<#
.SYNOPSIS
    Step3_OnboardValidate-SecurityInsight-OpenAI-PAYG-Instance-Azure - engine script in the SecurityInsight solution.

================================================================================
Step3_OnboardValidate-SecurityInsight-OpenAI-PAYG-Instance-Azure.ps1
================================================================================
PURPOSE
  Deploy (or reuse) an Azure OpenAI account (PAYG) and a model deployment using
  ON-DEMAND / PAY-PER-USE where possible (NO PTU).

USAGE
  Preferred: run via the Step 4 launcher (no CLI args needed, reads auth + config
  from LauncherConfig.custom.ps1 in the same folder):
    .\LAUNCHERS\Step3_OnboardValidate-SecurityInsight-OpenAI-PAYG-Instance-Azure\launcher.community-vm.template.ps1

  Direct invocation (rare -- engine defaults in $ScriptDefaults):
    .\Step3_OnboardValidate-SecurityInsight-OpenAI-PAYG-Instance-Azure.ps1

  Override params at invocation:
    .\Step3_OnboardValidate-SecurityInsight-OpenAI-PAYG-Instance-Azure.ps1 -AccountName "security-insight-02" -DeploymentName "chat" -Verbose

  Force a model (still tries SKUs if needed):
    .\Step3_OnboardValidate-SecurityInsight-OpenAI-PAYG-Instance-Azure.ps1 -ModelName "gpt-4" -ModelVersion "latest" -Verbose
================================================================================

.NOTES
    Requirements:
      PowerShell 7 (pwsh). Windows PowerShell 5.1 is refused at once (#Requires -Version 7.0).
      Role: Contributor (or Cognitive Services Contributor) -- on the resource group
      Hosts: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net, www.powershellgallery.com
    Solution       : SecurityInsight
    File           : Step3_OnboardValidate-SecurityInsight-OpenAI-PAYG-Instance-Azure.ps1
    Developed by   : Morten Knudsen, Microsoft MVP
    Blog           : https://mortenknudsen.net  (alias https://aka.ms/morten)
    GitHub         : https://github.com/KnudsenMorten
    Support        : For public repos, open a GitHub Issue on that solution's repo.


.LINK
    https://invardia.com/docs/si/scripts/Validate-SIOpenAI/
#>
[CmdletBinding(SupportsShouldProcess)]
param(
    [string]$SubscriptionId,
    [string]$ResourceGroupName,
    [string]$Location,
    [string]$AccountName,
    [string]$DeploymentName,

    # Optional: if not passed, script auto-selects a supported model for the account + region
    [string]$ModelName,
    [string]$ModelVersion,

    # If omitted, PS 5.1 may treat it as 0 => we treat 0 as "not provided"
    [int]$Capacity,

    [ValidateSet("Enabled","Disabled")]
    [string]$PublicNetworkAccess,

    # #1102 (framework rule 11): the install is PRIVATE (its private-network answer). Without it the install's database server
    # is read: public network access off = private. A private install never gets an account with public access.
    [switch]$PrivateNetwork,
    # The install's resource group, where its database server is read (default: -ResourceGroupName).
    [string]$InstallResourceGroupName,

    [switch]$WaitForAccountReady,
    [ValidateRange(2,120)]
    [int]$WaitIntervalSeconds = 5,
    [ValidateRange(30,1800)]
    [int]$WaitTimeoutSeconds = 300,

    # Which deployment SKUs to try, in order.
    # Keep Standard first to prefer on-demand / pay-per-use.
    [string[]]$DeploymentSkuOrder,

    # If set, writes model dumps to disk when selection/deploy fails
    [switch]$WriteModelDumps,

    # When $true, no resources are created or modified -- the engine just
    # verifies each resource exists and prints the same summary block you'd
    # get after a real provisioning run. Useful for re-running Step3 as an
    # ongoing "is my OpenAI still healthy?" check without making changes.
    [switch]$ValidateOnly
)

#Requires -Version 7.0
# SecurityInsight 3.0.79 -- Validate-SIOpenAI.ps1, standalone (Community edition). Built 2026-11-09T20:28:39Z from commit c1472e2f4c240c971c9559f07eef7e794b322001, source SOLUTIONS/SecurityInsight/setup/Validate-SIOpenAI.ps1,
# by release/Build-SISupportScripts.ps1 (framework SUPPORT-DL-1). Download: Invoke-WebRequest https://invardia.com/support/si/Validate-SIOpenAI.ps1 -OutFile Validate-SIOpenAI.ps1
# It carries the 165 SecurityInsight file(s) the script loads (listed in $__siSupportFiles below, readable, each line
# prefixed with "|"); at run time it writes them to a private temporary folder, checks each SHA-256, runs the original
# script from there with your parameters, and removes the folder. No PowerShell modules are needed.
$script:SIScriptVersion = '3.0.79'   # SI #547: the version this copy reports first (stamped into its embedded setup/_shared/SI-ScriptRun.ps1 too)
$__siSupportVersion = '3.0.79'
$__siSupportEntry = 'setup/Validate-SIOpenAI.ps1'
$__siSupportFiles = [ordered]@{}
$__siSupportFiles['setup/Validate-SIOpenAI.ps1'] = @{ Sha256 = '16e2b86f20fd27f7ce491bd5e5de000a932cf235124f668adba144b97c8d12ad'; Text = @'
|<#
|.SYNOPSIS
|    Step3_OnboardValidate-SecurityInsight-OpenAI-PAYG-Instance-Azure - engine script in the SecurityInsight solution.
|
|================================================================================
|Step3_OnboardValidate-SecurityInsight-OpenAI-PAYG-Instance-Azure.ps1
|================================================================================
|PURPOSE
|  Deploy (or reuse) an Azure OpenAI account (PAYG) and a model deployment using
|  ON-DEMAND / PAY-PER-USE where possible (NO PTU).
|
|USAGE
|  Preferred: run via the Step 4 launcher (no CLI args needed, reads auth + config
|  from LauncherConfig.custom.ps1 in the same folder):
|    .\LAUNCHERS\Step3_OnboardValidate-SecurityInsight-OpenAI-PAYG-Instance-Azure\launcher.community-vm.template.ps1
|
|  Direct invocation (rare -- engine defaults in $ScriptDefaults):
|    .\Step3_OnboardValidate-SecurityInsight-OpenAI-PAYG-Instance-Azure.ps1
|
|  Override params at invocation:
|    .\Step3_OnboardValidate-SecurityInsight-OpenAI-PAYG-Instance-Azure.ps1 -AccountName "security-insight-02" -DeploymentName "chat" -Verbose
|
|  Force a model (still tries SKUs if needed):
|    .\Step3_OnboardValidate-SecurityInsight-OpenAI-PAYG-Instance-Azure.ps1 -ModelName "gpt-4" -ModelVersion "latest" -Verbose
|================================================================================
|
|.NOTES
|    Solution       : SecurityInsight
|    File           : Step3_OnboardValidate-SecurityInsight-OpenAI-PAYG-Instance-Azure.ps1
|    Developed by   : Morten Knudsen, Microsoft MVP
|    Blog           : https://mortenknudsen.net  (alias https://aka.ms/morten)
|    GitHub         : https://github.com/KnudsenMorten
|    Support        : For public repos, open a GitHub Issue on that solution's repo.
|
|
|.LINK
|    https://invardia.com/docs/si/scripts/Validate-SIOpenAI/
|#>
|
|[CmdletBinding(SupportsShouldProcess)]
|param(
|    [string]$SubscriptionId,
|    [string]$ResourceGroupName,
|    [string]$Location,
|    [string]$AccountName,
|    [string]$DeploymentName,
|
|    # Optional: if not passed, script auto-selects a supported model for the account + region
|    [string]$ModelName,
|    [string]$ModelVersion,
|
|    # If omitted, PS 5.1 may treat it as 0 => we treat 0 as "not provided"
|    [int]$Capacity,
|
|    [ValidateSet("Enabled","Disabled")]
|    [string]$PublicNetworkAccess,
|
|    # #1102 (framework rule 11): the install is PRIVATE (its private-network answer). Without it the install's database server
|    # is read: public network access off = private. A private install never gets an account with public access.
|    [switch]$PrivateNetwork,
|    # The install's resource group, where its database server is read (default: -ResourceGroupName).
|    [string]$InstallResourceGroupName,
|
|    [switch]$WaitForAccountReady,
|    [ValidateRange(2,120)]
|    [int]$WaitIntervalSeconds = 5,
|    [ValidateRange(30,1800)]
|    [int]$WaitTimeoutSeconds = 300,
|
|    # Which deployment SKUs to try, in order.
|    # Keep Standard first to prefer on-demand / pay-per-use.
|    [string[]]$DeploymentSkuOrder,
|
|    # If set, writes model dumps to disk when selection/deploy fails
|    [switch]$WriteModelDumps,
|
|    # When $true, no resources are created or modified -- the engine just
|    # verifies each resource exists and prints the same summary block you'd
|    # get after a real provisioning run. Useful for re-running Step3 as an
|    # ongoing "is my OpenAI still healthy?" check without making changes.
|    [switch]$ValidateOnly
|)
|
|#Requires -Version 7.0   # after the help and the param block: before the help, it hides the help from Get-Help
|
|# framework section 12.7 / 12.10: the documentation link first, a transcript of the run, -WhatIf writes nothing
|. ([IO.Path]::Combine($PSScriptRoot, '_shared', 'SI-ScriptRun.ps1'))
|$siRun = Start-SIScriptRun -Script 'Validate-SIOpenAI' -Quiet:($false)
|if ($WhatIfPreference) { $ValidateOnly = $true; $WriteModelDumps = $false }   # -WhatIf = check only: nothing is created, no files written
|try {
|
|Set-StrictMode -Version Latest
|$ErrorActionPreference = "Stop"
|
|#region ================= HOST / PATH SAFETY ======================
|# $PSScriptRoot is only populated when running from a .ps1 file context.
|# If this script is pasted into a console/ISE, it can be empty -> Join-Path fails.
|$ScriptRoot = if ($PSScriptRoot -and -not [string]::IsNullOrWhiteSpace($PSScriptRoot)) {
|    $PSScriptRoot
|} else {
|    (Get-Location).Path
|}
|#endregion =======================================================
|
|# ----------------------------------------------------------------------
|#  Azure over plain REST -- no PowerShell modules (#305)
|# ----------------------------------------------------------------------
|. ([IO.Path]::Combine($ScriptRoot, '_shared', 'SI-SetupAzure.ps1'))
|# A resource group this script creates gets the setup tags (product, ring, edition, hosting, tenant, owner, purpose).
|. (Join-Path $ScriptRoot '_shared\SI-SetupNaming.ps1')
|# #1102: a private install's account follows rule 11 (Test-SISqlServerPrivate, Get-SIOpenAIPrivatePlan)
|. (Join-Path $ScriptRoot '_shared\SI-SetupArm.ps1')
|. (Join-Path $ScriptRoot '_shared\SI-OpenAIPrivate.ps1')
|function Get-SISetupRgTag {
|    $ring    = if (@('r0', 'r1', 'r2', 'prod') -contains "$($global:SI_Ring)".Trim()) { "$($global:SI_Ring)".Trim() } else { 'prod' }
|    $hosting = if ("$($global:SI_Bootstrap_ResourceGroupName)".Trim()) { 'ca' } else { 'vm' }
|    $edition = Resolve-SISetupEdition -SIRoot (Split-Path -Parent $ScriptRoot) -LicenceValue ([string]$global:SI_License)
|    ConvertTo-SIAzTagHashtable -Tags (Get-SIResourceGroupTags -Ring $ring -Edition $edition -Hosting $hosting -Tenant (Resolve-SITenantTag) -Owner ([string]$global:SI_Owner))
|}
|#region ================= API VERSIONING ==========================
|# Management-plane API version (ARM) used for:
|# - accounts
|# - deployments
|# - models listing
|# - listKeys
|$ApiVersion = "2024-10-01"
|
|# Data-plane inference API version (Azure OpenAI inference endpoint).
|# This is NOT used for ARM calls. Kept separate for clarity/output.
|$InferenceApiVersion = "2025-01-01-preview"
|#endregion =======================================================
|
|#region ================= LAUNCHER-SUPPLIED DEFAULTS =================
|# This engine is launcher-driven. All customer-specific values
|# (SubscriptionId, ResourceGroupName, Location, AccountName, DeploymentName)
|# MUST be supplied by the launcher -- either as -SubscriptionId etc.
|# parameters, or by setting matching $global:* variables before the
|# engine is invoked.
|#
|# The defaults here are PLATFORM-NEUTRAL only -- model preference,
|# capacity, SKU order, etc. They are safe to ship to the community repo.
|$ScriptDefaults = @{
|    SubscriptionId      = $global:SubscriptionId
|    ResourceGroupName   = $global:ResourceGroupName
|    Location            = $global:Location
|    AccountName         = $global:AccountName
|    DeploymentName      = $global:DeploymentName
|
|    # Preferred default (may not be supported; script will try others)
|    ModelName           = if ($global:ModelName)    { $global:ModelName }    else { 'gpt-4.1-mini' }
|    ModelVersion        = if ($global:ModelVersion) { $global:ModelVersion } else { 'latest' }
|
|    Capacity            = if ($global:Capacity)            { [int]$global:Capacity }            else { 100 }
|    PublicNetworkAccess = if ($global:PublicNetworkAccess) { $global:PublicNetworkAccess }      else { 'Enabled' }
|    WaitForAccountReady = if ($null -ne $global:WaitForAccountReady) { [bool]$global:WaitForAccountReady } else { $true }
|
|    DeploymentSkuOrder  = if ($global:DeploymentSkuOrder) { @($global:DeploymentSkuOrder) } else { @('GlobalStandard') }
|
|    WriteModelDumps     = if ($null -ne $global:WriteModelDumps) { [bool]$global:WriteModelDumps } else { $true }
|}
|
|# Hard guard: customer-specific values must be present (from launcher or -param)
|foreach ($req in 'SubscriptionId','ResourceGroupName','Location','AccountName','DeploymentName') {
|    $fromParam = (Get-Variable -Name $req -Scope Local -ErrorAction Ignore).Value
|    $fromDefaults = $ScriptDefaults[$req]
|    if ([string]::IsNullOrWhiteSpace([string]$fromParam) -and [string]::IsNullOrWhiteSpace([string]$fromDefaults)) {
|        throw "Step3_OnboardValidate-SecurityInsight-OpenAI-PAYG-Instance-Azure: '$req' must be supplied by the launcher (set -$req or `$global:$req)."
|    }
|}
|
|$AlwaysVerbose = $true
|#endregion =======================================================
|
|#region ================= LOGGING HELPERS =========================
|function Write-Log {
|    param(
|        [Parameter(Mandatory=$true)][ValidateSet("INFO","WARN","ERROR","DEBUG")][string]$Level,
|        [Parameter(Mandatory=$true)][string]$Message
|    )
|    $ts = (Get-Date).ToString("yyyy-MM-dd HH:mm:ss")
|    switch ($Level) {
|        "INFO"  { Write-Host "[$ts] [INFO ] $Message" }
|        "WARN"  { Write-Host "[$ts] [WARN ] $Message" -ForegroundColor Yellow }
|        "ERROR" { Write-Host "[$ts] [ERROR] $Message" -ForegroundColor Red }
|        "DEBUG" {
|            if ($AlwaysVerbose -or $PSBoundParameters.ContainsKey('Verbose')) {
|                Write-Host "[$ts] [DEBUG] $Message" -ForegroundColor White
|            }
|        }
|    }
|}
|
|function Write-Section {
|    param([string]$Title)
|    Write-Host ""
|    Write-Host $Title
|    Write-Host ("-" * $Title.Length)
|}
|
|#endregion =======================================================
|
|#region ================= DEFAULT RESOLUTION ======================
|function Use-DefaultIfEmpty {
|    param([string]$Name, $Value)
|    if ($null -eq $Value) { return $ScriptDefaults[$Name] }
|    if ($Value -is [string] -and [string]::IsNullOrWhiteSpace($Value)) { return $ScriptDefaults[$Name] }
|    return $Value
|}
|function Use-DefaultIfNullOrZero {
|    param([string]$Name, $Value)
|    if ($null -eq $Value) { return $ScriptDefaults[$Name] }
|    if ($Value -is [ValueType] -and $Value -eq 0) { return $ScriptDefaults[$Name] }
|    return $Value
|}
|
|Write-Section "1) Parameter Resolution"
|
|$SubscriptionId      = Use-DefaultIfEmpty            "SubscriptionId"      $SubscriptionId
|$ResourceGroupName   = Use-DefaultIfEmpty            "ResourceGroupName"   $ResourceGroupName
|$Location            = Use-DefaultIfEmpty            "Location"            $Location
|$AccountName         = Use-DefaultIfEmpty            "AccountName"         $AccountName
|$DeploymentName      = Use-DefaultIfEmpty            "DeploymentName"      $DeploymentName
|$ModelName           = Use-DefaultIfEmpty            "ModelName"           $ModelName
|$ModelVersion        = Use-DefaultIfEmpty            "ModelVersion"        $ModelVersion
|$Capacity            = [int](Use-DefaultIfNullOrZero "Capacity"            $Capacity)
|$PublicNetworkAccess = Use-DefaultIfEmpty            "PublicNetworkAccess" $PublicNetworkAccess
|
|if (-not $PSBoundParameters.ContainsKey("WaitForAccountReady")) {
|    $WaitForAccountReady = [bool]$ScriptDefaults.WaitForAccountReady
|}
|
|if (-not $PSBoundParameters.ContainsKey("DeploymentSkuOrder") -or -not $DeploymentSkuOrder -or $DeploymentSkuOrder.Count -eq 0) {
|    $DeploymentSkuOrder = [string[]]$ScriptDefaults.DeploymentSkuOrder
|}
|
|if (-not $PSBoundParameters.ContainsKey("WriteModelDumps")) {
|    $WriteModelDumps = [bool]$ScriptDefaults.WriteModelDumps
|}
|
|Write-Log INFO  "SubscriptionId        : $SubscriptionId"
|Write-Log INFO  "ResourceGroupName     : $ResourceGroupName"
|Write-Log INFO  "Location              : $Location"
|Write-Log INFO  "AccountName           : $AccountName"
|Write-Log INFO  "DeploymentName        : $DeploymentName"
|Write-Log INFO  "Requested Model       : $ModelName ($ModelVersion)"
|Write-Log INFO  "Capacity              : $Capacity"
|Write-Log INFO  "PublicNetworkAccess   : $PublicNetworkAccess"
|Write-Log INFO  "WaitForAccountReady   : $WaitForAccountReady"
|Write-Log INFO  "SKU order             : $($DeploymentSkuOrder -join ', ')"
|Write-Log INFO  "WriteModelDumps       : $WriteModelDumps"
|Write-Log DEBUG "Mgmt ApiVersion (ARM) : $ApiVersion"
|Write-Log DEBUG "Infer ApiVersion      : $InferenceApiVersion"
|Write-Log DEBUG "ScriptRoot            : $ScriptRoot"
|#endregion =======================================================
|
|#region ================= SANITY CHECKS ===========================
|Write-Section "2) Sanity Checks"
|
|if ([string]::IsNullOrWhiteSpace($SubscriptionId))     { throw "SubscriptionId is empty." }
|if ([string]::IsNullOrWhiteSpace($ResourceGroupName))  { throw "ResourceGroupName is empty." }
|if ([string]::IsNullOrWhiteSpace($Location))           { throw "Location is empty." }
|if ([string]::IsNullOrWhiteSpace($AccountName))        { throw "AccountName is empty." }
|if ([string]::IsNullOrWhiteSpace($DeploymentName))     { throw "DeploymentName is empty." }
|if ($Capacity -lt 1)                                  { throw "Capacity must be >= 1." }
|if ($AccountName -notmatch '^[a-z0-9-]{2,63}$') {
|    throw "AccountName '$AccountName' is invalid. Use 2-63 chars: lowercase letters, numbers, hyphen."
|}
|Write-Log INFO "Sanity checks passed."
|#endregion =======================================================
|
|#region ================= AZURE HELPERS ===========================
|# Each helper that calls Azure turns strict mode OFF for its own scope: the shared REST layer (SI-SetupAzure.ps1 and
|# the engine files it loads) reads optional globals that a launcher may not have set, which strict mode -- set for
|# this script at the top -- turns into errors. Strict mode stays on for everything else in this script.
|function Initialize-SIOpenAIAzureSignIn {
|    # Reuses a sign-in already made in this PowerShell session; otherwise a person signs in (automatically in Azure
|    # Cloud Shell, else in the browser). No PowerShell module.
|    Set-StrictMode -Off
|    if (-not (Get-SISetupAzureContext)) {
|        Write-Log INFO "Not signed in to Azure yet. Signing in (in your browser, or automatically in Azure Cloud Shell)..."
|        $null = Connect-SISetupAzure -SubscriptionId $SubscriptionId
|    }
|    Write-Log INFO "Selecting subscription: $SubscriptionId"
|    $null = Set-SIAzContext -Subscription $SubscriptionId
|}
|
|function Ensure-ResourceGroup {
|    Set-StrictMode -Off
|    $rg =Get-SIAzResourceGroup -Name $ResourceGroupName -ErrorAction SilentlyContinue
|    if (-not $rg) {
|        if ($ValidateOnly) {
|            Write-Log WARN "[ValidateOnly] Resource group '$ResourceGroupName' NOT FOUND in '$Location'. Skipping create."
|            $script:Status_ResourceGroup = 'MISSING'
|            return
|        }
|        Write-Log INFO "Resource group '$ResourceGroupName' not found. Creating in '$Location'..."
|        New-SIAzResourceGroup -Name $ResourceGroupName -Location $Location -Tag (Get-SISetupRgTag) | Out-Null
|        $script:Status_ResourceGroup = 'CREATED'
|    } else {
|        Write-Log INFO "Resource group '$ResourceGroupName' already exists (location: $($rg.Location))."
|        $script:Status_ResourceGroup = 'REUSED'
|    }
|}
|
|# Use ${ResourceId} when appending ?api-version to avoid "$ResourceId?api" parsing
|function Invoke-Get {
|    param([string]$ResourceId, [string]$ApiVersion)
|    Set-StrictMode -Off
|    $path = "${ResourceId}?api-version=${ApiVersion}"
|    Write-Log DEBUG "GET  $path"
|    $res = Invoke-SIAzRestMethod -Method GET -Path $path -ErrorAction SilentlyContinue
|    if ($res.StatusCode -eq 404) { return $null }
|    if ($res.Content) { return ($res.Content | ConvertFrom-Json) }
|}
|
|function Invoke-Put {
|    param([string]$ResourceId, [string]$ApiVersion, $Body)
|    Set-StrictMode -Off
|    $json =$Body | ConvertTo-Json -Depth 80 -Compress
|    $path = "${ResourceId}?api-version=${ApiVersion}"
|    Write-Log DEBUG "PUT  $path"
|    Write-Log DEBUG "Body $json"
|    $res = Invoke-SIAzRestMethod -Method PUT -Path $path -Payload $json
|    Write-Log DEBUG "StatusCode: $($res.StatusCode)"
|    if ($res.StatusCode -notin 200,201) {
|        throw "PUT failed ($($res.StatusCode)): $($res.Content)"
|    }
|    if ($res.Content) { return ($res.Content | ConvertFrom-Json) }
|}
|
|function Invoke-Post {
|    param([string]$Path, [string]$Payload)
|    Set-StrictMode -Off
|    Write-Log DEBUG "POST $Path"
|    $res = Invoke-SIAzRestMethod -Method POST -Path $Path -Payload $Payload
|    Write-Log DEBUG "StatusCode: $($res.StatusCode)"
|    return $res
|}
|
|function Wait-ForProvisioningState {
|    param(
|        [string]$ResourceId,
|        [string]$ApiVersion,
|        [string]$DesiredState,
|        [int]$IntervalSeconds,
|        [int]$TimeoutSeconds
|    )
|    $deadline = (Get-Date).AddSeconds($TimeoutSeconds)
|    while ($true) {
|        $obj = Invoke-Get -ResourceId $ResourceId -ApiVersion $ApiVersion
|        $state = $null
|        if ($obj -and $obj.properties -and $obj.properties.provisioningState) {
|            $state = [string]$obj.properties.provisioningState
|        }
|        Write-Log INFO "ProvisioningState: $state (waiting for '$DesiredState')"
|        if ($state -eq $DesiredState) { return $obj }
|        if ((Get-Date) -ge $deadline) {
|            throw "Timeout waiting for provisioningState='$DesiredState' (last state: '$state')."
|        }
|        Start-Sleep -Seconds $IntervalSeconds
|    }
|}
|
|function Get-AccountKeys {
|    param([string]$AccountId, [string]$ApiVersion)
|    $path = "${AccountId}/listKeys?api-version=${ApiVersion}"
|    $res = Invoke-Post -Path $path -Payload "{}"
|    if ($res.StatusCode -notin 200,201) {
|        throw "listKeys failed ($($res.StatusCode)): $($res.Content)"
|    }
|    return ($res.Content | ConvertFrom-Json)
|}
|
|function Try-ParseAzureErrorMessage {
|    param([string]$ExceptionMessage)
|
|    # The thrown message usually contains the JSON body. Try to extract "message":"..."
|    if ($ExceptionMessage -match '"message"\s*:\s*"([^"]+)"') { return $matches[1] }
|    return $ExceptionMessage
|}
|#endregion =======================================================
|
|#region ================= ACCOUNT MODEL DISCOVERY =================
|function Get-AccountModels {
|    param([string]$AccountId, [string]$ApiVersion)
|
|    $rid = "${AccountId}/models"
|    Write-Log INFO "Querying supported models for this Azure OpenAI account..."
|    $result = Invoke-Get -ResourceId $rid -ApiVersion $ApiVersion
|
|    $models = @()
|    if ($result -and $result.value) { $models = @($result.value) }
|
|    Write-Log INFO ("Account models returned: " + $models.Count)
|
|    if (($AlwaysVerbose -or $PSBoundParameters.ContainsKey('Verbose')) -and $models.Count -gt 0) {
|        Write-Log DEBUG ("Sample account model item: " + (($models | Select-Object -First 1) | ConvertTo-Json -Depth 18))
|    }
|
|    return $models
|}
|
|function Normalize-AccountModelsToCandidates {
|    param([object[]]$AccountModels)
|
|    function Get-PropValue { param($Obj,[string]$PropName)
|        $p = $Obj.PSObject.Properties[$PropName]
|        if ($null -eq $p) { return $null }
|        return $p.Value
|    }
|
|    $norm = @()
|    foreach ($m in $AccountModels) {
|        $name = Get-PropValue $m "name"
|        $ver  = Get-PropValue $m "version"
|        $fmt  = Get-PropValue $m "format"
|
|        if ($name) {
|            $norm += [pscustomobject]@{
|                Name    = [string]$name
|                Version = if ($ver) { [string]$ver } else { $null }
|                Format  = if ($fmt) { [string]$fmt } else { $null }
|                Raw     = $m
|            }
|        }
|    }
|
|    return $norm
|}
|
|function Build-OrderedCandidates {
|    param(
|        [Parameter(Mandatory=$true)][object[]]$Candidates,
|        [Parameter(Mandatory=$true)][string[]]$PreferenceNames
|    )
|
|    # Prefer OpenAI format if present
|    $c = $Candidates
|    $openAiFmt = $Candidates | Where-Object { $_.Format -and $_.Format -ieq "OpenAI" }
|    if ($openAiFmt -and $openAiFmt.Count -gt 0) { $c = $openAiFmt }
|
|    $ordered = @()
|
|    foreach ($p in $PreferenceNames) {
|        $hit = $c | Where-Object { $_.Name -ieq $p } | Select-Object -First 1
|        if ($hit) { $ordered += $hit }
|    }
|
|    $restGpt = $c | Where-Object { $_.Name -match '^gpt' } | Where-Object { $ordered.Name -notcontains $_.Name }
|    $ordered += $restGpt
|
|    $restOther = $c | Where-Object { $ordered.Name -notcontains $_.Name }
|    $ordered += $restOther
|
|    return $ordered
|}
|#endregion =======================================================
|
|#region ================= DEPLOYMENT WITH FALLBACK =================
|function New-DeploymentWithSkuAndModelFallback {
|    param(
|        [Parameter(Mandatory=$true)][string]$DeploymentId,
|        [Parameter(Mandatory=$true)][string]$ApiVersion,
|        [Parameter(Mandatory=$true)][int]$Capacity,
|        [Parameter(Mandatory=$true)][object[]]$CandidateModels,
|        [Parameter(Mandatory=$true)][string[]]$SkuOrder
|    )
|
|    foreach ($skuName in $SkuOrder) {
|        foreach ($c in $CandidateModels) {
|
|            $mn = $c.Name
|            $mv = $c.Version
|            if ([string]::IsNullOrWhiteSpace($mv)) { $mv = "latest" }
|
|            Write-Log INFO "Attempting deployment: sku=$skuName, model=$mn ($mv), capacity=$Capacity"
|
|            try {
|                Invoke-Put -ResourceId $DeploymentId -ApiVersion $ApiVersion -Body @{
|                    properties = @{
|                        model = @{
|                            format  = "OpenAI"
|                            name    = $mn
|                            version = $mv
|                        }
|                    }
|                    sku = @{
|                        name     = $skuName
|                        capacity = $Capacity
|                    }
|                } | Out-Null
|
|                return [pscustomobject]@{
|                    Sku     = $skuName
|                    Name    = $mn
|                    Version = $mv
|                    Status  = "Succeeded"
|                }
|            }
|            catch {
|                $azMsg = Try-ParseAzureErrorMessage -ExceptionMessage $_.Exception.Message
|
|                # Continue for known "try next" errors
|                if ($azMsg -match "SKU '.*'.*not supported" -or
|                    $azMsg -match "not supported in this region" -or
|                    $azMsg -match "DeploymentModelNotSupported" -or
|                    $azMsg -match "InvalidResourceProperties") {
|
|                    Write-Log WARN "Rejected (will try next): sku=$skuName, model=$mn ($mv)"
|                    Write-Log WARN "Azure says: $azMsg"
|                    continue
|                }
|
|                # Unknown/critical error: stop immediately
|                Write-Log ERROR "Deployment failed with non-retryable error."
|                Write-Log ERROR "sku=$skuName, model=$mn ($mv)"
|                Write-Log ERROR "Azure says: $azMsg"
|                throw
|            }
|        }
|    }
|
|    throw "No candidate model could be deployed with the configured SKU order ($($SkuOrder -join ', ')) in region '$Location'."
|}
|#endregion =======================================================
|
|#region ================= MAIN ===============================
|Write-Section "3) Azure Auth + Subscription"
|Initialize-SIOpenAIAzureSignIn
|
|$AccountId    = "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.CognitiveServices/accounts/$AccountName"
|$DeploymentId = "${AccountId}/deployments/${DeploymentName}"
|
|# #1102 (framework rule 11; only logs / the data collection endpoint may stay public, rule 11f): on a PRIVATE install no
|# account is created with public access and none is switched to it. Decided BEFORE anything is created (the resource group
|# included); a read that fails stops the script with nothing created.
|Write-Section "3b) Private install?"
|$__priv = & {
|    Set-StrictMode -Off
|    Test-SIOpenAIInstallPrivate -PrivateNetwork ([bool]$PrivateNetwork) -SubscriptionId $SubscriptionId `
|        -ResourceGroupName $(if ($InstallResourceGroupName) { $InstallResourceGroupName } else { $ResourceGroupName })
|}
|$__plan = Get-SIOpenAIPrivatePlan -Private ([bool]$__priv.Private) -Account $(if ($__priv.Private) { Invoke-Get -ResourceId $AccountId -ApiVersion $ApiVersion } else { $null }) -AccountName $AccountName
|if ($__priv.Private) { Write-Log INFO ("The install is private ({0})." -f $__priv.Why) } else { Write-Log INFO "The install is not private." }
|if ($__plan.Action -eq 'refuse') {
|    Write-Log WARN $__plan.Line
|    $global:BuildSummaryByAI = $false
|    return
|}
|if ($__plan.Action -in 'report', 'reuse') { Write-Log $(if ($__plan.Action -eq 'report') { 'WARN' } else { 'INFO' }) $__plan.Line }
|
|Write-Section "4) Resource Group"
|Ensure-ResourceGroup
|
|Write-Section "5) Azure OpenAI Account (PAYG)"
|Write-Log INFO "Account ResourceId: $AccountId"
|Write-Log INFO "Creating/reusing account: kind=OpenAI, sku=S0 (PAYG)"
|
|$account = Invoke-Get -ResourceId $AccountId -ApiVersion $ApiVersion
|if (-not $account) {
|    if ($ValidateOnly) {
|        Write-Log WARN "[ValidateOnly] Azure OpenAI account '$AccountName' NOT FOUND. Skipping create."
|        $script:Status_Account = 'MISSING'
|    } elseif ($__priv.Private) {
|        # #1102: never reached in practice (the plan refused above) -- the create below always sends public access
|        Write-Log WARN $script:SIOpenAIPrivateRefusal
|        $global:BuildSummaryByAI = $false
|        return
|    } else {
|        Write-Log INFO "Account does not exist -> creating..."
|        Invoke-Put -ResourceId $AccountId -ApiVersion $ApiVersion -Body @{
|            location = $Location
|            kind     = "OpenAI"
|            sku      = @{ name = "S0" }
|            properties = @{
|                customSubDomainName = $AccountName
|                publicNetworkAccess = $PublicNetworkAccess
|                networkAcls = @{
|                    defaultAction       = "Allow"
|                    ipRules             = @()
|                    virtualNetworkRules = @()
|                }
|            }
|            tags = @{}
|        } | Out-Null
|        Write-Log INFO "Account create request sent."
|        $script:Status_Account = 'CREATED'
|    }
|} else {
|    Write-Log INFO "Account already exists -> skipping create."
|    $script:Status_Account = 'REUSED'
|}
|
|if ($WaitForAccountReady) {
|    Write-Section "5b) Wait for Account Ready"
|    $account = Wait-ForProvisioningState -ResourceId $AccountId -ApiVersion $ApiVersion -DesiredState "Succeeded" `
|        -IntervalSeconds $WaitIntervalSeconds -TimeoutSeconds $WaitTimeoutSeconds
|} else {
|    $account = Invoke-Get -ResourceId $AccountId -ApiVersion $ApiVersion
|}
|
|Write-Section "6) Model Discovery (Account Scoped)"
|$acctModels = Get-AccountModels -AccountId $AccountId -ApiVersion $ApiVersion
|
|if ($WriteModelDumps) {
|    # ensure target folder exists
|    if (-not (Test-Path -LiteralPath $ScriptRoot)) {
|        New-Item -ItemType Directory -Path $ScriptRoot -Force | Out-Null
|    }
|
|    $dumpRaw = Join-Path -Path $ScriptRoot -ChildPath ("account-models-raw-" + $AccountName + ".json")
|    $acctModels | ConvertTo-Json -Depth 30 | Out-File -FilePath $dumpRaw -Encoding utf8
|    Write-Log INFO "Wrote raw account models to: $dumpRaw"
|}
|
|$candidatesAll = Normalize-AccountModelsToCandidates -AccountModels $acctModels
|Write-Log INFO ("Normalized candidates: " + $candidatesAll.Count)
|
|Write-Section "7) Model Selection + Deployment (Fallback by SKU & Model)"
|
|$UserForcedModel = $false
|if ($PSBoundParameters.ContainsKey("ModelName") -or $PSBoundParameters.ContainsKey("ModelVersion")) {
|    $UserForcedModel = $true
|    Write-Log INFO "Model was provided via runtime parameters -> will deploy using that model (but still try SKU fallbacks)."
|}
|
|if ($UserForcedModel) {
|    $ordered = @([pscustomobject]@{ Name=$ModelName; Version=$ModelVersion; Format="OpenAI"; Raw=$null })
|} else {
|    # Preference list (edit freely)
|    $preference = @(
|        "gpt-4.1-mini",
|        "gpt-4.1",
|        "gpt-4",
|        "gpt-35-turbo"
|    )
|
|    $ordered = Build-OrderedCandidates -Candidates $candidatesAll -PreferenceNames $preference
|    $preview = $ordered | Select-Object -First 12
|    $previewText = ($preview | ForEach-Object {
|        if ($_.Version) { "$($_.Name) ($($_.Version))" } else { "$($_.Name) (latest)" }
|    }) -join ", "
|    Write-Log INFO ("Top candidates to try: " + $previewText)
|
|    if ($WriteModelDumps) {
|        if (-not (Test-Path -LiteralPath $ScriptRoot)) {
|            New-Item -ItemType Directory -Path $ScriptRoot -Force | Out-Null
|        }
|
|        $dumpNorm = Join-Path -Path $ScriptRoot -ChildPath ("account-models-normalized-" + $AccountName + ".json")
|        $ordered | Select-Object Name,Version,Format | ConvertTo-Json -Depth 5 | Out-File -FilePath $dumpNorm -Encoding utf8
|        Write-Log INFO "Wrote normalized candidate list to: $dumpNorm"
|    }
|}
|
|$DeploymentExists = Invoke-Get -ResourceId $DeploymentId -ApiVersion $ApiVersion
|if ($DeploymentExists) {
|    Write-Log INFO "Deployment already exists -> skipping create."
|    $script:Status_Deployment = 'REUSED'
|    # Capture the existing model info so the summary reflects reality, not the
|    # user's -ModelName/-ModelVersion request (which may not match what was deployed).
|    try {
|        $existingModel = $DeploymentExists.properties.model
|        if ($existingModel) {
|            $ModelName    = [string]$existingModel.name
|            $ModelVersion = [string]$existingModel.version
|        }
|    } catch { }
|} elseif ($ValidateOnly) {
|    Write-Log WARN "[ValidateOnly] Deployment '$DeploymentName' NOT FOUND. Skipping create."
|    $script:Status_Deployment = 'MISSING'
|} else {
|    Write-Log INFO "Deployment does not exist -> creating..."
|    $result = New-DeploymentWithSkuAndModelFallback -DeploymentId $DeploymentId -ApiVersion $ApiVersion -Capacity $Capacity `
|        -CandidateModels $ordered -SkuOrder $DeploymentSkuOrder
|
|    Write-Log INFO "Deployment succeeded!"
|    Write-Log INFO "Chosen SKU   : $($result.Sku)"
|    Write-Log INFO "Chosen Model : $($result.Name) ($($result.Version))"
|
|    # Update output variables to reflect what actually worked
|    $ModelName    = $result.Name
|    $ModelVersion = $result.Version
|    $script:Status_Deployment = 'CREATED'
|}
|
|Write-Section "8) Output (Endpoint + Keys)"
|$account = Invoke-Get -ResourceId $AccountId -ApiVersion $ApiVersion
|# Keys require the account to exist. In ValidateOnly mode when the account is
|# missing, skip the listKeys call so the summary can still render gracefully.
|$keys = $null
|if ($account) {
|    try { $keys = Get-AccountKeys -AccountId $AccountId -ApiVersion $ApiVersion } catch {
|        Write-Log WARN "Could not fetch account keys: $($_.Exception.Message)"
|    }
|} else {
|    Write-Log WARN "Account not present -- skipping listKeys."
|}
|
|$__endpoint = if ($account -and $account.properties -and $account.properties.endpoint) { $account.properties.endpoint } else { '(not found)' }
|$__key1     = if ($keys -and $keys.key1) { $keys.key1 } else { '(not available)' }
|$__key2     = if ($keys -and $keys.key2) { $keys.key2 } else { '(not available)' }
|
|Write-Host ""
|Write-Host "==================== RESULT ===================="
|Write-Host "AccountName : $AccountName"
|Write-Host "ResourceId  : $AccountId"
|Write-Host "Endpoint    : $__endpoint"
|Write-Host "Deployment  : $DeploymentName"
|Write-Host "Model       : $ModelName ($ModelVersion)"
|Write-Host "Account SKU : S0 (PAYG)"
|Write-Host "Deploy SKUs : Tried => $($DeploymentSkuOrder -join ', ')"
|Write-Host "Key1        : $__key1"
|Write-Host "Key2        : $__key2"
|Write-Host "================================================"
|Write-Host ""
|
|Write-Host "Example API call (Responses API style):"
|Write-Host "POST ${__endpoint}openai/responses?api-version=$InferenceApiVersion"
|Write-Host "Header: api-key: <key>"
|Write-Host "Body: { `"model`": `"$DeploymentName`", `"input`": `"hello`" }"
|Write-Host ""
|#endregion =======================================================
|
|Write-Section "9) PowerShell Variable Output (SecurityInsight - Copy/Paste Ready)"
|
|$AI_apiKey     = if ($keys) { $keys.key1 } else { $null }
|$AI_endpoint   = if ($account -and $account.properties -and $account.properties.endpoint) { $account.properties.endpoint.TrimEnd('/') } else { '' }
|$AI_deployment = $DeploymentName
|$AI_apiVersion = $InferenceApiVersion
|
|# ----------------------------------------------------------------------------
|# Provisioning summary -- matches the Step1 OnboardValidate format so ops can
|# eyeball a re-run and see exactly what was CREATED vs. REUSED vs. MISSING.
|# ----------------------------------------------------------------------------
|if (-not $script:Status_ResourceGroup) { $script:Status_ResourceGroup = 'UNKNOWN' }
|if (-not $script:Status_Account)       { $script:Status_Account       = 'UNKNOWN' }
|if (-not $script:Status_Deployment)    { $script:Status_Deployment    = 'UNKNOWN' }
|
|$__modeLabel = if ($ValidateOnly) { 'VALIDATE-ONLY (no writes)' } else { 'PROVISION' }
|
|Write-Host ""
|Write-Host "  ========= SecurityInsight Step3 -- Azure OpenAI provisioning summary =========" -ForegroundColor Cyan
|Write-Host ""
|Write-Host ("  Mode                  : {0}" -f $__modeLabel)        -ForegroundColor White
|Write-Host ("  Subscription          : {0}" -f $SubscriptionId)     -ForegroundColor White
|Write-Host ("  Resource Group        : {0}  [{1}]" -f $ResourceGroupName, $script:Status_ResourceGroup) -ForegroundColor White
|Write-Host ("  Azure OpenAI account  : {0}  [{1}]" -f $AccountName,       $script:Status_Account)       -ForegroundColor White
|Write-Host ("  Deployment            : {0}  [{1}]" -f $DeploymentName,    $script:Status_Deployment)    -ForegroundColor White
|Write-Host ("  Model                 : {0} ({1})" -f $ModelName, $ModelVersion) -ForegroundColor White
|Write-Host ("  Location              : {0}" -f $Location)           -ForegroundColor White
|Write-Host ("  Endpoint              : {0}" -f $AI_endpoint)        -ForegroundColor White
|Write-Host ""
|Write-Host "  Copy into LauncherConfig.custom.ps1 (SecurityInsight_RiskAnalysis):" -ForegroundColor Yellow
|Write-Host "  (the BuildSummaryByAI master toggle is REQUIRED -- without it, the engine ignores the OpenAI_* values and skips the AI summary entirely)" -ForegroundColor Yellow
|Write-Host ""
|Write-Host  "    `$Global:BuildSummaryByAI           = `$true"                     -ForegroundColor Green
|Write-Host ("    `$Global:OpenAI_apiKey              = `"{0}`"" -f $AI_apiKey)     -ForegroundColor White
|Write-Host ("    `$Global:OpenAI_endpoint            = `"{0}`"" -f $AI_endpoint)   -ForegroundColor White
|Write-Host ("    `$Global:OpenAI_deployment          = `"{0}`"" -f $AI_deployment) -ForegroundColor White
|Write-Host ("    `$Global:OpenAI_apiVersion          = `"{0}`"" -f $AI_apiVersion) -ForegroundColor White
|Write-Host  "    `$Global:OpenAI_MaxTokensPerRequest = 16384"                      -ForegroundColor White
|Write-Host ""
|
|# v2.1.210 -- expose the values as $global:* so the InitialDeployment orchestrator
|# (or any other parent script that runs Step3 via & or dot-source) can auto-capture
|# them and write straight into config/SecurityInsight.custom.ps1 -- no manual
|# copy/paste of the printed paste-block above.
|$global:BuildSummaryByAI           = $true
|$global:OpenAI_apiKey              = $AI_apiKey
|$global:OpenAI_endpoint            = $AI_endpoint
|$global:OpenAI_deployment          = $AI_deployment
|$global:OpenAI_apiVersion          = $AI_apiVersion
|$global:OpenAI_MaxTokensPerRequest = 16384
|
|# ----------------------------------------------------------------------------
|# Exit code: non-zero if -ValidateOnly found any MISSING resource
|# ----------------------------------------------------------------------------
|if ($ValidateOnly) {
|    $missing = @('ResourceGroup','Account','Deployment') | Where-Object { (Get-Variable -Name ("Status_" + $_) -Scope Script -ValueOnly) -eq 'MISSING' }
|    if ($missing.Count -gt 0) {
|        Write-Host ("  [VALIDATE] {0} resource(s) missing: {1}" -f $missing.Count, ($missing -join ', ')) -ForegroundColor Red
|        Write-Host  "  Re-run Step3 without -ValidateOnly to provision the missing pieces."              -ForegroundColor Red
|        exit 2
|    }
|    Write-Host "  [VALIDATE] All 3 resources present -- tenant is ready for RiskAnalysis -BuildSummaryByAI." -ForegroundColor Green
|}
|
|} finally { Stop-SIScriptRun -Run $siRun }
'@ }
$__siSupportFiles['setup/_shared/SI-ScriptRun.ps1'] = @{ Sha256 = 'a5c4d788d516521639611af43e1b88458216ce58bdb455885cac8e2a568afbd2'; Text = @'
|#Requires -Version 5.1
|<#
|    EVERY SCRIPT A PERSON RUNS (framework DOCS/REQUIREMENTS.md section 12.7 SCRIPT-DOC-1 + section 12.10 SECURITY-PACK-1; SI #481 / #484).
|    One helper, called first by each such script:
|
|      $siRun = Start-SIScriptRun -Script '<Script>'
|      try { ...the script... } finally { Stop-SIScriptRun -Run $siRun }
|
|    Start-SIScriptRun prints, as the script's FIRST line (SI #547, owner 2026-10-10: "do you provide the version in all
|    scripts, so i can troubleshoot better"):
|        <Script> version <version> - documentation: https://invardia.com/docs/si/scripts/<Script>/
|    (the page Invardia renders from the script's <Script>.doc.json). The transcript is started BEFORE that line is printed,
|    so the same line is also the first line of the transcript. The version (Get-SIScriptVersion), in this order:
|        1. the version stamped into a PUBLISHED copy: release\Build-SISupportScripts.ps1 rewrites the
|           $script:SIScriptVersionStamp line below in the copy of this file each self-contained script embeds;
|        2. the install / package / checkout this file sits in: BUILD.json (its display, e.g. 3.0.0-rc.12), else VERSION;
|        3. "unknown (not a released copy)".
|    It then says plainly when -WhatIf is on (nothing is changed). The transcript is a local file in ONE known folder:
|        Windows : %LOCALAPPDATA%\SecurityInsight\script-logs\<Script>-<yyyyMMdd-HHmmss>.log
|        others  : ~/.securityinsight/script-logs/<Script>-<yyyyMMdd-HHmmss>.log
|    Stop-SIScriptRun ends the transcript and prints its path. The transcript holds what the script printed -- the scripts
|    never print a secret value (section 12.10 "no secrets in, no secrets out"). A transcript that cannot be started (a host
|    without transcription, a read-only profile) is said and the script goes on: it never blocks the work.
|    The transcript and its folder are written even under -WhatIf (-WhatIf:$false): they are the record of what was
|    previewed, not a change to the customer's environment.
|    PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|# SI #547 -- the PUBLISH STAMP. Empty in the repository and the package; release\Build-SISupportScripts.ps1 writes the release
|# version here (Set-SIScriptVersionStamp) in the copy a self-contained script embeds. Keep this line's shape: the build
|# refuses to publish when it cannot find it.
|$script:SIScriptVersionStamp = '3.0.79'
|# the folder this helper lives in (setup\_shared) -- the solution root is two levels up
|$script:SIScriptRunHome = $PSScriptRoot
|
|function Get-SIScriptVersion {
|    <#
|        The version a person-run script reports. -Stamp (default: the publish stamp above) wins; else -SolutionRoot's
|        BUILD.json display / version, else its VERSION file; else 'unknown (not a released copy)'. Never throws.
|    #>
|    param([AllowEmptyString()][string]$Stamp = [string]$script:SIScriptVersionStamp, [AllowEmptyString()][string]$SolutionRoot = '')
|    if ("$Stamp".Trim()) { return "$Stamp".Trim() }
|    if (-not "$SolutionRoot".Trim() -and "$($script:SIScriptRunHome)".Trim()) {
|        try { $SolutionRoot = [IO.Path]::GetFullPath([IO.Path]::Combine([string]$script:SIScriptRunHome, '..', '..')) } catch { $SolutionRoot = '' }
|    }
|    if ("$SolutionRoot".Trim()) {
|        try {
|            # not [IO.Path]::Combine(..., 'BUILD.json'): the support-script builder embeds every data file a helper names that
|            # way, and a published copy must never carry the build machine's BUILD.json (its version comes from the stamp)
|            $bj = $SolutionRoot.TrimEnd('\', '/') + [IO.Path]::DirectorySeparatorChar + 'BUILD.json'
|            if ([IO.File]::Exists($bj)) {
|                $j = [IO.File]::ReadAllText($bj) | ConvertFrom-Json
|                if ("$($j.display)".Trim()) { return "$($j.display)".Trim() }
|                if ("$($j.version)".Trim()) { return "$($j.version)".Trim() }
|            }
|        } catch { }
|        try {
|            $vf = [IO.Path]::Combine($SolutionRoot, 'VERSION')
|            if ([IO.File]::Exists($vf)) { $v = ([IO.File]::ReadAllText($vf)).Trim(); if ($v) { return $v } }
|        } catch { }
|    }
|    'unknown (not a released copy)'
|}
|
|function Get-SIScriptFirstLine {
|    <# PURE. The first line of every person-run script: "<Script> version <v> - documentation: <link>". #>
|    param([Parameter(Mandatory)][string]$Script, [Parameter(Mandatory)][string]$Version)
|    $n = [IO.Path]::GetFileNameWithoutExtension($Script.Trim())
|    '{0} version {1} - documentation: {2}' -f $n, $Version, (Get-SIScriptDocUrl -Script $n)
|}
|
|function Get-SIScriptDocUrl {
|    <# PURE. The documentation page of a script (no .ps1, trailing slash -- confirmed by Invardia 2026-10-09). #>
|    param([Parameter(Mandatory)][string]$Script)
|    $n = ([IO.Path]::GetFileNameWithoutExtension($Script.Trim()))
|    'https://invardia.com/docs/si/scripts/{0}/' -f $n
|}
|
|function Get-SIScriptLogFolder {
|    <# PURE apart from reading the environment. The one known folder every script's transcript goes to. #>
|    if ($env:SI_SCRIPT_LOG_DIR) { return [string]$env:SI_SCRIPT_LOG_DIR }
|    if ($env:LOCALAPPDATA) { return [IO.Path]::Combine($env:LOCALAPPDATA, 'SecurityInsight', 'script-logs') }
|    $h = $HOME; if (-not $h) { $h = [Environment]::GetFolderPath('UserProfile') }
|    [IO.Path]::Combine($h, '.securityinsight', 'script-logs')
|}
|
|function Start-SIScriptRun {
|    <#
|        The first thing a script does. Returns the run (pass it to Stop-SIScriptRun). -WhatIf comes from the caller's
|        $WhatIfPreference; -Quiet (tests) prints nothing and starts no transcript.
|    #>
|    param([Parameter(Mandatory)][string]$Script, [switch]$Quiet, [bool]$WhatIfOn = [bool]$WhatIfPreference)
|    if ($env:SI_SCRIPT_RUN_QUIET -eq '1') { $Quiet = [switch]$true }      # tests: no banner, no transcript
|    $name = [IO.Path]::GetFileNameWithoutExtension($Script.Trim())
|    $ver = Get-SIScriptVersion
|    $run = [pscustomobject]@{ Script = $name; DocUrl = (Get-SIScriptDocUrl -Script $name); Version = $ver; FirstLine = (Get-SIScriptFirstLine -Script $name -Version $ver)
|                              Transcript = ''; Started = $false; WhatIf = $WhatIfOn; Quiet = [bool]$Quiet }
|    if ($Quiet) { return $run }
|    # the transcript FIRST (silently), so the version line below is the first line of the console AND of the transcript
|    $noTranscript = ''
|    try {
|        $dir = Get-SIScriptLogFolder
|        if (-not [IO.Directory]::Exists($dir)) { [void][IO.Directory]::CreateDirectory($dir) }
|        $path = [IO.Path]::Combine($dir, ('{0}-{1:yyyyMMdd-HHmmss}.log' -f $name, [datetime]::Now))
|        $null = Start-Transcript -LiteralPath $path -WhatIf:$false -ErrorAction Stop
|        $run.Transcript = $path; $run.Started = $true
|    } catch {
|        $noTranscript = $_.Exception.Message
|    }
|    Write-Host $run.FirstLine
|    if ($noTranscript) { Write-Host ('(no transcript of this run: {0})' -f $noTranscript) -ForegroundColor DarkGray }
|    if ($WhatIfOn) { Write-Host '-WhatIf: this run only reads and shows what it would change -- nothing is changed.' -ForegroundColor Yellow }
|    $run
|}
|
|function Stop-SIScriptRun {
|    <# The last thing a script does (in its finally block): ends the transcript and prints where it is. #>
|    param($Run)
|    if ($null -eq $Run -or $Run.Quiet) { return }
|    if ($Run.Started) {
|        try { $null = Stop-Transcript -ErrorAction Stop } catch { }
|        Write-Host ('Transcript of this run: {0}' -f $Run.Transcript)
|    }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-SetupAzure.ps1'] = @{ Sha256 = 'c54979b69ba2b3fabde3641cf7fb820bf6ed4e956a2acc43d2c0c5d980144200'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight SETUP -- Azure with NO PowerShell modules: native REST, ARM and .NET only.
|
|    Dot-source this ONE file at the top of a setup script (setup\, setup\ConfigWizard\backend\, Bootstrap-*, Setup-*):
|
|        . (Join-Path $PSScriptRoot 'setup\_shared\SI-SetupAzure.ps1')      # from the solution root
|        . (Join-Path $PSScriptRoot '_shared\SI-SetupAzure.ps1')            # from setup\
|        Connect-SISetupAzure -TenantId $tid -SubscriptionId $sub           # a person, or an app (see below)
|
|    It loads the engine's REST layer (engine/_shared/SI-AzRest.ps1: Invoke-SIArm, Resource Graph, Key Vault secrets,
|    storage data plane, the *-SIAz* REST twins), switches this process to REST (SI_AzureAccess_Engine = 'Rest'), adds the
|    sign-in of a PERSON (SI-SetupSignIn.ps1: Azure Cloud Shell token endpoint, or the browser with code + PKCE), and adds
|    what setup needs that the engines never did: Key Vault vaults and certificates, resource providers, deleting a role
|    assignment, typed ARM reads (resources, VMs, managed identities, SQL, Azure OpenAI, tenants, Log Analytics tables)
|    and storage management (tables, containers and queues through ARM, the lifecycle policy, name availability --
|    never an account key).
|
|    Every call goes through Invoke-SIAzRestHttp (the engine's one HTTP seam), so the offline tests run it against a fake.
|
|    INSIDE AN INVARDIA SUPPORT SESSION (owner 2026-10-12) setup signs in to NOTHING itself: Connect-SISetupAzure and
|    Get-SISetupAzureContext answer from the session (engine/_shared/SI-AzRest.ps1, Get-SISupportSession -- the one place
|    that detects it), and every call goes through the session's recording command, so each change is in the
|    environment's audit log. A subscription the session does not name is refused.
|    PS 5.1 safe; pwsh 7 on Windows, Linux (Azure Cloud Shell) and macOS.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|
|$__siSetupAzureRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|. ([IO.Path]::Combine($__siSetupAzureRoot, 'engine', '_shared', 'SI-AzRest.ps1'))
|. ([IO.Path]::Combine($__siSetupAzureRoot, 'engine', '_shared', 'SI-LogIngest.ps1'))
|. ([IO.Path]::Combine($__siSetupAzureRoot, 'auth', 'Find-SICertificate.ps1'))
|. ([IO.Path]::Combine($__siSetupAzureRoot, 'auth', 'SI-ManagedIdentity.ps1'))
|. ([IO.Path]::Combine($PSScriptRoot, 'SI-SetupSignIn.ps1'))
|Remove-Variable -Name __siSetupAzureRoot -ErrorAction SilentlyContinue
|
|# Setup never loads an Az module: every *-SIAz* wrapper takes its REST twin, and log ingestion its REST path.
|$global:SI_AzureAccess_Engine = 'Rest'
|$global:SI_LogIngest_Engine   = 'Rest'
|
|function Get-SIAzureToken {
|    <#
|        THE token function of the REST layer, as setup needs it: a signed-in PERSON (Connect-SISetupUser) is answered
|        from the setup sign-in; an app or a managed identity exactly as engine/_shared/SI-AzRest.ps1 does. Defined here,
|        after that file, so every REST helper -- Invoke-SIArm, the *-SIAz* twins, Key Vault, storage, Graph -- runs as
|        whoever signed in.
|    #>
|    param(
|        [ValidateSet('Arm', 'LaQuery', 'Storage', 'KeyVault', 'Graph', 'Monitor')][string]$Audience = 'Arm',
|        [string]$Resource,
|        [hashtable]$Auth,
|        [switch]$ForceRefresh
|    )
|    if (-not $Resource) { $Resource = Get-SIAzureAudience -Audience $Audience }
|    if (-not $Auth) {
|        # an Invardia Support session in the shell is setup's sign-in (never a person's or an app's beside it)
|        $null = Sync-SISupportConnection -TakeOver
|        $st = Get-SIAzRestState
|        if ($st.Connection -is [hashtable] -and $st.Connection.Mode -eq 'User') { $Auth = $st.Connection }
|    }
|    if ($Auth -and $Auth.Mode -eq 'User') { return (Get-SISetupUserToken -Resource $Resource -ForceRefresh:$ForceRefresh) }
|    # the engine's own hook ($global:SI_TokenProvider), exactly as engine/_shared/SI-AzRest.ps1 consults it
|    if (-not $Auth) {
|        $tp = Get-Variable -Scope Global -Name SI_TokenProvider -ValueOnly -ErrorAction Ignore
|        if ($tp -is [scriptblock]) { $pt = [string](& $tp $Resource); if (-not [string]::IsNullOrWhiteSpace($pt)) { return $pt } }
|    }
|    Initialize-SIAzRestHelpers
|    if (-not $Auth) { $Auth = Resolve-SIAzRestAuth }
|    return (Get-SILogIngestToken -Resource $Resource -Auth $Auth -ForceRefresh:$ForceRefresh)
|}
|# published globally too: a child script that loads only the engine file still finds the setup sign-in
|Set-Item -Path 'function:global:Get-SIAzureToken' -Value ${function:Get-SIAzureToken}
|
|# =====================================================================================================================
|#  Sign-in: one entry point for a person, an app or a managed identity
|# =====================================================================================================================
|
|function Connect-SISetupAzure {
|    <#
|        Signs this PowerShell process in to Azure for setup. No module, no Connect-AzAccount.
|          -ApplicationId + -CertificateThumbprint   an app with a certificate (LocalMachine\My or CurrentUser\My)
|          -ApplicationId + -ClientSecret            an app with a client secret (string or SecureString)
|          -Identity [-ManagedIdentityClientId]      this host's managed identity
|          (none of these)                           a PERSON: Azure Cloud Shell, else the browser (-UserSignIn)
|        AN INVARDIA SUPPORT SESSION open in this shell IS the sign-in: nothing is signed in here (no browser, no
|        certificate, no token request) -- the context is the session's: its tenant, and -SubscriptionId when the session
|        names it, else its first subscription. A subscription or tenant the session does not name is refused, and so is
|        -ApplicationId / -Identity (a sign-in beside the session would not be recorded there). One plain line says so.
|        ONE connect path (#524): an existing Azure session of this process (Connect-AzAccount, az login) is never used.
|        An existing sign-in in this process is REUSED (same tenant) unless -Force. -SubscriptionId selects the
|        subscription every following call works in. The app/identity is proven by asking for an ARM token at once, so a
|        wrong secret or certificate fails here, not three steps later. Returns Get-SISetupAzureContext.
|    #>
|    [CmdletBinding()]
|    param(
|        [string]$TenantId,
|        [string]$SubscriptionId,
|        [string]$ApplicationId,
|        [string]$CertificateThumbprint,
|        $ClientSecret,
|        [switch]$Identity,
|        [string]$ManagedIdentityClientId,
|        [ValidateSet('Auto', 'CloudShell', 'Browser')][string]$UserSignIn = 'Auto',
|        [string]$LoginHint,
|        [int]$TimeoutSec = 300,
|        [switch]$Force
|    )
|    $st = Get-SIAzRestState
|    $app = ($ApplicationId -and ($CertificateThumbprint -or $ClientSecret))
|    $sess = Get-SISupportSession
|    if ($sess) {
|        $name = Get-SISupportSessionName $sess
|        if ($app -or $Identity) {
|            $who = if ($Identity) { 'a managed identity' } else { 'the app {0}' -f $ApplicationId }
|            throw ('An Invardia Support session for {0} is open in this PowerShell session: SecurityInsight setup works through it, so every change is recorded there. Signing in here as {1} would not be recorded -- refused. Run the same command without the sign-in parameters, or end the session first (Disconnect-InvardiaSupport).' -f $name, $who)
|        }
|        if ($TenantId -and $TenantId -ne $sess.TenantId) {
|            throw ('The Invardia Support session for {0} is for tenant {1}, not {2} -- refused. Connect the support session of tenant {2}.' -f $name, $sess.TenantId, $TenantId)
|        }
|        if ($SubscriptionId) { Assert-SISupportSubscription -SubscriptionId $SubscriptionId -Session $sess }
|        if (Test-SISetupUserSignedIn) { Disconnect-SISetupUser }
|        return (Get-SISetupAzureContext -SubscriptionId $SubscriptionId)
|    }
|    $null = Sync-SISupportConnection   # a Support sign-in whose session was closed is dropped
|    $existing = $st.Connection
|    $reuse = (-not $Force) -and ($existing -is [hashtable]) -and (-not $app) -and (-not $Identity) -and
|             ((-not $TenantId) -or ([string]$existing.TenantId -eq $TenantId) -or ($existing.Mode -eq 'ManagedIdentity'))
|    # 2026-11-03 (a customer install, a second run in one window): a person's connection left by an earlier run whose sign-in this run does
|    # not hold is NEVER reused -- the person is signed in again (else Get-SISetupAzureContext answers $null and the install
|    # stops "not signed in")
|    if ($reuse -and [string]$existing.Mode -eq 'User' -and -not $existing['IsApp'] -and -not (Test-SISetupUserSignedIn)) { $reuse = $false; $st.Connection = $null }
|    if (-not $reuse) {
|        if ($app -or $Identity) {
|            if (Test-SISetupUserSignedIn) { Disconnect-SISetupUser }
|            $c = @{}
|            if ($Identity) {
|                $c['Identity'] = $true
|                if ($ManagedIdentityClientId) { $c['AccountId'] = $ManagedIdentityClientId }
|            } elseif ($CertificateThumbprint) {
|                $c['ServicePrincipal'] = $true; $c['ApplicationId'] = $ApplicationId; $c['CertificateThumbprint'] = $CertificateThumbprint; $c['Tenant'] = $TenantId
|            } else {
|                $sec = if ($ClientSecret -is [System.Security.SecureString]) { $ClientSecret } else { ConvertTo-SISecureString -Text ([string]$ClientSecret) }
|                $c['ServicePrincipal'] = $true; $c['Credential'] = New-Object System.Management.Automation.PSCredential($ApplicationId, $sec); $c['Tenant'] = $TenantId
|            }
|            if ($SubscriptionId) { $c['Subscription'] = $SubscriptionId }
|            $null = Connect-SIAzAccountRest @c
|            if ($global:SI_LogIngestRunCache -is [hashtable]) { $global:SI_LogIngestRunCache.Tokens = @{} }
|            try { $null = Get-SIAzureToken -Audience Arm -ForceRefresh }
|            catch {
|                $st.Connection = $null
|                $who = if ($Identity) { 'the managed identity of this host' } else { 'app {0}' -f $ApplicationId }
|                throw ('Signing in to Azure as {0} failed: {1}' -f $who, $_.Exception.Message)
|            }
|        } elseif ([string](Get-Variable -Scope Global -Name SI_AuthMethod -ValueOnly -ErrorAction Ignore) -eq 'AzContext') {
|            # #524: the retired sign-in mode "AzContext" (borrow this process's Azure session) is refused -- never a silent fallback
|            throw ('SI_AuthMethod = AzContext (use the current Azure session of this PowerShell process) is no longer supported: setup signs in itself -- a person (Azure Cloud Shell or the browser), or an app with -ApplicationId and -CertificateThumbprint or -ClientSecret, or -Identity. Supported sign-ins: {0}.' -f (Get-SISupportedSignInText))
|        } else {
|            $u = Connect-SISetupUser -TenantId $TenantId -Method $UserSignIn -LoginHint $LoginHint -TimeoutSec $TimeoutSec
|            # #876: a sign-in handed over by the installation page may be an APPLICATION's (IsApp): it is then a service
|            # principal for every check that asks who installs -- its object id is the service principal's
|            $isApp = [bool]($u.PSObject.Properties['IsApp'] -and $u.IsApp)
|            $st.Connection = @{ Mode = 'User'; AppId = $u.Account; TenantId = $u.TenantId; ObjectId = $u.ObjectId; Method = $u.Method; IsApp = $isApp }
|            $st.TenantId = $u.TenantId
|            $st.SubscriptionId = $null
|            $st.Cache = @{}
|        }
|    }
|    if ($SubscriptionId) { $st.SubscriptionId = $SubscriptionId }
|    return (Get-SISetupAzureContext)
|}
|
|function ConvertTo-SISecureString {
|    param([string]$Text)
|    $s = New-Object System.Security.SecureString
|    foreach ($ch in ([string]$Text).ToCharArray()) { $s.AppendChar($ch) }
|    $s.MakeReadOnly()
|    return $s
|}
|
|function Get-SISetupAzureContext {
|    <#
|        Who this process is signed in as -- the shape setup read from Get-AzContext: Account.Id / .Type ('User',
|        'ServicePrincipal', 'ManagedService'), Account.ObjectId, Tenant.Id, Subscription.Id / .Name, SignInMethod.
|        $null when nobody is signed in.
|        In an Invardia Support session the context IS the session's (SignInMethod 'Support', read from the session -- no
|        sign-in and no token request): its tenant, and -SubscriptionId when the session names it, else the install's
|        configured subscription, else the session's first. THROWS only what a Support session refuses: a subscription it
|        does not name, another tenant than the configured one, a session without its recording command.
|        -SubscriptionId selects the subscription the following calls work in (as Connect-SISetupAzure -SubscriptionId).
|    #>
|    param([string]$SubscriptionId)
|    $st = Get-SIAzRestState
|    $sess = Sync-SISupportConnection -TakeOver
|    $c = $st.Connection
|    if (-not ($c -is [hashtable])) {
|        # an app configured through the SI_SPN_* globals counts as signed in (the engines' own rule)
|        try { $c = Resolve-SIAzRestAuth } catch { return $null }
|    }
|    # 2026-11-03 (an install run twice in ONE PowerShell window, the second from a newer package): a person's connection left
|    # by the earlier run while this run holds no sign-in of that person (its tokens live with the earlier run) is NOT a
|    # sign-in -- $null, so the install signs the person in again instead of failing at its first Azure call
|    if (-not $sess -and [string]$c.Mode -eq 'User' -and -not $c['IsApp'] -and (Get-Command -Name Test-SISetupUserSignedIn -ErrorAction SilentlyContinue) -and -not (Test-SISetupUserSignedIn)) { return $null }
|    if ($SubscriptionId) {
|        if ($sess) { Assert-SISupportSubscription -SubscriptionId $SubscriptionId -Session $sess }
|        $st.SubscriptionId = $SubscriptionId
|    }
|    $type = switch ([string]$c.Mode) { 'User' { $(if ($c['IsApp']) { 'ServicePrincipal' } else { 'User' }) } 'ManagedIdentity' { 'ManagedService' } default { 'ServicePrincipal' } }
|    $id = switch ([string]$c.Mode) { 'ManagedIdentity' { $(if ($c.ClientId) { [string]$c.ClientId } else { 'MSI' }) } default { [string]$c.AppId } }
|    $tid = [string]$st.TenantId
|    if (-not $tid) { $tid = [string]$c.TenantId }
|    if (-not $tid -and $c.Mode -ne 'User') { try { $tid = Get-SIAzRestTenantId } catch { } }
|    $sub = $null
|    try { $sub = Get-SIAzRestSubscriptionId } catch { }
|    if ($sess -and $sub) {
|        Assert-SISupportSubscription -SubscriptionId $sub -Session $sess
|        # the session already knows its first subscription's name: no call for it
|        if ($sess.SubscriptionName -and ([string]$sub).Trim().ToLowerInvariant() -eq $sess.SubscriptionId -and -not $st.Cache.ContainsKey('subname|' + $sub)) { $st.Cache['subname|' + $sub] = [string]$sess.SubscriptionName }
|    }
|    $subName = $sub
|    if ($sub) {
|        $k = 'subname|' + $sub
|        if ($st.Cache.ContainsKey($k)) { $subName = $st.Cache[$k] }
|        else {
|            try { $s = Invoke-SIArm -Path ('/subscriptions/' + $sub) -ApiVersion '2022-12-01' -AllowNotFound; if ($s -and $s.displayName) { $subName = [string]$s.displayName } } catch { }
|            $st.Cache[$k] = $subName
|        }
|    }
|    return [pscustomobject]@{
|        PSTypeName   = 'SI.Setup.AzureContext'
|        Name         = ('{0} ({1})' -f $subName, $id)
|        Account      = [pscustomobject]@{ Id = $id; Type = $type; ObjectId = $(if ($c.ObjectId) { [string]$c.ObjectId } else { $null }) }
|        Tenant       = [pscustomobject]@{ Id = $tid; TenantId = $tid }
|        Subscription = $(if ($sub) { [pscustomobject]@{ Id = $sub; SubscriptionId = $sub; Name = $subName; TenantId = $tid } } else { $null })
|        SignInMethod = $(if ($c.Mode -eq 'User') { [string]$c.Method } else { [string]$c.Mode })
|    }
|}
|
|function Disconnect-SISetupAzure {
|    Disconnect-SISetupUser
|    Disconnect-SIAzAccountRest
|}
|
|function Get-SISetupSignedInObjectId {
|    <# The object id of whoever is signed in: the person (from their token), else the app's service principal. #>
|    $st = Get-SIAzRestState
|    $c = $st.Connection
|    if ($c -is [hashtable] -and $c.ObjectId) { return [string]$c.ObjectId }
|    try {
|        $claims = ConvertFrom-SIJwtPayload (Get-SIAzureToken -Audience Arm)
|        if ($claims -and $claims.oid) { return [string]$claims.oid }
|    } catch { }
|    return $null
|}
|
|# =====================================================================================================================
|#  Small ARM helpers
|# =====================================================================================================================
|
|function Get-SISetupSubscriptionId {
|    param([string]$SubscriptionId)
|    if ($SubscriptionId) { return $SubscriptionId }
|    $s = Get-SIAzRestSubscriptionId
|    if (-not $s) { throw 'No Azure subscription is selected. Pass the subscription id (or sign in with access to one) and run the same command again.' }
|    return $s
|}
|
|function Get-SIArmResourceGroupFromId {
|    param([string]$Id)
|    if ([string]$Id -match '/resourceGroups/([^/]+)/') { return $Matches[1] }
|    return $null
|}
|
|# =====================================================================================================================
|#  (2) Key Vault: vaults (ARM) and certificates (data plane)
|# =====================================================================================================================
|
|function ConvertTo-SIKeyVaultObject {
|    param($V)
|    [pscustomobject]@{
|        VaultName                 = [string]$V.name
|        ResourceId                = [string]$V.id
|        ResourceGroupName         = (Get-SIArmResourceGroupFromId $V.id)
|        Location                  = [string]$V.location
|        VaultUri                  = [string]$V.properties.vaultUri
|        TenantId                  = [string]$V.properties.tenantId
|        Sku                       = [string]$V.properties.sku.name
|        EnableRbacAuthorization   = [bool]$V.properties.enableRbacAuthorization
|        EnableSoftDelete          = [bool]$V.properties.enableSoftDelete
|        EnablePurgeProtection     = [bool]$V.properties.enablePurgeProtection
|        PublicNetworkAccess       = [string]$V.properties.publicNetworkAccess
|        ProvisioningState         = [string]$V.properties.provisioningState
|        Tags                      = $V.tags
|    }
|}
|
|function Get-SIKeyVault {
|    <#
|        A Key Vault by name, the way Get-AzKeyVault found it: in -ResourceGroupName, else anywhere in the subscription.
|        -InRemovedState -Location: the soft-deleted vault of that name (DeletionDate, ScheduledPurgeDate). Not found is a
|        non-terminating error (so -ErrorAction SilentlyContinue gives $null), as for the cmdlet.
|    #>
|    [CmdletBinding()]
|    param([Alias('Name')][string]$VaultName, [string]$ResourceGroupName, [switch]$InRemovedState, [string]$Location, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    if ($InRemovedState) {
|        if (-not $Location) { throw 'Get-SIKeyVault -InRemovedState needs -Location.' }
|        $d = Invoke-SIArm -Path ("/subscriptions/$sub/providers/Microsoft.KeyVault/locations/$Location/deletedVaults/$VaultName") -ApiVersion '2023-07-01' -AllowNotFound
|        if (-not $d) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("No deleted Key Vault '{0}' in {1}." -f $VaultName, $Location) -Target $VaultName; return }
|        return [pscustomobject]@{
|            VaultName = [string]$d.name; Id = [string]$d.id; Location = [string]$d.properties.location; ResourceId = [string]$d.properties.vaultId
|            DeletionDate = $d.properties.deletionDate; ScheduledPurgeDate = $d.properties.scheduledPurgeDate; EnablePurgeProtection = [bool]$d.properties.purgeProtectionEnabled
|        }
|    }
|    if ($VaultName -and $ResourceGroupName) {
|        $v = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.KeyVault/vaults/$VaultName") -ApiVersion '2023-07-01' -AllowNotFound
|        if (-not $v) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The Key Vault '{0}' was not found in resource group '{1}'." -f $VaultName, $ResourceGroupName) -Target $VaultName; return }
|        return (ConvertTo-SIKeyVaultObject $v)
|    }
|    $path = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.KeyVault/vaults" } else { "/subscriptions/$sub/providers/Microsoft.KeyVault/vaults" }
|    $found = $false
|    foreach ($v in @(Invoke-SIArm -Path $path -ApiVersion '2023-07-01' -List)) {
|        if ($VaultName -and [string]$v.name -ne $VaultName) { continue }
|        $found = $true
|        ConvertTo-SIKeyVaultObject $v
|    }
|    if ($VaultName -and -not $found) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The Key Vault '{0}' was not found in subscription {1}." -f $VaultName, $sub) -Target $VaultName }
|}
|
|function New-SIKeyVault {
|    <# Creates (PUT) a Key Vault: soft delete on, Azure RBAC authorization by default, and waits until it is ready. #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][Alias('Name')][string]$VaultName,
|        [Parameter(Mandatory)][string]$ResourceGroupName,
|        [Parameter(Mandatory)][string]$Location,
|        [ValidateSet('standard', 'premium', 'Standard', 'Premium')][string]$Sku = 'standard',
|        [bool]$EnableRbacAuthorization = $true,
|        [switch]$EnablePurgeProtection,
|        [int]$SoftDeleteRetentionInDays = 90,
|        [hashtable]$Tag,
|        [string]$SubscriptionId,
|        [string]$TenantId,
|        # #866 (a private install; owner: "we will not allow fw option or exceptions"): 'Disabled' CREATES the vault with no
|        # public access at all (its firewall Deny, trusted Microsoft services allowed) -- a policy that refuses a public
|        # vault never sees one. Empty: Azure's default, as before.
|        [ValidateSet('', 'Disabled')][string]$PublicNetworkAccess = ''
|    )
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    if (-not $TenantId) { $TenantId = Get-SIAzRestTenantId }
|    $props = [ordered]@{
|        tenantId                  = $TenantId
|        sku                       = @{ family = 'A'; name = $Sku.ToLowerInvariant() }
|        enableRbacAuthorization   = $EnableRbacAuthorization
|        enableSoftDelete          = $true
|        softDeleteRetentionInDays = $SoftDeleteRetentionInDays
|        accessPolicies            = @()
|    }
|    if ($EnablePurgeProtection) { $props['enablePurgeProtection'] = $true }
|    if ($PublicNetworkAccess -eq 'Disabled') {
|        $props['publicNetworkAccess'] = 'Disabled'
|        $props['networkAcls'] = [ordered]@{ defaultAction = 'Deny'; bypass = 'AzureServices'; ipRules = @(); virtualNetworkRules = @() }
|    }
|    $body = [ordered]@{ location = $Location; properties = $props }
|    if ($Tag) { $body['tags'] = $Tag }
|    $path = "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.KeyVault/vaults/$VaultName"
|    $v = Invoke-SIArm -Method PUT -Path $path -ApiVersion '2023-07-01' -Body $body
|    for ($i = 0; $i -lt 30 -and $v -and [string]$v.properties.provisioningState -and [string]$v.properties.provisioningState -notin 'Succeeded', 'Failed'; $i++) {
|        Start-Sleep -Seconds 5
|        $v = Invoke-SIArm -Path $path -ApiVersion '2023-07-01' -AllowNotFound
|    }
|    if (-not $v) { throw ("The Key Vault '{0}' was requested but did not appear." -f $VaultName) }
|    return (ConvertTo-SIKeyVaultObject $v)
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|#  FRAMEWORK INSTALLER RULE 11 -- the install's Key Vault network shape, set and READ BACK every run.
|#  Rule 11 (framework REQUIREMENTS, installer rules, 3 Nov): "a PRIVATE install's Key Vault: publicNetworkAccess Disabled +
|#  networkAcls { defaultAction Deny, bypass AzureServices, no ipRules, no virtualNetworkRules } ... bypass AzureServices is
|#  REQUIRED: ARM key / secret operations ... are refused with ForbiddenByConnection under bypass None ... ENFORCE IT EVERY
|#  RUN: a re-install RECOVERS a soft-deleted vault (purge protection), and a recover IGNORES networkAcls (it comes back with
|#  bypass None) - so set the vault to this shape and READ IT BACK before any key / secret step, whether the vault was made,
|#  recovered or found." Rule 11 names only the private shape; a PUBLIC install takes the one part that is not about being
|#  private -- bypass AzureServices -- and nothing else is changed (its public access and firewall stay the customer's).
|# ---------------------------------------------------------------------------------------------------------------------
|
|function Get-SIKeyVaultNetworkShape {
|    <# PURE. The network settings of a vault as ARM returns it (PSCustomObject or hashtable): PublicNetworkAccess,
|       DefaultAction, Bypass, IpRules, VirtualNetworkRules (the rule lists, empty when there are none). #>
|    param($Vault)
|    $get = { param($o, [string]$n) if ($null -eq $o) { return $null }; if ($o -is [System.Collections.IDictionary]) { if ($o.Contains($n)) { return $o[$n] }; return $null }; $p = $o.PSObject.Properties[$n]; if ($p) { $p.Value } else { $null } }
|    $props = & $get $Vault 'properties'
|    $acl = & $get $props 'networkAcls'
|    [pscustomobject]@{
|        PublicNetworkAccess = [string](& $get $props 'publicNetworkAccess')
|        DefaultAction       = [string](& $get $acl 'defaultAction')
|        Bypass              = [string](& $get $acl 'bypass')
|        IpRules             = @(@(& $get $acl 'ipRules') | Where-Object { $null -ne $_ })
|        VirtualNetworkRules = @(@(& $get $acl 'virtualNetworkRules') | Where-Object { $null -ne $_ })
|    }
|}
|
|function Get-SIKeyVaultRule11Patch {
|    <# PURE. The PATCH body that brings -Vault to the rule-11 shape -- ONLY what differs -- or $null when it has it.
|         -Private  publicNetworkAccess Disabled + networkAcls { Deny, AzureServices, no IP rules, no network rules }
|         public    a vault open to all networks (default action Allow, or no firewall at all) already lets trusted Microsoft
|                   services in: nothing to set -- Azure does not keep a bypass on a vault without a firewall, so asking for
|                   one can never read back. Only a vault whose firewall DENIES gets bypass AzureServices; its default action
|                   and rules are kept, publicNetworkAccess is not touched -- a public install never opens or closes a vault. #>
|    param($Vault, [switch]$Private)
|    $s = Get-SIKeyVaultNetworkShape -Vault $Vault
|    $p = [ordered]@{}
|    if ($Private) {
|        if ($s.PublicNetworkAccess -ne 'Disabled') { $p['publicNetworkAccess'] = 'Disabled' }
|        if ($s.DefaultAction -ne 'Deny' -or $s.Bypass -ne 'AzureServices' -or $s.IpRules.Count -or $s.VirtualNetworkRules.Count) {
|            $p['networkAcls'] = [ordered]@{ defaultAction = 'Deny'; bypass = 'AzureServices'; ipRules = @(); virtualNetworkRules = @() }
|        }
|    } elseif ($s.DefaultAction -eq 'Deny' -and $s.Bypass -ne 'AzureServices') {
|        $p['networkAcls'] = [ordered]@{ defaultAction = 'Deny'; bypass = 'AzureServices'
|                                        ipRules = @($s.IpRules); virtualNetworkRules = @($s.VirtualNetworkRules) }
|    }
|    if (-not $p.Count) { return $null }
|    [ordered]@{ properties = $p }
|}
|
|function Test-SIKeyVaultRule11Shape {
|    <# PURE. Does -Vault read back in the rule-11 shape (private or public, as above)? #>
|    param($Vault, [switch]$Private)
|    [bool]($Vault -and $null -eq (Get-SIKeyVaultRule11Patch -Vault $Vault -Private:$Private))
|}
|
|function Get-SIKeyVaultShapeText {
|    <# PURE. One line for the log: public access, default action, bypass, rule counts. #>
|    param($Vault)
|    $s = Get-SIKeyVaultNetworkShape -Vault $Vault
|    'publicNetworkAccess {0}, defaultAction {1}, bypass {2}, ipRules {3}, virtualNetworkRules {4}' -f $(if ($s.PublicNetworkAccess) { $s.PublicNetworkAccess } else { '(not set)' }),
|        $(if ($s.DefaultAction) { $s.DefaultAction } else { '(not set)' }), $(if ($s.Bypass) { $s.Bypass } else { '(not set)' }), $s.IpRules.Count, $s.VirtualNetworkRules.Count
|}
|
|function Set-SIKeyVaultRule11 {
|    <# Sets the vault to the rule-11 shape (PATCH, only what differs) and READS IT BACK. Throws plainly when it does not read
|       back in that shape -- nothing writes a key or secret to it before it does. Returns Changed, Shape (the read-back line),
|       Vault (the read-back vault as Get-SIKeyVault returns it). #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$VaultName, [Parameter(Mandatory)][string]$ResourceGroupName, [string]$SubscriptionId,
|          [switch]$Private, [int]$Tries = 12, [int]$PauseSeconds = 5)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $path = "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.KeyVault/vaults/$VaultName"
|    $have = Invoke-SIArm -Path $path -ApiVersion '2023-07-01' -AllowNotFound
|    if (-not $have) { throw ("The Key Vault '{0}' was not found in resource group '{1}' -- its network shape (framework installer rule 11) cannot be set." -f $VaultName, $ResourceGroupName) }
|    $patch = Get-SIKeyVaultRule11Patch -Vault $have -Private:$Private
|    $back = $have
|    if ($patch) {
|        $null = Invoke-SIArm -Method PATCH -Path $path -ApiVersion '2023-07-01' -Body $patch
|        for ($i = 1; $i -le $Tries; $i++) {
|            $back = Invoke-SIArm -Path $path -ApiVersion '2023-07-01' -AllowNotFound
|            if (Test-SIKeyVaultRule11Shape -Vault $back -Private:$Private) { break }
|            if ($i -lt $Tries) { Start-Sleep -Seconds $PauseSeconds }
|        }
|    }
|    if (-not (Test-SIKeyVaultRule11Shape -Vault $back -Private:$Private)) {
|        # Framework rule 17: the advice names ONLY the one setting that is missing -- never "set the networking", which on
|        # a public install invites "selected networks" and locks the jobs out of their own vault.
|        throw ("The Key Vault '{0}' does not read back in the shape it must have ({1}); it reads: {2}. Nothing writes a key or secret to it until it does -- run the same command again; if it stays like this, {3}, change nothing else there, and run again." -f $VaultName,
|            $(if ($Private) { 'public access Disabled, firewall Deny, trusted Microsoft services allowed (bypass AzureServices), no IP or network rules' } else { 'trusted Microsoft services allowed (bypass AzureServices)' }), (Get-SIKeyVaultShapeText -Vault $back),
|            $(if ($Private) { "in the Azure portal (Key vaults > $VaultName > Networking) choose 'Disable public access' and tick 'Allow trusted Microsoft services to bypass this firewall'" } else { "in the Azure portal (Key vaults > $VaultName > Networking > Exceptions) tick only 'Allow trusted Microsoft services to bypass this firewall'" }))
|    }
|    [pscustomobject]@{ Changed = [bool]$patch; Shape = (Get-SIKeyVaultShapeText -Vault $back); Vault = (ConvertTo-SIKeyVaultObject $back) }
|}
|
|function Get-SIKeyVaultEnsureAction {
|    <# PURE. What the install does with its vault: 'found' (it is there), 'recover' (absent, but soft-deleted in the install's
|       location FROM THE INSTALL'S OWN resource group -- a re-install; with purge protection it can neither be purged nor
|       made again under that name), 'create' (also when the deleted vault was another resource group's: the create then
|       fails with Azure's own "exists in deleted state", as before -- another install's vault is never taken over). #>
|    param($Found, $Deleted, [string]$ResourceGroupName)
|    if ($Found) { return 'found' }
|    if ($Deleted) {
|        $rg = if ([string]$Deleted.ResourceId -match '(?i)/resourceGroups/([^/]+)/') { $Matches[1] } else { '' }
|        if (-not $rg -or -not $ResourceGroupName -or $rg -eq $ResourceGroupName) { return 'recover' }
|    }
|    'create'
|}
|
|function Get-SIKeyVaultRecoverBody {
|    <# PURE. The PUT body that RECOVERS a soft-deleted vault (properties.createMode 'recover'; Azure restores its settings --
|       but NOT its networkAcls, hence Set-SIKeyVaultRule11 right after). tenantId and sku are required by the schema. #>
|    param([Parameter(Mandatory)][string]$Location, [Parameter(Mandatory)][string]$TenantId, [string]$Sku = 'standard')
|    [ordered]@{ location = $Location; properties = [ordered]@{ tenantId = $TenantId; sku = [ordered]@{ family = 'A'; name = $Sku.ToLowerInvariant() }; createMode = 'recover' } }
|}
|
|function Restore-SIKeyVault {
|    <# RECOVERS the soft-deleted vault -Deleted (Get-SIKeyVault -InRemovedState) into the resource group it was deleted from
|       (or -ResourceGroupName when that is not known), and waits until it is ready. Returns it as Get-SIKeyVault does. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)]$Deleted, [Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Location,
|          [string]$SubscriptionId, [string]$TenantId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    if (-not $TenantId) { $TenantId = Get-SIAzRestTenantId }
|    $rg = Get-SIArmResourceGroupFromId ([string]$Deleted.ResourceId)
|    if (-not $rg) { $rg = $ResourceGroupName }
|    $name = [string]$Deleted.VaultName
|    $path = "/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.KeyVault/vaults/$name"
|    $v = Invoke-SIArm -Method PUT -Path $path -ApiVersion '2023-07-01' -Body (Get-SIKeyVaultRecoverBody -Location $Location -TenantId $TenantId)
|    for ($i = 0; $i -lt 30 -and (-not $v -or ([string]$v.properties.provisioningState -and [string]$v.properties.provisioningState -notin 'Succeeded', 'Failed')); $i++) {
|        Start-Sleep -Seconds 5
|        $v = Invoke-SIArm -Path $path -ApiVersion '2023-07-01' -AllowNotFound
|    }
|    if (-not $v) { throw ("The soft-deleted Key Vault '{0}' was recovered but did not appear." -f $name) }
|    return (ConvertTo-SIKeyVaultObject $v)
|}
|
|function Initialize-SIKeyVault {
|    <# The install's vault, FOUND, RECOVERED or CREATED -- and in every case set to the rule-11 shape and READ BACK before
|       anything writes a key or secret to it. -PublicNetworkAccess 'Disabled' = a private install (created private from
|       birth, converged to the private shape); '' = a public one. Returns Action (found | recovered | created), Vault,
|       Changed (the shape had to be set), Shape (the read-back line), Deleted (what was recovered). #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$VaultName, [Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Location,
|          [string]$SubscriptionId, [string]$TenantId, [switch]$EnablePurgeProtection,
|          [ValidateSet('', 'Disabled')][string]$PublicNetworkAccess = '', [int]$PauseSeconds = 5)
|    $isPrivate = ($PublicNetworkAccess -eq 'Disabled')
|    $kv = Get-SIKeyVault -VaultName $VaultName -SubscriptionId $SubscriptionId -ErrorAction SilentlyContinue
|    $deleted = $null
|    if (-not $kv) { $deleted = Get-SIKeyVault -VaultName $VaultName -InRemovedState -Location $Location -SubscriptionId $SubscriptionId -ErrorAction SilentlyContinue }
|    $action = Get-SIKeyVaultEnsureAction -Found $kv -Deleted $deleted -ResourceGroupName $ResourceGroupName
|    switch ($action) {
|        'create' {
|            # Azure RBAC authorization (not access policies); a private install is private from birth (no public moment)
|            $kv = New-SIKeyVault -VaultName $VaultName -ResourceGroupName $ResourceGroupName -Location $Location -SubscriptionId $SubscriptionId -TenantId $TenantId -EnableRbacAuthorization $true -EnablePurgeProtection:$EnablePurgeProtection -PublicNetworkAccess $PublicNetworkAccess
|            $action = 'created'
|        }
|        'recover' { $kv = Restore-SIKeyVault -Deleted $deleted -ResourceGroupName $ResourceGroupName -Location $Location -SubscriptionId $SubscriptionId -TenantId $TenantId; $action = 'recovered' }
|    }
|    $rg = if ([string]$kv.ResourceGroupName) { [string]$kv.ResourceGroupName } else { $ResourceGroupName }
|    $c = Set-SIKeyVaultRule11 -VaultName $VaultName -ResourceGroupName $rg -SubscriptionId $SubscriptionId -Private:$isPrivate -PauseSeconds $PauseSeconds
|    # the vault's own facts (RBAC, purge protection) from the create / recover answer; its network from the read-back
|    $out = $c.Vault
|    if (-not [string]$out.VaultUri -and $kv) { $out = $kv }
|    [pscustomobject]@{ Action = $action; Vault = $out; Changed = $c.Changed; Shape = $c.Shape; Deleted = $deleted }
|}
|
|function Test-SIKeyVaultNameAvailability {
|    <# Microsoft.KeyVault checkNameAvailability: NameAvailable, Reason, Message. #>
|    param([Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $r = Invoke-SIArm -Method POST -Path ("/subscriptions/$sub/providers/Microsoft.KeyVault/checkNameAvailability") -ApiVersion '2022-07-01' -Body @{ name = $Name; type = 'Microsoft.KeyVault/vaults' }
|    return [pscustomobject]@{ NameAvailable = [bool]$r.nameAvailable; Reason = [string]$r.reason; Message = [string]$r.message }
|}
|
|function ConvertFrom-SIBase64UrlToHex {
|    param([string]$Text)
|    if (-not $Text) { return $null }
|    $p = $Text.Replace('-', '+').Replace('_', '/')
|    switch ($p.Length % 4) { 2 { $p += '==' } 3 { $p += '=' } }
|    return (([Convert]::FromBase64String($p) | ForEach-Object { $_.ToString('X2') }) -join '')
|}
|
|function ConvertTo-SIKeyVaultCertificateObject {
|    param($J, [string]$VaultName, [string]$Name)
|    $x = $null
|    if ($J.cer) { try { $x = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2(,[Convert]::FromBase64String([string]$J.cer)) } catch { } }
|    $thumb = if ($x) { [string]$x.Thumbprint } else { ConvertFrom-SIBase64UrlToHex ([string]$J.x5t) }
|    $exp = $null
|    if ($J.attributes -and $J.attributes.exp) { try { $exp = [DateTimeOffset]::FromUnixTimeSeconds([long]$J.attributes.exp).UtcDateTime } catch { } }
|    [pscustomobject]@{
|        VaultName = $VaultName; Name = $Name; Id = [string]$J.id; SecretId = [string]$J.sid; KeyId = [string]$J.kid
|        Thumbprint = $thumb; Certificate = $x; Enabled = $(if ($J.attributes) { [bool]$J.attributes.enabled } else { $null }); Expires = $exp
|    }
|}
|
|function Get-SIKeyVaultCertificate {
|    <# One certificate (current version) from a vault's data plane; $null (non-terminating error) when absent. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$VaultName, [Parameter(Mandatory)][string]$Name)
|    $uri = 'https://{0}.vault.azure.net/certificates/{1}?api-version=7.4' -f $VaultName, [uri]::EscapeDataString($Name)
|    $r = Invoke-SIAzRestRequest -Method GET -Uri $uri -Audience KeyVault -AllowNotFound -What ("Key Vault certificate '{0}' in '{1}'" -f $Name, $VaultName)
|    if (-not $r) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The certificate '{0}' was not found in Key Vault '{1}'." -f $Name, $VaultName) -Target $Name; return }
|    return (ConvertTo-SIKeyVaultCertificateObject -J ($r.Content | ConvertFrom-Json) -VaultName $VaultName -Name $Name)
|}
|
|function Import-SIKeyVaultCertificate {
|    <# Imports a PFX (-FilePath or -CertificateBytes, optional -Password) into a vault as certificate -Name. #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$VaultName,
|        [Parameter(Mandatory)][string]$Name,
|        [string]$FilePath,
|        [byte[]]$CertificateBytes,
|        $Password
|    )
|    if (-not $CertificateBytes) {
|        if (-not $FilePath) { throw 'Import-SIKeyVaultCertificate needs -FilePath or -CertificateBytes.' }
|        $CertificateBytes = [System.IO.File]::ReadAllBytes($FilePath)
|    }
|    $pw = if ($Password -is [System.Security.SecureString]) { [System.Net.NetworkCredential]::new('', $Password).Password } else { [string]$Password }
|    $body = [ordered]@{ value = [Convert]::ToBase64String($CertificateBytes); policy = @{ secret_props = @{ contentType = 'application/x-pkcs12' } } }
|    if ($pw) { $body['pwd'] = $pw }
|    $uri = 'https://{0}.vault.azure.net/certificates/{1}/import?api-version=7.4' -f $VaultName, [uri]::EscapeDataString($Name)
|    $r = Invoke-SIAzRestRequest -Method POST -Uri $uri -Audience KeyVault -Body ($body | ConvertTo-Json -Depth 5 -Compress) -What ("Importing certificate '{0}' into Key Vault '{1}'" -f $Name, $VaultName)
|    return (ConvertTo-SIKeyVaultCertificateObject -J ($r.Content | ConvertFrom-Json) -VaultName $VaultName -Name $Name)
|}
|
|# =====================================================================================================================
|#  (3) Resource providers
|# =====================================================================================================================
|
|function Get-SIResourceProvider {
|    <# A resource provider's registration in the subscription: ProviderNamespace, RegistrationState, ResourceTypes. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ProviderNamespace, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $p = Invoke-SIArm -Path ("/subscriptions/$sub/providers/$ProviderNamespace") -ApiVersion '2021-04-01' -AllowNotFound
|    if (-not $p) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The resource provider '{0}' was not found." -f $ProviderNamespace) -Target $ProviderNamespace; return }
|    return [pscustomobject]@{ ProviderNamespace = [string]$p.namespace; RegistrationState = [string]$p.registrationState; ResourceTypes = @($p.resourceTypes); Id = [string]$p.id }
|}
|
|function Get-SISetupResourceProviderList {
|    <#
|        PURE. #564: EVERY resource provider a SecurityInsight install WRITES to -- the guided install checks and registers
|        these before the first resource. Container Apps (Microsoft.App), the registry, the workspace, diagnostic settings and
|        data collection (Microsoft.Insights), the managed identities, the Key Vault, the storage account; Pro adds Azure SQL.
|        Microsoft.Network is NOT listed: SecurityInsight creates no network resource (no virtual network, private endpoint
|        or public IP; the Container Apps environment is a consumption one without a virtual network).
|    #>
|    param([switch]$Pro)
|    $l = @('Microsoft.App', 'Microsoft.OperationalInsights', 'Microsoft.Insights', 'Microsoft.ContainerRegistry', 'Microsoft.ManagedIdentity', 'Microsoft.KeyVault', 'Microsoft.Storage')
|    if ($Pro) { $l += 'Microsoft.Sql' }
|    $l
|}
|
|function Register-SIResourceProvider {
|    <# Registers a resource provider in the subscription (idempotent; Azure finishes it in the background). #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ProviderNamespace, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $p = Invoke-SIArm -Method POST -Path ("/subscriptions/$sub/providers/$ProviderNamespace/register") -ApiVersion '2021-04-01'
|    return [pscustomobject]@{ ProviderNamespace = $ProviderNamespace; RegistrationState = $(if ($p) { [string]$p.registrationState } else { 'Registering' }) }
|}
|
|function Get-SIArmApiVersion {
|    <# The newest non-preview api-version ARM offers for -ResourceType ('Microsoft.Sql/servers', 'Microsoft.Sql/servers/databases'). Cached. #>
|    param([Parameter(Mandatory)][string]$ResourceType, [string]$SubscriptionId)
|    $st = Get-SIAzRestState
|    $key = 'apiver|' + $ResourceType.ToLowerInvariant()
|    if ($st.Cache.ContainsKey($key)) { return $st.Cache[$key] }
|    $ns, $rest = $ResourceType -split '/', 2
|    $p = Get-SIResourceProvider -ProviderNamespace $ns -SubscriptionId $SubscriptionId -ErrorAction SilentlyContinue
|    $rt = @($p.ResourceTypes | Where-Object { [string]$_.resourceType -eq $rest }) | Select-Object -First 1
|    $v = @(@($rt.apiVersions) | Where-Object { $_ -and $_ -notmatch 'preview' } | Sort-Object -Descending) | Select-Object -First 1
|    if (-not $v) { $v = @(@($rt.apiVersions) | Sort-Object -Descending) | Select-Object -First 1 }
|    if (-not $v) { throw ("Azure does not offer the resource type '{0}' in this subscription." -f $ResourceType) }
|    $st.Cache[$key] = [string]$v
|    return [string]$v
|}
|
|# =====================================================================================================================
|#  (4) Role assignments: delete, and "what does this principal hold, through its groups too"
|# =====================================================================================================================
|
|function Remove-SIRoleAssignment {
|    <#
|        Deletes a role assignment: -RoleAssignmentId, or every assignment of -RoleDefinitionName to -ObjectId exactly at
|        -Scope. Returns what was removed. Absent = nothing to do (idempotent).
|    #>
|    [CmdletBinding()]
|    param([string]$RoleAssignmentId, [string]$ObjectId, [string]$RoleDefinitionName, [string]$Scope)
|    $ids = @()
|    if ($RoleAssignmentId) { $ids = @($RoleAssignmentId) }
|    else {
|        if (-not ($ObjectId -and $RoleDefinitionName -and $Scope)) { throw 'Remove-SIRoleAssignment needs -RoleAssignmentId, or -ObjectId with -RoleDefinitionName and -Scope.' }
|        $ids = @(Get-SIAzRoleAssignmentRest -ObjectId $ObjectId -Scope $Scope -RoleDefinitionName $RoleDefinitionName |
|                 Where-Object { ([string]$_.Scope).TrimEnd('/') -ieq $Scope.TrimEnd('/') } | ForEach-Object { [string]$_.RoleAssignmentId })
|    }
|    foreach ($id in $ids) {
|        $null = Invoke-SIArm -Method DELETE -Path $id -ApiVersion '2022-04-01' -AllowNotFound
|        [pscustomobject]@{ RoleAssignmentId = $id; ObjectId = $ObjectId; RoleDefinitionName = $RoleDefinitionName; Scope = $Scope }
|    }
|}
|
|function New-SIRoleAssignment {
|    <#
|        Assigns -RoleDefinitionName to -ObjectId at -Scope, with the principal's type stated (-PrincipalType, default
|        ServicePrincipal) -- what New-AzRoleAssignment -ObjectType did: ARM then accepts a principal that was created
|        seconds ago and has not replicated yet. Same output shape as New-SIAzRoleAssignment.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$ObjectId,
|        [Parameter(Mandatory)][string]$Scope,
|        [Parameter(Mandatory)][string]$RoleDefinitionName,
|        [ValidateSet('ServicePrincipal', 'User', 'Group', 'ForeignGroup', 'Device')][string]$PrincipalType = 'ServicePrincipal'
|    )
|    $subScope = if ($Scope -match '^(/subscriptions/[^/]+)') { $Matches[1] } else { $Scope }
|    $def = @(Get-SIAzRestRoleDefinitions -Scope $subScope | Where-Object { [string]$_.properties.roleName -eq $RoleDefinitionName }) | Select-Object -First 1
|    if (-not $def) { throw ("The role definition '{0}' was not found at scope '{1}'." -f $RoleDefinitionName, $subScope) }
|    $body = @{ properties = @{ roleDefinitionId = [string]$def.id; principalId = $ObjectId; principalType = $PrincipalType } }
|    $a = Invoke-SIArm -Method PUT -Path ($Scope.TrimEnd('/') + '/providers/Microsoft.Authorization/roleAssignments/' + [guid]::NewGuid().ToString()) -ApiVersion '2022-04-01' -Body $body
|    return [pscustomobject]@{ RoleAssignmentId = [string]$a.id; RoleAssignmentName = [string]$a.name; Scope = $Scope; RoleDefinitionName = $RoleDefinitionName; RoleDefinitionId = [string]$def.name; ObjectId = $ObjectId; ObjectType = $PrincipalType }
|}
|
|function Get-SIRoleAssignmentAssignedTo {
|    <#
|        The role assignments that apply to -ObjectId at or above -Scope, INCLUDING those it holds through a group
|        (ARM's assignedTo() filter -- what Get-AzRoleAssignment -ExpandPrincipalGroups returned). Same object shape as
|        Get-SIAzRoleAssignment.
|    #>
|    param([Parameter(Mandatory)][string]$ObjectId, [string]$Scope, [string]$RoleDefinitionName)
|    if (-not $Scope) { $Scope = '/subscriptions/' + (Get-SISetupSubscriptionId) }
|    $path = $Scope.TrimEnd('/') + '/providers/Microsoft.Authorization/roleAssignments?$filter=' + [uri]::EscapeDataString(("assignedTo('{0}')" -f $ObjectId))
|    $items = @(Invoke-SIArm -Path $path -ApiVersion '2022-04-01' -List)
|    $subScope = if ($Scope -match '^(/subscriptions/[^/]+)') { $Matches[1] } else { $Scope }
|    $defs = @{}
|    foreach ($d in @(Get-SIAzRestRoleDefinitions -Scope $subScope)) { $defs[([string]$d.name).ToLowerInvariant()] = [string]$d.properties.roleName }
|    foreach ($a in $items) {
|        $rdId = ([string]$a.properties.roleDefinitionId -split '/')[-1]
|        $rdName = $defs[$rdId.ToLowerInvariant()]
|        if ($RoleDefinitionName -and $rdName -ne $RoleDefinitionName) { continue }
|        [pscustomobject]@{
|            RoleAssignmentId = [string]$a.id; RoleAssignmentName = [string]$a.name; Scope = [string]$a.properties.scope
|            RoleDefinitionName = $rdName; RoleDefinitionId = $rdId; ObjectId = [string]$a.properties.principalId; ObjectType = [string]$a.properties.principalType
|        }
|    }
|}
|
|# =====================================================================================================================
|#  (5) Typed ARM reads
|# =====================================================================================================================
|
|function Get-SIArmResource {
|    <#
|        One resource by -ResourceId (api-version given, or the newest ARM offers for its type), or every resource of
|        -ResourceType (and -Name / -ResourceGroupName) in the subscription -- what Get-AzResource did. Objects carry
|        ResourceId, Id, Name, ResourceGroupName, ResourceType, Location, Tags, Properties, Identity.
|    #>
|    [CmdletBinding()]
|    param([string]$ResourceId, [string]$ResourceType, [string]$Name, [string]$ResourceGroupName, [string]$ApiVersion, [string]$SubscriptionId)
|    $conv = {
|        param($R)
|        [pscustomobject]@{
|            ResourceId = [string]$R.id; Id = [string]$R.id; Name = [string]$R.name; ResourceGroupName = (Get-SIArmResourceGroupFromId $R.id)
|            ResourceType = [string]$R.type; Type = [string]$R.type; Location = [string]$R.location; Tags = $R.tags; Kind = [string]$R.kind
|            Sku = $R.sku; Properties = $R.properties; Identity = $R.identity
|        }
|    }
|    if ($ResourceId) {
|        if (-not $ApiVersion) {
|            $t = if ($ResourceId -match '/providers/([^/]+)/(.+)$') {
|                $segs = $Matches[2] -split '/'
|                $Matches[1] + '/' + ((0..($segs.Count - 1) | Where-Object { $_ % 2 -eq 0 } | ForEach-Object { $segs[$_] }) -join '/')
|            } else { $null }
|            if (-not $t) { throw ("Not an Azure resource id: {0}" -f $ResourceId) }
|            $ApiVersion = Get-SIArmApiVersion -ResourceType $t
|        }
|        $r = Invoke-SIArm -Path $ResourceId -ApiVersion $ApiVersion -AllowNotFound
|        if (-not $r) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The resource '{0}' was not found." -f $ResourceId) -Target $ResourceId; return }
|        return (& $conv $r)
|    }
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $f = @()
|    if ($ResourceType) { $f += ("resourceType eq '{0}'" -f $ResourceType) }
|    if ($Name) { $f += ("name eq '{0}'" -f $Name) }
|    $base = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/resources" } else { "/subscriptions/$sub/resources" }
|    if ($f.Count) { $base += '?$filter=' + [uri]::EscapeDataString(($f -join ' and ')) }
|    foreach ($r in @(Invoke-SIArm -Path $base -ApiVersion '2021-04-01' -List)) {
|        if ($Name -and [string]$r.name -ne $Name) { continue }
|        & $conv $r
|    }
|}
|
|function Get-SIVirtualMachine {
|    <# A VM: Name, Id, ResourceGroupName, Location, Identity (type, principalId, userAssignedIdentities), VmId. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $v = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Compute/virtualMachines/$Name") -ApiVersion '2023-09-01' -AllowNotFound
|    if (-not $v) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The virtual machine '{0}' was not found in resource group '{1}'." -f $Name, $ResourceGroupName) -Target $Name; return }
|    [pscustomobject]@{ Name = [string]$v.name; Id = [string]$v.id; ResourceGroupName = $ResourceGroupName; Location = [string]$v.location; VmId = [string]$v.properties.vmId; Identity = $v.identity; Tags = $v.tags }
|}
|
|function Get-SIUserAssignedIdentity {
|    <# A user-assigned managed identity: Name, Id, ClientId, PrincipalId, TenantId, Location. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $u = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$Name") -ApiVersion '2023-01-31' -AllowNotFound
|    if (-not $u) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The managed identity '{0}' was not found in resource group '{1}'." -f $Name, $ResourceGroupName) -Target $Name; return }
|    [pscustomobject]@{
|        Name = [string]$u.name; Id = [string]$u.id; ResourceGroupName = $ResourceGroupName; Location = [string]$u.location
|        ClientId = [string]$u.properties.clientId; PrincipalId = [string]$u.properties.principalId; TenantId = [string]$u.properties.tenantId
|    }
|}
|
|function New-SIUserAssignedIdentity {
|    <# Creates (or returns) a user-assigned managed identity. Idempotent: an existing one is returned unchanged. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$Location,
|          [string]$SubscriptionId, [hashtable]$Tag)
|    $have = Get-SIUserAssignedIdentity -ResourceGroupName $ResourceGroupName -Name $Name -SubscriptionId $SubscriptionId -ErrorAction SilentlyContinue
|    if ($have) { return $have }
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $body = @{ location = $Location }
|    if ($Tag -and $Tag.Count) { $body.tags = $Tag }
|    $path = "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$Name"
|    # The create's own answer carries the two ids; a read right after it can still say "not found", or come without them.
|    # So: the answer first, then the identity re-read (6 x 5 s) until BOTH ids are there -- and a clear stop when they
|    # never come: everything after this (role assignments, the jobs' sign-in) needs them.
|    $u = Invoke-SIArm -Method PUT -Path $path -ApiVersion '2023-01-31' -Body $body
|    $sleep = Get-Variable -Scope Global -Name SI_ArmBusySleep -ValueOnly -ErrorAction Ignore
|    for ($i = 0; $i -lt 6; $i++) {
|        if ($u -and $u.properties -and [string]$u.properties.clientId -and [string]$u.properties.principalId) { break }
|        if ($sleep -is [scriptblock]) { & $sleep 5 } else { Start-Sleep -Seconds 5 }
|        $u = Invoke-SIArm -Path $path -ApiVersion '2023-01-31' -AllowNotFound
|    }
|    if (-not $u -or -not $u.properties -or -not [string]$u.properties.clientId -or -not [string]$u.properties.principalId) {
|        throw ("The managed identity '{0}' was created in resource group '{1}', but Azure does not show its client id and principal id yet -- run the same command again in a minute." -f $Name, $ResourceGroupName)
|    }
|    [pscustomobject]@{
|        Name = [string]$u.name; Id = [string]$u.id; ResourceGroupName = $ResourceGroupName; Location = [string]$u.location
|        ClientId = [string]$u.properties.clientId; PrincipalId = [string]$u.properties.principalId; TenantId = [string]$u.properties.tenantId
|    }
|}
|
|function Get-SIVmIdentityPatchBody {
|    <#
|        PURE. The 'identity' body that ADDS a user-assigned identity to a VM and keeps every identity it already has: a
|        system-assigned identity stays (type 'SystemAssigned, UserAssigned'), other user-assigned ones stay listed.
|        Returns $null when the identity is already attached (nothing to change).
|    #>
|    param([AllowNull()]$CurrentIdentity, [Parameter(Mandatory)][string]$IdentityResourceId)
|    $type = if ($CurrentIdentity -and $CurrentIdentity.PSObject.Properties['type']) { [string]$CurrentIdentity.type } else { '' }
|    $ids = [ordered]@{}
|    if ($CurrentIdentity -and $CurrentIdentity.PSObject.Properties['userAssignedIdentities'] -and $CurrentIdentity.userAssignedIdentities) {
|        foreach ($p in $CurrentIdentity.userAssignedIdentities.PSObject.Properties) { $ids[$p.Name] = @{} }
|    }
|    if (@($ids.Keys | Where-Object { "$_" -ieq $IdentityResourceId }).Count) { return $null }
|    $ids[$IdentityResourceId] = @{}
|    $newType = if ($type -match '(?i)SystemAssigned') { 'SystemAssigned, UserAssigned' } else { 'UserAssigned' }
|    @{ identity = @{ type = $newType; userAssignedIdentities = $ids } }
|}
|
|function Add-SIVmUserAssignedIdentity {
|    <# Attaches a user-assigned identity to an Azure VM, keeping the identities it has. Returns $true when it changed. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$VmName,
|          [Parameter(Mandatory)][string]$IdentityResourceId, [string]$SubscriptionId)
|    $vm = Get-SIVirtualMachine -ResourceGroupName $ResourceGroupName -Name $VmName -SubscriptionId $SubscriptionId -ErrorAction Stop
|    $body = Get-SIVmIdentityPatchBody -CurrentIdentity $vm.Identity -IdentityResourceId $IdentityResourceId
|    if (-not $body) { return $false }
|    $null = Invoke-SIArm -Method PATCH -Path $vm.Id -ApiVersion '2023-09-01' -Body $body
|    $true
|}
|
|function Get-SISqlServer {
|    <# Azure SQL logical servers: ServerName, ResourceId, ResourceGroupName, Location, FullyQualifiedDomainName, Administrators. #>
|    [CmdletBinding()]
|    param([string]$ResourceGroupName, [string]$ServerName, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $conv = {
|        param($S)
|        [pscustomobject]@{
|            ServerName = [string]$S.name; ResourceId = [string]$S.id; ResourceGroupName = (Get-SIArmResourceGroupFromId $S.id); Location = [string]$S.location
|            FullyQualifiedDomainName = [string]$S.properties.fullyQualifiedDomainName; Administrators = $S.properties.administrators
|            PublicNetworkAccess = [string]$S.properties.publicNetworkAccess; Tags = $S.tags
|        }
|    }
|    if ($ResourceGroupName -and $ServerName) {
|        $s = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Sql/servers/$ServerName") -ApiVersion '2021-11-01' -AllowNotFound
|        if (-not $s) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The SQL server '{0}' was not found in resource group '{1}'." -f $ServerName, $ResourceGroupName) -Target $ServerName; return }
|        return (& $conv $s)
|    }
|    $path = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Sql/servers" } else { "/subscriptions/$sub/providers/Microsoft.Sql/servers" }
|    foreach ($s in @(Invoke-SIArm -Path $path -ApiVersion '2021-11-01' -List)) { if (-not $ServerName -or [string]$s.name -eq $ServerName) { & $conv $s } }
|}
|
|function Get-SISqlDatabase {
|    <# Databases of an Azure SQL server: DatabaseName, ResourceId, ServerName, Status, SkuName. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$ServerName, [string]$DatabaseName, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $base = "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Sql/servers/$ServerName/databases"
|    $conv = { param($D) [pscustomobject]@{ DatabaseName = [string]$D.name; ResourceId = [string]$D.id; ServerName = $ServerName; ResourceGroupName = $ResourceGroupName; Location = [string]$D.location; Status = [string]$D.properties.status; SkuName = [string]$D.sku.name } }
|    if ($DatabaseName) {
|        $d = Invoke-SIArm -Path ($base + '/' + $DatabaseName) -ApiVersion '2021-11-01' -AllowNotFound
|        if (-not $d) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The database '{0}' was not found on SQL server '{1}'." -f $DatabaseName, $ServerName) -Target $DatabaseName; return }
|        return (& $conv $d)
|    }
|    foreach ($d in @(Invoke-SIArm -Path $base -ApiVersion '2021-11-01' -List)) { & $conv $d }
|}
|
|function Get-SICognitiveServicesAccount {
|    <# Azure OpenAI / Cognitive Services accounts: AccountName, Id, ResourceGroupName, Kind, Endpoint, Location. #>
|    [CmdletBinding()]
|    param([string]$ResourceGroupName, [string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $conv = { param($A) [pscustomobject]@{ AccountName = [string]$A.name; Id = [string]$A.id; ResourceGroupName = (Get-SIArmResourceGroupFromId $A.id); Kind = [string]$A.kind; Location = [string]$A.location; Endpoint = [string]$A.properties.endpoint; Sku = [string]$A.sku.name } }
|    if ($ResourceGroupName -and $Name) {
|        $a = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.CognitiveServices/accounts/$Name") -ApiVersion '2023-05-01' -AllowNotFound
|        if (-not $a) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The Azure AI account '{0}' was not found in resource group '{1}'." -f $Name, $ResourceGroupName) -Target $Name; return }
|        return (& $conv $a)
|    }
|    $path = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.CognitiveServices/accounts" } else { "/subscriptions/$sub/providers/Microsoft.CognitiveServices/accounts" }
|    foreach ($a in @(Invoke-SIArm -Path $path -ApiVersion '2023-05-01' -List)) { if (-not $Name -or [string]$a.name -eq $Name) { & $conv $a } }
|}
|
|function Get-SITenant {
|    <# The tenants the signed-in account can see: Id, TenantId, Name, DefaultDomain, Domains. -TenantId picks one. #>
|    [CmdletBinding()]
|    param([string]$TenantId)
|    $found = $false
|    foreach ($t in @(Invoke-SIArm -Path '/tenants' -ApiVersion '2022-12-01' -List)) {
|        if ($TenantId -and [string]$t.tenantId -ne $TenantId) { continue }
|        $found = $true
|        [pscustomobject]@{ Id = [string]$t.tenantId; TenantId = [string]$t.tenantId; Name = [string]$t.displayName; DefaultDomain = [string]$t.defaultDomain; Domains = @($t.domains); TenantCategory = [string]$t.tenantCategory }
|    }
|    if ($TenantId -and -not $found) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The tenant '{0}' is not visible to the signed-in account." -f $TenantId) -Target $TenantId }
|}
|
|function Get-SILogAnalyticsTable {
|    <# One Log Analytics table (or all): Name, Id, Plan, RetentionInDays, TotalRetentionInDays, Schema (columns). #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$WorkspaceName, [string]$TableName, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $base = "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.OperationalInsights/workspaces/$WorkspaceName/tables"
|    $conv = { param($T) [pscustomobject]@{ Name = [string]$T.name; Id = [string]$T.id; Plan = [string]$T.properties.plan; RetentionInDays = $T.properties.retentionInDays; TotalRetentionInDays = $T.properties.totalRetentionInDays; Schema = $T.properties.schema; ProvisioningState = [string]$T.properties.provisioningState } }
|    if ($TableName) {
|        $t = Invoke-SIArm -Path ($base + '/' + $TableName) -ApiVersion '2022-10-01' -AllowNotFound
|        if (-not $t) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The table '{0}' was not found in workspace '{1}'." -f $TableName, $WorkspaceName) -Target $TableName; return }
|        return (& $conv $t)
|    }
|    foreach ($t in @(Invoke-SIArm -Path $base -ApiVersion '2022-10-01' -List)) { & $conv $t }
|}
|
|# =====================================================================================================================
|#  (7) Storage management through ARM (no data-plane role and no account key needed)
|# =====================================================================================================================
|
|function Get-SIStorageArmChildPath {
|    param([string]$SubscriptionId, [string]$ResourceGroupName, [string]$AccountName, [ValidateSet('Table', 'Container', 'Queue')][string]$Kind, [string]$Name)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $svc = switch ($Kind) { 'Table' { 'tableServices/default/tables' } 'Container' { 'blobServices/default/containers' } 'Queue' { 'queueServices/default/queues' } }
|    return ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Storage/storageAccounts/{2}/{3}/{4}' -f $sub, $ResourceGroupName, $AccountName, $svc, $Name)
|}
|
|function Get-SIStorageArmChild {
|    <# A table / blob container / queue of a storage account, read through ARM; non-terminating not-found. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$AccountName,
|          [Parameter(Mandatory)][ValidateSet('Table', 'Container', 'Queue')][string]$Kind, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $p = Get-SIStorageArmChildPath -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName -AccountName $AccountName -Kind $Kind -Name $Name
|    $r = Invoke-SIArm -Path $p -ApiVersion '2023-01-01' -AllowNotFound
|    if (-not $r) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The {0} '{1}' was not found in storage account '{2}'." -f $Kind.ToLowerInvariant(), $Name, $AccountName) -Target $Name; return }
|    return [pscustomobject]@{ Name = [string]$r.name; Id = [string]$r.id; Kind = $Kind; Properties = $r.properties }
|}
|
|function New-SIStorageArmChild {
|    <# Creates (PUT, idempotent) a table / private blob container / queue through ARM. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$AccountName,
|          [Parameter(Mandatory)][ValidateSet('Table', 'Container', 'Queue')][string]$Kind, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $p = Get-SIStorageArmChildPath -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName -AccountName $AccountName -Kind $Kind -Name $Name
|    $body = if ($Kind -eq 'Container') { @{ properties = @{ publicAccess = 'None' } } } else { @{ properties = @{} } }
|    $r = Invoke-SIArm -Method PUT -Path $p -ApiVersion '2023-01-01' -Body $body
|    return [pscustomobject]@{ Name = $(if ($r) { [string]$r.name } else { $Name }); Id = $(if ($r) { [string]$r.id } else { $p }); Kind = $Kind }
|}
|
|function Get-SIStorageLifecyclePolicy {
|    <# The account's lifecycle management policy: .Rules (the raw ARM rules: name, enabled, type, definition); $null when there is none. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$AccountName, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $p = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Storage/storageAccounts/$AccountName/managementPolicies/default") -ApiVersion '2023-01-01' -AllowNotFound
|    if (-not $p) { return $null }
|    return [pscustomobject]@{ Id = [string]$p.id; Rules = @($p.properties.policy.rules | Where-Object { $_ }); LastModifiedTime = $p.properties.lastModifiedTime }
|}
|
|function Set-SIStorageLifecyclePolicy {
|    <# REPLACES the account's lifecycle policy with -Rules (raw ARM rule objects). Callers merge, see New-SIStorageLifecycleDeleteRule. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$AccountName, [Parameter(Mandatory)][object[]]$Rules, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $p = Invoke-SIArm -Method PUT -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Storage/storageAccounts/$AccountName/managementPolicies/default") -ApiVersion '2023-01-01' `
|             -Body @{ properties = @{ policy = @{ rules = @($Rules) } } }
|    return [pscustomobject]@{ Id = [string]$p.id; Rules = @($p.properties.policy.rules | Where-Object { $_ }) }
|}
|
|function New-SIStorageLifecycleDeleteRule {
|    <# PURE. A lifecycle rule that deletes block blobs under -PrefixMatch N days after their last modification. #>
|    param([Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string[]]$PrefixMatch, [Parameter(Mandatory)][int]$DaysAfterModification)
|    return [ordered]@{
|        enabled    = $true
|        name       = $Name
|        type       = 'Lifecycle'
|        definition = [ordered]@{
|            actions = @{ baseBlob = @{ delete = @{ daysAfterModificationGreaterThan = $DaysAfterModification } } }
|            filters = [ordered]@{ blobTypes = @('blockBlob'); prefixMatch = @($PrefixMatch) }
|        }
|    }
|}
|
|function Get-SIStorageLifecycleRuleDeleteDays {
|    <# PURE. The delete-after-modification days of a raw lifecycle rule ($null when it has none). #>
|    param($Rule)
|    try { return $Rule.definition.actions.baseBlob.delete.daysAfterModificationGreaterThan } catch { return $null }
|}
|
|function Test-SIStorageAccountNameAvailability {
|    <# Microsoft.Storage checkNameAvailability: NameAvailable, Reason, Message. #>
|    param([Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $r = Invoke-SIArm -Method POST -Path ("/subscriptions/$sub/providers/Microsoft.Storage/checkNameAvailability") -ApiVersion '2023-01-01' -Body @{ name = $Name; type = 'Microsoft.Storage/storageAccounts' }
|    return [pscustomobject]@{ NameAvailable = [bool]$r.nameAvailable; Reason = [string]$r.reason; Message = [string]$r.message }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-AzRest.ps1'] = @{ Sha256 = 'ab77e822fccc463f44911a2b47f52d56e82bdaac4b48f605f2252ecd332bfd5f'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- Azure over plain REST, without the Az.* PowerShell modules (REQUIREMENTS 9.3, decision 2:
|    "no PS module dependencies ... go pure REST").
|
|    SecurityInsight runs with NO PowerShell modules: every Azure call is plain REST with tokens from SecurityInsight's
|    own sign-in (managed identity, certificate client assertion, client secret -- the run's decision). There is no
|    switch and no module path: no Az module is loaded, installed or needed anywhere in the runtime.
|
|    The call sites keep the familiar names with 'SIAz' in place of 'Az' (Invoke-SIAzOperationalInsightsQuery,
|    Search-SIAzGraph, ...). Each wrapper takes the arguments the call sites pass and does the job over REST (its *Rest
|    twin), returning objects with the properties the call sites read. Connect-SIAzAccount only RECORDS which identity to
|    sign in as; each REST call mints its token when it needs one.
|    The REST building blocks are public and usable directly:
|        Get-SIAzureToken -Audience Arm|LaQuery|Storage|KeyVault|Graph      one token function per audience
|        Invoke-SILaQuery                                                   Log Analytics data plane (api.loganalytics.io)
|        Invoke-SIArm                                                       ARM GET/PUT/PATCH/DELETE, list with nextLink
|        Search-SIResourceGraph                                             Resource Graph, every page ($skipToken)
|        Get-SIKeyVaultSecretValue                                          one secret, as plain text
|        Get-SIBlobContent / Set-SIBlobContent / Get-SIBlobList / ...       blob data plane (OAuth, x-ms-version)
|        Send-SIQueueMessage / Receive-SIQueueMessage / Remove-SIQueueMessage
|        Get-SITableEntity / Set-SITableEntity                              table data plane (upsert)
|
|    HTTP: every call of this file goes through Invoke-SIAzRestHttp. Token requests (client secret) go through
|    SI-LogIngest.ps1's Invoke-SILogIngestHttp -- the same HttpWebRequest shape; tests mock both seams.
|    Token hook: $global:SI_TokenProvider = { param($Resource) ... } (a scriptblock returning a bearer token) is consulted
|    first by Get-SIAzureToken and Get-SILogIngestToken when set -- for a host with its own sign-in, e.g. setup.
|
|    Retry rule (CLAUDE.md working rule 4): 429 / 408 / 5xx / no response -> wait (Retry-After when sent) and retry
|    in-run; 401 once -> refresh the token and repeat once; any other 4xx -> FAIL FAST with the service's own body.
|
|    PS 5.1 safe (no ?. / ??, no RSA.ImportFromPem); works on pwsh 7 and in a Linux container (no Cert: drive needed).
|    Ships in both editions and never references a Pro path.
|#>
|
|# NO Set-StrictMode HERE -- a dot-sourced file that sets it leaks into the caller's scope.
|
|# #730: the streaming Log Analytics reader (Invoke-SILaQuery reads Risk Analysis' answers with it; compiled on first use)
|if (-not (Get-Command -Name Get-SILaStreamReaderType -ErrorAction Ignore)) {
|    $__siLaStream = [System.IO.Path]::Combine($PSScriptRoot, 'SI-LaStreamRead.ps1')
|    if ([System.IO.File]::Exists($__siLaStream)) { . $__siLaStream }
|}
|
|# ONE connect path (#524, owner 2026-10-09 "modern single connect only"): SecurityInsight's own REST token client --
|# managed identity, certificate, client secret (and, in setup, a person's own sign-in). The old sign-in mode "AzContext"
|# (#413: borrow the current Azure / Invardia Support session of the process) and its file SI-AzSession.ps1 are gone.
|#
|# ONE TOKEN SOURCE more for that same path (#524, owner 2026-10-09 via Invardia: "support installs use TOKENS, never the
|# secret"): in a shell where Invardia's Connect-InvardiaSupport is open, its function Get-InvardiaSupportToken -Resource <r>
|# returns a bearer token as the customer's Invardia support app (cached by Invardia, tid + appid verified there). SI takes
|# EVERY token from it -- Mode 'Support' -- and still checks each token's tenant against the tenant it works in. No session
|# state is read (only the token), no Az / Graph cmdlet is called. Outside a support session nothing changes.
|#
|# THE SESSION ITSELF IS USED (owner 2026-10-12: a change in an environment is made inside its Invardia Support session, so
|# it is recorded in that environment's audit log). Get-SISupportSession is the ONE place that says whether a session is
|# open: Invardia's $global:InvardiaSupportState names a tenant AND its recording command Invoke-InvardiaSupportRequest is
|# in the shell. With a session, who SecurityInsight works as (tenant, app, subscriptions) is read from it -- no sign-in of
|# SecurityInsight's own and no token request -- and every HTTP call goes through the recording command (Invoke-SISupportHttp).
|
|function Get-SISupportedSignInText {
|    <# PURE. The sign-ins SecurityInsight supports, for an error message. #>
|    'a managed identity (SI_AuthMethod = ManagedIdentity), an app with a certificate (SI_SPN_AppId + SI_SPN_TenantId + SI_SPN_CertThumbprint), an app with a client secret (SI_SPN_AppId + SI_SPN_TenantId + SI_SPN_Secret), or the tokens of an Invardia support session (Get-InvardiaSupportToken). An Azure session of this PowerShell process (Connect-AzAccount, az login) is never used'
|}
|
|function Get-SISupportSession {
|    <#
|        THE ONE PLACE that says whether an Invardia Support session is open in this PowerShell session, and what it names.
|        Open = Invardia's $global:InvardiaSupportState is a hashtable that names a tenant AND its recording command
|        Invoke-InvardiaSupportRequest is here (Test-Path Function: -- never Get-Command, which can load a module).
|        $null when there is none (Disconnect-InvardiaSupport empties the state). Never guessed: a state WITHOUT the
|        recording command is said and stops the caller -- nothing could be recorded.
|        Returns TenantId, AppId, Environment (the handle), EnvironmentId, SessionId, Subscriptions (lower case; the ones the
|        environment names), SubscriptionId (the first of them, '' when it names none), SubscriptionName.
|    #>
|    $s = Get-Variable -Scope Global -Name InvardiaSupportState -ValueOnly -ErrorAction Ignore
|    if (-not ($s -is [hashtable])) { return $null }
|    $tid = [string]$s['TenantId']
|    if ([string]::IsNullOrWhiteSpace($tid)) { return $null }
|    if (-not (Test-Path -LiteralPath 'Function:\Invoke-InvardiaSupportRequest')) {
|        throw ('An Invardia Support session is noted in this PowerShell session (tenant {0}), but its recording command Invoke-InvardiaSupportRequest is not here, so nothing SecurityInsight does could be recorded. Nothing was done. Open the session again (Connect-InvardiaSupport -Environment <handle> -Reason ''<why>''), or end it (Disconnect-InvardiaSupport) and work with your own sign-in.' -f $tid)
|    }
|    $subs = @(@($s['Subscriptions']) | Where-Object { $_ } | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() } | Where-Object { $_ })
|    $first = ''
|    if ($subs.Count) { $first = [string]$subs[0] }
|    return [pscustomobject]@{
|        TenantId = $tid.Trim(); AppId = [string]$s['AppId']; Environment = [string]$s['Environment']; EnvironmentId = [string]$s['EnvironmentId']
|        SessionId = [string]$s['SessionId']; Subscriptions = [string[]]$subs; SubscriptionId = $first; SubscriptionName = [string]$s['SubscriptionName']
|    }
|}
|
|function Get-SISupportSessionName {
|    <# PURE. How a Support session is named in a message: its environment handle, else its tenant. #>
|    param($Session)
|    if ($Session -and [string]$Session.Environment) { return [string]$Session.Environment }
|    if ($Session) { return ('tenant {0}' -f $Session.TenantId) }
|    return ''
|}
|
|function Assert-SISupportSubscription {
|    <# In a Support session only a subscription the environment names is worked in: any other is REFUSED (throws). A session
|       whose environment names no subscription refuses none (Invardia's own rule). No session = nothing to check. #>
|    param([string]$SubscriptionId, $Session)
|    if ([string]::IsNullOrWhiteSpace($SubscriptionId)) { return }
|    if (-not $Session) { $Session = Get-SISupportSession }
|    if (-not $Session) { return }
|    $named = @($Session.Subscriptions)
|    if ($named.Count -and $named -notcontains $SubscriptionId.Trim().ToLowerInvariant()) {
|        throw ('Subscription {0} is not one the Invardia Support session for {1} names ({2}) -- refused, nothing was done there. Use a subscription of this environment, or open the Support session of the environment that owns {0}.' -f $SubscriptionId, (Get-SISupportSessionName $Session), ($named -join ', '))
|    }
|}
|
|function Test-SISupportTokenSource {
|    <# Is an Invardia Support session open in this shell? (Get-SISupportSession decides -- the one place.) #>
|    return [bool](Get-SISupportSession)
|}
|
|function Get-SISupportExpectedTenantId {
|    <# The tenant SI works in, which the Support session must be for: -TenantId, else the configured one. Empty = the
|       session's own. #>
|    param([string]$TenantId)
|    if ($TenantId) { return $TenantId }
|    return [string](Get-SIAzRestValue 'SI_SPN_TenantId', 'SpnTenantId', 'AzureTenantId', 'TenantId')
|}
|
|function Get-SISupportToken {
|    <#
|        A bearer token for -Resource from the Invardia Support session; its 'tid' must be -TenantId (refused otherwise).
|        ONLY for what has no HTTP request the recording command can send -- the SQL sign-in of a database step, the
|        container registry's own token exchange, reading who the Support app is from its token. Invardia records that the
|        token was issued; what is done with it is not recorded. Every HTTP call goes through Invoke-SISupportHttp instead
|        and asks for no token here.
|    #>
|    param([Parameter(Mandatory)][string]$Resource, [string]$TenantId, [switch]$ForceRefresh)
|    if (-not (Get-SISupportSession)) { throw 'No Invardia Support session is open in this PowerShell session (Connect-InvardiaSupport -Environment <handle> -Reason ''<why>'').' }
|    if (-not (Test-Path -LiteralPath 'Function:\Get-InvardiaSupportToken')) { throw ('The Invardia Support session in this PowerShell session has no token command (Get-InvardiaSupportToken), so no token for {0} can be taken from it. Open the session again (Connect-InvardiaSupport).' -f $Resource) }
|    $p = @{ Resource = $Resource.TrimEnd('/') }
|    if ($ForceRefresh) { $p['ForceRefresh'] = $true }
|    $tok = [string](Get-InvardiaSupportToken @p)
|    if ([string]::IsNullOrWhiteSpace($tok)) { throw ('The Invardia support session returned no token for {0}.' -f $Resource) }
|    $c = ConvertFrom-SIJwtPayload $tok
|    if (-not $c -or -not [string]$c.tid) { throw ('The Invardia support token for {0} could not be read (no tenant in it) -- refused.' -f $Resource) }
|    if ($TenantId -and [string]$c.tid -ne $TenantId) {
|        throw ('The Invardia support token for {0} is for tenant {1}, not {2} -- refused. Connect the support session of tenant {2}.' -f $Resource, $c.tid, $TenantId)
|    }
|    return $tok
|}
|
|function Get-SISupportAuth {
|    <# The Auth hashtable of the Invardia Support session: Mode 'Support', app + tenant + first subscription read from the
|       SESSION (Get-SISupportSession) -- no token is asked for. Refused when the session is for another tenant than
|       -TenantId / the configured one. ObjectId is not known here (Get-SISetupSignedInObjectId finds it when asked). #>
|    param([string]$TenantId)
|    $sess = Get-SISupportSession
|    if (-not $sess) { throw 'No Invardia Support session is open in this PowerShell session (Connect-InvardiaSupport -Environment <handle> -Reason ''<why>'').' }
|    $want = Get-SISupportExpectedTenantId -TenantId $TenantId
|    if ($want -and $want -ne $sess.TenantId) {
|        throw ('The Invardia Support session for {0} is for tenant {1}, not {2} -- refused. Connect the support session of tenant {2}.' -f (Get-SISupportSessionName $sess), $sess.TenantId, $want)
|    }
|    return @{ Mode = 'Support'; AppId = [string]$sess.AppId; TenantId = [string]$sess.TenantId; ObjectId = $null; SubscriptionId = [string]$sess.SubscriptionId
|              Environment = [string]$sess.Environment; EnvironmentId = [string]$sess.EnvironmentId; SessionId = [string]$sess.SessionId }
|}
|
|function Sync-SISupportConnection {
|    <#
|        Keeps the recorded sign-in of this process in step with the Invardia Support session, and returns the session
|        ($null = none):
|          * no session, but the recorded sign-in is a Support one  -> the session was closed: the sign-in is dropped
|          * a session and no recorded sign-in (or one of ANOTHER session) -> the session becomes the sign-in
|          * a session and a recorded sign-in of SecurityInsight's own -> kept, unless -TakeOver (setup: a Support session
|            in the shell always wins there -- setup never works beside it with a sign-in of its own)
|        Says ONE plain line the first time a session is used. Throws what Get-SISupportSession / Get-SISupportAuth refuse.
|    #>
|    param([switch]$TakeOver)
|    $sess = Get-SISupportSession
|    $st = Get-SIAzRestState
|    $c = $st.Connection
|    $isSupport = ($c -is [hashtable]) -and ([string]$c.Mode -eq 'Support')
|    if (-not $sess) {
|        if ($isSupport) { $st.Connection = $null; $st.TenantId = $null; $st.SubscriptionId = $null; $st.Cache = @{} }
|        return $null
|    }
|    $same = $isSupport -and ([string]$c.TenantId -eq $sess.TenantId) -and ([string]$c.SessionId -eq $sess.SessionId) -and ([string]$c.EnvironmentId -eq $sess.EnvironmentId)
|    if ($same) { return $sess }
|    if (($c -is [hashtable]) -and -not $isSupport -and -not $TakeOver) { return $sess }
|    $st.Connection = Get-SISupportAuth
|    $st.TenantId = [string]$sess.TenantId
|    $st.Cache = @{}
|    if ($st.SubscriptionId -and @($sess.Subscriptions).Count -and @($sess.Subscriptions) -notcontains ([string]$st.SubscriptionId).Trim().ToLowerInvariant()) { $st.SubscriptionId = $null }
|    $key = '{0}|{1}|{2}' -f $sess.TenantId, $sess.EnvironmentId, $sess.SessionId
|    if ([string]$st['SupportSaid'] -ne $key) {
|        $st['SupportSaid'] = $key
|        Write-Host ('using the Invardia Support session for {0} -- every change is recorded there' -f (Get-SISupportSessionName $sess))
|    }
|    return $sess
|}
|
|function Test-SISupportRecorderPresent {
|    <# #548: is an Invardia Support session, with its RECORDING wrapper, open in this shell? (Get-SISupportSession decides.) #>
|    return [bool](Get-SISupportSession)
|}
|
|function Test-SISupportRequestRoute {
|    <#
|        #548 (Invardia, 2026-10-10: every Support app action is recorded in the customer's audit log): does a request for
|        -Audience, as -Auth (none = the run's own sign-in), go through Invardia's recording wrapper? Yes when a Support
|        session is open (Get-SISupportSession) AND the call is made as the support session (Mode 'Support' -- the recorded
|        sign-in, or no recorded sign-in at all) AND no host token provider ($global:SI_TokenProvider) answers instead.
|        Every audience SecurityInsight signs in to: Arm, Graph, Log Analytics, Storage, Exchange Online's admin API, Key
|        Vault and Azure Monitor -- on any host (a host the wrapper does not know by itself gets its token audience named,
|        Get-SISupportTokenResource). A URL that is none of these (-Audience Other: another service with its own key) is
|        not a call as the support app and never goes through it. -Uri is accepted for callers that pass it.
|    #>
|    param([string]$Audience = 'Arm', [hashtable]$Auth, [string]$Uri)
|    if ($Audience -notin 'Arm', 'Graph', 'LaQuery', 'Storage', 'Exchange', 'KeyVault', 'Monitor') { return $false }
|    if ($Auth) {
|        if ([string]$Auth.Mode -ne 'Support') { return $false }
|        return [bool](Get-SISupportSession)
|    }
|    $tp = Get-Variable -Scope Global -Name SI_TokenProvider -ValueOnly -ErrorAction Ignore
|    if ($tp -is [scriptblock]) { return $false }
|    # a caller that loaded only part of this file (a script's own fakes, a lifted function) has no state helpers -- and no
|    # support session either
|    if (-not (Test-Path -LiteralPath 'Function:\Get-SIAzRestState')) { return $false }
|    if (-not (Test-Path -LiteralPath 'Function:\Sync-SISupportConnection')) { return $false }
|    if (-not (Sync-SISupportConnection)) { return $false }
|    $c = (Get-SIAzRestState).Connection
|    return (($c -is [hashtable]) -and ([string]$c.Mode -eq 'Support'))
|}
|
|function Get-SISupportTokenResource {
|    <# PURE. The token audience to NAME to the recording wrapper for a request it cannot name from the URL's host by
|       itself: a Key Vault or Azure Monitor URL on another host than <vault>.vault.azure.net /
|       <endpoint>.ingest.monitor.azure.com. '' = the wrapper names it (Arm, Graph, Log Analytics, Storage, Exchange). #>
|    param([string]$Audience, [string]$Uri)
|    $h = ''
|    try { $h = ([uri]$Uri).Host } catch { $h = '' }
|    if ($Audience -eq 'KeyVault' -and $h -notmatch '(?i)\.vault\.azure\.net$') { return 'https://vault.azure.net' }
|    if ($Audience -eq 'Monitor' -and $h -notmatch '(?i)\.ingest\.monitor\.azure\.com$') { return 'https://monitor.azure.com' }
|    return ''
|}
|
|function Test-SISupportReadOnlyPost {
|    <#
|        PURE. Is this POST a READ (recorded as a read, not as a change)? Only the POSTs known to change nothing:
|          ARM    Resource Graph (/providers/Microsoft.ResourceGraph/resources), a provider's checkNameAvailability, a
|                 workspace query (.../workspaces/<name>/query, /api/query)
|          Log Analytics   /v1/workspaces/<id>/query
|          Graph  getByIds, getMemberObjects, getMemberGroups, checkMemberObjects, checkMemberGroups, security/runHuntingQuery
|                 (a KQL hunting query), and a $batch whose
|                 requests are ALL GET
|        Anything else -- and anything not understood -- is a CHANGE. A GET / HEAD is a read by its method (not asked here).
|    #>
|    param([string]$Method, [string]$Uri, $Body)
|    if (([string]$Method).ToUpperInvariant() -ne 'POST') { return $false }
|    $u = $null
|    try { $u = [uri]$Uri } catch { return $false }
|    if (-not $u -or -not $u.IsAbsoluteUri) { return $false }
|    $h = $u.Host.ToLowerInvariant(); $p = $u.AbsolutePath
|    if ($h -match '^management\.(azure\.com|core\.windows\.net)$') {
|        if ($p -match '(?i)^/providers/Microsoft\.ResourceGraph/resources/?$') { return $true }
|        if ($p -match '(?i)/providers/[^/]+/checkNameAvailability/?$') { return $true }
|        if ($p -match '(?i)/providers/Microsoft\.OperationalInsights/workspaces/[^/]+/(api/)?query/?$') { return $true }
|        return $false
|    }
|    if ($h -eq 'api.loganalytics.io' -or $h -eq 'api.loganalytics.azure.com') { return [bool]($p -match '(?i)^/v1/workspaces/[^/]+/query/?$') }
|    if ($h -eq 'graph.microsoft.com') {
|        if ($p -match '(?i)/(getByIds|getMemberObjects|getMemberGroups|checkMemberObjects|checkMemberGroups)/?$') { return $true }
|        # Defender advanced hunting: a KQL query, which can only read
|        if ($p -match '(?i)^/(v1\.0|beta)/security/runHuntingQuery/?$') { return $true }
|        if ($p -match '(?i)^/(v1\.0|beta)/\$batch/?$') {
|            try {
|                $text = ''
|                if ($Body -is [byte[]]) { $text = [System.Text.Encoding]::UTF8.GetString($Body) } else { $text = [string]$Body }
|                $reqs = @(($text | ConvertFrom-Json).requests | Where-Object { $null -ne $_ })
|                if (-not $reqs.Count) { return $false }
|                return (-not @($reqs | Where-Object { ([string]$_.method).ToUpperInvariant() -ne 'GET' }).Count)
|            } catch { return $false }
|        }
|        return $false
|    }
|    return $false
|}
|
|function Test-SISupportBodyIsText {
|    <# PURE. Can -Body go through Invardia's recording wrapper? Yes for every body: the wrapper sends a [byte[]] body
|       unchanged (Invardia, 2026-10-10). Kept as the one place to say otherwise. #>
|    param($Body, [string]$ContentType)
|    return $true
|}
|
|function Invoke-SISupportHttp {
|    <#
|        #548: ONE HTTP exchange through Invardia's recording wrapper, in the shape of Invoke-SIAzRestHttp (StatusCode,
|        Content, Bytes, Headers, RetryAfter) so Invoke-SIAzRestRequest's retry and error rules stay exactly as they are
|        (an HTTP status >= 400 becomes SecurityInsight's own error there). The wrapper adds the support app's token: an
|        Authorization header of the caller is dropped. No answer = StatusCode 0 (retried like any network failure); a
|        refusal to record the action in the customer's audit log is RETHROWN (fail-closed: the action was not made).
|        A GET / HEAD is a read by its method; a POST that only reads (Test-SISupportReadOnlyPost) is sent -ReadOnly;
|        everything else is recorded as a change. An Azure Resource Manager URL of a subscription the session's environment
|        does not name is REFUSED before anything is sent (Assert-SISupportSubscription). -Audience names the token audience
|        for a host the wrapper does not know (Get-SISupportTokenResource); -TimeoutSec is passed on.
|    #>
|    param([Parameter(Mandatory)][string]$Method, [Parameter(Mandatory)][string]$Uri, [hashtable]$Headers, $Body, [string]$ContentType, [switch]$AsBytes,
|          [string]$Audience, [int]$TimeoutSec = 0)
|    $sess = Get-SISupportSession
|    if (-not $sess) { throw 'No Invardia support session is open in this PowerShell session, so this request cannot be sent through it.' }
|    $target = $null
|    try { $target = [uri]$Uri } catch { $target = $null }
|    if ($target -and $target.IsAbsoluteUri -and $target.Host -match '(?i)^management\.(azure\.com|core\.windows\.net)$' -and
|        $target.AbsolutePath -match '(?i)^/subscriptions/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(/|$)') {
|        Assert-SISupportSubscription -SubscriptionId $Matches[1] -Session $sess
|    }
|    $h = @{}
|    if ($Headers) { foreach ($k in @($Headers.Keys)) { if ([string]$k -ine 'Authorization' -and [string]$k -ine 'Content-Type') { $h[[string]$k] = $Headers[$k] } elseif ([string]$k -ieq 'Content-Type' -and -not $ContentType) { $ContentType = [string]$Headers[$k] } } }
|    $p = @{ Method = $Method.ToUpperInvariant(); Uri = $Uri }
|    if ($h.Count) { $p.Headers = $h }
|    if ($null -ne $Body) {
|        # bytes go unchanged (a source package upload). NOT $(if ...): a subexpression ENUMERATES the byte array into an
|        # object[] -- the wrapper then sent it as JSON numbers instead of the file
|        if ($Body -is [byte[]]) { $p.Body = $Body } else { $p.Body = [string]$Body }
|        if ($ContentType) { $p.ContentType = $ContentType }
|    }
|    $o = $null
|    if ($AsBytes) { $p.AsBytes = $true }   # the raw answer as ContentBytes (a download)
|    if (Test-SISupportReadOnlyPost -Method $Method -Uri $Uri -Body $Body) { $p.ReadOnly = $true }   # a POST that only reads
|    if ($TimeoutSec -gt 0) { $p.TimeoutSec = $TimeoutSec }
|    $tokenResource = Get-SISupportTokenResource -Audience $Audience -Uri $Uri
|    if ($tokenResource) { $p.TokenResource = $tokenResource }
|    try { $o = Invoke-InvardiaSupportRequest @p }
|    catch {
|        $m = [string]$_.Exception.Message
|        if ($m -match '(?i)audit log|fail-closed|could not be recorded|No Invardia support session') { throw }
|        return [pscustomobject]@{ StatusCode = 0; Content = $m; Bytes = $null; Headers = @{}; RetryAfter = $null }
|    }
|    $hh = New-Object 'System.Collections.Hashtable' ([System.StringComparer]::OrdinalIgnoreCase)
|    if ($o -and $o.Headers) {
|        try {
|            if ($o.Headers -is [System.Collections.IDictionary]) { foreach ($k in @($o.Headers.Keys)) { $hh[[string]$k] = (@($o.Headers[$k]) | ForEach-Object { [string]$_ }) -join ',' } }
|            else { foreach ($k in @($o.Headers.AllKeys)) { $hh[[string]$k] = [string]$o.Headers[$k] } }
|        } catch { }
|    }
|    $text = if ($o) { [string]$o.Content } else { '' }
|    # the raw answer as [byte[]] -- assigned in statements, never through $( ... ), which would enumerate it into object[]
|    [byte[]]$raw = $null
|    if ($AsBytes) {
|        if ($o -and $o.PSObject.Properties['ContentBytes'] -and $o.ContentBytes) { $raw = [byte[]]$o.ContentBytes } else { $raw = [System.Text.Encoding]::UTF8.GetBytes($text) }
|    }
|    $out = [pscustomobject]@{
|        StatusCode = $(if ($o) { [int]$o.StatusCode } else { 0 }); Content = $(if ($AsBytes) { '' } else { $text })
|        Bytes = $null; Headers = $hh; RetryAfter = [string]$hh['Retry-After']
|    }
|    $out.Bytes = $raw
|    $out
|}
|
|function Invoke-SIRestMethod {
|    <#
|        #548: the drop-in for Invoke-RestMethod that setup's own Graph / ARM calls use (-Method, -Uri, -Headers with the
|        caller's bearer token, -Body, -ContentType): inside an Invardia support session the call goes through the recording
|        wrapper (the caller's Authorization header is dropped -- the wrapper signs as the support app); otherwise exactly
|        Invoke-RestMethod. Throws on HTTP >= 400 like Invoke-RestMethod, with the service's answer in the message; returns
|        the parsed JSON (or the text when it is not JSON).
|    #>
|    [CmdletBinding()]   # -ErrorAction and the other common parameters, as Invoke-RestMethod callers pass them
|    param([string]$Method = 'GET', [Parameter(Mandatory)][string]$Uri, [hashtable]$Headers, $Body, [string]$ContentType, [int]$TimeoutSec = 120)
|    $host_ = ([uri]$Uri).Host
|    $aud = if ($host_ -eq 'graph.microsoft.com') { 'Graph' } elseif ($host_ -match '^management\.(azure\.com|core\.windows\.net)$') { 'Arm' } elseif ($host_ -eq 'api.loganalytics.io') { 'LaQuery' } elseif ($host_ -eq 'outlook.office365.com') { 'Exchange' } else { 'Other' }
|    # this function is published GLOBALLY: a caller that never loaded this file (a script run on its own, a test with its
|    # own fakes) has no routing helpers -- and then no support session either: plain Invoke-RestMethod
|    if ((Test-Path -LiteralPath 'Function:\Test-SISupportRequestRoute') -and (Test-SISupportRequestRoute -Audience $aud)) {
|        $b = $Body
|        if ($null -ne $b -and -not ($b -is [string]) -and -not ($b -is [byte[]])) { $b = ConvertTo-Json -InputObject $b -Depth 30 -Compress }
|        $ct = if ($ContentType) { $ContentType } elseif ($null -ne $b) { 'application/json' } else { '' }
|        $r = Invoke-SISupportHttp -Method $Method -Uri $Uri -Headers $Headers -Body $b -ContentType $ct -Audience $aud -TimeoutSec $TimeoutSec
|        $code = [int]$r.StatusCode
|        if ($code -lt 200 -or $code -ge 300) {
|            throw (New-SIAzRestError -Message ('{0} {1} failed. HTTP Status: {2} ({3}) Response: {4}' -f $Method.ToUpperInvariant(), ($Uri -replace '\?.*$', ''), $code, (Get-SIAzRestStatusName $code), $r.Content) -Response $r)
|        }
|        $t = [string]$r.Content
|        if (-not $t.Trim()) { return $null }
|        try { return ($t | ConvertFrom-Json) } catch { return $t }
|    }
|    $a = @{ Method = $Method; Uri = $Uri; ErrorAction = 'Stop'; TimeoutSec = $TimeoutSec }
|    if ($Headers) { $a.Headers = $Headers }
|    if ($null -ne $Body) { $a.Body = $Body }
|    if ($ContentType) { $a.ContentType = $ContentType }
|    Invoke-RestMethod @a
|}
|# published globally: a product script the install runs (in this process) finds it even when it loaded only part of the layer
|Set-Item -Path 'function:global:Invoke-SIRestMethod' -Value ${function:Invoke-SIRestMethod}
|
|# =====================================================================================================================
|#  The wrapper map, shared state
|# =====================================================================================================================
|
|function Get-SIAzRestWrapperMap {
|    <# wrapper -> the Az cmdlet it replaces -> its REST twin, as data. The wiring tests read it. #>
|    $m = [ordered]@{}
|    foreach ($az in @(
|        'Connect-AzAccount', 'Disconnect-AzAccount', 'Disable-AzContextAutosave', 'Get-AzContext', 'Set-AzContext',
|        'Get-AzAccessToken', 'Get-AzSubscription', 'Invoke-AzRestMethod',
|        'Invoke-AzOperationalInsightsQuery', 'Get-AzOperationalInsightsWorkspace', 'New-AzOperationalInsightsWorkspace',
|        'Search-AzGraph', 'Get-AzKeyVaultSecret', 'Set-AzKeyVaultSecret',
|        'Get-AzResourceGroup', 'New-AzResourceGroup', 'Get-AzRoleAssignment', 'New-AzRoleAssignment', 'Get-AzRoleDefinition',
|        'Get-AzTag', 'Update-AzTag', 'Get-AzADServicePrincipal',
|        'Get-AzDataCollectionEndpoint', 'New-AzDataCollectionEndpoint', 'Get-AzDataCollectionRule',
|        'New-AzStorageContext', 'Get-AzStorageAccount', 'New-AzStorageAccount',
|        'Get-AzStorageContainer', 'New-AzStorageContainer', 'Get-AzStorageBlob', 'Get-AzStorageBlobContent',
|        'Set-AzStorageBlobContent', 'Remove-AzStorageBlob', 'Start-AzStorageBlobCopy',
|        'Get-AzStorageQueue', 'New-AzStorageQueue')) {
|        $w = $az -replace '-Az', '-SIAz'
|        $m[$w] = @{ Replaces = $az; Rest = ($w + 'Rest') }
|    }
|    return $m
|}
|
|function Get-SIAzRestState {
|    <# Per-process state: the recorded sign-in, the current subscription, token / lookup caches. Global because this
|       file is dot-sourced at different depths by different engines. #>
|    # StrictMode-safe: an unset global is read through Get-Variable, never directly (a caller may run Set-StrictMode).
|    if (-not ((Get-Variable -Scope Global -Name SI_AzRestState -ValueOnly -ErrorAction Ignore) -is [hashtable])) {
|        $global:SI_AzRestState = @{ Connection = $null; SubscriptionId = $null; TenantId = $null; Cache = @{} }
|    }
|    return $global:SI_AzRestState
|}
|
|function Initialize-SIAzRestHelpers {
|    <# The token functions (SI-LogIngest.ps1), the KQL error reader (SI-KqlError.ps1) and the certificate helpers
|       (auth/Find-SICertificate.ps1). Loaded on first need; only what is MISSING is loaded and published globally, so a
|       caller's own copy or a test's mock is never replaced. #>
|    $want = @(
|        @{ Path = (Join-Path $PSScriptRoot 'SI-LogIngest.ps1'); Fns = @('Get-SILogIngestToken', 'Invoke-SILogIngestHttp', 'Get-SILogIngestRunCache', 'Get-SILogIngestRetryDelay', 'Initialize-SILogIngestAuthHelpers') }
|        @{ Path = (Join-Path $PSScriptRoot 'SI-KqlError.ps1');   Fns = @('Get-SIKqlErrorText', 'Get-SIKqlErrorSummary', 'Test-SIKqlTableMissing') }
|        @{ Path = (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'auth/Find-SICertificate.ps1'); Fns = @('Get-SICertificateClientToken', 'Get-SICertificateFromStore', 'Test-SICertDriveAvailable') }
|    )
|    foreach ($w in $want) {
|        $missing = @($w.Fns | Where-Object { -not (Get-Command -Name $_ -ErrorAction Ignore) })
|        if ($missing.Count -eq 0) { continue }
|        if (-not (Test-Path -LiteralPath $w.Path)) { continue }
|        . $w.Path
|        foreach ($n in $missing) {
|            $f = Get-Command -Name $n -CommandType Function -ErrorAction Ignore
|            if ($f) { Set-Item -Path ("function:global:{0}" -f $n) -Value $f.ScriptBlock }
|        }
|    }
|}
|
|# =====================================================================================================================
|#  HTTP seam, sign-in, tokens
|# =====================================================================================================================
|
|function Remove-SIAzRestCaughtError {
|    <# Takes a HANDLED error record back out of $global:Error (newest entries only). PS 5.1 safe. #>
|    param($Record)
|    if ($null -eq $Record) { return }
|    $errs = $global:Error
|    for ($i = 0; $i -lt [Math]::Min(3, $errs.Count); $i++) {
|        $e = $errs[$i]
|        if ([object]::ReferenceEquals($e, $Record) -or ($e -is [System.Management.Automation.ErrorRecord] -and $Record -is [System.Management.Automation.ErrorRecord] -and [object]::ReferenceEquals($e.Exception, $Record.Exception))) {
|            $errs.RemoveAt($i); return
|        }
|    }
|}
|
|function Invoke-SIAzRestHttp {
|    <#
|        THE ONE HTTP SEAM of this file (tests Mock it). Never throws on an HTTP status: returns
|        @{ StatusCode; Content; Bytes; Headers; RetryAfter }. A network failure (no response) is StatusCode 0.
|        HttpWebRequest, not Invoke-WebRequest: the 4xx body and headers read the same way on PS 5.1 and pwsh 7.
|        -AsBytes keeps the body as bytes (blob downloads); Content is then ''.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Method,
|        [Parameter(Mandatory)][string]$Uri,
|        [hashtable]$Headers,
|        $Body,
|        [string]$ContentType,
|        [int]$TimeoutSec = 300,
|        [switch]$AsBytes,
|        # A 2xx body read AS IT ARRIVES (SI-LaStreamRead.ps1): { param([IO.Stream]$Stream) <the parsed answer> } -- the body
|        # is never held whole; the answer is returned as .Parsed (Content '', Bytes $null). Any other status: as without it.
|        [scriptblock]$ReadStream
|    )
|    if ($PSVersionTable.PSEdition -ne 'Core') {
|        [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
|    }
|    $req = [System.Net.HttpWebRequest]::Create($Uri)
|    $req.Method = $Method.ToUpperInvariant()
|    $req.Timeout = $TimeoutSec * 1000
|    $req.ReadWriteTimeout = $TimeoutSec * 1000
|    $req.Accept = 'application/json'
|    if ($Headers) {
|        foreach ($k in $Headers.Keys) {
|            if ($k -eq 'Content-Type') { $req.ContentType = [string]$Headers[$k] }
|            elseif ($k -eq 'Accept')   { $req.Accept = [string]$Headers[$k] }
|            else { $req.Headers[$k] = [string]$Headers[$k] }
|        }
|    }
|    if ($ContentType) { $req.ContentType = $ContentType }
|    if ($null -ne $Body) {
|        # statements, never `= if (...) { $Body }`: an if-expression ENUMERATES a byte array into object[] (one boxed object
|        # per byte) -- a build context of tens of MB became gigabytes and the updater ran out of memory
|        [byte[]]$bytes = $null
|        if ($Body -is [byte[]]) { $bytes = $Body } else { $bytes = [System.Text.Encoding]::UTF8.GetBytes([string]$Body) }
|        $req.ContentLength = $bytes.Length
|        # A connection that fails while the BODY is sent (connect, DNS, reset) is "no answer" (StatusCode 0), which the caller
|        # retries -- for a request that is safe to send again (PUT / PATCH / DELETE / MERGE: idempotent, as an ARM or table PUT
|        # is). A POST that failed here is thrown as before: it is not repeated blindly. (The sweep of 2026-10-22: this threw
|        # past every retry loop on blob, table and ARM writes.)
|        try {
|            $s = $req.GetRequestStream()
|            try { $s.Write($bytes, 0, $bytes.Length) } finally { $s.Close() }
|        } catch {
|            if ($req.Method -eq 'POST') { throw }
|            return [pscustomobject]@{ StatusCode = 0; Content = [string]$_.Exception.Message; Bytes = $null; Headers = @{}; RetryAfter = $null }
|        }
|    } elseif ($req.Method -in 'POST', 'PUT', 'PATCH', 'MERGE') {
|        $req.ContentLength = 0
|    }
|    $resp = $null
|    try { $resp = $req.GetResponse() }
|    catch {
|        $we = $_.Exception
|        while ($we -and -not ($we -is [System.Net.WebException])) { $we = $we.InnerException }
|        if ($we -and $we.Response) {
|            $resp = $we.Response
|            # An HTTP status is an ANSWER, returned to the caller (who decides whether a 404 is "not there" or a failure)
|            # -- not an error of this process. PowerShell still records the caught exception in $Error, and setup shows
|            # every new $Error entry: each "does it exist?" probe printed "(404) Not Found" (live 2026-10-06). Drop it.
|            Remove-SIAzRestCaughtError -Record $_
|        }
|        else { return [pscustomobject]@{ StatusCode = 0; Content = [string]$_.Exception.Message; Bytes = $null; Headers = @{}; RetryAfter = $null } }
|    }
|    try {
|        $h = New-Object 'System.Collections.Hashtable' ([System.StringComparer]::OrdinalIgnoreCase)
|        foreach ($k in $resp.Headers.AllKeys) { $h[$k] = [string]$resp.Headers[$k] }
|        $text = ''; $raw = $null
|        $rs = $resp.GetResponseStream()
|        $sc = [int]$resp.StatusCode
|        if ($rs -and $ReadStream -and $sc -ge 200 -and $sc -lt 300) {
|            $parsed = $null
|            try { $parsed = & $ReadStream $rs } finally { $rs.Close() }
|            return [pscustomobject]@{ StatusCode = $sc; Content = ''; Bytes = $null; Headers = $h; RetryAfter = [string]$h['Retry-After']; Parsed = $parsed }
|        }
|        if ($rs) {
|            # #639: the body is read ONCE into an array of its own length when the service says how long it is -- not into a
|            # growing buffer that is then copied again (a large answer was held two or three times before it was parsed)
|            try {
|                $len = [long]$resp.ContentLength
|                if ($len -gt 0 -and $len -lt [int]::MaxValue) {
|                    $raw = [byte[]]::new([int]$len); $off = 0
|                    while ($off -lt $len) { $n = $rs.Read($raw, $off, [int]($len - $off)); if ($n -le 0) { break }; $off += $n }
|                    if ($off -lt $len) { $part = [byte[]]::new($off); [Array]::Copy($raw, $part, $off); $raw = $part; $part = $null }
|                } else {
|                    $ms = New-Object System.IO.MemoryStream
|                    $rs.CopyTo($ms); $raw = $ms.ToArray(); $ms.Dispose(); $ms = $null
|                }
|            } finally { $rs.Close() }
|            if (-not $AsBytes) { $text = [System.Text.Encoding]::UTF8.GetString($raw); $raw = $null }
|        }
|        return [pscustomobject]@{ StatusCode = [int]$resp.StatusCode; Content = $text; Bytes = $raw; Headers = $h; RetryAfter = [string]$h['Retry-After'] }
|    } finally { $resp.Close() }
|}
|
|function Get-SIAzRestValue {
|    <# The first non-empty global of -Names. #>
|    param([string[]]$Names)
|    foreach ($n in $Names) {
|        $v = Get-Variable -Scope Global -Name $n -ValueOnly -ErrorAction Ignore
|        if ($null -ne $v -and -not [string]::IsNullOrWhiteSpace([string]$v)) { return [string]$v }
|    }
|    return $null
|}
|
|function Resolve-SIAzRestAuth {
|    <#
|        WHO this run signs in as, for the REST path:
|          1. what Connect-SIAzAccount recorded in this process (the launcher / container entry point decided)
|          1b. an Invardia Support session open in this shell (Mode 'Support', read from the session)
|          2. the run's managed-identity switch (SI_UseManagedIdentity / UseManagedIdentity, #222)
|          3. an SPN certificate   (SI_SPN_AppId | SpnClientId | HighPriv_* + SI_SPN_CertThumbprint | SpnCertificateThumbprint)
|          4. an SPN client secret (SI_SPN_Secret | SpnClientSecret | HighPriv_*)
|        Certificate before secret, as everywhere in SecurityInsight. Returns the Auth hashtable Get-SILogIngestToken
|        takes. Throws when nothing is configured -- the REST path never falls back to an Az session.
|    #>
|    # An Invardia Support session in this shell: it IS the sign-in when nothing else was recorded (and a Support sign-in
|    # whose session was closed is dropped) -- Sync-SISupportConnection, read from the session, no token asked for.
|    $null = Sync-SISupportConnection
|    $st = Get-SIAzRestState
|    if ($st.Connection -is [hashtable]) { return $st.Connection }
|    # #524: the retired sign-in mode "AzContext" (borrow this process's Azure session) is refused by name
|    if ([string](Get-Variable -Scope Global -Name SI_AuthMethod -ValueOnly -ErrorAction Ignore) -eq 'AzContext') {
|        throw ('SI_AuthMethod = AzContext (use the current Azure session of this PowerShell process) is no longer supported: SecurityInsight signs in itself. Supported sign-ins: {0}.' -f (Get-SISupportedSignInText))
|    }
|    if ([bool](Get-Variable -Scope Global -Name SI_UseManagedIdentity -ValueOnly -ErrorAction Ignore) -or [bool](Get-Variable -Scope Global -Name UseManagedIdentity -ValueOnly -ErrorAction Ignore)) {
|        return @{ Mode = 'ManagedIdentity'; ClientId = [string](Get-SIAzRestValue 'SI_UAMI_ClientId', 'SI_ManagedIdentityClientId') }
|    }
|    $tid   = Get-SIAzRestValue 'SI_SPN_TenantId', 'SpnTenantId', 'HighPriv_Modern_TenantID', 'AzureTenantId', 'TenantId'
|    $app   = Get-SIAzRestValue 'SI_SPN_AppId', 'SpnClientId', 'HighPriv_Modern_ApplicationID_Azure'
|    $thumb = Get-SIAzRestValue 'SI_SPN_CertThumbprint', 'SpnCertificateThumbprint', 'HighPriv_Modern_CertificateThumbprint_Azure'
|    $sec   = Get-SIAzRestValue 'SI_SPN_Secret', 'SpnClientSecret', 'HighPriv_Modern_Secret_Azure', 'HighPriv_Modern_ApplicationSecret_Azure'
|    if ($app -and $thumb -and $tid) { return @{ Mode = 'Certificate'; AppId = $app; TenantId = $tid; Thumbprint = ($thumb -replace '\s', '') } }
|    if ($app -and $sec -and $tid)   { return @{ Mode = 'Secret'; AppId = $app; TenantId = $tid; Secret = $sec } }
|    throw ('No sign-in is configured for Azure access over REST. Supported sign-ins: {0}.' -f (Get-SISupportedSignInText))
|}
|
|function Get-SIAzureAudience {
|    <# The token resource of each audience the REST path talks to. #>
|    param([Parameter(Mandatory)][ValidateSet('Arm', 'LaQuery', 'Storage', 'KeyVault', 'Graph', 'Monitor')][string]$Audience)
|    switch ($Audience) {
|        'Arm'      { 'https://management.azure.com/' }
|        'LaQuery'  { 'https://api.loganalytics.io/' }
|        'Storage'  { 'https://storage.azure.com/' }
|        'KeyVault' { 'https://vault.azure.net/' }
|        'Graph'    { 'https://graph.microsoft.com/' }
|        'Monitor'  { 'https://monitor.azure.com/' }
|    }
|}
|
|function Get-SIAzureToken {
|    <#
|        ONE token function for every audience: a bearer token as the identity Resolve-SIAzRestAuth names, minted by
|        Get-SILogIngestToken (managed identity endpoint / certificate client assertion / client secret), cached per
|        identity + audience until 5 minutes before expiry. -Audience or a raw -Resource; -Auth overrides the identity.
|    #>
|    param(
|        [ValidateSet('Arm', 'LaQuery', 'Storage', 'KeyVault', 'Graph', 'Monitor')][string]$Audience = 'Arm',
|        [string]$Resource,
|        [hashtable]$Auth,
|        [switch]$ForceRefresh
|    )
|    if (-not $Resource) { $Resource = Get-SIAzureAudience -Audience $Audience }
|    # A host that signs in its own way (setup, a test) can supply tokens: $global:SI_TokenProvider = { param($Resource) <token> }.
|    # Consulted first, only when no explicit -Auth was passed; an empty answer falls through to SecurityInsight's own sign-in.
|    if (-not $Auth) {
|        $tp = Get-Variable -Scope Global -Name SI_TokenProvider -ValueOnly -ErrorAction Ignore
|        if ($tp -is [scriptblock]) { $pt = [string](& $tp $Resource); if (-not [string]::IsNullOrWhiteSpace($pt)) { return $pt } }
|    }
|    Initialize-SIAzRestHelpers
|    if (-not $Auth) { $Auth = Resolve-SIAzRestAuth }
|    return (Get-SILogIngestToken -Resource $Resource -Auth $Auth -ForceRefresh:$ForceRefresh)
|}
|
|function ConvertFrom-SIJwtPayload {
|    <# PURE. The claims of a JWT (no signature check -- only used to read tid / exp / appid of our own token). #>
|    param([string]$Token)
|    $parts = ([string]$Token) -split '\.'
|    if ($parts.Count -lt 2) { return $null }
|    $p = $parts[1].Replace('-', '+').Replace('_', '/')
|    switch ($p.Length % 4) { 2 { $p += '==' } 3 { $p += '=' } }
|    try { return ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($p)) | ConvertFrom-Json) } catch { return $null }
|}
|
|function New-SIAzRestError {
|    <# An exception carrying the service's response (Response.StatusCode / Content / Headers), so the existing readers
|       (Get-SIKqlErrorText, the ledger's 412 match, ...) find what the service said. #>
|    param([string]$Message, $Response)
|    $ex = New-Object System.Exception($Message)
|    if ($Response) {
|        $r = [pscustomobject]@{ StatusCode = [int]$Response.StatusCode; Content = [string]$Response.Content; Headers = $Response.Headers }
|        Add-Member -InputObject $ex -NotePropertyName Response -NotePropertyValue $r -Force
|    }
|    return $ex
|}
|
|function Get-SIAzRestStatusName {
|    param([int]$Code)
|    if ($Code -le 0) { return 'NoResponse' }
|    try { return [string][System.Net.HttpStatusCode]$Code } catch { return [string]$Code }
|}
|
|function Invoke-SIAzRestRequest {
|    <#
|        One authenticated REST call with the retry rule:
|          429 / 408 / 5xx / no response -> PLATFORM: wait (Retry-After when sent) and retry in-run
|          401 once                      -> refresh the token, repeat once
|          404 with -AllowNotFound       -> $null
|          any other 4xx                 -> FAIL FAST with the body
|        Returns the response (StatusCode / Content / Bytes / Headers).
|    #>
|    param(
|        [string]$Method = 'GET',
|        [Parameter(Mandatory)][string]$Uri,
|        [ValidateSet('Arm', 'LaQuery', 'Storage', 'KeyVault', 'Graph', 'Monitor')][string]$Audience = 'Arm',
|        $Body,
|        [string]$ContentType = 'application/json',
|        [hashtable]$Headers,
|        [switch]$AllowNotFound,
|        [int[]]$AllowStatus = @(),
|        [switch]$AsBytes,
|        [int]$TimeoutSec = 300,
|        [int]$MaxAttempts = 6,
|        [string]$What = 'Azure request',
|        [hashtable]$Auth,  # another identity than the run's (the platform sign-in reads its Key Vault as the bootstrap identity)
|        # a 2xx body read as it arrives (Invoke-SIAzRestHttp -ReadStream); not through an Invardia support session, whose
|        # recording wrapper hands the answer back whole
|        [scriptblock]$ReadStream
|    )
|    $refreshed = $false; $force = $false
|    # #548: inside an Invardia support session every call SecurityInsight makes as the support app goes through Invardia's
|    # RECORDING wrapper (Invoke-InvardiaSupportRequest: the customer's audit log, fail-closed) -- never a raw token + HTTP.
|    # Every body and every answer goes through the wrapper: a binary body is sent unchanged, a binary answer (a download)
|    # comes back as its ContentBytes (Invardia, 2026-10-10).
|    $viaSupport = (Test-SISupportBodyIsText -Body $Body -ContentType $ContentType) -and (Test-SISupportRequestRoute -Audience $Audience -Auth $Auth -Uri $Uri)
|    for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
|        if ($viaSupport) {
|            $h = @{}
|            if ($Headers) { foreach ($k in $Headers.Keys) { $h[$k] = $Headers[$k] } }
|            $r = Invoke-SISupportHttp -Method $Method -Uri $Uri -Headers $h -Body $Body -ContentType $ContentType -AsBytes:$AsBytes -Audience $Audience -TimeoutSec $TimeoutSec
|        } else {
|            $token = Get-SIAzureToken -Audience $Audience -Auth $Auth -ForceRefresh:$force
|            $force = $false
|            $h = @{ 'Authorization' = ('Bearer ' + $token) }
|            if ($Headers) { foreach ($k in $Headers.Keys) { $h[$k] = $Headers[$k] } }
|            if ($ReadStream) { $r = Invoke-SIAzRestHttp -Method $Method -Uri $Uri -Headers $h -Body $Body -ContentType $ContentType -TimeoutSec $TimeoutSec -AsBytes:$AsBytes -ReadStream $ReadStream }
|            else { $r = Invoke-SIAzRestHttp -Method $Method -Uri $Uri -Headers $h -Body $Body -ContentType $ContentType -TimeoutSec $TimeoutSec -AsBytes:$AsBytes }
|        }
|        $code = [int]$r.StatusCode
|        if ($code -ge 200 -and $code -lt 300) { return $r }
|        if ($AllowStatus -contains $code) { return $r }
|        if ($code -eq 404 -and $AllowNotFound) { return $null }
|        if ($code -eq 401 -and -not $refreshed) { $refreshed = $true; $force = $true; continue }
|        $transient = ($code -eq 0 -or $code -eq 408 -or $code -eq 429 -or $code -ge 500)
|        if ($transient -and $attempt -lt $MaxAttempts) {
|            Initialize-SIAzRestHelpers
|            $wait = Get-SILogIngestRetryDelay -RetryAfter ([string]$r.RetryAfter) -Attempt $attempt
|            Write-Verbose ("{0}: HTTP {1}, retrying in {2}s (attempt {3}/{4})" -f $What, $code, $wait, $attempt, $MaxAttempts)
|            Start-Sleep -Seconds $wait
|            continue
|        }
|        $body = [string]$r.Content
|        if ($AsBytes -and $r.Bytes) { try { $body = [System.Text.Encoding]::UTF8.GetString($r.Bytes) } catch { } }
|        $errCode = ''
|        if ($r.Headers -and $r.Headers['x-ms-error-code']) { $errCode = ' ' + [string]$r.Headers['x-ms-error-code'] }
|        $resp = [pscustomobject]@{ StatusCode = $code; Content = $body; Headers = $r.Headers }
|        throw (New-SIAzRestError -Message ("{0} failed. HTTP Status: {1} ({2}){3} Response: {4}" -f $What, $code, (Get-SIAzRestStatusName $code), $errCode, $body) -Response $resp)
|    }
|    throw ("{0} failed after {1} attempts." -f $What, $MaxAttempts)
|}
|
|# =====================================================================================================================
|#  ARM, Resource Graph, Key Vault, Log Analytics
|# =====================================================================================================================
|
|function Test-SIArmBusyError {
|    <# PURE. #564: an ARM refusal that means "another operation on this resource is still running" (HTTP 409
|       OperationInProgress and its per-service names) -- a wait, not a failure. A plain 409 Conflict ("already exists") is NOT. #>
|    param([AllowEmptyString()][string]$Message)
|    [bool]("$Message" -match '(?i)\w*OperationInProgress|operation is (still )?in progress|another operation is (in progress|ongoing|running)|active provisioning operation|is currently being (updated|provisioned)')
|}
|
|function Invoke-SIArmWriteBusyRetry {
|    <#
|        #564 (PIM's install at customer I, 2026-10-10): ONE ARM write (PUT / PATCH / POST / DELETE) with a BOUNDED wait for a busy
|        resource: a write seconds after another change to the same resource is refused "409 OperationInProgress". Waits
|        $global:SI_ArmBusyWaits (default 6 x 20 s) between attempts, RE-READS the resource before each retry (PUT / PATCH /
|        DELETE: what Azure has now), and after a write that had to wait READS IT BACK until it is provisioned (about 60 s).
|        Any other failure is rethrown at once WITH ITS OWN ERROR; the last busy failure is rethrown after the last wait.
|        NOT a closure (a GetNewClosure() block cannot see the functions this file defines). $global:SI_ArmBusySleep
|        { param($Seconds) } is the test seam for the waits. Returns the response (Invoke-SIAzRestRequest's shape).
|    #>
|    param([Parameter(Mandatory)][string]$Method, [Parameter(Mandatory)][string]$Uri, $Json, [switch]$AllowNotFound, [string]$What = 'Azure Resource Manager write')
|    $waits = @(20, 20, 20, 20, 20, 20)
|    $gw = Get-Variable -Scope Global -Name SI_ArmBusyWaits -ValueOnly -ErrorAction Ignore
|    if ($null -ne $gw) { $waits = @($gw | ForEach-Object { [int]$_ }) }
|    $sleep = Get-Variable -Scope Global -Name SI_ArmBusySleep -ValueOnly -ErrorAction Ignore
|    $verb = $Method.ToUpperInvariant()
|    $resourceUri = if ($verb -in 'PUT', 'PATCH', 'DELETE') { $Uri } else { $null }
|    $try = 0; $waited = $false
|    while ($true) {
|        try { $r = Invoke-SIAzRestRequest -Method $Method -Uri $Uri -Body $Json -AllowNotFound:$AllowNotFound -What $What; break }
|        catch {
|            if (-not (Test-SIArmBusyError -Message ([string]$_.Exception.Message)) -or $try -ge $waits.Count) { throw }
|            $w = [int]$waits[$try]; $try++; $waited = $true
|            Write-Host ('       Azure is still busy with another change to {0} -- waiting {1} s, then trying again ({2}/{3}) ...' -f (($Uri -replace '\?.*$', '') -split '/')[-1], $w, $try, $waits.Count) -ForegroundColor DarkYellow
|            if ($w -gt 0) { if ($sleep -is [scriptblock]) { & $sleep $w } else { Start-Sleep -Seconds $w } }
|            # re-read before the retry: what Azure has now (never fails the write -- the retry decides)
|            if ($resourceUri) { try { $null = Invoke-SIAzRestRequest -Method GET -Uri $resourceUri -AllowNotFound -What ('Reading ' + $What) } catch { } }
|        }
|    }
|    if ($waited -and $verb -in 'PUT', 'PATCH') {
|        # read back: the write that waited is followed until Azure has provisioned it (bounded, about 60 s)
|        for ($i = 0; $i -lt 6; $i++) {
|            $back = $null
|            try { $back = Invoke-SIAzRestRequest -Method GET -Uri $resourceUri -AllowNotFound -What ('Reading back ' + $What) } catch { break }
|            $ps = ''
|            try { $ps = [string](($back.Content | ConvertFrom-Json).properties.provisioningState) } catch { $ps = '' }
|            if (-not $ps -or $ps -in 'Succeeded', 'Failed', 'Canceled', 'Cancelled') { break }
|            if ($sleep -is [scriptblock]) { & $sleep 10 } else { Start-Sleep -Seconds 10 }
|        }
|    }
|    $r
|}
|
|function Invoke-SIArm {
|    <#
|        Azure Resource Manager. -Path is '/subscriptions/...' (or a full https:// URL, e.g. a nextLink); -ApiVersion is
|        appended when the path has none. Returns the parsed body ($null for a 404 with -AllowNotFound).
|        -List returns every item of a list, following nextLink.
|    #>
|    param(
|        [string]$Method = 'GET',
|        [Parameter(Mandatory)][string]$Path,
|        [string]$ApiVersion,
|        $Body,
|        [switch]$AllowNotFound,
|        [switch]$List
|    )
|    $uri = if ($Path -match '^https://') { $Path } else { 'https://management.azure.com' + $Path }
|    if ($ApiVersion -and $uri -notmatch '[?&]api-version=') { $uri += $(if ($uri -match '\?') { '&' } else { '?' }) + 'api-version=' + $ApiVersion }
|    $json = if ($null -ne $Body -and -not ($Body -is [string])) { $Body | ConvertTo-Json -Depth 50 -Compress } else { $Body }
|    # #564 (PIM's install at customer I, 2026-10-10): an ARM POST ACTION with no body (listSecrets, listCredentials, listKeys,
|    # sharedKeys, a revision restart, a provider register) sends '{}' -- an empty body with a JSON content type was
|    # refused with HTTP 415.
|    if ($Method.ToUpperInvariant() -eq 'POST' -and ($null -eq $json -or ([string]$json) -eq '')) { $json = '{}' }
|    $what = 'Azure Resource Manager {0} {1}' -f $Method, ($uri -replace '\?.*$', '')
|    if (-not $List) {
|        if ($Method.ToUpperInvariant() -eq 'GET') { $r = Invoke-SIAzRestRequest -Method $Method -Uri $uri -Body $json -AllowNotFound:$AllowNotFound -What $what }
|        else { $r = Invoke-SIArmWriteBusyRetry -Method $Method -Uri $uri -Json $json -AllowNotFound:$AllowNotFound -What $what }
|        if (-not $r -or [string]::IsNullOrWhiteSpace([string]$r.Content)) { return $null }
|        return ($r.Content | ConvertFrom-Json)
|    }
|    $items = [System.Collections.Generic.List[object]]::new()
|    $next = $uri
|    while ($next) {
|        $r = Invoke-SIAzRestRequest -Method 'GET' -Uri $next -AllowNotFound:$AllowNotFound -What $what
|        if (-not $r) { break }
|        $page = $r.Content | ConvertFrom-Json
|        foreach ($v in @($page.value)) { if ($null -ne $v) { [void]$items.Add($v) } }
|        $next = [string]$page.nextLink
|    }
|    return $items.ToArray()
|}
|
|function Search-SIResourceGraph {
|    <# Resource Graph: EVERY row of -Query, following $skipToken. -Subscription / -ManagementGroup scope it; neither =
|       every subscription the identity can read (as Search-AzGraph without them). #>
|    param(
|        [Parameter(Mandatory)][string]$Query,
|        [string[]]$Subscription,
|        [string[]]$ManagementGroup,
|        [int]$PageSize = 1000
|    )
|    $rows = [System.Collections.Generic.List[object]]::new()
|    $skip = $null
|    do {
|        $page = Invoke-SIResourceGraphPage -Query $Query -Subscription $Subscription -ManagementGroup $ManagementGroup -First $PageSize -SkipToken $skip
|        foreach ($d in @($page.Data)) { if ($null -ne $d) { [void]$rows.Add($d) } }
|        $skip = [string]$page.SkipToken
|    } while ($skip)
|    return $rows.ToArray()
|}
|
|function Invoke-SIResourceGraphPage {
|    <# ONE Resource Graph page: @{ Data; SkipToken; TotalRecords }. #>
|    param([string]$Query, [string[]]$Subscription, [string[]]$ManagementGroup, [int]$First = 1000, [int]$Skip = 0, [string]$SkipToken)
|    $opt = [ordered]@{ resultFormat = 'objectArray'; '$top' = $First }
|    if ($Skip -gt 0) { $opt['$skip'] = $Skip }
|    if ($SkipToken) { $opt['$skipToken'] = $SkipToken }
|    $body = [ordered]@{ query = $Query; options = $opt }
|    $subs = @(@($Subscription) | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) })
|    $mgs  = @(@($ManagementGroup) | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) })
|    if ($subs.Count) { $body['subscriptions'] = [string[]]$subs }
|    if ($mgs.Count) { $body['managementGroups'] = [string[]]$mgs }
|    $r = Invoke-SIAzRestRequest -Method POST -Uri 'https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=2022-10-01' `
|             -Body ($body | ConvertTo-Json -Depth 10 -Compress) -What 'Resource Graph query'
|    $j = $r.Content | ConvertFrom-Json
|    $tok = $null
|    if ($j.PSObject.Properties['$skipToken']) { $tok = [string]$j.'$skipToken' }
|    return [pscustomobject]@{ Data = @($j.data); SkipToken = $tok; TotalRecords = $j.totalRecords }
|}
|
|function Get-SIKeyVaultSecretValue {
|    <# One Key Vault secret as plain text; $null when the secret does not exist. #>
|    param([Parameter(Mandatory)][string]$VaultName, [Parameter(Mandatory)][string]$Name, [string]$Version, [hashtable]$Auth)
|    $j = Get-SIKeyVaultSecretRaw -VaultName $VaultName -Name $Name -Version $Version -Auth $Auth
|    if (-not $j) { return $null }
|    return [string]$j.value
|}
|
|function Get-SIKeyVaultSecretRaw {
|    param([string]$VaultName, [string]$Name, [string]$Version, [hashtable]$Auth)
|    $v = if ($Version) { '/' + $Version } else { '' }
|    $uri = 'https://{0}.vault.azure.net/secrets/{1}{2}?api-version=7.4' -f $VaultName, [uri]::EscapeDataString($Name), $v
|    $r = Invoke-SIAzRestRequest -Method GET -Uri $uri -Audience KeyVault -AllowNotFound -Auth $Auth -What ("Key Vault secret '{0}' in '{1}'" -f $Name, $VaultName)
|    if (-not $r) { return $null }
|    return ($r.Content | ConvertFrom-Json)
|}
|
|function ConvertTo-SIAzLaCellString {
|    <# One Log Analytics cell, as Az.OperationalInsights hands it to callers: TEXT. Strings and dates stay as the
|       service sent them, numbers keep their JSON spelling, booleans are 'true' / 'false', null stays null, nested
|       values are JSON text. #>
|    param($Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [string]) { return $Value }
|    if ($Value -is [bool]) { if ($Value) { return 'true' } else { return 'false' } }
|    if ($Value -is [datetime]) { return $Value.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.FFFFFFFZ', [System.Globalization.CultureInfo]::InvariantCulture) }
|    if ($Value -is [System.IFormattable]) { return $Value.ToString($null, [System.Globalization.CultureInfo]::InvariantCulture) }
|    return (ConvertTo-Json -InputObject $Value -Depth 20 -Compress)
|}
|
|function ConvertFrom-SILaQueryJson {
|    <#
|        The Log Analytics query response -> @{ Tables = @( @{ Name; Columns = @(@{name;type}); Rows = @(@(cells as text)) } ); Error }.
|        pwsh 7: System.Text.Json, so a date stays the exact text the service sent (ConvertFrom-Json would turn it into a
|        local DateTime). Windows PowerShell 5.1: ConvertFrom-Json, which leaves dates as text.
|    #>
|    param([Parameter(Mandatory)][string]$Json)
|    $tables = [System.Collections.Generic.List[object]]::new()
|    $err = $null
|    if ($PSVersionTable.PSEdition -eq 'Core') {
|        $doc = [System.Text.Json.JsonDocument]::Parse($Json)
|        try {
|            $root = $doc.RootElement
|            $tEl = [System.Text.Json.JsonElement]::new()
|            if ($root.TryGetProperty('tables', [ref]$tEl)) {
|                foreach ($t in $tEl.EnumerateArray()) {
|                    $cols = [System.Collections.Generic.List[object]]::new()
|                    foreach ($c in $t.GetProperty('columns').EnumerateArray()) {
|                        $ty = [System.Text.Json.JsonElement]::new(); $tyS = ''
|                        if ($c.TryGetProperty('type', [ref]$ty)) { $tyS = $ty.GetString() }
|                        [void]$cols.Add([pscustomobject]@{ name = $c.GetProperty('name').GetString(); type = $tyS })
|                    }
|                    $rows = [System.Collections.Generic.List[object]]::new()
|                    foreach ($row in $t.GetProperty('rows').EnumerateArray()) {
|                        $cells = [System.Collections.Generic.List[object]]::new()
|                        foreach ($cell in $row.EnumerateArray()) {
|                            switch ($cell.ValueKind.ToString()) {
|                                'String' { [void]$cells.Add($cell.GetString()) }
|                                'Null'   { [void]$cells.Add($null) }
|                                'True'   { [void]$cells.Add('true') }
|                                'False'  { [void]$cells.Add('false') }
|                                default  { [void]$cells.Add($cell.GetRawText()) }
|                            }
|                        }
|                        [void]$rows.Add($cells.ToArray())
|                    }
|                    $nm = [System.Text.Json.JsonElement]::new(); $nmS = ''
|                    if ($t.TryGetProperty('name', [ref]$nm)) { $nmS = $nm.GetString() }
|                    [void]$tables.Add([pscustomobject]@{ Name = $nmS; Columns = $cols.ToArray(); Rows = $rows.ToArray() })
|                }
|            }
|            $eEl = [System.Text.Json.JsonElement]::new()
|            if ($root.TryGetProperty('error', [ref]$eEl) -and $eEl.ValueKind.ToString() -ne 'Null') { $err = ($eEl.GetRawText() | ConvertFrom-Json) }
|        } finally { $doc.Dispose() }
|    } else {
|        $j = $Json | ConvertFrom-Json
|        foreach ($t in @($j.tables)) {
|            if ($null -eq $t) { continue }
|            $rows = [System.Collections.Generic.List[object]]::new()
|            foreach ($row in @($t.rows)) {
|                $cells = [System.Collections.Generic.List[object]]::new()
|                foreach ($cell in @($row)) { [void]$cells.Add((ConvertTo-SIAzLaCellString $cell)) }
|                [void]$rows.Add($cells.ToArray())
|            }
|            [void]$tables.Add([pscustomobject]@{ Name = [string]$t.name; Columns = @($t.columns); Rows = $rows.ToArray() })
|        }
|        if ($j.PSObject.Properties['error'] -and $j.error) { $err = $j.error }
|    }
|    return [pscustomobject]@{ Tables = $tables.ToArray(); Error = $err }
|}
|
|function Get-SILaCompactRowType {
|    <#
|        #711. A .NET class for one column list: one public text property per column, in the column order, built from the
|        row's values in one call (new(string[])). Built once per column list and process (Add-Type, pwsh 7 / .NET 8) and
|        reused. $null when it cannot be built -- a column name that is not a plain identifier, two names that differ only in
|        case (PowerShell reads properties without case), Windows PowerShell -- and the caller keeps PSCustomObject rows.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][string[]]$Names)
|    if ($PSVersionTable.PSEdition -ne 'Core' -or $Names.Count -eq 0) { return $null }
|    if ($null -eq $script:SILaCompactRowTypes) { $script:SILaCompactRowTypes = @{} }
|    $key = ($Names -join "`n")
|    if ($script:SILaCompactRowTypes.ContainsKey($key)) { return $script:SILaCompactRowTypes[$key] }
|    $type = $null
|    try {
|        $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([System.StringComparer]::OrdinalIgnoreCase)
|        foreach ($n in $Names) { if ($n -notmatch '^[A-Za-z_][A-Za-z0-9_]*$' -or -not $seen.Add($n)) { throw ('not a plain column name: {0}' -f $n) } }
|        $sha = [System.Security.Cryptography.SHA256]::Create()
|        try { $h = ([System.BitConverter]::ToString($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($key))) -replace '-', '').Substring(0, 20) } finally { $sha.Dispose() }
|        $cls = 'R' + $h
|        $full = 'SecurityInsight.LaRows.' + $cls
|        $type = $full -as [type]
|        if ($null -eq $type) {
|            $sb = New-Object System.Text.StringBuilder
|            [void]$sb.Append('namespace SecurityInsight.LaRows { public sealed class ').Append($cls).Append(' { ')
|            foreach ($n in $Names) { [void]$sb.Append('public string @').Append($n).Append(' { get; set; } ') }
|            [void]$sb.Append('public ').Append($cls).Append('(string[] v) { ')
|            for ($i = 0; $i -lt $Names.Count; $i++) { [void]$sb.Append('this.@').Append($Names[$i]).Append(' = v[').Append($i).Append(']; ') }
|            [void]$sb.Append('} } }')
|            Add-Type -TypeDefinition $sb.ToString() -Language CSharp -ErrorAction Stop
|            $type = $full -as [type]
|        }
|    } catch { $type = $null }
|    $script:SILaCompactRowTypes[$key] = $type
|    return $type
|}
|
|function ConvertFrom-SILaQueryRows {
|    <#
|        The Log Analytics query response AS THE BYTES THE SERVICE SENT -> @{ Rows; Error }: the primary table's rows, one
|        object per row, one TEXT property per column -- the same rows Invoke-SILaQuery hands out as .Results.
|        For large answers (Invoke-SILaQuery -RowsOnly): the bytes are parsed where they are. The answer is never also held
|        as one text (twice its size), as a second copy of every table, or as a list of cells per row -- on a large install
|        those copies together ran a job out of memory. pwsh 7 only (System.Text.Json).
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][byte[]]$Bytes)
|    $rows = [System.Collections.Generic.List[object]]::new()
|    $cols = [System.Collections.Generic.List[object]]::new()
|    $err = $null
|    $doc = [System.Text.Json.JsonDocument]::Parse([System.ReadOnlyMemory[byte]]::new($Bytes))
|    try {
|        $root = $doc.RootElement
|        $tEl = [System.Text.Json.JsonElement]::new()
|        if ($root.TryGetProperty('tables', [ref]$tEl)) {
|            # the table named PrimaryResult, else the first one -- as .Results has always been chosen
|            $have = $false
|            $pick = [System.Text.Json.JsonElement]::new()
|            foreach ($t in $tEl.EnumerateArray()) {
|                $nm = [System.Text.Json.JsonElement]::new(); $nmS = ''
|                if ($t.TryGetProperty('name', [ref]$nm)) { $nmS = [string]$nm.GetString() }
|                if (-not $have) { $pick = $t; $have = $true }
|                if ($nmS -eq 'PrimaryResult') { $pick = $t; break }
|            }
|            if ($have) {
|                $names = [System.Collections.Generic.List[string]]::new()
|                foreach ($c in $pick.GetProperty('columns').EnumerateArray()) {
|                    $names.Add([string]$c.GetProperty('name').GetString())
|                    $ty = [System.Text.Json.JsonElement]::new(); $tyS = $null
|                    if ($c.TryGetProperty('type', [ref]$ty)) { $tyS = $ty.GetString() }
|                    $cols.Add([pscustomobject]@{ name = $names[$names.Count - 1]; type = $tyS })
|                }
|                $nCols = $names.Count
|                # #711: a caller that keeps the rows for long (Risk Analysis' lookups) asks for COMPACT rows -- one small
|                # .NET object per row with one text property per column (Get-SILaCompactRowType), not a PSCustomObject
|                # (measured on the test VM: ~6 KB per row of 11 columns as a PSCustomObject). Read the same way by
|                # every reader ($row.Col, $row.PSObject.Properties['Col'].Value). Not available -> the rows as always.
|                $compactType = $null
|                if ([bool]$global:SI_LaCompactRows) { $compactType = Get-SILaCompactRowType -Names $names.ToArray() }
|                if ($null -ne $compactType) {
|                    # a short value that repeats (a tier, a flag, an empty text, a short factor list) is held once per read
|                    $pool = [System.Collections.Generic.Dictionary[string, string]]::new([System.StringComparer]::Ordinal)
|                    foreach ($row in $pick.GetProperty('rows').EnumerateArray()) {
|                        # a null cell is left as the array's own null (assigning $null to a [string] element would make it '')
|                        $vals = [string[]]::new($nCols)
|                        $i = 0
|                        foreach ($cell in $row.EnumerateArray()) {
|                            if ($i -ge $nCols) { break }
|                            $kind = $cell.ValueKind.ToString()
|                            if ($kind -ne 'Null') {
|                                $s = if ($kind -eq 'String') { $cell.GetString() } elseif ($kind -eq 'True') { 'true' } elseif ($kind -eq 'False') { 'false' } else { $cell.GetRawText() }
|                                if ($s.Length -le 32) { $p0 = $null; if ($pool.TryGetValue($s, [ref]$p0)) { $s = $p0 } else { $pool[$s] = $s } }
|                                $vals[$i] = $s
|                            }
|                            $i++
|                        }
|                        [void]$rows.Add($compactType::new($vals))
|                    }
|                    $nCols = -1
|                }
|                if ($nCols -ge 0) {
|                foreach ($row in $pick.GetProperty('rows').EnumerateArray()) {
|                    $o = [ordered]@{}
|                    $i = 0
|                    foreach ($cell in $row.EnumerateArray()) {
|                        if ($i -ge $nCols) { break }
|                        $name = $names[$i]
|                        $kind = $cell.ValueKind.ToString()
|                        if ($kind -eq 'String') { $o[$name] = $cell.GetString() }
|                        elseif ($kind -eq 'Null') { $o[$name] = $null }
|                        elseif ($kind -eq 'True') { $o[$name] = 'true' }
|                        elseif ($kind -eq 'False') { $o[$name] = 'false' }
|                        else { $o[$name] = $cell.GetRawText() }
|                        $i++
|                    }
|                    # a row shorter than its columns: the missing ones are empty, as before
|                    for (; $i -lt $nCols; $i++) { $o[$names[$i]] = $null }
|                    [void]$rows.Add([pscustomobject]$o)
|                }
|                }
|            }
|        }
|        $eEl = [System.Text.Json.JsonElement]::new()
|        if ($root.TryGetProperty('error', [ref]$eEl) -and $eEl.ValueKind.ToString() -ne 'Null') { $err = ($eEl.GetRawText() | ConvertFrom-Json) }
|    } finally { $doc.Dispose() }
|    return [pscustomobject]@{ Rows = $rows.ToArray(); Columns = $cols.ToArray(); Error = $err }
|}
|
|function Get-SILaServiceRowLimit {
|    <# The most rows ONE Log Analytics query answer carries (the service's own limit). An answer holding exactly that many
|       rows cannot be told from an answer the service cut there. $global:SI_LaServiceRowLimit overrides it (tests). #>
|    $v = 0L
|    try { $v = [long]$global:SI_LaServiceRowLimit } catch { $v = 0L }
|    if ($v -gt 0) { return $v }
|    return 500000L
|}
|
|function Get-SILaPartialVerdict {
|    <#
|        PURE. What a Log Analytics partial answer (the "error" object beside the rows of an HTTP 200 answer) says, read from
|        its LEAVES (the innermost error objects -- the outer ones are generic). Returns @{ Kind; Code; Detail; Tables }:
|          Unresolved  every leaf is "Failed to resolve table or column expression named 'SI_..._CL'": a `union isfuzzy=true`
|                      leg over a SecurityInsight table this workspace does not have yet. The answer IS the whole result (the
|                      missing table has no rows) -- the one partial answer that is not a cut one.
|          Limit       a leaf names a limit (rows / size / time / memory): the answer is CUT; a smaller read fixes it.
|          Other       anything else: the answer is short, and a smaller read does not fix it.
|        The same reading as Risk Analysis' own (RA-LaPartedRead.ps1 Get-RALaPartialVerdict); kept here so every reader of
|        Log Analytics refuses a cut answer, not only Risk Analysis.
|        -MayBeMissing (2026-10-23): other tables the CALLER names that this workspace may not have (the capability probe's
|        SecurityIncident / SecurityAlert in a workspace without Sentinel): a leaf that cannot resolve one of them is
|        Unresolved too -- the answer is whole, the table has no rows. Only the tables named; never any other.
|    #>
|    param([AllowNull()][object]$ErrorObject, [string[]]$MayBeMissing = @())
|    $leaves = New-Object System.Collections.Generic.List[string]
|    $all = New-Object System.Collections.Generic.List[string]
|    $codes = New-Object System.Collections.Generic.List[string]
|    $get = {
|        param($o, $n)
|        if ($null -eq $o) { return $null }
|        if ($o -is [System.Collections.IDictionary]) { if ($o.Contains($n)) { return $o[$n] }; return $null }
|        $p = $o.PSObject.Properties[$n]; if ($p) { return $p.Value }; return $null
|    }
|    $stack = New-Object System.Collections.Stack
|    if ($null -ne $ErrorObject -and $ErrorObject -isnot [string]) { $stack.Push($ErrorObject) }
|    $visited = 0
|    while ($stack.Count -gt 0 -and $visited -lt 256) {
|        $o = $stack.Pop(); $visited++
|        if ($null -eq $o -or $o -is [string]) { continue }
|        $m = [string](& $get $o 'message'); $c = [string](& $get $o 'code')
|        if ($c -and $codes.Count -lt 3 -and -not $codes.Contains($c)) { $codes.Add($c) }
|        if ($m) { $all.Add($m) }
|        $children = New-Object System.Collections.Generic.List[object]
|        $ie = & $get $o 'innererror'; if ($null -ne $ie -and $ie -isnot [string]) { $children.Add($ie) }
|        $ds = & $get $o 'details'
|        if ($null -ne $ds) { foreach ($d in @($ds)) { if ($null -ne $d -and $d -isnot [string]) { $children.Add($d) } } }
|        if ($children.Count -eq 0) { if ($m) { $leaves.Add($m) } }
|        else { for ($i = $children.Count - 1; $i -ge 0; $i--) { $stack.Push($children[$i]) } }
|    }
|    if ($null -ne $ErrorObject -and $ErrorObject -is [string]) { $leaves.Add([string]$ErrorObject); $all.Add([string]$ErrorObject) }
|    $generic = '^(There were some errors when processing your query\.?|Something went wrong processing your query on the server\.?)$'
|    $specific = @($all | Where-Object { $_ -notmatch $generic } | Select-Object -Unique)
|    $detail = (@($specific) -join '; ')
|    if (-not $detail) { $detail = (@($all | Select-Object -Unique) -join '; ') }
|    if ($detail.Length -gt 400) { $detail = $detail.Substring(0, 400) + '...' }
|    $code = (@($codes) -join '/')
|    # a 'union' leaf says "table expression", a 'where' leaf "table or column expression" (both: the table is not there)
|    $rx = "Failed to resolve table (?:or column )?expression named '(?<t>[A-Za-z0-9_]+)'"
|    $okMissing = { param($t) ($t -match '^SI_[A-Za-z0-9_]+_CL$') -or (@($MayBeMissing | Where-Object { $_ -and [string]$_ -ieq $t }).Count -gt 0) }
|    $tables = New-Object System.Collections.Generic.List[string]
|    $leafSpecific = @($leaves | Where-Object { $_ -notmatch $generic })
|    $allResolve = ($leafSpecific.Count -gt 0)
|    foreach ($l in $leafSpecific) {
|        $mm = [regex]::Match($l, $rx)
|        if (-not $mm.Success -or -not (& $okMissing $mm.Groups['t'].Value)) { $allResolve = $false; break }
|        if (-not $tables.Contains($mm.Groups['t'].Value)) { $tables.Add($mm.Groups['t'].Value) }
|    }
|    if ($allResolve) { return @{ Kind = 'Unresolved'; Code = $code; Detail = $detail; Tables = $tables.ToArray() } }
|    $limitRx = '(?i)limit|exceeded|too large|E_QUERY_RESULT_SET_TOO_LARGE|timed out|timeout|E_RUNAWAY|out of memory|memory|truncat|cancell?ed|preempted'
|    if (@($all | Where-Object { $_ -match $limitRx }).Count -gt 0) { return @{ Kind = 'Limit'; Code = $code; Detail = $detail; Tables = @() } }
|    return @{ Kind = 'Other'; Code = $code; Detail = $detail; Tables = @() }
|}
|
|function Test-SILaAnswerWhole {
|    <#
|        PURE. Is a Log Analytics answer the WHOLE result? -ErrorObject: the partial-error object beside the rows; -Rows: how
|        many rows the answer held. Returns @{ Whole; Kind; Code; Detail; Tables; Rows }:
|          no error and fewer rows than the service's own row limit   -> whole
|          an Unresolved partial error (a missing SI table in a fuzzy union)  -> whole (the missing table has no rows)
|          a Limit / Other partial error                              -> NOT whole
|          no error, but exactly as many rows as the service's limit  -> NOT whole (Limit): it cannot be told from a cut answer
|    #>
|    # -MayBeMissing: as Get-SILaPartialVerdict (the tables the caller names that the workspace may not have)
|    param([AllowNull()][object]$ErrorObject, [long]$Rows = 0, [string[]]$MayBeMissing = @())
|    if ($null -ne $ErrorObject) {
|        $v = Get-SILaPartialVerdict -ErrorObject $ErrorObject -MayBeMissing $MayBeMissing
|        return @{ Whole = ($v.Kind -eq 'Unresolved'); Kind = $v.Kind; Code = $v.Code; Detail = $v.Detail; Tables = $v.Tables; Rows = $Rows }
|    }
|    $cap = Get-SILaServiceRowLimit
|    if ($Rows -ge $cap) {
|        $d = [string]::Format([System.Globalization.CultureInfo]::InvariantCulture, 'the answer holds {0:N0} rows, the most one answer carries (the service''s limit of {1:N0} rows) -- it cannot be told from a cut answer', $Rows, $cap)
|        return @{ Whole = $false; Kind = 'Limit'; Code = 'RowLimit'; Detail = $d; Tables = @(); Rows = $Rows }
|    }
|    return @{ Whole = $true; Kind = ''; Code = ''; Detail = ''; Tables = @(); Rows = $Rows }
|}
|
|function New-SILaCutAnswerError {
|    <#
|        The error a refused cut answer becomes (Invoke-SILaQuery without -AllowPartial). An ErrorRecord whose exception
|        carries the service's own words three ways, so every classifier that reads a failed query finds them:
|          * the message: "Log Analytics returned a PARTIAL answer (<code>: <detail>) -- ..."; a Limit also says "Query
|            execution has exceeded the allowed limits" (the text Risk Analysis' bucket logic makes a slice smaller on);
|          * Exception.Response.Content and ErrorDetails: the error object as JSON (Get-SIKqlErrorText -> the data sync's
|            "too large" check, Test-SIDataResponseTooLarge, cuts that page in two);
|          * Exception.Data: SILaPartial / SIRALaPartial = the kind, SIRALaPartialRows = the rows the short answer held (Risk
|            Analysis' parted reader measures with them).
|    #>
|    param([Parameter(Mandatory)][hashtable]$Verdict, [AllowNull()][object]$ErrorObject, [string]$WorkspaceId = '')
|    $msg = if ($Verdict.Kind -eq 'Limit') {
|        "Log Analytics returned a PARTIAL answer ({0}: {1}) -- Query execution has exceeded the allowed limits; the rows it returned are not the whole result and were not used" -f $Verdict.Code, $Verdict.Detail
|    } else {
|        "Log Analytics returned a PARTIAL answer ({0}: {1}) -- the rows it returned are not the whole result and were not used" -f $Verdict.Code, $Verdict.Detail
|    }
|    $json = ''
|    if ($null -ne $ErrorObject) { try { $json = ConvertTo-Json -InputObject ([pscustomobject]@{ error = $ErrorObject }) -Depth 12 -Compress } catch { $json = [string]$ErrorObject } }
|    else { $json = ConvertTo-Json -InputObject ([pscustomobject]@{ error = [pscustomobject]@{ code = [string]$Verdict.Code; message = [string]$Verdict.Detail } }) -Depth 4 -Compress }
|    $ex = New-SIAzRestError -Message $msg -Response ([pscustomobject]@{ StatusCode = 200; Content = $json; Headers = @{} })
|    $ex.Data['SILaPartial'] = [string]$Verdict.Kind
|    $ex.Data['SIRALaPartial'] = [string]$Verdict.Kind
|    $ex.Data['SIRALaPartialRows'] = [long]$Verdict.Rows
|    $er = New-Object System.Management.Automation.ErrorRecord($ex, 'SILaQueryPartial', [System.Management.Automation.ErrorCategory]::LimitsExceeded, $WorkspaceId)
|    $er.ErrorDetails = New-Object System.Management.Automation.ErrorDetails($json)
|    return $er
|}
|
|function Test-SILaCutAnswerError {
|    <# PURE. Was this failure a cut answer Invoke-SILaQuery refused (New-SILaCutAnswerError)? -Kind: only that kind. #>
|    param([AllowNull()][object]$Err, [string]$Kind = '')
|    $ex = $null
|    if ($Err -is [System.Management.Automation.ErrorRecord]) { $ex = $Err.Exception } elseif ($Err -is [System.Exception]) { $ex = $Err }
|    while ($null -ne $ex) {
|        if ($ex.Data -and $ex.Data.Contains('SILaPartial')) { return ((-not $Kind) -or ([string]$ex.Data['SILaPartial'] -eq $Kind)) }
|        $ex = $ex.InnerException
|    }
|    return $false
|}
|
|function Invoke-SILaQuery {
|    <#
|        A KQL query on the Log Analytics DATA PLANE: POST https://api.loganalytics.io/v1/workspaces/{id}/query. Not the
|        ARM /api/query route, which hides the semantic error behind a generic one.
|        Returns the shape Invoke-AzOperationalInsightsQuery returns and every caller reads:
|            .Results   the primary table's rows, one object per row, one TEXT property per column (as Az hands them)
|            .Columns   the primary table's columns (name / type) -- what the workbooks type their columns from
|            .Tables    ONE entry: the primary table's Name and Columns, NO rows (RowsOmitted). The rows are in .Results only;
|                       the answer is never held a second time as tables beside them (#639). No caller reads table rows.
|            .Error     the partial-error object (or $null) -- only ever set beside rows that ARE the whole result (a missing SI
|                       table in a fuzzy union), or with -AllowPartial
|            .RowCount  the rows the answer held (with -OnPage: the rows handed to it)
|        A CUT ANSWER IS REFUSED (#639, working rule 4). Log Analytics answers HTTP 200 with the rows it got to AND an error
|        object when it stopped early (a result over its row / size limit, a part that timed out); an answer with exactly as
|        many rows as the service's own row limit cannot be told from one cut there. Such an answer THROWS
|        (New-SILaCutAnswerError: the service's words, the kind, the rows it held) -- a cut answer is never handed out as
|        whole. -AllowPartial: the caller reads .Error itself and decides (the rows and the error come back as before, and
|        .Partial says the kind). A read that pages (its query keys the rows) catches the "too large" refusal and reads that
|        page again in smaller pages -- the refusal carries the same words the cut answer did.
|        -OnPage { param($Rows) }: the rows are handed on a PAGE at a time as they arrive (about -PageBytes of answer each,
|        the size measured from the answer's own bytes) and never collected -- memory is one page, whatever the size of the
|        answer. .Results is then empty. The pages are PROVISIONAL until this call returns: a cut answer (said at the END of
|        the answer) or a read that fails half-way throws AFTER pages were handed on, so a caller stages the pages and keeps
|        them only when the call returned. Without the streaming reader (Windows PowerShell, or it cannot be built) the
|        answer is read the older way and then handed on in pages of the same size.
|        THE LEAN READ IS THE DEFAULT (#639): on pwsh 7 the answer arrives as bytes and its rows are read from those bytes
|        (ConvertFrom-SILaQueryRows) -- never also held as one text (twice its size) or as a list of cells per row. The same
|        rows and the same text values as before. Windows PowerShell (no System.Text.Json) reads the text, as always.
|        -WorkspaceId is the workspace's customer id (GUID). -Wait = server timeout in seconds (Prefer: wait=N).
|        -RowsOnly is kept for the callers that name it; it is what every read does now.
|        A refused query throws with the service's own code and message, e.g.
|            "Operation returned an invalid status code 'BadRequest' -- BadArgumentError/SemanticError/SEM0100: ..."
|        and carries the body in Exception.Response.Content and ErrorDetails -- what SI-KqlError.ps1 reads.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$WorkspaceId,
|        [Parameter(Mandatory)][string]$Query,
|        [int]$Wait = 0,
|        [timespan]$Timespan = [timespan]::Zero,
|        [int]$MaxAttempts = 4,
|        [switch]$RowsOnly,
|        # the caller reads .Error itself and decides what a cut answer means (never the default)
|        [switch]$AllowPartial,
|        # the rows a page at a time, never collected (see above)
|        [scriptblock]$OnPage,
|        [long]$PageBytes = 4MB
|    )
|    Initialize-SIAzRestHelpers
|    if ($OnPage) {
|        return (Invoke-SILaQueryPaged -WorkspaceId $WorkspaceId -Query $Query -Wait $Wait -Timespan $Timespan -MaxAttempts $MaxAttempts -AllowPartial:$AllowPartial -OnPage $OnPage -PageBytes $PageBytes)
|    }
|    $uri = 'https://api.loganalytics.io/v1/workspaces/{0}/query' -f $WorkspaceId.Trim()
|    $body = [ordered]@{ query = $Query }
|    if ($Timespan -gt [timespan]::Zero) { $body['timespan'] = [System.Xml.XmlConvert]::ToString($Timespan) }
|    $headers = @{}
|    $timeout = 300
|    # #882 (A4): Log Analytics stops a query at 3 minutes unless asked to wait -- every query asks for its maximum (10 minutes)
|    if ($Wait -le 0) { $Wait = 600 }
|    if ($Wait -gt 0) { $headers['Prefer'] = ('wait={0}' -f $Wait); $timeout = $Wait + 60 }
|    # the answer as bytes wherever it can be read from them (pwsh 7) -- the lean read is the default (#639)
|    $asBytes = ([bool]$RowsOnly -or $PSVersionTable.PSEdition -eq 'Core')
|    # #730: Risk Analysis' reads (its lookups -- SI_LaCompactRows -- and its Log Analytics answers -- SI_LaStreamRows) are
|    # read AS THEY ARRIVE (SI-LaStreamRead.ps1): the same rows, the answer never held whole. Everything else reads as before.
|    $readStream = $null
|    if ($PSVersionTable.PSEdition -eq 'Core' -and ([bool]$global:SI_LaCompactRows -or [bool]$global:SI_LaStreamRows) -and
|        (Get-Command -Name Get-SILaStreamReaderType -ErrorAction Ignore)) {
|        if (Get-SILaStreamReaderType) {
|            $__lsCompact = [bool]$global:SI_LaCompactRows
|            # (no closure: it runs inside this call, so $__lsCompact is seen; a closure would not see this file's functions)
|            # #836: a failed stream read answers a marker -- read again below the older way, never an error of the query
|            $readStream = { param($s) Read-SILaQueryStreamSafe -Stream $s -Compact:$__lsCompact }
|        } else {
|            # #836: never silent -- one line on the run log says the older read is used and why
|            Write-SILaStreamFallback -Once -Reason ([string]$global:SI_LaStreamReaderOff)
|        }
|    }
|    $rq = @{ Method = 'POST'; Uri = $uri; Audience = 'LaQuery'; Body = ($body | ConvertTo-Json -Compress -Depth 5); Headers = $headers
|             TimeoutSec = $timeout; MaxAttempts = $MaxAttempts; AllowStatus = @(400, 403, 404, 409, 413, 422); What = 'Log Analytics query'; AsBytes = $asBytes }
|    if ($readStream) { $rq['ReadStream'] = $readStream }
|    $r = Invoke-SIAzRestRequest @rq
|    if ($readStream -and $r -and $r.PSObject.Properties['Parsed'] -and $null -ne $r.Parsed -and $r.Parsed.PSObject.Properties['SILaStreamFailed']) {
|        # #836: the stream read of this answer failed -- the same query again, read the older way (data first), and said
|        Write-SILaStreamFallback -Reason ('reading this answer as it arrived failed (' + [string]$r.Parsed.SILaStreamFailed + '), so it was read again')
|        $r = $null
|        [void]$rq.Remove('ReadStream')
|        $r = Invoke-SIAzRestRequest @rq
|    }
|    if ($r -and $r.PSObject.Properties['Parsed'] -and $null -ne $r.Parsed -and [int]$r.StatusCode -lt 400) {
|        $streamed = $r.Parsed
|        $r = $null
|        return (Complete-SILaQueryAnswer -Results $streamed.Rows -Columns $streamed.Columns -QueryError $streamed.Error -AllowPartial:$AllowPartial -WorkspaceId $WorkspaceId)
|    }
|    $code = [int]$r.StatusCode
|    # A refusal (always small) is read as text, as is every answer on Windows PowerShell (no System.Text.Json there); an
|    # answer on pwsh 7 is parsed from its bytes below.
|    $content = [string]$r.Content
|    $hasBytes = ($asBytes -and $null -ne $r.Bytes -and $r.Bytes.Length -gt 0)
|    $lean = ($hasBytes -and $code -lt 400 -and $PSVersionTable.PSEdition -eq 'Core')
|    if ($hasBytes -and -not $lean) { $content = [System.Text.Encoding]::UTF8.GetString($r.Bytes) }
|    if ($code -ge 400) { throw (New-SILaQueryRefusedError -Code $code -Content $content -Headers $r.Headers -WorkspaceId $WorkspaceId) }
|    if ($lean) {
|        # a plain statement, never through $( ... ): a subexpression would enumerate the byte array into object[]
|        [byte[]]$answer = $r.Bytes
|        $r = $null
|        $leanAnswer = ConvertFrom-SILaQueryRows -Bytes $answer
|        $answer = $null
|        return (Complete-SILaQueryAnswer -Results $leanAnswer.Rows -Columns $leanAnswer.Columns -QueryError $leanAnswer.Error -AllowPartial:$AllowPartial -WorkspaceId $WorkspaceId)
|    }
|    $parsed = ConvertFrom-SILaQueryJson -Json $content
|    $content = $null
|    $results = [System.Collections.Generic.List[object]]::new()
|    $first = @($parsed.Tables | Where-Object { $_.Name -eq 'PrimaryResult' }) + @($parsed.Tables) | Select-Object -First 1
|    $cols = @()
|    if ($first) {
|        $names = @($first.Columns | ForEach-Object { [string]$_.name })
|        $cols = @($first.Columns | ForEach-Object { [pscustomobject]@{ name = [string]$_.name; type = $(if ($_.PSObject.Properties['type']) { [string]$_.type } else { $null }) } })
|        foreach ($row in $first.Rows) {
|            $o = [ordered]@{}
|            for ($i = 0; $i -lt $names.Count; $i++) { $o[$names[$i]] = $row[$i] }
|            [void]$results.Add([pscustomobject]$o)
|        }
|    }
|    $err = $parsed.Error
|    $parsed = $null; $first = $null
|    return (Complete-SILaQueryAnswer -Results $results.ToArray() -Columns $cols -QueryError $err -AllowPartial:$AllowPartial -WorkspaceId $WorkspaceId)
|}
|
|function New-SILaQueryRefusedError {
|    <# The error a refused query (HTTP 4xx) becomes: the service's own code and message, the body for SI-KqlError. #>
|    param([int]$Code, [AllowNull()][AllowEmptyString()][string]$Content, $Headers, [string]$WorkspaceId = '')
|    $base = "Operation returned an invalid status code '{0}'" -f (Get-SIAzRestStatusName $Code)
|    $resp = [pscustomobject]@{ StatusCode = $Code; Content = $Content; Headers = $Headers }
|    $probe = New-SIAzRestError -Message $base -Response $resp
|    $msg = Get-SIKqlErrorSummary -ErrorRecord $probe
|    if ($msg -eq $base) {
|        # no innererror chain: the top-level error code + message
|        try { $e = ($Content | ConvertFrom-Json).error; if ($e) { $msg = ('{0} -- {1}: {2}' -f $base, [string]$e.code, [string]$e.message) } } catch { }
|    }
|    $ex = New-SIAzRestError -Message $msg -Response $resp
|    $er = New-Object System.Management.Automation.ErrorRecord($ex, 'SILaQueryFailed', [System.Management.Automation.ErrorCategory]::InvalidOperation, $WorkspaceId)
|    $er.ErrorDetails = New-Object System.Management.Automation.ErrorDetails($Content)
|    $er
|}
|
|function Complete-SILaQueryAnswer {
|    <#
|        The end of every Invoke-SILaQuery read: a cut answer (Test-SILaAnswerWhole) THROWS (New-SILaCutAnswerError) unless
|        -AllowPartial; otherwise the answer (New-SILaQueryAnswer), with .Partial = the kind of a partial answer handed out
|        under -AllowPartial ('' when whole).
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Results = @(), [AllowNull()][AllowEmptyCollection()][object[]]$Columns = @(), $QueryError,
|          [switch]$AllowPartial, [string]$WorkspaceId = '', [long]$RowCount = -1)
|    $n = $RowCount
|    if ($n -lt 0) { $n = 0L; if ($null -ne $Results) { $n = [long]$Results.Count } }
|    $v = Test-SILaAnswerWhole -ErrorObject $QueryError -Rows $n
|    if (-not $v.Whole -and -not $AllowPartial) { throw (New-SILaCutAnswerError -Verdict $v -ErrorObject $QueryError -WorkspaceId $WorkspaceId) }
|    $a = New-SILaQueryAnswer -Results $Results -Columns $Columns -QueryError $QueryError
|    $kind = ''; if (-not $v.Whole) { $kind = [string]$v.Kind }
|    $a | Add-Member -NotePropertyName Partial -NotePropertyValue $kind -Force
|    $a | Add-Member -NotePropertyName RowCount -NotePropertyValue $n -Force
|    $a
|}
|
|function Invoke-SILaQueryPaged {
|    <#
|        Invoke-SILaQuery -OnPage: the rows handed on a page at a time, never collected (see Invoke-SILaQuery). The streaming
|        reader (SI-LaStreamRead.ps1) delivers each page as soon as about -PageBytes of the answer's own bytes are in; the
|        compact rows of $global:SI_LaCompactRows apply. A cut answer is refused at the end, after the pages (they are
|        provisional until this returns). A stream read that fails BEFORE any page was handed on is read again the older way;
|        one that fails AFTER a page was handed on throws (handing the pages on again would hand some rows twice).
|        Without the streaming reader: the older read, then the rows in pages of the same measured size.
|        Returns the answer shape with no rows in .Results; .RowCount = the rows handed on, .Pages = the pages.
|    #>
|    param([Parameter(Mandatory)][string]$WorkspaceId, [Parameter(Mandatory)][string]$Query, [int]$Wait = 0,
|          [timespan]$Timespan = [timespan]::Zero, [int]$MaxAttempts = 4, [switch]$AllowPartial,
|          [Parameter(Mandatory)][scriptblock]$OnPage, [long]$PageBytes = 4MB)
|    if ($PageBytes -lt 1KB) { $PageBytes = 1KB }
|    $uri = 'https://api.loganalytics.io/v1/workspaces/{0}/query' -f $WorkspaceId.Trim()
|    $body = [ordered]@{ query = $Query }
|    if ($Timespan -gt [timespan]::Zero) { $body['timespan'] = [System.Xml.XmlConvert]::ToString($Timespan) }
|    $headers = @{}
|    $timeout = 300
|    # #882 (A4): Log Analytics stops a query at 3 minutes unless asked to wait -- every query asks for its maximum (10 minutes)
|    if ($Wait -le 0) { $Wait = 600 }
|    if ($Wait -gt 0) { $headers['Prefer'] = ('wait={0}' -f $Wait); $timeout = $Wait + 60 }
|    $rq = @{ Method = 'POST'; Uri = $uri; Audience = 'LaQuery'; Body = ($body | ConvertTo-Json -Compress -Depth 5); Headers = $headers
|             TimeoutSec = $timeout; MaxAttempts = $MaxAttempts; AllowStatus = @(400, 403, 404, 409, 413, 422); What = 'Log Analytics query'
|             AsBytes = ($PSVersionTable.PSEdition -eq 'Core') }
|    $streamable = ($PSVersionTable.PSEdition -eq 'Core' -and (Get-Command -Name Get-SILaStreamReaderType -ErrorAction Ignore) -and (Get-SILaStreamReaderType))
|    $state = @{ Pages = 0; Rows = 0L }
|    if ($streamable) {
|        $__lpCompact = [bool]$global:SI_LaCompactRows
|        $__lpOn = $OnPage; $__lpBytes = $PageBytes; $__lpState = $state
|        $rq['ReadStream'] = { param($s) Read-SILaQueryStreamSafe -Stream $s -Compact:$__lpCompact -OnPage $__lpOn -PageBytes $__lpBytes -PageState $__lpState }
|    } elseif ($PSVersionTable.PSEdition -eq 'Core') {
|        Write-SILaStreamFallback -Once -Reason ([string]$global:SI_LaStreamReaderOff)
|    }
|    $r = Invoke-SIAzRestRequest @rq
|    if ($r -and $r.PSObject.Properties['Parsed'] -and $null -ne $r.Parsed -and $r.Parsed.PSObject.Properties['SILaStreamFailed']) {
|        if ([int]$state.Pages -gt 0) {
|            throw ('Log Analytics: the answer could not be read to its end ({0}) after {1} page(s) had been handed on -- the read is not whole and its pages must not be used' -f [string]$r.Parsed.SILaStreamFailed, $state.Pages)
|        }
|        Write-SILaStreamFallback -Reason ('reading this answer as it arrived failed (' + [string]$r.Parsed.SILaStreamFailed + '), so it was read again')
|        $r = $null
|        [void]$rq.Remove('ReadStream')
|        $r = Invoke-SIAzRestRequest @rq
|    }
|    if ($r -and $r.PSObject.Properties['Parsed'] -and $null -ne $r.Parsed -and [int]$r.StatusCode -lt 400) {
|        $p = $r.Parsed; $r = $null
|        $a = Complete-SILaQueryAnswer -Results @() -Columns $p.Columns -QueryError $p.Error -AllowPartial:$AllowPartial -WorkspaceId $WorkspaceId -RowCount ([long]$p.RowCount)
|        $a | Add-Member -NotePropertyName Pages -NotePropertyValue ([int]$p.Pages) -Force
|        return $a
|    }
|    # the older read (no streaming reader, or read again): the same refusal of a 4xx and of a cut answer, then the pages
|    [void]$rq.Remove('ReadStream')
|    if ($null -eq $r) { $r = Invoke-SIAzRestRequest @rq }
|    $code = [int]$r.StatusCode
|    $content = [string]$r.Content
|    if ($null -ne $r.Bytes -and $r.Bytes.Length -gt 0 -and ($code -ge 400 -or $PSVersionTable.PSEdition -ne 'Core')) { $content = [System.Text.Encoding]::UTF8.GetString($r.Bytes) }
|    if ($code -ge 400) { throw (New-SILaQueryRefusedError -Code $code -Content $content -Headers $r.Headers -WorkspaceId $WorkspaceId) }
|    $lean = $null
|    if ($null -ne $r.Bytes -and $r.Bytes.Length -gt 0 -and $PSVersionTable.PSEdition -eq 'Core') {
|        [byte[]]$bytes = $r.Bytes
|        $total = [long]$bytes.Length
|        $r = $null
|        $lean = ConvertFrom-SILaQueryRows -Bytes $bytes
|        $bytes = $null
|    } else {
|        $total = [long][System.Text.Encoding]::UTF8.GetByteCount($content)
|        $parsed = ConvertFrom-SILaQueryJson -Json $content
|        $content = $null
|        $first = @($parsed.Tables | Where-Object { $_.Name -eq 'PrimaryResult' }) + @($parsed.Tables) | Select-Object -First 1
|        $rowsL = [System.Collections.Generic.List[object]]::new(); $colsL = @()
|        if ($first) {
|            $names = @($first.Columns | ForEach-Object { [string]$_.name })
|            $colsL = @($first.Columns | ForEach-Object { [pscustomobject]@{ name = [string]$_.name; type = $(if ($_.PSObject.Properties['type']) { [string]$_.type } else { $null }) } })
|            foreach ($row in $first.Rows) { $o = [ordered]@{}; for ($i = 0; $i -lt $names.Count; $i++) { $o[$names[$i]] = $row[$i] }; [void]$rowsL.Add([pscustomobject]$o) }
|        }
|        $lean = [pscustomobject]@{ Rows = $rowsL.ToArray(); Columns = $colsL; Error = $parsed.Error }
|        $parsed = $null; $first = $null
|    }
|    $all = @($lean.Rows); $n = $all.Count
|    # a cut answer is refused BEFORE a page is handed on (the whole answer is in hand on this path)
|    $v = Test-SILaAnswerWhole -ErrorObject $lean.Error -Rows $n
|    if (-not $v.Whole -and -not $AllowPartial) { throw (New-SILaCutAnswerError -Verdict $v -ErrorObject $lean.Error -WorkspaceId $WorkspaceId) }
|    # pages of about -PageBytes of the answer: the measured bytes per row of this answer decide the rows per page
|    $per = $n
|    if ($n -gt 0 -and $total -gt $PageBytes) { $per = [int][Math]::Max(1, [Math]::Floor($n * ([double]$PageBytes / [double]$total))) }
|    $pages = 0
|    for ($i = 0; $i -lt $n; $i += [Math]::Max(1, $per)) {
|        $len = [Math]::Min([Math]::Max(1, $per), $n - $i)
|        $pg = [object[]]::new($len); [Array]::Copy($all, $i, $pg, 0, $len)
|        $null = & $OnPage $pg
|        $pages++
|        for ($k = $i; $k -lt $i + $len; $k++) { $all[$k] = $null }
|    }
|    $a = Complete-SILaQueryAnswer -Results @() -Columns $lean.Columns -QueryError $lean.Error -AllowPartial:$AllowPartial -WorkspaceId $WorkspaceId -RowCount ([long]$n)
|    $a | Add-Member -NotePropertyName Pages -NotePropertyValue $pages -Force
|    $a
|}
|
|function New-SILaQueryAnswer {
|    <#
|        PURE. The one shape Invoke-SILaQuery answers (#639): .Results (the rows), .Columns (name / type), .Tables = the
|        primary table's SCHEMA only (Name, Columns, no rows -- RowsOmitted), .Error. The rows are never held twice.
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Results = @(), [AllowNull()][AllowEmptyCollection()][object[]]$Columns = @(), $QueryError)
|    $c = @($Columns | Where-Object { $null -ne $_ })
|    $schema = [pscustomobject]@{ Name = 'PrimaryResult'; Columns = $c; Rows = @(); RowsOmitted = $true }
|    # plain statements: an if used as a value would unroll the rows (one row would come back as that row, not a list)
|    $rows = $Results
|    if ($null -eq $rows) { $rows = [object[]]@() }
|    [pscustomobject]@{ Results = $rows; Columns = $c; Tables = @($schema); Error = $QueryError; Statistics = $null; Render = $null }
|}
|
|# =====================================================================================================================
|#  Storage data plane: blob, queue, table (OAuth bearer, x-ms-version)
|# =====================================================================================================================
|
|function Get-SIStorageApiVersion { '2021-08-06' }
|
|function Get-SIStorageUri {
|    param([Parameter(Mandatory)][string]$Account, [ValidateSet('blob', 'queue', 'table')][string]$Service = 'blob', [string]$Path = '', [string]$Query = '')
|    $p = (($Path -split '/') | ForEach-Object { [uri]::EscapeDataString($_) }) -join '/'
|    $u = 'https://{0}.{1}.core.windows.net/{2}' -f $Account, $Service, $p
|    if ($Query) { $u += '?' + $Query }
|    return $u
|}
|
|function Invoke-SIStorageRequest {
|    param([string]$Method = 'GET', [Parameter(Mandatory)][string]$Uri, $Body, [string]$ContentType, [hashtable]$Headers, [switch]$AllowNotFound, [int[]]$AllowStatus = @(), [switch]$AsBytes, [string]$What = 'Azure Storage request')
|    $h = @{ 'x-ms-version' = (Get-SIStorageApiVersion); 'x-ms-date' = [datetime]::UtcNow.ToString('R') }
|    if ($Headers) { foreach ($k in $Headers.Keys) { $h[$k] = $Headers[$k] } }
|    if (-not $ContentType) { $ContentType = 'application/octet-stream' }
|    return (Invoke-SIAzRestRequest -Method $Method -Uri $Uri -Audience Storage -Body $Body -ContentType $ContentType -Headers $h -AllowNotFound:$AllowNotFound -AllowStatus $AllowStatus -AsBytes:$AsBytes -What $What)
|}
|
|function ConvertTo-SIStorageDate {
|    param([string]$Text)
|    $d = [DateTimeOffset]::MinValue
|    if ($Text -and [DateTimeOffset]::TryParse($Text, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::AssumeUniversal, [ref]$d)) { return $d }
|    return $null
|}
|
|function Get-SIBlobProperties {
|    <# HEAD of one blob: @{ Name; Length; LastModified; ETag; ContentType } or $null when it does not exist. #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Container, [Parameter(Mandatory)][string]$Blob)
|    $r = Invoke-SIStorageRequest -Method HEAD -Uri (Get-SIStorageUri -Account $Account -Path ("$Container/$Blob")) -AllowNotFound -What ("Blob '{0}/{1}'" -f $Container, $Blob)
|    if (-not $r) { return $null }
|    $len = 0L; [void][long]::TryParse([string]$r.Headers['Content-Length'], [ref]$len)
|    return [pscustomobject]@{ Name = $Blob; Container = $Container; Length = $len; LastModified = (ConvertTo-SIStorageDate $r.Headers['Last-Modified']); ETag = [string]$r.Headers['ETag']; ContentType = [string]$r.Headers['Content-Type'] }
|}
|
|function Get-SIBlobList {
|    <# Every blob in -Container under -Prefix (List Blobs, following the marker). #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Container, [string]$Prefix)
|    $out = [System.Collections.Generic.List[object]]::new()
|    $marker = $null
|    do {
|        $q = 'restype=container&comp=list&maxresults=5000'
|        if ($Prefix) { $q += '&prefix=' + [uri]::EscapeDataString($Prefix) }
|        if ($marker) { $q += '&marker=' + [uri]::EscapeDataString($marker) }
|        $r = Invoke-SIStorageRequest -Method GET -Uri (Get-SIStorageUri -Account $Account -Path $Container -Query $q) -Headers @{ Accept = 'application/xml' } -What ("List blobs in '{0}'" -f $Container)
|        # The listing is XML (EnumerationResults). A cast `[xml]$text` that fails puts the WHOLE listing (up to 5,000 blobs)
|        # into its error text -- customer B 2026-10-15: "Cannot convert value "<?xml ... EnumerationResults ..." to type
|        # System.Xml.XmlDocument. Error: OutOfMemoryException" as the run's end text. Parsed here; a failure says what failed
|        # and why, in one short line, never the payload.
|        $x = New-Object System.Xml.XmlDocument
|        try { $x.LoadXml((([string]$r.Content) -replace '^\uFEFF', '')) }
|        catch {
|            $why = $_.Exception.Message; if ($_.Exception.InnerException) { $why = $_.Exception.InnerException.Message }
|            if ($why.Length -gt 300) { $why = $why.Substring(0, 300) }
|            throw ("The blob list of '{0}' (prefix '{1}') could not be read: {2}" -f $Container, $Prefix, $why)
|        }
|        foreach ($b in @($x.EnumerationResults.Blobs.Blob)) {
|            if ($null -eq $b) { continue }
|            $len = 0L; [void][long]::TryParse([string]$b.Properties.'Content-Length', [ref]$len)
|            [void]$out.Add([pscustomobject]@{ Name = [string]$b.Name; Container = $Container; Length = $len; LastModified = (ConvertTo-SIStorageDate ([string]$b.Properties.'Last-Modified')); ETag = [string]$b.Properties.Etag; ContentType = [string]$b.Properties.'Content-Type' })
|        }
|        $marker = [string]$x.EnumerationResults.NextMarker
|    } while ($marker)
|    return $out.ToArray()
|}
|
|function Get-SIBlobContent {
|    <# Download one blob: the bytes, or -Destination writes them to a file (returns the path). -AllowMissing: a blob that
|       does not exist (404) returns $null -- no error is raised or logged (2026-10-23: the pipeline's poll of a run's
|       records marker logged a TerminatingError 404 every 30 s, hiding the real errors). #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Container, [Parameter(Mandatory)][string]$Blob, [string]$Destination, [switch]$AllowMissing)
|    $r = Invoke-SIStorageRequest -Method GET -Uri (Get-SIStorageUri -Account $Account -Path ("$Container/$Blob")) -AsBytes -AllowNotFound:$AllowMissing -What ("Download blob '{0}/{1}'" -f $Container, $Blob)
|    if ($AllowMissing -and $null -eq $r) { return $null }
|    # PLAIN statements, never `$bytes = if (...) { [byte[]]... }`: an `if` used as a value sends the array through the
|    # pipeline ONE BYTE AT A TIME into an object[] -- about 30 times the blob's size in memory. A new customer install
|    # 2026-10-12: the Azure collection's 13,562 assets made one large part, and reading it back ended in
|    # "System.OutOfMemoryException" on a job with 4 GiB and again with 8 GiB.
|    $bytes = $r.Bytes
|    if ($null -eq $bytes) { $bytes = [byte[]]::new(0) }
|    if (-not $Destination) { return ,$bytes }
|    [System.IO.File]::WriteAllBytes($Destination, $bytes)
|    return $Destination
|}
|
|function Set-SIBlobContent {
|    <# Upload one block blob (create or overwrite) from -File or -Bytes. -IfMatchETag makes it conditional (412 when
|       another writer got there first); -IfNoneMatch creates it only when it does not exist yet (409 / 412 when it does --
|       a claim exactly one writer wins). Returns the new ETag. #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Container, [Parameter(Mandatory)][string]$Blob,
|          [string]$File, [byte[]]$Bytes, [string]$IfMatchETag, [string]$ContentType = 'application/octet-stream', [switch]$IfNoneMatch)
|    if ($File) { $Bytes = [System.IO.File]::ReadAllBytes($File) }
|    if ($null -eq $Bytes) { $Bytes = [byte[]]@() }
|    $h = @{ 'x-ms-blob-type' = 'BlockBlob' }
|    if ($IfMatchETag) { $h['If-Match'] = $IfMatchETag }
|    if ($IfNoneMatch) { $h['If-None-Match'] = '*' }
|    $r = Invoke-SIStorageRequest -Method PUT -Uri (Get-SIStorageUri -Account $Account -Path ("$Container/$Blob")) -Body $Bytes -ContentType $ContentType -Headers $h -What ("Upload blob '{0}/{1}'" -f $Container, $Blob)
|    return [string]$r.Headers['ETag']
|}
|
|function Remove-SIBlob {
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Container, [Parameter(Mandatory)][string]$Blob)
|    $null = Invoke-SIStorageRequest -Method DELETE -Uri (Get-SIStorageUri -Account $Account -Path ("$Container/$Blob")) -AllowNotFound -What ("Delete blob '{0}/{1}'" -f $Container, $Blob)
|}
|
|function Test-SIBlobContainer {
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Container)
|    $r = Invoke-SIStorageRequest -Method HEAD -Uri (Get-SIStorageUri -Account $Account -Path $Container -Query 'restype=container') -AllowNotFound -What ("Container '{0}'" -f $Container)
|    if (-not $r) { return $null }
|    return [pscustomobject]@{ Name = $Container; LastModified = (ConvertTo-SIStorageDate $r.Headers['Last-Modified']); ETag = [string]$r.Headers['ETag'] }
|}
|
|function New-SIBlobContainer {
|    <# Create a private container; an existing one is not an error. #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Container)
|    $null = Invoke-SIStorageRequest -Method PUT -Uri (Get-SIStorageUri -Account $Account -Path $Container -Query 'restype=container') -AllowStatus @(409) -What ("Create container '{0}'" -f $Container)
|    return [pscustomobject]@{ Name = $Container }
|}
|
|function Test-SIQueue {
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Queue)
|    $r = Invoke-SIStorageRequest -Method GET -Uri (Get-SIStorageUri -Account $Account -Service queue -Path $Queue -Query 'comp=metadata') -AllowNotFound -What ("Queue '{0}'" -f $Queue)
|    return [bool]$r
|}
|
|function New-SIQueue {
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Queue)
|    $null = Invoke-SIStorageRequest -Method PUT -Uri (Get-SIStorageUri -Account $Account -Service queue -Path $Queue) -AllowStatus @(409) -What ("Create queue '{0}'" -f $Queue)
|}
|
|function Send-SIQueueMessage {
|    <# Put one message. The text is sent as-is (XML-escaped), the encoding the Az.Storage 9 queue client uses. #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Queue, [Parameter(Mandatory)][AllowEmptyString()][string]$Text)
|    $body = '<QueueMessage><MessageText>{0}</MessageText></QueueMessage>' -f [System.Security.SecurityElement]::Escape($Text)
|    $r = Invoke-SIStorageRequest -Method POST -Uri (Get-SIStorageUri -Account $Account -Service queue -Path ("$Queue/messages")) -Body $body -ContentType 'application/xml' -What ("Send to queue '{0}'" -f $Queue)
|    $x = [xml]($r.Content -replace '^\uFEFF', '')
|    return [pscustomobject]@{ MessageId = [string]$x.QueueMessagesList.QueueMessage.MessageId; PopReceipt = [string]$x.QueueMessagesList.QueueMessage.PopReceipt }
|}
|
|function Receive-SIQueueMessage {
|    <# Lease one message for -VisibilityTimeoutSeconds: @{ MessageId; PopReceipt; MessageText; DequeueCount } or $null
|       when the queue is empty. #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Queue, [int]$VisibilityTimeoutSeconds = 30)
|    $q = 'numofmessages=1&visibilitytimeout={0}' -f $VisibilityTimeoutSeconds
|    $r = Invoke-SIStorageRequest -Method GET -Uri (Get-SIStorageUri -Account $Account -Service queue -Path ("$Queue/messages") -Query $q) -Headers @{ Accept = 'application/xml' } -What ("Receive from queue '{0}'" -f $Queue)
|    $x = [xml]($r.Content -replace '^\uFEFF', '')
|    $m = @($x.QueueMessagesList.QueueMessage) | Where-Object { $_ } | Select-Object -First 1
|    if (-not $m) { return $null }
|    return [pscustomobject]@{ MessageId = [string]$m.MessageId; PopReceipt = [string]$m.PopReceipt; MessageText = [string]$m.MessageText; DequeueCount = [int]$m.DequeueCount }
|}
|
|function Update-SIQueueMessage {
|    <#
|        RENEW the hold on one leased message: its visibility timeout is set to -VisibilityTimeoutSeconds from now (Update
|        Message). The message text goes back unchanged (-Text: as it was received). NEVER THROWS -- the answer says which:
|          @{ Ok = $true;  PopReceipt = <the NEW receipt: the old one is no longer valid> }
|          @{ Ok = $false; Lost = $true;  Why }   the message is gone (404) or another worker holds it (400 PopReceiptMismatch)
|          @{ Ok = $false; Lost = $false; Why }   anything else (network, sign-in, a 5xx): not known -- try again
|        Short timeouts and two attempts: this is called from a heartbeat, which must not hang on one request.
|        -Auth: the identity to sign in as (a second thread has no sign-in of its own; Resolve-SIAzRestAuth's answer).
|    #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Queue, [Parameter(Mandatory)][string]$MessageId, [Parameter(Mandatory)][string]$PopReceipt,
|          [Parameter(Mandatory)][int]$VisibilityTimeoutSeconds, [AllowEmptyString()][string]$Text = '', [hashtable]$Auth, [int]$TimeoutSec = 30)
|    try {
|        $q = 'popreceipt={0}&visibilitytimeout={1}' -f [uri]::EscapeDataString($PopReceipt), $VisibilityTimeoutSeconds
|        $body = '<QueueMessage><MessageText>{0}</MessageText></QueueMessage>' -f [System.Security.SecurityElement]::Escape($Text)
|        $h = @{ 'x-ms-version' = (Get-SIStorageApiVersion); 'x-ms-date' = [datetime]::UtcNow.ToString('R') }
|        $r = Invoke-SIAzRestRequest -Method PUT -Uri (Get-SIStorageUri -Account $Account -Service queue -Path ("$Queue/messages/$MessageId") -Query $q) -Audience Storage -Body $body `
|                -ContentType 'application/xml' -Headers $h -AllowStatus @(400, 404) -TimeoutSec $TimeoutSec -MaxAttempts 2 -Auth $Auth -What ("Renew the hold on a message of queue '{0}'" -f $Queue)
|        $code = 0; try { $code = [int]$r.StatusCode } catch { }
|        if ($code -ge 200 -and $code -lt 300) {
|            $new = [string]$r.Headers['x-ms-popreceipt']
|            if (-not $new) { return [pscustomobject]@{ Ok = $false; Lost = $false; PopReceipt = $PopReceipt; Why = 'the queue answered without a new receipt' } }
|            return [pscustomobject]@{ Ok = $true; Lost = $false; PopReceipt = $new; Why = '' }
|        }
|        if ($code -eq 404) { return [pscustomobject]@{ Ok = $false; Lost = $true; PopReceipt = $PopReceipt; Why = 'the message is no longer in the queue' } }
|        $said = [string]$r.Content; try { if ($r.Headers -and $r.Headers['x-ms-error-code']) { $said += ' ' + [string]$r.Headers['x-ms-error-code'] } } catch { }
|        if ($code -eq 400 -and $said -match '(?i)PopReceiptMismatch|MessageNotFound') { return [pscustomobject]@{ Ok = $false; Lost = $true; PopReceipt = $PopReceipt; Why = 'another worker holds the message now' } }
|        return [pscustomobject]@{ Ok = $false; Lost = $false; PopReceipt = $PopReceipt; Why = ('HTTP {0}: {1}' -f $code, (([string]$r.Content -replace '\s+', ' ').Trim() -replace '^(.{200}).*$', '$1...')) }
|    } catch {
|        return [pscustomobject]@{ Ok = $false; Lost = $false; PopReceipt = $PopReceipt; Why = [string]$_.Exception.Message }
|    }
|}
|
|function Remove-SIQueueMessage {
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Queue, [Parameter(Mandatory)][string]$MessageId, [Parameter(Mandatory)][string]$PopReceipt)
|    $q = 'popreceipt=' + [uri]::EscapeDataString($PopReceipt)
|    $null = Invoke-SIStorageRequest -Method DELETE -Uri (Get-SIStorageUri -Account $Account -Service queue -Path ("$Queue/messages/$MessageId") -Query $q) -AllowNotFound -What ("Delete from queue '{0}'" -f $Queue)
|}
|
|function Get-SITableEntity {
|    <# One table entity (PartitionKey + RowKey) or $null; without -RowKey, every entity of the partition (following the
|       continuation headers). #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Table, [Parameter(Mandatory)][string]$PartitionKey, [string]$RowKey)
|    $h = @{ Accept = 'application/json;odata=nometadata' }
|    $esc = { param($s) ([string]$s).Replace("'", "''") }
|    if ($RowKey) {
|        $path = "{0}(PartitionKey='{1}',RowKey='{2}')" -f $Table, [uri]::EscapeDataString((& $esc $PartitionKey)), [uri]::EscapeDataString((& $esc $RowKey))
|        $r = Invoke-SIStorageRequest -Method GET -Uri ('https://{0}.table.core.windows.net/{1}' -f $Account, $path) -Headers $h -ContentType 'application/json' -AllowNotFound -What ("Table '{0}' entity" -f $Table)
|        if (-not $r) { return $null }
|        return ($r.Content | ConvertFrom-Json)
|    }
|    $out = [System.Collections.Generic.List[object]]::new()
|    $filter = [uri]::EscapeDataString(("PartitionKey eq '{0}'" -f (& $esc $PartitionKey)))
|    $np = $null; $nr = $null
|    do {
|        $q = '$filter=' + $filter
|        if ($np) { $q += '&NextPartitionKey=' + [uri]::EscapeDataString($np) }
|        if ($nr) { $q += '&NextRowKey=' + [uri]::EscapeDataString($nr) }
|        $r = Invoke-SIStorageRequest -Method GET -Uri ('https://{0}.table.core.windows.net/{1}()?{2}' -f $Account, $Table, $q) -Headers $h -ContentType 'application/json' -What ("Table '{0}' query" -f $Table)
|        foreach ($e in @(($r.Content | ConvertFrom-Json).value)) { if ($e) { [void]$out.Add($e) } }
|        $np = [string]$r.Headers['x-ms-continuation-NextPartitionKey']; $nr = [string]$r.Headers['x-ms-continuation-NextRowKey']
|    } while ($np)
|    return $out.ToArray()
|}
|
|function Set-SITableEntity {
|    <# UPSERT one entity (Insert Or Replace; -Merge = Insert Or Merge). -Entity is a hashtable of properties. #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Table, [Parameter(Mandatory)][string]$PartitionKey,
|          [Parameter(Mandatory)][string]$RowKey, [hashtable]$Entity = @{}, [switch]$Merge)
|    $e = [ordered]@{ PartitionKey = $PartitionKey; RowKey = $RowKey }
|    foreach ($k in $Entity.Keys) { if ($k -notin 'PartitionKey', 'RowKey') { $e[$k] = $Entity[$k] } }
|    $esc = { param($s) ([string]$s).Replace("'", "''") }
|    $path = "{0}(PartitionKey='{1}',RowKey='{2}')" -f $Table, [uri]::EscapeDataString((& $esc $PartitionKey)), [uri]::EscapeDataString((& $esc $RowKey))
|    $bytes = [System.Text.Encoding]::UTF8.GetBytes(($e | ConvertTo-Json -Depth 5 -Compress))
|    $null = Invoke-SIStorageRequest -Method $(if ($Merge) { 'MERGE' } else { 'PUT' }) -Uri ('https://{0}.table.core.windows.net/{1}' -f $Account, $path) -Body $bytes `
|                -ContentType 'application/json' -Headers @{ Accept = 'application/json;odata=nometadata' } -What ("Table '{0}' upsert" -f $Table)
|}
|
|# =====================================================================================================================
|#  The wrappers -- each forwards to its REST twin below
|# =====================================================================================================================
|# Each declares the parameters SecurityInsight's call sites use, UNTYPED except switches, and forwards @PSBoundParameters
|# -- never @args (measured: @args splits -Name:$value into a switch plus a positional value).
|function Connect-SIAzAccount {
|    [CmdletBinding()]
|    param([switch]$Identity, $AccountId, [switch]$ServicePrincipal, $ApplicationId, $CertificateThumbprint,
|          $CertificatePath, $CertificatePassword, $Credential,
|          [Alias('TenantId')]$Tenant, [Alias('SubscriptionId')]$Subscription, $Scope)
|    return (Connect-SIAzAccountRest @PSBoundParameters)
|}
|function Disconnect-SIAzAccount {
|    [CmdletBinding()] param($Scope)
|    return (Disconnect-SIAzAccountRest @PSBoundParameters)
|}
|function Disable-SIAzContextAutosave {
|    [CmdletBinding()] param($Scope)
|    return (Disable-SIAzContextAutosaveRest @PSBoundParameters)
|}
|function Get-SIAzContext {
|    [CmdletBinding()] param()
|    return (Get-SIAzContextRest @PSBoundParameters)
|}
|function Set-SIAzContext {
|    [CmdletBinding()]
|    param([Alias('SubscriptionId', 'SubscriptionName')]$Subscription, [Alias('TenantId', 'Domain')]$Tenant, $Context, $Scope)
|    return (Set-SIAzContextRest @PSBoundParameters)
|}
|function Get-SIAzAccessToken {
|    [CmdletBinding()] param($ResourceUrl, $TenantId)
|    return (Get-SIAzAccessTokenRest @PSBoundParameters)
|}
|function Get-SIAzSubscription {
|    [CmdletBinding()] param($TenantId, $SubscriptionId)
|    return (Get-SIAzSubscriptionRest @PSBoundParameters)
|}
|function Invoke-SIAzRestMethod {
|    [CmdletBinding()] param($Path, $Method, $Payload)
|    return (Invoke-SIAzRestMethodRest @PSBoundParameters)
|}
|function Invoke-SIAzOperationalInsightsQuery {
|    # -AllowPartial: the caller reads .Error itself (Invoke-SILaQuery refuses a cut answer otherwise); -OnPage / -PageBytes:
|    # the rows a page at a time (Invoke-SILaQuery)
|    [CmdletBinding()] param($WorkspaceId, $Query, $Wait, $Timespan, [switch]$AllowPartial, [scriptblock]$OnPage, [long]$PageBytes)
|    return (Invoke-SIAzOperationalInsightsQueryRest @PSBoundParameters)
|}
|function Get-SIAzOperationalInsightsWorkspace {
|    [CmdletBinding()] param($ResourceGroupName, $Name)
|    return (Get-SIAzOperationalInsightsWorkspaceRest @PSBoundParameters)
|}
|function New-SIAzOperationalInsightsWorkspace {
|    [CmdletBinding()] param($ResourceGroupName, $Name, $Location, $Sku, $RetentionInDays)
|    return (New-SIAzOperationalInsightsWorkspaceRest @PSBoundParameters)
|}
|function Search-SIAzGraph {
|    [CmdletBinding()] param($Query, $First, $Skip, $Subscription, $ManagementGroup, $SkipToken)
|    return ,(Search-SIAzGraphRest @PSBoundParameters)   # one page object, not its rows
|}
|function Get-SIAzKeyVaultSecret {
|    [CmdletBinding()] param($VaultName, $Name, [switch]$AsPlainText)
|    return (Get-SIAzKeyVaultSecretRest @PSBoundParameters)
|}
|function Set-SIAzKeyVaultSecret {
|    [CmdletBinding()] param($VaultName, $Name, $SecretValue, $ContentType)
|    return (Set-SIAzKeyVaultSecretRest @PSBoundParameters)
|}
|function Get-SIAzResourceGroup {
|    [CmdletBinding()] param($Name)
|    return (Get-SIAzResourceGroupRest @PSBoundParameters)
|}
|function New-SIAzResourceGroup {
|    [CmdletBinding()] param($Name, $Location, $Tag)
|    return (New-SIAzResourceGroupRest @PSBoundParameters)
|}
|function Get-SIAzRoleAssignment {
|    [CmdletBinding()] param($ObjectId, $Scope, $RoleDefinitionName)
|    return (Get-SIAzRoleAssignmentRest @PSBoundParameters)
|}
|function New-SIAzRoleAssignment {
|    [CmdletBinding()] param($ObjectId, $Scope, $RoleDefinitionName, $Description)
|    return (New-SIAzRoleAssignmentRest @PSBoundParameters)
|}
|function Get-SIAzRoleDefinition {
|    [CmdletBinding()] param([switch]$Custom, $Name, $Scope)
|    return (Get-SIAzRoleDefinitionRest @PSBoundParameters)
|}
|function Get-SIAzTag {
|    [CmdletBinding()] param($ResourceId)
|    return (Get-SIAzTagRest @PSBoundParameters)
|}
|function Update-SIAzTag {
|    [CmdletBinding()] param($ResourceId, $Tag, $Operation)
|    return (Update-SIAzTagRest @PSBoundParameters)
|}
|function Get-SIAzADServicePrincipal {
|    [CmdletBinding()] param($ApplicationId, $ObjectId)
|    return (Get-SIAzADServicePrincipalRest @PSBoundParameters)
|}
|function Get-SIAzDataCollectionEndpoint {
|    [CmdletBinding()] param($Name, $ResourceGroupName)
|    return (Get-SIAzDataCollectionEndpointRest @PSBoundParameters)
|}
|function New-SIAzDataCollectionEndpoint {
|    [CmdletBinding()] param($Name, $ResourceGroupName, $Location, $NetworkAclsPublicNetworkAccess)
|    return (New-SIAzDataCollectionEndpointRest @PSBoundParameters)
|}
|function Get-SIAzDataCollectionRule {
|    [CmdletBinding()] param($Name, $ResourceGroupName)
|    return (Get-SIAzDataCollectionRuleRest @PSBoundParameters)
|}
|function New-SIAzStorageContext {
|    [CmdletBinding()] param($StorageAccountName, [switch]$UseConnectedAccount)
|    return (New-SIAzStorageContextRest @PSBoundParameters)
|}
|function Get-SIAzStorageAccount {
|    [CmdletBinding()] param($ResourceGroupName, $Name)
|    return (Get-SIAzStorageAccountRest @PSBoundParameters)
|}
|function New-SIAzStorageAccount {
|    [CmdletBinding()]
|    param($ResourceGroupName, $Name, $Location, $SkuName, $Kind, $EnableHttpsTrafficOnly,
|          $MinimumTlsVersion, $AllowBlobPublicAccess, $PublicNetworkAccess)
|    return (New-SIAzStorageAccountRest @PSBoundParameters)
|}
|function Get-SIAzStorageContainer {
|    [CmdletBinding()] param($Name, $Context)
|    return (Get-SIAzStorageContainerRest @PSBoundParameters)
|}
|function New-SIAzStorageContainer {
|    [CmdletBinding()] param($Name, $Context, $Permission)
|    return (New-SIAzStorageContainerRest @PSBoundParameters)
|}
|function Get-SIAzStorageBlob {
|    [CmdletBinding()] param($Container, $Blob, $Prefix, $Context)
|    return (Get-SIAzStorageBlobRest @PSBoundParameters)
|}
|function Get-SIAzStorageBlobContent {
|    [CmdletBinding()] param($Container, $Blob, $CloudBlob, $Destination, $Context, [switch]$Force)
|    return (Get-SIAzStorageBlobContentRest @PSBoundParameters)
|}
|function Set-SIAzStorageBlobContent {
|    [CmdletBinding()] param($File, $Container, $Blob, $Context, [switch]$Force)
|    return (Set-SIAzStorageBlobContentRest @PSBoundParameters)
|}
|function Remove-SIAzStorageBlob {
|    [CmdletBinding()] param($Container, $Blob, $Context, [switch]$Force)
|    return (Remove-SIAzStorageBlobRest @PSBoundParameters)
|}
|function Start-SIAzStorageBlobCopy {
|    [CmdletBinding()] param($SrcContainer, $SrcBlob, $DestContainer, $DestBlob, $Context, [switch]$Force)
|    return (Start-SIAzStorageBlobCopyRest @PSBoundParameters)
|}
|function Get-SIAzStorageQueue {
|    [CmdletBinding()] param($Name, $Context)
|    return (Get-SIAzStorageQueueRest @PSBoundParameters)
|}
|function New-SIAzStorageQueue {
|    [CmdletBinding()] param($Name, $Context)
|    return (New-SIAzStorageQueueRest @PSBoundParameters)
|}
|
|function Set-SIAzStorageBlobContentIfMatch {
|    <# The ledger's CONDITIONAL write (only when the blob still has -IfMatchETag): PUT with If-Match. A lost race fails
|       with '412 ConditionNotMet'. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$File, [Parameter(Mandatory)][string]$Container, [Parameter(Mandatory)][string]$Blob,
|          [Parameter(Mandatory)][object]$Context, [Parameter(Mandatory)][string]$IfMatchETag)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    $null = Set-SIBlobContent -Account $acct -Container $Container -Blob $Blob -File $File -IfMatchETag $IfMatchETag
|}
|# =====================================================================================================================
|#  The REST twins -- what each wrapper does with no Az module
|# =====================================================================================================================
|
|function Write-SIAzRestNotFound {
|    <# A lookup that found nothing, the way the Az cmdlet reports it: a NON-terminating error, so -ErrorAction
|       SilentlyContinue yields $null and -ErrorAction Stop throws. #>
|    param([Parameter(Mandatory)]$Cmdlet, [Parameter(Mandatory)][string]$Message, [string]$Target)
|    $er = New-Object System.Management.Automation.ErrorRecord((New-Object System.Exception($Message)), 'SIAzRestNotFound', [System.Management.Automation.ErrorCategory]::ObjectNotFound, $Target)
|    $Cmdlet.WriteError($er)
|}
|
|function Get-SIAzRestSubscriptionId {
|    <# The current subscription: Set-SIAzContext / Connect -Subscription, else the install's workspace subscription,
|       else the first enabled subscription the identity sees (what Connect-AzAccount selects). #>
|    param([switch]$NoLookup)
|    $st = Get-SIAzRestState
|    if ($st.SubscriptionId) { return [string]$st.SubscriptionId }
|    $s = [string](Get-SIAzRestValue 'SI_AzSubscriptionId')
|    if (-not $s -and [string](Get-SIAzRestValue 'SI_WorkspaceResourceId') -match '/subscriptions/([^/]+)/') { $s = $Matches[1] }
|    if (-not $s) { $s = [string](Get-SIAzRestValue 'SubscriptionId') }
|    # in an Invardia Support session, the first subscription the environment names
|    if (-not $s) { $sess = Get-SISupportSession; if ($sess -and $sess.SubscriptionId) { $s = [string]$sess.SubscriptionId } }
|    if (-not $s -and -not $NoLookup) {
|        try {
|            $first = @(Invoke-SIArm -Path '/subscriptions' -ApiVersion '2022-12-01' -List | Where-Object { [string]$_.state -eq 'Enabled' }) | Select-Object -First 1
|            if ($first) { $s = [string]$first.subscriptionId }
|        } catch { }
|    }
|    if ($s) { $st.SubscriptionId = $s }
|    return $s
|}
|
|function Get-SIAzRestTenantId {
|    $st = Get-SIAzRestState
|    if ($st.TenantId) { return [string]$st.TenantId }
|    $a = Resolve-SIAzRestAuth
|    $t = [string]$a.TenantId
|    if (-not $t) {
|        # a managed identity knows its tenant: read it from its own ARM token
|        try { $c = ConvertFrom-SIJwtPayload (Get-SIAzureToken -Audience Arm); if ($c) { $t = [string]$c.tid } } catch { }
|    }
|    if ($t) { $st.TenantId = $t }
|    return $t
|}
|
|function Connect-SIAzAccountRest {
|    <# RECORDS the identity; no sign-in happens here (each REST call mints its token when it needs one). #>
|    [CmdletBinding()]
|    param([switch]$Identity, [string]$AccountId, [switch]$ServicePrincipal, [string]$ApplicationId, [string]$CertificateThumbprint,
|          [string]$CertificatePath, [securestring]$CertificatePassword, [pscredential]$Credential,
|          [Alias('TenantId')][string]$Tenant, [Alias('SubscriptionId')][string]$Subscription, [string]$Scope)
|    $st = Get-SIAzRestState
|    $conn = $null
|    if ($Identity) {
|        $cid = if ($AccountId) { $AccountId } else { [string](Get-SIAzRestValue 'SI_UAMI_ClientId', 'SI_ManagedIdentityClientId') }
|        $conn = @{ Mode = 'ManagedIdentity'; ClientId = $cid }
|    } elseif ($Credential) {
|        $conn = @{ Mode = 'Secret'; AppId = [string]$Credential.UserName; TenantId = $Tenant; Secret = $Credential.GetNetworkCredential().Password }
|    } elseif ($CertificateThumbprint -or $CertificatePath) {
|        $thumb = $CertificateThumbprint
|        if ($CertificatePath) {
|            # the PFX the container wrote: the token signer looks a certificate up by thumbprint in the X509 store, so
|            # it goes into CurrentUser\My (the only store a Linux container has) unless it is already there
|            $pw = if ($CertificatePassword) { [System.Net.NetworkCredential]::new('', $CertificatePassword).Password } else { '' }
|            $flags = [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable -bor [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::PersistKeySet
|            $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new([System.IO.File]::ReadAllBytes($CertificatePath), $pw, $flags)
|            $thumb = [string]$cert.Thumbprint
|            Initialize-SIAzRestHelpers
|            if (-not (Get-SICertificateFromStore -Thumbprint $thumb)) {
|                $store = New-Object System.Security.Cryptography.X509Certificates.X509Store('My', 'CurrentUser')
|                try { $store.Open('ReadWrite'); $store.Add($cert) } finally { $store.Close() }
|            }
|        }
|        $conn = @{ Mode = 'Certificate'; AppId = $ApplicationId; TenantId = $Tenant; Thumbprint = ($thumb -replace '\s', '') }
|    } else {
|        throw 'Connect-SIAzAccount (REST): name the identity -- -Identity, -Credential, or -ApplicationId with -CertificateThumbprint / -CertificatePath.'
|    }
|    $st.Connection = $conn
|    $st.TenantId = if ($Tenant) { $Tenant } else { $null }
|    $st.SubscriptionId = if ($Subscription) { $Subscription } else { $null }
|    $st.Cache = @{}
|    return (Get-SIAzContextRest)
|}
|
|function Disconnect-SIAzAccountRest {
|    [CmdletBinding()] param([string]$Scope)
|    $st = Get-SIAzRestState
|    $st.Connection = $null; $st.SubscriptionId = $null; $st.TenantId = $null; $st.Cache = @{}
|    $rc = Get-Variable -Scope Global -Name SI_LogIngestRunCache -ValueOnly -ErrorAction Ignore
|    if ($rc -is [hashtable]) { $rc.Tokens = @{} }
|}
|
|function Disable-SIAzContextAutosaveRest { [CmdletBinding()] param([string]$Scope) }
|
|function Get-SIAzContextRest {
|    <# The context object the call sites read (Subscription.Id / .Name, Tenant.Id, Account.Id / .Type), or $null when
|       no identity is configured. #>
|    [CmdletBinding()] param()
|    try { $a = Resolve-SIAzRestAuth } catch { return $null }
|    $sub = Get-SIAzRestSubscriptionId
|    $tid = Get-SIAzRestTenantId
|    $acct = switch ($a.Mode) { 'ManagedIdentity' { [pscustomobject]@{ Id = $(if ($a.ClientId) { $a.ClientId } else { 'MSI' }); Type = 'ManagedService' } } default { [pscustomobject]@{ Id = $a.AppId; Type = 'ServicePrincipal' } } }
|    return [pscustomobject]@{
|        PSTypeName   = 'SI.AzRest.Context'
|        Name         = ('{0} ({1})' -f $sub, $acct.Id)
|        Account      = $acct
|        Subscription = $(if ($sub) { [pscustomobject]@{ Id = $sub; SubscriptionId = $sub; Name = $sub; TenantId = $tid; ExtendedProperties = @{} } } else { $null })
|        Tenant       = [pscustomobject]@{ Id = $tid; TenantId = $tid }
|        Environment  = [pscustomobject]@{ Name = 'AzureCloud' }
|    }
|}
|
|function Set-SIAzContextRest {
|    [CmdletBinding()]
|    param([Alias('SubscriptionId', 'SubscriptionName')][string]$Subscription, [Alias('TenantId', 'Domain')][string]$Tenant, [object]$Context, [string]$Scope)
|    $st = Get-SIAzRestState
|    if ($Context -and $Context.Subscription) { $Subscription = [string]$Context.Subscription.Id }
|    if ($Subscription) { $st.SubscriptionId = $Subscription }
|    if ($Tenant) { $st.TenantId = $Tenant }
|    return (Get-SIAzContextRest)
|}
|
|function Get-SIAzAccessTokenRest {
|    [CmdletBinding()] param([string]$ResourceUrl, [string]$TenantId)
|    $res = if ($ResourceUrl) { $ResourceUrl } else { 'https://management.azure.com/' }
|    $tok = Get-SIAzureToken -Resource $res
|    $c = ConvertFrom-SIJwtPayload $tok
|    $exp = [DateTimeOffset]::UtcNow.AddMinutes(45)
|    if ($c -and $c.exp) { try { $exp = [DateTimeOffset]::FromUnixTimeSeconds([long]$c.exp) } catch { } }
|    return [pscustomobject]@{ Token = $tok; ExpiresOn = $exp; Type = 'Bearer'; TenantId = $(if ($c) { [string]$c.tid } else { $null }); UserId = $(if ($c) { [string]$c.appid } else { $null }) }
|}
|
|function Get-SIAzSubscriptionRest {
|    [CmdletBinding()] param([string]$TenantId, [string]$SubscriptionId)
|    foreach ($s in @(Invoke-SIArm -Path '/subscriptions' -ApiVersion '2022-12-01' -List)) {
|        if ($TenantId -and [string]$s.tenantId -and [string]$s.tenantId -ne $TenantId) { continue }
|        if ($SubscriptionId -and [string]$s.subscriptionId -ne $SubscriptionId) { continue }
|        [pscustomobject]@{ Id = [string]$s.subscriptionId; SubscriptionId = [string]$s.subscriptionId; Name = [string]$s.displayName; State = [string]$s.state; TenantId = [string]$s.tenantId; HomeTenantId = [string]$s.tenantId }
|    }
|}
|
|function Invoke-SIAzRestMethodRest {
|    <# As Invoke-AzRestMethod: never throws on an HTTP status; returns StatusCode / Content / Headers / Method. #>
|    [CmdletBinding()] param([string]$Path, [string]$Method = 'GET', [string]$Payload)
|    if (-not $Method) { $Method = 'GET' }
|    $uri = if ($Path -match '^https://') { $Path } else { 'https://management.azure.com' + $Path }
|    $body = if ($Payload) { $Payload } else { $null }
|    # #564: a POST action with no body sends '{}' (an empty JSON body was refused with HTTP 415)
|    if ($Method.ToUpperInvariant() -eq 'POST' -and $null -eq $body) { $body = '{}' }
|    # #548: inside an Invardia support session through the recording wrapper, never a raw token
|    if (Test-SISupportRequestRoute -Audience Arm) { $r = Invoke-SISupportHttp -Method $Method -Uri $uri -Body $body -ContentType 'application/json' -Audience Arm }
|    else {
|        $tok = Get-SIAzureToken -Audience Arm
|        $r = Invoke-SIAzRestHttp -Method $Method -Uri $uri -Headers @{ Authorization = ('Bearer ' + $tok) } -Body $body -ContentType 'application/json'
|    }
|    return [pscustomobject]@{ StatusCode = [int]$r.StatusCode; Content = [string]$r.Content; Headers = $r.Headers; Method = $Method.ToUpperInvariant() }
|}
|
|function Invoke-SIAzOperationalInsightsQueryRest {
|    [CmdletBinding()] param([string]$WorkspaceId, [string]$Query, [int]$Wait, [timespan]$Timespan, [switch]$AllowPartial, [scriptblock]$OnPage, [long]$PageBytes)
|    $p = @{ WorkspaceId = $WorkspaceId; Query = $Query }
|    if ($PSBoundParameters.ContainsKey('Wait')) { $p['Wait'] = $Wait }
|    if ($PSBoundParameters.ContainsKey('Timespan')) { $p['Timespan'] = $Timespan }
|    if ($AllowPartial) { $p['AllowPartial'] = $true }
|    if ($OnPage) { $p['OnPage'] = $OnPage }
|    if ($PSBoundParameters.ContainsKey('PageBytes') -and $PageBytes -gt 0) { $p['PageBytes'] = $PageBytes }
|    return (Invoke-SILaQuery @p)
|}
|
|function ConvertTo-SIAzWorkspaceObject {
|    param($Ws)
|    $cid = [guid]::Empty
|    [void][guid]::TryParse([string]$Ws.properties.customerId, [ref]$cid)
|    $rg = if ([string]$Ws.id -match '/resourceGroups/([^/]+)/') { $Matches[1] } else { $null }
|    [pscustomobject]@{
|        Name = [string]$Ws.name; ResourceId = [string]$Ws.id; ResourceGroupName = $rg; Location = [string]$Ws.location
|        CustomerId = $cid; Sku = [string]$Ws.properties.sku.name; RetentionInDays = $Ws.properties.retentionInDays
|        ProvisioningState = [string]$Ws.properties.provisioningState; Tags = $Ws.tags
|    }
|}
|
|function Get-SIAzOperationalInsightsWorkspaceRest {
|    [CmdletBinding()] param([string]$ResourceGroupName, [string]$Name)
|    $sub = Get-SIAzRestSubscriptionId
|    if ($ResourceGroupName -and $Name) {
|        $ws = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.OperationalInsights/workspaces/$Name") -ApiVersion '2022-10-01' -AllowNotFound
|        if (-not $ws) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The Log Analytics workspace '{0}' was not found in resource group '{1}'." -f $Name, $ResourceGroupName) -Target $Name; return }
|        return (ConvertTo-SIAzWorkspaceObject $ws)
|    }
|    $path = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.OperationalInsights/workspaces" } else { "/subscriptions/$sub/providers/Microsoft.OperationalInsights/workspaces" }
|    foreach ($w in @(Invoke-SIArm -Path $path -ApiVersion '2022-10-01' -List)) {
|        if ($Name -and [string]$w.name -ne $Name) { continue }
|        ConvertTo-SIAzWorkspaceObject $w
|    }
|}
|
|function New-SIAzOperationalInsightsWorkspaceRest {
|    [CmdletBinding()] param([string]$ResourceGroupName, [string]$Name, [string]$Location, [string]$Sku = 'PerGB2018', [int]$RetentionInDays = 30)
|    if (-not $Sku) { $Sku = 'PerGB2018' }
|    $sub = Get-SIAzRestSubscriptionId
|    $body = @{ location = $Location; properties = @{ sku = @{ name = $Sku } } }
|    if ($PSBoundParameters.ContainsKey('RetentionInDays')) { $body.properties['retentionInDays'] = $RetentionInDays }
|    $wsPath = "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.OperationalInsights/workspaces/$Name"
|    $ws = Invoke-SIArm -Method PUT -Path $wsPath -ApiVersion '2022-10-01' -Body $body
|    # the create is asynchronous (its answer can be empty, or a workspace still being made): wait until the workspace is
|    # THERE and provisioned -- its id and customer id are used right after this returns. Not ready in time = a clear stop.
|    $sleep = Get-Variable -Scope Global -Name SI_ArmBusySleep -ValueOnly -ErrorAction Ignore
|    $state = ''
|    for ($i = 0; $i -lt 60; $i++) {
|        $state = if ($ws -and $ws.properties) { [string]$ws.properties.provisioningState } else { '' }
|        if ($ws -and [string]$ws.id -and ($state -eq 'Succeeded' -or -not $state)) { return (ConvertTo-SIAzWorkspaceObject $ws) }
|        if ($state -in 'Failed', 'Canceled') { throw ("The Log Analytics workspace '{0}' was not created: Azure reports it {1} -- see the activity log of resource group '{2}' for its reason." -f $Name, $state, $ResourceGroupName) }
|        if ($sleep -is [scriptblock]) { & $sleep 5 } else { Start-Sleep -Seconds 5 }
|        $ws = Invoke-SIArm -Path $wsPath -ApiVersion '2022-10-01' -AllowNotFound
|    }
|    throw ("The Log Analytics workspace '{0}' is not ready 5 minutes after it was created (Azure shows: {1})." -f $Name, $(if ($state) { $state } else { 'not there yet' }))
|}
|
|function New-SIAzGraphPage {
|    <# A page shaped like Search-AzGraph's response: enumerates as the rows, with .Data and .SkipToken. #>
|    param([object[]]$Rows, [string]$SkipToken)
|    $list = [System.Collections.Generic.List[object]]::new()
|    foreach ($r in @($Rows)) { if ($null -ne $r) { [void]$list.Add($r) } }
|    Add-Member -InputObject $list -NotePropertyName Data -NotePropertyValue $list.ToArray() -Force
|    Add-Member -InputObject $list -NotePropertyName SkipToken -NotePropertyValue $(if ($SkipToken) { $SkipToken } else { $null }) -Force
|    return ,$list
|}
|
|function Search-SIAzGraphRest {
|    [CmdletBinding()] param([string]$Query, [int]$First = 100, [int]$Skip, [string[]]$Subscription, [string[]]$ManagementGroup, [string]$SkipToken)
|    if (-not $PSBoundParameters.ContainsKey('First') -or $First -le 0) { $First = 100 }
|    $page = Invoke-SIResourceGraphPage -Query $Query -Subscription $Subscription -ManagementGroup $ManagementGroup -First $First -Skip $Skip -SkipToken $SkipToken
|    $p = New-SIAzGraphPage -Rows $page.Data -SkipToken $page.SkipToken
|    return ,$p
|}
|
|function Get-SIAzKeyVaultSecretRest {
|    [CmdletBinding()] param([string]$VaultName, [string]$Name, [switch]$AsPlainText)
|    $j = Get-SIKeyVaultSecretRaw -VaultName $VaultName -Name $Name
|    if (-not $j) { return }
|    if ($AsPlainText) { return [string]$j.value }
|    $sec = New-Object System.Security.SecureString
|    foreach ($ch in ([string]$j.value).ToCharArray()) { $sec.AppendChar($ch) }
|    $sec.MakeReadOnly()
|    return [pscustomobject]@{ VaultName = $VaultName; Name = $Name; Id = [string]$j.id; SecretValue = $sec; ContentType = [string]$j.contentType; Enabled = $j.attributes.enabled; Tags = $j.tags }
|}
|
|function Set-SIAzKeyVaultSecretRest {
|    <# PUT secrets/{name}: a new version of the secret. -SecretValue is a SecureString (as for the cmdlet) or plain text. #>
|    [CmdletBinding()] param([string]$VaultName, [string]$Name, $SecretValue, [string]$ContentType)
|    $plain = if ($SecretValue -is [System.Security.SecureString]) { [System.Net.NetworkCredential]::new('', $SecretValue).Password } else { [string]$SecretValue }
|    $body = @{ value = $plain }
|    if ($ContentType) { $body.contentType = $ContentType }
|    $uri = 'https://{0}.vault.azure.net/secrets/{1}?api-version=7.4' -f $VaultName, [uri]::EscapeDataString($Name)
|    $r = Invoke-SIAzRestRequest -Method PUT -Uri $uri -Audience KeyVault -Body ($body | ConvertTo-Json -Compress) -What ("Key Vault secret '{0}' in '{1}'" -f $Name, $VaultName)
|    $j = $r.Content | ConvertFrom-Json
|    return [pscustomobject]@{ VaultName = $VaultName; Name = $Name; Id = [string]$j.id; ContentType = [string]$j.contentType; Enabled = $j.attributes.enabled }
|}
|
|function ConvertTo-SIAzResourceGroupObject {
|    param($Rg)
|    [pscustomobject]@{ ResourceGroupName = [string]$Rg.name; Location = [string]$Rg.location; ResourceId = [string]$Rg.id; ProvisioningState = [string]$Rg.properties.provisioningState; Tags = $Rg.tags }
|}
|
|function Get-SIAzResourceGroupRest {
|    [CmdletBinding()] param([string]$Name)
|    $sub = Get-SIAzRestSubscriptionId
|    if ($Name) {
|        $rg = Invoke-SIArm -Path ("/subscriptions/$sub/resourcegroups/$Name") -ApiVersion '2021-04-01' -AllowNotFound
|        if (-not $rg) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("Provided resource group '{0}' does not exist." -f $Name) -Target $Name; return }
|        return (ConvertTo-SIAzResourceGroupObject $rg)
|    }
|    foreach ($rg in @(Invoke-SIArm -Path ("/subscriptions/$sub/resourcegroups") -ApiVersion '2021-04-01' -List)) { ConvertTo-SIAzResourceGroupObject $rg }
|}
|
|function New-SIAzResourceGroupRest {
|    [CmdletBinding()] param([string]$Name, [string]$Location, [hashtable]$Tag)
|    $sub = Get-SIAzRestSubscriptionId
|    $body = @{ location = $Location }
|    if ($Tag) { $body['tags'] = $Tag }
|    $rg = Invoke-SIArm -Method PUT -Path ("/subscriptions/$sub/resourcegroups/$Name") -ApiVersion '2021-04-01' -Body $body
|    return (ConvertTo-SIAzResourceGroupObject $rg)
|}
|
|function Get-SIAzRestRoleDefinitions {
|    <# Role definitions visible at -Scope (built-in + custom), cached per scope for the run. #>
|    param([string]$Scope, [switch]$CustomOnly)
|    $st = Get-SIAzRestState
|    $key = 'roledefs|' + $Scope.ToLowerInvariant() + '|' + [string][bool]$CustomOnly
|    if ($st.Cache.ContainsKey($key)) { return $st.Cache[$key] }
|    $path = $Scope.TrimEnd('/') + '/providers/Microsoft.Authorization/roleDefinitions'
|    if ($CustomOnly) { $path += '?$filter=' + [uri]::EscapeDataString("type eq 'CustomRole'") }
|    $defs = @(Invoke-SIArm -Path $path -ApiVersion '2022-04-01' -List)
|    $st.Cache[$key] = $defs
|    return $defs
|}
|
|function Get-SIAzRestRoleDefinitionNames {
|    <#
|        The role NAME of every role definition visible at -Scope, by its id (lowercase): @{ <id> = <roleName> }. For the
|        role-assignment read, which needs only the name. Built-in roles are the same at every scope: they are read ONCE per
|        run and kept as names only; a scope's custom roles are read per scope, names only. The full definitions (every
|        permission of ~800 built-in roles) are never kept. customer B 2026-10-15: the identity producer read the role
|        assignments of 1,195 subscriptions and kept the WHOLE definition list of every one of them (Get-SIAzRestRoleDefinitions
|        caches per scope) -- the process ran out of memory in its sixth minute and every read after that failed.
|        -Fetch (tests): { param($Path) } -> the ARM rows of that list.
|    #>
|    param([Parameter(Mandatory)][string]$Scope, [scriptblock]$Fetch)
|    $st = Get-SIAzRestState
|    $read = { param($p) if ($Fetch) { @(& $Fetch $p) } else { @(Invoke-SIArm -Path $p -ApiVersion '2022-04-01' -List) } }
|    $base = $Scope.TrimEnd('/') + '/providers/Microsoft.Authorization/roleDefinitions?$filter='
|    $bk = 'roledefnames|builtin'
|    if (-not $st.Cache.ContainsKey($bk)) {
|        $m = @{}
|        foreach ($d in (& $read ($base + [uri]::EscapeDataString("type eq 'BuiltInRole'")))) { if ($d -and $d.name) { $m[([string]$d.name).ToLowerInvariant()] = [string]$d.properties.roleName } }
|        $st.Cache[$bk] = $m
|    }
|    $ck = 'roledefnames|custom|' + $Scope.ToLowerInvariant()
|    if (-not $st.Cache.ContainsKey($ck)) {
|        $m = @{}
|        foreach ($d in (& $read ($base + [uri]::EscapeDataString("type eq 'CustomRole'")))) { if ($d -and $d.name) { $m[([string]$d.name).ToLowerInvariant()] = [string]$d.properties.roleName } }
|        $st.Cache[$ck] = $m
|    }
|    [pscustomobject]@{ BuiltIn = $st.Cache[$bk]; Custom = $st.Cache[$ck] }
|}
|
|function ConvertTo-SIAzRoleDefinitionObject {
|    param($D)
|    $perm = @($D.properties.permissions) | Select-Object -First 1
|    [pscustomobject]@{
|        Name = [string]$D.properties.roleName; Id = [string]$D.name; IsCustom = ([string]$D.properties.type -eq 'CustomRole')
|        Description = [string]$D.properties.description
|        Actions = @($perm.actions); NotActions = @($perm.notActions); DataActions = @($perm.dataActions); NotDataActions = @($perm.notDataActions)
|        AssignableScopes = @($D.properties.assignableScopes)
|    }
|}
|
|function Get-SIAzRoleDefinitionRest {
|    [CmdletBinding()] param([switch]$Custom, [string]$Name, [string]$Scope)
|    if (-not $Scope) { $Scope = '/subscriptions/' + (Get-SIAzRestSubscriptionId) }
|    $out = @(Get-SIAzRestRoleDefinitions -Scope $Scope -CustomOnly:$Custom | ForEach-Object { ConvertTo-SIAzRoleDefinitionObject $_ })
|    if ($Name) { $out = @($out | Where-Object { $_.Name -eq $Name }) }
|    return $out
|}
|
|function Resolve-SIAzRestPrincipalNames {
|    <# DisplayName per object id, best effort (Microsoft Graph directoryObjects/getByIds). Empty on any failure: a name
|       is informational, never a reason to fail the read. #>
|    param([string[]]$Ids)
|    $map = @{}
|    $ids = @($Ids | Where-Object { $_ } | Select-Object -Unique)
|    for ($i = 0; $i -lt $ids.Count; $i += 1000) {
|        $chunk = @($ids[$i..([Math]::Min($i + 999, $ids.Count - 1))])
|        try {
|            $r = Invoke-SIAzRestRequest -Method POST -Uri 'https://graph.microsoft.com/v1.0/directoryObjects/getByIds' -Audience Graph `
|                     -Body (@{ ids = $chunk } | ConvertTo-Json -Compress) -What 'Microsoft Graph getByIds' -MaxAttempts 3
|            foreach ($o in @(($r.Content | ConvertFrom-Json).value)) { if ($o.id) { $map[[string]$o.id] = [string]$o.displayName } }
|        } catch { Write-Verbose ('principal names not resolved: {0}' -f $_.Exception.Message) }
|    }
|    return $map
|}
|
|function Get-SIAzRoleAssignmentRest {
|    [CmdletBinding()] param([string]$ObjectId, [string]$Scope, [string]$RoleDefinitionName)
|    $explicitScope = [bool]$Scope
|    if (-not $Scope) { $Scope = '/subscriptions/' + (Get-SIAzRestSubscriptionId) }
|    $path = $Scope.TrimEnd('/') + '/providers/Microsoft.Authorization/roleAssignments'
|    if ($ObjectId) { $path += '?$filter=' + [uri]::EscapeDataString(("principalId eq '{0}'" -f $ObjectId)) }
|    elseif ($explicitScope) { $path += '?$filter=' + [uri]::EscapeDataString('atScope()') }
|    $items = @(Invoke-SIArm -Path $path -ApiVersion '2022-04-01' -List)
|    $subScope = if ($Scope -match '^(/subscriptions/[^/]+)') { $Matches[1] } else { $Scope }
|    # names only, built-ins read once per run (Get-SIAzRestRoleDefinitionNames) -- never the whole definition list per scope
|    $defs = Get-SIAzRestRoleDefinitionNames -Scope $subScope
|    $names = Resolve-SIAzRestPrincipalNames -Ids @($items | ForEach-Object { [string]$_.properties.principalId })
|    foreach ($a in $items) {
|        $rdId = ([string]$a.properties.roleDefinitionId -split '/')[-1]
|        $rdKey = $rdId.ToLowerInvariant()
|        $rdName = if ($defs.BuiltIn.ContainsKey($rdKey)) { $defs.BuiltIn[$rdKey] } else { $defs.Custom[$rdKey] }
|        if ($RoleDefinitionName -and $rdName -ne $RoleDefinitionName) { continue }
|        $oid = [string]$a.properties.principalId
|        [pscustomobject]@{
|            RoleAssignmentId = [string]$a.id; RoleAssignmentName = [string]$a.name; Scope = [string]$a.properties.scope
|            DisplayName = $(if ($names.ContainsKey($oid)) { $names[$oid] } else { $null }); SignInName = $null
|            RoleDefinitionName = $rdName; RoleDefinitionId = $rdId; ObjectId = $oid; ObjectType = [string]$a.properties.principalType
|            CanDelegate = $false; Condition = $a.properties.condition; Description = [string]$a.properties.description
|        }
|    }
|}
|
|function New-SIAzRoleAssignmentRest {
|    # -Description (optional): stored on the assignment itself -- who gave it and why survives on Azure's side, so a later
|    # run can find an assignment it gave even when its own record of that is gone
|    [CmdletBinding()] param([string]$ObjectId, [string]$Scope, [string]$RoleDefinitionName, [string]$Description)
|    $subScope = if ($Scope -match '^(/subscriptions/[^/]+)') { $Matches[1] } else { $Scope }
|    $def = @(Get-SIAzRestRoleDefinitions -Scope $subScope | Where-Object { [string]$_.properties.roleName -eq $RoleDefinitionName }) | Select-Object -First 1
|    if (-not $def) { throw ("The role definition '{0}' was not found at scope '{1}'." -f $RoleDefinitionName, $subScope) }
|    $name = [guid]::NewGuid().ToString()
|    $body = @{ properties = @{ roleDefinitionId = [string]$def.id; principalId = $ObjectId } }
|    if ("$Description".Trim()) { $body.properties['description'] = "$Description".Trim() }
|    $a = Invoke-SIArm -Method PUT -Path ($Scope.TrimEnd('/') + '/providers/Microsoft.Authorization/roleAssignments/' + $name) -ApiVersion '2022-04-01' -Body $body
|    return [pscustomobject]@{ RoleAssignmentId = [string]$a.id; RoleAssignmentName = [string]$a.name; Scope = $Scope; RoleDefinitionName = $RoleDefinitionName; RoleDefinitionId = [string]$def.name; ObjectId = $ObjectId; ObjectType = [string]$a.properties.principalType }
|}
|
|function Get-SIAzTagRest {
|    [CmdletBinding()] param([string]$ResourceId)
|    $t = Invoke-SIArm -Path ($ResourceId.TrimEnd('/') + '/providers/Microsoft.Resources/tags/default') -ApiVersion '2021-04-01'
|    $h = @{}
|    if ($t -and $t.properties -and $t.properties.tags) { foreach ($p in $t.properties.tags.PSObject.Properties) { $h[$p.Name] = [string]$p.Value } }
|    return [pscustomobject]@{ Id = [string]$t.id; Name = 'default'; Properties = [pscustomobject]@{ TagsProperty = $h } }
|}
|
|function Update-SIAzTagRest {
|    [CmdletBinding()] param([string]$ResourceId, [hashtable]$Tag, [string]$Operation = 'Merge')
|    if (-not $Operation) { $Operation = 'Merge' }
|    $t = Invoke-SIArm -Method PATCH -Path ($ResourceId.TrimEnd('/') + '/providers/Microsoft.Resources/tags/default') -ApiVersion '2021-04-01' -Body @{ operation = $Operation; properties = @{ tags = $Tag } }
|    $h = @{}
|    if ($t -and $t.properties -and $t.properties.tags) { foreach ($p in $t.properties.tags.PSObject.Properties) { $h[$p.Name] = [string]$p.Value } }
|    return [pscustomobject]@{ Id = [string]$t.id; Name = 'default'; Properties = [pscustomobject]@{ TagsProperty = $h } }
|}
|
|function Get-SIAzADServicePrincipalRest {
|    [CmdletBinding()] param([string]$ApplicationId, [string]$ObjectId)
|    $uri = if ($ObjectId) { 'https://graph.microsoft.com/v1.0/servicePrincipals/{0}?$select=id,appId,displayName,servicePrincipalNames' -f $ObjectId }
|           else { 'https://graph.microsoft.com/v1.0/servicePrincipals?$filter={0}&$select=id,appId,displayName,servicePrincipalNames' -f [uri]::EscapeDataString(("appId eq '{0}'" -f $ApplicationId)) }
|    $r = Invoke-SIAzRestRequest -Method GET -Uri $uri -Audience Graph -AllowNotFound -What 'Microsoft Graph service principal'
|    if (-not $r) { return }
|    $j = $r.Content | ConvertFrom-Json
|    $items = if ($j.PSObject.Properties['value']) { @($j.value) } else { @($j) }
|    foreach ($s in $items) { if ($s) { [pscustomobject]@{ Id = [string]$s.id; AppId = [string]$s.appId; DisplayName = [string]$s.displayName; ServicePrincipalName = @($s.servicePrincipalNames) } } }
|}
|
|function ConvertTo-SIAzDceObject {
|    param($D)
|    [pscustomobject]@{
|        Name = [string]$D.name; Id = [string]$D.id; Location = [string]$D.location
|        LogIngestionEndpoint = [string]$D.properties.logsIngestion.endpoint; ConfigurationAccessEndpoint = [string]$D.properties.configurationAccess.endpoint
|        NetworkAclsPublicNetworkAccess = [string]$D.properties.networkAcls.publicNetworkAccess; ProvisioningState = [string]$D.properties.provisioningState
|    }
|}
|
|function Get-SIAzDataCollectionEndpointRest {
|    [CmdletBinding()] param([string]$Name, [string]$ResourceGroupName)
|    $sub = Get-SIAzRestSubscriptionId
|    if ($Name -and $ResourceGroupName) {
|        $d = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Insights/dataCollectionEndpoints/$Name") -ApiVersion '2022-06-01' -AllowNotFound
|        if (-not $d) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The data collection endpoint '{0}' was not found in resource group '{1}'." -f $Name, $ResourceGroupName) -Target $Name; return }
|        return (ConvertTo-SIAzDceObject $d)
|    }
|    $path = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Insights/dataCollectionEndpoints" } else { "/subscriptions/$sub/providers/Microsoft.Insights/dataCollectionEndpoints" }
|    foreach ($d in @(Invoke-SIArm -Path $path -ApiVersion '2022-06-01' -List)) { if (-not $Name -or [string]$d.name -eq $Name) { ConvertTo-SIAzDceObject $d } }
|}
|
|function New-SIAzDataCollectionEndpointRest {
|    [CmdletBinding()] param([string]$Name, [string]$ResourceGroupName, [string]$Location, [string]$NetworkAclsPublicNetworkAccess = 'Enabled')
|    if (-not $NetworkAclsPublicNetworkAccess) { $NetworkAclsPublicNetworkAccess = 'Enabled' }
|    $sub = Get-SIAzRestSubscriptionId
|    $d = Invoke-SIArm -Method PUT -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Insights/dataCollectionEndpoints/$Name") -ApiVersion '2022-06-01' `
|             -Body @{ location = $Location; properties = @{ networkAcls = @{ publicNetworkAccess = $NetworkAclsPublicNetworkAccess } } }
|    return (ConvertTo-SIAzDceObject $d)
|}
|
|function Get-SIAzDataCollectionRuleRest {
|    [CmdletBinding()] param([string]$Name, [string]$ResourceGroupName)
|    $sub = Get-SIAzRestSubscriptionId
|    $path = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Insights/dataCollectionRules" } else { "/subscriptions/$sub/providers/Microsoft.Insights/dataCollectionRules" }
|    foreach ($d in @(Invoke-SIArm -Path $path -ApiVersion '2022-06-01' -List)) {
|        if ($Name -and [string]$d.name -ne $Name) { continue }
|        [pscustomobject]@{ Name = [string]$d.name; Id = [string]$d.id; Location = [string]$d.location; ImmutableId = [string]$d.properties.immutableId; DataCollectionEndpointId = [string]$d.properties.dataCollectionEndpointId }
|    }
|}
|
|function New-SIAzStorageContextRest {
|    <# The storage "context" the REST path needs: the account name (and its endpoints). Every call
|       signs in with the run's identity (OAuth); there is no account-key form. #>
|    [CmdletBinding()] param([string]$StorageAccountName, [switch]$UseConnectedAccount)
|    return [pscustomobject]@{
|        PSTypeName = 'SI.AzRest.StorageContext'; SIRest = $true; StorageAccountName = $StorageAccountName
|        BlobEndPoint = ('https://{0}.blob.core.windows.net/' -f $StorageAccountName)
|        QueueEndPoint = ('https://{0}.queue.core.windows.net/' -f $StorageAccountName)
|        TableEndPoint = ('https://{0}.table.core.windows.net/' -f $StorageAccountName)
|    }
|}
|
|function Get-SIAzRestStorageAccountName {
|    param($Context)
|    if ($null -eq $Context) { throw 'No storage context was given.' }
|    $n = [string]$Context.StorageAccountName
|    if (-not $n) { throw 'The storage context does not name a storage account.' }
|    return $n
|}
|
|function ConvertTo-SIAzStorageAccountObject {
|    param($S)
|    $rg = if ([string]$S.id -match '/resourceGroups/([^/]+)/') { $Matches[1] } else { $null }
|    [pscustomobject]@{
|        StorageAccountName = [string]$S.name; ResourceGroupName = $rg; Id = [string]$S.id; Location = [string]$S.location
|        Kind = [string]$S.kind; Sku = $S.sku; PrimaryEndpoints = $S.properties.primaryEndpoints; ProvisioningState = [string]$S.properties.provisioningState
|        Context = (New-SIAzStorageContextRest -StorageAccountName ([string]$S.name) -UseConnectedAccount)
|    }
|}
|
|function Get-SIAzStorageAccountRest {
|    [CmdletBinding()] param([string]$ResourceGroupName, [string]$Name)
|    $sub = Get-SIAzRestSubscriptionId
|    if ($ResourceGroupName -and $Name) {
|        $s = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Storage/storageAccounts/$Name") -ApiVersion '2023-01-01' -AllowNotFound
|        if (-not $s) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The storage account '{0}' was not found in resource group '{1}'." -f $Name, $ResourceGroupName) -Target $Name; return }
|        return (ConvertTo-SIAzStorageAccountObject $s)
|    }
|    $path = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Storage/storageAccounts" } else { "/subscriptions/$sub/providers/Microsoft.Storage/storageAccounts" }
|    foreach ($s in @(Invoke-SIArm -Path $path -ApiVersion '2023-01-01' -List)) { if (-not $Name -or [string]$s.name -eq $Name) { ConvertTo-SIAzStorageAccountObject $s } }
|}
|
|function Get-SIStorageAccountCreateProperties {
|    <#
|        PURE. The properties EVERY storage account SecurityInsight creates gets: shared-key access OFF (no account key
|        and no key-signed SAS works -- a user-delegation SAS still does), Entra ID the default in the portal, HTTPS only,
|        TLS 1.2 at least, no public blob access. Every SecurityInsight host reaches its storage with its own identity
|        (Storage Blob / Queue / Table Data roles), so nothing needs a key. An EXISTING account is never changed here;
|        setup\Set-SIStorageSharedKey.ps1 -Disable switches one off after checking nothing still uses a key.
|    #>
|    return @{
|        supportsHttpsTrafficOnly     = $true
|        allowBlobPublicAccess        = $false
|        allowSharedKeyAccess         = $false
|        defaultToOAuthAuthentication = $true
|        minimumTlsVersion            = 'TLS1_2'
|    }
|}
|
|function New-SIAzStorageAccountRest {
|    [CmdletBinding()]
|    param([string]$ResourceGroupName, [string]$Name, [string]$Location, [string]$SkuName, [string]$Kind, [bool]$EnableHttpsTrafficOnly = $true,
|          [string]$MinimumTlsVersion, [bool]$AllowBlobPublicAccess = $false,
|          # #866 (a private install): 'Disabled' CREATES the account with no public access -- only its private endpoints
|          [ValidateSet('', 'Disabled')][string]$PublicNetworkAccess = '')
|    $sub = Get-SIAzRestSubscriptionId
|    # -EnableHttpsTrafficOnly / -MinimumTlsVersion / -AllowBlobPublicAccess keep the Az cmdlet's shape, but a NEW
|    # account is always created locked down (Get-SIStorageAccountCreateProperties): no caller can weaken it.
|    $props = Get-SIStorageAccountCreateProperties
|    if ($PublicNetworkAccess -eq 'Disabled') { $props['publicNetworkAccess'] = 'Disabled' }
|    $path = "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Storage/storageAccounts/$Name"
|    $null = Invoke-SIArm -Method PUT -Path $path -ApiVersion '2023-01-01' -Body @{ location = $Location; sku = @{ name = $SkuName }; kind = $Kind; properties = $props }
|    # the create is asynchronous: wait until the account is THERE AND PROVISIONED (10 minutes at most) -- what follows
|    # (its roles, its containers) is refused "operation in progress" on an account Azure is still making. A "not found"
|    # in between is "not yet"; an account that is not ready in time is a clear stop, never handed on as if it were.
|    $s = $null; $state = ''
|    $sleep = Get-Variable -Scope Global -Name SI_ArmBusySleep -ValueOnly -ErrorAction Ignore
|    for ($i = 0; $i -lt 120; $i++) {
|        $s = Invoke-SIArm -Path $path -ApiVersion '2023-01-01' -AllowNotFound
|        $state = if ($s -and $s.properties) { [string]$s.properties.provisioningState } else { '' }
|        if ($s -and ($state -eq 'Succeeded' -or -not $state)) { return (ConvertTo-SIAzStorageAccountObject $s) }
|        if ($state -in 'Failed', 'Canceled') { throw ("The storage account '{0}' was not created: Azure reports it {1} -- see the activity log of resource group '{2}' for its reason." -f $Name, $state, $ResourceGroupName) }
|        if ($sleep -is [scriptblock]) { & $sleep 5 } else { Start-Sleep -Seconds 5 }
|    }
|    if (-not $s) { throw ("The storage account '{0}' was requested but did not appear." -f $Name) }
|    throw ("The storage account '{0}' is not ready 10 minutes after it was created (Azure shows: {1})." -f $Name, $(if ($state) { $state } else { 'no state' }))
|}
|
|function Get-SIAzStorageContainerRest {
|    [CmdletBinding()] param([string]$Name, [object]$Context)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    $c = Test-SIBlobContainer -Account $acct -Container $Name
|    if (-not $c) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("Can not find the container '{0}' (ContainerNotFound)." -f $Name) -Target $Name; return }
|    return $c
|}
|
|function New-SIAzStorageContainerRest {
|    [CmdletBinding()] param([string]$Name, [object]$Context, [string]$Permission)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    return (New-SIBlobContainer -Account $acct -Container $Name)
|}
|
|function ConvertTo-SIAzBlobObject {
|    <# A blob shaped like Get-AzStorageBlob's: Name / Length / LastModified / ETag, and the ICloudBlob members the call
|       sites read (Name, Container.Name, Properties.ETag / LastModified / Length). #>
|    param($B, [string]$Account)
|    $cloud = [pscustomobject]@{
|        Name = $B.Name; SIAccount = $Account
|        Container = [pscustomobject]@{ Name = $B.Container }
|        Properties = [pscustomobject]@{ ETag = $B.ETag; LastModified = $B.LastModified; Length = $B.Length; ContentType = $B.ContentType }
|    }
|    [pscustomobject]@{ Name = $B.Name; Length = $B.Length; LastModified = $B.LastModified; ETag = $B.ETag; ContentType = $B.ContentType; BlobType = 'BlockBlob'; ICloudBlob = $cloud }
|}
|
|function Get-SIAzStorageBlobRest {
|    [CmdletBinding()] param([string]$Container, [string]$Blob, [string]$Prefix, [object]$Context)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    if ($Blob) {
|        $b = Get-SIBlobProperties -Account $acct -Container $Container -Blob $Blob
|        if (-not $b) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("Can not find blob '{0}' in container '{1}' (BlobNotFound)." -f $Blob, $Container) -Target $Blob; return }
|        return (ConvertTo-SIAzBlobObject $b $acct)
|    }
|    foreach ($b in @(Get-SIBlobList -Account $acct -Container $Container -Prefix $Prefix)) { ConvertTo-SIAzBlobObject $b $acct }
|}
|
|function Get-SIAzStorageBlobContentRest {
|    [CmdletBinding()] param([string]$Container, [string]$Blob, [object]$CloudBlob, [string]$Destination, [object]$Context, [switch]$Force)
|    if ($CloudBlob) { $Blob = [string]$CloudBlob.Name; $Container = [string]$CloudBlob.Container.Name }
|    $acct = if ($Context) { Get-SIAzRestStorageAccountName -Context $Context } else { [string]$CloudBlob.SIAccount }
|    $target = $Destination
|    if (-not $target) { $target = (Get-Location).Path }
|    if (Test-Path -LiteralPath $target -PathType Container) { $target = [System.IO.Path]::Combine($target, ($Blob -replace '/', [System.IO.Path]::DirectorySeparatorChar)) }
|    $dir = Split-Path -Parent $target
|    if ($dir -and -not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null }
|    $null = Get-SIBlobContent -Account $acct -Container $Container -Blob $Blob -Destination $target
|    $b = Get-SIBlobProperties -Account $acct -Container $Container -Blob $Blob
|    if ($b) { return (ConvertTo-SIAzBlobObject $b $acct) }
|}
|
|function Set-SIAzStorageBlobContentRest {
|    [CmdletBinding()] param([string]$File, [string]$Container, [string]$Blob, [object]$Context, [switch]$Force)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    if (-not $Blob) { $Blob = Split-Path -Leaf $File }
|    $etag = Set-SIBlobContent -Account $acct -Container $Container -Blob $Blob -File $File
|    $len = (Get-Item -LiteralPath $File).Length
|    return (ConvertTo-SIAzBlobObject ([pscustomobject]@{ Name = $Blob; Container = $Container; Length = $len; LastModified = [DateTimeOffset]::UtcNow; ETag = $etag; ContentType = 'application/octet-stream' }) $acct)
|}
|
|function Remove-SIAzStorageBlobRest {
|    [CmdletBinding()] param([string]$Container, [string]$Blob, [object]$Context, [switch]$Force)
|    Remove-SIBlob -Account (Get-SIAzRestStorageAccountName -Context $Context) -Container $Container -Blob $Blob
|}
|
|function Start-SIAzStorageBlobCopyRest {
|    <# A copy within the account: download and upload (the files SI copies are small exports), so no SAS and no
|       copy-source authorization is needed. #>
|    [CmdletBinding()] param([string]$SrcContainer, [string]$SrcBlob, [string]$DestContainer, [string]$DestBlob, [object]$Context, [switch]$Force)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    $bytes = Get-SIBlobContent -Account $acct -Container $SrcContainer -Blob $SrcBlob
|    $null = Set-SIBlobContent -Account $acct -Container $DestContainer -Blob $DestBlob -Bytes $bytes
|    return [pscustomobject]@{ Name = $DestBlob; Container = $DestContainer }
|}
|
|function New-SIAzQueueObject {
|    <# A queue shaped like Get-AzStorageQueue's: .QueueClient with SendMessage / ReceiveMessage / DeleteMessage, as the
|       worker queue calls them. #>
|    param([string]$Account, [string]$Name)
|    $client = [pscustomobject]@{ Name = $Name; SIAccount = $Account }
|    $client | Add-Member -MemberType ScriptMethod -Name SendMessage -Value { param($Text) Send-SIQueueMessage -Account $this.SIAccount -Queue $this.Name -Text ([string]$Text) }
|    $client | Add-Member -MemberType ScriptMethod -Name ReceiveMessage -Value {
|        param($VisibilityTimeout)
|        $secs = if ($VisibilityTimeout -is [timespan]) { [int]$VisibilityTimeout.TotalSeconds } elseif ($VisibilityTimeout) { [int]$VisibilityTimeout } else { 30 }
|        [pscustomobject]@{ Value = (Receive-SIQueueMessage -Account $this.SIAccount -Queue $this.Name -VisibilityTimeoutSeconds $secs) }
|    }
|    $client | Add-Member -MemberType ScriptMethod -Name DeleteMessage -Value { param($Id, $PopReceipt) Remove-SIQueueMessage -Account $this.SIAccount -Queue $this.Name -MessageId ([string]$Id) -PopReceipt ([string]$PopReceipt) }
|    return [pscustomobject]@{ Name = $Name; QueueClient = $client }
|}
|
|function Get-SIAzStorageQueueRest {
|    [CmdletBinding()] param([string]$Name, [object]$Context)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    if (-not (Test-SIQueue -Account $acct -Queue $Name)) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("Can not find queue '{0}' (QueueNotFound)." -f $Name) -Target $Name; return }
|    return (New-SIAzQueueObject -Account $acct -Name $Name)
|}
|
|function New-SIAzStorageQueueRest {
|    [CmdletBinding()] param([string]$Name, [object]$Context)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    New-SIQueue -Account $acct -Queue $Name
|    return (New-SIAzQueueObject -Account $acct -Name $Name)
|}
|
|# #639 lane 4: a read in parts when one answer cannot carry it (Read-SILaParts) -- for every reader of a large result.
|# Loaded LAST: it reads through this file's Invoke-SIAzOperationalInsightsQuery (and loads this file itself when it is
|# dot-sourced alone, guarded on Invoke-SIArm -- defined by now, so never twice).
|if (-not (Get-Command -Name Read-SILaParts -ErrorAction Ignore)) {
|    $__siLaParts = [System.IO.Path]::Combine($PSScriptRoot, 'SI-LaParts.ps1')
|    if ([System.IO.File]::Exists($__siLaParts)) { . $__siLaParts }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-LaStreamRead.ps1'] = @{ Sha256 = '76262967b7a09e5713b4687cf62f9267864ddcc0f3f11e678958f17226738511'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- A LOG ANALYTICS ANSWER READ AS IT ARRIVES, NEVER HELD WHOLE (Risk Analysis' lookups and answers;
|    owner rule "same method, all sizes; stream always").
|
|    The lean read (#639, SI-AzRest.ps1 ConvertFrom-SILaQueryRows) reads the answer's BYTES into one array of their full
|    length, parses them into a JsonDocument (an index of every token beside them), and only then builds the rows -- so
|    while a lookup is read the process holds the whole answer about three times (bytes + index + rows). A Risk Analysis
|    lookup at a large install is a tenant-sized answer (the identity CI lookup of a 153,000-user tenant: every key of every
|    identity), read in parts of up to the service's own answer limit; the large install's Risk Analysis job ran out of
|    memory on 2 CPU / 4 GiB (#730).
|
|    Here the response stream is read through a small buffer: each ROW is parsed when its bytes are in, turned into the row
|    object at once, and its bytes are let go. Only the rows are held -- the same rows the lean read builds: the same
|    columns in the same order, the same TEXT values (strings as sent, numbers in the service's own spelling, true / false,
|    null stays null, a nested value as its raw JSON text), the table named PrimaryResult else the first, the column list
|    (name / type) and the partial-error object. Compact rows (SI_LaCompactRows, Get-SILaCompactRowType) when the caller
|    asks for them, PSCustomObject rows otherwise.
|
|    pwsh 7 only (System.Text.Json's Utf8JsonReader, compiled once per process with Add-Type). Windows PowerShell, or a
|    process where the reader cannot be compiled: Get-SILaStreamReaderType answers $null and the caller keeps the lean read.
|
|    #836 (found 2026-10-20): NOTHING HERE LIVES ONLY IN THIS FILE'S SCRIPT SCOPE. A function reads $script: of its CALLER's
|    script, and in a container the entry point (container\Start-SIInContainer.ps1) dot-sources SI-AzRest.ps1 -> this file
|    in ITS scope while every engine runs as its own script and skips reloading it -- so a $script: source was $null there,
|    Add-Type failed, the failure was swallowed and no container engine ever streamed. The C# source comes from a FUNCTION
|    (Get-SILaStreamReaderSource), the compiled type is found by its name, and the state a run must share (the reader is off
|    and why, the last read's numbers) is $global:. The older read stays the fallback, but it is never silent: one plain line
|    on the run log says the older read is used and why (Write-SILaStreamFallback).
|#>
|
|function Get-SILaStreamReaderSource {
|    <# The reader's C# source. A FUNCTION, never a $script: variable (#836): callable from any script's scope. #>
|    @'
|using System;
|using System.Collections.Generic;
|using System.IO;
|using System.Management.Automation;
|using System.Reflection;
|using System.Text;
|using System.Text.Json;
|
|namespace SecurityInsight.LaStream
|{
|    public sealed class LaStreamAnswer
|    {
|        public object[] Rows { get; set; }
|        public string[] ColumnNames { get; set; }
|        public string[] ColumnTypes { get; set; }
|        public string ErrorJson { get; set; }
|        public long BytesRead { get; set; }
|        public int LargestBuffer { get; set; }
|        // with a page callback: the rows handed on and in how many pages (Rows is then empty)
|        public long RowsDelivered { get; set; }
|        public int Pages { get; set; }
|    }
|
|    // the caller's own page callback failed -- not a fault of the reader or of the answer
|    public sealed class LaStreamPageException : Exception
|    {
|        public LaStreamPageException(Exception inner) : base("the page callback failed: " + (inner == null ? "" : inner.Message), inner) { }
|    }
|
|    public static class LaStreamReader
|    {
|        // the rows handed on a page at a time: the table being handed on, the answer bytes of the rows waiting, the totals
|        private sealed class PageSink
|        {
|            public Action<object[]> On;
|            public long Limit;
|            public long Bytes;
|            public object Table;
|            public bool FromNonPrimary;
|            public long Rows;
|            public int Pages;
|        }
|
|        private static void Flush(PageSink sink, List<object> rows)
|        {
|            if (sink == null || rows == null || rows.Count == 0) { if (sink != null) sink.Bytes = 0; return; }
|            object[] page = rows.ToArray();
|            rows.Clear();
|            sink.Bytes = 0;
|            try { sink.On(page); }
|            catch (Exception e) { throw new LaStreamPageException(e); }
|            sink.Rows += page.Length;
|            sink.Pages++;
|        }
|
|        public static LaStreamAnswer Read(Stream stream, bool compact, Func<string[], ConstructorInfo> compactCtorFor, int bufferSize, Func<string[], string[], object> plainRowFor)
|        {
|            return Read(stream, compact, compactCtorFor, bufferSize, plainRowFor, null, 0);
|        }
|
|        // onPage: the primary table's rows are handed on a page at a time (about pageBytes of the answer each) and never
|        // collected; the answer's Rows is then empty, RowsDelivered / Pages say what was handed on
|        public static LaStreamAnswer Read(Stream stream, bool compact, Func<string[], ConstructorInfo> compactCtorFor, int bufferSize, Func<string[], string[], object> plainRowFor, Action<object[]> onPage, long pageBytes)
|        {
|            PageSink sink = onPage == null ? null : new PageSink { On = onPage, Limit = Math.Max(1024, pageBytes) };
|            return ReadCore(stream, compact, compactCtorFor, bufferSize, plainRowFor, sink);
|        }
|
|        private enum Ctx { Root, Tables, Table, Columns, Rows, Done }
|
|        private sealed class TableAcc
|        {
|            public int Index;
|            public string Name = "";
|            public List<string> Names = new List<string>();
|            public List<string> Types = new List<string>();
|            public bool ColumnsDone;
|            public bool Keep = true;
|            public ConstructorInfo Ctor;
|            public bool CtorAsked;
|            public Dictionary<string, string> Pool;
|            public List<object> Rows = new List<object>();
|            public List<string[]> Early;   // rows met before the column list (kept as values, built at the end)
|            public Func<string[], string[], object> Plain;   // names that differ only in case: the row is built as the lean read builds it
|            public bool PlainChecked;
|        }
|
|        private static LaStreamAnswer ReadCore(Stream stream, bool compact, Func<string[], ConstructorInfo> compactCtorFor, int bufferSize, Func<string[], string[], object> plainRowFor, PageSink sink)
|        {
|            if (stream == null) throw new ArgumentNullException("stream");
|            byte[] buf = new byte[Math.Max(1024, bufferSize)];
|            int filled = 0, start = 0;
|            bool final = false;
|            long total = 0;
|            int largest = buf.Length;
|            JsonReaderState state = new JsonReaderState();
|            var stack = new List<Ctx>();
|            string prop = null;
|            TableAcc cur = null, first = null, primary = null;
|            int tableCount = 0;
|            string errorJson = null;
|            bool bomChecked = false;
|
|            while (true)
|            {
|                // fill: keep what is not consumed, grow only when one unit does not fit
|                if (start > 0) { Buffer.BlockCopy(buf, start, buf, 0, filled - start); filled -= start; start = 0; }
|                if (!final)
|                {
|                    if (filled == buf.Length)
|                    {
|                        var bigger = new byte[buf.Length * 2]; Buffer.BlockCopy(buf, 0, bigger, 0, filled); buf = bigger;
|                        if (buf.Length > largest) largest = buf.Length;
|                    }
|                    int n = stream.Read(buf, filled, buf.Length - filled);
|                    if (n <= 0) final = true; else { filled += n; total += n; }
|                    if (!bomChecked && (filled >= 3 || final))
|                    {
|                        bomChecked = true;
|                        if (filled >= 3 && buf[0] == 0xEF && buf[1] == 0xBB && buf[2] == 0xBF) start = 3;
|                    }
|                    if (!final && filled < buf.Length && n > 0) continue;   // read until the buffer is full or the stream ends
|                }
|
|                var reader = new Utf8JsonReader(new ReadOnlySpan<byte>(buf, start, filled - start), final, state);
|                bool more = false;
|                while (true)
|                {
|                    JsonReaderState before = reader.CurrentState;
|                    long beforeAt = reader.BytesConsumed;
|                    if (!reader.Read()) { more = true; break; }
|                    JsonTokenType tt = reader.TokenType;
|                    Ctx ctx = stack.Count == 0 ? Ctx.Root : stack[stack.Count - 1];
|                    if (stack.Count == 0)
|                    {
|                        if (tt == JsonTokenType.StartObject) { stack.Add(Ctx.Root); continue; }
|                        throw new JsonException("the Log Analytics answer is not a JSON object");
|                    }
|                    if (tt == JsonTokenType.PropertyName) { prop = reader.GetString(); continue; }
|
|                    // a UNIT: a value that is read whole (a row, a column, the error, anything skipped) -- its bytes must all be
|                    // in the buffer; when they are not, everything goes back to before its first token and more is read
|                    bool container = (tt == JsonTokenType.StartObject || tt == JsonTokenType.StartArray);
|                    switch (ctx)
|                    {
|                        case Ctx.Root:
|                            if (tt == JsonTokenType.EndObject) { stack[stack.Count - 1] = Ctx.Done; continue; }
|                            if (prop == "tables" && tt == JsonTokenType.StartArray) { stack.Add(Ctx.Tables); prop = null; continue; }
|                            {
|                                int us = start + (int)reader.TokenStartIndex;
|                                if (container && !reader.TrySkip()) { state = before; start += (int)beforeAt; more = true; goto Refill; }
|                                int ue = start + (int)reader.BytesConsumed;
|                                if (prop == "error")
|                                {
|                                    errorJson = (tt == JsonTokenType.Null) ? null : Encoding.UTF8.GetString(buf, us, ue - us);
|                                }
|                                prop = null;
|                                continue;
|                            }
|                        case Ctx.Tables:
|                            if (tt == JsonTokenType.EndArray) { stack.RemoveAt(stack.Count - 1); continue; }
|                            if (tt == JsonTokenType.StartObject)
|                            {
|                                cur = new TableAcc { Index = tableCount++, Plain = plainRowFor };
|                                // a later table's rows are kept only while no PrimaryResult was found before it
|                                cur.Keep = (primary == null);
|                                if (compact) cur.Pool = new Dictionary<string, string>(StringComparer.Ordinal);
|                                stack.Add(Ctx.Table); prop = null; continue;
|                            }
|                            if (container && !reader.TrySkip()) { state = before; start += (int)beforeAt; more = true; goto Refill; }
|                            continue;
|                        case Ctx.Table:
|                            if (tt == JsonTokenType.EndObject)
|                            {
|                                stack.RemoveAt(stack.Count - 1);
|                                FinishTable(cur, compact, compactCtorFor);
|                                if (sink != null && object.ReferenceEquals(sink.Table, cur)) Flush(sink, cur.Rows);
|                                if (cur.Index == 0) first = cur;
|                                if (primary == null && cur.Name == "PrimaryResult") { primary = cur; if (first != null && first != cur) first.Rows = null; }
|                                else if (cur.Index != 0) cur.Rows = null;
|                                cur = null; prop = null; continue;
|                            }
|                            if (prop == "name" && !container)
|                            {
|                                cur.Name = (tt == JsonTokenType.String) ? (reader.GetString() ?? "") : "";
|                                prop = null; continue;
|                            }
|                            if (prop == "columns" && tt == JsonTokenType.StartArray) { stack.Add(Ctx.Columns); prop = null; continue; }
|                            if (prop == "rows" && tt == JsonTokenType.StartArray) { stack.Add(Ctx.Rows); prop = null; continue; }
|                            if (container && !reader.TrySkip()) { state = before; start += (int)beforeAt; more = true; goto Refill; }
|                            prop = null; continue;
|                        case Ctx.Columns:
|                            if (tt == JsonTokenType.EndArray) { stack.RemoveAt(stack.Count - 1); cur.ColumnsDone = true; continue; }
|                            {
|                                int us = start + (int)reader.TokenStartIndex;
|                                if (container && !reader.TrySkip()) { state = before; start += (int)beforeAt; more = true; goto Refill; }
|                                int ue = start + (int)reader.BytesConsumed;
|                                if (tt == JsonTokenType.StartObject) ReadColumn(buf, us, ue - us, cur);
|                                continue;
|                            }
|                        case Ctx.Rows:
|                            if (tt == JsonTokenType.EndArray) { stack.RemoveAt(stack.Count - 1); continue; }
|                            {
|                                int us = start + (int)reader.TokenStartIndex;
|                                if (container && !reader.TrySkip()) { state = before; start += (int)beforeAt; more = true; goto Refill; }
|                                int ue = start + (int)reader.BytesConsumed;
|                                if (tt == JsonTokenType.StartArray && cur.Keep)
|                                {
|                                    if (sink == null) AddRow(buf, us, ue - us, cur, compact, compactCtorFor);
|                                    else if (SinkTakes(sink, cur))
|                                    {
|                                        AddRow(buf, us, ue - us, cur, compact, compactCtorFor);
|                                        sink.Bytes += (ue - us);
|                                        if (sink.Bytes >= sink.Limit) Flush(sink, cur.Rows);
|                                    }
|                                }
|                                continue;
|                            }
|                        default:
|                            if (container && !reader.TrySkip()) { state = before; start += (int)beforeAt; more = true; goto Refill; }
|                            continue;
|                    }
|                }
|                state = reader.CurrentState;
|                start += (int)reader.BytesConsumed;
|            Refill:
|                if (final)
|                {
|                    if (stack.Count == 0 || stack[0] != Ctx.Done) throw new JsonException("the Log Analytics answer ended before it was complete");
|                    break;
|                }
|                if (!more) continue;
|            }
|
|            TableAcc pick = primary ?? first;
|            var ans = new LaStreamAnswer { ErrorJson = errorJson, BytesRead = total, LargestBuffer = largest };
|            if (sink != null) { ans.RowsDelivered = sink.Rows; ans.Pages = sink.Pages; }
|            if (pick != null)
|            {
|                ans.Rows = (pick.Rows == null || sink != null) ? new object[0] : pick.Rows.ToArray();
|                ans.ColumnNames = pick.Names.ToArray();
|                ans.ColumnTypes = pick.Types.ToArray();
|            }
|            else { ans.Rows = new object[0]; ans.ColumnNames = new string[0]; ans.ColumnTypes = new string[0]; }
|            return ans;
|        }
|
|        // with a page callback: does this table's row go to the pages? The table named PrimaryResult, else the first table --
|        // as the whole read picks it. A PrimaryResult that comes after another table's rows were handed on cannot be read in
|        // pages (those rows are gone): the read fails, never a wrong set handed on.
|        private static bool SinkTakes(PageSink sink, TableAcc cur)
|        {
|            if (object.ReferenceEquals(sink.Table, cur)) return true;
|            if (sink.Table == null)
|            {
|                if (cur.Name == "PrimaryResult" || cur.Index == 0) { sink.Table = cur; sink.FromNonPrimary = (cur.Name != "PrimaryResult"); return true; }
|                return false;
|            }
|            if (cur.Name == "PrimaryResult" && sink.FromNonPrimary)
|            {
|                if (sink.Rows > 0) throw new InvalidOperationException("the Log Analytics answer names its primary table after another table whose rows were already handed on -- it cannot be read in pages");
|                ((TableAcc)sink.Table).Rows.Clear();
|                sink.Table = cur; sink.FromNonPrimary = false; sink.Bytes = 0;
|                return true;
|            }
|            return false;
|        }
|
|        private static void ReadColumn(byte[] buf, int off, int len, TableAcc t)
|        {
|            var r = new Utf8JsonReader(new ReadOnlySpan<byte>(buf, off, len), true, new JsonReaderState());
|            r.Read();   // StartObject
|            string name = null, type = null; bool hasName = false;
|            while (r.Read())
|            {
|                if (r.TokenType == JsonTokenType.EndObject && r.CurrentDepth == 0) break;
|                if (r.TokenType != JsonTokenType.PropertyName) continue;
|                string p = r.GetString();
|                r.Read();
|                if (r.TokenType == JsonTokenType.StartObject || r.TokenType == JsonTokenType.StartArray) { r.Skip(); continue; }
|                if (p == "name") { name = (r.TokenType == JsonTokenType.String || r.TokenType == JsonTokenType.Null) ? r.GetString() : Encoding.UTF8.GetString(r.ValueSpan.ToArray()); hasName = true; }
|                else if (p == "type") { type = (r.TokenType == JsonTokenType.String || r.TokenType == JsonTokenType.Null) ? r.GetString() : Encoding.UTF8.GetString(r.ValueSpan.ToArray()); }
|            }
|            if (!hasName) throw new KeyNotFoundException("a column of the Log Analytics answer has no name");
|            t.Names.Add(name); t.Types.Add(type);
|        }
|
|        private static string[] ReadCells(byte[] buf, int off, int len, int nCols, Dictionary<string, string> pool)
|        {
|            var r = new Utf8JsonReader(new ReadOnlySpan<byte>(buf, off, len), true, new JsonReaderState());
|            r.Read();   // StartArray
|            var cells = nCols >= 0 ? new string[nCols] : null;
|            var open = nCols < 0 ? new List<string>() : null;
|            int i = 0;
|            while (r.Read())
|            {
|                if (r.TokenType == JsonTokenType.EndArray && r.CurrentDepth == 0) break;
|                string s;
|                switch (r.TokenType)
|                {
|                    case JsonTokenType.String: s = r.GetString(); break;
|                    case JsonTokenType.Null: s = null; break;
|                    case JsonTokenType.True: s = "true"; break;
|                    case JsonTokenType.False: s = "false"; break;
|                    case JsonTokenType.StartObject:
|                    case JsonTokenType.StartArray:
|                        {
|                            int ts = (int)r.TokenStartIndex;
|                            r.Skip();
|                            s = Encoding.UTF8.GetString(buf, off + ts, (int)r.BytesConsumed - ts);
|                            break;
|                        }
|                    default: s = Encoding.UTF8.GetString(r.ValueSpan.ToArray()); break;
|                }
|                if (s != null && pool != null && s.Length <= 32)
|                {
|                    string p0;
|                    if (pool.TryGetValue(s, out p0)) s = p0; else pool[s] = s;
|                }
|                if (open != null) open.Add(s);
|                else if (i < nCols) cells[i] = s;
|                i++;
|            }
|            return open != null ? open.ToArray() : cells;
|        }
|
|        private static object MakeRow(string[] cells, TableAcc t)
|        {
|            if (t.Ctor != null) return t.Ctor.Invoke(new object[] { cells });
|            if (!t.PlainChecked)
|            {
|                t.PlainChecked = true;
|                var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase); bool dup = false;
|                foreach (var nm in t.Names) { if (nm != null && !seen.Add(nm)) { dup = true; break; } }
|                if (!dup) t.Plain = null;
|            }
|            if (t.Plain != null) return t.Plain(t.Names.ToArray(), cells);
|            var o = new PSObject();
|            int n = t.Names.Count;
|            for (int i = 0; i < n; i++)
|            {
|                string v = i < cells.Length ? cells[i] : null;
|                var existing = o.Properties[t.Names[i]];
|                if (existing != null) existing.Value = v; else o.Properties.Add(new PSNoteProperty(t.Names[i], v));
|            }
|            return o;
|        }
|
|        private static void AddRow(byte[] buf, int off, int len, TableAcc t, bool compact, Func<string[], ConstructorInfo> compactCtorFor)
|        {
|            if (!t.ColumnsDone && t.Names.Count == 0)
|            {
|                if (t.Early == null) t.Early = new List<string[]>();
|                t.Early.Add(ReadCells(buf, off, len, -1, null));
|                return;
|            }
|            if (compact && !t.CtorAsked) { MakeRowPrepare(t, compactCtorFor); }
|            var cells = ReadCells(buf, off, len, t.Names.Count, t.Ctor != null ? t.Pool : null);
|            t.Rows.Add(MakeRow(cells, t));
|        }
|
|        private static void MakeRowPrepare(TableAcc t, Func<string[], ConstructorInfo> compactCtorFor)
|        {
|            // the compact type for these columns, asked once; none -> PSCustomObject rows without pooling, as the lean read
|            t.CtorAsked = true;
|            if (compactCtorFor != null) t.Ctor = compactCtorFor(t.Names.ToArray());
|            if (t.Ctor == null) t.Pool = null;
|        }
|
|        private static void FinishTable(TableAcc t, bool compact, Func<string[], ConstructorInfo> compactCtorFor)
|        {
|            if (t.Early == null) return;
|            if (!t.Keep) { t.Early = null; return; }
|            var built = new List<object>(t.Early.Count + t.Rows.Count);
|            if (compact && !t.CtorAsked) MakeRowPrepare(t, compactCtorFor);
|            int n = t.Names.Count;
|            foreach (var raw in t.Early)
|            {
|                var cells = new string[n];
|                for (int i = 0; i < n && i < raw.Length; i++) cells[i] = raw[i];
|                built.Add(MakeRow(cells, t));
|            }
|            built.AddRange(t.Rows);
|            t.Rows = built; t.Early = null;
|        }
|    }
|}
|'@
|}
|
|function Get-SILaStreamReaderType {
|    <# The compiled reader ([SecurityInsight.LaStream.LaStreamReader]), built once per process; $null where it cannot be
|       (Windows PowerShell, or a compile that fails -- the caller then keeps the lean read). Scope-independent (#836): the
|       compiled type is found by its NAME (a type is per process), the source comes from a function, and a compile that
|       failed is remembered for the whole process in $global:SI_LaStreamReaderOff (its reason) -- tried once, not per read. #>
|    if ($PSVersionTable.PSEdition -ne 'Core') { return $null }
|    # off for this process (it could not be built, or it failed on an answer -- Read-SILaQueryStreamSafe): the older read
|    if ($global:SI_LaStreamReaderOff) { return $null }
|    $t = 'SecurityInsight.LaStream.LaStreamReader' -as [type]
|    if ($null -ne $t) { return $t }
|    try {
|        $src = Get-SILaStreamReaderSource
|        if ([string]::IsNullOrWhiteSpace([string]$src)) { throw 'its source is empty' }
|        Add-Type -TypeDefinition $src -Language CSharp -ErrorAction Stop
|        $t = 'SecurityInsight.LaStream.LaStreamReader' -as [type]
|        if ($null -eq $t) { throw 'the compiled type was not found' }
|        return $t
|    } catch {
|        $global:SI_LaStreamReaderOff = 'the reader could not be built in this process: ' + (Get-SILaStreamShortReason $_.Exception.Message)
|        return $null
|    }
|}
|
|function Get-SILaStreamShortReason {
|    <# PURE. The first line of an error text, at most 300 characters (a compiler error lists every line it refused). #>
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    $s = ([string]$Text -split "`r?`n" | Where-Object { $_.Trim() } | Select-Object -First 1)
|    if (-not $s) { return 'no reason given' }
|    $s = $s.Trim()
|    if ($s.Length -gt 300) { $s = $s.Substring(0, 300) + ' ...' }
|    return $s
|}
|
|function Write-SILaStreamFallback {
|    <#
|        #836: the older read is used instead of the streaming one -- ONE plain line on the run log (the transcript) saying
|        so and why. -Once: said once per process for that reason (the reader cannot be built: every later read is the
|        older one too, and saying it per read would flood the log). Without -Once (one read whose stream failed and was
|        read again the older way) it is said every time it happens. The results are the same either way.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Reason, [switch]$Once)
|    if ([string]::IsNullOrWhiteSpace($Reason)) { $Reason = 'the streaming reader is not available in this process' }
|    if ($Once) {
|        if ($null -eq $global:SI_LaStreamFallbackSaid) { $global:SI_LaStreamFallbackSaid = @{} }
|        if ($global:SI_LaStreamFallbackSaid.ContainsKey($Reason)) { return }
|        $global:SI_LaStreamFallbackSaid[$Reason] = $true
|    }
|    Write-Host ('Log Analytics answers are read the older way (whole, then parsed) instead of as they arrive -- {0}. The rows are the same; the read uses more memory.' -f $Reason) -ForegroundColor DarkYellow
|}
|
|function Read-SILaQueryStreamSafe {
|    <#
|        #836: ConvertFrom-SILaQueryStream for Invoke-SILaQuery's -ReadStream -- DATA FIRST: a read that fails (the reader
|        throws, the answer is not valid JSON, the connection drops mid-answer) is NOT an error of the query: it answers a
|        marker (.SILaStreamFailed = why) and Invoke-SILaQuery reads the same query again the older way and says so in one
|        line. A failure that is not the network's (IOException / a socket error) turns streaming off for the rest of the
|        process ($global:SI_LaStreamReaderOff) so a reader fault never doubles every read.
|    #>
|    param([Parameter(Mandatory)][System.IO.Stream]$Stream, [switch]$Compact,
|          # the rows a page at a time (ConvertFrom-SILaQueryStream -OnPage); -PageState counts the pages handed on so far
|          [scriptblock]$OnPage, [long]$PageBytes = 4MB, [hashtable]$PageState)
|    try {
|        if ($OnPage) { return (ConvertFrom-SILaQueryStream -Stream $Stream -Compact:$Compact -OnPage $OnPage -PageBytes $PageBytes -PageState $PageState) }
|        return (ConvertFrom-SILaQueryStream -Stream $Stream -Compact:$Compact)
|    }
|    catch {
|        $ex = $_.Exception
|        # the CALLER's page callback failed (a page could not be stored): its own failure, passed on as it is -- never a
|        # reader fault, never read again
|        for ($e = $ex; $null -ne $e; $e = $e.InnerException) {
|            if ($e.GetType().FullName -eq 'SecurityInsight.LaStream.LaStreamPageException') {
|                $cause = $e.InnerException
|                while ($cause -is [System.Management.Automation.MethodInvocationException] -and $null -ne $cause.InnerException) { $cause = $cause.InnerException }
|                if ($cause -is [System.Management.Automation.RuntimeException] -and $cause.ErrorRecord) { throw $cause.ErrorRecord }
|                if ($null -ne $cause) { throw $cause }
|                throw $e
|            }
|        }
|        $net = $false
|        for ($e = $ex; $null -ne $e; $e = $e.InnerException) {
|            if ($e -is [System.IO.IOException] -or $e -is [System.Net.WebException] -or $e -is [System.Net.Sockets.SocketException]) { $net = $true; break }
|        }
|        $inner = $ex; while ($null -ne $inner.InnerException) { $inner = $inner.InnerException }
|        $why = Get-SILaStreamShortReason $inner.Message
|        if (-not $net) { $global:SI_LaStreamReaderOff = 'the streaming reader failed on an answer: ' + $why }
|        return [pscustomobject]@{ SILaStreamFailed = $why; Network = $net }
|    }
|}
|
|function ConvertFrom-SILaQueryStream {
|    <#
|        The Log Analytics query response READ FROM ITS STREAM -> @{ Rows; Columns; Error } -- the shape and the rows of
|        ConvertFrom-SILaQueryRows (SI-AzRest.ps1), without the answer ever being held whole. -Compact: compact rows
|        (Get-SILaCompactRowType) where a compact type can be built for the columns; PSCustomObject rows otherwise.
|        -BufferBytes: the first buffer (it grows only when one row does not fit). Throws on an answer that is not valid
|        JSON or ends early (as the lean read does).
|        -OnPage { param($Rows) }: FOR EVERY READER, not only Risk Analysis -- the primary table's rows are handed on a page
|        at a time, as soon as about -PageBytes of the answer's own bytes are in, and are never collected: memory is one
|        page. .Rows is then empty; .RowCount / .Pages say what was handed on; -PageState (a hashtable) is kept up to date
|        as pages go out (Pages, Rows). The error object (a cut answer) comes at the END of the answer, after the pages: a
|        caller keeps its pages only once the whole read returned (Invoke-SILaQuery -OnPage refuses a cut answer there).
|    #>
|    param([Parameter(Mandatory)][System.IO.Stream]$Stream, [switch]$Compact, [int]$BufferBytes = 65536,
|          [scriptblock]$OnPage, [long]$PageBytes = 4MB, [hashtable]$PageState)
|    $t = Get-SILaStreamReaderType
|    if ($null -eq $t) { throw 'the streaming Log Analytics reader is not available in this process' }
|    $ctorFor = $null
|    if ($Compact) {
|        $ctorFor = [Func[string[], System.Reflection.ConstructorInfo]] {
|            param([string[]]$names)
|            $ct = $null
|            if (Get-Command -Name Get-SILaCompactRowType -ErrorAction SilentlyContinue) { $ct = Get-SILaCompactRowType -Names $names }
|            if ($null -eq $ct) { return $null }
|            return $ct.GetConstructor([type[]]@([string[]]))
|        }
|    }
|    # column names that differ only in case (never in a real answer): the row is built exactly as the lean read builds it
|    # [[string[]]] -- the spelling Windows PowerShell 5.1 can parse too: setup scripts a customer runs there load this file
|    # through SI-AzRest.ps1 (the same type as [Func[string[], string[], object]], which 5.1 refuses as a parse error)
|    $plainFor = [Func[[string[]], [string[]], object]] {
|        param([string[]]$names, [string[]]$cells)
|        $o = [ordered]@{}
|        for ($i = 0; $i -lt $names.Length; $i++) { $o[$names[$i]] = $(if ($i -lt $cells.Length) { $cells[$i] } else { $null }) }
|        [pscustomobject]$o
|    }
|    if ($OnPage) {
|        if ($null -eq $PageState) { $PageState = @{} }
|        $PageState['Pages'] = 0; $PageState['Rows'] = 0L
|        $__psOn = $OnPage; $__psState = $PageState
|        $pageAction = [Action[object[]]] {
|            param([object[]]$page)
|            $null = & $__psOn $page
|            $__psState['Pages'] = [int]$__psState['Pages'] + 1
|            $__psState['Rows'] = [long]$__psState['Rows'] + $page.Length
|        }
|        $a = $t::Read($Stream, [bool]$Compact, $ctorFor, $BufferBytes, $plainFor, $pageAction, [long]$PageBytes)
|    } else {
|        $a = $t::Read($Stream, [bool]$Compact, $ctorFor, $BufferBytes, $plainFor)
|    }
|    $cols = [System.Collections.Generic.List[object]]::new()
|    for ($i = 0; $i -lt $a.ColumnNames.Length; $i++) { $cols.Add([pscustomobject]@{ name = $a.ColumnNames[$i]; type = $a.ColumnTypes[$i] }) }
|    $err = $null
|    if ($null -ne $a.ErrorJson) { $err = ($a.ErrorJson | ConvertFrom-Json) }
|    $count = [long]$a.Rows.Length; if ($OnPage) { $count = [long]$a.RowsDelivered }
|    # (#836: $global:, never $script: -- a function's $script: is its caller's)
|    $global:SI_LaStreamLast = [pscustomobject]@{ BytesRead = $a.BytesRead; LargestBuffer = $a.LargestBuffer; Rows = $count; Pages = [int]$a.Pages }
|    return [pscustomobject]@{ Rows = $a.Rows; Columns = $cols.ToArray(); Error = $err; RowCount = $count; Pages = [int]$a.Pages }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-LaParts.ps1'] = @{ Sha256 = 'd6068eb409f171257cf45624fee0eea678cadb739bc63f8b366afc3f9b7b1edd'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- a Log Analytics read IN PARTS, so a large install never meets the service's limit on one answer
|    (#639 lane 4, owner 2026-10-21: "memory issues must not be a problem in any step. env must work in millions of assets
|    env"). Loaded by SI-AzRest.ps1, and guarded by every caller, so it loads on its own (tests).
|
|    WHY. One Log Analytics answer carries at most ~500,000 rows / ~64 MB. Invoke-SILaQuery REFUSES an answer the service
|    cut (New-SILaCutAnswerError) -- a cut answer is never taken as whole. A reader whose result can outgrow one answer
|    (a profile snapshot, the correlation map, a customer's rule query) therefore reads in PARTS:
|
|      * The query is first asked AS IT IS -- a small result costs exactly what it cost before (one query, unchanged).
|      * Refused as cut (or too large, or this process ran out of memory on it): the query is MEASURED once (rows and
|        bytes of its result) and read again in that many parts: each part is the query's own result, filtered on a hash
|        of each result row (or of a key the caller names). The parts never overlap and together are every row --
|        whatever the query does, because the filter is applied to its RESULT.
|      * A part still refused is cut in two (only that part; on a hash of its own, so the pieces never overlap); a part
|        far larger than planned cuts every part still to read by the measured factor. The size of a part follows what
|        was measured, never a fixed number (working rule 5).
|      * MEASURED stop, never a cap: a refused part that held NO row at all, twice in a row, is the query's own work
|        hitting a limit (every part repeats it) -- more parts cannot help, and the read fails saying so.
|      * A part that fails for any other reason fails THE READ: what was read is not the whole, so it is UNKNOWN -- never
|        handed out as the result (working rule 4). The caller's own handling of a failed read applies unchanged.
|
|    A query whose rows differ between two runs of it (take / limit / sample) is never cut into parts: its refusal is passed
|    on as it is. The rows of a read in parts come in no particular order.
|
|    PowerShell 5.1-safe: no ternary, no null-conditional. NO Set-StrictMode here (it leaks into the caller's scope).
|    A caller's -Read / -OnRows / -Log block runs INSIDE Read-SILaParts: a variable it reads must not share a name with
|    this function's own (Query, WorkspaceId, Wait, Key, Read, OnRows, What, Log, rows, got, page, queue ...).
|#>
|
|# Azure access: plain REST, no PowerShell modules (SI-AzRest.ps1 loads this file last, so this never loads it twice).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot './SI-AzRest.ps1') }
|
|function Get-SILaPartFilter {
|    <#
|        PURE. The KQL that keeps ONE part of a query's result: -Cuts = @( @{ Parts; Part } ...) -- the first cut is the
|        planned part ("bucket Part of Parts" of the row's hash); each later cut divides that part again on a hash of its own
|        (the depth in front of the value), so the pieces of a part never overlap and together are that part. -Key: a KQL
|        expression on the result's columns to hash (e.g. 'SI_AssetId'); '' = the whole result row (pack_all()). '' = no cut.
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Cuts = @(), [string]$Key = '')
|    $terms = New-Object System.Collections.Generic.List[string]
|    for ($d = 0; $d -lt @($Cuts).Count; $d++) {
|        $parts = [long]$Cuts[$d].Parts; $part = [long]$Cuts[$d].Part
|        if ($parts -lt 1 -or $part -lt 0 -or $part -ge $parts) { throw ('Get-SILaPartFilter: part {0} is outside 0..{1}' -f $part, ($parts - 1)) }
|        if ($parts -eq 1) { continue }
|        if ($d -eq 0) { $terms.Add(('hash(_siPart, {0}) == {1}' -f $parts, $part)) }
|        else { $terms.Add(('hash(strcat("{0}|", _siPart), {1}) == {2}' -f $d, $parts, $part)) }
|    }
|    if ($terms.Count -eq 0) { return '' }
|    $k = 'tostring(pack_all())'
|    if ($Key) { $k = 'tostring({0})' -f $Key }
|    ('| extend _siPart = {0} | where {1} | project-away _siPart' -f $k, ($terms -join ' and '))
|}
|
|function Get-SILaPartQuery {
|    <#
|        PURE. -Query with -Filter after its LAST tabular statement: trailing blank / comment lines and semicolons are taken
|        off first, so the filter follows the result. '' -Filter = the query unchanged.
|    #>
|    param([Parameter(Mandatory)][string]$Query, [AllowEmptyString()][string]$Filter = '')
|    if (-not $Filter) { return $Query }
|    $lines = New-Object System.Collections.Generic.List[string]
|    foreach ($l in ($Query -split "`r?`n")) { $lines.Add($l) }
|    while ($lines.Count -gt 0) {
|        $t = $lines[$lines.Count - 1].Trim()
|        if ($t -eq '' -or $t.StartsWith('//')) { $lines.RemoveAt($lines.Count - 1); continue }
|        if ($t.EndsWith(';')) { $lines[$lines.Count - 1] = $lines[$lines.Count - 1].TrimEnd().TrimEnd(';'); continue }
|        break
|    }
|    (($lines -join "`n") + "`n" + $Filter)
|}
|
|function Get-SILaMeasureQuery {
|    <# PURE. How many rows -Query's result holds and about how many bytes (one small answer: SIRows, SIBytes). #>
|    param([Parameter(Mandatory)][string]$Query)
|    Get-SILaPartQuery -Query $Query -Filter '| summarize SIRows = count(), SIBytes = sum(estimate_data_size(*))'
|}
|
|function Test-SILaQueryPartable {
|    <# PURE. May -Query be read in parts? Not when its rows differ between two runs of it (take / limit / sample): the parts
|       of two runs would not be one result. #>
|    param([AllowEmptyString()][string]$Query)
|    -not ([string]$Query -match '(?im)\|\s*(take|limit|sample|sample-distinct)\b')
|}
|
|function Get-SILaPartFailure {
|    <#
|        PURE. What a failed read of one part says: @{ Cut = $true when a SMALLER part fixes it -- an answer the service cut
|        for a limit (Invoke-SILaQuery's refusal, Risk Analysis' own), an answer refused as too large, or this process out of
|        memory on it; Rows = the rows the short answer held (-1 unknown) }. Anything else: Cut = $false (passed on as it is).
|    #>
|    param([AllowNull()][object]$Err)
|    $ex = $null; $texts = New-Object System.Collections.Generic.List[string]
|    if ($Err -is [System.Management.Automation.ErrorRecord]) {
|        $ex = $Err.Exception
|        if ($Err.ErrorDetails -and $Err.ErrorDetails.Message) { $texts.Add([string]$Err.ErrorDetails.Message) }
|    } elseif ($Err -is [System.Exception]) { $ex = $Err }
|    elseif ($null -ne $Err) { $texts.Add([string]$Err) }
|    $e = $ex
|    while ($null -ne $e) {
|        if ($e -is [System.OutOfMemoryException] -or $e -is [System.InsufficientExecutionStackException]) { return @{ Cut = $true; Rows = -1L; Why = 'too large for this job''s memory' } }
|        if ($e.Data) {
|            foreach ($k in 'SILaPartial', 'SIRALaPartial') {
|                if ($e.Data.Contains($k)) {
|                    $rows = -1L
|                    if ($e.Data.Contains('SIRALaPartialRows')) { try { $rows = [long]$e.Data['SIRALaPartialRows'] } catch { $rows = -1L } }
|                    return @{ Cut = ([string]$e.Data[$k] -eq 'Limit'); Rows = $rows; Why = 'cut by the service''s limit' }
|                }
|            }
|        }
|        $texts.Add([string]$e.Message)
|        try { if ($e.PSObject.Properties['Response'] -and $e.Response -and $e.Response.PSObject.Properties['Content']) { $texts.Add([string]$e.Response.Content) } } catch { }
|        $e = $e.InnerException
|    }
|    $all = ($texts -join ' ')
|    if ($all -match '(?i)E_QUERY_RESULT_SET_TOO_LARGE|ResponsePayloadTooLarge|ResponseSizeError|result set (is )?too large|exceeds? the (maximum )?(response|result) size|response size .*exceed') {
|        return @{ Cut = $true; Rows = -1L; Why = 'too large to read in one answer' }
|    }
|    @{ Cut = $false; Rows = -1L; Why = '' }
|}
|
|function ConvertTo-SILaPartRows {
|    <# PURE. Rows however a reader handed them over -- one array (`, @(rows)`), an array holding that array, or rows on the
|       pipeline -- as ONE flat object[] without nulls. #>
|    param([AllowNull()][object]$Answer)
|    $l = New-Object System.Collections.Generic.List[object]
|    foreach ($x in @($Answer)) {
|        if ($null -eq $x) { continue }
|        if ($x -is [array]) { foreach ($y in $x) { if ($null -ne $y) { $l.Add($y) } } } else { $l.Add($x) }
|    }
|    , $l.ToArray()
|}
|
|function Get-SILaPartPlan {
|    <#
|        PURE. How many parts a result of -Rows rows / about -Bytes bytes is read in: each part well under one answer's
|        limits -- at most half the service's own row limit, and -TargetBytes of answer (the JSON answer is -Expansion times
|        the data's own size). At least 2 (the result was refused whole). Follows the measurement; no ceiling.
|    #>
|    param([long]$Rows = -1, [double]$Bytes = -1, [long]$TargetRows = 0, [double]$TargetBytes = 16MB, [double]$Expansion = 2.5)
|    if ($TargetRows -le 0) {
|        $limit = 500000L
|        if (Get-Command -Name Get-SILaServiceRowLimit -ErrorAction SilentlyContinue) { $limit = [long](Get-SILaServiceRowLimit) }
|        $TargetRows = [long][Math]::Max(1, [Math]::Floor($limit / 2))
|    }
|    $n = 2L
|    if ($Rows -gt 0) { $n = [long][Math]::Max($n, [Math]::Ceiling([double]$Rows / [double]$TargetRows)) }
|    if ($Bytes -gt 0 -and $TargetBytes -gt 0) { $n = [long][Math]::Max($n, [Math]::Ceiling(($Bytes * $Expansion) / $TargetBytes)) }
|    $n
|}
|
|function Read-SILaParts {
|    <#
|        ONE Log Analytics read, in parts when one answer cannot carry it (see the header of this file). Every row once.
|          -Query      the KQL (asked as it is first)
|          -Key        a KQL expression on the result's columns that the parts hash on ('' = the whole result row). A key
|                      that is the same for many rows cannot divide them -- '' always can.
|          -Read       { param($Kql) rows } -- the reader (the seam for tests). Default: Invoke-SIAzOperationalInsightsQuery
|                      on -WorkspaceId (with -Wait), its .Results.
|          -OnRows     { param($Rows) } -- each part's rows as soon as that part is read whole (then not collected; memory is
|                      one part). The parts handed on are only the result when this call RETURNS: a later part that fails
|                      throws, and the caller treats the whole read as failed. Without -OnRows the rows are collected.
|          -What       what is read, for the lines it says; -Log { param($Level, $Message) }
|        Returns @{ Rows (without -OnRows); RowCount; Pages; Parts (planned); Cuts }. Throws when the read is not whole.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Query,
|        [string]$WorkspaceId = '',
|        [int]$Wait = 0,
|        [string]$Key = '',
|        [scriptblock]$Read,
|        [scriptblock]$OnRows,
|        [string]$What = 'the Log Analytics read',
|        [scriptblock]$Log,
|        [long]$TargetRows = 0,
|        [double]$TargetBytes = 16MB,
|        [int]$MaxDepth = 24
|    )
|    if (-not $Read) {
|        if (-not $WorkspaceId) { throw 'Read-SILaParts: -WorkspaceId or -Read is needed' }
|        # (-Wait only when given: the same call the readers made before, so a reader's own stand-in still answers it)
|        $Read = {
|            param($k)
|            $__p = @{ WorkspaceId = $WorkspaceId; Query = $k; ErrorAction = 'Stop' }
|            if ($Wait -gt 0) { $__p['Wait'] = $Wait }
|            $__a = Invoke-SIAzOperationalInsightsQuery @__p
|            if ($__a) { , @($__a.Results) } else { , @() }
|        }
|    }
|    if (-not $Log) { $Log = { param($l, $m) Write-Host ('[{0}] {1}' -f $l, $m) } }
|    if ($TargetRows -le 0) {
|        $limit = 500000L
|        if (Get-Command -Name Get-SILaServiceRowLimit -ErrorAction SilentlyContinue) { $limit = [long](Get-SILaServiceRowLimit) }
|        $TargetRows = [long][Math]::Max(1, [Math]::Floor($limit / 2))
|    }
|    $partable = Test-SILaQueryPartable -Query $Query
|    $acc = $null
|    if (-not $OnRows) { $acc = New-Object System.Collections.Generic.List[object] }
|    $queue = New-Object 'System.Collections.Generic.Queue[object]'
|    $queue.Enqueue([pscustomobject]@{ Cuts = @() })
|    $pages = 0L; $rowsRead = 0L; $cutsMade = 0L; $planned = 1L; $measured = $false; $emptyRefusals = 0
|    while ($queue.Count -gt 0) {
|        $page = $queue.Dequeue()
|        $kql = Get-SILaPartQuery -Query $Query -Filter (Get-SILaPartFilter -Cuts @($page.Cuts) -Key $Key)
|        $rows = $null; $fail = $null
|        try {
|            # assigned first: the reader answers ONE array (`, @(rows)`) -- @() around the call would hold it as one row
|            $got = & $Read $kql
|            $rows = ConvertTo-SILaPartRows $got
|            $got = $null
|        } catch {
|            $f = Get-SILaPartFailure -Err $_
|            if (-not $f.Cut -or -not $partable) { throw }
|            $fail = $f; $failErr = $_
|        }
|        if ($fail) {
|            $rows = $null
|            if (@($page.Cuts).Count -ge $MaxDepth) {
|                throw ('{0} is more than Log Analytics can answer: a part cut {1} times is still {2} -- the read is not whole and nothing of it is used' -f $What, @($page.Cuts).Count, $fail.Why)
|            }
|            if ([long]$fail.Rows -eq 0) { $emptyRefusals++ } else { $emptyRefusals = 0 }
|            if ($emptyRefusals -ge 2) {
|                throw ('{0} is more than Log Analytics can answer: a part stopped at the service''s limit before it returned a row, twice, so reading it in more parts cannot make it fit -- the read is not whole and nothing of it is used ({1})' -f $What, (([string]$failErr.Exception.Message -split "`n") | Select-Object -First 1))
|            }
|            if (@($page.Cuts).Count -eq 0 -and -not $measured) {
|                # the whole query was refused: measured ONCE, then read in that many parts
|                $measured = $true
|                $mRows = -1L; $mBytes = -1.0
|                try {
|                    $mr = ConvertTo-SILaPartRows (& $Read (Get-SILaMeasureQuery -Query $Query)); $m = $null; if ($mr.Count -gt 0) { $m = $mr[0] }
|                    if ($m) {
|                        if ($m.PSObject.Properties['SIRows'] -and "$($m.SIRows)" -ne '') { $mRows = [long][double]::Parse([string]$m.SIRows, [Globalization.CultureInfo]::InvariantCulture) }
|                        if ($m.PSObject.Properties['SIBytes'] -and "$($m.SIBytes)" -ne '') { $mBytes = [double]::Parse([string]$m.SIBytes, [Globalization.CultureInfo]::InvariantCulture) }
|                    }
|                } catch { $mRows = -1L; $mBytes = -1.0 }
|                $planned = Get-SILaPartPlan -Rows $mRows -Bytes $mBytes -TargetRows $TargetRows -TargetBytes $TargetBytes
|                for ($p = 0L; $p -lt $planned; $p++) { $queue.Enqueue([pscustomobject]@{ Cuts = @([pscustomobject]@{ Parts = $planned; Part = $p }) }) }
|                $cutsMade++
|                $sizeText = ''
|                if ($mRows -ge 0) { $sizeText = [string]::Format([Globalization.CultureInfo]::InvariantCulture, ' (measured: {0:N0} row(s){1})', $mRows, $(if ($mBytes -ge 0) { [string]::Format([Globalization.CultureInfo]::InvariantCulture, ', about {0:N0} MB', ($mBytes / 1MB)) } else { '' })) }
|                & $Log 'INFO' ('{0} is larger than one Log Analytics answer can carry ({1}) -- it is read in {2} parts{3}; nothing of the short answer is kept' -f $What, $fail.Why, $planned, $sizeText)
|            } else {
|                foreach ($half in 0, 1) { $queue.Enqueue([pscustomobject]@{ Cuts = @($page.Cuts) + @([pscustomobject]@{ Parts = 2L; Part = [long]$half }) }) }
|                $cutsMade++
|                & $Log 'INFO' ('{0}: a part was {1} -- it is read again in two smaller parts' -f $What, $fail.Why)
|            }
|            continue
|        }
|        $emptyRefusals = 0
|        $n = $rows.Count
|        $pages++; $rowsRead += $n
|        if ($OnRows) { $null = & $OnRows $rows } else { $acc.AddRange([object[]]$rows) }
|        $rows = $null
|        # measured, not assumed: a part far larger than planned -> every part still to read is cut by that factor
|        if (@($page.Cuts).Count -gt 0 -and $n -gt (2 * $TargetRows) -and $queue.Count -gt 0) {
|            $factor = [long][Math]::Ceiling([double]$n / [double]$TargetRows)
|            $rest = $queue.ToArray(); $queue.Clear()
|            foreach ($rp in $rest) { for ($piece = 0L; $piece -lt $factor; $piece++) { $queue.Enqueue([pscustomobject]@{ Cuts = @($rp.Cuts) + @([pscustomobject]@{ Parts = $factor; Part = $piece }) }) } }
|            $cutsMade++
|            & $Log 'INFO' ('{0}: its parts are larger than measured -- the {1} part(s) still to read are read as {2}' -f $What, $rest.Count, $queue.Count)
|        }
|    }
|    if ($pages -gt 1) { & $Log 'INFO' ([string]::Format([Globalization.CultureInfo]::InvariantCulture, '{0}: read whole in {1} part(s), {2:N0} row(s)', $What, $pages, $rowsRead)) }
|    $out = [ordered]@{ Rows = @(); RowCount = $rowsRead; Pages = $pages; Parts = $planned; Cuts = $cutsMade }
|    if ($acc) { $out.Rows = $acc.ToArray() }
|    [pscustomobject]$out
|}
'@ }
$__siSupportFiles['engine/_shared/SI-LogIngest.ps1'] = @{ Sha256 = '877c581ac6adda5fa7951afb09db3fefd7fbe77742dfbc686cf9037255224f6f'; Text = @'
|#Requires -Version 5.1
|<#
|    SI -- publish rows to a Log Analytics custom table through the normal DCR path.
|
|    Moved here from engine/asset-correlation/_shared/SI-CorrelationIngest.ps1 because a FREE stage uses
|    it too: the azure profiler's Defender for Cloud recommendations stage publishes with
|    Send-SIObjectMapRows. The correlation engine is part of SecurityInsight Pro and is not in the
|    Community edition, so a free engine must never load a file from its folder. The function names are
|    unchanged, so every caller and test keeps working.
|#>
|
|# NO Set-StrictMode HERE -- a dot-sourced file that sets it leaks into the caller's scope.
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction Ignore)) { . (Join-Path $PSScriptRoot './SI-AzRest.ps1') }
|
|function Initialize-SIIngestGlobals {
|    <#
|      Fill the three names the DCR/DCE pinning and the LogIngest role grant need, from what an install
|      actually has (#174). The profiling orchestrator backfills them at its entry; the stages and engines that
|      publish WITHOUT it (trend, Defender recommendations, the Pro engines) did not -- and the CLI setup wrote
|      only the older names -- so pinning was skipped and a new DCR got no LogIngest principal.
|        SI_AzSubscriptionId  <- the subscription in SI_WorkspaceResourceId, else the 2.2.x SubscriptionId
|        SI_DceResourceGroup  <- the 2.2.x DceResourceGroup, else SI_DcrResourceGroup (same RG by default)
|        SI_SPN_ObjectId      <- SpnObjectId, else SI_LogIngest_ObjectId
|      Only EMPTY names are filled; a value the customer set always stands. Never throws.
|    #>
|    if (-not $global:SI_AzSubscriptionId) {
|        if ("$($global:SI_WorkspaceResourceId)" -match '/subscriptions/([^/]+)/') { $global:SI_AzSubscriptionId = $Matches[1] }
|        elseif ($global:SubscriptionId) { $global:SI_AzSubscriptionId = [string]$global:SubscriptionId }
|    }
|    if (-not $global:SI_DceResourceGroup) {
|        # SI_DcrResourceGroup FIRST: the unprefixed DceResourceGroup is ALWAYS set by the solution-wide shared
|        # defaults ('rg-dce-securityinsight'), so after loading it cannot tell a customer value from the default.
|        # The DCE normally lives with the DCRs (the sample: "leave unset, same RG as workspace").
|        if ($global:SI_DcrResourceGroup) { $global:SI_DceResourceGroup = [string]$global:SI_DcrResourceGroup }
|        elseif ($global:DceResourceGroup) { $global:SI_DceResourceGroup = [string]$global:DceResourceGroup }
|    }
|    if (-not $global:SI_SPN_ObjectId) {
|        if ($global:SpnObjectId) { $global:SI_SPN_ObjectId = [string]$global:SpnObjectId }
|        elseif ($global:SI_LogIngest_ObjectId) { $global:SI_SPN_ObjectId = [string]$global:SI_LogIngest_ObjectId }
|    }
|}
|
|function Get-SILogIngestObjectId {
|    <#
|      The object id that gets the ingest role on a new or updated data collection rule: SI_SPN_ObjectId (what setup
|      writes), else the older SI_LogIngest_ObjectId -- the same order Send-SIObjectMapRows, trend, asset properties and
|      the run-health row use. Three output stages passed SI_LogIngest_ObjectId alone, so an install with only
|      SI_SPN_ObjectId got a rule nobody could post to (#257). Empty when neither is set.
|    #>
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_SPN_ObjectId)) { return [string]$global:SI_SPN_ObjectId }
|    return [string]$global:SI_LogIngest_ObjectId
|}
|
|function Select-SIIngestTarget {
|    <#
|        #199 -- make the endpoint AzLogDcrIngestPS will use the RIGHT one, before it touches the rule and again
|        before the post. The module resolves the endpoint by NAME ONLY -- the first match in $global:AzDceDetails,
|        or in a tenant-wide Resource Graph query when that cache is empty. Measured 2026-10-01: three endpoints
|        named dce-securityinsight in two subscriptions; a rule created on the right one was re-bound to another
|        one minute later by the engine's own post (#198); four rules on this tenant were bound to the other
|        subscription's endpoint.
|        The endpoint is chosen as follows:
|          - a rule that EXISTS posts through the endpoint it is bound to, when that endpoint has the configured
|            name. Ingestion accepts a post only through the rule's own endpoint, and moving a rule is not an
|            option -- measured 2026-10-01, a re-bound rule was still refused (HTTP 403) more than 10 minutes later.
|          - otherwise (a new rule) this install's endpoint -- subscription + resource group + name -- so the
|            module creates the rule there and not on a same-named endpoint elsewhere.
|          - ONE endpoint of that name anywhere is unambiguous and used (an endpoint outside the rules' resource
|            group has always worked that way). Several and none here: refused, nothing is posted.
|        The DCR cache is narrowed to this install's rule (or, before it exists, cleared of same-named rules
|        elsewhere). An empty cache is built first. Without a subscription id there is nothing to pin to.
|    #>
|    param([hashtable]$AuthParams, [Parameter(Mandatory)][string]$DcrName)
|    $sub = [string]$global:SI_AzSubscriptionId
|    if (-not $sub -or -not $global:SI_DceName) { return }
|    $dceRg = if ($global:SI_DceResourceGroup) { [string]$global:SI_DceResourceGroup } else { [string]$global:SI_DcrResourceGroup }
|    $dcrRg = [string]$global:SI_DcrResourceGroup
|    $rebuilt = $false
|    $rebuild = {
|        if ($rebuilt -or -not $AuthParams) { return }
|        try { $global:AzDceDetails = Get-SIDceList @AuthParams -Verbose:$false 4>$null } catch { }
|        try { $global:AzDcrDetails = Get-SIDcrList @AuthParams -Verbose:$false 4>$null } catch { }
|        $rebuilt = $true   # dot-sourced: this IS the function's scope
|    }
|    $findHere = { @($global:AzDceDetails | Where-Object { $_ -and $_.name -eq $global:SI_DceName -and [string]$_.id -like "/subscriptions/$sub/resourceGroups/$dceRg/*" }) | Select-Object -First 1 }
|    $findRule = { if ($dcrRg) { @($global:AzDcrDetails | Where-Object { $_ -and $_.name -eq $DcrName -and [string]$_.id -like "/subscriptions/$sub/resourceGroups/$dcrRg/*" }) | Select-Object -First 1 } }
|
|    if (-not $global:AzDceDetails) { . $rebuild }
|    $dce = . $findHere
|    $dcr = . $findRule
|    if (-not $dce -or ($dcrRg -and -not $dcr)) { . $rebuild; $dce = . $findHere; $dcr = . $findRule }
|    if (-not $dce) {
|        $same = @($global:AzDceDetails | Where-Object { $_ -and $_.name -eq $global:SI_DceName })
|        if ($same.Count -ne 1) {
|            throw ("Data collection endpoint '{0}' was not found in resource group '{1}' of subscription '{2}'. {3} endpoint(s) of that name exist elsewhere, so nothing was posted -- set SI_DceResourceGroup to the one this install uses." -f $global:SI_DceName, $dceRg, $sub, $same.Count)
|        }
|        $dce = $same[0]
|    }
|    $bound = if ($dcr -and $dcr.properties) { [string]$dcr.properties.dataCollectionEndpointId } else { '' }
|    if ($bound -and $bound -ne [string]$dce.id) {
|        $b = @($global:AzDceDetails | Where-Object { $_ -and [string]$_.id -eq $bound }) | Select-Object -First 1
|        if (-not $b) { . $rebuild; $b = @($global:AzDceDetails | Where-Object { $_ -and [string]$_.id -eq $bound }) | Select-Object -First 1 }
|        if ($b -and $b.name -eq $global:SI_DceName) {
|            Write-Verbose ("Data collection rule '{0}' is bound to {1}; posting through it." -f $DcrName, $bound)
|            $dce = $b
|        }
|    }
|    $global:AzDceDetails = @($dce)
|    if ($dcr) { $global:AzDcrDetails = @($dcr) }
|    elseif ($global:AzDcrDetails) { $global:AzDcrDetails = @($global:AzDcrDetails | Where-Object { $_ -and $_.name -ne $DcrName }) }
|}
|function Resolve-SICorrelationAuthParams {
|    <#
|        MI > SPN+cert > SPN+secret, resolved into the splat AzLogDcrIngestPS wants.
|        Mirrors Send-SIRunHealthRow deliberately -- see this file's header for why it is not shared.
|    #>
|    $spnAppId     = if ($global:SI_SPN_AppId)    { $global:SI_SPN_AppId }    else { $global:SI_LogIngest_AppId }
|    $spnSecret    = if ($global:SI_SPN_Secret)   { $global:SI_SPN_Secret }   else { $global:SI_LogIngest_Secret }
|    $spnTenantId  = if ($global:SI_SPN_TenantId) { $global:SI_SPN_TenantId } else { $global:SI_LogIngest_TenantId }
|    $spnCertThumb = [string]$global:SI_SPN_CertThumbprint
|
|    # Auto-detect which store actually holds the private key. A thumbprint in the wrong store reads as
|    # "no cert" and falls through to the secret branch, which then fails on a tenant that has no secret.
|    $spnCertStore = if ($global:SI_SPN_CertStoreLocation) { [string]$global:SI_SPN_CertStoreLocation }
|                    elseif ($spnCertThumb) {
|                        $clean = $spnCertThumb -replace '\s',''
|                        if (Get-PSDrive -Name Cert -ErrorAction SilentlyContinue) {
|                            $resolved = 'LocalMachine'
|                            foreach ($s in 'LocalMachine','CurrentUser') {
|                                $c = Get-ChildItem "Cert:\$s\My" -ErrorAction SilentlyContinue |
|                                     Where-Object { $_.Thumbprint -eq $clean -and $_.HasPrivateKey } |
|                                     Select-Object -First 1
|                                if ($c) { $resolved = $s; break }
|                            }
|                            $resolved
|                        } else {
|                            # #209: no Cert: drive (a Linux container) -- read the X509Store instead.
|                            if (-not (Get-Command Get-SICertStoreLocation -ErrorAction Ignore)) {
|                                . (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'auth/Find-SICertificate.ps1')
|                            }
|                            Get-SICertStoreLocation -Thumbprint $clean
|                        }
|                    } else { 'LocalMachine' }
|
|    $useMi   = $global:SI_PreferUami -and -not [string]::IsNullOrWhiteSpace($global:SI_UAMI_ClientId)
|    $useCert = -not $useMi -and -not [string]::IsNullOrWhiteSpace($spnCertThumb)
|
|    if ($useMi) {
|        return @{ UseManagedIdentity = $true; ManagedIdentityClientId = $global:SI_UAMI_ClientId }
|    }
|    if ($useCert) {
|        return @{
|            AzAppId                       = $spnAppId
|            AzAppCertificateThumbprint    = $spnCertThumb
|            AzAppCertificateStoreLocation = $spnCertStore
|            TenantId                      = $spnTenantId
|        }
|    }
|    @{ AzAppId = $spnAppId; AzAppSecret = $spnSecret; TenantId = $spnTenantId }
|}
|
|function Send-SIObjectMapRows {
|    <#
|        Publish the map to SI_ObjectMap_CL through the normal DCR path.
|
|        SQL COMPUTES AND HOLDS, LA PUBLISHES -- and there is no SQL yet, so today this IS the store.
|
|        🔴 CORRECTED 2026-08-13. This header used to say the deterministic seed means "an object's id is
|        recomputed identically every run", and that key-stability memory was "an OPTIMISATION over a
|        correctness property the core already has". THAT WAS WRONG, and believing it is what would ship
|        duplicate CIs. The property the core has is `same INPUT -> same id`. The property a connector
|        needs is `same OBJECT -> same id`. They diverge whenever group membership changes:
|
|          * Measured: adding one member carrying a lower-sorting exposure-graph id moved a group from
|            `exposuregraphnodeid:aaa` to `exposuregraphnodeid:000`. The seed is the ordinally-lowest
|            value of the highest-priority type PRESENT IN THE GROUP, so any arrival or departure moves
|            it.
|          * Departures are routine: the same day, EndpointEG returned 0 rows on a timeout and 51 assets
|            left the snapshot.
|          * Anchors churn independently -- MDE ids rotate, a rebuilt VM gets a new ARM path, a
|            re-enrolled device gets a new AadDeviceId.
|
|        So SQL key-stability is a CORRECTNESS PREREQUISITE before the connector may create CIs, not an
|        optimisation. Publishing to LA without it is fine -- reading a map is harmless. CREATING a
|        ServiceNow CI from an id that can move is not.
|
|        Decided 2026-08-13 (V3-ARCHITECTURE 2.3a): a minted UUIDv5-from-birth-anchor id, stored, with an
|        anchor ledger and a superseded table. Until that exists, ids emitted here are PROVISIONAL and a
|        connector must not create CIs from them.
|
|        NOT best-effort. Unlike the run-health heartbeat, this IS the output -- a swallowed failure
|        would leave consumers reading a stale map while every run reported success.
|    #>
|    param(
|        [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Rows,
|        [string]$TableName = 'SI_ObjectMap',
|        [string]$DcrName
|    )
|
|    if (@($Rows).Count -eq 0) {
|        Write-Warning 'correlation: nothing to publish -- 0 map rows. Not posting.'
|        return 0
|    }
|    if ([string]::IsNullOrWhiteSpace($DcrName)) {
|        $DcrName = if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_ObjectMap_DcrName)) {
|            [string]$global:SI_ObjectMap_DcrName
|        } else { 'dcr-si-objectmap' }
|    }
|
|    $savedVerbose = $global:VerbosePreference
|    $global:VerbosePreference = 'SilentlyContinue'
|    $lock = $null
|    try {
|        $authParams = Resolve-SICorrelationAuthParams
|        Initialize-SIIngestGlobals
|        $spnObjectId = if ($global:SI_SPN_ObjectId) { $global:SI_SPN_ObjectId } else { $global:SI_LogIngest_ObjectId }
|
|        # #475 -- A TABLE + RULE ALREADY MADE READY IN THIS PROCESS FOR THESE COLUMNS IS NOT CHECKED AGAIN. The steps below
|        # (endpoint + rule selection twice, the table / rule update with its coverage check, the cache refresh) are several
|        # Azure calls; they ran for every batch, and a run collected in parts posts its records in dozens of batches
|        # (customer H 2026-10-09: 96,551 records). A batch whose columns were all made ready earlier in this process posts
|        # through the same pinned endpoint and rule; a batch with a NEW column takes the full path again.
|        $readyKey = ('{0}|{1}' -f $TableName, $DcrName).ToLowerInvariant()
|        $batchCols = Get-SIObjectMapColumns -Rows @($Rows)
|        # in the run cache (global, like the tokens: this file is dot-sourced at different depths, so $script: differs)
|        $rcache = Get-SILogIngestRunCache
|        if (-not ($rcache.ObjectMapReady -is [hashtable])) { $rcache.ObjectMapReady = @{} }
|        $ready = $rcache.ObjectMapReady[$readyKey]
|        if ($ready -and (Test-SIObjectMapColumnsReady -Ready $ready.Columns -Columns $batchCols)) {
|            $global:AzDceDetails = @($ready.Dce); $global:AzDcrDetails = @($ready.Dcr)
|            $data = @($Rows)
|            $data = Repair-SILogColumnName -Data $data 4>$null
|            $data = Format-SILogRowsToSchema -Data $data 4>$null
|            $null = Send-SILogData -DceName $global:SI_DceName -DcrName $DcrName -Data $data -TableName $TableName @authParams 4>$null
|            return @($data).Count
|        }
|        # several processes of one run publish at once (the records of a run collected in parts): the table / rule update
|        # is done by one at a time (SI_INGEST_LOCK_FILE), so two never update the same rule over each other
|        $lock = Enter-SIIngestLock
|
|        # 🔴 THE WHOLE SET, NOT ONE ROW -- CORRECTED 2026-08-31. `-Data` was
|        # `@($Rows | Select-Object -First 1)`. AzLogDcrIngestPS INFERS the table + DCR column set
|        # from what it is handed, so one row defined the schema for the entire table: a row lacking
|        # an optional field meant that column was never created, and every other row's value for it
|        # was DROPPED AT INGEST, silently, for the life of the table.
|        # 🪤 Nothing errors. The engine reports rows posted, the table exists, and the field is
|        # simply absent -- indistinguishable from "no object had a value".
|        # 📌 The four profilers already got this right (Invoke-Output.ps1's `$schemaSample` is the
|        # FULL dataset, commented "full dataset for type inference"). Only the engines that publish
|        # their own v3 tables carried the shortcut.
|        #
|        # 🔴 AND THIS COMMENT MUST STAY *ABOVE* THE CALL, NOT INSIDE IT (audit #102, 2026-09-02).
|        # It was written between two backtick-continued argument lines, and **a comment TERMINATES a
|        # backtick continuation**: everything after it was dropped, including the `-Data @($Rows)` this
|        # very comment was added to introduce. Correlation then failed at publish on every run --
|        # `missing mandatory parameters: Data AzDcrSetLogIngestApiAppPermissionsDcrLevel
|        # AzLogDcrTableCreateFromReferenceMachine`, which is exactly the arguments that follow it here.
|        # #199 -- pin BEFORE the create/update, not only before the post.
|        Select-SIIngestTarget -AuthParams $authParams -DcrName $DcrName
|        $null = Update-SILogTableSchema `
|            -AzLogWorkspaceResourceId                   $global:SI_WorkspaceResourceId `
|            @authParams `
|            -DceName                                    $global:SI_DceName `
|            -DcrName                                    $DcrName `
|            -DcrResourceGroup                           $global:SI_DcrResourceGroup `
|            -TableName                                  $TableName `
|            -Data                                       @($Rows) `
|            -LogIngestServicePricipleObjectId           $spnObjectId `
|            -AzDcrSetLogIngestApiAppPermissionsDcrLevel $false `
|            -AzLogDcrTableCreateFromAnyMachine          $true `
|            -AzLogDcrTableCreateFromReferenceMachine    @() 4>$null
|
|        # Re-sync the DCE/DCR cache so a freshly created DCR's immutableId is known before the
|        # name-only lookup inside Post-*. Without it the module falls back to the DCE's location
|        # field as a bogus immutableId and the ingestion API answers 404 'westeurope'.
|        try {
|            $ensureFn = Get-Command -Name 'Ensure-SecurityInsightAzDceDcrCache' -ErrorAction Ignore
|            if ($ensureFn) {
|                & $ensureFn @authParams `
|                    -SubscriptionId   $global:SI_AzSubscriptionId `
|                    -DceResourceGroup $global:SI_DceResourceGroup `
|                    -DcrResourceGroup $global:SI_DcrResourceGroup `
|                    -Force 4>$null
|            }
|        } catch { }
|
|        # 📌 SUPERSEDED 2026-10-01 (#199): Select-SIIngestTarget above now builds and pins the caches BEFORE the
|        # create/update -- the module resolves the endpoint by name inside CheckCreateUpdate too, so pinning only
|        # here was too late. The history below is kept for the BlockCopy lesson.
|        # 🪤 DO NOT PRE-POPULATE THE CACHES HERE. Tried on 2026-08-30, mirroring the profiler's
|        # `$global:AzDceDetails = Get-AzDceListAll @authParams`, on the reasoning that filtering a
|        # cache that does not exist yet would be a silent no-op. It is not a no-op -- by this point
|        # `CheckCreateUpdate-TableDcr-Structure` (called above) has already built both caches, which
|        # is why the DCR pin below has always worked. The rebuild is redundant work, nothing more.
|        # 📌 It was briefly believed to have CAUSED the "BlockCopy ... Object must be an array of
|        # primitives" error that appeared once the 403 was gone. It did not, and the wrong version of
|        # this note lived here for an hour. That error was a real defect in AzLogDcrIngestPS 1.7.1 --
|        # `return $bytes` enumerates the array, so the caller binds object[] and [Buffer]::BlockCopy
|        # rejects it -- which broke the UNCOMPRESSED path for every caller of the module. Fixed
|        # upstream in 1.7.2 (SI finding #81). Removing these lines did not make it go away; only the
|        # module fix did.
|
|        # DCR name-collision guard. One SPN can see same-named DCRs in several subscriptions -- there
|        # are already three DCEs called dce-securityinsight in this tenant -- and the module's name-only
|        # lookup then picks one at random. Pin to (sub + RG + name) before posting.
|        if ($global:AzDcrDetails -and $global:SI_AzSubscriptionId -and $global:SI_DcrResourceGroup) {
|            $picked = @($global:AzDcrDetails | Where-Object {
|                $_.name -eq $DcrName -and
|                $_.id   -like "*/subscriptions/$($global:SI_AzSubscriptionId)/resourceGroups/$($global:SI_DcrResourceGroup)/*"
|            }) | Select-Object -First 1
|            if ($picked) { $global:AzDcrDetails = @($picked) }
|        }
|
|        # 🔴 AND THE SAME GUARD FOR THE **DCE** -- its absence is why this engine could never publish.
|        # The comment above names the hazard exactly ("three DCEs called dce-securityinsight") and then
|        # pins only the DCR. `Post-*` resolves the DCE by NAME-ONLY against $global:AzDceDetails, so it
|        # could pick an endpoint in a DIFFERENT subscription and post this workspace's DCR immutableId
|        # to it -- which the Log Ingestion API answers with **HTTP 403**.
|        # MEASURED 2026-08-30: three DCEs named `dce-securityinsight` exist across this tenant (one in
|        # the workspace's own subscription, two in a sibling), and every correlation run ended
|        # `[ERROR] Engine failed: Log Ingestion API request failed. HTTP Status: 403` AFTER doing all
|        # of its real work -- 1296 rows read, 1291 objects correlated, ledger updated, 2228 map rows
|        # built -- and losing the lot at the final POST. That is why the handoff records correlation as
|        # "built + run on real data, never published": it was never a correlation defect at all.
|        # 🔑 THE PROFILER ALREADY SOLVES THIS. `Apply-SIDcrScopeFilter` (asset-profiling/stages/
|        # Invoke-Output.ps1) filters BOTH caches to the configured sub + RG, which is exactly why the
|        # four profilers ingest happily while this engine 403s on the same credentials. Operator,
|        # 2026-08-30: *"it must use same auth as the design is using to send data to la in the
|        # profiler"* -- so this mirrors that filter rather than inventing a third variant.
|        # 📌 Same auth params, same scope pin. The DCE RG falls back to the DCR RG, matching the
|        # profiler's own default of 'rg-securityinsight' when SI_DceResourceGroup is unset.
|        $_dceRg = if ($global:SI_DceResourceGroup) { [string]$global:SI_DceResourceGroup }
|                  else { [string]$global:SI_DcrResourceGroup }
|        if ($global:AzDceDetails -and $global:SI_AzSubscriptionId -and $_dceRg) {
|            $_pickedDce = @($global:AzDceDetails | Where-Object {
|                $_.id -like "*/subscriptions/$($global:SI_AzSubscriptionId)/resourceGroups/$_dceRg/*"
|            })
|            if ($_pickedDce.Count -gt 0) { $global:AzDceDetails = @($_pickedDce) }
|        }
|
|        # #199 -- again before the post: the cache refresh above narrowed it to this install's endpoint, which is
|        # not the rule's own when the rule is bound elsewhere.
|        Select-SIIngestTarget -AuthParams $authParams -DcrName $DcrName
|        # ready for these columns in this process (#475): the next batch with no new column posts straight away
|        $known = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|        if ($ready) { foreach ($c in $ready.Columns) { [void]$known.Add($c) } }
|        foreach ($c in $batchCols) { [void]$known.Add($c) }
|        $rcache.ObjectMapReady[$readyKey] = [pscustomobject]@{ Columns = $known; Dce = @($global:AzDceDetails); Dcr = @($global:AzDcrDetails) }
|        Exit-SIIngestLock -Lock $lock; $lock = $null
|        $data = @($Rows)
|        $data = Repair-SILogColumnName -Data $data 4>$null
|        $data = Format-SILogRowsToSchema -Data $data 4>$null
|        $null = Send-SILogData `
|            -DceName   $global:SI_DceName `
|            -DcrName   $DcrName `
|            -Data      $data `
|            -TableName $TableName `
|            @authParams 4>$null
|
|        @($data).Count
|    }
|    finally {
|        if ($lock) { Exit-SIIngestLock -Lock $lock }
|        if ($null -ne $savedVerbose) { $global:VerbosePreference = $savedVerbose }
|    }
|}
|
|function Get-SIObjectMapColumns {
|    <# PURE. Every column name of a batch of rows (PSObject properties or dictionary keys), once. #>
|    param([AllowEmptyCollection()][object[]]$Rows = @())
|    $set = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($r in $Rows) {
|        if ($null -eq $r) { continue }
|        if ($r -is [System.Collections.IDictionary]) { foreach ($k in $r.Keys) { [void]$set.Add([string]$k) } }
|        else { foreach ($p in $r.PSObject.Properties) { [void]$set.Add($p.Name) } }
|    }
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($c in $set) { $out.Add($c) }
|    , $out.ToArray()
|}
|
|function Test-SIObjectMapColumnsReady {
|    <# PURE. $true when every column of the batch is among the columns already made ready. #>
|    param($Ready, [AllowEmptyCollection()][string[]]$Columns = @())
|    if ($null -eq $Ready) { return $false }
|    foreach ($c in $Columns) { if (-not $Ready.Contains($c)) { return $false } }
|    $true
|}
|
|function Enter-SIIngestLock {
|    <#
|        The cross-process lock of the table / rule update (SI_INGEST_LOCK_FILE, set by a parent that runs several publishing
|        processes at once). No variable = no lock ($null). Waits up to 20 minutes; then goes on without it, said once -- a
|        lock that cannot be taken never stops a publish (the coverage check before every post still guards the rule).
|    #>
|    param([int]$WaitSeconds = 1200)
|    $path = [string][Environment]::GetEnvironmentVariable('SI_INGEST_LOCK_FILE')
|    if ([string]::IsNullOrWhiteSpace($path)) { return $null }
|    $until = [datetime]::UtcNow.AddSeconds($WaitSeconds)
|    while ([datetime]::UtcNow -lt $until) {
|        try { return [System.IO.File]::Open($path, [System.IO.FileMode]::OpenOrCreate, [System.IO.FileAccess]::ReadWrite, [System.IO.FileShare]::None) }
|        catch { Start-Sleep -Milliseconds 500 }
|    }
|    Write-Warning ('the table update lock ({0}) was not free for {1} seconds -- this process goes on without it' -f $path, $WaitSeconds)
|    $null
|}
|
|function Exit-SIIngestLock {
|    param($Lock)
|    if ($Lock) { try { $Lock.Dispose() } catch { } }
|}
|
|# =====================================================================================================================
|#  LOG INGESTION OVER PLAIN REST -- SecurityInsight needs no PowerShell module (no AzLogDcrIngestPS, no Az.*).
|# =====================================================================================================================
|<#
|    Every SI call site calls the SI wrapper of the job; each wrapper does it over plain REST (its *Rest function):
|
|        SI wrapper                  replaces (AzLogDcrIngestPS)                            SI REST function
|        Get-SIDceList               Get-AzDceListAll                                       Get-SIDceListRest
|        Get-SIDcrList               Get-AzDcrListAll                                       Get-SIDcrListRest
|        Update-SILogTableSchema     CheckCreateUpdate-TableDcr-Structure                   Update-SILogTableSchemaRest
|        Send-SILogData              Post-AzLogAnalyticsLogIngestCustomLogDcrDce-Output     Send-SILogDataRest
|        Add-SICollectionTime        Add-CollectionTimeToAllEntriesInArray                  Add-SICollectionTimeRest
|        Add-SIColumnData            Add-ColumnDataToAllEntriesInArray                      Add-SIColumnDataRest
|        Repair-SILogColumnName      ValidateFix-AzLogAnalyticsTableSchemaColumnNames       Repair-SILogColumnNameRest
|        Format-SILogRowsToSchema    Build-DataArrayToAlignWithSchema                       Format-SILogRowsToSchemaRest
|        Get-SILogSchemaArray        Get-ObjectSchemaAsArray                                Get-SILogSchemaRest -As Array
|        Get-SILogSchemaHash         Get-ObjectSchemaAsHash                                 Get-SILogSchemaRest -As Hash
|        Test-SILogTableDcrStatus    Get-AzLogAnalyticsTableAzDataCollectionRuleStatus      Test-SILogTableDcrStatusRest
|        Set-SILogTable              CreateUpdate-AzLogAnalyticsCustomLogTableDcr           Set-SILogTableRest
|        Set-SILogDcr                CreateUpdate-AzDataCollectionRuleLogIngestCustomLog    Set-SILogDcrRest
|
|    The wrappers keep the parameter names and types the call sites were written against, so no call site changed.
|
|    PS 5.1 safe: no ?. / ??, no RSA.ImportFromPem. Works on pwsh 7 / Linux (no Cert: drive needed). Community + Pro:
|    this file never references a Pro path.
|#>
|
|function Get-SILogIngestWrapperMap {
|    <# The wrapper -> replaced function -> REST function table above, as data (the wiring tests read it). #>
|    [ordered]@{
|        'Get-SIDceList'            = @{ Replaces = 'Get-AzDceListAll';                                   Rest = 'Get-SIDceListRest' }
|        'Get-SIDcrList'            = @{ Replaces = 'Get-AzDcrListAll';                                   Rest = 'Get-SIDcrListRest' }
|        'Update-SILogTableSchema'  = @{ Replaces = 'CheckCreateUpdate-TableDcr-Structure';               Rest = 'Update-SILogTableSchemaRest' }
|        'Send-SILogData'           = @{ Replaces = 'Post-AzLogAnalyticsLogIngestCustomLogDcrDce-Output'; Rest = 'Send-SILogDataRest' }
|        'Add-SICollectionTime'     = @{ Replaces = 'Add-CollectionTimeToAllEntriesInArray';              Rest = 'Add-SICollectionTimeRest' }
|        'Add-SIColumnData'         = @{ Replaces = 'Add-ColumnDataToAllEntriesInArray';                  Rest = 'Add-SIColumnDataRest' }
|        'Repair-SILogColumnName'   = @{ Replaces = 'ValidateFix-AzLogAnalyticsTableSchemaColumnNames';   Rest = 'Repair-SILogColumnNameRest' }
|        'Format-SILogRowsToSchema' = @{ Replaces = 'Build-DataArrayToAlignWithSchema';                   Rest = 'Format-SILogRowsToSchemaRest' }
|        'Get-SILogSchemaArray'     = @{ Replaces = 'Get-ObjectSchemaAsArray';                            Rest = 'Get-SILogSchemaRest' }
|        'Get-SILogSchemaHash'      = @{ Replaces = 'Get-ObjectSchemaAsHash';                             Rest = 'Get-SILogSchemaRest' }
|        'Test-SILogTableDcrStatus' = @{ Replaces = 'Get-AzLogAnalyticsTableAzDataCollectionRuleStatus';  Rest = 'Test-SILogTableDcrStatusRest' }
|        'Set-SILogTable'           = @{ Replaces = 'CreateUpdate-AzLogAnalyticsCustomLogTableDcr';       Rest = 'Set-SILogTableRest' }
|        'Set-SILogDcr'             = @{ Replaces = 'CreateUpdate-AzDataCollectionRuleLogIngestCustomLog'; Rest = 'Set-SILogDcrRest' }
|    }
|}
|
|# ---- the wrappers ------------------------------------------------------------------------------------------------
|# Each declares the parameters the call sites pass (names + types) and forwards @PSBoundParameters: only what the call
|# site bound, with the value it bound, including -Verbose:$false. NOT `@args`: measured 2026-10-03 on PS 5.1 and 7.6,
|# `@args` splits `-Name:$value` into a bare switch plus a positional value.
|
|function Get-SIDceList {
|    [CmdletBinding()]
|    param([string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation,
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    return (Get-SIDceListRest @PSBoundParameters)
|}
|
|function Get-SIDcrList {
|    [CmdletBinding()]
|    param([string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation,
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    return (Get-SIDcrListRest @PSBoundParameters)
|}
|
|function Get-SIDcrCreateRefusal {
|    <# PURE. The line of a DCR / table create's captured output in which Azure (or the create itself) REFUSED it -- the
|       Microsoft answer to surface, '' when there is none. A refused create never makes the rule appear, so it is not waited for.
|       'skipping create' / 'already exists in' (a rule of that name in ANOTHER resource group) is a refusal too: the create did nothing. #>
|    param([AllowNull()][AllowEmptyString()][string]$CreateOutput)
|    if ([string]::IsNullOrWhiteSpace($CreateOutput)) { return '' }
|    $re = '(?i)AuthorizationFailed|LinkedAuthorizationFailed|\(Forbidden\)|\b403\b|\(Unauthorized\)|\b401\b|InvalidPayload|InvalidTemplate|InvalidRequestContent|BadRequest|ResourceGroupNotFound|SubscriptionNotFound|WorkspaceNotFound|Step 3 threw|skipping create|already exists in'
|    foreach ($l in ($CreateOutput -split '\r?\n')) { if ($l -match $re) { return $l.Trim() } }
|    ''
|}
|
|function Wait-SIDcrReady {
|    <#
|        Fix request 2a40d950 (owner 2026-10-22: no fixed limits on SI's own work): after the table / rule create, WAIT UNTIL
|        THE RULE IS READY and read it back -- never a fixed number of seconds that gives up while Azure is still making it
|        (it was 240 s). A not-found / no-immutableId answer right after a create means "not yet" (REQUIREMENTS #619). It stops
|        only on EVIDENCE that waiting cannot help, and says Microsoft's answer:
|          * the create's own output carries a refusal (Get-SIDcrCreateRefusal) -- before any wait;
|          * Azure says the rule's provisioning FAILED;
|          * reading the rule is refused (401 / 403 -- the identity may not read it);
|          * the create has RETURNED and two read-backs in a row, spaced by the progress pace (-MaxPauseSeconds), find NO rule
|            at all: the create did nothing, so waiting cannot help (review S1: it polled until the job died). A rule that IS
|            there but still provisioning is waited for without a deadline.
|        Any other failed read is a transient answer: said, and read again. Progress is said on every read (elapsed, what was
|        seen); the first read is at once (a rule that is already there costs no wait); the pause between reads grows from -FirstPauseSeconds to -MaxPauseSeconds (a pace, never a deadline).
|        -Probe { } -> @{ ImmutableId; State } of the rule as SI's own lists see it now ($null = not there yet); it throws
|        when the read fails. -Sleep { param($s) } / -Log { param($m) } are seams. Returns @{ Ready; ImmutableId; Waited; Why }.
|    #>
|    param([Parameter(Mandatory)][string]$DcrName, [Parameter(Mandatory)][scriptblock]$Probe, [AllowNull()][AllowEmptyString()][string]$CreateOutput,
|          [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s }, [scriptblock]$Log = { param($m) Write-Host $m },
|          [int]$FirstPauseSeconds = 15, [int]$MaxPauseSeconds = 60, [AllowEmptyString()][string]$Location = '')
|    $refused = Get-SIDcrCreateRefusal -CreateOutput $CreateOutput
|    if ($refused) {
|        # read back ONCE: a refusal of a later part (the table, a role) can come after the rule itself was made -- then it is used
|        $r = $null; try { $r = & $Probe } catch { $r = $null }
|        if ($null -ne $r -and [string]$r.ImmutableId -and [string]$r.ImmutableId -notlike '*location*' -and [string]$r.ImmutableId -ne $Location -and [string]$r.State -notmatch '(?i)^failed$') {
|            & $Log ("DCR '{0}' is ready although the create reported: {1}" -f $DcrName, $refused)
|            return @{ Ready = $true; ImmutableId = [string]$r.ImmutableId; Waited = 0; Why = '' }
|        }
|        return @{ Ready = $false; ImmutableId = ''; Waited = 0; Why = ("the create of DCR '{0}' was refused -- {1}" -f $DcrName, $refused) }
|    }
|    $waited = 0; $pause = [Math]::Max(1, $FirstPauseSeconds); $absent = 0
|    while ($true) {
|        $seen = 'not there yet'
|        try {
|            $r = & $Probe
|            if ($null -ne $r) {
|                $imm = [string]$r.ImmutableId; $st = [string]$r.State
|                if ($st -match '(?i)^failed$') { return @{ Ready = $false; ImmutableId = ''; Waited = $waited; Why = ("Azure reports DCR '{0}' with provisioning state Failed" -f $DcrName) } }
|                if ($imm -and $imm -notlike '*location*' -and $imm -ne $Location) { & $Log ("DCR immutableId resolved after {0}s: {1}" -f $waited, $imm); return @{ Ready = $true; ImmutableId = $imm; Waited = $waited; Why = '' } }
|                $seen = $(if ($st) { "there, provisioning state $st, no immutableId yet" } else { 'there, no immutableId yet' })
|                $absent = 0
|            } else {
|                $absent++
|                if ($absent -ge 2) {
|                    $said = @(([string]$CreateOutput) -split '\r?\n' | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|                    $answer = $(if ($said.Count) { $said[-1] } else { 'nothing (the create returned no output)' })
|                    return @{ Ready = $false; ImmutableId = ''; Waited = $waited; Why = ("the rule was not created; Azure answered: {0} -- DCR '{1}' was not found on two read-backs {2}s apart after the create returned" -f $answer, $DcrName, [Math]::Max(1, $MaxPauseSeconds)) }
|                }
|            }
|        } catch {
|            $m = ("$($_.Exception.Message)" -replace '\s+', ' ').Trim()
|            if ($m -match '(?i)\b401\b|\b403\b|AuthorizationFailed|Forbidden|Unauthorized') { return @{ Ready = $false; ImmutableId = ''; Waited = $waited; Why = ("reading DCR '{0}' was refused -- {1}" -f $DcrName, $m) } }
|            $seen = "the read failed ($m) -- read again"
|        }
|        & $Log ("waiting for DCR '{0}' to be ready ({1}s so far; {2}) ..." -f $DcrName, $waited, $seen)
|        # after a read that found no rule at all, the next read is a full progress pace later (the second read-back of the stop rule)
|        $nap = $(if ($absent -ge 1) { [Math]::Max($pause, [Math]::Max(1, $MaxPauseSeconds)) } else { $pause })
|        & $Sleep $nap
|        $waited += $nap
|        $pause = [Math]::Min([Math]::Max(1, $MaxPauseSeconds), $pause * 2)
|    }
|}
|
|function Update-SILogTableSchema {
|    [CmdletBinding()]
|    param([Array]$Data, [string]$AzLogWorkspaceResourceId, [string]$TableName, [string]$DcrName, [string]$DcrResourceGroup, [string]$DceName,
|          [AllowEmptyCollection()][string]$LogIngestServicePricipleObjectId, [boolean]$AzDcrSetLogIngestApiAppPermissionsDcrLevel,
|          [boolean]$AzLogDcrTableCreateFromAnyMachine, [string]$SchemaMode, [boolean]$EnableUploadViaLogHub,
|          [AllowEmptyCollection()][array]$AzLogDcrTableCreateFromReferenceMachine,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation,
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    # A rule that already feeds ANOTHER table is never repurposed, and columns this call adds to an existing rule are
|    # noted so the post can check that they are stored (Start-SILogDcrWatch / Complete-SILogDcrWatch, below).
|    $watch = Start-SILogDcrWatch -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -TableName $TableName -WorkspaceResourceId $AzLogWorkspaceResourceId -Bound $PSBoundParameters
|    # A NEW rule for a table that already exists is declared from the TABLE (its columns, with their types):
|    # Set-SILogDcrRest does this itself.
|    $out = Update-SILogTableSchemaRest @PSBoundParameters
|    # The rule this install posts through must declare EVERY column of the data -- a column it does not declare is
|    # dropped by Azure without an error. Missing ones are added from the table; any still missing refuses the post.
|    # Before Complete-SILogDcrWatch, so columns added here are checked after the post like any other new column.
|    $null = Assert-SILogDcrCoversData -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -TableName $TableName -WorkspaceResourceId $AzLogWorkspaceResourceId -DceName $DceName -Data $Data -Bound $PSBoundParameters
|    Complete-SILogDcrWatch -Watch $watch
|    $out
|}
|
|function Send-SILogData {
|    [CmdletBinding()]
|    param([array]$Data, [AllowEmptyString()][string]$DcrName, [AllowEmptyString()][string]$DceName, [string]$TableName,
|          [string]$BatchAmount, [bool]$EnableUploadViaLogHub, [string]$LogHubPath,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation, [string]$TenantId,
|          [Nullable[bool]]$EnableCompression, [Nullable[bool]]$UseManagedIdentity, [string]$ManagedIdentityClientId)
|    $out = Send-SILogDataRest @PSBoundParameters
|    # Columns added to this rule earlier in the run: check that Log Analytics really stores their values.
|    Confirm-SILogNewColumns -DcrName $DcrName -TableName $TableName -Data $Data -Bound $PSBoundParameters
|    $out
|}
|
|function Add-SICollectionTime {
|    [CmdletBinding()]
|    param([Array]$Data)
|    return (Add-SICollectionTimeRest @PSBoundParameters)
|}
|
|function Add-SIColumnData {
|    [CmdletBinding()]
|    param([Array]$Data, [string]$Column1Name, [string]$Column1Data, [string]$Column2Name, [string]$Column2Data, [string]$Column3Name, [string]$Column3Data)
|    return (Add-SIColumnDataRest @PSBoundParameters)
|}
|
|function Repair-SILogColumnName {
|    [CmdletBinding()]
|    param([Array]$Data)
|    return (Repair-SILogColumnNameRest @PSBoundParameters)
|}
|
|function Format-SILogRowsToSchema {
|    [CmdletBinding()]
|    param([Array]$Data)
|    return (Format-SILogRowsToSchemaRest @PSBoundParameters)
|}
|
|function Get-SILogSchemaArray {
|    [CmdletBinding()]
|    param([Array]$Data, [string[]]$ReturnType)
|    return (Get-SILogSchemaRest -As Array @PSBoundParameters)
|}
|
|function Get-SILogSchemaHash {
|    [CmdletBinding()]
|    param([Array]$Data, [string[]]$ReturnType)
|    return (Get-SILogSchemaRest -As Hash @PSBoundParameters)
|}
|
|function Test-SILogTableDcrStatus {
|    [CmdletBinding()]
|    param([string]$AzLogWorkspaceResourceId, [string]$TableName, [string]$DcrName, [array]$SchemaSourceObject,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation,
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    return (Test-SILogTableDcrStatusRest @PSBoundParameters)
|}
|
|function Set-SILogTable {
|    [CmdletBinding()]
|    param([string]$TableName, [array]$SchemaSourceObject, [string]$AzLogWorkspaceResourceId, [string]$SchemaMode,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation,
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    return (Set-SILogTableRest @PSBoundParameters)
|}
|
|function Set-SILogDcr {
|    [CmdletBinding()]
|    param([array]$SchemaSourceObject, [string]$AzLogWorkspaceResourceId, [string]$DceName, [string]$DcrResourceGroup, [string]$DcrName, [string]$TableName,
|          [boolean]$AzDcrSetLogIngestApiAppPermissionsDcrLevel, [AllowEmptyCollection()][string]$LogIngestServicePricipleObjectId, [string]$SchemaMode,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation,
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    $watch = Start-SILogDcrWatch -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -TableName $TableName -WorkspaceResourceId $AzLogWorkspaceResourceId -Bound $PSBoundParameters
|    $out = Set-SILogDcrRest @PSBoundParameters
|    Complete-SILogDcrWatch -Watch $watch
|    $out
|}
|
|# =====================================================================================================================
|#  A RULE IS NEVER REPURPOSED, AND NEW COLUMNS ARE CHECKED -- both engines (these run around the wrappers above)
|#
|#  1. A data collection rule that already feeds ANOTHER table is never changed to feed this one. Measured in the 2.2 ->
|#     3.0 upgrade test: a setup-written 2.2 config named its public-IP rule 'dcr-si-publicip-profile' (feeding the 2.2
|#     public-IP table); 3.0's own default uses the same name for its new table, and the module REWROTE the rule -- the
|#     old flow was gone and the first post failed. Start-SILogDcrWatch refuses before anything is written.
|#  2. Columns added to an EXISTING rule land empty for a while: Azure accepts the post, but drops the new columns'
|#     values until the change has reached the ingestion pipeline (measured: the first 3.0 run after the upgrade wrote
|#     SI_AssetName / SI_AssetId empty on 134 of 134 rows; empty again 4 and 18 minutes after a column was added; filled
|#     hours later). The rule shows the new column at once, so the rule itself is no signal. Complete-SILogDcrWatch
|#     notes what was added; Confirm-SILogNewColumns, after the post, asks Log Analytics whether this run's values were
|#     STORED, and when they were not, the run says so and records it (Get-SILogIngestNotes -> the run's outcome is
|#     success-partial, so nothing downstream reads the snapshot as whole).
|#  Every read here is best effort: a rule that cannot be read is never a reason to stop a publish -- only a rule that IS
|#  read and feeds another table is.
|# =====================================================================================================================
|
|function Get-SILogDcrStreams {
|    <# PURE. The streams an existing rule writes: each data flow's outputStream, else the flow's streams; a rule with
|       no data flows -> its declared streams. #>
|    param([AllowNull()]$Dcr)
|    $out = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Dcr -or $null -eq $Dcr.properties) { return @() }
|    foreach ($f in @($Dcr.properties.dataFlows)) {
|        if ($null -eq $f) { continue }
|        $names = if ($f.PSObject.Properties['outputStream'] -and $f.outputStream) { @([string]$f.outputStream) } else { @(@($f.streams) | ForEach-Object { [string]$_ }) }
|        foreach ($n in $names) { if ($n -and -not $out.Contains($n)) { [void]$out.Add($n) } }
|    }
|    if ($out.Count -eq 0 -and $Dcr.properties.streamDeclarations) {
|        foreach ($p in $Dcr.properties.streamDeclarations.PSObject.Properties) { [void]$out.Add([string]$p.Name) }
|    }
|    return $out.ToArray()
|}
|
|function Test-SILogDcrFeedsOtherTable {
|    <# PURE. $true when the rule exists, writes at least one stream, and none of its streams is this table's. #>
|    param([AllowNull()]$Dcr, [Parameter(Mandatory)][string]$TableName)
|    $streams = @(Get-SILogDcrStreams -Dcr $Dcr)
|    if ($streams.Count -eq 0) { return $false }
|    $t = $TableName -replace '_CL$', ''
|    $mine = @(('Custom-' + $t + '_CL'), (Get-SILogStreamName -TableName $t))
|    foreach ($s in $streams) { if ($mine -contains $s) { return $false } }
|    return $true
|}
|
|function Get-SILogDcrStreamColumns {
|    <# PURE. The column names the rule declares for this table's stream (empty when it declares none). #>
|    param([AllowNull()]$Dcr, [Parameter(Mandatory)][string]$TableName)
|    if ($null -eq $Dcr -or $null -eq $Dcr.properties -or -not $Dcr.properties.streamDeclarations) { return @() }
|    $t = $TableName -replace '_CL$', ''
|    foreach ($s in @(('Custom-' + $t + '_CL'), (Get-SILogStreamName -TableName $t))) {
|        $p = $Dcr.properties.streamDeclarations.PSObject.Properties[$s]
|        if ($p) { return @(@($p.Value.columns) | Where-Object { $_ } | ForEach-Object { [string]$_.name }) }
|    }
|    return @()
|}
|
|function Get-SILogAddedColumns {
|    <# PURE. Columns in -After that -Before did not have. #>
|    param([AllowEmptyCollection()][string[]]$Before = @(), [AllowEmptyCollection()][string[]]$After = @())
|    return @(@($After) | Where-Object { $_ -and (@($Before) -notcontains $_) })
|}
|
|function Get-SILogAlternateDcrName {
|    <# PURE. A distinct, deterministic rule name for this install: '<name>-<resource group>', or '<name>-<8-character
|       hash of the resource group>' when that would pass 60 characters -- the rule the profilers' collision rename
|       already uses, so every run derives the same name. #>
|    param([Parameter(Mandatory)][string]$DcrName, [Parameter(Mandatory)][string]$ResourceGroup)
|    $rgClean = ($ResourceGroup -replace '[^a-zA-Z0-9-]', '-').ToLowerInvariant().Trim('-')
|    $name = "$DcrName-$rgClean"
|    if ($name.Length -gt 60) {
|        $sha = [System.Security.Cryptography.SHA1]::Create()
|        try { $h = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($ResourceGroup.ToLowerInvariant())) } finally { $sha.Dispose() }
|        $name = "$DcrName-" + (([BitConverter]::ToString($h) -replace '-', '').Substring(0, 8).ToLowerInvariant())
|    }
|    return $name
|}
|
|function Get-SILogDcrRepurposeMessage {
|    <# The one sentence a refused rule produces. #>
|    param([string]$DcrName, [string]$ResourceGroup, [string[]]$Streams, [string]$TableName)
|    $feeds = (@($Streams) | ForEach-Object { $_ -replace '^Custom-', '' }) -join ', '
|    ("The data collection rule '{0}' (resource group '{1}') already sends data to {2}. It is left unchanged -- changing it to send {3}_CL would stop the data it carries now. Give {3}_CL a rule of its own: set this table's data collection rule name in config\SecurityInsight.custom.ps1 to a new name (it is created automatically)." -f `
|        $DcrName, $ResourceGroup, $feeds, ($TableName -replace '_CL$', ''))
|}
|
|function Get-SILogDcrState {
|    <#
|        The rule as Azure has it NOW (never from the run cache): Known = $false when it cannot be read (no subscription /
|        resource group configured, or the read failed); else Dcr = the rule, or $null when it does not exist.
|    #>
|    param([string]$DcrName, [string]$DcrResourceGroup, [string]$WorkspaceResourceId, $Bound)
|    $scope = Get-SILogIngestScope -WorkspaceResourceId $WorkspaceResourceId -DcrResourceGroup $DcrResourceGroup
|    if (-not $DcrName -or -not $scope.Subscription -or -not $scope.DcrRg) { return [pscustomobject]@{ Known = $false; Dcr = $null; ResourceGroup = $scope.DcrRg } }
|    try {
|        $auth = Resolve-SILogIngestAuth -Bound $Bound
|        $d = Invoke-SILogArm -Path "/subscriptions/$($scope.Subscription)/resourceGroups/$($scope.DcrRg)/providers/Microsoft.Insights/dataCollectionRules/$DcrName" `
|                 -ApiVersion (Get-SILogArmApiVersion Dcr) -Auth $auth -AllowNotFound -NoCache
|        return [pscustomobject]@{ Known = $true; Dcr = $d; ResourceGroup = $scope.DcrRg }
|    } catch {
|        Write-Verbose ("data collection rule '{0}' could not be read before the update: {1}" -f $DcrName, $_.Exception.Message)
|        return [pscustomobject]@{ Known = $false; Dcr = $null; ResourceGroup = $scope.DcrRg }
|    }
|}
|
|function Resolve-SILogDcrNameForTable {
|    <#
|        The rule name this table should post through: -DcrName, unless that rule exists and feeds ANOTHER table -- then
|        Get-SILogAlternateDcrName (when that one is free or already this table's). When the alternate is taken too, the
|        original name is returned and the wrapper refuses it with a clear message. Unknown (cannot be read) -> unchanged.
|        Returns Name + Reason (empty when unchanged).
|    #>
|    param([Parameter(Mandatory)][string]$DcrName, [string]$DcrResourceGroup, [Parameter(Mandatory)][string]$TableName, [string]$WorkspaceResourceId, $Bound)
|    $st = Get-SILogDcrState -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -WorkspaceResourceId $WorkspaceResourceId -Bound $Bound
|    if (-not $st.Known -or -not $st.Dcr -or -not (Test-SILogDcrFeedsOtherTable -Dcr $st.Dcr -TableName $TableName)) {
|        return [pscustomobject]@{ Name = $DcrName; Reason = '' }
|    }
|    $alt = Get-SILogAlternateDcrName -DcrName $DcrName -ResourceGroup ([string]$st.ResourceGroup)
|    $st2 = Get-SILogDcrState -DcrName $alt -DcrResourceGroup $DcrResourceGroup -WorkspaceResourceId $WorkspaceResourceId -Bound $Bound
|    if ($st2.Known -and $st2.Dcr -and (Test-SILogDcrFeedsOtherTable -Dcr $st2.Dcr -TableName $TableName)) {
|        return [pscustomobject]@{ Name = $DcrName; Reason = '' }
|    }
|    $feeds = (@(Get-SILogDcrStreams -Dcr $st.Dcr) | ForEach-Object { $_ -replace '^Custom-', '' }) -join ', '
|    [pscustomobject]@{
|        Name   = $alt
|        Reason = ("the data collection rule '{0}' already sends data to {1} and is left unchanged; {2}_CL uses its own rule '{3}'." -f $DcrName, $feeds, ($TableName -replace '_CL$', ''), $alt)
|    }
|}
|
|function Start-SILogDcrWatch {
|    <# Before a rule is created / updated: refuse a rule that feeds another table; remember the columns it declares. #>
|    param([string]$DcrName, [string]$DcrResourceGroup, [string]$TableName, [string]$WorkspaceResourceId, $Bound)
|    if (-not $DcrName -or -not $TableName) { return $null }
|    $b = @{}; if ($Bound) { foreach ($k in @($Bound.Keys)) { if ($k -notin 'Data', 'SchemaSourceObject') { $b[$k] = $Bound[$k] } } }
|    $st = Get-SILogDcrState -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -WorkspaceResourceId $WorkspaceResourceId -Bound $b
|    if (-not $st.Known) { return $null }
|    if ($st.Dcr -and (Test-SILogDcrFeedsOtherTable -Dcr $st.Dcr -TableName $TableName)) {
|        throw (Get-SILogDcrRepurposeMessage -DcrName $DcrName -ResourceGroup ([string]$st.ResourceGroup) -Streams @(Get-SILogDcrStreams -Dcr $st.Dcr) -TableName $TableName)
|    }
|    [pscustomobject]@{
|        DcrName = $DcrName; DcrResourceGroup = $DcrResourceGroup; TableName = ($TableName -replace '_CL$', ''); WorkspaceResourceId = $WorkspaceResourceId
|        Bound = $b; Existed = [bool]$st.Dcr; Before = @(Get-SILogDcrStreamColumns -Dcr $st.Dcr -TableName $TableName)
|    }
|}
|
|function Complete-SILogDcrWatch {
|    <# After the update: columns an EXISTING rule gained are noted for Confirm-SILogNewColumns. Never throws. #>
|    param($Watch)
|    if (-not $Watch -or -not $Watch.Existed) { return }
|    # The run-health record does not check itself: it is the record a check would report into.
|    if ($Watch.TableName -ieq 'SI_RunHealth') { return }
|    try {
|        $st = Get-SILogDcrState -DcrName $Watch.DcrName -DcrResourceGroup $Watch.DcrResourceGroup -WorkspaceResourceId $Watch.WorkspaceResourceId -Bound $Watch.Bound
|        if (-not $st.Known -or -not $st.Dcr) { return }
|        $added = @(Get-SILogAddedColumns -Before $Watch.Before -After @(Get-SILogDcrStreamColumns -Dcr $st.Dcr -TableName $Watch.TableName))
|        if ($added.Count -eq 0) { return }
|        if (-not ($global:SI_LogIngestNewColumns -is [hashtable])) { $global:SI_LogIngestNewColumns = @{} }
|        $key = $Watch.DcrName.ToLowerInvariant()
|        $ws = if ($Watch.WorkspaceResourceId) { $Watch.WorkspaceResourceId } else { [string]$global:SI_WorkspaceResourceId }
|        if ($global:SI_LogIngestNewColumns.ContainsKey($key)) {
|            $prev = $global:SI_LogIngestNewColumns[$key]
|            $added = @(@($prev.Columns) + @($added) | Select-Object -Unique)
|        }
|        $global:SI_LogIngestNewColumns[$key] = [pscustomobject]@{ Table = $Watch.TableName; Columns = $added; WorkspaceResourceId = $ws; AddedAt = [datetime]::UtcNow }
|    } catch { Write-Verbose ("new-column check skipped: {0}" -f $_.Exception.Message) }
|}
|
|function Get-SILogColumnsWithValues {
|    <# PURE. Of -Columns, those holding a non-empty value in at least one row (only those can be checked). #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [AllowEmptyCollection()][string[]]$Columns = @())
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($c in @($Columns)) {
|        foreach ($r in @($Rows)) {
|            if ($null -eq $r) { continue }
|            $v = if ($r -is [System.Collections.IDictionary]) { $r[$c] } elseif ($r.PSObject.Properties[$c]) { $r.$c } else { $null }
|            if ($null -ne $v -and -not [string]::IsNullOrWhiteSpace([string]$v)) { [void]$out.Add($c); break }
|        }
|    }
|    return $out.ToArray()
|}
|
|function Get-SILogRowColumnNames {
|    <# PURE. Every column name the rows carry (first-seen order, TimeGenerated left out: Azure sets it). #>
|    param([AllowEmptyCollection()][object[]]$Rows = @())
|    $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $names = if ($r -is [System.Collections.IDictionary]) { @($r.Keys | ForEach-Object { [string]$_ }) } else { @($r.PSObject.Properties | ForEach-Object { $_.Name }) }
|        foreach ($n in $names) { if ($n -and $n -ne 'TimeGenerated' -and $seen.Add($n)) { [void]$out.Add($n) } }
|    }
|    return $out.ToArray()
|}
|
|function Get-SILogRowsCollectionTime {
|    <# PURE. The run's CollectionTime from the first row that carries one, as UTC; $null when no row does. #>
|    param([AllowEmptyCollection()][object[]]$Rows = @())
|    foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $v = if ($r -is [System.Collections.IDictionary]) { $r['CollectionTime'] } elseif ($r.PSObject.Properties['CollectionTime']) { $r.CollectionTime } else { $null }
|        if ($null -eq $v -or [string]::IsNullOrWhiteSpace([string]$v)) { continue }
|        if ($v -is [datetime]) { if ($v.Kind -eq [DateTimeKind]::Local) { return $v.ToUniversalTime() }; return [datetime]::SpecifyKind($v, [DateTimeKind]::Utc) }
|        $d = [datetime]::MinValue
|        $styles = [Globalization.DateTimeStyles]::AssumeUniversal -bor [Globalization.DateTimeStyles]::AdjustToUniversal
|        if ([datetime]::TryParse([string]$v, [Globalization.CultureInfo]::InvariantCulture, $styles, [ref]$d)) { return $d }
|    }
|    return $null
|}
|
|function Get-SILogColumnCheckKql {
|    <# PURE. Rows of this run in the table, and how many carry a value in each new column (C0, C1, ... in -Columns order). #>
|    param([Parameter(Mandatory)][string]$TableName, [Parameter(Mandatory)][string[]]$Columns, [AllowNull()]$CollectionTime, [AllowNull()]$PostedSince)
|    $t = ($TableName -replace '_CL$', '') -replace '[^A-Za-z0-9_]', ''
|    $agg = for ($i = 0; $i -lt $Columns.Count; $i++) {
|        'C{0} = countif(isnotempty(tostring(column_ifexists("{1}", ""))))' -f $i, ($Columns[$i] -replace '[^A-Za-z0-9_]', '')
|    }
|    $filter = if ($CollectionTime) {
|        $ct = ([datetime]$CollectionTime).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ', [Globalization.CultureInfo]::InvariantCulture)
|        "| where TimeGenerated > ago(2d)`n| where CollectionTime between (datetime($ct) - 2s .. datetime($ct) + 2s)"
|    } else {
|        $since = ([datetime]$PostedSince).ToUniversalTime().AddMinutes(-1).ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture)
|        "| where TimeGenerated >= datetime($since)"
|    }
|    "{0}_CL`n{1}`n| summarize Rows = count(), {2}" -f $t, $filter, ($agg -join ', ')
|}
|
|function Get-SILogColumnCheckVerdict {
|    <#
|        PURE. One result row of Get-SILogColumnCheckKql -> Verdict:
|          stored      -- rows arrived and every new column holds values
|          not-stored  -- rows arrived and a new column is empty on all of them (Missing names which)
|          not-landed  -- no row of this run is queryable yet
|    #>
|    param([AllowNull()]$Result, [Parameter(Mandatory)][string[]]$Columns)
|    $get = { param($n) if ($null -eq $Result) { 0 } elseif ($Result -is [System.Collections.IDictionary]) { [long]$Result[$n] } elseif ($Result.PSObject.Properties[$n]) { [long]$Result.$n } else { 0 } }
|    $rows = & $get 'Rows'
|    if ($rows -le 0) { return [pscustomobject]@{ Verdict = 'not-landed'; Rows = 0; Missing = @($Columns) } }
|    $missing = @(for ($i = 0; $i -lt $Columns.Count; $i++) { if ((& $get ('C' + $i)) -le 0) { $Columns[$i] } })
|    if ($missing.Count -gt 0) { return [pscustomobject]@{ Verdict = 'not-stored'; Rows = $rows; Missing = $missing } }
|    [pscustomobject]@{ Verdict = 'stored'; Rows = $rows; Missing = @() }
|}
|
|function Invoke-SILogLaQuery {
|    <# One Log Analytics query as the run's identity (the workspace's id read through ARM). Returns the first table's
|       rows as objects. Throws on failure. #>
|    param([Parameter(Mandatory)][string]$WorkspaceResourceId, [Parameter(Mandatory)][string]$Query, $Bound)
|    $auth = Resolve-SILogIngestAuth -Bound $Bound
|    $ws = Invoke-SILogArm -Path $WorkspaceResourceId -ApiVersion (Get-SILogArmApiVersion Table) -Auth $auth
|    $cid = if ($ws -and $ws.properties) { [string]$ws.properties.customerId } else { '' }
|    if (-not $cid) { throw 'the Log Analytics workspace id could not be read' }
|    $r = Invoke-SILogIngestRequest -Method POST -Uri ('https://api.loganalytics.io/v1/workspaces/{0}/query' -f $cid) -Body (@{ query = $Query } | ConvertTo-Json -Compress) `
|             -Resource 'https://api.loganalytics.io/' -Auth $auth -MaxAttempts 3 -What 'Log Analytics query'
|    $j = $r.Content | ConvertFrom-Json
|    $tbl = @($j.tables)[0]
|    if (-not $tbl) { return @() }
|    $names = @(@($tbl.columns) | ForEach-Object { [string]$_.name })
|    foreach ($row in @($tbl.rows)) {
|        $o = [ordered]@{}
|        for ($i = 0; $i -lt $names.Count; $i++) { $o[$names[$i]] = @($row)[$i] }
|        [pscustomobject]$o
|    }
|}
|
|function Wait-SILogColumnsStored {
|    <#
|        Asks Log Analytics, until this run's rows have arrived, whether the new columns hold their values. Polls at 30 s,
|        then 60 s, then every 120 s; stops as soon as the answer is known (stored, or every row arrived with a column
|        empty) or after -WindowSec (default 900: Azure's ingestion delay is normally seconds to a few minutes, so rows
|        that are still missing after 15 minutes are reported, not waited for). A query that fails ends the check.
|    #>
|    param([Parameter(Mandatory)][string]$WorkspaceResourceId, [Parameter(Mandatory)][string]$TableName, [Parameter(Mandatory)][string[]]$Columns,
|          [AllowNull()]$CollectionTime, [AllowNull()]$PostedSince, [int]$ExpectedRows = 1, $Bound, [int]$WindowSec = 0)
|    if ($WindowSec -le 0) { $WindowSec = 900; $o = 0; if ([int]::TryParse([string]$global:SI_LogIngest_NewColumnCheckSec, [ref]$o) -and $o -gt 0) { $WindowSec = $o } }
|    $kql = Get-SILogColumnCheckKql -TableName $TableName -Columns $Columns -CollectionTime $CollectionTime -PostedSince $PostedSince
|    $waited = 0; $step = 30
|    $last = [pscustomobject]@{ Verdict = 'not-landed'; Rows = 0; Missing = @($Columns) }
|    while ($true) {
|        Start-Sleep -Seconds $step
|        $waited += $step
|        try {
|            $res = @(Invoke-SILogLaQuery -WorkspaceResourceId $WorkspaceResourceId -Query $kql -Bound $Bound)
|            $last = Get-SILogColumnCheckVerdict -Result $(if ($res.Count) { $res[0] } else { $null }) -Columns $Columns
|        } catch {
|            $last = [pscustomobject]@{ Verdict = 'unverified'; Rows = 0; Missing = @($Columns); Detail = $_.Exception.Message }
|            break
|        }
|        if ($last.Verdict -eq 'stored') { break }
|        if ($last.Verdict -eq 'not-stored' -and $last.Rows -ge $ExpectedRows) { break }
|        if ($waited -ge $WindowSec) { break }
|        $step = [Math]::Min(120, $step * 2)
|    }
|    $last | Add-Member -NotePropertyName WaitedSec -NotePropertyValue $waited -Force
|    return $last
|}
|
|function Add-SILogIngestNote {
|    <# Something a publish could not deliver in full, for the run's outcome (Get-SIRunOutcome). #>
|    # -Kind 'column-lag' (#414): only NEW, non-key columns were not stored yet (Azure's propagation delay) -- the rows and
|    # their key columns are there, so a Risk Analysis run says it as a warning and is NOT partial for it.
|    param([Parameter(Mandatory)][string]$Table, [string[]]$Columns = @(), [Parameter(Mandatory)][string]$Message, [string]$Kind = 'incomplete')
|    if (-not ($global:SI_LogIngestNotes -is [System.Collections.Generic.List[object]])) { $global:SI_LogIngestNotes = New-Object System.Collections.Generic.List[object] }
|    [void]$global:SI_LogIngestNotes.Add([pscustomobject]@{ Table = $Table; Columns = @($Columns); Message = $Message; Kind = $Kind })
|}
|
|function Get-SILogIngestNoteKind {
|    <#
|        PURE. 'column-lag' when a 'not-stored' verdict misses only non-key columns; else 'incomplete'.
|        #414 / #294: the KEY columns are the ones a row cannot be placed or read without. A new key column that was not
|        stored is a real loss (the data sync refuses such rows); any other new column not stored yet is propagation lag.
|    #>
|    param([string]$Verdict, [string[]]$Missing = @())
|    $keys = @('CollectionTime', 'ConfigurationId', 'AssetId', 'AssetName', 'ReportName', 'SecuritySeverity', 'CriticalityTier', 'RiskScoreTotal', 'SolutionVersion')
|    if ($Verdict -ne 'not-stored' -or -not @($Missing).Count) { return 'incomplete' }
|    foreach ($m in @($Missing)) { if ($keys -contains ([string]$m).Trim()) { return 'incomplete' } }
|    'column-lag'
|}
|
|function Get-SILogIngestNotes {
|    if ($global:SI_LogIngestNotes -is [System.Collections.Generic.List[object]]) { return $global:SI_LogIngestNotes.ToArray() }
|    return @()
|}
|
|function Reset-SILogIngestNotes {
|    <# At the start of a run: notes and pending column checks belong to ONE run. #>
|    $global:SI_LogIngestNotes = New-Object System.Collections.Generic.List[object]
|    $global:SI_LogIngestNewColumns = @{}
|}
|
|function Confirm-SILogNewColumns {
|    <#
|        After a post through a rule that gained columns earlier in this run: were this run's values for them STORED?
|        Not stored (or not confirmable) -> one warning that says what is missing and that the next run fills it, and a
|        note that makes the run's outcome success-partial. Never throws: the rows themselves were posted.
|    #>
|    param([string]$DcrName, [string]$TableName, [AllowNull()][array]$Data, $Bound)
|    if (-not $DcrName -or -not ($global:SI_LogIngestNewColumns -is [hashtable])) { return }
|    $key = $DcrName.ToLowerInvariant()
|    if (-not $global:SI_LogIngestNewColumns.ContainsKey($key)) { return }
|    $chg = $global:SI_LogIngestNewColumns[$key]
|    $global:SI_LogIngestNewColumns.Remove($key)
|    $table = if ($TableName) { $TableName -replace '_CL$', '' } else { [string]$chg.Table }
|    try {
|        $rows = @($Data)
|        $newCols = @(Get-SILogColumnsWithValues -Rows $rows -Columns @($chg.Columns))
|        # ring 1, 2026-10-11 -- a rule CHANGED right before the post can drop values of columns it had already (added by an
|        # earlier run or job inside Azure's propagation window), not only of the columns this run added. So once this run
|        # changed the rule, EVERY column that carries a value in the posted rows is checked; the new ones first.
|        $cols = @(Get-SILogColumnsWithValues -Rows $rows -Columns @(@($newCols) + @(Get-SILogRowColumnNames -Rows $rows) | Select-Object -Unique))
|        if ($newCols.Count -eq 0 -or $cols.Count -eq 0) { return }
|        # #475: the wait (half a minute or more) is spent ONCE per table per process -- a run that posts its records in
|        # dozens of batches gained new columns batch after batch and waited every time (customer H 2026-10-09)
|        $rcache = Get-SILogIngestRunCache
|        if (-not ($rcache.ConfirmedTables -is [hashtable])) { $rcache.ConfirmedTables = @{} }
|        $tk = $table.ToLowerInvariant()
|        if ($rcache.ConfirmedTables.ContainsKey($tk)) {
|            Write-Host (" [INFO] {0}_CL gained {1} more new column(s) ({2}); this run checked the table's new columns once already, so these are not waited for -- the next run stores them in any case." -f $table, $newCols.Count, ($newCols -join ', '))
|            return
|        }
|        $rcache.ConfirmedTables[$tk] = $true
|        $b = @{}; if ($Bound) { foreach ($k in @($Bound.Keys)) { if ($k -ne 'Data') { $b[$k] = $Bound[$k] } } }
|        Write-Host (" [INFO] {0}_CL gained {1} new column(s) in this run ({2}). Azure takes a while to start storing a new column, so this run checks that the values of every column it posted ({3}) arrived ..." -f $table, $newCols.Count, ($newCols -join ', '), $cols.Count)
|        $res = Wait-SILogColumnsStored -WorkspaceResourceId ([string]$chg.WorkspaceResourceId) -TableName $table -Columns $cols `
|                   -CollectionTime (Get-SILogRowsCollectionTime -Rows $rows) -PostedSince ([datetime]::UtcNow.AddSeconds(-60)) -ExpectedRows $rows.Count -Bound $b
|        if ($res.Verdict -eq 'stored') {
|            Write-Host (" [OK]   {0}_CL: the new column(s) hold this run's values." -f $table)
|            return
|        }
|        $msg = switch ($res.Verdict) {
|            'not-stored' { "{0}_CL: the data collection rule was changed in this run and Azure was not yet storing every column when the rows arrived: this run's values for {1} are missing. The rows are there; the next run stores these columns." -f $table, (@($res.Missing) -join ', ') }
|            'not-landed' { "{0}_CL gained new column(s) in this run ({1}) and this run's rows were not queryable within {2} minutes, so it is not known whether those columns were stored." -f $table, ($cols -join ', '), [int]($res.WaitedSec / 60) }
|            default      { "{0}_CL gained new column(s) in this run ({1}) and it could not be checked whether this run's values were stored ({2})." -f $table, ($cols -join ', '), $res.Detail }
|        }
|        Write-Warning $msg
|        # the run's outcome is judged on the columns this run ADDED (as before); a column the rule already had that read
|        # back empty is said (the warning above) but only ever counts as propagation lag
|        $missNew = @(@($res.Missing) | Where-Object { $newCols -contains $_ })
|        $kind = 'column-lag'
|        if ([string]$res.Verdict -ne 'not-stored') { $kind = 'incomplete' }
|        elseif ($missNew.Count -gt 0) { $kind = Get-SILogIngestNoteKind -Verdict 'not-stored' -Missing $missNew }
|        Add-SILogIngestNote -Table $table -Columns $cols -Message $msg -Kind $kind
|    } catch {
|        $msg = ("{0}_CL gained new column(s) in this run and it could not be checked whether this run's values were stored ({1})." -f $table, $_.Exception.Message)
|        Write-Warning $msg
|        Add-SILogIngestNote -Table $table -Message $msg
|    }
|}
|
|# =====================================================================================================================
|#  THE RULE MUST DECLARE EVERY COLUMN OF THE DATA -- both engines (#294)
|#
|#  Azure stores only the columns a data collection rule DECLARES: every other value of a posted row is dropped, and the
|#  post still answers 204. Found live 2026-10-05 on ring 1: a Risk Analysis Detailed run posted 14,624 rows and only
|#  AssetName, AssetId, the report name and 8 more columns arrived -- CollectionTime, ConfigurationId, SecuritySeverity,
|#  CriticalityTier, RiskScoreTotal and SolutionVersion were EMPTY on every row, and the run logged SUCCESS. The chain:
|#    1. the run used the default rule name (its configuration had not reached the job), a rule that did not exist yet;
|#    2. AzLogDcrIngestPS creates a new rule in two steps -- first with the data's FIRST 11 columns, then with all of
|#       them. The second step was refused (InvalidTransformOutput: a column the data reads as an object, the existing
|#       table holds as text), so the rule was left with 11 columns;
|#    3. on the next run the module looked the rule up BY NAME across the tenant, found another install's same-named
|#       rule with every column, concluded nothing was missing, and the rows went through the 11-column rule.
|#  Set-SILogDcrRest stops step 2 (a new rule for an existing table is declared from the TABLE, with its
|#  types); Assert-SILogDcrCoversData stops step 3 for good: after every table/rule update it reads THE rule this install
|#  posts through (in the configured scope, never by name across the tenant), adds from the table any column of the data
|#  the rule does not declare, and REFUSES the post when a column of the data still is not declared.
|# =====================================================================================================================
|
|function Get-SILogBoundAuth {
|    <# The sign-in arguments of a wrapper call (what Set-SILogDcrRest / Resolve-SILogIngestAuth take), nothing else. #>
|    param($Bound)
|    $b = @{}
|    if ($null -eq $Bound) { return $b }
|    foreach ($k in 'AzAppId', 'AzAppSecret', 'AzAppCertificateThumbprint', 'AzAppCertificateStoreLocation', 'UseManagedIdentity', 'ManagedIdentityClientId', 'TenantId') {
|        if ($Bound.ContainsKey($k) -and $null -ne $Bound[$k] -and "$($Bound[$k])" -ne '') { $b[$k] = $Bound[$k] }
|    }
|    $b
|}
|
|function Get-SILogDataColumnNames {
|    <#
|        PURE. The columns a set of rows carries: the union over EVERY row (first-seen order, names compared without
|        letter case), without TimeGenerated and Log Analytics' own standard columns, and only names a Log Analytics
|        column can have (a name the ingest path drops before posting is not a column of the posted data).
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Rows = @())
|    $std = @('TimeGenerated', 'TenantId', 'Type', '_ResourceId', '_SubscriptionId', 'SourceSystem', 'MG', 'ManagementGroupName', '_BilledSize', '_IsBillable', '_ItemId', '_TimeReceived')
|    $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $names = if ($r -is [System.Collections.IDictionary]) { @($r.Keys) } else { @($r.PSObject.Properties | ForEach-Object { $_.Name }) }
|        foreach ($n in $names) {
|            $s = [string]$n
|            if (-not $s -or $s -notmatch '^[A-Za-z][A-Za-z0-9_]*$' -or ($std -contains $s)) { continue }
|            if ($s.Length -gt 45) { $s = $s.Substring(0, 45) }   # the column name repair cuts a longer name to 45
|            if ($seen.Add($s)) { [void]$out.Add($s) }
|        }
|    }
|    return $out.ToArray()
|}
|
|function Get-SILogNewRuleColumns {
|    <#
|        PURE. The stream declaration of a NEW rule: the table's columns with the table's types when the table exists (then
|        each column of -SchemaSourceObject the table does not have, with its own type); else -SchemaSourceObject.
|        TimeGenerated is never declared (the rule's transform sets it).
|    #>
|    param([AllowNull()]$Table, [AllowNull()][AllowEmptyCollection()][object[]]$SchemaSourceObject = @())
|    $out = New-Object System.Collections.Generic.List[object]
|    $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $add = { param($n, $t) $s = [string]$n; if ($s -and $s -ne 'TimeGenerated' -and $seen.Add($s)) { [void]$out.Add([ordered]@{ name = $s; type = [string]$t }) } }
|    if ($null -ne $Table -and $Table.properties -and $Table.properties.schema) {
|        foreach ($c in @($Table.properties.schema.columns)) { if ($c) { & $add $c.name $c.type } }
|    }
|    foreach ($c in @($SchemaSourceObject)) { if ($c) { & $add $c.name $c.type } }
|    return $out.ToArray()
|}
|
|function Get-SILogDcrCoverageGap {
|    <#
|        PURE. Which of -Columns the rule does NOT declare for this table's stream: Missing (all of them), InTable (those
|        the table has -- the rule can be given them from the table) and NotInTable (those the table does not have).
|    #>
|    param([AllowNull()]$Dcr, [Parameter(Mandatory)][string]$TableName, [AllowEmptyCollection()][string[]]$Columns = @(), [AllowNull()]$Table)
|    $declared = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($n in @(Get-SILogDcrStreamColumns -Dcr $Dcr -TableName $TableName)) { [void]$declared.Add([string]$n) }
|    $inTable = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    if ($null -ne $Table -and $Table.properties -and $Table.properties.schema) {
|        foreach ($c in @($Table.properties.schema.columns)) { if ($c) { [void]$inTable.Add([string]$c.name) } }
|    }
|    $missing = @(@($Columns) | Where-Object { $_ -and -not $declared.Contains([string]$_) })
|    [pscustomobject]@{
|        Missing    = $missing
|        InTable    = @($missing | Where-Object { $inTable.Contains([string]$_) })
|        NotInTable = @($missing | Where-Object { -not $inTable.Contains([string]$_) })
|    }
|}
|
|function Assert-SILogDcrCoversData {
|    <#
|        After a table/rule update: THE rule this install posts through (read in the configured scope) must declare every
|        column of -Data. Columns it lacks that the table has are added from the table (Set-SILogDcrRest, additive); a
|        column still not declared after that REFUSES the post -- throws System.IO.InvalidDataException, because Azure
|        would store the rows without it and answer success. Columns the TABLE does not have either are said and noted
|        (the run is partial), not refused: the table update is what failed there, and it says so itself.
|        Nothing is checked when schema management is off for this machine (the same rule the module applies) or the
|        rule cannot be read (said with -Verbose; Known = $false). Returns @{ Verdict; Added; Missing }.
|    #>
|    param([string]$DcrName, [string]$DcrResourceGroup, [string]$TableName, [string]$WorkspaceResourceId, [string]$DceName, [AllowNull()][array]$Data, $Bound)
|    $res = [pscustomobject]@{ Verdict = 'skipped'; Added = @(); Missing = @() }
|    if (-not $DcrName -or -not $TableName) { return $res }
|    if ($Bound) {
|        if ($Bound.ContainsKey('EnableUploadViaLogHub') -and [bool]$Bound['EnableUploadViaLogHub']) { return $res }
|        if ($Bound.ContainsKey('AzLogDcrTableCreateFromAnyMachine') -and -not [bool]$Bound['AzLogDcrTableCreateFromAnyMachine']) {
|            $ref = if ($Bound.ContainsKey('AzLogDcrTableCreateFromReferenceMachine')) { @($Bound['AzLogDcrTableCreateFromReferenceMachine']) } else { @() }
|            if (-not ($env:COMPUTERNAME -and ($ref -contains $env:COMPUTERNAME))) { return $res }
|        }
|    }
|    $cols = @(Get-SILogDataColumnNames -Rows @($Data))
|    if (-not $cols.Count) { return $res }
|    $t = $TableName -replace '_CL$', ''
|    $b = Get-SILogBoundAuth -Bound $Bound
|    $st = Get-SILogDcrState -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -WorkspaceResourceId $WorkspaceResourceId -Bound $b
|    if (-not $st.Known) { $res.Verdict = 'unknown'; Write-Verbose ("data collection rule '{0}' could not be read -- its columns are not checked" -f $DcrName); return $res }
|    if (-not $st.Dcr) {
|        throw (New-Object System.IO.InvalidDataException(("The data collection rule '{0}' does not exist in resource group '{1}' after the table and rule update, so nothing is posted to {2}_CL." -f $DcrName, $st.ResourceGroup, $t)))
|    }
|    $auth = Resolve-SILogIngestAuth -Bound $b
|    $readTable = { try { Get-SILogTableRest -WorkspaceResourceId $WorkspaceResourceId -TableName $t -Auth $auth -NoCache } catch { $null } }
|    $table = & $readTable
|    $gap = Get-SILogDcrCoverageGap -Dcr $st.Dcr -TableName $t -Columns $cols -Table $table
|    if (-not @($gap.Missing).Count) { $res.Verdict = 'covered'; return $res }
|    if (@($gap.InTable).Count) {
|        Write-Host (" [WARN] the data collection rule '{0}' does not declare {1} column(s) of {2}_CL that this data carries ({3}) -- Azure would drop their values. Adding them to the rule from the table." -f `
|            $DcrName, @($gap.InTable).Count, $t, ((@($gap.InTable) | Select-Object -First 12) -join ', ')) -ForegroundColor Yellow
|        $null = Set-SILogDcrRest -SchemaSourceObject @(@($gap.InTable) | ForEach-Object { @{ name = [string]$_; type = 'string' } }) -AzLogWorkspaceResourceId $WorkspaceResourceId `
|                    -DceName $DceName -DcrResourceGroup ([string]$st.ResourceGroup) -DcrName $DcrName -TableName $t @b
|        $res.Added = @($gap.InTable)
|        $st = Get-SILogDcrState -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -WorkspaceResourceId $WorkspaceResourceId -Bound $b
|        $gap = Get-SILogDcrCoverageGap -Dcr $st.Dcr -TableName $t -Columns $cols -Table $table
|    }
|    $res.Missing = @($gap.Missing)
|    if (@($gap.InTable).Count) {
|        throw (New-Object System.IO.InvalidDataException(("The data collection rule '{0}' does not declare {1} column(s) of {2}_CL that this data carries ({3}) and they could not be added to it. Posting through it would store the rows WITHOUT those values, so nothing is posted." -f `
|            $DcrName, @($gap.InTable).Count, $t, ((@($gap.InTable) | Select-Object -First 20) -join ', '))))
|    }
|    if (@($gap.NotInTable).Count) {
|        $msg = ("{0}_CL does not have {1} column(s) this data carries ({2}), so their values are not stored by this run." -f $t, @($gap.NotInTable).Count, ((@($gap.NotInTable) | Select-Object -First 20) -join ', '))
|        Write-Warning $msg
|        Add-SILogIngestNote -Table $t -Columns @($gap.NotInTable) -Message $msg
|        $res.Verdict = 'partial'
|        return $res
|    }
|    $res.Verdict = 'repaired'
|    return $res
|}
|
|# =====================================================================================================================
|#  REST: run cache, HTTP seam, tokens
|# =====================================================================================================================
|
|function Get-SILogIngestRunCache {
|    <# Per-run (per-process) cache: tokens, ARM reads, DCR ids. Global because this file is dot-sourced at different
|       depths by different engines, and `$script:` would then be a different scope per caller. #>
|    if (-not ($global:SI_LogIngestRunCache -is [hashtable])) {
|        $global:SI_LogIngestRunCache = @{ Tokens = @{}; Arm = @{}; DcrIds = @{} }
|    }
|    return $global:SI_LogIngestRunCache
|}
|
|function Reset-SILogIngestArmCache {
|    <# After any create/update: the next read must see what was just written. #>
|    $c = Get-SILogIngestRunCache
|    $c.Arm = @{}
|}
|
|function Invoke-SILogIngestHttp {
|    <#
|        THE ONE HTTP SEAM. Every REST call in this file goes through here (tests Mock it). Never throws on an HTTP status:
|        returns @{ StatusCode; Content; RetryAfter }. A network failure (no response at all) is StatusCode 0.
|        HttpWebRequest, not Invoke-WebRequest: its error shape is the same on PS 5.1 and pwsh 7, so the body of a 4xx
|        and the Retry-After of a 429 are read the same way on both.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Method,
|        [Parameter(Mandatory)][string]$Uri,
|        [hashtable]$Headers,
|        $Body,
|        [string]$ContentType,
|        [int]$TimeoutSec = 300
|    )
|    if ($PSVersionTable.PSEdition -ne 'Core') {
|        # Windows PowerShell 5.1 on an older .NET Framework may not offer TLS 1.2 by default; Azure requires it.
|        [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
|    }
|    $req = [System.Net.HttpWebRequest]::Create($Uri)
|    $req.Method = $Method.ToUpperInvariant()
|    $req.Timeout = $TimeoutSec * 1000
|    $req.ReadWriteTimeout = $TimeoutSec * 1000
|    $req.Accept = 'application/json'
|    if ($Headers) {
|        foreach ($k in $Headers.Keys) {
|            if ($k -eq 'Content-Type') { $req.ContentType = [string]$Headers[$k] }
|            elseif ($k -eq 'Accept')   { $req.Accept = [string]$Headers[$k] }
|            else { $req.Headers[$k] = [string]$Headers[$k] }
|        }
|    }
|    if ($ContentType) { $req.ContentType = $ContentType }
|    if ($null -ne $Body) {
|        # statements, never `= if (...) { $Body }`: an if-expression enumerates a byte array into object[]
|        [byte[]]$bytes = $null
|        if ($Body -is [byte[]]) { $bytes = $Body } else { $bytes = [System.Text.Encoding]::UTF8.GetBytes([string]$Body) }
|        $req.ContentLength = $bytes.Length
|        $s = $req.GetRequestStream()
|        try { $s.Write($bytes, 0, $bytes.Length) } finally { $s.Close() }
|    } elseif ($req.Method -in 'POST', 'PUT', 'PATCH') {
|        $req.ContentLength = 0
|    }
|    $resp = $null
|    try { $resp = $req.GetResponse() }
|    catch {
|        $we = $_.Exception
|        while ($we -and -not ($we -is [System.Net.WebException])) { $we = $we.InnerException }
|        if ($we -and $we.Response) {
|            $resp = $we.Response
|            # An HTTP status is an answer returned to the caller, not an error of this process: take the caught record
|            # back out of $Error (setup shows every new entry -- each probe printed "(404) Not Found", 2026-10-06).
|            if ($global:Error.Count -gt 0 -and [object]::ReferenceEquals($global:Error[0], $_)) { $global:Error.RemoveAt(0) }
|        }
|        else { return [pscustomobject]@{ StatusCode = 0; Content = [string]$_.Exception.Message; RetryAfter = $null } }
|    }
|    try {
|        $text = ''
|        $rs = $resp.GetResponseStream()
|        if ($rs) { $sr = New-Object System.IO.StreamReader($rs); try { $text = $sr.ReadToEnd() } finally { $sr.Close() } }
|        return [pscustomobject]@{ StatusCode = [int]$resp.StatusCode; Content = $text; RetryAfter = [string]$resp.Headers['Retry-After'] }
|    } finally { $resp.Close() }
|}
|
|function Initialize-SILogIngestAuthHelpers {
|    <# The managed-identity and certificate token helpers live in auth/. Loaded on first need, never at file load. #>
|    # Only what is MISSING is loaded, and only that is published to the global scope (it was dot-sourced inside this
|    # function, so it would vanish on return). Something already visible -- the engine's own copy, a test's mock -- is
|    # never replaced.
|    $authDir = Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'auth'
|    # The managed-identity helper is NOT loaded here: the run's entry point loads it (the launcher config on a VM / Arc
|    # server, the container entry in a job) -- an engine never does (SIv3-ContainerIdentity). Get-SILogIngestToken
|    # says so when it is missing.
|    $want = @(
|        @{ File = 'Find-SICertificate.ps1'; Fns = @('Get-SICertificateClientToken', 'Get-SICertificateFromStore', 'Test-SICertDriveAvailable') }
|    )
|    foreach ($w in $want) {
|        $missing = @($w.Fns | Where-Object { -not (Get-Command -Name $_ -ErrorAction Ignore) })
|        if ($missing.Count -eq 0) { continue }
|        $p = Join-Path $authDir $w.File
|        if (-not (Test-Path -LiteralPath $p)) { continue }
|        . $p
|        foreach ($n in $missing) {
|            $f = Get-Command -Name $n -CommandType Function -ErrorAction Ignore
|            if ($f) { Set-Item -Path ("function:global:{0}" -f $n) -Value $f.ScriptBlock }
|        }
|    }
|}
|
|function Resolve-SILogIngestAuth {
|    <#
|        The sign-in the call site handed over (the same splat AzLogDcrIngestPS takes), as one decision:
|          ManagedIdentity -- UseManagedIdentity = $true
|          Certificate     -- AzAppId + AzAppCertificateThumbprint + TenantId
|          Secret          -- AzAppId + AzAppSecret + TenantId
|          then the run's own decision: $global:SI_UseManagedIdentity (#222) -> ManagedIdentity, else the run's own
|          sign-in (Resolve-SIAzRestAuth: what Connect-SIAzAccount recorded, else the configured identity).
|        Same precedence as the module: managed identity, then certificate, then secret.
|    #>
|    param($Bound = @{})   # a hashtable or $PSBoundParameters
|    if ($null -eq $Bound) { $Bound = @{} }
|    $g = { param($k) if ($Bound.ContainsKey($k)) { $Bound[$k] } else { $null } }
|    $mi = & $g 'UseManagedIdentity'
|    if ($null -eq $mi -and $null -ne (Get-Variable -Scope Global -Name UseManagedIdentityDefault -ValueOnly -ErrorAction Ignore)) { $mi = (Get-Variable -Scope Global -Name UseManagedIdentityDefault -ValueOnly -ErrorAction Ignore) }
|    $app = [string](& $g 'AzAppId'); $tid = [string](& $g 'TenantId')
|    $thumb = [string](& $g 'AzAppCertificateThumbprint'); $sec = [string](& $g 'AzAppSecret')
|    if ([bool]$mi) {
|        $cid = [string](& $g 'ManagedIdentityClientId'); if (-not $cid) { $cid = [string](Get-Variable -Scope Global -Name SI_UAMI_ClientId -ValueOnly -ErrorAction Ignore) }
|        return @{ Mode = 'ManagedIdentity'; ClientId = $cid }
|    }
|    if ($app -and $thumb -and $tid) { return @{ Mode = 'Certificate'; AppId = $app; TenantId = $tid; Thumbprint = ($thumb -replace '\s', '') } }
|    if ($app -and $sec -and $tid)   { return @{ Mode = 'Secret'; AppId = $app; TenantId = $tid; Secret = $sec } }
|    if ((Get-Variable -Scope Global -Name SI_UseManagedIdentity -ValueOnly -ErrorAction Ignore) -eq $true) { return @{ Mode = 'ManagedIdentity'; ClientId = [string](Get-Variable -Scope Global -Name SI_UAMI_ClientId -ValueOnly -ErrorAction Ignore) } }
|    return @{ Mode = 'Run' }
|}
|
|function Get-SILogIngestToken {
|    <#
|        A bearer token for -Resource (https://monitor.azure.com/ for ingestion, https://management.azure.com/ for ARM),
|        as the identity -Auth (Resolve-SILogIngestAuth) names:
|          ManagedIdentity -- Get-SIManagedIdentityToken (container / Azure VM / Azure Arc endpoint; its own cache)
|          Certificate     -- Get-SICertificateClientToken (JWT client assertion signed from the X509Store; no Cert: drive)
|          Secret          -- client_credentials with the secret
|          Support         -- the Invardia support session's Get-InvardiaSupportToken (#524; SI-AzRest.ps1 Get-SISupportToken)
|          Run             -- the run's own sign-in (Resolve-SIAzRestAuth, over REST; #524: never an Azure session)
|        Cached per identity + resource until 5 minutes before expiry.
|    #>
|    param([Parameter(Mandatory)][string]$Resource, [hashtable]$Auth, [switch]$ForceRefresh)
|    # the supported token hook (see SI-AzRest.ps1): consulted first when set and no explicit sign-in was handed over
|    if (-not $Auth) {
|        $tp = Get-Variable -Scope Global -Name SI_TokenProvider -ValueOnly -ErrorAction Ignore
|        if ($tp -is [scriptblock]) { $pt = [string](& $tp $Resource); if (-not [string]::IsNullOrWhiteSpace($pt)) { return $pt } }
|        $Auth = Resolve-SILogIngestAuth
|    }
|    $res = $Resource.TrimEnd('/') + '/'
|    # #524: the Invardia support session's tokens (Resolve-SIAzRestAuth's Mode 'Support') -- Invardia caches them; the
|    # tenant of each is checked against the one SI works in
|    if ($Auth.Mode -eq 'Support') { return (Get-SISupportToken -Resource $res -TenantId ([string]$Auth.TenantId) -ForceRefresh:$ForceRefresh) }
|    $cache = (Get-SILogIngestRunCache).Tokens
|    $who = switch ($Auth.Mode) { 'Certificate' { $Auth.AppId } 'Secret' { $Auth.AppId } 'ManagedIdentity' { $Auth.ClientId } default { '' } }
|    $key = '{0}|{1}|{2}' -f $Auth.Mode, $who, $res
|    if (-not $ForceRefresh -and $cache.ContainsKey($key) -and $cache[$key].ExpiresAt -gt [datetime]::UtcNow) { return $cache[$key].Token }
|
|    $token = $null; $expiresAt = [datetime]::UtcNow.AddMinutes(45)
|    # A TRANSIENT failure of the token endpoint (the managed-identity endpoint of a container, Entra) is waited out and asked
|    # again, a bounded number of times -- Microsoft's errors (Get-SITransientKind: throttled / timeout / unavailable). Any
|    # other answer (a refused sign-in, a missing certificate) fails at once, as before. The sweep of 2026-10-22: one
|    # IDENTITY_ENDPOINT blip threw through every helper's retry and failed the run.
|    if (-not (Get-Command -Name Get-SITransientKind -ErrorAction Ignore)) { . (Join-Path $PSScriptRoot 'SI-ErrorClass.ps1') }
|    $tokenAttempts = 4
|    for ($tokenTry = 1; $tokenTry -le $tokenAttempts; $tokenTry++) {
|    try {
|    switch ($Auth.Mode) {
|        'ManagedIdentity' {
|            if (-not (Get-Command -Name Get-SIManagedIdentityToken -ErrorAction Ignore)) {
|                throw 'Sign-in as a managed identity was asked for, but the managed-identity sign-in helper is not loaded in this run (its entry point loads it: the launcher configuration or the container entry).'
|            }
|            $token = Get-SIManagedIdentityToken -Resource $res -ClientId ([string]$Auth.ClientId) -ForceRefresh:$ForceRefresh
|        }
|        'Certificate' {
|            Initialize-SILogIngestAuthHelpers
|            $token = Get-SICertificateClientToken -TenantId $Auth.TenantId -ClientId $Auth.AppId -Thumbprint $Auth.Thumbprint -Resource $res
|        }
|        'Secret' {
|            $body = 'client_id={0}&scope={1}&client_secret={2}&grant_type=client_credentials' -f `
|                [uri]::EscapeDataString($Auth.AppId), [uri]::EscapeDataString($res.TrimEnd('/') + '/.default'), [uri]::EscapeDataString($Auth.Secret)
|            $r = Invoke-SILogIngestHttp -Method POST -Uri ('https://login.microsoftonline.com/{0}/oauth2/v2.0/token' -f $Auth.TenantId) `
|                     -Body $body -ContentType 'application/x-www-form-urlencoded'
|            if ([int]$r.StatusCode -lt 200 -or [int]$r.StatusCode -ge 300) {
|                throw ("Sign-in with the client secret failed for {0}. HTTP Status: {1} Response: {2}" -f $res, $r.StatusCode, $r.Content)
|            }
|            $j = $r.Content | ConvertFrom-Json
|            $token = [string]$j.access_token
|            $secs = 0
|            if ([int]::TryParse([string]$j.expires_in, [ref]$secs) -and $secs -gt 600) { $expiresAt = [datetime]::UtcNow.AddSeconds($secs - 300) }
|        }
|        default {
|            $t = Get-SIAzAccessToken -ResourceUrl $res -ErrorAction Stop
|            $token = if ($t.Token -is [System.Security.SecureString]) { [System.Net.NetworkCredential]::new('', $t.Token).Password } else { [string]$t.Token }
|            try { if ($t.ExpiresOn) { $e = ([DateTimeOffset]$t.ExpiresOn).UtcDateTime.AddMinutes(-5); if ($e -lt $expiresAt) { $expiresAt = $e } } } catch { }
|        }
|    }
|    break
|    } catch {
|        $kind = Get-SITransientKind -Message ([string]$_.Exception.Message)
|        if ($kind -eq 'error' -or $tokenTry -ge $tokenAttempts) { throw }
|        $wait = Get-SILogIngestRetryDelay -RetryAfter '' -Attempt $tokenTry
|        Write-Verbose ("The token for {0} ({1} sign-in) was not issued ({2}: {3}) -- asked again in {4} s ({5}/{6})." -f $res, $Auth.Mode, $kind, $_.Exception.Message, $wait, $tokenTry, $tokenAttempts)
|        Start-Sleep -Seconds $wait
|    }
|    }
|    if ([string]::IsNullOrWhiteSpace($token)) { throw ("No access token for {0} ({1} sign-in)." -f $res, $Auth.Mode) }
|    $cache[$key] = @{ Token = $token; ExpiresAt = $expiresAt }
|    return $token
|}
|
|function Get-SILogIngestRetryDelay {
|    <# Seconds to wait before retry -Attempt: the server's Retry-After (seconds or an HTTP date) when it sent one,
|       else exponential (2, 4, 8 ... capped at 60). Never more than 10 minutes: a wait the server asks for had no upper
|       limit, and a run that waits says nothing meanwhile (the retry after it either works or is the answer). #>
|    param([string]$RetryAfter, [int]$Attempt)
|    $s = 0
|    if ($RetryAfter) {
|        if ([int]::TryParse($RetryAfter.Trim(), [ref]$s)) { return [Math]::Min(600, [Math]::Max(1, $s)) }
|        $d = [datetime]::MinValue
|        if ([datetime]::TryParse($RetryAfter, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::AdjustToUniversal, [ref]$d)) {
|            return [int][Math]::Min(600, [Math]::Max(1, [Math]::Ceiling(($d - [datetime]::UtcNow).TotalSeconds)))
|        }
|    }
|    return [int][Math]::Min(60, [Math]::Pow(2, $Attempt))
|}
|
|function Invoke-SILogIngestRequest {
|    <#
|        One authenticated REST call with the retry rule (CLAUDE.md working rule 4):
|          429 / 408 / 5xx / no response -> PLATFORM: wait (Retry-After when sent) and retry in-run
|          401 once                      -> the token is refreshed and the call repeated once
|          404 with -AllowNotFound       -> $null (a lookup that found nothing)
|          any other 4xx                 -> FAIL FAST, the response body in the error: re-sending an invalid request
|                                           burns time and fails identically
|        Returns the response object (StatusCode / Content).
|    #>
|    param(
|        [string]$Method = 'GET',
|        [Parameter(Mandatory)][string]$Uri,
|        $Body,
|        [string]$ContentType = 'application/json',
|        [hashtable]$Headers,
|        [string]$Resource = 'https://management.azure.com/',
|        [hashtable]$Auth,
|        [switch]$AllowNotFound,
|        [int]$MaxAttempts = 6,
|        [string]$What = 'Azure Resource Manager request'
|    )
|    $refreshed = $false; $forceNext = $false
|    for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
|        $token = Get-SILogIngestToken -Resource $Resource -Auth $Auth -ForceRefresh:$forceNext
|        $forceNext = $false
|        $h = @{ 'Authorization' = ('Bearer ' + $token) }
|        if ($Headers) { foreach ($k in $Headers.Keys) { $h[$k] = $Headers[$k] } }
|        $r = Invoke-SILogIngestHttp -Method $Method -Uri $Uri -Headers $h -Body $Body -ContentType $ContentType
|        $code = [int]$r.StatusCode
|        if ($code -ge 200 -and $code -lt 300) { return $r }
|        if ($code -eq 404 -and $AllowNotFound) { return $null }
|        if ($code -eq 401 -and -not $refreshed) { $refreshed = $true; $forceNext = $true; continue }
|        $transient = ($code -eq 0 -or $code -eq 408 -or $code -eq 429 -or $code -ge 500)
|        if ($transient -and $attempt -lt $MaxAttempts) {
|            $wait = Get-SILogIngestRetryDelay -RetryAfter ([string]$r.RetryAfter) -Attempt $attempt
|            Write-Verbose ("{0}: HTTP {1}, retrying in {2}s (attempt {3}/{4})" -f $What, $code, $wait, $attempt, $MaxAttempts)
|            # SAID, not only in the verbose stream (which the publish path switches off): a call that got no answer can
|            # have taken 5 minutes already, and six of them in a row were half an hour without one line in the run log
|            if ($code -eq 0 -or $wait -ge 30) {
|                Write-Host (" [INFO] {0}: {1} -- trying again in {2} second(s) (attempt {3} of {4})" -f $What, $(if ($code -eq 0) { 'no answer from Azure' } else { 'Azure answered HTTP {0}' -f $code }), $wait, $attempt, $MaxAttempts)
|            }
|            Start-Sleep -Seconds $wait
|            continue
|        }
|        throw ("{0} failed. HTTP Status: {1} Response: {2}" -f $What, $code, $r.Content)
|    }
|    throw ("{0} failed after {1} attempts." -f $What, $MaxAttempts)
|}
|
|# =====================================================================================================================
|#  REST: ARM reads/writes, scoped lookups
|# =====================================================================================================================
|
|function Get-SILogArmApiVersion {
|    <# ARM api-versions this file uses (a function, not a variable: the file is dot-sourced at different depths). #>
|    param([Parameter(Mandatory)][ValidateSet('Dce', 'Dcr', 'Table', 'Role')][string]$Kind)
|    switch ($Kind) { 'Dce' { '2022-06-01' } 'Dcr' { '2022-06-01' } 'Table' { '2022-10-01' } 'Role' { '2022-04-01' } }
|}
|
|function Invoke-SILogArm {
|    <# ARM call -> parsed JSON (or $null for a 404 with -AllowNotFound). GETs are cached per run; any write clears it. #>
|    param([string]$Method = 'GET', [Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$ApiVersion, $Body, [hashtable]$Auth, [switch]$AllowNotFound, [switch]$NoCache)
|    $uri = if ($Path -match '^https://') { $Path } else { 'https://management.azure.com' + $Path + $(if ($Path -match '\?') { '&' } else { '?' }) + 'api-version=' + $ApiVersion }
|    $cache = (Get-SILogIngestRunCache).Arm
|    if ($Method -eq 'GET' -and -not $NoCache -and $cache.ContainsKey($uri)) { return $cache[$uri] }
|    $json = if ($null -ne $Body -and -not ($Body -is [string])) { $Body | ConvertTo-Json -Depth 50 -Compress } else { $Body }
|    $r = Invoke-SILogIngestRequest -Method $Method -Uri $uri -Body $json -Auth $Auth -AllowNotFound:$AllowNotFound -What ('Azure Resource Manager {0} {1}' -f $Method, ($uri -replace '\?.*$', ''))
|    $obj = $null
|    if ($r -and -not [string]::IsNullOrWhiteSpace([string]$r.Content)) { $obj = $r.Content | ConvertFrom-Json }
|    if ($Method -eq 'GET') { if (-not $NoCache) { $cache[$uri] = $obj } } else { Reset-SILogIngestArmCache }
|    return $obj
|}
|
|function Get-SILogArmList {
|    <# Every item of an ARM list, following nextLink. #>
|    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$ApiVersion, [hashtable]$Auth)
|    $items = New-Object 'System.Collections.Generic.List[object]'
|    $page = Invoke-SILogArm -Path $Path -ApiVersion $ApiVersion -Auth $Auth
|    while ($page) {
|        foreach ($v in @($page.value)) { if ($null -ne $v) { [void]$items.Add($v) } }
|        if ([string]::IsNullOrWhiteSpace([string]$page.nextLink)) { break }
|        $page = Invoke-SILogArm -Path ([string]$page.nextLink) -ApiVersion $ApiVersion -Auth $Auth
|    }
|    foreach ($i in $items) {
|        # the Resource Graph shape callers already read (subscriptionId / resourceGroup) -- ARM omits them
|        if ([string]$i.id -match '^/subscriptions/([^/]+)/resourceGroups/([^/]+)/') {
|            if (-not $i.PSObject.Properties['subscriptionId']) { $i | Add-Member -NotePropertyName subscriptionId -NotePropertyValue $Matches[1] }
|            if (-not $i.PSObject.Properties['resourceGroup'])  { $i | Add-Member -NotePropertyName resourceGroup -NotePropertyValue $Matches[2] }
|        }
|    }
|    return $items.ToArray()   # enumerated, like the module's list; callers wrap in @()
|}
|
|function Get-SILogIngestScope {
|    <#
|        WHERE this install's endpoint and rules live: subscription + resource groups. Lookups are by NAME within this
|        scope, never tenant-wide -- the same name exists in other environments (measured 2026-10-01: three endpoints
|        named dce-securityinsight in two subscriptions).
|          Subscription  -SubscriptionId, else -WorkspaceResourceId's, else SI_AzSubscriptionId, else SI_WorkspaceResourceId's,
|                        else the 2.2.x SubscriptionId (a new rule is created in the workspace's subscription, as the
|                        module did; SI_AzSubscriptionId is filled from the workspace by Initialize-SIIngestGlobals)
|          DcrRg         -DcrResourceGroup, else SI_DcrResourceGroup
|          DceRg         -DceResourceGroup, else SI_DceResourceGroup, else the DCR resource group
|    #>
|    param([string]$SubscriptionId, [string]$WorkspaceResourceId, [string]$DcrResourceGroup, [string]$DceResourceGroup)
|    $sub = $SubscriptionId
|    if (-not $sub -and $WorkspaceResourceId -match '/subscriptions/([^/]+)/') { $sub = $Matches[1] }
|    if (-not $sub) { $sub = [string]$global:SI_AzSubscriptionId }
|    if (-not $sub -and "$($global:SI_WorkspaceResourceId)" -match '/subscriptions/([^/]+)/') { $sub = $Matches[1] }
|    if (-not $sub) { $sub = [string]$global:SubscriptionId }
|    $dcrRg = if ($DcrResourceGroup) { $DcrResourceGroup } else { [string]$global:SI_DcrResourceGroup }
|    $dceRg = if ($DceResourceGroup) { $DceResourceGroup } elseif ($global:SI_DceResourceGroup) { [string]$global:SI_DceResourceGroup } else { $dcrRg }
|    [pscustomobject]@{ Subscription = $sub; DcrRg = $dcrRg; DceRg = $dceRg }
|}
|
|function Get-SILogScopedList {
|    param([ValidateSet('Dce', 'Dcr')][string]$Kind, [string]$SubscriptionId, [string]$ResourceGroup, [hashtable]$Auth)
|    if ([string]::IsNullOrWhiteSpace($SubscriptionId)) {
|        throw ("No subscription is configured for the data collection {0} lookup (SI_AzSubscriptionId / SI_WorkspaceResourceId). It is never read tenant-wide, because the same name exists in other environments." -f $(if ($Kind -eq 'Dce') { 'endpoint' } else { 'rule' }))
|    }
|    $type = if ($Kind -eq 'Dce') { 'dataCollectionEndpoints' } else { 'dataCollectionRules' }
|    $path = if ($ResourceGroup) { "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroup/providers/Microsoft.Insights/$type" }
|            else { "/subscriptions/$SubscriptionId/providers/Microsoft.Insights/$type" }
|    return (Get-SILogArmList -Path $path -ApiVersion (Get-SILogArmApiVersion $Kind) -Auth $Auth)
|}
|
|function Get-SIDceListRest {
|    <# REST twin of Get-AzDceListAll -- but SCOPED: the configured subscription only (never tenant-wide). Same auth
|       arguments as the module; -SubscriptionId / -ResourceGroup narrow further. #>
|    [CmdletBinding()]
|    param([string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation = 'LocalMachine',
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId, [string]$SubscriptionId, [string]$ResourceGroup)
|    $auth = Resolve-SILogIngestAuth -Bound $PSBoundParameters
|    $scope = Get-SILogIngestScope -SubscriptionId $SubscriptionId
|    return (Get-SILogScopedList -Kind Dce -SubscriptionId $scope.Subscription -ResourceGroup $ResourceGroup -Auth $auth)
|}
|
|function Get-SIDcrListRest {
|    <# REST twin of Get-AzDcrListAll -- scoped to the configured subscription, like Get-SIDceListRest. #>
|    [CmdletBinding()]
|    param([string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation = 'LocalMachine',
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId, [string]$SubscriptionId, [string]$ResourceGroup)
|    $auth = Resolve-SILogIngestAuth -Bound $PSBoundParameters
|    $scope = Get-SILogIngestScope -SubscriptionId $SubscriptionId
|    return (Get-SILogScopedList -Kind Dcr -SubscriptionId $scope.Subscription -ResourceGroup $ResourceGroup -Auth $auth)
|}
|
|function Find-SILogResourceByName {
|    <#
|        A DCR or DCE by NAME in the configured scope:
|          resource group known  -> exactly that resource (GET by its id); nothing else is considered
|          resource group absent -> the subscription's list; one match is used, several refuse (the name is ambiguous)
|        -AnyResourceGroupWhenMissing (endpoints only): not in the resource group, but exactly ONE of that name in the
|        subscription -> that one (an endpoint outside the rules' resource group has always worked); several refuse.
|        Returns $null when there is none.
|    #>
|    param([ValidateSet('Dce', 'Dcr')][string]$Kind, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId, [string]$ResourceGroup, [hashtable]$Auth, [switch]$AnyResourceGroupWhenMissing)
|    $label = if ($Kind -eq 'Dce') { 'data collection endpoint' } else { 'data collection rule' }
|    if ([string]::IsNullOrWhiteSpace($SubscriptionId)) { throw ("No subscription is configured to look up {0} '{1}' in (SI_AzSubscriptionId / SI_WorkspaceResourceId)." -f $label, $Name) }
|    $type = if ($Kind -eq 'Dce') { 'dataCollectionEndpoints' } else { 'dataCollectionRules' }
|    if ($ResourceGroup) {
|        $hit = Invoke-SILogArm -Path "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroup/providers/Microsoft.Insights/$type/$Name" -ApiVersion (Get-SILogArmApiVersion $Kind) -Auth $Auth -AllowNotFound
|        if ($hit -or -not $AnyResourceGroupWhenMissing) { return $hit }
|    }
|    $same = @(Get-SILogScopedList -Kind $Kind -SubscriptionId $SubscriptionId -Auth $Auth | Where-Object { $_ -and $_.name -eq $Name })
|    if ($same.Count -eq 1) { return $same[0] }
|    if ($same.Count -gt 1) {
|        throw ("{0} '{1}' exists {2} times in subscription '{3}'{4}, so nothing was posted -- set the resource group this install uses ({5})." -f `
|            $label, $Name, $same.Count, $SubscriptionId, $(if ($ResourceGroup) { " (none in resource group '$ResourceGroup')" } else { '' }),
|            $(if ($Kind -eq 'Dce') { 'SI_DceResourceGroup' } else { 'SI_DcrResourceGroup' }))
|    }
|    return $null
|}
|
|# =====================================================================================================================
|#  REST: data shape -- exact twins of the module's pre-processing (so 'Rest' declares and posts the same columns)
|# =====================================================================================================================
|
|function Add-SICollectionTimeRest {
|    <#
|        CollectionTime on every row, IDENTICAL across all shards and batches of one run:
|          * a row that already carries a CollectionTime keeps it -- the engines stamp the run's own value upstream
|            ($RunContext.CollectionTime / $global:RA_CollectionTime), and that is the value every shard shares;
|          * a row without one gets this process's run value, minted once and reused by every later call.
|        Same value format as the module ([datetime] from "yyyy-MM-ddTHH:mm:ssK", UTC).
|        DIFFERS FROM THE MODULE ON PURPOSE: Add-CollectionTimeToAllEntriesInArray overwrites every row with the time
|        of THAT call, so a "safety net" call after the upstream stamp replaced the shared run value.
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][Array]$Data)
|    if (-not ($global:SI_LogIngestRunCollectionTime -is [datetime])) {
|        [datetime]$ct = (Get-Date ([datetime]::Now.ToUniversalTime()) -Format 'yyyy-MM-ddTHH:mm:ssK')
|        $global:SI_LogIngestRunCollectionTime = $ct
|    }
|    $out = New-Object 'System.Collections.Generic.List[object]'
|    foreach ($e in $Data) {
|        $p = $e.PSObject.Properties['CollectionTime']
|        if (-not $p -or $null -eq $p.Value -or [string]::IsNullOrWhiteSpace([string]$p.Value)) {
|            $e | Add-Member -MemberType NoteProperty -Name CollectionTime -Value $global:SI_LogIngestRunCollectionTime -Force | Out-Null
|        }
|        [void]$out.Add($e)
|    }
|    return [array]$out.ToArray()
|}
|
|function Add-SIColumnDataRest {
|    <# Twin of Add-ColumnDataToAllEntriesInArray: up to three columns with one value each, on every row. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][Array]$Data, [Parameter(Mandatory)][string]$Column1Name, [Parameter(Mandatory)][AllowEmptyString()][string]$Column1Data,
|          [string]$Column2Name, [string]$Column2Data, [string]$Column3Name, [string]$Column3Data)
|    $out = New-Object 'System.Collections.Generic.List[object]'
|    foreach ($e in $Data) {
|        if ($Column1Name) { $e | Add-Member -MemberType NoteProperty -Name $Column1Name -Value $Column1Data -Force }
|        if ($Column2Name) { $e | Add-Member -MemberType NoteProperty -Name $Column2Name -Value $Column2Data -Force }
|        if ($Column3Name) { $e | Add-Member -MemberType NoteProperty -Name $Column3Name -Value $Column3Data -Force }
|        [void]$out.Add($e)
|    }
|    return [array]$out.ToArray()
|}
|
|function Repair-SILogColumnNameRest {
|    <# Twin of ValidateFix-AzLogAnalyticsTableSchemaColumnNames (1.7.x): prohibited names get '_', ':' '-' '.' are
|       removed, leading '_' trimmed, leading whitespace trimmed, >45 characters cut; renamed columns move to the end
|       of the row with their own values. Rows are rebuilt only when a name needs fixing. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][Array]$Data)
|    $prohibited = @('_ResourceId', 'id', '_ResourceId', '_SubscriptionId', 'TenantId', 'Type', 'UniqueId', 'Title', 'Date')
|    $checked = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $rename = @{}
|    foreach ($e in $Data) {
|        foreach ($p in $e.PSObject.Properties) {
|            $n = $p.Name
|            if (-not $checked.Add($n)) { continue }
|            if ($n -in $prohibited)     { $rename[$n] = $n + '_' }
|            elseif ($n -like '*:*')     { $rename[$n] = $n.Replace(':', '') }
|            elseif ($n -like '*-*')     { $rename[$n] = $n.Replace('-', '') }
|            elseif ($n -like '*.*')     { $rename[$n] = $n.Replace('.', '') }
|            elseif ($n -like '_*')      { $rename[$n] = $n.TrimStart('_') }
|            elseif ($n -like '* *')     { $rename[$n] = $n.TrimStart() }
|            elseif ($n.Length -gt 45)   { $rename[$n] = $n.Substring(0, 45) }
|        }
|    }
|    if ($rename.Count -eq 0) { return [array]$Data }
|    # #639: only a row that CARRIES a name to fix is rebuilt (a copy of that row); every other row is passed on as it is --
|    # never a copy of the whole post. (Not in place: the caller may still read the row by its own names.)
|    $out = New-Object 'System.Collections.Generic.List[object]'
|    foreach ($row in $Data) {
|        $needs = $false
|        foreach ($p in $row.PSObject.Properties) { if ($rename.ContainsKey($p.Name)) { $needs = $true; break } }
|        if (-not $needs) { [void]$out.Add($row); continue }
|        $rebuilt = [ordered]@{}
|        $moved = New-Object 'System.Collections.Generic.List[object]'
|        foreach ($p in $row.PSObject.Properties) {
|            if ($rename.ContainsKey($p.Name)) { [void]$moved.Add($p) } else { $rebuilt[$p.Name] = $p.Value }
|        }
|        foreach ($p in $moved) { $rebuilt[[string]$rename[$p.Name]] = $p.Value }
|        [void]$out.Add([pscustomobject]$rebuilt)
|    }
|    return [array]$out.ToArray()
|}
|
|function Get-SILogSchemaRest {
|    <#
|        Twin of Get-ObjectSchemaAsArray (-As Array) and Get-ObjectSchemaAsHash (-As Hash): the column list of the
|        WHOLE set, each column's type from the first row that carries it, read the way the module reads it -- the row
|        is round-tripped through JSON and the type taken from Get-Member's definition:
|            int* / real* -> int    long* -> long    guid* -> dynamic    string* -> string    datetime* -> datetime
|            bool* -> boolean       object* / PSCustomObject -> dynamic
|        DIFFERENCES FROM THE MODULE (2026-10-11, both made Log Analytics discard values):
|          * a fractional number is `real` -- the module matched none of its patterns and INHERITED the type of the column
|            read just before it (alphabetically), which is how LastSignInDays became datetime;
|          * an empty (null) value does not decide the type: the first row with a value does, 'dynamic' if none has one.
|        KNOWN TRAP KEPT:
|          * 'int' vs 'long' follows the value's size in the first row that has the column.
|        -ReturnType Table adds TimeGenerated (datetime) first and a description per column; DCR (the default for Array)
|        has name + type only. -As Hash returns hashtables and, like the module, nothing without -ReturnType.
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][Array]$Data, [ValidateSet('Array', 'Hash')][string]$As = 'Array', [ValidateSet('Table', 'DCR')][string[]]$ReturnType)
|    $table = New-Object 'System.Collections.Generic.List[object]'
|    $dcr   = New-Object 'System.Collections.Generic.List[object]'
|    $seen  = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    [void]$seen.Add('TimeGenerated')
|    # the module's shapes: Array -> PSCustomObject, Hash -> plain hashtable
|    $mk = { param($n, $t, [switch]$Desc)
|        if ($As -eq 'Hash') { if ($Desc) { @{ name = $n; type = $t; description = '' } } else { @{ name = $n; type = $t } } }
|        elseif ($Desc) { [pscustomobject]@{ name = $n; type = $t; description = '' } }
|        else { [pscustomobject]@{ name = $n; type = $t } }
|    }
|    [void]$table.Add((& $mk 'TimeGenerated' 'datetime' -Desc))
|    # columns seen so far only EMPTY (null): typed from the first row that has a value, 'dynamic' when none has
|    $nullOnly = New-Object 'System.Collections.Generic.List[string]'
|    $nullSet  = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($entry in $Data) {
|        $hasNew = $false
|        foreach ($p in $entry.PSObject.Properties) { if (-not $seen.Contains($p.Name) -and ($null -ne $p.Value -or -not $nullSet.Contains($p.Name))) { $hasNew = $true; break } }
|        if (-not $hasNew) { continue }
|        $cols = $entry | ConvertTo-Json -Depth 100 | ConvertFrom-Json | Get-Member -MemberType NoteProperty
|        foreach ($c in $cols) {
|            if ($seen.Contains($c.Name)) { continue }
|            $d = [string]$c.Definition
|            # ring 1, 2026-10-11 -- THE TYPE IS DECIDED PER COLUMN, NEVER INHERITED. The module's mapping kept the previous
|            # column's type for a definition it did not know (a double), and Get-Member lists the columns alphabetically,
|            # so LastSignInDays (a double) was declared after LastSignInDateTime: datetime -- and every value of it was then
|            # discarded by Log Analytics. A fractional number is `real`; an empty value waits for a row that has one.
|            $objType = $null
|            if ($d -match '^(?i)(System\.)?Object\s') {   # a null value round-trips as "object <name>=null"
|                if ($nullSet.Add($c.Name)) { [void]$nullOnly.Add($c.Name) }
|                continue
|            }
|            if     ($d -like 'int*')      { $objType = 'int' }
|            elseif ($d -like 'real*')     { $objType = 'int' }
|            elseif ($d -like 'long*')     { $objType = 'long' }
|            elseif ($d -like 'double*' -or $d -like 'decimal*' -or $d -like 'float*' -or $d -like 'single*') { $objType = 'real' }
|            elseif ($d -like 'guid*')     { $objType = 'dynamic' }
|            elseif ($d -like 'string*')   { $objType = 'string' }
|            elseif ($d -like 'datetime*') { $objType = 'datetime' }
|            elseif ($d -like 'bool*')     { $objType = 'boolean' }
|            elseif ($d -like 'object*')   { $objType = 'dynamic' }
|            elseif ($d -like 'System.Management.Automation.PSCustomObject*') { $objType = 'dynamic' }
|            else { $objType = 'dynamic' }
|            [void]$seen.Add($c.Name)
|            [void]$table.Add((& $mk $c.Name $objType -Desc))
|            [void]$dcr.Add((& $mk $c.Name $objType))
|        }
|    }
|    foreach ($n in $nullOnly) {
|        if ($seen.Contains($n)) { continue }
|        [void]$seen.Add($n)
|        [void]$table.Add((& $mk $n 'dynamic' -Desc))
|        [void]$dcr.Add((& $mk $n 'dynamic'))
|    }
|    if ($ReturnType -eq 'Table') { return $table.ToArray() }
|    if ($ReturnType -eq 'DCR' -or $As -eq 'Array') { return $dcr.ToArray() }
|}
|
|function Format-SILogRowsToSchemaRest {
|    <# Twin of Build-DataArrayToAlignWithSchema (1.7.x): every row gets every schema column (missing = $null), in
|       schema order; a property the schema does not list (a literal TimeGenerated) is kept, after them.
|       #639: IN PLACE, never a padded copy of the whole post. A PSCustomObject row is aligned on itself (its properties
|       re-ordered, the missing ones added as $null) -- the same row, the same JSON as the copy made before; a row of another
|       kind (a hashtable, a compact .NET row) is replaced in the array by its aligned copy, one row at a time. The post
|       then serialises a batch at a time (Send-SILogDataRest), so nothing of the post is ever held twice. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][Array]$Data)
|    $schema = Get-SILogSchemaRest -Data $Data -As Array
|    if (@($Data).Count -eq 0) { return $Data }
|    $names = New-Object 'System.Collections.Generic.List[string]'
|    foreach ($c in $schema) { [void]$names.Add([string]$c.name) }
|    $nm = $names.ToArray()
|    for ($i = 0; $i -lt $Data.Count; $i++) { $Data[$i] = Format-SILogRowToNamesInPlace -Row $Data[$i] -Names $nm }
|    return $Data
|}
|
|function Format-SILogRowToNamesInPlace {
|    <# ONE row aligned to -Names (missing = $null, in that order, the other properties after them) -- the row itself when
|       it is a PSCustomObject (its properties re-ordered in place; nothing done when it already is aligned), else its
|       aligned copy (Format-SILogRowsToNames). The JSON of the result equals the JSON of Format-SILogRowsToNames. #>
|    param($Row, [Parameter(Mandatory)][AllowEmptyCollection()][string[]]$Names)
|    if ($null -eq $Row) { return $Row }
|    if ($Row.PSObject.BaseObject -isnot [System.Management.Automation.PSCustomObject]) {
|        return @(Format-SILogRowsToNames -Data @($Row) -Names $Names)[0]
|    }
|    $props = $Row.PSObject.Properties
|    # already aligned: the names first, in order, every one present -- nothing to do
|    $all = @($props)
|    $aligned = ($all.Count -ge $Names.Count)
|    if ($aligned) { for ($k = 0; $k -lt $Names.Count; $k++) { if ($all[$k].Name -cne $Names[$k] -or $all[$k] -isnot [System.Management.Automation.PSNoteProperty]) { $aligned = $false; break } } }
|    if ($aligned) { return $Row }
|    foreach ($p in $all) { if ($p -isnot [System.Management.Automation.PSNoteProperty]) { return @(Format-SILogRowsToNames -Data @($Row) -Names $Names)[0] } }
|    $set = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($n in $Names) { [void]$set.Add($n) }
|    # the values, then the properties rebuilt on the same object: the names in order, then the others as they were
|    $vals = @{}
|    $rest = New-Object 'System.Collections.Generic.List[object]'
|    foreach ($p in $all) {
|        if ($set.Contains($p.Name)) { if (-not $vals.ContainsKey($p.Name)) { $vals[$p.Name] = $p } }
|        else { $rest.Add($p) }
|    }
|    foreach ($p in $all) { $props.Remove($p.Name) }
|    foreach ($n in $Names) {
|        $v = $null; if ($vals.ContainsKey($n)) { $v = $vals[$n].Value }
|        $props.Add([System.Management.Automation.PSNoteProperty]::new($n, $v))
|    }
|    foreach ($p in $rest) { $props.Add([System.Management.Automation.PSNoteProperty]::new($p.Name, $p.Value)) }
|    return $Row
|}
|
|function Format-SILogRowsToNames {
|    <# PURE. Format-SILogRowsToSchemaRest's second half: every row gets every column of -Names (missing = $null), in that
|       order; a property not in -Names is kept, after them. Each row on its own -- the names are the whole set's schema, read
|       before (Risk Analysis prepares the rows of one chunk on several cores with it, #744). #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][Array]$Data, [Parameter(Mandatory)][AllowEmptyCollection()][string[]]$Names)
|    $out = New-Object 'System.Collections.Generic.List[object]'
|    foreach ($row in $Data) {
|        $props = $row.PSObject.Properties
|        $a = [ordered]@{}
|        foreach ($n in $Names) { $p = $props[$n]; if ($null -ne $p) { $a[$n] = $p.Value } else { $a[$n] = $null } }
|        foreach ($p in $props) { if (-not $a.Contains($p.Name)) { $a[$p.Name] = $p.Value } }
|        [void]$out.Add([pscustomobject]$a)
|    }
|    return $out.ToArray()
|}
|
|# =====================================================================================================================
|#  REST: table + DCR create / update -- ADDITIVE only
|# =====================================================================================================================
|
|function Get-SILogStreamName {
|    <# 'Custom-<table>_CL', cut to 52 characters (the stream name limit) -- the module's rule. #>
|    param([Parameter(Mandatory)][string]$TableName)
|    $s = 'Custom-' + $TableName + '_CL'
|    if ($s.Length -gt 52) { $s = $s.Substring(0, 52) }
|    return $s
|}
|
|function Get-SILogTableRest {
|    param([Parameter(Mandatory)][string]$WorkspaceResourceId, [Parameter(Mandatory)][string]$TableName, [hashtable]$Auth, [switch]$NoCache)
|    return (Invoke-SILogArm -Path ($WorkspaceResourceId + '/tables/' + $TableName + '_CL') -ApiVersion (Get-SILogArmApiVersion Table) -Auth $Auth -AllowNotFound -NoCache:$NoCache)
|}
|
|function Resolve-SILogDcrForTable {
|    <# The rule this install posts through: the one recorded this run when it was created/updated, else by name in the
|       configured scope (Find-SILogResourceByName). #>
|    param([Parameter(Mandatory)][string]$DcrName, [string]$SubscriptionId, [string]$ResourceGroup, [hashtable]$Auth)
|    $ids = (Get-SILogIngestRunCache).DcrIds
|    $key = $DcrName.ToLowerInvariant()   # the rule created / updated / found THIS run, wherever the caller put it
|    if ($ids.ContainsKey($key)) {
|        $hit = Invoke-SILogArm -Path $ids[$key] -ApiVersion (Get-SILogArmApiVersion Dcr) -Auth $Auth -AllowNotFound
|        if ($hit) { return $hit }
|    }
|    return (Find-SILogResourceByName -Kind Dcr -Name $DcrName -SubscriptionId $SubscriptionId -ResourceGroup $ResourceGroup -Auth $Auth)
|}
|
|function Test-SILogTableDcrStatusRest {
|    <# Twin of Get-AzLogAnalyticsTableAzDataCollectionRuleStatus: $true when the table or the rule must be created or
|       given columns. The rule is looked up in the configured scope, not by name across the tenant. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$AzLogWorkspaceResourceId, [Parameter(Mandatory)][string]$TableName, [Parameter(Mandatory)][string]$DcrName,
|          [Parameter(Mandatory)][array]$SchemaSourceObject, [string]$DcrResourceGroup,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation = 'LocalMachine',
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    $auth = Resolve-SILogIngestAuth -Bound $PSBoundParameters
|    $scope = Get-SILogIngestScope -WorkspaceResourceId $AzLogWorkspaceResourceId -DcrResourceGroup $DcrResourceGroup
|    $needs = $false
|    $t = Get-SILogTableRest -WorkspaceResourceId $AzLogWorkspaceResourceId -TableName $TableName -Auth $auth -NoCache
|    $cols = @(); $std = @()
|    if (-not $t) { $needs = $true }
|    else {
|        $cols = @($t.properties.schema.columns); $std = @($t.properties.schema.standardColumns)
|        foreach ($e in $SchemaSourceObject) {
|            if (-not ($cols | Where-Object { $_.name -eq $e.name }) -and -not ($std | Where-Object { $_.name -eq $e.name })) { $needs = $true }
|        }
|    }
|    $dcr = Resolve-SILogDcrForTable -DcrName $DcrName -SubscriptionId $scope.Subscription -ResourceGroup $scope.DcrRg -Auth $auth
|    if (-not $dcr) { return $true }
|    (Get-SILogIngestRunCache).DcrIds[$DcrName.ToLowerInvariant()] = [string]$dcr.id   # the post uses THIS rule
|    $stream = Get-SILogStreamName -TableName $TableName
|    $dcrCols = @()
|    if ($dcr.properties.streamDeclarations -and $dcr.properties.streamDeclarations.PSObject.Properties[$stream]) { $dcrCols = @($dcr.properties.streamDeclarations.$stream.columns) }
|    $tableCols = @($cols | Where-Object { $_.name -ne 'TimeGenerated' })
|    if ($dcrCols.Count -lt $tableCols.Count) { return $true }
|    foreach ($c in $tableCols) { if (-not ($dcrCols | Where-Object { $_.name -eq $c.name })) { $needs = $true } }
|    return $needs
|}
|
|function Set-SILogTableRest {
|    <#
|        Twin of CreateUpdate-AzLogAnalyticsCustomLogTableDcr, ADDITIVE ONLY:
|          no table   -> PUT it with the schema of the data (TimeGenerated + every column)
|          table      -> the columns it does not have yet are added (PATCH: retention and plan are left as they are); an
|                        existing column is never changed or removed, whatever type the data now suggests
|        A refused write FAILS with Azure's answer. The module's fallback -- DELETE the table and re-create it -- is not
|        copied: it discards data.
|        -SchemaSourceObject: the Table-format schema (Get-SILogSchemaRest -ReturnType Table / Get-ObjectSchemaAsHash).
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$TableName, [Parameter(Mandatory)][array]$SchemaSourceObject, [Parameter(Mandatory)][string]$AzLogWorkspaceResourceId,
|          [string]$SchemaMode = 'Merge',
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation = 'LocalMachine',
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    $auth = Resolve-SILogIngestAuth -Bound $PSBoundParameters
|    $table = $TableName + '_CL'
|    if ($table.Length -gt 45) { Write-Error ("ERROR - Reduce length of tablename, as it has a maximum of 45 characters (current length: {0})" -f $table.Length) }
|    $path = $AzLogWorkspaceResourceId + '/tables/' + $table
|    $cur = Get-SILogTableRest -WorkspaceResourceId $AzLogWorkspaceResourceId -TableName $TableName -Auth $auth -NoCache
|    $toCol = { param($c) [ordered]@{ name = [string]$c.name; type = [string]$c.type; description = '' } }
|    if (-not $cur) {
|        $columns = @($SchemaSourceObject | ForEach-Object { & $toCol $_ })
|        $null = Invoke-SILogArm -Method PUT -Path $path -ApiVersion (Get-SILogArmApiVersion Table) -Auth $auth -Body @{ properties = @{ schema = @{ name = $table; columns = $columns } } }
|        Write-Output ("table {0}: created with {1} column(s)" -f $table, $columns.Count)
|        return
|    }
|    $std = @($cur.properties.schema.standardColumns | ForEach-Object { [string]$_.name })
|    $merged = New-Object 'System.Collections.Generic.List[object]'
|    foreach ($c in @($cur.properties.schema.columns)) { if ($c -and ([string]$c.name -notin $std)) { [void]$merged.Add((& $toCol $c)) } }
|    $added = New-Object 'System.Collections.Generic.List[string]'
|    foreach ($s in $SchemaSourceObject) {
|        if ([string]$s.name -in $std) { continue }
|        if (@($merged | Where-Object { $_.name -eq [string]$s.name }).Count) { continue }
|        [void]$merged.Add((& $toCol $s)); [void]$added.Add([string]$s.name)
|    }
|    if ($added.Count -eq 0) { Write-Output ("table {0}: has every column" -f $table); return }
|    $null = Invoke-SILogArm -Method PATCH -Path $path -ApiVersion (Get-SILogArmApiVersion Table) -Auth $auth -Body @{ properties = @{ schema = @{ name = $table; columns = @($merged.ToArray()) } } }
|    Write-Output ("table {0}: {1} column(s) added ({2})" -f $table, $added.Count, ($added -join ', '))
|}
|
|function Resolve-SILogEndpointForNewRule {
|    <# This install's endpoint, for a NEW rule: by name in SI_DceResourceGroup (else the rules' group) of the
|       subscription; one of that name elsewhere in the subscription is unambiguous; several refuse. #>
|    param([Parameter(Mandatory)][string]$DceName, $Scope, [hashtable]$Auth)
|    $dce = Find-SILogResourceByName -Kind Dce -Name $DceName -SubscriptionId $Scope.Subscription -ResourceGroup $Scope.DceRg -Auth $Auth -AnyResourceGroupWhenMissing
|    if (-not $dce) {
|        throw ("Data collection endpoint '{0}' was not found in resource group '{1}' of subscription '{2}', so nothing was created or posted." -f $DceName, $Scope.DceRg, $Scope.Subscription)
|    }
|    return $dce
|}
|
|function Set-SILogDcrRest {
|    <#
|        Twin of CreateUpdate-AzDataCollectionRuleLogIngestCustomLog, ADDITIVE ONLY:
|          no rule -> PUT one in the configured subscription + resource group, bound to THIS install's endpoint, with the
|                     stream declaration (the data's columns), the workspace destination and the default transform
|          rule    -> the columns the table has and the stream does not are ADDED to the stream declaration; everything
|                     else the rule carries (its endpoint, transform, destinations, other streams) is kept as it is. The
|                     module rebuilt the whole rule instead, re-binding it to the endpoint it found by name (#198).
|        A new rule waits 15 seconds for Azure to settle, as the module did.
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][array]$SchemaSourceObject, [Parameter(Mandatory)][string]$AzLogWorkspaceResourceId, [string]$DceName,
|          [Parameter(Mandatory)][string]$DcrResourceGroup, [Parameter(Mandatory)][string]$DcrName, [Parameter(Mandatory)][string]$TableName,
|          [boolean]$AzDcrSetLogIngestApiAppPermissionsDcrLevel = $false, [AllowEmptyString()][string]$LogIngestServicePricipleObjectId, [string]$SchemaMode = 'Merge',
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation = 'LocalMachine',
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    $auth = Resolve-SILogIngestAuth -Bound $PSBoundParameters
|    $scope = Get-SILogIngestScope -WorkspaceResourceId $AzLogWorkspaceResourceId -DcrResourceGroup $DcrResourceGroup
|    $stream = Get-SILogStreamName -TableName $TableName
|    $wsName = ($AzLogWorkspaceResourceId -split '/')[-1]
|    $dcrPath = "/subscriptions/$($scope.Subscription)/resourceGroups/$DcrResourceGroup/providers/Microsoft.Insights/dataCollectionRules/$DcrName"
|    $ids = (Get-SILogIngestRunCache).DcrIds
|    $key = $DcrName.ToLowerInvariant()
|    $dcr = Invoke-SILogArm -Path $dcrPath -ApiVersion (Get-SILogArmApiVersion Dcr) -Auth $auth -AllowNotFound -NoCache
|    $toCol = { param($c) [ordered]@{ name = [string]$c.name; type = [string]$c.type } }
|
|    if (-not $dcr) {
|        $dce = Resolve-SILogEndpointForNewRule -DceName $DceName -Scope $scope -Auth $auth
|        # #294: a new rule for a table that EXISTS declares the table's columns with the TABLE's types (then any column of
|        # the data the table does not have yet). Declared from the data instead, a type that differs from the table's
|        # (a column the data reads as an object, the table holds as text) makes Azure refuse the rule.
|        $tNew = Get-SILogTableRest -WorkspaceResourceId $AzLogWorkspaceResourceId -TableName $TableName -Auth $auth -NoCache
|        $cols = @(Get-SILogNewRuleColumns -Table $tNew -SchemaSourceObject $SchemaSourceObject)
|        $body = [ordered]@{
|            location   = [string]$dce.location
|            properties = [ordered]@{
|                dataCollectionEndpointId = [string]$dce.id
|                streamDeclarations       = @{ $stream = @{ columns = $cols } }
|                destinations             = @{ logAnalytics = @(@{ workspaceResourceId = $AzLogWorkspaceResourceId; name = $wsName }) }
|                dataFlows                = @(@{ streams = @($stream); destinations = @($wsName); transformKql = 'source | extend TimeGenerated = now()'; outputStream = $stream })
|            }
|        }
|        $created = Invoke-SILogArm -Method PUT -Path $dcrPath -ApiVersion (Get-SILogArmApiVersion Dcr) -Auth $auth -Body $body
|        $ids[$key] = $dcrPath
|        Write-Output ("data collection rule {0}: created on endpoint {1} with {2} column(s)" -f $DcrName, $dce.id, $cols.Count)
|        if ($AzDcrSetLogIngestApiAppPermissionsDcrLevel -and $LogIngestServicePricipleObjectId) {
|            $roleDef = "/subscriptions/$($scope.Subscription)/providers/Microsoft.Authorization/roleDefinitions/3913510d-42f4-4e42-8a64-420c390055eb"
|            try {
|                $null = Invoke-SILogArm -Method PUT -Path ($dcrPath + '/providers/Microsoft.Authorization/roleAssignments/' + [guid]::NewGuid().ToString()) -ApiVersion (Get-SILogArmApiVersion Role) -Auth $auth `
|                    -Body @{ properties = @{ roleDefinitionId = $roleDef; principalId = $LogIngestServicePricipleObjectId; principalType = 'ServicePrincipal' } }
|            } catch { Write-Warning ("Monitoring Metrics Publisher on {0} was not granted: {1}" -f $DcrName, $_.Exception.Message) }
|        }
|        Start-Sleep -Seconds 15
|        return
|    }
|
|    $ids[$key] = [string]$dcr.id
|    # the columns the stream must carry: the table's (after Set-SILogTableRest), plus Computer/RawData when they are
|    # standard columns of a table migrated from v1 -- the module's rule
|    $t = Get-SILogTableRest -WorkspaceResourceId $AzLogWorkspaceResourceId -TableName $TableName -Auth $auth -NoCache
|    $want = New-Object 'System.Collections.Generic.List[object]'
|    if ($t) {
|        foreach ($c in @($t.properties.schema.columns)) { if ($c -and $c.name -ne 'TimeGenerated') { [void]$want.Add((& $toCol $c)) } }
|        foreach ($n in 'Computer', 'RawData') {
|            if (-not @($want | Where-Object { $_.name -eq $n }).Count -and @($t.properties.schema.standardColumns | Where-Object { $_.name -eq $n }).Count) { [void]$want.Add([ordered]@{ name = $n; type = 'string' }) }
|        }
|    } else {
|        foreach ($c in $SchemaSourceObject) { if ($c.name -ne 'TimeGenerated') { [void]$want.Add((& $toCol $c)) } }
|    }
|    $p = $dcr.properties
|    if (-not $p.streamDeclarations) { $p | Add-Member -NotePropertyName streamDeclarations -NotePropertyValue ([pscustomobject]@{}) -Force }
|    $hasStream = [bool]$p.streamDeclarations.PSObject.Properties[$stream]
|    $have = if ($hasStream) { @($p.streamDeclarations.$stream.columns) } else { @() }
|    $merged = New-Object 'System.Collections.Generic.List[object]'
|    foreach ($c in $have) { if ($c) { [void]$merged.Add((& $toCol $c)) } }
|    $added = New-Object 'System.Collections.Generic.List[string]'
|    foreach ($c in $want) { if (-not @($merged | Where-Object { $_.name -eq $c.name }).Count) { [void]$merged.Add($c); [void]$added.Add([string]$c.name) } }
|    if ($added.Count -eq 0) { Write-Output ("data collection rule {0}: has every column" -f $DcrName); return }
|
|    if ($hasStream) { $p.streamDeclarations.$stream.columns = @($merged.ToArray()) }
|    else {
|        $p.streamDeclarations | Add-Member -NotePropertyName $stream -NotePropertyValue ([pscustomobject]@{ columns = @($merged.ToArray()) })
|        $flows = @($p.dataFlows)
|        if (-not @($flows | Where-Object { @($_.streams) -contains $stream }).Count) {
|            $dest = @($p.destinations.logAnalytics)[0]
|            $p.dataFlows = @($flows) + @([pscustomobject]@{ streams = @($stream); destinations = @([string]$dest.name); transformKql = 'source | extend TimeGenerated = now()'; outputStream = $stream })
|        }
|    }
|    $props = [ordered]@{}
|    foreach ($q in $p.PSObject.Properties) { if ($q.Name -notin 'immutableId', 'provisioningState', 'endpoints', 'metadata') { $props[$q.Name] = $q.Value } }
|    $body = [ordered]@{ location = [string]$dcr.location; properties = $props }
|    if ($dcr.PSObject.Properties['kind'] -and $dcr.kind) { $body['kind'] = $dcr.kind }
|    if ($dcr.PSObject.Properties['tags'] -and $dcr.tags) { $body['tags'] = $dcr.tags }
|    $null = Invoke-SILogArm -Method PUT -Path ([string]$dcr.id) -ApiVersion (Get-SILogArmApiVersion Dcr) -Auth $auth -Body $body
|    Write-Output ("data collection rule {0}: {1} column(s) added to {2} ({3})" -f $DcrName, $added.Count, $stream, ($added -join ', '))
|}
|
|function Update-SILogTableSchemaRest {
|    <#
|        Twin of CheckCreateUpdate-TableDcr-Structure: the table and the rule carry every column of the data (the WHOLE
|        set decides the schema). Same arguments as the module. Additive only (Set-SILogTableRest / Set-SILogDcrRest).
|        A table name with '_' first, '-', ':', '.' or a space is refused as the module refuses it (nothing is done).
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][Array]$Data, [Parameter(Mandatory)][string]$AzLogWorkspaceResourceId, [Parameter(Mandatory)][string]$TableName,
|          [Parameter(Mandatory)][string]$DcrName, [string]$DcrResourceGroup, [string]$DceName,
|          [AllowEmptyString()][AllowEmptyCollection()][string]$LogIngestServicePricipleObjectId, [boolean]$AzDcrSetLogIngestApiAppPermissionsDcrLevel = $false,
|          [boolean]$AzLogDcrTableCreateFromAnyMachine, [string]$SchemaMode = 'Merge', [boolean]$EnableUploadViaLogHub = $false,
|          [AllowEmptyCollection()][array]$AzLogDcrTableCreateFromReferenceMachine,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation = 'LocalMachine',
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    if ($TableName -like '_*' -or $TableName -like '*-*' -or $TableName -like '*:*' -or $TableName -like '*.*' -or $TableName -like '* *') {
|        Write-Verbose ("ISSUE - Table name [ {0} ] is not a valid Log Analytics table name" -f $TableName)
|        return
|    }
|    if ($EnableUploadViaLogHub) { return }
|    if (-not ($AzLogDcrTableCreateFromAnyMachine -or ($env:COMPUTERNAME -and $env:COMPUTERNAME -in @($AzLogDcrTableCreateFromReferenceMachine)))) { return }
|    if (-not $DcrResourceGroup) { $DcrResourceGroup = (Get-SILogIngestScope -WorkspaceResourceId $AzLogWorkspaceResourceId).DcrRg }
|    $authArgs = @{}
|    foreach ($k in 'AzAppId', 'AzAppSecret', 'AzAppCertificateThumbprint', 'AzAppCertificateStoreLocation', 'UseManagedIdentity', 'ManagedIdentityClientId', 'TenantId') {
|        if ($PSBoundParameters.ContainsKey($k)) { $authArgs[$k] = $PSBoundParameters[$k] }
|    }
|    $schema = Get-SILogSchemaRest -Data $Data -As Array
|    $needs = Test-SILogTableDcrStatusRest -AzLogWorkspaceResourceId $AzLogWorkspaceResourceId -TableName $TableName -DcrName $DcrName -SchemaSourceObject $schema -DcrResourceGroup $DcrResourceGroup @authArgs
|    if (-not $needs) { Write-Output ("table {0}_CL and rule {1}: every column is declared" -f $TableName, $DcrName); return }
|    Set-SILogTableRest -AzLogWorkspaceResourceId $AzLogWorkspaceResourceId -TableName $TableName -SchemaSourceObject (Get-SILogSchemaRest -Data $Data -As Hash -ReturnType Table) -SchemaMode $SchemaMode @authArgs
|    Set-SILogDcrRest -AzLogWorkspaceResourceId $AzLogWorkspaceResourceId -SchemaSourceObject (Get-SILogSchemaRest -Data $Data -As Hash -ReturnType DCR) `
|        -DceName $DceName -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -TableName $TableName -SchemaMode $SchemaMode `
|        -LogIngestServicePricipleObjectId $LogIngestServicePricipleObjectId -AzDcrSetLogIngestApiAppPermissionsDcrLevel $AzDcrSetLogIngestApiAppPermissionsDcrLevel @authArgs
|}
|
|# =====================================================================================================================
|#  REST: upload
|# =====================================================================================================================
|
|function ConvertTo-SILogGzip {
|    param([Parameter(Mandatory)][byte[]]$Bytes)
|    $ms = New-Object System.IO.MemoryStream
|    try {
|        $gz = New-Object System.IO.Compression.GZipStream($ms, [System.IO.Compression.CompressionMode]::Compress, $true)
|        try { $gz.Write($Bytes, 0, $Bytes.Length) } finally { $gz.Dispose() }
|        return , $ms.ToArray()
|    } finally { $ms.Dispose() }
|}
|
|function Send-SILogIngestBatch {
|    <# Posts rows [List of row JSON bytes] as one JSON array. Measured: when the payload (compressed when -State says
|       so) exceeds the limit, the batch is split in two and each half measured again. #>
|    param([Parameter(Mandatory)]$Rows, [Parameter(Mandatory)][hashtable]$State)
|    $raw = New-Object System.IO.MemoryStream
|    try {
|        $raw.WriteByte(0x5B)
|        for ($i = 0; $i -lt $Rows.Count; $i++) { if ($i -gt 0) { $raw.WriteByte(0x2C) }; $b = $Rows[$i]; $raw.Write($b, 0, $b.Length) }
|        $raw.WriteByte(0x5D)
|        $rawBytes = $raw.ToArray()
|    } finally { $raw.Dispose() }
|    $payload = if ($State.Compress) { ConvertTo-SILogGzip -Bytes $rawBytes } else { $rawBytes }
|    if ($payload.Length -gt $State.MaxBytes) {
|        if ($Rows.Count -eq 1) { throw ("A single record ({0} bytes) is larger than the {1}-byte limit of the Log Ingestion API, so it cannot be posted." -f $payload.Length, $State.MaxBytes) }
|        $half = [int][Math]::Floor($Rows.Count / 2)
|        $a = New-Object 'System.Collections.Generic.List[byte[]]'; $z = New-Object 'System.Collections.Generic.List[byte[]]'
|        for ($i = 0; $i -lt $Rows.Count; $i++) { if ($i -lt $half) { [void]$a.Add($Rows[$i]) } else { [void]$z.Add($Rows[$i]) } }
|        Send-SILogIngestBatch -Rows $a -State $State
|        Send-SILogIngestBatch -Rows $z -State $State
|        return
|    }
|    if ($State.Compress -and $rawBytes.Length -gt 0) { $State.Ratio = [Math]::Max(0.01, $payload.Length / $rawBytes.Length) }
|    $from = $State.Posted + 1; $to = $State.Posted + $Rows.Count
|    Write-Host ''
|    Write-Host ("  Posting data to LogAnalytics table [ {0}_CL ]" -f $State.Table)
|    Write-Host ("    Rows       : {0}..{1} / {2}" -f $from, $to, $State.Total)
|    Write-Host ("    {0} | {1}" -f $(if ($State.Compress) { 'Compression=ON' } else { 'Compression=OFF' }), $State.AuthText)
|    Write-Host ''
|    $h = @{}
|    if ($State.Compress) { $h['Content-Encoding'] = 'gzip' }
|    $null = Invoke-SILogIngestRequest -Method POST -Uri $State.Uri -Body ([byte[]]$payload) -ContentType 'application/json' -Headers $h `
|        -Resource 'https://monitor.azure.com/' -Auth $State.Auth -What 'Log Ingestion API request'
|    $State.Posted += $Rows.Count
|    $State.Bytes += [long]$rawBytes.Length
|    $State.Batches++
|    Write-Host '  SUCCESS - data uploaded to LogAnalytics' -ForegroundColor Green
|}
|
|# =====================================================================================================================
|#  REST: the PARALLEL SENDER (#738) -- for a caller that posts one large result in many calls (Risk Analysis)
|#
|#  A large install, 2026-10-17: 1,138,554 Risk Analysis rows reached Log Analytics at ~2,200 rows a minute (~8.5 hours). Every post
|#  was made, and waited for, in line with the work that builds the rows: the page read, the preparation, the JSON, then one
|#  POST at a time, each ~half full (the batch split in two whenever the compressed size went over the limit).
|#  A sender changes only HOW the rows travel, never WHICH rows or their JSON (the rows are serialised exactly as before, by
|#  Send-SILogDataRest, in the order given):
|#    * each POST is filled close to the API's limit: the rows are compressed, the compressed size MEASURED, and a batch that
|#      comes out over the limit gives back its last rows to the next batch (no half batches); the compression ratio adapts
|#      from every measurement; a 413 from the service lowers the limit and the batch is split and sent again;
|#    * up to -Degree POSTs are in flight at once (a small fixed number, 4), each on its own worker; a 429 / 408 / 5xx / no
|#      answer is retried by its worker after the service's Retry-After, and a 429 holds EVERY worker until then;
|#    * the endpoint, the rule and the token are resolved once per sender (the token from the run's cache, refreshed on 401);
|#    * the rows confirmed by the service (2xx) are COUNTED; Complete-SILogIngestSender throws when they are fewer than the
|#      rows handed over -- the same verdict as before. A failed post stops the next hand-over at once (the error is the
|#      same text as a failed synchronous post).
|#  Started by the caller (Start-SILogIngestSender -TableName), then every Send-SILogData for that table goes through it;
|#  any other table, and every caller that never starts one, posts synchronously exactly as before.
|# =====================================================================================================================
|
|function Get-SILogIngestSenderWorkerScript {
|    <# The worker: one POST with the retry rule (working rule 4), holding while the service asked every worker to wait. #>
|    @'
|param([string]$Uri, [byte[]]$Body, [hashtable]$Headers, [int]$MaxAttempts, $Gate)
|$notes = New-Object 'System.Collections.Generic.List[string]'
|for ($attempt = 1; ; $attempt++) {
|    while ($true) {
|        $until = [long]$Gate['PauseUntil']; $now = [datetime]::UtcNow.Ticks
|        if ($until -le $now) { break }
|        Start-Sleep -Milliseconds ([int][Math]::Min(60000, [Math]::Ceiling(($until - $now) / 10000.0)) + 1)
|    }
|    $r = Invoke-SILogIngestHttp -Method POST -Uri $Uri -Headers $Headers -Body $Body -ContentType 'application/json'
|    $code = [int]$r.StatusCode
|    if ($code -ge 200 -and $code -lt 300) { return @{ Code = $code; Attempts = $attempt; Content = ''; Notes = $notes.ToArray() } }
|    $transient = ($code -eq 0 -or $code -eq 408 -or $code -eq 429 -or $code -ge 500)
|    if (-not $transient -or $attempt -ge $MaxAttempts) { return @{ Code = $code; Attempts = $attempt; Content = [string]$r.Content; Notes = $notes.ToArray() } }
|    $wait = Get-SILogIngestRetryDelay -RetryAfter ([string]$r.RetryAfter) -Attempt $attempt
|    if ($code -eq 429) {
|        [System.Threading.Monitor]::Enter($Gate.SyncRoot)
|        try { $t = [datetime]::UtcNow.AddSeconds($wait).Ticks; if ($t -gt [long]$Gate['PauseUntil']) { $Gate['PauseUntil'] = $t } } finally { [System.Threading.Monitor]::Exit($Gate.SyncRoot) }
|    }
|    if ($code -eq 0 -or $wait -ge 30) {
|        $notes.Add((" [INFO] Log Ingestion API request: {0} -- trying again in {1} second(s) (attempt {2} of {3})" -f $(if ($code -eq 0) { 'no answer from Azure' } else { 'Azure answered HTTP {0}' -f $code }), $wait, $attempt, $MaxAttempts))
|    }
|    [System.Threading.Monitor]::Enter($Gate.SyncRoot)
|    try { $Gate['Retries'] = 1 + [int]$Gate['Retries'] } finally { [System.Threading.Monitor]::Exit($Gate.SyncRoot) }
|    Start-Sleep -Seconds $wait
|}
|'@
|}
|
|function Get-SILogIngestSender {
|    <# The sender started for -TableName in this run ($null when none). #>
|    param([Parameter(Mandatory)][string]$TableName)
|    $c = Get-SILogIngestRunCache
|    if (-not ($c.Senders -is [hashtable])) { return $null }
|    $k = ($TableName -replace '_CL$', '').ToLowerInvariant()
|    if ($c.Senders.ContainsKey($k)) { return $c.Senders[$k] }
|    $null
|}
|
|function Get-SILogIngestPostDegree {
|    <# PURE over the setting. POSTs in flight at once: 4 (a small fixed number). SI_LogIngest_ParallelPosts (global) or the
|       environment variable SI_LOGINGEST_PARALLELPOSTS: 1 / 0 / off = one at a time; a number = that many, at most 8. #>
|    param($Setting = $(Get-Variable -Scope Global -Name SI_LogIngest_ParallelPosts -ValueOnly -ErrorAction Ignore), [AllowNull()][AllowEmptyString()][string]$EnvValue = $env:SI_LOGINGEST_PARALLELPOSTS)
|    $s = if ($null -ne $Setting -and ([string]$Setting).Trim() -ne '') { ([string]$Setting).Trim() } elseif ($EnvValue) { $EnvValue.Trim() } else { '' }
|    if ($s -match '^(?i)(off|false|no|disabled?)$') { return 1 }
|    $n = 0
|    if ($s -ne '' -and [int]::TryParse($s, [ref]$n)) { if ($n -le 1) { return 1 }; return [Math]::Min(8, $n) }
|    4
|}
|
|function Start-SILogIngestSender {
|    <# Starts the sender for -TableName (see the block above). -Degree: POSTs in flight at once (Get-SILogIngestPostDegree).
|       -MaxPayloadBytes: the API's limit per call; each POST is filled to -Fill of it (measured after compression). #>
|    param([Parameter(Mandatory)][string]$TableName, [int]$Degree = 0, [long]$MaxPayloadBytes = 1MB, [double]$Fill = 0.95, [int]$MaxAttempts = 6)
|    if ($Degree -le 0) { $Degree = Get-SILogIngestPostDegree }
|    $c = Get-SILogIngestRunCache
|    if (-not ($c.Senders -is [hashtable])) { $c.Senders = @{} }
|    $k = ($TableName -replace '_CL$', '').ToLowerInvariant()
|    if ($c.Senders.ContainsKey($k)) { Stop-SILogIngestSender -TableName $TableName }
|    $s = @{
|        Table = ($TableName -replace '_CL$', ''); Degree = $Degree; MaxBytes = [long]$MaxPayloadBytes; Fill = $Fill; MaxAttempts = $MaxAttempts
|        Uri = $null; Auth = $null; AuthText = ''; Compress = $true; Ratio = 1.0
|        Pending = (New-Object 'System.Collections.Generic.List[byte[]]'); PendingBytes = 2L
|        InFlight = (New-Object 'System.Collections.Generic.List[object]')
|        Accepted = 0L; Dispatched = 0L; Confirmed = 0L; Bytes = 0L; SentBytes = 0L; Posts = 0; Split413 = 0; MaxSent = 0L
|        Failed = $null; Pool = $null; Gate = [hashtable]::Synchronized(@{ PauseUntil = 0L; Retries = 0 }); Script = (Get-SILogIngestSenderWorkerScript)
|    }
|    if ($Degree -gt 1) {
|        # the worker's environment: the HTTP seam and the retry delay AS THEY ARE in this run (a test's fake service
|        # included), and $SILogSeam (the test seam's shared state, $null in a real run). Never a script block of this
|        # runspace: a worker runs only text it was given.
|        $iss = [System.Management.Automation.Runspaces.InitialSessionState]::CreateDefault2()
|        foreach ($fn in 'Invoke-SILogIngestHttp', 'Get-SILogIngestRetryDelay') {
|            $def = (Get-Command -Name $fn -CommandType Function -ErrorAction Stop).Definition
|            $iss.Commands.Add((New-Object System.Management.Automation.Runspaces.SessionStateFunctionEntry($fn, $def)))
|        }
|        $seam = Get-Variable -Scope Global -Name SILogSeam -ValueOnly -ErrorAction Ignore
|        $iss.Variables.Add((New-Object System.Management.Automation.Runspaces.SessionStateVariableEntry('SILogSeam', $seam, '')))
|        $pool = [System.Management.Automation.Runspaces.RunspaceFactory]::CreateRunspacePool(1, $Degree, $iss, $Host)
|        $pool.Open()
|        $s.Pool = $pool
|    }
|    $c.Senders[$k] = $s
|    $s
|}
|
|function Send-SILogIngestSenderBatch {
|    <# Hands one payload to a worker (or posts it here when the sender has no workers), waiting first while -Degree are in flight. #>
|    param([Parameter(Mandatory)][hashtable]$Sender, [Parameter(Mandatory)][byte[]]$Payload, [Parameter(Mandatory)][hashtable]$Batch)
|    while ($Sender.InFlight.Count -ge [Math]::Max(1, $Sender.Degree)) { Receive-SILogIngestSenderResults -Sender $Sender -WaitOne }
|    # once a post has failed, nothing more goes out (the run fails; the rows not posted are counted as not confirmed)
|    if ($Sender.Failed) { return }
|    $token = Get-SILogIngestToken -Resource 'https://monitor.azure.com/' -Auth $Sender.Auth -ForceRefresh:([bool]$Batch.Refresh)
|    $h = @{ 'Authorization' = ('Bearer ' + $token) }
|    if ($Sender.Compress) { $h['Content-Encoding'] = 'gzip' }
|    $Batch.Payload = $Payload
|    $Sender.Posts++
|    if ($null -eq $Sender.Pool) {
|        $res = & ([scriptblock]::Create($Sender.Script)) $Sender.Uri $Payload $h $Sender.MaxAttempts $Sender.Gate
|        Complete-SILogIngestSenderBatch -Sender $Sender -Batch $Batch -Result $res
|        return
|    }
|    $ps = [powershell]::Create()
|    $ps.RunspacePool = $Sender.Pool
|    [void]$ps.AddScript($Sender.Script).AddArgument($Sender.Uri).AddArgument($Payload).AddArgument($h).AddArgument($Sender.MaxAttempts).AddArgument($Sender.Gate)
|    $Batch.PS = $ps
|    $Batch.Handle = $ps.BeginInvoke()
|    [void]$Sender.InFlight.Add($Batch)
|}
|
|function Complete-SILogIngestSenderBatch {
|    <# One post's answer: 2xx = its rows confirmed (said as before); 401 = sent once more with a fresh token; 413 = the limit
|       is lowered and the batch split and sent again; anything else = the sender has FAILED (same text as a failed post). #>
|    param([Parameter(Mandatory)][hashtable]$Sender, [Parameter(Mandatory)][hashtable]$Batch, $Result)
|    $r = $Result
|    if ($r -is [System.Collections.IEnumerable] -and -not ($r -is [hashtable])) { $r = @($r | Where-Object { $_ -is [hashtable] }) | Select-Object -Last 1 }
|    if (-not ($r -is [hashtable])) { $r = @{ Code = 0; Content = 'the post''s worker returned no answer'; Notes = @() } }
|    foreach ($n in @($r.Notes)) { if ($n) { Write-Host $n } }
|    $code = [int]$r.Code
|    if ($code -ge 200 -and $code -lt 300) {
|        $Sender.Confirmed += $Batch.Rows.Count
|        $Sender.Bytes += [long]$Batch.Raw
|        $Sender.SentBytes += [long]$Batch.Payload.Length
|        if ($Batch.Payload.Length -gt $Sender.MaxSent) { $Sender.MaxSent = [long]$Batch.Payload.Length }
|        Write-Host ''
|        Write-Host ("  Posting data to LogAnalytics table [ {0}_CL ]" -f $Sender.Table)
|        Write-Host ("    Rows       : {0}..{1} / {2}" -f $Batch.From, ($Batch.From + $Batch.Rows.Count - 1), $Sender.Accepted)
|        Write-Host ("    {0} | {1} | {2:n0} bytes" -f $(if ($Sender.Compress) { 'Compression=ON' } else { 'Compression=OFF' }), $Sender.AuthText, $Batch.Payload.Length)
|        Write-Host ''
|        Write-Host '  SUCCESS - data uploaded to LogAnalytics' -ForegroundColor Green
|        return
|    }
|    if ($code -eq 401 -and -not $Batch.Refresh -and -not $Sender.Failed) {
|        $Batch.Refresh = $true
|        Send-SILogIngestSenderBatch -Sender $Sender -Payload $Batch.Payload -Batch $Batch
|        return
|    }
|    if ($code -eq 413 -and $Batch.Rows.Count -gt 1 -and -not $Sender.Failed) {
|        # the service's own limit is lower than ours: lower it under this payload and send the rows again in two
|        $Sender.MaxBytes = [long][Math]::Max(65536, [Math]::Floor($Batch.Payload.Length * 0.9))
|        $Sender.Split413++
|        $half = [int][Math]::Floor($Batch.Rows.Count / 2)
|        $a = New-Object 'System.Collections.Generic.List[byte[]]'; $z = New-Object 'System.Collections.Generic.List[byte[]]'
|        for ($i = 0; $i -lt $Batch.Rows.Count; $i++) { if ($i -lt $half) { [void]$a.Add($Batch.Rows[$i]) } else { [void]$z.Add($Batch.Rows[$i]) } }
|        $Sender.Dispatched -= $Batch.Rows.Count
|        Send-SILogIngestSenderRows -Sender $Sender -Rows $a -From $Batch.From
|        Send-SILogIngestSenderRows -Sender $Sender -Rows $z -From ($Batch.From + $half)
|        return
|    }
|    if (-not $Sender.Failed) { $Sender.Failed = ("Log Ingestion API request failed. HTTP Status: {0} Response: {1}" -f $code, $r.Content) }
|}
|
|function Receive-SILogIngestSenderResults {
|    <# Collects the answers of the posts that finished; -WaitOne waits for at least one (when any is in flight); -All for all. #>
|    param([Parameter(Mandatory)][hashtable]$Sender, [switch]$WaitOne, [switch]$All)
|    while ($Sender.InFlight.Count -gt 0) {
|        $done = @($Sender.InFlight | Where-Object { $_.Handle.IsCompleted })
|        if ($done.Count -eq 0) {
|            if (-not $WaitOne -and -not $All) { return }
|            $handles = [System.Threading.WaitHandle[]]@($Sender.InFlight | ForEach-Object { $_.Handle.AsyncWaitHandle } | Select-Object -First 64)
|            [void][System.Threading.WaitHandle]::WaitAny($handles, 1000)
|            continue
|        }
|        # out of the list first: answering one post can send another (401, 413) and wait for the workers again
|        foreach ($b in $done) { [void]$Sender.InFlight.Remove($b) }
|        # each answer on its own: one that throws (a token fetch for a 401 resend, a record too large in a 413 split) is the
|        # sender's FIRST error -- every other finished post is still counted and its worker disposed
|        foreach ($b in $done) {
|            $res = $null
|            try { $res = @($b.PS.EndInvoke($b.Handle)) | ForEach-Object { $_.psobject.BaseObject } | Where-Object { $_ -is [hashtable] } | Select-Object -Last 1 }
|            catch { $res = @{ Code = 0; Content = $_.Exception.Message; Notes = @() } }
|            finally { try { $b.PS.Dispose() } catch { }; $b.PS = $null; $b.Handle = $null }
|            try { Complete-SILogIngestSenderBatch -Sender $Sender -Batch $b -Result $res }
|            catch { if (-not $Sender.Failed) { $Sender.Failed = [string]$_.Exception.Message } }
|        }
|        if ($WaitOne -and -not $All) { return }
|    }
|}
|
|function Send-SILogIngestSenderCut {
|    <# Makes ONE post from the rows waiting: compressed and MEASURED; over the limit -> the last rows wait for the next post
|       (as many as the measurement says), never a half-empty post: a post that measures under 60% of the limit is not
|       sent yet (the ratio is learnt from it and the rows keep coming) -- unless -Final (the rows left at the end). #>
|    param([Parameter(Mandatory)][hashtable]$Sender, [switch]$Final)
|    $rows = $Sender.Pending
|    if ($rows.Count -eq 0) { return }
|    $take = $rows.Count
|    $limit = [long][Math]::Floor($Sender.MaxBytes * $Sender.Fill)
|    while ($true) {
|        $raw = New-Object System.IO.MemoryStream
|        try {
|            $raw.WriteByte(0x5B)
|            for ($i = 0; $i -lt $take; $i++) { if ($i -gt 0) { $raw.WriteByte(0x2C) }; $b = $rows[$i]; $raw.Write($b, 0, $b.Length) }
|            $raw.WriteByte(0x5D)
|            $rawBytes = $raw.ToArray()
|        } finally { $raw.Dispose() }
|        $payload = if ($Sender.Compress) { ConvertTo-SILogGzip -Bytes $rawBytes } else { $rawBytes }
|        if ($Sender.Compress -and $rawBytes.Length -gt 0) { $Sender.Ratio = [Math]::Max(0.005, $payload.Length / [double]$rawBytes.Length) }
|        if (-not $Final -and $take -eq $rows.Count -and $payload.Length -lt [long]($limit * 0.6)) { return }   # too empty yet: wait for more rows
|        if ($payload.Length -le $limit -or ($payload.Length -le $Sender.MaxBytes -and $take -eq 1)) { break }
|        if ($take -eq 1) { throw ("A single record ({0} bytes) is larger than the {1}-byte limit of the Log Ingestion API, so it cannot be posted." -f $payload.Length, $Sender.MaxBytes) }
|        # as many rows as the measured bytes per row allow, a little under (the next post takes the rest)
|        $take = [int][Math]::Max(1, [Math]::Min($take - 1, [Math]::Floor($take * ($limit * 0.98) / [double]$payload.Length)))
|    }
|    $batchRows = $rows.GetRange(0, $take)
|    $rows.RemoveRange(0, $take)
|    $Sender.PendingBytes = 2L; foreach ($b in $rows) { $Sender.PendingBytes += $b.Length + 1 }
|    $from = $Sender.Dispatched + 1
|    $Sender.Dispatched += $take
|    Send-SILogIngestSenderBatch -Sender $Sender -Payload $payload -Batch @{ Rows = $batchRows; Raw = $rawBytes.Length; From = $from; Refresh = $false }
|}
|
|function Send-SILogIngestSenderRows {
|    <# Adds serialised rows to the sender, in order; a post is made each time the rows waiting reach the measured size of a
|       full one. -From: re-sent rows (a 413 split) keep their numbers and go out at once. #>
|    param([Parameter(Mandatory)][hashtable]$Sender, [Parameter(Mandatory)]$Rows, [long]$From = 0)
|    if ($From -gt 0) {
|        # a split batch: these rows go out as they are (each half measured again), ahead of the rows waiting
|        $keep = $Sender.Pending; $keepBytes = $Sender.PendingBytes
|        $Sender.Pending = New-Object 'System.Collections.Generic.List[byte[]]'; foreach ($b in $Rows) { [void]$Sender.Pending.Add($b) }
|        $saved = $Sender.Dispatched; $Sender.Dispatched = $From - 1
|        while ($Sender.Pending.Count -gt 0) { Send-SILogIngestSenderCut -Sender $Sender -Final }
|        $Sender.Dispatched = $saved + $Rows.Count
|        $Sender.Pending = $keep; $Sender.PendingBytes = $keepBytes
|        return
|    }
|    foreach ($b in $Rows) {
|        if (-not $Sender.Compress -and ($b.Length + 2) -gt $Sender.MaxBytes) {
|            throw ("A single record ({0} bytes) is larger than the {1}-byte limit of the Log Ingestion API, so it cannot be posted." -f ($b.Length + 2), $Sender.MaxBytes)
|        }
|        # raw-bytes ceiling: the limit itself uncompressed; compressed, the fill level over the measured ratio
|        $ceiling = if ($Sender.Compress) { [long][Math]::Min(64MB, [Math]::Floor($Sender.MaxBytes * $Sender.Fill / $Sender.Ratio)) } else { [long][Math]::Floor($Sender.MaxBytes * $Sender.Fill) }
|        $add = $b.Length + $(if ($Sender.Pending.Count -gt 0) { 1 } else { 0 })
|        if ($Sender.Pending.Count -gt 0 -and ($Sender.PendingBytes + $add) -gt $ceiling) {
|            Send-SILogIngestSenderCut -Sender $Sender
|            if ($Sender.Failed) { throw $Sender.Failed }
|            $add = $b.Length + $(if ($Sender.Pending.Count -gt 0) { 1 } else { 0 })
|        }
|        [void]$Sender.Pending.Add($b); $Sender.PendingBytes += $add
|        $Sender.Accepted++
|    }
|    Receive-SILogIngestSenderResults -Sender $Sender
|    if ($Sender.Failed) { throw $Sender.Failed }
|}
|
|function Sync-SILogIngestSender {
|    <# Every row handed over is posted and answered (the rows waiting go out now). Throws when a post failed. #>
|    param([Parameter(Mandatory)][hashtable]$Sender)
|    while ($Sender.Pending.Count -gt 0 -and -not $Sender.Failed) { Send-SILogIngestSenderCut -Sender $Sender -Final }
|    Receive-SILogIngestSenderResults -Sender $Sender -All
|    if ($Sender.Failed) { throw $Sender.Failed }
|}
|
|function Invoke-SILogIngestGuardHeal {
|    <#
|        #733 (owner 2026-10-17: guards heal themselves): a table whose rows Log Analytics accepted IN FULL clears an earlier
|        "rows not accepted" of that table by itself. Once per table per process (the first full post), so the hot path pays one
|        state read per table, not one per post. Never throws; nothing when the guard code is not loaded.
|    #>
|    param([Parameter(Mandatory)][string]$Table)
|    try {
|        if (-not (Get-Command -Name Invoke-SIGuardHeal -ErrorAction Ignore)) { return }
|        if ($null -eq $script:SILogIngestHealed) { $script:SILogIngestHealed = @{} }
|        $t = $Table.ToLowerInvariant()
|        if ($script:SILogIngestHealed.ContainsKey($t)) { return }
|        $script:SILogIngestHealed[$t] = $true
|        $null = Invoke-SIGuardHeal -Checked @(@{ GuardId = 'ingest.rows.short-count'; Subject = $Table; Detail = ('Log Analytics accepted every row for {0}.' -f $Table) }) -Complete $true
|    } catch { }
|}
|
|function Complete-SILogIngestSender {
|    <#
|        The end of the hand-over: the rows waiting are posted, every post is answered, the workers are closed. The rows the
|        service CONFIRMED are counted against the rows handed over -- fewer throws (and is a guard event), as a short
|        synchronous post did. Returns @{ RowsPosted; RowsHandedOver; Posts; BytesPosted; BytesSent; MaxBytesSent; Retries; Split413 }.
|    #>
|    param([Parameter(Mandatory)][string]$TableName)
|    $s = Get-SILogIngestSender -TableName $TableName
|    if ($null -eq $s) { return $null }
|    try { Sync-SILogIngestSender -Sender $s }
|    finally { Close-SILogIngestSender -TableName $TableName }
|    if ($s.Confirmed -ne $s.Accepted) {
|        if (Get-Command -Name Send-SIGuardEvent -ErrorAction Ignore) { $null = Send-SIGuardEvent -GuardId 'ingest.rows.short-count' -Outcome 'refused' -Subject ($s.Table + '_CL') -Detail ("Log Analytics accepted {0} of {1} row(s) for {2}_CL." -f $s.Confirmed, $s.Accepted, $s.Table) -Values @(@{ Name = 'rowsPosted'; Label = 'Rows accepted'; Measured = [long]$s.Confirmed; Limit = [long]$s.Accepted }, @{ Name = 'rowsGiven'; Label = 'Rows sent'; Measured = [long]$s.Accepted }) -HeldCount ([long]$s.Accepted - [long]$s.Confirmed) }
|        throw ("Posted {0} of {1} row(s) to {2}_CL -- the other rows are UNKNOWN, not posted." -f $s.Confirmed, $s.Accepted, $s.Table)
|    }
|    if ([long]$s.Accepted -gt 0) { Invoke-SILogIngestGuardHeal -Table ($s.Table + '_CL') }
|    [pscustomobject]@{ RowsPosted = $s.Confirmed; RowsHandedOver = $s.Accepted; Posts = $s.Posts; BytesPosted = $s.Bytes; BytesSent = $s.SentBytes; MaxBytesSent = $s.MaxSent; Retries = [int]$s.Gate['Retries']; Split413 = $s.Split413 }
|}
|
|function Send-SILogDataToSender {
|    <#
|        Send-SILogDataRest's rows through a sender: serialised EXACTLY as the synchronous path does (ConvertTo-Json -Depth 100
|        -Compress per row, UTF-8, in the order given) and handed over. Returns the synchronous path's result shape: RowsPosted
|        = the rows handed over (the rows CONFIRMED are counted by Complete-SILogIngestSender), BytesPosted = their JSON bytes.
|        When this run added columns to the rule and their check is due (Confirm-SILogNewColumns, after this call), every row
|        handed over is posted and answered first -- the check reads the rows back from Log Analytics.
|    #>
|    param([Parameter(Mandatory)][hashtable]$Sender, [Parameter(Mandatory)][AllowEmptyCollection()][array]$Data, [string]$DcrName)
|    # #639: handed over a BATCH at a time -- the rows serialised so far are handed to the sender once they fill a post
|    # (its measured size), never the whole post serialised first and held as bytes beside the rows
|    $list = New-Object 'System.Collections.Generic.List[byte[]]'
|    $bytes = 1L; $count = 0L; $listBytes = 0L
|    $fill = 1.0; if ($Sender.ContainsKey('Fill') -and $Sender.Fill) { $fill = [double]$Sender.Fill }
|    $ratio = 1.0; if ($Sender.ContainsKey('Ratio') -and $Sender.Ratio) { $ratio = [double]$Sender.Ratio }
|    $max = 1MB; if ($Sender.ContainsKey('MaxBytes') -and $Sender.MaxBytes) { $max = [long]$Sender.MaxBytes }
|    $handAt = [long][Math]::Max(1, [Math]::Floor($max * $fill))
|    if ($Sender.Compress) { $handAt = [long][Math]::Min(64MB, [Math]::Floor($max * $fill / $ratio)) }
|    foreach ($row in $Data) {
|        $b = [System.Text.Encoding]::UTF8.GetBytes((ConvertTo-Json -Depth 100 -InputObject $row -Compress))
|        [void]$list.Add($b); $bytes += $b.Length + 1; $listBytes += $b.Length + 1; $count++
|        if ($listBytes -ge $handAt) {
|            Send-SILogIngestSenderRows -Sender $Sender -Rows $list
|            $list = New-Object 'System.Collections.Generic.List[byte[]]'; $listBytes = 0L
|        }
|    }
|    if ($list.Count -gt 0) { Send-SILogIngestSenderRows -Sender $Sender -Rows $list }
|    $list = $null
|    if ($DcrName -and ($global:SI_LogIngestNewColumns -is [hashtable]) -and $global:SI_LogIngestNewColumns.ContainsKey($DcrName.ToLowerInvariant())) {
|        Sync-SILogIngestSender -Sender $Sender
|    }
|    [pscustomobject]@{ StatusCode = 204; RowsPosted = $count; BytesPosted = $bytes; Batches = 0; Table = ($Sender.Table + '_CL'); Stream = '' }
|}
|
|function Stop-SILogIngestSender {
|    <# After a failure: nothing more is posted; the posts in flight are answered (their rows count), the workers closed.
|       Returns the rows the service confirmed (the rows that DID reach Log Analytics). Never throws. #>
|    param([Parameter(Mandatory)][string]$TableName)
|    $s = Get-SILogIngestSender -TableName $TableName
|    if ($null -eq $s) { return 0L }
|    try { $s.Pending.Clear(); Receive-SILogIngestSenderResults -Sender $s -All } catch { }
|    Close-SILogIngestSender -TableName $TableName
|    [long]$s.Confirmed
|}
|
|function Close-SILogIngestSender {
|    param([Parameter(Mandatory)][string]$TableName)
|    $c = Get-SILogIngestRunCache
|    $k = ($TableName -replace '_CL$', '').ToLowerInvariant()
|    if (-not ($c.Senders -is [hashtable]) -or -not $c.Senders.ContainsKey($k)) { return }
|    $s = $c.Senders[$k]
|    foreach ($b in $s.InFlight.ToArray()) { try { if ($b.PS) { $b.PS.Stop(); $b.PS.Dispose() } } catch { } }
|    $s.InFlight.Clear()
|    if ($s.Pool) { try { $s.Pool.Close(); $s.Pool.Dispose() } catch { }; $s.Pool = $null }
|    $c.Senders.Remove($k)
|}
|
|function Send-SILogDataRest {
|    <#
|        Twin of Post-AzLogAnalyticsLogIngestCustomLogDcrDce-Output, over plain REST:
|          * the rule is found by NAME in the configured subscription + SI_DcrResourceGroup (or the one created this run);
|          * the post goes through the endpoint the RULE is bound to -- ingestion accepts nothing else (#199);
|          * POST {endpoint}/dataCollectionRules/{immutableId}/streams/Custom-{table}_CL?api-version=2023-01-01;
|          * batches are sized from the MEASURED JSON bytes of the rows (working rule 5: no fixed row counts), each under
|            the 1 MB limit -- compressed when $global:EnableCompressionDefault says so, measured after compression and
|            split again if over;
|          * 429 / 5xx retried in-run with Retry-After; any other 4xx fails at once with the response body;
|          * the rows posted are COUNTED against the rows given -- a shortfall throws, it is never reported as done.
|        Rows are serialised exactly as the module serialised them (ConvertTo-Json -Depth 100 -Compress per row).
|        -BatchAmount is accepted and ignored: a fixed row count is what working rule 5 forbids.
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][AllowEmptyCollection()][array]$Data, [Parameter(Mandatory)][AllowEmptyString()][string]$DcrName,
|          [AllowEmptyString()][string]$DceName, [Parameter(Mandatory)][string]$TableName,
|          [string]$BatchAmount, [bool]$EnableUploadViaLogHub = $false, [string]$LogHubPath,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation = 'LocalMachine', [string]$TenantId,
|          [Nullable[bool]]$EnableCompression = $null, [Nullable[bool]]$UseManagedIdentity = $null, [string]$ManagedIdentityClientId,
|          [string]$SubscriptionId, [string]$DcrResourceGroup, [long]$MaxPayloadBytes = 1MB)
|    $total = @($Data).Count
|    if ($total -eq 0) { return }
|    if ($null -eq $EnableCompression) { $EnableCompression = if ($null -ne $global:EnableCompressionDefault) { [bool]$global:EnableCompressionDefault } else { $false } }
|    $bound = @{}; foreach ($k in $PSBoundParameters.Keys) { $bound[$k] = $PSBoundParameters[$k] }
|    $auth = Resolve-SILogIngestAuth -Bound $bound
|    # #738: a sender started for this table takes the rows (in order, serialised exactly as below); its endpoint, rule and
|    # sign-in are resolved on its first call and reused
|    $sender = Get-SILogIngestSender -TableName $TableName
|    if ($sender -and $sender.Uri) {
|        if ([bool]$EnableCompression -ne [bool]$sender.Compress) { $sender = $null }   # never mixed in one sender
|        else { return (Send-SILogDataToSender -Sender $sender -Data $Data -DcrName $DcrName) }
|    }
|    $scope = Get-SILogIngestScope -SubscriptionId $SubscriptionId -DcrResourceGroup $DcrResourceGroup
|
|    $dcr = Resolve-SILogDcrForTable -DcrName $DcrName -SubscriptionId $scope.Subscription -ResourceGroup $scope.DcrRg -Auth $auth
|    if (-not $dcr) { throw ("Data collection rule '{0}' was not found in resource group '{1}' of subscription '{2}', so nothing was posted." -f $DcrName, $scope.DcrRg, $scope.Subscription) }
|    $immutableId = [string]$dcr.properties.immutableId
|    if (-not $immutableId) { throw ("Data collection rule '{0}' has no immutable id yet, so nothing was posted." -f $DcrName) }
|    $stream = Get-SILogStreamName -TableName $TableName
|    if (-not ($dcr.properties.streamDeclarations -and $dcr.properties.streamDeclarations.PSObject.Properties[$stream])) {
|        $first = @(@($dcr.properties.dataFlows)[0].streams)[0]
|        if ($first) { $stream = [string]$first }
|    }
|    $endpoint = $null
|    $boundDce = [string]$dcr.properties.dataCollectionEndpointId
|    if ($boundDce) {
|        $dce = Invoke-SILogArm -Path $boundDce -ApiVersion (Get-SILogArmApiVersion Dce) -Auth $auth -AllowNotFound
|        if ($dce) { $endpoint = [string]$dce.properties.logsIngestion.endpoint }
|    }
|    if (-not $endpoint -and $dcr.properties.endpoints -and $dcr.properties.endpoints.logsIngestion) { $endpoint = [string]$dcr.properties.endpoints.logsIngestion }
|    if (-not $endpoint -and $DceName) {
|        $dce = Find-SILogResourceByName -Kind Dce -Name $DceName -SubscriptionId $scope.Subscription -ResourceGroup $scope.DceRg -Auth $auth -AnyResourceGroupWhenMissing
|        if ($dce) { $endpoint = [string]$dce.properties.logsIngestion.endpoint }
|    }
|    if (-not $endpoint) { throw ("No ingestion endpoint for data collection rule '{0}' (not bound to an endpoint, and '{1}' was not found), so nothing was posted." -f $DcrName, $DceName) }
|
|    $authText = switch ($auth.Mode) { 'ManagedIdentity' { 'Auth=ManagedIdentity' } 'Certificate' { 'Auth=SPN-Cert' } 'Secret' { 'Auth=SPN' } 'Support' { 'Auth=InvardiaSupport' } default { 'Auth=Run' } }
|    $state = @{
|        Uri = ('{0}/dataCollectionRules/{1}/streams/{2}?api-version=2023-01-01' -f $endpoint.TrimEnd('/'), $immutableId, $stream)
|        Auth = $auth; Compress = [bool]$EnableCompression; MaxBytes = $MaxPayloadBytes; Ratio = 1.0
|        Posted = 0; Bytes = 0L; Batches = 0; Total = $total; Table = $TableName; AuthText = $authText
|    }
|    if ($sender) {
|        $sender.Uri = $state.Uri; $sender.Auth = $auth; $sender.AuthText = $authText; $sender.Compress = [bool]$EnableCompression
|        $sender.MaxBytes = [long][Math]::Min([double]$sender.MaxBytes, [double]$MaxPayloadBytes)
|        return (Send-SILogDataToSender -Sender $sender -Data $Data -DcrName $DcrName)
|    }
|    $batch = New-Object 'System.Collections.Generic.List[byte[]]'
|    $batchBytes = 2
|    foreach ($row in $Data) {
|        $b = [System.Text.Encoding]::UTF8.GetBytes((ConvertTo-Json -Depth 100 -InputObject $row -Compress))
|        if (-not $state.Compress -and ($b.Length + 2) -gt $MaxPayloadBytes) {
|            throw ("A single record ({0} bytes) is larger than the {1}-byte limit of the Log Ingestion API, so it cannot be posted." -f ($b.Length + 2), $MaxPayloadBytes)
|        }
|        # raw-bytes ceiling: the limit itself uncompressed; compressed, the limit over the measured ratio (90% margin)
|        $ceiling = if ($state.Compress) { [long][Math]::Min(64MB, [Math]::Floor($MaxPayloadBytes / $state.Ratio * 0.9)) } else { $MaxPayloadBytes }
|        $add = $b.Length + $(if ($batch.Count -gt 0) { 1 } else { 0 })
|        if ($batch.Count -gt 0 -and ($batchBytes + $add) -gt $ceiling) {
|            Send-SILogIngestBatch -Rows $batch -State $state
|            $batch = New-Object 'System.Collections.Generic.List[byte[]]'; $batchBytes = 2; $add = $b.Length
|        }
|        [void]$batch.Add($b); $batchBytes += $add
|    }
|    if ($batch.Count -gt 0) { Send-SILogIngestBatch -Rows $batch -State $state }
|    if ($state.Posted -ne $total) {
|        # #277: the short count is a guard trip -- mailed and reported (never instead of the throw)
|        if (Get-Command -Name Send-SIGuardEvent -ErrorAction Ignore) { $null = Send-SIGuardEvent -GuardId 'ingest.rows.short-count' -Outcome 'refused' -Subject ($TableName + '_CL') -Detail ("Log Analytics accepted {0} of {1} row(s) for {2}_CL." -f $state.Posted, $total, $TableName) -Values @(@{ Name = 'rowsPosted'; Label = 'Rows accepted'; Measured = [long]$state.Posted; Limit = [long]$total }, @{ Name = 'rowsGiven'; Label = 'Rows sent'; Measured = [long]$total }) -HeldCount ([long]$total - [long]$state.Posted) }
|        throw ("Posted {0} of {1} row(s) to {2}_CL -- the other rows are UNKNOWN, not posted." -f $state.Posted, $total, $TableName)
|    }
|    if ([long]$total -gt 0) { Invoke-SILogIngestGuardHeal -Table ($TableName + '_CL') }
|    # BytesPosted: the uncompressed JSON bytes of the rows posted -- a caller that posts in parts sizes its next part from it
|    return [pscustomobject]@{ StatusCode = 204; RowsPosted = $state.Posted; BytesPosted = $state.Bytes; Batches = $state.Batches; Table = ($TableName + '_CL'); Stream = $stream }
|}
'@ }
$__siSupportFiles['auth/Find-SICertificate.ps1'] = @{ Sha256 = '3778fc328c239b499738360e6b4fb31eb3109db39c3a9a9d8f5a02a228ad58d8'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- find the engine SPN's certificate on ANY host, and bring one into a container (#209).
|
|    KEY POINT: THE `Cert:` DRIVE IS A WINDOWS CONVENIENCE; [X509Store] IS THE AUTHORITY. The drive does not exist
|    in a Linux container at all (pwsh on Linux has no certificate provider), and on Windows it can vanish
|    from a PS 5.1 child that inherited a pwsh 7 PSModulePath (framework finding AUTH-1). Five ingest sites
|    looked a thumbprint up through the drive ONLY, so in a container the lookup always "missed", the store
|    location fell back to LocalMachine, and certificate sign-in could not work there at all.
|
|    Every function here uses the drive when it exists -- exactly what the engines did before -- and the
|    X509Store only when it does not, so a Windows VM with its certificate in LocalMachine\My resolves the
|    same certificate, from the same store, as it always has.
|
|    Functions:
|      Get-SICertificateFromStore    -- one thumbprint -> @{ Certificate; StoreLocation } or $null
|      Get-SICertStoreLocation       -- 'LocalMachine' / 'CurrentUser' for the log-ingestion sign-in (default LocalMachine)
|      Get-SICertificateClientToken  -- client_credentials with a certificate-signed assertion (no Cert: drive)
|      Import-SIContainerCertificate -- a base64 PFX (Key Vault reference) -> CurrentUser\My + a PFX file
|
|    PS 5.1 safe: no ?. / ??, no ImportFromPem.
|#>
|
|function Test-SICertDriveAvailable {
|    <# The Windows certificate provider is loaded in this process. A seam for the tests. #>
|    return [bool](Get-PSDrive -Name Cert -ErrorAction SilentlyContinue)
|}
|
|function Get-SICertificateFromStore {
|    <#
|        Find a certificate WITH a private key by thumbprint, LocalMachine first, then CurrentUser -- the order
|        every SI engine already used. Returns @{ Certificate; StoreLocation } or $null.
|
|        -HasCertDrive and -OpenStore are test seams: -OpenStore takes a store location and returns the
|        certificates in its My store.
|    #>
|    param(
|        [Parameter(Mandatory)][AllowEmptyString()][string]$Thumbprint,
|        [string[]]$StoreLocations = @('LocalMachine', 'CurrentUser'),
|        [scriptblock]$HasCertDrive,
|        [scriptblock]$OpenStore
|    )
|    $clean = ($Thumbprint -replace '\s', '').ToUpperInvariant()
|    if ([string]::IsNullOrWhiteSpace($clean)) { return $null }
|    if (-not $HasCertDrive) { $HasCertDrive = { Test-SICertDriveAvailable } }
|    if (-not $OpenStore) {
|        $OpenStore = {
|            param([string]$Location)
|            $x = New-Object System.Security.Cryptography.X509Certificates.X509Store('My', $Location)
|            try {
|                $x.Open('ReadOnly')
|                return @($x.Certificates)
|            } finally { $x.Close() }
|        }
|    }
|    $drive = [bool](& $HasCertDrive)
|    foreach ($loc in $StoreLocations) {
|        $found = $null
|        if ($drive) {
|            $found = Get-ChildItem "Cert:\$loc\My" -ErrorAction SilentlyContinue |
|                     Where-Object { $_.Thumbprint -eq $clean -and $_.HasPrivateKey } |
|                     Select-Object -First 1
|        } else {
|            try {
|                $found = @(& $OpenStore $loc | Where-Object { $_ -and $_.Thumbprint -eq $clean -and $_.HasPrivateKey })[0]
|            } catch {
|                Write-Verbose ("certificate store {0}\My unreadable: {1}" -f $loc, $_.Exception.Message)
|            }
|        }
|        if ($found) { return [pscustomobject]@{ Certificate = $found; StoreLocation = $loc } }
|    }
|    return $null
|}
|
|function Get-SICertStoreLocation {
|    <#
|        The store the log-ingestion sign-in should be told to look in. Same answer the five ingest sites computed
|        through the Cert: drive (LocalMachine when nothing is found), now also right where the drive is
|        missing.
|    #>
|    param(
|        [Parameter(Mandatory)][AllowEmptyString()][string]$Thumbprint,
|        [scriptblock]$HasCertDrive,
|        [scriptblock]$OpenStore
|    )
|    $hit = Get-SICertificateFromStore -Thumbprint $Thumbprint -HasCertDrive $HasCertDrive -OpenStore $OpenStore
|    if ($hit) { return [string]$hit.StoreLocation }
|    return 'LocalMachine'
|}
|
|function Get-SICertificateClientToken {
|    <#
|        An access token for -Resource via client_credentials with a certificate-signed JWT assertion -- the
|        grant Get-SIGraphToken and the log ingestion already use, without the Cert: drive. Returns the
|        token string. -Invoke is a test seam: { param($Uri, $Body) } returning the token response.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$TenantId,
|        [Parameter(Mandatory)][string]$ClientId,
|        [Parameter(Mandatory)][string]$Thumbprint,
|        [Parameter(Mandatory)][string]$Resource,
|        [scriptblock]$Invoke
|    )
|    $hit = Get-SICertificateFromStore -Thumbprint $Thumbprint
|    if (-not $hit) { throw ("certificate '{0}' was not found with a private key in LocalMachine\My or CurrentUser\My." -f (($Thumbprint -replace '\s', '').ToUpperInvariant())) }
|    $cert = $hit.Certificate
|
|    $scope = if ($Resource -match '/\.default$') { $Resource } else { ($Resource.TrimEnd('/') + '/.default') }
|    $tokenUri = 'https://login.microsoftonline.com/{0}/oauth2/v2.0/token' -f $TenantId
|    $b64url = { param([byte[]]$Bytes) [Convert]::ToBase64String($Bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_') }
|    $now = [DateTimeOffset]::UtcNow.ToUnixTimeSeconds()
|    $header = @{ alg = 'RS256'; typ = 'JWT'; x5t = (& $b64url $cert.GetCertHash()) } | ConvertTo-Json -Compress
|    $claims = @{ aud = $tokenUri; iss = $ClientId; sub = $ClientId; jti = [guid]::NewGuid().ToString(); nbf = $now; exp = ($now + 600) } | ConvertTo-Json -Compress
|    $enc = [System.Text.Encoding]::UTF8
|    $unsigned = '{0}.{1}' -f (& $b64url $enc.GetBytes($header)), (& $b64url $enc.GetBytes($claims))
|    $rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
|    if (-not $rsa) { throw ("certificate '{0}' has no usable RSA private key." -f $cert.Thumbprint) }
|    $sig = $rsa.SignData($enc.GetBytes($unsigned), [System.Security.Cryptography.HashAlgorithmName]::SHA256, [System.Security.Cryptography.RSASignaturePadding]::Pkcs1)
|    $body = @{
|        client_id             = $ClientId
|        scope                 = $scope
|        client_assertion_type = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
|        client_assertion      = ('{0}.{1}' -f $unsigned, (& $b64url $sig))
|        grant_type            = 'client_credentials'
|    }
|    $resp = if ($Invoke) { & $Invoke $tokenUri $body }
|            # a time limit: without one this call waits for as long as the other side stays silent (PowerShell 7 has no default)
|            else { Invoke-RestMethod -Method Post -Uri $tokenUri -Body $body -ContentType 'application/x-www-form-urlencoded' -TimeoutSec 60 }
|    if (-not $resp.access_token) { throw 'the token endpoint returned no access_token.' }
|    return [string]$resp.access_token
|}
|
|function Get-SIContainerCertificateKeyFlags {
|    <# PURE. The key flags the container imports the SPN's PFX with: Exportable + PersistKeySet (the store keeps the key for
|       the life of the run). One place, so a test can pin them. #>
|    [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable -bor
|        [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::PersistKeySet
|}
|
|function Import-SIContainerCertificate {
|    <#
|        CONTAINER ONLY. The SPN's PFX arrives as a Key Vault-referenced secret (base64), exactly as the SI
|        updater receives its own. This puts it where every engine looks:
|          * CurrentUser\My, through [X509Store] (the only certificate store a Linux container has), so
|            Get-SIGraphToken, the ledger and the log ingestion find it by thumbprint;
|          * a PFX file (owner-only), so Connect-SIAzAccount -CertificatePath can sign in with it -- az and
|            the sign-in remember the PATH, not the key, so the file is kept for the life of the run.
|        Returns @{ Thumbprint; PfxPath }. Never prints the certificate or its password.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$PfxBase64,
|        [string]$Password,
|        [string]$Directory = [IO.Path]::GetTempPath(),
|        [switch]$SkipStore,
|        # TESTS ONLY: a Windows test session that cannot persist a private key (no DPAPI master key) imports with
|        # EphemeralKeySet instead. No caller in the product passes it: the container always uses Get-SIContainerCertificateKeyFlags.
|        [Parameter(DontShow)][AllowNull()][Nullable[System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]]$KeyStorageFlags = $null
|    )
|    $bytes = [Convert]::FromBase64String(($PfxBase64 -replace '\s', ''))
|    $flags = if ($null -ne $KeyStorageFlags) { [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]$KeyStorageFlags } else { Get-SIContainerCertificateKeyFlags }
|    # A Key Vault certificate's secret is a password-less PFX; '' opens those on both .NET hosts.
|    $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($bytes, [string]$Password, $flags)
|    if (-not $cert.HasPrivateKey) { throw 'the SPN certificate (SI_SPN_CERT_PFX_B64) carries no private key.' }
|
|    if (-not $SkipStore) {
|        $store = New-Object System.Security.Cryptography.X509Certificates.X509Store('My', 'CurrentUser')
|        try {
|            $store.Open('ReadWrite')
|            $store.Add($cert)
|        } finally { $store.Close() }
|    }
|
|    $pfxPath = Join-Path $Directory ('si-spn-' + [guid]::NewGuid().ToString('N') + '.pfx')
|    [IO.File]::WriteAllBytes($pfxPath, $bytes)
|    if ($PSVersionTable.PSVersion.Major -ge 6 -and -not $IsWindows) { try { & chmod 600 $pfxPath } catch { } }
|    return [pscustomobject]@{ Thumbprint = [string]$cert.Thumbprint; PfxPath = $pfxPath }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-ErrorClass.ps1'] = @{ Sha256 = 'ab3ed267218c640b0e672f593af5d33a61146cc96980f39dc70ee56e2f8bd92d'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- WHAT KIND OF FAILURE WAS IT: one error class per failed run, for the telemetry `run` record.
|
|    ExitReason says only success / success-partial / error / settings-error. A release-health view needs to tell "a
|    permission is missing" from "the service was throttling" from "the query is broken", without free text (anonymous
|    installs send no error text at all). Get-SIErrorClass maps an error to exactly ONE value of a CLOSED list -- the list
|    agreed with the receiving side; anything not recognised is 'unknown', never a guess.
|
|    It is built on the classifiers SecurityInsight already trusts:
|      * SI-KqlError.ps1 -- what a Log Analytics failure REALLY said (the response body, not "BadRequest") and whether
|        it was a missing table;
|      * working rule 4 / Risk Analysis' bucket classifier -- the recognised PLATFORM prefixes (a cancellation or a
|        service-side entity resolution carries the service's generic "Fix semantic errors" tail and is NOT a query
|        defect), then syntax / semantic / type errors = query defect, then throttle, then timeout / 5xx.
|
|    The order of the checks is the contract (first match wins):
|      settings-error > guard-refused > out-of-memory > database-full > licence-invalid > mi-unavailable > sql-login > config-missing > ingest-short-count >
|      table-missing > platform prefix (timeout / 5xx) > kql-query-defect > throttled > ingest-4xx >
|      401 / 403 by service > ai-error > platform-timeout > platform-5xx > unknown.
|    A 401 from Microsoft Graph is graph-401; a 401 from another service means the same thing as its 403 there (access
|    refused) and gets that service's -403 class.
|
|    PURE. No network. PS 5.1 safe.
|#>
|
|if (-not (Get-Command -Name Get-SIKqlErrorText -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-KqlError.ps1'))
|}
|
|# The closed list, exactly as agreed (#226). Get-SIErrorClass returns one of these and nothing else.
|function Get-SIErrorClassesState {
|    <# The value of $script:SIErrorClasses, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIErrorClasses) { $script:SIErrorClasses = @(
|    'graph-401', 'graph-403', 'defender-403', 'arm-403', 'kv-403', 'storage-403', 'sql-login', 'mi-unavailable',
|    'throttled', 'platform-timeout', 'platform-5xx', 'kql-query-defect', 'table-missing', 'ingest-4xx',
|    'ingest-short-count', 'settings-error', 'config-missing', 'licence-invalid', 'ai-error',
|    # UPLINK-FIX (Invardia, 2026-10-07): a run a guard REFUSED (nothing written, by design). The run's message is
|    # '<guard id> refused: <why>' (Get-SIGuardRefusalText) -- its own class, so a refusal never reads as 'unknown'.
|    'guard-refused',
|    # #641 (owner 2026-10-13): a Risk Analysis report that is NOT COMPLETE in its run (its rows do not match what the source
|    # holds, or it is not in the run at all) -- set by Risk Analysis itself, never derived from a message
|    'report-incomplete',
|    # #702 (1) (customer B 2026-10-15): the process ran out of memory. Its own class, never platform-timeout -- a platform
|    # class is retried in-run on the same size, which runs out again; the job-size rule raises the job one band instead.
|    # (Invardia's receiver takes any ^[a-z0-9-]{1,40}$ class -- packages/core/src/uplink.ts.)
|    'out-of-memory',
|    # #904 (a large install 2026-10-26): Azure SQL refused a write because the database reached its maximum size (1105,
|    # 40544, "has reached its size quota"). Its own class -- never 'unknown' -- so a part that failed on it opens a ticket.
|    'database-full',
|    # #913 (the ride test install 2026-10-27): an Azure SQL transient (9001 log not available, 40613 / 40501 / 40197 /
|    # 49918-49920, 4060 during a failover, 10928 / 10929, a reset connection) that did not pass within its bounded retry.
|    # Set by the caller that retried it (the pipeline runner's lock), never derived from a text: not a product defect.
|    'transient-sql',
|    # 3.0.30: the web app's identity has no grant on its Key Vault key (the updater only checks it; setup makes it) -- the
|    # customer's action with the command, never arm-403 (that is a real 403 answer). Set by the caller, never derived from a text.
|    'grant-missing',
|    'unknown'
|) }
|    , $script:SIErrorClasses
|}
|$script:SIErrorClasses = $null; $null = Get-SIErrorClassesState
|
|# #904: the numbers of Azure SQL's "the database is full" refusal (1105: no space in the filegroup; 40544: the database
|# reached its size quota; 1101: no new page could be allocated)
|function Get-SIDatabaseFullNumbersState {
|    <# The value of $script:SIDatabaseFullNumbers, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIDatabaseFullNumbers) { $script:SIDatabaseFullNumbers = @(1105, 40544, 1101) }
|    , $script:SIDatabaseFullNumbers
|}
|$script:SIDatabaseFullNumbers = $null; $null = Get-SIDatabaseFullNumbersState
|
|# Risk Analysis' recognised platform-failure prefixes (RA-GraphHunting.ps1, $script:RAPlatformFailurePrefixes). Read
|# from there when Risk Analysis is loaded, so the two can never disagree; this copy serves every other engine. A test
|# compares the two lists.
|function Get-SIErrorPlatformPrefixesState {
|    <# The value of $script:SIErrorPlatformPrefixes, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIErrorPlatformPrefixes) { $script:SIErrorPlatformPrefixes = @(
|    @{ Pattern = 'Query cancelled on creation'; Class = 'platform-timeout' }
|    @{ Pattern = 'ScalarEvaluator\.Evaluate failed'; Class = 'platform-timeout' }
|    @{ Pattern = 'Errors occurred while resolving remote entities'; Class = 'platform-5xx' }
|) }
|    , $script:SIErrorPlatformPrefixes
|}
|$script:SIErrorPlatformPrefixes = $null; $null = Get-SIErrorPlatformPrefixesState
|
|function Get-SIErrorClasses { (Get-SIErrorClassesState) }
|
|function Test-SIDatabaseFullError {
|    <#
|        PURE. #904: did Azure SQL refuse a write because the database is FULL? -Value: an ErrorRecord, an exception (its
|        SqlException numbers and inner exceptions are read) or a text. SQL 1105 / 40544 / 1101, "has reached its size quota",
|        "filegroup is full", "Could not allocate space" / "Could not allocate a new page".
|    #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $false }
|    $ex = if ($Value -is [System.Exception]) { $Value } elseif ($Value -is [System.Management.Automation.ErrorRecord]) { $Value.Exception } else { $null }
|    $texts = New-Object System.Collections.Generic.List[string]
|    while ($ex) {
|        if ($ex -is [System.Data.SqlClient.SqlException]) { foreach ($er in @($ex.Errors)) { if ((Get-SIDatabaseFullNumbersState) -contains [int]$er.Number) { return $true } } }
|        $texts.Add([string]$ex.Message); $ex = $ex.InnerException
|    }
|    if (-not $texts.Count) { $texts.Add([string]$Value) }
|    $t = $texts -join ' | '
|    return [bool]($t -match '(?i)has reached its size quota|filegroup is full|Could not allocate (space|a new page)|\b(Error|Msg|Number)[ :=]*(1105|40544)\b|\((1105|40544)\)')
|}
|
|function Get-SITransientKind {
|    <#
|        PURE. THE ONE DECISION of what a failed call or a failure text REALLY was (2026-10-22: a "Connection timed out" to
|        SI's own storage was reported to the owner as "Microsoft throttled this run"):
|          throttled    Microsoft asked us to slow down -- ONLY a real throttling answer: HTTP 429, "Too Many Requests", a
|                       rate limit, SQL 40501 / 10928 / 10929 (the service is busy / resource limit)
|          timeout      no answer in time: HTTP 408 / 504, SQL -2, "timed out" / "timeout" / a cancelled task
|          unavailable  the service could not be reached or failed: HTTP 500 / 502 / 503, no answer at all (status 0 without a
|                       timeout), a reset / refused / closed connection, a host that does not resolve, SQL 40613 / 40197 /
|                       49918-49920 / 10053 / 10054 / 233 / 64
|          error        anything else (a refusal, a bug, a bad request) -- never retried as transient
|        -StatusCode (an HTTP status; 0 = no answer; -1 = not known), -Message (the error text), -SqlNumber (SqlException numbers).
|        SecurityInsight's OWN customer sentence ("Microsoft throttled this run ...") is taken out of the text first, so a
|        re-read log never classifies itself.
|    #>
|    param([int]$StatusCode = -1, [AllowNull()][AllowEmptyString()][string]$Message = '', [AllowNull()][int[]]$SqlNumber = @())
|    $t = ([string]$Message) -replace '(?i)Microsoft throttled this run[^|]*', ''
|    $sql = @($SqlNumber | Where-Object { $null -ne $_ })
|    if ($StatusCode -eq 429 -or @($sql | Where-Object { $_ -in 40501, 10928, 10929 }).Count -gt 0) { return 'throttled' }
|    if ($t -match '(?i)\b429\b|Too ?Many ?Requests|\bthrottl|rate limit|RequestRateTooLarge') { return 'throttled' }
|    if ($StatusCode -in 408, 504 -or $sql -contains -2) { return 'timeout' }
|    if ($t -match '(?i)timed? ?out|timeout|TaskCanceledException|A task was canceled|operation was canceled|\b504\b|Gateway Time-?out|\b408\b') { return 'timeout' }
|    if ($StatusCode -in 500, 502, 503 -or $StatusCode -eq 0 -or @($sql | Where-Object { $_ -in 40613, 40197, 49918, 49919, 49920, 10053, 10054, 233, 64 }).Count -gt 0) { return 'unavailable' }
|    if ($t -match '(?i)\b50[0-3]\b|Internal ?Server ?Error|Bad Gateway|Service ?Unavailable|ServiceUnavailable|temporarily unavailable|is not currently available|forcibly closed|connection (was )?reset|Connection reset by peer|actively refused|No such host is known|Name or service not known|transport-level error|Unable to connect to the remote server') { return 'unavailable' }
|    'error'
|}
|
|function Test-SIOutOfMemoryText {
|    <# PURE. Does a failure text (or an exception / ErrorRecord, read with its inner exceptions) say the process ran out of
|       memory? .NET's OutOfMemoryException (also wrapped: "Exception calling ... : Exception of type
|       'System.OutOfMemoryException' was thrown", "Cannot process argument transformation on parameter 'TimeoutSec'. ..."),
|       Container Apps' OOMKilled, or SecurityInsight's own "out of memory" wording. #702 (1). #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $false }
|    $ex = if ($Value -is [System.Exception]) { $Value } elseif ($Value -is [System.Management.Automation.ErrorRecord]) { $Value.Exception } else { $null }
|    while ($ex) { if ($ex -is [System.OutOfMemoryException]) { return $true }; $ex = $ex.InnerException }
|    $t = if ($Value -is [System.Management.Automation.ErrorRecord]) { [string]$Value.Exception } else { [string]$Value }
|    return [bool]($t -match '(?i)OutOfMemoryException|\bOOMKilled\b|\bout of memory\b')
|}
|
|# WHO FIXES IT (framework §8.5 CLOSE-LOOP, Invardia 046): the classes whose fix is the CUSTOMER's configuration -- a
|# permission or consent the install's identity does not have (the five -403 classes), a licence or licensed feature it
|# lacks (licence-invalid), a setting the customer must set (config-missing, settings-error). Everything else -- sign-in
|# and token trouble, a missing table, ingestion, throttling, timeouts, service errors, guard refusals, unknown -- stays a
|# product defect: a class is put here only when its own definition above says the customer's configuration is the cause.
|function Get-SICustomerConfigClassesState {
|    <# The value of $script:SICustomerConfigClasses, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SICustomerConfigClasses) { $script:SICustomerConfigClasses = @('graph-403', 'defender-403', 'arm-403', 'kv-403', 'storage-403', 'licence-invalid', 'config-missing', 'settings-error', 'grant-missing') }
|    , $script:SICustomerConfigClasses
|}
|$script:SICustomerConfigClasses = $null; $null = Get-SICustomerConfigClassesState
|# #913: the classes that are nobody's fix -- an Azure SQL transient that did not pass within its bounded retry. No FixKind:
|# never a fix request, never a red alert (the next wake-up runs as usual).
|function Get-SINoFixClassesState {
|    <# The value of $script:SINoFixClasses, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SINoFixClasses) { $script:SINoFixClasses = @('transient-sql') }
|    , $script:SINoFixClasses
|}
|$script:SINoFixClasses = $null; $null = Get-SINoFixClassesState
|
|function Get-SICustomerConfigClasses { (Get-SICustomerConfigClassesState) }
|
|function Get-SIErrorFixKind {
|    <#
|        PURE. The FixKind of a failed report's error class: 'customer-config' for a class on the customer-configuration list,
|        'product-defect' for every other class of the closed list (and anything not on it), '' when there is no class.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$ErrorClass)
|    $c = "$ErrorClass".Trim().ToLowerInvariant()
|    if (-not $c) { return '' }
|    if ((Get-SINoFixClassesState) -contains $c) { return '' }
|    if ((Get-SICustomerConfigClassesState) -contains $c) { return 'customer-config' }
|    'product-defect'
|}
|
|function Get-SIErrorService {
|    <# PURE. Which service a failure came from, by the host or the wording it carries: graph | defender | arm | kv |
|       storage | sql | ingest | ai | loganalytics | ''. #>
|    param([AllowEmptyString()][string]$Text)
|    $t = [string]$Text
|    if ($t -match '(?i)ingest\.monitor\.azure\.com|Logs Ingestion|log ingestion|dataCollectionRules|\bDCR\b|\bDCE\b|InvalidTransformOutput') { return 'ingest' }
|    if ($t -match '(?i)openai\.azure\.com|\bOpenAI\b|content_filter|context_length_exceeded|DeploymentNotFound|chat/completions') { return 'ai' }
|    if ($t -match '(?i)api\.securitycenter\.microsoft\.com|api\.security\.microsoft\.com|security/runHuntingQuery|advanced hunting|Microsoft Defender|\bMachine\.Read\.All\b|\bThreatHunting\.Read\.All\b') { return 'defender' }
|    if ($t -match '(?i)\.vault\.azure\.net|Key ?Vault|ForbiddenByRbac|ForbiddenByPolicy|secrets get permission|getSecret/action') { return 'kv' }
|    if ($t -match '(?i)\.(blob|table|queue|file|dfs)\.core\.windows\.net|AuthorizationPermissionMismatch|AuthorizationFailure|storage account') { return 'storage' }
|    if ($t -match '(?i)database\.windows\.net|SqlException|SqlClient|\bLogin failed\b') { return 'sql' }
|    if ($t -match '(?i)management\.azure\.com|AuthorizationFailed|Microsoft\.[A-Za-z]+/[A-Za-z]+/[A-Za-z/]*(read|write|action)|\bAzure Resource Manager\b|LinkedAuthorizationFailed') { return 'arm' }
|    if ($t -match '(?i)graph\.microsoft\.com|Authorization_RequestDenied|Microsoft Graph|InvalidAuthenticationToken') { return 'graph' }
|    if ($t -match '(?i)api\.loganalytics|loganalytics\.io|Log Analytics|SEM\d{4}|SYN\d{4}') { return 'loganalytics' }
|    ''
|}
|
|function Get-SIErrorLines {
|    <#
|        PURE. A failed run's own words from its log (a run transcript, a console tail): the error that ENDED it -- the LAST
|        [ERROR] / exception / failed / refused / denied / status-code block (transcript TerminatingError markers and WARNING:
|        lines only when nothing else is there), and the lines after it up to -Max, else -- no such line --
|        the LAST -Max lines that carry text. Transcript headers / footers and the ******** frames are dropped. Never the whole
|        log: the uplink carries a few lines, and the caller redacts them (ConvertTo-AitUplinkRedacted). '' for no text.
|    #>
|    param([AllowNull()][AllowEmptyCollection()][string[]]$Lines = @(), [int]$Max = 8, [int]$MaxChars = 1800)
|    $keep = New-Object System.Collections.Generic.List[string]
|    $inHeader = $false
|    foreach ($raw in @($Lines)) {
|        $l = ([string]$raw).TrimEnd()
|        if (-not $l.Trim()) { continue }
|        if ($l -match '^\*{10,}$') { $inHeader = -not $inHeader; continue }
|        if ($inHeader) { continue }
|        if ($l -match '^(PowerShell|Windows PowerShell) transcript (start|end)|^(Start|End) time: \d{14}|^Transcript started, output file is') { continue }
|        $keep.Add($l.Trim())
|    }
|    if (-not $keep.Count) { return '' }
|    $err = '(?i)\[(ERROR|FAIL(ED)?|FATAL)\]|\bERROR\b|Exception|\bfailed\b|could not|cannot|refused|denied|Forbidden|Unauthorized|Login failed|\b(40[0-9]|429|50[0-4])\b|throttl|timed? ?out'
|    # The error that ENDED the run, not the first one in the log: every error-looking line is a candidate; the
|    # transcript's own "PS>TerminatingError(...)" / ">> TerminatingError(...)" markers (written for an error the code
|    # CAUGHT and went on after) and WARNING: lines count only when the log has no other error line. The LAST such line
|    # is taken, from the start of its block (the error lines right before it), and the lines after it up to -Max.
|    $isErr = { param($s) $s -match $err -and $s -notmatch '(?i)^\s*(VERBOSE|DEBUG)\b|\b0 (failed|errors?)\b' }
|    $isWeak = { param($s) $s -match '(?i)^\s*(PS>|>>\s*)TerminatingError\(|^\s*WARNING:' }
|    $strong = -1; $weak = -1
|    for ($i = 0; $i -lt $keep.Count; $i++) {
|        if (-not (& $isErr $keep[$i])) { continue }
|        if (& $isWeak $keep[$i]) { $weak = $i } else { $strong = $i }
|    }
|    $first = if ($strong -ge 0) { $strong } else { $weak }
|    if ($first -ge 0) {
|        $wantWeak = ($strong -lt 0)
|        while ($first -gt 0 -and (& $isErr $keep[$first - 1]) -and ($wantWeak -or -not (& $isWeak $keep[$first - 1]))) { $first-- }
|    }
|    $pick = if ($first -ge 0) { @($keep.GetRange($first, [Math]::Min($Max, $keep.Count - $first))) } else { @($keep.GetRange([Math]::Max(0, $keep.Count - $Max), [Math]::Min($Max, $keep.Count))) }
|    $t = ($pick -join "`n")
|    if ($t.Length -gt $MaxChars) { $t = $t.Substring(0, $MaxChars) }
|    $t
|}
|
|function Get-SIErrorRecordSummary {
|    <# PURE. The words of a caught error, never empty: its message, else its exception type + error id + where it was
|       raised (an exception thrown without a message reached Invardia as an empty text -- si-trend x5). #>
|    param([AllowNull()]$ErrorRecord)
|    if ($null -eq $ErrorRecord) { return '' }
|    $ex = if ($ErrorRecord -is [System.Exception]) { $ErrorRecord } elseif ($ErrorRecord.PSObject.Properties['Exception']) { $ErrorRecord.Exception } else { $null }
|    $m = if ($ex) { "$($ex.Message)".Trim() } else { "$ErrorRecord".Trim() }
|    if ($m) { return $m }
|    $parts = New-Object System.Collections.Generic.List[string]
|    if ($ex) { $parts.Add($ex.GetType().FullName) }
|    if ($ErrorRecord.PSObject.Properties['FullyQualifiedErrorId'] -and "$($ErrorRecord.FullyQualifiedErrorId)".Trim()) { $parts.Add("id $($ErrorRecord.FullyQualifiedErrorId)") }
|    if ($ErrorRecord.PSObject.Properties['InvocationInfo'] -and $ErrorRecord.InvocationInfo -and $ErrorRecord.InvocationInfo.ScriptName) { $parts.Add(('at {0}:{1}' -f (Split-Path -Leaf $ErrorRecord.InvocationInfo.ScriptName), $ErrorRecord.InvocationInfo.ScriptLineNumber)) }
|    if (-not $parts.Count) { return 'an error without a message' }
|    'an error without a message (' + ($parts -join ', ') + ')'
|}
|
|function Get-SIErrorClass {
|    <#
|        PURE. The error class of one failure -- exactly one value of Get-SIErrorClasses.
|          -ErrorRecord  an ErrorRecord or an exception (its message, response body, typed body and inner exceptions are
|                        all read -- Get-SIKqlErrorText)
|          -Message      a text (a run-health ErrorMessage, a log line)
|          -ExitReason   the run's ExitReason: 'settings-error' is its own class whatever the text says
|          -Service      a hint when the caller knows which service it called (graph, defender, arm, kv, storage, sql,
|                        ingest, ai) -- used when the text does not name one
|    #>
|    param([AllowNull()]$ErrorRecord, [AllowEmptyString()][AllowNull()][string]$Message, [AllowEmptyString()][string]$ExitReason, [AllowEmptyString()][string]$Service)
|    if ($ExitReason -eq 'settings-error') { return 'settings-error' }
|    if ("$Message" -match '^[a-z0-9][a-z0-9.-]{0,99} refused: ') { return 'guard-refused' }
|    $parts = New-Object System.Collections.Generic.List[string]
|    if ($null -ne $ErrorRecord) { $parts.Add((Get-SIKqlErrorText -ErrorRecord $ErrorRecord)) }
|    if ($Message) { $parts.Add($Message) }
|    $t = ($parts | Where-Object { $_ }) -join ' | '
|    # #702 (1): out of memory ANYWHERE in the text wins over every service / platform word around it (customer B's
|    # "... parameter 'TimeoutSec'. Exception of type 'System.OutOfMemoryException' was thrown" read as platform-timeout)
|    if ((Test-SIOutOfMemoryText $t) -or ($null -ne $ErrorRecord -and (Test-SIOutOfMemoryText $ErrorRecord))) { return 'out-of-memory' }
|    if ([string]::IsNullOrWhiteSpace($t)) { return 'unknown' }
|    # #904: the database is full -- before every service / platform word (its text names SQL and often a timeout)
|    if ((Test-SIDatabaseFullError $t) -or ($null -ne $ErrorRecord -and (Test-SIDatabaseFullError $ErrorRecord))) { return 'database-full' }
|    # 2026-10-29: a temporary Azure SQL error that outlasted SecurityInsight's own retry is TAGGED by the code that retried
|    # it -- its message ends "-- transient-sql" (SI-DataSql.ps1, the pipeline lock); the step's log carries that line, so the
|    # pipeline's report of the step names the platform's class, never a product defect
|    if ($t -match '(?i)--\s*transient-sql\b') { return 'transient-sql' }
|    $svc =Get-SIErrorService -Text $t
|    if (-not $svc -and $Service) { $svc = $Service.ToLowerInvariant() }
|
|    # ---- the run's own configuration ----------------------------------------------------------------------------------
|    if ($t -match '(?i)SecurityInsight Pro: .*settings database|in the settings database are not valid|settings documents could not be prepared') { return 'settings-error' }
|    if ($t -match '(?i)\blicen[cs]e\b.*\b(invalid|not valid|expired|signature verification FAILED|tampered|no entitlement|not readable|could not be read|does not include feature|names no SecurityInsight Pro edition|does not list it)\b|no \.(pimlicense|silicense|aitlicense)|not an AutomateIT licence|signature verification FAILED.*licensing key') { return 'licence-invalid' }
|
|    # ---- identity / sign-in -----------------------------------------------------------------------------------------
|    if ($t -match '(?i)ManagedIdentityCredential|No Managed Identity endpoint|169\.254\.169\.254|IDENTITY_ENDPOINT|\bIMDS\b|MSI endpoint|managed identity.*(unavailable|not available|not found|could not|failed|is not loaded)|identity token helper is not loaded') { return 'mi-unavailable' }
|    if ($t -match "(?i)Login failed for user|Cannot open (server|database) .* requested by the login|\b18456\b|token-identified principal") { return 'sql-login' }
|    if ($t -match "(?i)Cannot (bind|validate) argument (to|on) parameter '(Az)?(ApplicationId|AppId|TenantId|ClientId|CertificateThumbprint|Thumbprint|SubscriptionId|VaultName|WorkspaceId|DcrImmutableId|DceUri|ServicePrincipal\w*)' because it is (an empty string|null)|is not (set|configured)|not found in the configuration|the Pro database is not configured|certificate .* was not found") { return 'config-missing' }
|
|    # ---- ingestion --------------------------------------------------------------------------------------------------
|    if ($t -match '(?i)wrote fewer rows than it carried|fewer rows than (were )?(sent|posted|expected)|short count|rows? (were )?(lost|dropped) (at|during) ingest|accepted \d+ of \d+ rows') { return 'ingest-short-count' }
|
|    # ---- Log Analytics / advanced hunting: the query and the tables -------------------------------------------------
|    # #876: a 'union' leaf says "table expression", a 'where' leaf "table or column expression" -- both: the table is not there
|    if ($t -match "Failed to resolve table (?:or column )?expression named \\?['""]?([A-Za-z0-9_]+)") {
|        $name = $Matches[1]
|        if ($name -match '(?i)_CL$' -or $t -match '(?i)\btable\b.*(could not be found|does not exist)') { return 'table-missing' }
|    }
|    if ($t -match "(?i)\btable\b[^|]{0,120}\b(could not be found|does not exist)|unknown table|PathNotFoundError|not present in this tenant's advanced hunting schema") { return 'table-missing' }
|    foreach ($p in (Get-SIErrorPlatformPrefixesState)) { if ($t -match $p.Pattern) { return $p.Class } }
|    if ($t -match '(?i)Fix syntax errors in your query|Fix semantic errors in your query|SyntaxError|SemanticError|return types are not compatible|\bSEM\d{4}\b|\bSYN\d{4}\b|Expected: .* in query|Failed to resolve (scalar|table or column|table) expression') { return 'kql-query-defect' }
|
|    # ---- throttling -------------------------------------------------------------------------------------------------
|    # ONE decision (Get-SITransientKind): only a real throttling answer is 'throttled'. A Retry-After header alone is not
|    # (a 503 sends one too); SI's own "Microsoft throttled this run" sentence never classifies itself.
|    if ((Get-SITransientKind -Message $t) -eq 'throttled') { return 'throttled' }
|
|    # ---- status codes, by service -----------------------------------------------------------------------------------
|    $code = $null
|    if ($t -match '(?i)\((4\d\d)\)|status code (?:does not indicate success: )?(4\d\d)\b|\b(4\d\d) \((Bad Request|Unauthorized|Forbidden|Not Found|Request Entity Too Large|Conflict)\)|''(BadRequest|Unauthorized|Forbidden|NotFound|RequestEntityTooLarge)''') {
|        $code = @($Matches[1], $Matches[2], $Matches[3], $Matches[5]) | Where-Object { $_ } | Select-Object -First 1
|    }
|    $named = @{ BadRequest = '400'; Unauthorized = '401'; Forbidden = '403'; NotFound = '404'; RequestEntityTooLarge = '413' }
|    if ($code -and $named.ContainsKey($code)) { $code = $named[$code] }
|    $is401 = ($code -eq '401') -or ($t -match '(?i)\bUnauthorized\b|InvalidAuthenticationToken|token is expired|Lifetime validation failed')
|    $is403 = ($code -eq '403') -or ($t -match '(?i)\bForbidden\b|Authorization_RequestDenied|AuthorizationFailed|AuthorizationPermissionMismatch|Insufficient privileges|does not have authorization|does not have (any of )?the required|is not authorized to perform|ForbiddenByRbac|ForbiddenByPolicy|Access denied')
|    if ($svc -eq 'ingest' -and ($code -match '^4\d\d$' -or $is401 -or $is403 -or $t -match '(?i)InvalidTransformOutput|is not associated with DCR|DCE FQDN')) { return 'ingest-4xx' }
|    if ($is401 -or $is403) {
|        switch ($svc) {
|            'graph'    { if ($is401 -and -not $is403) { return 'graph-401' } else { return 'graph-403' } }
|            'defender' { return 'defender-403' }
|            'arm'      { return 'arm-403' }
|            'kv'       { return 'kv-403' }
|            'storage'  { return 'storage-403' }
|            'sql'      { return 'sql-login' }
|            'ai'       { return 'ai-error' }
|            default    { if ($is401 -and -not $is403) { return 'graph-401' } }
|        }
|    }
|
|    # ---- AI ---------------------------------------------------------------------------------------------------------
|    if ($svc -eq 'ai') { return 'ai-error' }
|
|    # ---- the platform -----------------------------------------------------------------------------------------------
|    switch (Get-SITransientKind -Message $t) {
|        'timeout'     { return 'platform-timeout' }
|        'unavailable' { return 'platform-5xx' }
|    }
|    'unknown'
|}
'@ }
$__siSupportFiles['engine/_shared/SI-KqlError.ps1'] = @{ Sha256 = 'ee8dfba0c796cb9c3a24f592a058e3b1223b4edff9a71df30d7bd65465d14221'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- what a failed Log Analytics query actually said (#221).
|
|    WHY. Az.OperationalInsights throws ErrorResponseException whose MESSAGE is only
|    "Operation returned an invalid status code 'BadRequest'". The reason -- e.g. SEM0100 "Failed to resolve table or
|    column expression named 'SI_PublicIP_Profile_CL'" -- is in the response body (Exception.Response.Content /
|    Exception.Body). Measured 2026-10-03 on 3.4.0 (container) and 3.4.1 (the development machine), PS 5.1 and pwsh 7 alike.
|    Readers that classified on the message therefore never recognised a MISSING table: on a fresh install, where a
|    profile or Risk Analysis table does not exist yet, correlation, trend and the close-loop failed outright.
|
|    A missing table is the ONLY error a reader may treat as "no data here yet". Everything else still fails loudly --
|    a throttle or timeout must never pass as an empty table (#132).
|
|    PS 5.1 safe: no ?. / ??.
|#>
|
|function Get-SIKqlErrorText {
|    <# PURE. Every text a Log Analytics query failure carries: the message, the response body, the typed body, inner
|       exceptions and ErrorDetails -- joined, so a caller can classify on what the service really said. #>
|    param([Parameter(Mandatory)][AllowNull()]$ErrorRecord)
|    if ($null -eq $ErrorRecord) { return '' }
|    $parts = New-Object System.Collections.Generic.List[string]
|    $ex = if ($ErrorRecord -is [System.Management.Automation.ErrorRecord]) { $ErrorRecord.Exception } else { $ErrorRecord }
|    if ($ErrorRecord -is [System.Management.Automation.ErrorRecord] -and $ErrorRecord.ErrorDetails -and $ErrorRecord.ErrorDetails.Message) {
|        $parts.Add([string]$ErrorRecord.ErrorDetails.Message)
|    }
|    $depth = 0
|    while ($ex -and $depth -lt 5) {
|        $parts.Add([string]$ex.Message)
|        if ($ex.PSObject.Properties['Response'] -and $ex.Response) {
|            $c = $null
|            if ($ex.Response.PSObject.Properties['Content']) { $c = $ex.Response.Content }
|            if ($c) { $parts.Add([string]$c) }
|        }
|        if ($ex.PSObject.Properties['Body'] -and $ex.Body) {
|            try { $parts.Add((ConvertTo-Json -InputObject $ex.Body -Depth 8 -Compress)) } catch { $parts.Add([string]$ex.Body) }
|        }
|        $ex = $ex.InnerException
|        $depth++
|    }
|    return (($parts | Where-Object { $_ }) -join ' | ')
|}
|
|function Get-SIKqlErrorSummary {
|    <# PURE. ONE log-ready line: the exception message plus the service's own error code(s) and the innermost
|       message, e.g. "Operation returned an invalid status code 'BadRequest' -- SemanticError/SEM0100: 'summarize'
|       operator: Failed to resolve scalar expression named 'AssetName'". Without it a query defect logs only
|       "BadRequest", which says nothing about what to fix. The bare message is kept at the front so classifiers that
|       match on it (BadRequest, TaskCanceledException, 502 ...) see exactly what they saw before. #>
|    param([Parameter(Mandatory)][AllowNull()]$ErrorRecord)
|    if ($null -eq $ErrorRecord) { return '' }
|    $ex = if ($ErrorRecord -is [System.Management.Automation.ErrorRecord]) { $ErrorRecord.Exception } else { $ErrorRecord }
|    $base = if ($ex -and $ex.PSObject.Properties['Message']) { [string]$ex.Message } else { [string]$ex }
|    $text = Get-SIKqlErrorText -ErrorRecord $ErrorRecord
|    if (-not $text) { return $base }
|    # The Log Analytics body nests the reason: error -> innererror (SemanticError / SyntaxError) -> innererror
|    # (SEM0100 ...). Collect the innererror chain of the first body found; the deepest message is the useful one.
|    $rx = '"innererror"\s*:\s*\{\s*"code"\s*:\s*"([^"]*)"\s*,\s*"message"\s*:\s*"((?:[^"\\]|\\.)*)"'
|    $ms = [regex]::Matches($text, $rx)
|    if ($ms.Count -eq 0) { return $base }
|    $codes = New-Object System.Collections.Generic.List[string]
|    $msg = ''
|    foreach ($m in $ms) {
|        $c = $m.Groups[1].Value
|        if ($codes.Contains($c)) { break }   # a second copy of the same body (typed body / ErrorDetails) starts here
|        $codes.Add($c)
|        $msg = $m.Groups[2].Value
|    }
|    try { $msg = [regex]::Unescape($msg) } catch { }
|    $detail = ('{0}: {1}' -f ($codes -join '/'), $msg)
|    if ($base -and $base.Contains($msg)) { return $base }
|    if (-not $base) { return $detail }
|    return ('{0} -- {1}' -f $base, $detail)
|}
|
|function Test-SIKqlTableMissing {
|    <# PURE. True only when the failure says THIS table does not exist in the workspace. #>
|    param([Parameter(Mandatory)][AllowNull()]$ErrorRecord, [Parameter(Mandatory)][string]$TableName)
|    $t = Get-SIKqlErrorText -ErrorRecord $ErrorRecord
|    if (-not $t) { return $false }
|    $name = [regex]::Escape($TableName)
|    # #876: a 'union' leaf says "table expression", a 'where' leaf "table or column expression" -- both: the table is not there
|    if ($t -match ("Failed to resolve table (?:or column )?expression named \\?['""]?{0}" -f $name)) { return $true }
|    if ($t -match $name -and $t -match '(?i)SEM0100|could not be found|does not exist|unknown table') { return $true }
|    return $false
|}
'@ }
$__siSupportFiles['auth/SI-ManagedIdentity.ps1'] = @{ Sha256 = '8198e8e891fb59de6e58fe9f8b08fe7f3f838586096d36758b85aa0e118f6673'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- sign in with a MANAGED IDENTITY: a container job's (#209), an Azure VM's or an Azure Arc
|    server's (#222).
|
|    WHY. An engine container could only sign in with an SPN client SECRET. Internal installs are certificate
|    only, and Pro is container only, so a certificate-only customer could not run Pro at all. PIM4EntraPS's
|    containers sign in as the job's managed identity; this copies that (PIM: Get-PimManagedIdentityToken).
|    #222 (operator 2026-10-03): the managed identity is the DEFAULT everywhere; an SPN stays supported.
|
|    THE ONE SWITCH. A run uses the managed identity when $global:SI_UseManagedIdentity = $true.
|        $global:SI_UAMI_ClientId = '<client id>'   optional: a USER-assigned identity; empty = the host's
|                                                    system-assigned identity
|    Who sets it: the container entry points (when the job has an identity endpoint), and on a VM the sign-in
|    decision in the config loader (auth/SI-AuthMethod.ps1). When it is off, every function below either is
|    never called or returns "not mine" -- the secret and certificate paths are exactly what they were.
|    The host decides the endpoint (Get-SIManagedIdentityHost): container IDENTITY_ENDPOINT + IDENTITY_HEADER;
|    Azure Arc IDENTITY_ENDPOINT + IMDS_ENDPOINT (401 challenge file); otherwise the Azure VM endpoint.
|
|    Log ingestion keeps its existing switch ($global:SI_PreferUami + SI_UAMI_ClientId -> -UseManagedIdentity on
|    SI's REST ingestion, which mints the token here); the container sets that from the same decision. No second
|    identity switch.
|
|    PS 5.1 safe: no ?. / ??.
|#>
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../engine/_shared/SI-AzRest.ps1') }
|
|$__siFindCert = Join-Path $PSScriptRoot 'Find-SICertificate.ps1'
|if ((Test-Path -LiteralPath $__siFindCert) -and -not (Get-Command Get-SICertificateFromStore -ErrorAction SilentlyContinue)) { . $__siFindCert }
|
|if (-not (Get-Variable -Name SIManagedIdentityTokenCache -Scope Script -ErrorAction SilentlyContinue)) {
|    $script:SIManagedIdentityTokenCache = @{}   # '<clientId>|<resource>' -> @{ Token; ExpiresAt }
|}
|
|function Test-SIUseManagedIdentity {
|    <# THE switch: this run signs in as a managed identity (a container job's, an Azure VM's or an Azure Arc
|       server's -- #222). The client id is optional: empty = the host's SYSTEM-assigned identity. #>
|    return [bool]$global:SI_UseManagedIdentity
|}
|
|function Get-SIManagedIdentityHost {
|    <#
|        PURE (reads env only). Which managed-identity endpoint this host has (#222):
|          Container -- Azure Container Apps / App Service: IDENTITY_ENDPOINT + IDENTITY_HEADER
|          Arc       -- an Azure Arc-enabled server: IDENTITY_ENDPOINT + IMDS_ENDPOINT, no IDENTITY_HEADER (the Arc
|                       agent sets both machine-wide); the token needs a challenge-file handshake
|          AzureVm   -- an Azure VM (and anything else): the instance metadata endpoint 169.254.169.254
|    #>
|    param([scriptblock]$GetEnv)
|    if (-not $GetEnv) { $GetEnv = { param($n) [Environment]::GetEnvironmentVariable($n) } }
|    $ep = [string](& $GetEnv 'IDENTITY_ENDPOINT'); $hd = [string](& $GetEnv 'IDENTITY_HEADER'); $imds = [string](& $GetEnv 'IMDS_ENDPOINT')
|    if ($ep -and $hd) { return 'Container' }
|    if ($ep -and $imds) { return 'Arc' }
|    return 'AzureVm'
|}
|
|function Get-SIManagedIdentityToken {
|    <#
|        A token for -Resource as this host's managed identity (#209 container, #222 Azure VM + Azure Arc):
|          Container -- IDENTITY_ENDPOINT + X-IDENTITY-HEADER, api-version 2019-08-01, client_id when known
|          AzureVm   -- http://169.254.169.254/metadata/identity/oauth2/token, Metadata: true, client_id when known
|          Arc       -- IDENTITY_ENDPOINT (api-version 2020-06-01, Metadata: true): the first call answers 401 with
|                       'WWW-Authenticate: Basic realm=<file>'; the file's content is the secret for the second call.
|                       Reading it needs local Administrators or the 'Hybrid agent extension applications' group. Arc
|                       has the SYSTEM-assigned identity only, so no client_id.
|
|        TRAP: THE client_id IS NOT OPTIONAL IN PRACTICE for a user-assigned identity. PIM4EntraPS measured it: with a
|        user-assigned identity only, the endpoint has nothing to default to and the failure surfaces far away as
|        "Login failed" / 401. So it is always sent when known.
|
|        Cached per identity + resource until 5 minutes before the token's own expiry. -Invoke is a test seam:
|        { param($Uri, $Headers) } returning the endpoint's response (Arc: the @{Status;Body;WwwAuthenticate} shape).
|        -ReadFile is a test seam for the Arc challenge file.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Resource,
|        [string]$ClientId,
|        [switch]$ForceRefresh,
|        [scriptblock]$Invoke,
|        [scriptblock]$ReadFile
|    )
|    # A guided install's own sign-in wins (live 2026-10-06, an AzContext install on an Azure VM got the VM's IMDS token for
|    # SQL): while $global:SI_InstallTokenProvider is set, the token comes from it and NO identity endpoint is called.
|    $installProvider = Get-Variable -Scope Global -Name SI_InstallTokenProvider -ValueOnly -ErrorAction Ignore
|    # Re-entry = the install's sign-in itself IS this host's managed identity (sign-in mode ManagedIdentity): then, and only
|    # then, the identity endpoint below answers.
|    if (($installProvider -is [scriptblock]) -and -not $global:SI_InstallTokenProviderBusy) {
|        $global:SI_InstallTokenProviderBusy = $true
|        try { $pt = [string](& $installProvider $Resource) } finally { $global:SI_InstallTokenProviderBusy = $false }
|        if ([string]::IsNullOrWhiteSpace($pt)) { throw ("the install's sign-in returned no token for '{0}'." -f $Resource) }
|        return $pt
|    }
|    # SELF-CONTAINED on purpose: it is published to the global scope and may run where this file's other functions are
|    # not visible. The host rule is Get-SIManagedIdentityHost's, repeated here.
|    $endpoint = [Environment]::GetEnvironmentVariable('IDENTITY_ENDPOINT')
|    $header   = [Environment]::GetEnvironmentVariable('IDENTITY_HEADER')
|    $imdsEp   = [Environment]::GetEnvironmentVariable('IMDS_ENDPOINT')
|    $hostKind = if ($endpoint -and $header) { 'Container' } elseif ($endpoint -and $imdsEp) { 'Arc' } else { 'AzureVm' }
|    $arcGet = {
|        param([string]$U, [hashtable]$H)
|        $req = [System.Net.HttpWebRequest]::Create($U)
|        $req.Method = 'GET'; $req.Timeout = 60000
|        foreach ($k in $H.Keys) { if ($k -eq 'Authorization') { $req.Headers['Authorization'] = [string]$H[$k] } else { $req.Headers.Add($k, [string]$H[$k]) } }
|        try { $r = $req.GetResponse() }
|        catch [System.Net.WebException] { $r = $_.Exception.Response; if (-not $r) { throw } }
|        try {
|            $sr = New-Object System.IO.StreamReader($r.GetResponseStream()); $b = $sr.ReadToEnd(); $sr.Close()
|            [pscustomobject]@{ Status = [int]$r.StatusCode; Body = $b; WwwAuthenticate = [string]$r.Headers['WWW-Authenticate'] }
|        } finally { $r.Close() }
|    }
|    if ([string]::IsNullOrWhiteSpace($ClientId)) { $ClientId = [string]$global:SI_UAMI_ClientId }
|    # The cache is created HERE, not only when this file loads: when this function runs from another scope, `$script:` is
|    # that scope and the file-level cache does not exist.
|    # Measured live 2026-10-02 (first container run on the identity): "You cannot call a method on a null-valued
|    # expression" on every token, and every Log Analytics post failed.
|    if ($null -eq $script:SIManagedIdentityTokenCache) { $script:SIManagedIdentityTokenCache = @{} }
|    $res = ($Resource -replace '/\.default$', '')
|    $key = '{0}|{1}' -f $ClientId, $res
|    if (-not $ForceRefresh -and $script:SIManagedIdentityTokenCache.ContainsKey($key)) {
|        $c = $script:SIManagedIdentityTokenCache[$key]
|        if ($c.ExpiresAt -gt [datetime]::UtcNow) { return $c.Token }
|    }
|
|    $resp = $null
|    switch ($hostKind) {
|        'Container' {
|            $uri = '{0}?resource={1}&api-version=2019-08-01' -f $endpoint, [uri]::EscapeDataString($res)
|            if (-not [string]::IsNullOrWhiteSpace($ClientId)) { $uri += '&client_id=' + [uri]::EscapeDataString($ClientId) }
|            $headers = @{ 'X-IDENTITY-HEADER' = $header }
|            $resp = if ($Invoke) { & $Invoke $uri $headers }
|                    else { Invoke-RestMethod -Method Get -Uri $uri -Headers $headers -TimeoutSec 60 }
|        }
|        'AzureVm' {
|            $uri = 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource={0}' -f [uri]::EscapeDataString($res)
|            if (-not [string]::IsNullOrWhiteSpace($ClientId)) { $uri += '&client_id=' + [uri]::EscapeDataString($ClientId) }
|            $headers = @{ 'Metadata' = 'true' }
|            $resp = if ($Invoke) { & $Invoke $uri $headers }
|                    else { Invoke-RestMethod -Method Get -Uri $uri -Headers $headers -TimeoutSec 60 }
|        }
|        'Arc' {
|            $uri = '{0}?api-version=2020-06-01&resource={1}' -f $endpoint, [uri]::EscapeDataString($res)
|            $first = if ($Invoke) { & $Invoke $uri @{ 'Metadata' = 'true' } } else { & $arcGet $uri @{ 'Metadata' = 'true' } }
|            if ([int]$first.Status -ne 401 -or [string]$first.WwwAuthenticate -notmatch '(?i)realm=(.+)$') {
|                throw ("managed identity (Azure Arc): expected a 401 challenge from {0}, got {1}. Is the Arc agent running?" -f $endpoint, $first.Status)
|            }
|            $keyFile = $Matches[1].Trim().Trim('"')
|            $secret = $null
|            try { $secret = if ($ReadFile) { & $ReadFile $keyFile } else { [System.IO.File]::ReadAllText($keyFile) } }
|            catch { throw ("managed identity (Azure Arc): cannot read the challenge file {0} -- the run must be a local Administrator or in the 'Hybrid agent extension applications' group. {1}" -f $keyFile, $_.Exception.Message) }
|            $second = if ($Invoke) { & $Invoke $uri @{ 'Metadata' = 'true'; 'Authorization' = ('Basic ' + $secret) } }
|                      else { & $arcGet $uri @{ 'Metadata' = 'true'; 'Authorization' = ('Basic ' + $secret) } }
|            if ([int]$second.Status -ne 200) { throw ("managed identity (Azure Arc): the identity endpoint refused the token request ({0})." -f $second.Status) }
|            $resp = $second.Body | ConvertFrom-Json
|        }
|    }
|    $token = [string]$resp.access_token
|    if ([string]::IsNullOrWhiteSpace($token)) {
|        throw ("managed identity ({2}): the identity endpoint returned no token for '{0}' (client id {1}). Is that identity assigned to this host / job?" -f $res, $ClientId, $hostKind)
|    }
|
|    $expiresAt = [datetime]::UtcNow.AddMinutes(50)
|    $epoch = 0L
|    if ([long]::TryParse([string]$resp.expires_on, [ref]$epoch) -and $epoch -gt 0) {
|        $expiresAt = [DateTimeOffset]::FromUnixTimeSeconds($epoch).UtcDateTime.AddMinutes(-5)
|    } else {
|        $secs = 0
|        if ([int]::TryParse([string]$resp.expires_in, [ref]$secs) -and $secs -gt 600) { $expiresAt = [datetime]::UtcNow.AddSeconds($secs - 300) }
|    }
|    $script:SIManagedIdentityTokenCache[$key] = @{ Token = $token; ExpiresAt = $expiresAt }
|    # #232 -- the licence is checked against the tenant the identity REALLY lives in. A managed identity's token always
|    # comes from its home tenant, whatever the configuration claims, so its 'tid' claim is the proof; a configured tenant
|    # id is not (a copied licence plus an edited config would otherwise pass). Recorded from every real token.
|    try {
|        $seg = $token.Split('.')
|        if ($seg.Count -ge 2) {
|            $p = $seg[1].Replace('-', '+').Replace('_', '/'); while ($p.Length % 4) { $p += '=' }
|            $tid = [string](([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($p))) | ConvertFrom-Json).tid
|            if ($tid -match '^[0-9a-fA-F-]{36}$') { $global:SI_IdentityTokenTenantId = $tid.ToLowerInvariant() }
|        }
|    } catch { }
|    try { [System.Console]::Out.WriteLine(("  [mi] token for {0} via the {2} identity endpoint (len {1})" -f $res, $token.Length, $hostKind)) } catch { }
|    return $token
|}
|
|function Get-SIAccessToken {
|    <#
|        "A token for resource X as the identity this run uses." The managed identity when the switch is on;
|        otherwise the run's own sign-in (Get-SIAzAccessToken, over REST).
|    #>
|    param([Parameter(Mandatory)][string]$Resource, [switch]$ForceRefresh)
|    if (Test-SIUseManagedIdentity) { return (Get-SIManagedIdentityToken -Resource $Resource -ForceRefresh:$ForceRefresh) }
|    $t = Get-SIAzAccessToken -ResourceUrl $Resource -ErrorAction Stop
|    if ($t.Token -is [System.Security.SecureString]) { return [System.Net.NetworkCredential]::new('', $t.Token).Password }
|    return [string]$t.Token
|}
'@ }
$__siSupportFiles['setup/_shared/SI-SetupSignIn.ps1'] = @{ Sha256 = 'f679aeea5410c99712147634239b38093e6d3973996f57bd67db46f4f947596c'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight SETUP -- signing in to Azure with NO PowerShell modules (native REST and .NET only).
|
|    WHO SIGNS IN, AND HOW
|      A person (the guided install, the wizard, Setup-SecurityInsight, Bootstrap-*, Grant-*, Validate-* ...):
|        * Azure Cloud Shell  -- the Cloud Shell token endpoint ($env:MSI_ENDPOINT, else $env:IDENTITY_ENDPOINT). It hands
|                                out tokens for the person who opened Cloud Shell, per resource, with no prompt.
|        * a workstation      -- OAuth 2.0 authorization code + PKCE in the person's own browser, answered on a loopback
|                                listener (System.Net.HttpListener on http://localhost:<free port>/). The client is the
|                                public Azure PowerShell client, so the same consent and the same Microsoft Graph rights
|                                (Directory.AccessAsUser.All) setup always had. NO device code: it is blocked by
|                                Conditional Access in many tenants and is deliberately not offered.
|        Tokens for the other resources (Graph, Key Vault, Storage, Log Analytics, SQL ...) come from the refresh token
|        (browser) or the Cloud Shell endpoint, on first use. EXCEPT Exchange Online (https://outlook.office365.com): its
|        admin API accepts only a token of the Exchange Online PowerShell client (Get-SISignInExchangeClientId), so the first
|        Exchange token is one more browser sign-in with that client (same flow, the account pre-filled), then its own
|        refresh token. Everything is kept IN MEMORY in this PowerShell process --
|        nothing is written to disk.
|      An app (unattended setup, CI): a certificate or a client secret -- recorded by Connect-SIAzAccount (REST), tokens
|        minted by engine/_shared (client assertion / client credentials). A managed identity likewise.
|
|    HOW THE REST LAYER USES IT
|      engine/_shared/SI-AzRest.ps1 asks Get-SIAzureToken for every token. setup/_shared/SI-SetupAzure.ps1 loads that file
|      and then defines Get-SIAzureToken once more, here: a USER sign-in is answered from this file, anything else exactly
|      as the engine does. So Invoke-SIArm, the *-SIAz* REST twins, Key Vault, Graph and storage all run as the signed-in
|      person without knowing it.
|
|    TEST SEAMS: every HTTP call goes through Invoke-SIAzRestHttp (engine); the browser through Open-SISignInBrowser; the
|    loopback wait through Wait-SILoopbackAuthCode. Pure helpers (PKCE pair, authorize URL, redirect parsing) are public.
|
|    PS 5.1 safe (no ?. / ??), pwsh 7 on Windows, Linux (Cloud Shell) and macOS.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|
|
|function Get-SISignInClientId {
|    <# The public client the browser sign-in uses: $global:SI_SetupSignInClientId (an organisation's own public app
|       registration with an http://localhost redirect) when set, else the Azure PowerShell client. #>
|    $c = "$(Get-Variable -Scope Global -Name SI_SetupSignInClientId -ValueOnly -ErrorAction Ignore)"
|    if ($c.Trim()) { return $c.Trim() }
|    return '1950a258-227b-4e31-a9cf-717495945fc2'
|}
|
|function Get-SISignInExchangeClientId {
|    <# The public client the Exchange Online admin API (https://outlook.office365.com/adminapi/...) is signed in with:
|       "Microsoft Exchange REST API Based Powershell", the client the Exchange Online PowerShell V3 module itself uses
|       (PIM4EntraPS does the same). A delegated token for Exchange must carry Exchange.Manage; the Azure PowerShell client
|       is not consented for it, so Exchange answered its token with 401 Unauthorized (customer ticket 2026-10-15).
|       $global:SI_SetupExchangeClientId overrides it (an organisation's own public app with Exchange.Manage). #>
|    $c = "$(Get-Variable -Scope Global -Name SI_SetupExchangeClientId -ValueOnly -ErrorAction Ignore)"
|    if ($c.Trim()) { return $c.Trim() }
|    return 'fb78d390-0c51-40cd-8e17-fdbfab77341b'
|}
|
|function Test-SISignInExchangeResource {
|    <# PURE. True for the Exchange Online resource (its admin API takes only a token of the Exchange client). #>
|    param([string]$Resource)
|    $r = ("$Resource" -replace '/\.default$', '').TrimEnd('/').ToLowerInvariant()
|    return ($r -eq 'https://outlook.office365.com' -or $r -eq 'https://outlook.office.com')
|}
|
|function Get-SISignInState {
|    <# The in-memory sign-in of this process: the user session (method, tenant, account, refresh token) and its tokens. #>
|    if (-not ((Get-Variable -Scope Global -Name SI_SetupSignInState -ValueOnly -ErrorAction Ignore) -is [hashtable])) {
|        $global:SI_SetupSignInState = @{ Session = $null; Tokens = @{} }
|    }
|    return $global:SI_SetupSignInState
|}
|
|function Test-SICloudShell {
|    <# True in Azure Cloud Shell: the Cloud Shell markers AND a token endpoint. #>
|    $marker = ([string]$env:AZUREPS_HOST_ENVIRONMENT) -like 'cloud-shell*' -or [bool]$env:ACC_CLOUD -or [bool]$env:ACC_TERM_ID
|    return ($marker -and [bool](Get-SICloudShellEndpoint))
|}
|
|function Get-SICloudShellEndpoint {
|    $e = [string]$env:MSI_ENDPOINT
|    if (-not $e.Trim()) { $e = [string]$env:IDENTITY_ENDPOINT }
|    return $e.Trim()
|}
|
|# ---------------------------------------------------------------------------------------------------------------
|# PURE helpers: PKCE, state, the authorize URL, the redirect, token claims
|# ---------------------------------------------------------------------------------------------------------------
|function ConvertTo-SIBase64Url {
|    param([Parameter(Mandatory)][byte[]]$Bytes)
|    return ([Convert]::ToBase64String($Bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_'))
|}
|
|function New-SIRandomBase64Url {
|    param([int]$ByteCount = 32)
|    $b = New-Object byte[] $ByteCount
|    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
|    try { $rng.GetBytes($b) } finally { $rng.Dispose() }
|    return (ConvertTo-SIBase64Url -Bytes $b)
|}
|
|function Get-SIPkceChallenge {
|    <# RFC 7636 S256: BASE64URL(SHA256(ASCII(verifier))). #>
|    param([Parameter(Mandatory)][string]$Verifier)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $h = $sha.ComputeHash([System.Text.Encoding]::ASCII.GetBytes($Verifier)) } finally { $sha.Dispose() }
|    return (ConvertTo-SIBase64Url -Bytes $h)
|}
|
|function New-SIPkcePair {
|    <# A fresh verifier (43 chars from 32 random bytes, inside RFC 7636's 43..128 unreserved set) and its S256 challenge. #>
|    $v = New-SIRandomBase64Url -ByteCount 32
|    return [pscustomobject]@{ Verifier = $v; Challenge = (Get-SIPkceChallenge -Verifier $v); Method = 'S256' }
|}
|
|function Get-SISignInScope {
|    <# The v2 scope of a resource: 'https://graph.microsoft.com/' -> 'https://graph.microsoft.com/.default'. #>
|    param([Parameter(Mandatory)][string]$Resource)
|    $r = ($Resource -replace '/\.default$', '').TrimEnd('/')
|    return ($r + '/.default')
|}
|
|function Get-SIAuthorizeUrl {
|    <# The Microsoft Entra authorize URL for the code + PKCE flow. #>
|    param(
|        [string]$TenantId,
|        [Parameter(Mandatory)][string]$ClientId,
|        [Parameter(Mandatory)][string]$RedirectUri,
|        [Parameter(Mandatory)][string]$Scope,
|        [Parameter(Mandatory)][string]$CodeChallenge,
|        [Parameter(Mandatory)][string]$State,
|        [string]$LoginHint,
|        [string]$Prompt = 'select_account'
|    )
|    $t = if ([string]::IsNullOrWhiteSpace($TenantId)) { 'organizations' } else { $TenantId.Trim() }
|    $q = [ordered]@{
|        client_id             = $ClientId
|        response_type         = 'code'
|        redirect_uri          = $RedirectUri
|        response_mode         = 'query'
|        scope                 = $Scope
|        state                 = $State
|        code_challenge        = $CodeChallenge
|        code_challenge_method = 'S256'
|    }
|    if ($Prompt) { $q['prompt'] = $Prompt }
|    if ($LoginHint) { $q['login_hint'] = $LoginHint }
|    $pairs = foreach ($k in $q.Keys) { '{0}={1}' -f $k, [uri]::EscapeDataString([string]$q[$k]) }
|    return ('https://login.microsoftonline.com/{0}/oauth2/v2.0/authorize?{1}' -f [uri]::EscapeDataString($t), ($pairs -join '&'))
|}
|
|function ConvertFrom-SIQueryString {
|    <# '?a=1&b=x%20y' -> @{ a = '1'; b = 'x y' } (case-insensitive keys). #>
|    param([string]$Query)
|    $h = New-Object 'System.Collections.Hashtable' ([System.StringComparer]::OrdinalIgnoreCase)
|    $q = ([string]$Query).TrimStart('?')
|    foreach ($p in ($q -split '&')) {
|        if (-not $p) { continue }
|        $i = $p.IndexOf('=')
|        $k = if ($i -ge 0) { $p.Substring(0, $i) } else { $p }
|        $v = if ($i -ge 0) { $p.Substring($i + 1) } else { '' }
|        $h[[uri]::UnescapeDataString($k.Replace('+', ' '))] = [uri]::UnescapeDataString($v.Replace('+', ' '))
|    }
|    return $h
|}
|
|function Resolve-SIAuthRedirect {
|    <#
|        The browser's redirect back to the loopback listener -> the authorization code. Throws in customer language when
|        Entra returned an error, when the state does not match (a response this sign-in did not ask for), or when no
|        code came back.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Query, [Parameter(Mandatory)][string]$ExpectedState)
|    $q = ConvertFrom-SIQueryString -Query $Query
|    if ($q['error']) {
|        $d = [string]$q['error_description']
|        throw ("The Microsoft sign-in did not complete: {0}{1}" -f $q['error'], $(if ($d) { ' -- ' + $d } else { '' }))
|    }
|    if ([string]$q['state'] -ne $ExpectedState) {
|        throw 'The sign-in answer did not belong to this sign-in (the state value does not match). Nothing was signed in; run the same command again.'
|    }
|    if (-not $q['code']) { throw 'The sign-in answer carried no authorization code. Run the same command again.' }
|    return [string]$q['code']
|}
|
|function ConvertFrom-SISignInJwt {
|    <# The claims of a JWT (no signature check -- only read to learn the tenant, the account and the expiry). #>
|    param([string]$Token)
|    $parts = ([string]$Token) -split '\.'
|    if ($parts.Count -lt 2) { return $null }
|    $p = $parts[1].Replace('-', '+').Replace('_', '/')
|    switch ($p.Length % 4) { 2 { $p += '==' } 3 { $p += '=' } }
|    try { return ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($p)) | ConvertFrom-Json) } catch { return $null }
|}
|
|function Get-SISignInAccountName {
|    param($Claims)
|    if (-not $Claims) { return $null }
|    foreach ($n in 'upn', 'preferred_username', 'unique_name', 'email', 'oid') {
|        if ($Claims.PSObject.Properties[$n] -and [string]$Claims.$n) { return [string]$Claims.$n }
|    }
|    return $null
|}
|
|function Get-SITokenExpiry {
|    <# When a token response expires (5 minutes early): expires_in (seconds) or expires_on (unix seconds / a date). #>
|    param($Response)
|    $now = [datetime]::UtcNow
|    $s = 0
|    if ($Response.PSObject.Properties['expires_in'] -and [int]::TryParse([string]$Response.expires_in, [ref]$s) -and $s -gt 0) {
|        return $now.AddSeconds([Math]::Max(60, $s - 300))
|    }
|    if ($Response.PSObject.Properties['expires_on']) {
|        $l = 0L
|        if ([long]::TryParse([string]$Response.expires_on, [ref]$l) -and $l -gt 0) {
|            return ([DateTimeOffset]::FromUnixTimeSeconds($l).UtcDateTime.AddMinutes(-5))
|        }
|        $d = [datetime]::MinValue
|        if ([datetime]::TryParse([string]$Response.expires_on, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::AdjustToUniversal, [ref]$d)) {
|            return $d.AddMinutes(-5)
|        }
|    }
|    return $now.AddMinutes(30)
|}
|
|# ---------------------------------------------------------------------------------------------------------------
|# HANDED-OVER TOKENS (#876, owner 2026-10-21 "test trial with support app today"): Invardia's bootstrap may hand the
|# install the access tokens it already holds, in $env:SI_HANDOFF_TOKENS -- the same shape as PIM_HANDOFF_TOKENS:
|#   { "https://management.azure.com/": { "access_token": "...", "expires_on": <unix seconds> },
|#     "https://graph.microsoft.com/": {...}, "https://database.windows.net/": {...} }
|# With them the install signs in to NOTHING itself: no browser, no Cloud Shell endpoint, no app sign-in. The tokens may be
|# a person's (delegated) or an application's (the Invardia Support app: idtyp app, no scp) -- the claims say which, and an
|# application's object id (oid) IS its service principal's. Every token must be for the SAME tenant (and for the install's
|# tenant when one is named): one for another tenant refuses the whole hand-over. Read ONCE, kept in memory only
|# ($global:SI_SetupHandoff), and the variable is removed from the environment so no later process inherits it. No refresh
|# token crosses over, so a token cannot be renewed: when one is about to run out the install STOPS with one plain line
|# and resumes from that step with a fresh hand-over. An Invardia Support session open in the same shell wins over the
|# hand-over (its calls are recorded in the customer's audit log and its tokens are renewed by the session).
|# ---------------------------------------------------------------------------------------------------------------
|$script:SIHandoffMinMinutes = 2
|
|function Get-SIHandoffResourceKey {
|    <# PURE. The comparison key of a token audience: 'https://graph.microsoft.com' and '.../' and '.../.default' are one. #>
|    param([string]$Resource)
|    return ((("$Resource".Trim()) -replace '/\.default$', '').TrimEnd('/') + '/').ToLowerInvariant()
|}
|
|function Get-SIHandoffExpiredText {
|    <# PURE. The one line said when a handed-over token runs out (the install resumes from the step it stopped at). #>
|    param([string]$Resource)
|    $what = if ("$Resource".Trim()) { ' (for {0})' -f (Get-SIHandoffResourceKey $Resource).TrimEnd('/') } else { '' }
|    'The hand-over sign-in{0} has expired -- restart the install with a fresh code from the installation page (the install resumes where it stopped).' -f $what
|}
|
|function Import-SIHandoffTokens {
|    <#
|        PURE given -Json and -NowUtc. Reads the bootstrap's hand-over JSON. Returns
|          @{ Present; Ok; Reason; TenantId; IsApp; ObjectId; AppId; Account; Tokens = @{ <resource key> = @{ Token; ExpiresAt } } }
|        Present = something was handed over. Ok = it can be used (at least an Azure Resource Manager token, every token for
|        one tenant -- -TenantId when given -- and every token of one kind: all a person's or all one application's).
|        Reason (when not Ok) never contains token text. ExpiresAt = the earlier of expires_on and the token's own exp.
|    #>
|    param([AllowEmptyString()][string]$Json, [string]$TenantId, [datetime]$NowUtc = [datetime]::UtcNow)
|    $out = @{ Present = $false; Ok = $false; Reason = ''; TenantId = ''; IsApp = $false; ObjectId = ''; AppId = ''; Account = ''; Tokens = @{} }
|    if (-not "$Json".Trim()) { return $out }
|    $out.Present = $true
|    $o = $null
|    try { $o = "$Json" | ConvertFrom-Json } catch { $out.Reason = 'the hand-over could not be read (it is not JSON)'; return $out }
|    $tids = @(); $kinds = @(); $oids = @()
|    foreach ($p in @($o.PSObject.Properties)) {
|        $v = $p.Value; $tok = ''; $exp = $null
|        if ($v -is [string]) { $tok = $v }
|        elseif ($null -ne $v -and $v.PSObject.Properties['access_token']) { $tok = [string]$v.access_token; if ($v.PSObject.Properties['expires_on']) { $exp = $v.expires_on } }
|        if (-not $tok.Trim()) { continue }
|        $c = ConvertFrom-SISignInJwt $tok
|        if (-not $c -or -not $c.PSObject.Properties['tid'] -or -not [string]$c.tid) { $out.Reason = ('the token handed over for {0} cannot be read (no tenant in it)' -f $p.Name); return $out }
|        $tid = ([string]$c.tid).Trim().ToLowerInvariant()
|        if ("$TenantId".Trim() -and $tid -ne "$TenantId".Trim().ToLowerInvariant()) {
|            $out.Reason = ('the token handed over for {0} is for tenant {1}, not this installation''s tenant {2}' -f $p.Name, $tid, "$TenantId".Trim()); return $out
|        }
|        $isApp = ([string]$(if ($c.PSObject.Properties['idtyp']) { $c.idtyp } else { '' }) -eq 'app') -or -not ($c.PSObject.Properties['scp'] -and [string]$c.scp)
|        # the expiry: the earlier of what the bootstrap says and the token's own exp claim
|        $ends = @()
|        $l = 0L
|        if ($null -ne $exp -and [long]::TryParse([string]$exp, [ref]$l) -and $l -gt 0) { $ends += [DateTimeOffset]::FromUnixTimeSeconds($l).UtcDateTime }
|        if ($c.PSObject.Properties['exp'] -and [long]::TryParse([string]$c.exp, [ref]$l) -and $l -gt 0) { $ends += [DateTimeOffset]::FromUnixTimeSeconds($l).UtcDateTime }
|        if (-not $ends.Count) { $out.Reason = ('the token handed over for {0} carries no expiry' -f $p.Name); return $out }
|        $out.Tokens[(Get-SIHandoffResourceKey $p.Name)] = @{ Token = $tok; ExpiresAt = (@($ends | Sort-Object) | Select-Object -First 1) }
|        $tids += $tid; $kinds += $isApp; $oids += ([string]$(if ($c.PSObject.Properties['oid']) { $c.oid } else { '' })).ToLowerInvariant()
|        if (-not $out.AppId -and $c.PSObject.Properties['appid']) { $out.AppId = [string]$c.appid }
|        if (-not $out.AppId -and $c.PSObject.Properties['azp']) { $out.AppId = [string]$c.azp }
|        if (-not $out.Account -and -not $isApp) { $out.Account = [string](Get-SISignInAccountName $c) }
|    }
|    if (-not $out.Tokens.Count) { $out.Reason = 'the hand-over holds no token'; return $out }
|    if (@($tids | Select-Object -Unique).Count -gt 1) { $out.Reason = ('the tokens handed over are for different tenants ({0})' -f ((@($tids | Select-Object -Unique)) -join ', ')); $out.Tokens = @{}; return $out }
|    if (@($kinds | Select-Object -Unique).Count -gt 1 -or @($oids | Where-Object { $_ } | Select-Object -Unique).Count -gt 1) {
|        $out.Reason = 'the tokens handed over are not all for the same identity'; $out.Tokens = @{}; return $out
|    }
|    if (-not $out.Tokens.ContainsKey('https://management.azure.com/')) { $out.Reason = 'the hand-over holds no Azure Resource Manager token'; $out.Tokens = @{}; return $out }
|    $out.TenantId = [string]$tids[0]; $out.IsApp = [bool]$kinds[0]
|    $out.ObjectId = [string](@($oids | Where-Object { $_ }) | Select-Object -First 1)
|    if ($out.IsApp) { $out.Account = $out.AppId }
|    $out.Ok = $true
|    return $out
|}
|
|function Get-SISetupHandoff {
|    <#
|        The hand-over of this process ($global:SI_SetupHandoff), read from $env:SI_HANDOFF_TOKENS the first time it is asked
|        for (then removed from the environment). $null when nothing was handed over. -TenantId: the install's tenant (a
|        hand-over for another tenant THROWS -- never used, never silently replaced by another sign-in).
|    #>
|    param([string]$TenantId)
|    $h = Get-Variable -Scope Global -Name SI_SetupHandoff -ValueOnly -ErrorAction Ignore
|    if (-not ($h -is [hashtable])) {
|        $json = [string][Environment]::GetEnvironmentVariable('SI_HANDOFF_TOKENS')
|        if (-not $json.Trim()) { return $null }
|        $h = Import-SIHandoffTokens -Json $json -TenantId $TenantId
|        [Environment]::SetEnvironmentVariable('SI_HANDOFF_TOKENS', $null)
|        Remove-Item -Path 'env:SI_HANDOFF_TOKENS' -ErrorAction SilentlyContinue
|        $global:SI_SetupHandoff = $h
|    }
|    if (-not $h.Present) { return $null }
|    if (-not $h.Ok) { throw ('The sign-in handed over by the installation page cannot be used: {0}. Nothing was changed. Restart the install with a fresh code from the installation page.' -f $h.Reason) }
|    if ("$TenantId".Trim() -and $h.TenantId -and $h.TenantId -ne "$TenantId".Trim().ToLowerInvariant()) {
|        throw ('The sign-in handed over by the installation page is for tenant {0}, not this installation''s tenant {1}. Nothing was changed. Restart the install from the installation page of tenant {1}.' -f $h.TenantId, "$TenantId".Trim())
|    }
|    return $h
|}
|
|function Test-SISetupHandoffPresent {
|    <# Was a sign-in handed over to this process (and not refused)? Never throws. #>
|    try { return [bool](Get-SISetupHandoff) } catch { return $false }
|}
|
|function Get-SISetupHandoffStatus {
|    <#
|        PURE given -NowUtc. Which handed-over tokens are usable for at least -MinMinutes more: @{ Expired = @(<resource>);
|        Missing = @(<resource>) } over -Resources. Used before each install step, so a step never starts on a token that
|        runs out under it.
|    #>
|    param([Parameter(Mandatory)][hashtable]$Handoff, [string[]]$Resources = @('https://management.azure.com/'), [datetime]$NowUtc = [datetime]::UtcNow, [int]$MinMinutes = $script:SIHandoffMinMinutes)
|    $exp = @(); $miss = @()
|    foreach ($r in $Resources) {
|        $k = Get-SIHandoffResourceKey $r
|        if (-not $Handoff.Tokens.ContainsKey($k)) { $miss += $k; continue }
|        if ($Handoff.Tokens[$k].ExpiresAt -le $NowUtc.AddMinutes($MinMinutes)) { $exp += $k }
|    }
|    @{ Expired = $exp; Missing = $miss }
|}
|
|# ---------------------------------------------------------------------------------------------------------------
|# The loopback listener and the browser
|# ---------------------------------------------------------------------------------------------------------------
|function Get-SIFreeLoopbackPort {
|    <# A free TCP port on the loopback interface (the OS picks it). #>
|    $l = New-Object System.Net.Sockets.TcpListener([System.Net.IPAddress]::Loopback, 0)
|    try { $l.Start(); return ([System.Net.IPEndPoint]$l.LocalEndpoint).Port } finally { $l.Stop() }
|}
|
|function Get-SISignInEdgePath {
|    <# The Microsoft Edge executable on Windows ($null when absent): the sign-in opens InPrivate in it. #>
|    foreach ($b in @(${env:ProgramFiles(x86)}, $env:ProgramFiles)) {
|        if (-not "$b".Trim()) { continue }
|        $p = [IO.Path]::Combine($b, 'Microsoft', 'Edge', 'Application', 'msedge.exe')
|        if (Test-Path -LiteralPath $p) { return $p }
|    }
|    $null
|}
|
|function Open-SISignInBrowser {
|    <#
|        Opens the sign-in page. Never throws: the URL is always printed as well.
|        #564 (PIM's install at customer I, 2026-10-10): a normal browser window opens the DEFAULT profile, whose saved account signs in
|        silently -- the person never sees a credential prompt and lands in the wrong tenant. On Windows the page opens in an
|        Edge InPrivate window (no saved account, the sign-in form always appears); without Edge, the default browser.
|        SI_SIGNIN_BROWSER=none: nothing is opened -- the person pastes the printed address into the right browser profile.
|    #>
|    param([Parameter(Mandatory)][string]$Url)
|    if ("$env:SI_SIGNIN_BROWSER".Trim().ToLowerInvariant() -eq 'none') { return $false }
|    try {
|        if ($PSVersionTable.PSEdition -ne 'Core' -or $IsWindows) {
|            $edge = Get-SISignInEdgePath
|            if ($edge) { Start-Process -FilePath $edge -ArgumentList @('--inprivate', '--new-window', $Url) | Out-Null; return $true }
|            Start-Process -FilePath $Url | Out-Null; return $true
|        }
|        if ($IsMacOS) { & open $Url 2>$null | Out-Null; return $true }
|        & xdg-open $Url 2>$null | Out-Null
|        return $true
|    } catch { return $false }
|}
|
|function Wait-SILoopbackAuthCode {
|    <#
|        Listens on http://localhost:<Port>/ (the loopback interface only) for the browser's redirect, answers it with a
|        short page, and returns the request's query string. -Listener is a test seam (an HttpListener the test drives).
|    #>
|    param([Parameter(Mandatory)][int]$Port, [int]$TimeoutSec = 300, $Listener)
|    $own = $false
|    if (-not $Listener) {
|        $Listener = New-Object System.Net.HttpListener
|        $Listener.Prefixes.Add(('http://localhost:{0}/' -f $Port))
|        $Listener.Start()
|        $own = $true
|    }
|    try {
|        $deadline = [datetime]::UtcNow.AddSeconds($TimeoutSec)
|        while ($true) {
|            $task = $Listener.GetContextAsync()
|            $left = [int][Math]::Max(1, ($deadline - [datetime]::UtcNow).TotalMilliseconds)
|            if (-not $task.Wait($left)) {
|                throw ('No answer from the browser sign-in within {0} seconds. Run the same command again and complete the sign-in in the browser window that opens.' -f $TimeoutSec)
|            }
|            $ctx = $task.Result
|            $query = [string]$ctx.Request.Url.Query
|            $isAnswer = ($query -match '(^|[?&])(code|error)=')
|            $html = if ($isAnswer) {
|                '<!doctype html><html><head><meta charset="utf-8"><title>SecurityInsight sign-in</title></head><body style="font-family:Segoe UI,Arial,sans-serif;margin:40px"><h2>SecurityInsight</h2><p>The sign-in is complete. You can close this window and return to PowerShell.</p></body></html>'
|            } else { '<!doctype html><html><body></body></html>' }
|            $bytes = [System.Text.Encoding]::UTF8.GetBytes($html)
|            try {
|                $ctx.Response.StatusCode = 200
|                $ctx.Response.ContentType = 'text/html; charset=utf-8'
|                $ctx.Response.ContentLength64 = $bytes.Length
|                $ctx.Response.OutputStream.Write($bytes, 0, $bytes.Length)
|            } finally { $ctx.Response.OutputStream.Close(); $ctx.Response.Close() }
|            if ($isAnswer) { return $query }
|            # a favicon or a probe: keep listening for the real redirect
|        }
|    } finally {
|        if ($own) { try { $Listener.Stop(); $Listener.Close() } catch { } }
|    }
|}
|
|# ---------------------------------------------------------------------------------------------------------------
|# Token endpoints
|# ---------------------------------------------------------------------------------------------------------------
|function Invoke-SISignInTokenRequest {
|    <# POST to the Entra v2 token endpoint of -TenantId with -Form. Returns the parsed response; throws Entra's own
|       error text (AADSTS...) in a customer sentence. #>
|    param([Parameter(Mandatory)][string]$TenantId, [Parameter(Mandatory)][System.Collections.IDictionary]$Form, [string]$What = 'Sign-in')
|    $pairs = foreach ($k in $Form.Keys) { '{0}={1}' -f $k, [uri]::EscapeDataString([string]$Form[$k]) }
|    $uri = 'https://login.microsoftonline.com/{0}/oauth2/v2.0/token' -f [uri]::EscapeDataString($TenantId)
|    $r = Invoke-SIAzRestHttp -Method POST -Uri $uri -Body ($pairs -join '&') -ContentType 'application/x-www-form-urlencoded' -TimeoutSec 60
|    $code = [int]$r.StatusCode
|    $j = $null; try { $j = ([string]$r.Content) | ConvertFrom-Json } catch { }
|    if ($code -lt 200 -or $code -ge 300 -or -not $j -or -not $j.access_token) {
|        $msg = if ($j -and $j.error_description) { ([string]$j.error_description -split "`r?`n")[0] } elseif ($code -eq 0) { [string]$r.Content } else { [string]$r.Content }
|        throw ('{0} failed (HTTP {1}): {2}' -f $What, $code, $msg)
|    }
|    return $j
|}
|
|function Get-SICloudShellToken {
|    <# A token for -Resource from the Azure Cloud Shell token endpoint: the person who opened Cloud Shell. #>
|    param([Parameter(Mandatory)][string]$Resource)
|    $ep = Get-SICloudShellEndpoint
|    if (-not $ep) { throw 'This is not Azure Cloud Shell: no Cloud Shell token endpoint (MSI_ENDPOINT) is set.' }
|    $res = ($Resource -replace '/\.default$', '').TrimEnd('/') + '/'
|    $r = Invoke-SIAzRestHttp -Method POST -Uri $ep -Headers @{ Metadata = 'true' } -Body ('resource=' + [uri]::EscapeDataString($res)) `
|             -ContentType 'application/x-www-form-urlencoded' -TimeoutSec 60
|    $j = $null; try { $j = ([string]$r.Content) | ConvertFrom-Json } catch { }
|    if ([int]$r.StatusCode -lt 200 -or [int]$r.StatusCode -ge 300 -or -not $j -or -not $j.access_token) {
|        throw ('Azure Cloud Shell did not hand out a token for {0} (HTTP {1}): {2}. Close and reopen Cloud Shell, then run the same command again.' -f $res, $r.StatusCode, $r.Content)
|    }
|    return [pscustomobject]@{ Token = [string]$j.access_token; ExpiresAt = (Get-SITokenExpiry -Response $j) }
|}
|
|# ---------------------------------------------------------------------------------------------------------------
|# The user session
|# ---------------------------------------------------------------------------------------------------------------
|function Send-SISignInNotice {
|    <#
|        #564: says "waiting: sign-in required for <resource> in tenant <t>" BEFORE a browser window opens -- on the console
|        and to the host's progress feed: $global:SI_SignInNotify = { param($Resource, $TenantId) ... } (the guided install
|        registers it and posts the line as an event, so the status page shows WHY the install waits). Never throws.
|    #>
|    param([Parameter(Mandatory)][string]$Resource, [string]$TenantId)
|    $t = if ("$TenantId".Trim()) { "$TenantId".Trim() } else { 'your organisation' }
|    Write-Host ('waiting: sign-in required for {0} in tenant {1}' -f $Resource, $t) -ForegroundColor Yellow
|    $n = Get-Variable -Scope Global -Name SI_SignInNotify -ValueOnly -ErrorAction Ignore
|    if ($n -is [scriptblock]) { try { & $n $Resource $TenantId } catch { } }
|}
|
|function Assert-SISignInTenant {
|    <# PURE apart from throwing. #564: a token whose tid is not the target tenant (a wrong browser profile or account) is
|       refused before any call is made with it. No target tenant (or not a tenant id) = nothing to compare. #>
|    param([AllowEmptyString()][string]$Token, [string]$TenantId, [string]$Where = 'the browser')
|    if (-not "$TenantId".Trim() -or "$TenantId" -notmatch '^[0-9a-fA-F-]{36}$') { return }
|    $c = ConvertFrom-SISignInJwt $Token
|    $tid = if ($c -and $c.PSObject.Properties['tid']) { [string]$c.tid } else { '' }
|    if ($tid -and $tid -ne $TenantId) {
|        throw ('You signed in to tenant {0} in {1}, but this installation is for tenant {2}. Sign in with an account of tenant {2} (open the address in the browser profile of an admin of that tenant), then run the same command again.' -f $tid, $Where, $TenantId)
|    }
|}
|
|function Test-SISignInInteractive {
|    <# Can this session open a browser for a person? (A seam: tests fake it -- a gate run over SSH is never interactive.) #>
|    $interactive = $true
|    try { $interactive = [Environment]::UserInteractive } catch { }
|    [bool]$interactive
|}
|
|function Invoke-SIBrowserCodeSignIn {
|    <#
|        ONE browser sign-in (authorization code + PKCE on a loopback listener) for -Resource with the public client
|        -ClientId. Returns Entra's token response (access_token, refresh_token, expires_in). The account must belong to
|        -TenantId (#564). -Prompt '' with a -LoginHint lets the browser reuse the person's sign-in (no account picker).
|    #>
|    param(
|        [string]$TenantId,
|        [Parameter(Mandatory)][string]$ClientId,
|        [Parameter(Mandatory)][string]$Resource,
|        [string]$LoginHint,
|        [string]$Prompt = 'select_account',
|        [string]$What = 'Azure Resource Manager',
|        [string]$Title = 'Sign in to Azure in your browser.',
|        [string]$FailText = 'The Azure sign-in',
|        [int]$TimeoutSec = 300
|    )
|    $pkce = New-SIPkcePair
|    $state = New-SIRandomBase64Url -ByteCount 16
|    $port = Get-SIFreeLoopbackPort
|    $redirect = 'http://localhost:{0}/' -f $port
|    $scope = (Get-SISignInScope -Resource $Resource) + ' offline_access openid profile'
|    $url = Get-SIAuthorizeUrl -TenantId $TenantId -ClientId $ClientId -RedirectUri $redirect -Scope $scope -CodeChallenge $pkce.Challenge -State $state -LoginHint $LoginHint -Prompt $Prompt
|    # #564: the reason for the wait is said BEFORE any window opens; the address is always printed
|    Send-SISignInNotice -Resource $What -TenantId $TenantId
|    $who = if ($TenantId) { 'an admin of tenant ' + $TenantId } else { 'the admin who installs' }
|    Write-Host ''
|    Write-Host ('{0} If no window opens, or it opens in the wrong profile or account, open this address in the browser profile of {1}:' -f $Title, $who) -ForegroundColor Cyan
|    Write-Host ('  {0}' -f $url)
|    $null = Open-SISignInBrowser -Url $url
|    $query = Wait-SILoopbackAuthCode -Port $port -TimeoutSec $TimeoutSec
|    $code = Resolve-SIAuthRedirect -Query $query -ExpectedState $state
|    $authTenant = if ($TenantId) { $TenantId } else { 'organizations' }
|    $j = Invoke-SISignInTokenRequest -TenantId $authTenant -What $FailText -Form ([ordered]@{
|        client_id     = $ClientId
|        grant_type    = 'authorization_code'
|        code          = $code
|        redirect_uri  = $redirect
|        code_verifier = $pkce.Verifier
|        scope         = $scope
|    })
|    # #564: the account must belong to the TARGET tenant -- refused here, before any call uses the token
|    Assert-SISignInTenant -Token ([string]$j.access_token) -TenantId $TenantId -Where 'the browser'
|    return $j
|}
|
|function Connect-SISetupUser {
|    <#
|        Signs a PERSON in for setup and records the session in this process (memory only).
|          -Method Auto       Cloud Shell when this is Cloud Shell, else the browser (code + PKCE on a loopback listener)
|          -Method CloudShell the Cloud Shell token endpoint
|          -Method Browser    the browser
|        -TenantId: the tenant to sign in to (the browser signs in there; Cloud Shell must already be in it).
|        Returns the session: Method, TenantId, Account, ObjectId.
|    #>
|    param(
|        [string]$TenantId,
|        [ValidateSet('Auto', 'CloudShell', 'Browser', 'Handoff')][string]$Method = 'Auto',
|        [string]$LoginHint,
|        [int]$TimeoutSec = 300,
|        [string]$ClientId
|    )
|    # #876: a sign-in handed over by the installation page answers first -- nothing is signed in here
|    $ho = $null
|    if ($Method -in 'Auto', 'Handoff') { $ho = Get-SISetupHandoff -TenantId $TenantId }
|    if ($Method -eq 'Handoff' -and -not $ho) { throw 'No sign-in was handed over to this PowerShell session (SI_HANDOFF_TOKENS is not set).' }
|    if ($ho) { $Method = 'Handoff' }
|    if ($Method -eq 'Auto') { $Method = if (Test-SICloudShell) { 'CloudShell' } else { 'Browser' } }
|    $st = Get-SISignInState
|    $st.Tokens = @{}
|    $st['Exchange'] = $null
|    $arm = 'https://management.azure.com/'
|    if ($Method -eq 'Handoff') {
|        $armTok = $ho.Tokens[$arm]
|        if ($armTok.ExpiresAt -le [datetime]::UtcNow.AddMinutes($script:SIHandoffMinMinutes)) { throw (Get-SIHandoffExpiredText -Resource $arm) }
|        $st.Session = @{ Method = 'Handoff'; TenantId = $ho.TenantId; Account = $ho.Account; ObjectId = $ho.ObjectId; IsApp = [bool]$ho.IsApp; AppId = $ho.AppId; RefreshToken = $null; ClientId = $null }
|        foreach ($k in @($ho.Tokens.Keys)) { $st.Tokens[$k] = @{ Token = $ho.Tokens[$k].Token; ExpiresAt = $ho.Tokens[$k].ExpiresAt } }
|        Write-Host ('Using the sign-in handed over by the installation page: {0} {1} (tenant {2}) -- no sign-in here.' -f $(if ($ho.IsApp) { 'the application' } else { 'the account' }), $ho.Account, $ho.TenantId) -ForegroundColor Green
|        return [pscustomobject]@{ Method = 'Handoff'; TenantId = $ho.TenantId; Account = $ho.Account; ObjectId = $ho.ObjectId; IsApp = [bool]$ho.IsApp }
|    }
|    if ($Method -eq 'CloudShell') {
|        $t = Get-SICloudShellToken -Resource $arm
|        $c = ConvertFrom-SISignInJwt $t.Token
|        $tid = if ($c) { [string]$c.tid } else { '' }
|        if ($TenantId -and $tid -and $tid -ne $TenantId) {
|            throw ("Azure Cloud Shell is signed in to tenant {0}, but this needs tenant {1}. Switch directory in the Azure portal (Settings > Directories), reopen Cloud Shell, then run the same command again." -f $tid, $TenantId)
|        }
|        $st.Session = @{ Method = 'CloudShell'; TenantId = $tid; Account = (Get-SISignInAccountName $c); ObjectId = $(if ($c) { [string]$c.oid } else { '' }); RefreshToken = $null; ClientId = $null }
|        $st.Tokens[$arm] = @{ Token = $t.Token; ExpiresAt = $t.ExpiresAt }
|    } else {
|        if (Test-SICloudShell) {
|            # #564: Cloud Shell has its own token endpoint (-Method CloudShell / Auto); a localhost answer cannot reach it
|            throw 'Azure Cloud Shell cannot take the browser sign-in''s answer (it goes to localhost on your own machine). In Cloud Shell setup signs in through Cloud Shell itself: run the same command without asking for the browser sign-in.'
|        }
|        if (-not (Test-SISignInInteractive)) {
|            throw 'A person has to sign in for this step, and this PowerShell session cannot open a browser. Run it in an interactive session or in Azure Cloud Shell, or sign in with an app (certificate or client secret).'
|        }
|        if (-not $ClientId) { $ClientId = Get-SISignInClientId }
|        $j = Invoke-SIBrowserCodeSignIn -TenantId $TenantId -ClientId $ClientId -Resource $arm -LoginHint $LoginHint -TimeoutSec $TimeoutSec
|        $c = ConvertFrom-SISignInJwt ([string]$j.access_token)
|        $tid = if ($c -and $c.tid) { [string]$c.tid } else { $TenantId }
|        $st.Session = @{ Method = 'Browser'; TenantId = $tid; Account = (Get-SISignInAccountName $c); ObjectId = $(if ($c) { [string]$c.oid } else { '' }); RefreshToken = [string]$j.refresh_token; ClientId = $ClientId }
|        $st.Tokens[$arm] = @{ Token = [string]$j.access_token; ExpiresAt = (Get-SITokenExpiry -Response $j) }
|    }
|    Write-Host ('Signed in to Azure as {0} (tenant {1}, {2}).' -f $st.Session.Account, $st.Session.TenantId, $(if ($st.Session.Method -eq 'CloudShell') { 'Azure Cloud Shell' } else { 'browser sign-in' })) -ForegroundColor Green
|    return [pscustomobject]@{ Method = $st.Session.Method; TenantId = $st.Session.TenantId; Account = $st.Session.Account; ObjectId = $st.Session.ObjectId }
|}
|
|function Test-SISetupUserSignedIn {
|    $st = Get-SISignInState
|    return ($st.Session -is [hashtable])
|}
|
|function Get-SISetupUserToken {
|    <# A token for -Resource as the signed-in person: memory cache, else the Cloud Shell endpoint or the refresh token. #>
|    param([Parameter(Mandatory)][string]$Resource, [switch]$ForceRefresh)
|    $st = Get-SISignInState
|    $s = $st.Session
|    if (-not ($s -is [hashtable])) { throw 'No one is signed in to Azure in this PowerShell session. Run the same command again to sign in.' }
|    $res = ($Resource -replace '/\.default$', '').TrimEnd('/') + '/'
|    if ($s.Method -eq 'Handoff') {
|        # #876: a handed-over token cannot be renewed here (no refresh token crosses over): one that is about to run out
|        # stops the step with one plain line, and the install resumes from that step with a fresh hand-over
|        $k = Get-SIHandoffResourceKey $res
|        $hit = $null
|        foreach ($tk in @($st.Tokens.Keys)) { if ((Get-SIHandoffResourceKey $tk) -eq $k) { $hit = $st.Tokens[$tk]; break } }
|        if (-not $hit) {
|            throw ('The sign-in handed over by the installation page holds no token for {0}, which this step needs. Nothing more was changed. Restart the install with a hand-over that includes {0} (the install resumes where it stopped).' -f $k.TrimEnd('/'))
|        }
|        if ($hit.ExpiresAt -le [datetime]::UtcNow.AddMinutes($script:SIHandoffMinMinutes)) { $global:SI_SetupHandoffExpired = $k; throw (Get-SIHandoffExpiredText -Resource $k) }
|        return [string]$hit.Token
|    }
|    if (-not $ForceRefresh -and $st.Tokens.ContainsKey($res) -and $st.Tokens[$res].ExpiresAt -gt [datetime]::UtcNow) { return [string]$st.Tokens[$res].Token }
|    if ($s.Method -eq 'CloudShell') {
|        $t = Get-SICloudShellToken -Resource $res
|        $st.Tokens[$res] = @{ Token = $t.Token; ExpiresAt = $t.ExpiresAt }
|        return $t.Token
|    }
|    if (Test-SISignInExchangeResource -Resource $res) {
|        # Exchange Online takes only a token of its own client (Exchange.Manage): its own refresh token, and the first time
|        # one more browser sign-in -- the same account pre-filled, so the browser normally signs straight in.
|        $xc = Get-SISignInExchangeClientId
|        $x = $st['Exchange']
|        $j = $null
|        if ($x -is [hashtable] -and $x.RefreshToken -and $x.ClientId -eq $xc) {
|            try {
|                $j = Invoke-SISignInTokenRequest -TenantId $s.TenantId -What 'Getting a token for Exchange Online' -Form ([ordered]@{
|                    client_id = $xc; grant_type = 'refresh_token'; refresh_token = $x.RefreshToken; scope = (Get-SISignInScope -Resource $res) + ' offline_access' })
|            } catch { $j = $null }
|        }
|        if (-not $j) {
|            if (-not (Test-SISignInInteractive)) { throw 'Exchange Online needs its own sign-in in the browser, and this PowerShell session cannot open a browser. Run it in an interactive PowerShell window.' }
|            $j = Invoke-SIBrowserCodeSignIn -TenantId $s.TenantId -ClientId $xc -Resource $res -LoginHint ([string]$s.Account) -Prompt '' `
|                     -What 'Exchange Online' -Title 'Sign in once more, for Exchange Online (it accepts only its own sign-in; your account is filled in).' -FailText 'The Exchange Online sign-in'
|        }
|        $st['Exchange'] = @{ ClientId = $xc; RefreshToken = $(if ($j.refresh_token) { [string]$j.refresh_token } elseif ($x -is [hashtable]) { $x.RefreshToken } else { $null }) }
|        Assert-SISignInTenant -Token ([string]$j.access_token) -TenantId ([string]$s.TenantId) -Where 'the token for Exchange Online'
|        $st.Tokens[$res] = @{ Token = [string]$j.access_token; ExpiresAt = (Get-SITokenExpiry -Response $j) }
|        return [string]$j.access_token
|    }
|    if (-not $s.RefreshToken) { throw 'The Azure sign-in has expired. Run the same command again to sign in.' }
|    $j = Invoke-SISignInTokenRequest -TenantId $s.TenantId -What ('Getting a token for {0}' -f $res) -Form ([ordered]@{
|        client_id     = $s.ClientId
|        grant_type    = 'refresh_token'
|        refresh_token = $s.RefreshToken
|        scope         = (Get-SISignInScope -Resource $res) + ' offline_access'
|    })
|    if ($j.refresh_token) { $s.RefreshToken = [string]$j.refresh_token }   # Entra rotates it
|    Assert-SISignInTenant -Token ([string]$j.access_token) -TenantId ([string]$s.TenantId) -Where ('the token for ' + $res)
|    $st.Tokens[$res] = @{ Token = [string]$j.access_token; ExpiresAt = (Get-SITokenExpiry -Response $j) }
|    return [string]$j.access_token
|}
|
|function Disconnect-SISetupUser {
|    $st = Get-SISignInState
|    $st.Session = $null
|    $st.Tokens = @{}
|    $st['Exchange'] = $null
|}
'@ }
$__siSupportFiles['setup/_shared/SI-SetupNaming.ps1'] = @{ Sha256 = '74e967b155a319a1869b7e594dd96fa1cc6f81ab3431bc9e26f81816a1831d40'; Text = @'
|#Requires -Version 5.1
|<#
|.SYNOPSIS
|    The names and tags setup gives the Azure resources it CREATES for a new SecurityInsight install.
|
|.DESCRIPTION
|    NEW GUIDED INSTALLS (framework section 5.5, owner 2026-11-04): <type>-si[-<purpose>] with no ring / edition / hosting, and
|    <t> (SHA-256 of the install id) on the globally unique names -- Get-SISetupInstallNames. Everything below is the EARLIER
|    pattern: what every existing install runs with, the server / unattended setup, and a resource group named in it.
|    Pattern: <type>-si-<ring>-<edition>-<hosting>, for example rg-si-prod-community-ca.
|      ring    : r0 | r1 | r2 | prod (prod = a single production install, the default)
|      edition : community | pro (spelled out)
|      hosting : ca (Azure Container Apps) | vm (a Windows server or Azure Arc machine). Always present: a VM install
|                and a container install of the same edition can run side by side.
|    Registry, storage account, Key Vault and SQL server names must be unique in ALL of Azure (they are DNS names:
|    <name>.database.windows.net, <name>.vault.azure.net, ...). Without a subscription they carry the instance number 01
|    (stsiprodcommunityca01) -- every install of the same edition then wants the SAME name. With -SubscriptionId they
|    carry a short STABLE per-install suffix instead: the first 6 hex characters of SHA-256(subscription id, lower case),
|    e.g. sql-si-prod-pro-ca-1a2b3c. Live 2026-10-07: a second customer's Pro install failed preflight because another
|    tenant's install already held sql-si-prod-pro-ca. An EXISTING install keeps its names: the guided install looks for
|    its resources first (Resolve-SIInstallExistingNames), the server / unattended / container setup the same way
|    (Resolve-SISetupDefaultGlobalName), and only a resource none of them finds gets a new name.
|
|    ONLY FOR NEW RESOURCES. The engines and launchers find an EXISTING install through the names in its config, and
|    fall back to the names older releases created (rg-securityinsight, dce-securityinsight, ...). Those fallbacks are
|    deliberately NOT here and NOT changed: an install that never wrote a name into its config depends on them.
|    A customer may always choose their own names; these are only the defaults.
|
|    Every function here is pure except Resolve-SITenantTag (one read of the signed-in Az context).
|#>
|
|$script:SISetupRings     = @('r0', 'r1', 'r2', 'prod')
|$script:SISetupEditions  = @('community', 'pro')
|$script:SISetupHostings  = @('ca', 'vm')
|
|function Get-SISetupEnvLabel {
|    <# PURE. '<ring>-<edition>-<hosting>', e.g. 'prod-community-ca'. Used in resource names and, in brackets, in Entra display names. #>
|    param(
|        [ValidateSet('r0', 'r1', 'r2', 'prod')][string]$Ring = 'prod',
|        [Parameter(Mandatory)][ValidateSet('community', 'pro')][string]$Edition,
|        [Parameter(Mandatory)][ValidateSet('ca', 'vm')][string]$Hosting
|    )
|    '{0}-{1}-{2}' -f $Ring.ToLowerInvariant(), $Edition.ToLowerInvariant(), $Hosting.ToLowerInvariant()
|}
|
|function Test-SISetupNewInstallNames {
|    <#
|        REMOVE-ME once a fresh install has proven the CR5 names (#655 step 2). PURE. Is SI_Setup_NewInstallNames ON for this
|        install? Read from the install's values (-Values: the guided install's answers), else the environment (-Env, default
|        the process). ON BY DEFAULT since 2026-10-18 (owner: CR1-CR8 delivered; framework 12.11c -- a NEW install gets the
|        new names): only 'false' / '0' / 'no' / 'off' turns it off.
|          ON   a NEW install gets the CR5 names (Get-SISetupComponentNames -New, the engine identity id-si-engine, the sign-in
|               app "SecurityInsight", the SQL admin group shown as "SecurityInsight SQL admins");
|          OFF  a new install gets TODAY's names (ca-si-management, uami-si-*, id-si-<ring>-<edition>-<hosting>, the sign-in
|               app "SecurityInsight Management") -- exactly as before step 2.
|        An EXISTING install keeps today's resource names either way (Resolve-SIInstallExistingNames): Azure cannot rename them.
|    #>
|    param([System.Collections.IDictionary]$Values, [System.Collections.IDictionary]$Env)
|    $name = 'SI_Setup_NewInstallNames'
|    $v = $null
|    if ($Values -and $Values.Contains($name)) { $v = $Values[$name] }
|    if ($null -eq $v -or "$v".Trim() -eq '') { $v = if ($Env) { if ($Env.Contains($name)) { $Env[$name] } else { $null } } else { [Environment]::GetEnvironmentVariable($name) } }
|    -not ("$v".Trim() -match '^(?i)(false|0|no|off)$')
|}
|
|function Get-SISetupComponentNames {
|    <#
|        PURE. The names setup gives the components INSIDE a new install's resource group (the web app, its MCP server, the
|        updater job and their identities, asset tagging's identity). No ring or environment in them: the resource group and
|        its tags already say which environment they belong to (owner: find apps by id, never by an environment in a name).
|        Without -New: TODAY's names -- what every existing install runs with, and a new install's names with
|        SI_Setup_NewInstallNames off (REMOVE-ME; ON by default since 2026-10-18). -New: the CR5 names for NEW installs (#655 step 2; framework 12.11c):
|        purpose words web / mcp / updater, identities id-si-<role>. The MCP server and the updater job already fit and keep
|        their names. Nothing FINDS a resource by these: a running install reads its names from its install record
|        (engine/_shared/SI-InstallNames.ps1); setup passes these to the scripts that create the components.
|    #>
|    param([switch]$New)
|    if ($New) {
|        return [ordered]@{
|            # the web app keeps ca-si-management for every install, new ones too (framework 5.5, owner 2026-11-09: identities
|            # get standard names, web app names / addresses are not aligned)
|            WebApp          = 'ca-si-management'
|            McpApp          = 'ca-si-mcp'
|            UpdaterJob      = 'caj-si-updater'
|            WebIdentity     = 'id-si-web'
|            McpIdentity     = 'id-si-mcp'
|            UpdaterIdentity = 'id-si-updater'
|            TaggingIdentity = 'id-si-tagging'
|        }
|    }
|    [ordered]@{
|        WebApp          = 'ca-si-management'
|        McpApp          = 'ca-si-mcp'
|        UpdaterJob      = 'caj-si-updater'
|        WebIdentity     = 'uami-si-management'
|        McpIdentity     = 'uami-si-mcp'
|        UpdaterIdentity = 'uami-si-updater'
|        TaggingIdentity = 'uami-securityinsight-tagging'
|    }
|}
|
|function Get-SISetupDisplayNames {
|    <# PURE. The names people read for a new install's directory objects. Without -New: today's ("SecurityInsight" for the
|       engine's own app registration, "SecurityInsight Management" for the web app's sign-in registration, grp-si-sql-admins
|       for the SQL admin group); -New: the CR5 names (framework 12.11c item 5: the full name where people read) --
|       "SecurityInsight Engine", "SecurityInsight" -- and the SQL admin group keeps its STANDARD name grp-si-sql-admins (framework
|       5.5, Invardia ruling 2026-11-07: groups follow grp-<code>-<purpose>; an older install's group is renamed back in place by
|       the update's identity-names step).
|       An existing install's objects get the same names from the update (setup\_shared\SI-DisplayNames.ps1).
|       SIDE BY SIDE IN ONE TENANT (SI #750, 2026-10-27; the same rule as v2.2 beside v3): these three are TENANT-WIDE objects,
|       found by name when an install is set up, so a NEW Community edition install (-New -Edition community) gets names of its
|       own -- "SecurityInsight Community Engine", "SecurityInsight Community", and its own SQL admin group (group
|       grp-si-community-sql-admins, mailNickname grpsicommunitysqladmins) -- and never finds, reuses or renames a Pro
|       install's application or admin group in the same tenant (nor a Pro install the Community one's). SqlAdminGroupName =
|       the name the admin group is looked up and created by (setup\Set-SISqlAdminGroup.ps1 -GroupName). Without -New (an
|       existing install, or SI_Setup_NewInstallNames off) both editions keep today's names, exactly as before. #>
|    param([switch]$New, [ValidateSet('community', 'pro')][string]$Edition = 'pro')
|    if ($New -and $Edition -eq 'community') {
|        return [ordered]@{
|            SpnDisplayName           = 'SecurityInsight Community Engine'
|            WebAppDisplayName        = 'SecurityInsight Community'
|            # framework 5.5 (Invardia ruling 2026-11-07): the group carries its STANDARD name from the start, no display name of its own
|            SqlAdminGroupDisplayName = 'grp-si-community-sql-admins'
|            SqlAdminGroupName        = 'grp-si-community-sql-admins'
|        }
|    }
|    [ordered]@{
|        SpnDisplayName           = $(if ($New) { 'SecurityInsight Engine' } else { 'SecurityInsight' })
|        WebAppDisplayName        = $(if ($New) { 'SecurityInsight' } else { 'SecurityInsight Management' })
|        SqlAdminGroupDisplayName = 'grp-si-sql-admins'
|        SqlAdminGroupName        = 'grp-si-sql-admins'
|    }
|}
|
|function Get-SISetupComponentName {
|    <# PURE. One component's name from a names table (Get-SISetupResourceNames), else the default of Get-SISetupComponentNames
|       (a table built before the component names were part of it). An unknown -Key throws. #>
|    # -Names: a hashtable / ordered table, or an object with the key as a property (a context built elsewhere)
|    param([AllowNull()]$Names, [Parameter(Mandatory)][string]$Key)
|    $d = Get-SISetupComponentNames
|    if (-not $d.Contains($Key)) { throw ("Get-SISetupComponentName: unknown component '{0}' (known: {1})" -f $Key, (@($d.Keys) -join ', ')) }
|    $v = $null
|    if ($Names -is [System.Collections.IDictionary]) { if ($Names.Contains($Key)) { $v = $Names[$Key] } }
|    elseif ($null -ne $Names -and $Names.PSObject.Properties[$Key]) { $v = $Names.$Key }
|    if ("$v".Trim()) { return "$v".Trim() }
|    [string]$d[$Key]
|}
|
|function Get-SISetupResourceNames {
|    <#
|        PURE. The default name of every environment-level resource setup creates, for one install, plus the names of the
|        components inside the resource group (Get-SISetupComponentNames: WebApp, McpApp, UpdaterJob, WebIdentity,
|        McpIdentity, UpdaterIdentity, TaggingIdentity). The engine jobs keep caj-si-<engine>.
|    #>
|    param(
|        [ValidateSet('r0', 'r1', 'r2', 'prod')][string]$Ring = 'prod',
|        [Parameter(Mandatory)][ValidateSet('community', 'pro')][string]$Edition,
|        [Parameter(Mandatory)][ValidateSet('ca', 'vm')][string]$Hosting,
|        [ValidatePattern('^[0-9]{2}$')][string]$Instance = '01',
|        # given: the globally unique names carry the subscription's suffix (Get-SISetupSubscriptionSuffix), not the instance
|        [AllowEmptyString()][AllowNull()][string]$SubscriptionId,
|        # CR5 (#655 step 2; SI_Setup_NewInstallNames, REMOVE-ME): the NEW-install names for the components, the engine's
|        # identity (id-si-engine) and the sign-in app's display name. Off: today's names, exactly as before.
|        [switch]$NewNames
|    )
|    $label   = Get-SISetupEnvLabel -Ring $Ring -Edition $Edition -Hosting $Hosting
|    $flat    = ($label -replace '[^a-z0-9]', '')
|    $kv      = 'kv-si-{0}{1}' -f $label, $Instance
|    if ($kv.Length -gt 24) { $kv = 'kvsi{0}{1}' -f $flat, $Instance }     # Key Vault: 3-24 characters
|    $n = [ordered]@{
|        EnvLabel        = $label
|        ResourceGroup   = 'rg-si-{0}' -f $label
|        Workspace       = 'log-si-{0}' -f $label
|        Dce             = 'dce-si-{0}' -f $label
|        StorageAccount  = 'stsi{0}{1}' -f $flat, $Instance                 # 3-24, lowercase letters and digits
|        Acr             = 'acrsi{0}{1}' -f $flat, $Instance                # 5-50, letters and digits
|        KeyVault        = $kv
|        ContainerEnv    = 'cae-si-{0}' -f $label
|        # the engine's identity: today id-si-<label>; CR5 (new installs, the setting on) id-si-engine -- no ring in the name
|        ManagedIdentity = $(if ($NewNames) { 'id-si-engine' } else { 'id-si-{0}' -f $label })
|        SqlServer       = 'sql-si-{0}' -f $label
|    }
|    # directory objects users see (consent, enterprise apps): ONE product-level name, no ring / environment in it
|    $d = Get-SISetupDisplayNames -New:$NewNames -Edition $Edition; foreach ($k in $d.Keys) { $n[$k] = $d[$k] }
|    $c = Get-SISetupComponentNames -New:$NewNames; foreach ($k in $c.Keys) { $n[$k] = $c[$k] }
|    Set-SISetupGlobalNames -Names $n -SubscriptionId $SubscriptionId
|    $n
|}
|
|function Get-SISetupSubscriptionSuffix {
|    <# PURE. The per-install suffix for globally unique names: the first 6 hex characters of SHA-256 of the subscription
|       id (trimmed, lower case). The same subscription always gives the same suffix; '' without a subscription. #>
|    param([AllowEmptyString()][AllowNull()][string]$SubscriptionId)
|    $id = "$SubscriptionId".Trim().ToLowerInvariant()
|    if (-not $id) { return '' }
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $h = $sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($id)) } finally { $sha.Dispose() }
|    (-join ($h[0..2] | ForEach-Object { $_.ToString('x2') }))
|}
|
|# ------------------------------------------------------------------------------------------------------------------------
|# Framework section 5.5 (owner 2026-11-04, OPEN-30: "i hate the si method, and love the pim method"): the names a NEW guided install
|# gets. <type>-si[-<purpose>] -- no edition, ring, prod or hosting in any name (the 7 resource-group tags carry those) -- and
|# the globally unique names end in <t> = 6 hex characters of SHA-256 of the install id (PIM's Get-PimInstallToken, the
|# reference). NEW INSTALLS ONLY: an existing install keeps every name it has (Resolve-SIInstallDefaultResourceGroup,
|# Resolve-SIInstallExistingNames); the updater never derives a name.
|# ------------------------------------------------------------------------------------------------------------------------
|
|$script:SISetupDefaultInstallId = 'securityinsight'
|
|function Get-SISetupInstallToken {
|    <# PURE. <t>: the first 6 hex characters (lower case) of SHA-256 over the install id, trimmed and lower-cased, UTF-8 --
|       byte for byte PIM's Get-PimInstallToken (framework section 5.5). The same install id always gives the same <t>. #>
|    param([Parameter(Mandatory)][string]$InstallId)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $h = $sha.ComputeHash([Text.Encoding]::UTF8.GetBytes("$InstallId".Trim().ToLowerInvariant())) } finally { $sha.Dispose() }
|    (-join ($h[0..2] | ForEach-Object { $_.ToString('x2') }))
|}
|
|function Get-SISetupDerivedInstallId {
|    <# PURE. The install id of an install that was not given one of its own (PIM's Get-PimInstallDerivedId, same form):
|       'si-' + 12 hex characters of SHA-256 of 'tenant|subscription|resource group' (lower case). The same three answers give
|       the same id on every run and resume; another tenant, subscription or resource group gives another one. #>
|    param([Parameter(Mandatory)][string]$TenantId, [Parameter(Mandatory)][string]$SubscriptionId, [string]$ResourceGroup = 'rg-si')
|    $rg = if ("$ResourceGroup".Trim()) { "$ResourceGroup".Trim() } else { 'rg-si' }
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $h = $sha.ComputeHash([Text.Encoding]::UTF8.GetBytes(('{0}|{1}|{2}' -f "$TenantId".Trim(), "$SubscriptionId".Trim(), $rg).ToLowerInvariant())) } finally { $sha.Dispose() }
|    'si-' + (-join ($h[0..5] | ForEach-Object { $_.ToString('x2') }))
|}
|
|function Get-SISetupNamingInstallId {
|    <# PURE. The install id <t> is made from: the install's own id (Invardia's, or -InstallId given by the customer), else --
|       when it is SecurityInsight's default id 'securityinsight', which EVERY install without its own id shares and which would
|       give every customer the same SQL server / Key Vault / storage / registry name -- the derived id
|       (Get-SISetupDerivedInstallId). #>
|    param([AllowEmptyString()][AllowNull()][string]$InstallId, [AllowEmptyString()][AllowNull()][string]$TenantId,
|          [AllowEmptyString()][AllowNull()][string]$SubscriptionId, [AllowEmptyString()][AllowNull()][string]$ResourceGroup)
|    $id = "$InstallId".Trim()
|    if ($id -and $id -ine $script:SISetupDefaultInstallId) { return $id }
|    if ("$TenantId".Trim() -and "$SubscriptionId".Trim()) { return (Get-SISetupDerivedInstallId -TenantId $TenantId -SubscriptionId $SubscriptionId -ResourceGroup $ResourceGroup) }
|    if ($id) { return $id }
|    $script:SISetupDefaultInstallId
|}
|
|function Get-SISetupInstallNames {
|    <#
|        PURE. Framework section 5.5 "THE AGREED LIST" for SecurityInsight -- the names a NEW guided install gets:
|          ResourceGroup rg-si, ContainerEnv cae-si, Workspace log-si, Dce dce-si, Vnet vnet-si (in the install's own group),
|          SqlServer sql-si-<t>, KeyVault kv-si-<t>, StorageAccount stsi<t>, Acr acrsi<t>, the engine identity id-si-engine,
|          the components of Get-SISetupComponentNames -New (ca-si-management, ca-si-mcp, caj-si-updater, id-si-web / -mcp /
|          -updater / -tagging) and the -New display names (grp-si-sql-admins). -ResourceGroup: the customer's own group wins.
|        Length rules: storage 3-24 lower-case letters and digits, Key Vault 3-24, registry 5-50 letters and digits, SQL 1-63
|        -- every name here is 13 characters or fewer.
|    #>
|    param(
|        [Parameter(Mandatory)][ValidateSet('community', 'pro')][string]$Edition,
|        [Parameter(Mandatory)][ValidatePattern('^[0-9a-f]{6}$')][string]$InstallToken,
|        [AllowEmptyString()][AllowNull()][string]$ResourceGroup
|    )
|    $t = $InstallToken
|    $n = [ordered]@{
|        EnvLabel        = ''
|        InstallToken    = $t
|        ResourceGroup   = $(if ("$ResourceGroup".Trim()) { "$ResourceGroup".Trim() } else { 'rg-si' })
|        Workspace       = 'log-si'
|        Dce             = 'dce-si'
|        StorageAccount  = 'stsi{0}' -f $t
|        Acr             = 'acrsi{0}' -f $t
|        KeyVault        = 'kv-si-{0}' -f $t
|        ContainerEnv    = 'cae-si'
|        Vnet            = 'vnet-si'
|        ManagedIdentity = 'id-si-engine'
|        SqlServer       = 'sql-si-{0}' -f $t
|    }
|    $d = Get-SISetupDisplayNames -New -Edition $Edition; foreach ($k in $d.Keys) { $n[$k] = $d[$k] }
|    $c = Get-SISetupComponentNames -New; foreach ($k in $c.Keys) { $n[$k] = $c[$k] }
|    $n
|}
|
|function Get-SISetupGlobalName {
|    <#
|        PURE. A globally unique name for one resource kind, within that kind's rules:
|          StorageAccount  3-24, lower-case letters and digits only                       stsi<label><suffix>
|          Acr             5-50, letters and digits only                                  acrsi<label><suffix>
|          KeyVault        3-24, letters, digits, dashes; starts with a letter, no '--', no dash at the end
|                                                       kv-si-<label>-<suffix>, or kvsi<label><suffix> when that is longer than 24
|          SqlServer       1-63, lower-case letters, digits, dashes; no dash at either end sql-si-<label>-<suffix>
|        A label too long for the kind is shortened -- never the suffix, which is what keeps the name unique.
|    #>
|    param(
|        [Parameter(Mandatory)][ValidateSet('StorageAccount', 'Acr', 'KeyVault', 'SqlServer')][string]$Kind,
|        [Parameter(Mandatory)][string]$Label,
|        [Parameter(Mandatory)][ValidatePattern('^[a-z0-9]{1,12}$')][string]$Suffix
|    )
|    $lbl  = (($Label.ToLowerInvariant() -replace '[^a-z0-9-]', '') -replace '-{2,}', '-').Trim('-')
|    $flat = $lbl -replace '-', ''
|    $cut = { param([string]$Base, [int]$Max) if ($Base.Length -gt $Max) { $Base.Substring(0, $Max).TrimEnd('-') } else { $Base } }
|    switch ($Kind) {
|        'StorageAccount' { return ((& $cut ('stsi' + $flat) (24 - $Suffix.Length)) + $Suffix) }
|        'Acr'            { return ((& $cut ('acrsi' + $flat) (50 - $Suffix.Length)) + $Suffix) }
|        'KeyVault' {
|            $d = 'kv-si-{0}-{1}' -f $lbl, $Suffix
|            if ($d.Length -le 24) { return $d }
|            return ((& $cut ('kvsi' + $flat) (24 - $Suffix.Length)) + $Suffix)
|        }
|        'SqlServer'      { return ('{0}-{1}' -f (& $cut ('sql-si-' + $lbl) (63 - $Suffix.Length - 1)), $Suffix) }
|    }
|}
|
|function Set-SISetupGlobalNames {
|    <# PURE (changes the table it is given). With a subscription, the globally unique names follow its suffix and the label. #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Names, [AllowEmptyString()][AllowNull()][string]$SubscriptionId)
|    $sfx = Get-SISetupSubscriptionSuffix -SubscriptionId $SubscriptionId
|    if (-not $sfx) { return }
|    foreach ($k in 'StorageAccount', 'Acr', 'KeyVault', 'SqlServer') { $Names[$k] = Get-SISetupGlobalName -Kind $k -Label ([string]$Names['EnvLabel']) -Suffix $sfx }
|}
|
|$script:SISetupGlobalNameTypes = [ordered]@{
|    StorageAccount = 'Microsoft.Storage/storageAccounts'
|    KeyVault       = 'Microsoft.KeyVault/vaults'
|    Acr            = 'Microsoft.ContainerRegistry/registries'
|    SqlServer      = 'Microsoft.Sql/servers'
|}
|$script:SISetupGlobalNamePrefixes = @{ StorageAccount = '^stsi'; KeyVault = '^(kv-si-|kvsi)'; Acr = '^acrsi'; SqlServer = '^sql-si-' }
|
|function Select-SISetupExistingName {
|    <#
|        PURE. Which existing resource of one kind in the install's resource group IS the install's: the name this release
|        would give it, else a name older releases gave it (-Legacy, in order), else the only one of that kind whose name
|        is SecurityInsight's (-Prefix: stsi, kv-si / kvsi, acrsi, sql-si) -- a customer's own resource that happens to
|        share the group is never taken over. Two or more candidates: none -- the new name is used.
|    #>
|    param([AllowEmptyCollection()][string[]]$Existing = @(), [string]$Wanted, [AllowEmptyCollection()][string[]]$Legacy = @(), [string]$Prefix = '^$')
|    $e = @($Existing | Where-Object { $_ })
|    foreach ($c in @(@($Wanted) + @($Legacy))) { if ($c) { $hit = @($e | Where-Object { $_ -eq $c }); if ($hit.Count) { return [string]$hit[0] } } }
|    $si = @($e | Where-Object { $_ -match $Prefix })
|    if ($si.Count -eq 1) { return [string]$si[0] }
|    $null
|}
|
|function Resolve-SISetupDefaultGlobalName {
|    <#
|        PURE. The name a DEFAULTED globally unique resource gets on a run of the server / unattended / container setup
|        (the guided install has its own, Resolve-SIInstallExistingNames): the resource of that kind already in the
|        install's resource group (Select-SISetupExistingName) -- an existing install keeps its name; else, when the
|        group could not be read (-ReadFailed), the name older releases gave it (the first -Legacy) -- never a second
|        storage account or registry next to an install setup could not see; else the new name (-Wanted).
|    #>
|    param(
|        [Parameter(Mandatory)][ValidateSet('StorageAccount', 'Acr', 'KeyVault', 'SqlServer')][string]$Kind,
|        [Parameter(Mandatory)][string]$Wanted,
|        [AllowEmptyCollection()][string[]]$Legacy = @(),
|        [AllowEmptyCollection()][string[]]$Existing = @(),
|        [switch]$ReadFailed
|    )
|    $old = @($Legacy | Where-Object { $_ })
|    if ($ReadFailed) { if ($old.Count) { return [string]$old[0] }; return $Wanted }
|    $pick = Select-SISetupExistingName -Existing $Existing -Wanted $Wanted -Legacy $old -Prefix $script:SISetupGlobalNamePrefixes[$Kind]
|    if ($pick) { return $pick }
|    $Wanted
|}
|
|function Get-SISetupNamesFromResourceGroup {
|    <#
|        PURE. When setup is handed a resource group that follows the pattern (rg-si-<label>), the names of the
|        resources it creates INSIDE it follow the same label. Any other resource group name (rg-securityinsight, a
|        customer's own) returns $null -- the caller then keeps the names it has always used there, so a re-run
|        against an existing install never creates a second registry, environment or identity next to the first.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$ResourceGroupName, [ValidatePattern('^[0-9]{2}$')][string]$Instance = '01',
|        [AllowEmptyString()][AllowNull()][string]$SubscriptionId,
|        # CR5 new-install names (Get-SISetupResourceNames -NewNames); the engine identity id-si-engine then carries no suffix
|        # either: it lives inside the resource group, like every other component
|        [switch]$NewNames)
|    # An optional naming suffix (rg-si-prod-community-ca-test) carries over to every name.
|    if ("$ResourceGroupName" -cnotmatch '^rg-si-(r0|r1|r2|prod)-(community|pro)-(ca|vm)(-[a-z0-9][a-z0-9-]*)?$') { return $null }
|    $sfx = [string]$Matches[4]
|    $n = Get-SISetupResourceNames -Ring $Matches[1] -Edition $Matches[2] -Hosting $Matches[3] -Instance $Instance -NewNames:$NewNames
|    if ($sfx) {
|        $flat = ($sfx -replace '[^a-z0-9]', '')
|        $withSfx = @('ResourceGroup', 'Workspace', 'Dce', 'ContainerEnv', 'SqlServer'); if (-not $NewNames) { $withSfx += 'ManagedIdentity' }
|        foreach ($k in $withSfx) { $n[$k] = $n[$k] + $sfx }
|        $n.EnvLabel = $n.EnvLabel + $sfx
|        foreach ($k in 'StorageAccount', 'Acr') {
|            $base = ($n[$k] -replace ([regex]::Escape($Instance) + '$'), '') + $flat
|            if ($base.Length -gt 22) { $base = $base.Substring(0, 22) }
|            $n[$k] = $base + $Instance
|        }
|        $n.KeyVault = ('kvsi{0}{1}' -f ($n.EnvLabel -replace '[^a-z0-9]', ''), '')
|        if ($n.KeyVault.Length -gt 22) { $n.KeyVault = $n.KeyVault.Substring(0, 22) }
|        $n.KeyVault += $Instance
|        # directory object names stay product-level with a suffix too (no ring / environment in them)
|    }
|    Set-SISetupGlobalNames -Names $n -SubscriptionId $SubscriptionId
|    $n
|}
|
|function Resolve-SISetupEdition {
|    <#
|        PURE apart from looking for a licence file. Which edition a NEW install is: an explicit -Edition wins; a licence
|        (a path given to setup, a licence file in the install's config folder, or SI_License already set) means
|        'pro'; otherwise 'community'. The licence decides, not the presence of Pro code: the private sync ships the
|        Pro code to every customer.
|    #>
|    param(
|        [AllowEmptyString()][string]$Edition,
|        [AllowEmptyString()][AllowNull()][string]$LicencePath,
|        [AllowEmptyString()][AllowNull()][string]$SIRoot,
|        [AllowEmptyString()][AllowNull()][string]$LicenceValue
|    )
|    if ("$Edition".Trim()) {
|        $e = "$Edition".Trim().ToLowerInvariant()
|        if ($e -eq 'com') { throw "Edition 'com' is not a name: use 'community' or 'pro'." }
|        if ($script:SISetupEditions -notcontains $e) { throw ("Edition '{0}' is not known: use 'community' or 'pro'." -f $Edition) }
|        return $e
|    }
|    if ("$LicencePath".Trim()) { return 'pro' }
|    if ("$LicenceValue".Trim()) { return 'pro' }
|    if ("$SIRoot".Trim()) {
|        $cfg = Join-Path $SIRoot 'config'
|        if (Test-Path -LiteralPath $cfg) {
|            if (@(Get-ChildItem -LiteralPath $cfg -File -ErrorAction SilentlyContinue | Where-Object { $_.Extension -in '.silicense', '.aitlicense' }).Count) { return 'pro' }
|        }
|    }
|    'community'
|}
|
|function Get-SIResourceGroupTags {
|    <#
|        PURE. The seven tags every resource group setup creates carries: product, ring, edition, hosting, tenant,
|        owner, purpose. Owner is whatever the customer passes (empty by default -- never a name baked into code).
|    #>
|    param(
|        [ValidateSet('r0', 'r1', 'r2', 'prod')][string]$Ring = 'prod',
|        [Parameter(Mandatory)][ValidateSet('community', 'pro')][string]$Edition,
|        [Parameter(Mandatory)][ValidateSet('ca', 'vm')][string]$Hosting,
|        [AllowEmptyString()][AllowNull()][string]$Tenant,
|        [AllowEmptyString()][AllowNull()][string]$Owner
|    )
|    [ordered]@{
|        product = 'si'
|        ring    = $Ring.ToLowerInvariant()
|        edition = $Edition.ToLowerInvariant()
|        hosting = $Hosting.ToLowerInvariant()
|        tenant  = "$Tenant".Trim()
|        owner   = "$Owner".Trim()
|        purpose = 'SecurityInsight'
|    }
|}
|
|function ConvertTo-SIAzCliTagArgs {
|    <# PURE. The tags as az CLI arguments: --tags key=value ... (an empty value is passed as key=). #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Tags)
|    $a = @('--tags')
|    foreach ($k in $Tags.Keys) { $a += ('{0}={1}' -f $k, [string]$Tags[$k]) }
|    $a
|}
|
|function ConvertTo-SIAzTagHashtable {
|    <# PURE. A resource group's tags as a plain string hashtable (what an ARM PUT of the group takes). #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Tags)
|    $h = @{}; foreach ($k in $Tags.Keys) { $h[[string]$k] = [string]$Tags[$k] }; $h
|}
|
|function Resolve-SITenantTag {
|    <#
|        The value of the 'tenant' tag: the tenant's default verified domain when the setup sign-in
|        (setup\_shared\SI-SetupAzure.ps1, REST) can read it, otherwise the tenant id. Never signs anyone in and never
|        fails setup -- a tag is not worth stopping an install for.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$TenantId)
|    $tid = "$TenantId".Trim()
|    $signedIn = $false
|    if (Get-Command -Name Get-SISetupAzureContext -ErrorAction SilentlyContinue) {
|        try { $c = Get-SISetupAzureContext; if ($c) { $signedIn = $true; if (-not $tid) { $tid = [string]$c.Tenant.Id } } } catch { }
|    }
|    if (-not $tid) { return '' }
|    try {
|        if ($signedIn -and (Get-Command -Name Get-SITenant -ErrorAction SilentlyContinue)) {
|            $t = Get-SITenant -TenantId $tid -ErrorAction Stop | Select-Object -First 1
|            if ($t -and $t.PSObject.Properties['DefaultDomain'] -and "$($t.DefaultDomain)".Trim()) { return "$($t.DefaultDomain)".Trim() }
|        }
|    } catch { }
|    $tid
|}
'@ }
$__siSupportFiles['setup/_shared/SI-SetupArm.ps1'] = @{ Sha256 = '61b71c0d0ea6f199ab767029462a9f7a4c49d4d98ebd550c26cd6eeac58c40ed'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight SETUP -- the Azure resources setup creates and changes, over ARM / data-plane REST only (#521 phase 2:
|    "pure rest or arm only", "want to not be dependent on it" -- the az CLI included). Every call goes through
|    engine/_shared/SI-AzRest.ps1 (Invoke-SIArm / Invoke-SIAzRestRequest -> Invoke-SIAzRestHttp, the one HTTP seam), so it
|    signs in exactly as setup does (Connect-SISetupAzure: a person in Cloud Shell or the browser, an app, a managed
|    identity, or the Invardia support session's tokens) and the offline tests run it against a fake.
|
|    Dot-source AFTER setup\_shared\SI-SetupAzure.ps1:
|        . (Join-Path $PSScriptRoot '_shared\SI-SetupAzure.ps1')
|        . (Join-Path $PSScriptRoot '_shared\SI-SetupArm.ps1')
|
|    What replaces which az command:
|        az containerapp job show / list / create / update / delete / start / secret set|remove / identity assign /
|           registry set                            Get-/New-/Update-/Remove-/Start-SIContainerAppJob (READ-MODIFY-WRITE:
|                                                  the whole job, secret values read back with listSecrets, ONE PUT)
|        az containerapp show / update --set-env-vars    Get-SIContainerApp / Set-SIContainerAppEnvVar
|        az containerapp env show / create / delete Get-/New-/Remove-SIManagedEnvironment; Initialize-SIManagedEnvironment
|                                                  (an existing one's STATE decides: ready, waited for, or removed and
|                                                  created again when Azure left it Failed and it holds nothing)
|        az acr show / create / check-name / credential show   Get-/New-SIContainerRegistry, Test-SIContainerRegistryName,
|                                                  Get-SIContainerRegistryCredential  (az acr build: setup\_shared\SI-AcrBuild.ps1)
|        az keyvault show / secret list / secret show / secret set   Get-SIKeyVaultArm, Get-SIKeyVaultSecretNames,
|                                                  Get-SIKeyVaultSecretValue (engine), Set-SIKeyVaultSecretText
|        az storage account show                    Get-SIStorageAccountArm
|        az identity show / create                  Get-/New-SIUserAssignedIdentity (SI-SetupAzure.ps1)
|        az role assignment list / create           Test-SIRoleAssignmentPresent / New-SIRoleAssignment (SI-SetupAzure.ps1)
|        az group show                              Get-SIResourceGroupArm
|        az provider show / register                Get-/Register-SIResourceProvider (SI-SetupAzure.ps1)
|        az sql server create / firewall-rule create / db create   New-SISqlServerEntraOnly, Set-SISqlFirewallRule,
|                                                  New-SISqlDatabaseArm
|        az account get-access-token --resource X   Get-SISetupAccessToken -Resource X
|        az rest (ARM)                              Invoke-SIArm;   az rest (Graph $count)   Get-SITenantDirectoryCounts
|    PS 5.1 safe; pwsh 7 on Windows, Linux (Azure Cloud Shell) and macOS.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|
|# 2025-07-01, NOT 2024-03-01 (#616, a new customer install 2026-10-12): the older version does not know the queue scale
|# rule's `identity` and DROPS it without a word -- on a GET it is not returned, on a PUT it is not stored. A worker job
|# written with it has a scaler that cannot read the queue (storage is identity-only), so the workers never start and the
|# pipeline waits at its first collection. The same version the deploy of the web app and the release tool use.
|$script:SIAppArmApi       = '2025-07-01'   # Microsoft.App (jobs, container apps, managed environments)
|$script:SIAcrArmApi       = '2023-07-01'   # Microsoft.ContainerRegistry/registries
|$script:SIKvArmApi        = '2023-07-01'
|$script:SIStorageArmApi   = '2023-01-01'
|$script:SISqlArmApi       = '2021-11-01'
|$script:SIKvDataApi       = '7.4'
|
|# =====================================================================================================================
|#  Tokens and small helpers
|# =====================================================================================================================
|
|function Get-SISetupAccessToken {
|    <# `az account get-access-token --resource <r> --query accessToken`: a bearer token for -Resource as whoever setup
|       signed in as (Get-SIAzureToken -- the person, the app, the managed identity or the support session). #>
|    param([Parameter(Mandatory)][string]$Resource, [switch]$ForceRefresh)
|    $t = Get-SIAzureToken -Resource $Resource -ForceRefresh:$ForceRefresh
|    if ($t -is [System.Security.SecureString]) { $t = (New-Object System.Net.NetworkCredential('', $t)).Password }
|    [string]$t
|}
|
|function Get-SISetupArmPath {
|    <# PURE. /subscriptions/<s>/resourceGroups/<rg>/providers/<Type>/<name>. #>
|    param([Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Type, [string]$Name)
|    $p = '/subscriptions/{0}/resourceGroups/{1}/providers/{2}' -f $SubscriptionId, $ResourceGroupName, $Type
|    if ($Name) { $p += '/' + $Name }
|    $p
|}
|
|function Get-SISetupArmProp {
|    <# PURE. A nested property of an ARM object (PSCustomObject or dictionary), $null when any step is missing. #>
|    param($Object, [string[]]$Path)
|    $o = $Object
|    foreach ($p in $Path) {
|        if ($null -eq $o) { return $null }
|        if ($o -is [System.Collections.IDictionary]) { $o = $(if ($o.Contains($p)) { $o[$p] } else { $null }); continue }
|        $pp = $o.PSObject.Properties[$p]
|        $o = $(if ($pp) { $pp.Value } else { $null })
|    }
|    $o
|}
|
|function ConvertTo-SISetupArmHashtable {
|    <# PURE. An ARM object read back (PSCustomObject from ConvertFrom-Json) as ordered dictionaries + arrays, so it can be
|       changed and written back whole. #>
|    param($InputObject)
|    if ($null -eq $InputObject) { return $null }
|    if ($InputObject -is [string] -or $InputObject -is [ValueType]) { return $InputObject }
|    if ($InputObject -is [System.Collections.IDictionary]) {
|        $h = [ordered]@{}; foreach ($k in @($InputObject.Keys)) { $h[[string]$k] = ConvertTo-SISetupArmHashtable $InputObject[$k] }; return $h
|    }
|    if ($InputObject -is [System.Collections.IEnumerable]) {
|        $l = New-Object System.Collections.Generic.List[object]
|        foreach ($i in $InputObject) { $l.Add((ConvertTo-SISetupArmHashtable $i)) }
|        return , $l.ToArray()
|    }
|    $h = [ordered]@{}
|    foreach ($p in $InputObject.PSObject.Properties) { $h[$p.Name] = ConvertTo-SISetupArmHashtable $p.Value }
|    $h
|}
|
|function Send-SISetupWaitProgress {
|    <#
|        #876 (owner: "make it very easy and info on progress"): a long wait says what it is waiting for, at most once a
|        minute (one shared clock for every wait, so nothing floods): "still waiting for <what> (Azure shows: <state>) --
|        <n> min so far". The guided install registers $global:SI_InstallWaitNotify = { param([string]$Message) ... } (it posts
|        the line as a progress event of the running step, through the reporter); without it nothing is said (another
|        script's own output is unchanged). Never throws.
|    #>
|    param([Parameter(Mandatory)][string]$What, [string]$State, [datetime]$SinceUtc = [datetime]::MinValue, [int]$EverySec = 55)
|    try {
|        $n = Get-Variable -Scope Global -Name SI_InstallWaitNotify -ValueOnly -ErrorAction Ignore
|        if (-not ($n -is [scriptblock])) { return }
|        $now = [datetime]::UtcNow
|        $last = Get-Variable -Scope Global -Name SI_InstallWaitLastAt -ValueOnly -ErrorAction Ignore
|        if ($last -is [datetime] -and ($now - $last).TotalSeconds -lt $EverySec) { return }
|        $global:SI_InstallWaitLastAt = $now
|        $mins = if ($SinceUtc -gt [datetime]::MinValue) { [int][Math]::Floor(($now - $SinceUtc).TotalMinutes) } else { -1 }
|        $msg = 'still waiting for {0}{1}{2}' -f $What, $(if ("$State".Trim()) { ' (Azure shows: {0})' -f "$State".Trim() } else { '' }), $(if ($mins -ge 0) { ' -- {0} min so far' -f $mins } else { '' })
|        & $n $msg
|    } catch { }
|}
|
|function Wait-SIArmProvisioning {
|    <# Polls an ARM resource until its provisioningState is terminal (Succeeded / Failed / Canceled). Returns the resource;
|       a Failed resource throws with what Azure said. -Sleep: tests. #>
|    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$ApiVersion, [int]$TimeoutSec = 900, [int]$PollSec = 5, [scriptblock]$Sleep,
|          # -WaitForResource (#616): a resource that is NOT THERE YET is waited for too. Without it a 404 right after the PUT
|          # returned at once as if it were ready -- a new SQL server was "created" while Azure was still making it, and the
|          # databases sent to it seconds later were rejected (2026-10-12, a new customer install).
|          [switch]$WaitForResource)
|    $deadline = (Get-Date).AddSeconds($TimeoutSec)
|    $since = [datetime]::UtcNow
|    while ($true) {
|        $r = Invoke-SIArm -Path $Path -ApiVersion $ApiVersion -AllowNotFound
|        $ps = [string](Get-SISetupArmProp $r @('properties', 'provisioningState'))
|        # #876: a long wait says what it waits for, at most once a minute
|        if (([datetime]::UtcNow - $since).TotalSeconds -ge 30) { Send-SISetupWaitProgress -What ((($Path -replace '\?.*$', '').TrimEnd('/') -split '/')[-1]) -State $(if ($r) { $ps } else { 'not there yet' }) -SinceUtc $since }
|        if (-not $r -and $WaitForResource) {
|            if ((Get-Date) -ge $deadline) { throw ('{0}: Azure did not show the resource within {1} seconds of creating it.' -f (($Path -split '/')[-1]), $TimeoutSec) }
|            if ($Sleep) { & $Sleep $PollSec } else { Start-Sleep -Seconds $PollSec }
|            continue
|        }
|        if (-not $r -or -not $ps -or $ps -in 'Succeeded', 'Failed', 'Canceled', 'Cancelled') {
|            if ($ps -eq 'Failed') { throw ('{0}: Azure reports provisioning Failed.' -f (($Path -split '/')[-1])) }
|            return $r
|        }
|        if ((Get-Date) -ge $deadline) { return $r }
|        if ($Sleep) { & $Sleep $PollSec } else { Start-Sleep -Seconds $PollSec }
|    }
|}
|
|# =====================================================================================================================
|#  After a create: WAIT UNTIL IT EXISTS AND IS READY, and retry ONLY the "not there yet" answer
|#  (the lessons of the first customer install through the Support app, 2026-10-12). Every value these read is written
|#  out here -- never a script value of this file: a script that finds the functions defined does not load the file.
|# =====================================================================================================================
|
|function Get-SIArmReadiness {
|    <#
|        PURE. Is this resource, as Azure returned it, ready to be used? The property that says so differs per type:
|          Microsoft.Sql/servers/<s>/databases/<d>   properties.status = Online
|          Microsoft.Sql/servers/<s>                 properties.state  = Ready
|          everything else                           properties.provisioningState = Succeeded (none at all = ready:
|                                                    a firewall rule, a managed identity carry no state)
|        Returns @{ State (the text Azure has); Ready; Failed; Why (Azure's own error text for a failed one, '' when it gave none) }.
|    #>
|    param([Parameter(Mandatory)][string]$Path, [AllowNull()]$Resource)
|    $p = ($Path -replace '\?.*$', '').TrimEnd('/')
|    $get = { param($o, [string[]]$names) foreach ($n in $names) { if ($null -eq $o) { return $null }; if ($o -is [System.Collections.IDictionary]) { $o = $(if ($o.Contains($n)) { $o[$n] } else { $null }) } else { $pp = $o.PSObject.Properties[$n]; $o = $(if ($pp) { $pp.Value } else { $null }) } }; $o }
|    if ($null -eq $Resource) { return [pscustomobject]@{ State = ''; Ready = $false; Failed = $false; Why = '' } }
|    if ($p -match '(?i)/providers/Microsoft\.Sql/servers/[^/]+/databases/[^/]+$') {
|        $s = [string](& $get $Resource @('properties', 'status'))
|        return [pscustomobject]@{ State = $s; Ready = ($s -eq 'Online'); Failed = $false; Why = '' }
|    }
|    if ($p -match '(?i)/providers/Microsoft\.Sql/servers/[^/]+$') {
|        $s = [string](& $get $Resource @('properties', 'state'))
|        return [pscustomobject]@{ State = $s; Ready = ($s -eq 'Ready'); Failed = $false; Why = '' }
|    }
|    $s = [string](& $get $Resource @('properties', 'provisioningState'))
|    $failed = $s -in 'Failed', 'Canceled', 'Cancelled'
|    $why = ''
|    if ($failed) {
|        # what Azure itself says on the resource (the names differ per provider); none = say where to look
|        $parts = New-Object System.Collections.Generic.List[string]
|        foreach ($n in 'provisioningError', 'provisioningErrors', 'statusMessage', 'statusDetails', 'deploymentErrors', 'errorMessage', 'error') {
|            $v = & $get $Resource @('properties', $n)
|            if ($null -eq $v) { continue }
|            $t = if ($v -is [string]) { $v } else { try { ConvertTo-Json -InputObject $v -Depth 6 -Compress } catch { [string]$v } }
|            if ("$t".Trim() -and "$t" -ne '{}' -and "$t" -ne '[]') { $parts.Add(('{0}: {1}' -f $n, "$t".Trim())) }
|        }
|        $why = ($parts.ToArray() -join '; ')
|        if ($why.Length -gt 600) { $why = $why.Substring(0, 597) + '...' }
|    }
|    [pscustomobject]@{ State = $s; Ready = (-not $s -or $s -eq 'Succeeded'); Failed = $failed; Why = $why }
|}
|
|function Wait-SIArmResourceReady {
|    <#
|        After a create or a change: polls the resource until it EXISTS AND IS READY (Get-SIArmReadiness), and returns it.
|        A 404 is "not there yet" and is polled through -- never "done". THROWS at the deadline (with the last state Azure
|        showed) and on a failed resource (with Azure's own error text) -- it never returns something that is not ready.
|        The deadline is -TimeoutSec, and at most TimeoutSec / PollSec polls (so a test's instant -Sleep ends too).
|    #>
|    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$ApiVersion, [int]$TimeoutSec = 900, [int]$PollSec = 10, [scriptblock]$Sleep, [string]$What)
|    $name = (($Path -replace '\?.*$', '').TrimEnd('/') -split '/')[-1]
|    if (-not $What) { $What = $name }
|    $deadline = (Get-Date).AddSeconds($TimeoutSec)
|    $polls = [Math]::Max(1, [int][Math]::Ceiling($TimeoutSec / [double][Math]::Max(1, $PollSec)))
|    $state = 'not there yet'
|    $since = [datetime]::UtcNow
|    for ($i = 0; $i -le $polls; $i++) {
|        if ($i -gt 0) { Send-SISetupWaitProgress -What $What -State $state -SinceUtc $since }   # #876: at most once a minute
|        $r = Invoke-SIArm -Path $Path -ApiVersion $ApiVersion -AllowNotFound
|        if ($r) {
|            $rd = Get-SIArmReadiness -Path $Path -Resource $r
|            if ($rd.Failed) {
|                throw ('{0}: Azure reports it {1}{2}' -f $What, $rd.State, $(if ($rd.Why) { ' -- ' + $rd.Why } else { ' and gives no reason on the resource -- see the activity log of the resource group for it' }))
|            }
|            if ($rd.Ready) { return $r }
|            $state = $(if ($rd.State) { $rd.State } else { 'no state yet' })
|        } else { $state = 'not there yet' }
|        if ((Get-Date) -ge $deadline -or $i -ge $polls) { break }
|        if ($Sleep) { & $Sleep $PollSec } else { Start-Sleep -Seconds $PollSec }
|    }
|    throw ('{0} is not ready {1} seconds after it was created or changed (Azure shows: {2}).' -f $What, $TimeoutSec, $state)
|}
|
|function Test-SIArmResourceAbsent {
|    <#
|        Is this resource DEFINITELY not there? $true only when Azure answers "not found" TWICE, with a pause between (a
|        resource that is being scaled or moved can answer 404 for a few seconds). $false when it is there. Any other
|        answer -- a refusal, a time-out, a server error -- THROWS: "could not read" is never "not there", and a create
|        must never be sent over something that exists.
|    #>
|    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$ApiVersion, [int]$PauseSec = 15, [scriptblock]$Sleep)
|    if (Invoke-SIArm -Path $Path -ApiVersion $ApiVersion -AllowNotFound) { return $false }
|    if ($Sleep) { & $Sleep $PauseSec } else { Start-Sleep -Seconds $PauseSec }
|    if (Invoke-SIArm -Path $Path -ApiVersion $ApiVersion -AllowNotFound) { return $false }
|    $true
|}
|
|function Test-SINotThereYetAnswer {
|    <#
|        PURE. Is this error text the "not there yet" answer of something created a moment ago -- HTTP 404 / "not found",
|        Microsoft Graph's NoBackingApplicationObject / "does not reference a valid application object" /
|        Request_ResourceNotFound, Azure's PrincipalNotFound? A REFUSAL (401 / 403, Authorization_RequestDenied,
|        "Insufficient privileges", AuthorizationFailed) is never one, whatever else the text says.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Text)
|    $t = "$Text"
|    if ($t -match '(?i)Authorization_RequestDenied|Insufficient privileges|AuthorizationFailed|does not have authorization|\bForbidden\b|HTTP Status: 40[13]\b|HTTP 40[13]\b|\(40[13]\)') { return $false }
|    [bool]($t -match '(?i)HTTP Status: 404\b|HTTP 404\b|\(404\)|\b404 \(Not ?Found\)|\bNotFound\b|Request_ResourceNotFound|ResourceNotFound|NoBackingApplicationObject|does not reference a valid application object|PrincipalNotFound|does not exist in the directory|does not exist or one of its queried reference-property objects')
|}
|
|function Test-SIAccessNotYetAnswer {
|    <#
|        PURE. Is this error text a data-plane REFUSAL of the kind a role assignment made a minute ago gives until it has
|        reached the service (Key Vault / storage: HTTP 403, Forbidden, ForbiddenByRbac, AuthorizationPermissionMismatch)?
|        Only for a call made right after the grant: the caller bounds the wait.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Text)
|    [bool]("$Text" -match '(?i)HTTP Status: 403\b|HTTP 403\b|\(403\)|\bForbidden|ForbiddenByRbac|AuthorizationPermissionMismatch|not authorized|does not have secrets set permission')
|}
|
|function Test-SIAccessRefusedAnswer {
|    <#
|        PURE. Is this error text Azure's REFUSAL of the signed-in account (HTTP 401 / 403, AuthorizationFailed, Forbidden,
|        Authorization_RequestDenied)? Any other failure (a scope that is not there, a bad request, a timeout) is not.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Text)
|    [bool]("$Text" -match '(?i)HTTP Status: 40[13]\b|HTTP 40[13]\b|\(40[13]\)|\bAuthorizationFailed\b|LinkedAuthorizationFailed|does not have authorization|\bForbidden\b|\bUnauthorized\b|Authorization_RequestDenied')
|}
|
|function Test-SIScopeInsideAny {
|    <# PURE. Is -Scope one of -Own, or below one of them (a resource in the install's resource group)? Case-insensitive. #>
|    param([AllowEmptyString()][string]$Scope, [AllowNull()][AllowEmptyCollection()][string[]]$Own = @())
|    $s = "$Scope".TrimEnd('/').ToLowerInvariant()
|    if (-not $s) { return $false }
|    foreach ($o in @($Own | Where-Object { "$_".Trim() })) {
|        $x = "$o".TrimEnd('/').ToLowerInvariant()
|        if ($s -eq $x -or $s.StartsWith($x + '/')) { return $true }
|    }
|    $false
|}
|
|function Get-SIGrantRefusalOutcome {
|    <#
|        PURE. GRANT-READ-1 (framework rule, 3.0.34): what a failed read (or write) of a role assignment means for the grants.
|        A refusal (401 / 403) at a scope OUTSIDE the install's own scopes (-OwnScopes: its resource group and the SI
|        resources it creates) = 'not-known': the grant is a customer task and the run continues. Anything else -- a refusal
|        INSIDE the install's own scopes, or a failure that is not a refusal -- = 'stop', as before.
|        (Live 2026-11-04, a private install: the tenant root management group's role assignments could not be read by the
|        installing admin, and that one read stopped the whole install.)
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Message, [AllowEmptyString()][string]$Scope, [AllowNull()][AllowEmptyCollection()][string[]]$OwnScopes = @())
|    if (-not (Test-SIAccessRefusedAnswer -Text $Message)) { return 'stop' }
|    if (Test-SIScopeInsideAny -Scope $Scope -Own $OwnScopes) { return 'stop' }
|    'not-known'
|}
|
|function Invoke-SIRetryNotThereYet {
|    <#
|        Runs -Action; when it throws the "not there yet" answer (-Test, default Test-SINotThereYetAnswer: 404,
|        NoBackingApplicationObject, PrincipalNotFound) it waits and runs it again -- -Waits seconds between tries
|        (default 5, 10, 20, 30, 30, 30: about two minutes). ANY OTHER error is thrown at once, unchanged: a refusal is
|        never waited for. The last "not there yet" error is thrown after the last wait. -Sleep: tests.
|        The reason is read from the error's message AND its ErrorDetails (Invoke-RestMethod keeps the service's answer there).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Action, [int[]]$Waits = @(5, 10, 20, 30, 30, 30), [scriptblock]$Test, [scriptblock]$Sleep, [string]$What)
|    $__siTry = 0; $__siOut = $null
|    while ($true) {
|        # no return inside the try: Windows PowerShell 5.1 can fail on one in a function it has compiled
|        try { $__siOut = & $Action; break }
|        catch {
|            $__siText = '{0} {1}' -f [string]$_.Exception.Message, $(if ($_.ErrorDetails) { [string]$_.ErrorDetails.Message } else { '' })
|            $__siYet = if ($Test) { [bool](& $Test $__siText) } else { Test-SINotThereYetAnswer -Text $__siText }
|            if (-not $__siYet -or $__siTry -ge @($Waits).Count) { throw }
|            $__siWait = [int]@($Waits)[$__siTry]; $__siTry++
|            if ($What) { Write-Host ('       {0}: not there yet -- waiting {1} s and trying again ({2}/{3}) ...' -f $What, $__siWait, $__siTry, @($Waits).Count) -ForegroundColor DarkYellow }
|            if ($__siWait -gt 0) { if ($Sleep) { & $Sleep $__siWait } else { Start-Sleep -Seconds $__siWait } }
|        }
|    }
|    $__siOut
|}
|
|# The SQL connection retry (Open-SISqlConnectionRetry, Test-SISqlNotYetAnswer, Test-SISqlTransientError) lives in the ENGINE's
|# shared layer now -- one implementation for setup, the updater and the engine (owner 2026-10-22: "why not use shared everywhere").
|. ([IO.Path]::GetFullPath([IO.Path]::Combine($PSScriptRoot, '..', '..', 'engine', '_shared', 'SI-SqlRetry.ps1')))
|
|# =====================================================================================================================
|#  Container Apps jobs -- READ-MODIFY-WRITE of the whole job
|# =====================================================================================================================
|
|function Get-SIContainerAppJob {
|    <# `az containerapp job show`: the job as ARM returns it; $null when it does not exist. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    Invoke-SIArm -Path (Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.App/jobs' $Name) -ApiVersion $script:SIAppArmApi -AllowNotFound
|}
|
|function Get-SIContainerAppJobList {
|    <# `az containerapp job list --resource-group`: every job of the resource group (ARM objects). #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $items = @(Invoke-SIArm -Path (Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.App/jobs') -ApiVersion $script:SIAppArmApi -List -AllowNotFound)
|    $items   # unrolled into the pipeline (a comma would hand the caller ONE array object)
|}
|
|function Get-SIContainerAppJobSecretValues {
|    <# POST <job>/listSecrets: name -> @{ name; value | keyVaultUrl + identity }. ARM never returns secret values on GET,
|       so a whole-job write must read them back first or it would blank every secret. $null-safe: no secrets = @{}. #>
|    param([Parameter(Mandatory)][string]$JobId)
|    $r = Invoke-SIArm -Method POST -Path ($JobId.TrimEnd('/') + '/listSecrets') -ApiVersion $script:SIAppArmApi -AllowNotFound
|    $h = @{}
|    foreach ($s in @(Get-SISetupArmProp $r @('value'))) { if ($s -and $s.name) { $h[[string]$s.name] = $s } }
|    $h
|}
|
|function Get-SIJobSecretsWithoutValue {
|    <#
|        PURE. The names of the secrets a whole-job write would BLANK: declared by the job (-Job, as read) with a PLAIN
|        value -- not a Key Vault reference, neither on the job nor in what listSecrets returned (-SecretValues) -- whose
|        value is in neither, and that this write does not replace (-SetSecrets) or remove (-RemoveSecrets).
|        A Key Vault reference never counts: it has no value to lose. None = @().
|    #>
|    param([Parameter(Mandatory)]$Job, [hashtable]$SecretValues = @{}, [object[]]$SetSecrets = @(), [string[]]$RemoveSecrets = @())
|    $replaced = @($SetSecrets | Where-Object { $_ } | ForEach-Object { (([string]$_) -split '=', 2)[0] })
|    foreach ($s in @(Get-SISetupArmProp $Job @('properties', 'configuration', 'secrets') | Where-Object { $_ })) {
|        $n = [string](Get-SISetupArmProp $s @('name'))
|        if (-not $n -or @($RemoveSecrets) -contains $n -or $replaced -contains $n) { continue }
|        $known = $SecretValues[$n]
|        if ([string](Get-SISetupArmProp $s @('keyVaultUrl')) -or ($known -and [string](Get-SISetupArmProp $known @('keyVaultUrl')))) { continue }
|        $val = Get-SISetupArmProp $s @('value'); if ($null -eq $val -and $known) { $val = Get-SISetupArmProp $known @('value') }
|        if ($null -eq $val) { $n }
|    }
|}
|
|function ConvertTo-SIJobSecretEntry {
|    <# PURE. One `--secrets` argument (name=value | name=keyvaultref:<url>,identityref:<id>) as an ARM secret. #>
|    param([Parameter(Mandatory)][string]$Arg)
|    $p = $Arg -split '=', 2
|    $v = $(if ($p.Count -gt 1) { $p[1] } else { '' })
|    if ($v.StartsWith('keyvaultref:')) {
|        $ref = $v.Substring(12); $k = $ref.IndexOf(',identityref:')
|        if ($k -ge 0) { return [ordered]@{ name = $p[0]; keyVaultUrl = $ref.Substring(0, $k); identity = $ref.Substring($k + 13) } }
|        return [ordered]@{ name = $p[0]; keyVaultUrl = $ref }
|    }
|    [ordered]@{ name = $p[0]; value = $v }
|}
|
|function ConvertTo-SIJobEnvEntry {
|    <# PURE. One `--env-vars` argument (N=V | N=secretref:S) as an ARM env entry. #>
|    param([Parameter(Mandatory)][string]$Arg)
|    $p = $Arg -split '=', 2
|    $v = $(if ($p.Count -gt 1) { $p[1] } else { '' })
|    if ($v.StartsWith('secretref:')) { return [ordered]@{ name = $p[0]; secretRef = $v.Substring(10) } }
|    [ordered]@{ name = $p[0]; value = $v }
|}
|
|function ConvertFrom-SIScaleRuleArgs {
|    <# PURE. Get-SIKedaQueueScaleArgs' arguments (--scale-rule-name/-type/-metadata k=v/-identity) as ONE ARM scale rule. #>
|    param([object[]]$ScaleArgs = @())
|    $rule = [ordered]@{ name = ''; type = ''; metadata = [ordered]@{} }
|    $cur = $null
|    foreach ($x in @($ScaleArgs | ForEach-Object { [string]$_ })) {
|        if ($x.StartsWith('--')) { $cur = $x; continue }
|        switch ($cur) {
|            '--scale-rule-name'     { $rule.name = $x }
|            '--scale-rule-type'     { $rule.type = $x }
|            '--scale-rule-identity' { $rule.identity = $x }
|            '--scale-rule-metadata' { $kv = $x -split '=', 2; $rule.metadata[$kv[0]] = $(if ($kv.Count -gt 1) { $kv[1] } else { '' }) }
|        }
|    }
|    if (-not $rule.name) { return $null }
|    $rule
|}
|
|function Merge-SIContainerAppJobUpdate {
|    <#
|        PURE. The job written back WHOLE, with what an `az containerapp job update` / `secret set` / `secret remove` /
|        `identity assign` / `registry set` changed -- applied to the job as read (-Job, with its secret values from
|        listSecrets in -SecretValues). Only what is given changes; everything else (command, args, probes, volumes, the
|        trigger of a job the flow made Manual, other secrets, other identities) is kept as it is.
|          -Image / -Cpu / -Memory      the job's (first) container          -Env      REPLACES its environment (N=V)
|          -SetEnv                      adds / overwrites these (N=V)        -RemoveEnv  drops these names
|          -Cron                        scheduleTriggerConfig.cronExpression (a Schedule job only)
|          -ReplicaTimeout              configuration.replicaTimeout         -Tags     merged into the job's tags (k=v)
|          -ScaleRule                   replaces the rule of that name (eventTriggerConfig.scale.rules)
|          -SetSecrets                  adds / overwrites (name=value | keyvaultref)   -RemoveSecrets  drops these names
|          -AddIdentity                 a user-assigned identity resource id (kept identities stay)
|          -RegistryServer + -RegistryIdentity   the registry entry for that server pulls as the identity
|        Returns the body (an ordered dictionary) for a PUT.
|    #>
|    param(
|        [Parameter(Mandatory)]$Job, [hashtable]$SecretValues = @{},
|        [string]$Image, [string]$Cpu, [string]$Memory, [object[]]$Env, [object[]]$SetEnv = @(), [string[]]$RemoveEnv = @(),
|        [string]$Cron, [int]$ReplicaTimeout = 0, [object[]]$Tags = @(), $ScaleRule,
|        [object[]]$SetSecrets = @(), [string[]]$RemoveSecrets = @(), [string]$AddIdentity, [string]$RegistryServer, [string]$RegistryIdentity
|    )
|    $b = ConvertTo-SISetupArmHashtable $Job
|    foreach ($ro in 'systemData', 'etag') { if ($b.Contains($ro)) { $b.Remove($ro) } }
|    if (-not $b.Contains('properties') -or $null -eq $b.properties) { $b.properties = [ordered]@{} }
|    $p = $b.properties
|    foreach ($ro in 'provisioningState', 'eventStreamEndpoint', 'outboundIpAddresses') { if ($p.Contains($ro)) { $p.Remove($ro) } }
|    if (-not $p.Contains('configuration') -or $null -eq $p.configuration) { $p.configuration = [ordered]@{} }
|    $cfg = $p.configuration
|    if (-not $p.Contains('template') -or $null -eq $p.template) { $p.template = [ordered]@{ containers = @() } }
|
|    # ---- secrets: the values read back, then the changes ----
|    $secrets = New-Object System.Collections.Generic.List[object]
|    foreach ($s in @($cfg.secrets | Where-Object { $_ })) {
|        $n = [string]$s.name
|        if (@($RemoveSecrets) -contains $n) { continue }
|        $e = [ordered]@{ name = $n }
|        $known = $SecretValues[$n]
|        $kv = [string](Get-SISetupArmProp $s @('keyVaultUrl')); if (-not $kv -and $known) { $kv = [string](Get-SISetupArmProp $known @('keyVaultUrl')) }
|        if ($kv) {
|            $e.keyVaultUrl = $kv
|            $id = [string](Get-SISetupArmProp $s @('identity')); if (-not $id -and $known) { $id = [string](Get-SISetupArmProp $known @('identity')) }
|            if ($id) { $e.identity = $id }
|        } else {
|            $val = Get-SISetupArmProp $s @('value'); if ($null -eq $val -and $known) { $val = Get-SISetupArmProp $known @('value') }
|            # (a value that was not read back becomes '' here: this function only shapes the body. The WRITE is guarded --
|            # Update-SIContainerAppJob stops before it when Get-SIJobSecretsWithoutValue names a secret.)
|            $e.value = [string]$val
|        }
|        $secrets.Add($e)
|    }
|    foreach ($a in @($SetSecrets | Where-Object { $_ })) {
|        $e = ConvertTo-SIJobSecretEntry -Arg ([string]$a)
|        $i = -1; for ($k = 0; $k -lt $secrets.Count; $k++) { if ([string]$secrets[$k].name -eq [string]$e.name) { $i = $k } }
|        if ($i -ge 0) { $secrets[$i] = $e } else { $secrets.Add($e) }
|    }
|    if ($secrets.Count) { $cfg.secrets = $secrets.ToArray() } elseif ($cfg.Contains('secrets')) { $cfg.secrets = @() }
|
|    if ($ReplicaTimeout -gt 0) { $cfg.replicaTimeout = $ReplicaTimeout }
|    if ($Cron -and [string]$cfg.triggerType -eq 'Schedule') {
|        if (-not $cfg.Contains('scheduleTriggerConfig') -or $null -eq $cfg.scheduleTriggerConfig) { $cfg.scheduleTriggerConfig = [ordered]@{ parallelism = 1; replicaCompletionCount = 1 } }
|        $cfg.scheduleTriggerConfig.cronExpression = $Cron
|    }
|    if ($ScaleRule) {
|        if (-not $cfg.Contains('eventTriggerConfig') -or $null -eq $cfg.eventTriggerConfig) { $cfg.eventTriggerConfig = [ordered]@{ parallelism = 1; replicaCompletionCount = 1 } }
|        $etc = $cfg.eventTriggerConfig
|        if (-not $etc.Contains('scale') -or $null -eq $etc.scale) { $etc.scale = [ordered]@{ minExecutions = 0; maxExecutions = 10; pollingInterval = 30 } }
|        $rules = @(@($etc.scale.rules) | Where-Object { $_ -and [string]$_.name -ne [string]$ScaleRule.name })
|        $etc.scale.rules = @($rules) + @($ScaleRule)
|    }
|    if ($RegistryServer -and $RegistryIdentity) {
|        $regs = @(@($cfg.registries) | Where-Object { $_ -and [string]$_.server -ne $RegistryServer })
|        $cfg.registries = @($regs) + @([ordered]@{ server = $RegistryServer; identity = $RegistryIdentity })
|    }
|
|    # ---- identity ----
|    if ($AddIdentity) {
|        $idn = $b.identity
|        if ($null -eq $idn) { $idn = [ordered]@{ type = 'UserAssigned' }; $b.identity = $idn }
|        $ua = $idn.userAssignedIdentities
|        $newUa = [ordered]@{}
|        if ($ua -is [System.Collections.IDictionary]) { foreach ($k in @($ua.Keys)) { $newUa[[string]$k] = [ordered]@{} } }
|        if (-not @($newUa.Keys | Where-Object { "$_" -ieq $AddIdentity }).Count) { $newUa[$AddIdentity] = [ordered]@{} }
|        $idn.userAssignedIdentities = $newUa
|        $t = [string]$idn.type
|        $idn.type = $(if ($t -match '(?i)SystemAssigned') { 'SystemAssigned,UserAssigned' } else { 'UserAssigned' })
|    }
|
|    # ---- tags (merged) ----
|    $tagList = @($Tags | Where-Object { $_ })
|    if ($tagList.Count) {
|        $tg = [ordered]@{}
|        if ($b.tags -is [System.Collections.IDictionary]) { foreach ($k in @($b.tags.Keys)) { $tg[[string]$k] = $b.tags[$k] } }
|        foreach ($t in $tagList) { $kv = ([string]$t) -split '=', 2; $tg[$kv[0]] = $(if ($kv.Count -gt 1) { $kv[1] } else { '' }) }
|        $b.tags = $tg
|    }
|
|    # ---- the container ----
|    $containers = @($p.template.containers | Where-Object { $_ })
|    if ($containers.Count -eq 0 -and ($Image -or $Env -or $SetEnv.Count)) { $containers = @([ordered]@{ name = [string]$b.name; image = $Image; env = @() }) }
|    if ($containers.Count) {
|        $c = $containers[0]
|        if ($Image) { $c.image = $Image }
|        if ($Cpu -or $Memory) {
|            if (-not $c.Contains('resources') -or $null -eq $c.resources) { $c.resources = [ordered]@{} }
|            if ($Cpu) { $c.resources.cpu = [double]::Parse($Cpu, [Globalization.CultureInfo]::InvariantCulture) }
|            if ($Memory) { $c.resources.memory = $Memory }
|            if ($c.resources.Contains('ephemeralStorage') -and ($Cpu -or $Memory)) { $c.resources.Remove('ephemeralStorage') }
|        }
|        $envList = New-Object System.Collections.Generic.List[object]
|        if ($null -ne $Env) { foreach ($x in @($Env | Where-Object { $_ })) { $envList.Add((ConvertTo-SIJobEnvEntry -Arg ([string]$x))) } }
|        else { foreach ($x in @($c.env | Where-Object { $_ })) { $envList.Add($x) } }
|        foreach ($x in @($SetEnv | Where-Object { $_ })) {
|            $e = ConvertTo-SIJobEnvEntry -Arg ([string]$x)
|            $i = -1; for ($k = 0; $k -lt $envList.Count; $k++) { if ([string]$envList[$k].name -eq [string]$e.name) { $i = $k } }
|            if ($i -ge 0) { $envList[$i] = $e } else { $envList.Add($e) }
|        }
|        if (@($RemoveEnv).Count) { $keep = @($envList | Where-Object { @($RemoveEnv) -notcontains [string]$_.name }); $envList = New-Object System.Collections.Generic.List[object]; foreach ($x in $keep) { $envList.Add($x) } }
|        $c.env = $envList.ToArray()
|        $containers[0] = $c
|        $p.template.containers = $containers
|    }
|    $b
|}
|
|function Test-SIContainerAppIdentityNotReady {
|    <# PURE. A Container Apps create/update refused because a NEW managed identity's registry pull right has not reached the
|       registry yet (the role assignment was made seconds before) -- a wait, not a failure. customer A, 2026-10-08. #>
|    param([AllowEmptyString()][string]$Text)
|    [bool]("$Text" -match '(?i)unable to pull image using Managed identity|identity .* (is not|has not been) (authorized|granted).*(pull|registry)|UNAUTHORIZED: authentication required')
|}
|
|function Test-SIContainerAppRegistryNotResolvable {
|    <# PURE. A Container Apps create/update refused because Azure cannot resolve a container registry's name YET -- the
|       registry was created minutes before and its name has not reached the resolver Container Apps uses
|       (InvalidParameterValueInContainerTemplate ... "failed to resolve registry '<name>.azurecr.io' ... no such host").
|       A wait, not a failure: the customer-run install at customer C stopped on it 2026-10-15 07:12Z (registry made
|       07:08Z, its name resolving minutes later). #>
|    param([AllowEmptyString()][string]$Text)
|    [bool]("$Text" -match "(?i)failed to resolve registry\s+'?[a-z0-9.-]+\.azurecr\.io'?[^;]*no such host")
|}
|
|function Get-SIJobBodyRunLimit {
|    <# PURE. The run limit (properties.configuration.replicaTimeout, seconds) a job body asks for; 0 when it names none.
|       The body may be hashtables (a create) or objects (a job as read). #>
|    param($Body)
|    $get = { param($o, $n) if ($null -eq $o) { $null } elseif ($o -is [System.Collections.IDictionary]) { $o[$n] } else { $pp = $o.PSObject.Properties[$n]; if ($pp) { $pp.Value } else { $null } } }
|    $v = & $get (& $get (& $get $Body 'properties') 'configuration') 'replicaTimeout'
|    $n = 0; [void][int]::TryParse("$v", [ref]$n); $n
|}
|
|function Set-SIJobBodyRunLimit {
|    <# The run limit of a job body set to -ReplicaTimeout, and a KEDA worker's queue lease (SI_QUEUE_LEASE_SECONDS on its
|       first container) with it: the limit + 300 s. Changes -Body in place. #>
|    param($Body, [Parameter(Mandatory)][int]$ReplicaTimeout)
|    $get = { param($o, $n) if ($null -eq $o) { $null } elseif ($o -is [System.Collections.IDictionary]) { $o[$n] } else { $pp = $o.PSObject.Properties[$n]; if ($pp) { $pp.Value } else { $null } } }
|    $set = { param($o, $n, $val) if ($o -is [System.Collections.IDictionary]) { $o[$n] = $val } else { $o | Add-Member -NotePropertyName $n -NotePropertyValue $val -Force } }
|    $props = & $get $Body 'properties'
|    $cfg = & $get $props 'configuration'
|    if ($null -eq $cfg) { return }
|    & $set $cfg 'replicaTimeout' $ReplicaTimeout
|    $first = @(& $get (& $get $props 'template') 'containers' | Where-Object { $_ }) | Select-Object -First 1
|    foreach ($e in @(& $get $first 'env')) {
|        if ($e -and [string](& $get $e 'name') -eq 'SI_QUEUE_LEASE_SECONDS') { & $set $e 'value' ([string]($ReplicaTimeout + 300)) }
|    }
|}
|
|function Set-SIContainerAppJob {
|    <# PUT the WHOLE job (create or replace) and wait until Azure has provisioned it. A refusal because a new identity's
|       registry pull right has not arrived yet is waited out (-IdentityWaitSeconds). A run limit above 24 hours that Azure
|       refuses is sent once more as 24 hours -- the rest of the job unchanged -- with one plain line; the refusal is
|       remembered for the run (container\_shared\SI-ContainerConfig.ps1, Get-SIRunLimitToSend). Returns the job as Azure has it. #>
|    param([Parameter(Mandatory)][string]$JobId, [Parameter(Mandatory)]$Body, [int]$IdentityWaitSeconds = 600, [scriptblock]$Sleep, [switch]$NoWait)
|    if (-not (Get-Command -Name Get-SIRunLimitToSend -ErrorAction Ignore)) { . ([IO.Path]::Combine($PSScriptRoot, '..', '..', 'container', '_shared', 'SI-ContainerConfig.ps1')) }
|    $asked = Get-SIJobBodyRunLimit -Body $Body
|    $limit = Get-SIRunLimitToSend -ReplicaTimeout $asked
|    if ($limit -lt $asked) { Set-SIJobBodyRunLimit -Body $Body -ReplicaTimeout $limit }   # refused earlier in this run
|    $lowered = $false
|    $until = (Get-Date).AddSeconds($IdentityWaitSeconds)
|    while ($true) {
|        try { $null = Invoke-SIArm -Method PUT -Path $JobId -ApiVersion $script:SIAppArmApi -Body $Body; break }
|        catch {
|            $text = [string]$_.Exception.Message
|            if (Test-SIContainerAppIdentityNotReady -Text $text) {
|                if ((Get-Date) -ge $until) { throw }
|                Write-Host '       the new identity''s registry pull right has not reached the registry yet -- waiting 30 s and trying again ...' -ForegroundColor DarkYellow
|                if ($Sleep) { & $Sleep 30 } else { Start-Sleep -Seconds 30 }
|                continue
|            }
|            if (Test-SIContainerAppRegistryNotResolvable -Text $text) {
|                if ((Get-Date) -ge $until) { throw }
|                Write-Host '       Azure cannot find the new container registry''s name yet (it was just created) -- waiting 30 s and trying again ...' -ForegroundColor DarkYellow
|                if ($Sleep) { & $Sleep 30 } else { Start-Sleep -Seconds 30 }
|                continue
|            }
|            # a run limit above 24 hours may be what Azure refused: the same job once more with 24 hours
|            if ($lowered -or -not (Test-SIRunLimitRefusal -ReplicaTimeout $limit -Text $text)) { throw }
|            $limit = [int](Get-SIAzureKnownRunLimit); $lowered = $true
|            Set-SIJobBodyRunLimit -Body $Body -ReplicaTimeout $limit
|        }
|    }
|    if ($lowered) {
|        # accepted with 24 hours: the run limit was the cause -- said once, and the other jobs of this run ask for 24 hours
|        Set-SIRunLimitRefused
|        Write-Host ('       ' + (Get-SIRunLimitRefusedLine -Job (([string]$JobId -split '/')[-1]) -ReplicaTimeout $asked)) -ForegroundColor DarkYellow
|    }
|    if ($NoWait) { return (Invoke-SIArm -Path $JobId -ApiVersion $script:SIAppArmApi -AllowNotFound) }
|    # until the job EXISTS and is provisioned: a 404 is "not yet", a deadline or a failed job throws with Azure's words
|    Wait-SIArmResourceReady -Path $JobId -ApiVersion '2025-07-01' -TimeoutSec 900 -PollSec 5 -Sleep $Sleep -What ('the Container Apps job {0}' -f (([string]$JobId -split '/')[-1]))
|}
|
|function New-SIContainerAppJobFromArgs {
|    <#
|        `az containerapp job create <args>` over ARM: Bootstrap's job definition (the create arguments of
|        container\_shared\SI-ContainerConfig.ps1 -- Get-SIKedaWorkerCreateArgs and friends -- plus tags, registry, identity,
|        secrets and env) translated by ConvertFrom-SIJobCreateArgs (setup\_shared\SI-KedaConvert.ps1, the one translation
|        the update uses too) into the Microsoft.App/jobs resource, and PUT whole. -EnvironmentId: the environment's
|        resource id (the arguments may carry its name). Returns the job.
|    #>
|    param([Parameter(Mandatory)][object[]]$CreateArgs, [Parameter(Mandatory)][string]$Location, [Parameter(Mandatory)][string]$EnvironmentId,
|          [string]$SubscriptionId, [scriptblock]$Sleep)
|    if (-not (Get-Command -Name ConvertFrom-SIJobCreateArgs -ErrorAction Ignore)) { . (Join-Path $PSScriptRoot 'SI-KedaConvert.ps1') }
|    $spec = ConvertFrom-SIJobCreateArgs -CreateArgs $CreateArgs -Location $Location
|    $spec.Body.properties.environmentId = $EnvironmentId
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $id = Get-SISetupArmPath $sub $spec.ResourceGroup 'Microsoft.App/jobs' $spec.Name
|    Set-SIContainerAppJob -JobId $id -Body $spec.Body -Sleep $Sleep
|}
|
|function Update-SIContainerAppJob {
|    <#
|        The az update family over ARM, READ-MODIFY-WRITE: GET the job, read its secret values back (listSecrets), apply the
|        changes (Merge-SIContainerAppJobUpdate -- same parameters) and PUT the whole job once. A job that does not exist
|        throws. Returns the job as Azure has it.
|    #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId,
|          [string]$Image, [string]$Cpu, [string]$Memory, [object[]]$Env, [object[]]$SetEnv = @(), [string[]]$RemoveEnv = @(),
|          [string]$Cron, [int]$ReplicaTimeout = 0, [object[]]$Tags = @(), $ScaleRule,
|          [object[]]$SetSecrets = @(), [string[]]$RemoveSecrets = @(), [string]$AddIdentity, [string]$RegistryServer, [string]$RegistryIdentity,
|          $Job, [scriptblock]$Sleep)
|    if (-not $Job) { $Job = Get-SIContainerAppJob -ResourceGroupName $ResourceGroupName -Name $Name -SubscriptionId $SubscriptionId }
|    if (-not $Job) { throw ("The Container Apps job '{0}' was not found in resource group '{1}'." -f $Name, $ResourceGroupName) }
|    $vals = Get-SIContainerAppJobSecretValues -JobId ([string]$Job.id)
|    # THE WRITE IS GUARDED: a secret the job declares with a plain value that was not read back would be written EMPTY by
|    # the whole-job write, and the job would lose it without a word. Stop before the write instead.
|    $noValue = @(Get-SIJobSecretsWithoutValue -Job $Job -SecretValues $vals -SetSecrets $SetSecrets -RemoveSecrets $RemoveSecrets)
|    if ($noValue.Count) {
|        throw ("The job {0} is NOT written: its secret(s) {1} have no value that could be read back (listSecrets did not return them), and writing the job would blank them. Check that this sign-in may read the job's secrets (Microsoft.App/jobs/listSecrets/action) and run the same command again." -f $Name, (($noValue | ForEach-Object { "'" + $_ + "'" }) -join ', '))
|    }
|    $m = @{ Job = $Job; SecretValues = $vals }
|    foreach ($k in 'Image', 'Cpu', 'Memory', 'Env', 'SetEnv', 'RemoveEnv', 'Cron', 'ReplicaTimeout', 'Tags', 'ScaleRule', 'SetSecrets', 'RemoveSecrets', 'AddIdentity', 'RegistryServer', 'RegistryIdentity') {
|        if ($PSBoundParameters.ContainsKey($k)) { $m[$k] = $PSBoundParameters[$k] }
|    }
|    $body = Merge-SIContainerAppJobUpdate @m
|    Set-SIContainerAppJob -JobId ([string]$Job.id) -Body $body -Sleep $Sleep
|}
|
|function Remove-SIContainerAppJob {
|    <# `az containerapp job delete --yes`. Absent = nothing to do. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $null = Invoke-SIArm -Method DELETE -Path (Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.App/jobs' $Name) -ApiVersion $script:SIAppArmApi -AllowNotFound
|}
|
|function Start-SIContainerAppJob {
|    <# `az containerapp job start` (POST <job>/start). -Template: the execution's own template (e.g. the flow job started
|       with SI_FLOW_FORCE=1). Returns @{ id; name } of the execution. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId, $Template)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $body = if ($null -ne $Template) { $Template } else { $null }
|    Invoke-SIArm -Method POST -Path ((Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.App/jobs' $Name) + '/start') -ApiVersion $script:SIAppArmApi -Body $body
|}
|
|# =====================================================================================================================
|#  Container apps (the Pro web app) and managed environments
|# =====================================================================================================================
|
|function Get-SIContainerApp {
|    <# `az containerapp show`: the app as ARM returns it; $null when it does not exist. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    Invoke-SIArm -Path (Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.App/containerApps' $Name) -ApiVersion $script:SIAppArmApi -AllowNotFound
|}
|
|function Set-SIContainerAppEnvVar {
|    <# `az containerapp update --set-env-vars N=V ...`, READ-MODIFY-WRITE: the app read whole, the variables set on its
|       first container (others kept), the WHOLE template written back by PATCH (a template PATCH replaces the container
|       array, so it carries every container as read; secrets are not part of it and stay). Returns $true when it changed. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string[]]$SetEnv, [string]$SubscriptionId)
|    $app = Get-SIContainerApp -ResourceGroupName $ResourceGroupName -Name $Name -SubscriptionId $SubscriptionId
|    if (-not $app) { throw ("The container app '{0}' was not found in resource group '{1}'." -f $Name, $ResourceGroupName) }
|    $tpl = ConvertTo-SISetupArmHashtable (Get-SISetupArmProp $app @('properties', 'template'))
|    $cs = @($tpl.containers | Where-Object { $_ })
|    if (-not $cs.Count) { throw ("The container app '{0}' has no container." -f $Name) }
|    $env = New-Object System.Collections.Generic.List[object]; foreach ($x in @($cs[0].env | Where-Object { $_ })) { $env.Add($x) }
|    $changed = $false
|    foreach ($a in $SetEnv) {
|        $e = ConvertTo-SIJobEnvEntry -Arg $a
|        $i = -1; for ($k = 0; $k -lt $env.Count; $k++) { if ([string]$env[$k].name -eq [string]$e.name) { $i = $k } }
|        if ($i -ge 0) { if ([string]$env[$i].value -ne [string]$e.value -or $env[$i].Contains('secretRef')) { $env[$i] = $e; $changed = $true } } else { $env.Add($e); $changed = $true }
|    }
|    if (-not $changed) { return $false }
|    $cs[0].env = $env.ToArray(); $tpl.containers = $cs
|    if ($tpl.Contains('revisionSuffix')) { $tpl.Remove('revisionSuffix') }
|    $null = Invoke-SIArm -Method PATCH -Path ([string]$app.id) -ApiVersion $script:SIAppArmApi -Body ([ordered]@{ properties = [ordered]@{ template = $tpl } })
|    $null = Wait-SIArmResourceReady -Path ([string]$app.id) -ApiVersion '2025-07-01' -TimeoutSec 900 -PollSec 5 -What ('the container app {0}' -f $Name)
|    $true
|}
|
|function Get-SIManagedEnvironment {
|    <# `az containerapp env show`: the environment as ARM returns it; $null when it does not exist. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    Invoke-SIArm -Path (Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.App/managedEnvironments' $Name) -ApiVersion $script:SIAppArmApi -AllowNotFound
|}
|
|function Get-SIManagedEnvironmentBody {
|    <# PURE. A new Container Apps environment: logs through Azure Monitor (#220 -- no stray workspace; the diagnostic
|       setting sends them to the SI workspace) and the Consumption workload profile (what az creates by default). #>
|    param([Parameter(Mandatory)][string]$Location,
|          # #681 (private networking, an option): the environment in the customer's subnet; -Internal = no public address
|          [string]$InfrastructureSubnetId = '', [switch]$Internal)
|    $b = [ordered]@{ location = $Location; properties = [ordered]@{
|        appLogsConfiguration = [ordered]@{ destination = 'azure-monitor' }
|        workloadProfiles     = @([ordered]@{ name = 'Consumption'; workloadProfileType = 'Consumption' }) } }
|    if ("$InfrastructureSubnetId".Trim()) { $b.properties['vnetConfiguration'] = [ordered]@{ infrastructureSubnetId = "$InfrastructureSubnetId".Trim(); internal = [bool]$Internal } }
|    $b
|}
|
|function New-SIManagedEnvironment {
|    <# `az containerapp env create --logs-destination azure-monitor`: PUT, then waits until provisioned (minutes). #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$Location, [string]$SubscriptionId, [scriptblock]$Sleep,
|          [string]$InfrastructureSubnetId = '', [switch]$Internal)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $path = Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.App/managedEnvironments' $Name
|    $null = Invoke-SIArm -Method PUT -Path $path -ApiVersion $script:SIAppArmApi -Body (Get-SIManagedEnvironmentBody -Location $Location -InfrastructureSubnetId $InfrastructureSubnetId -Internal:$Internal)
|    Wait-SIArmResourceReady -Path $path -ApiVersion '2025-07-01' -TimeoutSec 1800 -PollSec 15 -Sleep $Sleep -What ('the Container Apps environment {0}' -f $Name)
|}
|
|function Wait-SIArmResourceGone {
|    <#
|        After a DELETE: polls the resource until Azure answers "not found", and returns $true. A resource that still
|        answers is "not gone yet" whatever state it shows. THROWS at the deadline with the last state Azure showed -- it
|        never returns while the resource is there. At most TimeoutSec / PollSec polls (so a test's instant -Sleep ends too).
|    #>
|    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$ApiVersion, [int]$TimeoutSec = 1800, [int]$PollSec = 15, [scriptblock]$Sleep, [string]$What)
|    if (-not $What) { $What = (($Path -replace '\?.*$', '').TrimEnd('/') -split '/')[-1] }
|    $deadline = (Get-Date).AddSeconds($TimeoutSec)
|    $polls = [Math]::Max(1, [int][Math]::Ceiling($TimeoutSec / [double][Math]::Max(1, $PollSec)))
|    $state = ''
|    for ($i = 0; $i -le $polls; $i++) {
|        $r = Invoke-SIArm -Path $Path -ApiVersion $ApiVersion -AllowNotFound
|        if (-not $r) { return $true }
|        $state = [string](Get-SIArmReadiness -Path $Path -Resource $r).State
|        if ((Get-Date) -ge $deadline -or $i -ge $polls) { break }
|        if ($Sleep) { & $Sleep $PollSec } else { Start-Sleep -Seconds $PollSec }
|    }
|    throw ('{0} is still there {1} seconds after its removal was asked for (Azure shows: {2}).' -f $What, $TimeoutSec, $(if ($state) { $state } else { 'no state' }))
|}
|
|function Remove-SIManagedEnvironment {
|    <# `az containerapp env delete --yes`: DELETE, then WAITS UNTIL IT IS GONE (Azure takes minutes; a create sent while
|       the old one is still being removed is refused). Absent = nothing to do. The caller decides whether it may be
|       removed (Get-SIManagedEnvironmentUse) -- this function removes what it is given. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId, [int]$TimeoutSec = 1800, [scriptblock]$Sleep)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $path = Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.App/managedEnvironments' $Name
|    $null = Invoke-SIArm -Method DELETE -Path $path -ApiVersion '2025-07-01' -AllowNotFound
|    $null = Wait-SIArmResourceGone -Path $path -ApiVersion '2025-07-01' -TimeoutSec $TimeoutSec -PollSec 15 -Sleep $Sleep -What ('the Container Apps environment {0}' -f $Name)
|}
|
|function Get-SIManagedEnvironmentUse {
|    <#
|        What runs in this environment: every Container Apps job and container app of the resource group that refers to it
|        (properties.environmentId / properties.managedEnvironmentId), as 'the job <name>' / 'the container app <name>'.
|        Nothing = an empty list. A list that cannot be read THROWS: "could not read" is never "empty", and an
|        environment is only ever removed when it is known to hold nothing.
|    #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$EnvironmentId, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $want = $EnvironmentId.Trim().TrimEnd('/')
|    $found = New-Object System.Collections.Generic.List[string]
|    foreach ($kind in @(@{ Type = 'Microsoft.App/jobs'; Word = 'the job' }, @{ Type = 'Microsoft.App/containerApps'; Word = 'the container app' })) {
|        $items = @(Invoke-SIArm -Path (Get-SISetupArmPath $sub $ResourceGroupName $kind.Type) -ApiVersion '2025-07-01' -List | Where-Object { $_ })
|        foreach ($it in $items) {
|            foreach ($prop in 'environmentId', 'managedEnvironmentId') {
|                $v = ([string](Get-SISetupArmProp $it @('properties', $prop))).Trim().TrimEnd('/')
|                if ($v -and [string]::Equals($v, $want, [System.StringComparison]::OrdinalIgnoreCase)) { $found.Add(('{0} {1}' -f $kind.Word, [string]$it.name)); break }
|            }
|        }
|    }
|    $found.ToArray()
|}
|
|function Test-SIManagedEnvironmentInNetwork {
|    <# PURE. Is -Environment (as ARM returns it) in -SubnetId, and internal when -Internal is asked? (Whatever its state:
|       one Azure is still making carries its network from the create.) #>
|    param($Environment, [Parameter(Mandatory)][string]$SubnetId, [switch]$Internal)
|    $s = ([string](Get-SISetupArmProp $Environment @('properties', 'vnetConfiguration', 'infrastructureSubnetId'))).Trim().TrimEnd('/')
|    if (-not $s -or -not [string]::Equals($s, $SubnetId.Trim().TrimEnd('/'), [System.StringComparison]::OrdinalIgnoreCase)) { return $false }
|    if ($Internal -and -not [bool](Get-SISetupArmProp $Environment @('properties', 'vnetConfiguration', 'internal'))) { return $false }
|    $true
|}
|
|function Get-SIManagedEnvironmentNetworkText {
|    <# PURE. How an environment sits, in words: 'public (not in a virtual network)' | 'in another subnet (<id>)' |
|       'in the virtual network but not internal (it has a public address)' | 'internal, in <subnet>'. #>
|    param($Environment)
|    $s = [string](Get-SISetupArmProp $Environment @('properties', 'vnetConfiguration', 'infrastructureSubnetId'))
|    if (-not $s) { return 'public (not in a virtual network)' }
|    if (-not [bool](Get-SISetupArmProp $Environment @('properties', 'vnetConfiguration', 'internal'))) { return ('in the subnet {0} but not internal (it has a public address)' -f $s) }
|    'internal, in the subnet {0}' -f $s
|}
|
|function Get-SIPrivateEnvironmentNameHint { 'cae-si-private' }
|
|function Initialize-SIManagedEnvironment {
|    <#
|        The Container Apps environment of an install, READY -- or a plain sentence why not. An environment that exists is
|        not "fine" because it exists (a customer install, 2026-10-13: Azure left a new one Failed, and the next run went on
|        with it). What Azure shows decides:
|          not there                  created, waited for until it is ready
|          ready                      returned as it is -- nothing is written
|          still being made           waited for (the same limit as a new one); a second one is never created
|          being removed              waited for until it is gone, then created
|          Failed / Canceled          Azure does not repair it. EMPTY (no job and no container app of the resource group
|                                     refers to it): removed, waited for until it is gone, created again -- ONCE per run.
|                                     NOT empty: nothing is removed; it stops and says so (a support case).
|        A create that Azure fails stops with what Azure said and what the person does next; it is not tried again in the
|        same run (the failed one is removed by the next run). -Sleep: tests.
|    #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$Location, [string]$SubscriptionId, [scriptblock]$Sleep,
|          # #681 (private networking, an option): a NEW environment is created in this subnet (-Internal: no public address).
|          # An environment that exists is never changed: Azure cannot move one into a virtual network (setup\Set-SIPrivateNetworking.ps1).
|          [string]$InfrastructureSubnetId = '', [switch]$Internal)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $path = Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.App/managedEnvironments' $Name
|    $what = 'the Container Apps environment {0}' -f $Name
|    $again = $false   # this run (or the one before it) already had a failed environment: the create below is a second try
|    $cae = Get-SIManagedEnvironment -ResourceGroupName $ResourceGroupName -Name $Name -SubscriptionId $sub
|    # FRAMEWORK INSTALLER RULE 11 (general, 2026-11-04: made, recovered OR FOUND, every resource of a private install ends
|    # private) + the owner (2026-11-04: "if we have leftovers that are wrong, then we must handle that"): a private install
|    # that FINDS its environment not internal in its subnet (Azure cannot convert one) replaces it -- ONLY when it holds no
|    # job and no app (a half-made or failed one counts as empty); one that holds anything is never removed: it stops with
|    # the plan. An environment that IS internal in the subnet -- also one Azure is still making ("Waiting") -- is kept and
|    # waited for, below.
|    $script:SIManagedEnvironmentReplaced = $null
|    if ($cae -and "$InfrastructureSubnetId".Trim() -and -not (Test-SIManagedEnvironmentInNetwork -Environment $cae -SubnetId $InfrastructureSubnetId -Internal:$Internal)) {
|        $prd = Get-SIArmReadiness -Path $path -Resource $cae
|        $shape = Get-SIManagedEnvironmentNetworkText -Environment $cae
|        if (-not $prd.Failed -and [string]$prd.State -match '(?i)delet') {
|            Write-Host ('       {0} is being removed by Azure ({1}) -- waiting until it is gone, then it is created internal in your virtual network ...' -f $what, $prd.State) -ForegroundColor DarkYellow
|            $null = Wait-SIArmResourceGone -Path $path -ApiVersion '2025-07-01' -TimeoutSec 1800 -PollSec 15 -Sleep $Sleep -What $what
|        } else {
|            $use = @()
|            try { $use = @(Get-SIManagedEnvironmentUse -ResourceGroupName $ResourceGroupName -EnvironmentId ([string]$cae.id) -SubscriptionId $sub) }
|            catch { throw ('{0} is {1}, but this install is private: it must be internal in your virtual network. Azure cannot convert an environment, so an EMPTY one is replaced -- and what it holds could not be read: {2} Nothing was removed and nothing was changed. Run the install command again; if it stops here again, contact SecurityInsight support with this message.' -f $what, $shape, [string]$_.Exception.Message) }
|            if ($use.Count) {
|                throw ('{0} is {1}, but this install is private: it must be internal in your virtual network, and Azure cannot convert an environment. It holds {2}, so it is NOT removed. The plan (Invardia support runs it through the Support app; it shows each step first): 1. create the internal environment {3} in the subnet {4}; 2. move every job and app into it (setup\Set-SIPrivateNetworking.ps1 -Steps private-environment,move-jobs,move-apps); 3. remove the empty old environment. Nothing was removed and nothing was changed.' -f $what, $shape, ($use -join ', '), (Get-SIPrivateEnvironmentNameHint), $InfrastructureSubnetId)
|            }
|            Write-Host ('       {0} is {1} ({2}) and holds nothing, but this install is private -- Azure cannot convert an environment, so it is removed and created internal in your virtual network ...' -f $what, $shape, $(if ($prd.State) { $prd.State } else { 'no state' })) -ForegroundColor DarkYellow
|            try { Remove-SIManagedEnvironment -ResourceGroupName $ResourceGroupName -Name $Name -SubscriptionId $sub -Sleep $Sleep }
|            catch { throw ('{0} ({1}, empty) could not be removed: {2} Nothing else was changed. Run the install command again in a few minutes; it removes the empty environment and creates it internal in your virtual network.' -f $what, $shape, [string]$_.Exception.Message) }
|            Write-Host '       Removed.'
|            # the install records this line (Invoke-SIInstallBootstrap -> the step's facts): what was replaced, and why
|            Write-Host ('       ENVIRONMENT REPLACED: {0} was {1} and empty -- removed; it is created internal in your virtual network.' -f $Name, $shape)
|            $script:SIManagedEnvironmentReplaced = [pscustomobject]@{ Name = $Name; Was = $shape; State = [string]$prd.State; AtUtc = [DateTime]::UtcNow.ToString('o') }
|        }
|        $cae = $null
|    }
|    if ($cae) {
|        $rd = Get-SIArmReadiness -Path $path -Resource $cae
|        if ($rd.Ready) { return $cae }
|        if (-not $rd.Failed -and [string]$rd.State -match '(?i)delet') {
|            Write-Host ('       {0} is being removed by Azure ({1}) -- waiting until it is gone (this takes minutes), then it is created again ...' -f $what, $rd.State) -ForegroundColor DarkYellow
|            $null = Wait-SIArmResourceGone -Path $path -ApiVersion '2025-07-01' -TimeoutSec 1800 -PollSec 15 -Sleep $Sleep -What $what
|            $cae = $null; $again = $true
|        } elseif (-not $rd.Failed) {
|            Write-Host ('       {0} is still being made by Azure ({1}) -- waiting for it (this can take up to 30 minutes); a second one is not created ...' -f $what, $(if ($rd.State) { $rd.State } else { 'no state yet' })) -ForegroundColor DarkYellow
|            $waitError = $null
|            try { $ready = Wait-SIArmResourceReady -Path $path -ApiVersion '2025-07-01' -TimeoutSec 1800 -PollSec 15 -Sleep $Sleep -What $what } catch { $waitError = $_ }
|            if (-not $waitError) { return $ready }
|            # it did not get ready: only an environment Azure now shows as Failed goes on to the removal below
|            $cae = Get-SIManagedEnvironment -ResourceGroupName $ResourceGroupName -Name $Name -SubscriptionId $sub
|            $rd = Get-SIArmReadiness -Path $path -Resource $cae
|            if (-not $cae -or -not $rd.Failed) { throw $waitError }
|        }
|        if ($cae) {
|            $why = $(if ($rd.Why) { ([string]$rd.Why).TrimEnd('.', ' ') } else { 'Azure gives no reason on the resource' })
|            $inUse = @()
|            try { $inUse = @(Get-SIManagedEnvironmentUse -ResourceGroupName $ResourceGroupName -EnvironmentId ([string]$cae.id) -SubscriptionId $sub) }
|            catch { throw ('{0} was left {1} by Azure ({2}). It is removed and created again only when it holds nothing, and what it holds could not be read: {3} Nothing was removed and nothing was changed. Run the same command again; if it stops here again, contact SecurityInsight support with this message.' -f $what, $rd.State, $why, [string]$_.Exception.Message) }
|            if ($inUse.Count) {
|                throw ('{0} was left {1} by Azure ({2}). Azure does not repair such an environment by itself; it has to be removed and created again -- but it is NOT empty: it holds {3}, and removing it would take them with it. Nothing was removed and nothing was changed. Contact SecurityInsight support with this message.' -f $what, $rd.State, $why, ($inUse -join ', '))
|            }
|            Write-Host ('       {0} was left {1} by Azure ({2}) -- it holds nothing, so it is removed and created again.' -f $what, $rd.State, $why) -ForegroundColor DarkYellow
|            Write-Host '       Removing it -- Azure takes several minutes for this; waiting until it is gone (up to 30 minutes) ...'
|            try { Remove-SIManagedEnvironment -ResourceGroupName $ResourceGroupName -Name $Name -SubscriptionId $sub -Sleep $Sleep }
|            catch { throw ('{0} was left {1} by Azure ({2}) and could not be removed: {3} Nothing else was changed. Run the same command again later; if it stops here again, contact SecurityInsight support with this message.' -f $what, $rd.State, $why, [string]$_.Exception.Message) }
|            Write-Host '       Removed.'
|            $again = $true
|        }
|    }
|    # framework installer rule 11b: console text names what is made as it is -- no cost figure
|    $kindText = if ("$InfrastructureSubnetId".Trim()) { $(if ($Internal) { 'internal, in your virtual network' } else { 'in your virtual network' }) } else { 'workload profiles' }
|    Write-Host ('       Creating the Container Apps environment {0}{1} ({2}) ...' -f $Name, $(if ($again) { ' again' } else { '' }), $kindText)
|    $createError = $null; $new = $null
|    try { $new = New-SIManagedEnvironment -ResourceGroupName $ResourceGroupName -Name $Name -Location $Location -SubscriptionId $sub -Sleep $Sleep -InfrastructureSubnetId $InfrastructureSubnetId -Internal:$Internal } catch { $createError = $_ }
|    if (-not $createError) { return $new }
|    # what did Azure leave? Only an environment it shows as Failed gets the plain sentence; anything else keeps its own error
|    $left = $null; try { $left = Get-SIManagedEnvironment -ResourceGroupName $ResourceGroupName -Name $Name -SubscriptionId $sub } catch { $left = $null }
|    $lrd = Get-SIArmReadiness -Path $path -Resource $left
|    if (-not $left -or -not $lrd.Failed) { throw $createError }
|    $lwhy = $(if ($lrd.Why) { ([string]$lrd.Why).TrimEnd('.', ' ') } else { 'Azure gives no reason on the resource -- see the activity log of the resource group' })
|    # only Azure's own "could not make the cluster, retry later" is called what it is; any other reason stands as Azure gave it
|    $cause = if ($lwhy -match '(?i)ManagedEnvironmentProvisioningError|retry later|managed cluster|capacity') {
|        (' This is Azure''s own capacity in the region {0} at the moment -- nothing in this install is wrong and nothing has to be changed.' -f $Location)
|    } else { '' }
|    if ($again) {
|        throw ('Azure could not make {0} this time either: {1}.{2} The failed environment holds nothing and is removed by the next run. Wait -- an hour is a good first wait -- and run the same command again; it continues from this step. If it still fails after several tries, contact SecurityInsight support with this message.' -f $what, $lwhy, $cause)
|    }
|    throw ('Azure could not make {0}: {1}.{2} Wait a while (15 minutes or more) and run the same command again: it removes the failed environment, which holds nothing, and creates it again.' -f $what, $lwhy, $cause)
|}
|
|function Set-SIEnvironmentLogSetting {
|    <# #220: the diagnostic setting that sends the environment's console + system logs to the SI workspace (idempotent PUT). #>
|    param([Parameter(Mandatory)][string]$EnvironmentId, [Parameter(Mandatory)][string]$WorkspaceResourceId)
|    $body = Get-SIEnvironmentLogSettingBody -WorkspaceResourceId $WorkspaceResourceId
|    $null = Invoke-SIArm -Method PUT -Path ($EnvironmentId.TrimEnd('/') + '/providers/Microsoft.Insights/diagnosticSettings/si-environment-logs') -ApiVersion '2021-05-01-preview' -Body $body
|}
|
|# =====================================================================================================================
|#  Container registry
|# =====================================================================================================================
|
|function Get-SIContainerRegistry {
|    <# `az acr show`: the registry as ARM returns it (id, properties.loginServer); $null when it does not exist. Adds
|       loginServer at the top, as az did. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $r = Invoke-SIArm -Path (Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.ContainerRegistry/registries' $Name) -ApiVersion $script:SIAcrArmApi -AllowNotFound
|    if ($r -and -not $r.PSObject.Properties['loginServer']) { $r | Add-Member -NotePropertyName loginServer -NotePropertyValue ([string](Get-SISetupArmProp $r @('properties', 'loginServer'))) }
|    $r
|}
|
|function New-SIContainerRegistry {
|    <# `az acr create --sku Basic --admin-enabled true`: PUT, waits until provisioned, returns Get-SIContainerRegistry. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$Location,
|          [string]$Sku = 'Basic', [bool]$AdminEnabled = $true, [string]$SubscriptionId, [scriptblock]$Sleep)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $path = Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.ContainerRegistry/registries' $Name
|    $null = Invoke-SIArm -Method PUT -Path $path -ApiVersion $script:SIAcrArmApi -Body ([ordered]@{ location = $Location; sku = @{ name = $Sku }; properties = @{ adminUserEnabled = $AdminEnabled } })
|    $null = Wait-SIArmResourceReady -Path $path -ApiVersion '2023-07-01' -TimeoutSec 900 -PollSec 5 -Sleep $Sleep -What ('the container registry {0}' -f $Name)
|    Get-SIContainerRegistry -ResourceGroupName $ResourceGroupName -Name $Name -SubscriptionId $sub
|}
|
|function Test-SIContainerRegistryName {
|    <# `az acr check-name`: @{ nameAvailable; reason; message }. #>
|    param([Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    Invoke-SIArm -Method POST -Path ("/subscriptions/$sub/providers/Microsoft.ContainerRegistry/checkNameAvailability") -ApiVersion $script:SIAcrArmApi `
|        -Body @{ name = $Name; type = 'Microsoft.ContainerRegistry/registries' }
|}
|
|function Get-SIContainerRegistryCredential {
|    <# `az acr credential show`: @{ username; passwords = @(@{ name; value }) } -- $null when admin access is disabled. #>
|    param([Parameter(Mandatory)][string]$RegistryId)
|    try { Invoke-SIArm -Method POST -Path ($RegistryId.TrimEnd('/') + '/listCredentials') -ApiVersion $script:SIAcrArmApi } catch { $null }
|}
|
|# =====================================================================================================================
|#  Key Vault, storage, resource group
|# =====================================================================================================================
|
|function Get-SIKeyVaultArm {
|    <# `az keyvault show --name` (no resource group): the vault as ARM returns it (id, properties.vaultUri), found in the
|       subscription; $null when not found or not readable. #>
|    param([Parameter(Mandatory)][string]$Name, [string]$ResourceGroupName, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    try {
|        if ($ResourceGroupName) { return (Invoke-SIArm -Path (Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.KeyVault/vaults' $Name) -ApiVersion $script:SIKvArmApi -AllowNotFound) }
|        foreach ($v in @(Invoke-SIArm -Path "/subscriptions/$sub/providers/Microsoft.KeyVault/vaults" -ApiVersion $script:SIKvArmApi -List)) {
|            if ([string]$v.name -eq $Name) {
|                # the list carries no vaultUri on every api version: read the vault itself
|                return (Invoke-SIArm -Path ([string]$v.id) -ApiVersion $script:SIKvArmApi -AllowNotFound)
|            }
|        }
|    } catch { return $null }
|    $null
|}
|
|function Get-SIKeyVaultSecretNames {
|    <# `az keyvault secret list --query [].name`: the secret NAMES a vault holds (never a value), every page. $null = they
|       could not be read from here (no data-plane right, the vault not reachable). #>
|    param([Parameter(Mandatory)][string]$VaultName)
|    $names = New-Object System.Collections.Generic.List[string]
|    $next = 'https://{0}.vault.azure.net/secrets?api-version={1}&maxresults=25' -f $VaultName, $script:SIKvDataApi
|    try {
|        while ($next) {
|            $r = Invoke-SIAzRestRequest -Method GET -Uri $next -Audience KeyVault -What ("Listing the secrets of Key Vault '{0}'" -f $VaultName)
|            $j = $r.Content | ConvertFrom-Json
|            foreach ($s in @($j.value)) { if ($s -and $s.id) { $names.Add(([string]$s.id).TrimEnd('/').Split('/')[-1]) } }
|            $next = [string]$j.nextLink
|        }
|    } catch { return $null }
|    , $names.ToArray()
|}
|
|function Set-SIKeyVaultSecretText {
|    <# `az keyvault secret set --file <f> --encoding utf-8 [--content-type]`: one secret, its value as plain text. #>
|    param([Parameter(Mandatory)][string]$VaultName, [Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][AllowEmptyString()][string]$Value, [string]$ContentType)
|    $body = [ordered]@{ value = $Value }
|    if ($ContentType) { $body.contentType = $ContentType }
|    $uri = 'https://{0}.vault.azure.net/secrets/{1}?api-version={2}' -f $VaultName, [uri]::EscapeDataString($Name), $script:SIKvDataApi
|    $r = Invoke-SIAzRestRequest -Method PUT -Uri $uri -Audience KeyVault -Body ($body | ConvertTo-Json -Compress) -What ("Writing secret '{0}' to Key Vault '{1}'" -f $Name, $VaultName)
|    $r.Content | ConvertFrom-Json
|}
|
|function Get-SIStorageAccountArm {
|    <# `az storage account show --name`: the account as ARM returns it (id); $null when not found. #>
|    param([Parameter(Mandatory)][string]$Name, [string]$ResourceGroupName, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    if ($ResourceGroupName) { return (Invoke-SIArm -Path (Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.Storage/storageAccounts' $Name) -ApiVersion $script:SIStorageArmApi -AllowNotFound) }
|    foreach ($s in @(Invoke-SIArm -Path "/subscriptions/$sub/providers/Microsoft.Storage/storageAccounts" -ApiVersion $script:SIStorageArmApi -List)) {
|        if ([string]$s.name -eq $Name) { return $s }
|    }
|    $null
|}
|
|function Get-SIResourceGroupArm {
|    <# `az group show`: the resource group (id, location); $null when it does not exist. #>
|    param([Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    Invoke-SIArm -Path "/subscriptions/$sub/resourcegroups/$Name" -ApiVersion '2021-04-01' -AllowNotFound
|}
|
|# =====================================================================================================================
|#  Role assignments
|# =====================================================================================================================
|
|function Test-SIScopeCovers {
|    <# PURE. Does an assignment at -AssignedScope apply at -Scope (the same scope, or one above it)? #>
|    param([string]$AssignedScope, [string]$Scope)
|    $a = ([string]$AssignedScope).TrimEnd('/').ToLowerInvariant(); $s = ([string]$Scope).TrimEnd('/').ToLowerInvariant()
|    ($a -eq '' -or $a -eq '/' -or $s -eq $a -or $s.StartsWith($a + '/'))
|}
|
|function Test-SIRoleAssignmentPresent {
|    <# `az role assignment list --assignee <oid> --scope <s> --role <r>` is not empty: does -ObjectId hold
|       -RoleDefinitionName (directly) at -Scope or above? #>
|    param([Parameter(Mandatory)][string]$ObjectId, [Parameter(Mandatory)][string]$Scope, [Parameter(Mandatory)][string]$RoleDefinitionName)
|    $subScope = if ($Scope -match '^(/subscriptions/[^/]+)') { $Matches[1] } else { $Scope }
|    $def = @(Get-SIAzRestRoleDefinitions -Scope $subScope | Where-Object { [string]$_.properties.roleName -eq $RoleDefinitionName }) | Select-Object -First 1
|    if (-not $def) { return $false }
|    $rid = ([string]$def.name).ToLowerInvariant()
|    $path = $Scope.TrimEnd('/') + '/providers/Microsoft.Authorization/roleAssignments?$filter=' + [uri]::EscapeDataString(("principalId eq '{0}'" -f $ObjectId))
|    foreach ($a in @(Invoke-SIArm -Path $path -ApiVersion '2022-04-01' -List)) {
|        if ((([string]$a.properties.roleDefinitionId) -split '/')[-1].ToLowerInvariant() -ne $rid) { continue }
|        if (Test-SIScopeCovers -AssignedScope ([string]$a.properties.scope) -Scope $Scope) { return $true }
|    }
|    $false
|}
|
|function Resolve-SIPrincipalObjectId {
|    <# `az role assignment create --assignee <appId>`: the object id of a service principal named by its app (client) id;
|       a value that is already an object id of one is returned as it is. Graph. #>
|    param([Parameter(Mandatory)][string]$Id)
|    $r = Invoke-SIAzRestRequest -Method GET -Uri ("https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appId eq '{0}'&`$select=id" -f $Id) -Audience Graph -What 'Finding the service principal'
|    $sp = @(($r.Content | ConvertFrom-Json).value)[0]
|    if ($sp -and $sp.id) { return [string]$sp.id }
|    $Id
|}
|
|# =====================================================================================================================
|#  Azure SQL (Pro database)
|# =====================================================================================================================
|
|function Get-SISqlServerEntraOnlyBody {
|    <# PURE. A new Azure SQL server with Entra-only sign-in from the first second (`az sql server create --enable-ad-only-auth
|       --external-admin-principal-type/-name/-sid`). #>
|    param([Parameter(Mandatory)][string]$Location, [Parameter(Mandatory)][string]$AdminName, [Parameter(Mandatory)][string]$AdminSid,
|          [ValidateSet('User', 'Group', 'Application')][string]$AdminType = 'User', [string]$TenantId,
|          # #866 (a private install; owner: "we will not allow fw option or exceptions"): 'Disabled' CREATES the server with
|          # no public access -- only its private endpoint, which setup makes right after it
|          [ValidateSet('Enabled', 'Disabled')][string]$PublicNetworkAccess = 'Enabled')
|    $adm = [ordered]@{ administratorType = 'ActiveDirectory'; principalType = $AdminType; login = $AdminName; sid = $AdminSid; azureADOnlyAuthentication = $true }
|    if ($TenantId) { $adm.tenantId = $TenantId }
|    [ordered]@{ location = $Location; properties = [ordered]@{ version = '12.0'; minimalTlsVersion = '1.2'; publicNetworkAccess = $PublicNetworkAccess; administrators = $adm } }
|}
|
|function New-SISqlServerEntraOnly {
|    <# `az sql server create --enable-ad-only-auth ...`: PUT, waits until it is ready. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$Location,
|          [Parameter(Mandatory)][string]$AdminName, [Parameter(Mandatory)][string]$AdminSid, [ValidateSet('User', 'Group', 'Application')][string]$AdminType = 'User',
|          [string]$SubscriptionId, [scriptblock]$Sleep, [ValidateSet('Enabled', 'Disabled')][string]$PublicNetworkAccess = 'Enabled')
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $path = Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.Sql/servers' $Name
|    $tid = $null; try { $tid = Get-SIAzRestTenantId } catch { }
|    # A create is NEVER sent over a server that exists (it would make the installer its administrator again): only when
|    # Azure says "not found" twice. A read that fails for another reason throws (Test-SIArmResourceAbsent).
|    $absent = Test-SIArmResourceAbsent -Path $path -ApiVersion '2021-11-01' -Sleep $Sleep
|    if ($absent) {
|        $null = Invoke-SIArm -Method PUT -Path $path -ApiVersion '2021-11-01' -Body (Get-SISqlServerEntraOnlyBody -Location $Location -AdminName $AdminName -AdminSid $AdminSid -AdminType $AdminType -TenantId $tid -PublicNetworkAccess $PublicNetworkAccess)
|    }
|    # until the server IS there and Ready -- its databases are sent right after this returns; not Ready in time THROWS
|    $srv = Wait-SIArmResourceReady -Path $path -ApiVersion '2021-11-01' -TimeoutSec 1800 -PollSec 10 -Sleep $Sleep -What ('the database server {0}' -f $Name)
|    $srv | Add-Member -NotePropertyName SIExisted -NotePropertyValue (-not $absent) -Force
|    $srv
|}
|
|function Get-SISqlServerEntraAdmin {
|    <# The server's Entra administrator as ARM has it on the server itself: @{ Sid; Login; PrincipalType }. $null = NONE IS
|       SET. A server that cannot be read THROWS -- "could not read" is never "none set". #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $srv = Invoke-SIArm -Method GET -Path (Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.Sql/servers' $Name) -ApiVersion '2021-11-01'
|    if (-not $srv) { throw ('the database server {0} could not be read (Azure returned nothing)' -f $Name) }
|    $a = Get-SISetupArmProp $srv @('properties', 'administrators')
|    if (-not $a -or -not [string](Get-SISetupArmProp $a @('sid'))) { return $null }
|    [pscustomobject]@{ Sid = [string](Get-SISetupArmProp $a @('sid')); Login = [string](Get-SISetupArmProp $a @('login')); PrincipalType = [string](Get-SISetupArmProp $a @('principalType')) }
|}
|
|function Get-SISqlServerEntraAdminPatchBody {
|    <# PURE. The PATCH of the SERVER that sets its Entra administrator WITH its kind (the administrators sub-resource has
|       no field for the kind, so a change through it left "Group" on a server whose administrator was an application). #>
|    param([Parameter(Mandatory)][string]$AdminName, [Parameter(Mandatory)][string]$AdminSid,
|          [Parameter(Mandatory)][ValidateSet('User', 'Group', 'Application')][string]$AdminType, [string]$TenantId,
|          # the server's OWN "Entra-only sign-in" setting, sent back as it is: the administrators block is written whole,
|          # and one that leaves it out could switch it off. $null = not known = left out (never guessed).
|          [AllowNull()]$EntraOnly)
|    $adm = [ordered]@{ administratorType = 'ActiveDirectory'; principalType = $AdminType; login = $AdminName; sid = $AdminSid }
|    if ($TenantId) { $adm.tenantId = [string]$TenantId }
|    if ($null -ne $EntraOnly) { $adm.azureADOnlyAuthentication = [bool]$EntraOnly }
|    [ordered]@{ properties = [ordered]@{ administrators = $adm } }
|}
|
|function Set-SISqlServerEntraAdmin {
|    <# Makes -AdminSid (a person's or group's object id; an application's CLIENT id) the server's Entra administrator, AS
|       -AdminType (User / Group / Application), through a PATCH of the server, and waits until the server shows that sid
|       AND that kind. Throws when it does not change. Returns @{ Sid; Login; PrincipalType }. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$AdminName,
|          [Parameter(Mandatory)][string]$AdminSid, [ValidateSet('User', 'Group', 'Application')][string]$AdminType = 'Application',
|          [string]$SubscriptionId, [scriptblock]$Sleep)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $path = Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.Sql/servers' $Name
|    $tid = $null; try { $tid = Get-SIAzRestTenantId } catch { }
|    # THE SERVER IS READ FIRST: its "Entra-only sign-in" setting goes back in the same block exactly as it is. A server
|    # that cannot be read is NOT changed (throws) -- the setting is never written blind.
|    $srv = Invoke-SIArm -Method GET -Path $path -ApiVersion '2021-11-01'
|    if (-not $srv) { throw ('the database server {0} could not be read (Azure returned nothing) -- its administrator was not changed' -f $Name) }
|    $only = Get-SISetupArmProp $srv @('properties', 'administrators', 'azureADOnlyAuthentication')
|    $onlyBefore = $(if ($null -ne $only -and "$only" -ne '') { [bool]$only } else { $null })
|    $null = Invoke-SIArm -Method PATCH -Path $path -ApiVersion '2021-11-01' -Body (Get-SISqlServerEntraAdminPatchBody -AdminName $AdminName -AdminSid $AdminSid -AdminType $AdminType -TenantId $tid -EntraOnly $onlyBefore)
|    $now = $null
|    $since = [datetime]::UtcNow
|    for ($i = 1; $i -le 36; $i++) {
|        if ($i -gt 1) { Send-SISetupWaitProgress -What ('the database server {0} to take its new administrator' -f $Name) -SinceUtc $since }   # #876
|        try { $now = Get-SISqlServerEntraAdmin -ResourceGroupName $ResourceGroupName -Name $Name -SubscriptionId $sub } catch { $now = $null }
|        if ($now -and [string]$now.Sid -ieq $AdminSid -and [string]$now.PrincipalType -ieq $AdminType) { return $now }
|        if ($Sleep) { & $Sleep 5 } else { Start-Sleep -Seconds 5 }
|    }
|    throw ("the Entra administrator of the database server {0} did not change to {1} as {2} (Azure shows: {3})" -f $Name, $AdminName, $AdminType,
|        $(if ($now) { '{0} as {1}' -f $now.Login, $now.PrincipalType } else { 'none, or the server could not be read' }))
|}
|
|function Set-SISqlFirewallRule {
|    <# `az sql server firewall-rule create` (idempotent PUT). 0.0.0.0-0.0.0.0 = Azure services. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$ServerName, [Parameter(Mandatory)][string]$Name,
|          [string]$StartIpAddress = '0.0.0.0', [string]$EndIpAddress = '0.0.0.0', [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    Invoke-SIArm -Method PUT -Path ((Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.Sql/servers' $ServerName) + '/firewallRules/' + $Name) -ApiVersion $script:SISqlArmApi `
|        -Body @{ properties = @{ startIpAddress = $StartIpAddress; endIpAddress = $EndIpAddress } }
|}
|
|function Get-SISqlFirewallRule {
|    <# One firewall rule of an Azure SQL server (properties.startIpAddress / endIpAddress); $null when it does not exist. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$ServerName, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    Invoke-SIArm -Path ((Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.Sql/servers' $ServerName) + '/firewallRules/' + $Name) -ApiVersion $script:SISqlArmApi -AllowNotFound
|}
|
|function Remove-SISqlFirewallRule {
|    <# Deletes one firewall rule of an Azure SQL server. Absent = nothing to do. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$ServerName, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $null = Invoke-SIArm -Method DELETE -Path ((Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.Sql/servers' $ServerName) + '/firewallRules/' + $Name) -ApiVersion $script:SISqlArmApi -AllowNotFound
|}
|
|function Get-SISqlServerNetworkShape {
|    <# #1091: how an Azure SQL server is reached, as ARM shows it -- for the end-of-install check of a PRIVATE install.
|       [pscustomobject]@{ PublicNetworkAccess = 'Enabled' | 'Disabled' | ''; PrivateEndpoints = @( @{ Id; Status } ) }
|       (Status = the connection's privateLinkServiceConnectionState, e.g. 'Approved'). $null when the server is not there;
|       a read that fails THROWS -- "could not read" is never "not private". #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$ServerName, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $s = Invoke-SIArm -Path (Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.Sql/servers' $ServerName) -ApiVersion '2021-11-01' -AllowNotFound
|    if (-not $s) { return $null }
|    $pes = @(@(Get-SISetupArmProp $s @('properties', 'privateEndpointConnections')) | Where-Object { $_ } | ForEach-Object {
|            [pscustomobject]@{ Id = [string](Get-SISetupArmProp $_ @('properties', 'privateEndpoint', 'id'))
|                               Status = [string](Get-SISetupArmProp $_ @('properties', 'privateLinkServiceConnectionState', 'status')) } })
|    [pscustomobject]@{ PublicNetworkAccess = [string](Get-SISetupArmProp $s @('properties', 'publicNetworkAccess')); PrivateEndpoints = $pes }
|}
|
|function Test-SISqlServerPrivate {
|    <# #1099 (framework rule 11e): is this Azure SQL server a PRIVATE install's -- its public network access anything but
|       'Enabled' (Disabled; SecuredByPerimeter)? Support and ops tooling ask this BEFORE any firewall-rule write: on a
|       private install support never opens a resource to get in, not even for a moment. Reads the server (ARM GET, through
|       Get-SISqlServerNetworkShape). A server that is not there, or a read that fails, THROWS -- "could not read" is never
|       "public", so nothing is opened then either. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$ServerName, [string]$SubscriptionId)
|    $shape = Get-SISqlServerNetworkShape -ResourceGroupName $ResourceGroupName -ServerName $ServerName -SubscriptionId $SubscriptionId
|    if ($null -eq $shape) { throw ('the database server {0} could not be found -- nothing was opened' -f $ServerName) }
|    $pna = ([string]$shape.PublicNetworkAccess).Trim()
|    # an empty value is a server made before the setting existed: public
|    -not ($pna -eq '' -or $pna -ieq 'Enabled')
|}
|
|function Get-SISqlPrivateNoOpenText {
|    <# PURE. #1099: the one sentence support / ops tooling says when it meets a private install's database (rule 11e).
|       -InNetwork names the install's own in-network way to do the same thing, when there is one. #>
|    param([Parameter(Mandatory)][string]$ServerName, [string]$InNetwork)
|    'this install is private: its database {0} is reached only from inside its network -- framework rule 11e; nothing was opened. Run this through the install''s own job / as a customer step{1}' -f `
|        $ServerName, $(if ($InNetwork) { ' (' + $InNetwork + ')' } else { '' })
|}
|
|function Test-SISqlDatabasePresent {
|    <# Is this database on the server? $true / $false ("not found"). Any other failure of the read THROWS -- "could not
|       read" is never "not there". (The end-of-install check.) #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$ServerName, [Parameter(Mandatory)][string]$DatabaseName, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    [bool](Invoke-SIArm -Path ((Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.Sql/servers' $ServerName) + '/databases/' + $DatabaseName) -ApiVersion '2021-11-01' -AllowNotFound)
|}
|
|function Get-SISqlDatabaseCreateBody {
|    <# PURE. A new database at -Target (Get-SISqlDatabaseTier: Name / Tier / Capacity / MaxSizeBytes), local backup
|       redundancy -- what `az sql db create --service-objective --max-size --backup-storage-redundancy Local` sent. #>
|    param([Parameter(Mandatory)][string]$Location, [Parameter(Mandatory)]$Target)
|    $sku = [ordered]@{ name = [string]$Target.Name }
|    if ([string]$Target.Tier) { $sku.tier = [string]$Target.Tier }
|    if ([int]$Target.Capacity -gt 0) { $sku.capacity = [int]$Target.Capacity }
|    $props = [ordered]@{ requestedBackupStorageRedundancy = 'Local' }
|    if ([long]$Target.MaxSizeBytes -gt 0) { $props.maxSizeBytes = [long]$Target.MaxSizeBytes }
|    [ordered]@{ location = $Location; sku = $sku; properties = $props }
|}
|
|function New-SISqlDatabaseArm {
|    <# `az sql db create`: PUT at -Target's size, waits until it is online. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$ServerName, [Parameter(Mandatory)][string]$Name,
|          [Parameter(Mandatory)]$Target, [string]$Location, [string]$SubscriptionId, [scriptblock]$Sleep)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $srvPath = Get-SISetupArmPath $sub $ResourceGroupName 'Microsoft.Sql/servers' $ServerName
|    if (-not $Location) { $Location = [string](Invoke-SIArm -Path $srvPath -ApiVersion $script:SISqlArmApi).location }
|    $path = $srvPath + '/databases/' + $Name
|    $body = Get-SISqlDatabaseCreateBody -Location $Location -Target $Target
|    # A create is NEVER sent over a database that exists -- it carries a size, and would lower one the customer raised.
|    # Only when Azure says "not found" TWICE (a database being resized can answer 404 for a few seconds); a read that
|    # fails for another reason throws. One that is there is waited for until it is online, and returned as it is.
|    if (-not (Test-SIArmResourceAbsent -Path $path -ApiVersion '2021-11-01' -Sleep $Sleep)) {
|        $have = Wait-SIArmResourceReady -Path $path -ApiVersion '2021-11-01' -TimeoutSec 1800 -PollSec 10 -Sleep $Sleep -What ('the database {0}' -f $Name)
|        $have | Add-Member -NotePropertyName SIExisted -NotePropertyValue $true -Force
|        return $have
|    }
|    # a database create is ACCEPTED and made afterwards; Azure can still reject it then (a server not ready yet).
|    # So: wait until the database EXISTS and is Online; when it is still not there after two minutes the request was
|    # lost or rejected -- it is sent again (three times at most); never "created" on the accepted request alone.
|    $deadline = (Get-Date).AddSeconds(1800)
|    for ($send = 1; $send -le 3; $send++) {
|        try { $null = Invoke-SIArm -Method PUT -Path $path -ApiVersion '2021-11-01' -Body $body }
|        catch {
|            # sent AGAIN while Azure still makes the first one: a conflict then means "being made" -- keep waiting for it
|            if ($send -eq 1 -or "$($_.Exception.Message)" -notmatch '(?i)HTTP Status: 409\b|Conflict|OperationInProgress|in progress') { throw }
|        }
|        $until = (Get-Date).AddSeconds(120)
|        $polls = 0
|        while ($true) {
|            $db = Invoke-SIArm -Path $path -ApiVersion '2021-11-01' -AllowNotFound
|            if ($polls -gt 0) { Send-SISetupWaitProgress -What ('the database {0} to come online' -f $Name) -State $(if ($db) { [string](Get-SISetupArmProp $db @('properties', 'status')) } else { 'not there yet' }) }   # #876
|            if ($db -and [string](Get-SISetupArmProp $db @('properties', 'status')) -eq 'Online') {
|                $db | Add-Member -NotePropertyName SIExisted -NotePropertyValue $false -Force
|                return $db
|            }
|            $polls++
|            if (-not $db -and ((Get-Date) -ge $until -or $polls -ge 12)) { break }                 # not there: send it again
|            if ((Get-Date) -ge $deadline -or $polls -ge 180) { throw ("the database {0} is not online {1} minutes after it was created (status '{2}')" -f $Name, 30, [string](Get-SISetupArmProp $db @('properties', 'status'))) }
|            if ($Sleep) { & $Sleep 10 } else { Start-Sleep -Seconds 10 }
|        }
|    }
|    throw ("Azure accepted the request to create the database {0} three times and did not create it -- see the activity log of the resource group for its reason" -f $Name)
|}
|
|# =====================================================================================================================
|#  The image build (az acr build) -- phase 1's REST ACR build, ONE implementation for the updater and setup
|# =====================================================================================================================
|
|function Invoke-SIAcrRestBuild {
|    <#
|        `az acr build --registry <acr> --image <name:tag> --file <Dockerfile> <folder>` over REST, as setup's own sign-in:
|        a thin wrapper over setup\_shared\SI-AcrBuild.ps1 (#521 phase 1 -- packs the folder with the .dockerignore honoured,
|        uploads it to the registry's SAS without a bearer token, schedules the build, image names registry-relative) through
|        the REST seam of setup\_shared\SI-UpdateRest.ps1 (New-SIUpdateRestSeam: every token from Get-SIAzureToken, i.e. the
|        person / support session / app setup signed in as). Polls the run to its end unless -NoWait.
|        Framework rule 11g: the build runs inside a build-pool session (setup\_shared\SI-AcrBuildPool.ps1) -- a private
|        install's agent pool is scaled up just before the build (read back) and back to 0 agents in a FINALLY, after a
|        success, a failed or a timed-out build (read back); a caller that holds a session already keeps the pool up across
|        its builds. A scale-down that fails is said (BuildPoolOk = $false, BuildPoolLine) and never changes Ok / Status.
|        Returns @{ Ok; Status; RunId; Seconds; Bytes; Files; Images; BuildPoolOk; BuildPoolLine }.
|    #>
|    param([Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup, [Parameter(Mandatory)][string]$RegistryName,
|          [Parameter(Mandatory)][string]$SourcePath, [Parameter(Mandatory)][string[]]$ImageNames, [Parameter(Mandatory)][string]$DockerFilePath,
|          [int]$TimeoutSeconds = 1800, [switch]$NoWait, [scriptblock]$OnPoll, [scriptblock]$Sleep, [scriptblock]$Rest, [int]$PollSeconds = 15,
|          # framework installer rule 11b: the registry's agent pool in the network ('' = the registry decides, Resolve-SIAcrAgentPool)
|          [string]$AgentPoolName = '')
|    if (-not (Get-Command -Name Invoke-SIAcrQueueBuild -ErrorAction Ignore)) { . (Join-Path $PSScriptRoot 'SI-AcrBuild.ps1') }
|    if (-not (Get-Command -Name Open-SIBuildPoolSession -ErrorAction Ignore) -and (Test-Path -LiteralPath (Join-Path $PSScriptRoot 'SI-AcrBuildPool.ps1'))) { . (Join-Path $PSScriptRoot 'SI-AcrBuildPool.ps1') }
|    if (-not $Rest) { $Rest = New-SIUpdateRestSeam }
|    # -NoWait hands the run to the caller: the pool is left to the caller's own session (never scaled down under a queued build)
|    $pooled = (-not $NoWait) -and [bool](Get-Command -Name Open-SIBuildPoolSession -ErrorAction Ignore)
|    if ($pooled) { $null = Open-SIBuildPoolSession }
|    $out = $null; $pc = $null
|    try {
|        # rule 11g: a build on the agent pool scales it up first (Invoke-SIAcrQueueBuild); the build's own wait starts once it is queued
|        $q = Invoke-SIAcrQueueBuild -Rest $Rest -SubscriptionId $SubscriptionId -AcrName $RegistryName -ResourceGroup $ResourceGroup `
|                -ContextPath $SourcePath -Image (@($ImageNames)[0]) -DockerfilePath $DockerFilePath -TimeoutSeconds $TimeoutSeconds -AgentPoolName $AgentPoolName
|        $started = Get-Date
|        if (-not $q.RunId) { throw ('The registry {0} accepted no build run for {1}.' -f $RegistryName, (@($ImageNames)[0])) }
|        $out = [ordered]@{ Ok = $true; Status = 'Queued'; RunId = [string]$q.RunId; Seconds = 0; Bytes = $q.Bytes; Files = $q.Files; Images = @($q.Image); BuildPoolOk = $true; BuildPoolLine = '' }
|        if (-not $NoWait) {
|            $deadline = $started.AddSeconds($TimeoutSeconds)
|            $status = 'Queued'
|            while ((Get-Date) -lt $deadline) {
|                $s = Get-SIAcrRunStatus -Rest $Rest -Registry $q.Registry -RunId $q.RunId
|                if ($s) { $status = $s }
|                if ($OnPoll) { try { & $OnPoll $status } catch { } }
|                Send-SISetupWaitProgress -What ('the container image build in the registry {0}' -f $RegistryName) -State $status -SinceUtc $started.ToUniversalTime()   # #876: at most once a minute
|                if (@('Succeeded', 'Failed', 'Canceled', 'Cancelled', 'Error', 'Timeout') -contains $status) { break }
|                if ($Sleep) { & $Sleep $PollSeconds } else { Start-Sleep -Seconds $PollSeconds }
|            }
|            $out.Status = $status; $out.Ok = ($status -eq 'Succeeded'); $out.Seconds = [int]((Get-Date) - $started).TotalSeconds
|        }
|    } finally {
|        # rule 11g: the pool back to 0 agents, read back -- after a success, a failed or timed-out build, or a throw
|        if ($pooled) {
|            $pc = Close-SIBuildPoolSession -Sleep $(if ($Sleep) { $Sleep } else { { param($x) Start-Sleep -Seconds $x } })
|            if ($pc.Line) { Write-Host ('       {0}{1}' -f $(if ($pc.Ok) { '' } else { 'WARNING: ' }), $pc.Line) }
|        }
|    }
|    if ($pc) { $out.BuildPoolOk = [bool]$pc.Ok; $out.BuildPoolLine = [string]$pc.Line }
|    [pscustomobject]$out
|}
|
|# =====================================================================================================================
|#  Microsoft Graph
|# =====================================================================================================================
|
|function Get-SITenantDirectoryCounts {
|    <# The tenant's size (Graph $count, ConsistencyLevel eventual): @{ Users; Groups; ServicePrincipals; Devices }, or $null
|       when it cannot be read (no directory read right). #>
|    $c = @{}
|    try {
|        foreach ($k in @(@{ N = 'Users'; P = 'users' }, @{ N = 'Groups'; P = 'groups' }, @{ N = 'ServicePrincipals'; P = 'servicePrincipals' }, @{ N = 'Devices'; P = 'devices' })) {
|            $r = Invoke-SIAzRestRequest -Method GET -Uri ('https://graph.microsoft.com/v1.0/{0}/$count' -f $k.P) -Audience Graph -Headers @{ ConsistencyLevel = 'eventual' } -What 'Microsoft Graph count'
|            $t = ([string]$r.Content).Trim().TrimStart([char]0xFEFF)
|            $n = 0L
|            if (-not [long]::TryParse($t, [ref]$n)) { return $null }
|            $c[$k.N] = $n
|        }
|    } catch { return $null }
|    $c
|}
'@ }
$__siSupportFiles['container/_shared/SI-ContainerConfig.ps1'] = @{ Sha256 = 'c1952b882e748a6fc52dca289b8acaaa0587aa512a1de57b99500b71ebd06106'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- how CONTAINER hosting receives its configuration (pure; no Azure, no network).
|
|    The container is deliberately its own configuration layer: it never loads config\SecurityInsight.custom.ps1
|    (the image must not carry a tenant's values; see Start-SIInContainer.ps1). Each setting arrived as one
|    hand-written env-var mapping, so ~45 of the settings a VM honours never reached a container at all
|    (2026-09-30 config review, #187), and neither did trend or the Pro engines (#170).
|
|    ONE GUARDED CHANNEL instead (#170/#187): Bootstrap-ContainerAppJob.ps1 passes named, NON-SECRET settings
|    from the customer's config as  SI_CFG_<GlobalName>=<value>  (JSON when the value is not a plain string);
|    the container restores each as $global:<GlobalName> with its type. Secrets never travel this way -- a
|    name that looks like one is refused on both ends -- and nothing here may override the credentials the
|    container's own env vars supply.
|
|    Also here, because each is a decision the entrypoints must make identically:
|      * AI: on only when Azure OpenAI is actually configured, and only if asked for (#184);
|      * sign-in (#209): managed identity > certificate (PFX from Key Vault) > client secret -- how a job signs
|        in (Resolve-SIContainerAuthMode), what Bootstrap gives each job for it (Get-SIContainerJobAuthArgs),
|        and the managed identity's required grants (Get-SIContainerIdentityGrantPlan).
|#>
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../../engine/_shared/SI-AzRest.ps1') }
|
|$script:SIConfigEnvPrefix = 'SI_CFG_'
|
|# Names the container's own env vars own. A passthrough value for any of these is ignored: the explicit
|# credential / target a Container App Job was given must never be overridden by a copied config value.
|$script:SIConfigProtected = @(
|    'SI_SPN_AppId', 'SI_SPN_Secret', 'SI_SPN_TenantId', 'SI_SPN_ObjectId',
|    # #209: the job's sign-in identity is decided by the container from its own env, never by a copied setting.
|    'SI_UseManagedIdentity', 'SI_UAMI_ClientId', 'SI_PreferUami', 'SI_SPN_CertStoreLocation',
|    'SI_StorageAccount',
|    'SI_WorkspaceResourceId', 'SI_DceName', 'SI_DcrResourceGroup',
|    'OpenAI_apiKey', 'OpenAI_endpoint', 'OpenAI_deployment', 'OpenAI_apiVersion',
|    'SI_License', 'SHODAN_ApiKey', 'SI_Shodan_ApiKey',
|    # The internal platform framework (FUNCTIONS\AutomateITPS) exists only on an internal VM -- never in a container.
|    # Live 2026-10-02: an internal install's AutomationFramework = $true travelled as SI_CFG_AutomationFramework and
|    # the tier classifier failed in the container looking for that module.
|    'AutomationFramework'
|)
|
|# Known NON-secret settings whose names happen to match the secret filter below (a token LIMIT, a tenant id). Exact names
|# only -- the filter stays broad for everything else, so a new name that looks like a credential is still refused.
|$script:SIConfigNotSecret = @('AI_MaxTokens', 'AI_MaxTokensPerRequest', 'OpenAI_MaxTokensPerRequest', 'SI_IdentityTokenTenantId')
|
|function Test-SIConfigNameIsSecret {
|    <# A name that holds a credential never travels as a plain env var. Deliberately broad; only the exact names in
|       $script:SIConfigNotSecret are let through. #>
|    param([Parameter(Mandatory)][string]$Name)
|    if ($script:SIConfigNotSecret -contains $Name) { return $false }
|    return ($Name -match '(?i)(secret|password|passwd|pwd|apikey|api_key|token|credential|connectionstring|sas|privatekey|pfx|thumbprint|storagekey|accountkey|license)')
|}
|
|function ConvertTo-SIConfigEnvValue {
|    <# PURE. A config value as an env-var string: plain strings as-is, everything else as compact JSON. #>
|    param([AllowNull()][object]$Value)
|    if ($null -eq $Value) { return 'null' }
|    if ($Value -is [string]) { return $Value }
|    if ($Value -is [bool]) { return $(if ($Value) { 'true' } else { 'false' }) }
|    return (ConvertTo-Json -InputObject $Value -Compress -Depth 6)
|}
|
|function ConvertFrom-SIConfigEnvValue {
|    <#
|      PURE. The inverse. JSON arrays/objects/numbers/booleans/null are decoded; anything else stays a string,
|      so a plain value such as 'westeurope' or '0 4 * * *' is never mangled.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    if ($null -eq $Text) { return $null }
|    $t = $Text.Trim()
|    if ($t -eq 'null') { return $null }
|    if ($t -eq 'true') { return $true }
|    if ($t -eq 'false') { return $false }
|    if ($t -match '^-?\d+$') { return [int64]$t }
|    if ($t -match '^-?\d+\.\d+$') { return [double]::Parse($t, [Globalization.CultureInfo]::InvariantCulture) }
|    if ($t.StartsWith('[') -or $t.StartsWith('{')) {
|        # A list of plain words (no quotes, no nesting) is read without ConvertFrom-Json: decoding it would throw, and even
|        # a caught throw writes a "TerminatingError(ConvertFrom-Json)" line into the run's transcript at every container
|        # start -- the line that then stood as the failure text of a step that failed for another reason. A list of JSON
|        # literals only (numbers, true / false / null) is valid JSON and still goes through ConvertFrom-Json.
|        if ($t -match '^\[\s*\]$') { return , @() }
|        if ($t -match '^\[\s*[^\[\]{}",]+(\s*,\s*[^\[\]{}",]+)*\s*\]$') {
|            $words = @($t.Substring(1, $t.Length - 2).Split(',') | ForEach-Object { $_.Trim() })
|            if (@($words | Where-Object { $_ -notmatch '^(-?\d+(\.\d+)?([eE][+-]?\d+)?|true|false|null)$' }).Count -gt 0) { return , $words }
|        }
|        try {
|            $v = ConvertFrom-Json -InputObject $t
|            if ($t.StartsWith('[')) { return , @($v) }
|            return $v
|        } catch {
|            # A list whose quotes were lost on the way: Bootstrap run on WINDOWS passes the job's environment through
|            # az.cmd, and its argument parsing drops the double quotes inside --env-vars, so ["LA","Excel"] arrives as
|            # [LA,Excel] (live 2026-10-06, Community rehearsal from the support host: every profiler wrote to "0/0
|            # sinks" -- nothing reached Log Analytics). A list of plain words is read back as that list.
|            if ($t -match '^\[\s*[^\[\]{}",]+(\s*,\s*[^\[\]{}",]+)*\s*\]$') {
|                return , @($t.Substring(1, $t.Length - 2).Split(',') | ForEach-Object { $_.Trim() })
|            }
|            if ($t -match '^\[\s*\]$') { return , @() }
|            return $Text
|        }
|    }
|    return $Text
|}
|
|function Get-SIConfigEnvArgs {
|    <#
|      PURE (Bootstrap side). For each requested global that the customer actually set, one
|      'SI_CFG_<Name>=<value>' env arg. Secret-looking and container-owned names are REFUSED and reported.
|      -Ignore: names skipped without a word -- settings that no longer exist (the settings catalog's "retired"
|      list), so a value left for one in a configuration is neither passed nor reported.
|      Returns @{ EnvArgs; Refused; Missing }.
|    #>
|    param(
|        [AllowEmptyCollection()][string[]]$Names = @(),
|        [Parameter(Mandatory)][hashtable]$Globals,
|        [AllowEmptyCollection()][string[]]$Ignore = @()
|    )
|    $envArgs = New-Object System.Collections.Generic.List[string]
|    $refused = New-Object System.Collections.Generic.List[string]
|    $missing = New-Object System.Collections.Generic.List[string]
|    foreach ($n in @($Names | Where-Object { $_ -and @($Ignore) -notcontains $_ } | Select-Object -Unique)) {
|        if ((Test-SIConfigNameIsSecret -Name $n) -or ($script:SIConfigProtected -contains $n)) { $refused.Add($n); continue }
|        if (-not $Globals.ContainsKey($n)) { $missing.Add($n); continue }
|        $envArgs.Add(('{0}{1}={2}' -f $script:SIConfigEnvPrefix, $n, (ConvertTo-SIConfigEnvValue -Value $Globals[$n])))
|    }
|    [pscustomobject]@{ EnvArgs = $envArgs.ToArray(); Refused = $refused.ToArray(); Missing = $missing.ToArray() }
|}
|
|# Settings that no longer exist. A value left for one in a customer's configuration is ignored without a word. The
|# same list is the settings catalog's "retired" list (a Pro file, so it is repeated here for both editions;
|# SIv3-NoStorageKey.Tests.ps1 keeps the two equal).
|$script:SIRetiredSettings = @('SI_PrestageInfra', 'SI_StorageKey', 'SI_UseStorageOAuth')
|# #914: the older ServiceNow push's five settings are retired too
|$script:SIRetiredSettings += @('SI_ServiceNow_DirectWrite', 'SI_ServiceNow_ImportSetMaxRows', 'SI_ServiceNow_ImportSetTable', 'SI_VulnSync_ServiceNowDirectWrite', 'SI_VulnSync_ServiceNowImportSetTable')
|
|function Get-SIRetiredSettingNames {
|    <# PURE. The settings that no longer exist (see $script:SIRetiredSettings). #>
|    return @($script:SIRetiredSettings)
|}
|
|# #986 (2026-10-31): settings whose ONE source on a Pro install is the Pro database. They are never passed to a job as
|# SI_CFG_<name> when the install has a Pro database: the pipeline runner reads the start time from the database (cfg.JobFlow /
|# cfg.Setting), and a copy in the job's environment went stale the moment someone changed it (live: the job said 22:00
|# Europe/Paris while the runs started at 19:00 Europe/Amsterdam). The Community edition has no database: there the job's
|# environment IS the source, and these still travel. The update removes them from existing Pro jobs (setup\_shared\
|# SI-NightlySchedule.ps1, Invoke-SINightlyJobEnvCleanup).
|$script:SIConfigDbOwned = @('SI_Pipeline_StartTime', 'SI_Pipeline_TimeZone')
|
|function Get-SIConfigDbOwnedNames {
|    <# PURE. The settings a Pro install keeps in its database only (see $script:SIConfigDbOwned). #>
|    return @($script:SIConfigDbOwned)
|}
|
|# Job secrets an older setup created that no current job uses. Bootstrap removes them from an existing job after its
|# environment variables have been replaced (so nothing references them any more).
|$script:SIRetiredJobSecrets = @('si-storage-key')
|
|function Get-SIRetiredJobSecretNames {
|    <# PURE. Of an existing Container App Job (az containerapp job show), the retired secrets it still carries. #>
|    param([AllowNull()][object]$Job)
|    if ($null -eq $Job -or -not $Job.PSObject.Properties['properties']) { return @() }
|    $have = @($Job.properties.configuration.secrets | Where-Object { $_ } | ForEach-Object { [string]$_.name })
|    return @($script:SIRetiredJobSecrets | Where-Object { $have -contains $_ })
|}
|
|function Get-SIUnwiredOptionalJobSecretNames {
|    <#
|        PURE. Of an existing job, the OPTIONAL secrets (Shodan, Azure OpenAI, SMTP) it carries that this run of setup did
|        not wire (-SecretArgs, '<alias>=...'): the secret left the vault or the feature was switched off. The env vars were
|        just replaced, so nothing references them -- and a Key Vault reference to a secret that is gone would make every
|        later change to the job fail (2026-10-06).
|    #>
|    param([AllowNull()][object]$Job, [string[]]$SecretArgs = @())
|    if ($null -eq $Job -or -not $Job.PSObject.Properties['properties']) { return @() }
|    $have  = @($Job.properties.configuration.secrets | Where-Object { $_ } | ForEach-Object { [string]$_.name })
|    $wired = @($SecretArgs | Where-Object { $_ } | ForEach-Object { ([string]$_ -split '=', 2)[0] })
|    return @('shodan-key', 'openai-apikey', 'smtp-password' | Where-Object { $have -contains $_ -and $wired -notcontains $_ })
|}
|
|function Get-SIConfigFileSettingNames {
|    <#
|      PURE (Bootstrap side, #294). The settings a config file SETS: every `$global:<Name> = ...` assignment in it, read
|      from the file's syntax tree -- nothing is run. Bootstrap passes these to every job as SI_CFG_<name>.
|      Why not "the globals that appeared when the file was loaded": when the caller had loaded the config already (a
|      deploy that imported the settings into the Pro database first, in the same session), every global existed before,
|      so NONE appeared -- 0 settings went to every job, and on ring 1 (2026-10-04/05) the jobs ran without the customer's
|      configuration: default rule names, no Pro settings database, and a Risk Analysis snapshot posted through a rule
|      that dropped its key columns. A file that cannot be parsed returns nothing (the caller still has the other method).
|    #>
|    param([Parameter(Mandatory)][string]$Path)
|    if (-not (Test-Path -LiteralPath $Path)) { return @() }
|    $tokens = $null; $errors = $null
|    $ast = [System.Management.Automation.Language.Parser]::ParseFile($Path, [ref]$tokens, [ref]$errors)
|    if ($null -eq $ast) { return @() }
|    $assigns = $ast.FindAll({ param($n) $n -is [System.Management.Automation.Language.AssignmentStatementAst] }, $true)
|    $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($a in $assigns) {
|        $left = $a.Left
|        if ($left -is [System.Management.Automation.Language.ConvertExpressionAst]) { $left = $left.Child }
|        if ($left -isnot [System.Management.Automation.Language.VariableExpressionAst]) { continue }
|        $vp = $left.VariablePath
|        if (-not $vp.IsGlobal) { continue }
|        $name = $vp.UserPath.Substring($vp.UserPath.IndexOf(':') + 1)
|        if ($name -match '^[A-Za-z_][A-Za-z0-9_]*$' -and $seen.Add($name)) { [void]$out.Add($name) }
|    }
|    return $out.ToArray()
|}
|
|function Import-SIConfigFromEnv {
|    <#
|      Container side. Sets $global:<Name> for every SI_CFG_<Name> env var, except secret-looking and
|      container-owned names. -Environment is a name->value hashtable (the process environment by default,
|      a test seam otherwise). Returns @{ Applied; Refused }.
|    #>
|    param([hashtable]$Environment)
|    if (-not $Environment) {
|        $Environment = @{}
|        foreach ($e in [Environment]::GetEnvironmentVariables().GetEnumerator()) { $Environment[[string]$e.Key] = [string]$e.Value }
|    }
|    $applied = New-Object System.Collections.Generic.List[string]
|    $refused = New-Object System.Collections.Generic.List[string]
|    foreach ($k in @($Environment.Keys | Sort-Object)) {
|        if (-not ([string]$k).StartsWith($script:SIConfigEnvPrefix, [StringComparison]::OrdinalIgnoreCase)) { continue }
|        $name = ([string]$k).Substring($script:SIConfigEnvPrefix.Length)
|        if (-not $name -or $name -notmatch '^[A-Za-z_][A-Za-z0-9_]*$') { $refused.Add($name); continue }
|        if ((Test-SIConfigNameIsSecret -Name $name) -or ($script:SIConfigProtected -contains $name)) { $refused.Add($name); continue }
|        Set-Variable -Name $name -Scope Global -Value (ConvertFrom-SIConfigEnvValue -Text ([string]$Environment[$k]))
|        $applied.Add($name)
|    }
|    [pscustomobject]@{ Applied = $applied.ToArray(); Refused = $refused.ToArray() }
|}
|
|function Resolve-SIContainerAi {
|    <#
|      PURE (#184). Azure OpenAI is OPTIONAL: configured only when all four settings are present. AI is ON
|      only when it is configured AND asked for (SI_ENABLE_AI, or $global:SI_EnableAI_<engine> passed through).
|      Asked for but not configured -> OFF, with a reason the log states. Returns @{ Configured; Enabled; Reason }.
|    #>
|    param(
|        [hashtable]$OpenAi = @{},
|        [bool]$Requested = $false
|    )
|    $need = 'apiKey', 'endpoint', 'deployment', 'apiVersion'
|    $have = @($need | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$OpenAi[$_]) })
|    $configured = ($have.Count -eq $need.Count)
|    if (-not $Requested) { return [pscustomobject]@{ Configured = $configured; Enabled = $false; Reason = 'AI classification is off (not requested)' } }
|    if (-not $configured) {
|        $missing = @($need | Where-Object { $have -notcontains $_ }) -join ', '
|        return [pscustomobject]@{ Configured = $false; Enabled = $false; Reason = "AI classification was requested but Azure OpenAI is not configured (missing: $missing) -- running without it" }
|    }
|    [pscustomobject]@{ Configured = $true; Enabled = $true; Reason = 'AI classification is on' }
|}
|
|# ==================================================================================================================
|#  CONTAINER PARITY WITH THE VM LAUNCHERS
|# ==================================================================================================================
|# A VM launcher layers: shipped defaults -> the customer's config -> launcher/<engine>/LauncherConfig.defaults.ps1 ->
|# launcher/<engine>/LauncherConfig.custom.ps1 -> CLI switches. A container job gets the same layers this way:
|#   * the engine's shipped LauncherConfig.defaults.ps1 is loaded by the entry point BEFORE the customer's settings;
|#   * the customer's config AND the engine's LauncherConfig.custom.ps1 travel as SI_CFG_<name> (per job);
|#   * a job env var the entry point owns wins only when it is PRESENT -- an absent one never overwrites a setting.
|
|function Get-SIEngineSettingSuffix {
|    <# PURE. The per-engine suffix of a setting name, as the VM launchers spell it: endpoint -> Endpoint, publicip ->
|       PublicIp, risk-analysis-detailed -> RiskAnalysisDetailed, privilege-tier-classifier -> PrivilegeTierClassifier. #>
|    param([Parameter(Mandatory)][string]$Engine)
|    if ($Engine -ieq 'publicip') { return 'PublicIp' }
|    $parts = @(($Engine -split '[-_]') | Where-Object { $_ } | ForEach-Object { $_.Substring(0, 1).ToUpperInvariant() + $_.Substring(1).ToLowerInvariant() })
|    return ($parts -join '')
|}
|
|function Get-SIContainerEngineLauncherFolder {
|    <# PURE. The launcher\<folder> whose LauncherConfig.defaults.ps1 / .custom.ps1 belong to a container engine; $null for an
|       engine that has no launcher config of its own. Every Risk Analysis job (Summary, Detailed, extra) shares one. #>
|    param([Parameter(Mandatory)][string]$Engine)
|    $e = $Engine.ToLowerInvariant()
|    if ($e -in 'endpoint', 'identity', 'azure', 'publicip', 'privilege-tier-classifier', 'asset-trend') { return $e }
|    if ($e -in 'risk-analysis', 'risk-analysis-detailed' -or $e -like 'ra-*') { return 'risk-analysis' }
|    return $null
|}
|
|function Get-SIContainerEngineDefaultsPath {
|    <# The engine's shipped launcher\<folder>\LauncherConfig.defaults.ps1 under -Root, or $null (no such engine or file).
|       The entry point dot-sources it BEFORE importing the customer's settings, so a customer value always wins. #>
|    param([Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][string]$Root)
|    $folder = Get-SIContainerEngineLauncherFolder -Engine $Engine
|    if (-not $folder) { return $null }
|    $p = [IO.Path]::Combine($Root, 'launcher', $folder, 'LauncherConfig.defaults.ps1')
|    if (Test-Path -LiteralPath $p) { return $p }
|    return $null
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|# THE SHIPPED DEFAULT OF EVERY SETTING (framework: "an unstored setting reads the catalog default"). A container never
|# loads launcher\_lib\SecurityInsight.shared-defaults.ps1 (it also states Location, SubscriptionId and other values the
|# container takes from its own env vars), and the Pro settings layer sets a global only for a STORED row -- so a setting
|# nobody stored was $null in a container, and a switch whose code read $null as "off" ran off although its shipped
|# default is on (found 2026-11-07 for the two identity scope switches). The entry points therefore set, FIRST -- before
|# the engine's defaults file, the customer's SI_CFG_* values and the stored cfg.Setting rows, which all still win --
|# every catalog setting's global from config\settings.catalog.locked.json "default", only where the global is unset.
|# Left out: secrets, settings without a default, the names the container states from its own env vars
|# ($script:SIConfigProtected), the web app's settings (SIWeb_*: the Pro layer fills those only when unset), and the
|# settings below whose UNSET value has a meaning of its own.
|# ---------------------------------------------------------------------------------------------------------------------
|$script:SICatalogDefaultNotApplied = [ordered]@{
|    # not set = inferred from the SMTP credentials (anonymous relay when there are none); a stored false = authenticated.
|    # The catalog's false would turn a mail without credentials into a refused SMTP pre-flight -- so it stays unset.
|    'Mail_SendAnonymous' = 'not set means: inferred from the SMTP credentials'
|}
|
|function ConvertFrom-SICatalogDefault {
|    <# PURE. A catalog setting's "default" as the global's value, by the catalog's own type: bool / int / number / list /
|       text / enum. $null for a value that does not fit its type (then nothing is set). #>
|    param([Parameter(Mandatory)]$Setting)
|    $d = $Setting.default
|    if ($null -eq $d) { return $null }
|    switch ([string]$Setting.type) {
|        'bool'   { if ($d -is [bool]) { return [bool]$d }; $s = ([string]$d).Trim().ToLowerInvariant(); if ($s -in 'true', '1', 'on', 'yes') { return $true }; if ($s -in 'false', '0', 'off', 'no') { return $false }; return $null }
|        'int'    { $n = 0L; if ([long]::TryParse(([string]$d).Trim(), [Globalization.NumberStyles]::Integer, [Globalization.CultureInfo]::InvariantCulture, [ref]$n)) { if ($n -ge [int]::MinValue -and $n -le [int]::MaxValue) { return [int]$n }; return $n }; return $null }
|        'number' { $x = 0.0; if ([double]::TryParse(([string]$d).Trim(), [Globalization.NumberStyles]::Float, [Globalization.CultureInfo]::InvariantCulture, [ref]$x)) { return $x }; return $null }
|        'list'   { return , @(@($d) | ForEach-Object { [string]$_ }) }
|        default  { return [string]$d }
|    }
|}
|
|function Get-SIContainerCatalogDefaults {
|    <# PURE (reads the catalog). The settings whose shipped default a container applies: @( @{ Name; Type; Value } ). #>
|    param([Parameter(Mandatory)][string]$CatalogPath)
|    $cat = [IO.File]::ReadAllText($CatalogPath) | ConvertFrom-Json
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($s in @($cat.settings)) {
|        $n = [string]$s.name
|        if (-not $n -or $n -notmatch '^[A-Za-z_][A-Za-z0-9_]*$') { continue }
|        if ($null -eq $s.default -or [bool]$s.secret) { continue }
|        if ((Test-SIConfigNameIsSecret -Name $n) -or ($script:SIConfigProtected -contains $n) -or $n.StartsWith('SIWeb_') -or $script:SICatalogDefaultNotApplied.Contains($n)) { continue }
|        $v = ConvertFrom-SICatalogDefault -Setting $s
|        if ($null -eq $v) { continue }
|        $out.Add([pscustomobject]@{ Name = $n; Type = [string]$s.type; Value = $v })
|    }
|    , $out.ToArray()
|}
|
|function Set-SIContainerCatalogDefaults {
|    <# Sets $global:<Name> to the catalog default for every setting whose global is unset (missing or $null); a value
|       already there is never touched. Returns @{ Applied = @(names); Kept = @(names already set) }. #>
|    param([Parameter(Mandatory)][string]$CatalogPath)
|    $applied = New-Object System.Collections.Generic.List[string]; $kept = New-Object System.Collections.Generic.List[string]
|    foreach ($d in (Get-SIContainerCatalogDefaults -CatalogPath $CatalogPath)) {
|        $cur = Get-Variable -Name $d.Name -Scope Global -ErrorAction SilentlyContinue
|        if ($cur -and $null -ne $cur.Value) { $kept.Add($d.Name); continue }
|        Set-Variable -Name $d.Name -Scope Global -Value $d.Value
|        $applied.Add($d.Name)
|    }
|    [pscustomobject]@{ Applied = $applied.ToArray(); Kept = $kept.ToArray() }
|}
|
|$script:SIRunspaceNoise = @('?', '^', '$', '_', 'args', 'input', 'this', 'Error', 'LASTEXITCODE', 'Matches', 'MyInvocation', 'PSItem',
|    'PWD', 'StackTrace', 'PSBoundParameters', 'PSCmdlet', 'PSCommandPath', 'PSScriptRoot', 'foreach', 'switch', 'ExecutionContext',
|    'Host', 'PID', 'PSDebugContext', 'NestedPromptLevel', 'ConsoleFileName', 'ShellId')
|
|function Read-SILauncherCustomSettings {
|    <#
|        Bootstrap side. The settings a launcher\<engine>\LauncherConfig.custom.ps1 sets, as name -> value -- read in its
|        OWN runspace, so one engine's file never changes Bootstrap's globals or another job's settings. A file that fails
|        part-way returns what it set before the failure, with the error. Returns @{ Settings; Errors }.
|    #>
|    param([Parameter(Mandatory)][string]$Path)
|    $settings = @{}
|    $errors = New-Object System.Collections.Generic.List[string]
|    if (-not (Test-Path -LiteralPath $Path)) { return [pscustomobject]@{ Settings = $settings; Errors = @() } }
|    $ps = [powershell]::Create()
|    try {
|        $probe = {
|            param($File, $Noise)
|            # A fresh runspace holds only PowerShell's own variables, so every name the file adds is one of its settings.
|            $before = @{}
|            foreach ($v in (Get-Variable -Scope Global)) { $before[$v.Name] = $true }
|            $failure = $null
|            try { . $File } catch { $failure = $_.Exception.Message }
|            $after = @{}
|            foreach ($v in (Get-Variable -Scope Global)) {
|                if ($before.ContainsKey($v.Name) -or $Noise -contains $v.Name -or $v.Name -notmatch '^[A-Za-z_][A-Za-z0-9_]*$') { continue }
|                $after[$v.Name] = $v.Value
|            }
|            [pscustomobject]@{ Settings = $after; Failure = $failure }
|        }
|        $null = $ps.AddScript($probe.ToString(), $true).AddArgument($Path).AddArgument($script:SIRunspaceNoise)
|        $res = @($ps.Invoke())
|        foreach ($e in @($ps.Streams.Error)) { $errors.Add([string]$e) }
|        if ($res.Count) {
|            if ($res[-1].Failure) { $errors.Add([string]$res[-1].Failure) }
|            foreach ($k in @($res[-1].Settings.Keys)) { if ($k -notlike 'SI_Bootstrap_*') { $settings[$k] = $res[-1].Settings[$k] } }
|        }
|    } catch {
|        $errors.Add($_.Exception.Message)
|    } finally { $ps.Dispose() }
|    [pscustomobject]@{ Settings = $settings; Errors = $errors.ToArray() }
|}
|
|function Merge-SIConfigEnvArgs {
|    <# PURE. The job's SI_CFG_* list: -Base (the customer's config) with -Override (the engine's own launcher config) winning
|       name by name -- one entry per name, so a job never carries the same variable twice. #>
|    param([AllowEmptyCollection()][string[]]$Base = @(), [AllowEmptyCollection()][string[]]$Override = @())
|    $over = @{}
|    foreach ($a in @($Override | Where-Object { $_ })) { $over[($a -split '=', 2)[0]] = $true }
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($a in @($Base | Where-Object { $_ })) { if (-not $over.ContainsKey(($a -split '=', 2)[0])) { $out.Add($a) } }
|    foreach ($a in @($Override | Where-Object { $_ })) { $out.Add($a) }
|    return , $out.ToArray()
|}
|
|function Test-SITruthy {
|    <# PURE. $true, 1, 'true', '1', 'yes' (any case) -> $true; everything else -> $false. #>
|    param([AllowNull()][object]$Value)
|    if ($null -eq $Value) { return $false }
|    if ($Value -is [bool]) { return [bool]$Value }
|    return ("$Value".Trim() -match '^(?i)(true|1|yes)$')
|}
|
|function Get-SIProcessEnvironment {
|    $h = @{}
|    foreach ($e in [Environment]::GetEnvironmentVariables().GetEnumerator()) { $h[[string]$e.Key] = [string]$e.Value }
|    return $h
|}
|
|function Resolve-SIContainerRunOptions {
|    <#
|        PURE. What a profiler run collects and where it sends it -- the VM launcher's per-engine settings
|        (SI_AssetLimit_<Engine>, SI_Sinks_<Engine>, SI_ForceFullRun_<Engine>, from the customer's config, the engine's
|        launcher config or the Pro settings database) unless the job's own env var (SI_ASSET_LIMIT, SI_SINKS,
|        SI_FORCE_FULL_RUN) is PRESENT. Neither -> the VM default (all assets, JSON + Excel + LA, incremental).
|        Returns @{ AssetLimit; Sinks; ForceFullRun; Source } -- Source names where each came from.
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [hashtable]$Globals = @{}, [hashtable]$Environment)
|    if (-not $Environment) { $Environment = Get-SIProcessEnvironment }
|    $sfx = Get-SIEngineSettingSuffix -Engine $Engine
|    $ev = { param($n) if ($Environment.ContainsKey($n) -and -not [string]::IsNullOrWhiteSpace([string]$Environment[$n])) { ([string]$Environment[$n]).Trim() } else { $null } }
|    $gv = { param($n) if ($Globals.ContainsKey($n)) { $Globals[$n] } else { $null } }
|    $src = [ordered]@{}
|
|    $limit = 0; $src.AssetLimit = 'default'
|    $e = & $ev 'SI_ASSET_LIMIT'; $g = & $gv ('SI_AssetLimit_{0}' -f $sfx)
|    if ($null -ne $e -and $e -match '^\d+$') { $limit = [int]$e; $src.AssetLimit = 'SI_ASSET_LIMIT' }
|    elseif ($null -ne $g -and "$g".Trim() -match '^\d+$') { $limit = [int]"$g"; $src.AssetLimit = ('SI_AssetLimit_{0}' -f $sfx) }
|
|    $sinks = @('JSON', 'Excel', 'LA'); $src.Sinks = 'default'
|    $e = & $ev 'SI_SINKS'; $g = @(& $gv ('SI_Sinks_{0}' -f $sfx) | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) })
|    if ($null -ne $e) { $sinks = @($e.Split(',') | ForEach-Object { $_.Trim() } | Where-Object { $_ }); $src.Sinks = 'SI_SINKS' }
|    elseif ($g.Count) { $sinks = @($g | ForEach-Object { ([string]$_).Trim() }); $src.Sinks = ('SI_Sinks_{0}' -f $sfx) }
|
|    # Same order as the VM launcher (#257): the job's env var, else the engine's own switch when it is ON, else the
|    # tenant-wide SI_ForceFullRun, else an explicit engine OFF, else incremental. The tenant-wide switch used to be
|    # ignored here, so a container job never did the full run the config asked for.
|    $force = $false; $src.ForceFullRun = 'default'
|    $e = & $ev 'SI_FORCE_FULL_RUN'; $g = & $gv ('SI_ForceFullRun_{0}' -f $sfx); $t = & $gv 'SI_ForceFullRun'
|    if ($null -ne $e) { $force = Test-SITruthy $e; $src.ForceFullRun = 'SI_FORCE_FULL_RUN' }
|    elseif ($null -ne $g -and (Test-SITruthy $g)) { $force = $true; $src.ForceFullRun = ('SI_ForceFullRun_{0}' -f $sfx) }
|    elseif ($null -ne $t -and (Test-SITruthy $t)) { $force = $true; $src.ForceFullRun = 'SI_ForceFullRun' }
|    elseif ($null -ne $g) { $force = $false; $src.ForceFullRun = ('SI_ForceFullRun_{0}' -f $sfx) }
|
|    [pscustomobject]@{ AssetLimit = $limit; Sinks = $sinks; ForceFullRun = [bool]$force; Source = $src }
|}
|
|function Get-SIContainerRaEnvOverrides {
|    <#
|        PURE. The Risk Analysis settings a job's env vars set -- ONLY those whose env var is PRESENT. An absent env var
|        returns nothing, so the customer's setting (or the VM launcher's default, loaded first) stands. Returns an ordered
|        name -> value map of the globals to set.
|    #>
|    param([hashtable]$Environment)
|    if (-not $Environment) { $Environment = Get-SIProcessEnvironment }
|    $out = [ordered]@{}
|    $map = [ordered]@{
|        SI_RA_TABLE_SUMMARY = @('SI_RiskAnalysis_TableName_Summary', 'string'); SI_RA_TABLE_DETAILED = @('SI_RiskAnalysis_TableName_Detailed', 'string')
|        SI_RA_SEND_TO_LOG_ANALYTICS = @('SendToLogAnalytics', 'bool'); SI_RA_SEND_MAIL = @('SendMail', 'bool')
|        SI_RA_BUILD_SUMMARY_BY_AI = @('BuildSummaryByAI', 'bool'); SI_RA_AUTO_BUCKET = @('AutoBucketCount', 'bool')
|        SI_RA_AUTO_BUCKET_MAX = @('AutoBucketMax', 'int'); SI_RA_AUTO_BUCKET_CACHE = @('AutoBucketCache', 'bool')
|    }
|    foreach ($k in $map.Keys) {
|        if (-not $Environment.ContainsKey($k) -or [string]::IsNullOrWhiteSpace([string]$Environment[$k])) { continue }
|        $v = ([string]$Environment[$k]).Trim()
|        switch ($map[$k][1]) {
|            'bool'   { $out[$map[$k][0]] = Test-SITruthy $v }
|            'int'    { if ($v -match '^\d+$') { $out[$map[$k][0]] = [int]$v } }
|            default  { $out[$map[$k][0]] = $v }
|        }
|    }
|    return $out
|}
|
|# THE RETRY LIMIT (2026-10-23): every ENGINE job -- a job the pipeline starts -- has replicaRetryLimit 0. Live: Azure
|# re-ran a failed data sync container inside the same execution (852 min = 504 + 347) and the vulnerability step twice
|# (2 x 18 min); the pipeline runner decides what runs again (it also restarts a container that never started). At a new
|# install (Bootstrap, the missing-jobs step, the queue worker / producer definitions) and on every update for an existing
|# job (setup/_shared/SI-JobSizing.ps1 Invoke-SIEngineJobRetryLimit). The runner (caj-si-flow), the updater, the template
|# publish, schema discovery, the configuration backup and the heartbeat are not engine jobs and keep what they have.
|function Get-SIPipelineStepKeys {
|    <#
|        The jobs that are steps of the pipeline, from the shipped map (config\job-flow.locked.json): every job with a stage
|        that is not marked neverInFlow / ownSchedule / retired, as its key (the job name without caj-si-). -Path: test seam.
|        @() when the map cannot be read.
|    #>
|    param([string]$Path)
|    if (-not $Path) { $Path = [IO.Path]::Combine($PSScriptRoot, '..', '..', 'config', 'job-flow.locked.json') }
|    try {
|        $raw = [IO.File]::ReadAllText($Path) | ConvertFrom-Json
|        $flag = { param($j, $n) [bool]($j.PSObject.Properties[$n] -and $j.$n) }
|        return @(@($raw.jobs) | Where-Object { $_ -and (& $flag $_ 'stage') -and -not (& $flag $_ 'neverInFlow') -and -not (& $flag $_ 'ownSchedule') -and -not (& $flag $_ 'retired') } |
|                 ForEach-Object { ([string]$_.key).ToLowerInvariant() })
|    } catch { return @() }
|}
|
|function Test-SIEngineJobName {
|    <#
|        An ENGINE job: one the pipeline starts. caj-si-<step> for every step of the pipeline (-StepKeys, default
|        Get-SIPipelineStepKeys), its -producer / -worker, every Risk Analysis job (caj-si-risk-analysis,
|        caj-si-risk-analysis-detailed, caj-si-ra-<name>) and the Risk Analysis queue workers (caj-si-raworker-<grain>).
|        Not the runner (caj-si-flow), the updater or any job that is no step.
|    #>
|    param([AllowEmptyString()][string]$Name, [string[]]$StepKeys)
|    $n = "$Name".Trim().ToLowerInvariant()
|    if (-not $n.StartsWith('caj-si-')) { return $false }
|    $s = $n.Substring(7)
|    if ($s -match '^(risk-analysis|risk-analysis-detailed|ra-[a-z0-9-]+|raworker-[a-z0-9-]+)$') { return $true }
|    if ($s -match '^(.+)-(producer|worker)$') { $s = $Matches[1] }
|    if ($s -in @('flow', 'updater')) { return $false }
|    if ($null -eq $StepKeys) { $StepKeys = @(Get-SIPipelineStepKeys) }
|    [bool](@($StepKeys) -contains $s)
|}
|
|function Get-SIJobRetryLimitArg {
|    <# PURE. The --replica-retry-limit a NEW job is created with: '0' for an engine job (Test-SIEngineJobName), else '1'. #>
|    param([AllowEmptyString()][string]$Name, [string[]]$StepKeys)
|    # #1038 (1): the data-out job retries its own failed outputs -- Azure never starts it again as a whole new run
|    if ("$Name".Trim().ToLowerInvariant() -eq 'caj-si-data-out') { return '0' }
|    # #1021: the support grant job -- a request is answered once; a failed start is the Support session's to repeat
|    if ("$Name".Trim().ToLowerInvariant() -eq 'caj-si-support-grant') { return '0' }
|    if (Test-SIEngineJobName -Name $Name -StepKeys $StepKeys) { '0' } else { '1' }
|}
|
|# The container job sizes setup gives each kind of job unless the customer sets SI_Bootstrap_ReplicaTimeout_<Engine> /
|# _Cpu_<Engine> / _Memory_<Engine> (seconds / cores / '<n>Gi'). These were the only values before they became settings.
|# THE FLOOR (owner 2026-10-10: "money must not be the case", "time is critical" -> "Floor 2/4, tenant rule to 4/8"): every
|# SI job runs with at least 2 CPU / 4 GiB; the tenant-size rule (Get-SITenantSizedJobResources) and the update's failure
|# learning raise it to 4 CPU / 8 GiB. A job is paid only while it runs.
|# THE RUN LIMIT (owner 2026-10-13: "we are not to judge that and it breaks the whole solution", "why have a limit, if the
|# environment has 100000000000 objects"): SecurityInsight chooses NO run limit for a step. Azure makes every job carry
|# one, so every engine job gets THE LONGEST ONE AZURE TAKES (Get-SIJobRunLimit) -- at a new install, and every update
|# raises an existing job to it (setup/_shared/SI-JobSizing.ps1, Invoke-SIJobFloor). One value, at any tenant size.
|function Get-SIJobRunLimit {
|    <#
|        PURE. The run limit of every engine job, in seconds: 604800 (7 days) -- the longest run limit Azure is PROVEN to
|        take for a Container Apps job (the pipeline job has run with it on live installs since 2026-10-12). Microsoft
|        documents no maximum for properties.configuration.replicaTimeout ("Maximum number of seconds a replica is allowed
|        to run", an int, no upper bound stated), so no larger value is established; 7 days is also the longest lease a
|        storage queue gives a collection worker's part. When a larger value is established, change it HERE only.
|        Not the updater (its own limit). A limit the customer set (SI_Bootstrap_ReplicaTimeout_<Engine>) wins -- it can
|        only be shorter or the same.
|    #>
|    604800
|}
|$script:SIJobResourceDefaults = @{
|    Keda         = @{ ReplicaTimeout = (Get-SIJobRunLimit); Cpu = '2.0'; Memory = '4.0Gi' }
|    RiskAnalysis = @{ ReplicaTimeout = (Get-SIJobRunLimit); Cpu = '2.0'; Memory = '4.0Gi' }
|    Manual       = @{ ReplicaTimeout = (Get-SIJobRunLimit); Cpu = '2.0'; Memory = '4.0Gi' }
|    Schedule     = @{ ReplicaTimeout = (Get-SIJobRunLimit); Cpu = '2.0'; Memory = '4.0Gi' }
|}
|
|# THE TENANT'S SIZE AS SETUP READ IT, KEPT ON EVERY JOB (2026-10-16, the large installs: the updater's identity has no
|# directory read, the identity collection had written 0 users, so the update's size rule read 0 users and kept the job
|# at 2 CPU / 4 GiB). Setup reads the counts from Microsoft Graph once (Get-SITenantDirectoryCounts) and tags every job it
|# creates or updates with them; every update reads them back from the job list it already has. Plain digits only.
|$script:SITenantSizeTagNames = [ordered]@{ Users = 'si-tenant-users'; Groups = 'si-tenant-groups'; ServicePrincipals = 'si-tenant-serviceprincipals'; Devices = 'si-tenant-devices' }
|
|function Get-SITenantSizeTags {
|    <# PURE. The counts (-Counts: Users / Groups / ServicePrincipals / Devices) as job tags 'si-tenant-users=22705' ...; @() when none were read. #>
|    param([hashtable]$Counts)
|    if (-not $Counts) { return @() }
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($k in @($script:SITenantSizeTagNames.Keys)) {
|        $n = 0L
|        if ($Counts.ContainsKey($k) -and [long]::TryParse("$($Counts[$k])", [ref]$n) -and $n -ge 0) { $out.Add(('{0}={1}' -f $script:SITenantSizeTagNames[$k], $n)) }
|    }
|    if (-not @($out | Where-Object { $_ -notmatch '=0$' }).Count) { return @() }
|    $out.ToArray()
|}
|
|function ConvertFrom-SITenantSizeTags {
|    <#
|        PURE. The counts setup read, from the tags of the jobs (ARM shape: tags.si-tenant-*). The largest value of any job
|        (setup tags every job it touches; an older job may carry an older count). @{ Users; Groups; ServicePrincipals;
|        Devices } or $null when no job carries them.
|    #>
|    param([object[]]$Jobs = @())
|    $c = @{ Users = 0L; Groups = 0L; ServicePrincipals = 0L; Devices = 0L }; $any = $false
|    foreach ($j in @($Jobs)) {
|        if (-not $j -or -not $j.PSObject.Properties['tags'] -or -not $j.tags) { continue }
|        $t = $j.tags
|        foreach ($k in @($script:SITenantSizeTagNames.Keys)) {
|            $name = $script:SITenantSizeTagNames[$k]
|            $v = $null
|            if ($t -is [System.Collections.IDictionary]) { if ($t.Contains($name)) { $v = $t[$name] } }
|            elseif ($t.PSObject.Properties[$name]) { $v = $t.$name }
|            $n = 0L
|            if ($null -ne $v -and "$v".Trim() -match '^\d+$' -and [long]::TryParse("$v".Trim(), [ref]$n)) { if ($n -gt $c[$k]) { $c[$k] = $n }; $any = $true }
|        }
|    }
|    if ($any) { $c } else { $null }
|}
|
|function Get-SITenantSizedJobResources {
|    <#
|        PURE. A collection job's size for THIS tenant (customer H 2026-10-08: 22,705 users + 5,097 groups ran the identity
|        job out of memory at the 2 GiB default). -Counts: Users, Groups, ServicePrincipals, Devices (Microsoft Graph $count;
|        a missing count is 0). Container Apps takes only these CPU/memory pairs, so a size is one of them:
|          < 5,000 objects   -> $null (the job kind's default stands)
|          >= 5,000          -> 4.0 CPU / 8.0Gi (the largest a consumption job has)
|        The run limit does not depend on the tenant's size: every engine job gets the longest run limit Azure takes
|        (Get-SIJobRunLimit; the ReplicaTimeout returned here is that value).
|        Objects: identity = users + groups + service principals; endpoint = devices; asset-correlation (the CI
|        build) and the Risk Analysis jobs (risk-analysis*, ra-<name>; #509) = all of them; other engines are not sized
|        here. The same rule runs at install (Bootstrap) and on every update (setup/_shared/SI-JobSizing.ps1, #509).
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [hashtable]$Counts = @{})
|    $g = { param($k) if ($Counts -and $Counts.ContainsKey($k) -and $null -ne $Counts[$k]) { [long]$Counts[$k] } else { 0L } }
|    $n = switch ($Engine.Trim().ToLowerInvariant()) {
|        'identity' { (& $g 'Users') + (& $g 'Groups') + (& $g 'ServicePrincipals') }
|        'endpoint' { (& $g 'Devices') }
|        # the CI build (PowerShell 7 enriches the CIs in parallel on the job's CPUs): every object of every kind
|        'asset-correlation' { (& $g 'Users') + (& $g 'Groups') + (& $g 'ServicePrincipals') + (& $g 'Devices') }
|        # the Azure collection: no count of Azure resources is known at install, so it is sized as the tenant is (a new
|        # customer install 2026-10-12 ran its Azure worker out of memory at 4 GiB in the Enrich step)
|        'azure' { (& $g 'Users') + (& $g 'Groups') + (& $g 'ServicePrincipals') + (& $g 'Devices') }
|        # #509: the Risk Analysis jobs (Summary, Detailed and every extra report job ra-<name>) read every object too
|        { $_ -like 'risk-analysis*' -or $_ -like 'ra-*' } { (& $g 'Users') + (& $g 'Groups') + (& $g 'ServicePrincipals') + (& $g 'Devices') }
|        # the jobs that load the whole Risk Analysis result are sized as Risk Analysis is (customer H 2026-10-10: data sync OOM)
|        { $_ -in @('asset-datasync', 'asset-vulnerabilities') } { (& $g 'Users') + (& $g 'Groups') + (& $g 'ServicePrincipals') + (& $g 'Devices') }
|        default { -1L }
|    }
|    $n = @($n)[0]
|    if ($n -lt 5000) { return $null }
|    # 5,000 to 15,000 objects: 4 CPU / 8 GiB too since 2026-10-12 (it was 2 CPU / 4 GiB). A new customer install of about
|    # 10,100 identity objects peaked at 3.2 GiB of 4 in its identity worker and ran its Azure worker out of memory on the
|    # first collection. Owner: reliability over cost; "we can always lower it later".
|    return [pscustomobject]@{ Cpu = '4.0'; Memory = '8.0Gi'; ReplicaTimeout = [int](Get-SIJobRunLimit); Objects = $n }
|}
|
|function Get-SIFlowJobReplicaTimeout {
|    <#
|        PURE. The run limit of the pipeline job itself (caj-si-flow), in seconds: 7 days. The pipeline runner starts each
|        step and WAITS for it inside its own execution, so it must never end before a step does -- 7 days is the longest a
|        customer may set a job's run limit to (SI_Bootstrap_ReplicaTimeout_<Engine>). A runner that does end early loses
|        nothing: the next wake-up resumes the run and follows the running step. Bootstrap gives a new install this value
|        and every update raises an existing install's pipeline job to it (setup/_shared/SI-JobSizing.ps1).
|    #>
|    604800
|}
|
|# A RUN LIMIT ABOVE 24 HOURS MAY BE REFUSED BY AZURE. 86400 s is the longest run limit Azure is KNOWN to take for a
|# Container Apps job. Every place that sends a longer one (setup's job create / update, the update's job sizing, the
|# pipeline job) tries it, and when Azure refuses the request it sends the SAME request once more with 24 hours -- the
|# CPU / memory change in it is never lost and neither an install nor an update fails for it. The refusal is remembered for
|# the rest of the run, so the other jobs are sent 24 hours at once.
|function Get-SIAzureKnownRunLimit { 86400 }
|
|function Test-SIRunLimitRefused {
|    <# Did Azure refuse a run limit above 24 hours earlier in this run? (Read tolerant: this file is dot-sourced more than once.) #>
|    [bool](Get-Variable -Name SIRunLimitRefused -Scope Script -ValueOnly -ErrorAction Ignore)
|}
|
|function Set-SIRunLimitRefused {
|    <# Remember (or, in a test, forget) that Azure refused a run limit above 24 hours in this run. #>
|    param([bool]$Value = $true)
|    $script:SIRunLimitRefused = $Value
|}
|
|function Get-SIRunLimitToSend {
|    <# PURE over the run's memory. The run limit to ask Azure for: -ReplicaTimeout, or 24 hours once a longer one was refused. #>
|    param([int]$ReplicaTimeout)
|    if ($ReplicaTimeout -gt (Get-SIAzureKnownRunLimit) -and (Test-SIRunLimitRefused)) { return [int](Get-SIAzureKnownRunLimit) }
|    $ReplicaTimeout
|}
|
|function Test-SIRunLimitRefusal {
|    <#
|        PURE. Is this answer a refusal that the run limit may have caused? Only for a request that asked for MORE than 24
|        hours: Azure's error names the replica timeout, or it is a 400 (-Status, or the words of one in -Text when only an
|        error message is at hand). The caller then sends the same request with 24 hours; only when THAT is accepted was the
|        run limit the cause.
|    #>
|    param([int]$ReplicaTimeout, [int]$Status = 0, [AllowEmptyString()][string]$Text = '')
|    if ($ReplicaTimeout -le (Get-SIAzureKnownRunLimit)) { return $false }
|    if ($Status -ge 500) { return $false }
|    if ("$Text" -match '(?i)replica\s*-?\s*timeout') { return $true }
|    if ($Status -eq 400) { return $true }
|    [bool]($Status -eq 0 -and "$Text" -match '(?i)HTTP Status: 400|returned 400|Bad\s?Request|InvalidRequest|InvalidParameter|ValidationError|InvalidTemplate')
|}
|
|function Get-SIRunLimitRefusedLine {
|    <# PURE. The one plain line for a run limit Azure did not take. #>
|    param([Parameter(Mandatory)][string]$Job, [int]$ReplicaTimeout)
|    'Azure did not accept a run limit of {0} hours for {1}; it keeps 24 hours.' -f ([double]$ReplicaTimeout / 3600).ToString('0.#', [Globalization.CultureInfo]::InvariantCulture), $Job
|}
|
|function Get-SIHeartbeatJobRunLimit {
|    <# PURE. #718: the run limit of the hourly status report job (caj-si-heartbeat), in seconds -- 30 minutes. #>
|    1800
|}
|
|function Get-SIContainerJobResources {
|    <#
|        PURE. A job's replica timeout, CPU and memory: SI_Bootstrap_ReplicaTimeout_<Engine>, SI_Bootstrap_Cpu_<Engine> and
|        SI_Bootstrap_Memory_<Engine> when set and valid, else the defaults for the kind of job. An invalid value is ignored
|        with a note (the default stands) -- a typo never fails setup half-way. Returns @{ ReplicaTimeout; Cpu; Memory; Notes }.
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][ValidateSet('Keda', 'RiskAnalysis', 'Manual', 'Schedule')][string]$Kind,
|          [hashtable]$Globals = @{},
|          # the tenant's directory counts (Get-SITenantSizedJobResources) -- a size the customer set still wins
|          [hashtable]$TenantCounts)
|    $d = $script:SIJobResourceDefaults[$Kind]
|    $sfx = Get-SIEngineSettingSuffix -Engine $Engine
|    $gv = { param($n) if ($Globals.ContainsKey($n) -and -not [string]::IsNullOrWhiteSpace([string]$Globals[$n])) { "$($Globals[$n])".Trim() } else { $null } }
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $notes = New-Object System.Collections.Generic.List[string]
|    $timeout = [int]$d.ReplicaTimeout; $cpu = [string]$d.Cpu; $mem = [string]$d.Memory
|    # #718: the hourly status report is the one job with a SHORT run limit of its own (30 minutes): a tick that hangs must
|    # never keep the next hour's tick from starting (the execution guard skips a tick while the previous one runs). Its size
|    # is the floor every job gets (2 CPU / 4 GiB -- the update raises any job below it).
|    if ($Engine -eq 'heartbeat') { $timeout = Get-SIHeartbeatJobRunLimit }
|    # the users' sign-in methods read in the background: the same short limit -- a run reads for its slice (8 minutes by
|    # default, at most 25) and a run that hangs must never keep the next one from starting
|    if ($Engine -eq 'signin-methods') { $timeout = Get-SIHeartbeatJobRunLimit }
|    if ($TenantCounts) {
|        $sized = Get-SITenantSizedJobResources -Engine $Engine -Counts $TenantCounts
|        if ($sized -and [double]($sized.Memory -replace 'Gi$', '') -gt [double]($mem -replace 'Gi$', '')) {
|            $cpu = $sized.Cpu; $mem = $sized.Memory
|            $notes.Add(('sized for this tenant: {0:N0} objects -> {1} CPU / {2}' -f $sized.Objects, $cpu, $mem))
|        }
|    }
|
|    $n = 'SI_Bootstrap_ReplicaTimeout_{0}' -f $sfx; $v = & $gv $n
|    if ($null -ne $v) {
|        # the customer's own run limit wins: it can only be shorter than (or the same as) the 7 days every job gets
|        if ($v -match '^\d{1,9}$' -and [int64]$v -ge 300 -and [int64]$v -le 604800) { $timeout = [int]$v }
|        else { $notes.Add(("{0} = '{1}' is not a number of seconds between 300 and 604800 (7 days) -- using {2}" -f $n, $v, $timeout)) }
|    }
|    $n = 'SI_Bootstrap_Cpu_{0}' -f $sfx; $v = & $gv $n
|    if ($null -ne $v) {
|        $c = 0.0
|        if ([double]::TryParse($v, [Globalization.NumberStyles]::Float, $inv, [ref]$c) -and $c -ge 0.25 -and $c -le 4 -and (($c * 4) % 1) -eq 0) { $cpu = $c.ToString('0.0#', $inv) }
|        else { $notes.Add(("{0} = '{1}' is not a CPU size (0.25 to 4, in steps of 0.25) -- using {2}" -f $n, $v, $cpu)) }
|    }
|    $n = 'SI_Bootstrap_Memory_{0}' -f $sfx; $v = & $gv $n
|    if ($null -ne $v) {
|        $m = 0.0; $num = ($v -replace '(?i)\s*gi$', '')
|        if ([double]::TryParse($num, [Globalization.NumberStyles]::Float, $inv, [ref]$m) -and $m -ge 0.5 -and $m -le 8 -and (($m * 2) % 1) -eq 0) { $mem = ('{0}Gi' -f $m.ToString('0.0#', $inv)) }
|        else { $notes.Add(("{0} = '{1}' is not a memory size (0.5Gi to 8Gi, in steps of 0.5Gi) -- using {2}" -f $n, $v, $mem)) }
|    }
|    [pscustomobject]@{ ReplicaTimeout = $timeout; Cpu = $cpu; Memory = $mem; Notes = $notes.ToArray() }
|}
|
|function Get-SIJobResourcesNeverLower {
|    <#
|        PURE. Re-running setup on an EXISTING job never LOWERS it: its run limit may be longer than setup would write, its
|        CPU / memory raised after an out-of-memory run. -Resources: what
|        setup would write (Get-SIContainerJobResources); -ExistingJob: the job as Azure has it (ARM shape; $null = a new
|        job, nothing changes). The LARGER of the two is written -- the run limit on its own, CPU and memory as a pair.
|        A value the customer set (SI_Bootstrap_ReplicaTimeout_ / _Cpu_ / _Memory_<Engine> in -Globals) still wins, also
|        downwards: that is their choice. Returns the same shape, with a note per value kept.
|    #>
|    param([Parameter(Mandatory)]$Resources, $ExistingJob, [Parameter(Mandatory)][string]$Engine, [hashtable]$Globals = @{})
|    if (-not $ExistingJob) { return $Resources }
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $sfx = Get-SIEngineSettingSuffix -Engine $Engine
|    $set = { param($n) [bool]($Globals -and $Globals.ContainsKey($n) -and -not [string]::IsNullOrWhiteSpace([string]$Globals[$n])) }
|    $notes = New-Object System.Collections.Generic.List[string]; foreach ($n in @($Resources.Notes)) { if ($n) { $notes.Add([string]$n) } }
|    $timeout = [int]$Resources.ReplicaTimeout; $cpu = [string]$Resources.Cpu; $mem = [string]$Resources.Memory
|    $haveTo = 0; $haveCpu = 0.0; $haveMem = 0.0; $haveMemText = ''
|    try { [void][int]::TryParse("$($ExistingJob.properties.configuration.replicaTimeout)", [ref]$haveTo) } catch { $haveTo = 0 }
|    try {
|        $c = @($ExistingJob.properties.template.containers | Where-Object { $_ })[0]
|        [void][double]::TryParse("$($c.resources.cpu)", [Globalization.NumberStyles]::Float, $inv, [ref]$haveCpu)
|        $haveMemText = [string]$c.resources.memory
|        [void][double]::TryParse(($haveMemText -replace '(?i)\s*gi$', ''), [Globalization.NumberStyles]::Float, $inv, [ref]$haveMem)
|    } catch { $haveCpu = 0.0; $haveMem = 0.0 }
|    if ($haveTo -gt $timeout -and -not (& $set ('SI_Bootstrap_ReplicaTimeout_{0}' -f $sfx))) {
|        $notes.Add(('the job already runs for up to {0:N1} hours -- kept (setup never lowers a run limit; it would have set {1:N1})' -f ($haveTo / 3600), ($timeout / 3600)))
|        $timeout = $haveTo
|    }
|    $wantMem = 0.0; [void][double]::TryParse(($mem -replace '(?i)\s*gi$', ''), [Globalization.NumberStyles]::Float, $inv, [ref]$wantMem)
|    if ($haveMem -gt $wantMem -and $haveCpu -gt 0 -and -not (& $set ('SI_Bootstrap_Cpu_{0}' -f $sfx)) -and -not (& $set ('SI_Bootstrap_Memory_{0}' -f $sfx))) {
|        $notes.Add(('the job already has {0} CPU / {1} -- kept (setup never lowers a job''s size; it would have set {2} CPU / {3})' -f $haveCpu.ToString('0.0#', $inv), $haveMemText, $cpu, $mem))
|        $cpu = $haveCpu.ToString('0.0#', $inv); $mem = $haveMemText
|    }
|    [pscustomobject]@{ ReplicaTimeout = $timeout; Cpu = $cpu; Memory = $mem; Notes = $notes.ToArray() }
|}
|
|function Get-SIRaTemplateMode {
|    <# PURE. The run mode a template's name states ('Detailed' / 'Summary'), or $null -- the same rule the RA entry point uses. #>
|    param([AllowNull()][AllowEmptyString()][string]$Template)
|    if ([string]::IsNullOrWhiteSpace($Template)) { return $null }
|    if ($Template -match '(?i)detailed') { return 'Detailed' }
|    if ($Template -match '(?i)summary') { return 'Summary' }
|    return $null
|}
|
|function Get-SIRiskAnalysisJobPlan {
|    <#
|        PURE. Every Risk Analysis job setup deploys, with its mode, report template and schedule:
|          risk-analysis           -- the Summary job: -SummaryTemplate when given explicitly, else the customer's
|                                     RiskAnalysis_ReportTemplate_Default_Summary (or ReportTemplate_Default_Summary), else
|                                     RiskAnalysis_Summary -- what the VM launcher runs when no template is named;
|          risk-analysis-detailed  -- the Detailed job: RiskAnalysis_ReportTemplate_Default_Detailed (or
|                                     ReportTemplate_Default_Detailed), else RiskAnalysis_Detailed;
|          extra jobs              -- SI_Bootstrap_RiskAnalysisJobs: a list of @{ Name; Mode; Template; Cron } (Mode may be
|                                     left out when the template's name states it). Job name caj-si-ra-<Name>.
|        An extra job that is not valid is refused with the reason, never deployed half-right.
|        Returns @{ Jobs = @(@{ Engine; JobShort; Mode; Template; Cron }); Refused = @(string) }.
|    #>
|    param([string[]]$Engines = @(), [hashtable]$Globals = @{}, [string]$SummaryTemplate, [string]$SummaryMode = 'Summary',
|          [string]$ScheduleSummary = '0 6 * * *', [string]$ScheduleDetailed = '0 8 * * *')
|    $gv = { param($n) if ($Globals.ContainsKey($n) -and -not [string]::IsNullOrWhiteSpace([string]$Globals[$n])) { ([string]$Globals[$n]).Trim() } else { $null } }
|    $jobs = New-Object System.Collections.Generic.List[object]
|    $refused = New-Object System.Collections.Generic.List[string]
|    if (@($Engines) -contains 'risk-analysis') {
|        $t = if (-not [string]::IsNullOrWhiteSpace($SummaryTemplate)) { $SummaryTemplate.Trim() }
|             elseif (& $gv 'RiskAnalysis_ReportTemplate_Default_Summary') { & $gv 'RiskAnalysis_ReportTemplate_Default_Summary' }
|             elseif (& $gv 'ReportTemplate_Default_Summary') { & $gv 'ReportTemplate_Default_Summary' }
|             else { 'RiskAnalysis_Summary' }
|        $m = Get-SIRaTemplateMode -Template $t; if (-not $m) { $m = if ($SummaryMode -ieq 'Detailed') { 'Detailed' } else { 'Summary' } }
|        $jobs.Add([pscustomobject]@{ Engine = 'risk-analysis'; JobShort = 'risk-analysis'; Mode = $m; Template = $t; Cron = $ScheduleSummary })
|    }
|    if (@($Engines) -contains 'risk-analysis-detailed') {
|        $t = if (& $gv 'RiskAnalysis_ReportTemplate_Default_Detailed') { & $gv 'RiskAnalysis_ReportTemplate_Default_Detailed' }
|             elseif (& $gv 'ReportTemplate_Default_Detailed') { & $gv 'ReportTemplate_Default_Detailed' }
|             else { 'RiskAnalysis_Detailed' }
|        $jobs.Add([pscustomobject]@{ Engine = 'risk-analysis-detailed'; JobShort = 'risk-analysis-detailed'; Mode = 'Detailed'; Template = $t; Cron = $ScheduleDetailed })
|    }
|    $extra = if ($Globals.ContainsKey('SI_Bootstrap_RiskAnalysisJobs')) { @($Globals['SI_Bootstrap_RiskAnalysisJobs'] | Where-Object { $null -ne $_ }) } else { @() }
|    $seen = @{}
|    foreach ($j in $extra) {
|        $get = { param($n) if ($j -is [System.Collections.IDictionary]) { if ($j.Contains($n)) { $j[$n] } else { $null } } else { $p = $j.PSObject.Properties[$n]; if ($p) { $p.Value } else { $null } } }
|        $name = "$(& $get 'Name')".Trim().ToLowerInvariant()
|        $tpl  = "$(& $get 'Template')".Trim()
|        $mode = "$(& $get 'Mode')".Trim()
|        $cron = "$(& $get 'Cron')".Trim(); if (-not $cron) { $cron = "$(& $get 'Schedule')".Trim() }
|        if ($name -notmatch '^[a-z0-9]([a-z0-9-]{0,20}[a-z0-9])?$') { $refused.Add(("extra Risk Analysis job '{0}': the name must be 1 to 22 lower-case letters, digits or '-' (the job is caj-si-ra-<name>)" -f $name)); continue }
|        if ($seen.ContainsKey($name)) { $refused.Add(("extra Risk Analysis job '{0}': the name is used twice" -f $name)); continue }
|        if ($cron -notmatch '^\S+(\s+\S+){4}$') { $refused.Add(("extra Risk Analysis job '{0}': Cron '{1}' is not a five-field cron expression (UTC)" -f $name, $cron)); continue }
|        $tplMode = Get-SIRaTemplateMode -Template $tpl
|        $modeNorm = if (-not $mode) { $null } elseif ($mode -ieq 'Summary') { 'Summary' } elseif ($mode -ieq 'Detailed') { 'Detailed' } else { 'bad' }
|        if ($modeNorm -eq 'bad') { $refused.Add(("extra Risk Analysis job '{0}': Mode '{1}' is not Summary or Detailed" -f $name, $mode)); continue }
|        if ($tplMode -and $modeNorm -and $tplMode -ne $modeNorm) { $refused.Add(("extra Risk Analysis job '{0}': template '{1}' is a {2} template but Mode is {3}" -f $name, $tpl, $tplMode, $modeNorm)); continue }
|        $final = if ($tplMode) { $tplMode } elseif ($modeNorm) { $modeNorm } else { $null }
|        if (-not $final) { $refused.Add(("extra Risk Analysis job '{0}': set Mode (Summary or Detailed) -- template '{1}' does not say which" -f $name, $tpl)); continue }
|        if (-not $tpl) { $tpl = 'RiskAnalysis_{0}' -f $final }
|        $seen[$name] = $true
|        $jobs.Add([pscustomobject]@{ Engine = ('ra-{0}' -f $name); JobShort = ('ra-{0}' -f $name); Mode = $final; Template = $tpl; Cron = $cron })
|    }
|    [pscustomobject]@{ Jobs = $jobs.ToArray(); Refused = $refused.ToArray() }
|}
|
|function Get-SIRaJobEnvArgs {
|    <#
|        PURE. A Risk Analysis job's own env vars. SI_RA_SEND_TO_LOG_ANALYTICS / SI_RA_BUILD_SUMMARY_BY_AI are written ONLY
|        when setup was told (-RiskAnalysisSendToLogAnalytics / -RiskAnalysisBuildSummaryByAI, or SI_RiskAnalysis_* in the
|        config): $null = not decided here, so the customer's own setting -- or the VM default (send to Log Analytics: ON)
|        -- decides in the container.
|    #>
|    param([Parameter(Mandatory)][string]$Template, [Parameter(Mandatory)][string]$Mode,
|          [AllowNull()][object]$SendToLogAnalytics = $null, [AllowNull()][object]$BuildSummaryByAI = $null, [string]$ExportDestination)
|    $a = New-Object System.Collections.Generic.List[string]
|    $a.Add("SI_RA_REPORT_TEMPLATE=$Template"); $a.Add("SI_RA_MODE=$Mode")
|    if ($null -ne $SendToLogAnalytics) { $a.Add(('SI_RA_SEND_TO_LOG_ANALYTICS={0}' -f [int][bool]$SendToLogAnalytics)) }
|    if ($null -ne $BuildSummaryByAI)   { $a.Add(('SI_RA_BUILD_SUMMARY_BY_AI={0}' -f [int][bool]$BuildSummaryByAI)) }
|    if (-not [string]::IsNullOrWhiteSpace($ExportDestination)) { $a.Add("SI_RA_EXPORT_DESTINATION=$ExportDestination") }
|    # #873 E: a 256 MB .NET gen0 budget (hex) -- fewer GC pauses while a slice's rows are scored; a runtime setting, no row
|    # changes (setup\_shared\SI-RaGcSetting.ps1 gives existing installs the same on every update; its queue worker copies it)
|    $a.Add('DOTNET_GCgen0size=10000000')
|    # Unrolled, never ', $array': Bootstrap appends with $envArgs += @(Get-SIRaJobEnvArgs ...), and a wrapped array became
|    # ONE element that az received as one argument joined by spaces -- the job's template read
|    # 'RiskAnalysis_Detailed SI_RA_MODE=Detailed SI_RA_EXPORT_DESTINATION=...' and both RA jobs failed (live 2026-10-04).
|    return $a.ToArray()
|}
|
|function Select-SIBootstrapEngines {
|    <#
|        PURE. The engines setup deploys. The privilege-tier classifier is left out when Azure OpenAI is not configured:
|        without it every role it classifies becomes Tier 99 (manual review), and that catalog would replace the shipped
|        one the profilers use. Returns @{ Engines; Note } -- Note is the one line setup prints, empty when nothing changed.
|    #>
|    param([string[]]$Engines = @(), [bool]$HaveOpenAi)
|    $list = @($Engines)
|    if (-not $HaveOpenAi -and $list -contains 'privilege-tier-classifier') {
|        return [pscustomobject]@{ Engines = @($list | Where-Object { $_ -ne 'privilege-tier-classifier' })
|            Note = 'The privilege-tier classifier job is not deployed: Azure OpenAI is not configured, and without it every role would be classified Tier 99 (manual review). The shipped tier catalog is used; configure Azure OpenAI and run setup again to add the job.' }
|    }
|    [pscustomobject]@{ Engines = $list; Note = '' }
|}
|
|function Test-SIAssetTaggingApply {
|    <#
|      PURE (#236). Does the setting switch asset tagging's WRITES on? Only a real true ($true, 'true', '1', 'yes',
|      'apply', any letter case). Everything else -- not set, empty, $false, 'false', 'report', a typo -- is report only:
|      a value nobody can read never writes to a customer's tenant.
|    #>
|    param([AllowNull()][object]$Value)
|    if ($null -eq $Value) { return $false }
|    if ($Value -is [bool]) { return [bool]$Value }
|    return ("$Value".Trim() -match '^(?i)(true|1|yes|apply)$')
|}
|
|function Get-SIVulnConnectorGroup {
|    <#
|        PURE (#269). Which connectors THIS vulnerability job drives, from its environment (SI_VULN_TARGET, set by
|        Bootstrap): 'Sql' (caj-si-asset-vulnerabilities -- the SQL connector, and REST connectors), 'ServiceNow'
|        (caj-si-asset-vulns-servicenow), or '' (no variable: every connector, as before the split). Any other value is ''.
|    #>
|    param([hashtable]$Environment)
|    $v = if ($Environment) { [string]$Environment['SI_VULN_TARGET'] } else { [string][Environment]::GetEnvironmentVariable('SI_VULN_TARGET') }
|    switch -Regex ($v.Trim()) { '^(?i)sql$' { 'Sql' } '^(?i)servicenow$' { 'ServiceNow' } default { '' } }
|}
|
|function Get-SIContainerEngineDispatch {
|    <#
|      PURE (#170). For an engine the container dispatches directly -- asset-trend (free) and the Pro engines
|      asset-correlation / asset-properties / asset-cmdb / asset-vulnerabilities / asset-datasync / close-loop-mail /
|      asset-tagging -- the script and the parameters, resolved from the
|      settings EXACTLY as each engine's VM launcher resolves them (same names, same defaults, same safe
|      fallbacks). Returns $null for engines that go through the profiling orchestrator. Returns
|      @{ Script; Args; Skip } -- Skip set when the engine is deliberately off (it then does nothing).
|      A Pro engine without a licence refuses with one line itself (Assert-SIFeatureOrSkip), as on a VM.
|      -Globals is a name -> value hashtable (the caller passes the live globals).
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [hashtable]$Globals = @{}, [hashtable]$Environment)
|    $g = { param($n) if ($Globals.ContainsKey($n)) { $Globals[$n] } else { $null } }
|    $int = { param($n) $v = & $g $n; if ($null -ne $v -and "$v" -match '^\d+$') { [int]"$v" } else { 0 } }
|    $a = @{}
|    switch ($Engine.ToLowerInvariant()) {
|        'asset-trend' {
|            $grain = "$(& $g 'SI_Trend_Grain')".Trim()
|            $a['Grain'] = if ($grain -in 'Summary', 'Detailed') { $grain } else { 'Summary' }
|            if ([bool](& $g 'SI_Trend_DryRun')) { $a['DryRun'] = $true }
|            return [pscustomobject]@{ Script = 'engine/asset-trend/Invoke-SITrend.ps1'; Args = $a; Skip = $null }
|        }
|        'asset-correlation' {
|            if ([bool](& $g 'SI_Correlation_DryRun')) { $a['DryRun'] = $true }
|            $rl = & $int 'SI_Correlation_RowLimit'; if ($rl -gt 0) { $a['RowLimit'] = $rl }
|            return [pscustomobject]@{ Script = 'engine/asset-correlation/Invoke-SICorrelation.ps1'; Args = $a; Skip = $null }
|        }
|        'asset-properties' {
|            # #412 RETIRED as a collection job: with SI_AssetProperties = 'full' the profilers read each source once and
|            # publish the full asset metadata themselves. A job an existing install still starts ends successfully, said.
|            return [pscustomobject]@{ Script = 'engine/asset-properties/Invoke-SIAssetProperties.ps1'; Args = $a
|                Skip = "skipped: asset-properties is retired -- with SI_AssetProperties = 'full' the endpoint, identity and azure profilers read each source once and publish the full asset metadata themselves; this job can be removed" }
|        }
|        'asset-cmdb' {
|            # Writing to a customer's CMDB is a deliberate act: only SI_Cmdb_Run = 'apply' switches it on. NO STEP OF THE FLOW
|            # RUNS IN WHATIF (owner 2026-10-23: "all enabled must be working in the flow. no whatiff") -- a hand-off that is
|            # not switched on has nothing to do, said plainly; it never plans in whatif as if it ran (live: the largest
|            # install's step ran "-Mode match-only -WhatIf True" every night with its ServiceNow connector off).
|            $run = "$(& $g 'SI_Cmdb_Run')".Trim().ToLowerInvariant()
|            if ($run -ne 'apply') {
|                return [pscustomobject]@{ Script = 'engine/asset-cmdb/Invoke-SICmdb.ps1'; Args = $a
|                    Skip = "the CMDB hand-off to ServiceNow is not switched on at this install (SI_Cmdb_Run = 'apply' switches it on)" }
|            }
|            $mode = "$(& $g 'SI_Cmdb_Mode')".Trim().ToLowerInvariant()
|            $a['Mode'] = if ($mode -in 'match-only', 'create-if-unmatched') { $mode } else { 'match-only' }
|            if ([bool](& $g 'SI_Cmdb_AllowCreate')) { $a['AllowCreate'] = $true }
|            $rl = & $int 'SI_Cmdb_RowLimit'; if ($rl -gt 0) { $a['RowLimit'] = $rl }
|            return [pscustomobject]@{ Script = 'engine/asset-cmdb/Invoke-SICmdb.ps1'; Args = $a; Skip = $null }
|        }
|        'asset-vulnerabilities' {
|            # The vulnerability close-loop (#216): the VM's `asset-cmdb launcher -Vulnerabilities`, as its own job, so
|            # a SQL-only install never needs the optional ServiceNow CMDB connector. Same safe defaults as the VM:
|            # 'plan' unless Run = apply; opening and closing are armed separately.
|            $script = 'engine/asset-cmdb/Invoke-SIVulnLoop.ps1'
|            # #269: TWO jobs drive the connectors -- caj-si-asset-vulnerabilities (SI_VULN_TARGET=Sql: the SQL connector,
|            # and any REST connector) and caj-si-asset-vulns-servicenow (SI_VULN_TARGET=ServiceNow). A job without the
|            # variable (an install not set up again since) drives every connector, exactly as before.
|            $group = Get-SIVulnConnectorGroup -Environment $Environment
|            if ($group) { $a['ConnectorGroup'] = $group }
|            $legacy = "$(& $g 'SI_VulnSync_Target')".Trim()
|            if ($group -and $legacy -in 'Sql', 'ServiceNow' -and $legacy -ne $group -and -not ("$(& $g 'SI_ProSqlServer')".Trim() -and "$(& $g 'SI_ProSqlDatabase')".Trim())) {
|                return [pscustomobject]@{ Script = $script; Args = $a
|                    Skip = ("this is the {0} connector's job, and this install's vulnerability target is {1} -- the {1} job runs it" -f $group, $legacy) }
|            }
|            if ("$(& $g 'SI_ProSqlServer')".Trim() -and "$(& $g 'SI_ProSqlDatabase')".Trim()) {
|                # Phase E: connectors live in the Pro database (cfg.Connector) and each carries its own Mode and
|                # AllowCreate / AllowClose, so the job arms nothing itself. Only an explicit SI_VulnSync_Run = 'plan'
|                # keeps every connector in whatif. No rows there = the engine says there is no target.
|                # The legacy SI_VulnSync_Target (still on every container job: SI_CFG_SI_VulnSync_Target=Sql) never decides
|                # here (live 2026-10-23: it sent every install with a Pro database down the legacy path, where no
|                # SI_VulnSync_Run = 'apply' meant WHATIF -- the connector said apply, nothing was ever written).
|                if ("$(& $g 'SI_VulnSync_Run')".Trim().ToLowerInvariant() -eq 'plan') { $a['WhatIf'] = $true }
|                return [pscustomobject]@{ Script = $script; Args = $a; Skip = $null }
|            }
|            if ("$(& $g 'SI_VulnSync_Target')".Trim() -notin 'Sql', 'ServiceNow') {
|                return [pscustomobject]@{ Script = $script; Args = $a
|                    Skip = "the vulnerability close-loop has no target: set SI_VulnSync_Target = 'Sql' or 'ServiceNow', or configure the Pro database (SI_ProSqlServer / SI_ProSqlDatabase) and add a connector, to enable it" }
|            }
|            $run = "$(& $g 'SI_VulnSync_Run')".Trim().ToLowerInvariant()
|            if (-not $run) { $run = "$(& $g 'SI_Cmdb_Run')".Trim().ToLowerInvariant() }
|            if ($run -ne 'apply') { $a['WhatIf'] = $true }
|            $create = & $g 'SI_VulnSync_AllowCreate'
|            if ($null -eq $create -or "$create" -eq '') { $create = & $g 'SI_Cmdb_AllowCreate' }
|            if ([bool]$create) { $a['AllowCreate'] = $true }
|            if ([bool](& $g 'SI_VulnSync_AllowClose')) { $a['AllowClose'] = $true }
|            return [pscustomobject]@{ Script = $script; Args = $a; Skip = $null }
|        }
|        'asset-datasync' {
|            # The Pro data backend (REQUIREMENTS §9.3.3 B): complete Risk Analysis collections -> the Pro database. Off,
|            # with the reason, until a Pro database is configured. The retention is read by the engine itself.
|            $script = 'engine/pro-data/Invoke-SIDataSync.ps1'
|            $srv = "$(& $g 'SI_Pro_DataSqlServer')".Trim(); if (-not $srv) { $srv = "$(& $g 'SI_ProSqlServer')".Trim() }
|            $db = "$(& $g 'SI_Pro_DataSqlDatabase')".Trim(); if (-not $db) { $db = "$(& $g 'SI_ProSqlDatabase')".Trim() }
|            if (-not $srv -or -not $db) {
|                return [pscustomobject]@{ Script = $script; Args = $a
|                    Skip = 'the Pro data backend has no database: set SI_ProSqlServer and SI_ProSqlDatabase to enable it' }
|            }
|            if ([bool](& $g 'SI_Pro_DataSync_DryRun')) { $a['DryRun'] = $true }
|            $lb = & $int 'SI_Pro_DataLookbackDays'; if ($lb -gt 0) { $a['LookbackDays'] = $lb }
|            return [pscustomobject]@{ Script = $script; Args = $a; Skip = $null }
|        }
|        'data-out' {
|            # #1038 (1): the data-out job (caj-si-data-out) -- the ServiceNow hand-off and the other outputs, from the newest
|            # collection the data sync marked ready. Off, with the reason, until a Pro database is configured (as the data sync).
|            $script = 'engine/data-out/Invoke-SIDataOutJob.ps1'
|            $srv = "$(& $g 'SI_Pro_DataSqlServer')".Trim(); if (-not $srv) { $srv = "$(& $g 'SI_ProSqlServer')".Trim() }
|            $db = "$(& $g 'SI_Pro_DataSqlDatabase')".Trim(); if (-not $db) { $db = "$(& $g 'SI_ProSqlDatabase')".Trim() }
|            if (-not $srv -or -not $db) {
|                return [pscustomobject]@{ Script = $script; Args = $a
|                    Skip = 'data out has no database: set SI_ProSqlServer and SI_ProSqlDatabase to enable it' }
|            }
|            return [pscustomobject]@{ Script = $script; Args = $a; Skip = $null }
|        }
|        'support-grant' {
|            # #1021: the support grant job (caj-si-support-grant) -- the Invardia Support app's database access, just in time,
|            # on a request on the queue si-support-requests. Never skipped here: without a Pro database it says so itself
|            # (its one SUPPORT-GRANT line, exit 2), so the Support session always reads an answer.
|            return [pscustomobject]@{ Script = 'engine/support-grant/Invoke-SISupportGrant.ps1'; Args = $a; Skip = $null }
|        }
|        'asset-cmdb-sql' {
|            # The SQL CMDB connector (#271): every CI into the Pro database's CI table. Off, with the reason, until a Pro
|            # database is configured or when SI_Pro_CmdbSql_Enabled is false. Its other settings are read by the engine.
|            $script = 'engine/asset-cmdb/Invoke-SICmdbSql.ps1'
|            $srv = "$(& $g 'SI_Pro_DataSqlServer')".Trim(); if (-not $srv) { $srv = "$(& $g 'SI_ProSqlServer')".Trim() }
|            $db = "$(& $g 'SI_Pro_DataSqlDatabase')".Trim(); if (-not $db) { $db = "$(& $g 'SI_ProSqlDatabase')".Trim() }
|            if (-not $srv -or -not $db) {
|                return [pscustomobject]@{ Script = $script; Args = $a
|                    Skip = 'the SQL CMDB connector has no database: set SI_ProSqlServer and SI_ProSqlDatabase to enable it' }
|            }
|            if ("$(& $g 'SI_Pro_CmdbSql_Enabled')".Trim().Trim('$') -match '^(?i)(false|0|no|off)$') {
|                return [pscustomobject]@{ Script = $script; Args = $a; Skip = 'the SQL CMDB connector is switched off (SI_Pro_CmdbSql_Enabled = false)' }
|            }
|            if ("$(& $g 'SI_Pro_CmdbSql_DryRun')".Trim().Trim('$') -match '^(?i)(true|1|yes|on)$') { $a['WhatIf'] = $true }
|            return [pscustomobject]@{ Script = $script; Args = $a; Skip = $null }
|        }
|        'close-loop-mail' {
|            # The close-loop's daily mail. Whether it sends (Mail_CloseLoop_Daily_SendMail / _To) is decided by the engine
|            # itself, after its licence gate -- off or without recipients it says so in one line and ends successfully.
|            return [pscustomobject]@{ Script = 'engine/asset-cmdb/Invoke-SICloseLoopMail.ps1'; Args = $a; Skip = $null }
|        }
|        'asset-tagging' {
|            # #236: asset tagging as a Pro job, under its OWN identity. REPORT ONLY unless the Pro setting
|            # SI_Pro_AssetTagging_Apply is on -- writing to the customer's Defender, Azure and Entra is a deliberate
|            # act, exactly like the CMDB's 'apply'. Only a real true turns it on: an empty, unknown or 'false' value
|            # keeps the run report-only.
|            # #643 (owner 2026-10-13: "tagging must be disabled by default. customer must enable it in settings"): the job
|            # runs at all only when the customer setting "Asset tagging" (SI_AssetTagging_Enabled) is a real true. Off = no
|            # rule is evaluated, nothing is planned, nothing is written. Writing stays the separate opt-in above.
|            if (-not (Test-SIAssetTaggingApply -Value (& $g 'SI_AssetTagging_Enabled'))) {
|                return [pscustomobject]@{ Script = 'engine/asset-tagging/Invoke-SIAssetTaggingJob.ps1'; Args = $a; Skip = 'asset tagging is off (the setting "Asset tagging", SI_AssetTagging_Enabled, is not on)' }
|            }
|            if (Test-SIAssetTaggingApply -Value (& $g 'SI_Pro_AssetTagging_Apply')) { $a['Apply'] = $true }
|            return [pscustomobject]@{ Script = 'engine/asset-tagging/Invoke-SIAssetTaggingJob.ps1'; Args = $a; Skip = $null }
|        }
|        'verification' {
|            # The verification service (docs/V3-DATA-MODEL.md 2.11): data-collection gaps, read-only toward Defender, Entra and
|            # Azure. Off, with the reason, until a Pro database is configured -- its findings and decisions live there.
|            $script = 'engine/verification/Invoke-SIVerification.ps1'
|            $srv = "$(& $g 'SI_Pro_DataSqlServer')".Trim(); if (-not $srv) { $srv = "$(& $g 'SI_ProSqlServer')".Trim() }
|            $db = "$(& $g 'SI_Pro_DataSqlDatabase')".Trim(); if (-not $db) { $db = "$(& $g 'SI_ProSqlDatabase')".Trim() }
|            if (-not $srv -or -not $db) {
|                return [pscustomobject]@{ Script = $script; Args = $a; Skip = 'the verification service has no database: set SI_ProSqlServer and SI_ProSqlDatabase to enable it' }
|            }
|            return [pscustomobject]@{ Script = $script; Args = $a; Skip = $null }
|        }
|        'config-backup' {
|            # #404 (CONFIG-1.3): the daily configuration backup (caj-si-config-backup), on its own timer outside the pipeline.
|            # Off, with the reason, until a Pro database is configured. The retention settings are read by the engine.
|            $script = 'engine/pro-settings/Invoke-SIConfigBackup.ps1'
|            if (-not "$(& $g 'SI_ProSqlServer')".Trim() -or -not "$(& $g 'SI_ProSqlDatabase')".Trim()) {
|                return [pscustomobject]@{ Script = $script; Args = $a; Skip = 'the configuration backup has no database: set SI_ProSqlServer and SI_ProSqlDatabase to enable it' }
|            }
|            return [pscustomobject]@{ Script = $script; Args = $a; Skip = $null }
|        }
|        'signin-methods' {
|            # the users' sign-in methods read in the background (caj-si-signin-methods), on its own timer outside the pipeline:
|            # Graph and its own tables only, never a lock of the pipeline or the updater. It decides itself what it can do (no
|            # database / the setting off = it says so and ends) and never fails.
|            return [pscustomobject]@{ Script = 'engine/signin-methods/Invoke-SISignInMethods.ps1'; Args = $a; Skip = $null }
|        }
|        'heartbeat' {
|            # #718: the hourly status report to Invardia (caj-si-heartbeat), on its own timer outside the pipeline. It decides
|            # itself what it may send (identified only; nothing from an anonymous install) and never fails.
|            return [pscustomobject]@{ Script = 'engine/heartbeat/Invoke-SIHeartbeat.ps1'; Args = $a; Skip = $null }
|        }
|        'flow' {
|            # #269: the daily job flow (caj-si-flow): starts the other jobs through ARM, one step after the other.
|            # Env SI_FLOW_FORCE / SI_FLOW_FROM_STEP / SI_FLOW_TRIGGER are read by the runner itself.
|            return [pscustomobject]@{ Script = 'engine/flow/Invoke-SIJobFlowRun.ps1'; Args = @{ HostKind = 'Container' }; Skip = $null }
|        }
|        'templates-publish' {
|            # #235: caj-si-templates -- MANUAL trigger only. The web app starts it after an Admin accepted a template
|            # release (or roll back) on Review & commit, with the EXACT accepted selection fingerprint in the execution's
|            # environment. Without one it does nothing; with one the publish refuses any other (-StrictJob: a blocked
|            # publish fails the job, so the page shows it as failed).
|            $script = 'setup/Publish-SITemplates.ps1'
|            if (-not $Environment) {
|                $Environment = @{}
|                foreach ($e in [Environment]::GetEnvironmentVariables().GetEnumerator()) { $Environment[[string]$e.Key] = [string]$e.Value }
|            }
|            $ev = { param($n) if ($Environment.ContainsKey($n) -and -not [string]::IsNullOrWhiteSpace([string]$Environment[$n])) { ([string]$Environment[$n]).Trim() } else { '' } }
|            $fp = & $ev 'SI_TEMPLATES_ACCEPT_FINGERPRINT'; $mode = (& $ev 'SI_TEMPLATES_MODE').ToLowerInvariant(); $pack = & $ev 'SI_TEMPLATES_PACK'
|            if ($fp -notmatch '^[0-9a-f]{64}$') {
|                return [pscustomobject]@{ Script = $script; Args = $a
|                    Skip = 'no accepted template release: this job is started from the web app''s Template releases page, with the fingerprint the Admin accepted' }
|            }
|            if ($mode -notin 'release', 'rollback' -or $pack -notmatch '^\d{1,6}(\.\d{1,12}){1,5}$') {
|                return [pscustomobject]@{ Script = $script; Args = $a; Skip = ("the template release request is incomplete (mode '{0}', version '{1}') -- nothing was published" -f $mode, $pack) }
|            }
|            $a['Apply'] = $true; $a['StrictJob'] = $true; $a['PassThru'] = $true; $a['AcceptFingerprint'] = $fp
|            if ($mode -eq 'rollback') { $a['RollbackToVersion'] = $pack } else { $a['FromStaged'] = $pack }
|            $methods = @((& $ev 'SI_TEMPLATES_METHODS') -split ';' | ForEach-Object { $_.Trim() } | Where-Object { $_ -and $_ -ne '*' })
|            if ($methods.Count) { $a['Method'] = $methods }
|            # #405: the one-click roll back of Microsoft content -- only that class's items
|            $cls = @((& $ev 'SI_TEMPLATES_CLASS') -split ';' | ForEach-Object { $_.Trim().ToLowerInvariant() } | Where-Object { $_ -in 'fix', 'default', 'microsoft' })
|            if ($cls.Count -and $mode -eq 'rollback') { $a['Class'] = $cls }
|            $by = & $ev 'SI_TEMPLATES_REQUESTED_BY'; if ($by) { $a['RequestedBy'] = $by }
|            return [pscustomobject]@{ Script = $script; Args = $a; Skip = $null }
|        }
|        default { return $null }
|    }
|}
|
|# ==================================================================================================================
|#  SIGN-IN (#209) -- managed identity > certificate (PFX from Key Vault) > client secret
|# ==================================================================================================================
|# An engine container could only sign in with an SPN client SECRET. Internal installs are certificate only and Pro is
|# container only, so a certificate-only customer could not run Pro at all. PIM's containers sign in as the job's
|# managed identity; SI now does the same, keeps the certificate (as the SI updater receives it), and KEEPS THE
|# SECRET: it is a required Community capability, and a Community job that has only the secret runs exactly as before.
|
|function Resolve-SIContainerAuthMode {
|    <#
|        PURE. How THIS container signs in, from its environment (-Environment: a name -> value hashtable; the
|        process environment by default).
|          ManagedIdentity -- IDENTITY_ENDPOINT (Container Apps injects it when the job has an identity) AND
|                             SI_UAMI_CLIENTID (Bootstrap names the user-assigned identity to use);
|          Certificate     -- SI_SPN_CERT_PFX_B64 (a Key Vault-referenced secret) + SI_SPN_APPID + SI_SPN_TENANTID;
|          Secret          -- SI_SPN_SECRET (unchanged; the Community default);
|          None            -- nothing usable (the entry point refuses with Reason).
|        Returns @{ Mode; ClientId; Reason }.
|    #>
|    param([hashtable]$Environment)
|    if (-not $Environment) {
|        $Environment = @{}
|        foreach ($e in [Environment]::GetEnvironmentVariables().GetEnumerator()) { $Environment[[string]$e.Key] = [string]$e.Value }
|    }
|    $get = { param($n) if ($Environment.ContainsKey($n) -and -not [string]::IsNullOrWhiteSpace([string]$Environment[$n])) { ([string]$Environment[$n]).Trim() } else { '' } }
|    $endpoint = & $get 'IDENTITY_ENDPOINT'
|    $uami     = & $get 'SI_UAMI_CLIENTID'
|    if ($endpoint -and $uami) {
|        return [pscustomobject]@{ Mode = 'ManagedIdentity'; ClientId = $uami; Reason = ("the job's user-assigned managed identity (client id {0})" -f $uami) }
|    }
|    $appId  = & $get 'SI_SPN_APPID'
|    $tenant = & $get 'SI_SPN_TENANTID'
|    if ((& $get 'SI_SPN_CERT_PFX_B64') -and $appId -and $tenant) {
|        return [pscustomobject]@{ Mode = 'Certificate'; ClientId = $appId; Reason = ('the SPN {0} by certificate (PFX from Key Vault)' -f $appId) }
|    }
|    if (& $get 'SI_SPN_SECRET') {
|        return [pscustomobject]@{ Mode = 'Secret'; ClientId = $appId; Reason = ('the SPN {0} by client secret' -f $appId) }
|    }
|    $why = if ($uami -and -not $endpoint) { 'SI_UAMI_CLIENTID is set but the job has no managed identity endpoint (IDENTITY_ENDPOINT) -- assign the identity to the job' }
|           else { 'no credential: set SI_UAMI_CLIENTID (managed identity), SI_SPN_CERT_PFX_B64 + SI_SPN_APPID + SI_SPN_TENANTID (certificate), or SI_SPN_SECRET (client secret)' }
|    [pscustomobject]@{ Mode = 'None'; ClientId = ''; Reason = $why }
|}
|
|function Resolve-SIBootstrapAuthChoice {
|    <#
|        PURE (Bootstrap side). Which sign-in the jobs get, and why. First match wins:
|          1. -UseManagedIdentity                                   -> ManagedIdentity
|          2. -CertificateKeyVaultName AND -CertificateSecretName   -> Certificate (half of it is an error, never a silent
|                                                                      fall back to another sign-in)
|          3. -UseClientSecret                                      -> Secret (a supported, explicit choice -- never removed)
|          4. SI_AuthMethod in the config: ManagedIdentity / Secret -> that one
|          5. the config carries an SPN client secret (an install set up with one -- SI_SPN_Secret, the 2.2 SI_Graph_Secret,
|             or a Key Vault secret name) and no SI_AuthMethod      -> Secret: an existing install keeps what its jobs
|                                                                      have; nothing changes under it by itself
|          6. otherwise                                             -> ManagedIdentity (the DEFAULT since 2026-10-07,
|                                                                      operator decision -- as the guided install does)
|        -UseClientSecret with -UseManagedIdentity or with a certificate is an error: pick one.
|        Returns @{ Mode; Reason; Default } -- Default $true when no switch and no SI_AuthMethod decided it.
|    #>
|    param([bool]$UseManagedIdentity = $false, [string]$CertificateKeyVaultName, [string]$CertificateSecretName,
|          [bool]$UseClientSecret = $false, [AllowEmptyString()][string]$ConfiguredMethod = '', [bool]$HasConfiguredSecret = $false)
|    $kv = -not [string]::IsNullOrWhiteSpace($CertificateKeyVaultName)
|    $cs = -not [string]::IsNullOrWhiteSpace($CertificateSecretName)
|    if ($kv -xor $cs) { throw 'Certificate sign-in needs BOTH -CertificateKeyVaultName and -CertificateSecretName (the Key Vault secret holding the SPN PFX).' }
|    $cert = $kv -and $cs
|    # -UseManagedIdentity wins over certificate settings (as it always has); a client secret next to either is an error.
|    if ($UseClientSecret -and ($UseManagedIdentity -or $cert)) {
|        throw 'Pick ONE sign-in for the jobs: -UseManagedIdentity, -UseClientSecret, or -CertificateKeyVaultName with -CertificateSecretName.'
|    }
|    $o = { param($m, $why, $def) [pscustomobject]@{ Mode = $m; Reason = $why; Default = [bool]$def } }
|    if ($UseManagedIdentity) { return (& $o 'ManagedIdentity' '-UseManagedIdentity' $false) }
|    if ($cert)               { return (& $o 'Certificate' '-CertificateKeyVaultName / -CertificateSecretName' $false) }
|    if ($UseClientSecret)    { return (& $o 'Secret' '-UseClientSecret' $false) }
|    $cfg = "$ConfiguredMethod".Trim()
|    if ($cfg -match '^(?i)(ManagedIdentity|MI|Identity)$')          { return (& $o 'ManagedIdentity' 'SI_AuthMethod = ManagedIdentity in the config' $false) }
|    if ($cfg -match '^(?i)(Secret|SpnSecret|ClientSecret)$')        { return (& $o 'Secret' 'SI_AuthMethod = Secret in the config' $false) }
|    if ($HasConfiguredSecret) { return (& $o 'Secret' 'the config carries an SPN client secret (an existing install keeps its sign-in)' $true) }
|    & $o 'ManagedIdentity' 'the default: a user-assigned managed identity' $true
|}
|
|# #475 -- KEDA BY DESIGN (operator 2026-10-08: "KEDA by design"; DESIGN.md 13): the collection engines that discover into
|# parts run as a producer + queue-scaled workers. Only these three can: discovery writes their parts and their workers run
|# from Collect on a part. Public IP (a handful of addresses), the classifier and the Pro engines stay one scheduled job each.
|$script:SIKedaPartsEngines = @('identity', 'endpoint', 'azure')
|
|function Test-SIKedaPartsEngine {
|    <# PURE. Whether an engine runs as producer + workers when queue scaling is on. #>
|    param([AllowEmptyString()][string]$Engine)
|    $script:SIKedaPartsEngines -contains ([string]$Engine).Trim().ToLowerInvariant()
|}
|
|function Resolve-SIBootstrapKedaChoice {
|    <#
|        PURE (Bootstrap side). Whether the collection engines run as producer + workers (KEDA), and what that does to the
|        jobs' sign-in. KEDA is ON BY DESIGN; the opt-out is explicit (-UseKEDA:$false, or SI_Bootstrap_UseKEDA = $false).
|        Queue scaling runs on the jobs' MANAGED IDENTITY (operator 2026-10-08: "use managed identity" -- the scaler signs in
|        with it, never with a storage key or a secret):
|          managed identity / certificate (both have the identity)  -> KEDA
|          a client secret the install merely CARRIES (no switch, no SI_AuthMethod -- Resolve-SIBootstrapAuthChoice
|            Default)                                                -> KEDA, and the jobs MOVE to the managed identity with
|                                                                       its grants applied (as -UseManagedIdentity
|                                                                       -GrantIdentityRoles); if a grant cannot be made, the
|                                                                       caller keeps the jobs as they are
|          a client secret CHOSEN explicitly (-UseClientSecret, SI_AuthMethod = Secret) -> no KEDA (the choice stands;
|                                                                       app-secret sign-in is a supported capability); an
|                                                                       EXPLICIT -UseKEDA with it is refused, as before
|        Returns @{ Keda; Explicit; MoveToManagedIdentity; Refuse; Message }.
|    #>
|    param([bool]$CliBound = $false, [bool]$CliValue = $false, $Configured, [Parameter(Mandatory)][string]$AuthMode, [bool]$AuthDefault = $false)
|    $o = { param($k, $x, $mv, $rf, $msg) [pscustomobject]@{ Keda = [bool]$k; Explicit = [bool]$x; MoveToManagedIdentity = [bool]$mv; Refuse = [bool]$rf; Message = [string]$msg } }
|    $cfgSet = ($null -ne $Configured -and "$Configured".Trim() -ne '')
|    $cfgVal = $false
|    if ($cfgSet) { if ($Configured -is [bool]) { $cfgVal = $Configured } else { $cfgVal = ("$Configured".Trim() -match '^(?i)(1|true|on|yes)$') } }
|    $explicit = $CliBound -or $cfgSet
|    $want = $true
|    if ($CliBound) { $want = $CliValue } elseif ($cfgSet) { $want = $cfgVal }
|    if (-not $want) {
|        return (& $o $false $explicit $false $false '[parts] queue scaling is switched off for this install (SI_Bootstrap_UseKEDA = $false / -UseKEDA:$false): identity, endpoint and Azure run as one scheduled job each.')
|    }
|    if ($AuthMode -ne 'Secret') {
|        return (& $o $true $explicit $false $false '[parts] identity, endpoint and Azure run as a producer and queue-scaled workers (KEDA), signed in as the jobs'' managed identity.')
|    }
|    if ($AuthDefault) {
|        return (& $o $true $explicit $true $false '[parts] queue scaling runs on the jobs'' managed identity: these jobs move from the client secret to the managed identity, with its grants -- if a grant cannot be made here, nothing changes and the missing grant is listed.')
|    }
|    if ($explicit) {
|        return (& $o $false $true $false $true 'Queue scaling (-UseKEDA) needs the jobs'' managed identity: the queue scaler signs in with it, never with a storage key. Use the managed identity or certificate sign-in (SI_AuthMethod), or leave -UseKEDA off.')
|    }
|    & $o $false $false $false $false '[parts] these jobs sign in with a client secret by choice (-UseClientSecret / SI_AuthMethod = Secret), and queue scaling needs the managed identity: identity, endpoint and Azure run as one scheduled job each.'
|}
|
|function Test-SIBootstrapJobIsSI {
|    <# PURE. A job SI's setup created (its si-build tag) -- only such a job may be replaced or removed by setup. #>
|    param($Job)
|    if ($null -eq $Job -or $null -eq $Job.tags) { return $false }
|    $names = @(); if ($Job.tags -is [System.Collections.IDictionary]) { $names = @($Job.tags.Keys) } else { $names = @($Job.tags.PSObject.Properties | ForEach-Object { $_.Name }) }
|    [bool](@($names | Where-Object { [string]$_ -eq 'si-build' }).Count)
|}
|
|function Get-SIBootstrapReplacedJobs {
|    <#
|        PURE. The jobs of ONE engine that the chosen layout replaces: with queue scaling on, the engine's scheduled job
|        caj-si-<engine> (the producer + worker take over); with it off, the engine's producer and worker. Never anything
|        else. Returns the job NAMES; the caller removes only those that exist and carry SI's si-build tag.
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][bool]$Keda)
|    $k = $Engine.Trim().ToLowerInvariant()
|    if (-not (Test-SIKedaPartsEngine $k)) { return @() }
|    if ($Keda) { return @("caj-si-$k") }
|    @("caj-si-$k-producer", "caj-si-$k-worker")
|}
|
|function Resolve-SIBootstrapAuthMode {
|    <# PURE (Bootstrap side). The jobs' sign-in mode (Resolve-SIBootstrapAuthChoice, Mode only). #>
|    param([bool]$UseManagedIdentity = $false, [string]$CertificateKeyVaultName, [string]$CertificateSecretName,
|          [bool]$UseClientSecret = $false, [AllowEmptyString()][string]$ConfiguredMethod = '', [bool]$HasConfiguredSecret = $false)
|    (Resolve-SIBootstrapAuthChoice -UseManagedIdentity $UseManagedIdentity -CertificateKeyVaultName $CertificateKeyVaultName `
|        -CertificateSecretName $CertificateSecretName -UseClientSecret $UseClientSecret -ConfiguredMethod $ConfiguredMethod `
|        -HasConfiguredSecret $HasConfiguredSecret).Mode
|}
|
|function Get-SIBootstrapRequiredSpnGlobals {
|    <# PURE. The SPN globals Bootstrap must find in the customer's config for a sign-in mode. #>
|    param([Parameter(Mandatory)][ValidateSet('Secret', 'ManagedIdentity', 'Certificate')][string]$Mode)
|    switch ($Mode) {
|        'Secret'          { return @('SI_SPN_AppId', 'SI_SPN_Secret', 'SI_SPN_TenantId', 'SI_SPN_ObjectId') }
|        'Certificate'     { return @('SI_SPN_AppId', 'SI_SPN_TenantId', 'SI_SPN_ObjectId') }
|        'ManagedIdentity' { return @() }   # the identity is Bootstrap's own; the tenant comes from the Az context
|    }
|}
|
|function Get-SIContainerJobAuthArgs {
|    <#
|        PURE (Bootstrap side). What each engine job carries to sign in. Returns @{ Mode; SecretArgs; EnvArgs;
|        IdentityResourceId } -- IdentityResourceId is the identity to ASSIGN to the job ($null for Secret).
|          Secret          -- si-spn-secret + SI_SPN_APPID / SI_SPN_SECRET=secretref / SI_SPN_TENANTID / SI_SPN_OBJECTID,
|                             EXACTLY what every job carried before #209;
|          ManagedIdentity -- no secret at all: SI_UAMI_CLIENTID + SI_SPN_TENANTID + SI_SPN_OBJECTID (the identity's
|                             principal id -- the object the DCR grants are made to);
|          Certificate     -- the SPN's PFX as a Key Vault REFERENCE (si-spn-cert, resolved by the assigned
|                             identity -- Bootstrap never reads the value), as Install-SIUpdaterJob.ps1 does.
|    #>
|    param(
|        [Parameter(Mandatory)][ValidateSet('Secret', 'ManagedIdentity', 'Certificate')][string]$Mode,
|        [string]$SpnAppId, [string]$SpnSecret, [string]$SpnTenantId, [string]$SpnObjectId,
|        [string]$IdentityClientId, [string]$IdentityPrincipalId, [string]$IdentityResourceId,
|        [string]$KeyVaultUri, [string]$CertificateSecretName
|    )
|    $need = { param($v, $n) if ([string]::IsNullOrWhiteSpace([string]$v)) { throw ("{0} sign-in: {1} is empty." -f $Mode, $n) } }
|    switch ($Mode) {
|        'Secret' {
|            return [pscustomobject]@{
|                Mode = $Mode; IdentityResourceId = $null
|                SecretArgs = @(('si-spn-secret={0}' -f $SpnSecret))
|                EnvArgs    = @("SI_SPN_APPID=$SpnAppId", 'SI_SPN_SECRET=secretref:si-spn-secret', "SI_SPN_TENANTID=$SpnTenantId", "SI_SPN_OBJECTID=$SpnObjectId")
|            }
|        }
|        'ManagedIdentity' {
|            & $need $IdentityClientId 'the identity client id'; & $need $IdentityResourceId 'the identity resource id'; & $need $SpnTenantId 'the tenant id'
|            return [pscustomobject]@{
|                Mode = $Mode; IdentityResourceId = $IdentityResourceId
|                SecretArgs = @()
|                EnvArgs    = @("SI_UAMI_CLIENTID=$IdentityClientId", "SI_SPN_TENANTID=$SpnTenantId", "SI_SPN_OBJECTID=$IdentityPrincipalId")
|            }
|        }
|        'Certificate' {
|            & $need $SpnAppId 'SI_SPN_AppId'; & $need $SpnTenantId 'SI_SPN_TenantId'; & $need $KeyVaultUri 'the Key Vault URI'
|            & $need $CertificateSecretName 'the certificate secret name'; & $need $IdentityResourceId 'the identity resource id'
|            $vault = ([string]$KeyVaultUri).TrimEnd('/') + '/'
|            return [pscustomobject]@{
|                Mode = $Mode; IdentityResourceId = $IdentityResourceId
|                SecretArgs = @(('si-spn-cert=keyvaultref:{0}secrets/{1},identityref:{2}' -f $vault, $CertificateSecretName, $IdentityResourceId))
|                EnvArgs    = @("SI_SPN_APPID=$SpnAppId", 'SI_SPN_CERT_PFX_B64=secretref:si-spn-cert', "SI_SPN_TENANTID=$SpnTenantId", "SI_SPN_OBJECTID=$SpnObjectId")
|            }
|        }
|    }
|}
|
|function Get-SIKedaQueueScaleArgs {
|    <#
|        PURE (Bootstrap side). The queue scale rule of a KEDA worker job (caj-si-<engine>-worker): the azure-queue
|        scaler on SI's own storage account, signed in as the job's MANAGED IDENTITY (--scale-rule-identity). Storage
|        is reached with an identity only -- a new account has shared-key access OFF -- so a scaler with no
|        identity could never read the queue length and the worker would never start. Same arguments on create and
|        on update, so an older worker gets the identity on the next run of setup.
|        No identity (the Secret sign-in) = refused: there is nothing the scaler could sign in as.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Engine,
|        [Parameter(Mandatory)][AllowEmptyString()][string]$StorageAccount,
|        [AllowEmptyString()][string]$IdentityResourceId,
|        # #742: a queue other than the parts engine's shard queue (the Risk Analysis work items, Get-SIRaScaleOutQueueName)
|        [string]$QueueName = ''
|    )
|    if ([string]::IsNullOrWhiteSpace($StorageAccount)) { throw 'Queue scaling needs SI_StorageAccount (the account that holds the shard queues).' }
|    if ([string]::IsNullOrWhiteSpace($IdentityResourceId)) {
|        throw 'Queue scaling (-UseKEDA) needs the jobs'' managed identity: the queue scaler signs in with it, never with a storage key. Use the managed identity or certificate sign-in (SI_AuthMethod), or leave -UseKEDA off.'
|    }
|    $q = if ($QueueName) { $QueueName } else { 'si-{0}-shards' -f $Engine }
|    return @(
|        '--scale-rule-name', 'si-shards-queue',
|        '--scale-rule-type', 'azure-queue',
|        '--scale-rule-metadata', ('queueName={0}' -f $q), ('accountName={0}' -f $StorageAccount), 'queueLength=1',
|        '--scale-rule-identity', $IdentityResourceId
|    )
|}
|
|# #1154 (framework §5.5, 2026-11-08): the support grant job caj-si-support-grant is STARTED BY ITS OWN QUEUE. The Invardia
|# Support app puts its request on si-support-requests (Storage Queue Data Message Sender on that one queue -- its ONLY right)
|# and the queue scaler starts the job, signed in as the ENGINE identity (identity only: shared-key access is off, #307). The
|# Support app holds no ARM right on any job any more: Microsoft.App/jobs/start/action alone accepts a container override, so
|# a start right would let it run its own command as the engine identity. One execution at a time; the scaler looks every
|# 10 seconds. The update's PATCH (setup\_shared\SI-SupportGrantUpdate.ps1 Get-SISupportGrantEventTriggerConfig) writes the
|# same trigger -- a test holds the two equal.
|$script:SISupportGrantTrigger = [ordered]@{ Queue = 'si-support-requests'; RuleName = 'si-support-requests'; MaxExecutions = 1; PollingInterval = 10 }
|
|function Get-SISupportGrantTriggerArgs {
|    <#
|        PURE. The trigger part of `az containerapp job create` for caj-si-support-grant: Event, the azure-queue scale rule on
|        si-support-requests in -StorageAccount, signed in as -IdentityResourceId (the engine identity), at most one execution.
|        Both are needed: no storage account or no identity throws (a queue scaler without an identity never reads the queue).
|    #>
|    param([AllowEmptyString()][string]$StorageAccount, [AllowEmptyString()][string]$IdentityResourceId)
|    if ([string]::IsNullOrWhiteSpace($StorageAccount)) { throw 'the support grant job is started by its queue: it needs SI_StorageAccount (the account that holds si-support-requests)' }
|    if ([string]::IsNullOrWhiteSpace($IdentityResourceId)) { throw 'the support grant job is started by its queue: the queue scaler signs in as the engine''s managed identity, and this job has none' }
|    $t = $script:SISupportGrantTrigger
|    @(
|        '--trigger-type', 'Event',
|        '--min-executions', '0',
|        '--max-executions', ([string]$t.MaxExecutions),
|        '--polling-interval', ([string]$t.PollingInterval),
|        '--scale-rule-name', $t.RuleName,
|        '--scale-rule-type', 'azure-queue',
|        '--scale-rule-metadata', ('queueName={0}' -f $t.Queue), ('accountName={0}' -f $StorageAccount.Trim()), 'queueLength=1',
|        '--scale-rule-identity', $IdentityResourceId.Trim()
|    )
|}
|
|function ConvertTo-SISupportGrantEventCreateArgs {
|    <#
|        PURE. A job's create arguments (a Manual or Schedule `az containerapp job create` list) with the trigger replaced by the
|        support grant job's queue trigger (Get-SISupportGrantTriggerArgs): --trigger-type and --cron-expression (with their
|        values) are dropped, the event trigger is added. Everything else is kept as it is. Throws as the trigger does.
|    #>
|    param([Parameter(Mandatory)][object[]]$CreateArgs, [AllowEmptyString()][string]$StorageAccount, [AllowEmptyString()][string]$IdentityResourceId)
|    $trigger = @(Get-SISupportGrantTriggerArgs -StorageAccount $StorageAccount -IdentityResourceId $IdentityResourceId)
|    $a = @($CreateArgs | ForEach-Object { [string]$_ })
|    $out = New-Object System.Collections.Generic.List[string]
|    $i = 0
|    while ($i -lt $a.Count) {
|        if ($a[$i] -in '--trigger-type', '--cron-expression') { $i += 2; continue }
|        $out.Add($a[$i]); $i++
|    }
|    @(@($out.ToArray()) + $trigger)
|}
|
|# #742 -- RISK ANALYSIS ON QUEUE WORKERS (engine/risk-analysis/_shared/RA-ScaleOut.ps1). The Detailed Risk Analysis job is the
|# run's PRODUCER; caj-si-raworker-detailed is its queue-scaled WORKER job (KEDA, the same identity, the producer's size). One
|# definition, used by Bootstrap for a new install and by every update for an existing one (setup/_shared/SI-RaWorkerJobs.ps1).
|$script:SIRaScaleOutEngines = @{ 'risk-analysis-detailed' = 'Detailed' }
|
|function Get-SIRaScaleOutGrain {
|    <# PURE. The grain whose reports run on queue workers for a Risk Analysis engine ('' = none: that job runs its reports
|       itself). The Detailed job only, for now (#742 increment 1). #>
|    param([AllowEmptyString()][string]$Engine)
|    $k = ([string]$Engine).Trim().ToLowerInvariant()
|    if ($script:SIRaScaleOutEngines.ContainsKey($k)) { return [string]$script:SIRaScaleOutEngines[$k] }
|    ''
|}
|
|function Get-SIRaScaleOutQueueName {
|    <# PURE. The work queue of a grain (RA-ScaleOut.ps1 Get-RAScaleOutQueueName -- the same name). #>
|    param([Parameter(Mandatory)][ValidateSet('Detailed', 'Summary')][string]$Grain)
|    'si-ra-{0}-items' -f $Grain.ToLowerInvariant()
|}
|
|function Get-SIRaWorkerJobName {
|    <# PURE. The worker job of a grain: 32 characters at most, and outside the caj-si-ra-<name> namespace of the extra
|       report jobs (RA-ScaleOut.ps1 Get-RAScaleOutWorkerJobName -- the same name). #>
|    param([Parameter(Mandatory)][ValidateSet('Detailed', 'Summary')][string]$Grain)
|    'caj-si-raworker-{0}' -f $Grain.ToLowerInvariant()
|}
|
|function Get-SIRaWorkerMaxExecutions {
|    <# PURE. How many workers run at once: SI_Bootstrap_RaMaxWorkers, default 4 (the advanced hunting service limits a
|       tenant's queries; four workers each running one report keep well inside them). #>
|    param([hashtable]$Globals = @{})
|    $n = 0
|    if ($Globals -and $Globals.ContainsKey('SI_Bootstrap_RaMaxWorkers') -and [int]::TryParse("$($Globals['SI_Bootstrap_RaMaxWorkers'])", [ref]$n) -and $n -gt 0) { return [Math]::Min(30, $n) }
|    4
|}
|
|function Get-SIRaScaleOutOptIn {
|    <#
|        PURE. THE RISK ANALYSIS WORKERS ARE ON BY DEFAULT WHERE THEY CAN RUN (owner 2026-10-18: "pls dont turn off things that
|        improve time, why do that"). The config's SI_Bootstrap_RaScaleOut, else SI_UPDATER_RA_SCALE_OUT on the updater job
|        (-UpdaterValue). Returns @{ On; Configured (a value was set -- on or off) }. Not set = ON: setup and every update give
|        the install the workers where queue scaling and the managed identity let them run. Only an explicit $false / off /
|        0 / no turns them off -- the customer's choice, always honoured.
|    #>
|    param([hashtable]$Globals = @{}, [AllowEmptyString()][string]$UpdaterValue = '')
|    $v = $null
|    if ($Globals -and $Globals.ContainsKey('SI_Bootstrap_RaScaleOut') -and $null -ne $Globals['SI_Bootstrap_RaScaleOut'] -and "$($Globals['SI_Bootstrap_RaScaleOut'])".Trim() -ne '') { $v = "$($Globals['SI_Bootstrap_RaScaleOut'])".Trim() }
|    elseif ("$UpdaterValue".Trim()) { $v = "$UpdaterValue".Trim() }
|    $off = ($null -ne $v -and $v -match '^(?i)(0|false|\$false|off|no|disabled?)$')
|    [pscustomobject]@{ On = (-not $off); Configured = ($null -ne $v) }
|}
|
|function Resolve-SIRaScaleOutChoice {
|    <#
|        PURE. Whether a Risk Analysis job hands its reports to a worker job: its grain has workers (Get-SIRaScaleOutGrain), the
|        install did not switch the workers off (SI_Bootstrap_RaScaleOut -- ON by default, Get-SIRaScaleOutOptIn), queue
|        scaling is on for the install (the KEDA choice -- the same rule as the collection engines) and the jobs sign in with
|        an identity the queue scaler can use. Returns @{ On; Grain; Reason; Configured }. Off = the job runs its reports
|        itself, as before; Reason is the one plain line that says why. Configured = the setting was given (on or off);
|        SwitchedOff = the customer switched the workers off (the only case in which setup removes a worker job).
|    #>
|    param([AllowEmptyString()][string]$Engine, [bool]$Keda, [AllowEmptyString()][string]$IdentityResourceId, [AllowEmptyString()][string]$StorageAccount, [hashtable]$Globals = @{})
|    $g = Get-SIRaScaleOutGrain -Engine $Engine
|    $opt = Get-SIRaScaleOutOptIn -Globals $Globals
|    $o = { param($on, $why) [pscustomobject]@{ On = [bool]$on; Grain = $g; Reason = [string]$why; Configured = [bool]$opt.Configured; SwitchedOff = (-not $opt.On) } }
|    if (-not $g) { return (& $o $false 'this Risk Analysis job runs its reports itself') }
|    if (-not $opt.On) { return (& $o $false 'Risk Analysis workers are switched off for this install (SI_Bootstrap_RaScaleOut = $false)') }
|    if (-not $Keda) { return (& $o $false 'queue scaling is off for this install, so the Risk Analysis reports run in their job') }
|    if (-not "$IdentityResourceId".Trim()) { return (& $o $false 'the jobs have no managed identity for the queue scaler, so the Risk Analysis reports run in their job') }
|    if (-not "$StorageAccount".Trim()) { return (& $o $false 'no storage account for the work queue, so the Risk Analysis reports run in their job') }
|    & $o $true ('the {0} reports run on queue workers ({1})' -f $g, (Get-SIRaWorkerJobName -Grain $g))
|}
|
|function Get-SIRaProducerScaleOutEnvArgs {
|    <# PURE. What makes a Risk Analysis job the producer of its worker job: SI_RA_SCALE_OUT=on and the worker job's name.
|       -Workers (#831): how many workers may run at once -- the SAME SI_RA_WORKERS its workers get, so the producer plans the
|       parts of a big report for the real worker count (none written when not given). #>
|    param([Parameter(Mandatory)][ValidateSet('Detailed', 'Summary')][string]$Grain, [int]$Workers = 0)
|    $w = @(); if ($Workers -gt 0) { $w = @('SI_RA_WORKERS={0}' -f $Workers) }
|    @('SI_RA_SCALE_OUT=on', ('SI_RA_WORKER_JOB={0}' -f (Get-SIRaWorkerJobName -Grain $Grain))) + $w
|}
|
|function Get-SIRaWorkerEnvArgs {
|    <#
|        PURE. The worker's environment from its producer's: the same settings, sign-in and Risk Analysis switches (it runs the
|        reports as the producer would), without the producer's own (SI_RA_SCALE_OUT / SI_RA_WORKER_JOB), with role ra and
|        SI_RA_SCALEOUT_ROLE=worker, and a fallback hold on a report longer than its replica (Get-SIKedaQueueLeaseEnvArgs).
|        -Workers: how many workers may run at once (SI_RA_WORKERS) -- each worker asks Defender for its SHARE of the parts one
|        Risk Analysis job may ask at a time (engine/risk-analysis/_shared/RA-PartsInParallel.ps1 Get-RAPartsInParallelShare).
|    #>
|    param([object[]]$EnvArgs = @(), [int]$ReplicaTimeout = 0, [int]$Workers = 0)
|    $w = @(); if ($Workers -gt 0) { $w = @('SI_RA_WORKERS={0}' -f $Workers) }
|    @(@($EnvArgs | Where-Object { [string]$_ -notmatch '^(SI_RA_SCALE_OUT|SI_RA_WORKER_JOB|SI_RA_SCALEOUT_ROLE|SI_RA_WORKERS|SI_ROLE|SI_TRIGGER_FROM_QUEUE|SI_QUEUE_LEASE_SECONDS)=' }) +
|      @('SI_ROLE=ra', 'SI_RA_SCALEOUT_ROLE=worker') + $w + @(Get-SIKedaQueueLeaseEnvArgs -ReplicaTimeout $ReplicaTimeout))
|}
|
|# #519 -- THE PRODUCER + WORKER JOBS, ONE DEFINITION: Bootstrap creates them for a new install, and every update
|# (setup\_shared\SI-KedaConvert.ps1) creates the same jobs for an install made before queue scaling. Both call these.
|function Get-SIKedaQueueName {
|    <# PURE. The shard queue of a parts engine: what the producer writes, the workers read and the scaler counts. #>
|    param([Parameter(Mandatory)][string]$Engine)
|    'si-{0}-shards' -f $Engine.Trim().ToLowerInvariant()
|}
|
|function Get-SIKedaQueueLeaseEnvArgs {
|    <# PURE. A KEDA worker's shard lease must outlive its replica, or a second worker takes a shard still being processed.
|       Never above 7 days (604800 s): a storage queue refuses a longer lease. #>
|    param([int]$ReplicaTimeout)
|    if ($ReplicaTimeout -gt 3600) { return @(('SI_QUEUE_LEASE_SECONDS={0}' -f [Math]::Min(604800, $ReplicaTimeout + 300))) }
|    return @()
|}
|
|function Get-SIKedaProducerEnvArgs {
|    <#
|        PURE. #475: the producer DISCOVERS once into parts (SI_PRODUCER_DISCOVERS=1), writes the manifest and one message per
|        part, and hands discovery's records over -- it runs the engine, so it carries the worker's whole environment
|        (configuration, sign-in, licence, guard), without the worker's queue-only settings, as role 'producer'.
|    #>
|    param([object[]]$EnvArgs = @(), [int]$Parallelism = 1)
|    @(@($EnvArgs | Where-Object { [string]$_ -notmatch '^(SI_TRIGGER_FROM_QUEUE|SI_ROLE|SI_QUEUE_LEASE_SECONDS|SI_SHARD_COUNT)=' }) + @(
|        'SI_ROLE=producer',
|        'SI_PRODUCER_DISCOVERS=1',
|        "SI_SHARD_COUNT=$Parallelism"
|    ))
|}
|
|function Get-SIKedaWorkerCreateArgs {
|    <#
|        PURE. `az containerapp job create` for a KEDA worker (caj-si-<engine>-worker): event-triggered with the queue scale
|        rule (Get-SIKedaQueueScaleArgs). --replica-completion-count 1: each replica is one work-item; --parallelism is the
|        per-execution cap; KEDA polls and starts one execution per <queueLength> messages above 0, at most -MaxExecutions.
|        The caller adds tags, registry, identity, secrets and env.
|    #>
|    param([Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$ResourceGroup, [Parameter(Mandatory)][string]$Environment,
|          [Parameter(Mandatory)][string]$Image, [Parameter(Mandatory)][string]$LoginServer, [Parameter(Mandatory)][int]$ReplicaTimeout,
|          [Parameter(Mandatory)][string]$Cpu, [Parameter(Mandatory)][string]$Memory, [int]$MaxExecutions = 30,
|          [Parameter(Mandatory)][string]$Engine, [AllowEmptyString()][string]$StorageAccount, [AllowEmptyString()][string]$IdentityResourceId,
|          [string]$QueueName = '')
|    @(
|        'containerapp','job','create',
|        '--name',$Name,
|        '--resource-group',$ResourceGroup,
|        '--environment',$Environment,
|        '--trigger-type','Event',
|        '--replica-timeout',"$ReplicaTimeout",
|        '--replica-retry-limit','0',
|        '--replica-completion-count','1',
|        '--parallelism','1',
|        '--min-executions','0',
|        '--max-executions',"$MaxExecutions",
|        '--polling-interval','30',
|        '--image',$Image,
|        '--registry-server',$LoginServer,
|        '--cpu',$Cpu,
|        '--memory',$Memory,
|        '--output','none'
|    ) + @(Get-SIKedaQueueScaleArgs -Engine $Engine -StorageAccount $StorageAccount -IdentityResourceId $IdentityResourceId -QueueName $QueueName)
|}
|
|function Get-SIKedaProducerCreateArgs {
|    <#
|        PURE. `az containerapp job create` for a KEDA producer (caj-si-<engine>-producer): cron-triggered, one replica that
|        discovers and queues the parts. The caller adds tags, registry, identity, secrets and env.
|        SIZE: the ENGINE's size -- -Cpu / -Memory / -ReplicaTimeout as the tenant-sized rule gives the engine's job at install
|        (Get-SIContainerJobResources: up to 4 CPU / 8 GiB, the longest run limit Azure takes), or the old job's at a conversion.
|        Default (no size given) = the floor every SI job gets, 2 CPU / 4 GiB, that run limit -- NOT a small replica: the identity producer also
|        runs the tenant-wide permission scan (role assignments, PIM for groups, transitive memberships) before it queues; on
|        0.25 CPU / 0.5 GiB and 10 min it was killed out of memory (exit 137) on internal ring 1, 2026-10-10. The update's job
|        sizing raises its CPU and memory further after an out-of-memory run (setup/_shared/SI-JobSizing.ps1).
|        No run limit given = the one every engine job gets (Get-SIJobRunLimit); a limit given (the customer's own, the old job's) is used as it is.
|    #>
|    param([Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$ResourceGroup, [Parameter(Mandatory)][string]$Environment,
|          [Parameter(Mandatory)][string]$Cron, [Parameter(Mandatory)][string]$Image, [Parameter(Mandatory)][string]$LoginServer,
|          [string]$Cpu = '2.0', [string]$Memory = '4.0Gi', [int]$ReplicaTimeout = 0)
|    if (-not "$Cpu".Trim()) { $Cpu = '2.0' }; if (-not "$Memory".Trim()) { $Memory = '4.0Gi' }; if ($ReplicaTimeout -le 0) { $ReplicaTimeout = [int](Get-SIJobRunLimit) }
|    @(
|        'containerapp','job','create',
|        '--name',$Name,
|        '--resource-group',$ResourceGroup,
|        '--environment',$Environment,
|        '--trigger-type','Schedule',
|        '--replica-timeout',"$ReplicaTimeout",
|        '--replica-retry-limit','0',
|        '--replica-completion-count','1',
|        '--parallelism','1',
|        '--cron-expression',$Cron,
|        '--image',$Image,
|        '--registry-server',$LoginServer,
|        '--cpu',$Cpu,
|        '--memory',$Memory,
|        '--output','none'
|    )
|}
|
|# The application permissions the engines USE, read only. Derived from the earlier permission script's catalog (the SPN's
|# required catalog) and the engine code: /users, /devices, /groups/{id}/transitiveMembers, /servicePrincipals (+
|# appRoleAssignments, oauth2PermissionGrants), /directoryObjects/getByIds, /directory/deletedItems,
|# /roleManagement/directory/*, /identityGovernance/privilegedAccess/group/*, /reports/authenticationMethods/*,
|# /users/{id}/authentication/methods (passwordless-only accounts, UserAuthenticationMethod.Read.All -- read only, #549),
|# /security/runHuntingQuery, api.securitycenter.microsoft.com/api/machines, api.securitycenter.microsoft.com/api/vulnerabilities (the exploit
|# details of a CVE for the vulnerability findings, Vulnerability.Read.All -- read only), api.securitycenter.microsoft.com/api/recommendations (the exposure impact
|# and active alert of a Defender recommendation, SecurityRecommendation.Read.All -- read only), /deviceManagement/managedDevices (Intune serial numbers and
|# MAC addresses for the full asset details, DeviceManagementManagedDevices.Read.All -- read only),
|# /deviceManagement/deviceCompliancePolicies and /deviceManagement/deviceConfigurations (which compliance policies a device does
|# not meet, its update ring, DeviceManagementConfiguration.Read.All -- read only),
|# /identityGovernance/accessReviews/definitions (the last access review of a privileged role, group or application,
|# AccessReview.Read.All -- read only), /security/alerts_v2 (the OPEN alerts per device: how many, the highest severity,
|# the newest one -- SecurityAlert.Read.All -- read only), /security/secureScores (the latest Microsoft Secure Score for the
|# hourly status report, SecurityEvents.Read.All -- read only, owner 2026-10-16) and api.securitycenter.microsoft.com/api/exposureScore
|# (the Defender exposure score for the same report, Score.Read.All -- read only).
|# LOCKED: READ ONLY AT COLLECTION. Machine.Read.All, never Machine.ReadWrite.All. Tag WRITES belong to the asset-tagging
|# job (caj-si-asset-tagging, #236), which runs under its OWN user-assigned identity with its own, opt-in grant plan
|# (Get-SIAssetTaggingIdentityGrantPlan below) -- never under this collection identity. Nothing here may contain Write.
|$script:SIContainerIdentityAppRoles = @(
|    [pscustomobject]@{ Resource = 'Microsoft Graph'; ResourceAppId = '00000003-0000-0000-c000-000000000000'; Roles = @(
|        'User.Read.All', 'Group.Read.All', 'Directory.Read.All', 'Device.Read.All', 'Application.Read.All',
|        'AuditLog.Read.All', 'Policy.Read.All', 'RoleManagement.Read.All', 'RoleManagement.Read.Directory',
|        'RoleManagementPolicy.Read.Directory', 'RoleEligibilitySchedule.Read.Directory', 'RoleAssignmentSchedule.Read.Directory',
|        'PrivilegedAccess.Read.AzureADGroup', 'IdentityRiskyUser.Read.All', 'IdentityRiskEvent.Read.All',
|        'IdentityRiskyServicePrincipal.Read.All', 'ThreatHunting.Read.All', 'UserAuthenticationMethod.Read.All', 'DeviceManagementManagedDevices.Read.All', 'DeviceManagementConfiguration.Read.All', 'AccessReview.Read.All', 'SecurityAlert.Read.All', 'SecurityEvents.Read.All') }
|    [pscustomobject]@{ Resource = 'Microsoft Threat Protection'; ResourceAppId = '8ee8fdad-f234-4243-8f3b-15c294843740'; Roles = @('AdvancedHunting.Read.All') }
|    [pscustomobject]@{ Resource = 'WindowsDefenderATP'; ResourceAppId = 'fc780465-2017-40d4-a0c5-307022471b92'; Roles = @('Machine.Read.All', 'Vulnerability.Read.All', 'SecurityRecommendation.Read.All', 'Score.Read.All') }
|)
|
|function Get-SIEnvironmentLogSettingBody {
|    <#
|        PURE (#220). The diagnostic setting that sends a Container Apps environment's console + system logs to the
|        install's own SI workspace (the environment is created with --logs-destination azure-monitor, so no workspace
|        key is ever handed to it, and Azure does not create a stray workspace of its own).
|    #>
|    param([Parameter(Mandatory)][string]$WorkspaceResourceId)
|    @{ properties = @{ workspaceId = $WorkspaceResourceId; logs = @(
|        @{ category = 'ContainerAppConsoleLogs'; enabled = $true },
|        @{ category = 'ContainerAppSystemLogs'; enabled = $true }) } } | ConvertTo-Json -Depth 5 -Compress
|}
|
|function Get-SIContainerRaMailPlan {
|    <#
|        PURE (#218). Does the customer's config switch Risk Analysis mail ON, and does that mail need the SMTP password?
|        Mail is wanted when any send switch is true -- the per-mode ones (RiskAnalysis_Summary_SendMail /
|        RiskAnalysis_Detailed_SendMail, and their legacy Mail_SecurityInsight_* names) or the global SendMail.
|        Authenticated SMTP (Mail_SendAnonymous not true) needs the password, which never travels as a plain setting:
|        without it the Risk Analysis engine refuses to start ("SMTP PRE-FLIGHT FAILED").
|        Returns @{ Wanted; NeedsPassword }.
|    #>
|    param([hashtable]$Globals = @{})
|    $g = { param($n) if ($Globals.ContainsKey($n)) { $Globals[$n] } else { $null } }
|    $wanted = $false
|    foreach ($n in 'RiskAnalysis_Summary_SendMail', 'RiskAnalysis_Detailed_SendMail',
|                   'Mail_SecurityInsight_Summary_SendMail', 'Mail_SecurityInsight_Detailed_SendMail', 'SendMail') {
|        $v = & $g $n
|        if ($null -ne $v -and "$v" -ne '' -and "$v" -notin '0', 'false', 'False', 'no') { if ([bool]$v) { $wanted = $true } }
|    }
|    $anon = & $g 'Mail_SendAnonymous'
|    $isAnon = ($null -ne $anon -and "$anon" -in '1', 'true', 'True', 'yes') -or ($anon -is [bool] -and $anon)
|    # MAIL-1: only an SMTP relay has a password; the shared mailbox (Graph, the job's identity) and 'none' never do
|    $notSmtp = "$(& $g 'SI_Mail_Mode')".Trim() -match '^(?i)(sharedmailbox|shared|graph|none|off|disabled)$'
|    [pscustomobject]@{ Wanted = $wanted; NeedsPassword = ($wanted -and -not $isAnon -and -not $notSmtp) }
|}
|
|function Get-SICloseLoopMailSchedule {
|    <#
|        PURE. The close-loop daily mail job's cron, from Mail_CloseLoop_Daily_SendTimeUtc (HH:mm, UTC). Empty -> 10:45,
|        after the close-loop (10:00) and the data backend sync (10:30). A value that is not HH:mm -> 10:45 too, with the
|        reason in Note so setup can say so. Returns @{ Cron; TimeUtc; Note }.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$SendTimeUtc)
|    $t = "$SendTimeUtc".Trim()
|    $note = ''
|    if ($t -notmatch '^([01][0-9]|2[0-3]):([0-5][0-9])$') {
|        if ($t) { $note = ("Mail_CloseLoop_Daily_SendTimeUtc '{0}' is not a time of day as HH:mm (UTC) -- using 10:45" -f $t) }
|        $t = '10:45'
|        [void]($t -match '^([01][0-9]|2[0-3]):([0-5][0-9])$')
|    }
|    $cron = '{0} {1} * * *' -f [int]$Matches[2], [int]$Matches[1]
|    [pscustomobject]@{ Cron = $cron; TimeUtc = $t; Note = $note }
|}
|
|function Get-SIContainerCloseLoopMailPlan {
|    <#
|        PURE. What setup wires for the close-loop daily mail job, from the customer's config (-Globals).
|          Wanted        -- Mail_CloseLoop_Daily_SendMail is on in the config. (The switch may also be turned on later in
|                           the web app, which setup does not read -- so the relay is wired whenever it is configured.)
|          NeedsPassword -- an SMTP server is configured and the relay is not anonymous: the job then gets the SMTP
|                           password as a Key Vault reference, exactly as the Risk Analysis jobs do.
|          Schedule      -- Get-SICloseLoopMailSchedule of Mail_CloseLoop_Daily_SendTimeUtc.
|    #>
|    param([hashtable]$Globals = @{})
|    $g = { param($n) if ($Globals.ContainsKey($n)) { $Globals[$n] } else { $null } }
|    $on = & $g 'Mail_CloseLoop_Daily_SendMail'
|    $wanted = ($on -is [bool] -and $on) -or ("$on".Trim() -in '1', 'true', 'True', 'yes')
|    $anon = & $g 'Mail_SendAnonymous'
|    $isAnon = ($anon -is [bool] -and $anon) -or ("$anon".Trim() -in '1', 'true', 'True', 'yes')
|    $hasSmtp = -not [string]::IsNullOrWhiteSpace([string](& $g 'SmtpServer'))
|    # MAIL-1: only an SMTP relay has a password; the shared mailbox (Graph, the job's identity) and 'none' never do
|    if ("$(& $g 'SI_Mail_Mode')".Trim() -match '^(?i)(sharedmailbox|shared|graph|none|off|disabled)$') { $hasSmtp = $false }
|    [pscustomobject]@{ Wanted = [bool]$wanted; NeedsPassword = ($hasSmtp -and -not $isAnon)
|                       Schedule = (Get-SICloseLoopMailSchedule -SendTimeUtc ([string](& $g 'Mail_CloseLoop_Daily_SendTimeUtc'))) }
|}
|
|function Get-SIKeyVaultSecretArg {
|    <#
|        PURE. A job secret '<Alias>=...': a Key Vault REFERENCE resolved by the job's identity when a vault and an
|        identity are known -- the value never passes through setup; else the configured value, as before; else $null
|        (the engine then runs without the feature and says so). Used for the Shodan key (#185) and the Azure OpenAI
|        key (#215): setup cannot read either value -- the config pulls them through a platform context setup does not have.
|    #>
|    param([Parameter(Mandatory)][string]$Alias, [string]$VaultUri, [string]$SecretName, [string]$IdentityResourceId, [string]$Value)
|    if (-not [string]::IsNullOrWhiteSpace($VaultUri) -and -not [string]::IsNullOrWhiteSpace($IdentityResourceId) -and -not [string]::IsNullOrWhiteSpace($SecretName)) {
|        $u = if ($VaultUri.EndsWith('/')) { $VaultUri } else { $VaultUri + '/' }
|        return ('{0}=keyvaultref:{1}secrets/{2},identityref:{3}' -f $Alias, $u, $SecretName, $IdentityResourceId)
|    }
|    if (-not [string]::IsNullOrWhiteSpace($Value)) { return ('{0}={1}' -f $Alias, $Value) }
|    $null
|}
|
|function Get-SIShodanSecretArg {
|    <# PURE. The publicip job's `shodan-key` secret (#185) -- see Get-SIKeyVaultSecretArg. #>
|    param([string]$VaultUri, [string]$SecretName = 'SI-Shodan-ApiKey', [string]$IdentityResourceId, [string]$Value)
|    Get-SIKeyVaultSecretArg -Alias 'shodan-key' -VaultUri $VaultUri -SecretName $SecretName -IdentityResourceId $IdentityResourceId -Value $Value
|}
|
|function Resolve-SIJobKeyVaultSecret {
|    <#
|        PURE. A job secret that is a Key Vault REFERENCE only when the secret is actually IN the vault. Container Apps
|        resolves every reference when the job is created or updated, so a reference to a secret the vault does not hold
|        fails the whole job (live 2026-10-06: a new install's vault had no Shodan key -- an optional paid entitlement --
|        and caj-si-publicip was never created).
|          -VaultSecretNames  the names the vault holds; $null = they could not be read from here (unknown).
|          -Required          the job cannot run without it: absent = a clear failure (throw), never a broken job.
|        Returns @{ SecretArg; Status = Reference | Value | Omitted; Message }. Omitted = the job runs without the
|        feature and the engine says so in its log; Message says why, for setup to print.
|    #>
|    param([Parameter(Mandatory)][string]$Alias, [string]$VaultName, [string]$VaultUri, [string]$SecretName,
|          [string]$IdentityResourceId, [string]$Value, [AllowNull()][string[]]$VaultSecretNames, [switch]$Required,
|          [string]$Feature = $Alias)
|    $haveRef = -not [string]::IsNullOrWhiteSpace($VaultUri) -and -not [string]::IsNullOrWhiteSpace($IdentityResourceId) -and -not [string]::IsNullOrWhiteSpace($SecretName)
|    $haveValue = -not [string]::IsNullOrWhiteSpace($Value)
|    $vaultLabel = if ($VaultName) { $VaultName } else { $VaultUri }
|    $why = $null
|    if ($haveRef) {
|        # Key Vault secret names are case-insensitive; -contains on strings is too.
|        $known = ($null -ne $VaultSecretNames)
|        if ($known -and (@($VaultSecretNames) -contains $SecretName)) {
|            return [pscustomobject]@{ SecretArg = (Get-SIKeyVaultSecretArg -Alias $Alias -VaultUri $VaultUri -SecretName $SecretName -IdentityResourceId $IdentityResourceId); Status = 'Reference'; Message = $null }
|        }
|        if (-not $known -and $Required) {
|            # A required secret whose presence cannot be checked from here keeps its reference: the job's own
|            # identity may read what setup cannot, and Container Apps reports the reference if it is wrong.
|            return [pscustomobject]@{ SecretArg = (Get-SIKeyVaultSecretArg -Alias $Alias -VaultUri $VaultUri -SecretName $SecretName -IdentityResourceId $IdentityResourceId); Status = 'Reference'
|                Message = ("could not list the secrets of Key Vault '{0}' from here -- '{1}' ({2}) is referenced unchecked." -f $vaultLabel, $SecretName, $Feature) }
|        }
|        $why = if ($known) { "Key Vault '{0}' holds no secret '{1}'" -f $vaultLabel, $SecretName }
|               else { "the secrets of Key Vault '{0}' could not be listed from here, so '{1}' could not be confirmed" -f $vaultLabel, $SecretName }
|    } else {
|        $why = if ([string]::IsNullOrWhiteSpace($VaultUri)) { 'no Key Vault is known for it' } else { 'the jobs have no identity to read the Key Vault with' }
|    }
|    if ($haveValue) { return [pscustomobject]@{ SecretArg = ('{0}={1}' -f $Alias, $Value); Status = 'Value'; Message = $null } }
|    if ($Required) {
|        throw ("{0} is required, but {1} and no value is configured. Store it in Key Vault secret '{2}' (vault '{3}') and re-run setup." -f $Feature, $why, $SecretName, $vaultLabel)
|    }
|    [pscustomobject]@{ SecretArg = $null; Status = 'Omitted'
|        Message = ("{0}: {1} -- the job is set up without it and runs without {0} (its log says so). Store the secret and re-run setup to add it." -f $Feature, $why) }
|}
|
|function Get-SIContainerIdentityGrantPlan {
|    <#
|        PURE. What the jobs' identity must hold. Returns one row per grant:
|          @{ Kind = 'AzureRole'; Role; Scope; Why }  or  @{ Kind = 'AppRole'; Role; Resource; ResourceAppId; Why }
|        ManagedIdentity -- the identity IS the engine: Reader at the collection scope(s), Monitoring Metrics Publisher
|                           on the DCR resource group, Log Analytics Reader on the workspace(s), the storage data roles
|                           on SI's own account, and the read-only application permissions above.
|        Certificate     -- the identity only resolves the PFX reference: Key Vault Secrets User on that vault. The
|                           SPN keeps the grants it already has.
|        A scope that is not known is left out (and the caller says so).
|    #>
|    param(
|        [Parameter(Mandatory)][ValidateSet('ManagedIdentity', 'Certificate')][string]$Mode,
|        [string[]]$ReaderScopes = @(),
|        [string]$DcrResourceGroupId,
|        [string]$WorkspaceResourceId,
|        [string]$DefenderWorkspaceResourceId,
|        [string]$StorageAccountId,
|        [string]$KeyVaultId,
|        [string]$AcrRegistryId,
|        [string]$ShodanKeyVaultId,
|        [string]$OpenAIKeyVaultId,
|        [string]$SmtpKeyVaultId,
|        [string]$LicenceKeyVaultId,
|        # KEDA worker jobs: the queue scaler signs in as the identity, so in Certificate mode (where the identity
|        # otherwise only resolves the PFX) it needs to read the shard queues too. ManagedIdentity already has it.
|        [switch]$KedaQueueScaler
|    )
|    $plan = New-Object System.Collections.Generic.List[object]
|    # #185 / #215 / #218: the identity resolves the Shodan key, the Azure OpenAI key and the SMTP password references
|    # (both modes). One grant per vault: a vault that is also the certificate vault is granted below with it.
|    # The licence: the Pro engines read the SI-License secret from the install's vault at run time, so a renewed or
|    # replaced licence is in force on the next run (a copy in the job went stale -- found live 2026-10-03).
|    $kvSeen = @($KeyVaultId)
|    foreach ($kv in @(@{ Id = $ShodanKeyVaultId; Why = 'resolve the Shodan key (Key Vault reference) when the publicip job starts' },
|                      @{ Id = $OpenAIKeyVaultId; Why = 'resolve the Azure OpenAI key (Key Vault reference) for AI classification' },
|                      @{ Id = $SmtpKeyVaultId;   Why = 'resolve the SMTP password (Key Vault reference) for the Risk Analysis and close-loop mail' },
|                      @{ Id = $LicenceKeyVaultId; Why = 'read the SecurityInsight licence (SI-License) when a job starts' })) {
|        if ($kv.Id -and $kvSeen -notcontains $kv.Id) { $kvSeen += $kv.Id; $plan.Add([pscustomobject]@{ Kind = 'AzureRole'; Role = 'Key Vault Secrets User'; Scope = $kv.Id; Why = $kv.Why }) }
|    }
|    $grant = { param($role, $scope, $why) if (-not [string]::IsNullOrWhiteSpace($scope)) { $plan.Add([pscustomobject]@{ Kind = 'AzureRole'; Role = $role; Scope = $scope; Why = $why }) } }
|    if ($Mode -eq 'Certificate') {
|        & $grant 'Key Vault Secrets User' $KeyVaultId 'resolve the SPN certificate (Key Vault reference) when the job starts'
|        if ($KedaQueueScaler) { & $grant 'Storage Queue Data Reader' $StorageAccountId 'the queue scaler reads the shard queue length (no storage key)' }
|        return $plan.ToArray()
|    }
|    # The jobs pull their image AS the identity -- no registry password (admin access may be disabled).
|    & $grant 'AcrPull' $AcrRegistryId 'pull the engine image from the registry'
|    foreach ($s in @($ReaderScopes | Where-Object { $_ } | Select-Object -Unique)) { & $grant 'Reader' $s 'enumerate Azure resources (Resource Graph) and resolve the workspace / DCR / DCE' }
|    & $grant 'Monitoring Metrics Publisher' $DcrResourceGroupId 'send rows through the SI data collection rules'
|    & $grant 'Log Analytics Reader' $WorkspaceResourceId 'Risk Analysis, trend, correlation and properties query the SI tables'
|    if ($DefenderWorkspaceResourceId -and $DefenderWorkspaceResourceId -ne $WorkspaceResourceId) {
|        & $grant 'Log Analytics Reader' $DefenderWorkspaceResourceId 'query the Defender / Sentinel workspace'
|    }
|    foreach ($r in 'Storage Blob Data Contributor', 'Storage Queue Data Contributor', 'Storage Table Data Contributor') {
|        & $grant $r $StorageAccountId "SI's own run state: fingerprint cache, staging, run logs, shard queue"
|    }
|    foreach ($res in $script:SIContainerIdentityAppRoles) {
|        foreach ($role in $res.Roles) {
|            $plan.Add([pscustomobject]@{ Kind = 'AppRole'; Role = $role; Resource = $res.Resource; ResourceAppId = $res.ResourceAppId; Why = 'read-only collection' })
|        }
|    }
|    return $plan.ToArray()
|}
|
|# ==================================================================================================================
|#  ASSET TAGGING'S OWN IDENTITY (#236)
|# ==================================================================================================================
|# The asset-tagging job is the ONE SecurityInsight job that writes to the customer's tenant, so it never runs as the
|# collection identity above: it gets its own user-assigned identity (default 'uami-securityinsight-tagging') and this
|# plan. Its WRITE permissions are exactly the three the engine uses, and nothing else:
|#   * Defender for Endpoint Machine.ReadWrite.All -- machine tags (POST /api/machines/{id}/tags, AddOrRemoveTagForMultipleMachines)
|#   * Tag Contributor at the configured tagging scope(s) -- Azure resource tags (a merge of the tags, over REST)
|#   * Microsoft Graph CustomSecAttributeAssignment.ReadWrite.All -- Entra custom security attributes (PATCH on
|#     /users/{id} and /servicePrincipals/{id}; the KustoCL rules)
|# Its read permissions are what the rules' queries need: Resource Graph (Reader), advanced hunting
|# (ThreatHunting.Read.All), the identities the attributes are set on (User.Read.All, Application.Read.All), and the SI
|# workspace for KustoCL rules (Log Analytics Reader). Its activity rows and run log go to SI's OWN workspace and storage
|# (Monitoring Metrics Publisher on the DCR resource group, Storage Blob Data Contributor on SI's storage account).
|# OPT-IN: setup grants this plan only when asked (Bootstrap-ContainerAppJob.ps1 -GrantTaggingRoles,
|# setup\Grant-SIIdentity.ps1 -Tagging -Apply); without it the job can only report.
|$script:SIAssetTaggingIdentityAppRoles = @(
|    [pscustomobject]@{ Resource = 'Microsoft Graph'; ResourceAppId = '00000003-0000-0000-c000-000000000000'
|        Roles = @('ThreatHunting.Read.All', 'User.Read.All', 'Application.Read.All', 'CustomSecAttributeAssignment.ReadWrite.All') }
|    [pscustomobject]@{ Resource = 'WindowsDefenderATP'; ResourceAppId = 'fc780465-2017-40d4-a0c5-307022471b92'; Roles = @('Machine.ReadWrite.All') }
|)
|# The write permissions in that plan -- the ONLY ones it may hold (the tests assert it, and that the collection plan holds none).
|$script:SIAssetTaggingWriteGrants = @('Tag Contributor', 'Machine.ReadWrite.All', 'CustomSecAttributeAssignment.ReadWrite.All')
|
|function Get-SIAssetTaggingIdentityGrantPlan {
|    <#
|        PURE (#236). What the asset-tagging job's OWN identity must hold -- the same row shape as
|        Get-SIContainerIdentityGrantPlan. -TaggingScopes: where Azure tags may be written (Tag Contributor); default the
|        -ReaderScopes. A scope that is not known is left out (the caller says so).
|    #>
|    param(
|        [string[]]$ReaderScopes = @(),
|        [string[]]$TaggingScopes = @(),
|        [string]$DcrResourceGroupId,
|        [string]$WorkspaceResourceId,
|        [string]$StorageAccountId,
|        [string]$AcrRegistryId,
|        [string]$LicenceKeyVaultId
|    )
|    $plan = New-Object System.Collections.Generic.List[object]
|    # Write = $true marks the rows that let the job WRITE (fix request 85bd728f): setup grants every other row always -- the
|    # job reports what it would tag from day one -- and the writes only on request (-GrantTaggingRoles / Grant-SIIdentity -Tagging).
|    $grant = { param($role, $scope, $why) if (-not [string]::IsNullOrWhiteSpace($scope)) { $plan.Add([pscustomobject]@{ Kind = 'AzureRole'; Role = $role; Scope = $scope; Why = $why; Write = ($script:SIAssetTaggingWriteGrants -contains $role) }) } }
|    & $grant 'AcrPull' $AcrRegistryId 'pull the engine image from the registry'
|    & $grant 'Key Vault Secrets User' $LicenceKeyVaultId 'asset tagging: read the SecurityInsight licence (SI-License) when the job starts'
|    $readers = @($ReaderScopes | Where-Object { $_ } | Select-Object -Unique)
|    foreach ($s in $readers) { & $grant 'Reader' $s 'asset tagging: run the Resource Graph rules' }
|    $tagScopes = @($TaggingScopes | Where-Object { $_ } | Select-Object -Unique)
|    if (-not $tagScopes.Count) { $tagScopes = $readers }
|    foreach ($s in $tagScopes) { & $grant 'Tag Contributor' $s 'asset tagging: WRITE Azure resource tags (only when SI_Pro_AssetTagging_Apply is on)' }
|    & $grant 'Log Analytics Reader' $WorkspaceResourceId 'asset tagging: run the KustoCL rules against the SI tables'
|    & $grant 'Monitoring Metrics Publisher' $DcrResourceGroupId 'asset tagging: send the activity rows (planned and executed writes) to SI''s workspace'
|    & $grant 'Storage Blob Data Contributor' $StorageAccountId 'asset tagging: keep the run log in SI''s own storage'
|    foreach ($res in $script:SIAssetTaggingIdentityAppRoles) {
|        foreach ($role in $res.Roles) {
|            $why = if ($script:SIAssetTaggingWriteGrants -contains $role) { 'asset tagging: WRITE (only when SI_Pro_AssetTagging_Apply is on)' } else { 'asset tagging: read what the rules query' }
|            $plan.Add([pscustomobject]@{ Kind = 'AppRole'; Role = $role; Resource = $res.Resource; ResourceAppId = $res.ResourceAppId; Why = $why; Write = ($script:SIAssetTaggingWriteGrants -contains $role) })
|        }
|    }
|    return $plan.ToArray()
|}
|
|# #446: what the Pro web app's OWN identity (uami-si-management) reads in Entra -- READ ONLY: the names on the Access page,
|# the people picker (users and groups by name), group membership when a sign-in token lists too many groups, and who
|# holds a role on the enterprise application "SecurityInsight Management" (shown on Access, counted by Get Started).
|$script:SIWebAppIdentityAppRoles = @(
|    [pscustomobject]@{ Resource = 'Microsoft Graph'; ResourceAppId = '00000003-0000-0000-c000-000000000000'
|        Roles = @('User.ReadBasic.All', 'GroupMember.Read.All', 'Application.Read.All') }
|)
|
|function Get-SIWebAppIdentityGrantPlan {
|    <# PURE (#446). The Pro web app identity's Microsoft Graph application permissions -- the same row shape as
|       Get-SIContainerIdentityGrantPlan; all read only. #>
|    $plan = New-Object System.Collections.Generic.List[object]
|    foreach ($res in $script:SIWebAppIdentityAppRoles) {
|        foreach ($role in $res.Roles) {
|            $why = switch ($role) { 'User.ReadBasic.All' { 'the web app: people''s names, and finding a person by name' } 'GroupMember.Read.All' { 'the web app: group names and members (sign-in, Access)' } default { 'the web app: who holds a role on the enterprise application' } }
|            $plan.Add([pscustomobject]@{ Kind = 'AppRole'; Role = $role; Resource = $res.Resource; ResourceAppId = $res.ResourceAppId; Why = $why })
|        }
|    }
|    return $plan.ToArray()
|}
|
|# ==================================================================================================================
|#  #269 -- the ServiceNow jobs exist only where ServiceNow is configured; the daily job flow
|# ==================================================================================================================
|function Test-SIBootstrapTruthy { param($Value) if ($null -eq $Value) { return $false }; if ($Value -is [bool]) { return $Value }; ("$Value".Trim().Trim('$').ToLowerInvariant()) -in @('true', '1', 'yes', 'on') }
|
|function Get-SIServiceNowJobPlan {
|    <#
|        PURE. Whether this install gets the two ServiceNow jobs (operator 2026-10-04: "i need service for ServiceNow CMDB
|        Connector" / "one for sql connector and one for servicenow"):
|          asset-cmdb                          -- the ServiceNow CMDB connector (creates / updates CIs): -Cmdb, or
|                                                 SI_Bootstrap_ServiceNowCmdb, or SI_EnableServiceNowCmdb, or SI_Cmdb_Run = apply;
|          asset-vulnerabilities-servicenow    -- the ServiceNow VULNERABILITY connector: -Vulnerabilities, or
|                                                 SI_Bootstrap_ServiceNowVulnerabilities, or SI_VulnSync_Target = ServiceNow,
|                                                 or SI_VulnSync_ServiceNowTable set.
|        Setup does not read the Pro database, so a ServiceNow connector kept only in cfg.Connector is named with the switch
|        (or the SI_Bootstrap_* setting). Returns @{ Cmdb = @{ Deploy; Why }; Vulnerabilities = @{ Deploy; Why } }.
|    #>
|    param([hashtable]$Globals = @{}, [bool]$Cmdb, [bool]$Vulnerabilities)
|    $g = { param($n) if ($Globals.ContainsKey($n)) { $Globals[$n] } else { $null } }
|    $c = if ($Cmdb) { 'asked for (-ServiceNowCmdb)' } elseif (Test-SIBootstrapTruthy (& $g 'SI_Bootstrap_ServiceNowCmdb')) { 'SI_Bootstrap_ServiceNowCmdb' }
|         elseif (Test-SIBootstrapTruthy (& $g 'SI_EnableServiceNowCmdb')) { 'SI_EnableServiceNowCmdb' }
|         elseif ("$(& $g 'SI_Cmdb_Run')".Trim().ToLowerInvariant() -eq 'apply') { "SI_Cmdb_Run = 'apply'" } else { '' }
|    $v = if ($Vulnerabilities) { 'asked for (-ServiceNowVulnerabilities)' } elseif (Test-SIBootstrapTruthy (& $g 'SI_Bootstrap_ServiceNowVulnerabilities')) { 'SI_Bootstrap_ServiceNowVulnerabilities' }
|         elseif ("$(& $g 'SI_VulnSync_Target')".Trim() -ieq 'ServiceNow') { "SI_VulnSync_Target = 'ServiceNow'" }
|         elseif ("$(& $g 'SI_VulnSync_ServiceNowTable')".Trim()) { 'SI_VulnSync_ServiceNowTable' } else { '' }
|    [pscustomobject]@{
|        Cmdb            = [pscustomobject]@{ Deploy = [bool]$c; Why = $(if ($c) { $c } else { 'no ServiceNow CMDB connector is configured (SI_EnableServiceNowCmdb, -ServiceNowCmdb)' }) }
|        Vulnerabilities = [pscustomobject]@{ Deploy = [bool]$v; Why = $(if ($v) { $v } else { "no ServiceNow vulnerability connector is configured (SI_VulnSync_Target = 'ServiceNow', -ServiceNowVulnerabilities)" }) }
|    }
|}
|
|function Get-SIBootstrapJobName {
|    <# PURE. The Container Apps job name of an engine (max 32 characters) -- the same short aliases Bootstrap uses. #>
|    param([Parameter(Mandatory)][string]$Engine)
|    $short = switch ($Engine) {
|        'privilege-tier-classifier'        { 'ptc' }
|        'schema-discovery'                 { 'schema' }
|        'templates-publish'                { 'templates' }
|        'asset-vulnerabilities-servicenow' { 'asset-vulns-servicenow' }
|        default                            { $Engine }
|    }
|    'caj-si-' + $short
|}
|
|function Select-SIBootstrapServiceNowEngines {
|    <#
|        PURE. The engine list without the ServiceNow jobs this install does not use -- unless the job already exists (an
|        install is never stripped of a job it has; Bootstrap never deletes). @{ Engines; Skipped = @(@{ Engine; Why }) }.
|    #>
|    param([string[]]$Engines = @(), [Parameter(Mandatory)]$Plan, [string[]]$ExistingJobs = @())
|    $skipped = New-Object System.Collections.Generic.List[object]
|    $keep = New-Object System.Collections.Generic.List[string]
|    foreach ($e in $Engines) {
|        $p = $null
|        if ($e -eq 'asset-cmdb') { $p = $Plan.Cmdb } elseif ($e -eq 'asset-vulnerabilities-servicenow') { $p = $Plan.Vulnerabilities }
|        if (-not $p -or $p.Deploy -or $ExistingJobs -contains (Get-SIBootstrapJobName -Engine $e)) { $keep.Add($e); continue }
|        $skipped.Add([pscustomobject]@{ Engine = $e; Why = $p.Why })
|    }
|    [pscustomobject]@{ Engines = $keep.ToArray(); Skipped = $skipped.ToArray() }
|}
|
|function Get-SIBootstrapJobEnvArgs {
|    <#
|        PURE. The env vars that make one job THE job it is, beyond SI_ENGINE: the ServiceNow vulnerability job runs the
|        vulnerability engine for the ServiceNow connectors, the SQL one for the SQL (and REST) connectors; the flow job
|        knows where the jobs it starts are. Returns @{ SiEngine; EnvArgs }.
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [string]$SubscriptionId, [string]$ResourceGroup)
|    switch ($Engine) {
|        'asset-vulnerabilities'            { return [pscustomobject]@{ SiEngine = 'asset-vulnerabilities'; EnvArgs = @('SI_VULN_TARGET=Sql') } }
|        'asset-vulnerabilities-servicenow' { return [pscustomobject]@{ SiEngine = 'asset-vulnerabilities'; EnvArgs = @('SI_VULN_TARGET=ServiceNow') } }
|        'flow'                             { return [pscustomobject]@{ SiEngine = 'flow'; EnvArgs = @(('SI_FLOW_SUBSCRIPTIONID={0}' -f $SubscriptionId), ('SI_FLOW_RESOURCEGROUP={0}' -f $ResourceGroup)) } }
|        default                            { return [pscustomobject]@{ SiEngine = $Engine; EnvArgs = @() } }
|    }
|}
|
|function Get-SIBootstrapJobGuardEnvArgs {
|    <# PURE (SCHED-1.1). Where every job finds its own executions -- the execution guard asks ARM whether an earlier
|       execution of the same job is still running. #>
|    param([string]$SubscriptionId, [string]$ResourceGroup)
|    @(('SI_JOBS_SUBSCRIPTIONID={0}' -f $SubscriptionId), ('SI_JOBS_RESOURCEGROUP={0}' -f $ResourceGroup))
|}
|
|function Get-SIBootstrapTriggerPlan {
|    <#
|        PURE. How Bootstrap CREATES a job's trigger. An EXISTING job's trigger is never changed by setup -- Operations > Jobs'
|        mode switch and setup\Switch-SIJobOrchestration.ps1 own that.
|          flow mode:      a job of the flow -> Manual, its timer remembered in the si-disabled-cron tag (leaving the flow
|                          restores it); caj-si-flow -> Schedule at the flow's start time;
|          schedules mode: every job on its own timer; caj-si-flow -> Manual with the flow's time remembered.
|        A job that is never in the flow (templates, schema discovery, asset tagging) keeps its timer. @{ Trigger; RememberCron }.
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][ValidateSet('flow', 'schedules')][string]$Mode, [string]$Cron, $Map)
|    $key = (Get-SIBootstrapJobName -Engine $Engine).Substring(7)
|    if ($Engine -eq 'flow') {
|        if ($Mode -eq 'flow') { return [pscustomobject]@{ Trigger = 'Schedule'; RememberCron = '' } }
|        return [pscustomobject]@{ Trigger = 'Manual'; RememberCron = $Cron }
|    }
|    # #1038 (1): a job that is only ever STARTED (the data-out job: by the data sync and by a person) -- Manual in both modes,
|    # no timer to remember (the map's 'manualOnly')
|    if ($Map -and $Map.Jobs.Contains($key) -and $Map.Jobs[$key].PSObject.Properties['ManualOnly'] -and $Map.Jobs[$key].ManualOnly) { return [pscustomobject]@{ Trigger = 'Manual'; RememberCron = '' } }
|    $inFlow = $false
|    if ($Map -and $Map.Jobs.Contains($key)) { $inFlow = (-not $Map.Jobs[$key].NeverInFlow) -and ($Map.DefaultFlow -contains $key) }
|    # #306: the risk trend is written by Risk Analysis while the jobs run as a pipeline -- its job waits (runnable by hand)
|    if ($Map -and $Map.Jobs.Contains($key) -and $Map.Jobs[$key].PSObject.Properties['ManualInFlowMode'] -and $Map.Jobs[$key].ManualInFlowMode) { $inFlow = $true }
|    if ($Mode -eq 'flow' -and $inFlow) { return [pscustomobject]@{ Trigger = 'Manual'; RememberCron = $Cron } }
|    [pscustomobject]@{ Trigger = 'Schedule'; RememberCron = '' }
|}
|
|function Get-SIBootstrapProducerTriggerPlan {
|    <#
|        PURE (#1096). How Bootstrap CREATES a collect producer (caj-si-<engine>-producer): exactly as its engine's job
|        (-TriggerPlan: Get-SIBootstrapTriggerPlan for the engine). Pipeline mode: the engine is a step, the pipeline starts its
|        producer -> Manual, the engine's timer (-Cron) remembered in si-disabled-cron (a later switch to per-job schedules gives
|        it back). Schedules mode, or an engine that is no step: its cron. @{ Trigger = Manual | Schedule; RememberCron }.
|    #>
|    param([Parameter(Mandatory)]$TriggerPlan, [string]$Cron)
|    if ([string]$TriggerPlan.Trigger -eq 'Manual') { return [pscustomobject]@{ Trigger = 'Manual'; RememberCron = $(if ([string]$TriggerPlan.RememberCron) { [string]$TriggerPlan.RememberCron } else { $Cron }) } }
|    [pscustomobject]@{ Trigger = 'Schedule'; RememberCron = '' }
|}
|
|function ConvertTo-SIManualCreateArgs {
|    <#
|        PURE (#269). `az containerapp job create` arguments for a Schedule job turned into the same job with a MANUAL
|        trigger: --trigger-type Manual, no --cron-expression, and the timer remembered in the si-disabled-cron tag (the
|        tag the web app's Disable / Enable and the flow's leave-the-flow read). Everything else is kept as it was.
|    #>
|    param([Parameter(Mandatory)][object[]]$CreateArgs, [string]$RememberCron)
|    $out = New-Object System.Collections.Generic.List[object]
|    for ($i = 0; $i -lt $CreateArgs.Count; $i++) {
|        $a = $CreateArgs[$i]
|        if ($a -eq '--cron-expression') { $i++; continue }
|        if ($a -eq '--trigger-type') { $out.Add('--trigger-type'); $out.Add('Manual'); $i++; continue }
|        $out.Add($a)
|    }
|    if ($RememberCron) { $out.Add('--tags'); $out.Add(('si-disabled-cron={0}' -f $RememberCron)) }
|    , $out.ToArray()
|}
|
|function Get-SIJobExecutionOverlap {
|    <#
|        PURE (SCHED-1.1, #269). A job started by its own cron fires on the clock, whatever the last run is doing: this is
|        the EXECUTION GUARD. From the job's executions (ARM list: name, properties.status, properties.startTime) and this
|        execution's name, the OTHER execution of the same job that is still active (Running / Processing) and started
|        before this one -- then this execution starts nothing ("skipped: previous still running"). $null when there is
|        none. An execution not in the list yet is fine: the list is only asked about the others.
|    #>
|    param([AllowEmptyCollection()][object[]]$Executions = @(), [Parameter(Mandatory)][string]$Self)
|    $mine = @($Executions | Where-Object { $_ -and [string]$_.name -eq $Self })[0]
|    $myStart = if ($mine -and $mine.properties.startTime) { ([datetime]$mine.properties.startTime).ToUniversalTime() } else { [datetime]::MaxValue }
|    $others = @($Executions | Where-Object {
|        $_ -and [string]$_.name -ne $Self -and ([string]$_.properties.status) -in @('Running', 'Processing') -and
|        ((-not $_.properties.startTime) -or ([datetime]$_.properties.startTime).ToUniversalTime() -le $myStart)
|    } | Sort-Object { if ($_.properties.startTime) { [datetime]$_.properties.startTime } else { [datetime]::MinValue } })
|    if ($others.Count) { return $others[0] }
|    $null
|}
|
|function Test-SIFlowGuardRequest {
|    <#
|        PURE (#946). Does this flow execution CARRY something the execution guard lets through beside a running flow
|        execution? @{ Request; Cancel }: Request = a Run now (SI_FLOW_FORCE / SI_FLOW_STAGE / SI_FLOW_STEP / SI_FLOW_FROM_STEP)
|        or a cancel (SI_FLOW_CANCEL); Cancel = SI_FLOW_CANCEL. A value of 0 / false / no is no request. -Get { param($Name) }:
|        the environment (default: the process environment).
|    #>
|    param([scriptblock]$Get = { param($n) [Environment]::GetEnvironmentVariable($n) })
|    $on = { param($n) $v = ([string](& $Get $n)).Trim(); [bool]($v -and $v.ToLowerInvariant() -notin @('0', 'false', 'no')) }
|    $cancel = & $on 'SI_FLOW_CANCEL'
|    $req = $cancel -or [bool](@('SI_FLOW_FORCE', 'SI_FLOW_STAGE', 'SI_FLOW_STEP', 'SI_FLOW_FROM_STEP') | Where-Object { & $on $_ })
|    [pscustomobject]@{ Request = [bool]$req; Cancel = [bool]$cancel }
|}
|
|function Get-SIExecutionGuardDecision {
|    <#
|        PURE (#277 live finding, ring 1 2026-10-05). What the execution guard does with an overlap Get-SIJobExecutionOverlap
|        found. @{ Action; Message }:
|          Run       -- no earlier execution is running: the run goes on.
|          FlowBusy  -- THE FLOW RUNNER (SI_ENGINE=flow / caj-si-flow) woke up while its previous execution still runs. It
|                       wakes every 5 minutes, so this is every wake-up of a long flow run: normal operation, NOT a guard.
|                       One plain INFO line; no run-health row, no guard event, no telemetry, no warning. A start
|                       that was really blocked shows up as the flow's catch-up when it runs. #1063 (3.0.30): Housekeeping
|                       $true -- the entry does NOT end here: it goes on to the runner with SI_FLOW_HOUSEKEEPING_ONLY=1,
|                       which runs only the paced clean-up of old collections' rows and ends (exit 0). The data out's
|                       FlowBusy (Housekeeping $false) still ends at once.
|          Skip      -- any other job started twice: the guard trips (skipped row + 'job.execution.previous-running').
|        -FlowRequest: this flow execution CARRIES a request (Run the pipeline now / a stage / a step / from a step:
|        SI_FLOW_FORCE, SI_FLOW_STAGE, SI_FLOW_STEP, SI_FLOW_FROM_STEP). It is never dropped here: it runs, and the runner's
|        own lock puts the request in the queue while the other run holds the install (live 2026-10-06, Community
|        rehearsal: the install's "Run the pipeline now" started 2 minutes after a 5-minute wake-up, which was still
|        checking -- "this wake-up does nothing", and the first run never happened).
|    #>
|    param([string]$Engine, [string]$Job, $Other, [string]$Self, [switch]$FlowRequest, [switch]$FlowCancel)
|    if (-not $Other) { return [pscustomobject]@{ Action = 'Run'; Message = '' } }
|    $started = if ($Other.properties -and $Other.properties.startTime) { [string]$Other.properties.startTime } else { 'unknown' }
|    if ($Engine -eq 'flow' -or $Job -eq 'caj-si-flow') {
|        # #946 (live 2026-10-29, three installs): a CANCEL of the running run (SI_FLOW_CANCEL) is never dropped either -- it is
|        # meant for the run the other execution holds; the runner's cancel stops that runner, marks the run Cancelled and
|        # frees the lock (Invoke-SIPipelineCancelRun)
|        if ($FlowCancel) {
|            return [pscustomobject]@{ Action = 'Run'
|                Message = ('[flow] another flow execution is running ({0}, started {1}); this one carries a cancel of the running run, so it goes on.' -f $Other.name, $started) }
|        }
|        if ($FlowRequest) {
|            return [pscustomobject]@{ Action = 'Run'
|                Message = ('[flow] another flow execution is running ({0}, started {1}); this one carries a request, so it goes on -- the pipeline lock queues it while that run holds the install.' -f $Other.name, $started) }
|        }
|        # #1063 (3.0.30): FlowBusy, Housekeeping $true -- the entry goes on to the runner in housekeeping-only mode: the paced
|        # clean-up of old collections' rows (the in-run clean-up), then it ends. It starts nothing; the running run goes on.
|        return [pscustomobject]@{ Action = 'FlowBusy'; Housekeeping = $true
|            Message = ('[flow] the flow is still running (execution {0}, started {1}); this wake-up starts nothing -- it only does the paced housekeeping.' -f $Other.name, $started) }
|    }
|    # #1038 (1): the data-out job is started by the data sync on every mark and by a person to resend -- a start while one
|    # sends is normal operation, not a guard (the running one sends the newest mark when it has finished): one plain line
|    if ($Engine -eq 'data-out' -or $Job -eq 'caj-si-data-out') {
|        return [pscustomobject]@{ Action = 'FlowBusy'; Housekeeping = $false
|            Message = ('[data-out] data out is already sending (execution {0}, started {1}); this start does nothing -- that run sends the newest marked collection.' -f $Other.name, $started) }
|    }
|    # the users' sign-in methods read in the background: a run while the previous one still reads is normal (a slow tenant), not
|    # a guard -- this one ends at once and the running one carries on; one plain line, no guard event
|    if ($Engine -eq 'signin-methods' -or $Job -eq 'caj-si-signin-methods') {
|        return [pscustomobject]@{ Action = 'FlowBusy'; Housekeeping = $false
|            Message = ('[signin-methods] the previous background read is still running (execution {0}, started {1}); this run ends at once and reads nothing.' -f $Other.name, $started) }
|    }
|    # #1021: the support grant job -- every start carries its own request on the queue, so one is never dropped; the signed
|    # procedures' lock keeps two grants on the same database apart (framework 4b: support always works)
|    if ($Engine -eq 'support-grant' -or $Job -eq 'caj-si-support-grant') {
|        return [pscustomobject]@{ Action = 'Run'
|            Message = ('[support-grant] another support grant execution is running ({0}, started {1}); this one reads its own request.' -f $Other.name, $started) }
|    }
|    [pscustomobject]@{ Action = 'Skip'
|        Message = ('[guard] skipped: previous still running -- execution {0} of {1} (started {2}) has not finished; this execution ({3}) starts nothing.' -f $Other.name, $Job, $started, $Self) }
|}
|
|function Resolve-SIContainerSubscriptionId {
|    <#
|        PURE (#281). The subscription this install's Log Analytics ingest lives in -- the run-health record, the data
|        collection rule and endpoint lookups. The first that has one:
|          1. -AzSubscriptionId (the customer's SI_AzSubscriptionId, when a setting carried it)
|          2. the subscription in -WorkspaceResourceId (/subscriptions/<sub>/resourceGroups/...) -- the global, else the
|             job's SI_WORKSPACE_RESOURCEID. A new rule is created in the workspace's subscription, so this comes first.
|          3. -JobsSubscriptionId (SI_JOBS_SUBSCRIPTIONID / SI_FLOW_SUBSCRIPTIONID: where the jobs run)
|          4. -ContextSubscriptionId (the signed-in Az context)
|        Returns '' when none has one.
|    #>
|    param([string]$AzSubscriptionId, [AllowEmptyCollection()][string[]]$WorkspaceResourceId = @(),
|          [AllowEmptyCollection()][string[]]$JobsSubscriptionId = @(), [string]$ContextSubscriptionId)
|    if (-not [string]::IsNullOrWhiteSpace($AzSubscriptionId)) { return $AzSubscriptionId.Trim() }
|    foreach ($w in @($WorkspaceResourceId)) { if ("$w" -match '/subscriptions/([^/]+)/') { return $Matches[1] } }
|    foreach ($j in @($JobsSubscriptionId)) { if (-not [string]::IsNullOrWhiteSpace($j)) { return $j.Trim() } }
|    if (-not [string]::IsNullOrWhiteSpace($ContextSubscriptionId)) { return $ContextSubscriptionId.Trim() }
|    return ''
|}
|
|function Initialize-SIContainerIngestGlobals {
|    <#
|        #281. THE container's env -> ingest-globals mapping, called by BOTH entry points (Start-SIInContainer.ps1,
|        Start-RiskAnalysisInContainer.ps1) right after sign-in, before any engine runs or any run-health record is sent.
|        Found live 2026-10-05 on ring 1: no container ever set SI_AzSubscriptionId -- on a VM it comes from the customer's
|        config or the backfill at a profiler run's entry, and neither reaches a container -- so every profiler and flow run
|        lost its run-health record ("Cannot bind argument to parameter 'SubscriptionId' because it is an empty string").
|        And Risk Analysis kept its identity only under its own names (Spn*), so the record signed in with an EMPTY app
|        id, which the ingest module answers by creating nothing ("the data collection rule ... was not found").
|        Fills ONLY empty names; a value the customer's settings or the job already gave always stands. Never throws.
|          SI_WorkspaceResourceId / SI_DceName / SI_DcrResourceGroup  <- SI_WORKSPACE_RESOURCEID / SI_DCE_NAME / SI_DCR_RESOURCEGROUP
|          SI_AzSubscriptionId   <- Resolve-SIContainerSubscriptionId (workspace, then the jobs' subscription, then the Az context)
|          SI_DceResourceGroup   <- SI_DCE_RESOURCEGROUP, else SI_DcrResourceGroup (the endpoint lives with the rules)
|          SI_SPN_AppId / _TenantId / _Secret  <- SpnClientId / SpnTenantId / SpnClientSecret (Risk Analysis' names)
|          SI_SPN_ObjectId       <- SI_SPN_OBJECTID
|          SI_LogIngest_AppId / _TenantId / _ObjectId  <- the SI_SPN_* values
|        -GetEnv: the env reader (tests pass their own); -ContextSubscriptionId: the signed-in context's subscription
|        (read from Get-SIAzContext when not given). Returns what it resolved, for the run log.
|    #>
|    param([scriptblock]$GetEnv = { param($n) [Environment]::GetEnvironmentVariable($n) }, [string]$ContextSubscriptionId)
|    $envOf = { param($n) $v = & $GetEnv $n; if ([string]::IsNullOrWhiteSpace([string]$v)) { $null } else { [string]$v } }
|    try {
|        if (-not $global:SI_WorkspaceResourceId) { $global:SI_WorkspaceResourceId = & $envOf 'SI_WORKSPACE_RESOURCEID' }
|        if (-not $global:SI_DceName)             { $global:SI_DceName             = & $envOf 'SI_DCE_NAME' }
|        if (-not $global:SI_DcrResourceGroup)    { $global:SI_DcrResourceGroup    = & $envOf 'SI_DCR_RESOURCEGROUP' }
|        if (-not $global:SI_AzSubscriptionId) {
|            $wsIds = @([string]$global:SI_WorkspaceResourceId, [string](& $envOf 'SI_WORKSPACE_RESOURCEID'))
|            $jobSubs = @([string](& $envOf 'SI_JOBS_SUBSCRIPTIONID'), [string](& $envOf 'SI_FLOW_SUBSCRIPTIONID'))
|            $sub = Resolve-SIContainerSubscriptionId -WorkspaceResourceId $wsIds -JobsSubscriptionId $jobSubs -ContextSubscriptionId $ContextSubscriptionId
|            if (-not $sub) {
|                # the Az context only as the last resort -- and only asked for when nothing else answered
|                try {
|                    if (Get-Command -Name Get-SIAzContext -ErrorAction SilentlyContinue) { $sub = [string](Get-SIAzContext -ErrorAction SilentlyContinue).Subscription.Id }
|                } catch { }
|            }
|            if ($sub) { $global:SI_AzSubscriptionId = $sub }
|        }
|        if (-not $global:SI_DceResourceGroup) {
|            $dceRg = & $envOf 'SI_DCE_RESOURCEGROUP'
|            $global:SI_DceResourceGroup = if ($dceRg) { $dceRg } else { [string]$global:SI_DcrResourceGroup }
|        }
|        foreach ($p in @(@('SI_SPN_AppId', 'SpnClientId'), @('SI_SPN_TenantId', 'SpnTenantId'), @('SI_SPN_Secret', 'SpnClientSecret'))) {
|            $cur = [string](Get-Variable -Name $p[0] -Scope Global -ValueOnly -ErrorAction SilentlyContinue)
|            $src = [string](Get-Variable -Name $p[1] -Scope Global -ValueOnly -ErrorAction SilentlyContinue)
|            if (-not $cur -and $src) { Set-Variable -Name $p[0] -Scope Global -Value $src }
|        }
|        if (-not $global:SI_SPN_ObjectId) { $o = & $envOf 'SI_SPN_OBJECTID'; if ($o) { $global:SI_SPN_ObjectId = $o } }
|        if (-not $global:SI_LogIngest_AppId)    { $global:SI_LogIngest_AppId    = $global:SI_SPN_AppId }
|        if (-not $global:SI_LogIngest_TenantId) { $global:SI_LogIngest_TenantId = $global:SI_SPN_TenantId }
|        if (-not $global:SI_LogIngest_ObjectId) { $global:SI_LogIngest_ObjectId = $global:SI_SPN_ObjectId }
|    } catch { Write-Warning ('[ingest] the Log Analytics target could not be fully resolved: {0}' -f $_.Exception.Message) }
|    [pscustomobject]@{ SubscriptionId = [string]$global:SI_AzSubscriptionId; DceName = [string]$global:SI_DceName
|                       DcrResourceGroup = [string]$global:SI_DcrResourceGroup; DceResourceGroup = [string]$global:SI_DceResourceGroup }
|}
'@ }
$__siSupportFiles['config/job-flow.locked.json'] = @{ Sha256 = '0f6e57b0cdfb4edacf2f0612da6ac21880be683d7f294159ee1a7aa8a62527bd'; Text = @'
|{
|  "_": "THE job dependency map and the DEFAULT daily pipeline of SecurityInsight (#269, #306). Read by PowerShell (engine/_shared/SI-JobFlow.ps1: the pipeline runner in a container job and on a VM, Bootstrap, the VM setup step). The web app keeps the same map in Jobs/JobSchedule.cs (Role().Needs) and Jobs/JobFlow.cs (DefaultStages / StageOf) and a test (JobFlowTests) fails when they differ -- change them together. A key is the Container Apps job name without 'caj-si-'. 'needs' are the jobs whose output this job reads; 'stage' is the stage of the pipeline the job belongs to (collect -> correlate (the CIs, then Risk Analysis on them) -> deliver; a schema-1 flow is migrated by it); 'defaultCron' (UTC) is the job's own timer in schedules mode -- Bootstrap's default, and what leaving the pipeline / switching to schedules gives a job that has no remembered timer; a need that is not installed is ignored. 'defaultPipeline' is what a new install gets: its stages in order, each one step after the other except the steps a stage names in 'withPrevious' (they start together with the step above them; JobFlow.cs DefaultTogether); a job not installed is left out. 'defaultFlow' is the same order flattened (what a schema-1 reader sees). 'manualInFlowMode': not a step, and no timer of its own while the jobs run as a pipeline (the risk trend: Risk Analysis writes the daily trend row itself; the job stays runnable by hand). 'ownSchedule' (the updater, framework UPDATE-1.6): NEVER a step of any pipeline -- it runs on its own daily timer (18:30 in the local time of the install's Azure region -- Danish time, the two UTC ticks 16:30 and 17:30, when the region is not known; the updater ends the tick that is not 18:30 there) in every mode; a switch to the pipeline keeps that timer and gives back one an earlier switch took away; a stored pipeline that still has it as a step loses that step when it is read (said in the log). An update waits while the pipeline runs; the pipeline waits (its requests stay queued) while an update runs. 'config-backup' (#404, framework CONFIG-1.3): the daily configuration backup, never a step -- its own timer (18:00 UTC: after the working day, before the pipeline, never at the nightly update). 'retired' (asset-properties, #412 -- the endpoint, identity and azure profilers publish the full asset metadata themselves): the job does nothing any more -- never a step and no timer; a stored pipeline that still has it as a step loses that step when it is read (said in the log), and a need on it is ignored.",
|  "schema": 2,
|  "defaultStartTime": "19:00",
|  "defaultTimeZone": "Europe/Copenhagen",
|  "_defaultTime": "The pipeline starts at 23:30 in the local time of the install's Azure region, after the nightly update at 23:00 in the same zone, so the night's run is complete by 08:00 (owner 2026-10-15): a new install writes 23:30 with its region's zone (SI_Pipeline_StartTime + SI_Pipeline_TimeZone); defaultStartTime in defaultTimeZone (Danish time) applies only when no start time is set, i.e. when the region is not known -- all year: daylight saving moves the UTC time, never the local one. A start time the customer sets (SI_Pipeline_StartTime) is read in the install's own time zone (SI_Pipeline_TimeZone); with no start time set, the default zone applies whatever SI_Pipeline_TimeZone says. Existing installs on the old shipped 22:00 are moved to 23:30 Danish time once by the update (setup/_shared/SI-NightlySchedule.ps1). A schedule stored before time zones keeps its time as UTC.",
|  "_reads": "'reads' (a job): jobs whose output of the SAME day it reads when it is there and does without -- the previous run's -- when it is not (verified in code 2026-10-10: azure's identity-tier overlay XENG_AccessedBy* = Get-SIIdentityTierMap over SI_Identity_Profile_CL; endpoint's MostFrequentUser tier = Get-SIBulkDeviceUserCorrelation + AssetProfileByLogonUser over SI_Identity_Profile_CL). Not a need: a failure skips nothing; a step placed before or together with one it reads is warned about. Two reads always see the run before, by design (a cycle): identity reads endpoint's device tiers (Get-SIEndpointTierMap), azure reads endpoint's VM correlation (EndpointAzureCorrelationCache).",
|  "_withPrevious": "'withPrevious' (a stage of defaultPipeline): the steps that start together with the step above them -- neither reads the other's output of the same day (azure and endpoint, after identity). A stored pipeline still on the old one-after-the-other layout gets it as it is read (Update-SIJobFlowDefaultLayout, the JSON's 'defaults' level); one a person changed is never re-laid.",
|  "_sideBySide": "Layout level 3 (#754): Risk Analysis Summary and Detailed start together after the asset correlation -- neither reads the other's output (verified in code 2026-10-18: separate SQL collections, Log Analytics tables, queues, bucket caches and run keys; the only link is the AI summary's leader snapshot in Consistent mode, which the Detailed run reads just before its mail and which is order-independent by design, #108). 'withPreviousSince' (a stage): the layout level at which a 'withPrevious' step was added -- a stored pipeline still on the default layout of its own level gets the current one when it is read and through the update (setup/_shared/SI-PipelineLayout.ps1); one a person changed is never re-laid. Both Risk Analysis jobs write the database through Write-SIDataJsonRows, which paces each writer on the database's own load (SI-SqlPacing.ps1, #749).",
|  "_summaryOff": "Layout level 4 (#636, owner 2026-10-19: \"i prefer to switch so detailed becomes the engine default and summary is optional\" / \"i dont see a need for summary in pipeline\"): Risk Analysis Summary (risk-analysis) is OFF by default -- 'defaultEnabled': false, the existing per-step on/off switch; a new pipeline has the step, switched off. Every Summary-shaped view is a grouping of the Detailed findings (data-model/summary-groupings.locked.json). A stored pipeline below level 4 that is still the default of its own level with every step on gets the step switched off as it is read and through the update (Update-SIJobFlowDefaultLayout / JobFlow.ConvergeDefaultLayout, setup/_shared/SI-PipelineLayout.ps1); one a person changed keeps it (one line says so). The risk trend and the data sync need Risk Analysis Detailed only. The next release removes the step.",
|  "_startsWhenReady": "'startsWhenReady' (a Deliver job, #754): in a run of the whole pipeline the step starts as soon as the steps it reads have ended -- its 'needs' and 'reads' that are placed above it, and every step of Collect -- not after every step above it -- and its 'heldBy': steps it does not read but that hold it by the owner's rule (2026-10-13: a failed Risk Analysis Detailed holds every connector; the CMDB connectors read only the CIs, so they wait for Detailed by that rule, not for data). Risk Analysis Detailed is enough for the vulnerability connector and the CMDB connectors; the data sync reads Risk Analysis Detailed (and stores a Summary collection when the optional Summary step ran) and the vulnerability connector's events. What holds it is judged on those steps and on every step above it that has already ended (a failed Summary that ended before it starts is said in its record, as before): one of them that failed, was held or was skipped holds it as before (nothing goes out on a report it needs that is not whole -- absence is not remediation), with the same exceptions (runsOnStored, runsWithoutNiceToHave). A step without it (the daily mail, the verification service) waits for every step above it. A run of one stage or one step, and an install's first collection (nothing is written to the customer's systems before one run is complete), are not changed. 'required' (#748, the verification service -- it runs the daily data health check, CR2): the update adds it to a stored pipeline that does not have it where its job is installed, and the web app does not remove it (its off switch is SI_DataHealth_Enabled).",
|  "_runsOnStored":"'needs' = the job reads the output of those jobs OF THIS RUN: when one of them did not succeed it is held. 'runsOnStored' (a job; read by the PowerShell runner only): the job works on what is STORED and holds back by itself whatever is not complete, so after a step of Correlate (the CI build, Risk Analysis) did not succeed it still runs -- the data sync (it loads only whole collections whose run is shown complete, closes no finding on one that is not, and sends nothing to an output in such a run) and the verification service (it only reads). One failed step then does not cost the customer the rest of the run. NEVER on a job that writes to the customer's systems, changes a ticket or sends a mail: those keep their need. 'brings' (a job): what the job would have brought, as a person reads it -- named in the sentence of a run in which it failed or was held. 'assetBuild' (one job): the build of the merged assets -- on a new install's first collection nothing that rests on it runs before it has finished whole. 'niceToHave' (a job: Risk Analysis Summary -- the overview for management; the owner 2026-10-13: \"connectors only need detailed ... summary is nice-to-have\") + 'runsWithoutNiceToHave' (a job: the CMDB connectors, the vulnerability connector and its ServiceNow form, the data sync): when the ONLY steps that failed after Collect are nice-to-have ones, a step with this mark runs in full on this run's own result -- the findings (Risk Analysis Detailed) and the merged assets of this run are whole. It stays held when Risk Analysis Detailed or the asset correlation did not succeed, and on an install's first collection. The daily mail has no such mark: it waits for a complete run. Off for the whole install: SI_Pro_Pipeline_GoOnAfterFailedStep = $false.",
|  "_title": "'title' (a stage of defaultPipeline): the stage as a heading and in the overview -- its name plus what the stage is for (data-in, data structure, data-out). 'name' stays the short name used inside a sentence about one step, and is what a pipeline stores. The title is decided from the stage id when a pipeline is shown, so a stored pipeline shows it without being rewritten; a name a person gave a stage is kept.",
|  "defaultCadence": "daily",
|  "defaultTimeoutMinutes": 240,
|  "jobs": [
|    { "key": "updater", "defaultCron": "30 16,17 * * *", "engine": "updater", "needs": [], "neverInFlow": true, "ownSchedule": true },
|    { "key": "ptc", "stage": "collect", "defaultCron": "0 1 * * *", "engine": "privilege-tier-classifier", "needs": [], "timeoutMinutes": 180 },
|    { "key": "identity", "stage": "collect", "defaultCron": "30 4 * * *", "engine": "identity", "needs": [ "ptc" ] },
|    { "key": "azure", "stage": "collect", "defaultCron": "0 5 * * *", "engine": "azure", "needs": [ "ptc" ], "reads": [ "identity" ] },
|    { "key": "endpoint", "stage": "collect", "defaultCron": "0 4 * * *", "engine": "endpoint", "needs": [ "ptc" ], "reads": [ "identity" ] },
|    { "key": "publicip", "stage": "collect", "defaultCron": "15 5 * * *", "engine": "publicip", "needs": [ "endpoint", "azure" ] },
|    { "key": "asset-correlation", "stage": "correlate", "defaultCron": "30 5 * * *", "engine": "asset-correlation", "needs": [ "endpoint", "identity", "azure" ], "assetBuild": true, "brings": "a part of the asset list (its correlation did not finish)" },
|    { "key": "asset-properties", "engine": "asset-properties", "needs": [], "neverInFlow": true, "retired": true },
|    { "key": "asset-cmdb-sql", "stage": "deliver", "defaultCron": "55 5 * * *", "engine": "asset-cmdb-sql", "needs": [ "asset-correlation" ], "heldBy": [ "risk-analysis-detailed" ], "startsWhenReady": true, "runsWithoutNiceToHave": true, "brings": "the CMDB update" },
|    { "key": "asset-cmdb", "stage": "deliver", "defaultCron": "0 7 * * *", "engine": "asset-cmdb", "needs": [ "asset-correlation" ], "heldBy": [ "risk-analysis-detailed" ], "startsWhenReady": true, "runsWithoutNiceToHave": true, "brings": "the CMDB update" },
|    { "key": "risk-analysis", "stage": "correlate", "defaultCron": "0 6 * * *", "engine": "risk-analysis", "needs": [ "endpoint", "identity", "azure", "publicip", "ptc", "asset-correlation" ], "niceToHave": true, "defaultEnabled": false, "brings": "the Risk Analysis summary" },
|    { "key": "risk-analysis-detailed", "stage": "correlate", "defaultCron": "0 8 * * *", "engine": "risk-analysis-detailed", "needs": [ "endpoint", "identity", "azure", "publicip", "ptc", "asset-correlation" ], "brings": "the findings and their risk scores" },
|    { "key": "asset-trend", "stage": "correlate", "defaultCron": "0 9 * * *", "engine": "asset-trend", "needs": [ "risk-analysis-detailed" ], "manualInFlowMode": true },
|    { "key": "asset-vulnerabilities", "stage": "deliver", "defaultCron": "0 10 * * *", "engine": "asset-vulnerabilities", "needs": [ "risk-analysis-detailed" ], "startsWhenReady": true, "runsWithoutNiceToHave": true, "brings": "the vulnerability tickets" },
|    { "key": "asset-vulns-servicenow", "stage": "deliver", "defaultCron": "15 10 * * *", "engine": "asset-vulnerabilities-servicenow", "needs": [ "risk-analysis-detailed", "asset-cmdb" ], "startsWhenReady": true, "runsWithoutNiceToHave": true, "brings": "the vulnerability tickets" },
|    { "key": "asset-datasync", "stage": "deliver", "defaultCron": "30 10 * * *", "engine": "asset-datasync", "needs": [ "risk-analysis-detailed", "asset-vulnerabilities" ], "startsWhenReady": true, "runsOnStored": true, "runsWithoutNiceToHave": true },
|    { "key": "close-loop-mail", "stage": "deliver", "defaultCron": "45 10 * * *", "engine": "close-loop-mail", "needs": [ "asset-datasync", "asset-vulnerabilities", "asset-vulns-servicenow" ], "brings": "the daily mail" },
|    { "key": "verification", "stage": "deliver", "defaultCron": "0 11 * * *", "engine": "verification", "needs": [ "ptc", "identity", "azure", "endpoint", "publicip" ], "runsOnStored": true, "required": true },
|    { "key": "asset-tagging", "stage": "deliver", "defaultCron": "50 5 * * *", "engine": "asset-tagging", "needs": [ "endpoint" ] },
|    { "key": "templates", "engine": "templates-publish", "needs": [], "neverInFlow": true },
|    { "key": "schema", "defaultCron": "0 3 * * 0", "engine": "schema-discovery", "needs": [], "neverInFlow": true },
|    { "key": "flow", "defaultCron": "*/5 * * * *", "engine": "flow", "needs": [], "neverInFlow": true },
|    { "key": "config-backup", "defaultCron": "0 18 * * *", "engine": "config-backup", "needs": [], "neverInFlow": true },
|    { "key": "heartbeat", "defaultCron": "7,22,37,52 * * * *", "engine": "heartbeat", "needs": [], "neverInFlow": true },
|    { "key": "signin-methods", "defaultCron": "3,18,33,48 * * * *", "engine": "signin-methods", "needs": [], "neverInFlow": true },
|    { "key": "data-out", "engine": "data-out", "needs": [], "neverInFlow": true, "manualOnly": true, "brings": "the ServiceNow hand-off and the other outputs, sent from the newest collection the data sync marked ready" },
|    { "key": "support-grant", "engine": "support-grant", "needs": [], "neverInFlow": true, "manualOnly": true, "brings": "the Invardia Support app's database access, opened and closed just in time on a support request" }
|  ],
|  "defaultPipeline": {
|    "id": "daily",
|    "name": "Daily pipeline",
|    "stages": [
|      { "id": "collect", "name": "Collect", "title": "Collect (data-in)", "steps": [ "ptc", "identity", "azure", "endpoint", "publicip" ], "withPrevious": [ "endpoint" ], "withPreviousSince": { "endpoint": 2 } },
|      { "id": "correlate", "name": "Correlate", "title": "Correlate (data structure)", "steps": [ "asset-correlation", "risk-analysis", "risk-analysis-detailed" ], "withPrevious": [ "risk-analysis-detailed" ], "withPreviousSince": { "risk-analysis-detailed": 3 } },
|      { "id": "deliver", "name": "Deliver", "title": "Deliver (data-out)", "steps": [ "asset-cmdb-sql", "asset-cmdb", "asset-vulnerabilities", "asset-vulns-servicenow", "asset-datasync", "close-loop-mail", "verification" ] }
|    ]
|  },
|  "defaultFlow": [
|    "ptc", "identity", "azure", "endpoint", "publicip",
|    "asset-correlation", "risk-analysis", "risk-analysis-detailed",
|    "asset-cmdb-sql", "asset-cmdb", "asset-vulnerabilities", "asset-vulns-servicenow", "asset-datasync", "close-loop-mail", "verification"
|  ]
|}
'@ }
$__siSupportFiles['setup/_shared/SI-KedaConvert.ps1'] = @{ Sha256 = 'd47d28c0e21fcb0e431ec96ba4f672776de79a71c0f355a2d7092bd08b405b3d'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- EXISTING INSTALLS MOVE TO QUEUE SCALING ON UPDATE (#519, measured 2026-10-09: an install made before
|    queue scaling (f7faf3a8f, 2026-10-08) kept one scheduled caj-si-identity job, and its ~28,000-object identity collection
|    ran ~2 h in one container. New installs get a producer + queue-scaled workers; the updater never moved the old ones).
|
|    Every update (setup\Invoke-SIContainerUpdate.ps1, the updater job and the VM sync hook both run it) checks the engines
|    that discover into parts (identity, endpoint, azure -- Test-SIKedaPartsEngine) and moves one that still runs as ONE
|    scheduled job to what setup gives a new install -- the SAME jobs, built by the same definitions Bootstrap uses
|    (Get-SIKedaWorkerCreateArgs / Get-SIKedaProducerCreateArgs / Get-SIKedaProducerEnvArgs / Get-SIKedaQueueScaleArgs in
|    container\_shared\SI-ContainerConfig.ps1):
|
|      * WHEN (Get-SIKedaConvertPlan, PURE): caj-si-<engine> exists, no caj-si-<engine>-producer / -worker exists, SI's
|        setup created it (its si-build tag -- Test-SIBootstrapJobIsSI), it signs in with the managed identity (or the
|        certificate, which also carries the identity) -- the rule of Resolve-SIBootstrapKedaChoice: a client secret stays
|        as it is, the updater never changes a sign-in -- and the install has not switched queue scaling off
|        (SI_Bootstrap_UseKEDA = $false in the config, or SI_UPDATER_USE_KEDA = false on the updater job).
|      * HOW (Invoke-SIKedaConvert): from the old job itself -- its image, environment, secrets, identity, registry, size
|        and schedule: (1) the queue scaler's storage queue role for the jobs' identity (present, or granted; missing =
|        nothing changes); (2) the shard queue (the producer also makes it, so a refusal here is only noted); (3) the
|        worker (event-triggered, the queue scale rule, up to SI_Bootstrap_KedaMaxReplicas at once, the old job's size);
|        (4) the producer, created WITHOUT a timer (its cron remembered); (5) both read back; (6) only then the old job is
|        switched off (its timer removed and remembered, the job kept) and the producer gets the old cron. A job of the
|        daily job flow (no timer of its own) stays that way: the producer joins the flow in its place.
|      * NEVER TWO SCHEDULES: the old job loses its timer before the producer gets one. Any failure: the jobs this run
|        created are removed again, the old job runs on as before, one line says why, and the next update tries again.
|      * Never throws; -WhatIf: the plan only, no Azure call at all.
|
|    NO az CLI, no PowerShell module: every call is ARM or storage data-plane REST through ONE seam,
|    -Rest { param([string]$Method, [string]$Uri, $Body, [string]$Resource, [hashtable]$Headers) } -> @{ Status; Body }
|    ($Resource = the token audience: https://management.azure.com/ or https://storage.azure.com/). The jobs are built by
|    translating Bootstrap's own job definitions (the az arguments) into the ARM resource (ConvertFrom-SIJobCreateArgs, PURE).
|#>
|
|$script:SIKedaConvertLibRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|if (-not (Get-Command Get-SIKedaWorkerCreateArgs -ErrorAction SilentlyContinue)) { . ([IO.Path]::Combine($script:SIKedaConvertLibRoot, 'container', '_shared', 'SI-ContainerConfig.ps1')) }
|if (-not (Get-Command Get-SIRegistryPullArgs -ErrorAction SilentlyContinue)) { . ([IO.Path]::Combine($script:SIKedaConvertLibRoot, 'setup', '_shared', 'SI-ContainerUpdate.ps1')) }
|if (-not (Get-Command ConvertTo-SIArmJobTrigger -ErrorAction SilentlyContinue)) { . ([IO.Path]::Combine($script:SIKedaConvertLibRoot, 'engine', '_shared', 'SI-JobFlow.ps1')) }
|
|# the PATCH of a job's trigger reads and writes in the schema the jobs were listed in (SI-FastRoll.ps1, live 2026-10-06)
|$script:SIKedaConvertArmApi = '2025-07-01'
|$script:SIKedaConvertDefaultMaxReplicas = 30   # Bootstrap's -KedaMaxReplicas default
|
|function Get-SIKedaConvertProp {
|    <# PURE. A property of a parsed ARM object, $null when absent (never throws on a missing level). #>
|    param($Object, [string[]]$Path)
|    $o = $Object
|    foreach ($p in $Path) {
|        if ($null -eq $o) { return $null }
|        if ($o -is [System.Collections.IDictionary]) { if ($o.Contains($p)) { $o = $o[$p] } else { return $null }; continue }
|        $pp = $o.PSObject.Properties[$p]; if (-not $pp) { return $null }; $o = $pp.Value
|    }
|    $o
|}
|
|function ConvertTo-SIKedaConvertEnvArgs {
|    <# PURE. A job container's env list (ARM: name + value | secretRef) as az's NAME=value / NAME=secretref:<secret>. #>
|    param([object[]]$Env = @())
|    @(@($Env) | Where-Object { $_ -and "$(Get-SIKedaConvertProp $_ @('name'))".Trim() } | ForEach-Object {
|        $n = [string](Get-SIKedaConvertProp $_ @('name')); $sr = [string](Get-SIKedaConvertProp $_ @('secretRef'))
|        if ($sr) { '{0}=secretref:{1}' -f $n, $sr } else { '{0}={1}' -f $n, [string](Get-SIKedaConvertProp $_ @('value')) }
|    })
|}
|
|function Get-SIKedaConvertEnvValue {
|    <# PURE. The value of NAME in a NAME=value list ('' when absent). #>
|    param([object[]]$EnvArgs = @(), [string]$Name)
|    foreach ($e in @($EnvArgs)) { $s = [string]$e; if ($s.StartsWith($Name + '=')) { return $s.Substring($Name.Length + 1) } }
|    ''
|}
|
|function Get-SIKedaWorkerEnvFromJob {
|    <# PURE. The worker's environment from the scheduled job's: the same settings, and the worker's own queue settings
|       (SI_TRIGGER_FROM_QUEUE=1, role worker, a shard lease longer than its replica) -- what Bootstrap gives a new worker. #>
|    param([object[]]$EnvArgs = @(), [int]$ReplicaTimeout)
|    @(@($EnvArgs | Where-Object { [string]$_ -notmatch '^(SI_TRIGGER_FROM_QUEUE|SI_ROLE|SI_QUEUE_LEASE_SECONDS)=' }) +
|      @('SI_TRIGGER_FROM_QUEUE=1', 'SI_ROLE=worker') + @(Get-SIKedaQueueLeaseEnvArgs -ReplicaTimeout $ReplicaTimeout))
|}
|
|function Get-SIKedaConvertJobIdentity {
|    <#
|        PURE. The user-assigned identity the job signs in with: the one whose client id is SI_UAMI_CLIENTID, else the only
|        one assigned. Returns @{ ResourceId; PrincipalId; ClientId } or $null.
|    #>
|    param($Job, [string]$ClientId)
|    $ua = Get-SIKedaConvertProp $Job @('identity', 'userAssignedIdentities')
|    if ($null -eq $ua) { return $null }
|    $rows = @()
|    if ($ua -is [System.Collections.IDictionary]) { foreach ($k in $ua.Keys) { $rows += [pscustomobject]@{ ResourceId = [string]$k; V = $ua[$k] } } }
|    else { foreach ($p in $ua.PSObject.Properties) { $rows += [pscustomobject]@{ ResourceId = $p.Name; V = $p.Value } } }
|    $rows = @($rows | ForEach-Object { [pscustomobject]@{ ResourceId = $_.ResourceId; PrincipalId = [string](Get-SIKedaConvertProp $_.V @('principalId')); ClientId = [string](Get-SIKedaConvertProp $_.V @('clientId')) } })
|    if ($ClientId) { $m = @($rows | Where-Object { $_.ClientId -eq $ClientId }); if ($m.Count -eq 1) { return $m[0] } }
|    if ($rows.Count -eq 1) { return $rows[0] }
|    $null
|}
|
|function Resolve-SIKedaConvertOptOut {
|    <# PURE. Queue scaling switched off for this install: the config's SI_Bootstrap_UseKEDA, else SI_UPDATER_USE_KEDA on
|       the updater job. Returns the configured value as Resolve-SIBootstrapKedaChoice reads it ($null = not set). #>
|    param([hashtable]$Globals = @{}, [string]$UpdaterValue)
|    if ($Globals.ContainsKey('SI_Bootstrap_UseKEDA') -and $null -ne $Globals['SI_Bootstrap_UseKEDA'] -and "$($Globals['SI_Bootstrap_UseKEDA'])".Trim() -ne '') { return $Globals['SI_Bootstrap_UseKEDA'] }
|    if ("$UpdaterValue".Trim()) { return "$UpdaterValue".Trim() }
|    $null
|}
|
|function Get-SIKedaConvertPlan {
|    <#
|        PURE. What the update does per parts engine, from the job list (ARM shape) and the customer's settings:
|          convert -- caj-si-<engine> runs as one job; it moves to producer + workers
|          keep    -- it stays as it is (Reason says why, in plain words)
|        An engine with no job of its own, or already on producer + worker, gives a 'keda' row (nothing to do).
|        Returns @(@{ Engine; Action = convert | keep | keda; Job; Reason; AuthMode; Identity; StorageAccount; Cron; Trigger }).
|    #>
|    param([object[]]$Jobs = @(), [hashtable]$Globals = @{}, [string]$UpdaterUseKeda)
|    $byName = @{}
|    foreach ($j in @($Jobs)) { if ($j) { $n = [string](Get-SIKedaConvertProp $j @('name')); if ($n) { $byName[$n.ToLowerInvariant()] = $j } } }
|    $configured = Resolve-SIKedaConvertOptOut -Globals $Globals -UpdaterValue $UpdaterUseKeda
|    $rows = New-Object System.Collections.Generic.List[object]
|    foreach ($e in @($script:SIKedaPartsEngines)) {
|        $plainName = "caj-si-$e"; $plain = $byName[$plainName]
|        $hasP = $byName.ContainsKey("caj-si-$e-producer"); $hasW = $byName.ContainsKey("caj-si-$e-worker")
|        $row = [ordered]@{ Engine = $e; Action = 'keep'; Job = $plainName; Reason = ''; AuthMode = ''; Identity = $null; StorageAccount = ''; Cron = ''; Trigger = '' }
|        if (-not $plain) {
|            $row.Action = 'keda'
|            $row.Reason = $(if ($hasP -and $hasW) { 'already runs as a producer and queue-scaled workers' } elseif ($hasP -or $hasW) { 'has only half of the producer and worker -- run the container setup again to complete it' } else { 'not installed' })
|            $rows.Add([pscustomobject]$row); continue
|        }
|        if ($hasP -or $hasW) { $row.Reason = 'runs as a scheduled job and has a producer or worker beside it -- left as it is; run the container setup again to settle it'; $rows.Add([pscustomobject]$row); continue }
|        $env = @(ConvertTo-SIKedaConvertEnvArgs -Env @(Get-SIKedaConvertProp $plain @('properties', 'template', 'containers') | Select-Object -First 1 | ForEach-Object { Get-SIKedaConvertProp $_ @('env') }))
|        $ident = Get-SIKedaConvertJobIdentity -Job $plain -ClientId (Get-SIKedaConvertEnvValue -EnvArgs $env -Name 'SI_UAMI_CLIENTID')
|        $authEnv = @{}; foreach ($a in $env) { $kv = ([string]$a) -split '=', 2; if ($kv.Count -eq 2) { $authEnv[$kv[0]] = $kv[1] } }
|        if ($ident) { $authEnv['IDENTITY_ENDPOINT'] = 'assigned' }   # Container Apps injects it into a job that has an identity
|        $auth = Resolve-SIContainerAuthMode -Environment $authEnv
|        $row.AuthMode = $auth.Mode; $row.Identity = $ident
|        $choice = Resolve-SIBootstrapKedaChoice -Configured $configured -AuthMode $(if ($auth.Mode -eq 'None') { 'Secret' } else { $auth.Mode }) -AuthDefault $false
|        $trigger = [string](Get-SIKedaConvertProp $plain @('properties', 'configuration', 'triggerType'))
|        $cron = [string](Get-SIKedaConvertProp $plain @('properties', 'configuration', 'scheduleTriggerConfig', 'cronExpression'))
|        if (-not $cron) { $cron = [string](Get-SIKedaConvertProp $plain @('tags', 'si-disabled-cron')) }
|        $row.Trigger = $trigger; $row.Cron = $cron
|        $row.StorageAccount = Get-SIKedaConvertEnvValue -EnvArgs $env -Name 'SI_STORAGE_ACCOUNT'
|        if (-not $row.StorageAccount -and $Globals.ContainsKey('SI_StorageAccount')) { $row.StorageAccount = "$($Globals['SI_StorageAccount'])".Trim() }
|        if (-not $choice.Keda -and $choice.Explicit -and -not $choice.Refuse) { $row.Reason = 'queue scaling is switched off for this install (SI_Bootstrap_UseKEDA = $false)' }
|        elseif ($auth.Mode -eq 'Secret' -or $auth.Mode -eq 'None') { $row.Reason = 'its job signs in with a client secret, and queue scaling needs the jobs'' managed identity -- the update never changes how the jobs sign in' }
|        elseif (-not $ident) { $row.Reason = 'the job''s managed identity could not be told apart (none, or more than one, assigned)' }
|        elseif (-not $choice.Keda) { $row.Reason = 'queue scaling is switched off for this install' }
|        elseif (-not (Test-SIBootstrapJobIsSI -Job $plain)) { $row.Reason = 'SecurityInsight''s setup did not create this job (no si-build tag), so the update does not change it' }
|        elseif ($trigger -notin @('Schedule', 'Manual')) { $row.Reason = ('its trigger is {0}, not a schedule' -f $(if ($trigger) { $trigger } else { 'unknown' })) }
|        elseif ($trigger -eq 'Schedule' -and -not $cron) { $row.Reason = 'its schedule could not be read' }
|        elseif (-not $row.StorageAccount) { $row.Reason = 'the storage account that holds the queues is not known (SI_STORAGE_ACCOUNT on the job)' }
|        elseif (-not [string](Get-SIKedaConvertProp $plain @('properties', 'environmentId'))) { $row.Reason = 'the job''s Container Apps environment could not be read' }
|        else { $row.Action = 'convert'; $row.Reason = 'runs as one scheduled job' }
|        $rows.Add([pscustomobject]$row)
|    }
|    $rows.ToArray()
|}
|
|# The storage queue roles the queue scaler can read the queue length with, by role definition id (the same in every cloud)
|$script:SIKedaConvertQueueRoleIds = @{
|    'Storage Queue Data Contributor' = '974c5e8b-45b9-4653-ba55-5f855dd0fb88'
|    'Storage Queue Data Reader'      = '19e7f393-937e-4f77-808e-94535e297925'
|}
|$script:SIKedaConvertRoleApi = '2022-04-01'
|$script:SIKedaConvertStorageApi = '2023-05-01'
|$script:SIKedaConvertQueueVersion = '2021-08-06'   # the data-plane x-ms-version engine/_shared/SI-AzRest.ps1 uses
|
|function ConvertFrom-SIJobCreateArgs {
|    <#
|        PURE. Bootstrap's job definition -- the `az containerapp job create` arguments of Get-SIKedaWorkerCreateArgs /
|        Get-SIKedaProducerCreateArgs plus tags, registry, identity, secrets and env -- as the ARM resource of
|        Microsoft.App/jobs, so the update creates EXACTLY the job setup would, with no az CLI. Every flag is translated;
|        a flag this does not know is refused (throws), never dropped.
|          --environment            properties.environmentId (a resource id)
|          --trigger-type           configuration.triggerType; --cron-expression scheduleTriggerConfig.cronExpression
|          --replica-timeout / --replica-retry-limit                      configuration.replicaTimeout / replicaRetryLimit
|          --parallelism / --replica-completion-count                     <trigger>TriggerConfig.parallelism / replicaCompletionCount
|          --min-executions / --max-executions / --polling-interval      eventTriggerConfig.scale.*
|          --scale-rule-name / -type / -metadata k=v / -identity         eventTriggerConfig.scale.rules[0] (identity auth)
|          --image / --cpu / --memory / --env-vars N=V | N=secretref:S    template.containers[0] (named after the job, as az does)
|          --registry-server + --registry-identity | --registry-username/--registry-password   configuration.registries[0]
|          --secrets n=v | n=keyvaultref:<url>,identityref:<id>           configuration.secrets
|          --mi-user-assigned       identity (UserAssigned);  --tags k=v  tags;  --name / --resource-group  the resource's path
|        Returns @{ Name; ResourceGroup; Body }.
|    #>
|    param([Parameter(Mandatory)][object[]]$CreateArgs, [string]$Location)
|    $a = @($CreateArgs | ForEach-Object { [string]$_ })
|    if ($a.Count -lt 3 -or $a[0] -ne 'containerapp' -or $a[1] -ne 'job' -or $a[2] -ne 'create') { throw 'not an az containerapp job create argument list' }
|    $known = @('--name', '--resource-group', '--environment', '--trigger-type', '--replica-timeout', '--replica-retry-limit', '--replica-completion-count',
|               '--parallelism', '--cron-expression', '--min-executions', '--max-executions', '--polling-interval', '--scale-rule-name', '--scale-rule-type',
|               '--scale-rule-metadata', '--scale-rule-identity', '--image', '--registry-server', '--registry-identity', '--registry-username',
|               '--registry-password', '--cpu', '--memory', '--output', '--tags', '--mi-user-assigned', '--secrets', '--env-vars')
|    $v = [ordered]@{}
|    $i = 3
|    while ($i -lt $a.Count) {
|        $f = $a[$i]
|        if (-not $f.StartsWith('--')) { throw ("unexpected value '{0}' in the job definition" -f $f) }
|        if ($known -notcontains $f) { throw ("the ARM translation does not know {0} -- add it to ConvertFrom-SIJobCreateArgs" -f $f) }
|        $i++
|        if (-not $v.Contains($f)) { $v[$f] = New-Object System.Collections.Generic.List[string] }
|        while ($i -lt $a.Count -and -not $a[$i].StartsWith('--')) { $v[$f].Add($a[$i]); $i++ }
|    }
|    $one = { param($f, $def) if ($v.Contains($f) -and $v[$f].Count) { $v[$f][0] } else { $def } }
|    $all = { param($f) if ($v.Contains($f)) { @($v[$f]) } else { @() } }
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $name = & $one '--name' ''
|    if (-not $name) { throw 'the job definition has no --name' }
|    $trigger = & $one '--trigger-type' 'Manual'
|    $cfg = [ordered]@{ triggerType = $trigger; replicaTimeout = [int](& $one '--replica-timeout' '1800'); replicaRetryLimit = [int](& $one '--replica-retry-limit' '0') }
|    $tc = [ordered]@{ parallelism = [int](& $one '--parallelism' '1'); replicaCompletionCount = [int](& $one '--replica-completion-count' '1') }
|    switch ($trigger) {
|        'Schedule' { $cron = & $one '--cron-expression' ''; if (-not $cron) { throw 'a Schedule job needs --cron-expression' }; $cfg.scheduleTriggerConfig = [ordered]@{ cronExpression = $cron; parallelism = $tc.parallelism; replicaCompletionCount = $tc.replicaCompletionCount } }
|        'Manual'   { $cfg.manualTriggerConfig = $tc }
|        'Event'    {
|            $scale = [ordered]@{ minExecutions = [int](& $one '--min-executions' '0'); maxExecutions = [int](& $one '--max-executions' '10'); pollingInterval = [int](& $one '--polling-interval' '30'); rules = @() }
|            $rn = & $one '--scale-rule-name' ''
|            if ($rn) {
|                $md = [ordered]@{}; foreach ($kv in (& $all '--scale-rule-metadata')) { $p = $kv -split '=', 2; $md[$p[0]] = $(if ($p.Count -gt 1) { $p[1] } else { '' }) }
|                $rule = [ordered]@{ name = $rn; type = (& $one '--scale-rule-type' ''); metadata = $md }
|                $rid = & $one '--scale-rule-identity' ''; if ($rid) { $rule.identity = $rid }
|                $scale.rules = @($rule)
|            }
|            $cfg.eventTriggerConfig = [ordered]@{ parallelism = $tc.parallelism; replicaCompletionCount = $tc.replicaCompletionCount; scale = $scale }
|        }
|        default { throw ("unknown trigger type '{0}'" -f $trigger) }
|    }
|    $secrets = New-Object System.Collections.Generic.List[object]
|    foreach ($s in (& $all '--secrets')) {
|        $p = $s -split '=', 2; $sv = $(if ($p.Count -gt 1) { $p[1] } else { '' })
|        if ($sv.StartsWith('keyvaultref:')) {
|            $ref = $sv.Substring(12); $k = $ref.IndexOf(',identityref:')
|            if ($k -ge 0) { $secrets.Add([ordered]@{ name = $p[0]; keyVaultUrl = $ref.Substring(0, $k); identity = $ref.Substring($k + 13) }) } else { $secrets.Add([ordered]@{ name = $p[0]; keyVaultUrl = $ref }) }
|        } else { $secrets.Add([ordered]@{ name = $p[0]; value = $sv }) }
|    }
|    $server = & $one '--registry-server' ''
|    if ($server) {
|        $reg = [ordered]@{ server = $server }
|        $rid = & $one '--registry-identity' ''; $ru = & $one '--registry-username' ''
|        if ($rid) { $reg.identity = $rid }
|        elseif ($ru) { $reg.username = $ru; $reg.passwordSecretRef = 'registry-password'; $secrets.Add([ordered]@{ name = 'registry-password'; value = (& $one '--registry-password' '') }) }
|        $cfg.registries = @($reg)
|    }
|    if ($secrets.Count) { $cfg.secrets = $secrets.ToArray() }
|    $env = @(& $all '--env-vars' | ForEach-Object {
|        $p = $_ -split '=', 2; $ev = $(if ($p.Count -gt 1) { $p[1] } else { '' })
|        if ($ev.StartsWith('secretref:')) { [ordered]@{ name = $p[0]; secretRef = $ev.Substring(10) } } else { [ordered]@{ name = $p[0]; value = $ev } }
|    })
|    $container = [ordered]@{ name = $name; image = (& $one '--image' ''); resources = [ordered]@{ cpu = [double]::Parse((& $one '--cpu' '0.5'), $inv); memory = (& $one '--memory' '1Gi') }; env = $env }
|    $tags = [ordered]@{}; foreach ($t in (& $all '--tags')) { $p = $t -split '=', 2; $tags[$p[0]] = $(if ($p.Count -gt 1) { $p[1] } else { '' }) }
|    $body = [ordered]@{}
|    if ($Location) { $body.location = $Location }
|    if ($tags.Count) { $body.tags = $tags }
|    $mi = @(& $all '--mi-user-assigned')
|    if ($mi.Count) { $ua = [ordered]@{}; foreach ($m in $mi) { $ua[$m] = @{} }; $body.identity = [ordered]@{ type = 'UserAssigned'; userAssignedIdentities = $ua } }
|    $body.properties = [ordered]@{ environmentId = (& $one '--environment' ''); configuration = $cfg; template = [ordered]@{ containers = @($container) } }
|    [pscustomobject]@{ Name = $name; ResourceGroup = (& $one '--resource-group' ''); Body = $body }
|}
|
|function Get-SIKedaConvertJobSpec {
|    <#
|        PURE. The producer and worker for one engine, from its scheduled job: Bootstrap's job definitions (the az create
|        arguments) with the old job's image, registry, identity, size, environment and secrets, translated to the ARM
|        resource (ConvertFrom-SIJobCreateArgs). The producer is created with NO timer (Manual; the cron remembered in
|        si-disabled-cron) -- the update gives it the cron only after the old job has lost its own. -SecretArgs: name=value /
|        name=keyvaultref:... for every secret the old job carries (the registry password excluded -- -RegistryPassword).
|        Returns @{ Worker; Producer; WorkerArgs; ProducerArgs; WorkerBody; ProducerBody; QueueName; Image; Cron; ShardCount; MaxExecutions }.
|    #>
|    param([Parameter(Mandatory)]$Job, [Parameter(Mandatory)]$Plan, [Parameter(Mandatory)][string]$ResourceGroup,
|          [object[]]$SecretArgs = @(), [string]$RegistryPassword, [int]$MaxExecutions = 30)
|    $e = $Plan.Engine
|    $c = @(Get-SIKedaConvertProp $Job @('properties', 'template', 'containers'))[0]
|    $image = [string](Get-SIKedaConvertProp $c @('image'))
|    $env = @(ConvertTo-SIKedaConvertEnvArgs -Env @(Get-SIKedaConvertProp $c @('env')))
|    $cfg = Get-SIKedaConvertProp $Job @('properties', 'configuration')
|    $timeout = [int](Get-SIKedaConvertProp $cfg @('replicaTimeout')); if ($timeout -le 0) { $timeout = [int](Get-SIJobRunLimit) }   # a job that names none: what every engine job gets
|    $cpuRaw = Get-SIKedaConvertProp $c @('resources', 'cpu')
|    $cpu = if ($null -ne $cpuRaw -and "$cpuRaw".Trim()) { ([double]$cpuRaw).ToString([Globalization.CultureInfo]::InvariantCulture) } else { '1.0' }
|    $mem = [string](Get-SIKedaConvertProp $c @('resources', 'memory')); if (-not $mem) { $mem = '2Gi' }
|    $reg = @(Get-SIKedaConvertProp $cfg @('registries') | Where-Object { $_ })[0]
|    $login = [string](Get-SIKedaConvertProp $reg @('server')); if (-not $login) { $login = ($image -split '/')[0] }
|    $regArgs = @()
|    $regIdentity = [string](Get-SIKedaConvertProp $reg @('identity'))
|    $regUser = [string](Get-SIKedaConvertProp $reg @('username'))
|    if ($regIdentity) { $regArgs = @(Get-SIRegistryPullArgs -Mode 'ManagedIdentity' -IdentityResourceId $regIdentity) }
|    elseif ($regUser -and $RegistryPassword) { $regArgs = @('--registry-username', $regUser, '--registry-password', $RegistryPassword) }
|    $shards = 0; [void][int]::TryParse((Get-SIKedaConvertEnvValue -EnvArgs $env -Name 'SI_SHARD_COUNT'), [ref]$shards); if ($shards -le 0) { $shards = 1 }
|    $build = [string](Get-SIKedaConvertProp $Job @('tags', 'si-build'))
|    $envId = [string](Get-SIKedaConvertProp $Job @('properties', 'environmentId'))
|    $location = [string](Get-SIKedaConvertProp $Job @('location'))
|    $ident = $Plan.Identity
|    $workerName = "caj-si-$e-worker"; $producerName = "caj-si-$e-producer"
|    $workerEnv = @(Get-SIKedaWorkerEnvFromJob -EnvArgs $env -ReplicaTimeout $timeout)
|    $producerEnv = @(Get-SIKedaProducerEnvArgs -EnvArgs $env -Parallelism $shards)
|    $tail = {
|        param([object[]]$EnvArgs, [string[]]$Tags)
|        $t = @('--tags') + @($Tags | Where-Object { $_ })
|        $t + $regArgs + @('--mi-user-assigned', $ident.ResourceId) + $(if (@($SecretArgs).Count) { @('--secrets') + @($SecretArgs) } else { @() }) + @('--env-vars') + @($EnvArgs)
|    }
|    $w = @(Get-SIKedaWorkerCreateArgs -Name $workerName -ResourceGroup $ResourceGroup -Environment $envId -Image $image -LoginServer $login `
|            -ReplicaTimeout $timeout -Cpu $cpu -Memory $mem -MaxExecutions $MaxExecutions -Engine $e -StorageAccount $Plan.StorageAccount -IdentityResourceId $ident.ResourceId)
|    $w += @(& $tail $workerEnv @($(if ($build) { "si-build=$build" })))
|    $p = @(Get-SIKedaProducerCreateArgs -Name $producerName -ResourceGroup $ResourceGroup -Environment $envId -Cron $(if ($Plan.Cron) { $Plan.Cron } else { '0 0 * * *' }) -Image $image -LoginServer $login `
|            -Cpu ([string]$cpu) -Memory ([string]$mem) -ReplicaTimeout ([int]$timeout))
|    # assigned as it comes (it returns its array with a leading comma: @( ) around it would nest it)
|    $p = ConvertTo-SIManualCreateArgs -CreateArgs $p -RememberCron ''   # no timer yet; the tag is set below, with si-build, in ONE --tags
|    $p += @(& $tail $producerEnv @($(if ($build) { "si-build=$build" }), $(if ($Plan.Cron) { "si-disabled-cron=$($Plan.Cron)" })))
|    [pscustomobject]@{ Worker = $workerName; Producer = $producerName; WorkerArgs = $w; ProducerArgs = $p
|                       WorkerBody = (ConvertFrom-SIJobCreateArgs -CreateArgs $w -Location $location).Body
|                       ProducerBody = (ConvertFrom-SIJobCreateArgs -CreateArgs $p -Location $location).Body
|                       QueueName = (Get-SIKedaQueueName -Engine $e); Image = $image; Cron = $Plan.Cron; ShardCount = $shards; MaxExecutions = $MaxExecutions }
|}
|
|function Test-SIKedaConvertReadBack {
|    <# PURE. The worker and producer as Azure returned them: created (provisioning not failed), the worker event-triggered
|       with the queue rule on the image, the producer without a timer on the image. Returns '' (good) or what is wrong. #>
|    param($Worker, $Producer, [Parameter(Mandatory)][string]$Image, [Parameter(Mandatory)][string]$QueueName)
|    if (-not $Worker) { return 'the worker could not be read back' }
|    if (-not $Producer) { return 'the producer could not be read back' }
|    foreach ($x in @(@{ N = 'worker'; J = $Worker }, @{ N = 'producer'; J = $Producer })) {
|        $ps = [string](Get-SIKedaConvertProp $x.J @('properties', 'provisioningState'))
|        if ($ps -and $ps -ne 'Succeeded') { return ('the {0} was not created (provisioning {1})' -f $x.N, $ps) }
|    }
|    if ([string](Get-SIKedaConvertProp $Worker @('properties', 'configuration', 'triggerType')) -ne 'Event') { return 'the worker is not event-triggered' }
|    $rule = @(Get-SIKedaConvertProp $Worker @('properties', 'configuration', 'eventTriggerConfig', 'scale', 'rules') | Where-Object { $_ -and [string](Get-SIKedaConvertProp $_ @('name')) -eq 'si-shards-queue' })[0]
|    if (-not $rule) { return 'the worker has no queue scale rule' }
|    $q = [string](Get-SIKedaConvertProp $rule @('metadata', 'queueName'))
|    if ($q -and $q -ne $QueueName) { return ('the worker''s scale rule reads {0}, not {1}' -f $q, $QueueName) }
|    if ([string](Get-SIKedaConvertProp $Producer @('properties', 'configuration', 'triggerType')) -ne 'Manual') { return 'the producer has a timer before the old job lost its own' }
|    foreach ($x in @(@{ N = 'worker'; J = $Worker }, @{ N = 'producer'; J = $Producer })) {
|        $img = [string](@(Get-SIKedaConvertProp $x.J @('properties', 'template', 'containers'))[0] | ForEach-Object { Get-SIKedaConvertProp $_ @('image') })
|        if ($img -ne $Image) { return ('the {0} runs {1}, not {2}' -f $x.N, $img, $Image) }
|    }
|    ''
|}
|
|function Invoke-SIKedaConvert {
|    <#
|        EXISTING INSTALLS: move every parts engine that still runs as one scheduled job to a producer + queue-scaled workers
|        (the plan: Get-SIKedaConvertPlan). -Jobs: the job list (ARM shape). -Rest { param([string]$Method, [string]$Uri,
|        $Body, [string]$Resource, [hashtable]$Headers) } -> @{ Status; Body } -- ARM (https://management.azure.com/, every
|        path under /subscriptions/<-SubscriptionId>) and the queue data plane (https://storage.azure.com/). No az CLI.
|        -WhatIf: the plan only, no call. Returns @{ Results = @(@{ Engine; Action = converted | would-convert | keep | keda |
|        failed; Line }); Lines }. NEVER throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [object[]]$Jobs = @(), [hashtable]$Globals = @{}, [string]$UpdaterUseKeda, [switch]$WhatIf, [int]$PollSeconds = 5, [int]$PollMax = 36)
|    $results = New-Object System.Collections.Generic.List[object]
|    $lines = New-Object System.Collections.Generic.List[string]
|    $add = { param($e, $a, $l) $results.Add([pscustomobject]@{ Engine = $e; Action = $a; Line = $l }); if ($l) { $lines.Add($l) } }
|    try {
|        $plan = @(Get-SIKedaConvertPlan -Jobs $Jobs -Globals $Globals -UpdaterUseKeda $UpdaterUseKeda)
|        $arm = 'https://management.azure.com/'; $stor = 'https://storage.azure.com/'
|        $api = $script:SIKedaConvertArmApi
|        $call = {
|            param([string]$Method, [string]$Uri, $Body, [string]$Resource, [hashtable]$Headers)
|            $r = $null
|            try { $r = & $Rest $Method $Uri $Body $Resource $Headers } catch { $r = [pscustomobject]@{ Status = 0; Body = $_.Exception.Message } }
|            if (-not $r) { $r = [pscustomobject]@{ Status = 0; Body = 'no answer' } }
|            $r
|        }
|        $isOk = { param($r) $r -and [int]$r.Status -ge 200 -and [int]$r.Status -lt 300 }
|        $parse = { param($r) if (-not $r -or -not "$($r.Body)".Trim()) { return $null }; $o = $null; try { $o = ("$($r.Body)" | ConvertFrom-Json) } catch { $o = $null }; return $o }
|        $why = { param($r) $t = ("$(if ($r) { $r.Body })" -replace '\s+', ' ').Trim(); if ($t.Length -gt 300) { $t = $t.Substring(0, 297) + '...' }; ('HTTP {0}{1}' -f $(if ($r) { [int]$r.Status } else { 0 }), $(if ($t) { ": $t" } else { '' })) }
|        $jobPath = { param($n) '/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs/{2}' -f $SubscriptionId, $ResourceGroup, $n }
|        $jobUri = { param($n, [string]$Action) 'https://management.azure.com{0}{1}?api-version={2}' -f (& $jobPath $n), $Action, $api }
|        $max = $script:SIKedaConvertDefaultMaxReplicas
|        if ($Globals.ContainsKey('SI_Bootstrap_KedaMaxReplicas')) { $m = 0; if ([int]::TryParse("$($Globals['SI_Bootstrap_KedaMaxReplicas'])", [ref]$m) -and $m -gt 0) { $max = $m } }
|        $byName = @{}; foreach ($j in @($Jobs)) { if ($j) { $byName[([string](Get-SIKedaConvertProp $j @('name'))).ToLowerInvariant()] = $j } }
|        $toJson = { param($o) ConvertTo-Json -InputObject $o -Depth 30 -Compress }
|        # a created job is read back once its creation has finished (ARM creates a job asynchronously)
|        $readBack = {
|            param([string]$n)
|            for ($k = 1; $k -le [Math]::Max(1, $PollMax); $k++) {
|                $r = & $call 'GET' (& $jobUri $n) $null $arm $null
|                if (-not (& $isOk $r)) { return $null }
|                $j = & $parse $r
|                $ps = [string](Get-SIKedaConvertProp $j @('properties', 'provisioningState'))
|                if (-not $ps -or $ps -in @('Succeeded', 'Failed', 'Canceled')) { return $j }
|                if ($k -lt $PollMax -and $PollSeconds -gt 0) { Start-Sleep -Seconds $PollSeconds }
|            }
|            $j
|        }
|        $stgIds = @{}
|
|        foreach ($row in $plan) {
|            $e = $row.Engine
|            if ($row.Action -eq 'keda') { if ($row.Reason -ne 'not installed') { & $add $e 'keda' ('queue scaling: {0} {1}' -f $e, $row.Reason) } else { & $add $e 'keda' '' }; continue }
|            if ($row.Action -eq 'keep') { & $add $e 'keep' ('queue scaling: {0} stays one scheduled job ({1}) -- {2}' -f $e, $row.Job, $row.Reason); continue }
|            $old = $byName[$row.Job]
|            $when = if ($row.Trigger -eq 'Schedule') { "on its schedule '$($row.Cron)'" } else { 'in the daily job flow, as the old job was' }
|            if ($WhatIf) {
|                & $add $e 'would-convert' ('queue scaling: {0} would move from one scheduled job ({1}) to a producer ({2}) and queue-scaled workers ({3}) (re-run with -Apply)' -f $e, $row.Job, "caj-si-$e-producer", "caj-si-$e-worker")
|                continue
|            }
|            $created = New-Object System.Collections.Generic.List[string]
|            $fail = {
|                param([string]$Reason)
|                foreach ($n in @($created)) { $null = & $call 'DELETE' (& $jobUri $n) $null $arm $null }
|                & $add $e 'failed' ('queue scaling: {0} was NOT moved ({1}) -- it keeps running as the scheduled job {2}; the next update tries again' -f $e, $Reason, $row.Job)
|            }
|            try {
|                # (1) the storage account's resource id (ARM list of the subscription's accounts, read once)
|                $acct = $row.StorageAccount.ToLowerInvariant()
|                if (-not $stgIds.ContainsKey($acct)) {
|                    $found = ''
|                    # FIRST the account read directly in its resource group (the install's own group, then the configured storage
|                    # group): the updater's identity holds rights on the resource group, not on the subscription -- a
|                    # subscription-wide list answers 403 there (internal ring 1, 2026-10-10: "could not be read").
|                    $rgs = New-Object System.Collections.Generic.List[string]
|                    foreach ($cand in @($ResourceGroup, $(if ($Globals -and $Globals.ContainsKey('SI_StorageResourceGroup')) { $Globals['SI_StorageResourceGroup'] }))) {
|                        if ("$cand".Trim() -and -not $rgs.Contains("$cand".Trim())) { $rgs.Add("$cand".Trim()) }
|                    }
|                    $lastAnswer = ''
|                    foreach ($rgName in $rgs) {
|                        if ($found) { break }
|                        $u = 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Storage/storageAccounts/{2}?api-version={3}' -f $SubscriptionId, $rgName, $acct, $script:SIKedaConvertStorageApi
|                        $r = & $call 'GET' $u $null $arm $null
|                        if (& $isOk $r) { $found = [string](Get-SIKedaConvertProp (& $parse $r) @('id')) } else { $lastAnswer = ('in {0}: {1}' -f $rgName, (& $why $r)) }
|                    }
|                    $next = if ($found) { '' } else { 'https://management.azure.com/subscriptions/{0}/providers/Microsoft.Storage/storageAccounts?api-version={1}' -f $SubscriptionId, $script:SIKedaConvertStorageApi }
|                    $pages = 0
|                    while ($next -and -not $found -and $pages -lt 50) {
|                        $pages++; $r = & $call 'GET' $next $null $arm $null
|                        if (-not (& $isOk $r)) { $lastAnswer = ('{0}; the subscription list: {1}' -f $lastAnswer, (& $why $r)).TrimStart('; '); break }
|                        $pg = & $parse $r
|                        foreach ($sa in @(Get-SIKedaConvertProp $pg @('value'))) { if ($sa -and ([string](Get-SIKedaConvertProp $sa @('name'))).ToLowerInvariant() -eq $acct) { $found = [string](Get-SIKedaConvertProp $sa @('id')) } }
|                        $next = [string](Get-SIKedaConvertProp $pg @('nextLink'))
|                    }
|                    $stgIds[$acct] = $found
|                }
|                $stgId = $stgIds[$acct]
|                if (-not $stgId) { & $fail ('the storage account {0} could not be read{1}' -f $row.StorageAccount, $(if ("$lastAnswer".Trim()) { ' -- Azure answered ' + $lastAnswer } else { '' })); continue }
|                # the scaler reads the queue length as the jobs' identity: its storage queue role (Bootstrap's grant plan)
|                $grants = @(Get-SIContainerIdentityGrantPlan -Mode $row.AuthMode -StorageAccountId $stgId -KedaQueueScaler |
|                            Where-Object { $_.Kind -eq 'AzureRole' -and $_.Scope -eq $stgId -and $_.Role -like 'Storage Queue*' })
|                $principal = [string]$row.Identity.PrincipalId
|                if (-not $principal) { & $fail 'the managed identity''s object id could not be read'; continue }
|                $grantFailed = ''
|                foreach ($g in $grants) {
|                    $rid = $script:SIKedaConvertQueueRoleIds[$g.Role]
|                    if (-not $rid) { $grantFailed = ('the role {0} is not known here' -f $g.Role); break }
|                    $flt = [uri]::EscapeDataString(("principalId eq '{0}'" -f $principal))
|                    $r = & $call 'GET' ('https://management.azure.com{0}/providers/Microsoft.Authorization/roleAssignments?$filter={1}&api-version={2}' -f $stgId, $flt, $script:SIKedaConvertRoleApi) $null $arm $null
|                    if (-not (& $isOk $r)) { $grantFailed = ('the role assignments on the storage account could not be read ({0})' -f (& $why $r)); break }
|                    $have = @(Get-SIKedaConvertProp (& $parse $r) @('value') | Where-Object { $_ -and ([string](Get-SIKedaConvertProp $_ @('properties', 'roleDefinitionId'))).ToLowerInvariant().EndsWith('/' + $rid) })
|                    if ($have.Count) { continue }
|                    $body = [ordered]@{ properties = [ordered]@{ roleDefinitionId = ('/subscriptions/{0}/providers/Microsoft.Authorization/roleDefinitions/{1}' -f $SubscriptionId, $rid); principalId = $principal; principalType = 'ServicePrincipal' } }
|                    $r = & $call 'PUT' ('https://management.azure.com{0}/providers/Microsoft.Authorization/roleAssignments/{1}?api-version={2}' -f $stgId, [guid]::NewGuid().ToString(), $script:SIKedaConvertRoleApi) (& $toJson $body) $arm $null
|                    if (-not (& $isOk $r)) { $grantFailed = ('the jobs'' identity lacks {0} on the storage account and it could not be granted here ({1}) -- grant it once to object id {2} on {3}' -f $g.Role, (& $why $r), $principal, $stgId); break }
|                }
|                if ($grantFailed) { & $fail $grantFailed; continue }
|                # (2) the old job's secrets, with their values (Key Vault references as references): ARM listSecrets
|                $secretArgs = @(); $regPassword = ''
|                $reg = @(Get-SIKedaConvertProp $old @('properties', 'configuration', 'registries') | Where-Object { $_ })[0]
|                $regPwRef = [string](Get-SIKedaConvertProp $reg @('passwordSecretRef'))
|                if (@(Get-SIKedaConvertProp $old @('properties', 'configuration', 'secrets') | Where-Object { $_ }).Count) {
|                    $r = & $call 'POST' (& $jobUri $row.Job '/listSecrets') $null $arm $null
|                    if (-not (& $isOk $r)) { & $fail ('the old job''s secrets could not be read ({0})' -f (& $why $r)); continue }
|                    foreach ($s in @(Get-SIKedaConvertProp (& $parse $r) @('value'))) {
|                        $sn = [string](Get-SIKedaConvertProp $s @('name')); if (-not $sn) { continue }
|                        $kvu = [string](Get-SIKedaConvertProp $s @('keyVaultUrl'))
|                        $val = [string](Get-SIKedaConvertProp $s @('value'))
|                        if ($sn -eq $regPwRef) { $regPassword = $val; continue }
|                        if ($kvu) { $secretArgs += ('{0}=keyvaultref:{1},identityref:{2}' -f $sn, $kvu, [string](Get-SIKedaConvertProp $s @('identity'))) }
|                        else { $secretArgs += ('{0}={1}' -f $sn, $val) }
|                    }
|                }
|                if ($regPwRef -and -not $regPassword -and -not [string](Get-SIKedaConvertProp $reg @('identity'))) { & $fail 'the registry password of the old job could not be read'; continue }
|                $spec = Get-SIKedaConvertJobSpec -Job $old -Plan $row -ResourceGroup $ResourceGroup -SecretArgs $secretArgs -RegistryPassword $regPassword -MaxExecutions $max
|                # (3) the shard queue (data plane) -- the producer creates it on its first run as well, so a refusal here changes nothing
|                $r = & $call 'PUT' ('https://{0}.queue.core.windows.net/{1}' -f $acct, $spec.QueueName) $null $stor @{ 'x-ms-version' = $script:SIKedaConvertQueueVersion }
|                if (-not ((& $isOk $r) -or [int]$r.Status -eq 409)) { $lines.Add(('queue scaling: {0}: the queue {1} could not be created from here ({2}) -- the producer creates it on its first run' -f $e, $spec.QueueName, (& $why $r))) }
|                # (4) the worker -- idle until the producer queues work, so creating it starts nothing
|                $r = & $call 'PUT' (& $jobUri $spec.Worker) (& $toJson $spec.WorkerBody) $arm $null
|                if (-not (& $isOk $r)) { & $fail ('the worker could not be created ({0})' -f (& $why $r)); continue }
|                $created.Add($spec.Worker)
|                # (5) the producer -- without a timer until the old job has lost its own
|                $r = & $call 'PUT' (& $jobUri $spec.Producer) (& $toJson $spec.ProducerBody) $arm $null
|                if (-not (& $isOk $r)) { & $fail ('the producer could not be created ({0})' -f (& $why $r)); continue }
|                $created.Add($spec.Producer)
|                # (6) both read back
|                $wb = & $readBack $spec.Worker; $pb = & $readBack $spec.Producer
|                $bad = Test-SIKedaConvertReadBack -Worker $wb -Producer $pb -Image $spec.Image -QueueName $spec.QueueName
|                if ($bad) { & $fail $bad; continue }
|                # (7) the swap: the old job loses its timer FIRST, then the producer gets it -- never two schedules
|                if ($row.Trigger -eq 'Schedule') {
|                    $r = & $call 'PATCH' (& $jobUri $row.Job) (& $toJson (ConvertTo-SIArmJobTrigger -Job $old -Action 'to-manual')) $arm $null
|                    if (-not (& $isOk $r)) { & $fail ('the old job''s schedule could not be switched off ({0})' -f (& $why $r)); continue }
|                    $r = & $call 'PATCH' (& $jobUri $spec.Producer) (& $toJson (ConvertTo-SIArmJobTrigger -Job $pb -Action 'to-schedule' -Cron $row.Cron)) $arm $null
|                    if (-not (& $isOk $r)) {
|                        $pwhy = & $why $r
|                        $back = & $call 'PATCH' (& $jobUri $row.Job) (& $toJson (ConvertTo-SIArmJobTrigger -Job $old -Action 'to-schedule' -Cron $row.Cron)) $arm $null
|                        if (& $isOk $back) { & $fail ('the producer could not be given the schedule ({0})' -f $pwhy) }
|                        else {
|                            foreach ($n in @($created)) { $null = & $call 'DELETE' (& $jobUri $n) $null $arm $null }
|                            & $add $e 'failed' ('queue scaling: {0} was NOT moved, and its scheduled job {1} could not be given its schedule back -- {0} does NOT run on a timer now. Switch it back on: Enable on the web app''s Jobs page (its schedule ''{2}'' is remembered on the job)' -f $e, $row.Job, $row.Cron)
|                        }
|                        continue
|                    }
|                }
|                & $add $e 'converted' ('queue scaling: {0} now runs as a producer ({1}, {2}) and up to {3} workers that start as work arrives ({4}); the old scheduled job {5} is switched off and kept' -f $e, $spec.Producer, $when, $max, $spec.Worker, $row.Job)
|            } catch { & $fail $_.Exception.Message }
|        }
|        if (-not @($results | Where-Object { $_.Line }).Count) { $lines.Add('queue scaling: no identity, endpoint or Azure job in this install -- nothing to move') }
|    } catch {
|        $lines.Add(('queue scaling: not checked ({0}) -- the update goes on; the next update tries again' -f $_.Exception.Message))
|    }
|    [pscustomobject]@{ Results = $results.ToArray(); Lines = $lines.ToArray() }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-ContainerUpdate.ps1'] = @{ Sha256 = 'eddaf7c4fe7beca01a052bb5c1f7ce51e74e1fae9706760b09727e4b45385809'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- container update DECISIONS (pure; no Azure calls). The orchestrator
|    setup/Invoke-SIContainerUpdate.ps1 executes; this file decides, so every decision is testable offline.
|
|    WHY (#107, operator ruling 2026-09-29: "use the same flow as PIM is doing, that is proven and works").
|    A container-hosted SecurityInsight bakes its tree into the image (`COPY . /app/`) and no entrypoint
|    pulls code, so a synced update reached the sync host's disk and NO job ever ran it. PIM4EntraPS solves
|    the same problem through its solution.deploy.json deploy hook: after a sync that changed the solution,
|    the sync engine runs the solution's own update script, which builds the image from the pulled tree,
|    rolls the hosting to it, verifies, and rolls back on failure. SI now does the same, adapted to
|    Container Apps JOBS: jobs have no revisions, so the rollback target is each job's previous image,
|    captured before anything changes.
|#>
|
|function Resolve-SIContainerUpdateTarget {
|    <#
|        Where the container hosting lives, or $null when this is not a container install.
|        Explicit parameters win, then the customer's own config globals -- the SAME names setup uses
|        (SI_Bootstrap_*). There are NO shipped defaults on purpose: a default would be the operator's own
|        resource names, and a customer who set nothing would then target the operator's infrastructure.
|        Nothing configured = a VM install = nothing to update.
|    #>
|    param(
|        [string]$ResourceGroupName,
|        [string]$AcrName,
|        [string]$SubscriptionId,
|        [hashtable]$Globals = @{}
|    )
|    $pick = { param($explicit, $name) if (-not [string]::IsNullOrWhiteSpace($explicit)) { return $explicit.Trim() }
|              $g = $Globals[$name]; if ($g -and -not [string]::IsNullOrWhiteSpace([string]$g)) { return ([string]$g).Trim() }; return $null }
|    $rg  = & $pick $ResourceGroupName 'SI_Bootstrap_ResourceGroupName'
|    $acr = & $pick $AcrName 'SI_Bootstrap_AcrName'
|    $sub = & $pick $SubscriptionId 'SI_Bootstrap_SubscriptionId'
|    if (-not $sub) {
|        # The workspace id carries the subscription the solution was installed into.
|        $ws = [string]$Globals['SI_WorkspaceResourceId']
|        if ($ws -match '/subscriptions/([^/]+)/') { $sub = $Matches[1] }
|    }
|    if (-not $rg -and -not $acr) { return $null }
|    if (-not $rg -or -not $acr) {
|        throw ("Container hosting is only half configured (resource group: '{0}', registry: '{1}'). Set both SI_Bootstrap_ResourceGroupName and SI_Bootstrap_AcrName in config\SecurityInsight.custom.ps1, or neither on a VM install." -f $rg, $acr)
|    }
|    if (-not $sub) { throw 'Container hosting is configured but no subscription could be resolved. Set SI_Bootstrap_SubscriptionId in config\SecurityInsight.custom.ps1.' }
|    return [pscustomobject]@{ ResourceGroupName = $rg; AcrName = $acr; SubscriptionId = $sub }
|}
|
|function Resolve-SIBootstrapSubscription {
|    <#
|        PURE. The ONE subscription container setup works in, and where it came from. The install's own config decides:
|        the saved hosting (SI_Bootstrap_SubscriptionId), then SI_AzSubscriptionId, then the workspace id; the signed-in
|        Az context only when the config names none. Measured 2026-10-02: setup read the Az PowerShell context while az
|        ran against its OWN default -- two different subscriptions in one run.
|    #>
|    param([hashtable]$Globals = @{}, [string]$ContextSubscriptionId, [string]$Explicit)
|    # An explicit -SubscriptionId (the guided install passes its own answer) wins over every global: a value left in the
|    # session, or a config file that is not the install's own, never moves it (live 2026-10-06: ring 1's subscription).
|    if (-not [string]::IsNullOrWhiteSpace($Explicit)) { return [pscustomobject]@{ SubscriptionId = $Explicit.Trim(); Source = 'the -SubscriptionId parameter' } }
|    foreach ($n in 'SI_Bootstrap_SubscriptionId', 'SI_AzSubscriptionId') {
|        $v = [string]$Globals[$n]
|        if (-not [string]::IsNullOrWhiteSpace($v)) { return [pscustomobject]@{ SubscriptionId = $v.Trim(); Source = $n } }
|    }
|    $ws = [string]$Globals['SI_WorkspaceResourceId']
|    if ($ws -match '/subscriptions/([^/]+)/') { return [pscustomobject]@{ SubscriptionId = $Matches[1]; Source = 'SI_WorkspaceResourceId' } }
|    if (-not [string]::IsNullOrWhiteSpace($ContextSubscriptionId)) { return [pscustomobject]@{ SubscriptionId = $ContextSubscriptionId.Trim(); Source = 'the signed-in Azure context' } }
|    [pscustomobject]@{ SubscriptionId = $null; Source = $null }
|}
|
|function Add-SIAzSubscriptionArg {
|    <#
|        PURE. The az arguments with an explicit --subscription on every subscription-scoped command -- never az's own
|        default. Directory, REST, sign-in and CLI-housekeeping commands take none; a call that names one keeps it.
|    #>
|    param([string[]]$AzArgs, [string]$SubscriptionId)
|    $a = @($AzArgs)
|    if ([string]::IsNullOrWhiteSpace($SubscriptionId) -or -not $a.Count) { return $a }
|    if ($a[0] -in 'ad', 'rest', 'login', 'logout', 'account', 'version', 'extension', 'config', 'bicep', 'upgrade', 'cloud') { return $a }
|    if ($a -contains '--subscription') { return $a }
|    $a + @('--subscription', $SubscriptionId)
|}
|
|function Get-SIRegistryPullArgs {
|    <#
|        PURE. How a job pulls its image. Managed identity: AS the identity (`--registry-identity`; AcrPull is in its grant
|        plan) -- no password. Otherwise the registry's admin credentials, as before; when admin access is disabled (the
|        secure setting) a clear refusal instead of the null-index crash measured 2026-10-02.
|    #>
|    param([string]$Mode, [string]$IdentityResourceId, $AdminCredential, [string]$AcrName)
|    if ($Mode -eq 'ManagedIdentity') {
|        if ([string]::IsNullOrWhiteSpace($IdentityResourceId)) { throw 'managed-identity mode without an identity -- the jobs could not pull their image.' }
|        return @('--registry-identity', $IdentityResourceId)
|    }
|    $user = if ($AdminCredential) { [string]$AdminCredential.username }
|    $pass = if ($AdminCredential -and $AdminCredential.passwords) { [string]@($AdminCredential.passwords)[0].value }
|    if ([string]::IsNullOrWhiteSpace($user) -or [string]::IsNullOrWhiteSpace($pass)) {
|        throw ("Registry '{0}' gives no admin credentials (admin access is disabled -- the secure setting). Run with -UseManagedIdentity so the jobs pull as their identity, or enable admin access on the registry." -f $AcrName)
|    }
|    @('--registry-username', $user, '--registry-password', $pass)
|}
|
|function Get-SIContainerContentHash {
|    <#
|        A stable hash of what goes into the image, so an unchanged tree never rebuilds. Relative path +
|        SHA-256 of every file, sorted ordinally; folders that never reach an image (run output, local
|        state, tests, docs, the web app) are left out. Same content -> same hash on any host.
|    #>
|    param([Parameter(Mandatory)][string]$SolutionRoot)
|    $skip = @('logs', 'output', 'staging', 'internal', 'tests', 'docs', 'analyzer-web', '.git', 'demo')
|    # BUILD OUTPUT at any depth is never content: no tracked file lives in a bin\ / obj\ / node_modules\ folder, so a
|    # clean tree (a release archive, a sync) hashes exactly as before. Measured 2026-10-07 on the test VM: the gate's
|    # `dotnet build` of pro-management\ (alongside Pester) left thousands of build files here, and every one of the ten
|    # end-to-end runs of SIv3-ContainerUpdate hashed them all on PowerShell 5.1 -- the batch passed its 1,200 s timeout.
|    $buildDirs = @('bin', 'obj', 'node_modules')
|    $root = (Resolve-Path -LiteralPath $SolutionRoot).Path.TrimEnd('\', '/')
|    $lines = New-Object System.Collections.Generic.List[string]
|    # a walk that never ENTERS a skipped folder (Get-ChildItem -Recurse listed tests\, docs\ and every build folder first,
|    # then dropped them); hidden files count as before (-Force)
|    $files = New-Object System.Collections.Generic.List[string]
|    $dirs = New-Object System.Collections.Generic.Stack[string]
|    $dirs.Push($root)
|    while ($dirs.Count) {
|        $d = $dirs.Pop()
|        try { foreach ($x in [IO.Directory]::GetFiles($d)) { $files.Add($x) } } catch { }
|        $subs = @(); try { $subs = [IO.Directory]::GetDirectories($d) } catch { }
|        foreach ($s in $subs) {
|            $n = [IO.Path]::GetFileName($s).ToLowerInvariant()
|            if ($d -eq $root -and $skip -contains $n) { continue }
|            if ($buildDirs -contains $n) { continue }
|            # a junction / symbolic link is not followed (a shipped tree has none)
|            try { if (([IO.File]::GetAttributes($s) -band [IO.FileAttributes]::ReparsePoint)) { continue } } catch { continue }
|            $dirs.Push($s)
|        }
|    }
|    # one SHA-256 for every file (Get-FileHash per file costs a cmdlet call each on 5.1); the same upper-case hex
|    $fileSha = [System.Security.Cryptography.SHA256]::Create()
|    try {
|    foreach ($full in $files) {
|        $rel = $full.Substring($root.Length).TrimStart('\', '/') -replace '\\', '/'
|        if ($skip -contains ($rel -split '/')[0].ToLowerInvariant()) { continue }
|        if ($rel -like '*.custom.*' -and $rel -notlike '*.custom.sample.*') { continue }   # customer files never ship in an image
|        # ...nor do the customer files .dockerignore keeps out by name (they reach the jobs from storage): a changed CMDB.csv
|        # or custom query file must not rebuild an image that does not contain it.
|        if ($rel -match '(?i)^asset-profiling-providers/[^/]+/CMDB\.csv$|(^|/)RiskAnalysis_Queries_Custom\.yaml$|\.exclude\.json$') { continue }
|        # #178: the VM sync never carries launcher.community-* (its manifest excludes them) while a release archive
|        # does, so the VM hook and the managed updater computed DIFFERENT tags for the same release -- and each
|        # rebuilt and re-rolled every night. No container runs a community launcher; they do not decide the image.
|        if ((Split-Path -Leaf $rel) -like 'launcher.community-*') { continue }
|        $fs = [IO.File]::Open($full, [IO.FileMode]::Open, [IO.FileAccess]::Read, [IO.FileShare]::ReadWrite)
|        try { $h = ([BitConverter]::ToString($fileSha.ComputeHash($fs)) -replace '-', '') } finally { $fs.Dispose() }
|        $lines.Add(('{0}|{1}' -f $rel, $h))
|    }
|    } finally { $fileSha.Dispose() }
|    $arr = $lines.ToArray(); [Array]::Sort($arr, [StringComparer]::Ordinal)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $bytes = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes(($arr -join "`n"))) } finally { $sha.Dispose() }
|    return ([BitConverter]::ToString($bytes) -replace '-', '').ToLowerInvariant()
|}
|
|function Get-SIContainerImageTag {
|    <# v<VERSION>-<first 12 of the content hash>: readable, and unique per content. #>
|    param([Parameter(Mandatory)][string]$Version, [Parameter(Mandatory)][string]$ContentHash)
|    $v = ($Version.Trim() -replace '[^0-9A-Za-z._-]', '-')
|    return ('v{0}-{1}' -f $v, $ContentHash.Substring(0, 12))
|}
|
|function Get-SIContainerUpdatePlan {
|    <#
|        Which jobs to point at the new image. A job is SecurityInsight's when its image is this registry's
|        si-orchestrator repository -- discovered, not recomputed from naming rules, so KEDA producer/worker
|        pairs and renamed jobs are all found. Returns one entry per SI job with the action:
|          'update'  -> image differs from the target
|          'current' -> already on the target (idempotent re-run)
|    #>
|    param(
|        [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Jobs,      # @{ Name; Image }
|        [Parameter(Mandatory)][string]$LoginServer,
|        [Parameter(Mandatory)][string]$TargetImage
|    )
|    $repo = ('{0}/si-orchestrator' -f $LoginServer).ToLowerInvariant()
|    foreach ($j in $Jobs) {
|        $img = ([string]$j.Image).ToLowerInvariant()
|        if (-not ($img.StartsWith($repo + ':') -or $img.StartsWith($repo + '@'))) { continue }
|        [pscustomobject]@{
|            Name          = [string]$j.Name
|            PreviousImage = [string]$j.Image
|            Action        = $(if ($img -eq $TargetImage.ToLowerInvariant()) { 'current' } else { 'update' })
|        }
|    }
|}
|
|function Get-SIContainerRollbackPlan {
|    <#
|        After a failed update: every job that was changed goes back to the image it had before -- but ONLY while it still
|        runs the image THIS update set (-NewImage, with -Current = name -> image read back now). A job someone else moved in
|        the meantime is left where it is (Action 'skip'). Found live 2026-10-05 (#350): an updater run collided with a
|        manual deploy ("an active provisioning operation in progress"), and its rollback put seven jobs back on the image
|        from BEFORE both -- over the manual deploy's newer one. Without -Current every changed job is restored, as before.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Updated,   # plan entries that were updated
|          [string]$NewImage, [hashtable]$Current)
|    foreach ($u in $Updated) {
|        $now = if ($Current -and $Current.ContainsKey($u.Name)) { [string]$Current[$u.Name] } else { $null }
|        if ($NewImage -and $null -ne $now -and $now -ne $NewImage) {
|            [pscustomobject]@{ Name = $u.Name; Image = $u.PreviousImage; Action = 'skip'; Now = $now }
|        } else { [pscustomobject]@{ Name = $u.Name; Image = $u.PreviousImage; Action = 'restore'; Now = $now } }
|    }
|}
|
|# ---- where the containers live, SAVED so every later update can find them (#166) ----------------------
|# Resolve-SIContainerUpdateTarget reads SI_Bootstrap_* from config\SecurityInsight.custom.ps1. Until
|# 2026-09-30 nothing ever WROTE them: the container setup set them in memory for its own run and the
|# config had been written before that step anyway -- so the update hook found "no container hosting",
|# exited 0, and the jobs stayed on the old image with no error. The container setup now saves them here,
|# as one marked block that a re-run REPLACES (never duplicates), and everything outside it is untouched.
|$script:SIContainerBlockBegin = '# >>> SecurityInsight container hosting -- written by setup; a re-run replaces this block >>>'
|$script:SIContainerBlockEnd   = '# <<< SecurityInsight container hosting <<<'
|
|function ConvertTo-SIConfigLiteral {
|    # Same rule as the config wizard's writer: inside a single-quoted literal the only special characters
|    # are the quote characters (ASCII + four Unicode quotes); doubling each makes it literal.
|    param([AllowNull()][object]$Value)
|    $s = if ($null -eq $Value) { '' } else { [string]$Value }
|    foreach ($q in @([char]0x27, [char]0x2018, [char]0x2019, [char]0x201A, [char]0x201B)) {
|        $s = $s.Replace([string]$q, [string]$q + [string]$q)
|    }
|    "'" + $s + "'"
|}
|
|function Get-SIContainerHostingBlock {
|    <# PURE. The text of the block for these values (only the ones given). #>
|    param(
|        [Parameter(Mandatory)][string]$SubscriptionId,
|        [Parameter(Mandatory)][string]$ResourceGroupName,
|        [Parameter(Mandatory)][string]$AcrName,
|        [string]$EnvName,
|        [string]$Location,
|        [string]$UpdaterJob,
|        [string]$ManagedIdentityName
|    )
|    $lines = @($script:SIContainerBlockBegin)
|    $pairs = [ordered]@{
|        SI_Bootstrap_SubscriptionId    = $SubscriptionId
|        SI_Bootstrap_ResourceGroupName = $ResourceGroupName
|        SI_Bootstrap_AcrName           = $AcrName
|        SI_Bootstrap_EnvName           = $EnvName
|        SI_Bootstrap_Location          = $Location
|        SI_Bootstrap_UpdaterJob        = $UpdaterJob
|        SI_Bootstrap_ManagedIdentityName = $ManagedIdentityName
|    }
|    foreach ($k in $pairs.Keys) {
|        if ([string]::IsNullOrWhiteSpace([string]$pairs[$k])) { continue }
|        $lines += ('$global:{0} = {1}' -f $k.PadRight(30), (ConvertTo-SIConfigLiteral ([string]$pairs[$k]).Trim()))
|    }
|    $lines += $script:SIContainerBlockEnd
|    $lines -join "`r`n"
|}
|
|function Get-SIContainerHostingValue {
|    <# PURE. One value from the saved block (a single-quoted literal, quotes doubled), or '' when absent. #>
|    param([AllowEmptyString()][AllowNull()][string]$Text, [Parameter(Mandatory)][string]$Name)
|    if (-not $Text) { return '' }
|    $m = [regex]::Match($Text, '(?m)^[ \t]*\$global:' + [regex]::Escape($Name) + '[ \t]*=[ \t]*''((?:[^'']|'''')*)''')
|    if (-not $m.Success) { return '' }
|    $m.Groups[1].Value.Replace("''", "'")
|}
|
|function Get-SIUpdaterManagedJob {
|    <#
|        PURE. The updater job that owns this install's rollout, or $null. Set by Upgrade-SIToPro.ps1: from then on
|        the job rolls the containers to what the customer's ring approves, and a hand roll from a git pull would
|        put them on a version the ring has not approved (PIM: Upgrade-PimToPro, "do NOT keep running
|        Update-PimCommunity.ps1").
|    #>
|    param([hashtable]$Globals = @{})
|    $j = [string]$Globals['SI_Bootstrap_UpdaterJob']
|    if ([string]::IsNullOrWhiteSpace($j)) { return $null }
|    $j.Trim()
|}
|
|function Get-SIContainerUpdateGuidance {
|    <# PURE. What container setup tells the customer about updates: the Community command, or the updater job that owns it. #>
|    param([string]$UpdaterJob)
|    if (-not [string]::IsNullOrWhiteSpace($UpdaterJob)) {
|        return @(("Updates: the updater job '{0}' (SecurityInsight Pro) rolls these containers to the version your update ring approves -- nothing to run." -f $UpdaterJob.Trim()))
|    }
|    @(
|        'Updates: run .\Update-SecurityInsight.ps1 -Apply when you want the latest release -- it pulls it and rebuilds + rolls these containers (verify, roll back on failure).',
|        'With SecurityInsight Pro: .\setup\Upgrade-SIToPro.ps1 (from the Pro package) installs the updater job, which keeps the containers on your update ring by itself -- updates come from Invardia.'
|    )
|}
|
|function Get-SIProUpgradePlan {
|    <#
|        PURE. What Upgrade-SIToPro.ps1 passes to Install-SIUpdaterJob.ps1: the hosting this install SAVED (#166) and its
|        identity -- the job's managed identity (-UseManagedIdentity), or the SPN and the Key Vault secret name of its
|        certificate. Updates come from Invardia (SI's own update feed is retired, 2026-10-06), so no feed link is asked for.
|        Explicit values win. Returns @{ Args; Missing } -- nothing is guessed: a missing value is named so the customer can
|        pass it.
|    #>
|    param(
|        [hashtable]$Globals = @{},
|        [string]$CertSecretName,
|        [string]$KeyVaultName,
|        [string]$EnvName,
|        [switch]$UseManagedIdentity
|    )
|    $pick = { param($explicit, [string[]]$names)
|        if (-not [string]::IsNullOrWhiteSpace($explicit)) { return $explicit.Trim() }
|        foreach ($n in $names) { $g = [string]$Globals[$n]; if (-not [string]::IsNullOrWhiteSpace($g)) { return $g.Trim() } }
|        '' }
|    $sub = & $pick '' @('SI_Bootstrap_SubscriptionId')
|    if (-not $sub -and ([string]$Globals['SI_WorkspaceResourceId']) -match '/subscriptions/([^/]+)/') { $sub = $Matches[1] }
|    $a = [ordered]@{
|        SubscriptionId      = $sub
|        ResourceGroupName   = & $pick '' @('SI_Bootstrap_ResourceGroupName')
|        AcrName             = & $pick '' @('SI_Bootstrap_AcrName')
|        EnvName             = & $pick $EnvName @('SI_Bootstrap_EnvName')
|        KeyVaultName        = & $pick $KeyVaultName @('SI_KeyVaultName', 'SpnKeyVaultName')
|    }
|    if (-not $UseManagedIdentity) {
|        $a['CertSecretName'] = & $pick $CertSecretName @()
|        $a['SpnClientId']    = & $pick '' @('SI_SPN_AppId')
|    }
|    $a['TenantId'] = & $pick '' @('SI_SPN_TenantId')
|    $missing = @($a.Keys | Where-Object { -not $a[$_] })
|    [pscustomobject]@{ Args = $a; Missing = $missing }
|}
|
|function Merge-SIContainerHostingBlock {
|    <#
|      PURE. Returns the config text with the block replaced, or appended when absent. Everything outside
|      the markers is returned byte-for-byte. Two or more blocks (a hand-copied one) are collapsed into one.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Text, [Parameter(Mandatory)][string]$Block)
|    $t = if ($null -eq $Text) { '' } else { $Text }
|    $pattern = '(?ms)^[ \t]*' + [regex]::Escape($script:SIContainerBlockBegin) + '.*?' + [regex]::Escape($script:SIContainerBlockEnd) + '[ \t]*(\r?\n)?'
|    $found = [regex]::Matches($t, $pattern)
|    if ($found.Count -eq 0) {
|        $sep = if ($t.Length -eq 0 -or $t.EndsWith("`n")) { '' } else { "`r`n" }
|        return $t + $sep + $Block + "`r`n"
|    }
|    # A hashtable, not a bool: an assignment inside the evaluator would only set a local copy per call,
|    # and every match would get the block.
|    $state = @{ First = $true; Block = $Block }
|    return [regex]::Replace($t, $pattern, {
|        param($m)
|        if ($state.First) { $state.First = $false; return $state.Block + "`r`n" }
|        return ''
|    }.GetNewClosure())
|}
|
|function Save-SIContainerHostingConfig {
|    <#
|      Writes the block into the customer's config file. Idempotent: identical content is not rewritten.
|      A changed file is backed up to *.bak.<timestamp> first, and written UTF-8 WITH a BOM -- Windows
|      PowerShell 5.1 reads a BOM-less file in the ANSI code page. Returns @{ Path; Changed; Backup }.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$ConfigPath,
|        [Parameter(Mandatory)][string]$SubscriptionId,
|        [Parameter(Mandatory)][string]$ResourceGroupName,
|        [Parameter(Mandatory)][string]$AcrName,
|        [string]$EnvName,
|        [string]$Location,
|        # Set by Upgrade-SIToPro.ps1 only. When not passed, the value already in the block is KEPT: a re-run of container
|        # setup must never quietly hand a Pro install, updated by its updater job, back to the Community update.
|        [string]$UpdaterJob,
|        # Set by the container setup, which picks the engine jobs' identity name. When not passed, the value already
|        # in the block is KEPT, so a later Bootstrap-ContainerAppJob.ps1 run finds the same identity.
|        [string]$ManagedIdentityName
|    )
|    $old = ''
|    if (Test-Path -LiteralPath $ConfigPath) { $old = [IO.File]::ReadAllText($ConfigPath) }   # honours a BOM
|    if (-not $PSBoundParameters.ContainsKey('UpdaterJob')) { $UpdaterJob = Get-SIContainerHostingValue -Text $old -Name 'SI_Bootstrap_UpdaterJob' }
|    if (-not $PSBoundParameters.ContainsKey('ManagedIdentityName')) {
|        # Only from inside the block: a value elsewhere in the file stays where the customer put it.
|        $blk = [regex]::Match($old, '(?ms)' + [regex]::Escape($script:SIContainerBlockBegin) + '.*?' + [regex]::Escape($script:SIContainerBlockEnd))
|        $ManagedIdentityName = if ($blk.Success) { Get-SIContainerHostingValue -Text $blk.Value -Name 'SI_Bootstrap_ManagedIdentityName' } else { '' }
|    }
|    $block = Get-SIContainerHostingBlock -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName -AcrName $AcrName -EnvName $EnvName -Location $Location -UpdaterJob $UpdaterJob -ManagedIdentityName $ManagedIdentityName
|    $new = Merge-SIContainerHostingBlock -Text $old -Block $block
|    if ($new -ceq $old) { return [pscustomobject]@{ Path = $ConfigPath; Changed = $false; Backup = $null } }
|    $backup = $null
|    if (Test-Path -LiteralPath $ConfigPath) {
|        $backup = '{0}.bak.{1:yyyyMMdd-HHmmss}' -f $ConfigPath, (Get-Date)
|        Copy-Item -LiteralPath $ConfigPath -Destination $backup -Force
|    } else {
|        $dir = Split-Path -Parent $ConfigPath
|        if ($dir -and -not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Force -Path $dir | Out-Null }
|    }
|    [IO.File]::WriteAllText($ConfigPath, $new, [Text.UTF8Encoding]::new($true))
|    [pscustomobject]@{ Path = $ConfigPath; Changed = $true; Backup = $backup }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-JobFlow.ps1'] = @{ Sha256 = 'b6e7bb35032de85a02059411a514a819a46119136c28ac7fc37daf6156f00b3b'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- the daily job FLOW (#269).
|
|    Operator 2026-10-04: "define it as a flow and NOT timer based, so it starts job run and then job 2 start when 1
|    completes" / "i prefer the job flow queue, where i define an order and start time for the flow and then not control
|    it per schedule" / "make both options, but flow is default/preferred".
|
|    ONE flow per install: one start time + cadence, and an ORDERED list of steps (jobs). A step starts when the step
|    before it has ENDED; a step marked "start together with the step above" (WithPrevious) joins that step's group, and
|    the group waits for all of its members. Per step: Enabled, OnFailure (stop | continue | skip-dependents -- the
|    default skips only the steps that NEED the failed one, transitively, from config\job-flow.locked.json) and a timeout.
|
|    This file is the ENGINE-SIDE half and is host-neutral:
|      * the definition (JSON, the same shape the web app writes to cfg.JobFlow and a VM keeps in
|        config\job-flow.custom.json) -- read, validated, defaulted;
|      * the RUNNER (Invoke-SIJobFlow) -- pure over its seams: -Start / -Poll / -Stop (ARM in a container job, local
|        processes on a VM, a fake in tests), -Save (the run record), -Now / -Sleep (the clock);
|      * the adapters: ARM (container), local process (VM), and three run-record stores (file, blob, Pro SQL).
|
|    🔒 A STEP NEVER RUNS TWICE. The run record is saved BEFORE a step is started (state Starting) and again with the
|    execution name once it has. A runner that crashes and is started again RESUMES the record: a Running step is polled
|    (not started), a Starting step -- unknown whether it started -- is reported Interrupted and never started again, a
|    finished day is reported, not repeated. A record whose heartbeat is fresh belongs to a runner that is still alive:
|    the second runner refuses. PS 5.1 and 7.
|#>
|
|$script:SIJobFlow = @{
|    SIRoot      = (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))
|    OnFailure   = @('skip-dependents', 'stop', 'continue')
|    # 'interval' = every IntervalMinutes AFTER the previous run FINISHED (SCHED-1.1); the others are a time of day
|    Cadences    = @('daily', 'weekdays', 'weekly', 'interval')
|    # the flow job's cron only WAKES the runner (SCHED-1.1: a clock trigger never stands in for the cadence)
|    TickCron    = '*/5 * * * *'
|    Final       = @('Success', 'Failed', 'TimedOut', 'Interrupted', 'Skipped', 'Disabled')
|    Failures    = @('Failed', 'TimedOut', 'Interrupted')
|    # a RUN that has ended (#700: Cancelled = ended on purpose by a person or by the updater; never resumed)
|    RunFinished = @('Succeeded', 'Failed', 'Stopped', 'Cancelled')
|    ArmApi      = '2025-07-01'
|    # Working rule 4 -- only the PLATFORM gets re-run (live 2026-10-05: a step's container died before the engine ran).
|    # A step whose container never started the engine is started again this many times, after this pause; a run longer
|    # than NeverStartedMaxSeconds is never called "never started".
|    StartRetries           = 1
|    StartRetryBackoff      = 60
|    NeverStartedMaxSeconds = 120
|    # A RUNNING step that shows no sign of progress is REPORTED, never stopped (owner 2026-10-12: "Warn only"): no new log
|    # line and no run-health record for SilentAfterMinutes -> ONE warning for that step in that run. Asked for at most
|    # every ProgressCheckMinutes, and only once the step has run that long.
|    SilentAfterMinutes     = 120
|    ProgressCheckMinutes   = 30
|    # the shipped default LAYOUT (CONVERGE-DEFAULTS, framework 12.16): 1 = every step one after the other; 2 = the steps of a
|    # stage that read nothing of each other's same-day output start together (the map's defaultPipeline 'withPrevious');
|    # 3 (#754) = Risk Analysis Summary and Detailed start together too (the stage's 'withPreviousSince' names the level each
|    # one came with). A stored pipeline below this level that still has the default layout of ITS level is brought to it as
|    # it is read (Update-SIJobFlowDefaultLayout) and by the update (setup/_shared/SI-PipelineLayout.ps1); one a person
|    # changed is only marked, never re-laid.
|    # 4 (#636) = Risk Analysis Summary is off by default (the map's 'defaultEnabled': false): a stored pipeline still the
|    # default of its level with every step on gets the step switched off; one a person changed keeps it (said once).
|    DefaultsLevel          = 4
|    SummaryOffSince        = 4
|}
|# #306: pipelines and stages (schema 2, the stage gate, the install's run lock and queue) -- one dot-source for every caller
|. (Join-Path $PSScriptRoot 'SI-Pipeline.ps1')
|# #532: THROTTLE-IS-NORMAL -- a step whose engine was only throttled is 'throttled', not a failure (framework §12.18)
|if (-not (Get-Command -Name Get-SIThrottleText -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Throttle.ps1') }
|# the failed step's class + first error lines for the pipeline's report (Get-SIJobFlowStepFailure)
|if (-not (Get-Command -Name Get-SIErrorLines -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-ErrorClass.ps1') }
|
|# =====================================================================================================================
|#  The map (config\job-flow.locked.json) and the definition
|# =====================================================================================================================
|function Get-SIJobFlowMap {
|    <# The dependency map + default flow. PURE over -Path (default: config\job-flow.locked.json of this solution). #>
|    param([string]$Path)
|    if (-not $Path) { $Path = Join-Path (Join-Path $script:SIJobFlow.SIRoot 'config') 'job-flow.locked.json' }
|    $raw = [IO.File]::ReadAllText($Path) | ConvertFrom-Json
|    $jobs = [ordered]@{}
|    foreach ($j in @($raw.jobs)) {
|        $t = 0; if ($j.PSObject.Properties['timeoutMinutes']) { $t = [int]$j.timeoutMinutes }
|        $never = $false; if ($j.PSObject.Properties['neverInFlow']) { $never = [bool]$j.neverInFlow }
|        $cron = ''; if ($j.PSObject.Properties['defaultCron']) { $cron = [string]$j.defaultCron }
|        $stage = ''; if ($j.PSObject.Properties['stage']) { $stage = [string]$j.stage }
|        $manual = $false; if ($j.PSObject.Properties['manualInFlowMode']) { $manual = [bool]$j.manualInFlowMode }
|        $own = $false; if ($j.PSObject.Properties['ownSchedule']) { $own = [bool]$j.ownSchedule }
|        $retired = $false; if ($j.PSObject.Properties['retired']) { $retired = [bool]$j.retired }
|        # 'reads': jobs whose output of the SAME day this job reads when it is there, and does without (the previous run's)
|        # when it is not -- not a need (a failure skips nothing), but a step started together with one reads the run before
|        $reads = @(); if ($j.PSObject.Properties['reads']) { $reads = @(@($j.reads) | Where-Object { $_ } | ForEach-Object { [string]$_ }) }
|        # 'runsOnStored': the step holds back by itself whatever is not complete, so when a step it needs did not succeed in
|        # this run it still runs, on what is stored (Get-SIPipelineStoredDataRun). Not set = it needs THIS run's output.
|        $stored = $false; if ($j.PSObject.Properties['runsOnStored']) { $stored = [bool]$j.runsOnStored }
|        $jobs[[string]$j.key] = [pscustomobject]@{ Key = [string]$j.key; Engine = [string]$j.engine; Needs = @(@($j.needs) | Where-Object { $_ } | ForEach-Object { [string]$_ })
|                                                   TimeoutMinutes = $t; NeverInFlow = ($never -or $own -or $retired); DefaultCron = $cron; Stage = $stage; ManualInFlowMode = $manual; OwnSchedule = $own
|                                                   Retired = $retired; Reads = $reads; RunsOnStored = $stored
|                                                   # 'brings': what the job would have brought, in plain words; 'assetBuild': the build of the merged assets
|                                                   Brings = $(if ($j.PSObject.Properties['brings']) { [string]$j.brings } else { '' })
|                                                   AssetBuild = $(if ($j.PSObject.Properties['assetBuild']) { [bool]$j.assetBuild } else { $false })
|                                                   # 'niceToHave': the step's failure holds only the steps that need it (Risk Analysis Summary);
|                                                   # 'runsWithoutNiceToHave': the step runs in full when only nice-to-have steps failed
|                                                   NiceToHave = $(if ($j.PSObject.Properties['niceToHave']) { [bool]$j.niceToHave } else { $false })
|                                                   RunsWithoutNiceToHave = $(if ($j.PSObject.Properties['runsWithoutNiceToHave']) { [bool]$j.runsWithoutNiceToHave } else { $false })
|                                                   # #754 'startsWhenReady': in a run of the whole pipeline the step starts as soon as the steps it reads
|                                                   # have ended (Get-SIJobFlowAwaited), not after every step above it
|                                                   StartsWhenReady = $(if ($j.PSObject.Properties['startsWhenReady']) { [bool]$j.startsWhenReady } else { $false })
|                                                   # #754 'heldBy': steps it does not read but waits for by the owner's rule (a failed Detailed holds every connector)
|                                                   HeldBy = @($(if ($j.PSObject.Properties['heldBy']) { @($j.heldBy) | Where-Object { $_ } | ForEach-Object { [string]$_ } }))
|                                                   # #748 'required': the update adds the step to a stored pipeline without it (where its job is installed)
|                                                   Required = $(if ($j.PSObject.Properties['required']) { [bool]$j.required } else { $false })
|                                                   # #636 'defaultEnabled': false = a new pipeline has the step switched off (Risk Analysis Summary)
|                                                   DefaultEnabled = $(if ($j.PSObject.Properties['defaultEnabled']) { [bool]$j.defaultEnabled } else { $true })
|                                                   # #1038 (1) 'manualOnly': only ever STARTED (the data-out job: by the data sync on its mark and by
|                                                   # a person to resend) -- Manual in both modes, never a timer, never a step
|                                                   ManualOnly = $(if ($j.PSObject.Properties['manualOnly']) { [bool]$j.manualOnly } else { $false }) }
|    }
|    # #306: the default PIPELINE (stages in order, each with its steps); a map without one gets it from defaultFlow by stage.
|    # A stage's 'withPrevious' names the steps that start together with the step above them (DefaultsLevel 2), and its
|    # 'withPreviousSince' the layout level each of them came with (#754; none named = level 2, the first such level).
|    $pipe = $null
|    if ($raw.PSObject.Properties['defaultPipeline'] -and $raw.defaultPipeline) {
|        $pipe = [pscustomobject]@{ Id = [string]$raw.defaultPipeline.id; Name = [string]$raw.defaultPipeline.name
|                                   Stages = @(@($raw.defaultPipeline.stages) | Where-Object { $_ } | ForEach-Object {
|                                       $since = @{}
|                                       if ($_.PSObject.Properties['withPreviousSince'] -and $_.withPreviousSince) { foreach ($sp in @($_.withPreviousSince.PSObject.Properties)) { $since[[string]$sp.Name] = [int]$sp.Value } }
|                                       [pscustomobject]@{ Id = [string]$_.id; Name = [string]$_.name; Steps = @(@($_.steps) | ForEach-Object { [string]$_ })
|                                                          WithPrevious = @($(if ($_.PSObject.Properties['withPrevious']) { @($_.withPrevious) | Where-Object { $_ } | ForEach-Object { [string]$_ } }))
|                                                          WithPreviousSince = $since } }) }
|    } else {
|        $pipe = [pscustomobject]@{ Id = 'daily'; Name = 'Daily pipeline'; Stages = @(foreach ($sid in @('collect', 'correlate', 'deliver')) {
|            [pscustomobject]@{ Id = $sid; Name = (Get-Culture).TextInfo.ToTitleCase($sid); Steps = @(@($raw.defaultFlow) | ForEach-Object { [string]$_ } | Where-Object { $jobs.Contains($_) -and $jobs[$_].Stage -eq $sid }); WithPrevious = @(); WithPreviousSince = @{} } }) }
|    }
|    [pscustomobject]@{
|        Jobs = $jobs; DefaultFlow = @(@($raw.defaultFlow) | ForEach-Object { [string]$_ })
|        DefaultPipeline = $pipe
|        DefaultStartTime = [string]$raw.defaultStartTime; DefaultCadence = [string]$raw.defaultCadence
|        DefaultTimeZone = $(if ($raw.PSObject.Properties['defaultTimeZone'] -and $raw.defaultTimeZone) { [string]$raw.defaultTimeZone } else { 'UTC' })
|        DefaultTimeoutMinutes = [int]$raw.defaultTimeoutMinutes
|    }
|}
|
|function Get-SIJobFlowKey {
|    <# PURE. 'caj-si-endpoint' -> 'endpoint' (the key the map and the definition use). #>
|    param([AllowEmptyString()][AllowNull()][string]$Name)
|    $k = ([string]$Name).Trim().ToLowerInvariant()
|    if ($k.StartsWith('caj-si-')) { $k = $k.Substring(7) }
|    $k
|}
|
|function Get-SIJobFlowStepKey {
|    <#
|        PURE (#1096). The pipeline STEP a job belongs to: 'caj-si-endpoint' -> 'endpoint', and a collection in parts' two jobs
|        -- 'caj-si-endpoint-producer' / 'caj-si-endpoint-worker' -> 'endpoint' (the runner starts the producer for that step,
|        Add-SIJobFlowCollectParts; the worker works the producer's parts). Every other name is its plain key.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Name)
|    $k = Get-SIJobFlowKey $Name
|    if ($k -match '^(.+)-(producer|worker)$') { return $Matches[1] }
|    $k
|}
|
|function Get-SIJobFlowJobName { param([Parameter(Mandatory)][string]$Key) 'caj-si-' + $Key }
|
|function Get-SIJobFlowWorkerJobs {
|    <#
|        PURE. #882: the jobs whose executions work FOR a step's job -- what must stop when the pipeline ends, interrupts or
|        cancels that step (live 2026-10-22, internal: the Detailed Risk Analysis step was closed Interrupted and its queue
|        worker went on for 50 minutes and wrote state the next run used):
|          * a collection in parts: caj-si-<key>-worker (the producer caj-si-<key>-producer is the step's own execution);
|          * Risk Analysis on queue workers: caj-si-raworker-<grain> (RA-ScaleOut.ps1), whose runs live under
|            collect/ra-<grain>/ in the state store -- RunsFolder, where the pipeline marks the step's run closed.
|        -Installed: the install's job names; only a worker job that exists is returned (none known = every candidate).
|        Returns @(@{ Job (the worker job's name); RunsFolder ('' = none to close) }).
|    #>
|    param([AllowEmptyString()][string]$Job, [string[]]$Installed = $null)
|    $k = Get-SIJobFlowKey $Job
|    if (-not $k) { return @() }
|    $out = New-Object System.Collections.Generic.List[object]
|    $cand = New-Object System.Collections.Generic.List[object]
|    $cand.Add([pscustomobject]@{ Job = ('caj-si-{0}-worker' -f $k); RunsFolder = '' })
|    if ($k -eq 'risk-analysis-detailed') { $cand.Add([pscustomobject]@{ Job = 'caj-si-raworker-detailed'; RunsFolder = 'ra-detailed' }) }
|    elseif ($k -eq 'risk-analysis') { $cand.Add([pscustomobject]@{ Job = 'caj-si-raworker-summary'; RunsFolder = 'ra-summary' }) }
|    foreach ($c in $cand) {
|        if ($null -ne $Installed -and @($Installed).Count -and -not (@($Installed) -contains [string]$c.Job)) {
|            # the queue workers' runs are closed even where their job is not listed: a worker inside the producer's own
|            # container (no worker job) reads the same mark
|            if ([string]$c.RunsFolder) { $out.Add([pscustomobject]@{ Job = ''; RunsFolder = [string]$c.RunsFolder }) }
|            continue
|        }
|        $out.Add($c)
|    }
|    $out.ToArray()
|}
|
|function Test-SIJobFlowOwnSchedule {
|    <#
|        PURE. $true for a job that runs on its OWN daily timer in every mode and is never a step of any pipeline: the
|        updater (framework UPDATE-1.6 (a): one updater per environment, daily at 03:00 UTC on its own schedule, plus started
|        on a release -- never inside the product's daily pipeline). The map marks it 'ownSchedule'; the updater is one
|        whatever the map says, so an older map cannot put it back into a pipeline. Why: the updater waits while any SI job
|        runs, and a running pipeline is an SI job -- as a step it waited for itself and never updated (found live, ring 1).
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Job, $Map)
|    $k = Get-SIJobFlowKey $Job
|    if ($k -eq 'updater') { return $true }
|    [bool]($Map -and $Map.Jobs.Contains($k) -and $Map.Jobs[$k].PSObject.Properties['OwnSchedule'] -and $Map.Jobs[$k].OwnSchedule)
|}
|
|function Test-SIJobFlowRetired {
|    <#
|        PURE. $true for a job that does nothing any more and is never a step: asset-properties (#412, operator 2026-10-06:
|        "we dont pull in the same data twice" -- the endpoint, identity and azure profilers publish the full asset metadata
|        themselves). The map marks it 'retired'; asset-properties is one whatever the map says, so an older map cannot put
|        it back into a pipeline.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Job, $Map)
|    $k = Get-SIJobFlowKey $Job
|    if ($k -eq 'asset-properties') { return $true }
|    [bool]($Map -and $Map.Jobs.Contains($k) -and $Map.Jobs[$k].PSObject.Properties['Retired'] -and $Map.Jobs[$k].Retired)
|}
|
|function Remove-SIJobFlowOwnScheduleStep {
|    <#
|        PURE. A stored pipeline (schema 1 or 2) without the steps that are never steps (Test-SIJobFlowOwnSchedule: the
|        updater; Test-SIJobFlowRetired: a retired job -- asset-properties, #412). Each dropped step is said in
|        .MigrationNotes and the definition is marked .Migrated, so the runner logs it and the web app shows it; saving the
|        pipeline stores it without the step. A step that started together with the dropped one starts on its own when it
|        is now the first of its stage. The input is not changed.
|    #>
|    param([Parameter(Mandatory)]$Definition, $Map)
|    $isDropped = { param($j) (Test-SIJobFlowOwnSchedule -Job $j -Map $Map) -or (Test-SIJobFlowRetired -Job $j -Map $Map) }
|    $drop = @(@($Definition.Steps) | Where-Object { $_ -and (& $isDropped ([string]$_.Job)) })
|    if (-not $drop.Count) { return $Definition }
|    $keep = New-Object System.Collections.Generic.List[object]
|    $prevStage = $null
|    foreach ($s in @($Definition.Steps)) {
|        if ($null -eq $s -or (& $isDropped ([string]$s.Job))) { continue }
|        $c = $s.PSObject.Copy()
|        $st = Get-SIPipelineStepStage $c
|        if ([bool]$c.WithPrevious -and ($keep.Count -eq 0 -or $prevStage -ne $st)) { $c.WithPrevious = $false }
|        $keep.Add($c); $prevStage = $st
|    }
|    $d = $Definition.PSObject.Copy()
|    $d.Steps = $keep.ToArray()
|    $notes = New-Object System.Collections.Generic.List[string]
|    if ($Definition.PSObject.Properties['MigrationNotes']) { foreach ($n in @($Definition.MigrationNotes)) { if ($n) { $notes.Add([string]$n) } } }
|    foreach ($x in $drop) {
|        if (Test-SIJobFlowRetired -Job ([string]$x.Job) -Map $Map) { $notes.Add(('{0} was a step of the stored pipeline and is taken out: it is retired -- the endpoint, identity and azure profilers read each source once and publish the full asset metadata themselves' -f $x.Job)) }
|        else { $notes.Add(('{0} was a step of the stored pipeline and is taken out: the updater runs on its own daily schedule (18:30 in the local time of the install''s Azure region), never inside the pipeline -- it waits while the pipeline runs, so as a step it waited for itself' -f $x.Job)) }
|    }
|    $d | Add-Member -NotePropertyName Migrated -NotePropertyValue $true -Force
|    $d | Add-Member -NotePropertyName MigrationNotes -NotePropertyValue $notes.ToArray() -Force
|    $d
|}
|
|function Move-SIJobFlowStepAfterNeeds {
|    <#
|        PURE. A step runs after every step it NEEDS (the map's 'needs') when that step is in a later STAGE. v3 data model (V3-DATA-MODEL part 2, P4): Risk
|        Analysis now needs the CI build, so a pipeline stored when Risk Analysis ran in Collect -- before the job it now
|        reads -- gets that step moved to right after the last step it needs, into that step's stage, and says so in
|        .MigrationNotes (.Migrated); saving the pipeline stores the new order. A need that is not a step of the pipeline is
|        ignored (as everywhere in the flow), so nothing moves where that job is not installed. The input is not changed.
|    #>
|    param([Parameter(Mandatory)]$Definition, $Map)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $steps = New-Object System.Collections.Generic.List[object]
|    foreach ($s in @($Definition.Steps)) { if ($s) { $steps.Add($s.PSObject.Copy()) } }
|    $moved = New-Object System.Collections.Generic.List[string]
|    $why = @{}
|    $changed = $true; $guard = 0
|    while ($changed -and $guard -lt 50) {
|        $changed = $false; $guard++
|        for ($i = 0; $i -lt $steps.Count; $i++) {
|            $k = [string]$steps[$i].Job
|            if (-not $Map.Jobs.Contains($k)) { continue }
|            $last = -1
|            # only a need in a LATER STAGE moves the step (a stored stage layout that predates the dependency); a misorder
|            # inside one stage stays as it is and is warned about by Test-SIJobFlowDefinition, as before
|            $myStage = Get-SIPipelineStepStage $steps[$i]
|            $later = New-Object System.Collections.Generic.List[string]
|            foreach ($n in @($Map.Jobs[$k].Needs)) { for ($j = $i + 1; $j -lt $steps.Count; $j++) { if ([string]$steps[$j].Job -eq $n -and (Get-SIPipelineStepStage $steps[$j]) -ne $myStage) { if ($j -gt $last) { $last = $j }; if (-not $later.Contains($n)) { $later.Add($n) } } } }
|            if ($last -lt 0) { continue }
|            $m = $steps[$i]; $steps.RemoveAt($i)
|            $at = $last                                   # the needed step slid one place up: insert right after it ...
|            while ($at -lt $steps.Count -and $moved.Contains([string]$steps[$at].Job)) { $at++ }   # ... and after the steps moved there before (their order is kept)
|            $m.Stage = Get-SIPipelineStepStage $steps[$last - 1]
|            $m.WithPrevious = $false
|            $steps.Insert($at, $m)
|            if (-not $moved.Contains($k)) { $moved.Add($k) }
|            $why[$k] = $later.ToArray()
|            $changed = $true
|            break
|        }
|    }
|    if ($moved.Count -eq 0) { return $Definition }
|    # a step that started together with a moved one starts on its own when it is now the first of its stage
|    $prevStage = $null
|    for ($i = 0; $i -lt $steps.Count; $i++) {
|        $st = Get-SIPipelineStepStage $steps[$i]
|        if ([bool]$steps[$i].WithPrevious -and ($i -eq 0 -or $prevStage -ne $st)) { $steps[$i].WithPrevious = $false }
|        $prevStage = $st
|    }
|    $d = $Definition.PSObject.Copy()
|    $d.Steps = $steps.ToArray()
|    $notes = New-Object System.Collections.Generic.List[string]
|    if ($Definition.PSObject.Properties['MigrationNotes']) { foreach ($n in @($Definition.MigrationNotes)) { if ($n) { $notes.Add([string]$n) } } }
|    foreach ($k in $moved) { $notes.Add(('{0} now runs after {1}: it reads its output' -f $k, (@($why[$k]) -join ', '))) }
|    $d | Add-Member -NotePropertyName Migrated -NotePropertyValue $true -Force
|    $d | Add-Member -NotePropertyName MigrationNotes -NotePropertyValue $notes.ToArray() -Force
|    $d
|}
|function New-SIJobFlowStep {
|    param([Parameter(Mandatory)][string]$Job, [bool]$Enabled = $true, [bool]$WithPrevious = $false, [string]$OnFailure = 'skip-dependents', [int]$TimeoutMinutes = 240, [string]$Stage = '')
|    [pscustomobject]@{ Job = $Job; Enabled = $Enabled; WithPrevious = $WithPrevious; OnFailure = $OnFailure; TimeoutMinutes = $TimeoutMinutes; Stage = $Stage }
|}
|
|function New-SIDefaultJobFlow {
|    <#
|        PURE. The default PIPELINE (#306, schema 2) for the jobs that are installed (-Installed: keys or caj-si-* names):
|        the map's defaultPipeline -- Collect -> Correlate -> Deliver -- each stage one step after the other, except a step the
|        stage names in 'withPrevious' (it reads nothing of the step above it from the same day): it starts together with
|        the step above it when that step is installed. Each step with the map's timeout and its stage's on-failure default
|        (Deliver: continue -- the targets are independent). Mode 'flow', the map's start time, daily, DefaultsLevel = the
|        current layout. The three stages are always there (a stage with no installed job is empty).
|    #>
|    param([AllowEmptyCollection()][string[]]$Installed = @(), $Map,
|          # the start time (HH:mm) and its time zone: the settings SI_Pipeline_StartTime / SI_Pipeline_TimeZone, else the
|          # map's defaults: 19:00 Danish time (Europe/Copenhagen) when no region is known, after the 18:30 update (owner 2026-10-21).
|          # The zone is read for a start time that is SET; with no start time the default time keeps its default zone.
|          [string]$StartTime = [string]$global:SI_Pipeline_StartTime, [string]$TimeZone = [string]$global:SI_Pipeline_TimeZone)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    if ($StartTime -notmatch '^([01]\d|2[0-3]):[0-5]\d$') { $StartTime = $Map.DefaultStartTime; $TimeZone = $Map.DefaultTimeZone }
|    if (-not $TimeZone.Trim()) { $TimeZone = $Map.DefaultTimeZone }
|    $have = @($Installed | ForEach-Object { Get-SIJobFlowKey $_ })
|    $steps = New-Object System.Collections.Generic.List[object]
|    $stages = New-Object System.Collections.Generic.List[object]
|    foreach ($st in @($Map.DefaultPipeline.Stages)) {
|        $stages.Add((New-SIPipelineStage -Id $st.Id -Name $st.Name))
|        foreach ($k in @($st.Steps)) {
|            if ($have -notcontains $k) { continue }
|            $t = $Map.DefaultTimeoutMinutes
|            if ($Map.Jobs.Contains($k) -and $Map.Jobs[$k].TimeoutMinutes -gt 0) { $t = $Map.Jobs[$k].TimeoutMinutes }
|            $with = Test-SIJobFlowTogetherWithShippedAbove -Stage $st.Id -Job $k -Present $have -Map $Map
|            # #636: a step the map ships switched off (Risk Analysis Summary: 'defaultEnabled': false) is there, off
|            $on = -not ($Map.Jobs.Contains($k) -and $Map.Jobs[$k].PSObject.Properties['DefaultEnabled'] -and -not [bool]$Map.Jobs[$k].DefaultEnabled)
|            $steps.Add((New-SIJobFlowStep -Job $k -Enabled $on -TimeoutMinutes $t -OnFailure (Get-SIPipelineStageOnFailure $st.Id) -Stage $st.Id -WithPrevious $with))
|        }
|    }
|    New-SIPipelineDefinition -Id $Map.DefaultPipeline.Id -Name $Map.DefaultPipeline.Name -Mode 'flow' -StartTime $StartTime -Cadence $Map.DefaultCadence `
|        -Weekday 1 -IntervalMinutes 1440 -Stages $stages.ToArray() -Steps $steps.ToArray() -TimeZone $TimeZone -DefaultsLevel $script:SIJobFlow.DefaultsLevel
|}
|
|function Test-SIJobFlowTogetherWithShippedAbove {
|    <# PURE. Does -Job start together with the step SHIPPED right above it in -Stage? Only when the stage names it in
|       'withPrevious' AND that step is in -Present: with it missing the job starts on its own (it would otherwise join a
|       step whose same-day output it reads -- endpoint after identity when azure is not installed).
|       -Level (#754): the default layout of THAT level -- a step that came with a later level ('withPreviousSince') is not
|       together there (default: the current level). #>
|    param([Parameter(Mandatory)][string]$Stage, [Parameter(Mandatory)][string]$Job, [AllowEmptyCollection()][string[]]$Present = @(), $Map,
|          [int]$Level = $script:SIJobFlow.DefaultsLevel)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $st = @(@($Map.DefaultPipeline.Stages) | Where-Object { [string]$_.Id -eq $Stage })[0]
|    if (-not $st -or -not $st.PSObject.Properties['WithPrevious'] -or @($st.WithPrevious) -notcontains $Job) { return $false }
|    $since = 2
|    if ($st.PSObject.Properties['WithPreviousSince'] -and $st.WithPreviousSince -and $st.WithPreviousSince.ContainsKey($Job)) { $since = [int]$st.WithPreviousSince[$Job] }
|    if ($since -gt $Level) { return $false }
|    $i = [array]::IndexOf(@($st.Steps), $Job)
|    ($i -gt 0) -and (@($Present) -contains [string]@($st.Steps)[$i - 1])
|}
|
|function Update-SIJobFlowDefaultLayout {
|    <#
|        PURE. CONVERGE-DEFAULTS (framework 12.16) for the pipeline's LAYOUT. A stored pipeline below the current DefaultsLevel
|        that still has the default layout OF ITS OWN LEVEL -- each step starts together with the step above it exactly where
|        that level's default says (level 1: nowhere, every step one after the other; level 2: endpoint with azure), and each
|        stage's steps exactly the shipped default's steps in the shipped order (a job not installed is simply absent) --
|        gets the current layout: each step a stage names in the map's 'withPrevious' starts together with the step above it
|        (level 3, #754: Risk Analysis Detailed with Risk Analysis Summary). Nothing else of a step changes (on/off, on
|        failure, timeout stay as they are). A pipeline a person changed (a group of their own, another order, a step moved
|        to another stage, a custom step) is NOT re-laid. Either way the result carries the current DefaultsLevel, so once
|        it is saved the decision is never made again -- a person who then runs those steps one after the other keeps that.
|        Changed: .Migrated + one line in .MigrationNotes per step (the runner logs it, the web app shows it; saving stores
|        it -- and the update stores it, setup/_shared/SI-PipelineLayout.ps1). Idempotent; the input is not changed.
|        Level 4 (#636): on such a default pipeline with every step on, a step the map ships switched off ('defaultEnabled':
|        false -- Risk Analysis Summary) is switched off, with its line; a pipeline a person changed keeps the step as it is,
|        and one line says so.
|    #>
|    param([Parameter(Mandatory)]$Definition, $Map)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $level = if ($Definition.PSObject.Properties['DefaultsLevel'] -and [int]$Definition.DefaultsLevel -ge 1) { [int]$Definition.DefaultsLevel } else { 1 }
|    $now = [int]$script:SIJobFlow.DefaultsLevel
|    if ($level -ge $now) { return $Definition }
|    $d = $Definition.PSObject.Copy()
|    $d | Add-Member -NotePropertyName DefaultsLevel -NotePropertyValue $now -Force
|    $steps = @(@($Definition.Steps) | Where-Object { $_ })
|    # the default of the stored level: each stage is the shipped stage's steps in the shipped order, and a step starts
|    # together with the one above it exactly where that level's default put it
|    $want = New-Object System.Collections.Generic.List[string]
|    $present = @($steps | ForEach-Object { [string]$_.Job })
|    foreach ($st in @($Map.DefaultPipeline.Stages)) { foreach ($k in @($st.Steps)) { if ($present -contains $k) { $want.Add(('{0}|{1}' -f $st.Id, $k)) } } }
|    $got = @($steps | ForEach-Object { '{0}|{1}' -f (Get-SIPipelineStepStage $_), [string]$_.Job })
|    $isOld = ($got.Count -eq $want.Count) -and (($got -join ';') -eq (($want.ToArray()) -join ';'))
|    if ($isOld) {
|        for ($i = 0; $i -lt $steps.Count; $i++) {
|            $sid = Get-SIPipelineStepStage $steps[$i]
|            $was = ($i -gt 0) -and (Get-SIPipelineStepStage $steps[$i - 1]) -eq $sid -and (Test-SIJobFlowTogetherWithShippedAbove -Stage $sid -Job ([string]$steps[$i].Job) -Present @([string]$steps[$i - 1].Job) -Map $Map -Level $level)
|            if ([bool]$steps[$i].WithPrevious -ne [bool]$was) { $isOld = $false; break }
|        }
|    }
|    $notes = New-Object System.Collections.Generic.List[string]
|    if ($Definition.PSObject.Properties['MigrationNotes']) { foreach ($n in @($Definition.MigrationNotes)) { if ($n) { $notes.Add([string]$n) } } }
|    # level 4 (#636): the steps the map ships switched off (Risk Analysis Summary) -- switched off on a pipeline that is still
|    # the default of its level with every step on; a pipeline a person changed keeps the step as it is (one line says so)
|    $summaryOff = ($level -lt [int]$script:SIJobFlow.SummaryOffSince)
|    $offJobs = @($Map.Jobs.Keys | Where-Object { $Map.Jobs[$_].PSObject.Properties['DefaultEnabled'] -and -not [bool]$Map.Jobs[$_].DefaultEnabled })
|    $keptNote = { param($k) '{0} stays switched on: the pipeline was changed by a person -- the Summary report is optional now (every Summary view is a grouping of the Detailed findings); switch the step off on the Jobs page when nobody reads its mail' -f $k }
|    if (-not $isOld) {
|        if ($summaryOff) {
|            $kept = @($steps | Where-Object { $offJobs -contains [string]$_.Job -and [bool]$_.Enabled })
|            if ($kept.Count) {
|                foreach ($s in $kept) { $notes.Add((& $keptNote ([string]$s.Job))) }
|                $d | Add-Member -NotePropertyName MigrationNotes -NotePropertyValue $notes.ToArray() -Force
|            }
|        }
|        return $d
|    }
|    $out = New-Object System.Collections.Generic.List[object]
|    $prev = $null; $changed = $false
|    foreach ($s in $steps) {
|        $c = $s.PSObject.Copy()
|        $sid = Get-SIPipelineStepStage $c
|        if (-not [bool]$c.WithPrevious -and $prev -and (Get-SIPipelineStepStage $prev) -eq $sid -and (Test-SIJobFlowTogetherWithShippedAbove -Stage $sid -Job ([string]$c.Job) -Present @([string]$prev.Job) -Map $Map)) {
|            $c.WithPrevious = $true; $changed = $true
|            $notes.Add(('{0} now starts together with {1} (the new default: neither reads the other''s output of the same day) -- to run them one after the other again, untick "start together" and save' -f $c.Job, $prev.Job))
|        }
|        $out.Add($c); $prev = $c
|    }
|    if ($summaryOff) {
|        $allOn = -not @($steps | Where-Object { -not [bool]$_.Enabled }).Count
|        foreach ($c in $out) {
|            if ($offJobs -notcontains [string]$c.Job -or -not [bool]$c.Enabled) { continue }
|            if ($allOn) {
|                $c.Enabled = $false; $changed = $true
|                $notes.Add(('{0} is now switched off (the new default: the Summary report is optional -- every Summary view is a grouping of the Detailed findings) -- to run it again, switch the step on and save' -f $c.Job))
|            } else { $notes.Add((& $keptNote ([string]$c.Job))) }
|        }
|        if (-not $changed -and $notes.Count) { $d | Add-Member -NotePropertyName MigrationNotes -NotePropertyValue $notes.ToArray() -Force }
|    }
|    $d.Steps = $out.ToArray()
|    if ($changed) {
|        $d | Add-Member -NotePropertyName Migrated -NotePropertyValue $true -Force
|        $d | Add-Member -NotePropertyName MigrationNotes -NotePropertyValue $notes.ToArray() -Force
|    }
|    $d
|}
|
|function ConvertFrom-SIJobFlowJson {
|    <#
|        PURE. A definition from its JSON (camelCase, as the web app and config\job-flow.custom.json write it). Missing
|        fields take their defaults; nothing is validated here (Test-SIJobFlowDefinition does).
|        #306: schema 2 (stages[], each with its steps) is read as it is; a schema-1 flow (one steps[] list) is MIGRATED
|        in memory (ConvertFrom-SIPipelineSchema1: lossless, .Migrated + .MigrationNotes) -- every reader reads both.
|        Either schema: a step that is never a step (the updater -- it runs on its own daily schedule) is dropped, in the notes.
|    #>
|    param([Parameter(Mandatory)][string]$Json, $Map)
|    $o = $Json | ConvertFrom-Json
|    $p = { param($obj, $n, $d) if ($obj.PSObject.Properties[$n] -and $null -ne $obj.$n -and "$($obj.$n)" -ne '') { $obj.$n } else { $d } }
|    $readStep = { param($s, $stage, $defOf) New-SIJobFlowStep -Job (Get-SIJobFlowKey ([string](& $p $s 'job' ''))) -Enabled ([bool](& $p $s 'enabled' $true)) -WithPrevious ([bool](& $p $s 'withPrevious' $false)) `
|                    -OnFailure ([string](& $p $s 'onFailure' $defOf)).ToLowerInvariant() -TimeoutMinutes ([int](& $p $s 'timeoutMinutes' 240)) -Stage $stage }
|    $schema = [int](& $p $o 'schema' 1)
|    $mode = ([string](& $p $o 'mode' 'flow')).ToLowerInvariant()
|    $start = [string](& $p $o 'startTime' '01:00'); $cad = ([string](& $p $o 'cadence' 'daily')).ToLowerInvariant()
|    $wd = [int](& $p $o 'weekday' 1); $iv = [int](& $p $o 'intervalMinutes' 1440)
|    # a schedule stored before time zones has none: its time was UTC, and stays UTC
|    $tzId = [string](& $p $o 'timeZone' 'UTC')
|    if ($schema -ge 2 -and $o.PSObject.Properties['stages'] -and $null -ne $o.stages) {
|        $stages = New-Object System.Collections.Generic.List[object]
|        $steps = New-Object System.Collections.Generic.List[object]
|        foreach ($st in @($o.stages)) {
|            if ($null -eq $st) { continue }
|            $sid = ([string](& $p $st 'id' 'custom')).ToLowerInvariant()
|            $stages.Add((New-SIPipelineStage -Id $sid -Name ([string](& $p $st 'name' (Get-SIPipelineStageName $sid))) -RunIfPreviousFailed ([bool](& $p $st 'runIfPreviousFailed' $false))))
|            foreach ($s in @($st.steps)) { if ($null -ne $s) { $steps.Add((& $readStep $s $sid (Get-SIPipelineStageOnFailure $sid))) } }
|        }
|        $d2 = New-SIPipelineDefinition -Id ([string](& $p $o 'id' 'daily')) -Name ([string](& $p $o 'name' 'Daily pipeline')) -Mode $mode -StartTime $start -Cadence $cad -Weekday $wd -IntervalMinutes $iv `
|                    -Stages $stages.ToArray() -Steps $steps.ToArray() -TimeZone $tzId -DefaultsLevel ([int](& $p $o 'defaults' 1))
|        # the updater is never a step (UPDATE-1.6): a pipeline stored before that loses the step, and says so; a pipeline
|        # still on the old default layout gets the current one (CONVERGE-DEFAULTS)
|        return (Update-SIJobFlowDefaultLayout -Definition (Move-SIJobFlowStepAfterNeeds -Definition (Remove-SIJobFlowOwnScheduleStep -Definition $d2 -Map $Map) -Map $Map) -Map $Map)
|    }
|    $steps1 = foreach ($s in @($o.steps)) {
|        if ($null -eq $s) { continue }
|        & $readStep $s '' 'skip-dependents'
|    }
|    $v1 = [pscustomobject]@{ Schema = 1; Mode = $mode; StartTime = $start; TimeZone = $tzId; Cadence = $cad; Weekday = $wd; IntervalMinutes = $iv; Steps = @($steps1) }
|    Update-SIJobFlowDefaultLayout -Definition (Move-SIJobFlowStepAfterNeeds -Definition (Remove-SIJobFlowOwnScheduleStep -Definition (ConvertFrom-SIPipelineSchema1 -Definition $v1 -Map $Map) -Map $Map) -Map $Map) -Map $Map
|}
|
|function ConvertTo-SIJobFlowJson {
|    <#
|        PURE. The definition as JSON (camelCase, schema 2) -- the shape ConvertFrom-SIJobFlowJson and the web app read:
|        stages[] (id, name, runIfPreviousFailed, steps[]) AND the same steps flattened in steps[] (each with its stage),
|        so a reader of schema 1 (an older runner or web app during the update) still sees the whole flow in its order.
|    #>
|    param([Parameter(Mandatory)]$Definition)
|    $iv = $(if ($Definition.PSObject.Properties['IntervalMinutes'] -and $Definition.IntervalMinutes) { [int]$Definition.IntervalMinutes } else { 1440 })
|    $id = if ($Definition.PSObject.Properties['Id'] -and $Definition.Id) { [string]$Definition.Id } else { 'daily' }
|    $name = if ($Definition.PSObject.Properties['Name'] -and $Definition.Name) { [string]$Definition.Name } else { 'Daily pipeline' }
|    $stepJson = { param($s) ConvertTo-Json -Compress -InputObject ([ordered]@{ job = [string]$s.Job; stage = (Get-SIPipelineStepStage $s); enabled = [bool]$s.Enabled; withPrevious = [bool]$s.WithPrevious; onFailure = [string]$s.OnFailure; timeoutMinutes = [int]$s.TimeoutMinutes }) }
|    $stageJson = foreach ($st in @(Get-SIPipelineStages -Definition $Definition)) {
|        $mine = @(@($Definition.Steps) | Where-Object { (Get-SIPipelineStepStage $_) -eq [string]$st.Id })
|        $head = ConvertTo-Json -Compress -InputObject ([ordered]@{ id = [string]$st.Id; name = [string]$st.Name; runIfPreviousFailed = [bool]$st.RunIfPreviousFailed })
|        $head.Substring(0, $head.Length - 1) + ',"steps":[' + ((@($mine | ForEach-Object { & $stepJson $_ })) -join ',') + ']}'
|    }
|    $lvl = if ($Definition.PSObject.Properties['DefaultsLevel'] -and [int]$Definition.DefaultsLevel -ge 1) { [int]$Definition.DefaultsLevel } else { 1 }
|    $head = ConvertTo-Json -Compress -InputObject ([ordered]@{ schema = 2; id = $id; name = $name; mode = [string]$Definition.Mode; startTime = [string]$Definition.StartTime; timeZone = (Get-SIPipelineTimeZoneId $Definition); cadence = [string]$Definition.Cadence; weekday = [int]$Definition.Weekday; intervalMinutes = $iv; defaults = $lvl })
|    # built by hand: PS 5.1 collapses a one-element array to an object, and nesting stages in steps would need it twice
|    $head.Substring(0, $head.Length - 1) + ',"stages":[' + (@($stageJson) -join ',') + '],"steps":[' + ((@(@($Definition.Steps) | ForEach-Object { & $stepJson $_ })) -join ',') + ']}'
|}
|
|function Test-SIJobFlowDefinition {
|    <#
|        PURE. @{ Problems; Warnings } -- Problems refuse the definition (the runner does not start), Warnings are said and
|        the flow runs: an unknown / duplicate / never-in-flow job, an unknown OnFailure, a timeout outside 5-4320 min, a
|        start time that is not HH:mm, an unknown cadence (problems); a step placed before a job it needs, a job not
|        installed (warnings). -Installed (keys or names) enables the "not installed" check.
|    #>
|    param([Parameter(Mandatory)]$Definition, $Map, [string[]]$Installed)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $problems = New-Object System.Collections.Generic.List[string]
|    $warnings = New-Object System.Collections.Generic.List[string]
|    if ([string]$Definition.StartTime -notmatch '^([01]\d|2[0-3]):[0-5]\d$') { $problems.Add(("the start time '{0}' is not HH:mm (UTC)" -f $Definition.StartTime)) }
|    if ($script:SIJobFlow.Cadences -notcontains [string]$Definition.Cadence) { $problems.Add(("the cadence '{0}' is not one of {1}" -f $Definition.Cadence, ($script:SIJobFlow.Cadences -join ', '))) }
|    if ([string]$Definition.Cadence -eq 'weekly' -and ([int]$Definition.Weekday -lt 0 -or [int]$Definition.Weekday -gt 6)) { $problems.Add('the weekday must be 0 (Sunday) to 6') }
|    if ([string]$Definition.Cadence -eq 'interval' -and ([int]$Definition.IntervalMinutes -lt 5 -or [int]$Definition.IntervalMinutes -gt 10080)) { $problems.Add('the interval must be 5 minutes to 7 days (the rest between the end of one run and the start of the next)') }
|    $seen = @{}
|    $pos = @{}
|    $i = 0
|    $have = if ($null -ne $Installed) { @($Installed | ForEach-Object { Get-SIJobFlowKey $_ }) } else { $null }
|    foreach ($s in @($Definition.Steps)) {
|        $i++
|        $k = [string]$s.Job
|        if (-not $k -or $k -notmatch '^[a-z0-9][a-z0-9\-]{0,24}$') { $problems.Add(("step {0}: '{1}' is not a job" -f $i, $k)); continue }
|        if ($seen.ContainsKey($k)) { $problems.Add(("step {0}: {1} is already step {2}" -f $i, $k, $seen[$k])); continue }
|        $seen[$k] = $i
|        if (Test-SIJobFlowOwnSchedule -Job $k -Map $Map) { $problems.Add(("step {0}: {1} is never part of the pipeline -- the updater runs on its own daily schedule" -f $i, $k)) }
|        elseif (Test-SIJobFlowRetired -Job $k -Map $Map) { $problems.Add(("step {0}: {1} is retired -- the profilers publish the full asset metadata themselves" -f $i, $k)) }
|        elseif ($Map.Jobs.Contains($k) -and $Map.Jobs[$k].NeverInFlow) { $problems.Add(("step {0}: {1} is never part of the flow (it is started on demand)" -f $i, $k)) }
|        if ($script:SIJobFlow.OnFailure -notcontains [string]$s.OnFailure) { $problems.Add(("step {0} ({1}): on failure '{2}' is not one of {3}" -f $i, $k, $s.OnFailure, ($script:SIJobFlow.OnFailure -join ', '))) }
|        if ([int]$s.TimeoutMinutes -lt 5 -or [int]$s.TimeoutMinutes -gt 4320) { $problems.Add(("step {0} ({1}): the timeout must be 5-4320 minutes" -f $i, $k)) }
|        if ($null -ne $have -and $have -notcontains $k) { $warnings.Add(("step {0}: {1} is not installed -- it is reported as failed when the flow reaches it" -f $i, $k)) }
|        if ($i -eq 1 -and [bool]$s.WithPrevious) { $warnings.Add(("step 1 ({0}) has no step above to start together with" -f $k)) }
|    }
|    # a step before a job it needs reads yesterday's output
|    $groups = Get-SIJobFlowGroups -Definition $Definition
|    foreach ($g in $groups) { foreach ($s in $g.Steps) { $pos[[string]$s.Job] = $g.Index } }
|    foreach ($g in $groups) {
|        foreach ($s in $g.Steps) {
|            if (-not $Map.Jobs.Contains([string]$s.Job)) { continue }
|            foreach ($n in $Map.Jobs[[string]$s.Job].Needs) {
|                if ($pos.ContainsKey($n) -and $pos[$n] -ge $g.Index) {
|                    $warnings.Add(("{0} runs {1} {2}, which it needs -- it reads {2}'s output from the run before" -f $s.Job, $(if ($pos[$n] -eq $g.Index) { 'together with' } else { 'before' }), $n))
|                }
|            }
|            # a soft same-day read (the map's 'reads'): nothing is skipped when it fails, but run before / together with it the
|            # job uses its previous run's output
|            foreach ($n in @($(if ($Map.Jobs[[string]$s.Job].PSObject.Properties['Reads']) { $Map.Jobs[[string]$s.Job].Reads }))) {
|                if ($n -and $pos.ContainsKey($n) -and $pos[$n] -ge $g.Index) {
|                    $warnings.Add(("{0} runs {1} {2}, whose output of the same day it reads -- it uses {2}'s previous run instead" -f $s.Job, $(if ($pos[$n] -eq $g.Index) { 'together with' } else { 'before' }), $n))
|                }
|            }
|        }
|    }
|    # #306: the stages (known ids, each once, Deliver after Collect, the steps in stage order)
|    $sc = Test-SIPipelineStages -Definition $Definition
|    foreach ($x in @($sc.Problems)) { $problems.Add($x) }
|    foreach ($x in @($sc.Warnings)) { $warnings.Add($x) }
|    [pscustomobject]@{ Problems = $problems.ToArray(); Warnings = $warnings.ToArray() }
|}
|
|function Get-SIJobFlowCron {
|    <# PURE. The schedule as a cron (UTC) from the start time + cadence -- for display only: the runner wakes every 5
|       minutes and decides with Get-SIJobFlowLatestSlot, so a time zone's daylight saving needs no cron change. In a time
|       zone other than UTC the hour is today's (-NowUtc). #>
|    param([Parameter(Mandatory)]$Definition, [datetime]$NowUtc = [datetime]::UtcNow)
|    $h, $m = ([string]$Definition.StartTime) -split ':'
|    $h = [int]$h; $m = [int]$m
|    if ((Get-SIPipelineTimeZoneId $Definition) -ne 'UTC') {
|        $z = (Resolve-SIPipelineTimeZone (Get-SIPipelineTimeZoneId $Definition)).Zone
|        $u = ConvertTo-SIPipelineUtc -Local ([TimeZoneInfo]::ConvertTimeFromUtc([datetime]::SpecifyKind($NowUtc.ToUniversalTime(), 'Utc'), $z).Date.AddHours($h).AddMinutes($m)) -Zone $z
|        $h = $u.Hour; $m = $u.Minute
|    }
|    switch ([string]$Definition.Cadence) {
|        'weekdays' { '{0} {1} * * 1-5' -f $m, $h }
|        'weekly'   { '{0} {1} * * {2}' -f $m, $h, [int]$Definition.Weekday }
|        default    { '{0} {1} * * *' -f $m, $h }
|    }
|}
|
|function Get-SIJobFlowCadenceText {
|    <# PURE. The cadence in words: "daily at 01:00 UTC" / "every 6 h after the previous run finished". #>
|    param([Parameter(Mandatory)]$Definition)
|    $at = Get-SIPipelineScheduleText -Definition $Definition
|    switch ([string]$Definition.Cadence) {
|        'interval' { $iv = [int]$Definition.IntervalMinutes; if ($iv % 60 -eq 0) { 'every {0} h after the previous run finished' -f ($iv / 60) } else { 'every {0} min after the previous run finished' -f $iv } }
|        'weekdays' { 'weekdays at {0}' -f $at }
|        'weekly'   { '{0}s at {1}' -f ([DayOfWeek]([int]$Definition.Weekday % 7)), $at }
|        default    { 'daily at {0}' -f $at }
|    }
|}
|
|function Get-SIJobFlowGroups {
|    <# PURE. The steps as groups in order: a step with WithPrevious joins the group above it -- never across a stage
|       (#306: the first step of a stage always starts a group). @(@{ Index; Stage; Steps }). #>
|    param([Parameter(Mandatory)]$Definition)
|    $groups = New-Object System.Collections.Generic.List[object]
|    $cur = $null
|    foreach ($s in @($Definition.Steps)) {
|        $sid = Get-SIPipelineStepStage $s
|        if ($null -eq $cur -or -not [bool]$s.WithPrevious -or $cur.Stage -ne $sid) {
|            $cur = [pscustomobject]@{ Index = $groups.Count + 1; Stage = $sid; Steps = (New-Object System.Collections.Generic.List[object]) }
|            $groups.Add($cur)
|        }
|        $cur.Steps.Add($s)
|    }
|    , $groups.ToArray()
|}
|
|function Get-SIJobFlowDependents {
|    <# PURE. The flow's steps that need -Job, directly or through another step (transitively), by the map. #>
|    param([Parameter(Mandatory)][string]$Job, [Parameter(Mandatory)]$Definition, $Map)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $inFlow = @(@($Definition.Steps) | ForEach-Object { [string]$_.Job })
|    $out = New-Object System.Collections.Generic.List[string]
|    $queue = New-Object System.Collections.Generic.Queue[string]
|    $queue.Enqueue($Job)
|    while ($queue.Count) {
|        $x = $queue.Dequeue()
|        foreach ($k in $inFlow) {
|            if ($out.Contains($k) -or $k -eq $Job) { continue }
|            if ($Map.Jobs.Contains($k) -and $Map.Jobs[$k].Needs -contains $x) { $out.Add($k); $queue.Enqueue($k) }
|        }
|    }
|    , $out.ToArray()
|}
|
|function Get-SIJobFlowAwaited {
|    <#
|        PURE. #754 -- WHAT A STEP OF A RUN WAITS FOR before it may start: @{ Early; Jobs; Reads }.
|          * Every step: the steps of the groups above it (-State: the run record, its steps in order with their Group) --
|            the group-by-group order (a group starts when every step above it has ended). Early = $false.
|          * A Deliver step the map marks 'startsWhenReady', in a run of the WHOLE pipeline (Scope 'pipeline'; a re-run
|            from a step too): only the steps above it that it READS -- its 'needs' and 'reads', followed through the jobs
|            those read in turn (a job not in this run is followed too, never waited for) -- and every step above it that is
|            not in Correlate or Deliver (Collect, a custom stage) -- plus its 'heldBy' (steps it does not read but that hold
|            it by the owner's rule: the CMDB connectors read only the CIs, and wait for Risk Analysis Detailed because a
|            failed Detailed holds every connector). Early = $true; Reads = the steps of Correlate / Deliver it waits for.
|            Risk Analysis Detailed is enough for the vulnerability connector and the CMDB connectors -- none of them waits for
|            the Summary; the data sync reads both Risk Analysis reports and the vulnerability connector.
|        -NoEarly: an install's first collection -- every step waits for the steps above it.
|        A step never waits for a step placed below it (it reads that one's previous run, as Test-SIJobFlowDefinition warns),
|        so the first waiting step of a run can always start.
|    #>
|    param([Parameter(Mandatory)]$State, [Parameter(Mandatory)]$Step, $Map,
|          # an install's first collection: every step waits for the steps above it (nothing is written to the customer's
|          # systems before one run is complete)
|          [switch]$NoEarly)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $k = Get-SIJobFlowKey ([string]$Step.Job)
|    $above = @(@($State.Steps) | Where-Object { $_ -and [int]$_.Group -lt [int]$Step.Group })
|    $scope = if ($State.PSObject.Properties['Scope'] -and $State.Scope) { [string]$State.Scope } else { 'pipeline' }
|    $early = -not $NoEarly -and $scope -eq 'pipeline' -and $Map.Jobs.Contains($k) -and $Map.Jobs[$k].PSObject.Properties['StartsWhenReady'] -and [bool]$Map.Jobs[$k].StartsWhenReady -and
|             (Get-SIPipelineStepStage $Step) -eq 'deliver'
|    if (-not $early) { return [pscustomobject]@{ Early = $false; Jobs = @($above | ForEach-Object { [string]$_.Job }); Reads = @() } }
|    # what it reads, followed through what those read
|    $reads = @{}
|    $queue = New-Object System.Collections.Generic.Queue[string]
|    $queue.Enqueue($k)
|    # ... and what holds it by rule without being read ('heldBy': the CMDB connectors wait for Risk Analysis Detailed)
|    foreach ($h in @($(if ($Map.Jobs[$k].PSObject.Properties['HeldBy']) { $Map.Jobs[$k].HeldBy }))) { if ($h -and -not $reads.ContainsKey([string]$h)) { $reads[[string]$h] = $true; $queue.Enqueue([string]$h) } }
|    while ($queue.Count) {
|        $x = $queue.Dequeue()
|        if (-not $Map.Jobs.Contains($x)) { continue }
|        $r = @(@($Map.Jobs[$x].Needs) + @($(if ($Map.Jobs[$x].PSObject.Properties['Reads']) { $Map.Jobs[$x].Reads })) | Where-Object { $_ })
|        foreach ($n in $r) { if (-not $reads.ContainsKey([string]$n)) { $reads[[string]$n] = $true; $queue.Enqueue([string]$n) } }
|    }
|    $jobs = New-Object System.Collections.Generic.List[string]
|    $readJobs = New-Object System.Collections.Generic.List[string]
|    foreach ($a in $above) {
|        $j = [string]$a.Job
|        if ((Get-SIPipelineStepStage $a) -notin @('correlate', 'deliver')) { $jobs.Add($j); continue }
|        if ($reads.ContainsKey($j)) { $jobs.Add($j); $readJobs.Add($j) }
|    }
|    [pscustomobject]@{ Early = $true; Jobs = $jobs.ToArray(); Reads = $readJobs.ToArray() }
|}
|
|function Add-SIJobFlowRequiredStep {
|    <#
|        PURE. #748 -- a stored pipeline WITHOUT a step the map marks 'required' (the verification service: it runs the daily
|        data health check, CR2) gets it, where its job is installed (-Installed: keys or caj-si-* names): in its stage, at
|        its place in the default order (after the last step that comes before it there), else last in that stage -- the
|        same place the web app's "include" gives it -- with the map's timeout and its stage's on-failure default. Said in
|        .MigrationNotes (.Migrated); the update stores it (setup/_shared/SI-PipelineLayout.ps1). A step that is there,
|        switched on or off, is left as it is. Idempotent; the input is not changed.
|    #>
|    param([Parameter(Mandatory)]$Definition, [AllowEmptyCollection()][string[]]$Installed = @(), $Map)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $have = @($Installed | ForEach-Object { Get-SIJobFlowKey $_ })
|    $steps = New-Object System.Collections.Generic.List[object]
|    foreach ($s in @($Definition.Steps)) { if ($s) { $steps.Add($s.PSObject.Copy()) } }
|    $stageIds = @(Get-SIPipelineStages -Definition $Definition | ForEach-Object { [string]$_.Id })
|    $order = @($Map.DefaultFlow)
|    $added = New-Object System.Collections.Generic.List[string]
|    foreach ($k in @($Map.Jobs.Keys)) {
|        $j = $Map.Jobs[$k]
|        if (-not ($j.PSObject.Properties['Required'] -and [bool]$j.Required) -or $j.NeverInFlow) { continue }
|        if ($have -notcontains $k) { continue }
|        if (@($steps | Where-Object { [string]$_.Job -eq $k }).Count) { continue }
|        $stage = if ($j.Stage -and $stageIds -contains [string]$j.Stage) { [string]$j.Stage } elseif ($stageIds.Count) { [string]$stageIds[-1] } else { 'deliver' }
|        $rank = [array]::IndexOf($order, $k)
|        $inStage = @(for ($i = 0; $i -lt $steps.Count; $i++) { if ((Get-SIPipelineStepStage $steps[$i]) -eq $stage) { $i } })
|        if ($rank -ge 0 -and $inStage.Count) {
|            $before = @($inStage | Where-Object { $r = [array]::IndexOf($order, [string]$steps[$_].Job); $r -ge 0 -and $r -lt $rank })
|            $at = if ($before.Count) { [int]$before[-1] + 1 } else { [int]$inStage[0] }
|        } elseif ($inStage.Count) { $at = [int]$inStage[-1] + 1 }
|        else {
|            $si = [array]::IndexOf($stageIds, $stage)
|            $next = @(for ($i = 0; $i -lt $steps.Count; $i++) { if ([array]::IndexOf($stageIds, [string](Get-SIPipelineStepStage $steps[$i])) -gt $si) { $i } })
|            $at = if ($next.Count) { [int]$next[0] } else { $steps.Count }
|        }
|        $t = $Map.DefaultTimeoutMinutes; if ($j.TimeoutMinutes -gt 0) { $t = $j.TimeoutMinutes }
|        $steps.Insert($at, (New-SIJobFlowStep -Job $k -TimeoutMinutes $t -OnFailure (Get-SIPipelineStageOnFailure $stage) -Stage $stage))
|        $added.Add($k)
|    }
|    if (-not $added.Count) { return $Definition }
|    $d = $Definition.PSObject.Copy()
|    $d.Steps = $steps.ToArray()
|    $notes = New-Object System.Collections.Generic.List[string]
|    if ($Definition.PSObject.Properties['MigrationNotes']) { foreach ($n in @($Definition.MigrationNotes)) { if ($n) { $notes.Add([string]$n) } } }
|    foreach ($k in $added) { $notes.Add(('{0} is now a step of the pipeline: every pipeline has it -- it runs the daily data health check (its off switch is the setting SI_DataHealth_Enabled)' -f $k)) }
|    $d | Add-Member -NotePropertyName Migrated -NotePropertyValue $true -Force
|    $d | Add-Member -NotePropertyName MigrationNotes -NotePropertyValue $notes.ToArray() -Force
|    $d
|}
|
|# =====================================================================================================================
|#  The run record
|# =====================================================================================================================
|function New-SIJobFlowRunState {
|    <# PURE. A new run record: every step Waiting (a disabled step Disabled), in definition order. #>
|    param([Parameter(Mandatory)]$Definition, [Parameter(Mandatory)][datetime]$NowUtc, [string]$FlowRunId, [string]$Trigger = 'schedule', [string]$FromStep,
|          # SCHED-1.1: the time-of-day slot this run is for (none for a manual / interval run), the last slot any run was
|          # for (carried forward, so a manual run never makes the next slot run twice), and a note (a blocked start)
|          $SlotUtc, $LastSlotUtc, [string]$Note = '',
|          # #306: what is run -- the pipeline, one stage (-Target = its id) or one step (-Target = the job) -- and who asked
|          [ValidateSet('pipeline', 'stage', 'step', 'from-step')][string]$Scope = 'pipeline', [string]$Target = '', [string]$RequestedBy = '', [long]$RequestId = 0,
|          # #700: the SecurityInsight version the run STARTED on (the updater cancels a run of another version); who cancelled it
|          [string]$Version = '')
|    if (-not $FlowRunId) { $FlowRunId = [guid]::NewGuid().ToString() }
|    if ($FromStep -and $Scope -eq 'pipeline') { $Scope = 'from-step'; $Target = $FromStep }
|    $steps = New-Object System.Collections.Generic.List[object]
|    $order = 0
|    foreach ($g in (Get-SIJobFlowGroups -Definition $Definition)) {
|        foreach ($s in $g.Steps) {
|            if ($Scope -eq 'stage' -and $g.Stage -ne $Target) { continue }
|            if ($Scope -eq 'step' -and [string]$s.Job -ne $Target) { continue }
|            $order++
|            # a step run now on its own runs even when it is switched off in the pipeline (the operator asked for it)
|            $on = [bool]$s.Enabled -or $Scope -eq 'step'
|            $steps.Add([pscustomobject]@{ Order = $order; Group = $g.Index; Job = [string]$s.Job; Stage = $g.Stage; State = $(if ($on) { 'Waiting' } else { 'Disabled' })
|                                          Execution = ''; StartedUtc = $null; EndedUtc = $null; ErrorClass = ''; Error = ''; Attempts = 0; RetryReason = '' })
|        }
|    }
|    [pscustomobject]@{ FlowRunId = $FlowRunId; Day = $NowUtc.ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture)
|                       Trigger = $Trigger; FromStep = [string]$FromStep; State = 'Running'; StartedUtc = $NowUtc; EndedUtc = $null; HeartbeatUtc = $NowUtc
|                       StopReason = ''; SlotUtc = $SlotUtc; LastSlotUtc = $(if ($SlotUtc) { $SlotUtc } else { $LastSlotUtc }); Note = $Note
|                       Scope = $Scope; Target = [string]$Target; RequestedBy = [string]$RequestedBy; RequestId = $RequestId
|                       Version = [string]$Version; CancelledBy = ''; Steps = $steps.ToArray() }
|}
|
|function Get-SIJobFlowAttempts {
|    <# PURE. How many times a step record's job was started: its Attempts, else (a record written before attempts were
|       kept) 1 when it has an execution, 0 when not. #>
|    param($Step)
|    if ($null -eq $Step) { return 0 }
|    if ($Step.PSObject.Properties['Attempts'] -and $null -ne $Step.Attempts -and -not ($Step.Attempts -is [DBNull]) -and "$($Step.Attempts)" -ne '') { return [int]$Step.Attempts }
|    if ($Step.PSObject.Properties['Execution'] -and -not ($Step.Execution -is [DBNull]) -and "$($Step.Execution)" -ne '') { return 1 }
|    0
|}
|
|function ConvertFrom-SIJobFlowRunJson {
|    <# PURE. A run record from its JSON (the file / blob store). Times as UTC [datetime] or $null. #>
|    param([Parameter(Mandatory)][string]$Json)
|    $o = $Json | ConvertFrom-Json
|    $t = { param($v) if ($null -eq $v -or "$v" -eq '') { $null } else { ([datetime]::Parse([string]$v, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal)) } }
|    $steps = foreach ($s in @($o.Steps)) {
|        if ($null -eq $s) { continue }
|        [pscustomobject]@{ Order = [int]$s.Order; Group = [int]$s.Group; Job = [string]$s.Job; Stage = $(if ($s.PSObject.Properties['Stage'] -and $s.Stage) { [string]$s.Stage } else { '' }); State = [string]$s.State; Execution = [string]$s.Execution
|                           StartedUtc = (& $t $s.StartedUtc); EndedUtc = (& $t $s.EndedUtc); ErrorClass = [string]$s.ErrorClass; Error = [string]$s.Error
|                           Attempts = (Get-SIJobFlowAttempts $s); RetryReason = $(if ($s.PSObject.Properties['RetryReason']) { [string]$s.RetryReason } else { '' }) }
|    }
|    $f = { param($n, $d) if ($o.PSObject.Properties[$n] -and $null -ne $o.$n -and "$($o.$n)" -ne '') { $o.$n } else { $d } }
|    [pscustomobject]@{ FlowRunId = [string]$o.FlowRunId; Day = [string]$o.Day; Trigger = [string]$o.Trigger; FromStep = [string]$o.FromStep; State = [string]$o.State
|                       StartedUtc = (& $t $o.StartedUtc); EndedUtc = (& $t $o.EndedUtc); HeartbeatUtc = (& $t $o.HeartbeatUtc); StopReason = [string]$o.StopReason
|                       SlotUtc = (& $t $o.SlotUtc); LastSlotUtc = (& $t $o.LastSlotUtc); Note = [string]$o.Note
|                       Scope = [string](& $f 'Scope' 'pipeline'); Target = [string](& $f 'Target' ''); RequestedBy = [string](& $f 'RequestedBy' ''); RequestId = [long](& $f 'RequestId' 0)
|                       Version = [string](& $f 'Version' ''); CancelledBy = [string](& $f 'CancelledBy' ''); Steps = @($steps) }
|}
|
|function ConvertTo-SIJobFlowRunJson {
|    param([Parameter(Mandatory)]$State)
|    $iso = { param($v) if ($null -eq $v) { $null } else { ([datetime]$v).ToUniversalTime().ToString('o', [Globalization.CultureInfo]::InvariantCulture) } }
|    $g = { param($n, $d) if ($State.PSObject.Properties[$n] -and $null -ne $State.$n) { $State.$n } else { $d } }
|    $o = [ordered]@{ FlowRunId = $State.FlowRunId; Day = $State.Day; Trigger = $State.Trigger; FromStep = $State.FromStep; State = $State.State
|                     StartedUtc = (& $iso $State.StartedUtc); EndedUtc = (& $iso $State.EndedUtc); HeartbeatUtc = (& $iso $State.HeartbeatUtc); StopReason = $State.StopReason
|                     SlotUtc = (& $iso $State.SlotUtc); LastSlotUtc = (& $iso $State.LastSlotUtc); Note = [string]$State.Note
|                     Scope = [string](& $g 'Scope' 'pipeline'); Target = [string](& $g 'Target' ''); RequestedBy = [string](& $g 'RequestedBy' ''); RequestId = [long](& $g 'RequestId' 0)
|                     Version = [string](& $g 'Version' ''); CancelledBy = [string](& $g 'CancelledBy' '')
|                     Steps =@(@($State.Steps) | ForEach-Object { [ordered]@{ Order = $_.Order; Group = $_.Group; Job = $_.Job; Stage = $(if ($_.PSObject.Properties['Stage']) { [string]$_.Stage } else { '' }); State = $_.State; Execution = $_.Execution
|                                                                             StartedUtc = (& $iso $_.StartedUtc); EndedUtc = (& $iso $_.EndedUtc); ErrorClass = $_.ErrorClass; Error = $_.Error
|                                                                             Attempts = (Get-SIJobFlowAttempts $_); RetryReason = $(if ($_.PSObject.Properties['RetryReason']) { [string]$_.RetryReason } else { '' }) } }) }
|    $o | ConvertTo-Json -Depth 6
|}
|
|function Get-SIJobFlowLatestSlot {
|    <#
|        PURE. The latest time-of-day slot at or before -NowUtc for a daily / weekdays / weekly flow, as UTC; $null for
|        interval. #306: the start time is a wall-clock time in the pipeline's time zone (TimeZone; none = UTC) -- 22:00
|        Europe/Copenhagen is 20:00 UTC in summer and 21:00 UTC in winter, every day computed from that day's local date
|        (the weekday too is the local one).
|    #>
|    param([Parameter(Mandatory)]$Definition, [Parameter(Mandatory)][datetime]$NowUtc)
|    if ([string]$Definition.Cadence -eq 'interval') { return $null }
|    $h, $m = ([string]$Definition.StartTime) -split ':'
|    $n = [datetime]::SpecifyKind($NowUtc.ToUniversalTime(), 'Utc')
|    $zone = (Resolve-SIPipelineTimeZone (Get-SIPipelineTimeZoneId $Definition)).Zone
|    $localDay = [TimeZoneInfo]::ConvertTimeFromUtc($n, $zone).Date
|    for ($i = 0; $i -lt 9; $i++) {
|        $local = $localDay.AddDays(-$i).AddHours([int]$h).AddMinutes([int]$m)
|        $t = ConvertTo-SIPipelineUtc -Local $local -Zone $zone
|        if ($t -gt $n) { continue }
|        $ok = switch ([string]$Definition.Cadence) {
|            'weekdays' { $local.DayOfWeek -notin @([DayOfWeek]::Saturday, [DayOfWeek]::Sunday) }
|            'weekly'   { [int]$local.DayOfWeek -eq ([int]$Definition.Weekday % 7) }
|            default    { $true }
|        }
|        if ($ok) { return $t }
|    }
|    $null
|}
|
|function Get-SIJobFlowCoveredSlot {
|    <#
|        PURE. (2026-10-24, seen on internal: a manual run still going at the daily time, then a catch-up -- a second full run
|        back to back, and its load raised tickets.) The time-of-day slot -Previous COVERED: the latest slot S with
|        StartedUtc < S <= EndedUtc -- the run was RUNNING at that time -- when it ended Succeeded (every step: a run with a
|        failed step is Failed) AND it was a run of the WHOLE pipeline (Scope pipeline, no FromStep: one step, one stage or a
|        re-run from a step does not collect everything) AND it had NO SLOT OF ITS OWN (a manual or queued run -- SlotUtc
|        empty): a scheduled or catch-up run is already its own slot's run, and one that takes longer than the schedule's
|        interval keeps "start when the last one ends" (the next slot runs once at its end -- a large install's data stays
|        refreshed every run, not every second day). $null otherwise -- a failed, cancelled or stopped run, a run with its
|        own slot, an interval cadence, no run -- and the catch-up stays as it was.
|    #>
|    param([Parameter(Mandatory)]$Definition, $Previous)
|    if (-not $Previous -or [string]$Definition.Cadence -eq 'interval') { return $null }
|    if ([string]$Previous.State -ne 'Succeeded') { return $null }
|    if ($Previous.PSObject.Properties['SlotUtc'] -and $Previous.SlotUtc) { return $null }
|    $scope = if ($Previous.PSObject.Properties['Scope'] -and [string]$Previous.Scope) { [string]$Previous.Scope } else { 'pipeline' }
|    if ($scope -ne 'pipeline') { return $null }
|    if ($Previous.PSObject.Properties['FromStep'] -and [string]$Previous.FromStep) { return $null }
|    if (-not $Previous.StartedUtc -or -not $Previous.EndedUtc) { return $null }
|    $start = ([datetime]$Previous.StartedUtc).ToUniversalTime(); $end = ([datetime]$Previous.EndedUtc).ToUniversalTime()
|    $s = Get-SIJobFlowLatestSlot -Definition $Definition -NowUtc $end
|    if ($s -and $s -gt $start) { return $s }
|    $null
|}
|
|function Get-SIJobFlowSlotRun {
|    <# PURE. The latest slot that HAS RUN after -Previous: its LastSlotUtc, or the slot it covered (Get-SIJobFlowCoveredSlot) when
|       that is later; $null when neither. What a new run carries forward and what the schedule reads as "this slot has run". #>
|    param([Parameter(Mandatory)]$Definition, $Previous)
|    if (-not $Previous) { return $null }
|    $last = if ($Previous.LastSlotUtc) { ([datetime]$Previous.LastSlotUtc).ToUniversalTime() } else { $null }
|    $cov = Get-SIJobFlowCoveredSlot -Definition $Definition -Previous $Previous
|    if ($cov -and (-not $last -or $cov -gt $last)) { return $cov }
|    $last
|}
|
|function Get-SIJobFlowDue {
|    <#
|        PURE. SCHED-1.1 (framework): is a flow run due at this wake-up (the flow job's cron / the VM task only WAKE the
|        runner -- they never stand in for the cadence)? Returns @{ Action; SlotUtc; Trigger; Note; NextUtc; Reason }:
|          Busy    -- the previous run is still running (fresh heartbeat): nothing starts -- never two runs at once;
|          Resume  -- the previous run is unfinished and its runner died (stale heartbeat): continue it;
|          Start   -- a run is due now;
|          Wait    -- not due; NextUtc says when.
|        INTERVAL ("every N minutes / hours"): next = the previous run's FINISH + the interval -- an 8-minute run every
|        5 minutes started at T finishes at T+8 and is next due at T+13. A failed run counts as finished. A cadence change
|        is re-derived from the finish on the next wake-up (nothing is stored but the finish).
|        TIME OF DAY (daily / weekdays / weekly at HH:mm): the slot keeps its clock time. A slot whose start was BLOCKED
|        because the previous run was still running runs ONCE as soon as that run finishes (Trigger 'catch-up', Note says
|        which run blocked it); several missed slots run once, never queued. With no slotted run in the history, only a
|        slot within -FirstRunWindowMinutes starts (a new install does not start hours late).
|    #>
|    param([Parameter(Mandatory)]$Definition, $Previous, [Parameter(Mandatory)][datetime]$NowUtc, [int]$StaleAfterMinutes = 15, [int]$FirstRunWindowMinutes = 15)
|    $now = $NowUtc.ToUniversalTime()
|    $mk = { param($a, $slot, $trg, $note, $next, $why) [pscustomobject]@{ Action = $a; SlotUtc = $slot; Trigger = $trg; Note = $note; NextUtc = $next; Reason = $why } }
|    # #700: a CANCELLED run is finished -- it is never resumed (a person or the updater ended it on purpose)
|    $running = $Previous -and ([string]$Previous.State -notin $script:SIJobFlow.RunFinished)
|    if ($running) {
|        $hb = $Previous.HeartbeatUtc
|        if ($hb -and ($now - ([datetime]$hb).ToUniversalTime()).TotalMinutes -lt $StaleAfterMinutes) {
|            return (& $mk 'Busy' $null '' '' $null ('skipped: the previous flow run ({0}) is still running' -f $Previous.FlowRunId))
|        }
|        return (& $mk 'Resume' $null '' '' $null ('the previous flow run ({0}) stopped without finishing -- it is resumed' -f $Previous.FlowRunId))
|    }
|    if ([string]$Definition.Cadence -eq 'interval') {
|        $iv = [int]$Definition.IntervalMinutes; if ($iv -lt 1) { $iv = 1440 }
|        if (-not $Previous -or -not $Previous.EndedUtc) { return (& $mk 'Start' $null 'interval' '' $null 'no earlier run') }
|        $next = ([datetime]$Previous.EndedUtc).ToUniversalTime().AddMinutes($iv)
|        if ($now -ge $next) { return (& $mk 'Start' $null 'interval' '' $null ('the previous run finished {0:u}; every {1} min after the finish' -f $Previous.EndedUtc, $iv)) }
|        return (& $mk 'Wait' $null '' '' $next ('next run {0:u}: the previous run finished {1:u} + {2} min' -f $next, $Previous.EndedUtc, $iv))
|    }
|    $slot = Get-SIJobFlowLatestSlot -Definition $Definition -NowUtc $now
|    $nextSlot = Get-SIJobFlowLatestSlot -Definition $Definition -NowUtc $now.AddDays(8)
|    for ($d = 7; $d -ge 0; $d--) { $c = Get-SIJobFlowLatestSlot -Definition $Definition -NowUtc $now.AddDays($d); if ($c -and $c -gt $now) { $nextSlot = $c } }
|    # 2026-10-24: a whole run that was running at the slot and succeeded IS that slot's run (Get-SIJobFlowCoveredSlot)
|    $last = Get-SIJobFlowSlotRun -Definition $Definition -Previous $Previous
|    if ($last -and $slot -and ([datetime]$last).ToUniversalTime() -ge $slot) {
|        $own = if ($Previous -and $Previous.LastSlotUtc) { ([datetime]$Previous.LastSlotUtc).ToUniversalTime() } else { $null }
|        if (-not $own -or $own -lt $slot) {
|            return (& $mk 'Wait' $null '' '' $nextSlot ('the {0:u} slot was covered by flow run {1}: it was running at that time and succeeded; next slot {2:u}' -f $slot, $Previous.FlowRunId, $nextSlot))
|        }
|        return (& $mk 'Wait' $null '' '' $nextSlot ('the {0:u} slot has run; next slot {1:u}' -f $slot, $nextSlot))
|    }
|    if (-not $slot) { return (& $mk 'Wait' $null '' '' $nextSlot 'no slot yet') }
|    if (-not $last) {
|        if (($now - $slot).TotalMinutes -le $FirstRunWindowMinutes) { return (& $mk 'Start' $slot 'schedule' '' $null ('the {0:u} slot' -f $slot)) }
|        return (& $mk 'Wait' $null '' '' $nextSlot ('first run: the {0:u} slot has passed; next slot {1:u}' -f $slot, $nextSlot))
|    }
|    # the slot has not run: on time, or blocked by a run that was still running at the slot and has finished since
|    $blocked = $Previous -and $Previous.StartedUtc -and $Previous.EndedUtc -and ([datetime]$Previous.StartedUtc).ToUniversalTime() -lt $slot -and ([datetime]$Previous.EndedUtc).ToUniversalTime() -gt $slot
|    if ($blocked) {
|        return (& $mk 'Start' $slot 'catch-up' ('the {0:u} start was blocked: flow run {1} was still running; it ran once when that run finished ({2:u})' -f $slot, $Previous.FlowRunId, $Previous.EndedUtc) $null 'a blocked start runs once when the previous run finishes')
|    }
|    $late = ($now - $slot).TotalMinutes
|    $note = if ($late -gt $FirstRunWindowMinutes) { ('the {0:u} slot started {1:N0} min late (the runner was not woken earlier)' -f $slot, $late) } else { '' }
|    & $mk 'Start' $slot 'schedule' $note $null ('the {0:u} slot' -f $slot)
|}
|
|function Get-SIJobFlowLateStart {
|    <#
|        PURE. WHY A SCHEDULED START IS LATE (owner 2026-10-12: "Quiet when runs are just long"), decided when the run
|        STARTS and written into its note, so the run's own record says it (and a resumed run still knows it):
|          on-time      -- it started within -LateAfterMinutes of its scheduled time (or it is not a scheduled start);
|          previous-run -- it was owed ONLY because the previous run was still going at its scheduled time, and it started
|                          as soon as that run ended (within -LateAfterMinutes of its end). Normal on an install whose run
|                          takes longer than the schedule's interval: said in the note, NOT a guard event;
|          missed       -- anything else: no run was going at its scheduled time and it still started late (the pipeline was
|                          not woken, its job was switched off, an update held it), or the previous run was going but this
|                          run did not start when that one ended. The guard 'flow.run.catch-up' reports it.
|        -Trigger: schedule | catch-up (anything else is not a scheduled start); -SlotUtc: the scheduled time the run is
|        for; -Previous: the last run record. @{ Kind; LateMinutes; Note } -- Note '' for on-time.
|        The two sentences are what Get-SIGuardCallsForFlow (SI-Guard.ps1) reads: 'started late because the previous run was
|        still going' = quiet, 'scheduled start was missed' = reported.
|    #>
|    param([string]$Trigger = 'schedule', $SlotUtc, $Previous, [Parameter(Mandatory)][datetime]$NowUtc, [int]$LateAfterMinutes = 15)
|    $none = [pscustomobject]@{ Kind = 'on-time'; LateMinutes = 0; Note = '' }
|    if (-not $SlotUtc -or $Trigger -notin @('schedule', 'catch-up')) { return $none }
|    $now = $NowUtc.ToUniversalTime(); $slot = ([datetime]$SlotUtc).ToUniversalTime()
|    $late = [int][Math]::Floor(($now - $slot).TotalMinutes)
|    $pStart = if ($Previous -and $Previous.StartedUtc) { ([datetime]$Previous.StartedUtc).ToUniversalTime() } else { $null }
|    $pEnd = if ($Previous -and $Previous.EndedUtc) { ([datetime]$Previous.EndedUtc).ToUniversalTime() } else { $null }
|    if ($pStart -and $pEnd -and $pStart -lt $slot -and $pEnd -gt $slot) {
|        # a run was going at the scheduled time
|        $after = [int][Math]::Floor(($now - $pEnd).TotalMinutes)
|        if ($after -le $LateAfterMinutes) {
|            return [pscustomobject]@{ Kind = 'previous-run'; LateMinutes = $late
|                Note = ('This run started late because the previous run ({0}) was still going at its scheduled time ({1:u}); it started as soon as that run ended ({2:u}).' -f $Previous.FlowRunId, $slot, $pEnd) }
|        }
|        return [pscustomobject]@{ Kind = 'missed'; LateMinutes = $late
|            Note = ('This scheduled start was missed: the previous run ({0}) was still going at its time ({1:u}) and ended {2:u}, but this run started {3} minutes after that.' -f $Previous.FlowRunId, $slot, $pEnd, $after) }
|    }
|    if ($late -gt $LateAfterMinutes) {
|        return [pscustomobject]@{ Kind = 'missed'; LateMinutes = $late
|            Note = ('This scheduled start was missed: its time was {0:u} and no run was going then, but it started {1} minutes late.' -f $slot, $late) }
|    }
|    $none
|}
|
|function Resolve-SIJobFlowStart {
|    <#
|        PURE. What a runner does with the last run record it finds (crash recovery and double-start protection):
|          New      -- no record, or the last one is finished and this is a new start (a forced / manual run, a re-run from
|                      a step, or a scheduled run on a later day);
|          Resume   -- the last record is unfinished and its heartbeat is stale (its runner died): continue THAT run;
|          Busy     -- the last record is unfinished and its heartbeat is fresh: another runner is alive -- refuse;
|          Done     -- a scheduled start finds today's run already finished: report it, run nothing again.
|        -StaleAfterMinutes: a heartbeat older than this is a dead runner (the runner beats every poll).
|    #>
|    param($Previous, [Parameter(Mandatory)][datetime]$NowUtc, [switch]$Force, [string]$FromStep, [int]$StaleAfterMinutes = 15)
|    if ($null -eq $Previous) { return 'New' }
|    $finished = ([string]$Previous.State -in $script:SIJobFlow.RunFinished)
|    if (-not $finished) {
|        $hb = $Previous.HeartbeatUtc
|        if ($hb -and ($NowUtc - ([datetime]$hb).ToUniversalTime()).TotalMinutes -lt $StaleAfterMinutes) { return 'Busy' }
|        return 'Resume'
|    }
|    if ($Force -or $FromStep) { return 'New' }
|    $today = $NowUtc.ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture)
|    if ([string]$Previous.Day -eq $today) { return 'Done' }
|    return 'New'
|}
|
|# =====================================================================================================================
|#  The runner
|# =====================================================================================================================
|function Get-SIJobFlowBlocked {
|    <#
|        PURE. From the steps that have ended so far: whether the flow is stopped (a failed step with OnFailure 'stop') and
|        which steps are skipped because a step they need failed (OnFailure 'skip-dependents'). @{ Stopped; StopReason; Skip = @{ job = failedJob } }.
|        A SOURCE DROPOUT skips nothing: a failed collection step (identity / azure / endpoint / publicip) whose run has
|        another collection that SUCCEEDED leaves the steps that need it running -- they read that source's last good
|        collection. With no collection succeeded there is nothing new to calculate, and its dependents are skipped as before.
|    #>
|    param([Parameter(Mandatory)]$State, [Parameter(Mandatory)]$Definition, $Map)
|    $stopped = $false; $why = ''
|    $skip = @{}
|    $anySource = (Get-SIPipelineCollectVerdict -State $State -Definition $Definition).AnySource
|    foreach ($st in @($State.Steps)) {
|        if ($script:SIJobFlow.Failures -notcontains [string]$st.State) { continue }
|        # #700: a step whose execution was STOPPED from outside the pipeline stops the run there, whatever its own failure
|        # rule says: a stop is on purpose, so the run does not go on by itself (and a run that ended Stopped is never resumed)
|        if ([string]$st.ErrorClass -eq 'stopped') {
|            if (-not $stopped) { $stopped = $true; $why = Get-SIJobFlowStoppedText -Job ([string]$st.Job) -Run }
|            continue
|        }
|        $def = @(@($Definition.Steps) | Where-Object { $_.Job -eq $st.Job })[0]
|        $mode = if ($def) { [string]$def.OnFailure } else { 'skip-dependents' }
|        if ($mode -eq 'stop' -and -not $stopped) { $stopped = $true; $why = ('{0} {1} -- the flow stops there (on failure: stop)' -f $st.Job, $st.State.ToLowerInvariant()) }
|        elseif ($mode -eq 'skip-dependents' -and $anySource -and (Get-SIPipelineStepStage $st) -eq 'collect' -and (Test-SIPipelineSourceJob ([string]$st.Job))) { continue }
|        elseif ($mode -eq 'skip-dependents') { foreach ($d in (Get-SIJobFlowDependents -Job $st.Job -Definition $Definition -Map $Map)) { if (-not $skip.ContainsKey($d)) { $skip[$d] = $st.Job } } }
|    }
|    [pscustomobject]@{ Stopped = $stopped; StopReason = $why; Skip = $skip }
|}
|
|function Get-SIJobFlowStoppedText {
|    <#
|        PURE. #700: the plain words for a step whose execution was STOPPED from outside the pipeline (in Azure, by a person,
|        by a release tool). -Run: the run's stop reason (the run does not go on). A stop on purpose is not a platform error:
|        the step is never started again as one (working rule 4 retries only a container that never started the engine).
|        Nor is it a failure of the engine (2026-10-23: "failed -- the execution ended stopped" + "who must act: the vendor"
|        for executions an update / roll or a person stopped opened misleading fix requests): the step is recorded
|        Interrupted (class 'stopped') with these words, and a run whose only failures are such steps is 'interrupted'
|        (Get-SIJobFlowRunExitReason) -- never reported as a failure.
|    #>
|    param([Parameter(Mandatory)][string]$Job, [switch]$Run)
|    if ($Run) { return ('{0} was stopped from outside the pipeline -- the run does not go on by itself (a stop is on purpose, not a platform error). Start the pipeline again when it should run.' -f $Job) }
|    'stopped from outside the pipeline (an update, a roll or a person stopped its execution) -- not a failure of the step; nothing has to be fixed'
|}
|
|function Test-SIJobFlowStoppedOnly {
|    <# PURE. The run did not succeed, and EVERY step that failed (Failed / TimedOut / Interrupted) was stopped from outside
|       the pipeline (class 'stopped') or cancelled on purpose (class 'cancelled'): nothing failed by itself. #>
|    param([Parameter(Mandatory)]$State)
|    if ([string]$State.State -notin @('Failed', 'Stopped')) { return $false }
|    $bad = @(@($State.Steps) | Where-Object { $script:SIJobFlow.Failures -contains [string]$_.State })
|    if ($bad.Count -eq 0) { return $false }
|    foreach ($s in $bad) { if ([string]$s.ErrorClass -notin @('stopped', 'cancelled')) { return $false } }
|    $true
|}
|
|function Get-SIJobFlowFailureClass {
|    <#
|        PURE. Working rule 4 -- "only the PLATFORM gets re-run": did a failed step's container ever run the engine?
|        Found live 2026-10-05 (ring 1): a step's execution ended Failed 31 s after it was started, with no console line,
|        no run transcript and no run-health record -- the container died before PowerShell ran. That is an Azure
|        platform failure, and it is started again; a failure of the engine itself is never started again (it would fail
|        the same way and burn another run).
|          -ErrorClass       the step's. Only 'job-failed' (the execution ended Failed / Stopped) is considered: a start ARM
|                            refused, a timeout or an interruption is never retried here.
|          -HasStartRecord   the engine's START run-health row for THIS execution exists ($true), does not ($false), or the
|                            store cannot tell ($null: no workspace, the query failed, or the store holds no stamped row of
|                            THIS engine in the last 7 days -- measured on ring 1 2026-10-05: container runs were not saving
|                            run health at all, so an empty store proves nothing).
|          -HasTranscript    a run transcript published inside the execution's window ($true / $false / $null = unknown).
|          -DurationSeconds  from the start to the end the runner saw. -MaxSeconds (default 120): used only when the
|                            store cannot tell (-HasStartRecord $null) -- longer is then never "never started".
|          -Attempts / -Retries: the starts made so far and the retries allowed.
|        A START row or a transcript = the engine ran: a real failure (engine-failed), never retried.
|        never-started needs a POSITIVE signal, never the run-health store alone: NO run transcript in the window (known,
|        not unknown) AND either a START row known absent (any duration -- live 2026-10-23 a platform outage held pods
|        unstarted for 314 s / 377 s) or, when the store cannot tell, a run of at most -MaxSeconds. A transcript that
|        cannot be checked is 'unknown' -- never retried, whatever the store says.
|        Returns @{ Class = never-started | engine-failed | unknown | not-applicable; Retry; Signal; Why }.
|    #>
|    param([AllowEmptyString()][string]$ErrorClass, $HasStartRecord, $HasTranscript, [double]$DurationSeconds,
|          [int]$MaxSeconds = $script:SIJobFlow.NeverStartedMaxSeconds, [int]$Attempts = 1, [int]$Retries = $script:SIJobFlow.StartRetries)
|    $mk = { param($c, $r, $sig, $why) [pscustomobject]@{ Class = $c; Retry = [bool]$r; Signal = $sig; Why = $why } }
|    if ($ErrorClass -ne 'job-failed') { return (& $mk 'not-applicable' $false '' ('a step that {0} is not a start failure' -f $(if ($ErrorClass) { "ended '$ErrorClass'" } else { 'did not fail' }))) }
|    if ($HasStartRecord -eq $true) { return (& $mk 'engine-failed' $false 'run-health' 'the engine recorded its start, so the job itself failed -- it is not started again') }
|    if ($HasTranscript -eq $true) { return (& $mk 'engine-failed' $false 'transcript' 'the engine wrote a run log, so the job itself failed -- it is not started again') }
|    if ($HasTranscript -ne $false) { return (& $mk 'unknown' $false '' 'whether the job started could not be told (its run logs could not be read) -- it is not started again') }
|    # Live 2026-10-23: Azure could not start any container for 13 minutes -- two executions ran 314 s and 377 s (pods
|    # created, never started, BackoffLimitExceeded) with no run log and no START row. Both signals known absent is the
|    # evidence that the engine never ran, whatever the duration: no fixed time bound decides it then.
|    if ($HasStartRecord -eq $false) {
|        return (& $mk 'never-started' ($Attempts -le $Retries) 'transcript+duration+run-health' ('the execution ended after {0:N0} s without a run log and without recording its start' -f $DurationSeconds))
|    }
|    $sig = 'transcript+duration'
|    if ($DurationSeconds -gt $MaxSeconds) { return (& $mk 'unknown' $false $sig ('the execution ran {0:N0} s (over {1} s) without a run log -- not a start failure, it is not started again' -f $DurationSeconds, $MaxSeconds)) }
|    & $mk 'never-started' ($Attempts -le $Retries) $sig ('the execution ended after {0:N0} s without a run log{1}' -f $DurationSeconds, $(if ($HasStartRecord -eq $false) { ' and without recording its start' } else { '' }))
|}
|
|function Get-SIJobFlowStartRecordQuery {
|    <#
|        PURE. The KQL that tells whether the engine of -Execution recorded its START (SI_RunHealth_CL, column Execution --
|        every engine stamps CONTAINER_APP_JOB_EXECUTION_NAME there since #269). Mine = the execution's START rows (the
|        flow's own step rows excluded); Stamped = rows of -Engine in the last 7 days that carry an execution -- 0 means
|        this engine's runs are not in the store (an older image, or run health not being saved), so "no row" proves
|        nothing and the answer is "cannot tell". $null for a name that is not an execution / engine name (never put
|        into a query).
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Execution, [Parameter(Mandatory)][datetime]$StartedUtc, [Parameter(Mandatory)][AllowEmptyString()][string]$Engine)
|    if ($Execution -notmatch '^[a-z0-9][a-z0-9\-]{0,126}$') { return $null }
|    if ($Engine -notmatch '^[a-z0-9][a-z0-9\-]{0,63}$') { return $null }
|    $from = $StartedUtc.ToUniversalTime().AddMinutes(-10).ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture)
|    ("SI_RunHealth_CL | where TimeGenerated > ago(7d) | extend Execution = tostring(column_ifexists('Execution', '')) " +
|     "| summarize Mine = countif(TimeGenerated > datetime({0}) and Phase == 'Start' and Execution == '{1}' and not(Engine startswith 'flow')), " +
|     "Stamped = countif(Engine == '{2}' and isnotempty(Execution)), " +
|     "Throttled = countif(TimeGenerated > datetime({0}) and Phase == 'End' and Execution == '{1}' and not(Engine startswith 'flow') and tostring(ExitReason) == 'throttled'), " +
|     "EndOther = countif(TimeGenerated > datetime({0}) and Phase == 'End' and Execution == '{1}' and not(Engine startswith 'flow') and tostring(ExitReason) !in ('throttled', 'success'))") -f $from, $Execution, $Engine
|}
|
|function Test-SIJobFlowTranscriptInWindow {
|    <#
|        PURE. Is there a run transcript (run-logs/<engine>/<engine>_<flavour>_<yyyyMMddTHHmmssZ>.log) stamped inside
|        [-StartedUtc - 60 s, -EndedUtc + 60 s]? Every engine's, on purpose: a transcript of another job in the window only
|        makes the answer "it ran" -- never retried -- which is the safe side.
|    #>
|    param([AllowEmptyCollection()][string[]]$Names = @(), [Parameter(Mandatory)][datetime]$StartedUtc, [Parameter(Mandatory)][datetime]$EndedUtc)
|    $a = $StartedUtc.ToUniversalTime().AddSeconds(-60); $b = $EndedUtc.ToUniversalTime().AddSeconds(60)
|    foreach ($n in @($Names)) {
|        if ([string]$n -notmatch '_(\d{8}T\d{6}Z)\.log$') { continue }
|        $t = [datetime]::MinValue
|        if ([datetime]::TryParseExact($Matches[1], 'yyyyMMddTHHmmssZ', [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal, [ref]$t)) {
|            if ($t -ge $a -and $t -le $b) { return $true }
|        }
|    }
|    $false
|}
|
|function New-SIJobFlowStartEvidence {
|    <#
|        The container flow's "did the engine start?" probe: Probe($Job, $Execution, $StartedUtc, $EndedUtc) ->
|        @{ HasStartRecord; HasTranscript; EndReason } -- each $true / $false, or $null when it cannot be told (never throws).
|        EndReason (#532): 'throttled' when the engine of THIS execution recorded END 'throttled' and nothing else, 'failed'
|        when it recorded another failure, $null when no END record of it was found (yet).
|        Seams (tests): -Query { param($Kql) } -> rows with Mine / Stamped; -ListBlobs { param($Prefix) } -> blob names.
|        Default: Log Analytics as the job's identity (Invoke-SILogLaQuery, -WorkspaceResourceId) and the install's
|        storage (Get-SIBlobList, -StorageAccount, container sistaging, prefix run-logs/).
|    #>
|    param([string]$WorkspaceResourceId, [string]$StorageAccount, [scriptblock]$Query, [scriptblock]$ListBlobs, $Map)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $engines = @{}; foreach ($k in @($Map.Jobs.Keys)) { if ($Map.Jobs[$k].Engine) { $engines[[string]$k] = [string]$Map.Jobs[$k].Engine } }
|    New-SIJobFlowSeams -Fields @{ Workspace = $WorkspaceResourceId; Account = $StorageAccount; Query = $Query; ListBlobs = $ListBlobs; Engines = $engines } -Methods @{
|        Probe = {
|            param($Job, $Execution, $StartedUtc, $EndedUtc)
|            $row = $null; $tr = $null; $endReason = $null
|            if (($this.Query -or $this.Workspace) -and $StartedUtc) {
|                try {
|                    $eng = if ($this.Engines.ContainsKey([string]$Job)) { $this.Engines[[string]$Job] } else { [string]$Job }
|                    $kql = Get-SIJobFlowStartRecordQuery -Execution ([string]$Execution) -StartedUtc ([datetime]$StartedUtc) -Engine $eng
|                    if ($kql) {
|                        # @( ) around the whole if: one row out of an if is unrolled, and PS 5.1 gives a [pscustomobject] no .Count
|                        $r = @(if ($this.Query) { & $this.Query $kql } else { Invoke-SILogLaQuery -WorkspaceResourceId $this.Workspace -Query $kql }) | Where-Object { $_ }
|                        $r = @($r)
|                        if ($r.Count -and [long]$r[0].Stamped -gt 0) { $row = ([long]$r[0].Mine -gt 0) }
|                        elseif ($r.Count -and [long]$r[0].Mine -gt 0) { $row = $true }
|                        # #532: the engine of this execution recorded END 'throttled' and no other failure -- throttled
|                        if ($r.Count -and $r[0].PSObject.Properties['Throttled']) {
|                            $other = if ($r[0].PSObject.Properties['EndOther']) { [long]$r[0].EndOther } else { 0 }
|                            $endReason = if ([long]$r[0].Throttled -gt 0 -and $other -eq 0) { 'throttled' } elseif ($other -gt 0) { 'failed' } else { $null }
|                        }
|                    }
|                } catch { $row = $null; $endReason = $null }
|            }
|            if (($this.ListBlobs -or $this.Account) -and $StartedUtc -and $EndedUtc) {
|                try {
|                    $names = if ($this.ListBlobs) { @(& $this.ListBlobs 'run-logs/') } else { @(Get-SIBlobList -Account $this.Account -Container 'sistaging' -Prefix 'run-logs/' | ForEach-Object { [string]$_.Name }) }
|                    # #966 THIS STEP'S OWN run log (its engine, or its key; a producer / worker of it counts), never any
|                    # engine's: in a pipeline the step before and the half-hourly heartbeat publish theirs inside the window,
|                    # so "any transcript" answered "it ran" and a container that died before the engine started was never
|                    # started again (live 2026-10-30: the verification step, pod created and BackoffLimitExceeded 65 s later,
|                    # no line of its own -- the close-loop mail's run log 4 s before it decided "it ran", the run failed).
|                    # No run log at all = this install keeps none; no run log of THIS engine ever = its logs are named
|                    # otherwise: either way the signal does not exist ($null -- never retried on it).
|                    $key = Get-SIJobFlowKey ([string]$Job)
|                    $teng = if ($this.Engines.ContainsKey($key)) { $this.Engines[$key] } elseif ($this.Engines.ContainsKey([string]$Job)) { $this.Engines[[string]$Job] } else { $key }
|                    $ever = if (@($names).Count) { Select-SIJobFlowStepLog -Names $names -Engine $teng -Key $key -StartedUtc ([datetime]::new(2000, 1, 1, 0, 0, 0, [DateTimeKind]::Utc)) -EndedUtc ([datetime]::new(2100, 1, 1, 0, 0, 0, [DateTimeKind]::Utc)) } else { '' }
|                    $tr = if ($ever) { [bool](Select-SIJobFlowStepLog -Names $names -Engine $teng -Key $key -StartedUtc ([datetime]$StartedUtc) -EndedUtc ([datetime]$EndedUtc)) } else { $null }
|                } catch { $tr = $null }
|            }
|            [pscustomobject]@{ HasStartRecord = $row; HasTranscript = $tr; EndReason = $endReason }
|        }
|    }
|}
|
|function Get-SIJobFlowSilentText {
|    <#
|        PURE. The plain words for a running step that shows no sign of progress (the log, the run-health record, the step).
|        -NoticedUtc: when the pipeline noticed it. THE STEP RECORD CARRIES THIS SENTENCE (RetryReason), and the web app's
|        pipeline page reads two things out of it to show the warning on the running step -- "no sign of progress for N
|        hours" and "(noticed yyyy-MM-dd HH:mm UTC" (JobFlow.SilentStep in pro-management). Keep the two in step.
|    #>
|    param([Parameter(Mandatory)][string]$Job, [int]$SilentMinutes, $LastSeenUtc, $NoticedUtc)
|    $h = ([double]$SilentMinutes / 60).ToString('0.#', [Globalization.CultureInfo]::InvariantCulture)
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $bits = @()
|    if ($NoticedUtc) { $bits += ('noticed {0} UTC' -f ([datetime]$NoticedUtc).ToUniversalTime().ToString('yyyy-MM-dd HH:mm', $inv)) }
|    if ($LastSeenUtc) { $bits += ('its last log line or record was at {0} UTC' -f ([datetime]$LastSeenUtc).ToUniversalTime().ToString('yyyy-MM-dd HH:mm', $inv)) }
|    $at = if ($bits.Count) { ' ({0})' -f ($bits -join '; ') } else { '' }
|    '{0} has shown no sign of progress for {1} hours{2}. It is still running and nothing is stopped -- if it does not move on, look at the job''s log' -f $Job, $h, $at
|}
|
|function Get-SIJobFlowProgressQuery {
|    <#
|        PURE. The KQL that tells when a running step's job LAST SAID ANYTHING: its console log lines (Container Apps writes
|        them to the workspace: ContainerAppConsoleLogs, or the classic ContainerAppConsoleLogs_CL -- whichever exists) and
|        its run-health records, since the step started. -Execution: the step's execution (its replica's log name starts
|        with it); -WorkerJob: for a collection in parts, the worker job whose replicas do the work after the producer.
|        One row: Last (the newest of them), Console (how many LOG lines -- 0 means this install's console logs are not in
|        the workspace, so silence proves nothing). $null for a name that is not an execution / job name (never put into a query).
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Execution, [Parameter(Mandatory)][datetime]$StartedUtc, [AllowEmptyString()][string]$WorkerJob = '')
|    if ($Execution -notmatch '^[a-z0-9][a-z0-9\-]{0,126}$') { return $null }
|    if ($WorkerJob -and $WorkerJob -notmatch '^[a-z0-9][a-z0-9\-]{0,63}$') { return $null }
|    $from = $StartedUtc.ToUniversalTime().AddMinutes(-10).ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture)
|    $mine = if ($WorkerJob) { "(N startswith '{0}' or N startswith '{1}')" -f $Execution, $WorkerJob } else { "N startswith '{0}'" -f $Execution }
|    ("union isfuzzy=true " +
|     "(ContainerAppConsoleLogs | where TimeGenerated > datetime({0}) | extend N = tostring(column_ifexists('ContainerGroupName', '')) | where {1} | project TimeGenerated, K = 'log'), " +
|     "(ContainerAppConsoleLogs_CL | where TimeGenerated > datetime({0}) | extend N = tostring(column_ifexists('ContainerGroupName_s', '')) | where {1} | project TimeGenerated, K = 'log'), " +
|     "(SI_RunHealth_CL | where TimeGenerated > datetime({0}) | extend N = tostring(column_ifexists('Execution', '')) | where {1} and not(Engine startswith 'flow') | project TimeGenerated, K = 'health') " +
|     "| summarize Last = max(TimeGenerated), Console = countif(K == 'log')") -f $from, $mine
|}
|
|function New-SIJobFlowProgressProbe {
|    <#
|        The container flow's "is this step still doing anything?" probe: Probe($Job, $Execution, $StartedUtc) ->
|        @{ LastSeenUtc; Console } -- LastSeenUtc is when the step's job last wrote a console log line or a run-health record,
|        or $null when it CANNOT BE TOLD: no console log line of this execution is in the workspace at all (this install's
|        console logs do not go there, or they have not arrived yet), the query failed, or there is no workspace. Never
|        throws, never guesses: silence is only reported for a job that was heard before.
|        -PartsJobs: the engines collected in parts (their workers' log lines count for the step).
|        Seam (tests): -Query { param($Kql) } -> rows with Last / Console. Default: Log Analytics as the job's identity.
|    #>
|    param([string]$WorkspaceResourceId, [scriptblock]$Query, [string[]]$PartsJobs = @())
|    $parts = @{}; foreach ($p in @($PartsJobs)) { if ($p) { $parts[(Get-SIJobFlowKey (([string]$p) -replace '-(producer|worker)$', ''))] = $true } }
|    New-SIJobFlowSeams -Fields @{ Workspace = $WorkspaceResourceId; Query = $Query; Parts = $parts } -Methods @{
|        Probe = {
|            param($Job, $Execution, $StartedUtc)
|            $none = [pscustomobject]@{ LastSeenUtc = $null; Console = 0 }
|            if (-not ($this.Query -or $this.Workspace) -or -not $StartedUtc -or -not $Execution) { return $none }
|            try {
|                $k = Get-SIJobFlowKey ([string]$Job)
|                $worker = if ($this.Parts.ContainsKey($k)) { 'caj-si-{0}-worker' -f $k } else { '' }
|                $kql = Get-SIJobFlowProgressQuery -Execution ([string]$Execution) -StartedUtc ([datetime]$StartedUtc) -WorkerJob $worker
|                if (-not $kql) { return $none }
|                $r = @(if ($this.Query) { & $this.Query $kql } else { Invoke-SILogLaQuery -WorkspaceResourceId $this.Workspace -Query $kql }) | Where-Object { $_ }
|                $r = @($r)
|                if (-not $r.Count) { return $none }
|                $console = 0L; try { $console = [long]$r[0].Console } catch { $console = 0L }
|                if ($console -le 0 -or -not $r[0].Last) { return $none }
|                $last = if ($r[0].Last -is [datetime]) { $r[0].Last.ToUniversalTime() } else { [datetime]::Parse([string]$r[0].Last, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal) }
|                [pscustomobject]@{ LastSeenUtc = $last; Console = $console }
|            } catch { $none }
|        }
|    }
|}
|
|function Select-SIJobFlowStepLog {
|    <#
|        PURE. The run log of ONE failed step: of the transcript names (run-logs/<engine>/<engine>_<flavour>..._<stamp>.log, or
|        a VM's <engine>_<flavour>..._<stamp>.log), the LATEST one of that step's engine (-Engine, or the step key -Key; a
|        producer / worker log of it counts) stamped inside [-StartedUtc - 60 s, -EndedUtc + 60 s]. '' when there is none.
|    #>
|    param([AllowEmptyCollection()][string[]]$Names = @(), [string]$Engine, [string]$Key, [Parameter(Mandatory)][datetime]$StartedUtc, [Parameter(Mandatory)][datetime]$EndedUtc)
|    $a = $StartedUtc.ToUniversalTime().AddSeconds(-60); $b = $EndedUtc.ToUniversalTime().AddSeconds(60)
|    $want = @(@($Engine, $Key) | Where-Object { "$_".Trim() } | ForEach-Object { ([regex]::Replace("$_", '[^A-Za-z0-9\-]', '')).ToLowerInvariant() } | Select-Object -Unique)
|    $best = ''; $bestT = [datetime]::MinValue
|    foreach ($n in @($Names)) {
|        $leaf = ([string]$n -split '[\\/]')[-1]
|        if ($leaf -notmatch '_(\d{8}T\d{6}Z)\.log$') { continue }
|        $stamp = $Matches[1]
|        $eng = ($leaf -split '_')[0].ToLowerInvariant()
|        $ok = $false
|        foreach ($w in $want) { if ($eng -eq $w -or $eng -like "$w-producer" -or $eng -like "$w-worker") { $ok = $true } }
|        if (-not $ok) { continue }
|        $t = [datetime]::MinValue
|        if (-not [datetime]::TryParseExact($stamp, 'yyyyMMddTHHmmssZ', [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal, [ref]$t)) { continue }
|        if ($t -lt $a -or $t -gt $b) { continue }
|        if ($t -ge $bestT) { $best = [string]$n; $bestT = $t }
|    }
|    $best
|}
|
|function New-SIJobFlowStepLogReader {
|    <#
|        The failed step's own run log, for the pipeline's report (telemetry quality, owner 2026-10-10): Read($Job, $StartedUtc,
|        $EndedUtc) -> @{ Name; Lines } or $null. Container: the transcript the step's engine published to the install's
|        storage (sistaging/run-logs/<engine>/, -StorageAccount); VM: the launcher's transcript folder (-LogRoot). NEVER
|        throws. Seams (tests): -ListNames { param($Engine) } -> names, -ReadText { param($Name) } -> text.
|    #>
|    param([string]$StorageAccount, [string]$LogRoot, [scriptblock]$ListNames, [scriptblock]$ReadText, $Map)
|    if (-not $Map) { try { $Map = Get-SIJobFlowMap } catch { $Map = $null } }
|    $engines = @{}; if ($Map) { foreach ($k in @($Map.Jobs.Keys)) { if ($Map.Jobs[$k].Engine) { $engines[[string]$k] = [string]$Map.Jobs[$k].Engine } } }
|    New-SIJobFlowSeams -Fields @{ Account = $StorageAccount; LogRoot = $LogRoot; ListNames = $ListNames; ReadText = $ReadText; Engines = $engines } -Methods @{
|        Read = {
|            param($Job, $StartedUtc, $EndedUtc)
|            try {
|                if (-not $StartedUtc) { return $null }
|                $end = if ($EndedUtc) { [datetime]$EndedUtc } else { [datetime]::UtcNow }
|                $key = Get-SIJobFlowKey ([string]$Job)
|                $eng = if ($this.Engines.ContainsKey($key)) { $this.Engines[$key] } else { $key }
|                $names = @()
|                if ($this.ListNames) { $names = @(& $this.ListNames $eng) }
|                elseif ($this.Account) {
|                    foreach ($e in @($eng, $key) | Select-Object -Unique) {
|                        $names += @(Get-SIBlobList -Account $this.Account -Container 'sistaging' -Prefix ('run-logs/{0}' -f $e) | ForEach-Object { [string]$_.Name })
|                    }
|                } elseif ($this.LogRoot -and (Test-Path -LiteralPath $this.LogRoot)) {
|                    $names = @(Get-ChildItem -LiteralPath $this.LogRoot -Filter '*.log' -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName })
|                }
|                $pick = Select-SIJobFlowStepLog -Names $names -Engine $eng -Key $key -StartedUtc ([datetime]$StartedUtc) -EndedUtc $end
|                if (-not $pick) { return $null }
|                $text = ''
|                if ($this.ReadText) { $text = [string](& $this.ReadText $pick) }
|                elseif ($this.Account) {
|                    $bytes = [byte[]](Get-SIBlobContent -Account $this.Account -Container 'sistaging' -Blob $pick)
|                    $ms = New-Object System.IO.MemoryStream(, $bytes); try { $text = (New-Object System.IO.StreamReader($ms, $true)).ReadToEnd() } finally { $ms.Dispose() }
|                } else {
|                    $fs = New-Object System.IO.FileStream($pick, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::ReadWrite)
|                    try { $text = (New-Object System.IO.StreamReader($fs, $true)).ReadToEnd() } finally { $fs.Dispose() }
|                }
|                [pscustomobject]@{ Name = $pick; Lines = @($text -split "`r?`n") }
|            } catch { $null }
|        }
|    }
|}
|
|function Get-SIJobFlowStepFailure {
|    <#
|        PURE. What the pipeline reports for its failed step (owner 2026-10-10: "the report names the failed step and carries
|        THAT step's error class + lines, not the pipeline summary"): @{ Step (the step key); Text; ErrorClass }.
|        Text = the first error lines of the step's own run log (-LogLines, Get-SIErrorLines), else the step's recorded error
|        (a parts failure, the start ARM refused, a timeout ...). ErrorClass = Get-SIErrorClass of that text (the step's
|        recorded error too); a step Microsoft throttled is 'throttled', a step timeout with no better class platform-timeout.
|    #>
|    param([Parameter(Mandatory)]$Step, [AllowNull()][AllowEmptyCollection()][string[]]$LogLines)
|    $rec = "$($Step.Error)".Trim()
|    $log = if ($LogLines) { Get-SIErrorLines -Lines @($LogLines) } else { '' }
|    $text = if ($log) { $log } else { $rec }
|    $cls = if ($text) { Get-SIErrorClass -Message $text } else { 'unknown' }
|    if ($cls -eq 'unknown' -and $rec -and $rec -ne $text) { $cls = Get-SIErrorClass -Message $rec }
|    switch ([string]$Step.ErrorClass) {
|        'throttled' { $cls = 'throttled' }
|        'timeout' { if ($cls -eq 'unknown') { $cls = 'platform-timeout' } }
|        default {
|            # 3.0.30: the step close already named the step by its own run log's last ERROR line (Get-SIJobFlowLogErrorClass)
|            if ($cls -eq 'unknown' -and [string]$Step.ErrorClass -and [string]$Step.ErrorClass -ne 'unknown' -and @(Get-SIErrorClasses) -contains [string]$Step.ErrorClass) { $cls = [string]$Step.ErrorClass }
|        }
|    }
|    if (-not $text) { $text = ('the step {0} ended {1}' -f (Get-SIJobFlowKey ([string]$Step.Job)), ([string]$Step.State).ToLowerInvariant()) }
|    [pscustomobject]@{ Step = (Get-SIJobFlowKey ([string]$Step.Job)); Text = $text; ErrorClass = $cls }
|}
|
|function Get-SIJobFlowLogErrorClass {
|    <#
|        PURE. 3.0.30 (a read-only triage of production alerts: a failed step whose engine wrote its run log was reported
|        "unknown"). The error a failed step's OWN run log names: its LAST ERROR line ("[ERROR] ...", "ERROR: ...", a
|        Write-Error line) -- else, with no ERROR line, the block that ended the run (Get-SIErrorLines) -- classified by
|        Get-SIErrorClass. @{ Line (that line, '' none); ErrorClass ('' when the log does not tell: no line, 'unknown', or a
|        class that would read as a stop on purpose -- 'stopped' / 'cancelled' are never derived from a log) }.
|    #>
|    param([AllowNull()][AllowEmptyCollection()][string[]]$Lines = @())
|    $last = ''
|    foreach ($raw in @($Lines)) {
|        $l = ([string]$raw).Trim()
|        # "[ERROR]" in any case; a bare ERROR only in capitals ("no error found" is not one)
|        if ($l -and ($l -match '(?i)\[ERROR\]|^Write-Error:' -or $l -cmatch '^(\S+\s+){0,3}ERROR[:\s]')) { $last = $l }
|    }
|    $text = $last
|    if (-not $text) { $text = Get-SIErrorLines -Lines @($Lines) -Max 1 }
|    $text = ([string]$text -split "`r?`n")[0].Trim()
|    $cls = ''
|    if ($text) { try { $cls = [string](Get-SIErrorClass -Message $text) } catch { $cls = '' } }
|    if ($cls -in @('unknown', 'stopped', 'cancelled')) { $cls = '' }
|    if ($text.Length -gt 500) { $text = $text.Substring(0, 497) + '...' }
|    [pscustomobject]@{ Line = $text; ErrorClass = $cls }
|}
|
|function Get-SIJobFlowStepCauseText {
|    <#
|        PURE. #850 (live 2026-10-21: a step ran out of memory and its run record said only "the execution ended failed" --
|        the cause was in its log alone). The step's recorded error with the cause its own run log gives (the first error
|        line: an out-of-memory, a timeout ...), so run health and Operations > Jobs say WHY. No cause = the recorded error
|        unchanged; a recorded error that already carries the cause is unchanged. At most 1000 characters (the column).
|    #>
|    param([AllowEmptyString()][string]$Recorded = '', [AllowEmptyString()][string]$Cause = '')
|    $rec = [string]$Recorded
|    $c = ''
|    foreach ($line in ([string]$Cause).Split([char[]]@("`r", "`n"))) { if (-not [string]::IsNullOrWhiteSpace($line)) { $c = $line.Trim(); break } }
|    if (-not $c -or $rec.Contains($c)) { return $rec }
|    $t = if ($rec) { '{0}: {1}' -f $rec.TrimEnd([char[]]@('.', ' ')), $c } else { $c }
|    if ($t.Length -gt 1000) { $t = $t.Substring(0, 997) + '...' }
|    $t
|}
|
|function Get-SIJobFlowRetryText {
|    <# PURE. The customer words for a step that was started again / that did not start (the log, the step record, the mail). #>
|    param([Parameter(Mandatory)][ValidateSet('retried', 'gave-up')][string]$Kind, [string]$Execution, [int]$Attempts = 1)
|    if ($Kind -eq 'retried') { return ("the step's container did not start (an Azure platform problem); it was started again{0}" -f $(if ($Execution) { " (the failed execution: $Execution)" } else { '' })) }
|    "the step's container did not start (an Azure platform problem), also not when it was started again ($Attempts attempts) -- see the job's executions in Operations > Jobs"
|}
|
|function Get-SIJobFlowOverdueText {
|    <#
|        PURE. The plain words for a step that has run longer than its step timeout (the log and the step record). The
|        pipeline REPORTS it and stops nothing (owner 2026-10-13: no give-up on elapsed time). The step record carries
|        this sentence (RetryReason); "longer than its step timeout" is what says it was reported already.
|    #>
|    param([Parameter(Mandatory)][string]$Job, [int]$RunMinutes, [int]$TimeoutMinutes)
|    '{0} has run for {1} minutes, longer than its step timeout of {2} minutes. It keeps running: the pipeline stops no step for the time it takes. A step that stands still is reported when it shows no sign of progress.' -f $Job, $RunMinutes, $TimeoutMinutes
|}
|
|# =====================================================================================================================
|#  A RUN OR STEP MUCH LONGER THAN USUAL FOR THIS INSTALL -- PURE (si-flow-1203, 2026-10-26: four large installs had a run
|#  going for ~79 h -- a data sync ~45 h, a correlation ~65 h -- and it looked "Running" and healthy; nobody was told).
|#  WARNING ONLY: nothing is stopped, nothing is held, no cap (owner: warn on suspicion, never block). One rule for the
|#  runner's own log / step record and for the heartbeat's Warnings.
|# =====================================================================================================================
|function Get-SIPipelineLongRunRule {
|    <#
|        PURE. The rule: a run (step) warns once it has run longer than max(Factor x usual, usual + ExtraMinutes). Usual =
|        the MEDIAN of the install's own measured lengths among the newest RunsRead run records -- full runs that succeeded
|        (scope pipeline, not from a step) for a run; that job's successful steps (any run) for a step. With fewer than
|        MinHistory measured lengths there is no usual: the plain floor applies (RunFloorMinutes / StepFloorMinutes).
|    #>
|    @{ Factor = 2.0; ExtraMinutes = 120; MinHistory = 3; RunFloorMinutes = 1440; StepFloorMinutes = 720; RunsRead = 10 }
|}
|
|function ConvertTo-SIPipelineLongRunTime {
|    <# PURE. A time as UTC [datetime], or $null (null, DBNull, '' or not a time). #>
|    param($Value)
|    if ($null -eq $Value -or $Value -is [DBNull] -or "$Value".Trim() -eq '') { return $null }
|    if ($Value -is [datetime]) { return $(if ($Value.Kind -eq [DateTimeKind]::Unspecified) { [datetime]::SpecifyKind($Value, [DateTimeKind]::Utc) } else { $Value.ToUniversalTime() }) }
|    if ($Value -is [DateTimeOffset]) { return $Value.UtcDateTime }
|    $d = [datetime]::MinValue
|    if ([datetime]::TryParse([string]$Value, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal, [ref]$d)) { return $d }
|    $null
|}
|
|function Get-SIPipelineMedian {
|    <# PURE. The median of -Values (the mean of the middle two for an even count), or $null for none. #>
|    param([double[]]$Values = @())
|    $v = @(@($Values) | Sort-Object)
|    if (-not $v.Count) { return $null }
|    $m = [int][Math]::Floor($v.Count / 2)
|    if ($v.Count % 2) { return [double]$v[$m] }
|    ([double]$v[$m - 1] + [double]$v[$m]) / 2
|}
|
|function Get-SIPipelineUsualMinutes {
|    <#
|        PURE. How long a run and each step USUALLY take on this install. -Runs { FlowRunId, State, Scope, FromStep,
|        StartedUtc, EndedUtc }, -Steps { FlowRunId, Job, State, StartedUtc, EndedUtc } (the newest run records read and
|        their steps); -ExcludeRunId = the run going on (never its own steps). Answers @{ RunMinutes; RunCount; Steps =
|        @{ <job key> = @{ Minutes; Count } } } -- Minutes $null where fewer than MinHistory lengths were measured.
|    #>
|    param([object[]]$Runs = @(), [object[]]$Steps = @(), [AllowEmptyString()][string]$ExcludeRunId = '')
|    $rule = Get-SIPipelineLongRunRule
|    $len = { param($a, $b) $x = ConvertTo-SIPipelineLongRunTime $a; $y = ConvertTo-SIPipelineLongRunTime $b; if ($null -eq $x -or $null -eq $y -or $y -lt $x) { $null } else { ($y - $x).TotalMinutes } }
|    $others = @(@($Runs) | Where-Object { $_ -and [string]$_.FlowRunId -and [string]$_.FlowRunId -ne $ExcludeRunId } |
|                Sort-Object { ConvertTo-SIPipelineLongRunTime $_.StartedUtc } -Descending | Select-Object -First ([int]$rule.RunsRead))
|    $runLens = New-Object System.Collections.Generic.List[double]
|    foreach ($r in $others) {
|        $scope = if ($r.PSObject.Properties['Scope']) { [string]$r.Scope } else { '' }
|        $from = if ($r.PSObject.Properties['FromStep'] -and -not ($r.FromStep -is [DBNull])) { [string]$r.FromStep } else { '' }
|        if ([string]$r.State -ne 'Succeeded' -or ($scope -and $scope -ne 'pipeline') -or $from.Trim()) { continue }
|        $m = & $len $r.StartedUtc $r.EndedUtc
|        if ($null -ne $m) { $runLens.Add([double]$m) }
|    }
|    $ids = @{}; foreach ($r in $others) { $ids[[string]$r.FlowRunId] = $true }
|    $byJob = @{}
|    foreach ($s in @(@($Steps) | Where-Object { $_ -and $ids.ContainsKey([string]$_.FlowRunId) -and [string]$_.State -eq 'Success' })) {
|        $k = Get-SIJobFlowKey ([string]$s.Job); if (-not $k) { continue }
|        $m = & $len $s.StartedUtc $s.EndedUtc
|        if ($null -eq $m) { continue }
|        if (-not $byJob.ContainsKey($k)) { $byJob[$k] = New-Object System.Collections.Generic.List[double] }
|        $byJob[$k].Add([double]$m)
|    }
|    $stepOut = @{}
|    foreach ($k in $byJob.Keys) {
|        $l = $byJob[$k]
|        $stepOut[$k] = @{ Minutes = $(if ($l.Count -ge [int]$rule.MinHistory) { Get-SIPipelineMedian -Values $l.ToArray() } else { $null }); Count = $l.Count }
|    }
|    @{ RunMinutes = $(if ($runLens.Count -ge [int]$rule.MinHistory) { Get-SIPipelineMedian -Values $runLens.ToArray() } else { $null }); RunCount = $runLens.Count; Steps = $stepOut }
|}
|
|function Get-SIPipelineLongRunThreshold {
|    <# PURE. The minutes after which a run (-Kind run) or step (-Kind step) warns: from -UsualMinutes, else the floor. #>
|    param([AllowNull()]$UsualMinutes, [ValidateSet('run', 'step')][string]$Kind = 'run')
|    $rule = Get-SIPipelineLongRunRule
|    if ($null -eq $UsualMinutes) {
|        return @{ Minutes = [double]$(if ($Kind -eq 'run') { $rule.RunFloorMinutes } else { $rule.StepFloorMinutes }); Basis = 'floor'; UsualMinutes = $null }
|    }
|    $u = [double]$UsualMinutes
|    @{ Minutes = [Math]::Max($u * [double]$rule.Factor, $u + [double]$rule.ExtraMinutes); Basis = 'history'; UsualMinutes = $u }
|}
|
|function Get-SIPipelineLongRun {
|    <#
|        PURE. What of the run going on has run much longer than usual. -Run { FlowRunId, State, StartedUtc } (the newest
|        run), -Steps = ITS steps { Job, Order, State, StartedUtc }, -Usual = Get-SIPipelineUsualMinutes (over the OTHER
|        runs), -NowUtc. A run that is not Running answers nothing. One entry per finding:
|        { Kind run | step; RunId; Step (job key, '' for the run); Order; StartedUtc; AgeMinutes; UsualMinutes ($null = no
|        history); ThresholdMinutes; Basis history | floor; History (the measured lengths behind usual); CrossedUtc (when
|        it crossed the threshold) } -- the run first, then the steps by order.
|    #>
|    param($Run, [object[]]$Steps = @(), $Usual, [Parameter(Mandatory)][datetime]$NowUtc)
|    if (-not $Run -or [string]$Run.State -ne 'Running') { return }
|    $now = $NowUtc.ToUniversalTime()
|    if (-not $Usual) { $Usual = @{ RunMinutes = $null; RunCount = 0; Steps = @{} } }
|    $mk = {
|        param($kind, $step, $order, $start, $th, $hist)
|        $age = ($now - $start).TotalMinutes
|        if ($age -le [double]$th.Minutes) { return }
|        [pscustomobject]@{ Kind = $kind; RunId = [string]$Run.FlowRunId; Step = $step; Order = $order; StartedUtc = $start; AgeMinutes = [long][Math]::Floor($age)
|                           UsualMinutes = $(if ($null -ne $th.UsualMinutes) { [long][Math]::Round([double]$th.UsualMinutes) } else { $null })
|                           ThresholdMinutes = [long][Math]::Ceiling([double]$th.Minutes); Basis = $th.Basis; History = [int]$hist; CrossedUtc = $start.AddMinutes([double]$th.Minutes) }
|    }
|    $rs = ConvertTo-SIPipelineLongRunTime $Run.StartedUtc
|    if ($null -ne $rs) { & $mk 'run' '' $null $rs (Get-SIPipelineLongRunThreshold -UsualMinutes $Usual.RunMinutes -Kind run) ([int]$Usual.RunCount) }
|    foreach ($s in @(@($Steps) | Where-Object { $_ -and [string]$_.State -in @('Running', 'Starting') } | Sort-Object { [int]$_.Order })) {
|        $ss = ConvertTo-SIPipelineLongRunTime $s.StartedUtc; if ($null -eq $ss) { continue }
|        $k = Get-SIJobFlowKey ([string]$s.Job); if (-not $k) { continue }
|        $u = if ($Usual.Steps -and $Usual.Steps.ContainsKey($k)) { $Usual.Steps[$k] } else { @{ Minutes = $null; Count = 0 } }
|        & $mk 'step' $k ([int]$s.Order) $ss (Get-SIPipelineLongRunThreshold -UsualMinutes $u.Minutes -Kind step) ([int]$u.Count)
|    }
|}
|
|function Get-SIPipelineLongRunText {
|    <#
|        PURE. The plain words for one finding of Get-SIPipelineLongRun (the runner's log, the step record's RetryReason, the
|        run's note). "much longer than usual" is the mark that says it was reported already.
|    #>
|    param([Parameter(Mandatory)]$Finding)
|    $h = { param($m) ('{0} h' -f ([double]$m / 60).ToString('0.#', [Globalization.CultureInfo]::InvariantCulture)) }
|    $what = if ($Finding.Kind -eq 'run') { 'pipeline run {0}' -f $Finding.RunId } else { 'step {0} of run {1}' -f $Finding.Step, $Finding.RunId }
|    $usual = if ($Finding.Basis -eq 'history') {
|        'usually {0} on this install (the median of its last {1} measured {2}); it warns after {3}' -f (& $h $Finding.UsualMinutes), $Finding.History, $(if ($Finding.Kind -eq 'run') { 'complete runs' } else { 'runs of this step' }), (& $h $Finding.ThresholdMinutes)
|    } else {
|        'this install has fewer than {0} measured {1}, so the plain floor of {2} applies' -f (Get-SIPipelineLongRunRule).MinHistory, $(if ($Finding.Kind -eq 'run') { 'complete runs' } else { 'runs of this step' }), (& $h $Finding.ThresholdMinutes)
|    }
|    '{0} has run for {1}, much longer than usual ({2}). Warning only: nothing is stopped, the run goes on. Look at it on Operations > Jobs (si-flow-1203).' -f $what, (& $h $Finding.AgeMinutes), $usual
|}
|
|# =====================================================================================================================
|#  A STEP THAT RUNS FAR PAST ITS LAST TIME WITH NO PROGRESS -- PURE (si-flow-1204, owner 2026-10-29: "a stuck step is seen
|#  after days, not hours" -- a correlation ran 55 h and two data syncs 35 h+ before anyone acted). WARNING ONLY: nothing is
|#  stopped, nothing is held. One rule for the runner's log / step record and for the heartbeat (Warnings + Pipeline.stalledSteps).
|# =====================================================================================================================
|function Get-SIPipelineStallRule {
|    <#
|        PURE. A running step is "stuck" when BOTH hold:
|          * it has run longer than max(Factor x its last run's time, its last run's time + ExtraMinutes) -- its last run's time =
|            the job's newest successful step among the OTHER runs read; none known: NoTimeMinutes;
|          * it shows no progress for QuietMinutes: its newest sign of progress (cfg.StepProgress / cfg.StepPhaseTime since it
|            started) is older than that -- or, for a step that leaves no such sign, the runner's log check already found no
|            sign of progress (its record says "no sign of progress").
|    #>
|    @{ Factor = 2.0; ExtraMinutes = 60; NoTimeMinutes = 360; QuietMinutes = 60 }
|}
|
|function Get-SIPipelineLastStepMinutes {
|    <# PURE. Job key -> the minutes its newest SUCCESSFUL step took among -Steps { FlowRunId, Job, State, StartedUtc, EndedUtc }
|       of the runs other than -ExcludeRunId (the run going on). A job that never succeeded in them has no entry. #>
|    param([object[]]$Steps = @(), [AllowEmptyString()][string]$ExcludeRunId = '')
|    $out = @{}; $at = @{}
|    foreach ($s in @(@($Steps) | Where-Object { $_ -and [string]$_.State -eq 'Success' -and [string]$_.FlowRunId -ne $ExcludeRunId })) {
|        $k = Get-SIJobFlowKey ([string]$s.Job); if (-not $k) { continue }
|        $a = ConvertTo-SIPipelineLongRunTime $s.StartedUtc; $b = ConvertTo-SIPipelineLongRunTime $s.EndedUtc
|        if ($null -eq $a -or $null -eq $b -or $b -lt $a) { continue }
|        if ($at.ContainsKey($k) -and $at[$k] -ge $a) { continue }
|        $at[$k] = $a; $out[$k] = ($b - $a).TotalMinutes
|    }
|    $out
|}
|
|function Get-SIPipelineStallThreshold {
|    <# PURE. The minutes after which a running step may be called stuck: from -LastMinutes (its last run's time), else the rule. #>
|    param([AllowNull()]$LastMinutes)
|    $r = Get-SIPipelineStallRule
|    if ($null -eq $LastMinutes) { return @{ Minutes = [double]$r.NoTimeMinutes; Basis = 'rule'; LastMinutes = $null } }
|    $l = [double]$LastMinutes
|    @{ Minutes = [Math]::Max($l * [double]$r.Factor, $l + [double]$r.ExtraMinutes); Basis = 'last'; LastMinutes = $l }
|}
|
|function Get-SIPipelineStalledSteps {
|    <#
|        PURE. The running steps that are stuck (Get-SIPipelineStallRule). -Steps: the run's steps { Job, Order, State,
|        StartedUtc, LastProgressUtc ($null = no sign of progress recorded since it started), Silent (the runner's log check
|        found no sign of progress) }; -LastMinutes: Get-SIPipelineLastStepMinutes; -NowUtc. One entry per stuck step, by
|        order: { Step (job key); Order; StartedUtc; AgeMinutes; LastMinutes ($null = not known); ThresholdMinutes; Basis
|        last | rule; LastProgressUtc; SinceUtc (when it became stuck) }. A step with recent progress, or still inside its
|        time, is never said.
|    #>
|    param([object[]]$Steps = @(), [hashtable]$LastMinutes = @{}, [Parameter(Mandatory)][datetime]$NowUtc)
|    $r = Get-SIPipelineStallRule
|    $now = $NowUtc.ToUniversalTime()
|    foreach ($s in @(@($Steps) | Where-Object { $_ -and [string]$_.State -in @('Running', 'Starting') } | Sort-Object { [int]$_.Order })) {
|        $start = ConvertTo-SIPipelineLongRunTime $s.StartedUtc; if ($null -eq $start) { continue }
|        $k = Get-SIJobFlowKey ([string]$s.Job); if (-not $k) { continue }
|        $th = Get-SIPipelineStallThreshold -LastMinutes $(if ($LastMinutes.ContainsKey($k)) { $LastMinutes[$k] } else { $null })
|        $age = ($now - $start).TotalMinutes
|        if ($age -le [double]$th.Minutes) { continue }
|        $prog = if ($s.PSObject.Properties['LastProgressUtc']) { ConvertTo-SIPipelineLongRunTime $s.LastProgressUtc } else { $null }
|        $silent = [bool]($s.PSObject.Properties['Silent'] -and $s.Silent)
|        $crossed = $start.AddMinutes([double]$th.Minutes)
|        if ($null -ne $prog) {
|            if (($now - $prog).TotalMinutes -lt [double]$r.QuietMinutes) { continue }
|            $quietFrom = $prog.AddMinutes([double]$r.QuietMinutes)
|        } elseif ($silent) {
|            $quietFrom = $crossed
|        } else { continue }
|        [pscustomobject]@{ Step = $k; Order = [int]$s.Order; StartedUtc = $start; AgeMinutes = [long][Math]::Floor($age)
|                           LastMinutes = $(if ($null -ne $th.LastMinutes) { [long][Math]::Round([double]$th.LastMinutes) } else { $null })
|                           ThresholdMinutes = [long][Math]::Ceiling([double]$th.Minutes); Basis = $th.Basis; LastProgressUtc = $prog
|                           SinceUtc = $(if ($quietFrom -gt $crossed) { $quietFrom } else { $crossed }) }
|    }
|}
|
|function Get-SIPipelineStalledText {
|    <# PURE. The plain words for one entry of Get-SIPipelineStalledSteps (the runner's log and the step record). "shows no
|       progress" is the mark that says it was reported already. #>
|    param([Parameter(Mandatory)]$Finding)
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $h = { param($m) ('{0} h' -f ([double]$m / 60).ToString('0.#', $inv)) }
|    $basis = if ($Finding.Basis -eq 'last') { 'its last run here took {0}' -f (& $h $Finding.LastMinutes) } else { 'its last run''s time is not known here, so the rule of {0} applies' -f (& $h $Finding.ThresholdMinutes) }
|    $quiet = if ($Finding.LastProgressUtc) { 'its last sign of progress was at {0} UTC' -f ([datetime]$Finding.LastProgressUtc).ToString('yyyy-MM-dd HH:mm', $inv) } else { 'it has written no sign of progress' }
|    'step {0} has run for {1}, far past its usual time ({2}), and shows no progress: {3}. Warning only: nothing is stopped, the run goes on. Look at it on Operations > Jobs (si-flow-1204).' -f $Finding.Step, (& $h $Finding.AgeMinutes), $basis, $quiet
|}
|
|function Test-SIJobFlowExecutionAtLimit {
|    <#
|        PURE. Did this execution (ARM: name, properties.status / startTime / endTime) END AT ITS JOB'S OWN RUN LIMIT? It
|        ended without succeeding, and it ran for the whole limit (-LimitSeconds, less 2 % or 2 minutes -- the same rule the
|        update's job sizing uses). -SinceUtc: only an execution that started at or after it (less 5 minutes) counts.
|        A run that was killed earlier (out of memory) or failed by itself is NOT at its limit: a longer limit does not help it.
|    #>
|    param($Execution, [int]$LimitSeconds, $SinceUtc)
|    if (-not $Execution -or $LimitSeconds -le 0) { return $false }
|    $props = if ($Execution.PSObject.Properties['properties'] -and $Execution.properties) { $Execution.properties } else { $Execution }
|    $p = { param($n) $pp = $props.PSObject.Properties[$n]; if ($pp) { $pp.Value } else { $null } }
|    $status = [string](& $p 'status')
|    if ($status -notmatch '^(?i)(failed|stopped|degraded|cancelled|canceled)$') { return $false }
|    $t = { param($v) if ($null -eq $v -or "$v" -eq '') { $null } elseif ($v -is [datetime]) { $v.ToUniversalTime() } else { [datetime]::Parse([string]$v, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal) } }
|    $start = $null; $end = $null
|    try { $start = & $t (& $p 'startTime'); $end = & $t (& $p 'endTime') } catch { return $false }
|    if (-not $start -or -not $end) { return $false }
|    if ($SinceUtc -and $start -lt ([datetime]$SinceUtc).ToUniversalTime().AddMinutes(-5)) { return $false }
|    [bool](($end - $start).TotalSeconds -ge ($LimitSeconds - [Math]::Max(120, $LimitSeconds * 0.02)))
|}
|
|function Select-SIJobFlowRunningExecution {
|    <#
|        PURE. Of a job's executions (Azure's list), the one that is running NOW (Running / Processing) -- the one that
|        started first when there are several. @{ Execution; StartedUtc ($null when Azure does not say) }, or $null when
|        none is running. The pipeline follows it as the step's run instead of starting a second one beside it.
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Executions = @())
|    $live = @(@($Executions) | Where-Object { $_ -and [string]$_.name -and $_.properties -and ([string]$_.properties.status) -in @('Running', 'Processing') } |
|              Sort-Object { if ($_.properties.startTime) { ([datetime]$_.properties.startTime).ToUniversalTime() } else { [datetime]::MaxValue } })
|    if (-not $live.Count) { return $null }
|    $started = $null
|    if ($live[0].properties.startTime) { try { $started = ([datetime]$live[0].properties.startTime).ToUniversalTime() } catch { $started = $null } }
|    [pscustomobject]@{ Execution = [string]$live[0].name; StartedUtc = $started }
|}
|
|function Get-SIJobFlowExecutionStatusOf {
|    <#
|        PURE (#945). The status Azure's execution LIST gives one execution (-Execution, by name), or '' when it is not in the
|        list. The fallback when the single-execution read fails (live 2026-10-28/29, a customer install: the step's execution had ended
|        Failed, the runner's read of it never answered, and the step stayed "running" for days).
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Executions = @(), [AllowEmptyString()][string]$Execution)
|    if (-not "$Execution".Trim()) { return '' }
|    $hit = @(@($Executions) | Where-Object { $_ -and [string]$_.name -eq $Execution -and $_.PSObject.Properties['properties'] -and $_.properties })[0]
|    if (-not $hit) { return '' }
|    [string]$hit.properties.status
|}
|
|function Get-SIJobFlowEndedExecutionCloses {
|    <#
|        PURE (#945, owner 2026-10-29). THE WAKE-UP CHECK: which open steps of the run -State have an execution that Azure says
|        has ENDED, while the step's record still says Running? Asked on EVERY wake-up of the pipeline runner -- also the ones
|        that find the install busy -- so a run whose runner never noticed the end (a customer install, 28 Oct: Failed at 03:09Z, still
|        "running" on 29 Oct) is closed and goes on by the normal rules (a failed step's dependants are skipped, the run ends).
|        -ExecutionsByJob: step key -> that job's execution list (ARM shape); a key that is missing or $null = the list could
|        not be read -> nothing is closed for it. -PartsJobs: the step keys collected in parts (their list is the PRODUCER's;
|        a producer that SUCCEEDED does not end the step -- its parts do -- so only Failed / Stopped close it).
|        CLOSES ONLY: a step that is Running, with a recorded execution (never a VM process 'pid@...'), found BY NAME in the
|        list, with an ended status (Succeeded / Failed / Degraded / Cancelled / Stopped) AND an end time at least
|        -GraceMinutes ago (20: longer than a working runner needs -- it polls every 30 s, and its pause before judging a
|        failure is at most 15 minutes). Running / Processing / not in the list / no end time = nothing. A run that has ended:
|        nothing. Never stops anything. Returns @(@{ Order; Job; Execution; Status; State; ErrorClass; Error; EndedUtc }).
|    #>
|    param($State, [hashtable]$ExecutionsByJob = @{}, [Parameter(Mandatory)][datetime]$NowUtc, [int]$GraceMinutes = 20, [hashtable]$PartsJobs = @{})
|    $out = New-Object System.Collections.Generic.List[object]
|    if (-not $State -or [string]$State.State -in $script:SIJobFlow.RunFinished) { return @() }
|    $now = $NowUtc.ToUniversalTime()
|    foreach ($st in @($State.Steps)) {
|        if (-not $st -or [string]$st.State -ne 'Running') { continue }
|        $ex = [string]$st.Execution
|        if (-not $ex.Trim() -or $ex.Contains('@')) { continue }
|        $k = Get-SIJobFlowKey ([string]$st.Job)
|        if (-not $ExecutionsByJob.ContainsKey($k) -or $null -eq $ExecutionsByJob[$k]) { continue }
|        $hit = @(@($ExecutionsByJob[$k]) | Where-Object { $_ -and [string]$_.name -eq $ex -and $_.PSObject.Properties['properties'] -and $_.properties })[0]
|        if (-not $hit) { continue }
|        $p = $hit.properties
|        $status = [string]$p.status
|        if ($status -notmatch '^(?i)(succeeded|failed|degraded|cancelled|canceled|stopped)$') { continue }
|        $end = $null
|        try { if ($p.PSObject.Properties['endTime'] -and "$($p.endTime)".Trim()) { $end = [datetime]::Parse([string]$p.endTime, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal) } } catch { $end = $null }
|        if (-not $end -or ($now - $end).TotalMinutes -lt $GraceMinutes) { continue }
|        $parts = $PartsJobs.ContainsKey($k) -and [bool]$PartsJobs[$k]
|        $noticed = 'noticed by the pipeline''s wake-up at {0:yyyy-MM-dd HH:mm}Z (its runner had not closed the step)' -f $now
|        $endText = '{0:yyyy-MM-dd HH:mm}Z' -f $end
|        $s = $null; $cls = ''; $err = ''
|        switch -Regex ($status) {
|            '^(?i)succeeded$' {
|                if ($parts) { break }
|                $s = 'Success'; $cls = ''; $err = ''
|            }
|            '^(?i)stopped$' {
|                $s = 'Interrupted'; $cls = 'stopped'
|                $err = '{0} -- the execution ended stopped at {1}; {2}' -f (Get-SIJobFlowStoppedText -Job ([string]$st.Job)), $endText, $noticed
|            }
|            default {
|                $s = 'Failed'; $cls = 'job-failed'
|                $err = 'the execution ended {0} at {1}; {2}' -f $status.ToLowerInvariant(), $endText, $noticed
|            }
|        }
|        if (-not $s) { continue }
|        $out.Add([pscustomobject]@{ Order = [int]$st.Order; Job = [string]$st.Job; Execution = $ex; Status = $status; State = $s; ErrorClass = $cls; Error = $err; EndedUtc = $end })
|    }
|    $out.ToArray()
|}
|
|function Set-SIJobFlowStepClosed {
|    <# PURE (#945). The file / blob stores' close of one step in the run record -State: only when it is run -FlowRunId, the
|       run has not ended, and the step (-Close.Order) is Running with -Close.Execution. Changes -State in place; $true when
|       the step was closed. #>
|    param($State, [string]$FlowRunId, [Parameter(Mandatory)]$Close)
|    if (-not $State -or [string]$State.FlowRunId -ne $FlowRunId -or [string]$State.State -in $script:SIJobFlow.RunFinished) { return $false }
|    $st = @($State.Steps | Where-Object { $_ -and [int]$_.Order -eq [int]$Close.Order })[0]
|    if (-not $st -or [string]$st.State -ne 'Running' -or [string]$st.Execution -ne [string]$Close.Execution) { return $false }
|    $st.State = [string]$Close.State; $st.ErrorClass = [string]$Close.ErrorClass; $st.Error = [string]$Close.Error; $st.EndedUtc = ([datetime]$Close.EndedUtc).ToUniversalTime()
|    $true
|}
|
|function Get-SIJobFlowSaveJson {
|    <# PURE (#945). The JSON the file / blob store writes for -State: as it is, except a step the STORED record (-Stored, the
|       same run) already ended (Success / Failed / Interrupted / TimedOut) with the SAME execution, which -State still says is
|       Running -- that step is written as stored (a runner that never saw the wake-up check's close does not reopen it; it
|       takes the close over at its next poll). A step started again (a new execution, or Starting) is written as it is.
|       -State itself is never changed. #>
|    param([Parameter(Mandatory)]$State, $Stored)
|    $json = ConvertTo-SIJobFlowRunJson -State $State
|    if (-not $Stored -or [string]$Stored.FlowRunId -ne [string]$State.FlowRunId) { return $json }
|    $keep = @{}
|    foreach ($st in @($State.Steps)) {
|        if (-not $st -or [string]$st.State -ne 'Running' -or -not [string]$st.Execution) { continue }
|        $was = @($Stored.Steps | Where-Object { $_ -and [int]$_.Order -eq [int]$st.Order })[0]
|        if ($was -and [string]$was.Execution -eq [string]$st.Execution -and [string]$was.State -in @('Success', 'Failed', 'Interrupted', 'TimedOut')) { $keep[[int]$st.Order] = $was }
|    }
|    if (-not $keep.Count) { return $json }
|    $copy = ConvertFrom-SIJobFlowRunJson -Json $json
|    foreach ($st in @($copy.Steps)) {
|        if (-not $st -or -not $keep.ContainsKey([int]$st.Order)) { continue }
|        $w = $keep[[int]$st.Order]
|        $st.State = [string]$w.State; $st.ErrorClass = [string]$w.ErrorClass; $st.Error = [string]$w.Error; $st.EndedUtc = $w.EndedUtc
|    }
|    ConvertTo-SIJobFlowRunJson -State $copy
|}
|
|function Get-SIJobFlowStepRowOf {
|    <# PURE (#945). One step of the stored run record (or $null when the record is another run). #>
|    param($State, [string]$FlowRunId, [int]$Order)
|    if (-not $State -or [string]$State.FlowRunId -ne $FlowRunId) { return $null }
|    @($State.Steps | Where-Object { $_ -and [int]$_.Order -eq $Order })[0]
|}
|
|function Get-SIJobFlowHoursText {
|    <# PURE. Seconds as hours for a plain line: 14400 -> '4 h', 5400 -> '1.5 h'. #>
|    param([int]$Seconds)
|    '{0} h' -f ([double]$Seconds / 3600).ToString('0.#', [Globalization.CultureInfo]::InvariantCulture)
|}
|
|function Invoke-SIJobFlow {
|    <#
|        Run (or resume) one flow run. Pure over its seams:
|          -Start  { param($Job) }            -> the execution name (throws when it cannot start)
|          -Poll   { param($Job, $Execution) } -> the execution status: Running | Processing | Succeeded | Failed | Stopped | Degraded
|          -Stop   { param($Job, $Execution) } (optional) -- a timed-out execution is asked to stop
|          -JobLimit { param($Job) } (optional; the container flow: the seams' Limit) -> the job's OWN run limit in minutes
|                  (its replica timeout), 0 = not known. THE PIPELINE NEVER CUTS A STEP BEFORE ITS JOB WOULD END BY ITSELF:
|                  a step's limit is the LARGER of its configured timeout and its job's run limit (plus 5 minutes, so the
|                  job ends first), and the log says which one applies. A limit that cannot be read is asked for again on
|                  the next poll; until it answers, and without the seam (the VM flow), the configured timeout applies.
|          SELF-HEALING IN THE SAME RUN (owner 2026-10-12: "si must self heal with limits"): a step whose job was stopped AT
|          ITS OWN RUN LIMIT is not left for the next update and the next day's run. With both seams below:
|          -LimitHit { param($Job, $Execution, $SinceUtc) } (the container flow: the seams' LimitHit) -> $null, or
|                  @{ JobName; LimitSeconds; Execution } = the job (the step's own, or the producer / a worker of a
|                  collection in parts) whose execution ended at its limit;
|          -RaiseLimit { param($Hit) } -> @{ Restart; NewSeconds; Why } -- raises that job's run limit by the SAME rule and
|                  code as the update's job sizing (setup/_shared/SI-JobSizing.ps1, Invoke-SIJobRunLimitHeal);
|          the step is then STARTED AGAIN ONCE in this run (any kind of step: a collection, the CI build, a delivery), and
|          the steps after it run when it succeeds. Never a second time for the same step in one run: stopped at its limit
|          again, or the limit could not be raised (the customer's own run limit, no right to change the job, already at
|          the longest limit Azure takes), the step fails as before with the reason in plain words. A run killed for memory is never at its limit.
|          A JOB THAT IS ALREADY RUNNING IS NOT STARTED AGAIN (owner 2026-10-12: "we cannot have 2 builds running at the
|          same time"): -Running { param($Job) } (the container flow: the seams' Running) -> $null, or @{ Execution;
|                  StartedUtc } = an execution of the step's job that is running now (somebody ran the job by hand, a
|                  release check started it). The step then starts NO second execution: it FOLLOWS that one as its own run
|                  -- the log and the run's note say so -- and is judged by its result. A collection in parts follows its
|                  producer the same way. Nothing went wrong, so no guard event. A check that cannot be made is said and
|                  the step is started as before; without the seam (the VM flow) nothing is checked.
|          -Save   { param($State) }           -- the run record after every change (and every poll: the heartbeat)
|          -OnStep { param($State, $Step, $Phase) } (optional) -- 'Start' / 'End' per step (run health)
|          -Now    { } -> UTC [datetime]; -Sleep { param($Seconds) }
|          -StartEvidence (optional; the container flow) { param($Job, $Execution, $StartedUtc, $EndedUtc) } or an object
|                  with Probe() (New-SIJobFlowStartEvidence) -> @{ HasStartRecord; HasTranscript }. With it, a step whose
|                  execution ended Failed without the engine ever starting (Get-SIJobFlowFailureClass: never-started) is
|                  started again -StartRetries times after -StartRetryBackoffSeconds; the step record keeps Attempts and
|                  RetryReason. Without it (the VM flow) nothing is retried.
|          -StepLogs (optional) an object with Read($Job, $StartedUtc, $EndedUtc) (New-SIJobFlowStepLogReader) or a
|                  scriptblock of the same arguments -> @{ Name; Lines }. With it, a step whose engine ran and failed (its run
|                  log exists) is named by its own error: the LAST ERROR line of that log, classified by Get-SIErrorClass
|                  (Get-SIJobFlowLogErrorClass), instead of the bare 'job-failed' -- 3.0.30, a failed step read "unknown".
|        -Previous: the last run record (Resolve-SIJobFlowStart decides). -FromStep: a re-run that starts at that step (the
|        steps before it are Skipped, 'before the re-run'). Returns the final run record (+ .Outcome = the Resolve answer).
|    #>
|    param(
|        [Parameter(Mandatory)]$Definition,
|        # an adapter object (New-SIJobFlowArmSeams / New-SIJobFlowVmSeams) -- or the three scriptblocks below
|        $Seams,
|        [scriptblock]$Start,
|        [scriptblock]$Poll,
|        [scriptblock]$Stop,
|        [scriptblock]$JobLimit,
|        [scriptblock]$LimitHit,
|        [scriptblock]$RaiseLimit,
|        [scriptblock]$Running,
|        # #882 -- A STEP THE PIPELINE ENDS LEAVES NOTHING RUNNING FOR IT. -StopWorkers { param($Job, $SinceUtc, $Execution) }
|        # (the container flow: the workers of a collection in parts, the Risk Analysis queue workers -- their runs closed in
|        # the state store first, so a worker started later discards them; Get-SIJobFlowWorkerJobs). Called for a step that
|        # ended without success (failed, stopped, its job died), that was cancelled, and for a step a resumed run closes
|        # Interrupted (then also its job's execution that runs now and started since the step did is stopped: nobody
|        # follows it any more). A stop that fails is said; it never fails the run.
|        [scriptblock]$StopWorkers,
|        # THE RUN GOES ON WITHOUT ONE SOURCE. -SourceState (New-SISourceStateStore, engine\_shared\SI-SourceState.ps1; none
|        # on an install without its database): told when a COLLECTION step ended for good -- Good($Job, $SinceUtc, $NowUtc)
|        # or Dropped($Job, $SinceUtc, $NowUtc, $Why) -> when that source last collected completely (or $null). Dropped also
|        # makes sure nothing the failed collection wrote counts as a complete collection (no record turns 'not seen').
|        # Never fails the run: a state that cannot be written is said, and the run goes on.
|        $SourceState,
|        # DELIVERY WAITS FOR A SOURCE THAT IS TOO OLD. -DeliverHold { } -> '' or why (Get-SISourceDeliveryHold: a source has
|        # had no good collection for SI_Pro_SourceDropout_HoldDeliveryDays days or more). Asked once, when Deliver is about
|        # to start: with a reason its steps are Skipped (class 'source-too-old', the reason in the record) -- the stages
|        # before it ran, nothing is mailed and no ticket is changed. A step run now on its own is the person's own choice
|        # and is not held. Never a guard event (it would mail every run).
|        [scriptblock]$DeliverHold,
|        # ONE FAILED STEP DOES NOT COST THE REST OF THE RUN (owner 2026-10-12 / 13). After a step of Correlate (the CI build,
|        # Risk Analysis) did not succeed, a step the map marks 'runsOnStored' (the data sync, the verification service)
|        # still runs, on what is stored -- it holds back by itself whatever is not complete and closes nothing. Every other
|        # step that needs this run's result stays held as before. -GoOnAfterFailedStep $false = everything is held as
|        # before (the setting SI_Pro_Pipeline_GoOnAfterFailedStep). -FirstRun { } -> $true when this install has no earlier
|        # complete data to fall back on (the wording then says "first collection, not complete yet"); without the seam a
|        # run with no run before it counts as the first. Never fails the run.
|        [bool]$GoOnAfterFailedStep = (Test-SIPipelineGoOnAfterFailedStep),
|        [scriptblock]$FirstRun,
|        # THE FIRST RUN OF A NEW INSTALL IS ITS OWN FLOW (owner 2026-10-13; engine\_shared\SI-Pipeline.ps1, "THE FIRST RUN").
|        # Only with the -FirstRun seam, and only while it answers $true (the database holds no complete collection yet):
|        #   * "two restarts": a step that collects, correlates or runs on what is stored and fails or is stopped is started
|        #     again at once, up to -FirstRunRestarts times (the setting SI_Pro_Pipeline_FirstRunRestarts, default 2; 0 =
|        #     never). NEVER a step that writes to the customer's systems, changes a ticket or sends a mail;
|        #   * "wait for merged assets": the moment the asset build has finished whole, the data sync runs at once, on what
|        #     is stored (it holds every output), so the merged assets are the first data view; it then runs again at its
|        #     own place. Nothing of it ever fails the run.
|        [int]$FirstRunRestarts = (Get-SIPipelineFirstRunRestarts),
|        # A STEP THAT SHOWS NO PROGRESS IS REPORTED, NEVER STOPPED. -Progress (the container flow: New-SIJobFlowProgressProbe)
|        # { param($Job, $Execution, $StartedUtc) } or an object with Probe() -> @{ LastSeenUtc } = when the step's job last
|        # wrote a log line or a run-health record; $null / no LastSeenUtc = it cannot be told (then nothing is said). A step
|        # silent for -SilentAfterMinutes gets ONE warning in this run -- the log, OnStep 'Silent' (run health) and the step
|        # record -- and keeps running. Asked at most every -ProgressCheckMinutes.
|        $Progress,
|        [int]$SilentAfterMinutes = $script:SIJobFlow.SilentAfterMinutes,
|        [int]$ProgressCheckMinutes = $script:SIJobFlow.ProgressCheckMinutes,
|        # a run-record store (New-SIJobFlowFileStore / -BlobStore / -SqlStore): its Save() is used when -Save is not given
|        $Store,
|        [scriptblock]$Save,
|        [scriptblock]$OnStep,
|        [scriptblock]$Now = { [datetime]::UtcNow },
|        [scriptblock]$Sleep = { param($Seconds) Start-Sleep -Seconds $Seconds },
|        [scriptblock]$Log = { param($Level, $Message) Write-Host ('[flow] {0}' -f $Message) },
|        $Map,
|        $Previous,
|        [string]$FromStep,
|        [string]$Trigger = 'schedule',
|        [switch]$Force,
|        [int]$PollSeconds = 30,
|        [int]$StaleAfterMinutes = 15,
|        $StartEvidence,
|        $StepLogs,
|        [int]$StartRetries = $script:SIJobFlow.StartRetries,
|        [int]$StartRetryBackoffSeconds = $script:SIJobFlow.StartRetryBackoff,
|        [int]$NeverStartedMaxSeconds = $script:SIJobFlow.NeverStartedMaxSeconds,
|        # #306: what this run is -- the pipeline (default), one stage (-Target = stage id), one step (-Target = job), or the
|        # pipeline from a step (from-step = -FromStep) -- who asked for it, the queue request it serves, the slot it is for
|        # (a queued scheduled run), the run id (the queue names it before the run starts), the note, and the lock's
|        # heartbeat (called on every save, so the install's lock stays alive exactly as long as the run record does)
|        [ValidateSet('pipeline', 'stage', 'step', 'from-step')][string]$Scope = 'pipeline',
|        [string]$Target = '',
|        [string]$RequestedBy = '',
|        [long]$RequestId = 0,
|        $SlotUtc,
|        [string]$Note = '',
|        [string]$FlowRunId,
|        [scriptblock]$Heartbeat,
|        # #700: the SecurityInsight version this runner runs (recorded on a NEW run: the updater cancels a run of another
|        # version); -Cancelled { param($FlowRunId) } -> $null, or @{ By; Reason } when the run was CANCELLED meanwhile (the
|        # web app, a support start of the runner, the updater). Asked at every stage and every poll: a cancelled run starts
|        # nothing more, its running executions are asked to stop, and it ends Cancelled. Without the seam nothing is asked.
|        [string]$Version = '',
|        [scriptblock]$Cancelled,
|        # si-flow-1203 (2026-10-26): A RUN OR STEP MUCH LONGER THAN USUAL IS SAID, NEVER STOPPED. -History @{ Runs; Steps }
|        # = the newest run records and their steps (New-SIJobFlowSqlStore .Recent(); Get-SIPipelineUsualMinutes' shapes), or
|        # a scriptblock that answers them (read once, only when the run goes on).
|        # With it, a run that has run longer than its threshold (Get-SIPipelineLongRun: 2 x usual, at least usual + 2 h; the
|        # floor without history) is said ONCE in the log and in the run's note, a step once in the log and its step record
|        # (RetryReason). Without it (the default) nothing is checked. Never fails the run.
|        $History,
|        # si-flow-1204 (owner 2026-10-29): A STEP FAR PAST ITS LAST TIME WITH NO PROGRESS IS SAID, NEVER STOPPED. -StepProgress
|        # { param($Job, $Execution, $SinceUtc) } -> the step's newest sign of progress since it started (Get-SIStepProgressLast), or
|        # $null. Asked only for a step already past its time (Get-SIPipelineStalledSteps), at most every 10 minutes per step;
|        # said ONCE in the log and the step record (RetryReason). Needs -History (the last run's times). Never fails the run.
|        [scriptblock]$StepProgress
|    )
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    if ($Scope -eq 'from-step') { if (-not $FromStep) { $FromStep = $Target }; $Scope = 'pipeline' }
|    if ($Scope -eq 'step') { $Target = Get-SIJobFlowKey $Target }
|    if ($Seams) {
|        if (-not $Start) { $Start = { param($j) $Seams.Start($j) } }
|        if (-not $Poll) { $Poll = { param($j, $e) $Seams.Poll($j, $e) } }
|        if (-not $Stop -and $Seams.PSObject.Methods['Stop']) { $Stop = { param($j, $e) $Seams.Stop($j, $e) } }
|        if (-not $JobLimit -and $Seams.PSObject.Methods['Limit']) { $JobLimit = { param($j) $Seams.Limit($j) } }
|        if (-not $LimitHit -and $Seams.PSObject.Methods['LimitHit']) { $LimitHit = { param($j, $e, $since) $Seams.LimitHit($j, $e, $since) } }
|        if (-not $Running -and $Seams.PSObject.Methods['Running']) { $Running = { param($j) $Seams.Running($j) } }
|        if (-not $StopWorkers -and $Seams.PSObject.Methods['StopWorkers']) { $StopWorkers = { param($j, $s, $e) $Seams.StopWorkers($j, $s, $e) } }
|    }
|    if (-not $Start -or -not $Poll) { throw 'Invoke-SIJobFlow needs -Seams, or -Start and -Poll' }
|    # #882: what worked for a step that ended without success, was cancelled or was closed Interrupted is stopped -- its
|    # workers (their runs closed first) and, for a step closed Interrupted by a resumed run (-AlsoRunning), its job's
|    # execution that runs now and started since the step did. Never throws; what could not be stopped is said.
|    $stopStepWork = {
|        param($st, [switch]$AlsoRunning)
|        $k = [string]$st.Job
|        $since = if ($st.StartedUtc) { ([datetime]$st.StartedUtc).ToUniversalTime() } else { $null }
|        if ($AlsoRunning -and $Running -and $Stop) {
|            $live = $null
|            try { $live = & $Running $k } catch { $live = $null }
|            if ($live -and [string]$live.Execution -and ((-not $since) -or (-not $live.StartedUtc) -or ([datetime]$live.StartedUtc).ToUniversalTime() -ge $since.AddMinutes(-5))) {
|                try { $null = & $Stop $k ([string]$live.Execution); & $Log 'WARN' ('step {0} {1}: its execution {2} was still running and nobody follows it any more -- stopped' -f $st.Order, $k, $live.Execution) }
|                catch { & $Log 'WARN' ('step {0} {1}: its execution {2} could not be stopped ({3})' -f $st.Order, $k, $live.Execution, $_.Exception.Message) }
|            }
|        }
|        if ($StopWorkers) {
|            try { $null = & $StopWorkers $k $since ([string]$st.Execution) }
|            catch { & $Log 'WARN' ('step {0} {1}: its workers could not be stopped ({2})' -f $st.Order, $k, $_.Exception.Message) }
|        }
|    }
|    if (-not $Save) { if ($Store) { $Save = { param($s) $Store.Save($s) } } else { $Save = { param($s) } } }
|    if (-not $PSBoundParameters.ContainsKey('Previous') -and $Store) { $Previous = $Store.Load() }
|    $FromStep = Get-SIJobFlowKey $FromStep
|    $t0 = ([datetime](& $Now)).ToUniversalTime()
|    # SCHED-1.1: a manual start (Run flow now / re-run from a step) runs now -- unless a run is still running; a wake-up of
|    # the schedule runs only when the cadence says the flow is due (finish + interval, or a time-of-day slot).
|    $due = $null
|    $manual = $Force -or $FromStep -or $Scope -ne 'pipeline'
|    if ($manual) { $decision = Resolve-SIJobFlowStart -Previous $Previous -NowUtc $t0 -Force -FromStep $FromStep -StaleAfterMinutes $StaleAfterMinutes }
|    else {
|        $due = Get-SIJobFlowDue -Definition $Definition -Previous $Previous -NowUtc $t0 -StaleAfterMinutes $StaleAfterMinutes
|        $decision = switch ($due.Action) { 'Start' { 'New' } 'Wait' { 'Wait' } default { $due.Action } }
|    }
|    if ($decision -eq 'Busy') {
|        # #277: a schedule wake-up during a run is normal operation (the runner wakes every 5 minutes) -- INFO, not a guard.
|        # A manual start (Run flow now / re-run from a step) that is refused is worth a warning.
|        if ($manual) { & $Log 'WARN' ('skipped: the previous flow run ({0}, started {1:u}) is still running -- nothing starts twice' -f $Previous.FlowRunId, $Previous.StartedUtc) }
|        else { & $Log 'INFO' ('the flow is still running (flow run {0}, started {1:u}); this wake-up does nothing' -f $Previous.FlowRunId, $Previous.StartedUtc) }
|        $Previous | Add-Member -NotePropertyName Outcome -NotePropertyValue 'Busy' -Force; return $Previous
|    }
|    if ($decision -eq 'Wait') {
|        & $Log 'INFO' ('not due: {0}' -f $due.Reason)
|        $w = if ($Previous) { $Previous } else { [pscustomobject]@{ FlowRunId = ''; State = 'None'; Steps = @() } }
|        $w | Add-Member -NotePropertyName Outcome -NotePropertyValue 'Wait' -Force
|        $w | Add-Member -NotePropertyName NextUtc -NotePropertyValue $due.NextUtc -Force
|        return $w
|    }
|    $check = Test-SIJobFlowDefinition -Definition $Definition -Map $Map
|    if (@($check.Problems).Count) { throw ('the flow definition is not valid: ' + (@($check.Problems) -join '; ')) }
|    foreach ($w in @($check.Warnings)) { & $Log 'WARN' $w }
|
|    if ($decision -eq 'Resume') {
|        $state = $Previous
|        & $Log 'WARN' ('resuming flow run {0} (its runner stopped) -- finished steps are kept, a running step is followed, nothing is started twice' -f $state.FlowRunId)
|        foreach ($st in @($state.Steps)) {
|            if ($st.State -eq 'Starting') {
|                $st.State = 'Interrupted'; $st.ErrorClass = 'interrupted'; $st.EndedUtc = $t0
|                $st.Error = 'the flow runner stopped while starting this step; it is not started again (it may or may not have run) -- see the job''s executions'
|                # #882: what it may have started is not followed by anyone -- stopped, its workers too
|                & $stopStepWork $st -AlsoRunning
|            }
|        }
|    } else {
|        if ($FromStep -and -not (@($Definition.Steps) | Where-Object { $_.Job -eq $FromStep })) { throw ("'{0}' is not a step of the flow" -f $FromStep) }
|        if ($Scope -eq 'step' -and -not (@($Definition.Steps) | Where-Object { $_.Job -eq $Target })) { throw ("'{0}' is not a step of the pipeline" -f $Target) }
|        if ($Scope -eq 'stage' -and -not (@(Get-SIPipelineStages -Definition $Definition) | Where-Object { [string]$_.Id -eq $Target })) { throw ("'{0}' is not a stage of the pipeline" -f $Target) }
|        $trg = if ($FromStep) { 'rerun' } elseif ($due -and $due.Trigger) { $due.Trigger } else { $Trigger }
|        $slot = if ($due) { $due.SlotUtc } elseif ($SlotUtc -and $Scope -eq 'pipeline') { $SlotUtc } else { $null }
|        $nt = if ($due) { [string]$due.Note } else { $Note }
|        # why a scheduled start is late, in the run's own note: owed only because the previous run was still going (normal
|        # on a large install -- no guard event) or missed for any other reason (the guard reports it). Decided here, at the
|        # start, for a start of the schedule and for one that waited in the queue alike.
|        if ($Scope -eq 'pipeline' -and -not $FromStep -and $slot) {
|            $lateStart = $null; try { $lateStart = Get-SIJobFlowLateStart -Trigger $trg -SlotUtc $slot -Previous $Previous -NowUtc $t0 } catch { $lateStart = $null }
|            if ($lateStart -and $lateStart.Kind -ne 'on-time') { $nt = [string]$lateStart.Note }
|        }
|        # the measured cadence: when the run before this one took longer than the schedule's interval, the run's note says
|        # in plain words how often the data is really refreshed (the web app shows the note; the run's record keeps it)
|        if ($Scope -eq 'pipeline' -and -not $FromStep -and $slot -and $Previous) {
|            $cad = $null; try { $cad = Get-SIPipelineMeasuredCadence -Definition $Definition -Previous $Previous -NowUtc $t0 -SlotUtc $slot } catch { $cad = $null }
|            if ($cad) { $nt = ('{0} {1}' -f $cad.Text, $nt).Trim(); if ($nt.Length -gt 400) { $nt = $nt.Substring(0, 400) } }   # the note's column holds 400
|        }
|        $state = New-SIJobFlowRunState -Definition $Definition -NowUtc $t0 -Trigger $trg -FromStep $FromStep -FlowRunId $FlowRunId `
|            -SlotUtc $slot -LastSlotUtc $(if ($Previous) { Get-SIJobFlowSlotRun -Definition $Definition -Previous $Previous } else { $null }) -Note $nt `
|            -Scope $Scope -Target $Target -RequestedBy $RequestedBy -RequestId $RequestId -Version $Version
|        if ($state.Note) { & $Log 'WARN' $state.Note }
|        if ($FromStep) {
|            foreach ($st in @($state.Steps)) {
|                if ($st.Job -eq $FromStep) { break }
|                if ($st.State -eq 'Waiting') { $st.State = 'Skipped'; $st.ErrorClass = 'before-rerun'; $st.Error = ('before the re-run from {0}' -f $FromStep) }
|            }
|        }
|    }
|    # a record written before attempts were kept gets them now (a resumed run)
|    foreach ($st in @($state.Steps)) {
|        if (-not $st.PSObject.Properties['Attempts']) { $st | Add-Member -NotePropertyName Attempts -NotePropertyValue (Get-SIJobFlowAttempts $st) }
|        if (-not $st.PSObject.Properties['RetryReason']) { $st | Add-Member -NotePropertyName RetryReason -NotePropertyValue '' }
|    }
|    foreach ($st in @($state.Steps)) { if (-not $st.PSObject.Properties['Stage']) { $st | Add-Member -NotePropertyName Stage -NotePropertyValue '' } }
|    foreach ($n in @('Scope', 'Target', 'RequestedBy', 'RequestId', 'Version', 'CancelledBy')) { if (-not $state.PSObject.Properties[$n]) { $state | Add-Member -NotePropertyName $n -NotePropertyValue $(if ($n -eq 'Scope') { 'pipeline' } elseif ($n -eq 'RequestId') { 0 } else { '' }) } }
|    # #700: was this run CANCELLED meanwhile? Asked at every stage and every poll (never fails the run: a check that cannot be
|    # made is asked again at the next poll). $cancelHit = @{ By; Reason } once it was.
|    $cancelHit = $null
|    # (dot-sourced: it sets $cancelHit of this function)
|    $askCancelled = {
|        if ($Cancelled -and -not $cancelHit) {
|            try { $cx = & $Cancelled ([string]$state.FlowRunId); if ($cx) { $cancelHit = $cx } } catch { }
|        }
|    }
|    $saveNow = {
|        $state.HeartbeatUtc = ([datetime](& $Now)).ToUniversalTime(); & $Save $state
|        if ($Heartbeat) { try { & $Heartbeat $state } catch { & $Log 'WARN' ('the pipeline lock could not be beaten ({0})' -f $_.Exception.Message) } }
|    }
|    & $saveNow
|
|    $groups = Get-SIJobFlowGroups -Definition $Definition
|    $defByJob = @{}; foreach ($s in @($Definition.Steps)) { $defByJob[[string]$s.Job] = $s }
|    # the limit of a step: the larger of its configured timeout and its job's own run limit (read once per job, said once)
|    $jobLimits = @{}; $saidLimit = @{}
|    # a step with no sign of progress: said once per step (this run), asked for at most every ProgressCheckMinutes
|    $silentSaid = @{}; $progressAsked = @{}
|    # a step that has run longer than its step timeout: said once per step (this run) -- never stopped
|    $overdueSaid = @{}
|    # si-flow-1203: a run / step much longer than usual for this install -- said once (the run: its note says it; a step:
|    # its RetryReason), never stopped. The usual lengths are worked out once, from the OTHER runs read (-History).
|    $longUsual = $null; $longRunSaid = $false; $longStepSaid = @{}
|    # si-flow-1204: the last run's time of each job (the OTHER runs read), the steps said, when each step's progress was asked
|    $stallLast = $null; $stallSaid = @{}; $stallAsked = @{}
|    if ($null -ne $History) {
|        try {
|            # a scriptblock is read only here, once the run goes on (never on a wake-up that only waits)
|            $hist = if ($History -is [scriptblock]) { & $History } else { $History }
|            $longUsual = Get-SIPipelineUsualMinutes -Runs @($hist.Runs | Where-Object { $_ }) -Steps @($hist.Steps | Where-Object { $_ }) -ExcludeRunId ([string]$state.FlowRunId)
|            if ($StepProgress) { $stallLast = Get-SIPipelineLastStepMinutes -Steps @($hist.Steps | Where-Object { $_ }) -ExcludeRunId ([string]$state.FlowRunId) }
|        }
|        catch { $longUsual = $null; & $Log 'WARN' ('how long a run usually takes here could not be worked out ({0}) -- a long run is not said in this run' -f $_.Exception.Message) }
|    }
|    # (dot-sourced: it sets $longRunSaid of this function; the caller saves)
|    $longCheck = {
|        if ($null -eq $longUsual) { return }
|        try {
|            foreach ($lf in @(Get-SIPipelineLongRun -Run $state -Steps @($state.Steps) -Usual $longUsual -NowUtc ([datetime](& $Now)).ToUniversalTime())) {
|                $lt = Get-SIPipelineLongRunText -Finding $lf
|                if ($lf.Kind -eq 'run') {
|                    if ($longRunSaid -or [string]$state.Note -match 'much longer than usual') { $longRunSaid = $true; continue }
|                    $longRunSaid = $true
|                    & $Log 'WARN' $lt
|                    $ln = 'This run has run much longer than usual: {0} h so far{1} (si-flow-1203).' -f ([double]$lf.AgeMinutes / 60).ToString('0.#', [Globalization.CultureInfo]::InvariantCulture),
|                          $(if ($lf.Basis -eq 'history') { ', usually {0} h' -f ([double]$lf.UsualMinutes / 60).ToString('0.#', [Globalization.CultureInfo]::InvariantCulture) } else { '' })
|                    $state.Note = ('{0} {1}' -f [string]$state.Note, $ln).Trim()
|                    if ($state.Note.Length -gt 400) { $state.Note = $state.Note.Substring(0, 400) }
|                    continue
|                }
|                $lst = @(@($state.Steps) | Where-Object { [int]$_.Order -eq [int]$lf.Order })[0]
|                if (-not $lst -or $longStepSaid.ContainsKey([int]$lf.Order) -or [string]$lst.RetryReason -match 'much longer than usual') { if ($lst) { $longStepSaid[[int]$lf.Order] = $true }; continue }
|                $longStepSaid[[int]$lf.Order] = $true
|                & $Log 'WARN' ('step {0} {1}: {2}' -f $lst.Order, $lst.Job, $lt)
|                $lst.RetryReason = (@([string]$lst.RetryReason, $lt) | Where-Object { $_ }) -join ' | '
|            }
|        } catch { & $Log 'WARN' ('whether this run is much longer than usual could not be told ({0})' -f $_.Exception.Message) }
|        # si-flow-1204: a step far past its last time that shows no progress -- said once, nothing is stopped
|        if ($null -ne $stallLast -and $StepProgress) {
|            try {
|                $sNow = ([datetime](& $Now)).ToUniversalTime()
|                $cand = @()
|                foreach ($st0 in @(@($state.Steps) | Where-Object { [string]$_.State -in @('Running', 'Starting') -and $_.StartedUtc })) {
|                    $sk0 = Get-SIJobFlowKey ([string]$st0.Job)
|                    if ($stallSaid.ContainsKey([int]$st0.Order) -or [string]$st0.RetryReason -match 'shows no progress') { $stallSaid[[int]$st0.Order] = $true; continue }
|                    $th0 = Get-SIPipelineStallThreshold -LastMinutes $(if ($stallLast.ContainsKey($sk0)) { $stallLast[$sk0] } else { $null })
|                    $since0 = ([datetime]$st0.StartedUtc).ToUniversalTime()
|                    if (($sNow - $since0).TotalMinutes -le [double]$th0.Minutes) { continue }
|                    if ($stallAsked.ContainsKey([int]$st0.Order) -and ($sNow - [datetime]$stallAsked[[int]$st0.Order]).TotalMinutes -lt 10) { continue }
|                    $stallAsked[[int]$st0.Order] = $sNow
|                    $lp = $null; try { $lp = & $StepProgress ([string]$st0.Job) ([string]$st0.Execution) $since0 } catch { $lp = $null }
|                    $cand += [pscustomobject]@{ Job = [string]$st0.Job; Order = [int]$st0.Order; State = [string]$st0.State; StartedUtc = $since0; LastProgressUtc = $lp
|                                                Silent = ([string]$st0.RetryReason -match 'has shown no sign of progress for') }
|                }
|                foreach ($sf in @(Get-SIPipelineStalledSteps -Steps $cand -LastMinutes $stallLast -NowUtc $sNow)) {
|                    $sst = @(@($state.Steps) | Where-Object { [int]$_.Order -eq [int]$sf.Order })[0]
|                    if (-not $sst) { continue }
|                    $stallSaid[[int]$sf.Order] = $true
|                    $stt = Get-SIPipelineStalledText -Finding $sf
|                    & $Log 'WARN' ('step {0} {1}: {2}' -f $sst.Order, $sst.Job, $stt)
|                    $sst.RetryReason = (@([string]$sst.RetryReason, $stt) | Where-Object { $_ }) -join ' | '
|                }
|            } catch { & $Log 'WARN' ('whether a step shows progress could not be told ({0})' -f $_.Exception.Message) }
|        }
|    }
|    $limitOf = {
|        param($st)
|        $k = [string]$st.Job
|        $conf = 240; if ($defByJob.ContainsKey($k)) { $conf = [int]$defByJob[$k].TimeoutMinutes }
|        $jobMin = 0; $known = $true
|        if ($JobLimit) {
|            if ($jobLimits.ContainsKey($k)) { $jobMin = [int]$jobLimits[$k] }
|            else {
|                try { $jobMin = [int](& $JobLimit $k); $jobLimits[$k] = $jobMin }
|                catch { $known = $false }   # asked again on the next poll; until it answers the step's own timeout applies
|            }
|        }
|        $fromJob = $jobMin -gt $conf
|        $r = [pscustomobject]@{ Minutes = $(if ($fromJob) { $jobMin + 5 } else { $conf }); Configured = $conf; JobMinutes = $jobMin; FromJob = $fromJob; Known = $known }
|        if ($JobLimit -and $known -and -not $saidLimit.ContainsKey($k)) {
|            $saidLimit[$k] = $true
|            if ($jobMin -gt 0) { & $Log 'INFO' ('step {0} {1}: the pipeline stops no step for the time it takes -- its job''s own run limit is {2} minutes; after {3} minutes (the step timeout) the pipeline says it is taking long' -f $st.Order, $k, $jobMin, $conf) }
|            else { & $Log 'INFO' ('step {0} {1}: the pipeline stops no step for the time it takes; after {2} minutes (the step timeout) the pipeline says it is taking long' -f $st.Order, $k, $conf) }
|        }
|        $r
|    }
|    # a COLLECTION step that ended for good (after self-healing and the start retry): the source's state is recorded, and a
|    # failed one learns when that source last collected completely (the run's sentence names it). -SourceState first; else
|    # the run before this one, when that step succeeded in it; else no date.
|    $firstStart = @{}
|    $deliverHoldAsked = $false; $deliverHoldWhy = ''
|    # has this install no earlier complete data (a new install's first collection)? Asked at most once per run, only when
|    # a step would run on what is stored after a failed step. (dot-sourced: it sets the two variables of this function)
|    $firstRunAsked = $false; $isFirstRun = $false
|    $askFirstRun = {
|        if (-not $firstRunAsked) {
|            $firstRunAsked = $true
|            if ($FirstRun) { try { $isFirstRun = [bool](& $FirstRun) } catch { $isFirstRun = $false; & $Log 'INFO' ('whether this install has earlier complete data could not be checked ({0})' -f $_.Exception.Message) } }
|            else { $isFirstRun = -not $Previous }
|        }
|    }
|    # A FIRST COLLECTION, "wait for merged assets": the asset build ($st) has just finished whole -- the step that shows
|    # the merged assets ($fd, the data sync) runs AT ONCE, on what is stored. Its record says so BEFORE it is started, so
|    # the data sync holds every output (nothing goes to ServiceNow or a file from a run that is not complete). Then the
|    # step goes back to waiting and runs again at its own place. (dot-sourced: it reads and sets this function's variables)
|    # IT RUNS BESIDE THE REST OF THE RUN, NEVER IN FRONT OF IT (seen live 2026-11-05 at a large install's first collection:
|    # the delivery at once was waited for in place, so Risk Analysis and every later step stood still for 6 hours behind
|    # it). It is started here and followed by the run's own loop ($pollFirstDelivery); while it runs the step shows
|    # Running, so nothing that needs it starts and it cannot start a second time at its own place.
|    $firstDelivered = $false
|    $fdSide = $null
|    $deliverFirst = {
|        $fdKeep = [string]$fd.RetryReason
|        try {
|            $fdWhy = Get-SIPipelineFirstRunText -Kind DeliveryWhy -Job ([string]$fd.Job)
|            $fd.RetryReason = (@($fdKeep, $fdWhy) | Where-Object { $_ }) -join ' | '
|            $fd.State = 'Starting'; $fd.StartedUtc = ([datetime](& $Now)).ToUniversalTime()
|            & $saveNow
|            $fdExec = [string](& $Start $fd.Job)
|            $fd.Execution = $fdExec; $fd.State = 'Running'
|            & $Log 'WARN' ('step {0} {1}: {2} ({3})' -f $fd.Order, $fd.Job, $fdWhy, $fdExec)
|            $fdSide = [pscustomobject]@{ Step = $fd; Build = $st; Exec = $fdExec; Keep = $fdKeep }
|            & $saveNow
|        } catch {
|            & $Log 'WARN' ('first collection: {0} could not be run at once after the asset build ({1})' -f $fd.Job, $_.Exception.Message)
|            $fdSide = [pscustomobject]@{ Step = $fd; Build = $st; Exec = ''; Keep = $fdKeep }
|            . $endFirstDelivery $false
|        }
|    }
|    # the delivery at once has ended ($ok): the step goes back to waiting (it runs again at its own place), said in the
|    # asset build's record and the run's note
|    $endFirstDelivery = {
|        param([bool]$ok)
|        $fd = $fdSide.Step
|        $fd.State = 'Waiting'; $fd.Execution = ''; $fd.StartedUtc = $null; $fd.EndedUtc = $null; $fd.ErrorClass = ''; $fd.Error = ''; $fd.RetryReason = $fdSide.Keep
|        $fdSaid = Get-SIPipelineFirstRunText -Kind $(if ($ok) { 'Delivered' } else { 'NotDelivered' }) -Job ([string]$fd.Job)
|        & $Log $(if ($ok) { 'INFO' } else { 'WARN' }) $fdSaid
|        $fdSide.Build.RetryReason = (@([string]$fdSide.Build.RetryReason, $fdSaid) | Where-Object { $_ }) -join ' | '
|        $state.Note = ('{0} {1}' -f $fdSaid, ([string]$state.Note).Replace((Get-SIPipelineFirstRunText -Kind Running), '').Trim()).Trim()
|        if ($state.Note.Length -gt 400) { $state.Note = $state.Note.Substring(0, 400) }
|        $fdSide = $null
|        & $saveNow
|    }
|    # one look at the delivery at once, from the run's loop: never waits
|    $pollFirstDelivery = {
|        if ($fdSide -and [string]$fdSide.Step.State -eq 'Running') {
|            $fdStatus = ''
|            try {
|                $fdPr = & $Poll $fdSide.Step.Job $fdSide.Exec
|                if ($null -ne $fdPr -and $fdPr -isnot [string] -and $fdPr.PSObject.Properties['Status']) { $fdStatus = [string]$fdPr.Status } else { $fdStatus = [string]$fdPr }
|            } catch { & $Log 'WARN' ('step {0} {1}: its status could not be read ({2}) -- trying again' -f $fdSide.Step.Order, $fdSide.Step.Job, $_.Exception.Message) }
|            if ($fdStatus -match '^(?i)succeeded$') { . $endFirstDelivery $true }
|            elseif ($fdStatus -match '^(?i)(failed|stopped|degraded|cancelled|canceled)$') { . $endFirstDelivery $false }
|        } elseif ($fdSide) { $fdSide = $null }   # the run's own handling took the step over (a cancel): nothing more to follow
|    }
|    $isFirstDelivery = { param($x) [bool]($fdSide -and [object]::ReferenceEquals($x, $fdSide.Step)) }
|    # a first collection says so from its start (the pipeline page shows the run's note): nothing is shown yet, and why
|    if ($FirstRun -and $decision -ne 'Resume' -and [string]$state.Scope -eq 'pipeline' -and -not [string]$state.FromStep) {
|        . $askFirstRun
|        if ($isFirstRun) {
|            $state.Note = ('{0} {1}' -f (Get-SIPipelineFirstRunText -Kind Running), [string]$state.Note).Trim()
|            if ($state.Note.Length -gt 400) { $state.Note = $state.Note.Substring(0, 400) }
|            & $Log 'INFO' (Get-SIPipelineFirstRunText -Kind Running)
|        }
|    }
|    $sourceEnded = {
|        param($st)
|        if ((Get-SIPipelineStepStage $st) -ne 'collect' -or -not (Test-SIPipelineSourceJob ([string]$st.Job))) { return }
|        $k = [string]$st.Job
|        $nowU = ([datetime](& $Now)).ToUniversalTime()
|        $since = if ($firstStart.ContainsKey($k)) { [datetime]$firstStart[$k] } elseif ($st.StartedUtc) { ([datetime]$st.StartedUtc).ToUniversalTime() } else { $nowU }
|        $good = $null
|        if ($SourceState) {
|            try {
|                if ([string]$st.State -eq 'Success') { $null = $SourceState.Good($k, $since, $nowU) }
|                else { $good = $SourceState.Dropped($k, $since, $nowU, [string]$st.Error) }
|            } catch { & $Log 'WARN' ('step {0} {1}: the state of this source could not be recorded ({2})' -f $st.Order, $k, $_.Exception.Message) }
|        }
|        if ([string]$st.State -eq 'Success') { return }
|        if (-not $good -and $Previous -and [string]$Previous.FlowRunId -ne [string]$state.FlowRunId) {
|            $was = @(@($Previous.Steps) | Where-Object { [string]$_.Job -eq $k -and [string]$_.State -eq 'Success' -and $_.StartedUtc })[0]
|            if ($was) { $good = ([datetime]$was.StartedUtc).ToUniversalTime() }
|        }
|        if ($good) { $st | Add-Member -NotePropertyName LastGoodUtc -NotePropertyValue ([datetime]$good).ToUniversalTime() -Force }
|    }
|    $saidStage = @{}
|    $stageOf = @{}; foreach ($g in $groups) { foreach ($s in $g.Steps) { $stageOf[[string]$s.Job] = $g.Stage } }
|    # a resumed run: a collection whose start was interrupted (it may or may not have run) is a dropped source too
|    if ($decision -eq 'Resume') {
|        foreach ($st in @($state.Steps | Where-Object { [string]$_.State -eq 'Interrupted' -and $_.EndedUtc -and ([datetime]$_.EndedUtc).ToUniversalTime() -eq $t0 })) {
|            if (-not $st.Stage -and $stageOf.ContainsKey([string]$st.Job)) { $st.Stage = $stageOf[[string]$st.Job] }
|            & $sourceEnded $st
|        }
|    }
|    foreach ($st in @($state.Steps)) { if (-not $st.Stage -and $stageOf.ContainsKey([string]$st.Job)) { $st.Stage = $stageOf[[string]$st.Job] } }
|    # delivery waits for a source that is too old: asked once, when Deliver would start
|    # (dot-sourced below: it sets the two variables of this function)
|    $askDeliverHold = {
|        if ($DeliverHold -and -not $deliverHoldAsked -and [string]$state.Scope -ne 'step') {
|            $deliverHoldAsked = $true
|            try { $deliverHoldWhy = [string](& $DeliverHold) } catch { $deliverHoldWhy = ''; & $Log 'WARN' ('whether delivery must wait for a source could not be checked ({0}) -- delivery runs' -f $_.Exception.Message) }
|            if ($deliverHoldWhy) { & $Log 'WARN' $deliverHoldWhy }
|        }
|    }
|    # #754 -- A STEP STARTS AS SOON AS WHAT IT WAITS FOR HAS ENDED (Get-SIJobFlowAwaited): a step waits for every step of the
|    # groups above it (the group-by-group order of before: the steps of one group start together, the next group when they
|    # have all ended); a Deliver step the map marks 'startsWhenReady' waits, in a run of the whole pipeline, only for the
|    # steps it reads and Collect -- so the CMDB connectors run beside Risk Analysis, the vulnerability connector starts when
|    # Risk Analysis Detailed has ended. Such a step is also JUDGED only on those steps (its stage gate, what failed before
|    # it, the exceptions for a step that runs on what is stored or without a nice-to-have step): a report it does not read
|    # neither starts nor holds it; a report it reads that failed, was held or was skipped holds it as before.
|    $isEnded = { param($x) [string]$x.State -notin @('Waiting', 'Starting', 'Running') }
|    # an install's FIRST collection keeps the group-by-group order: nothing is written to the customer's systems before one
|    # run is complete. Known from the run's start (the -FirstRun seam is asked then); without the seam: no run before this
|    # one; with the seam not asked (a resumed run, a re-run from a step): the order of before, to be safe.
|    $noEarly = $true
|    if ($firstRunAsked) { $noEarly = [bool]$isFirstRun } elseif (-not $FirstRun) { $noEarly = -not $Previous }
|    $readyOf = {
|        param($x)
|        $a = Get-SIJobFlowAwaited -State $state -Step $x -Map $Map -NoEarly:$noEarly
|        if (@(@($state.Steps) | Where-Object { @($a.Jobs) -contains [string]$_.Job -and -not (& $isEnded $_) }).Count) { return $null }
|        $a
|    }
|    # one step that may start now ($st, its awaited steps $aw). Dot-sourced: it reads and sets this function's variables;
|    # $blocked and $gates are this pass's (computed once for the steps that become ready together, as for one group before)
|    $startStep = {
|        param($st, $aw)
|        $g = [pscustomobject]@{ Stage = [string](Get-SIPipelineStepStage $st) }
|        # what the step is judged on: the whole run, or (#754) Collect, the steps it waits for, and every step that has
|        # already ended (a step still running that it does not read can neither start nor hold it)
|        $view = $state
|        if ($aw.Early) { $view = [pscustomobject]@{ FlowRunId = $state.FlowRunId; Scope = $state.Scope; Steps = @(@($state.Steps) | Where-Object { (Get-SIPipelineStepStage $_) -notin @('correlate', 'deliver') -or @($aw.Jobs) -contains [string]$_.Job -or [string]$_.Job -eq [string]$st.Job -or ([int]$_.Group -lt [int]$st.Group -and (& $isEnded $_)) }) } }
|        # #306: a stage starts only when the stage before it ENDED -- and not at all when that stage did not succeed (unless
|        # it is set to run anyway); Deliver never starts after a Collect of this run that did not succeed (rule 4)
|        $gk = '{0}|{1}' -f $g.Stage, $(if ($aw.Early) { [string]$st.Job } else { '' })
|        if (-not $gates.ContainsKey($gk)) { $gates[$gk] = Get-SIPipelineStageGate -State $view -Definition $Definition -Stage $g.Stage }
|        $gate = $gates[$gk]
|        if ($gate -and $gate.Reason -and -not $saidStage.ContainsKey($gk)) { $saidStage[$gk] = $true; & $Log 'WARN' $(if ($aw.Early) { 'step {0} {1}: {2}' -f $st.Order, $st.Job, $gate.Reason } else { $gate.Reason }) }
|        elseif ($gate -and $gate.Run -and -not $aw.Early -and -not $saidStage.ContainsKey($gk)) { $saidStage[$gk] = $true; & $Log 'INFO' ('stage {0} starts' -f (Get-SIPipelineStageName $g.Stage)) }
|        if ($aw.Early -and $gate -and $gate.Run -and -not $blocked.Stopped) {
|            $still = @(@($state.Steps) | Where-Object { [int]$_.Group -lt [int]$st.Group -and -not (& $isEnded $_) } | ForEach-Object { [string]$_.Job })
|            if ($still.Count) { & $Log 'INFO' ('step {0} {1}: starts now -- what it reads has ended ({2}); it does not wait for {3}' -f $st.Order, $st.Job, $(if (@($aw.Reads).Count) { @($aw.Reads) -join ', ' } else { 'Collect' }), ($still -join ', ')) }
|        }
|        if ($g.Stage -eq 'deliver' -and -not $blocked.Stopped -and $gate -and $gate.Run) { . $askDeliverHold }
|        if ($blocked.Stopped) { $st.State = 'Skipped'; $st.ErrorClass = 'flow-stopped'; $st.Error = $blocked.StopReason; return }
|        # what would hold this step: its stage does not start, or a step it needs did not succeed
|        $heldClass = ''; $heldWhy = ''
|        if ($gate -and -not $gate.Run) { $heldClass = 'stage-blocked'; $heldWhy = $gate.Reason }
|        elseif ($blocked.Skip.ContainsKey($st.Job)) { $heldClass = 'needs-failed'; $heldWhy = ('needs {0}, which did not succeed' -f $blocked.Skip[$st.Job]) }
|        # ONE FAILED STEP DOES NOT COST THE REST OF THE RUN: a step that runs on what is stored is not held when what
|        # failed comes after a Collect that is good (Get-SIPipelineStoredDataRun). Every other step is held as before.
|        # THE CONNECTORS NEED THE FINDINGS, NOT THE SUMMARY (owner 2026-10-13): when the only steps that failed after
|        # Collect are nice-to-have ones (Risk Analysis Summary), a step the map marks for it runs IN FULL, on this run's
|        # own result (Get-SIPipelineOwnResultRun). Never on an install's first collection: nothing is written to the
|        # customer's systems before one run is complete.
|        $own = $null
|        if ($heldClass -eq 'stage-blocked' -and $GoOnAfterFailedStep -and -not $blocked.Skip.ContainsKey($st.Job)) {
|            try {
|                $own = Get-SIPipelineOwnResultRun -State $view -Definition $Definition -Map $Map -Job ([string]$st.Job)
|                if ($own.Run) { . $askFirstRun; if ($isFirstRun) { $own = $null } }
|            } catch { $own = $null }
|        }
|        $onOwn = [bool]($own -and $own.Run)
|        $stored = $null
|        if ($heldClass -and $GoOnAfterFailedStep -and -not $onOwn) {
|            try {
|                $stored = Get-SIPipelineStoredDataRun -State $view -Definition $Definition -Map $Map -Job ([string]$st.Job)
|                # a new install's first collection: asked once, and only when a step would run on what is stored
|                if ($stored.Run) { . $askFirstRun; if ($isFirstRun) { $stored = Get-SIPipelineStoredDataRun -State $view -Definition $Definition -Map $Map -Job ([string]$st.Job) -FirstRun } }
|            } catch { $stored = $null }
|        }
|        $onStored = [bool]($stored -and $stored.Run)
|        # the first collection's asset build failed: the step stays held, with the first collection's own reason
|        if ($stored -and $stored.FirstHeld) { $heldWhy = [string]$stored.Reason }
|        if ($heldClass -eq 'stage-blocked' -and -not $onStored -and -not $onOwn) { $st.State = 'Skipped'; $st.ErrorClass = $heldClass; $st.Error = $heldWhy; return }
|        # delivery waits for a source that is too old -- also for a step that would run on what is stored, or in full
|        # after a nice-to-have step failed
|        if (($onStored -or $onOwn) -and $g.Stage -eq 'deliver') { . $askDeliverHold }
|        if ($g.Stage -eq 'deliver' -and $deliverHoldWhy) { $st.State = 'Skipped'; $st.ErrorClass = 'source-too-old'; $st.Error = $deliverHoldWhy; return }
|        if ($heldClass -eq 'needs-failed' -and -not $onStored) { $st.State = 'Skipped'; $st.ErrorClass = $heldClass; $st.Error = $heldWhy; return }
|        if ($onStored) {
|            # kept in the step's own record: the run's sentence, its note and its report are read from it
|            $st.RetryReason = (@([string]$st.RetryReason, [string]$stored.Reason) | Where-Object { $_ }) -join ' | '
|            & $Log 'WARN' ('step {0} {1}: {2}' -f $st.Order, $st.Job, $stored.Reason)
|        }
|        if ($onOwn) {
|            $st.RetryReason = (@([string]$st.RetryReason, [string]$own.Reason) | Where-Object { $_ }) -join ' | '
|            & $Log 'WARN' ('step {0} {1}: {2}' -f $st.Order, $st.Job, $own.Reason)
|        }
|        $st.State = 'Starting'; $st.StartedUtc = ([datetime](& $Now)).ToUniversalTime()
|        if (-not $firstStart.ContainsKey([string]$st.Job)) { $firstStart[[string]$st.Job] = $st.StartedUtc }
|        & $saveNow
|        try {
|            # a job that is already running is not started again: the step follows that execution as its own run
|            $already = $null
|            if ($Running) {
|                try { $already = & $Running $st.Job }
|                catch { $already = $null; & $Log 'INFO' ('step {0} {1}: whether its job is already running could not be checked ({2}) -- it is started' -f $st.Order, $st.Job, $_.Exception.Message) }
|            }
|            $st.Attempts = [int]$st.Attempts + 1
|            if ($already -and [string]$already.Execution) {
|                $st.Execution = [string]$already.Execution; $st.State = 'Running'
|                $alreadySince = ''
|                if ($already.StartedUtc) {
|                    $alreadySince = ', started {0:u}' -f ([datetime]$already.StartedUtc).ToUniversalTime()
|                    # what that run collects counts for this step from ITS start (the source's state)
|                    $firstStart[[string]$st.Job] = ([datetime]$already.StartedUtc).ToUniversalTime()
|                }
|                & $Log 'INFO' ('step {0} {1}: already running ({2}{3}) -- the pipeline follows it instead of starting another' -f $st.Order, $st.Job, $st.Execution, $alreadySince)
|                # the run's own note says it too (the pipeline page shows the note; its column holds 400)
|                $state.Note = ('{0} {1} was already running ({2}{3}) -- the pipeline followed that run instead of starting another.' -f [string]$state.Note, $st.Job, $st.Execution, $alreadySince).Trim()
|                if ($state.Note.Length -gt 400) { $state.Note = $state.Note.Substring(0, 400) }
|            } else {
|                $exec = [string](& $Start $st.Job)
|                $st.Execution = $exec; $st.State = 'Running'
|                & $Log 'INFO' ('step {0} {1}: started ({2})' -f $st.Order, $st.Job, $exec)
|            }
|        } catch {
|            $st.State = 'Failed'; $st.ErrorClass = 'start-failed'; $st.Error = [string]$_.Exception.Message; $st.EndedUtc = ([datetime](& $Now)).ToUniversalTime()
|            & $Log 'WARN' ('step {0} {1}: could not start -- {2}' -f $st.Order, $st.Job, $st.Error)
|            & $sourceEnded $st
|        }
|        & $saveNow
|        if ($OnStep) { try { & $OnStep $state $st 'Start' } catch { } ; if ($st.State -eq 'Failed') { try { & $OnStep $state $st 'End' } catch { } } }
|    }
|    # one poll of one running step ($st). Dot-sourced: it reads and sets this function's variables.
|    $pollStep = {
|        param($st)
|        $tNow = ([datetime](& $Now)).ToUniversalTime()
|        $status = ''; $statusError = ''
|        try {
|            $pr = & $Poll $st.Job $st.Execution
|            # #475: a Collect step in parts answers @{ Status; Error } when its collection failed (the parts named)
|            if ($null -ne $pr -and $pr -isnot [string] -and $pr.PSObject.Properties['Status']) { $status = [string]$pr.Status; $statusError = [string]$pr.Error } else { $status = [string]$pr }
|        } catch { & $Log 'WARN' ('step {0} {1}: its status could not be read ({2}) -- trying again' -f $st.Order, $st.Job, $_.Exception.Message) }
|        $ended = $false
|        switch -Regex ($status) {
|            '^(?i)succeeded$' { $st.State = 'Success'; $ended = $true }
|            # #700: an execution STOPPED from outside the pipeline (in Azure, by a person, by a release tool) was ended on
|            # purpose -- not a platform error: it is never started again as one, and the run does not go on
|            # (Get-SIJobFlowBlocked). A job stopped at its OWN run limit is still self-healed below (that is checked by the
|            # time it ran, whatever Azure calls it).
|            '^(?i)stopped$' {
|                $st.State = 'Interrupted'; $ended = $true; $st.ErrorClass = 'stopped'
|                $st.Error = if ($statusError) { $statusError } else { Get-SIJobFlowStoppedText -Job ([string]$st.Job) }
|            }
|            '^(?i)(failed|degraded|cancelled|canceled)$' {
|                $st.State = 'Failed'; $ended = $true
|                if ($statusError) { $st.ErrorClass = 'parts-failed'; $st.Error = $statusError }
|                else {
|                    $st.ErrorClass = 'job-failed'; $st.Error = ('the execution ended {0}' -f $status.ToLowerInvariant())
|                    # the job ended at its OWN run limit (Azure stopped it, not the pipeline): say so, and what raises it
|                    $jobMin = if ($jobLimits.ContainsKey([string]$st.Job)) { [int]$jobLimits[[string]$st.Job] } else { 0 }
|                    $ran = if ($st.StartedUtc) { ($tNow - ([datetime]$st.StartedUtc).ToUniversalTime()).TotalMinutes } else { 0 }
|                    if ($jobMin -gt 0 -and $ran -ge ($jobMin - 2)) {
|                        $st.Error = ('{0} after {1} minutes -- it ran until its job''s own run limit ({2} minutes). Every update gives every step''s job the longest run limit Azure takes' -f $st.Error, [int]$ran, $jobMin)
|                    }
|                }
|            }
|        }
|        # #945: the status could not be read, and a wake-up of the pipeline may have closed this step meanwhile (it read
|        # that the execution had ENDED -- Get-SIJobFlowEndedExecutionCloses): the close is taken over, so the step ends here
|        # by the normal rules (its dependants are judged, the run goes on or ends). Only a row of THIS execution that is no
|        # longer Running; a store without the read, or a read that fails, changes nothing.
|        $adoptedEnd = $null
|        if (-not $ended -and -not $status -and $Store -and $Store.PSObject.Methods['StepRow']) {
|            $row = $null
|            try { $row = $Store.StepRow([string]$state.FlowRunId, [int]$st.Order) } catch { $row = $null }
|            if ($row -and [string]$row.Execution -eq [string]$st.Execution -and [string]$row.State -in @('Success', 'Failed', 'Interrupted')) {
|                $st.State = [string]$row.State; $st.ErrorClass = [string]$row.ErrorClass; $st.Error = [string]$row.Error; $ended = $true
|                if ($row.EndedUtc) { $adoptedEnd = ([datetime]$row.EndedUtc).ToUniversalTime() }
|                & $Log 'WARN' ('step {0} {1}: its execution {2} had ended ({3}) -- closed by the pipeline''s wake-up check; the run goes on by the normal rules' -f $st.Order, $st.Job, $st.Execution, ([string]$row.State).ToLowerInvariant())
|            }
|        }
|        if (-not $ended) {
|            $lim = & $limitOf $st
|            $since = if ($st.StartedUtc) { ([datetime]$st.StartedUtc).ToUniversalTime() } else { $tNow }
|            $sk = [string]$st.Job
|            # NO GIVE-UP ON ELAPSED TIME (owner 2026-10-13): the pipeline stops no step for the time it takes. The
|            # step's timeout is the time after which it SAYS so, once for this step in this run -- the step keeps
|            # running. What ends a step is its own end (the job finished, failed, or Azure stopped it at the job's
|            # own run limit); what watches a step that stands still is the no-progress report below.
|            if (($tNow - $since).TotalMinutes -ge [int]$lim.Configured -and -not $overdueSaid.ContainsKey($sk) -and [string]$st.RetryReason -notmatch 'longer than its step timeout') {
|                $overdueSaid[$sk] = $true
|                $late = Get-SIJobFlowOverdueText -Job $sk -RunMinutes ([int]($tNow - $since).TotalMinutes) -TimeoutMinutes ([int]$lim.Configured)
|                & $Log 'WARN' ('step {0} {1}: {2}' -f $st.Order, $sk, $late)
|                $st.RetryReason = (@([string]$st.RetryReason, $late) | Where-Object { $_ }) -join ' | '
|                & $saveNow
|            }
|            # NO SIGN OF PROGRESS: reported once for this step in this run -- the step keeps running, nothing is stopped
|            if (-not $ended -and $Progress -and $SilentAfterMinutes -gt 0 -and ($tNow - $since).TotalMinutes -ge $SilentAfterMinutes -and
|                -not $silentSaid.ContainsKey($sk) -and [string]$st.RetryReason -notmatch 'no sign of progress' -and
|                (-not $progressAsked.ContainsKey($sk) -or ($tNow - [datetime]$progressAsked[$sk]).TotalMinutes -ge $ProgressCheckMinutes)) {
|                $progressAsked[$sk] = $tNow
|                $pg = $null
|                try { $pg = if ($Progress -is [scriptblock]) { & $Progress $st.Job $st.Execution $since } else { $Progress.Probe($st.Job, $st.Execution, $since) } } catch { $pg = $null }
|                $seen = if ($pg -and $pg.PSObject.Properties['LastSeenUtc'] -and $pg.LastSeenUtc) { ([datetime]$pg.LastSeenUtc).ToUniversalTime() } else { $null }
|                if ($seen -and ($tNow - $seen).TotalMinutes -ge $SilentAfterMinutes) {
|                    $silentSaid[$sk] = $true
|                    $quiet = Get-SIJobFlowSilentText -Job $sk -SilentMinutes ([int]($tNow - $seen).TotalMinutes) -LastSeenUtc $seen -NoticedUtc $tNow
|                    & $Log 'WARN' ('step {0} {1}: {2}' -f $st.Order, $sk, $quiet)
|                    $st.RetryReason = (@([string]$st.RetryReason, $quiet) | Where-Object { $_ }) -join ' | '
|                    if ($OnStep) { try { & $OnStep $state $st 'Silent' } catch { } }
|                }
|            }
|        }
|        # SELF-HEALING: the step's job (or the producer / a worker of its collection) was stopped at its OWN run limit --
|        # the limit is raised by the update's sizing rule and the step is started again, ONCE in this run.
|        # A stop Azure reports for a job at its own run limit is first recorded Interrupted (class 'stopped'): checked here too.
|        if ($ended -and $LimitHit -and $RaiseLimit -and ($st.State -in @('Failed', 'TimedOut') -or ($st.State -eq 'Interrupted' -and [string]$st.ErrorClass -eq 'stopped'))) {
|            $hit = $null
|            try { $hit = & $LimitHit $st.Job $st.Execution $(if ($st.StartedUtc) { ([datetime]$st.StartedUtc).ToUniversalTime() } else { $tNow }) }
|            catch { & $Log 'WARN' ('step {0} {1}: whether it was stopped at its run limit could not be checked ({2})' -f $st.Order, $st.Job, $_.Exception.Message) }
|            if ($hit) {
|                # stopped at its own run limit: a failure of the step's job (not a stop from outside)
|                if ($st.State -eq 'Interrupted') { $st.State = 'Failed' }
|                $was = Get-SIJobFlowHoursText -Seconds ([int]$hit.LimitSeconds)
|                if ([string]$st.RetryReason -match 'was stopped at its run limit') {
|                    # the one retry of this run is used: never a third start
|                    $st.ErrorClass = 'timeout'
|                    $st.Error = ('{0} was stopped at its run limit again ({1}), after the limit was raised and the step was started again once in this run -- it is not started a third time' -f $hit.JobName, $was)
|                } else {
|                    $rz = $null
|                    try { $rz = & $RaiseLimit $hit } catch { $rz = [pscustomobject]@{ Restart = $false; NewSeconds = 0; Why = [string]$_.Exception.Message } }
|                    if ($rz -and $rz.Restart) {
|                        $healLine = ('{0} was stopped at its run limit of {1}; the limit is now {2} and the step is started again' -f $hit.JobName, $was, (Get-SIJobFlowHoursText -Seconds ([int]$rz.NewSeconds)))
|                        & $Log 'WARN' ('step {0} {1}: {2}' -f $st.Order, $st.Job, $healLine)
|                        $st.RetryReason = $healLine; $st.Error = $healLine; $st.ErrorClass = 'run-limit-raised'
|                        if ($OnStep) { try { & $OnStep $state $st 'Heal' } catch { } }
|                        $st.State = 'Starting'; $st.ErrorClass = ''; $st.Error = ''; $st.EndedUtc = $null; $st.StartedUtc = ([datetime](& $Now)).ToUniversalTime()
|                        & $saveNow
|                        # the job's limit changed: read again (and said again) for the second start
|                        $jobLimits.Remove([string]$st.Job); $saidLimit.Remove([string]$st.Job)
|                        try {
|                            $st.Attempts = [int]$st.Attempts + 1
|                            $st.Execution = [string](& $Start $st.Job); $st.State = 'Running'; $ended = $false
|                            & $Log 'INFO' ('step {0} {1}: started again ({2}, attempt {3})' -f $st.Order, $st.Job, $st.Execution, $st.Attempts)
|                        } catch {
|                            $st.State = 'Failed'; $st.ErrorClass = 'start-failed'; $st.Error = [string]$_.Exception.Message; $tNow = ([datetime](& $Now)).ToUniversalTime()
|                        }
|                    } else {
|                        $st.ErrorClass = 'timeout'
|                        $st.Error = ('{0} was stopped at its run limit of {1} and is not started again: {2}' -f $hit.JobName, $was, $(if ($rz -and $rz.Why) { [string]$rz.Why } else { 'the limit could not be raised' }))
|                    }
|                }
|            }
|        }
|        # Working rule 4: a container that died before the engine ran is a PLATFORM failure -- started again; a
|        # failure of the engine itself never is. Classified only after the pause, so the engine's records arrive.
|        if ($ended -and $StartEvidence -and $st.State -eq 'Failed' -and $st.ErrorClass -eq 'job-failed') {
|            $began = if ($st.StartedUtc) { ([datetime]$st.StartedUtc).ToUniversalTime() } else { $tNow }
|            if ($StartRetryBackoffSeconds -gt 0) { & $Sleep $StartRetryBackoffSeconds }
|            $ev = $null
|            try { $ev = if ($StartEvidence -is [scriptblock]) { & $StartEvidence $st.Job $st.Execution $began $tNow } else { $StartEvidence.Probe($st.Job, $st.Execution, $began, $tNow) } }
|            catch { & $Log 'WARN' ('step {0} {1}: whether it started could not be checked ({2})' -f $st.Order, $st.Job, $_.Exception.Message) }
|            $hasRow = if ($ev -and $ev.PSObject.Properties['HasStartRecord']) { $ev.HasStartRecord } else { $null }
|            $hasLog = if ($ev -and $ev.PSObject.Properties['HasTranscript']) { $ev.HasTranscript } else { $null }
|            $cls = Get-SIJobFlowFailureClass -ErrorClass $st.ErrorClass -HasStartRecord $hasRow -HasTranscript $hasLog -DurationSeconds ($tNow - $began).TotalSeconds `
|                       -MaxSeconds $NeverStartedMaxSeconds -Attempts ([int]$st.Attempts) -Retries $StartRetries
|            if ($cls.Class -eq 'never-started' -and $cls.Retry) {
|                $failedExec = [string]$st.Execution
|                $st.RetryReason = Get-SIJobFlowRetryText -Kind retried -Execution $failedExec
|                & $Log 'WARN' ('step {0} {1}: {2} -- {3}' -f $st.Order, $st.Job, $st.RetryReason, $cls.Why)
|                $st.State = 'Starting'; $st.ErrorClass = ''; $st.Error = ''; $st.EndedUtc = $null; $st.StartedUtc = ([datetime](& $Now)).ToUniversalTime()
|                & $saveNow
|                try {
|                    $st.Attempts = [int]$st.Attempts + 1
|                    $st.Execution = [string](& $Start $st.Job); $st.State = 'Running'; $ended = $false
|                    & $Log 'INFO' ('step {0} {1}: started again ({2}, attempt {3})' -f $st.Order, $st.Job, $st.Execution, $st.Attempts)
|                } catch {
|                    $st.State = 'Failed'; $st.ErrorClass = 'start-failed'; $st.Error = [string]$_.Exception.Message; $tNow = ([datetime](& $Now)).ToUniversalTime()
|                }
|            } elseif ($cls.Class -eq 'never-started') {
|                $st.ErrorClass = 'never-started'; $st.Error = Get-SIJobFlowRetryText -Kind gave-up -Attempts ([int]$st.Attempts)
|            } else {
|                & $Log 'INFO' ('step {0} {1}: {2}' -f $st.Order, $st.Job, $cls.Why)
|                # #532 THROTTLE-IS-NORMAL: the engine ran and recorded that Microsoft only throttled it (nothing written).
|                # Its END record can arrive a little after the execution ends: asked once more after the same pause.
|                $endWhy = if ($ev -and $ev.PSObject.Properties['EndReason']) { $ev.EndReason } else { $null }
|                if ($null -eq $endWhy -and $hasRow -eq $true -and $ev -and $ev.PSObject.Properties['EndReason']) {
|                    if ($StartRetryBackoffSeconds -gt 0) { & $Sleep $StartRetryBackoffSeconds }
|                    try {
|                        $ev2 = if ($StartEvidence -is [scriptblock]) { & $StartEvidence $st.Job $st.Execution $began $tNow } else { $StartEvidence.Probe($st.Job, $st.Execution, $began, $tNow) }
|                        if ($ev2 -and $ev2.PSObject.Properties['EndReason']) { $endWhy = $ev2.EndReason }
|                    } catch { }
|                }
|                # the step's REAL error text is kept (2026-10-22: it was replaced by "Microsoft throttled this run", and the
|                # real cause -- a storage timeout -- was gone from Operations > Jobs); the words only fill an empty one
|                if ($endWhy -eq 'throttled') { $st.ErrorClass = 'throttled'; if ([string]::IsNullOrWhiteSpace([string]$st.Error)) { $st.Error = Get-SIThrottleText } }
|                # 3.0.30: the engine wrote its run log, so the job itself failed -- the step is named by ITS OWN error (the
|                # last ERROR line of that log, Get-SIErrorClass), not by the bare 'job-failed' that reached the report as
|                # "unknown". A class the log does not tell, or a log that cannot be read, leaves the step as it was.
|                # (the reader finds THIS step's log in the execution's window; none = nothing changes)
|                if ($StepLogs -and $cls.Class -eq 'engine-failed' -and [string]$st.ErrorClass -eq 'job-failed') {
|                    $sl = $null
|                    try { $sl = if ($StepLogs -is [scriptblock]) { & $StepLogs $st.Job $began $tNow } else { $StepLogs.Read([string]$st.Job, $began, $tNow) } }
|                    catch { & $Log 'WARN' ('step {0} {1}: its run log could not be read ({2})' -f $st.Order, $st.Job, $_.Exception.Message) }
|                    if ($sl -and $sl.PSObject.Properties['Lines']) {
|                        $lc = Get-SIJobFlowLogErrorClass -Lines @($sl.Lines)
|                        if ($lc.ErrorClass) {
|                            $st.ErrorClass = [string]$lc.ErrorClass
|                            $st.Error = Get-SIJobFlowStepCauseText -Recorded ([string]$st.Error) -Cause ([string]$lc.Line)
|                            & $Log 'INFO' ('step {0} {1}: its run log names the error ({2}): {3}' -f $st.Order, $st.Job, $lc.ErrorClass, $lc.Line)
|                        }
|                    }
|                }
|            }
|        }
|        # A NEW INSTALL'S FIRST COLLECTION -- "two restarts" (owner 2026-10-13): a step that failed or was stopped is
|        # started again at once (the step's own engine carries on from what it finished), up to -FirstRunRestarts
|        # times; each restart is kept in the step's own record. After that the step stays failed, and the run ends
|        # with the warning that names it. Never a step that writes to the customer's systems; never a step Microsoft
|        # only throttled; never after the first complete collection.
|        # #700 (owner 2026-10-15: "Stop is final"): never a step whose execution was STOPPED on purpose -- also not on a first
|        # collection; a platform failure is still started again
|        if ($ended -and $FirstRun -and $FirstRunRestarts -gt 0 -and $st.State -in @('Failed', 'TimedOut') -and [string]$st.ErrorClass -notin @('throttled', 'stopped') -and [string]$state.Scope -ne 'step') {
|            $mayAgain = $false; try { $mayAgain = Test-SIPipelineFirstRunRestartStep -Step $st -Map $Map } catch { $mayAgain = $false }
|            if ($mayAgain) {
|                . $askFirstRun
|                $doneAgain = Get-SIPipelineFirstRunRestartCount -Step $st
|                if ($isFirstRun -and $doneAgain -lt $FirstRunRestarts) {
|                    $againLine = Get-SIPipelineFirstRunRestartText -Job ([string]$st.Job) -Why ([string]$st.Error) -Restart ($doneAgain + 1) -Of $FirstRunRestarts
|                    & $Log 'WARN' ('step {0} {1}: {2}' -f $st.Order, $st.Job, $againLine)
|                    $st.RetryReason = (@([string]$st.RetryReason, $againLine) | Where-Object { $_ }) -join ' | '
|                    $st.State = 'Starting'; $st.ErrorClass = ''; $st.Error = ''; $st.EndedUtc = $null; $st.StartedUtc = ([datetime](& $Now)).ToUniversalTime()
|                    & $saveNow
|                    try {
|                        $st.Attempts = [int]$st.Attempts + 1
|                        $st.Execution = [string](& $Start $st.Job); $st.State = 'Running'; $ended = $false
|                        & $Log 'INFO' ('step {0} {1}: started again ({2}, attempt {3})' -f $st.Order, $st.Job, $st.Execution, $st.Attempts)
|                    } catch {
|                        $st.State = 'Failed'; $st.ErrorClass = 'start-failed'; $st.Error = [string]$_.Exception.Message; $tNow = ([datetime](& $Now)).ToUniversalTime()
|                    }
|                } elseif ($isFirstRun -and $doneAgain -gt 0) {
|                    $st.Error = ('{0} -- also after {1} restart(s) on this first collection' -f [string]$st.Error, $doneAgain)
|                }
|            }
|        }
|        if ($ended) {
|            $st.EndedUtc = if ($adoptedEnd -and [string]$st.State -ne 'Starting' -and [string]$st.State -ne 'Running') { $adoptedEnd } else { $tNow }
|            & $Log $(if ($st.State -eq 'Success') { 'INFO' } else { 'WARN' }) ('step {0} {1}: {2}{3}' -f $st.Order, $st.Job, $st.State.ToLowerInvariant(), $(if ($st.Error) { ' -- ' + $st.Error } else { '' }))
|            # #882: a step that ended without success leaves no worker running for it (its producer died or was stopped;
|            # its queue workers would go on writing for a run nobody finishes)
|            if ($st.State -ne 'Success') { & $stopStepWork $st }
|            & $sourceEnded $st
|            if ($OnStep) { try { & $OnStep $state $st 'End' } catch { } }
|            # A FIRST COLLECTION, "wait for merged assets": the asset build has finished whole -> the merged assets
|            # are shown at once (asked once per run; never when the web app must not show a run that is not complete)
|            if ($st.State -eq 'Success' -and $FirstRun -and -not $firstDelivered -and $GoOnAfterFailedStep -and [string]$state.Scope -eq 'pipeline' -and (Test-SIPipelineAssetBuild -Job ([string]$st.Job) -Map $Map)) {
|                $firstDelivered = $true
|                . $askFirstRun
|                $fd = $null
|                if ($isFirstRun) { try { $fd = Get-SIPipelineFirstDeliveryStep -State $state -Map $Map } catch { $fd = $null } }
|                if ($fd) { . $deliverFirst }
|            }
|        }
|    }
|    while ($true) {
|        # #700: a run cancelled meanwhile starts no further step and is not followed any further (its executions are asked to
|        # stop after the loop) -- asked before any step starts and at every poll
|        . $askCancelled
|        if ($cancelHit) { break }
|        # the steps that may start now -- together, judged on the run as it is at this moment (as one group was before)
|        $ready = New-Object System.Collections.Generic.List[object]
|        foreach ($w in @(@($state.Steps) | Where-Object { [string]$_.State -eq 'Waiting' })) { $wa = & $readyOf $w; if ($wa) { $ready.Add([pscustomobject]@{ Step = $w; Awaited = $wa }) } }
|        if ($ready.Count) {
|            $blocked = Get-SIJobFlowBlocked -State $state -Definition $Definition -Map $Map
|            $gates = @{}
|            foreach ($r in $ready) { if ([string]$r.Step.State -eq 'Waiting') { . $startStep $r.Step $r.Awaited } }
|            continue
|        }
|        # (not $running: the -Running seam is a parameter of this function)
|        # the delivery at once of a first collection is followed here, beside the steps -- it never holds them
|        $fdWas = [bool]$fdSide
|        . $pollFirstDelivery
|        # it has just ended: its step waits again -- judge the run anew (it may start now), never "not reached"
|        if ($fdWas -and -not $fdSide) { continue }
|        $runningNow =@(@($state.Steps) | Where-Object { [string]$_.State -eq 'Running' -and -not (& $isFirstDelivery $_) })
|        if (-not $runningNow.Count -and $fdSide) {
|            # only the delivery at once still runs: wait for it (its step then goes back to waiting and runs at its place)
|            & $saveNow
|            & $Sleep $PollSeconds
|            continue
|        }
|        if (-not $runningNow.Count) {
|            $left = @(@($state.Steps) | Where-Object { [string]$_.State -eq 'Waiting' })
|            if (-not $left.Count) { break }
|            # nothing runs and nothing may start: never by the rules above (the first waiting step waits only for steps above
|            # it) -- said, and the steps left are recorded as not reached rather than left waiting
|            foreach ($x in $left) { $x.State = 'Skipped'; $x.ErrorClass = 'not-reached'; $x.Error = 'the pipeline did not reach this step: a step it waits for never ended' }
|            & $Log 'WARN' ('the pipeline could not reach {0} -- a step they wait for never ended' -f (@($left | ForEach-Object { [string]$_.Job }) -join ', '))
|            break
|        }
|        foreach ($st in $runningNow) { . $pollStep $st }
|        . $longCheck
|        & $saveNow
|        # wait for the running steps -- unless a step may start now (#754: one that waits only for what it reads)
|        if (@(@($state.Steps) | Where-Object { [string]$_.State -eq 'Running' }).Count) {
|            $now2 = $false
|            foreach ($w in @(@($state.Steps) | Where-Object { [string]$_.State -eq 'Waiting' })) { if (& $readyOf $w) { $now2 = $true; break } }
|            if (-not $now2) { & $Sleep $PollSeconds }
|        }
|    }
|    # #700: THE RUN WAS CANCELLED (asked once more here: a cancel can land between the last check and the end, and its
|    # stopped executions would otherwise read as "stopped from outside"). Nothing more starts; what still runs is asked to
|    # stop; the run ends Cancelled -- a finished state, never resumed.
|    . $askCancelled
|    if ($cancelHit) {
|        $cut = Set-SIPipelineRunCancelled -State $state -By ([string]$cancelHit.By) -Reason ([string]$cancelHit.Reason) -NowUtc ([datetime](& $Now)).ToUniversalTime() -Stop $Stop -StopWorkers $StopWorkers
|        & $saveNow
|        & $Log 'WARN' $cut.Text
|        $state | Add-Member -NotePropertyName Outcome -NotePropertyValue $decision -Force
|        return $state
|    }
|    $blocked = Get-SIJobFlowBlocked -State $state -Definition $Definition -Map $Map
|    $failed = @($state.Steps | Where-Object { $script:SIJobFlow.Failures -contains $_.State })
|    $state.State = if ($blocked.Stopped) { 'Stopped' } elseif ($failed.Count) { 'Failed' } else { 'Succeeded' }
|    $state.StopReason = $blocked.StopReason
|    $state.EndedUtc = ([datetime](& $Now)).ToUniversalTime()
|    # THE RUN WENT ON WITHOUT A SOURCE: said in plain words in the log and kept in the run's own note (the pipeline page
|    # shows the note; the note's column holds 400). The run stays Failed -- its failed step is never shown as succeeded.
|    $wentOn = ''
|    try { $wentOn = Get-SIPipelineWentOnText -State $state -Definition $Definition } catch { $wentOn = '' }
|    if ($wentOn) {
|        & $Log 'WARN' $wentOn
|        if ([string]$state.Note -notmatch 'this run went on without') {
|            $state.Note = ('{0} {1}' -f [string]$state.Note, $wentOn).Trim()
|            if ($state.Note.Length -gt 400) { $state.Note = $state.Note.Substring(0, 400) }
|        }
|    }
|    # A FIRST COLLECTION HAS ENDED: the "running" words leave the note (the note's column holds 400, and what follows says
|    # how it ended); a first collection that ended whole says so.
|    try {
|        if ([string]$state.Note -match [regex]::Escape($script:SIPipelineFirstRunningMark)) {
|            foreach ($fk in 'Running', 'Delivered', 'NotDelivered') {
|                foreach ($fj in @(@($state.Steps | ForEach-Object { [string]$_.Job }) + 'asset-datasync' | Select-Object -Unique)) { $state.Note = ([string]$state.Note).Replace((Get-SIPipelineFirstRunText -Kind $fk -Job $fj), '') }
|            }
|            $state.Note = (([string]$state.Note) -replace '\s{2,}', ' ').Trim()
|            if ($state.State -eq 'Succeeded') {
|                $state.Note = ('{0} {1}' -f (Get-SIPipelineFirstRunText -Kind Complete), [string]$state.Note).Trim()
|                if ($state.Note.Length -gt 400) { $state.Note = $state.Note.Substring(0, 400) }
|                & $Log 'INFO' (Get-SIPipelineFirstRunText -Kind Complete)
|            }
|        }
|    } catch { }
|    # ONE FAILED STEP DID NOT COST THE REST OF THE RUN: which step failed, which ran all the same and which were held, in
|    # plain words -- in the log, and FIRST in the run's own note (the pipeline page shows the note). The run stays Failed.
|    try {
|        if (Test-SIPipelinePartialRun -State $state) {
|            . $askFirstRun
|            $isFirst = [bool]$isFirstRun
|            & $Log 'WARN' (Get-SIPipelinePartialText -State $state -Definition $Definition -Map $Map -FirstRun:$isFirst)
|            if ([string]$state.Note -notmatch 'not complete( yet)?: ') {
|                $state.Note = ('{0} {1}' -f (Get-SIPipelinePartialText -State $state -Definition $Definition -Map $Map -FirstRun:$isFirst -Short), [string]$state.Note).Trim()
|                if ($state.Note.Length -gt 400) { $state.Note = $state.Note.Substring(0, 400) }
|            }
|        }
|    } catch { & $Log 'WARN' ('what this run delivered after its failed step could not be put into words ({0})' -f $_.Exception.Message) }
|    # delivery waited for a source that is too old: the run's note says so too (it was logged when Deliver would have started)
|    if ($deliverHoldWhy -and [string]$state.Note -notmatch 'delivery waits:') {
|        $state.Note = ('{0} {1}' -f [string]$state.Note, $deliverHoldWhy).Trim()
|        if ($state.Note.Length -gt 400) { $state.Note = $state.Note.Substring(0, 400) }
|    }
|    & $saveNow
|    & $Log $(if ($state.State -eq 'Succeeded') { 'INFO' } else { 'WARN' }) ('flow run {0}: {1} ({2})' -f $state.FlowRunId, $state.State.ToLowerInvariant(), (Get-SIJobFlowSummary -State $state))
|    $state | Add-Member -NotePropertyName Outcome -NotePropertyValue $decision -Force
|    $state
|}
|
|function Get-SIJobFlowSummary {
|    <# PURE. "12 success, 1 failed, 2 skipped" -- the run's step outcomes in one line (run health + telemetry). #>
|    param([Parameter(Mandatory)]$State)
|    (@($State.Steps) | Group-Object State | Sort-Object Name | ForEach-Object { '{0} {1}' -f $_.Count, $_.Name.ToLowerInvariant() }) -join ', '
|}
|
|function Get-SIJobFlowExitReason {
|    <# PURE. The run-health ExitReason of a step / the flow: success | error | skipped | disabled | timeout | interrupted. #>
|    param([Parameter(Mandatory)][string]$State)
|    switch ($State) {
|        'Success' { 'success' } 'Succeeded' { 'success' } 'Failed' { 'error' } 'Stopped' { 'error' } 'TimedOut' { 'timeout' }
|        'Interrupted' { 'interrupted' } 'Skipped' { 'skipped' } 'Disabled' { 'disabled' }
|        # #700: a run cancelled on purpose (a person, the updater) is not an error and opens no fix request
|        'Cancelled' { 'skipped' }
|        default { $State.ToLowerInvariant() }
|    }
|}
|
|function Test-SIJobFlowStepThrottled {
|    <# PURE. #532: a step that failed only because Microsoft throttled its engine (State Failed, ErrorClass 'throttled'). #>
|    param([AllowNull()]$Step)
|    ($null -ne $Step) -and ([string]$Step.State -eq 'Failed') -and ([string]$Step.ErrorClass -eq 'throttled')
|}
|
|function Get-SIJobFlowStepExitReason {
|    <# PURE. #532: a step's run-health ExitReason -- 'throttled' for a throttled step, else Get-SIJobFlowExitReason. #>
|    param([Parameter(Mandatory)]$Step)
|    if (Test-SIJobFlowStepThrottled $Step) { return 'throttled' }
|    Get-SIJobFlowExitReason ([string]$Step.State)
|}
|
|function Test-SIJobFlowThrottledOnly {
|    <# PURE. #532: the run did not succeed, and EVERY step that failed (Failed / TimedOut / Interrupted) failed only because
|       Microsoft throttled it. A timeout of the step itself, an interruption or any other failure is a real failure. #>
|    param([Parameter(Mandatory)]$State)
|    if ([string]$State.State -notin @('Failed', 'Stopped')) { return $false }
|    $bad = @(@($State.Steps) | Where-Object { $script:SIJobFlow.Failures -contains [string]$_.State })
|    if ($bad.Count -eq 0) { return $false }
|    foreach ($s in $bad) { if (-not (Test-SIJobFlowStepThrottled $s)) { return $false } }
|    $true
|}
|
|function Get-SIJobFlowRunExitReason {
|    <# PURE. #532: the flow run's run-health ExitReason -- 'throttled' when its only failures were throttled steps (no
|       failure mail, Outcome warning, exit 0), else Get-SIJobFlowExitReason of the run's state. #>
|    param([Parameter(Mandatory)]$State)
|    if (Test-SIJobFlowThrottledOnly -State $State) { return 'throttled' }
|    # a run whose only failures are steps stopped from outside / cancelled on purpose: 'interrupted' -- not an error of
|    # the product, never reported as a failure (no fix request), the step's own record says it was stopped
|    if (Test-SIJobFlowStoppedOnly -State $State) { return 'interrupted' }
|    # one failed step did not cost the rest of the run: every step that ran all the same (on what is stored, or in full
|    # after a nice-to-have step failed) succeeded, so the run's own record is a WARNING ('success-partial') that NAMES THE
|    # FAILED STEP -- never 'success', never an error that stops, never silent. THE WARNING OPENS A FIX REQUEST (owner
|    # 2026-10-13: "Warning that opens a fix request"): the report to Invardia carries Outcome warning + FailedStep (the step
|    # the run went on after) + that step's own error class and FixKind (SI-TelemetrySend.ps1), and Invardia treats a warning
|    # that names a failed step as a fix request. A run that was stopped, or in which such a step failed too, stays 'error'.
|    if ([string]$State.State -eq 'Failed' -and (Test-SIPipelineWentOn -State $State -AllSucceeded)) { return 'success-partial' }
|    Get-SIJobFlowExitReason ([string]$State.State)
|}
|
|# =====================================================================================================================
|#  Adapters -- ARM (container), local processes (VM), run-record stores
|# =====================================================================================================================
|function New-SIJobFlowSeams {
|    <#
|        An adapter object whose METHODS are the runner's seams (Start / Poll / Stop, and List where it can). Methods, not
|        closures: a GetNewClosure() scriptblock runs in its own module scope and cannot see the functions a script
|        dot-sourced (measured: "Get-SIJobFlowJobName is not recognized"). -Fields become note properties ($this.<name>).
|    #>
|    param([Parameter(Mandatory)][hashtable]$Fields, [Parameter(Mandatory)][hashtable]$Methods)
|    $o = New-Object psobject
|    foreach ($k in $Fields.Keys) { $o | Add-Member -NotePropertyName $k -NotePropertyValue $Fields[$k] }
|    foreach ($k in $Methods.Keys) { $o | Add-Member -MemberType ScriptMethod -Name $k -Value $Methods[$k] }
|    $o
|}
|
|function Test-SIJobFlowStopAlreadyEnded {
|    <# PURE. Is this the answer ARM gives to a stop of an execution that has already ended (live 2026-10-23: 400 "job
|       execution ... not found" when the runner stopped executions that had finished)? Then the execution is already
|       stopped: not a failure of the stop. Anything else (no access, the job itself missing, a throttle) is a failure. #>
|    param([AllowEmptyString()][AllowNull()][string]$Message)
|    [bool]("$Message" -match '(?is)\bexecution\b.{0,300}\bnot\s+found\b|ExecutionNotFound|JobExecutionNotFound')
|}
|
|function New-SIJobFlowArmSeams {
|    <#
|        Start / Poll / Stop / List over Azure Resource Manager (Container Apps jobs), as the job's own identity
|        (Invoke-SIArm: managed identity in a container, else the SPN). -Arm is the call seam (tests): { param($Method, $Path, $Body) }.
|        Needs 'Container Apps Jobs Contributor' on the jobs' resource group (Bootstrap grants it with -GrantIdentityRoles).
|    #>
|    param([Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup, [scriptblock]$Arm, [string]$ApiVersion = $script:SIJobFlow.ArmApi)
|    if (-not $Arm) { $Arm = { param($Method, $Path, $Body) Invoke-SIArm -Method $Method -Path $Path -ApiVersion $script:SIJobFlow.ArmApi -Body $Body } }
|    New-SIJobFlowSeams -Fields @{ Arm = $Arm; Base = ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs' -f $SubscriptionId, $ResourceGroup) } -Methods @{
|        Start = { param($Job) $r = & $this.Arm 'POST' ('{0}/{1}/start' -f $this.Base, (Get-SIJobFlowJobName $Job)) @{}
|                  $n = [string]$r.name; if (-not $n -and $r.id) { $n = ([string]$r.id -split '/')[-1] }
|                  if (-not $n) { throw 'the start returned no execution name' }; $n }
|        # #945: when the read of the one execution fails or says nothing, its status is taken from the job's execution LIST
|        # (live 2026-10-28, a customer install: the step's execution ended Failed and the runner kept "trying again" for days). Neither
|        # answers = the first error is thrown (the runner tries again at its next poll, as before).
|        Poll  = { param($Job, $Execution)
|                  $first = $null; $st = ''
|                  try { $r = & $this.Arm 'GET' ('{0}/{1}/executions/{2}' -f $this.Base, (Get-SIJobFlowJobName $Job), $Execution) $null; if ($r -and $r.PSObject.Properties['properties'] -and $r.properties) { $st = [string]$r.properties.status } }
|                  catch { $first = $_ }
|                  if ($st) { return $st }
|                  $list = $null
|                  try { $list = $this.Executions($Job) } catch { if ($first) { throw $first }; throw }
|                  $st = Get-SIJobFlowExecutionStatusOf -Executions @($list) -Execution ([string]$Execution)
|                  if ($st) { return $st }
|                  if ($first) { throw $first }
|                  '' }
|        # #945: the job's executions, every page (at most 5; Azure lists the newest first)
|        Executions = { param($Job)
|                  $all = New-Object System.Collections.Generic.List[object]; $path = '{0}/{1}/executions' -f $this.Base, (Get-SIJobFlowJobName $Job); $pg = 0
|                  while ($path -and $pg -lt 5) {
|                      $r = & $this.Arm 'GET' $path $null; $pg++
|                      foreach ($v in @($r.value)) { if ($v) { $all.Add($v) } }
|                      $path = if ($r -and $r.PSObject.Properties['nextLink'] -and $r.nextLink) { [string]$r.nextLink } else { $null }
|                  }
|                  $all.ToArray() }
|        # an execution that already ended answers 400 "job execution ... not found": it is already stopped, not a failure
|        Stop  = { param($Job, $Execution) try { $null = & $this.Arm 'POST' ('{0}/{1}/stop/{2}' -f $this.Base, (Get-SIJobFlowJobName $Job), $Execution) @{} } catch { if (-not (Test-SIJobFlowStopAlreadyEnded -Message ([string]$_.Exception.Message))) { throw } } }
|        # the job's own run limit (its replica timeout) in seconds / in whole minutes; 0 when the job does not say
|        LimitSeconds = { param($Job) $r = & $this.Arm 'GET' ('{0}/{1}' -f $this.Base, (Get-SIJobFlowJobName $Job)) $null
|                  $sec = 0; $cfg = if ($r -and $r.PSObject.Properties['properties'] -and $r.properties -and $r.properties.PSObject.Properties['configuration']) { $r.properties.configuration } else { $null }
|                  if ($cfg -and $cfg.PSObject.Properties['replicaTimeout']) { [void][int]::TryParse("$($cfg.replicaTimeout)", [ref]$sec) }
|                  [int]$sec }
|        Limit = { param($Job) [int][Math]::Floor([int]$this.LimitSeconds($Job) / 60) }
|        # SELF-HEALING: did an execution of this job end AT THE JOB'S OWN RUN LIMIT (Azure stopped it)? -Execution: that one
|        # execution; '' = any execution of the job that started at or after -SinceUtc (the workers of a collection in parts).
|        # @{ JobName; LimitSeconds; Execution } or $null.
|        LimitHit = { param($Job, $Execution, $SinceUtc)
|                  $lim = [int]$this.LimitSeconds($Job); if ($lim -le 0) { return $null }
|                  $name = Get-SIJobFlowJobName $Job
|                  $list = if ($Execution) { @(& $this.Arm 'GET' ('{0}/{1}/executions/{2}' -f $this.Base, $name, $Execution) $null) }
|                          else { $r = & $this.Arm 'GET' ('{0}/{1}/executions' -f $this.Base, $name) $null; @($r.value) }
|                  foreach ($e in @($list)) {
|                      if (Test-SIJobFlowExecutionAtLimit -Execution $e -LimitSeconds $lim -SinceUtc $(if ($Execution) { $null } else { $SinceUtc })) {
|                          return [pscustomobject]@{ JobName = $name; LimitSeconds = $lim; Execution = [string]$e.name }
|                      }
|                  }
|                  $null }
|        # an execution of this job that is running NOW (somebody else started it): @{ Execution; StartedUtc } or $null
|        Running = { param($Job) $r = & $this.Arm 'GET' ('{0}/{1}/executions' -f $this.Base, (Get-SIJobFlowJobName $Job)) $null
|                  Select-SIJobFlowRunningExecution -Executions @($r.value) }
|        # EVERY page: Azure lists 20 jobs a page. Reading only the first one left a job on page 2 out of the default pipeline
|        # (internal 2026-10-20: 26 jobs, caj-si-verification on page 2 -- no verification step, every run refused at publish,
|        # the data health check never ran). -Arm takes a nextLink as its path (Invoke-SIArm: a full URL, api-version kept).
|        List  = { $names = New-Object System.Collections.Generic.List[string]; $path = $this.Base; $seen = 0
|                  while ($path -and $seen -lt 50) {
|                      $r = & $this.Arm 'GET' $path $null; $seen++
|                      foreach ($v in @($r.value)) { if ($v) { $names.Add([string]$v.name) } }
|                      $path = if ($r -and $r.PSObject.Properties['nextLink'] -and $r.nextLink) { [string]$r.nextLink } else { $null }
|                  }
|                  $names.ToArray() }
|    }
|}
|
|function Add-SIJobFlowCollectParts {
|    <#
|        #475 -- KEDA for the Collect stage. Wraps a container's Start / Poll / Stop seams: for an engine whose PRODUCER job
|        exists (caj-si-<engine>-producer), the step starts the producer; once the producer has succeeded, the step follows
|        the run's MANIFEST (SI-CollectParts.ps1: run id = the producer's execution name) until every part is marked --
|        succeeded / failed (the parts named) / incomplete after -TimeoutMinutes plus the worker job's own run limit (so a
|        part whose worker is still running is never called incomplete). Every other job is unchanged.
|        Poll answers a word (Running / Succeeded / Failed) or, for a finished collection that failed, @{ Status; Error }.
|        -Store: the collect state store (New-SICollectBlobStore); -ProducerJobs: test seam (the job names), else List().
|    #>
|    param([Parameter(Mandatory)]$Seams, [Parameter(Mandatory)]$Store, [int]$TimeoutMinutes = 180, [string[]]$ProducerJobs, [scriptblock]$Now)
|    if (-not (Get-Command -Name Get-SICollectProgress -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-CollectParts.ps1') }
|    if (-not $Now) { $Now = { [datetime]::UtcNow } }
|    $names = if ($PSBoundParameters.ContainsKey('ProducerJobs')) { @($ProducerJobs) } else { @($Seams.List()) }
|    $keda = @{}
|    foreach ($n in $names) { if ([string]$n -match '^caj-si-(.+)-producer$') { $keda[$Matches[1]] = $true } }
|    # Progress (#576): { param($Key, $Execution, $Done, $Total) } -- the parts done of all, at every poll of a running
|    # collection (the caller sets it: the runner writes the step's progress record); $null = nothing written
|    New-SIJobFlowSeams -Fields @{ Inner = $Seams; Store = $Store; Keda = $keda; Timeout = $TimeoutMinutes; NowFn = $Now; Waits = @{}; Progress = $null } -Methods @{
|        IsParts = { param($Job) $this.Keda.ContainsKey((Get-SIJobFlowKey $Job)) }
|        # NOT A WAIT ANY MORE (2026-10-13: the parts are waited for until they are done -- Poll). Only what the step's own
|        # run limit is said to be: -TimeoutMinutes (the parts' start and queueing) plus the worker job's own run limit.
|        PartsWait = { param($Key)
|            if (-not $this.Waits.ContainsKey($Key)) {
|                $w = 0
|                if ($this.Inner.PSObject.Methods['Limit']) { try { $w = [int]$this.Inner.Limit($Key + '-worker') } catch { return [int]$this.Timeout } }
|                $this.Waits[$Key] = [int]$this.Timeout + $w
|            }
|            [int]$this.Waits[$Key] }
|        # the step's own run limit: the producer's, then the wait for the parts
|        Limit = { param($Job)
|            if (-not $this.Inner.PSObject.Methods['Limit']) { return 0 }
|            if (-not $this.IsParts($Job)) { return [int]$this.Inner.Limit($Job) }
|            $k = Get-SIJobFlowKey $Job
|            [int]$this.Inner.Limit($k + '-producer') + [int]$this.PartsWait($k) }
|        # SELF-HEALING: which job of the step was stopped at its own run limit -- the producer (this execution), else a
|        # worker that started since the step did; every other job: the job itself
|        LimitHit = { param($Job, $Execution, $SinceUtc)
|            if (-not $this.Inner.PSObject.Methods['LimitHit']) { return $null }
|            if (-not $this.IsParts($Job)) { return $this.Inner.LimitHit($Job, $Execution, $SinceUtc) }
|            $k = Get-SIJobFlowKey $Job
|            $h = $this.Inner.LimitHit($k + '-producer', $Execution, $SinceUtc)
|            if ($h) { return $h }
|            # the wait for the parts follows the worker's limit: read again after a raise
|            $this.Waits.Remove($k)
|            $this.Inner.LimitHit($k + '-worker', '', $SinceUtc) }
|        # a collection in parts that is already running: its PRODUCER is followed like any other job (the step then follows
|        # that run's parts by the producer's execution name, as Poll does). The workers are never asked about: several
|        # of them running at once is how a collection in parts works.
|        Running = { param($Job)
|            if (-not $this.Inner.PSObject.Methods['Running']) { return $null }
|            if ($this.IsParts($Job)) { $this.Inner.Running((Get-SIJobFlowKey $Job) + '-producer') } else { $this.Inner.Running($Job) } }
|        Start = { param($Job) if ($this.IsParts($Job)) { $this.Inner.Start((Get-SIJobFlowKey $Job) + '-producer') } else { $this.Inner.Start($Job) } }
|        Stop  = { param($Job, $Execution) if ($this.IsParts($Job)) { $this.Inner.Stop((Get-SIJobFlowKey $Job) + '-producer', $Execution) } else { $this.Inner.Stop($Job, $Execution) } }
|        List  = { $this.Inner.List() }
|        Poll  = {
|            param($Job, $Execution)
|            if (-not $this.IsParts($Job)) { return $this.Inner.Poll($Job, $Execution) }
|            $k = Get-SIJobFlowKey $Job
|            $st = [string]$this.Inner.Poll($k + '-producer', $Execution)
|            if ($st -notmatch '^(?i)succeeded$') { return $st }          # the producer is still discovering, or it failed
|            $m = Read-SICollectManifest -Store $this.Store -Engine $k -RunId $Execution
|            # a run whose records are handed over ends only when the last worker has published them (its records marker)
|            $rm = $null
|            if ($m -and $m.PSObject.Properties['RecordsHandover'] -and [bool]$m.RecordsHandover) { $rm = Read-SICollectRecordsMarker -Store $this.Store -Engine $k -RunId $Execution }
|            # -TimeoutMinutes 0: NO GIVE-UP ON ELAPSED TIME (owner 2026-10-13). The collection is waited for until every part
|            # has its marker and the records are published. That ends by itself: a worker that dies gives its part back
|            # within one short lease (WorkerQueue.ps1), and a part handed out more than 5 times is parked with a FAILED
|            # marker, which ends the step with the part named.
|            $p = Get-SICollectProgress -Manifest $m -Markers @(Read-SICollectPartMarkers -Store $this.Store -Engine $k -RunId $Execution) -Now (& $this.NowFn) -TimeoutMinutes 0 -Records $rm
|            switch ($p.State) {
|                'succeeded' { return 'Succeeded' }
|                'failed' { return [pscustomobject]@{ Status = 'Failed'; Error = $p.Text } }
|                'incomplete' { return [pscustomobject]@{ Status = 'Failed'; Error = $p.Text } }
|                'waiting' {
|                    # the producer ended without a manifest: nothing will ever mark the parts
|                    return [pscustomobject]@{ Status = 'Failed'; Error = 'the producer ended without writing the list of parts -- the collection did not start' }
|                }
|                default {
|                    if ($this.Progress) { try { $null = & $this.Progress $k ([string]$Execution) ([long]$p.Done) ([long]$p.Parts) } catch { } }
|                    return 'Running'
|                }
|            }
|        }
|    }
|}
|
|function Get-SIJobFlowVmCommand {
|    <#
|        PURE. The command line a VM flow step runs: the step's launcher (-Flavour community-vm | internal-vm; the
|        internal launcher when only that one exists), Risk Analysis with -Summary / -Detailed, the updater as
|        Update-SecurityInsight.ps1 -Apply. $null for a job that has no VM launcher (a Pro container job).
|        Returns @{ File; Arguments }.
|    #>
|    param([Parameter(Mandatory)][string]$Job, [Parameter(Mandatory)][string]$Root, [string]$Flavour = 'community-vm')
|    $k = Get-SIJobFlowKey $Job
|    if ($k -eq 'updater') { return [pscustomobject]@{ File = (Join-Path $Root 'Update-SecurityInsight.ps1'); Arguments = @('-Apply') } }
|    $folder = switch ($k) { 'ptc' { 'privilege-tier-classifier' } 'risk-analysis-detailed' { 'risk-analysis' } default { $k } }
|    $extra = switch ($k) { 'risk-analysis' { @('-Summary') } 'risk-analysis-detailed' { @('-Detailed') } default { @() } }
|    $dir = Join-Path (Join-Path $Root 'launcher') $folder
|    foreach ($f in @($Flavour, 'community-vm', 'internal-vm') | Select-Object -Unique) {
|        $p = Join-Path $dir ('launcher.{0}.ps1' -f $f)
|        if (Test-Path -LiteralPath $p) { return [pscustomobject]@{ File = $p; Arguments = @($extra) } }
|    }
|    $null
|}
|
|function Get-SIJobFlowVmInstalled {
|    <# The flow keys that have a VM launcher under -Root (the VM's "installed jobs"; the updater when its script exists). #>
|    param([Parameter(Mandatory)][string]$Root, [string]$Flavour = 'community-vm', $Map)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    @($Map.DefaultFlow | Where-Object { Get-SIJobFlowVmCommand -Job $_ -Root $Root -Flavour $Flavour } | Where-Object { $_ -ne 'updater' -or (Test-Path -LiteralPath (Join-Path $Root 'Update-SecurityInsight.ps1')) })
|}
|
|function New-SIJobFlowVmSeams {
|    <#
|        Start / Poll / Stop on a VM: each step is its launcher in its own PowerShell process (as the per-engine scheduled
|        tasks ran them). The execution name is "<pid>@<process start time>", so a resumed runner can tell its own process
|        from a recycled process id. -Exe: powershell.exe (5.1, the launchers' runtime) by default.
|    #>
|    param([Parameter(Mandatory)][string]$Root, [string]$Flavour = 'community-vm', [string]$Exe = 'powershell.exe')
|    New-SIJobFlowSeams -Fields @{ Root = $Root; Flavour = $Flavour; Exe = $Exe; Procs = @{} } -Methods @{
|        Start = {
|            param($Job)
|            $c = Get-SIJobFlowVmCommand -Job $Job -Root $this.Root -Flavour $this.Flavour
|            if (-not $c) { throw ("{0} has no VM launcher (it runs as a container job only)" -f $Job) }
|            $argList = @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', ('"{0}"' -f $c.File)) + @($c.Arguments)
|            $p = Start-Process -FilePath $this.Exe -ArgumentList $argList -WorkingDirectory $this.Root -PassThru -WindowStyle Hidden
|            $name = '{0}@{1}' -f $p.Id, $p.StartTime.ToUniversalTime().ToString('o', [Globalization.CultureInfo]::InvariantCulture)
|            $this.Procs[$name] = $p
|            $name
|        }
|        Poll = {
|            param($Job, $Execution)
|            # the process object this runner started holds its exit code; a resumed runner only has the id
|            $p = $this.Procs[[string]$Execution]
|            if (-not $p) {
|                $id, $started = ([string]$Execution) -split '@', 2
|                $q = Get-Process -Id ([int]$id) -ErrorAction SilentlyContinue
|                if ($q -and $q.StartTime.ToUniversalTime().ToString('o', [Globalization.CultureInfo]::InvariantCulture) -eq $started) { return 'Running' }
|                throw ("the process of {0} ({1}) is no longer there and this runner did not start it -- its outcome is unknown" -f $Job, $Execution)
|            }
|            if (-not $p.HasExited) { return 'Running' }
|            if ($p.ExitCode -eq 0) { 'Succeeded' } else { 'Failed' }
|        }
|        Stop = { param($Job, $Execution) $id = ([string]$Execution -split '@', 2)[0]; Stop-Process -Id ([int]$id) -Force -ErrorAction SilentlyContinue }
|    }
|}
|
|function Copy-SIJobFlowCancelled {
|    <#
|        PURE. #700: a run record that is CANCELLED in the store stays cancelled -- a runner that is still alive and saves its
|        own (older) copy never turns it back to Running / Stopped. -Stored: what the store holds now; -State: what is about
|        to be saved (changed in place: State, StopReason, EndedUtc, CancelledBy of the stored record). $true when it was.
|    #>
|    param($Stored, [Parameter(Mandatory)]$State)
|    if (-not $Stored -or [string]$Stored.State -ne 'Cancelled' -or [string]$Stored.FlowRunId -ne [string]$State.FlowRunId) { return $false }
|    if ([string]$State.State -eq 'Cancelled') { return $false }
|    $State.State = 'Cancelled'; $State.StopReason = [string]$Stored.StopReason; $State.EndedUtc = $Stored.EndedUtc
|    $by = if ($Stored.PSObject.Properties['CancelledBy']) { [string]$Stored.CancelledBy } else { '' }
|    if ($State.PSObject.Properties['CancelledBy']) { $State.CancelledBy = $by } else { $State | Add-Member -NotePropertyName CancelledBy -NotePropertyValue $by }
|    $true
|}
|
|function Get-SIJobFlowCancelledOf {
|    <# PURE. #700: @{ By; Reason } when -Stored is run -FlowRunId and it is CANCELLED, else $null (the runner's -Cancelled seam). #>
|    param($Stored, [string]$FlowRunId)
|    if (-not $Stored -or [string]$Stored.State -ne 'Cancelled') { return $null }
|    if ($FlowRunId -and [string]$Stored.FlowRunId -ne $FlowRunId) { return $null }
|    [pscustomobject]@{ By = $(if ($Stored.PSObject.Properties['CancelledBy']) { [string]$Stored.CancelledBy } else { '' }); Reason = [string]$Stored.StopReason }
|}
|
|function Resolve-SIJobFlowRunFinal {
|    <#
|        PURE (live 2026-10-19, ring 2). A run CANCELLED once is final. A run record that names who cancelled it
|        (CancelledBy) but is not in a finished state was written back to Running after the cancel by a runner that never
|        saw it (older code; a container that outlived its stop -- it kept starting the step again). It is returned as
|        Cancelled with Revived = $true: never resumed, never "still beating", and Close-SIJobFlowCancelledRun closes it.
|        Any other record is returned as it is (Revived = $false).
|    #>
|    param($State)
|    if (-not $State) { return $State }
|    $by = if ($State.PSObject.Properties['CancelledBy']) { [string]$State.CancelledBy } else { '' }
|    $revived = ("$by".Trim() -and [string]$State.State -notin $script:SIJobFlow.RunFinished)
|    if ($revived) { $State.State = 'Cancelled' }
|    $State | Add-Member -NotePropertyName Revived -NotePropertyValue ([bool]$revived) -Force
|    $State
|}
|
|function Close-SIJobFlowCancelledRun {
|    <#
|        Live 2026-10-19 (ring 2): A CANCELLED RUN IS FINAL, also when a runner that never saw the cancel is still alive. The
|        web app's cancel (cfg.FlowRunCancelSet) marks the run and frees the lock; the run's own runner stops its running
|        step when it sees the cancel. A runner of older code never asks -- at customer F one whose container outlived its
|        stop kept starting the step again and wrote the run back to Running. The runner that holds the lock now closes
|        such a run on every wake-up while it is the last run:
|          - a step still Starting / Running: its execution is stopped (never started again) and the step is closed
|            Interrupted, class 'cancelled' (as the cancel itself closes it);
|          - with -Running: an execution of a step's job that is running NOW and started after the cancel (or, for a run
|            written back to Running, after the run started) is stopped too -- the runner that started it is not this run's;
|          - a run written back to Running (Revived, Resolve-SIJobFlowRunFinal) is ended Cancelled again (its end now, the
|            stop reason kept or said).
|        -Stop { param($Job, $Execution) }, -Running { param($Job) } -> @{ Execution; StartedUtc } or $null, -Save { param($s) }.
|        #882: -StopWorkers { param($Job, $SinceUtc, $Execution) } -- a step closed here, or whose job was found running again,
|        has its workers stopped too (their runs closed first).
|        Returns @{ Changed; Revived; Stopped (job execution); StopFailed (job: why) }; nothing changed = nothing saved.
|    #>
|    param([Parameter(Mandatory)]$State, [scriptblock]$Stop, [scriptblock]$Running, [scriptblock]$Save, [datetime]$NowUtc = [datetime]::UtcNow,
|          [scriptblock]$Log = { param($Level, $Message) }, [scriptblock]$StopWorkers)
|    $now = $NowUtc.ToUniversalTime()
|    $revived = [bool]($State.PSObject.Properties['Revived'] -and $State.Revived)
|    $res = [pscustomobject]@{ Changed = $false; Revived = $revived; Stopped = @(); StopFailed = @() }
|    if ([string]$State.State -ne 'Cancelled') { return $res }
|    $by = if ($State.PSObject.Properties['CancelledBy']) { [string]$State.CancelledBy } else { '' }
|    $why = if ("$by".Trim()) { 'cancelled by {0}' -f $by } else { 'cancelled' }
|    $since = if (-not $revived -and $State.EndedUtc) { ([datetime]$State.EndedUtc).ToUniversalTime() } elseif ($State.StartedUtc) { ([datetime]$State.StartedUtc).ToUniversalTime() } else { $null }
|    $stopped = New-Object System.Collections.Generic.List[string]
|    $failed = New-Object System.Collections.Generic.List[string]
|    $stopOne = {
|        param($Job, $Execution)
|        $key = '{0} {1}' -f $Job, $Execution
|        if ($stopped -contains $key) { return }
|        if (-not $Stop) { $failed.Add(('{0}: nothing can stop it here' -f $Job)); return }
|        try { $null = & $Stop $Job $Execution; $stopped.Add($key) } catch { $failed.Add(('{0}: {1}' -f $Job, $_.Exception.Message)) }
|    }
|    foreach ($st in @($State.Steps)) {
|        if ($null -eq $st) { continue }
|        $job = [string]$st.Job
|        $workersOf = {
|            if (-not $StopWorkers) { return }
|            $ws = if ($st.StartedUtc) { ([datetime]$st.StartedUtc).ToUniversalTime() } else { $since }
|            try { $null = & $StopWorkers $job $ws ([string]$st.Execution) } catch { $failed.Add(('{0} (its workers): {1}' -f $job, $_.Exception.Message)) }
|        }
|        if ([string]$st.State -in @('Starting', 'Running')) {
|            if ([string]$st.Execution) { & $stopOne $job ([string]$st.Execution) }
|            . $workersOf
|            $st.State = 'Interrupted'; $st.ErrorClass = 'cancelled'; $st.EndedUtc = $now
|            $st.Error = ('stopped: the run was {0} -- a cancelled run is final, the step is not started again' -f $why)
|            if (([string]$st.Error).Length -gt 1000) { $st.Error = ([string]$st.Error).Substring(0, 1000) }
|            $res.Changed = $true
|        } elseif ([string]$st.State -eq 'Waiting') {
|            $st.State = 'Skipped'; $st.ErrorClass = 'cancelled'; $st.Error = ('not run: the run was {0}' -f $why)
|            $res.Changed = $true
|        }
|        # a step that had started (not one that never ran) may have been started again by a runner that did not see the cancel
|        if ($Running -and [string]$st.State -notin @('Waiting', 'Skipped', 'Disabled', 'Success')) {
|            $live = $null
|            try { $live = & $Running $job } catch { $live = $null }
|            if ($live -and [string]$live.Execution -and ((-not $since) -or (-not $live.StartedUtc) -or ([datetime]$live.StartedUtc).ToUniversalTime() -ge $since)) {
|                & $stopOne $job ([string]$live.Execution)
|                if ($StopWorkers) { try { $null = & $StopWorkers $job $(if ($live.StartedUtc) { ([datetime]$live.StartedUtc).ToUniversalTime() } else { $since }) ([string]$live.Execution) } catch { $failed.Add(('{0} (its workers): {1}' -f $job, $_.Exception.Message)) } }
|            }
|        }
|    }
|    if ($revived) {
|        $State.EndedUtc = $now
|        $note = 'ended again: a runner that did not see the cancel wrote the run back to Running'
|        $State.StopReason = $(if ("$($State.StopReason)".Trim()) { '{0}; {1}' -f $State.StopReason, $note } else { 'the run was {0}; {1}' -f $why, $note })
|        if (([string]$State.StopReason).Length -gt 1000) { $State.StopReason = ([string]$State.StopReason).Substring(0, 1000) }
|        $res.Changed = $true
|    }
|    $res.Stopped = $stopped.ToArray(); $res.StopFailed = $failed.ToArray()
|    if ($stopped.Count) { $res.Changed = $true }
|    if ($res.Changed) {
|        if ($Save) { & $Save $State }
|        & $Log 'WARN' ('cancelled run {0} closed: {1} execution(s) asked to stop{2}{3} -- a cancelled run is final' -f $State.FlowRunId, $stopped.Count, $(if ($stopped.Count) { (' ({0})' -f ($stopped -join ', ')) } else { '' }), $(if ($failed.Count) { ('; could not be stopped: {0}' -f ($failed -join '; ')) } else { '' }))
|    }
|    $res
|}
|
|function Get-SIJobFlowEndedStepStops {
|    <#
|        PURE. #882 -- what the runner stops for the started step rows of ENDED runs it is about to close (EndedRunOpenSteps):
|        the execution recorded on the row, and the step's workers -- never what the run going on NOW uses: an execution a
|        step of the live run follows (a run can follow a job that was already running), or the workers of a job the live
|        run has Starting / Running. -Rows: @(@{ Job; Execution; StartedUtc }); -Live: the last run record when it has not
|        ended ($null = none). Returns @(@{ Job; Execution ('' = none to stop); Workers (bool); SinceUtc; Why }), one per row.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), $Live = $null)
|    $liveExec = @{}; $liveJobs = @{}
|    if ($Live) {
|        foreach ($s in @($Live.Steps)) {
|            if ($null -eq $s) { continue }
|            if ([string]$s.Execution) { $liveExec[([string]$s.Execution).ToLowerInvariant()] = $true }
|            if ([string]$s.State -in @('Starting', 'Running')) { $liveJobs[(Get-SIJobFlowKey ([string]$s.Job))] = $true }
|        }
|    }
|    @(foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $k = Get-SIJobFlowKey ([string]$r.Job)
|        $ex = ([string]$r.Execution).Trim()
|        $why = ''
|        if ($ex -and $liveExec.ContainsKey($ex.ToLowerInvariant())) { $why = 'the run going on now follows this execution'; $ex = '' }
|        $wk = -not $liveJobs.ContainsKey($k)
|        if (-not $wk -and -not $why) { $why = 'the run going on now runs this job -- its workers are left to it' }
|        [pscustomobject]@{ Job = $k; Execution = $ex; Workers = [bool]$wk; SinceUtc = $r.StartedUtc; Why = $why }
|    })
|}
|
|function New-SIJobFlowFileStore {
|    <# The run record as a JSON file (VM: <install>\data\flow\flow-run.json). Methods Load() / Save($State) / Cancelled($FlowRunId). #>
|    param([Parameter(Mandatory)][string]$Path)
|    New-SIJobFlowSeams -Fields @{ Path = $Path } -Methods @{
|        Load = { if (Test-Path -LiteralPath $this.Path) { ConvertFrom-SIJobFlowRunJson -Json ([IO.File]::ReadAllText($this.Path)) } else { $null } }
|        Cancelled = { param($FlowRunId) $s = $null; try { $s = $this.Load() } catch { $s = $null }; Get-SIJobFlowCancelledOf -Stored $s -FlowRunId $FlowRunId }
|        # #945: the wake-up check's close of one step (only while it is Running with that execution, in a run not ended)
|        CloseOpenStep = { param($FlowRunId, $Close) $s = $this.Load(); if (Set-SIJobFlowStepClosed -State $s -FlowRunId $FlowRunId -Close $Close) { $this.Save($s); 1 } else { 0 } }
|        StepRow = { param($FlowRunId, $Order) Get-SIJobFlowStepRowOf -State $this.Load() -FlowRunId $FlowRunId -Order $Order }
|        Save = {
|            param($State)
|            # #700: a run cancelled in the file stays cancelled (a live runner's later save does not undo it)
|            $old = $null; try { $old = $this.Load() } catch { $old = $null }
|            if ([string]$State.State -ne 'Cancelled') { $null = Copy-SIJobFlowCancelled -Stored $old -State $State }
|            $dir = Split-Path -Parent $this.Path
|            if ($dir -and -not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null }
|            $tmp = $this.Path + '.tmp'
|            # #945: a step the wake-up check closed is never written back to Running with the same execution
|            [IO.File]::WriteAllText($tmp, (Get-SIJobFlowSaveJson -State $State -Stored $old), (New-Object System.Text.UTF8Encoding($false)))
|            Move-Item -LiteralPath $tmp -Destination $this.Path -Force
|        }
|    }
|}
|
|function New-SIJobFlowBlobStore {
|    <# The run record as a blob (a Community container: <account>/sistate/flow/flow-run.json, OAuth as the job). #>
|    param([Parameter(Mandatory)][string]$Account, [string]$Container = 'sistate', [string]$Blob = 'flow/flow-run.json')
|    New-SIJobFlowSeams -Fields @{ Account = $Account; Container = $Container; Blob = $Blob } -Methods @{
|        Load = {
|            try {
|                $bytes = Get-SIBlobContent -Account $this.Account -Container $this.Container -Blob $this.Blob
|                if (-not $bytes -or $bytes.Length -eq 0) { return $null }
|                ConvertFrom-SIJobFlowRunJson -Json ([Text.Encoding]::UTF8.GetString($bytes))
|            } catch { if ("$($_.Exception.Message)" -match '404|BlobNotFound|ContainerNotFound|not found') { $null } else { throw } }
|        }
|        Cancelled = { param($FlowRunId) $s = $null; try { $s = $this.Load() } catch { $s = $null }; Get-SIJobFlowCancelledOf -Stored $s -FlowRunId $FlowRunId }
|        # #945: the wake-up check's close of one step (only while it is Running with that execution, in a run not ended)
|        CloseOpenStep = { param($FlowRunId, $Close) $s = $this.Load(); if (Set-SIJobFlowStepClosed -State $s -FlowRunId $FlowRunId -Close $Close) { $this.Save($s); 1 } else { 0 } }
|        StepRow = { param($FlowRunId, $Order) Get-SIJobFlowStepRowOf -State $this.Load() -FlowRunId $FlowRunId -Order $Order }
|        Save = {
|            param($State)
|            # #700: a run cancelled in the blob stays cancelled (a live runner's later save does not undo it)
|            $old = $null; try { $old = $this.Load() } catch { $old = $null }
|            if ([string]$State.State -ne 'Cancelled') { $null = Copy-SIJobFlowCancelled -Stored $old -State $State }
|            # #945: a step the wake-up check closed is never written back to Running with the same execution
|            $null = Set-SIBlobContent -Account $this.Account -Container $this.Container -Blob $this.Blob -Bytes ([Text.Encoding]::UTF8.GetBytes((Get-SIJobFlowSaveJson -State $State -Stored $old))) -ContentType 'application/json'
|        }
|    }
|}
|
|# ---- Pro: cfg.JobFlow (the definition), cfg.FlowRun + cfg.FlowStepRun (the run records) ------------------------------
|function Get-SIJobFlowSqlText {
|    <# The T-SQL of the Pro store (one place; the LocalSql test runs it against sql\si-pro-settings.sql). #>
|    param([Parameter(Mandatory)][ValidateSet('ReadDefinition', 'LastRun', 'LastRunSteps', 'SaveRun', 'SaveStep', 'RunCancelled', 'CloseEndedRunSteps', 'EndedRunOpenSteps', 'RecentRuns', 'RecentSteps', 'CloseOpenStep', 'StepRow')][string]$Name)
|    $recent = [int](Get-SIPipelineLongRunRule).RunsRead
|    switch ($Name) {
|        # si-flow-1203: the newest run records and their steps -- how long a run and each step usually take here (read once
|        # per runner process; index reads: IX_FlowRun_Started, the steps by their primary key). SELECT *: Scope exists once
|        # the schema is applied again (it only adds); a run without it counts as the pipeline.
|        'RecentRuns' { "IF OBJECT_ID(N'cfg.FlowRun') IS NOT NULL SELECT TOP ($recent) * FROM cfg.FlowRun WHERE FlowId = N'daily' ORDER BY StartedUtc DESC;" }
|        'RecentSteps' { "IF OBJECT_ID(N'cfg.FlowRun') IS NOT NULL AND OBJECT_ID(N'cfg.FlowStepRun') IS NOT NULL SELECT s.FlowRunId, s.Job, s.State, s.StartedUtc, s.EndedUtc FROM cfg.FlowStepRun s JOIN (SELECT TOP ($recent) FlowRunId FROM cfg.FlowRun WHERE FlowId = N'daily' ORDER BY StartedUtc DESC) r ON r.FlowRunId = s.FlowRunId;" }
|        'ReadDefinition' { "IF OBJECT_ID(N'cfg.JobFlow') IS NULL SELECT CAST(NULL AS nvarchar(max)) AS DefinitionJson, CAST(NULL AS nvarchar(16)) AS Mode ELSE SELECT TOP (1) DefinitionJson, Mode FROM cfg.JobFlow WHERE FlowId = N'daily';" }
|        # SELECT *: Scope / Target / RequestedBy / RequestId (#306) exist once the schema is applied again (it only adds)
|        'LastRun' { "IF OBJECT_ID(N'cfg.FlowRun') IS NOT NULL SELECT TOP (1) * FROM cfg.FlowRun WHERE FlowId = N'daily' ORDER BY StartedUtc DESC;" }
|        # SELECT *: Attempts / RetryReason exist once the schema is applied again (it only adds); a reader without them gets none
|        'LastRunSteps' { "SELECT * FROM cfg.FlowStepRun WHERE FlowRunId = @FlowRunId ORDER BY StepOrder;" }
|        # #700 + live 2026-10-19 (ring 2): a run that has ENDED in the database (Succeeded, Failed, Stopped, Cancelled) is
|        # final -- a runner that is still alive and saves its own copy never turns it back (its state, stop reason and end
|        # are kept; its heartbeat and note too, unless the save is that same final state again); the version it started on
|        # is written once. The schema's trigger cfg.TR_FlowRun_Final refuses the same for any writer (older code included).
|        'SaveRun' { @'
|MERGE cfg.FlowRun AS t
|USING (SELECT @FlowRunId AS FlowRunId) AS s ON t.FlowRunId = s.FlowRunId
|WHEN MATCHED THEN UPDATE SET State = CASE WHEN t.State IN (N'Succeeded', N'Failed', N'Stopped', N'Cancelled') THEN t.State ELSE @State END,
|                             EndedUtc = CASE WHEN t.State = N'Cancelled' OR (t.State IN (N'Succeeded', N'Failed', N'Stopped') AND t.State <> @State) THEN t.EndedUtc ELSE @EndedUtc END,
|                             HeartbeatUtc = CASE WHEN t.State IN (N'Succeeded', N'Failed', N'Stopped', N'Cancelled') AND t.State <> @State THEN t.HeartbeatUtc ELSE @HeartbeatUtc END,
|                             StopReason = CASE WHEN t.State = N'Cancelled' OR (t.State IN (N'Succeeded', N'Failed', N'Stopped') AND t.State <> @State) THEN t.StopReason ELSE @StopReason END,
|                             Note = CASE WHEN t.State IN (N'Succeeded', N'Failed', N'Stopped', N'Cancelled') AND t.State <> @State THEN t.Note ELSE @Note END
|WHEN NOT MATCHED THEN INSERT (FlowRunId, FlowId, Day, Trg, FromStep, State, StartedUtc, EndedUtc, HeartbeatUtc, StopReason, SlotUtc, LastSlotUtc, Note)
|     VALUES (@FlowRunId, N'daily', @Day, @Trg, @FromStep, @State, @StartedUtc, @EndedUtc, @HeartbeatUtc, @StopReason, @SlotUtc, @LastSlotUtc, @Note);
|IF COL_LENGTH(N'cfg.FlowRun', N'Scope') IS NOT NULL AND COL_LENGTH(N'cfg.FlowRun', N'RequestId') IS NOT NULL
|    EXEC sp_executesql N'UPDATE cfg.FlowRun SET Scope = @S, Target = @T, RequestedBy = @B, RequestId = @Q WHERE FlowRunId = @F AND (Scope IS NULL OR Scope <> @S OR RequestId IS NULL);',
|         N'@S nvarchar(16), @T nvarchar(64), @B nvarchar(256), @Q bigint, @F nvarchar(64)', @S = @Scope, @T = @Target, @B = @RequestedBy, @Q = @RequestId, @F = @FlowRunId;
|IF COL_LENGTH(N'cfg.FlowRun', N'Version') IS NOT NULL AND COL_LENGTH(N'cfg.FlowRun', N'CancelledBy') IS NOT NULL
|    EXEC sp_executesql N'UPDATE cfg.FlowRun SET Version = COALESCE(Version, NULLIF(@V, N'''')), CancelledBy = COALESCE(CancelledBy, NULLIF(@C, N'''')) WHERE FlowRunId = @F;',
|         N'@V nvarchar(32), @C nvarchar(256), @F nvarchar(64)', @V = @Version, @C = @CancelledBy, @F = @FlowRunId;
|'@ }
|        # #700: is this run cancelled? (the runner asks at every poll; SELECT *: CancelledBy exists once the schema is applied again)
|        # live 2026-10-19: a run written back to Running after its cancel (CancelledBy kept) is cancelled all the same
|        'RunCancelled' { @'
|IF OBJECT_ID(N'cfg.FlowRun') IS NOT NULL
|BEGIN
|    IF COL_LENGTH(N'cfg.FlowRun', N'CancelledBy') IS NOT NULL
|        EXEC sp_executesql N'SELECT * FROM cfg.FlowRun WHERE FlowRunId = @F AND (State = N''Cancelled'' OR NULLIF(CancelledBy, N'''') IS NOT NULL);', N'@F nvarchar(64)', @F = @FlowRunId;
|    ELSE
|        SELECT * FROM cfg.FlowRun WHERE FlowRunId = @FlowRunId AND State = N'Cancelled';
|END
|'@ }
|        # #945: a step that has ENDED is never written back to Running with the SAME execution (a runner that never saw the
|        # wake-up check's close keeps it closed; it takes the close over at its next poll) -- a new execution is written.
|        # a step of a run that has ENDED is never moved (back) to Starting / Running: a runner that did not see the end
|        # (older code, a container that outlived its stop) cannot record a step it started again -- the row is kept
|        'SaveStep' { @'
|MERGE cfg.FlowStepRun AS t
|USING (SELECT @FlowRunId AS FlowRunId, @StepOrder AS StepOrder,
|              CASE WHEN @State IN (N'Starting', N'Running') AND EXISTS (SELECT 1 FROM cfg.FlowRun r WHERE r.FlowRunId = @FlowRunId AND r.State IN (N'Succeeded', N'Failed', N'Stopped', N'Cancelled')) THEN 1 ELSE 0 END AS RunEnded) AS s
|    ON t.FlowRunId = s.FlowRunId AND t.StepOrder = s.StepOrder
|WHEN MATCHED AND s.RunEnded = 0 AND NOT (@State = N'Running' AND t.Execution = @Execution AND t.State IN (N'Success', N'Failed', N'Interrupted', N'TimedOut')) THEN UPDATE SET State = @State, Execution = @Execution, StartedUtc = @StartedUtc, EndedUtc = @EndedUtc, ErrorClass = @ErrorClass, Error = @Error
|WHEN NOT MATCHED AND s.RunEnded = 0 THEN INSERT (FlowRunId, StepOrder, GroupNo, Job, State, Execution, StartedUtc, EndedUtc, ErrorClass, Error)
|     VALUES (@FlowRunId, @StepOrder, @GroupNo, @Job, @State, @Execution, @StartedUtc, @EndedUtc, @ErrorClass, @Error);
|IF COL_LENGTH(N'cfg.FlowStepRun', N'Attempts') IS NOT NULL AND COL_LENGTH(N'cfg.FlowStepRun', N'RetryReason') IS NOT NULL
|    EXEC sp_executesql N'UPDATE cfg.FlowStepRun SET Attempts = @A, RetryReason = @R WHERE FlowRunId = @F AND StepOrder = @S;',
|         N'@A int, @R nvarchar(1000), @F nvarchar(64), @S int', @A = @Attempts, @R = @RetryReason, @F = @FlowRunId, @S = @StepOrder;
|IF COL_LENGTH(N'cfg.FlowStepRun', N'Stage') IS NOT NULL
|    EXEC sp_executesql N'UPDATE cfg.FlowStepRun SET Stage = @G WHERE FlowRunId = @F AND StepOrder = @S;',
|         N'@G nvarchar(32), @F nvarchar(64), @S int', @G = @Stage, @F = @FlowRunId, @S = @StepOrder;
|'@ }
|        # A STEP OF A RUN THAT HAS ENDED IS NEVER LEFT OPEN (live 2026-10-21, ring 2). Two step rows of runs cancelled on
|        # 2026-10-18/19 still said Running two days later: the cancel ended the RUN, and the runner closes the open steps of
|        # the LAST run only (Close-SIJobFlowCancelledRun) -- a newer run had already started, so nobody closed them, and their
|        # executions were long gone. Every wake-up closes them here, in one statement, with the reason: a step that was
|        # Starting / Running is Interrupted at the run's end, a step that never started is Skipped. Only rows of runs that
|        # have ENDED (Succeeded, Failed, Stopped, Cancelled) are touched -- never the run that is going on, never the lock.
|        # Answers Closed (the rows closed).
|        'CloseEndedRunSteps' { @'
|SET NOCOUNT ON;
|UPDATE s SET
|    State = CASE WHEN s.State = N'Waiting' THEN N'Skipped' ELSE N'Interrupted' END,
|    ErrorClass = CASE WHEN NULLIF(s.ErrorClass, N'') IS NOT NULL THEN s.ErrorClass WHEN r.State = N'Cancelled' THEN N'cancelled' ELSE N'run-ended' END,
|    EndedUtc = CASE WHEN s.State = N'Waiting' THEN s.EndedUtc ELSE COALESCE(s.EndedUtc, r.EndedUtc, SYSUTCDATETIME()) END,
|    Error = LEFT(CASE WHEN s.State = N'Waiting'
|                      THEN N'not run: the run ended (' + r.State + N') before this step started'
|                      ELSE N'closed: the run ended (' + r.State + N') while this step was still open -- its execution '
|                           + ISNULL(NULLIF(s.Execution, N''), N'(none recorded)') + N' is not followed any more; the step did not finish in this run' END, 1000)
|FROM cfg.FlowStepRun s JOIN cfg.FlowRun r ON r.FlowRunId = s.FlowRunId
|WHERE r.State IN (N'Succeeded', N'Failed', N'Stopped', N'Cancelled') AND s.State IN (N'Starting', N'Running', N'Waiting');
|SELECT @@ROWCOUNT AS Closed;
|'@ }
|        # #882: the step rows CloseEndedRunSteps is about to close that had STARTED (Starting / Running) -- read first, so the
|        # runner stops what may still run for them (the execution recorded on the row, the step's workers). Read-only.
|        # #945: the wake-up check closes ONE step whose execution Azure says has ended -- only while the row still says Running
|        # with THAT execution (a runner that moved the step on -- closed it, started it again -- is never overwritten), and
|        # only in a run that has not ended. Answers Closed (0 or 1).
|        'CloseOpenStep' { @'
|SET NOCOUNT ON;
|UPDATE s SET State = @State, EndedUtc = @EndedUtc, ErrorClass = @ErrorClass, Error = LEFT(@Error, 1000)
|FROM cfg.FlowStepRun s JOIN cfg.FlowRun r ON r.FlowRunId = s.FlowRunId
|WHERE s.FlowRunId = @FlowRunId AND s.StepOrder = @StepOrder AND s.State = N'Running' AND s.Execution = @Execution
|  AND r.State NOT IN (N'Succeeded', N'Failed', N'Stopped', N'Cancelled');
|SELECT @@ROWCOUNT AS Closed;
|'@ }
|        # #945: one step row as it is stored now (the runner adopts a close the wake-up check made). Read-only.
|        'StepRow' { "SELECT State, Execution, EndedUtc, ErrorClass, Error FROM cfg.FlowStepRun WHERE FlowRunId = @FlowRunId AND StepOrder = @StepOrder;" }
|        'EndedRunOpenSteps' { @'
|SET NOCOUNT ON;
|SELECT s.FlowRunId, s.StepOrder, s.Job, s.Execution, s.State, s.StartedUtc
|FROM cfg.FlowStepRun s JOIN cfg.FlowRun r ON r.FlowRunId = s.FlowRunId
|WHERE r.State IN (N'Succeeded', N'Failed', N'Stopped', N'Cancelled') AND s.State IN (N'Starting', N'Running');
|'@ }
|    }
|}
|
|function ConvertTo-SIJobFlowSqlRows {
|    <# PURE. The Pro store's reader returns a result set as ONE array of hashtables (New-SIProSettingsStore); a test seam
|       may return rows one by one or as objects. Either way: one [pscustomobject] per row, so a property test
|       (PSObject.Properties['Attempts']) sees the columns. Before this, a stored run with several steps reached the loader
|       as one array and [int]$_.StepOrder failed on it ("Cannot convert System.Object[] to System.Int32"). #>
|    process {
|        foreach ($row in @($_)) {
|            if ($null -eq $row) { continue }
|            if ($row -is [System.Collections.IDictionary]) { [pscustomobject]$row } else { $row }
|        }
|    }
|}
|
|function New-SIJobFlowSqlStore {
|    <#
|        The Pro store over the (sql, params, mode) -Invoke seam every Pro engine uses (New-SIProSettingsStore .Invoke).
|        Load(): the last cfg.FlowRun + its steps. Save($State): the run row and the step rows that changed since the last
|        save (MERGE, idempotent) -- the heartbeat costs one statement. ReadDefinition(): cfg.JobFlow (or $null).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke)
|    New-SIJobFlowSeams -Fields @{ Invoke = $Invoke; Seen = @{} } -Methods @{
|        ReadDefinition = {
|            $r = @(& $this.Invoke (Get-SIJobFlowSqlText 'ReadDefinition') @{} 'reader' | ConvertTo-SIJobFlowSqlRows)
|            if ($r.Count -and "$($r[0].DefinitionJson)" -and -not ($r[0].DefinitionJson -is [DBNull])) { [pscustomobject]@{ Json = [string]$r[0].DefinitionJson; Mode = [string]$r[0].Mode } } else { $null }
|        }
|        Load = {
|            $r = @(& $this.Invoke (Get-SIJobFlowSqlText 'LastRun') @{} 'reader' | ConvertTo-SIJobFlowSqlRows)
|            if (-not $r.Count) { return $null }
|            $x = $r[0]
|            $t = { param($v) if ($null -eq $v -or $v -is [DBNull]) { $null } else { ([datetime]$v).ToUniversalTime() } }
|            $steps = @(& $this.Invoke (Get-SIJobFlowSqlText 'LastRunSteps') @{ FlowRunId = [string]$x.FlowRunId } 'reader' | ConvertTo-SIJobFlowSqlRows | ForEach-Object {
|                [pscustomobject]@{ Order = [int]$_.StepOrder; Group = [int]$_.GroupNo; Job = [string]$_.Job; Stage = $(if ($_.PSObject.Properties['Stage'] -and -not ($_.Stage -is [DBNull])) { [string]$_.Stage } else { '' }); State = [string]$_.State; Execution = [string]$_.Execution
|                                   StartedUtc = (& $t $_.StartedUtc); EndedUtc = (& $t $_.EndedUtc); ErrorClass = [string]$_.ErrorClass; Error = [string]$_.Error
|                                   Attempts = (Get-SIJobFlowAttempts $_); RetryReason = $(if ($_.PSObject.Properties['RetryReason'] -and -not ($_.RetryReason -is [DBNull])) { [string]$_.RetryReason } else { '' }) } })
|            # a run CANCELLED once is final: a row an older runner wrote back to Running after the cancel (its CancelledBy
|            # is kept) loads as Cancelled -- never resumed, its open steps closed (Close-SIJobFlowCancelledRun)
|            Resolve-SIJobFlowRunFinal -State ([pscustomobject]@{ FlowRunId = [string]$x.FlowRunId; Day = [string]$x.Day; Trigger = [string]$x.Trg; FromStep = [string]$x.FromStep; State = [string]$x.State
|                               StartedUtc = (& $t $x.StartedUtc); EndedUtc = (& $t $x.EndedUtc); HeartbeatUtc = (& $t $x.HeartbeatUtc); StopReason = [string]$x.StopReason
|                               SlotUtc = (& $t $x.SlotUtc); LastSlotUtc = (& $t $x.LastSlotUtc); Note = [string]$x.Note
|                               Scope = $(if ($x.PSObject.Properties['Scope'] -and -not ($x.Scope -is [DBNull]) -and $x.Scope) { [string]$x.Scope } else { 'pipeline' })
|                               Target = $(if ($x.PSObject.Properties['Target'] -and -not ($x.Target -is [DBNull])) { [string]$x.Target } else { '' })
|                               RequestedBy = $(if ($x.PSObject.Properties['RequestedBy'] -and -not ($x.RequestedBy -is [DBNull])) { [string]$x.RequestedBy } else { '' })
|                               RequestId = $(if ($x.PSObject.Properties['RequestId'] -and -not ($x.RequestId -is [DBNull]) -and $null -ne $x.RequestId) { [long]$x.RequestId } else { 0 })
|                               Version = $(if ($x.PSObject.Properties['Version'] -and -not ($x.Version -is [DBNull]) -and $null -ne $x.Version) { [string]$x.Version } else { '' })
|                               # #700: a database whose schema was not applied again has no Version column -- the version is then unknown
|                               VersionRecorded = [bool]$x.PSObject.Properties['Version']
|                               CancelledBy = $(if ($x.PSObject.Properties['CancelledBy'] -and -not ($x.CancelledBy -is [DBNull]) -and $null -ne $x.CancelledBy) { [string]$x.CancelledBy } else { '' })
|                               Steps = $steps })
|        }
|        # si-flow-1203: @{ Runs; Steps } -- the newest run records and their steps (Invoke-SIJobFlow -History)
|        Recent = {
|            $t = { param($v) if ($null -eq $v -or $v -is [DBNull]) { $null } else { [datetime]::SpecifyKind([datetime]$v, [DateTimeKind]::Utc) } }
|            $s = { param($v) if ($null -eq $v -or $v -is [DBNull]) { '' } else { [string]$v } }
|            $runs = @(& $this.Invoke (Get-SIJobFlowSqlText 'RecentRuns') @{} 'reader' | ConvertTo-SIJobFlowSqlRows | ForEach-Object {
|                [pscustomobject]@{ FlowRunId = [string]$_.FlowRunId; State = [string]$_.State; FromStep = (& $s $_.FromStep)
|                                   Scope = $(if ($_.PSObject.Properties['Scope']) { & $s $_.Scope } else { '' }); StartedUtc = (& $t $_.StartedUtc); EndedUtc = (& $t $_.EndedUtc) } })
|            $steps = @(& $this.Invoke (Get-SIJobFlowSqlText 'RecentSteps') @{} 'reader' | ConvertTo-SIJobFlowSqlRows | ForEach-Object {
|                [pscustomobject]@{ FlowRunId = [string]$_.FlowRunId; Job = [string]$_.Job; State = [string]$_.State; StartedUtc = (& $t $_.StartedUtc); EndedUtc = (& $t $_.EndedUtc) } })
|            [pscustomobject]@{ Runs = $runs; Steps = $steps }
|        }
|        # #700: @{ By; Reason } when run -FlowRunId is cancelled in the database, else $null (one small read per poll)
|        Cancelled = {
|            param($FlowRunId)
|            if (-not $FlowRunId) { return $null }
|            $r = @(& $this.Invoke (Get-SIJobFlowSqlText 'RunCancelled') @{ FlowRunId = [string]$FlowRunId } 'reader' | ConvertTo-SIJobFlowSqlRows)
|            if (-not $r.Count) { return $null }
|            $x = $r[0]
|            [pscustomobject]@{ By = $(if ($x.PSObject.Properties['CancelledBy'] -and -not ($x.CancelledBy -is [DBNull]) -and $null -ne $x.CancelledBy) { [string]$x.CancelledBy } else { '' })
|                               Reason = $(if ($x.StopReason -is [DBNull] -or $null -eq $x.StopReason) { '' } else { [string]$x.StopReason }) }
|        }
|        # the open step rows of runs that have ENDED, closed with the reason (Get-SIJobFlowSqlText 'CloseEndedRunSteps');
|        # answers how many were closed. The step rows the runner remembers as saved are forgotten: a closed row is the truth.
|        CloseEndedRunSteps = {
|            $r = @(& $this.Invoke (Get-SIJobFlowSqlText 'CloseEndedRunSteps') @{} 'reader' | ConvertTo-SIJobFlowSqlRows)
|            $n = 0; if ($r.Count -and $r[0].PSObject.Properties['Closed'] -and -not ($r[0].Closed -is [DBNull])) { $n = [int]$r[0].Closed }
|            if ($n -gt 0) { $this.Seen.Clear() }
|            $n
|        }
|        # #945: the wake-up check's close of one step (Get-SIJobFlowSqlText 'CloseOpenStep'); answers 1 when it was closed
|        CloseOpenStep = {
|            param($FlowRunId, $Close)
|            $r = @(& $this.Invoke (Get-SIJobFlowSqlText 'CloseOpenStep') @{ FlowRunId = [string]$FlowRunId; StepOrder = [int]$Close.Order; Execution = [string]$Close.Execution
|                     State = [string]$Close.State; EndedUtc = ([datetime]$Close.EndedUtc).ToUniversalTime(); ErrorClass = [string]$Close.ErrorClass; Error = [string]$Close.Error } 'reader' | ConvertTo-SIJobFlowSqlRows)
|            $n = 0; if ($r.Count -and $r[0].PSObject.Properties['Closed'] -and -not ($r[0].Closed -is [DBNull])) { $n = [int]$r[0].Closed }
|            if ($n -gt 0) { $this.Seen.Remove(('{0}|{1}' -f $FlowRunId, [int]$Close.Order)) }
|            $n
|        }
|        # #945: one step row as stored now: @{ State; Execution; EndedUtc; ErrorClass; Error } or $null
|        StepRow = {
|            param($FlowRunId, $Order)
|            $r = @(& $this.Invoke (Get-SIJobFlowSqlText 'StepRow') @{ FlowRunId = [string]$FlowRunId; StepOrder = [int]$Order } 'reader' | ConvertTo-SIJobFlowSqlRows)
|            if (-not $r.Count) { return $null }
|            $x = $r[0]; $s = { param($v) if ($null -eq $v -or $v -is [DBNull]) { '' } else { [string]$v } }
|            [pscustomobject]@{ State = (& $s $x.State); Execution = (& $s $x.Execution); ErrorClass = (& $s $x.ErrorClass); Error = (& $s $x.Error)
|                               EndedUtc = $(if ($null -eq $x.EndedUtc -or $x.EndedUtc -is [DBNull]) { $null } else { ([datetime]$x.EndedUtc).ToUniversalTime() }) }
|        }
|        # #882: the started step rows of ended runs that are still open (Get-SIJobFlowSqlText 'EndedRunOpenSteps') -- read
|        # before they are closed, so what may still run for them is stopped. @(@{ FlowRunId; Job; Execution; State; StartedUtc })
|        EndedRunOpenSteps = {
|            @(& $this.Invoke (Get-SIJobFlowSqlText 'EndedRunOpenSteps') @{} 'reader' | ConvertTo-SIJobFlowSqlRows | ForEach-Object {
|                [pscustomobject]@{ FlowRunId = [string]$_.FlowRunId; Job = [string]$_.Job
|                                   Execution = $(if ($_.Execution -is [DBNull] -or $null -eq $_.Execution) { '' } else { [string]$_.Execution })
|                                   State = [string]$_.State
|                                   StartedUtc = $(if ($_.StartedUtc -is [DBNull] -or $null -eq $_.StartedUtc) { $null } else { ([datetime]$_.StartedUtc).ToUniversalTime() }) } })
|        }
|        Save = {
|            param($State)
|            $nul = { param($v) if ($null -eq $v) { [DBNull]::Value } else { $v } }
|            $null = & $this.Invoke (Get-SIJobFlowSqlText 'SaveRun') @{ FlowRunId = $State.FlowRunId; Day = $State.Day; Trg = $State.Trigger; FromStep = [string]$State.FromStep; State = $State.State
|                StartedUtc = $State.StartedUtc; EndedUtc = (& $nul $State.EndedUtc); HeartbeatUtc = $State.HeartbeatUtc; StopReason = [string]$State.StopReason
|                SlotUtc = (& $nul $State.SlotUtc); LastSlotUtc = (& $nul $State.LastSlotUtc); Note = [string]$State.Note
|                Scope = $(if ($State.PSObject.Properties['Scope'] -and $State.Scope) { [string]$State.Scope } else { 'pipeline' }); Target = $(if ($State.PSObject.Properties['Target']) { [string]$State.Target } else { '' })
|                RequestedBy = $(if ($State.PSObject.Properties['RequestedBy']) { ([string]$State.RequestedBy) } else { '' }); RequestId = $(if ($State.PSObject.Properties['RequestId'] -and $State.RequestId) { [long]$State.RequestId } else { [long]0 })
|                Version = $(if ($State.PSObject.Properties['Version']) { ([string]$State.Version) } else { '' }); CancelledBy = $(if ($State.PSObject.Properties['CancelledBy']) { ([string]$State.CancelledBy) } else { '' }) } 'nonquery'
|            foreach ($s in @($State.Steps)) {
|                $key = '{0}|{1}' -f $State.FlowRunId, $s.Order
|                $att = Get-SIJobFlowAttempts $s
|                $why = if ($s.PSObject.Properties['RetryReason']) { [string]$s.RetryReason } else { '' }; if ($why.Length -gt 1000) { $why = $why.Substring(0, 1000) }
|                $stg = if ($s.PSObject.Properties['Stage']) { [string]$s.Stage } else { '' }
|                $sig = '{0}|{1}|{2}|{3}|{4}|{5}|{6}|{7}|{8}' -f $s.State, $s.Execution, $s.StartedUtc, $s.EndedUtc, $s.ErrorClass, $s.Error, $att, $why, $stg
|                if ($this.Seen[$key] -eq $sig) { continue }
|                $err = [string]$s.Error; if ($err.Length -gt 1000) { $err = $err.Substring(0, 1000) }
|                $null = & $this.Invoke (Get-SIJobFlowSqlText 'SaveStep') @{ FlowRunId = $State.FlowRunId; StepOrder = [int]$s.Order; GroupNo = [int]$s.Group; Job = $s.Job; State = $s.State
|                    Execution = [string]$s.Execution; StartedUtc = (& $nul $s.StartedUtc); EndedUtc = (& $nul $s.EndedUtc); ErrorClass = [string]$s.ErrorClass; Error = $err
|                    Attempts = [int]$att; RetryReason = $why; Stage = $stg } 'nonquery'
|                $this.Seen[$key] = $sig
|            }
|        }
|    }
|}
|
|# =====================================================================================================================
|#  Mode switches (Bootstrap, the VM setup step, the web app's preview uses the same rules in C#)
|# =====================================================================================================================
|function Get-SIJobOrchestrationSwitchPlan {
|    <#
|        PURE. What switching the install to -Mode does to each job -- the preview, and what -Apply carries out. -Jobs:
|        @(@{ Name; TriggerType (Schedule | Manual | Event); Cron; RememberedCron }) as listed. -Definition: the flow (its
|        steps are the jobs IN the flow; default: the default flow over the jobs listed).
|          flow:      a job of the flow on a timer -> to-manual (its timer remembered in the si-disabled-cron tag);
|                     caj-si-flow -> to-schedule at the flow's start time;
|          schedules: a job of the flow without a timer -> to-schedule with its remembered timer, or the map's default
|                     timer (the dependency order of the shipped schedule); caj-si-flow -> to-manual (its time remembered).
|        The updater (Test-SIJobFlowOwnSchedule) keeps its own timer in BOTH modes, and one an earlier switch turned to manual
|        (remembered in si-disabled-cron) is given back -- UPDATE-1.6: it runs on its own daily schedule, never in the pipeline.
|        A job outside the flow, an event-triggered (KEDA) job and the template job are kept. Reversible: switching back
|        restores every timer that was remembered. Returns @(@{ Job; Action = to-manual | to-schedule | keep; Cron; Why }).
|    #>
|    param([AllowEmptyCollection()][object[]]$Jobs = @(), [Parameter(Mandatory)][ValidateSet('flow', 'schedules')][string]$Mode, $Definition, $Map)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    # #1096: a collection in parts (producer + worker) is installed as its engine's step -- the default pipeline has it
|    $names = @($Jobs | Where-Object { $_ } | ForEach-Object { Get-SIJobFlowStepKey ([string]$_.Name) } | Select-Object -Unique)
|    if (-not $Definition) { $Definition = New-SIDefaultJobFlow -Installed $names -Map $Map }
|    if (@(@($Definition.Steps) | Where-Object { $_ -and ((Test-SIJobFlowOwnSchedule -Job ([string]$_.Job) -Map $Map) -or (Test-SIJobFlowRetired -Job ([string]$_.Job) -Map $Map)) }).Count) { $Definition = Remove-SIJobFlowOwnScheduleStep -Definition $Definition -Map $Map }
|    $inFlow = @(@($Definition.Steps) | ForEach-Object { [string]$_.Job })
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($j in @($Jobs | Where-Object { $_ })) {
|        $k = Get-SIJobFlowKey $j.Name; $tt = [string]$j.TriggerType
|        # #1096: a PRODUCER is its engine's step (the runner starts it for that step): in the pipeline it has no timer of its
|        # own -- its own daily timer was a second collection that belonged to no run (found live). Its worker is event-triggered.
|        if ($k -match '-producer$') { $k = Get-SIJobFlowStepKey $k }
|        $row = { param($a, $c, $w) $out.Add([pscustomobject]@{ Job = [string]$j.Name; Action = $a; Cron = $c; Why = $w }) }
|        if ($tt -eq 'Event') { & $row 'keep' '' 'event-triggered (scaled by its queue)'; continue }
|        if ($k -eq 'flow') {
|            if ($Mode -eq 'flow') {
|                if ($tt -eq 'Schedule') { & $row 'keep' ([string]$j.Cron) 'the flow''s timer is on' } else { & $row 'to-schedule' $script:SIJobFlow.TickCron ('wakes the flow runner every 5 min; the flow starts {0}' -f (Get-SIJobFlowCadenceText -Definition $Definition)) }
|            } else {
|                if ($tt -eq 'Schedule') { & $row 'to-manual' ([string]$j.Cron) 'the flow waits (its time is remembered)' } else { & $row 'keep' '' 'the flow is already off' }
|            }
|            continue
|        }
|        # UPDATE-1.6: the updater keeps its OWN timer in every mode -- and gets back one an earlier switch took away
|        if (Test-SIJobFlowOwnSchedule -Job $k -Map $Map) {
|            if ($tt -eq 'Schedule') { & $row 'keep' ([string]$j.Cron) 'the updater runs on its own daily schedule -- never a step of the pipeline' }
|            elseif ([string]$j.RememberedCron) { & $row 'to-schedule' ([string]$j.RememberedCron) 'the updater runs on its own daily schedule -- its timer, taken away by an earlier switch, comes back' }
|            else { & $row 'keep' '' ('the updater has no timer and none is remembered -- give it its daily schedule ({0} UTC) with setup\Install-SIUpdaterJob.ps1' -f $(if ($Map.Jobs.Contains($k) -and $Map.Jobs[$k].DefaultCron) { $Map.Jobs[$k].DefaultCron } else { '30 16,17 * * *' })) }
|            continue
|        }
|        # #412: a retired job (asset-properties) does nothing any more -- its timer is turned off in both modes (remembered,
|        # so the switch stays reversible); it never comes back on
|        if (Test-SIJobFlowRetired -Job $k -Map $Map) {
|            if ($tt -eq 'Schedule') { & $row 'to-manual' ([string]$j.Cron) 'retired -- the profilers publish the full asset metadata themselves (its timer is remembered)' }
|            else { & $row 'keep' '' 'retired -- the profilers publish the full asset metadata themselves' }
|            continue
|        }
|        # #306: the risk trend runs inside Risk Analysis while the jobs run as a pipeline -- its own job waits (runnable by hand)
|        if ($inFlow -notcontains $k -and $Map.Jobs.Contains($k) -and $Map.Jobs[$k].ManualInFlowMode) {
|            if ($Mode -eq 'flow') { if ($tt -eq 'Schedule') { & $row 'to-manual' ([string]$j.Cron) 'Risk Analysis writes the daily trend row itself -- the job is kept for a run by hand (its timer is remembered)' } else { & $row 'keep' '' 'runs by hand only (Risk Analysis writes the daily trend row)' } }
|            else { if ($tt -eq 'Schedule') { & $row 'keep' ([string]$j.Cron) 'already on its own timer' } else { $c = [string]$j.RememberedCron; if (-not $c) { $c = $Map.Jobs[$k].DefaultCron }; & $row 'to-schedule' $c 'its own timer again' } }
|            continue
|        }
|        if ($inFlow -notcontains $k) { & $row 'keep' ([string]$j.Cron) 'not in the flow -- keeps its own schedule'; continue }
|        if ($Mode -eq 'flow') {
|            if ($tt -eq 'Schedule') { & $row 'to-manual' ([string]$j.Cron) ('step {0} of the flow -- its timer {1} is remembered' -f ([array]::IndexOf($inFlow, $k) + 1), $j.Cron) }
|            else { & $row 'keep' '' ('step {0} of the flow' -f ([array]::IndexOf($inFlow, $k) + 1)) }
|        } else {
|            if ($tt -eq 'Schedule') { & $row 'keep' ([string]$j.Cron) 'already on its own timer'; continue }
|            $c = [string]$j.RememberedCron; $why = 'its remembered timer'
|            if (-not $c) { $c = $(if ($Map.Jobs.Contains($k) -and $Map.Jobs[$k].DefaultCron) { $Map.Jobs[$k].DefaultCron } else { '0 4 * * *' }); $why = 'the default timer (dependency order)' }
|            & $row 'to-schedule' $c $why
|        }
|    }
|    , $out.ToArray()
|}
|
|function ConvertTo-SIJobFlowTriggerList {
|    <# PURE. Container Apps jobs as ARM lists them -> @(@{ Name; TriggerType; Cron; RememberedCron }) (the switch plan's input). #>
|    param([AllowEmptyCollection()][object[]]$ArmJobs = @())
|    @($ArmJobs | Where-Object { $_ -and $_.PSObject.Properties['name'] -and [string]$_.name -like 'caj-si-*' } | ForEach-Object {
|        $c = if ($_.PSObject.Properties['properties'] -and $_.properties -and $_.properties.PSObject.Properties['configuration'] -and $_.properties.configuration) { $_.properties.configuration } else { [pscustomobject]@{ triggerType = '' } }
|        [pscustomobject]@{ Name = [string]$_.name; TriggerType = [string]$c.triggerType
|                           Cron = $(if ($c.PSObject.Properties['scheduleTriggerConfig'] -and $c.scheduleTriggerConfig) { [string]$c.scheduleTriggerConfig.cronExpression } else { '' })
|                           RememberedCron = $(if ($_.PSObject.Properties['tags'] -and $_.tags -and $_.tags.PSObject.Properties['si-disabled-cron']) { [string]$_.tags.'si-disabled-cron' } else { '' }) }
|    })
|}
|
|function Test-SIJobOrchestrationNeitherMode {
|    <#
|        PURE. "NEITHER MODE" (found live on a ring 2 install, 2026-10-10: nothing ran for 14 h): caj-si-flow has no timer
|        (Manual) AND no job of the flow has its own timer -- so the daily pipeline never starts and its jobs never run. Not
|        a mode anyone can choose: flow mode = caj-si-flow on its timer; schedules mode = the jobs of the flow on theirs.
|        Jobs outside the flow (the updater's own schedule, the template job, an event-triggered worker, a queue producer,
|        a retired job, the trend job that runs by hand in flow mode) do not count. -Jobs: ConvertTo-SIJobFlowTriggerList.
|        Returns @{ Neither; Why; FlowJob (caj-si-flow exists); Steps (jobs of the flow that exist); Timed (of them on a timer) }.
|    #>
|    param([AllowEmptyCollection()][object[]]$Jobs = @(), $Definition, $Map)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $list = @($Jobs | Where-Object { $_ })
|    $names = @($list | ForEach-Object { [string]$_.Name })
|    if (-not $Definition) { $Definition = New-SIDefaultJobFlow -Installed $names -Map $Map }
|    if (@(@($Definition.Steps) | Where-Object { $_ -and ((Test-SIJobFlowOwnSchedule -Job ([string]$_.Job) -Map $Map) -or (Test-SIJobFlowRetired -Job ([string]$_.Job) -Map $Map)) }).Count) { $Definition = Remove-SIJobFlowOwnScheduleStep -Definition $Definition -Map $Map }
|    $inFlow = @(@($Definition.Steps) | ForEach-Object { Get-SIJobFlowKey ([string]$_.Job) })
|    $flow = @($list | Where-Object { (Get-SIJobFlowKey $_.Name) -eq 'flow' }) | Select-Object -First 1
|    $steps = @($list | Where-Object { $inFlow -contains (Get-SIJobFlowKey $_.Name) -and [string]$_.TriggerType -ne 'Event' })
|    $timed = @($steps | Where-Object { [string]$_.TriggerType -eq 'Schedule' })
|    $mk = { param($n, $w) [pscustomobject]@{ Neither = [bool]$n; Why = $w; FlowJob = [bool]$flow; Steps = $steps.Count; Timed = $timed.Count } }
|    if (-not $flow) { return (& $mk $false 'no caj-si-flow job (an install made before the pipeline: its jobs run on their own timers)') }
|    if ([string]$flow.TriggerType -eq 'Schedule') { return (& $mk $false ('the pipeline is scheduled (caj-si-flow wakes "{0}")' -f $flow.Cron)) }
|    if (-not $steps.Count) { return (& $mk $false 'caj-si-flow has no timer, but no job of the pipeline exists yet') }
|    if ($timed.Count) { return (& $mk $false ('per-job schedules: {0} of {1} job(s) of the pipeline run on their own timer' -f $timed.Count, $steps.Count)) }
|    & $mk $true ('NOTHING RUNS: caj-si-flow has no timer and none of the {0} job(s) of the pipeline has its own -- neither the pipeline nor the jobs start' -f $steps.Count)
|}
|
|function Invoke-SIJobOrchestrationRepair {
|    <#
|        Every update (setup\Invoke-SIContainerUpdate.ps1) -- "neither mode" (Test-SIJobOrchestrationNeitherMode) is put back
|        to the PIPELINE (flow mode), by the same plan and the same PATCH as setup\Switch-SIJobOrchestration.ps1 -Mode flow
|        (Get-SIJobOrchestrationSwitchPlan + ConvertTo-SIArmJobTrigger): in practice caj-si-flow gets its timer back. ONE
|        plain warning line says it. -WhatIf (the update's -DetectOnly): the plan only. Any other state: nothing changes.
|          -Jobs  the jobs as ARM lists them; -Arm { param($Method, $Path, $Body) } -> the parsed answer (GET the job / PATCH it;
|                 $Path = the job's resource id); -Log { param($Level, $Message) } (INFO / WARN).
|        NEVER THROWS. Returns @{ State = ok | repaired | would-repair | failed (the repair did not complete) | unchecked; Why;
|        Changed = @(job names); Plan }.
|    #>
|    param([AllowEmptyCollection()][object[]]$Jobs = @(), [Parameter(Mandatory)][scriptblock]$Arm, [scriptblock]$Log, [switch]$WhatIf, $Definition, $Map)
|    if (-not $Log) { $Log = { param($l, $m) } }
|    $out = { param($s, $w, $c, $p) [pscustomobject]@{ State = $s; Why = $w; Changed = @($c); Plan = @($p) } }
|    try {
|        if (-not $Map) { $Map = Get-SIJobFlowMap }
|        $list = ConvertTo-SIJobFlowTriggerList -ArmJobs $Jobs
|        $chk = Test-SIJobOrchestrationNeitherMode -Jobs $list -Definition $Definition -Map $Map
|        if (-not $chk.Neither) { & $Log 'INFO' ('pipeline schedule: {0}' -f $chk.Why); return (& $out 'ok' $chk.Why @() @()) }
|        # (assigned, never wrapped in @(): the plan comes back as ONE array -- @() would make it one item)
|        $all = Get-SIJobOrchestrationSwitchPlan -Jobs $list -Mode flow -Definition $Definition -Map $Map
|        # timers ON first (caj-si-flow), then off -- stopped half-way it never leaves nothing scheduled
|        $plan = @(@($all | Where-Object { $_.Action -eq 'to-schedule' }) + @($all | Where-Object { $_.Action -eq 'to-manual' }))
|        if ($WhatIf) {
|            & $Log 'WARN' ('pipeline schedule: {0} -- the update switches it to the pipeline: {1} (re-run with -Apply)' -f $chk.Why, (($plan | ForEach-Object { '{0} {1} {2}' -f $_.Job, $_.Action, $_.Cron }) -join '; '))
|            return (& $out 'would-repair' $chk.Why @() $plan)
|        }
|        $done = New-Object System.Collections.Generic.List[string]; $bad = New-Object System.Collections.Generic.List[string]
|        foreach ($p in $plan) {
|            try {
|                $raw = @($Jobs | Where-Object { [string]$_.name -eq [string]$p.Job }) | Select-Object -First 1
|                $job = & $Arm 'GET' ([string]$raw.id) $null
|                $body = ConvertTo-SIArmJobTrigger -Job $job -Action $p.Action -Cron $(if ($p.Action -eq 'to-schedule') { $p.Cron } else { '' })
|                $null = & $Arm 'PATCH' ([string]$raw.id) $body
|                $done.Add([string]$p.Job)
|            } catch { $bad.Add(('{0} ({1})' -f $p.Job, $_.Exception.Message)) }
|        }
|        if ($bad.Count) {
|            & $Log 'WARN' ('pipeline schedule: {0} -- switching it to the pipeline did not complete: {1}; the next update tries again (or run setup\Switch-SIJobOrchestration.ps1 -Mode flow -Apply)' -f $chk.Why, ($bad -join '; '))
|            return (& $out 'failed' $chk.Why $done.ToArray() $plan)
|        }
|        & $Log 'WARN' ('pipeline schedule: {0} -- switched to the pipeline (flow mode): {1}' -f $chk.Why, (($plan | ForEach-Object { '{0} {1} {2}' -f $_.Job, $_.Action, $_.Cron }) -join '; '))
|        & $out 'repaired' $chk.Why $done.ToArray() $plan
|    } catch {
|        & $Log 'WARN' ('pipeline schedule: not checked ({0}) -- the next update tries again' -f $_.Exception.Message)
|        & $out 'unchecked' "$($_.Exception.Message)" @() @()
|    }
|}
|
|function Get-SICollectProducerTriggerPlan {
|    <#
|        PURE (#1096). Which collect PRODUCERS (caj-si-<engine>-producer) lose their own timer: in PIPELINE mode a producer whose
|        engine is a step of the pipeline (-Definition: the stored one; none = the default over the installed jobs) is started
|        only by the pipeline -> to-manual (its cron remembered in si-disabled-cron, exactly as every other step). A producer
|        whose engine is NOT a step of the stored pipeline keeps its timer (it is then that engine's only collection) and is
|        named. SCHEDULES mode: nothing changes. -Jobs: ConvertTo-SIJobFlowTriggerList. Returns @(@{ Job; Action = to-manual |
|        keep; Cron; Why }) -- one row per producer.
|    #>
|    param([AllowEmptyCollection()][object[]]$Jobs = @(), [Parameter(Mandatory)][ValidateSet('flow', 'schedules')][string]$Mode, $Definition, $Map)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $list = @($Jobs | Where-Object { $_ })
|    $prods = @($list | Where-Object { [string]$_.Name -match '^caj-si-.+-producer$' -and [string]$_.TriggerType -ne 'Event' })
|    if (-not $prods.Count) { return }
|    $plan = Get-SIJobOrchestrationSwitchPlan -Jobs $list -Mode flow -Definition $Definition -Map $Map
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($p in $prods) {
|        $row = @($plan | Where-Object { [string]$_.Job -eq [string]$p.Name })[0]
|        $step = Get-SIJobFlowStepKey ([string]$p.Name)
|        if ($Mode -ne 'flow') { $out.Add([pscustomobject]@{ Job = [string]$p.Name; Action = 'keep'; Cron = [string]$p.Cron; Why = 'the jobs run on their own timers -- the producer keeps its timer' }); continue }
|        if ($row -and $row.Action -eq 'to-manual') { $out.Add([pscustomobject]@{ Job = [string]$p.Name; Action = 'to-manual'; Cron = [string]$p.Cron; Why = ('the {0} step of the pipeline starts it -- its own timer "{1}" is remembered' -f $step, $p.Cron) }); continue }
|        if ([string]$p.TriggerType -eq 'Manual') { $out.Add([pscustomobject]@{ Job = [string]$p.Name; Action = 'keep'; Cron = ''; Why = ('started by the {0} step of the pipeline' -f $step) }); continue }
|        $out.Add([pscustomobject]@{ Job = [string]$p.Name; Action = 'keep'; Cron = [string]$p.Cron; Why = ('{0} is not a step of the stored pipeline -- the producer keeps its own timer (its only collection); add {0} to the pipeline on Operations > Jobs' -f $step) })
|    }
|    $out.ToArray()
|}
|
|function Invoke-SICollectProducerTrigger {
|    <#
|        #1096, EVERY UPDATE (existing installs reach the new-install state): in pipeline mode each collect producer whose engine
|        is a step of the pipeline goes MANUAL (Get-SICollectProducerTriggerPlan) -- the same PATCH as every switch
|        (ConvertTo-SIArmJobTrigger: the trigger and the tags only, the cron remembered in si-disabled-cron), then READ BACK
|        until the trigger is Manual. A producer already Manual is not touched (idempotent). -Jobs: the jobs as ARM lists them;
|        -Arm { param($Method, $Path, $Body) } (Path = the job's resource id); -Mode flow | schedules; -Definition: the stored
|        pipeline ($null = the default); -WhatIf: the plan only. NEVER THROWS. Returns @{ State = ok | converged | would-converge
|        | failed | unchecked; Lines; Changed; Plan }.
|    #>
|    param([AllowEmptyCollection()][object[]]$Jobs = @(), [Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][ValidateSet('flow', 'schedules')][string]$Mode,
|          $Definition, $Map, [switch]$WhatIf, [int]$PollSeconds = 5, [int]$PollMax = 12)
|    $lines = New-Object System.Collections.Generic.List[string]
|    $out = { param($s, $c, $p) [pscustomobject]@{ State = $s; Lines = $lines.ToArray(); Changed = @($c); Plan = @($p) } }
|    try {
|        $plan = @(Get-SICollectProducerTriggerPlan -Jobs (ConvertTo-SIJobFlowTriggerList -ArmJobs $Jobs) -Mode $Mode -Definition $Definition -Map $Map)
|        foreach ($k in @($plan | Where-Object { $_.Action -eq 'keep' -and $_.Why -match 'not a step of the stored pipeline' })) { $lines.Add(('collect producer: {0} -- {1}' -f $k.Job, $k.Why)) }
|        $todo = @($plan | Where-Object { $_.Action -eq 'to-manual' })
|        if (-not $todo.Count) { if (@($plan).Count) { $lines.Add(('collect producers: {0}' -f $(if ($Mode -eq 'flow') { 'started only by the pipeline' } else { 'on their own timers (the jobs run on their own timers)' }))) }; return (& $out 'ok' @() $plan) }
|        if ($WhatIf) { foreach ($t in $todo) { $lines.Add(('collect producer: {0} would lose its own timer -- {1} (re-run with -Apply)' -f $t.Job, $t.Why)) }; return (& $out 'would-converge' @() $plan) }
|        $done = New-Object System.Collections.Generic.List[string]; $bad = 0
|        foreach ($t in $todo) {
|            try {
|                $raw = @($Jobs | Where-Object { [string]$_.name -eq [string]$t.Job }) | Select-Object -First 1
|                $id = [string]$raw.id
|                $job = & $Arm 'GET' $id $null
|                if ([string]$job.properties.configuration.triggerType -ne 'Manual') {
|                    $null = & $Arm 'PATCH' $id (ConvertTo-SIArmJobTrigger -Job $job -Action 'to-manual')
|                }
|                # read back (ARM may apply a PATCH asynchronously)
|                $tt = ''
|                for ($i = 1; $i -le [Math]::Max(1, $PollMax); $i++) {
|                    $b = & $Arm 'GET' $id $null
|                    $tt = [string]$b.properties.configuration.triggerType
|                    if ($tt -eq 'Manual') { break }
|                    if ($i -lt $PollMax -and $PollSeconds -gt 0) { Start-Sleep -Seconds $PollSeconds }
|                }
|                if ($tt -ne 'Manual') { throw ('read back: trigger {0}' -f $(if ($tt) { $tt } else { 'unknown' })) }
|                $done.Add([string]$t.Job)
|                $lines.Add(('collect producer: {0} -- {1}; now started only by the pipeline (read back)' -f $t.Job, $t.Why))
|            } catch { $bad++; $lines.Add(('collect producer: {0} was NOT taken off its own timer ({1}) -- the update goes on; the next update tries again' -f $t.Job, $_.Exception.Message)) }
|        }
|        & $out $(if ($bad) { 'failed' } else { 'converged' }) $done.ToArray() $plan
|    } catch {
|        $lines.Add(('collect producers: not checked ({0}) -- the update goes on; the next update tries again' -f $_.Exception.Message))
|        & $out 'unchecked' @() @()
|    }
|}
|
|function Get-SIFlowRunnerScheduleState {
|    <#
|        PURE. #732 (live 2026-10-17: one install's caj-si-flow had trigger Manual and never ran after its install; a queued
|        run waited 6 h -- every other install wakes the runner every 5 minutes). Is the pipeline runner on its schedule?
|        -Jobs: ConvertTo-SIJobFlowTriggerList. Returns @{ State; Why; Cron; Trigger }:
|          scheduled       caj-si-flow is on a timer (whatever its cron)
|          not-scheduled   caj-si-flow has no timer, and no job of the pipeline runs on its own -- the update puts it on
|                          its schedule; the heartbeat says so (si-flow-1201)
|          schedules-mode  caj-si-flow has no timer, and the jobs of the pipeline run on their own timers: that install
|                          chose per-job schedules -- left as it is (a runner on its timer would run the default pipeline
|                          there as well, every job twice)
|          no-runner       no caj-si-flow (an install made before the pipeline)
|    #>
|    param([AllowEmptyCollection()][object[]]$Jobs = @(), $Definition, $Map)
|    $list = @($Jobs | Where-Object { $_ })
|    $flow = @($list | Where-Object { (Get-SIJobFlowKey ([string]$_.Name)) -eq 'flow' }) | Select-Object -First 1
|    $mk = { param($s, $w) [pscustomobject]@{ State = $s; Why = $w; Cron = $(if ($flow) { [string]$flow.Cron } else { '' }); Trigger = $(if ($flow) { [string]$flow.TriggerType } else { '' }) } }
|    if (-not $flow) { return (& $mk 'no-runner' 'no caj-si-flow job at this install (an install made before the pipeline: its jobs run on their own timers)') }
|    if ([string]$flow.TriggerType -eq 'Schedule') { return (& $mk 'scheduled' ('caj-si-flow wakes "{0}"' -f [string]$flow.Cron)) }
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $chk = Test-SIJobOrchestrationNeitherMode -Jobs $list -Definition $Definition -Map $Map
|    if ($chk.Timed -gt 0) { return (& $mk 'schedules-mode' ('caj-si-flow has no timer and {0} of the {1} job(s) of the pipeline run on their own timer -- this install runs its jobs on their own schedules' -f $chk.Timed, $chk.Steps)) }
|    & $mk 'not-scheduled' ('caj-si-flow has no timer (trigger {0}) -- the pipeline never starts by itself and a queued run waits' -f $(if ([string]$flow.TriggerType) { [string]$flow.TriggerType } else { 'unknown' }))
|}
|
|function New-SIFlowRunnerSchedulePatchBody {
|    <#
|        PURE. #732: the ARM PATCH that puts caj-si-flow on its schedule, from the job as ARM just returned it (GET): the
|        job's WHOLE template as read (the default imageType and the read-only ephemeralStorage left out, as every update
|        PATCH does), its configuration with triggerType Schedule and scheduleTriggerConfig { -Cron, its parallelism and
|        completion count }, its run limit (replicaTimeout -- 7 days) and retry limit as read; its tags without the
|        si-disabled-cron a Manual job remembers. NEVER the secrets or the registries (ARM returns secrets without their
|        values). The input is not changed. Returns an ordered dictionary (ConvertTo-Json it).
|    #>
|    param([Parameter(Mandatory)]$Job, [string]$Cron = $script:SIJobFlow.TickCron)
|    $props = if ($Job.PSObject.Properties['properties']) { $Job.properties } else { $null }
|    $cfg = if ($props -and $props.PSObject.Properties['configuration']) { $props.configuration } else { $null }
|    if (-not $cfg) { throw 'the job has no configuration' }
|    if (-not $props.PSObject.Properties['template'] -or -not $props.template) { throw 'the job has no template' }
|    if ($Cron -notmatch '^[0-9*/,\-]{1,40}( [0-9*/,\-]{1,40}){4}$') { throw ("'{0}' is not a 5-field cron expression" -f $Cron) }
|    $tpl = ConvertTo-Json -InputObject $props.template -Depth 60 | ConvertFrom-Json
|    foreach ($c in (@($tpl.containers) + @($tpl.initContainers))) {
|        if (-not $c) { continue }
|        if ($c.PSObject.Properties['imageType'] -and ([string]$c.imageType -in '', 'ContainerImage')) { $c.PSObject.Properties.Remove('imageType') }
|        if ($c.PSObject.Properties['resources'] -and $c.resources -and $c.resources.PSObject.Properties['ephemeralStorage']) { $c.resources.PSObject.Properties.Remove('ephemeralStorage') }
|    }
|    $par = 1; $rcc = 1
|    $src = if ($cfg.PSObject.Properties['scheduleTriggerConfig'] -and $cfg.scheduleTriggerConfig) { $cfg.scheduleTriggerConfig } elseif ($cfg.PSObject.Properties['manualTriggerConfig'] -and $cfg.manualTriggerConfig) { $cfg.manualTriggerConfig } else { $null }
|    if ($src) { if ($src.PSObject.Properties['parallelism'] -and $src.parallelism) { $par = $src.parallelism }; if ($src.PSObject.Properties['replicaCompletionCount'] -and $src.replicaCompletionCount) { $rcc = $src.replicaCompletionCount } }
|    $c2 = [ordered]@{ triggerType = 'Schedule' }
|    if ($cfg.PSObject.Properties['replicaTimeout'] -and $cfg.replicaTimeout) { $c2.replicaTimeout = $cfg.replicaTimeout }
|    if ($cfg.PSObject.Properties['replicaRetryLimit'] -and $null -ne $cfg.replicaRetryLimit -and "$($cfg.replicaRetryLimit)" -ne '') { $c2.replicaRetryLimit = $cfg.replicaRetryLimit }
|    $c2.scheduleTriggerConfig = [ordered]@{ cronExpression = $Cron; parallelism = $par; replicaCompletionCount = $rcc }
|    $tags = [ordered]@{}
|    if ($Job.PSObject.Properties['tags'] -and $null -ne $Job.tags) {
|        if ($Job.tags -is [System.Collections.IDictionary]) { foreach ($k in $Job.tags.Keys) { $tags[[string]$k] = [string]$Job.tags[$k] } }
|        else { foreach ($p in $Job.tags.PSObject.Properties) { $tags[$p.Name] = [string]$p.Value } }
|    }
|    $tags.Remove('si-disabled-cron')
|    [ordered]@{ tags = $tags; properties = [ordered]@{ template = $tpl; configuration = $c2 } }
|}
|
|function Invoke-SIFlowRunnerSchedule {
|    <#
|        #732, EVERY UPDATE (existing installs reach the new-install state): an existing caj-si-flow without its timer is put
|        on its schedule (-Cron, default "*/5 * * * *", the runner's wake-up a new install gets) -- ONE read-modify-write ARM
|        PATCH (New-SIFlowRunnerSchedulePatchBody: the whole template, the run limit and retry limit kept, no secret sent
|        back), then READ BACK until the trigger is Schedule on that cron. ONE plain line says what happened. A runner on a
|        timer is never touched (no PATCH); an install that runs its jobs on their own timers keeps them (schedules-mode);
|        no caj-si-flow = nothing. -Jobs: the job list (ARM shape). -Rest: the update's REST seam { param($Method, $Uri, $Body,
|        $Resource, $Headers) } -> @{ Status; Body }. -WhatIf: the plan only, no call.
|        NEVER THROWS. Returns @{ State = ok | patched | would-patch | schedules-mode | no-runner | failed; Line; Why }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [AllowEmptyCollection()][object[]]$Jobs = @(), [string]$Cron = $script:SIJobFlow.TickCron, [switch]$WhatIf,
|          [int]$PollSeconds = 5, [int]$PollMax = 24, $Map)
|    $out = { param($s, $l, $w) [pscustomobject]@{ State = $s; Line = $l; Why = $w } }
|    $name = 'caj-si-flow'
|    try {
|        $st = Get-SIFlowRunnerScheduleState -Jobs (ConvertTo-SIJobFlowTriggerList -ArmJobs $Jobs) -Map $Map
|        switch ($st.State) {
|            'no-runner'      { return (& $out 'no-runner' ('pipeline runner: {0}' -f $st.Why) $st.Why) }
|            'scheduled'      { return (& $out 'ok' ('pipeline runner: on its schedule -- {0}' -f $st.Why) $st.Why) }
|            'schedules-mode' { return (& $out 'schedules-mode' ('pipeline runner: left without its timer -- {0}' -f $st.Why) $st.Why) }
|        }
|        if ($WhatIf) { return (& $out 'would-patch' ('pipeline runner: {0} -- the update puts {1} on its schedule "{2}" (re-run with -Apply)' -f $st.Why, $name, $Cron) $st.Why) }
|        $uri = 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs/{2}?api-version={3}' -f $SubscriptionId, $ResourceGroup, $name, $script:SIJobFlow.ArmApi
|        $arm = 'https://management.azure.com/'
|        $call = {
|            param([string]$Method, $Body)
|            $r = $null
|            try { $r = & $Rest $Method $uri $Body $arm @{ 'Content-Type' = 'application/json' } } catch { $r = [pscustomobject]@{ Status = 0; Body = $_.Exception.Message } }
|            if (-not $r) { $r = [pscustomobject]@{ Status = 0; Body = 'no answer' } }
|            $r
|        }
|        $isOk = { param($r) $r -and [int]$r.Status -ge 200 -and [int]$r.Status -lt 300 }
|        $parse = { param($r) if (-not $r -or -not "$($r.Body)".Trim()) { return $null }; $o = $null; try { $o = ("$($r.Body)" | ConvertFrom-Json) } catch { $o = $null }; $o }
|        $why = { param($r) $t = ("$(if ($r) { $r.Body })" -replace '\s+', ' ').Trim(); if ($t.Length -gt 300) { $t = $t.Substring(0, 297) + '...' }; ('HTTP {0}{1}' -f $(if ($r) { [int]$r.Status } else { 0 }), $(if ($t) { ": $t" } else { '' })) }
|        $fail = { param($w) & $out 'failed' ('pipeline runner: {0} was NOT put on its schedule "{1}" ({2}) -- the update goes on; the next update tries again' -f $name, $Cron, $w) $w }
|        # read
|        $g = & $call 'GET' $null
|        if (-not (& $isOk $g)) { return (& $fail ('it could not be read: {0}' -f (& $why $g))) }
|        $job = & $parse $g
|        if (-not $job) { return (& $fail 'it could not be read') }
|        if ([string]$job.properties.configuration.triggerType -eq 'Schedule') { return (& $out 'ok' ('pipeline runner: on its schedule -- {0} wakes "{1}" (set meanwhile)' -f $name, [string]$job.properties.configuration.scheduleTriggerConfig.cronExpression) 'set meanwhile') }
|        # modify + write
|        $body = New-SIFlowRunnerSchedulePatchBody -Job $job -Cron $Cron
|        $p = & $call 'PATCH' (ConvertTo-Json -InputObject $body -Depth 60 -Compress)
|        if (-not (& $isOk $p)) { return (& $fail ('Azure refused it: {0}' -f (& $why $p))) }
|        # read back (ARM may apply a PATCH asynchronously)
|        $tt = ''; $got = ''
|        for ($k = 1; $k -le [Math]::Max(1, $PollMax); $k++) {
|            $b = & $call 'GET' $null
|            $j = if (& $isOk $b) { & $parse $b } else { $null }
|            $ps = ''; $tt = ''; $got = ''
|            if ($j) {
|                try { $ps = [string]$j.properties.provisioningState } catch { }
|                try { $tt = [string]$j.properties.configuration.triggerType } catch { }
|                try { $got = [string]$j.properties.configuration.scheduleTriggerConfig.cronExpression } catch { }
|            }
|            if ($j -and ($tt -eq 'Schedule' -and (($got -replace '\s+', ' ').Trim() -eq $Cron)) -and (-not $ps -or $ps -in @('Succeeded', 'Failed', 'Canceled'))) { break }
|            if ($j -and $ps -in @('Failed', 'Canceled')) { break }
|            if ($k -lt $PollMax -and $PollSeconds -gt 0) { Start-Sleep -Seconds $PollSeconds }
|        }
|        if ($tt -ne 'Schedule' -or (($got -replace '\s+', ' ').Trim() -ne $Cron)) { return (& $fail ('read back: trigger {0}, timer "{1}"' -f $(if ($tt) { $tt } else { 'unknown' }), $got)) }
|        & $out 'patched' ('pipeline runner: {0} had no timer -- put on its schedule "{1}" and read back (the pipeline starts by itself again; a queued run no longer waits)' -f $name, $Cron) $st.Why
|    } catch {
|        & $out 'failed' ('pipeline runner: not checked ({0}) -- the update goes on; the next update tries again' -f $_.Exception.Message) "$($_.Exception.Message)"
|    }
|}
|
|function Get-SIJobFlowSetModeSql {
|    <# PURE. #732: how the stored pipeline runs (cfg.JobFlow Mode), set ONLY through cfg.JobFlowSetMode (sql\si-pro-settings.sql;
|       the engine role holds EXECUTE on it and no write right on the table). Returns one row: Updated (0 = none stored). #>
|    'EXEC cfg.JobFlowSetMode @Mode = @Mode, @By = @By;'
|}
|
|function Get-SIJobFlowMigrationLastComplete {
|    <#
|        PURE. #732 migration: when the install last ran COMPLETELY under its own timers -- the OLDEST of the pipeline steps'
|        newest succeeded execution start (every step ran at least that recently). $null when a step has never succeeded or
|        no step was read. -Executions: job name -> its executions (ARM shape). -Steps: the pipeline's step job names.
|    #>
|    param([System.Collections.IDictionary]$Executions = @{}, [string[]]$Steps = @())
|    $oldest = $null
|    foreach ($s in @($Steps | Where-Object { $_ })) {
|        $newest = $null
|        foreach ($x in @($Executions[$s])) {
|            if (-not $x) { continue }
|            $p = if ($x.PSObject.Properties['properties']) { $x.properties } else { $x }
|            if ([string]$p.status -ne 'Succeeded' -or -not $p.startTime) { continue }
|            $t = ([datetime]$p.startTime).ToUniversalTime()
|            if ($null -eq $newest -or $t -gt $newest) { $newest = $t }
|        }
|        if ($null -eq $newest) { return $null }
|        if ($null -eq $oldest -or $newest -lt $oldest) { $oldest = $newest }
|    }
|    $oldest
|}
|
|function Invoke-SIJobFlowMigration {
|    <#
|        #732 (owner 2026-10-17: ONE method everywhere -- every install runs as the pipeline). EVERY UPDATE: an install that
|        runs its jobs on their OWN timers (Get-SIFlowRunnerScheduleState 'schedules-mode') is moved to the pipeline (flow
|        mode) -- the state a new install has -- in one step:
|          0. the pipeline: the stored one (cfg.JobFlow) when there is one -- its Mode made 'flow', read back; none stored =
|             the default pipeline over the installed jobs, exactly what a new install runs (setup stores none either);
|          1. NEVER TWICE: only when no engine job (every caj-si-* job but the updater and the heartbeat; caj-si-flow too) has
|             an execution Running / Processing and no pipeline run is going (cfg.FlowRun unfinished with a fresh
|             heartbeat). Otherwise -- or when that cannot be read -- one line, nothing changed, the next update tries again;
|          2. the jobs of the pipeline go MANUAL (their timer remembered in si-disabled-cron, exactly as a flow install has
|             them; Get-SIJobOrchestrationSwitchPlan -Mode flow, ConvertTo-SIArmJobTrigger: the trigger and the tags only,
|             everything else on the job kept), then caj-si-flow goes on its schedule ("*/5 * * * *");
|          3. EVERYTHING READ BACK. Any step that fails, part-way: what this run changed is put BACK (timers on, caj-si-flow
|             Manual, the stored mode as it was) -- the install keeps running on its timers. Should that put-back itself
|             fail, the update's neither-mode repair that runs next (Invoke-SIJobOrchestrationRepair, on a fresh job list)
|             puts caj-si-flow on its timer: never neither;
|          4. NEVER A DAY SKIPPED: when the install's last COMPLETE run (Get-SIJobFlowMigrationLastComplete) is older than the
|             pipeline's latest start time (Get-SIJobFlowLatestSlot), ONE pipeline run is queued (cfg.PipelineQueue, as "Run
|             now"; requested by 'update'). Without the Pro database: said, not queued.
|        -Rest: the update's REST seam { param($Method, $Uri, $Body, $Resource, $Headers) } -> @{ Status; Body }. -Sql: the Pro
|        database { param($Query, $Params, $Mode) } ($null = none). -WhatIf (the update's -DetectOnly): the plan only, no
|        change. One plain line per change. NEVER THROWS.
|        Returns @{ State = not-needed | would-migrate | deferred | migrated | reverted | failed; Lines; Queued; Changed }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [AllowEmptyCollection()][object[]]$Jobs = @(), [scriptblock]$Sql, [switch]$WhatIf, [datetime]$NowUtc = [datetime]::UtcNow,
|          [int]$PollSeconds = 5, [int]$PollMax = 12, [int]$StaleAfterMinutes = 15, $Map)
|    $lines = New-Object System.Collections.Generic.List[string]
|    $changed = New-Object System.Collections.Generic.List[string]
|    $out = { param($s, [bool]$q = $false) [pscustomobject]@{ State = $s; Lines = $lines.ToArray(); Queued = $q; Changed = $changed.ToArray() } }
|    try {
|        if (-not $Map) { $Map = Get-SIJobFlowMap }
|        $now = $NowUtc.ToUniversalTime()
|        $list = ConvertTo-SIJobFlowTriggerList -ArmJobs $Jobs
|        $st = Get-SIFlowRunnerScheduleState -Jobs $list -Map $Map
|        if ($st.State -ne 'schedules-mode') { return (& $out 'not-needed') }
|        $arm = 'https://management.azure.com/'
|        $base = 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs' -f $SubscriptionId, $ResourceGroup
|        $api = '?api-version={0}' -f $script:SIJobFlow.ArmApi
|        $call = {
|            param([string]$Method, [string]$Uri, $Body)
|            $r = $null
|            try { $r = & $Rest $Method $Uri $Body $arm @{ 'Content-Type' = 'application/json' } } catch { $r = [pscustomobject]@{ Status = 0; Body = $_.Exception.Message } }
|            if (-not $r) { $r = [pscustomobject]@{ Status = 0; Body = 'no answer' } }
|            $r
|        }
|        $isOk = { param($r) $r -and [int]$r.Status -ge 200 -and [int]$r.Status -lt 300 }
|        $parse = { param($r) if (-not $r -or -not "$($r.Body)".Trim()) { return $null }; $o = $null; try { $o = ("$($r.Body)" | ConvertFrom-Json) } catch { $o = $null }; $o }
|        $why = { param($r) $t = ("$(if ($r) { $r.Body })" -replace '\s+', ' ').Trim(); if ($t.Length -gt 200) { $t = $t.Substring(0, 197) + '...' }; ('HTTP {0}{1}' -f $(if ($r) { [int]$r.Status } else { 0 }), $(if ($t) { ": $t" } else { '' })) }
|        $pre = 'switch to the pipeline:'
|
|        # 0. the pipeline this install will run
|        $store = $null; $stored = $null
|        if ($Sql) {
|            $store = New-SIJobFlowSqlStore -Invoke $Sql
|            try { $stored = $store.ReadDefinition() } catch { $lines.Add(('{0} not now -- the stored pipeline could not be read ({1}); the next update tries again' -f $pre, $_.Exception.Message)); return (& $out 'deferred') }
|        }
|        $names = @($list | ForEach-Object { [string]$_.Name })
|        $def = if ($stored) { ConvertFrom-SIJobFlowJson -Json $stored.Json } else { New-SIDefaultJobFlow -Installed $names -Map $Map }
|        $def.Mode = 'flow'
|        $all = Get-SIJobOrchestrationSwitchPlan -Jobs $list -Mode flow -Definition $def -Map $Map
|        # timers OFF first, then caj-si-flow ON: in between nothing starts -- never a job twice
|        $toManual = @($all | Where-Object { $_.Action -eq 'to-manual' })
|        $toSched = @($all | Where-Object { $_.Action -eq 'to-schedule' })
|        $steps = @(@($def.Steps) | ForEach-Object { 'caj-si-' + (Get-SIJobFlowKey ([string]$_.Job)) } | Where-Object { $names -contains $_ })
|
|        # 1. never twice: nothing may be running
|        $execs = @{}
|        $watch = @($names | Where-Object { $_ -notin @('caj-si-updater', 'caj-si-heartbeat') })
|        $busy = New-Object System.Collections.Generic.List[string]
|        foreach ($n in $watch) {
|            $r = & $call 'GET' ('{0}/{1}/executions{2}' -f $base, $n, $api) $null
|            if (-not (& $isOk $r)) { $lines.Add(('{0} not now -- whether {1} is running could not be read ({2}); nothing was changed, the next update tries again' -f $pre, $n, (& $why $r))); return (& $out 'deferred') }
|            $v = & $parse $r
|            $ex = @(if ($v -and $v.PSObject.Properties['value']) { @($v.value) } else { @() })
|            $execs[$n] = $ex
|            if (@($ex | Where-Object { $_ -and ([string]$(if ($_.PSObject.Properties['properties']) { $_.properties.status } else { $_.status })) -in @('Running', 'Processing') }).Count) { $busy.Add($n) }
|        }
|        if ($store) {
|            $last = $null
|            try { $last = $store.Load() } catch { $lines.Add(('{0} not now -- the last pipeline run could not be read ({1}); nothing was changed, the next update tries again' -f $pre, $_.Exception.Message)); return (& $out 'deferred') }
|            if ($last -and [string]$last.State -notin @('Succeeded', 'Failed', 'Stopped') -and $last.HeartbeatUtc -and ($now - ([datetime]$last.HeartbeatUtc).ToUniversalTime()).TotalMinutes -lt $StaleAfterMinutes) { $busy.Add(('the pipeline run {0}' -f $last.FlowRunId)) }
|        }
|        if ($busy.Count) {
|            $lines.Add(('{0} not now -- running: {1}; nothing was changed (a job never runs twice), the next update tries again' -f $pre, ($busy -join ', ')))
|            return (& $out 'deferred')
|        }
|
|        # 4 (decided now, done last). never a day skipped
|        $slot = Get-SIJobFlowLatestSlot -Definition $def -NowUtc $now
|        $lastComplete = Get-SIJobFlowMigrationLastComplete -Executions $execs -Steps $steps
|        $needRun = [bool]($slot -and ($null -eq $lastComplete -or $lastComplete -lt $slot))
|        $runWhy = if (-not $slot) { '' } elseif ($null -eq $lastComplete) { 'no complete run of every step is recorded' } else { 'the last complete run started {0:u}, before the pipeline''s start {1:u}' -f $lastComplete, $slot }
|
|        if ($WhatIf) {
|            $lines.Add(('{0} this install runs its jobs on their own timers -- the update moves it to the pipeline (re-run with -Apply):' -f $pre))
|            if ($stored -and [string]$stored.Mode -ne 'flow') { $lines.Add(('{0} the stored pipeline would be set to run as the pipeline (it says ''{1}'')' -f $pre, $stored.Mode)) }
|            foreach ($p in @($toManual + $toSched)) { $lines.Add(('{0} {1} would go {2}{3} -- {4}' -f $pre, $p.Job, $(if ($p.Action -eq 'to-manual') { 'Manual' } else { 'on its schedule' }), $(if ($p.Cron) { ' "' + $p.Cron + '"' } else { '' }), $p.Why)) }
|            if ($needRun) { $lines.Add(('{0} one pipeline run would be queued -- {1}' -f $pre, $runWhy)) }
|            return (& $out 'would-migrate')
|        }
|
|        # the put-back of whatever this run changed (timers on first, then caj-si-flow off, then the stored mode)
|        $doneM = New-Object System.Collections.Generic.List[string]; $doneS = New-Object System.Collections.Generic.List[string]; $modeOld = $null
|        $patch = {
|            param([string]$Job, [string]$Action, [string]$Cron)
|            $g = & $call 'GET' ('{0}/{1}{2}' -f $base, $Job, $api) $null
|            if (-not (& $isOk $g)) { throw ('{0} could not be read ({1})' -f $Job, (& $why $g)) }
|            $body = ConvertTo-SIArmJobTrigger -Job (& $parse $g) -Action $Action -Cron $Cron
|            $p = & $call 'PATCH' ('{0}/{1}{2}' -f $base, $Job, $api) (ConvertTo-Json -InputObject $body -Depth 20 -Compress)
|            if (-not (& $isOk $p)) { throw ('{0}: Azure refused it ({1})' -f $Job, (& $why $p)) }
|        }
|        $putBack = {
|            param([string]$Cause)
|            $bad = New-Object System.Collections.Generic.List[string]
|            foreach ($j in @($doneM)) { try { & $patch $j 'to-schedule' ''; $lines.Add(('{0} {1} back on its own timer' -f $pre, $j)) } catch { $bad.Add($_.Exception.Message) } }
|            foreach ($j in @($doneS)) { try { & $patch $j 'to-manual' ''; $lines.Add(('{0} {1} back to Manual' -f $pre, $j)) } catch { $bad.Add($_.Exception.Message) } }
|            if ($null -ne $modeOld) {
|                try { $null = & $Sql (Get-SIJobFlowSetModeSql) @{ Mode = $modeOld; By = 'update' } 'reader'; $lines.Add(('{0} the stored pipeline back to ''{1}''' -f $pre, $modeOld)) }
|                catch { $bad.Add(('the stored pipeline mode: {0}' -f $_.Exception.Message)) }
|            }
|            if ($bad.Count) {
|                $lines.Add(('{0} NOT done ({1}) and NOT fully put back ({2}) -- the neither-mode repair that runs next puts caj-si-flow on its timer; the next update tries again' -f $pre, $Cause, ($bad -join '; ')))
|                return 'failed'
|            }
|            $lines.Add(('{0} NOT done ({1}) -- put back: the install runs on its own timers as before; the next update tries again' -f $pre, $Cause))
|            'reverted'
|        }
|
|        # 0. the stored pipeline runs as the pipeline
|        if ($stored -and [string]$stored.Mode -ne 'flow') {
|            try {
|                $null = & $Sql (Get-SIJobFlowSetModeSql) @{ Mode = 'flow'; By = 'update' } 'reader'
|                $modeOld = [string]$stored.Mode
|                $back = $store.ReadDefinition()
|                if (-not $back -or [string]$back.Mode -ne 'flow') { throw ('it reads back ''{0}''' -f $(if ($back) { $back.Mode } else { 'nothing' })) }
|                $lines.Add(('{0} the stored pipeline runs as the pipeline (was ''{1}'')' -f $pre, $modeOld))
|            } catch { return (& $out (& $putBack ('the stored pipeline could not be set to run as the pipeline: {0}' -f $_.Exception.Message))) }
|        }
|        # 2. timers off, then caj-si-flow on
|        foreach ($p in $toManual) {
|            try { & $patch $p.Job 'to-manual' ''; $doneM.Add($p.Job); $changed.Add($p.Job); $lines.Add(('{0} {1} Manual -- a step of the pipeline now (its timer "{2}" remembered)' -f $pre, $p.Job, $p.Cron)) }
|            catch { return (& $out (& $putBack $_.Exception.Message)) }
|        }
|        foreach ($p in $toSched) {
|            try { & $patch $p.Job 'to-schedule' ([string]$p.Cron); $doneS.Add($p.Job); $changed.Add($p.Job); $lines.Add(('{0} {1} on its schedule "{2}"' -f $pre, $p.Job, $p.Cron)) }
|            catch { return (& $out (& $putBack $_.Exception.Message)) }
|        }
|        # 3. read everything back
|        $want = @{}; foreach ($j in $doneM) { $want[$j] = 'Manual' }; foreach ($j in $doneS) { $want[$j] = 'Schedule' }
|        $wrong = @()
|        for ($k = 1; $k -le [Math]::Max(1, $PollMax); $k++) {
|            $wrong = @()
|            foreach ($j in @($want.Keys)) {
|                $g = & $call 'GET' ('{0}/{1}{2}' -f $base, $j, $api) $null
|                $o = if (& $isOk $g) { & $parse $g } else { $null }
|                $tt = ''; try { $tt = [string]$o.properties.configuration.triggerType } catch { }
|                if ($tt -ne $want[$j]) { $wrong += ('{0} reads back {1}' -f $j, $(if ($tt) { $tt } else { 'nothing' })) }
|            }
|            if (-not $wrong.Count) { break }
|            if ($k -lt $PollMax -and $PollSeconds -gt 0) { Start-Sleep -Seconds $PollSeconds }
|        }
|        if ($wrong.Count) { return (& $out (& $putBack ('read back: {0}' -f ($wrong -join '; ')))) }
|        $lines.Add(('{0} done and read back -- the install runs as the pipeline ({1} job(s) changed)' -f $pre, $changed.Count))
|
|        # 4. never a day skipped
|        $queued = $false
|        if ($needRun) {
|            if (-not $Sql) { $lines.Add(('{0} today''s pipeline run is not queued -- {1}, and this install has no Pro database for the queue; start it with Run now' -f $pre, $runWhy)) }
|            else {
|                try {
|                    $ctl = New-SIPipelineSqlControl -Invoke $Sql
|                    $q = $ctl.Enqueue((New-SIPipelineRequest -Scope pipeline -Trigger manual -RequestedBy 'update' -Note ('the switch to the pipeline: {0}' -f $runWhy) -RequestedUtc $now))
|                    if ([string]$q.Outcome -eq 'Missing') { $lines.Add(('{0} today''s pipeline run is not queued -- the Pro database has no pipeline queue yet; start it with Run now' -f $pre)) }
|                    else { $queued = $true; $lines.Add(('{0} one pipeline run queued (as Run now) -- {1}' -f $pre, $runWhy)) }
|                } catch { $lines.Add(('{0} today''s pipeline run could not be queued ({1}) -- start it with Run now' -f $pre, $_.Exception.Message)) }
|            }
|        }
|        & $out 'migrated' $queued
|    } catch {
|        $lines.Add(('switch to the pipeline: not checked ({0}) -- the update goes on; the next update tries again' -f $_.Exception.Message))
|        & $out 'failed'
|    }
|}
|
|function ConvertTo-SIArmJobTrigger {
|    <#
|        PURE. A Container Apps job as ARM returned it (GET, ConvertFrom-Json) turned into the PATCH body for -Action:
|          to-manual    -- triggerType Manual, the cron remembered in the si-disabled-cron tag (exactly what the web app's
|                          Disable does -- JobRules.Disabled in JobsClient.cs);
|          to-schedule  -- triggerType Schedule with -Cron (default: the remembered one), the tag removed (JobRules.Enabled).
|        The body carries ONLY what changes: { tags: <the job's tags plus/minus si-disabled-cron>, properties: { configuration:
|        { triggerType, replicaTimeout, manualTriggerConfig | scheduleTriggerConfig } } } -- never the secrets, the template
|        or anything else of the job. Why (#269, found live): ARM's GET returns secrets WITHOUT their values, so a PUT of the
|        whole resource is refused for any job that has a secret (ContainerAppSecretInvalid -- the Pro jobs carry
|        si-license). Send it with PATCH. The input is not changed.
|    #>
|    param([Parameter(Mandatory)]$Job, [Parameter(Mandatory)][ValidateSet('to-manual', 'to-schedule')][string]$Action, [string]$Cron)
|    $props = if ($Job.PSObject.Properties['properties']) { $Job.properties } else { $null }
|    $cfg = if ($props -and $props.PSObject.Properties['configuration']) { $props.configuration } else { $null }
|    if (-not $cfg) { throw 'the job has no configuration' }
|    $tags = [ordered]@{}
|    if ($Job.PSObject.Properties['tags'] -and $null -ne $Job.tags) {
|        if ($Job.tags -is [System.Collections.IDictionary]) { foreach ($k in $Job.tags.Keys) { $tags[[string]$k] = [string]$Job.tags[$k] } }
|        else { foreach ($p in $Job.tags.PSObject.Properties) { $tags[$p.Name] = [string]$p.Value } }
|    }
|    $par = 1; $rcc = 1
|    $src = if ($cfg.PSObject.Properties['scheduleTriggerConfig'] -and $cfg.scheduleTriggerConfig) { $cfg.scheduleTriggerConfig } elseif ($cfg.PSObject.Properties['manualTriggerConfig'] -and $cfg.manualTriggerConfig) { $cfg.manualTriggerConfig } else { $null }
|    if ($src) { if ($src.PSObject.Properties['parallelism'] -and $src.parallelism) { $par = $src.parallelism }; if ($src.PSObject.Properties['replicaCompletionCount'] -and $src.replicaCompletionCount) { $rcc = $src.replicaCompletionCount } }
|    $c = [ordered]@{}
|    if ($Action -eq 'to-manual') {
|        if ([string]$cfg.triggerType -ne 'Schedule') { throw 'only a scheduled job can be moved off its timer' }
|        $tags['si-disabled-cron'] = [string]$cfg.scheduleTriggerConfig.cronExpression
|        $c.triggerType = 'Manual'
|    } else {
|        if (-not $Cron -and $tags.Contains('si-disabled-cron')) { $Cron = [string]$tags['si-disabled-cron'] }
|        if ($Cron -notmatch '^[0-9*/,\-]{1,40}( [0-9*/,\-]{1,40}){4}$') { throw ("'{0}' is not a 5-field cron expression" -f $Cron) }
|        $tags.Remove('si-disabled-cron')
|        $c.triggerType = 'Schedule'
|    }
|    if ($cfg.PSObject.Properties['replicaTimeout'] -and $cfg.replicaTimeout) { $c.replicaTimeout = $cfg.replicaTimeout }
|    if ($Action -eq 'to-manual') { $c.manualTriggerConfig = [ordered]@{ parallelism = $par; replicaCompletionCount = $rcc } }
|    else { $c.scheduleTriggerConfig = [ordered]@{ cronExpression = $Cron; parallelism = $par; replicaCompletionCount = $rcc } }
|    ([ordered]@{ tags = $tags; properties = [ordered]@{ configuration = $c } } | ConvertTo-Json -Depth 10) | ConvertFrom-Json
|}
|
|function Get-SIAzErrorMessage {
|    <#
|        PURE. The readable reason from what a failed `az rest` printed (stderr + stdout lines): ARM's "<code>: <message>"
|        when its error JSON is there (az prints e.g. ERROR: Bad Request({"error":{"code":"ContainerAppSecretInvalid",
|        "message":"..."}}) or ERROR: (Code) message), else the text itself without az's "ERROR: " prefix. Max 800 chars.
|    #>
|    param([AllowEmptyCollection()][AllowNull()][object[]]$Lines = @())
|    $t = (@($Lines | Where-Object { $null -ne $_ } | ForEach-Object { ([string]$_).Trim() } | Where-Object { $_ }) -join ' ').Trim()
|    if (-not $t) { return '(az printed no error text)' }
|    $code = if ($t -match '"code"\s*:\s*"([^"]{1,120})"') { $Matches[1] } elseif ($t -match '\((\w{3,120})\)') { $Matches[1] } else { '' }
|    $msg = if ($t -match '"message"\s*:\s*"((?:[^"\\]|\\.){1,2000})"') { $Matches[1] -replace '\\"', '"' -replace '\\\\', '\' } else { ($t -replace '^(?i)ERROR:\s*', '' -replace '^\(\w{3,120}\)\s*', '') }
|    $r = if ($code -and $msg -notmatch [regex]::Escape($code)) { '{0}: {1}' -f $code, $msg } else { $msg }
|    if ($r.Length -gt 800) { $r = $r.Substring(0, 800) + '...' }
|    $r
|}
|
|function Get-SIFlowTaskReplacePlan {
|    <#
|        PURE (VM). Which existing scheduled tasks the flow task replaces: a task whose action runs the launcher of a step of
|        the flow (launcher\<folder>\launcher.*.ps1) -- never the updater's task (it runs on its own daily schedule) -- Risk Analysis
|        -Summary / -Detailed told apart by the argument. -Tasks: @(@{ TaskPath; TaskName; State; Execute; Arguments }).
|        Returns @(@{ Task (path + name); Job; State }) -- the setup step disables them (enabled ones only) and records them,
|        and -Remove enables exactly those again.
|    #>
|    param([AllowEmptyCollection()][object[]]$Tasks = @(), [Parameter(Mandatory)]$Definition, $Map)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $out = New-Object System.Collections.Generic.List[object]
|    $steps = @(@($Definition.Steps) | ForEach-Object { [string]$_.Job })
|    # #306: the risk trend's own task too -- Risk Analysis writes the daily trend row while the jobs run as a pipeline
|    $steps += @(@($Map.Jobs.Keys) | Where-Object { $Map.Jobs[$_].ManualInFlowMode -and $steps -notcontains $_ })
|    foreach ($t in @($Tasks | Where-Object { $_ })) {
|        $cmd = ('{0} {1}' -f $t.Execute, $t.Arguments)
|        if ($cmd -match '(?i)Invoke-SIJobFlowRun\.ps1') { continue }
|        $job = $null
|        if ($cmd -match '(?i)Update-SecurityInsight\.ps1') { $job = 'updater' }
|        elseif ($cmd -match '(?i)[\\/]launcher[\\/]([a-z0-9\-]+)[\\/]launcher\.[a-z\-]+\.ps1') {
|            $folder = $Matches[1].ToLowerInvariant()
|            $job = switch ($folder) {
|                'privilege-tier-classifier' { 'ptc' }
|                'risk-analysis' { if ($cmd -match '(?i)-Detailed\b') { 'risk-analysis-detailed' } else { 'risk-analysis' } }
|                default { $folder }
|            }
|        }
|        if (-not $job -or $steps -notcontains $job -or (Test-SIJobFlowOwnSchedule -Job $job -Map $Map)) { continue }
|        $out.Add([pscustomobject]@{ Task = ('{0}{1}' -f $t.TaskPath, $t.TaskName); TaskPath = [string]$t.TaskPath; TaskName = [string]$t.TaskName; Job = $job; State = [string]$t.State })
|    }
|    , $out.ToArray()
|}
|
|function Get-SIJobOrchestrationMode {
|    <#
|        PURE. flow | schedules. An explicit value (setting SI_JobOrchestration, a CLI parameter) wins; otherwise a NEW
|        install (no SI job yet) gets 'flow' -- the default and the recommendation -- and an EXISTING install keeps its
|        timers ('schedules') until someone switches. Returns @{ Mode; Why }.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Explicit, [bool]$ExistingInstall,
|          # the jobs that exist, with their triggers (ConvertTo-SIJobFlowTriggerList). ROOT CAUSE of "neither mode" (ring 2,
|          # 2026-10-10: nothing ran for 14 h): a first install that stopped after creating the jobs of the pipeline (Manual,
|          # in flow mode) but before caj-si-flow (created last) was re-run as an EXISTING install -> 'schedules' -> caj-si-flow
|          # created Manual, its jobs left Manual. What the existing jobs ARE decides: none of the pipeline's jobs on a timer
|          # (or caj-si-flow on its timer) = the install runs as the pipeline.
|          [AllowEmptyCollection()][object[]]$ExistingJobs, $Map)
|    $e = ([string]$Explicit).Trim().ToLowerInvariant()
|    if ($e -in @('flow', 'schedules')) { return [pscustomobject]@{ Mode = $e; Why = 'set explicitly' } }
|    if ($e) { return [pscustomobject]@{ Mode = $(if ($ExistingInstall) { 'schedules' } else { 'flow' }); Why = ("'{0}' is not flow or schedules -- ignored" -f $Explicit) } }
|    if ($ExistingInstall -and @($ExistingJobs | Where-Object { $_ }).Count) {
|        $chk = Test-SIJobOrchestrationNeitherMode -Jobs @($ExistingJobs | Where-Object { $_ }) -Map $Map
|        $flowOn = @($ExistingJobs | Where-Object { $_ -and (Get-SIJobFlowKey ([string]$_.Name)) -eq 'flow' -and [string]$_.TriggerType -eq 'Schedule' }).Count
|        if ($flowOn) { return [pscustomobject]@{ Mode = 'flow'; Why = 'the install runs as the pipeline (caj-si-flow is on its timer)' } }
|        if ($chk.Steps -gt 0 -and $chk.Timed -eq 0) { return [pscustomobject]@{ Mode = 'flow'; Why = 'the jobs that exist run in the pipeline (none of them has its own timer) -- an earlier install that stopped half-way is completed as the pipeline' } }
|    }
|    if ($ExistingInstall) { return [pscustomobject]@{ Mode = 'schedules'; Why = 'an existing install keeps its timers until it is switched (Operations > Jobs recommends the flow)' } }
|    [pscustomobject]@{ Mode = 'flow'; Why = 'a new install runs as one flow (the default)' }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-Pipeline.ps1'] = @{ Sha256 = 'c37baefaf12390b6cdf106c3edabf03e213013920f05fa4769bd23789323faed'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- PIPELINES and STAGES (#306), on top of the job flow runner (engine\_shared\SI-JobFlow.ps1, which
|    dot-sources this file).
|
|    Operator 2026-10-05: "profiling + risk analyse is what takes data in. Then we have a part 2 with data correlation and
|    then we have a data out to sql, servicenow, etc." / "i want it to run as a single flow ... we can run subflows
|    individually (run now) and we can appoint schedules to flows". Naming (operator): a flow is a PIPELINE, a subflow a
|    STAGE; the default stages are Collect -> Correlate -> Deliver; the default pipeline is "Daily pipeline".
|
|    This file holds:
|      * the stage catalog and the schema-1 -> schema-2 migration (lossless: every step, enabled / timeout / on failure
|        kept; known jobs go to their stage by the map, an unknown step stays in the stage of the step above it);
|      * the stage GATE: a stage starts only when the stage before it has ENDED; when that stage did not succeed the stage
|        is skipped (unless it is set to run anyway, runIfPreviousFailed), and Deliver NEVER starts after a Collect that
|        did not succeed (working rule 4: nothing is published from a partial collection);
|      * THE RUN GOES ON WITHOUT ONE SOURCE (owner 2026-10-12: "a source dropout should not block ci calculation, then use
|        latest avail collection from the source"): a COLLECTION step (identity / azure / endpoint / publicip) that did not
|        succeed while another collection of the same run did is a DROPOUT, not a failed Collect -- Correlate and Deliver
|        run, with that source's records as its last good collection left them (Get-SIPipelineCollectVerdict). The step
|        itself stays Failed. Every collection failing, or the tier classifier (a prerequisite, not a source), holds the
|        run back as before;
|      * ONE RUN LOCK per install and a persisted FIFO QUEUE (Pro: cfg.PipelineLock / cfg.PipelineQueue; a VM: two files
|        in data\flow; a Community container: two blobs) -- every run, scheduled or "Run now" on a pipeline, a stage or a
|        step, takes the same lock; a request that finds it busy waits in the queue (never dropped, never overlapping,
|        the same request queued twice is kept once);
|      * the drain (Invoke-SIPipelineDrain): what one wake-up of the runner does. PS 5.1 and 7.
|#>
|
|# NO FRESH BEAT = DEAD: the rule that decides whether another execution still runs (the updater check below)
|$siExecLive = Join-Path $PSScriptRoot 'SI-ExecutionLiveness.ps1'
|if ((Test-Path -LiteralPath $siExecLive) -and -not (Get-Command -Name Get-SIExecutionLiveness -ErrorAction SilentlyContinue)) { . $siExecLive }
|
|$script:SIPipeline = @{
|    StageIds        = @('collect', 'correlate', 'deliver')
|    StageNames      = @{ collect = 'Collect'; correlate = 'Correlate'; deliver = 'Deliver' }
|    # what each stage is FOR, in the owner's words (2026-10-13): shown wherever a stage is a HEADING or part of the
|    # overview ("Stage 2 of 3: Correlate (data structure)"). A sentence about one step keeps the short name above.
|    # The same three as config\job-flow.locked.json ('title') and the web app's JobFlow.StageTitle.
|    StageTitles     = @{ collect = 'Collect (data-in)'; correlate = 'Correlate (data structure)'; deliver = 'Deliver (data-out)' }
|    # inside Deliver the targets are independent: a failed vulnerability connector does not skip the data sync or the mail
|    StageOnFailure  = @{ collect = 'skip-dependents'; correlate = 'skip-dependents'; deliver = 'continue' }
|    Scopes          = @('pipeline', 'stage', 'step', 'from-step')
|    DefaultId       = 'daily'
|    DefaultName     = 'Daily pipeline'
|    LockStaleMinutes = 15
|    # a RUN that has ended (#700: Cancelled = ended on purpose by a person or by the updater -- never resumed)
|    RunFinished     = @('Succeeded', 'Failed', 'Stopped', 'Cancelled')
|    # THE SOURCES: the Collect steps that each read one family of sources and write its records. A failed one is a DROPOUT
|    # (the run goes on with its last good collection). The tier classifier (ptc) is NOT a source: it writes no records --
|    # it builds the tier catalog every collection reads, so it stays a prerequisite (its failure skips the collections).
|    SourceJobs      = @('identity', 'azure', 'endpoint', 'publicip')
|}
|
|# =====================================================================================================================
|#  The pipeline's time zone (operator 2026-10-05: the Daily pipeline starts at a time of day in its time zone, all
|#  year -- daylight saving included -- and the time and the zone can be changed; owner 2026-10-15: by default 23:30 Danish
|#  time on every install, after the 23:00 update -- setup\_shared\SI-NightlySchedule.ps1)
|# =====================================================================================================================
|# IANA -> Windows for the common zones: Windows PowerShell 5.1 (.NET Framework) knows only the Windows ids. PowerShell 7
|# (.NET 6+) knows both on Windows (ICU) and on Linux, so the map is the 5.1 fallback only.
|$script:SIPipelineIanaToWindows = @{
|    'Europe/Copenhagen' = 'Romance Standard Time'; 'Europe/Paris' = 'Romance Standard Time'; 'Europe/Brussels' = 'Romance Standard Time'; 'Europe/Madrid' = 'Romance Standard Time'
|    'Europe/Berlin' = 'W. Europe Standard Time'; 'Europe/Amsterdam' = 'W. Europe Standard Time'; 'Europe/Oslo' = 'W. Europe Standard Time'; 'Europe/Stockholm' = 'W. Europe Standard Time'
|    'Europe/Rome' = 'W. Europe Standard Time'; 'Europe/Vienna' = 'W. Europe Standard Time'; 'Europe/Zurich' = 'W. Europe Standard Time'
|    'Europe/Warsaw' = 'Central European Standard Time'; 'Europe/Prague' = 'Central Europe Standard Time'; 'Europe/Budapest' = 'Central Europe Standard Time'
|    'Europe/Helsinki' = 'FLE Standard Time'; 'Europe/Tallinn' = 'FLE Standard Time'; 'Europe/Riga' = 'FLE Standard Time'; 'Europe/Vilnius' = 'FLE Standard Time'
|    'Europe/London' = 'GMT Standard Time'; 'Europe/Dublin' = 'GMT Standard Time'; 'Europe/Lisbon' = 'GMT Standard Time'; 'Atlantic/Reykjavik' = 'Greenwich Standard Time'
|    'America/New_York' = 'Eastern Standard Time'; 'America/Chicago' = 'Central Standard Time'; 'America/Denver' = 'Mountain Standard Time'; 'America/Los_Angeles' = 'Pacific Standard Time'
|    'America/Sao_Paulo' = 'E. South America Standard Time'; 'Asia/Tokyo' = 'Tokyo Standard Time'; 'Asia/Singapore' = 'Singapore Standard Time'; 'Asia/Kolkata' = 'India Standard Time'
|    'Asia/Dubai' = 'Arabian Standard Time'; 'Australia/Sydney' = 'AUS Eastern Standard Time'; 'Pacific/Auckland' = 'New Zealand Standard Time'
|    'UTC' = 'UTC'; 'Etc/UTC' = 'UTC'; 'Etc/GMT' = 'UTC'
|}
|
|function Resolve-SIPipelineTimeZone {
|    <#
|        PURE (over the machine's time zone database). A time zone by IANA id (Europe/Copenhagen) or Windows id (Romance
|        Standard Time), on PS 5.1 and 7, Windows and Linux. Unknown or empty = UTC, said in .Why (the caller warns once).
|        Returns @{ Zone = [TimeZoneInfo]; Id = what was asked; Fallback = $true when UTC stands in for an unknown id; Why }.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Id)
|    $want = ([string]$Id).Trim()
|    if (-not $want -or $want -in @('UTC', 'Etc/UTC', 'Z')) { return [pscustomobject]@{ Zone = [TimeZoneInfo]::Utc; Id = 'UTC'; Fallback = $false; Why = '' } }
|    $try = New-Object System.Collections.Generic.List[string]
|    $try.Add($want)
|    if ($script:SIPipelineIanaToWindows.ContainsKey($want)) { $try.Add($script:SIPipelineIanaToWindows[$want]) }
|    foreach ($k in $script:SIPipelineIanaToWindows.Keys) { if ($script:SIPipelineIanaToWindows[$k] -eq $want -and -not $try.Contains($k)) { $try.Add($k) } }
|    foreach ($t in $try) {
|        try { $z = [TimeZoneInfo]::FindSystemTimeZoneById($t); return [pscustomobject]@{ Zone = $z; Id = $want; Fallback = $false; Why = '' } } catch { }
|    }
|    [pscustomobject]@{ Zone = [TimeZoneInfo]::Utc; Id = $want; Fallback = $true; Why = ("the time zone '{0}' is not known on this machine -- the pipeline's time is read as UTC" -f $want) }
|}
|
|function Get-SIPipelineTimeZoneId {
|    <# PURE. The definition's time zone id ('UTC' when it has none -- a stored schedule from before time zones). #>
|    param($Definition)
|    if ($Definition -and $Definition.PSObject.Properties['TimeZone'] -and ([string]$Definition.TimeZone).Trim()) { return ([string]$Definition.TimeZone).Trim() }
|    'UTC'
|}
|
|function ConvertTo-SIPipelineUtc {
|    <#
|        PURE. A local wall-clock time in -Zone as UTC. A time that does not exist that day (the spring-forward gap) runs
|        when the clock reaches it: one hour later; a time that exists twice (the autumn fall-back) is its first occurrence.
|    #>
|    param([Parameter(Mandatory)][datetime]$Local, [Parameter(Mandatory)][TimeZoneInfo]$Zone)
|    $l = [datetime]::SpecifyKind($Local, 'Unspecified')
|    if ($Zone.IsInvalidTime($l)) { $l = $l.AddHours(1) }
|    if ($Zone.IsAmbiguousTime($l)) {
|        $offs = @($Zone.GetAmbiguousTimeOffsets($l) | Sort-Object -Descending)
|        return [datetime]::SpecifyKind($l - $offs[0], 'Utc')
|    }
|    [TimeZoneInfo]::ConvertTimeToUtc($l, $Zone)
|}
|
|function Get-SIPipelineScheduleText {
|    <# PURE. "22:00 Europe/Copenhagen (20:00 UTC today)" -- the start time with its zone and today's UTC time. #>
|    param([Parameter(Mandatory)]$Definition, [datetime]$NowUtc = [datetime]::UtcNow)
|    $tzId = Get-SIPipelineTimeZoneId $Definition
|    if ($tzId -eq 'UTC') { return ('{0} UTC' -f $Definition.StartTime) }
|    $z = (Resolve-SIPipelineTimeZone $tzId).Zone
|    $h, $m = ([string]$Definition.StartTime) -split ':'
|    $local = [TimeZoneInfo]::ConvertTimeFromUtc([datetime]::SpecifyKind($NowUtc.ToUniversalTime(), 'Utc'), $z).Date.AddHours([int]$h).AddMinutes([int]$m)
|    $u = ConvertTo-SIPipelineUtc -Local $local -Zone $z
|    '{0} {1} ({2:HH:mm} UTC today)' -f $Definition.StartTime, $tzId, $u
|}
|
|# =====================================================================================================================
|#  Stages
|# =====================================================================================================================
|function Test-SIPipelineStageId {
|    <# PURE. collect | correlate | deliver, or a custom stage: custom / custom-<a-z0-9>. #>
|    param([AllowEmptyString()][AllowNull()][string]$Id)
|    ([string]$Id) -match '^(collect|correlate|deliver|custom(-[a-z0-9]{1,24})?)$'
|}
|
|function Get-SIPipelineStageName {
|    <# PURE. The stage's display name: Collect / Correlate / Deliver, else the id. #>
|    param([AllowEmptyString()][AllowNull()][string]$Id)
|    if ($script:SIPipeline.StageNames.ContainsKey([string]$Id)) { return $script:SIPipeline.StageNames[[string]$Id] }
|    [string]$Id
|}
|
|function Get-SIPipelineStageTitle {
|    <#
|        PURE. The stage as a HEADING / in the overview: "Collect (data-in)", "Correlate (data structure)",
|        "Deliver (data-out)". Decided from the stage ID, so an install whose STORED pipeline carries the name from before
|        ("Collect") shows the new words without anything being rewritten. -Name is the stage's stored name: a name a
|        person gave the stage themselves is kept as it is; a custom stage shows its own name (else its id).
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Id, [AllowEmptyString()][AllowNull()][string]$Name)
|    $k = ([string]$Id).Trim().ToLowerInvariant()
|    $n = ([string]$Name).Trim()
|    if (-not $script:SIPipeline.StageTitles.ContainsKey($k)) { if ($n) { return $n }; return [string]$Id }
|    if (-not $n -or $n -ieq $script:SIPipeline.StageNames[$k] -or $n -ieq $script:SIPipeline.StageTitles[$k] -or $n -ieq $k) { return $script:SIPipeline.StageTitles[$k] }
|    $n
|}
|
|function Get-SIPipelineStageOnFailure {
|    <# PURE. What a step's failure does by default in this stage: Deliver -> continue (independent targets), else skip-dependents. #>
|    param([AllowEmptyString()][AllowNull()][string]$Id)
|    if ($script:SIPipeline.StageOnFailure.ContainsKey([string]$Id)) { return $script:SIPipeline.StageOnFailure[[string]$Id] }
|    'skip-dependents'
|}
|
|function New-SIPipelineStage {
|    param([Parameter(Mandatory)][string]$Id, [string]$Name, [bool]$RunIfPreviousFailed = $false)
|    if (-not $Name) { $Name = Get-SIPipelineStageName $Id }
|    [pscustomobject]@{ Id = $Id; Name = $Name; RunIfPreviousFailed = $RunIfPreviousFailed }
|}
|
|function Get-SIPipelineStageOf {
|    <# PURE. The stage a job belongs to by the map ('stage'); '' when the map does not know the job. #>
|    param([Parameter(Mandatory)][string]$Job, [Parameter(Mandatory)]$Map)
|    if ($Map.Jobs.Contains($Job) -and $Map.Jobs[$Job].PSObject.Properties['Stage']) { return [string]$Map.Jobs[$Job].Stage }
|    ''
|}
|
|function ConvertFrom-SIPipelineSchema1 {
|    <#
|        PURE. A schema-1 flow (Steps without a stage) as a schema-2 pipeline -- LOSSLESS: every step stays, with its
|        enabled / start together / on failure / timeout, in its order within its stage.
|          * a job the map knows goes to the map's stage ('stage' in config\job-flow.locked.json);
|          * an unknown (custom) step stays in the stage of the step above it (the first stage when it is first);
|          * the stages run in the order collect -> correlate -> deliver (a custom stage is never invented here);
|          * a step that started "together with the step above" keeps it when that step is still the one above it in
|            the same stage, else it starts on its own (said in the notes);
|          * on failure: a Deliver step that had the old default (skip-dependents) gets the Deliver default (continue --
|            the operator's rule that the targets are independent); an explicit stop / continue is kept;
|          * the risk trend (asset-trend) is kept as a step but switched off: Risk Analysis writes the daily trend row
|            itself now (said in the notes).
|        Returns the schema-2 definition with .Migrated = $true and .MigrationNotes.
|    #>
|    param([Parameter(Mandatory)]$Definition, $Map)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $notes = New-Object System.Collections.Generic.List[string]
|    $byStage = [ordered]@{}
|    foreach ($id in $script:SIPipeline.StageIds) { $byStage[$id] = New-Object System.Collections.Generic.List[object] }
|    $prevStage = $script:SIPipeline.StageIds[0]
|    $prevJob = ''
|    foreach ($s in @($Definition.Steps)) {
|        if ($null -eq $s) { continue }
|        $job = [string]$s.Job
|        $st = Get-SIPipelineStageOf -Job $job -Map $Map
|        if (-not $st -or -not $byStage.Contains($st)) {
|            $st = $prevStage
|            $notes.Add(("{0} is not a job SecurityInsight ships: it stays in the stage of the step above it ({1})" -f $job, (Get-SIPipelineStageName $st)))
|        }
|        $with = [bool]$s.WithPrevious
|        if ($with -and ($byStage[$st].Count -eq 0 -or [string]$byStage[$st][$byStage[$st].Count - 1].Job -ne $prevJob)) {
|            $with = $false
|            $notes.Add(("{0} started together with {1}; they are in different stages now, so it starts on its own" -f $job, $(if ($prevJob) { $prevJob } else { 'the step above' })))
|        }
|        $of = ([string]$s.OnFailure).ToLowerInvariant()
|        if ($st -eq 'deliver' -and $of -eq 'skip-dependents') {
|            $of = 'continue'
|            $notes.Add(("{0} (Deliver): on failure is now 'continue' -- the Deliver targets are independent of each other" -f $job))
|        }
|        $en = [bool]$s.Enabled
|        if ($job -eq 'asset-trend' -and $en) {
|            $en = $false
|            $notes.Add('asset-trend is kept but switched off: Risk Analysis writes the daily trend row itself now (switch it on only with SI_Trend_AtEndOfRiskAnalysis = $false)')
|        }
|        $byStage[$st].Add((New-SIJobFlowStep -Job $job -Enabled $en -WithPrevious $with -OnFailure $of -TimeoutMinutes ([int]$s.TimeoutMinutes) -Stage $st))
|        $prevStage = $st; $prevJob = $job
|    }
|    $stages = @(foreach ($id in $script:SIPipeline.StageIds) { New-SIPipelineStage -Id $id })
|    $steps = New-Object System.Collections.Generic.List[object]
|    foreach ($id in $script:SIPipeline.StageIds) { foreach ($x in $byStage[$id]) { $steps.Add($x) } }
|    $d = New-SIPipelineDefinition -Id $script:SIPipeline.DefaultId -Name $script:SIPipeline.DefaultName -Mode ([string]$Definition.Mode) -StartTime ([string]$Definition.StartTime) `
|        -Cadence ([string]$Definition.Cadence) -Weekday ([int]$Definition.Weekday) -IntervalMinutes ([int]$Definition.IntervalMinutes) -Stages $stages -Steps $steps.ToArray() `
|        -TimeZone (Get-SIPipelineTimeZoneId $Definition)
|    # a stored schedule keeps its time: before time zones every start time was UTC, so it stays UTC (shown converted)
|    $d | Add-Member -NotePropertyName Migrated -NotePropertyValue $true -Force
|    $d | Add-Member -NotePropertyName MigrationNotes -NotePropertyValue $notes.ToArray() -Force
|    $d
|}
|
|function New-SIPipelineDefinition {
|    <# The schema-2 definition object: Steps is the FLAT ordered list (each step carries its Stage), Stages the order. #>
|    param([string]$Id = 'daily', [string]$Name = 'Daily pipeline', [string]$Mode = 'flow', [string]$StartTime = '01:00', [string]$Cadence = 'daily', [int]$Weekday = 1,
|          [int]$IntervalMinutes = 1440, [AllowEmptyCollection()][object[]]$Stages = @(), [AllowEmptyCollection()][object[]]$Steps = @(),
|          # the start time's zone (IANA or Windows id); 'UTC' = a schedule stored before time zones (it keeps its time)
|          [string]$TimeZone = 'UTC',
|          # the shipped default layout the pipeline has been brought to (Update-SIJobFlowDefaultLayout; the JSON's 'defaults'):
|          # 1 = stored before the layout had levels -- every step one after the other
|          [int]$DefaultsLevel = 1)
|    if (-not $IntervalMinutes) { $IntervalMinutes = 1440 }
|    if (-not $TimeZone) { $TimeZone = 'UTC' }
|    if ($DefaultsLevel -lt 1) { $DefaultsLevel = 1 }
|    [pscustomobject]@{ Schema = 2; Id = $Id; Name = $Name; Mode = $Mode; StartTime = $StartTime; TimeZone = $TimeZone; Cadence = $Cadence; Weekday = $Weekday; IntervalMinutes = $IntervalMinutes
|                       Stages = @($Stages); Steps = @($Steps); Migrated = $false; MigrationNotes = @(); DefaultsLevel = $DefaultsLevel }
|}
|
|function Get-SIPipelineStages {
|    <# PURE. The definition's stages in order (callers wrap in @()); a definition without .Stages (an old in-memory
|       object) gets them from its steps. #>
|    param([Parameter(Mandatory)]$Definition)
|    if ($Definition.PSObject.Properties['Stages'] -and @($Definition.Stages).Count) { return @($Definition.Stages) }
|    $ids = New-Object System.Collections.Generic.List[string]
|    foreach ($s in @($Definition.Steps)) { $sid = if ($s.PSObject.Properties['Stage'] -and $s.Stage) { [string]$s.Stage } else { 'collect' }; if (-not $ids.Contains($sid)) { $ids.Add($sid) } }
|    foreach ($i in $ids) { New-SIPipelineStage -Id $i }
|}
|
|function Get-SIPipelineStepStage {
|    <# PURE. A step's stage ('collect' when it has none -- a schema-1 object in memory). #>
|    param($Step)
|    if ($Step -and $Step.PSObject.Properties['Stage'] -and $Step.Stage) { return [string]$Step.Stage }
|    'collect'
|}
|
|function Test-SIPipelineStages {
|    <# PURE. The schema-2 checks: @{ Problems; Warnings } (Test-SIJobFlowDefinition adds them to its own). #>
|    param([Parameter(Mandatory)]$Definition)
|    $p = New-Object System.Collections.Generic.List[string]
|    $w = New-Object System.Collections.Generic.List[string]
|    $stages = @(Get-SIPipelineStages -Definition $Definition)
|    $tz = Resolve-SIPipelineTimeZone (Get-SIPipelineTimeZoneId $Definition)
|    if ($tz.Fallback) { $w.Add($tz.Why) }
|    $seen = @{}
|    $i = 0
|    foreach ($st in $stages) {
|        $i++
|        $id = [string]$st.Id
|        if (-not (Test-SIPipelineStageId $id)) { $p.Add(("stage {0}: '{1}' is not a stage (collect, correlate, deliver or custom-<name>)" -f $i, $id)); continue }
|        if ($seen.ContainsKey($id)) { $p.Add(("stage {0}: {1} is already stage {2}" -f $i, $id, $seen[$id])); continue }
|        $seen[$id] = $i
|    }
|    if ($seen.ContainsKey('collect') -and $seen.ContainsKey('deliver') -and $seen['deliver'] -lt $seen['collect']) { $p.Add('Deliver runs before Collect -- it would publish before the data is collected') }
|    if ($seen.ContainsKey('correlate') -and $seen.ContainsKey('deliver') -and $seen['deliver'] -lt $seen['correlate']) { $w.Add('Deliver runs before Correlate -- it publishes the correlation of the run before') }
|    $order = @{}; $k = 0; foreach ($st in $stages) { $k++; if (-not $order.ContainsKey([string]$st.Id)) { $order[[string]$st.Id] = $k } }
|    $last = 0; $prevStage = ''
|    $n = 0
|    foreach ($s in @($Definition.Steps)) {
|        $n++
|        $sid = Get-SIPipelineStepStage $s
|        if (-not $order.ContainsKey($sid)) { $p.Add(("step {0} ({1}): its stage '{2}' is not a stage of the pipeline" -f $n, $s.Job, $sid)); continue }
|        if ($order[$sid] -lt $last) { $p.Add(("step {0} ({1}): the steps must be in stage order -- {2} comes before {3}" -f $n, $s.Job, (Get-SIPipelineStageName $sid), (Get-SIPipelineStageName $prevStage))) }
|        if ($sid -ne $prevStage -and [bool]$s.WithPrevious -and $n -gt 1) { $w.Add(("step {0} ({1}) is the first of {2}: it cannot start together with a step of another stage -- it starts on its own" -f $n, $s.Job, (Get-SIPipelineStageName $sid))) }
|        $last = $order[$sid]; $prevStage = $sid
|    }
|    [pscustomobject]@{ Problems = $p.ToArray(); Warnings = $w.ToArray() }
|}
|
|# =====================================================================================================================
|#  The stage gate and the words
|# =====================================================================================================================
|function Get-SIPipelineStageOutcome {
|    <#
|        PURE. A stage's outcome in a run record: NotRun (none of its steps is part of this run -- a stage / step run, or
|        the steps above a re-run), Waiting, Running, Succeeded (every step Success or Disabled), Failed (anything else
|        ended: failed, timed out, interrupted, or skipped).
|    #>
|    param([Parameter(Mandatory)]$State, [Parameter(Mandatory)][string]$Stage)
|    $mine = @(@($State.Steps) | Where-Object { (Get-SIPipelineStepStage $_) -eq $Stage -and [string]$_.ErrorClass -ne 'before-rerun' })
|    if (-not $mine.Count) { return 'NotRun' }
|    if (@($mine | Where-Object { $_.State -in @('Running', 'Starting') }).Count) { return 'Running' }
|    if (@($mine | Where-Object { $_.State -eq 'Waiting' }).Count) {
|        if (@($mine | Where-Object { $_.State -ne 'Waiting' -and $_.State -ne 'Disabled' }).Count) { return 'Running' }
|        return 'Waiting'
|    }
|    if (@($mine | Where-Object { $_.State -notin @('Success', 'Disabled') }).Count) { return 'Failed' }
|    'Succeeded'
|}
|
|function Test-SIPipelineSourceJob {
|    <# PURE. Is -Job a SOURCE -- a Collect step that reads one family of sources and writes its records (identity, azure,
|       endpoint, publicip; a collection in parts is the same step)? The tier classifier and a custom step are not. #>
|    param([AllowEmptyString()][AllowNull()][string]$Job)
|    $k = ([string]$Job).Trim().ToLowerInvariant()
|    if ($k.StartsWith('caj-si-')) { $k = $k.Substring(7) }
|    $script:SIPipeline.SourceJobs -contains $k
|}
|
|function Get-SIPipelineCollectVerdict {
|    <#
|        PURE. What the Collect stage of this run was, from the steps that have ended:
|          GoesOn    $true when the run goes on WITHOUT one or more sources: at least one collection step failed (Failed /
|                    TimedOut / Interrupted), at least one collection step SUCCEEDED (there is something new to calculate),
|                    nothing else in Collect went wrong (the tier classifier, a custom step, a collection that was skipped),
|                    and no failed collection is set to stop the pipeline (the customer's saved "on failure: stop" is kept);
|          Dropouts  the failed collection steps (the run's step records) when it goes on, else none;
|          AnySource whether a collection step of this run succeeded (the runner asks this while Collect still runs).
|        -Definition is optional: without it a saved "stop" cannot be seen (the runner has then stopped the pipeline anyway).
|    #>
|    param([Parameter(Mandatory)]$State, $Definition)
|    $mine = @(@($State.Steps) | Where-Object { (Get-SIPipelineStepStage $_) -eq 'collect' -and [string]$_.ErrorClass -ne 'before-rerun' })
|    $sources = @($mine | Where-Object { Test-SIPipelineSourceJob ([string]$_.Job) })
|    $failed = @($sources | Where-Object { [string]$_.State -in @('Failed', 'TimedOut', 'Interrupted') })
|    $ok = @($sources | Where-Object { [string]$_.State -eq 'Success' })
|    $failedJobs = @($failed | ForEach-Object { [string]$_.Job })
|    $other = @($mine | Where-Object { [string]$_.State -notin @('Success', 'Disabled') -and $failedJobs -notcontains [string]$_.Job })
|    $stop = $false
|    if ($Definition) {
|        foreach ($f in $failed) {
|            $def = @(@($Definition.Steps) | Where-Object { [string]$_.Job -eq [string]$f.Job })[0]
|            if ($def -and [string]$def.OnFailure -eq 'stop') { $stop = $true }
|        }
|    }
|    $go = ($failed.Count -gt 0 -and $ok.Count -gt 0 -and $other.Count -eq 0 -and -not $stop)
|    [pscustomobject]@{ GoesOn = $go; Dropouts = @(if ($go) { $failed }); AnySource = ($ok.Count -gt 0); Failed = $failed }
|}
|
|function Get-SIPipelineStageGate {
|    <#
|        PURE. May -Stage start in this run? @{ Run; Reason }. It starts when the stage before it (the nearest earlier stage
|        that is part of this run) ended Succeeded. When that stage did not succeed, -Stage runs only when it is set to run
|        anyway (RunIfPreviousFailed) -- and Deliver NEVER runs after a Collect of this run that did not succeed, whatever
|        it is set to (working rule 4: nothing is published from a partial collection).
|        A Collect that only LOST A SOURCE (Get-SIPipelineCollectVerdict: GoesOn) counts as succeeded here: the stages after
|        it start, and the reason says which source the run goes on without.
|    #>
|    param([Parameter(Mandatory)]$State, [Parameter(Mandatory)]$Definition, [Parameter(Mandatory)][string]$Stage)
|    $stages = @(Get-SIPipelineStages -Definition $Definition)
|    $me = @($stages | Where-Object { [string]$_.Id -eq $Stage })[0]
|    $idx = [array]::IndexOf(@($stages | ForEach-Object { [string]$_.Id }), $Stage)
|    $verdict = Get-SIPipelineCollectVerdict -State $State -Definition $Definition
|    if ($Stage -eq 'deliver') {
|        $c = Get-SIPipelineStageOutcome -State $State -Stage 'collect'
|        if ($c -notin @('NotRun', 'Succeeded') -and -not $verdict.GoesOn) {
|            return [pscustomobject]@{ Run = $false; Reason = 'Collect did not succeed in this run -- nothing is delivered from a partial collection' }
|        }
|    }
|    for ($i = $idx - 1; $i -ge 0; $i--) {
|        $prev = [string]$stages[$i].Id
|        $o = Get-SIPipelineStageOutcome -State $State -Stage $prev
|        if ($o -eq 'NotRun') { continue }
|        if ($o -eq 'Succeeded') { return [pscustomobject]@{ Run = $true; Reason = '' } }
|        if ($prev -eq 'collect' -and $verdict.GoesOn) {
|            return [pscustomobject]@{ Run = $true; Reason = ('Collect: {0} did not succeed -- {1} starts all the same, with the last good collection of that source' -f ((@($verdict.Dropouts | ForEach-Object { [string]$_.Job })) -join ', '), (Get-SIPipelineStageName $Stage)) }
|        }
|        if ($me -and [bool]$me.RunIfPreviousFailed) { return [pscustomobject]@{ Run = $true; Reason = ('{0} did not succeed; {1} is set to run anyway' -f (Get-SIPipelineStageName $prev), (Get-SIPipelineStageName $Stage)) } }
|        return [pscustomobject]@{ Run = $false; Reason = ('{0} did not succeed -- {1} does not start' -f (Get-SIPipelineStageName $prev), (Get-SIPipelineStageName $Stage)) }
|    }
|    [pscustomobject]@{ Run = $true; Reason = '' }
|}
|
|function Get-SIPipelineMeasuredCadence {
|    <#
|        PURE. THE MEASURED CADENCE (owner 2026-10-12: "start when the last one ends"). The pipeline never runs twice at once:
|        a scheduled start that finds a run still going is not lost and not doubled -- ONE start is owed, however many
|        scheduled times passed, and it is made on the first wake-up after the run ended (Get-SIJobFlowDue: 'catch-up').
|        So on an install whose full run takes longer than the schedule's interval, the data is refreshed as often as a
|        run takes -- and that is said in plain words, with the measured numbers:
|          -Previous: the last run record (a finished run of the WHOLE pipeline); -NowUtc: when the next run starts;
|          -SlotUtc: the scheduled time that next run is for.
|        Returns $null when the previous run fitted inside the schedule's interval (nothing to say), was not a run of the
|        whole pipeline, or the schedule is 'interval' (it counts from the finish anyway). Else
|        @{ RunHours; StartToStartHours; IntervalHours; Text } -- Text is what the run's note, its record and the web app show.
|    #>
|    param([Parameter(Mandatory)]$Definition, $Previous, [Parameter(Mandatory)][datetime]$NowUtc, $SlotUtc)
|    if (-not $Previous -or -not $Previous.StartedUtc -or -not $Previous.EndedUtc) { return $null }
|    if ([string]$Definition.Cadence -eq 'interval') { return $null }
|    $scope = if ($Previous.PSObject.Properties['Scope'] -and $Previous.Scope) { [string]$Previous.Scope } else { 'pipeline' }
|    if ($scope -ne 'pipeline') { return $null }
|    $start = ([datetime]$Previous.StartedUtc).ToUniversalTime(); $end = ([datetime]$Previous.EndedUtc).ToUniversalTime(); $now = $NowUtc.ToUniversalTime()
|    $slot = if ($SlotUtc) { ([datetime]$SlotUtc).ToUniversalTime() } else { Get-SIJobFlowLatestSlot -Definition $Definition -NowUtc $now }
|    $interval = 24.0
|    if ($slot) { $before = Get-SIJobFlowLatestSlot -Definition $Definition -NowUtc $slot.AddMinutes(-1); if ($before) { $interval = ($slot - $before).TotalHours } }
|    $run = ($end - $start).TotalHours
|    if ($run -le $interval) { return $null }
|    $s2s = ($now - $start).TotalHours
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    [pscustomobject]@{ RunHours = [Math]::Round($run, 1); StartToStartHours = [Math]::Round($s2s, 1); IntervalHours = [Math]::Round($interval, 1)
|        Text = ('At this size a full run takes about {0} hours, so data is refreshed about every {1} hours.' -f [Math]::Round($run).ToString($inv), [Math]::Round($s2s).ToString($inv)) }
|}
|
|function Get-SIPipelineHeldBackText {
|    <#
|        PURE. The plain sentence for a run that was HELD BACK: a collection step or the correlation did not succeed, so the
|        steps after it did not run -- nothing goes out on incomplete data (working rule 4: absence is not remediation).
|        '' when no step was held back. Says which step stopped it, how many steps did not run, whether anything was
|        delivered, and that the data of the last good run stays in place (nothing is deleted or shown as fixed).
|    #>
|    param([Parameter(Mandatory)]$State)
|    $held = @(@($State.Steps) | Where-Object { [string]$_.State -eq 'Skipped' -and [string]$_.ErrorClass -in @('stage-blocked', 'needs-failed', 'flow-stopped') })
|    if (-not $held.Count) { return '' }
|    # a run in which the steps that run on what is stored ran all the same has its own sentence (Get-SIPipelinePartialText):
|    # it names the held steps too, and never says "the data of the last good run" on an install that has none
|    if (Test-SIPipelinePartialRun -State $State) { return '' }
|    # a source the run went on without did not hold it back: the step named is the one that did (the first other failure)
|    $went = @((Get-SIPipelineCollectVerdict -State $State).Dropouts | ForEach-Object { [string]$_.Job })
|    $bad = @(@($State.Steps) | Where-Object { [string]$_.State -in @('Failed', 'TimedOut', 'Interrupted') -and $went -notcontains [string]$_.Job }) | Select-Object -First 1
|    if (-not $bad) { $bad = @(@($State.Steps) | Where-Object { [string]$_.State -in @('Failed', 'TimedOut', 'Interrupted') }) | Select-Object -First 1 }
|    $what = if ($bad) { '{0} ({1}) did not succeed' -f $bad.Job, (Get-SIPipelineStageName (Get-SIPipelineStepStage $bad)) } else { 'an earlier step did not succeed' }
|    $deliver = @(@($State.Steps) | Where-Object { (Get-SIPipelineStepStage $_) -eq 'deliver' })
|    $out = @($deliver | Where-Object { [string]$_.State -notin @('Skipped', 'Disabled', 'Waiting') })
|    $tail = if ($deliver.Count -and -not $out.Count) { ' and nothing was delivered from this run' } else { '' }
|    'this run was held back: {0}, so {1} step(s) after it did not run{2} -- the data of the last good run stays in place' -f $what, $held.Count, $tail
|}
|
|# =====================================================================================================================
|#  ONE FAILED STEP DOES NOT COST THE REST OF THE RUN (owner 2026-10-12: "we can not loose all data when one fail";
|#  2026-10-13: "report it, but let it continue", and for a new install: "we nee to revisit that for the initial collection
|#  flow" -- an install with no earlier good run was left EMPTY by "the data of the last good run stays in place").
|#
|#  The map (config\job-flow.locked.json) says per step which kind of need it has:
|#    needs          the step reads the output of those steps OF THIS RUN -- it is held when one of them did not succeed;
|#    runsOnStored   the step works on what is STORED and holds back by itself whatever is not complete (the data sync loads
|#                   only collections whose run is shown complete, and closes no finding on a collection that is not; the
|#                   verification service only reads). After a step of Correlate (the CI build, Risk Analysis) did not
|#                   succeed, such a step still runs -- so the web app gets what the completed collections brought.
|#  What does NOT change (working rule 4, absence is not remediation): a Collect that did not succeed still lets nothing
|#  out; Risk Analysis never runs on a CI build that failed; the connectors that write to the customer's systems, the
|#  vulnerability tickets and the daily mail stay held; a saved "on failure: stop" still stops the pipeline; delivery
|#  still waits for a source that is too old. The run stays Failed in its record, its own run-health record is a WARNING
|#  that names the failed step, what ran all the same and what was held.
|# =====================================================================================================================
|#
|#  A NEW INSTALL'S FIRST COLLECTION (owner 2026-10-13, "wait for merged assets"): there is no last good run, and the
|#  customer never sees unmerged or half-built assets. The first data view is the merged assets, so while the asset build
|#  has not finished whole the data sync does not run either -- the run says "first collection, not complete yet" and names
|#  the step that failed. Once the asset build is whole, a failed Risk Analysis no longer keeps the assets from the web app.
|$script:SIPipelineStoredMark = 'on what is stored'
|$script:SIPipelineFirstMark = 'first collection, not complete yet'
|#  THE CONNECTORS NEED THE FINDINGS, NOT THE SUMMARY (owner 2026-10-13: "connectors only need detailed. connectors can
|#  work if detailed is ok. summary is nice-to-have (mgmt friendly, good easy overview). detailed is what integrations
|#  need"). The map marks Risk Analysis Summary 'niceToHave' and the CMDB connectors, the vulnerability connector, its
|#  ServiceNow form and the data sync 'runsWithoutNiceToHave': when the ONLY steps that failed after Collect are
|#  nice-to-have ones, those steps run IN FULL, on this run's own result -- the merged assets and the findings of this run
|#  are whole. They stay held when Risk Analysis Detailed or the asset correlation did not succeed (anything that is not
|#  nice-to-have failed), on an install's first collection, and the daily mail waits for a complete run.
|$script:SIPipelineOwnMark = 'on this run''s own result'
|
|function Get-SIPipelineStepBrings {
|    <# PURE. What a failed or held step would have brought, as a person reads it -- the map's 'brings' ('' when the map
|       says nothing of it: the step is then named by its own name only). #>
|    param([AllowEmptyString()][AllowNull()][string]$Job, $Map)
|    $k = Get-SIJobFlowKey $Job
|    if ($Map -and $k -and $Map.Jobs.Contains($k) -and $Map.Jobs[$k].PSObject.Properties['Brings']) { return [string]$Map.Jobs[$k].Brings }
|    ''
|}
|
|function Test-SIPipelineAssetBuild {
|    <# PURE. Is -Job the build of the merged assets (the map's 'assetBuild')? #>
|    param([AllowEmptyString()][AllowNull()][string]$Job, $Map)
|    $k = Get-SIJobFlowKey $Job
|    [bool]($Map -and $k -and $Map.Jobs.Contains($k) -and $Map.Jobs[$k].PSObject.Properties['AssetBuild'] -and [bool]$Map.Jobs[$k].AssetBuild)
|}
|
|function Test-SIPipelineGoOnAfterFailedStep {
|    <# PURE. The setting SI_Pro_Pipeline_GoOnAfterFailedStep: on unless it is set to false / 0 / no / off (then every step
|       after a failed one is held as before). #>
|    param($Value = $global:SI_Pro_Pipeline_GoOnAfterFailedStep)
|    if ($null -eq $Value) { return $true }
|    if ($Value -is [bool]) { return [bool]$Value }
|    -not (([string]$Value).Trim().Trim('$') -match '^(?i)(false|0|no|off)$')
|}
|
|function Get-SIPipelineStoredDataRun {
|    <#
|        PURE. A step that would be HELD (its stage does not start, or a step it needs did not succeed): may it run all the
|        same, on what is stored? @{ Run; Reason }. Yes only when ALL of this holds:
|          * the map marks the step 'runsOnStored';
|          * the Collect of this run is good -- it succeeded, it is not part of this run, or it only lost a source
|            (Get-SIPipelineCollectVerdict: GoesOn). After a Collect that did not succeed nothing is let out, as before;
|          * what failed comes AFTER Collect (a step of Correlate / Deliver / a custom stage);
|          * no failed step is set to stop the pipeline (the customer's saved "on failure: stop" is kept).
|    #>
|    param([Parameter(Mandatory)]$State, [Parameter(Mandatory)]$Definition, $Map, [Parameter(Mandatory)][string]$Job,
|          # A NEW INSTALL'S FIRST COLLECTION (owner 2026-10-13: "wait for merged assets"): the customer never sees a
|          # half-built asset list. When the asset build itself failed and the install has no earlier complete data, a step
|          # that rests on the asset build (the data sync) does NOT run -- the answer says so (FirstHeld, with the plain
|          # reason); a step that does not rest on it (the verification service) still runs.
|          [switch]$FirstRun)
|    $no = [pscustomobject]@{ Run = $false; Reason = ''; FirstHeld = $false }
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $k = Get-SIJobFlowKey $Job
|    if (-not $Map.Jobs.Contains($k) -or -not $Map.Jobs[$k].PSObject.Properties['RunsOnStored'] -or -not [bool]$Map.Jobs[$k].RunsOnStored) { return $no }
|    $verdict = Get-SIPipelineCollectVerdict -State $State -Definition $Definition
|    if ((Get-SIPipelineStageOutcome -State $State -Stage 'collect') -notin @('NotRun', 'Succeeded') -and -not $verdict.GoesOn) { return $no }
|    $bad = @(@($State.Steps) | Where-Object { [string]$_.State -in @('Failed', 'TimedOut', 'Interrupted') -and (Get-SIPipelineStepStage $_) -ne 'collect' })
|    if (-not $bad.Count) { return $no }
|    foreach ($b in $bad) {
|        $def = @(@($Definition.Steps) | Where-Object { [string]$_.Job -eq [string]$b.Job })[0]
|        if ($def -and [string]$def.OnFailure -eq 'stop') { return $no }
|    }
|    if ($FirstRun -and @($bad | Where-Object { Test-SIPipelineAssetBuild -Job ([string]$_.Job) -Map $Map }).Count) {
|        $rests = $false
|        $seen = @{}; $queue = New-Object System.Collections.Generic.Queue[string]; $queue.Enqueue($k)
|        while ($queue.Count -and -not $rests) {
|            $x = $queue.Dequeue(); if ($seen.ContainsKey($x)) { continue }; $seen[$x] = $true
|            if (-not $Map.Jobs.Contains($x)) { continue }
|            foreach ($n in @($Map.Jobs[$x].Needs)) { if (Test-SIPipelineAssetBuild -Job ([string]$n) -Map $Map) { $rests = $true; break }; $queue.Enqueue([string]$n) }
|        }
|        if ($rests) { return [pscustomobject]@{ Run = $false; FirstHeld = $true; Reason = ('{0}: the asset build did not finish, so the assets are not shown yet -- they are shown when the build has finished whole' -f $script:SIPipelineFirstMark) } }
|    }
|    [pscustomobject]@{ Run = $true; FirstHeld = $false; Reason = ('{0} did not succeed in this run -- {1} runs all the same, {2}: it holds back whatever is not complete and closes nothing' -f ((@($bad | ForEach-Object { [string]$_.Job })) -join ', '), $k, $script:SIPipelineStoredMark) }
|}
|
|function Test-SIPipelineNiceToHave {
|    <# PURE. Is -Job a nice-to-have step (the map's 'niceToHave': its failure holds only the steps that need it)? #>
|    param([AllowEmptyString()][AllowNull()][string]$Job, $Map)
|    $k = Get-SIJobFlowKey $Job
|    [bool]($Map -and $k -and $Map.Jobs.Contains($k) -and $Map.Jobs[$k].PSObject.Properties['NiceToHave'] -and [bool]$Map.Jobs[$k].NiceToHave)
|}
|
|function Get-SIPipelineOwnResultRun {
|    <#
|        PURE. A step whose STAGE does not start because the stage before it did not succeed: may it run all the same, IN
|        FULL, on this run's own result? @{ Run; Reason }. Yes only when ALL of this holds:
|          * the map marks the step 'runsWithoutNiceToHave' (the CMDB connectors, the vulnerability connector, its
|            ServiceNow form, the data sync -- never the daily mail);
|          * the Collect of this run is good (as Get-SIPipelineStoredDataRun);
|          * a step of the stages between Collect and this step's own stage failed, and EVERY step that failed there is a
|            nice-to-have one (Risk Analysis Summary) -- so Risk Analysis Detailed and the asset correlation did not fail
|            (a failure inside the step's own stage is judged as in every run: by the step's needs);
|          * every other step of the stages before this step's stage ended well (Success, or switched off) -- nothing the
|            step rests on was held, timed out or left out;
|          * no failed step is set to stop the pipeline (the customer's saved "on failure: stop" is kept).
|        The caller holds the step all the same when a step it NEEDS failed, and on an install's first collection.
|    #>
|    param([Parameter(Mandatory)]$State, [Parameter(Mandatory)]$Definition, $Map, [Parameter(Mandatory)][string]$Job)
|    $no = [pscustomobject]@{ Run = $false; Reason = '' }
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $k = Get-SIJobFlowKey $Job
|    if (-not $Map.Jobs.Contains($k) -or -not $Map.Jobs[$k].PSObject.Properties['RunsWithoutNiceToHave'] -or -not [bool]$Map.Jobs[$k].RunsWithoutNiceToHave) { return $no }
|    $verdict = Get-SIPipelineCollectVerdict -State $State -Definition $Definition
|    if ((Get-SIPipelineStageOutcome -State $State -Stage 'collect') -notin @('NotRun', 'Succeeded') -and -not $verdict.GoesOn) { return $no }
|    # the stages before this step's own stage (a failure INSIDE its own stage is judged as in every run: by its needs)
|    $stages = @(Get-SIPipelineStages -Definition $Definition | ForEach-Object { [string]$_.Id })
|    $mine = @(@($State.Steps) | Where-Object { (Get-SIJobFlowKey ([string]$_.Job)) -eq $k })[0]
|    $myStage = if ($mine) { Get-SIPipelineStepStage $mine } else { Get-SIPipelineStageOf -Job $k -Map $Map }
|    $at = [array]::IndexOf($stages, [string]$myStage)
|    if ($at -lt 0) { return $no }
|    $bad = @(@($State.Steps) | Where-Object {
|        $i = [array]::IndexOf($stages, [string](Get-SIPipelineStepStage $_))
|        [string]$_.State -in @('Failed', 'TimedOut', 'Interrupted') -and (Get-SIPipelineStepStage $_) -ne 'collect' -and $i -ge 0 -and $i -lt $at })
|    if (-not $bad.Count) { return $no }
|    foreach ($b in $bad) {
|        if (-not (Test-SIPipelineNiceToHave -Job ([string]$b.Job) -Map $Map)) { return $no }
|        $def = @(@($Definition.Steps) | Where-Object { [string]$_.Job -eq [string]$b.Job })[0]
|        if ($def -and [string]$def.OnFailure -eq 'stop') { return $no }
|    }
|    # every other step of those stages ended well
|    $badJobs = @($bad | ForEach-Object { [string]$_.Job })
|    foreach ($s in @($State.Steps)) {
|        $sStage = [string](Get-SIPipelineStepStage $s)
|        if ($sStage -eq 'collect' -or [string]$s.ErrorClass -eq 'before-rerun') { continue }
|        $i = [array]::IndexOf($stages, $sStage)
|        if ($i -lt 0 -or $i -ge $at) { continue }
|        if ($badJobs -contains [string]$s.Job) { continue }
|        if ([string]$s.State -notin @('Success', 'Disabled')) { return $no }
|    }
|    $what = @($bad | ForEach-Object { Get-SIPipelineStepBrings -Job ([string]$_.Job) -Map $Map } | Where-Object { $_ } | Select-Object -Unique)
|    [pscustomobject]@{ Run = $true; Reason = ('{0} did not succeed in this run -- {1} runs all the same, {2}: the findings and the merged assets of this run are whole, and it does not need {3}' -f ($badJobs -join ', '), $k, $script:SIPipelineOwnMark, $(if ($what.Count) { $what -join '; ' } else { 'what the failed step brings' })) }
|}
|
|function Get-SIPipelineWentOnSteps {
|    <# PURE. The steps of this run that RAN ALL THE SAME after another step failed: on what is stored, or in full on this
|       run's own result (the runner keeps the reason in the step's own record). -Kind stored | own | any. #>
|    param([Parameter(Mandatory)]$State, [ValidateSet('any', 'stored', 'own')][string]$Kind = 'any')
|    $marks = @(if ($Kind -in @('any', 'stored')) { $script:SIPipelineStoredMark }; if ($Kind -in @('any', 'own')) { $script:SIPipelineOwnMark })
|    @(@($State.Steps) | Where-Object {
|        $s = $_
|        $s.PSObject.Properties['RetryReason'] -and [string]$s.State -notin @('Skipped', 'Waiting', 'Disabled') -and
|        @($marks | Where-Object { [string]$s.RetryReason -like ('*' + $_ + '*') }).Count -gt 0 })
|}
|
|function Test-SIPipelineWentOn {
|    <# PURE. Did a step of this run run all the same after another step failed (on what is stored, or in full on this
|       run's own result)? -AllSucceeded: ... and every such step succeeded. #>
|    param([Parameter(Mandatory)]$State, [switch]$AllSucceeded)
|    $ran = @(Get-SIPipelineWentOnSteps -State $State)
|    if (-not $ran.Count) { return $false }
|    if ($AllSucceeded) { return (@($ran | Where-Object { [string]$_.State -ne 'Success' }).Count -eq 0) }
|    $true
|}
|
|function Get-SIPipelineWentOnAfter {
|    <# PURE. The failed step(s) THIS RUN WENT ON AFTER, in the run's order: failed / timed out / interrupted, not a source
|       the run went on without (it has its own sentence) and not a step that itself ran all the same. None when the run
|       did not go on after a failed step. The run's report names the first of them (the warning that opens a fix request). #>
|    param([Parameter(Mandatory)]$State, $Definition)
|    if (-not (Test-SIPipelinePartialRun -State $State)) { return @() }
|    $went = @((Get-SIPipelineCollectVerdict -State $State -Definition $Definition).Dropouts | ForEach-Object { [string]$_.Job })
|    $ranJobs = @(Get-SIPipelineWentOnSteps -State $State | ForEach-Object { [string]$_.Job })
|    @(@($State.Steps) | Where-Object { [string]$_.State -in @('Failed', 'TimedOut', 'Interrupted') -and $went -notcontains [string]$_.Job -and $ranJobs -notcontains [string]$_.Job })
|}
|
|function Test-SIPipelinePartialRun {
|    <# PURE. Is this a run in which one failed step did not cost the rest -- a step ran on what is stored, or (a first
|       collection whose asset build failed) a step was held with the first collection's own reason? Such a run has its own
|       sentence (Get-SIPipelinePartialText) instead of "held back ... the data of the last good run stays in place". #>
|    param([Parameter(Mandatory)]$State)
|    if (Test-SIPipelineWentOn -State $State) { return $true }
|    @(@($State.Steps) | Where-Object { [string]$_.State -eq 'Skipped' -and [string]$_.Error -like ($script:SIPipelineFirstMark + ':*') }).Count -gt 0
|}
|
|function Test-SIPipelineRanOnStored {
|    <# PURE. Did a step of this run run on what is stored after another step failed (the runner keeps the reason in the
|       step's own record)? -AllSucceeded: ... and every such step succeeded. #>
|    param([Parameter(Mandatory)]$State, [switch]$AllSucceeded)
|    $ran = @(@($State.Steps) | Where-Object { $_.PSObject.Properties['RetryReason'] -and [string]$_.RetryReason -like ('*' + $script:SIPipelineStoredMark + '*') -and [string]$_.State -notin @('Skipped', 'Waiting', 'Disabled') })
|    if (-not $ran.Count) { return $false }
|    if ($AllSucceeded) { return (@($ran | Where-Object { [string]$_.State -ne 'Success' }).Count -eq 0) }
|    $true
|}
|
|function Get-SIPipelinePartialText {
|    <#
|        PURE. The plain sentence of a run in which ONE FAILED STEP DID NOT COST THE REST: which step did not succeed, which
|        steps ran all the same on what is stored, what is therefore missing or not from this run, and which steps were
|        held and why. '' when no step ran on what is stored. Never says the run is whole, never says anything was fixed.
|          -FirstRun  the install has no earlier complete data: "first collection, not complete yet: ..." -- there is no
|                     last good run to fall back on, so the sentence never claims one;
|          -Short     the run's own note (the pipeline page; its column holds 400).
|    #>
|    param([Parameter(Mandatory)]$State, $Definition, [switch]$FirstRun, [switch]$Short, $Map)
|    if (-not (Test-SIPipelinePartialRun -State $State)) { return '' }
|    $steps = @($State.Steps)
|    $went = @((Get-SIPipelineCollectVerdict -State $State -Definition $Definition).Dropouts | ForEach-Object { [string]$_.Job })
|    $ranAll = @($steps | Where-Object { $_.PSObject.Properties['RetryReason'] -and [string]$_.RetryReason -like ('*' + $script:SIPipelineStoredMark + '*') -and [string]$_.State -notin @('Skipped', 'Waiting', 'Disabled') })
|    $ranJobs = @($ranAll | ForEach-Object { [string]$_.Job })
|    $ran = @($ranAll | Where-Object { [string]$_.State -eq 'Success' } | ForEach-Object { [string]$_.Job })
|    $ranBad = @($ranAll | Where-Object { [string]$_.State -ne 'Success' } | ForEach-Object { [string]$_.Job })
|    # the steps that ran in full on this run's own result (only nice-to-have steps failed)
|    $ownAll = @(Get-SIPipelineWentOnSteps -State $State -Kind own)
|    $ownJobs = @($ownAll | ForEach-Object { [string]$_.Job })
|    $ownOk = @($ownAll | Where-Object { [string]$_.State -eq 'Success' } | ForEach-Object { [string]$_.Job })
|    $ownBad = @($ownAll | Where-Object { [string]$_.State -ne 'Success' } | ForEach-Object { [string]$_.Job })
|    $bad = @($steps | Where-Object { [string]$_.State -in @('Failed', 'TimedOut', 'Interrupted') -and $went -notcontains [string]$_.Job -and $ranJobs -notcontains [string]$_.Job -and $ownJobs -notcontains [string]$_.Job })
|    $held = @($steps | Where-Object { [string]$_.State -eq 'Skipped' -and [string]$_.ErrorClass -in @('stage-blocked', 'needs-failed', 'flow-stopped') })
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    # a first collection whose asset build failed: no asset list is shown at all (never a half-built one)
|    $buildFailed = @($bad | Where-Object { Test-SIPipelineAssetBuild -Job ([string]$_.Job) -Map $Map }).Count -gt 0
|    $wordOf = {
|        param($s)
|        if ($FirstRun -and $buildFailed -and (Test-SIPipelineAssetBuild -Job ([string]$s.Job) -Map $Map)) { 'the asset list (its build did not finish)' }
|        else { Get-SIPipelineStepBrings -Job ([string]$s.Job) -Map $Map }
|    }
|    $brings = New-Object System.Collections.Generic.List[string]
|    foreach ($s in @($bad) + @($held)) {
|        $w = [string](& $wordOf $s)
|        if ($w -and -not $brings.Contains($w)) { $brings.Add($w) }
|    }
|    $missing = if ($brings.Count) { $brings -join '; ' } else { 'what the failed step would have brought' }
|    if ($Short) {
|        # the note holds 400 and carries other sentences too: what the FAILED step brings is named, the rest in four words
|        $own = New-Object System.Collections.Generic.List[string]
|        foreach ($s in @($bad)) { $w = [string](& $wordOf $s); if ($w -and -not $own.Contains($w)) { $own.Add($w) } }
|        $missing = if ($own.Count) { $own -join '; ' } else { 'what the failed step would have brought' }
|        if ($held.Count) { $missing += ' and what the held steps bring' }
|    }
|    $badShort = (@($bad | ForEach-Object { [string]$_.Job })) -join ', '
|    $badLong = (@($bad | ForEach-Object { '{0} ({1})' -f $_.Job, (Get-SIPipelineStageName (Get-SIPipelineStepStage $_)) })) -join ', '
|    $ranText = if ($ran.Count) { $ran -join ', ' } else { 'no step' }
|    $heldJobs = (@($held | ForEach-Object { [string]$_.Job })) -join ', '
|    if ($ownAll.Count) {
|        # only nice-to-have steps failed: the connectors and the data sync ran in full, on this run's own result
|        $ownText = if ($ownOk.Count) { $ownOk -join ', ' } else { 'no step' }
|        $ownAlso = if ($ownBad.Count) { (' {0} was started {1} and did not succeed.' -f ($ownBad -join ', '), $script:SIPipelineOwnMark) } else { '' }
|        if ($Short) {
|            return ('this run is not complete: {0} did not succeed; from the last good run, not from this one: {1}; {2} ran in full, {3}{4}; {5} step(s) held; nothing was closed because of the failed step.' -f $badShort, $missing, $ownText, $script:SIPipelineOwnMark,
|                $(if ($ran.Count) { ('; {0} ran {1}' -f ($ran -join ', '), $script:SIPipelineStoredMark) } else { '' }), $held.Count)
|        }
|        return ('this run is not complete: {0} did not succeed. {1} ran in full, {2}: the findings and the merged assets of this run are whole, and these steps do not need what the failed step brings; this is from the last good run, not from this one: {3}.{4}{5}{6}{7} Nothing was closed and no ticket was changed because of the failed step: what is missing is unknown, not resolved.' -f $badLong, $ownText, $script:SIPipelineOwnMark, $missing,
|            $(if ($ran.Count) { (' {0} ran {1}.' -f ($ran -join ', '), $script:SIPipelineStoredMark) } else { '' }), $ownAlso,
|            $(if ($ranBad.Count) { (' {0} was started on what is stored and did not succeed either.' -f ($ranBad -join ', ')) } else { '' }),
|            $(if ($held.Count) { (' Held until a run is complete: {0}.' -f $heldJobs) } else { '' }))
|    }
|    if ($Short) {
|        if ($FirstRun -and $buildFailed) {
|            return ('{0}: {1} did not succeed; missing: {2}; the assets are shown when their build has finished whole; {3} step(s) held; nothing was closed.' -f $script:SIPipelineFirstMark, $badShort, $missing, $held.Count)
|        }
|        if ($FirstRun) {
|            return ('{0}: {1} did not succeed; missing: {2}; {3} ran, so the assets that were built whole are shown; {4} step(s) held; nothing was closed.' -f $script:SIPipelineFirstMark, $badShort, $missing, $ranText, $held.Count)
|        }
|        return ('this run is not complete: {0} did not succeed; from the last good run, not from this one: {1}; {2} ran {3}; {4} step(s) held; nothing was closed.' -f $badShort, $missing, $ranText, $script:SIPipelineStoredMark, $held.Count)
|    }
|    $heldText = if ($held.Count) { (' Held, because they need the result of this run: {0}.' -f $heldJobs) } else { '' }
|    $alsoBad = if ($ranBad.Count) { (' {0} was started on what is stored and did not succeed either.' -f ($ranBad -join ', ')) } else { '' }
|    $never = ' Nothing was closed, no ticket was changed and no mail was sent because of the failed step: what is missing is unknown, not resolved.'
|    # a first collection's failed step was started again before the run gave up on it: said once, after everything else
|    $again = @($bad | Where-Object { (Get-SIPipelineFirstRunRestartCount -Step $_) -gt 0 } | ForEach-Object { '{0} was started again {1} time(s) on this first collection, carrying on from what it finished, and did not succeed' -f $_.Job, (Get-SIPipelineFirstRunRestartCount -Step $_) })
|    $againText = if ($again.Count) { ' ' + ($again -join '; ') + '.' } else { '' }
|    if ($FirstRun -and $buildFailed) {
|        return ('{0}: {1} did not succeed. Missing: {2}. The assets are shown when their build has finished whole -- no unmerged and no half-built asset list is shown, and there is no earlier run to fall back on.{3}{4}{5}{6}{7}' -f $script:SIPipelineFirstMark, $badLong, $missing,
|            $(if ($ran.Count) { (' {0} ran all the same.' -f $ranText) } else { '' }), $alsoBad, $heldText, $never, $againText)
|    }
|    if ($FirstRun) {
|        return ('{0}: {1} did not succeed. Missing: {2}. {3} ran all the same, so the web app shows the assets that were built whole -- without what is missing; there is no earlier run to fall back on.{4}{5}{6}{7}' -f $script:SIPipelineFirstMark, $badLong, $missing, $ranText, $alsoBad, $heldText, $never, $againText)
|    }
|    'this run is not complete: {0} did not succeed. {1} ran all the same, {2}, so the web app has what the completed collections brought; this is from the last good run, not from this one: {3}.{4}{5}{6}' -f $badLong, $ranText, $script:SIPipelineStoredMark, $missing, $alsoBad, $heldText, $never
|}
|
|function Get-SIPipelineWhoActsText {
|    <# PURE. Who must act on the failed step, from its error class (engine\_shared\SI-ErrorClass.ps1: Get-SIErrorFixKind):
|       the customer for a permission, licence or setting of the install; the vendor for everything else. #>
|    param([AllowEmptyString()][AllowNull()][string]$ErrorClass)
|    # a step stopped from outside the pipeline (an update, a roll, a person) or cancelled on purpose is nobody's fault
|    if ("$ErrorClass" -in @('stopped', 'cancelled')) { return 'who must act: nobody -- the step was stopped from outside the pipeline on purpose, not a failure; start the pipeline again when it should run' }
|    $kind = ''
|    if (Get-Command -Name Get-SIErrorFixKind -ErrorAction SilentlyContinue) { $kind = [string](Get-SIErrorFixKind -ErrorClass $ErrorClass) }
|    if ($kind -eq 'customer-config') { return 'who must act: you -- the failed step names a permission, a licence or a setting of this install that is missing (see the failed step''s own log)' }
|    'who must act: the vendor of SecurityInsight -- the failed step is a fault of the product, not of your setup; nothing has to be done here'
|}
|
|function Get-SIPipelineFirstRunSql {
|    <# The one guarded statement that answers "has this install no complete findings collection yet?" (1 = none). #>
|    "SET NOCOUNT ON; SELECT CASE WHEN OBJECT_ID(N'sidata.Collection') IS NULL THEN 1 WHEN EXISTS (SELECT 1 FROM sidata.Collection WHERE Status = N'Complete') THEN 0 ELSE 1 END;"
|}
|
|function Test-SIPipelineFirstRun {
|    <# Has this install NO earlier complete data to fall back on (no complete collection in its database)? -Invoke is the
|       database seam (sql, params, mode). Throws when it cannot be read -- the caller then does not claim a first run. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke)
|    ([int](& $Invoke (Get-SIPipelineFirstRunSql) @{} 'scalar')) -eq 1
|}
|
|# =====================================================================================================================
|#  THE FIRST RUN OF A NEW INSTALL IS ITS OWN FLOW (owner 2026-10-13: "we nee to revisit that for the initial collection
|#  flow"). An install is on its FIRST COLLECTION while its database holds no complete collection (Test-SIPipelineFirstRun).
|#  His answers, and what the runner does with each:
|#    "Wait for merged assets"  nothing is shown before the asset build has finished whole (Get-SIPipelineStoredDataRun
|#                              -FirstRun holds the data sync until then); the moment it has, the data sync runs AT ONCE,
|#                              on what is stored -- the merged assets are the first data view, and the findings follow
|#                              when Risk Analysis has finished. The run's note says which of the three it is at.
|#    "Two restarts"            a step that fails or is stopped is started again at once (it carries on from what it
|#                              finished), up to SI_Pro_Pipeline_FirstRunRestarts times (default 2); then the run ends with
|#                              a warning that names the step and who must act, and the run's report goes to Invardia.
|#    "whole collections only"  what reaches the web app is always a whole collection, marked with what is still missing.
|#  NOT COMPROMISED BY ANY OF IT (owner 2026-10-13: "we also agreed upon rules against servicenow and cmdb that must not
|#  be compromized after the first run"): the delivery at once holds every output (the data sync is told it runs on what
|#  is stored, the mark of Part "one failed step"); a step that writes to a CMDB, to ServiceNow or to a ticket is never
|#  started again by this and never started early; the connectors' own guards (refuse an incomplete run, refuse an empty
|#  desired set, the closure ceilings, match-only, never create, never from a provisional id) are not touched.
|# =====================================================================================================================
|$script:SIPipelineFirstRestartMark = 'first collection: started again'
|$script:SIPipelineFirstRunningMark = 'first collection running'
|
|function Get-SIPipelineFirstRunRestarts {
|    <# PURE. The setting SI_Pro_Pipeline_FirstRunRestarts: how many times a failed step of a first collection is started
|       again (default 2; 0 = never; anything that is not a whole number of 0 or more = the default). #>
|    param($Value = $global:SI_Pro_Pipeline_FirstRunRestarts)
|    $n = 0
|    if ($null -eq $Value -or -not [int]::TryParse(([string]$Value).Trim(), [ref]$n) -or $n -lt 0) { return 2 }
|    $n
|}
|
|function Test-SIPipelineRestsOnAssetBuild {
|    <# PURE. Does -Job rest on the build of the merged assets (the map's 'assetBuild' is one of its needs, directly or
|       through another step)? #>
|    param([AllowEmptyString()][AllowNull()][string]$Job, $Map)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $k = Get-SIJobFlowKey $Job
|    $seen = @{}; $queue = New-Object System.Collections.Generic.Queue[string]; $queue.Enqueue([string]$k)
|    while ($queue.Count) {
|        $x = $queue.Dequeue(); if ($seen.ContainsKey($x)) { continue }; $seen[$x] = $true
|        if (-not $Map.Jobs.Contains($x)) { continue }
|        foreach ($n in @($Map.Jobs[$x].Needs)) { if (Test-SIPipelineAssetBuild -Job ([string]$n) -Map $Map) { return $true }; $queue.Enqueue([string]$n) }
|    }
|    $false
|}
|
|function Test-SIPipelineFirstRunRestartStep {
|    <# PURE. May a failed step be STARTED AGAIN on a first collection? Only a step that collects or correlates, or one
|       that runs on what is stored (the data sync, the verification service). NEVER a step that writes to the customer's
|       systems, changes a ticket or sends a mail: those are started once, behind a complete run, as in every run. #>
|    param([Parameter(Mandatory)]$Step, $Map)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $k = Get-SIJobFlowKey ([string]$Step.Job)
|    if ((Get-SIPipelineStepStage $Step) -in @('collect', 'correlate')) { return $true }
|    [bool]($Map.Jobs.Contains($k) -and $Map.Jobs[$k].PSObject.Properties['RunsOnStored'] -and [bool]$Map.Jobs[$k].RunsOnStored)
|}
|
|function Get-SIPipelineFirstRunRestartCount {
|    <# PURE. How many times this step was started again on this first collection (the runner keeps each in the step's own
|       record, so a resumed run counts the same). #>
|    param([Parameter(Mandatory)]$Step)
|    if (-not $Step.PSObject.Properties['RetryReason']) { return 0 }
|    [regex]::Matches([string]$Step.RetryReason, [regex]::Escape($script:SIPipelineFirstRestartMark)).Count
|}
|
|function Get-SIPipelineFirstRunRestartText {
|    <# PURE. The plain line for one restart on a first collection. #>
|    param([Parameter(Mandatory)][string]$Job, [AllowEmptyString()][string]$Why, [int]$Restart = 1, [int]$Of = 2)
|    if ($Why.Length -gt 160) { $Why = $Why.Substring(0, 160) + ' ...' }   # the step's record holds 1000, and every restart is kept in it
|    '{0} ({1} of {2}) -- {3} did not succeed{4}; it carries on from what it finished' -f $script:SIPipelineFirstRestartMark, $Restart, $Of, (Get-SIJobFlowKey $Job), $(if ($Why) { ' (' + $Why + ')' } else { '' })
|}
|
|function Get-SIPipelineFirstDeliveryStep {
|    <# PURE. The step that shows the merged assets AT ONCE when the asset build of a first collection has finished whole:
|       the first step of this run that still waits, runs on what is stored and rests on the asset build (the data sync).
|       $null when there is none (it is not installed, switched off, or not part of this run). #>
|    param([Parameter(Mandatory)]$State, $Map)
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    @(@($State.Steps) | Where-Object {
|        $k = Get-SIJobFlowKey ([string]$_.Job)
|        [string]$_.State -eq 'Waiting' -and $Map.Jobs.Contains($k) -and $Map.Jobs[$k].PSObject.Properties['RunsOnStored'] -and [bool]$Map.Jobs[$k].RunsOnStored -and
|        (Test-SIPipelineRestsOnAssetBuild -Job $k -Map $Map) } | Select-Object -First 1)[0]
|}
|
|function Get-SIPipelineFirstRunText {
|    <#
|        PURE. The words of a first collection, one per moment:
|          Running       the run's note while nothing is shown yet;
|          DeliveryWhy   the reason kept in the data sync's record while it runs at once after the asset build (it carries
|                        the "on what is stored" words, so the data sync holds every output);
|          Delivered     the merged assets are in the web app, the findings follow;
|          NotDelivered  the delivery at once did not succeed -- the step runs again at its own place;
|          Complete      the first collection ended whole.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Running', 'DeliveryWhy', 'Delivered', 'NotDelivered', 'Complete')][string]$Kind, [string]$Job = 'asset-datasync', [string]$Stage = '')
|    $k = Get-SIJobFlowKey $Job
|    switch ($Kind) {
|        'Running'      { '{0}: nothing is shown before the asset build has finished whole -- then the merged assets, then the findings.' -f $script:SIPipelineFirstRunningMark }
|        'DeliveryWhy'  { 'first collection: the asset build finished whole -- {0} runs at once, {1}, so the merged assets are shown while the rest of the run goes on: it holds back whatever is not complete, closes nothing and sends nothing to an output' -f $k, $script:SIPipelineStoredMark }
|        'Delivered'    { '{0}: the merged assets are in the web app now ({1} ran at once after the asset build; nothing was closed and nothing was sent to an output) -- the findings follow when Risk Analysis has finished.' -f $script:SIPipelineFirstRunningMark, $k }
|        'NotDelivered' { '{0}: the merged assets could not be shown yet ({1} did not succeed when it ran at once after the asset build) -- it runs again at its own place in this run.' -f $script:SIPipelineFirstRunningMark, $k }
|        'Complete'     { 'first collection complete: the merged assets and the findings are in the web app.' }
|    }
|}
|
|function Get-SIPipelineWentOnText {
|    <#
|        PURE. The plain sentence for a run that WENT ON WITHOUT A SOURCE: a collection step did not succeed, the steps after
|        it ran all the same, and that source's data is what its last good collection left -- nothing of it is shown as gone
|        or fixed (absence is not remediation). '' when the run lost no source, or was held back at Collect instead.
|        Each dropped step may carry .LastGoodUtc (the runner sets it: when that source last collected completely); without
|        it the sentence says "its last good collection" and no date. Times are UTC.
|          this run went on without endpoint: its data is from 2026-10-10 14:05 UTC, because its last collection did not complete
|    #>
|    param([Parameter(Mandatory)]$State, $Definition)
|    $drop = @((Get-SIPipelineCollectVerdict -State $State -Definition $Definition).Dropouts)
|    if (-not $drop.Count) { return '' }
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $when = {
|        param($s)
|        $t = $null
|        if ($s.PSObject.Properties['LastGoodUtc'] -and $s.LastGoodUtc) { try { $t = ([datetime]$s.LastGoodUtc).ToUniversalTime() } catch { $t = $null } }
|        if ($t) { $t.ToString('yyyy-MM-dd HH:mm', $inv) + ' UTC' } else { 'its last good collection' }
|    }
|    if ($drop.Count -eq 1) {
|        return ('this run went on without {0}: its data is from {1}, because its last collection did not complete' -f $drop[0].Job, (& $when $drop[0]))
|    }
|    'this run went on without {0}: {1} -- their last collections did not complete' -f ((@($drop | ForEach-Object { [string]$_.Job })) -join ', '),
|        ((@($drop | ForEach-Object { '{0} data is from {1}' -f $_.Job, (& $when $_) })) -join '; ')
|}
|
|function Get-SIPipelineStatusText {
|    <#
|        PURE. The run in words: "Daily pipeline - Stage 2 of 3: Correlate (data structure)" while it runs, "Daily pipeline -
|        succeeded" when it ended; a stage run "Daily pipeline - Stage 3 of 3: Deliver (data-out) (run now)", a step run
|        "... - step Data sync". The stage is named as in the overview's headings (Get-SIPipelineStageTitle).
|    #>
|    param([Parameter(Mandatory)]$State, [Parameter(Mandatory)]$Definition)
|    $name = if ($Definition.PSObject.Properties['Name'] -and $Definition.Name) { [string]$Definition.Name } else { $script:SIPipeline.DefaultName }
|    $stages = @(Get-SIPipelineStages -Definition $Definition)
|    $ids = @($stages | ForEach-Object { [string]$_.Id })
|    $scope = if ($State.PSObject.Properties['Scope'] -and $State.Scope) { [string]$State.Scope } else { 'pipeline' }
|    $target = if ($State.PSObject.Properties['Target']) { [string]$State.Target } else { '' }
|    $finished = [string]$State.State -in $script:SIPipeline.RunFinished
|    $cur = ''
|    if (-not $finished) {
|        foreach ($id in $ids) { if ((Get-SIPipelineStageOutcome -State $State -Stage $id) -in @('Running', 'Waiting')) { $cur = $id; break } }
|    } elseif ($scope -eq 'stage') { $cur = $target }
|    $where = ''
|    if ($scope -eq 'step') { $where = ('step {0}' -f $target) }
|    elseif ($cur) {
|        $curStage = @($stages | Where-Object { [string]$_.Id -eq $cur })[0]
|        $curName = if ($curStage -and $curStage.PSObject.Properties['Name']) { [string]$curStage.Name } else { '' }
|        $where = ('Stage {0} of {1}: {2}' -f ([array]::IndexOf($ids, $cur) + 1), $ids.Count, (Get-SIPipelineStageTitle -Id $cur -Name $curName))
|    }
|    $tail = if ($finished) { [string]$State.State.ToLowerInvariant() } else { '' }
|    # #532: a run whose only failures were steps Microsoft throttled reads 'throttled', never 'failed' (the web app says the same)
|    if ($finished -and (Get-Command -Name Test-SIJobFlowThrottledOnly -ErrorAction SilentlyContinue) -and (Test-SIJobFlowThrottledOnly -State $State)) { $tail = 'throttled' }
|    $parts = @($name) + @(@($where, $tail) | Where-Object { $_ })
|    # the middle dot as a code point: Windows PowerShell 5.1 reads a file without a byte-order mark as ANSI
|    ($parts -join (' {0} ' -f [char]0x00B7)) + $(if ($scope -ne 'pipeline' -and $scope -ne 'from-step') { ' (run now)' } else { '' })
|}
|
|# =====================================================================================================================
|#  Requests, the queue and the lock
|# =====================================================================================================================
|function New-SIPipelineRequest {
|    <#
|        PURE. One request to run: -Scope pipeline (the whole pipeline) | stage (-Target = the stage id) | step (-Target =
|        the job) | from-step (the pipeline from -Target on). -Trigger schedule | catch-up | interval | manual; -SlotUtc: the
|        time-of-day slot a scheduled request is for (it is then recorded as run).
|    #>
|    param([Parameter(Mandatory)][ValidateSet('pipeline', 'stage', 'step', 'from-step')][string]$Scope, [string]$Target = '', [string]$Trigger = 'manual',
|          [string]$RequestedBy = '', $SlotUtc, [string]$Note = '', $RequestedUtc)
|    if ($Scope -eq 'pipeline') { $Target = '' }
|    elseif (-not $Target) { throw ("a {0} request names what it runs" -f $Scope) }
|    if ($Scope -in @('step', 'from-step')) { $Target = Get-SIJobFlowKey $Target }
|    if ($Target -and $Target -notmatch '^[a-z0-9][a-z0-9\-]{0,63}$') { throw ("'{0}' is not a stage or a step" -f $Target) }
|    if ($null -eq $RequestedUtc) { $RequestedUtc = [datetime]::UtcNow }
|    [pscustomobject]@{ Id = 0; Scope = $Scope; Target = [string]$Target; Trigger = $Trigger; RequestedBy = [string]$RequestedBy; RequestedUtc = $RequestedUtc
|                       SlotUtc = $SlotUtc; Note = $Note; State = 'Queued'; FlowRunId = ''; Outcome = '' }
|}
|
|function Get-SIPipelineRequestKey {
|    <# PURE. Two queued requests with the same key are the same request (it is kept once): scope + target. #>
|    param([Parameter(Mandatory)]$Request)
|    ('{0}|{1}' -f ([string]$Request.Scope).ToLowerInvariant(), ([string]$Request.Target).ToLowerInvariant())
|}
|
|function Get-SIPipelineRequestText {
|    <# PURE. "the pipeline" / "stage Correlate" / "step asset-datasync" / "the pipeline from asset-datasync". #>
|    param([Parameter(Mandatory)]$Request)
|    switch ([string]$Request.Scope) {
|        'stage' { 'stage {0}' -f (Get-SIPipelineStageName $Request.Target) }
|        'step' { 'step {0}' -f $Request.Target }
|        'from-step' { 'the pipeline from {0}' -f $Request.Target }
|        default { 'the pipeline' }
|    }
|}
|
|function Test-SIPipelineRequest {
|    <# PURE. $null when -Request can run against -Definition, else why not (an unknown stage / step). #>
|    param([Parameter(Mandatory)]$Request, [Parameter(Mandatory)]$Definition)
|    switch ([string]$Request.Scope) {
|        'stage' { if (-not @(@(Get-SIPipelineStages -Definition $Definition) | Where-Object { [string]$_.Id -eq [string]$Request.Target }).Count) { return ("'{0}' is not a stage of the pipeline" -f $Request.Target) } }
|        { $_ -in @('step', 'from-step') } { if (-not @(@($Definition.Steps) | Where-Object { [string]$_.Job -eq [string]$Request.Target }).Count) { return ("'{0}' is not a step of the pipeline" -f $Request.Target) } }
|    }
|    $null
|}
|
|function Get-SIPipelinePendingSlot {
|    <#
|        PURE. While a run holds the install (a manual run, or a long one), is a time-of-day slot of the schedule waiting
|        for it? The slot is then QUEUED (catch-up: it runs once when the lock is free). @{ SlotUtc; Note } or $null. An
|        interval schedule never queues (its next run is counted from the finish).
|    #>
|    param([Parameter(Mandatory)]$Definition, $Previous, [Parameter(Mandatory)][datetime]$NowUtc, [int]$FirstRunWindowMinutes = 15)
|    if ([string]$Definition.Cadence -eq 'interval') { return $null }
|    $slot = Get-SIJobFlowLatestSlot -Definition $Definition -NowUtc $NowUtc
|    if (-not $slot) { return $null }
|    # the slot that has run: the run's own, or one a manual run covered (Get-SIJobFlowSlotRun)
|    $last = if ($Previous) { Get-SIJobFlowSlotRun -Definition $Definition -Previous $Previous } else { $null }
|    if ($last -and ([datetime]$last).ToUniversalTime() -ge $slot) { return $null }
|    if (-not $last -and ($NowUtc.ToUniversalTime() - $slot).TotalMinutes -gt $FirstRunWindowMinutes) { return $null }
|    $who = if ($Previous) { ('run {0}' -f $Previous.FlowRunId) } else { 'another run' }
|    [pscustomobject]@{ SlotUtc = $slot; Note = ('the {0:u} start waited in the queue: {1} was still running' -f $slot, $who) }
|}
|
|function ConvertTo-SIPipelineJsonArray {
|    <# PURE. A JSON array of -Items (each through ConvertTo-Json): PS 5.1 never collapses a one-element list. #>
|    param([AllowEmptyCollection()][AllowNull()][object[]]$Items = @(), [int]$Depth = 6)
|    '[' + ((@($Items | Where-Object { $null -ne $_ }) | ForEach-Object { ConvertTo-Json -InputObject $_ -Depth $Depth -Compress }) -join ',') + ']'
|}
|
|function ConvertFrom-SIPipelineRequestRow {
|    <# PURE. A queue row (SQL reader hashtable / JSON object) as a request object. #>
|    param($Row)
|    if ($null -eq $Row) { return $null }
|    if ($Row -is [System.Collections.IDictionary]) { $Row = [pscustomobject]$Row }
|    $g = { param($n, $d) if ($Row.PSObject.Properties[$n] -and $null -ne $Row.$n -and -not ($Row.$n -is [DBNull])) { $Row.$n } else { $d } }
|    $t = { param($v) if ($null -eq $v -or "$v" -eq '') { $null } elseif ($v -is [datetime]) { $v.ToUniversalTime() } else { [datetime]::Parse([string]$v, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal) } }
|    [pscustomobject]@{ Id = [long](& $g 'Id' 0); Scope = [string](& $g 'Scope' 'pipeline'); Target = [string](& $g 'Target' ''); Trigger = [string](& $g 'Trg' (& $g 'Trigger' 'manual'))
|                       RequestedBy = [string](& $g 'RequestedBy' ''); RequestedUtc = (& $t (& $g 'RequestedUtc' $null)); SlotUtc = (& $t (& $g 'SlotUtc' $null)); Note = [string](& $g 'Note' '')
|                       State = [string](& $g 'State' 'Queued'); FlowRunId = [string](& $g 'FlowRunId' ''); Outcome = [string](& $g 'Outcome' '') }
|}
|
|# ---- Pro: cfg.PipelineLock + cfg.PipelineQueue over the (sql, params, mode) -Invoke seam ----------------------------
|function Get-SIPipelineSqlText {
|    <# The T-SQL of the Pro lock + queue (one place; the LocalSql test runs it against sql\si-pro-settings.sql). #>
|    param([Parameter(Mandatory)][ValidateSet('Acquire', 'Heartbeat', 'Release', 'Lock', 'ReleaseRun', 'Enqueue', 'Next', 'MarkRunning', 'MarkDone', 'Cancel', 'List')][string]$Name)
|    switch ($Name) {
|        'Acquire' { @'
|IF OBJECT_ID(N'cfg.PipelineLock') IS NULL BEGIN SELECT CAST(NULL AS nvarchar(128)) AS Holder, CAST(NULL AS nvarchar(200)) AS What, CAST(NULL AS datetime2) AS AcquiredUtc, CAST(NULL AS datetime2) AS HeartbeatUtc, CAST(NULL AS nvarchar(128)) AS PreviousHolder, -1 AS Mine; RETURN; END
|SET XACT_ABORT ON;
|BEGIN TRAN;
|IF NOT EXISTS (SELECT 1 FROM cfg.PipelineLock WITH (UPDLOCK, HOLDLOCK) WHERE LockId = N'install') INSERT cfg.PipelineLock (LockId) VALUES (N'install');
|DECLARE @prev nvarchar(128) = (SELECT Holder FROM cfg.PipelineLock WITH (UPDLOCK, HOLDLOCK) WHERE LockId = N'install');
|UPDATE cfg.PipelineLock
|   SET Holder = @Holder, What = @What, FlowRunId = NULL,
|       AcquiredUtc = CASE WHEN Holder = @Holder THEN AcquiredUtc ELSE SYSUTCDATETIME() END, HeartbeatUtc = SYSUTCDATETIME()
| WHERE LockId = N'install' AND (Holder IS NULL OR Holder = @Holder OR HeartbeatUtc IS NULL OR HeartbeatUtc < DATEADD(minute, -@StaleMinutes, SYSUTCDATETIME()));
|SELECT Holder, What, AcquiredUtc, HeartbeatUtc, CASE WHEN @prev = @Holder THEN NULL ELSE @prev END AS PreviousHolder, CASE WHEN Holder = @Holder THEN 1 ELSE 0 END AS Mine
|  FROM cfg.PipelineLock WHERE LockId = N'install';
|COMMIT;
|'@ }
|        'Heartbeat' { "UPDATE cfg.PipelineLock SET HeartbeatUtc = SYSUTCDATETIME(), FlowRunId = @FlowRunId, What = @What WHERE LockId = N'install' AND Holder = @Holder; SELECT @@ROWCOUNT AS Held;" }
|        'Release' { "IF OBJECT_ID(N'cfg.PipelineLock') IS NOT NULL UPDATE cfg.PipelineLock SET Holder = NULL, What = NULL, FlowRunId = NULL, HeartbeatUtc = NULL WHERE LockId = N'install' AND Holder = @Holder;" }
|        # #700: who holds the lock now, and for which run
|        'Lock' { "IF OBJECT_ID(N'cfg.PipelineLock') IS NOT NULL SELECT Holder, What, FlowRunId, HeartbeatUtc FROM cfg.PipelineLock WHERE LockId = N'install';" }
|        # #700: the lock of ONE run, released at once when that run is cancelled (whoever holds it for that run)
|        'ReleaseRun' { "IF OBJECT_ID(N'cfg.PipelineLock') IS NULL BEGIN SELECT 0 AS Released; RETURN; END UPDATE cfg.PipelineLock SET Holder = NULL, What = NULL, FlowRunId = NULL, HeartbeatUtc = NULL WHERE LockId = N'install' AND Holder IS NOT NULL AND FlowRunId = @FlowRunId; SELECT @@ROWCOUNT AS Released;" }
|        'Enqueue' { @'
|IF OBJECT_ID(N'cfg.PipelineQueue') IS NULL BEGIN SELECT CAST(0 AS bigint) AS Id, N'Missing' AS Outcome; RETURN; END
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @id bigint = (SELECT TOP (1) Id FROM cfg.PipelineQueue WITH (UPDLOCK, HOLDLOCK) WHERE PipelineId = N'daily' AND Scope = @Scope AND Target = @Target AND State = N'Queued' ORDER BY Id);
|IF @id IS NOT NULL
|BEGIN
|    UPDATE cfg.PipelineQueue SET SlotUtc = COALESCE(SlotUtc, @SlotUtc), Note = CASE WHEN Note IS NULL OR Note = N'' THEN @Note ELSE Note END WHERE Id = @id;
|    COMMIT; SELECT @id AS Id, N'Deduplicated' AS Outcome; RETURN;
|END
|INSERT cfg.PipelineQueue (PipelineId, Scope, Target, Trg, RequestedBy, SlotUtc, Note) VALUES (N'daily', @Scope, @Target, @Trg, @RequestedBy, @SlotUtc, @Note);
|SET @id = CAST(SCOPE_IDENTITY() AS bigint);
|COMMIT;
|SELECT @id AS Id, N'Queued' AS Outcome;
|'@ }
|        'Next' { "IF OBJECT_ID(N'cfg.PipelineQueue') IS NOT NULL SELECT TOP (1) Id, Scope, Target, Trg, RequestedBy, RequestedUtc, SlotUtc, Note, State, FlowRunId, Outcome FROM cfg.PipelineQueue WHERE PipelineId = N'daily' AND State = N'Queued' ORDER BY Id;" }
|        # live 2026-10-19 (ring 2): the runner names itself (the session's 'si.pipeline.holder') -- the schema's trigger
|        # cfg.TR_PipelineQueue_Claim lets a request be taken only by the runner that holds the install's lock, so a runner of
|        # older code that outlived its stop or an update never starts the next queued run
|        'MarkRunning' { "EXEC sys.sp_set_session_context @key = N'si.pipeline.holder', @value = @Holder; UPDATE cfg.PipelineQueue SET State = N'Running', FlowRunId = @FlowRunId, StartedUtc = SYSUTCDATETIME() WHERE Id = @Id AND State = N'Queued'; SELECT @@ROWCOUNT AS Taken;" }
|        'MarkDone' { "UPDATE cfg.PipelineQueue SET State = N'Done', Outcome = @Outcome, EndedUtc = SYSUTCDATETIME() WHERE Id = @Id AND State IN (N'Queued', N'Running');" }
|        'Cancel' { "UPDATE cfg.PipelineQueue SET State = N'Cancelled', CancelledBy = @By, EndedUtc = SYSUTCDATETIME() WHERE Id = @Id AND State = N'Queued'; SELECT @@ROWCOUNT AS Cancelled;" }
|        'List' { "IF OBJECT_ID(N'cfg.PipelineQueue') IS NOT NULL SELECT Id, Scope, Target, Trg, RequestedBy, RequestedUtc, SlotUtc, Note, State, FlowRunId, Outcome FROM cfg.PipelineQueue WHERE PipelineId = N'daily' AND State IN (N'Queued', N'Running') ORDER BY Id;" }
|    }
|}
|
|# =====================================================================================================================
|#  #913 (the ride test install 2026-10-27, 3.0.0.202610261957): the runner's wake-up failed in AcquireLock on
|#  "Exception calling "Close" ... Error code 9001" (Azure SQL: the log is not available -- a transient) and went to Invardia
|#  as a product defect with a red alert, though no run was affected. The LOCK calls (open, acquire, beat, release, close --
|#  each one statement on its own connection) now treat the Azure SQL transients like the published-copy ranges do (#890 (4)):
|#  the call again after 2, 4, 8, 16, 30 s (about a minute); only then it fails, tagged transient-sql (never product-defect).
|#  Every lock statement is idempotent for its holder (Acquire / Heartbeat / Release name the holder), so a call that ran and
|#  lost only its Close is safe to send again.
|# =====================================================================================================================
|$script:SIPipelineLockRetry = @{
|    Waits   = @(2, 4, 8, 16, 30)
|    # 9001 log not available; 40613 / 40501 / 40197 / 49918-49920 the database or the service busy, moving or not available;
|    # 4060 cannot open the database (during a failover); 10928 / 10929 resource limits; 10053 / 10054 / 233 / 64 a reset
|    # or closed connection; -2 a client timeout
|    Numbers = @(9001, 40613, 40501, 40197, 49918, 49919, 49920, 4060, 10928, 10929, 10053, 10054, 233, 64, -2)
|    Pattern = '(?i)\b(9001|40613|40501|40197|49918|49919|49920|10928|10929)\b|log for database .* is not available|is not currently available|transport-level error|connection was forcibly closed|forcibly closed by the remote host|connection reset|Connection reset by peer|broken pipe|Cannot open database .* requested by the login.*(failover|not currently available)'
|    Class   = 'transient-sql'
|}
|
|function Test-SIPipelineLockTransient {
|    <# PURE. #913: is a failure of a lock call an Azure SQL transient worth another attempt? -ErrorRecord: an ErrorRecord, an
|       exception (SqlException numbers and inner exceptions are read) or a text. A permission, a syntax error or anything
|       else is never retried. #>
|    param([AllowNull()]$ErrorRecord)
|    if ($null -eq $ErrorRecord) { return $false }
|    $ex = if ($ErrorRecord -is [System.Management.Automation.ErrorRecord]) { $ErrorRecord.Exception } elseif ($ErrorRecord -is [System.Exception]) { $ErrorRecord } else { $null }
|    $texts = New-Object System.Collections.Generic.List[string]
|    while ($ex) {
|        if ($ex -is [System.Data.SqlClient.SqlException]) {
|            foreach ($er in @($ex.Errors)) { if ($script:SIPipelineLockRetry.Numbers -contains [int]$er.Number) { return $true } }
|            if ($script:SIPipelineLockRetry.Numbers -contains [int]$ex.Number) { return $true }
|        }
|        $texts.Add([string]$ex.Message); $ex = $ex.InnerException
|    }
|    if (-not $texts.Count) { $texts.Add([string]$ErrorRecord) }
|    return [bool](($texts -join ' | ') -match $script:SIPipelineLockRetry.Pattern)
|}
|
|function Get-SIPipelineErrorClassTag {
|    <# PURE. #913: the error class a caller TAGGED on a failure (Exception.Data['SIErrorClass'], on it or an inner exception --
|       a script method wraps what it throws), or ''. #>
|    param([AllowNull()]$ErrorRecord)
|    $ex = if ($ErrorRecord -is [System.Management.Automation.ErrorRecord]) { $ErrorRecord.Exception } elseif ($ErrorRecord -is [System.Exception]) { $ErrorRecord } else { $null }
|    while ($ex) {
|        try { if ($ex.Data -and $ex.Data.Contains('SIErrorClass') -and [string]$ex.Data['SIErrorClass']) { return [string]$ex.Data['SIErrorClass'] } } catch { }
|        $ex = $ex.InnerException
|    }
|    ''
|}
|
|function Invoke-SIPipelineLockCall {
|    <#
|        #913: ONE lock call (-Call { }) with the bounded retry on the Azure SQL transients (Test-SIPipelineLockTransient):
|        again after each of -Waits seconds (default 2, 4, 8, 16, 30 -- about a minute); any other error is thrown at once.
|        When the transient outlasts the retry it is thrown as "the pipeline lock (<What>) ... transient-sql", the class on
|        Exception.Data['SIErrorClass'] = 'transient-sql' (Get-SIPipelineErrorClassTag). -Sleep { param($s) } and -Log
|        { param($Level, $Text) } are seams.
|    #>
|    param([Parameter(Mandatory)][string]$What, [Parameter(Mandatory)][scriptblock]$Call, [int[]]$Waits = $script:SIPipelineLockRetry.Waits,
|          [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s }, [scriptblock]$Log)
|    $try = 0
|    while ($true) {
|        try { return (& $Call) }
|        catch {
|            $err = $_
|            if (-not (Test-SIPipelineLockTransient -ErrorRecord $err)) { throw }
|            $first = (([string]$err.Exception.Message) -split "`n")[0].Trim()
|            if ($try -ge @($Waits).Count) {
|                $ex = New-Object System.Exception(('the pipeline lock ({0}) could not be reached: Azure SQL answered a transient error {1} time(s) in about a minute ({2}) -- {3}; the next wake-up tries again' -f $What, ($try + 1), $first, $script:SIPipelineLockRetry.Class), $err.Exception)
|                $ex.Data['SIErrorClass'] = $script:SIPipelineLockRetry.Class
|                throw $ex
|            }
|            $w = [int]@($Waits)[$try]; $try++
|            if ($Log) { try { & $Log 'WARN' ('the pipeline lock ({0}): Azure SQL is not available for a moment ({1}) -- trying again in {2} s ({3}/{4})' -f $What, $first, $w, $try, @($Waits).Count) } catch { } }
|            if ($w -gt 0) { & $Sleep $w }
|        }
|    }
|}
|
|function New-SIPipelineSqlControl {
|    <#
|        The Pro lock + queue (cfg.PipelineLock / cfg.PipelineQueue) over the -Invoke seam every Pro engine uses
|        (New-SIProSettingsStore .Invoke: ONE array of hashtables per reader -- ConvertTo-SIJobFlowSqlRows flattens it).
|        A database whose schema was not applied again has neither table: Available is then $false and the runner falls back
|        to the run record's heartbeat (SCHED-1.1, as before #306).
|        #913: the lock calls (AcquireLock, HeartbeatLock, ReleaseLock, ReleaseLockOfRun, LockHolder) retry the Azure SQL
|        transients (Invoke-SIPipelineLockCall); -LockWaits / -LockSleep / -LockLog are its seams.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [int[]]$LockWaits = $script:SIPipelineLockRetry.Waits,
|          [scriptblock]$LockSleep = { param($s) Start-Sleep -Seconds $s }, [scriptblock]$LockLog)
|    New-SIJobFlowSeams -Fields @{ Invoke = $Invoke; Kind = 'sql'; LockWaits = $LockWaits; LockSleep = $LockSleep; LockLog = $LockLog } -Methods @{
|        AcquireLock = {
|            param($Holder, $What, $StaleMinutes)
|            # (the call block reads uniquely named locals: it runs inside Invoke-SIPipelineLockCall, whose own -What would win)
|            $__lkInv = $this.Invoke; $__lkArgs = @{ Holder = [string]$Holder; What = [string]$What; StaleMinutes = [int]$StaleMinutes }
|            $r = @(Invoke-SIPipelineLockCall -What 'acquire' -Waits $this.LockWaits -Sleep $this.LockSleep -Log $this.LockLog -Call {
|                    @(& $__lkInv (Get-SIPipelineSqlText 'Acquire') $__lkArgs 'reader' | ConvertTo-SIJobFlowSqlRows) })
|            if (-not $r.Count -or [int]$r[0].Mine -lt 0) { return [pscustomobject]@{ Available = $false; Acquired = $true; Holder = ''; What = ''; HeartbeatUtc = $null; TookOver = '' } }
|            $x = $r[0]
|            $tk = if (-not ($x.PreviousHolder -is [DBNull]) -and $x.PreviousHolder -and [int]$x.Mine -eq 1) { [string]$x.PreviousHolder } else { '' }
|            [pscustomobject]@{ Available = $true; Acquired = ([int]$x.Mine -eq 1); Holder = [string]$x.Holder; What = [string]$x.What
|                               HeartbeatUtc = $(if ($x.HeartbeatUtc -is [DBNull]) { $null } else { $x.HeartbeatUtc }); TookOver = $tk }
|        }
|        HeartbeatLock = {
|            param($Holder, $FlowRunId, $What)
|            $__lkInv = $this.Invoke; $__lkArgs = @{ Holder = [string]$Holder; FlowRunId = [string]$FlowRunId; What = [string]$What }
|            $r = @(Invoke-SIPipelineLockCall -What 'beat' -Waits $this.LockWaits -Sleep $this.LockSleep -Log $this.LockLog -Call {
|                    @(& $__lkInv (Get-SIPipelineSqlText 'Heartbeat') $__lkArgs 'reader' | ConvertTo-SIJobFlowSqlRows) })
|            ($r.Count -and [int]$r[0].Held -gt 0)
|        }
|        ReleaseLock = {
|            param($Holder)
|            $__lkInv = $this.Invoke; $__lkArgs = @{ Holder = [string]$Holder }
|            $null = Invoke-SIPipelineLockCall -What 'release' -Waits $this.LockWaits -Sleep $this.LockSleep -Log $this.LockLog -Call {
|                    $null = & $__lkInv (Get-SIPipelineSqlText 'Release') $__lkArgs 'nonquery' }
|        }
|        ReleaseLockOfRun = {
|            param($FlowRunId)
|            $__lkInv = $this.Invoke; $__lkArgs = @{ FlowRunId = [string]$FlowRunId }
|            $r = @(Invoke-SIPipelineLockCall -What 'release of a run' -Waits $this.LockWaits -Sleep $this.LockSleep -Log $this.LockLog -Call {
|                    @(& $__lkInv (Get-SIPipelineSqlText 'ReleaseRun') $__lkArgs 'reader' | ConvertTo-SIJobFlowSqlRows) })
|            ($r.Count -and [int]$r[0].Released -gt 0)
|        }
|        LockHolder = {
|            $__lkInv = $this.Invoke
|            $r = @(Invoke-SIPipelineLockCall -What 'read' -Waits $this.LockWaits -Sleep $this.LockSleep -Log $this.LockLog -Call {
|                    @(& $__lkInv (Get-SIPipelineSqlText 'Lock') @{} 'reader' | ConvertTo-SIJobFlowSqlRows) })
|            if (-not $r.Count -or $r[0].Holder -is [DBNull] -or -not [string]$r[0].Holder) { return $null }
|            [pscustomobject]@{ Holder = [string]$r[0].Holder; What = $(if ($r[0].What -is [DBNull]) { '' } else { [string]$r[0].What }); FlowRunId = $(if ($r[0].FlowRunId -is [DBNull]) { '' } else { [string]$r[0].FlowRunId }) }
|        }
|        Enqueue = {
|            param($Request)
|            $nul = { param($v) if ($null -eq $v) { [DBNull]::Value } else { $v } }
|            $r = @(& $this.Invoke (Get-SIPipelineSqlText 'Enqueue') @{ Scope = [string]$Request.Scope; Target = [string]$Request.Target; Trg = [string]$Request.Trigger
|                                                                        RequestedBy = [string]$Request.RequestedBy; SlotUtc = (& $nul $Request.SlotUtc); Note = [string]$Request.Note } 'reader' | ConvertTo-SIJobFlowSqlRows)
|            if (-not $r.Count) { return [pscustomobject]@{ Id = 0; Outcome = 'Missing' } }
|            [pscustomobject]@{ Id = [long]$r[0].Id; Outcome = [string]$r[0].Outcome }
|        }
|        NextQueued = { $r = @(& $this.Invoke (Get-SIPipelineSqlText 'Next') @{} 'reader' | ConvertTo-SIJobFlowSqlRows); if ($r.Count) { ConvertFrom-SIPipelineRequestRow $r[0] } else { $null } }
|        MarkRunning = { param($Id, $FlowRunId, $Holder) $r = @(& $this.Invoke (Get-SIPipelineSqlText 'MarkRunning') @{ Id = [long]$Id; FlowRunId = [string]$FlowRunId; Holder = [string]$Holder } 'reader' | ConvertTo-SIJobFlowSqlRows); ($r.Count -and [int]$r[0].Taken -gt 0) }
|        MarkDone = { param($Id, $Outcome) $null = & $this.Invoke (Get-SIPipelineSqlText 'MarkDone') @{ Id = [long]$Id; Outcome = [string]$Outcome } 'nonquery' }
|        Cancel = { param($Id, $By) $r = @(& $this.Invoke (Get-SIPipelineSqlText 'Cancel') @{ Id = [long]$Id; By = [string]$By } 'reader' | ConvertTo-SIJobFlowSqlRows); ($r.Count -and [int]$r[0].Cancelled -gt 0) }
|        List = { @(& $this.Invoke (Get-SIPipelineSqlText 'List') @{} 'reader' | ConvertTo-SIJobFlowSqlRows | ForEach-Object { ConvertFrom-SIPipelineRequestRow $_ }) }
|    }
|}
|
|# ---- VM (files) and Community container (blobs): the same two JSON documents ------------------------------------------
|function New-SIPipelineDocControl {
|    <#
|        The lock + queue as two JSON documents over a document seam -Docs with methods Read($name) (text or $null),
|        Write($name, $text), CreateNew($name, $text) (atomic: $false when it exists), Delete($name). Names: 'pipeline.lock'
|        (the lock: Holder, What, FlowRunId, AcquiredUtc, HeartbeatUtc) and 'pipeline-queue.json' (the queue, oldest first;
|        finished requests are kept for the last 50). The queue is changed under a short mutex document
|        ('pipeline-queue.mutex', stale after 60 s). -Now: the clock (UTC).
|        A file system makes the lock atomic (CreateNew); a blob store is read-check-write -- two runners racing for a
|        STALE lock in the same second could both take it (the container's flow job has one execution at a time by its
|        own guard, so this is the corner it leaves).
|    #>
|    param([Parameter(Mandatory)]$Docs, [scriptblock]$Now = { [datetime]::UtcNow }, [string]$Kind = 'file')
|    New-SIJobFlowSeams -Fields @{ Docs = $Docs; Now = $Now; Kind = $Kind } -Methods @{
|        ReadLock = {
|            $t = $this.Docs.Read('pipeline.lock')
|            if (-not $t) { return $null }
|            try { $o = $t | ConvertFrom-Json } catch { return [pscustomobject]@{ Holder = '?'; What = 'an unreadable lock'; HeartbeatUtc = $null } }
|            $hb = $null; if ($o.HeartbeatUtc) { $hb = [datetime]::Parse([string]$o.HeartbeatUtc, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal) }
|            [pscustomobject]@{ Holder = [string]$o.Holder; What = [string]$o.What; FlowRunId = [string]$o.FlowRunId; HeartbeatUtc = $hb }
|        }
|        LockText = {
|            param($Holder, $What, $FlowRunId)
|            $iso = ([datetime](& $this.Now)).ToUniversalTime().ToString('o', [Globalization.CultureInfo]::InvariantCulture)
|            ConvertTo-Json -InputObject ([ordered]@{ Holder = [string]$Holder; What = [string]$What; FlowRunId = [string]$FlowRunId; HeartbeatUtc = $iso }) -Compress
|        }
|        AcquireLock = {
|            param($Holder, $What, $StaleMinutes)
|            $text = $this.LockText($Holder, $What, '')
|            if ($this.Docs.CreateNew('pipeline.lock', $text)) { return [pscustomobject]@{ Available = $true; Acquired = $true; Holder = $Holder; What = $What; HeartbeatUtc = $null; TookOver = '' } }
|            $cur = $this.ReadLock()
|            $now = ([datetime](& $this.Now)).ToUniversalTime()
|            $stale = (-not $cur) -or (-not $cur.HeartbeatUtc) -or (($now - $cur.HeartbeatUtc).TotalMinutes -ge [int]$StaleMinutes)
|            if ($cur -and [string]$cur.Holder -eq [string]$Holder) { $stale = $true }
|            if (-not $stale) { return [pscustomobject]@{ Available = $true; Acquired = $false; Holder = [string]$cur.Holder; What = [string]$cur.What; HeartbeatUtc = $cur.HeartbeatUtc; TookOver = '' } }
|            $this.Docs.Write('pipeline.lock', $text)
|            $back = $this.ReadLock()
|            $mine = $back -and [string]$back.Holder -eq [string]$Holder
|            $took = if ($mine -and $cur -and [string]$cur.Holder -ne [string]$Holder) { [string]$cur.Holder } else { '' }
|            [pscustomobject]@{ Available = $true; Acquired = [bool]$mine; Holder = $(if ($back) { [string]$back.Holder } else { '' }); What = $(if ($back) { [string]$back.What } else { '' }); HeartbeatUtc = $(if ($back) { $back.HeartbeatUtc } else { $null }); TookOver = $took }
|        }
|        HeartbeatLock = {
|            param($Holder, $FlowRunId, $What)
|            $cur = $this.ReadLock()
|            if (-not $cur -or [string]$cur.Holder -ne [string]$Holder) { return $false }
|            $this.Docs.Write('pipeline.lock', $this.LockText($Holder, $What, $FlowRunId)); $true
|        }
|        ReleaseLock = { param($Holder) $cur = $this.ReadLock(); if ($cur -and [string]$cur.Holder -eq [string]$Holder) { $this.Docs.Delete('pipeline.lock') } }
|        # #700: the lock of ONE run, released at once when that run is cancelled
|        ReleaseLockOfRun = { param($FlowRunId) $cur = $this.ReadLock(); if ($cur -and $FlowRunId -and [string]$cur.FlowRunId -eq [string]$FlowRunId) { $this.Docs.Delete('pipeline.lock'); $true } else { $false } }
|        LockHolder = { $this.ReadLock() }
|        # ---- the queue (under the mutex) ----
|        # -Change { param($Items, $Arg) } changes the list in place and returns the answer. No GetNewClosure: a closure
|        # runs in its own module scope and cannot see the functions a script dot-sourced (see New-SIJobFlowSeams).
|        WithQueue = {
|            param([scriptblock]$Change, $Arg)
|            $got = $false
|            for ($i = 0; $i -lt 50 -and -not $got; $i++) {
|                $got = $this.Docs.CreateNew('pipeline-queue.mutex', ([datetime](& $this.Now)).ToUniversalTime().ToString('o', [Globalization.CultureInfo]::InvariantCulture))
|                if (-not $got) {
|                    $m = $this.Docs.Read('pipeline-queue.mutex'); $mt = $null
|                    try { $mt = [datetime]::Parse([string]$m, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal) } catch { }
|                    if (-not $mt -or (([datetime](& $this.Now)).ToUniversalTime() - $mt).TotalSeconds -gt 60) { $this.Docs.Delete('pipeline-queue.mutex') } else { Start-Sleep -Milliseconds 200 }
|                }
|            }
|            if (-not $got) { throw 'the pipeline queue is held by another process (pipeline-queue.mutex) -- try again' }
|            try {
|                $items = New-Object System.Collections.Generic.List[object]
|                $t = $this.Docs.Read('pipeline-queue.json')
|                if ($t) { $parsed = ConvertFrom-Json -InputObject $t; foreach ($x in @($parsed)) { if ($x) { $items.Add((ConvertFrom-SIPipelineRequestRow $x)) } } }
|                $out = & $Change $items $Arg
|                # keep every open request and the last 50 finished ones
|                $open = @($items | Where-Object { $_.State -in @('Queued', 'Running') })
|                $done = @($items | Where-Object { $_.State -notin @('Queued', 'Running') } | Select-Object -Last 50)
|                $keep = @($items | Where-Object { $open -contains $_ -or $done -contains $_ })
|                $iso = { param($v) if ($null -eq $v) { $null } else { ([datetime]$v).ToUniversalTime().ToString('o', [Globalization.CultureInfo]::InvariantCulture) } }
|                $rows = @($keep | ForEach-Object { [ordered]@{ Id = [long]$_.Id; Scope = $_.Scope; Target = $_.Target; Trg = $_.Trigger; RequestedBy = $_.RequestedBy; RequestedUtc = (& $iso $_.RequestedUtc)
|                                                               SlotUtc = (& $iso $_.SlotUtc); Note = $_.Note; State = $_.State; FlowRunId = $_.FlowRunId; Outcome = $_.Outcome } })
|                $this.Docs.Write('pipeline-queue.json', (ConvertTo-SIPipelineJsonArray -Items $rows))
|                $out
|            } finally { $this.Docs.Delete('pipeline-queue.mutex') }
|        }
|        Enqueue = {
|            param($Request)
|            if (-not $Request.RequestedUtc) { $Request.RequestedUtc = ([datetime](& $this.Now)).ToUniversalTime() }
|            $this.WithQueue({
|                param($items, $req)
|                $key = Get-SIPipelineRequestKey $req
|                $same = @($items | Where-Object { $_.State -eq 'Queued' -and (Get-SIPipelineRequestKey $_) -eq $key })
|                if ($same.Count) {
|                    if (-not $same[0].SlotUtc -and $req.SlotUtc) { $same[0].SlotUtc = $req.SlotUtc }
|                    if (-not $same[0].Note -and $req.Note) { $same[0].Note = $req.Note }
|                    return [pscustomobject]@{ Id = [long]$same[0].Id; Outcome = 'Deduplicated' }
|                }
|                $max = 0; foreach ($x in $items) { if ([long]$x.Id -gt $max) { $max = [long]$x.Id } }
|                $n = ConvertFrom-SIPipelineRequestRow ([pscustomobject]@{ Id = $max + 1; Scope = $req.Scope; Target = $req.Target; Trg = $req.Trigger; RequestedBy = $req.RequestedBy
|                                                                          RequestedUtc = $req.RequestedUtc; SlotUtc = $req.SlotUtc; Note = $req.Note; State = 'Queued' })
|                $items.Add($n)
|                [pscustomobject]@{ Id = [long]$n.Id; Outcome = 'Queued' }
|            }, $Request)
|        }
|        NextQueued = { $t = $this.Docs.Read('pipeline-queue.json'); if (-not $t) { return $null }; $parsed = ConvertFrom-Json -InputObject $t; $q = @(@($parsed) | Where-Object { $_ -and $_.State -eq 'Queued' } | Sort-Object { [long]$_.Id }); if ($q.Count) { ConvertFrom-SIPipelineRequestRow $q[0] } else { $null } }
|        MarkRunning = { param($Id, $FlowRunId) [bool]($this.WithQueue({ param($items, $a) $x = @($items | Where-Object { [long]$_.Id -eq $a.Id -and $_.State -eq 'Queued' }); if ($x.Count) { $x[0].State = 'Running'; $x[0].FlowRunId = $a.Run; $true } else { $false } }, @{ Id = [long]$Id; Run = [string]$FlowRunId })) }
|        MarkDone = { param($Id, $Outcome) $null = $this.WithQueue({ param($items, $a) foreach ($x in @($items | Where-Object { [long]$_.Id -eq $a.Id -and $_.State -in @('Queued', 'Running') })) { $x.State = 'Done'; $x.Outcome = $a.Outcome } }, @{ Id = [long]$Id; Outcome = [string]$Outcome }) }
|        Cancel = { param($Id, $By) [bool]($this.WithQueue({ param($items, $a) $x = @($items | Where-Object { [long]$_.Id -eq $a -and $_.State -eq 'Queued' }); if ($x.Count) { $x[0].State = 'Cancelled'; $true } else { $false } }, [long]$Id)) }
|        List = { $t = $this.Docs.Read('pipeline-queue.json'); if (-not $t) { return @() }; $parsed = ConvertFrom-Json -InputObject $t; @(@($parsed) | Where-Object { $_ -and $_.State -in @('Queued', 'Running') } | Sort-Object { [long]$_.Id } | ForEach-Object { ConvertFrom-SIPipelineRequestRow $_ }) }
|    }
|}
|
|function New-SIPipelineFileDocs {
|    <# The document seam over a folder (a VM: <install>\data\flow). CreateNew is atomic (FileMode.CreateNew). #>
|    param([Parameter(Mandatory)][string]$Folder)
|    New-SIJobFlowSeams -Fields @{ Folder = $Folder } -Methods @{
|        Path = { param($Name) if (-not (Test-Path -LiteralPath $this.Folder)) { New-Item -ItemType Directory -Path $this.Folder -Force | Out-Null }; Join-Path $this.Folder $Name }
|        Read = { param($Name) $p = $this.Path($Name); if (Test-Path -LiteralPath $p) { try { [IO.File]::ReadAllText($p) } catch { $null } } else { $null } }
|        Write = { param($Name, $Text) $p = $this.Path($Name); $tmp = $p + '.' + [guid]::NewGuid().ToString('n') + '.tmp'; [IO.File]::WriteAllText($tmp, [string]$Text, (New-Object System.Text.UTF8Encoding($false))); Move-Item -LiteralPath $tmp -Destination $p -Force }
|        CreateNew = {
|            param($Name, $Text)
|            $p = $this.Path($Name)
|            try {
|                $fs = [IO.File]::Open($p, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None)
|                try { $b = (New-Object System.Text.UTF8Encoding($false)).GetBytes([string]$Text); $fs.Write($b, 0, $b.Length) } finally { $fs.Dispose() }
|                $true
|            } catch { $false }
|        }
|        Delete = { param($Name) $p = $this.Path($Name); if (Test-Path -LiteralPath $p) { Remove-Item -LiteralPath $p -Force -ErrorAction SilentlyContinue } }
|    }
|}
|
|function New-SIPipelineBlobDocs {
|    <# The document seam over the install's storage (a Community container: <account>/sistate/flow/<name>), OAuth as the job. #>
|    param([Parameter(Mandatory)][string]$Account, [string]$Container = 'sistate', [string]$Prefix = 'flow/')
|    New-SIJobFlowSeams -Fields @{ Account = $Account; Container = $Container; Prefix = $Prefix } -Methods @{
|        Read = { param($Name) try { $b = Get-SIBlobContent -Account $this.Account -Container $this.Container -Blob ($this.Prefix + $Name); if (-not $b -or $b.Length -eq 0) { $null } else { [Text.Encoding]::UTF8.GetString($b) } } catch { if ("$($_.Exception.Message)" -match '404|BlobNotFound|ContainerNotFound|not found') { $null } else { throw } } }
|        Write = { param($Name, $Text) $null = Set-SIBlobContent -Account $this.Account -Container $this.Container -Blob ($this.Prefix + $Name) -Bytes ([Text.Encoding]::UTF8.GetBytes([string]$Text)) -ContentType 'application/json' }
|        CreateNew = { param($Name, $Text) if ($this.Read($Name)) { return $false }; $this.Write($Name, $Text); $true }
|        Delete = { param($Name) try { if (Get-Command -Name Remove-SIBlob -ErrorAction SilentlyContinue) { Remove-SIBlob -Account $this.Account -Container $this.Container -Blob ($this.Prefix + $Name) } else { $this.Write($Name, '') } } catch { } }
|    }
|}
|
|function Get-SIPipelineUpdateLiveness {
|    <#
|        PURE. Is the updater updating SecurityInsight now, and which of its executions are DEAD (no fresh beat)?
|        -Executions: the updater job's executions as ARM lists them (name, properties.status, properties.startTime).
|        -Locks / -LocksKnown: the lock rows (SI-ExecutionLiveness.ps1 Read-SIExecutionLocks). NO FRESH BEAT = DEAD: a Running /
|        Processing execution counts only while it beats the install lock (Holder caj-si-updater:<execution>, from its run gate)
|        or its own 'updater' row (from its first moment after the sign-in); one that never beat counts for 30 minutes after
|        its start, one that beat until 15 minutes after its last beat. Without readable lock rows (-LocksKnown $false) the old
|        rule holds: every Running one counts. The fixed outer fallback stays: an execution older than -MaxHours never counts
|        (a dead one is stopped too). -Stopped: names this process stopped already (left out). -Processes (VM): command lines
|        of the running PowerShell processes; one that runs Update-SecurityInsight.ps1 counts.
|        Returns @{ Running = why ('' = no update runs); Dead = @(liveness of the dead ones) }.
|    #>
|    param([AllowEmptyCollection()][object[]]$Executions = @(), [AllowEmptyCollection()][string[]]$Processes = @(), [datetime]$NowUtc = [datetime]::UtcNow, [int]$MaxHours = 6,
|          [AllowEmptyCollection()][object[]]$Locks = @(), [bool]$LocksKnown = $false, [System.Collections.IDictionary]$Stopped)
|    $why = ''
|    $sel = Select-SIExecutionLiveness -Executions $Executions -Kind updater -Locks $Locks -LocksKnown $LocksKnown -NowUtc $NowUtc -Stopped $Stopped
|    foreach ($lv in @($sel.Live | Sort-Object { if ($_.StartedUtc) { $_.StartedUtc } else { [datetime]::MinValue } })) {
|        if ($lv.StartedUtc -and ($NowUtc.ToUniversalTime() - $lv.StartedUtc).TotalHours -gt $MaxHours) { continue }
|        $why = ('caj-si-updater execution {0}{1}' -f $lv.Name, $(if ($lv.StartedUtc) { (', started {0:u}' -f $lv.StartedUtc) } else { '' }))
|        break
|    }
|    if (-not $why) {
|        foreach ($c in @($Processes | Where-Object { $_ })) {
|            if ([string]$c -match '(?i)Update-SecurityInsight\.ps1') { $why = 'Update-SecurityInsight.ps1 is running on this machine'; break }
|        }
|    }
|    [pscustomobject]@{ Running = $why; Dead = @($sel.Dead) }
|}
|
|function Get-SIPipelineUpdateRunning {
|    <#
|        PURE. Why the pipeline must not start now because the updater is updating SecurityInsight -- '' when it is not
|        (Get-SIPipelineUpdateLiveness .Running, the same parameters; without lock rows: every Running execution younger
|        than -MaxHours counts, as before).
|    #>
|    param([AllowEmptyCollection()][object[]]$Executions = @(), [AllowEmptyCollection()][string[]]$Processes = @(), [datetime]$NowUtc = [datetime]::UtcNow, [int]$MaxHours = 6,
|          [AllowEmptyCollection()][object[]]$Locks = @(), [bool]$LocksKnown = $false)
|    [string](Get-SIPipelineUpdateLiveness -Executions $Executions -Processes $Processes -NowUtc $NowUtc -MaxHours $MaxHours -Locks $Locks -LocksKnown $LocksKnown).Running
|}
|
|function ConvertFrom-SIPipelineUpdateWaitsTag {
|    <#
|        PURE. 2026-10-23: the updater's wait mark (tag si-update-waits on the updater job, written by its run gate --
|        container/updater/_shared/SI-UpdaterRunGate.ps1 ConvertTo-SIUpdateWaitsTag): '<sinceUtc>|<setUtc>|<run|store>|<reason>'
|        -> @{ SinceUtc; SetUtc; Kind; Reason }, or $null (none / not that shape).
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    if (-not "$Value".Trim()) { return $null }
|    $p = "$Value".Split('|', 4)
|    if ($p.Count -lt 3 -or $p[2] -notin @('run', 'store')) { return $null }
|    $t = { param($s) $d = [datetime]::MinValue; if ([datetime]::TryParse($s, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal, [ref]$d)) { $d } else { $null } }
|    $since = & $t $p[0]; $set = & $t $p[1]
|    if (-not $since -or -not $set) { return $null }
|    [pscustomobject]@{ SinceUtc = $since; SetUtc = $set; Kind = $p[2]; Reason = $(if ($p.Count -ge 4) { $p[3] } else { '' }) }
|}
|
|function Get-SIPipelineUpdateStart {
|    <#
|        PURE. 2026-10-23: may the runner start the updater for this wait mark (-Waits)? Once per mark: an execution of the
|        updater that started at or after the mark was last written (SetUtc) has run for it already -- running: not again;
|        ended (and the mark is still there): not again, said (the queue then runs -- never a block). -Executions: the
|        updater job's executions (ARM shape). Returns @{ Start; Running (an execution for it runs now: hold, start nothing); Text }.
|    #>
|    param([Parameter(Mandatory)]$Waits, [AllowEmptyCollection()][object[]]$Executions = @())
|    $set = ([datetime]$Waits.SetUtc).ToUniversalTime()
|    foreach ($e in @($Executions | Where-Object { $_ })) {
|        $p = if ($e.PSObject.Properties['properties']) { $e.properties } else { $e }
|        $t = $null
|        if ($p.PSObject.Properties['startTime'] -and "$($p.startTime)".Trim()) { try { $t = ([datetime]$p.startTime).ToUniversalTime() } catch { $t = $null } }
|        if (-not $t -or $t -lt $set) { continue }
|        $st = [string]$p.status
|        if ($st -in @('Running', 'Processing') -and -not ($p.PSObject.Properties['endTime'] -and "$($p.endTime)".Trim())) {
|            return [pscustomobject]@{ Start = $false; Running = $true; Text = ('the updater is already running for it ({0})' -f [string]$e.name) }
|        }
|        return [pscustomobject]@{ Start = $false; Running = $false; Text = ('the updater ran for it ({0}, {1}) and left it -- its log says why' -f [string]$e.name, $(if ($st) { $st.ToLowerInvariant() } else { 'ended' })) }
|    }
|    [pscustomobject]@{ Start = $true; Running = $false; Text = '' }
|}
|
|function Get-SIPipelineEndOfRunUpdateFirst {
|    <#
|        PURE. #1129 (live 2026-11-05, ring 0: an update that waited for a run was held 21 minutes after the run's last step by
|        the end-of-run work -- 640 s of statistics refresh before the publish, the publish, the refresh again). When an update
|        waits for THIS run (the updater's wait mark, kind 'run'), the end-of-run work that is maintenance only -- the
|        statistics refresh, which since 2026-11-05 runs only after the publish -- is left to the next run's end, so the update lands as soon as the run is published; the
|        publish itself (data) always runs. -Waits: the mark (ConvertFrom-SIPipelineUpdateWaitsTag) or $null. Returns the
|        line to say, or '' (nothing waits / a 'store' mark: the refresh runs as always).
|    #>
|    param($Waits)
|    if (-not $Waits -or [string]$Waits.Kind -ne 'run') { return '' }
|    $since = if ($Waits.SinceUtc) { (' (since {0:yyyy-MM-dd HH:mm}Z)' -f ([datetime]$Waits.SinceUtc).ToUniversalTime()) } else { '' }
|    ('an update of SecurityInsight waits for this run{0} -- the statistics refresh is left to the next run''s end, so the update is installed as soon as the run is published (the pages are not affected: only their speed)' -f $since)
|}
|
|function New-SIPipelineLockBeat {
|    <#
|        #1129 (live 2026-11-05, ring 0): the beat of the install's lock while the runner works on a run that has ENDED (the
|        statistics refresh, the publish, the second statistics refresh). Returns a script block that renews the lock
|        (-Control .HeartbeatLock with -Holder / -FlowRunId / -What) and answers whether it is still held.
|        WHY A FUNCTION: the runner built this beat as `{ $control.HeartbeatLock($lockHolder, ...) }.GetNewClosure()` inside
|        its run block. A GetNewClosure() block keeps only the variables of the scope it is made in; the runner's $control and
|        $lockHolder live in the runner script's own scope, and in the container the runner is started by the entry script
|        (`& $script`), so the closure saw $null -- every beat threw "You cannot call a method on a null-valued expression",
|        which the callers swallow. Live: the lock kept its 20:14:03Z heartbeat through 14+ minutes of statistics refresh and
|        publish, and would have lapsed (15 minutes) under a runner still publishing. Here every value is a parameter of this
|        function, so the closure always holds them. A failing beat is said ONCE per beat (-Log), never thrown.
|    #>
|    param([Parameter(Mandatory)]$Control, [Parameter(Mandatory)][string]$Holder, [string]$FlowRunId = '', [string]$What = '', [scriptblock]$Log)
|    $beatState = @{ Said = $false }
|    {
|        try { [bool]$Control.HeartbeatLock($Holder, $FlowRunId, $What) }
|        catch {
|            if (-not $beatState.Said -and $Log) { $beatState.Said = $true; try { & $Log 'WARN' ('the install''s lock could not be renewed ({0}) -- the work goes on; the lock lapses 15 minutes after its last renewal' -f $_.Exception.Message) } catch { } }
|            $false
|        }
|    }.GetNewClosure()
|}
|
|# =====================================================================================================================
|#  #700: cancel the RUNNING pipeline run (owner 2026-10-15: "why not kill it" / "dont let it finish if it runs wrong release")
|# =====================================================================================================================
|function Get-SIPipelineCancelText {
|    <# PURE. The run's stop reason once it is cancelled: "cancelled by <who>: <why>" (at most 1000 characters, its column). #>
|    param([AllowEmptyString()][string]$By, [AllowEmptyString()][string]$Reason)
|    $who = if ("$By".Trim()) { "$By".Trim() } else { 'someone' }
|    $t = if ("$Reason".Trim()) { 'cancelled by {0}: {1}' -f $who, "$Reason".Trim() } else { 'cancelled by {0}' -f $who }
|    if ($t.Length -gt 1000) { $t = $t.Substring(0, 1000) }
|    $t
|}
|
|function Set-SIPipelineRunCancelled {
|    <#
|        #700. Marks the run record -State CANCELLED, in place: State Cancelled (a finished state -- never resumed), the stop
|        reason "cancelled by <who>: <why>", CancelledBy, the end. A step still starting or running is asked to stop (-Stop
|        { param($Job, $Execution) }: the job execution over ARM / the process on a VM) and is recorded Interrupted (class
|        'cancelled'); a waiting step is Skipped (class 'cancelled'). A stop that fails is said and does not stop the cancel.
|        #882: -StopWorkers { param($Job, $SinceUtc, $Execution) } -- the workers of such a step (a collection in parts, the
|        Risk Analysis queue workers, their runs closed first) are stopped too: a cancelled step leaves nothing running.
|        Returns @{ Text; Stopped (the executions asked to stop); StopFailed (job: why) }.
|    #>
|    param([Parameter(Mandatory)]$State, [AllowEmptyString()][string]$By = '', [AllowEmptyString()][string]$Reason = '', [datetime]$NowUtc = [datetime]::UtcNow, [scriptblock]$Stop,
|          [scriptblock]$StopWorkers)
|    $now = $NowUtc.ToUniversalTime()
|    $why = Get-SIPipelineCancelText -By $By -Reason $Reason
|    $stopped = New-Object System.Collections.Generic.List[object]
|    $failed = New-Object System.Collections.Generic.List[string]
|    foreach ($st in @($State.Steps)) {
|        if ($null -eq $st) { continue }
|        if ([string]$st.State -in @('Starting', 'Running')) {
|            if ($Stop -and [string]$st.Execution) {
|                try { $null = & $Stop ([string]$st.Job) ([string]$st.Execution); $stopped.Add([pscustomobject]@{ Job = [string]$st.Job; Execution = [string]$st.Execution }) }
|                catch { $failed.Add(('{0}: {1}' -f $st.Job, $_.Exception.Message)) }
|            }
|            if ($StopWorkers) {
|                $wSince = if ($st.StartedUtc) { ([datetime]$st.StartedUtc).ToUniversalTime() } else { $null }
|                try { $null = & $StopWorkers ([string]$st.Job) $wSince ([string]$st.Execution) } catch { $failed.Add(('{0} (its workers): {1}' -f $st.Job, $_.Exception.Message)) }
|            }
|            $st.State = 'Interrupted'; $st.ErrorClass = 'cancelled'; $st.EndedUtc = $now
|            $st.Error = ('stopped: the run was {0}' -f $why)
|        } elseif ([string]$st.State -eq 'Waiting') {
|            $st.State = 'Skipped'; $st.ErrorClass = 'cancelled'
|            $st.Error = ('not run: the run was {0}' -f $why)
|        }
|        if ($st.Error -and ([string]$st.Error).Length -gt 1000) { $st.Error = ([string]$st.Error).Substring(0, 1000) }
|    }
|    $State.State = 'Cancelled'; $State.StopReason = $why; $State.EndedUtc = $now
|    if ($State.PSObject.Properties['CancelledBy']) { $State.CancelledBy = [string]$By } else { $State | Add-Member -NotePropertyName CancelledBy -NotePropertyValue ([string]$By) }
|    $text = 'pipeline run {0} {1}; {2} job execution(s) asked to stop{3}' -f $State.FlowRunId, $why, $stopped.Count, $(if ($failed.Count) { ('; could not be stopped: {0}' -f ($failed -join '; ')) } else { '' })
|    [pscustomobject]@{ Text = $text; Stopped = $stopped.ToArray(); StopFailed = $failed.ToArray() }
|}
|
|function Invoke-SIPipelineCancelRun {
|    <#
|        #700 -- THE ONE WAY a running pipeline run is cancelled (Operations > Jobs, a support start of the runner with
|        SI_FLOW_CANCEL=1, the updater). In this order, so nothing can bring the run back half-way:
|          0. the RUNNER that holds the install's lock for this run (another execution of the pipeline job, or a runner
|             process on a VM) is stopped first (-StopRunner { param($Holder) }; -Self = this process's own holder, never
|             stopped): a runner of an older version does not know a cancelled run and would save it back and start the
|             next step;
|          1. the run record is marked CANCELLED (a finished state: the scheduler never resumes it; a runner that is still
|             alive sees it at its next poll and starts nothing more), with who and why;
|          2. its running job executions are asked to stop (-Stop; -StopWorkers { param($Job, $SinceUtc) } for the workers
|             of a collection in parts);
|          3. its queue request ends (Outcome Cancelled), and the install's lock is released AT ONCE (only when it is held
|             for this run) -- the next queued request starts on the next wake-up;
|          4. the run is read back: a runner that saved it back in the meantime is overruled (marked cancelled again);
|          5. -Audit { param($Result) } writes the audit record (who, why, what was stopped).
|        A run already cancelled (the web app marks it, releases the lock and then starts the runner with the holder it
|        released, SI_FLOW_CANCEL_RUNNER, to stop the executions) gets steps 0 and 2-5: who and why of that cancel are kept. -FlowRunId: only this run ('' = the last run, when it has not ended). -OtherVersionThan (the updater): only
|        a run that STARTED on another version (or on a version that did not record it) is cancelled.
|        Returns @{ Outcome = Cancelled | NothingRunning | SameVersion | NotThatRun; FlowRunId; Version; Stopped; StopFailed;
|        LockReleased; Text } -- Text is the one plain line to say.
|    #>
|    param(
|        [Parameter(Mandatory)]$Store,
|        [Parameter(Mandatory)]$Control,
|        [scriptblock]$Stop,
|        [scriptblock]$StopWorkers,
|        [scriptblock]$StopRunner,
|        [string]$Self = '',
|        [string]$RunnerHolder = '',
|        [AllowEmptyString()][string]$By = '',
|        [AllowEmptyString()][string]$Reason = '',
|        [string]$FlowRunId = '',
|        # untyped on purpose: a [string] parameter turns $null into '' -- and "not given" must stay "not given"
|        [AllowNull()]$OtherVersionThan = $null,
|        [scriptblock]$Audit,
|        [scriptblock]$Now = { [datetime]::UtcNow },
|        [scriptblock]$Log = { param($Level, $Message) Write-Host ('[pipeline] {0}' -f $Message) }
|    )
|    $mk = { param($o, $id, $ver, $text, $stp, $sf, $lr) [pscustomobject]@{ Outcome = $o; FlowRunId = [string]$id; Version = [string]$ver; Stopped = @($stp); StopFailed = @($sf); LockReleased = [bool]$lr; Text = $text } }
|    $run = $Store.Load()
|    if (-not $run) { return (& $mk 'NothingRunning' '' '' 'no pipeline run is going -- nothing to cancel' @() @() $false) }
|    if ($FlowRunId -and [string]$run.FlowRunId -ne $FlowRunId) { return (& $mk 'NotThatRun' $run.FlowRunId '' ('pipeline run {0} is not the last run any more -- nothing cancelled' -f $FlowRunId) @() @() $false) }
|    $ver = if ($run.PSObject.Properties['Version']) { [string]$run.Version } else { '' }
|    $already = [string]$run.State -eq 'Cancelled'
|    $live = @(@($run.Steps) | Where-Object { $_ -and [string]$_.State -in @('Starting', 'Running') })
|    if (-not $already -and [string]$run.State -in $script:SIPipeline.RunFinished) { return (& $mk 'NothingRunning' $run.FlowRunId $ver ('no pipeline run is going (the last one, {0}, has {1}) -- nothing to cancel' -f $run.FlowRunId, ([string]$run.State).ToLowerInvariant()) @() @() $false) }
|    # the updater: a run already cancelled by somebody else is left to that cancel
|    $byVersion = $null -ne $OtherVersionThan -and "$OtherVersionThan".Trim() -ne ''
|    if ($byVersion) { $OtherVersionThan = "$OtherVersionThan".Trim() }
|    if ($byVersion -and $already) { return (& $mk 'NothingRunning' $run.FlowRunId $ver ('no pipeline run is going (the last one, {0}, is cancelled) -- nothing to cancel' -f $run.FlowRunId) @() @() $false) }
|    # a store that cannot keep the version (a Pro database whose schema was not applied again) tells nothing: left alone
|    if ($byVersion -and $run.PSObject.Properties['VersionRecorded'] -and -not $run.VersionRecorded) {
|        return (& $mk 'SameVersion' $run.FlowRunId '' ('the version pipeline run {0} started on is not recorded (apply the Pro database schema again) -- it goes on' -f $run.FlowRunId) @() @() $false)
|    }
|    if ($byVersion -and -not $already -and $ver -and $ver -eq $OtherVersionThan) {
|        return (& $mk 'SameVersion' $run.FlowRunId $ver ('the pipeline run that is going ({0}) started on this version ({1}) -- it goes on' -f $run.FlowRunId, $ver) @() @() $false)
|    }
|    $nowU = ([datetime](& $Now)).ToUniversalTime()
|    $useBy = $By; $useWhy = $Reason
|    if ($already) {
|        # keep who and why of the cancel that was made first
|        if ($run.PSObject.Properties['CancelledBy'] -and [string]$run.CancelledBy) { $useBy = [string]$run.CancelledBy }
|        $useWhy = ''
|    }
|    $stopped = New-Object System.Collections.Generic.List[object]; $sf = New-Object System.Collections.Generic.List[string]
|    # 0. the runner that holds the lock for this run -- it starts nothing more and saves nothing back. -RunnerHolder: the
|    # holder the caller saw (the web app releases the lock at once and names the holder it released)
|    $runner = [string]$RunnerHolder
|    if (-not $runner) {
|        $holder = $null; try { $holder = $Control.LockHolder() } catch { $holder = $null }
|        if ($holder -and [string]$holder.Holder -and [string]$holder.FlowRunId -eq [string]$run.FlowRunId) { $runner = [string]$holder.Holder }
|    }
|    if ($StopRunner -and $runner -and $runner -ne $Self) {
|        try { $null = & $StopRunner $runner; $stopped.Add([pscustomobject]@{ Job = 'the pipeline runner'; Execution = $runner }) }
|        catch { $sf.Add(('the pipeline runner {0}: {1}' -f $runner, $_.Exception.Message)) }
|    }
|    # 1. CANCELLED first -- before any step is stopped, so a stopped execution can never read as "resume me"
|    $sinceOf = @{}; foreach ($st in $live) { $sinceOf[[string]$st.Job] = $st.StartedUtc }
|    if (-not $already) {
|        # the steps are marked here without stopping them: the stop follows (step 2), from the list of what was running
|        $null = Set-SIPipelineRunCancelled -State $run -By $useBy -Reason $useWhy -NowUtc $nowU
|        $Store.Save($run)
|    }
|    # 2. stop what still runs
|    foreach ($st in $live) {
|        if ($Stop -and [string]$st.Execution) {
|            try { $null = & $Stop ([string]$st.Job) ([string]$st.Execution); $stopped.Add([pscustomobject]@{ Job = [string]$st.Job; Execution = [string]$st.Execution }) }
|            catch { $sf.Add(('{0}: {1}' -f $st.Job, $_.Exception.Message)) }
|        }
|        if ($StopWorkers) { try { $null = & $StopWorkers ([string]$st.Job) $sinceOf[[string]$st.Job] ([string]$st.Execution) } catch { $sf.Add(('{0} (its workers): {1}' -f $st.Job, $_.Exception.Message)) } }
|        if ([string]$st.State -in @('Starting', 'Running')) {
|            $st.State = 'Interrupted'; $st.ErrorClass = 'cancelled'; $st.EndedUtc = $nowU
|            $st.Error = ('stopped: the run was {0}' -f $(if ($already) { [string]$run.StopReason } else { Get-SIPipelineCancelText -By $useBy -Reason $useWhy }))
|        }
|    }
|    if ($already) { foreach ($st in @($run.Steps | Where-Object { $_ -and [string]$_.State -eq 'Waiting' })) { $st.State = 'Skipped'; $st.ErrorClass = 'cancelled'; $st.Error = ('not run: the run was {0}' -f $run.StopReason) } }
|    try { $Store.Save($run) } catch { & $Log 'WARN' ('the cancelled run''s steps could not be saved ({0}) -- the run itself is cancelled' -f $_.Exception.Message) }
|    # 3. its queue request, and the lock -- at once
|    try { foreach ($x in @($Control.List() | Where-Object { $_ -and [string]$_.State -eq 'Running' -and [string]$_.FlowRunId -eq [string]$run.FlowRunId })) { $Control.MarkDone($x.Id, 'Cancelled') } } catch { & $Log 'WARN' ('the queue request of the cancelled run could not be closed ({0})' -f $_.Exception.Message) }
|    $lr = $false
|    try { $lr = [bool]$Control.ReleaseLockOfRun([string]$run.FlowRunId) } catch { & $Log 'WARN' ('the pipeline lock could not be released ({0}) -- it frees itself when its heartbeat is {1} minutes old' -f $_.Exception.Message, $script:SIPipeline.LockStaleMinutes) }
|    # 4. read back: a runner that was saving while it was stopped is overruled
|    try {
|        $back = $Store.Load()
|        if ($back -and [string]$back.FlowRunId -eq [string]$run.FlowRunId -and [string]$back.State -ne 'Cancelled') {
|            $null = Set-SIPipelineRunCancelled -State $back -By $(if ($run.PSObject.Properties['CancelledBy']) { [string]$run.CancelledBy } else { $useBy }) -Reason '' -NowUtc $nowU
|            $back.StopReason = [string]$run.StopReason
|            $Store.Save($back)
|            & $Log 'WARN' ('pipeline run {0} had been saved back by its runner -- it is marked cancelled again' -f $run.FlowRunId)
|        }
|    } catch { & $Log 'WARN' ('the cancelled run could not be read back ({0})' -f $_.Exception.Message) }
|    $text ='pipeline run {0} {1}; {2} job execution(s) asked to stop{3}; the next run starts on the next wake-up of the pipeline' -f $run.FlowRunId, [string]$run.StopReason, $stopped.Count, $(if ($sf.Count) { ('; could not be stopped: {0}' -f ($sf -join '; ')) } else { '' })
|    $res = & $mk 'Cancelled' $run.FlowRunId $ver $text $stopped.ToArray() $sf.ToArray() $lr
|    if ($Audit) { try { $null = & $Audit $res } catch { & $Log 'WARN' ('the cancel could not be put on the audit trail ({0})' -f $_.Exception.Message) } }
|    $res
|}
|
|# =====================================================================================================================
|#  The drain: what one wake-up of the runner does
|# =====================================================================================================================
|function Test-SIPipelineCodeCurrent {
|    <# PURE. Is the code this runner started with still the installed code? -StartImage: the flow job's image when this
|       execution started; -NowImage: its image now ('' = could not be read). Unknown is current: a check that cannot read
|       never ends a runner's work. #>
|    param([AllowEmptyString()][string]$StartImage, [AllowEmptyString()][string]$NowImage)
|    if (-not "$StartImage".Trim() -or -not "$NowImage".Trim()) { return $true }
|    [string]::Equals("$StartImage".Trim(), "$NowImage".Trim(), [System.StringComparison]::OrdinalIgnoreCase)
|}
|
|function Invoke-SIPipelineDrain {
|    <#
|        One wake-up (the 5-minute timer of caj-si-flow / the VM task, or a "Run now"):
|          1. -Request (a Run now) is put in the queue (kept once when the same request already waits);
|          2. the schedule (pipeline mode 'flow' only): a pipeline run that is due is queued (a slot passed while another
|             run held the install is queued too -- it runs once, when the lock is free);
|          2b. an UPDATE of SecurityInsight is running (-UpdateRunning returns why): nothing starts -- what was queued
|             stays queued and runs on a later wake-up, once the update has finished (Outcome Busy). THE ORDER (owner
|             2026-10-23: "Should the rolls skip installs that are mid-run (large installs pick up the new build at their
|             next run)?" -> "yes to both"; this REPLACES the rule of 2026-10-12 that the updater installs at once while an
|             SI job runs): the updater never installs while a pipeline run is going -- its run gate reads this install's
|             run records and takes this same lock (container/updater/_shared/SI-UpdaterRunGate.ps1) -- and the pipeline
|             never starts while an update runs (it does not wait inside the run -- it ends this wake-up and the 5-minute
|             wake-up tries again; a due slot stays due);
|          3. the install's ONE lock is taken -- busy: nothing more happens (the queue waits; exit quietly);
|          4. holding the lock: an unfinished run whose runner died is resumed first (an update that waits for it never
|             holds that back -- the run must end for the update to land);
|          4c. AN UPDATE WAITS FOR THE PIPELINE (-UpdateWaits returns the updater's wait mark, tag si-update-waits): the
|             runner starts NO new run -- it starts the updater (-StartUpdate) and ends this wake-up; what waits in the queue
|             stays queued and starts on a later wake-up, on the new build. Asked before the queue, and again before each
|             further queued run. A wait of kind 'store' (the updater could not read the state store) starts the updater
|             but holds no run back. NEVER A BLOCK: -StartUpdate answering that the updater already ran for this mark and
|             ended without taking it away (or that it could not be started) is said, and the queue runs. #1129: the
|             install's lock is released BEFORE the updater is started (-StartUpdate { param($Waits, $BeforeStart) } calls
|             $BeforeStart right before its start), so the update's run gate finds the install free and installs instead of
|             deferring on this runner's lock; a start that fails after that release ends the wake-up (the next one runs the queue);
|          then the queued requests run one after the other, oldest first, until the queue is empty; the lock is beaten
|             on every save;
|          5. the lock is released.
|        Seams: -Control (New-SIPipelineSqlControl / -DocControl), -LoadLast { } (the last run record), -RunOne { param($Request,
|        $Previous, $FlowRunId) } (one run -> its final record; $Request $null = resume), -UpdateRunning { } ('' = no update
|        runs, else why; a failing check never stops the pipeline), -CodeCurrent { } ($false once an update has replaced the
|        code this runner runs; a failing check counts as current), -UpdateWaits { } ($null = no update waits, else
|        @{ Kind run | store; SinceUtc; SetUtc; Reason }; a failing check holds nothing back), -StartUpdate { param($Waits, $BeforeStart) }
|        (@{ Started; Text }), -Now, -Log.
|        A RUNNER NEVER STARTS A NEW RUN ON REPLACED CODE: one execution drains the queue, and a long run outlives an update
|        (the update never stops a running pipeline; since 2026-10-23 it waits for it). Before it takes ANOTHER request after a run it did, it asks -CodeCurrent;
|        replaced = it ends here and the next wake-up -- a new execution, on the installed version -- takes the queue (live
|        2026-10-19: the run queued after the rc11 roll-out was run by a runner of 10-15, whose counts, causes and versions it
|        reported for the new release).
|        Returns @{ Outcome = Busy | Idle | Ran | Blocked; Runs; Lock; Queued (what was put in the queue); UpdateStarted }.
|    #>
|    param(
|        [Parameter(Mandatory)]$Definition,
|        [Parameter(Mandatory)]$Control,
|        [Parameter(Mandatory)][scriptblock]$LoadLast,
|        [Parameter(Mandatory)][scriptblock]$RunOne,
|        $Request,
|        [scriptblock]$UpdateRunning,
|        [scriptblock]$CodeCurrent,
|        # 2026-10-23: the updater waits for the pipeline (its wait mark) / start it (step 4c)
|        [scriptblock]$UpdateWaits,
|        [scriptblock]$StartUpdate,
|        # live 2026-10-19: { param($Run) } -- the last run is CANCELLED (final): its steps still open are stopped and closed
|        # (Close-SIJobFlowCancelledRun); a failing close never stops the wake-up
|        [scriptblock]$CloseCancelled,
|        [string]$Holder =('{0}:{1}:{2}' -f $env:COMPUTERNAME, $PID, ([guid]::NewGuid().ToString('n').Substring(0, 8))),
|        [scriptblock]$Now = { [datetime]::UtcNow },
|        [scriptblock]$Log = { param($Level, $Message) Write-Host ('[pipeline] {0}' -f $Message) },
|        [int]$StaleAfterMinutes = $script:SIPipeline.LockStaleMinutes,
|        [int]$MaxRuns = 50
|    )
|    $queued = New-Object System.Collections.Generic.List[object]
|    $runs = New-Object System.Collections.Generic.List[object]
|    # 1. the Run now request
|    if ($Request) {
|        $why = Test-SIPipelineRequest -Request $Request -Definition $Definition
|        if ($why) { throw $why }
|        $q = $Control.Enqueue($Request)
|        $Request.Id = [long]$q.Id
|        $queued.Add($Request)
|        $said = switch ($q.Outcome) {
|            'Deduplicated' { 'already waiting in the queue -- kept once' }
|            'Missing' { 'runs now if nothing else runs (the Pro database has no pipeline queue yet -- apply the Pro database schema again, it only adds)' }
|            default { 'queued' }
|        }
|        & $Log $(if ($q.Outcome -eq 'Missing') { 'WARN' } else { 'INFO' }) ('{0}: {1}{2}' -f (Get-SIPipelineRequestText $Request), $said, $(if ($Request.RequestedBy) { (' (by {0})' -f $Request.RequestedBy) } else { '' }))
|    }
|    # 2. the schedule
|    $prev = & $LoadLast
|    $t0 = ([datetime](& $Now)).ToUniversalTime()
|    if ([string]$Definition.Mode -ne 'schedules') {
|        $due = Get-SIJobFlowDue -Definition $Definition -Previous $prev -NowUtc $t0 -StaleAfterMinutes $StaleAfterMinutes
|        $sched = $null
|        if ($due.Action -eq 'Start') { $sched = New-SIPipelineRequest -Scope pipeline -Trigger $(if ($due.Trigger) { $due.Trigger } else { 'schedule' }) -SlotUtc $due.SlotUtc -Note ([string]$due.Note) -RequestedUtc $t0 }
|        elseif ($due.Action -eq 'Busy') {
|            $pend = Get-SIPipelinePendingSlot -Definition $Definition -Previous $prev -NowUtc $t0
|            if ($pend) { $sched = New-SIPipelineRequest -Scope pipeline -Trigger 'catch-up' -SlotUtc $pend.SlotUtc -Note $pend.Note -RequestedUtc $t0 }
|        }
|        if ($sched) {
|            $q = $Control.Enqueue($sched)
|            if ($q.Outcome -ne 'Missing') { $sched.Id = [long]$q.Id; $queued.Add($sched); if ($q.Outcome -eq 'Queued') { & $Log 'INFO' ('the scheduled run is due ({0}) -- queued' -f $(if ($sched.SlotUtc) { '{0:u}' -f $sched.SlotUtc } else { $sched.Trigger })) } }
|            else {
|                # an older Pro database (no queue table): the schedule runs directly when nothing else runs (SCHED-1.1, before #306)
|                if ($due.Action -eq 'Start') { $queued.Add($sched) }
|            }
|        }
|    }
|    # 2b. an update of SecurityInsight is running: nothing starts under it (the queue keeps what waits)
|    if ($UpdateRunning) {
|        $upd = ''
|        try { $upd = [string](& $UpdateRunning) } catch { & $Log 'WARN' ('whether an update is running could not be checked ({0}) -- the pipeline runs' -f $_.Exception.Message) }
|        if ($upd) {
|            $waiting = @(try { $Control.List() } catch { @() })
|            & $Log 'INFO' ('an update of SecurityInsight is running ({0}) -- nothing starts until it has finished; {1} request(s) wait in the queue' -f $upd, @($waiting | Where-Object { $_.State -eq 'Queued' }).Count)
|            return [pscustomobject]@{ Outcome = 'Busy'; Runs = @(); Lock = [pscustomobject]@{ Acquired = $false; What = ('an update of SecurityInsight ({0})' -f $upd); HeartbeatUtc = $null; TookOver = '' }; Queued = $queued.ToArray() }
|        }
|    }
|    # 3. the lock
|    $lock = $Control.AcquireLock($Holder, 'pipeline runner', $StaleAfterMinutes)
|    if (-not $lock.Acquired) {
|        $waiting = @(try { $Control.List() } catch { @() })
|        & $Log 'INFO' ('the install is busy ({0}{1}) -- {2} request(s) wait in the queue and run when it is free' -f $lock.What, $(if ($lock.HeartbeatUtc) { (', alive {0:u}' -f $lock.HeartbeatUtc) } else { '' }), @($waiting | Where-Object { $_.State -eq 'Queued' }).Count)
|        return [pscustomobject]@{ Outcome = 'Busy'; Runs = @(); Lock = $lock; Queued = $queued.ToArray() }
|    }
|    if ($lock.TookOver) { & $Log 'WARN' ('took over the pipeline lock of {0}: its heartbeat is older than {1} minutes (its runner stopped)' -f $lock.TookOver, $StaleAfterMinutes) }
|    $outcome = 'Idle'
|    try {
|        # 4a. an unfinished run (its runner died): resume it before anything else
|        $prev = & $LoadLast
|        $open = @(try { $Control.List() } catch { @() })
|        # live 2026-10-19 (ring 2): a CANCELLED run is final -- what a runner that never saw the cancel left running (or
|        # started again) is stopped by the runner that holds the lock now, and the run is ended Cancelled again when it was
|        # written back to Running (its CancelledBy kept: the store loads it Cancelled)
|        if ($prev -and [string]$prev.State -eq 'Cancelled' -and $CloseCancelled) {
|            $closed = $null
|            try { $closed = & $CloseCancelled $prev } catch { & $Log 'WARN' ('the cancelled run {0} could not be closed ({1}) -- the next wake-up tries again' -f $prev.FlowRunId, $_.Exception.Message) }
|            # it had been written back to Running: a runner that never saw the cancel is (or was until now) alive -- this
|            # wake-up starts nothing beside it; what waits in the queue starts on the next one
|            if ($closed -and $closed.PSObject.Properties['Revived'] -and [bool]$closed.Revived) {
|                & $Log 'WARN' ('run {0} was cancelled and then written back to Running by a runner that did not see the cancel -- it is ended Cancelled again; what waits in the queue starts on the next wake-up' -f $prev.FlowRunId)
|                return [pscustomobject]@{ Outcome = 'Idle'; Runs = @(); Lock = $lock; Queued = $queued.ToArray() }
|            }
|        }
|        # #700: a CANCELLED run is finished -- it is never resumed
|        if ($prev -and [string]$prev.State -notin $script:SIPipeline.RunFinished) {
|            $null = $Control.HeartbeatLock($Holder, [string]$prev.FlowRunId, 'resuming a run')
|            $r = & $RunOne $null $prev ([string]$prev.FlowRunId)
|            if ($r) { $runs.Add($r) }
|            if ($r -and [string]$r.Outcome -eq 'Busy') {
|                & $Log 'INFO' ('run {0} is still beating -- nothing else starts until it ends' -f $prev.FlowRunId)
|                return [pscustomobject]@{ Outcome = 'Blocked'; Runs = $runs.ToArray(); Lock = $lock; Queued = $queued.ToArray() }
|            }
|            $outcome = 'Ran'
|            foreach ($x in @($open | Where-Object { $_.State -eq 'Running' -and [string]$_.FlowRunId -eq [string]$prev.FlowRunId })) { $Control.MarkDone($x.Id, $(if ($r) { [string]$r.State } else { 'Interrupted' })) }
|            $prev = & $LoadLast
|            # #700: the resumed run was cancelled meanwhile: the lock was released by the cancel, so this runner starts
|            # nothing more -- what waits in the queue starts on the next wake-up (never two runners side by side)
|            if ($r -and [string]$r.State -eq 'Cancelled') {
|                & $Log 'INFO' ('run {0} was cancelled -- this wake-up starts nothing more; what waits in the queue starts on the next one' -f $r.FlowRunId)
|                return [pscustomobject]@{ Outcome = $outcome; Runs = $runs.ToArray(); Lock = $lock; Queued = $queued.ToArray() }
|            }
|        }
|        # a request marked Running whose run is not the current one never finished being recorded
|        foreach ($x in @($open | Where-Object { $_.State -eq 'Running' })) {
|            if ($prev -and [string]$x.FlowRunId -eq [string]$prev.FlowRunId -and [string]$prev.State -in $script:SIPipeline.RunFinished) { $Control.MarkDone($x.Id, [string]$prev.State) }
|            elseif (-not $prev -or [string]$x.FlowRunId -ne [string]$prev.FlowRunId) { $Control.MarkDone($x.Id, 'Interrupted') }
|        }
|        # 4c. an update waits for the pipeline (owner 2026-10-23): no NEW run -- the updater is started first; a wait of kind
|        # 'store' starts it and holds nothing back; a start that did not happen, or an updater that already ran for this
|        # mark and left it, is said and the queue runs (never a block). Returns $true = hold the queue (this wake-up ends).
|        # once per mark in a wake-up: the same mark (its SetUtc) asked again after a run gets the answer it had (no second start)
|        $hand = @{ Started = ''; Mark = $null; Hold = $false; Released = $false }
|        $handOff = {
|            if (-not $UpdateWaits) { return $false }
|            $wt = $null
|            try { $wt = & $UpdateWaits } catch { & $Log 'WARN' ('whether an update waits for the pipeline could not be read ({0}) -- the queue runs' -f $_.Exception.Message); return $false }
|            if (-not $wt) { return $false }
|            if ($null -ne $hand.Mark -and $wt.SetUtc -and ([datetime]$wt.SetUtc).ToUniversalTime() -eq $hand.Mark) { return $hand.Hold }
|            $hand.Mark = $(if ($wt.SetUtc) { ([datetime]$wt.SetUtc).ToUniversalTime() } else { [datetime]::MinValue }); $hand.Hold = $false
|            # #1129 (live 2026-11-05, ring 0): the updater is started only AFTER this runner has released the install's lock.
|            # Before, the lock was released in this function's finally -- after the start -- so the updater's run gate could
|            # find "the pipeline runner holds the install" and defer again, leaving a new mark that only the NEXT wake-up acts
|            # on. -StartUpdate calls this block right before its start (and only when it really starts the updater); a wait
|            # of kind 'store' holds no run back, so its lock is kept (the queue may still run under it).
|            $relCtl = $Control; $relHolder = $Holder; $relHand = $hand; $relLog = $Log
|            $releaseFirst = $null
|            if ([string]$wt.Kind -ne 'store') {
|                $releaseFirst = {
|                    try { $relCtl.ReleaseLock($relHolder); $relHand.Released = $true; & $relLog 'INFO' 'the install''s lock is released before the updater is started -- the update finds the install free' }
|                    catch { & $relLog 'WARN' ('the install''s lock could not be released before the updater is started ({0}) -- it frees itself when its heartbeat is old' -f $_.Exception.Message) }
|                }.GetNewClosure()
|            }
|            $st = $null
|            if ($StartUpdate) {
|                try { $st = & $StartUpdate $wt $releaseFirst } catch { $st = [pscustomobject]@{ Started = $false; Text = ('the updater could not be started ({0})' -f $_.Exception.Message) } }
|            } else { $st = [pscustomobject]@{ Started = $false; Text = 'this runner cannot start the updater' } }
|            if ($hand.Released -and -not ($st -and $st.Started)) {
|                # the lock is given up already: this runner takes nothing more -- the next wake-up runs the queue (or starts the updater)
|                & $Log 'WARN' ('an update of SecurityInsight waits for the pipeline, but {0} -- the install''s lock was released for it, so what waits in the queue starts on the next wake-up' -f $(if ($st -and $st.Text) { $st.Text } else { 'the updater was not started' }))
|                $hand.Hold = $true
|                return $true
|            }
|            $ql = @(try { $Control.List() } catch { @() }); $nq = @($ql | Where-Object { $_.State -eq 'Queued' }).Count
|            $since = if ($wt.SinceUtc) { (' since {0:yyyy-MM-dd HH:mm}Z' -f ([datetime]$wt.SinceUtc).ToUniversalTime()) } else { '' }
|            if ($st -and $st.Started) {
|                $hand.Started = [string]$st.Text
|                if ([string]$wt.Kind -eq 'store') {
|                    & $Log 'INFO' ('the updater could not read the state store at its last run ({0}) -- it is started again ({1}); no run is held back for it' -f $wt.Reason, $st.Text)
|                    return $false
|                }
|                & $Log 'INFO' ('an update of SecurityInsight waits for the pipeline{0} -- the updater is started ({1}) before any new run; {2} request(s) wait in the queue and start after it, on the new build' -f $since, $st.Text, $nq)
|                $hand.Hold = $true
|                return $true
|            }
|            & $Log 'WARN' ('an update of SecurityInsight waits for the pipeline{0}, but {1} -- the queue runs on the installed build; the updater waits again for that run' -f $since, $(if ($st -and $st.Text) { $st.Text } else { 'the updater was not started' }))
|            $false
|        }
|        if (& $handOff) {
|            return [pscustomobject]@{ Outcome = $(if ($runs.Count) { 'Ran' } else { 'Busy' }); Runs = $runs.ToArray(); Lock = $lock; Queued = $queued.ToArray(); UpdateStarted = $hand.Started }
|        }
|        # 4b. the queue, oldest first
|        $direct = @($queued | Where-Object { [long]$_.Id -eq 0 })   # an older Pro database: no queue table
|        $n = 0
|        while ($n -lt $MaxRuns) {
|            # never a NEW run on replaced code: after a run this execution did, an update may have replaced its code
|            if ($runs.Count -gt 0 -and $CodeCurrent) {
|                $cur = $true
|                try { $cur = [bool](& $CodeCurrent) } catch { $cur = $true }
|                if (-not $cur) {
|                    & $Log 'INFO' 'SecurityInsight was updated while this runner worked -- what waits in the queue starts on the next wake-up, on the new version'
|                    break
|                }
|            }
|            # never a NEW run while an update waits: the update that waited for the run this execution just did goes first
|            if ($runs.Count -gt 0 -and (& $handOff)) { break }
|            $req = $null
|            if ($direct.Count) { $req = $direct[0]; $direct = @($direct | Select-Object -Skip 1) } else { $req = $Control.NextQueued() }
|            if (-not $req) { break }
|            $n++
|            # 2026-10-24: a catch-up queued while a manual run held the install is not run when that run covered its slot (it was
|            # running at that time and succeeded as a whole run -- Get-SIJobFlowCoveredSlot); closed 'Covered', said once
|            if ([string]$req.Trigger -eq 'catch-up' -and $req.SlotUtc) {
|                $cov = $null
|                try { $cov = Get-SIJobFlowCoveredSlot -Definition $Definition -Previous (& $LoadLast) } catch { $cov = $null }
|                if ($cov -and ([datetime]$cov).ToUniversalTime() -ge ([datetime]$req.SlotUtc).ToUniversalTime()) {
|                    & $Log 'INFO' ('the queued {0:u} start is not run: the run before it was running at that time and succeeded -- it is that day''s run' -f ([datetime]$req.SlotUtc).ToUniversalTime())
|                    if ($req.Id) { $Control.MarkDone($req.Id, 'Covered') }
|                    continue
|                }
|            }
|            $why = Test-SIPipelineRequest -Request $req -Definition $Definition
|            $fid = [guid]::NewGuid().ToString()
|            # the database refuses a claim by a runner that does not hold the install's lock (cfg.TR_PipelineQueue_Claim:
|            # its lock was released by a cancel, or taken over) -- this runner then takes nothing more; the next wake-up does
|            if ($req.Id) {
|                $taken = $false
|                try { $taken = [bool]$Control.MarkRunning($req.Id, $fid, $Holder) }
|                catch {
|                    if ("$($_.Exception.Message)" -notmatch 'holds the install lock') { throw }
|                    & $Log 'INFO' ('{0} is not taken: this runner no longer holds the install''s lock -- it starts on the next wake-up' -f (Get-SIPipelineRequestText $req))
|                    break
|                }
|                if (-not $taken) { continue }   # cancelled or taken meanwhile
|            }
|            if ($why) { & $Log 'WARN' ('{0}: not run -- {1}' -f (Get-SIPipelineRequestText $req), $why); if ($req.Id) { $Control.MarkDone($req.Id, 'Refused') }; continue }
|            $null = $Control.HeartbeatLock($Holder, $fid, (Get-SIPipelineRequestText $req))
|            & $Log 'INFO' ('running {0} ({1}{2})' -f (Get-SIPipelineRequestText $req), $req.Trigger, $(if ($req.RequestedBy) { ', by ' + $req.RequestedBy } else { '' }))
|            $r = $null
|            try { $r = & $RunOne $req (& $LoadLast) $fid }
|            catch { & $Log 'ERROR' ('{0} could not run: {1}' -f (Get-SIPipelineRequestText $req), $_.Exception.Message); if ($req.Id) { $Control.MarkDone($req.Id, 'Error') }; continue }
|            if ($r) { $runs.Add($r) }
|            if ($r -and [string]$r.Outcome -eq 'Busy') {
|                # an unfinished run still beats (a runner that stopped minutes ago): the request goes back to wait
|                if ($req.Id) { $Control.MarkDone($req.Id, 'Requeued'); $back = $req; $back.Id = 0; $null = $Control.Enqueue($back) }
|                $outcome = 'Blocked'; break
|            }
|            if ($req.Id) { $Control.MarkDone($req.Id, $(if ($r) { [string]$r.State } else { 'Unknown' })) }
|            $outcome = 'Ran'
|            # #700: the run was cancelled meanwhile -- the cancel released the lock, so this runner takes nothing more from
|            # the queue (the next wake-up does, as the lock's one holder)
|            if ($r -and [string]$r.State -eq 'Cancelled') { & $Log 'INFO' ('run {0} was cancelled -- what waits in the queue starts on the next wake-up' -f $r.FlowRunId); break }
|        }
|    } finally {
|        try { $Control.ReleaseLock($Holder) } catch { & $Log 'WARN' ('the pipeline lock could not be released ({0}) -- it frees itself when its heartbeat is {1} minutes old' -f $_.Exception.Message, $StaleAfterMinutes) }
|    }
|    [pscustomobject]@{ Outcome = $outcome; Runs = $runs.ToArray(); Lock = $lock; Queued = $queued.ToArray(); UpdateStarted = $hand.Started }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-ExecutionLiveness.ps1'] = @{ Sha256 = 'ba3a12630c2191918c3b3b1bc9730181e99be4c2f742bce81a210d757db92eae'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- NO FRESH BEAT = DEAD (one rule for every execution kind; agreed with Invardia 2026-11-06).
|
|    WHY. Live 2026-11-06: an updater execution that never started its container (ARM status Running, no log line) held an
|    install's daily run back for 6 hours -- the pipeline treated ANY running updater execution younger than 6 h as an update.
|    Live 2026-11-05/06: a hung flow execution held another install for 47 hours -- every later wake-up saw "the flow is still
|    running" and only did the housekeeping. Azure's "Running" says nothing about whether the code still works.
|
|    THE RULE. An execution counts as RUNNING only while it shows a fresh sign of life -- a BEAT on a lock row (Pro: a row of
|    cfg.PipelineLock; Community without a database: a lock document in the install's storage) whose Holder names the
|    execution:
|      * updater      -- the install lock ('install', Holder caj-si-updater:<execution>, from its run gate on) or its own row
|                        ('updater', from its first moment after the sign-in; every log line beats it);
|      * flow         -- the install lock ('install', Holder = the execution name: the runner of a run);
|      * housekeeping -- its own row ('housekeeping'), taken by the container entry as its first act, beaten by the clean-up.
|    GRACE: an execution that beat before is DEAD 15 minutes after its last beat; one that has NEVER beaten is dead only 30
|    minutes after it started (nothing runs before the image pull). An execution with neither a start time nor a beat is never
|    judged dead. When the lock rows cannot be read the old rule holds (everything Running counts; nothing is stopped).
|    A DEAD execution is STOPPED (ARM executions/<name>/stop), said in one plain WARNING line, and raised to Invardia as the
|    alert si.execution.stopped-dead; the queued work goes on in the same wake-up. A stop that fails is a WARNING and the
|    execution still holds the work back -- unless it started more than 6 hours ago (the outer fallback): never two runs side
|    by side. PURE functions + small seams; PS 5.1 and 7; no PowerShell module.
|#>
|
|function Get-SIExecutionLivenessContract {
|    <# PURE. The numbers and names of the rule (a function, so every scope that dot-sources this file reads the same). #>
|    [pscustomobject]@{
|        BeatStaleMinutes      = 15
|        NeverBeatGraceMinutes = 30
|        FallbackHours         = 6
|        AlertId               = 'si.execution.stopped-dead'
|        Kinds                 = @('updater', 'flow', 'housekeeping')
|        InstallLock           = 'install'
|        UpdaterLock           = 'updater'
|        HousekeepingLock      = 'housekeeping'
|        StopApi               = '2024-03-01'
|        UpdaterHolderPrefix   = 'caj-si-updater:'
|        ActionTextMax         = 500
|    }
|}
|
|function Get-SIExecLiveField {
|    <# PURE. One field of a row (a hashtable, a DataRow-like dictionary or an object); DBNull = $null. #>
|    param($Row, [string]$Name)
|    if ($null -eq $Row) { return $null }
|    $v = $null
|    if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($Name)) { $v = $Row[$Name] } }
|    elseif ($Row.PSObject.Properties[$Name]) { $v = $Row.$Name }
|    if ($v -is [DBNull]) { return $null }
|    $v
|}
|
|function ConvertTo-SIExecLiveUtc {
|    <# PURE. A time (a [datetime] of any kind -- Unspecified is UTC, as SQL datetime2 and ARM give it -- or ISO text) -> UTC, or $null. #>
|    param($Value)
|    if ($null -eq $Value -or $Value -is [DBNull]) { return $null }
|    if ($Value -is [datetime]) {
|        if ($Value.Kind -eq [DateTimeKind]::Unspecified) { return [datetime]::SpecifyKind($Value, [DateTimeKind]::Utc) }
|        return $Value.ToUniversalTime()
|    }
|    if ($Value -is [DateTimeOffset]) { return $Value.UtcDateTime }
|    $s = "$Value".Trim(); if (-not $s) { return $null }
|    $d = [datetime]::MinValue
|    if ([datetime]::TryParse($s, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal, [ref]$d)) { return $d }
|    $null
|}
|
|function Get-SIExecutionStartUtc {
|    <# PURE. The start of an execution in the ARM shape (name, properties.startTime), or $null. #>
|    param($Execution)
|    if (-not $Execution) { return $null }
|    $p = if ($Execution.PSObject.Properties['properties'] -and $Execution.properties) { $Execution.properties } else { $Execution }
|    if (-not $p.PSObject.Properties['startTime']) { return $null }
|    ConvertTo-SIExecLiveUtc $p.startTime
|}
|
|function Test-SIExecutionRunning {
|    <# PURE. Azure says the execution runs: status Running / Processing and no end time. #>
|    param($Execution)
|    if (-not $Execution) { return $false }
|    $p = if ($Execution.PSObject.Properties['properties'] -and $Execution.properties) { $Execution.properties } else { $Execution }
|    $st = if ($p.PSObject.Properties['status']) { [string]$p.status } else { '' }
|    if ($st -notin @('Running', 'Processing')) { return $false }
|    if ($p.PSObject.Properties['endTime'] -and "$($p.endTime)".Trim()) { return $false }
|    $true
|}
|
|function Test-SIExecutionHolder {
|    <# PURE. Does the lock Holder name this execution? '<execution>', 'caj-si-updater:<execution>' or any '<prefix>:<execution>'. #>
|    param([string]$Holder, [string]$Name)
|    $h = "$Holder".Trim(); $n = "$Name".Trim()
|    if (-not $h -or -not $n) { return $false }
|    if ($h -ieq $n) { return $true }
|    $i = $h.LastIndexOf(':')
|    ($i -ge 0 -and $h.Substring($i + 1) -ieq $n)
|}
|
|function Get-SIExecutionBeat {
|    <# PURE. The freshest beat of the execution -Name on the lock rows -Locks (LockName, Holder, HeartbeatUtc): @{ LastBeatUtc; LockName }, or $null. #>
|    param([string]$Name, [object[]]$Locks = @())
|    $best = $null
|    foreach ($l in @($Locks | Where-Object { $_ })) {
|        if (-not (Test-SIExecutionHolder -Holder ([string](Get-SIExecLiveField $l 'Holder')) -Name $Name)) { continue }
|        $hb = ConvertTo-SIExecLiveUtc (Get-SIExecLiveField $l 'HeartbeatUtc')
|        if (-not $hb) { continue }
|        if (-not $best -or $hb -gt $best.LastBeatUtc) { $best = [pscustomobject]@{ LastBeatUtc = $hb; LockName = [string](Get-SIExecLiveField $l 'LockName') } }
|    }
|    $best
|}
|
|function Get-SIExecutionLiveness {
|    <#
|        PURE. THE RULE for one execution. -Kind: 'updater', or 'flow' (then 'housekeeping' when its beat is on the housekeeping
|        lock). Returns @{ Name; Kind; StartedUtc; AgeMin; LastBeatUtc; MinutesSinceBeat; LockName; Alive; PastFallback; Execution }.
|    #>
|    param([Parameter(Mandatory)]$Execution, [ValidateSet('updater', 'flow', 'housekeeping')][string]$Kind = 'flow', [object[]]$Locks = @(), [datetime]$NowUtc = [datetime]::UtcNow)
|    $c = Get-SIExecutionLivenessContract
|    $now = (ConvertTo-SIExecLiveUtc $NowUtc)
|    $name = [string]$Execution.name
|    $start = Get-SIExecutionStartUtc $Execution
|    $beat = Get-SIExecutionBeat -Name $name -Locks $Locks
|    $age = if ($start) { [Math]::Max(0, ($now - $start).TotalMinutes) } else { $null }
|    $since = if ($beat) { [Math]::Max(0, ($now - $beat.LastBeatUtc).TotalMinutes) } else { $null }
|    $k = $Kind
|    if ($k -eq 'flow' -and $beat -and $beat.LockName -eq $c.HousekeepingLock) { $k = 'housekeeping' }
|    $alive = if ($beat) { $since -lt $c.BeatStaleMinutes } elseif ($null -ne $age) { $age -lt $c.NeverBeatGraceMinutes } else { $true }
|    [pscustomobject]@{
|        Name = $name; Kind = $k; StartedUtc = $start
|        AgeMin = $(if ($null -ne $age) { [int][Math]::Floor($age) } else { $null })
|        LastBeatUtc = $(if ($beat) { $beat.LastBeatUtc } else { $null })
|        MinutesSinceBeat = $(if ($null -ne $since) { [int][Math]::Floor($since) } else { $null })
|        LockName = $(if ($beat) { $beat.LockName } else { '' })
|        Alive = [bool]$alive
|        PastFallback = [bool]($null -ne $age -and $age -gt ($c.FallbackHours * 60))
|        Execution = $Execution
|    }
|}
|
|function Select-SIExecutionLiveness {
|    <#
|        PURE. The OTHER running executions of one job, split: @{ Live = @(..); Dead = @(..); Known }. -Self is never judged.
|        -LocksKnown $false (the lock rows could not be read): every running one is Live -- the old rule, nothing is stopped.
|        -Stopped: names this process stopped already (a stopped execution may still read Running for a moment) -- left out.
|    #>
|    param([object[]]$Executions = @(), [string]$Self = '', [ValidateSet('updater', 'flow')][string]$Kind = 'flow', [object[]]$Locks = @(),
|          [bool]$LocksKnown = $true, [datetime]$NowUtc = [datetime]::UtcNow, [System.Collections.IDictionary]$Stopped)
|    $live = New-Object System.Collections.Generic.List[object]; $dead = New-Object System.Collections.Generic.List[object]
|    foreach ($e in @($Executions | Where-Object { $_ })) {
|        if ("$Self".Trim() -and [string]$e.name -eq $Self) { continue }
|        if (-not (Test-SIExecutionRunning $e)) { continue }
|        if ($Stopped -and $Stopped.Contains([string]$e.name)) { continue }
|        $lv = Get-SIExecutionLiveness -Execution $e -Kind $Kind -Locks $(if ($LocksKnown) { $Locks } else { @() }) -NowUtc $NowUtc
|        if (-not $LocksKnown) { $lv.Alive = $true }
|        if ($lv.Alive) { $live.Add($lv) } else { $dead.Add($lv) }
|    }
|    [pscustomobject]@{ Live = $live.ToArray(); Dead = $dead.ToArray(); Known = [bool]$LocksKnown }
|}
|
|function Select-SIFlowGuardOther {
|    <#
|        PURE. The flow job's execution guard under the rule: of the OTHER flow executions that started before this one (-Self)
|        and still read Running, which are DEAD, and which LIVE one holds this wake-up back. A live clean-up pass (its beat on
|        the housekeeping lock) never holds a wake-up back: it gives way to a run by itself (it asks before every range). Without
|        readable lock rows (-LocksKnown $false) every running one is live (the old rule). Returns @{ Other (the ARM execution
|        that holds it back, the earliest, or $null); Dead = @(); Live = @() }.
|    #>
|    param([object[]]$Executions = @(), [Parameter(Mandatory)][string]$Self, [object[]]$Locks = @(), [bool]$LocksKnown = $true,
|          [datetime]$NowUtc = [datetime]::UtcNow, [System.Collections.IDictionary]$Stopped)
|    $mine = @($Executions | Where-Object { $_ -and [string]$_.name -eq $Self })[0]
|    $myStart = Get-SIExecutionStartUtc $mine; if (-not $myStart) { $myStart = [datetime]::MaxValue }
|    $earlier = New-Object System.Collections.Generic.List[object]
|    foreach ($e in @($Executions | Where-Object { $_ -and [string]$_.name -ne $Self })) {
|        $s = Get-SIExecutionStartUtc $e
|        if ((-not $s) -or $s -le $myStart) { $earlier.Add($e) }
|    }
|    $earlier = $earlier.ToArray()
|    $sel = Select-SIExecutionLiveness -Executions $earlier -Self $Self -Kind flow -Locks $Locks -LocksKnown $LocksKnown -NowUtc $NowUtc -Stopped $Stopped
|    $hold = @($sel.Live | Where-Object { $_.Kind -ne 'housekeeping' } | Sort-Object { if ($_.StartedUtc) { $_.StartedUtc } else { [datetime]::MinValue } })
|    [pscustomobject]@{ Other = $(if ($hold.Count) { $hold[0].Execution } else { $null }); Dead = @($sel.Dead); Live = @($sel.Live) }
|}
|
|function Get-SIExecutionKindText {
|    <# PURE. What the execution is, in plain words. #>
|    param([string]$Kind)
|    switch ($Kind) { 'updater' { 'an update of SecurityInsight' } 'housekeeping' { 'a clean-up of old data' } default { 'a pipeline runner' } }
|}
|
|function Get-SIExecutionLifeText {
|    <# PURE. Its last sign of life, in plain words. #>
|    param([Parameter(Mandatory)]$Dead)
|    $st = if ($Dead.StartedUtc) { (' (started {0:yyyy-MM-dd HH:mm}Z)' -f ([datetime]$Dead.StartedUtc)) } else { '' }
|    $life = if ($Dead.LastBeatUtc) { ('last reported that it was working at {0:yyyy-MM-dd HH:mm}Z, {1} minutes ago' -f ([datetime]$Dead.LastBeatUtc), $Dead.MinutesSinceBeat) }
|            else { ('never reported that it was working, {0} minutes after it started' -f $Dead.AgeMin) }
|    ('{0}{1} {2}' -f $Dead.Name, $st, $life)
|}
|
|function Get-SIExecutionStoppedText {
|    <# PURE. The one WARNING line of a stop -- customer language, no internal numbers. #>
|    param([Parameter(Mandatory)]$Dead, [bool]$QueuedRunStarted = $true)
|    ('{0} showed no sign of life and was stopped: {1} -- {2}' -f (Get-SIExecutionKindText $Dead.Kind), (Get-SIExecutionLifeText $Dead),
|        $(if ($QueuedRunStarted) { 'the waiting work goes on now' } else { 'nothing else was held back by it' }))
|}
|
|function Get-SIExecutionStopFailedText {
|    <# PURE. The WARNING line of a stop that failed. #>
|    param([Parameter(Mandatory)]$Dead, [string]$Reason = '')
|    ('{0} showed no sign of life but could not be stopped ({1}): {2} -- {3}' -f (Get-SIExecutionKindText $Dead.Kind), $(if ("$Reason".Trim()) { "$Reason".Trim() } else { 'no answer' }), (Get-SIExecutionLifeText $Dead),
|        $(if ($Dead.PastFallback) { 'it started more than 6 hours ago, so it is no longer waited for' } else { 'nothing new starts beside it; the next wake-up tries again' }))
|}
|
|function New-SIExecutionStoppedEvent {
|    <# PURE. The stop as an event: id, execution, kind, ageMin, lastBeatUtc ($null = never beat), lockName, stoppedUtc, queuedRunStarted. #>
|    param([Parameter(Mandatory)]$Dead, [Parameter(Mandatory)][datetime]$StoppedUtc, [bool]$QueuedRunStarted)
|    $c = Get-SIExecutionLivenessContract
|    [pscustomobject]@{
|        Id = $c.AlertId; Execution = [string]$Dead.Name; Kind = [string]$Dead.Kind; AgeMin = $Dead.AgeMin
|        LastBeatUtc = $Dead.LastBeatUtc; MinutesSinceBeat = $Dead.MinutesSinceBeat; LockName = [string]$Dead.LockName
|        StoppedUtc = (ConvertTo-SIExecLiveUtc $StoppedUtc); QueuedRunStarted = [bool]$QueuedRunStarted
|    }
|}
|
|function ConvertTo-SIExecutionStoppedAlert {
|    <#
|        PURE. The uplink ALERT record (Invardia's closed shape, Kind 'alert', identified only -- $null for an anonymous
|        context): the envelope (Schema 2, Kind, Product, Version, Ring, Edition, ClaimedTenantId, InstallId, LicenceId,
|        EnvironmentName -- each only when known) and AlertId si.execution.stopped-dead, Severity warning, Measured { ageMin,
|        minutesSinceBeat (left out when it never beat), queuedRunStarted 0 | 1 } (whole numbers), Area execution, Job = the
|        kind, ActionText = the execution and the lock in plain words (at most 500), FirstSeenUtc = the stop time, Count 1.
|        Nothing else: any other field refuses the whole record.
|    #>
|    param([Parameter(Mandatory)]$Event, [Parameter(Mandatory)]$Context)
|    $c = Get-SIExecutionLivenessContract
|    if ([string]$Context.Mode -ne 'identified') { return $null }
|    if ($c.Kinds -notcontains [string]$Event.Kind) { return $null }
|    $r = [ordered]@{ Schema = 2; Kind = 'alert'; Product = 'securityinsight' }
|    $ctxv = { param($n) if ($Context.PSObject.Properties[$n] -and $null -ne $Context.$n -and "$($Context.$n)".Trim() -ne '') { $Context.$n } else { $null } }
|    if (& $ctxv 'Version') { $r.Version = [string](& $ctxv 'Version') }
|    if ($null -ne (& $ctxv 'Ring')) { $r.Ring = [int](& $ctxv 'Ring') }
|    if (& $ctxv 'Edition') { $r.Edition = [string](& $ctxv 'Edition') }
|    if (& $ctxv 'TenantId') { $r.ClaimedTenantId = [string](& $ctxv 'TenantId') }
|    $lid = & $ctxv 'LastingInstallId'
|    if ($lid -and (Get-Command -Name ConvertTo-SIInvardiaInstallId -ErrorAction SilentlyContinue)) { $lid = ConvertTo-SIInvardiaInstallId ([string]$lid) }
|    if ($lid) { $r.InstallId = [string]$lid }
|    if (& $ctxv 'LicenceId') { $r.LicenceId = [string](& $ctxv 'LicenceId') }
|    if (& $ctxv 'EnvironmentName') { $r.EnvironmentName = [string](& $ctxv 'EnvironmentName') }
|    $m = [ordered]@{ ageMin = [int]$(if ($null -ne $Event.AgeMin) { $Event.AgeMin } else { 0 }) }
|    if ($Event.LastBeatUtc -and $null -ne $Event.MinutesSinceBeat) { $m.minutesSinceBeat = [int]$Event.MinutesSinceBeat }
|    $m.queuedRunStarted = $(if ($Event.QueuedRunStarted) { 1 } else { 0 })
|    $lockWords = switch ([string]$Event.LockName) {
|        'install'      { 'its last beat was on the install lock' }
|        'updater'      { 'its last beat was on the update''s own lock' }
|        'housekeeping' { 'its last beat was on the clean-up''s own lock' }
|        default        { 'it never beat a lock' }
|    }
|    $at = ('SecurityInsight stopped the {0} execution {1}: Azure still showed it running, but {2}{3} -- {4}.' -f [string]$Event.Kind, [string]$Event.Execution, $lockWords,
|        $(if ($Event.LastBeatUtc) { (' ({0:yyyy-MM-dd HH:mm}Z)' -f ([datetime]$Event.LastBeatUtc)) } else { '' }),
|        $(if ($Event.QueuedRunStarted) { 'the queued work started' } else { 'nothing else was waiting for it' }))
|    $at = ($at -replace '[\x00-\x1F\x7F]', ' ')
|    if ($at.Length -gt $c.ActionTextMax) { $at = $at.Substring(0, $c.ActionTextMax) }
|    $r.AlertId = $c.AlertId
|    $r.Severity = 'warning'
|    $r.Measured = [pscustomobject]$m
|    $r.FirstSeenUtc = ([datetime]$Event.StoppedUtc).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture)
|    $r.Count = 1
|    $r.Area = 'execution'
|    $r.Job = [string]$Event.Kind
|    $r.ActionText = $at
|    [pscustomobject]$r
|}
|
|function Send-SIExecutionStoppedAlert {
|    <#
|        Raises the alert to Invardia (the uplink, as every SecurityInsight report). NEVER throws. Returns @{ State; Record }:
|        sent | failed | off (telemetry switched off) | anonymous (alerts are identified only) | test-session | no-telemetry.
|        -Context: a Get-SITelemetryContext result; -Transport { param($Record, $Endpoint, $AccessCode, $TimeoutSec) } (default
|        Send-SITelemetryUplink, else Send-AitUplink).
|    #>
|    param([Parameter(Mandatory)]$Event, $Context, [scriptblock]$Transport, [scriptblock]$Log)
|    $res = [ordered]@{ State = 'no-telemetry'; Record = $null }
|    try {
|        if (-not $Context) {
|            if ((Get-Command -Name Test-SITelemetryEnabled -ErrorAction SilentlyContinue) -and -not (Test-SITelemetryEnabled)) { $res.State = 'off'; return [pscustomobject]$res }
|            if (-not $Transport -and (Get-Module -Name Pester)) { $res.State = 'test-session'; return [pscustomobject]$res }
|            if (-not (Get-Command -Name Get-SITelemetryContext -ErrorAction SilentlyContinue)) { return [pscustomobject]$res }
|            $Context = Get-SITelemetryContext
|        }
|        $rec = ConvertTo-SIExecutionStoppedAlert -Event $Event -Context $Context
|        if (-not $rec) { $res.State = 'anonymous'; return [pscustomobject]$res }
|        $res.Record = $rec
|        if (-not $Transport) {
|            if (Get-Command -Name Send-SITelemetryUplink -ErrorAction SilentlyContinue) { $Transport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) Send-SITelemetryUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec } }
|            elseif (Get-Command -Name Send-AitUplink -ErrorAction SilentlyContinue) { $Transport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) Send-AitUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec } }
|            else { return [pscustomobject]$res }
|        }
|        $a = & $Transport $rec ([string]$Context.Endpoint) ([string]$Context.AccessCode) 5
|        $res.State = if ($a -and [string]$a.Status -eq 'ok') { 'sent' } else { 'failed' }
|    } catch { $res.State = 'failed'; if ($Log) { try { & $Log 'INFO' ('the stop could not be reported to Invardia ({0})' -f $_.Exception.Message) } catch { } } }
|    [pscustomobject]$res
|}
|
|function Invoke-SIExecutionDeadStop {
|    <#
|        Stops every DEAD execution (-Dead: Select-SIExecutionLiveness .Dead). -Stop { param($Name) } (throws on failure; an
|        execution that already ended is not a failure -- Test-SIJobFlowStopAlreadyEnded's words). Each stop: one WARNING line
|        (-Log { param($Level, $Message) }), the alert (-Alert { param($Event) }), and the name kept in -Stopped (this process
|        never stops or counts it again). -OthersLive: a live execution still holds the work back (then queuedRunStarted = 0).
|        Returns @{ Stopped = @(); Failed = @(); Blocking = @() (failed and not past the 6 h fallback: wait); Events = @() }.
|        Never throws.
|    #>
|    param([object[]]$Dead = @(), [Parameter(Mandatory)][scriptblock]$Stop, [scriptblock]$Log, [scriptblock]$Alert, [bool]$OthersLive = $false,
|          [System.Collections.IDictionary]$Stopped, [datetime]$NowUtc = [datetime]::UtcNow)
|    $ok = New-Object System.Collections.Generic.List[object]; $failed = New-Object System.Collections.Generic.List[object]
|    $events = New-Object System.Collections.Generic.List[object]
|    foreach ($d in @($Dead | Where-Object { $_ })) {
|        try { $null = & $Stop ([string]$d.Name); $ok.Add($d) }
|        catch {
|            $msg = [string]$_.Exception.Message
|            if ($msg -match '(?is)\bexecution\b.{0,300}\bnot\s+found\b|ExecutionNotFound|JobExecutionNotFound') { $ok.Add($d) }
|            else { $failed.Add([pscustomobject]@{ Dead = $d; Reason = $msg }) }
|        }
|    }
|    $blocking = @($failed | Where-Object { -not $_.Dead.PastFallback } | ForEach-Object { $_.Dead })
|    $goesOn = (-not $OthersLive) -and ($blocking.Count -eq 0)
|    foreach ($d in $ok) {
|        if ($Stopped) { $Stopped[[string]$d.Name] = $true }
|        if ($Log) { try { & $Log 'WARN' (Get-SIExecutionStoppedText -Dead $d -QueuedRunStarted $goesOn) } catch { } }
|        $ev = New-SIExecutionStoppedEvent -Dead $d -StoppedUtc $NowUtc -QueuedRunStarted $goesOn
|        $events.Add($ev)
|        if ($Alert) { try { $null = & $Alert $ev } catch { } }
|    }
|    foreach ($f in $failed) {
|        if ($f.Dead.PastFallback -and $Stopped) { $Stopped[[string]$f.Dead.Name] = $true }
|        if ($Log) { try { & $Log 'WARN' (Get-SIExecutionStopFailedText -Dead $f.Dead -Reason $f.Reason) } catch { } }
|    }
|    [pscustomobject]@{ Stopped = $ok.ToArray(); Failed = $failed.ToArray(); Blocking = $blocking; Events = $events.ToArray() }
|}
|
|function Get-SIExecutionStopPath {
|    <# PURE. The ARM path that stops one execution of a job (-Base: .../providers/Microsoft.App/jobs). #>
|    param([Parameter(Mandatory)][string]$Base, [Parameter(Mandatory)][string]$Job, [Parameter(Mandatory)][string]$Execution)
|    ('{0}/{1}/executions/{2}/stop?api-version={3}' -f $Base.TrimEnd('/'), $Job, $Execution, (Get-SIExecutionLivenessContract).StopApi)
|}
|
|# =====================================================================================================================
|#  THE LOCK ROWS -- read and beat (Pro: cfg.PipelineLock rows over the (sql, params, mode) seam; Community: documents)
|# =====================================================================================================================
|function Get-SIExecutionLockSql {
|    <# PURE. The T-SQL of the lock rows. Read: every row (a row LockId '-' = no lock table). Take / Beat / Release: one NAMED row
|       (never 'install' -- that one belongs to the run gate and the runner). #>
|    param([Parameter(Mandatory)][ValidateSet('Read', 'Take', 'Beat', 'Release')][string]$Name)
|    switch ($Name) {
|        'Read' { "SET NOCOUNT ON; IF OBJECT_ID(N'cfg.PipelineLock') IS NULL BEGIN SELECT CAST(N'-' AS nvarchar(32)) AS LockId, CAST(NULL AS nvarchar(128)) AS Holder, CAST(NULL AS datetime2) AS HeartbeatUtc; RETURN; END SELECT LockId, Holder, HeartbeatUtc FROM cfg.PipelineLock WHERE Holder IS NOT NULL;" }
|        'Take' { @'
|SET NOCOUNT ON; SET XACT_ABORT ON;
|IF OBJECT_ID(N'cfg.PipelineLock') IS NULL OR @LockId = N'install' BEGIN SELECT CAST(-1 AS int) AS Mine; RETURN; END
|BEGIN TRAN;
|IF NOT EXISTS (SELECT 1 FROM cfg.PipelineLock WITH (UPDLOCK, HOLDLOCK) WHERE LockId = @LockId) INSERT cfg.PipelineLock (LockId) VALUES (@LockId);
|UPDATE cfg.PipelineLock
|   SET Holder = @Holder, What = @What, FlowRunId = NULL,
|       AcquiredUtc = CASE WHEN Holder = @Holder THEN AcquiredUtc ELSE SYSUTCDATETIME() END, HeartbeatUtc = SYSUTCDATETIME()
| WHERE LockId = @LockId AND (Holder IS NULL OR Holder = @Holder OR HeartbeatUtc IS NULL OR HeartbeatUtc < DATEADD(minute, -@StaleMinutes, SYSUTCDATETIME()));
|COMMIT;
|SELECT CASE WHEN Holder = @Holder THEN 1 ELSE 0 END AS Mine FROM cfg.PipelineLock WHERE LockId = @LockId;
|'@ }
|        'Beat' { "SET NOCOUNT ON; IF OBJECT_ID(N'cfg.PipelineLock') IS NULL OR @LockId = N'install' BEGIN SELECT 0 AS Held; RETURN; END UPDATE cfg.PipelineLock SET HeartbeatUtc = SYSUTCDATETIME(), What = @What WHERE LockId = @LockId AND Holder = @Holder; SELECT @@ROWCOUNT AS Held;" }
|        'Release' { "IF OBJECT_ID(N'cfg.PipelineLock') IS NOT NULL AND @LockId <> N'install' UPDATE cfg.PipelineLock SET Holder = NULL, What = NULL, FlowRunId = NULL, HeartbeatUtc = NULL WHERE LockId = @LockId AND Holder = @Holder;" }
|    }
|}
|
|function ConvertTo-SIExecLiveRows {
|    <# PURE. The rows a seam answered (one array per reader, arrays of hashtables, DataRows, objects) flattened. #>
|    param($Answer)
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($x in @($Answer)) {
|        if ($null -eq $x) { continue }
|        if ($x -is [System.Collections.IDictionary] -or $x -is [System.Data.DataRow] -or $x -is [string] -or $x -is [System.Management.Automation.PSCustomObject]) { $out.Add($x); continue }
|        if ($x -is [System.Collections.IEnumerable]) { foreach ($y in $x) { if ($null -ne $y) { $out.Add($y) } }; continue }
|        $out.Add($x)
|    }
|    , $out.ToArray()
|}
|
|function New-SIExecutionLockStore {
|    <# The lock rows' store: -Invoke (sql, params, mode) for Pro, or -Docs (Read / Write / Delete of a named document) for an
|       install without a database -- the same documents the pipeline's lock uses ('pipeline.lock' = the install lock). #>
|    param([scriptblock]$Invoke, $Docs, [scriptblock]$Now = { [datetime]::UtcNow })
|    if ($Invoke) { return [pscustomobject]@{ Kind = 'sql'; Invoke = $Invoke; Docs = $null; Now = $Now } }
|    if ($Docs) { return [pscustomobject]@{ Kind = 'docs'; Invoke = $null; Docs = $Docs; Now = $Now } }
|    $null
|}
|
|function Get-SIExecLiveDocName {
|    param([string]$Lock)
|    if ($Lock -eq 'install') { 'pipeline.lock' } else { '{0}.lock' -f $Lock }
|}
|
|function Read-SIExecLiveDoc {
|    param($Store, [string]$Lock)
|    $t = $Store.Docs.Read((Get-SIExecLiveDocName $Lock))
|    if (-not "$t".Trim()) { return $null }
|    try { $o = ConvertFrom-Json -InputObject ([string]$t) } catch { return $null }
|    [pscustomobject]@{ LockName = $Lock; Holder = [string]$o.Holder; HeartbeatUtc = (ConvertTo-SIExecLiveUtc $o.HeartbeatUtc) }
|}
|
|function Read-SIExecutionLocks {
|    <# The lock rows now: @{ Known; Rows = @( @{ LockName; Holder; HeartbeatUtc } ) }. Known $false = no lock table (old schema). Throws when unreadable. #>
|    param([Parameter(Mandatory)]$Store)
|    if ($Store.Kind -eq 'sql') {
|        $rows = ConvertTo-SIExecLiveRows (& $Store.Invoke (Get-SIExecutionLockSql 'Read') @{} 'reader')
|        $out = New-Object System.Collections.Generic.List[object]
|        foreach ($r in $rows) {
|            $id = [string](Get-SIExecLiveField $r 'LockId')
|            if ($id -eq '-') { return [pscustomobject]@{ Known = $false; Rows = @() } }
|            $out.Add([pscustomobject]@{ LockName = $id; Holder = [string](Get-SIExecLiveField $r 'Holder'); HeartbeatUtc = (ConvertTo-SIExecLiveUtc (Get-SIExecLiveField $r 'HeartbeatUtc')) })
|        }
|        return [pscustomobject]@{ Known = $true; Rows = $out.ToArray() }
|    }
|    $c = Get-SIExecutionLivenessContract
|    $docs = @(foreach ($n in @($c.InstallLock, $c.UpdaterLock, $c.HousekeepingLock)) { Read-SIExecLiveDoc -Store $Store -Lock $n })
|    [pscustomobject]@{ Known = $true; Rows = @($docs | Where-Object { $_ -and $_.Holder }) }
|}
|
|function Enter-SIExecutionLock {
|    <# Takes the NAMED lock -Lock for -Holder (free, stale 15 min, or its own). $true = held. Never throws ($false). #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Lock, [Parameter(Mandatory)][string]$Holder, [string]$What = '')
|    if ($Lock -eq 'install' -or -not $Store) { return $false }
|    $stale = (Get-SIExecutionLivenessContract).BeatStaleMinutes
|    try {
|        if ($Store.Kind -eq 'sql') {
|            $r = ConvertTo-SIExecLiveRows (& $Store.Invoke (Get-SIExecutionLockSql 'Take') @{ LockId = $Lock; Holder = $Holder; What = $What; StaleMinutes = [int]$stale } 'reader')
|            return [bool]($r.Count -and [int](Get-SIExecLiveField $r[0] 'Mine') -eq 1)
|        }
|        $now = ([datetime](& $Store.Now)).ToUniversalTime()
|        $cur = Read-SIExecLiveDoc -Store $Store -Lock $Lock
|        $free = (-not $cur) -or (-not $cur.Holder) -or (-not $cur.HeartbeatUtc) -or (($now - $cur.HeartbeatUtc).TotalMinutes -ge $stale) -or ($cur.Holder -eq $Holder)
|        if (-not $free) { return $false }
|        $Store.Docs.Write((Get-SIExecLiveDocName $Lock), (ConvertTo-Json -Compress -InputObject ([ordered]@{ Holder = $Holder; What = $What; HeartbeatUtc = $now.ToString('o', [Globalization.CultureInfo]::InvariantCulture) })))
|        $back = Read-SIExecLiveDoc -Store $Store -Lock $Lock
|        return [bool]($back -and $back.Holder -eq $Holder)
|    } catch { return $false }
|}
|
|function Update-SIExecutionLockBeat {
|    <# Beats the NAMED lock while -Holder holds it. $true = beaten. Never throws. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Lock, [Parameter(Mandatory)][string]$Holder, [string]$What = '')
|    if ($Lock -eq 'install' -or -not $Store) { return $false }
|    try {
|        if ($Store.Kind -eq 'sql') {
|            $r = ConvertTo-SIExecLiveRows (& $Store.Invoke (Get-SIExecutionLockSql 'Beat') @{ LockId = $Lock; Holder = $Holder; What = $What } 'reader')
|            return [bool]($r.Count -and [int](Get-SIExecLiveField $r[0] 'Held') -gt 0)
|        }
|        $cur = Read-SIExecLiveDoc -Store $Store -Lock $Lock
|        if (-not $cur -or $cur.Holder -ne $Holder) { return $false }
|        $now = ([datetime](& $Store.Now)).ToUniversalTime()
|        $Store.Docs.Write((Get-SIExecLiveDocName $Lock), (ConvertTo-Json -Compress -InputObject ([ordered]@{ Holder = $Holder; What = $What; HeartbeatUtc = $now.ToString('o', [Globalization.CultureInfo]::InvariantCulture) })))
|        return $true
|    } catch { return $false }
|}
|
|function Exit-SIExecutionLock {
|    <# Releases the NAMED lock when -Holder holds it. Never throws. #>
|    param($Store, [string]$Lock, [string]$Holder)
|    if (-not $Store -or -not $Lock -or -not $Holder -or $Lock -eq 'install') { return }
|    try {
|        if ($Store.Kind -eq 'sql') { $null = & $Store.Invoke (Get-SIExecutionLockSql 'Release') @{ LockId = $Lock; Holder = $Holder } 'nonquery'; return }
|        $cur = Read-SIExecLiveDoc -Store $Store -Lock $Lock
|        if ($cur -and $cur.Holder -eq $Holder) { $Store.Docs.Delete((Get-SIExecLiveDocName $Lock)) }
|    } catch { }
|}
|
|function New-SIExecutionLockBlobDocs {
|    <# The document seam over the install's storage (<account>/sistate/flow/<name>) -- the same place as the pipeline's lock. #>
|    param([Parameter(Mandatory)][string]$Account, [string]$Container = 'sistate', [string]$Prefix = 'flow/')
|    $o = [pscustomobject]@{ Account = $Account; Container = $Container; Prefix = $Prefix }
|    $o | Add-Member -MemberType ScriptMethod -Name Read -Value { param($Name) $b = Get-SIBlobContent -Account $this.Account -Container $this.Container -Blob ($this.Prefix + $Name) -AllowMissing; if (-not $b -or $b.Length -eq 0) { $null } else { [Text.Encoding]::UTF8.GetString($b) } }
|    $o | Add-Member -MemberType ScriptMethod -Name Write -Value { param($Name, $Text) $null = Set-SIBlobContent -Account $this.Account -Container $this.Container -Blob ($this.Prefix + $Name) -Bytes ([Text.Encoding]::UTF8.GetBytes([string]$Text)) -ContentType 'application/json' }
|    $o | Add-Member -MemberType ScriptMethod -Name Delete -Value { param($Name) try { Remove-SIBlob -Account $this.Account -Container $this.Container -Blob ($this.Prefix + $Name) } catch { } }
|    $o
|}
'@ }
$__siSupportFiles['engine/_shared/SI-Throttle.ps1'] = @{ Sha256 = '2e4bc2af1e8f4f256000ac4ba7064a227d06025704da23cedbc1f343e1026f62'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THROTTLE-IS-NORMAL (#532; framework DOCS/REQUIREMENTS.md §12.18 holds the contract, not this file).
|
|    A run whose failures are ALL real THROTTLING (a 429 / "too many requests" / rate-limit answer -- Get-SITransientKind in
|    SI-ErrorClass.ps1, class 'throttled') and that wrote nothing is not a failed run. Its run-health ExitReason is
|    'throttled' (telemetry Outcome 'warning', ErrorClass 'throttled'): no failure mail, no fix request, amber, and it runs
|    again at its next scheduled time.
|    2026-10-22 (owner, approved): a TIMEOUT or a service that could not be reached (5xx, a reset connection, DNS) is NOT
|    throttling -- it was reported as "Microsoft throttled this run" when SI's own storage timed out. Such a run stays a real
|    failure ('error'): its real error text is kept, it is mailed and reported, and a new install's first collection is
|    restarted after it.
|
|    ONE alert, only when SecurityInsight cannot handle it: the same job has not succeeded for a long stretch because of
|    throttling -- the "stuck" alert (guard 'job.run.throttled-stuck'). Settable: SI_Throttle_StuckHours (default 6) and
|    SI_Throttle_StuckRuns (default 12), whichever comes first, and never on one run alone. The next successful run clears
|    it (nothing to acknowledge).
|
|    What does NOT change (working rule 4: absence is not remediation):
|      * a run that wrote part of its result (ExitReason 'success-partial', or a failure in a stage that writes) is never
|        'throttled' -- a partial result is never shipped as whole, and a partial write stays a real failure;
|      * a run with ANY other failure (403, bad data, a bug) next to the throttling is 'error', exactly as before;
|      * a throttled run published nothing, so the previous whole result is still the newest: findings it could not
|        collect are UNKNOWN, never resolved (every reader that waits for a 'success' / 'success-partial' run -- the data
|        sync, the close-loop, the v3 snapshot -- treats 'throttled' as a run that did not succeed).
|
|    PURE except Get-SIThrottleHistoryKql's caller (Invoke-SIThrottleStuckCheck reads Log Analytics through a seam).
|    PS 5.1 safe.
|#>
|
|if (-not (Get-Command -Name Get-SIErrorClass -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-ErrorClass.ps1'))
|}
|
|$script:SIThrottle = @{
|    # the error class that means "Microsoft asked us to slow down" -- ONLY real throttling (Get-SITransientKind); a timeout
|    # ('platform-timeout') or an unreachable service ('platform-5xx') is a real failure with its own words
|    Classes          = @('throttled')
|    # run-health ExitReasons that mean "nothing reached any output" -- the only ones that can become 'throttled'
|    ErrorReasons     = @('error', 'failure', 'failed')
|    # a failure in one of these stages may have written part of the result: never 'throttled'
|    WriteStageRegex  = '(?i)output|tagging|recommendations|ingest|publish|write|post|sink|mail|apply|sync|upload|store'
|    # Microsoft Graph wording a 429 can carry next to an access problem: an access refusal is never throttling
|    AccessRegex      = '(?i)\b40[13]\b|\bForbidden\b|\bUnauthorized\b|Authorization_RequestDenied|AuthorizationFailed|AuthorizationPermissionMismatch|Insufficient privileges|is not authorized to perform|ForbiddenByRbac|ForbiddenByPolicy|Access denied|InvalidAuthenticationToken'
|    StuckHours       = 6
|    StuckRuns        = 12
|    GuardId          = 'job.run.throttled-stuck'
|    GuardFile        = ([System.IO.Path]::Combine($PSScriptRoot, 'SI-Guard.ps1'))
|    # the customer words (plain language, no internal numbers)
|    Text             = 'Microsoft throttled this run; it runs again automatically at its next scheduled time. Nothing was published from it, so the previous results stay in place.'
|}
|
|function Get-SIThrottleClasses { @($script:SIThrottle.Classes) }
|
|function Get-SIThrottleText {
|    <# PURE. The customer words for a run that ended 'throttled' (run health, the Jobs page, the flow log). A run ends
|       'throttled' only when Microsoft really throttled it (Get-SITransientKind), so these words are true. #>
|    $script:SIThrottle.Text
|}
|
|function Get-SIRunFailureClasses {
|    <#
|        PURE. Every failure a run's error text names, one error class each. SecurityInsight joins the failures of one run
|        with ' | ' (SI-RunOutcome, Risk Analysis); each part is classified on its own, so "429 | 403" is two failures, not
|        one throttle. A part that is classified as throttling but ALSO carries an access refusal (401 / 403 wording) adds
|        'access-refused' -- Get-SIErrorClass checks throttling first and would otherwise hide it.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Message)
|    $out = New-Object System.Collections.Generic.List[string]
|    if ([string]::IsNullOrWhiteSpace($Message)) { return @() }
|    foreach ($part in ([regex]::Split([string]$Message, '\s\|\s|\r?\n'))) {
|        $p = "$part".Trim()
|        if (-not $p) { continue }
|        $c = Get-SIErrorClass -Message $p
|        $out.Add($c)
|        if ($script:SIThrottle.Classes -contains $c -and $p -match $script:SIThrottle.AccessRegex) { $out.Add('access-refused') }
|    }
|    $out.ToArray()
|}
|
|function Test-SIThrottleOnly {
|    <#
|        PURE. $true when there is at least one failure and EVERY failure is throttling / service-side (Get-SIThrottleClasses).
|        One unknown, access, data or query failure next to it = $false (the run is a real failure).
|    #>
|    param([AllowNull()][AllowEmptyCollection()][string[]]$ErrorClasses)
|    $c = @(@($ErrorClasses) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
|    if ($c.Count -eq 0) { return $false }
|    foreach ($x in $c) { if ($script:SIThrottle.Classes -notcontains [string]$x) { return $false } }
|    $true
|}
|
|function Resolve-SIThrottledExitReason {
|    <#
|        PURE. The run-health ExitReason a run REALLY ended with: 'throttled' when it ended 'error' (nothing reached any
|        output), every failure in -ErrorMessage (or -ErrorClasses, when the caller knows them) is throttling / service-side,
|        it did not fail in a stage that writes (-FailedStep), and the caller did not say it wrote part of its result
|        (-WrotePartial). Anything else is returned unchanged -- 'success-partial' is never turned into 'throttled'.
|    #>
|    param([AllowEmptyString()][string]$ExitReason, [AllowEmptyString()][AllowNull()][string]$ErrorMessage,
|          [AllowNull()][string[]]$ErrorClasses, [AllowEmptyString()][AllowNull()][string]$FailedStep, [switch]$WrotePartial)
|    $x = "$ExitReason".Trim().ToLowerInvariant()
|    if ($script:SIThrottle.ErrorReasons -notcontains $x) { return $ExitReason }
|    if ($WrotePartial) { return $ExitReason }
|    if ($FailedStep -and $FailedStep -match $script:SIThrottle.WriteStageRegex) { return $ExitReason }
|    $cls = if ($null -ne $ErrorClasses -and @($ErrorClasses).Count) { @($ErrorClasses) } else { @(Get-SIRunFailureClasses -Message $ErrorMessage) }
|    if (Test-SIThrottleOnly -ErrorClasses $cls) { return 'throttled' }
|    $ExitReason
|}
|
|function Get-SIThrottleSetting {
|    <# PURE. A positive whole number from the install's settings (-Globals, else $global:), else the default. #>
|    param([Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][int]$Default, [System.Collections.IDictionary]$Globals)
|    $v = if ($Globals -and $Globals.Contains($Name)) { $Globals[$Name] } else { Get-Variable -Name $Name -Scope Global -ValueOnly -ErrorAction SilentlyContinue }
|    $n = 0
|    if ($null -ne $v -and [int]::TryParse(([string]$v).Trim(), [ref]$n) -and $n -gt 0) { return $n }
|    $Default
|}
|
|function Get-SIThrottleStuckVerdict {
|    <#
|        PURE. Is this job STUCK on throttling -- the one alert THROTTLE-IS-NORMAL allows?
|          -History  the job's END records, any order: @{ EndedUtc; ExitReason } (newest included)
|          -Hours / -Runs  the thresholds (SI_Throttle_StuckHours / SI_Throttle_StuckRuns)
|        The STREAK is the unbroken run of 'throttled' records since the newest success ('success' or 'success-partial').
|        Any other ending (a real failure) breaks it too -- that one alerts on its own, as before.
|        Stuck = the streak has at least 2 runs AND (it spans at least -Hours from its first run to -NowUtc, OR it has at
|        least -Runs runs). AlertDue = stuck now, and NOT stuck without the newest record -- so the alert goes out once per
|        episode; the next success ends the episode (nothing to acknowledge).
|        Returns @{ Stuck; AlertDue; Runs; SinceUtc; Hours }.
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$History, [Parameter(Mandatory)][datetime]$NowUtc,
|          [int]$Hours = $script:SIThrottle.StuckHours, [int]$Runs = $script:SIThrottle.StuckRuns)
|    $now = $NowUtc.ToUniversalTime()
|    $rows = @(@($History) | Where-Object { $_ -and $_.EndedUtc } | Sort-Object { ([datetime]$_.EndedUtc).ToUniversalTime() } -Descending)
|    $streak = New-Object System.Collections.Generic.List[object]
|    foreach ($r in $rows) {
|        if ("$($r.ExitReason)".Trim().ToLowerInvariant() -ne 'throttled') { break }
|        $streak.Add($r)
|    }
|    $judge = {
|        param($list, $at)
|        $n = @($list).Count
|        if ($n -lt 2) { return $false }
|        $first = ([datetime]@($list)[$n - 1].EndedUtc).ToUniversalTime()
|        (($at - $first).TotalHours -ge $Hours) -or ($n -ge $Runs)
|    }
|    $stuck = [bool](& $judge $streak.ToArray() $now)
|    $before = $false
|    if ($stuck -and $streak.Count -ge 2) {
|        # was the job already stuck when the PREVIOUS run ended? (judged at that run's own time)
|        $older = @($streak.ToArray() | Select-Object -Skip 1)
|        $before = [bool](& $judge $older ([datetime]$older[0].EndedUtc).ToUniversalTime())
|    }
|    $since = if ($streak.Count) { ([datetime]$streak[$streak.Count - 1].EndedUtc).ToUniversalTime() } else { $null }
|    [pscustomobject]@{
|        Stuck    = $stuck
|        AlertDue = ($stuck -and -not $before)
|        Runs     = $streak.Count
|        SinceUtc = $since
|        Hours    = $(if ($since) { [Math]::Round(($now - $since).TotalHours, 1) } else { 0 })
|    }
|}
|
|function Get-SIThrottleHistoryKql {
|    <#
|        PURE. The KQL that reads one engine's END records of the last -Days days (newest first, at most 200) -- the
|        history Get-SIThrottleStuckVerdict judges. $null for a name that is not an engine name (never put into a query).
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Engine, [int]$Days = 14)
|    if ($Engine -notmatch '^[a-z0-9][a-z0-9:\-]{0,63}$') { return $null }
|    "SI_RunHealth_CL | where TimeGenerated > ago($($Days)d) | where Phase == 'End' and Engine == '$Engine' and toint(ShardIndex) == 0 | project EndedUtc = TimeGenerated, ExitReason = tostring(ExitReason) | order by EndedUtc desc | take 200"
|}
|
|function Invoke-SIThrottleStuckCheck {
|    <#
|        At the END of a throttled run: read the job's history, add THIS run (its record may not be in the store yet) and,
|        when the job has just become stuck, raise the ONE alert (guard 'job.run.throttled-stuck': the Guards page, one mail,
|        one report to Invardia). NEVER throws; returns the verdict (or $null when the history could not be read).
|          -Query  { param($Kql) } -> rows with EndedUtc / ExitReason (default Invoke-SILogLaQuery on SI_WorkspaceResourceId)
|          -Raise  { param($Verdict, $Engine, $RunId) } (default Send-SIGuardEvent)
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [string]$RunId, [datetime]$NowUtc = [datetime]::UtcNow,
|          [scriptblock]$Query, [scriptblock]$Raise, [System.Collections.IDictionary]$Globals)
|    try {
|        $hours = Get-SIThrottleSetting -Name 'SI_Throttle_StuckHours' -Default $script:SIThrottle.StuckHours -Globals $Globals
|        $runs = Get-SIThrottleSetting -Name 'SI_Throttle_StuckRuns' -Default $script:SIThrottle.StuckRuns -Globals $Globals
|        $kql = Get-SIThrottleHistoryKql -Engine $Engine
|        if (-not $kql) { return $null }
|        if (-not $Query) {
|            if (-not [string]$global:SI_WorkspaceResourceId -or -not (Get-Command -Name Invoke-SILogLaQuery -ErrorAction SilentlyContinue)) { return $null }
|            $Query = { param($k) Invoke-SILogLaQuery -WorkspaceResourceId ([string]$global:SI_WorkspaceResourceId) -Query $k }
|        }
|        $rows = @(@(& $Query $kql) | Where-Object { $_ })
|        $now = $NowUtc.ToUniversalTime()
|        $hist = @([pscustomobject]@{ EndedUtc = $now; ExitReason = 'throttled' }) + @($rows | Where-Object { $_.EndedUtc -and ([datetime]$_.EndedUtc).ToUniversalTime() -lt $now.AddSeconds(-5) })
|        $v = Get-SIThrottleStuckVerdict -History $hist -NowUtc $now -Hours $hours -Runs $runs
|        if ($v.AlertDue) {
|            try {
|                if ($Raise) { $null = & $Raise $v $Engine $RunId }
|                else {
|                    if (-not (Get-Command -Name Send-SIGuardEvent -ErrorAction SilentlyContinue)) { . $script:SIThrottle.GuardFile }
|                    # the cause = this job + the start of this episode: the alert goes out once per episode, and again only
|                    # after a successful run has ended the episode and a new one has become stuck
|                    $cause = '{0}|{1}' -f $Engine, ([datetime]$v.SinceUtc).ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture)
|                    $null = Send-SIGuardEvent -GuardId $script:SIThrottle.GuardId -Outcome 'warning' -Engine $Engine -Subject $Engine -RunId $RunId -Globals $Globals `
|                        -Detail ('The {0} job was throttled by Microsoft on every run for {1} hours ({2} runs in a row) and has not completed since.' -f $Engine, $v.Hours, $v.Runs) `
|                        -Values @(@{ Name = 'hoursStuck'; Label = 'Hours without a completed run'; Measured = $v.Hours }, @{ Name = 'runsThrottled'; Label = 'Throttled runs in a row'; Measured = $v.Runs }) `
|                        -CauseKeys @($cause)
|                }
|            } catch { Write-Warning ('The stuck-job alert could not be raised: {0}' -f $_.Exception.Message) }
|        }
|        $v
|    } catch { $null }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-Guard.ps1'] = @{ Sha256 = '84d4108d57e1bda83c25a284fd1c157bedb426f6656d0cbb36f9728abe4a0a23'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- GUARD EVENTS (#277): every guard that holds, refuses or halts a step to protect data tells a person
|    and Invardia, on by default.
|
|    ONE CALL for every guard: Send-SIGuardEvent. It takes the guard id (stable, dotted, from config\guard-catalog.locked.json),
|    the outcome (halted | refused | held | skipped | warning), the measured values against their limits, what was held, an
|    optional subject (which connector / report / job), the detail sentence and a link -- and then, EACH STEP FAILURE-SAFE
|    (nothing here ever throws to its caller, and nothing here can fail the job that tripped the guard):
|
|      (a) RUN HEALTH   one row in SI_RunHealth_CL, Phase 'Guard', ExitReason 'guard-<outcome>' (the run's own Start / End
|                       rows are untouched; every reader of run health filters on Phase == 'End');
|      (b) AUDIT        one AUDIT-1 event 'guard.event.trip' on the Pro database's audit trail (Pro only: needs the database);
|      (c) MAIL         one mail per guard per run to SI_GuardMail_To (else the install's report recipients, MailTo; else the
|                       Pro SuperAdmins), through the Risk Analysis relay settings and transports. ON by default
|                       (SI_GuardMail_Enabled). DE-DUPLICATED: a guard that keeps tripping mails again only after 24 hours,
|                       and that mail says "still tripping (N times)". The trip state lives in the Pro database
|                       (cfg.GuardState) when there is one, else in a small file (%ProgramData%\SecurityInsight\guards);
|      (d) TELEMETRY    one GUARD-1 record (Schema 2, Kind 'guard' -- Invardia's receiver, 2026-10-04) posted through the
|                       framework client's Send-AitUplink, following SI_Telemetry_Enabled (default ON). Self-sufficient for a
|                       support ticket per environment + guard: GuardId, GuardOutcome, Severity, Area, Job, Measured /
|                       Thresholds (numbers), HeldCount, TripCount, FirstSeenUtc, Version, Ring. ANONYMOUS adds only the random
|                       InstallId -- no tenant, host, subject, detail, action text or link; IDENTIFIED adds ClaimedTenantId,
|                       Host, ActionText (redacted, at most 500 characters), Link (https) and -- Invardia S16 -- InstallId =
|                       the install's LASTING id (SI-InstallId) when it has one. The framework's own record
|                       builder (New-AitUplinkReport) knows heartbeat | run | install only; the guard record is built here.
|      (e) THE GUARDS VIEW  one row in cfg.GuardEvent (Pro database) -- the web app's Operations > Guards (safety checks) view, and the
|                       outbox the mail job reads for events the web app writes (Invoke-SIGuardOutbox).
|
|    A TEST SESSION NEVER MAILS OR SENDS (Pester loaded, no transport handed in) and never writes state to the machine.
|
|    Customer-facing words (subject, body) are plain language: what was protected, what happened, the numbers against the
|    limit, what was held (nothing lost), what to do. No internal numbers, no jargon.
|
|    PS 5.1 and 7.
|#>
|
|if (-not (Get-Command -Name Get-SITelemetryContext -ErrorAction SilentlyContinue)) {
|    try { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-TelemetrySend.ps1')) } catch { }
|}
|# MAIL-1: the one mail transport (SI_Mail_Mode: sharedMailbox | smtp | none)
|if (-not (Get-Command -Name Send-SIMail -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-MailTransport.ps1')) }
|# CR4 (#654): the stricter period after a release that changed engine code -- halved limits, the guard mode
|if (-not (Get-Command -Name Resolve-SIGuardLimit -ErrorAction SilentlyContinue)) {
|    $sgs = [System.IO.Path]::Combine($PSScriptRoot, 'SI-GuardStrict.ps1')
|    if ([System.IO.File]::Exists($sgs)) { . $sgs }
|}
|# owner 2026-10-17: guards heal themselves, say which release they tripped on, and can be accepted at every install
|if (-not (Get-Command -Name Get-SIGuardHealDecision -ErrorAction SilentlyContinue)) {
|    $sgh = [System.IO.Path]::Combine($PSScriptRoot, 'SI-GuardHeal.ps1')
|    if ([System.IO.File]::Exists($sgh)) { . $sgh }
|}
|
|$script:SIGuard = @{
|    SIRoot      = (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))
|    WindowHours = 24
|    Catalog     = $null
|    IdPattern   = '^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*){2}$'
|    NamePattern = '^[a-z][A-Za-z0-9]{0,30}$'
|    Sources     = @('job', 'web', 'setup', 'engine')
|    AuditAction = 'guard.event.trip'
|    Product     = 'securityinsight'
|}
|if ($null -eq $global:SI_GuardHealth) { $global:SI_GuardHealth = @{ Events = 0; Failed = 0; LastError = '' } }
|
|# =====================================================================================================================
|#  The catalog -- PURE (reads one shipped file)
|# =====================================================================================================================
|function Get-SIGuardCatalog {
|    <# The closed list of guards (config\guard-catalog.locked.json): outcomes, severity per outcome, guards. Cached. #>
|    param([string]$SIRoot = $script:SIGuard.SIRoot, [switch]$Refresh)
|    if ($script:SIGuard.Catalog -and -not $Refresh -and -not $PSBoundParameters.ContainsKey('SIRoot')) { return $script:SIGuard.Catalog }
|    $p = [System.IO.Path]::Combine($SIRoot, 'config', 'guard-catalog.locked.json')
|    $c = ConvertFrom-Json -InputObject ([System.IO.File]::ReadAllText($p))
|    if (-not $PSBoundParameters.ContainsKey('SIRoot')) { $script:SIGuard.Catalog = $c }
|    $c
|}
|
|function Get-SIGuardDefinition {
|    <# The catalog entry of one guard id; throws for an id that is not listed (a guard must be listed on purpose). #>
|    param([Parameter(Mandatory)][string]$Id)
|    $g = @((Get-SIGuardCatalog).guards | Where-Object { [string]$_.id -eq $Id }) | Select-Object -First 1
|    if (-not $g) { throw ("guard '{0}' is not in config\guard-catalog.locked.json" -f $Id) }
|    $g
|}
|
|function Get-SIGuardSeverity {
|    <# PURE. halted / refused = critical (the step did not happen); held / skipped / warning = warning. #>
|    param([Parameter(Mandatory)][string]$Outcome)
|    switch ($Outcome) {
|        'halted'  { return 'critical' }
|        'refused' { return 'critical' }
|        'held'    { return 'warning' }
|        'skipped' { return 'warning' }
|        'warning' { return 'warning' }
|    }
|    throw ("'{0}' is not a guard outcome (halted, refused, held, skipped, warning)" -f $Outcome)
|}
|
|# =====================================================================================================================
|#  Settings -- PURE over the values handed in
|# =====================================================================================================================
|function Test-SIGuardFlag {
|    <# PURE. A switch setting: the setting wins when set, then the environment value, else -Default. false/0/off/no = off. #>
|    param([AllowNull()]$Value, [AllowNull()][AllowEmptyString()][string]$EnvValue, [bool]$Default = $true)
|    foreach ($v in @($Value, $EnvValue)) {
|        if ($null -eq $v) { continue }
|        if ($v -is [bool]) { return $v }
|        $s = ([string]$v).Trim().Trim('$').ToLowerInvariant()
|        if (-not $s) { continue }
|        return -not ($s -in @('false', '0', 'off', 'no', 'disabled'))
|    }
|    $Default
|}
|
|function Get-SIGuardSetting {
|    <# One setting: -Globals (a test's hashtable) when given, else the live global. #>
|    param([Parameter(Mandatory)][string]$Name, [System.Collections.IDictionary]$Globals)
|    if ($Globals) { if ($Globals.Contains($Name)) { return $Globals[$Name] }; return $null }
|    Get-Variable -Name $Name -Scope Global -ValueOnly -ErrorAction SilentlyContinue
|}
|
|function Test-SIGuardMailEnabled {
|    param([System.Collections.IDictionary]$Globals)
|    $envV = if ($Globals) { $null } else { $env:SI_GUARDMAIL_ENABLED }
|    Test-SIGuardFlag -Value (Get-SIGuardSetting -Name 'SI_GuardMail_Enabled' -Globals $Globals) -EnvValue $envV -Default $true
|}
|
|# =====================================================================================================================
|#  #414 -- THE GUARD SWITCHES (operator, 2026-10-06: "give me settings for ALL gates, so I can turn them off and fine
|#  tune them"). Every guard in config\guard-catalog.locked.json has two settings, both ON by default:
|#    SI_Guard_<Token>_Enabled   off = the guard does not hold, refuse or halt: it logs ONE line "guard <id> is off
|#                               (setting ...)" and the step goes on as if it had not tripped (no event, no mail). For a
|#                               guard whose stop is not SecurityInsight's own choice (the source failed, the data has no
|#                               key, the licence) off means: no event and no mail -- the catalog's 'whenOff' says which,
|#                               in plain words, and the Settings page shows it.
|#    SI_Guard_<Token>_Mail      off = the event is still recorded (Guards page, run health, audit), but not mailed.
|#  plus ONE master switch SI_Guards_Enabled (off = every guard is off). <Token> = the id in PascalCase
|#  ('vuln.connector.close-ceiling' -> 'VulnConnectorCloseCeiling'). Pro: the Settings page (cfg.Setting -> $global:);
|#  Community / VM: the same names in the configuration file.
|# =====================================================================================================================
|function ConvertTo-SIGuardSettingToken {
|    <# PURE. 'vuln.connector.close-ceiling' -> 'VulnConnectorCloseCeiling'. #>
|    param([Parameter(Mandatory)][string]$GuardId)
|    (@($GuardId -split '[.\-]' | Where-Object { $_ } | ForEach-Object { $_.Substring(0, 1).ToUpperInvariant() + $_.Substring(1) })) -join ''
|}
|
|function Get-SIGuardSwitchNames {
|    <# PURE. The setting names of one guard's switches. #>
|    param([Parameter(Mandatory)][string]$GuardId)
|    $t = ConvertTo-SIGuardSettingToken -GuardId $GuardId
|    [pscustomobject]@{ Master = 'SI_Guards_Enabled'; Enabled = ('SI_Guard_{0}_Enabled' -f $t); Mail = ('SI_Guard_{0}_Mail' -f $t) }
|}
|
|function Test-SIGuardDefaultOn {
|    <#
|        #448 (operator 2026-10-07: "turn off these in all env worldwide" -- "people are pissed of all these stupid blockers"):
|        a guard is ON by default unless the catalog marks it "defaultOff": true. Those guards (a report that shrank, a
|        collection of a not-complete run, the vulnerability connector after a not-complete run) neither hold, refuse nor
|        mail until an install switches them ON (SI_Guard_<Token>_Enabled = true). Unreadable catalog: on (never throws).
|    #>
|    param([Parameter(Mandatory)][string]$GuardId)
|    try {
|        $g = @((Get-SIGuardCatalog).guards | Where-Object { [string]$_.id -eq $GuardId }) | Select-Object -First 1
|        return -not ($g -and $g.PSObject.Properties['defaultOff'] -and [bool]$g.defaultOff)
|    } catch { return $true }
|}
|function Test-SIGuardOn {
|    <#
|        Is this guard on? The master switch (SI_Guards_Enabled, env SI_GUARDS_ENABLED) AND the guard's own
|        SI_Guard_<Token>_Enabled; the master defaults ON, a guard ON unless the catalog marks it "defaultOff". A guard that is
|        off says so ONCE per process per guard, in one line: "guard <id> is off (setting <name>) -- the step goes on without
|        it". That line is a WARN only when an install SWITCHED OFF a check that is on by default (or the master); a guard
|        that is off because the catalog default says so (nothing set) is INFO -- the guard relief (owner 2026-10-11) turned
|        all but two guards off by default, and 34 warnings a run would be noise. -Quiet says nothing. Never throws (on).
|    #>
|    param([Parameter(Mandatory)][string]$GuardId, [System.Collections.IDictionary]$Globals, [scriptblock]$Log, [switch]$Quiet)
|    try {
|        $n = Get-SIGuardSwitchNames -GuardId $GuardId
|        $envM = if ($Globals) { $null } else { $env:SI_GUARDS_ENABLED }
|        $master = Test-SIGuardFlag -Value (Get-SIGuardSetting -Name $n.Master -Globals $Globals) -EnvValue $envM -Default $true
|        $ownValue = Get-SIGuardSetting -Name $n.Enabled -Globals $Globals
|        $defaultOn = Test-SIGuardDefaultOn -GuardId $GuardId
|        $own = Test-SIGuardFlag -Value $ownValue -Default $defaultOn
|        if ($master -and $own) { return $true }
|        if (-not $Quiet) {
|            if ($null -eq $global:SI_GuardOffSaid) { $global:SI_GuardOffSaid = @{} }
|            if (-not $global:SI_GuardOffSaid.ContainsKey($GuardId)) {
|                $global:SI_GuardOffSaid[$GuardId] = $true
|                # the guard's own switch is set (an empty value = not set)
|                $explicit = -not ($null -eq $ownValue -or ($ownValue -isnot [bool] -and -not ([string]$ownValue).Trim().Trim('$')))
|                $line = if ((-not $master) -or $explicit) { 'guard {0} is off (setting {1}) -- the step goes on without it' -f $GuardId, $(if (-not $master) { $n.Master } else { $n.Enabled }) }
|                        else { 'guard {0} is off by default (switch it on with {1}) -- the step goes on without it' -f $GuardId, $n.Enabled }
|                # WARN only when a protection that is on by default was switched off (the master, or a default-on guard's switch).
|                # The caller's -Log failing never changes the answer: it was caught below as "on" -- a guard that is OFF read
|                # as on (the SQL CMDB run of 2026-10-22: its logger recursed until the call depth overflowed)
|                $warnLine = ((-not $master) -or ($explicit -and $defaultOn))
|                try {
|                    if ($warnLine) { if ($Log) { & $Log 'WARN' $line } else { Write-Warning $line } }
|                    elseif ($Log) { & $Log 'INFO' $line } else { Write-Verbose $line }
|                } catch { Write-Warning ('{0} (the step''s log could not take this line: {1})' -f $line, $_.Exception.Message) }
|            }
|        }
|        return $false
|    } catch { return $true }
|}
|
|function Test-SIGuardMailOn {
|    <#
|        The guard's own mail switch SI_Guard_<Token>_Mail. Not set = it follows the guard: on while the guard is on (a
|        default-off guard an install switches on mails without a second switch), off while it is off. The install-wide
|        SI_GuardMail_Enabled is separate.
|    #>
|    param([Parameter(Mandatory)][string]$GuardId, [System.Collections.IDictionary]$Globals)
|    try { Test-SIGuardFlag -Value (Get-SIGuardSetting -Name (Get-SIGuardSwitchNames -GuardId $GuardId).Mail -Globals $Globals) -Default (Test-SIGuardOn -GuardId $GuardId -Globals $Globals -Quiet) } catch { $true }
|}
|
|function Get-SIGuardOffList {
|    <# The ids of the guards that are off now (for a PURE planner that takes -GuardsOff). Each is said once (Test-SIGuardOn). #>
|    param([string[]]$GuardIds, [System.Collections.IDictionary]$Globals, [scriptblock]$Log)
|    $ids = if ($GuardIds) { $GuardIds } else { @((Get-SIGuardCatalog).guards | ForEach-Object { [string]$_.id }) }
|    @($ids | Where-Object { -not (Test-SIGuardOn -GuardId $_ -Globals $Globals -Log $Log) })
|}
|
|function Get-SIGuardCauseKey {
|    <# PURE. A short stable hash of one cause (SHA-256, first 16 hex characters), for Send-SIGuardEvent -CauseKeys. #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $b = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Text.Trim().ToLowerInvariant())) } finally { $sha.Dispose() }
|    (-join @($b | Select-Object -First 8 | ForEach-Object { $_.ToString('x2') }))
|}
|
|function Split-SIGuardAddresses {
|    <# PURE. A list, or text separated by ',' or ';' -> the addresses (something@something), trimmed, each once. #>
|    param([AllowNull()]$Value)
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($v in @($Value)) {
|        if ($null -eq $v) { continue }
|        foreach ($p in ("$v" -split '[,;]')) {
|            $t = $p.Trim()
|            if ($t -match '^[^@\s]+@[^@\s]+$' -and -not ($out -contains $t)) { $out.Add($t) }
|        }
|    }
|    # unrolled on purpose: callers wrap the call in @() (one address stays a one-element list, none an empty one)
|    $out.ToArray()
|}
|
|function Get-SIGuardMailRecipients {
|    <#
|        PURE. Who the guard mails go to: SI_GuardMail_To, else the install's report recipients (MailTo), else the Pro
|        SuperAdmins' mail addresses (-SuperAdminMails). Returns @{ To; Source }.
|    #>
|    param([System.Collections.IDictionary]$Globals, [AllowNull()][string[]]$SuperAdminMails)
|    $to = @(Split-SIGuardAddresses (Get-SIGuardSetting -Name 'SI_GuardMail_To' -Globals $Globals))
|    if ($to.Count) { return [pscustomobject]@{ To = $to; Source = 'SI_GuardMail_To' } }
|    $to = @(Split-SIGuardAddresses (Get-SIGuardSetting -Name 'MailTo' -Globals $Globals))
|    if ($to.Count) { return [pscustomobject]@{ To = $to; Source = 'MailTo' } }
|    $to = @(Split-SIGuardAddresses $SuperAdminMails)
|    if ($to.Count) { return [pscustomobject]@{ To = $to; Source = 'SuperAdmins' } }
|    [pscustomobject]@{ To = @(); Source = '' }
|}
|
|function Get-SIGuardSmtp {
|    <#
|        PURE. How SecurityInsight sends -- the ONE mail setting set every mail uses (Get-SIMailSettings, MAIL-1):
|        SI_Mail_Mode (sharedMailbox | smtp | none), SI_Mail_From, and for smtp SmtpServer, SMTPPort, SMTP_UseSSL,
|        SMTPFrom / MailFrom / SMTPUser, SMTPUser + SMTPPassword or SecureCredentialsSMTP, Mail_SendAnonymous.
|        Kept here by name so a Community install, which does not ship the Pro close-loop mail, mails its guards too.
|        Returns @{ Mode; Off; Server; Port; UseSsl; From; Anonymous; User; Password; SharedMailbox; Problems; ... }.
|    #>
|    param([System.Collections.IDictionary]$Globals)
|    Get-SIMailSettings -Globals $Globals
|}
|
|# =====================================================================================================================
|#  The event -- PURE
|# =====================================================================================================================
|function ConvertTo-SIGuardNumber {
|    <# PURE. A measured value / limit as a number ($null when it is not one). Whole numbers stay [long]. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or "$Value".Trim() -eq '') { return $null }
|    $d = 0.0
|    if (-not [double]::TryParse(("$Value".Trim() -replace '%$', ''), [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $null }
|    if ([double]::IsNaN($d) -or [double]::IsInfinity($d)) { return $null }
|    if ($d -eq [Math]::Floor($d) -and [Math]::Abs($d) -lt 9e15) { return [long]$d }
|    [Math]::Round($d, 4)
|}
|
|function New-SIGuardEvent {
|    <#
|        PURE. One guard event, checked against the catalog. -Values: @( @{ Name = 'closeShare'; Label = 'Share of open
|        records to close'; Measured = 25.9; Limit = 10; Unit = '%' }, ... ) -- Name is camelCase (it becomes a telemetry
|        field), Label is what a person reads. -Subject names WHICH connector / report / job (never sent anonymously).
|        -Detail is one plain sentence of what happened (never sent anonymously). -Action overrides the catalog's text.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$GuardId,
|        [Parameter(Mandatory)][string]$Outcome,
|        [string]$Engine, [string]$Job, [string]$Subject, [string]$Detail,
|        [object[]]$Values = @(), [long]$HeldCount = 0, [string]$Action, [string]$Link,
|        [string]$RunId, [datetime]$NowUtc = [datetime]::UtcNow, [string]$Source = 'job'
|    )
|    if ($GuardId -notmatch $script:SIGuard.IdPattern) { throw ("'{0}' is not a guard id (area.object.what, lower-case)" -f $GuardId) }
|    $def = Get-SIGuardDefinition -Id $GuardId
|    $sev = Get-SIGuardSeverity -Outcome $Outcome
|    if ($script:SIGuard.Sources -notcontains $Source) { throw ("'{0}' is not a guard source ({1})" -f $Source, ($script:SIGuard.Sources -join ', ')) }
|    if ($HeldCount -lt 0) { $HeldCount = 0 }
|    $vals = New-Object System.Collections.Generic.List[object]
|    foreach ($v in @($Values)) {
|        if ($null -eq $v) { continue }
|        $name = [string]$(if ($v -is [System.Collections.IDictionary]) { $v['Name'] } else { $v.Name })
|        if ($name -notmatch $script:SIGuard.NamePattern) { throw ("guard value name '{0}' must be camelCase letters and digits (it is a telemetry field)" -f $name) }
|        $get = { param($k) if ($v -is [System.Collections.IDictionary]) { $v[$k] } elseif ($v.PSObject.Properties[$k]) { $v.$k } else { $null } }
|        $label = [string](& $get 'Label'); if (-not $label) { $label = $name }
|        $vo = [pscustomobject]@{ Name = $name; Label = $label; Measured = (ConvertTo-SIGuardNumber (& $get 'Measured')); Limit = (ConvertTo-SIGuardNumber (& $get 'Limit')); Unit = [string](& $get 'Unit') }
|        # CR4 (#654): a limit halved in the stricter period after a release carries the configured one beside it
|        $cfgL = ConvertTo-SIGuardNumber (& $get 'Configured')
|        if ($null -ne $cfgL -and $null -ne $vo.Limit) { $vo | Add-Member -NotePropertyName Configured -NotePropertyValue $cfgL }
|        $vals.Add($vo)
|    }
|    $job = if ($Job) { $Job } elseif ([string]$def.job) { [string]$def.job } elseif ($Engine -and (Get-Command -Name Resolve-SITelemetryJob -ErrorAction SilentlyContinue)) { [string](Resolve-SITelemetryJob -Engine $Engine) } else { '' }
|    $sub = "$Subject".Trim(); if ($sub.Length -gt 400) { $sub = $sub.Substring(0, 400) }
|    $det = "$Detail".Trim(); if ($det.Length -gt 2000) { $det = $det.Substring(0, 2000) }
|    [pscustomobject]@{
|        GuardId   = $GuardId
|        GuardKey  = $(if ($sub) { $GuardId + '|' + $sub.ToLowerInvariant() } else { $GuardId })
|        Area      = [string]$def.area
|        Job       = $job
|        Engine    = [string]$Engine
|        Protected = [string]$def.protects
|        Subject   = $sub
|        Outcome   = $Outcome
|        Severity  = $sev
|        Values    = $vals.ToArray()
|        HeldCount = $HeldCount
|        Detail    = $det
|        Action    = $(if ($Action) { $Action } else { [string]$def.action })
|        Link      = [string]$Link
|        RunId     = $(if ($RunId) { $RunId } else { [string]$global:SI_GuardRunId })
|        Source    = $Source
|        TimeUtc   = $NowUtc.ToUniversalTime()
|    }
|}
|
|function Format-SIGuardNumber {
|    <# PURE. A number for a person: thousands grouped and decimals in -Culture (default: the install's number format, else
|       invariant). $null reads "unknown". #>
|    param([AllowNull()]$Value, [System.Globalization.CultureInfo]$Culture = [System.Globalization.CultureInfo]::InvariantCulture)
|    if ($null -eq $Value) { return 'unknown' }
|    if ($Value -is [long] -or $Value -is [int]) { return ([long]$Value).ToString('N0', $Culture) }
|    ([double]$Value).ToString('#,0.##', $Culture)
|}
|
|function Format-SIGuardValues {
|    <# PURE. "Label: 25.9 % (limit 10 %)" per value, joined by '; '. #>
|    param([object[]]$Values = @(), [System.Globalization.CultureInfo]$Culture = [System.Globalization.CultureInfo]::InvariantCulture)
|    $parts = foreach ($v in @($Values)) {
|        if ($null -eq $v) { continue }
|        $u = if ($v.Unit) { ' ' + $v.Unit } else { '' }
|        $t = '{0}: {1}{2}' -f $v.Label, (Format-SIGuardNumber $v.Measured $Culture), $(if ($null -ne $v.Measured) { $u } else { '' })
|        if ($null -ne $v.Limit) {
|            # CR4 (#654): the stricter period after a release -- the halved limit and the configured one, said calmly
|            if ($v.PSObject.Properties['Configured'] -and $null -ne $v.Configured -and $v.Configured -ne $v.Limit) {
|                $t += (' (limit {0}{2} in the stricter period after a release, normally {1}{2})' -f (Format-SIGuardNumber $v.Limit $Culture), (Format-SIGuardNumber $v.Configured $Culture), $u)
|            } else { $t += (' (limit {0}{1})' -f (Format-SIGuardNumber $v.Limit $Culture), $u) }
|        }
|        $t
|    }
|    (@($parts) -join '; ')
|}
|
|# =====================================================================================================================
|#  THE THREE PARTS (what happened / why / consequence + what to do) -- PURE, the catalog's templates filled from the event.
|#  The SAME rules as the web app (Guards\GuardText.cs): {held} {detail} {subject} {when} {latest} {v:<name>}; {x|text}
|#  uses text when x is empty; a [ ... ] part is left out when a placeholder in it is empty.
|# =====================================================================================================================
|function Format-SIGuardText {
|    <# PURE. One catalog template filled from -Fields (name -> text; an empty or missing name reads empty). #>
|    param([AllowEmptyString()][string]$Template, [hashtable]$Fields = @{})
|    if (-not $Template) { return '' }
|    $placeholder = '\{(held|detail|subject|when|latest|v:[A-Za-z0-9]+)(?:\|([^{}]*))?\}'
|    $fill = {
|        param([string]$s, [ref]$missing)
|        [regex]::Replace($s, $placeholder, {
|            param($m)
|            $v = [string]$Fields[$m.Groups[1].Value]
|            if ("$v".Trim()) { return "$v".Trim() }
|            if ($m.Groups[2].Success) { return $m.Groups[2].Value }
|            $missing.Value = $true
|            ''
|        })
|    }
|    $out = [regex]::Replace($Template, '\s?\[([^\[\]]*)\]', {
|        param($m)
|        $miss = $false
|        $inner = & $fill $m.Groups[1].Value ([ref]$miss)
|        if ($miss) { return '' }
|        $(if ($m.Value.StartsWith(' ')) { ' ' } else { '' }) + $inner
|    })
|    $none = $false
|    $out = & $fill $out ([ref]$none)
|    ConvertTo-SIGuardPlurals ([regex]::Replace($out, '\s{2,}', ' ')).Trim()
|}
|
|function ConvertTo-SIGuardPlurals {
|    <# PURE. Operator 2026-10-09 ("no (s) anywhere"): "1 job(s)" -> "1 job", "2 job(s)" -> "2 jobs", "report(s)" -> "reports"
|       -- the same rule as the web app (GuardText.Plurals), so the page and the mail say the same words. #>
|    param([AllowEmptyString()][string]$Text)
|    if (-not $Text -or $Text.IndexOf('(s)') -lt 0) { return $Text }
|    $many = { param([string]$w)
|        if ($w.Length -gt 1 -and $w.EndsWith('y') -and 'aeiou'.IndexOf([char]::ToLowerInvariant($w[$w.Length - 2])) -lt 0) { return $w.Substring(0, $w.Length - 1) + 'ies' }
|        if ($w.EndsWith('s') -or $w.EndsWith('x') -or $w.EndsWith('ch') -or $w.EndsWith('sh')) { return $w + 'es' }
|        $w + 's' }
|    $t = [regex]::Replace($Text, "(?<n>\d[\d,. ']*)\s+(?<w>[A-Za-z-]+)\(s\)", {
|        param($m)
|        $digits = (-join ($m.Groups['n'].Value.ToCharArray() | Where-Object { [char]::IsDigit($_) })).TrimStart('0')
|        $one = ($digits -eq '1') -and ($m.Groups['n'].Value.IndexOf('.') -lt 0)
|        $m.Groups['n'].Value + ' ' + $(if ($one) { $m.Groups['w'].Value } else { & $many $m.Groups['w'].Value })
|    })
|    [regex]::Replace($t, '(?<w>[A-Za-z-]+)\(s\)', { param($m) & $many $m.Groups['w'].Value })
|}
|
|function Get-SIGuardTextFields {
|    <# PURE. The placeholder values of one event: held, detail, subject, when, v:<name> (numbers in -Culture). -NoDetail
|       leaves out what never travels to Invardia (detail, subject). #>
|    param([Parameter(Mandatory)]$Event, [System.Globalization.CultureInfo]$Culture = [System.Globalization.CultureInfo]::InvariantCulture, [switch]$NoDetail)
|    $f = @{}
|    if ([long]$Event.HeldCount -gt 0) { $f['held'] = Format-SIGuardNumber ([long]$Event.HeldCount) $Culture }
|    if (-not $NoDetail) { $f['detail'] = [string]$Event.Detail; $f['subject'] = [string]$Event.Subject }
|    if ($Event.PSObject.Properties['TimeUtc'] -and $Event.TimeUtc) { $f['when'] = ('{0:yyyy-MM-dd HH:mm} UTC' -f ([datetime]$Event.TimeUtc)) }
|    foreach ($v in @($Event.Values)) { if ($v -and $null -ne $v.Measured) { $f['v:' + [string]$v.Name] = Format-SIGuardNumber $v.Measured $Culture } }
|    $f
|}
|
|function Get-SIGuardParts {
|    <#
|        PURE. The three parts a person reads -- What (what happened), Why (the cause of THIS event), Consequence (what the user
|        sees or misses) -- plus Steps (what to do) and Kind (what a release means), filled from the event. A guard listed
|        without them (an older catalog) falls back to its 'action' text as the one step.
|    #>
|    param([Parameter(Mandatory)]$Event, [System.Globalization.CultureInfo]$Culture = [System.Globalization.CultureInfo]::InvariantCulture, [switch]$NoDetail)
|    $def = Get-SIGuardDefinition -Id ([string]$Event.GuardId)
|    $get = { param([string]$n) if ($def.PSObject.Properties[$n]) { $def.$n } else { $null } }
|    $fields = Get-SIGuardTextFields -Event $Event -Culture $Culture -NoDetail:$NoDetail
|    $steps = @(@(& $get 'steps') | Where-Object { "$_".Trim() } | ForEach-Object { Format-SIGuardText -Template ([string]$_) -Fields $fields } | Where-Object { $_ })
|    if (-not $steps.Count) { $steps = @([string]$def.action) }
|    [pscustomobject]@{
|        Kind        = $(if (& $get 'kind') { [string](& $get 'kind') } else { 'info' })
|        What        = (Format-SIGuardText -Template ([string](& $get 'what')) -Fields $fields)
|        Why         = $(if ($NoDetail) { '' } else { Format-SIGuardText -Template ([string](& $get 'why')) -Fields $fields })
|        Consequence = (Format-SIGuardText -Template ([string](& $get 'consequence')) -Fields $fields)
|        IfRelease   = (Format-SIGuardText -Template ([string](& $get 'ifRelease')) -Fields $fields)
|        Steps       = $steps
|    }
|}
|
|function Format-SIGuardSteps {
|    <# PURE. Numbered steps as one line: "1. ... 2. ..." #>
|    param([string[]]$Steps = @())
|    $i = 0
|    (@($Steps | Where-Object { "$_".Trim() } | ForEach-Object { $i++; '{0}. {1}' -f $i, "$_".Trim() }) -join ' ')
|}
|
|function Get-SIGuardWhere {
|    <# PURE. WHERE a guard event happened, in plain words: the job (else the engine) and what it was about (the report,
|       connector, asset or jobs the caller named). "" only when the event names neither. #>
|    param([Parameter(Mandatory)]$Event)
|    $job = if ("$($Event.Job)".Trim()) { "$($Event.Job)".Trim() } elseif ("$($Event.Engine)".Trim()) { "$($Event.Engine)".Trim() } else { '' }
|    $sub = "$($Event.Subject)".Trim()
|    $parts = @()
|    if ($job) { $parts += ('job {0}' -f $job) }
|    if ($sub -and $sub -ine $job) { $parts += $sub }
|    ($parts -join ', ')
|}
|
|function Format-SIGuardSummary {
|    <#
|        PURE. ONE plain line a person can act on (#425: "the context is so poor that nobody knows"): WHAT happened, WHERE
|        (job and report / connector / asset), the NUMBERS (measured against the limit, how many were held) and WHAT TO DO.
|        The same words as the Guards page and the mail (the catalog's parts); used for the run log and the run-health record.
|    #>
|    param([Parameter(Mandatory)]$Event, [System.Globalization.CultureInfo]$Culture = [System.Globalization.CultureInfo]::InvariantCulture)
|    $parts = $null; try { $parts = Get-SIGuardParts -Event $Event -Culture $Culture } catch { $parts = $null }
|    $what = if ($parts -and $parts.What) { $parts.What } elseif ("$($Event.Detail)".Trim()) { "$($Event.Detail)".Trim() } else { 'SecurityInsight protected {0}.' -f $Event.Protected }
|    $out = New-Object System.Collections.Generic.List[string]
|    $out.Add(($what.TrimEnd('.') + '.'))
|    # the cause of THIS event when the catalog's sentence did not already carry it
|    if ("$($Event.Detail)".Trim() -and $what.IndexOf("$($Event.Detail)".Trim(), [StringComparison]::OrdinalIgnoreCase) -lt 0) {
|        $out.Add(('Cause: {0}' -f ("$($Event.Detail)".Trim().TrimEnd('.') + '.')))
|    }
|    $where = Get-SIGuardWhere -Event $Event
|    if ($where) { $out.Add(('Where: {0}.' -f $where)) }
|    $nums = New-Object System.Collections.Generic.List[string]
|    $vals = Format-SIGuardValues -Values @($Event.Values) -Culture $Culture
|    if ($vals) { $nums.Add($vals) }
|    if ([long]$Event.HeldCount -gt 0) { $nums.Add(('{0} held' -f (Format-SIGuardNumber ([long]$Event.HeldCount) $Culture))) }
|    if ($nums.Count) { $out.Add(('Numbers: {0}.' -f ($nums -join '; '))) }
|    # CR4 (#654): the stricter period after a release, in one calm clause
|    if ($Event.PSObject.Properties['Strict'] -and $Event.Strict) {
|        $sv = "$($Event.Strict.Version)".Trim(); $su = if (Get-Command -Name Format-SIGuardStrictUntil -ErrorAction SilentlyContinue) { Format-SIGuardStrictUntil $Event.Strict.Until } else { '' }
|        $out.Add(('Stricter period{0}{1}: the limit is halved for 24 hours after a release that changed the engine, as planned.' -f $(if ($sv) { ' after release ' + $sv } else { ' after a release' }), $(if ($su) { ' until ' + $su } else { '' })))
|    }
|    $def = $null; try { $def = Get-SIGuardDefinition -Id ([string]$Event.GuardId) } catch { }
|    $own = $def -and "$($Event.Action)".Trim() -and [string]$Event.Action -ne [string]$def.action
|    $todo = if ($parts -and @($parts.Steps).Count -and -not $own) { Format-SIGuardSteps -Steps $parts.Steps } else { "$($Event.Action)".Trim() }
|    if ($todo) { $out.Add(('What to do: {0}' -f $todo)) }
|    ConvertTo-SIGuardPlurals (($out -join ' ') -replace '\.\.', '.')
|}
|
|function Get-SIGuardTelemetryKey {
|    <# PURE. The de-duplication key Invardia's receiver uses per install: the guard id, plus a short hash of the subject when
|       there is one (the hash names no connector / report; two subjects of one guard stay two tickets). #>
|    param([Parameter(Mandatory)]$Event)
|    if (-not $Event.Subject) { return [string]$Event.GuardId }
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $h = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes(([string]$Event.Subject).ToLowerInvariant())) } finally { $sha.Dispose() }
|    ('{0}#{1}' -f $Event.GuardId, (-join ($h[0..5] | ForEach-Object { $_.ToString('x2') })))
|}
|
|# =====================================================================================================================
|#  De-duplication -- PURE decision + three stores
|# =====================================================================================================================
|function ConvertTo-SIGuardUtc {
|    <# PURE. A stored time as UTC, or $null (null, DBNull, empty, not a time). A text without a zone is read AS UTC. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -is [System.DBNull] -or "$Value".Trim() -eq '') { return $null }
|    if ($Value -is [datetime]) { if ($Value.Kind -eq [DateTimeKind]::Local) { return $Value.ToUniversalTime() }; return [datetime]::SpecifyKind($Value, [DateTimeKind]::Utc) }
|    $d = [datetime]::MinValue
|    $styles = [System.Globalization.DateTimeStyles]::AssumeUniversal -bor [System.Globalization.DateTimeStyles]::AdjustToUniversal
|    if ([datetime]::TryParse("$Value", [System.Globalization.CultureInfo]::InvariantCulture, $styles, [ref]$d)) { return $d }
|    $null
|}
|
|function Get-SIGuardTenantTag {
|    <# PURE over the settings. The tenant as the mail shows it, from what the run already knows (never a network call). #>
|    param([System.Collections.IDictionary]$Globals)
|    foreach ($n in 'TenantShort', 'TenantNameOrganization', 'SI_TenantDisplayName') {
|        $v = "$(Get-SIGuardSetting -Name $n -Globals $Globals)".Trim(); if ($v) { return $v }
|    }
|    ''
|}
|
|function Get-SIGuardTripState {
|    <#
|        PURE. The trip's place in its episode. -Previous: @{ FirstSeenUtc; LastSeenUtc; TripCount; LastMailUtc } or $null.
|        A trip more than -WindowHours after the last one starts a NEW episode (count 1, mail). Within the window the count
|        goes up; a mail goes out only when the last mail is at least -WindowHours old ("still tripping, N times").
|        -MailEnabled $false never mails and keeps LastMailUtc. Returns @{ FirstSeenUtc; LastSeenUtc; TripCount; LastMailUtc;
|        Mail; StillTripping }.
|    #>
|    param([AllowNull()]$Previous, [Parameter(Mandatory)][datetime]$NowUtc, [int]$WindowHours = 24, [bool]$MailEnabled = $true)
|    $now = $NowUtc.ToUniversalTime()
|    $t = { param($v) ConvertTo-SIGuardUtc $v }
|    $prevLast = $null; $prevFirst = $null; $prevMail = $null; $prevCount = 0
|    if ($Previous) {
|        $prevLast = & $t $Previous.LastSeenUtc; $prevFirst = & $t $Previous.FirstSeenUtc; $prevMail = & $t $Previous.LastMailUtc
|        $n = 0; if ([int]::TryParse("$($Previous.TripCount)", [ref]$n)) { $prevCount = $n }
|    }
|    # a guard that CLEARED (a later complete run was back at the normal level, or it was accepted) starts a new episode
|    $prevCleared = $null
|    if ($Previous -and $Previous.PSObject.Properties['ClearedUtc']) { $prevCleared = & $t $Previous.ClearedUtc }
|    elseif ($Previous -is [System.Collections.IDictionary] -and $Previous.Contains('ClearedUtc')) { $prevCleared = & $t $Previous['ClearedUtc'] }
|    $newEpisode = ($null -eq $prevLast) -or (($now - $prevLast).TotalHours -gt $WindowHours) -or ($prevCleared -and $prevCleared -ge $prevLast)
|    if ($newEpisode) {
|        $mail = [bool]$MailEnabled
|        return [pscustomobject]@{ FirstSeenUtc = $now; LastSeenUtc = $now; TripCount = 1; LastMailUtc = $(if ($mail) { $now } else { $null }); Mail = $mail; StillTripping = $false }
|    }
|    $count = $prevCount + 1
|    $first = if ($prevFirst) { $prevFirst } else { $prevLast }
|    $mail = [bool]$MailEnabled -and (($null -eq $prevMail) -or (($now - $prevMail).TotalHours -ge $WindowHours))
|    [pscustomobject]@{ FirstSeenUtc = $first; LastSeenUtc = $now; TripCount = $count; LastMailUtc = $(if ($mail) { $now } else { $prevMail }); Mail = $mail; StillTripping = $true }
|}
|
|function New-SIGuardMemoryStateStore {
|    <# A state store in memory (tests; a container without a disk or a database). #>
|    $h = @{}
|    [pscustomobject]@{
|        Kind = 'memory'
|        Get  = { param([string]$Key) if ($h.ContainsKey($Key)) { $h[$Key] } else { $null } }.GetNewClosure()
|        # every field of the state is kept (the episode's four, and the version / clear fields of SI-GuardHeal.ps1)
|        Set  = { param([string]$Key, [string]$GuardId, $State)
|                 $o = [ordered]@{ FirstSeenUtc = $State.FirstSeenUtc; LastSeenUtc = $State.LastSeenUtc; TripCount = $State.TripCount; LastMailUtc = $State.LastMailUtc }
|                 if ($State -is [System.Collections.IDictionary]) { foreach ($k in @($State.Keys)) { if (-not $o.Contains([string]$k)) { $o[[string]$k] = $State[$k] } } }
|                 else { foreach ($p in @($State.PSObject.Properties)) { if (-not $o.Contains($p.Name) -and $p.Name -notin 'Mail', 'StillTripping') { $o[$p.Name] = $p.Value } } }
|                 $h[$Key] = [pscustomobject]$o }.GetNewClosure()
|    }
|}
|
|function Get-SIGuardStateDirectory {
|    <# SI_GUARD_STATE_DIR, else %ProgramData%\SecurityInsight\guards on Windows, else ~/.securityinsight/guards. #>
|    $d = [string]$env:SI_GUARD_STATE_DIR
|    if ($d.Trim()) { return $d.Trim() }
|    if ([Environment]::OSVersion.Platform -eq [PlatformID]::Win32NT) {
|        return [System.IO.Path]::Combine([Environment]::GetFolderPath('CommonApplicationData'), 'SecurityInsight', 'guards')
|    }
|    $h = [Environment]::GetFolderPath('UserProfile'); if (-not $h) { $h = [System.IO.Path]::GetTempPath() }
|    [System.IO.Path]::Combine($h, '.securityinsight', 'guards')
|}
|
|function New-SIGuardFileStateStore {
|    <# A state store in one JSON file (<dir>\guard-state.json): guard key -> state. A file that cannot be read starts empty. #>
|    param([Parameter(Mandatory)][string]$Directory)
|    $file = [System.IO.Path]::Combine($Directory, 'guard-state.json')
|    # a closure (GetNewClosure) cannot see script-scope functions: the one it needs is captured
|    $toUtc = ${function:ConvertTo-SIGuardUtc}
|    $read = {
|        $m = @{}
|        try {
|            if ([System.IO.File]::Exists($file)) {
|                $o = ConvertFrom-Json -InputObject ([System.IO.File]::ReadAllText($file))
|                foreach ($p in @($o.PSObject.Properties)) { $m[$p.Name] = $p.Value }
|            }
|        } catch { }
|        $m
|    }.GetNewClosure()
|    [pscustomobject]@{
|        Kind = 'file'
|        Path = $file
|        Get  = { param([string]$Key) $m = & $read; if ($m.ContainsKey($Key)) { $m[$Key] } else { $null } }.GetNewClosure()
|        Set  = {
|            param([string]$Key, [string]$GuardId, $State)
|            $m = & $read
|            $iso = { param($v) $u = & $toUtc $v; if ($null -eq $u) { $null } else { $u.ToString('o', [System.Globalization.CultureInfo]::InvariantCulture) } }
|            $m[$Key] = [ordered]@{ GuardId = $GuardId; FirstSeenUtc = (& $iso $State.FirstSeenUtc); LastSeenUtc = (& $iso $State.LastSeenUtc); TripCount = [int]$State.TripCount; LastMailUtc = (& $iso $State.LastMailUtc) }
|            # the version / clear fields (SI-GuardHeal.ps1), when the state carries them
|            foreach ($xn in 'Version', 'PreviousVersion', 'FirstRunId', 'MarkerKind', 'ClearedRunId', 'ClearedVersion', 'ClearedHow') {
|                $xv = if ($State -is [System.Collections.IDictionary]) { $State[$xn] } elseif ($State.PSObject.Properties[$xn]) { $State.$xn } else { $null }
|                if ($null -ne $xv -and "$xv" -ne '') { $m[$Key][$xn] = [string]$xv }
|            }
|            $xc = if ($State -is [System.Collections.IDictionary]) { $State['ClearedUtc'] } elseif ($State.PSObject.Properties['ClearedUtc']) { $State.ClearedUtc } else { $null }
|            if ($null -ne $xc -and "$xc" -ne '') { $m[$Key]['ClearedUtc'] = (& $iso $xc) }
|            # keep the file small: episodes older than 30 days are dropped
|            $keep = [ordered]@{}
|            foreach ($k in @($m.Keys | Sort-Object)) {
|                $ls = $m[$k].LastSeenUtc
|                $age = 0; try { $age = ([datetime]::UtcNow - ([datetime]$ls).ToUniversalTime()).TotalDays } catch { $age = 0 }
|                if ($age -le 30) { $keep[$k] = $m[$k] }
|            }
|            $null = [System.IO.Directory]::CreateDirectory([System.IO.Path]::GetDirectoryName($file))
|            [System.IO.File]::WriteAllText($file, (ConvertTo-Json -InputObject $keep -Depth 4))
|        }.GetNewClosure()
|    }
|}
|
|function Get-SIGuardSql {
|    <# The guard statements against the Pro database (sql\si-pro-settings.sql: cfg.GuardEvent, cfg.GuardState). #>
|    param([Parameter(Mandatory)][ValidateSet('Exists', 'StateGet', 'StateSet', 'Insert', 'SuperAdmins', 'OutboxRead', 'OutboxMark')][string]$Name)
|    switch ($Name) {
|        'Exists' { "SELECT CASE WHEN OBJECT_ID(N'cfg.GuardEvent') IS NOT NULL AND OBJECT_ID(N'cfg.GuardState') IS NOT NULL THEN 1 ELSE 0 END AS HasGuards;" }
|        # every column: the episode's four, and the version / clear columns where the database has them (SI-GuardHeal.ps1)
|        'StateGet' { "SELECT TOP (1) * FROM cfg.GuardState WHERE GuardKey = @GuardKey;" }
|        'StateSet' { @'
|MERGE cfg.GuardState WITH (HOLDLOCK) AS t
|USING (SELECT @GuardKey AS GuardKey) AS s ON t.GuardKey = s.GuardKey
|WHEN MATCHED THEN UPDATE SET GuardId = @GuardId, FirstSeenUtc = @FirstSeenUtc, LastSeenUtc = @LastSeenUtc, TripCount = @TripCount, LastMailUtc = @LastMailUtc
|WHEN NOT MATCHED THEN INSERT (GuardKey, GuardId, FirstSeenUtc, LastSeenUtc, TripCount, LastMailUtc)
|     VALUES (@GuardKey, @GuardId, @FirstSeenUtc, @LastSeenUtc, @TripCount, @LastMailUtc);
|'@ }
|        'Insert' { @'
|INSERT cfg.GuardEvent (GuardId, GuardKey, Area, Job, Engine, Source, Outcome, Severity, Protected, Subject, Detail, MeasuredText, ValuesJson,
|                       HeldCount, ActionText, Link, RunId, TripCount, FirstSeenUtc, MailState, MailTo, TelemetryState)
|VALUES (@GuardId, @GuardKey, @Area, @Job, @Engine, @Source, @Outcome, @Severity, @Protected, @Subject, @Detail, @MeasuredText, @ValuesJson,
|        @HeldCount, @ActionText, @Link, @RunId, @TripCount, @FirstSeenUtc, @MailState, @MailTo, @TelemetryState);
|SELECT CAST(SCOPE_IDENTITY() AS BIGINT) AS Id;
|'@ }
|        'SuperAdmins' { "IF OBJECT_ID(N'cfg.AccessAssignment') IS NULL SELECT CAST(NULL AS NVARCHAR(256)) AS Mail WHERE 1 = 0; ELSE SELECT DisplayName AS Mail FROM cfg.AccessAssignment WHERE Role = N'SuperAdmin' AND PrincipalType = N'User' AND DisplayName LIKE N'%_@_%';" }
|        'OutboxRead' { "SELECT TOP (50) Id, TsUtc, GuardId, GuardKey, Area, Job, Engine, Source, Outcome, Severity, Subject, Detail, ValuesJson, HeldCount, ActionText, Link, RunId, MailState, TelemetryState FROM cfg.GuardEvent WHERE MailState = N'pending' OR TelemetryState = N'pending' ORDER BY Id;" }
|        'OutboxMark' { "UPDATE cfg.GuardEvent SET MailState = @MailState, MailTo = COALESCE(@MailTo, MailTo), TelemetryState = @TelemetryState, TripCount = COALESCE(@TripCount, TripCount), FirstSeenUtc = COALESCE(@FirstSeenUtc, FirstSeenUtc) WHERE Id = @Id;" }
|    }
|}
|
|function New-SIGuardSqlStateStore {
|    <# A state store in the Pro database (cfg.GuardState), over the (sql, params, mode) seam every Pro engine has. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke)
|    $inv = $Invoke
|    $getSql = Get-SIGuardSql 'StateGet'; $setSql = Get-SIGuardSql 'StateSet'   # captured: a closure cannot see script-scope functions
|    # the version / clear fields of SI-GuardHeal.ps1, written only where the database has their columns
|    $extraSql = if (Get-Command -Name Get-SIGuardHealSql -ErrorAction SilentlyContinue) { Get-SIGuardHealSql 'StateExtra' } else { '' }
|    [pscustomobject]@{
|        Kind = 'sql'
|        Get  = { param([string]$Key) $rows = @(& $inv $getSql @{ GuardKey = $Key } 'reader'); if ($rows.Count -and $rows[0]) { $rows[0] } else { $null } }.GetNewClosure()
|        Set  = { param([string]$Key, [string]$GuardId, $State)
|                 $null = & $inv $setSql @{ GuardKey = $Key; GuardId = $GuardId; FirstSeenUtc = $State.FirstSeenUtc; LastSeenUtc = $State.LastSeenUtc; TripCount = [int]$State.TripCount; LastMailUtc = $State.LastMailUtc } 'nonquery'
|                 if ($extraSql) {
|                     $x = @{ GuardKey = $Key }
|                     foreach ($n in 'Version', 'PreviousVersion', 'FirstRunId', 'MarkerKind', 'ClearedUtc', 'ClearedRunId', 'ClearedVersion', 'ClearedHow') {
|                         $v = if ($State -is [System.Collections.IDictionary]) { $State[$n] } elseif ($State.PSObject.Properties[$n]) { $State.$n } else { $null }
|                         if ($v -is [string]) { $v = $v.Trim(); if ($v.Length -gt 64) { $v = $v.Substring(0, 64) }; if (-not $v) { $v = $null } }
|                         $x[$n] = $v
|                     }
|                     $null = & $inv $extraSql $x 'nonquery'
|                 } }.GetNewClosure()
|    }
|}
|
|# =====================================================================================================================
|#  The mail -- PURE
|# =====================================================================================================================
|# owner 2026-10-11 ("dont stop my business with unnecessary guards"; a warn-only check mailed "action needed"): a check that
|# only WARNS (it held, stopped or refused nothing) sends no mail -- it is recorded, shown on the Guards page and in the run
|# report. A mail means something was stopped or held. The one exception: the licence grace period, which needs a renewal.
|# #937 (owner 2026-10-28, "Stop the mail"): a check whose catalog entry says "mail": "never" sends no mail whatever its
|# outcome -- collection.source.asset-drop accepts a real drop by itself on the next complete collection, so its mail asked
|# nothing of anyone. Its event, the Guards page, the run report and the report to Invardia are unchanged.
|$script:SIGuardWarningMails = @('licence.state.grace')
|function Test-SIGuardNeverMails {
|    <# PURE over the catalog. Does the guard's catalog entry say "mail": "never"? Unknown id / unreadable catalog: $false. #>
|    param([AllowNull()][AllowEmptyString()][string]$GuardId)
|    if (-not "$GuardId".Trim()) { return $false }
|    try {
|        $g = @((Get-SIGuardCatalog).guards | Where-Object { [string]$_.id -eq $GuardId }) | Select-Object -First 1
|        return [bool]($g -and $g.PSObject.Properties['mail'] -and ([string]$g.mail -ieq 'never'))
|    } catch { return $false }
|}
|function Test-SIGuardOutcomeMails {
|    <# PURE. Whether this event's outcome sends a mail at all: every outcome but 'warning' (and the listed exceptions);
|       never for a guard the catalog marks "mail": "never". #>
|    param([Parameter(Mandatory)]$Event)
|    if (Test-SIGuardNeverMails -GuardId ([string]$Event.GuardId)) { return $false }
|    ([string]$Event.Outcome -ine 'warning') -or ($script:SIGuardWarningMails -contains [string]$Event.GuardId)
|}
|
|function ConvertTo-SIGuardTextHtml {
|    <#
|        PURE. One guard text as HTML a person can read: a run of 4 or more items joined by '; ' (a list of columns, reports,
|        jobs) becomes an intro line and a bullet list of at most 10 items ("and N more"), never one run-on paragraph.
|    #>
|    param([AllowEmptyString()][string]$Text, [int]$MaxItems = 10)
|    $enc = { param($s) if (Get-Command -Name ConvertTo-SIMailInlineHtml -ErrorAction SilentlyContinue) { ConvertTo-SIMailInlineHtml $s } else { [System.Net.WebUtility]::HtmlEncode([string]$s) } }
|    $t = [string]$Text
|    $segs = @($t -split ';\s+')
|    if ($segs.Count -lt 4) { return (& $enc $t) }
|    # the intro is what stands before the list: the text up to the last ': ' of the first segment
|    $first = $segs[0]; $intro = ''
|    $cut = $first.LastIndexOf(': ')
|    if ($cut -gt 0) { $intro = $first.Substring(0, $cut + 1); $segs[0] = $first.Substring($cut + 2) }
|    $items = @($segs | ForEach-Object { $_.Trim().TrimEnd('.') } | Where-Object { $_ })
|    $shown = @($items | Select-Object -First $MaxItems)
|    $li = @($shown | ForEach-Object { '<li style="margin:0 0 2px 0;">' + (& $enc $_) + '</li>' }) -join ''
|    if ($items.Count -gt $shown.Count) { $li += '<li style="margin:0 0 2px 0;color:#59636e;">' + (& $enc ('and {0} more' -f ($items.Count - $shown.Count))) + '</li>' }
|    (& $enc $intro) + '<ul style="margin:4px 0 0 18px;padding:0;">' + $li + '</ul>'
|}
|
|function Get-SIGuardCulture {
|    <# The install's number format for mails: SIWeb_NumberFormatDefault when it names a culture, else invariant. #>
|    param([System.Collections.IDictionary]$Globals)
|    $c = "$(Get-SIGuardSetting -Name 'SIWeb_NumberFormatDefault' -Globals $Globals)".Trim()
|    if ($c -and $c -ne 'auto') { try { return [System.Globalization.CultureInfo]::GetCultureInfo($c) } catch { } }
|    [System.Globalization.CultureInfo]::InvariantCulture
|}
|
|function Get-SIGuardMailSeverity {
|    <#
|        PURE. The guard mail's severity word (MAIL-3, #653): 'Failed' for a guard that reports a failed step or update
|        (an id ending in failed / interrupted), 'Warning' for an outcome 'warning' (recorded and shown, nothing held),
|        'Action needed' for every trip that stopped, refused, held or skipped something -- a person decides what happens next.
|    #>
|    param([Parameter(Mandatory)]$Event)
|    if ([string]$Event.GuardId -match '(?i)[.-](failed|interrupted)$') { return 'Failed' }
|    if ([string]$Event.Outcome -ieq 'warning') { return 'Warning' }
|    'Action needed'
|}
|
|function ConvertTo-SIGuardMail {
|    <#
|        PURE. The guard mail: subject "<severity word>: <what was protected>" (+ "still tripping, N times"),
|        and a body with what happened, the numbers against the limit, what was held (nothing lost), what to do and the link.
|        Returns @{ Subject; Html; Text }.
|    #>
|    param([Parameter(Mandatory)]$Event, [Parameter(Mandatory)]$Trip, [string]$TenantTag, [System.Globalization.CultureInfo]$Culture = [System.Globalization.CultureInfo]::InvariantCulture)
|    $e = { param($s) [System.Net.WebUtility]::HtmlEncode([string]$s) }
|    # MAIL-2 / #573: free text keeps its line breaks (encoded, a <br> per break) -- never collapsed into one run-on line
|    $tx = { param($s) if (Get-Command -Name ConvertTo-SIMailInlineHtml -ErrorAction SilentlyContinue) { ConvertTo-SIMailInlineHtml $s } else { [System.Net.WebUtility]::HtmlEncode([string]$s) } }
|    $what = ([string]$Event.Protected)
|    # MAIL-3 (#653): '<severity word>: <what was protected>' -- the transport adds '[<environment>]' and '[SecurityInsight]'
|    $subject = '{0}: {1}' -f (Get-SIGuardMailSeverity -Event $Event), $(if ($what) { $what.Substring(0, 1).ToUpperInvariant() + $what.Substring(1) } else { 'Your data' })
|    if ($Trip.StillTripping) { $subject += (' (still tripping, {0} times since {1:yyyy-MM-dd HH:mm} UTC)' -f $Trip.TripCount, ([datetime]$Trip.FirstSeenUtc)) }
|    if ($TenantTag) { $subject += (' | {0}' -f $TenantTag) }
|    $verb = switch ([string]$Event.Outcome) {
|        'halted'  { 'SecurityInsight stopped a step to protect {0}.' }
|        'refused' { 'SecurityInsight refused a step to protect {0}.' }
|        'held'    { 'SecurityInsight held back part of a step to protect {0}.' }
|        'skipped' { 'SecurityInsight skipped a step to protect {0}.' }
|        default   { 'SecurityInsight needs your attention to protect {0}.' }
|    }
|    $lead = $verb -f $what
|    # #728 (no tables in mails): the numbers are "Topic: text" lines, one per measured value -- the label in bold, the
|    # value, and the limit in brackets only when the value has one: "Rows: 1,060,000 (limit 2,000,000)"
|    $rows = foreach ($v in @($Event.Values)) {
|        $u = if ($v.Unit) { ' ' + $v.Unit } else { '' }
|        $val = (Format-SIGuardNumber $v.Measured $Culture) + $(if ($null -ne $v.Measured) { $u } else { '' })
|        $lim = if ($null -ne $v.Limit) { 'limit ' + (Format-SIGuardNumber $v.Limit $Culture) + $u + $(if ($v.PSObject.Properties['Configured'] -and $null -ne $v.Configured -and $v.Configured -ne $v.Limit) { ', normally {0}{1}' -f (Format-SIGuardNumber $v.Configured $Culture), $u } else { '' }) } else { '' }
|        '<p style="margin:0 0 8px 0;line-height:1.5;"><strong>{0}:</strong> {1}{2}</p>' -f (& $e $v.Label), (& $e $val), $(if ($lim) { ' (' + (& $e $lim) + ')' } else { '' })
|    }
|    # CR4 (#654): a trip in the stricter period after a release says so calmly -- expected, temporary, with the numbers
|    $strictText = if ($Event.PSObject.Properties['Strict'] -and $Event.Strict -and (Get-Command -Name Format-SIGuardStrictSentence -ErrorAction SilentlyContinue)) { Format-SIGuardStrictSentence -Strict $Event.Strict } else { '' }
|    $table = if (@($rows).Count) { '<div data-guard-values style="margin:0 0 12px 0;font-size:14px;">' + (@($rows) -join '') + '</div>' } else { '' }
|    $held = if ($Event.HeldCount -gt 0) { ('{0} item(s) were held back. Nothing was lost: they stay as they were and are processed again on the next good run.' -f (Format-SIGuardNumber ([long]$Event.HeldCount) $Culture)) }
|            else { 'Nothing was changed by this step, so nothing was lost.' }
|    $tripLine = if ($Trip.StillTripping) { ('This has happened {0} times since {1:yyyy-MM-dd HH:mm} UTC; you get at most one mail a day about it.' -f $Trip.TripCount, ([datetime]$Trip.FirstSeenUtc)) } else { '' }
|    $font = 'font-family:Segoe UI,Arial,sans-serif;'
|    $p = { param($s) '<p style="margin:0 0 12px 0;">' + $s + '</p>' }
|    $sb = New-Object System.Text.StringBuilder
|    [void]$sb.Append('<html><body style="margin:0;padding:0;background:#f4f6f8;"><div style="' + $font + 'max-width:720px;margin:0 auto;background:#ffffff;border:1px solid #d0d7de;">')
|    [void]$sb.Append('<div style="background:' + $(if ($Event.Severity -eq 'critical') { '#b42318' } else { '#9a6700' }) + ';color:#ffffff;padding:14px 22px;font-size:18px;"><strong>SecurityInsight</strong> &middot; action needed</div>')
|    [void]$sb.Append('<div style="padding:18px 22px;font-size:14px;color:#1f2328;">')
|    # #728: a summary block first -- what happened, what was held, whether the reader must act (not marked
|    # data-mail-summary: the guard mail carries no portal link line, as before)
|    $sumLines = @('<strong>' + (& $e $lead) + '</strong>')
|    if ($Event.HeldCount -gt 0) { $sumLines += (& $e ('{0} item(s) held back; nothing was lost.' -f (Format-SIGuardNumber ([long]$Event.HeldCount) $Culture))) }
|    $sumLines += ('<strong>' + (& $e (Get-SIGuardMailSeverity -Event $Event)) + ':</strong> see What to do below.')
|    [void]$sb.Append('<div data-guard-summary style="background:#EEF3FE;border-left:4px solid #1B4FE4;border-radius:4px;padding:12px 16px;margin:0 0 18px 0;font-size:15px;line-height:1.55;color:#0B1633;"><p style="margin:0;">' + ($sumLines -join '<br>') + '</p></div>')
|    # owner 2026-10-11 ("nobody understand what to do and the consequence"): three blocks in this order -- what happened (and
|    # its cause), what it means for you, what to do -- each a heading over its text; a list is a bullet list; a part that
|    # does not apply (nothing held, no release possible) is left out
|    $h = { param($s) '<p style="margin:16px 0 4px 0;font-size:15px;"><strong>' + $s + '</strong></p>' }
|    $parts = $null; try { $parts = Get-SIGuardParts -Event $Event -Culture $Culture } catch { $parts = $null }
|    $releasable = $parts -and $parts.IfRelease -and ([string]$parts.IfRelease -notmatch '^This check cannot be released')
|    [void]$sb.Append((& $h 'What happened'))
|    if ($parts -and $parts.What) {
|        [void]$sb.Append((& $p (& $tx $parts.What)))
|        if ($parts.Why) { [void]$sb.Append('<div style="margin:0 0 12px 0;">' + (ConvertTo-SIGuardTextHtml -Text $parts.Why) + '</div>') }
|    } elseif ($Event.Detail) { [void]$sb.Append('<div style="margin:0 0 12px 0;">' + (ConvertTo-SIGuardTextHtml -Text $Event.Detail) + '</div>') }
|    if ($table) { [void]$sb.Append($table) }
|    if ($strictText) { [void]$sb.Append((& $p (& $tx $strictText))) }
|    # owner 2026-10-17: which release it tripped on, so "our update" is told from "your source changed"
|    $attrText = if ($Event.PSObject.Properties['Attribution'] -and [string]$Event.Attribution) { [string]$Event.Attribution } else { '' }
|    if ($attrText) { [void]$sb.Append((& $p (& $tx $attrText))) }
|    [void]$sb.Append((& $h 'What it means for you'))
|    if ($parts -and $parts.Consequence) { [void]$sb.Append((& $p (& $tx $parts.Consequence))) }
|    if ($Event.HeldCount -gt 0) { [void]$sb.Append((& $p (& $tx $held))) }
|    elseif (-not ($parts -and $parts.Consequence)) { [void]$sb.Append((& $p (& $tx $held))) }
|    [void]$sb.Append((& $h 'What to do'))
|    # an explicit -Action (the caller's own words) wins over the catalog's steps
|    $def = $null; try { $def = Get-SIGuardDefinition -Id ([string]$Event.GuardId) } catch { }
|    $own = $def -and [string]$Event.Action -and [string]$Event.Action -ne [string]$def.action
|    if ($parts -and @($parts.Steps).Count -and -not $own) {
|        $li = @($parts.Steps | ForEach-Object { '<li style="margin:0 0 4px 0;">' + (& $e $_) + '</li>' }) -join ''
|        [void]$sb.Append('<ol style="margin:0 0 12px 18px;padding:0;">' + $li + '</ol>')
|    } else { [void]$sb.Append((& $p (& $tx $Event.Action))) }
|    if ($releasable) { [void]$sb.Append((& $p ('<strong>If you release it:</strong> ' + (& $tx $parts.IfRelease)))) }
|    if ($tripLine) { [void]$sb.Append((& $p (& $tx $tripLine))) }
|    if ($Event.Link) { [void]$sb.Append((& $p ('<a href="' + (& $e $Event.Link) + '" style="color:#0969da;">Open it in SecurityInsight</a>'))) }
|    # #425: where = the job (else the engine) and what it was about -- in the footer with the time and the reference
|    $whereText = Get-SIGuardWhere -Event $Event
|    [void]$sb.Append('<p style="margin:20px 0 0 0;padding-top:10px;border-top:1px solid #d0d7de;font-size:12px;color:#59636e;">' + (& $e ('{0:yyyy-MM-dd HH:mm} UTC{1}{2} - reference {3}' -f ([datetime]$Event.TimeUtc), $(if ($whereText) { ' - ' + $whereText } else { '' }), $(if ($TenantTag) { ' - ' + $TenantTag } else { '' }), $Event.GuardId)) +
|        '. To turn this check or its mail off, or to tune its limits: Settings &gt; Guards (safety checks).</p>')
|    [void]$sb.Append('</div></div></body></html>')
|    $todo = if ($parts -and @($parts.Steps).Count -and -not $own) { 'What to do: ' + (Format-SIGuardSteps -Steps $parts.Steps) } else { $Event.Action }
|    $three = if ($parts -and $parts.What) { @(('What happened: ' + $parts.What), $(if ($parts.Why) { 'Cause: ' + $parts.Why }), $(if ($parts.Consequence) { 'What it means for you: ' + $parts.Consequence })) } else { @([string]$Event.Detail) }
|    $heldText = if ($Event.HeldCount -gt 0 -or -not ($parts -and $parts.Consequence)) { $held } else { '' }
|    $releaseText = if ($releasable) { 'If you release it: ' + $parts.IfRelease } else { '' }
|    $text = @(@($lead) + $three + @((Format-SIGuardValues -Values $Event.Values -Culture $Culture), $strictText, $attrText, $heldText, $todo, $releaseText, $tripLine, [string]$Event.Link)) | Where-Object { "$_".Trim() }
|    [pscustomobject]@{ Subject = $subject; Html = $sb.ToString(); Text = (@($text) -join "`r`n`r`n") }   # MAIL-2: CRLF, a blank line between paragraphs
|}
|
|# =====================================================================================================================
|#  Telemetry -- PURE builder of the GUARD-1 record (Invardia's receiver: Schema 2, Kind 'guard')
|# =====================================================================================================================
|$script:SIGuardWire = @{
|    GuardIdPattern  = '^[a-z0-9][a-z0-9.-]{0,99}$'
|    KeyPattern      = '^[a-z][A-Za-z0-9]{0,30}$'
|    Outcomes        = @('halted', 'refused', 'held', 'skipped', 'warning')   # 'warning': GUARD-1.3 (recorded and shown, no ticket, no release-health alert)
|    Severities      = @('critical', 'warning')
|    MaxValues       = 10
|    ActionTextMax   = 500
|    # every field the record may carry; anything else would land in the receiver's Detail
|    Fields          = @('Schema', 'Kind', 'Product', 'Version', 'Ring', 'Edition', 'Hosting', 'RuntimeIdentity', 'LicenceState', 'Job', 'GuardId', 'GuardOutcome',
|                        'Severity', 'Area', 'Measured', 'Thresholds', 'HeldCount', 'TripCount', 'FirstSeenUtc', 'InstallId', 'ClaimedTenantId', 'Host',
|                        'ActionText', 'Link', 'LastSeenUtc',
|                        # CR4 (#654, Invardia 1.0.445): a trip in the stricter period after a release; the identified guard mode
|                        'Strict', 'ConfiguredLimit', 'EffectiveLimit', 'GuardMode',
|                        # owner 2026-10-17 (Invardia DESIGN "A guard report that says cleared"): GuardOutcome 'cleared'
|                        'ClearedBy', 'ClearedUtc')
|    IdentifiedOnly  = @('ClaimedTenantId', 'Host', 'ActionText', 'Link')
|}
|
|function Resolve-SIGuardHealOutcomesSwitch {
|    <#
|        PURE. Do the guard-heal reports go to Invardia from this install? (Invardia 2026-10-17: its guard receiver takes only
|        halted / refused / held / skipped / warning so far.) Switch SI_Uplink_SendGuardHealOutcomes (job variable
|        SI_UPLINK_SENDGUARDHEALOUTCOMES), read like the other SI_Uplink_Send* switches: -Value (the setting) wins, then
|        -EnvValue; on / true / yes = on; off / false / no = off; a ring list ("0", "0,1", "ring 1") = on for those rings;
|        anything else = auto = the rings in -ConfirmedRings -- every ring since Invardia 1.0.512 (2026-10-17: its receiver takes
|        'cleared' passed / released, 'taken', SiVersion / PreviousVersion / Attribution, "held (accepted range)"), so ON by default.
|        OFF: no 'cleared' report is sent (Send-SIGuardClear, the outbox's clears: TelemetryState 'off', so a later switch-on
|        never sends them in a burst) and a trip report keeps its earlier shape (no "held (accepted range)" words). Everything
|        local -- the heal, the Guards page, run health, mail, audit -- is the same either way. Returns @{ On; Setting; Reason }.
|        REMOVE-ME: once Invardia's receiver takes 'cleared' (ClearedBy / ClearedUtc), confirm the rings, then drop the switch.
|    #>
|    param([AllowNull()]$Value = $global:SI_Uplink_SendGuardHealOutcomes, [AllowNull()][AllowEmptyString()][string]$EnvValue = $env:SI_UPLINK_SENDGUARDHEALOUTCOMES,
|          [AllowNull()]$Ring, [int[]]$ConfirmedRings = @(0, 1, 2, 3), [System.Collections.IDictionary]$Globals)
|    if ($Globals -and -not $PSBoundParameters.ContainsKey('Value')) { $Value = Get-SIGuardSetting -Name 'SI_Uplink_SendGuardHealOutcomes' -Globals $Globals }
|    $name = 'SI_Uplink_SendGuardHealOutcomes'
|    if (Get-Command -Name Resolve-SIUplinkFieldSwitch -ErrorAction SilentlyContinue) {
|        return (Resolve-SIUplinkFieldSwitch -Name $name -Value $Value -EnvValue $EnvValue -Ring $Ring -ConfirmedRings $ConfirmedRings)
|    }
|    # the same rules as Resolve-SIUplinkFieldSwitch (SI-HeartbeatJob.ps1), for a process that has not loaded it
|    $rn = -1
|    if ($null -ne $Ring -and "$Ring".Trim() -ne '') { if (-not [int]::TryParse("$Ring", [ref]$rn)) { $rn = -1 } }
|    $set = ''
|    foreach ($v in @($Value, $EnvValue)) {
|        if ($null -eq $v) { continue }
|        if ($v -is [bool]) { $set = $(if ($v) { 'on' } else { 'off' }); break }
|        $s = ([string]$v).Trim().Trim('$').ToLowerInvariant()
|        if (-not $s) { continue }
|        $set = $s; break
|    }
|    if ($set -in @('on', 'true', 'yes', 'enabled')) { return [pscustomobject]@{ On = $true; Setting = 'on'; Reason = "$name is on" } }
|    if ($set -in @('off', 'false', 'no', 'disabled')) { return [pscustomobject]@{ On = $false; Setting = 'off'; Reason = "$name is off" } }
|    if ($set -match '^(ring\s*)?[0-3](\s*[,;]\s*(ring\s*)?[0-3])*$') {
|        $rings = @([regex]::Matches($set, '[0-3]') | ForEach-Object { [int]$_.Value })
|        return [pscustomobject]@{ On = ($rn -ge 0 -and $rings -contains $rn); Setting = $set; Reason = "$name is on for ring(s) $($rings -join ', ')" }
|    }
|    [pscustomobject]@{ On = ($rn -ge 0 -and @($ConfirmedRings) -contains $rn); Setting = 'auto'; Reason = "$name is auto (confirmed rings: $(if (@($ConfirmedRings).Count) { @($ConfirmedRings) -join ', ' } else { 'none' }))" }
|}
|
|function ConvertTo-SIGuardWireOutcome {
|    <# PURE. The receiver's GuardOutcome (halted | refused | held | skipped | warning -- GUARD-1.3). A trip that HELD
|       NOTHING -- SI's own 'warning' (a licence in grace, a report that lost findings), or a 'held' with no held count --
|       travels as 'warning': recorded and shown, no ticket, no release-health alert. 'held' is kept for a trip that
|       really held something (HeldCount > 0). #>
|    param([Parameter(Mandatory)][string]$Outcome, [long]$HeldCount = 0)
|    if ($Outcome -eq 'held' -and $HeldCount -le 0) { return 'warning' }
|    if ($script:SIGuardWire.Outcomes -contains $Outcome) { return $Outcome }
|    throw ("'{0}' is not a guard outcome" -f $Outcome)
|}
|
|function New-SIGuardTelemetryRecord {
|    <#
|        PURE. The GUARD-1 record (Invardia's receiver opens / updates ONE support ticket per environment + guard for Pro; for
|        Community it counts installs per guard and version). -Context: a Get-SITelemetryContext result.
|          always      Schema 2, Kind guard, Product, Version, Ring, Edition, Hosting, RuntimeIdentity, LicenceState, Job, GuardId,
|                      GuardOutcome, Severity, Area, Measured / Thresholds (camelCase keys, numbers only, at most 10 each),
|                      HeldCount, TripCount, FirstSeenUtc, LastSeenUtc
|          anonymous   + InstallId. NO tenant, host, subject, detail, action text or link.
|          identified  + ClaimedTenantId, Host, ActionText (at most 500 characters, redacted), Link (https only), and InstallId =
|                      the install's LASTING id (Context.LastingInstallId, Invardia S16) when there is one.
|        A value outside the receiver's lists is refused here (it would reject the whole report).
|    #>
|    param([Parameter(Mandatory)]$Event, [Parameter(Mandatory)]$Trip, [Parameter(Mandatory)]$Context, [string]$HostName, $Now)
|    $w = $script:SIGuardWire
|    $anon = ([string]$Context.Mode -eq 'anonymous')
|    $iso = { param($v) $u = ConvertTo-SIGuardUtc $v; if ($null -eq $u) { $null } else { $u.ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture) } }
|    $gid = [string]$Event.GuardId
|    if ($gid -notmatch $w.GuardIdPattern) { throw ("guard id '{0}' does not fit the receiver ({1})" -f $gid, $w.GuardIdPattern) }
|    if ($w.Severities -notcontains [string]$Event.Severity) { throw ("severity '{0}' is not critical / warning" -f $Event.Severity) }
|    $measured = [ordered]@{}; $limits = [ordered]@{}
|    foreach ($v in @($Event.Values)) {
|        if ($v.Name -notmatch $w.KeyPattern) { continue }
|        if ($null -ne $v.Measured -and $measured.Count -lt $w.MaxValues) { $measured[$v.Name] = $v.Measured }
|        if ($null -ne $v.Limit -and $limits.Count -lt $w.MaxValues) { $limits[$v.Name] = $v.Limit }
|    }
|    $r = [ordered]@{ Schema = 2; Kind = 'guard'; Product = $script:SIGuard.Product }
|    $ver = "$($Context.Version)".Trim(); if ($ver) { $r.Version = $ver }
|    if ($Context.PSObject.Properties['Ring'] -and $null -ne $Context.Ring -and "$($Context.Ring)" -ne '') { $r.Ring = [int]$Context.Ring }
|    foreach ($k in 'Edition', 'Hosting', 'RuntimeIdentity', 'LicenceState') { $val = "$($Context.$k)".Trim(); if ($val) { $r[$k] = $val } }
|    if ([string]$Event.Job) { $r.Job = [string]$Event.Job }
|    $r.GuardId      = $gid
|    $r.GuardOutcome = ConvertTo-SIGuardWireOutcome -Outcome ([string]$Event.Outcome) -HeldCount ([long]$Event.HeldCount)
|    $r.Severity     = [string]$Event.Severity
|    $r.Area         = [string]$Event.Area
|    $r.Measured     = [pscustomobject]$measured
|    $r.Thresholds   = [pscustomobject]$limits
|    $r.HeldCount    = [long]$Event.HeldCount
|    $r.TripCount    = [int]$Trip.TripCount
|    $r.FirstSeenUtc = & $iso $Trip.FirstSeenUtc
|    if ($anon) {
|        $r.InstallId = [string]$Context.InstallId
|    } else {
|        $r.ClaimedTenantId = [string]$Context.TenantId
|        $r.Host = $(if ($HostName) { $HostName } else { [string][System.Environment]::MachineName })
|        # Invardia S16: the install's LASTING id (SI-InstallId) on the identified report -- never the anonymous id; none = no field
|        if ($Context.PSObject.Properties['LastingInstallId'] -and (Get-Command -Name ConvertTo-SIInvardiaInstallId -ErrorAction SilentlyContinue)) {
|            $lid = ConvertTo-SIInvardiaInstallId ([string]$Context.LastingInstallId); if ($lid) { $r.InstallId = $lid }
|        }
|        $red =if (Get-Command -Name ConvertTo-AitUplinkRedacted -ErrorAction SilentlyContinue) { { param($s) ConvertTo-AitUplinkRedacted -Text $s } } else { { param($s) $s } }
|        # the three parts WITHOUT the event's detail or subject (what happened, the consequence, what to do) -- the same
|        # words as the mail and the Guards page; the caller's own -Action when it gave one
|        $atText = [string]$Event.Action
|        try {
|            $def = Get-SIGuardDefinition -Id $gid
|            if ($atText -eq [string]$def.action) {
|                $pp = Get-SIGuardParts -Event $Event -NoDetail
|                if ($pp.What) { $atText = (@($pp.What, $pp.Consequence, $(if (@($pp.Steps).Count) { 'What to do: ' + (Format-SIGuardSteps -Steps $pp.Steps) })) | Where-Object { "$_".Trim() }) -join ' ' }
|            }
|        } catch { }
|        $at = (& $red $atText).Trim()
|        if ($at.Length -gt $w.ActionTextMax) { $at = $at.Substring(0, $w.ActionTextMax - 3) + '...' }
|        if ($at) { $r.ActionText = $at }
|        if ([string]$Event.Link -match '^https://') { $r.Link = [string]$Event.Link }
|    }
|    # CR4 (#654): a trip in the stricter period after a release -- Strict, the customer's configured limit and the halved
|    # one (whole numbers only: Invardia keeps nothing else); the guard mode on an identified report only
|    $sv = @(@($Event.Values) | Where-Object { $_ -and $_.PSObject.Properties['Configured'] -and $null -ne $_.Configured -and $null -ne $_.Limit }) | Select-Object -First 1
|    if ($sv -or ($Event.PSObject.Properties['Strict'] -and $Event.Strict)) {
|        $r.Strict = $true
|        $cl = if ($sv) { [Math]::Abs([double]$sv.Configured) } elseif ($null -ne $Event.Strict.Configured) { [Math]::Abs([double]$Event.Strict.Configured) } else { $null }
|        $el = if ($sv) { [Math]::Abs([double]$sv.Limit) } elseif ($null -ne $Event.Strict.Effective) { [Math]::Abs([double]$Event.Strict.Effective) } else { $null }
|        if ($null -ne $cl -and $cl -eq [Math]::Floor($cl) -and $cl -lt 2147483647) { $r.ConfiguredLimit = [long]$cl }
|        if ($null -ne $el -and $el -eq [Math]::Floor($el) -and $el -lt 2147483647) { $r.EffectiveLimit = [long]$el }
|        if (-not $anon -and $Event.PSObject.Properties['Strict'] -and $Event.Strict -and (Get-Command -Name ConvertTo-SIGuardModeWire -ErrorAction SilentlyContinue)) {
|            $gm = ConvertTo-SIGuardModeWire -Mode ([pscustomobject]@{ Mode = 'strict'; Recorded = $true; Until = $Event.Strict.Until; Version = $Event.Strict.Version; EndedEarlyAt = $null; EndedByRole = '' })
|            if ($gm) { $r.GuardMode = [pscustomobject]$gm }
|        }
|    }
|    $r.LastSeenUtc = & $iso $(if ($Now) { $Now } else { $Trip.LastSeenUtc })
|    [pscustomobject]$r
|}
|
|function ConvertTo-SIGuardWire {
|    <# PURE. The record as it is posted: the GUARD-1 record itself (Send-AitUplink posts any record). $null when an
|       anonymous record has no install id (the receiver needs one) -- then nothing is sent. Returns @{ Shape; Record }. #>
|    param([Parameter(Mandatory)]$Record, [Parameter(Mandatory)]$Context)
|    if ([string]$Context.Mode -eq 'anonymous' -and [string]$Record.InstallId -notmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$') {
|        return [pscustomobject]@{ Shape = 'none'; Record = $null }
|    }
|    [pscustomobject]@{ Shape = 'guard'; Record = $Record }
|}
|
|# =====================================================================================================================
|#  THE ONE CALL
|# =====================================================================================================================
|function Get-SIGuardCallerEngine {
|    <# The engine folder of the script that called (engine\<name>\...), for a guard that is not told its engine. #>
|    try {
|        foreach ($f in @(Get-PSCallStack)) {
|            $s = [string]$f.ScriptName
|            if ($s -match '[\\/]engine[\\/]([a-z0-9-]+)[\\/]' -and $Matches[1] -ne '_shared') { return $Matches[1] }
|        }
|    } catch { }
|    ''
|}
|
|function Send-SIGuardEvent {
|    <#
|        THE call every guard makes. NEVER throws. Returns @{ Status (recorded | duplicate | error); Event; Trip; Mail;
|        Telemetry; Stored; RunHealth; Audit; Reason }.
|        What: -GuardId, -Outcome, -Engine / -Job, -Subject, -Detail, -Values, -HeldCount, -Action, -Link, -RunId, -Source.
|        Seams (tests; all optional):
|          -Invoke             the Pro database (sql, params, mode) -- dedup state, the Guards view row, the audit event,
|                              the SuperAdmins' mail. Default: $global:SI_GuardInvoke, else none.
|          -StateStore         a dedup store (New-SIGuardMemoryStateStore / -FileStateStore / -SqlStateStore).
|          -MailTransport      { param($To, $Subject, $Html, $Priority) } -> $true; default: the Risk Analysis transports.
|          -TelemetryTransport { param($Record, $Endpoint, $AccessCode, $TimeoutSec) } -> @{ Status }; default Send-AitUplink.
|          -TelemetryContext   a Get-SITelemetryContext result.
|          -RunHealth          { param($RunContext, $ExitReason, $Message, $HeldCount) }; default Send-SIRunHealthRow.
|          -Globals            settings as a hashtable instead of the live globals.
|          -Now                the clock.
|        -NoMail / -NoTelemetry: this call only (the settings decide otherwise).
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$GuardId,
|        [Parameter(Mandatory)][string]$Outcome,
|        [string]$Engine, [string]$Job, [string]$Subject, [string]$Detail,
|        [object[]]$Values = @(), [long]$HeldCount = 0, [string]$Action, [string]$Link, [string]$RunId, [string]$Source = 'job',
|        [scriptblock]$Invoke, $StateStore, [scriptblock]$MailTransport, [scriptblock]$TelemetryTransport, $TelemetryContext,
|        [scriptblock]$RunHealth, [System.Collections.IDictionary]$Globals, $Now, [switch]$NoMail, [switch]$NoTelemetry,
|        [scriptblock]$Log,
|        # #414: the distinct causes this event is about (Get-SIGuardCauseKey). When EVERY one was reported before, the
|        # event is not made again (Status 'already-reported': no row, no mail, no report) -- a cause fires ONCE, however
|        # many runs still see it (ring 1, 2026-10-06: 14,624 rows of one broken run re-fired on every data sync).
|        [string[]]$CauseKeys,
|        # the SecurityInsight version this run is on (default: Get-SIGuardRunVersion) -- tests hand one in
|        [string]$Version
|    )
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) if ($level -eq 'WARN') { Write-Warning $msg } else { Write-Host (' [{0}] {1}' -f $level, $msg) } } }
|    $res = [ordered]@{ Status = 'error'; Event = $null; Trip = $null; Mail = [pscustomobject]@{ State = 'not-tried'; To = @(); Subject = '' }
|                       Telemetry = [pscustomobject]@{ State = 'not-tried'; Shape = ''; Record = $null }; Stored = $false; RunHealth = 'not-tried'; Audit = 'not-tried'; Reason = '' }
|    if ($null -eq $global:SI_GuardHealth) { $global:SI_GuardHealth = @{ Events = 0; Failed = 0; LastError = '' } }
|    # #414: a guard switched off makes no event and no mail (it says so once, Test-SIGuardOn)
|    if (-not (Test-SIGuardOn -GuardId $GuardId -Globals $Globals -Log $Log)) {
|        $res.Status = 'off'; $res.Reason = 'the guard is off (setting)'
|        return [pscustomobject]$res
|    }
|    try {
|        $nowUtc = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|        $isTest = [bool](Get-Module -Name Pester)
|        if (-not $global:SI_GuardRunId) { $global:SI_GuardRunId = [guid]::NewGuid().ToString() }
|        if (-not $Engine) { $Engine = Get-SIGuardCallerEngine }
|        $ev = New-SIGuardEvent -GuardId $GuardId -Outcome $Outcome -Engine $Engine -Job $Job -Subject $Subject -Detail $Detail -Values $Values `
|                -HeldCount $HeldCount -Action $Action -Link $Link -RunId $RunId -NowUtc $nowUtc -Source $Source
|        # CR4 (#654): a limit halved in the stricter period after a release (Resolve-SIGuardLimit) rides on the event
|        if (Get-Command -Name Add-SIGuardStrictToEvent -ErrorAction SilentlyContinue) { try { $ev = Add-SIGuardStrictToEvent -Event $ev } catch { } }
|        if (-not $ev.Link) {
|            $base = "$(Get-SIGuardSetting -Name 'SIWeb_PublicBaseUrl' -Globals $Globals)".Trim().TrimEnd('/')
|            if ($base -match '^https://') { $ev.Link = $base + '/Admin/Guards' }
|        }
|        $res.Event = $ev
|
|        # ---- one event per guard (and subject) per run ----
|        if ($null -eq $global:SI_GuardSeenThisRun) { $global:SI_GuardSeenThisRun = @{} }
|        $runKey = '{0}|{1}' -f $ev.RunId, $ev.GuardKey
|        if ($global:SI_GuardSeenThisRun.ContainsKey($runKey)) {
|            $res.Status = 'duplicate'; $res.Reason = 'this guard already reported in this run'
|            return [pscustomobject]$res
|        }
|        $global:SI_GuardSeenThisRun[$runKey] = $true
|        # A 'warning' is not prefixed: the console's own "WARNING:" already says it (it printed "WARNING: WARNING: ...").
|        # #425: what, where, the numbers and what to do -- one line a person can act on (Format-SIGuardSummary)
|        $summary = Format-SIGuardSummary -Event $ev
|        & $Log 'WARN' ('{0}{1}' -f $(if ($ev.Outcome -ieq 'warning') { '' } else { $ev.Outcome.ToUpperInvariant() + ': ' }), $summary)
|
|        # #735: every guard in ONE place -- a step that hands in no database (the collection's asset-drop guard, Risk
|        # Analysis' row-count / column-fill / bucket-jump guards) still writes its row to cfg.GuardEvent when the install has a
|        # Pro database (Resolve-SIGuardEventInvoke); run health and the uplink are written as before
|        $Invoke = Resolve-SIGuardEventInvoke -Invoke $Invoke -IsTest $isTest
|        $hasTables = $false
|        if ($Invoke) {
|            try { $hasTables = ([int](& $Invoke (Get-SIGuardSql 'Exists') @{} 'scalar') -eq 1) } catch { & $Log 'WARN' ('the guard tables could not be checked: {0}' -f $_.Exception.Message) }
|        }
|
|        # ---- the trip's episode (de-duplication) ----
|        if (-not $StateStore) {
|            if ($hasTables) { $StateStore = New-SIGuardSqlStateStore -Invoke $Invoke }
|            elseif ($isTest) { if (-not $global:SI_GuardTestStore) { $global:SI_GuardTestStore = New-SIGuardMemoryStateStore }; $StateStore = $global:SI_GuardTestStore }
|            else { $StateStore = New-SIGuardFileStateStore -Directory (Get-SIGuardStateDirectory) }
|        }
|        # #414: a cause reported before is not reported again
|        $causes = @($CauseKeys | Where-Object { "$_".Trim() } | ForEach-Object { 'cause|{0}|{1}' -f $ev.GuardId, ([string]$_).Trim().ToLowerInvariant() })
|        if ($causes.Count) {
|            $newCauses = @($causes | Where-Object { $ck = $_; $known = $null; try { $known = & $StateStore.Get $ck } catch { $known = $null }; -not $known })
|            if (-not $newCauses.Count) {
|                & $Log 'INFO' ('{0}: already reported (the same cause) -- not reported again' -f $ev.GuardId)
|                $res.Status = 'already-reported'; $res.Reason = 'every cause of this event was reported before'
|                return [pscustomobject]$res
|            }
|        }
|        $prev = $null
|        try { $prev = & $StateStore.Get $ev.GuardKey } catch { & $Log 'WARN' ('the guard''s earlier trips could not be read ({0}) -- treated as a first trip' -f $_.Exception.Message) }
|        # ---- WHICH RELEASE (owner 2026-10-17): the version it tripped on, the one before, "the first run after the update" ----
|        $marker = $null; $newMarker = $null; $attr = $null
|        if (Get-Command -Name Get-SIGuardAttribution -ErrorAction SilentlyContinue) {
|            try {
|                $ver = if ($Version) { $Version } else { Get-SIGuardRunVersion }
|                $marker = Read-SIGuardVersionMarker -StateStore $StateStore -GuardKey $ev.GuardKey
|                $attr = Get-SIGuardAttribution -Marker $marker -Version $ver -RunId $ev.RunId
|                $newMarker = Update-SIGuardVersionMarker -Marker $marker -Version $ver -RunId $ev.RunId -NowUtc $nowUtc -Kind trip -Tripped $true
|                $ev | Add-Member -NotePropertyName Version -NotePropertyValue ([string]$attr.Version) -Force
|                $ev | Add-Member -NotePropertyName PreviousVersion -NotePropertyValue ([string]$attr.PreviousVersion) -Force
|                $ev | Add-Member -NotePropertyName AfterUpdate -NotePropertyValue ([bool]$attr.AfterUpdate) -Force
|                $ev | Add-Member -NotePropertyName Attribution -NotePropertyValue ([string]$attr.Text) -Force
|            } catch { & $Log 'INFO' ('the version this guard tripped on could not be worked out: {0}' -f $_.Exception.Message) }
|        }
|        # ---- ACCEPTED BY THE OWNER (cfg.GuardAccept): still recorded, not mailed, not reported again ----
|        $accepted = $null
|        if ($hasTables -and (Get-Command -Name Test-SIGuardAcceptCovers -ErrorAction SilentlyContinue)) {
|            try {
|                $acc = @(& $Invoke (Get-SIGuardHealSql 'AcceptRead') @{ GuardId = $ev.GuardId } 'reader' | ForEach-Object { $_ } | Where-Object { $_ })
|                $accepted = Test-SIGuardAcceptCovers -Accepts $acc -GuardKey $ev.GuardKey -Version $(if ($attr) { [string]$attr.Version } else { '' }) -TimeUtc $nowUtc
|            } catch { $accepted = $null }
|        }
|        # owner review 2026-10-17: ONLY A WARNING is muted by an acceptance. A trip that HOLDS, refuses or stops something is
|        # still mailed and reported -- with "inside a range the owner accepted" -- so held data is never silent.
|        $acceptedHold = $false
|        if ($accepted) {
|            $wireOc = 'warning'; try { $wireOc = ConvertTo-SIGuardWireOutcome -Outcome ([string]$ev.Outcome) -HeldCount ([long]$ev.HeldCount) } catch { $wireOc = 'held' }
|            if ($wireOc -ne 'warning') {
|                $acceptedHold = $true
|                $note = 'This version is inside a range the owner accepted ({0}), but this run still held or stopped something, so it is mailed and reported as usual.' -f [string](Get-SIGuardField $accepted 'AcceptedBy')
|                $ev | Add-Member -NotePropertyName Attribution -NotePropertyValue ((@([string]$(if ($ev.PSObject.Properties['Attribution']) { $ev.Attribution } else { '' }), $note) | Where-Object { $_ }) -join ' ') -Force
|                if ($attr) { $attr.Text = [string]$ev.Attribution }
|                & $Log 'INFO' ('{0}: inside a range the owner accepted, but it held data -- mailed and reported as usual' -f $ev.GuardId)
|                $accepted = $null
|            } else { & $Log 'INFO' ('{0}: accepted by {1} for this version -- a warning only: recorded, not mailed and not reported again' -f $ev.GuardId, [string](Get-SIGuardField $accepted 'AcceptedBy')) }
|        }
|        if ($accepted) { $NoMail = $true }
|        $mailOn = (Test-SIGuardMailEnabled -Globals $Globals) -and (Test-SIGuardMailOn -GuardId $ev.GuardId -Globals $Globals) -and -not $NoMail -and (Test-SIGuardOutcomeMails -Event $ev)
|        $trip = Get-SIGuardTripState -Previous $prev -NowUtc $nowUtc -WindowHours $script:SIGuard.WindowHours -MailEnabled $mailOn
|        $res.Trip = $trip
|
|        # ---- (c) MAIL ----
|        $mailState = 'off'; $mailTo = @(); $mailSubject = ''
|        if (-not $mailOn) { $mailState = 'off' }
|        elseif (-not $trip.Mail) { $mailState = 'deduped' }
|        else {
|            try {
|                $admins = @()
|                $rcp = Get-SIGuardMailRecipients -Globals $Globals
|                if (-not @($rcp.To).Count -and $hasTables) {
|                    try { $admins = @(& $Invoke (Get-SIGuardSql 'SuperAdmins') @{} 'reader' | ForEach-Object { [string]$_.Mail }) } catch { }
|                    $rcp = Get-SIGuardMailRecipients -Globals $Globals -SuperAdminMails $admins
|                }
|                $mailTo = @($rcp.To)
|                $tag = Get-SIGuardTenantTag -Globals $Globals
|                $m = ConvertTo-SIGuardMail -Event $ev -Trip $trip -TenantTag $tag -Culture (Get-SIGuardCulture -Globals $Globals)
|                $mailSubject = $m.Subject
|                if (-not $mailTo.Count) {
|                    # #277 (live: printed 24 times in one run): said ONCE per process; every guard row carries 'mail: no recipients'
|                    $mailState = 'no-recipients'
|                    if (-not $global:SI_GuardNoRecipientsWarned) { $global:SI_GuardNoRecipientsWarned = $true; & $Log 'WARN' 'the guard mail has no recipients (set SI_GuardMail_To, or MailTo) -- not sent' }
|                }
|                elseif (-not $MailTransport -and $isTest) { $mailState = 'test-session' }
|                else {
|                    $prio = if ($ev.Severity -eq 'critical') { 'High' } else { 'Normal' }
|                    $smtp = if ($MailTransport) { $null } else { Get-SIGuardSmtp -Globals $Globals }
|                    if (-not $MailTransport -and $smtp.Off) { $mailState = 'off' }
|                    elseif (-not $MailTransport -and @($smtp.Problems).Count) { $mailState = 'no-relay'; & $Log 'WARN' ('the guard mail could not be sent: ' + (@($smtp.Problems) -join '; ')) }
|                    else {
|                        $ok = if ($MailTransport) { & $MailTransport $mailTo $m.Subject $m.Html $prio } else { Send-SIGuardMailDefault -Smtp $smtp -To $mailTo -Subject $m.Subject -Html $m.Html -Priority $prio }
|                        $mailState = if (@($ok | Where-Object { $_ -is [bool] } | Select-Object -Last 1) -contains $false) { 'failed' } else { 'sent' }
|                    }
|                }
|            } catch {
|                $mailState = 'failed'
|                & $Log 'WARN' ('the guard mail could not be sent: {0}. The job itself is not affected.' -f $_.Exception.Message)
|            }
|            # an undelivered mail is tried again on the next trip, not a day later
|            if ($mailState -ne 'sent') { $trip.LastMailUtc = $(if ($prev) { ConvertTo-SIGuardUtc $prev.LastMailUtc } else { $null }) }
|        }
|        if ($accepted) { $mailState = 'accepted' }
|        $res.Mail = [pscustomobject]@{ State = $mailState; To = $mailTo; Subject = $mailSubject }
|
|        # ---- (d) TELEMETRY ----
|        $telState = 'off'; $shape = ''; $wireRec = $null
|        try {
|            if ($accepted) { $telState = 'accepted' }
|            elseif ($NoTelemetry -or -not (Get-Command -Name Test-SITelemetryEnabled -ErrorAction SilentlyContinue)) { $telState = 'off' }
|            elseif (-not $Globals -and -not (Test-SITelemetryEnabled)) { $telState = 'off' }
|            elseif ($Globals -and -not (Test-SIGuardFlag -Value (Get-SIGuardSetting -Name 'SI_Telemetry_Enabled' -Globals $Globals) -Default $true)) { $telState = 'off' }
|            elseif ($global:SI_TelemetryHalted -and -not $TelemetryTransport) { $telState = 'halted' }
|            elseif (-not $TelemetryTransport -and $isTest) { $telState = 'test-session' }
|            else {
|                $ctx = if ($TelemetryContext) { $TelemetryContext } else { Get-SITelemetryContext }
|                $rec = New-SIGuardTelemetryRecord -Event $ev -Trip $trip -Context $ctx -Now $nowUtc
|                # a trip that held inside a range the owner accepted says so to Invardia (identified: its words) -- only with
|                # SI_Uplink_SendGuardHealOutcomes on (off: the report keeps its earlier shape)
|                if ($acceptedHold -and $rec.PSObject.Properties['ActionText'] -and (Resolve-SIGuardHealOutcomesSwitch -Ring $ctx.Ring -Globals $Globals).On) {
|                    $tx2 = 'held (accepted range): ' + [string]$rec.ActionText; if ($tx2.Length -gt 500) { $tx2 = $tx2.Substring(0, 497) + '...' }
|                    $rec.ActionText = $tx2
|                }
|                $wire = ConvertTo-SIGuardWire -Record $rec -Context $ctx
|                $shape = $wire.Shape; $wireRec = $wire.Record
|                if ($null -eq $wire.Record) { $telState = 'no-install-id' }
|                else {
|                    if (-not $TelemetryTransport) { $TelemetryTransport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) if (Get-Command -Name Test-SITelemetryCommunitySendAllowed -ErrorAction SilentlyContinue) { $g = Test-SITelemetryCommunitySendAllowed -AccessCode $AccessCode; if (-not $g.Allowed) { return [pscustomobject]@{ Status = 'skipped'; Reason = $g.Reason; Sent = $false } } }; Send-AitUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec } }
|                    $r = & $TelemetryTransport $wire.Record $ctx.Endpoint $ctx.AccessCode 5
|                    if ("$($r.Status)" -eq 'ok') { $telState = 'sent' }
|                    else {
|                        $telState = 'failed'
|                        $global:SI_TelemetryHalted = $true
|                        & $Log 'WARN' ('the guard report to Invardia was not sent ({0}); the job is not affected' -f $(if (Get-Command -Name ConvertTo-AitUplinkRedacted -ErrorAction SilentlyContinue) { ConvertTo-AitUplinkRedacted -Text "$($r.Reason)" } else { "$($r.Reason)" }))
|                    }
|                }
|            }
|        } catch { $telState = 'failed'; & $Log 'WARN' ('the guard report to Invardia could not be prepared: {0}' -f $_.Exception.Message) }
|        $res.Telemetry = [pscustomobject]@{ State = $telState; Shape = $shape; Record = $wireRec }
|
|        # ---- the episode, saved (with the version it tripped on; a trip re-opens a cleared episode) ----
|        $tripSave = $trip
|        if ($attr) {
|            $tripSave = [pscustomobject]@{ FirstSeenUtc = $trip.FirstSeenUtc; LastSeenUtc = $trip.LastSeenUtc; TripCount = $trip.TripCount; LastMailUtc = $trip.LastMailUtc
|                                           Version = [string]$attr.Version; PreviousVersion = [string]$attr.PreviousVersion; ClearedUtc = $null; ClearedRunId = $null; ClearedVersion = $null; ClearedHow = $null }
|        }
|        try { & $StateStore.Set $ev.GuardKey $ev.GuardId $tripSave } catch { & $Log 'WARN' ('the guard''s trip count could not be saved: {0}' -f $_.Exception.Message) }
|        foreach ($ck in $causes) { try { & $StateStore.Set $ck $ev.GuardId $trip } catch { } }
|        if ($newMarker) { Save-SIGuardVersionMarker -StateStore $StateStore -GuardKey $ev.GuardKey -GuardId $ev.GuardId -Marker $newMarker -NowUtc $nowUtc }
|
|        # ---- (e) the Guards view row ----
|        if ($hasTables) {
|            try {
|                $vj = ConvertTo-Json -InputObject @($ev.Values) -Depth 3 -Compress
|                $newId = & $Invoke (Get-SIGuardSql 'Insert') @{
|                    GuardId = $ev.GuardId; GuardKey = $ev.GuardKey; Area = $ev.Area; Job = $ev.Job; Engine = $ev.Engine; Source = $ev.Source
|                    Outcome = $ev.Outcome; Severity = $ev.Severity; Protected = $ev.Protected; Subject = $ev.Subject; Detail = $ev.Detail
|                    MeasuredText = (Format-SIGuardValues -Values $ev.Values); ValuesJson = $vj; HeldCount = [long]$ev.HeldCount; ActionText = $ev.Action
|                    Link = $ev.Link; RunId = $ev.RunId; TripCount = [int]$trip.TripCount; FirstSeenUtc = $trip.FirstSeenUtc
|                    MailState = $mailState; MailTo = (@($mailTo) -join '; '); TelemetryState = $telState } 'scalar'
|                $res.Stored = $true
|                # the version it tripped on and the words of "which release" (only where the database has the columns)
|                if ($attr) {
|                    $nid = 0L
|                    if ([long]::TryParse([string]$(if ($newId -is [array]) { $newId[0] } else { $newId }), [ref]$nid) -and $nid -gt 0) {
|                        $at = [string]$attr.Text; if ($at.Length -gt 400) { $at = $at.Substring(0, 400) }
|                        try { $null = & $Invoke (Get-SIGuardHealSql 'EventInfo') @{ Id = $nid; SiVersion = $(if ($attr.Version) { [string]$attr.Version } else { $null }); PreviousVersion = $(if ($attr.PreviousVersion) { [string]$attr.PreviousVersion } else { $null }); Attribution = $(if ($at) { $at } else { $null }) } 'nonquery' } catch { }
|                    }
|                }
|            } catch { & $Log 'WARN' ('the guard event could not be saved for the Guards view: {0}' -f $_.Exception.Message) }
|        }
|
|        # ---- (a) RUN HEALTH ----
|        try {
|            $ctxRh = [pscustomobject]@{ RunId = $ev.RunId; Engine = $(if ($ev.Engine) { $ev.Engine } else { 'guard' }); ShardIndex = 0; ShardCount = 1; CollectionTime = $nowUtc; StartedAt = $nowUtc }
|            $msg = '{0}: {1}' -f $ev.GuardId, $summary
|            if ($attr -and [string]$attr.Text) { $msg += ' ' + [string]$attr.Text }
|            if ($mailState -eq 'no-recipients') { $msg += ' | mail: no recipients' }
|            if ($accepted) { $msg += ' | accepted by the owner for this version' }
|            if ($RunHealth) { $null = & $RunHealth $ctxRh ('guard-' + $ev.Outcome) $msg ([long]$ev.HeldCount); $res.RunHealth = 'written' }
|            elseif (Get-Command -Name Send-SIRunHealthRow -ErrorAction SilentlyContinue) {
|                Send-SIRunHealthRow -RunContext $ctxRh -Phase Guard -AssetCount ([int][Math]::Min([long]$ev.HeldCount, [int]::MaxValue)) -ExitReason ('guard-' + $ev.Outcome) -ErrorMessage $msg -NoTelemetry
|                $res.RunHealth = 'written'
|            } else { $res.RunHealth = 'unavailable' }
|        } catch { $res.RunHealth = 'failed' }
|
|        # ---- (b) AUDIT ----
|        if ($Invoke -and (Get-Command -Name Write-SIAuditEvent -ErrorAction SilentlyContinue)) {
|            $after = [ordered]@{ guard = $ev.GuardId; area = $ev.Area; outcome = $ev.Outcome; severity = $ev.Severity; held = [long]$ev.HeldCount
|                                 measured = (Format-SIGuardValues -Values $ev.Values); trips = [int]$trip.TripCount; mail = $mailState; telemetry = $telState }
|            $actor = if (Get-Command -Name Get-SIAuditActor -ErrorAction SilentlyContinue) { Get-SIAuditActor -Job $(if ($ev.Engine) { $ev.Engine } else { 'guard' }) } else { 'guard' }
|            $ok = Write-SIAuditEvent -Invoke $Invoke -Action $script:SIGuard.AuditAction -Actor $actor -ActorSource $(if ($ev.Source -eq 'web') { 'web' } elseif ($ev.Source -eq 'setup') { 'setup' } else { 'job' }) `
|                    -Target $(if ($ev.Subject) { '{0} ({1})' -f $ev.GuardId, $ev.Subject } else { $ev.GuardId }) -Reason $ev.Protected `
|                    -Outcome $(if ($ev.Severity -eq 'critical') { 'refused' } else { 'held' }) -OutcomeText $(if ($ev.Detail) { $ev.Detail } else { $ev.Action }) `
|                    -CorrelationId $ev.RunId -After $after -Log { param($l, $m) }
|            $res.Audit = if ($ok) { 'written' } else { 'failed' }
|        } else { $res.Audit = 'no-database' }
|
|        $global:SI_GuardHealth.Events++
|        $res.Status = 'recorded'
|        return [pscustomobject]$res
|    } catch {
|        $global:SI_GuardHealth.Failed++; $global:SI_GuardHealth.LastError = [string]$_.Exception.Message
|        $res.Status = 'error'; $res.Reason = [string]$_.Exception.Message
|        try { & $Log 'WARN' ('a guard event could not be recorded: {0}. The job itself is not affected.' -f $_.Exception.Message) } catch { }
|        return [pscustomobject]$res
|    }
|}
|
|function Send-SIGuardMailDefault {
|    <# The default mail path: the one transport (Send-SIMail, SI-MailTransport.ps1) with the mail settings (-Smtp, from
|       Get-SIGuardSmtp). A plain function, not a closure: a closure cannot see functions dot-sourced into the engine's
|       script scope. THROWS when the mail does not go out. #>
|    param([Parameter(Mandatory)]$Smtp, [Parameter(Mandatory)][string[]]$To, [Parameter(Mandatory)][string]$Subject, [Parameter(Mandatory)][string]$Html, [string]$Priority = 'Normal',
|          # MAIL-3 (#653): the subject's severity word (the guard mail writes it first in its subject itself)
|          [AllowNull()][AllowEmptyString()][string]$Severity)
|    $r = Send-SIMail -Settings $Smtp -To $To -Subject $Subject -BodyHtml $Html -Priority $Priority -Severity $Severity
|    if (-not $r.Sent) { throw $(if ($r.Error) { [string]$r.Error } else { 'the mail was not accepted' }) }
|    return $true
|}
|
|function Invoke-SIGuardOutbox {
|    <#
|        The mail job's step (Pro): the guard events the WEB APP wrote (cfg.GuardEvent, MailState / TelemetryState
|        'pending') are mailed and reported here, with the same de-duplication as a job's guard. Never throws; returns
|        @{ Read; Mailed; Reported; Failed }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, $StateStore, [scriptblock]$MailTransport, [scriptblock]$TelemetryTransport, $TelemetryContext,
|          [System.Collections.IDictionary]$Globals, $Now, [switch]$DryRun, [scriptblock]$Log)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Host (' [{0}] {1}' -f $level, $msg) } }
|    $out = [ordered]@{ Read = 0; Mailed = 0; Reported = 0; Failed = 0 }
|    try {
|        if ([int](& $Invoke (Get-SIGuardSql 'Exists') @{} 'scalar') -ne 1) { & $Log 'INFO' 'guards    : the Pro database has no guard tables yet -- nothing to send'; return [pscustomobject]$out }
|        $rows = @(& $Invoke (Get-SIGuardSql 'OutboxRead') @{} 'reader' | ForEach-Object { $_ } | Where-Object { $_ })
|        $out.Read = $rows.Count
|        if (-not $rows.Count) { return [pscustomobject]$out }
|        if (-not $StateStore) { $StateStore = New-SIGuardSqlStateStore -Invoke $Invoke }
|        foreach ($row in $rows) {
|            # owner 2026-10-17: a CLEAR another writer recorded (the owner's acceptance, cfg.GuardAcceptSet) -- only the report
|            # to Invardia that the guard is cleared (ClearedBy 'released': a person decided); nothing is mailed
|            if ([string]$row.Outcome -eq 'cleared') {
|                try {
|                    $telState = [string]$row.TelemetryState
|                    if ($telState -eq 'pending' -and -not $DryRun) {
|                        $enabled = if ($Globals) { Test-SIGuardFlag -Value (Get-SIGuardSetting -Name 'SI_Telemetry_Enabled' -Globals $Globals) -Default $true } else { Test-SITelemetryEnabled }
|                        $ctx = $null
|                        if ($enabled -and -not ($global:SI_TelemetryHalted -and -not $TelemetryTransport)) { $ctx = if ($TelemetryContext) { $TelemetryContext } else { Get-SITelemetryContext } }
|                        if (-not $enabled) { $telState = 'off' }
|                        elseif ($global:SI_TelemetryHalted -and -not $TelemetryTransport) { $telState = 'halted' }
|                        # Invardia's receiver does not take 'cleared' yet: with SI_Uplink_SendGuardHealOutcomes off the clear is
|                        # marked 'off' -- never sent, and never sent later in a burst when the switch goes on
|                        elseif (-not (Resolve-SIGuardHealOutcomesSwitch -Ring $ctx.Ring -Globals $Globals).On) { $telState = 'off' }
|                        else {
|                            $def = Get-SIGuardDefinition -Id ([string]$row.GuardId)
|                            $nowC = if ($row.TsUtc -and -not ($row.TsUtc -is [System.DBNull])) { ([datetime]$row.TsUtc).ToUniversalTime() } else { [datetime]::UtcNow }
|                            $rec = New-SIGuardClearTelemetryRecord -GuardId ([string]$row.GuardId) -Context $ctx -How released -NowUtc $nowC -Job $(if ([string]$row.Job) { [string]$row.Job } else { [string]$def.job }) -Area ([string]$def.area) -Text ([string]$row.Detail)
|                            if ([string]$ctx.Mode -eq 'anonymous' -and [string]$rec.InstallId -notmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$') { $telState = 'no-install-id' }
|                            else {
|                                if (-not $TelemetryTransport) { $TelemetryTransport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) if (Get-Command -Name Test-SITelemetryCommunitySendAllowed -ErrorAction SilentlyContinue) { $g = Test-SITelemetryCommunitySendAllowed -AccessCode $AccessCode; if (-not $g.Allowed) { return [pscustomobject]@{ Status = 'skipped'; Reason = $g.Reason; Sent = $false } } }; Send-AitUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec } }
|                                $r = & $TelemetryTransport $rec $ctx.Endpoint $ctx.AccessCode 5
|                                if ("$($r.Status)" -eq 'ok') { $telState = 'sent'; $out.Reported++ } else { $telState = 'failed' }
|                            }
|                        }
|                        $null = & $Invoke (Get-SIGuardSql 'OutboxMark') @{ Id = [long]$row.Id; MailState = $(if ([string]$row.MailState -eq 'pending') { 'off' } else { [string]$row.MailState }); MailTo = $null; TelemetryState = $telState; TripCount = $null; FirstSeenUtc = $null } 'nonquery'
|                    }
|                } catch { $out.Failed++; & $Log 'WARN' ('guards    : the clear {0} could not be reported: {1}' -f $row.Id, $_.Exception.Message) }
|                continue
|            }
|            try {
|                $vals = @(); if ([string]$row.ValuesJson) { try { $vals = @(ConvertFrom-Json -InputObject ([string]$row.ValuesJson)) } catch { $vals = @() } }
|                $ev = New-SIGuardEvent -GuardId ([string]$row.GuardId) -Outcome ([string]$row.Outcome) -Engine ([string]$row.Engine) -Job ([string]$row.Job) -Subject ([string]$row.Subject) `
|                        -Detail ([string]$row.Detail) -Values $vals -HeldCount ([long]$row.HeldCount) -Action ([string]$row.ActionText) -Link ([string]$row.Link) -RunId ([string]$row.RunId) `
|                        -NowUtc $(if ($row.TsUtc) { [datetime]$row.TsUtc } else { [datetime]::UtcNow }) -Source $(if ([string]$row.Source) { [string]$row.Source } else { 'web' })
|                $nowUtc = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|                # CR4 (#654): a web app event whose limit was halved (its value carries Configured) -- the period's words
|                $hv = @(@($ev.Values) | Where-Object { $_ -and $_.PSObject.Properties['Configured'] }) | Select-Object -First 1
|                if ($hv -and (Get-Command -Name Get-SIGuardModeNow -ErrorAction SilentlyContinue)) {
|                    try {
|                        $gmo = Get-SIGuardModeNow -Invoke $Invoke
|                        $ev | Add-Member -NotePropertyName Strict -NotePropertyValue ([pscustomobject]@{ GuardId = $ev.GuardId; Name = $hv.Name; Label = $hv.Label; Configured = [Math]::Abs([double]$hv.Configured)
|                                                                                                       Effective = [Math]::Abs([double]$hv.Limit); Unit = $hv.Unit; Until = $gmo.Until; Version = [string]$gmo.Version }) -Force
|                    } catch { }
|                }
|                $prev = $null; try { $prev = & $StateStore.Get $ev.GuardKey } catch { }
|                $mailOn = (Test-SIGuardMailEnabled -Globals $Globals) -and (Test-SIGuardMailOn -GuardId $ev.GuardId -Globals $Globals) -and (Test-SIGuardOutcomeMails -Event $ev)
|                $trip =Get-SIGuardTripState -Previous $prev -NowUtc $nowUtc -MailEnabled $mailOn
|                $mailState = [string]$row.MailState; $telState = [string]$row.TelemetryState; $to = $null
|                if ($mailState -eq 'pending') {
|                    if (-not $mailOn) { $mailState = 'off' }
|                    elseif (-not $trip.Mail) { $mailState = 'deduped' }
|                    elseif ($DryRun) { $mailState = 'pending' }
|                    else {
|                        $rcp = Get-SIGuardMailRecipients -Globals $Globals -SuperAdminMails @(& $Invoke (Get-SIGuardSql 'SuperAdmins') @{} 'reader' | ForEach-Object { [string]$_.Mail })
|                        $to = @($rcp.To)
|                        if (-not $to.Count) { $mailState = 'no-recipients' }
|                        else {
|                            $smtp = if ($MailTransport) { $null } else { Get-SIGuardSmtp -Globals $Globals }
|                            if (-not $MailTransport -and $smtp.Off) { $mailState = 'off' }
|                            elseif (-not $MailTransport -and @($smtp.Problems).Count) { $mailState = 'no-relay' }
|                            else {
|                                $m = ConvertTo-SIGuardMail -Event $ev -Trip $trip -Culture (Get-SIGuardCulture -Globals $Globals)
|                                $prio = if ($ev.Severity -eq 'critical') { 'High' } else { 'Normal' }
|                                try { if ($MailTransport) { $null = & $MailTransport $to $m.Subject $m.Html $prio } else { $null = Send-SIGuardMailDefault -Smtp $smtp -To $to -Subject $m.Subject -Html $m.Html -Priority $prio }; $mailState = 'sent'; $out.Mailed++ }
|                                catch { $mailState = 'failed'; $out.Failed++; & $Log 'WARN' ('guards    : the mail about {0} was not sent: {1}' -f $ev.GuardId, $_.Exception.Message) }
|                            }
|                        }
|                    }
|                    if ($mailState -ne 'sent') { $trip.LastMailUtc = $(if ($prev) { ConvertTo-SIGuardUtc $prev.LastMailUtc } else { $null }) }
|                }
|                if ($telState -eq 'pending' -and -not $DryRun) {
|                    $enabled = if ($Globals) { Test-SIGuardFlag -Value (Get-SIGuardSetting -Name 'SI_Telemetry_Enabled' -Globals $Globals) -Default $true } else { Test-SITelemetryEnabled }
|                    if (-not $enabled) { $telState = 'off' }
|                    elseif ($global:SI_TelemetryHalted -and -not $TelemetryTransport) { $telState = 'halted' }
|                    else {
|                        $ctx = if ($TelemetryContext) { $TelemetryContext } else { Get-SITelemetryContext }
|                        $rec = New-SIGuardTelemetryRecord -Event $ev -Trip $trip -Context $ctx -Now $nowUtc
|                        $wire = ConvertTo-SIGuardWire -Record $rec -Context $ctx
|                        if ($null -eq $wire.Record) { $telState = 'no-install-id' }
|                        else {
|                            if (-not $TelemetryTransport) { $TelemetryTransport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) if (Get-Command -Name Test-SITelemetryCommunitySendAllowed -ErrorAction SilentlyContinue) { $g = Test-SITelemetryCommunitySendAllowed -AccessCode $AccessCode; if (-not $g.Allowed) { return [pscustomobject]@{ Status = 'skipped'; Reason = $g.Reason; Sent = $false } } }; Send-AitUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec } }
|                            $r = & $TelemetryTransport $wire.Record $ctx.Endpoint $ctx.AccessCode 5
|                            if ("$($r.Status)" -eq 'ok') { $telState = 'sent'; $out.Reported++ } else { $telState = 'failed'; $global:SI_TelemetryHalted = $true }
|                        }
|                    }
|                }
|                if (-not $DryRun) {
|                    try { & $StateStore.Set $ev.GuardKey $ev.GuardId $trip } catch { }
|                    $null = & $Invoke (Get-SIGuardSql 'OutboxMark') @{ Id = [long]$row.Id; MailState = $mailState; MailTo = $(if ($to) { @($to) -join '; ' } else { $null }); TelemetryState = $telState; TripCount = [int]$trip.TripCount; FirstSeenUtc = $trip.FirstSeenUtc } 'nonquery'
|                }
|            } catch { $out.Failed++; & $Log 'WARN' ('guards    : event {0} could not be sent: {1}' -f $row.Id, $_.Exception.Message) }
|        }
|        & $Log 'INFO' ('guards    : {0} event(s) from the web app -- {1} mailed, {2} reported to Invardia' -f $out.Read, $out.Mailed, $out.Reported)
|    } catch { $out.Failed++; & $Log 'WARN' ('guards    : the guard outbox could not be read: {0}' -f $_.Exception.Message) }
|    [pscustomobject]$out
|}
|
|# =====================================================================================================================
|#  ADAPTERS -- PURE: one area's result -> the guard events it tripped (each a hashtable of Send-SIGuardEvent arguments).
|#  The engines call Invoke-SIGuardCalls with them, so "which guard tripped, with which numbers" is provable offline.
|# =====================================================================================================================
|function Invoke-SIGuardCalls {
|    <#
|        Sends each call (Send-SIGuardEvent arguments) with the shared extras (-Invoke, -Engine, ...). Never throws.
|        AUTO-HEAL (owner 2026-10-17): -Checked names the guards this step CHECKED (guard ids, or @{ GuardId; Subject; Values;
|        Detail }; a bare id takes -Subject) and -Complete whether the run was complete. Every checked guard that did not
|        trip records that it ran on this version, and clears its open episode when the run was complete and its values are
|        within their limits (Invoke-SIGuardHeal, SI-GuardHeal.ps1). Without -Checked nothing is cleared (as before).
|        Returns the trips' results (the clears are not among them).
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Calls, [hashtable]$Common = @{}, [AllowNull()][AllowEmptyCollection()][object[]]$Checked, [bool]$Complete = $false, [string]$Subject)
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($c in @($Calls)) {
|        if ($null -eq $c) { continue }
|        try {
|            $a = @{}; foreach ($k in @($Common.Keys)) { if ($null -ne $Common[$k]) { $a[$k] = $Common[$k] } }
|            foreach ($k in @($c.Keys)) { $a[$k] = $c[$k] }
|            $out.Add((Send-SIGuardEvent @a))
|        } catch { }
|    }
|    if ($PSBoundParameters.ContainsKey('Checked') -and @($Checked | Where-Object { $_ }).Count -and (Get-Command -Name Invoke-SIGuardHeal -ErrorAction SilentlyContinue)) {
|        try {
|            $hc = @{}; foreach ($k in @($Common.Keys)) { $hc[$k] = $Common[$k] }
|            if ($Subject) { $hc['Subject'] = $Subject }
|            $null = Invoke-SIGuardHeal -Checked $Checked -Calls @($Calls | Where-Object { $_ }) -Complete $Complete -Common $hc
|        } catch { }
|    }
|    $out.ToArray()
|}
|
|function Resolve-SIGuardEventInvoke {
|    <#
|        #735 -- the database a guard event is written to (cfg.GuardEvent, the Operations > Guards (safety checks) view): the -Invoke the step
|        handed in; else the process's guard seam ($global:SI_GuardInvoke); else the Pro database of this install
|        (-ProInvoke, default Get-SIGuardProInvoke -- none without a Pro database). A test session (-IsTest) never opens one.
|        $null = no database (Community): the event still goes to run health and the uplink. Never throws.
|    #>
|    param([scriptblock]$Invoke, [bool]$IsTest = $false, [scriptblock]$ProInvoke)
|    try {
|        if ($Invoke) { return $Invoke }
|        if ($IsTest) { return $null }
|        if ($global:SI_GuardInvoke -is [scriptblock]) { return $global:SI_GuardInvoke }
|        if (-not $ProInvoke) {
|            if (-not (Get-Command -Name Get-SIGuardProInvoke -ErrorAction SilentlyContinue)) { return $null }
|            $ProInvoke = { Get-SIGuardProInvoke }
|        }
|        $p = & $ProInvoke
|        if ($p -is [array]) { $p = @($p | Where-Object { $_ -is [scriptblock] }) | Select-Object -First 1 }
|        if ($p -is [scriptblock]) { return $p }
|    } catch { }
|    $null
|}
|
|function Get-SIGuardProInvoke {
|    <#
|        The Pro SETTINGS database's (sql, params, mode) seam for the guard rows -- the engine's own -Default when it already
|        points there (or no Pro database is configured), else one opened for SI_ProSqlServer / SI_ProSqlDatabase with the
|        engine's sign-in (New-SIDataSqlInvoke; #735 loaded here when the engine has not loaded it -- a collection job writes
|        its guard rows too). Remembered for the process. Never throws.
|    #>
|    param([scriptblock]$Default, [string]$Server, [string]$Database)
|    try {
|        $ps = [string]$global:SI_ProSqlServer; $pd = [string]$global:SI_ProSqlDatabase
|        if ($ps -and $pd -and -not ($ps -eq $Server -and $pd -eq $Database) -and -not ($global:SI_GuardProInvoke -is [scriptblock]) -and -not (Get-Command -Name New-SIDataSqlInvoke -ErrorAction SilentlyContinue)) {
|            $dsq = [System.IO.Path]::Combine($PSScriptRoot, 'data-sql', 'SI-DataSql.ps1')
|            if ([System.IO.File]::Exists($dsq)) { try { . $dsq } catch { } }
|        }
|        if (-not $ps -or -not $pd -or ($ps -eq $Server -and $pd -eq $Database)) { $inv = $Default }
|        elseif ($global:SI_GuardProInvoke -is [scriptblock]) { $inv = $global:SI_GuardProInvoke }
|        elseif (Get-Command -Name New-SIDataSqlInvoke -ErrorAction SilentlyContinue) {
|            $inv = New-SIDataSqlInvoke -Server $ps -Database $pd -AppId $global:SI_SPN_AppId -TenantId $global:SI_SPN_TenantId -CertThumbprint $global:SI_SPN_CertThumbprint
|            $global:SI_GuardProInvoke = $inv
|        } else { $inv = $null }
|        if ($inv -and -not ($global:SI_GuardInvoke -is [scriptblock])) { $global:SI_GuardInvoke = $inv }
|        return $inv
|    } catch { return $Default }
|}
|
|function Get-SIGuardCallsForVulnPlan {
|    <# The vulnerability connector: a halted plan (close ceiling, empty / collapsed snapshot, scope change, incomplete run)
|       -> one 'halted' event; else results not known to be complete that held closes -> one 'held' event. #>
|    param([Parameter(Mandatory)]$Plan, $Complete, [string]$Subject)
|    if ($Plan.Halted) {
|        $g = if ($Plan.PSObject.Properties['HaltGuard'] -and $Plan.HaltGuard) { [string]$Plan.HaltGuard } else { 'vuln.connector.run-incomplete' }
|        $held = if ($Plan.PSObject.Properties['HaltHeld']) { [long]$Plan.HaltHeld } else { 0 }
|        $vals = if ($Plan.PSObject.Properties['HaltValues']) { @($Plan.HaltValues) } else { @() }
|        return @(@{ GuardId = $g; Outcome = 'halted'; Subject = $Subject; Detail = ([string]$Plan.HaltReason -replace '^\[[A-Za-z]+\]\s*', ''); Values = $vals; HeldCount = $held })
|    }
|    if ($Complete -and -not $Complete.Complete) {
|        # #850: a paged run's plan carries the count (its pages' held records are never all held at once)
|        $n = if ($Plan.PSObject.Properties['HeldIncompleteCount']) { [long]$Plan.HeldIncompleteCount } else { @($Plan.Held | Where-Object { [string]$_.Reason -like 'this run was not complete*' }).Count }
|        if ($n -gt 0) {
|            return @(@{ GuardId = 'vuln.connector.snapshot-incomplete'; Outcome = 'held'; Subject = $Subject; HeldCount = $n
|                          Detail = ('The newest Risk Analysis results are not known to be complete ({0}), so {1} record(s) that would have closed stay open.' -f [string]$Complete.Reason, $n)
|                          Values = @(@{ Name = 'heldCloses'; Label = 'Closes held back'; Measured = $n }) })
|        }
|    }
|    @()
|}
|
|function Get-SIGuardCallsForCmdbSql {
|    <# The SQL CMDB connector: a refused or stale run -> one event, its guard told apart by the refusal's reason. #>
|    param([Parameter(Mandatory)]$Result)
|    $o = [string]$Result.Outcome; $why = [string]$Result.Reason
|    if ($o -eq 'stale') { return @(@{ GuardId = 'cmdb.sql.stale'; Outcome = 'skipped'; Detail = $why }) }
|    # UPLINK-FIX (customer G 2026-10-07): a first run whose correlation map has no results yet -- shown, a WARNING (no
|    # ticket, no critical mail), never a refusal: the CI table has nothing to protect yet and the next run fills it.
|    if ($o -eq 'pending') { return @(@{ GuardId = $(if ($why -match 'profile snapshot') { 'cmdb.sql.snapshot-incomplete' } else { 'cmdb.sql.no-correlation-map' }); Outcome = 'warning'; Detail = $why }) }
|    if ($o -ne 'refused') { return @() }
|    $desired = 0; if ($Result.Plan -and $Result.Plan.Summary) { $desired = [long]$Result.Plan.Summary.Desired }
|    $g = 'cmdb.sql.snapshot-incomplete'; $vals = @()
|    if ($why -match 'correlation map') { $g = 'cmdb.sql.no-correlation-map' }
|    elseif ($why -match 'holds no asset|no kind in scope') { $g = 'cmdb.sql.empty-snapshot'; $vals = @(@{ Name = 'assetsSeen'; Label = 'Assets seen'; Measured = 0 }) }
|    elseif ($why -match '^(\w+): (\d+) asset\(s\) seen against (\d+) active CI\(s\) -- below (\d+)') {
|        $g = 'cmdb.sql.collapse'
|        $vals = @(@{ Name = 'assetsSeen'; Label = ('Assets seen ({0})' -f $Matches[1]); Measured = [long]$Matches[2] }, @{ Name = 'activeCis'; Label = 'Active CIs'; Measured = [long]$Matches[3] },
|                  @{ Name = 'seenShare'; Label = 'Seen against active'; Measured = $(if ([long]$Matches[3]) { [Math]::Round(100.0 * [long]$Matches[2] / [long]$Matches[3], 1) } else { 0 }); Limit = [long]$Matches[4]; Unit = '%' })
|    }
|    @(@{ GuardId = $g; Outcome = 'refused'; Detail = $why; Values = $vals; HeldCount = $desired })
|}
|
|function Get-SIGuardCallsForServiceNowCmdb {
|    <# The ServiceNow CMDB connector: the instance unreachable (halted), assets refused by the create / match gates (held),
|       an incoherent service model (refused). #>
|    param($Result, [int]$ModelProblems = 0, [string[]]$ModelText = @())
|    $calls = New-Object System.Collections.Generic.List[object]
|    if ($ModelProblems -gt 0) {
|        $calls.Add(@{ GuardId = 'cmdb.servicenow.service-model'; Outcome = 'refused'; Detail = ('The service model has {0} problem(s): {1}' -f $ModelProblems, ((@($ModelText) | Select-Object -First 3) -join '; '))
|                      Values = @(@{ Name = 'modelProblems'; Label = 'Problems in the service model'; Measured = $ModelProblems }) })
|    }
|    if ($Result) {
|        if ($Result.Halted) { $calls.Add(@{ GuardId = 'cmdb.servicenow.unreachable'; Outcome = 'halted'; Detail = [string]$Result.HaltReason }) }
|        $review = @($Result.Review | Where-Object { $_ })
|        # #928: the data-out push hands in the reasons (a sample) and the COUNT of rows ServiceNow did not accept
|        $n = if ($Result.PSObject.Properties['ReviewCount'] -and $null -ne $Result.ReviewCount) { [long]$Result.ReviewCount } else { [long]$review.Count }
|        if ($n -gt 0) {
|            $why = (@($review | ForEach-Object { [string]$_.Reason } | Group-Object | Sort-Object Count -Descending | Select-Object -First 3 | ForEach-Object { '{0} x {1}' -f $_.Count, $_.Name })) -join '; '
|            $calls.Add(@{ GuardId = 'cmdb.servicenow.create-gate'; Outcome = 'held'; HeldCount = $n
|                          Detail = ('{0} asset(s) were not written to ServiceNow{1}' -f $n, $(if ($why) { ': ' + $why } else { '' }))
|                          Values = @(@{ Name = 'assetsHeld'; Label = 'Assets not written'; Measured = $n }, @{ Name = 'assetsSubmitted'; Label = 'Assets submitted'; Measured = [long]$Result.Submitted }) })
|        }
|    }
|    $calls.ToArray()
|}
|
|function ConvertTo-SIGuardServiceNowPushResult {
|    <#
|        PURE. #928 (the ServiceNow push moved to ONE route, the data-out connector): the push result of one ServiceNow
|        data-out session (Open-SIDataOutSnowSession ... Close-SIDataOutSnowSession) in the shape the ServiceNow CMDB guard
|        reads (Get-SIGuardCallsForServiceNowCmdb -Result): @{ Halted; HaltReason; Review; ReviewCount; Submitted; Reached }.
|          Halted     the check before the push could not reach the instance, or the instance refused the account (a
|                     connection problem of KIND 'setup' -- no connector switched on, no credential -- is the install's
|                     setup, said by the run and Data health, never "not reachable");
|          Review     the reasons ServiceNow gave for the rows its import did not accept (at most 50), ReviewCount their number;
|          Reached    the push reached ServiceNow (the guards' checks ran and may clear).
|    #>
|    param([Parameter(Mandatory)]$Session)
|    $get = { param($o, $n) if ($null -eq $o) { $null } elseif ($o -is [System.Collections.IDictionary]) { $o[$n] } elseif ($o.PSObject.Properties[$n]) { $o.$n } else { $null } }
|    $chk = & $get $Session 'Check'
|    $conn = & $get $chk 'Connection'
|    $halted = [bool]($conn -and ($conn.Ok -eq $false) -and ([string]$conn.Kind -ne 'setup'))
|    $errs = @(@(& $get $Session 'Errors') | Where-Object { $_ } | Select-Object -First 50 | ForEach-Object { [pscustomobject]@{ Reason = [string]$_ } })
|    $notAccepted = [long](& $get $Session 'NotAccepted')
|    [pscustomobject]@{
|        Halted      = $halted
|        HaltReason  = $(if ($halted) { [string]$conn.Text } else { '' })
|        Review      = $errs
|        ReviewCount = $notAccepted
|        Submitted   = [long](& $get $Session 'Sent')
|        Reached     = [bool]($conn -and $conn.Ok -eq $true)
|    }
|}
|
|function Get-SIGuardCallsForDataSync {
|    <# The Pro data sync: collections held because their run is not known to be complete -> one 'held' event. #>
|    param([Parameter(Mandatory)]$Result)
|    $calls = New-Object System.Collections.Generic.List[object]
|    $held = @($Result.Held)
|    if ($held.Count) {
|        $rows = 0L; foreach ($h in $held) { $rows += [long]$h.Rows }
|        # per collection: when, how many findings, and WHAT was incomplete in the words of its run (its run-health message)
|        $each = @($held | Sort-Object { $_.CollectionTime } | Select-Object -First 5 | ForEach-Object {
|            $why = if ($_.PSObject.Properties['RunDetail'] -and [string]$_.RunDetail) { [string]$_.RunDetail } else { [string]$_.Reason }
|            $when = if ($_.PSObject.Properties['CollectionTime'] -and $_.CollectionTime) { [string]::Format([Globalization.CultureInfo]::InvariantCulture, 'of {0:yyyy-MM-dd HH:mm} UTC ', [datetime]$_.CollectionTime) } else { '' }
|            [string]::Format([Globalization.CultureInfo]::InvariantCulture, 'the collection {0}({1:N0} findings): {2}', $when, [long]$_.Rows, $why) })
|        $calls.Add(@{ GuardId = 'datasync.collection.held'; Outcome = 'held'; HeldCount = $held.Count
|               Detail = ('{0} collection(s) were not loaded because the Risk Analysis run that produced them did not finish completely -- {1}' -f $held.Count, ($each -join '; '))
|               Values = @(@{ Name = 'collectionsHeld'; Label = 'Collections held'; Measured = $held.Count }, @{ Name = 'rowsHeld'; Label = 'Findings in them'; Measured = $rows }) })
|    }
|    # #294: snapshots that are never loaded -- rows without their finding id, or without a CollectionTime at all
|    $refused = @(); if ($Result.PSObject.Properties['Refused']) { $refused = @($Result.Refused | Where-Object { $_ }) }
|    $untimed = @(); if ($Result.PSObject.Properties['Untimed']) { $untimed = @($Result.Untimed | Where-Object { $_ }) }
|    if ($refused.Count -or $untimed.Count) {
|        $rRows = 0L; foreach ($r in $refused) { $rRows += [long]$r.Rows }
|        $uRows = 0L; foreach ($u in $untimed) { $uRows += [long]$u.Rows }
|        $parts = New-Object System.Collections.Generic.List[string]
|        foreach ($r in $refused) { $parts.Add(('{0:yyyy-MM-dd HH:mm} UTC: {1}' -f $r.CollectionTime, [string]$r.Reason)) }
|        if ($untimed.Count) {
|            $hours = (@($untimed | Sort-Object { $_.Hour } | ForEach-Object { '{0:yyyy-MM-dd HH:00} UTC' -f ([datetime]$_.Hour) }) | Select-Object -First 5) -join ', '
|            $parts.Add([string]::Format([Globalization.CultureInfo]::InvariantCulture, 'the Risk Analysis run around {0} wrote {1:N0} row(s) without their collection time (their key columns were lost on the way into Log Analytics), so they belong to no collection and cannot be placed in a day', $hours, $uRows))
|        }
|        # #414: ONE event per distinct cause -- each refused collection and each hour of rows without a collection time is a
|        # cause; a sync that sees only causes reported before reports nothing (they stay until they age out of the window)
|        $causeKeys = @(@($refused | ForEach-Object { Get-SIGuardCauseKey -Text ([string]::Format([Globalization.CultureInfo]::InvariantCulture, 'refused|{0:yyyy-MM-ddTHH:mm:ss}', [datetime]$_.CollectionTime)) }) +
|                       @($untimed | ForEach-Object { Get-SIGuardCauseKey -Text ([string]::Format([Globalization.CultureInfo]::InvariantCulture, 'untimed|{0:yyyy-MM-ddTHH}', [datetime]$_.Hour)) }))
|        $calls.Add(@{ GuardId = 'datasync.collection.refused'; Outcome = 'refused'; HeldCount = ($refused.Count + $untimed.Count); CauseKeys = $causeKeys
|               Detail = ('Risk Analysis data that is not loaded as a day: {0}' -f ((@($parts) | Select-Object -First 5) -join '; '))
|               Values = @(@{ Name = 'collectionsRefused'; Label = 'Collections refused'; Measured = $refused.Count }, @{ Name = 'rowsRefused'; Label = 'Findings in them'; Measured = $rRows },
|                          @{ Name = 'rowsWithoutTime'; Label = 'Rows without a collection time'; Measured = $uRows }) })
|    }
|    # #428: an asset kind the findings imply that arrived as 0 CIs, or CIs with findings and no kind (the 2026-10-07
|    # "azure (0)" class) -- one event per distinct cause (collection + kind), so a repeat sync reports nothing new
|    $kc = @(); if ($Result.PSObject.Properties['Loaded']) { $kc = @($Result.Loaded | Where-Object { $_ -and $_.PSObject.Properties['KindCoverage'] -and $null -ne $_.KindCoverage }) }
|    $kParts = New-Object System.Collections.Generic.List[string]; $kKeys = New-Object System.Collections.Generic.List[string]
|    $kDropped = 0; $kKindless = 0L
|    foreach ($l in $kc) {
|        $c = $l.KindCoverage; $when = [string]::Format([Globalization.CultureInfo]::InvariantCulture, '{0:yyyy-MM-ddTHH:mm:ss}', [datetime]$l.CollectionTime)
|        foreach ($k in @($c.Dropped)) {
|            $kDropped++
|            $kParts.Add([string]::Format([Globalization.CultureInfo]::InvariantCulture, 'the collection of {0:yyyy-MM-dd HH:mm} UTC has findings on {1:N0} {2} asset(s) but 0 CIs of kind {2}', [datetime]$l.CollectionTime, [long]$c.Implied[$k], $k))
|            $kKeys.Add((Get-SIGuardCauseKey -Text ('kind|{0}|{1}' -f $when, $k)))
|        }
|        if ([long]$c.Kindless -gt 0) {
|            $kKindless += [long]$c.Kindless
|            $kParts.Add([string]::Format([Globalization.CultureInfo]::InvariantCulture, 'the collection of {0:yyyy-MM-dd HH:mm} UTC has {1:N0} asset(s) with findings and no asset kind', [datetime]$l.CollectionTime, [long]$c.Kindless))
|            $kKeys.Add((Get-SIGuardCauseKey -Text ('kindless|{0}' -f $when)))
|        }
|    }
|    if ($kParts.Count) {
|        $calls.Add(@{ GuardId = 'datasync.asset.kind-dropped'; Outcome = 'warning'; HeldCount = $kParts.Count; CauseKeys = $kKeys.ToArray()
|               Detail = ('Findings the web app''s asset kind filter cannot show: {0}' -f ((@($kParts) | Select-Object -First 5) -join '; '))
|               Values = @(@{ Name = 'kindsDropped'; Label = 'Asset kinds stored as 0'; Measured = $kDropped }, @{ Name = 'assetsWithoutKind'; Label = 'Assets with no kind'; Measured = $kKindless }) })
|    }
|    $calls.ToArray()
|}
|
|function Get-SIGuardCallsForRowCount {
|    <# Risk Analysis: the row-count guard's findings (LARGE-DROP / WENT-TO-ZERO / MISSING) -> ONE event per run, listing
|       every report. #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Findings, [string]$Template)
|    # HANDED-OFF is informational: the findings moved to the receiving report (the guard itself says "moved, not lost").
|    # Measured in the 2.2 -> 3.0 upgrade test: it raised this warning on every upgraded install's first night.
|    # BELOW-THRESHOLD (#407) is not a loss either: a one-row threshold report whose count fell to or below its threshold
|    # (the run log carries it as a warning). Ring 1, 2026-10-06: it made the run partial after a PIM activation ended.
|    $f = @($Findings | Where-Object { $_ -and [string]$_.Kind -ne 'HANDED-OFF' -and [string]$_.Kind -ne 'BELOW-THRESHOLD' })
|    if (-not $f.Count) { return @() }
|    $words = @{ 'LARGE-DROP' = 'far fewer findings'; 'WENT-TO-ZERO' = 'no findings any more'; 'MISSING' = 'no result at all'
|                'HANDOFF-LOST' = 'left to a report that produced no result -- those findings are in no report' }
|    $list = @($f | ForEach-Object { $k = [string]$_.Kind; $w = if ($words.ContainsKey($k)) { $words[$k] } else { $k.ToLowerInvariant() }; '{0}: {1} -> {2} ({3})' -f $_.Report, $_.Previous, $(if ($null -eq $_.Current) { 'none' } else { $_.Current }), $w })
|    $prev = 0L; $curr = 0L; foreach ($x in $f) { $prev += [long]$x.Previous; if ($null -ne $x.Current) { $curr += [long]$x.Current } }
|    @(@{ GuardId = 'ra.output.row-drop'; Outcome = 'warning'; Subject = $Template
|           Detail = ('{0} report(s) produced far fewer findings than the previous run: {1}' -f $f.Count, ((@($list) | Select-Object -First 20) -join '; '))
|           Values = @(@{ Name = 'reports'; Label = 'Reports affected'; Measured = $f.Count }, @{ Name = 'findingsBefore'; Label = 'Findings in them before'; Measured = $prev }, @{ Name = 'findingsNow'; Label = 'Findings in them now'; Measured = $curr }) })
|}
|
|function Get-SIGuardCallsForColumnFill {
|    <# Risk Analysis: the column-fill guard's findings (COLUMN-EMPTIED / COLUMN-VANISHED) -> ONE event per run, listing
|       every report and column. #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Findings, [string]$Template)
|    $f = @($Findings | Where-Object { $_ })
|    if (-not $f.Count) { return @() }
|    $list = @($f | ForEach-Object { '{0}.{1} ({2})' -f $_.Report, $_.Column, $(if ([string]$_.Kind -eq 'COLUMN-VANISHED') { 'gone' } else { 'empty' }) })
|    @(@{ GuardId = 'ra.output.column-emptied'; Outcome = 'warning'; Subject = $Template
|           Detail = ('{0} column(s) lost their content since the previous run: {1}' -f $f.Count, ((@($list) | Select-Object -First 20) -join '; '))
|           Values = @(@{ Name = 'columns'; Label = 'Columns affected'; Measured = $f.Count }, @{ Name = 'reports'; Label = 'Reports affected'; Measured = @($f | ForEach-Object { $_.Report } | Select-Object -Unique).Count }) })
|}
|
|function Get-SIGuardCallsForFlow {
|    <# The daily job flow, for a run THIS wake-up started or resumed: a scheduled start that was missed (catch-up, held),
|       dependent steps skipped after a failure (skipped), interrupted steps (held).
|       NOT a trip: a wake-up while the flow is running (Busy -- the runner wakes every 5 minutes, so that is every wake-up
|       of a long run), and not due (Wait / Done).
|       NOT a trip either (owner 2026-10-12, "Quiet when runs are just long"): a start that was owed ONLY because the
|       previous run was still going at its scheduled time and that was made as soon as that run ended -- every run of an
|       install whose pipeline takes longer than its schedule's interval. The run's own note says so (the runner writes
|       it at the start: Get-SIJobFlowLateStart, 'started late because the previous run was still going'), so it is in the
|       run's record and on the pipeline page, and no guard event is raised.
|       STILL a trip: a scheduled start missed for any other reason (the note says 'scheduled start was missed': no run
|       was going and it started late all the same, or it did not start when the previous run ended), and a catch-up
|       whose note does not say why (a record written before the note said it). #>
|    param([Parameter(Mandatory)]$Result)
|    $calls = New-Object System.Collections.Generic.List[object]
|    if ($Result.PSObject.Properties['Outcome'] -and [string]$Result.Outcome -in @('Busy', 'Wait', 'Done')) { return @() }
|    # #700: a run CANCELLED on purpose (a person, the updater) is not a trip -- the cancel is on the audit trail with who and why
|    if ($Result.PSObject.Properties['State'] -and [string]$Result.State -eq 'Cancelled') { return @() }
|    $flowNote =if ($Result.PSObject.Properties['Note'] -and $Result.Note) { [string]$Result.Note } else { '' }
|    $onlyLongRun = $flowNote -match 'started late because the previous run'
|    $missedStart = $flowNote -match 'scheduled start was missed'
|    if ($missedStart -or ([string]$Result.Trigger -eq 'catch-up' -and -not $onlyLongRun)) {
|        $calls.Add(@{ GuardId = 'flow.run.catch-up'; Outcome = 'held'; Detail = $(if ($flowNote) { $flowNote } else { 'A scheduled start was held until the previous flow run finished.' }) })
|    }
|    $steps = @($Result.Steps)
|    # A step STOPPED FROM OUTSIDE (an update, a roll or a person stopped its execution: Interrupted, class 'stopped') is on
|    # purpose, like a cancelled run -- not a trip, and neither are the jobs skipped because the flow stopped there (owner
|    # 2026-10-23: no run may alert for nothing). Any other interruption or skip is still a trip.
|    $stoppedOnPurpose = @($steps | Where-Object { [string]$_.State -eq 'Interrupted' -and [string]$_.ErrorClass -eq 'stopped' }).Count -gt 0
|    # #306: 'stage-blocked' = a stage that did not start because the stage before it did not succeed
|    $skipped = @($steps | Where-Object { [string]$_.State -eq 'Skipped' -and [string]$_.ErrorClass -in @('needs-failed', 'flow-stopped', 'stage-blocked') -and -not ($stoppedOnPurpose -and [string]$_.ErrorClass -eq 'flow-stopped') })
|    # #532 THROTTLE-IS-NORMAL (framework §12.18): steps skipped because a step Microsoft THROTTLED did not complete are not a
|    # trip -- throttling is normal and is never mailed; the engine raises the one "stuck" alert when it cannot catch up.
|    # Every failure of the run throttled = none of its skips is mailed; else a skip that needed a throttled step is left out.
|    $throttledJobs = @($steps | Where-Object { [string]$_.State -eq 'Failed' -and [string]$_.ErrorClass -eq 'throttled' } | ForEach-Object { [string]$_.Job })
|    if ($throttledJobs.Count) {
|        $realFailures = @($steps | Where-Object { [string]$_.State -in @('Failed', 'TimedOut', 'Interrupted') -and -not ([string]$_.State -eq 'Failed' -and [string]$_.ErrorClass -eq 'throttled') })
|        if ($realFailures.Count -eq 0) { $skipped = @() }
|        else {
|            $skipped = @($skipped | Where-Object {
|                $s = $_; $byThrottle = $false
|                if ([string]$s.ErrorClass -eq 'needs-failed') { foreach ($j in $throttledJobs) { if ([string]$s.Error -like ('needs {0},*' -f $j)) { $byThrottle = $true; break } } }
|                -not $byThrottle
|            })
|        }
|    }
|    if ($skipped.Count) {
|        $calls.Add(@{ GuardId = 'flow.step.skipped'; Outcome = 'skipped'; HeldCount = $skipped.Count
|                      Detail = ('{0} job(s) were skipped: {1}' -f $skipped.Count, ((@($skipped | ForEach-Object { '{0} ({1})' -f $_.Job, $_.Error })) -join '; '))
|                      Values = @(@{ Name = 'stepsSkipped'; Label = 'Jobs skipped'; Measured = $skipped.Count }, @{ Name = 'steps'; Label = 'Jobs in the flow'; Measured = $steps.Count }) })
|    }
|    # working rule 4: a step whose container never ran the engine was started again; it did not start that time either.
|    # 'halted' when steps that need it were skipped (or the flow stopped there), else 'skipped' (only this step is missing).
|    $never = @($steps | Where-Object { [string]$_.State -eq 'Failed' -and [string]$_.ErrorClass -eq 'never-started' })
|    if ($never.Count) {
|        $jobs = @($never | ForEach-Object { [string]$_.Job })
|        $after = New-Object System.Collections.Generic.List[object]
|        foreach ($s in $steps) {
|            if ([string]$s.State -ne 'Skipped') { continue }
|            if ([string]$s.ErrorClass -eq 'flow-stopped') { $after.Add($s); continue }
|            if ([string]$s.ErrorClass -ne 'needs-failed') { continue }
|            foreach ($j in $jobs) { if ([string]$s.Error -like ('needs {0},*' -f $j)) { $after.Add($s); break } }
|        }
|        $calls.Add(@{ GuardId = 'flow.step.start-failed'; Outcome = $(if ($after.Count) { 'halted' } else { 'skipped' }); HeldCount = $never.Count; Subject = ($jobs -join ', ')
|                      Detail = ('{0} job(s) did not start, also not when started again: {1}{2}' -f $never.Count, ((@($never | ForEach-Object { '{0} ({1} attempts)' -f $_.Job, $(if ($_.PSObject.Properties['Attempts']) { [int]$_.Attempts } else { 1 }) })) -join '; '), $(if ($after.Count) { ('; {0} job(s) after it were skipped' -f $after.Count) } else { '' }))
|                      Values = @(@{ Name = 'stepsNotStarted'; Label = 'Jobs that did not start'; Measured = $never.Count }, @{ Name = 'stepsSkipped'; Label = 'Jobs skipped because of it'; Measured = $after.Count }) })
|    }
|    $int = @($steps | Where-Object { [string]$_.State -eq 'Interrupted' -and [string]$_.ErrorClass -ne 'stopped' })
|    if ($int.Count) {
|        $calls.Add(@{ GuardId = 'flow.step.interrupted'; Outcome = 'held'; HeldCount = $int.Count
|                      Detail = ('{0} job(s) were interrupted and not started again: {1}' -f $int.Count, ((@($int | ForEach-Object { [string]$_.Job })) -join ', '))
|                      Values = @(@{ Name = 'stepsInterrupted'; Label = 'Jobs interrupted'; Measured = $int.Count }) })
|    }
|    $calls.ToArray()
|}
|
|function Get-SIGuardHealth {
|    <# How many guard events this process recorded, and how many could not be (with the last reason). #>
|    if ($null -eq $global:SI_GuardHealth) { $global:SI_GuardHealth = @{ Events = 0; Failed = 0; LastError = '' } }
|    [pscustomobject]@{ Events = [int]$global:SI_GuardHealth.Events; Failed = [int]$global:SI_GuardHealth.Failed; LastError = [string]$global:SI_GuardHealth.LastError }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-TelemetrySend.ps1'] = @{ Sha256 = '782f563e70bf1bf79afe3a1c798491b942b251fe230f2974c2036ef727b7afcd'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- SENDING the telemetry records (#226): one `heartbeat` a day and one `run` report per engine run,
|    through the framework uplink client (engine/_shared/AitUplink.ps1, a byte-identical copy of sync/_AitUplink.ps1 --
|    SecurityInsight containers and Pro installs have no sync/ folder; SIv3-Telemetry.Tests.ps1 compares the two).
|
|    WHEN: at the run-health END moment. Send-SIRunHealthRow calls Send-SITelemetryRunEnd from its `finally` for every
|    Phase 'End' record, so every engine that records its run health reports its run -- success, success-partial, error
|    and settings-error alike -- whether or not the Log Analytics record itself could be saved.
|
|    WHAT (built by SI-Telemetry.ps1, which checks every value against the agreed lists, then shaped for the wire by the
|    framework's New-AitUplinkReport, which drops anything the receiver would refuse):
|      heartbeat  product, edition, version, hosting, runtime identity kind, licence state -- once per UTC day; an
|                 IDENTIFIED (Pro / trial) heartbeat also carries Counts = users, guests, devices (#424,
|                 SI-TelemetryCounts.ps1 -- the exact definitions are there); an anonymous one carries none
|      run       the stable Job id, Outcome (ok / warning / failed from ExitReason), DurationMs, FailedStep, ErrorClass
|                 (SI-ErrorClass.ps1) and Counts
|
|    TWO MODES (Resolve-AitUplinkSender):
|      anonymous   Community, and a Pro install that has no install key yet: the public community code, a random install
|                  id kept on this machine, NO tenant, NO host name, NO error text -- the fields are never put in the
|                  record -- and counts only as buckets.
|      identified  Pro / trial with the install key from the install's Key Vault (SI-Invardia-InstallKey, the same key the
|                  updater uses), read as the runtime identity. The tenant and host are carried; the error text is
|                  redacted and shortened (here AND by the framework client AND by the receiver).
|
|    OFF: $global:SI_Telemetry_Enabled = $false (or the environment variable SI_TELEMETRY_ENABLED = false). Then nothing is
|    built, nothing is read, no file is written and no network call is made.
|
|    RULE: TELEMETRY NEVER FAILS OR SLOWS A RUN. One attempt per record from the run, a 5-second timeout, no retry in the run.
|    The first answer that is not 'ok' stops all telemetry for the rest of the process (no retry storm), and is said ONCE as
|    a warning. Nothing here throws to its caller.
|    THE OUTBOX (framework 8.4, agreed with Invardia 2026-11-05; SI-UplinkOutbox.ps1): a RUN record that was not taken --
|    no answer, a timeout, a 429, any answer that is not ok, or not sent at all because an earlier report of this process
|    was refused -- is kept in the install's own Pro database (cfg.UplinkOutbox) with ONE cheap insert (a 5-second lock
|    timeout); a failed insert is said once and the record dropped. Identified installs with the Pro database open only; an
|    install without SQL does nothing new. The heartbeat job sends the kept records again later (oldest first, in rounds,
|    after its own heartbeat) -- never an engine run. Heartbeats and setup reports are never kept: the next one replaces them.
|
|    PS 5.1 and 7.
|#>
|
|if (-not (Get-Command -Name New-SITelemetryRunRecord -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-Telemetry.ps1')) }
|if (-not (Get-Command -Name New-AitUplinkReport -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'AitUplink.ps1')) }
|if (-not (Get-Command -Name Get-SITelemetryHeartbeatCounts -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-TelemetryCounts.ps1')) }
|# the install key goes ONLY to Invardia's own address (Test-SITelemetryEndpointHost)
|if (-not (Get-Command -Name Test-SITelemetryEndpointHost -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-OutboundTrust.ps1')) }
|# CR4 (#654): the guard mode on the identified heartbeat (the stricter period after a release that changed engine code)
|if (-not (Get-Command -Name ConvertTo-SIGuardModeWire -ErrorAction SilentlyContinue) -and [System.IO.File]::Exists([System.IO.Path]::Combine($PSScriptRoot, 'SI-GuardStrict.ps1'))) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-GuardStrict.ps1')) }
|# CR3 (#657): release control -- the wave and release mode on the identified heartbeat, the 30-minute release-mode reports
|if (-not (Get-Command -Name Resolve-SIReleaseControlSwitch -ErrorAction SilentlyContinue) -and [System.IO.File]::Exists([System.IO.Path]::Combine($PSScriptRoot, 'SI-ReleaseControl.ps1'))) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-ReleaseControl.ps1')) }
|# the ring every report carries (Resolve-SIReportedRing) -- the same order the web app's header uses
|if (-not (Get-Command -Name Resolve-SIReportedRing -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-ReportedRing.ps1')) }
|# the setup report (Kind = setup, framework §8.7): the control list, once a day with the heartbeat (identified only)
|if (-not (Get-Command -Name New-SISetupReport -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-SetupUplink.ps1')) }
|# #517 / framework §12.6b: the installed licence's id on identified reports, and Invardia's "superseded by" answer
|if (-not (Get-Command -Name Get-SILicenceSupersededFromAnswer -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-LicenceSuperseded.ps1')) }
|# framework §8.9: the install's own links (endpoints) on the identified heartbeat -- behind SI_Telemetry_SendEndpoints (default off) -- and the deep Link on a failed run report
|if (-not (Get-Command -Name Get-SITelemetryInstallEndpoints -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-TelemetryEndpoints.ps1')) }
|# #709 / framework 8.16 UPLINK-CAUSES: the run record's Reports[] and the heartbeat's Capabilities / CiColumns / Licences
|if (-not (Get-Command -Name ConvertTo-SIUplinkReports -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-UplinkCauses.ps1')) }
|# #710 / framework 8.16: Invardia's answer names the install's environment (environmentId) -- kept for the customer mail's portal link
|if (-not (Get-Command -Name Get-SIInvardiaEnvironmentIdFromAnswer -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-InvardiaPortalLink.ps1')) }
|# Invardia S16: the install's LASTING id (SI-InstallId) as InstallId on every identified record (never the anonymous id)
|if (-not (Get-Command -Name Add-SIUplinkInstallId -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-InvardiaInstallId.ps1')) }
|# framework 8.4: a run record that was not taken is kept in the Pro database (cfg.UplinkOutbox); the heartbeat job sends it again
|if (-not (Get-Command -Name Add-SIUplinkOutboxRecord -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-UplinkOutbox.ps1')) }
|
|function Initialize-SIAitUplinkScope {
|    <# The framework client (AitUplink.ps1, kept as it is) holds its closed lists and the community endpoint at script scope.
|       When its functions were loaded by an outer script (a container entrypoint) and are called from an engine's own script,
|       those lists are empty there: the record lost its Edition and Outcome, and an anonymous report its endpoint. Read once
|       into the reading scope from the same file, before the client is used. Never throws. #>
|    if ($null -ne $script:AitUplinkEditions -and $null -ne $script:AitUplinkInvardiaEndpoint) { return }
|    try {
|        $f = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'engine', '_shared', 'AitUplink.ps1')
|        if ([System.IO.File]::Exists($f)) { . $f }
|    } catch { }
|}
|
|function New-SITelemetrySendState {
|    <# The sender's settings. Made when this file loads -- and again by the functions below when `$script:` is the scope
|       of a script started from the one that loaded this file (its own scope: the functions are visible there, this
|       table is not). The root comes from this function's own file, never from the caller. #>
|    $file = [string]$MyInvocation.MyCommand.ScriptBlock.File
|    $dir = if ($file) { [System.IO.Path]::GetDirectoryName($file) } else { $PSScriptRoot }
|    @{
|    SIRoot         = (Split-Path -Parent (Split-Path -Parent $dir))
|    TimeoutSec     = 5
|    InstallKeyName = 'SI-Invardia-InstallKey'
|    # Engine name (run-health Engine / launcher folder) -> the stable Job id agreed with the receiver (#226).
|    Jobs           = @{
|        'privilege-tier-classifier' = 'si-ptc'
|        'endpoint'                  = 'si-endpoint'
|        'identity'                  = 'si-identity'
|        'azure'                     = 'si-azure'
|        'publicip'                  = 'si-publicip'
|        'asset-trend'               = 'si-trend'
|        'trend'                     = 'si-trend'
|        'schema-discovery'          = 'si-schema-discovery'
|        'asset-tagging'             = 'si-asset-tagging'
|        'asset-correlation'         = 'si-correlation'
|        'correlation'               = 'si-correlation'
|        'asset-properties'          = 'si-asset-properties'
|        'asset-cmdb'                = 'si-cmdb'
|        'cmdb'                      = 'si-cmdb'
|        'asset-cmdb-sql'            = 'si-cmdb-sql'
|        'vuln-closeloop'            = 'si-vuln-closeloop'
|        'datasync'                  = 'si-datasync'
|        # UPLINK-FIX: the data sync records its runs as 'asset-datasync' (its job's name) -- unmapped, none of them was reported
|        'asset-datasync'            = 'si-datasync'
|        'updater'                   = 'si-updater'
|        'web'                       = 'si-web'
|        # #269: the daily job flow -- ONE run for the whole flow; FailedStep names the first step that did not succeed
|        'flow'                      = 'si-flow'
|        # #427: a failed step of the guided install (setup/_shared/SI-GuidedInstall.ps1) -- Send-SITelemetryFailure
|        'install'                   = 'si-install'
|    }
|    }
|}
|function Get-SITelemetrySendState {
|    <# The value of $script:SITelemetrySend, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SITelemetrySend) { $script:SITelemetrySend = New-SITelemetrySendState }
|    , $script:SITelemetrySend
|}
|$script:SITelemetrySend = $null; $null = Get-SITelemetrySendState
|
|# =====================================================================================================================
|#  Pure decisions
|# =====================================================================================================================
|function Test-SITelemetryEnabled {
|    <#
|        PURE. Is telemetry on? The setting wins when it is set, then the environment variable SI_TELEMETRY_ENABLED,
|        else ON (the owner's decision: on by default, one setting to turn it off). false / 0 / off / no turn it off.
|    #>
|    param([AllowNull()]$Value = $global:SI_Telemetry_Enabled, [AllowNull()][AllowEmptyString()][string]$EnvValue = $env:SI_TELEMETRY_ENABLED)
|    # #918: every test entry point sets SI_TELEMETRY_ENABLED=false (+ SI_TEST_GATE=1) for itself and every engine CHILD process
|    # it starts -- those never send. Inside a Pester session that variable is the gate's, not the test's: such a session never
|    # sends to Invardia anyway (Send-SITelemetryRunEnd needs its own -Transport there), and its suites test the sender with
|    # their own stub, so the gate's process-wide value is not read in it (a value passed with -EnvValue always is).
|    if (-not $PSBoundParameters.ContainsKey('EnvValue') -and "$env:SI_TEST_GATE" -eq '1' -and (Get-Module -Name Pester)) { $EnvValue = $null }
|    foreach ($v in @($Value, $EnvValue)) {
|        if ($null -eq $v) { continue }
|        if ($v -is [bool]) { return $v }
|        $s = ([string]$v).Trim().Trim('$').ToLowerInvariant()
|        if (-not $s) { continue }
|        return -not ($s -in @('false', '0', 'off', 'no', 'disabled'))
|    }
|    return $true
|}
|
|function Resolve-SITelemetryJob {
|    <# PURE. The stable Job id of an engine run, or $null (nothing is sent for an engine without one). Risk Analysis is
|       two jobs: the Summary template is si-ra-summary, every other template si-ra-detailed. #>
|    param([AllowEmptyString()][AllowNull()][string]$Engine, [AllowEmptyString()][AllowNull()][string]$ReportTemplate)
|    $e = "$Engine".Trim().ToLowerInvariant()
|    if (-not $e) { return $null }
|    if ($e -eq 'risk-analysis') {
|        if ("$ReportTemplate" -match '(?i)summary') { return 'si-ra-summary' }
|        return 'si-ra-detailed'
|    }
|    if ((Get-SITelemetrySendState).Jobs.ContainsKey($e)) { return (Get-SITelemetrySendState).Jobs[$e] }
|    return $null
|}
|
|function ConvertTo-SITelemetryExitReason {
|    <# PURE. Run health's ExitReason as one of the four the telemetry maps. The tier classifier writes 'failure' for
|       'error'; an empty or unknown value is $null (not reported rather than guessed). #>
|    param([AllowEmptyString()][AllowNull()][string]$ExitReason)
|    $x = "$ExitReason".Trim().ToLowerInvariant()
|    if ($x -in @('success', 'success-partial', 'throttled', 'error', 'settings-error')) { return $x }   # throttled: #532
|    if ($x -in @('failure', 'failed')) { return 'error' }
|    if ($x -eq 'dry-run') { return 'success' }   # #276: a dry run that went well (a failed dry run keeps its own reason)
|    return $null
|}
|
|function Get-SITelemetryHosting {
|    <# PURE (reads env only). container | arc | vm: Container Apps sets CONTAINER_APP_* and IDENTITY_ENDPOINT +
|       IDENTITY_HEADER; the Arc agent sets IDENTITY_ENDPOINT + IMDS_ENDPOINT; anything else is a VM. #>
|    param([scriptblock]$GetEnv)
|    if (-not $GetEnv) { $GetEnv = { param($n) [Environment]::GetEnvironmentVariable($n) } }
|    $ep = [string](& $GetEnv 'IDENTITY_ENDPOINT'); $hd = [string](& $GetEnv 'IDENTITY_HEADER'); $imds = [string](& $GetEnv 'IMDS_ENDPOINT')
|    if ([string](& $GetEnv 'CONTAINER_APP_JOB_NAME') -or [string](& $GetEnv 'CONTAINER_APP_NAME') -or ($ep -and $hd)) { return 'container' }
|    if ($ep -and $imds) { return 'arc' }
|    return 'vm'
|}
|
|function Get-SITelemetryRuntimeIdentity {
|    <# PURE over -Vars (default: the run's globals). The KIND of identity the engines sign in as -- never which one:
|       mi-<hosting> | spn-certificate | spn-secret. An SPN with a certificate thumbprint is spn-certificate; one with only
|       a secret is spn-secret; nothing known is spn-certificate (the internal sign-in, certificate only). #>
|    param([Parameter(Mandatory)][string]$Hosting, [System.Collections.IDictionary]$Vars)
|    if (-not $Vars) {
|        $Vars = @{ UseMi = $global:SI_UseManagedIdentity; PreferUami = $global:SI_PreferUami; UamiClientId = $global:SI_UAMI_ClientId
|                   Thumbprint = @($global:SI_SPN_CertThumbprint, $global:SpnCertificateThumbprint) -join ''
|                   Secret = @($global:SI_SPN_Secret, $global:SpnClientSecret) -join '' }
|    }
|    if ([bool]$Vars.UseMi -or ([bool]$Vars.PreferUami -and "$($Vars.UamiClientId)".Trim())) { return ('mi-' + $Hosting) }
|    if ("$($Vars.Thumbprint)".Trim()) { return 'spn-certificate' }
|    if ("$($Vars.Secret)".Trim()) { return 'spn-secret' }
|    return 'spn-certificate'
|}
|
|function Get-SITelemetryLicenceInfo {
|    <# PURE. A licence status (Get-SILicense) as Edition (community | pro | trial) + LicenceState (valid | grace |
|       expired | none). Only a valid or grace licence makes the edition pro (trial when its sku says so). #>
|    param([AllowNull()]$License)
|    $st = if ($License) { "$($License.Status)" } else { '' }
|    $state = switch ($st) { 'Valid' { 'valid' } 'Grace' { 'grace' } 'Expired' { 'expired' } default { 'none' } }
|    $edition = 'community'
|    # #510 (framework §12.6a): the sku names the edition -- a Community sku is community even while it verifies
|    if ($state -in @('valid', 'grace')) {
|        $sku = "$($License.Sku)".Trim()
|        if ($sku -match '(?i)trial') { $edition = 'trial' }
|        elseif ($sku -match '(?i)^(pro|trial)([^a-z]|$)|(^|[^a-z])msp([^a-z]|$)') { $edition = 'pro' }
|    }
|    [pscustomobject]@{ Edition = $edition; LicenceState = $state }
|}
|
|function Get-SITelemetryCounts {
|    <# PURE. The run's count under the name the receiver knows: identities for the identity engine, findings for Risk
|       Analysis, assets otherwise. A negative count means "not counted" and is not sent. #>
|    param([Parameter(Mandatory)][string]$Job, [long]$Count = -1)
|    if ($Count -lt 0) { return @{} }
|    $name = switch -Regex ($Job) { '^si-identity$' { 'identities' } '^si-ra-' { 'findings' } default { 'assets' } }
|    @{ $name = $Count }
|}
|
|function Get-SITelemetryFailedStep {
|    <# PURE. Which stage a run that did not end ok stopped in: the run context's FailedStep when the engine recorded it,
|       'settings' for a settings error, 'ra-query' for a partial Risk Analysis run, else nothing. #>
|    param([AllowNull()]$RunContext, [AllowEmptyString()][string]$ExitReason, [string]$Job)
|    if ($ExitReason -eq 'success') { return $null }
|    if ($ExitReason -eq 'settings-error') { return 'settings' }
|    if ($RunContext -and $RunContext.PSObject.Properties['FailedStep'] -and "$($RunContext.FailedStep)".Trim()) {
|        $s = ("$($RunContext.FailedStep)".Trim().ToLowerInvariant() -replace '[^a-z0-9\-]', '-') -replace '^[^a-z]+', ''
|        if ($s.Length -gt 32) { $s = $s.Substring(0, 32) }
|        if ($s -match '^[a-z][a-z0-9\-]{0,31}$') { return $s }
|    }
|    if ($ExitReason -eq 'success-partial' -and $Job -like 'si-ra-*') { return 'ra-query' }
|    return $null
|}
|
|function Get-SITelemetryStepsOk {
|    <#
|        PURE. The steps a run report lists as finished well (StepsOk): Invardia resolves a step's ticket when a later report of
|        the same job is ok and lists that step. -RunContext.StepsOk: the steps the engine finished (its stages, the pipeline's
|        steps that succeeded, the data sync's parts that did not fail ...), in their order. -FailedStep: the report's own.
|          ok        every listed step, and 'run' (the run as a whole -- the step a failure without a recorded step is reported under);
|          warning   the listed steps BEFORE the failed one when it is in the list, else every listed step; never 'run';
|          failed    none.
|        Ids in the FailedStep shape (lower-case letters, digits, dashes, at most 32), each once, at most 50.
|    #>
|    param([AllowNull()]$RunContext, [AllowEmptyString()][string]$ExitReason, [AllowEmptyString()][string]$FailedStep = '')
|    $out = New-Object System.Collections.Generic.List[string]
|    $outcome = try { Get-SITelemetryOutcome -ExitReason $ExitReason } catch { 'failed' }
|    if ($outcome -eq 'failed') { return }
|    $norm = { param($v) $s = ("$v".Trim().ToLowerInvariant() -replace '[^a-z0-9\-]', '-') -replace '^[^a-z]+', ''; if ($s.Length -gt 32) { $s = $s.Substring(0, 32) }; if ($s -cmatch '^[a-z][a-z0-9\-]{0,31}$') { $s } else { '' } }
|    $list = New-Object System.Collections.Generic.List[string]
|    if ($RunContext -and $RunContext.PSObject.Properties['StepsOk']) { foreach ($x in @($RunContext.StepsOk)) { $n = & $norm $x; if ($n -and -not $list.Contains($n)) { $list.Add($n) } } }
|    $failed = & $norm $FailedStep
|    if ($outcome -eq 'warning') {
|        $cut = if ($failed) { $list.IndexOf($failed) } else { -1 }
|        $take = if ($cut -ge 0) { $cut } else { $list.Count }
|        for ($i = 0; $i -lt $take; $i++) { if ($list[$i] -ne $failed -and $list[$i] -ne 'run') { $out.Add($list[$i]) } }
|    } else {
|        foreach ($x in $list) { $out.Add($x) }
|        if (-not $out.Contains('run')) { $out.Add('run') }
|    }
|    [string[]]@($out | Select-Object -First 50)
|}
|
|function Get-SITelemetryIncompleteReports {
|    <#
|        PURE. #641: the reports of a Risk Analysis run that are not complete, from its run context (ReportsExpected,
|        ReportsStored, ReportsIncomplete -- numbers; ReportsIncompleteLink -- the web app page that lists them).
|        $null when the run has none (or is not a Risk Analysis run that counted them).
|    #>
|    param([AllowNull()]$RunContext)
|    if ($null -eq $RunContext -or -not $RunContext.PSObject.Properties['ReportsIncomplete']) { return $null }
|    $n = 0L; if (-not [long]::TryParse([string]$RunContext.ReportsIncomplete, [ref]$n) -or $n -le 0) { return $null }
|    $num = { param($v) $x = 0L; if ([long]::TryParse([string]$v, [ref]$x) -and $x -ge 0) { $x } else { 0L } }
|    $link = ''
|    if ($RunContext.PSObject.Properties['ReportsIncompleteLink']) { $link = "$($RunContext.ReportsIncompleteLink)".Trim(); if ($link.Length -gt 400) { $link = '' } }
|    [pscustomobject]@{ Expected = (& $num $RunContext.ReportsExpected); Stored = (& $num $RunContext.ReportsStored); Incomplete = $n; Link = $link }
|}
|
|function Test-SITelemetryHeartbeatDue {
|    <# PURE. A heartbeat is due once per UTC day: when none was sent yet, or the last one was on an earlier UTC date. #>
|    param([AllowEmptyString()][AllowNull()][string]$LastSentDate, [Parameter(Mandatory)][datetime]$NowUtc)
|    $today = $NowUtc.ToUniversalTime().ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture)
|    return ("$LastSentDate".Trim() -ne $today)
|}
|
|function ConvertTo-SITelemetryWire {
|    <#
|        PURE. A record from SI-Telemetry.ps1 (heartbeat or run, already checked) as the framework's Schema 2 wire record
|        (New-AitUplinkReport). -Counts are the RAW counts: the framework buckets them itself in anonymous mode. In
|        anonymous mode the tenant, the host and the error text are not passed at all -- the SI record does not carry
|        them, and the framework would drop them anyway.
|    #>
|    param([Parameter(Mandatory)]$Record, [Parameter(Mandatory)][ValidateSet('anonymous', 'identified')][string]$Mode,
|          [System.Collections.IDictionary]$Counts, $Now,
|          # #517 / framework §12.6b: the installed licence's id -- on an IDENTIFIED report only, and only GUID-shaped (Invardia
|          # refuses the whole report for anything else)
|          [AllowEmptyString()][AllowNull()][string]$LicenceId,
|          # framework §8.9: the install's own links as `endpoints` -- on an IDENTIFIED heartbeat only, and only while the send
|          # gate is on (SI_Telemetry_SendEndpoints, default OFF; ConvertTo-SITelemetryEndpointList: kind + url (+ label),
|          # at most 12, https, no query string); never on an anonymous record
|          [AllowNull()][object[]]$Endpoints,
|          # the deep link of an IDENTIFIED run report that did not end ok (the web app's run-health page), https only
|          [AllowEmptyString()][AllowNull()][string]$Link,
|          # MAIL-3 (#653, framework §12.11a item 4): the environment's name as the web app's header shows it -- optional,
|          # on an IDENTIFIED heartbeat / run report only (a name says whose install it is: never anonymous)
|          [AllowEmptyString()][AllowNull()][string]$EnvironmentName,
|          # CR4 (#654, framework §12.11b item 5): the install's guard mode (ConvertTo-SIGuardModeWire) -- on an IDENTIFIED
|          # heartbeat only; $null (no fingerprint recorded: an older install) = left out
|          [AllowNull()]$GuardMode,
|          # CR3 (#657, framework 12.11e item 4): wave { name, version, ring } and releaseMode { version, sinceUtc, untilUtc,
|          # everyMinutes } -- on an IDENTIFIED heartbeat only, each as @{ Known; Value } (Get-SITelemetryReleaseFields):
|          # Known = the field is sent (Value $null = JSON null: no wave / not in release mode); $null = left out
|          [AllowNull()]$Wave, [AllowNull()]$ReleaseMode,
|          # CR3 (framework 12.11e items 3 + 5(a), 2026-10-18): components (Testing / Stable per component) and evidence (the daily
|          # counts and verdicts) -- identified heartbeat only, each @{ Known; Value } like wave; $null = left out
|          [AllowNull()]$Components, [AllowNull()]$Evidence,
|          # #709 / framework 8.16: the run record's Reports (ConvertTo-SIUplinkReports -- already shaped, at most 20, Detail only
|          # when identified) and the heartbeat's probe (Get-SICapabilityProbe: Capabilities, CiColumns; Licences identified only)
|          [AllowNull()][object[]]$Reports, [AllowNull()]$Probe,
|          # framework 4.1b (owner 2026-10-18): the Invardia Support app's database access, READ ONLY (SI-SupportSqlAccess.ps1,
|          # Get-SISupportSqlAccess .Wire: group, dbUser, checkedUtc, healedUtc -- healedUtc always null, SI never heals) -- on an
|          # IDENTIFIED heartbeat only; $null (no Support app recorded, or not read) = left out
|          [AllowNull()]$SupportSqlAccess,
|          # CR2: the build label (Get-SITelemetryVersion; default: read here) -- the field `build` on a heartbeat / run report when it
|          # differs from Version (the release); '' = no field. A test session reads no label of its own (pass -Build)
|          [AllowNull()][AllowEmptyString()][string]$Build)
|    $a = @{ Kind = [string]$Record.Kind; Mode = $Mode; Product = [string]$Record.Product; Version = [string]$Record.Version; Ring = $Record.Ring
|            Edition = [string]$Record.Edition; Hosting = [string]$Record.Hosting; RuntimeIdentity = [string]$Record.RuntimeIdentity
|            LicenceState = [string]$Record.LicenceState }
|    if ($Now) { $a.Now = $Now }
|    if ($Record.Kind -eq 'heartbeat' -and $Mode -eq 'identified' -and $Counts -and $Counts.Count) {
|        # #424: the tenant counts ride ONLY on an identified heartbeat; an anonymous one never carries them.
|        $h = @{}; foreach ($k in @($Counts.Keys)) { if ((Get-SITelemetryHeartbeatCountNames) -contains [string]$k) { $h[[string]$k] = $Counts[$k] } }
|        if ($h.Count) { $a.Counts = $h }
|    }
|    if ($Record.Kind -eq 'run') {
|        $a.Job = [string]$Record.Job; $a.Outcome = [string]$Record.Outcome; $a.DurationMs = $Record.DurationMs
|        $a.FailedStep = [string]$Record.FailedStep; $a.ErrorClass = [string]$Record.ErrorClass
|        if ($Counts -and $Counts.Count) { $h = @{}; foreach ($k in @($Counts.Keys)) { $h[[string]$k] = $Counts[$k] }; $a.Counts = $h }
|    }
|    if ($Mode -eq 'anonymous') {
|        $a.InstallId = [string]$Record.InstallId
|    } else {
|        $a.TenantId = [string]$Record.ClaimedTenantId
|        $a.HostName = [string]$Record.Host
|        if ($Record.PSObject.Properties['ErrorText']) { $a.ErrorText = [string]$Record.ErrorText }
|    }
|    Initialize-SIAitUplinkScope
|    $w = New-AitUplinkReport @a
|    # #719: the framework client keeps the first 40 Counts keys by name (10 before main's 2026-10-13 copy); Invardia takes up
|    # to 40 per record -- SI still shapes the identified
|    # heartbeat's Counts itself (SI-TelemetryCounts.ps1: the agreed names, whole numbers >= 0, at most 38)
|    if ($w -and $a.ContainsKey('Counts') -and $Record.Kind -eq 'heartbeat' -and (Get-Command -Name ConvertTo-SITelemetryCountsWire -ErrorAction SilentlyContinue)) {
|        $cw = ConvertTo-SITelemetryCountsWire -Counts $a.Counts
|        if ($cw) { $w | Add-Member -NotePropertyName 'Counts' -NotePropertyValue $cw -Force }
|    }
|    # framework §8.5 CLOSE-LOOP: a run report that did not end ok names WHO fixes it -- customer-config (the customer's
|    # permission, consent, licence or setting; Invardia shows "needs customer action" and opens no fix request) or
|    # product-defect. Decided from the error class only (Get-SIErrorFixKind); no class = no FixKind. Added here, beside the
|    # framework client, so AitUplink.ps1 stays as it is. Anonymous reports carry it too (an enum identifies nobody).
|    if ($w -and $Record.Kind -eq 'run' -and "$($w.ErrorClass)".Trim() -and "$($w.Outcome)" -ne 'ok' -and (Get-Command -Name Get-SIErrorFixKind -ErrorAction SilentlyContinue)) {
|        $fk = Get-SIErrorFixKind -ErrorClass ([string]$w.ErrorClass)
|        if ($fk) { $w | Add-Member -NotePropertyName 'FixKind' -NotePropertyValue $fk -Force }
|    }
|    # the steps the run finished well (StepsOk, the FailedStep shape, at most 50): on identified and anonymous reports alike
|    # (ids identify nobody) -- Invardia resolves a step's ticket on a later ok report that lists it
|    if ($w -and $Record.Kind -eq 'run' -and $Record.PSObject.Properties['StepsOk'] -and @($Record.StepsOk | Where-Object { $_ }).Count) {
|        $w | Add-Member -NotePropertyName 'StepsOk' -NotePropertyValue ([string[]]@($Record.StepsOk | Where-Object { $_ } | Select-Object -First 50)) -Force
|    }
|    if ($w -and $Mode -eq 'identified' -and $Record.Kind -in @('heartbeat', 'run') -and (Get-Command -Name ConvertTo-SILicenceIdOrEmpty -ErrorAction SilentlyContinue)) {
|        $lid = ConvertTo-SILicenceIdOrEmpty $LicenceId
|        if ($lid) { $w | Add-Member -NotePropertyName 'LicenceId' -NotePropertyValue $lid -Force }
|    }
|    # REMOVE-ME gate: Invardia refuses the WHOLE report (422) for a list its validator does not accept, and that validator is
|    # not live yet -- the list rides only while SI_Telemetry_SendEndpoints is on (default off)
|    if ($w -and $Mode -eq 'identified' -and $Record.Kind -eq 'heartbeat' -and $Endpoints -and (Get-Command -Name ConvertTo-SITelemetryEndpointList -ErrorAction SilentlyContinue) -and (Test-SITelemetrySendEndpoints)) {
|        $eps = @(ConvertTo-SITelemetryEndpointList -Items $Endpoints)
|        if ($eps.Count) { $w | Add-Member -NotePropertyName 'endpoints' -NotePropertyValue $eps -Force }
|    }
|    if ($w -and $Mode -eq 'identified' -and $Record.Kind -eq 'run' -and "$($w.Outcome)" -ne 'ok' -and "$Link".Trim() -and (Get-Command -Name ConvertTo-SITelemetryEndpointUrl -ErrorAction SilentlyContinue)) {
|        $lk = ConvertTo-SITelemetryEndpointUrl $Link
|        if ($lk) { $w | Add-Member -NotePropertyName 'Link' -NotePropertyValue $lk -Force }
|    }
|    # Invardia accepts the field since 2026-10-14 (it reads environmentName and EnvironmentName); no name, no field
|    if ($w -and $Mode -eq 'identified' -and $Record.Kind -in @('heartbeat', 'run')) {
|        $en = ConvertTo-SITelemetryEnvironmentName $EnvironmentName
|        if ($en) { $w | Add-Member -NotePropertyName 'environmentName' -NotePropertyValue $en -Force }
|    }
|    # Invardia 1.0.445 reads guardMode on an identified heartbeat (lenient: a value it does not understand is ignored, the
|    # report is still taken); never on an anonymous one
|    if ($w -and $Mode -eq 'identified' -and $Record.Kind -eq 'heartbeat' -and $GuardMode) {
|        $gmMode = if ($GuardMode -is [System.Collections.IDictionary]) { [string]$GuardMode['mode'] } elseif ($GuardMode.PSObject.Properties['mode']) { [string]$GuardMode.mode } else { '' }
|        if ($gmMode -in @('strict', 'normal')) { $w | Add-Member -NotePropertyName 'guardMode' -NotePropertyValue ([pscustomobject]$GuardMode) -Force }
|    }
|    # CR3 (#657): the release fields -- behind SI_Telemetry_ReleaseControl (Get-SITelemetryReleaseFields decides); never anonymous
|    if ($w -and $Mode -eq 'identified' -and $Record.Kind -eq 'heartbeat') {
|        foreach ($f in @(@{ N = 'wave'; V = $Wave }, @{ N = 'releaseMode'; V = $ReleaseMode }, @{ N = 'components'; V = $Components }, @{ N = 'evidence'; V = $Evidence })) {
|            $fv = $f.V
|            if ($null -eq $fv -or -not $fv.Known) { continue }
|            $val = if ($null -ne $fv.Value) { [pscustomobject]$fv.Value } else { $null }
|            $w | Add-Member -NotePropertyName $f.N -NotePropertyValue $val -Force
|        }
|    }
|    # CR2 (Invardia 2026-10-18): Version is the release; the build label rides as `build` -- only when it says something else
|    if ($w -and $Record.Kind -in @('heartbeat', 'run')) {
|        $bl = if ($PSBoundParameters.ContainsKey('Build')) { [string]$Build } elseif (Get-Module -Name Pester) { '' } else { try { [string](Get-SITelemetryVersion) } catch { '' } }
|        $bl = $bl.Trim()
|        if ($bl -and $bl -ne [string]$w.Version -and $bl.Length -le 100) { $w | Add-Member -NotePropertyName 'build' -NotePropertyValue $bl -Force }
|    }
|    # framework 4.1b: supportSqlAccess { group, dbUser, checkedUtc, healedUtc } -- identified heartbeat only; group / dbUser are
|    # true / false, or null when they could not be checked (never claimed); healedUtc is always null (Invardia heals, not SI)
|    if ($w -and $Mode -eq 'identified' -and $Record.Kind -eq 'heartbeat' -and $SupportSqlAccess) {
|        $sv = ConvertTo-SITelemetrySupportSqlAccessWire $SupportSqlAccess
|        if ($sv) { $w | Add-Member -NotePropertyName 'supportSqlAccess' -NotePropertyValue $sv -Force }
|    }
|    # #709 / framework 8.16 UPLINK-CAUSES (Invardia 1.0.477). A problem here never costs the record: anything that fails is
|    # left out, and the sender sends the record again without these fields when Invardia refuses it.
|    if ($w -and $Record.Kind -eq 'run' -and $Reports -and @($Reports).Count) {
|        try {
|            $items = @(@($Reports) | Where-Object { $_ -and "$($_.Code)".Trim() -and "$($_.CauseClass)".Trim() } | Select-Object -First 20)
|            if ($Mode -ne 'identified') { $items = @($items | ForEach-Object { $c = $_.PSObject.Copy(); if ($c.PSObject.Properties['Detail']) { $c.PSObject.Properties.Remove('Detail') }; $c }) }
|            if ($items.Count) { $w | Add-Member -NotePropertyName 'Reports' -NotePropertyValue $items -Force; $w = Limit-SIUplinkRecordSize -Record $w }
|        } catch { if ($w.PSObject.Properties['Reports']) { $w.PSObject.Properties.Remove('Reports') } }
|    }
|    if ($w -and $Record.Kind -eq 'heartbeat' -and $Probe) {
|        try {
|            if ($Probe.Capabilities -and @($Probe.Capabilities.Keys).Count) { $w | Add-Member -NotePropertyName 'Capabilities' -NotePropertyValue ([pscustomobject]$Probe.Capabilities) -Force }
|            if (@($Probe.CiColumns).Count) { $w | Add-Member -NotePropertyName 'CiColumns' -NotePropertyValue @(@($Probe.CiColumns) | Select-Object -First 40) -Force }
|            # the tenant's licences say whose tenant it is: an identified heartbeat only
|            if ($Mode -eq 'identified' -and @($Probe.Licences).Count) { $w | Add-Member -NotePropertyName 'Licences' -NotePropertyValue @(@($Probe.Licences) | Select-Object -First 40) -Force }
|        } catch { foreach ($n in 'Capabilities', 'CiColumns', 'Licences') { if ($w.PSObject.Properties[$n]) { $w.PSObject.Properties.Remove($n) } } }
|    }
|    $w
|}
|
|# the fields a record carries that Invardia may refuse; a refused record goes again ONCE without them (#657 release fields,
|# #709 report causes and the capability probe; #718 the hourly heartbeat's collection state and pipeline progress; #719 the
|# hourly heartbeat's eight further fields, SI-HeartbeatFields.ps1)
|function Get-SITelemetryOptionalFields { @('wave', 'releaseMode', 'components', 'evidence', 'Reports', 'Capabilities', 'CiColumns', 'Licences', 'Collections', 'runProgress',
|                                          'Pipeline', 'Jobs', 'Sources', 'Database', 'Update', 'Mail', 'Warnings', 'Security', 'Published', 'DataOut', 'supportSqlAccess', 'build',
|                                          # #1065 (3.0.30): in Invardia's closed list and taken leniently -- here only so a refusal never costs the record
|                                          'setupSteps',
|                                          # framework rule 11g: a private install's image build pool -- behind its own switch, off until Invardia confirms
|                                          'BuildPool',
|                                          # framework 8.4: the run records kept unsent (the outbox) -- behind its own switch (on: Invardia deployed it 2026-11-05)
|                                          'UplinkBacklog') }
|
|function ConvertTo-SITelemetrySupportSqlAccessWire {
|    <# PURE. The heartbeat's supportSqlAccess, exactly { group, dbUser, checkedUtc, healedUtc }: group / dbUser true, false or
|       null; checkedUtc an ISO UTC time (required -- none = $null, the field is left out); healedUtc always null (SecurityInsight
|       never heals: Invardia does). Anything else in the input is dropped. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    $get = { param($k) if ($Value -is [System.Collections.IDictionary]) { if ($Value.Contains($k)) { $Value[$k] } else { $null } } elseif ($Value.PSObject.Properties[$k]) { $Value.$k } else { $null } }
|    $tri = { param($v) if ($null -eq $v) { $null } elseif ($v -is [bool]) { $v } else { $null } }
|    $c = & $get 'checkedUtc'
|    if ($null -eq $c -or -not "$c".Trim()) { return $null }
|    try { $iso = ([datetime]$c).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) } catch { return $null }
|    $o = [ordered]@{ group = (& $tri (& $get 'group')); dbUser = (& $tri (& $get 'dbUser')); checkedUtc = $iso; healedUtc = $null }
|    # #1021 (agreed with Invardia 2026-11-01): the support grant's keys are ADDED -- never in place of the four above -- and
|    # only when the heartbeat put them there (its switch SI_Uplink_SendSupportSqlAccessJit): readOnly true / false / null,
|    # jitOpen true / false, jitUntil an ISO UTC time or null
|    $has = { param($k) if ($Value -is [System.Collections.IDictionary]) { $Value.Contains($k) } else { [bool]$Value.PSObject.Properties[$k] } }
|    if ((& $has 'readOnly') -or (& $has 'jitOpen') -or (& $has 'jitUntil')) {
|        $o['readOnly'] = (& $tri (& $get 'readOnly'))
|        $o['jitOpen'] = [bool](& $tri (& $get 'jitOpen'))
|        $ju = & $get 'jitUntil'; $o['jitUntil'] = $null
|        if ($null -ne $ju -and "$ju".Trim()) { try { $o['jitUntil'] = ([datetime]$ju).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) } catch { $o['jitUntil'] = $null } }
|    }
|    [pscustomobject]$o
|}
|
|function Get-SITelemetryReleaseFields {
|    <#
|        CR3 (#657): the release fields of an IDENTIFIED heartbeat -- @{ On; Wave; ReleaseMode; Invoke; Rows; Reason }; Wave /
|        ReleaseMode are @{ Known; Value } for ConvertTo-SITelemetryWire, or $null (left out). Nothing at all when:
|        anonymous; SI_Telemetry_ReleaseControl does not allow it for this ring (Resolve-SIReleaseControlSwitch); held for 24
|        hours after Invardia refused a heartbeat with them; no Pro database; a test session without -Rows. NEVER throws.
|          -Rows    the cfg.InstallState rows (Read-SIReleaseControlRows) -- or the context's ReleaseRows (tests)
|          -Invoke  the Pro database seam (default: the one the job has open, Get-SIReleaseControlInvoke)
|    #>
|    param([Parameter(Mandatory)]$Context, [Parameter(Mandatory)][datetime]$NowUtc, [scriptblock]$Invoke, $Rows)
|    $out = [pscustomobject]@{ On = $false; Wave = $null; ReleaseMode = $null; Components = $null; Evidence = $null; Invoke = $Invoke; Rows = $null; Reason = '' }
|    try {
|        if (-not (Get-Command -Name Resolve-SIReleaseControlSwitch -ErrorAction SilentlyContinue)) { $out.Reason = 'this release does not carry release control'; return $out }
|        if ($Context.Mode -eq 'anonymous') { $out.Reason = 'anonymous: never'; return $out }
|        $sw = Resolve-SIReleaseControlSwitch -Ring $(if ($Context.PSObject.Properties['Ring']) { $Context.Ring } else { $null })
|        if (-not $sw.On) { $out.Reason = $sw.Reason; return $out }
|        if (-not $Rows -and $Context.PSObject.Properties['ReleaseRows']) { $Rows = $Context.ReleaseRows }
|        if (-not $Rows) {
|            if (-not $Invoke) {
|                if (Get-Module -Name Pester) { $out.Reason = 'a test session never reads a database'; return $out }
|                $Invoke = Get-SIReleaseControlInvoke
|            }
|            if (-not $Invoke) { $out.Reason = 'no Pro database is open in this run'; return $out }
|            $Rows = Read-SIReleaseControlRows -Invoke $Invoke
|        }
|        $out.Invoke = $Invoke; $out.Rows = $Rows
|        if (Test-SIReleaseControlHold -Hold ([string]$Rows.ReleaseControlHold) -NowUtc $NowUtc) { $out.Reason = 'held for 24 hours: Invardia refused a heartbeat that carried them'; return $out }
|        $m = Get-SIReleaseModeFromFingerprint -Fingerprint ([string]$Rows.EngineFingerprint) -NowUtc $NowUtc
|        if ($m.Known) { $out.ReleaseMode = [pscustomobject]@{ Known = $true; Value = $m.Wire } }
|        $wv = Get-SIReleaseWaveFromUpdateState -Json ([string]$Rows.UpdateState)
|        if ($wv.Known) { $out.Wave = [pscustomobject]@{ Known = $true; Value = $wv.Wave } }
|        # framework 12.11e items 3 + 5(a): Testing / Stable per component and the daily evidence -- a failed read leaves
|        # only these two out (the context's ReleaseEvidence in tests: @{ Components; Evidence })
|        try {
|            $ef = if ($Context.PSObject.Properties['ReleaseEvidence']) { $Context.ReleaseEvidence } elseif ($Invoke -and (Get-Command -Name Read-SIReleaseEvidenceFields -ErrorAction SilentlyContinue)) { Read-SIReleaseEvidenceFields -Invoke $Invoke -Rows $Rows -NowUtc $NowUtc } else { $null }
|            if ($ef -and $ef.Components) { $out.Components = [pscustomobject]@{ Known = $true; Value = $ef.Components } }
|            if ($ef -and $ef.Evidence) { $out.Evidence = [pscustomobject]@{ Known = $true; Value = $ef.Evidence } }
|        } catch { $out.Components = $null; $out.Evidence = $null }
|        $out.On = [bool]($out.ReleaseMode -or $out.Wave -or $out.Components -or $out.Evidence)
|        $out.Reason = $sw.Reason
|    } catch { $out.On = $false; $out.Wave = $null; $out.ReleaseMode = $null; $out.Reason = ("not read: {0}" -f $_.Exception.Message) }
|    $out
|}
|
|function Get-SITelemetryGuardModeWire {
|    <#
|        CR4 (#654): the identified heartbeat's guardMode (ConvertTo-SIGuardModeWire), from the FIRST of:
|          -Context.GuardMode       (tests, or a caller that has it)
|          -Rows                    the cfg.InstallState rows already read (Read-SIReleaseControlRows: EngineFingerprint, GuardStrictEnd)
|          -Invoke                  the Pro database the sender has open (Read-SIGuardModeState)
|          Get-SIGuardModeNow       the guard code's own database (an engine run; never in a test session)
|        LIVE 2026-10-18: the half-hourly heartbeat job has the Pro database open but not the guard code that finds it by
|        itself, so it read "nothing recorded" and sent NO guardMode while the install was strict. $null = no fingerprint is
|        recorded (an older install) or nothing could be read -- the field is left out. NEVER throws.
|    #>
|    param($Context, [scriptblock]$Invoke, $Rows, [Parameter(Mandatory)][datetime]$NowUtc)
|    try {
|        if ($Context -and $Context.PSObject.Properties['GuardMode']) { return $Context.GuardMode }
|        if (-not (Get-Command -Name ConvertTo-SIGuardModeWire -ErrorAction SilentlyContinue)) { return $null }
|        if ($Rows -and $Rows.PSObject.Properties['EngineFingerprint'] -and "$($Rows.EngineFingerprint)".Trim()) {
|            return (ConvertTo-SIGuardModeWire -Mode (Get-SIGuardModeFromState -Fingerprint ([string]$Rows.EngineFingerprint) -StrictEnd ([string]$Rows.GuardStrictEnd) -NowUtc $NowUtc))
|        }
|        if ($Invoke) { return (ConvertTo-SIGuardModeWire -Mode (Read-SIGuardModeState -Invoke $Invoke -NowUtc $NowUtc)) }
|        if (Get-Module -Name Pester) { return $null }
|        ConvertTo-SIGuardModeWire -Mode (Get-SIGuardModeNow -NowUtc $NowUtc)
|    } catch { $null }
|}
|
|function Test-SITelemetryHasReleaseFields {
|    <# PURE. Does a wire record carry a release field (wave / releaseMode)? #>
|    param($Record)
|    [bool]($Record -and ($Record.PSObject.Properties['wave'] -or $Record.PSObject.Properties['releaseMode'] -or $Record.PSObject.Properties['components'] -or $Record.PSObject.Properties['evidence']))
|}
|
|function Send-SITelemetryRecordWithFallback {
|    <#
|        CR3 (#657, framework 12.22 3(b)): one record through -Transport; a heartbeat with the release fields that is NOT taken
|        is sent again ONCE without them -- when that one is taken, the fields are held back for 24 hours (-Invoke:
|        cfg.InstallState 'ReleaseControlHold') and said once. Returns @{ Result; Record; Held }. Never throws past the transport.
|    #>
|    param([Parameter(Mandatory)]$Record, [Parameter(Mandatory)][scriptblock]$Transport, [Parameter(Mandatory)]$Context, [int]$TimeoutSec = 5,
|          [scriptblock]$Invoke, [datetime]$NowUtc = [datetime]::UtcNow)
|    # Invardia S16: every IDENTIFIED record (heartbeat, run -- not the setup report) carries the install's LASTING id as
|    # InstallId; an anonymous record keeps only its own random id, and no lasting id (none / unreadable) = no field
|    if ($Record -and [string]$Context.Mode -eq 'identified' -and $Context.PSObject.Properties['LastingInstallId']) {
|        $Record = Add-SIUplinkInstallId -Record $Record -InstallId ([string]$Context.LastingInstallId)
|    }
|    $r = & $Transport $Record $Context.Endpoint $Context.AccessCode $TimeoutSec
|    # #902: a record with HOLD items (class held-last-good / held-too-long, or the hold fields) that is NOT taken goes again
|    # first WITHOUT those items only -- a validator that does not know the hold contract yet never costs the real failures
|    if ("$($r.Status)" -ne 'ok' -and $Record -and $Record.PSObject.Properties['Reports'] -and (Get-Command -Name Get-SIUplinkCausesContract -ErrorAction SilentlyContinue)) {
|        $hc = Get-SIUplinkCausesContract
|        $isHold = { param($i) $i -and (([string]$i.CauseClass -in @([string]$hc.HoldClassInfo, [string]$hc.HoldClassEscalated)) -or $i.PSObject.Properties[[string]$hc.HoldFieldHeld]) }
|        $all = @($Record.Reports)
|        $keep = @($all | Where-Object { -not (& $isHold $_) })
|        if ($keep.Count -lt $all.Count) {
|            if ($keep.Count) { $Record.Reports = $keep } else { $Record.PSObject.Properties.Remove('Reports') }
|            if (-not $global:SI_UplinkHoldsWarned) { $global:SI_UplinkHoldsWarned = $true; Write-SIUplinkDiag ("Invardia did not take the run report with the held reports ({0}) -- it goes again without them" -f "$($r.Reason)") }
|            $r = & $Transport $Record $Context.Endpoint $Context.AccessCode $TimeoutSec
|        }
|    }
|    $opt = @(Get-SITelemetryOptionalFields | Where-Object { $Record -and $Record.PSObject.Properties[$_] })
|    if ("$($r.Status)" -eq 'ok' -or -not $opt.Count) { return [pscustomobject]@{ Result = $r; Record = $Record; Held = $false } }
|    $first = "$($r.Reason)"
|    $hadRelease = [bool](Test-SITelemetryHasReleaseFields $Record)
|    # #709: a record with Reports[] / the capability probe that is NOT taken goes again without them -- the run record matters
|    # more than its causes (framework 8.16: send without Reports rather than fail)
|    foreach ($n in $opt) { $Record.PSObject.Properties.Remove($n) }
|    $r2 = & $Transport $Record $Context.Endpoint $Context.AccessCode $TimeoutSec
|    if ("$($r2.Status)" -ne 'ok') { return [pscustomobject]@{ Result = $r2; Record = $Record; Held = $false } }
|    if (@($opt | Where-Object { $_ -notin @('wave', 'releaseMode', 'components', 'evidence', 'Collections', 'runProgress', 'Pipeline', 'Jobs', 'Sources', 'Database', 'Update', 'Mail', 'Warnings', 'Security', 'Published', 'DataOut', 'supportSqlAccess', 'build', 'setupSteps', 'UplinkBacklog') }).Count) {
|        if (-not $global:SI_UplinkCausesWarned) { $global:SI_UplinkCausesWarned = $true; Write-SIUplinkDiag ("Invardia did not take the status report with the report causes / capability fields ({0}) -- it was sent without them" -f (ConvertTo-AitUplinkRedacted -Text $first)) }
|    }
|    if (-not $hadRelease) { return [pscustomobject]@{ Result = $r2; Record = $Record; Held = $false } }
|    $held = $false
|    if (Get-Command -Name Save-SIReleaseControlHold -ErrorAction SilentlyContinue) { $held = Save-SIReleaseControlHold -Invoke $Invoke -NowUtc $NowUtc -Why (ConvertTo-AitUplinkRedacted -Text $first) }
|    if (-not $global:SI_ReleaseControlWarned) {
|        $global:SI_ReleaseControlWarned = $true
|        try { Write-Warning ("Invardia did not take the status report with the release fields (wave, release mode) -- it was sent without them{0}. To turn them off: SI_Telemetry_ReleaseControl = off." -f $(if ($held) { ', and they are held back for 24 hours' } else { '' })) } catch { }
|    }
|    [pscustomobject]@{ Result = $r2; Record = $Record; Held = $held }
|}
|
|function ConvertTo-SITelemetryEnvironmentName {
|    <# PURE. The environment's name for the uplink: trimmed, one line, without a ring / edition it carries itself
|       ('Internal (ring 1, PRO)' -> 'Internal', the same name the mail subjects use), at most 100 characters; '' = left out. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    $v = ("$Value" -replace '[\r\n\t]+', ' ').Trim()
|    $v = ($v -replace '(?i)\s*\([^()]*\b(ring\s*\d|pro|community)\b[^()]*\)\s*$', '').Trim()
|    if ($v.Length -gt 100) { $v = $v.Substring(0, 100).TrimEnd() }
|    $v
|}
|
|function Get-SITelemetryEnvironmentName {
|    <#
|        The environment's name as the web app's header shows it (MAIL-3 / #653: the same name the mail subjects carry):
|        SIWeb_EnvironmentName, else SI_EnvironmentName. Not set = '' (left out -- the install id is not a name). -Globals
|        is the test seam.
|    #>
|    param([System.Collections.IDictionary]$Globals)
|    foreach ($n in @('SIWeb_EnvironmentName', 'SI_EnvironmentName')) {
|        $v = if ($Globals) { if ($Globals.Contains($n)) { $Globals[$n] } else { $null } } else { Get-Variable -Name $n -Scope Global -ValueOnly -ErrorAction SilentlyContinue }
|        $v = ConvertTo-SITelemetryEnvironmentName ([string]$v)
|        if ($v) { return $v }
|    }
|    ''
|}
|
|# =====================================================================================================================
|#  This install: where state is kept, the install id, the install key, the endpoint
|# =====================================================================================================================
|function Get-SITelemetryStateDirectory {
|    <# Where the install id and the last heartbeat date are kept: SI_TELEMETRY_STATE_DIR, else
|       %ProgramData%\SecurityInsight\telemetry on Windows, else ~/.securityinsight/telemetry. #>
|    param([scriptblock]$GetEnv)
|    if (-not $GetEnv) { $GetEnv = { param($n) [Environment]::GetEnvironmentVariable($n) } }
|    $d = [string](& $GetEnv 'SI_TELEMETRY_STATE_DIR')
|    if ($d.Trim()) { return $d.Trim() }
|    if ([Environment]::OSVersion.Platform -eq [PlatformID]::Win32NT) {
|        return [System.IO.Path]::Combine([Environment]::GetFolderPath('CommonApplicationData'), 'SecurityInsight', 'telemetry')
|    }
|    $h = [Environment]::GetFolderPath('UserProfile'); if (-not $h) { $h = [System.IO.Path]::GetTempPath() }
|    [System.IO.Path]::Combine($h, '.securityinsight', 'telemetry')
|}
|
|function Test-SITelemetryProInstall {
|    <# PURE (with -GetEnv). Does this install have a Pro database (the setting, or the container's SI_CFG_ variable)? #>
|    param([scriptblock]$GetEnv)
|    if (-not $GetEnv) { $GetEnv = { param($n) [Environment]::GetEnvironmentVariable($n) } }
|    if ("$($global:SI_ProSqlServer)".Trim() -and "$($global:SI_ProSqlDatabase)".Trim()) { return $true }
|    return [bool]("$(& $GetEnv 'SI_CFG_SI_ProSqlServer')".Trim() -and "$(& $GetEnv 'SI_CFG_SI_ProSqlDatabase')".Trim())
|}
|
|function Get-SITelemetryInstallId {
|    <#
|        The anonymous install id: a random GUID created ONCE and kept in <state>\install-id. It identifies nothing but
|        "the same install as last time". When the file cannot be written (a read-only disk) a fresh id is used for this
|        process. Never throws.
|    #>
|    param([Parameter(Mandatory)][string]$StateDirectory, [scriptblock]$GetEnv)
|    # A CONTAINER keeps no file between runs: every run was a "new install" (6 installs reported for 3 -- fix request
|    # 85bd728f). There the id is derived from the install's own storage account name (one per install, the same every
|    # run); it still identifies nothing but "the same install as last time".
|    if (-not $GetEnv) { $GetEnv = { param($n) [Environment]::GetEnvironmentVariable($n) } }
|    $stg = "$(& $GetEnv 'SI_STORAGE_ACCOUNT')".Trim().ToLowerInvariant()
|    if ($stg -and "$(& $GetEnv 'SI_ENGINE')".Trim()) {
|        $sha = [System.Security.Cryptography.SHA256]::Create()
|        try { $h = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes('securityinsight-install:' + $stg)) } finally { $sha.Dispose() }
|        $b = New-Object byte[] 16; [Array]::Copy($h, $b, 16)
|        $b[7] = [byte](($b[7] -band 0x0F) -bor 0x50); $b[8] = [byte](($b[8] -band 0x3F) -bor 0x80)   # a version-5 shaped GUID
|        return ([guid]$b).ToString()
|    }
|    $guidRe = '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
|    $f = [System.IO.Path]::Combine($StateDirectory, 'install-id')
|    $damaged = $false
|    try {
|        if ([System.IO.File]::Exists($f)) {
|            $v = ([System.IO.File]::ReadAllText($f)).Trim().ToLowerInvariant()
|            if ($v -match $guidRe) { return $v }
|            $damaged = $true
|        }
|    } catch { }
|    $new = [guid]::NewGuid().ToString()
|    if ($damaged) {
|        # A damaged file is replaced once, so the install keeps ONE id from here on.
|        try { [System.IO.File]::WriteAllText($f, $new) } catch { }
|        return $new
|    }
|    try {
|        $null = [System.IO.Directory]::CreateDirectory($StateDirectory)
|        # CreateNew: two engines starting together must not overwrite each other's id. The loser reads the winner's.
|        $fs = New-Object System.IO.FileStream($f, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write)
|        try { $b = [System.Text.Encoding]::ASCII.GetBytes($new); $fs.Write($b, 0, $b.Length) } finally { $fs.Dispose() }
|    } catch {
|        try {
|            $v = ([System.IO.File]::ReadAllText($f)).Trim().ToLowerInvariant()
|            if ($v -match $guidRe) { return $v }
|        } catch { }
|    }
|    return $new
|}
|
|function Get-SITelemetryLastHeartbeat {
|    param([Parameter(Mandatory)][string]$StateDirectory)
|    try {
|        $f = [System.IO.Path]::Combine($StateDirectory, 'last-heartbeat')
|        if ([System.IO.File]::Exists($f)) { return ([System.IO.File]::ReadAllText($f)).Trim() }
|    } catch { }
|    return ''
|}
|
|function Set-SITelemetryLastHeartbeat {
|    param([Parameter(Mandatory)][string]$StateDirectory, [Parameter(Mandatory)][datetime]$NowUtc)
|    try {
|        $null = [System.IO.Directory]::CreateDirectory($StateDirectory)
|        [System.IO.File]::WriteAllText([System.IO.Path]::Combine($StateDirectory, 'last-heartbeat'),
|            $NowUtc.ToUniversalTime().ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture))
|    } catch { }
|}
|
|function Get-SITelemetryEndpoint {
|    <# The report address: SI_Telemetry_Endpoint, else SI_TELEMETRY_ENDPOINT, else '' (= the framework default, Invardia's). #>
|    $e = @([string]$global:SI_Telemetry_Endpoint, [string]$env:SI_TELEMETRY_ENDPOINT) | Where-Object { "$_".Trim() } | Select-Object -First 1
|    return "$e".Trim()
|}
|
|function Get-SITelemetryInstallKey {
|    <# Pro / trial only: the install key from the install's Key Vault (SI-Invardia-InstallKey), read as the runtime
|       identity. '' when there is none or it cannot be read -- the install then reports anonymously. Never throws, never
|       prints the value.
|       -WithReason: @{ Key; Reason } -- Reason says in plain words why there is no key ('' when there is one); it names
|       the secret and the vault, never a value.
|       -Name: another secret read the same way (Invardia S16: SI-InstallId, the install's lasting id); default the install key. #>
|    param([switch]$WithReason, [string]$Name)
|    if ($null -eq (Get-SITelemetrySendState)) { $script:SITelemetrySend = New-SITelemetrySendState }
|    $name = if ("$Name".Trim()) { "$Name".Trim() } else { (Get-SITelemetrySendState).InstallKeyName }
|    $why = ''
|    $key = ''
|    try {
|        # an internal install: the platform Key Vault (signed in by SecurityInsight itself -- auth/SI-PlatformConnect.ps1)
|        if ($global:Context -and $global:KV_HighPriv_KeyVaultName) {
|            try {
|                if (-not (Get-Command -Name Get-SIPlatformSecret -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'auth', 'SI-PlatformConnect.ps1')) }
|                $v = [string](Get-SIPlatformSecret -Context $global:Context -Name $name -AsPlainText -ErrorAction Stop 3>$null); if ($v.Trim()) { $key = $v.Trim() }
|                else { $why = ('{0} is empty or missing in the platform Key Vault {1}' -f $name, [string]$global:KV_HighPriv_KeyVaultName) }
|            } catch { $why = ('{0} could not be read from the platform Key Vault {1}: {2}' -f $name, [string]$global:KV_HighPriv_KeyVaultName, $_.Exception.Message) }
|        }
|        if (-not $key) {
|            if (-not (Get-Command -Name Get-SIVaultName -ErrorAction SilentlyContinue)) {
|                $h = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'auth', 'Get-SIVaultName.ps1'); if (Test-Path -LiteralPath $h) { . $h }
|            }
|            $vault = $null
|            if (Get-Command -Name Get-SIVaultName -ErrorAction SilentlyContinue) { try { $vault = Get-SIVaultName -AllowMissing } catch { } }
|            elseif ($global:SI_KeyVaultName) { $vault = [string]$global:SI_KeyVaultName }
|            if (-not $vault) {
|                if (-not $why) { $why = 'the install''s Key Vault is not known to this job (SI_KeyVaultName is not set)' }
|            } else {
|                if (-not (Get-Command -Name Get-SIKvSecret -ErrorAction SilentlyContinue)) {
|                    $h = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'auth', 'Get-SIKvSecret.ps1'); if (Test-Path -LiteralPath $h) { . $h }
|                }
|                if (Get-Command -Name Get-SIKvSecret -ErrorAction SilentlyContinue) {
|                    $kvWarn = $null
|                    $v = [string](Get-SIKvSecret -VaultName $vault -SecretName $name -WarningVariable kvWarn -WarningAction SilentlyContinue)
|                    $key = $v.Trim()
|                    if (-not $key) {
|                        $w = (@($kvWarn) | ForEach-Object { [string]$_ } | Select-Object -First 1)
|                        $why = $(if ($w) { ('{0} could not be read from the Key Vault {1}: {2}' -f $name, $vault, ($w -replace '^Get-SIKvSecret:\s*', '')) }
|                                 else { ('{0} is not in the Key Vault {1}, or this job''s identity may not read secrets there' -f $name, $vault) })
|                    }
|                } elseif (-not $why) { $why = 'the Key Vault reader (auth\Get-SIKvSecret.ps1) is not available in this job' }
|            }
|        }
|    } catch { $key = ''; if (-not $why) { $why = ('{0} could not be read: {1}' -f $name, $_.Exception.Message) } }
|    if ($key) { $why = '' }
|    if ($WithReason) { return [pscustomobject]@{ Key = $key; Reason = $why } }
|    return $key
|}
|
|function Get-SITelemetryVersion {
|    <#
|        The BUILD LABEL of this install: the stamped build (BUILD.json) as "<display>+<shortCommit>" -- e.g.
|        "3.0.0-rc.12+0dc9062" -- so a fleet view tells the builds of one release apart. No BUILD.json: the VERSION file.
|        CR2 (Invardia 2026-10-18): this is NOT what Version says on the uplink -- Version is the RELEASE the install runs
|        (Get-SITelemetryReleaseVersion; Invardia matches installs to releases by it: the health hold, "who runs V"); the
|        label rides as its own field `build` (heartbeat and run report; an optional field, resent without when refused).
|    #>
|    if ($null -eq (Get-SITelemetrySendState)) { $script:SITelemetrySend = New-SITelemetrySendState }
|    try {
|        $bj = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'BUILD.json')
|        if ([System.IO.File]::Exists($bj)) {
|            $j = [System.IO.File]::ReadAllText($bj) | ConvertFrom-Json
|            $d = ([string]$j.display).Trim(); $sc = ([string]$j.shortCommit).Trim()
|            if ($d) { return $(if ($sc) { '{0}+{1}' -f $d, $sc } else { $d }) }
|        }
|    } catch { }
|    try {
|        $f = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'VERSION')
|        if ([System.IO.File]::Exists($f)) { return ([System.IO.File]::ReadAllText($f)).Trim() }
|    } catch { }
|    return ''
|}
|
|function Get-SITelemetryReleaseVersion {
|    <# The RELEASE this install runs (BUILD.json 'release', stamped by Publish-SIRelease: 3.0.0.<build number>) -- what the
|       error catalogue's fixedIn is compared with (#709). Not stamped (an older or a local package): the reported version,
|       which never reads as newer than a fix. #>
|    if ($null -eq (Get-SITelemetrySendState)) { $script:SITelemetrySend = New-SITelemetrySendState }
|    try {
|        $bj = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'BUILD.json')
|        if ([System.IO.File]::Exists($bj)) {
|            $j = [System.IO.File]::ReadAllText($bj) | ConvertFrom-Json
|            if ($j.PSObject.Properties['release'] -and "$($j.release)".Trim()) { return ([string]$j.release).Trim() }
|        }
|    } catch { }
|    Get-SITelemetryVersion
|}
|
|function Test-SITelemetryReleasedLabel {
|    <# PURE. #918 / #919: is -Release (BUILD.json 'release') the label of a RELEASED build? Digits and dots only, 3 or 4 parts --
|       3.0.1 (#919, from the next release on) and 3.0.0.202610272235 (before). Empty, a dev / rc / local label, or any letter
|       is not. Decided by BUILD.json's release field, never by the number of parts of VERSION. @{ Released; Reason }. #>
|    param([AllowNull()][AllowEmptyString()][string]$Release)
|    $r = "$Release".Trim()
|    if (-not $r) { return [pscustomobject]@{ Released = $false; Reason = 'BUILD.json carries no release (a dev tree, a test VM or a gate''s work folder)' } }
|    if ($r -match '^\d+\.\d+\.\d+(\.\d+)?$') { return [pscustomobject]@{ Released = $true; Reason = ('release {0}' -f $r) } }
|    [pscustomobject]@{ Released = $false; Reason = ("'{0}' is a dev or pre-release label" -f $r) }
|}
|
|function Test-SITelemetryReleasedBuild {
|    <# #918: does this install run a RELEASED build? Reads ONLY BUILD.json's 'release' under the solution root (-Root; default
|       the root of this file's tree) -- a dev tree has none, whatever its VERSION file says. @{ Released; Reason }. Never throws. #>
|    param([string]$Root)
|    try {
|        if (-not "$Root".Trim()) { if ($null -eq (Get-SITelemetrySendState)) { $script:SITelemetrySend = New-SITelemetrySendState }; $Root = (Get-SITelemetrySendState).SIRoot }
|        $bj = [System.IO.Path]::Combine($Root, 'BUILD.json')
|        if (-not [System.IO.File]::Exists($bj)) { return [pscustomobject]@{ Released = $false; Reason = 'no BUILD.json (a dev tree, a test VM or a gate''s work folder)' } }
|        $j = [System.IO.File]::ReadAllText($bj).TrimStart([char]0xFEFF) | ConvertFrom-Json -ErrorAction Stop
|        Test-SITelemetryReleasedLabel -Release $(if ($j.PSObject.Properties['release']) { [string]$j.release } else { '' })
|    } catch { [pscustomobject]@{ Released = $false; Reason = ('BUILD.json could not be read ({0})' -f $_.Exception.Message) } }
|}
|
|function Test-SITelemetryCommunitySendAllowed {
|    <# #918 (2026-10-27: 210 "installs" on version 3.0.0 were test runs and dev runs): may a record go out with -AccessCode? Only
|       the PUBLIC community code is gated -- an identified install's own key is never refused here. The community code needs a
|       RELEASED build (Test-SITelemetryReleasedBuild; -Released overrides it, tests). @{ Allowed; Reason }. #>
|    param([AllowNull()][AllowEmptyString()][string]$AccessCode, $Released)
|    $community = if (Get-Variable -Name AitUplinkCommunityCode -Scope Script -ErrorAction SilentlyContinue) { [string]$script:AitUplinkCommunityCode } else { 'invardia-community-telemetry-v1' }
|    if ("$AccessCode" -ne $community) { return [pscustomobject]@{ Allowed = $true; Reason = 'not the community code' } }
|    $rel = if ($null -ne $Released) { [pscustomobject]@{ Released = [bool]$Released; Reason = $(if ($Released) { 'released' } else { 'not a released build' }) } } else { Test-SITelemetryReleasedBuild }
|    if ($rel.Released) { return [pscustomobject]@{ Allowed = $true; Reason = $rel.Reason } }
|    [pscustomobject]@{ Allowed = $false; Reason = ('not a released build ({0}) -- nothing is sent to the public community uplink' -f $rel.Reason) }
|}
|
|function Get-SITelemetryContext {
|    <#
|        Who and what this install reports as, once per process (cached in $global:SI_TelemetryContext). Every input can be
|        injected (tests): -License (a Get-SILicense status), -InstallKey, -GetEnv, -StateDirectory, -Vars (runtime
|        identity), -TenantId, -Version. Returns Mode (anonymous | identified), Endpoint, AccessCode, Edition, LicenceState,
|        Version, Hosting, RuntimeIdentity, InstallId (anonymous only), TenantId (identified only), StateDirectory.
|        The install key is looked up ONLY for a Pro / trial licence: a Community install never touches a Key Vault here.
|    #>
|    param([AllowNull()]$License, [AllowNull()][AllowEmptyString()][string]$InstallKey, [scriptblock]$GetEnv, [string]$StateDirectory,
|          [System.Collections.IDictionary]$Vars, [AllowEmptyString()][string]$TenantId, [string]$Version, [switch]$Refresh,
|          # #427: the edition when the caller knows it better than a licence status (the guided install, the updater)
|          [ValidateSet('', 'community', 'pro', 'trial')][string]$Edition = '',
|          # the ring (Resolve-SIReportedRing): -UpdaterRing = what the updater resolved in this process; -RingFacts = the
|          # cfg.InstallState rows (default $global:SI_InstallRingFacts, read by the Pro settings layer at run start);
|          # -RingSetting = SI_UpdateRing (default the global); -CommunityRing = config\update.custom.json's ring
|          [AllowNull()]$UpdaterRing, [AllowNull()]$RingFacts, [AllowNull()]$RingSetting, [AllowNull()]$CommunityRing,
|          # framework §8.4: the install's own links (default: Get-SITelemetryInstallEndpoints) -- identified installs only
|          [AllowNull()][object[]]$Endpoints,
|          # MAIL-3 (#653): the environment's name (default: Get-SITelemetryEnvironmentName) -- identified installs only
|          [AllowNull()][AllowEmptyString()][string]$EnvironmentName,
|          # Invardia S16: the install's LASTING id (SI-InstallId) -- identified installs only. Not given: read (only) from the
|          # Key Vault the install key comes from -- unless the caller gave -InstallKey, then it gives this too ('' = none)
|          [AllowNull()][AllowEmptyString()][string]$LastingInstallId)
|    $injected = @($PSBoundParameters.Keys | Where-Object { $_ -ne 'Refresh' }).Count -gt 0
|    if (-not $injected -and -not $Refresh -and $global:SI_TelemetryContext) { return $global:SI_TelemetryContext }
|    if ($null -eq (Get-SITelemetrySendState)) { $script:SITelemetrySend = New-SITelemetrySendState }
|
|    if (-not $PSBoundParameters.ContainsKey('License')) {
|        $License = $null
|        if (-not (Get-Command -Name Get-SILicense -ErrorAction SilentlyContinue)) {
|            $cat = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'engine', 'SI-FeatureCatalog.ps1')
|            # Loaded here for this call only (functions dot-sourced in a function vanish when it returns) -- enough: the
|            # result is cached.
|            if (Test-Path -LiteralPath $cat) { try { . $cat } catch { } }
|        }
|        if (Get-Command -Name Get-SILicense -ErrorAction SilentlyContinue) { try { $License = Get-SILicense 3>$null } catch { $License = $null } }
|    }
|    $li = Get-SITelemetryLicenceInfo -License $License
|    if ($Edition) { $li = [pscustomobject]@{ Edition = $Edition; LicenceState = $li.LicenceState } }
|    elseif ($li.Edition -eq 'community' -and (Test-SITelemetryProInstall -GetEnv $GetEnv)) {
|        # An install WITH a Pro database is Pro even when this run could not read its licence (it failed before, or its
|        # identity cannot read the vault): reported as Pro with the licence state as found -- never as an anonymous
|        # Community install (fix request 85bd728f: three Pro installs reported as six Community ones).
|        $li = [pscustomobject]@{ Edition = 'pro'; LicenceState = $li.LicenceState }
|    }
|    $hosting = Get-SITelemetryHosting -GetEnv $GetEnv
|    $rt = Get-SITelemetryRuntimeIdentity -Hosting $hosting -Vars $Vars
|    $key = ''
|    # why this install reports anonymously (plain words; never a secret value) -- '' when it is identified
|    $anonWhy = ''
|    if ($li.Edition -ne 'community') {
|        if ($PSBoundParameters.ContainsKey('InstallKey')) { $key = "$InstallKey".Trim(); if (-not $key) { $anonWhy = 'no install key was given' } }
|        else {
|            $kr = Get-SITelemetryInstallKey -WithReason
|            if ($kr -is [string]) { $key = $kr.Trim() } else { $key = "$($kr.Key)".Trim(); $anonWhy = [string]$kr.Reason }
|            if (-not $key -and -not $anonWhy) { $anonWhy = 'the install key (SI-Invardia-InstallKey) could not be read' }
|        }
|        if ($key -and $key -notmatch '^inv-[^\s]{8,}$') { $anonWhy = 'the value stored as the install key (SI-Invardia-InstallKey) is not an Invardia install key' }
|        if ($key -notmatch '^inv-[^\s]{8,}$') { $key = '' }   # not an Invardia install key: report anonymously, never with it
|    } else {
|        $anonWhy = $(if ($null -eq $License) { 'no SecurityInsight Pro licence could be read in this run, and this install has no Pro database set' }
|                     else { ('no SecurityInsight Pro licence is in force (licence: {0}{1})' -f $(if ("$($License.Status)".Trim()) { [string]$License.Status } else { 'unknown' }), $(if ("$($License.Reason)".Trim()) { ' -- ' + [string]$License.Reason } else { '' })) })
|    }
|    Initialize-SIAitUplinkScope
|    # THE INSTALL KEY GOES ONLY TO INVARDIA (https, invardia.com or a subdomain): a report address set to anything else is
|    # used ANONYMOUSLY -- the key never leaves for it -- and said once per process
|    $ep = Get-SITelemetryEndpoint
|    if ($key -and $ep) {
|        $epWhy = Test-SITelemetryEndpointHost -Endpoint $ep
|        if ($epWhy) {
|            if (-not [bool](Get-Variable -Name SI_TelemetryEndpointWarned -Scope Global -ValueOnly -ErrorAction SilentlyContinue)) {
|                Write-Warning ('[telemetry] the report address is not Invardia''s ({0}) -- this install reports to it anonymously; its install key is sent only to Invardia' -f $epWhy)
|                $global:SI_TelemetryEndpointWarned = $true
|            }
|            $key = ''; $anonWhy = 'the report address is not Invardia''s -- the install key is sent only to Invardia'
|        }
|    }
|    $sender = Resolve-AitUplinkSender -Enabled $true -InstallKey $key -Endpoint $ep
|    if ($sender.Mode -ne 'anonymous') { $anonWhy = '' }
|    $dir = if ("$StateDirectory".Trim()) { $StateDirectory } else { Get-SITelemetryStateDirectory -GetEnv $GetEnv }
|    $iid = ''; $tid = ''; $lasting = ''
|    if ($sender.Mode -eq 'anonymous') { $iid = Get-SITelemetryInstallId -StateDirectory $dir -GetEnv $GetEnv }
|    else {
|        $tid = if ($PSBoundParameters.ContainsKey('TenantId')) { $TenantId }
|               elseif (Get-Command -Name Get-SIRunTenantId -ErrorAction SilentlyContinue) { try { [string](Get-SIRunTenantId) } catch { '' } } else { '' }
|        # Invardia S16: the install's LASTING id (SI-InstallId, made once by the licence knock) -- never the anonymous id
|        # above; read only, and '' (no field) when there is none, it cannot be read or it is not a GUID
|        $lasting = if ($PSBoundParameters.ContainsKey('LastingInstallId')) { ConvertTo-SIInvardiaInstallId $LastingInstallId }
|                   elseif ($PSBoundParameters.ContainsKey('InstallKey')) { '' }
|                   else { try { ConvertTo-SIInvardiaInstallId ([string](Get-SITelemetryInstallKey -Name 'SI-InstallId')) } catch { '' } }
|    }
|    # CR2: Version = the RELEASE this install runs (BUILD.json 'release', 3.0.0.<build number>); not known (a dev run) = the build
|    # label, as before. The label itself rides as Build (the wire field `build`).
|    $build = Get-SITelemetryVersion
|    $ver = if ($PSBoundParameters.ContainsKey('Version')) { $Version } else { Get-SITelemetryReleaseVersion }
|    $ring = Get-SITelemetryRing -Edition $li.Edition -BoundParameters $PSBoundParameters -UpdaterRing $UpdaterRing -RingFacts $RingFacts -RingSetting $RingSetting -CommunityRing $CommunityRing
|    $ctx = [pscustomobject]@{
|        Mode = $sender.Mode; Endpoint = $sender.Endpoint; AccessCode = $sender.AccessCode
|        Edition = $li.Edition; LicenceState = $li.LicenceState; Version = $ver; Build = $build; Hosting = $hosting; RuntimeIdentity = $rt
|        InstallId = $iid; TenantId = $tid; StateDirectory = $dir; Ring = $ring.Ring; RingSource = $ring.Source
|        # Invardia S16: the install's LASTING id (identified only; '' = none -> no field). InstallId above stays the anonymous one.
|        LastingInstallId = $lasting
|        # why the install reports anonymously ('' when identified) -- said in the run's log by a caller that needs identified
|        # (the data health record); never sent
|        AnonymousReason = $anonWhy
|        # #517: the installed licence's id (identified only; '' when it has no GUID-shaped id)
|        LicenceId = $(if ($sender.Mode -ne 'anonymous' -and $License -and (Get-Command -Name ConvertTo-SILicenceIdOrEmpty -ErrorAction SilentlyContinue)) { ConvertTo-SILicenceIdOrEmpty ([string]$License.LicenseId) } else { '' })
|        # framework §8.4: the install's own links -- identified only (an anonymous install never names its addresses)
|        Endpoints = $(if ($sender.Mode -eq 'anonymous') { , @() }
|                      elseif ($PSBoundParameters.ContainsKey('Endpoints')) { , @(ConvertTo-SITelemetryEndpointList -Items $Endpoints) }
|                      else { , @(Get-SITelemetryInstallEndpoints) })
|        # MAIL-3 (#653): the web app header's name -- identified only (a name says whose install it is)
|        EnvironmentName = $(if ($sender.Mode -eq 'anonymous') { '' }
|                            elseif ($PSBoundParameters.ContainsKey('EnvironmentName')) { ConvertTo-SITelemetryEnvironmentName $EnvironmentName }
|                            else { Get-SITelemetryEnvironmentName })
|    }
|    if (-not $injected) { $global:SI_TelemetryContext = $ctx }
|    $ctx
|}
|
|function Initialize-SITelemetryLastingInstallId {
|    <#
|        Invardia 2026-11-01 (S16, answer 2): THE UPLINK JOB MAKES THE LASTING ID WHEN IT IS MISSING, so every identified install
|        sends one -- also one whose licence never needed a knock. Called by the heartbeat job (Send-SIHeartbeatTick) on a tick
|        it sends. -Context: an IDENTIFIED Get-SITelemetryContext without a LastingInstallId; anything else is returned as it is.
|        The id is made by the licence knock's own code (Resolve-SIInvardiaInstallId: a GUID, written to SI-InstallId, read
|        back -- an existing value is never rewritten; when the knock and this job make it at once, the kept one wins for both).
|        FIRST WRITE WINS: with -ReadVersions { param($Name) } (the versions of SI-InstallId; default: the vault's, over REST)
|        the id is the oldest version that holds a GUID, whichever side wrote it.
|        Seams: -ReadSecret { param($Name) } / -WriteSecret { param($Name, $Value) }; default: the install's Key Vault (the
|        reader the install key comes through; Set-SIAzKeyVaultSecret for the one write) -- never in a test session.
|        A vault that cannot be read or written = no id THIS tick (said once per process), never a failure. Returns the context.
|    #>
|    param($Context, [scriptblock]$ReadSecret, [scriptblock]$WriteSecret, [scriptblock]$ReadVersions)
|    try {
|        if ($null -eq $Context -or [string]$Context.Mode -ne 'identified') { return $Context }
|        # FIRST WRITE WINS: with the vault's versions the id is resolved every tick (the oldest GUID version), so a context
|        # that read the newest value is corrected; without them a context that has an id keeps it
|        if (-not $ReadVersions -and $ReadSecret -and $WriteSecret -and $Context.PSObject.Properties['LastingInstallId'] -and "$($Context.LastingInstallId)".Trim()) { return $Context }
|        if (-not $ReadSecret -or -not $WriteSecret) {
|            if (Get-Module -Name Pester) { return $Context }   # a test session never touches a vault without its seams
|            # ONE vault for the read and the write: the install's own (the one the knock keeps SI-InstallId in). The read
|            # THROWS on anything but "there is none" (Get-SIAzKeyVaultSecret: 404 = $null, 403 / network = an error), so a
|            # vault this job cannot read is never taken for an empty one -- an existing id is never overwritten
|            if (-not (Get-Command -Name Get-SIVaultName -ErrorAction SilentlyContinue)) {
|                $h = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'auth', 'Get-SIVaultName.ps1'); if (Test-Path -LiteralPath $h) { . $h }
|            }
|            $vault = $null
|            if (Get-Command -Name Get-SIVaultName -ErrorAction SilentlyContinue) { try { $vault = Get-SIVaultName -AllowMissing } catch { $vault = $null } }
|            if (-not $vault -and $global:SI_KeyVaultName) { $vault = [string]$global:SI_KeyVaultName }
|            if (-not $vault -or -not (Get-Command -Name Get-SIAzKeyVaultSecret -ErrorAction SilentlyContinue) -or -not (Get-Command -Name Set-SIAzKeyVaultSecret -ErrorAction SilentlyContinue)) { return $Context }
|            $kvGet = ${function:Get-SIAzKeyVaultSecret}; $kvSet = ${function:Set-SIAzKeyVaultSecret}; $kvVers = ${function:Get-SIInvardiaKvInstallIdVersions}
|            if (-not $ReadVersions -and $kvVers) { $ReadVersions = { param($n) & $kvVers -VaultName $vault -Name $n }.GetNewClosure() }
|            if (-not $ReadSecret) {
|                $ReadSecret = { param($n) $s = & $kvGet -VaultName $vault -Name $n -ErrorAction Stop; if (-not $s) { return $null }; [System.Net.NetworkCredential]::new('', $s.SecretValue).Password }.GetNewClosure()
|            }
|            if (-not $WriteSecret) {
|                $WriteSecret = { param($n, $v) $null = & $kvSet -VaultName $vault -Name $n -SecretValue (ConvertTo-SecureString -String $v -AsPlainText -Force) -ErrorAction Stop }.GetNewClosure()
|            }
|        }
|        $id = Resolve-SIInvardiaInstallId -ReadSecret $ReadSecret -WriteSecret $WriteSecret -ReadVersions $ReadVersions
|        if (-not $id -and -not [bool](Get-Variable -Name SI_LastingInstallIdWarned -Scope Global -ValueOnly -ErrorAction SilentlyContinue)) {
|            $global:SI_LastingInstallIdWarned = $true
|            Write-Host '  [telemetry] the install''s lasting id (SI-InstallId) could not be read or kept in the Key Vault -- the status reports go without it this time'
|        }
|        $Context | Add-Member -NotePropertyName LastingInstallId -NotePropertyValue $id -Force
|    } catch { }
|    return $Context
|}
|
|function Get-SITelemetryRing {
|    <#
|        The ring this install reports (Resolve-SIReportedRing, the order the web app's header uses): the updater's ring in
|        this process > the updater's recorded state > the ring recorded for the install > SI_UpdateRing > (Community) the
|        ring in config\update.custom.json. Each input the caller did not pass is read from where the product keeps it.
|        NEVER throws; returns @{ Ring; Source } (Ring $null = not known, left out of the report).
|    #>
|    param([string]$Edition, [System.Collections.IDictionary]$BoundParameters = @{}, [AllowNull()]$UpdaterRing, [AllowNull()]$RingFacts,
|          [AllowNull()]$RingSetting, [AllowNull()]$CommunityRing)
|    try {
|        $bound = @($BoundParameters.Keys); $has = { param($n) $bound -contains $n }
|        if (-not (& $has 'RingFacts')) { $RingFacts = $global:SI_InstallRingFacts }
|        if (-not (& $has 'RingSetting')) { $RingSetting = $global:SI_UpdateRing }
|        if (-not (& $has 'CommunityRing')) {
|            $CommunityRing = $null
|            if ($Edition -eq 'community') {
|                $file = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'config', 'update.custom.json')
|                if (Test-Path -LiteralPath $file) { try { $CommunityRing = ([IO.File]::ReadAllText($file).TrimStart([char]0xFEFF) | ConvertFrom-Json -ErrorAction Stop).ring } catch { $CommunityRing = $null } }
|            }
|        }
|        $us = ''; $ir = ''
|        if ($RingFacts) {
|            $p = { param($n) if ($RingFacts -is [System.Collections.IDictionary]) { if ($RingFacts.Contains($n)) { [string]$RingFacts[$n] } else { '' } } elseif ($RingFacts.PSObject.Properties[$n]) { [string]$RingFacts.$n } else { '' } }
|            $us = & $p 'UpdateState'; $ir = & $p 'Ring'
|        }
|        Resolve-SIReportedRing -UpdaterRing $UpdaterRing -UpdateStateJson $us -InstallRingJson $ir -Setting $RingSetting -CommunityRing $CommunityRing
|    } catch { [pscustomobject]@{ Ring = $null; Source = '' } }
|}
|
|# =====================================================================================================================
|#  The one call: at the run-health END moment
|# =====================================================================================================================
|function Send-SITelemetryUplink {
|    <#
|        #517: the default transport. EXACTLY the framework client's post (Send-AitUplink: https only, a credential, the
|        X-Ait-Uplink-Code header, one attempt, never throws) -- and it keeps Invardia's answer: a 202 {"supersededBy": "<id>"}
|        (framework §12.6b) comes back as SupersededBy, and (#710, Invardia 1.0.488) a 202 {"environmentId": "<id>"} as
|        EnvironmentId. Refusals without a network call are Send-AitUplink's own.
|        Returns @{ Status; Reason; Sent; SupersededBy; EnvironmentId }.
|    #>
|    param([Parameter(Mandatory)][object]$Record, [AllowNull()][string]$Endpoint, [AllowNull()][string]$AccessCode, [int]$TimeoutSec = 5)
|    # #918: a build that is not a RELEASE never sends to the PUBLIC community uplink (identified installs are unchanged)
|    Initialize-SIAitUplinkScope
|    $gate = Test-SITelemetryCommunitySendAllowed -AccessCode $AccessCode
|    if (-not $gate.Allowed) { return [pscustomobject]@{ Status = 'skipped'; Reason = $gate.Reason; Sent = $false; SupersededBy = ''; EnvironmentId = '' } }
|    if ("$Endpoint" -notmatch '^https://' -or -not "$AccessCode".Trim()) { return (Send-AitUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec) }
|    try {
|        $body = $Record | ConvertTo-Json -Depth 6 -Compress
|        $answer = Invoke-RestMethod -Uri $Endpoint -Method Post -Headers @{ 'X-Ait-Uplink-Code' = $AccessCode; 'Content-Type' = 'application/json' } -Body $body -TimeoutSec $TimeoutSec -UseBasicParsing -ErrorAction Stop
|        [pscustomobject]@{ Status = 'ok'; Reason = 'uplink accepted'; Sent = $true; SupersededBy = (Get-SILicenceSupersededFromAnswer $answer); EnvironmentId = (Get-SIInvardiaEnvironmentIdFromAnswer $answer) }
|    } catch {
|        [pscustomobject]@{ Status = 'failed'; Reason = "uplink POST failed: $($_.Exception.Message)"; Sent = $false; SupersededBy = ''; EnvironmentId = '' }
|    }
|}
|
|function Invoke-SILicenceSupersededNotice {
|    <#
|        #517: Invardia says the installed licence was re-issued (-LicenceId = the newest one). Recorded for the updater's
|        licence step, which knocks with currentLicenceId on its next run: -OnSuperseded (tests), else the Pro database this
|        run opened ($global:SI_ProSettingsStore, set by the Pro settings layer) -- no second sign-in. One plain line in the
|        run's log. NEVER throws; $true when recorded.
|    #>
|    param([Parameter(Mandatory)][string]$LicenceId, [scriptblock]$OnSuperseded, $NowUtc)
|    $done = $false
|    try {
|        if ($OnSuperseded) { $null = & $OnSuperseded $LicenceId; $done = $true }
|        elseif ($global:SI_ProSettingsStore -and (Get-Command -Name Save-SILicenceSupersededMark -ErrorAction SilentlyContinue)) {
|            Save-SILicenceSupersededMark -Store $global:SI_ProSettingsStore -LicenceId $LicenceId -NowUtc $NowUtc; $done = $true
|        }
|    } catch { $done = $false }
|    try {
|        if ($done) { Write-Host (" [INFO] Invardia has issued a newer licence for this install ({0}); the updater fetches and installs it on its next run." -f $LicenceId) }
|        else { Write-Host (" [INFO] Invardia has issued a newer licence for this install ({0}), but this run could not record it for the updater. The installed licence keeps working; the next run tries again." -f $LicenceId) }
|    } catch { }
|    $done
|}
|
|function Get-SITelemetryLogTail {
|    <# The lines of this run's own transcript ($global:SI_TranscriptPath, or -Path), read while it is still open (shared
|       read) -- the last -Tail lines. Never throws: @() when there is none. #>
|    param([string]$Path = [string]$global:SI_TranscriptPath, [int]$Tail = 400)
|    try {
|        if (-not "$Path".Trim() -or -not [System.IO.File]::Exists($Path)) { return @() }
|        $fs = New-Object System.IO.FileStream($Path, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, ([System.IO.FileShare]::ReadWrite -bor [System.IO.FileShare]::Delete))
|        try { $sr = New-Object System.IO.StreamReader($fs, $true); $text = $sr.ReadToEnd() } finally { $fs.Dispose() }
|        $all = @($text -split "`r?`n")
|        if ($all.Count -gt $Tail) { $all = @($all[($all.Count - $Tail)..($all.Count - 1)]) }
|        return $all
|    } catch { return @() }
|}
|
|function Resolve-SITelemetryFailureDetail {
|    <#
|        The words and the class a run report that did not end ok carries (owner 2026-10-10: most failed reports reached
|        Invardia as 'unknown' with the pipeline's summary only, some with no text at all):
|          1. the failing STEP's own words + class when the run context carries them (FailedStepError / FailedStepErrorClass
|             -- the pipeline runner sets them from the failed step's run log), the summary kept after them;
|          2. else the run's own message;
|          3. no message -> the run's last log lines (-LogLines, else this run's transcript: Get-SITelemetryLogTail), the
|             first error lines of it (Get-SIErrorLines).
|        Returns @{ Text; ErrorClass ('' = classify the text); Source = step | message | log | '' }. Never throws.
|    #>
|    param([AllowNull()]$RunContext, [AllowEmptyString()][string]$ErrorMessage, [AllowEmptyString()][string]$ExitReason, [AllowNull()][string[]]$LogLines)
|    $out = [pscustomobject]@{ Text = ''; ErrorClass = ''; Source = '' }
|    try {
|        $has = { param($n) $RunContext -and $RunContext.PSObject.Properties[$n] -and "$($RunContext.$n)".Trim() }
|        $msg = "$ErrorMessage".Trim()
|        if (& $has 'FailedStepError') {
|            $out.Text = "$($RunContext.FailedStepError)".Trim()
|            if ($msg -and $msg -ne $out.Text) { $out.Text = "{0}`n({1})" -f $out.Text, $msg }
|            $out.Source = 'step'
|            if (& $has 'FailedStepErrorClass') {
|                $c = "$($RunContext.FailedStepErrorClass)".Trim().ToLowerInvariant()
|                if ((Get-SIErrorClasses) -contains $c -and $c -ne 'unknown') { $out.ErrorClass = $c }
|            }
|            if (-not $out.ErrorClass) { $out.ErrorClass = Get-SIErrorClass -Message "$($RunContext.FailedStepError)" -ExitReason $ExitReason }
|            if ($out.ErrorClass -eq 'unknown' -and $msg) { $c2 = Get-SIErrorClass -Message $msg -ExitReason $ExitReason; if ($c2 -ne 'unknown') { $out.ErrorClass = $c2 } }
|            return $out
|        }
|        if ($msg) { $out.Text = $msg; $out.Source = 'message'; return $out }
|        $lines = if ($null -ne $LogLines) { @($LogLines) } else { @(Get-SITelemetryLogTail) }
|        $t = Get-SIErrorLines -Lines $lines
|        if ($t) { $out.Text = $t; $out.Source = 'log' }
|    } catch { }
|    $out
|}
|
|function Send-SITelemetryRunEnd {
|    <#
|        Report one engine run (and, once per UTC day, the heartbeat before it). NEVER throws; returns
|        @{ Status; Sent; Reason } -- Status: disabled | skipped | halted | ok | failed | error.
|          -RunContext    the run-health context (Engine, StartedAt, ShardIndex, FailedStep when the engine recorded it)
|          -ExitReason / -ErrorMessage / -AssetCount   what Send-SIRunHealthRow was given
|          -Context       a Get-SITelemetryContext result (default: this install's, cached)
|          -Transport     { param($Record, $Endpoint, $AccessCode, $TimeoutSec) } -> @{ Status } (default: the framework's
|                         Send-AitUplink). The test seam.
|          -Now           the clock (tests)
|          -HeartbeatCounts { } -> @{ users; guests; devices } for an IDENTIFIED heartbeat (default:
|                         Get-SITelemetryHeartbeatCounts, #424). Never called for an anonymous one. The test seam.
|        A shard other than the first reports only a run that did not end ok, so a sharded run is one report, not N.
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][AllowNull()]$RunContext, [AllowEmptyString()][string]$ExitReason, [AllowEmptyString()][string]$ErrorMessage,
|          [long]$AssetCount = -1, $Context, [scriptblock]$Transport, $Now, [scriptblock]$HeartbeatCounts,
|          # #427: a failure report from outside an engine run (the install, the updater) carries no heartbeat
|          [switch]$NoHeartbeat,
|          # #491: the setup report's closed list (default config\setup-catalog.locked.json) -- the test seam
|          $SetupCatalog,
|          # #517: { param($LicenceId) } when Invardia answers that the installed licence was re-issued (default: recorded for
|          # the updater's licence step, Save-SILicenceSupersededMark on the Pro database the run has open) -- the test seam
|          [scriptblock]$OnSuperseded,
|          # #709: { } -> the capability probe (Get-SICapabilityProbe's shape) for the heartbeat (default: Get-SICapabilityProbe,
|          # never in a test session) -- the test seam
|          [scriptblock]$CapabilityProbe,
|          # #710: { param($EnvironmentId) } when Invardia's answer names an environment id this install has not recorded yet
|          # (default: Save-SIInvardiaEnvironmentMark on the Pro database the run has open) -- the test seam
|          [scriptblock]$OnEnvironment,
|          # framework 8.4: the Pro database a run record that is NOT taken is kept in (cfg.UplinkOutbox; default: the Pro
|          # settings store the run has open -- never in a test session) -- the test seam
|          [scriptblock]$OutboxInvoke)
|    $supSeen = ''
|    $envSeen = $false
|    $keptRun = $false
|    $out = { param($s, $sent, $why) [pscustomobject]@{ Status = $s; Sent = @($sent); Reason = $why; SupersededBy = $supSeen; Kept = [bool]$keptRun } }
|    try {
|        if (-not (Test-SITelemetryEnabled)) { return (& $out 'disabled' @() 'telemetry is switched off (SI_Telemetry_Enabled)') }
|        # an earlier report of this process was not taken: nothing more is SENT from it -- the run record is still built and
|        # KEPT in the outbox where the Pro database is open (framework 8.4); without one, nothing is built
|        $halted = [bool]$global:SI_TelemetryHalted
|        if ($halted -and -not $OutboxInvoke -and -not (Get-SIUplinkOutboxInvoke)) { return (& $out 'halted' @() 'an earlier report in this process was not accepted -- nothing more is sent from it') }
|        # A TEST SESSION NEVER SENDS. ~60 suites run engine code that reaches the run-health END record; none of them
|        # may report to Invardia or write an install id on the test machine. Pester is never loaded by an engine run.
|        # Only a test that hands in its own -Transport (a stub) gets past this line.
|        if (-not $Transport -and (Get-Module -Name Pester)) { return (& $out 'skipped' @() 'a test session (Pester is loaded) never sends; pass -Transport to test the sender') }
|        if ($null -eq $RunContext) { return (& $out 'skipped' @() 'no run context') }
|        $job = Resolve-SITelemetryJob -Engine ([string]$RunContext.Engine) -ReportTemplate ([string]$global:ReportTemplate)
|        if (-not $job) { return (& $out 'skipped' @() ("no telemetry job id for engine '{0}'" -f $RunContext.Engine)) }
|        $exit = ConvertTo-SITelemetryExitReason $ExitReason
|        if (-not $exit) { return (& $out 'skipped' @() ("run-health ExitReason '{0}' is not reported" -f $ExitReason)) }
|        $shard = 0; if ($RunContext.PSObject.Properties['ShardIndex']) { $shard = [int]$RunContext.ShardIndex }
|        if ($shard -gt 0 -and $exit -eq 'success') { return (& $out 'skipped' @() 'a successful shard other than the first is not reported separately') }
|        # a part of a run in parts (a collection's producer before its hand-over, a part's worker) does not report the job's
|        # ok: only the execution that knows the whole result does (the one that publishes the collection's records). Its
|        # failures and warnings are still reported.
|        if ($exit -eq 'success' -and $RunContext.PSObject.Properties['SuppressJobOk'] -and [bool]$RunContext.SuppressJobOk) { return (& $out 'skipped' @() 'a part of a run in parts does not report the job''s ok -- the execution that publishes the whole result does') }
|
|        $nowUtc = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|        if (-not $Context) { $Context = Get-SITelemetryContext }
|        if (-not $Transport) {
|            # #918: a build that is not a RELEASE (no BUILD.json release, a dev or rc label) never sends to the PUBLIC community
|            # uplink -- test runs, gate suites, the test VM and dev runs were counted as Community installs. Identified installs
|            # (their own key) are unchanged. Said here, before anything is built, so it is never a "not sent" warning.
|            $cg = Test-SITelemetryCommunitySendAllowed -AccessCode ([string]$Context.AccessCode)
|            if (-not $cg.Allowed) { return (& $out 'skipped' @() $cg.Reason) }
|            # #517: SI's sender (Send-SITelemetryUplink) -- the framework client's post, plus Invardia's answer (supersededBy)
|            $Transport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) Send-SITelemetryUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec }
|        }
|        $anon = ($Context.Mode -eq 'anonymous')
|        # framework 8.4: where a run record that is not taken is kept -- identified installs with the Pro database open only
|        $obInvoke = $null
|        if (-not $anon) { $obInvoke = if ($OutboxInvoke) { $OutboxInvoke } else { Get-SIUplinkOutboxInvoke } }
|        if ($halted -and -not $obInvoke) { return (& $out 'halted' @() 'an earlier report in this process was not accepted -- nothing more is sent from it') }
|        $lid = if (-not $anon -and $Context.PSObject.Properties['LicenceId']) { [string]$Context.LicenceId } else { '' }
|        # framework §8.4: the install's own links (identified heartbeat) and the run-health deep link (identified failed run)
|        $eps = @()
|        if (-not $anon) { $eps = @(if ($Context.PSObject.Properties['Endpoints']) { @($Context.Endpoints) } else { @(Get-SITelemetryInstallEndpoints) }) }
|        $runLink = if ($eps.Count) { Get-SITelemetryRunLink -Endpoints $eps } else { '' }
|        # MAIL-3 (#653): the environment's name (identified only; a context built without it carries none)
|        $envName = if (-not $anon -and $Context.PSObject.Properties['EnvironmentName']) { [string]$Context.EnvironmentName } else { '' }
|        $base = @{ Edition = $Context.Edition; Version = $Context.Version; Hosting = $Context.Hosting; RuntimeIdentity = $Context.RuntimeIdentity
|                   LicenceState = $Context.LicenceState; Now = $nowUtc
|                   # framework §8.4 / §8.7: EVERY heartbeat and run report carries the install's ring (Invardia judges the update
|                   # level against the version approved for it). Not known = left out, never guessed.
|                   Ring = $(if ($Context.PSObject.Properties['Ring']) { $Context.Ring } else { $null }) }
|        if ($anon) { $base.Anonymous = $true; $base.InstallId = $Context.InstallId } else { $base.TenantId = $Context.TenantId }
|
|        $durMs = 0L
|        if ($RunContext.PSObject.Properties['StartedAt'] -and $RunContext.StartedAt) {
|            try { $durMs = [long][Math]::Max(0, ($nowUtc - ([datetime]$RunContext.StartedAt).ToUniversalTime()).TotalMilliseconds) } catch { $durMs = 0L }
|        }
|        $counts = Get-SITelemetryCounts -Job $job -Count $AssetCount
|        $runArgs = @{} + $base
|        $runArgs.Job = $job; $runArgs.ExitReason = $exit; $runArgs.DurationMs = $durMs; $runArgs.Counts = $counts
|        $step = Get-SITelemetryFailedStep -RunContext $RunContext -ExitReason $exit -Job $job
|        if ($exit -ne 'success') {
|            # UPLINK-FIX (Invardia, 2026-10-07): a report that did not end ok ALWAYS carries FailedStep + ErrorClass (+ the
|            # ErrorText when identified) -- Invardia's signature is built from the three, and an empty one cannot be acted on
|            # (customer G 2026-10-07: two fix requests with none of them). No recorded step = 'run' (the run as a whole); no
|            # message = a sentence that says so, never an empty text.
|            if (-not $step) { $step = 'run' }
|            # Telemetry quality (owner 2026-10-10, "use telemetry from si"): the report carries the FAILING STEP's own words
|            # and class -- for the pipeline the step's (RunContext.FailedStepError / FailedStepErrorClass, set by the flow
|            # runner from the step's own run log), never the pipeline's summary line. No text = the run's last log lines.
|            $d = Resolve-SITelemetryFailureDetail -RunContext $RunContext -ErrorMessage $ErrorMessage -ExitReason $exit
|            $msg = [string]$d.Text
|            if (-not $msg) { $msg = ('{0} ended {1} without an error message (step {2})' -f $job, $exit, $step) }
|            # The class is computed from the text here; in anonymous mode the TEXT itself never leaves this function.
|            $runArgs.ErrorClass = if ($d.ErrorClass) { [string]$d.ErrorClass } else { Get-SIErrorClass -Message $msg -ExitReason $exit }
|            # #532 (framework §12.18): a throttled run is ErrorClass 'throttled', Outcome 'warning' -- never a fix request
|            if ($exit -eq 'throttled') { $runArgs.ErrorClass = 'throttled' }
|            if (-not $anon) { $runArgs.ErrorMessage = $msg }
|        }
|        if ($step) { $runArgs.FailedStep = $step }
|        # #641: a Risk Analysis run with a report that is NOT COMPLETE (Risk Analysis sets the numbers on its run context):
|        # FailedStep ra-report, ErrorClass report-incomplete, the three report counts (numbers only -- the report NAMES stay
|        # in the run's log and the database, never in the record) and, identified, the link to the web app's page of the run
|        $incN = Get-SITelemetryIncompleteReports -RunContext $RunContext
|        if ($null -ne $incN -and $exit -ne 'success') {
|            $c2 = @{}; foreach ($k in @($counts.Keys)) { $c2[$k] = $counts[$k] }
|            $c2['reportsExpected'] = $incN.Expected; $c2['reportsStored'] = $incN.Stored; $c2['reportsIncomplete'] = $incN.Incomplete
|            $counts = $c2; $runArgs.Counts = $counts
|            $runArgs.FailedStep = (Get-SITelemetryState).ReportIncompleteStep
|            $runArgs.ErrorClass = (Get-SITelemetryState).ReportIncompleteClass
|            if ($incN.Link) { $runLink = $incN.Link }
|            # the text says how many, the names are on the page and in the run's log; #709 (identified only): the most severe
|            # one's cause in plain words follows -- the report's id already travels in Reports[] (framework 8.16)
|            if (-not $anon) {
|                $runArgs.ErrorMessage = ('{0} of {1} Risk Analysis report(s) are not complete in this run -- the run''s page lists them' -f $incN.Incomplete, $incN.Expected)
|                $head = ''
|                try { if ($RunContext.PSObject.Properties['ReportCauses'] -and $RunContext.ReportCauses -and (Get-Command -Name Get-SIReportCauseHeadline -ErrorAction SilentlyContinue)) { $head = Get-SIReportCauseHeadline -Facts @($RunContext.ReportCauses) } } catch { $head = '' }
|                if ($head) { $runArgs.ErrorMessage += ('. First cause: {0}' -f $head) }
|            }
|        }
|        # the steps this run finished well (StepsOk): a later ok report closes the tickets of the steps it lists
|        $sok = @(Get-SITelemetryStepsOk -RunContext $RunContext -ExitReason $exit -FailedStep $(if ($runArgs.ContainsKey('FailedStep')) { [string]$runArgs.FailedStep } else { '' }))
|        if ($sok.Count) { $runArgs.StepsOk = [string[]]$sok }
|        $runRec = New-SITelemetryRunRecord @runArgs
|        # #709 / framework 8.16: every report that failed, did not apply or deviated, with its code and cause (Risk Analysis
|        # puts the facts on its run context as ReportCauses). Built here, never fatal: nothing = no Reports.
|        $causeItems = @()
|        try {
|            if ($RunContext.PSObject.Properties['ReportCauses'] -and $RunContext.ReportCauses) {
|                # #902: a report held on purpose goes with the hold contract only once Invardia takes it for this ring (REMOVE-ME switch)
|                $holdOn = $false
|                try { $holdOn = [bool](Resolve-SIUplinkHoldFieldsSwitch -Ring $(if ($Context.PSObject.Properties['Ring']) { $Context.Ring } else { $null })).On } catch { $holdOn = $false }
|                $causeItems = @(ConvertTo-SIUplinkReports -Facts @($RunContext.ReportCauses) -Identified:(-not $anon) -Version (Get-SITelemetryReleaseVersion) -Region (Get-SIUplinkRegion) -HoldFields:$holdOn)
|                # #902: the reports held on purpose (information only) -- a number on the run record, the names stay in the log
|                $nHeld = @(@($RunContext.ReportCauses) | Where-Object { (Test-SIUplinkFactHeld -Fact $_) -eq 'info' }).Count
|                if ($nHeld -gt 0) { $c3 = @{}; foreach ($k in @($counts.Keys)) { $c3[$k] = $counts[$k] }; $c3['reportsHeld'] = [long]$nHeld; $counts = $c3 }
|            }
|        } catch { $causeItems = @() }
|        # SUP-2026-00198: a failure outside a report whose catalogue code is known (Send-SITelemetryFailure -Code: the
|        # updater's roll / restore) is its own item, so the record names the code
|        try {
|            if ($RunContext.PSObject.Properties['FailureCode'] -and "$($RunContext.FailureCode)".Trim()) {
|                $causeItems = @($causeItems) + @(ConvertTo-SIUplinkFailureItem -Code ([string]$RunContext.FailureCode) -Job ([string]$RunContext.Engine) -Step ([string]$RunContext.FailedStep) `
|                                                   -Text $ErrorMessage -Identified:(-not $anon) -Version (Get-SITelemetryReleaseVersion) -Region (Get-SIUplinkRegion))
|            }
|        } catch { }
|        # a COMPLETE report with more rows than the source counted is a note, not a failure: never in Reports, kept on the
|        # run's own record (RunContext.ReportNotes) and said once in the run log
|        try {
|            if ($RunContext.PSObject.Properties['ReportCauses'] -and $RunContext.ReportCauses) {
|                $notes = @(Get-SIUplinkReportNotes -Facts @($RunContext.ReportCauses))
|                if ($notes.Count) {
|                    $RunContext | Add-Member -NotePropertyName 'ReportNotes' -NotePropertyValue $notes -Force
|                    Write-Host ('  Note: {0} complete report(s) returned more rows than the source counted -- nothing is missing, no action ({1}).' -f $notes.Count, ((@($notes | Select-Object -First 5) | ForEach-Object { $_.Report }) -join ', '))
|                }
|            }
|        } catch { }
|
|        $queue = New-Object System.Collections.Generic.List[object]
|        $relF = $null
|        $hbDue =Test-SITelemetryHeartbeatDue -LastSentDate (Get-SITelemetryLastHeartbeat -StateDirectory $Context.StateDirectory) -NowUtc $nowUtc
|        # a halted process sends nothing: no heartbeat and no setup report are built (only the run record, for the outbox)
|        if ($halted) { $hbDue = $false }
|        if ($hbDue -and -not $NoHeartbeat) {
|            # #424: users / guests / devices, Pro (identified) only. A count that cannot be computed is left out.
|            $hbCounts = $null
|            if (-not $anon) {
|                # a test session never queries a workspace for them: only a handed-in -HeartbeatCounts stub runs there
|                try { $hbCounts = if ($HeartbeatCounts) { & $HeartbeatCounts } elseif (-not (Get-Module -Name Pester)) { Get-SITelemetryHeartbeatCounts -NowUtc $nowUtc } }
|                catch { $hbCounts = $null }
|            }
|            # CR3 (#657): the wave and release mode (identified only, behind SI_Telemetry_ReleaseControl) -- never fails the heartbeat
|            $relF = $null
|            if (-not $anon) { try { $relF = Get-SITelemetryReleaseFields -Context $Context -NowUtc $nowUtc } catch { $relF = $null } }
|            # CR4 (#654): the guard mode (identified only): the context's when it carries one (tests), else the rows release
|            # control read, else the database it has open, else the guard code's own read (Get-SITelemetryGuardModeWire) --
|            # never fails the heartbeat (nothing recorded / not readable = left out)
|            $gmWire = $null
|            if (-not $anon) { $gmWire = Get-SITelemetryGuardModeWire -Context $Context -Invoke $(if ($relF) { $relF.Invoke } else { $null }) -Rows $(if ($relF) { $relF.Rows } else { $null }) -NowUtc $nowUtc }
|            # #709: the capability probe (Capabilities, CiColumns; Licences identified only) -- once per process, never in a
|            # test session without -CapabilityProbe, never fails the heartbeat
|            $probe = $null
|            try { $probe = if ($CapabilityProbe) { & $CapabilityProbe } elseif (-not (Get-Module -Name Pester)) { Get-SICapabilityProbe } } catch { $probe = $null }
|            $queue.Add((ConvertTo-SITelemetryWire -Record (New-SITelemetryHeartbeat @base) -Mode $Context.Mode -Counts $hbCounts -Now $nowUtc -Endpoints $eps -LicenceId $lid -EnvironmentName $envName -GuardMode $gmWire `
|                            -Wave $(if ($relF) { $relF.Wave } else { $null }) -ReleaseMode $(if ($relF) { $relF.ReleaseMode } else { $null }) -Components $(if ($relF) { $relF.Components } else { $null }) -Evidence $(if ($relF) { $relF.Evidence } else { $null }) -Probe $probe -Build $(if ($Context.PSObject.Properties['Build']) { [string]$Context.Build } else { '' })))
|        }
|        $runWire = ConvertTo-SITelemetryWire -Record $runRec -Mode $Context.Mode -Counts $counts -Now $nowUtc -Link $runLink -LicenceId $lid -EnvironmentName $envName -Reports $causeItems -Build $(if ($Context.PSObject.Properties['Build']) { [string]$Context.Build } else { '' })
|        $queue.Add($runWire)
|        # framework 8.4: the run record as it would be sent, taken BEFORE the send (a refused send may strip fields from it) --
|        # kept in the outbox when it is not taken. Only where an outbox applies (identified, the Pro database open).
|        $runJson = ''
|        if ($obInvoke -and $null -ne $runWire) { try { $runJson = ConvertTo-SIUplinkOutboxJson -Record $runWire } catch { $runJson = '' } }
|        $runTaken = $false
|        $keepRun = { param([string]$Why)
|            if ($runTaken -or -not $runJson) { return $false }
|            [bool](Add-SIUplinkOutboxRecord -Invoke $obInvoke -Job $job -Json $runJson -Answer $Why -NowUtc $nowUtc) }
|        if ($halted) {
|            $keptRun = & $keepRun 'not sent: an earlier report of this process was not taken'
|            return (& $out 'halted' @() ('an earlier report in this process was not accepted -- nothing more is sent from it{0}' -f $(if ($keptRun) { '; the run report is kept and goes with a later status report' } else { '' })))
|        }
|        # #491 / framework §8.7: the setup report (the control list) once a day with the heartbeat -- identified installs only,
|        # LAST in the queue so a refused setup report never costs the heartbeat or the run report. SI_Telemetry_SetupControls:
|        # all (default, owner 2026-10-18: "telemetry must be on") = every control in the catalog, and when Invardia refuses
|        # that report it goes again once with only the minimum list; minimum = only the framework's minimum controls; off = none. Anything that fails here leaves the setup report out, nothing else.
|        $setupMinimum = $null
|        if ($hbDue -and -not $NoHeartbeat -and -not $anon) {
|            try {
|                $scope = Resolve-SISetupControlScope -Value $global:SI_Telemetry_SetupControls
|                if ($scope -ne 'off') {
|                    $cat = if ($SetupCatalog) { $SetupCatalog } else { Get-SISetupCatalog }
|                    $us = ''; if ($global:SI_InstallRingFacts -and $global:SI_InstallRingFacts.PSObject.Properties['UpdateState']) { $us = [string]$global:SI_InstallRingFacts.UpdateState }
|                    $ps = ''; if ($global:SI_InstallRingFacts -and $global:SI_InstallRingFacts.PSObject.Properties['PipelineSchedule']) { $ps = [string]$global:SI_InstallRingFacts.PipelineSchedule }
|                    $states = Get-SISetupControlStates -Context $Context -ExitReason $exit -UpdateStateJson $us -NowUtc $nowUtc -PipelineScheduleJson $ps -SecretHandoverJson $(if ($global:SI_InstallRingFacts -and $global:SI_InstallRingFacts.PSObject.Properties['SecretHandover']) { [string]$global:SI_InstallRingFacts.SecretHandover } else { '' })
|                    $setup = New-SISetupReport -Context $Context -Catalog $cat -States $states -Scope $scope -Now $nowUtc
|                    if ($setup) { $queue.Add($setup) }
|                    # 'all' (the default) refused by Invardia goes again ONCE with only the minimum list (below)
|                    if ($setup -and $scope -eq 'all') { $setupMinimum = New-SISetupReport -Context $Context -Catalog $cat -States $states -Scope 'minimum' -Now $nowUtc }
|                }
|            } catch { }
|        }
|
|        $sent = New-Object System.Collections.Generic.List[string]
|        foreach ($w in $queue) {
|            if ($null -eq $w) { throw 'the report could not be built (an anonymous report needs its install id)' }
|            # CR3: a heartbeat refused WITH the release fields goes again once without them (Send-SITelemetryRecordWithFallback)
|            $r = (Send-SITelemetryRecordWithFallback -Record $w -Transport $Transport -Context $Context -TimeoutSec (Get-SITelemetrySendState).TimeoutSec `
|                    -Invoke $(if ($relF) { $relF.Invoke } else { $null }) -NowUtc $nowUtc).Result
|            # the setup report with every control (SI_Telemetry_SetupControls = all, the default) that Invardia does not take
|            # goes again ONCE with only the framework's minimum list -- said once per process; the minimum one decides
|            if ("$($r.Status)" -ne 'ok' -and [string]$w.Kind -eq 'setup' -and $setupMinimum) {
|                $firstWhy = ConvertTo-AitUplinkRedacted -Text ("$($r.Reason)")
|                $r = & $Transport $setupMinimum $Context.Endpoint $Context.AccessCode (Get-SITelemetrySendState).TimeoutSec
|                if ("$($r.Status)" -eq 'ok' -and -not $global:SI_SetupControlsFallbackSaid) {
|                    $global:SI_SetupControlsFallbackSaid = $true
|                    Write-Host ("  Invardia did not take the setup report with every SecurityInsight control ({0}) -- it was sent with the minimum control list instead." -f $firstWhy)
|                }
|                $setupMinimum = $null
|            }
|            if ("$($r.Status)" -ne 'ok') {
|                # STOP at the first answer that is not ok -- for the rest of this process. No retry in the run. The RUN record,
|                # when it was not taken (this one, or the one after a refused heartbeat), is kept in the outbox (framework 8.4)
|                $global:SI_TelemetryHalted = $true
|                $why = ConvertTo-AitUplinkRedacted -Text ("$($r.Reason)")
|                $keptRun = & $keepRun $why
|                if (-not $global:SI_TelemetryWarned) {
|                    $global:SI_TelemetryWarned = $true
|                    Write-Warning ("The status report to Invardia was not sent ({0}). The run is not affected; nothing more is sent from this run{1}. To turn these reports off, set `$global:SI_Telemetry_Enabled = `$false." -f $why, $(if ($keptRun) { ' -- the run report is kept in this install''s database and goes with a later status report' } else { '' }))
|                }
|                return (& $out 'failed' $sent $why)
|            }
|            if ([object]::ReferenceEquals($w, $runWire)) { $runTaken = $true }
|            $sent.Add([string]$w.Kind)
|            # #517: Invardia re-issued the installed licence -> recorded ONCE per process for the updater's licence step
|            if (-not $supSeen -and $r.PSObject.Properties['SupersededBy']) {
|                $sup = ConvertTo-SILicenceIdOrEmpty ([string]$r.SupersededBy)
|                if ($sup -and $sup -ne $lid) { $supSeen = $sup; $null = Invoke-SILicenceSupersededNotice -LicenceId $sup -OnSuperseded $OnSuperseded -NowUtc $nowUtc }
|            }
|            # #710: Invardia names the install's environment (identified only) -> recorded once per process, and only when it
|            # is not the id already recorded, for the customer mail's portal link (Send-SIMail)
|            if (-not $anon -and -not $envSeen -and $r.PSObject.Properties['EnvironmentId']) {
|                try {
|                    $eid = ConvertTo-SIInvardiaEnvironmentIdOrEmpty ([string]$r.EnvironmentId)
|                    if ($eid) {
|                        $envSeen = $true
|                        if ($eid -ne (Get-SIInvardiaEnvironmentIdKnown)) { $null = Invoke-SIInvardiaEnvironmentNotice -EnvironmentId $eid -OnEnvironment $OnEnvironment -NowUtc $nowUtc }
|                    }
|                } catch { }
|            }
|            if ($w.Kind -eq 'heartbeat') {
|                Set-SITelemetryLastHeartbeat -StateDirectory $Context.StateDirectory -NowUtc $nowUtc
|                try {
|                    $how = if ($anon) { 'anonymous: no tenant, host name or error text' } else { 'identified by this install''s key' }
|                    Write-Host (" [INFO] Sent today's status report to Invardia ({0}). To turn these reports off, set `$global:SI_Telemetry_Enabled = `$false." -f $how)
|                } catch { }
|            }
|        }
|        return (& $out 'ok' $sent ("sent {0} report(s) ({1})" -f $sent.Count, $Context.Mode))
|    } catch {
|        # #702 (customer B 2026-10-15): a run that ran out of memory could not even build its report, so Invardia never
|        # heard of the failure. Out of memory while preparing: let go of what can be let go and try ONCE more with the run
|        # report alone (no heartbeat counts, no setup report -- the smallest report there is). Once per process.
|        $prepErr = $_
|        $isOom = $false; try { $isOom = [bool]((Get-Command -Name Test-SIOutOfMemoryText -ErrorAction SilentlyContinue) -and (Test-SIOutOfMemoryText $prepErr)) } catch { $isOom = $true }
|        if ($isOom -and -not $script:SITelemetryOomRetried) {
|            $script:SITelemetryOomRetried = $true
|            try { [System.GC]::Collect(); [System.GC]::WaitForPendingFinalizers(); [System.GC]::Collect() } catch { }
|            $again = @{}; foreach ($k in @($PSBoundParameters.Keys)) { $again[$k] = $PSBoundParameters[$k] }
|            $again['NoHeartbeat'] = $true
|            try { return (Send-SITelemetryRunEnd @again) } catch { $prepErr = $_ }
|        }
|        $global:SI_TelemetryHalted = $true
|        if (-not $global:SI_TelemetryWarned) {
|            $global:SI_TelemetryWarned = $true
|            # si-upl-0601: the run record could not be built (data-model/errors.locked.json)
|            try { Write-Warning ("The status report to Invardia could not be prepared (si-upl-0601: {0}). The run is not affected." -f (ConvertTo-AitUplinkRedacted -Text $prepErr.Exception.Message)) } catch { }
|        }
|        return (& $out 'error' @() ("si-upl-0601: $($prepErr.Exception.Message)"))
|    }
|}
|
|# =====================================================================================================================
|#  #427: failures OUTSIDE an engine run -- the guided install's failed steps and the updater's failures
|# =====================================================================================================================
|function Send-SITelemetryFailure {
|    <#
|        Report ONE failure that happened outside an engine run (framework UPLINK-FIX, owner 2026-10-07: every failure a
|        product can observe reaches the uplink): -Job install (a guided install step, Job si-install), updater (Job
|        si-updater) or datasync (#904: a PART of the data sync that failed while the job completed, Job si-datasync), -Step the step id (FailedStep: the install step id, or download / verify / database / build / roll /
|        restore / claim / licence / ...), -ErrorMessage the error. It is a `run` report with Outcome failed, ErrorClass from
|        the text, the version, no heartbeat. The SAME rules as an engine run: the telemetry switch is honoured, identified
|        with the install key where one is known (the text redacted), anonymous otherwise (no tenant, no host, no text). A
|        test session never sends without -Transport. NEVER throws; returns the Send-SITelemetryRunEnd result.
|          -Context   a Get-SITelemetryContext result (default: this process's)
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][ValidateSet('install', 'updater', 'datasync')][string]$Job, [Parameter(Mandatory)][AllowEmptyString()][string]$Step,
|          [AllowEmptyString()][string]$ErrorMessage, $StartedAt, $Context, [scriptblock]$Transport, $Now,
|          # the class when the caller KNOWS it (a value of the closed list; anything else is classified from the text)
|          [AllowEmptyString()][string]$ErrorClass,
|          # ring 1 2026-10-10: something the CUSTOMER must do (a role grant to re-run) -- Outcome warning, never 'failed':
|          # the update did not fail. With a customer-config class Invardia shows "needs customer action", no fix request.
|          [switch]$CustomerAction,
|          # #904: a PART of a job that failed while the job completed (-Job datasync: a part of the data sync) -- Outcome
|          # warning, the class and FailedStep of that part; with a product-defect class Invardia opens a fix request
|          [switch]$Partial,
|          # SUP-2026-00198: the failure's error-catalogue code when the caller KNOWS it (si-upd-0803 a refused roll,
|          # si-upd-0804 a failed restore, si-upd-0805 a roll that did not verify) -- sent as the record's Reports[] item
|          # (ConvertTo-SIUplinkFailureItem), so Invardia files it under that code and never as 'unknown'
|          [AllowEmptyString()][string]$Code)
|    try {
|        $st = ("$Step".Trim().ToLowerInvariant() -replace '[^a-z0-9\-]', '-') -replace '^[^a-z]+', ''
|        if (-not $st) { $st = 'unknown' }
|        $rc = [pscustomobject]@{ Engine = $Job; ShardIndex = 0; StartedAt = $StartedAt; FailedStep = $st }
|        if ("$Code".Trim()) {
|            $rc | Add-Member -NotePropertyName FailureCode -NotePropertyValue "$Code".Trim().ToLowerInvariant()
|            # a registry / platform that did not answer Azure is the platform's, not 'unknown' (the 400 of 2026-10-19)
|            if (-not "$ErrorClass".Trim() -and "$ErrorMessage" -match '(?i)connection refused|connection reset|i/o timeout|TLS handshake timeout|no such host|context deadline exceeded|Service Unavailable|Bad Gateway') { $ErrorClass = 'platform-5xx' }
|        }
|        if ("$ErrorClass".Trim()) { $rc | Add-Member -NotePropertyName FailedStepError -NotePropertyValue "$ErrorMessage"; $rc | Add-Member -NotePropertyName FailedStepErrorClass -NotePropertyValue "$ErrorClass".Trim() }
|        $a = @{ RunContext = $rc; ExitReason = $(if ($CustomerAction -or $Partial) { 'success-partial' } else { 'error' }); ErrorMessage = "$ErrorMessage"; NoHeartbeat = $true }
|        if ($Context) { $a.Context = $Context }
|        if ($Transport) { $a.Transport = $Transport }
|        if ($Now) { $a.Now = $Now }
|        Send-SITelemetryRunEnd @a
|    } catch { [pscustomobject]@{ Status = 'error'; Sent = @(); Reason = "$($_.Exception.Message)" } }
|}
|
|
|# =====================================================================================================================
|#  CR3 (#657): RELEASE MODE -- the identified heartbeat every 30 minutes for 12 hours after a release that changed engine code
|# =====================================================================================================================
|function Send-SIReleaseModeReport {
|    <#
|        One release-mode report, when one is due: an IDENTIFIED heartbeat (users, guests, devices, the guard mode, the wave)
|        with releaseMode { version, sinceUtc, untilUtc, everyMinutes } -- counts only, never a name. Due = this install is in
|        release mode (the engine fingerprint changed less than 12 hours ago, Get-SIReleaseModeFromFingerprint) AND no report
|        of this half hour was sent: the half hour is CLAIMED in the Pro database first (cfg.InstallState 'ReleaseModeReport',
|        one statement), so two processes never both send it. The same rules as every report: the telemetry switch, a test
|        session never sends without -Transport, the first answer that is not ok stops telemetry for the process. Behind
|        SI_Telemetry_ReleaseControl (auto = the confirmed rings only). NEVER throws; returns @{ Status; Reason }:
|        sent | disabled | halted | skipped | not-due | failed | error.
|          -Invoke          the Pro database seam (required: no database = nothing to read, nothing sent)
|          -Context         a Get-SITelemetryContext result (default: this install's)
|          -Transport       the test seam (default Send-SITelemetryUplink)
|          -HeartbeatCounts { } -> @{ users; guests; devices } (default Get-SITelemetryHeartbeatCounts; never in a test session)
|          -Rows            the cfg.InstallState rows (tests; default read through -Invoke)
|    #>
|    [CmdletBinding()]
|    param([scriptblock]$Invoke, $Context, [scriptblock]$Transport, $Now, [scriptblock]$HeartbeatCounts, $Rows)
|    $out = { param($s, $why) [pscustomobject]@{ Status = $s; Reason = $why } }
|    try {
|        if (-not (Test-SITelemetryEnabled)) { return (& $out 'disabled' 'telemetry is switched off (SI_Telemetry_Enabled)') }
|        if ($global:SI_TelemetryHalted) { return (& $out 'halted' 'an earlier report in this process was not accepted') }
|        if (-not $Transport -and (Get-Module -Name Pester)) { return (& $out 'skipped' 'a test session (Pester is loaded) never sends; pass -Transport to test the sender') }
|        if (-not $Invoke -and -not $Rows) { return (& $out 'skipped' 'no Pro database') }
|        $nowUtc = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|        if (-not $Context) { $Context = Get-SITelemetryContext }
|        if ($Context.Mode -eq 'anonymous') { return (& $out 'skipped' 'an anonymous install sends no release-mode reports') }
|        $rel = Get-SITelemetryReleaseFields -Context $Context -NowUtc $nowUtc -Invoke $Invoke -Rows $Rows
|        if (-not $rel.Rows) { return (& $out 'skipped' $rel.Reason) }
|        if (-not $rel.ReleaseMode -or $null -eq $rel.ReleaseMode.Value) {
|            return (& $out 'not-due' $(if ($rel.ReleaseMode) { 'not in release mode' } elseif ($rel.Reason) { $rel.Reason } else { 'no engine fingerprint is recorded' }))
|        }
|        $mode = Get-SIReleaseModeFromFingerprint -Fingerprint ([string]$rel.Rows.EngineFingerprint) -NowUtc $nowUtc
|        $slot = Get-SIReleaseModeSlot -Mode $mode -NowUtc $nowUtc
|        if ($slot -lt 0) { return (& $out 'not-due' 'not in release mode') }
|        $claimInvoke = if ($Invoke) { $Invoke } else { $rel.Invoke }
|        if (-not $claimInvoke) { return (& $out 'skipped' 'no Pro database to claim the half hour in') }
|        if (-not (Invoke-SIReleaseModeClaim -Invoke $claimInvoke -Mode $mode -Slot $slot -NowUtc $nowUtc)) { return (& $out 'not-due' ("the report of this half hour (slot {0}) was sent already" -f $slot)) }
|        if (-not $Transport) { $Transport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) Send-SITelemetryUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec } }
|
|        $base = @{ Edition = $Context.Edition; Version = $Context.Version; Hosting = $Context.Hosting; RuntimeIdentity = $Context.RuntimeIdentity
|                   LicenceState = $Context.LicenceState; Now = $nowUtc; Ring = $(if ($Context.PSObject.Properties['Ring']) { $Context.Ring } else { $null }); TenantId = $Context.TenantId }
|        $hbCounts = $null
|        try { $hbCounts = if ($HeartbeatCounts) { & $HeartbeatCounts } elseif (-not (Get-Module -Name Pester)) { Get-SITelemetryHeartbeatCounts -NowUtc $nowUtc } } catch { $hbCounts = $null }
|        $gmWire = $null
|        try { if (Get-Command -Name ConvertTo-SIGuardModeWire -ErrorAction SilentlyContinue) { $gmWire = ConvertTo-SIGuardModeWire -Mode (Get-SIGuardModeFromState -Fingerprint ([string]$rel.Rows.EngineFingerprint) -StrictEnd ([string]$rel.Rows.GuardStrictEnd) -NowUtc $nowUtc) } } catch { $gmWire = $null }
|        $eps = @(if ($Context.PSObject.Properties['Endpoints']) { @($Context.Endpoints) })
|        $lid = if ($Context.PSObject.Properties['LicenceId']) { [string]$Context.LicenceId } else { '' }
|        $envName = if ($Context.PSObject.Properties['EnvironmentName']) { [string]$Context.EnvironmentName } else { '' }
|        $w = ConvertTo-SITelemetryWire -Record (New-SITelemetryHeartbeat @base) -Mode $Context.Mode -Counts $hbCounts -Now $nowUtc -Endpoints $eps -LicenceId $lid -EnvironmentName $envName `
|                -GuardMode $gmWire -Wave $rel.Wave -ReleaseMode $rel.ReleaseMode -Components $rel.Components -Evidence $rel.Evidence -Build $(if ($Context.PSObject.Properties['Build']) { [string]$Context.Build } else { '' })
|        if ($null -eq $w) { return (& $out 'error' 'the report could not be built') }
|        $s = Send-SITelemetryRecordWithFallback -Record $w -Transport $Transport -Context $Context -TimeoutSec (Get-SITelemetrySendState).TimeoutSec -Invoke $claimInvoke -NowUtc $nowUtc
|        if ("$($s.Result.Status)" -ne 'ok') {
|            $global:SI_TelemetryHalted = $true
|            $why = ConvertTo-AitUplinkRedacted -Text ("$($s.Result.Reason)")
|            if (-not $global:SI_TelemetryWarned) {
|                $global:SI_TelemetryWarned = $true
|                Write-Warning ("The release-mode status report to Invardia was not sent ({0}). The run is not affected; nothing more is sent from this run." -f $why)
|            }
|            return (& $out 'failed' $why)
|        }
|        try { Write-Host (" [INFO] Sent a release-mode status report to Invardia (release {0}: every {1} minutes until {2}; counts only)." -f $(if ($mode.Version) { $mode.Version } else { 'with engine changes' }), $script:SIReleaseControl.EveryMinutes, (Format-SIGuardStrictUntil $mode.Until)) } catch { }
|        & $out 'sent' ("slot {0} of release {1}" -f $slot, $mode.Version)
|    } catch {
|        & $out 'error' ("$($_.Exception.Message)")
|    }
|}
|
|function Invoke-SIReleaseModeReportTick {
|    <#
|        The pipeline runner's call (engine\flow\Invoke-SIJobFlowRun.ps1): at every wake-up (every 5 minutes) and from its
|        lock heartbeat during a long run. Asks Send-SIReleaseModeReport at most once every 4 minutes per process. NEVER
|        throws; returns its result, or $null when it did not ask.
|    #>
|    param([scriptblock]$Invoke, [scriptblock]$Transport, $Now, [switch]$Force)
|    try {
|        $nowUtc = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|        $last = $global:SI_ReleaseModeTickAt
|        if (-not $Force -and $last -and ($nowUtc - [datetime]$last).TotalMinutes -lt $script:SIReleaseControl.CheckMinutes -and $nowUtc -ge [datetime]$last) { return $null }
|        $global:SI_ReleaseModeTickAt = $nowUtc
|        # #882 -- A RUN OF MANY HOURS: the pipeline runner is ONE process that may live a whole day (it drains the queue and
|        # follows each long run). A report that was not accepted halts telemetry for the process (built for a short engine
|        # run), so one refused or lost half hour silenced every later release-mode report until the runner ended. In the
|        # runner the halt lasts until the NEXT half hour: then the report of that half hour is asked again (the warning is
|        # not said again). Still at most one report per half hour (the slot is claimed in the database first).
|        $every = [Math]::Max(1, [int]$script:SIReleaseControl.EveryMinutes)
|        $slotNow = [long][Math]::Floor(($nowUtc - [datetime]::new(2000, 1, 1, 0, 0, 0, [DateTimeKind]::Utc)).TotalMinutes / $every)
|        if ($global:SI_TelemetryHalted) {
|            if ($null -eq $global:SI_ReleaseModeHaltSlot) { $global:SI_ReleaseModeHaltSlot = $slotNow }
|            elseif ($slotNow -gt [long]$global:SI_ReleaseModeHaltSlot) { $global:SI_TelemetryHalted = $false; $global:SI_ReleaseModeHaltSlot = $null }
|        } else { $global:SI_ReleaseModeHaltSlot = $null }
|        $a = @{ Invoke = $Invoke; Now = $nowUtc }
|        if ($Transport) { $a.Transport = $Transport }
|        $res = Send-SIReleaseModeReport @a
|        if ($global:SI_TelemetryHalted -and $null -eq $global:SI_ReleaseModeHaltSlot) { $global:SI_ReleaseModeHaltSlot = $slotNow }
|        $res
|    } catch { $null }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-Telemetry.ps1'] = @{ Sha256 = '40ac7968d4e8cd01c43356cdaf3820a02778af8d416fd32d9e2823620ea7685c'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- the TELEMETRY RECORDS SecurityInsight would send through the framework uplink (Schema 2).
|
|    Two kinds, as agreed with the receiving side:
|      heartbeat  once a day: product, edition, version, ring, hosting, runtime identity, licence state
|      run        once per engine run, at the run-health END moment: the stable Job id, Outcome (from ExitReason),
|                 DurationMs, FailedStep, ErrorClass (SI-ErrorClass.ps1), Counts
|
|    Two modes:
|      anonymous   (Community, the default there) -- a random InstallId; NO tenant, NO host name, NO error text, and
|                  counts only as buckets (0, 1-100, 100-1k, 1k-10k, 10k-100k, 100k+). Data that is never put in the
|                  record cannot leak, so the fields are absent, not empty.
|      identified  (Pro / trial) -- the install key proves who sends; the tenant and host are carried, error text is
|                  shortened to 4000 characters and redacted (tokens, secrets, connection strings, SAS signatures).
|
|    NOTHING IS SENT FROM HERE. These are pure builders: values in, one record out, no network, no file, no clock
|    unless -Now is omitted. SI-TelemetrySend.ps1 calls them at the run-health END moment, shapes the record for the wire
|    with the framework client's New-AitUplinkReport (engine/_shared/AitUplink.ps1, a copy of sync/_AitUplink.ps1) and
|    sends it with Send-AitUplink. Every enum is checked here, so a record that would be refused by the receiver is
|    refused at the source instead.
|
|    PS 5.1 safe.
|#>
|
|if (-not (Get-Command -Name Get-SIErrorClass -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-ErrorClass.ps1'))
|}
|
|function Get-SITelemetryState {
|    <# The value of $script:SITelemetry, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SITelemetry) { $script:SITelemetry = @{
|    Product          = 'securityinsight'
|    Solution         = 'SecurityInsight'
|    Schema           = 2
|    Editions         = @('community', 'pro', 'trial')
|    Hostings         = @('container', 'vm', 'arc')
|    RuntimeIdentities = @('mi-container', 'mi-arc', 'mi-vm', 'spn-certificate', 'spn-secret')
|    LicenceStates    = @('valid', 'grace', 'expired', 'none')
|    Outcomes         = @('ok', 'warning', 'failed')
|    # One `run` per engine run. Community engines first, then Pro.
|    Jobs             = @('si-ptc', 'si-endpoint', 'si-identity', 'si-azure', 'si-publicip', 'si-ra-summary', 'si-ra-detailed', 'si-trend',
|                         'si-schema-discovery', 'si-asset-tagging', 'si-correlation', 'si-asset-properties', 'si-cmdb', 'si-vuln-closeloop',
|                         'si-datasync', 'si-updater', 'si-web', 'si-cmdb-sql', 'si-flow', 'si-install')
|    # #641: a Risk Analysis run's reports -- how many the template has, how many are stored complete, how many are not
|    CountNames       = @('assets', 'findings', 'identities', 'reportsExpected', 'reportsStored', 'reportsIncomplete')
|    # Invardia's receiver DROPS a record with more than 40 Counts keys (raised from 10, Invardia 2026-10-13) (numbers only, keys ^[a-z][A-Za-z0-9]{0,30}$)
|    MaxCounts        = 40
|    CountKeyPattern  = '^[a-z][A-Za-z0-9]{0,30}$'
|    # #641: the step and the class of a run with a report that is not complete
|    ReportIncompleteStep  = 'ra-report'
|    ReportIncompleteClass = 'report-incomplete'
|    ErrorTextMax     = 4000   # Invardia UPLINK-FIX 2026-10-07: run ErrorText max 4000
|} }
|    , $script:SITelemetry
|}
|$script:SITelemetry = $null; $null = Get-SITelemetryState
|
|function Get-SITelemetryContract { (Get-SITelemetryState) }
|
|function Get-SITelemetryOutcome {
|    <# PURE. ExitReason -> Outcome: success = ok, success-partial = warning, throttled = warning (#532, framework §12.18
|       THROTTLE-IS-NORMAL: never failed, never a fix request), error / settings-error = failed. Anything else is refused
|       (a new ExitReason must be mapped on purpose, not guessed). #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$ExitReason)
|    switch ($ExitReason) {
|        'success'         { return 'ok' }
|        'success-partial' { return 'warning' }
|        'throttled'       { return 'warning' }   # #532: Microsoft throttled the run; it runs again -- information, not a problem
|        'dry-run'         { return 'ok' }        # #276: a dry run that went well; a failed one keeps its own reason
|        'error'           { return 'failed' }
|        'settings-error'  { return 'failed' }
|    }
|    throw ("'{0}' is not a run-health ExitReason (success, success-partial, throttled, error, settings-error)" -f $ExitReason)
|}
|
|function Get-SITelemetryCountBucket {
|    <# PURE. A count as its anonymous bucket: 0 | 1-100 | 100-1k | 1k-10k | 10k-100k | 100k+ (UPPER bound inclusive:
|       100 is '1-100', 1000 is '100-1k' -- the same boundaries as the framework client, Get-AitUplinkCountBucket, and the
|       receiver; the wire record is bucketed by the framework, and the two must never disagree).
|       $null for an unknown count (run health uses -1 for "not counted"). #>
|    param([AllowNull()]$Count)
|    if ($null -eq $Count -or [string]::IsNullOrWhiteSpace([string]$Count)) { return $null }
|    $n = 0L
|    if (-not [long]::TryParse([string]$Count, [System.Globalization.NumberStyles]::Integer, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n) -or $n -lt 0) { return $null }
|    if ($n -eq 0) { return '0' }
|    if ($n -le 100) { return '1-100' }
|    if ($n -le 1000) { return '100-1k' }
|    if ($n -le 10000) { return '1k-10k' }
|    if ($n -le 100000) { return '10k-100k' }
|    '100k+'
|}
|
|function ConvertTo-SITelemetryErrorText {
|    <# PURE. Error text an IDENTIFIED record may carry: secrets redacted, then shortened to 4000 characters (the receiver's limit). #>
|    param([AllowEmptyString()][AllowNull()][string]$Text)
|    if ([string]::IsNullOrEmpty($Text)) { return '' }
|    $t = $Text
|    $t = [regex]::Replace($t, 'eyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}', '[jwt]')
|    $t = [regex]::Replace($t, '(?i)\bBearer\s+[A-Za-z0-9_\-\.=~+/]+', 'Bearer [redacted]')
|    $t = [regex]::Replace($t, '(?i)\b(client_secret|password|pwd|accountkey|sharedaccesskey|apikey|api-key|x-api-key|access_token|refresh_token)\s*[=:]\s*("[^"]*"|''[^'']*''|[^;&\s,]+)', '$1=[redacted]')
|    $t = [regex]::Replace($t, '(?i)\bsig=[A-Za-z0-9%+/=]+', 'sig=[redacted]')
|    if ($t.Length -gt (Get-SITelemetryState).ErrorTextMax) { $t = $t.Substring(0, (Get-SITelemetryState).ErrorTextMax) }
|    $t
|}
|
|function Test-SITelemetryValue {
|    param([string]$Name, [AllowEmptyString()][AllowNull()][string]$Value, [string[]]$Allowed, [switch]$Optional)
|    if ($Optional -and [string]::IsNullOrEmpty($Value)) { return }
|    if ($Allowed -notcontains $Value) { throw ("telemetry: '{0}' is not a valid {1} ({2})" -f $Value, $Name, ($Allowed -join ', ')) }
|}
|
|function New-SITelemetryBase {
|    param([string]$Kind, [string]$Edition, [string]$Version, $Ring, [string]$Hosting, [string]$RuntimeIdentity, [string]$LicenceState,
|          [bool]$Anonymous, [string]$InstallId, [string]$TenantId, [string]$HostName, $Now)
|    Test-SITelemetryValue -Name 'Edition' -Value $Edition -Allowed (Get-SITelemetryState).Editions
|    Test-SITelemetryValue -Name 'Hosting' -Value $Hosting -Allowed (Get-SITelemetryState).Hostings
|    Test-SITelemetryValue -Name 'RuntimeIdentity' -Value $RuntimeIdentity -Allowed (Get-SITelemetryState).RuntimeIdentities
|    Test-SITelemetryValue -Name 'LicenceState' -Value $LicenceState -Allowed (Get-SITelemetryState).LicenceStates
|    if ($Anonymous -and $InstallId -notmatch '^[A-Za-z0-9\-]{16,64}$') { throw 'telemetry: an anonymous record needs its random InstallId (16-64 letters, digits or dashes)' }
|    $ts = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|    $r = [ordered]@{
|        Schema          = (Get-SITelemetryState).Schema
|        Kind            = $Kind
|        Product         = (Get-SITelemetryState).Product
|        Solution        = (Get-SITelemetryState).Solution
|        Edition         = $Edition
|        Version         = [string]$Version
|        Ring            = $(if ($null -ne $Ring -and [string]$Ring -ne '') { [int]$Ring } else { $null })
|        Hosting         = $Hosting
|        RuntimeIdentity = $RuntimeIdentity
|        LicenceState    = $LicenceState
|        WriterSource    = $(if ($Anonymous) { 'anonymous' } else { 'install-key' })
|    }
|    if ($Anonymous) { $r.InstallId = $InstallId }
|    else {
|        $r.ClaimedTenantId = [string]$TenantId
|        $r.Host = $(if ($HostName) { $HostName } else { [string][System.Environment]::MachineName })
|    }
|    $r.LastSeenUtc = $ts.ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture)
|    $r
|}
|
|function New-SITelemetryHeartbeat {
|    <#
|        PURE. The daily `heartbeat` record. -Anonymous drops the tenant and the host and carries -InstallId instead.
|    #>
|    param([Parameter(Mandatory)][string]$Edition, [Parameter(Mandatory)][string]$Version, $Ring,
|          [Parameter(Mandatory)][string]$Hosting, [Parameter(Mandatory)][string]$RuntimeIdentity, [Parameter(Mandatory)][string]$LicenceState,
|          [switch]$Anonymous, [string]$InstallId, [string]$TenantId, [string]$HostName, $Now)
|    [pscustomobject](New-SITelemetryBase -Kind 'heartbeat' -Edition $Edition -Version $Version -Ring $Ring -Hosting $Hosting -RuntimeIdentity $RuntimeIdentity `
|        -LicenceState $LicenceState -Anonymous ([bool]$Anonymous) -InstallId $InstallId -TenantId $TenantId -HostName $HostName -Now $Now)
|}
|
|function New-SITelemetryRunRecord {
|    <#
|        PURE. The `run` record of one engine run, built at the run-health END moment.
|          -Job          the stable job id (si-ptc, si-ra-detailed, ...)
|          -ExitReason   run health's ExitReason -> Outcome (ok / warning / failed)
|          -DurationMs   the run's duration
|          -FailedStep   the stage that failed (collect, classify, ingest, ra-query, mail, ...) -- failed / warning only
|          -ErrorClass   given, or classified here from -ErrorRecord / -ErrorMessage (Get-SIErrorClass) for a run that did
|                        not end ok
|          -Counts       @{ assets; findings; identities } -- exact when identified, bucketed when anonymous
|          -ErrorMessage the error text: carried (redacted, max 8 KB) ONLY in an identified record
|        -Anonymous drops the tenant, the host and the error text and buckets the counts.
|    #>
|    param([Parameter(Mandatory)][string]$Job, [Parameter(Mandatory)][AllowEmptyString()][string]$ExitReason,
|          [Parameter(Mandatory)][string]$Edition, [Parameter(Mandatory)][string]$Version, $Ring,
|          [Parameter(Mandatory)][string]$Hosting, [Parameter(Mandatory)][string]$RuntimeIdentity, [Parameter(Mandatory)][string]$LicenceState,
|          [long]$DurationMs = 0, [string]$FailedStep, [string]$ErrorClass, $ErrorRecord, [AllowEmptyString()][string]$ErrorMessage,
|          [System.Collections.IDictionary]$Counts, [switch]$Anonymous, [string]$InstallId, [string]$TenantId, [string]$HostName, $Now,
|          # the steps this run finished well (Get-SITelemetryStepsOk) -- ids in the FailedStep shape, at most 50; ok and
|          # warning runs only: a later ok report that lists a step closes the ticket that step's failure opened
|          [string[]]$StepsOk)
|    Test-SITelemetryValue -Name 'Job' -Value $Job -Allowed (Get-SITelemetryState).Jobs
|    $outcome = Get-SITelemetryOutcome -ExitReason $ExitReason
|    if ($DurationMs -lt 0) { throw 'telemetry: DurationMs cannot be negative' }
|    if ($FailedStep -and $FailedStep -notmatch '^[a-z][a-z0-9\-]{0,31}$') { throw ("telemetry: '{0}' is not a step name (lower-case letters, digits and dashes)" -f $FailedStep) }
|    $cls = $null
|    if ($outcome -ne 'ok') {
|        $cls = if ($ErrorClass) { $ErrorClass } else { Get-SIErrorClass -ErrorRecord $ErrorRecord -Message $ErrorMessage -ExitReason $ExitReason }
|        # #532 (framework §12.18): a throttled run reports ErrorClass 'throttled' -- platform-5xx / platform-timeout as the
|        # only cause map the same way
|        if ($ExitReason -eq 'throttled') { $cls = 'throttled' }
|        Test-SITelemetryValue -Name 'ErrorClass' -Value $cls -Allowed (Get-SITelemetryErrorClassList)
|    }
|    $c = [ordered]@{}
|    if ($Counts) {
|        foreach ($k in @($Counts.Keys)) {
|            if ((Get-SITelemetryState).CountNames -notcontains [string]$k) { throw ("telemetry: '{0}' is not a count ({1})" -f $k, ((Get-SITelemetryState).CountNames -join ', ')) }
|            if ([string]$k -cnotmatch (Get-SITelemetryState).CountKeyPattern) { throw ("telemetry: '{0}' is not a count name the receiver accepts" -f $k) }
|        }
|        if (@($Counts.Keys).Count -gt (Get-SITelemetryState).MaxCounts) { throw ("telemetry: {0} counts -- the receiver drops a record with more than {1}" -f @($Counts.Keys).Count, (Get-SITelemetryState).MaxCounts) }
|        foreach ($k in (Get-SITelemetryState).CountNames) {
|            if (-not $Counts.Contains($k)) { continue }
|            if ($Anonymous) { $c[$k] = Get-SITelemetryCountBucket $Counts[$k] }
|            else { $n = 0L; $c[$k] = $(if ([long]::TryParse([string]$Counts[$k], [ref]$n) -and $n -ge 0) { $n } else { $null }) }
|        }
|    }
|    $r = New-SITelemetryBase -Kind 'run' -Edition $Edition -Version $Version -Ring $Ring -Hosting $Hosting -RuntimeIdentity $RuntimeIdentity `
|        -LicenceState $LicenceState -Anonymous ([bool]$Anonymous) -InstallId $InstallId -TenantId $TenantId -HostName $HostName -Now $Now
|    $last = $r.LastSeenUtc; $r.Remove('LastSeenUtc')
|    $r.Job = $Job
|    $r.Outcome = $outcome
|    $r.DurationMs = $DurationMs
|    $r.FailedStep = $(if ($outcome -ne 'ok' -and $FailedStep) { $FailedStep } else { $null })
|    if ($outcome -ne 'failed') {
|        $so = New-Object System.Collections.Generic.List[string]
|        foreach ($s in @($StepsOk)) {
|            $id = ([string]$s).Trim().ToLowerInvariant()
|            if ($id -cmatch '^[a-z][a-z0-9\-]{0,31}$' -and -not $so.Contains($id) -and $so.Count -lt 50) { $so.Add($id) }
|        }
|        if ($so.Count) { $r.StepsOk = [string[]]$so.ToArray() }
|    }
|    $r.ErrorClass = $cls
|    $r.Counts = [pscustomobject]$c
|    if (-not $Anonymous) {
|        $txt = ''
|        if ($outcome -ne 'ok') {
|            $raw = if ($ErrorMessage) { $ErrorMessage } elseif ($null -ne $ErrorRecord) { Get-SIKqlErrorSummary -ErrorRecord $ErrorRecord } else { '' }
|            $txt = ConvertTo-SITelemetryErrorText $raw
|        }
|        $r.ErrorText = $txt
|    }
|    $r.Ok = ($outcome -eq 'ok')
|    $r.LastSeenUtc = $last
|    [pscustomobject]$r
|}
|
|# the closed ErrorClass list, from the classifier (one definition)
|function Get-SITelemetryErrorClassList {
|    <# The value of $script:SITelemetry_ErrorClasses, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SITelemetry_ErrorClasses) { $script:SITelemetry_ErrorClasses = @(Get-SIErrorClasses) }
|    , $script:SITelemetry_ErrorClasses
|}
|$script:SITelemetry_ErrorClasses = $null; $null = Get-SITelemetryErrorClassList
'@ }
$__siSupportFiles['engine/_shared/AitUplink.ps1'] = @{ Sha256 = 'e4ed93e29a6a372bf0aeb40de94afea418506c79691d0135b55fe40193aad4d4'; Text = @'
|#Requires -Version 5.1
|<#
|.SYNOPSIS
|    §8 -- the uplink client. Turns a sync outcome into a record, and decides when to retry.
|
|.DESCRIPTION
|    **This is the gate.** RING-1: "the uplink must exist before the FIRST real customer is
|    assigned." Until it does, "nothing happened" and "nothing needed to happen" are
|    indistinguishable, which is why no real customer is on a ring today.
|
|    🔒 THE API IS THE ONLY TRANSPORT (operator, 2026-09-08: "drop email"). Each customer sends
|    its state up; nothing is ever sent down. §8 had named email a secondary channel and that is
|    now dropped rather than left half-built -- a transport nobody maintains is a transport
|    nobody trusts, and two half-wired paths would make "did it report?" ambiguous.
|
|    🔒 AND EMAIL COULD NEVER HAVE BEEN THE MECHANISM ANYWAY. A customer whose sync never ran
|    sends no mail, so absence of failure mail is indistinguishable from health -- the same
|    defect as `[sync] done` printed after doing nothing, `built=True deployed=False`, and
|    RING-8's green board. Only a stored record carrying a LAST-SEEN timestamp makes silence
|    visible, and that lives in the API's store (uplink.vSilentTargets).
|
|    🔒 WHY NOT A STORAGE ACCOUNT (operator decision, 2026-08-08). Granting ~30 customer SPNs
|    write access to a storage account is an inbound data-plane grant from every customer into
|    the operator tenant; one compromised customer would own the whole fleet store. The chosen
|    transport is an Entra-authenticated, append-only API that fronts SQL and exposes no reads.
|
|    🔒 IDENTITY COMES FROM THE TOKEN, NEVER THE BODY. New-AitUplinkRecord stamps TenantId for
|    the LOCAL record and the email path only. The server must establish the writer from the
|    access token and ignore the field entirely -- otherwise any authenticated customer could
|    write another customer's row by editing one JSON value. The field is named
|    ClaimedTenantId to make that impossible to forget at the API end.
|
|    🔒 INERT BY CONSTRUCTION. With no endpoint configured, Send-AitUplink returns 'disabled'
|    and performs no network call. sync/ auto-deploys from main to ~30 customers with no review
|    step, so this ships doing nothing until an operator configures a target.
|#>
|
|Set-StrictMode -Off
|
|<#
|.SYNOPSIS
|    PURE. Build the §8 uplink record from a sync plan. No disk, no network, no clock of its own.
|
|.DESCRIPTION
|    §8 fixes the payload: Action, Ring, Version, Run/Held/Blocked/Refused, a last-seen
|    timestamp, and the FULL error message (open item 4 -- "yes, the full error message"),
|    which is what makes the uplink actionable rather than merely a status board.
|
|    🔑 IT MUST REPORT CAPABILITIES, NOT JUST VERSIONS. Otherwise "held by policy" and "failed
|    to apply" are identical, which is precisely the ambiguity ring gating introduces. That is
|    also why Held / Blocked / Refused travel separately rather than collapsed into one list:
|    a stalled rollout and a healthy customer opt-out must never look the same.
|
|.PARAMETER Plan
|    A Get-AitSyncPlan result. Its shape is the contract: Solution, Action, Ring, Version,
|    Capabilities{Run,Held,Blocked,Refused}, Reason.
|
|.PARAMETER ErrorText
|    The FULL error, verbatim. Truncating it here would recreate the problem the uplink exists
|    to solve -- a status without a cause.
|#>
|function New-AitUplinkRecord {
|    [CmdletBinding()]
|    param(
|        [Parameter()][AllowNull()][object]$Plan,
|        [Parameter()][AllowNull()][string]$TenantId,
|        [Parameter()][AllowNull()][string]$Solution,
|        [Parameter()][AllowNull()][string]$DeployedVersion,
|        [Parameter()][AllowNull()][string]$ErrorText,
|        [Parameter()][AllowNull()][object]$Now,
|        # 🪤 NOT $Host. That is a read-only automatic variable: a parameter named $Host PARSES
|        # CLEAN on 5.1 and 7, then fails at BIND time with "Cannot overwrite variable Host",
|        # and every field of the record comes back empty. Found by running it, 2026-09-08 --
|        # a parse check would have shipped it.
|        [Parameter()][AllowNull()][string]$HostName
|    )
|
|    $ts = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { (Get-Date).ToUniversalTime() }
|    $caps = if ($Plan) { $Plan.Capabilities } else { $null }
|
|    # 🪤 PLAIN ASSIGNMENTS, NOT AN INLINE `(if ...)` IN ARGUMENT POSITION. `& $f (if ($x) {…})`
|    # PARSES CLEAN and then fails at runtime with "The term 'if' is not recognized as a name of
|    # a cmdlet" -- because in argument position `if` is read as a COMMAND, not an expression.
|    # Every field silently came back empty. This is RING-7's landmine 2 in a new costume, and
|    # its own lesson is exactly this: prefer plain assignments before the call.
|    # (`Key = if (...) {...}` inside the hashtable below IS valid -- that is assignment
|    # position, not argument position. The distinction is the whole trap.)
|    $runCaps = @(); $heldCaps = @(); $blockedCaps = @(); $refusedCaps = @()
|    if ($caps) {
|        if ($caps.Run)     { $runCaps     = @($caps.Run     | Where-Object { $_ }) }
|        if ($caps.Held)    { $heldCaps    = @($caps.Held    | Where-Object { $_ }) }
|        if ($caps.Blocked) { $blockedCaps = @($caps.Blocked | Where-Object { $_ }) }
|        if ($caps.Refused) { $refusedCaps = @($caps.Refused | Where-Object { $_ }) }
|    }
|
|    return [pscustomobject]@{
|        Schema          = 1
|        # Named ClaimedTenantId on purpose: the API MUST take identity from the token and
|        # ignore this. See the header. Kept because the local record and the email path have
|        # no token to read.
|        ClaimedTenantId = "$TenantId"
|        Solution        = if ($Solution) { "$Solution" } elseif ($Plan) { "$($Plan.Solution)" } else { '' }
|        Action          = if ($Plan) { "$($Plan.Action)" } else { 'unknown' }
|        Ring            = if ($Plan -and $null -ne $Plan.Ring) { [int]$Plan.Ring } else { $null }
|        Version         = if ($Plan) { "$($Plan.Version)" } else { '' }
|        DeployedVersion = "$DeployedVersion"
|        Run             = $runCaps
|        Held            = $heldCaps
|        Blocked         = $blockedCaps
|        Refused         = $refusedCaps
|        Reason          = if ($Plan) { "$($Plan.Reason)" } else { '' }
|        ErrorText       = "$ErrorText"
|        Ok              = (-not "$ErrorText".Trim())
|        Host            = if ("$HostName".Trim()) { "$HostName" } else { "$env:COMPUTERNAME" }
|        LastSeenUtc     = $ts.ToString('yyyy-MM-ddTHH:mm:ssZ')
|    }
|}
|
|<#
|.SYNOPSIS
|    PURE. Should this target retry, and should somebody be told?
|
|.DESCRIPTION
|    §8: "Retry policy is part of observability." _SyncDeploy.ps1 already does not advance its
|    marker on a failed deploy, so the next cycle retries -- a good pattern. What is MISSING is
|    a ceiling and backoff: without them a permanently broken deploy retries nightly forever
|    and nobody is told, which is the same silence failure wearing different clothes.
|
|    🔑 EXHAUSTING THE CEILING IS AN ALERTABLE EVENT, not a quiet stop. A retry loop that gives
|    up silently is strictly worse than one that never stops, because it also stops producing
|    the failures somebody might have noticed.
|
|.OUTPUTS
|    Retry   -- try again on the next cycle
|    Backoff -- skip this cycle; DelayCycles says how many to wait
|    Alert   -- ceiling exhausted. Stop retrying AND tell a human.
|#>
|function Get-AitUplinkRetryDecision {
|    [CmdletBinding()]
|    param(
|        [Parameter()][int]$ConsecutiveFailures = 0,
|        [Parameter()][int]$Ceiling = 5
|    )
|
|    if ($ConsecutiveFailures -le 0) {
|        return [pscustomobject]@{ Action = 'Retry'; DelayCycles = 0; Alert = $false; Reason = 'no failures recorded' }
|    }
|    if ($ConsecutiveFailures -ge $Ceiling) {
|        return [pscustomobject]@{
|            Action = 'Alert'; DelayCycles = 0; Alert = $true
|            Reason = "retry ceiling reached ($ConsecutiveFailures of $Ceiling consecutive failures) -- stopping automatic retries and raising this, because a loop that gives up QUIETLY also stops producing the failures somebody might notice"
|        }
|    }
|    # Exponential: 1,2,4,8... cycles. CAPPED, because [Math]::Pow(2, 98) overflows the [int]
|    # cast and throws -- turning a retry-policy helper into the thing that breaks the sync.
|    # Unreachable while the ceiling check above stands; capped anyway, because a guard that
|    # only holds while a DIFFERENT guard holds is not a guard.
|    $exp = [Math]::Min([double]($ConsecutiveFailures - 1), 16.0)
|    $delay = [Math]::Pow(2, $exp)
|    return [pscustomobject]@{
|        Action = 'Backoff'; DelayCycles = [int]$delay; Alert = $false
|        Reason = "failure $ConsecutiveFailures of $Ceiling -- backing off $([int]$delay) cycle(s) before the next attempt"
|    }
|}
|
|<#
|.SYNOPSIS
|    Send a record to the uplink API. INERT unless an endpoint is configured.
|
|.DESCRIPTION
|    🔒 NO ENDPOINT => NO NETWORK CALL, and the result says 'disabled' rather than 'ok'. This
|    file ships to ~30 customers from main with no review step, so the resting state must be
|    provably nothing, and a disabled uplink must never be mistaken for a healthy one.
|
|    🔒 A FAILED UPLINK MUST NEVER FAIL THE SYNC. Observability that can break the thing it
|    observes is worse than none: a customer would stop updating because telemetry was down.
|    Every transport failure returns a result and is reported by the caller; nothing throws.
|
|.PARAMETER Endpoint
|    HTTPS URL of the append-only API. Absent => disabled.
|
|.PARAMETER AccessToken
|    Entra token for the SPN the customer already holds. The server derives identity from the
|    token and ignores the body's ClaimedTenantId.
|
|.PARAMETER AccessCode
|    Shared access code (operator decision, 2026-09-08). Chosen over per-tenant Entra consent
|    because this is telemetry: append-only, no read surface, nothing to steal or escalate, and
|    ~30 admin consents is real cost against a threat that does not exist here.
|
|    🔑 THE CONSEQUENCE, AND IT IS UNAVOIDABLE RATHER THAN AN OVERSIGHT: a shared code proves
|    that SOME customer is calling, never WHICH. So with a code the tenant necessarily comes
|    from the BODY, and the server records `WriterSource = 'shared-code'` on the row to say so.
|    Rows are then honest about their own provenance instead of implying a proof that was not
|    performed -- and if per-customer credentials arrive later, the old rows still say what they
|    were.
|
|    🪤 The realistic failure this leaves open is NOT forgery, it is a CLONED CONFIG: a VM imaged
|    from another customer's reports as that customer, and with one shared code every caller
|    looks identical. `HostName` is on every record precisely so two hosts under one identity are
|    still visible.
|
|    Exactly one of -AccessToken / -AccessCode is used; the token wins if both are supplied,
|    because a proven identity should never be silently downgraded to an asserted one.
|#>
|function Send-AitUplink {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][object]$Record,
|        [Parameter()][AllowNull()][string]$Endpoint,
|        [Parameter()][AllowNull()][string]$AccessToken,
|        [Parameter()][AllowNull()][string]$AccessCode,
|        [Parameter()][int]$TimeoutSec = 20
|    )
|
|    if (-not "$Endpoint".Trim()) {
|        return [pscustomobject]@{ Status = 'disabled'; Reason = 'no uplink endpoint configured -- nothing was sent (this is the shipped resting state)'; Sent = $false }
|    }
|    if ("$Endpoint" -notmatch '^https://') {
|        # Still refused with a shared code -- arguably MORE so. A bearer code in a plaintext
|        # request is readable by anything on the path, and unlike a token it does not expire.
|        return [pscustomobject]@{ Status = 'refused'; Reason = "uplink endpoint must be https -- refusing to post run data over '$Endpoint'"; Sent = $false }
|    }
|    if (-not "$AccessToken".Trim() -and -not "$AccessCode".Trim()) {
|        return [pscustomobject]@{ Status = 'refused'; Reason = 'no access token and no access code -- there is deliberately no anonymous path'; Sent = $false }
|    }
|
|    try {
|        $body = $Record | ConvertTo-Json -Depth 6 -Compress
|        # Token WINS when both are present: a proven identity must never be silently downgraded
|        # to an asserted one just because a code happens to be configured alongside it.
|        $headers = if ("$AccessToken".Trim()) { @{ Authorization = "Bearer $AccessToken"; 'Content-Type' = 'application/json' } }
|                   else                       { @{ 'X-Ait-Uplink-Code' = $AccessCode;     'Content-Type' = 'application/json' } }
|        $null = Invoke-RestMethod -Uri $Endpoint -Method Post -Headers $headers -Body $body -TimeoutSec $TimeoutSec -UseBasicParsing -ErrorAction Stop
|        return [pscustomobject]@{ Status = 'ok'; Reason = 'uplink accepted'; Sent = $true }
|    } catch {
|        # Never rethrow: see the header. The sync must survive a broken uplink.
|        return [pscustomobject]@{ Status = 'failed'; Reason = "uplink POST failed: $($_.Exception.Message)"; Sent = $false }
|    }
|}
|
|# =====================================================================================================
|# SCHEMA 2 -- product heartbeat + run reports (Invardia-hosted uplink, owner decisions 2026-10-03;
|# Invardia docs/design/TELEMETRY-UPLINK.md section 7, framework DOCS/REQUIREMENTS.md section 8.4).
|#
|# ADDITIVE ONLY. The sync engine does not call anything below; a PRODUCT (PIM, SI) calls it from its own
|# jobs behind its own switch. Nothing here reads config, touches disk or the network except
|# Send-AitUplink, which is unchanged and still refuses without an https endpoint + a credential.
|#
|# Two senders, one endpoint (POST https://invardia.com/api/uplink/v1/report, header X-Ait-Uplink-Code):
|#   anonymous   -- the PUBLIC community code; the record carries NO ClaimedTenantId, NO Host, NO ErrorText,
|#                  only an ErrorClass and BUCKETED counts, plus a random InstallId the product keeps.
|#                  Data that is never sent cannot leak: the server drops these fields too, but we do not
|#                  rely on that.
|#   identified  -- a per-install key Invardia issued (Pro / trial). The KEY proves the environment; the
|#                  body's ClaimedTenantId is only compared for mismatch. ErrorText is shortened + redacted
|#                  here as well as on the server.
|# The server refuses unknown fields and checks closed value lists, so the lists below mirror Invardia's
|# packages/core/src/uplink.ts exactly; a value outside them is dropped here rather than failing the POST.
|# =====================================================================================================
|
|$script:AitUplinkCommunityCode   = 'invardia-community-telemetry-v1'   # public by design: "a Community install", nothing more
|$script:AitUplinkInvardiaEndpoint = 'https://invardia.com/api/uplink/v1/report'
|$script:AitUplinkKinds     = @('heartbeat', 'run', 'install')
|$script:AitUplinkOutcomes  = @('ok', 'warning', 'failed')
|$script:AitUplinkEditions  = @('community', 'pro', 'trial')
|$script:AitUplinkHosting   = @('container', 'vm', 'arc')
|$script:AitUplinkRuntime   = @('mi-container', 'mi-vm', 'mi-arc', 'spn-certificate', 'spn-secret')
|$script:AitUplinkLicence   = @('valid', 'grace', 'expired', 'none')
|
|function ConvertTo-AitUplinkRedacted {
|    <# PURE. Removes secrets from free text before it can leave the install (same rules as Invardia's redact()). #>
|    [CmdletBinding()]
|    param([AllowNull()][string]$Text)
|    $t = "$Text"
|    if (-not $t) { return '' }
|    $t = [regex]::Replace($t, 'eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*', '[jwt]')
|    $t = [regex]::Replace($t, '(?i)\b(Bearer)\s+[A-Za-z0-9._~+/=-]{10,}', '$1 [redacted]')
|    $t = [regex]::Replace($t, '(?i)\b(client_secret|password|pwd|secret|apikey|api_key|accountkey|sharedaccesskey)\s*[=:]\s*("[^"]*"|''[^'']*''|[^\s;&,]+)', '$1=[redacted]')
|    $t = [regex]::Replace($t, '(?i)([?&](sig|se|sv|sp|skoid|sktid)=)[^&\s]+', '$1[redacted]')
|    $t = [regex]::Replace($t, '-----BEGIN [A-Z ]+-----[\s\S]*?-----END [A-Z ]+-----', '[pem]')
|    # An X-Ait-Uplink-Code / install key that ends up in an error message (e.g. a proxy echoing headers).
|    $t = [regex]::Replace($t, 'inv-[A-Za-z0-9_-]{20,}', '[install-key]')
|    return $t
|}
|
|function Get-AitUplinkCountBucket {
|    <# PURE. Anonymous mode never sends an exact count: 0, 1-100, 100-1k, 1k-10k, 10k-100k, 100k+. #>
|    param([double]$Count)
|    if ($Count -le 0) { return '0' }
|    if ($Count -le 100) { return '1-100' }
|    if ($Count -le 1000) { return '100-1k' }
|    if ($Count -le 10000) { return '1k-10k' }
|    if ($Count -le 100000) { return '10k-100k' }
|    return '100k+'
|}
|
|function New-AitUplinkReport {
|    <#
|    .SYNOPSIS
|        PURE. Build a Schema 2 record (Kind heartbeat | run | install) for -Mode anonymous | identified.
|    .DESCRIPTION
|        Only fields with a value are emitted (the server refuses unknown fields and checks enums; an empty
|        string where an enum is expected would be refused). An enum value outside the closed list is
|        DROPPED, never sent. Job / FailedStep are normalised to the server's id shape (lower-case,
|        [a-z0-9.-], 60 chars). ErrorClass is lower-cased (PIM's failure codes are upper-case).
|        Anonymous: ClaimedTenantId, Host and ErrorText are never put in the record, counts are bucketed,
|        and an InstallId (GUID) is REQUIRED -- without one the result is $null and nothing should be sent.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][ValidateSet('heartbeat', 'run', 'install')][string]$Kind,
|        [Parameter(Mandatory)][ValidateSet('anonymous', 'identified')][string]$Mode,
|        [Parameter(Mandatory)][string]$Product,
|        [AllowNull()][string]$Version,
|        [AllowNull()][object]$Ring,
|        [AllowNull()][string]$Edition,
|        [AllowNull()][string]$Hosting,
|        [AllowNull()][string]$RuntimeIdentity,
|        [AllowNull()][string]$LicenceState,
|        [AllowNull()][string]$Job,
|        [AllowNull()][string]$Outcome,
|        [AllowNull()][object]$DurationMs,
|        [AllowNull()][string]$FailedStep,
|        [AllowNull()][string]$ErrorClass,
|        [AllowNull()][string]$ErrorText,
|        [AllowNull()][hashtable]$Counts,
|        [AllowNull()][string]$InstallId,
|        [AllowNull()][string]$TenantId,
|        [AllowNull()][string]$HostName,
|        [AllowNull()][object]$Now
|    )
|    $anon = ($Mode -eq 'anonymous')
|    $iid = "$InstallId".Trim().ToLowerInvariant()
|    if ($anon -and $iid -notmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$') { return $null }
|    $ts = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { (Get-Date).ToUniversalTime() }
|    $idOf = { param($v) $s = ("$v".Trim().ToLowerInvariant() -replace '[^a-z0-9.-]', '-') -replace '^[^a-z0-9]+', ''; if ($s.Length -gt 60) { $s = $s.Substring(0, 60) }; $s }
|    $o = [ordered]@{ Schema = 2; Kind = $Kind; Product = "$Product".Trim().ToLowerInvariant() }
|    $ver = "$Version".Trim(); if ($ver -match '^[0-9A-Za-z.+-]{1,50}$') { $o['Version'] = $ver }
|    $rp = 0; if ($null -ne $Ring -and "$Ring" -ne '' -and [int]::TryParse("$Ring", [ref]$rp) -and $rp -ge 0 -and $rp -le 10) { $o['Ring'] = $rp }
|    foreach ($pair in @(@('Edition', $Edition, $script:AitUplinkEditions), @('Hosting', $Hosting, $script:AitUplinkHosting),
|                        @('RuntimeIdentity', $RuntimeIdentity, $script:AitUplinkRuntime), @('LicenceState', $LicenceState, $script:AitUplinkLicence),
|                        @('Outcome', $Outcome, $script:AitUplinkOutcomes))) {
|        $v = "$($pair[1])".Trim().ToLowerInvariant()
|        if ($v -and ($pair[2] -contains $v)) { $o[$pair[0]] = $v }
|    }
|    $j = & $idOf $Job; if ($j) { $o['Job'] = $j }
|    $fs = & $idOf $FailedStep; if ($fs) { $o['FailedStep'] = $fs }
|    $ec = ("$ErrorClass".Trim().ToLowerInvariant() -replace '[^a-z0-9-]', '-'); if ($ec.Length -gt 40) { $ec = $ec.Substring(0, 40) }; if ($ec) { $o['ErrorClass'] = $ec }
|    $d = [int64]0; if ($null -ne $DurationMs -and [int64]::TryParse("$DurationMs", [ref]$d) -and $d -ge 0) { $o['DurationMs'] = [int][Math]::Min($d, [int64]2147483646) }
|    if ($Counts -and $Counts.Count) {
|        $c = [ordered]@{}
|        foreach ($k in @($Counts.Keys | Sort-Object | Select-Object -First 40)) {   # 40 keys: agreed by SI + PIM + Invardia, owner yes 2026-10-13 (Invardia accepts 40 since 1.0.413)
|            if ("$k" -notmatch '^[a-z][A-Za-z0-9]{0,30}$') { continue }
|            $n = 0.0; if (-not [double]::TryParse("$($Counts[$k])", [ref]$n) -or $n -lt 0) { continue }
|            $c["$k"] = if ($anon) { Get-AitUplinkCountBucket -Count $n } else { [int64][Math]::Floor($n) }
|        }
|        if ($c.Count) { $o['Counts'] = [pscustomobject]$c }
|    }
|    if ($anon) {
|        $o['InstallId'] = $iid
|    } else {
|        if ("$TenantId".Trim()) { $o['ClaimedTenantId'] = "$TenantId".Trim() }
|        $h = if ("$HostName".Trim()) { "$HostName".Trim() } else { "$env:COMPUTERNAME" }
|        if ($h) { $o['Host'] = $(if ($h.Length -gt 100) { $h.Substring(0, 100) } else { $h }) }
|        $et = ConvertTo-AitUplinkRedacted -Text "$ErrorText".Trim()
|        if ($et) { $o['ErrorText'] = $(if ($et.Length -gt 8000) { $et.Substring(0, 8000) } else { $et }) }
|    }
|    $o['LastSeenUtc'] = $ts.ToString('yyyy-MM-ddTHH:mm:ssZ')
|    return [pscustomobject]$o
|}
|
|function Resolve-AitUplinkSender {
|    <#
|    .SYNOPSIS
|        PURE. Which credential + mode this install sends with, or 'disabled'.
|    .DESCRIPTION
|        -Enabled $false (the product's opt-out)  -> disabled; nothing is sent.
|        an install key (Pro / trial, issued by Invardia) -> identified, the key in X-Ait-Uplink-Code.
|        no key                                    -> anonymous with the public community code -- also for a Pro
|                                                     install that has no key yet: it then reports like a
|                                                     Community install (no tenant, no host, no text) rather
|                                                     than inventing an identity it cannot prove.
|        -Endpoint overrides Invardia's (a private estate); it must still be https (Send-AitUplink refuses
|        anything else).
|    #>
|    param([bool]$Enabled, [AllowNull()][string]$InstallKey, [AllowNull()][string]$Endpoint)
|    if (-not $Enabled) { return [pscustomobject]@{ Mode = 'disabled'; Endpoint = ''; AccessCode = ''; Reason = 'telemetry is switched off' } }
|    $ep = if ("$Endpoint".Trim()) { "$Endpoint".Trim() } else { $script:AitUplinkInvardiaEndpoint }
|    $key = "$InstallKey".Trim()
|    if ($key) { return [pscustomobject]@{ Mode = 'identified'; Endpoint = $ep; AccessCode = $key; Reason = 'install key' } }
|    return [pscustomobject]@{ Mode = 'anonymous'; Endpoint = $ep; AccessCode = $script:AitUplinkCommunityCode; Reason = 'no install key -- anonymous (community code)' }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-TelemetryCounts.ps1'] = @{ Sha256 = 'cbf2d2c4d9a1933ab15ad1518dbcb07695db8826c75e34a74c12d3448a61b935'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- the TENANT COUNTS on the daily heartbeat (#424, owner 2026-10-07: "we need a counter in the telemetry
|    by tenant from both pro, users for stat purpose"). Invardia stores Counts per environment (= per tenant); PIM sends
|    the same three keys with the same definitions, so the two products can be added up and compared.
|
|    THE DEFINITIONS (identical in PIM -- change them in both products or in neither; the one exception is users' AD part):
|      users    ENABLED MEMBER users, CLOUD AND ON-PREM AD (owner 2026-10-10: "users include both cloud and ad local",
|               "from exposuregraph"), each real person once:
|                 Entra part   Entra user objects with accountEnabled = true AND userType = Member (cloud-only AND
|                              AD-synced users -- a synced user is one Entra object);
|                 + AD part    AD-ONLY enabled user accounts from the Exposure Graph: 'user' nodes with rawData
|                              primaryProvider = ActiveDirectory AND identityType = User (AD service accounts and
|                              computers are NOT users) AND enabled (rawData accountEnabled, else isEnabled -- the two
|                              names SI's EG mapping reads for si_account_enabled -- else isActive when EG carries
|                              neither), whose adSid is NOT the OnPremSid of ANY Entra user in the latest identity
|                              collection (a synced user is already in the Entra part and counts once).
|               The AD part runs through Advanced Hunting (Invoke-SIHuntingQueryRest, the run's Graph token). When it
|               cannot be read (no permission, no Defender, an error, a truncated answer) users = the Entra part only and
|               the run log says so once, plainly -- never a guessed number, never 0 for the AD part. No Entra part = no
|               users key at all (the AD part is never sent alone). PIM's users is Entra-only; SI's adds AD-only accounts
|               because SI sees AD through the Exposure Graph.
|      guests   GUEST users: Entra user objects with userType = Guest, ENABLED OR NOT (a disabled guest is still a guest
|               object in the tenant; the stat is "how many guests does this tenant carry").
|      devices  the 7-DAY MAXIMUM of the daily count of unique CORRELATED devices: endpoints and servers (Defender machines
|               and Entra devices), ONE per real machine however many sources see it (the correlation object id, so a
|               machine seen by Defender and by Entra counts once). IoT and network devices are not devices here. Per UTC
|               day the latest correlation run of that day is counted; the heartbeat carries the highest of the last 7
|               days. This is also the unit of the future Pro Business device cap -- Get-SIDeviceCount is the one place
|               it is computed.
|
|    WHERE THE NUMBERS COME FROM: only what SecurityInsight already reads -- no new permission.
|      users / guests  the latest collection in SI_Identity_Profile_CL (AccountEnabled, UserType, IdentityType = User,
|                      OnPremSid); users' AD part from ExposureGraphNodes over Advanced Hunting -- the same read the
|                      identity engine's Exposure Graph discovery already makes with the same Graph identity
|      devices         SI_ObjectMap_CL (the correlation map: SI_CorrelationId per endpoint member), with the device
|                      category from SI_Endpoint_Profile_CL
|
|    A COUNT THAT CANNOT BE COMPUTED IS OMITTED, never sent as 0 by guess: no table, no rows, a failed query, no UserType
|    column filled at all, no correlation run in the last 7 days -- each leaves its key out.
|
|    PRO ONLY: Send-SITelemetryRunEnd asks for these counts only for an IDENTIFIED heartbeat (a Pro / trial install with
|    its install key). Community and an anonymous Pro install send nothing new. Telemetry switched off computes nothing.
|
|    PS 5.1 and 7. Never throws to its caller.
|#>
|
|function Get-SITelemetryCountNamesState {
|    <# The value of $script:SITelemetryCountNames, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SITelemetryCountNames) { $script:SITelemetryCountNames = @('users', 'guests', 'devices', 'sqlUsedMb', 'sqlMaxMb', 'servicePrincipals', 'azureResources', 'servers', 'clientDevices',
|    # #719 (owner 2026-10-16 via Invardia: "add relevant. i want data") -- the Risk Analysis result and the CI estate, from the
|    # Pro database (Get-SIRaTelemetryCounts; each key's definition in data-model/telemetry-counts.locked.json)
|    'raReportsTotal', 'raReportsComplete', 'raRowsDetailed', 'cveDevicePairs', 'cveDevices', 'cves', 'cvesCritical', 'cvesHigh',
|    # owner 2026-10-16 ("Yes, change the report"): the distinct CVE ids with a known exploit, from the CVE Summary rows
|    'cvesExploited',
|    'recommendations', 'recommendationDevicePairs', 'eosSoftwareDevices', 'azureRecommendations', 'attackPaths', 'usersWithoutMfa',
|    'staleUsers180d', 'privilegedPermanent', 'guestsPrivileged', 'spnsExpiringCredentials', 'cis', 'cisTier0',
|    # owner 2026-10-16 ("Add, permission REQUIRED"): Microsoft Secure Score and the Defender exposure score (Get-SISecurityScoreCounts)
|    'secureScore', 'secureScoreMax', 'exposureScore',
|    # owner 2026-10-13 ("si must send objects for each of the security domains"; Invardia's adoption dashboard): the current
|    # CIs per security domain and the close-loop's real remediations -- same read (Get-SIRaTelemetryCountSql)
|    'domainEndpoint', 'domainIdentity', 'domainAzure', 'domainPublicIp', 'fixedLast30Days') }
|    , $script:SITelemetryCountNames
|}
|$script:SITelemetryCountNames = $null; $null = Get-SITelemetryCountNamesState
|
|# #719: Invardia refuses the WHOLE record above 40 Counts keys; SI stays at or under 38 (two spare), every value a whole number
|# >= 0. The framework client (AitUplink.ps1, byte-identical to sync/) keeps the first 40 keys by name (it kept 10 before
|# main's 2026-10-13 copy) -- SI still shapes the heartbeat's Counts itself, by priority, at most 38
|# (ConvertTo-SITelemetryCountsWire, called by ConvertTo-SITelemetryWire) -- the safe path.
|function Get-SITelemetryCountMaxKeysState {
|    <# The value of $script:SITelemetryCountMaxKeys, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SITelemetryCountMaxKeys) { $script:SITelemetryCountMaxKeys = 38 }
|    , $script:SITelemetryCountMaxKeys
|}
|$script:SITelemetryCountMaxKeys = $null; $null = Get-SITelemetryCountMaxKeysState
|
|<#
|    THE ASSET INVENTORY (owner 2026-10-10, via Invardia: "updated numbers both total and per customer and per tenant of
|    users, spns, azure objects, servers, client devices"), each from the LATEST collection of its profile table:
|      servicePrincipals  service principals + managed identities (SI_Identity_Profile_CL, IdentityType)
|      azureResources     distinct Azure resources in the scopes SI covers (SI_Azure_Profile_CL, AzureResourceId)
|      servers            endpoints whose DeviceType is Server or whose OS is a server OS (SI_Endpoint_Profile_CL)
|      clientDevices      workstations / mobile devices (DeviceType or a client OS); IoT, network devices and unknown
|                         devices are neither
|    The OS is the profile's column OsPlatform (the name the endpoint profile writes; column names are case-sensitive in
|    KQL), OSPlatform only as a fallback: reading only 'OSPlatform' made the OS fallback dead, so an endpoint collection
|    whose rows carried no DeviceType counted 0 servers and 0 clients (a large school 2026-10-18 / 10-19: "servers fell to
|    0", "client devices fell to 0" while 1,977 devices were profiled).
|    A table with no collection in the last 8 days leaves its keys OUT (never a guessed 0).
|#>
|function Get-SIInventoryCountQuery {
|    # #712 (Invardia watcher 2026-10-16, customer C: clientDevices 26 -> 618, servers 0 -> 23 between two heartbeats
|    # while the collection itself was identical): the NEWEST collection was counted while Log Analytics was still taking it
|    # in (rows arrive over 10-20 minutes). Only a collection whose rows stopped arriving 30 minutes ago is counted; a newer
|    # one still arriving waits for the next heartbeat, the one before it is counted meanwhile.
|    # A collection IN PARTS publishes part by part under one collection time, its parts' rows minutes or hours apart: a
|    # quiet half hour between two parts is not its end. So where the install's database says when each source last
|    # collected COMPLETELY (sidata.SourceState, Get-SICountCompleteBy), a newer collection is never counted.
|    param([System.Collections.IDictionary]$CompleteBy = (Get-SICountCompleteByState))
|    $q = @'
|let idt = SI_Identity_Profile_CL | where TimeGenerated > ago(8d);
|let idl = toscalar(idt{{IDB}} | summarize _in = max(ingestion_time()) by CollectionTime | where _in < ago(30m) | summarize max(CollectionTime));
|let azt = SI_Azure_Profile_CL | where TimeGenerated > ago(8d);
|let azl = toscalar(azt{{AZB}} | summarize _in = max(ingestion_time()) by CollectionTime | where _in < ago(30m) | summarize max(CollectionTime));
|let ept = SI_Endpoint_Profile_CL | where TimeGenerated > ago(8d);
|let epl = toscalar(ept{{EPB}} | summarize _in = max(ingestion_time()) by CollectionTime | where _in < ago(30m) | summarize max(CollectionTime));
|union isfuzzy=true
| (idt | where CollectionTime == idl | extend _id = tostring(column_ifexists("SI_AssetId", "")), _t = tostring(column_ifexists("IdentityType", ""))
|      | where isnotempty(_id) | summarize Spns = dcountif(_id, _t in~ ("ServicePrincipal", "ManagedIdentity")), IdRows = count()),
| (azt | where CollectionTime == azl | extend _r = tolower(tostring(column_ifexists("AzureResourceId", "")))
|      | summarize Azure = dcountif(_r, isnotempty(_r)), AzRows = count()),
| (ept | where CollectionTime == epl | extend _a = tostring(column_ifexists("SI_AssetId", "")), _c = tolower(tostring(column_ifexists("DeviceCategory", ""))),
|        _d = tolower(tostring(column_ifexists("DeviceType", ""))), _o = tolower(coalesce(tostring(column_ifexists("OsPlatform", "")), tostring(column_ifexists("OSPlatform", ""))))
|      | where isnotempty(_a) | summarize arg_max(CollectionTime, _c, _d, _o) by _a
|      | extend _srv = (_d == "server" or _o contains "server")
|      | extend _cli = (not(_srv) and not(_c in ("iot", "networkdevice")) and (_d in ("workstation", "mobile", "tablet", "smartphone") or _o matches regex @"^(windows(10|11)?|macos.*|ios|ipados|android)$"))
|      | summarize Servers = countif(_srv), Clients = countif(_cli), EpRows = count())
|| summarize Spns = max(Spns), IdRows = max(IdRows), Azure = max(Azure), AzRows = max(AzRows), Servers = max(Servers), Clients = max(Clients), EpRows = max(EpRows)
|'@
|    $q.Replace('{{IDB}}', (Get-SICountCompleteFilter -Source identity -CompleteBy $CompleteBy)).Replace('{{AZB}}', (Get-SICountCompleteFilter -Source azure -CompleteBy $CompleteBy)).Replace('{{EPB}}', (Get-SICountCompleteFilter -Source endpoint -CompleteBy $CompleteBy))
|}
|
|# source -> when it last collected completely, for the counts of ONE heartbeat (Get-SITelemetryHeartbeatCounts sets it)
|function Get-SICountCompleteByState {
|    <# The value of $script:SICountCompleteBy, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SICountCompleteBy) { $script:SICountCompleteBy = @{} }
|    , $script:SICountCompleteBy
|}
|$script:SICountCompleteBy = $null; $null = Get-SICountCompleteByState
|
|function Get-SICountCompleteFilter {
|    <# PURE. The KQL filter that keeps a source's counts off a collection newer than its last COMPLETE one:
|       ' | where CollectionTime <= datetime(<last complete + 10 minutes>)' (the minutes absorb the difference between the
|       database's and Log Analytics' stamp of one collection; the next collection starts hours later). '' when not known.
|       A source the database knows but that has NEVER collected completely ('never', Get-SICountCompleteBy): no collection
|       of it is counted ('| where false') -- its keys are left out until its first complete collection, never a part's
|       number (a large install 2026-10-19: identity never ended well, so the heartbeat counted a part -- 6,827 users,
|       115 service principals -- for two days, then the real 107,441 / 1,604 arrived as a "3x jump"). #>
|    param([Parameter(Mandatory)][string]$Source, [System.Collections.IDictionary]$CompleteBy)
|    if (-not $CompleteBy -or -not $CompleteBy.Contains($Source) -or $null -eq $CompleteBy[$Source]) { return '' }
|    if ($CompleteBy[$Source] -is [string] -and [string]$CompleteBy[$Source] -eq 'never') { return ' | where false' }
|    $t = $null; try { $t = ([datetime]$CompleteBy[$Source]).ToUniversalTime().AddMinutes(10) } catch { return '' }
|    ' | where todatetime(CollectionTime) <= datetime({0})' -f $t.ToString('yyyy-MM-ddTHH:mm:ss.fffZ', [Globalization.CultureInfo]::InvariantCulture)
|}
|
|function Get-SICountCompleteSql {
|    <# READS ONLY. When each collecting source last collected COMPLETELY (sidata.SourceState.LastGoodAt, written by the
|       pipeline when a collection -- every part of it -- ended well). No table = no rows. #>
|    "IF OBJECT_ID(N'sidata.SourceState') IS NULL SELECT CAST(NULL AS NVARCHAR(32)) AS Source, CAST(NULL AS DATETIME2(3)) AS LastGoodAt WHERE 1 = 0; ELSE SELECT Source, LastGoodAt FROM sidata.SourceState WHERE Source IN (N'identity', N'azure', N'endpoint');"
|}
|
|function Get-SICountCompleteBy {
|    <# source -> when it last collected completely (UTC), from Get-SICountCompleteSql through -SqlRows { param($Sql) rows }
|       (default Invoke-SITelemetrySqlRows). A source with a row but no LastGoodAt has never collected completely: 'never'
|       (Get-SICountCompleteFilter counts none of its collections). A source without a row is not known: absent (the
|       settled rule alone). Empty when it cannot be read: the counts then use the settled rule alone, as before. Never
|       throws. #>
|    param([scriptblock]$SqlRows)
|    $out = @{}
|    try {
|        if (-not $SqlRows) { $SqlRows = { param($Sql) Invoke-SITelemetrySqlRows -Sql $Sql } }
|        foreach ($r in @(& $SqlRows (Get-SICountCompleteSql))) {
|            if ($null -eq $r) { continue }
|            $src = ''; $at = $null
|            if ($r -is [System.Collections.IDictionary]) { $src = [string]$r['Source']; $at = $r['LastGoodAt'] } else { $src = [string]$r.Source; $at = $r.LastGoodAt }
|            $src = $src.Trim().ToLowerInvariant()
|            if (-not $src) { continue }
|            if ($null -eq $at -or $at -is [System.DBNull] -or "$at".Trim() -eq '') { $out[$src] = 'never'; continue }
|            $t = $null
|            if ($at -is [datetime]) { $t = [datetime]::SpecifyKind($at, [DateTimeKind]::Utc) }
|            else {
|                $p = [datetime]::MinValue
|                if ([datetime]::TryParse([string]$at, [Globalization.CultureInfo]::InvariantCulture, ([Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal), [ref]$p)) { $t = $p }
|            }
|            if ($null -ne $t) { $out[$src] = $t }
|        }
|    } catch { return @{} }
|    $out
|}
|
|function Get-SIInventoryCounts {
|    <# PURE. The inventory query's one row -> the keys whose table HAD a collection (its row count > 0). #>
|    param([AllowNull()]$Row)
|    $out = [ordered]@{}
|    if ($null -eq $Row) { return $out }
|    $has = { param($n) $v = ConvertTo-SITelemetryCount $Row.$n; $null -ne $v -and $v -gt 0 }
|    if (& $has 'IdRows') { $v = ConvertTo-SITelemetryCount $Row.Spns; if ($null -ne $v) { $out['servicePrincipals'] = $v } }
|    if (& $has 'AzRows') { $v = ConvertTo-SITelemetryCount $Row.Azure; if ($null -ne $v) { $out['azureResources'] = $v } }
|    if (& $has 'EpRows') {
|        $v = ConvertTo-SITelemetryCount $Row.Servers; if ($null -ne $v) { $out['servers'] = $v }
|        $v = ConvertTo-SITelemetryCount $Row.Clients; if ($null -ne $v) { $out['clientDevices'] = $v }
|    }
|    $out
|}
|
|function Get-SITelemetryHeartbeatCountNames { (Get-SITelemetryCountNamesState) }
|
|function Get-SITelemetryCountMaxKeys { (Get-SITelemetryCountMaxKeysState) }
|
|function ConvertTo-SITelemetryCountsWire {
|    <#
|        PURE. The heartbeat's Counts as they go on the wire (#719): only the agreed names, each key ^[a-z][A-Za-z0-9]{0,30}$,
|        each value a whole number >= 0 ([long]), at most 38 keys (the agreed order). $null when nothing is left.
|    #>
|    param([AllowNull()][System.Collections.IDictionary]$Counts)
|    if ($null -eq $Counts -or $Counts.Count -eq 0) { return $null }
|    $o = [ordered]@{}
|    foreach ($k in (Get-SITelemetryCountNamesState)) {
|        if ($o.Count -ge (Get-SITelemetryCountMaxKeysState)) { break }
|        if ($k -cnotmatch '^[a-z][A-Za-z0-9]{0,30}$' -or -not $Counts.Contains($k)) { continue }
|        $v = ConvertTo-SITelemetryCount $Counts[$k]
|        if ($null -ne $v) { $o[$k] = [long]$v }
|    }
|    if ($o.Count -eq 0) { return $null }
|    [pscustomobject]$o
|}
|
|<#
|    THE RISK ANALYSIS RESULT AND THE CI ESTATE (#719, owner 2026-10-16: "add relevant. i want data"; the names agreed with
|    Invardia). Read from the Pro database in ONE batch (Get-SIRaTelemetryCountSql), each key from the LATEST COMPLETE
|    Detailed collection (sidata.Collection Kind 'Detailed' Status 'Complete'), and only when ITS report's verdict there
|    (sidata.RaReportStatus) is Complete. A report that is not Complete leaves its key OUT, never 0.
|    #636 (owner 2026-10-19: "i prefer to switch so detailed becomes the engine default and summary is optional"): the counts
|    came from the Summary report's rows (sidata.SummaryRow / SummaryAsset); the Summary step is now off by default, so every
|    count comes from the DETAILED findings -- through the stored groupings the data sync writes per collection
|    (sidata.SummaryGroup, grouping 'report': per report its distinct assets, distinct recommendations / CVEs, of them Very High
|    / High / with a known exploit -- engine\_shared\SI-SummaryGroupings.ps1). #871 (found 2026-10-21: five installs whose
|    run stopped before the data sync sent no grouped keys for a day, and the dashboard's users without MFA fell from 22,136
|    to 3,444): those keys come from the NEWEST complete collection that HAS its groupings, decided by that collection's own
|    verdicts; its date goes out as Security.collectionUtc and the heartbeat's Warnings say si-data-1402 while the newest
|    collection is not grouped yet (SI-HeartbeatFields.ps1). Only an install that has never grouped a collection leaves them
|    out. Cheap by design: sidata.RaReportStatus (one row per report), the 'report' grouping of ONE
|    collection (by its index) and sidata.Ci. sidata.Finding is NEVER read (30 GB at a large install).
|    The definitions -- one line each -- are in data-model/telemetry-counts.locked.json (handed to Invardia with the release).
|    Every "how many assets" key counts the DISTINCT assets of the report's findings; every "how many recommendations / CVEs"
|    key the distinct configuration ids.
|    THE SECURITY DOMAINS (owner 2026-10-13: "si must send objects for each of the security domains"; built 2026-10-13 on
|    si-v3-scale/telemetry-counts-from-sql, ported onto rc11): the CURRENT CIs (not retired, as cis) of each class -- the
|    web app's domain of a CI is its class (device = Endpoint, identity = Identity, cloud_resource = Azure, public_ip =
|    PublicIP). Sent once sidata.Ci holds any CI (as cis); a domain without a CI is then a real 0.
|      domainEndpoint / domainIdentity / domainAzure / domainPublicIp
|    THE CLOSE-LOOP'S REAL REMEDIATIONS (the 2026-10-13 adoption numbers, Invardia's adoption dashboard):
|      fixedLast30Days  vuln.VulnerabilityItem items CLOSED in the last 30 days with reason Remediated (the reason's first
|                       word -- never AssetRetired / NoLongerMonitored / an engineer's other reason). Read on the Pro database
|                       through IX_VulnerabilityItem_UpdatedAt (a close sets UpdatedAt); left out when the close-loop holds
|                       no item there (not in use, or its own database elsewhere).
|    The other 2026-10-13 adoption numbers are covered here already or by the heartbeat's own fields: assetsProfiled = cis;
|    findingsOpen / Critical / High = Security.domains[].findings / findingsCritical / findingsHigh (the Detailed findings'
|    domain grouping -- sidata.Finding is never read); vulnerabilitiesOpen = cves + recommendations + azureRecommendations;
|    dataSources = Sources.
|#>
|function Get-SIRaCountAssetReportsState {
|    <# The value of $script:SIRaCountAssetReports, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIRaCountAssetReports) { $script:SIRaCountAssetReports = [ordered]@{
|    cveDevices              = 'Device_Missing_CVEs_Detailed'
|    eosSoftwareDevices      = 'Device_EndOfSupport_Software_Detailed'
|    usersWithoutMfa         = 'Identity_NoMFA_Detailed'
|    staleUsers180d          = 'Identity_StaleUser_NoLogin180Days_Detailed'
|    privilegedPermanent     = 'Identity_PermanentPrivilegedRole_Detailed'
|    guestsPrivileged        = 'Identity_GuestWithPrivilegedRole_Detailed'
|    spnsExpiringCredentials = 'Identity_SPN_ExpiringCredentials_Detailed'
|} }
|    , $script:SIRaCountAssetReports
|}
|$script:SIRaCountAssetReports = $null; $null = Get-SIRaCountAssetReportsState
|# the distinct recommendations / CVEs of a report (the 'report' grouping's Recommendations and its Very High / High / exploited twins)
|function Get-SIRaCountRecommendationReportsState {
|    <# The value of $script:SIRaCountRecommendationReports, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIRaCountRecommendationReports) { $script:SIRaCountRecommendationReports = [ordered]@{
|    cves                 = @('Device_Missing_CVEs_Detailed', 'recs')
|    cvesCritical         = @('Device_Missing_CVEs_Detailed', 'recsCritical')
|    cvesHigh             = @('Device_Missing_CVEs_Detailed', 'recsHigh')
|    cvesExploited        = @('Device_Missing_CVEs_Detailed', 'recsExploited')
|    recommendations      = @('Device_Recommendations_Detailed', 'recs')
|    azureRecommendations = @('Azure_DefenderRecommendations_Detailed', 'recs')
|} }
|    , $script:SIRaCountRecommendationReports
|}
|$script:SIRaCountRecommendationReports = $null; $null = Get-SIRaCountRecommendationReportsState
|# sidata.Ci Class -> the Counts key of its security domain (the web app: device = Endpoint, identity = Identity,
|# cloud_resource = Azure, public_ip = PublicIP)
|function Get-SITelemetryDomainKeysState {
|    <# The value of $script:SITelemetryDomainKeys, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SITelemetryDomainKeys) { $script:SITelemetryDomainKeys = [ordered]@{ device = 'domainEndpoint'; identity = 'domainIdentity'; cloud_resource = 'domainAzure'; public_ip = 'domainPublicIp' } }
|    , $script:SITelemetryDomainKeys
|}
|$script:SITelemetryDomainKeys = $null; $null = Get-SITelemetryDomainKeysState
|function Get-SIRaCountDetailedPairsState {
|    <# The value of $script:SIRaCountDetailedPairs, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIRaCountDetailedPairs) { $script:SIRaCountDetailedPairs = [ordered]@{
|    cveDevicePairs            = 'Device_Missing_CVEs_Detailed'
|    recommendationDevicePairs = 'Device_Recommendations_Detailed'
|} }
|    , $script:SIRaCountDetailedPairs
|}
|$script:SIRaCountDetailedPairs = $null; $null = Get-SIRaCountDetailedPairsState
|
|function Get-SIRaTelemetryCountSql {
|    <#
|        The one read: a result set of (K, R, G, S, N) rows --
|          status       R = report, G = grain, S = verdict, N = StoredRows   (sidata.RaReportStatus, the latest Detailed collection)
|          assets / recs / recsCritical / recsHigh / recsExploited
|                       R = report, N = its distinct assets / distinct recommendations (configuration ids) / of them Very High /
|                       High / with a known exploit -- the 'report' grouping of the Detailed findings (sidata.SummaryGroup)
|                       of the newest complete collection whose groupings are written (sidata.SummaryGroupState, #871)
|          groupedOlder N = 1 when that collection is OLDER than the newest complete one
|          gstatus      as status, for that older collection (its verdicts decide its grouped figures)
|          cis / cisTier0                    N = current CIs (not retired) / of them tier 0   (sidata.Ci)
|          domain       R = class (device / identity / cloud_resource / public_ip), N = current CIs of that class (sidata.Ci)
|          vulnItems    N = 1 when the close-loop holds any item (vuln.VulnerabilityItem), else 0
|          fixedLast30Days                   N = close-loop items closed Remediated in the last 30 days
|        Every part guarded: a database without a table / column answers without that part.
|    #>
|@"
|SET NOCOUNT ON;
|DECLARE @o TABLE (K nvarchar(32) NOT NULL, R nvarchar(256) NULL, G nvarchar(16) NULL, S nvarchar(16) NULL, N bigint NULL);
|DECLARE @dt datetime2(3), @dc int, @gt datetime2(3), @gc int;
|IF OBJECT_ID(N'sidata.Collection') IS NOT NULL
|    SELECT TOP (1) @dt = CollectionTime, @dc = CollectionId FROM sidata.Collection WHERE Kind = N'Detailed' AND Status = N'Complete' ORDER BY CollectionTime DESC;
|IF OBJECT_ID(N'sidata.RaReportStatus') IS NOT NULL AND @dt IS NOT NULL
|    INSERT @o (K, R, G, S, N)
|    SELECT N'status', ReportName, Grain, State, StoredRows FROM sidata.RaReportStatus
|    WHERE Grain = N'Detailed' AND CollectionTime = @dt;
|-- #871: the grouped figures come from the NEWEST complete collection that HAS its groupings -- a run that stopped before the
|-- data sync never drops them; that collection's own verdicts decide them (gstatus) when it is not the newest
|IF @dc IS NOT NULL AND OBJECT_ID(N'sidata.SummaryGroup') IS NOT NULL AND OBJECT_ID(N'sidata.SummaryGroupState') IS NOT NULL
|    EXEC sp_executesql N'SELECT TOP (1) @gt = c.CollectionTime, @gc = c.CollectionId FROM sidata.Collection AS c
|WHERE c.Kind = N''Detailed'' AND c.Status = N''Complete'' AND EXISTS (SELECT 1 FROM sidata.SummaryGroupState AS s WHERE s.CollectionId = c.CollectionId)
|ORDER BY c.CollectionTime DESC;', N'@gt datetime2(3) OUTPUT, @gc int OUTPUT', @gt = @gt OUTPUT, @gc = @gc OUTPUT;
|IF @gc IS NOT NULL AND @gc <> @dc
|BEGIN
|    INSERT @o (K, N) VALUES (N'groupedOlder', 1);
|    IF OBJECT_ID(N'sidata.RaReportStatus') IS NOT NULL
|        INSERT @o (K, R, G, S, N)
|        SELECT N'gstatus', ReportName, Grain, State, StoredRows FROM sidata.RaReportStatus
|        WHERE Grain = N'Detailed' AND CollectionTime = @gt;
|END
|IF @gc IS NOT NULL
|    INSERT @o (K, R, N)
|    EXEC sp_executesql N'
|IF EXISTS (SELECT 1 FROM sidata.SummaryGroupState WHERE CollectionId = @dc)
|SELECT N''grouped'', CONVERT(nvarchar(256), NULL), CONVERT(bigint, 1)
|UNION ALL
|SELECT x.K, g.Key1, x.N
|FROM sidata.SummaryGroup AS g
|CROSS APPLY (VALUES (N''assets'', CONVERT(bigint, g.Assets)), (N''recs'', CONVERT(bigint, g.Recommendations)), (N''recsCritical'', CONVERT(bigint, g.CriticalRecommendations)),
|                    (N''recsHigh'', CONVERT(bigint, g.HighRecommendations)), (N''recsExploited'', CONVERT(bigint, g.ExploitedRecommendations))) AS x(K, N)
|WHERE g.CollectionId = @dc AND g.GroupingId = ''report'';', N'@dc int', @dc = @gc;
|IF OBJECT_ID(N'sidata.Ci') IS NOT NULL
|    INSERT @o (K, N)
|    SELECT N'cis', COUNT_BIG(*) FROM sidata.Ci WHERE ISNULL(Lifecycle, N'') <> N'retired'
|    UNION ALL
|    SELECT N'cisTier0', COUNT_BIG(*) FROM sidata.Ci WHERE Tier = 0 AND ISNULL(Lifecycle, N'') <> N'retired';
|IF OBJECT_ID(N'sidata.Ci') IS NOT NULL AND COL_LENGTH(N'sidata.Ci', N'Class') IS NOT NULL
|    INSERT @o (K, R, N)
|    EXEC sp_executesql N'SELECT N''domain'', Class, COUNT_BIG(*) FROM sidata.Ci
|WHERE ISNULL(Lifecycle, N'''') <> N''retired'' AND Class IN (N''device'', N''identity'', N''cloud_resource'', N''public_ip'')
|GROUP BY Class;';
|IF OBJECT_ID(N'vuln.VulnerabilityItem') IS NOT NULL
|    INSERT @o (K, N)
|    SELECT N'vulnItems', CASE WHEN EXISTS (SELECT 1 FROM vuln.VulnerabilityItem) THEN 1 ELSE 0 END
|    UNION ALL
|    SELECT N'fixedLast30Days', COUNT_BIG(*) FROM vuln.VulnerabilityItem
|    WHERE UpdatedAt >= DATEADD(day, -30, SYSUTCDATETIME()) AND State = N'Closed' AND ClosedAt >= DATEADD(day, -30, SYSUTCDATETIME())
|      AND LEFT(ISNULL(CloseReason, N''), CHARINDEX(N':', ISNULL(CloseReason, N'') + N':') - 1) = N'Remediated';
|SELECT K, R, G, S, N FROM @o;
|"@
|}
|
|
|function ConvertFrom-SIRaTelemetryCountRows {
|    <#
|        PURE. The read's rows (K, R, G, S, N) -> the #719 keys that are KNOWN: a key whose report is not Complete in the
|        latest complete collection of its grain, or whose number is missing, is left out (never 0 by guess).
|    #>
|    param([AllowNull()][object[]]$Rows)
|    $out = [ordered]@{}
|    $status = @{}; $gstatus = @{}; $agg = @{}
|    foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $k = [string]$r.K
|        if ($k -eq 'status') { $status[('{0}|{1}' -f $r.G, $r.R)] = @{ S = [string]$r.S; N = (ConvertTo-SITelemetryCount $r.N) } }
|        elseif ($k -eq 'gstatus') { $gstatus[('{0}|{1}' -f $r.G, $r.R)] = @{ S = [string]$r.S; N = (ConvertTo-SITelemetryCount $r.N) } }
|        elseif ($k) { $agg[('{0}|{1}' -f $k, [string]$r.R)] = ConvertTo-SITelemetryCount $r.N }
|    }
|    $done = { param($g, $n) $x = $status["$g|$n"]; ($null -ne $x -and $x.S -eq 'Complete') }
|    # #871: the grouped figures are decided by the verdicts of the collection they come from -- an OLDER one when the newest
|    # complete collection has no groupings yet (a run that stopped before the data sync); its date rides Security.collectionUtc
|    $older = ($null -ne $agg['groupedOlder|'] -and $agg['groupedOlder|'] -gt 0)
|    $gv = $status; if ($older) { $gv = $gstatus }
|    $gdone = { param($g, $n) $x = $gv["$g|$n"]; ($null -ne $x -and $x.S -eq 'Complete') }
|    if ($status.Count) {
|        $out['raReportsTotal'] = [long]$status.Count
|        $out['raReportsComplete'] = [long]@($status.Values | Where-Object { $_.S -eq 'Complete' }).Count
|        $det = @($status.Keys | Where-Object { $_ -like 'Detailed|*' } | ForEach-Object { $status[$_].N } | Where-Object { $null -ne $_ })
|        if ($det.Count) { $s = [long]0; foreach ($v in $det) { $s += [long]$v }; $out['raRowsDetailed'] = $s }
|    }
|    foreach ($key in (Get-SIRaCountDetailedPairsState).Keys) {
|        $rn = (Get-SIRaCountDetailedPairsState)[$key]
|        if ((& $done 'Detailed' $rn) -and $null -ne $status["Detailed|$rn"].N) { $out[$key] = [long]$status["Detailed|$rn"].N }
|    }
|    # #636: the distinct assets / CVEs / recommendations of a Complete report, from the Detailed findings' 'report' grouping; a
|    # report without a group row (no finding) is a real 0 once the collection's groupings were read
|    $grouped = [bool](@($agg.Keys | Where-Object { $_ -like 'recs|*' -or $_ -like 'assets|*' -or $_ -eq 'grouped|' }).Count)
|    foreach ($key in (Get-SIRaCountAssetReportsState).Keys) {
|        $rn = (Get-SIRaCountAssetReportsState)[$key]
|        if (-not (& $gdone 'Detailed' $rn)) { continue }
|        if ($agg.ContainsKey("assets|$rn") -and $null -ne $agg["assets|$rn"]) { $out[$key] = [long]$agg["assets|$rn"] }
|        elseif ($grouped) { $out[$key] = [long]0 }
|    }
|    foreach ($key in (Get-SIRaCountRecommendationReportsState).Keys) {
|        $rn = (Get-SIRaCountRecommendationReportsState)[$key][0]; $k = (Get-SIRaCountRecommendationReportsState)[$key][1]
|        if (-not (& $gdone 'Detailed' $rn)) { continue }
|        if ($agg.ContainsKey("$k|$rn") -and $null -ne $agg["$k|$rn"]) { $out[$key] = [long]$agg["$k|$rn"] }
|        elseif ($grouped) { $out[$key] = [long]0 }
|    }
|    # attack paths: every Attack_Paths_Detailed_* report of the run Complete, each with its stored rows (the path findings)
|    $ap = @($status.Keys | Where-Object { $_ -like 'Detailed|Attack_Paths_Detailed_*' })
|    if ($ap.Count -and -not @($ap | Where-Object { $status[$_].S -ne 'Complete' -or $null -eq $status[$_].N }).Count) {
|        $s = [long]0; foreach ($x in $ap) { $s += [long]$status[$x].N }; $out['attackPaths'] = $s
|    }
|    # the CI estate: a database without any CI yet has nothing to say (no key, not 0)
|    if ($null -ne $agg['cis|'] -and $agg['cis|'] -gt 0) {
|        $out['cis'] = [long]$agg['cis|']
|        if ($null -ne $agg['cisTier0|']) { $out['cisTier0'] = [long]$agg['cisTier0|'] }
|        # the security domains: once the class was read at all (a domain row came back), a domain without a CI is a real 0
|        if (@($agg.Keys | Where-Object { $_ -like 'domain|*' }).Count) {
|            foreach ($d in (Get-SITelemetryDomainKeysState).Keys) {
|                $v = $agg["domain|$d"]
|                $out[(Get-SITelemetryDomainKeysState)[$d]] = $(if ($null -ne $v) { [long]$v } else { [long]0 })
|            }
|        }
|    }
|    # the close-loop's real remediations: only where the close-loop holds items (none = not in use here: no key)
|    if ($null -ne $agg['vulnItems|'] -and $agg['vulnItems|'] -gt 0 -and $null -ne $agg['fixedLast30Days|']) {
|        $out['fixedLast30Days'] = [long]$agg['fixedLast30Days|']
|    }
|    $out
|}
|
|function Invoke-SITelemetrySqlRows {
|    <#
|        One read on the install's Pro database (SI_ProSqlServer / SI_ProSqlDatabase) as the job, closed after; the rows as
|        objects. $null when no database is configured or this is a test session (never a connection there). Throws on a
|        failed read (the caller leaves the keys out).
|    #>
|    param([Parameter(Mandatory)][string]$Sql, [string]$Server = [string]$global:SI_ProSqlServer, [string]$Database = [string]$global:SI_ProSqlDatabase)
|    if ([string]::IsNullOrWhiteSpace($Server) -or [string]::IsNullOrWhiteSpace($Database)) { return $null }
|    if (Get-Module -Name Pester) { return $null }
|    if (-not (Get-Command -Name Get-SIObjectLedgerConnection -ErrorAction SilentlyContinue)) {
|        . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'identity', 'SI-ObjectLedgerStore.ps1'))
|    }
|    $cn = Get-SIObjectLedgerConnection -Server $Server -Database $Database -MaxAttempts 2
|    if (-not $cn) { return $null }
|    $rows = New-Object System.Collections.Generic.List[object]
|    try {
|        $cmd = $cn.CreateCommand(); $cmd.CommandText = $Sql; $cmd.CommandTimeout = 0
|        $rd = $cmd.ExecuteReader()
|        try {
|            while ($rd.Read()) {
|                $o = [ordered]@{}
|                for ($i = 0; $i -lt $rd.FieldCount; $i++) { $o[$rd.GetName($i)] = $(if ($rd.IsDBNull($i)) { $null } else { $rd.GetValue($i) }) }
|                $rows.Add([pscustomobject]$o)
|            }
|        } finally { $rd.Dispose() }
|    } finally { $cn.Dispose() }
|    , $rows.ToArray()
|}
|
|function Get-SIRaTelemetryCounts {
|    <#
|        The #719 keys of this install (an ordered dictionary, possibly empty). -SqlRows { param($Sql) rows } is the seam
|        (default Invoke-SITelemetrySqlRows). A failed read leaves EVERY #719 key out and says so in ONE plain line per process
|        (-Log, default Write-Host). Never throws.
|    #>
|    param([scriptblock]$SqlRows, [scriptblock]$Log)
|    if (-not $SqlRows) { $SqlRows = { param($Sql) Invoke-SITelemetrySqlRows -Sql $Sql } }
|    try {
|        $rows = & $SqlRows (Get-SIRaTelemetryCountSql)
|        if ($null -eq $rows) { return [ordered]@{} }
|        return (ConvertFrom-SIRaTelemetryCountRows -Rows @($rows))
|    } catch {
|        if (-not $script:SIRaCountsWarned) {
|            $script:SIRaCountsWarned = $true
|            $m = ("$($_.Exception.Message)".Trim() -replace '\s+', ' '); if ($m.Length -gt 160) { $m = $m.Substring(0, 160) + '...' }
|            $line = (" [INFO] Today's status report leaves out the report and CI numbers -- the database could not be read ({0})." -f $m)
|            try { if ($Log) { & $Log $line } else { Write-Host $line } } catch { }
|        }
|        return [ordered]@{}
|    }
|}
|
|<#
|    SQL SPACE (#512, owner 2026-10-09: "telemetry must collect available sql db space remaining in health telemetry";
|    framework §8.10 SQL-SPACE, the same two keys PIM sends): the install's Pro database (SI_ProSqlServer /
|    SI_ProSqlDatabase), in MB --
|      sqlUsedMb  the space its data files USE (FILEPROPERTY SpaceUsed, 8 KB pages)
|      sqlMaxMb   its maximum size (DATABASEPROPERTYEX MaxSizeInBytes)
|    Both readable with data rights only. Invardia warns on space left; a maximum under 250 GB is flagged (#511).
|#>
|function Get-SISqlSpaceQuery {
|    # ONE value, 'used|max' -- read as a scalar
|    "SET NOCOUNT ON; SELECT CONCAT((SELECT SUM(CAST(FILEPROPERTY(name, 'SpaceUsed') AS bigint)) * 8 / 1024 FROM sys.database_files WHERE type_desc = 'ROWS'), '|', CAST(DATABASEPROPERTYEX(DB_NAME(), 'MaxSizeInBytes') AS bigint) / 1048576);"
|}
|
|function ConvertFrom-SISqlSpaceValue {
|    <# PURE. 'used|max' -> @{ sqlUsedMb; sqlMaxMb } with only the parts that are whole numbers >= 0 (sqlMaxMb > 0). #>
|    param($Value)
|    $c = @{}
|    if ($null -eq $Value -or $Value -is [System.DBNull]) { return $c }
|    $p = ([string]$Value).Split('|')
|    $n = [long]0
|    if ($p.Count -ge 1 -and [long]::TryParse($p[0].Trim(), [Globalization.NumberStyles]::Integer, [Globalization.CultureInfo]::InvariantCulture, [ref]$n) -and $n -ge 0) { $c['sqlUsedMb'] = $n }
|    if ($p.Count -ge 2 -and [long]::TryParse($p[1].Trim(), [Globalization.NumberStyles]::Integer, [Globalization.CultureInfo]::InvariantCulture, [ref]$n) -and $n -gt 0) { $c['sqlMaxMb'] = $n }
|    $c
|}
|
|function Get-SISqlSpaceCounts {
|    <#
|        sqlUsedMb / sqlMaxMb of the install's Pro database; an empty hashtable when there is no database or it could not be
|        read. -Scalar { param($Sql) } is the seam (default: one connection as the job, closed after). Never throws.
|    #>
|    param([scriptblock]$Scalar, [string]$Server = [string]$global:SI_ProSqlServer, [string]$Database = [string]$global:SI_ProSqlDatabase)
|    try {
|        if ($Scalar) { return (ConvertFrom-SISqlSpaceValue -Value (& $Scalar (Get-SISqlSpaceQuery))) }
|        if ([string]::IsNullOrWhiteSpace($Server) -or [string]::IsNullOrWhiteSpace($Database)) { return @{} }
|        # (no closure seam here: a GetNewClosure() runs in its own module scope and does not see the connection helper)
|        if (-not (Get-Command -Name Get-SIObjectLedgerConnection -ErrorAction SilentlyContinue)) {
|            . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'identity', 'SI-ObjectLedgerStore.ps1'))
|        }
|        $cn = Get-SIObjectLedgerConnection -Server $Server -Database $Database -MaxAttempts 2
|        if (-not $cn) { return @{} }
|        try { $cmd = $cn.CreateCommand(); $cmd.CommandText = (Get-SISqlSpaceQuery); $cmd.CommandTimeout = 0; $v = $cmd.ExecuteScalar() } finally { $cn.Dispose() }
|        ConvertFrom-SISqlSpaceValue -Value $v
|    } catch { @{} }
|}
|
|function Get-SIIdentityCountQuery {
|    <# The KQL for users / guests: the latest identity collection, one row per user object. Typed = how many users carry
|       a UserType at all -- 0 means the column is not filled, and then nothing is reported. #>
|    param([System.Collections.IDictionary]$CompleteBy = (Get-SICountCompleteByState))
|    $q = @'
|let t = SI_Identity_Profile_CL | where TimeGenerated > ago(8d);
|let lastColl = toscalar(t{{IDB}} | summarize _in = max(ingestion_time()) by CollectionTime | where _in < ago(30m) | summarize max(CollectionTime));
|t
|| where CollectionTime == lastColl
|| extend _id = tostring(column_ifexists("SI_AssetId", "")), _type = tostring(column_ifexists("IdentityType", "")), _ut = tostring(column_ifexists("UserType", "")), _en = tostring(column_ifexists("AccountEnabled", ""))
|| where isnotempty(_id) and _type =~ "User"
|| summarize _ut = take_any(_ut), _en = take_any(_en) by _id
|| summarize Users = countif(_ut =~ "Member" and _en =~ "true"), Guests = countif(_ut =~ "Guest"), Typed = countif(isnotempty(_ut)), Total = count()
|'@
|    $q.Replace('{{IDB}}', (Get-SICountCompleteFilter -Source identity -CompleteBy $CompleteBy))
|}
|
|function Get-SIAdOnlyUserHuntingQuery {
|    <# The Advanced Hunting KQL for users' AD part: the distinct adSid of every enabled AD USER account in the Exposure
|       Graph (field names as Get-DiscoveryFromIdentityExposureGraph and data-model/mappings/eg.locked.json read them).
|       Total = how many there are, so a truncated answer is detected (rows < Total) and never sent as a count. #>
|    @'
|let u = ExposureGraphNodes
|| where NodeLabel =~ "user"
|| extend _p = tostring(NodeProperties.rawData.primaryProvider), _t = tostring(NodeProperties.rawData.identityType), _sid = toupper(tostring(NodeProperties.rawData.adSid)), _en = tostring(NodeProperties.rawData.accountEnabled), _en2 = tostring(NodeProperties.rawData.isEnabled), _act = tostring(NodeProperties.rawData.isActive)
|| extend _enabled = iff(isnotempty(_en), _en, iff(isnotempty(_en2), _en2, _act))
|| where _p =~ "ActiveDirectory" and _t =~ "User" and isnotempty(_sid) and _enabled =~ "true"
|| distinct AdSid = _sid;
|u | extend Total = toscalar(u | count)
|'@
|}
|
|function Get-SIEntraOnPremSidQuery {
|    <# The KQL for the SIDs of every Entra user in the latest identity collection that came from on-prem AD (OnPremSid),
|       enabled or not -- a synced AD account belongs to the Entra part either way (counted there, or deliberately not
|       when disabled in Entra), so it is never added again from AD. #>
|    param([System.Collections.IDictionary]$CompleteBy = (Get-SICountCompleteByState))
|    $q = @'
|let t = SI_Identity_Profile_CL | where TimeGenerated > ago(8d);
|let lastColl = toscalar(t{{IDB}} | summarize _in = max(ingestion_time()) by CollectionTime | where _in < ago(30m) | summarize max(CollectionTime));
|t
|| where CollectionTime == lastColl
|| extend _type = tostring(column_ifexists("IdentityType", "")), _sid = toupper(tostring(column_ifexists("OnPremSid", "")))
|| where _type =~ "User" and isnotempty(_sid)
|| distinct OnPremSid = _sid
|'@
|    $q.Replace('{{IDB}}', (Get-SICountCompleteFilter -Source identity -CompleteBy $CompleteBy))
|}
|
|function Get-SIAdOnlyUserCountFromRows {
|    <#
|        PURE. users' AD part from the hunting rows (AdSid, Total) and the Entra OnPremSids. Returns @{ Count; Reason }:
|        Count = the AD-only enabled users (a SID that is an Entra user's OnPremSid is not counted), or $null with a plain
|        Reason when the hunting answer was cut short (fewer rows than its Total).
|    #>
|    param([AllowNull()][object[]]$EgRows, [AllowNull()][object[]]$EntraSids)
|    $ad = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $total = $null
|    foreach ($r in @($EgRows)) {
|        if ($null -eq $r) { continue }
|        $sid = "$($r.AdSid)".Trim()
|        if ($sid) { [void]$ad.Add($sid) }
|        $t = ConvertTo-SITelemetryCount $r.Total
|        if ($null -ne $t -and ($null -eq $total -or $t -gt $total)) { $total = $t }
|    }
|    if ($null -ne $total -and $ad.Count -lt $total) {
|        return @{ Count = $null; Reason = ('the Exposure Graph answer was cut short ({0} of {1} AD users)' -f $ad.Count, $total) }
|    }
|    $n = [long]0
|    if ($ad.Count -gt 0) {
|        $entra = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|        foreach ($e in @($EntraSids)) {
|            if ($null -eq $e) { continue }
|            $v = if ($e -is [string]) { $e } else { "$($e.OnPremSid)" }
|            if ($v.Trim()) { [void]$entra.Add($v.Trim()) }
|        }
|        foreach ($s in $ad) { if (-not $entra.Contains($s)) { $n++ } }
|    }
|    @{ Count = $n; Reason = '' }
|}
|
|function Invoke-SITelemetryHuntingQuery {
|    <#
|        One Advanced Hunting query for the counts, as the run's Graph identity (Get-SIGraphToken -Resource Graph -- the token
|        the identity engine's Exposure Graph discovery uses) through Invoke-SIHuntingQueryRest (v1.0, 120 s, -AsResult).
|        Returns the rows as plain objects; throws a plain reason when it cannot be read. A test session never calls out.
|    #>
|    param([Parameter(Mandatory)][string]$Query)
|    if (Get-Module -Name Pester) { throw 'a test session does not query Advanced Hunting' }
|    if (-not (Get-Command -Name Invoke-SIHuntingQueryRest -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-GraphRest.ps1')) }
|    if (-not (Get-Command -Name Get-SIGraphToken -ErrorAction SilentlyContinue)) {
|        . ([System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'auth', 'Get-SIGraphToken.ps1'))
|    }
|    $token = Get-SIGraphToken -Resource Graph
|    if ([string]::IsNullOrWhiteSpace([string]$token)) { throw 'no Graph token for Advanced Hunting' }
|    $r = Invoke-SIHuntingQueryRest -Query $Query -Token $token -TimeoutSec 120 -ApiVersion 'v1.0' -AsResult
|    if (-not $r.Ok) { throw ([string]$r.Error) }
|    $rows = New-Object System.Collections.Generic.List[object]
|    foreach ($x in @($r.Results)) { if ($null -ne $x) { $rows.Add([pscustomobject]$x.AdditionalProperties) } }
|    , $rows.ToArray()
|}
|
|function Get-SIAdOnlyUserCount {
|    <#
|        users' AD part: @{ Count; Reason } -- Count $null (with a plain Reason) when it cannot be read. -RunHunting
|        { param($Kql) rows } and -RunQuery { param($Kql) rows } are the seams (defaults: Invoke-SITelemetryHuntingQuery /
|        Invoke-SITelemetryLaQuery). Never throws.
|    #>
|    param([scriptblock]$RunHunting, [scriptblock]$RunQuery)
|    if (-not $RunHunting) { $RunHunting = { param($Kql) Invoke-SITelemetryHuntingQuery -Query $Kql } }
|    if (-not $RunQuery) { $RunQuery = { param($Kql) Invoke-SITelemetryLaQuery -Query $Kql } }
|    $why = { param($e) $m = ("$e".Trim() -replace '\s+', ' '); if ($m.Length -gt 160) { $m = $m.Substring(0, 160) + '...' }; $m }
|    try {
|        $eg = & $RunHunting (Get-SIAdOnlyUserHuntingQuery)
|        if ($null -eq $eg) { return @{ Count = $null; Reason = 'the Exposure Graph could not be read' } }
|        $eg = @($eg)
|        $sids = @()
|        if ($eg.Count -gt 0) {
|            # the dedupe needs the Entra SIDs; without them an AD number could count synced users twice, so none is sent
|            try { $sids = & $RunQuery (Get-SIEntraOnPremSidQuery) }
|            catch { return @{ Count = $null; Reason = ('the Entra on-prem SIDs to match synced users could not be read: {0}' -f (& $why $_.Exception.Message)) } }
|            if ($null -eq $sids) { return @{ Count = $null; Reason = 'the Entra on-prem SIDs to match synced users could not be read' } }
|        }
|        return (Get-SIAdOnlyUserCountFromRows -EgRows $eg -EntraSids @($sids))
|    } catch { return @{ Count = $null; Reason = ('the Exposure Graph could not be read: {0}' -f (& $why $_.Exception.Message)) } }
|}
|
|function Get-SIDeviceCountQuery {
|    <# The KQL for devices: per UTC day of the last 7, the latest correlation run of that day, the number of distinct
|       correlation objects with an endpoint member that is not an IoT or network device. #>
|    @'
|let rows = SI_ObjectMap_CL
|| where TimeGenerated > ago(8d)
|| where CollectionTime > ago(7d)
|| where tostring(SI_MemberEngine) == "endpoint"
|| extend Day = startofday(CollectionTime);
|let lastPerDay = rows | summarize CollectionTime = max(CollectionTime) by Day;
|let cats = SI_Endpoint_Profile_CL
|| where TimeGenerated > ago(8d)
|| extend _aid = tostring(column_ifexists("SI_AssetId", "")), _cat = tolower(tostring(column_ifexists("DeviceCategory", "")))
|| where isnotempty(_aid)
|| summarize arg_max(CollectionTime, _cat) by _aid
|| project SI_AssetId = _aid, _cat;
|rows
|| join kind=inner (lastPerDay) on Day, CollectionTime
|| join kind=leftouter (cats) on SI_AssetId
|| where not(_cat in ("iot", "networkdevice"))
|| summarize Devices = count_distinct(SI_CorrelationId) by Day
|| order by Day asc
|'@
|}
|
|function ConvertTo-SITelemetryCount {
|    <# PURE. A non-negative whole number, or $null (unknown). #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or [string]::IsNullOrWhiteSpace([string]$Value)) { return $null }
|    $d = 0.0
|    if (-not [double]::TryParse([string]$Value, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $null }
|    if ($d -lt 0 -or [double]::IsNaN($d) -or [double]::IsInfinity($d)) { return $null }
|    [long][Math]::Floor($d)
|}
|
|function Get-SIIdentityCounts {
|    <#
|        PURE. users / guests from the identity query's one result row (Users, Guests, Typed, Total). Returns an ordered
|        dictionary with the keys it could compute -- EMPTY when there are no users or no UserType was collected at all.
|    #>
|    param([AllowNull()]$Row)
|    $out = [ordered]@{}
|    if ($null -eq $Row) { return $out }
|    $total = ConvertTo-SITelemetryCount $Row.Total
|    $typed = ConvertTo-SITelemetryCount $Row.Typed
|    if ($null -eq $total -or $total -eq 0 -or $null -eq $typed -or $typed -eq 0) { return $out }
|    $u = ConvertTo-SITelemetryCount $Row.Users
|    $g = ConvertTo-SITelemetryCount $Row.Guests
|    if ($null -ne $u) { $out['users'] = $u }
|    if ($null -ne $g) { $out['guests'] = $g }
|    $out
|}
|
|function Get-SIDeviceCountMax {
|    <#
|        PURE. The 7-day maximum of daily device counts. -DailyCounts: rows with Day (a date) and Devices. Only the UTC days
|        from (today - 6) to today count; an older or future day, or a row without a number, is ignored. $null when no day
|        is left (no correlation run in the last 7 days) -- never 0 by guess.
|    #>
|    param([AllowNull()][object[]]$DailyCounts, [datetime]$NowUtc = [datetime]::UtcNow)
|    $today = $NowUtc.ToUniversalTime().Date
|    $first = $today.AddDays(-6)
|    $max = $null
|    foreach ($r in @($DailyCounts)) {
|        if ($null -eq $r) { continue }
|        $n = ConvertTo-SITelemetryCount $r.Devices
|        if ($null -eq $n) { continue }
|        $day = $null
|        try {
|            $dv = $r.Day
|            $day = if ($dv -is [datetime]) { $dv.ToUniversalTime().Date }
|                   else { ([datetime]::Parse([string]$dv, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]'AdjustToUniversal, AssumeUniversal')).Date }
|        } catch { continue }
|        if ($day -lt $first -or $day -gt $today) { continue }
|        if ($null -eq $max -or $n -gt $max) { $max = $n }
|    }
|    $max
|}
|
|function Invoke-SITelemetryLaQuery {
|    <#
|        One KQL query on the install's workspace, for the counts: the Log Analytics resource-centric data plane
|        (api.loganalytics.io/v1<workspace resource id>/query) as the run's identity, through the run's own REST helper.
|        Short: 2 attempts, 60 s. Returns the primary table as objects, or $null when the REST helper is not loaded in this
|        process (no signed-in engine) or there is no workspace. Throws on a refused query (the caller omits the count).
|    #>
|    # -MayBeMissing: tables of the query this workspace may not have (Test-SILaAnswerWhole): their legs answer nothing, the rest is whole
|    param([Parameter(Mandatory)][string]$Query, [AllowEmptyString()][string]$WorkspaceResourceId = [string]$global:SI_WorkspaceResourceId, [string[]]$MayBeMissing = @())
|    $ws = "$WorkspaceResourceId".Trim().TrimEnd('/')
|    if ($ws -notmatch '^/subscriptions/[^/]+/resourceGroups/[^/]+/providers/Microsoft\.OperationalInsights/workspaces/[^/]+$') { return $null }
|    if (-not (Get-Command -Name Invoke-SIAzRestRequest -ErrorAction SilentlyContinue) -or
|        -not (Get-Command -Name ConvertFrom-SILaQueryJson -ErrorAction SilentlyContinue)) { return $null }
|    $uri = 'https://api.loganalytics.io/v1{0}/query' -f $ws
|    $r = Invoke-SIAzRestRequest -Method POST -Uri $uri -Audience LaQuery -Body (@{ query = $Query } | ConvertTo-Json -Compress) `
|             -TimeoutSec 60 -MaxAttempts 2 -What 'telemetry count query'
|    $parsed = ConvertFrom-SILaQueryJson -Json ([string]$r.Content)
|    # #639 lane 4: a count from an answer the service CUT (a part that timed out) is a wrong count -- refused like every
|    # Log Analytics read (Test-SILaAnswerWhole); the caller omits the count, never sends a short one
|    if ($null -ne $parsed.Error -and (Get-Command -Name Test-SILaAnswerWhole -ErrorAction SilentlyContinue)) {
|        $v = Test-SILaAnswerWhole -ErrorObject $parsed.Error -Rows 0 -MayBeMissing $MayBeMissing
|        if (-not $v.Whole) { throw (New-SILaCutAnswerError -Verdict $v -ErrorObject $parsed.Error) }
|    }
|    $t = @($parsed.Tables) | Select-Object -First 1
|    $rows = New-Object System.Collections.Generic.List[object]
|    if ($t) {
|        $names = @($t.Columns | ForEach-Object { [string]$_.name })
|        foreach ($row in @($t.Rows)) {
|            $o = [ordered]@{}
|            for ($i = 0; $i -lt $names.Count; $i++) { $o[$names[$i]] = $row[$i] }
|            $rows.Add([pscustomobject]$o)
|        }
|    }
|    , $rows.ToArray()
|}
|
|function Get-SIDeviceCount {
|    <#
|        THE device count of this install: the 7-day maximum of unique correlated devices (endpoints + servers, one per
|        real machine). $null when it cannot be computed. The reusable unit for the heartbeat AND the future Pro Business
|        device cap. -RunQuery { param($Kql) rows } is the test seam (default: Invoke-SITelemetryLaQuery). Never throws.
|    #>
|    param([scriptblock]$RunQuery, [datetime]$NowUtc = [datetime]::UtcNow)
|    if (-not $RunQuery) { $RunQuery = { param($Kql) Invoke-SITelemetryLaQuery -Query $Kql } }
|    try {
|        $rows = & $RunQuery (Get-SIDeviceCountQuery)
|        if ($null -eq $rows) { return $null }
|        return (Get-SIDeviceCountMax -DailyCounts @($rows) -NowUtc $NowUtc)
|    } catch { return $null }
|}
|
|<#
|    THE SECURITY SCORES (owner 2026-10-16: "Add, permission REQUIRED"), three Counts keys, whole numbers >= 0 (rounded):
|      secureScore / secureScoreMax  Microsoft Secure Score, the LATEST daily score of the tenant: Graph
|                                    GET /v1.0/security/secureScores?$top=1 -> currentScore / maxScore
|                                    (application permission Microsoft Graph SecurityEvents.Read.All, read only)
|      exposureScore                 the Defender for Endpoint exposure score: GET https://api.securitycenter.microsoft.com/api/exposureScore
|                                    -> score (application permission WindowsDefenderATP Score.Read.All, read only)
|    Both permissions are REQUIRED (config/permissions.locked.json): setup grants them on a new install, an existing install's
|    update names them (setup/_shared/SI-PermissionNote.ps1). Until granted, a 401 / 403 leaves the keys OUT and the heartbeat's
|    Warnings carry si-perm-1004 (Get-SISecurityScoreState -> SI-HeartbeatFields.ps1, Get-SIHeartbeatWarnings). Any other
|    failure (no Defender for Endpoint, a timeout, a 5xx, no token) leaves the keys out, says one line, raises no warning.
|    CHEAP: one call each, at most once an hour per process (the answer is kept for -CacheMinutes), and only in the hourly
|    status report job (SI_ENGINE heartbeat) unless -WithScores says otherwise. Never throws.
|#>
|function Get-SISecurityScoreTable {
|    <# The value of $script:SISecurityScore, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SISecurityScore) { $script:SISecurityScore = @{
|    GraphUri     = 'https://graph.microsoft.com/v1.0/security/secureScores?$top=1'
|    DefenderUri  = 'https://api.securitycenter.microsoft.com/api/exposureScore'
|    GraphRole    = 'SecurityEvents.Read.All'
|    DefenderRole = 'Score.Read.All'
|    TimeoutSec   = 30
|    CacheMinutes = 55
|} }
|    , $script:SISecurityScore
|}
|$script:SISecurityScore = $null; $null = Get-SISecurityScoreTable
|
|function Get-SISecurityScoreContract { (Get-SISecurityScoreTable) }
|
|function Invoke-SISecurityScoreGet {
|    <#
|        One GET as the run's identity (Get-SIGraphToken -Resource Graph | Defender). Returns @{ Status (int; 0 = no answer);
|        Body; Error } and NEVER throws. A test session never calls out (Status 0).
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Graph', 'Defender')][string]$Resource, [Parameter(Mandatory)][string]$Uri)
|    if (Get-Module -Name Pester) { return @{ Status = 0; Body = $null; Error = 'a test session does not read the security scores' } }
|    try {
|        if (-not (Get-Command -Name Get-SIGraphToken -ErrorAction SilentlyContinue)) {
|            . ([System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'auth', 'Get-SIGraphToken.ps1'))
|        }
|        $token = Get-SIGraphToken -Resource $Resource
|        if ([string]::IsNullOrWhiteSpace([string]$token)) { return @{ Status = 0; Body = $null; Error = ('no {0} token' -f $Resource) } }
|        $body = Invoke-RestMethod -Method Get -Uri $Uri -Headers @{ Authorization = ('Bearer ' + $token) } -TimeoutSec (Get-SISecurityScoreTable).TimeoutSec -ErrorAction Stop
|        return @{ Status = 200; Body = $body; Error = '' }
|    } catch {
|        $code = 0
|        try { if ($_.Exception.Response) { $code = [int]$_.Exception.Response.StatusCode } } catch { $code = 0 }
|        $m = ("$($_.Exception.Message)".Trim() -replace '\s+', ' '); if ($m.Length -gt 160) { $m = $m.Substring(0, 160) + '...' }
|        return @{ Status = $code; Body = $null; Error = $m }
|    }
|}
|
|function ConvertFrom-SISecurityScoreAnswers {
|    <#
|        PURE. The two answers (@{ Status; Body; Error }, or $null = not asked) -> @{ Counts (ordered); Refused (the permissions a
|        401 / 403 names); Problems (plain reasons, not a permission) }. A value that is not a number >= 0 is left out.
|    #>
|    param([AllowNull()]$Graph, [AllowNull()]$Defender)
|    $c = (Get-SISecurityScoreTable)
|    $counts = [ordered]@{}; $refused = New-Object System.Collections.Generic.List[string]; $problems = New-Object System.Collections.Generic.List[string]
|    $num = { param($v) if ($null -eq $v) { return $null }; $d = 0.0
|        if (-not [double]::TryParse([string]$v, [Globalization.NumberStyles]::Float, [Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $null }
|        if ([double]::IsNaN($d) -or [double]::IsInfinity($d) -or $d -lt 0) { return $null }
|        [long][Math]::Round($d, [MidpointRounding]::AwayFromZero) }
|    $prop = { param($o, $n) if ($null -eq $o) { return $null }; if ($o -is [System.Collections.IDictionary]) { return $o[$n] }; $p = $o.PSObject.Properties[$n]; if ($p) { $p.Value } else { $null } }
|    if ($null -ne $Graph) {
|        $s = [int]$Graph.Status
|        if ($s -in 401, 403) { $refused.Add($c.GraphRole) }
|        elseif ($s -ge 200 -and $s -lt 300) {
|            $latest = @(& $prop $Graph.Body 'value') | Where-Object { $null -ne $_ } | Select-Object -First 1
|            if ($null -eq $latest) { $problems.Add('Microsoft Secure Score has no score yet') }
|            else {
|                $cur = & $num (& $prop $latest 'currentScore'); $max = & $num (& $prop $latest 'maxScore')
|                if ($null -ne $cur) { $counts['secureScore'] = $cur }
|                if ($null -ne $max) { $counts['secureScoreMax'] = $max }
|                if ($null -eq $cur -and $null -eq $max) { $problems.Add('Microsoft Secure Score answered without a score') }
|            }
|        } else { $problems.Add(('Microsoft Secure Score could not be read ({0})' -f $(if ("$($Graph.Error)".Trim()) { "$($Graph.Error)".Trim() } else { "status $s" }))) }
|    }
|    if ($null -ne $Defender) {
|        $s = [int]$Defender.Status
|        if ($s -in 401, 403) { $refused.Add($c.DefenderRole) }
|        elseif ($s -ge 200 -and $s -lt 300) {
|            $sc = & $num (& $prop $Defender.Body 'score')
|            if ($null -ne $sc) { $counts['exposureScore'] = $sc } else { $problems.Add('the Defender exposure score answered without a score') }
|        } else { $problems.Add(('the Defender exposure score could not be read ({0})' -f $(if ("$($Defender.Error)".Trim()) { "$($Defender.Error)".Trim() } else { "status $s" }))) }
|    }
|    @{ Counts = $counts; Refused = $refused.ToArray(); Problems = $problems.ToArray() }
|}
|
|function Reset-SISecurityScoreCache { $global:SI_SecurityScoreCache = $null; $global:SI_SecurityScoreState = $null; $global:SI_SecurityScoreSaid = $false }
|
|function Get-SISecurityScoreState {
|    <# The permission state of the last score read in this process: @{ Refused = string[]; SinceUtc } -- $null when nothing was
|       read, or nothing was refused. Read by the heartbeat's Warnings (si-perm-1004). #>
|    $s = $global:SI_SecurityScoreState
|    if ($null -eq $s -or -not @($s.Refused).Count) { return $null }
|    $s
|}
|
|function Get-SISecurityScoreCounts {
|    <#
|        The three score keys of this install (an ordered dictionary, possibly empty). -GraphGet / -DefenderGet
|        { param($Uri) } -> @{ Status; Body; Error } are the seams (default Invoke-SISecurityScoreGet). The answer is kept for
|        -CacheMinutes (55): a second call within the hour reads nothing. Sets the permission state (Get-SISecurityScoreState)
|        and says ONE plain line per process when a score could not be read (-Log, default Write-Host). Never throws.
|    #>
|    param([scriptblock]$GraphGet, [scriptblock]$DefenderGet, [datetime]$NowUtc = [datetime]::UtcNow, [int]$CacheMinutes = (Get-SISecurityScoreTable).CacheMinutes,
|          [scriptblock]$Log)
|    try {
|        $now = $NowUtc.ToUniversalTime()
|        $cache = $global:SI_SecurityScoreCache
|        if ($null -ne $cache -and $CacheMinutes -gt 0 -and ($now - [datetime]$cache.AtUtc).TotalMinutes -lt $CacheMinutes -and ($now -ge [datetime]$cache.AtUtc)) {
|            $o = [ordered]@{}; foreach ($k in @($cache.Counts.Keys)) { $o[$k] = $cache.Counts[$k] }; return $o
|        }
|        if (-not $GraphGet) { $GraphGet = { param($Uri) Invoke-SISecurityScoreGet -Resource Graph -Uri $Uri } }
|        if (-not $DefenderGet) { $DefenderGet = { param($Uri) Invoke-SISecurityScoreGet -Resource Defender -Uri $Uri } }
|        $g = $null; $d = $null
|        try { $g = & $GraphGet (Get-SISecurityScoreTable).GraphUri } catch { $g = @{ Status = 0; Body = $null; Error = "$($_.Exception.Message)" } }
|        try { $d = & $DefenderGet (Get-SISecurityScoreTable).DefenderUri } catch { $d = @{ Status = 0; Body = $null; Error = "$($_.Exception.Message)" } }
|        $r = ConvertFrom-SISecurityScoreAnswers -Graph $g -Defender $d
|        $prev = $global:SI_SecurityScoreState
|        $since = if ($prev -and @($prev.Refused).Count -and $prev.SinceUtc) { $prev.SinceUtc } else { $now }
|        $global:SI_SecurityScoreState = @{ Refused = @($r.Refused); SinceUtc = $(if (@($r.Refused).Count) { $since } else { $null }) }
|        $global:SI_SecurityScoreCache = @{ AtUtc = $now; Counts = $r.Counts }
|        $why = @(@($r.Refused | ForEach-Object { 'the permission {0} is not granted' -f $_ }) + @($r.Problems))
|        if ($why.Count -and -not $global:SI_SecurityScoreSaid) {
|            $global:SI_SecurityScoreSaid = $true
|            $line = (" [INFO] The status report leaves out a security score -- {0}." -f ($why -join '; '))
|            try { if ($Log) { & $Log $line } else { Write-Host $line } } catch { }
|        }
|        $o = [ordered]@{}; foreach ($k in @($r.Counts.Keys)) { $o[$k] = $r.Counts[$k] }
|        return $o
|    } catch { return [ordered]@{} }
|}
|
|function Get-SITelemetryHeartbeatCounts {
|    <#
|        The Counts of an identified heartbeat: users, guests, devices -- each only when it could be computed. Returns a
|        hashtable (possibly empty). -RunQuery as Get-SIDeviceCount; -RunHunting as Get-SIAdOnlyUserCount; -Log
|        { param($Line) } gets the one plain line when users carries the Entra part only (default: Write-Host). Never throws.
|    #>
|    # -SqlRows: the #719 read's seam (Get-SIRaTelemetryCounts)
|    # -WithScores: read the security scores (default: only in the hourly status report job, SI_ENGINE heartbeat -- an engine's
|    # end-of-run heartbeat never calls the score APIs); -GraphGet / -DefenderGet: their seams (Get-SISecurityScoreCounts)
|    param([scriptblock]$RunQuery, [datetime]$NowUtc = [datetime]::UtcNow, [scriptblock]$SqlScalar, [scriptblock]$RunHunting, [scriptblock]$Log, [scriptblock]$SqlRows,
|          [AllowNull()]$WithScores, [scriptblock]$GraphGet, [scriptblock]$DefenderGet)
|    if (-not $RunQuery) { $RunQuery = { param($Kql) Invoke-SITelemetryLaQuery -Query $Kql } }
|    $c = @{}
|    $s = Get-SISqlSpaceCounts -Scalar $SqlScalar
|    foreach ($k in @($s.Keys)) { $c[$k] = $s[$k] }
|    # #712: a collection newer than its source's last COMPLETE one (a collection in parts, still running) is never counted
|    $script:SICountCompleteBy = Get-SICountCompleteBy -SqlRows $SqlRows
|    try {
|        $rows = & $RunQuery (Get-SIIdentityCountQuery)
|        if ($null -ne $rows) {
|            $ic = Get-SIIdentityCounts -Row (@($rows) | Select-Object -First 1)
|            foreach ($k in @($ic.Keys)) { $c[$k] = $ic[$k] }
|        }
|    } catch { }
|    if ($c.ContainsKey('users')) {
|        # users' AD part (AD-only enabled user accounts from the Exposure Graph); unreadable = Entra only + one plain line
|        $ad = $null
|        try { $ad = Get-SIAdOnlyUserCount -RunHunting $RunHunting -RunQuery $RunQuery } catch { $ad = $null }
|        if ($null -ne $ad -and $null -ne $ad.Count) { $c['users'] = [long]$c['users'] + [long]$ad.Count }
|        else {
|            $why = if ($ad -and $ad.Reason) { $ad.Reason } else { 'the Exposure Graph could not be read' }
|            $line = (" [INFO] Today's status report counts Entra users only -- on-prem AD users are not included ({0})." -f $why)
|            try { if ($Log) { & $Log $line } else { Write-Host $line } } catch { }
|        }
|    }
|    $d =Get-SIDeviceCount -RunQuery $RunQuery -NowUtc $NowUtc
|    if ($null -ne $d) { $c['devices'] = $d }
|    try {
|        $inv = & $RunQuery (Get-SIInventoryCountQuery)
|        if ($null -ne $inv) { $ic = Get-SIInventoryCounts -Row (@($inv) | Select-Object -First 1); foreach ($k in @($ic.Keys)) { $c[$k] = $ic[$k] } }
|    } catch { }
|    try { $ra = Get-SIRaTelemetryCounts -SqlRows $SqlRows -Log $Log; foreach ($k in @($ra.Keys)) { $c[$k] = $ra[$k] } } catch { }
|    $scores = if ($null -ne $WithScores) { [bool]$WithScores } else { "$([Environment]::GetEnvironmentVariable('SI_ENGINE'))".Trim() -eq 'heartbeat' }
|    if ($scores) {
|        try { $sc = Get-SISecurityScoreCounts -GraphGet $GraphGet -DefenderGet $DefenderGet -NowUtc $NowUtc -Log $Log; foreach ($k in @($sc.Keys)) { $c[$k] = $sc[$k] } } catch { }
|    }
|    foreach ($k in @($c.Keys)) { if ((Get-SITelemetryCountNamesState) -notcontains $k) { $c.Remove($k) } }
|    $c
|}
'@ }
$__siSupportFiles['engine/data-model/identity/SI-ObjectLedgerStore.ps1'] = @{ Sha256 = '8384752e589f2d96c44cb93a4363ee91a047362c8d6dba3ecbe09479b0ba2ae0'; Text = @'
|#Requires -Version 5.1
|<#
|    SI v3 -- the identity ledger's SQL persistence. THIN ON PURPOSE.
|
|    Every decision lives in SI-ObjectIdentity.ps1, which is pure and has 24 tests. This file only moves
|    rows in and out, so the part that can be wrong without a database stays provable without one.
|
|    🔒 ENTRA-ONLY, CERTIFICATE AUTH. The server is created with azureADOnlyAuthentication, so there is
|    no SQL login to leak and no password to store -- matching the connect rules (SPN + certificate,
|    never a secret).
|
|    🔴 DEGRADE LOUDLY, NEVER DIE. If the ledger is unreachable the run still publishes: the map is the
|    customer's output and losing it to protect an id would be the wrong trade. What must NOT happen is
|    silently emitting a derived id that LOOKS durable -- so the rows go out marked
|    `SI_IdSource = derived-provisional`, which is true, and a connector is already forbidden from
|    creating CIs from those. An outage costs a late CI, never a duplicate one.
|#>
|
|# The rule for an identifier value longer than the table's column (ConvertTo-SILedgerStoredValue) lives with the pure
|# ledger functions; this file writes and looks up every value through it.
|if (-not (Get-Command -Name ConvertTo-SILedgerStoredValue -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-ObjectIdentity.ps1') }
|
|function Assert-SILedgerRowsFit {
|    <#
|        PURE. Refuses, BEFORE anything is written, a ledger row the table cannot hold -- in a moment, not after minutes of
|        writes that are then undone (2026-10-12: 18,820 anchors written for 10 minutes and all of them lost to one value).
|        -Rows: @{ Type; Value (as stored); CorrelationId }. The value's own length cannot fail any more (the short form
|        of a long value always fits); the type and the id are checked all the same. Throws with the first row that does
|        not fit and how many there are.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @())
|    $bad = 0; $first = ''
|    foreach ($r in $Rows) {
|        if ($null -eq $r) { continue }
|        $why = ''
|        if (([string]$r.Value).Length -gt 256) { $why = 'its value is {0} characters long (the most is 256)' -f ([string]$r.Value).Length }
|        elseif (([string]$r.Type).Length -gt 64) { $why = 'its type name is {0} characters long (the most is 64)' -f ([string]$r.Type).Length }
|        elseif (([string]$r.CorrelationId).Length -gt 64) { $why = 'its id is {0} characters long (the most is 64)' -f ([string]$r.CorrelationId).Length }
|        if ($why) { $bad++; if (-not $first) { $v = [string]$r.Value; if ($v.Length -gt 80) { $v = $v.Substring(0, 80) + '...' }; $first = "identifier '{0}' = '{1}': {2}" -f [string]$r.Type, $v, $why } }
|    }
|    if ($bad -gt 0) { throw ("the identity ledger cannot hold {0} identifier(s) of this run, so nothing was written to it (first: {1})" -f $bad, $first) }
|}
|
|function Get-SILedgerCertificate {
|    <#
|        The engine SPN's certificate, found WITHOUT depending on the `Cert:` provider.
|
|        🔑 The provider is not always there. A Windows PowerShell 5.1 child that inherits a pwsh 7
|        parent's PSModulePath resolves Microsoft.PowerShell.Security to the PS7 build, fails to load it,
|        and loses the `Cert:` drive with it -- so `Get-ChildItem Cert:\...` returns nothing for a
|        certificate that is installed and readable. That is framework finding AUTH-1, and this file had
|        its own copy of the same lookup. X509Store exists on both hosts, so the provider is the
|        convenience and the store is the authority.
|    #>
|    param([Parameter(Mandatory)][string]$Thumbprint)
|
|    $t = ($Thumbprint -replace '\s', '').ToUpperInvariant()
|    if ([string]::IsNullOrWhiteSpace($t)) { return $null }
|
|    foreach ($loc in 'LocalMachine', 'CurrentUser') {
|        $found = $null
|        if (Get-PSDrive -Name Cert -ErrorAction SilentlyContinue) {
|            $found = Get-ChildItem "Cert:\$loc\My" -ErrorAction SilentlyContinue |
|                     Where-Object { $_.Thumbprint -eq $t -and $_.HasPrivateKey } | Select-Object -First 1
|        }
|        if (-not $found) {
|            try {
|                $store = New-Object System.Security.Cryptography.X509Certificates.X509Store('My', $loc)
|                $store.Open('ReadOnly')
|                $found = @($store.Certificates | Where-Object { $_.Thumbprint -eq $t -and $_.HasPrivateKey })[0]
|                $store.Close()
|            } catch {
|                Write-Verbose ("ledger: X509Store {0}\My unreadable -- {1}" -f $loc, $_.Exception.Message)
|            }
|        }
|        if ($found) { return $found }
|    }
|    return $null
|}
|
|function Get-SILedgerAccessToken {
|    <#
|        A database.windows.net access token for the engine SPN, via a certificate-signed client
|        assertion.
|
|        🔴 MSAL IS DELIBERATELY NOT USED, and this is the whole point of the function.
|        `[Microsoft.Identity.Client.ConfidentialClientApplicationBuilder]` resolves under Windows
|        PowerShell 5.1, because Az.Accounts loads MSAL into the default context there. Under pwsh 7
|        Az.Accounts isolates its assemblies in a private load context, so the type does not exist and
|        the call throws "Unable to find type". Measured on one machine within the same minute:
|        5.1 -> ledger works, pwsh 7 -> ledger unavailable, publishing provisional ids.
|        🔑 That mattered because the VisualCron nightly runs every SI launcher under **pwsh 7**, so the
|        one host the schedule actually uses was the one host where durable ids silently stopped.
|        A signed assertion needs only System.Security and an HTTPS POST, which behave identically on
|        both hosts and cannot be disabled by someone else's module loading strategy.
|    #>
|    param(
|        [Parameter(Mandatory)][System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate,
|        [Parameter(Mandatory)][string]$AppId,
|        [Parameter(Mandatory)][string]$TenantId,
|        [string]$Scope = 'https://database.windows.net/.default'
|    )
|
|    # PS 5.1 defaults to TLS 1.0/1.1 on some hosts; the token endpoint requires 1.2+.
|    try {
|        if (([Net.ServicePointManager]::SecurityProtocol -band [Net.SecurityProtocolType]::Tls12) -ne [Net.SecurityProtocolType]::Tls12) {
|            [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
|        }
|    } catch { }
|
|    $b64url = {
|        param([byte[]]$Bytes)
|        [Convert]::ToBase64String($Bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_')
|    }
|
|    $tokenUri = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token"
|    $now      = [DateTimeOffset]::UtcNow.ToUnixTimeSeconds()
|
|    $header  = @{ alg = 'RS256'; typ = 'JWT'; x5t = (& $b64url $Certificate.GetCertHash()) } | ConvertTo-Json -Compress
|    $payload = @{ aud = $tokenUri; iss = $AppId; sub = $AppId; jti = [guid]::NewGuid().ToString()
|                  nbf = $now; exp = ($now + 600) } | ConvertTo-Json -Compress
|
|    $unsigned = (& $b64url ([Text.Encoding]::UTF8.GetBytes($header))) + '.' +
|                (& $b64url ([Text.Encoding]::UTF8.GetBytes($payload)))
|
|    $rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($Certificate)
|    if (-not $rsa) { throw ("ledger: certificate {0} has no usable RSA private key." -f $Certificate.Thumbprint) }
|    $sig = & $b64url ($rsa.SignData([Text.Encoding]::UTF8.GetBytes($unsigned),
|                                    [Security.Cryptography.HashAlgorithmName]::SHA256,
|                                    [Security.Cryptography.RSASignaturePadding]::Pkcs1))
|
|    # a time limit: without one this call waits for as long as the other side stays silent (PowerShell 7 has no default)
|    $resp = Invoke-RestMethod -Method Post -Uri $tokenUri -TimeoutSec 60 -Body @{
|        client_id             = $AppId
|        scope                 = $Scope
|        client_assertion_type = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
|        client_assertion      = "$unsigned.$sig"
|        grant_type            = 'client_credentials'
|    }
|    if (-not $resp.access_token) { throw 'ledger: token endpoint returned no access_token.' }
|    [string]$resp.access_token
|}
|
|# Test-SISqlTransientError: the shared SQL retry (engine\_shared\SI-SqlRetry.ps1) -- one list of transient Azure SQL faults
|. ([IO.Path]::Combine($PSScriptRoot, '..', '..', '_shared', 'SI-SqlRetry.ps1'))
|
|function Get-SIObjectLedgerConnection {
|    <#
|        A SqlConnection authenticated as the engine SPN with its certificate.
|        Returns $null when the ledger is not configured -- which is the normal state until an operator
|        points SI at a store, and must not be an error.
|    #>
|    param(
|        [Parameter()][string]$Server   = [string]$global:SI_LedgerSqlServer,
|        [Parameter()][string]$Database = [string]$global:SI_LedgerDatabase,
|        [int]$MaxAttempts = 4
|    )
|    if ([string]::IsNullOrWhiteSpace($Server) -or [string]::IsNullOrWhiteSpace($Database)) { return $null }
|
|    if ((Get-Command -Name Test-SIUseManagedIdentity -ErrorAction SilentlyContinue) -and (Test-SIUseManagedIdentity)) {
|        # #209: a container job signing in as its managed identity. Its database user is created once by the
|        # operator (CREATE USER [<identity name>] FROM EXTERNAL PROVIDER) -- setup prints that step.
|        $token = Get-SIManagedIdentityToken -Resource 'https://database.windows.net/'
|    } else {
|        $thumb  = [string]$global:SI_SPN_CertThumbprint
|        $appId  = [string]$global:SI_SPN_AppId
|        $tenant = [string]$global:SI_SPN_TenantId
|        if ([string]::IsNullOrWhiteSpace($thumb) -or [string]::IsNullOrWhiteSpace($appId)) {
|            throw 'ledger: SI_SPN_AppId / SI_SPN_CertThumbprint are empty -- the engine bridges these from HighPriv_Modern_* at entry; if they are missing here that bridge did not run.'
|        }
|
|        $cert = Get-SILedgerCertificate -Thumbprint $thumb
|        if (-not $cert) { throw ("ledger: certificate {0} not found with a private key in LocalMachine\My or CurrentUser\My (checked via the Cert: drive AND X509Store)." -f $thumb) }
|
|        $token = Get-SILedgerAccessToken -Certificate $cert -AppId $appId -TenantId $tenant
|    }
|
|    # The database is provisioned to RUN CONTINUOUSLY (no auto-pause), so a cold-start resume is not
|    # the expected path any more. The retry stays because Azure SQL is a shared service that can still
|    # throttle or fail over, and because a single attempt against ANY managed database is a coin flip.
|    # It is bounded and only covers the named transient codes -- see Test-SISqlTransientError.
|    $delay = 5
|    for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
|        $conn = New-Object System.Data.SqlClient.SqlConnection
|        $conn.ConnectionString = "Server=tcp:$Server,1433;Database=$Database;Encrypt=True;TrustServerCertificate=False;Connection Timeout=60;"
|        $conn.AccessToken = $token
|        try {
|            $conn.Open()
|            if ($attempt -gt 1) { Write-Warning ("ledger connected on attempt {0} of {1}" -f $attempt, $MaxAttempts) }
|            return $conn
|        } catch {
|            try { $conn.Dispose() } catch { }
|            $isTransient = Test-SISqlTransientError -ErrorRecord $_
|            if (-not $isTransient -or $attempt -eq $MaxAttempts) { throw }
|            # Write-Warning, not the engine's Write-Corr* helpers: those are defined in the CALLER, so a
|            # test dot-sourcing this file on its own would fail inside the retry -- the one path that
|            # must not add a second failure to the one it is recovering from.
|            Write-Warning ("ledger connect attempt {0}/{1} hit a transient fault ({2}); retrying in {3}s" -f `
|                            $attempt, $MaxAttempts, $_.Exception.Message.Split([char]10)[0].Trim(), $delay)
|            Start-Sleep -Seconds $delay
|            $delay = [Math]::Min($delay * 2, 40)
|        }
|    }
|}
|
|function Get-SIObjectLedger {
|    <#
|        The whole ledger as the hashtable Resolve-SIObjectIdentity expects:
|        "type|value" -> @{ CorrelationId; FirstSeen }.
|
|        Read whole rather than queried per anchor: a run resolves every object at once, and one round
|        trip against a table of this shape beats thousands. Revisit only if a real estate makes it hurt
|        -- not before, and with a measurement.
|    #>
|    param([Parameter()]$Connection)
|    $ledger = @{}
|    if ($null -eq $Connection) { return $ledger }
|
|    $cmd = $Connection.CreateCommand()
|    $cmd.CommandTimeout = 0
|    $cmd.CommandText = 'SELECT IdentifierType, IdentifierValue, SI_CorrelationId, FirstSeen FROM si.ObjectIdentity'
|    $rdr = $cmd.ExecuteReader()
|    try {
|        while ($rdr.Read()) {
|            $k = '{0}|{1}' -f ([string]$rdr['IdentifierType']).ToLowerInvariant(), ([string]$rdr['IdentifierValue']).ToLowerInvariant()
|            $ledger[$k] = @{ CorrelationId = [string]$rdr['SI_CorrelationId']; FirstSeen = [datetime]$rdr['FirstSeen'] }
|        }
|    } finally { $rdr.Close() }
|    $ledger
|}
|
|function Save-SIObjectLedger {
|    <#
|        Persist one run's decisions: new anchors, and any merge supersessions.
|
|        🔒 ONE TRANSACTION. A half-written merge is the worst possible state -- anchors re-pointed at a
|        survivor while the superseded row is missing means the connector never learns old -> new and
|        orphans a CI, which is precisely the failure the ledger exists to prevent. All or nothing.
|
|        Anchors are UPSERTed by (type, value), never blind-inserted: an anchor already present under
|        the same id is the normal case on every run after the first, and must be a no-op rather than a
|        primary-key violation.
|    #>
|    param(
|        [Parameter(Mandatory)]$Connection,
|        [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Decisions,
|        [Parameter()][AllowEmptyCollection()][object[]]$Superseded,
|        [Parameter()][datetime]$Now = ([datetime]::UtcNow)
|    )
|
|    # EVERY ROW IS MADE READY AND CHECKED BEFORE THE FIRST ONE IS WRITTEN: a value longer than the column goes in as its
|    # short form (ConvertTo-SILedgerStoredValue), and a row the table cannot hold is refused here, in a moment -- not by
|    # the database after minutes of writes that are then all undone.
|    $anchors = New-Object System.Collections.Generic.List[object]
|    foreach ($d in @($Decisions)) {
|        if ($null -eq $d -or [string]::IsNullOrWhiteSpace([string]$d.CorrelationId)) { continue }
|        foreach ($n in @($d.NewIdentifiers)) {
|            if ($null -eq $n) { continue }
|            $anchors.Add([pscustomobject]@{ Type = [string]$n.Type; Value = (ConvertTo-SILedgerStoredValue -Value ([string]$n.Value)); CorrelationId = [string]$n.CorrelationId })
|        }
|    }
|    Assert-SILedgerRowsFit -Rows $anchors.ToArray()
|
|    # 🔑 ONE STATEMENT, not one round trip per anchor (2026-10-16, #605: a first run or a rebuild writes tens of thousands of
|    # anchors, one MERGE each). The same rows land: an anchor written twice in one run keeps its LAST id (what the MERGEs
|    # in order left), a supersession written twice keeps its FIRST new id (what 'insert when not there' left) -- decided
|    # here, so the statement sees each key once. The same time: the run's time as the database stores a datetime
|    # parameter. Still ONE transaction (Get-SIObjectLedgerSetSql), all or nothing.
|    $byKey = New-Object 'System.Collections.Generic.Dictionary[string,object]' ([StringComparer]::OrdinalIgnoreCase)
|    $order = New-Object System.Collections.Generic.List[string]
|    foreach ($n in $anchors) {
|        $k = $n.Type + '|' + $n.Value
|        if (-not $byKey.ContainsKey($k)) { $order.Add($k) }
|        $byKey[$k] = $n
|    }
|    $a = @(foreach ($k in $order) { $n = $byKey[$k]; [ordered]@{ ty = [string]$n.Type; va = [string]$n.Value; cid = [string]$n.CorrelationId } })
|    $seenOld = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $s = @(foreach ($x in @($Superseded)) { if ($null -ne $x -and $seenOld.Add([string]$x.OldId)) { [ordered]@{ o = [string]$x.OldId; n = [string]$x.NewId } } })
|    $nowText = ([System.Data.SqlTypes.SqlDateTime]$Now).Value.ToString('o')
|    $p = @{ a = (ConvertTo-SILedgerJsonArray $a); s = (ConvertTo-SILedgerJsonArray $s); nowText = $nowText }
|    $null = @(Invoke-SIObjectLedgerSql -Connection $Connection -Sql (Get-SIObjectLedgerSetSql) -Params $p)
|    # the counts as before: every anchor and every supersession of the run's decisions
|    [pscustomobject]@{ AnchorsWritten = $anchors.Count; SupersededWritten = @(@($Superseded) | Where-Object { $null -ne $_ }).Count }
|}
|function Get-SIObjectLedgerSubsetSql {
|    <# The ledger rows of the given identifiers (@j = [{ t; v }]) and every row of the ids they point at. #>
|    @'
|SET NOCOUNT ON;
|DECLARE @k TABLE (IdentifierType NVARCHAR(64), IdentifierValue NVARCHAR(450), PRIMARY KEY (IdentifierType, IdentifierValue));
|INSERT @k SELECT DISTINCT t, v FROM OPENJSON(@j) WITH (t NVARCHAR(64), v NVARCHAR(450)) WHERE t IS NOT NULL AND v IS NOT NULL;
|WITH hit AS (SELECT o.SI_CorrelationId FROM si.ObjectIdentity o JOIN @k k ON o.IdentifierType = k.IdentifierType AND o.IdentifierValue = k.IdentifierValue)
|SELECT o.IdentifierType, o.IdentifierValue, o.SI_CorrelationId, o.FirstSeen FROM si.ObjectIdentity o
|WHERE o.SI_CorrelationId IN (SELECT SI_CorrelationId FROM hit);
|'@
|}
|
|function Invoke-SIObjectLedgerSql {
|    <# One statement on the ledger's open connection -> rows (objects). The seam both ledger functions below use. #>
|    param([Parameter(Mandatory)]$Connection, [Parameter(Mandatory)][string]$Sql, [hashtable]$Params = @{})
|    $cmd = $Connection.CreateCommand(); $cmd.CommandTimeout = 0; $cmd.CommandText = $Sql
|    foreach ($k in $Params.Keys) { $pp = $cmd.Parameters.Add('@' + $k, [System.Data.SqlDbType]::NVarChar, -1); $pp.Value = [string]$Params[$k] }
|    $rdr = $cmd.ExecuteReader()
|    try {
|        $names = @(for ($i = 0; $i -lt $rdr.FieldCount; $i++) { $rdr.GetName($i) })
|        while ($rdr.Read()) {
|            $o = [ordered]@{}
|            for ($i = 0; $i -lt $names.Count; $i++) { $v = $rdr.GetValue($i); if ($v -is [System.DBNull]) { $v = $null }; $o[$names[$i]] = $v }
|            [pscustomobject]$o
|        }
|    } finally { $rdr.Close() }
|}
|
|function ConvertTo-SILedgerJsonArray {
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Items)
|    if ($null -eq $Items -or @($Items).Count -eq 0) { return '[]' }
|    $j = ConvertTo-Json -InputObject @($Items) -Compress -Depth 3
|    if ($j.TrimStart().StartsWith('[')) { $j } else { '[' + $j + ']' }
|}
|
|function Get-SIObjectLedgerSubset {
|    <#
|        #477 / #501: the part of the ledger ONE batch of CIs needs, not the whole map -- the rows of the batch's identifiers
|        and every row of the ids those point at (Resolve-SIObjectIdentity reports an id's anchors that did not appear).
|        -Keys: @{ Type; Value } (canonical type). Same hashtable shape as Get-SIObjectLedger.
|        -Invoke { param($Sql, $Params, $Mode) } is the seam (tests); default = the connection.
|    #>
|    param([Parameter()]$Connection, [AllowEmptyCollection()][object[]]$Keys = @(), [scriptblock]$Invoke)
|    $ledger = @{}
|    if (@($Keys).Count -eq 0) { return $ledger }
|    # asked for as the table holds it: a value longer than the column under its short form (ConvertTo-SILedgerStoredValue).
|    # The rows come back under that short form too, and Resolve-SIObjectIdentity finds them (Get-SILedgerEntryKey).
|    $items = @(foreach ($k in $Keys) { [ordered]@{ t = [string]$k.Type; v = (ConvertTo-SILedgerStoredValue -Value ([string]$k.Value).ToLowerInvariant()) } })
|    $p = @{ j = (ConvertTo-SILedgerJsonArray $items) }
|    if ($Invoke) { $rows = @(& $Invoke (Get-SIObjectLedgerSubsetSql) $p 'rows') }
|    else { $rows = @(Invoke-SIObjectLedgerSql -Connection $Connection -Sql (Get-SIObjectLedgerSubsetSql) -Params $p) }
|    foreach ($r in $rows) {
|        if ($null -eq $r) { continue }
|        $k = '{0}|{1}' -f ([string]$r.IdentifierType).ToLowerInvariant(), ([string]$r.IdentifierValue).ToLowerInvariant()
|        $ledger[$k] = @{ CorrelationId = [string]$r.SI_CorrelationId; FirstSeen = [datetime]$r.FirstSeen }
|    }
|    $ledger
|}
|
|function Get-SIObjectLedgerSetSql {
|    <#
|        #501: one batch's ledger changes in ONE statement and ONE transaction (Save-SIObjectLedger sends one MERGE per
|        identifier -- a first run of a 100,000-record tenant is hundreds of thousands of round trips). The same rule:
|        anchors upserted by (type, value), a supersession written once per old id. @a = anchors, @s = supersessions.
|    #>
|    @'
|SET NOCOUNT ON;
|SET XACT_ABORT ON;
|DECLARE @now DATETIME2(3) = ISNULL(TRY_CONVERT(DATETIME2(3), @nowText, 127), SYSUTCDATETIME());
|DECLARE @x TABLE (IdentifierType NVARCHAR(64), IdentifierValue NVARCHAR(450), SI_CorrelationId NVARCHAR(64), PRIMARY KEY (IdentifierType, IdentifierValue));
|INSERT @x SELECT ty, va, MAX(cid) FROM OPENJSON(@a) WITH (ty NVARCHAR(64), va NVARCHAR(450), cid NVARCHAR(64))
|WHERE ty IS NOT NULL AND va IS NOT NULL AND cid IS NOT NULL GROUP BY ty, va;
|BEGIN TRANSACTION;
|MERGE si.ObjectIdentity AS t USING @x AS s
|   ON t.IdentifierType = s.IdentifierType AND t.IdentifierValue = s.IdentifierValue
|WHEN MATCHED THEN UPDATE SET SI_CorrelationId = s.SI_CorrelationId, LastSeen = @now
|WHEN NOT MATCHED THEN INSERT (IdentifierType, IdentifierValue, SI_CorrelationId, FirstSeen, LastSeen)
|     VALUES (s.IdentifierType, s.IdentifierValue, s.SI_CorrelationId, @now, @now);
|DECLARE @anchors INT = @@ROWCOUNT;
|INSERT INTO si.ObjectIdentitySuperseded (OldId, NewId, SupersededAt, Reason)
|SELECT s.o, MAX(s.n), @now, N'merge: anchors resolved to two ids' FROM OPENJSON(@s) WITH (o NVARCHAR(64), n NVARCHAR(64)) s
|WHERE s.o IS NOT NULL AND NOT EXISTS (SELECT 1 FROM si.ObjectIdentitySuperseded x WHERE x.OldId = s.o) GROUP BY s.o;
|DECLARE @sup INT = @@ROWCOUNT;
|COMMIT TRANSACTION;
|SELECT @anchors AS AnchorsWritten, @sup AS SupersededWritten;
|'@
|}
|
|function Save-SIObjectLedgerSet {
|    <# Persist one batch's decisions set-based (Get-SIObjectLedgerSetSql). -Invoke is the seam (tests). #>
|    param([Parameter()]$Connection, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Decisions, [AllowEmptyCollection()][object[]]$Superseded = @(),
|          [datetime]$Now = [datetime]::UtcNow, [scriptblock]$Invoke)
|    $a = New-Object System.Collections.Generic.List[object]
|    foreach ($d in @($Decisions)) {
|        if ($null -eq $d -or [string]::IsNullOrWhiteSpace([string]$d.CorrelationId)) { continue }
|        # a value longer than the column goes in as its short form (ConvertTo-SILedgerStoredValue) -- the statement would
|        # otherwise drop it without a word (over 450 characters) or fail the whole batch (257 to 450)
|        foreach ($n in @($d.NewIdentifiers)) { if ($n) { $a.Add([ordered]@{ ty = [string]$n.Type; va = (ConvertTo-SILedgerStoredValue -Value ([string]$n.Value)); cid = [string]$n.CorrelationId }) } }
|    }
|    # refused here, before the statement runs, when a row cannot be held at all
|    Assert-SILedgerRowsFit -Rows @(foreach ($x in $a) { [pscustomobject]@{ Type = $x.ty; Value = $x.va; CorrelationId = $x.cid } })
|    $s = @(foreach ($x in @($Superseded)) { if ($x) { [ordered]@{ o = [string]$x.OldId; n = [string]$x.NewId } } })
|    if ($a.Count -eq 0 -and $s.Count -eq 0) { return [pscustomobject]@{ AnchorsWritten = 0; SupersededWritten = 0 } }
|    $p = @{ a = (ConvertTo-SILedgerJsonArray $a.ToArray()); s = (ConvertTo-SILedgerJsonArray $s); nowText = $Now.ToUniversalTime().ToString('o') }
|    if ($Invoke) { $rows = @(& $Invoke (Get-SIObjectLedgerSetSql) $p 'rows') }
|    else { $rows = @(Invoke-SIObjectLedgerSql -Connection $Connection -Sql (Get-SIObjectLedgerSetSql) -Params $p) }
|    if ($rows.Count -gt 0 -and $rows[0]) { return [pscustomobject]@{ AnchorsWritten = [int]$rows[0].AnchorsWritten; SupersededWritten = [int]$rows[0].SupersededWritten } }
|    [pscustomobject]@{ AnchorsWritten = 0; SupersededWritten = 0 }
|}
'@ }
$__siSupportFiles['engine/data-model/identity/SI-ObjectIdentity.ps1'] = @{ Sha256 = 'f561066dbf68d40218839a779da71b4b2e24a1220992d6065afc8f271c56b088'; Text = @'
|#Requires -Version 5.1
|<#
|    SI v3 -- THE IDENTITY LEDGER, as pure functions.
|
|    Operator decision 2026-08-13 (V3-ARCHITECTURE 2.3a): a minted, stored SI_CorrelationId plus an
|    anchor ledger and a superseded table. ANCHORS ARE HOW WE RECOGNISE AN ASSET; THEY ARE NEVER WHAT WE
|    CALL IT.
|
|    🔴 WHY THIS EXISTS, and it is a correctness fix rather than an optimisation.
|    Get-SICorrelationId seeds from the ordinally-lowest value of the highest-priority type PRESENT IN
|    THE GROUP. That is `same INPUT -> same id`, which is NOT what a connector needs -- it needs
|    `same OBJECT -> same id`. The two diverge the moment group membership changes, and membership is not
|    stable:
|
|      * MEASURED 2026-08-13: adding one member carrying a lower-sorting exposure-graph id moved a group
|        from `exposuregraphnodeid:aaa` to `exposuregraphnodeid:000`.
|      * The same day, EndpointEG timed out at 0 rows and 51 assets left the snapshot entirely.
|      * Anchors churn regardless: MDE device ids rotate, a rebuilt VM gets a new ARM path, a re-enrolled
|        device gets a new AadDeviceId. Editing SISeedPriority would re-key the whole estate at once.
|
|    A ServiceNow CI bound to a key that moves becomes a SECOND CI, and duplicate CIs are effectively
|    permanent once incidents point at them.
|
|    🔑 WHY NOT "PICK A DURABLE NATIVE ID AND RE-PICK WHEN IT DIES" -- considered and rejected by the
|    operator. Re-picking IS the orphaning event. Their own example proves anchors die while assets live:
|    decommission AD sync and the SID goes. Everyone who tried natural-key-as-identity built the alias
|    table anyway -- sIDHistory, and Entra Connect keying ms-DS-ConsistencyGuid rather than SID.
|    ServiceNow's own answer is correlation_id PLUS the IRE identification rules.
|
|    PURE ON PURPOSE. No SQL, no I/O. The store is a detail; the DECISIONS are the part worth proving,
|    and they are provable before a schema exists. Same reasoning as SI-CorrelationCore.
|
|    NO Set-StrictMode here -- it leaks into the caller's scope (measured 2026-08-12).
|#>
|
|# Namespace for SI's UUIDv5 derivation. Fixed forever: changing it re-keys every asset in every estate,
|# which is the one thing this file exists to prevent. Chosen once, never generated at runtime.
|$script:SIObjectIdNamespace = [guid]'6b1f4a2e-8c33-5d47-9a10-2f7e5c8d4b91'
|
|# The birth anchor's type priority. The correlation engine (Pro) sets the same list in SI-CorrelationCore.ps1; the CI build
|# runs WITHOUT it in Community (Risk Analysis builds the CIs), where this list was missing and every object minted the
|# same id. Same values -- one list, set here when the correlation engine has not.
|if (-not $script:SISeedPriority) {
|    $script:SISeedPriority = @('ExposureGraphNodeId', 'EgNodeId', 'AzureResourceId', 'AadDeviceId', 'AadObjectId', 'MdeDeviceId',
|        'ActiveDirectoryObjectGuid', 'SecurityIdentifier', 'OnPremObjectGuid', 'AzureVmId')
|}
|
|# #642 THE IDENTIFIER TYPES ONE OBJECT HOLDS EXACTLY ONCE (lower-case canonical type). A service principal has one object id
|# and one app id; an Azure resource is its one resource id; an Exposure Graph node and an AD object guid name one object.
|# Types that legitimately rotate or come in several on one object (a Defender device id after a re-onboarding, an Entra
|# device id after a re-registration, a SID with history) are NOT here -- they never prove two objects apart.
|$script:SIOnePerObjectIdTypes = @('aadobjectid', 'aadappid', 'azureresourceid', 'exposuregraphnodeid', 'activedirectoryobjectguid', 'cloudnativeresourceid')
|
|function Test-SILedgerWrongMerge {
|    <#
|        PURE. #642 IS THIS GROUP PROVABLY ANOTHER OBJECT THAN THE REST OF THE LEDGER ID IT RESOLVED TO?
|
|        Found at a ring 1 install 2026-10-13: one ledger id held 11 different service principals (11 object ids, 11 app ids,
|        11 Exposure Graph nodes, all born in ONE run) -- separate per-subscription service principals with the same display
|        name. An Exposure Graph node matched BY DISPLAY NAME had given every one of them the same node id (Invoke-Collect.ps1,
|        identity EG enrichment), the correlation fused them on it, and the ledger kept the fusion for good: every run after
|        that each service principal resolved to the one id again.
|
|        The proof needs no guess about sources that failed (the reason Resolve-SIObjectIdentity never splits on its own): for
|        TWO OR MORE identifier types an object holds only once ($script:SIOnePerObjectIdTypes), the id holds a value of the
|        group's own type that the group does not carry, and that value was written in the SAME RUN as the group's own value
|        (FirstSeen within one second). One object cannot have two object ids AND two app ids born in the same run; an object
|        whose id rotated over time (a new value in a later run) is never taken for two objects.
|
|        -Ids: the group's identifiers (Type, Value; canonical, lower-cased). -AnchorKeys: the ledger keys of the id (Get-SILedgerKeysOfId).
|        Returns @{ Proven; Types = the conflicting types }.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Ids, [Parameter()][AllowNull()][hashtable]$Ledger,
|          [Parameter()][AllowEmptyCollection()][string[]]$AnchorKeys = @())
|    $none = [pscustomobject]@{ Proven = $false; Types = @() }
|    if ($null -eq $Ledger -or @($AnchorKeys).Count -eq 0) { return $none }
|    # the group's own anchors under this id, by type: key -> FirstSeen
|    $own = @{}; $ownKeys = @{}
|    foreach ($id in $Ids) {
|        $t = ([string]$id.Type).ToLowerInvariant()
|        if ($script:SIOnePerObjectIdTypes -notcontains $t) { continue }
|        $k = Get-SILedgerEntryKey -Ledger $Ledger -Type ([string]$id.Type) -Value ([string]$id.Value)
|        $ownKeys[(Get-SILedgerKey -Type ([string]$id.Type) -Value ([string]$id.Value))] = $true
|        if ($null -eq $k) { continue }
|        $ownKeys[$k] = $true
|        if (-not $own.ContainsKey($t)) { $own[$t] = New-Object System.Collections.Generic.List[datetime] }
|        if ($null -ne $Ledger[$k].FirstSeen) { $own[$t].Add([datetime]$Ledger[$k].FirstSeen) }
|    }
|    foreach ($x in @($own.Keys)) { if ($own[$x].Count -eq 0) { $own.Remove($x) } }
|    if ($own.Count -lt 2) { return $none }
|    $types = New-Object System.Collections.Generic.List[string]
|    foreach ($ak in $AnchorKeys) {
|        if ($ownKeys.ContainsKey($ak)) { continue }
|        $cut = ([string]$ak).IndexOf('|'); if ($cut -lt 1) { continue }
|        $t = ([string]$ak).Substring(0, $cut)
|        if (-not $own.ContainsKey($t) -or $types.Contains($t)) { continue }
|        if ($null -eq $Ledger[$ak] -or $null -eq $Ledger[$ak].FirstSeen) { continue }
|        $fs = [datetime]$Ledger[$ak].FirstSeen
|        foreach ($mine in $own[$t]) { if ([Math]::Abs(($fs - $mine).TotalSeconds) -lt 1) { $types.Add($t); break } }
|    }
|    [pscustomobject]@{ Proven = ($types.Count -ge 2); Types = $types.ToArray() }
|}
|
|function Get-SILedgerIdKeeperKey {
|    <#
|        PURE. #642 The ledger key of the anchor whose object KEEPS a ledger id when the id is found to hold several objects:
|        the anchor the id was minted from (its v5 id is the id itself) -- else the oldest anchor (FirstSeen), ties broken by
|        the ordinally lowest key. Decided from the ledger alone, so every batch of a CI build and every engine agree on it.
|    #>
|    param([Parameter(Mandatory)][string]$CorrelationId, [Parameter()][AllowNull()][hashtable]$Ledger,
|          [Parameter()][AllowEmptyCollection()][string[]]$AnchorKeys = @())
|    $best = $null; $bestT = $null
|    foreach ($ak in $AnchorKeys) {
|        if ((New-SIObjectUuidV5 -Name ([string]$ak)).ToString() -eq $CorrelationId) { return [string]$ak }
|        $t = [datetime]::MaxValue; if ($null -ne $Ledger[$ak] -and $null -ne $Ledger[$ak].FirstSeen) { $t = [datetime]$Ledger[$ak].FirstSeen }
|        if ($null -eq $best -or $t -lt $bestT -or ($t -eq $bestT -and [string]::CompareOrdinal([string]$ak, $best) -lt 0)) { $best = [string]$ak; $bestT = $t }
|    }
|    $best
|}
|
|function New-SIObjectUuidV5 {
|    <#
|        RFC 4122 v5 (SHA-1, name-based) UUID.
|
|        DETERMINISTIC AT BIRTH, which is the whole point of choosing v5 over a random GUID: if the
|        ledger is ever lost, ids can be PARTIALLY rebuilt by re-deriving from the anchors that are still
|        present, instead of re-keying the estate and orphaning every CI. A random GUID would have made
|        loss unrecoverable.
|
|        🔒 It is derived ONCE, at birth, and then STORED. It is never re-derived at runtime to answer
|        "what is this object called" -- that would reintroduce exactly the anchor-dependence this
|        design removes. Derivation is for minting and for disaster recovery, nothing else.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Name,
|        [Parameter()][guid]$Namespace = $script:SIObjectIdNamespace
|    )
|
|    # Namespace goes in BIG-ENDIAN network order, per RFC 4122. .NET's Guid.ToByteArray() returns the
|    # first three fields little-endian, so they must be flipped or the id differs from every other
|    # implementation -- and an id that disagrees with the rest of the world is a bug we would only find
|    # when someone cross-checked it.
|    $nb = $Namespace.ToByteArray()
|    [Array]::Reverse($nb, 0, 4)
|    [Array]::Reverse($nb, 4, 2)
|    [Array]::Reverse($nb, 6, 2)
|
|    # 🪤 NOT `$name` -- PowerShell variable names are CASE-INSENSITIVE, so `$name` IS the `[string]$Name`
|    # parameter. Assigning a byte[] into it silently COERCES back to a string, and `.Length` then counts
|    # characters instead of bytes: the buffer is sized wrong and Array.Copy dies with "Source array was
|    # not long enough". It failed on some inputs and not others, which is what made it look like a data
|    # problem rather than a shadowing one.
|    $nameBytes = [System.Text.Encoding]::UTF8.GetBytes($Name)
|    $buf = New-Object byte[] ($nb.Length + $nameBytes.Length)
|    [Array]::Copy($nb, 0, $buf, 0, $nb.Length)
|    [Array]::Copy($nameBytes, 0, $buf, $nb.Length, $nameBytes.Length)
|
|    $sha = [System.Security.Cryptography.SHA1]::Create()
|    try { $hash = $sha.ComputeHash($buf) } finally { $sha.Dispose() }
|
|    $out = New-Object byte[] 16
|    [Array]::Copy($hash, 0, $out, 0, 16)
|    $out[6] = [byte](($out[6] -band 0x0F) -bor 0x50)   # version 5
|    $out[8] = [byte](($out[8] -band 0x3F) -bor 0x80)   # RFC 4122 variant
|
|    # Flip back to .NET's little-endian layout so [guid] renders the canonical string.
|    [Array]::Reverse($out, 0, 4)
|    [Array]::Reverse($out, 4, 2)
|    [Array]::Reverse($out, 6, 2)
|    [guid][byte[]]$out
|}
|
|function Get-SIObjectBirthAnchor {
|    <#
|        The anchor an object is BORN with: highest-priority identifier type present, and within that
|        type the ordinally-lowest value.
|
|        Reuses SISeedPriority so birth and today's seed agree -- but note the difference that matters:
|        this is consulted ONCE, at mint. After that the id is stored and the anchor may die freely.
|
|        ORDINAL, never Sort-Object: culture-sensitive sort makes the same object mint a different id on
|        a Danish host than an English one (see Sort-SIOrdinal). SI ships to ~6,000 installs whose locale
|        we do not choose.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Identifiers)
|
|    $ids = @($Identifiers | Where-Object { $null -ne $_ })
|    if ($ids.Count -eq 0) { return $null }
|
|    foreach ($type in $script:SISeedPriority) {
|        $vals = @()
|        foreach ($id in $ids) { if ($id.Type -ieq $type) { $vals += [string]$id.Value } }
|        if ($vals.Count -gt 0) {
|            $first = @(Sort-SIOrdinal -Value $vals)[0]
|            return [pscustomobject]@{ Type = (Get-SICanonicalIdType -Type $type); Value = [string]$first }
|        }
|    }
|    # 🔴 No type of the priority list (a public IP, an Intune-only device, an app id): the ordinally-lowest ledger key of
|    # what the object HAS. Returning nothing here minted every such object from the empty key -- ONE id for all of them
|    # (#477, 2026-10-09: found when the CI build ran without the correlation engine, where the list was not even loaded).
|    $keys = @(foreach ($id in $ids) { Get-SILedgerKey -Type ([string]$id.Type) -Value ([string]$id.Value) })
|    $low = @(Sort-SIOrdinal -Value $keys)[0]
|    $cut = $low.IndexOf('|')
|    $match = @($ids | Where-Object { (Get-SILedgerKey -Type ([string]$_.Type) -Value ([string]$_.Value)) -ceq $low })[0]
|    [pscustomobject]@{ Type = (Get-SICanonicalIdType -Type ([string]$match.Type)); Value = $low.Substring($cut + 1) }
|}
|
|function Get-SILedgerKey {
|    <# The ledger's lookup key. Canonicalised and lower-cased, so one fact cannot have two spellings. #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Type,
|          [Parameter(Mandatory)][AllowEmptyString()][string]$Value)
|    # while Resolve-SIObjectIdentity runs, every key is made once (2026-10-16: five times per identifier of every object --
|    # a quarter of the correlation job's ledger step on a large install); the same text, from a table of this call's keys
|    $memo = $script:SILedgerKeyMemo
|    if ($null -ne $memo) {
|        $mk = $Type + [char]1 + $Value
|        $hit = $null
|        if ($memo.TryGetValue($mk, [ref]$hit)) { return $hit }
|        $k = '{0}|{1}' -f (Get-SICanonicalIdType -Type $Type).ToLowerInvariant(), ([string]$Value).ToLowerInvariant()
|        $memo[$mk] = $k
|        return $k
|    }
|    '{0}|{1}' -f (Get-SICanonicalIdType -Type $Type).ToLowerInvariant(), ([string]$Value).ToLowerInvariant()
|}
|
|# The widest identifier value the ledger's table holds is 256 characters (si.ObjectIdentity.IdentifierValue,
|# NVARCHAR(256)). The column is part of the table's primary key, so it cannot simply be made wider: SQL Server limits a
|# clustered key to 900 bytes, and the type (64 characters) + 256 characters already take 640 of them.
|function ConvertTo-SILedgerStoredValue {
|    <#
|        PURE. THE ONE RULE for an identifier value that is longer than the ledger's column (an Azure resource id can be
|        2,000 characters and more): the value as the ledger's table stores it and looks it up.
|
|          256 characters or fewer -> the value itself, untouched
|          longer                  -> '~sha256:' + SHA-256 of the lower-cased value (64 hex) + ':' + its first 160 characters
|
|        The same long value always gives the same short form (so it is found again), two different long values never give
|        the same one (the hash decides; the readable start is only there so a person can see what it is). Always 233
|        characters or fewer. The id an object is BORN with is still derived from the full value (New-SIObjectUuidV5) --
|        this is only what the table holds.
|
|        Found 2026-10-12: a new install's first run wrote 18,820 anchors for 10 minutes and lost all of them, because one
|        Azure resource id did not fit the column.
|
|        (The two numbers are written out, not read from the variables above: this function is also called where this
|        file's script scope is not the caller's.)
|    #>
|    param([Parameter()][AllowNull()][AllowEmptyString()][string]$Value)
|    if ($null -eq $Value) { return '' }
|    if ($Value.Length -le 256) { return $Value }
|    $low = $Value.ToLowerInvariant()
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $hex = ([System.BitConverter]::ToString($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($low))) -replace '-', '').ToLowerInvariant() }
|    finally { $sha.Dispose() }
|    $head = $low.Substring(0, 160)
|    # never half of a two-part character at the cut
|    if ([char]::IsHighSurrogate($head[$head.Length - 1])) { $head = $head.Substring(0, $head.Length - 1) }
|    '~sha256:' + $hex + ':' + $head
|}
|
|function Get-SILedgerEntryKey {
|    <#
|        PURE. The key under which -Ledger holds this identifier, or $null when it does not: the plain key, or -- for a
|        value longer than the ledger's column -- the key of its stored short form (what a ledger read from the table
|        carries; ConvertTo-SILedgerStoredValue). A ledger kept as a file holds long values whole, so the plain key is
|        asked first.
|    #>
|    param([Parameter()][AllowNull()][hashtable]$Ledger,
|          [Parameter(Mandatory)][AllowEmptyString()][string]$Type,
|          [Parameter(Mandatory)][AllowEmptyString()][string]$Value)
|    if ($null -eq $Ledger) { return $null }
|    $k = Get-SILedgerKey -Type $Type -Value $Value
|    if ($Ledger.ContainsKey($k)) { return $k }
|    if ($Value.Length -gt 256) {
|        $k2 = Get-SILedgerKey -Type $Type -Value (ConvertTo-SILedgerStoredValue -Value $Value)
|        if ($Ledger.ContainsKey($k2)) { return $k2 }
|    }
|    $null
|}
|
|function Get-SILedgerKeysById {
|    <#
|        PURE. The ledger's keys by the id they point at, for "which anchors does this id hold" without
|        reading the whole ledger once per object.
|
|        Returns { LedgerKeys = <every ledger key, in the ledger's own order>; ById = <id -> positions in
|        LedgerKeys, ascending>; Other = <positions whose id is not plain text> }.
|
|        🔒 IT MUST FIND EXACTLY WHAT `[string]$Ledger[$k].CorrelationId -eq $cid` FINDS, in the same order.
|        `-eq` on strings ignores case by the invariant culture's rules. For PLAIN text (printable ASCII --
|        every id SI mints is a GUID) that is the same as an ordinal ignore-case match, which is what the
|        lookup uses. An id with any other character is NOT indexed: it is kept in `Other` and compared with
|        `-eq` itself (Get-SILedgerKeysOfId), so nothing is matched differently for it.
|    #>
|    param([Parameter()][AllowNull()][hashtable]$Ledger)
|    $byId  = New-Object 'System.Collections.Generic.Dictionary[string,System.Collections.Generic.List[int]]' ([StringComparer]::OrdinalIgnoreCase)
|    $other = New-Object System.Collections.Generic.List[int]
|    $keys  = @()
|    if ($null -ne $Ledger) { $keys = @($Ledger.Keys) }
|    for ($i = 0; $i -lt $keys.Count; $i++) {
|        $c = [string]$Ledger[$keys[$i]].CorrelationId
|        # \z, not $: a trailing line break is not plain text
|        if ([regex]::IsMatch($c, '^[\x20-\x7E]*\z')) {
|            $list = $null
|            if (-not $byId.TryGetValue($c, [ref]$list)) { $list = New-Object System.Collections.Generic.List[int]; $byId[$c] = $list }
|            [void]$list.Add($i)
|        } else { [void]$other.Add($i) }
|    }
|    [pscustomobject]@{ LedgerKeys = $keys; ById = $byId; Other = $other }
|}
|
|function Get-SILedgerKeysOfId {
|    <#
|        PURE. The ledger keys that point at -CorrelationId, in the ledger's own order -- what a scan of
|        every key with `[string]$Ledger[$k].CorrelationId -eq $CorrelationId` answers (Get-SILedgerKeysById).
|    #>
|    param([Parameter(Mandatory)]$Index, [Parameter()][AllowNull()][hashtable]$Ledger, [Parameter()][AllowNull()][AllowEmptyString()][string]$CorrelationId)
|    $keys = $Index.LedgerKeys
|    $pos  = New-Object System.Collections.Generic.List[int]
|    if ([regex]::IsMatch([string]$CorrelationId, '^[\x20-\x7E]*\z')) {
|        $list = $null
|        if ($Index.ById.TryGetValue($CorrelationId, [ref]$list)) { foreach ($i in $list) { [void]$pos.Add($i) } }
|        # ids that are not plain text: compared exactly as before, and put back in the ledger's order
|        if ($Index.Other.Count -gt 0) {
|            foreach ($i in $Index.Other) { if ([string]$Ledger[$keys[$i]].CorrelationId -eq $CorrelationId) { [void]$pos.Add($i) } }
|            $pos.Sort()
|        }
|    } else {
|        # the id asked for is not plain text: the scan, as before
|        for ($i = 0; $i -lt $keys.Count; $i++) { if ([string]$Ledger[$keys[$i]].CorrelationId -eq $CorrelationId) { [void]$pos.Add($i) } }
|    }
|    foreach ($i in $pos) { $keys[$i] }
|}
|
|function Get-SISupersededRowValue {
|    <# PURE. One value of a row (a dictionary or an object), without case. #>
|    param($Row, [string]$Name)
|    if ($null -eq $Row) { return $null }
|    if ($Row -is [System.Collections.IDictionary]) { foreach ($k in $Row.Keys) { if ([string]$k -ieq $Name) { return $Row[$k] } }; return $null }
|    $p = $Row.PSObject.Properties[$Name]; if ($p) { return $p.Value }
|    $null
|}
|
|function ConvertTo-SISupersededMap {
|    <#
|        PURE. THE MERGED-AWAY IDS (owner 2026-11-05: "ci object must be the stable id"): rows { OldId; NewId; At } -> a
|        case-insensitive map old id -> the id it was merged into. Sources (the CI build reads them): the identity ledger's
|        si.ObjectIdentitySuperseded, sidata.AssetIdHistory's CI->CI 'merge' events (both ids are CIs) and every retired CI
|        that names si_merged_into.
|        ONE ANSWER PER OLD ID, deterministic: the NEWEST event (At) wins; equal times -> the ordinally lowest new id. A row
|        whose old and new id are the same is ignored.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @())
|    $map = New-Object 'System.Collections.Hashtable' ([StringComparer]::OrdinalIgnoreCase)
|    $at = New-Object 'System.Collections.Hashtable' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $o = ([string](Get-SISupersededRowValue $r 'OldId')).Trim(); $n = ([string](Get-SISupersededRowValue $r 'NewId')).Trim()
|        if (-not $o -or -not $n -or $o -ieq $n) { continue }
|        $t = [datetime]::MinValue
|        $tv = Get-SISupersededRowValue $r 'At'
|        if ($tv -is [datetime]) { $t = ([datetime]$tv).ToUniversalTime() }
|        elseif ($tv) { $p = [datetime]::MinValue; if ([datetime]::TryParse([string]$tv, [Globalization.CultureInfo]::InvariantCulture, ([Globalization.DateTimeStyles]::AssumeUniversal -bor [Globalization.DateTimeStyles]::AdjustToUniversal), [ref]$p)) { $t = $p } }
|        if (-not $map.ContainsKey($o) -or $t -gt $at[$o] -or ($t -eq $at[$o] -and [string]::CompareOrdinal($n.ToLowerInvariant(), ([string]$map[$o]).ToLowerInvariant()) -lt 0)) {
|            $map[$o] = $n.ToLowerInvariant(); $at[$o] = $t
|        }
|    }
|    $map
|}
|
|function Resolve-SISupersededId {
|    <#
|        PURE. The id -Id stands for NOW: the merge chain followed to its end (a -> b -> c answers c). A merged-away id is
|        never an id of its own again. A cycle (a -> b -> a, two contradicting merges) ends on the ordinally lowest id of the
|        cycle, so every batch and every host answers the same. No map, or an id that was never merged: the id itself.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Id, [hashtable]$Map)
|    if (-not $Id -or $null -eq $Map -or $Map.Count -eq 0) { return $Id }
|    $cur = $Id
|    $path = New-Object System.Collections.Generic.List[string]
|    $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    while ($Map.ContainsKey($cur)) {
|        if (-not $seen.Add($cur)) {
|            # a cycle: the ordinally lowest id of the cycle
|            $start = $path.IndexOf(($path | Where-Object { $_ -ieq $cur } | Select-Object -First 1))
|            $low = $null
|            for ($i = $start; $i -lt $path.Count; $i++) { $c = $path[$i].ToLowerInvariant(); if ($null -eq $low -or [string]::CompareOrdinal($c, $low) -lt 0) { $low = $c } }
|            return $low
|        }
|        $path.Add($cur)
|        $cur = [string]$Map[$cur]
|    }
|    $cur
|}
|
|function Resolve-SIObjectIdentity {
|    <#
|        Decide each group's SI_CorrelationId against the existing ledger, and say what the ledger must
|        become. Returns decisions; it does not write anything.
|
|        Ledger is a hashtable: "type|value" -> @{ CorrelationId; FirstSeen }.
|        Absent or empty means a first run, in which case everything mints -- which is correct, and is
|        also the disaster-recovery path.
|
|          MINT   no identifier is known         -> derive a v5 id from the birth anchor
|          REUSE  all known identifiers agree    -> take the existing id, record any new identifiers
|          MERGE  identifiers name 2+ ids        -> keep the OLDEST, supersede the rest, emit old->new
|
|        🔒 THE OLDEST SURVIVES, not the "best". Any other rule (lowest tier, most members, newest) makes
|        the surviving id depend on this run's data, which is the exact property being removed. FirstSeen
|        decides; an ordinal id compare breaks ties so two hosts never disagree.
|
|        ◻ SPLIT DETECTION IS DEFERRED, AND DELIBERATELY NOT GUESSED. A genuine split -- one object whose
|        identifiers stop co-occurring -- cannot be told apart from "a source failed and half the
|        identifiers are missing this run" by looking at one run. Getting that wrong RETIRES A LIVE CI,
|        which is worse than a late one. It needs either two consecutive runs agreeing or an explicit
|        operator action, and that is a separate decision. What this DOES do is report the shrink
|        (`ShrunkObjects`) so it is visible rather than silent.
|        🔑 THE ONE EXCEPTION, #642: a group that PROVABLY is another object than the rest of its id (Test-SILedgerWrongMerge
|        -- two or more types an object holds once, each with another value written in the same run) is split off: a source
|        that failed cannot produce that, a fused group can. The object the id was minted from keeps it (Action 'split',
|        Splits Kind 'wrong-merge', counted in WrongMergeSplit).
|
|        🔴 -AmbiguousIdKeys (#61.4, added 2026-08-20 after a LIVE failure). Ledger keys carried by more
|        than one object this run, which happens only when an operator never-merge kept two groups
|        apart. Such a key identifies NEITHER group any more, so it is excluded from three places --
|        and ALL THREE are required, or the fix does not survive to the next run:
|
|          1. the `$known` LOOKUP   -- or the shared anchor drags both halves back onto one id
|          2. the BIRTH ANCHOR      -- or both halves mint the SAME v5 id from the shared value
|          3. the ledger WRITE-BACK -- or the re-minted half claims the shared anchor, and next run the
|                                      other half follows it and they MERGE again
|
|        Measured before the fix: `distinct durable ids: 1 for 2 objects`. The derived seed was already
|        correct by then, so the published map looked right while the LEDGER re-fused them -- and a
|        durable id is exactly the one a connector is permitted to create CIs from.
|    #>
|    param(
|        # AllowNull as well as AllowEmptyCollection: a caller flattening several sources can hand us an
|        # array with a null element, and binding must not refuse it. The loop skips nulls itself.
|        [Parameter(Mandatory)][AllowNull()][AllowEmptyCollection()][object[]]$Groups,
|        [Parameter()][hashtable]$Ledger,
|        [Parameter()][datetime]$Now = ([datetime]'2000-01-01T00:00:00Z'),
|        [Parameter()][AllowNull()][hashtable]$AmbiguousIdKeys,
|        # THE MERGED-AWAY IDS (ConvertTo-SISupersededMap: old id -> the id it was merged into). An id the ledger still
|        # names for an identifier but that was merged away is NEVER used again: it resolves to the end of its merge chain
|        # (Resolve-SISupersededId) and EVERY anchor it still holds is re-pointed there (owner 2026-11-05, a ring 1 install:
|        # an old Exposure Graph node id of a VM still pointed at the merged twin, and the build brought the twin back)
|        [Parameter()][AllowNull()][hashtable]$MergedAway
|    )
|
|    if ($null -eq $Ledger) { $Ledger = @{} }
|    # the ledger keys of this call, each made once (Get-SILedgerKey); dropped at the end of the call
|    $script:SILedgerKeyMemo = New-Object 'System.Collections.Generic.Dictionary[string,string]' ([StringComparer]::Ordinal)
|    $hasAmbiguous = ($null -ne $AmbiguousIdKeys -and $AmbiguousIdKeys.Keys.Count -gt 0)
|
|    $decisions   = New-Object System.Collections.Generic.List[object]
|    $superseded  = New-Object System.Collections.Generic.List[object]
|    $shrunk      = New-Object System.Collections.Generic.List[object]
|    $splits      = New-Object System.Collections.Generic.List[object]
|    $unkeyable   = 0
|    $keysById    = $null   # the ledger's keys by id, built when the first object that is not new needs it
|    $keeperKeys  = @{}      # #642 per ledger id: the key of the anchor whose object keeps the id
|
|    foreach ($g in @($Groups)) {
|        if ($null -eq $g) { continue }
|
|        # Every identifier the group carries, across all members, canonicalised.
|        $idsAll = New-Object System.Collections.Generic.List[object]
|        foreach ($m in @($g.Members)) {
|            foreach ($id in (Get-SIMemberIdentifiers -Member $m)) {
|                [void]$idsAll.Add([pscustomobject]@{
|                    Type  = (Get-SICanonicalIdType -Type ([string]$id.Type))
|                    Value = ([string]$id.Value).ToLowerInvariant()
|                })
|            }
|        }
|
|        # Identity is decided on the UNAMBIGUOUS subset. A group whose ONLY anchors are contested falls
|        # back to the full set rather than being declared unkeyable -- it still needs an id, and the
|        # collision pass below reports what could not be separated.
|        $ids = $idsAll
|        if ($hasAmbiguous) {
|            $filtered = New-Object System.Collections.Generic.List[object]
|            foreach ($id in $idsAll) {
|                if (-not $AmbiguousIdKeys.ContainsKey((Get-SILedgerKey -Type $id.Type -Value $id.Value))) {
|                    [void]$filtered.Add($id)
|                }
|            }
|            if ($filtered.Count -gt 0) { $ids = $filtered }
|        }
|
|        if ($ids.Count -eq 0) {
|            # No anchor at all -- nothing to remember it by, so it cannot be given a durable identity.
|            # Counted, never invented: minting for an unkeyable object would create a new id every run.
|            $unkeyable++
|            [void]$decisions.Add([pscustomobject]@{
|                Group = $g; CorrelationId = $null; Action = 'unkeyable'
|                BirthAnchor = $null; NewIdentifiers = @(); PriorIds = @()
|            })
|            continue
|        }
|
|        # Which existing ids do this group's identifiers already point at?
|        $known = @{}
|        # every id the ledger names for these identifiers, as written (before the merge chain is followed)
|        $rawIds = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|        foreach ($id in $ids) {
|            # (a value longer than the ledger's column is held under its short form -- Get-SILedgerEntryKey finds both)
|            $k = Get-SILedgerEntryKey -Ledger $Ledger -Type $id.Type -Value $id.Value
|            if ($null -ne $k) {
|                $e = $Ledger[$k]
|                $cid = [string]$e.CorrelationId
|                if ([string]::IsNullOrWhiteSpace($cid)) { continue }
|                [void]$rawIds.Add($cid)
|                # a merged-away id stands for the id it was merged into -- never for itself
|                $cid = Resolve-SISupersededId -Id $cid -Map $MergedAway
|                if (-not $known.ContainsKey($cid)) { $known[$cid] = $e.FirstSeen }
|            }
|        }
|
|        $anchor = Get-SIObjectBirthAnchor -Identifiers $ids.ToArray()
|        $action = ''
|        $cid    = $null
|        $priors = @()
|
|        if ($known.Keys.Count -eq 0) {
|            $action = 'mint'
|            $cid = (New-SIObjectUuidV5 -Name (Get-SILedgerKey -Type $anchor.Type -Value $anchor.Value)).ToString()
|        }
|        elseif ($known.Keys.Count -eq 1) {
|            $action = 'reuse'
|            $cid = @($known.Keys)[0]
|        }
|        else {
|            # MERGE. Oldest FirstSeen wins; ordinal id compare breaks a tie deterministically.
|            $action = 'merge'
|            $ordered = @($known.Keys) | Sort-Object @{ Expression = { $known[$_] } }, @{ Expression = { $_ } }
|            $oldest  = $null
|            $oldestT = $null
|            foreach ($k in @($known.Keys)) {
|                $t = $known[$k]
|                if ($null -eq $oldestT -or $t -lt $oldestT -or
|                    ($t -eq $oldestT -and (@(Sort-SIOrdinal -Value @($k, $oldest))[0]) -eq $k)) {
|                    $oldest = $k; $oldestT = $t
|                }
|            }
|            $cid = $oldest
|            $priors = @(@($known.Keys) | Where-Object { $_ -ne $cid })
|            foreach ($old in $priors) {
|                [void]$superseded.Add([pscustomobject]@{ OldId = $old; NewId = $cid; At = $Now })
|            }
|        }
|
|        # Identifiers this object did not previously have under this id -- the ledger rows to add.
|        $newIds = New-Object System.Collections.Generic.List[object]
|        foreach ($id in $ids) {
|            $k = Get-SILedgerEntryKey -Ledger $Ledger -Type $id.Type -Value $id.Value
|            if ($null -eq $k -or [string]$Ledger[$k].CorrelationId -ne $cid) {
|                [void]$newIds.Add([pscustomobject]@{ Type = $id.Type; Value = $id.Value; CorrelationId = $cid })
|            }
|        }
|
|        # ON A MERGE (and on a merged-away id met again) EVERY ANCHOR OF THE OLD ID IS RE-POINTED to the survivor -- not
|        # only the anchors this group carries this run. An anchor left behind is how a merged-away id came back: at a ring 1
|        # install (2026-11-05) a VM's old Exposure Graph node id still pointed at the merged twin, and the next build that
|        # saw that node alone REUSED the twin. The old ids are recorded as superseded (never an id of their own again).
|        if ($action -ne 'mint') {
|            $oldIds = @(foreach ($r in $rawIds) { if ($r -ine $cid) { $r } })
|            if ($oldIds.Count -gt 0) {
|                if ($null -eq $keysById) { $keysById = Get-SILedgerKeysById -Ledger $Ledger }
|                $have = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|                foreach ($n in $newIds) { [void]$have.Add((Get-SILedgerKey -Type ([string]$n.Type) -Value ([string]$n.Value))) }
|                foreach ($old in $oldIds) {
|                    foreach ($ok in @(Get-SILedgerKeysOfId -Index $keysById -Ledger $Ledger -CorrelationId $old)) {
|                        if ($hasAmbiguous -and $AmbiguousIdKeys.ContainsKey([string]$ok)) { continue }
|                        if (-not $have.Add([string]$ok)) { continue }
|                        $cut = ([string]$ok).IndexOf('|'); if ($cut -lt 1) { continue }
|                        [void]$newIds.Add([pscustomobject]@{ Type = (Get-SICanonicalIdType -Type ([string]$ok).Substring(0, $cut)); Value = ([string]$ok).Substring($cut + 1); CorrelationId = $cid })
|                    }
|                    if ($action -ne 'merge' -or $priors -notcontains $old) {
|                        [void]$superseded.Add([pscustomobject]@{ OldId = $old; NewId = $cid; At = $Now })
|                    }
|                }
|                if ($action -eq 'reuse') { $priors = @($oldIds) }
|            }
|        }
|
|        # #642 A WRONG MERGE IN THE LEDGER: this group resolved to an id that, by proof, also holds ANOTHER object (two or
|        # more identifier types an object holds once, each with another value written in the same run -- Test-SILedgerWrongMerge).
|        # The object the id was minted from (else the oldest) keeps it; this group becomes its own object, minted from its
|        # own birth anchor, and its anchors are re-pointed -- so the next run reuses the new id and nothing splits again.
|        # Decided per group from the ledger alone: a CI build batch that holds one of the objects decides exactly what a
|        # batch holding all of them would.
|        $idKeys = $null
|        if ($action -eq 'reuse') {
|            if ($null -eq $keysById) { $keysById = Get-SILedgerKeysById -Ledger $Ledger }
|            $idKeys = @(Get-SILedgerKeysOfId -Index $keysById -Ledger $Ledger -CorrelationId $cid)
|            $wm = Test-SILedgerWrongMerge -Ids $ids.ToArray() -Ledger $Ledger -AnchorKeys $idKeys
|            if ($wm.Proven) {
|                if (-not $keeperKeys.ContainsKey($cid)) { $keeperKeys[$cid] = Get-SILedgerIdKeeperKey -CorrelationId $cid -Ledger $Ledger -AnchorKeys $idKeys }
|                $keeperKey = [string]$keeperKeys[$cid]
|                $holdsKeeper = $false
|                foreach ($id in $ids) {
|                    if ((Get-SILedgerEntryKey -Ledger $Ledger -Type $id.Type -Value $id.Value) -eq $keeperKey) { $holdsKeeper = $true; break }
|                }
|                $newCid = (New-SIObjectUuidV5 -Name (Get-SILedgerKey -Type $anchor.Type -Value $anchor.Value)).ToString()
|                if (-not $holdsKeeper -and $newCid -ne $cid) {
|                    $rewritten = New-Object System.Collections.Generic.List[object]
|                    foreach ($id in $ids) { [void]$rewritten.Add([pscustomobject]@{ Type = $id.Type; Value = $id.Value; CorrelationId = $newCid }) }
|                    [void]$splits.Add([pscustomobject]@{
|                        CorrelationId = $cid; NewId = $newCid; Objects = 2; Resolved = $true; Kind = 'wrong-merge'
|                        KeptBy = $keeperKey; Types = @($wm.Types)
|                        Reason = ('the ledger id held another object as well ({0} differ, written in the same run) -- the object it was minted from keeps the id and this one is its own object' -f (@($wm.Types) -join ', '))
|                    })
|                    [void]$decisions.Add([pscustomobject]@{
|                        Group = $g; CorrelationId = $newCid; Action = 'split'
|                        BirthAnchor = $anchor; NewIdentifiers = $rewritten.ToArray(); PriorIds = @($cid)
|                        Identifiers = $ids.ToArray()
|                    })
|                    continue
|                }
|            }
|        }
|
|        # Anchors the ledger holds for this id that did NOT appear this run. Reported, never acted on --
|        # see the split note in the docblock.
|        if ($action -ne 'mint') {
|            $present = @{}
|            foreach ($id in $ids) {
|                $present[(Get-SILedgerKey -Type $id.Type -Value $id.Value)] = $true
|                # a long value is in the ledger under its short form: it appeared this run all the same
|                if (([string]$id.Value).Length -gt 256) { $present[(Get-SILedgerKey -Type $id.Type -Value (ConvertTo-SILedgerStoredValue -Value ([string]$id.Value)))] = $true }
|            }
|            # 🔴 THE LEDGER'S KEYS BY THE ID THEY POINT AT, built once (Get-SILedgerKeysById). This report used to read
|            # EVERY ledger key for EVERY object: 28,822 objects against a ledger of well over 100,000 anchors was more
|            # than an hour of one correlation run (2026-10-12), and the same again in every batch of the CI build.
|            # The same keys are found, in the same order.
|            if ($null -eq $keysById) { $keysById = Get-SILedgerKeysById -Ledger $Ledger }
|            $missing = New-Object System.Collections.Generic.List[object]
|            if ($null -eq $idKeys) { $idKeys = @(Get-SILedgerKeysOfId -Index $keysById -Ledger $Ledger -CorrelationId $cid) }
|            foreach ($k in $idKeys) {
|                if (-not $present.ContainsKey($k)) { [void]$missing.Add($k) }
|            }
|            if ($missing.Count -gt 0) {
|                [void]$shrunk.Add([pscustomobject]@{ CorrelationId = $cid; MissingAnchors = $missing.ToArray() })
|            }
|        }
|
|        [void]$decisions.Add([pscustomobject]@{
|            Group = $g; CorrelationId = $cid; Action = $action
|            BirthAnchor = $anchor; NewIdentifiers = $newIds.ToArray(); PriorIds = $priors
|            Identifiers = $ids.ToArray()
|        })
|    }
|
|    # ---- ONE LEDGER ID CLAIMED BY TWO OBJECTS -------------------------------------------------------
|    #
|    # 🔴 THIS IS THE OTHER HALF OF THE 2026-08-20 LIVE FAILURE, and excluding the contested anchor above
|    # does NOT on its own fix it. Before a split every anchor of the original object points at that
|    # object's id, so on the FIRST run after an operator separates it, BOTH halves still resolve to the
|    # same id through their own perfectly unambiguous anchors. Measured: `1 distinct id for 2 objects`.
|    #
|    # 🔑 WHY IT IS SAFE TO ACT HERE AND NOWHERE ELSE. The docblock above refuses to auto-detect splits
|    # because one run cannot tell "this object split" from "a source failed". That reasoning is intact:
|    # this pass only reassigns when an OPERATOR never-merge produced the separation, which is exactly
|    # the missing fact. Two groups that collide WITHOUT one are reported and left alone -- the deferred
|    # case, now at least visible instead of silently sharing an id.
|    $byId = @{}
|    foreach ($d in $decisions) {
|        if ([string]::IsNullOrWhiteSpace([string]$d.CorrelationId)) { continue }
|        $k = [string]$d.CorrelationId
|        if (-not $byId.ContainsKey($k)) { $byId[$k] = New-Object System.Collections.Generic.List[object] }
|        [void]$byId[$k].Add($d)
|    }
|
|    foreach ($k in @($byId.Keys)) {
|        # 🪤 .ToArray(), NOT @(...). On PS 5.1 wrapping a List[object] of PSCustomObjects in @() throws
|        # "Argument types do not match" -- and it threw here on the very first call, before any
|        # collision existed, so it would have taken down every correlation run.
|        $claimants = $byId[$k].ToArray()
|        if ($claimants.Count -lt 2) { continue }
|
|        $separated = @($claimants | Where-Object { $_.Group -and $_.Group.PSObject.Properties['SeparatedByDecision'] -and $_.Group.SeparatedByDecision })
|        if ($separated.Count -lt 2) {
|            # Not operator-separated: the deferred split/reassign case. Report, never act.
|            [void]$splits.Add([pscustomobject]@{
|                CorrelationId = $k; Objects = $claimants.Count; Resolved = $false; Kind = 'collision'
|                Reason = 'two or more objects resolve to one ledger id and no operator decision separated them -- reported, not acted on (see V3-ARCHITECTURE 2.3a)'
|            })
|            continue
|        }
|
|        # WHICH HALF KEEPS THE EXISTING ID. Ordinal compare of each half's own birth-anchor ledger key.
|        #
|        # 🔑 It is a TIEBREAK, not a claim about which half is "really" the original -- nothing in one
|        # run can establish that. What it must be is DETERMINISTIC and STABLE: a rule that flipped
|        # between runs would move the CI back and forth, which is worse than either choice. Ordinal
|        # (never culture-sensitive) so two hosts cannot disagree.
|        # 📌 The operator overrides it with `pin-id`, which is precisely what that kind is for.
|        # 🪤 ORDINAL SCAN, not Sort-Object, and NO `u ESCAPE.
|        # Two host traps in one line, both found on a LIVE pwsh 7 run while the PS 5.1 Pester suite
|        # stayed green (framework finding HOST-1: the suites run on 5.1, the engines on 7):
|        #   * "`uffff" is a pwsh 7 escape. On 5.1 it is the literal text "uffff" and parses fine; on
|        #     pwsh 7 it is a PARSE ERROR, which took the whole ledger block down to
|        #     "identity ledger unavailable -- publishing with DERIVED, PROVISIONAL ids".
|        #   * Sort-Object is culture-sensitive, and this choice decides which CI keeps its identity.
|        #     A da-DK host must not keep a different half than an en-US one.
|        $keeper    = $null
|        $keeperKey = $null
|        foreach ($d in $claimants) {
|            if (-not $d.BirthAnchor) { continue }
|            $dk = Get-SILedgerKey -Type $d.BirthAnchor.Type -Value $d.BirthAnchor.Value
|            if ($null -eq $keeperKey -or [string]::CompareOrdinal($dk, $keeperKey) -lt 0) {
|                $keeper = $d; $keeperKey = $dk
|            }
|        }
|        # Every claimant lacks a birth anchor: nothing to re-mint from, so leave them reported.
|        if ($null -eq $keeper) {
|            [void]$splits.Add([pscustomobject]@{
|                CorrelationId = $k; Objects = $claimants.Count; Resolved = $false; Kind = 'operator'
|                Reason = 'operator-separated, but no half carries an unambiguous anchor to mint a new id from -- reported, not acted on'
|            })
|            continue
|        }
|        $ranked = $claimants
|
|        foreach ($d in $ranked) {
|            if ($d -eq $keeper) { continue }
|            if (-not $d.BirthAnchor) { continue }   # nothing of its own to mint from; leave it reported
|            $newCid = (New-SIObjectUuidV5 -Name (Get-SILedgerKey -Type $d.BirthAnchor.Type -Value $d.BirthAnchor.Value)).ToString()
|            if ($newCid -eq $k) { continue }
|
|            # Re-point this half's OWN anchors at the new id. The contested anchor is already absent
|            # from $d.Identifiers, so it stays with the keeper -- which is what stops the two halves
|            # merging again on the next run.
|            $rewritten = New-Object System.Collections.Generic.List[object]
|            foreach ($id in @($d.Identifiers)) {
|                [void]$rewritten.Add([pscustomobject]@{ Type = $id.Type; Value = $id.Value; CorrelationId = $newCid })
|            }
|            $d.NewIdentifiers = $rewritten.ToArray()
|            $d.CorrelationId  = $newCid
|            $d.Action         = 'split'
|
|            [void]$splits.Add([pscustomobject]@{
|                CorrelationId = $k; NewId = $newCid; Objects = $claimants.Count; Resolved = $true
|                KeptBy = $keeper.CorrelationId; Kind = 'operator'
|                Reason = 'an operator never-merge separated this object; the other half keeps the existing id and this half is a NEW object'
|            })
|        }
|    }
|
|    $script:SILedgerKeyMemo = $null
|    # the decisions counted by action in one pass (the same -eq comparison as before, without case)
|    $actionCount = @{ mint = 0; reuse = 0; merge = 0; split = 0 }
|    foreach ($d in $decisions) { foreach ($a in 'mint', 'reuse', 'merge', 'split') { if ($d.Action -eq $a) { $actionCount[$a]++ } } }
|    [pscustomobject]@{
|        Decisions     = $decisions.ToArray()
|        Superseded    = $superseded.ToArray()
|        ShrunkObjects = $shrunk.ToArray()
|        Splits        = $splits.ToArray()
|        Minted        = $actionCount['mint']
|        Reused        = $actionCount['reuse']
|        Merged        = $actionCount['merge']
|        Split         = $actionCount['split']
|        # #642 of them: the objects split off a ledger id that held another object as well (a wrong merge, repaired)
|        WrongMergeSplit = @($splits | Where-Object { [string]$_.Kind -eq 'wrong-merge' }).Count
|        Unkeyable     = $unkeyable
|    }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-SqlRetry.ps1'] = @{ Sha256 = '0e387c153b615f7d80a0ea1391e42b3d7b87c0723c4ab20e90818aa4f843f211'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE ONE SQL CONNECTION RETRY (owner 2026-10-22: "why not use shared everywhere" / "stability is prio
|    also"). Moved here from setup\_shared\SI-SetupArm.ps1 (Open-SISqlConnectionRetry, Test-SISqlNotYetAnswer) and
|    engine\data-model\identity\SI-ObjectLedgerStore.ps1 (Test-SISqlTransientError), so the engine, the updater and setup open
|    a database the same way.
|
|    ONLY THE OPEN IS RETRIED. A statement that may already have run is never sent again by this file: an Open that failed
|    sent nothing.
|
|    PURE except Open-SISqlConnectionRetry's default -Connect (System.Data.SqlClient). PS 5.1 safe. Community + Pro.
|#>
|
|function Test-SISqlTransientError {
|    <#
|        Azure SQL faults worth another attempt at OPENING the connection. Deliberately a short, named list rather than
|        "retry anything": retrying a permission or a syntax error just delays a real failure.
|          40613 database not currently available (a serverless resume, or a failover)
|          40197 / 40501 / 49918 / 49919 / 49920  service busy, throttled or moving
|          4060  cannot open database right now
|          10928 / 10929 resource limits
|        -2 / 258 client timeouts
|        -ErrorRecord: an ErrorRecord or an exception (inner exceptions are read too).
|    #>
|    param([Parameter(Mandatory)]$ErrorRecord)
|    $codes = @(40613, 40197, 40501, 49918, 49919, 49920, 4060, 10928, 10929, -2, 258)
|    $ex = if ($ErrorRecord -is [System.Management.Automation.ErrorRecord]) { $ErrorRecord.Exception } else { $ErrorRecord }
|    while ($ex) {
|        if ($ex -is [System.Data.SqlClient.SqlException] -and $codes -contains [int]$ex.Number) { return $true }
|        $ex = $ex.InnerException
|    }
|    $msg = [string]$ErrorRecord
|    if ($ErrorRecord -is [System.Exception]) { $msg = [string]$ErrorRecord.Message }
|    return ($msg -match 'is not currently available|Please retry the connection later|too busy|try again')
|}
|
|function Test-SISqlStatementTransient {
|    <#
|        PURE and SELF-CONTAINED (it travels as a value into connection closures: it calls nothing by name). Is a failed SQL
|        STATEMENT one of Azure SQL's platform answers, so the statement may be run again on a new connection? Live 2026-10-28:
|        one statement of the data sync got 9001 (the log is not available) + 3314 (a rollback during recovery) + "A severe
|        error occurred on the current command" after minutes of a saturated log, and a 52-hour run failed on it.
|          transient: 9001, 3314, 40613, 40501, 40197, 49918 / 49919 / 49920 (not available, busy, moving), 4060 (cannot open
|                     the database during a failover), 10928 / 10929 (resource limits), 1205 (chosen as a deadlock victim),
|                     -2 / 258 (a client timeout), 10053 / 10054 / 233 / 64 (a reset or closed connection), 4083 ("the
|                     connection was recovered and rowcount in the first query is not available": the driver re-made an idle
|                     connection under the statement -- live 2026-11-04, a correlation run's CI build failed on it), "a severe error
|                     occurred on the current command", a transport-level error, a broken pooled connection ("Internal .NET
|                     Framework Data Provider error 6").
|          never:     the database is full (1105 / 40544 / 1101), a query defect (syntax, a type mismatch), a permission -- they
|                     fail on the first attempt.
|        -ErrorRecord: an ErrorRecord, an exception (SqlException numbers and inner exceptions are read) or a text.
|    #>
|    param([AllowNull()]$ErrorRecord)
|    if ($null -eq $ErrorRecord) { return $false }
|    $codes = @(9001, 3314, 40613, 40501, 40197, 49918, 49919, 49920, 4060, 10928, 10929, 1205, -2, 258, 10053, 10054, 233, 64, 4083)
|    $full = @(1105, 40544, 1101)
|    $ex = if ($ErrorRecord -is [System.Management.Automation.ErrorRecord]) { $ErrorRecord.Exception } elseif ($ErrorRecord -is [System.Exception]) { $ErrorRecord } else { $null }
|    $nums = New-Object System.Collections.Generic.List[int]
|    $texts = New-Object System.Collections.Generic.List[string]
|    while ($ex) {
|        if ($ex -is [System.Data.SqlClient.SqlException]) {
|            foreach ($er in @($ex.Errors)) { $nums.Add([int]$er.Number) }
|            $nums.Add([int]$ex.Number)
|        }
|        try { if ($ex.Data -and $ex.Data.Contains('SISqlNumbers')) { foreach ($n in @($ex.Data['SISqlNumbers'])) { $nums.Add([int]$n) } } } catch { }
|        $texts.Add([string]$ex.Message); $ex = $ex.InnerException
|    }
|    if (-not $texts.Count) { $texts.Add([string]$ErrorRecord) }
|    $t = $texts -join ' | '
|    foreach ($n in $nums) { if ($full -contains $n) { return $false } }
|    if ($t -match '(?i)has reached its size quota|could not allocate (a new page|space)') { return $false }
|    foreach ($n in $nums) { if ($codes -contains $n) { return $true } }
|    [bool]($t -match '(?i)a severe error occurred on the current command|transport-level error|connection was forcibly closed|forcibly closed by the remote host|connection reset|Connection reset by peer|broken pipe|Internal \.NET Framework Data Provider error 6|is not currently available|log for database .* is not available|connection was recovered and rowcount|\b(9001|3314|40613|40501|40197|49918|49919|49920|4083)\b')
|}
|
|function Test-SISqlConnectTransient {
|    <#
|        PURE and SELF-CONTAINED (it travels as a value; it calls nothing by name). Did the CONNECTION fail at the network /
|        transport level, before anything was sent -- so opening it again a moment later is safe? Live 2026-11-07 (an install's
|        pipeline runner, its settings read): "A network-related or instance-specific error occurred while establishing a
|        connection to SQL Server ... (provider: TCP Provider, error: 40 - Could not open a connection to SQL Server)" stopped
|        the run; every wake-up after it read the settings fine.
|          transient: SqlException 40 / 53 / 10060 / 10061 / 10065 / 11001 / 1225 / 121 / 4060 / 40613 / 40197 / 40501 /
|                     49918-49920 / -2 / 258 / 233 / 64 / 10053 / 10054, and the texts "network-related or instance-specific",
|                     "Could not open a connection to SQL Server", "error: 40" / "error: 26" / "error: 0" of a provider, "semaphore
|                     timeout", "connection attempt failed", "actively refused", "No such host is known", "server was not found".
|          never:     a refused sign-in (18456 -- a grant, not the network), a permission, a missing database by name.
|        -ErrorRecord: an ErrorRecord, an exception (SqlException numbers and inner exceptions are read) or a text.
|    #>
|    param([AllowNull()]$ErrorRecord)
|    if ($null -eq $ErrorRecord) { return $false }
|    $codes = @(40, 53, 10060, 10061, 10065, 11001, 1225, 121, 4060, 40613, 40197, 40501, 49918, 49919, 49920, -2, 258, 233, 64, 10053, 10054)
|    $ex = if ($ErrorRecord -is [System.Management.Automation.ErrorRecord]) { $ErrorRecord.Exception } elseif ($ErrorRecord -is [System.Exception]) { $ErrorRecord } else { $null }
|    $nums = New-Object System.Collections.Generic.List[int]
|    $texts = New-Object System.Collections.Generic.List[string]
|    while ($ex) {
|        if ($ex -is [System.Data.SqlClient.SqlException]) { foreach ($er in @($ex.Errors)) { $nums.Add([int]$er.Number) }; $nums.Add([int]$ex.Number) }
|        $texts.Add([string]$ex.Message); $ex = $ex.InnerException
|    }
|    if (-not $texts.Count) { $texts.Add([string]$ErrorRecord) }
|    $t = $texts -join ' | '
|    # a refused sign-in is a grant, not the network (4060 "Cannot open database ... The login failed." IS the failover class)
|    if ($nums -contains 18456 -or $t -match '(?i)Login failed for user|\b18456\b') { return $false }
|    foreach ($n in $nums) { if ($codes -contains $n) { return $true } }
|    [bool]($t -match '(?i)network-related or instance-specific error|Could not open a connection to SQL Server|\(provider: [^,]+, error: (0|26|35|40)\b|semaphore timeout|connection attempt failed|actively refused|No such host is known|server was not found or was not accessible|transport-level error|forcibly closed by the remote host|connection was forcibly closed|\b(40613|40197|40501|10060|10061|4060)\b')
|}
|
|function Get-SISqlConnectRetryWaits {
|    <# #1147: the pauses before each new attempt to READ when the connection failed at the network level (Test-SISqlConnectTransient):
|       4 more attempts over about 1.5 minutes -- a short network blip or a gateway that moved passes in seconds. #>
|    @(5, 10, 20, 45)
|}
|
|function Get-SISqlStatementRetryWaits {
|    <# The pauses before each new attempt of a statement that met an Azure SQL platform answer: 6 more attempts over about
|       9 minutes (owner 2026-10-29). A failover or a resume passes in under a minute; a log that recovers after a rollback
|       under load (the live case) takes minutes. A bound on Microsoft's errors, never on SI's own work. #>
|    @(5, 15, 30, 60, 120, 300)
|}
|
|function Test-SISqlNotYetAnswer {
|    <# PURE. Is this the refusal a database gives for a moment after its server's administrator or firewall rule changed:
|       "Login failed" (18456) or "client with IP address ... is not allowed" (40615)? #>
|    param([AllowEmptyString()][AllowNull()][string]$Text)
|    [bool]("$Text" -match '(?i)Login failed|\b18456\b|\b40615\b|is not allowed to access the server')
|}
|
|function Open-SISqlConnectionRetry {
|    <#
|        Opens a database connection with an Entra token, and tries again -- a bounded number of times (Microsoft's errors),
|        with a NEW token each time -- when the database answers
|          * "Login failed" / 18456 / 40615: its administrator or firewall rule was changed a moment ago (Test-SISqlNotYetAnswer);
|          * a transient Azure SQL fault: a failover, a serverless resume, busy, a client timeout (Test-SISqlTransientError).
|        Any other failure is thrown at once. Only the OPEN is retried -- nothing has been sent yet.
|          -Token    { param([bool]$Fresh) } -> the access token for https://database.windows.net/ ($Fresh = ask for a new one)
|          -Waits    seconds between tries (default 6 x 20 s)
|          -Connect  { param($Server, $Database, $Token) } -> an OPEN connection (tests; default: System.Data.SqlClient)
|          -ConnectTimeoutSec  the driver's own connect timeout (default 30)
|        Returns the open connection; the caller disposes it.
|    #>
|    param([Parameter(Mandatory)][string]$Server, [Parameter(Mandatory)][string]$Database, [Parameter(Mandatory)][scriptblock]$Token,
|          [int[]]$Waits = @(20, 20, 20, 20, 20, 20), [scriptblock]$Sleep, [scriptblock]$Connect, [int]$ConnectTimeoutSec = 30)
|    if (-not $Connect) {
|        $cto = $ConnectTimeoutSec
|        $Connect = {
|            param($Server, $Database, $Token)
|            # BUILT, never formatted: a server or database value is always ONE value (a ';' in it never adds a keyword).
|            # Self-contained (no function called by name -- this block travels as a value, see below).
|            $csb = New-Object System.Data.SqlClient.SqlConnectionStringBuilder
|            $h = "$Server".Trim(); if ($h.StartsWith('tcp:', [StringComparison]::OrdinalIgnoreCase)) { $h = $h.Substring(4) }
|            $ci = $h.IndexOf(','); if ($ci -ge 0) { $h = $h.Substring(0, $ci) }
|            $csb['Data Source'] = ('tcp:{0},1433' -f $h.Trim()); $csb['Initial Catalog'] = "$Database".Trim()
|            $csb['Encrypt'] = $true; $csb['TrustServerCertificate'] = $false; $csb['Connect Timeout'] = $cto
|            $cn = New-Object System.Data.SqlClient.SqlConnection($csb.ConnectionString)
|            $cn.AccessToken = $Token
|            try { $cn.Open() } catch { $cn.Dispose(); throw }
|            $cn
|        }.GetNewClosure()
|    }
|    $try = 0; $cn = $null
|    while ($true) {
|        $tok = ([string](& $Token ($try -gt 0))).Trim()
|        if (-not $tok) { throw 'the sign-in could not issue an Azure SQL token for the caller.' }
|        try { $cn = & $Connect $Server $Database $tok; break }
|        catch {
|            # SELF-CONTAINED (review 2, S3): the classification is written out here, never called by name -- this function
|            # travels as a value into connection closures (SI-DataSql.ps1) that outlive the scope that loaded this file
|            # (SI-Guard keeps one globally), where Test-SISqlNotYetAnswer / Test-SISqlTransientError are not visible: the
|            # failed open then threw "not recognized", hid the real SQL error and lost the retry. The same rules as those two.
|            $msgText = [string]$_.Exception.Message
|            $notYet = [bool]($msgText -match '(?i)Login failed|\b18456\b|\b40615\b|is not allowed to access the server')
|            $transient = $false
|            if (-not $notYet) {
|                $ex = $_.Exception
|                while ($ex) {
|                    if ($ex -is [System.Data.SqlClient.SqlException] -and @(40613, 40197, 40501, 49918, 49919, 49920, 4060, 10928, 10929, -2, 258) -contains [int]$ex.Number) { $transient = $true; break }
|                    $ex = $ex.InnerException
|                }
|                if (-not $transient) { $transient = [bool]($msgText -match 'is not currently available|Please retry the connection later|too busy|try again') }
|            }
|            if ((-not $notYet -and -not $transient) -or $try -ge @($Waits).Count) { throw }
|            $w = [int]@($Waits)[$try]; $try++
|            $why = if ($notYet) { 'does not accept this sign-in yet (its administrator or firewall rule changed a moment ago)' } else { ('is not available for a moment ({0})' -f (([string]$_.Exception.Message -split "`n")[0].Trim())) }
|            Write-Host ('       the database {0} {1} -- waiting {2} s and trying again ({3}/{4}) ...' -f $Database, $why, $w, $try, @($Waits).Count) -ForegroundColor DarkYellow
|            if ($w -gt 0) { if ($Sleep) { & $Sleep $w } else { Start-Sleep -Seconds $w } }
|        }
|    }
|    $cn
|}
'@ }
$__siSupportFiles['engine/_shared/SI-GraphRest.ps1'] = @{ Sha256 = 'c95ce8adf3e42b7095b8c257003e7aeccc3a806168b3db4fc551edfc6abf9701'; Text = @'
|#Requires -Version 5.1
|<#
|    THE GRAPH REST CLIENT FOR ENGINES MIGRATING OFF THE Microsoft.Graph SDK (#113).
|
|    🔑 WHY THIS EXISTS. Operator, 2026-09-08: *"do we need graph in image. can we use pure rest api"*.
|    Measured answer: no, and REST was already the house style -- the four asset-profiling engines use
|    ZERO `-Mg*` cmdlets, and every Graph call the remaining engines make already had a working REST
|    implementation somewhere in this solution. The SDK was carrying no capability, only a dependency:
|    enormous modules baked into every image for a handful of calls, a second auth path, and the
|    mixed-module-version hazard where a bundled `Azure.Core` poisons `Connect-MgGraph` and cmdlets
|    return SILENT NULLS.
|
|    🔒 AUTH IS NOT DUPLICATED HERE. Tokens come from `auth/Get-SIGraphToken.ps1`, the solution's one
|    token path (SPN secret or certificate, with its own cache). This file is transport only. Copying
|    auth logic is how two paths drift into disagreeing about which identity is in use.
|
|    📌 THERE IS AN OLDER PRIVATE COPY OF THIS PAGER, and it is deliberately left alone for now:
|    `engine/asset-profiling/shared/IdentityRoleFetcher.ps1` defines its own `Invoke-SIGraphPaged` +
|    `Get-SIGraphHttpStatus`. That engine is working, shipped and heavily tested; refactoring it in the
|    same change that migrates two OTHER engines would put unrelated blast radius into one commit.
|    ◻ Convergence is recorded as follow-up in `#113`. The behaviour here is modelled on that copy on
|    purpose, so converging later is a deletion rather than a reconciliation.
|
|    🔴 RETRY POLICY, and the distinction that matters most in this solution: TRANSIENT failures are
|    retried; PERMANENT ones propagate immediately. A platform failure retried is a few seconds lost; a
|    query defect retried burns a whole run and fails identically. That rule is `CLAUDE.md` working rule
|    4, and findings `#99` and `#106` are both cases of it being got wrong in the other direction --
|    a cancellation and a service-side resolution failure each reported as *"fix your query"*.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope (measured 2026-08-12), and the shipped
|# engines deliberately run without it.
|
|function New-SIGraphJsonBody {
|    <#
|        Serialise a request body to UTF-8 BYTES. Every POST in this file goes through here.
|
|        🔴 THIS EXISTS BECAUSE A STRING BODY IS SILENTLY CORRUPTED ON PS 5.1, WHICH IS THE SHELL
|        CUSTOMERS RUN. `Invoke-RestMethod -Body <string>` transcodes to a single-byte encoding, so
|        every non-ASCII character is destroyed before it reaches the wire. MEASURED against a local
|        HttpListener, capturing the actual received bytes:
|
|            payload, correct UTF-8 : 47 bytes
|            -Body <string>         : 35 bytes received, content mangled
|            -Body <utf8 bytes>     : 47 bytes received, byte-exact
|
|        🪤 IT FAILS AS A JSON ERROR, WHICH POINTS AT THE WRONG HALF. The service answers
|        `400 BadRequest -- "Unable to read JSON request payload. Please ensure Content-Type header is
|        set and payload is of valid JSON format."` The Content-Type *is* set and the JSON *was* valid
|        when built; the bytes were broken in transit. Risk Analysis then classified it as a QUERY
|        DEFECT and reported "re-running will fail identically" -- correct advice about the wrong cause.
|
|        🔑 WHY IT SURVIVED THE OFFLINE SUITE AND ONLY APPEARED ON A LIVE RUN. It needs a non-ASCII
|        character in the request. Plain KQL is ASCII; RA is the first caller to inline hundreds of real
|        device and user names into the query body, and this estate is Danish -- æ, ø and å in a
|        customer's own asset names are what broke it. No amount of offline testing would have produced
|        that byte.
|
|        📌 The charset must ALSO be declared on the Content-Type, or the service is entitled to guess.
|    #>
|    param(
|        [Parameter(Mandatory)]$Object,
|        [int]$Depth = 10
|    )
|    $json = ConvertTo-Json $Object -Depth $Depth -Compress
|    # 🪤 THE LEADING COMMA IS LOAD-BEARING. PowerShell UNROLLS an array on return, so without it the
|    # caller receives an Object[] of boxed bytes rather than a byte[] -- and Invoke-RestMethod then
|    # does not treat the body as raw bytes at all, which reintroduces the very corruption this
|    # function exists to prevent. Caught by `serialises to a byte array, not a string` before it
|    # shipped; the failure is otherwise invisible until a live call with a non-ASCII character.
|    # 📌 Note this is the OPPOSITE of the `,$x.ToArray()` trap warned about below: there the comma
|    # wraps an empty result into a phantom single element, here it stops a real array being scattered.
|    return ,[System.Text.Encoding]::UTF8.GetBytes($json)
|}
|
|function Invoke-SIGraphHttp {
|    <#
|        The transport. Returns status + body and NEVER throws on an HTTP status code.
|
|        🔴 THIS EXISTS BECAUSE `Invoke-RestMethod` THROWS ON EVERY NON-2xx, AND A THROWN ERROR IS
|        WRITTEN TO THE TRANSCRIPT EVEN WHEN IT IS CAUGHT. The first live run after the REST migration
|        took `PS>TerminatingError` lines from **2 to 16** -- the exact noise
|        `tests/pester/SI-TranscriptNoise.Tests.ps1` exists to prevent, and the operator's own
|        complaint: *"it looks very amateur"*. The SDK path avoided it with
|        `-ErrorAction SilentlyContinue`; there is no such switch for a REST client that throws by
|        design, so the transport has to stop throwing instead.
|
|        🪤 AND THE PROBE IS THE COMMON CASE, NOT THE RARE ONE. `Test-AdvancedHuntingHasTable` asks
|        whether a custom LA table is mirrored into XDR, and the ANSWER IS NORMALLY NO -- arriving as a
|        400. Every SI_*_Profile_CL table produces one, every run. That is a routing decision working
|        correctly, and it was being written to the transcript as a terminating error.
|
|        📌 `HttpClient` returns a response object for 4xx/5xx rather than raising, and it exists on
|        PS 5.1 (.NET 4.5+). It still throws on a genuine transport failure or timeout, which is
|        correct -- that is the TaskCanceled signal RA's bucket escalation depends on.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Uri,
|        [Parameter(Mandatory)][string]$Token,
|        [ValidateSet('Get','Post')][string]$Method = 'Get',
|        [byte[]]$BodyBytes,
|        [string]$ContentType = 'application/json; charset=utf-8',
|        [int]$TimeoutSec = 300,
|        [hashtable]$ExtraHeaders
|    )
|
|    Add-Type -AssemblyName System.Net.Http -ErrorAction SilentlyContinue
|
|    $client = New-SIGraphHttpClient
|    try {
|        $client.Timeout = [TimeSpan]::FromSeconds($TimeoutSec)
|        $req = New-Object System.Net.Http.HttpRequestMessage(
|                    [System.Net.Http.HttpMethod]::$Method, $Uri)
|        [void]$req.Headers.TryAddWithoutValidation('Authorization', ('Bearer ' + $Token))
|        if ($ExtraHeaders) {
|            foreach ($k in $ExtraHeaders.Keys) { [void]$req.Headers.TryAddWithoutValidation([string]$k, [string]$ExtraHeaders[$k]) }
|        }
|        if ($BodyBytes) {
|            $content = New-Object System.Net.Http.ByteArrayContent(,$BodyBytes)
|            # Set on the CONTENT, not the request: charset lives with the payload it describes.
|            $content.Headers.Remove('Content-Type') | Out-Null
|            [void]$content.Headers.TryAddWithoutValidation('Content-Type', $ContentType)
|            $req.Content = $content
|        }
|
|        # PS 5.1 has no await, and this call is synchronous by design -- so the task is waited on here.
|        # 🔴 GetAwaiter().GetResult(), NEVER .Result. `.Result` is a PROPERTY GETTER, and PowerShell
|        # swallows an exception raised inside a getter: a timed-out request returned $null instead of
|        # throwing, reached the caller as "0 HTTP error", and RA's AutoBucket escalation -- which keys
|        # on the TaskCanceledException text -- never fired on the 900s ceiling. Measured on PS 5.1 and
|        # pwsh 7 (#117). A method call throws: MethodInvocationException wrapping TaskCanceledException,
|        # which the catch in Invoke-SIHuntingQueryRest already inspects (exception AND inner).
|        $resp = $client.SendAsync($req).GetAwaiter().GetResult()
|        $body = ''
|        if ($resp.Content) { $body = $resp.Content.ReadAsStringAsync().GetAwaiter().GetResult() }
|
|        return [pscustomobject]@{
|            StatusCode    = [int]$resp.StatusCode
|            Body          = $body
|            Ok            = $resp.IsSuccessStatusCode
|            RetryAfterSec = (Get-SIHttpRetryAfterSeconds -Response $resp)
|        }
|    } finally {
|        if ($client) { $client.Dispose() }
|    }
|}
|
|function New-SIGraphHttpClient {
|    <# One HttpClient for one request. $script:SIGraphHttpHandler is a seam for tests only (an HttpMessageHandler that
|       answers in-process); unset -- always, in a run -- it is the plain client. #>
|    Add-Type -AssemblyName System.Net.Http -ErrorAction SilentlyContinue
|    if ($null -ne $script:SIGraphHttpHandler) { return (New-Object System.Net.Http.HttpClient -ArgumentList $script:SIGraphHttpHandler, $false) }
|    New-Object System.Net.Http.HttpClient
|}
|
|function Get-SIHttpRetryAfterSeconds {
|    <# The seconds a 429 / 503 answer's Retry-After header asks for (a delay or a date); 0 when it says nothing. #>
|    param($Response)
|    try {
|        if ($null -eq $Response -or $null -eq $Response.Headers -or $null -eq $Response.Headers.RetryAfter) { return 0 }
|        $ra = $Response.Headers.RetryAfter
|        if ($null -ne $ra.Delta) { return [int][Math]::Ceiling($ra.Delta.TotalSeconds) }
|        if ($null -ne $ra.Date) { return [int][Math]::Max(0, [Math]::Ceiling(($ra.Date.UtcDateTime - [datetime]::UtcNow).TotalSeconds)) }
|    } catch { }
|    0
|}
|
|# ---- PARTS ASKED AHEAD (Risk Analysis: several query parts at a time) -----------------------------------------------
|# Risk Analysis asks its parts one by one and processes each (scoring, the database) before it asks the next. With
|# $script:SIHuntingPrefetch set (engine/risk-analysis/_shared/RA-PartsInParallel.ps1), the hunting request of a part
|# further ahead is SENT now and its answer waits here, keyed by the exact request body: when the part's turn comes, its
|# own call (Invoke-SIHuntingQueryRest, from the unchanged Invoke-GraphHuntingQuery) finds the answer instead of sending
|# the same request again. Everything else -- the retries, the error classification, the order the parts are processed
|# in -- is the one-at-a-time path, on the main thread. Only HttpClient runs in the background: no PowerShell code ever
|# runs on another thread, so no engine state is shared between threads. Unset (every other engine, and RA with
|# SI_RA_PartsInParallel_Max = 1): nothing here is used.
|# (functions, not file-level variables: the same text wherever a file is loaded from)
|function Get-SIHuntingAheadStartedText { 'the hunting request of this part was sent ahead -- its answer is read when the part runs' }
|function Get-SIHuntingNotAheadText { 'this part is not asked ahead -- it is not answered by advanced hunting' }
|
|function New-SIHuntingPrefetchStore {
|    [pscustomobject]@{
|        Capture = $false                                                                      # on while a part is being asked ahead
|        Entries = (New-Object 'System.Collections.Generic.Dictionary[string,object]' ([System.StringComparer]::Ordinal))
|        Answers = (New-Object System.Collections.Generic.List[object])                       # what each answer read here was like
|        Part    = -1                                                                          # the part being asked ahead
|    }
|}
|
|function Get-SIHuntingBodyKey {
|    <# PURE. The key of one request: the SHA-256 of its exact body bytes. #>
|    param([Parameter(Mandatory)][byte[]]$BodyBytes)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { [System.BitConverter]::ToString($sha.ComputeHash($BodyBytes)) -replace '-', '' } finally { $sha.Dispose() }
|}
|
|function Start-SIHuntingPrefetch {
|    <# Sends one hunting request now and keeps its pending answer in the store. Returns the request's key. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Uri, [Parameter(Mandatory)][string]$Token, [Parameter(Mandatory)][byte[]]$BodyBytes, [int]$TimeoutSec = 900)
|    $key = Get-SIHuntingBodyKey -BodyBytes $BodyBytes
|    if ($Store.Entries.ContainsKey($key)) { return $key }     # the same request is already on its way
|    $client = New-SIGraphHttpClient
|    $client.Timeout = [TimeSpan]::FromSeconds($TimeoutSec)
|    $req = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Post, $Uri)
|    [void]$req.Headers.TryAddWithoutValidation('Authorization', ('Bearer ' + $Token))
|    $content = New-Object System.Net.Http.ByteArrayContent(, $BodyBytes)
|    $content.Headers.Remove('Content-Type') | Out-Null
|    [void]$content.Headers.TryAddWithoutValidation('Content-Type', 'application/json; charset=utf-8')
|    $req.Content = $content
|    # the default completion (ResponseContentRead): the task completes with the answer's body already read
|    $task = $client.SendAsync($req)
|    $Store.Entries[$key] = [pscustomobject]@{ Key = $key; Part = [int]$Store.Part; Task = $task; Client = $client; Request = $req; Watch = [System.Diagnostics.Stopwatch]::StartNew(); Peeked = $false }
|    $key
|}
|
|function Receive-SIHuntingPrefetch {
|    <# The answer of a request sent ahead, in the shape Invoke-SIGraphHttp returns -- waiting for it if it is still on its
|       way. A transport failure (the 900 s ceiling included) is thrown exactly as Invoke-SIGraphHttp throws it. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)]$Entry)
|    $wait = [System.Diagnostics.Stopwatch]::StartNew()
|    $status = 0; $ra = 0
|    try {
|        # GetAwaiter().GetResult(), never .Result (see Invoke-SIGraphHttp: a getter swallows the timeout)
|        $resp = $Entry.Task.GetAwaiter().GetResult()
|        $body = ''
|        if ($resp.Content) { $body = $resp.Content.ReadAsStringAsync().GetAwaiter().GetResult() }
|        $status = [int]$resp.StatusCode
|        $ra = Get-SIHttpRetryAfterSeconds -Response $resp
|        return [pscustomobject]@{ StatusCode = $status; Body = $body; Ok = $resp.IsSuccessStatusCode; RetryAfterSec = $ra }
|    } finally {
|        $wait.Stop()
|        $Store.Answers.Add([pscustomobject]@{ Part = [int]$Entry.Part; Status = $status; RetryAfterSec = $ra; WaitedSec = [double]$wait.Elapsed.TotalSeconds; Seconds = [double]$Entry.Watch.Elapsed.TotalSeconds; Peeked = [bool]$Entry.Peeked })
|        try { $Entry.Client.Dispose() } catch { }
|    }
|}
|
|function Remove-SIHuntingPrefetch {
|    <# Drops answers sent ahead that no part will read (the report ended, ran again with more parts, or a part's request
|       came out different): an answer still on its way is cancelled. Returns how many were dropped. #>
|    param($Store, [string]$Key)
|    if ($null -eq $Store) { return 0 }
|    $keys = if ($Key) { @($Key) } else { @($Store.Entries.Keys) }
|    $n = 0
|    foreach ($k in $keys) {
|        if (-not $Store.Entries.ContainsKey($k)) { continue }
|        $e = $Store.Entries[$k]; [void]$Store.Entries.Remove($k); $n++
|        try { $e.Client.CancelPendingRequests() } catch { }
|        try { $e.Client.Dispose() } catch { }
|    }
|    $n
|}
|
|function Get-SIHuntingPrefetchThrottle {
|    <# Looks at the answers sent ahead that have already come back, WITHOUT reading them for their part: the highest
|       Retry-After of a 429 / 503 / 504 among them (-1: none was throttled). Each answer is looked at once. #>
|    param($Store)
|    $worst = -1
|    if ($null -eq $Store) { return $worst }
|    foreach ($e in @($Store.Entries.Values)) {
|        if ($e.Peeked -or -not $e.Task.IsCompleted) { continue }
|        $e.Peeked = $true
|        if ($e.Task.Status -ne [System.Threading.Tasks.TaskStatus]::RanToCompletion) { continue }
|        $r = $e.Task.GetAwaiter().GetResult()
|        if ([int]$r.StatusCode -in 429, 503, 504) { $worst = [Math]::Max($worst, [int](Get-SIHttpRetryAfterSeconds -Response $r)) }
|    }
|    $worst
|}
|
|function Get-SIGraphRestStatus {
|    <#
|        Pull the HTTP status code out of an ErrorRecord across BOTH PowerShell editions.
|
|        🪤 PS 5.1 and PS 7 do not agree here, and getting it wrong silently disables the retry policy:
|        5.1 raises WebException with .Response.StatusCode, 7 raises HttpResponseException with
|        .Response.StatusCode as an enum. A miss returns 0, which this treats as transient (a network
|        reset produces no status at all), so a wrong read fails toward retrying rather than toward
|        declaring a permanent defect.
|    #>
|    param([Parameter(Mandatory)]$ErrorRecord)
|
|    $r = $ErrorRecord.Exception.Response
|    if ($null -eq $r) { return 0 }
|    try {
|        $code = $r.StatusCode
|        if ($null -eq $code) { return 0 }
|        return [int]$code
|    } catch { return 0 }
|}
|
|function Test-SIGraphRestTransient {
|    <#
|        429 throttle, 502/503/504 gateway, and 0 (no response at all -- a reset or timeout).
|
|        🔒 408 and 409 are NOT here. A request timeout and a conflict both mean "this specific call
|        will not succeed by repeating it unchanged", and quietly retrying them is how a run burns its
|        budget looking busy.
|    #>
|    param([int]$Status)
|    return ($Status -in 429, 502, 503, 504) -or ($Status -eq 0)
|}
|
|function Get-SIGraphRestRetryAfter {
|    <# #882 (A2): the wait Graph asks for (Retry-After: seconds or an HTTP date), read on both editions; $null when absent. #>
|    param([Parameter(Mandatory)][System.Management.Automation.ErrorRecord]$ErrorRecord)
|    try {
|        $resp = $ErrorRecord.Exception.Response
|        if (-not $resp) { return $null }
|        if ($resp.Headers -and $resp.Headers.PSObject.Properties['RetryAfter'] -and $null -ne $resp.Headers.RetryAfter) {
|            $t = $resp.Headers.RetryAfter
|            if ($null -ne $t.Delta) { return [int][Math]::Max(0, [Math]::Ceiling($t.Delta.TotalSeconds)) }
|            if ($null -ne $t.Date) { $d = [int][Math]::Ceiling(($t.Date.UtcDateTime - [datetime]::UtcNow).TotalSeconds); if ($d -gt 0) { return $d } }
|            return $null
|        }
|        $raw = $null; try { $raw = $resp.Headers['Retry-After'] } catch { $raw = $null }
|        $s = 0; if ($raw -and [int]::TryParse([string]$raw, [ref]$s)) { return [Math]::Max(0, $s) }
|    } catch { }
|    $null
|}
|
|function Invoke-SIGraphRest {
|    <#
|        One Graph call, with the transient-retry policy applied. GET, POST or PATCH.
|
|          -Uri        absolute, or a /v1.0-relative path ('/servicePrincipals?...')
|          -Token      from Get-SIGraphToken
|          -Method     Get (default) | Post | Patch (asset tagging writes custom security attributes)
|          -Body       hashtable, sent as JSON, POST / PATCH only
|          -TimeoutSec per-attempt ceiling
|
|        Returns the deserialised response object. Throws on permanent failure, after retries on
|        transient failure -- so a caller that gets a return value knows the call actually worked.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Uri,
|        [Parameter(Mandatory)][string]$Token,
|        [ValidateSet('Get','Post','Patch')][string]$Method = 'Get',
|        [hashtable]$Body,
|        [int]$TimeoutSec = 300,
|        # #882 (A2): 6 attempts (was 3 in ~3 s -- data sync, asset tagging and the close-loop mail failed under ordinary
|        # Graph throttling), the wait Graph asks for (Retry-After) honoured, a 500 temporary for a read or a PATCH (never for
|        # a POST, which may not be safe to repeat), and an expired token renewed once
|        [int]$MaxAttempts = 6,
|        [string]$ApiVersion = 'v1.0',
|        # test seam: { param($Seconds) }
|        [scriptblock]$Sleep
|    )
|
|    $url = if ($Uri -match '^https?://') { $Uri } else { ('https://graph.microsoft.com/{0}{1}' -f $ApiVersion, $Uri) }
|    $headers = @{ Authorization = ('Bearer ' + $Token); 'ConsistencyLevel' = 'eventual' }
|    if (-not $Sleep) { $Sleep = { param($s) Start-Sleep -Seconds $s } }
|    $renewed = $false
|
|    $attempt = 0
|    while ($true) {
|        $attempt++
|        try {
|            $irmArgs = @{
|                Method      = $Method
|                Uri         = $url
|                Headers     = $headers
|                TimeoutSec  = $TimeoutSec
|                ErrorAction = 'Stop'
|            }
|            if ($Method -eq 'Post' -or $Method -eq 'Patch') {
|                # -Depth 10: the default of 2 silently truncates nested request bodies into the string
|                # "System.Collections.Hashtable", which the service rejects with a message about the
|                # payload rather than about the serialisation -- an error naming the wrong half.
|                # 🔴 UTF-8 BYTES, NOT A STRING -- see New-SIGraphJsonBody. A string body is silently
|                # transcoded to a single-byte encoding by PS 5.1 and every non-ASCII character is
|                # destroyed.
|                $irmArgs['Body']        = (New-SIGraphJsonBody -Object $Body -Depth 10)
|                $irmArgs['ContentType'] = 'application/json; charset=utf-8'
|            }
|            return Invoke-RestMethod @irmArgs
|        } catch {
|            $status = Get-SIGraphRestStatus -ErrorRecord $_
|            if ($status -eq 401 -and -not $renewed -and $url -match '^https://graph\.microsoft\.com/' -and (Get-Command -Name Get-SIGraphToken -ErrorAction SilentlyContinue)) {
|                $renewed = $true; $attempt--
|                $tk = $null; try { $tk = [string](Get-SIGraphToken -Resource Graph -ForceRefresh) } catch { $tk = $null }
|                if ($tk) { $headers['Authorization'] = 'Bearer ' + $tk; continue }
|            }
|            $temp = (Test-SIGraphRestTransient -Status $status) -or ($status -eq 500 -and $Method -ne 'Post')
|            if (-not $temp -or $attempt -ge $MaxAttempts) { throw }
|            $delay = Get-SIGraphRestRetryAfter -ErrorRecord $_
|            if ($null -eq $delay) { $delay = [int][Math]::Min(60, [Math]::Pow(2, $attempt)) }   # 2, 4, 8, 16, 32 s
|            Write-Verbose ('Graph transient error (HTTP {0}) on {1} -- retry {2}/{3} in {4}s' -f $status, $url, $attempt, $MaxAttempts, $delay)
|            & $Sleep $delay
|        }
|    }
|}
|
|function Invoke-SIGraphRestPaged {
|    <#
|        GET with `@odata.nextLink` paging. Returns the combined `.value` array.
|
|        🪤 RETURNS A REAL ARRAY, ALWAYS. `,$list.ToArray()` is the shape that has defeated guards in
|        this codebase repeatedly -- with zero results a `@(...)` wrapper yields an array CONTAINING an
|        empty array, so `.Count` reads 1 and "nothing found" becomes "found one thing". Emitting the
|        ArrayList's ToArray() directly keeps an empty result empty.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$RelativeUrl,
|        [Parameter(Mandatory)][string]$Token,
|        [int]$TimeoutSec = 300,
|        [string]$ApiVersion = 'v1.0'
|    )
|
|    $all = New-Object System.Collections.ArrayList
|    $url = $RelativeUrl
|    while ($url) {
|        $resp = Invoke-SIGraphRest -Uri $url -Token $Token -Method Get -TimeoutSec $TimeoutSec -ApiVersion $ApiVersion
|        if ($null -ne $resp -and $resp.PSObject.Properties['value'] -and $null -ne $resp.value) {
|            foreach ($item in @($resp.value)) { [void]$all.Add($item) }
|        }
|        # The nextLink is absolute and already carries the query + skiptoken.
|        $url = if ($resp -and $resp.PSObject.Properties['@odata.nextLink']) { [string]$resp.'@odata.nextLink' } else { $null }
|    }
|    return $all.ToArray()
|}
|
|function Invoke-SIHuntingQueryRest {
|    <#
|        Advanced Hunting over REST -- the replacement for `Start-MgBetaSecurityHuntingQuery` (#113b).
|
|        🔑 IT IS THE SAME ENDPOINT THE SDK CALLED. `POST /security/runHuntingQuery`, which
|        `engine/asset-profiling/shared/HuntingQuery.ps1:136` has been calling directly all along, and
|        which Risk Analysis' own comments name while debugging the nginx in front of it
|        (`RA-GraphHunting.ps1:593,659`). The SDK was a wrapper over this URL, not a capability.
|
|        🔒 THIS RETURNS THE SDK'S RESPONSE SHAPE ON PURPOSE, and that is the whole design of the port.
|        `Invoke-RiskAnalysis.ps1` reads `$resp.Results.AdditionalProperties` in FOUR places, and
|        `RA-ExcelReport.ps1` documents that bag as the row source. Returning raw Graph JSON would have
|        meant changing every one of those and the tests around them. Emitting
|        `Results[].AdditionalProperties` confines the change to the transport, so nothing downstream
|        moves.
|
|        🔴 NO RETRY HERE, DELIBERATELY, AND IT IS NOT AN OVERSIGHT. `Invoke-SIGraphRest` retries
|        429/502/503/504 -- correct for ordinary reads, WRONG for hunting. Risk Analysis records why:
|        a 502 from the nginx in front of the AH backend is the deterministic "response too large to
|        proxy" signal, and "retrying the identical query just burns 4 more attempts (each up to 900s)
|        on the same fail". The bucket-escalation loop OWNS retry for this call; a second retry policy
|        underneath it would silently multiply a 15-minute failure by four.
|
|        🪤 THE TWO ERROR SIGNALS MUST SURVIVE THE TRANSPORT CHANGE, or AutoBucket escalation stops and
|        nothing says so. Downstream classification matches on TEXT:
|          * the 900s ceiling must still read as `TaskCanceledException` -- under the SDK it arrived as
|            that type; over REST a client timeout is a WebException on 5.1 and a TaskCanceled/
|            HttpRequestException on 7, so it is NORMALISED to text containing 'TaskCanceledException'.
|          * a 502 must still read as `502 Bad Gateway`. Invoke-RestMethod's own message is
|            "(502) Bad Gateway" -- parenthesised -- which does NOT match the existing
|            `-match '502 Bad Gateway'`. The status line is therefore composed explicitly.
|        Getting either wrong does not throw; it silently stops the ramp on exactly the reports that
|        need it, which is the failure this comment exists to prevent.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Query,
|        [Parameter(Mandatory)][string]$Token,
|        [int]$TimeoutSec  = 900,          # matches the old Set-MgRequestContext -ClientTimeout 900
|        [string]$ApiVersion = 'beta',     # the SDK cmdlet was the BETA one; endpoint kept identical
|
|        # 🔒 Return a result object instead of throwing. Used by the advanced-hunting PROBE, whose
|        # expected answer is a 400 -- once per SI_*_Profile_CL table, every run. See the comment at
|        # the throw site: this is what keeps a working routing decision out of the transcript.
|        [switch]$AsResult
|    )
|
|    $url  = ('https://graph.microsoft.com/{0}/security/runHuntingQuery' -f $ApiVersion)
|    # 🔴 UTF-8 BYTES. RA inlines real device and user names into the query, so this body carries
|    # customer data, not just KQL -- and on PS 5.1 a STRING body loses every non-ASCII character.
|    # That is not theoretical: it is what a live run produced on 2026-09-08, as 400 BadRequest
|    # "Unable to read JSON request payload" on 18 buckets. See New-SIGraphJsonBody.
|    $body = New-SIGraphJsonBody -Object @{ Query = $Query } -Depth 5
|
|    $errText = $null
|    $http    = $null
|    # PARTS ASKED AHEAD (see Start-SIHuntingPrefetch): while a part is asked ahead its request is sent now and left on its
|    # way; when the part runs, its own request finds that answer. The probe (-AsResult) is never asked ahead.
|    $__pf = $null
|    if (-not $AsResult -and $null -ne $script:SIHuntingPrefetch) {
|        if ($script:SIHuntingPrefetch.Capture) {
|            $null = Start-SIHuntingPrefetch -Store $script:SIHuntingPrefetch -Uri $url -Token $Token -BodyBytes $body -TimeoutSec $TimeoutSec
|            throw (Get-SIHuntingAheadStartedText)
|        }
|        if ($script:SIHuntingPrefetch.Entries.Count -gt 0) {
|            $__pfKey = Get-SIHuntingBodyKey -BodyBytes $body
|            if ($script:SIHuntingPrefetch.Entries.ContainsKey($__pfKey)) { $__pf = $script:SIHuntingPrefetch.Entries[$__pfKey]; [void]$script:SIHuntingPrefetch.Entries.Remove($__pfKey) }
|        }
|    }
|    # a request sent here and now while parts are asked ahead is measured too (the engine waited for all of it): how quickly
|    # Defender answers -- and whether it throttles -- is learned from every answer, not only from the parts asked ahead
|    $__direct = if ($null -eq $__pf -and -not $AsResult -and $null -ne $script:SIHuntingPrefetch) { [System.Diagnostics.Stopwatch]::StartNew() } else { $null }
|    try {
|        $http = if ($null -ne $__pf) { Receive-SIHuntingPrefetch -Store $script:SIHuntingPrefetch -Entry $__pf }
|                else { Invoke-SIGraphHttp -Uri $url -Token $Token -Method Post -BodyBytes $body -TimeoutSec $TimeoutSec }
|        if ($null -ne $__direct) {
|            $__direct.Stop()
|            $script:SIHuntingPrefetch.Answers.Add([pscustomobject]@{ Part = -1; Status = [int]$http.StatusCode; RetryAfterSec = [int]$http.RetryAfterSec; WaitedSec = [double]$__direct.Elapsed.TotalSeconds; Seconds = [double]$__direct.Elapsed.TotalSeconds; Peeked = $false })
|        }
|    } catch {
|        # Only a genuine TRANSPORT failure reaches here now -- HTTP status codes come back as data.
|        # A timeout arrives as TaskCanceledException wrapped in the MethodInvocationException that
|        # GetResult() raises through PowerShell, so both the exception and its inner are inspected.
|        $ex = $_.Exception
|        $inner = $ex.InnerException
|        $isTimeout = ($ex -is [System.Threading.Tasks.TaskCanceledException]) -or
|                     ($inner -is [System.Threading.Tasks.TaskCanceledException]) -or
|                     ($ex -is [System.Net.WebException] -and $ex.Status -eq [System.Net.WebExceptionStatus]::Timeout) -or
|                     ($ex.Message -match 'timed out' -or $ex.Message -match 'canceled' -or $ex.Message -match 'cancelled')
|        if ($isTimeout) {
|            $errText = ("TaskCanceledException: the request was canceled due to the configured timeout of {0} seconds elapsing." -f $TimeoutSec)
|        } else {
|            $errText = [string]$ex.Message
|        }
|    }
|
|    if (-not $errText -and $http -and -not $http.Ok) {
|        # ---- compose the status line the classifiers already match on -------------------------------
|        # 🪤 The BODY is appended because the AH backend puts the real reason there -- including the
|        # "Query cancelled on creation" text that #99/#106 turn on, and the "Failed to resolve table"
|        # text the advanced-hunting probe reads. The status line alone does not carry it.
|        $reason = switch ($http.StatusCode) {
|            502 { 'Bad Gateway' }
|            503 { 'Service Unavailable' }
|            504 { 'Gateway Timeout' }
|            413 { 'Request Entity Too Large' }
|            429 { 'Too Many Requests' }
|            400 { 'Bad Request' }
|            default { 'HTTP error' }
|        }
|        # the service's Retry-After, when it sent one, in the words Get-RABucketRetryDelaySeconds reads
|        $__ra = if ($http.PSObject.Properties['RetryAfterSec'] -and [int]$http.RetryAfterSec -gt 0) { (' (retry-after {0}s)' -f [int]$http.RetryAfterSec) } else { '' }
|        $errText = ("{0} {1} -- {2}" -f $http.StatusCode, ($reason + $__ra), $http.Body)
|    }
|
|    if ($errText) {
|        # 🔒 -AsResult IS WHAT KEEPS THE TRANSCRIPT CLEAN, and it is not a convenience. The
|        # advanced-hunting PROBE asks whether a custom LA table is mirrored into XDR and the answer is
|        # normally NO, arriving as a 400 -- once per SI_*_Profile_CL table, every run. Throwing there
|        # writes a terminating error to the transcript for a routing decision that worked perfectly.
|        # The QUERY path still throws, because RA's bucket-escalation loop is built around catching it.
|        if ($AsResult) { return [pscustomobject]@{ Ok = $false; Error = $errText; Results = @(); Schema = $null } }
|        throw $errText
|    }
|
|    $resp = $null
|    if ($http -and $http.Body) {
|        try { $resp = $http.Body | ConvertFrom-Json } catch {
|            $msg = ('advanced hunting returned a body that is not JSON: {0}' -f $_.Exception.Message)
|            if ($AsResult) { return [pscustomobject]@{ Ok = $false; Error = $msg; Results = @(); Schema = $null } }
|            throw $msg
|        }
|    }
|
|    # ---- adapt to the SDK's shape ------------------------------------------------------------------
|    # Each row becomes an object carrying an AdditionalProperties dictionary, because that is exactly
|    # what `Results[].AdditionalProperties` broadcasts over downstream.
|    $rows = New-Object System.Collections.ArrayList
|    if ($null -ne $resp -and $resp.PSObject.Properties['results'] -and $null -ne $resp.results) {
|        foreach ($r in @($resp.results)) {
|            $bag = [ordered]@{}
|            foreach ($p in $r.PSObject.Properties) { $bag[$p.Name] = $p.Value }
|            [void]$rows.Add([pscustomobject]@{ AdditionalProperties = $bag })
|        }
|    }
|    $schema = if ($resp -and $resp.PSObject.Properties['schema']) { $resp.schema } else { $null }
|    # 📌 Ok/Error are present on the SUCCESS shape too, so an -AsResult caller can test one property
|    # either way rather than distinguishing two different object shapes.
|    return [pscustomobject]@{ Schema = $schema; Results = $rows.ToArray(); Ok = $true; Error = $null }
|}
'@ }
$__siSupportFiles['auth/Get-SIGraphToken.ps1'] = @{ Sha256 = 'c4992331c6c2dcef693fdea79948cdc75c0f1b6d728b22cf0ce95bc3713225bb'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight v2.2 -- Microsoft Graph / MDE / Defender token helper.
|
|    Three paths, tried in order:
|      1. User Assigned Managed Identity (production / Container App Job)
|         -- when $env:IDENTITY_ENDPOINT and $env:IDENTITY_HEADER are set
|         (Container Apps injects these), we hit the local IMDS endpoint
|         to mint a token. No secrets, no rotation overhead.
|      2. SPN with secret (production / dev VM)
|         -- pulls from $global:SI_Graph_AppId + $global:SI_Graph_TenantId
|         + $global:SI_Graph_Secret. Uses the v2 token endpoint directly.
|      3. The run's own sign-in (last resort)
|         -- Get-SIAzAccessToken, over REST (no PowerShell module).
|
|    Bootstrap-Auth.ps1 populates the SI_Graph_* globals from the customer's
|    Key Vault (Modern-ApplicationId-O365 / Modern-Secret-O365).
|    Bootstrap-ContainerAppJob.ps1 -UseManagedIdentity assigns ONE user-assigned
|    identity to every engine job (#209); the container entry point then sets
|    $global:SI_UseManagedIdentity + SI_UAMI_ClientId and this helper takes the
|    identity endpoint (auth/SI-ManagedIdentity.ps1) before anything else.
|
|    Tokens are cached for 50 minutes (Graph token TTL is 60-90 minutes;
|    50-minute cache leaves a safety margin).
|#>
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../engine/_shared/SI-AzRest.ps1') }
|
|if (-not (Get-Variable -Name SIGraphTokenCache -Scope Script -ErrorAction SilentlyContinue)) {
|    $script:SIGraphTokenCache = @{}    # resourceUrl -> @{ Token; ExpiresAt }
|}
|
|function Get-SIGraphToken {
|    [CmdletBinding()]
|    param(
|        [ValidateSet('Graph','MDE','Defender','SentinelDataLake')]
|        [string]$Resource = 'Graph',
|
|        [switch]$ForceRefresh
|    )
|
|    $resourceUrl = switch ($Resource) {
|        'Graph'            { 'https://graph.microsoft.com' }
|        'MDE'              { 'https://api.security.microsoft.com' }
|        'Defender'         { 'https://api.securitycenter.microsoft.com' }
|        'SentinelDataLake' { 'https://api.securityplatform.microsoft.com' }
|    }
|
|    # The cache is created HERE, not only when this file loads: `$script:` is the scope of the SCRIPT that is running, and
|    # a script started from another one (the data health check, started by the verification engine) has its own -- this
|    # function is visible there, the file-level cache is not. Measured live 2026-10-15 (the first data health run): "You
|    # cannot call a method on a null-valued expression" on every Graph and Defender read. (auth\SI-ManagedIdentity.ps1
|    # has the same guard for the same reason.)
|    if ($null -eq $script:SIGraphTokenCache) { $script:SIGraphTokenCache = @{} }
|    if (-not $ForceRefresh -and $script:SIGraphTokenCache.ContainsKey($resourceUrl)) {
|        $cached = $script:SIGraphTokenCache[$resourceUrl]
|        if ($cached.ExpiresAt -gt [datetime]::UtcNow) {
|            return $cached.Token
|        }
|    }
|
|    # #209/#222 -- the MANAGED IDENTITY, first, and ONLY when the run's one switch is on ($global:SI_UseManagedIdentity,
|    # set by the container entry point, or on a VM by the sign-in decision in the config loader). The client id is
|    # optional; auth/SI-ManagedIdentity.ps1 picks the host's endpoint (container, Azure VM, Azure Arc server). When the
|    # helper is not loaded, Test-SIUseManagedIdentity does not exist and nothing below this block changes.
|    if ((Get-Command -Name Test-SIUseManagedIdentity -ErrorAction SilentlyContinue) -and (Test-SIUseManagedIdentity)) {
|        # The data lake's resource is its app id (see the SPN branch below for why).
|        $miResource = if ($Resource -eq 'SentinelDataLake') { '4500ebfb-89b6-4b14-a480-7f749797bfcd' } else { $resourceUrl }
|        $tokenStr = Get-SIManagedIdentityToken -Resource $miResource -ForceRefresh:$ForceRefresh
|        $script:SIGraphTokenCache[$resourceUrl] = @{ Token = $tokenStr; ExpiresAt = [datetime]::UtcNow.AddMinutes(30) }
|        return $tokenStr
|    }
|
|    # SPN-secret is the primary path. Read SI_SPN_* (new names)
|    # with backwards-compat fallback to SI_Graph_*.
|    # UAMI/IMDS is now opt-in (only when $global:SI_PreferUami = $true) --
|    # SPN replication across tenants is more flexible than UAMI.
|    $spnAppId    = if ($global:SI_SPN_AppId)    { $global:SI_SPN_AppId }    else { $global:SI_Graph_AppId }
|    $spnSecret   = if ($global:SI_SPN_Secret)   { $global:SI_SPN_Secret }   else { $global:SI_Graph_Secret }
|    $spnTenantId = if ($global:SI_SPN_TenantId) { $global:SI_SPN_TenantId } else { $global:SI_Graph_TenantId }
|
|    # Certificate, resolved the same way every other SI engine resolves it. Also accept the
|    # AutomationFramework's HighPriv_* name, because on an internal install that is the ONLY place the
|    # thumbprint exists -- which is exactly how a cert customer ended up with no first-class token path.
|    $spnCertThumb = if ($global:SI_SPN_CertThumbprint) { [string]$global:SI_SPN_CertThumbprint }
|                    else { [string]$global:HighPriv_Modern_CertificateThumbprint_Azure }
|
|    # SPN with secret (PRIMARY path ).
|    if ($spnAppId -and $spnSecret -and $spnTenantId) {
|        # SentinelDataLake's resource principal isn't registered under a URI in
|        # most tenants -- AADSTS500011 if you ask for the URL. Microsoft docs the
|        # data-lake service principal as the GUID below; use it as the v2 scope
|        # identifier. Other resources still resolve fine via their URL.
|        $scope = if ($Resource -eq 'SentinelDataLake') {
|                     '4500ebfb-89b6-4b14-a480-7f749797bfcd/.default'
|                 } else {
|                     ($resourceUrl + '/.default')
|                 }
|        $body = @{
|            client_id     = $spnAppId
|            scope         = $scope
|            client_secret = $spnSecret
|            grant_type    = 'client_credentials'
|        }
|        $resp = Invoke-RestMethod -Method Post `
|            -Uri ('https://login.microsoftonline.com/{0}/oauth2/v2.0/token' -f $spnTenantId) `
|            -Body $body -ContentType 'application/x-www-form-urlencoded'
|        $tokenStr = $resp.access_token
|        $expiresAt = [datetime]::UtcNow.AddSeconds(($resp.expires_in - 600))
|    }
|    elseif ($spnAppId -and $spnCertThumb -and $spnTenantId) {
|        # SPN with CERTIFICATE -- first-class, same client_credentials grant as the secret path above,
|        # signed with a JWT client assertion instead of a shared secret.
|        #
|        # WHY THIS EXISTS. Before this, a certificate-authenticated customer had no SPN path at all: the
|        # secret branch was skipped (no secret) and the run fell through to the interactive-Az fallback,
|        # which failed with the opaque "ClientCertificateCredential authentication failed:" -- no AADSTS
|        # code, no scope, nothing to act on. Observed live on a customer whose Sentinel data lake route
|        # died on that line, which then forced every RA query onto advanced hunting, the one path that
|        # HAS a 900s ceiling.
|        #
|        # NOTE ON SCOPE, so this is not misread: making the certificate path first-class does not by
|        # itself grant the SPN anything. If the app registration is not consented for the resource, this
|        # branch now returns a real AADSTS error naming the missing grant, instead of the opaque
|        # credential failure above. Diagnosable rather than silent -- that is the improvement.
|        $scope = if ($Resource -eq 'SentinelDataLake') {
|                     '4500ebfb-89b6-4b14-a480-7f749797bfcd/.default'
|                 } else {
|                     ($resourceUrl + '/.default')
|                 }
|
|        $clean = ($spnCertThumb -replace '\s','').ToUpperInvariant()
|        $cert  = $null
|
|        # 🔴 THE `Cert:` PROVIDER IS THE CONVENIENCE; `X509Store` IS THE AUTHORITY. This is framework
|        # finding AUTH-1, and until 2026-08-31 this function only used the provider.
|        #
|        # 🪤 THE PROVIDER IS NOT ALWAYS THERE. A Windows PowerShell 5.1 child that inherits a pwsh 7
|        # parent's PSModulePath resolves Microsoft.PowerShell.Security to the PS7 build, fails to load
|        # it, and LOSES THE `Cert:` DRIVE WITH IT -- so `Get-ChildItem Cert:\LocalMachine\My` returns
|        # nothing for a certificate that is installed, readable and has a private key. The failure then
|        # reads as "the certificate is missing", which sends someone to re-issue a certificate that was
|        # never gone.
|        #
|        # 📌 MEASURED HERE 2026-08-31: the identity profiler failed with
|        # `certificate '78E4…' was not found with a private key`, while the SAME thumbprint resolved
|        # via BOTH paths from a directly-invoked shell in the same session. The difference was only how
|        # the process was launched. `SI-ObjectLedgerStore.ps1` already carried this workaround; the auth
|        # path every engine depends on did not.
|        foreach ($store in 'LocalMachine','CurrentUser') {
|            if (Get-PSDrive -Name Cert -ErrorAction SilentlyContinue) {
|                $cert = Get-ChildItem "Cert:\$store\My" -ErrorAction SilentlyContinue |
|                        Where-Object { $_.Thumbprint -eq $clean -and $_.HasPrivateKey } |
|                        Select-Object -First 1
|            }
|            if (-not $cert) {
|                try {
|                    $x = New-Object System.Security.Cryptography.X509Certificates.X509Store('My', $store)
|                    $x.Open('ReadOnly')
|                    $cert = @($x.Certificates | Where-Object { $_.Thumbprint -eq $clean -and $_.HasPrivateKey })[0]
|                    $x.Close()
|                } catch { }
|            }
|            if ($cert) { break }
|        }
|        if (-not $cert) {
|            # 🪤 THE MESSAGE USED TO PRINT THE LITERAL `{0}`, AND THAT COST A DIAGNOSIS.
|            # `"A" + "B" -f $x` parses as `"A" + ("B" -f $x)`, so the placeholder in the FIRST literal
|            # was never substituted and the error named no thumbprint at all -- on the one failure
|            # whose entire question is "which thumbprint?". Parenthesise the concatenation before -f.
|            # 🔑 And distinguish the case that actually bit: an EMPTY thumbprint is not a missing
|            # certificate, it is a missing CONFIGURATION, and sending someone to the certificate store
|            # to look for '' wastes the trip.
|            if ([string]::IsNullOrWhiteSpace($clean)) {
|                throw ("Get-SIGraphToken: no certificate thumbprint is configured, so there is nothing to look for. " +
|                       "On the internal-vm flavour this comes from Connect-Platform / Initialize-PlatformAutomationFramework " +
|                       "(HighPriv_Modern_CertificateThumbprint_Azure); on community installs from " +
|                       "config\SecurityInsight.custom.ps1 (SI_SPN_CertThumbprint). Running an engine standalone, " +
|                       "without the platform connect, reaches here.")
|            }
|            throw (("Get-SIGraphToken: certificate '{0}' was not found with a private key in LocalMachine\My or CurrentUser\My. " +
|                    "Note that a sandboxed or restricted-profile shell can report BOTH stores as empty.") -f $clean)
|        }
|
|        $tokenUri = 'https://login.microsoftonline.com/{0}/oauth2/v2.0/token' -f $spnTenantId
|        $now      = [DateTimeOffset]::UtcNow.ToUnixTimeSeconds()
|
|        # base64url, per RFC 7515: standard base64 with +/ swapped for -_ and the padding stripped.
|        $b64url = {
|            param([byte[]]$Bytes)
|            [Convert]::ToBase64String($Bytes).TrimEnd('=').Replace('+','-').Replace('/','_')
|        }
|
|        # x5t is the cert's SHA-1 thumbprint as base64url BYTES -- not the hex string. Passing the hex
|        # yields AADSTS700027 with no hint that the encoding is what is wrong.
|        $x5t = & $b64url $cert.GetCertHash()
|
|        $header = @{ alg = 'RS256'; typ = 'JWT'; x5t = $x5t } | ConvertTo-Json -Compress
|        # aud/iss/sub/jti/nbf/exp per the client-assertion spec. 10-minute life: the assertion is used
|        # once, immediately, so a short window costs nothing and limits replay.
|        $claims = @{
|            aud = $tokenUri
|            iss = $spnAppId
|            sub = $spnAppId
|            jti = [guid]::NewGuid().ToString()
|            nbf = $now
|            exp = $now + 600
|        } | ConvertTo-Json -Compress
|
|        $enc         = [System.Text.Encoding]::UTF8
|        $signingInput = ('{0}.{1}' -f (& $b64url $enc.GetBytes($header)), (& $b64url $enc.GetBytes($claims)))
|
|        # GetRSAPrivateKey (not the legacy .PrivateKey property): CNG-stored keys return $null from
|        # .PrivateKey on PS 5.1, and most modern certs are CNG. Do NOT reach for ImportFromPem here --
|        # it is .NET Core 3.0+ / PS 7 only and these engines run on Windows PowerShell 5.1.
|        $rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
|        if (-not $rsa) {
|            throw (("Get-SIGraphToken: certificate '{0}' has no usable RSA private key (GetRSAPrivateKey returned null). " +
|                    "If the key is CNG-stored, confirm this account has read access to it.") -f $clean)
|        }
|        $sig = $rsa.SignData($enc.GetBytes($signingInput),
|                             [System.Security.Cryptography.HashAlgorithmName]::SHA256,
|                             [System.Security.Cryptography.RSASignaturePadding]::Pkcs1)
|        $assertion = '{0}.{1}' -f $signingInput, (& $b64url $sig)
|
|        $body = @{
|            client_id             = $spnAppId
|            scope                 = $scope
|            client_assertion_type = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
|            client_assertion      = $assertion
|            grant_type            = 'client_credentials'
|        }
|        $resp = Invoke-RestMethod -Method Post -Uri $tokenUri -Body $body -ContentType 'application/x-www-form-urlencoded'
|        $tokenStr  = $resp.access_token
|        $expiresAt = [datetime]::UtcNow.AddSeconds(($resp.expires_in - 600))
|    }
|    else {
|        # Last resort -- the run's own sign-in, over REST.
|        $azTok = Get-SIAzAccessToken -ResourceUrl $resourceUrl
|        if ($azTok.Token -is [System.Security.SecureString]) {
|            $tokenStr = [System.Net.NetworkCredential]::new('', $azTok.Token).Password
|        } else {
|            $tokenStr = $azTok.Token
|        }
|        # Cache until the token's OWN expiry less a margin. A flat 50 minutes outlived tokens a
|        # token cache handed back part-used (e.g. 10 minutes left), and every call for the next ~40
|        # minutes then sent an expired token.
|        $expiresAt = [datetime]::UtcNow.AddMinutes(50)
|        try {
|            if ($azTok.ExpiresOn) {
|                $tokExp = ([DateTimeOffset]$azTok.ExpiresOn).UtcDateTime.AddMinutes(-5)
|                if ($tokExp -lt $expiresAt) { $expiresAt = $tokExp }
|            }
|        } catch {}
|    }
|
|    $script:SIGraphTokenCache[$resourceUrl] = @{
|        Token     = $tokenStr
|        ExpiresAt = $expiresAt
|    }
|    return $tokenStr
|}
'@ }
$__siSupportFiles['engine/_shared/SI-OutboundTrust.ps1'] = @{ Sha256 = '34fe997008df9445c117d2c98cdf791cb808bf4acc3277a0543851b01d290217'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT -- WHERE A CREDENTIAL MAY GO. PURE checks, each returning '' (allowed) or the reason in plain words.
|    The engine uses them where it sends a token, a key or the install's own credential; a value one of them refuses is left
|    out of the run and said (a warning), never the end of the run. The web app checks the same rules when a person saves a
|    setting (pro-management/src/SI.Management.Web/Settings/OutboundHostPolicy.cs).
|
|      Test-SIAzureSqlHost            the SQL server the engine sends its Azure SQL access token to: an Azure SQL host
|      Test-SITelemetryEndpointHost   the uplink the install key goes to: https, invardia.com or a subdomain of it
|      Test-SIHttpsSameOrigin         a connector's request or next page: https, the same host and port as its own base address
|      Test-SISqlDatabaseName         a database name, never a connection-string fragment
|      New-SISqlConnectionString      the Azure SQL connection string, built (never formatted) from the server and database
|
|    Strict-mode safe; PS 5.1 and 7.
|#>
|
|function Get-SIAzureSqlHostSuffixes { @('.database.windows.net', '.database.usgovcloudapi.net', '.database.chinacloudapi.cn', '.database.cloudapi.de') }
|
|function Get-SISqlServerHostName {
|    <# PURE. 'tcp:<host>,<port>' / '<host>,<port>' / '<host>' -> '<host>' (lower case). #>
|    param([AllowEmptyString()][string]$Server = '')
|    $h = "$Server".Trim()
|    if ($h.StartsWith('tcp:', [StringComparison]::OrdinalIgnoreCase)) { $h = $h.Substring(4) }
|    $c = $h.IndexOf(','); if ($c -ge 0) { $h = $h.Substring(0, $c) }
|    $h.Trim().ToLowerInvariant()
|}
|
|function Test-SIAzureSqlHost {
|    <# PURE. '' = -Server is an Azure SQL server (public or sovereign cloud) the engine's SQL access token may go to. #>
|    param([AllowEmptyString()][string]$Server = '')
|    $h = Get-SISqlServerHostName -Server $Server
|    if (-not $h) { return 'no SQL server is named' }
|    if ($h -notmatch '^[a-z0-9.-]+$') { return ("'{0}' is not a SQL server name" -f "$Server".Trim()) }
|    foreach ($s in (Get-SIAzureSqlHostSuffixes)) { if ($h.EndsWith($s) -and $h.Length -gt $s.Length) { return '' } }
|    ("'{0}' is not an Azure SQL server (<name>.database.windows.net)" -f $h)
|}
|
|function Test-SISqlDatabaseName {
|    <# PURE. '' = -Database is a database name (1-128 characters, no ; = quote bracket brace or control character). #>
|    param([AllowEmptyString()][string]$Database = '')
|    $d = "$Database".Trim()
|    if (-not $d) { return 'no database is named' }
|    if ($d.Length -gt 128 -or $d -match '[;=''"\[\]{}\x00-\x1f]') { return ("'{0}' is not a database name" -f $d) }
|    ''
|}
|
|function New-SISqlConnectionString {
|    <#
|        PURE. The connection string for an Azure SQL database with an Entra token: built with SqlConnectionStringBuilder, so a
|        server or database value is always ONE value (a ';' in it can never add a keyword). Encrypted, the certificate checked.
|    #>
|    param([Parameter(Mandatory)][string]$Server, [Parameter(Mandatory)][string]$Database, [int]$ConnectTimeoutSec = 30)
|    $csb = New-Object System.Data.SqlClient.SqlConnectionStringBuilder
|    $csb['Data Source'] = ('tcp:{0},1433' -f (Get-SISqlServerHostName -Server $Server))
|    $csb['Initial Catalog'] = "$Database".Trim()
|    $csb['Encrypt'] = $true; $csb['TrustServerCertificate'] = $false; $csb['Connect Timeout'] = $ConnectTimeoutSec
|    $csb.ConnectionString
|}
|
|function Test-SITelemetryEndpointHost {
|    <# PURE. '' = -Endpoint is Invardia's own https address (invardia.com or a subdomain) -- the only place the install key goes. #>
|    param([AllowEmptyString()][string]$Endpoint = '')
|    $e = "$Endpoint".Trim()
|    if (-not $e) { return 'no endpoint is set' }
|    $u = $null
|    if (-not [Uri]::TryCreate($e, [UriKind]::Absolute, [ref]$u)) { return ("'{0}' is not an address" -f $e) }
|    if ($u.Scheme -ne 'https') { return ("'{0}' is not https" -f $e) }
|    if ($u.UserInfo) { return ("'{0}' carries a user name" -f $u.Host) }
|    $h = $u.Host.ToLowerInvariant()
|    if ($h -eq 'invardia.com' -or $h.EndsWith('.invardia.com')) { return '' }
|    ("'{0}' is not an Invardia address" -f $u.Host)
|}
|
|function Test-SIHttpsSameOrigin {
|    <# PURE. '' = -Url is https with the same host and port as -BaseUrl (which must be https itself). #>
|    param([AllowEmptyString()][string]$Url = '', [AllowEmptyString()][string]$BaseUrl = '')
|    $b = $null; $u = $null
|    if (-not [Uri]::TryCreate("$BaseUrl".Trim(), [UriKind]::Absolute, [ref]$b) -or $b.Scheme -ne 'https') { return 'the connector''s base address is not an https address' }
|    if (-not [Uri]::TryCreate("$Url".Trim(), [UriKind]::Absolute, [ref]$u)) { return ("'{0}' is not an address" -f $Url) }
|    if ($u.Scheme -ne 'https') { return ("'{0}' is not https" -f $u.GetLeftPart([UriPartial]::Authority)) }
|    if ($u.UserInfo) { return ("'{0}' carries a user name" -f $u.Host) }
|    if (-not [string]::Equals($u.Host, $b.Host, [StringComparison]::OrdinalIgnoreCase) -or $u.Port -ne $b.Port) {
|        return ("'{0}' is not the connector's own host ({1})" -f $u.Authority, $b.Authority)
|    }
|    ''
|}
'@ }
$__siSupportFiles['engine/_shared/SI-GuardStrict.ps1'] = @{ Sha256 = '616e34c03123322f8bef8d6700169ef37f1224bd91a746b7a37e585bec405a05'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- STRICTER SAFETY CHECKS FOR 24 HOURS AFTER A RELEASE THAT CHANGED ENGINE CODE (CR4, SI #654; framework
|    DOCS/REQUIREMENTS.md §12.11b GUARD-STRICT; approved by the owner 2026-10-14).
|
|    THE TRIGGER -- the engine fingerprint. The updater computes a SHA-256 fingerprint over the engine folders of the release
|    it has just installed (Get-SIEngineFingerprint: engine/, launcher/, risk-analysis-detection/ -- the same folders the
|    publish call judges `engineChanged` by) and records it in the Pro database (cfg.InstallState 'EngineFingerprint'). A
|    fingerprint that DIFFERS from the one recorded starts the stricter period; the same fingerprint (a template / text /
|    web-only release) keeps it as it is. The FIRST fingerprint an install records starts nothing: an install that never
|    recorded one (every install before this) behaves exactly as before -- no stricter period is invented.
|
|    THE RULE -- every numbered damage brake (the limit a customer configures) is halved while the period lasts:
|    effective = max(1, floor(configured x 0.5)), never above the configured value (a limit of 1 stays 1; 0 = "no limit"
|    stays 0). Never lower than a limit a SuperAdmin approved for one run. The brakes (Resolve-SIGuardLimit at each one):
|      vuln.connector.close-ceiling       SI_VulnSync_MaxClosePercent, SI_VulnSync_MaxCloseAbsolute
|      asset.properties.collection-change SI_AssetProperties_ChangeGuardPercent
|      cmdb.handoff.mass-change           the hand-off connector's changeGuardPercent (default the same setting)
|      collection.source.asset-drop       SI_Pro_DataQuality_AssetDropPercent
|      exemption.bulk.refused             SIWeb_Exemption_BulkMax (the web app, Guards\GuardMode.cs)
|
|    THE PERIOD -- 24 hours from the time the updater recorded the changed fingerprint. A SuperAdmin may end it early with
|    a reason (the web app, Operations > Guards (safety checks); audited guard.strict.end-early) -- cfg.InstallState 'GuardStrictEnd'.
|
|    A STRICT TRIP is a normal trip: it holds as always and mails when its check mails (a check the catalog marks "mail": "never" does not); its numbers say the limit is halved, worded calmly
|    ("stricter period after release X until <time>"), and its report to Invardia carries Strict, ConfiguredLimit and
|    EffectiveLimit. The identified heartbeat carries guardMode { mode, until, startedBy, version, endedEarlyAt, endedBy }.
|
|    NEVER THROWS where a job calls it: anything that cannot be read means Normal (the limits as configured -- as today).
|    PS 5.1 and 7.
|#>
|
|function Get-SIGuardStrictState {
|    <# The value of $script:SIGuardStrict, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIGuardStrict) { $script:SIGuardStrict = @{
|    Hours          = 24
|    Folders        = @('engine', 'launcher', 'risk-analysis-detection')
|    FingerprintRow = 'EngineFingerprint'
|    EndRow         = 'GuardStrictEnd'
|    CacheMinutes   = 5
|} }
|    , $script:SIGuardStrict
|}
|$script:SIGuardStrict = $null; $null = Get-SIGuardStrictState
|
|# =====================================================================================================================
|#  The engine fingerprint -- deterministic
|# =====================================================================================================================
|function Get-SIEngineFingerprintFolders {
|    <# PURE. The engine folders (relative to the solution root), the same as the publish call's Get-SIEngineFolders. #>
|    @((Get-SIGuardStrictState).Folders)
|}
|
|function Get-SIEngineFingerprint {
|    <#
|        The engine fingerprint of the code under -SIRoot: SHA-256 (lower-case hex) over one line pair per file of the engine
|        folders -- "<path>`n<sha256 of the file's bytes>`n" -- with <path> relative to -SIRoot, '/' as separator, the list
|        sorted ordinally. The same files give the same fingerprint on every machine; a renamed, added, removed or changed
|        file gives another. '' when no engine folder exists under -SIRoot (nothing to judge).
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $root = [System.IO.Path]::GetFullPath($SIRoot)
|    $files = New-Object System.Collections.Generic.List[object]
|    foreach ($f in (Get-SIEngineFingerprintFolders)) {
|        $dir = [System.IO.Path]::Combine($root, $f)
|        if (-not [System.IO.Directory]::Exists($dir)) { continue }
|        foreach ($p in [System.IO.Directory]::GetFiles($dir, '*', [System.IO.SearchOption]::AllDirectories)) {
|            $rel = $p.Substring($root.Length).TrimStart('\', '/') -replace '\\', '/'
|            $files.Add([pscustomobject]@{ Rel = $rel; Path = $p })
|        }
|    }
|    if ($files.Count -eq 0) { return '' }
|    $sorted = $files.ToArray()
|    $keys = [string[]]@($sorted | ForEach-Object { [string]$_.Rel })
|    [Array]::Sort($keys, $sorted, [StringComparer]::Ordinal)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try {
|        $sb = New-Object System.Text.StringBuilder
|        foreach ($x in $sorted) {
|            $bytes = [System.IO.File]::ReadAllBytes($x.Path)
|            $h = -join @($sha.ComputeHash($bytes) | ForEach-Object { $_.ToString('x2') })
|            [void]$sb.Append($x.Rel).Append("`n").Append($h).Append("`n")
|        }
|        return (-join @($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($sb.ToString())) | ForEach-Object { $_.ToString('x2') }))
|    } finally { $sha.Dispose() }
|}
|
|function ConvertTo-SIGuardStrictUtc {
|    <# PURE. A stored time as UTC, or $null. A text without a zone is read AS UTC. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -is [System.DBNull] -or "$Value".Trim() -eq '') { return $null }
|    if ($Value -is [datetime]) { if ($Value.Kind -eq [DateTimeKind]::Local) { return $Value.ToUniversalTime() }; return [datetime]::SpecifyKind($Value, [DateTimeKind]::Utc) }
|    $d = [datetime]::MinValue
|    $styles = [System.Globalization.DateTimeStyles]::AssumeUniversal -bor [System.Globalization.DateTimeStyles]::AdjustToUniversal
|    if ([datetime]::TryParse("$Value", [System.Globalization.CultureInfo]::InvariantCulture, $styles, [ref]$d)) { return $d }
|    $null
|}
|
|function ConvertTo-SIGuardStrictIso {
|    param([AllowNull()]$Value)
|    $u = ConvertTo-SIGuardStrictUtc $Value
|    if ($null -eq $u) { return $null }
|    $u.ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture)
|}
|
|function ConvertFrom-SIGuardStrictJson {
|    <# PURE. A stored JSON row as an object; $null for nothing / not JSON / not an object. #>
|    param([AllowNull()][AllowEmptyString()][string]$Json)
|    if ([string]::IsNullOrWhiteSpace($Json)) { return $null }
|    try { $o = ConvertFrom-Json -InputObject $Json -ErrorAction Stop } catch { return $null }
|    if ($null -eq $o -or $o -is [string] -or $o -is [System.ValueType] -or $o -is [array]) { return $null }
|    $o
|}
|
|function Get-SIGuardStrictField {
|    param($Object, [string]$Name)
|    if ($null -eq $Object) { return $null }
|    if ($Object -is [System.Collections.IDictionary]) { if ($Object.Contains($Name)) { return $Object[$Name] }; return $null }
|    if ($Object.PSObject.Properties[$Name]) { return $Object.$Name }
|    $null
|}
|
|function New-SIEngineFingerprintRecord {
|    <#
|        PURE. The updater's record after installing code with -Hash (version -Version) at -NowUtc, given the record before
|        (-Previous: its JSON). Returns @{ Record (ordered: hash, version, since, strictFrom, strictVersion); Changed; First }
|        -- $null when -Hash is empty (nothing is recorded).
|          no record before (or not readable)  recorded, NO stricter period (First = $true) -- an older install never gets
|                                              one invented
|          the same fingerprint                the record as it was (its period, if any, unchanged); the version updated
|          another fingerprint                 strictFrom = -NowUtc, strictVersion = -Version: the stricter period starts
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Previous, [AllowEmptyString()][string]$Hash, [AllowEmptyString()][string]$Version, [Parameter(Mandatory)][datetime]$NowUtc)
|    $h = "$Hash".Trim().ToLowerInvariant()
|    if ($h -notmatch '^[0-9a-f]{64}$') { return $null }
|    $now = ConvertTo-SIGuardStrictIso $NowUtc.ToUniversalTime()
|    $ver = "$Version".Trim(); if ($ver.Length -gt 50) { $ver = $ver.Substring(0, 50) }
|    $p = ConvertFrom-SIGuardStrictJson $Previous
|    $ph = ([string](Get-SIGuardStrictField $p 'hash')).Trim().ToLowerInvariant()
|    if ($ph -notmatch '^[0-9a-f]{64}$') {
|        return [pscustomobject]@{ Record = [ordered]@{ hash = $h; version = $ver; since = $now; strictFrom = $null; strictVersion = '' }; Changed = $false; First = $true }
|    }
|    if ($ph -eq $h) {
|        $rec = [ordered]@{ hash = $h; version = $(if ($ver) { $ver } else { [string](Get-SIGuardStrictField $p 'version') })
|                           since = (ConvertTo-SIGuardStrictIso (Get-SIGuardStrictField $p 'since'))
|                           strictFrom = (ConvertTo-SIGuardStrictIso (Get-SIGuardStrictField $p 'strictFrom'))
|                           strictVersion = [string](Get-SIGuardStrictField $p 'strictVersion') }
|        return [pscustomobject]@{ Record = $rec; Changed = $false; First = $false }
|    }
|    [pscustomobject]@{ Record = [ordered]@{ hash = $h; version = $ver; since = $now; strictFrom = $now; strictVersion = $ver }; Changed = $true; First = $false }
|}
|
|# =====================================================================================================================
|#  The guard mode -- PURE over the two rows
|# =====================================================================================================================
|function Get-SIGuardModeFromState {
|    <#
|        PURE. The install's guard mode from its fingerprint record (-Fingerprint) and a SuperAdmin's early end (-StrictEnd),
|        both JSON (or objects). Returns @{ Mode ('strict' | 'normal'); Recorded (a fingerprint is recorded); Until;
|        Version (the release that started the period); StrictFrom; Hash; EndedEarlyAt; EndedBy; EndedByRole; Reason }.
|        Strict = a period started (strictFrom), -NowUtc before its end (strictFrom + -Hours), and no early end OF THIS
|        PERIOD (the end names the same fingerprint and start). An early end of an older period ends nothing.
|    #>
|    param([AllowNull()]$Fingerprint, [AllowNull()]$StrictEnd, [Parameter(Mandatory)][datetime]$NowUtc, [int]$Hours = (Get-SIGuardStrictState).Hours)
|    $fp = if ($Fingerprint -is [string]) { ConvertFrom-SIGuardStrictJson $Fingerprint } else { $Fingerprint }
|    $en = if ($StrictEnd -is [string]) { ConvertFrom-SIGuardStrictJson $StrictEnd } else { $StrictEnd }
|    $now = $NowUtc.ToUniversalTime()
|    $out = [ordered]@{ Mode = 'normal'; Recorded = $false; Until = $null; Version = ''; StrictFrom = $null; Hash = ''; EndedEarlyAt = $null; EndedBy = ''; EndedByRole = ''; Reason = '' }
|    $hash = ([string](Get-SIGuardStrictField $fp 'hash')).Trim().ToLowerInvariant()
|    if ($hash -notmatch '^[0-9a-f]{64}$') { return [pscustomobject]$out }
|    $out.Recorded = $true; $out.Hash = $hash
|    $from = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $fp 'strictFrom')
|    if ($null -eq $from) { return [pscustomobject]$out }
|    $until = $from.AddHours($Hours)
|    if ($now -ge $until -or $now -lt $from.AddMinutes(-5)) { return [pscustomobject]$out }
|    $out.StrictFrom = $from; $out.Until = $until; $out.Version = [string](Get-SIGuardStrictField $fp 'strictVersion')
|    if ($en) {
|        $eh = ([string](Get-SIGuardStrictField $en 'hash')).Trim().ToLowerInvariant()
|        $ef = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $en 'strictFrom')
|        $ea = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $en 'endedAt')
|        if ($eh -eq $hash -and $ef -and [Math]::Abs(($ef - $from).TotalSeconds) -lt 1 -and $ea) {
|            $out.EndedEarlyAt = $ea; $out.EndedBy = [string](Get-SIGuardStrictField $en 'by')
|            $out.EndedByRole = $(if ([string](Get-SIGuardStrictField $en 'role')) { [string](Get-SIGuardStrictField $en 'role') } else { 'SuperAdmin' })
|            $out.Reason = [string](Get-SIGuardStrictField $en 'reason')
|            return [pscustomobject]$out
|        }
|    }
|    $out.Mode = 'strict'
|    [pscustomobject]$out
|}
|
|function ConvertTo-SIGuardModeWire {
|    <#
|        PURE. The heartbeat's guardMode (framework §12.11b item 5; Invardia's parseGuardMode): { mode ('strict' | 'normal'),
|        until, startedBy (the release that started it), version (the same), endedEarlyAt, endedBy (a ROLE, never a person) }.
|        $null when no fingerprint is recorded -- an older install sends nothing new.
|    #>
|    param([AllowNull()]$Mode)
|    if ($null -eq $Mode -or -not $Mode.Recorded) { return $null }
|    $v = "$($Mode.Version)".Trim()
|    if ($v -and $v -notmatch '^[0-9A-Za-z.+-]{1,50}$') { $v = '' }
|    $role = "$($Mode.EndedByRole)".Trim()
|    if ($role -and $role -notmatch '^[A-Za-z][A-Za-z0-9 ._-]{0,39}$') { $role = 'SuperAdmin' }
|    [ordered]@{
|        mode         = [string]$Mode.Mode
|        until        = (ConvertTo-SIGuardStrictIso $Mode.Until)
|        startedBy    = $(if ($v) { $v } else { $null })
|        version      = $(if ($v) { $v } else { $null })
|        endedEarlyAt = (ConvertTo-SIGuardStrictIso $Mode.EndedEarlyAt)
|        endedBy      = $(if ($Mode.EndedEarlyAt -and $role) { $role } else { $null })
|    }
|}
|
|# =====================================================================================================================
|#  The limit -- PURE
|# =====================================================================================================================
|function Get-SIGuardStrictLimit {
|    <#
|        PURE. One numbered limit while -Strict: effective = max(1, floor(-Configured x 0.5)), never above -Configured (a
|        limit of 1 stays 1; 0 or less = "no limit" stays as it is); never below -ApprovedForRun (a limit a SuperAdmin
|        approved for one run). Not strict = the configured value. Returns @{ Configured; Effective; Halved; Text }.
|    #>
|    param([AllowNull()]$Configured, [bool]$Strict, [AllowNull()]$ApprovedForRun)
|    $c = 0.0
|    $ok = ($null -ne $Configured) -and [double]::TryParse(("$Configured").Trim(), [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$c) -and -not [double]::IsNaN($c) -and -not [double]::IsInfinity($c)
|    if (-not $ok) { return [pscustomobject]@{ Configured = $Configured; Effective = $Configured; Halved = $false; Text = '' } }
|    $e = $c
|    if ($Strict -and $c -gt 0) {
|        $e = [Math]::Max(1.0, [Math]::Floor($c * 0.5))
|        if ($e -gt $c) { $e = $c }
|        $a = 0.0
|        if ($null -ne $ApprovedForRun -and [double]::TryParse(("$ApprovedForRun").Trim(), [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$a) -and $a -gt $e) { $e = $a }
|    }
|    $num = { param($d) if ($d -eq [Math]::Floor($d) -and [Math]::Abs($d) -lt 9e15) { [long]$d } else { [Math]::Round($d, 4) } }
|    $cv = & $num $c; $ev = & $num $e
|    $halved = ($ev -ne $cv)
|    [pscustomobject]@{ Configured = $cv; Effective = $ev; Halved = [bool]$halved; Text = $(if ($halved) { '{0} -> {1} while strict' -f $cv, $ev } else { '' }) }
|}
|
|# =====================================================================================================================
|#  The guard mode NOW -- read once per process (5 minutes), never throws
|# =====================================================================================================================
|function Get-SIGuardModeSql {
|    "IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL SELECT Name, Value FROM cfg.InstallState WHERE Name IN (N'EngineFingerprint', N'GuardStrictEnd');"
|}
|
|function Read-SIGuardModeState {
|    <# The two rows from the Pro database (-Invoke: the (sql, params, mode) seam) -> Get-SIGuardModeFromState. Throws on a
|       failed read (the caller decides). #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][datetime]$NowUtc)
|    $fp = $null; $en = $null
|    foreach ($r in @(& $Invoke (Get-SIGuardModeSql) @{} 'reader' | ForEach-Object { $_ } | Where-Object { $_ })) {
|        $n = [string](Get-SIGuardStrictField $r 'Name'); $v = [string](Get-SIGuardStrictField $r 'Value')
|        if ($n -eq (Get-SIGuardStrictState).FingerprintRow) { $fp = $v } elseif ($n -eq (Get-SIGuardStrictState).EndRow) { $en = $v }
|    }
|    Get-SIGuardModeFromState -Fingerprint $fp -StrictEnd $en -NowUtc $NowUtc
|}
|
|function Get-SIGuardModeNow {
|    <#
|        The install's guard mode now. $global:SI_GuardModeOverride (a test's, or a run's own) wins; a test session (Pester
|        loaded) never reads a database; else the Pro database (the guard seam $global:SI_GuardInvoke, else
|        Get-SIGuardProInvoke), remembered for 5 minutes. Anything that cannot be read = normal. Never throws.
|    #>
|    param([switch]$Refresh, [scriptblock]$Invoke, $NowUtc)
|    $now = if ($NowUtc) { ([datetime]$NowUtc).ToUniversalTime() } else { [datetime]::UtcNow }
|    $normal = [pscustomobject]@{ Mode = 'normal'; Recorded = $false; Until = $null; Version = ''; StrictFrom = $null; Hash = ''; EndedEarlyAt = $null; EndedBy = ''; EndedByRole = ''; Reason = '' }
|    try {
|        if ($null -ne $global:SI_GuardModeOverride) { return $global:SI_GuardModeOverride }
|        if (-not $Invoke -and (Get-Module -Name Pester)) { return $normal }
|        $c = $script:SIGuardModeCache
|        if (-not $Refresh -and -not $Invoke -and $c -and ($now - $c.At).TotalMinutes -lt (Get-SIGuardStrictState).CacheMinutes -and $now -ge $c.At) { return $c.Mode }
|        $inv = $Invoke
|        if (-not $inv -and $global:SI_GuardInvoke -is [scriptblock]) { $inv = $global:SI_GuardInvoke }
|        if (-not $inv -and (Get-Command -Name Get-SIGuardProInvoke -ErrorAction SilentlyContinue)) { $inv = Get-SIGuardProInvoke }
|        $m = if ($inv) { Read-SIGuardModeState -Invoke $inv -NowUtc $now } else { $normal }
|        if (-not $Invoke) { $script:SIGuardModeCache = [pscustomobject]@{ At = $now; Mode = $m } }
|        return $m
|    } catch { return $normal }
|}
|
|function Format-SIGuardStrictUntil {
|    <# PURE. "2026-10-15 14:00 UTC". #>
|    param([AllowNull()]$Until)
|    $u = ConvertTo-SIGuardStrictUtc $Until
|    if ($null -eq $u) { return '' }
|    '{0:yyyy-MM-dd HH:mm} UTC' -f $u
|}
|
|function Format-SIGuardStrictSentence {
|    <# PURE. The calm sentence: "Stricter period after release 3.0.1 until 2026-10-15 14:00 UTC: ...". '' when not strict. #>
|    param([AllowNull()]$Strict)
|    if ($null -eq $Strict) { return '' }
|    $after = if ("$($Strict.Version)".Trim()) { ' after release ' + "$($Strict.Version)".Trim() } else { ' after a recent release' }
|    $until = Format-SIGuardStrictUntil $Strict.Until
|    $u = if ("$($Strict.Unit)".Trim()) { ' ' + "$($Strict.Unit)".Trim() } else { '' }
|    $nums = if ($null -ne $Strict.Effective -and $null -ne $Strict.Configured) { (' Here the limit is {0}{2} (normally {1}{2}).' -f $Strict.Effective, $Strict.Configured, $u) } else { '' }
|    ('This safety check is in its stricter period{0}{1}: its limit is halved for 24 hours after a release that changed the engine, as planned.{2} After the period the normal limit applies again by itself.' -f `
|        $after, $(if ($until) { ' until ' + $until } else { '' }), $nums)
|}
|
|function Resolve-SIGuardLimit {
|    <#
|        The limit a brake uses NOW: the configured value, halved while the install is in its stricter period
|        (Get-SIGuardStrictLimit over Get-SIGuardModeNow). A halved limit is remembered for the guard's event
|        ($global:SI_GuardStrictApplied[<guard id>]: the trip's report then carries strict + configured + effective) and
|        said once per process and guard in one calm line. -Mode: a mode handed in (tests). Never throws: the configured
|        value on any problem. Returns @{ Configured; Effective; Halved; Text; Strict (the remembered entry or $null) }.
|    #>
|    param([Parameter(Mandatory)][string]$GuardId, [string]$Name, [string]$Label, [AllowNull()]$Configured, [string]$Unit, [AllowNull()]$ApprovedForRun, $Mode, [scriptblock]$Log)
|    try {
|        $m = if ($Mode) { $Mode } else { Get-SIGuardModeNow }
|        $strict = [string]$m.Mode -eq 'strict'
|        $l = Get-SIGuardStrictLimit -Configured $Configured -Strict $strict -ApprovedForRun $ApprovedForRun
|        $entry = $null
|        if ($l.Halved) {
|            $entry = [pscustomobject]@{ GuardId = $GuardId; Name = $Name; Label = $(if ($Label) { $Label } else { $Name }); Configured = $l.Configured; Effective = $l.Effective
|                                        Unit = $Unit; Until = $m.Until; Version = [string]$m.Version }
|            if ($null -eq $global:SI_GuardStrictApplied) { $global:SI_GuardStrictApplied = @{} }
|            $first = -not $global:SI_GuardStrictApplied.ContainsKey(('{0}|{1}' -f $GuardId, $Name))
|            $global:SI_GuardStrictApplied[('{0}|{1}' -f $GuardId, $Name)] = $entry
|            $global:SI_GuardStrictApplied[$GuardId] = $entry
|            if ($first) {
|                $u = if ($Unit) { ' ' + $Unit } else { '' }
|                $line = 'stricter period{0}{1}: {2} {3}{5} -> {4}{5} while it lasts (safety check {6})' -f `
|                    $(if ("$($m.Version)".Trim()) { ' after release ' + "$($m.Version)".Trim() } else { '' }), $(if ($m.Until) { ' until ' + (Format-SIGuardStrictUntil $m.Until) } else { '' }),
|                    $entry.Label, $l.Configured, $l.Effective, $u, $GuardId
|                # the caller's -Log failing never drops the halved limit (it was caught below: the configured value)
|                try { if ($Log) { & $Log 'INFO' $line } else { Write-Host (' [INFO] ' + $line) } } catch { Write-Host (' [INFO] ' + $line) }
|            }
|        }
|        return [pscustomobject]@{ Configured = $l.Configured; Effective = $l.Effective; Halved = $l.Halved; Text = $l.Text; Strict = $entry }
|    } catch {
|        return [pscustomobject]@{ Configured = $Configured; Effective = $Configured; Halved = $false; Text = ''; Strict = $null }
|    }
|}
|
|function Add-SIGuardStrictToEvent {
|    <#
|        PURE over the remembered entries. A guard event whose limit was halved by Resolve-SIGuardLimit in this process gets
|        Strict = @{ Configured; Effective; Unit; Until; Version; Label } and, on its value with the same name, Configured
|        (the configured limit beside the effective one -- a negative limit, the asset drop's, keeps its sign). -Applied: the
|        remembered entries (default $global:SI_GuardStrictApplied). Returns the event.
|    #>
|    param([Parameter(Mandatory)]$Event, [System.Collections.IDictionary]$Applied = $global:SI_GuardStrictApplied)
|    $gid = [string]$Event.GuardId
|    if (-not $Applied -or -not $Applied.Contains($gid)) { return $Event }
|    $first = $null
|    foreach ($v in @($Event.Values)) {
|        if ($null -eq $v -or $null -eq $v.Limit) { continue }
|        $k = '{0}|{1}' -f $gid, [string]$v.Name
|        if (-not $Applied.Contains($k)) { continue }
|        $s = $Applied[$k]
|        $cfg = if ([double]$v.Limit -lt 0) { -1 * [double]$s.Configured } else { [double]$s.Configured }
|        if ($cfg -eq [Math]::Floor($cfg)) { $cfg = [long]$cfg }
|        $v | Add-Member -NotePropertyName Configured -NotePropertyValue $cfg -Force
|        if (-not $first) { $first = $s }
|    }
|    $Event | Add-Member -NotePropertyName Strict -NotePropertyValue $(if ($first) { $first } else { $Applied[$gid] }) -Force
|    $Event
|}
'@ }
$__siSupportFiles['engine/_shared/SI-ReleaseControl.ps1'] = @{ Sha256 = 'ff065e5e15161b1e416b60d95a7508bf32251d9eded63fb9a9a25a25c29b8164'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- RELEASE CONTROL (CR3, SI #657; framework DOCS/REQUIREMENTS.md 12.11e RELEASE-CONTROL; approved by the
|    owner 2026-10-14). SecurityInsight's part:
|
|    1. THE WAVE. Invardia may serve an install that the owner put in a pre-release wave a version already released to a lower
|       ring, early, with no ring move; the signed manifest then carries "wave": "<name>". The updater keeps the wave of the
|       release it applied (SI-InvardiaUpdate.ps1: appliedWave); the web app's header says "Ring 2 - Pre-release (<name>)" and
|       the identified heartbeat carries wave { name, version, ring } (null = no wave). Leaving or stopping a wave NEVER moves
|       the install back: it keeps its version until its ring reaches it.
|
|    2. RELEASE MODE. After a release that changed engine code (the same trigger as the stricter safety checks, CR4: the
|       engine fingerprint the updater records changed -- SI-GuardStrict.ps1) SecurityInsight reports every 30 minutes for
|       12 hours, counts only: the identified heartbeat (users, guests, devices, the guard mode, the wave) with
|       releaseMode { version, sinceUtc, untilUtc, everyMinutes } (null = not in release mode). The pipeline runner, which
|       wakes every 5 minutes, sends it (Send-SIReleaseModeReport, SI-TelemetrySend.ps1); one report per half hour, claimed
|       in the Pro database (cfg.InstallState 'ReleaseModeReport') so two processes never both send it.
|
|    3. COMPONENTS: TESTING / STABLE. SecurityInsight's components are the collections per source, the correlation, Risk
|       Analysis per report and data out per channel (config\release-scopes.locked.json maps each to its engine files; a core
|       file belongs to every component). Each component has a fingerprint of its code:
|         * the publish call says which components a release changed (changedScopes -- Get-SIReleaseChangedScopesFromGit);
|         * the updater fingerprints the code it installed (Save-SIReleaseScopeRecords): a component whose fingerprint
|           changed is TESTING from then;
|         * a component is STABLE again after 3 good daily runs with no code change (Update-SIReleaseScopeRun, at the end of
|           every engine run: a good run counts once per UTC day; a failed run starts the count again while it is Testing).
|       The first fingerprints an install records mark nothing Testing (an older install never gets a state invented).
|       The identified heartbeat carries them as components { total, testing, stable, testingIds, since, version }.
|
|    4. THE EVIDENCE (framework 12.11e item 5(a), rule D): every identified heartbeat -- so at least daily, every ring -- carries
|       evidence { day, version, sinceUtc, health { state, sinceUtc }, guardTrips { sinceRelease, before, windowHours,
|       verdict }, components { total, testing, stable }, verdict ok | attention }: counts and verdicts only, read with the
|       install's own (read-only) database access. NOT in it yet: the audit of changes made by SecurityInsight's own
|       identities (a Graph audit read the heartbeat path does not have) -- see SI REQUIREMENTS #657.
|
|    THE SWITCH (framework 12.22 3(b), owner 2026-10-14): wave and releaseMode are NEW FIELDS on the heartbeat. They go out
|    only while SI_Telemetry_ReleaseControl (setting) / SI_TELEMETRY_RELEASECONTROL (job variable) allows it:
|      on    always            off   never (the heartbeat is exactly as before; no release-mode reports)
|      auto  (the default)     only on the rings in $script:SIReleaseControl.ConfirmedRings -- ring 0 first; every ring
|                              since 2026-10-18 (Invardia's intake is live; PIM sends them on every ring).
|    A heartbeat refused WITH the new fields is sent again once WITHOUT them; when that one is taken, the fields are held back
|    for 24 hours (cfg.InstallState 'ReleaseControlHold').
|
|    NEVER THROWS where a job calls it. PS 5.1 and 7. No PowerShell modules.
|#>
|
|if (-not (Get-Command -Name ConvertFrom-SIGuardStrictJson -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-GuardStrict.ps1')) }
|
|function Get-SIReleaseControlState {
|    <# The value of $script:SIReleaseControl, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIReleaseControl) { $script:SIReleaseControl = @{
|    ReleaseModeHours = 12
|    EveryMinutes     = 30
|    # framework 12.22 3(a): the new heartbeat fields went to ring 0 first; Invardia's wave / releaseMode intake is live and
|    # PIM sends them on every ring (2.4.641) -- every ring takes them now (2026-10-18). A refused heartbeat is still resent
|    # once without them and they are held 24 h; SI_Telemetry_ReleaseControl = off turns them off without a release.
|    ConfirmedRings   = @(0, 1, 2, 3)
|    StableGoodDays   = 3
|    HoldHours        = 24
|    CheckMinutes     = 4
|    MaxScopesListed  = 30
|    ScopeMapFile     = 'config/release-scopes.locked.json'
|    ReportRow        = 'ReleaseModeReport'
|    HoldRow          = 'ReleaseControlHold'
|    SIRoot           = (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))
|    WaveName         = '^[A-Za-z0-9][A-Za-z0-9 ._()+-]{0,59}$'
|    VersionText      = '^[0-9A-Za-z.+-]{1,50}$'
|} }
|    , $script:SIReleaseControl
|}
|$script:SIReleaseControl = $null; $null = Get-SIReleaseControlState
|
|# =====================================================================================================================
|#  The switch -- PURE
|# =====================================================================================================================
|function Resolve-SIReleaseControlSwitch {
|    <#
|        PURE. Do wave + releaseMode go out from this install? The setting wins when set (SI_Telemetry_ReleaseControl), then
|        the job variable SI_TELEMETRY_RELEASECONTROL, else 'auto'. on / true / 1 / yes = on; off / false / 0 / no = off;
|        anything else = auto. auto = on only for a ring in ConfirmedRings (-Ring; not known = off).
|        Returns @{ On; Setting (on | off | auto); Reason }.
|    #>
|    param([AllowNull()]$Value = $global:SI_Telemetry_ReleaseControl, [AllowNull()][AllowEmptyString()][string]$EnvValue = $env:SI_TELEMETRY_RELEASECONTROL,
|          [AllowNull()]$Ring, [int[]]$ConfirmedRings = @((Get-SIReleaseControlState).ConfirmedRings))
|    $set = ''
|    foreach ($v in @($Value, $EnvValue)) {
|        if ($null -eq $v) { continue }
|        if ($v -is [bool]) { $set = $(if ($v) { 'on' } else { 'off' }); break }
|        $s = ([string]$v).Trim().Trim('$').ToLowerInvariant()
|        if (-not $s) { continue }
|        $set = if ($s -in @('on', 'true', '1', 'yes', 'enabled')) { 'on' } elseif ($s -in @('off', 'false', '0', 'no', 'disabled')) { 'off' } else { 'auto' }
|        break
|    }
|    if (-not $set) { $set = 'auto' }
|    if ($set -eq 'on') { return [pscustomobject]@{ On = $true; Setting = 'on'; Reason = 'switched on (SI_Telemetry_ReleaseControl)' } }
|    if ($set -eq 'off') { return [pscustomobject]@{ On = $false; Setting = 'off'; Reason = 'switched off (SI_Telemetry_ReleaseControl)' } }
|    $rn = -1
|    if ($null -ne $Ring -and "$Ring".Trim() -ne '') { if (-not [int]::TryParse("$Ring", [ref]$rn)) { $rn = -1 } }
|    $on = ($rn -ge 0 -and @($ConfirmedRings) -contains $rn)
|    [pscustomobject]@{ On = $on; Setting = 'auto'
|        Reason = $(if ($on) { "ring $rn takes the release fields" } elseif ($rn -lt 0) { 'the ring is not known -- the release fields wait' } else { "ring $rn takes the release fields once Invardia has confirmed them through ring 0" }) }
|}
|
|function ConvertTo-SIReleaseControlRing {
|    <# PURE. 0..3 or -1. #>
|    param([AllowNull()]$Ring)
|    $n = -1
|    if ($null -ne $Ring -and [int]::TryParse("$Ring", [ref]$n) -and $n -ge 0 -and $n -le 3) { return $n }
|    -1
|}
|
|# =====================================================================================================================
|#  The wave -- PURE over the update state the updater records
|# =====================================================================================================================
|function ConvertTo-SIReleaseWaveName {
|    <# PURE. A wave name as the manifest gives it: trimmed, one line, at most 60 characters of the safe set; '' = none. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return '' }
|    if (-not ($Value -is [string]) -and -not ($Value -is [System.ValueType])) {
|        # an object { name } is read for its name (a manifest that carries more than the name)
|        $n = Get-SIGuardStrictField $Value 'name'
|        if ($null -eq $n) { return '' }
|        $Value = $n
|    }
|    $v = ("$Value" -replace '[\r\n\t]+', ' ').Trim()
|    if ($v -notmatch (Get-SIReleaseControlState).WaveName) { return '' }
|    $v
|}
|
|function Get-SIReleaseWaveFromUpdateState {
|    <#
|        PURE. The wave of the code this install runs, from the update state (-Json: the compact row cfg.InstallState
|        'UpdateState', or the full Key Vault state). Returns @{ Known; Wave }:
|          Known  $true when the state could be read (then Wave is the wave or $null = none); $false = nothing recorded / not
|                 readable -> the heartbeat leaves the field out (an older install sends nothing new)
|          Wave   [ordered]@{ name; version; ring } or $null
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Json)
|    $none = [pscustomobject]@{ Known = $false; Wave = $null }
|    $o = ConvertFrom-SIGuardStrictJson $Json
|    if ($null -eq $o) { return $none }
|    $code = Get-SIGuardStrictField $o 'code'
|    $name = ''; $ver = ''; $ring = $null
|    if ($code) {
|        $w = Get-SIGuardStrictField $code 'wave'
|        if ($null -ne $w -and -not ($w -is [string])) {
|            $name = ConvertTo-SIReleaseWaveName (Get-SIGuardStrictField $w 'name')
|            $ver = [string](Get-SIGuardStrictField $w 'version'); $ring = Get-SIGuardStrictField $w 'ring'
|        } elseif ($w -is [string]) {
|            $name = ConvertTo-SIReleaseWaveName $w
|        }
|        if (-not $name) {
|            # the full state (Key Vault): appliedWave + appliedVersion + appliedRing
|            $name = ConvertTo-SIReleaseWaveName (Get-SIGuardStrictField $code 'appliedWave')
|            if ($name) { $ver = [string](Get-SIGuardStrictField $code 'appliedVersion'); $ring = Get-SIGuardStrictField $code 'appliedRing' }
|        }
|    }
|    if (-not $name) { return [pscustomobject]@{ Known = $true; Wave = $null } }
|    $ver = "$ver".Trim(); if ($ver -notmatch (Get-SIReleaseControlState).VersionText) { $ver = '' }
|    $rn = ConvertTo-SIReleaseControlRing $ring
|    [pscustomobject]@{ Known = $true; Wave = [ordered]@{ name = $name; version = $(if ($ver) { $ver } else { $null }); ring = $(if ($rn -ge 0) { $rn } else { $null }) } }
|}
|
|function Format-SIReleaseRingLabel {
|    <# PURE. The header's words: "Ring 2 - Pre-release (Pre1)" in a wave, else "ring 2" (as today). #>
|    param([AllowNull()]$Ring, [AllowEmptyString()][string]$Wave)
|    $rn = ConvertTo-SIReleaseControlRing $Ring
|    $w = ConvertTo-SIReleaseWaveName $Wave
|    if ($rn -lt 0) { return '' }
|    if ($w) { return ('Ring {0} - Pre-release ({1})' -f $rn, $w) }
|    'ring {0}' -f $rn
|}
|
|# =====================================================================================================================
|#  Release mode -- PURE over the engine fingerprint record (cfg.InstallState 'EngineFingerprint', CR4)
|# =====================================================================================================================
|function Get-SIReleaseModeFromFingerprint {
|    <#
|        PURE. Release mode from the fingerprint record the updater keeps: a release that CHANGED engine code sets strictFrom
|        + strictVersion; release mode lasts -Hours (12) from strictFrom, reports every -EveryMinutes (30). A SuperAdmin ending
|        the stricter safety checks early does NOT end release mode (it is about reporting, not about the limits).
|        Returns @{ Known; Active; Since; Until; Version; Wire }:
|          Known   a fingerprint is recorded (else: an older install -- the field is left out)
|          Wire    [ordered]@{ version; sinceUtc; untilUtc; everyMinutes } while Active, else $null
|    #>
|    param([AllowNull()]$Fingerprint, [Parameter(Mandatory)][datetime]$NowUtc, [int]$Hours = (Get-SIReleaseControlState).ReleaseModeHours,
|          [int]$EveryMinutes = (Get-SIReleaseControlState).EveryMinutes)
|    $out = [ordered]@{ Known = $false; Active = $false; Since = $null; Until = $null; Version = ''; Wire = $null }
|    $fp = if ($Fingerprint -is [string]) { ConvertFrom-SIGuardStrictJson $Fingerprint } else { $Fingerprint }
|    $hash = ([string](Get-SIGuardStrictField $fp 'hash')).Trim().ToLowerInvariant()
|    if ($hash -notmatch '^[0-9a-f]{64}$') { return [pscustomobject]$out }
|    $out.Known = $true
|    $from = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $fp 'strictFrom')
|    if ($null -eq $from) { return [pscustomobject]$out }
|    $now = $NowUtc.ToUniversalTime()
|    $until = $from.AddHours($Hours)
|    if ($now -ge $until -or $now -lt $from.AddMinutes(-5)) { return [pscustomobject]$out }
|    $v = ([string](Get-SIGuardStrictField $fp 'strictVersion')).Trim()
|    if ($v -notmatch (Get-SIReleaseControlState).VersionText) { $v = '' }
|    $out.Active = $true; $out.Since = $from; $out.Until = $until; $out.Version = $v
|    $out.Wire = [ordered]@{ version = $(if ($v) { $v } else { $null }); sinceUtc = (ConvertTo-SIGuardStrictIso $from); untilUtc = (ConvertTo-SIGuardStrictIso $until); everyMinutes = $EveryMinutes }
|    [pscustomobject]$out
|}
|
|function Get-SIReleaseModeSlot {
|    <# PURE. Which half hour of release mode -NowUtc is in (0 = the first); -1 when not in release mode. #>
|    param([AllowNull()]$Mode, [Parameter(Mandatory)][datetime]$NowUtc, [int]$EveryMinutes = (Get-SIReleaseControlState).EveryMinutes)
|    if ($null -eq $Mode -or -not $Mode.Active -or $null -eq $Mode.Since) { return -1 }
|    $m = ($NowUtc.ToUniversalTime() - ([datetime]$Mode.Since)).TotalMinutes
|    if ($m -lt 0) { return 0 }
|    [int][Math]::Floor($m / [Math]::Max(1, $EveryMinutes))
|}
|
|function Test-SIReleaseControlHold {
|    <# PURE. Is the hold (a refused heartbeat with the release fields) still on at -NowUtc? -Hold: the row's JSON. #>
|    param([AllowNull()]$Hold, [Parameter(Mandatory)][datetime]$NowUtc)
|    $h = if ($Hold -is [string]) { ConvertFrom-SIGuardStrictJson $Hold } else { $Hold }
|    $u = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $h 'untilUtc')
|    [bool]($null -ne $u -and $NowUtc.ToUniversalTime() -lt $u)
|}
|
|# =====================================================================================================================
|#  The rows (cfg.InstallState) -- through the (sql, params, mode) seam
|# =====================================================================================================================
|function Get-SIReleaseControlRowsSql {
|    "IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL SELECT Name, Value FROM cfg.InstallState WHERE Name IN (N'EngineFingerprint', N'GuardStrictEnd', N'ReleaseControlHold', N'UpdateState');"
|}
|
|function Read-SIReleaseControlRows {
|    <# The rows release control reads, as @{ EngineFingerprint; GuardStrictEnd; ReleaseControlHold; UpdateState } (text or
|       $null). Throws on a failed read (the caller decides). #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke)
|    $h = [ordered]@{ EngineFingerprint = $null; GuardStrictEnd = $null; ReleaseControlHold = $null; UpdateState = $null }
|    # the Pro store's reader answers ONE array of rows (New-SIProSettingsStore: , $out.ToArray()) -- flattened here, so the
|    # rows are read whatever the seam's shape (live 2026-10-16: the same shape made the hourly heartbeat's claim read as 0)
|    foreach ($r in @(& $Invoke (Get-SIReleaseControlRowsSql) @{} 'reader' | ForEach-Object { $_ } | Where-Object { $_ })) {
|        $n = [string](Get-SIGuardStrictField $r 'Name')
|        if ($h.Contains($n)) { $h[$n] = [string](Get-SIGuardStrictField $r 'Value') }
|    }
|    [pscustomobject]$h
|}
|
|function Get-SIReleaseModeClaimSql {
|    <#
|        ONE statement: claim the half hour's report (-Slot of release mode -Since) in cfg.InstallState 'ReleaseModeReport' --
|        taken only when no report of this slot (or a later one) of this release mode was claimed before. Returns Claimed 1/0.
|    #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.InstallState') IS NULL
|    SELECT CAST(0 AS int) AS Claimed;
|ELSE
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    DECLARE @cur NVARCHAR(400) = NULL, @ok int = 0;
|    SELECT @cur = Value FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N'ReleaseModeReport';
|    IF @cur IS NULL AND NOT EXISTS (SELECT 1 FROM cfg.InstallState WHERE Name = N'ReleaseModeReport')
|    BEGIN
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'ReleaseModeReport', @Value, @Version, @By);
|        SET @ok = 1;
|    END
|    ELSE IF ISNULL(CASE WHEN ISJSON(@cur) = 1 THEN JSON_VALUE(@cur, '$.since') END, N'') <> @Since
|         OR ISNULL(CASE WHEN ISJSON(@cur) = 1 THEN TRY_CAST(JSON_VALUE(@cur, '$.slot') AS int) END, -1) < @Slot
|    BEGIN
|        UPDATE cfg.InstallState SET Value = @Value, [Version] = @Version, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'ReleaseModeReport';
|        SET @ok = 1;
|    END
|    COMMIT;
|    SELECT @ok AS Claimed;
|END
|'@
|}
|
|function Invoke-SIReleaseModeClaim {
|    <# Claim this half hour's release-mode report. $true = this process sends it. Throws on a failed write. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)]$Mode, [Parameter(Mandatory)][int]$Slot, [Parameter(Mandatory)][datetime]$NowUtc, [string]$By = 'release-mode report')
|    $since = ConvertTo-SIGuardStrictIso $Mode.Since
|    $value = ([ordered]@{ since = $since; slot = $Slot; sentUtc = (ConvertTo-SIGuardStrictIso $NowUtc) } | ConvertTo-Json -Compress)
|    $ver = "$($Mode.Version)"; if ($ver.Length -gt 32) { $ver = $ver.Substring(0, 32) }
|    $rows = @(& $Invoke (Get-SIReleaseModeClaimSql) ([ordered]@{ Value = $value; Version = $(if ($ver) { $ver } else { $null }); By = $By; Since = $since; Slot = $Slot }) 'reader' | ForEach-Object { $_ } | Where-Object { $_ })
|    if (-not $rows.Count) { return $false }
|    [int](Get-SIGuardStrictField $rows[0] 'Claimed') -eq 1
|}
|
|function Get-SIReleaseControlHoldSql {
|    @'
|IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N'ReleaseControlHold')
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'ReleaseControlHold';
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'ReleaseControlHold', @Value, NULL, @By);
|    COMMIT;
|END
|'@
|}
|
|function Save-SIReleaseControlHold {
|    <# Hold the release fields back for 24 hours (Invardia refused a heartbeat that carried them). Never throws. #>
|    param([scriptblock]$Invoke, [Parameter(Mandatory)][datetime]$NowUtc, [string]$Why = '')
|    if (-not $Invoke) { return $false }
|    try {
|        $w = ("$Why" -replace '[\r\n\t]+', ' ').Trim(); if ($w.Length -gt 200) { $w = $w.Substring(0, 197) + '...' }
|        $v = ([ordered]@{ untilUtc = (ConvertTo-SIGuardStrictIso $NowUtc.AddHours((Get-SIReleaseControlState).HoldHours)); why = $w } | ConvertTo-Json -Compress)
|        $null = & $Invoke (Get-SIReleaseControlHoldSql) ([ordered]@{ Value = $v; By = 'telemetry' }) 'nonquery'
|        $true
|    } catch { $false }
|}
|
|function Get-SIReleaseControlInvoke {
|    <# The Pro database seam a job already has: the settings layer's store, else the guard seam. $null = none (nothing read). #>
|    try {
|        if ($global:SI_ProSettingsStore -and $global:SI_ProSettingsStore.PSObject.Properties['Invoke'] -and $global:SI_ProSettingsStore.Invoke -is [scriptblock]) { return $global:SI_ProSettingsStore.Invoke }
|        if ($global:SI_GuardInvoke -is [scriptblock]) { return $global:SI_GuardInvoke }
|        if (Get-Command -Name Get-SIGuardProInvoke -ErrorAction SilentlyContinue) { $i = Get-SIGuardProInvoke; if ($i -is [scriptblock]) { return $i } }
|    } catch { }
|    $null
|}
|
|# =====================================================================================================================
|#  Components: the scope map and the per-component fingerprints
|# =====================================================================================================================
|function Get-SIReleaseScopeMap {
|    <# The component map (config\release-scopes.locked.json under -SIRoot, or -Json). Throws when it cannot be read. #>
|    param([string]$SIRoot = (Get-SIReleaseControlState).SIRoot, [AllowEmptyString()][string]$Json)
|    if (-not "$Json".Trim()) { $Json = [System.IO.File]::ReadAllText([System.IO.Path]::Combine($SIRoot, (Get-SIReleaseControlState).ScopeMapFile)) }
|    $m = $Json.TrimStart([char]0xFEFF) | ConvertFrom-Json
|    if (-not $m.scopes -or -not $m.raReports) { throw 'the component map has no scopes' }
|    $m
|}
|
|function ConvertTo-SIReleaseGlobRegex {
|    <# PURE. A map pattern as an anchored, case-blind regex: '**' any levels, '*' text inside one level. #>
|    param([Parameter(Mandatory)][string]$Pattern)
|    $p = $Pattern.Trim().Replace('\', '/')
|    $sb = New-Object System.Text.StringBuilder
|    [void]$sb.Append('^(?i)')
|    for ($i = 0; $i -lt $p.Length; $i++) {
|        $c = $p[$i]
|        if ($c -eq '*') {
|            if ($i + 1 -lt $p.Length -and $p[$i + 1] -eq '*') {
|                $i++
|                if ($i + 1 -lt $p.Length -and $p[$i + 1] -eq '/') { $i++; [void]$sb.Append('(?:.*/)?') } else { [void]$sb.Append('.*') }
|            } else { [void]$sb.Append('[^/]*') }
|        } else { [void]$sb.Append([regex]::Escape([string]$c)) }
|    }
|    [void]$sb.Append('$')
|    $sb.ToString()
|}
|
|function Resolve-SIReleaseFileTarget {
|    <#
|        PURE. Where one engine file belongs: @{ Kind = none | scope | group | core | ra; Id }. Order: the Risk Analysis
|        report file, 'none', 'scopes', 'groups', 'core'; nothing matched = core.
|    #>
|    param([Parameter(Mandatory)][string]$Rel, [Parameter(Mandatory)]$Map)
|    $r = $Rel.Replace('\', '/').TrimStart('/')
|    if ($r -ieq [string]$Map.raReports.file) { return [pscustomobject]@{ Kind = 'ra'; Id = [string]$Map.raReports.group } }
|    $hit = { param($list) foreach ($p in @($list)) { if ($p -and $r -match (ConvertTo-SIReleaseGlobRegex $p)) { return $true } }; $false }
|    if (& $hit $Map.none) { return [pscustomobject]@{ Kind = 'none'; Id = '' } }
|    foreach ($s in @($Map.scopes)) { if (& $hit $s.patterns) { return [pscustomobject]@{ Kind = 'scope'; Id = [string]$s.id } } }
|    foreach ($g in @($Map.groups)) { if (& $hit $g.patterns) { return [pscustomobject]@{ Kind = 'group'; Id = [string]$g.id } } }
|    [pscustomobject]@{ Kind = 'core'; Id = '' }
|}
|
|function Split-SIReleaseRaReports {
|    <#
|        PURE. The Risk Analysis report file's text as its report blocks: @{ Reports = ordered name -> block text; Rest = the
|        text outside every report block }. Inside the top-level section "Reports:" only, a block starts at a line
|        "    - ReportName: <name>" (any indent) and runs until the next such line or a line that starts in column 0. The
|        report TEMPLATES (section "ReportTemplates:") are not reports: they stay in Rest (they belong to every report).
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    $reports = [ordered]@{}; $rest = New-Object System.Text.StringBuilder
|    $cur = $null; $buf = $null; $section = ''
|    foreach ($line in @("$Text" -split "`r?`n")) {
|        $sm = [regex]::Match($line, '^(?<s>[A-Za-z_][\w-]*)\s*:')
|        if ($sm.Success) { $section = $sm.Groups['s'].Value }
|        $m = [regex]::Match($line, '^\s+-\s+ReportName:\s*(?<n>\S.*?)\s*$')
|        if ($m.Success -and $section -ceq 'Reports') {
|            if ($cur) { $reports[$cur] = $buf.ToString() }
|            $cur = $m.Groups['n'].Value.Trim('''', '"'); $buf = New-Object System.Text.StringBuilder; [void]$buf.Append($line).Append("`n"); continue
|        }
|        if ($cur -and $line -match '^[^\s#]') { $reports[$cur] = $buf.ToString(); $cur = $null; $buf = $null }
|        if ($cur) { [void]$buf.Append($line).Append("`n") } else { [void]$rest.Append($line).Append("`n") }
|    }
|    if ($cur) { $reports[$cur] = $buf.ToString() }
|    [pscustomobject]@{ Reports = $reports; Rest = $rest.ToString() }
|}
|
|function Get-SIReleaseTextSha256 {
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { -join @($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes("$Text")) | ForEach-Object { $_.ToString('x2') }) } finally { $sha.Dispose() }
|}
|
|function Get-SIReleaseScopeHashes {
|    <#
|        PURE. The fingerprint of every component: -Entries = one @{ Rel; Id } per engine file (Id = the file's content id: a
|        SHA-256 of its bytes on an install, its git blob id in the publish tooling -- only ever compared with the same kind),
|        -RaText = the Risk Analysis report file's text, -Map = the component map. Returns an ordered map component id ->
|        SHA-256 (lower-case hex), sorted ordinally. A component's fingerprint covers its own files, its group's files and
|        the core files -- so a core change changes every component, a group change every component of the group.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Entries, [AllowNull()][AllowEmptyString()][string]$RaText, [Parameter(Mandatory)]$Map)
|    $bucket = @{}
|    $add = { param($k, $line) if (-not $bucket.ContainsKey($k)) { $bucket[$k] = New-Object System.Collections.Generic.List[string] }; $bucket[$k].Add($line) }
|    foreach ($e in @($Entries | Where-Object { $_ })) {
|        $rel = ([string]$e.Rel).Replace('\', '/').TrimStart('/')
|        $t = Resolve-SIReleaseFileTarget -Rel $rel -Map $Map
|        $line = '{0}|{1}' -f $rel, ([string]$e.Id).ToLowerInvariant()
|        switch ($t.Kind) {
|            'none' { }
|            'scope' { & $add ('s:' + $t.Id) $line }
|            'group' { & $add ('g:' + $t.Id) $line }
|            'ra' { }
|            default { & $add 'core' $line }
|        }
|    }
|    $ra = Split-SIReleaseRaReports -Text $RaText
|    $prefix = [string]$Map.raReports.prefix; $raGroup = [string]$Map.raReports.group
|    & $add ('g:' + $raGroup) ('{0}#rest|{1}' -f [string]$Map.raReports.file, (Get-SIReleaseTextSha256 $ra.Rest))
|    $ids = New-Object System.Collections.Generic.List[string]
|    foreach ($s in @($Map.scopes)) { $ids.Add([string]$s.id) }
|    foreach ($n in @($ra.Reports.Keys)) {
|        $id = $prefix + [string]$n
|        $ids.Add($id)
|        & $add ('s:' + $id) ('{0}#{1}|{2}' -f [string]$Map.raReports.file, $n, (Get-SIReleaseTextSha256 $ra.Reports[$n]))
|    }
|    $joined = { param($k) if ($bucket.ContainsKey($k)) { $l = $bucket[$k].ToArray(); [Array]::Sort($l, [StringComparer]::Ordinal); ($l -join "`n") } else { '' } }
|    $core = & $joined 'core'
|    $groups = @(@($Map.groups) | ForEach-Object { [string]$_.id }) + @($raGroup) | Select-Object -Unique
|    $arr = $ids.ToArray() | Select-Object -Unique
|    $arr = [string[]]@($arr); [Array]::Sort($arr, [StringComparer]::Ordinal)
|    $out = [ordered]@{}
|    foreach ($id in $arr) {
|        $g = @($groups | Where-Object { $_ -and $id.StartsWith($_, [StringComparison]::Ordinal) } | ForEach-Object { 'g ' + $_ + "`n" + (& $joined ('g:' + $_)) })
|        $out[$id] = Get-SIReleaseTextSha256 ("core`n{0}`n--`n{1}`n--`nown`n{2}" -f $core, ($g -join "`n"), (& $joined ('s:' + $id)))
|    }
|    $out
|}
|
|function Get-SIReleaseScopeHashesFromDisk {
|    <# The component fingerprints of the code under -SIRoot (an install: the release the updater just extracted). #>
|    param([Parameter(Mandatory)][string]$SIRoot, $Map)
|    if (-not $Map) { $Map = Get-SIReleaseScopeMap -SIRoot $SIRoot }
|    $root = [System.IO.Path]::GetFullPath($SIRoot)
|    $entries = New-Object System.Collections.Generic.List[object]
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try {
|        foreach ($f in @($Map.folders)) {
|            $dir = [System.IO.Path]::Combine($root, [string]$f)
|            if (-not [System.IO.Directory]::Exists($dir)) { continue }
|            foreach ($p in [System.IO.Directory]::GetFiles($dir, '*', [System.IO.SearchOption]::AllDirectories)) {
|                $rel = $p.Substring($root.Length).TrimStart('\', '/') -replace '\\', '/'
|                $id = -join @($sha.ComputeHash([System.IO.File]::ReadAllBytes($p)) | ForEach-Object { $_.ToString('x2') })
|                $entries.Add([pscustomobject]@{ Rel = $rel; Id = $id })
|            }
|        }
|    } finally { $sha.Dispose() }
|    $raPath = [System.IO.Path]::Combine($root, ([string]$Map.raReports.file).Replace('/', [System.IO.Path]::DirectorySeparatorChar))
|    $raText = if ([System.IO.File]::Exists($raPath)) { [System.IO.File]::ReadAllText($raPath) } else { '' }
|    Get-SIReleaseScopeHashes -Entries $entries.ToArray() -RaText $raText -Map $Map
|}
|
|function Invoke-SIReleaseGitText {
|    <# #917: git text (show / log) read as UTF-8 whatever the console's encoding -- setup\_shared\SI-GitText.ps1's
|       Invoke-SIGitText when this tree carries it (the release tooling), else git as before (an install's tree). #>
|    param([Parameter(Mandatory)][string]$RepoRoot, [Parameter(Mandatory)][string[]]$Arguments)
|    if (-not (Get-Command -Name Invoke-SIGitText -ErrorAction SilentlyContinue)) {
|        $gt = [System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'setup', '_shared', 'SI-GitText.ps1')
|        if ([System.IO.File]::Exists($gt)) { . $gt }
|    }
|    if (Get-Command -Name Invoke-SIGitText -ErrorAction SilentlyContinue) { return (Invoke-SIGitText -RepoRoot $RepoRoot -Arguments $Arguments) }
|    & git -C $RepoRoot @Arguments 2>$null
|}
|
|function Get-SIReleaseScopeHashesFromGit {
|    <# The component fingerprints of SOLUTIONS/SecurityInsight at -Ref of the clone -RepoRoot (git blob ids as content ids). Throws when git cannot read it. #>
|    param([Parameter(Mandatory)][string]$RepoRoot, [Parameter(Mandatory)][string]$Ref, [Parameter(Mandatory)]$Map, [string]$SolutionPath = 'SOLUTIONS/SecurityInsight')
|    $global:LASTEXITCODE = 0
|    $paths = @(@($Map.folders) | ForEach-Object { '{0}/{1}' -f $SolutionPath, $_ })
|    $lines = @(& git -C $RepoRoot ls-tree -r --full-tree $Ref -- @($paths) 2>&1)
|    if ($LASTEXITCODE -ne 0) { throw ("cannot list the engine files of '{0}': {1}" -f $Ref, ($lines -join ' ')) }
|    $entries = New-Object System.Collections.Generic.List[object]
|    foreach ($l in $lines) {
|        $m = [regex]::Match([string]$l, '^\d+\s+blob\s+(?<id>[0-9a-f]{40,64})\t(?<p>.+)$')
|        if (-not $m.Success) { continue }
|        $p = $m.Groups['p'].Value.Trim('"')
|        if (-not $p.StartsWith($SolutionPath + '/', [StringComparison]::Ordinal)) { continue }
|        $entries.Add([pscustomobject]@{ Rel = $p.Substring($SolutionPath.Length + 1); Id = $m.Groups['id'].Value })
|    }
|    $global:LASTEXITCODE = 0
|    $ra = @(Invoke-SIReleaseGitText -RepoRoot $RepoRoot -Arguments @('show', ('{0}:{1}/{2}' -f $Ref, $SolutionPath, [string]$Map.raReports.file)))
|    $raText = if ($LASTEXITCODE -eq 0) { $ra -join "`n" } else { '' }
|    $global:LASTEXITCODE = 0
|    Get-SIReleaseScopeHashes -Entries $entries.ToArray() -RaText $raText -Map $Map
|}
|
|function Compare-SIReleaseScopeHashes {
|    <#
|        PURE. Which components changed from -Previous to -Current (both: component id -> fingerprint). A component that is
|        new counts as changed; one that is gone is listed in Removed. No previous fingerprints at all = nothing changed
|        (First = $true). Returns @{ First; Changed (sorted ids); Removed; All (every component changed); Total }.
|    #>
|    param([AllowNull()][System.Collections.IDictionary]$Previous, [Parameter(Mandatory)][System.Collections.IDictionary]$Current)
|    $cur = @($Current.Keys | ForEach-Object { [string]$_ })
|    if ($null -eq $Previous -or $Previous.Count -eq 0) { return [pscustomobject]@{ First = $true; Changed = @(); Removed = @(); All = $false; Total = $cur.Count } }
|    $changed = New-Object System.Collections.Generic.List[string]
|    foreach ($k in $cur) { if (-not $Previous.Contains($k) -or [string]$Previous[$k] -ne [string]$Current[$k]) { $changed.Add($k) } }
|    $removed = @($Previous.Keys | ForEach-Object { [string]$_ } | Where-Object { -not $Current.Contains($_) })
|    $c = $changed.ToArray(); [Array]::Sort($c, [StringComparer]::Ordinal)
|    [pscustomobject]@{ First = $false; Changed = @($c); Removed = @($removed); All = ($cur.Count -gt 0 -and $c.Count -eq $cur.Count); Total = $cur.Count }
|}
|
|function Format-SIReleaseChangedScopes {
|    <#
|        PURE. The changedScopes value of a publish call: '*' when every component changed (a core file) or more than
|        -Max did, else the ids joined with ','. '' when none changed. As a list for a JSON body: -AsList.
|    #>
|    param([Parameter(Mandatory)]$Comparison, [int]$Max = (Get-SIReleaseControlState).MaxScopesListed, [switch]$AsList)
|    $c = @($Comparison.Changed)
|    if (-not $c.Count) { if ($AsList) { return , @() } else { return '' } }
|    $all = [bool]$Comparison.All -or $c.Count -gt $Max
|    if ($AsList) { if ($all) { return , @('*') } else { return , @($c) } }
|    if ($all) { return '*' }
|    $c -join ','
|}
|
|function Get-SIReleaseChangedScopesFromGit {
|    <#
|        The publish tooling: the components a release changed between -SinceRef (the previous release's commit) and -Ref,
|        judged with the component map of -Ref. Returns the Compare-SIReleaseScopeHashes result. Throws when git cannot compare
|        them -- an unknown answer is never sent as "nothing changed".
|    #>
|    param([Parameter(Mandatory)][string]$RepoRoot, [Parameter(Mandatory)][string]$SinceRef, [Parameter(Mandatory)][string]$Ref, $Map, [string]$SolutionPath = 'SOLUTIONS/SecurityInsight')
|    if (-not $Map) {
|        $global:LASTEXITCODE = 0
|        $mj = @(Invoke-SIReleaseGitText -RepoRoot $RepoRoot -Arguments @('show', ('{0}:{1}/{2}' -f $Ref, $SolutionPath, (Get-SIReleaseControlState).ScopeMapFile)))
|        $Map = if ($LASTEXITCODE -eq 0 -and $mj.Count) { Get-SIReleaseScopeMap -Json ($mj -join "`n") } else { Get-SIReleaseScopeMap }
|        $global:LASTEXITCODE = 0
|    }
|    $before = Get-SIReleaseScopeHashesFromGit -RepoRoot $RepoRoot -Ref $SinceRef -Map $Map -SolutionPath $SolutionPath
|    $after = Get-SIReleaseScopeHashesFromGit -RepoRoot $RepoRoot -Ref $Ref -Map $Map -SolutionPath $SolutionPath
|    $cmp = Compare-SIReleaseScopeHashes -Previous $before -Current $after
|    # a commit before the components existed is still compared: its fingerprints are computed with today's map
|    if ($cmp.First -and $after.Count) { $cmp = [pscustomobject]@{ First = $false; Changed = @($after.Keys); Removed = @(); All = $true; Total = $after.Count } }
|    $cmp
|}
|
|function Resolve-SIPublishChangedScopesSwitch {
|    <#
|        PURE. framework 12.22 3(b): does the publish call carry changedScopes? SI_PUBLISH_CHANGEDSCOPES = off (never, the
|        switch that turns the field off without a release) / on / auto (the default). auto = EVERY publish and ring call
|        (owner 2026-10-18 "build pending"; Invardia's changedScopes intake is live and PIM sends it on every call since
|        2026-10-16) -- -Ring only words the reason.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$EnvValue = $env:SI_PUBLISH_CHANGEDSCOPES, [int]$Ring = -1)
|    $s = "$EnvValue".Trim().ToLowerInvariant()
|    if ($s -in @('on', 'true', '1', 'yes')) { return [pscustomobject]@{ On = $true; Reason = 'SI_PUBLISH_CHANGEDSCOPES is on' } }
|    if ($s -in @('off', 'false', '0', 'no')) { return [pscustomobject]@{ On = $false; Reason = 'SI_PUBLISH_CHANGEDSCOPES is off' } }
|    [pscustomobject]@{ On = $true; Reason = $(if ($Ring -ge 0) { "ring $Ring call" } else { 'the publish call (registered only)' }) }
|}
|
|# =====================================================================================================================
|#  Components on the install: Testing / Stable (cfg.ReleaseScope)
|# =====================================================================================================================
|function Get-SIReleaseScopeReadSql {
|    "IF OBJECT_ID(N'cfg.ReleaseScope') IS NOT NULL SELECT Scope, Hash, ChangedUtc, ChangedVersion, GoodDays, LastGoodDay FROM cfg.ReleaseScope;"
|}
|
|function Get-SIReleaseScopeState {
|    <# PURE. One component row's state: Testing (its code changed and it has fewer than -GoodDays good daily runs since), else Stable. #>
|    param([Parameter(Mandatory)]$Row, [int]$GoodDays = (Get-SIReleaseControlState).StableGoodDays)
|    $ch = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $Row 'ChangedUtc')
|    if ($null -eq $ch) { return 'Stable' }
|    $n = 0; [void][int]::TryParse("$(Get-SIGuardStrictField $Row 'GoodDays')", [ref]$n)
|    if ($n -ge $GoodDays) { 'Stable' } else { 'Testing' }
|}
|
|function New-SIReleaseScopePlan {
|    <#
|        PURE. What the updater writes after installing code whose component fingerprints are -Current, given the stored rows
|        -Stored (Scope, Hash, ...). Returns @{ First; Rows (one @{ s; h; changed } per component of -Current); Changed (ids);
|        Removed (ids) }. First = nothing stored before: every component is recorded with no change (Stable) -- an install that
|        never recorded components gets no Testing state invented.
|    #>
|    param([AllowNull()][object[]]$Stored, [Parameter(Mandatory)][System.Collections.IDictionary]$Current)
|    $prev = [ordered]@{}
|    foreach ($r in @($Stored | Where-Object { $_ })) { $s = [string](Get-SIGuardStrictField $r 'Scope'); if ($s) { $prev[$s] = ([string](Get-SIGuardStrictField $r 'Hash')).Trim().ToLowerInvariant() } }
|    $cmp = Compare-SIReleaseScopeHashes -Previous $prev -Current $Current
|    $rows = New-Object System.Collections.Generic.List[object]
|    foreach ($k in @($Current.Keys)) { $rows.Add([ordered]@{ s = [string]$k; h = [string]$Current[$k]; changed = [bool](@($cmp.Changed) -contains [string]$k) }) }
|    [pscustomobject]@{ First = [bool]$cmp.First; Rows = $rows.ToArray(); Changed = @($cmp.Changed); Removed = @($cmp.Removed) }
|}
|
|function Get-SIReleaseScopeSaveSql {
|    <# ONE transaction: the component rows of -Json ([{ s, h, changed }]) -- a changed one is Testing from @Now (good runs 0),
|       an unchanged one keeps its state, a gone one is removed. #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.ReleaseScope') IS NOT NULL
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    DECLARE @j TABLE (Scope NVARCHAR(200) NOT NULL PRIMARY KEY, Hash CHAR(64) NOT NULL, Changed bit NOT NULL);
|    INSERT @j (Scope, Hash, Changed) SELECT s, h, c FROM OPENJSON(@Json) WITH (s NVARCHAR(200) '$.s', h CHAR(64) '$.h', c bit '$.changed');
|    DELETE r FROM cfg.ReleaseScope r WHERE NOT EXISTS (SELECT 1 FROM @j j WHERE j.Scope = r.Scope);
|    UPDATE r SET Hash = j.Hash, ChangedUtc = @Now, ChangedVersion = @Version, GoodDays = 0, LastGoodDay = NULL, UpdatedAt = SYSUTCDATETIME()
|      FROM cfg.ReleaseScope r JOIN @j j ON j.Scope = r.Scope WHERE j.Changed = 1;
|    INSERT cfg.ReleaseScope (Scope, Hash, ChangedUtc, ChangedVersion, GoodDays)
|      SELECT j.Scope, j.Hash, CASE WHEN j.Changed = 1 THEN @Now END, CASE WHEN j.Changed = 1 THEN @Version END, 0
|      FROM @j j WHERE NOT EXISTS (SELECT 1 FROM cfg.ReleaseScope r WHERE r.Scope = j.Scope);
|    COMMIT;
|END
|'@
|}
|
|function Save-SIReleaseScopeRecords {
|    <#
|        The UPDATER, after installing a release (-SIRoot: the extracted, verified code): the component fingerprints into
|        cfg.ReleaseScope -- a changed component is Testing from now. Never throws: @{ Ok; First; Changed; Removed; Reason }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$SIRoot, [string]$Version = '', $NowUtc)
|    try {
|        $now = if ($NowUtc) { ([datetime]$NowUtc).ToUniversalTime() } else { [datetime]::UtcNow }
|        $cur = Get-SIReleaseScopeHashesFromDisk -SIRoot $SIRoot
|        if (-not $cur.Count) { return [pscustomobject]@{ Ok = $false; First = $false; Changed = @(); Removed = @(); Reason = 'no component found in this release' } }
|        $stored = @(& $Invoke (Get-SIReleaseScopeReadSql) @{} 'reader' | ForEach-Object { $_ } | Where-Object { $_ })
|        $plan = New-SIReleaseScopePlan -Stored $stored -Current $cur
|        $ver = "$Version".Trim(); if ($ver.Length -gt 50) { $ver = $ver.Substring(0, 50) }
|        $json = ConvertTo-Json -InputObject @($plan.Rows) -Compress -Depth 3
|        $null = & $Invoke (Get-SIReleaseScopeSaveSql) ([ordered]@{ Json = $json; Now = $now; Version = $(if ($ver) { $ver } else { $null }) }) 'nonquery'
|        $why = if ($plan.First) { '{0} components recorded (the first time: none is marked Testing)' -f $cur.Count }
|               elseif (@($plan.Changed).Count) { '{0} of {1} components changed and are Testing until 3 good daily runs: {2}' -f @($plan.Changed).Count, $cur.Count, (Format-SIReleaseScopeList @($plan.Changed)) }
|               else { 'no component changed ({0} recorded)' -f $cur.Count }
|        [pscustomobject]@{ Ok = $true; First = $plan.First; Changed = @($plan.Changed); Removed = @($plan.Removed); Reason = $why }
|    } catch { [pscustomobject]@{ Ok = $false; First = $false; Changed = @(); Removed = @(); Reason = ("the components could not be recorded: {0}" -f $_.Exception.Message) } }
|}
|
|function Format-SIReleaseScopeList {
|    <# PURE. A short plain list: the first 8 ids and "and N more". #>
|    param([AllowNull()][object[]]$Ids)
|    $a = @($Ids | Where-Object { $_ })
|    if ($a.Count -le 8) { return ($a -join ', ') }
|    '{0} and {1} more' -f (($a | Select-Object -First 8) -join ', '), ($a.Count - 8)
|}
|
|function Get-SIReleaseScopesForEngine {
|    <# PURE. The components an engine run counts for: @{ Ids; Prefix } from the map's 'engines' lists (a group: every
|       component whose id starts with its prefix). Empty = the engine is no component's. #>
|    param([AllowEmptyString()][string]$Engine, [Parameter(Mandatory)]$Map)
|    $e = "$Engine".Trim().ToLowerInvariant()
|    $ids = @(); $prefix = ''
|    if (-not $e -or $e.StartsWith('flow')) { return [pscustomobject]@{ Ids = @(); Prefix = '' } }
|    foreach ($s in @($Map.scopes)) { if (@($s.engines | ForEach-Object { "$_".ToLowerInvariant() }) -contains $e) { $ids += [string]$s.id } }
|    foreach ($g in @($Map.groups)) { if (@($g.engines | ForEach-Object { "$_".ToLowerInvariant() }) -contains $e) { $prefix = [string]$g.id } }
|    [pscustomobject]@{ Ids = @($ids); Prefix = $prefix }
|}
|
|function Get-SIReleaseScopeRunSql {
|    <#
|        ONE statement for one engine run's components (-Count ids @s0..@sN and/or the prefix @Prefix):
|          good   a run that started after the change counts once per UTC day while the component is Testing
|          bad    a failed run starts the count again while it is Testing
|    #>
|    param([Parameter(Mandatory)][ValidateSet('good', 'bad')][string]$Kind, [int]$Count = 0, [switch]$HasPrefix)
|    $parts = @()
|    if ($Count -gt 0) { $parts += ('Scope IN ({0})' -f ((0..($Count - 1) | ForEach-Object { '@s' + $_ }) -join ', ')) }
|    if ($HasPrefix) { $parts += "Scope LIKE @Prefix + N'%'" }
|    $where = '(' + ($parts -join ' OR ') + ') AND ChangedUtc IS NOT NULL AND GoodDays < @Need'
|    if ($Kind -eq 'good') {
|        return ("IF OBJECT_ID(N'cfg.ReleaseScope') IS NOT NULL UPDATE cfg.ReleaseScope SET GoodDays = GoodDays + 1, LastGoodDay = @Today, UpdatedAt = SYSUTCDATETIME() WHERE {0} AND ChangedUtc <= @StartedAt AND (LastGoodDay IS NULL OR LastGoodDay < @Today);" -f $where)
|    }
|    "IF OBJECT_ID(N'cfg.ReleaseScope') IS NOT NULL UPDATE cfg.ReleaseScope SET GoodDays = 0, LastGoodDay = NULL, UpdatedAt = SYSUTCDATETIME() WHERE {0};" -f $where
|}
|
|function Update-SIReleaseScopeRun {
|    <#
|        One engine run ended (-Engine, -ExitReason success | error | ...): its components count a good daily run, or start
|        their count again. Other outcomes (partial, throttled, skipped) change nothing. A Risk Analysis run with a report
|        that is not complete (-ReportsIncomplete > 0) is not a good run. Returns $true when a statement ran. Throws on a
|        failed write (the caller decides).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [AllowEmptyString()][string]$Engine, [AllowEmptyString()][string]$ExitReason, $StartedAt, $NowUtc,
|          [long]$ReportsIncomplete = 0, $Map)
|    if (-not $Map) { $Map = Get-SIReleaseScopeMap }
|    $x = "$ExitReason".Trim().ToLowerInvariant()
|    $kind = if ($x -eq 'success' -and $ReportsIncomplete -le 0) { 'good' } elseif ($x -in @('error', 'failure', 'failed', 'settings-error')) { 'bad' } else { '' }
|    if (-not $kind) { return $false }
|    $sc = Get-SIReleaseScopesForEngine -Engine $Engine -Map $Map
|    $ids = @($sc.Ids)
|    if (-not $ids.Count -and -not $sc.Prefix) { return $false }
|    $now = if ($NowUtc) { ([datetime]$NowUtc).ToUniversalTime() } else { [datetime]::UtcNow }
|    $start = if ($StartedAt) { try { ([datetime]$StartedAt).ToUniversalTime() } catch { $now } } else { $now }
|    $p = [ordered]@{ Need = [int](Get-SIReleaseControlState).StableGoodDays }
|    for ($i = 0; $i -lt $ids.Count; $i++) { $p[('s' + $i)] = [string]$ids[$i] }
|    if ($sc.Prefix) { $p['Prefix'] = [string]$sc.Prefix }
|    if ($kind -eq 'good') { $p['Today'] = $now.Date; $p['StartedAt'] = $start }
|    $null = & $Invoke (Get-SIReleaseScopeRunSql -Kind $kind -Count $ids.Count -HasPrefix:([bool]$sc.Prefix)) $p 'nonquery'
|    $true
|}
|
|function Invoke-SIReleaseScopeRunEnd {
|    <#
|        The run-health END moment (Send-SIRunHealthRow): this run's components count it. Only the engine's own END record
|        (not a pipeline step record, not a shard other than the first), only with a Pro database the run has open, never in
|        a test session (Pester) without -Invoke. NEVER throws; $true when counted.
|    #>
|    param([AllowNull()]$RunContext, [AllowEmptyString()][string]$ExitReason, [scriptblock]$Invoke, $NowUtc)
|    try {
|        if ($null -eq $RunContext) { return $false }
|        $shard = 0; if ($RunContext.PSObject.Properties['ShardIndex']) { [void][int]::TryParse("$($RunContext.ShardIndex)", [ref]$shard) }
|        if ($shard -gt 0) { return $false }
|        if (-not $Invoke) {
|            if (Get-Module -Name Pester) { return $false }
|            $Invoke = Get-SIReleaseControlInvoke
|        }
|        if (-not $Invoke) { return $false }
|        $inc = 0L
|        if ($RunContext.PSObject.Properties['ReportsIncomplete']) { [void][long]::TryParse("$($RunContext.ReportsIncomplete)", [ref]$inc) }
|        $st = if ($RunContext.PSObject.Properties['StartedAt']) { $RunContext.StartedAt } else { $null }
|        Update-SIReleaseScopeRun -Invoke $Invoke -Engine ([string]$RunContext.Engine) -ExitReason $ExitReason -StartedAt $st -NowUtc $NowUtc -ReportsIncomplete $inc
|    } catch { $false }
|}
|
|# =====================================================================================================================
|#  The heartbeat's components + the daily evidence (framework 12.11e items 3 and 5(a); 2026-10-18)
|# =====================================================================================================================
|function ConvertTo-SIReleaseComponentWireId {
|    <#
|        PURE. One component id in the spelling Invardia's heartbeat takes for components.testingIds (its STABILITY_ID:
|        ^[a-z][a-z0-9.-]{0,59}$): lower case, '_' and spaces as '-', anything else left out, at most 60 characters, never
|        ending in '.' or '-'. '' when nothing is left (the id is then not listed; the counts still count it). The
|        changedScopes of a publish call keep the component's own spelling (Invardia takes ^[A-Za-z0-9._-]{1,80}$ there).
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Id)
|    $t = ("$Id".Trim().ToLowerInvariant() -replace '[_\s]+', '-') -replace '[^a-z0-9.-]', ''
|    $t = $t -replace '^[^a-z]+', ''
|    if ($t.Length -gt 60) { $t = $t.Substring(0, 60) }
|    $t = $t.TrimEnd('.', '-')
|    if ($t -notmatch '^[a-z][a-z0-9.-]{0,59}$') { return '' }
|    $t
|}
|
|function ConvertTo-SIReleaseComponentsWire {
|    <#
|        PURE. Testing / Stable per component for the identified heartbeat (framework 12.11e item 3), counts + the ids of the
|        components that are Testing (component ids are SecurityInsight's own names -- never a customer value):
|          { total, testing, stable, testingIds: [ id, ... ] (at most MaxScopesListed, sorted), since, version }
|        since / version: the newest code change of a component (cfg.ReleaseScope ChangedUtc / ChangedVersion); null when
|        none was ever recorded. $null when no component is recorded (an older install: the field is left out).
|    #>
|    param([AllowNull()][object[]]$Rows)
|    $rows = @($Rows | Where-Object { $_ })
|    if (-not $rows.Count) { return $null }
|    $s = Get-SIReleaseScopeSummary -Rows $rows
|    # LIVE 2026-10-18: Invardia takes a testingIds entry only as ^[a-z][a-z0-9.-]{0,59}$ and drops the WHOLE components field
|    # for one entry it does not take (only evidence.components arrived) -- a Risk Analysis report id carries capitals and
|    # underscores, so every id goes in Invardia's spelling (ConvertTo-SIReleaseComponentWireId)
|    $ids = [string[]]@(@($s.TestingIds | Where-Object { $_ } | ForEach-Object { ConvertTo-SIReleaseComponentWireId $_ } | Where-Object { $_ }) | Select-Object -Unique)
|    [Array]::Sort($ids, [StringComparer]::Ordinal)
|    $newest = $null; $ver = ''
|    foreach ($r in $rows) {
|        $c = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $r 'ChangedUtc')
|        if ($null -ne $c -and ($null -eq $newest -or $c -gt $newest)) { $newest = $c; $ver = ([string](Get-SIGuardStrictField $r 'ChangedVersion')).Trim() }
|    }
|    if ($ver -notmatch (Get-SIReleaseControlState).VersionText) { $ver = '' }
|    [ordered]@{ total = [int]$s.Total; testing = [int]$s.Testing; stable = [int]$s.Stable
|        testingIds = @($ids | Select-Object -First (Get-SIReleaseControlState).MaxScopesListed)
|        since = $(if ($newest) { ConvertTo-SIGuardStrictIso $newest } else { $null }); version = $(if ($ver) { $ver } else { $null }) }
|}
|
|function Get-SIReleaseEvidenceSql {
|    <# ONE read: the data-health state and the guard trips (halted / held / refused -- a warning or a clear is no trip) in two windows ([@Before, @From) and [@From, now]). Read-only. #>
|    @'
|SET NOCOUNT ON;
|SELECT
|    (SELECT TOP (1) [State] FROM cfg.DataHealthState WHERE OBJECT_ID(N'cfg.DataHealthState') IS NOT NULL) AS HealthState,
|    (SELECT TOP (1) Since FROM cfg.DataHealthState WHERE OBJECT_ID(N'cfg.DataHealthState') IS NOT NULL) AS HealthSince,
|    (SELECT COUNT_BIG(*) FROM cfg.GuardEvent WHERE TsUtc >= @From AND Outcome IN (N'halted', N'held', N'refused')) AS TripsSince,
|    (SELECT COUNT_BIG(*) FROM cfg.GuardEvent WHERE TsUtc >= @Before AND TsUtc < @From AND Outcome IN (N'halted', N'held', N'refused')) AS TripsBefore;
|'@
|}
|
|function Get-SIReleaseEvidenceWindow {
|    <#
|        PURE. The release the evidence is about and its two windows: -Fingerprint (cfg.InstallState 'EngineFingerprint': the
|        last release that changed engine code -- strictFrom / strictVersion), else the newest component change (-Components:
|        ConvertTo-SIReleaseComponentsWire). @{ Known; Since; Version; Before; Hours } -- Before = Since minus the same length
|        as Since -> now (at least 1 h, at most 30 days). Known $false = no release recorded: no evidence is sent.
|    #>
|    param([AllowNull()]$Fingerprint, [AllowNull()]$Components, [Parameter(Mandatory)][datetime]$NowUtc)
|    $fp = if ($Fingerprint -is [string]) { ConvertFrom-SIGuardStrictJson $Fingerprint } else { $Fingerprint }
|    $since = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $fp 'strictFrom')
|    $ver = ([string](Get-SIGuardStrictField $fp 'strictVersion')).Trim()
|    if ($null -eq $since -and $Components -and $Components['since']) { $since = ConvertTo-SIGuardStrictUtc $Components['since']; $ver = [string]$Components['version'] }
|    if ($null -eq $since) { return [pscustomobject]@{ Known = $false; Since = $null; Version = ''; Before = $null; Hours = 0 } }
|    if ("$ver" -notmatch (Get-SIReleaseControlState).VersionText) { $ver = '' }
|    $now = $NowUtc.ToUniversalTime()
|    $h = [Math]::Min(720.0, [Math]::Max(1.0, ($now - $since).TotalHours))
|    [pscustomobject]@{ Known = $true; Since = $since; Version = $ver; Before = $since.AddHours(-$h); Hours = [int][Math]::Ceiling($h) }
|}
|
|function New-SIReleaseEvidence {
|    <#
|        PURE. The daily evidence of framework 12.11e item 5(a) -- counts and verdicts only, never a name, id or value:
|          { day, version, sinceUtc, health: { state, sinceUtc } | null, guardTrips: { sinceRelease, before, windowHours,
|            verdict: ok | more }, components: { total, testing, stable } | null, verdict: ok | attention }
|        -Window: Get-SIReleaseEvidenceWindow; -Row: the Get-SIReleaseEvidenceSql row; -Components:
|        ConvertTo-SIReleaseComponentsWire. verdict 'attention' = data health Unhealthy, or more guard trips since the release
|        than in the same time before it. $null when -Window is not Known.
|    #>
|    param([Parameter(Mandatory)]$Window, [AllowNull()]$Row, [AllowNull()]$Components, [Parameter(Mandatory)][datetime]$NowUtc)
|    if (-not $Window.Known) { return $null }
|    $hs = ([string](Get-SIGuardStrictField $Row 'HealthState')).Trim()
|    $health = $null
|    if ($hs -in @('Healthy', 'Unhealthy')) {
|        $hsi = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $Row 'HealthSince')
|        $health = [ordered]@{ state = $hs; sinceUtc = $(if ($hsi) { ConvertTo-SIGuardStrictIso $hsi } else { $null }) }
|    }
|    $n = { param($v) $x = 0L; if ($null -ne $v) { [void][long]::TryParse("$v", [ref]$x) }; [Math]::Max(0L, $x) }
|    $ts = & $n (Get-SIGuardStrictField $Row 'TripsSince'); $tb = & $n (Get-SIGuardStrictField $Row 'TripsBefore')
|    $tripsVerdict = if ($ts -gt $tb) { 'more' } else { 'ok' }
|    $comp = $null
|    if ($Components) { $comp = [ordered]@{ total = [int]$Components['total']; testing = [int]$Components['testing']; stable = [int]$Components['stable'] } }
|    [ordered]@{
|        day        = $NowUtc.ToUniversalTime().ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture)
|        version    = $(if ($Window.Version) { $Window.Version } else { $null })
|        sinceUtc   = ConvertTo-SIGuardStrictIso $Window.Since
|        health     = $health
|        guardTrips = [ordered]@{ sinceRelease = $ts; before = $tb; windowHours = [int]$Window.Hours; verdict = $tripsVerdict }
|        components = $comp
|        verdict    = $(if (($health -and $health.state -eq 'Unhealthy') -or $tripsVerdict -eq 'more') { 'attention' } else { 'ok' })
|    }
|}
|
|function Read-SIReleaseEvidenceFields {
|    <#
|        The heartbeat's components + evidence from the Pro database (-Invoke), given the release-control rows (-Rows:
|        Read-SIReleaseControlRows). Returns @{ Components; Evidence } (each $null = left out). Throws on a failed read (the
|        caller leaves both out).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, $Rows, [Parameter(Mandatory)][datetime]$NowUtc)
|    $scopeRows = @(& $Invoke (Get-SIReleaseScopeReadSql) @{} 'reader' | ForEach-Object { $_ } | Where-Object { $_ })
|    $comp = ConvertTo-SIReleaseComponentsWire -Rows $scopeRows
|    $win = Get-SIReleaseEvidenceWindow -Fingerprint $(if ($Rows) { [string]$Rows.EngineFingerprint } else { $null }) -Components $comp -NowUtc $NowUtc
|    $ev = $null
|    if ($win.Known) {
|        $row = @(& $Invoke (Get-SIReleaseEvidenceSql) ([ordered]@{ From = $win.Since; Before = $win.Before }) 'reader' | ForEach-Object { $_ } | Where-Object { $_ }) | Select-Object -First 1
|        $ev = New-SIReleaseEvidence -Window $win -Row $row -Components $comp -NowUtc $NowUtc
|    }
|    [pscustomobject]@{ Components = $comp; Evidence = $ev }
|}
|
|function Get-SIReleaseScopeSummary {
|    <# PURE. The component rows as @{ Testing; Stable; Total; TestingIds } (for the log and the web app's view). #>
|    param([AllowNull()][object[]]$Rows)
|    $t = @(); $s = 0
|    foreach ($r in @($Rows | Where-Object { $_ })) { if ((Get-SIReleaseScopeState -Row $r) -eq 'Testing') { $t += [string](Get-SIGuardStrictField $r 'Scope') } else { $s++ } }
|    [pscustomobject]@{ Testing = $t.Count; Stable = $s; Total = $t.Count + $s; TestingIds = @($t) }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-GitText.ps1'] = @{ Sha256 = '5e98e9881da0ea67c11b53f7ad388bacf621abaf7ac518d26a94eb7e573df637'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight (vendor tooling) -- GIT TEXT AS UTF-8, WHATEVER THE CONSOLE (#917).
|
|    Found 2026-10-27 (the ring 0 release 3.0.0.202610272235): Release-SI step 3e read REQUIREMENTS with `& git show
|    <commit>:...` in a detached PowerShell (Start-Process, output redirected) whose console encoding was IBM437. PowerShell
|    decodes a native command's output with [Console]::OutputEncoding, so every status mark (the open, built, paused, done and closed marks) came back
|    garbled, the parser saw 0 open items, and the backlog push removed all 500 from Invardia's backlog.
|
|    Invoke-SIGitText runs git as a process of its own and reads its standard output as UTF-8 BYTES decoded as UTF-8 -- the
|    console's encoding is never used. Every `git show` / `git log` of text in SI's release and support tooling goes through
|    it. Returns the lines (as `& git` would, without the line ends) and sets $global:LASTEXITCODE to git's exit code. Never
|    prints git's standard error (it is returned on -ErrorText when asked). PS 5.1 and 7.
|#>
|
|function ConvertTo-SIGitArgumentString {
|    <# PURE. The arguments as one command line (Windows rules: a part with a space or a quote is quoted, a quote doubled
|       with a backslash) -- for Windows PowerShell 5.1, whose ProcessStartInfo has no ArgumentList. #>
|    param([string[]]$Arguments)
|    (@($Arguments) | ForEach-Object {
|        $a = [string]$_
|        if ($a -eq '') { '""' }
|        elseif ($a -match '[\s"]') { '"' + ($a -replace '(\\*)"', '$1$1\"' -replace '(\\+)$', '$1$1') + '"' }
|        else { $a }
|    }) -join ' '
|}
|
|function Invoke-SIGitText {
|    <#
|        git -C <RepoRoot> <Arguments>, its output read as UTF-8 whatever the console encoding. Returns string[] (one per line).
|        -RepoRoot: the repository (omitted = the current folder). -Git: the git executable (default 'git'). -ErrorText
|        [ref]: git's standard error. Sets $global:LASTEXITCODE.
|    #>
|    param([string]$RepoRoot, [Parameter(Mandatory)][string[]]$Arguments, [string]$Git = 'git', [ref]$ErrorText)
|    $all = New-Object System.Collections.Generic.List[string]
|    if ("$RepoRoot".Trim()) { $all.Add('-C'); $all.Add($RepoRoot) }
|    foreach ($a in @($Arguments)) { $all.Add([string]$a) }
|    $psi = New-Object System.Diagnostics.ProcessStartInfo
|    $psi.FileName = $Git
|    $psi.UseShellExecute = $false
|    $psi.RedirectStandardOutput = $true
|    $psi.RedirectStandardError = $true
|    $psi.CreateNoWindow = $true
|    $utf8 = New-Object System.Text.UTF8Encoding($false)
|    $psi.StandardOutputEncoding = $utf8
|    $psi.StandardErrorEncoding = $utf8
|    if ($psi.PSObject.Properties['ArgumentList'] -and $null -ne $psi.ArgumentList) { foreach ($a in $all) { $psi.ArgumentList.Add($a) } }
|    else { $psi.Arguments = ConvertTo-SIGitArgumentString -Arguments $all.ToArray() }
|    $p = [System.Diagnostics.Process]::Start($psi)
|    try {
|        $errTask = $p.StandardError.ReadToEndAsync()
|        $text = $p.StandardOutput.ReadToEnd()
|        $p.WaitForExit()
|        $err = $errTask.GetAwaiter().GetResult()
|        $global:LASTEXITCODE = $p.ExitCode
|    } finally { $p.Dispose() }
|    if ($ErrorText) { $ErrorText.Value = $err }
|    if (-not $text) { return @() }
|    $text = $text.TrimStart([char]0xFEFF)
|    if ($text.EndsWith("`n")) { $text = $text.Substring(0, $text.Length - 1) }
|    [string[]]($text -split "`r?`n")
|}
|
|function Get-SIGitFileText {
|    <# The text of <Ref>:<Path> (git show), decoded as UTF-8 whatever the console; lines joined with "`n". '' when git
|       could not show it ($global:LASTEXITCODE says why). #>
|    param([string]$RepoRoot, [Parameter(Mandatory)][string]$Ref, [Parameter(Mandatory)][string]$Path)
|    $l = @(Invoke-SIGitText -RepoRoot $RepoRoot -Arguments @('show', ('{0}:{1}' -f $Ref, $Path)))
|    if ($global:LASTEXITCODE -ne 0) { return '' }
|    (@($l) -join "`n")
|}
'@ }
$__siSupportFiles['config/release-scopes.locked.json'] = @{ Sha256 = '437593be3495b4ce842f0c50948705e26aed6a6631618db6ecc4fd29afa7a5d3'; Text = @'
|{
|  "_": "THE COMPONENTS OF A RELEASE (CR3, SI #657; framework DOCS/REQUIREMENTS.md 12.11e item 3). SecurityInsight's components -- the collections per source, the correlation, Risk Analysis per report and data out per channel -- each with the engine files that are its code. engine/_shared/SI-ReleaseControl.ps1 reads this file: (1) the publish call says which components a release changed (changedScopes), (2) the updater fingerprints each component of the code it installed and marks a changed one 'Testing' (cfg.ReleaseScope), (3) a component is 'Stable' again after 3 good daily runs with no code change. Matching: a path is relative to the solution root with '/' separators; '*' is any text inside one folder level, '**' any number of levels. The FIRST list that matches wins, in this order: 'none' (not code of any component: samples, read-me files, and the jobs that are not one of the components -- verification, trend, schema discovery, the hourly status report), 'scopes' (one component), 'groups' (every component whose id starts with the group's prefix), 'core'. A file in the engine folders that matches nothing counts as CORE: a change to it marks EVERY component Testing (the same rule as PIM's: a core file = all scopes). Risk Analysis per report: each report block of 'raReports.file' is its own component '<prefix><ReportName>'; the rest of that file belongs to the group 'raReports.group'.",
|  "schema": 1,
|  "folders": [ "engine", "launcher", "risk-analysis-detection" ],
|  "raReports": { "file": "risk-analysis-detection/RiskAnalysis_Queries_Locked.yaml", "prefix": "risk-analysis.", "group": "risk-analysis." },
|  "none": [
|    "**/*.sample",
|    "**/*.sample.*",
|    "**/*.custom.sample.*",
|    "**/README.md",
|    "**/*.md",
|    "engine/verification/**",
|    "engine/heartbeat/**",
|    "engine/_shared/SI-HeartbeatJob.ps1",
|    "engine/index-build/**",
|    "engine/asset-trend/**",
|    "launcher/asset-trend/**",
|    "engine/asset-profiling/stages/Invoke-Schema*.ps1",
|    "engine/asset-profiling/lint/**"
|  ],
|  "scopes": [
|    {
|      "id": "collection.identity",
|      "label": "Collection: identities (Entra ID)",
|      "engines": [ "identity" ],
|      "patterns": [
|        "launcher/identity/**",
|        "engine/asset-profiling/discovery/Get-DiscoveryFromEntra*.ps1",
|        "engine/asset-profiling/discovery/Get-DiscoveryFromIdentityExposureGraph.ps1",
|        "engine/asset-profiling/discovery/Get-SIEntraContext.ps1",
|        "engine/asset-profiling/shared/Build-IdentityProfileRow.ps1",
|        "engine/asset-profiling/shared/IdentityCatalogTierComputer.ps1",
|        "engine/asset-profiling/shared/IdentityRoleFetcher.ps1",
|        "engine/asset-profiling/shared/SI-AuthMethodsRead.ps1",
|        "engine/asset-profiling/shared/SI-SignInMethodsChoice.ps1",
|        "engine/signin-methods/**",
|        "engine/asset-profiling/shared/SI-IdentityPublishScope.ps1"
|      ]
|    },
|    {
|      "id": "collection.endpoint",
|      "label": "Collection: devices (Defender for Endpoint, Intune)",
|      "engines": [ "endpoint" ],
|      "patterns": [
|        "launcher/endpoint/**",
|        "engine/asset-profiling/discovery/Get-DiscoveryFromMDE.ps1",
|        "engine/asset-profiling/discovery/Get-DiscoveryFromEndpointViaEG.ps1",
|        "engine/asset-profiling/discovery/Get-SIDefender*.ps1",
|        "engine/asset-profiling/discovery/Get-SIIntuneContext.ps1",
|        "engine/asset-profiling/shared/Build-EndpointProfileRow.ps1",
|        "engine/asset-profiling/shared/EndpointCatalogTierComputer.ps1",
|        "engine/asset-profiling/shared/EndpointAzureCorrelationCache.ps1",
|        "engine/asset-profiling/shared/endpoint-tiering.json",
|        "engine/asset-profiling/shared/server-applications.json"
|      ]
|    },
|    {
|      "id": "collection.azure",
|      "label": "Collection: Azure resources and Defender for Cloud",
|      "engines": [ "azure" ],
|      "patterns": [
|        "launcher/azure/**",
|        "engine/asset-profiling/discovery/*Azure*.ps1",
|        "engine/asset-profiling/discovery/Get-DiscoveryFromARG.ps1",
|        "engine/asset-profiling/discovery/Invoke-SIArgPaged.ps1",
|        "engine/asset-profiling/discovery/Get-SIMdc*.ps1",
|        "engine/asset-profiling/shared/Build-AzureProfileRow.ps1",
|        "engine/asset-profiling/shared/AzureParentScopeCache.ps1",
|        "engine/data-model/SI-AzureChildren.ps1"
|      ]
|    },
|    {
|      "id": "collection.publicip",
|      "label": "Collection: public IP addresses",
|      "engines": [ "publicip" ],
|      "patterns": [
|        "launcher/publicip/**",
|        "engine/asset-profiling/discovery/Get-DiscoveryFromShodan.ps1",
|        "engine/asset-profiling/shared/Build-PublicIpProfileRow.ps1",
|        "engine/asset-profiling/storage/ShodanCache.ps1"
|      ]
|    },
|    {
|      "id": "collection.privilege-tier",
|      "label": "Collection: privilege tiers",
|      "engines": [ "privilege-tier-classifier" ],
|      "patterns": [
|        "launcher/privilege-tier-classifier/**",
|        "engine/privilege-tier-classifier/**"
|      ]
|    },
|    {
|      "id": "collection.asset-properties",
|      "label": "Collection: asset properties",
|      "engines": [ "asset-properties" ],
|      "patterns": [
|        "launcher/asset-properties/**",
|        "engine/asset-properties/**"
|      ]
|    },
|    {
|      "id": "correlation",
|      "label": "Correlation",
|      "engines": [ "asset-correlation", "correlation" ],
|      "patterns": [
|        "launcher/asset-correlation/**",
|        "engine/asset-correlation/**",
|        "engine/data-model/SI-Ci*.ps1",
|        "engine/data-model/identity/**"
|      ]
|    },
|    {
|      "id": "data-out.cmdb",
|      "label": "Data out: CMDB hand-off",
|      "engines": [ "asset-cmdb", "cmdb", "asset-cmdb-sql" ],
|      "patterns": [
|        "launcher/asset-cmdb/**",
|        "engine/asset-cmdb/Invoke-SICmdb*.ps1",
|        "engine/asset-cmdb/_shared/SI-Cmdb*.ps1",
|        "engine/asset-cmdb/_shared/SI-ServiceNowClient.ps1",
|        "engine/asset-cmdb/_shared/SI-SnowImportSet.ps1",
|        "engine/asset-cmdb/_shared/SI-SnowTestPack.ps1",
|        "engine/asset-cmdb/_shared/SI-ServiceModel.ps1",
|        "engine/asset-cmdb/_shared/SI-AssetLifecycle.ps1",
|        "engine/asset-cmdb/_shared/SI-CollectionSend.ps1",
|        "engine/asset-cmdb/_shared/SI-ReconcileGuards.ps1"
|      ]
|    },
|    {
|      "id": "data-out.vulnerabilities",
|      "label": "Data out: vulnerability tickets",
|      "engines": [ "vuln-closeloop", "asset-vulnerabilities", "asset-vulnerabilities-servicenow" ],
|      "patterns": [
|        "engine/asset-cmdb/Invoke-SIVulnLoop.ps1",
|        "engine/asset-cmdb/_shared/SI-Vuln*.ps1"
|      ]
|    },
|    {
|      "id": "data-out.mail",
|      "label": "Data out: mail (close-loop, exemptions, governance, digests)",
|      "engines": [ "close-loop-mail" ],
|      "patterns": [
|        "engine/asset-cmdb/Invoke-SICloseLoopMail.ps1",
|        "engine/asset-cmdb/_shared/SI-CloseLoopMail.ps1",
|        "engine/asset-cmdb/_shared/SI-ExemptionMail.ps1",
|        "engine/pro-data/Invoke-SIGovernanceMail.ps1",
|        "engine/pro-data/Invoke-SITaskDigest.ps1",
|        "engine/pro-data/Invoke-SIDepartmentReport.ps1",
|        "engine/pro-data/_shared/SI-GovernanceMail.ps1",
|        "engine/pro-data/_shared/SI-TaskDigest.ps1",
|        "engine/pro-data/_shared/SI-DepartmentReport.ps1"
|      ]
|    },
|    {
|      "id": "data-out.sql",
|      "label": "Data out: the data sync to SQL",
|      "engines": [ "datasync", "asset-datasync" ],
|      "patterns": [
|        "engine/pro-data/Invoke-SIDataSync.ps1",
|        "engine/pro-data/_shared/SI-Data*.ps1",
|        "engine/pro-data/_shared/SI-ExemptedView.ps1"
|      ]
|    },
|    {
|      "id": "data-out.outputs",
|      "label": "Data out: listed outputs (workbooks, ServiceNow import sets)",
|      "engines": [ "data-out" ],
|      "patterns": [
|        "engine/data-out/**",
|        "engine/data-model/SI-OutputMapper.ps1"
|      ]
|    },
|    {
|      "id": "data-out.tagging",
|      "label": "Data out: asset tags",
|      "engines": [ "asset-tagging" ],
|      "patterns": [
|        "launcher/asset-tagging/**",
|        "engine/asset-tagging/**",
|        "engine/asset-profiling/stages/Invoke-Tagging.ps1"
|      ]
|    }
|  ],
|  "groups": [
|    {
|      "id": "risk-analysis.",
|      "label": "Risk Analysis (every report)",
|      "engines": [ "risk-analysis", "risk-analysis-detailed" ],
|      "patterns": [
|        "launcher/risk-analysis/**",
|        "engine/risk-analysis/**",
|        "risk-analysis-detection/**"
|      ]
|    }
|  ],
|  "core": [
|    "engine/_shared/**",
|    "engine/asset-profiling/**",
|    "engine/data-model/**",
|    "engine/pro-settings/**",
|    "engine/pro-data/**",
|    "engine/flow/**",
|    "launcher/_lib/**",
|    "engine/SI-FeatureCatalog.ps1"
|  ]
|}
'@ }
$__siSupportFiles['engine/_shared/SI-ReportedRing.ps1'] = @{ Sha256 = 'cc4938cf08721e6a53224eb74278fc381ff71b5ae414593941c6f5cc37b5140d'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE RING THIS INSTALL REPORTS (framework §8.4 / §8.7): every heartbeat and run report carries it, so
|    Invardia can judge the install's update level against the version approved for its ring. The SAME order the web app's
|    header uses (HeaderContext.RingOf): the updater's state > the ring recorded for the install > the setting SI_UpdateRing.
|
|    PURE, both editions (the telemetry sender ships in Community too). The two Pro database rows it reads are fetched by
|    Read-SIInstallRingFacts (engine\_shared\SI-InstallRing.ps1, Pro). Rings are the framework's: 0 dev, 1 internal,
|    2 early release, 3 broad. PS 5.1 and 7.
|#>
|
|function ConvertTo-SIReportedRing {
|    <# PURE. A ring as the product writes it -- 0..3 (number or text), 'r0'..'r3', 'ring 1', 'prod' (= 3) -- or $null. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -is [bool]) { return $null }
|    $t = ("$Value").Trim().ToLowerInvariant()
|    if (-not $t) { return $null }
|    if ($t -eq 'prod') { return 3 }
|    $t = $t -replace '^(ring\s*|r)', ''
|    $n = 0
|    if (-not [int]::TryParse($t, [System.Globalization.NumberStyles]::Integer, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n)) { return $null }
|    if ($n -lt 0 -or $n -gt 3) { return $null }
|    [int]$n
|}
|
|function Get-SIRingFromUpdateState {
|    <#
|        PURE. The ring in the updater's state: the compact cfg.InstallState 'UpdateState' row ({ code: { ring } }) or the
|        full SI-Update-State ({ code: { lastRing, appliedRing } }). Code first, then templates -- as the header reads it.
|        $null when the updater has recorded no ring.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Json)
|    if ([string]::IsNullOrWhiteSpace($Json)) { return $null }
|    try { $o = $Json | ConvertFrom-Json -ErrorAction Stop } catch { return $null }
|    if (-not $o) { return $null }
|    foreach ($kind in 'code', 'templates') {
|        if (-not $o.PSObject.Properties[$kind] -or $null -eq $o.$kind) { continue }
|        $k = $o.$kind
|        foreach ($f in 'ring', 'lastRing', 'appliedRing') {
|            if ($k.PSObject.Properties[$f] -and $null -ne $k.$f) { $r = ConvertTo-SIReportedRing $k.$f; if ($null -ne $r) { return $r } }
|        }
|    }
|    $null
|}
|
|function Get-SIRingFromInstallRow {
|    <# PURE. The ring in the install's recorded row (cfg.InstallState 'Ring': { "ring": 1, ... }), or $null. #>
|    param([AllowNull()][AllowEmptyString()][string]$Json)
|    if ([string]::IsNullOrWhiteSpace($Json)) { return $null }
|    try { $o = $Json | ConvertFrom-Json -ErrorAction Stop } catch { return $null }
|    if (-not $o -or -not $o.PSObject.Properties['ring']) { return $null }
|    ConvertTo-SIReportedRing $o.ring
|}
|
|function Resolve-SIReportedRing {
|    <#
|        PURE. The ring an uplink report carries, and where it came from. In order:
|          1. -UpdaterRing      the ring the updater resolved in THIS process (the updater's own reports;
|                               the guided install passes the ring it installs with)                  source 'updater'
|          2. -UpdateStateJson  the updater's recorded state (cfg.InstallState 'UpdateState')          source 'updater-state'
|          3. -InstallRingJson  the ring recorded for the install (cfg.InstallState 'Ring')            source 'install'
|          4. -Setting          SI_UpdateRing (the Pro database, else the configuration)              source 'setting'
|          5. -CommunityRing    a Community install's ring from config\update.custom.json             source 'community'
|        Returns @{ Ring (0..3 or $null); Source }. A value that is not a ring is skipped, never guessed.
|    #>
|    param([AllowNull()]$UpdaterRing, [AllowNull()][AllowEmptyString()][string]$UpdateStateJson, [AllowNull()][AllowEmptyString()][string]$InstallRingJson,
|          [AllowNull()]$Setting, [AllowNull()]$CommunityRing)
|    $r = ConvertTo-SIReportedRing $UpdaterRing
|    if ($null -ne $r) { return [pscustomobject]@{ Ring = $r; Source = 'updater' } }
|    $r = Get-SIRingFromUpdateState -Json $UpdateStateJson
|    if ($null -ne $r) { return [pscustomobject]@{ Ring = $r; Source = 'updater-state' } }
|    $r = Get-SIRingFromInstallRow -Json $InstallRingJson
|    if ($null -ne $r) { return [pscustomobject]@{ Ring = $r; Source = 'install' } }
|    $r = ConvertTo-SIReportedRing $Setting
|    if ($null -ne $r) { return [pscustomobject]@{ Ring = $r; Source = 'setting' } }
|    $r = ConvertTo-SIReportedRing $CommunityRing
|    if ($null -ne $r) { return [pscustomobject]@{ Ring = $r; Source = 'community' } }
|    [pscustomobject]@{ Ring = $null; Source = '' }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-SetupUplink.ps1'] = @{ Sha256 = '1469eccdafbdbfdd5593137aefe8dc2b553d25b0d24464550ec02ffcf6832730'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- the SETUP status report (uplink Kind = setup, framework §8.7 UPLINK-SETUP, #491): the control list of
|    critical parameters, so Invardia's customer health dashboard can show what is set and what is not.
|
|    THE CLOSED LIST is config\setup-catalog.locked.json ({ product, steps[], findings[], controls[] }; every item { id, title,
|    why, fix, docUrl? } + required (steps), productDefect (findings), enum + critical (controls), retired). Ids are stable
|    and lower-case and never removed. The release hands it over to Invardia as
|    <handover>\docs\securityinsight\<version>\setup-catalog.json (setup\Release-SI.ps1) with the released version added.
|
|    WHICH CONTROLS ARE SENT -- the setting SI_Telemetry_SetupControls:
|      all (default)      every control in the catalog (the framework minimum + SecurityInsight's extras). Invardia refuses the
|                         WHOLE report when it carries an id it does not know, so a refused 'all' report is sent again ONCE
|                         with only the minimum list, and said once (SI-TelemetrySend.ps1).
|      minimum            only the framework's minimum control set (Get-SISetupMinimumControlIds).
|      off                no setup report (the heartbeat and run reports are not affected).
|    The telemetry switch SI_Telemetry_Enabled = $false turns this off too.
|
|    WHAT IS SENT: identified installs only (an install key); an anonymous install never sends a setup report. Every control
|    in scope is in every report -- a control that could not be checked is 'unknown', never left out. `value` only for a
|    control declared with an enum, and only one of its values (the ring 1|2|3, the updater schedule, ...). Never a secret,
|    a user or group name, or error text.
|
|    PURE builders + one state reader; SI-TelemetrySend.ps1 queues the report with the daily heartbeat. PS 5.1 and 7.
|#>
|
|if (-not (Get-Command -Name ConvertTo-SIReportedRing -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-ReportedRing.ps1')) }
|
|function Get-SISetupUplinkState {
|    <# The value of $script:SISetupUplink, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SISetupUplink) { $script:SISetupUplink = @{
|    SIRoot      = (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))
|    CatalogFile = 'setup-catalog.locked.json'
|    Product     = 'securityinsight'
|    # The framework's minimum control set as Invardia's closed list holds it today (data/setup/securityinsight.json, seed).
|    # Every catalog control is sent by default (SI_Telemetry_SetupControls = all); this minimum list is the fallback when Invardia refuses that report.
|    Minimum     = @('updater-deployed', 'updater-schedule', 'update-ring', 'uplink-key', 'licence-valid', 'mail-sender',
|                    'alert-recipients', 'identity-permissions', 'last-run-24h', 'backup-configured', 'update-pinned')
|    States      = @('ok', 'missing', 'wrong', 'unknown')
|    Scopes      = @('minimum', 'all', 'off')
|    IdPattern   = '^[a-z0-9][a-z0-9.-]{0,59}$'
|} }
|    , $script:SISetupUplink
|}
|$script:SISetupUplink = $null; $null = Get-SISetupUplinkState
|
|function Get-SISetupMinimumControlIds { @((Get-SISetupUplinkState).Minimum) }
|
|function Get-SISetupCatalog {
|    <# The closed list (config\setup-catalog.locked.json) as an object. Throws when it cannot be read -- a release must not hand over a broken list. #>
|    param([string]$SIRoot = (Get-SISetupUplinkState).SIRoot)
|    $f = [System.IO.Path]::Combine($SIRoot, 'config', (Get-SISetupUplinkState).CatalogFile)
|    [IO.File]::ReadAllText($f).TrimStart([char]0xFEFF) | ConvertFrom-Json -ErrorAction Stop
|}
|
|function ConvertTo-SISetupCatalogHandover {
|    <#
|        PURE. The hand-over file for Invardia: { product, version, steps, findings, controls } -- exactly the fields Invardia's
|        import accepts (no note, no other field), the version the release published. Returns the JSON text.
|    #>
|    param([Parameter(Mandatory)]$Catalog, [Parameter(Mandatory)][string]$Version)
|    $o = [ordered]@{ product = [string]$Catalog.product; version = $Version.Trim()
|                     steps = @($Catalog.steps); findings = @($Catalog.findings); controls = @($Catalog.controls) }
|    ConvertTo-Json -InputObject $o -Depth 6
|}
|
|function Resolve-SISetupControlScope {
|    <# PURE. SI_Telemetry_SetupControls -> minimum | all | off. Not set or not one of them = all (the default, owner
|       2026-10-18: "telemetry must be on"); a report Invardia refuses with 'all' goes again once with the minimum list
|       (Send-SITelemetryRunEnd). #>
|    param([AllowNull()]$Value)
|    $v = "$Value".Trim().Trim('$').ToLowerInvariant()
|    if ($v -in @('false', 'none', 'disabled')) { $v = 'off' }
|    if ((Get-SISetupUplinkState).Scopes -contains $v) { return $v }
|    'all'
|}
|
|function Get-SISetupControlIds {
|    <# PURE. The control ids a report carries for -Scope: minimum = the framework minimum; all = every catalog control not retired. #>
|    param([Parameter(Mandatory)]$Catalog, [Parameter(Mandatory)][ValidateSet('minimum', 'all', 'off')][string]$Scope)
|    if ($Scope -eq 'off') { return @() }
|    $live = @(@($Catalog.controls) | Where-Object { $_ -and -not ($_.PSObject.Properties['retired'] -and $_.retired) } | ForEach-Object { [string]$_.id })
|    if ($Scope -eq 'all') { return $live }
|    @((Get-SISetupUplinkState).Minimum | Where-Object { $live -contains $_ })
|}
|
|function Get-SISetupControlStates {
|    <#
|        PURE. What this process can tell about the controls, from the telemetry context and the run that is ending:
|          update-ring       the reported ring (value 1|2|3; ring 0 = development: ok without a value); none = missing
|          uplink-key        identified (an install key) = ok, else missing
|          licence-valid     valid = ok, grace / expired = wrong, none = missing
|          licence-edition   the edition (value)
|          last-run-24h      this run ended ok = ok (another outcome says nothing about the last 24 hours: unknown)
|          updater-deployed / updater-schedule   the updater checked within 3 days (its recorded state) = ok / enabled
|        Everything else stays unknown (the report says 'unknown', never leaves it out). Returns id -> @{ State; Value }.
|    #>
|    param([Parameter(Mandatory)]$Context, [AllowEmptyString()][string]$ExitReason = '', [AllowNull()][AllowEmptyString()][string]$UpdateStateJson,
|          [datetime]$NowUtc = [datetime]::UtcNow,
|          # job-layout: the update's pipeline-schedule check (cfg.InstallState 'PipelineSchedule', within 3 days): ok / repaired
|          # = ok; would-repair / failed = wrong ("neither mode": the pipeline not scheduled and no job of it on its own timer)
|          [AllowNull()][AllowEmptyString()][string]$PipelineScheduleJson,
|          # secret-handover: the updater's hand-over key check (cfg.InstallState 'SecretHandover', within 3 days): ok, or missing =
|          # the updater may not use its Key Vault key until the updater setup is re-run with its role grants
|          [AllowNull()][AllowEmptyString()][string]$SecretHandoverJson)
|    $s = @{}
|    $prop = { param($n) if ($Context.PSObject.Properties[$n]) { $Context.$n } else { $null } }
|    $ring = ConvertTo-SIReportedRing (& $prop 'Ring')
|    $s['update-ring'] = if ($null -eq $ring) { @{ State = 'missing' } } elseif ($ring -ge 1) { @{ State = 'ok'; Value = [string]$ring } } else { @{ State = 'ok' } }
|    $s['uplink-key'] = @{ State = $(if ("$(& $prop 'Mode')" -eq 'identified') { 'ok' } else { 'missing' }) }
|    switch ("$(& $prop 'LicenceState')") { 'valid' { $s['licence-valid'] = @{ State = 'ok' } } 'grace' { $s['licence-valid'] = @{ State = 'wrong' } }
|                                         'expired' { $s['licence-valid'] = @{ State = 'wrong' } } 'none' { $s['licence-valid'] = @{ State = 'missing' } } }
|    $ed = "$(& $prop 'Edition')"; if ($ed) { $s['licence-edition'] = @{ State = 'ok'; Value = $ed } }
|    if ("$ExitReason" -eq 'success') { $s['last-run-24h'] = @{ State = 'ok' } }
|    if (-not [string]::IsNullOrWhiteSpace($UpdateStateJson)) {
|        try {
|            $o = $UpdateStateJson | ConvertFrom-Json -ErrorAction Stop
|            $last = $null
|            if ($o -and $o.PSObject.Properties['lastCheckUtc'] -and $o.lastCheckUtc) {
|                $d = [datetime]::MinValue
|                if ($o.lastCheckUtc -is [datetime]) { $last = $o.lastCheckUtc.ToUniversalTime() }
|                elseif ([datetime]::TryParse("$($o.lastCheckUtc)", [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]'AdjustToUniversal, AssumeUniversal', [ref]$d)) { $last = $d }
|            }
|            if ($last -and ($NowUtc.ToUniversalTime() - $last).TotalDays -le 3) {
|                $s['updater-deployed'] = @{ State = 'ok' }; $s['updater-schedule'] = @{ State = 'ok'; Value = 'enabled' }
|            }
|        } catch { }
|    }
|    if (-not [string]::IsNullOrWhiteSpace($PipelineScheduleJson)) {
|        try {
|            $p = $PipelineScheduleJson | ConvertFrom-Json -ErrorAction Stop
|            $at = [datetime]::MinValue
|            $fresh = $p.PSObject.Properties['checkedUtc'] -and [datetime]::TryParse("$($p.checkedUtc)", [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]'AdjustToUniversal, AssumeUniversal', [ref]$at) -and ($NowUtc.ToUniversalTime() - $at).TotalDays -le 3
|            if ($fresh) {
|                switch ("$($p.state)") { 'ok' { $s['job-layout'] = @{ State = 'ok' } } 'repaired' { $s['job-layout'] = @{ State = 'ok' } }
|                                         'would-repair' { $s['job-layout'] = @{ State = 'wrong' } } 'failed' { $s['job-layout'] = @{ State = 'wrong' } } }
|            }
|        } catch { }
|    }
|    if (-not [string]::IsNullOrWhiteSpace($SecretHandoverJson)) {
|        try {
|            $h = $SecretHandoverJson | ConvertFrom-Json -ErrorAction Stop
|            $at2 = [datetime]::MinValue
|            $fresh2 = $h.PSObject.Properties['checkedUtc'] -and [datetime]::TryParse("$($h.checkedUtc)", [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]'AdjustToUniversal, AssumeUniversal', [ref]$at2) -and ($NowUtc.ToUniversalTime() - $at2).TotalDays -le 3
|            if ($fresh2 -and "$($h.state)" -in @('ok', 'missing')) { $s['secret-handover'] = @{ State = "$($h.state)" } }
|        } catch { }
|    }
|    $s
|}
|
|function New-SISetupReport {
|    <#
|        PURE. The Kind=setup record for the uplink, or $null when nothing is to be sent (not identified, or -Scope off).
|        Every control of -Scope is in it (Get-SISetupControlIds); a control without a state in -States is 'unknown'. A state
|        outside the closed list becomes 'unknown'; a value is kept only for a control declared with an enum and only when
|        it is one of the enum's values. Ids in -States outside the scope are NOT sent (an unknown id rejects the report).
|        Fields: Schema, Kind, Product, Version, Ring, Edition, LastSeenUtc, Controls -- nothing else (Invardia refuses any
|        other field on a setup report).
|    #>
|    param([Parameter(Mandatory)]$Context, [Parameter(Mandatory)]$Catalog, [System.Collections.IDictionary]$States = @{},
|          [ValidateSet('minimum', 'all', 'off')][string]$Scope = 'minimum', $Now)
|    if ($Scope -eq 'off') { return $null }
|    if ("$($Context.Mode)" -ne 'identified') { return $null }
|    $ts = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|    $defs = @{}; foreach ($c in @($Catalog.controls)) { if ($c) { $defs[[string]$c.id] = $c } }
|    $controls = New-Object System.Collections.Generic.List[object]
|    foreach ($id in @(Get-SISetupControlIds -Catalog $Catalog -Scope $Scope)) {
|        if ($id -notmatch (Get-SISetupUplinkState).IdPattern) { continue }
|        $st = $States[$id]
|        $state = if ($st -and (Get-SISetupUplinkState).States -contains "$($st.State)") { "$($st.State)" } else { 'unknown' }
|        $item = [ordered]@{ id = $id; state = $state }
|        $def = $defs[$id]
|        if ($st -and $null -ne $st.Value -and "$($st.Value)" -ne '' -and $def -and $def.PSObject.Properties['enum'] -and (@($def.enum) -contains "$($st.Value)")) { $item['value'] = "$($st.Value)" }
|        $controls.Add([pscustomobject]$item)
|    }
|    $o = [ordered]@{ Schema = 2; Kind = 'setup'; Product = (Get-SISetupUplinkState).Product }
|    $ver = "$($Context.Version)".Trim(); if ($ver -match '^[0-9A-Za-z.+-]{1,50}$') { $o['Version'] = $ver }
|    $ring = $null; if ($Context.PSObject.Properties['Ring']) { $ring = ConvertTo-SIReportedRing $Context.Ring }
|    if ($null -ne $ring) { $o['Ring'] = [int]$ring }
|    $ed = "$($Context.Edition)".Trim().ToLowerInvariant(); if (@('community', 'pro', 'trial') -contains $ed) { $o['Edition'] = $ed }
|    $o['LastSeenUtc'] = $ts.ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture)
|    $o['Controls'] = $controls.ToArray()
|    [pscustomobject]$o
|}
'@ }
$__siSupportFiles['engine/_shared/SI-LicenceSuperseded.ps1'] = @{ Sha256 = '5da16885e4d22cddd570e1036645e9781a59c301218738c9f61aa6991ccb2ac9'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- A RE-ISSUED LICENCE REACHES THE INSTALL BY ITSELF (#517; framework DOCS/REQUIREMENTS.md §12.6b,
|    Invardia live 1.0.230).
|
|    HOW: every IDENTIFIED status report carries the installed licence's id (LicenceId, a lower-case GUID -- left out when
|    the licence has no GUID-shaped id, else Invardia refuses the whole report). When Invardia has re-issued that licence it
|    answers 202 {"supersededBy": "<newest id>"}. The engine run that hears it records the id here, in the Pro database
|    (cfg.InstallState 'LicenceSupersededBy', on the connection the run already has); the updater's licence step reads it on
|    its next run and knocks at once with currentLicenceId -- Invardia then approves the successor by itself and the normal
|    pull installs it (verified offline as every licence is). The same id is knocked for only once.
|
|    The marker only says "ask now"; nothing is trusted from it -- the licence itself is verified as always. PS 5.1 + 7.
|#>
|
|function Get-SILicenceSupersededNameState {
|    <# The value of $script:SILicenceSupersededName, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SILicenceSupersededName) { $script:SILicenceSupersededName = 'LicenceSupersededBy' }
|    , $script:SILicenceSupersededName
|}
|$script:SILicenceSupersededName = $null; $null = Get-SILicenceSupersededNameState
|function Get-SILicenceSupersededGuidState {
|    <# The value of $script:SILicenceSupersededGuid, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SILicenceSupersededGuid) { $script:SILicenceSupersededGuid = '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$' }
|    , $script:SILicenceSupersededGuid
|}
|$script:SILicenceSupersededGuid = $null; $null = Get-SILicenceSupersededGuidState
|
|function ConvertTo-SILicenceIdOrEmpty {
|    <# PURE. A licence id as the lower-case GUID Invardia takes, or '' when it is not GUID-shaped. #>
|    param([AllowNull()][AllowEmptyString()][string]$LicenceId)
|    $v = "$LicenceId".Trim()
|    if ($v -match (Get-SILicenceSupersededGuidState)) { return $v.ToLowerInvariant() }
|    ''
|}
|
|function Get-SILicenceSupersededFromAnswer {
|    <# PURE. The supersededBy id of an uplink answer (a parsed body, or its text), '' when none / not a GUID. #>
|    param([AllowNull()]$Answer)
|    if ($null -eq $Answer) { return '' }
|    $o = $Answer
|    if ($Answer -is [string]) { if (-not $Answer.Trim()) { return '' }; try { $o = $Answer | ConvertFrom-Json -ErrorAction Stop } catch { return '' } }
|    $v = ''
|    if ($o -is [System.Collections.IDictionary]) { if ($o.Contains('supersededBy')) { $v = [string]$o['supersededBy'] } }
|    elseif ($o.PSObject.Properties['supersededBy']) { $v = [string]$o.supersededBy }
|    ConvertTo-SILicenceIdOrEmpty $v
|}
|
|function Save-SILicenceSupersededMark {
|    <# Records the newest licence id Invardia named (cfg.InstallState 'LicenceSupersededBy') on -Store. Throws on failure. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$LicenceId, $NowUtc)
|    $id = ConvertTo-SILicenceIdOrEmpty $LicenceId
|    if (-not $id) { throw "not a licence id: '$LicenceId'" }
|    $at = if ($NowUtc) { ([datetime]$NowUtc).ToUniversalTime() } else { [datetime]::UtcNow }
|    $v = ([ordered]@{ licenceId = $id; seenUtc = $at.ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) } | ConvertTo-Json -Compress)
|    $sql = @'
|IF OBJECT_ID('cfg.InstallState') IS NOT NULL
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @Name)
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @Name;
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@Name, @Value, NULL, @By);
|    COMMIT;
|END
|'@
|    $null = & $Store.Invoke $sql ([ordered]@{ Name = (Get-SILicenceSupersededNameState); Value = $v; By = 'si-engine (Invardia uplink)' }) 'nonquery'
|}
|
|function Read-SILicenceSupersededMark {
|    <# The licence id the last report heard (cfg.InstallState 'LicenceSupersededBy') on -Store, '' when none. NEVER throws. #>
|    param([Parameter(Mandatory)]$Store)
|    try {
|        $rows = @(& $Store.Invoke "IF OBJECT_ID('cfg.InstallState') IS NOT NULL SELECT Value FROM cfg.InstallState WHERE Name = N'LicenceSupersededBy'" @{} 'reader' | ForEach-Object { $_ })
|        foreach ($row in $rows) {
|            if (-not $row) { continue }
|            $v = if ($row -is [System.Collections.IDictionary]) { $row['Value'] } else { $row.Value }
|            if ($null -eq $v -or $v -is [System.DBNull]) { continue }
|            return (Get-SILicenceSupersededFromAnswer ([string]$v -replace '"licenceId"', '"supersededBy"'))
|        }
|    } catch { }
|    ''
|}
'@ }
$__siSupportFiles['engine/_shared/SI-TelemetryEndpoints.ps1'] = @{ Sha256 = '5f4871e9760be3a64ed613dbb82f77a46a3cdeca2b63676fceaf86b60aa589ec'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- the INSTALL'S OWN LINKS on the identified heartbeat, and the deep Link on a failed run report
|    (framework §8.9 ENDPOINTS, Invardia: "Open SecurityInsight" buttons in every mail about the environment).
|
|    THE FIELD (identified heartbeat only -- an anonymous record never carries it), Invardia's contract (§8.9):
|        endpoints: [ { kind, url, label? } ]
|          - the property is `endpoints` (lower case); each entry has kind and url, optionally label -- NO other key (one
|            other key makes Invardia refuse the whole list);
|          - kind: ^[a-z][a-z0-9-]{1,30}$: web = the Pro web app, mcp = its MCP server; each kind once. 3.0.30 (Invardia's
|            alignment gap no-endpoint): Invardia's delivery check reads SI's web app as role `web` (Invardia DESIGN ch 9
|            "Customer endpoints": "SI: `web`, `mcp`"), so the kind earlier releases sent, `webapp` (framework §8.9's list),
|            was stored but never counted as the web app. `webapp` from an older row or caller is read as `web`;
|          - url: https only, no user name / password, no query string, no fragment, at most 400 characters;
|          - label: plain text, at most 60 characters (optional);
|          - at most 12 entries; the field is left out when nothing is known.
|
|    THE SEND GATE: a list Invardia's validator does not accept makes it refuse the WHOLE report (422), so the heartbeat
|    carries `endpoints` only while SI_Telemetry_SendEndpoints is on -- ON by default since Invardia's validator is live
|    (2026-10-10); a customer can switch it off. The run report's deep Link is not gated.
|
|    WHERE THE ADDRESSES COME FROM -- the install's own hosting and settings, never a hard-coded name:
|        1. the hosting record the updater keeps (cfg.InstallState 'Endpoints'): it reads the Container App FQDN of the web
|           app (ca-si-management) and the MCP server (ca-si-mcp) over ARM on every run (Save-SIInstallEndpointsRow); an
|           engine run reads the row at run start with the ring facts ($global:SI_InstallRingFacts.Endpoints); the updater
|           itself also keeps what it just read in $global:SI_InstallEndpoints. A row written before §8.9 (entries with
|           `role`: web / mcp) is read as kind (webapp / mcp);
|        2. the web app's public address setting (SIWeb_PublicBaseUrl) when the hosting record has no webapp entry.
|
|    THE DEEP LINK: an identified run report that did not end ok carries Link = <web app>/Admin/RunHealth (the run-health
|    page); guard records already carry <web app>/Admin/Guards (SI-Guard.ps1). No web app known = no Link.
|
|    PURE except Save-SIInstallEndpointsRow (one SQL write on a store the caller opened), Get-SITelemetryInstallEndpoints
|    and Test-SITelemetrySendEndpoints (read the run's globals). Nothing here throws to a telemetry caller: a bad value is
|    dropped, never sent.
|#>
|
|function Get-SITelemetryEndpointRulesState {
|    <# The value of $script:SITelemetryEndpointRules, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SITelemetryEndpointRules) { $script:SITelemetryEndpointRules = @{
|    Max           = 12
|    KindPattern   = '^[a-z][a-z0-9-]{1,30}$'
|    UrlMax        = 400
|    LabelMax      = 60
|    Keys          = @('kind', 'url', 'label')
|    # the web app's kind on the wire: Invardia's role for SI's main address (3.0.30, alignment gap no-endpoint)
|    WebKind       = 'web'
|    # older names (a row or caller before 3.0.30: kind webapp) -> the kind sent
|    KindAliases   = @{ webapp = 'web' }
|    Labels        = @{ web = 'SecurityInsight web app'; mcp = 'SecurityInsight MCP server' }
|    StateName     = 'Endpoints'      # cfg.InstallState row
|    StateMax      = 400              # cfg.InstallState.Value is NVARCHAR(400)
|    RunHealthPath = '/Admin/RunHealth'
|} }
|    , $script:SITelemetryEndpointRules
|}
|$script:SITelemetryEndpointRules = $null; $null = Get-SITelemetryEndpointRulesState
|
|function Get-SITelemetryEndpointRules { (Get-SITelemetryEndpointRulesState) }
|
|function Test-SITelemetrySendEndpoints {
|    <# The send gate: $global:SI_Telemetry_SendEndpoints, else the environment variable SI_TELEMETRY_SENDENDPOINTS; ON
|       when neither is set (Invardia accepts install links), otherwise on only for true / 1 / on / yes. #>
|    param([AllowNull()]$Value = $global:SI_Telemetry_SendEndpoints, [AllowNull()][AllowEmptyString()][string]$EnvValue = [Environment]::GetEnvironmentVariable('SI_TELEMETRY_SENDENDPOINTS'))
|    $v = if ($null -ne $Value -and "$Value".Trim() -ne '') { "$Value" } else { "$EnvValue" }
|    if (-not $v.Trim()) { return $true }
|    return ($v.Trim().ToLowerInvariant() -in @('true', '1', 'on', 'yes', '$true'))
|}
|
|function ConvertTo-SITelemetryEndpointUrl {
|    <# PURE. One address as Invardia accepts it: https://host[:port][/path], no query, no fragment, no credentials, no
|       trailing slash, at most 400 characters. A bare host name (a Container App FQDN) becomes https://<host>. '' for
|       anything else. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    $v = "$Value".Trim()
|    if (-not $v) { return '' }
|    if ($v -notmatch '^[a-zA-Z][a-zA-Z0-9+.-]*://') {
|        if ($v -match '^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)+(:\d{1,5})?(/[^?#]*)?$') { $v = 'https://' + $v }
|        else { return '' }
|    }
|    $u = $null
|    if (-not [System.Uri]::TryCreate($v, [System.UriKind]::Absolute, [ref]$u)) { return '' }
|    if ($u.Scheme -ne 'https') { return '' }
|    if ($u.Query -or $u.Fragment -or $v.Contains('?') -or $v.Contains('#')) { return '' }
|    if ($u.UserInfo -or $v -match '^https://[^/]*@') { return '' }
|    if (-not $u.Host -or $u.Host -notmatch '\.') { return '' }
|    $out = 'https://' + $u.Authority.ToLowerInvariant() + $u.AbsolutePath.TrimEnd('/')
|    if ($out.Length -gt (Get-SITelemetryEndpointRulesState).UrlMax) { return '' }
|    $out
|}
|
|function ConvertTo-SITelemetryEndpointLabel {
|    <# PURE. A label as plain text: control characters and markup characters removed, spaces collapsed, at most 60
|       characters. '' when nothing is left. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    $t = [regex]::Replace("$Value", '[\x00-\x1F\x7F<>]', ' ')
|    $t = [regex]::Replace($t, '\s+', ' ').Trim()
|    if ($t.Length -gt (Get-SITelemetryEndpointRulesState).LabelMax) { $t = $t.Substring(0, (Get-SITelemetryEndpointRulesState).LabelMax).TrimEnd() }
|    $t
|}
|
|function ConvertTo-SITelemetryEndpointList {
|    <# PURE. Items (hashtables or objects, in priority order) as the §8.9 wire list: each entry exactly kind + url (+ label
|       when one is given), valid entries only, each kind once (the first wins), at most 12. An item with `role` instead of
|       `kind` (a row written before §8.9) is read as kind; webapp (the kind before 3.0.30) is read as web. Writes the entries one by one (none = nothing to send),
|       so every caller collects them with @(...) and the list is never wrapped in a second array. #>
|    param([AllowNull()][object[]]$Items)
|    $r = (Get-SITelemetryEndpointRulesState)
|    $out = New-Object System.Collections.Generic.List[object]
|    $seen = @{}
|    foreach ($it in @($Items)) {
|        if ($null -eq $it -or $out.Count -ge $r.Max) { continue }
|        $get = { param($n) if ($it -is [System.Collections.IDictionary]) { if ($it.Contains($n)) { $it[$n] } else { $null } } elseif ($it.PSObject.Properties[$n]) { $it.$n } else { $null } }
|        $kind = "$(& $get 'kind')".Trim().ToLowerInvariant()
|        if (-not $kind) { $kind = "$(& $get 'role')".Trim().ToLowerInvariant() }
|        if ($r.KindAliases.ContainsKey($kind)) { $kind = $r.KindAliases[$kind] }
|        if ($kind -notmatch $r.KindPattern -or $seen.ContainsKey($kind)) { continue }
|        $url = ConvertTo-SITelemetryEndpointUrl ([string](& $get 'url'))
|        if (-not $url) { continue }
|        $seen[$kind] = $true
|        $e = [ordered]@{ kind = $kind; url = $url }
|        $label = ConvertTo-SITelemetryEndpointLabel ([string](& $get 'label'))
|        if ($label) { $e['label'] = $label }
|        $out.Add([pscustomobject]$e)
|    }
|    $out.ToArray()
|}
|
|function ConvertTo-SIInstallEndpointsValue {
|    <# PURE. The list as the cfg.InstallState 'Endpoints' value (compact JSON, kind + url only -- labels are added when the
|       report is built -- at most 400 characters: entries that would pass the limit are left out, in order). '' for an
|       empty list. #>
|    param([AllowNull()][object[]]$Endpoints)
|    $list = @(ConvertTo-SITelemetryEndpointList -Items $Endpoints | ForEach-Object { [pscustomobject][ordered]@{ kind = $_.kind; url = $_.url } })
|    $keep = New-Object System.Collections.Generic.List[object]
|    foreach ($e in $list) {
|        $keep.Add($e)
|        $json = ConvertTo-Json -InputObject @($keep.ToArray()) -Compress -Depth 3
|        if ($json.Length -gt (Get-SITelemetryEndpointRulesState).StateMax) { $keep.RemoveAt($keep.Count - 1) }
|    }
|    if (-not $keep.Count) { return '' }
|    ConvertTo-Json -InputObject @($keep.ToArray()) -Compress -Depth 3
|}
|
|function ConvertFrom-SIInstallEndpointsValue {
|    <# PURE. The cfg.InstallState 'Endpoints' value back as the checked list (an old row with `role` reads as kind).
|       Damaged JSON = an empty list. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    if (-not "$Value".Trim()) { return }
|    try { $j = "$Value".Trim() | ConvertFrom-Json -ErrorAction Stop } catch { return }
|    ConvertTo-SITelemetryEndpointList -Items @($j)
|}
|
|function Resolve-SITelemetryEndpoints {
|    <# PURE. The heartbeat's list: the hosting record first (-Hosting: what the updater read, or the recorded row), then the
|       web app's public address setting as 'webapp' when the hosting record has none; each known kind gets its plain
|       label. #>
|    param([AllowNull()][object[]]$Hosting, [AllowNull()][AllowEmptyString()][string]$PublicBaseUrl)
|    $items = New-Object System.Collections.Generic.List[object]
|    foreach ($h in @(ConvertTo-SITelemetryEndpointList -Items $Hosting)) { $items.Add($h) }
|    if ("$PublicBaseUrl".Trim()) { $items.Add([pscustomobject]@{ kind = (Get-SITelemetryEndpointRulesState).WebKind; url = "$PublicBaseUrl".Trim() }) }
|    $labels = (Get-SITelemetryEndpointRulesState).Labels
|    $withLabels = @(ConvertTo-SITelemetryEndpointList -Items $items.ToArray() | ForEach-Object {
|        $e = [ordered]@{ kind = $_.kind; url = $_.url }
|        if ($_.PSObject.Properties['label'] -and "$($_.label)") { $e['label'] = $_.label } elseif ($labels.ContainsKey($_.kind)) { $e['label'] = $labels[$_.kind] }
|        $e })
|    ConvertTo-SITelemetryEndpointList -Items $withLabels
|}
|
|function Get-SITelemetryRunLink {
|    <# PURE. The deep link of a run report that did not end ok: the web app's run-health page. '' without a web app.
|       (An old entry with role 'web' counts as the web app.) #>
|    param([AllowNull()][object[]]$Endpoints)
|    $web = @(ConvertTo-SITelemetryEndpointList -Items $Endpoints | Where-Object { "$($_.kind)" -eq (Get-SITelemetryEndpointRulesState).WebKind } | Select-Object -First 1)
|    if (-not $web.Count) { return '' }
|    $web[0].url + (Get-SITelemetryEndpointRulesState).RunHealthPath
|}
|
|function Get-SITelemetryInstallEndpoints {
|    <# This install's links from the run's globals (never throws; an empty list when nothing is known):
|       $global:SI_InstallEndpoints (the updater, this run) > $global:SI_InstallRingFacts.Endpoints (the recorded row) and
|       $global:SIWeb_PublicBaseUrl (the web app's address setting). #>
|    try {
|        $hosting = @()
|        if ($global:SI_InstallEndpoints) { $hosting = @($global:SI_InstallEndpoints) }
|        elseif ($global:SI_InstallRingFacts -and $global:SI_InstallRingFacts.PSObject.Properties['Endpoints']) {
|            $hosting = @(ConvertFrom-SIInstallEndpointsValue ([string]$global:SI_InstallRingFacts.Endpoints))
|        }
|        Resolve-SITelemetryEndpoints -Hosting $hosting -PublicBaseUrl ([string]$global:SIWeb_PublicBaseUrl)
|    } catch { }
|}
|
|function Save-SIInstallEndpointsRow {
|    <# The install's links into cfg.InstallState 'Endpoints' (the updater, after it read the Container Apps). Nothing to
|       write (an empty list) leaves the row as it is. Never throws: $true written, $false not. #>
|    param([Parameter(Mandatory)]$Store, [AllowNull()][object[]]$Endpoints, [string]$By = 'caj-si-updater')
|    $v = ConvertTo-SIInstallEndpointsValue -Endpoints $Endpoints
|    if (-not $v) { return $false }
|    $sql = @'
|IF OBJECT_ID('cfg.InstallState') IS NOT NULL
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N'Endpoints')
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'Endpoints' AND Value <> @Value;
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'Endpoints', @Value, NULL, @By);
|    COMMIT;
|END
|'@
|    try { $null = & $Store.Invoke $sql ([ordered]@{ Value = $v; By = $By }) 'nonquery'; $true } catch { $false }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-UplinkCauses.ps1'] = @{ Sha256 = '25aa44ed7614251cf67e67e28bab4e22ce339e54204adcb1bc6bb51e658add87'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- REPORT-FAILURE CAUSES, CAPABILITIES AND LICENCES IN THE UPLINK (#709; framework DOCS/REQUIREMENTS.md
|    8.16 UPLINK-CAUSES, the contract -- this file is SecurityInsight's own probe, catalogue and mapping).
|
|    WHAT IT BUILDS (pure builders; the sender, SI-TelemetrySend.ps1, puts them on the records):
|      run record  `Reports` -- at most 20 items, the most severe first, ONLY for reports that failed, were not applicable or
|                  deviated. Every item carries Report (an id, never a title), Code (si-<area>-<nnnn>, from
|                  data-model/errors.locked.json), CauseClass (the closed list), MissingName / MissingLicence / Bucket,
|                  FixedIn + Action (from the catalogue), the context numbers (RunMs, Rows, LastGoodRunMs, LastGoodRows,
|                  SourceCount, Buckets, Retries {429, 502, 504}, QueryHash, QueryChanged, Region, StartedUtc) and -- on an
|                  IDENTIFIED record only -- Detail: the engine's first error line, through SecurityInsight's secret scrub, at
|                  most 500 characters. A value that is not known is null, never guessed.
|      heartbeat   `Capabilities` (the closed keys, booleans -- a key that could not be measured is LEFT OUT, never sent as
|                  false by guess), `CiColumns` (the optional SI_CI_CL columns present, at most 40 ids) and `Licences` (the
|                  tenant's SKU part numbers from Graph subscribedSkus -- only when the run's identity may read them; no
|                  permission is ever added for it).
|
|    THE RULES:
|      * A Reports problem never costs the run record: ConvertTo-SIUplinkReports never throws (an item it cannot map gets
|        the generic code of its class; an item it cannot build at all is left out; nothing at all = no Reports), and the
|        sender sends the record again WITHOUT the optional fields when Invardia refuses it (Send-SITelemetryRecordWithFallback).
|      * Code and CauseClass are ALWAYS on an item (Invardia refuses the whole record, 422, for an item without them).
|      * Detail never carries a secret: SecurityInsight's own scrub (ConvertTo-SITelemetryErrorText) and the framework's
|        (ConvertTo-AitUplinkRedacted), then any long token-shaped run is cut; a Detail that still looks like a secret is
|        dropped (Invardia refuses the whole record for one).
|      * Ids: lower case, letters, digits and dashes, at most 60 (`Identity_SPN_OwnerMismatch` -> `identity-spn-ownermismatch`,
|        `si_cmdb_id` -> `si-cmdb-id`).
|
|    PS 5.1 and 7. Nothing here touches the network except the probe readers (Get-SICapabilityProbe's defaults), which a
|    test session never calls.
|#>
|
|function Get-SIUplinkCausesState {
|    <# The value of $script:SIUplinkCauses, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIUplinkCauses) { $script:SIUplinkCauses = @{
|    CauseClasses   = @('no-data-source', 'missing-column', 'query-defect', 'platform-timeout', 'too-large', 'count-more', 'count-less',
|                       'settings-unreachable', 'permission', 'missing-licence', 'out-of-memory', 'held-last-good', 'held-too-long')
|    Actions        = @('none', 'fixed-in', 'support', 'customer')
|    # most severe first: a run that could not read its settings, rows that are missing, SecurityInsight's own defects, a
|    # permission, the platform; then what does not apply (licence, data source) and last a count that was only higher
|    # #711: out of memory is SecurityInsight's own defect (the run held more than it needed) -- ranked with the query defects
|    # #902: a hold held too long ranks with the missing rows (count-less), a hold that is information only comes last
|    Severity       = @{ 'settings-unreachable' = 1; 'count-less' = 2; 'held-too-long' = 2; 'out-of-memory' = 3; 'query-defect' = 4; 'permission' = 5; 'platform-timeout' = 6
|                        'too-large' = 7; 'missing-column' = 8; 'missing-licence' = 9; 'no-data-source' = 10; 'count-more' = 11; 'held-last-good' = 12 }
|    MaxReports     = 20
|    DetailMax      = 500
|    IdMax          = 60
|    CodePattern    = '^si-[a-z]{2,8}-\d{4}$'
|    DocsBase       = 'https://invardia.com/docs/si/errors/'
|    CapabilityKeys = @('defenderXdr', 'defenderVulnMgmt', 'mdi', 'intune', 'entraP2Pim', 'cmdb', 'sentinel', 'dataLake')
|    MaxCiColumns   = 40
|    MaxLicences    = 40
|    # the SI_CI_CL columns that exist only where their source does (a CMDB, ServiceNow) -- the CMDB-less install lesson
|    OptionalCiColumnPattern = '^si_(cmdb|servicenow|snow)_[a-z0-9_]+$'
|    # service plans that say what a report needs (Graph subscribedSkus servicePlans[].servicePlanName)
|    PlanCapabilities = @{ 'INTUNE_A' = 'intune'; 'AAD_PREMIUM_P2' = 'entraP2Pim'; 'TVM_PREMIUM_1' = 'defenderVulnMgmt' }
|    # the generic code of each class: an unknown failure gets it until it is given its own (framework 8.16)
|    GenericCodes   = @{ 'no-data-source' = 'si-ra-0901'; 'missing-column' = 'si-ra-0902'; 'query-defect' = 'si-ra-0903'; 'platform-timeout' = 'si-ra-0904'
|                        'too-large' = 'si-ra-0905'; 'count-more' = 'si-ra-0906'; 'count-less' = 'si-ra-0907'; 'settings-unreachable' = 'si-ra-0908'
|                        'permission' = 'si-ra-0909'; 'missing-licence' = 'si-ra-0910'
|                        # #711: a report that ran Risk Analysis out of memory has its own code from the start (support, a ticket)
|                        'out-of-memory' = 'si-ra-0303'
|                        # #902: a hold's code always comes from the hold list (data-model/hold-kinds.locked.json); these are only
|                        # the classes' generic codes for the catalogue's rule "every class has one"
|                        'held-last-good' = 'si-ra-0911'; 'held-too-long' = 'si-ra-0913' }
|    # a failure whose cause is not recognised at all (the support worker escalates these for a human)
|    UnknownCode    = 'si-ra-0900'
|    # =================================================================================================================
|    # #902 THE HOLD CONTRACT WITH INVARDIA (framework 8.16 on main) -- every name of it is HERE, so a rename is one edit.
|    #   a report held ON PURPOSE (it keeps its last complete result, nothing of it closes) is an item of class
|    #   HoldClassInfo (information only at Invardia: no alert, no fix request); the same report held
|    #   escalateAfterDetailedRuns Detailed runs in a row is an item of class HoldClassEscalated (a normal failure at Invardia:
|    #   run alert, fix request, ticket). Both carry the HoldFields: Held (true), KeptAgeHours (whole hours from the kept
|    #   result's collection time to this run's; null = none), HeldRuns (runs of this grain in a row, this one included).
|    HoldClassInfo      = 'held-last-good'
|    HoldClassEscalated = 'held-too-long'
|    HoldFieldHeld      = 'Held'
|    HoldFieldAge       = 'KeptAgeHours'
|    HoldFieldRuns      = 'HeldRuns'
|    # REMOVE-ME (#902): Invardia's validator refuses an unknown item field (422 on Reports.Held) until its version is live.
|    # Until then the two classes and the three fields are NOT sent: an information hold is left OUT of Reports[], an
|    # escalated hold goes as a normal failure -- its escalation code, class HoldOffEscalatedClass, without the fields.
|    # Switch: setting SI_Uplink_SendHoldFields (job variable SI_UPLINK_SENDHOLDFIELDS): on / off / a ring list / auto =
|    # the rings in HoldFieldsRings -- confirmed for NO ring yet. When Invardia's version is live on every ring: send always,
|    # drop the switch, HoldFieldsRings and HoldOffEscalatedClass.
|    HoldFieldsSwitch      = 'SI_Uplink_SendHoldFields'
|    # Invardia's validator takes them since 1.0.592 (716b371, 2026-10-26): RING 0 FIRST (internal), the other rings once
|    # Invardia has checked internal's first held item on its environment page
|    HoldFieldsRings       = @(0)
|    HoldOffEscalatedClass = 'count-less'
|} }
|    , $script:SIUplinkCauses
|}
|$script:SIUplinkCauses = $null; $null = Get-SIUplinkCausesState
|
|# #902: the one list of hold kinds (the code of each hold)
|if (-not (Get-Command -Name Get-SIHoldKindCode -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-HoldKinds.ps1')) }
|
|function Get-SIUplinkCausesContract { (Get-SIUplinkCausesState) }
|
|function Resolve-SIUplinkHoldFieldsSwitch {
|    <#
|        PURE (with -Value / -EnvValue). REMOVE-ME (#902): do the hold classes and fields go out from this install?
|        SI_Uplink_SendHoldFields (setting) > SI_UPLINK_SENDHOLDFIELDS (job variable) > auto (the rings in HoldFieldsRings --
|        none yet). on / true / yes = on; off / false / no = off; a ring list ("0", "0,1") = on for those rings. -Ring not
|        known = off unless 'on'. @{ On; Setting; Reason } (the same rule as Resolve-SIUplinkFieldSwitch).
|    #>
|    param([AllowNull()]$Ring, $Value = '__read__', $EnvValue = '__read__', [int[]]$ConfirmedRings = @((Get-SIUplinkCausesState).HoldFieldsRings))
|    $name = [string](Get-SIUplinkCausesState).HoldFieldsSwitch
|    if ("$Value" -eq '__read__') { $Value = Get-Variable -Name $name -Scope Global -ValueOnly -ErrorAction SilentlyContinue }
|    if ("$EnvValue" -eq '__read__') { $EnvValue = [Environment]::GetEnvironmentVariable($name.ToUpperInvariant()) }
|    $rn = -1
|    if ($null -ne $Ring -and "$Ring".Trim() -ne '') { if (-not [int]::TryParse("$Ring", [ref]$rn)) { $rn = -1 } }
|    $set = ''
|    foreach ($v in @($Value, $EnvValue)) {
|        if ($null -eq $v) { continue }
|        if ($v -is [bool]) { $set = $(if ($v) { 'on' } else { 'off' }); break }
|        $s = ([string]$v).Trim().Trim('$').ToLowerInvariant()
|        if (-not $s) { continue }
|        $set = $s; break
|    }
|    if ($set -in @('on', 'true', 'yes', 'enabled')) { return [pscustomobject]@{ On = $true; Setting = 'on'; Reason = "$name is on" } }
|    if ($set -in @('off', 'false', 'no', 'disabled')) { return [pscustomobject]@{ On = $false; Setting = 'off'; Reason = "$name is off" } }
|    if ($set -match '^(ring\s*)?[0-3](\s*[,;]\s*(ring\s*)?[0-3])*$') {
|        $rings = @([regex]::Matches($set, '[0-3]') | ForEach-Object { [int]$_.Value })
|        return [pscustomobject]@{ On = ($rn -ge 0 -and $rings -contains $rn); Setting = 'rings'; Reason = ("$name is on for ring(s) {0}" -f ($rings -join ', ')) }
|    }
|    $on = ($rn -ge 0 -and @($ConfirmedRings) -contains $rn)
|    [pscustomobject]@{ On = $on; Setting = 'auto'; Reason = $(if ($on) { "ring $rn takes the hold fields" } else { 'the hold fields wait until Invardia has confirmed them' }) }
|}
|
|function Get-SIUplinkFactValue {
|    <# PURE. One value of a report fact (a hashtable or an object); $null when it has none. #>
|    param([AllowNull()]$Fact, [string]$Name)
|    if ($null -eq $Fact) { return $null }
|    if ($Fact -is [System.Collections.IDictionary]) { if ($Fact.Contains($Name)) { return $Fact[$Name] } else { return $null } }
|    if ($Fact.PSObject.Properties[$Name]) { return $Fact.$Name }
|    $null
|}
|
|function Test-SIUplinkFactHeld {
|    <# PURE. #902: is the fact a report held ON PURPOSE (a HoldKind of the list)? 'escalated' when it is held too long, 'info'
|       when it is information only, '' when it is not a hold (every other fact -- mapped exactly as before). #>
|    param([AllowNull()]$Fact)
|    $k = [string](Get-SIUplinkFactValue $Fact 'HoldKind')
|    if (-not $k -or -not (Test-SIHoldKind -Kind $k)) { return '' }
|    if ([bool](Get-SIUplinkFactValue $Fact 'Escalated')) { return 'escalated' }
|    'info'
|}
|
|function Add-SIReportCauseHoldFacts {
|    <#
|        PURE. #902: the run's report facts with each held report's hold added (-Held: Split-RAReportFailures .Held -- Report,
|        Kind, Names, HeldRuns, KeptResultAt, Escalated): HoldKind, HoldNames, HeldRuns, Escalated, KeptResultUtc and
|        KeptAgeHours (whole hours from the kept result to -RunUtc, this run's collection time; $null when either is not
|        known). A fact of a report that is not held is returned as it is. Never throws.
|    #>
|    param([AllowNull()][object[]]$Facts, [AllowNull()][object[]]$Held, $RunUtc)
|    $out = New-Object System.Collections.Generic.List[object]
|    try {
|        $byName = @{}
|        foreach ($h in @($Held | Where-Object { $_ -and [string]$_.Report })) { $byName[[string]$h.Report] = $h }
|        foreach ($f in @($Facts | Where-Object { $null -ne $_ })) {
|            $r = [string](Get-SIUplinkFactValue $f 'Report')
|            $h = $byName[$r]
|            if ($null -ne $h -and $f -isnot [System.Collections.IDictionary]) {
|                $kept = $null; if ($h.KeptResultAt) { try { $kept = ([datetime]$h.KeptResultAt).ToUniversalTime() } catch { $kept = $null } }
|                $age = $null
|                if ($null -ne $kept -and $null -ne $RunUtc) { try { $hrs = ([datetime]$RunUtc).ToUniversalTime() - $kept; if ($hrs.TotalHours -ge 0) { $age = [long][Math]::Floor($hrs.TotalHours) } } catch { $age = $null } }
|                foreach ($kv in @(@('HoldKind', [string]$h.Kind), @('HoldNames', [string[]]@($h.Names | Where-Object { $_ })), @('HeldRuns', [int]$(if ($h.HeldRuns) { $h.HeldRuns } else { 1 })),
|                                  @('Escalated', [bool]$h.Escalated), @('KeptResultUtc', $kept), @('KeptAgeHours', $age))) {
|                    Add-Member -InputObject $f -NotePropertyName $kv[0] -NotePropertyValue $kv[1] -Force
|                }
|            }
|            $out.Add($f)
|        }
|    } catch { return @($Facts) }
|    $out.ToArray()
|}
|
|function Write-SIUplinkDiag {
|    param([string]$Line)
|    try { if (Get-Command -Name Write-Diag -ErrorAction SilentlyContinue) { Write-Diag $Line } else { Write-Verbose $Line } } catch { }
|}
|
|function ConvertTo-SIUplinkId {
|    <# PURE. An id for the uplink: lower case, a-z 0-9 and dashes, no leading / trailing / double dash, at most 60. '' = none. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value, [int]$Max = 60)
|    $v = ("$Value".Trim().ToLowerInvariant() -replace '[^a-z0-9]+', '-').Trim('-')
|    if ($v.Length -gt $Max) { $v = $v.Substring(0, $Max).TrimEnd('-') }
|    $v
|}
|
|function Get-SIErrorCatalogue {
|    <# The error catalogue (data-model/errors.locked.json), read once per process. -Path is the test seam. @() when it cannot
|       be read -- every mapping then falls back to the generic codes, which are known here too. #>
|    param([string]$Path)
|    if (-not $Path -and $null -ne $script:SIErrorCatalogueCache) { return $script:SIErrorCatalogueCache }
|    $p = $Path
|    if (-not $p) { $p = [System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'data-model', 'errors.locked.json') }
|    $out = @()
|    try { $out = @([System.IO.File]::ReadAllText($p).TrimStart([char]0xFEFF) | ConvertFrom-Json -ErrorAction Stop) } catch { $out = @() }
|    if (-not $Path) { $script:SIErrorCatalogueCache = $out }
|    # emitted item by item (a ', $out' would reach a caller's @() as ONE nested array)
|    $out
|}
|
|function Get-SIErrorCodeUrl {
|    <# PURE. The public page of an error code: https://invardia.com/docs/si/errors/<code>/ -- '' for a value that is not a code. #>
|    param([AllowNull()][AllowEmptyString()][string]$Code)
|    $c = "$Code".Trim().ToLowerInvariant()
|    if ($c -notmatch (Get-SIUplinkCausesState).CodePattern) { return '' }
|    (Get-SIUplinkCausesState).DocsBase + $c + '/'
|}
|
|function Get-SIReportCause {
|    <#
|        PURE. The cause of ONE report that failed, did not apply or deviated, from what the engine knows: -State (Failed |
|        NotComplete | NotApplicable | Deviated) and -Text (the engine's own reason / error). Returns @{ CauseClass;
|        MissingName } -- CauseClass is ALWAYS a value of the closed list; MissingName the missing table / column / keyword as an
|        id, else ''. Recognised = Known $true; a text no rule recognises = Known $false (the caller gives it si-ra-0900).
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$State, [AllowEmptyString()][AllowNull()][string]$Text)
|    $t = [string]$Text
|    $r = { param($c, $n, $k = $true) [pscustomobject]@{ CauseClass = $c; MissingName = (ConvertTo-SIUplinkId $n); Known = [bool]$k } }
|    # ---- the settings database ------------------------------------------------------------------------------------------
|    if ($t -match '(?i)SQL error 40\b|error: 40 -|settings database (cannot|could not) be reached|could not reach (its|the) (own )?settings database|settings database is not reachable') { return (& $r 'settings-unreachable' '') }
|    # ---- #711: the process ran out of memory (before the other rules: its text can carry any other words) ------------------
|    if ($t -match '(?i)OutOfMemoryException|\bOOMKilled\b|\bout of memory\b|\bsi-ra-0303\b') { return (& $r 'out-of-memory' '') }
|    # ---- a data source / licence this tenant does not have ---------------------------------------------------------------
|    if ($t -match "(?i)Failed to resolve (?:table or column )?expression named '(DeviceTvm[A-Za-z]+)'") { return (& $r 'missing-licence' $Matches[1]) }
|    if ($t -match '(?i)Account is not provisioned|advanced hunting is not provisioned') { return (& $r 'no-data-source' 'defender-xdr') }
|    if ($t -match "(?i)Failed to resolve (?:table or column )?expression named '(SI_[A-Za-z0-9_]+_CL)'") { return (& $r 'no-data-source' $Matches[1]) }
|    if ($t -match "(?i)Failed to resolve (?:table or column )?expression named '((?:Device|Identity|Email|Cloud|Alert|Url|Exposure|Aad|Behavior)[A-Za-z]+)'") { return (& $r 'no-data-source' $Matches[1]) }
|    # ---- a column that is not there (an optional CI column at an install without its source) -----------------------------
|    if ($t -match "(?i)Failed to resolve scalar expression named '([^']+)'") { return (& $r 'missing-column' $Matches[1]) }
|    if ($t -match "(?i)Failed to resolve (?:table or column )?expression named '([^']+)'") { return (& $r 'missing-column' $Matches[1]) }
|    if ("$State" -eq 'NotApplicable') { return (& $r 'no-data-source' '') }
|    # ---- the count against the source --------------------------------------------------------------------------------------
|    if ($t -match '(?i)more than the source''s count') { return (& $r 'count-more' '') }
|    if ($t -match '(?i)the source holds (\d+) row\(s\)[^|]*retrieved (\d+)') {
|        if ([long]$Matches[2] -gt [long]$Matches[1]) { return (& $r 'count-more' '') }
|        return (& $r 'count-less' '')
|    }
|    if ($t -match '(?i)neither stored nor accounted for|far fewer findings|fewer (rows|findings) than|lost (a )?bucket|could not be read \(a query that timed out') { return (& $r 'count-less' '') }
|    # ---- too large ------------------------------------------------------------------------------------------------------
|    if ($t -match '(?i)413 Request Entity Too Large|Query body (EXCEEDED|is being tuned)|request body .*too large') { return (& $r 'too-large' 'query-body') }
|    if ($t -match '(?i)502 Bad Gateway|exceeded the allowed (result size|limits)|its row limit|OutOfMemory|out of memory|too large') { return (& $r 'too-large' '') }
|    # ---- SecurityInsight's own query -------------------------------------------------------------------------------------
|    if ($t -match '(?i)\bSYN0002\b') { return (& $r 'query-defect' 'syn0002') }
|    # ---- everything else through the run classifier ----------------------------------------------------------------------
|    $cls = 'unknown'
|    try { if (Get-Command -Name Get-SIErrorClass -ErrorAction SilentlyContinue) { $cls = Get-SIErrorClass -Message $t } } catch { $cls = 'unknown' }
|    switch -Regex ($cls) {
|        '^(graph-401|graph-403|defender-403|arm-403|kv-403|storage-403)$' { return (& $r 'permission' '') }
|        '^licence-invalid$' { return (& $r 'missing-licence' '') }
|        '^(sql-login|settings-error)$' { return (& $r 'settings-unreachable' '') }
|        '^table-missing$' { return (& $r 'no-data-source' '') }
|        '^kql-query-defect$' { return (& $r 'query-defect' '') }
|        # 3.0.30: a temporary Azure SQL answer that outlasted the statement's own retry (SI-SqlRetry.ps1) is the platform's
|        '^(platform-timeout|platform-5xx|throttled|mi-unavailable|transient-sql)$' { return (& $r 'platform-timeout' '') }
|        # 3.0.30: a FULL database is its own cause -- the closed class too-large with MissingName 'database', code si-data-1404
|        # (the catalogue's "The database is full", the same code the data sync sends; Resolve-SIReportCauseCode). Before, it fell
|        # through to the unknown si-ra-0900 and support was asked to find a cause that was already known.
|        '^database-full$' { return (& $r 'too-large' 'database') }
|        '^ingest-' { return (& $r 'count-less' '') }
|    }
|    # not recognised: a product defect until it is given its own code (framework 8.16: a failure without a cause is a defect)
|    & $r 'query-defect' '' $false
|}
|
|function Resolve-SIReportCauseCode {
|    <#
|        PURE. The stable code of a cause: the catalogue's own code when one fits (si-ra-0101 DeviceTvm* absent, si-ra-0102 a
|        missing optional CI column, si-ra-0103 a KQL reserved word, si-ra-0201 more rows than the count, si-ra-0302 the report
|        query too large, si-ra-0303 Risk Analysis out of memory (its generic code), si-set-0401 the settings database, si-data-1404 the
|        database is full -- too-large with MissingName 'database'), else the GENERIC code of its class, else -- a cause nothing
|        recognised -- si-ra-0900. NEVER throws, never returns ''.
|    #>
|    param([Parameter(Mandatory)]$Cause)
|    try {
|        $cc = [string]$Cause.CauseClass; $mn = [string]$Cause.MissingName
|        if ($Cause.PSObject.Properties['Known'] -and -not $Cause.Known) { return (Get-SIUplinkCausesState).UnknownCode }
|        switch ($cc) {
|            'missing-licence'      { if ($mn -like 'devicetvm*') { return 'si-ra-0101' } }
|            'no-data-source'       { if ($mn -like 'devicetvm*') { return 'si-ra-0101' } }
|            'missing-column'       { if ($mn -match ('^' + ((Get-SIUplinkCausesState).OptionalCiColumnPattern.Trim('^', '$') -replace '_', '-') + '$')) { return 'si-ra-0102' } }
|            'query-defect'         { if ($mn -eq 'syn0002') { return 'si-ra-0103' } }
|            'count-more'           { return 'si-ra-0201' }
|            'too-large'            { if ($mn -eq 'query-body') { return 'si-ra-0302' }; if ($mn -eq 'database') { return 'si-data-1404' } }
|            'settings-unreachable' { return 'si-set-0401' }
|        }
|        $g = (Get-SIUplinkCausesState).GenericCodes[$cc]
|        if ($g) { return $g }
|    } catch { }
|    (Get-SIUplinkCausesState).UnknownCode
|}
|
|function ConvertTo-SIUplinkDetail {
|    <#
|        PURE. The bounded free text of one item (framework 8.16 Detail): the FIRST line of the engine's error, through
|        SecurityInsight's secret scrub (ConvertTo-SITelemetryErrorText) and the framework's (ConvertTo-AitUplinkRedacted),
|        every long token-shaped run cut, at most 500 characters. $null when there is no text, or when what is left still
|        looks like a secret (Invardia refuses the whole record for one -- the record matters more than the Detail).
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    try {
|        $line = @("$Text" -split "`r?`n" | ForEach-Object { $_.Trim() } | Where-Object { $_ }) | Select-Object -First 1
|        if (-not $line) { return $null }
|        if (Get-Command -Name ConvertTo-SITelemetryErrorText -ErrorAction SilentlyContinue) { $line = ConvertTo-SITelemetryErrorText $line }
|        if (Get-Command -Name ConvertTo-AitUplinkRedacted -ErrorAction SilentlyContinue) { $line = ConvertTo-AitUplinkRedacted -Text $line }
|        # connection strings and SAS-style keys the two scrubs do not name
|        $line = [regex]::Replace($line, '(?i)\b(Server|Data Source|User ID|Uid|Initial Catalog)\s*=\s*[^;]+;', '$1=[redacted];')
|        $line = [regex]::Replace($line, '(?i)\b(token|key|credential|secret)\s*[=:]\s*\S+', '$1=[redacted]')
|        # a long run of token characters with letters AND digits (a key, a token, a hash) is cut whatever it is
|        $line = [regex]::Replace($line, '[A-Za-z0-9+/_=\-]{32,}', { param($m) if ($m.Value -match '[A-Za-z]' -and $m.Value -match '\d') { '[redacted]' } else { $m.Value } })
|        if ($line.Length -gt (Get-SIUplinkCausesState).DetailMax) { $line = $line.Substring(0, (Get-SIUplinkCausesState).DetailMax) }
|        if (Test-SIUplinkLooksSecret $line) { return $null }
|        return $line
|    } catch { return $null }
|}
|
|function Test-SIUplinkLooksSecret {
|    <# PURE. Does a text still look like it carries a secret (the shapes Invardia's check refuses)? #>
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    $t = "$Text"
|    if (-not $t) { return $false }
|    if ($t -match 'eyJ[A-Za-z0-9_-]{8,}\.') { return $true }
|    if ($t -match '-----BEGIN ') { return $true }
|    if ($t -match '(?i)\b(password|pwd|client_secret|accountkey|sharedaccesskey|apikey|api_key)\s*[=:]\s*(?!\[redacted\])\S') { return $true }
|    if ($t -match '(?i)[?&]sig=(?!\[redacted\])') { return $true }
|    if ($t -match 'inv-[A-Za-z0-9_-]{20,}') { return $true }
|    $false
|}
|
|function Compare-SIUplinkVersion {
|    <# PURE. -1 / 0 / 1 for two dotted versions (each part a whole number -- 3.0.0.202610151821 has a part too large for
|       [version]); $null when either cannot be read. Only the leading dotted digits count ('3.0.0.2026...+abc' reads). #>
|    param([AllowNull()][AllowEmptyString()][string]$A, [AllowNull()][AllowEmptyString()][string]$B)
|    $pa = if ("$A" -match '^\s*(\d+(?:\.\d+)*)') { @($Matches[1] -split '\.') } else { return $null }
|    $pb = if ("$B" -match '^\s*(\d+(?:\.\d+)*)') { @($Matches[1] -split '\.') } else { return $null }
|    $n = [Math]::Max($pa.Count, $pb.Count)
|    for ($i = 0; $i -lt $n; $i++) {
|        $x = if ($i -lt $pa.Count) { [decimal]$pa[$i] } else { [decimal]0 }
|        $y = if ($i -lt $pb.Count) { [decimal]$pb[$i] } else { [decimal]0 }
|        if ($x -lt $y) { return -1 }
|        if ($x -gt $y) { return 1 }
|    }
|    0
|}
|
|function Get-SIUplinkCatalogueAction {
|    <# PURE. Action + FixedIn of a code for THIS version: the catalogue's; a 'fixed-in' whose fix this version already has
|       (the cause came back) is 'support' with no FixedIn -- never a promise the release already broke. #>
|    param([AllowNull()]$Entry, [AllowEmptyString()][string]$Version)
|    $act = 'support'; $fix = $null
|    if ($Entry) {
|        $a = "$($Entry.action)".Trim().ToLowerInvariant(); if ((Get-SIUplinkCausesState).Actions -contains $a) { $act = $a }
|        if ("$($Entry.fixedIn)".Trim()) { $fix = "$($Entry.fixedIn)".Trim() }
|    }
|    if ($act -eq 'fixed-in') {
|        $cmp = Compare-SIUplinkVersion -A $Version -B $fix
|        if (-not $fix -or ($null -ne $cmp -and $cmp -ge 0)) { $act = 'support'; $fix = $null }
|    } elseif ($act -ne 'none') { $fix = $null }   # 'none' keeps the version since which the report is simply not applicable
|    [pscustomobject]@{ Action = $act; FixedIn = $fix }
|}
|
|function ConvertTo-SIUplinkNumber {
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or "$Value".Trim() -eq '') { return $null }
|    $d = 0.0
|    if (-not [double]::TryParse("$Value", [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $null }
|    if ($d -lt 0 -or [double]::IsNaN($d) -or [double]::IsInfinity($d)) { return $null }
|    [long][Math]::Floor($d)
|}
|
|function ConvertTo-SIUplinkReports {
|    <#
|        PURE. The run record's `Reports` from the run's report facts (-Facts: what Risk Analysis put on its run context as
|        ReportCauses -- Report, State, Why, StartedUtc, RunMs, Rows, SourceCount, Buckets, QueryHash, Retries, LastGoodRows,
|        LastGoodRunMs, LastGoodQueryHash, Bucket). -Identified adds Detail (anonymous: no text ever leaves). -Version decides
|        Action / FixedIn; -Region the install's Azure region; -Catalogue the error catalogue (default the shipped one).
|        At most 20 items, the most severe first. NEVER throws: an item that cannot be built is left out, nothing = @().
|        #902: a fact of a report held ON PURPOSE (HoldKind of the list, Add-SIReportCauseHoldFacts) is never mapped by its
|        text: its code is the hold list's (the escalation code once Escalated). With -HoldFields (the hold contract is live
|        for this install, Resolve-SIUplinkHoldFieldsSwitch) it is class held-last-good / held-too-long with Held, KeptAgeHours
|        and HeldRuns; without it an information hold is left OUT and an escalated hold goes as a normal failure (its code,
|        class count-less, no hold fields). An information hold sorts after every real failure. Every other fact: as before.
|    #>
|    param([AllowNull()][object[]]$Facts, [switch]$Identified, [AllowEmptyString()][string]$Version, [AllowEmptyString()][string]$Region,
|          [AllowNull()][object[]]$Catalogue, [switch]$HoldFields)
|    $items = New-Object System.Collections.Generic.List[object]
|    try {
|        if ($null -eq $Facts -or @($Facts).Count -eq 0) { return @() }
|        $cat = if ($PSBoundParameters.ContainsKey('Catalogue')) { @($Catalogue) } else { @(Get-SIErrorCatalogue) }
|        $byCode = @{}; foreach ($e in $cat) { if ($e -and "$($e.code)".Trim()) { $byCode["$($e.code)".Trim().ToLowerInvariant()] = $e } }
|        $reg = ConvertTo-SIUplinkId $Region
|        $seen = @{}
|        foreach ($f in @($Facts)) {
|            try {
|                if ($null -eq $f) { continue }
|                $get = { param($n) if ($f -is [System.Collections.IDictionary]) { if ($f.Contains($n)) { $f[$n] } else { $null } } elseif ($f.PSObject.Properties[$n]) { $f.$n } else { $null } }
|                $rid = ConvertTo-SIUplinkId ([string](& $get 'Report'))
|                if (-not $rid -or $seen.ContainsKey($rid)) { continue }
|                $state = [string](& $get 'State'); $why = [string](& $get 'Why')
|                $hold = Test-SIUplinkFactHeld -Fact $f
|                $cause = $null
|                if ($hold) {
|                    # #902: a report held ON PURPOSE -- its code from the hold list, never from its text (never si-ra-0900)
|                    if ($hold -eq 'info' -and -not $HoldFields) { continue }   # information only: left out until Invardia takes the class
|                    $hn = @(& $get 'HoldNames' | Where-Object { "$_".Trim() })
|                    $hc = $(if ($hold -eq 'escalated') { $(if ($HoldFields) { [string](Get-SIUplinkCausesState).HoldClassEscalated } else { [string](Get-SIUplinkCausesState).HoldOffEscalatedClass }) } else { [string](Get-SIUplinkCausesState).HoldClassInfo })
|                    $cause = [pscustomobject]@{ CauseClass = $hc; MissingName = $(if ($hn.Count) { ConvertTo-SIUplinkId ([string]$hn[0]) } else { '' }); Known = $true }
|                    $code = Get-SIHoldKindCode -Kind ([string](& $get 'HoldKind')) -Escalated:($hold -eq 'escalated')
|                } else {
|                try { $cause = Get-SIReportCause -State $state -Text $why } catch { $cause = $null }
|                if ($null -eq $cause -or (Get-SIUplinkCausesState).CauseClasses -notcontains [string]$cause.CauseClass) { $cause = [pscustomobject]@{ CauseClass = 'query-defect'; MissingName = ''; Known = $false } }
|                # a COMPLETE report with more rows than the source counted (nothing is missing) is not a report problem at
|                # all: it is never put in Reports -- Invardia made even an Action = none item a fix request (telemetry
|                # si-ra-0201). It stays visible as a note (Get-SIUplinkReportNotes: the run's own log and run record).
|                if ($state -eq 'Complete' -and [string]$cause.CauseClass -eq 'count-more') { continue }
|                $code = Resolve-SIReportCauseCode -Cause $cause
|                }
|                if ($code -notmatch (Get-SIUplinkCausesState).CodePattern) { $code = (Get-SIUplinkCausesState).UnknownCode }
|                $act = Get-SIUplinkCatalogueAction -Entry $byCode[$code] -Version $Version
|                $qh =ConvertTo-SIUplinkId ([string](& $get 'QueryHash')) -Max 16
|                $lgq = ConvertTo-SIUplinkId ([string](& $get 'LastGoodQueryHash')) -Max 16
|                $ret = & $get 'Retries'
|                $rv = [ordered]@{ '429' = 0L; '502' = 0L; '504' = 0L }
|                if ($ret) { foreach ($k in @('429', '502', '504')) { $x = $null; if ($ret -is [System.Collections.IDictionary]) { if ($ret.Contains($k)) { $x = $ret[$k] } } elseif ($ret.PSObject.Properties[$k]) { $x = $ret.$k }; $n = ConvertTo-SIUplinkNumber $x; if ($null -ne $n) { $rv[$k] = $n } } }
|                $st = & $get 'StartedUtc'; $stText = $null
|                if ($st) { try { $stText = ([datetime]$st).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture) } catch { $stText = $null } }
|                $bk = ConvertTo-SIUplinkId ([string](& $get 'Bucket'))
|                $it = [ordered]@{
|                    Report         = $rid
|                    Code           = $code
|                    CauseClass     = [string]$cause.CauseClass
|                    MissingName    = $(if ($cause.MissingName) { [string]$cause.MissingName } else { $null })
|                    MissingLicence = $null
|                    Bucket         = $(if ($bk) { $bk } else { $null })
|                    FixedIn        = $act.FixedIn
|                    Action         = $act.Action
|                    RunMs          = (ConvertTo-SIUplinkNumber (& $get 'RunMs'))
|                    Rows           = (ConvertTo-SIUplinkNumber (& $get 'Rows'))
|                    LastGoodRunMs  = (ConvertTo-SIUplinkNumber (& $get 'LastGoodRunMs'))
|                    LastGoodRows   = (ConvertTo-SIUplinkNumber (& $get 'LastGoodRows'))
|                    SourceCount    = (ConvertTo-SIUplinkNumber (& $get 'SourceCount'))
|                    Buckets        = (ConvertTo-SIUplinkNumber (& $get 'Buckets'))
|                    Retries        = [pscustomobject]$rv
|                    QueryHash      = $(if ($qh) { $qh } else { $null })
|                    QueryChanged   = $(if ($qh -and $lgq) { [bool]($qh -ne $lgq) } else { $null })
|                    Region         = $(if ($reg) { $reg } else { $null })
|                    StartedUtc     = $stText
|                }
|                if ($hold -and $HoldFields) {
|                    # #902: the hold contract's three fields (names in $script:SIUplinkCauses, one place)
|                    $it[[string](Get-SIUplinkCausesState).HoldFieldHeld] = $true
|                    $it[[string](Get-SIUplinkCausesState).HoldFieldAge] = (ConvertTo-SIUplinkNumber (& $get 'KeptAgeHours'))
|                    $hr = ConvertTo-SIUplinkNumber (& $get 'HeldRuns'); if ($null -eq $hr -or $hr -lt 1) { $hr = 1L }
|                    $it[[string](Get-SIUplinkCausesState).HoldFieldRuns] = $hr
|                }
|                # #709: the cause in plain words FIRST ("<report>, <step>: <why>."), then the engine's own first error line
|                if ($Identified) {
|                    if ($hold) { $it.Detail = Join-SIUplinkCauseDetail -Sentence (Get-SIHoldCauseSentence -Fact $f) -Raw '' } else { $it.Detail = Join-SIUplinkCauseDetail -Sentence (Get-SIReportCauseSentence -Fact $f -Cause $cause) -Raw (ConvertTo-SIUplinkDetail $why) }
|                }
|                $seen[$rid] = $true
|                # #902: an information hold sorts after every real failure (it never pushes a real item out of the 20)
|                $failed = [int]($state -in @('Failed', 'NotComplete')); if ($hold -eq 'info') { $failed = 0 }
|                $items.Add([pscustomobject]@{ Sev = [int](Get-SIUplinkCausesState).Severity[[string]$cause.CauseClass]; Failed = $failed; Item = [pscustomobject]$it })
|            } catch { continue }
|        }
|        # most severe first (a failure before a not-applicable report), then the report id -- the same order every run
|        $sorted = @($items | Sort-Object -Property @{ Expression = { $_.Failed }; Descending = $true }, @{ Expression = { $_.Sev } }, @{ Expression = { $_.Item.Report } })
|        $out = @($sorted | Select-Object -First (Get-SIUplinkCausesState).MaxReports | ForEach-Object { $_.Item })
|        return $out
|    } catch { return @() }
|}
|
|function ConvertTo-SIUplinkFailureItem {
|    <#
|        PURE. SUP-2026-00198 (2026-10-19): ONE Reports[] item for a failure OUTSIDE a Risk Analysis report -- the updater's
|        roll / restore -- whose catalogue code the caller KNOWS (-Code, e.g. si-upd-0803). The item has the shape of a report
|        item (ConvertTo-SIUplinkReports): Report = '<job>-<step>' (an id, e.g. updater-roll), Code, CauseClass and
|        FixedIn / Action from the catalogue entry, the context numbers null (not known, never guessed), Detail (-Text,
|        scrubbed, at most 500) on an IDENTIFIED record only. @() for a code that is not in the catalogue -- an item never
|        carries a code Invardia cannot look up. NEVER throws.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Code, [AllowEmptyString()][string]$Job = 'updater', [AllowEmptyString()][string]$Step = '',
|          [AllowEmptyString()][string]$Text = '', [switch]$Identified, [AllowEmptyString()][string]$Version, [AllowEmptyString()][string]$Region,
|          [AllowNull()][object[]]$Catalogue)
|    try {
|        $c = "$Code".Trim().ToLowerInvariant()
|        if ($c -notmatch (Get-SIUplinkCausesState).CodePattern) { return @() }
|        $cat = if ($PSBoundParameters.ContainsKey('Catalogue')) { @($Catalogue) } else { @(Get-SIErrorCatalogue) }
|        $e = @($cat | Where-Object { $_ -and "$($_.code)".Trim().ToLowerInvariant() -eq $c })[0]
|        if (-not $e -or (Get-SIUplinkCausesState).CauseClasses -notcontains [string]$e.causeClass) { return @() }
|        $act = Get-SIUplinkCatalogueAction -Entry $e -Version $Version
|        $rid = ConvertTo-SIUplinkId ((@("$Job".Trim(), "$Step".Trim()) | Where-Object { $_ }) -join '-')
|        if (-not $rid) { $rid = 'updater' }
|        $reg = ConvertTo-SIUplinkId $Region
|        $it = [ordered]@{
|            Report = $rid; Code = $c; CauseClass = [string]$e.causeClass; MissingName = $null; MissingLicence = $null; Bucket = $null
|            FixedIn = $act.FixedIn; Action = $act.Action; RunMs = $null; Rows = $null; LastGoodRunMs = $null; LastGoodRows = $null
|            SourceCount = $null; Buckets = $null; Retries = [pscustomobject][ordered]@{ '429' = 0L; '502' = 0L; '504' = 0L }
|            QueryHash = $null; QueryChanged = $null; Region = $(if ($reg) { $reg } else { $null }); StartedUtc = $null
|        }
|        if ($Identified) { $d = ConvertTo-SIUplinkDetail $Text; if ($d) { $it.Detail = $d } }
|        [pscustomobject]$it
|    } catch { @() }
|}
|
|function Get-SIReportCauseFacts {
|    <#
|        PURE. The facts of every report of a Risk Analysis run that FAILED, is NOT COMPLETE, did NOT APPLY or DEVIATED (more
|        rows than the source's count) -- what ConvertTo-SIUplinkReports maps. From what the run already keeps:
|          -Notes       report -> @{ StartedUtc; EndedUtc; State (NotApplicable | Complete | NotComplete | Unverified); Why; Rows;
|                       SourceCount; Buckets; QueryHash }   (Risk Analysis' $script:RAReportNotes)
|          -Failures    @{ Report; Why } -- Add-RAReportFailure's list
|          -Incomplete  @{ Report; Why } -- the row-count guard's reports
|          -Done        report -> the verdict (Complete | NotComplete | Unverified)
|          -Retries     report -> @{ '429'; '502'; '504' } (Add-SIReportRetryAnswer)
|          -LastGood    report -> @{ Rows; QueryHash } (the report's last complete run, Read-RAStreamLastGood)
|        Returns a list of objects; a report that ran clean is not in it. Never throws.
|    #>
|    param([System.Collections.IDictionary]$Notes, [AllowNull()][object[]]$Failures, [AllowNull()][object[]]$Incomplete,
|          [System.Collections.IDictionary]$Done, [System.Collections.IDictionary]$Retries, [System.Collections.IDictionary]$LastGood)
|    $out = New-Object System.Collections.Generic.List[object]
|    try {
|        $why = { param($list, $n) @(@($list) | Where-Object { $_ -and [string]$_.Report -eq $n } | ForEach-Object { [string]$_.Why }) | Select-Object -First 1 }
|        $names = New-Object System.Collections.Generic.List[string]
|        foreach ($n in @(@($Failures) + @($Incomplete) | Where-Object { $_ } | ForEach-Object { [string]$_.Report })) { if ($n -and -not $names.Contains($n)) { $names.Add($n) } }
|        if ($Notes) { foreach ($n in @($Notes.Keys)) { if (-not $names.Contains([string]$n)) { $names.Add([string]$n) } } }
|        foreach ($n in $names) {
|            $note = if ($Notes -and $Notes.Contains($n)) { $Notes[$n] } else { $null }
|            $nv = { param($k) if ($null -eq $note) { $null } elseif ($note -is [System.Collections.IDictionary]) { if ($note.Contains($k)) { $note[$k] } else { $null } } elseif ($note.PSObject.Properties[$k]) { $note.$k } else { $null } }
|            $state = ''; $text = ''
|            $fw = & $why $Failures $n; $iw = & $why $Incomplete $n
|            $verdict = if ($Done -and $Done.Contains($n)) { [string]$Done[$n] } else { '' }
|            if ($fw) { $state = $(if ($verdict -eq 'NotComplete' -and $fw -match '^not complete: ') { 'NotComplete' } else { 'Failed' }); $text = $fw }
|            elseif ($iw) { $state = 'NotComplete'; $text = $iw }
|            elseif ([string](& $nv 'State') -eq 'NotApplicable') { $state = 'NotApplicable'; $text = [string](& $nv 'Why') }
|            # #814: more rows than the source's count on a COMPLETE report keeps its verdict -- nothing is missing, so it is a
|            # note (Get-SIUplinkReportNotes), never a report item. Labelled Deviated for every report, a Complete Summary's
|            # count-more reached Invardia as si-ra-0201 with Action = support (fix request e394f927, rc13 and later).
|            elseif ([string](& $nv 'Why') -match '(?i)more than the source''s count') {
|                $state = $(if ([string](& $nv 'State') -eq 'Complete' -or $verdict -eq 'Complete') { 'Complete' } else { 'Deviated' }); $text = [string](& $nv 'Why')
|            }
|            else { continue }
|            $runMs = $null
|            try { $s = & $nv 'StartedUtc'; $e = & $nv 'EndedUtc'; if ($s -and $e) { $runMs = [long][Math]::Max(0, (([datetime]$e) - ([datetime]$s)).TotalMilliseconds) } } catch { $runMs = $null }
|            $lg = if ($LastGood -and $LastGood.Contains($n)) { $LastGood[$n] } else { $null }
|            $out.Add([pscustomobject]@{
|                Report = $n; State = $state; Why = $text; StartedUtc = (& $nv 'StartedUtc'); RunMs = $runMs
|                Rows = (& $nv 'Rows'); SourceCount = (& $nv 'SourceCount'); Buckets = (& $nv 'Buckets'); QueryHash = [string](& $nv 'QueryHash')
|                Retries = $(if ($Retries -and $Retries.Contains($n)) { $Retries[$n] } else { $null })
|                LastGoodRows = $(if ($lg) { $lg.Rows } else { $null }); LastGoodRunMs = $null
|                LastGoodQueryHash = $(if ($lg) { [string]$lg.QueryHash } else { '' })
|            })
|        }
|    } catch { }
|    $out.ToArray()
|}
|
|# =====================================================================================================================
|#  #709 -- THE CAUSE IN PLAIN WORDS: which report, which step, and why
|# =====================================================================================================================
|# A class ("kql-query-defect", "report-incomplete") took a session reading logs to explain. Each failed / not complete /
|# not applicable report gets ONE short sentence built from what the engine already wrote (the reason Risk Analysis keeps in
|# sidata.RaReportStatus, the error of a failed query, the retries it counted): "<report>, <step>: <why>". The numbers in
|# it are the report's own (rows, sizes, retries) -- never a secret, never a ticket number. It travels on the fields
|# Invardia already takes: the item's Detail (identified installs; first, before the engine's own first error line) and the
|# run record's ErrorMessage of a run with reports that are not complete (identified). Anonymous installs send no text.
|
|function Get-SIReportCauseStep {
|    <# PURE. The step of the report the text is about, in plain words. #>
|    param([AllowEmptyString()][AllowNull()][string]$State, [AllowEmptyString()][AllowNull()][string]$Text, [AllowEmptyString()][AllowNull()][string]$CauseClass)
|    $t = [string]$Text
|    if ($CauseClass -eq 'settings-unreachable') { return 'reading its settings' }
|    if ($CauseClass -eq 'out-of-memory') { return 'holding its rows in memory' }
|    if ($t -match '(?i)^\s*its query could not be sent') { return 'sending its query to Microsoft Defender' }
|    if ($t -match '(?i)lookup (this report needs|it needs) could not be read|^\s*it was not run: a lookup') { return 'reading a lookup it needs' }
|    if ($t -match '(?i)^\s*it was not run|it is not in this run|not in this worker''s template') { return 'starting the report' }
|    if ($t -match '(?i)could not collect it from its worker') { return 'collecting it from its worker' }
|    if ($t -match '(?i)^\s*its result could not be read') { return 'reading its result' }
|    if ($t -match '(?i)neither stored nor accounted for|\bstored \d+') { return 'storing its rows' }
|    if ($t -match '(?i)quer(y|ies) slice\(s\)|slice\(s\) of the report could not be read|bucket\(s\) could not be read') { return 'reading the parts of its query' }
|    if ($t -match '(?i)the source holds \d+ row\(s\)|more than the source''s count|count the report''s rows') { return 'checking its rows against the source' }
|    if ($CauseClass -in @('count-less', 'count-more')) { return 'checking its rows against the source' }
|    if ($t -match '(?i)^\s*its query failed') { return 'running its query' }
|    if ("$State" -eq 'NotApplicable' -or $CauseClass -in @('no-data-source', 'missing-licence')) { return 'checking its data source' }
|    if ($CauseClass -in @('platform-timeout', 'too-large', 'query-defect', 'missing-column', 'permission')) { return 'running its query' }
|    'running the report'
|}
|
|function Get-SIReportCauseWhy {
|    <# PURE. Why, in plain words, from the cause and the engine's own text (its numbers kept). Never '' -- a text no rule
|       reads says that the cause was not recognised. #>
|    param([AllowEmptyString()][AllowNull()][string]$State, [AllowEmptyString()][AllowNull()][string]$Text, $Cause, $Retries)
|    $t = [string]$Text
|    $cc = if ($Cause) { [string]$Cause.CauseClass } else { '' }
|    $mn = if ($Cause) { [string]$Cause.MissingName } else { '' }
|    $rv = @{ '429' = 0L; '502' = 0L; '504' = 0L }
|    if ($Retries) { foreach ($k in @('429', '502', '504')) { $x = $null; if ($Retries -is [System.Collections.IDictionary]) { if ($Retries.Contains($k)) { $x = $Retries[$k] } } elseif ($Retries.PSObject.Properties[$k]) { $x = $Retries.$k }; $n = ConvertTo-SIUplinkNumber $x; if ($null -ne $n) { $rv[$k] = $n } } }
|    $times = { param($n) if ([long]$n -eq 1) { 'once' } else { '{0} times' -f $n } }
|    # ---- too large: the lookup that has to travel whole, against what one Defender query carries ----------------------------
|    if ($t -match '(?i)the lookups? (?<names>.+?) (is|are) needed whole in every part of the query') {
|        $first = [regex]::Match($Matches['names'], '(?<n>[A-Za-z_][A-Za-z0-9_]*) \((?<r>[\d,\.]+) rows, (?<s>[\d\.]+ (MB|KB|bytes))\)')
|        $cap = [regex]::Match($t, '(?i)can carry \((?<c>[\d\.]+ (MB|KB|bytes))\)')
|        $qs = [regex]::Match($t, '(?i)that is (?<q>[\d\.]+ (MB|KB|bytes)) in every part')
|        $s = if ($first.Success) { 'the lookup {0} is {1}' -f $first.Groups['n'].Value, $first.Groups['s'].Value } else { 'a lookup has to travel whole in every part of the query' }
|        if ($qs.Success) { $s += (' (the query {0} in every part)' -f $qs.Groups['q'].Value) }
|        if ($cap.Success) { $s += (', over the {0} one Microsoft Defender query can carry -- more parts cannot make it fit' -f $cap.Groups['c'].Value) }
|        else { $s += ', more than one Microsoft Defender query can carry' }
|        return $s
|    }
|    if ($t -match '(?i)lookup (this report needs|it needs) could not be read') {
|        $why = [regex]::Match($t, '(?i)could not be read(?: from Log Analytics)?\s*(\([^)]*\))?\s*--\s*(?<w>[^|]{1,160})')
|        if ($why.Success) { $w = ConvertTo-SIUplinkDetail ($why.Groups['w'].Value.Trim().TrimEnd('.')); if ($w) { return ('a lookup it needs could not be read -- {0}' -f $w) } }
|        return 'a lookup it needs could not be read'
|    }
|    # ---- the count against the source / storage (the reasons Risk Analysis keeps in sidata.RaReportStatus) ----------------
|    $m = [regex]::Match($t, '(?i)the source holds (?<e>\d+) row\(s\)[^|]*?retrieved (?<r>\d+)')
|    if ($m.Success) { return ('the source holds {0} rows, the run retrieved {1}' -f $m.Groups['e'].Value, $m.Groups['r'].Value) }
|    $m = [regex]::Match($t, '(?i)retrieved (?<r>\d+) row\(s\), more than the source''s count of (?<e>\d+)')
|    if ($m.Success) { return ('the run retrieved {0} rows, more than the source''s count of {1} -- nothing is missing' -f $m.Groups['r'].Value, $m.Groups['e'].Value) }
|    $m = [regex]::Match($t, '(?i)retrieved (?<r>\d+) row\(s\) and stored (?<s>\d+): (?<l>\d+) row\(s\)')
|    if ($m.Success) { return ('{0} rows were retrieved and {1} stored -- {2} are neither stored nor accounted for' -f $m.Groups['r'].Value, $m.Groups['s'].Value, $m.Groups['l'].Value) }
|    $m = [regex]::Match($t, '(?i)(?<n>\d+) query slice\(s\) of the report could not be read')
|    if ($m.Success) { return ('{0} part(s) of its query could not be read -- their rows are unknown, not resolved' -f $m.Groups['n'].Value) }
|    if ($t -match '(?i)far fewer findings') { return 'it returned far fewer findings than its last run' }
|    if ($t -match '(?i)could not collect it from its worker') { return 'its worker did not hand its result back' }
|    if ($t -match '(?i)it is not in this run|not in this worker''s template') { return 'it is not in this run' }
|    switch ($cc) {
|        'settings-unreachable' { return 'the settings database could not be reached' }
|        'out-of-memory'        { return 'Risk Analysis ran out of memory' }
|        'permission'           { return 'the run''s identity was refused access -- a permission is missing' }
|        'missing-licence'      {
|            if ($mn -like 'devicetvm*') { return ('the tenant has no Defender vulnerability management (the table {0} is not there)' -f $mn) }
|            return 'a licence this report needs is not in the tenant'
|        }
|        'no-data-source'       {
|            if ($mn -eq 'defender-xdr') { return 'advanced hunting (Microsoft Defender XDR) is not set up in this tenant' }
|            if ($mn) { return ('the data source {0} is not in this tenant' -f $mn) }
|            return 'the data source it reads is not in this tenant'
|        }
|        'missing-column'       { if ($mn) { return ('the column {0} is not there -- its source is not set up at this install' -f $mn) }; return 'a column it reads is not there' }
|        'platform-timeout'     {
|            $parts = @()
|            if ($rv['504'] -gt 0) { $parts += ('Microsoft Defender timed out {0}' -f (& $times $rv['504'])) }
|            if ($rv['429'] -gt 0) { $parts += ('it was throttled {0}' -f (& $times $rv['429'])) }
|            if ($rv['502'] -gt 0) { $parts += ('the gateway refused it {0}' -f (& $times $rv['502'])) }
|            if ($parts.Count) { return ($parts -join ', ') }
|            return 'the platform did not answer in time'
|        }
|        'too-large'            {
|            if ($mn -eq 'query-body') { return 'the query is larger than Microsoft Defender accepts' }
|            if ($rv['502'] -gt 0) { return ('the answer was too large for one Microsoft Defender query (refused {0})' -f (& $times $rv['502'])) }
|            return 'the answer was too large for one query'
|        }
|        'query-defect'         {
|            $at = [regex]::Match($t, "(?i)could not be parsed at '(?<tok>[^']{1,40})' on line \[(?<l>\d+),\s*(?<c>\d+)\]")
|            if ($at.Success) { return ('the query has a syntax error at ''{0}'' (line {1}, position {2})' -f $at.Groups['tok'].Value, $at.Groups['l'].Value, $at.Groups['c'].Value) }
|            if ($mn -eq 'syn0002' -or $t -match '(?i)\bSYN0002\b|syntax error') { return 'the query has a syntax error' }
|            if ($Cause -and $Cause.PSObject.Properties['Known'] -and -not $Cause.Known) { return 'the cause was not recognised -- the run''s log has the error' }
|            return 'the query failed'
|        }
|    }
|    if ($cc -eq 'count-less') { return 'fewer rows were stored than the source holds' }
|    if ($cc -eq 'count-more') { return 'more rows than the source''s count -- nothing is missing' }
|    if ("$State" -eq 'NotApplicable') { return 'it does not apply at this install' }
|    'the cause was not recognised -- the run''s log has the error'
|}
|
|function Get-SIReportCauseSentence {
|    <#
|        PURE. "<report>, <step>: <why>." -- one short sentence a person can act on, from a report fact (Report, State, Why,
|        Retries). -Cause: Get-SIReportCause's answer when the caller has it. At most 300 characters. Never throws ('' only for
|        a fact with no report).
|    #>
|    param([AllowNull()]$Fact, $Cause)
|    try {
|        if ($null -eq $Fact) { return '' }
|        $get = { param($n) if ($Fact -is [System.Collections.IDictionary]) { if ($Fact.Contains($n)) { $Fact[$n] } else { $null } } elseif ($Fact.PSObject.Properties[$n]) { $Fact.$n } else { $null } }
|        # the report's uplink id (the one Reports[] already carries) -- never its display name (#641: no report name leaves
|        # the install)
|        $rep = ConvertTo-SIUplinkId ([string](& $get 'Report'))
|        if (-not $rep) { return '' }
|        $state = [string](& $get 'State'); $text = [string](& $get 'Why')
|        # the reason Risk Analysis kept starts "not complete: <reason>" -- the reason is what explains it
|        $plain = ($text -replace '(?i)^\s*not complete:\s*', '')
|        if ($null -eq $Cause) { try { $Cause = Get-SIReportCause -State $state -Text $text } catch { $Cause = $null } }
|        $cc = if ($Cause) { [string]$Cause.CauseClass } else { '' }
|        $step = Get-SIReportCauseStep -State $state -Text $plain -CauseClass $cc
|        $why = Get-SIReportCauseWhy -State $state -Text $plain -Cause $Cause -Retries (& $get 'Retries')
|        $s = ('{0}, {1}: {2}.' -f $rep, $step, $why) -replace '\.\.$', '.'
|        if ($s.Length -gt 300) { $s = $s.Substring(0, 297).TrimEnd() + '...' }
|        # built from SecurityInsight's own words, the report's numbers and names -- still never sent when it looks like a secret
|        if (Test-SIUplinkLooksSecret $s) { return '' }
|        return $s
|    } catch { return '' }
|}
|
|function Join-SIUplinkCauseDetail {
|    <# PURE. An item's Detail: the plain sentence, then " | " and the engine's own first error line (already scrubbed), at
|       most 500 characters; $null when there is neither. #>
|    param([AllowNull()][AllowEmptyString()][string]$Sentence, [AllowNull()][AllowEmptyString()][string]$Raw)
|    $s = "$Sentence".Trim(); $r = "$Raw".Trim()
|    $d = if ($s -and $r) { '{0} | {1}' -f $s, $r } elseif ($s) { $s } elseif ($r) { $r } else { '' }
|    if (-not $d) { return $null }
|    if ($d.Length -gt (Get-SIUplinkCausesState).DetailMax) { $d = $d.Substring(0, (Get-SIUplinkCausesState).DetailMax) }
|    $d
|}
|
|function Get-SIUplinkReportNotes {
|    <#
|        PURE. The reports of a run that are COMPLETE but returned more rows than the source counted -- information, never a
|        failure (ConvertTo-SIUplinkReports leaves them out). Each @{ Report; Rows; SourceCount; Note }. Never throws.
|    #>
|    param([AllowNull()][object[]]$Facts)
|    try {
|        foreach ($f in @($Facts | Where-Object { $_ })) {
|            $get = { param($n) if ($f -is [System.Collections.IDictionary]) { if ($f.Contains($n)) { $f[$n] } else { $null } } elseif ($f.PSObject.Properties[$n]) { $f.$n } else { $null } }
|            $st = [string](& $get 'State'); if ($st -ne 'Complete') { continue }
|            $c = $null; try { $c = Get-SIReportCause -State $st -Text ([string](& $get 'Why')) } catch { $c = $null }
|            if (-not $c -or [string]$c.CauseClass -ne 'count-more') { continue }
|            [pscustomobject][ordered]@{ Report = [string](& $get 'Report'); Rows = (ConvertTo-SIUplinkNumber (& $get 'Rows')); SourceCount = (ConvertTo-SIUplinkNumber (& $get 'SourceCount'))
|                                        Note = 'complete -- more rows than the source counted, nothing is missing (no action)' }
|        }
|    } catch { }
|}
|
|function Get-SIHoldCauseSentence {
|    <# PURE. #902: a report held ON PURPOSE in plain words -- "<report>, held at its last complete result for <n> run(s) in a
|       row: <why>." At most 300 characters; '' when it would look like a secret or the fact has no report. #>
|    param([AllowNull()]$Fact)
|    try {
|        $rid = ConvertTo-SIUplinkId ([string](Get-SIUplinkFactValue $Fact 'Report'))
|        if (-not $rid) { return '' }
|        $n = ConvertTo-SIUplinkNumber (Get-SIUplinkFactValue $Fact 'HeldRuns'); if ($null -eq $n -or $n -lt 1) { $n = 1L }
|        $why = (([string](Get-SIUplinkFactValue $Fact 'Why')) -replace '(?i)^\s*not complete:\s*', '').Trim().TrimEnd('.')
|        $s = ('{0}, held at its last complete result for {1} run(s) in a row: {2}.' -f $rid, $n, $why)
|        if ($s.Length -gt 300) { $s = $s.Substring(0, 297).TrimEnd() + '...' }
|        if (Test-SIUplinkLooksSecret $s) { return '' }
|        $s
|    } catch { '' }
|}
|
|function Get-SIReportCauseHeadline {
|    <# PURE. The sentence of the most severe report that FAILED or is NOT COMPLETE (ConvertTo-SIUplinkReports' order), for
|       the run record's message. '' when there is none. #902: a report held ON PURPOSE that is information only is never
|       the headline; an escalated hold is, as a held report (held-too-long). #>
|    param([AllowNull()][object[]]$Facts)
|    try {
|        $best = $null; $bestSev = [int]::MaxValue
|        foreach ($f in @($Facts | Where-Object { $_ })) {
|            $st = [string]$(if ($f -is [System.Collections.IDictionary]) { $f['State'] } else { $f.State })
|            if ($st -notin @('Failed', 'NotComplete')) { continue }
|            $hold = Test-SIUplinkFactHeld -Fact $f
|            if ($hold -eq 'info') { continue }
|            if ($hold -eq 'escalated') {
|                $sevH = [int](Get-SIUplinkCausesState).Severity[[string](Get-SIUplinkCausesState).HoldClassEscalated]
|                if ($sevH -lt $bestSev) { $best = @{ F = $f; C = $null; H = $true }; $bestSev = $sevH }
|                continue
|            }
|            $wt = [string]$(if ($f -is [System.Collections.IDictionary]) { $f['Why'] } else { $f.Why })
|            $c = $null; try { $c = Get-SIReportCause -State $st -Text $wt } catch { $c = $null }
|            $sev = if ($c -and (Get-SIUplinkCausesState).Severity.ContainsKey([string]$c.CauseClass)) { [int](Get-SIUplinkCausesState).Severity[[string]$c.CauseClass] } else { 99 }
|            if ($sev -lt $bestSev) { $best = @{ F = $f; C = $c }; $bestSev = $sev }
|        }
|        if ($null -eq $best) { return '' }
|        if ($best.H) { return (Get-SIHoldCauseSentence -Fact $best.F) }
|        Get-SIReportCauseSentence -Fact $best.F -Cause $best.C
|    } catch { '' }
|}
|
|function Get-SIReportStatusReasonsSql {
|    <# The reasons Risk Analysis kept for the reports of ONE collection and grain that are NOT COMPLETE (sidata.RaReportStatus). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.RaReportStatus') IS NULL BEGIN SELECT CAST(NULL AS NVARCHAR(256)) AS ReportName, CAST(NULL AS NVARCHAR(2000)) AS Reason WHERE 1 = 0; RETURN; END
|DECLARE @t datetime2(3) = CONVERT(datetime2(3), @CollectionTime, 126);
|SELECT ReportName, Reason FROM sidata.RaReportStatus WHERE CollectionTime = @t AND Grain = @Grain AND State = N'NotComplete' AND NULLIF(Reason, N'') IS NOT NULL;
|'@
|}
|
|function Add-SIReportCauseStoredReasons {
|    <#
|        PURE. The run's report facts, completed with the NotComplete reasons kept in sidata.RaReportStatus (-Stored: rows of
|        ReportName + Reason): a fact without a reason takes the stored one; a report the database holds as NOT COMPLETE that
|        has no fact in this process (a queue worker's report) is added as NotComplete with its reason. Never throws.
|    #>
|    param([AllowNull()][object[]]$Facts, [AllowNull()][object[]]$Stored)
|    $out = New-Object System.Collections.Generic.List[object]
|    try {
|        $byName = @{}
|        foreach ($r in @($Stored | Where-Object { $_ })) {
|            $n = [string]$(if ($r -is [System.Collections.IDictionary]) { $r['ReportName'] } else { $r.ReportName }); $w = [string]$(if ($r -is [System.Collections.IDictionary]) { $r['Reason'] } else { $r.Reason })
|            if ($n -and $w -and -not $byName.ContainsKey($n)) { $byName[$n] = $w }
|        }
|        $seen = @{}
|        foreach ($f in @($Facts | Where-Object { $_ })) {
|            $n = [string]$f.Report; $seen[$n] = $true
|            if (-not "$($f.Why)".Trim() -and $byName.ContainsKey($n)) { $f.Why = $byName[$n]; if (-not "$($f.State)".Trim()) { $f.State = 'NotComplete' } }
|            $out.Add($f)
|        }
|        foreach ($n in @($byName.Keys | Sort-Object)) {
|            if ($seen.ContainsKey($n)) { continue }
|            $out.Add([pscustomobject]@{ Report = $n; State = 'NotComplete'; Why = $byName[$n]; StartedUtc = $null; RunMs = $null; Rows = $null; SourceCount = $null; Buckets = $null
|                                        QueryHash = ''; Retries = $null; LastGoodRows = $null; LastGoodRunMs = $null; LastGoodQueryHash = '' })
|        }
|    } catch { return @($Facts) }
|    $out.ToArray()
|}
|
|function Add-SIReportRetryAnswer {
|    <# Counts one platform answer (429 / 502 / 504) for the report that is running ($global:SI_UplinkCurrentReport) --
|       Risk Analysis' hunting call reports each failed attempt here. Never throws. #>
|    param([AllowNull()][AllowEmptyString()][string]$Message, [string]$Report = [string]$global:SI_UplinkCurrentReport)
|    try {
|        if (-not "$Report".Trim() -or -not "$Message".Trim()) { return }
|        $k = if ($Message -match '(?i)\b429\b|Too ?Many ?Requests|throttl') { '429' } elseif ($Message -match '(?i)\b502\b|Bad Gateway') { '502' } elseif ($Message -match '(?i)\b504\b|Gateway Time-?out|TaskCanceledException|A task was canceled|timed? ?out') { '504' } else { '' }
|        if (-not $k) { return }
|        if ($null -eq $global:SI_UplinkRetryAnswers -or $global:SI_UplinkRetryAnswers -isnot [hashtable]) { $global:SI_UplinkRetryAnswers = @{} }
|        if (-not $global:SI_UplinkRetryAnswers.ContainsKey($Report)) { $global:SI_UplinkRetryAnswers[$Report] = @{ '429' = 0L; '502' = 0L; '504' = 0L } }
|        $global:SI_UplinkRetryAnswers[$Report][$k] = [long]$global:SI_UplinkRetryAnswers[$Report][$k] + 1
|    } catch { }
|}
|
|function Get-SIUplinkRegion {
|    <# The install's Azure region: SI_Location, else the container's SI_CFG_SI_Location / SI_LOCATION. '' = not known. #>
|    param([scriptblock]$GetEnv)
|    if (-not $GetEnv) { $GetEnv = { param($n) [Environment]::GetEnvironmentVariable($n) } }
|    foreach ($v in @([string]$global:SI_Location, [string](& $GetEnv 'SI_CFG_SI_Location'), [string](& $GetEnv 'SI_LOCATION'))) { if ("$v".Trim()) { return (ConvertTo-SIUplinkId $v) } }
|    ''
|}
|
|function Limit-SIUplinkRecordSize {
|    <#
|        The uplink's body limit is 16 KB. A record whose Reports make it larger is cut down -- never refused, never dropped:
|        the Details are shortened to 200 characters, then left out, then the least severe items are left out (the list is
|        already most severe first). Works on the record in place and returns it. Never throws.
|    #>
|    param([Parameter(Mandatory)]$Record, [int]$MaxBytes = 15000)
|    try {
|        if (-not $Record.PSObject.Properties['Reports']) { return $Record }
|        $size = { [System.Text.Encoding]::UTF8.GetByteCount(($Record | ConvertTo-Json -Depth 8 -Compress)) }
|        if ((& $size) -le $MaxBytes) { return $Record }
|        foreach ($i in @($Record.Reports)) { if ($i.PSObject.Properties['Detail'] -and "$($i.Detail)".Length -gt 200) { $i.Detail = "$($i.Detail)".Substring(0, 200) } }
|        if ((& $size) -le $MaxBytes) { return $Record }
|        foreach ($i in @($Record.Reports)) { if ($i.PSObject.Properties['Detail']) { $i.PSObject.Properties.Remove('Detail') } }
|        $list = New-Object System.Collections.Generic.List[object]; foreach ($i in @($Record.Reports)) { $list.Add($i) }
|        while ($list.Count -gt 0 -and (& $size) -gt $MaxBytes) { $list.RemoveAt($list.Count - 1); $Record.Reports = @($list.ToArray()) }
|        if ($list.Count -eq 0) { $Record.PSObject.Properties.Remove('Reports') }
|    } catch { try { $Record.PSObject.Properties.Remove('Reports') } catch { } }
|    $Record
|}
|
|# =====================================================================================================================
|#  The capability probe (heartbeat): Capabilities, CiColumns, Licences
|# =====================================================================================================================
|function Get-SICapabilityProbeLaQuery {
|    <# The ONE Log Analytics query of the probe: the CI table's columns, and whether Sentinel has incidents or alerts. #>
|    @'
|union isfuzzy=true
| (SI_CI_CL | getschema | project Kind = "col", Name = tolower(ColumnName)),
| (SecurityIncident | where TimeGenerated > ago(90d) | take 1 | project Kind = "sentinel", Name = ""),
| (SecurityAlert | where TimeGenerated > ago(90d) | take 1 | project Kind = "sentinel", Name = ""),
| (print Kind = "ok", Name = "")
|| distinct Kind, Name
|'@
|}
|
|function Get-SICapabilityProbeLaMayBeMissing {
|    <# The tables of the probe's Log Analytics query a workspace may not have (2026-10-23: in a workspace without Sentinel
|       the whole answer was refused as cut, so the status report left out the Sentinel, CMDB and CI-column details). #>
|    @('SecurityIncident', 'SecurityAlert')
|}
|
|function Get-SICapabilityProbeHuntingQuery {
|    <# The ONE advanced hunting query of the probe: Defender XDR, Defender vulnerability management, Defender for Identity,
|       and whether SecurityInsight's own table is visible there (Sentinel data lake mirroring). #>
|    @'
|union isfuzzy=true
| (DeviceInfo | take 1 | project T = "xdr"),
| (DeviceTvmSoftwareVulnerabilities | take 1 | project T = "tvm"),
| (IdentityDirectoryEvents | take 1 | project T = "mdi"),
| (SI_CI_CL | take 1 | project T = "lake")
|| distinct T
|'@
|}
|
|function ConvertFrom-SICapabilityProbe {
|    <#
|        PURE. The probe's answers as the heartbeat's three fields. -LaRows (the LA query's rows, $null = not read), -HuntRows
|        (the hunting query's rows, $null = not read), -HuntNotProvisioned (no Defender XDR at all), -Skus (Graph
|        subscribedSkus .value, $null = not read). A key whose answer was not read is LEFT OUT.
|        Returns @{ Capabilities (ordered); CiColumns (ids); Licences (ids) }.
|    #>
|    param([AllowNull()][object[]]$LaRows, [AllowNull()][object[]]$HuntRows, [switch]$HuntNotProvisioned, [AllowNull()][object[]]$Skus, [switch]$SkusRead)
|    $cap = [ordered]@{}
|    $ci = New-Object System.Collections.Generic.List[string]
|    $lic = New-Object System.Collections.Generic.List[string]
|    if ($null -ne $LaRows) {
|        $okRow = @($LaRows | Where-Object { $_ -and [string]$_.Kind -eq 'ok' }).Count -gt 0
|        if ($okRow) {
|            $cols = @($LaRows | Where-Object { $_ -and [string]$_.Kind -eq 'col' } | ForEach-Object { ([string]$_.Name).ToLowerInvariant() })
|            if ($cols.Count) {
|                $opt = @($cols | Where-Object { $_ -match (Get-SIUplinkCausesState).OptionalCiColumnPattern } | Sort-Object -Unique)
|                foreach ($c in ($opt | Select-Object -First (Get-SIUplinkCausesState).MaxCiColumns)) { $id = ConvertTo-SIUplinkId $c; if ($id) { $ci.Add($id) } }
|                $cap['cmdb'] = [bool](@($opt | Where-Object { $_ -like 'si_cmdb_*' }).Count -gt 0)
|            }
|            $cap['sentinel'] = [bool](@($LaRows | Where-Object { $_ -and [string]$_.Kind -eq 'sentinel' }).Count -gt 0)
|        }
|    }
|    if ($HuntNotProvisioned) { $cap['defenderXdr'] = $false; $cap['defenderVulnMgmt'] = $false; $cap['mdi'] = $false }
|    elseif ($null -ne $HuntRows) {
|        $ts = @($HuntRows | Where-Object { $_ } | ForEach-Object { [string]$_.T })
|        $cap['defenderXdr'] = [bool]($ts -contains 'xdr'); $cap['defenderVulnMgmt'] = [bool]($ts -contains 'tvm'); $cap['mdi'] = [bool]($ts -contains 'mdi')
|        $cap['dataLake'] = [bool]($ts -contains 'lake')
|    }
|    if ($SkusRead -and $null -ne $Skus) {
|        $plans = @{}
|        foreach ($s in @($Skus)) {
|            if ($null -eq $s) { continue }
|            $status = [string]$s.capabilityStatus
|            if ($status -and $status -notin @('Enabled', 'Warning')) { continue }
|            $id = ConvertTo-SIUplinkId ([string]$s.skuPartNumber)
|            if ($id -and -not $lic.Contains($id) -and $lic.Count -lt (Get-SIUplinkCausesState).MaxLicences) { $lic.Add($id) }
|            foreach ($p in @($s.servicePlans)) { if ($p -and [string]$p.servicePlanName) { $plans[[string]$p.servicePlanName] = $true } }
|        }
|        foreach ($pn in @((Get-SIUplinkCausesState).PlanCapabilities.Keys)) {
|            $k = (Get-SIUplinkCausesState).PlanCapabilities[$pn]
|            if ($k -eq 'defenderVulnMgmt') { continue }   # measured from the data itself (DeviceTvm*), the licence only adds to it
|            $cap[$k] = [bool]($plans.ContainsKey($pn) -or ($cap.Contains($k) -and $cap[$k]))
|        }
|    }
|    # the closed keys only, in the agreed order
|    $closed = [ordered]@{}; foreach ($k in (Get-SIUplinkCausesState).CapabilityKeys) { if ($cap.Contains($k)) { $closed[$k] = [bool]$cap[$k] } }
|    [pscustomobject]@{ Capabilities = $closed; CiColumns = @($ci.ToArray()); Licences = @($lic.ToArray()) }
|}
|
|function Get-SICapabilityProbe {
|    <#
|        THE PROBE, once per process ($global:SI_CapabilityProbe): one Log Analytics query, one advanced hunting query and --
|        only when the run's identity may read them -- Graph subscribedSkus. -RunQuery { param($Kql) rows }, -RunHunting
|        { param($Kql) rows }, -GraphGet { param($Uri) response } are the seams (defaults: SI-TelemetryCounts.ps1's readers and
|        SI-GraphRest.ps1). A test session never reads anything without a seam. Licences that cannot be read (no permission,
|        no Graph sign-in) are left out and said in ONE Write-Diag line; no permission is ever added for them. Never throws.
|    #>
|    param([scriptblock]$RunQuery, [scriptblock]$RunHunting, [scriptblock]$GraphGet, [switch]$Refresh)
|    if (-not $Refresh -and -not ($RunQuery -or $RunHunting -or $GraphGet) -and $null -ne $global:SI_CapabilityProbe) { return $global:SI_CapabilityProbe }
|    $test = [bool](Get-Module -Name Pester)
|    $la = $null; $hunt = $null; $notProv = $false; $skus = $null; $skusRead = $false
|    try {
|        if (-not $RunQuery -and -not $test -and (Get-Command -Name Invoke-SITelemetryLaQuery -ErrorAction SilentlyContinue)) { $RunQuery = { param($Kql) Invoke-SITelemetryLaQuery -Query $Kql -MayBeMissing @(Get-SICapabilityProbeLaMayBeMissing) } }
|        if ($RunQuery) { try { $la = & $RunQuery (Get-SICapabilityProbeLaQuery); if ($null -ne $la) { $la = @($la) } } catch { $la = $null; Write-SIUplinkDiag ("capability probe: the workspace could not be read ({0})" -f $_.Exception.Message) } }
|    } catch { $la = $null }
|    try {
|        if (-not $RunHunting -and -not $test -and (Get-Command -Name Invoke-SITelemetryHuntingQuery -ErrorAction SilentlyContinue)) { $RunHunting = { param($Kql) Invoke-SITelemetryHuntingQuery -Query $Kql } }
|        if ($RunHunting) {
|            try { $hunt = @(& $RunHunting (Get-SICapabilityProbeHuntingQuery)) }
|            catch {
|                $hunt = $null
|                if ("$($_.Exception.Message)" -match 'Account is not provisioned') { $notProv = $true }
|                else { Write-SIUplinkDiag ("capability probe: advanced hunting could not be read ({0})" -f $_.Exception.Message) }
|            }
|        }
|    } catch { $hunt = $null }
|    try {
|        if (-not $GraphGet -and -not $test -and (Get-Command -Name Get-SIGraphToken -ErrorAction SilentlyContinue) -and (Get-Command -Name Invoke-SIGraphRest -ErrorAction SilentlyContinue)) {
|            $GraphGet = { param($Uri) $tok = Get-SIGraphToken -Resource Graph; Invoke-SIGraphRest -Uri $Uri -Token $tok -TimeoutSec 30 -MaxAttempts 1 }
|        }
|        if ($GraphGet) {
|            # Directory.Read.All (config\permissions.locked.json, collection identity) covers GET /subscribedSkus; an identity
|            # that was not granted it answers 403 -- then there are no Licences, said once, and nothing is granted
|            try { $resp = & $GraphGet '/subscribedSkus?$select=skuPartNumber,capabilityStatus,servicePlans'; $skus = @(if ($resp -and $resp.PSObject.Properties['value']) { $resp.value } else { $resp }); $skusRead = $true }
|            catch { $skus = $null; Write-SIUplinkDiag ("capability probe: no Licences in the status report -- the tenant's licences (Graph subscribedSkus) could not be read with this identity ({0}); it needs Directory.Read.All, which SecurityInsight's permission list already names -- nothing is granted here" -f $_.Exception.Message) }
|        } else { Write-SIUplinkDiag 'capability probe: no Licences in the status report -- no Microsoft Graph sign-in is loaded in this job' }
|    } catch { $skus = $null; $skusRead = $false }
|    $p = $null
|    try { $p = ConvertFrom-SICapabilityProbe -LaRows $la -HuntRows $hunt -HuntNotProvisioned:$notProv -Skus $skus -SkusRead:$skusRead } catch { $p = [pscustomobject]@{ Capabilities = [ordered]@{}; CiColumns = @(); Licences = @() } }
|    if (-not ($PSBoundParameters.ContainsKey('RunQuery') -or $PSBoundParameters.ContainsKey('RunHunting') -or $PSBoundParameters.ContainsKey('GraphGet'))) { $global:SI_CapabilityProbe = $p }
|    $p
|}
|
|# =====================================================================================================================
|#  Customer mails: the reference codes of a failure, each linked to its page
|# =====================================================================================================================
|function Get-SIUplinkMailCodes {
|    <# PURE. The distinct codes of a run's report facts (ConvertTo-SIUplinkReports' mapping), in its order, at most 20. #>
|    param([AllowNull()][object[]]$Facts)
|    try { @(@(ConvertTo-SIUplinkReports -Facts $Facts) | ForEach-Object { [string]$_.Code } | Select-Object -Unique) } catch { @() }
|}
|
|function ConvertTo-SIErrorCodeMailHtml {
|    <# PURE. One paragraph for a failure mail: 'Reference: <code> (linked to its page), ...' -- '' when there is none. #>
|    param([AllowNull()][string[]]$Codes)
|    $links = @(@($Codes) | Where-Object { Get-SIErrorCodeUrl $_ } | Select-Object -Unique | ForEach-Object {
|        $u = Get-SIErrorCodeUrl $_
|        '<a href="{0}" style="color:#0969da;">{1}</a>' -f [System.Net.WebUtility]::HtmlEncode($u), [System.Net.WebUtility]::HtmlEncode(([string]$_).ToLowerInvariant())
|    })
|    if (-not $links.Count) { return '' }
|    '<p style="margin:0 0 10px 0;">Reference: {0} &mdash; each code''s page says what it means and what to do.</p>' -f ($links -join ', ')
|}
'@ }
$__siSupportFiles['engine/_shared/SI-HoldKinds.ps1'] = @{ Sha256 = '21fb034a309b3b7fdb084db0dc80553755d2af0432b50df9604d5e3505e5348d'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE ONE LIST OF REPORTS HELD ON PURPOSE (#902; owner 2026-10-26: "Approve, next release").
|
|    A report SI holds back ON PURPOSE keeps its last complete result and closes nothing (#900 a source that went silent,
|    #899 an incomplete Entra role read, #901 the run publishes). WHICH reasons exist, and the stable code of each, is ONE
|    list: data-model/hold-kinds.locked.json. Every reader goes through this file -- the stored sidata.RaReportStatus.HoldKind
|    (Add-RADeliberateHold, Set-RAStreamReportNotComplete), the uplink item (SI-UplinkCauses.ps1), the mail (RA-ReportMail.ps1)
|    and the heartbeat Warnings -- and the web app reads the same file (SI.Management.Core/Holds/HoldKinds.cs). A test fails
|    when code emits a kind that is not in the list (SIv3-HoldKinds.Tests.ps1).
|
|    The safe direction everywhere: a list that cannot be read has NO kinds, so every report is a real failure (nothing is
|    hidden as "held"). Whether a report IS held stays Get-RADeliberateHoldKind's rule (RA-SilentSource.ps1) -- not here.
|    PS 5.1 and 7. No modules, no network.
|#>
|
|$script:SIHoldKindsCache = $null
|
|function Get-SIHoldKinds {
|    <# The list, read once per process (-Path: the test seam, never cached). @{ Version; EscalateAfterDetailedRuns; Kinds =
|       @(@{ Kind; Code; EscalationCode; AcceptEmpty }) }. No kinds when the file cannot be read. #>
|    param([string]$Path)
|    if (-not $Path -and $null -ne $script:SIHoldKindsCache) { return $script:SIHoldKindsCache }
|    $p = $Path
|    if (-not $p) { $p = [System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'data-model', 'hold-kinds.locked.json') }
|    $out = [pscustomobject]@{ Version = 0; EscalateAfterDetailedRuns = 3; Kinds = @() }
|    try {
|        $j = [System.IO.File]::ReadAllText($p).TrimStart([char]0xFEFF) | ConvertFrom-Json -ErrorAction Stop
|        $n = 3; if ($j.PSObject.Properties['escalateAfterDetailedRuns'] -and [int]$j.escalateAfterDetailedRuns -ge 1) { $n = [int]$j.escalateAfterDetailedRuns }
|        $kinds = @(@($j.kinds) | Where-Object { $_ -and "$($_.kind)".Trim() -and "$($_.code)" -match '^si-[a-z]{2,8}-\d{4}$' -and "$($_.escalationCode)" -match '^si-[a-z]{2,8}-\d{4}$' } | ForEach-Object {
|            [pscustomobject]@{ Kind = "$($_.kind)".Trim(); Code = "$($_.code)".Trim().ToLowerInvariant(); EscalationCode = "$($_.escalationCode)".Trim().ToLowerInvariant(); AcceptEmpty = [bool]$_.acceptEmpty }
|        })
|        $out = [pscustomobject]@{ Version = [int]$j.version; EscalateAfterDetailedRuns = $n; Kinds = $kinds }
|    } catch { }
|    if (-not $Path) { $script:SIHoldKindsCache = $out }
|    $out
|}
|
|function Get-SIHoldKind {
|    <# The list entry of -Kind ($null when the kind is not in the list). #>
|    param([AllowNull()][AllowEmptyString()][string]$Kind)
|    if (-not "$Kind".Trim()) { return $null }
|    @((Get-SIHoldKinds).Kinds | Where-Object { $_.Kind -eq "$Kind".Trim() })[0]
|}
|
|function Test-SIHoldKind {
|    <# Is -Kind a kind of the list? ('' and an unknown kind: no -- the report is then a real failure.) #>
|    param([AllowNull()][AllowEmptyString()][string]$Kind)
|    [bool](Get-SIHoldKind -Kind $Kind)
|}
|
|function Get-SIHoldKindCode {
|    <# The catalogue code of -Kind: its information code, or its escalation code with -Escalated. '' for an unknown kind. #>
|    param([AllowNull()][AllowEmptyString()][string]$Kind, [switch]$Escalated)
|    $k = Get-SIHoldKind -Kind $Kind
|    if (-not $k) { return '' }
|    if ($Escalated) { return [string]$k.EscalationCode }
|    [string]$k.Code
|}
|
|function Test-SIHoldKindAcceptEmpty {
|    <# May an Admin accept the source of a report held for -Kind as empty for good? Only a kind of the list that says so. #>
|    param([AllowNull()][AllowEmptyString()][string]$Kind)
|    $k = Get-SIHoldKind -Kind $Kind
|    [bool]($k -and $k.AcceptEmpty)
|}
|
|function Test-SIHoldEscalated {
|    <# PURE. Is a hold escalated -- a real problem? Only a DETAILED run's hold, held -HeldRuns runs in a row (this run
|       included), at least escalateAfterDetailedRuns of the list. #>
|    param([AllowNull()]$HeldRuns, [AllowNull()][AllowEmptyString()][string]$Grain)
|    if ("$Grain" -ne 'Detailed') { return $false }
|    $n = 0
|    if ($null -eq $HeldRuns -or $HeldRuns -is [System.DBNull] -or -not [int]::TryParse("$HeldRuns", [ref]$n)) { return $false }
|    $n -ge [int](Get-SIHoldKinds).EscalateAfterDetailedRuns
|}
|
|function Get-RAHoldStreak {
|    <#
|        PURE. #902 (4): how many runs of this grain in a row a report is held for -Kind, this run included. -Previous: the
|        report's previous verdict row of the same grain (HoldKind, HeldRuns; $null = none). Held for the SAME kind before ->
|        its HeldRuns + 1; anything else (Complete, a real failure, another kind, no row, a row from before the column) -> 1.
|    #>
|    param([Parameter(Mandatory)][string]$Kind, [AllowNull()]$Previous)
|    if ($null -eq $Previous) { return 1 }
|    $pk = $null; $pr = $null
|    if ($Previous -is [System.Collections.IDictionary]) { $pk = $Previous['HoldKind']; $pr = $Previous['HeldRuns'] }
|    else { if ($Previous.PSObject.Properties['HoldKind']) { $pk = $Previous.HoldKind }; if ($Previous.PSObject.Properties['HeldRuns']) { $pr = $Previous.HeldRuns } }
|    if ($null -eq $pk -or $pk -is [System.DBNull] -or "$pk" -ne $Kind) { return 1 }
|    $n = 0
|    if ($null -eq $pr -or $pr -is [System.DBNull] -or -not [int]::TryParse("$pr", [ref]$n) -or $n -lt 1) { return 1 }
|    $n + 1
|}
'@ }
$__siSupportFiles['data-model/hold-kinds.locked.json'] = @{ Sha256 = '4c9885b896cf44f7879f50593e00f7b2bdd6d65e36e06427036cc3c99ed71a4a'; Text = @'
|{
|  "_comment": "THE ONE LIST of the reasons SecurityInsight holds a report back ON PURPOSE at its last complete result (#902). Every reader goes through it: the engine (engine/_shared/SI-HoldKinds.ps1 -- the stored sidata.RaReportStatus.HoldKind, the uplink item, the mail, the heartbeat Warnings) and the web app (SI.Management.Core/Holds/HoldKinds.cs, embedded). A new kind = one entry here + its two codes in errors.locked.json (code: information, cause class held-last-good; escalationCode: the same report held escalateAfterDetailedRuns Detailed runs in a row, cause class held-too-long). acceptEmpty: an Admin may accept the source as empty for good, per report (only a kind that means a SUCCESSFUL read of zero rows). A test fails when code emits a kind that is not here.",
|  "version": 1,
|  "escalateAfterDetailedRuns": 3,
|  "kinds": [
|    { "kind": "silent-source", "code": "si-ra-0911", "escalationCode": "si-ra-0913", "acceptEmpty": true },
|    { "kind": "role-read", "code": "si-ra-0912", "escalationCode": "si-ra-0914", "acceptEmpty": false }
|  ]
|}
'@ }
$__siSupportFiles['data-model/errors.locked.json'] = @{ Sha256 = '733aa319f6fe48cf8a6c7bb497dbc2cb782deaae8ee36c8e3d4f8ca63d3bc31e'; Text = @'
|[
|  {
|    "code": "si-ra-0101",
|    "title": "Defender Vulnerability Management is not in this tenant",
|    "causeClass": "missing-licence",
|    "appliesTo": {
|      "capabilities": [
|        "defenderVulnMgmt"
|      ],
|      "licences": [
|        "MDE P2 or the Defender Vulnerability Management add-on"
|      ]
|    },
|    "customerText": "Your tenant does not have Microsoft Defender Vulnerability Management, so the reports about missing security updates and device recommendations do not apply. Nothing is wrong and nothing is missing.",
|    "internalNote": "Tenant lacks DeviceTvm* tables (no MDE P2 / Defender Vulnerability Management add-on). Seen at customer A 2026-10-15. Reports: Device_Missing_CVEs_*, Device_Recommendations_*.",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": "3.0.0.202610151821",
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. If you add Defender Vulnerability Management later, these reports start on their own with the next run."
|      }
|    ],
|    "lesson": null,
|    "since": "3.0.0.202610151821"
|  },
|  {
|    "code": "si-ra-0102",
|    "title": "An optional asset field is not in this install (for example no CMDB)",
|    "causeClass": "missing-column",
|    "appliesTo": {
|      "capabilities": [
|        "cmdb"
|      ],
|      "licences": []
|    },
|    "customerText": "Your install has no CMDB data, so one asset field SecurityInsight can use does not exist yet. Earlier versions then scored findings without the asset's tier and exposure; this version reads the field only when it exists.",
|    "internalNote": "SI_CI_CL has no si_cmdb_* (or other optional) column at an install without that source; 1701 and older failed the CI context read (Failed to resolve scalar expression si_cmdb_id) -> findings scored without tier/exposure. Seen at customer G 2026-10-15.",
|    "whoActs": "nobody",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "fixed-in",
|    "fixedIn": "3.0.0.202610151840",
|    "waitForFix": true,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The fix arrives with the update; the next run scores every finding with its asset's tier and exposure."
|      }
|    ],
|    "lesson": null,
|    "since": "3.0.0.202610151840"
|  },
|  {
|    "code": "si-ra-0103",
|    "title": "A report query used a reserved word and could not run",
|    "causeClass": "query-defect",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report could not run because of an error in SecurityInsight's own query, so it returned no rows. This was SecurityInsight's fault, not your environment's.",
|    "internalNote": "Identity_SPN_OwnerMismatch read _ow.of (of is a KQL keyword) -> Log Analytics SYN0002, 0 rows. Internal 2026-10-15.",
|    "whoActs": "nobody",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "fixed-in",
|    "fixedIn": "3.0.0.202610151701",
|    "waitForFix": true,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The fix arrives with the update; the next run fills the report."
|      }
|    ],
|    "lesson": null,
|    "since": "3.0.0.202610151701"
|  },
|  {
|    "code": "si-ra-0201",
|    "title": "A report returned more rows than the source's count",
|    "causeClass": "count-more",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "A report returned slightly more rows than the source counted (the two are read a moment apart). Nothing is missing; earlier versions wrongly called the report incomplete.",
|    "internalNote": "Retrieved > source count was marked NotComplete before 1821 (customer G 2026-10-15, Attack_Paths_Summary_Credential_Based_Lateral_Movement 4 vs 3).",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "fixed-in",
|    "fixedIn": "3.0.0.202610151821",
|    "waitForFix": true,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do."
|      }
|    ],
|    "lesson": null,
|    "since": "3.0.0.202610151821"
|  },
|  {
|    "code": "si-ra-0302",
|    "title": "A report's data is more than Log Analytics can answer at once",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report needs more data from Log Analytics than one answer can carry. SecurityInsight reads it again in smaller parts; only when even the smallest parts cannot be answered is the report left out of this run. Its findings are then unknown for this run, not resolved, and SecurityInsight's team looks at it.",
|    "internalNote": "Log Analytics PartialError for a limit (result over the row / size limit, a part out of time or memory) on a report's own query or a lookup it needs. The read is repeated in 2, 4, 8 ... parts (a hash of the whole result row) until every part is whole; it stops (this code) only when two part counts in a row were refused with no row at all -- the query's own work is the limit, which every part repeats. A short answer is never stored as whole. NOT the cause at customer A 2026-10-15 (19:22Z / 19:28Z, Azure_Recommendations_* and Azure_DefenderRecommendations_*): there SI_AzureRecommendation_CL did not exist, a union isfuzzy leg over it is answered PartialError (severity Warning, 'Failed to resolve table'), and the engine refused every partial answer as 'exceeded the allowed limits' -- that answer is now taken as the whole result (#690 (37)).",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the run log for the report: it names the query or lookup and the part count it reached. The query itself has to be made lighter (fewer columns, an earlier filter) -- more parts cannot help."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0303",
|    "title": "Risk Analysis ran out of memory on a report",
|    "causeClass": "out-of-memory",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "Risk Analysis ran out of memory while it read the data one report needs, so that report was left out of this run. Its findings are unknown for this run, not resolved, and nothing is closed because of it. The other reports ran. The next update gives the Risk Analysis job more memory, and SecurityInsight's team looks at it.",
|    "internalNote": "An OutOfMemoryException while a report's lookups (its let-bindings over SI_CI_CL / SI_*_Profile_CL) were read from Log Analytics or inlined. Seen at the large ring-1 install 2026-10-15 23:27Z (rc.1247 / 1701): Identity_Admin_LogonTo_InternetExposedDevice_Summary, two hours into the run -- every report's lookups were cached for the whole run and never let go. Since this code: a lookup is kept only while the current or the previous report uses it, an out-of-memory lets go of every cached lookup (the run goes on), and the run health END says 'out of memory', which raises the Risk Analysis job one size band at the next update. Before this code the same failure was reported as too-large (si-ra-0905).",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the run log for the report: the lookup it read, its rows and the job's size. Check that the next update raised the Risk Analysis job one size band (the update log says 'job size: ... raised'); at 4 CPU / 8 GiB the report's lookup itself has to be made smaller."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-set-0401",
|    "title": "The settings database cannot be reached",
|    "causeClass": "settings-unreachable",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight could not reach its own settings database, so the run stopped before it collected anything. Your existing data is unchanged.",
|    "internalNote": "SQL error 40 on the settings database (sql-si-*): firewall / public network access or a paused server; check the server network settings with the Support app (needs its role on the SI subscription). Seen at customer E (a test install) 2026-10-15.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "params": {
|          "ResourceGroup": "resourceGroup",
|          "SubscriptionId": "subscriptionId"
|        },
|        "who": "customer",
|        "script": "Grant-SISupportAccess.ps1"
|      }
|    ],
|    "lesson": null,
|    "since": "3.0.0.202610151854"
|  },
|  {
|    "code": "si-col-0501",
|    "title": "A collection ran out of memory",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One collection needed more memory than its job has and stopped before it finished. It is marked not complete, so nothing in it is read as removed and the last complete collection stays in use until the next run finishes.",
|    "internalNote": "Identity producer at customer B 2026-10-15 (3.0.0.202610151701, 1,195 subscriptions): the Azure RBAC read kept the whole role-definition list per subscription; OutOfMemoryException from the 6th minute, both identity sources then threw and were \"continued with 0\". Fixed: role names only (built-ins once per run), the Exposure Graph identity nodes / service principal index / MFA registration read page by page, a failed source stops the collection (NOT COMPLETE), class out-of-memory (#702). The job-size rule raises the job one band after an out-of-memory run at the next update.",
|    "whoActs": "nobody",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "fixed-in",
|    "fixedIn": null,
|    "waitForFix": true,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The fix arrives with the update; the update also gives the job more memory when its last run ran out."
|      }
|    ],
|    "lesson": "A lookup kept per subscription / per page multiplies by the tenant: keep names and ids, never whole answers.",
|    "since": null
|  },
|  {
|    "code": "si-upl-0601",
|    "title": "The run record could not be built",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "A run could not prepare its status report for the support service, so support did not hear how the run ended. The run itself is not affected; its result is in the run log.",
|    "internalNote": "customer B 2026-10-15 19:11Z: \"The status report to Invardia could not be prepared (OutOfMemoryException)\" -- no run record / heartbeat after 15:25Z, the failure never reached Invardia. Fixed: a failed run lets go of its caches before the end record; an out-of-memory while preparing tries once more with the run record alone; the warning and the result carry si-upl-0601 (#702).",
|    "whoActs": "nobody",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "fixed-in",
|    "fixedIn": null,
|    "waitForFix": true,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The next run reports as usual."
|      }
|    ],
|    "lesson": "The end-of-run report must not need the memory the run used up: free first, then build the smallest report.",
|    "since": null
|  },
|  {
|    "code": "si-ra-0900",
|    "title": "A report failed for a cause SecurityInsight does not recognise yet",
|    "causeClass": "query-defect",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report could not be completed this run for a reason SecurityInsight does not recognise yet. SecurityInsight support has been told and looks into it; nothing has to be done in your environment.",
|    "internalNote": "No rule recognised the engine's error text (Get-SIReportCause Known = false). Read the item's Detail; give the cause its own code when it is understood.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the Detail on the environment's page and the run's log for the report; add a code for the cause."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0901",
|    "title": "A report has no data source in this tenant",
|    "causeClass": "no-data-source",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report reads data your tenant does not have (for example a Microsoft Defender product that is not in use), so the report does not apply. Nothing is wrong and nothing is missing.",
|    "internalNote": "Generic code of no-data-source: a table the report reads is not in this tenant (MissingName names it).",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The report starts on its own when the data source is added."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0902",
|    "title": "A column a report reads is not in this install",
|    "causeClass": "missing-column",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report reads a field that does not exist in your install, so the report could not be completed this run. SecurityInsight support has been told; nothing has to be done in your environment.",
|    "internalNote": "Generic code of missing-column: the column named in MissingName is not in the table the report reads (an optional CI column is si-ra-0102).",
|    "whoActs": "support",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Check whether the column is optional at this install; the report must read it only when it exists."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0903",
|    "title": "A report's query has an error",
|    "causeClass": "query-defect",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report could not run because of an error in SecurityInsight's own query, so it returned no rows this run. This is SecurityInsight's fault, not your environment's.",
|    "internalNote": "Generic code of query-defect: Log Analytics / advanced hunting refused the query (syntax or semantic error). Re-running fails identically; the query must be fixed.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Fix the report's query and release the fix; the next run fills the report."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0904",
|    "title": "A report timed out or Microsoft's service failed",
|    "causeClass": "platform-timeout",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "Microsoft's service did not answer one report in time this run (or answered with a temporary error). The report is read again on the next run; nothing has to be done in your environment.",
|    "internalNote": "Generic code of platform-timeout: a timeout, a 5xx, throttling or a cancelled query after the run's retries. Retries holds the answers.",
|    "whoActs": "support",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Compare the report's run time and retries with its last good run; if it repeats, raise its slice count."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0905",
|    "title": "A report's answer was too large",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report's answer was larger than Microsoft's service returns at once, so it could not be read in full this run. SecurityInsight reads it in smaller parts on its own; nothing has to be done in your environment.",
|    "internalNote": "Generic code of too-large: 502 Bad Gateway from the hunting front end, the 100,000-row limit, the allowed result size, or out of memory.",
|    "whoActs": "support",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Check the report's slice count against its rows; if it repeats, raise the slice count."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0906",
|    "title": "A report returned more rows than the source counted",
|    "causeClass": "count-more",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "A report returned slightly more rows than the source counted (the two are read a moment apart). Nothing is missing.",
|    "internalNote": "Generic code of count-more (the known case is si-ra-0201).",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0907",
|    "title": "A report returned fewer rows than the source holds",
|    "causeClass": "count-less",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report returned fewer rows than the source holds, so it is not complete this run. The findings that are missing are kept as they were (not closed); SecurityInsight support has been told.",
|    "internalNote": "Generic code of count-less: retrieved below the source's count, rows lost between retrieval and storage, a lost slice, or far fewer findings than the previous run.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Compare SourceCount, Rows and LastGoodRows; read the Detail for the slice that was lost."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0908",
|    "title": "A report could not reach the settings database",
|    "causeClass": "settings-unreachable",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight could not reach its own settings database while running one report. Your existing data is unchanged; SecurityInsight support has been told.",
|    "internalNote": "Generic code of settings-unreachable (the known case is si-set-0401).",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Check the server's network settings with the Support app."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0909",
|    "title": "SecurityInsight's identity may not read what a report needs",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight's identity is not allowed to read the data one report needs, so the report could not be completed. Get Started > Permissions names the missing permission; grant it with the setup script.",
|    "internalNote": "Generic code of permission: a 401 / 403 from Graph, Defender, ARM, Key Vault or storage while the report ran.",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Open Get Started > Permissions and grant what it lists with the setup script."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0910",
|    "title": "A report needs a licence this tenant does not have",
|    "causeClass": "missing-licence",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report needs a Microsoft licence your tenant does not have, so the report does not apply. Nothing is wrong and nothing is missing.",
|    "internalNote": "Generic code of missing-licence (the known case is si-ra-0101, Defender Vulnerability Management).",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. If the licence is added later, the report starts on its own with the next run."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0911",
|    "title": "A report kept its last complete result: a source it reads returned no rows",
|    "causeClass": "held-last-good",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report reads a Microsoft source that had rows before and returned none this run. SecurityInsight kept the report's last complete result and closed nothing in it. The report updates again as soon as the source has rows. If you turned that feature off on purpose, an Admin can accept the empty source on the Run reports page.",
|    "internalNote": "#900 / #902: a held report, kind silent-source (data-model/hold-kinds.locked.json) -- a source table the report reads counted 0 rows (a successful count) after it had rows (sidata.RaSourceCount). Information only: the report keeps its last complete result and nothing of it closes. MissingName names the table. Held 3 Detailed runs in a row = si-ra-0913.",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The report updates on its own when the source has rows again."
|      },
|      {
|        "who": "customer",
|        "text": "Only if the feature behind the source was turned off for good: an Admin opens Run health > Risk Analysis reports and accepts the empty source for that report."
|      }
|    ],
|    "lesson": "A source that goes silent is not a fix: the findings it showed never close because of it.",
|    "since": null
|  },
|  {
|    "code": "si-ra-0912",
|    "title": "A report kept its last complete result: the Entra role read was not complete",
|    "causeClass": "held-last-good",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The list of Entra role assignments came back incomplete this run. The reports that read role lists kept their last complete result and closed nothing. The next run reads the list again.",
|    "internalNote": "#899 / #902: a held report, kind role-read (data-model/hold-kinds.locked.json) -- the identity run could not read the Entra role assignments completely. Information only: the report keeps its last complete result and nothing of it closes. Held 3 Detailed runs in a row = si-ra-0914.",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The next run reads the role assignments again."
|      }
|    ],
|    "lesson": "A role list that was not read is never an empty role list.",
|    "since": null
|  },
|  {
|    "code": "si-ra-0913",
|    "title": "A report has kept its last complete result for 3 Detailed runs in a row: a source it reads still returns no rows",
|    "causeClass": "held-too-long",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report has kept its last complete result for three Detailed runs in a row, because a source it reads still returns no rows. SecurityInsight support has been told and is looking into it. Nothing in the report was closed. If you turned that feature off on purpose, an Admin can accept the empty source on the Run reports page.",
|    "internalNote": "#902 (4): si-ra-0911 for the same report escalateAfterDetailedRuns (3) Detailed runs in a row (sidata.RaReportStatus.HeldRuns). The data is still the last complete result; nothing closes. Check the source table (MissingName) in the tenant: a connector or a licence that stopped, or a feature the customer retired (then the Admin accepts it as empty).",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the run's WARNING line for the source (its last non-zero count and date) and check that table in the tenant; ask the customer whether the feature was turned off."
|      },
|      {
|        "who": "customer",
|        "text": "Only if the feature behind the source was turned off for good: an Admin opens Run health > Risk Analysis reports and accepts the empty source for that report."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0914",
|    "title": "A report has kept its last complete result for 3 Detailed runs in a row: the Entra role read is still not complete",
|    "causeClass": "held-too-long",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The list of Entra role assignments has come back incomplete for three Detailed runs in a row. The reports that read it still show their last complete result and nothing was closed. SecurityInsight support has been told and is looking into it.",
|    "internalNote": "#902 (4): si-ra-0912 for the same report escalateAfterDetailedRuns (3) Detailed runs in a row (sidata.RaReportStatus.HeldRuns). The data is still the last complete result; nothing closes. Read the identity run's role-read lines (pages, rows, the second read).",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the identity run's log for the role assignment read (each read's pages and rows) and the Graph answers it got."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-cmdb-0701",
|    "title": "No endpoints to send to the CMDB: the tenant has no active devices",
|    "causeClass": "no-data-source",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The endpoint collection ran and found no active devices in your tenant, so the CMDB connector had nothing to send. Nothing is wrong and nothing is missing. When devices are added, they reach the CMDB with the next run.",
|    "internalNote": "The endpoint profile table never held a row, but the endpoint collection ended well in the window: it found no active devices (customer A 2026-10-15: 1 Entra device, stale; 0 from MDE, Exposure Graph and Resource Graph), so SI_Endpoint_Profile_CL is never created. Before this code the CMDB SQL connector said every run \"no endpoint profile snapshot yet -- the first collection has not published one\" (success-partial, class unknown at Invardia). Now the run is a success with this code; a collection that never ran, or failed, stays \"not yet\".",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. If devices are added to the tenant, the next run sends them to the CMDB."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-upd-0801",
|    "title": "The updater may not store secrets in Key Vault (secure hand-over)",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "Secrets you paste in the SecurityInsight web app are handed to the updater, which stores them in your Key Vault. The updater's identity is not allowed to use its hand-over key there yet, so pasted secrets wait and are not stored. Run the updater setup again with its role grants.",
|    "internalNote": "cfg.InstallState 'SecretHandover' state 'missing' (checked by the updater within 3 days): the updater's hand-over key read / unwrap was refused with a 403 on the install's Key Vault (error class kv-403). Raised by the hourly heartbeat's Warnings (#719). The same check feeds the setup report's secret-handover control.",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Run the updater setup again with its role grants: .\\setup\\Install-SIUpdaterJob.ps1 -SubscriptionId <subscription id> -ResourceGroupName <resource group> -GrantSpnRoles"
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-upd-0802",
|    "title": "The updater may not change the SecurityInsight database",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The last update stopped before it changed anything, because the updater's identity is missing its rights on the SecurityInsight database. Nothing was rolled and the install keeps running on its current version. A database administrator grants the rights once with the setup script.",
|    "internalNote": "cfg.InstallState 'UpdateState' error names a database permission (db_ddladmin / db_securityadmin / 'permission was denied'): the updater's database step (container/updater/_shared/SI-UpdaterDatabase.ps1) was refused -- typically the updater was taken out of the server's SQL admin group without setup\\Grant-SIUpdaterDatabase.ps1 having granted its own roles. Raised by the hourly heartbeat's Warnings (#719).",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Let a member of the database server's Entra admin group run .\\setup\\Grant-SIUpdaterDatabase.ps1 once; the next update applies itself."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-upd-0803",
|    "title": "Azure refused the new version for a SecurityInsight job, so the update was rolled back",
|    "causeClass": "platform-timeout",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The update built the new version, but Azure refused to put it on one or more SecurityInsight jobs. Usually Azure could not reach your container registry at that moment. Every job that had already changed was put back on the version it ran before, so your install keeps working on its current version and no data was lost. The update is tried again.",
|    "internalNote": "ROLL step of setup/Invoke-SIContainerUpdate.ps1 (Invoke-SIJobImageRoll): the job's ARM PATCH was answered 400 InvalidParameterValueInContainerTemplate \"Field 'template.containers.<job>.image' is invalid ... Get https://<acr>/v2/: dial tcp <ip>:443: connect: connection refused\" -- Container Apps validates the image against the registry while it takes the PATCH. Seen at customer D 2026-10-19 14:09Z (rc13, 2 of 22 PATCHes; SUP-2026-00198/00199/00200; Basic ACR, public, no firewall). Since this code the PATCH is sent again for that transient registry answer (Test-SIArmRegistryTransient, up to 18 passes of 10 s) before the update fails. Not transient (never retried): MANIFEST_UNKNOWN / NAME_UNKNOWN / 401 / 403. Reported by the updater as step 'roll'.",
|    "whoActs": "support",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Check the update log: every job reads back its previous image and the installed version did not move. Read the 400's details: a registry network answer (connection refused, i/o timeout) is transient -- start the same update again. An image that does not exist or a registry that refuses the identity is not -- fix that first."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-upd-0804",
|    "title": "A SecurityInsight job could not be put back on its previous version after a failed update",
|    "causeClass": "platform-timeout",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "An update failed, and SecurityInsight could not put one or more of its jobs back on the version they ran before. Those jobs may now run a different version than the rest. SecurityInsight's support team puts them back for you.",
|    "internalNote": "ROLLBACK step of setup/Invoke-SIContainerUpdate.ps1: the restore PATCH (to the PreviousImage DETECT read BEFORE the roll, Get-SIContainerRollbackPlan) was refused or did not read back. Reported by the updater as step 'restore' ONLY for such a job -- before SUP-2026-00198 (2026-10-19) a clean rollback was reported as 'restore' with the roll's own 400. The update log names each job and the image it must run.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the update log for the jobs that 'could NOT be restored' and the image each must run; put each back on it (one PATCH of its template image), read it back, then start the update again."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-upd-0805",
|    "title": "A SecurityInsight job did not confirm the new version, so the update was rolled back",
|    "causeClass": "platform-timeout",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "Azure took the new version for a SecurityInsight job, but the job did not confirm it in time, or more than the version changed. Every job that had changed was put back on the version it ran before, so your install keeps working on its current version. SecurityInsight's support team looks at it.",
|    "internalNote": "VERIFY step of setup/Invoke-SIContainerUpdate.ps1 (Invoke-SIJobImageRoll read-back): the PATCH was accepted but the job ended Failed, reads back another image, changed more than the image (fingerprint), or was still provisioning after 8 minutes. Reported by the updater as step 'roll'.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the update log's VERIFY line for the job (failed / reads back / more than the image changed / still provisioning) and the job's ARM state; when the cause is cleared, start the update again."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-upd-0806",
|    "title": "An update has waited more than 24 hours for a pipeline run to end",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "A new SecurityInsight version is never installed while a pipeline run is going, so a run always finishes on the version it started with. This update has waited more than 24 hours for the current run to end. Nothing is stopped or lost: the update is installed as soon as the run ends, before the next run starts.",
|    "internalNote": "cfg.InstallState 'UpdateState' compact field waits.since older than 24 hours: the updater's run gate (container/updater/_shared/SI-UpdaterRunGate.ps1, owner decision 2026-10-23) found a pipeline run or step still going at every try since then. Warning only: the gate never cancels a run and never blocks one. The run itself (Operations > Jobs) says why it is long; a person may cancel it there (#700) -- the updater never does.",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Look at the running pipeline run on Operations > Jobs (its steps, how long each has run). A long run on a large install is expected; the update lands when it ends. Only when the run is stuck, decide with the customer whether to cancel it there."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-perm-1001",
|    "title": "SecurityInsight's identity is missing a Microsoft Graph permission",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "Microsoft Graph refused SecurityInsight's identity, so the collections that read Entra ID could not complete and their data is from the last good run. Get Started > Permissions names the missing permission; grant it with the setup script.",
|    "internalNote": "Run health (SI_RunHealth_CL): the newest failed run in 24 hours that read Microsoft Graph has error class graph-401 / graph-403, and no run of a Graph-reading engine succeeded since. Raised by the hourly heartbeat's Warnings (#719).",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Open Get Started > Permissions and grant what it lists with the setup script; the next run collects again."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-perm-1002",
|    "title": "SecurityInsight's identity is missing a Microsoft Defender permission",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [
|        "defenderXdr"
|      ],
|      "licences": []
|    },
|    "customerText": "Microsoft Defender refused SecurityInsight's identity, so the device data and the reports that read Defender could not complete; the data is from the last good run. Get Started > Permissions names the missing permission; grant it with the setup script.",
|    "internalNote": "Run health (SI_RunHealth_CL): the newest failed run in 24 hours that read Defender (machines, advanced hunting) has error class defender-403, and no run of a Defender-reading engine succeeded since. Raised by the hourly heartbeat's Warnings (#719).",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Open Get Started > Permissions and grant what it lists with the setup script; the next run collects again."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-perm-1003",
|    "title": "SecurityInsight's identity may not read Azure",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "Azure refused SecurityInsight's identity, so the Azure collection could not complete and its data is from the last good run. SecurityInsight needs Reader on the subscriptions or management groups it covers; grant it with the setup script.",
|    "internalNote": "Run health (SI_RunHealth_CL): the newest failed run in 24 hours that read Azure Resource Manager / Resource Graph has error class arm-403, and no run of an Azure-reading engine succeeded since. Raised by the hourly heartbeat's Warnings (#719).",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Open Get Started > Permissions and grant what it lists with the setup script; the next run collects again."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-perm-1004",
|    "title": "SecurityInsight may not read the security scores",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight may not read your tenant's Microsoft Secure Score or Defender exposure score yet, so the status report carries no scores. Nothing SecurityInsight collects is affected. Grant the two read-only permissions with the setup script.",
|    "internalNote": "The heartbeat reads Graph /security/secureScores?$top=1 (SecurityEvents.Read.All) and Defender /api/exposureScore (WindowsDefenderATP Score.Read.All), once per process per hour. One of them answered 401 / 403 -- Counts secureScore / secureScoreMax / exposureScore are then left out. Required permissions since 2026-10-16 (owner: \"Add, permission REQUIRED\"): granted on every new install; an existing install's update names them (the permission note). Raised by the hourly heartbeat's Warnings.",
|    "whoActs": "customer",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Open Get Started > Permissions: it lists Microsoft Graph SecurityEvents.Read.All and WindowsDefenderATP Score.Read.All with the two lines to run (Grant-SIIdentity.ps1 for the managed identity, Grant-SIIdentity.ps1 -AppId for an app registration)."
|      },
|      {
|        "who": "customer",
|        "text": "An admin who can give admin consent (Privileged Role Administrator or Global Administrator) runs them; the next hourly status report carries the scores."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-mail-1101",
|    "title": "The mail send right is not limited to the shared mailbox",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight's identity could send mail as other mailboxes than its shared mailbox, so SecurityInsight refuses to send any mail until the send right is limited. Limit it with the mail setup script.",
|    "internalNote": "cfg.InstallState 'MailRestriction' state 'unrestricted' (Get-SIMailRestrictionVerdict: a tenant-wide Mail.Send, or an Exchange role assignment not scoped to the shared mailbox). Raised by the hourly heartbeat's Warnings (#719).",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Run .\\setup\\Set-SIMail.ps1 -Apply: it removes the tenant-wide Mail.Send and limits the send right to the shared mailbox (Exchange RBAC for Applications)."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-mail-1102",
|    "title": "SecurityInsight may not send as its shared mailbox yet",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight's identity may not send mail as its shared mailbox yet, so reports and alerts are not mailed. Exchange's role assignment is missing or not active yet (it can take up to two hours after it is made).",
|    "internalNote": "cfg.InstallState 'MailRestriction' state 'not-granted' (the send probe as the shared mailbox was refused, or the mailbox does not exist). Raised by the hourly heartbeat's Warnings (#719).",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Run .\\setup\\Set-SIMail.ps1 -Apply for the shared mailbox, wait up to two hours, then send a test mail from the Settings page."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-mail-1103",
|    "title": "The mail send right is not verified as limited to the shared mailbox",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight could not verify that its send right is limited to the shared mailbox: there is no other mailbox to test it with, and no Exchange administrator has confirmed it. Set a test mailbox, or let an Exchange administrator confirm the restriction on the Settings page.",
|    "internalNote": "cfg.InstallState 'MailRestriction' state 'unverified' and no 'MailRestrictionAttestation' row. Raised by the hourly heartbeat's Warnings (#719).",
|    "whoActs": "customer",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Set SI_Mail_ProbeMailbox to a mailbox outside the shared mailbox's scope, or let an Exchange administrator confirm the restriction (Settings > Mail)."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-flow-1201",
|    "title": "The pipeline runner is not scheduled",
|    "causeClass": "settings-unreachable",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The job that starts SecurityInsight's daily pipeline has no timer, so the pipeline does not start by itself and a run you start from the web app waits. Your existing data is unchanged. The next update puts the job back on its schedule; support can do it at once.",
|    "internalNote": "caj-si-flow triggerType is not Schedule (no '*/5 * * * *' wake-up) and no job of the pipeline runs on its own timer (Get-SIFlowRunnerScheduleState 'not-scheduled'). Found live 2026-10-17 at one ring-2 install: caj-si-flow Manual since its install on 15 Oct, a queued run waited 6 h (#732). Every update now patches it to Schedule '*/5 * * * *' (Invoke-SIFlowRunnerSchedule, step 9b) and reads it back. Raised by the heartbeat's Warnings; since = the job's last change (systemData.lastModifiedAt). Support: put caj-si-flow on Schedule '*/5 * * * *' through the Support app, or start the update now.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The next update puts the pipeline job back on its schedule; support can do it at once."
|      }
|    ],
|    "lesson": "A job an install depends on to start anything must be checked by every update and by the heartbeat, not only created right once.",
|    "since": null
|  },
|  {
|    "code": "si-flow-1202",
|    "title": "A scheduled collection waited for or skipped a pipeline run",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "A collection that starts on its own daily timer found the pipeline running. It never runs beside the pipeline, so the two do not compete for the database: when the pipeline collects the same data itself, the scheduled collection did nothing; otherwise it waited for the run to end and then ran. Nothing is lost: the pipeline's own collection and the next scheduled one collect as usual.",
|    "internalNote": "cfg.InstallState 'CollectionHeld' {job, exec, run, action = skipped | waiting | waited | limit, atUtc} within the last 24 hours: a Collect-stage job's own execution (a producer, or the one job of an engine collected without queue scaling) found cfg.PipelineLock held by a live run (engine/_shared/SI-CollectionRunGate.ps1, 2026-10-25: a daily identity collection on its own timer rewrote 2.39 M CI records for 10-12 hours beside the pipeline on a 100 DTU database). skipped = the run includes that job's step; waiting / waited = it does not, so the collection waited (no cap of its own); limit = the job's own run limit ended the wait, nothing was collected. The pipeline's own step is never held. Information only; since = the time of that collection.",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. If it shows every day, the collection's own timer falls inside the pipeline's usual run; support may move that timer outside it on Operations > Jobs."
|      }
|    ],
|    "lesson": "A collection on its own timer and the pipeline's collection are two writers of the same tables: the one that is not the pipeline's must look before it writes.",
|    "since": null
|  },
|  {
|    "code": "si-flow-1203",
|    "title": "A pipeline run or step has run much longer than usual",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The pipeline run going on now, or one of its steps, has run much longer than it usually takes on this installation. Nothing is stopped: the run goes on and may still finish normally, for example after much more data than usual. Support looks at the run to see whether it is still making progress.",
|    "internalNote": "The newest cfg.FlowRun is Running and it, or a Running / Starting cfg.FlowStepRun of it, has run longer than max(2 x usual, usual + 2 h). Usual = the median of the install's own lengths among the newest 10 run records (a run: full runs that succeeded -- Scope pipeline, no FromStep; a step: that job's successful steps), at least 3 measured; without them the floor applies: 24 h for a run, 12 h for a step (Get-SIPipelineLongRun, engine/_shared/SI-JobFlow.ps1). Found 2026-10-26: four large installs had one run going for ~79 h (a data sync ~45 h, a correlation ~65 h) that looked Running and healthy. Warning only: nothing is stopped or held, no cap. since = when the first of them crossed its threshold; the run and step are Pipeline.runId / step; the runner's log, the run's note and the step's RetryReason say the age and the usual length. A person may cancel the run on Operations > Jobs (#700) -- SecurityInsight never does.",
|    "whoActs": "support",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Open the run on Operations > Jobs: which step runs, for how long, and whether its log still moves. A step that still makes progress on much more data is left to finish. A step that stands still: decide with the customer whether to cancel the run there."
|      }
|    ],
|    "lesson": "A run that only looks Running is not proof it is healthy: compare its age with how long it usually takes on that installation.",
|    "since": null
|  },
|  {
|    "code": "si-flow-1204",
|    "title": "A pipeline step runs far past its usual time and shows no progress",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "A step of the pipeline run going on now has run far longer than its last run took on this installation, and it has shown no sign of progress for an hour. Nothing is stopped: the run goes on. Support looks at the step to see whether it is stuck.",
|    "internalNote": "The newest cfg.FlowRun is Running and a Running / Starting cfg.FlowStepRun of it has run longer than max(2 x its last run's time, its last run's time + 60 min) -- its last run's time = that job's newest successful step among the newest 10 run records; none known: 6 h -- AND shows no progress for 60 minutes: its newest mark in cfg.StepProgress (its own execution's or its job's workers', moved by every batch a step writes, at most every 5 minutes) or phase row in cfg.StepPhaseTime is older than that, or, for a step that writes neither, the runner's log check found no sign of progress (its RetryReason). Get-SIPipelineStalledSteps, engine/_shared/SI-JobFlow.ps1. Found 2026-10-29: a correlation ran 55 h and two data syncs 35 h+ before anyone acted. Warning only: nothing is stopped or held. since = when it became stuck; the steps are named in Pipeline.stalledSteps (step, sinceUtc, lastProgressUtc); the runner's log and the step's RetryReason say it once. A person may cancel the run on Operations > Jobs -- SecurityInsight never does.",
|    "whoActs": "support",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Open the run on Operations > Jobs and the step named on the heartbeat: read its log and its database load. A step that stands still: decide with the customer whether to cancel the run there."
|      }
|    ],
|    "lesson": "Time alone does not tell a long step from a stuck one: a step that writes nothing for an hour, far past its usual time, is the one to look at.",
|    "since": null
|  },
|  {
|    "code": "si-flow-1205",
|    "title": "A job of the pipeline ran outside the pipeline",
|    "causeClass": "settings-unreachable",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The jobs of this installation run as one pipeline, but a job of the pipeline also ran on its own -- not started by a pipeline run and not by a person. Such a run collects or writes the same data a second time and belongs to no run. Nothing is lost; the next update takes such a job off its own timer.",
|    "internalNote": "#1096 (found live 2026-11-04: a collect producer caj-si-<engine>-producer kept its own daily cron beside the pipeline -- every install collected twice a day, the extra collection belonged to no run). The verification job's pipeline check (engine/_shared/SI-OutsidePipeline.ps1 Invoke-SIOutsidePipelineCheck) reads, in pipeline mode only, every execution of a pipeline step's job (caj-si-<key>, or the producer of a collection in parts; workers count through their producer) of the last 48 h from ARM and compares them with the step records of the runs (cfg.FlowStepRun.Execution, or a start inside that step's window -- an attempt started again) and the people's starts (cfg.JobTriggerRequest.ExecutionName). Any other execution = 'ran outside the pipeline: <job> <execution> <start>' in the job's log; cfg.InstallState 'OutsidePipeline' { checkedUtc, count, firstUtc, sample } within 30 h raises this warning. since = the first such execution. Warning only; the producer's own timer is taken away by the update (Invoke-SICollectProducerTrigger) and a scheduled producer execution in pipeline mode is skipped by the collection gate.",
|    "whoActs": "support",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the verification job's log (the 'ran outside the pipeline' lines name the job, the execution and its start). A job with its own timer in pipeline mode: let the next update take it off, or take it off on Operations > Jobs. A start by hand in the Azure portal: none needed."
|      }
|    ],
|    "lesson": "A job that is a step of the pipeline must have no other way to start by itself -- and an install should prove it every day, not trust it.",
|    "since": null
|  },
|  {
|    "code": "si-snow-1301",
|    "title": "A ServiceNow output's check failed",
|    "causeClass": "settings-unreachable",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight could not confirm that ServiceNow is ready for one of its outputs: the instance could not be reached, the key was refused or lacks a role, the Import Set table is missing, a column is missing or too short, or the table matches the columns by label. Nothing is sent to that table until it is fixed, so no row is lost or cut -- the rows go on the next run. Open the connector on Configuration > Connectors > Setup to see the check and run it again.",
|    "internalNote": "cfg.ServiceNowCheck: the newest row of an output (servicenow-ci / servicenow-vulnerable-item) has Outcome 'failed' (engine\\asset-cmdb\\_shared\\SI-SnowVerify.ps1: the data-out run before it sends, the daily check in the verification job, the web app's Verify on the mail job). The push of that output is held (Compare-SISnowSendColumns). Raised by the heartbeat's Warnings; since = the first not-ok check after the last ok one.",
|    "whoActs": "customer",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Open the ServiceNow connector (Configuration > Connectors > Setup), read the check, fix the instance address, the key, the role or the table in ServiceNow, and press Verify."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-data-1401",
|    "title": "The asset pages show an older copy than the rest of the web app",
|    "causeClass": "query-defect",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The pages of the merged assets (CIs and assets) show a copy that is older than the run the rest of the web app shows, so their numbers can differ from the other pages. Your data is unchanged. SecurityInsight refreshes the copy by itself right after each run; support is told if it stays.",
|    "internalNote": "sidata.PublishedRun 'current' in the data database has CopiedAt NULL or older than PublishedAt, no refresher is writing the copies (the session lock si-published-copy-refresh is free), and the publish is older than twice the last refresh's own time (the sum of sidata.PublishedCopy.Milliseconds) plus 10 minutes (Test-SIHeartbeatCopyStaleTooLong). Every publish moves the pointer first and the copies (sidata.CiPub, AssetPub, ...) follow range by range right after it (Invoke-SIPublishedCopyRefresh; CopiedAt moves when every range is done -- 14 minutes on internal 2026-10-28), so a copy being written is the normal course and is not said. sidata.PublishedCopyCatchUp repairs a stale copy on every wake-up of the pipeline runner, after every publish attempt that did not publish, and in the update (step 9g); found live 2026-10-21 after a hand publish. Raised by the heartbeat's Warnings (Get-SIHeartbeatPublishedCopySql); since = PublishedAt. If it stays: read the runner's log for the catch-up line, or EXEC sidata.PublishedCopyCatchUp through the Support app.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. SecurityInsight refreshes the copy by itself; support looks into it if the warning stays."
|      }
|    ],
|    "lesson": "A copy that must match a pointer is refreshed by the same code that moves the pointer, in the same transaction -- never by one of its callers.",
|    "since": null
|  },
|  {
|    "code": "si-data-1402",
|    "title": "The report figures are from an earlier collection",
|    "causeClass": "query-defect",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The newest Risk Analysis run has not been prepared for the overview yet, so the report figures shown are those of the run before it, with that run's date. Your data is unchanged. The figures move to the newest run by themselves once it is prepared.",
|    "internalNote": "#871: the newest complete Detailed collection (sidata.Collection Kind Detailed Status Complete) has no row in sidata.SummaryGroupState: its run stopped before the data sync built the groupings, or the data sync is still running. The heartbeat then sends the grouped figures (Counts usersWithoutMfa, cves, ... and Security) from the newest collection that HAS its groupings, decided by that collection's own verdicts; Security.collectionUtc is that collection's time and this warning's since is the newest collection's time. Normal for the hours between the Risk Analysis and the data sync of one run; if it stays past the next run, the data sync is not reaching the groupings -- read the pipeline's run page for the data sync step.",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The next pipeline run prepares the newest collection, and the figures move to it by themselves."
|      }
|    ],
|    "lesson": "A figure the install has had is sent with its date when a run did not renew it -- never left out, which reads as a fall.",
|    "since": null
|    },
|  {
|    "code": "si-data-1403",
|    "title": "The database is almost full",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The SecurityInsight database uses more than 85 % of its maximum size. When it is full, parts of the data sync cannot be written and the overview keeps older figures until they are. Support raises the maximum size or checks what the database keeps.",
|    "internalNote": "#904: the heartbeat's Database field (usedMb / maxSizeMb: sys.database_files FILEPROPERTY SpaceUsed of the data files, DATABASEPROPERTYEX MaxSizeInBytes) shows usedMb at or above 85 % of maxSizeMb. Seen first on a large install 2026-10-26 when the data sync hit the size quota (1105 / 40544) and the groupings, remediations and key figures of a collection were not written. Raise the database's max size (Azure portal or ARM, the install's Pro database) or check the retention of the large tables (cfg.ConnectorChange, the collections' own retention). since = when the heartbeat first saw it.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Raise the maximum size of the SecurityInsight database, or check what it keeps, before it is full."
|      }
|    ],
|    "lesson": "A limit that stops writes is watched before it is reached, never found by the write it refuses.",
|    "since": null
|  },
|  {
|    "code": "si-data-1404",
|    "title": "The database is full",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The SecurityInsight database reached its maximum size, so a part of the data sync could not be written. The pages of that part show their last complete result until it is. Support raises the maximum size; the next run builds what is missing.",
|    "internalNote": "#904: a part of the data sync (engine/pro-data/_shared/SI-DataSync.ps1: groupings, remediations, key figures, narrow findings, ...) failed on Azure SQL's size quota (1105 / 40544 / 'has reached its size quota'). Sent by the data sync as a failure of that part (Job si-datasync, FailedStep = the part, ErrorClass database-full); the step ends success-partial with the part named. Raise the database's max size, then queue a run (or wait for the next): each part builds what it is missing. Check the retention of the large tables (cfg.ConnectorChange).",
|    "whoActs": "support",
|    "priority": "P1",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Raise the maximum size of the SecurityInsight database. The next run builds what is missing by itself."
|      },
|      {
|        "who": "customer",
|        "text": "Nothing is needed when support manages the database. If your organisation sets the database's size itself, raise its maximum size in the Azure portal (the database's Compute + storage page); the next run builds what is missing by itself."
|      }
|    ],
|    "lesson": "A part that fails on a full database is a failure of that part, sent to support -- never only a warning line in the log.",
|    "since": null
|  }
|]
'@ }
$__siSupportFiles['engine/_shared/SI-InvardiaPortalLink.ps1'] = @{ Sha256 = 'daec661ab7f163fe336030e4a899cda1dfa698b6b447661c0415d6f26896bb66'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE CUSTOMER MAIL LINKS STRAIGHT TO THE INSTALL'S PAGE IN THE INVARDIA PORTAL (#710; framework
|    DOCS/REQUIREMENTS.md 8.16 "Order and links"; Invardia 1.0.488).
|
|    HOW:
|      1. Every IDENTIFIED status report Invardia takes is answered 202 { environmentId } (+ supersededBy when relevant).
|         The engine run that hears an id it does not have yet records it in the Pro database (cfg.InstallState
|         'InvardiaEnvironment' = {"environmentId":"<guid>","seenUtc":"..."}), on the connection the run already has
|         ($global:SI_ProSettingsStore). An anonymous install never gets an id (Invardia returns none) and never a link.
|      2. The Pro settings layer reads the row at run start with the other install facts (Read-SIInstallRingFacts ->
|         $global:SI_InstallRingFacts.InvardiaEnvironment).
|      3. Send-SIMail (SI-MailTransport.ps1) puts ONE line directly under the mail's summary (owner 2026-10-16):
|             See details and history: https://portal.invardia.com/#/environments/<environmentId>
|         -- only when the id is known (a GUID), only in a mail that HAS a summary, never in a mail that carries a
|         one-time secret (-NoPdf: the sign-in mails). No id = no line (never a broken or a start-page link).
|         Two mails without a summary carry it at their TOP (owner 2026-10-16, "Add to both"): the daily close-loop mail
|         (a place-holder row under its banner) and the management summary (Add-SIInvardiaPortalLinkAnchor, set by the mail
|         job before it sends) -- same rules: only a known id, HTML-encoded, once.
|
|    The id is a lower-case GUID (Invardia's inv.SupportEnvironments.EnvironmentId). Anything else is ignored.
|    PS 5.1 + 7. No modules.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|
|function Get-SIPortalLinkState {
|    <# The value of $script:SIPortalLink, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIPortalLink) { $script:SIPortalLink = @{
|    StateName = 'InvardiaEnvironment'                                  # cfg.InstallState row
|    UrlFormat = 'https://portal.invardia.com/#/environments/{0}'       # framework 8.16, Invardia 1.0.488
|    Text      = 'See details and history:'                             # the owner's wording, 2026-10-16
|    Marker    = 'data-si-portal-link'
|    Anchor    = '<!-- SI portal link -->'                              # the top of a mail without a summary (flow content)
|    RowAnchor = '<!-- SI portal link row -->'                          # the same (kept for an older body; filled like Anchor)
|    Guid      = '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'
|} }
|    , $script:SIPortalLink
|}
|$script:SIPortalLink = $null; $null = Get-SIPortalLinkState
|
|function ConvertTo-SIInvardiaEnvironmentIdOrEmpty {
|    <# PURE. An Invardia environment id as the lower-case GUID it is, or '' when it is not GUID-shaped. #>
|    param([AllowNull()][AllowEmptyString()][string]$EnvironmentId)
|    $v = "$EnvironmentId".Trim()
|    if ($v -match (Get-SIPortalLinkState).Guid) { return $v.ToLowerInvariant() }
|    ''
|}
|
|function Get-SIInvardiaEnvironmentIdFromAnswer {
|    <# PURE. The environmentId of an uplink answer (a parsed body, or its text), '' when none / not a GUID. #>
|    param([AllowNull()]$Answer)
|    if ($null -eq $Answer) { return '' }
|    $o = $Answer
|    if ($Answer -is [string]) { if (-not $Answer.Trim()) { return '' }; try { $o = $Answer | ConvertFrom-Json -ErrorAction Stop } catch { return '' } }
|    if ($null -eq $o) { return '' }
|    $v = ''
|    if ($o -is [System.Collections.IDictionary]) { if ($o.Contains('environmentId')) { $v = [string]$o['environmentId'] } }
|    elseif ($o.PSObject.Properties['environmentId']) { $v = [string]$o.environmentId }
|    ConvertTo-SIInvardiaEnvironmentIdOrEmpty $v
|}
|
|function ConvertTo-SIInvardiaEnvironmentValue {
|    <# PURE. The cfg.InstallState 'InvardiaEnvironment' value for -EnvironmentId (compact JSON). Throws on a non-GUID. #>
|    param([Parameter(Mandatory)][string]$EnvironmentId, $NowUtc)
|    $id = ConvertTo-SIInvardiaEnvironmentIdOrEmpty $EnvironmentId
|    if (-not $id) { throw "not an Invardia environment id: '$EnvironmentId'" }
|    $at = if ($NowUtc) { ([datetime]$NowUtc).ToUniversalTime() } else { [datetime]::UtcNow }
|    ([ordered]@{ environmentId = $id; seenUtc = $at.ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) } | ConvertTo-Json -Compress)
|}
|
|function Get-SIInvardiaEnvironmentIdFromValue {
|    <# PURE. The id in a cfg.InstallState 'InvardiaEnvironment' value (its JSON, or a bare GUID), '' when none. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    $v = "$Value".Trim()
|    if (-not $v) { return '' }
|    if ($v -match (Get-SIPortalLinkState).Guid) { return $v.ToLowerInvariant() }
|    Get-SIInvardiaEnvironmentIdFromAnswer $v
|}
|
|function Get-SIInvardiaPortalUrl {
|    <# PURE. The install's page in the Invardia customer portal, '' when the id is not a GUID. #>
|    param([AllowNull()][AllowEmptyString()][string]$EnvironmentId)
|    $id = ConvertTo-SIInvardiaEnvironmentIdOrEmpty $EnvironmentId
|    if (-not $id) { return '' }
|    (Get-SIPortalLinkState).UrlFormat -f $id
|}
|
|function Get-SIInvardiaPortalLinkHtml {
|    <# PURE. The one line, as HTML (every value encoded); '' when the id is not a GUID. #>
|    param([AllowNull()][AllowEmptyString()][string]$EnvironmentId)
|    $url = Get-SIInvardiaPortalUrl $EnvironmentId
|    if (-not $url) { return '' }
|    $u = [System.Net.WebUtility]::HtmlEncode($url)
|    ('<p {0}="1" style="font-family:Segoe UI,Arial,sans-serif;font-size:14px;line-height:1.5;color:#0B1633;margin:0 0 14px 0;">{1} <a href="{2}" style="color:#1B4FE4;text-decoration:underline;">{2}</a></p>' -f `
|        (Get-SIPortalLinkState).Marker, [System.Net.WebUtility]::HtmlEncode((Get-SIPortalLinkState).Text), $u)
|}
|
|function Test-SIInvardiaPortalLinkSummary {
|    <# PURE. $true when -BodyHtml has a summary the line goes under (the summary block, data-mail-summary: every SI mail's
|       summary since #728, the Risk Analysis mail's included; a <table> summary only in a mail queued by an older web app). #>
|    param([AllowNull()][AllowEmptyString()][string]$BodyHtml)
|    if (-not $BodyHtml) { return $false }
|    $BodyHtml -match '(?is)<(div|table)\b[^>]*\bdata-mail-summary\b'
|}
|
|function Add-SIInvardiaPortalLinkAnchor {
|    <#
|        PURE. Owner 2026-10-16 ("Add to both"): a mail WITHOUT a summary that still gets the line -- the daily close-loop
|        mail and the management summary -- carries it at the TOP. This marks the top of -BodyHtml (right after its <body>
|        tag, else at its start) with the place-holder Add-SIInvardiaPortalLink fills. A body that has a summary (the line
|        goes under it), already has a place-holder or the line, or is empty: unchanged. Invisible when no id is known
|        (an HTML comment; Send-SIMail removes it before sending).
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$BodyHtml)
|    if (-not $BodyHtml) { return $BodyHtml }
|    if ((Test-SIInvardiaPortalLinkSummary $BodyHtml) -or $BodyHtml -match (Get-SIPortalLinkState).Marker -or $BodyHtml.Contains((Get-SIPortalLinkState).Anchor) -or $BodyHtml.Contains((Get-SIPortalLinkState).RowAnchor)) { return $BodyHtml }
|    $b = [regex]::Match($BodyHtml, '(?i)<body\b[^>]*>')
|    if ($b.Success) { $at = $b.Index + $b.Length; return $BodyHtml.Substring(0, $at) + (Get-SIPortalLinkState).Anchor + $BodyHtml.Substring($at) }
|    (Get-SIPortalLinkState).Anchor + $BodyHtml
|}
|
|function Remove-SIInvardiaPortalLinkAnchor {
|    <# PURE. -BodyHtml without the place-holders (an unused one is never sent). #>
|    param([AllowNull()][AllowEmptyString()][string]$BodyHtml)
|    if (-not $BodyHtml) { return $BodyHtml }
|    $BodyHtml.Replace((Get-SIPortalLinkState).RowAnchor, '').Replace((Get-SIPortalLinkState).Anchor, '')
|}
|
|function Add-SIInvardiaPortalLink {
|    <#
|        PURE. -BodyHtml with the one line directly UNDER its summary. The summary is found as:
|          1. the summary block (data-mail-summary, #728: every SI mail's summary, the Risk Analysis mail's included): the line
|             follows it;
|          2. a mail queued by an older web app: its <table data-mail-summary> box -- the line follows its table.
|        A mail without a summary that asks for the line at its top (owner 2026-10-16: the daily close-loop mail and the
|        management summary) carries a place-holder there:
|          3. "<!-- SI portal link row -->" (an older body): the line in its place;
|          4. "<!-- SI portal link -->" (Add-SIInvardiaPortalLinkAnchor): the line in its place.
|        No summary and no place-holder, no / not-a-GUID id, or the line already there = the body unchanged. Returns the body.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$BodyHtml, [AllowNull()][AllowEmptyString()][string]$EnvironmentId)
|    if (-not $BodyHtml -or $BodyHtml -match (Get-SIPortalLinkState).Marker) { return $BodyHtml }
|    $line = Get-SIInvardiaPortalLinkHtml $EnvironmentId
|    if (-not $line) { return $BodyHtml }
|    if (-not (Test-SIInvardiaPortalLinkSummary $BodyHtml)) {
|        # 3. / 4. the place-holder at the top (the first one only: the line is never there twice)
|        $r = $BodyHtml.IndexOf((Get-SIPortalLinkState).RowAnchor, [StringComparison]::Ordinal)
|        if ($r -ge 0) { return $BodyHtml.Substring(0, $r) + $line + $BodyHtml.Substring($r + (Get-SIPortalLinkState).RowAnchor.Length) }
|        $a = $BodyHtml.IndexOf((Get-SIPortalLinkState).Anchor, [StringComparison]::Ordinal)
|        if ($a -ge 0) { return $BodyHtml.Substring(0, $a) + $line + $BodyHtml.Substring($a + (Get-SIPortalLinkState).Anchor.Length) }
|        return $BodyHtml
|    }
|    # 1. the summary block: <div ... data-mail-summary ...> ... </div> (no div inside it); the line follows it
|    $m = [regex]::Match($BodyHtml, '(?is)<div\b[^>]*\bdata-mail-summary\b[^>]*>.*?</div>')
|    if ($m.Success) { $at = $m.Index + $m.Length; return $BodyHtml.Substring(0, $at) + $line + $BodyHtml.Substring($at) }
|    # 2. a mail queued by an older web app: its <table ... data-mail-summary ...> box (no table inside it)
|    $m = [regex]::Match($BodyHtml, '(?is)<table\b[^>]*\bdata-mail-summary\b[^>]*>.*?</table>')
|    if ($m.Success) { $at = $m.Index + $m.Length; return $BodyHtml.Substring(0, $at) + $line + $BodyHtml.Substring($at) }
|    $BodyHtml
|}
|
|function Get-SIInvardiaEnvironmentIdKnown {
|    <#
|        The id this process knows (never throws, '' when none): -Facts (default $global:SI_InstallRingFacts, read by the
|        Pro settings layer at run start) .InvardiaEnvironment.
|    #>
|    param($Facts = $global:SI_InstallRingFacts)
|    try {
|        if ($null -eq $Facts) { return '' }
|        $v = if ($Facts -is [System.Collections.IDictionary]) { if ($Facts.Contains((Get-SIPortalLinkState).StateName)) { [string]$Facts[(Get-SIPortalLinkState).StateName] } else { '' } }
|             elseif ($Facts.PSObject.Properties[(Get-SIPortalLinkState).StateName]) { [string]$Facts.((Get-SIPortalLinkState).StateName) } else { '' }
|        return (Get-SIInvardiaEnvironmentIdFromValue $v)
|    } catch { return '' }
|}
|
|function Save-SIInvardiaEnvironmentMark {
|    <# Records the environment id Invardia named (cfg.InstallState 'InvardiaEnvironment') on -Store. Throws on failure. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$EnvironmentId, $NowUtc)
|    $v = ConvertTo-SIInvardiaEnvironmentValue -EnvironmentId $EnvironmentId -NowUtc $NowUtc
|    $sql = @'
|IF OBJECT_ID('cfg.InstallState') IS NOT NULL
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @Name)
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @Name;
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@Name, @Value, NULL, @By);
|    COMMIT;
|END
|'@
|    $null = & $Store.Invoke $sql ([ordered]@{ Name = (Get-SIPortalLinkState).StateName; Value = $v; By = 'si-engine (Invardia uplink)' }) 'nonquery'
|}
|
|function Invoke-SIInvardiaEnvironmentNotice {
|    <#
|        #710: Invardia named this install's environment (-EnvironmentId). Recorded for the customer mails: -OnEnvironment
|        (tests), else the Pro database this run opened ($global:SI_ProSettingsStore). The in-process facts
|        ($global:SI_InstallRingFacts) carry it at once, so a later mail of the same process links it too. NEVER throws;
|        $true when recorded.
|    #>
|    param([Parameter(Mandatory)][string]$EnvironmentId, [scriptblock]$OnEnvironment, $NowUtc)
|    $id = ConvertTo-SIInvardiaEnvironmentIdOrEmpty $EnvironmentId
|    if (-not $id) { return $false }
|    $done = $false
|    try {
|        if ($OnEnvironment) { $null = & $OnEnvironment $id; $done = $true }
|        elseif ($global:SI_ProSettingsStore) { Save-SIInvardiaEnvironmentMark -Store $global:SI_ProSettingsStore -EnvironmentId $id -NowUtc $NowUtc; $done = $true }
|    } catch { $done = $false }
|    try {
|        $val = ConvertTo-SIInvardiaEnvironmentValue -EnvironmentId $id -NowUtc $NowUtc
|        $f = $global:SI_InstallRingFacts
|        if ($f -is [System.Collections.IDictionary]) { $f[(Get-SIPortalLinkState).StateName] = $val }
|        elseif ($null -ne $f) { $f | Add-Member -NotePropertyName (Get-SIPortalLinkState).StateName -NotePropertyValue $val -Force }
|    } catch { }
|    $done
|}
'@ }
$__siSupportFiles['engine/_shared/SI-InvardiaInstallId.ps1'] = @{ Sha256 = '9817b4a05b6021c91c6cd3bb75e61d25587364f0889a86801136e6f4270fe917'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE INSTALL'S LASTING ID ON ITS CALLS TO INVARDIA (Invardia S16, agreed 2026-11-01; the same contract
|    PIM 3.0.14 runs).
|
|    THE ID. One per install: the Key Vault secret SI-InstallId -- the GUID the licence request (SI-LicenceRequest.ps1)
|    created ONCE, at the install's first knock, kept next to the licence and sent as the knock body's installId on every knock
|    since. It is what Invardia already knows the install by. An update, a restart or a new container never replaces it (it
|    lives in the install's Key Vault, not in the image or on a disk; a reinstall that keeps the vault keeps the id). It is
|    CREATED ONCE when missing -- by the licence knock and (Invardia 2026-11-01) by the uplink heartbeat job -- with the same
|    code (Resolve-SIInvardiaInstallId: a GUID, written, read back), and never rewritten. Every other caller only READS it.
|    No id stored / not readable / not a GUID = NO header and NO field -- never an empty, a placeholder or a made-up value
|    (a wrong id would lock the install key at Invardia).
|
|    NOT the anonymous telemetry id (Get-SITelemetryInstallId: <state>\install-id, or derived from the storage account in a
|    container). That one identifies nothing but "the same Community install as last time"; the two are never joined.
|
|    WHERE IT GOES:
|      header X-Invardia-Install-Id (lower-case GUID) on the manifest pull (SI-InvardiaUpdate.ps1 Request-SIInvardiaManifest)
|                                     and the licence knock (SI-LicenceRequest.ps1, POST /api/licence-requests);
|      field  InstallId on every IDENTIFIED uplink record -- heartbeat, run, guard (SI-TelemetrySend.ps1,
|                                     SI-Guard.ps1, SI-GuardHeal.ps1; the health record's own installId, SI-DataHealth.ps1);
|      never on the setup report (Kind setup), an anonymous record, the key claim, the licence pull, the install-run tracking
|      or the update-now signal.
|
|    PURE helpers, no network. PS 5.1 and 7.
|#>
|
|# The names are LITERALS inside each function (no $script: state): these functions are loaded by one script and called from
|# another's scope (an engine's own script, the updater), where a file-level variable would be empty.
|
|function ConvertTo-SIInvardiaInstallId {
|    <# PURE. A GUID (any case, trimmed) -> its lower-case 8-4-4-4-12 text; anything else ($null, '', '-', not a GUID) -> ''. #>
|    param([AllowNull()][object]$Value)
|    if ($null -eq $Value) { return '' }
|    $t = "$Value".Trim().ToLowerInvariant()
|    if ($t -match '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$') { return $t }
|    return ''
|}
|
|function Select-SIInvardiaFirstInstallId {
|    <#
|        PURE. FIRST WRITE WINS (Invardia 2026-11-01): from the versions of SI-InstallId (-Versions: objects with Value, Enabled,
|        Created, Version), the OLDEST ENABLED version that holds a GUID is the install's id -- whichever side wrote it. Order:
|        Created ascending, then the version id (ordinal) so two versions made in the same second are ordered the same way by
|        every reader. Returns @{ First (the id, lower-cased, '' = none); Newest (the newest enabled version's value as stored);
|        Count (enabled versions) }.
|    #>
|    param([AllowNull()][object[]]$Versions)
|    # a seam that hands back its list as ONE object (a List, an array in an array) is read as its items
|    $flat = foreach ($x in @($Versions)) { if ($x -is [System.Collections.IEnumerable] -and $x -isnot [string] -and $x -isnot [System.Collections.IDictionary]) { foreach ($y in $x) { $y } } else { $x } }
|    $en = @(@($flat) | Where-Object { $null -ne $_ -and -not ($_.PSObject.Properties['Enabled'] -and $_.Enabled -eq $false) })
|    $key = { param($x) $c = $x.Created; if ($c -is [datetime]) { $c.ToUniversalTime().Ticks } elseif ($null -ne $c -and "$c" -match '^\d+$') { [datetime]::new(1970, 1, 1, 0, 0, 0, [DateTimeKind]::Utc).AddSeconds([double]"$c").Ticks } else { [long]::MaxValue } }
|    $sorted = @($en | Sort-Object -Property @{ Expression = { & $key $_ } }, @{ Expression = { [string]$_.Version } })
|    $first = ''
|    foreach ($x in $sorted) { $g = ConvertTo-SIInvardiaInstallId $x.Value; if ($g) { $first = $g; break } }
|    [pscustomobject]@{ First = $first; Newest = $(if ($sorted.Count) { [string]$sorted[-1].Value } else { $null }); Count = $sorted.Count }
|}
|
|function Get-SIInvardiaKvInstallIdVersions {
|    <#
|        The versions of a Key Vault secret over REST (engine\_shared\SI-AzRest.ps1, the run's own sign-in): GET
|        /secrets/<name>/versions (every page), then each enabled version's value (at most 50, oldest first, plus the newest).
|        Returns @(@{ Value; Enabled; Created; Version }); none (404) = @(). THROWS when the vault cannot be read -- a caller
|        never takes an unreadable vault for an empty one.
|    #>
|    param([Parameter(Mandatory)][string]$VaultName, [string]$Name = 'SI-InstallId')
|    $uri = 'https://{0}.vault.azure.net/secrets/{1}/versions?api-version=7.4&maxresults=25' -f $VaultName, [uri]::EscapeDataString($Name)
|    $items = New-Object System.Collections.Generic.List[object]
|    $pages = 0
|    while ($uri -and $pages -lt 20) {
|        $pages++
|        $r = Invoke-SIAzRestRequest -Method GET -Uri $uri -Audience KeyVault -AllowNotFound -What ("the versions of Key Vault secret '{0}' in '{1}'" -f $Name, $VaultName)
|        if (-not $r) { break }
|        $j = $r.Content | ConvertFrom-Json
|        foreach ($v in @($j.value)) { if ($v) { $items.Add($v) } }
|        $uri = if ($j.PSObject.Properties['nextLink'] -and "$($j.nextLink)" -match '^https://') { [string]$j.nextLink } else { $null }
|    }
|    $rows = @($items | ForEach-Object {
|        $ver = ([string]$_.id).TrimEnd('/').Split('/')[-1]
|        [pscustomobject]@{ Value = $null; Enabled = -not ($_.attributes -and $_.attributes.enabled -eq $false); Created = $(if ($_.attributes) { $_.attributes.created } else { $null }); Version = $ver }
|    } | Where-Object { $_.Enabled })
|    $order = @($rows | Sort-Object -Property @{ Expression = { if ("$($_.Created)" -match '^\d+$') { [double]"$($_.Created)" } else { [double]::MaxValue } } }, @{ Expression = { [string]$_.Version } })
|    $want = @($order | Select-Object -First 50) + @($order | Select-Object -Last 1)
|    $seen = @{}
|    foreach ($x in $want) {
|        if ($seen.ContainsKey([string]$x.Version)) { continue }; $seen[[string]$x.Version] = $true
|        # only the versions that can decide: the 50 oldest (the first GUID is among them) and the newest (the converge check)
|        $raw = Get-SIKeyVaultSecretRaw -VaultName $VaultName -Name $Name -Version $x.Version
|        if ($raw) { $x.Value = [string]$raw.value }
|    }
|    # one object per version (an empty vault returns nothing): callers wrap the call in @()
|    return $order
|}
|
|function Get-SIInvardiaInstallId {
|    <#
|        This install's lasting id, READ ONLY. With -ReadVersions { param($Name) } (the versions of SI-InstallId): the OLDEST
|        enabled version holding a GUID (first write wins); when the versions cannot be read, the current value through
|        -ReadSecret { param($Name) }. A GUID comes back lower-cased; none / not a GUID / the read failed -> ''. Never creates
|        it, never throws.
|    #>
|    param([scriptblock]$ReadSecret, [scriptblock]$ReadVersions)
|    if ($ReadVersions) {
|        try { $p = Select-SIInvardiaFirstInstallId -Versions @(& $ReadVersions 'SI-InstallId'); if ($p.First -or $p.Count) { return $p.First } } catch { }
|    }
|    if (-not $ReadSecret) { return '' }
|    $v = $null
|    try { $v = & $ReadSecret 'SI-InstallId' } catch { return '' }
|    return (ConvertTo-SIInvardiaInstallId $v)
|}
|
|function Resolve-SIInvardiaInstallId {
|    <#
|        Invardia 2026-11-01 (S16, answer 2): the lasting id, CREATED ONCE when it is missing -- by the licence knock and by the
|        uplink (heartbeat) job, with the same code and format: [guid]::NewGuid().ToString(), written to SI-InstallId.
|          * FIRST WRITE WINS (-ReadVersions): the id is the OLDEST enabled version of SI-InstallId that holds a GUID
|            (Select-SIInvardiaFirstInstallId), whichever side wrote it. A side that just wrote reads back the same way, so
|            when the knock and the uplink create at once both send the first value. When a later version holds ANOTHER GUID
|            (the losing write of such a race), the first value is written once more as the current version, so a plain read
|            (the engines' status reports) gives the same id -- the id itself never changes. One version (every install
|            before a race) behaves exactly as a plain read.
|          * without -ReadVersions, or when the versions cannot be read: the current value (-ReadSecret), as before;
|          * a stored GUID is KEPT (returned lower-cased) -- never replaced by another id;
|          * a stored value that is not a GUID is left as it is and '' comes back, unless -ReplaceNotGuid (the knock's rule
|            since #239: its body needs a GUID);
|          * the vault cannot be read or written -> '' (no id this time), never a throw.
|        -ReadSecret { param($Name) } / -WriteSecret { param($Name, $Value) } / -ReadVersions { param($Name) } -> @(@{ Value;
|        Enabled; Created; Version }).
|    #>
|    param([scriptblock]$ReadSecret, [scriptblock]$WriteSecret, [scriptblock]$ReadVersions, [switch]$ReplaceNotGuid)
|    if ($ReadVersions) {
|        $pick = { Select-SIInvardiaFirstInstallId -Versions @(& $ReadVersions 'SI-InstallId') }
|        $p = $null
|        try { $p = & $pick } catch { $p = $null }
|        if ($null -ne $p) {
|            $converge = {
|                param($sel)
|                $nw = ConvertTo-SIInvardiaInstallId $sel.Newest
|                if ($WriteSecret -and $sel.First -and $nw -and $nw -ne $sel.First) { try { $null = & $WriteSecret 'SI-InstallId' $sel.First } catch { } }
|            }
|            if ($p.First) { & $converge $p; return $p.First }
|            if ($null -ne $p.Newest -and "$($p.Newest)".Trim() -and -not $ReplaceNotGuid) { return '' }
|            if (-not $WriteSecret) { return '' }
|            $new = [guid]::NewGuid().ToString()
|            try { $null = & $WriteSecret 'SI-InstallId' $new } catch { return '' }
|            try { $p = & $pick } catch { return '' }
|            if ($p.First) { & $converge $p }
|            return [string]$p.First
|        }
|        # the versions could not be read: the plain read below (as before)
|    }
|    if (-not $ReadSecret) { return '' }
|    $v = $null
|    try { $v = & $ReadSecret 'SI-InstallId' } catch { return '' }
|    $have = ConvertTo-SIInvardiaInstallId $v
|    if ($have) { return $have }
|    if ($null -ne $v -and "$v".Trim() -and -not $ReplaceNotGuid) { return '' }
|    if (-not $WriteSecret) { return '' }
|    $new = [guid]::NewGuid().ToString()
|    try { $null = & $WriteSecret 'SI-InstallId' $new } catch { return '' }
|    $back = $null
|    try { $back = & $ReadSecret 'SI-InstallId' } catch { return '' }
|    return (ConvertTo-SIInvardiaInstallId $back)
|}
|function Add-SIInvardiaInstallIdHeader {
|    <# PURE. -Headers with X-Invardia-Install-Id = -InstallId added when it is a GUID (lower-case); unchanged otherwise. #>
|    param([AllowNull()][System.Collections.IDictionary]$Headers, [AllowNull()][AllowEmptyString()][string]$InstallId = '')
|    $h = if ($null -ne $Headers) { $Headers } else { @{} }
|    $iid = ConvertTo-SIInvardiaInstallId $InstallId
|    if ($iid) { $h['X-Invardia-Install-Id'] = $iid }
|    return $h
|}
|
|function Add-SIUplinkInstallId {
|    <#
|        PURE (sets one field). An IDENTIFIED uplink record with -FieldName (default InstallId, the name PIM 3.0.14 sends) =
|        -InstallId, lower-cased. Unchanged when the id is not a GUID, when the record is a setup report (Kind / kind 'setup'),
|        or when it is $null. The caller decides identified vs anonymous: an anonymous record is never passed here.
|    #>
|    param([AllowNull()][object]$Record, [AllowNull()][AllowEmptyString()][string]$InstallId = '', [string]$FieldName = 'InstallId')
|    if ($null -eq $Record) { return $Record }
|    $iid = ConvertTo-SIInvardiaInstallId $InstallId
|    if (-not $iid) { return $Record }
|    if ($Record -is [System.Collections.IDictionary]) {
|        foreach ($k in 'Kind', 'kind') { if ($Record.Contains($k) -and "$($Record[$k])" -eq 'setup') { return $Record } }
|        $Record[$FieldName] = $iid
|        return $Record
|    }
|    $kp = $Record.PSObject.Properties['Kind']
|    if ($kp -and "$($kp.Value)" -eq 'setup') { return $Record }
|    $Record | Add-Member -NotePropertyName $FieldName -NotePropertyValue $iid -Force
|    return $Record
|}
'@ }
$__siSupportFiles['engine/_shared/SI-UplinkOutbox.ps1'] = @{ Sha256 = '4b9eb1ca8b457ff4bafc976e93a7522e00e2dfe45d85252a436d0dd00cf1cf7c'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight Pro -- THE UPLINK OUTBOX (framework 8.4, agreed with Invardia 2026-11-05).
|
|    WHY. A run report is sent ONCE, at the end of its job (Send-SITelemetryRunEnd, SI-TelemetrySend.ps1). Until now a report
|    Invardia did not take -- no answer, a timeout, a 429, any answer that is not ok -- was lost: Invardia never heard of that
|    run. Now such a report is kept in the install's own Pro database (cfg.UplinkOutbox, sql\si-pro-settings.sql) and sent
|    again later by the heartbeat job. The send at job end is unchanged.
|
|    THE THREE MOMENTS
|      1. JOB END (Add-SIUplinkOutboxRecord, called by Send-SITelemetryRunEnd): a run record that was NOT taken -- or not sent
|         at all because an earlier report of the same process was refused -- is ONE cheap insert (a 5-second lock timeout).
|         Identified installs only, and only where the run has the Pro database open; an install without SQL (Community)
|         does nothing new. A failed insert is said ONCE and dropped -- telemetry never fails or slows a run.
|      2. THE HEARTBEAT TICK (Invoke-SIUplinkOutboxTick, engine\heartbeat\Invoke-SIHeartbeat.ps1, LAST in the tick -- the
|         heartbeat itself goes FIRST): the rows are sent again OLDEST FIRST (by the time they were kept; so each job's runs
|         reach Invardia in the order they ran), in ROUNDS: at most 20 POSTs per round, at least 65 seconds between rounds, at
|         most 5 rounds per tick. A record taken is DELETED (it reached its target). The first answer that is not ok (a 429
|         or anything else) STOPS the drain for this tick -- the record stays, with its attempt counted. A tick whose own
|         heartbeat was not taken sends nothing from the outbox. Never in an engine job.
|      3. THE BOUND (Get-SIUplinkOutboxBoundSql, applied with every insert and at the start of every tick): at most 7 days
|         and at most 5,000 rows; beyond that the OLDEST rows go and are COUNTED in cfg.InstallState 'UplinkOutbox'
|         ({ dropped, said, drainUntilUtc }) -- the tick says the drops it has not said yet, once.
|    ONE DRAIN AT A TIME: the tick takes a 15-minute lease in the same state row (drainUntilUtc) -- a second execution of
|    the heartbeat job (a manual start) sends nothing from the outbox while the first drains.
|    THE HEARTBEAT FIELD UplinkBacklog { pending, oldestUtc, checkedUtc } (SI-HeartbeatFields.ps1) is read from this table
|    (Get-SIUplinkOutboxBacklogSql) -- on every ring (Invardia deployed it 2026-11-05), its own switch turns it off.
|
|    NOTHING HERE THROWS TO ITS CALLER. PS 5.1 and 7. No PowerShell modules. A test session never opens a database (every
|    reader is a seam).
|#>
|
|$script:SIUplinkOutbox = @{
|    Table          = 'cfg.UplinkOutbox'
|    StateName      = 'UplinkOutbox'
|    MaxDays        = 7
|    MaxRows        = 5000
|    RoundSize      = 20
|    RoundWaitSec   = 65
|    MaxRounds      = 5
|    LeaseMinutes   = 15
|    InsertLockMs   = 5000
|    AnswerMax      = 400
|    JsonDepth      = 6
|    Kinds          = @('run')
|    By             = 'si-engine (uplink outbox)'
|}
|
|function Get-SIUplinkOutboxContract { $script:SIUplinkOutbox }
|
|function Get-SIUplinkOutboxInvoke {
|    <# The Pro database seam the run has open (the Pro settings layer's store), or $null: none open, or a test session. #>
|    try {
|        if (Get-Module -Name Pester) { return $null }
|        if ($global:SI_ProSettingsStore -and $global:SI_ProSettingsStore.PSObject.Properties['Invoke'] -and $global:SI_ProSettingsStore.Invoke -is [scriptblock]) { return $global:SI_ProSettingsStore.Invoke }
|    } catch { }
|    $null
|}
|
|function ConvertTo-SIUplinkOutboxJson {
|    <# PURE. A wire record as the JSON the uplink client sends (the same depth, compressed). #>
|    param([Parameter(Mandatory)]$Record)
|    $Record | ConvertTo-Json -Depth ([int]$script:SIUplinkOutbox.JsonDepth) -Compress
|}
|
|function ConvertFrom-SIUplinkOutboxJsonElement {
|    param($Element)
|    switch ([string]$Element.ValueKind) {
|        'Object' {
|            $o = [ordered]@{}
|            foreach ($p in $Element.EnumerateObject()) { $o[$p.Name] = ConvertFrom-SIUplinkOutboxJsonElement $p.Value }
|            return [pscustomobject]$o
|        }
|        'Array' {
|            $a = New-Object System.Collections.Generic.List[object]
|            foreach ($e in $Element.EnumerateArray()) { $a.Add((ConvertFrom-SIUplinkOutboxJsonElement $e)) }
|            return , $a.ToArray()
|        }
|        'String' { return $Element.GetString() }
|        'Number' { $l = 0L; if ($Element.TryGetInt64([ref]$l)) { return $l }; return $Element.GetDouble() }
|        'True' { return $true }
|        'False' { return $false }
|        default { return $null }
|    }
|}
|
|function ConvertFrom-SIUplinkOutboxJson {
|    <#
|        PURE. A kept record back as an object that the uplink client serialises to the SAME JSON: on PowerShell 7 through
|        System.Text.Json (ConvertFrom-Json there turns ISO time strings into dates, and the record would leave in another
|        form); on 5.1 ConvertFrom-Json (it keeps strings as they are).
|    #>
|    param([Parameter(Mandatory)][string]$Json)
|    $t = 'System.Text.Json.JsonDocument' -as [type]
|    if ($t) {
|        $doc = [System.Text.Json.JsonDocument]::Parse($Json)
|        try { return (ConvertFrom-SIUplinkOutboxJsonElement $doc.RootElement) } finally { $doc.Dispose() }
|    }
|    $Json | ConvertFrom-Json
|}
|
|function ConvertTo-SIUplinkOutboxAnswer {
|    <# PURE. The uplink's answer as one short line (at most 400 characters), redacted when the framework client is loaded. #>
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    $t = ("$Text" -replace '[\r\n\t]+', ' ').Trim()
|    if (-not $t) { $t = 'no answer' }
|    try { if (Get-Command -Name ConvertTo-AitUplinkRedacted -ErrorAction SilentlyContinue) { $t = ConvertTo-AitUplinkRedacted -Text $t } } catch { }
|    $max = [int]$script:SIUplinkOutbox.AnswerMax
|    if ($t.Length -gt $max) { $t = $t.Substring(0, $max - 3) + '...' }
|    $t
|}
|
|# =====================================================================================================================
|#  The statements (fixed text, every value a parameter)
|# =====================================================================================================================
|function Get-SIUplinkOutboxBoundSql {
|    <#
|        The BOUND (a fragment of a batch; needs @NowUtc, @MaxDays, @MaxRows, @StateName, @By): rows older than @MaxDays, then
|        the oldest rows beyond @MaxRows, are deleted; their number is added to cfg.InstallState @StateName 'dropped'. Leaves
|        @dropNow (int) set.
|    #>
|    @'
|    DECLARE @dropNow int = 0, @cut DATETIME2(3) = DATEADD(DAY, -@MaxDays, @NowUtc), @rowsNow bigint;
|    DELETE FROM cfg.UplinkOutbox WHERE CreatedUtc < @cut;
|    SET @dropNow = @@ROWCOUNT;
|    SELECT @rowsNow = COUNT_BIG(*) FROM cfg.UplinkOutbox;
|    IF @rowsNow > @MaxRows
|    BEGIN
|        DELETE FROM cfg.UplinkOutbox WHERE OutboxId IN (SELECT TOP (CAST(@rowsNow - @MaxRows AS int)) OutboxId FROM cfg.UplinkOutbox ORDER BY CreatedUtc, OutboxId);
|        SET @dropNow = @dropNow + @@ROWCOUNT;
|    END
|    IF @dropNow > 0 AND OBJECT_ID(N'cfg.InstallState') IS NOT NULL
|    BEGIN
|        IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @StateName)
|            UPDATE cfg.InstallState
|               SET Value = JSON_MODIFY(CASE WHEN ISJSON(Value) = 1 THEN Value ELSE N'{}' END, '$.dropped',
|                                       CAST(CASE WHEN ISJSON(Value) = 1 THEN ISNULL(TRY_CONVERT(bigint, JSON_VALUE(Value, '$.dropped')), 0) ELSE 0 END + @dropNow AS bigint)),
|                   UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By
|             WHERE Name = @StateName;
|        ELSE
|            INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@StateName, CONCAT(N'{"dropped":', @dropNow, N',"said":0}'), NULL, @By);
|    END
|'@
|}
|
|function Get-SIUplinkOutboxInsertSql {
|    <# ONE record kept (@Job, @Kind, @Json, @Answer, @NowUtc), then the bound. Answers ONE row: Kept (1 / 0 = no table yet). #>
|    $bound = Get-SIUplinkOutboxBoundSql
|    @"
|SET NOCOUNT ON;
|SET LOCK_TIMEOUT $([int]$script:SIUplinkOutbox.InsertLockMs);
|IF OBJECT_ID(N'cfg.UplinkOutbox') IS NULL
|    SELECT CAST(0 AS int) AS Kept;
|ELSE
|BEGIN
|    INSERT cfg.UplinkOutbox (Job, Kind, RecordJson, CreatedUtc, Attempts, LastAttemptUtc, LastAnswer)
|    VALUES (@Job, @Kind, @Json, @NowUtc, 1, @NowUtc, @Answer);
|$bound
|    SELECT CAST(1 AS int) AS Kept;
|END
|"@
|}
|
|function Get-SIUplinkOutboxBeginSql {
|    <#
|        The tick's start: the bound, then the drain lease (cfg.InstallState @StateName 'drainUntilUtc': taken when none is
|        set or it has run out). Answers ONE row: HasTable, Taken, Dropped, Said.
|    #>
|    $bound = Get-SIUplinkOutboxBoundSql
|    @"
|SET NOCOUNT ON;
|SET XACT_ABORT ON;
|IF OBJECT_ID(N'cfg.UplinkOutbox') IS NULL OR OBJECT_ID(N'cfg.InstallState') IS NULL
|    SELECT CAST(0 AS int) AS HasTable, CAST(0 AS int) AS Taken, CAST(0 AS bigint) AS Dropped, CAST(0 AS bigint) AS Said;
|ELSE
|BEGIN
|$bound
|    BEGIN TRAN;
|    DECLARE @v NVARCHAR(400) = NULL, @has int = 0;
|    SELECT @v = Value, @has = 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @StateName;
|    IF ISNULL(ISJSON(@v), 0) <> 1 SET @v = N'{"dropped":0,"said":0}';
|    DECLARE @until DATETIME2(0) = TRY_CONVERT(DATETIME2(0), JSON_VALUE(@v, '$.drainUntilUtc'), 127);
|    DECLARE @taken int = CASE WHEN @until IS NULL OR @until <= @NowUtc THEN 1 ELSE 0 END;
|    IF @taken = 1
|    BEGIN
|        SET @v = JSON_MODIFY(@v, '$.drainUntilUtc', CONVERT(NVARCHAR(19), DATEADD(MINUTE, @LeaseMinutes, @NowUtc), 126) + N'Z');
|        IF @has = 1 UPDATE cfg.InstallState SET Value = @v, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @StateName;
|        ELSE INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@StateName, @v, NULL, @By);
|    END
|    COMMIT;
|    SELECT CAST(1 AS int) AS HasTable, @taken AS Taken,
|           ISNULL(TRY_CONVERT(bigint, JSON_VALUE(@v, '$.dropped')), 0) AS Dropped, ISNULL(TRY_CONVERT(bigint, JSON_VALUE(@v, '$.said')), 0) AS Said;
|END
|"@
|}
|
|function Get-SIUplinkOutboxEndSql {
|    <# The tick's end: the drops said so far recorded (@Said); the lease released only by the execution that holds it (@Release = 1). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL
|    UPDATE cfg.InstallState
|       SET Value = CASE WHEN @Release = 1
|                        THEN JSON_MODIFY(JSON_MODIFY(CASE WHEN ISJSON(Value) = 1 THEN Value ELSE N'{}' END, '$.drainUntilUtc', NULL), '$.said', CAST(@Said AS bigint))
|                        ELSE JSON_MODIFY(CASE WHEN ISJSON(Value) = 1 THEN Value ELSE N'{}' END, '$.said', CAST(@Said AS bigint)) END,
|           UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By
|     WHERE Name = @StateName;
|'@
|}
|
|function Get-SIUplinkOutboxReadSql {
|    <# The next @Take rows, OLDEST first (by the time kept, then the row id). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.UplinkOutbox') IS NOT NULL
|    SELECT TOP (@Take) OutboxId, Job, Kind, RecordJson, CONVERT(NVARCHAR(23), CreatedUtc, 126) AS CreatedUtc, Attempts
|    FROM cfg.UplinkOutbox ORDER BY CreatedUtc, OutboxId;
|'@
|}
|
|function Get-SIUplinkOutboxTakenSql { 'DELETE FROM cfg.UplinkOutbox WHERE OutboxId = @Id;' }
|
|function Get-SIUplinkOutboxNotTakenSql {
|    'UPDATE cfg.UplinkOutbox SET Attempts = Attempts + 1, LastAttemptUtc = @NowUtc, LastAnswer = @Answer WHERE OutboxId = @Id;'
|}
|
|function Get-SIUplinkOutboxBacklogSql {
|    <# What is still to send: Pending (rows) and OldestUtc -- both NULL when the table is not there yet (not known). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.UplinkOutbox') IS NULL
|    SELECT CAST(NULL AS bigint) AS Pending, CAST(NULL AS DATETIME2(3)) AS OldestUtc;
|ELSE
|    SELECT COUNT_BIG(*) AS Pending, MIN(CreatedUtc) AS OldestUtc FROM cfg.UplinkOutbox;
|'@
|}
|
|function ConvertTo-SIUplinkOutboxRows {
|    <# PURE. Whatever a database seam answers (ONE array of rows, rows one by one, a single row) as rows. #>
|    param($Answer)
|    foreach ($x in @($Answer)) {
|        if ($null -eq $x -or $x -is [DBNull]) { continue }
|        if ($x -is [array]) { foreach ($y in $x) { if ($null -ne $y -and -not ($y -is [DBNull])) { $y } } } else { $x }
|    }
|}
|
|function Get-SIUplinkOutboxValue {
|    param($Row, [string]$Name)
|    if ($null -eq $Row) { return $null }
|    $v = $null
|    if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($Name)) { $v = $Row[$Name] } }
|    elseif ($Row.PSObject.Properties[$Name]) { $v = $Row.$Name }
|    if ($v -is [DBNull]) { return $null }
|    $v
|}
|
|function Get-SIUplinkOutboxParams {
|    <# The parameters every statement here shares. #>
|    param([Parameter(Mandatory)][datetime]$NowUtc)
|    $c = $script:SIUplinkOutbox
|    [ordered]@{ NowUtc = $NowUtc.ToUniversalTime(); MaxDays = [int]$c.MaxDays; MaxRows = [int]$c.MaxRows; StateName = [string]$c.StateName; By = [string]$c.By }
|}
|
|# =====================================================================================================================
|#  1. JOB END -- one cheap insert
|# =====================================================================================================================
|function Add-SIUplinkOutboxRecord {
|    <#
|        Keep ONE record that Invardia did not take (-Json: the record as it would have been sent; -Answer: what the uplink
|        said). $true = kept. NEVER throws: no database, no table yet (an install one update behind) or a failed insert is
|        $false -- a failure is said ONCE per process and the record is dropped.
|    #>
|    param([scriptblock]$Invoke, [AllowEmptyString()][string]$Job, [AllowEmptyString()][string]$Json, [AllowNull()][AllowEmptyString()][string]$Answer,
|          [string]$Kind = 'run', [datetime]$NowUtc = [datetime]::UtcNow)
|    try {
|        if (-not $Invoke -or -not "$Job".Trim() -or -not "$Json".Trim()) { return $false }
|        if ($script:SIUplinkOutbox.Kinds -notcontains $Kind) { return $false }
|        $p = Get-SIUplinkOutboxParams -NowUtc $NowUtc
|        $p.Job = ("$Job".Trim()); if ($p.Job.Length -gt 64) { $p.Job = $p.Job.Substring(0, 64) }
|        $p.Kind = $Kind; $p.Json = $Json; $p.Answer = (ConvertTo-SIUplinkOutboxAnswer $Answer)
|        $rows = @(ConvertTo-SIUplinkOutboxRows (& $Invoke (Get-SIUplinkOutboxInsertSql) $p 'reader'))
|        if (-not $rows.Count) { return $true }
|        return ([int](Get-SIUplinkOutboxValue $rows[0] 'Kept') -eq 1)
|    } catch {
|        if (-not $global:SI_UplinkOutboxWarned) {
|            $global:SI_UplinkOutboxWarned = $true
|            try { Write-Warning ("The status report could not be kept for a later send either ({0}). The run is not affected." -f (ConvertTo-SIUplinkOutboxAnswer $_.Exception.Message)) } catch { }
|        }
|        return $false
|    }
|}
|
|# =====================================================================================================================
|#  The backlog -- what the heartbeat field UplinkBacklog says
|# =====================================================================================================================
|function ConvertTo-SIUplinkBacklog {
|    <#
|        PURE. UplinkBacklog { pending, oldestUtc, checkedUtc } from the backlog row (Pending, OldestUtc): EXACTLY these
|        three keys; pending a whole number >= 0, oldestUtc ISO-8601 UTC or null, checkedUtc ISO-8601 UTC (always). Caught up
|        = pending 0, oldestUtc null -- a value, never "empty". $null = not known (no table yet / not read): the field is left out.
|    #>
|    param($Row, [Parameter(Mandatory)][datetime]$NowUtc)
|    $n = Get-SIUplinkOutboxValue $Row 'Pending'
|    if ($null -eq $n -or "$n".Trim() -eq '') { return $null }
|    $cnt = 0L
|    if (-not [long]::TryParse("$n".Trim(), [Globalization.NumberStyles]::Integer, [Globalization.CultureInfo]::InvariantCulture, [ref]$cnt) -or $cnt -lt 0) { return $null }
|    $iso = { param($v)
|        if ($null -eq $v -or "$v".Trim() -eq '') { return $null }
|        $d = $null
|        if ($v -is [datetime]) { $d = $(if ($v.Kind -eq 'Unspecified') { [datetime]::SpecifyKind($v, 'Utc') } else { $v.ToUniversalTime() }) }
|        else { try { $d = [datetime]::Parse([string]$v, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal) } catch { return $null } }
|        $d.ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) }
|    $old = if ($cnt -gt 0) { & $iso (Get-SIUplinkOutboxValue $Row 'OldestUtc') } else { $null }
|    [pscustomobject][ordered]@{ pending = [int][Math]::Min($cnt, [long][int]::MaxValue); oldestUtc = $old; checkedUtc = (& $iso $NowUtc) }
|}
|
|function Get-SIUplinkOutboxBacklog {
|    <# The backlog read through -Invoke (the Pro database). $null = no database, no table yet, or not readable. Never throws. #>
|    param([scriptblock]$Invoke, [Parameter(Mandatory)][datetime]$NowUtc)
|    try {
|        if (-not $Invoke) { return $null }
|        $rows = @(ConvertTo-SIUplinkOutboxRows (& $Invoke (Get-SIUplinkOutboxBacklogSql) @{} 'reader'))
|        if (-not $rows.Count) { return $null }
|        ConvertTo-SIUplinkBacklog -Row $rows[0] -NowUtc $NowUtc
|    } catch { $null }
|}
|
|# =====================================================================================================================
|#  2. THE HEARTBEAT TICK -- the drain, in rounds
|# =====================================================================================================================
|function Invoke-SIUplinkOutboxDrain {
|    <#
|        Send the kept records again: OLDEST first, at most -RoundSize POSTs per round, -RoundWaitSec (at least 65) between
|        rounds (-Sleep { param($Seconds) }, the test seam), at most -MaxRounds rounds. A record taken is deleted; the first
|        record NOT taken stops the drain (its attempt counted, the record kept). -Send { param($Record) } -> @{ Status; Reason }
|        (default: Send-SITelemetryRecordWithFallback through -Transport with -Context). Returns @{ Sent; Rounds; Stopped;
|        Why; Order }. Throws only when the database cannot be read (the tick says it).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][scriptblock]$Send, [Parameter(Mandatory)][datetime]$NowUtc,
|          [scriptblock]$Sleep, [int]$RoundSize = $script:SIUplinkOutbox.RoundSize, [int]$RoundWaitSec = $script:SIUplinkOutbox.RoundWaitSec,
|          [int]$MaxRounds = $script:SIUplinkOutbox.MaxRounds, [scriptblock]$Clock)
|    if ($RoundWaitSec -lt 65) { $RoundWaitSec = 65 }
|    if (-not $Sleep) { $Sleep = { param($Seconds) Start-Sleep -Seconds $Seconds } }
|    if (-not $Clock) { $Clock = { [datetime]::UtcNow } }
|    $out = [pscustomobject]@{ Sent = 0; Rounds = 0; Stopped = $false; Why = ''; Order = (New-Object System.Collections.Generic.List[long]) }
|    while ($out.Rounds -lt $MaxRounds) {
|        $rows = @(ConvertTo-SIUplinkOutboxRows (& $Invoke (Get-SIUplinkOutboxReadSql) ([ordered]@{ Take = [int]$RoundSize }) 'reader'))
|        if (-not $rows.Count) { break }
|        # the rounds keep Invardia's rate limit: a wait BEFORE every round but the first, and only when there is more to send
|        if ($out.Rounds -gt 0) { & $Sleep $RoundWaitSec }
|        $out.Rounds++
|        foreach ($row in $rows) {
|            $id = [long](Get-SIUplinkOutboxValue $row 'OutboxId')
|            $r = $null
|            try {
|                $rec = ConvertFrom-SIUplinkOutboxJson -Json ([string](Get-SIUplinkOutboxValue $row 'RecordJson'))
|                $r = & $Send $rec
|            } catch { $r = [pscustomobject]@{ Status = 'failed'; Reason = ('the kept record could not be sent: {0}' -f $_.Exception.Message) } }
|            $out.Order.Add($id)
|            $now = ([datetime](& $Clock)).ToUniversalTime()
|            if ($r -and "$($r.Status)" -eq 'ok') {
|                $null = & $Invoke (Get-SIUplinkOutboxTakenSql) ([ordered]@{ Id = $id }) 'nonquery'
|                $out.Sent++
|                continue
|            }
|            $why = ConvertTo-SIUplinkOutboxAnswer $(if ($r) { [string]$r.Reason } else { 'no answer' })
|            try { $null = & $Invoke (Get-SIUplinkOutboxNotTakenSql) ([ordered]@{ Id = $id; NowUtc = $now; Answer = $why }) 'nonquery' } catch { }
|            $out.Stopped = $true; $out.Why = $why
|            break
|        }
|        if ($out.Stopped) { break }
|        if ($rows.Count -lt $RoundSize) { break }
|    }
|    $out
|}
|
|function Invoke-SIUplinkOutboxTick {
|    <#
|        The outbox's part of ONE heartbeat tick -- called LAST in the tick, after the heartbeat itself. NEVER throws; returns
|        @{ Status; Sent; Left; Dropped; Lines } -- Status: disabled | skipped | no-table | busy | held | caught-up | drained |
|        stopped | error. Every input is a seam (tests):
|          -Invoke            the Pro database (required: no database = skipped)
|          -HeartbeatStatus   this tick's heartbeat (Send-SIHeartbeatTick's Status): failed / error = Invardia did not take
|                             it, nothing is sent from the outbox this tick (the bound and the drop count still run)
|          -Context / -Transport / -Send   the sender (default: this install's context, Send-SITelemetryUplink through
|                             Send-SITelemetryRecordWithFallback); a test session sends nothing without -Transport or -Send
|          -Sleep / -Now      the wait between rounds and the clock
|    #>
|    [CmdletBinding()]
|    param([scriptblock]$Invoke, [AllowEmptyString()][string]$HeartbeatStatus = '', $Context, [scriptblock]$Transport, [scriptblock]$Send,
|          [scriptblock]$Sleep, $Now, [hashtable]$Rounds = @{})
|    $lines = New-Object System.Collections.Generic.List[string]
|    $out = { param($s, $sent, $left, $dropped) [pscustomobject]@{ Status = $s; Sent = [int]$sent; Left = $left; Dropped = [long]$dropped; Lines = $lines.ToArray() } }
|    $nowUtc = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|    $leased = $false; $said = $null; $c = $script:SIUplinkOutbox
|    try {
|        if ((Get-Command -Name Test-SITelemetryEnabled -ErrorAction SilentlyContinue) -and -not (Test-SITelemetryEnabled)) { return (& $out 'disabled' 0 $null 0) }
|        if (-not $Invoke) { return (& $out 'skipped' 0 $null 0) }
|        $p = Get-SIUplinkOutboxParams -NowUtc $nowUtc
|        $p.LeaseMinutes = [int]$c.LeaseMinutes
|        $b = @(ConvertTo-SIUplinkOutboxRows (& $Invoke (Get-SIUplinkOutboxBeginSql) $p 'reader'))
|        $b0 = if ($b.Count) { $b[0] } else { $null }
|        if (-not $b0 -or [int](Get-SIUplinkOutboxValue $b0 'HasTable') -ne 1) { return (& $out 'no-table' 0 $null 0) }
|        $dropped = [long](Get-SIUplinkOutboxValue $b0 'Dropped'); $saidBefore = [long](Get-SIUplinkOutboxValue $b0 'Said')
|        $leased = ([int](Get-SIUplinkOutboxValue $b0 'Taken') -eq 1)
|        # the drops not said yet -- ONCE, in this tick's line (the count keeps growing; "said" remembers how far it was said)
|        $newDrops = $dropped - $saidBefore
|        if ($newDrops -gt 0) {
|            $lines.Add(('uplink outbox: {0} unsent run report(s) were dropped -- older than {1} days or beyond {2:N0} kept (the oldest go first); {3} dropped in all' -f $newDrops, $c.MaxDays, $c.MaxRows, $dropped))
|            $said = $dropped
|        }
|        if (-not $leased) { $lines.Add('uplink outbox: another execution is sending the kept run reports -- nothing sent from here'); return (& $out 'busy' 0 $null $newDrops) }
|        if ($HeartbeatStatus -in @('failed', 'error')) {
|            $left = Get-SIUplinkOutboxBacklog -Invoke $Invoke -NowUtc $nowUtc
|            if ($left -and $left.pending -gt 0) { $lines.Add(('uplink outbox: {0} run report(s) kept; not sent this tick -- Invardia did not take the heartbeat' -f $left.pending)) }
|            return (& $out 'held' 0 $(if ($left) { $left.pending } else { $null }) $newDrops)
|        }
|        if (-not $Send) {
|            if (-not $Transport -and (Get-Module -Name Pester)) { return (& $out 'skipped' 0 $null $newDrops) }
|            if (-not $Context -and (Get-Command -Name Get-SITelemetryContext -ErrorAction SilentlyContinue)) { $Context = Get-SITelemetryContext }
|            if (-not $Context -or [string]$Context.Mode -ne 'identified') { return (& $out 'skipped' 0 $null $newDrops) }
|            if (-not $Transport) { $Transport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) Send-SITelemetryUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec } }
|            $obCtx = $Context; $obTr = $Transport; $obTo = 5
|            try { $obTo = [int](Get-SITelemetrySendState).TimeoutSec } catch { $obTo = 5 }
|            # PLAIN, not a closure: the drain calls it in this function's scope chain, so $obCtx / $obTr / $obTo are the ones
|            # here -- and the sender's functions are found where the caller loaded them (a closure sees only global ones)
|            $Send = { param($Record) (Send-SITelemetryRecordWithFallback -Record $Record -Transport $obTr -Context $obCtx -TimeoutSec $obTo -NowUtc ([datetime]::UtcNow)).Result }
|        }
|        $da = @{ Invoke = $Invoke; Send = $Send; NowUtc = $nowUtc; Sleep = $Sleep }
|        foreach ($k in 'RoundSize', 'RoundWaitSec', 'MaxRounds') { if ($Rounds.ContainsKey($k)) { $da[$k] = [int]$Rounds[$k] } }
|        $d = Invoke-SIUplinkOutboxDrain @da
|        $left = Get-SIUplinkOutboxBacklog -Invoke $Invoke -NowUtc $nowUtc
|        $leftN = if ($left) { $left.pending } else { $null }
|        if ($d.Stopped) {
|            $lines.Add(('uplink outbox: {0} kept run report(s) sent, then Invardia did not take the next ({1}) -- the rest stay for the next tick ({2} kept)' -f $d.Sent, $d.Why, $(if ($null -ne $leftN) { $leftN } else { 'unknown' })))
|            return (& $out 'stopped' $d.Sent $leftN $newDrops)
|        }
|        if ($d.Sent -gt 0) {
|            $lines.Add(('uplink outbox: {0} kept run report(s) sent in {1} round(s){2}' -f $d.Sent, $d.Rounds, $(if ($leftN) { ('; {0} left for the next tick' -f $leftN) } else { '; caught up' })))
|            return (& $out 'drained' $d.Sent $leftN $newDrops)
|        }
|        & $out 'caught-up' 0 $leftN $newDrops
|    } catch {
|        $lines.Add(('uplink outbox: not sent this tick ({0})' -f (ConvertTo-SIUplinkOutboxAnswer $_.Exception.Message)))
|        & $out 'error' 0 $null 0
|    } finally {
|        if ($leased -or $null -ne $said) {
|            $sv = if ($null -ne $said) { [long]$said } else { [long]$saidBefore }
|            try { $null = & $Invoke (Get-SIUplinkOutboxEndSql) ([ordered]@{ StateName = [string]$c.StateName; By = [string]$c.By; Said = $sv; Release = $(if ($leased) { 1 } else { 0 }) }) 'nonquery' } catch { }
|        }
|    }
|}
'@ }
$__siSupportFiles['auth/SI-PlatformConnect.ps1'] = @{ Sha256 = '2da078f5be28f13cdd78b27329c3e7d07ac19544dc3eabe9fe14c7ad53ae3d12'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- sign in on an INTERNAL (AutomateIT platform) install with no PowerShell module.
|
|    The platform framework's own sign-in lives in a PowerShell module that uses the Az / Microsoft Graph modules.
|    SecurityInsight runs with no modules, so it signs in to the platform itself, over plain REST, reading exactly what
|    the framework reads and setting exactly what the framework sets:
|
|      1. bootstrap\platform-config.json  (TenantId, SubscriptionId, KeyVaultName, BootstrapAppId, BootstrapThumbprint,
|                                          BootstrapAuth = Auto | ManagedIdentity | Certificate)
|      2. the BOOTSTRAP identity (managed identity when the host has one and it works, else its certificate) reads the
|         platform Key Vault: Modern-AppId, Modern-Thumbprint (optional), Modern-Secret (only when the certificate path
|         cannot be used)
|      3. the run signs in as the MODERN identity: certificate when its thumbprint is in Key Vault AND the certificate is
|         installed and valid here, else the secret
|      4. the framework's public contract is populated -- $global:HighPriv_Modern_* , $global:AzureTenantId,
|         $global:KV_HighPriv_*, $global:AutomationFramework, $global:Context, and the SI_SPN_* / Spn* aliases -- so every
|         consumer of those globals keeps working unchanged.
|
|    Get-SIPlatformSecret reads one platform Key Vault secret as the signed-in identity. A configuration file written for
|    the framework calls Get-PlatformSecret; when the framework's module is not loaded (it never is, in SecurityInsight)
|    a compatible Get-PlatformSecret is published that does the same over REST.
|
|    PS 5.1 safe (no ?. / ??, no RSA.ImportFromPem); works on pwsh 7. Internal installs only -- never in the Community
|    edition's code path (it runs only when bootstrap\platform-config.json exists).
|#>
|
|# NO Set-StrictMode HERE -- a dot-sourced file that sets it leaks into the caller's scope.
|
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../engine/_shared/SI-AzRest.ps1') }
|# The managed-identity helper is loaded only when the bootstrap sign-in is a managed identity (inside Connect-SIPlatform):
|# the run's entry point owns that helper, and a run that never uses it never loads it.
|$__siCertFile = Join-Path $PSScriptRoot 'Find-SICertificate.ps1'
|if ((Test-Path -LiteralPath $__siCertFile) -and -not (Get-Command -Name Get-SICertificateFromStore -ErrorAction SilentlyContinue)) { . $__siCertFile }
|
|function Test-SIPlatformConfigDisabled {
|    <# True when this process must not use the machine's AutomateIT platform configuration: SI_PLATFORM_CONFIG = off
|       (the guided install sets it for its run -- live 2026-10-06 on the development machine the platform's subscription was used). #>
|    [string]([Environment]::GetEnvironmentVariable('SI_PLATFORM_CONFIG')) -match '^(?i)(off|0|false|no|disabled)$'
|}
|
|function Find-SIPlatformConfigPath {
|    <# bootstrap\platform-config.json, walking up from -Start (the framework's own rule). $null when there is none. #>
|    param([string]$Start = $PSScriptRoot)
|    # SI_PLATFORM_CONFIG=off: this run must not use the machine's platform (the guided install sets it for its run)
|    if (Test-SIPlatformConfigDisabled) { return $null }
|    $cur = $Start
|    while ($cur) {
|        $p = [System.IO.Path]::Combine($cur, 'bootstrap', 'platform-config.json')
|        if (Test-Path -LiteralPath $p) { return $p }
|        $parent = Split-Path -Parent $cur
|        if (-not $parent -or $parent -eq $cur) { break }
|        $cur = $parent
|    }
|    return $null
|}
|
|function Read-SIPlatformConfig {
|    <# The platform configuration; TenantId, SubscriptionId and KeyVaultName are required (as the framework requires). #>
|    param([Parameter(Mandatory)][string]$Path)
|    if (-not (Test-Path -LiteralPath $Path)) { throw ("The platform configuration was not found at {0}." -f $Path) }
|    try { $cfg = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json }
|    catch { throw ("The platform configuration {0} could not be read: {1}" -f $Path, $_.Exception.Message) }
|    $missing = @('TenantId', 'SubscriptionId', 'KeyVaultName' | Where-Object { -not $cfg.PSObject.Properties[$_] -or [string]::IsNullOrWhiteSpace([string]$cfg.$_) })
|    if ($missing.Count) { throw ("The platform configuration {0} is missing: {1}." -f $Path, ($missing -join ', ')) }
|    return $cfg
|}
|
|function Test-SIPlatformManagedIdentityHost {
|    <# Does this host have a managed-identity endpoint (a container, an Azure Arc server, or an Azure VM whose metadata
|       endpoint answers within 3 seconds -- the framework's Auto probe)? -Probe is a test seam. #>
|    param([scriptblock]$Probe)
|    if ([Environment]::GetEnvironmentVariable('IDENTITY_ENDPOINT')) { return $true }
|    if ($Probe) { return [bool](& $Probe) }
|    try {
|        $req = [System.Net.HttpWebRequest]::Create('http://169.254.169.254/metadata/instance?api-version=2021-02-01')
|        $req.Method = 'GET'; $req.Timeout = 3000; $req.ReadWriteTimeout = 3000
|        $req.Headers['Metadata'] = 'true'
|        $resp = $req.GetResponse(); $resp.Close(); return $true
|    } catch {
|        $we = $_.Exception
|        while ($we -and -not ($we -is [System.Net.WebException])) { $we = $we.InnerException }
|        if ($we -and $we.Response) { try { $we.Response.Close() } catch { }; return $true }   # it answered: an endpoint exists
|        return $false
|    }
|}
|
|function Get-SIPlatformBootstrapAuths {
|    <# PURE (given -HasManagedIdentity). The bootstrap sign-ins to try, in order: BootstrapAuth = ManagedIdentity ->
|       the managed identity, then the certificate when the configuration has one (the framework's cross-tenant
|       fall-through); Certificate -> the certificate; Auto -> the managed identity when the host has one, then the
|       certificate. #>
|    param([Parameter(Mandatory)]$Config, [bool]$HasManagedIdentity)
|    $mode = if ($Config.PSObject.Properties['BootstrapAuth'] -and [string]$Config.BootstrapAuth) { [string]$Config.BootstrapAuth } else { 'Auto' }
|    $appId = [string]$Config.BootstrapAppId; $thumb = ([string]$Config.BootstrapThumbprint) -replace '\s', ''
|    $cert = if ($appId -and $thumb) { @{ Mode = 'Certificate'; AppId = $appId; TenantId = [string]$Config.TenantId; Thumbprint = $thumb } } else { $null }
|    $mi = @{ Mode = 'ManagedIdentity'; ClientId = '' }
|    $out = New-Object System.Collections.Generic.List[hashtable]
|    switch -Regex ($mode) {
|        '^(?i)managedidentity$' { [void]$out.Add($mi); if ($cert) { [void]$out.Add($cert) } }
|        '^(?i)certificate$'     { if ($cert) { [void]$out.Add($cert) } }
|        default                 { if ($HasManagedIdentity) { [void]$out.Add($mi) }; if ($cert) { [void]$out.Add($cert) } }
|    }
|    if ($out.Count -eq 0) {
|        throw ("The platform configuration names no usable bootstrap sign-in (BootstrapAuth = {0}; BootstrapAppId / BootstrapThumbprint {1})." -f $mode, $(if ($cert) { 'set' } else { 'missing' }))
|    }
|    return $out.ToArray()
|}
|
|function Test-SIPlatformCertificateUsable {
|    <# Is the certificate with -Thumbprint installed (LocalMachine\My or CurrentUser\My, read through X509Store -- no
|       Cert: drive needed), with its private key, and valid today? -Find is a test seam returning what
|       Get-SICertificateFromStore returns ({ Certificate; StoreLocation }) or a bare certificate, or $null.
|       #395: Get-SICertificateFromStore returns a WRAPPER. Reading NotAfter on the wrapper gave $null, `$null -le (Get-Date)`
|       is true, and every certificate -- valid until 2028 -- was reported EXPIRED: every internal install fell back to a
|       client secret it does not have, and every run failed. The certificate's own properties are read, never the wrapper's. #>
|    param([string]$Thumbprint, [scriptblock]$Find)
|    $tp = ([string]$Thumbprint).Trim() -replace '\s', ''
|    if (-not $tp) { return $false }
|    $found = if ($Find) { & $Find $tp } else { Get-SICertificateFromStore -Thumbprint $tp }
|    if (-not $found) { return $false }
|    $c = $found
|    if ($found.PSObject.Properties['Certificate'] -and $null -ne $found.Certificate) { $c = $found.Certificate }
|    if (-not ($c -is [System.Security.Cryptography.X509Certificates.X509Certificate2])) {
|        Write-Warning ("The platform certificate {0} could not be read from the certificate store. The client secret is used instead." -f $tp)
|        return $false
|    }
|    if (-not $c.HasPrivateKey) {
|        Write-Warning ("The platform certificate {0} is installed WITHOUT its private key, so it cannot sign in. Install it with the key; the client secret is used meanwhile." -f $tp)
|        return $false
|    }
|    $now = Get-Date
|    if ($c.NotAfter -le $now) {
|        Write-Warning ("The platform certificate {0} is installed but EXPIRED on {1:yyyy-MM-dd}. Renew it; the client secret is used meanwhile." -f $tp, $c.NotAfter)
|        return $false
|    }
|    if ($c.NotBefore -gt $now) {
|        Write-Warning ("The platform certificate {0} is installed but not valid before {1:yyyy-MM-dd}. The client secret is used meanwhile." -f $tp, $c.NotBefore)
|        return $false
|    }
|    return $true
|}
|
|function Read-SIPlatformBootstrapSecret {
|    <# One platform Key Vault secret read as the BOOTSTRAP identity; $null when it does not exist. #>
|    param([Parameter(Mandatory)][string]$VaultName, [Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][hashtable]$Auth)
|    $v = Get-SIKeyVaultSecretValue -VaultName $VaultName -Name $Name -Auth $Auth
|    if ($null -eq $v) { return $null }
|    return ([string]$v).Trim()
|}
|
|function New-SIPlatformContext {
|    <# The context object the framework's consumers read ($global:Context): Tenant.Id / SubscriptionId / KeyVaultName,
|       Providers.Secret = 'KeyVault', Host.Kind = 'VM'. #>
|    param([string]$TenantId, [string]$SubscriptionId, [string]$KeyVaultName)
|    [pscustomobject]@{
|        Schema       = 'AutomateIT.Context/1'
|        StartedUtc   = [datetime]::UtcNow
|        Host         = [pscustomobject]@{ Kind = 'VM'; ComputerName = $env:COMPUTERNAME; UserName = $env:USERNAME; PSVersion = $PSVersionTable.PSVersion.ToString() }
|        Tenant       = [pscustomobject]@{ Id = $TenantId; SubscriptionId = $SubscriptionId; KeyVaultName = $KeyVaultName }
|        Providers    = [pscustomobject]@{ Secret = 'KeyVault'; State = 'None'; Log = 'Stdout' }
|        SignedInBy   = 'SecurityInsight'
|    }
|}
|
|function Connect-SIPlatform {
|    <#
|        Sign in as the platform's Modern identity (see this file's header) and populate the framework's public globals.
|        -ConfigPath: bootstrap\platform-config.json (default: found walking up from -Start). Returns the context, or $null
|        when there is no platform configuration (a Community / standalone install -- nothing to do, as the framework's own
|        back-compat entry point did). Throws when the configuration exists but the sign-in cannot be completed.
|    #>
|    [CmdletBinding()]
|    param([string]$ConfigPath, [string]$Start = $PSScriptRoot, [scriptblock]$ProbeManagedIdentity)
|    if (Test-SIPlatformConfigDisabled) { return $null }
|    if (-not $ConfigPath) { $ConfigPath = Find-SIPlatformConfigPath -Start $Start }
|    if (-not $ConfigPath -or -not (Test-Path -LiteralPath $ConfigPath)) { return $null }
|    $cfg = Read-SIPlatformConfig -Path $ConfigPath
|    $tenantId = [string]$cfg.TenantId; $subId = [string]$cfg.SubscriptionId; $kv = [string]$cfg.KeyVaultName
|
|    $hasMi = Test-SIPlatformManagedIdentityHost -Probe $ProbeManagedIdentity
|    $candidates = @(Get-SIPlatformBootstrapAuths -Config $cfg -HasManagedIdentity $hasMi)
|    $boot = $null; $appId = $null; $errors = New-Object System.Collections.Generic.List[string]
|    $miFile = Join-Path (Split-Path -Parent $MyInvocation.MyCommand.ScriptBlock.File) 'SI-ManagedIdentity.ps1'
|    foreach ($a in $candidates) {
|        if ($a.Mode -eq 'ManagedIdentity' -and -not (Get-Command -Name Get-SIManagedIdentityToken -ErrorAction SilentlyContinue) -and (Test-Path -LiteralPath $miFile)) {
|            . $miFile
|        }
|        try {
|            $appId = Read-SIPlatformBootstrapSecret -VaultName $kv -Name 'Modern-AppId' -Auth $a
|            $boot = $a
|            break
|        } catch { [void]$errors.Add(('{0}: {1}' -f $a.Mode, $_.Exception.Message)) }
|    }
|    if (-not $boot) { throw ("The platform Key Vault '{0}' could not be read with the bootstrap sign-in ({1})." -f $kv, ($errors -join ' | ')) }
|    if ([string]::IsNullOrWhiteSpace($appId)) { throw ("The platform Key Vault '{0}' has no 'Modern-AppId' secret (or it is empty)." -f $kv) }
|
|    $thumb = $null
|    try { $thumb = Read-SIPlatformBootstrapSecret -VaultName $kv -Name 'Modern-Thumbprint' -Auth $boot } catch { Write-Verbose ("Modern-Thumbprint not read: {0}" -f $_.Exception.Message) }
|    $certOk = $false
|    if ($thumb) {
|        $certOk = Test-SIPlatformCertificateUsable -Thumbprint $thumb
|        if (-not $certOk) { Write-Warning ("Key Vault names the platform certificate {0}, but it is not installed (and valid) on this host; signing in with the client secret instead." -f $thumb) }
|    }
|    $secret = $null
|    if (-not $certOk) {
|        $secret = Read-SIPlatformBootstrapSecret -VaultName $kv -Name 'Modern-Secret' -Auth $boot
|        if ([string]::IsNullOrWhiteSpace($secret)) {
|            throw ("The platform identity cannot sign in on this host: no usable certificate, and the platform Key Vault '{0}' has no 'Modern-Secret'." -f $kv)
|        }
|    }
|
|    # sign in as the Modern identity (recorded; each REST call mints its token when it needs one)
|    if ($certOk) {
|        $null = Connect-SIAzAccount -ServicePrincipal -ApplicationId $appId -CertificateThumbprint $thumb -Tenant $tenantId -Subscription $subId
|    } else {
|        $cred = New-Object System.Management.Automation.PSCredential ($appId, ([System.Net.NetworkCredential]::new('', $secret).SecurePassword))
|        $null = Connect-SIAzAccount -ServicePrincipal -Credential $cred -Tenant $tenantId -Subscription $subId
|    }
|
|    $ctx = New-SIPlatformContext -TenantId $tenantId -SubscriptionId $subId -KeyVaultName $kv
|    # the framework's public contract -- the same names and values its own sign-in sets
|    $global:Context                                     = $ctx
|    $global:AzureTenantId                               = $tenantId
|    $global:HighPriv_Modern_ApplicationID_Azure         = $appId
|    $global:HighPriv_Modern_Secret_Azure                = $secret   # $null when the certificate signs in
|    $global:HighPriv_Modern_AuthMethod                  = $(if ($certOk) { 'Cert' } else { 'Secret' })
|    $global:HighPriv_Modern_CertificateThumbprint_Azure = $(if ($certOk) { $thumb } else { $null })
|    $global:KV_HighPriv_KeyVaultName                    = $kv
|    $global:KV_HighPriv_SubscriptionId                  = $subId
|    $global:AutomationFramework                         = $true
|    $global:SI_SPN_TenantId                             = $tenantId
|    $global:SI_SPN_AppId                                = $appId
|    $global:SI_SPN_Secret                               = $secret
|    $global:SpnTenantId                                 = $tenantId
|    $global:SpnClientId                                 = $appId
|    $global:SpnClientSecret                             = $secret
|    return $ctx
|}
|
|function Get-SIPlatformSecret {
|    <# One secret from the platform Key Vault ($global:Context / $global:KV_HighPriv_KeyVaultName), read as the signed-in
|       identity. THROWS when it does not exist (the framework's rule: a caller treats an optional secret as optional
|       with try/catch). -AsPlainText returns a string, else a SecureString. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$Name, [switch]$AsPlainText, $Context)
|    if (-not $Context) { $Context = $global:Context }
|    $kv = $null
|    if ($Context -and $Context.PSObject.Properties['Tenant'] -and $Context.Tenant) { $kv = [string]$Context.Tenant.KeyVaultName }
|    if (-not $kv) { $kv = [string]$global:KV_HighPriv_KeyVaultName }
|    if (-not $kv) { throw ("Get-PlatformSecret: no platform Key Vault is known in this run, so secret '{0}' was not found." -f $Name) }
|    $v = Get-SIKeyVaultSecretValue -VaultName $kv -Name $Name
|    if ($null -eq $v) { throw ("Get-PlatformSecret: secret '{0}' not found in vault '{1}'." -f $Name, $kv) }
|    if ($AsPlainText) { return [string]$v }
|    return [System.Net.NetworkCredential]::new('', [string]$v).SecurePassword
|}
|
|# A configuration file written for the framework calls Get-PlatformSecret -Context $global:Context -Name ... . The
|# framework's module is never loaded by SecurityInsight, so the same call is answered here, over REST. Published
|# globally and self-loading: configuration files are dot-sourced inside the launcher's configuration function, where
|# this file's other functions may not be visible.
|$global:SI_PlatformConnectFile = Join-Path $PSScriptRoot 'SI-PlatformConnect.ps1'
|if (-not (Get-Command -Name Get-PlatformSecret -ErrorAction SilentlyContinue)) {
|    function global:Get-PlatformSecret {
|        [CmdletBinding()]
|        param($Context, [Parameter(Mandatory)][string]$Name, [switch]$AsPlainText)
|        if (-not (Get-Command -Name Get-SIPlatformSecret -ErrorAction SilentlyContinue)) { . $global:SI_PlatformConnectFile }
|        Get-SIPlatformSecret -Name $Name -AsPlainText:$AsPlainText -Context $Context
|    }
|}
'@ }
$__siSupportFiles['auth/Get-SIVaultName.ps1'] = @{ Sha256 = 'ebb0663efe664c2aa019929e268a8c6d5ec287211ac9e0a35a1b82f7d95422c8'; Text = @'
|#Requires -Version 5.1
|<#
|    SI -- ONE KEY VAULT, RESOLVED IN ONE PLACE.
|
|    🔒 Operator, 2026-08-31: *"use the keyvault for the SI instance, so it is captured into one SI
|    keyvault."*
|
|    🔴 THE PROBLEM THIS FIXES IS THAT SI ALREADY NAMED ITS VAULT THREE WAYS, and each caller picked
|    one:
|      $global:SI_KeyVaultName        written by the Config Wizard (Write-SICustomConfig.ps1)
|      $global:SpnKeyVaultName        the name the config reference shows (Connect-SIAzCli read it; deleted)
|      $env:SI_DIAGNOSTICS_VAULT      the diagnostics scripts' own resolution
|    A customer who set one and not the others got a component that could not find the vault -- and the
|    failure surfaces as "no credential", which reads like a permissions problem and is not. Three
|    spellings of one fact is the same defect class as `EgNodeId`/`ExposureGraphNodeId`, which cost a
|    silent correlation split.
|
|    ✅ SO: every SI component resolves the vault through HERE, in a fixed order, and any one of the
|    three globals being set is enough. Nothing is renamed and no existing install breaks -- the
|    resolution simply stops depending on which name the customer happened to use.
|
|    ⛔ NO DEFAULT, EVER. There is no sensible fallback vault name: guessing one would send a secret
|    read at some other customer's vault, or at an internal one. Unresolved is an error with a message
|    that says what to set.
|
|    NO Set-StrictMode here -- it leaks into the caller's scope (measured 2026-08-12).
|#>
|
|function Get-SIVaultName {
|    <#
|        The SI Key Vault for this install.
|
|          -VaultName  an explicit override, which always wins (a CLI parameter, a test)
|
|        Order after that: SI_KeyVaultName -> SpnKeyVaultName -> SI_DIAGNOSTICS_VAULT env ->
|        SI_DiagnosticsVaultName. The diagnostics names come LAST on purpose: they exist so a
|        developer's sandbox vault is reachable, and they must never take precedence over a customer's
|        configured vault on a real run.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter()][string]$VaultName,
|        # Return $null instead of throwing. For callers that treat "no vault" as a supported state --
|        # the CMDB connector's plan-only path needs no secrets at all.
|        [Parameter()][switch]$AllowMissing
|    )
|
|    if (-not [string]::IsNullOrWhiteSpace($VaultName))                       { return $VaultName.Trim() }
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_KeyVaultName))  { return ([string]$global:SI_KeyVaultName).Trim() }
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SpnKeyVaultName))  { return ([string]$global:SpnKeyVaultName).Trim() }
|    if (-not [string]::IsNullOrWhiteSpace([string]$env:SI_DIAGNOSTICS_VAULT)){ return ([string]$env:SI_DIAGNOSTICS_VAULT).Trim() }
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_DiagnosticsVaultName)) { return ([string]$global:SI_DiagnosticsVaultName).Trim() }
|
|    if ($AllowMissing) { return $null }
|    throw ('SI: no Key Vault is configured. Set $global:SI_KeyVaultName in config\SecurityInsight.custom.ps1 ' +
|           '(the Config Wizard writes it for you). $global:SpnKeyVaultName is also accepted for installs ' +
|           'that predate that name. The vault holds the SPN secret and any integration credentials, and ' +
|           'there is deliberately no default -- guessing a vault name would send a secret read somewhere ' +
|           'it does not belong.')
|}
|
|# ---------------------------------------------------------------------------------------------------
|# THE SERVICENOW SECRET NAMES, in one place so the connector and the diagnostics cannot drift.
|#
|# 🔑 CANONICAL NAMES FIRST, LEGACY SECOND. The diagnostics scripts seeded `servicenow-pdi-*` while the
|# connector was being proven against a developer instance. Those keep working -- an operator should not
|# have to re-seed a vault to pick up a rename -- but a new install gets the `SI-ServiceNow-*` names,
|# which say which SOLUTION owns them in a vault that may hold secrets for several.
|# ---------------------------------------------------------------------------------------------------
|$script:SIServiceNowSecretNames = [ordered]@{
|    Instance = @('SI-ServiceNow-Instance', 'servicenow-pdi-instance')
|    User     = @('SI-ServiceNow-User',     'servicenow-pdi-user')
|    Password = @('SI-ServiceNow-Password', 'servicenow-pdi-password')
|}
|
|function Get-SIServiceNowSecretName {
|    <# The candidate secret names for one part, canonical first. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][ValidateSet('Instance','User','Password')][string]$Part)
|    @($script:SIServiceNowSecretNames[$Part])
|}
|
|function Get-SIServiceNowCredentialFromVault {
|    <#
|        The ServiceNow instance URL and integration credential, from the ONE SI vault.
|
|        Returns @{ Instance; Credential; InstanceSecretName } or $null when the vault holds none of
|        them -- which is a supported state for a plan-only run and must not throw there.
|
|        🪤 A PARTIAL SET IS AN ERROR, NOT A DEGRADED SUCCESS. An instance URL with no credential would
|        build a connection that fails on the first call with a 401, which reads like a permissions
|        problem at the customer's end. Say which secret is missing instead.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter()][string]$VaultName,
|        # Injectable so this is testable without a vault. Takes (vault, secretName), returns the value
|        # or $null.
|        [Parameter()][scriptblock]$Reader
|    )
|
|    $vault = Get-SIVaultName -VaultName $VaultName -AllowMissing
|    if ([string]::IsNullOrWhiteSpace($vault)) { return $null }
|
|    if (-not $Reader) {
|        $Reader = {
|            param($v, $n)
|            try { Get-SIKvSecret -VaultName $v -SecretName $n } catch { $null }
|        }
|    }
|
|    $found = @{}
|    foreach ($part in @('Instance','User','Password')) {
|        foreach ($name in (Get-SIServiceNowSecretName -Part $part)) {
|            $val = & $Reader $vault $name
|            if (-not [string]::IsNullOrWhiteSpace([string]$val)) {
|                $found[$part] = [string]$val
|                if ($part -eq 'Instance') { $found['InstanceSecretName'] = $name }
|                break
|            }
|        }
|    }
|
|    if ($found.Count -eq 0) { return $null }
|
|    $missing = @()
|    foreach ($part in @('Instance','User','Password')) { if (-not $found.ContainsKey($part)) { $missing += $part } }
|    if ($missing.Count -gt 0) {
|        throw ("SI: the ServiceNow credential in Key Vault '{0}' is INCOMPLETE -- missing {1}. Expected {2}. " -f `
|                $vault, ($missing -join ', '),
|                (@('Instance','User','Password') | ForEach-Object { (Get-SIServiceNowSecretName -Part $_)[0] }) -join ' / ') +
|              'A partial set would build a connection that fails on the first call with a 401, which reads like a permissions problem at the customer end.'
|    }
|
|    $sec = New-Object System.Security.SecureString
|    foreach ($ch in ([string]$found['Password']).ToCharArray()) { $sec.AppendChar($ch) }
|    $sec.MakeReadOnly()
|
|    [pscustomobject]@{
|        Instance           = [string]$found['Instance']
|        Credential         = (New-Object System.Management.Automation.PSCredential([string]$found['User'], $sec))
|        InstanceSecretName = [string]$found['InstanceSecretName']
|        VaultName          = $vault
|    }
|}
'@ }
$__siSupportFiles['auth/Get-SIKvSecret.ps1'] = @{ Sha256 = '0072740691d0711931706bdd1e2b18434a4d090557226e5b0a3a496d6f3715ec'; Text = @'
|#Requires -Version 5.1
|<#
|    Get-SIKvSecret -- runtime KV secret fetch for SecurityInsight engines.
|
|    Designed to be called from config/SecurityInsight.custom.ps1 at config-
|    load time so high-value secrets (Storage account keys, Shodan API key,
|    Azure OpenAI key) live ONLY in Key Vault and are pulled fresh into
|    in-memory globals on every launcher run -- never persisted to disk.
|
|    Auth strategy (in order) -- plain REST, no PowerShell module:
|      1. The run's own sign-in (what the launcher recorded with Connect-SIAzAccount, else the configured
|         SPN certificate / secret)
|      2. Otherwise a Managed Identity: user-assigned via $global:SI_ManagedIdentityClientId /
|         SI_KvMiClientId / SI_UAMI_ClientId when set, else the system-assigned one (typical internal VM)
|
|    Returns the secret as a plain string. Caller assigns it to a $global:
|    variable that the engines read.
|
|    Example use in config/SecurityInsight.custom.ps1:
|        . "$PSScriptRoot\..\auth\Get-SIKvSecret.ps1"
|        $kv = '<your-key-vault-name>'
|        $global:SI_Shodan_ApiKey = Get-SIKvSecret -VaultName $kv -SecretName 'SI-Shodan-ApiKey'
|        $global:OpenAI_apiKey    = Get-SIKvSecret -VaultName $kv -SecretName 'OpenAI-ApiKey'
|
|    Storage needs no secret: it is reached with the signed-in identity's Storage
|    Blob/Table/Queue Data Contributor roles.
|
|    Notes
|    -----
|    * PS 5.1 safe (no -AsPlainText switch which is PS 7+).
|    * No PowerShell module needed: the secret is read over REST (engine/_shared/SI-AzRest.ps1).
|    * No fallback to plaintext globals -- this helper is opt-in. If the
|      customer prefers plaintext, just don't call it.
|    * Returns $null (NOT throws) when the secret doesn't exist OR the
|      caller lacks Get-Secret RBAC -- engines will throw their own missing-
|      value error which is more actionable than a KV stack trace.
|#>
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../engine/_shared/SI-AzRest.ps1') }
|
|function Get-SIKvSecret {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$VaultName,
|        [Parameter(Mandatory)][string]$SecretName
|    )
|
|    # ---- 1. Make sure a sign-in is known (recorded; the token is minted over REST on the read) ----
|    $ctx = Get-SIAzContext -ErrorAction SilentlyContinue
|    if (-not $ctx) {
|        # Try managed identity first (system-assigned, then user-assigned via global)
|        try {
|            # #222: the install's one managed-identity client id; SI_KvMiClientId is the older name.
|            $kvMi = if ($global:SI_ManagedIdentityClientId) { [string]$global:SI_ManagedIdentityClientId }
|                    elseif ($global:SI_KvMiClientId) { [string]$global:SI_KvMiClientId }
|                    else { [string]$global:SI_UAMI_ClientId }
|            if ($kvMi) {
|                Connect-SIAzAccount -Identity -AccountId $kvMi -WarningAction SilentlyContinue -ErrorAction Stop | Out-Null
|            } else {
|                Connect-SIAzAccount -Identity -WarningAction SilentlyContinue -ErrorAction Stop | Out-Null
|            }
|        } catch {
|            throw "Get-SIKvSecret: no sign-in is configured and the managed identity could not be used. Either run on an Azure VM with a managed identity assigned, or configure the SecurityInsight sign-in before loading custom.ps1. Inner: $($_.Exception.Message)"
|        }
|    }
|
|    # ---- 2. Pull the secret ----
|    try {
|        $sec = Get-SIAzKeyVaultSecret -VaultName $VaultName -Name $SecretName -ErrorAction Stop
|    } catch {
|        Write-Warning ("Get-SIKvSecret: failed to read '{0}' from KV '{1}': {2}" -f $SecretName, $VaultName, $_.Exception.Message)
|        return $null
|    }
|    if (-not $sec) { return $null }
|
|    # PS 5.1: convert SecureString -> plain text via NetworkCredential
|    return [System.Net.NetworkCredential]::new('', $sec.SecretValue).Password
|}
'@ }
$__siSupportFiles['engine/SI-FeatureCatalog.ps1'] = @{ Sha256 = '1313bf7e4404e75c99a4fb424b68453af1d0f95327314b438742b0dd7050d13a'; Text = @'
|#Requires -Version 5.1
|<#
|.SYNOPSIS
|    LIC-1 -- SecurityInsight's feature catalog and the one gate its engines call.
|
|.DESCRIPTION
|    The licence FORMAT, signature and validity rules are FRAMEWORK-level (sync/_AitLicense.ps1 -- one
|    implementation, every solution). This file owns only the half that is genuinely SecurityInsight's:
|    WHICH FEATURES ARE PAID, where an install's licence comes from, and what a refused feature does.
|
|    🔒 THE RULE THIS FILE EXISTS TO ENFORCE (operator, 2026-09-08):
|        "license is only needed if not free" / "so license req is not for all a req"
|    A FREE feature never touches the licence path at all -- Test-SIFeatureAvailable returns for a free
|    feature BEFORE any licence is loaded, so a missing, expired, corrupt or wrong-tenant licence cannot
|    affect anything free. Community users hold no licence and must never be able to notice licensing.
|
|    🔒 v3 EDITIONS (operator rulings 2026-09-29, SI #159):
|      * Pro = the ServiceNow connector, the CMDB in SQL and its connectors, governance (departments, governance mails,
|        the task digest). Everything else is the Community edition: profilers, tier classifier, cross-engine
|        correlation and the full asset properties (owner 2026-10-27, #750 (1)), every Risk Analysis report, the AI
|        summary, trend, all outputs, the generic CSV CMDB, VM and container hosting, Shodan, asset tagging (#750 (2)),
|        verification and data health (#750 (8)).
|      * ENFORCED from v3 launch -- SI Pro is PAID. This replaces the 2026-09-08 ship-OFF default on
|        purpose. There is deliberately no customer switch: the only config an install has is the
|        customer's own, and a switch there would be a free Pro edition. (-Enforce stays for tests.)
|      * THE DATABASE AND THE WEB APP ARE IN BOTH VERSIONS (owner 2026-10-18, #750 (a); #477, #480, #678): the settings
|        database ('settings-database') and the data backend ('data-backend' -- the data sync, the Risk Analysis store, the
|        CIs in SQL) are no longer paid. They are not in the catalog any more, so they are free by the rule below (their
|        call sites keep their gate call: a no-op for a free feature). The paid features of the database chain are named
|        instead: 'governance' (departments, governance mails, the task digest) and 'cmdb-connectors' (the CMDB in SQL).
|      * Delivered as the Key Vault secret 'SI-License' (the signed file as JSON or base64), read at runtime
|        on VM and container alike; a licence file in config\ is the fallback.
|
|    🔑 TWO GATES, DIFFERENT QUESTIONS (LIC-3). ring = WHEN a version reaches you; licence = WHETHER you may
|    run a feature. And a CAPABILITY is not a FEATURE: capabilities in solution.deploy.json are ring-gated
|    INSTALL units; features here are licence-gated BEHAVIOUR. A required capability may never be Pro.
|
|    🔑 THE VERIFIER IS LOADED FROM SI's OWN COPY (engine/_shared/AitLicense.ps1, byte-identical to
|    sync/_AitLicense.ps1 -- a test fails on drift). sync/ is not in a container image or the public mirror,
|    so the previous "search upward for sync/" found nothing there and would have refused every Pro feature.
|
|    🔒 THE EDITION DECIDES, NOT features[] (framework §12.6a LICENCE-FEATURES, SI #510; owner 2026-10-09: "but does that
|    mean we have to sign licenses when new features are released, that is not smart"). The signed licence names the
|    EDITION in its `sku`; THIS file maps edition -> features:
|      * a Pro edition (sku Pro / Pro-Business / Pro-DesignPartner / Trial / any Pro-*) = EVERY catalog entry with
|        Edition 'Pro', current and future -- a Pro licence issued before a feature existed already covers it;
|      * an MSP edition (sku naming MSP) = the Pro features + the entries with Edition 'MSP' (multi-tenant; none today);
|      * Pro Business vs Pro Enterprise differ by the signed `limits`, never by features;
|      * features[] is informational, and counts ONLY for an entry marked AddOn = $true (an explicit paid add-on, which
|        needs its own id in features[]; '*' does not cover an add-on). There are NO add-ons today.
|    A licence that is not valid / in grace, not bound to this tenant, or whose sku names no Pro edition (Community,
|    Core, empty) gives Community. The shared verifier (AitLicense.ps1) is unchanged: SI asks it for the status and the
|    tenant binding, and applies the edition rule here, at its own call site.
|
|    🔴 ABSENCE IS NOT REMEDIATION (working rule 4). A refused Pro engine SKIPS and says why; it never
|    publishes an empty result, and no close path acts on the absence of its output.
|#>
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '_shared/SI-AzRest.ps1') }
|
|Set-StrictMode -Off
|
|# ---------------------------------------------------------------------------
|# THE CATALOG. Everything not listed here is FREE -- the default is free, so a
|# feature can never become paid by omission or typo, only by a deliberate entry.
|#
|# 🪤 NAME THE CONNECTOR PRECISELY. SI's INBOUND CSV provider was called
|# `servicenow-cmdb` until v2.2.421, it is FREE, and ~510 report references depend on
|# it. A loosely worded "ServiceNow = Pro" would gate the free CSV importer.
|#
|# Edition = 'Pro' (every Pro edition has it) | 'MSP' (multi-tenant; the MSP edition only).
|# AddOn   = $true only for an explicit paid add-on that the licence must LIST in features[] (#510). None today.
|# ---------------------------------------------------------------------------
|$script:SIFeatureCatalog = @(
|    [pscustomobject]@{
|        Name        = 'servicenow-connector'
|        Edition     = 'Pro'
|        Built       = $true
|        Title       = 'The ServiceNow CMDB connector'   # short name for the one-line skip message customers see
|        Description = 'ServiceNow CMDB connector (match and create CIs, vulnerability close-loop). Distinct from the free inbound CMDB CSV import.'
|    }
|    # 'correlation' (cross-engine correlation and the full asset properties) is NOT here any more: it is in the Community
|    # edition (owner 2026-10-27, SI #750 (1) / #678 -- "data in, data correlation, ra + data out to excel are part of
|    # community"). Unknown = free, so every call site that still names it runs in both editions.
|    [pscustomobject]@{
|        Name        = 'governance'
|        Edition     = 'Pro'
|        Built       = $true
|        Title       = 'Departments, governance and follow-up tasks'
|        Description = 'Asset responsibility put to work: the department reports, the governance mails (exemptions, remediation flows, vendor escalation) and the daily task digest.'
|    }
|    [pscustomobject]@{
|        Name        = 'cmdb-connectors'
|        Edition     = 'Pro'
|        Built       = $true
|        Title       = 'The CMDB in SQL and its connectors'
|        Description = 'The CMDB kept in the SecurityInsight database: the SQL CMDB connector and the CMDB import. Distinct from the free inbound CMDB CSV file.'
|    }
|)
|
|function Get-SIFeatureCatalog {
|    <# .SYNOPSIS Every PAID feature SI knows about. Everything else is free by default. #>
|    [CmdletBinding()] param()
|    return @($script:SIFeatureCatalog)
|}
|
|function Test-SIFeatureIsPaid {
|    <#
|    .SYNOPSIS
|        PURE. Is this feature paid? Unknown names are FREE.
|    .DESCRIPTION
|        🔒 UNKNOWN => FREE, deliberately. Guessing the other way means a typo in a call site silently
|        gates a shipped free feature for every customer at once. A typo in a PAID call site costs an
|        ungated paid feature -- recoverable, and the wiring tests name every paid call site.
|    #>
|    [CmdletBinding()] param([Parameter(Mandatory)][string]$Feature)
|    foreach ($f in $script:SIFeatureCatalog) {
|        if ("$($f.Name)" -ieq "$Feature".Trim()) { return ("$($f.Edition)" -in @('Pro', 'MSP')) }
|    }
|    return $false
|}
|
|function Get-SILicenceEdition {
|    <#
|    .SYNOPSIS
|        PURE. The EDITION a licence's signed sku names: 'MSP' | 'Pro' | 'Community' (framework §12.6a, SI #510).
|    .DESCRIPTION
|        Reads only the sku -- not the status, the tenant or features[] (Test-SIFeatureAvailable checks those).
|        Pro = a sku that starts with 'Pro' or 'Trial' as a word: Pro, Pro-Business, Pro Enterprise, Pro-DesignPartner,
|        pro-single-tenant, Trial. MSP = a sku naming 'msp' as a word (Pro-MSP, pro-msp). Anything else -- Community,
|        the verifier's 'Core' for no licence, an empty sku -- is Community.
|    #>
|    param([AllowNull()]$License)
|    if ($null -eq $License) { return 'Community' }
|    $sku = "$($License.Sku)".Trim()
|    if ($sku -match '(?i)(^|[^a-z])msp([^a-z]|$)') { return 'MSP' }
|    if ($sku -match '(?i)^(pro|trial)([^a-z]|$)') { return 'Pro' }
|    return 'Community'
|}
|
|function Test-SILicenceCoversFeature {
|    <#
|    .SYNOPSIS
|        PURE. Does a licence that is ALREADY valid/grace and bound to this tenant cover this paid catalog entry?
|        Returns @{ Allowed; Reason }. The edition decides; features[] only for an add-on (#510).
|    #>
|    param([AllowNull()]$License, [Parameter(Mandatory)][object]$Entry)
|    $name = "$($Entry.Name)"
|    if ([bool]$Entry.AddOn) {
|        foreach ($f in @($License.Features | Where-Object { $_ })) {
|            if ("$f".Trim() -ieq $name) { return [pscustomobject]@{ Allowed = $true; Reason = "the licence lists the add-on '$name'" } }
|        }
|        return [pscustomobject]@{ Allowed = $false; Reason = "'$name' is an add-on and the licence does not list it" }
|    }
|    $ed = Get-SILicenceEdition -License $License
|    $need = if ("$($Entry.Edition)" -ieq 'MSP') { 'MSP' } else { 'Pro' }
|    if ($ed -eq 'MSP' -or ($need -eq 'Pro' -and $ed -eq 'Pro')) {
|        return [pscustomobject]@{ Allowed = $true; Reason = "the $ed edition covers '$name'" }
|    }
|    $skuText = "$($License.Sku)".Trim(); if (-not $skuText) { $skuText = 'none' }
|    if ($need -eq 'MSP' -and $ed -eq 'Pro') { return [pscustomobject]@{ Allowed = $false; Reason = "'$name' is part of the MSP edition; this licence is $skuText" } }
|    return [pscustomobject]@{ Allowed = $false; Reason = "the licence names no SecurityInsight Pro edition (sku $skuText)" }
|}
|
|function Get-SIFrameworkLicensePath {
|    <#
|    .SYNOPSIS
|        The framework licence verifier for this install: SI's own copy first, then sync/ upward.
|    .DESCRIPTION
|        Returns $null when neither exists rather than throwing -- a free feature must still run.
|    #>
|    [CmdletBinding()] param([string]$StartPath)
|    $own = [IO.Path]::Combine($PSScriptRoot, '_shared', 'AitLicense.ps1')
|    if (-not "$StartPath".Trim() -and (Test-Path -LiteralPath $own)) { return $own }
|    $p = if ("$StartPath".Trim()) { $StartPath } elseif ($PSScriptRoot) { $PSScriptRoot } else { (Get-Location).Path }
|    for ($i = 0; $i -lt 6; $i++) {
|        # [IO.Path]::Combine, not Join-Path: Join-Path throws on a missing drive.
|        $cand = [IO.Path]::Combine($p, 'sync', '_AitLicense.ps1')
|        if (Test-Path -LiteralPath $cand) { return $cand }
|        $parent = Split-Path -Parent $p
|        if (-not $parent -or $parent -eq $p) { break }
|        $p = $parent
|    }
|    return $null
|}
|
|function ConvertFrom-SILicenseText {
|    <# The secret holds the licence file as raw JSON or base64 of it. Returns the parsed document or $null. #>
|    param([AllowNull()][string]$Text)
|    if ([string]::IsNullOrWhiteSpace($Text)) { return $null }
|    $t = $Text.Trim()
|    if (-not $t.StartsWith('{')) {
|        try { $t = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($t)).Trim() } catch { return $null }
|    }
|    try { return ($t | ConvertFrom-Json -ErrorAction Stop) } catch { return $null }
|}
|
|function Get-SILicenseSecretText {
|    <# The SI-License secret, without the customer having to edit their config. Never throws. #>
|    if ($global:SI_License) { return [string]$global:SI_License }
|    # an internal install: the platform Key Vault (signed in by SecurityInsight itself -- auth/SI-PlatformConnect.ps1)
|    if ($global:Context -and $global:KV_HighPriv_KeyVaultName) {
|        try {
|            if (-not (Get-Command -Name Get-SIPlatformSecret -ErrorAction SilentlyContinue)) { . ([IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'auth', 'SI-PlatformConnect.ps1')) }
|            return [string](Get-SIPlatformSecret -Context $global:Context -Name 'SI-License' -AsPlainText -ErrorAction Stop)
|        } catch { }
|    }
|    # The vault is resolved the way every other SI component resolves it (#173): SI_KeyVaultName, then the
|    # 2.2.x name SpnKeyVaultName, ... -- an upgraded install carrying only the older name was otherwise
|    # "unlicensed" while its licence sat in the vault it already uses for its SPN secret.
|    if (-not (Get-Command -Name Get-SIVaultName -ErrorAction SilentlyContinue)) {
|        $vaultHelper = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'auth', 'Get-SIVaultName.ps1')
|        if (Test-Path -LiteralPath $vaultHelper) { . $vaultHelper }
|    }
|    $vault = $null
|    if (Get-Command -Name Get-SIVaultName -ErrorAction SilentlyContinue) { try { $vault = Get-SIVaultName -AllowMissing } catch { } }
|    elseif ($global:SI_KeyVaultName) { $vault = [string]$global:SI_KeyVaultName }
|    if ($vault) {
|        if (-not (Get-Command -Name Get-SIKvSecret -ErrorAction SilentlyContinue)) {
|            $kvHelper = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'auth', 'Get-SIKvSecret.ps1')
|            if (Test-Path -LiteralPath $kvHelper) { . $kvHelper }
|        }
|        if (Get-Command -Name Get-SIKvSecret -ErrorAction SilentlyContinue) {
|            try { return [string](Get-SIKvSecret -VaultName $vault -SecretName 'SI-License') } catch { }
|        }
|    }
|    return $null
|}
|
|# Load the framework verifier ONCE, at file scope, so its functions outlive any one call. (Dot-sourcing it
|# inside a function defines them in that function's scope, and they vanish when it returns.) Loading the
|# verifier's CODE is not consulting a licence: a free feature still never reads one.
|$script:SIFrameworkLicensePath = Get-SIFrameworkLicensePath
|if ($script:SIFrameworkLicensePath) { . $script:SIFrameworkLicensePath }
|
|$script:SILicenseCache  = $null
|$script:SILicenseWarned = @{}
|
|# Framework LICENCE-DIMENSION (owner 2026-10-08): Pro has two dimensions, decided by the SIGNED licence -- Pro Business =
|# the payload carries a `limits` object (SecurityInsight reads `devices`), Pro Enterprise = no `limits`. Community has no
|# limits. A limit is a WARNING, never a stop: nothing here gates a feature or a run (the web app shows the banner).
|function ConvertTo-SILicenceLimits {
|    <#
|        PURE. The payload's `limits` value -> an ordered map name (lower-case) -> whole number, or $null when it is not an
|        object (absent / null / text / a number = no limits = Pro Enterprise). A value that is not a whole number is dropped,
|        never guessed; an empty object stays an empty map (the licence IS Business, without a SecurityInsight limit).
|    #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -isnot [System.Management.Automation.PSCustomObject]) { return $null }
|    $m = [ordered]@{}
|    foreach ($p in $Value.PSObject.Properties) {
|        $v = $p.Value
|        if (($v -is [int] -or $v -is [long]) -and $v -ge 0 -and $v -le [int]::MaxValue) { $m[$p.Name.ToLowerInvariant()] = [int]$v }
|    }
|    return $m
|}
|
|function Get-SILicenceLimitsOf {
|    <#
|        The limits of a VERIFIED licence, read ONLY from its signed payload bytes (payloadB64): a `limits` on the outer
|        document is not signed and is never read. $null for a licence that did not verify, or that names no limits.
|    #>
|    param([AllowNull()]$Document, [AllowNull()]$License)
|    if ($null -eq $Document -or $null -eq $License) { return $null }
|    if ("$($License.Status)" -notin @('Valid', 'Grace', 'NotYetValid', 'Expired')) { return $null }
|    try {
|        $p = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("$($Document.payloadB64)")) | ConvertFrom-Json -ErrorAction Stop
|        if ("$($p.licenseId)" -ne "$($License.LicenseId)") { return $null }
|        if ($p.PSObject.Properties.Name -contains 'limits') { return (ConvertTo-SILicenceLimits -Value $p.limits) }
|    } catch { }
|    return $null
|}
|
|function Get-SILicenceDimension {
|    <# PURE. 'Pro Business' | 'Pro Enterprise' | 'Community' for a licence: Pro while it is valid or in grace. #>
|    param([AllowNull()]$License)
|    if ($null -eq $License -or "$($License.Status)" -notin @('Valid', 'Grace')) { return 'Community' }
|    if ((Get-SILicenceEdition -License $License) -eq 'Community') { return 'Community' }   # #510: the sku names the edition
|    if ($License.PSObject.Properties['Limits'] -and $null -ne $License.Limits) { return 'Pro Business' }
|    return 'Pro Enterprise'
|}
|
|function Get-SILicense {
|    <#
|    .SYNOPSIS
|        This install's licence status (cached per process): Key Vault secret first, then config\.
|        Always a status object (Missing / Invalid / NotYetValid / Valid / Grace / Expired), never a throw.
|    #>
|    [CmdletBinding()]
|    param(
|        [AllowNull()][string]$SecretText,          # tests inject; absent = read the real sources
|        [AllowNull()][string]$LicenseDirectory,    # tests inject; absent = the solution's config\
|        [AllowNull()][string[]]$TrustedCertsB64,   # tests inject a throwaway signer
|        [AllowNull()][object]$Now,
|        [switch]$Refresh
|    )
|    $injected = $PSBoundParameters.ContainsKey('SecretText') -or $PSBoundParameters.ContainsKey('LicenseDirectory') -or
|                $PSBoundParameters.ContainsKey('TrustedCertsB64') -or $PSBoundParameters.ContainsKey('Now')
|    if ($script:SILicenseCache -and -not $Refresh -and -not $injected) { return $script:SILicenseCache }
|
|    if (-not (Get-Command -Name Resolve-AitLicenseStatus -ErrorAction SilentlyContinue)) {
|        return [pscustomobject]@{ Status = 'Missing'; Reason = 'the framework licence verifier is not installed'; Customer = ''; Features = @(); TenantIds = @(); Source = 'none'; Limits = $null }
|    }
|
|    $text = if ($PSBoundParameters.ContainsKey('SecretText')) { $SecretText } else { Get-SILicenseSecretText }
|    if (-not [string]::IsNullOrWhiteSpace($text)) {
|        $doc = ConvertFrom-SILicenseText -Text $text
|        $lic = Resolve-AitLicenseStatus -Document $doc -TrustedCertsB64 $TrustedCertsB64 -Now $Now
|        if ($null -eq $doc) { $lic.Status = 'Invalid'; $lic.Reason = 'the SI-License secret is neither licence JSON nor base64 of it' }
|        Add-Member -InputObject $lic -NotePropertyName Source -NotePropertyValue 'Key Vault secret SI-License' -Force
|        Add-Member -InputObject $lic -NotePropertyName Limits -NotePropertyValue (Get-SILicenceLimitsOf -Document $doc -License $lic) -Force
|    } else {
|        $dir = if ("$LicenseDirectory".Trim()) { $LicenseDirectory } else { [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'config') }
|        $lic = Get-AitLicense -Directory $dir -TrustedCertsB64 $TrustedCertsB64 -Now $Now
|        Add-Member -InputObject $lic -NotePropertyName Source -NotePropertyValue $(if ($lic.Path) { "file $($lic.Path)" } else { 'none' }) -Force
|        # the file is read again for its limits -- and verified again, so a file swapped in between gives none
|        $limits = $null
|        if ($lic.Path) {
|            try {
|                $fdoc = Get-Content -LiteralPath $lic.Path -Raw -Encoding UTF8 | ConvertFrom-Json -ErrorAction Stop
|                $again = Resolve-AitLicenseStatus -Document $fdoc -TrustedCertsB64 $TrustedCertsB64 -Now $Now
|                if ($again.Status -eq $lic.Status) { $limits = Get-SILicenceLimitsOf -Document $fdoc -License $again }
|            } catch { $limits = $null }
|        }
|        Add-Member -InputObject $lic -NotePropertyName Limits -NotePropertyValue $limits -Force
|    }
|    if (-not $injected) { $script:SILicenseCache = $lic }
|    return $lic
|}
|
|function Get-SIRunTenantId {
|    # #232 (operator: "validate license against the tenant so license can not be copied to other tenants" -- "must also
|    # work if customer use spn"). A MANAGED IDENTITY's token always comes from its home tenant, so the tenant is the
|    # 'tid' of the identity's own token (recorded by Get-SIManagedIdentityToken), never a configured value the customer
|    # controls. Unprovable = a value no licence names, so a tenant-bound licence fails CLOSED.
|    # An SPN's token is issued by the configured tenant, so for an SPN the configured tenant IS where the engine runs.
|    if ([bool]$global:SI_UseManagedIdentity) {
|        if (-not $global:SI_IdentityTokenTenantId -and (Get-Command -Name Get-SIManagedIdentityToken -ErrorAction SilentlyContinue)) {
|            try { $null = Get-SIManagedIdentityToken -Resource 'https://management.azure.com/' } catch { }
|        }
|        if ($global:SI_IdentityTokenTenantId) { return [string]$global:SI_IdentityTokenTenantId }
|        return 'unproven-managed-identity-tenant'
|    }
|    $t = @($global:SI_SPN_TenantId, $global:AzureTenantId, $global:TenantId) | Where-Object { $_ } | Select-Object -First 1
|    if (-not $t) { try { $t = [string](Get-SIAzContext -ErrorAction Stop).Tenant.Id } catch { } }
|    return [string]$t
|}
|
|function Test-SIFeatureAvailable {
|    <#
|    .SYNOPSIS
|        THE call-site gate. May this feature run? Returns @{ Allowed; Edition; Reason }.
|    .DESCRIPTION
|        🔒 ORDER IS THE CONTRACT, and it is asserted in tests:
|          1. FREE feature          -> allowed IMMEDIATELY. No licence is loaded, looked for, or consulted.
|          2. paid, -Enforce $false -> allowed (TESTS ONLY -- production has no such switch).
|          3. paid                  -> the framework verifier gives the status and the tenant binding (valid or
|                                      grace, bound to this tenant); then the EDITION the sku names decides
|                                      (§12.6a, #510): a Pro edition runs every Pro entry, current and future,
|                                      whatever features[] says. features[] counts only for an AddOn entry.
|        Grace runs, with one warning per feature per process.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$Feature,
|        [Parameter()][AllowNull()][string]$TenantId,
|        [Parameter()][AllowNull()][string]$LicenseDirectory,
|        [Parameter()][AllowNull()][object]$License,
|        [Parameter()][AllowNull()][object]$Enforce
|    )
|
|    # 1. FREE -- return before anything licence-shaped happens.
|    if (-not (Test-SIFeatureIsPaid -Feature $Feature)) {
|        return [pscustomobject]@{ Allowed = $true; Edition = 'Free'; Reason = "'$Feature' is a free feature -- no licence is required or consulted" }
|    }
|    if ($null -ne $Enforce -and -not [bool]$Enforce) {
|        return [pscustomobject]@{ Allowed = $true; Edition = 'Pro'; Reason = "enforcement is OFF for this call -- '$Feature' runs unlicensed" }
|    }
|
|    if ($null -eq $License) {
|        $License = if ("$LicenseDirectory".Trim()) { Get-SILicense -LicenseDirectory $LicenseDirectory -SecretText '' } else { Get-SILicense }
|    }
|    if (-not (Get-Command -Name Test-AitLicenseTenant -ErrorAction SilentlyContinue)) {
|        return [pscustomobject]@{ Allowed = $false; Edition = 'Pro'; Reason = "the framework licence verifier is not installed -- cannot establish entitlement for '$Feature'" }
|    }
|    if (-not "$TenantId".Trim()) { $TenantId = Get-SIRunTenantId }
|    # the verifier's status + tenant binding, then the edition (never features[] for an edition feature -- #510)
|    if ($null -eq $License -or "$($License.Status)" -notin @('Valid', 'Grace')) {
|        $st = if ($License) { "$($License.Status)" } else { 'Missing' }
|        $res = [pscustomobject]@{ Allowed = $false; Reason = "no entitlement: licence status is $st" }
|    } elseif (-not (Test-AitLicenseTenant -License $License -TenantId $TenantId)) {
|        $res = [pscustomobject]@{ Allowed = $false; Reason = "licence '$($License.Customer)' is not valid for tenant $TenantId" }
|    } else {
|        $entry = $script:SIFeatureCatalog | Where-Object { "$($_.Name)" -ieq "$Feature".Trim() } | Select-Object -First 1
|        $res = Test-SILicenceCoversFeature -License $License -Entry $entry
|    }
|    if ($res.Allowed -and "$($License.Status)" -eq 'Grace' -and -not $script:SILicenseWarned[$Feature]) {
|        $script:SILicenseWarned[$Feature] = $true
|        Write-Warning ("Your SecurityInsight Pro licence {0}. '{1}' keeps running until the grace period ends." -f $License.Reason, $Feature)
|    }
|    return [pscustomobject]@{ Allowed = [bool]$res.Allowed; Edition = 'Pro'; Reason = "$($res.Reason)" }
|}
|
|function Get-SIEdition {
|    <# 'Pro' when the licence entitles any paid EDITION feature for this tenant, else 'Community'. An add-on alone (#510)
|       does not make an install Pro. #>
|    param([AllowNull()][object]$License, [AllowNull()][string]$TenantId)
|    foreach ($f in @($script:SIFeatureCatalog | Where-Object { -not [bool]$_.AddOn })) {
|        if ((Test-SIFeatureAvailable -Feature $f.Name -License $License -TenantId $TenantId).Allowed) { return 'Pro' }
|    }
|    return 'Community'
|}
|
|function Assert-SIFeatureOrSkip {
|    <#
|    .SYNOPSIS
|        The one call a paid engine makes at its start. $true = run. $false = one plain line saying the feature
|        is part of SecurityInsight Pro and why it did not run; the engine then ends successfully WITHOUT
|        producing output, so nothing downstream reads an empty result as "everything was resolved".
|    #>
|    param([Parameter(Mandatory)][string]$Feature, [AllowNull()][string]$TenantId)
|    $r = Test-SIFeatureAvailable -Feature $Feature -TenantId $TenantId
|    # #277: a licence in its grace period, or an installed licence that does not let a Pro job run, is a guard trip
|    # (mail + telemetry, once per feature per process). No licence at all is the Community edition -- not a trip.
|    if ((Get-Command -Name Send-SIGuardEvent -ErrorAction SilentlyContinue) -and (Test-SIFeatureIsPaid -Feature $Feature)) {
|        if ($null -eq $script:SILicenseGuardSent) { $script:SILicenseGuardSent = @{} }
|        if (-not $script:SILicenseGuardSent.ContainsKey($Feature)) {
|            try {
|                $lic = Get-SILicense 3>$null
|                $st = if ($lic) { [string]$lic.Status } else { 'Missing' }
|                if ($r.Allowed -and $st -eq 'Grace') {
|                    $script:SILicenseGuardSent[$Feature] = $true
|                    $null = Send-SIGuardEvent -GuardId 'licence.state.grace' -Outcome 'warning' -Subject $Feature -Detail ('The SecurityInsight Pro licence {0}.' -f $lic.Reason)
|                } elseif (-not $r.Allowed -and $st -notin @('Missing', '')) {
|                    $script:SILicenseGuardSent[$Feature] = $true
|                    $null = Send-SIGuardEvent -GuardId 'licence.state.invalid' -Outcome 'refused' -Subject $Feature -Detail ('{0} did not run: {1}' -f $Feature, $r.Reason)
|                }
|            } catch { }
|        }
|    }
|    if ($r.Allowed) { return $true }
|    $entry = $script:SIFeatureCatalog | Where-Object { $_.Name -ieq $Feature } | Select-Object -First 1
|    $what = $null
|    if ($entry) { $what = $entry.Title; if (-not $what) { $what = $entry.Description } }
|    if (-not $what) { $what = $Feature }
|    Write-Host (" [INFO] {0} is part of SecurityInsight Pro and did not run ({1}). Nothing was changed or published; the previous results stay as they were." -f $what, $r.Reason)
|    return $false
|}
|
|function Test-SILicenseForInstall {
|    <#
|      PURE (#173). May this licence be INSTALLED? Checked by setup\Set-SILicense.ps1 before anything is written,
|      so a bad licence is refused at the desk instead of discovered as "Pro silently skipped" on the next run.
|        * the signature/dates must verify: Valid, Grace (renew now) or NotYetValid (starts later) -- never
|          Invalid / Expired / Missing;
|        * it must unlock something (#510, framework §12.6a): its sku names a Pro edition, or it lists an add-on
|          SecurityInsight has. features[] is informational for an edition licence, so a Pro licence with an empty or
|          old features[] installs; feature ids SecurityInsight does not have are a NOTE, never a refusal. (The first
|          licence issued granted 'SI.ServiceNow' / 'SI.Correlation' -- under the edition rule its sku Pro covers SI.)
|        * when it is bound to tenants and the tenant is known, this tenant must be one of them.
|      Returns @{ Ok; Problems; Notes; Edition; Summary }.
|    #>
|    param(
|        [Parameter(Mandatory)][object]$License,          # Get-SILicense / Resolve-AitLicenseStatus output
|        [AllowEmptyCollection()][string[]]$KnownFeatures = @(),
|        [AllowNull()][string]$TenantId
|    )
|    $problems = New-Object System.Collections.Generic.List[string]
|    $notes = New-Object System.Collections.Generic.List[string]
|    $st = "$($License.Status)"
|    if ($st -notin 'Valid', 'Grace', 'NotYetValid') { $problems.Add(("the licence does not verify: {0} ({1})" -f $st, $License.Reason)) }
|    $feats = @($License.Features | Where-Object { $_ } | ForEach-Object { "$_".Trim() })
|    $edition = Get-SILicenceEdition -License $License
|    $addOns = @($script:SIFeatureCatalog | Where-Object { [bool]$_.AddOn } | ForEach-Object { "$($_.Name)" })
|    $listedAddOns = @($feats | Where-Object { $addOns -contains $_ })
|    if ($edition -eq 'Community' -and -not $listedAddOns.Count) {
|        $skuText = "$($License.Sku)".Trim(); if (-not $skuText) { $skuText = 'none' }
|        $problems.Add(("the licence names no SecurityInsight Pro edition (sku {0}) and lists no add-on, so it unlocks nothing" -f $skuText))
|    }
|    $unknown = @($feats | Where-Object { $_ -ne '*' -and ($KnownFeatures -notcontains $_) })
|    if ($unknown.Count) { $notes.Add(("features[] names ids SecurityInsight does not have: {0} -- informational only, the edition decides" -f ($unknown -join ', '))) }
|    $ids = @($License.TenantIds | Where-Object { $_ })
|    if ($ids.Count -and "$TenantId".Trim() -and -not (@($ids | Where-Object { "$_".Trim() -ieq "$TenantId".Trim() }).Count)) {
|        $problems.Add(("it is bound to tenant(s) {0}, not to this tenant {1}" -f ($ids -join ', '), $TenantId))
|    }
|    $summary = "{0} -- {1}; edition: {2}; features: {3}; tenants: {4}" -f $License.Customer, $License.Reason, $edition, $(if ($feats.Count) { $feats -join ', ' } else { 'none listed' }), $(if ($ids.Count) { $ids -join ', ' } else { 'any' })
|    [pscustomobject]@{ Ok = ($problems.Count -eq 0); Problems = $problems.ToArray(); Notes = $notes.ToArray(); Edition = $edition; Summary = $summary }
|}
'@ }
$__siSupportFiles['engine/_shared/AitLicense.ps1'] = @{ Sha256 = 'b430fd4a5f8850e5ef0439b66c4b1f2e6798f0f5a563a2c195d15c1ec0e357f3'; Text = @'
|#Requires -Version 5.1
|<#
|.SYNOPSIS
|    LIC-1 -- the FRAMEWORK licence verifier. One implementation, every solution.
|
|.DESCRIPTION
|    The licence FORMAT is framework-wide by design: a customer holding one file for two
|    products must get identical semantics from both. LIC-1 therefore rules out the obvious
|    shortcut -- "Not chosen: copying PIM's verifier into SI ... two verifiers would drift
|    into two meanings of the same file" -- and LIC-3 places the verifier here, "beside
|    sync/_AitRings.ps1 as shared code that PIM and SI both call, with each solution keeping
|    only its own feature list."
|
|    So this file owns VERIFICATION. It deliberately owns nothing else:
|
|      here (framework)     : signature, validity window, grace, tenant binding, feature match
|      per solution         : the feature CATALOG, and what a gated feature does when refused
|
|    File format, as emitted by TOOLS/New-AitLicense.ps1:
|      { "product": "...", "payloadB64": "<b64 payload JSON>", "signature": "<b64 RSA sig>" }
|      payload: { licenseId, customer, sku, features[], tenantIds[], validFrom, validTo, graceDays }
|
|    Signature is RSA-SHA256 / PKCS#1 over the RAW PAYLOAD BYTES -- verified against the exact
|    payloadB64 bytes, never a re-serialised object, so JSON canonicalisation can never change
|    the answer.
|
|    🔒 OFFLINE. No activation, no call-home, no endpoint. Customers on locked-down automation
|    servers need nothing but the file. Only the PUBLIC certificate is embedded; the private key
|    never leaves the development machine.
|
|    🪤 SIGNED != FOUND (LIC-1 first issuance, 2026-09-05). The crypto half of a migration can
|    land while the DISCOVERY half does not, and the symptom -- Status=Missing -- is EXACTLY the
|    quiet resting state of an unlicensed install. The failure mode of a licensing system is
|    indistinguishable from its correct idle state, so discovery is treated as a first-class
|    concern here and tested on its own.
|
|.NOTES
|    PS 5.1: the certificate is loaded from raw bytes (X509Certificate2) and RSA comes via
|    RSACertificateExtensions. NOT RSA.ImportFromPem -- that is .NET Core 3.0+ / PS 7 only and
|    would break every customer engine, which run on 5.1.
|#>
|
|Set-StrictMode -Off
|
|# Public certificate of the framework licensing signer, CN=AutomateIT-Licensing-Service.
|# PUBLIC half only. Byte-identical to the copy PIM embeds, so a licence issued by
|# TOOLS/New-AitLicense.ps1 verifies the same under either until PIM migrates onto this file.
|$script:AitLicenseSignerCertB64 = 'MIIFFzCCAv+gAwIBAgIQNY8l3/KZOoxF7K1nXIXwazANBgkqhkiG9w0BAQsFADAnMSUwIwYDVQQDDBxBdXRvbWF0ZUlULUxpY2Vuc2luZy1TZXJ2aWNlMB4XDTI2MDgxMTEzMDY0NloXDTQ2MDgxMTEzMTE0NlowJzElMCMGA1UEAwwcQXV0b21hdGVJVC1MaWNlbnNpbmctU2VydmljZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALuth8WywLfudbaoZ6eR570apvs5LXzOeGfl5Z14z6Nl6DQgvwMLXG/8lZEHOCKsHWVtEnjZOZigsh4c16owJVhuW67OgY0Iy6OjmfeXzu+kcTICSdZ+Qj3ecsGp1Cz6Xo1AjYbgIORdqUBncy4BAuA1bxH0E+V+1zT+ltEk840xpLdWde+m7W8q7BrG9klh+xQl8xJTjeliyV0JN2mvBjI0JwB9t9vL2/luMWWtHp752/ZG4Icd9u6HyqSR/xEmlZIjkZwI7LEPLTICXV1iA3c3nFUEHkLhLlpDW6EQn3cip0Sijr7SVWEBH1fCA8vCo+PxIEgJc3RXaeRhqD4UOwPJIziHtrpy8+9L15zrhXnhIGZv2mUAHKiamUIOmKl9vj31vFp/vJx1chE0XA358T09HGu0jKgSbbC4afKQPKf3v+BHPU42T/xIOPMxDJWuFqKvr4anL7P5PEkTjycBRCkXnIPC5PlrXR/ZZz4oit4WKhbdzONYwb8CKnsF2Z9IVL9yviVJxAIr7kiGqRme9+H0t5A+hzAydxdFMQnop+R8Q02a0sei9WrdtCbwLempVVrXIS6N4hh5kvLqMouDi62b0h645UNk2cWahDIZWTKd/MYdlcdrtRt5muy2LOasHByVxUrZKwH7IetCmv+Kkm1BfMF6Fvi1Jh2Qgz4bo5XJAgMBAAGjPzA9MA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBT+IiWP1iqSIwaRLiV1somJAQ+ELjANBgkqhkiG9w0BAQsFAAOCAgEAFiDfl7nhDNIywkCZgu9iw0RtJUyJqiq8y+fXomucqowAQZKPhkpuHftZZjtDe09WM35TqjRgL7hqmJiEgqPlRrAv78FjE41RwMcANN2PVCrdcMcuDVdRbS40rObpp0B6+uVUiWY4+8MW6G8Wv+7CIBUEP8ypo3BhxQJZLpyJDKLNiPqnTVKOmYXe7BivfVz63F2Pg2dNXic1poQ7S6JTi/8FM4AV2Ge/zVQF+LaiIuBDJX3JjHnKXxNf1Zhk8PF6DeWaVSNyXtjESlaUfsz0U2Ue87UUZ8ELIuqjHTpG66HPInblBZme6VvR13n5QxmnvjPXdtmXAJzDzCf+76labSGQu9fMFxUoKwjAwT9vHrdFw8JEStappW7urXj+Oafp1wVafJOXzjd9utr8WT3AhaPeqMx3FYH20e2b7QNCI3owtm0ogHRg36neahe78PikiMe15AUpD3+BD6pKeLV7tsExeXZjxDxhFUSpScD0TrCOUEJdKL2Cfx8rM3ceISSiTTYmuJmU7fznQ122A6GNW58mpSk8miPYb3MzbLW0JFPRrEDiyT8dW1M9s98DL+7VR0z2QxgxhNMKyrVgBM7YgQtbtPLz26NBqAQsqG50rOdn7XmprzvnTmnb+r2PUQuqb6rCTAQFTJ3MjH7BviP3GkwJyvzMZ+S6OnUAGB2Fn3Y='
|
|# LIC-4 (operator 2026-10-03): the Invardia licence signer, CN=Invardia-Licensing (thumbprint BA65E6AA62128EBE89A743722E404980F6D2878D,
|# RSA 4096, valid to 2036-10-03). PUBLIC half only. Trusted ALONGSIDE the AutomateIT signer above -- never instead of it -- so
|# every licence already issued keeps verifying, and Invardia switches its signer only after this release is rolled out.
|# Byte-identical to the copy PIM embeds (engine/_shared/PIM-License.ps1) and to SI's copy of this file.
|$script:AitLicenseInvardiaCertB64 = 'MIIFQDCCAyigAwIBAgIQXXs1IY0ZQE2MwtugYutXwDANBgkqhkiG9w0BAQsFADAdMRswGQYDVQQDExJJbnZhcmRpYS1MaWNlbnNpbmcwHhcNMjYxMDAzMTY1NDMxWhcNMzYxMDAzMTcwNDMxWjAdMRswGQYDVQQDExJJbnZhcmRpYS1MaWNlbnNpbmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCn9X21WYLer9r3ojq9lCP3eGV5YK8UMHoyyGT/q8carwQK+ztBRweKAgHyg8rr67utZ1zZBDRei64T/63nXGZpC666efzNZjIU+Og7vtO0bTNjQm/yVD/Q4KFZachYbE5orU+99HQcgRrcwnmmltyazyun2MV2CTk2nUDeMX5IIFD/1yIT8SLNFa6b6Gy4Ms/TIlc4u3lEH3zjbTSF+phSrbv7J6ytz5Eq1ahRkKHWcdBoF9GJo2ynWP0vTGHWvvjNdeVpXP1rkGnLt9MAQj2Us/2XiTgZzf26QLNiXX9YeJeUA9IVdPWczJav+YYkcICyG4ynwhPCudI6S2iDeu8jyL54gfVT871/+RFebzKHq9teY2vB0aGsbaW9VOmV5dDQ2mVfQLFTkNd1ByeZKv9tR0vPfaiZCza+DedApF2LfoAa7Y34pb9WHGRJFAPVmG2WMSsTY90Y0VBYrktF4g4q712W2ZdQc+QIxtvP5nsz6bk1QBvJ1Hcsr/euiysxmkFxcl3NH7WM1EKzdzUaYDJpysoE9e0jkjdJpb9bNNmSE7V9IMTk7r/XOiYJ+8qOALTgwUIEyOLi/hfOihJDRn31aJ6aPvzCEYikueJV5oALrDxquiXbPi8z10aMuXLL4hfi6B7U0qo2kOTPQ9Qh/cJFVkV9pEXjtY+NwwI9EtxgaQIDAQABo3wwejAOBgNVHQ8BAf8EBAMCB4AwCQYDVR0TBAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYDVR0jBBgwFoAUuZzWkYh3hkE0oJH42LneYVKXIzowHQYDVR0OBBYEFLmc1pGId4ZBNKCR+Ni53mFSlyM6MA0GCSqGSIb3DQEBCwUAA4ICAQCluVZnotzEyS5ux+4hMuz9mOfpSJCNg5nkS8XxIHySiE2AEjVT4ZFEyykZUFoROv5clLBkO5icvDDRBitkeKHvioZruRPtVGy0fs0VxJ4VMcOU/i5cVdJXBQeyUFE8o//4+7FXZp10ToVNv/drjdO7adcNHRVjsddm2mXPNyHmE07ErV6eInPj+r0/1dogPBW1knF+T53RTwT2O0Ppe5qK0QEdBfo5sf4nvjg7ONNXYlW38SzXGLsXy6TZphRWqxLq7u31HAwujQGy9syO+TPIzusH1WHkCsvjDDRXNI8iYhKcS2wq/P/O6O4Ebt/PFN0hxyzyuYx4kreXKKhqrfsEMDxzMUQNnUEjFgU4/4atLVJpBvoDmb/MuQDIzlhxz8obAJi5BuxyjyemR9jg6XMIE2IAhe1v+MN0ZY58tbZR3t5rF30tp541NRaJfn4DBpqNmAIFyDQMdM2FogkFoOV+Mo0IBmGzV/jyv/2z+sre1P5MncLP2qZhfFmu595gWnNoOsMdUZmEWMkbISMGvGzfpPRF3IBan+fymCZSsKNB00E3W50Sh/t2sopEYc3eSwpu6bhvPUgB2ZKU6KN49Al4Pf41uldHVY0aVVp+kpLmRntDFzkTNXUG4OWOwF5gHuGY8jIrwDR7pCPSNzDWrUf857O6DyWEsHXERWg5OPLNUg=='
|
|# Every trusted signer, in the order they are tried (a licence is valid if ANY of them verifies it).
|$script:AitLicenseTrustedCertsB64 = @($script:AitLicenseSignerCertB64, $script:AitLicenseInvardiaCertB64)
|
|# Extensions a licence may use, MOST SPECIFIC FIRST. A solution-specific file wins a tie so an
|# existing per-solution licence keeps precedence over a framework-wide one in the same folder.
|$script:AitLicenseExtensions = @('.pimlicense', '.silicense', '.aitlicense')
|
|<#
|.SYNOPSIS
|    PURE. Verify an RSA-SHA256/PKCS#1 signature over raw payload bytes.
|
|.DESCRIPTION
|    Returns $true only on a genuine match. Every failure path -- malformed certificate,
|    unusable key, bad signature -- returns $false rather than throwing, because a verifier
|    that throws on a tampered file turns "refuse this licence" into "crash the engine".
|#>
|function Test-AitLicenseSignature {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][byte[]]$PayloadBytes,
|        [Parameter(Mandatory)][byte[]]$SignatureBytes,
|        [Parameter(Mandatory)][string]$PublicCertB64
|    )
|    try {
|        $certBytes = [Convert]::FromBase64String($PublicCertB64)
|        $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2(, $certBytes)
|        $rsa  = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPublicKey($cert)
|        if (-not $rsa) { return $false }
|        return $rsa.VerifyData(
|            $PayloadBytes,
|            $SignatureBytes,
|            [System.Security.Cryptography.HashAlgorithmName]::SHA256,
|            [System.Security.Cryptography.RSASignaturePadding]::Pkcs1)
|    } catch { return $false }
|}
|
|<#
|.SYNOPSIS
|    PURE. Turn a licence document + a clock into a status. No disk, no network.
|
|.DESCRIPTION
|    Split out from any file handling deliberately: this is where every rule that matters
|    lives, so it must be testable without writing a file. `Get-AitLicense` is the thin
|    impure wrapper that finds a file and calls this.
|
|.PARAMETER Document
|    The parsed licence object ({ payloadB64, signature }).
|
|.PARAMETER TrustedCertsB64
|    Accepted signers, in order. A caller mid-migration passes its legacy key as a second
|    entry so anything already issued keeps verifying -- there is no cutover and no reissue.
|
|.PARAMETER Now
|    Injected clock. A licence verifier whose tests cannot control time can only be tested
|    on the day the fixtures happen to be valid.
|
|.OUTPUTS
|    Status: Missing | Invalid | NotYetValid | Valid | Grace | Expired
|    Core is NEVER affected by any of them -- see Test-AitLicenseFeature.
|#>
|function Resolve-AitLicenseStatus {
|    [CmdletBinding()]
|    param(
|        [Parameter()][AllowNull()][object]$Document,
|        [Parameter()][AllowNull()][string[]]$TrustedCertsB64,
|        [Parameter()][AllowNull()][object]$Now
|    )
|
|    $result = [pscustomobject]@{
|        Status     = 'Missing'; Reason = 'no licence document supplied'
|        Customer   = ''; Sku = 'Core'; LicenseId = ''
|        Features   = @(); TenantIds = @()
|        ValidFrom  = $null; ValidTo = $null; GraceUntil = $null
|    }
|    if ($null -eq $Document) { return $result }
|
|    $today = if ($Now) { ([datetime]$Now).Date } else { (Get-Date).Date }
|    $certs = @($TrustedCertsB64 | Where-Object { $_ })
|    if (-not $certs.Count) { $certs = @($script:AitLicenseTrustedCertsB64) }
|
|    try {
|        if (-not $Document.payloadB64 -or -not $Document.signature) {
|            throw "not an AutomateIT licence (payloadB64/signature missing)"
|        }
|        $payloadBytes = [Convert]::FromBase64String("$($Document.payloadB64)")
|        $sigBytes     = [Convert]::FromBase64String("$($Document.signature)")
|
|        # Try every trusted signer. Order matters only for speed -- a licence is valid if ANY
|        # trusted key verifies it, which is what makes a signer migration a non-event.
|        $ok = $false
|        foreach ($c in $certs) {
|            if (Test-AitLicenseSignature -PayloadBytes $payloadBytes -SignatureBytes $sigBytes -PublicCertB64 $c) { $ok = $true; break }
|        }
|        if (-not $ok) {
|            $result.Status = 'Invalid'
|            $result.Reason = 'signature verification FAILED (file tampered, or not issued by a trusted AutomateIT licensing key)'
|            return $result
|        }
|
|        $p = [System.Text.Encoding]::UTF8.GetString($payloadBytes) | ConvertFrom-Json
|        $result.Customer  = "$($p.customer)"
|        $result.Sku       = "$($p.sku)"
|        $result.LicenseId = "$($p.licenseId)"
|        $result.Features  = @($p.features  | Where-Object { $_ })
|        $result.TenantIds = @($p.tenantIds | Where-Object { $_ })
|        # InvariantCulture, always. On da-DK "08/27/2026" parses as day 8 of month 27 and throws;
|        # the same locale bug already ate a promotedUtc stamp once (RING-7).
|        $result.ValidFrom = [datetime]::Parse("$($p.validFrom)", [System.Globalization.CultureInfo]::InvariantCulture).Date
|        $result.ValidTo   = [datetime]::Parse("$($p.validTo)",   [System.Globalization.CultureInfo]::InvariantCulture).Date
|
|        $graceDays = 30
|        if ($p.PSObject.Properties.Name -contains 'graceDays' -and "$($p.graceDays)" -match '^\d+$') { $graceDays = [int]$p.graceDays }
|        $result.GraceUntil = $result.ValidTo.AddDays($graceDays)
|
|        if     ($today -lt $result.ValidFrom)  { $result.Status = 'NotYetValid'; $result.Reason = "licence starts $($result.ValidFrom.ToString('yyyy-MM-dd'))" }
|        elseif ($today -le $result.ValidTo)    { $result.Status = 'Valid';       $result.Reason = "valid until $($result.ValidTo.ToString('yyyy-MM-dd'))" }
|        elseif ($today -le $result.GraceUntil) { $result.Status = 'Grace';       $result.Reason = "EXPIRED $($result.ValidTo.ToString('yyyy-MM-dd')) -- grace until $($result.GraceUntil.ToString('yyyy-MM-dd')), renew now" }
|        else                                   { $result.Status = 'Expired';     $result.Reason = "expired $($result.ValidTo.ToString('yyyy-MM-dd')) (grace ended $($result.GraceUntil.ToString('yyyy-MM-dd')))" }
|    } catch {
|        $result.Status = 'Invalid'
|        $result.Reason = "licence could not be read: $($_.Exception.Message)"
|    }
|    return $result
|}
|
|<#
|.SYNOPSIS
|    PURE. Is this licence bound to the tenant we are actually running against?
|
|.DESCRIPTION
|    An EMPTY or absent tenantIds list means "any tenant" -- that is the deliberate shape for
|    a site licence. A non-empty list binds, and the binding is the Entra tenant GUID.
|
|    🔒 A licence that names other tenants is NOT a licence for this one. That is the whole
|    point of binding, and it is why LIC-2 refuses to let a per-tenant licence be baked into a
|    build context shared by three tenants' images.
|#>
|function Test-AitLicenseTenant {
|    [CmdletBinding()]
|    param(
|        [Parameter()][AllowNull()][object]$License,
|        [Parameter()][AllowNull()][string]$TenantId
|    )
|    if ($null -eq $License) { return $false }
|    $ids = @($License.TenantIds | Where-Object { $_ })
|    # LIC anti-copy (operator 2026-10-03): a licence that names NO tenant is valid in NO tenant -- it used to be valid in
|    # every tenant, which made a copied file work anywhere. Every licence ever issued names its tenant(s).
|    if (-not $ids.Count) { return $false }
|    if (-not "$TenantId".Trim()) { return $false }      # bound, but we do not know who we are
|    foreach ($i in $ids) { if ("$i".Trim() -ieq "$TenantId".Trim()) { return $true } }
|    return $false
|}
|
|<#
|.SYNOPSIS
|    PURE. May this feature run?
|
|.DESCRIPTION
|    🔒 THE INVARIANT (LIC-1): a REQUIRED capability must never be Pro, and Core is never
|    affected by licence state. So this answers only for features a catalog has declared Pro;
|    everything else is free and must never be routed through here.
|
|    Grace counts as entitled -- that is what a grace window is for. Expired and Invalid do not.
|    '*' in the feature list means every Pro feature, which is how a site licence is expressed.
|
|.PARAMETER Enforce
|    🔒 ENFORCEMENT SHIPS OFF (LIC-1). With -Enforce absent, this returns $true with a reason
|    saying so: every feature behaves as though licensed, with no nag. That is what makes it
|    safe to issue licences to all ~30 customers and populate the registry BEFORE anything is
|    gated -- the rollout and the enforcement are separate events, and only the second one can
|    break somebody.
|#>
|function Test-AitLicenseFeature {
|    [CmdletBinding()]
|    param(
|        [Parameter()][AllowNull()][object]$License,
|        [Parameter(Mandatory)][string]$Feature,
|        [Parameter()][AllowNull()][string]$TenantId,
|        [switch]$Enforce
|    )
|
|    if (-not $Enforce) {
|        return [pscustomobject]@{ Allowed = $true; Reason = 'enforcement is OFF -- every feature runs (LIC-1 default posture)' }
|    }
|    if ($null -eq $License -or $License.Status -notin @('Valid', 'Grace')) {
|        $st = if ($License) { "$($License.Status)" } else { 'Missing' }
|        return [pscustomobject]@{ Allowed = $false; Reason = "no entitlement: licence status is $st" }
|    }
|    if (-not (Test-AitLicenseTenant -License $License -TenantId $TenantId)) {
|        return [pscustomobject]@{ Allowed = $false; Reason = "licence '$($License.Customer)' is not valid for tenant $TenantId" }
|    }
|    $feats = @($License.Features | Where-Object { $_ })
|    if ($feats -contains '*')       { return [pscustomobject]@{ Allowed = $true; Reason = "site licence ('*') covers '$Feature'" } }
|    foreach ($f in $feats) { if ("$f".Trim() -ieq "$Feature".Trim()) { return [pscustomobject]@{ Allowed = $true; Reason = "licensed for '$Feature'" } } }
|    return [pscustomobject]@{ Allowed = $false; Reason = "licence does not include feature '$Feature'" }
|}
|
|<#
|.SYNOPSIS
|    Find a licence file in a directory. IMPURE (disk), and separated for exactly that reason.
|
|.DESCRIPTION
|    🪤 THIS FUNCTION IS WHY LIC-1's FIRST ISSUANCE FAILED. The issuer wrote
|    `<customer>.aitlicense` while discovery globbed `*.pimlicense` only, so a correctly signed
|    licence reported Status=Missing -- indistinguishable from having no licence at all.
|    Accept EVERY known extension, most specific first.
|#>
|function Find-AitLicenseFile {
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$Directory)
|
|    if (-not (Test-Path -LiteralPath $Directory)) { return $null }
|    $rank = @{}
|    for ($i = 0; $i -lt $script:AitLicenseExtensions.Count; $i++) { $rank[$script:AitLicenseExtensions[$i]] = $i }
|
|    $f = Get-ChildItem -LiteralPath $Directory -File -ErrorAction SilentlyContinue |
|             Where-Object { $script:AitLicenseExtensions -contains $_.Extension.ToLowerInvariant() } |
|             Sort-Object @{ Expression = { $rank[$_.Extension.ToLowerInvariant()] } }, Name |
|             Select-Object -First 1
|    if ($f) { return $f.FullName }
|    return $null
|}
|
|<#
|.SYNOPSIS
|    Load + verify a licence. The thin impure wrapper over Resolve-AitLicenseStatus.
|
|.PARAMETER Path
|    A specific licence file. Wins over -Directory, and is what tests use.
|
|.PARAMETER Directory
|    Where to look when no -Path is given.
|#>
|function Get-AitLicense {
|    [CmdletBinding()]
|    param(
|        [Parameter()][AllowNull()][string]$Path,
|        [Parameter()][AllowNull()][string]$Directory,
|        [Parameter()][AllowNull()][string[]]$TrustedCertsB64,
|        [Parameter()][AllowNull()][object]$Now
|    )
|
|    $file = if ("$Path".Trim()) { $Path } elseif ("$Directory".Trim()) { Find-AitLicenseFile -Directory $Directory } else { $null }
|
|    if (-not $file -or -not (Test-Path -LiteralPath $file)) {
|        $r = Resolve-AitLicenseStatus -Document $null -TrustedCertsB64 $TrustedCertsB64 -Now $Now
|        $r.Reason = 'no .pimlicense / .silicense / .aitlicense file found'
|        Add-Member -InputObject $r -NotePropertyName Path -NotePropertyValue '' -Force
|        return $r
|    }
|
|    $doc = $null
|    try { $doc = Get-Content -LiteralPath $file -Raw -Encoding UTF8 | ConvertFrom-Json } catch { $doc = $null }
|    $res = Resolve-AitLicenseStatus -Document $doc -TrustedCertsB64 $TrustedCertsB64 -Now $Now
|    if ($null -eq $doc) { $res.Status = 'Invalid'; $res.Reason = 'licence file is not readable JSON' }
|    Add-Member -InputObject $res -NotePropertyName Path -NotePropertyValue $file -Force
|    return $res
|}
'@ }
$__siSupportFiles['engine/_shared/SI-MailTransport.ps1'] = @{ Sha256 = '6945650e8bbfe94d129db3daf129d5a7c0bd717eb1f74641545419995b1a40df'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT -- THE ONE MAIL TRANSPORT (MAIL-1). Every mail SecurityInsight sends goes through Send-SIMail:
|    the Risk Analysis report, the guard mails (Send-SIGuardMailDefault), the close-loop, exemption, sign-in, governance,
|    department and task-digest mails (Send-SICloseLoopMail) and the updater's licence mail. tests\pester\
|    SIv3-MailTransport.Tests.ps1 fails when any other file talks SMTP itself.
|
|    SI_Mail_Mode (the setting; install parameter mailMode):
|      sharedMailbox  Microsoft Graph app-only: POST /v1.0/users/{SI_Mail_From}/sendMail, as SecurityInsight's OWN
|                     identity (the job's managed identity in a container). The recommended mode for every new install.
|                     The send right is Exchange Online's 'Application Mail.Send' role scoped to that one mailbox (RBAC
|                     for Applications) -- and SecurityInsight REFUSES to send until it has verified the restriction
|                     (Get-SIMailRestriction), saying why.
|      smtp           your own relay (anonymous, or signed in; the password from Key Vault) -- RA-Mail.ps1's transports.
|      none           no mail.
|      not set        smtp when SmtpServer is set (an existing install keeps working on upgrade), else none.
|    SI_Mail_From      the shared mailbox; also the From for smtp (wins over SMTPFrom / MailFrom / SMTPUser).
|    SI_Mail_ProbeMailbox  a mailbox OUTSIDE the scope: sending as it must be refused, which proves the restriction.
|
|    Attachments with sharedMailbox: Graph takes an attachment inline in sendMail only up to ~3 MB (the whole request
|    at most 4 MB). A larger one would need an upload session, which needs Mail.ReadWrite on the mailbox -- a wider
|    right than Mail.Send. So a larger attachment is NOT sent: the mail goes without it and says where the file is
|    (the workbook stays on disk / in the export storage) -- the same trade the SMTP size guard makes.
|
|    PS 5.1 safe. No modules. Every network call goes through a seam (-Http, -TokenProvider) so the tests run offline.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|
|$script:SIMailTransportRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|# MAIL-2 / #573: the one mail layout -- Send-SIMail formats every body with it (Format-SIMailBody)
|if (-not (Get-Command -Name Format-SIMailBody -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-MailLayout.ps1')) }
|# #574: the mail PDF -- Send-SIMail attaches one to every mail that reports something (New-SIMailPdf)
|if (-not (Get-Command -Name New-SIMailPdf -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-MailPdf.ps1')) }
|# #710: the line under a mail's summary that links the install's page in the Invardia portal (Add-SIInvardiaPortalLink)
|if (-not (Get-Command -Name Add-SIInvardiaPortalLink -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-InvardiaPortalLink.ps1')) }
|$script:SIMailGraphInlineMaxMb = 3
|$script:SIMailRestrictionCache = @{}
|$script:SIMailAllowedStates = @('verified', 'legacy-policy')
|
|function Get-SIMailSetting {
|    param([Parameter(Mandatory)][string]$Name, [System.Collections.IDictionary]$Globals)
|    if ($Globals) { if ($Globals.Contains($Name)) { return $Globals[$Name] }; return $null }
|    Get-Variable -Name $Name -Scope Global -ValueOnly -ErrorAction SilentlyContinue
|}
|
|function ConvertTo-SIMailFlag {
|    param($Value, [bool]$Default = $false)
|    if ($null -eq $Value) { return $Default }
|    if ($Value -is [bool]) { return $Value }
|    $s = "$Value".Trim()
|    if (-not $s) { return $Default }
|    switch -Regex ($s) { '^(?i)(1|true|yes|on|\$true)$' { return $true } '^(?i)(0|false|no|off|\$false)$' { return $false } }
|    $Default
|}
|
|function Resolve-SIMailMode {
|    <#
|        PURE. The mail mode from SI_Mail_Mode and, when it is not set, from SmtpServer (an existing install).
|        Returns @{ Mode = none | smtp | sharedMailbox; Source = setting | legacy-smtp | default; Problem }.
|    #>
|    param([AllowNull()]$Value, [AllowNull()][string]$SmtpServer)
|    $v = if ($null -eq $Value) { '' } else { "$Value".Trim() }
|    if ($v) {
|        switch -Regex ($v) {
|            '^(?i)(sharedmailbox|shared|graph|sharedmailbox365|o365)$' { return [pscustomobject]@{ Mode = 'sharedMailbox'; Source = 'setting'; Problem = $null } }
|            '^(?i)smtp$'                                               { return [pscustomobject]@{ Mode = 'smtp'; Source = 'setting'; Problem = $null } }
|            '^(?i)(none|off|disabled)$'                                { return [pscustomobject]@{ Mode = 'none'; Source = 'setting'; Problem = $null } }
|        }
|        return [pscustomobject]@{ Mode = 'none'; Source = 'setting'; Problem = ("SI_Mail_Mode '{0}' is not one of none, smtp, sharedMailbox" -f $v) }
|    }
|    if ("$SmtpServer".Trim()) { return [pscustomobject]@{ Mode = 'smtp'; Source = 'legacy-smtp'; Problem = $null } }
|    [pscustomobject]@{ Mode = 'none'; Source = 'default'; Problem = $null }
|}
|
|function Resolve-SIInstallMailMode {
|    <#
|        PURE. The install parameter: mailMode (sharedMailbox | smtp | none), else the older bool 'mail' (true = smtp,
|        false = none), else sharedMailbox (the default for a new install). Returns the mode.
|    #>
|    param([System.Collections.IDictionary]$Values)
|    $m = if ($Values -and $Values.Contains('mailMode')) { "$($Values['mailMode'])".Trim() } else { '' }
|    if ($m) { return (Resolve-SIMailMode -Value $m).Mode }
|    if ($Values -and $Values.Contains('mail') -and $null -ne $Values['mail']) { if (ConvertTo-SIMailFlag $Values['mail']) { return 'smtp' } else { return 'none' } }
|    'sharedMailbox'
|}
|
|function Test-SIMailAddress { param([string]$Value) "$Value".Trim() -match '^[^@\s]+@[^@\s]+\.[^@\s]+$' }
|
|function Get-SIMailEnvironment {
|    <#
|        PURE (reads -Globals, else the live settings; the VERSION file). WHICH environment a mail comes from -- every mail
|        names it in its subject and footer (MAIL-1; owner: "i cannot see which tenant it is wrong"). Never "this tenant".
|          Name     SIWeb_EnvironmentName (the web app header's name; Pro runs read it from the web app's settings), else
|                   SI_EnvironmentName, else the tenant's name (SIWeb_TenantName / SI_TenantDomain /
|                   TenantNameOrganization), else '' -- never an id (a GUID or the install id)
|          Display  '<Name> (ring <n>, PRO|COMMUNITY)' -- as the web app's header shows it; the footer and the PDF carry it,
|                   the SUBJECT carries the Name only (MAIL-3, #653: Get-SIMailSubject)
|          Tenant   SIWeb_TenantName / SI_TenantDomain / TenantNameOrganization / TenantShort, and the tenant id
|          Version  SecurityInsight's version; WebUrl  SIWeb_PublicBaseUrl
|          InvardiaEnvironmentId  #710: the install's environment in the Invardia portal (SI_InstallRingFacts
|                   .InvardiaEnvironment, recorded from Invardia's answer), '' when not known
|    #>
|    param([System.Collections.IDictionary]$Globals)
|    Initialize-SIMailTransportState
|    $g = { param($n) $v = Get-SIMailSetting -Name $n -Globals $Globals; if ($null -eq $v) { '' } else { "$v".Trim() } }
|    $first = { param([string[]]$names) foreach ($n in $names) { $v = & $g $n; if ($v) { return $v } }; '' }
|    # a subject never shows an id (support: "it shows tenant id" -- the install id GUID stood where the name belongs): the
|    # environment's name, else the tenant's name / primary domain; with neither, no name (the subject then has no
|    # bracket, the footer says "your SecurityInsight"). A value that is only an id (a GUID, an inv-... id) is never a name.
|    $isId = { param([string]$s) $s -match '^\{?[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\}?$' -or $s -eq (& $g 'SI_InstallId') }
|    $name = ''
|    foreach ($n in @('SIWeb_EnvironmentName', 'SI_EnvironmentName', 'SIWeb_TenantName', 'SI_TenantDomain', 'TenantNameOrganization')) {
|        $v = & $g $n; if ($v -and -not (& $isId $v)) { $name = $v; break }
|    }
|    $ring = & $g 'SI_UpdateRing'
|    $edition = if ((& $g 'SI_ProSqlServer') -or (& $g 'SI_Edition') -match '^(?i)pro$') { 'PRO' } else { 'COMMUNITY' }
|    $inside = @(@($(if ("$ring" -match '^\d$') { 'ring ' + $ring }), $edition) | Where-Object { $_ }) -join ', '
|    # #449: a name that already says it -- "Internal (ring 1, PRO)" on ring 1 -- is shown as it is: never "... (PRO)" twice
|    $display = if ($name -match '\([^()]*\)\s*$') { $name.Trim() } else { '{0} ({1})' -f $(if ($name) { $name } else { 'your SecurityInsight' }), $inside }
|    $tid = & $first @('SI_SPN_TenantId', 'SpnTenantId', 'AzureTenantId', 'HighPriv_Modern_TenantID', 'TenantId')
|    $tname = & $first @('SIWeb_TenantName', 'SI_TenantDomain', 'TenantNameOrganization', 'TenantShort')
|    $ver = & $g 'SI_Version'
|    if (-not $ver) { try { $vf = [IO.Path]::Combine($script:SIMailTransportRoot, 'VERSION'); if (Test-Path -LiteralPath $vf) { $ver = ([IO.File]::ReadAllText($vf)).Trim() } } catch { } }
|    $web = (& $g 'SIWeb_PublicBaseUrl').TrimEnd('/')
|    $envId = ''
|    try { if (Get-Command -Name Get-SIInvardiaEnvironmentIdKnown -ErrorAction SilentlyContinue) { $envId = Get-SIInvardiaEnvironmentIdKnown -Facts (Get-SIMailSetting -Name 'SI_InstallRingFacts' -Globals $Globals) } } catch { $envId = '' }
|    [pscustomobject]@{ Name = $name; Display = $display; Ring = "$ring"; Edition = $edition; TenantName = $tname; TenantId = $tid
|                       Solution = 'SecurityInsight'; Version = $ver; WebUrl = $(if ($web -match '^https://') { $web } else { '' }); InvardiaEnvironmentId = $envId }
|}
|
|# MAIL-3 (#653): one subject format for every mail SecurityInsight sends
|$script:SIMailProduct = 'SecurityInsight'
|$script:SIMailSubjectMax = 120
|$script:SIMailSubjectEnvMax = 48
|
|# THE TRANSPORT'S OWN VALUES, also when this file was loaded in another scope than the function that runs (live 2026-11-01:
|# the close-loop mail's technical review threw "Substring ... length (-3)" -- $script:SIMailSubjectEnvMax was empty where
|# Get-SIMailSubjectEnvironment ran). Every function that reads them calls this first; a value already set is kept.
|function Initialize-SIMailTransportState {
|    if ($null -eq $script:SIMailTransportRoot) { $script:SIMailTransportRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot) }
|    if ($null -eq $script:SIMailGraphInlineMaxMb) { $script:SIMailGraphInlineMaxMb = 3 }
|    if ($null -eq $script:SIMailRestrictionCache) { $script:SIMailRestrictionCache = @{} }
|    if ($null -eq $script:SIMailAllowedStates) { $script:SIMailAllowedStates = @('verified', 'legacy-policy') }
|    if ($null -eq $script:SIMailProduct) { $script:SIMailProduct = 'SecurityInsight' }
|    if ($null -eq $script:SIMailSubjectMax) { $script:SIMailSubjectMax = 120 }
|    if ($null -eq $script:SIMailSubjectEnvMax) { $script:SIMailSubjectEnvMax = 48 }
|    if ($null -eq $script:SIMailForwardSentinels) { $script:SIMailForwardSentinels = @('false', 'none', 'n/a', 'na', 'null', 'nil', 'no', '0', '-', '--', 'empty') }
|}
|
|function ConvertTo-SIMailSeverityWord {
|    <# PURE. The subject's severity word from a -Severity value: 'Failed' | 'Warning' | 'Action needed' | '' (none). #>
|    param([AllowNull()][AllowEmptyString()][string]$Severity)
|    switch -Regex ("$Severity".Trim()) {
|        '^(?i)fail(ed|ure)?$'            { return 'Failed' }
|        '^(?i)warn(ing)?$'               { return 'Warning' }
|        '^(?i)action[\s_-]*(needed)?$'   { return 'Action needed' }
|    }
|    ''
|}
|
|function Get-SIMailSubjectEnvironment {
|    <#
|        PURE. The environment as the subject names it: the NAME the web app's header shows (Get-SIMailEnvironment .Name),
|        never the ring or the edition (the owner: only the name; they stay in the footer). A name that carries them itself
|        ('Internal (ring 1, PRO)') loses that part here; brackets are taken out (they would break the format).
|    #>
|    param($Environment)
|    Initialize-SIMailTransportState
|    if (-not $Environment) { return '' }
|    $n = "$($Environment.Name)".Trim()
|    if (-not $n -and -not $Environment.PSObject.Properties['Name']) { $n = "$($Environment.Display)".Trim() }
|    # never an id in a subject (a GUID-shaped name, from an older setting or caller)
|    if ($n -match '^\{?[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\}?$') { $n = '' }
|    $n = ($n -replace '(?i)\s*\([^()]*\b(ring\s*\d|pro|community)\b[^()]*\)\s*$', '').Trim()
|    $n = ($n -replace '[\[\]]', '').Trim()
|    if ($n.Length -gt $script:SIMailSubjectEnvMax) { $n = $n.Substring(0, $script:SIMailSubjectEnvMax - 3).TrimEnd() + '...' }
|    $n
|}
|
|function Get-SIMailSubject {
|    <#
|        PURE. THE ONE PLACE that builds a mail's whole subject (MAIL-3, #653):
|            [<Environment>] <severity word: if relevant><what happened> [<ticket if any>] [SecurityInsight]
|        - <Environment>   the web app header's name (Get-SIMailSubjectEnvironment) -- no ring, no edition
|        - severity word   -Severity (Failed | Warning | ActionNeeded), else a leading 'Failed:' / 'Warning:' /
|                          'Action needed:' the sender wrote itself; none for reports, digests and information mails
|        - <what happened> the sender's text, with a leading product name taken out ('SecurityInsight <middle dot> ',
|                          'SecurityInsight -- ', 'SecurityInsight: ', 'Security Insights | ' ...): the product is named once,
|                          at the end. Mails the web app queued in SQL come through here too, so a row queued by an older
|                          web app is put right as it is sent.
|        - at most -MaxLength (120) characters: ONLY <what happened> is shortened, with '...'; the brackets, the severity
|          word and the ticket are always kept.
|        - idempotent: a subject already in the format is returned as it is (never wrapped twice).
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Subject, $Environment,
|          [AllowNull()][AllowEmptyString()][string]$Severity, [AllowNull()][AllowEmptyString()][string]$Ticket, [int]$MaxLength = 0)
|    Initialize-SIMailTransportState
|    if ($MaxLength -le 0) { $MaxLength = $script:SIMailSubjectMax }
|    $product = ' [' + $script:SIMailProduct + ']'
|    $name = Get-SIMailSubjectEnvironment -Environment $Environment
|    $prefix = if ($name) { '[' + $name + '] ' } else { '' }
|    $word = ConvertTo-SIMailSeverityWord $Severity
|    $t = "$Ticket".Trim().Trim('[', ']').Trim()
|    $s = ([string]$Subject -replace '[\r\n\t]+', ' ').Trim()
|    # already in the format: never wrapped twice
|    if ($s.EndsWith($product) -and $s.Length -le $MaxLength -and (-not $prefix -or $s.StartsWith($prefix)) -and
|        (-not $word -or $s.StartsWith($prefix + $word + ':')) -and (-not $t -or $s.Contains('[' + $t + ']'))) { return $s }
|    # take the subject apart: product, environment (also the older '[<Name> (ring n, PRO)] ' one), ticket
|    if ($s.EndsWith($product)) { $s = $s.Substring(0, $s.Length - $product.Length).TrimEnd() }
|    $old = if ($Environment) { "$($Environment.Display)".Trim() } else { '' }
|    if ($prefix -and $s.StartsWith($prefix)) { $s = $s.Substring($prefix.Length).TrimStart() }
|    elseif ($old -and $s.StartsWith('[' + $old + '] ')) { $s = $s.Substring($old.Length + 3).TrimStart() }
|    if ($t -and $s.EndsWith('[' + $t + ']')) { $s = $s.Substring(0, $s.Length - $t.Length - 2).TrimEnd() }
|    # the product is named once, at the end (separators: middle dot, bar, colon, hyphen(s), en / em dash -- written as
|    # [char] so this file stays plain ASCII)
|    $dot = [string][char]0x00B7; $en = [string][char]0x2013; $em = [string][char]0x2014
|    $s = $s -replace ('^(?i)Security\s?Insights?(\s+Pro)?\s*(' + $dot + '|\||:|-{1,2}|' + $en + '|' + $em + ')\s*'), ''
|    $s = $s -replace '^(?i)SecurityInsight\s+(?=test mail$)', ''
|    # a severity word the sender wrote first
|    $m = [regex]::Match($s, ('^(?i)(Failed|Warning|Action needed)\s*(:|-{1,2}|' + $en + ')\s*'))
|    if ($m.Success) { if (-not $word) { $word = ConvertTo-SIMailSeverityWord $m.Groups[1].Value }; $s = $s.Substring($m.Length) }
|    $s = $s.Trim()
|    if (-not $s) { $s = 'Notification' }
|    $s = $s.Substring(0, 1).ToUpperInvariant() + $s.Substring(1)
|    $sev = if ($word) { $word + ': ' } else { '' }
|    $tail = $(if ($t) { ' [' + $t + ']' } else { '' }) + $product
|    $room = $MaxLength - $prefix.Length - $sev.Length - $tail.Length
|    if ($s.Length -gt $room) { $keep = [Math]::Max(1, $room - 3); $s = $s.Substring(0, [Math]::Min($keep, $s.Length)).TrimEnd() + '...' }
|    $prefix + $sev + $s + $tail
|}
|
|function Get-SIMailFooterHtml {
|    <# PURE. The footer every mail carries: environment, tenant name + id, solution + version, the web app's link. #>
|    param([Parameter(Mandatory)]$Environment)
|    $e = { param($s) [System.Net.WebUtility]::HtmlEncode([string]$s) }
|    $tenant = if ($Environment.TenantName -and $Environment.TenantId) { '{0} ({1})' -f $Environment.TenantName, $Environment.TenantId }
|              elseif ($Environment.TenantId) { $Environment.TenantId } elseif ($Environment.TenantName) { $Environment.TenantName } else { 'not recorded' }
|    $parts = @(
|        ('Environment: <b>{0}</b>' -f (& $e $Environment.Display))
|        ('Tenant: {0}' -f (& $e $tenant))
|        ('{0}{1}' -f (& $e $Environment.Solution), $(if ($Environment.Version) { ' v' + (& $e $Environment.Version) } else { '' }))
|    )
|    if ($Environment.WebUrl) { $parts += ('<a href="{0}" style="color:#2c5a8e;">{0}</a>' -f (& $e $Environment.WebUrl)) }
|    '<div data-si-mail-footer style="margin-top:16px;padding:8px 12px;border-top:1px solid #e0e6ed;font-family:Segoe UI,Arial,sans-serif;font-size:11px;color:#5a6a7a;">' + ($parts -join ' &middot; ') + '</div>'
|}
|
|function Add-SIMailFooter {
|    <# PURE. The footer, inside </body> when the mail is a full HTML document, else at the end. Added once. #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$BodyHtml, [Parameter(Mandatory)]$Environment)
|    if ($BodyHtml -match 'data-si-mail-footer') { return $BodyHtml }
|    $f = Get-SIMailFooterHtml -Environment $Environment
|    $i = $BodyHtml.LastIndexOf('</body>', [StringComparison]::OrdinalIgnoreCase)
|    if ($i -ge 0) { return $BodyHtml.Substring(0, $i) + $f + $BodyHtml.Substring($i) }
|    $BodyHtml + $f
|}
|
|function Add-SIMailSourceNote {
|    <# PURE. The source note(s) -- "Endpoint data is from ... -- the last collection from that source did not complete." --
|       as one paragraph at the end of the mail's body (inside </body> when it is a full HTML document; the footer follows).
|       Added once; no notes = the body unchanged. The text is encoded here. #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$BodyHtml, [AllowEmptyCollection()][string[]]$Notes = @())
|    $lines = @($Notes | Where-Object { "$_".Trim() })
|    if (-not $lines.Count -or $BodyHtml -match 'data-si-source-note') { return $BodyHtml }
|    $enc = @($lines | ForEach-Object { [System.Net.WebUtility]::HtmlEncode([string]$_) }) -join '<br>'
|    $p = '<p data-si-source-note="1" style="font-family:Segoe UI,Arial,sans-serif;font-size:13px;line-height:1.5;color:#8a4b00;background:#fff4e0;border-left:4px solid #d98a00;padding:8px 12px;margin:12px 24px;">' + $enc + '</p>'
|    $i = $BodyHtml.LastIndexOf('</body>', [StringComparison]::OrdinalIgnoreCase)
|    if ($i -ge 0) { return $BodyHtml.Substring(0, $i) + $p + $BodyHtml.Substring($i) }
|    $BodyHtml + $p
|}
|
|function Get-SIMailSettings {    <#
|        PURE (reads -Globals, else the live $global: settings). Everything a sender needs, for either mode:
|        @{ Mode; ModeSource; Off; From; SharedMailbox; ProbeMailbox; Server; Port; UseSsl; From; Anonymous; User; Password;
|           Problems }. Off = mail is switched off on purpose (SI_Mail_Mode = none): nothing is sent and that is not a
|        failure. A mode that is not set up has Problems (said, never guessed).
|        Kept property-compatible with the older relay object (Get-SIGuardSmtp / Get-SICloseLoopMailSmtp return it).
|    #>
|    param([System.Collections.IDictionary]$Globals)
|    Initialize-SIMailTransportState
|    $g = { param($n) Get-SIMailSetting -Name $n -Globals $Globals }
|    $problems = New-Object System.Collections.Generic.List[string]
|    $server = "$(& $g 'SmtpServer')".Trim()
|    $mode = Resolve-SIMailMode -Value (& $g 'SI_Mail_Mode') -SmtpServer $server
|    if ($mode.Problem) { $problems.Add($mode.Problem) }
|    $useSsl = ConvertTo-SIMailFlag (& $g 'SMTP_UseSSL')
|    $portRaw = "$(& $g 'SMTPPort')".Trim()
|    $port = if ($portRaw -match '^\d+$') { [int]$portRaw } elseif ($useSsl) { 587 } else { 25 }
|    $mailFrom = "$(& $g 'SI_Mail_From')".Trim()
|    $from = $mailFrom
|    if (-not $from) { foreach ($n in 'SMTPFrom', 'MailFrom', 'SMTPUser') { $v = "$(& $g $n)".Trim(); if ($v) { $from = $v; break } } }
|    $user = "$(& $g 'SMTPUser')".Trim()
|    $passRaw = & $g 'SMTPPassword'
|    $pass = if ($passRaw -is [securestring]) { (New-Object System.Management.Automation.PSCredential ('x', $passRaw)).GetNetworkCredential().Password } else { "$passRaw" }
|    $cred = & $g 'SecureCredentialsSMTP'
|    if ($cred -is [System.Management.Automation.PSCredential]) { $user = $cred.UserName; $pass = $cred.GetNetworkCredential().Password }
|    $anonRaw = & $g 'Mail_SendAnonymous'
|    $anon = ConvertTo-SIMailFlag $anonRaw
|    $probe = "$(& $g 'SI_Mail_ProbeMailbox')".Trim()
|    $off = $false
|    switch ($mode.Mode) {
|        'smtp' {
|            if (-not $server) { $problems.Add('no mail server is configured (SmtpServer)') }
|            if (-not $from) { $problems.Add('no sender address is configured (SI_Mail_From or SMTPFrom)') }
|            if (-not $anon) {
|                $explicitOff = ($null -ne $anonRaw -and "$anonRaw".Trim() -ne '')
|                if (-not $user -and -not $pass -and -not $explicitOff) { $anon = $true }
|                elseif (-not $user -or -not $pass) {
|                    $missing = @(@(@{ n = 'SMTPUser'; v = $user }, @{ n = 'SMTPPassword'; v = $pass }) | Where-Object { -not $_.v } | ForEach-Object { $_.n }) -join ' and '
|                    $problems.Add(("authenticated SMTP is configured but {0} is empty -- store the password in Key Vault (secret SI-Smtp-Password, setup\Set-SIMail.ps1 -Mode smtp) and re-run setup, or set Mail_SendAnonymous = true for an anonymous relay" -f $missing))
|                }
|            }
|        }
|        'sharedMailbox' {
|            if (-not $mailFrom) { $problems.Add('no shared mailbox is configured (SI_Mail_From) -- run setup\Set-SIMail.ps1 or Settings > E-mail > Set up mail') }
|            elseif (-not (Test-SIMailAddress $mailFrom)) { $problems.Add(("SI_Mail_From '{0}' is not a mail address" -f $mailFrom)) }
|            $from = $mailFrom
|        }
|        default {
|            if ($mode.Source -eq 'setting' -and -not $mode.Problem) { $off = $true }
|            elseif (-not $mode.Problem) { $problems.Add('mail is not set up (no SI_Mail_Mode, and no SmtpServer) -- run setup\Set-SIMail.ps1, or Settings > E-mail > Set up mail') }
|        }
|    }
|    $maxMb = 24
|    $mm = & $g 'SI_MaxMailAttachmentMB'
|    if ("$mm" -match '^\d+(\.\d+)?$' -and [double]$mm -gt 0) { $maxMb = [double]$mm }
|    if ($mode.Mode -eq 'sharedMailbox') { $maxMb = [Math]::Min($maxMb, $script:SIMailGraphInlineMaxMb) }
|    [pscustomobject]@{
|        Mode = $mode.Mode; ModeSource = $mode.Source; Off = [bool]$off
|        Server = $server; Port = $port; UseSsl = [bool]$useSsl; From = $from; Anonymous = [bool]$anon; User = $user; Password = $pass
|        SharedMailbox = $(if ($mode.Mode -eq 'sharedMailbox') { $mailFrom } else { '' }); ProbeMailbox = $probe
|        Attestation = "$(& $g 'SI_Mail_RestrictionAttestation')".Trim()
|        MaxAttachmentMb = $maxMb
|        Environment = (Get-SIMailEnvironment -Globals $Globals)
|        Problems = $problems.ToArray()
|    }
|}
|
|function Get-SIMailAttachmentPlan {
|    <#
|        PURE (reads file sizes). Which attachments go with the mail: the encoded size (base64, ~37% more) of ALL of them
|        together must stay within -MaxMb (sharedMailbox: 3 MB, Graph's inline limit; smtp: the relay budget). A file that
|        does not fit is left out, largest first kept out. Returns @{ Include; Dropped (@{ Path; DiskMb; EncodedMb }); MaxMb }.
|    #>
|    param([string[]]$Paths = @(), [double]$MaxMb = 24, [scriptblock]$SizeOf = { param($p) (Get-Item -LiteralPath $p).Length })
|    $inc = New-Object System.Collections.Generic.List[string]; $drop = New-Object System.Collections.Generic.List[object]
|    $budget = $MaxMb * 1MB; $used = 0.0
|    foreach ($p in @($Paths | Where-Object { "$_".Trim() })) {
|        $size = [double](& $SizeOf $p); $enc = $size * 1.37
|        if ($used + $enc -le $budget) { $inc.Add($p); $used += $enc }
|        else { $drop.Add([pscustomobject]@{ Path = $p; DiskMb = [Math]::Round($size / 1MB, 1); EncodedMb = [Math]::Round($enc / 1MB, 1) }) }
|    }
|    [pscustomobject]@{ Include = $inc.ToArray(); Dropped = $drop.ToArray(); MaxMb = $MaxMb }
|}
|
|function New-SIGraphSendMailBody {
|    <#
|        PURE. The Graph sendMail request: HTML body, To / Cc, importance, attachments as fileAttachment (base64), not
|        saved to Sent Items. -Attachments = @(@{ Name; ContentType; Bytes }).
|    #>
|    param([Parameter(Mandatory)][string[]]$To, [string[]]$Cc = @(), [Parameter(Mandatory)][string]$Subject, [Parameter(Mandatory)][AllowEmptyString()][string]$BodyHtml,
|          [ValidateSet('Normal', 'High', 'Low')][string]$Priority = 'Normal', [object[]]$Attachments = @(), [bool]$SaveToSentItems = $false)
|    $rcp = { param($list) , @(@($list) | Where-Object { "$_".Trim() } | ForEach-Object { @{ emailAddress = @{ address = "$_".Trim() } } }) }
|    $msg = [ordered]@{
|        subject      = $Subject
|        body         = [ordered]@{ contentType = 'HTML'; content = $BodyHtml }
|        toRecipients = (& $rcp $To)
|        importance   = $Priority.ToLowerInvariant()
|    }
|    $cc2 = & $rcp $Cc
|    if (@($cc2).Count) { $msg.ccRecipients = $cc2 }
|    if (@($Attachments).Count) {
|        $msg.attachments = @(@($Attachments) | ForEach-Object {
|            [ordered]@{ '@odata.type' = '#microsoft.graph.fileAttachment'; name = [string]$_.Name
|                        contentType = $(if ($_.ContentType) { [string]$_.ContentType } else { 'application/octet-stream' })
|                        contentBytes = [Convert]::ToBase64String([byte[]]$_.Bytes) } })
|    }
|    [ordered]@{ message = $msg; saveToSentItems = $SaveToSentItems }
|}
|
|function Get-SIMailContentType {
|    param([string]$Path)
|    switch -Regex ([IO.Path]::GetExtension("$Path").ToLowerInvariant()) {
|        '^\.xlsx$' { 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' }
|        '^\.pptx$' { 'application/vnd.openxmlformats-officedocument.presentationml.presentation' }
|        '^\.csv$'  { 'text/csv' }
|        '^\.json$' { 'application/json' }
|        '^\.html?$' { 'text/html' }
|        '^\.pdf$'  { 'application/pdf' }
|        default    { 'application/octet-stream' }
|    }
|}
|
|function Invoke-SIMailHttp {
|    <# The default HTTP seam: POST JSON, never throws on a status code. Returns @{ StatusCode; Body }. #>
|    param([Parameter(Mandatory)][string]$Uri, [Parameter(Mandatory)][string]$Token, [Parameter(Mandatory)]$Body, [int]$TimeoutSec = 120)
|    Add-Type -AssemblyName System.Net.Http -ErrorAction SilentlyContinue
|    $client = New-Object System.Net.Http.HttpClient
|    try {
|        $client.Timeout = [TimeSpan]::FromSeconds($TimeoutSec)
|        $req = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Post, $Uri)
|        [void]$req.Headers.TryAddWithoutValidation('Authorization', 'Bearer ' + $Token)
|        $json = ConvertTo-Json -InputObject $Body -Depth 12 -Compress
|        $content = New-Object System.Net.Http.ByteArrayContent(, [Text.Encoding]::UTF8.GetBytes($json))
|        $content.Headers.Remove('Content-Type') | Out-Null
|        [void]$content.Headers.TryAddWithoutValidation('Content-Type', 'application/json; charset=utf-8')
|        $req.Content = $content
|        $resp = $client.SendAsync($req).GetAwaiter().GetResult()
|        $text = ''; if ($resp.Content) { $text = $resp.Content.ReadAsStringAsync().GetAwaiter().GetResult() }
|        [pscustomobject]@{ StatusCode = [int]$resp.StatusCode; Body = $text }
|    } finally { $client.Dispose() }
|}
|
|function Get-SIMailGraphToken {
|    <# SecurityInsight's own Graph token: the run's identity (managed identity in a container), else Get-SIGraphToken. #>
|    if (-not (Get-Command -Name Get-SIAzureToken -ErrorAction SilentlyContinue)) {
|        $restFile = [IO.Path]::Combine($script:SIMailTransportRoot, 'engine', '_shared', 'SI-AzRest.ps1')
|        $li = [IO.Path]::Combine($script:SIMailTransportRoot, 'engine', '_shared', 'SI-LogIngest.ps1')
|        if ((Test-Path -LiteralPath $restFile) -and (Test-Path -LiteralPath $li)) { . $li; . $restFile }
|    }
|    if (Get-Command -Name Get-SIAzureToken -ErrorAction SilentlyContinue) { return (Get-SIAzureToken -Audience Graph) }
|    if (Get-Command -Name Get-SIGraphToken -ErrorAction SilentlyContinue) { return (Get-SIGraphToken) }
|    throw 'no Microsoft Graph token: SecurityInsight''s sign-in is not loaded'
|}
|
|function Get-SIMailGraphError {
|    <# PURE. @{ Code; Message } from a Graph error body. #>
|    param([string]$Body)
|    Initialize-SIMailTransportState
|    try { $e = (ConvertFrom-Json -InputObject $Body).error; return [pscustomobject]@{ Code = [string]$e.code; Message = [string]$e.message } } catch { }
|    [pscustomobject]@{ Code = ''; Message = "$Body" }
|}
|
|function Get-SIMailProbeVerdict {
|    <#
|        PURE. The answer to a probe -- sendMail as a mailbox with NO recipient, so nothing can be delivered:
|          allowed    400 ErrorInvalidRecipients (or 202): the identity MAY send as that mailbox -- the request got past
|                     authorization and failed only on the missing recipient
|          denied     401 / 403 (ErrorAccessDenied): it may not
|          not-found  404 / ErrorInvalidUser: no such mailbox
|          error      anything else
|    #>
|    param([int]$StatusCode, [string]$Body)
|    $e = Get-SIMailGraphError -Body $Body
|    if ($StatusCode -eq 202) { return 'allowed' }
|    if ($StatusCode -eq 400 -and ("$($e.Code)" -match '(?i)InvalidRecipients' -or "$($e.Message)" -match '(?i)recipient')) { return 'allowed' }
|    if ($StatusCode -in 401, 403 -or "$($e.Code)" -match '(?i)AccessDenied|Authorization_RequestDenied') { return 'denied' }
|    if ($StatusCode -eq 404 -or "$($e.Code)" -match '(?i)InvalidUser|ResourceNotFound|MailboxNotEnabled') { return 'not-found' }
|    'error'
|}
|
|function Get-SIMailRestrictionVerdict {
|    <#
|        PURE. Is SecurityInsight's send right restricted to the shared mailbox? From: whether its Graph token carries a
|        tenant-wide Mail.Send (roles claim), the probe as the shared mailbox (-Self) and as another mailbox (-Other, empty
|        when there is none), and an Exchange administrator's attestation. Returns @{ State; Detail; AllowsSend }:
|          verified       may send as the shared mailbox, may NOT send as another one (RBAC for Applications)
|          legacy-policy  the same, but through a tenant-wide Mail.Send that an Application Access Policy restricts --
|                         works; move to RBAC for Applications
|          unrestricted   may send as another mailbox -- REFUSED, in red
|          not-granted    may not send as the shared mailbox yet (role assignment missing, or not active yet)
|          unverified     (no longer answered when the identity holds no tenant-wide Mail.Send: see below)
|        Owner 2026-10-19 ("you cannot do that. we need a generic fix for this"): an identity WITHOUT the tenant-wide Graph
|        Mail.Send (roles claim) that may send as the shared mailbox can only send through Exchange's role scoped to that
|        mailbox -- that IS the restriction, proved by the token itself: 'verified', no probe mailbox needed. A probe mailbox
|        stays an extra proof; a probe that cannot be used (e.g. it does not exist) never blocks sending, it adds a note.
|          error          a probe failed in a way that says nothing
|    #>
|    param([bool]$TokenHasMailSend, [string]$Self, [string]$Other, [string]$Mailbox, [string]$ProbeMailbox, [string]$Attestation)
|    Initialize-SIMailTransportState
|    $s = { param($st, $d) [pscustomobject]@{ State = $st; Detail = $d; AllowsSend = ($script:SIMailAllowedStates -contains $st) } }
|    if ($Self -eq 'not-found') { return (& $s 'not-granted' ("the mailbox {0} does not exist (or is not a mailbox)" -f $Mailbox)) }
|    if ($Self -eq 'denied') { return (& $s 'not-granted' ("SecurityInsight may not send as {0} yet: Exchange's 'Application Mail.Send' role assignment for its identity is missing or not active yet (it can take up to 2 hours) -- setup\Set-SIMail.ps1" -f $Mailbox)) }
|    if ($Self -ne 'allowed') { return (& $s 'error' ("the send right on {0} could not be checked" -f $Mailbox)) }
|    if ($Other -eq 'allowed') {
|        $why = if ($TokenHasMailSend) { 'its identity holds the tenant-wide Microsoft Graph permission Mail.Send -- remove it (setup\Set-SIMail.ps1 -Apply does)' } else { 'its Exchange role assignment is not scoped to the shared mailbox' }
|        return (& $s 'unrestricted' ("Mail.Send is not restricted to the shared mailbox: SecurityInsight could also send as {0}; {1}" -f $ProbeMailbox, $why))
|    }
|    if ($Other -eq 'denied') {
|        if ($TokenHasMailSend) { return (& $s 'legacy-policy' ("restricted to {0} by an Application Access Policy (the older way) -- move to Exchange RBAC for Applications (setup\Set-SIMail.ps1)" -f $Mailbox)) }
|        return (& $s 'verified' ("restricted to {0}: sending as {1} is refused" -f $Mailbox, $ProbeMailbox))
|    }
|    if ($TokenHasMailSend) { return (& $s 'unrestricted' 'SecurityInsight''s identity holds the tenant-wide Microsoft Graph permission Mail.Send and no other mailbox proved it restricted -- remove it (setup\Set-SIMail.ps1 -Apply does)') }
|    if ("$Attestation".Trim()) { return (& $s 'verified' ("restricted to {0} (confirmed by the Exchange administrator: {1})" -f $Mailbox, "$Attestation".Trim())) }
|    # no tenant-wide Mail.Send + allowed as the shared mailbox: the only send right is the role scoped to that mailbox
|    $d = "restricted by Exchange RBAC for Applications: the identity holds no tenant-wide Mail.Send; its only send right is the role scoped to {0}" -f $Mailbox
|    if ("$ProbeMailbox".Trim()) {
|        if ($Other -eq 'not-found') { $d += ("; the probe mailbox {0} does not exist -- remove or correct SI_Mail_ProbeMailbox" -f "$ProbeMailbox".Trim()) }
|        elseif ("$Other".Trim()) { $d += ("; the probe mailbox {0} could not be used ({1})" -f "$ProbeMailbox".Trim(), $Other) }
|    }
|    & $s 'verified' $d
|}
|
|function Get-SIMailRestriction {
|    <#
|        Probes the restriction as SecurityInsight's identity (two sendMail calls with no recipient: nothing is sent) and
|        returns @{ State; Detail; AllowsSend; Mailbox; CheckedUtc }. Cached per process and mailbox. Never throws.
|    #>
|    param([Parameter(Mandatory)]$Settings, [scriptblock]$Http, [scriptblock]$TokenProvider, [switch]$Force)
|    Initialize-SIMailTransportState
|    $mb = [string]$Settings.SharedMailbox
|    $key = ('{0}|{1}' -f $mb, $Settings.ProbeMailbox).ToLowerInvariant()
|    if (-not $Force -and $script:SIMailRestrictionCache.ContainsKey($key)) { return $script:SIMailRestrictionCache[$key] }
|    if (-not $Http) { $Http = { param($u, $t, $b) Invoke-SIMailHttp -Uri $u -Token $t -Body $b } }
|    if (-not $TokenProvider) { $TokenProvider = { Get-SIMailGraphToken } }
|    $now = [datetime]::UtcNow.ToString('yyyy-MM-ddTHH:mm:ssZ')
|    try {
|        $tok = [string](& $TokenProvider)
|        $roles = @()
|        try { $p = $tok.Split('.')[1].Replace('-', '+').Replace('_', '/'); while ($p.Length % 4) { $p += '=' }; $roles = @(([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($p)) | ConvertFrom-Json).roles) } catch { }
|        $probeBody = [ordered]@{ message = [ordered]@{ subject = 'SecurityInsight permission check (never delivered: no recipient)'; body = [ordered]@{ contentType = 'Text'; content = '-' }; toRecipients = @() }; saveToSentItems = $false }
|        $ask = { param($box) $r = & $Http ('https://graph.microsoft.com/v1.0/users/{0}/sendMail' -f [uri]::EscapeDataString($box)) $tok $probeBody; Get-SIMailProbeVerdict -StatusCode ([int]$r.StatusCode) -Body ([string]$r.Body) }
|        $self = & $ask $mb
|        $other = ''
|        if ($self -eq 'allowed' -and "$($Settings.ProbeMailbox)".Trim() -and "$($Settings.ProbeMailbox)".Trim() -ne $mb) { $other = & $ask ([string]$Settings.ProbeMailbox) }
|        $v = Get-SIMailRestrictionVerdict -TokenHasMailSend ($roles -contains 'Mail.Send') -Self $self -Other $other -Mailbox $mb -ProbeMailbox ([string]$Settings.ProbeMailbox) -Attestation ([string]$Settings.Attestation)
|    } catch {
|        $v = [pscustomobject]@{ State = 'error'; Detail = ('the send right could not be checked: {0}' -f $_.Exception.Message); AllowsSend = $false }
|    }
|    $out = [pscustomobject]@{ State = $v.State; Detail = $v.Detail; AllowsSend = [bool]$v.AllowsSend; Mailbox = $mb; CheckedUtc = $now }
|    $script:SIMailRestrictionCache[$key] = $out
|    $out
|}
|
|function ConvertTo-SIMailRestrictionJson {
|    <# PURE. The cfg.InstallState 'MailRestriction' value (<= 400 characters). #>
|    param([Parameter(Mandatory)]$Restriction)
|    $d = [string]$Restriction.Detail
|    $mk = { param($det) ConvertTo-Json -Compress -InputObject ([ordered]@{ state = [string]$Restriction.State; detail = $det; mailbox = [string]$Restriction.Mailbox; checkedUtc = [string]$Restriction.CheckedUtc }) }
|    $j = & $mk $d
|    while ($j.Length -gt 400 -and $d.Length -gt 10) { $d = $d.Substring(0, [Math]::Max(10, $d.Length - ($j.Length - 400) - 3)) + '...'; $j = & $mk $d }
|    $j
|}
|
|function Write-SIMailRestrictionState {
|    <# The restriction, for the web app's Mail card and home banner: cfg.InstallState 'MailRestriction'. Never throws. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)]$Restriction, [string]$By = 'SecurityInsight mail')
|    $sql = @'
|IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL
|MERGE cfg.InstallState AS t USING (SELECT N'MailRestriction' AS Name) AS s ON t.Name = s.Name
|WHEN MATCHED THEN UPDATE SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By
|WHEN NOT MATCHED THEN INSERT (Name, Value, UpdatedBy) VALUES (N'MailRestriction', @Value, @By);
|'@
|    try { $null = & $Invoke $sql @{ Value = (ConvertTo-SIMailRestrictionJson -Restriction $Restriction); By = $By } 'nonquery'; $true } catch { $false }
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|#  THE SEND RECORD (#719, 2026-10-17): every mail Send-SIMail tries to send leaves its outcome in cfg.InstallState --
|#  'MailLastSent' (the newest mail handed over) and 'MailLastFailed' (the newest one that was not, with its error). The
|#  heartbeat's Mail field reads both (Get-SIHeartbeatMail): the close-loop, RA, guard, management-summary and other
|#  mails do not go through an outbox, so the outboxes alone left Mail.lastSentUtc days behind. Written by the engine in
|#  the same way as 'MailRestriction' (Write-SIMailRestrictionState); the web app never writes these rows.
|# ---------------------------------------------------------------------------------------------------------------------
|function ConvertTo-SIMailSendRecordJson {
|    <# PURE. The cfg.InstallState 'MailLastSent' / 'MailLastFailed' value (<= 400 characters): { utc, mode[, error] }. #>
|    param([Parameter(Mandatory)][datetime]$Utc, [AllowEmptyString()][string]$Mode = '', [AllowNull()][AllowEmptyString()][string]$ErrorText)
|    $u = $Utc.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
|    $mk = { param($e) $o = [ordered]@{ utc = $u; mode = [string]$Mode }; if ($null -ne $e) { $o.error = $e }; ConvertTo-Json -Compress -InputObject $o }
|    if (-not "$ErrorText".Trim()) { return (& $mk $null) }
|    $e = ("$ErrorText".Trim() -replace '\s+', ' ')
|    if ($e.Length -gt 300) { $e = $e.Substring(0, 297) + '...' }
|    $j = & $mk $e
|    while ($j.Length -gt 400 -and $e.Length -gt 10) { $e = $e.Substring(0, [Math]::Max(10, $e.Length - ($j.Length - 400) - 3)) + '...'; $j = & $mk $e }
|    $j
|}
|
|function Get-SIMailSendRecordSql {
|    <# PURE. One row of cfg.InstallState by its key (@Name = MailLastSent | MailLastFailed). #>
|@'
|IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL
|MERGE cfg.InstallState WITH (HOLDLOCK) AS t USING (SELECT @Name AS Name) AS s ON t.Name = s.Name
|WHEN MATCHED THEN UPDATE SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By
|WHEN NOT MATCHED THEN INSERT (Name, Value, UpdatedBy) VALUES (@Name, @Value, @By);
|'@
|}
|
|function Write-SIMailSendRecord {
|    <# The outcome of one send -> cfg.InstallState 'MailLastSent' (-Sent) or 'MailLastFailed'. Never throws; $true when written. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [bool]$Sent, [AllowNull()][AllowEmptyString()][string]$ErrorText,
|          [AllowEmptyString()][string]$Mode = '', [datetime]$NowUtc = [datetime]::UtcNow, [string]$By = 'SecurityInsight mail')
|    $name = if ($Sent) { 'MailLastSent' } else { 'MailLastFailed' }
|    $err = if ($Sent) { $null } elseif ("$ErrorText".Trim()) { $ErrorText } else { 'the mail was not sent' }
|    try { $null = & $Invoke (Get-SIMailSendRecordSql) @{ Name = $name; Value = (ConvertTo-SIMailSendRecordJson -Utc $NowUtc -Mode $Mode -ErrorText $err); By = $By } 'nonquery'; $true } catch { $false }
|}
|
|function Get-SIMailSendRecordInvoke {
|    <#
|        The SQL seam the send record uses: $global:SI_MailSendRecordInvoke when a job (or a test) set one; else, once per
|        process, the Pro database from the job's globals (SI_ProSqlServer / _SqlDatabase, else the data backend's) through
|        New-SIDataSqlInvoke when the job loaded it. $null = no record (no database, or none could be opened). Never throws.
|    #>
|    if ($global:SI_MailSendRecordInvoke -is [scriptblock]) { return $global:SI_MailSendRecordInvoke }
|    if ($global:SI_MailSendRecordUnavailable) { return $null }
|    $inv = $null
|    try {
|        if (Get-Command -Name New-SIDataSqlInvoke -ErrorAction SilentlyContinue) {
|            foreach ($pair in @(@('SI_ProSqlServer', 'SI_ProSqlDatabase'), @('SI_Pro_DataSqlServer', 'SI_Pro_DataSqlDatabase'))) {
|                $s = "$(Get-Variable -Name $pair[0] -Scope Global -ValueOnly -ErrorAction SilentlyContinue)".Trim()
|                $d = "$(Get-Variable -Name $pair[1] -Scope Global -ValueOnly -ErrorAction SilentlyContinue)".Trim()
|                if ($s -and $d) { $inv = New-SIDataSqlInvoke -Server $s -Database $d -AppId $global:SI_SPN_AppId -TenantId $global:SI_SPN_TenantId -CertThumbprint $global:SI_SPN_CertThumbprint; break }
|            }
|        }
|    } catch { $inv = $null }
|    if ($inv -is [scriptblock]) { $global:SI_MailSendRecordInvoke = $inv; return $inv }
|    $global:SI_MailSendRecordUnavailable = $true
|    $null
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|#  THE MAIL FORWARD (#765, owner 2026-10-19: "is it possible to define mail forward on accounts like in pim, so each admin
|#  account also get the repots but using their normal office"). A person on the Access page (cfg.AccessAssignment) may have
|#  ForwardTo -- "Send SecurityInsight mail to". Send-SIMail applies it to EVERY mail it sends (the jobs' own report and
|#  alert mails, and every mail the web app queued in an outbox: approvals, owners, notifications, management summaries):
|#  a recipient that names that person -- by object id, their own mail / sign-in name, or a name shown that is a mail
|#  address, case-insensitively -- gets the mail at the forward instead, never at both; the list is de-duplicated. Anyone
|#  not in the table is unchanged. The web app validates the address before it is stored (Auth\MailForward.cs, the same
|#  rules and the same test cases: MailForwardTests / SIv3-MailForward.Tests.ps1); a stored value that is not a real
|#  address is never used.
|# ---------------------------------------------------------------------------------------------------------------------
|$script:SIMailForwardSentinels = @('false', 'none', 'n/a', 'na', 'null', 'nil', 'no', '0', '-', '--', 'empty')
|$script:SIMailForwardCache = $null
|$script:SIMailForwardWarned = $false
|
|function Test-SIMailAddress {
|    <# PURE. A real mail address: one local part, one @, a domain with a dot and a letter top-level domain; no name, no list. #>
|    param([AllowNull()][AllowEmptyString()][string]$Address)
|    $v = "$Address".Trim()
|    if ($v.Length -le 5 -or $v.Length -gt 320) { return $false }
|    if ($v.Contains('..') -or $v.StartsWith('.') -or $v.Contains('.@')) { return $false }
|    return ($v -cmatch '^[A-Za-z0-9.!#$%&''*+/=?^_`{|}~-]+@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}$')
|}
|
|function ConvertTo-SIMailForward {
|    <# PURE. A stored / typed forward as the transport uses it: '' for a blank or a sentinel (FALSE, none, n/a, 0, ...) and
|       for anything that is not a real mail address (never used); else the address, lower-case. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    Initialize-SIMailTransportState
|    $v = "$Value".Trim()
|    if (-not $v -or $script:SIMailForwardSentinels -contains $v.ToLowerInvariant()) { return '' }
|    if (-not (Test-SIMailAddress $v)) { return '' }
|    $v.ToLowerInvariant()
|}
|
|function Get-SIMailForwardSql {
|    <# PURE. The people with a forward (no column yet = none: a database one schema version behind). #>
|@'
|IF OBJECT_ID(N'cfg.AccessAssignment') IS NOT NULL AND COL_LENGTH(N'cfg.AccessAssignment', N'ForwardTo') IS NOT NULL
|    EXEC (N'SELECT PrincipalId, DisplayName, AccountMail, ForwardTo FROM cfg.AccessAssignment WHERE PrincipalType = N''User'' AND ForwardTo IS NOT NULL;');
|ELSE
|    SELECT CAST(NULL AS nvarchar(64)) AS PrincipalId, CAST(NULL AS nvarchar(256)) AS DisplayName, CAST(NULL AS nvarchar(320)) AS AccountMail, CAST(NULL AS nvarchar(320)) AS ForwardTo WHERE 1 = 0;
|'@
|}
|
|function ConvertTo-SIMailForwardMap {
|    <# PURE. Rows (PrincipalId, DisplayName, AccountMail, ForwardTo) -> @{ '<key, lower-case>' = '<forward>' }: the object id, the
|       account mail and a mail-address name of every person whose forward is a real address. #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Rows = @())
|    $map = @{}
|    foreach ($r in @($Rows)) {
|        if (-not $r) { continue }
|        $get = { param($n) if ($r -is [System.Collections.IDictionary]) { "$($r[$n])" } elseif ($r.PSObject.Properties[$n]) { "$($r.$n)" } else { '' } }
|        $f = ConvertTo-SIMailForward (& $get 'ForwardTo')
|        if (-not $f) { continue }
|        $keys = @((& $get 'PrincipalId').Trim().ToLowerInvariant())
|        foreach ($n in 'AccountMail', 'DisplayName') { $k = (& $get $n).Trim(); if (Test-SIMailAddress $k) { $keys += $k.ToLowerInvariant() } }
|        foreach ($k in $keys) { if ($k -and -not $map.ContainsKey($k)) { $map[$k] = $f } }
|    }
|    $map
|}
|
|function Resolve-SIMailRecipients {
|    <# PURE. The list as it is sent: each address the map names is replaced by its forward (never both), de-duplicated
|       case-insensitively (the first place of each kept). Returns @{ To (string[]); Changed (@{ From; To }[]) }. #>
|    param([AllowNull()][AllowEmptyCollection()][string[]]$To = @(), [AllowNull()][hashtable]$Map)
|    $out = New-Object System.Collections.Generic.List[string]
|    $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $changed = New-Object System.Collections.Generic.List[object]
|    foreach ($raw in @($To | ForEach-Object { "$_" -split '[;,]' } | ForEach-Object { $_.Trim() } | Where-Object { $_ })) {
|        $target = $raw
|        if ($Map) {
|            $k = $raw.ToLowerInvariant()
|            if ($Map.ContainsKey($k) -and $Map[$k] -and $Map[$k] -ne $k) { $target = [string]$Map[$k]; $changed.Add([pscustomobject]@{ From = $raw; To = $target }) }
|        }
|        if ($seen.Add($target)) { $out.Add($target) }
|    }
|    [pscustomobject]@{ To = [string[]]$out.ToArray(); Changed = @($changed.ToArray()) }
|}
|
|function Get-SIMailForwardMap {
|    <# The forwards of the people with access, read once per 10 minutes per process: $global:SI_MailForwardMap when a job (or a
|       test) set one; else the Pro database through the same seam as the send record (Get-SIMailSendRecordInvoke). Cannot
|       be read = @{} (every address as given) and ONE line in the log. Never throws. #>
|    param([scriptblock]$Invoke)
|    Initialize-SIMailTransportState
|    if ($global:SI_MailForwardMap -is [hashtable]) { return $global:SI_MailForwardMap }
|    if ($script:SIMailForwardCache -and $script:SIMailForwardCache.Until -gt [datetime]::UtcNow) { return $script:SIMailForwardCache.Map }
|    $map = @{}
|    try {
|        $inv = if ($Invoke) { $Invoke } else { Get-SIMailSendRecordInvoke }
|        # the reader answers its rows as ONE array (', $rows'): unrolled here, so each row is a row
|        if ($inv) { $map = ConvertTo-SIMailForwardMap -Rows @(& $inv (Get-SIMailForwardSql) @{} 'rows' | ForEach-Object { $_ }) }
|        $script:SIMailForwardCache = @{ Map = $map; Until = [datetime]::UtcNow.AddMinutes(10) }
|    } catch {
|        if (-not $script:SIMailForwardWarned) { Write-Host ('   note: the mail forwards of the people with access could not be read ({0}) -- every mail goes to the addresses as given' -f $_.Exception.Message); $script:SIMailForwardWarned = $true }
|        $script:SIMailForwardCache = @{ Map = @{}; Until = [datetime]::UtcNow.AddMinutes(10) }
|    }
|    $map
|}
|
|function Send-SIMail {
|    <#
|        THE send. -Settings from Get-SIMailSettings (or Get-SIGuardSmtp / Get-SICloseLoopMailSmtp, the same object).
|        Returns @{ Sent; Mode; Off; Error; Dropped (attachments left out); Restriction; Text; Pdf (its file name); PdfError }.
|        NEVER throws; diagnostics are
|        written to the host. -Http / -TokenProvider are the Graph seams (tests); -PdfBuilder the PDF seam ({ param($Subject, $Html) @{ Bytes; Error } }); -NoPdf: no PDF (a sign-in mail).
|    #>
|    param([Parameter(Mandatory)]$Settings, [Parameter(Mandatory)][string[]]$To, [string[]]$Cc = @(), [Parameter(Mandatory)][string]$Subject,
|          [Parameter(Mandatory)][AllowEmptyString()][string]$BodyHtml, [string[]]$Attachments = @(),
|          [ValidateSet('Normal', 'High', 'Low')][string]$Priority = 'Normal', [scriptblock]$Http, [scriptblock]$TokenProvider,
|          [switch]$NoPdf, [scriptblock]$PdfBuilder,
|          # MAIL-3 (#653): the subject's severity word (Failed | Warning | ActionNeeded; none = a report or information mail)
|          # and a support ticket number -- both optional; Get-SIMailSubject builds the whole subject
|          [AllowNull()][AllowEmptyString()][string]$Severity, [AllowNull()][AllowEmptyString()][string]$Ticket)
|    Initialize-SIMailTransportState
|    $res = [ordered]@{ Sent = $false; Mode = [string]$Settings.Mode; Off = [bool]$Settings.Off; Error = $null; Dropped = @(); Restriction = $null; Text = ''; Pdf = $null; PdfError = $null }
|    $fail = { param($m) $res.Error = $m; Write-Host ('   mail NOT sent: ' + $m); [pscustomobject]$res }
|    $mode = if ($Settings.Mode) { [string]$Settings.Mode } else { 'smtp' }
|    if ($Settings.Off) { Write-Host '   mail is off (SI_Mail_Mode = none) -- not sent'; $res.Error = 'mail is off (SI_Mail_Mode = none)'; return [pscustomobject]$res }
|    if (@($Settings.Problems).Count) { return (& $fail ((@($Settings.Problems)) -join '; ')) }
|    $to = @($To | ForEach-Object { "$_" -split '[;,]' } | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|    if (-not $to.Count) { return (& $fail 'the mail has no recipient') }
|    # #765 (owner 2026-10-19, "mail forward on accounts like in pim"): a recipient who is a person on the Access page with
|    # "Send SecurityInsight mail to" gets the mail THERE, never at both; the list is de-duplicated. A mail that carries a
|    # one-time secret (-NoPdf: a sign-in link or code) goes only to the address it was made for. Never fails a mail: the
|    # forwards that cannot be read leave every address as it is (one line says so).
|    if (-not $NoPdf) {
|        try {
|            $fwMap = Get-SIMailForwardMap
|            $fw = Resolve-SIMailRecipients -To $to -Map $fwMap
|            foreach ($c in @($fw.Changed)) { Write-Host ('   mail for {0} goes to {1} (their "Send SecurityInsight mail to" on Access)' -f $c.From, $c.To) }
|            $to = @($fw.To)
|            if (@($Cc | Where-Object { "$_".Trim() }).Count) {
|                $ccr = Resolve-SIMailRecipients -To $Cc -Map $fwMap
|                $Cc = @(@($ccr.To) | Where-Object { $to -notcontains $_ })
|            }
|        } catch { Write-Host ('   note: the mail forwards could not be applied ({0}) -- sent to the addresses as given' -f $_.Exception.Message) }
|    }
|    # MAIL-1 / MAIL-3: every mail names its environment -- the subject ('[<Name>] ... [SecurityInsight]') and the footer
|    # (name, ring, edition), built here once for every sender
|    $envInfo = if ($Settings.PSObject.Properties['Environment'] -and $Settings.Environment) { $Settings.Environment } else { Get-SIMailEnvironment }
|    $Subject = Get-SIMailSubject -Subject $Subject -Environment $envInfo -Severity $Severity -Ticket $Ticket
|    # MAIL-2 / #573: EVERY body goes through the one layout -- real paragraphs, explicit spacing, never raw text in HTML.
|    # One HTML body: Graph sendMail takes one body, and so does the SMTP transport; .Text is the CRLF text rendering.
|    $formatted = Format-SIMailBody -BodyHtml $BodyHtml -Title $Subject
|    $BodyHtml = [string]$formatted.Html
|    # #710 (owner 2026-10-16): ONE line under the summary -- "See details and history: <the install's page in the Invardia
|    # portal>" -- only when Invardia has named the environment, only in a mail that has a summary (or a place-holder at
|    # its top: the daily close-loop mail and the management summary, owner 2026-10-16), never in a mail that
|    # carries a one-time secret (-NoPdf). Never fails a mail.
|    if (-not $NoPdf) {
|        try {
|            $eid = if ($envInfo -and $envInfo.PSObject.Properties['InvardiaEnvironmentId']) { [string]$envInfo.InvardiaEnvironmentId } else { '' }
|            if ($eid) { $BodyHtml = Add-SIInvardiaPortalLink -BodyHtml $BodyHtml -EnvironmentId $eid }
|        } catch { }
|    }
|    # the place-holder of a mail that asks for the line at its top is never sent (no id, or a -NoPdf mail)
|    try { $BodyHtml = Remove-SIInvardiaPortalLinkAnchor $BodyHtml } catch { }
|    # a source on its last good collection: every mail that carries data says so, in the same sentence the pages show
|    # (never fails a mail; a sign-in mail -- -NoPdf -- carries no data and no note)
|    if (-not $NoPdf) {
|        try {
|            if (-not (Get-Command -Name Get-SISourceMailNotes -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-SourceState.ps1') }
|            $BodyHtml = Add-SIMailSourceNote -BodyHtml $BodyHtml -Notes @(Get-SISourceMailNotes)
|        } catch { }
|    }
|    $BodyHtml = Add-SIMailFooter -BodyHtml $BodyHtml -Environment $envInfo
|    $res.Text = ConvertTo-SIMailText -Html $BodyHtml
|
|    # #574: ONE PDF of the mail -- its summary, facts and detail, exactly what the body shows (built from the body as it is
|    # sent). Attached LAST, so a large report workbook keeps its place; over the attachment budget it is left out like
|    # any attachment. A PDF that cannot be built never blocks the mail: it goes without it, and says so. -NoPdf: a mail
|    # that carries a one-time secret (a sign-in link or code) never gets a copy of it in a file.
|    $pdfPath = $null
|    if (-not $NoPdf) {
|        $pdf = $null
|        try {
|            $pdf = if ($PdfBuilder) { & $PdfBuilder $Subject $BodyHtml } else { New-SIMailPdf -Title $Subject -Html $BodyHtml -Footer ('SecurityInsight' + $(if ($envInfo -and $envInfo.Display) { ' - ' + [string]$envInfo.Display } else { '' })) }
|        } catch { $pdf = [pscustomobject]@{ Bytes = $null; Error = ('the PDF could not be built: ' + $_.Exception.Message) } }
|        if ($pdf -and $pdf.Bytes) {
|            try {
|                $pdfPath = Save-SIMailPdf -Bytes ([byte[]]$pdf.Bytes) -Subject $Subject
|                $Attachments = @(@($Attachments | Where-Object { "$_".Trim() }) + @($pdfPath))
|                $res.Pdf = Split-Path -Leaf $pdfPath
|            } catch { $res.PdfError = 'the PDF could not be saved: ' + $_.Exception.Message }
|        } else {
|            $res.PdfError = if ($pdf -and $pdf.Error) { [string]$pdf.Error } else { 'the PDF could not be built' }
|        }
|        if ($res.PdfError) { Write-Host ('   warning: the mail goes without its PDF -- ' + $res.PdfError) }
|    }
|    try {
|
|    if ($mode -eq 'sharedMailbox') {
|        $r = Get-SIMailRestriction -Settings $Settings -Http $Http -TokenProvider $TokenProvider
|        $res.Restriction = $r
|        if (-not $r.AllowsSend) { return (& $fail ('Mail.Send is not restricted to the shared mailbox yet -- SecurityInsight does not send until it is. ' + $r.Detail)) }
|        if ($r.State -eq 'legacy-policy') { Write-Host ('   note: ' + $r.Detail) }
|        $plan = Get-SIMailAttachmentPlan -Paths $Attachments -MaxMb ([double]$Settings.MaxAttachmentMb)
|        $res.Dropped = @($plan.Dropped)
|        foreach ($d in $plan.Dropped) { Write-Host ('   attachment left out: {0} ({1} MB, ~{2} MB encoded; Microsoft Graph takes at most {3} MB in one mail) -- the file stays where it is' -f (Split-Path $d.Path -Leaf), $d.DiskMb, $d.EncodedMb, $plan.MaxMb) }
|        $att = @(); foreach ($p in $plan.Include) { $att += @{ Name = (Split-Path $p -Leaf); ContentType = (Get-SIMailContentType $p); Bytes = [IO.File]::ReadAllBytes($p) } }
|        $body = New-SIGraphSendMailBody -To $to -Cc $Cc -Subject $Subject -BodyHtml $BodyHtml -Priority $Priority -Attachments $att
|        if (-not $Http) { $Http = { param($u, $t, $b) Invoke-SIMailHttp -Uri $u -Token $t -Body $b } }
|        if (-not $TokenProvider) { $TokenProvider = { Get-SIMailGraphToken } }
|        Write-Host ("Sending mail (shared mailbox {0}) to {1} with subject '{2}'" -f $Settings.SharedMailbox, ($to -join ', '), $Subject)
|        try {
|            $tok = [string](& $TokenProvider)
|            $resp = & $Http ('https://graph.microsoft.com/v1.0/users/{0}/sendMail' -f [uri]::EscapeDataString([string]$Settings.SharedMailbox)) $tok $body
|        } catch { return (& $fail ('Microsoft Graph could not be reached: ' + $_.Exception.Message)) }
|        if ([int]$resp.StatusCode -eq 202) { $res.Sent = $true; return [pscustomobject]$res }
|        $e = Get-SIMailGraphError -Body ([string]$resp.Body)
|        $hint = if ([int]$resp.StatusCode -eq 403) { ' -- SecurityInsight may not send as this mailbox (Exchange role assignment)' } elseif ([int]$resp.StatusCode -eq 413) { ' -- the mail is too large for Microsoft Graph' } else { '' }
|        $script:SIMailRestrictionCache.Clear()
|        # the status with its name ('403 (Forbidden)'), so the heartbeat's error class reads it (#719: Mail.lastErrorCode)
|        $sc = [int]$resp.StatusCode; $scName = ''; try { $scName = ' ({0})' -f ([System.Net.HttpStatusCode]$sc) } catch { $scName = '' }
|        return (& $fail ('Microsoft Graph answered {0}{1} {2}: {3}{4}' -f $sc, $scName, $e.Code, $e.Message, $hint))
|    }
|
|    # smtp -- the Risk Analysis transports (RA-Mail.ps1), the one place that talks SMTP
|    if (-not (Get-Command -Name Send-MailAnonymous -ErrorAction SilentlyContinue)) {
|        $ra = [IO.Path]::Combine($script:SIMailTransportRoot, 'engine', 'risk-analysis', '_shared', 'RA-Mail.ps1')
|        if (Test-Path -LiteralPath $ra) { . $ra }
|    }
|    if (-not (Get-Command -Name Send-MailAnonymous -ErrorAction SilentlyContinue)) { return (& $fail 'the SMTP transports (RA-Mail.ps1) are not available') }
|    $plan = Get-SIMailAttachmentPlan -Paths $Attachments -MaxMb ([double]$Settings.MaxAttachmentMb)
|    $res.Dropped = @($plan.Dropped)
|    $smtpArgs = @{ SmtpServer = [string]$Settings.Server; Port = [int]$Settings.Port; UseSsl = [bool]$Settings.UseSsl; From = [string]$Settings.From; To = $to; Subject = $Subject; BodyHtml = $BodyHtml; Priority = $Priority }
|    if (@($plan.Include).Count) { $smtpArgs.Attachments = @($plan.Include) }
|    if ($Settings.Anonymous) {
|        $out = @(Send-MailAnonymous @smtpArgs)
|        $lines = @($out | Where-Object { $_ -isnot [bool] } | ForEach-Object { [string]$_ })
|        foreach ($l in $lines) { Write-Host $l }
|        $verdict = @($out | Where-Object { $_ -is [bool] }) | Select-Object -Last 1
|        if (-not $verdict) {
|            $detail = @($lines | Where-Object { $_ -match 'FAILED|Message\s*:|StatusCode|InnerException' } | ForEach-Object { $_.Trim() }) -join ' | '
|            if (-not $detail) { $detail = 'the relay did not accept the message' }
|            $res.Error = $detail; return [pscustomobject]$res
|        }
|        $res.Sent = $true; return [pscustomobject]$res
|    }
|    try {
|        $smtpArgs.Credential = New-Object System.Management.Automation.PSCredential ([string]$Settings.User, (ConvertTo-SecureString ([string]$Settings.Password) -AsPlainText -Force))
|        $out = @(Send-MailSecure @smtpArgs -ErrorAction Stop)
|        foreach ($l in $out) { Write-Host ([string]$l) }
|        $res.Sent = $true
|    } catch {
|        $m = $_.Exception.Message
|        if ($_.Exception.InnerException) { $m += ' (' + $_.Exception.InnerException.Message + ')' }
|        $res.Error = $m
|    }
|    [pscustomobject]$res
|    } finally {
|        # #574: the PDF's temp copy goes once the mail is handed over (sent or not)
|        if ($pdfPath) { Remove-Item -LiteralPath (Split-Path -Parent $pdfPath) -Recurse -Force -ErrorAction SilentlyContinue }
|        # #719: every send leaves its outcome for the heartbeat (cfg.InstallState 'MailLastSent' / 'MailLastFailed'); never fails a mail
|        try { $recInv = Get-SIMailSendRecordInvoke; if ($recInv) { $null = Write-SIMailSendRecord -Invoke $recInv -Sent ([bool]$res.Sent) -ErrorText ([string]$res.Error) -Mode $mode } } catch { }
|    }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-MailLayout.ps1'] = @{ Sha256 = 'ff4f8d1dc50e2ddc6192900a462d1369aa954671cd508ebe0363f64789ba8ca3'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT -- THE ONE MAIL LAYOUT (framework MAIL-2, REQUIREMENTS #573: "every SI mail must be readable, with
|    real paragraphs and blank lines"). Every mail SecurityInsight sends goes through it: Send-SIMail (SI-MailTransport.ps1)
|    calls Format-SIMailBody on EVERY body before it is sent, whoever built it -- the Risk Analysis report, the guard
|    mails, the close-loop / exemption / governance / department / task-digest mails, the licence notice, and the mails
|    the web app queues in its outboxes (cfg.SignInMail, cfg.ExemptionMail, cfg.GovernanceMail, cfg.ReportMail).
|    tests\pester\SIv3-MailReadable.Tests.ps1 renders each mail type and fails when paragraphs or blank lines are lost,
|    and fails when a sender bypasses Format-SIMailBody.
|
|    WHY THE MAILS WERE HARD TO READ (the root causes this file removes):
|      1. plain text (or multi-line free text: a reason, a comment, an AI narrative) put into HTML without turning its
|         line breaks into paragraphs / <br> -- HTML collapses "\n" and "\n\n" into one space, so paragraphs ran together;
|      2. a <p> per LINE (the AI narrative) instead of a <p> per paragraph, with a 6 px gap -- no visible blank line;
|      3. <p> with no margin of its own -- Outlook (desktop, web) drops the default paragraph spacing, so paragraphs had no
|         blank line between them;
|      4. text joined with "`n" (LF only) for the text variant -- no CRLF, no blank line between paragraphs.
|
|    THE BODY: one HTML body. Microsoft Graph sendMail (the shared-mailbox mode) takes ONE body (contentType HTML or Text)
|    -- it has no multipart/alternative -- and the SMTP mode's Send-MailMessage also takes one body. So every mail is an
|    HTML body built with real structure: a <p> per paragraph (explicit margin), <br> only inside a paragraph, <ul> for
|    lists, headings, every interpolated value HTML-encoded. The plain-text rendering of the same mail
|    (ConvertTo-SIMailText: CRLF line ends, a blank line between paragraphs) is returned by Send-SIMail (.Text) and is what
|    a multipart sender would put in its text/plain part.
|
|    NO TABLES (REQUIREMENTS #728, owner: "Drop the tables in emails as it becomes hard to read on mobiles / Make line with
|    topic: / Then text. / Use bold where it can add important context / Use line spacing where needed"). The layout of
|    every SI mail, the same as Invardia's owner notes:
|      - a SUMMARY block first (data-mail-summary): 2-4 short lines -- what happened, the numbers, whether the reader must act;
|      - SECTIONS with a heading (ConvertTo-SIMailHeadingHtml);
|      - "Topic: text" lines, the topic in bold and short (ConvertTo-SIMailLineHtml / ConvertTo-SIMailFactsHtml);
|      - ONE LINE PER RECORD instead of a table row ("Device_Missing_CVEs_Detailed: Complete, 1,060,000 rows");
|      - bullets for lists; blank space between the parts;
|      - no fixed widths: the frame is a <div> with a max-width, so a phone shows it at its own width.
|    No helper here emits <table>, and tests\pester\SIv3-MailNoTables.Tests.ps1 fails when any SI mail does.
|
|    PURE functions only. PowerShell 5.1 and 7 syntax; no modules.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|
|$script:SIMailLayout = @{
|    Font      = 'font-family:Segoe UI,Arial,sans-serif;'
|    Ink       = '#0B1633'
|    Muted     = '#52607D'
|    Blue      = '#1B4FE4'
|    Line      = '#DCE3F2'
|    Panel     = '#F6F8FD'
|    Tint      = '#EEF3FE'
|    # an explicit bottom margin on every paragraph: Outlook drops the default <p> spacing
|    PStyle    = 'margin:0 0 14px 0;line-height:1.55;'
|    Marker    = 'data-si-mail-layout'
|    # the elements that make a body HTML (Format-SIMailBody); anything else tag-like in a text is text
|    HtmlElement = '(?i)<!DOCTYPE\b|</?(html|body|head|p|div|span|table|thead|tbody|tr|td|th|br|hr|h[1-6]|ul|ol|li|strong|b|em|i|u|a|img|code|pre|blockquote|font|center|small|meta|style)(\s[^>]*)?/?>'
|}
|
|function ConvertTo-SIMailEncoded {
|    <# PURE. HTML-encode one value (never raw text in HTML). #>
|    param([AllowNull()]$Value)
|    [System.Net.WebUtility]::HtmlEncode([string]$Value)
|}
|
|function ConvertTo-SIMailLinkified {
|    <# PURE. Encoded text with every https:// link clickable. #>
|    param([AllowEmptyString()][string]$Text)
|    if (-not $Text) { return '' }
|    $sb = New-Object System.Text.StringBuilder
|    $i = 0
|    foreach ($m in [regex]::Matches($Text, 'https://[^\s<>"'']+')) {
|        $url = $m.Value
|        while ($url.Length -gt 8 -and '.,;:)]'.Contains([string]$url[$url.Length - 1])) { $url = $url.Substring(0, $url.Length - 1) }
|        [void]$sb.Append((ConvertTo-SIMailEncoded $Text.Substring($i, $m.Index - $i)))
|        $u = ConvertTo-SIMailEncoded $url
|        [void]$sb.Append(('<a href="{0}" style="color:{1};text-decoration:underline;">{0}</a>' -f $u, $script:SIMailLayout.Blue))
|        $i = $m.Index + $url.Length
|    }
|    if ($i -lt $Text.Length) { [void]$sb.Append((ConvertTo-SIMailEncoded $Text.Substring($i))) }
|    $sb.ToString()
|}
|
|function ConvertTo-SIMailInlineHtml {
|    <# PURE. One free-text VALUE (a reason, a comment, a detail) for inside a paragraph or a table cell: encoded, links
|       clickable, every line break kept as <br> (a blank line as two). #>
|    param([AllowNull()]$Text)
|    $t = ([string]$Text) -replace "`r`n", "`n" -replace "`r", "`n"
|    $t = $t.Trim()
|    if (-not $t) { return '' }
|    ((@($t -split "`n") | ForEach-Object { ConvertTo-SIMailLinkified $_.TrimEnd() }) -join '<br>')
|}
|
|function ConvertTo-SIMailParagraphHtml {
|    <#
|        PURE. Plain text -> HTML blocks: a blank line separates paragraphs (<p>, with the explicit margin), a single line
|        break stays a <br> inside its paragraph, a run of lines starting with "- " / "* " is a <ul>. Every value is
|        encoded. -Markdown adds the subset an AI narrative uses: "## " / "### " headings, **bold**, _italic_ and
|        [text](https://link).
|        -NoLinks: TEXT ONLY -- no link is made clickable: a [text](link) shows its text alone, a bare address stays plain
|        text. For text SecurityInsight did not write itself (the AI narrative, which reads collected names).
|    #>
|    param([AllowNull()]$Text, [switch]$Markdown, [switch]$NoLinks, [string]$Style)
|    $L = $script:SIMailLayout
|    $pStyle = if ($Style) { $Style } else { $L.PStyle }
|    $t = ([string]$Text) -replace "`r`n", "`n" -replace "`r", "`n"
|    if (-not $t.Trim()) { return '' }
|    $plain = { param([string]$x) if ($NoLinks) { ConvertTo-SIMailEncoded $x } else { ConvertTo-SIMailLinkified $x } }
|    $inline = {
|        param([string]$s)
|        if (-not $Markdown) { return (& $plain $s) }
|        # markdown links first, the rest encoded + linkified
|        $out = New-Object System.Text.StringBuilder; $i = 0
|        foreach ($m in [regex]::Matches($s, '\[([^\]\n]+)\]\(([a-zA-Z][a-zA-Z0-9+.-]*:[^\s)]+)\)')) {
|            [void]$out.Append((& $plain $s.Substring($i, $m.Index - $i)))
|            if ($NoLinks -or $m.Groups[2].Value -notmatch '^https://') { [void]$out.Append((ConvertTo-SIMailEncoded $m.Groups[1].Value)) }
|            else { [void]$out.Append(('<a href="{0}" style="color:{1};text-decoration:underline;">{2}</a>' -f (ConvertTo-SIMailEncoded $m.Groups[2].Value), $L.Blue, (ConvertTo-SIMailEncoded $m.Groups[1].Value))) }
|            $i = $m.Index + $m.Length
|        }
|        if ($i -lt $s.Length) { [void]$out.Append((& $plain $s.Substring($i))) }
|        $h = $out.ToString()
|        $h = [regex]::Replace($h, '\*\*([^\*\n]+?)\*\*', '<strong>$1</strong>')
|        $h = [regex]::Replace($h, '(^|\s)_([^_\n]+?)_(\s|[\.,;:\)\]]|$)', '$1<em>$2</em>$3')
|        $h
|    }
|    $blocks = New-Object System.Collections.Generic.List[string]
|    foreach ($para in [regex]::Split($t.Trim(), '\n[ \t]*\n')) {
|        $lines = @($para -split "`n" | ForEach-Object { $_.TrimEnd() } | Where-Object { $_.Trim() })
|        if (-not $lines.Count) { continue }
|        $buf = New-Object System.Collections.Generic.List[string]
|        $ul = New-Object System.Collections.Generic.List[string]
|        $flushP = { if ($buf.Count) { $blocks.Add(('<p style="{0}{1}">{2}</p>' -f $L.Font, $pStyle, ($buf -join '<br>'))); $buf.Clear() } }
|        $flushU = { if ($ul.Count) { $blocks.Add(('<ul style="{0}margin:0 0 14px 0;padding:0 0 0 22px;">{1}</ul>' -f $L.Font, (($ul | ForEach-Object { '<li style="margin:0 0 4px 0;">' + $_ + '</li>' }) -join ''))); $ul.Clear() } }
|        foreach ($ln in $lines) {
|            if ($Markdown -and $ln -match '^\s*(#{2,3})\s+(.+)$') {
|                & $flushP; & $flushU
|                $size = if ($matches[1].Length -eq 2) { '16px' } else { '14px' }
|                $blocks.Add(('<h3 style="{0}font-size:{1};color:{2};margin:18px 0 8px 0;">{3}</h3>' -f $L.Font, $size, $L.Ink, (& $inline $matches[2].Trim())))
|                continue
|            }
|            if ($ln -match '^\s*[-*•]\s+(.+)$') { & $flushP; $ul.Add((& $inline $matches[1].Trim())); continue }
|            & $flushU
|            $buf.Add((& $inline $ln.Trim()))
|        }
|        & $flushP; & $flushU
|    }
|    ($blocks -join "`r`n")
|}
|
|function ConvertTo-SIMailHeadingHtml {
|    <# PURE. A section heading (#728: sections with a heading). Encoded. #>
|    param([AllowEmptyString()][string]$Text)
|    if (-not "$Text".Trim()) { return '' }
|    $L = $script:SIMailLayout
|    ('<h2 style="{0}font-size:16px;line-height:1.35;font-weight:700;color:{1};margin:24px 0 10px 0;">{2}</h2>' -f $L.Font, $L.Ink, (ConvertTo-SIMailEncoded $Text))
|}
|
|function ConvertTo-SIMailLineHtml {
|    <#
|        PURE. ONE "Topic: text" line (#728): the topic in bold, then the text, as a paragraph of its own (blank space after
|        it). -Text is plain text (encoded, links clickable, line breaks kept); -Html is a trusted fragment already built with
|        encoded values (a link, a bold number). No topic = the text alone.
|    #>
|    param([AllowEmptyString()][string]$Topic, [AllowNull()]$Text, [string]$Html, [string]$Color)
|    $L = $script:SIMailLayout
|    $body = if ($PSBoundParameters.ContainsKey('Html')) { $Html } else { ConvertTo-SIMailInlineHtml $Text }
|    $t = "$Topic".Trim()
|    if (-not $t -and -not "$body".Trim()) { return '' }
|    $lead = if ($t) { '<strong>' + (ConvertTo-SIMailEncoded ($t.TrimEnd(':'))) + ':</strong> ' } else { '' }
|    $ink = if ($Color) { $Color } else { $L.Ink }
|    ('<p style="{0}font-size:14px;line-height:1.5;color:{1};margin:0 0 10px 0;">{2}{3}</p>' -f $L.Font, $ink, $lead, $body)
|}
|
|function ConvertTo-SIMailFactsHtml {
|    <#
|        PURE. Key / value facts as "Topic: text" lines (#728: no table), one line per fact, the topic in bold; empty values
|        left out. -Facts: an ordered dictionary, or pairs @(@(k,v), ...). -Title: a section heading above them.
|    #>
|    param($Facts, [string]$Title)
|    $L = $script:SIMailLayout
|    $rows = New-Object System.Collections.Generic.List[object]
|    if ($Facts -is [System.Collections.IDictionary]) { foreach ($k in $Facts.Keys) { $rows.Add(@([string]$k, $Facts[$k])) } }
|    else { foreach ($p in @($Facts)) { if ($null -ne $p) { $rows.Add(@([string]@($p)[0], @($p)[1])) } } }
|    $kept = @($rows | Where-Object { "$(@($_)[1])".Trim() })
|    if (-not $kept.Count) { return '' }
|    $sb = New-Object System.Text.StringBuilder
|    if ($Title) { [void]$sb.Append((ConvertTo-SIMailHeadingHtml $Title)) }
|    [void]$sb.Append(('<div style="{0}margin:0 0 16px 0;" data-mail-facts>' -f $L.Font))
|    foreach ($r in $kept) { [void]$sb.Append((ConvertTo-SIMailLineHtml -Topic @($r)[0] -Text @($r)[1])) }
|    [void]$sb.Append('</div>')
|    $sb.ToString()
|}
|
|function ConvertTo-SIMailSummaryHtml {
|    <#
|        PURE. The SUMMARY block every mail starts with (#728): 2-4 short lines -- what happened, the numbers, whether the
|        reader must act. -Lines: plain text (encoded), one per line; -Html: trusted fragments (already encoded) instead.
|        A tinted block with a blue edge, no table, no fixed width (data-mail-summary: the portal link line goes under it).
|    #>
|    param([AllowEmptyCollection()][string[]]$Lines = @(), [AllowEmptyCollection()][string[]]$Html = @())
|    $L = $script:SIMailLayout
|    $parts = @(@($Html | Where-Object { "$_".Trim() }) + @($Lines | Where-Object { "$_".Trim() } | ForEach-Object { ConvertTo-SIMailInlineHtml $_ }))
|    if (-not $parts.Count) { return '' }
|    ('<div data-mail-summary style="{0}background:{1};border-left:4px solid {2};border-radius:4px;padding:12px 16px;margin:0 0 18px 0;font-size:15px;line-height:1.55;color:{3};"><p style="margin:0;">{4}</p></div>' -f `
|        $L.Font, $L.Tint, $L.Blue, $L.Ink, ($parts -join '<br>'))
|}
|
|function ConvertTo-SIMailButtonHtml {
|    <# PURE. The one blue button: a styled link in a paragraph of its own (no table, #728). Not https:// = no button. #>
|    param([string]$Url, [string]$Text)
|    if ("$Url" -notmatch '^https://') { return '' }
|    $L = $script:SIMailLayout
|    ('<p data-mail-button style="{2}margin:8px 0 18px 0;line-height:1.2;"><a href="{1}" target="_blank" style="{2}display:inline-block;background:{0};border:2px solid {0};border-radius:8px;padding:12px 24px;font-size:15px;font-weight:700;color:#ffffff;text-decoration:none;">{3}</a></p>' -f `
|        $L.Blue, (ConvertTo-SIMailEncoded $Url), $L.Font, (ConvertTo-SIMailEncoded $Text))
|}
|
|function New-SIMailFrameHtml {
|    <#
|        PURE. The frame every SI mail sits in (#728: no table, no fixed width -- a <div> with a max-width, so a phone shows it
|        at its own width): the SecurityInsight bar (an optional -Subtitle line under it: the tenant, the time), the title,
|        the -ContentHtml (trusted, already built with encoded values), the footer line. Carries the layout marker.
|    #>
|    param([string]$Title, [Parameter(Mandatory)][AllowEmptyString()][string]$ContentHtml, [string]$Footer, [string]$FooterHtml,
|          [string]$Brand = 'SecurityInsight', [string]$Subtitle)
|    $L = $script:SIMailLayout
|    $foot = if ($FooterHtml) { $FooterHtml } elseif ($Footer) { ConvertTo-SIMailInlineHtml $Footer } else { '' }
|    '<!DOCTYPE html><html><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="color-scheme" content="light only"></head>' +
|        ('<body style="margin:0;padding:0;background:#f3f5f8;" {0}="1"><div style="background:#f3f5f8;padding:16px 8px;">' -f $L.Marker) +
|        '<div style="max-width:680px;margin:0 auto;background:#ffffff;border:1px solid #e0e6ed;border-radius:8px;">' +
|        ('<div style="background:{0};padding:14px 20px;border-radius:8px 8px 0 0;{1}font-size:18px;font-weight:700;color:#ffffff;">{2}{3}</div>' -f $L.Ink, $L.Font, (ConvertTo-SIMailEncoded $Brand),
|            $(if ($Subtitle) { '<br><span style="font-size:12px;font-weight:400;color:#cfdce8;">' + (ConvertTo-SIMailEncoded $Subtitle) + '</span>' } else { '' })) +
|        $(if ($Title) { '<div style="padding:18px 20px 0 20px;"><h1 style="{0}font-size:21px;line-height:1.3;color:{1};margin:0 0 14px 0;">{2}</h1></div>' -f $L.Font, $L.Ink, (ConvertTo-SIMailEncoded $Title) } else { '' }) +
|        ('<div style="padding:4px 20px 12px 20px;{0}font-size:14px;color:{1};">{2}</div>' -f $L.Font, $L.Ink, $ContentHtml) +
|        $(if ($foot) { '<div style="padding:12px 20px 16px 20px;border-top:1px solid #e0e6ed;{0}font-size:11px;line-height:1.5;color:{1};">{2}</div>' -f $L.Font, $L.Muted, $foot } else { '' }) +
|        '</div></div></body></html>'
|}
|
|function New-SIMailLayout {
|    <#
|        PURE. A whole mail in the MAIL-2 / #728 layout, from PLAIN TEXT parts (everything is encoded here): the title, the
|        summary first (a tinted block), the facts as "Topic: text" lines, the paragraphs (-Paragraphs: one string per paragraph, or one text with blank
|        lines; lines starting "- " become a list), an optional trusted -BodyHtml fragment (already built with encoded
|        values), the blue button to the exact page, the doc link, the footer line.
|        Returns @{ Html; Text } -- Text: CRLF line ends, a blank line between paragraphs.
|    #>
|    param([string]$Title, [string]$Summary, $Facts, [string]$FactsTitle, [AllowEmptyCollection()][string[]]$Paragraphs = @(),
|          [string]$BodyHtml, [string]$ButtonUrl, [string]$ButtonText = 'Open SecurityInsight', [string]$DocUrl, [string]$DocText = 'Documentation',
|          [string]$Footer)
|    $L = $script:SIMailLayout
|    $parts = New-Object System.Text.StringBuilder
|    if ($Summary) { [void]$parts.Append((ConvertTo-SIMailSummaryHtml -Lines @($Summary))) }
|    if ($null -ne $Facts) { [void]$parts.Append((ConvertTo-SIMailFactsHtml -Facts $Facts -Title $FactsTitle)) }
|    $text = (@($Paragraphs) | Where-Object { "$_".Trim() }) -join "`n`n"
|    if ($text) { [void]$parts.Append((ConvertTo-SIMailParagraphHtml -Text $text)) }
|    if ($BodyHtml) { [void]$parts.Append($BodyHtml) }
|    [void]$parts.Append((ConvertTo-SIMailButtonHtml -Url $ButtonUrl -Text $ButtonText))
|    if ("$DocUrl" -match '^https://') {
|        [void]$parts.Append(('<p style="{0}{1}font-size:13px;color:{2};">{3}: <a href="{4}" style="color:{5};">{4}</a></p>' -f $L.Font, $L.PStyle, $L.Muted, (ConvertTo-SIMailEncoded $DocText), (ConvertTo-SIMailEncoded $DocUrl), $L.Blue))
|    }
|    $html = New-SIMailFrameHtml -Title $Title -ContentHtml $parts.ToString() -Footer $Footer
|    [pscustomobject]@{ Html = $html; Text = (ConvertTo-SIMailText -Html $html) }
|}
|
|function ConvertTo-SIMailText {
|    <#
|        PURE. The plain-text rendering of an HTML mail: CRLF line ends, one blank line between paragraphs / headings /
|        tables / lists, a list item as "- ", a table row as its cells separated by " | ", links as "text (url)". It is what
|        a text/plain part carries and what the tests read for "a blank line between paragraphs".
|    #>
|    param([AllowEmptyString()][string]$Html)
|    if (-not $Html) { return '' }
|    $h = [regex]::Replace($Html, '(?is)<(head|style|script)\b.*?</\1>', '')
|    $h = [regex]::Replace($h, '(?is)<!--.*?-->', '')
|    $h = $h -replace "[\r\n\t]+", ' '
|    $h = [regex]::Replace($h, '(?is)<a\b[^>]*href="(https?://[^"]+)"[^>]*>(.*?)</a>', {
|        param($m)
|        $label = [regex]::Replace($m.Groups[2].Value, '<[^>]+>', '').Trim()
|        $url = [System.Net.WebUtility]::HtmlDecode($m.Groups[1].Value)
|        if (-not $label -or [System.Net.WebUtility]::HtmlDecode($label) -eq $url) { $url } else { $label + ' (' + $url + ')' }
|    })
|    $h = [regex]::Replace($h, '(?i)<br\s*/?>', "`n")
|    $h = [regex]::Replace($h, '(?i)<li\b[^>]*>', "`n- ")
|    $h = [regex]::Replace($h, '(?i)</t[dh]>', ' | ')
|    $h = [regex]::Replace($h, '(?i)</tr>', "`n")
|    $h = [regex]::Replace($h, '(?i)</?(p|h[1-6]|ul|ol|table|div|pre|blockquote)\b[^>]*>', "`n`n")
|    $h = [regex]::Replace($h, '<[^>]+>', '')
|    $h = [System.Net.WebUtility]::HtmlDecode($h)
|    $lines = foreach ($ln in ($h -split "`n")) {
|        $x = ($ln -replace '[  ]+', ' ').Trim()
|        $x = $x -replace '(\s*\|\s*)+$', ''
|        $x = $x -replace '^(\|\s*)+', ''
|        $x
|    }
|    # collapse: at most one blank line in a row, none at the ends
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($x in $lines) {
|        if (-not $x) { if ($out.Count -and $out[$out.Count - 1] -ne '') { $out.Add('') }; continue }
|        $out.Add($x)
|    }
|    while ($out.Count -and $out[$out.Count - 1] -eq '') { $out.RemoveAt($out.Count - 1) }
|    ($out -join "`r`n")
|}
|
|function Format-SIMailBody {
|    <#
|        PURE. THE chokepoint every mail goes through (Send-SIMail calls it on every body). Returns @{ Html; Text }.
|          plain text (no HTML tag)  -> the MAIL-2 layout around it, its paragraphs and line breaks kept (New-SIMailLayout)
|          HTML                      -> structure kept; every <p> without a margin of its own gets the explicit paragraph
|                                       margin (Outlook drops the default spacing); a raw line break INSIDE a paragraph's
|                                       text (multi-line free text) becomes <br> (a blank line: a paragraph break)
|        Idempotent: a body already formatted is returned as it is.
|    #>
|    param([AllowEmptyString()][string]$BodyHtml, [string]$Title = 'SecurityInsight')
|    $L = $script:SIMailLayout
|    if ($BodyHtml -match $L.Marker) { return [pscustomobject]@{ Html = $BodyHtml; Text = (ConvertTo-SIMailText -Html $BodyHtml) } }
|    # HTML = it carries a mail markup element. A text that merely holds something tag-like ("<script>" in a reason, an
|    # address in angle brackets) is TEXT: it gets the layout, encoded -- never passed through as HTML.
|    if ($BodyHtml -notmatch $L.HtmlElement) {
|        # a plain-text body: never put raw text into HTML
|        return (New-SIMailLayout -Title $Title -Paragraphs @(([string]$BodyHtml).Trim()))
|    }
|    $html = $BodyHtml
|    # raw line breaks inside a paragraph's text -> <br> (two -> a paragraph gap)
|    $html = [regex]::Replace($html, '(?is)(<p\b[^>]*>)(.*?)(</p>)', {
|        param($m)
|        $inner = $m.Groups[2].Value
|        $inner = [regex]::Replace($inner, '(?<=[^\s>])[ \t]*\r?\n[ \t]*\r?\n[ \t]*(?=[^\s<])', '<br><br>')
|        $inner = [regex]::Replace($inner, '(?<=[^\s>])[ \t]*\r?\n[ \t]*(?=[^\s<])', '<br>')
|        $m.Groups[1].Value + $inner + $m.Groups[3].Value
|    })
|    # every <p> carries an explicit margin
|    $html = [regex]::Replace($html, '(?i)<p(\s[^>]*)?>', {
|        param($m)
|        $attrs = $m.Groups[1].Value
|        if ($attrs -match '(?i)\bstyle\s*=\s*"([^"]*)"') {
|            $st = $matches[1]
|            if ($st -match '(?i)(^|;)\s*margin(-[a-z]+)?\s*:') { return $m.Value }   # its own margin (or margin-top ...) is kept
|            $newSt = $st.TrimEnd(';', ' ') + $(if ($st.Trim()) { ';' } else { '' }) + $L.PStyle
|            return ('<p' + ($attrs -replace '(?i)\bstyle\s*=\s*"[^"]*"', ('style="' + $newSt.Replace('$', '$$') + '"')) + '>')
|        }
|        '<p' + $attrs + ' style="' + $L.PStyle + '">'
|    })
|    # the marker: formatted once
|    if ($html -match '(?i)<body\b') { $html = [regex]::Replace($html, '(?i)<body\b', ('<body ' + $L.Marker + '="1"'), 1) }
|    else { $html = '<div ' + $L.Marker + '="1">' + $html + '</div>' }
|    [pscustomobject]@{ Html = $html; Text = (ConvertTo-SIMailText -Html $html) }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-MailPdf.ps1'] = @{ Sha256 = 'e603968eb03994fb2b8f564f26580296768fc713924bf4464e186f2a27e94592'; Text = @'
|# pwsh 7 (Add-Type on .NET 8); in Windows PowerShell 5.1 the PDF is simply not built and the mail goes without it.
|<#
|    SECURITYINSIGHT -- THE MAIL PDF (REQUIREMENTS #574; owner: "include pdf file with summary and relavant infp in mails").
|    Send-SIMail (SI-MailTransport.ps1) attaches ONE PDF to every mail that reports something: the mail's own content (after
|    the #573 layout) -- its summary first, then the facts, lists and tables in the mail's order -- as an A4 PDF. Built by
|    the ONE PDF builder, engine/_shared/pdf/SIMailPdf.cs (the web app compiles the same file), compiled here with Add-Type
|    against the PDFsharp + MigraDoc DLLs (MIT; container/Install-SIPdfLibrary.ps1 puts them in the images, SI_PDF_LIB).
|
|    A PDF that cannot be built NEVER blocks the mail: New-SIMailPdf returns the reason, Send-SIMail sends without it and
|    says so. No PowerShell module, no browser, no native code.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|
|$script:SIMailPdfRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|$script:SIMailPdfState = @{ Loaded = $false; Error = $null }
|
|function Get-SIPdfPackageManifest {
|    <# The pinned package list (engine/_shared/pdf/SI.Pdf.packages.json). #>
|    Get-Content -Raw -LiteralPath ([IO.Path]::Combine($PSScriptRoot, 'pdf', 'SI.Pdf.packages.json')) | ConvertFrom-Json
|}
|
|function Find-SIPdfLibrary {
|    <#
|        Where the PDF DLLs are: @{ Files (name -> path); Missing (names) }. Looked for, per DLL, in: SI_PDF_LIB, /opt/si/pdf
|        (the images), engine/_shared/pdf/lib (a local install), then the NuGet package cache (a developer or test machine
|        that built the web app: ~/.nuget/packages/<id>/<version>/lib/net8.0).
|    #>
|    param([string[]]$Dirs)
|    $m = Get-SIPdfPackageManifest
|    $fw = [string]$m.framework
|    $base = @()
|    if ($Dirs) { $base += $Dirs }
|    if ("$env:SI_PDF_LIB".Trim()) { $base += "$env:SI_PDF_LIB".Trim() }
|    $base += '/opt/si/pdf'
|    $base += [IO.Path]::Combine($PSScriptRoot, 'pdf', 'lib')
|    $nuget = if ("$env:NUGET_PACKAGES".Trim()) { "$env:NUGET_PACKAGES".Trim() } else { [IO.Path]::Combine([Environment]::GetFolderPath('UserProfile'), '.nuget', 'packages') }
|    $files = [ordered]@{}; $missing = @()
|    foreach ($p in @($m.packages)) {
|        foreach ($dll in @($p.dlls)) {
|            $hit = $null
|            foreach ($d in $base) { $c = [IO.Path]::Combine($d, $dll); if (Test-Path -LiteralPath $c) { $hit = $c; break } }
|            if (-not $hit) { $c = [IO.Path]::Combine($nuget, ([string]$p.id).ToLowerInvariant(), [string]$p.version, 'lib', $fw, $dll); if (Test-Path -LiteralPath $c) { $hit = $c } }
|            if ($hit) { $files[$dll] = $hit } else { $missing += $dll }
|        }
|    }
|    [pscustomobject]@{ Files = $files; Missing = $missing }
|}
|
|function Import-SIPdfBuilder {
|    <# Loads the PDF DLLs and compiles the ONE builder (SIMailPdf.cs) once per process. $true, or $false with the reason
|       in $script:SIMailPdfState.Error. Never throws. #>
|    param([string[]]$Dirs)
|    if ('SecurityInsight.Pdf.SIMailPdf' -as [type]) { $script:SIMailPdfState.Loaded = $true; return $true }
|    try {
|        $lib = Find-SIPdfLibrary -Dirs $Dirs
|        if (@($lib.Missing).Count) { throw ('the PDF library is not installed (missing: {0}; the images carry it in /opt/si/pdf)' -f (@($lib.Missing) -join ', ')) }
|        $loaded = @{}; foreach ($a in [AppDomain]::CurrentDomain.GetAssemblies()) { $loaded[$a.GetName().Name] = $true }
|        # dependencies first
|        $order = @('Microsoft.Extensions.DependencyInjection.Abstractions.dll', 'Microsoft.Extensions.Logging.Abstractions.dll', 'PdfSharp.Shared.dll', 'PdfSharp.System.dll', 'PdfSharp.dll', 'PdfSharp.Charting.dll', 'MigraDoc.DocumentObjectModel.dll', 'MigraDoc.Rendering.dll')
|        foreach ($n in $order) {
|            if (-not $lib.Files.Contains($n)) { continue }
|            if ($loaded.ContainsKey([IO.Path]::GetFileNameWithoutExtension($n))) { continue }
|            $null = [Reflection.Assembly]::LoadFrom([string]$lib.Files[$n])
|        }
|        $src = [IO.Path]::Combine($PSScriptRoot, 'pdf', 'SIMailPdf.cs')
|        # -ReferencedAssemblies replaces Add-Type's default references: the PDF DLLs + .NET's own reference set (pwsh ships it
|        # in $PSHOME/ref; without that folder, the runtime's own assemblies)
|        $netRefs = @()
|        $refDir = [IO.Path]::Combine($PSHOME, 'ref')
|        if (Test-Path -LiteralPath $refDir) { $netRefs = @(Get-ChildItem -LiteralPath $refDir -Filter '*.dll' -File | ForEach-Object FullName) }
|        else { $netRefs = @(([string][AppContext]::GetData('TRUSTED_PLATFORM_ASSEMBLIES')) -split [IO.Path]::PathSeparator | Where-Object { $_ -match '[\\/](System|Microsoft\.CSharp|netstandard|mscorlib)[^\\/]*\.dll$' }) }
|        $refs = @(@($lib.Files.Values | ForEach-Object { [string]$_ }) + $netRefs)
|        Add-Type -Path $src -ReferencedAssemblies $refs -IgnoreWarnings -ErrorAction Stop
|        $script:SIMailPdfState.Loaded = $true; $script:SIMailPdfState.Error = $null
|        return $true
|    } catch {
|        $script:SIMailPdfState.Error = $_.Exception.Message
|        return $false
|    }
|}
|
|function ConvertTo-SIMailPdfFileName {
|    <# PURE. 'SecurityInsight - <subject>.pdf', safe on every file system, at most ~90 characters. #>
|    param([string]$Subject)
|    $s = ("$Subject" -replace '[\\/:*?"<>|\[\]\r\n\t]+', ' ' -replace '\s+', ' ').Trim(' ', '.', '-')
|    if (-not $s) { $s = 'SecurityInsight' }
|    if ($s -notmatch '(?i)securityinsight') { $s = 'SecurityInsight - ' + $s }
|    if ($s.Length -gt 86) { $s = $s.Substring(0, 86).TrimEnd(' ', '.', '-') }
|    $s + '.pdf'
|}
|
|function New-SIMailPdf {
|    <#
|        The PDF of a mail: -Title (the subject), -Html (the body as it is sent). Returns @{ Bytes; Error }; never throws.
|        The footer line names SecurityInsight and the environment (-Footer).
|    #>
|    param([string]$Title, [AllowEmptyString()][string]$Html, [string]$Footer = 'SecurityInsight')
|    if (-not (Import-SIPdfBuilder)) { return [pscustomobject]@{ Bytes = $null; Error = [string]$script:SIMailPdfState.Error } }
|    try {
|        $bytes = [SecurityInsight.Pdf.SIMailPdf]::FromHtml($Title, $Html, $Footer)
|        if (-not $bytes -or $bytes.Length -lt 100) { throw 'the PDF came out empty' }
|        [pscustomobject]@{ Bytes = $bytes; Error = $null }
|    } catch {
|        $e = $_.Exception; while ($e.InnerException) { $e = $e.InnerException }
|        [pscustomobject]@{ Bytes = $null; Error = ('the PDF could not be built: ' + $e.Message) }
|    }
|}
|
|function Save-SIMailPdf {
|    <# Writes the PDF bytes to a fresh temp folder under its mail name; returns the path (Send-SIMail removes it). #>
|    param([Parameter(Mandatory)][byte[]]$Bytes, [string]$Subject)
|    $dir = [IO.Path]::Combine([IO.Path]::GetTempPath(), 'si-mail-pdf-' + [guid]::NewGuid().ToString('N'))
|    $null = New-Item -ItemType Directory -Force -Path $dir
|    $path = [IO.Path]::Combine($dir, (ConvertTo-SIMailPdfFileName -Subject $Subject))
|    [IO.File]::WriteAllBytes($path, $Bytes)
|    $path
|}
'@ }
$__siSupportFiles['engine/_shared/pdf/SI.Pdf.packages.json'] = @{ Sha256 = '19d358ee948712aa60363528bb3991f5bdf167508875723099246bbe9c756934'; Text = @'
|{
|  "_comment": "#574 -- the .NET PDF library SecurityInsight renders its mail PDFs with: PDFsharp + MigraDoc 6.2.4 (MIT, verified on the nuspec of this exact version: <license type=\"expression\">MIT</license>; https://licenses.nuget.org/MIT) and its two Microsoft.Extensions dependencies (MIT). Never QuestPDF. ONE pinned list for every consumer: container/Install-SIPdfLibrary.ps1 downloads exactly these packages at image build and refuses any whose SHA-512 differs; engine/_shared/SI-MailPdf.ps1 finds the DLLs by these names; engine/_shared/pdf/SI.Pdf.csproj references the same versions (a test keeps them equal). Only the managed DLLs listed here are copied -- no native code, no executable, no PowerShell module.",
|  "framework": "net8.0",
|  "packages": [
|    { "id": "PDFsharp", "version": "6.2.4", "license": "MIT",
|      "sha512": "2b5fea680c984317f8839ece1804b6d51c436e2e67017e13ad68edf110707530b6340c0ef2f3c57860b4b1f7352ef42c162b5ea425c5b3a08685a9c0d4d45f0e",
|      "dlls": [ "PdfSharp.dll", "PdfSharp.Shared.dll", "PdfSharp.System.dll", "PdfSharp.Charting.dll" ] },
|    { "id": "PDFsharp-MigraDoc", "version": "6.2.4", "license": "MIT",
|      "sha512": "0dff6eddb3086207f0458fa0815d311b5b65f626fa3279bf2c4ca79ce18a37b1920ff282323949302c295fe096c9a621c868c8537718d16f2283624064eb5f19",
|      "dlls": [ "MigraDoc.DocumentObjectModel.dll", "MigraDoc.Rendering.dll" ] },
|    { "id": "Microsoft.Extensions.Logging.Abstractions", "version": "8.0.3", "license": "MIT",
|      "sha512": "e689ec1e2cb9d2fafa9fd9f6ab861a0895aa9a1cbc9fb37e9dd856c8d1709004eb1455e64570b51013be88b60e9ae0c44f8f853932d9cdeab33ddb42fcec199b",
|      "dlls": [ "Microsoft.Extensions.Logging.Abstractions.dll" ] },
|    { "id": "Microsoft.Extensions.DependencyInjection.Abstractions", "version": "8.0.2", "license": "MIT",
|      "sha512": "ba1960ef110ac7387a2a06eefc02c59ce57b0fe58b3e0cccb79b1c8f2150105c5d1f4b65e0ed95ff50d70f28142917c6a735b83f4e5406bb1d8f9dd1f9635d7d",
|      "dlls": [ "Microsoft.Extensions.DependencyInjection.Abstractions.dll" ] }
|  ]
|}
'@ }
$__siSupportFiles['engine/_shared/SI-SourceState.ps1'] = @{ Sha256 = '8a30c2e117dc25434e40ce423758aaa5d951e53d182bc4443d1c0637a44f10f1'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE STATE OF EACH SOURCE (owner 2026-10-12: "a source dropout should not block ci calculation, then
|    use latest avail collection from the source" / "last known state is sufficient to send if a source is not working").
|
|    A SOURCE is one collection step of the pipeline (identity / azure / endpoint / publicip). The pipeline runner tells
|    this store how each collection ended (engine\_shared\SI-JobFlow.ps1, -SourceState):
|
|      Good     the collection ended well: the source's last good collection is this one.
|      Dropped  the collection did not end well. Two things happen, in ONE statement:
|                 1. nothing it wrote counts as a complete collection. A feed (provider + record type) the failed step had
|                    already closed since it started (a collection in several processes: one of them died) is HELD: its
|                    row in sidata.RecordCollection says so, and ONE of its records is marked "not complete" -- the CI
|                    build reads a feed's completeness from its newest collection's records (Get-SICiFeedLatestSql), so
|                    every record the collection did not reach stays FROZEN (it keeps its CI active) instead of turning
|                    'not seen'. A collection that never closed is not complete already (SI-RecordSql.ps1: the feed close).
|                 2. the source is recorded as on its last good collection (sidata.SourceState: LastGoodAt stays, the
|                    attempt and the first moment it dropped are kept) -- what the run's sentence, the data sync and the
|                    finding lifecycle read.
|
|    The two tables come from sql\si-data-schema.sql (the updater applies it); on a database that does not have them yet
|    every statement here answers "nothing" and changes nothing. SQL over the (sql, params, mode) seam the record writer
|    uses (New-SIRecordSqlInvoke: every parameter is text; mode 'rows' answers objects). Free code, both editions.
|    PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|function Get-SISourceStateSql {
|    <# The T-SQL of the source state (one place; the real-SQL test runs it against sql\si-data-schema.sql). Times are ISO
|       text (@sinceText, @nowText); a feed the step wrote counts from 5 minutes before the step started (clocks differ). #>
|    param([Parameter(Mandatory)][ValidateSet('Good', 'Dropped', 'Read')][string]$Name)
|    switch ($Name) {
|        'Good' { @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.SourceState') IS NULL BEGIN SELECT CAST(NULL AS DATETIME2(3)) AS LastGoodAt, 0 AS Held; RETURN; END
|DECLARE @since DATETIME2(3) = TRY_CONVERT(DATETIME2(3), NULLIF(@sinceText, N''), 127);
|DECLARE @now DATETIME2(3) = ISNULL(TRY_CONVERT(DATETIME2(3), NULLIF(@nowText, N''), 127), SYSUTCDATETIME());
|DECLARE @good DATETIME2(3) = NULL;
|IF OBJECT_ID('sidata.RecordCollection') IS NOT NULL
|    SELECT @good = MAX(CollectionTime) FROM sidata.RecordCollection
|    WHERE Engine = @source AND State = N'good' AND CollectionTime >= DATEADD(minute, -5, ISNULL(@since, @now));
|SET @good = COALESCE(@good, @since, @now);
|MERGE sidata.SourceState AS t
|USING (SELECT @source AS Source) AS s ON t.Source = s.Source
|WHEN MATCHED THEN UPDATE SET LastGoodAt = @good, LastAttemptAt = @now, LastAttemptOk = 1, DroppedSince = NULL, Detail = NULL, UpdatedAt = SYSUTCDATETIME()
|WHEN NOT MATCHED THEN INSERT (Source, LastGoodAt, LastAttemptAt, LastAttemptOk) VALUES (@source, @good, @now, 1);
|SELECT @good AS LastGoodAt, 0 AS Held;
|'@ }
|        'Dropped' { @'
|SET NOCOUNT ON;
|SET XACT_ABORT ON;
|IF OBJECT_ID('sidata.SourceState') IS NULL BEGIN SELECT CAST(NULL AS DATETIME2(3)) AS LastGoodAt, 0 AS Held; RETURN; END
|DECLARE @since DATETIME2(3) = TRY_CONVERT(DATETIME2(3), NULLIF(@sinceText, N''), 127);
|DECLARE @now DATETIME2(3) = ISNULL(TRY_CONVERT(DATETIME2(3), NULLIF(@nowText, N''), 127), SYSUTCDATETIME());
|DECLARE @from DATETIME2(3) = DATEADD(minute, -5, ISNULL(@since, @now));
|DECLARE @held INT = 0, @before DATETIME2(3) = NULL;
|BEGIN TRANSACTION;
|IF OBJECT_ID('sidata.RecordCollection') IS NOT NULL
|BEGIN
|    -- 1. every feed this collection had closed since the step started is held: it did not end well
|    DECLARE @h TABLE (Provider NVARCHAR(32) NOT NULL, RecordType NVARCHAR(32) NOT NULL, CollectionTime DATETIME2(3) NOT NULL);
|    UPDATE sidata.RecordCollection SET State = N'held', Reason = LEFT(N'the collection did not complete: ' + ISNULL(@why, N''), 400), UpdatedAt = SYSUTCDATETIME()
|    OUTPUT inserted.Provider, inserted.RecordType, inserted.CollectionTime INTO @h (Provider, RecordType, CollectionTime)
|    WHERE Engine = @source AND State = N'good' AND CollectionTime >= @from;
|    SET @held = @@ROWCOUNT;
|    IF @held > 0
|    BEGIN
|        -- one record of each held feed's collection says "not complete": the CI build then freezes what that collection missed
|        ;WITH x AS (SELECT r.RecordKey, ROW_NUMBER() OVER (PARTITION BY r.Provider, ISNULL(r.RecordType, N'') ORDER BY r.RecordKey) AS n
|                   FROM sidata.CiRecord r JOIN @h h ON h.Provider = r.Provider AND h.RecordType = ISNULL(r.RecordType, N'') AND h.CollectionTime = r.CollectionTime)
|        UPDATE r SET Complete = 0 FROM sidata.CiRecord r JOIN x ON x.RecordKey = r.RecordKey WHERE x.n = 1;
|    END
|    -- a source that dropped before its state was ever recorded: its last good collection is the newest one it closed before
|    SELECT @before = MAX(CollectionTime) FROM sidata.RecordCollection WHERE Engine = @source AND State = N'good' AND CollectionTime < @from;
|END
|-- 2. the source is on its last good collection
|MERGE sidata.SourceState AS t
|USING (SELECT @source AS Source) AS s ON t.Source = s.Source
|WHEN MATCHED THEN UPDATE SET LastGoodAt = ISNULL(t.LastGoodAt, @before), LastAttemptAt = @now, LastAttemptOk = 0, DroppedSince = ISNULL(t.DroppedSince, @now),
|     Detail = LEFT(ISNULL(@why, N''), 400), UpdatedAt = SYSUTCDATETIME()
|WHEN NOT MATCHED THEN INSERT (Source, LastGoodAt, LastAttemptAt, LastAttemptOk, DroppedSince, Detail) VALUES (@source, @before, @now, 0, @now, LEFT(ISNULL(@why, N''), 400));
|COMMIT TRANSACTION;
|SELECT LastGoodAt, @held AS Held FROM sidata.SourceState WHERE Source = @source;
|'@ }
|        'Read' { @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.SourceState') IS NULL
|    SELECT CAST(NULL AS NVARCHAR(32)) AS Source, CAST(NULL AS DATETIME2(3)) AS LastGoodAt, CAST(NULL AS DATETIME2(3)) AS LastAttemptAt, CAST(NULL AS BIT) AS LastAttemptOk,
|           CAST(NULL AS DATETIME2(3)) AS DroppedSince, CAST(NULL AS NVARCHAR(400)) AS Detail WHERE 1 = 0
|ELSE
|    SELECT Source, LastGoodAt, LastAttemptAt, LastAttemptOk, DroppedSince, Detail FROM sidata.SourceState ORDER BY Source;
|'@ }
|    }
|}
|
|function ConvertTo-SISourceStateTime {
|    <# PURE. A time as the ISO text the statements take ('' for none); a database time back as UTC [datetime] or $null. #>
|    param($Value, [switch]$FromDb)
|    if ($null -eq $Value -or $Value -is [DBNull] -or "$Value" -eq '') { if ($FromDb) { return $null } else { return '' } }
|    if ($FromDb) {
|        if ($Value -is [datetime]) { return [datetime]::SpecifyKind([datetime]$Value, 'Utc') }
|        try { return [datetime]::Parse([string]$Value, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal) } catch { return $null }
|    }
|    ([datetime]$Value).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ', [Globalization.CultureInfo]::InvariantCulture)
|}
|
|function ConvertFrom-SISourceStateRow {
|    <# PURE. A sidata.SourceState row (object or hashtable) as @{ Source; LastGoodUtc; LastAttemptUtc; Ok; DroppedSinceUtc; Detail }. #>
|    param($Row)
|    if ($null -eq $Row) { return $null }
|    if ($Row -is [System.Collections.IDictionary]) { $Row = [pscustomobject]$Row }
|    $g = { param($n) if ($Row.PSObject.Properties[$n]) { $Row.$n } else { $null } }
|    $ok = & $g 'LastAttemptOk'
|    [pscustomobject]@{ Source = [string](& $g 'Source'); LastGoodUtc = (ConvertTo-SISourceStateTime (& $g 'LastGoodAt') -FromDb); LastAttemptUtc = (ConvertTo-SISourceStateTime (& $g 'LastAttemptAt') -FromDb)
|                       Ok = ($null -eq $ok -or $ok -is [DBNull] -or "$ok" -in @('True', '1')); DroppedSinceUtc = (ConvertTo-SISourceStateTime (& $g 'DroppedSince') -FromDb)
|                       Detail = $(if ($null -eq (& $g 'Detail') -or (& $g 'Detail') -is [DBNull]) { '' } else { [string](& $g 'Detail') }) }
|}
|
|function New-SISourceStateStore {
|    <#
|        The source state over the database seam -Invoke { param($Sql, $Params, $Mode) } (New-SIRecordSqlInvoke, or a test's).
|        Good($Source, $SinceUtc, $NowUtc) and Dropped($Source, $SinceUtc, $NowUtc, $Why) answer when that source last
|        collected completely (UTC, or $null: never recorded); Read() answers every source's row. The methods throw on a
|        database error -- the pipeline runner catches it, says it and goes on.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke)
|    $o = [pscustomobject]@{ Invoke = $Invoke }
|    $o | Add-Member -MemberType ScriptMethod -Name Good -Value {
|        param($Source, $SinceUtc, $NowUtc)
|        $r = @(& $this.Invoke (Get-SISourceStateSql 'Good') @{ source = ([string]$Source).ToLowerInvariant(); sinceText = (ConvertTo-SISourceStateTime $SinceUtc); nowText = (ConvertTo-SISourceStateTime $NowUtc) } 'rows' | ForEach-Object { $_ }) | Select-Object -First 1
|        if ($r -is [System.Collections.IDictionary]) { $r = [pscustomobject]$r }
|        if ($r) { ConvertTo-SISourceStateTime $r.LastGoodAt -FromDb } else { $null }
|    }
|    $o | Add-Member -MemberType ScriptMethod -Name Dropped -Value {
|        param($Source, $SinceUtc, $NowUtc, $Why)
|        $r = @(& $this.Invoke (Get-SISourceStateSql 'Dropped') @{ source = ([string]$Source).ToLowerInvariant(); sinceText = (ConvertTo-SISourceStateTime $SinceUtc); nowText = (ConvertTo-SISourceStateTime $NowUtc); why = [string]$Why } 'rows' | ForEach-Object { $_ }) | Select-Object -First 1
|        if ($r -is [System.Collections.IDictionary]) { $r = [pscustomobject]$r }
|        if ($r) { ConvertTo-SISourceStateTime $r.LastGoodAt -FromDb } else { $null }
|    }
|    $o | Add-Member -MemberType ScriptMethod -Name Read -Value {
|        # flattened first: the data sync's seam hands the rows back as ONE array object, which would be read as a single row
|        @(& $this.Invoke (Get-SISourceStateSql 'Read') @{} 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ } | ForEach-Object { ConvertFrom-SISourceStateRow $_ } | Where-Object { $_ -and $_.Source })
|    }
|    $o
|}
|
|function Get-SISourceDropouts {
|    <#
|        The sources that are on their LAST GOOD collection right now (their newest collection did not end well):
|        @(@{ Source; LastGoodUtc; DroppedSinceUtc; Detail }). Never throws: a database that cannot be read answers none
|        (and says so through -Log) -- callers that must be careful treat "cannot tell" themselves.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [scriptblock]$Log)
|    try {
|        @((New-SISourceStateStore -Invoke $Invoke).Read() | Where-Object { -not $_.Ok })
|    } catch {
|        if ($Log) { & $Log 'WARN' ('the state of the sources could not be read ({0})' -f $_.Exception.Message) }
|        @()
|    }
|}
|
|# =====================================================================================================================
|#  WHAT RESTS ON A DROPPED SOURCE -- only that is frozen (owner 2026-10-12: "Freeze only if ALL its sources are down")
|# =====================================================================================================================
|# While a source is on its last good collection, a finding or ticket that goes missing is FROZEN (never counted absent,
|# never closed) only when EVERY source that describes its CI is down; a CI that at least one healthy source still
|# describes closes its findings as usual. What can be told with certainty is which CIs a source describes: the feeds
|# (provider + record type) each collection step writes are registered when a collection closes
|# (sidata.RecordCollection.Engine), and sidata.CiRecord says which CI every record belongs to -- the unit is the CI:
|#   FROZEN   every CI that has a record in a feed of a dropped source and NO record in a feed of a healthy source,
|#            every owner that is not a CI, and every CI no record points to;
|#   AS USUAL every CI that a healthy source describes (also when a dropped source describes it too), and every CI no
|#            dropped source describes.
|#   (A feed that both a dropped and a healthy collection step write counts as dropped; a record of a feed no collection
|#   step registered -- a CMDB record -- is no evidence either way.)
|# THE KNOWN CONSEQUENCE, accepted by the owner: a finding that ONLY the dropped source could see, on a CI another source
|# still describes, can be counted absent and closed after the usual complete runs although nothing shows a fix. It opens
|# again, as reopened, when that source is back.
|# A dropped source whose feeds are not known (nothing registered in the last 30 days) cannot be attributed at all: then
|# nothing is closed in that run (Known = $false).
|
|function Get-SISourceDropoutOwnersSql {
|    <# The T-SQL of the per-source freeze. 'Sources': each dropped source and how many feeds are known for it.
|       'Lifecycle': the finding-lifecycle OWNER keys to freeze (the CIs ONLY dropped sources describe, and the open owners
|       that cannot be attributed). 'Cis': every CI that has records, N = 1 when only dropped sources describe it. #>
|    param([Parameter(Mandatory)][ValidateSet('Sources', 'Lifecycle', 'Cis')][string]$Name)
|    $head = @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.SourceState') IS NULL OR OBJECT_ID('sidata.RecordCollection') IS NULL OR OBJECT_ID('sidata.CiRecord') IS NULL
|BEGIN
|    SELECT CAST(NULL AS NVARCHAR(450)) AS K, 0 AS N WHERE 1 = 0;
|    RETURN;
|END
|'@
|    $feeds = @'
|WITH f AS (SELECT DISTINCT c.Provider, c.RecordType
|           FROM sidata.RecordCollection c JOIN sidata.SourceState d ON d.Source = c.Engine
|           WHERE d.LastAttemptOk = 0 AND c.CollectionTime >= DATEADD(day, -30, SYSUTCDATETIME())),
|     g AS (SELECT DISTINCT c.Provider, c.RecordType
|           FROM sidata.RecordCollection c
|           WHERE c.CollectionTime >= DATEADD(day, -30, SYSUTCDATETIME()) AND c.Engine <> N''
|             AND NOT EXISTS (SELECT 1 FROM sidata.SourceState d WHERE d.Source = c.Engine AND d.LastAttemptOk = 0)
|             AND NOT EXISTS (SELECT 1 FROM f WHERE f.Provider = c.Provider AND f.RecordType = c.RecordType)),
|     x AS (SELECT r.CiId, MAX(CASE WHEN f.Provider IS NULL THEN 0 ELSE 1 END) AS Down, MAX(CASE WHEN g.Provider IS NULL THEN 0 ELSE 1 END) AS Healthy
|           FROM sidata.CiRecord r
|           LEFT JOIN f ON f.Provider = r.Provider AND f.RecordType = ISNULL(r.RecordType, N'')
|           LEFT JOIN g ON g.Provider = r.Provider AND g.RecordType = ISNULL(r.RecordType, N'')
|           WHERE r.CiId IS NOT NULL GROUP BY r.CiId)
|'@
|    switch ($Name) {
|        'Sources' { $head + @'
|
|SELECT d.Source AS K,
|       (SELECT COUNT(*) FROM (SELECT DISTINCT c.Provider, c.RecordType FROM sidata.RecordCollection c
|                              WHERE c.Engine = d.Source AND c.CollectionTime >= DATEADD(day, -30, SYSUTCDATETIME())) x) AS N
|FROM sidata.SourceState d WHERE d.LastAttemptOk = 0;
|'@ }
|        # ONE result set (a seam may read only the first): the CIs a dropped source describes, and the open owners that are
|        # not a CI or whose CI no record points to. No lifecycle table = no lifecycle rows = nothing to freeze.
|        'Lifecycle' { $head + @'
|
|IF OBJECT_ID('sidata.CiFindingState') IS NULL
|BEGIN
|    SELECT CAST(NULL AS NVARCHAR(450)) AS K, 0 AS N WHERE 1 = 0;
|    RETURN;
|END
|;
|'@ + $feeds + @'
|,
|-- an open owner under an asset key (no CI id; an empty one is none): the CIs its asset is PROVEN to belong to -- a stored
|-- finding of a CI that names the asset id, or the CI link of the asset's own id
|oa AS (SELECT DISTINCT s.OwnerKey FROM sidata.CiFindingState s
|       WHERE s.State <> N'closed' AND NULLIF(s.CiId, N'') IS NULL AND s.OwnerKey LIKE N'asset:%'),
|lk AS (SELECT oa.OwnerKey, cf.CiId FROM oa JOIN sidata.CiFinding cf ON N'asset:' + LOWER(cf.AssetId) = oa.OwnerKey
|       WHERE NULLIF(cf.CiId, N'') IS NOT NULL AND NULLIF(cf.AssetId, N'') IS NOT NULL
|       UNION
|       SELECT oa.OwnerKey, l.CiId FROM oa JOIN sidata.CiLink l ON l.NativeId = SUBSTRING(oa.OwnerKey, 7, 450)),
|-- unfrozen ONLY when the link is proven (exactly one CI) AND every source of that CI is on a current collection (its
|-- records rest on no dropped source, and on at least one healthy one); anything unproven stays frozen
|pv AS (SELECT k.OwnerKey FROM lk k GROUP BY k.OwnerKey
|       HAVING COUNT(DISTINCT k.CiId) = 1 AND EXISTS (SELECT 1 FROM x WHERE x.CiId = MIN(k.CiId) AND x.Down = 0 AND x.Healthy = 1))
|SELECT CAST(x.CiId AS NVARCHAR(450)) AS K, 1 AS N
|FROM x WHERE x.Down = 1 AND x.Healthy = 0
|UNION
|SELECT s.OwnerKey AS K, 0 AS N FROM sidata.CiFindingState s
|WHERE s.State <> N'closed' AND (NULLIF(s.CiId, N'') IS NULL OR NOT EXISTS (SELECT 1 FROM sidata.CiRecord r WHERE r.CiId = s.CiId))
|  AND NOT EXISTS (SELECT 1 FROM pv WHERE pv.OwnerKey = s.OwnerKey);
|'@ }
|        'Cis' { $head + @'
|
|;
|'@ + $feeds + @'
|
|SELECT x.CiId AS K, CASE WHEN x.Down = 1 AND x.Healthy = 0 THEN 1 ELSE 0 END AS N FROM x;
|'@ }
|    }
|}
|
|function Get-SISourceDropoutOwners {
|    <#
|        What must be frozen while a source is on its last good collection. -For Lifecycle (default): .Owners = the finding
|        lifecycle's owner keys to freeze. -For Cis: .Healthy = the CI keys (lower case) whose records are all from healthy
|        sources -- every other asset is frozen (Test-SISourceAssetFrozen).
|        Returns @{ Dropouts; Known; Owners; Unlinked; Healthy; Why } (Unlinked: the open owners frozen because no CI with current sources is proven for them). No source dropped: Dropouts empty, Known $true, nothing frozen.
|        Known = $false when it cannot be told what rests on a dropped source (its feeds are not registered, or the database
|        could not be read) -- the caller then closes NOTHING in that run. Never throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [ValidateSet('Lifecycle', 'Cis')][string]$For = 'Lifecycle', [scriptblock]$Log)
|    $out = [ordered]@{ Dropouts = @(); Known = $true; Owners = @(); Unlinked = 0; Healthy = (New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)); Why = '' }
|    $val = { param($r, $n) if ($r -is [System.Collections.IDictionary]) { $r[$n] } elseif ($r -and $r.PSObject.Properties[$n]) { $r.$n } else { $null } }
|    try {
|        $out.Dropouts = @((New-SISourceStateStore -Invoke $Invoke).Read() | Where-Object { -not $_.Ok })
|        if (-not $out.Dropouts.Count) { return [pscustomobject]$out }
|        $known = @{}
|        foreach ($r in @(& $Invoke (Get-SISourceDropoutOwnersSql 'Sources') @{} 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })) { $known[[string](& $val $r 'K')] = [int](& $val $r 'N') }
|        $blind = @($out.Dropouts | Where-Object { -not $known.ContainsKey([string]$_.Source) -or $known[[string]$_.Source] -lt 1 } | ForEach-Object { [string]$_.Source })
|        if ($blind.Count) {
|            $out.Known = $false
|            $out.Why = ('which assets {0} describes is not known yet (no complete collection of it is registered)' -f ($blind -join ', '))
|            return [pscustomobject]$out
|        }
|        $rows = @(& $Invoke (Get-SISourceDropoutOwnersSql $For) @{} 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })
|        if ($For -eq 'Cis') {
|            foreach ($r in $rows) { $k = [string](& $val $r 'K'); if ($k -and [int](& $val $r 'N') -eq 0) { [void]$out.Healthy.Add($k.Trim()) } }
|        } else {
|            $out.Owners = @($rows | ForEach-Object { [string](& $val $_ 'K') } | Where-Object { $_ } | Sort-Object -Unique)
|            # the open owners frozen because no CI is proven for them (or their CI's sources are not shown current): counted, said
|            $out.Unlinked = @($rows | Where-Object { [int](& $val $_ 'N') -eq 0 -and [string](& $val $_ 'K') }).Count
|        }
|    } catch {
|        $out.Known = $false
|        $out.Why = ('what rests on the dropped source could not be read ({0})' -f $_.Exception.Message)
|        if ($Log) { & $Log 'WARN' $out.Why }
|    }
|    [pscustomobject]$out
|}
|
|function Test-SISourceAssetFrozen {
|    <# PURE. Is this asset (its CI key) frozen while a source is on its last good collection? Yes unless it is a CI whose
|       records are all from healthy sources (-Freeze: Get-SISourceDropoutOwners -For Cis). No source dropped: never. #>
|    param([AllowEmptyString()][AllowNull()][string]$Key, $Freeze)
|    if ($null -eq $Freeze -or -not @($Freeze.Dropouts).Count) { return $false }
|    $k = ([string]$Key).Trim()
|    if (-not $k) { return $true }
|    -not $Freeze.Healthy.Contains($k)
|}
|
|# =====================================================================================================================
|#  THE AGE OF A SOURCE -- known, said, and after 7 days it holds delivery (owner 2026-10-12: "last known state is
|#  sufficient to send if a source is not working" -- for a while: SI_Pro_SourceDropout_HoldDeliveryDays, default 7)
|# =====================================================================================================================
|function Get-SISourceAgeDays {
|    <# PURE. How many days a source has been without a good collection: 0 while its newest collection completed; else the
|       days since its last good collection (a source that never had one: since it first dropped). #>
|    param($Source, [datetime]$NowUtc = [datetime]::UtcNow)
|    if ($null -eq $Source -or $Source.Ok) { return 0.0 }
|    $from = $null
|    if ($Source.LastGoodUtc) { $from = ([datetime]$Source.LastGoodUtc).ToUniversalTime() } elseif ($Source.DroppedSinceUtc) { $from = ([datetime]$Source.DroppedSinceUtc).ToUniversalTime() }
|    if ($null -eq $from) { return 0.0 }
|    [math]::Round([math]::Max(0.0, ($NowUtc.ToUniversalTime() - $from).TotalDays), 2)
|}
|
|function Get-SISourceHoldDays {
|    <# PURE. After how many days without a good collection of a source delivery waits: SI_Pro_SourceDropout_HoldDeliveryDays,
|       default 7; 0 = delivery never waits for a source; anything that is not a whole number from 0 to 365 = the default. #>
|    param($Value = $global:SI_Pro_SourceDropout_HoldDeliveryDays)
|    $n = 0
|    if ($null -ne $Value -and [int]::TryParse(([string]$Value).Trim(), [ref]$n) -and $n -ge 0 -and $n -le 365) { return $n }
|    7
|}
|
|function Get-SISourceAgeText {
|    <# PURE. One plain line per source that is on its last good collection, with how old that collection is:
|       "endpoint has had no good collection for 3 days -- its data is from 2026-10-09 14:05 UTC". #>
|    param([AllowEmptyCollection()][object[]]$Sources = @(), [datetime]$NowUtc = [datetime]::UtcNow)
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    foreach ($s in @($Sources | Where-Object { $_ -and -not $_.Ok })) {
|        $d = Get-SISourceAgeDays -Source $s -NowUtc $NowUtc
|        $age = if ($d -lt 1) { '{0} hour(s)' -f [int][math]::Floor($d * 24) } else { '{0} day(s)' -f [int][math]::Floor($d) }
|        if ($s.LastGoodUtc) { '{0} has had no good collection for {1} -- its data is from {2} UTC' -f $s.Source, $age, ([datetime]$s.LastGoodUtc).ToUniversalTime().ToString('yyyy-MM-dd HH:mm', $inv) }
|        else { '{0} has had no good collection for {1}' -f $s.Source, $age }
|    }
|}
|
|function Get-SISourceDeliveryHold {
|    <#
|        PURE. Why delivery must wait, or '' when it need not: a source has had no good collection for -HoldDays days or
|        more. The calculation (the CI build, Risk Analysis) goes on; mails, tickets and the other delivery steps wait until
|        that source collects again -- what they would send rests on data that old. -HoldDays 0 = never.
|    #>
|    param([AllowEmptyCollection()][object[]]$Sources = @(), [datetime]$NowUtc = [datetime]::UtcNow, [int]$HoldDays = 7)
|    if ($HoldDays -le 0) { return '' }
|    $old = @($Sources | Where-Object { $_ -and -not $_.Ok -and (Get-SISourceAgeDays -Source $_ -NowUtc $NowUtc) -ge $HoldDays })
|    if (-not $old.Count) { return '' }
|    'delivery waits: {0} had no good collection for {1} days or more ({2}) -- nothing is mailed and no ticket is changed until that source collects again; the calculation goes on' -f `
|        ((@($old | ForEach-Object { [string]$_.Source })) -join ', '), $HoldDays,
|        ((@($old | ForEach-Object { '{0}: {1} days' -f $_.Source, [int][math]::Floor((Get-SISourceAgeDays -Source $_ -NowUtc $NowUtc)) })) -join ', ')
|}
|
|# =====================================================================================================================
|#  LABELLED EVERYWHERE -- the same sentence on the pages, on an export's info sheet and in the mails
|# =====================================================================================================================
|function Get-SISourceLabel {
|    <# PURE. A source as a person reads it: Endpoint / Identity / Azure / Public IP scan (the web app says the same). #>
|    param([AllowEmptyString()][AllowNull()][string]$Source)
|    switch (([string]$Source).Trim().ToLowerInvariant()) {
|        'endpoint' { 'Endpoint' } 'identity' { 'Identity' } 'azure' { 'Azure' } 'publicip' { 'Public IP scan' } default { [string]$Source }
|    }
|}
|
|function Get-SISourceNoteText {
|    <# PURE. "Endpoint data is from 2026-10-10 14:05 UTC -- the last collection from that source did not complete." #>
|    param([AllowEmptyString()][AllowNull()][string]$Source, $LastGoodUtc)
|    $when = 'its last good collection'
|    if ($LastGoodUtc) { $when = ([datetime]$LastGoodUtc).ToUniversalTime().ToString('yyyy-MM-dd HH:mm', [Globalization.CultureInfo]::InvariantCulture) + ' UTC' }
|    '{0} data is from {1} -- the last collection from that source did not complete.' -f (Get-SISourceLabel $Source), $when
|}
|
|function Get-SISourceCollectionMarkSql {
|    <#
|        ONE statement, at the end of every data sync: each loaded collection that was produced while a source was on its
|        last good collection gets a row saying which source and from when (sidata.CollectionSource) -- what the web app
|        shows when that collection is opened later. A collection is marked once; marks of collections that are gone are
|        cleared. Answers the rows added. Guarded: without the tables it does nothing.
|    #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.CollectionSource') IS NULL OR OBJECT_ID('sidata.SourceState') IS NULL OR OBJECT_ID('sidata.Collection') IS NULL
|BEGIN
|    SELECT 0 AS Marked;
|    RETURN;
|END
|DELETE FROM sidata.CollectionSource WHERE NOT EXISTS (SELECT 1 FROM sidata.Collection AS c WHERE c.CollectionId = sidata.CollectionSource.CollectionId);
|INSERT sidata.CollectionSource (CollectionId, Source, LastGoodAt)
|SELECT c.CollectionId, s.Source, s.LastGoodAt
|FROM sidata.Collection AS c CROSS JOIN sidata.SourceState AS s
|WHERE s.LastAttemptOk = 0 AND c.Status = N'Complete'
|  AND c.CollectionTime >= ISNULL(s.DroppedSince, c.CollectionTime)
|  AND NOT EXISTS (SELECT 1 FROM sidata.CollectionSource AS x WHERE x.CollectionId = c.CollectionId AND x.Source = s.Source);
|SELECT @@ROWCOUNT AS Marked;
|'@
|}
|
|function Invoke-SISourceCollectionMark {
|    <# The data sync's call: marks the loaded collections (Get-SISourceCollectionMarkSql). Never throws; returns the rows added. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [scriptblock]$Log)
|    try {
|        $n = & $Invoke (Get-SISourceCollectionMarkSql) @{} 'scalar'
|        if ($null -eq $n -or $n -is [DBNull]) { return 0 }
|        if ([int]$n -gt 0 -and $Log) { & $Log 'INFO' ("sources     : {0} collection(s) marked as calculated while a source was on its last good collection" -f [int]$n) }
|        [int]$n
|    } catch {
|        if ($Log) { & $Log 'WARN' ("sources     : the collections could not be marked ({0}) -- the web app shows the current state of the sources only" -f $_.Exception.Message) }
|        0
|    }
|}
|
|# the mails: read once per process (a job sends its mails within minutes), from the install's database
|$script:SISourceMailNotes = $null
|
|function Get-SISourceMailNotes {
|    <#
|        The sentence(s) a mail carries while a source is on its last good collection -- none when every source collected.
|        -Invoke: the database seam (default: the install's database, when one is configured). Never throws; read once per
|        process (-Fresh reads again).
|    #>
|    param([scriptblock]$Invoke, [switch]$Fresh)
|    if (-not $Fresh -and -not $Invoke -and $null -ne $script:SISourceMailNotes) { return @($script:SISourceMailNotes) }
|    $notes = @()
|    try {
|        if (-not $Invoke) {
|            if (-not ([string]$global:SI_ProSqlServer -and [string]$global:SI_ProSqlDatabase)) { return @() }
|            if (-not (Get-Command -Name New-SIRecordSqlInvoke -ErrorAction SilentlyContinue)) { . ([IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-RecordSql.ps1')) }
|            $Invoke = New-SIRecordSqlInvoke
|            if (-not $Invoke) { return @() }
|            $notes = @(Get-SISourceDropouts -Invoke $Invoke | ForEach-Object { Get-SISourceNoteText -Source $_.Source -LastGoodUtc $_.LastGoodUtc })
|            $script:SISourceMailNotes = $notes
|        } else {
|            $notes = @(Get-SISourceDropouts -Invoke $Invoke | ForEach-Object { Get-SISourceNoteText -Source $_.Source -LastGoodUtc $_.LastGoodUtc })
|        }
|    } catch { $notes = @() }
|    @($notes)
|}
|
|function Get-SISourceDropoutText {
|    <# PURE. "endpoint (data from 2026-10-10 14:05 UTC)" for each source on its last good collection, joined; '' for none. #>
|    param([AllowEmptyCollection()][object[]]$Dropouts = @())
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    (@($Dropouts | Where-Object { $_ } | ForEach-Object {
|        if ($_.LastGoodUtc) { '{0} (data from {1} UTC)' -f $_.Source, ([datetime]$_.LastGoodUtc).ToUniversalTime().ToString('yyyy-MM-dd HH:mm', $inv) } else { '{0} (its last good collection)' -f $_.Source }
|    })) -join ', '
|}
'@ }
$__siSupportFiles['engine/data-model/SI-RecordSql.ps1'] = @{ Sha256 = '640dbdb5a3ea91bfcaeb65b99df4343efd6702c8be811751fa3f0ab2cb28aad8'; Text = @'
|#Requires -Version 5.1
|<#
|    PROVIDER RECORDS IN SQL (#477, V3-DATA-MODEL 2.20 -- operator 2026-10-08/09: correlation in SQL ONLY, SQL in every v3
|    install; "la is only for kusto risk analysis"). Every batch of records a profiler captures is written to the install's
|    database -- and ONLY there (a copy to Log Analytics is the optional export SI_LaExport, never read back):
|
|      sidata.CiRecord          one row per record key (provider, type, class, name, collection time, complete, the record
|                               as JSON, its CONTENT HASH) -- MERGE by key; the CI a record belongs to (CiId) is kept
|      sidata.RecordIdentifier  the record's strong identifiers (the identity ledger's types -- the SAME extraction the CI
|                               build groups on, Get-SIRecordIdentifiers) -- narrow and indexed
|
|    COST (#501, operator: "performance and cost must be optimed"): a record whose CONTENT did not change (the hash leaves out
|    what changes every run: collection time, run id, complete) keeps its JSON and its identifiers -- only its collection
|    time and completeness are set (one set-based statement for the batch; the link state reads them). A changed record
|    gets its JSON, hash and identifiers rewritten.
|    A failed write is said and counted; it never fails the profiler (the profile rows are unaffected), but the CIs of a
|    run with missing records are built from what the database holds.
|    PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Get-SIRecordIdentifiers -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-CiBuild.ps1') }
|if (-not (Get-Command -Name Get-SIObjectLedgerConnection -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'identity\SI-ObjectLedgerStore.ps1') }
|
|# the fields that change on every run without the record changing -- left out of the content hash; the first three are
|# kept as COLUMNS (CollectionTime, Complete, SourceLastSeen) and the CI build reads them from the columns, not the JSON
|$script:SIRecordVolatileFields = @('si_collection_time', 'si_collection_complete', 'si_source_last_seen', 'si_run_id')
|
|function Get-SIContentHash {
|    <#
|        PURE. SHA-256 (hex) of an object's content WITHOUT the -Exclude fields: the keys in ordinal order, compact JSON --
|        the same content always gives the same hash on every host (no culture, no key order).
|    #>
|    param([Parameter(Mandatory)]$Item, [string[]]$Exclude = @())
|    $o = [ordered]@{}
|    $names = New-Object System.Collections.Generic.List[string]
|    if ($Item -is [System.Collections.IDictionary]) { foreach ($k in $Item.Keys) { $names.Add([string]$k) } }
|    else { foreach ($p in $Item.PSObject.Properties) { $names.Add([string]$p.Name) } }
|    $arr = $names.ToArray(); [Array]::Sort($arr, [StringComparer]::Ordinal)
|    foreach ($n in $arr) {
|        if ($Exclude -contains $n) { continue }
|        if ($Item -is [System.Collections.IDictionary]) { $o[$n] = $Item[$n] } else { $o[$n] = $Item.PSObject.Properties[$n].Value }
|    }
|    $json = ConvertTo-Json -InputObject $o -Compress -Depth 14
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { ([System.BitConverter]::ToString($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($json))) -replace '-', '') }
|    finally { $sha.Dispose() }
|}
|
|# 🔴 THE IDENTIFIER KEY MUST FIT SQL SERVER'S 900-BYTE CLUSTERED KEY. sidata.RecordIdentifier's key is RecordKey + IdType +
|# IdValue, and an Azure resource's record key ("azure:<resource id>") plus its resource id identifier is longer: one such
|# record made the whole batch's write fail ("The index entry of length 906 bytes for the index 'PK_RecordIdentifier'
|# exceeds the maximum length of 900 bytes"), on every run, so no Azure record reached the database, their CIs were no
|# longer built, and Risk Analysis lost the CI -- tier, risk factors, classification (the SQL tag) -- of every cloud resource.
|# The schema is additive-only (no key change), so a LONG identifier value is stored as its SHA-256 instead. The decision
|# depends on the value alone, so the same identifier is the same stored value on every record (the grouping compares
|# equality only), and the readers that match a plain value against the table hash it the same way
|# (Get-SIRecordIdValueSqlExpr). A record whose key is still too long is written without that identifier, with a warning,
|# instead of failing the batch.
|$script:SIRecordIdValueMaxChars = 128
|$script:SIRecordIdKeyMaxBytes = 900
|
|function ConvertTo-SIRecordIdValue {
|    <# PURE. The stored form of an identifier value: the value (lower-cased), or 'sha256:' + the lower-case hex SHA-256 of its
|       UTF-16LE bytes when it is longer than 128 characters -- what T-SQL HASHBYTES('SHA2_256', <nvarchar>) answers. #>
|    param([AllowNull()][string]$Value)
|    if ($null -eq $Value) { return $null }
|    $v = $Value.Trim().ToLowerInvariant()
|    if ($v.Length -le $script:SIRecordIdValueMaxChars) { return $v }
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { return ('sha256:' + (([System.BitConverter]::ToString($sha.ComputeHash([System.Text.Encoding]::Unicode.GetBytes($v))) -replace '-', '').ToLowerInvariant())) }
|    finally { $sha.Dispose() }
|}
|
|function Get-SIRecordIdValueSqlExpr {
|    <# PURE. The T-SQL expression that turns a plain identifier value <Expr> into its stored form (ConvertTo-SIRecordIdValue). #>
|    param([Parameter(Mandatory)][string]$Expr)
|    "(CASE WHEN LEN($Expr) > $($script:SIRecordIdValueMaxChars) THEN N'sha256:' + LOWER(CONVERT(NVARCHAR(64), HASHBYTES('SHA2_256', CAST(LOWER(LTRIM(RTRIM($Expr))) AS NVARCHAR(4000))), 2)) ELSE LOWER(LTRIM(RTRIM($Expr))) END)"
|}
|
|function ConvertTo-SIRecordSqlItems {
|    <#
|        PURE. Record rows (the record rows of one batch) -> @{ Records = [CiRecord items]; Identifiers = [items] }.
|        A row without a record key is left out. Every record carries its content hash (Hash, hex).
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [datetime]$Now = [datetime]::UtcNow, [hashtable]$TypeMap = (Get-SICiLedgerTypeMap),
|          # #882 -DeferDoc: no DocJson yet (Write-SIRecordsToSql builds it only for the records that changed); the rows each
|          # record came from are answered as Sources (same order as Records)
|          [switch]$DeferDoc)
|    $srcs = New-Object System.Collections.Generic.List[object]
|    $recs = New-Object System.Collections.Generic.List[object]
|    $ids = New-Object System.Collections.Generic.List[object]
|    $iso = { param($v) if ($null -eq $v -or "$v" -eq '') { $null } elseif ($v -is [datetime]) { $v.ToUniversalTime().ToString('o') } else { [string]$v } }
|    # one record per key (the database compares keys without case): the LAST row of a key wins, whole -- never a mix of
|    # two rows' columns, and only that row's identifiers
|    $last = New-Object 'System.Collections.Generic.Dictionary[string,int]' ([StringComparer]::OrdinalIgnoreCase)
|    $all = @($Rows)
|    for ($n = 0; $n -lt $all.Count; $n++) {
|        if ($null -eq $all[$n]) { continue }
|        $k = [string](Get-SIItemValue $all[$n] 'si_record_key'); if ($k) { $last[$k] = $n }
|    }
|    for ($n = 0; $n -lt $all.Count; $n++) {
|        $r = $all[$n]
|        if ($null -eq $r) { continue }
|        $key = [string](Get-SIItemValue $r 'si_record_key')
|        if (-not $key -or $last[$key] -ne $n) { continue }
|        $complete = Get-SIItemValue $r 'si_collection_complete'
|        $recs.Add([ordered]@{
|            RecordKey = $key; Provider = [string](Get-SIItemValue $r 'si_provider'); RecordType = [string](Get-SIItemValue $r 'si_record_type')
|            Class = [string](Get-SIItemValue $r 'si_class'); Name = [string](Get-SIItemValue $r 'si_asset_name')
|            SourceLastSeen = (& $iso (Get-SIItemValue $r 'si_source_last_seen')); CollectionTime = (& $iso (Get-SIItemValue $r 'si_collection_time'))
|            Complete = $(if ($null -eq $complete) { $null } else { [bool]($complete -eq $true -or "$complete" -match '^(?i)true|1$') })
|            Hash = (Get-SIContentHash -Item $r -Exclude $script:SIRecordVolatileFields)
|            DocJson = $(if ($DeferDoc) { $null } else { ConvertTo-Json -InputObject $r -Compress -Depth 12 })
|        })
|        $srcs.Add($r)
|        foreach ($i in (Get-SIRecordIdentifiers -Record $r -TypeMap $TypeMap)) {
|            $iv = ConvertTo-SIRecordIdValue ([string]$i.Value)
|            if (2 * ($key.Length + ([string]$i.Type).Length + $iv.Length) -gt $script:SIRecordIdKeyMaxBytes) {
|                $script:SIRecordIdTooLong++
|                continue
|            }
|            $ids.Add([ordered]@{ RecordKey = $key; IdType = [string]$i.Type; IdValue = $iv; SeenAt = $Now.ToUniversalTime().ToString('o') })
|        }
|    }
|    $o = [pscustomobject]@{ Records = $recs.ToArray(); Identifiers = $ids.ToArray() }
|    if ($DeferDoc) { $o | Add-Member -NotePropertyName Sources -NotePropertyValue $srcs.ToArray() }
|    $o
|}
|
|function Get-SIRecordSqlChangedKeysSql {
|    <#
|        #882 -- ONLY WHAT CHANGED IS SENT. One read before a batch is written: of the batch's records (@deltaKeys = [{ RecordKey; Hash }]),
|        which are new or carry another content hash than the stored one (@deltaKeys: a parameter name no other statement uses -- the seams and tests tell the statements apart by it). Answers ONE row: DeltaAsked (how many keys were
|        asked -- the caller trusts the answer only when it matches) and ChangedKeys (JSON [{ RecordKey }]). Read-only.
|        Measured at a large install (2026-10-21): 2.5 million records a run, 1.43 million of them on-premises AD identities
|        93 % unchanged -- each sent whole (its document) and parsed by the database on every run.
|    #>
|    @'
|SET NOCOUNT ON;
|DECLARE @k TABLE (RecordKey NVARCHAR(450) PRIMARY KEY, Hash VARBINARY(32));
|INSERT @k SELECT RecordKey, MAX(CONVERT(VARBINARY(32), Hash, 2))
|FROM OPENJSON(@deltaKeys) WITH (RecordKey NVARCHAR(450), Hash VARCHAR(64)) WHERE RecordKey IS NOT NULL GROUP BY RecordKey;
|SELECT (SELECT COUNT(*) FROM @k) AS DeltaAsked,
|       (SELECT k.RecordKey FROM @k k LEFT JOIN sidata.CiRecord t ON t.RecordKey = k.RecordKey
|        WHERE t.RecordKey IS NULL OR t.ContentHash IS NULL OR t.ContentHash <> k.Hash FOR JSON PATH) AS ChangedKeys;
|'@
|}
|
|function Get-SIRecordSqlChangedKeys {
|    <#
|        #882: the keys of -Records (ConvertTo-SIRecordSqlItems items) that are new or changed in the database, as a
|        case-insensitive set -- or $null when that cannot be shown (no answer, an answer that does not count every key asked,
|        an error): then every record is sent whole, as before. Never throws.
|    #>
|    param([AllowEmptyCollection()][object[]]$Records = @(), [Parameter(Mandatory)][scriptblock]$Invoke)
|    try {
|        $hk = @(foreach ($x in @($Records)) { if ($null -ne $x) { [ordered]@{ RecordKey = [string]$x.RecordKey; Hash = [string]$x.Hash } } })
|        if (-not $hk.Count) { return $null }
|        $res = @(& $Invoke (Get-SIRecordSqlChangedKeysSql) @{ deltaKeys = (ConvertTo-SIJsonArray $hk) } 'rows')
|        $row = $null; if ($res.Count -gt 0) { $row = $res[0] }
|        if ($null -eq $row) { return $null }
|        $asked = Get-SIItemValue $row 'DeltaAsked'
|        if ($null -eq $asked -or $asked -is [System.DBNull]) { return $null }
|        $distinct = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|        foreach ($x in $hk) { [void]$distinct.Add([string]$x.RecordKey) }
|        if ([int]$asked -ne $distinct.Count) { return $null }
|        $set = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|        $json = Get-SIItemValue $row 'ChangedKeys'
|        if ($null -ne $json -and $json -isnot [System.DBNull] -and "$json".Trim()) {
|            foreach ($c in @(ConvertFrom-Json -InputObject ([string]$json))) { if ($null -ne $c -and [string]$c.RecordKey) { [void]$set.Add([string]$c.RecordKey) } }
|        }
|        , $set
|    } catch { $null }
|}
|
|function Get-SIRecordSqlWriteSql {
|    <#
|        The ONE statement a batch is written with. New or CHANGED records (hash differs): the whole row and their
|        identifiers. Unchanged records: only the collection time, completeness and source last-seen. Answers one row:
|        Seen (the batch), Changed (new + changed), and the identifier rows written.
|        ONE WRITER AT A TIME (record-deadlock, 2026-10-26): several processes publish one run's buckets at once, and two of
|        them deadlocked on sidata.CiRecord (SQL error 1205 -- their keys are disjoint, but the UPDATE moves the collection
|        time in three indexes and the joins can scan). So the transaction first takes the database's application lock
|        'si-record-write', owned by the TRANSACTION (freed by its commit or rollback, never left behind), waiting up to
|        -LockMs. Not free in time: error 51222, retried like a lock timeout (Write-SIRecordsToSql). Only this write waits --
|        the merging, the conversion and the changed-keys read stay parallel. Which records changed is read INSIDE the
|        lock, so it is what the write sees. -LockMs 0 = no lock (only the tests' measurement uses it).
|        SAFE TO RERUN: SET XACT_ABORT ON rolls the whole transaction back on any error (a deadlock victim too) and ends
|        the batch; a rerun is a new batch that declares its table variables again from @r / @i and reads @changed again
|        from what is committed -- the same input gives the same rows (proven on a real SQL Server: SIv3-RecordDeadlock).
|    #>
|    param([int]$LockMs = 120000)
|    $lock = ''
|    if ($LockMs -gt 0) {
|        $lock = ("DECLARE @lk INT;`n" +
|            "EXEC @lk = sp_getapplock @Resource = N'si-record-write', @LockMode = N'Exclusive', @LockOwner = N'Transaction', @LockTimeout = {0};`n" +
|            "IF @lk < 0 BEGIN DECLARE @lkm NVARCHAR(300) = CONCAT(N'the record write lock (si-record-write) was not free in {1} s (sp_getapplock answered ', @lk, N')'); THROW 51222, @lkm, 1; END;`n") -f [int]$LockMs, [int][Math]::Ceiling($LockMs / 1000.0)
|    }
|    (@'
|SET XACT_ABORT ON;
|SET NOCOUNT ON;
|DECLARE @s TABLE (RecordKey NVARCHAR(450) PRIMARY KEY, Provider NVARCHAR(32), RecordType NVARCHAR(32), Class NVARCHAR(16), Name NVARCHAR(400),
|    SourceLastSeen DATETIME2(3), CollectionTime DATETIME2(3), Complete BIT, Hash VARBINARY(32), DocJson NVARCHAR(MAX));
|INSERT @s SELECT RecordKey, MAX(Provider), MAX(RecordType), MAX(Class), MAX(Name), MAX(SourceLastSeen), MAX(CollectionTime), CAST(MAX(CAST(Complete AS INT)) AS BIT),
|    MAX(CONVERT(VARBINARY(32), Hash, 2)), MAX(DocJson)
|FROM OPENJSON(@r) WITH (RecordKey NVARCHAR(450), Provider NVARCHAR(32), RecordType NVARCHAR(32), Class NVARCHAR(16), Name NVARCHAR(400),
|    SourceLastSeen DATETIME2(3), CollectionTime DATETIME2(3), Complete BIT, Hash VARCHAR(64), DocJson NVARCHAR(MAX))
|WHERE RecordKey IS NOT NULL GROUP BY RecordKey;
|DECLARE @changed TABLE (RecordKey NVARCHAR(450) PRIMARY KEY);
|BEGIN TRANSACTION;
|{WRITELOCK}INSERT @changed SELECT s.RecordKey FROM @s s LEFT JOIN sidata.CiRecord t ON t.RecordKey = s.RecordKey
|WHERE (t.RecordKey IS NULL OR t.ContentHash IS NULL OR t.ContentHash <> s.Hash) AND s.DocJson IS NOT NULL;
|UPDATE t SET CollectionTime = s.CollectionTime, Complete = s.Complete, SourceLastSeen = s.SourceLastSeen
|FROM sidata.CiRecord t JOIN @s s ON s.RecordKey = t.RecordKey
|WHERE s.RecordKey NOT IN (SELECT RecordKey FROM @changed)
|  AND (t.CollectionTime <> s.CollectionTime OR ISNULL(t.Complete, 1) <> ISNULL(s.Complete, 1) OR ISNULL(t.SourceLastSeen, '19000101') <> ISNULL(s.SourceLastSeen, '19000101'));
|MERGE sidata.CiRecord AS t
|USING (SELECT s.* FROM @s s JOIN @changed c ON c.RecordKey = s.RecordKey) AS s
|ON t.RecordKey = s.RecordKey
|WHEN MATCHED THEN UPDATE SET Provider = s.Provider, RecordType = s.RecordType, Class = s.Class, Name = s.Name, SourceLastSeen = s.SourceLastSeen,
|    CollectionTime = s.CollectionTime, Complete = s.Complete, ContentHash = s.Hash, DocJson = s.DocJson
|WHEN NOT MATCHED THEN INSERT (RecordKey, Provider, RecordType, Class, Name, SourceLastSeen, CollectionTime, Complete, ContentHash, DocJson)
|    VALUES (s.RecordKey, s.Provider, s.RecordType, s.Class, s.Name, s.SourceLastSeen, s.CollectionTime, s.Complete, s.Hash, s.DocJson);
|DELETE ri FROM sidata.RecordIdentifier ri WHERE ri.RecordKey IN (SELECT RecordKey FROM @changed);
|INSERT sidata.RecordIdentifier (RecordKey, IdType, IdValue, SeenAt)
|SELECT DISTINCT x.RecordKey, x.IdType, x.IdValue, x.SeenAt FROM OPENJSON(@i) WITH (RecordKey NVARCHAR(450), IdType NVARCHAR(40), IdValue NVARCHAR(400), SeenAt DATETIME2(3)) x
|WHERE x.RecordKey IN (SELECT RecordKey FROM @changed) AND x.IdValue IS NOT NULL;
|DECLARE @ids INT = @@ROWCOUNT;
|COMMIT TRANSACTION;
|SELECT (SELECT COUNT(*) FROM @s) AS Seen, (SELECT COUNT(*) FROM @changed) AS Changed, @ids AS Identifiers;
|'@).Replace('{WRITELOCK}', $lock)
|}
|
|# a batch write that lost a DEADLOCK (1205) or waited too long for a lock (1222; 51222 = the record write lock above) is
|# written again -- the statement is safe to rerun (Get-SIRecordSqlWriteSql). Attempts in all, and the first wait (doubled
|# each time, plus 0-100 % at random so two losers do not meet again). Tests set the wait to almost nothing.
|$script:SIRecordWriteAttempts = 4
|$script:SIRecordWriteRetryMs = 500
|
|function Get-SIRecordWriteRetryReason {
|    <#
|        PURE. Why a failed batch write may be tried again: 'deadlock' (SQL error 1205), 'lock timeout' (1222, or 51222 = the
|        record write lock was not free in time) -- or $null (any other failure: not retried). Reads the SqlException's
|        numbers through the inner exceptions, else the text Format-SISqlError makes ("SQL error 1205 (line ...").
|    #>
|    param($Exception)
|    $nums = New-Object System.Collections.Generic.List[int]
|    $texts = New-Object System.Collections.Generic.List[string]
|    $e = $Exception
|    while ($e) {
|        $texts.Add([string]$e.Message)
|        if ($e -is [System.Data.SqlClient.SqlException]) { foreach ($x in $e.Errors) { $nums.Add([int]$x.Number) } }
|        $e = $e.InnerException
|    }
|    foreach ($t in $texts) { foreach ($m in [regex]::Matches($t, 'SQL error (\d+)\b')) { $nums.Add([int]$m.Groups[1].Value) } }
|    if ($nums.Contains(1205)) { return 'deadlock' }
|    if ($nums.Contains(1222) -or $nums.Contains(51222)) { return 'lock timeout' }
|    $null
|}
|
|function Write-SIRecordsToSql {
|    <#
|        One batch of record rows -> the database. -Invoke { param($Sql, $Params, $Mode) } is the SQL seam (tests; a caller's
|        store; Mode 'rows' answers objects). Returns @{ Seen; Changed; Identifiers; Failed }; never throws (a failure is a
|        warning and Failed = the batch's records).
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [Parameter(Mandatory)][scriptblock]$Invoke, [datetime]$Now = [datetime]::UtcNow,
|          # THE FEED CLOSE (New-SIRecordFeedClose): with it, the first record of each feed in this batch is written "not
|          # complete" until the whole collection is in (Complete-SIRecordFeeds), and a failed batch is counted on it
|          $Close,
|          # what this batch is, for the log lines ("bucket 7"); empty = "a batch of N record(s)"
|          [string]$What = '',
|          # how long the write waits for the record write lock (Get-SIRecordSqlWriteSql); 0 = no lock (tests' measurement)
|          [int]$LockMs = 120000)
|    $items = $null
|    $attempt = 0; $why = $null
|    $pinned = @()
|    try {
|        $script:SIRecordIdTooLong = 0
|        if ($Close) { $pinned = @(Set-SIRecordFeedPins -Rows $Rows -Close $Close | Where-Object { $null -ne $_ }) }
|        $changedKeys = $null
|        try {
|            $items = ConvertTo-SIRecordSqlItems -Rows $Rows -Now $Now -DeferDoc
|            # #882: ONLY WHAT CHANGED IS SENT WHOLE -- the database says which records are new or changed (their content hash);
|            # an unchanged record goes with its key and hash only (its collection time, completeness and last-seen are
|            # updated as before). When that cannot be shown, every record is sent whole, as before.
|            $changedKeys = Get-SIRecordSqlChangedKeys -Records @($items.Records) -Invoke $Invoke
|            for ($ri = 0; $ri -lt @($items.Records).Count; $ri++) {
|                $rec = $items.Records[$ri]
|                if ($null -eq $changedKeys -or $changedKeys.Contains([string]$rec.RecordKey)) { $rec.DocJson = ConvertTo-Json -InputObject $items.Sources[$ri] -Compress -Depth 12 }
|            }
|            if ($null -ne $changedKeys) { $items.Identifiers = @($items.Identifiers | Where-Object { $changedKeys.Contains([string]$_.RecordKey) }) }
|        }
|        finally { foreach ($pr in $pinned) { $pr.si_collection_complete = $true } }   # the rows themselves are handed on unchanged
|        if ($script:SIRecordIdTooLong -gt 0) {
|            Write-Warning ('records: {0} identifier(s) left out -- their record key is too long for the identifier index (900 bytes); those records are kept and grouped by their other identifiers.' -f $script:SIRecordIdTooLong)
|        }
|        if ($items.Records.Count -eq 0) { return [pscustomobject]@{ Seen = 0; Changed = 0; Identifiers = 0; Failed = 0 } }
|        $p = @{ r = (ConvertTo-SIJsonArray $items.Records); i = (ConvertTo-SIJsonArray $items.Identifiers) }
|        # A DEADLOCK OR A LOCK TIMEOUT IS WRITTEN AGAIN (record-deadlock, 2026-10-26: 3,632 of 36,011 records of a run were
|        # lost to two 1205s). The statement is safe to rerun: it rolled back in full. Any other failure, or the last attempt,
|        # fails the batch exactly as before -- said and counted, never a silent loss.
|        $writeSql = Get-SIRecordSqlWriteSql -LockMs $LockMs
|        $max = [Math]::Max(1, [int]$script:SIRecordWriteAttempts)
|        $res = $null
|        $label = $What; if (-not $label) { $label = 'a batch of {0} record(s)' -f @($items.Records).Count }
|        for ($attempt = 1; $attempt -le $max; $attempt++) {
|            try { $res = @(& $Invoke $writeSql $p 'rows'); break }
|            catch {
|                $why = Get-SIRecordWriteRetryReason -Exception $_.Exception
|                if (-not $why -or $attempt -ge $max) { throw }
|                $waitMs = [int]([double]$script:SIRecordWriteRetryMs * [Math]::Pow(2, $attempt - 1) * (1.0 + (Get-Random -Minimum 0.0 -Maximum 1.0)))
|                Write-Warning ('records: {0} on {1}, attempt {2} of {3} -- retried in {4:0.0} s' -f $why, $label, $attempt, $max, ($waitMs / 1000.0))
|                Start-Sleep -Milliseconds $waitMs
|            }
|        }
|        if ($attempt -gt 1) { Write-Host ('[INFO] records: {0} written on attempt {1} of {2} (after a {3})' -f $label, $attempt, $max, $why) }
|        $row = $null; if ($res.Count -gt 0) { $row = $res[0] }
|        [pscustomobject]@{ Seen = [int](Get-SIItemValue $row 'Seen'); Changed = [int](Get-SIItemValue $row 'Changed'); Identifiers = [int](Get-SIItemValue $row 'Identifiers'); Failed = 0 }
|    } catch {
|        $n = 0; if ($items) { $n = @($items.Records).Count }
|        $tries = ''; if ($why -and $attempt -gt 1) { $tries = (' -- FAILED after {0} attempts, the last a {1}' -f $attempt, $why) }
|        $where = ''; if ($What) { $where = ' of ' + $What }
|        Write-Warning ('records: {0} record(s){1} could not be written to the database{2} -- {3}. The next run writes them again.' -f $n, $where, $tries, $_.Exception.Message)
|        if ($Close) { $Close.Failed = [int]$Close.Failed + [Math]::Max(1, $n) }
|        [pscustomobject]@{ Seen = 0; Changed = 0; Identifiers = 0; Failed = $n }
|    }
|}
|
|# =====================================================================================================================
|#  THE FEED CLOSE -- a half-written collection never counts as a complete one
|# =====================================================================================================================
|# The CI build reads, per feed (provider + record type), the NEWEST collection time and whether every record of it says
|# "complete" (Get-SICiFeedLatestSql); a record missing from a complete newer collection turns 'not seen'. The records of
|# one collection are written in batches, by one process or by several. A collection that stopped half-way -- the process
|# ended, a batch could not be written -- must not look like a complete one that simply has fewer records: every record it
|# did not reach would turn 'not seen', and CIs would be retired by a failure.
|# So the FIRST record of each feed in every batch is written "not complete" (a PIN), and the pins are set to complete in
|# ONE statement when every batch of the collection is in (Complete-SIRecordFeeds) -- which also registers the collection
|# (sidata.RecordCollection: who wrote it, how many records). A collection that never closed keeps its pins: its feed's
|# newest collection is not complete, so what it missed is FROZEN (it keeps its CI active). Cost: one extra statement per
|# collection and a handful of rows. Absence is never read from a collection that did not close.
|
|function New-SIRecordFeedClose {
|    <# The close of ONE collection (one engine run): the pins written so far, the feeds seen, the batches that failed. #>
|    param([string]$Engine = '')
|    [pscustomobject]@{ Engine = ([string]$Engine).Trim().ToLowerInvariant(); Pins = (New-Object System.Collections.Generic.List[string])
|                       Feeds = @{}; Incomplete = @{}; Failed = 0; PinFeed = @{} }
|}
|
|function Set-SIRecordFeedPins {
|    <#
|        PURE (changes -Rows in place; the caller sets them back). The first record of each feed in this batch whose pull
|        was complete is marked "not complete" and remembered on -Close. A feed whose own pull was NOT complete is only
|        noted (its records already say so, and it is not registered as a good collection). Returns the rows it pinned.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [Parameter(Mandatory)]$Close)
|    $seen = @{}
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $key = [string](Get-SIItemValue $r 'si_record_key')
|        if (-not $key) { continue }
|        $feed = Get-SIRecordFeed $r
|        $c = Get-SIItemValue $r 'si_collection_complete'
|        if ($null -ne $c -and -not ($c -eq $true -or "$c" -match '^(?i)(true|1)$')) { $Close.Incomplete[$feed] = $true; continue }
|        $Close.Feeds[$feed] = $true
|        if ($seen.ContainsKey($feed)) { continue }
|        if (-not ($r -is [psobject]) -or -not $r.PSObject.Properties['si_collection_complete']) { continue }
|        $seen[$feed] = $true
|        $r.si_collection_complete = $false
|        $Close.Pins.Add($key)
|        if ($Close.PSObject.Properties['PinFeed']) { $Close.PinFeed[$key] = $feed }
|        $out.Add($r)
|    }
|    # each pinned row by itself (never the list as ONE object: the caller sets every row back, one by one)
|    $out.ToArray()
|}
|
|function Get-SIRecordFeedCloseSql {
|    <#
|        The ONE statement that closes a collection: @k = the pinned record keys (JSON array of text), @f = its feeds
|        ([{ Provider; RecordType }]), @ctText = the collection time (ISO), @engine = the collection step that wrote it.
|        The pins become complete; each feed's collection is registered with its record count (a collection a failed step
|        already had HELD stays held). Answers Closed (pins set) and Feeds (registered).
|        A feed may carry State 'drop' and a Reason (the asset-drop guard keeps the last good collection: one of its pins is
|        then left out of @k by the caller, so that feed's collection stays "not complete").
|    #>
|    @'
|SET NOCOUNT ON;
|SET XACT_ABORT ON;
|DECLARE @ct DATETIME2(3) = TRY_CONVERT(DATETIME2(3), NULLIF(@ctText, N''), 127);
|DECLARE @n INT = 0, @feeds INT = 0;
|BEGIN TRANSACTION;
|UPDATE r SET Complete = 1
|FROM sidata.CiRecord r JOIN OPENJSON(@k) WITH (RecordKey NVARCHAR(450) '$') k ON k.RecordKey = r.RecordKey
|WHERE r.CollectionTime = @ct AND r.Complete = 0;
|SET @n = @@ROWCOUNT;
|IF OBJECT_ID('sidata.RecordCollection') IS NOT NULL
|BEGIN
|    MERGE sidata.RecordCollection AS t
|    USING (SELECT f.Provider, ISNULL(f.RecordType, N'') AS RecordType, f.State, f.Reason,
|                  (SELECT COUNT(*) FROM sidata.CiRecord r WHERE r.Provider = f.Provider AND ISNULL(r.RecordType, N'') = ISNULL(f.RecordType, N'') AND r.CollectionTime = @ct) AS Records
|           FROM OPENJSON(@f) WITH (Provider NVARCHAR(32), RecordType NVARCHAR(32), State NVARCHAR(16), Reason NVARCHAR(400)) f WHERE f.Provider IS NOT NULL) AS s
|    ON t.Provider = s.Provider AND t.RecordType = s.RecordType AND t.CollectionTime = @ct
|    WHEN MATCHED THEN UPDATE SET Records = s.Records, UpdatedAt = SYSUTCDATETIME(),
|         State = CASE WHEN t.State = N'held' OR s.State IS NULL THEN t.State ELSE s.State END, Reason = ISNULL(s.Reason, t.Reason)
|    WHEN NOT MATCHED THEN INSERT (Provider, RecordType, CollectionTime, Engine, Records, State, Reason) VALUES (s.Provider, s.RecordType, @ct, @engine, s.Records, ISNULL(s.State, N'good'), s.Reason);
|    SET @feeds = @@ROWCOUNT;
|END
|COMMIT TRANSACTION;
|SELECT @n AS Closed, @feeds AS Feeds;
|'@
|}
|
|# =====================================================================================================================
|#  THE ASSET-DROP GUARD (collection.source.asset-drop) -- the customer decides (owner 2026-10-12: "what happens with
|#  assets, make guard, let customer decide. it can be deletion of many azure ress")
|# =====================================================================================================================
|# A collection can COMPLETE and still carry far fewer assets than before: a real clean-up (many Azure resources removed),
|# or a source that answered only in part. Findings and vulnerabilities go up and down and are never judged by count; the
|# RECORDS of a feed (provider + record type: devices, users, Azure resources ...) are assets, and they are judged here,
|# when the collection closes -- BEFORE the CI build reads the feed:
|#   the feed's record count against its LAST GOOD collection, down by SI_Pro_DataQuality_AssetDropPercent (30 %) or more,
|#   and only when that last good collection had at least 20 records (a small feed moves by whole assets: 3 of 8 gone is
|#   38 % and no sign of a broken source -- 20 keeps the limit above "a handful of assets changed").
|# What then happens is the customer's choice, SI_Pro_SourceDropout_AssetDropAction:
|#   confirm (default)  the new collection is NOT taken as the truth: it is registered as a 'drop', and one of its records
|#                      stays "not complete", so everything it no longer lists is frozen (as when a collection fails). The
|#                      run goes on. When the NEXT complete collection of that feed shows the same level (within the
|#                      limit of the dropped level) the drop is accepted by itself -- a real mass deletion needs no person
|#                      and costs one run. Back to normal instead = the drop never took effect.
|#   accept             the records are taken as they came; the guard only reports.
|# One event per drop: the first collection that drops raises it; the collections that follow while it is unconfirmed do not.
|# A collection published by several processes at once (scheduled shards) is not judged: each sees only its own part.
|$script:SIRecordDropMinRecords = 20
|$script:SIRecordDropGuardId = 'collection.source.asset-drop'
|# A FEED SEVERAL STEPS WRITE IS JUDGED ONLY BY THE STEP THAT WRITES IT WHOLE. Every collection step reads the Exposure
|# Graph, so an eg feed is written by more than one step under the same collection time (the time is the minute the run
|# started): the endpoint step records the eg nodes of its Azure VMs and Arc machines (a handful), the Azure step every
|# Azure node. The step that closed first counted only what was written so far and held a feed that was not yet whole --
|# 3 against 36, then 36 against 36 one minute later (three installs, 2026-10-19/20). The other steps' part of such a feed
|# is a subset of the owner's (same record keys), so the owner's close always sees the whole feed; the others do not judge it.
|$script:SIRecordFeedOwner = @{ 'eg|azure_resource' = 'azure'; 'eg|public_ip' = 'azure'; 'eg|device' = 'endpoint'
|                               'eg|user' = 'identity'; 'eg|service_principal' = 'identity' }
|
|function Test-SIRecordFeedJudgedBy {
|    <# PURE. Whether the collection step -Engine judges the feed (provider|record type): its owner does, a step that writes
|       only a part of it does not ("not judged yet" -- never held, never a drop). An unknown step judges every feed. #>
|    param([string]$Feed, [string]$Engine = '')
|    $e = ([string]$Engine).Trim().ToLowerInvariant()
|    $f = ([string]$Feed).Trim().ToLowerInvariant()
|    if (-not $e -or -not $script:SIRecordFeedOwner.ContainsKey($f)) { return $true }
|    $script:SIRecordFeedOwner[$f] -eq $e
|}
|
|function Get-SIRecordDropSettings {
|    <# PURE. The limit and the choice: @{ Percent (1-100, default 30); Action ('confirm' | 'accept'); MinRecords }. #>
|    param($Percent = $global:SI_Pro_DataQuality_AssetDropPercent, $Action = $global:SI_Pro_SourceDropout_AssetDropAction)
|    $pc = 0
|    if (-not ($null -ne $Percent -and [int]::TryParse(([string]$Percent).Trim(), [ref]$pc) -and $pc -ge 1 -and $pc -le 100)) { $pc = 30 }
|    $act = if (([string]$Action).Trim().ToLowerInvariant() -eq 'accept') { 'accept' } else { 'confirm' }
|    [pscustomobject]@{ Percent = $pc; Action = $act; MinRecords = $script:SIRecordDropMinRecords }
|}
|
|function Get-SIRecordFeedDropVerdict {
|    <#
|        PURE. One feed's collection against its history. -Now: its record count; -History: its earlier collections, NEWEST
|        FIRST (@{ Records; State }: good | drop | held). Returns @{ Action; Drop; Baseline; ChangePercent; Event; Confirmed }:
|          take    not a drop (or nothing to compare with, or a feed too small to judge) -- taken as it came;
|          hold    a drop under 'confirm': the last good collection is kept (Event = $true only for the FIRST such collection);
|          accept  a drop that is taken: under 'accept' at once (Event = $true, it only reports), or under 'confirm' because
|                  the collection before it was a drop at the same level (Confirmed = $true, no event).
|    #>
|    param([int]$Now, [AllowEmptyCollection()][object[]]$History = @(), [int]$Percent = 30, [int]$MinRecords = 20, [string]$Action = 'confirm')
|    $res = [ordered]@{ Action = 'take'; Drop = $false; Baseline = $null; ChangePercent = $null; Event = $false; Confirmed = $false }
|    $hist = @($History | Where-Object { $_ })
|    $good = @($hist | Where-Object { [string]$_.State -eq 'good' }) | Select-Object -First 1
|    if (-not $good -or [int]$good.Records -lt $MinRecords) { return [pscustomobject]$res }
|    $base = [int]$good.Records
|    $res.Baseline = $base
|    $res.ChangePercent = [math]::Round(100.0 * ($Now - $base) / $base, 1)
|    if ($res.ChangePercent -gt (0 - $Percent)) { return [pscustomobject]$res }
|    $res.Drop = $true
|    if ($Action -eq 'accept') { $res.Action = 'accept'; $res.Event = $true; return [pscustomobject]$res }
|    $prev = $hist[0]
|    if ([string]$prev.State -eq 'drop') {
|        $pr = [int]$prev.Records
|        if ($pr -gt 0 -and [math]::Abs(100.0 * ($Now - $pr) / $pr) -lt $Percent) { $res.Action = 'accept'; $res.Confirmed = $true }
|        else { $res.Action = 'hold' }
|        return [pscustomobject]$res
|    }
|    $res.Action = 'hold'; $res.Event = $true
|    [pscustomobject]$res
|}
|
|function Get-SIRecordFeedDropSql {
|    <# ONE read at the close: per feed of @f, how many records the collection @ctText holds now, and the feed's 8 newest
|       earlier collections OF THE SAME COLLECTION STEP @engine (newest first). Without sidata.RecordCollection: no rows.
|       Why the step: one feed can be written by two steps -- the endpoint collection records the Exposure Graph nodes of
|       Azure VMs and Arc machines (eg azure_resource, a handful), the Azure collection records every Azure node (eg
|       azure_resource, all of them). Measured at the internal install 2026-10-13: the endpoint's 8 were judged against the
|       Azure collection's 101 (-92 %) and held, every night, though nothing was missing. A step is judged against itself. #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.RecordCollection') IS NULL
|BEGIN
|    SELECT CAST(NULL AS NVARCHAR(32)) AS Provider, CAST(NULL AS NVARCHAR(32)) AS RecordType, 0 AS NowRecords, CAST(NULL AS DATETIME2(3)) AS CollectionTime, 0 AS Records, CAST(NULL AS NVARCHAR(16)) AS State WHERE 1 = 0;
|    RETURN;
|END
|DECLARE @ct DATETIME2(3) = TRY_CONVERT(DATETIME2(3), NULLIF(@ctText, N''), 127);
|SELECT f.Provider, ISNULL(f.RecordType, N'') AS RecordType,
|       (SELECT COUNT(*) FROM sidata.CiRecord r WHERE r.Provider = f.Provider AND ISNULL(r.RecordType, N'') = ISNULL(f.RecordType, N'') AND r.CollectionTime = @ct) AS NowRecords,
|       h.CollectionTime, h.Records, h.State
|FROM OPENJSON(@h) WITH (Provider NVARCHAR(32), RecordType NVARCHAR(32)) f
|OUTER APPLY (SELECT TOP (8) c.CollectionTime, c.Records, c.State FROM sidata.RecordCollection c
|             WHERE c.Provider = f.Provider AND c.RecordType = ISNULL(f.RecordType, N'') AND c.CollectionTime < @ct
|               AND (ISNULL(@engine, N'') = N'' OR ISNULL(c.Engine, N'') = @engine)
|             ORDER BY c.CollectionTime DESC) h
|WHERE f.Provider IS NOT NULL
|ORDER BY f.Provider, f.RecordType, h.CollectionTime DESC;
|'@
|}
|
|function Get-SIRecordFeedDrops {
|    <#
|        The asset-drop guard's verdicts for the feeds of one collection, at its close: @(@{ Feed; Provider; RecordType; Now;
|        Baseline; ChangePercent; Action; Event; Confirmed; Text }) -- only the feeds that DROPPED. Nothing is judged when
|        the guard is off (Settings > Guards), when the collection is published by several processes at once (scheduled
|        shards), or when the history cannot be read. Never throws -- a guard never blocks a run.
|    #>
|    param([AllowEmptyCollection()][object[]]$Feeds = @(), [Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$CollectionTimeText, [string]$Engine = '',
|          $Settings, [int]$ShardCount = -1,
|          # owner 2026-10-17 (guards heal themselves): every feed judged and NOT held is added here as a guard check
|          # (@{ GuardId; Subject; Values; Detail }) -- the close hands them to the guard, which clears an earlier drop's episode
|          [System.Collections.Generic.List[object]]$Checks,
|          # #1056 the install's identity choice (Get-SIIdentityScopeChoice); not given = the install's settings
|          $IdentityChoice)
|    try {
|        if (-not @($Feeds).Count) { return }
|        if ($ShardCount -lt 0) { $sc = 0; if (-not [int]::TryParse([string][Environment]::GetEnvironmentVariable('SI_SHARD_COUNT'), [ref]$sc)) { $sc = 1 }; $ShardCount = $sc }
|        if ($ShardCount -gt 1) { return }
|        # a feed this step writes only a part of is judged by the step that writes it whole (Test-SIRecordFeedJudgedBy)
|        $Feeds = @(@($Feeds) | Where-Object { $_ -and (Test-SIRecordFeedJudgedBy -Feed ('{0}|{1}' -f (Get-SIItemValue $_ 'Provider'), (Get-SIItemValue $_ 'RecordType')) -Engine $Engine) })
|        if (-not $Feeds.Count) { return }
|        if ((Get-Command -Name Test-SIGuardOn -ErrorAction SilentlyContinue) -and -not (Test-SIGuardOn -GuardId $script:SIRecordDropGuardId)) { return }
|        if (-not $Settings) {
|            $Settings = Get-SIRecordDropSettings
|            # CR4 (#654): halved for 24 hours after a release that changed engine code (the configured share x 0.5, at least 1)
|            if (-not (Get-Command -Name Resolve-SIGuardLimit -ErrorAction SilentlyContinue)) {
|                $sgs = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-GuardStrict.ps1')
|                if ([IO.File]::Exists($sgs)) { . $sgs }
|            }
|            if (Get-Command -Name Resolve-SIGuardLimit -ErrorAction SilentlyContinue) {
|                $Settings.Percent = [int](Resolve-SIGuardLimit -GuardId $script:SIRecordDropGuardId -Name 'changePercent' -Label 'Asset drop at most (% of a source''s records)' -Configured $Settings.Percent -Unit '%').Effective
|            }
|        }
|        $rows = @(& $Invoke (Get-SIRecordFeedDropSql) @{ h = (ConvertTo-SIJsonArray @($Feeds)); ctText = $CollectionTimeText; engine = ([string]$Engine).Trim().ToLowerInvariant() } 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })
|        $by = [ordered]@{}
|        foreach ($r in $rows) {
|            $p = [string](Get-SIItemValue $r 'Provider'); if (-not $p) { continue }
|            $k = '{0}|{1}' -f $p, [string](Get-SIItemValue $r 'RecordType')
|            if (-not $by.Contains($k)) { $by[$k] = [pscustomobject]@{ Provider = $p; RecordType = [string](Get-SIItemValue $r 'RecordType'); Now = [int](Get-SIItemValue $r 'NowRecords'); History = (New-Object System.Collections.Generic.List[object]) } }
|            $st = Get-SIItemValue $r 'State'
|            if ($null -ne $st -and -not ($st -is [DBNull]) -and "$st") { $rc = Get-SIItemValue $r 'Records'; if ($null -eq $rc -or $rc -is [DBNull]) { $rc = 0 }; $by[$k].History.Add([pscustomobject]@{ Records = [int]$rc; State = [string]$st }) }
|        }
|        # #1056 a customer's choice (SI_Identity_SkipNeverSyncedAd / SI_Identity_SkipNeverSyncedDisabledAd / SI_Identity_SkipDeletedGroups) leaves records out
|        # of the Exposure Graph feed on purpose: they are added back to the count judged here, so the choice is never read as a
|        # broken source. Read only while a switch is on in this install; off, nothing changes.
|        $leftOut = @{}
|        if ($null -eq $IdentityChoice -and (Get-Command -Name Get-SIIdentityScopeChoice -ErrorAction SilentlyContinue)) { $IdentityChoice = Get-SIIdentityScopeChoice }
|        if ($null -ne $IdentityChoice -and $IdentityChoice.Any -and (Get-Command -Name Get-SIIdentityScopeLeftOutByFeed -ErrorAction SilentlyContinue)) {
|            $leftOut = Get-SIIdentityScopeLeftOutByFeed -Invoke $Invoke -CollectionTimeText $CollectionTimeText -Choice $IdentityChoice
|        }
|        foreach ($k in $by.Keys) {
|            $f = $by[$k]
|            $lk = ([string]$k).ToLowerInvariant()
|            if ($leftOut.ContainsKey($lk) -and [long]$leftOut[$lk] -gt 0) {
|                Write-Host ('[INFO] records: {0} {1}: {2} record(s) left out by the install''s choice this run are counted with the {3} recorded for the asset-drop check' -f $f.Provider, $f.RecordType, $leftOut[$lk], $f.Now)
|                $f.Now = [int]([Math]::Min([long][int]::MaxValue, [long]$f.Now + [long]$leftOut[$lk]))
|            }
|            $v = Get-SIRecordFeedDropVerdict -Now $f.Now -History $f.History.ToArray() -Percent $Settings.Percent -MinRecords $Settings.MinRecords -Action $Settings.Action
|            if ($null -ne $Checks) { $ck = Get-SIRecordFeedDropCheck -Feed $f -Verdict $v -Percent $Settings.Percent; if ($ck) { $Checks.Add($ck) } }
|            if (-not $v.Drop) { continue }
|            $what = '{0} {1} records: {2} in this collection against {3} in the last good one ({4} %)' -f $f.Provider, $f.RecordType, $f.Now, $v.Baseline, $v.ChangePercent
|            $text = switch ($v.Action) {
|                'hold' { $what + ' -- the last good collection is kept until the next complete collection shows the same level' }
|                default { if ($v.Confirmed) { $what + ' -- the same level as the collection before it: the drop is accepted' } else { $what + ' -- taken as it came (SI_Pro_SourceDropout_AssetDropAction = accept)' } }
|            }
|            Write-Host ('[{0}] records: {1}' -f $(if ($v.Action -eq 'hold') { 'WARN' } else { 'INFO' }), $text)
|            [pscustomobject]@{ Feed = $k; Provider = $f.Provider; RecordType = $f.RecordType; Now = $f.Now; Baseline = $v.Baseline; ChangePercent = $v.ChangePercent
|                               Action = $v.Action; Event = [bool]$v.Event; Confirmed = [bool]$v.Confirmed; Text = $text; Percent = $Settings.Percent }
|        }
|    } catch { Write-Warning ('records: the asset-drop check could not be made -- {0}. The collection is taken as it came.' -f $_.Exception.Message) }
|}
|
|function Get-SIRecordFeedDropCheck {
|    <#
|        PURE. One judged feed as a guard CHECK (owner 2026-10-17, guards heal themselves) -- @{ GuardId; Subject; Values;
|        Detail }, or $null when the feed is held or raised its own event this run:
|          take               back within the limit of its last good collection (or nothing to judge): clears an earlier drop
|                             "back at the normal level" -- the drop never took effect;
|          accept, confirmed  the same level twice: the drop is TAKEN AS THE NEW LEVEL -- never a heal: the episode closes
|                             with its own words (How 'taken': "taken as the new level after 2 runs at the same level -- not
|                             back to normal"), Invardia is NOT told it cleared (its ticket stays), and a later collection at
|                             that level is not read as "back to normal";
|          hold / accept now  still low, or reported this run: nothing is cleared.
|    #>
|    param([Parameter(Mandatory)]$Feed, [Parameter(Mandatory)]$Verdict, [int]$Percent = 30)
|    $sub = '{0} {1}' -f $Feed.Provider, $Feed.RecordType
|    if ($Verdict.Action -eq 'take') {
|        $vals = @(); $det = ''
|        if ($null -ne $Verdict.Baseline) {
|            $vals = @(@{ Name = 'changePercent'; Label = 'Change'; Measured = $Verdict.ChangePercent; Limit = (-1 * $Percent); Unit = '%' })
|            $det = '{0} records: {1} in this collection against {2} in the last good one -- back at the normal level.' -f $sub, $Feed.Now, $Verdict.Baseline
|        }
|        return @{ GuardId = $script:SIRecordDropGuardId; Subject = $sub; Values = $vals; Detail = $det }
|    }
|    if ($Verdict.Action -eq 'accept' -and $Verdict.Confirmed) {
|        return @{ GuardId = $script:SIRecordDropGuardId; Subject = $sub; Values = @(); How = 'taken'
|                  Detail = ('{0} records: {1} in this collection against {2} in the last good one, the same level as the collection before it.' -f $sub, $Feed.Now, $Verdict.Baseline) }
|    }
|    $null
|}
|
|function Get-SIGuardCallsForRecordDrop {
|    <# PURE. The guard events of the drops that raise one (Send-SIGuardEvent arguments): 'held' when the last good collection
|       is kept, 'warning' when the drop was taken at once. One per feed and drop -- a drop that is still unconfirmed, or
|       confirmed, raises none. #>
|    param([AllowEmptyCollection()][object[]]$Drops = @(), [string]$Engine = '')
|    foreach ($d in @($Drops | Where-Object { $_ -and $_.Event })) {
|        $c = @{ GuardId = $script:SIRecordDropGuardId; Outcome = $(if ($d.Action -eq 'hold') { 'held' } else { 'warning' }); Subject = ('{0} {1}' -f $d.Provider, $d.RecordType)
|                HeldCount = [long]([math]::Max(0, [int]$d.Baseline - [int]$d.Now)); Detail = ([string]$d.Text + '.')
|                Values = @(@{ Name = 'previousAssets'; Label = 'Assets in the last good collection'; Measured = [long]$d.Baseline },
|                           @{ Name = 'currentAssets'; Label = 'Assets in this collection'; Measured = [long]$d.Now },
|                           @{ Name = 'changePercent'; Label = 'Change'; Measured = $d.ChangePercent; Limit = (-1 * [int]$d.Percent); Unit = '%' }) }
|        if ($Engine) { $c['Job'] = 'si-' + $Engine.Trim().ToLowerInvariant() }
|        $c
|    }
|}
|
|function Send-SIRecordFeedDropEvents {
|    <# Raises the drops' guard events (the Guards page, run health, the guard's mail). Never throws; without the guard
|       code loaded the drop is in the run log only. #>
|    param([AllowEmptyCollection()][object[]]$Drops = @(), [string]$Engine = '',
|          # the feeds judged and not held (Get-SIRecordFeedDropCheck): a complete collection back at the normal level clears an
|          # earlier drop's episode -- recorded, and reported to Invardia as cleared (owner 2026-10-17)
|          [AllowEmptyCollection()][object[]]$Checks = @())
|    try {
|        $calls = @(Get-SIGuardCallsForRecordDrop -Drops $Drops -Engine $Engine)
|        $checked = @($Checks | Where-Object { $_ })
|        if (-not $calls.Count -and -not $checked.Count) { return }
|        if (-not (Get-Command -Name Invoke-SIGuardCalls -ErrorAction SilentlyContinue)) {
|            $g = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-Guard.ps1')
|            if ([IO.File]::Exists($g)) { . $g }
|        }
|        if (Get-Command -Name Invoke-SIGuardCalls -ErrorAction SilentlyContinue) {
|            $common = @{ Engine = $Engine }
|            if ($Engine) { $common['Job'] = 'si-' + $Engine.Trim().ToLowerInvariant() }
|            if ($checked.Count) { $null = Invoke-SIGuardCalls -Calls $calls -Common $common -Checked $checked -Complete $true }
|            else { $null = Invoke-SIGuardCalls -Calls $calls -Common @{ Engine = $Engine } }
|        }
|    } catch { Write-Warning ('records: the asset-drop event could not be raised -- {0}' -f $_.Exception.Message) }
|}
|
|function Complete-SIRecordFeeds {
|    <#
|        The end of a collection's records: when every batch was written (-Close.Failed = 0) the pins become complete and
|        the collection is registered; when a batch failed NOTHING is closed -- the collection stays "not complete" and the
|        records it did not write stay as the last good collection left them (said plainly). Never throws.
|        Returns @{ Closed; Feeds; Held } (Held = $true when it was left open).
|    #>
|    param([Parameter(Mandatory)]$Close, [Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][datetime]$CollectionTime)
|    try {
|        if ([int]$Close.Failed -gt 0) {
|            Write-Warning ('records: this collection is NOT complete -- {0} record(s) could not be written. The records it did not reach keep their last good state (nothing is shown as gone); the next collection that completes sets it right.' -f [int]$Close.Failed)
|            return [pscustomobject]@{ Closed = 0; Feeds = 0; Held = $true }
|        }
|        if ($Close.Pins.Count -eq 0) { return [pscustomobject]@{ Closed = 0; Feeds = 0; Held = $false } }
|        $feeds = @(@($Close.Feeds.Keys) | Where-Object { -not $Close.Incomplete.ContainsKey($_) } | Sort-Object | ForEach-Object {
|                $i = ([string]$_).IndexOf('|'); [ordered]@{ Provider = ([string]$_).Substring(0, $i); RecordType = ([string]$_).Substring($i + 1) } })
|        # (a feed whose own pull was not complete has no pins: all of its records say "not complete", and it is not registered)
|        $ctText = $CollectionTime.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ', [Globalization.CultureInfo]::InvariantCulture)
|        # THE ASSET-DROP GUARD, before the close: a feed that completed with far fewer assets than its last good collection
|        # keeps the last good collection (one of its pins stays "not complete") until the next collection confirms the level
|        $dropChecks = New-Object System.Collections.Generic.List[object]
|        # (a close that is only one of several processes publishing the same collection -- Judge = $false -- counts a feed
|        # before it is whole: not judged, as a sharded collection is not)
|        $drops = @()
|        if (-not ($Close.PSObject.Properties['Judge'] -and -not $Close.Judge)) {
|            $drops = @(Get-SIRecordFeedDrops -Feeds $feeds -Invoke $Invoke -CollectionTimeText $ctText -Engine ([string]$Close.Engine) -Checks $dropChecks)
|        }
|        $pins = New-Object System.Collections.Generic.List[string]
|        $kept = @{}
|        foreach ($d in @($drops | Where-Object { $_.Action -eq 'hold' })) { $kept[[string]$d.Feed] = $d }
|        $left = @{}
|        foreach ($k in $Close.Pins) {
|            $pf = if ($Close.PSObject.Properties['PinFeed'] -and $Close.PinFeed.ContainsKey($k)) { [string]$Close.PinFeed[$k] } else { '' }
|            if ($pf -and $kept.ContainsKey($pf) -and -not $left.ContainsKey($pf)) { $left[$pf] = $k; continue }   # ONE pin of a held feed stays
|            $pins.Add($k)
|        }
|        foreach ($f in $feeds) {
|            $fk = '{0}|{1}' -f $f.Provider, $f.RecordType
|            if ($kept.ContainsKey($fk) -and $left.ContainsKey($fk)) { $f['State'] = 'drop'; $f['Reason'] = [string]$kept[$fk].Text }
|        }
|        $p = @{ k = (ConvertTo-SIJsonArray $pins.ToArray()); f = (ConvertTo-SIJsonArray $feeds); ctText = $ctText; engine = [string]$Close.Engine }
|        $row = @(& $Invoke (Get-SIRecordFeedCloseSql) $p 'rows') | Select-Object -First 1
|        # the collection CLOSED complete (every batch written): the feeds back at the normal level clear an earlier drop
|        Send-SIRecordFeedDropEvents -Drops $drops -Engine ([string]$Close.Engine) -Checks $dropChecks.ToArray()
|        [pscustomobject]@{ Closed = [int](Get-SIItemValue $row 'Closed'); Feeds = [int](Get-SIItemValue $row 'Feeds'); Held = $false; Drops = $drops }
|    } catch {
|        Write-Warning ('records: the collection could not be closed -- {0}. It counts as not complete: nothing it did not reach is shown as gone.' -f $_.Exception.Message)
|        [pscustomobject]@{ Closed = 0; Feeds = 0; Held = $true }
|    }
|}
|
|function ConvertTo-SIJsonArray {
|    <# PURE. Always a JSON ARRAY for OPENJSON (PowerShell 5.1 writes a one-item list as the bare object). #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Items, [int]$Depth = 6)
|    if ($null -eq $Items -or @($Items).Count -eq 0) { return '[]' }
|    $j = ConvertTo-Json -InputObject @($Items) -Compress -Depth $Depth
|    if ($j.TrimStart().StartsWith('[')) { $j } else { '[' + $j + ']' }
|}
|
|function New-SIRecordSqlInvoke {
|    <#
|        The SQL seam over the install's database (SI_ProSqlServer / SI_ProSqlDatabase), signed in as the job (managed
|        identity in a container, else the engine certificate) -- the identity ledger's connection. $null = no database
|        configured: records and CIs live in SQL only, so the caller says plainly that nothing is kept.
|    #>
|    param([string]$Server = [string]$global:SI_ProSqlServer, [string]$Database = [string]$global:SI_ProSqlDatabase)
|    if ([string]::IsNullOrWhiteSpace($Server) -or [string]::IsNullOrWhiteSpace($Database)) { return $null }
|    # Not a GetNewClosure(): a closure runs in its own module scope and does not see the connection helpers the caller
|    # loaded. The server and database go in as literals; the functions are found where the seam is called.
|    $q = { param($s) "'" + ([string]$s).Replace("'", "''") + "'" }
|    $seam = [scriptblock]::Create(('param($Sql, $Params, $Mode) Invoke-SIRecordSqlDb -Server {0} -Database {1} -Sql $Sql -Params $Params -Mode $Mode' -f (& $q $Server), (& $q $Database)))
|    # 2026-10-29 a real database: the CI list's and the CI views' columns are filled a CiId range at a time (SI-DataCi.ps1 "KEY RANGES")
|    $seam | Add-Member -NotePropertyName SISqlRanged -NotePropertyValue $true
|    $seam
|}
|
|function Read-SISqlRows {
|    <#
|        Runs a command and answers the rows of EVERY result set, reading them to the end. A batch whose first statements
|        return nothing (temp tables, a loop, then the one SELECT) and whose later statement fails must be an ERROR here,
|        never an empty answer: closing a reader early discards the rest of the batch and its error (customer H 2026-10-09:
|        the CI grouping ran 294 s, answered no row and no error, and the build said "no records").
|    #>
|    param([Parameter(Mandatory)]$Command)
|    # 'Stop': a .NET exception in a loop condition is only STATEMENT-terminating -- under a container's error preference
|    # the loop just ended and the function answered nothing (customer H 2026-10-09: "answered no result", no error shown)
|    $ErrorActionPreference = 'Stop'
|    $rows = New-Object System.Collections.Generic.List[object]
|    $rd = $null
|    # what the database answered, for the "answered no result" messages (ring 1 2026-10-09, #513: a one-row SELECT came back
|    # with no row and no error inside the container, and nothing said whether the database or the reader lost it)
|    $global:SISqlLastRead = [ordered]@{ Sets = 0; Fields = ''; Rows = 0; HasRows = '' }
|    try {
|        $rd = $Command.ExecuteReader()
|        do {
|            $global:SISqlLastRead.Sets++
|            $global:SISqlLastRead.Fields = ('{0}{1}{2}' -f $global:SISqlLastRead.Fields, $(if ($global:SISqlLastRead.Fields) { '/' } else { '' }), $rd.FieldCount)
|            $global:SISqlLastRead.HasRows = ('{0}{1}' -f $global:SISqlLastRead.HasRows, $(if ($rd.HasRows) { 'y' } else { 'n' }))
|            # 🔒 the rows are read HERE, never by handing the reader to a function: a data reader is enumerable, and binding it to
|            # a function's parameter let PowerShell 7.4 (the container image) enumerate it -- every row consumed before the
|            # function's own Read(). Ring 1 2026-10-09 (#513): "1 result set(s), columns 1, rows reported y, 0 row(s) read";
|            # pwsh 7.6 (the development machine, the test VM) does not, so no offline run ever showed it. Guarded by SIv3-CiBuildSql.
|            if ($rd.FieldCount -gt 0) {
|                $names = @(for ($i = 0; $i -lt $rd.FieldCount; $i++) { $rd.GetName($i) })
|                while ($rd.Read()) {
|                    $o = [ordered]@{}
|                    for ($i = 0; $i -lt $names.Count; $i++) { $v = $rd.GetValue($i); if ($v -is [System.DBNull]) { $v = $null }; $o[$names[$i]] = $v }
|                    $rows.Add([pscustomobject]$o)
|                }
|            }
|            $global:SISqlLastRead.Rows = $rows.Count
|        } while ($rd.NextResult())
|    } catch {
|        throw (New-Object System.Exception((Format-SISqlError -Exception $_.Exception -InfoMessages @($script:SISqlInfoMessages)), $_.Exception))
|    } finally { if ($rd) { $rd.Close() } }
|    $rows.ToArray()
|}
|
|# the server's info messages of the current statement (SqlConnection.InfoMessage) -- part of an error's text
|$script:SISqlInfoMessages = New-Object System.Collections.Generic.List[string]
|
|function Get-SIRecordSchemaCheckSql {
|    <#
|        READ-ONLY: what the record writer and the CI build need of the database, beyond what an older release created --
|        answers ONE row, Missing = the names that are not there (empty = all there). The engine never changes the schema:
|        the tables, columns and indexes come from sql\si-data-schema.sql, which the updater applies (the job's identity
|        has data rights only -- customer H 2026-10-09).
|    #>
|    @'
|SET NOCOUNT ON;
|SELECT CONCAT_WS(N', ',
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NULL THEN N'sidata.CiRecord' END,
|    CASE WHEN OBJECT_ID('sidata.RecordIdentifier') IS NULL THEN N'sidata.RecordIdentifier' END,
|    CASE WHEN OBJECT_ID('sidata.Ci') IS NULL THEN N'sidata.Ci' END,
|    CASE WHEN OBJECT_ID('sidata.CiGroupMember') IS NULL THEN N'sidata.CiGroupMember' END,
|    CASE WHEN OBJECT_ID('sidata.CiGroupEdge') IS NULL THEN N'sidata.CiGroupEdge' END,
|    CASE WHEN OBJECT_ID('sidata.CiBuildState') IS NULL THEN N'sidata.CiBuildState' END,
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NOT NULL AND COL_LENGTH('sidata.CiRecord', 'ContentHash') IS NULL THEN N'sidata.CiRecord.ContentHash' END,
|    CASE WHEN OBJECT_ID('sidata.Ci') IS NOT NULL AND COL_LENGTH('sidata.Ci', 'ContentHash') IS NULL THEN N'sidata.Ci.ContentHash' END,
|    CASE WHEN OBJECT_ID('sidata.Ci') IS NOT NULL AND COL_LENGTH('sidata.Ci', 'PostedHash') IS NULL THEN N'sidata.Ci.PostedHash' END,
|    CASE WHEN OBJECT_ID('sidata.Ci') IS NOT NULL AND COL_LENGTH('sidata.Ci', 'PostedAt') IS NULL THEN N'sidata.Ci.PostedAt' END,
|    -- #534 the incremental CI build: what each record was at its last build, its group's dirty mark, a CI's last posted row
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NOT NULL AND COL_LENGTH('sidata.CiRecord', 'BuiltHash') IS NULL THEN N'sidata.CiRecord.BuiltHash' END,
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NOT NULL AND COL_LENGTH('sidata.CiRecord', 'BuiltGroupKey') IS NULL THEN N'sidata.CiRecord.BuiltGroupKey' END,
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NOT NULL AND COL_LENGTH('sidata.CiRecord', 'BuiltState') IS NULL THEN N'sidata.CiRecord.BuiltState' END,
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NOT NULL AND COL_LENGTH('sidata.CiRecord', 'BuiltTimeSig') IS NULL THEN N'sidata.CiRecord.BuiltTimeSig' END,
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NOT NULL AND COL_LENGTH('sidata.CiRecord', 'BuiltAt') IS NULL THEN N'sidata.CiRecord.BuiltAt' END,
|    CASE WHEN OBJECT_ID('sidata.CiGroupMember') IS NOT NULL AND COL_LENGTH('sidata.CiGroupMember', 'Dirty') IS NULL THEN N'sidata.CiGroupMember.Dirty' END,
|    CASE WHEN OBJECT_ID('sidata.CiGroupMember') IS NOT NULL AND COL_LENGTH('sidata.CiGroupMember', 'CurHash') IS NULL THEN N'sidata.CiGroupMember.CurHash' END,
|    CASE WHEN OBJECT_ID('sidata.CiGroupMember') IS NOT NULL AND COL_LENGTH('sidata.CiGroupMember', 'CurState') IS NULL THEN N'sidata.CiGroupMember.CurState' END,
|    CASE WHEN OBJECT_ID('sidata.CiGroupMember') IS NOT NULL AND COL_LENGTH('sidata.CiGroupMember', 'CurTimeSig') IS NULL THEN N'sidata.CiGroupMember.CurTimeSig' END,
|    CASE WHEN OBJECT_ID('sidata.Ci') IS NOT NULL AND COL_LENGTH('sidata.Ci', 'PostRowHash') IS NULL THEN N'sidata.Ci.PostRowHash' END,
|    -- identities before devices: the owner / user values a device / resource CI named
|    CASE WHEN OBJECT_ID('sidata.CiIdentityRef') IS NULL THEN N'sidata.CiIdentityRef' END,
|    -- #534 follow-up: when a record is next due, and the owning CMDB's items per CI
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NOT NULL AND COL_LENGTH('sidata.CiRecord', 'NextDueAt') IS NULL THEN N'sidata.CiRecord.NextDueAt' END,
|    CASE WHEN OBJECT_ID('sidata.CiCmdbUse') IS NULL THEN N'sidata.CiCmdbUse' END,
|    CASE WHEN OBJECT_ID('sidata.CiCmdbKey') IS NULL THEN N'sidata.CiCmdbKey' END
|) AS Missing;
|'@
|}
|
|function Get-SIRecordSchemaMissing {
|    <# The names Get-SIRecordSchemaCheckSql reports missing (an empty list = the database is current). Throws on a SQL error. #>
|    param([Parameter(Mandatory)][scriptblock]$Sql)
|    $global:SISqlLastRead = $null
|    $got = @(& $Sql (Get-SIRecordSchemaCheckSql) @{} 'rows')
|    $row = $got | Select-Object -First 1
|    if ($null -eq $row) { throw ('the schema check answered no result ({0})' -f (Get-SISqlLastReadText -Answered $got.Count)) }
|    $m = [string](Get-SIItemValue $row 'Missing')
|    @($m.Split(',') | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|}
|
|function Get-SISqlLastReadText {
|    <#
|        What the database answered to the last read (Read-SISqlRows), as one plain phrase -- the evidence an "answered no
|        result" message carries: no read at all, or N result set(s), their column counts, whether the server said it had
|        rows, and how many rows were read. -Answered: how many objects reached the caller.
|    #>
|    param([int]$Answered = 0)
|    $r = $global:SISqlLastRead
|    if ($null -eq $r) { return ('the statement was not read by the database reader; {0} object(s) came back' -f $Answered) }
|    'the database answered {0} result set(s), columns {1}, rows reported {2}, {3} row(s) read; {4} object(s) came back' -f $r.Sets, $r.Fields, $r.HasRows, $r.Rows, $Answered
|}
|
|function Format-SISqlError {
|    <#
|        A SQL failure as one line with what the database said: every error's number, line and message (a SqlException
|        carries several; .Message alone hid the real cause on customer H 2026-10-09), plus the server's info messages.
|    #>
|    param([Parameter(Mandatory)]$Exception, [string[]]$InfoMessages = @())
|    $e = $Exception
|    while ($e -and -not ($e -is [System.Data.SqlClient.SqlException]) -and $e.InnerException) { $e = $e.InnerException }
|    $parts = New-Object System.Collections.Generic.List[string]
|    if ($e -is [System.Data.SqlClient.SqlException]) {
|        foreach ($x in $e.Errors) { $parts.Add(('SQL error {0} (line {1}): {2}' -f $x.Number, $x.LineNumber, $x.Message)) }
|    }
|    if ($parts.Count -eq 0) { $parts.Add([string]$Exception.Message) }
|    foreach ($i in @($InfoMessages | Select-Object -Last 3)) { if ($i) { $parts.Add('server said: ' + $i) } }
|    ($parts | Select-Object -Unique) -join ' | '
|}
|
|$script:SIRecordSqlConnections = @{}
|
|function Invoke-SIRecordSqlDb {
|    <#
|        One statement against the database, signed in as the job. The connection is kept open for the process (one sign-in,
|        not one per statement -- a CI build sends hundreds) and re-opened once when it was lost.
|        -Mode: nonquery | scalar | rows (objects, the first result set).
|        A STATEMENT that meets one of Azure SQL's platform answers (Test-SISqlStatementTransient, engine\_shared\SI-SqlRetry.ps1:
|        4083 "the connection was recovered and rowcount ... not available", 9001, a failover, busy, a reset connection, "a
|        severe error occurred") is run again on a NEW connection after a pause (Get-SISqlStatementRetryWaits), and the log
|        says so. Live 2026-11-04: one 4083 failed a correlation run's CI build. Redoing is safe: every statement sent here is
|        one batch (its own transaction, MERGE by key; no #temp table outlives it) and the CI build is re-runnable; a 'rows'
|        answer is read whole before it is handed on. The CI build's lock lives on its own connection (Enter-SICiBuildLock),
|        never this one. Past the last attempt the error is thrown tagged transient-sql (Exception.Data['SIErrorClass']).
|        Any other failure is the answer at once.
|        Seams (tests): -Open { } -> an open connection; -StatementWaits; -Sleep { param($Seconds) }.
|    #>
|    param([Parameter(Mandatory)][string]$Server, [Parameter(Mandatory)][string]$Database, [Parameter(Mandatory)][string]$Sql, [hashtable]$Params, [string]$Mode = 'nonquery', [int]$TimeoutSeconds = 0,
|          [scriptblock]$Open, [int[]]$StatementWaits, [scriptblock]$Sleep)
|    $ErrorActionPreference = 'Stop'
|    $key = ('{0}|{1}' -f $Server, $Database).ToLowerInvariant()
|    $waits = if ($PSBoundParameters.ContainsKey('StatementWaits')) { @($StatementWaits) } elseif (Get-Command -Name Get-SISqlStatementRetryWaits -ErrorAction SilentlyContinue) { @(Get-SISqlStatementRetryWaits) } else { @() }
|    $reopened = $false; $try = 0
|    while ($true) {
|        $cn = $script:SIRecordSqlConnections[$key]
|        if ($null -eq $cn -or $cn.State -ne [System.Data.ConnectionState]::Open) {
|            if ($cn) { try { $cn.Dispose() } catch { } }
|            $cn = if ($Open) { & $Open } else { Get-SIObjectLedgerConnection -Server $Server -Database $Database }
|            if (-not $cn) { throw 'the database could not be opened' }
|            Register-SISqlInfoMessages -Connection $cn
|            $script:SIRecordSqlConnections[$key] = $cn
|        }
|        try {
|            $script:SISqlInfoMessages.Clear()
|            $c = $cn.CreateCommand(); $c.CommandText = $Sql; $c.CommandTimeout = $TimeoutSeconds
|            if ($Params) { foreach ($k in $Params.Keys) { $pp = $c.Parameters.Add('@' + $k, [System.Data.SqlDbType]::NVarChar, -1); $pp.Value = [string]$Params[$k] } }
|            if ($Mode -eq 'scalar') { return $c.ExecuteScalar() }
|            if ($Mode -eq 'rows') { return @(Read-SISqlRows -Command $c) }
|            return $c.ExecuteNonQuery()
|        } catch {
|            $err = $_
|            $transient = $false
|            if (Get-Command -Name Test-SISqlStatementTransient -ErrorAction SilentlyContinue) { $transient = [bool](Test-SISqlStatementTransient -ErrorRecord $err) }
|            if ($transient -and $try -lt @($waits).Count) {
|                # the connection is given up for good (never back into the pool) and the statement runs again on a new one
|                $script:SIRecordSqlConnections.Remove($key)
|                if ($cn -is [System.Data.SqlClient.SqlConnection]) { try { [System.Data.SqlClient.SqlConnection]::ClearPool($cn) } catch { } }
|                try { $cn.Dispose() } catch { }
|                $w = [int]@($waits)[$try]; $try++
|                $first = (([string]$err.Exception.Message) -split "`n")[0].Trim()
|                Write-Host ('       the database {0} answered a temporary Azure SQL error ({1}) -- connecting again and running the statement again in {2} s ({3}/{4})' -f $Database, $first, $w, $try, @($waits).Count) -ForegroundColor DarkYellow
|                if ($w -gt 0) { if ($Sleep) { & $Sleep $w } else { Start-Sleep -Seconds $w } }
|                continue
|            }
|            # a lost connection (closed, broken, a token past its life) is re-opened once; anything else is the answer
|            if (-not $reopened -and $cn.State -ne [System.Data.ConnectionState]::Open) { $reopened = $true; $script:SIRecordSqlConnections.Remove($key); continue }
|            $ex = New-Object System.Exception((Format-SISqlError -Exception $err.Exception -InfoMessages @($script:SISqlInfoMessages)), $err.Exception)
|            if ($transient) { $ex.Data['SIErrorClass'] = 'transient-sql' }
|            throw $ex
|        }
|    }
|}
|
|function Register-SISqlInfoMessages {
|    <# Keeps the server's info messages of a connection (PRINT, warnings) for the error text of its next failure. #>
|    param([Parameter(Mandatory)]$Connection)
|    # a delegate, not an event job: SqlClient raises it on this thread, while the statement runs; the closure holds the
|    # one list (cleared, never replaced, before every statement)
|    $list = $script:SISqlInfoMessages
|    $h = { param($s, $e) foreach ($x in $e.Errors) { [void]$list.Add(('{0}: {1}' -f $x.Number, $x.Message)) } }.GetNewClosure()
|    try { $Connection.add_InfoMessage([System.Data.SqlClient.SqlInfoMessageEventHandler]$h) } catch { }
|}
|
|# =====================================================================================================================
|#  ONE CI BUILD AT A TIME (owner 2026-10-12: "we cannot have 2 builds running at the same time. add as guard")
|# =====================================================================================================================
|# Two CI builds side by side write the same CIs, links, identity ledger and SI_CI_CL rows at once. Every starter (the
|# pipeline, a job run by hand, a release check, Risk Analysis building the CIs in its own run) shares ONE place: the
|# database. So the build holds an exclusive APPLICATION LOCK there for as long as it writes:
|#   * sp_getapplock, owned by the SESSION of a connection that is opened for the lock alone and stays open for the whole
|#     build. The server frees it when that connection ends -- a build that is stopped or killed frees it by itself. No
|#     flag is left behind, so nothing stale can ever block a build (LastBuildStatus 'running' is NOT the lock: after a
|#     stopped build it only means "carry on", Test-SICiCarryOn).
|#   * a second build that finds the lock held builds NOTHING beside the first: it WAITS (one line when it starts to wait,
|#     one every few minutes; bounded only by its own job's run limit) and then runs as an ordinary build -- incremental
|#     and quick when the first one just finished. It reads the build's state only AFTER it holds the lock, so a build
|#     that is running now is never taken for a stopped one.
|#   * WHO HOLDS IT is written to sidata.CiBuildState 'BuildLockHolder' ({ token; since; who }) by the holder, for the
|#     waiting build's log line and the event -- information only, never the lock.
|#   * THE CONNECTION CAN DROP while the build runs. The build checks its lock before every batch it writes
|#     (Test-SICiBuildLock). Lost: it takes the lock again at once; when 'BuildLockHolder' still carries its own token no
|#     other build ran in between and it goes on. In every other case (another build holds the lock, or held it
|#     meanwhile, or the check cannot be made) it STOPS without writing -- the next build builds what is left.
|#   * THE GUARD ci.build.concurrent is the REPORT (one event when a build has to wait); the lock is the correctness and
|#     holds whether the guard is on or off.
|# No database (Community without SQL): there is no CI build in SQL, so there is nothing to lock.
|$script:SICiBuildLockGuardId = 'ci.build.concurrent'
|# the lock THIS process holds: @{ Connection; Open; Token; Holder (its 'BuildLockHolder' value); Since; Who } -- kept
|# when this file is loaded again (the job holds the lock across the scripts it loads)
|if (-not (Test-Path -LiteralPath 'variable:script:SICiBuildLockState')) { $script:SICiBuildLockState = $null }
|
|function Get-SICiBuildLockSql {
|    <# The statements of the CI build's lock (one place; the real-SQL tests run them). #>
|    param([Parameter(Mandatory)][ValidateSet('Take', 'Mode', 'Release', 'HolderSet', 'HolderGet', 'HolderClear')][string]$Name)
|    switch ($Name) {
|        # @ms: how long to wait for it (0 = ask once). Result >= 0: held; -1: another session holds it
|        'Take' { "SET NOCOUNT ON; DECLARE @r INT, @t INT = CAST(@ms AS INT); EXEC @r = sp_getapplock @Resource = N'si-ci-build', @LockMode = N'Exclusive', @LockOwner = N'Session', @LockTimeout = @t; SELECT @r AS Result;" }
|        'Mode' { "SET NOCOUNT ON; SELECT APPLOCK_MODE(N'public', N'si-ci-build', N'Session') AS Mode;" }
|        'Release' { "SET NOCOUNT ON; IF APPLOCK_MODE(N'public', N'si-ci-build', N'Session') <> N'NoLock' EXEC sp_releaseapplock @Resource = N'si-ci-build', @LockOwner = N'Session'; SELECT 1 AS Released;" }
|        'HolderSet' { @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.CiBuildState') IS NULL BEGIN SELECT 0 AS Written; RETURN; END
|MERGE sidata.CiBuildState AS t USING (SELECT N'BuildLockHolder' AS Name, LEFT(@v, 400) AS Value) AS s ON t.Name = s.Name
|WHEN MATCHED THEN UPDATE SET Value = s.Value, UpdatedAt = SYSUTCDATETIME()
|WHEN NOT MATCHED THEN INSERT (Name, Value) VALUES (s.Name, s.Value);
|SELECT 1 AS Written;
|'@ }
|        'HolderGet' { @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.CiBuildState') IS NULL BEGIN SELECT CAST(NULL AS NVARCHAR(400)) AS Value; RETURN; END
|SELECT (SELECT TOP 1 Value FROM sidata.CiBuildState WHERE Name = N'BuildLockHolder') AS Value;
|'@ }
|        # only its own value: a build that lost the lock never clears the next holder's
|        'HolderClear' { "SET NOCOUNT ON; IF OBJECT_ID('sidata.CiBuildState') IS NOT NULL UPDATE sidata.CiBuildState SET Value = N'', UpdatedAt = SYSUTCDATETIME() WHERE Name = N'BuildLockHolder' AND Value = LEFT(@v, 400); SELECT 1 AS Cleared;" }
|    }
|}
|
|function Invoke-SICiBuildLockSql {
|    <# One statement on the lock's own connection -> its rows. Throws when the connection is gone. #>
|    param([Parameter(Mandatory)]$Connection, [Parameter(Mandatory)][string]$Sql, [hashtable]$Params, [int]$TimeoutSeconds = 0)
|    $ErrorActionPreference = 'Stop'
|    $c = $Connection.CreateCommand(); $c.CommandText = $Sql; $c.CommandTimeout = $TimeoutSeconds
|    if ($Params) { foreach ($k in $Params.Keys) { $pp = $c.Parameters.Add('@' + $k, [System.Data.SqlDbType]::NVarChar, -1); $pp.Value = [string]$Params[$k] } }
|    @(Read-SISqlRows -Command $c)
|}
|
|function Get-SICiBuildLockOpen {
|    <# The lock's connection for this install's database (SI_ProSqlServer / SI_ProSqlDatabase), signed in as the job --
|       a scriptblock that opens one; $null when no database is configured (nothing to lock). #>
|    param([string]$Server = [string]$global:SI_ProSqlServer, [string]$Database = [string]$global:SI_ProSqlDatabase)
|    if ([string]::IsNullOrWhiteSpace($Server) -or [string]::IsNullOrWhiteSpace($Database)) { return $null }
|    $q = { param($s) "'" + ([string]$s).Replace("'", "''") + "'" }
|    [scriptblock]::Create(('Get-SIObjectLedgerConnection -Server {0} -Database {1}' -f (& $q $Server), (& $q $Database)))
|}
|
|function Get-SICiBuildLockWho {
|    <# PURE. Who a build is, in the words the other build's log line and the event use: the job run (a container job's
|       execution carries the job's name), else the run id and the machine. #>
|    param([string]$RunId, [string]$Execution = [string]$env:CONTAINER_APP_JOB_EXECUTION_NAME, [string]$Computer = [string]$env:COMPUTERNAME)
|    if (-not [string]::IsNullOrWhiteSpace($Execution)) { return ('job run {0}' -f $Execution.Trim()) }
|    $who = if (-not [string]::IsNullOrWhiteSpace($RunId)) { 'run {0}' -f $RunId.Trim() } else { 'a run started by hand' }
|    if (-not [string]::IsNullOrWhiteSpace($Computer)) { $who = '{0} on {1}' -f $who, $Computer.Trim() }
|    $who
|}
|
|function ConvertFrom-SICiBuildLockHolder {
|    <# PURE. The 'BuildLockHolder' value -> @{ Token; Since ([datetime] UTC or $null); Who }; $null when there is none. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    if ([string]::IsNullOrWhiteSpace($Value)) { return $null }
|    try {
|        $o = ConvertFrom-Json -InputObject $Value
|        $since = $null
|        if ($o.PSObject.Properties['since'] -and $o.since) {
|            # (PowerShell 7 hands an ISO time in JSON back as a date already)
|            $d = [datetime]::MinValue
|            if ($o.since -is [datetime]) { $since = ([datetime]$o.since).ToUniversalTime() }
|            elseif ([datetime]::TryParse([string]$o.since, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal, [ref]$d)) { $since = $d }
|        }
|        [pscustomobject]@{ Token = [string]$o.token; Since = $since; Who = [string]$o.who }
|    } catch { $null }
|}
|
|function Format-SICiBuildLockLine {
|    <#
|        PURE. The run log's lines about the lock, in plain words:
|          Wait   a build finds another one running (-Other: its ConvertFrom-SICiBuildLockHolder, when known)
|          Still  it is still waiting (-Minutes so far)
|          Go     the other build finished (-Minutes waited)
|          Kept   this build's lock connection was lost and taken again; nothing ran in between
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Wait', 'Still', 'Go', 'Kept')][string]$Kind, $Other, [int]$Minutes = 0)
|    $about = @()
|    if ($Other -and $Other.Since) { $about += ('since {0:yyyy-MM-dd HH:mm} UTC' -f ([datetime]$Other.Since).ToUniversalTime()) }
|    if ($Other -and $Other.Who) { $about += [string]$Other.Who }
|    $in = if ($about.Count) { ' ({0})' -f ($about -join ', ') } else { '' }
|    switch ($Kind) {
|        'Wait' { 'CIs: another CI build is running{0} -- this one waits for it and then builds what is left' -f $in }
|        'Still' { 'CIs: still waiting for the other CI build{0} -- {1} minute(s) so far; nothing is built beside it' -f $in, $Minutes }
|        'Go' { 'CIs: the other CI build has finished (waited {0} minute(s)) -- this one builds what is left' -f $Minutes }
|        'Kept' { 'CIs: the connection that holds this build''s lock was lost and opened again -- no other CI build ran in between, so the build goes on' }
|    }
|}
|
|function Get-SIGuardCallsForCiBuildWait {
|    <# PURE. The guard event of a CI build that was started while another one was running and waits for it
|       (Send-SIGuardEvent arguments): a warning -- nothing is held, nothing fails. One per build that has to wait. #>
|    param($Other, [string]$Who, [string]$RunId, [string]$Engine)
|    $first = if ($Other -and $Other.Who) { [string]$Other.Who } else { 'another run' }
|    $since = if ($Other -and $Other.Since) { ', running since {0:yyyy-MM-dd HH:mm} UTC' -f ([datetime]$Other.Since).ToUniversalTime() } else { '' }
|    $c = @{ GuardId = $script:SICiBuildLockGuardId; Outcome = 'warning'
|            Detail = ('A CI build ({0}) was started while another CI build ({1}{2}) was still running. It waits for that build to finish and then builds what is left.' -f $(if ($Who) { $Who } else { 'this run' }), $first, $since) }
|    if ($RunId) { $c['RunId'] = $RunId }
|    if ($Engine) { $c['Engine'] = $Engine; $c['Job'] = 'si-' + $Engine.Trim().ToLowerInvariant(); $c['Subject'] = $Engine.Trim().ToLowerInvariant() }
|    $c
|}
|
|function Send-SICiBuildWaitEvent {
|    <# Raises the event of a build that has to wait (the Guards page, run health). Never throws; without the guard code
|       loaded the wait is in the run log only. #>
|    param($Other, [string]$Who, [string]$RunId, [string]$Engine)
|    try {
|        if (-not (Get-Command -Name Invoke-SIGuardCalls -ErrorAction SilentlyContinue)) {
|            $g = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-Guard.ps1')
|            if ([IO.File]::Exists($g)) { . $g }
|        }
|        if (Get-Command -Name Invoke-SIGuardCalls -ErrorAction SilentlyContinue) {
|            $inv = $null; if (Get-Command -Name Get-SIGuardProInvoke -ErrorAction SilentlyContinue) { $inv = Get-SIGuardProInvoke }
|            $null = Invoke-SIGuardCalls -Calls @(Get-SIGuardCallsForCiBuildWait -Other $Other -Who $Who -RunId $RunId -Engine $Engine) -Common @{ Invoke = $inv }
|        }
|    } catch { Write-Warning ('CIs: the event of a CI build that waits could not be raised -- {0}' -f $_.Exception.Message) }
|}
|
|function Close-SICiBuildLockConnection {
|    <# Ends the lock's connection for good (never back into a pool with the lock on it). Never throws. #>
|    param($Connection)
|    if ($null -eq $Connection) { return }
|    try { $Connection.GetType()::ClearPool($Connection) } catch { }
|    try { $Connection.Dispose() } catch { }
|}
|
|function Enter-SICiBuildLock {
|    <#
|        Takes the CI build's lock for this process, waiting for a build that holds it. Returns
|        @{ Held = $true; Owned (this call took it -- the caller that owns it releases it, Exit-SICiBuildLock);
|           Waited; WaitSeconds; Other (the build it waited for, when known) }.
|        A process that already holds it (the correlation job takes it before the CI build asks) gets Owned = $false, or --
|        when its lock was lost and another build ran meanwhile -- Held = $false with Why.
|        Throws when the lock cannot be asked for at all (the database does not answer, five times in a row).
|        Seams (tests): -Open { } -> an open connection; -Guard { param($Other, $Who) } instead of the guard event;
|        -Sleep { param($Seconds) }; -Now { }.
|    #>
|    param([scriptblock]$Open, [string]$RunId, [string]$Engine, [scriptblock]$Log, [int]$PollSeconds = 30, [int]$ProgressMinutes = 5,
|          [scriptblock]$Guard, [scriptblock]$Sleep = { param($Seconds) Start-Sleep -Seconds $Seconds }, [scriptblock]$Now = { [datetime]::UtcNow })
|    if (-not $Log) { $Log = { param($l, $m) if ($l -eq 'WARN') { Write-Warning $m } else { Write-Host ('[' + $l + '] ' + $m) } } }
|    if ($script:SICiBuildLockState) {
|        $chk = Test-SICiBuildLock -Log $Log
|        return [pscustomobject]@{ Held = [bool]$chk.Held; Owned = $false; Waited = $false; WaitSeconds = 0; Other = $null; Why = [string]$chk.Why }
|    }
|    if (-not $Open) { $Open = Get-SICiBuildLockOpen }
|    if (-not $Open) { throw 'no database is configured for the lock that keeps CI builds apart' }
|    if ($PollSeconds -lt 1) { $PollSeconds = 1 }
|    $who = Get-SICiBuildLockWho -RunId $RunId
|    $cn = $null; $t0 = ([datetime](& $Now)).ToUniversalTime(); $lastSaid = $t0; $waiting = $false; $other = $null; $fails = 0
|    while ($true) {
|        $code = $null
|        try {
|            if ($null -eq $cn -or $cn.State -ne [System.Data.ConnectionState]::Open) {
|                Close-SICiBuildLockConnection $cn
|                $cn = & $Open
|                if (-not $cn) { throw 'the database could not be opened' }
|            }
|            # asked once; while waiting, in turns of -PollSeconds (the server queues the request: the lock is taken the moment it is free)
|            $ms = if ($waiting) { $PollSeconds * 1000 } else { 0 }
|            $r = @(Invoke-SICiBuildLockSql -Connection $cn -Sql (Get-SICiBuildLockSql 'Take') -Params @{ ms = [string]$ms } -TimeoutSeconds ($PollSeconds + 120))
|            $code = [int]$r[0].Result
|            if ($code -lt 0 -and $code -ne -1) { throw ('the database refused the lock (result {0})' -f $code) }
|            $fails = 0
|        } catch {
|            $fails++
|            Close-SICiBuildLockConnection $cn; $cn = $null
|            if ($fails -ge 5) { throw ('the lock that keeps two CI builds apart could not be taken ({0})' -f $_.Exception.Message) }
|            & $Sleep ([Math]::Min(30, 5 * $fails))
|            continue
|        }
|        if ($code -ge 0) { break }
|        $nowU = ([datetime](& $Now)).ToUniversalTime()
|        if (-not $waiting) {
|            $waiting = $true; $lastSaid = $nowU
|            try { $other = ConvertFrom-SICiBuildLockHolder ([string]@(Invoke-SICiBuildLockSql -Connection $cn -Sql (Get-SICiBuildLockSql 'HolderGet'))[0].Value) } catch { $other = $null }
|            & $Log 'INFO' (Format-SICiBuildLockLine -Kind Wait -Other $other)
|            # the report (never the lock): one event for this build
|            if ($Guard) { try { & $Guard $other $who } catch { } } else { Send-SICiBuildWaitEvent -Other $other -Who $who -RunId $RunId -Engine $Engine }
|        } elseif (($nowU - $lastSaid).TotalMinutes -ge $ProgressMinutes) {
|            $lastSaid = $nowU
|            & $Log 'INFO' (Format-SICiBuildLockLine -Kind Still -Other $other -Minutes ([int]($nowU - $t0).TotalMinutes))
|        }
|    }
|    $t1 = ([datetime](& $Now)).ToUniversalTime()
|    $token = [guid]::NewGuid().ToString('n')
|    $holder = ConvertTo-Json -Compress -InputObject ([ordered]@{ token = $token; since = $t1.ToString('o'); who = $(if ($who.Length -gt 200) { $who.Substring(0, 200) } else { $who }) })
|    $written = $false
|    try { $written = ([int]@(Invoke-SICiBuildLockSql -Connection $cn -Sql (Get-SICiBuildLockSql 'HolderSet') -Params @{ v = $holder })[0].Written -eq 1) } catch { $written = $false }
|    $script:SICiBuildLockState = [pscustomobject]@{ Connection = $cn; Open = $Open; Token = $(if ($written) { $token } else { '' }); Holder = $holder; Since = $t1; Who = $who }
|    if ($waiting) { & $Log 'INFO' (Format-SICiBuildLockLine -Kind Go -Minutes ([int]($t1 - $t0).TotalMinutes)) }
|    [pscustomobject]@{ Held = $true; Owned = $true; Waited = $waiting; WaitSeconds = [int]($t1 - $t0).TotalSeconds; Other = $other; Why = '' }
|}
|
|function Test-SICiBuildLock {
|    <#
|        Does this process still hold the CI build's lock? Asked before every batch the build writes (it also keeps the
|        lock's connection in use). @{ Held; Why }. No lock in this process (no database, a test seam): Held, nothing to
|        check. A lost connection: the lock is taken again at once, and the build goes on only when 'BuildLockHolder' still
|        carries this build's own token (no other build ran in between); else Held = $false and the lock is given up.
|    #>
|    param([scriptblock]$Log)
|    $s = $script:SICiBuildLockState
|    if (-not $s) { return [pscustomobject]@{ Held = $true; Why = '' } }
|    try {
|        if ($s.Connection -and $s.Connection.State -eq [System.Data.ConnectionState]::Open) {
|            if ([string]@(Invoke-SICiBuildLockSql -Connection $s.Connection -Sql (Get-SICiBuildLockSql 'Mode'))[0].Mode -eq 'Exclusive') { return [pscustomobject]@{ Held = $true; Why = '' } }
|        }
|    } catch { }
|    # the lock is gone with its connection
|    Close-SICiBuildLockConnection $s.Connection
|    $script:SICiBuildLockState = $null
|    $cn = $null
|    try {
|        $cn = & $s.Open
|        if (-not $cn) { throw 'the database could not be opened' }
|        if ([int]@(Invoke-SICiBuildLockSql -Connection $cn -Sql (Get-SICiBuildLockSql 'Take') -Params @{ ms = '0' })[0].Result -lt 0) {
|            Close-SICiBuildLockConnection $cn
|            return [pscustomobject]@{ Held = $false; Why = 'this build lost its lock (its database connection ended) and another CI build is running now -- this build stops here and writes nothing more; the next build builds what is left' }
|        }
|        $now = ConvertFrom-SICiBuildLockHolder ([string]@(Invoke-SICiBuildLockSql -Connection $cn -Sql (Get-SICiBuildLockSql 'HolderGet'))[0].Value)
|        if ($s.Token -and $now -and [string]$now.Token -eq [string]$s.Token) {
|            $s.Connection = $cn
|            $script:SICiBuildLockState = $s
|            if ($Log) { & $Log 'INFO' (Format-SICiBuildLockLine -Kind Kept) }
|            return [pscustomobject]@{ Held = $true; Why = '' }
|        }
|        try { $null = Invoke-SICiBuildLockSql -Connection $cn -Sql (Get-SICiBuildLockSql 'Release') } catch { }
|        Close-SICiBuildLockConnection $cn
|        return [pscustomobject]@{ Held = $false; Why = 'this build lost its lock (its database connection ended) and another CI build may have run meanwhile -- this build stops here and writes nothing more; the next build builds what is left' }
|    } catch {
|        Close-SICiBuildLockConnection $cn
|        return [pscustomobject]@{ Held = $false; Why = ('this build lost its lock (its database connection ended) and could not take it again ({0}) -- this build stops here and writes nothing more; the next build builds what is left' -f $_.Exception.Message) }
|    }
|}
|
|function Exit-SICiBuildLock {
|    <# Releases the CI build's lock of this process and ends its connection. Never throws; nothing held = nothing done. #>
|    $s = $script:SICiBuildLockState
|    $script:SICiBuildLockState = $null
|    if (-not $s) { return }
|    try {
|        if ($s.Connection -and $s.Connection.State -eq [System.Data.ConnectionState]::Open) {
|            try { $null = Invoke-SICiBuildLockSql -Connection $s.Connection -Sql (Get-SICiBuildLockSql 'HolderClear') -Params @{ v = [string]$s.Holder } } catch { }
|            $null = Invoke-SICiBuildLockSql -Connection $s.Connection -Sql (Get-SICiBuildLockSql 'Release')
|        }
|    } catch { }
|    Close-SICiBuildLockConnection $s.Connection
|}
'@ }
$__siSupportFiles['engine/data-model/SI-CiBuild.ps1'] = @{ Sha256 = '3b4086bb4e2d9a70fa3da98b22aff9a5b48c5be76d69d16ea0b69ec79168ef31'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight CI BUILD -- phase 2 of the v3 data model (V3-DATA-MODEL part 2, P2 + the first step of P3):
|    the provider records of SI_Record_CL become CIs.
|
|      1. GROUP     records that share a STRONG identifier (data-model field catalog, join = strong) are one asset:
|                   connected components (union-find), transitive. Weak identifiers (names, IPs, MACs) never join.
|                   A public IP address is the identity of a public_ip record (Shodan knows nothing else).
|                   CMDB records are not grouped here: they are linked to a CI in the enrichment step.
|      2. IDENTIFY  every group gets its CI id from the identity LEDGER -- the same ledger the correlation engine keeps,
|                   the same identifier types, so a CI keeps the id it already has (and that a CMDB already holds):
|                   mint (new), reuse (one known id), merge (two known ids: the oldest survives). No provisional ids:
|                   no ledger, no CIs (a key that moves duplicates CIs in a CMDB).
|      3. LINK      every record is a linked object of its CI: provider, type, native id, primary, state, last seen.
|                   State: active (in its feed's newest collection), not_seen (missing from a COMPLETE newer
|                   collection), frozen (missing, but the newer collection was incomplete -- absence proves nothing),
|                   gone (positive evidence: offboarded). si_link_<provider> = the provider's primary record.
|      4. RESOLVE   every SI field the records carry is resolved onto the CI by its catalog policy -- the source-of-
|                   truth rule (V3-DATA-MODEL 2.6): fresh candidates only (record age <= staleDays), the first provider
|                   in the field's authority order wins, risk booleans any-true, lists union; no fresh candidate -> the
|                   newest value, marked stale. si_field_sources says, per field, which provider and record won.
|
|    PURE: no I/O. Invoke-SICiBuild (SI-CiBuildRun.ps1) reads the records, the ledger, and publishes.
|    PowerShell 5.1: no ?. / ??, no ternary, no Set-StrictMode.
|#>
|
|. (Join-Path $PSScriptRoot 'SI-Conditions.ps1')
|# #459: conflicts beside the winner (fresh providers that disagree) -- SI-FieldResolution.ps1
|. (Join-Path $PSScriptRoot 'SI-FieldResolution.ps1')
|# the asset lifecycle (V3-DATA-MODEL 2.5.5, #406): categories, grace periods, seen window -- one mechanism with the CMDB sync
|. (Join-Path $PSScriptRoot 'SI-CiLifecycle.ps1')
|# #1056 a customer's choice of which Exposure Graph identities become assets: a CI whose record the choice now leaves out
|# retires with a reason naming the switch (Get-SIRecordLink below)
|$script:SIIdentityScopeChoiceFile = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'asset-profiling', 'shared', 'SI-IdentityScopeChoice.ps1')
|if (-not (Get-Command -Name Get-SIRecordLeftOutByIdentityChoice -ErrorAction SilentlyContinue) -and [IO.File]::Exists($script:SIIdentityScopeChoiceFile)) { . $script:SIIdentityScopeChoiceFile }
|$script:SICiIdentityChoiceReady = [bool](Get-Command -Name Get-SIRecordLeftOutByIdentityChoice -ErrorAction SilentlyContinue)
|$script:SICiIdentityChoiceCache = $null
|# #1054 A SOURCE'S PLACEHOLDER NAME IS NEVER A CI'S NAME (owner's data-quality sweep 2026-11-02: 29 active devices named
|# "dummydevicename" -- Defender's placeholder for a device it has no name for). The CI takes the name from another linked
|# source; when none has one, a clear generated name: the shared stand-in of SI-AssetName.ps1 ('unnamed-device-<short id>',
|# deterministic, unique per device, recognisable by its 'unnamed-' prefix). The correlation check (SI-CorrelationSuspects.ps1,
|# rule placeholder) flags it. The list is the data model's placeholder_device_names (the same list the check reads).
|$script:SIAssetNameFile = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'asset-profiling', 'shared', 'SI-AssetName.ps1')
|if (-not (Get-Command -Name Get-SISyntheticAssetName -ErrorAction SilentlyContinue) -and [IO.File]::Exists($script:SIAssetNameFile)) { . $script:SIAssetNameFile }
|$script:SICiPlaceholderListId = 'placeholder_device_names'
|# the shipped list, used when no data model is given (the same values as data-model\lists.locked.json)
|$script:SICiPlaceholderNamesDefault = @('dummydevicename', 'unknown', 'localhost', '(none)', 'n/a')
|
|function Get-SICiPlaceholderNames {
|    <# PURE. The placeholder device names in force (lower case, trimmed): the model's list placeholder_device_names (locked +
|       the customer's override, as the model was merged), else the shipped list. #>
|    param($Model)
|    $vals = $null
|    if ($null -ne $Model) {
|        $lists = $null
|        try { $lists = $Model['lists'] } catch { $lists = $null }
|        if ($null -ne $lists) {
|            foreach ($l in @(Get-SIItemValue $lists 'lists')) {
|                if ($null -ne $l -and [string](Get-SIItemValue $l 'id') -eq $script:SICiPlaceholderListId) { $vals = @(Get-SIItemValue $l 'values'); break }
|            }
|        }
|    }
|    if ($null -eq $vals) { $vals = $script:SICiPlaceholderNamesDefault }
|    , [string[]]@(foreach ($v in @($vals)) { $s = ([string]$v).Trim().ToLowerInvariant(); if ($s) { $s } })
|}
|
|function Test-SICiPlaceholderName {
|    <# PURE. Is this name a source's placeholder (compared whole, trimmed, without case)? #>
|    param([AllowNull()]$Value, [AllowNull()][AllowEmptyCollection()][string[]]$Names)
|    if ($null -eq $Value -or $null -eq $Names -or $Names.Count -eq 0) { return $false }
|    $s = ([string]$Value).Trim().ToLowerInvariant()
|    if (-not $s) { return $false }
|    foreach ($n in $Names) { if ($s -eq $n) { return $true } }
|    $false
|}
|
|function Get-SICiUnnamedDeviceName {
|    <# PURE. #1054 the generated name of a device no linked source has a name for: 'unnamed-device-<short id>' from the native id
|       of its record (record key '<provider>:<id>' -- Defender's device id for a Defender record). $null when there is no id. #>
|    param([AllowEmptyString()][string]$RecordKey)
|    $id = [string]$RecordKey; $i = $id.IndexOf(':'); if ($i -ge 0) { $id = $id.Substring($i + 1) }
|    if (-not $id) { return $null }
|    if (Get-Command -Name Get-SISyntheticAssetName -ErrorAction SilentlyContinue) { return (Get-SISyntheticAssetName -Engine 'device' -Id $id) }
|    $clean = ($id -replace '[^A-Za-z0-9]', ''); if (-not $clean) { return $null }
|    $take = [Math]::Min(8, $clean.Length)
|    'unnamed-device-' + $clean.Substring($clean.Length - $take, $take).ToLowerInvariant()
|}
|
|function Get-SICiIdentityChoice {
|    <# The install's choice (Get-SIIdentityScopeChoice), read once and again only when one of the three settings changes -- the
|       CI build asks for every missing Exposure Graph record. $null when the choice code is not shipped. #>
|    if ($null -eq $script:SICiIdentityChoiceReady) { $script:SICiIdentityChoiceReady = [bool](Get-Command -Name Get-SIRecordLeftOutByIdentityChoice -ErrorAction SilentlyContinue) }
|    if (-not $script:SICiIdentityChoiceReady) { return $null }
|    $key = '{0}|{1}|{2}' -f $global:SI_Identity_SkipNeverSyncedAd, $global:SI_Identity_SkipNeverSyncedDisabledAd, $global:SI_Identity_SkipDeletedGroups
|    if ($null -eq $script:SICiIdentityChoiceCache -or $script:SICiIdentityChoiceCache.Key -ne $key) {
|        $script:SICiIdentityChoiceCache = [pscustomobject]@{ Key = $key; Choice = (Get-SIIdentityScopeChoice) }
|    }
|    $script:SICiIdentityChoiceCache.Choice
|}
|
|function Get-SICiLedgerTypeMap {
|    <# The catalog's strong identifier fields -> the identity ledger's identifier types (shared with the correlation engine). #>
|    return @{
|        mde_device_id     = 'MdeDeviceId'
|        entra_device_id   = 'AadDeviceId'
|        eg_node_id        = 'ExposureGraphNodeId'
|        azure_resource_id = 'AzureResourceId'
|        entra_object_id   = 'AadObjectId'
|        ad_object_guid    = 'ActiveDirectoryObjectGuid'
|        ad_sid            = 'SecurityIdentifier'
|        azure_vm_id       = 'AzureVmId'
|        intune_device_id  = 'IntuneDeviceId'
|        entra_app_id      = 'AadAppId'
|        # #500 a resource in another cloud (AWS ARN / GCP resource name), as Defender for Cloud's multicloud connector reports it
|        mdc_native_resource_id = 'CloudNativeResourceId'
|    }
|}
|
|function Get-SICiClassRank {
|    <# Which class a CI takes when its records differ: an Azure VM correlated with its Defender device is a device. #>
|    param([string]$Class)
|    switch ($Class) { 'device' { 0 } 'cloud_resource' { 1 } 'public_ip' { 2 } 'identity' { 3 } default { 9 } }
|}
|
|function Get-SIRecordIdentifiers {
|    <# A record's strong identifiers as @{ Type; Value; Key } (ledger vocabulary, lower-cased value). #>
|    param([Parameter(Mandatory)]$Record, [Parameter(Mandatory)][hashtable]$TypeMap)
|    $out = [System.Collections.Generic.List[object]]::new()
|    foreach ($f in $TypeMap.Keys) {
|        foreach ($v in (Get-SIValueList (Get-SIItemValue $Record $f))) {
|            $s = ([string]$v).Trim().ToLowerInvariant()
|            if (-not $s) { continue }
|            $t = $TypeMap[$f]
|            $out.Add([pscustomobject]@{ Type = $t; Value = $s; Key = ('{0}|{1}' -f $t.ToLowerInvariant(), $s) })
|        }
|    }
|    if ([string](Get-SIItemValue $Record 'si_class') -eq 'public_ip') {
|        $ip = ([string](Get-SIItemValue $Record 'si_ip_address')).Trim().ToLowerInvariant()
|        if ($ip) { $out.Add([pscustomobject]@{ Type = 'PublicIpAddress'; Value = $ip; Key = ('publicipaddress|{0}' -f $ip) }) }
|    }
|    return , $out
|}
|
|function Get-SICiGroups {
|    <#
|    .SYNOPSIS  Records -> groups of records that are one asset (connected components over strong identifiers).
|    .OUTPUTS   @{ Groups = [ @{ Members = [ @{ Identifiers; Record } ] } ]; Unkeyable = <records without a strong id>; Largest }
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Records, [hashtable]$TypeMap = (Get-SICiLedgerTypeMap))
|    $parent = @{}
|    $find = {
|        param($x)
|        $r = $x
|        while ($parent[$r] -ne $r) { $r = $parent[$r] }
|        $y = $x
|        while ($parent[$y] -ne $r) { $n = $parent[$y]; $parent[$y] = $r; $y = $n }
|        $r
|    }
|    $members = New-Object System.Collections.Generic.List[object]
|    $unkeyable = New-Object System.Collections.Generic.List[object]
|    foreach ($rec in $Records) {
|        if ($null -eq $rec) { continue }
|        if ([string](Get-SIItemValue $rec 'si_record_type') -eq 'cmdb_ci') { continue }
|        $ids = Get-SIRecordIdentifiers -Record $rec -TypeMap $TypeMap
|        if ($ids.Count -eq 0) { $unkeyable.Add($rec); continue }
|        $m = [pscustomobject]@{ Identifiers = $ids.ToArray(); Record = $rec; Node = ('rec:' + [string](Get-SIItemValue $rec 'si_record_key')) }
|        $members.Add($m)
|        if (-not $parent.ContainsKey($m.Node)) { $parent[$m.Node] = $m.Node }
|        foreach ($id in $ids) {
|            if (-not $parent.ContainsKey($id.Key)) { $parent[$id.Key] = $id.Key }
|            $a = & $find $m.Node; $b = & $find $id.Key
|            if ($a -ne $b) { if ([string]::CompareOrdinal($a, $b) -lt 0) { $parent[$b] = $a } else { $parent[$a] = $b } }
|        }
|    }
|    $byRoot = [ordered]@{}
|    foreach ($m in $members) {
|        $root = & $find $m.Node
|        if (-not $byRoot.Contains($root)) { $byRoot[$root] = New-Object System.Collections.Generic.List[object] }
|        $byRoot[$root].Add($m)
|    }
|    $groups = New-Object System.Collections.Generic.List[object]
|    $largest = 0
|    foreach ($k in $byRoot.Keys) {
|        $groups.Add([pscustomobject]@{ Members = $byRoot[$k].ToArray() })
|        if ($byRoot[$k].Count -gt $largest) { $largest = $byRoot[$k].Count }
|    }
|    return @{ Groups = $groups.ToArray(); Unkeyable = $unkeyable.ToArray(); Largest = $largest }
|}
|
|function Get-SIRecordFeed {
|    <# A record's feed -- the unit whose newest collection says what is present: provider + record type. #>
|    param($Record)
|    '{0}|{1}' -f (Get-SIItemValue $Record 'si_provider'), (Get-SIItemValue $Record 'si_record_type')
|}
|
|function Get-SIFeedLatest {
|    <# Per feed: the newest collection time and whether that collection was complete. #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Records)
|    $latest = @{}
|    foreach ($r in $Records) {
|        $f = Get-SIRecordFeed $r
|        $t = ConvertTo-SIUtcOrNull (Get-SIItemValue $r 'si_collection_time')
|        if ($null -eq $t) { continue }
|        $c = (ConvertTo-SIBoolOrNull (Get-SIItemValue $r 'si_collection_complete')) -ne $false
|        if (-not $latest.ContainsKey($f) -or $t -gt $latest[$f].Time) { $latest[$f] = [pscustomobject]@{ Time = $t; Complete = $c } }
|        elseif ($t -eq $latest[$f].Time -and -not $c) { $latest[$f].Complete = $false }
|    }
|    return $latest
|}
|
|function Test-SIRecordAdAccountAsDevice {
|    <#
|        PURE. #1052 Is this an Exposure Graph DEVICE record that is really an Active Directory computer account -- one a
|        build before the fix recorded as a device (provider eg, record type device) with AD ids (ad_object_guid / ad_sid) and
|        NO device identifier at all (no Defender, Entra, Intune or Azure id)? Such a record is not a device and never was:
|        it made a device CI of its own (a domain controller's Tier 0 landed on that empty duplicate).
|    #>
|    param($Record)
|    if ($null -eq $Record) { return $false }
|    if ([string](Get-SIItemValue $Record 'si_provider') -ne 'eg' -or [string](Get-SIItemValue $Record 'si_record_type') -ne 'device') { return $false }
|    $ad = $false
|    foreach ($f in 'ad_object_guid', 'ad_sid') { if (@(Get-SIValueList (Get-SIItemValue $Record $f) | Where-Object { [string]$_ }).Count -gt 0) { $ad = $true; break } }
|    if (-not $ad) { return $false }
|    foreach ($f in 'mde_device_id', 'entra_device_id', 'intune_device_id', 'azure_resource_id', 'azure_vm_id') {
|        if (@(Get-SIValueList (Get-SIItemValue $Record $f) | Where-Object { [string]$_ }).Count -gt 0) { return $false }
|    }
|    $true
|}
|
|function Get-SIRecordLink {
|    <#
|        PURE. One record's link state with its evidence: @{ State (active | not_seen | frozen | gone); Reason ('' when active) }.
|          gone      positive evidence: the source says offboarded -- or (#1052) the record is an Active Directory computer
|                    account an earlier build took in as a device (Test-SIRecordAdAccountAsDevice): SecurityInsight itself
|                    knows it is no device, so its CI is retired at once with that reason, never left active
|          frozen    missing from its feed's newest collection and that collection was incomplete, or -- 60.5.0d -- the
|                    provider's collection scope changed after the record was last listed (-ScopeChangedAt: provider ->
|                    the time its scope changed): an asset that leaves because we stopped looking has told us nothing
|          not_seen  missing from a COMPLETE newer collection; or (#406, -SeenWithinDays) LISTED, but a device record whose
|                    source has not seen it within the seen window (Get-SIRecordSeenWindowDays) -- Defender keeps listing a
|                    machine it has not heard from
|          active    otherwise
|        Without -SeenWithinDays (0) a listed record is active, as before the lifecycle was kept.
|          gone (#1056) also: missing from a COMPLETE newer collection while the install's choice
|                    (SI_Identity_SkipNeverSyncedAd / SI_Identity_SkipNeverSyncedDisabledAd / SI_Identity_SkipDeletedGroups) leaves it out -- the reason names
|                    the switch (Get-SIRecordLeftOutByIdentityChoice). -IdentityChoice: Get-SIIdentityScopeChoice (not given =
|                    the install's settings; both off = exactly as before).
|    #>
|    param($Record, [hashtable]$FeedLatest, [datetime]$Now = [datetime]::UtcNow, [int]$SeenWithinDays = 0, [hashtable]$ScopeChangedAt, $IdentityChoice,
|          # #1057 record key -> its source's PROOF of deletion (SI-DeletionProof.ps1, ConvertTo-SIDeletionProofIndex): a record
|          # missing from a COMPLETE newer collection with a proof is gone, "deleted in <source>" -- the proof wins over the
|          # not-seen window; a record still listed, or one whose newer collection was not complete, is never decided by it
|          [hashtable]$DeletionProof)
|    $p = [string](Get-SIItemValue $Record 'si_provider')
|    if ([string](Get-SIItemValue $Record 'si_onboarding_status') -eq 'offboarded') { return [pscustomobject]@{ State = 'gone'; Reason = ('{0} says it is offboarded' -f $p) } }
|    if (Test-SIRecordAdAccountAsDevice $Record) { return [pscustomobject]@{ State = 'gone'; Reason = 'an Active Directory computer account, not a device of its own (#1052) -- its facts go to its Defender device when the match is safe' } }
|    $t = ConvertTo-SIUtcOrNull (Get-SIItemValue $Record 'si_collection_time')
|    $fl = $null; if ($FeedLatest) { $fl = $FeedLatest[(Get-SIRecordFeed $Record)] }
|    $fmt = { param($d) ([datetime]$d).ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture) }
|    if ($null -eq $fl -or $null -eq $t -or $t -ge $fl.Time) {
|        $win = Get-SIRecordSeenWindowDays -Record $Record -SeenWithinDays $SeenWithinDays
|        if ($win -gt 0) {
|            # measured at the moment the source LISTED it (its collection time): a source that stops collecting proves nothing
|            # about its devices -- only what it said when it last listed them counts (a source outage never retires)
|            $sls = ConvertTo-SIUtcOrNull (Get-SIItemValue $Record 'si_source_last_seen')
|            $at = $t; if ($null -eq $at -or $at -gt $Now.ToUniversalTime()) { $at = $Now.ToUniversalTime() }
|            if ($null -ne $sls -and ($at - $sls).TotalDays -gt $win) {
|                return [pscustomobject]@{ State = 'not_seen'; Reason = ('{0} lists it, but last saw it on {1} (more than {2} days)' -f $p, (& $fmt $sls), $win) }
|            }
|        }
|        return [pscustomobject]@{ State = 'active'; Reason = '' }
|    }
|    if ($ScopeChangedAt -and $ScopeChangedAt.ContainsKey($p) -and $ScopeChangedAt[$p] -is [datetime] -and $t -lt $ScopeChangedAt[$p]) {
|        return [pscustomobject]@{ State = 'frozen'; Reason = ('the {0} collection scope changed on {1}; it was last listed before that' -f $p, (& $fmt $ScopeChangedAt[$p])) }
|    }
|    if ($DeletionProof -and $DeletionProof.Count -gt 0 -and $fl.Complete) {
|        $pk = [string](Get-SIItemValue $Record 'si_record_key')
|        if ($pk -and $DeletionProof.ContainsKey($pk)) {
|            $pr = $DeletionProof[$pk]
|            $on = ''; if ($pr.DeletedAt -is [datetime]) { $on = ' on ' + (& $fmt $pr.DeletedAt) }
|            return [pscustomobject]@{ State = 'gone'; Reason = ('deleted in {0}{1} ({2})' -f $pr.Label, $on, $pr.Evidence); Deleted = [string]$pr.Label }
|        }
|    }
|    # a device whose source -- when it last listed it -- had not seen it within the seen window is not seen, whatever the
|    # newer collection was: that is the source's own evidence, not an absence
|    $win = Get-SIRecordSeenWindowDays -Record $Record -SeenWithinDays $SeenWithinDays
|    if ($win -gt 0) {
|        # (as when it last listed it -- its collection time -- never "now": the newer collection was not complete)
|        $sls = ConvertTo-SIUtcOrNull (Get-SIItemValue $Record 'si_source_last_seen')
|        if ($null -ne $sls -and ($t - $sls).TotalDays -gt $win) {
|            return [pscustomobject]@{ State = 'not_seen'; Reason = ('{0} last saw it on {1} (more than {2} days before it last listed it)' -f $p, (& $fmt $sls), $win) }
|        }
|    }
|    if ($fl.Complete) {
|        # #1056 a customer's choice leaves this Exposure Graph record out now: gone, with the switch named -- never a silent
|        # vanish and never a grace-period wait for an object the install chose not to keep
|        if ($p -eq 'eg') {
|            if ($null -eq $IdentityChoice) { $IdentityChoice = Get-SICiIdentityChoice }
|            if ($null -ne $IdentityChoice -and $IdentityChoice.Any) {
|                $lo = Get-SIRecordLeftOutByIdentityChoice -Record $Record -Choice $IdentityChoice
|                if ($lo.Gone) { return [pscustomobject]@{ State = 'gone'; Reason = ('{0} (last listed {1})' -f $lo.Reason, (& $fmt $t)) } }
|            }
|        }
|        return [pscustomobject]@{ State = 'not_seen'; Reason = ('{0} no longer lists it (last listed {1})' -f $p, (& $fmt $t)) }
|    }
|    return [pscustomobject]@{ State = 'frozen'; Reason = ('the newest {0} collection was incomplete' -f $p) }
|}
|
|function Get-SIRecordLinkState {
|    <# active | not_seen | frozen | gone for one record (Get-SIRecordLink's state). #>
|    param($Record, [hashtable]$FeedLatest, [datetime]$Now = [datetime]::UtcNow, [int]$SeenWithinDays = 0, [hashtable]$ScopeChangedAt)
|    (Get-SIRecordLink -Record $Record -FeedLatest $FeedLatest -Now $Now -SeenWithinDays $SeenWithinDays -ScopeChangedAt $ScopeChangedAt).State
|}
|
|function Get-SICiIdentityOrigin {
|    <#
|    .SYNOPSIS  PURE. #546 -- where an identity's on-premises facts come from: 'synced' | 'cloud' | '' (cannot tell).
|                 synced  an Active Directory user record is linked to the CI, or any record says si_onprem_synced = true
|                         (Entra onPremisesSyncEnabled, the Exposure Graph identity node)
|                 cloud   an Entra record is linked and none of the above holds: Graph's onPremisesSyncEnabled is null for an
|                         account that was never synchronised, and a service principal is always a cloud object
|                 ''      neither (e.g. only an Exposure Graph or a Defender for Identity record) -- a field with an
|                         origin-specific authority is then UNKNOWN on this CI, never guessed
|    .PARAMETER Candidates  as Resolve-SICiField takes them: @{ Record; Provider; Key; State }
|    #>
|    param([AllowEmptyCollection()][object[]]$Candidates = @())
|    $hasEntra = $false
|    foreach ($c in $Candidates) {
|        if ($null -eq $c) { continue }
|        $p = [string]$c.Provider
|        if ($p -eq 'ad' -and [string](Get-SIItemValue $c.Record 'si_record_type') -in 'user', '') { return 'synced' }
|        if ((ConvertTo-SIBoolOrNull (Get-SIItemValue $c.Record 'si_onprem_synced')) -eq $true) { return 'synced' }
|        if ($p -eq 'entra') { $hasEntra = $true }
|    }
|    if ($hasEntra) { return 'cloud' }
|    return ''
|}
|
|function Get-SIFieldOriginRule {
|    <#
|    .SYNOPSIS  PURE. #546 -- a field's resolution for an identity origin (field catalog resolution.byOrigin.<origin>):
|               @{ Policy; Authority; DecidedBy } or $null when the field has no origin-specific authority.
|               Authority = the providers that may supply the value for that origin (in order; the others are ignored);
|               DecidedBy = the providers one of which must be linked to the CI for the value -- or its absence -- to be
|               known (default: Authority). A field with byOrigin on a CI whose origin is '' returns @{ Unknown = $true }.
|               Customer-overridable like every catalog field: Community field-catalog.custom.json, Pro cfg.ItemOverride
|               'field-catalog:<field>'.
|    #>
|    param([Parameter(Mandatory)]$Field, [AllowEmptyString()][string]$Origin)
|    $bo = $null
|    if ($Field.resolution) { $bo = Get-SIItemValue $Field.resolution 'byOrigin' }
|    if ($null -eq $bo) { return $null }
|    if (-not $Origin) { return @{ Unknown = $true } }
|    $r = Get-SIItemValue $bo $Origin
|    if ($null -eq $r) { return $null }
|    $pol = [string](Get-SIItemValue $r 'policy'); if (-not $pol) { $pol = [string]$Field.resolution.policy }
|    $auth = @(@(Get-SIItemValue $r 'authority') | Where-Object { $_ } | ForEach-Object { [string]$_ })
|    $dec = @(@(Get-SIItemValue $r 'decidedBy') | Where-Object { $_ } | ForEach-Object { [string]$_ })
|    if ($dec.Count -eq 0) { $dec = $auth }
|    return @{ Policy = $pol; Authority = $auth; DecidedBy = $dec; Unknown = $false }
|}
|
|function Test-SICiFieldUnknown {
|    <#
|    .SYNOPSIS  PURE. #546 -- is this field UNKNOWN on the CI: it has an origin-specific authority and either the origin cannot
|               be told, or none of the providers that decide it for that origin has a current (active / frozen) record
|               linked. A synchronised account without its Active Directory / Defender for Identity record has an unknown
|               password age and on-premises sign-in -- never "stale", never "never signed in".
|    #>
|    param([Parameter(Mandatory)]$Field, [AllowEmptyString()][string]$Origin, [AllowEmptyCollection()][object[]]$Candidates = @())
|    $rule = Get-SIFieldOriginRule -Field $Field -Origin $Origin
|    if ($null -eq $rule) { return $false }
|    if ($rule.Unknown) { return $true }
|    foreach ($c in $Candidates) {
|        if ($null -ne $c -and $rule.DecidedBy -contains [string]$c.Provider -and [string]$c.State -in 'active', 'frozen') { return $false }
|    }
|    return $true
|}
|
|function Resolve-SICiField {
|    <#
|    .SYNOPSIS  One SI field resolved from a CI's records by its catalog policy.
|    .PARAMETER Origin  #546 the identity's origin (Get-SICiIdentityOrigin): a field with resolution.byOrigin takes that
|                       origin's policy and authority, and ONLY the providers in it may supply the value (Entra never
|                       decides a synchronised account's password age).
|    .OUTPUTS   $null (no record carries it) or @{ Value; Provider; Record; ObservedAt; Stale }
|    #>
|    param([Parameter(Mandatory)]$Field, [Parameter(Mandatory)][object[]]$Candidates, [datetime]$Now, [string]$CmdbOwner = 'cmdb', [string]$Origin = '')
|    $policy = [string]$Field.resolution.policy
|    $rawAuth = @($Field.resolution.authority)
|    # (an origin rule is used only with an origin: without one it is never applied -- not read)
|    $originRule = $null; if ($Origin) { $originRule = Get-SIFieldOriginRule -Field $Field -Origin $Origin }
|    if ($null -ne $originRule -and -not $originRule.Unknown) {
|        $policy = $originRule.Policy
|        $rawAuth = @($originRule.Authority)
|        $allowed = $originRule.Authority
|        $Candidates = @(foreach ($c in $Candidates) { if ($c -and $allowed -contains [string]$c.Provider) { $c } })
|        if ($Candidates.Count -eq 0) { return $null }
|    }
|    # (2026-10-16, the CI build of a large install: this runs for every field of every CI -- loops, never a pipeline, and
|    # a pool of ONE candidate is that candidate without a sort. The same answers.)
|    # #463 the catalog's 'cmdb_owner' token is the tenant's ONE CMDB owner; a field whose authority is ONLY the owner
|    # (si_cmdb_*) takes no value from any other provider -- a non-owner CMDB never decides (2.8.1, D11)
|    $authority = @(foreach ($a in $rawAuth) { if ([string]$a -eq 'cmdb_owner') { $CmdbOwner } else { $a } })
|    $notOwner = 0; foreach ($a in $rawAuth) { if ([string]$a -ne 'cmdb_owner') { $notOwner++ } }
|    $ownerOnly = ($rawAuth.Count -gt 0 -and $notOwner -eq 0)
|    if ($ownerOnly) { $Candidates = @(foreach ($c in $Candidates) { if ([string]$c.Provider -eq $CmdbOwner) { $c } }); if ($Candidates.Count -eq 0) { return $null } }
|    $staleDays = 30
|    if ($null -ne $Field.resolution.staleDays) { $staleDays = [double]$Field.resolution.staleDays }
|    $cands = New-Object System.Collections.Generic.List[object]
|    foreach ($c in $Candidates) {
|        $v = Get-SIItemValue $c.Record ([string]$Field.name)
|        if (Test-SIValueEmpty $v) { if (-not ($v -is [bool])) { continue } }
|        $seen = ConvertTo-SIUtcOrNull (Get-SIItemValue $c.Record 'si_source_last_seen')
|        $fresh = ($c.State -in 'active', 'frozen') -and ($null -ne $seen) -and ((($Now - $seen).TotalDays) -le $staleDays)
|        $rank = [array]::IndexOf($authority, [string]$c.Provider)
|        if ($rank -lt 0) { $rank = 999 }
|        $cands.Add([pscustomobject]@{ Value = $v; Provider = $c.Provider; Record = $c.Key; ObservedAt = $seen; Fresh = $fresh; Rank = $rank })
|    }
|    if ($cands.Count -eq 0) { return $null }
|    # plain arrays only: assigning @(<the generic list>) inside this branch threw "Argument types do not match" on both
|    # hosts (measured on the test VM) -- the candidates are copied out once with ToArray()
|    $candArr = $cands.ToArray()
|    $freshArr = @(foreach ($c in $candArr) { if ($c.Fresh) { $c } })
|    $stale = ($freshArr.Count -eq 0)
|    $pool = @(if ($stale) { $candArr } else { $freshArr })
|    $newest = { param($xs) $xa = @($xs); if ($xa.Count -eq 1) { return $xa[0] }; @($xa | Sort-Object @{ Expression = { if ($_.ObservedAt) { $_.ObservedAt } else { [datetime]::MinValue } }; Descending = $true }, @{ Expression = { $_.Rank } })[0] }
|    switch ($policy) {
|        'any_true' {
|            $t = @(foreach ($c in $pool) { if ((ConvertTo-SIBoolOrNull $c.Value) -eq $true) { $c } })
|            # Providers: EVERY provider that said true -- the evidence of a risk factor names them all (#464)
|            if ($t.Count -gt 0) { $w = & $newest $t; return @{ Value = $true; Provider = $w.Provider; Record = $w.Record; ObservedAt = $w.ObservedAt; Stale = $stale; Providers = @($t | ForEach-Object { [string]$_.Provider } | Select-Object -Unique) } }
|            $f = @(foreach ($c in $pool) { if ((ConvertTo-SIBoolOrNull $c.Value) -eq $false) { $c } })
|            if ($f.Count -gt 0) { $w = & $newest $f; return @{ Value = $false; Provider = $w.Provider; Record = $w.Record; ObservedAt = $w.ObservedAt; Stale = $stale } }
|            return $null
|        }
|        'union' {
|            $list = New-Object System.Collections.Generic.List[object]
|            $seenKeys = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|            $byRank = $pool; if ($pool.Count -gt 1) { $byRank = @($pool | Sort-Object Rank) }
|            foreach ($c in $byRank) {
|                foreach ($x in (Get-SIValueList $c.Value)) {
|                    $k = if ($x -is [string] -or $x -is [ValueType]) { [string]$x } else { ($x | ConvertTo-Json -Compress -Depth 6) }
|                    if ($seenKeys.Add($k)) { $list.Add($x) }
|                }
|            }
|            $w = & $newest $pool
|            return @{ Value = $list.ToArray(); Provider = (@($pool | Select-Object -ExpandProperty Provider -Unique) -join ','); Record = $w.Record; ObservedAt = $w.ObservedAt; Stale = $stale }
|        }
|        { $_ -in 'min', 'max' } {
|            # compared by the catalog TYPE: values read back from Log Analytics are text, so the value cannot tell
|            $isDate = ([string]$Field.type -eq 'datetime')
|            $best = $null; $bestV = $null
|            foreach ($c in $cands) {
|                $x = $null
|                if ($isDate) { $x = ConvertTo-SIUtcOrNull $c.Value } else { $x = ConvertTo-SINumberOrNull $c.Value }
|                if ($null -eq $x) { continue }
|                if ($null -eq $best -or ($policy -eq 'max' -and $x -gt $bestV) -or ($policy -eq 'min' -and $x -lt $bestV)) { $best = $c; $bestV = $x }
|            }
|            if ($null -eq $best) { return $null }
|            return @{ Value = $best.Value; Provider = $best.Provider; Record = $best.Record; ObservedAt = $best.ObservedAt; Stale = $false }
|        }
|        default {
|            # authority (and anything else that reaches a CI from records): best authority rank, then newest
|            if ($stale) { $w = & $newest $pool }
|            elseif ($pool.Count -eq 1) { $w = $pool[0] }
|            else { $w = @($pool | Sort-Object @{ Expression = { $_.Rank } }, @{ Expression = { if ($_.ObservedAt) { $_.ObservedAt } else { [datetime]::MinValue } }; Descending = $true })[0] }
|            return @{ Value = $w.Value; Provider = $w.Provider; Record = $w.Record; ObservedAt = $w.ObservedAt; Stale = $stale }
|        }
|    }
|}
|
|function Get-SICiFieldPlan {
|    <#
|    .SYNOPSIS  PURE. The catalog fields a CI resolves from its records, in catalog order, each with what New-SICiDocument
|               asks of it for every CI: its name, whether it is an identity field, whether it has an origin-specific
|               authority (resolution.byOrigin). Read once per set of CIs instead of once per CI and field -- the catalog
|               has several hundred fields.
|               A field is in the plan when its level is 'both' and it is not computed (a computed field is
|               SecurityInsight's own on the CI, never resolved from the records).
|    #>
|    param([Parameter(Mandatory)]$Catalog)
|    $plan = New-Object System.Collections.Generic.List[object]
|    foreach ($f in @($Catalog.fields)) {
|        if ([string]$f.level -ne 'both') { continue }
|        if ([string]$f.resolution.policy -eq 'computed') { continue }
|        # as Get-SIFieldOriginRule reads it: no byOrigin = no origin rule, whatever the origin
|        $bo = $null
|        if ($f.resolution) { $bo = Get-SIItemValue $f.resolution 'byOrigin' }
|        $plan.Add([pscustomobject]@{ Field = $f; Name = [string]$f.name; Identity = (@($f.classes) -contains 'identity'); ByOrigin = ($null -ne $bo) })
|    }
|    return $plan.ToArray()   # unrolled: the caller collects with @()
|}
|
|function New-SICiDocument {
|    <#
|    .SYNOPSIS  One CI from its records: id, class, links, lifecycle and every resolved SI field.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$CiId,
|        [Parameter(Mandatory)][object[]]$Records,
|        [Parameter(Mandatory)]$Catalog,
|        [Parameter(Mandatory)][hashtable]$FeedLatest,
|        [datetime]$Now = [datetime]::UtcNow,
|        [string]$RunId = '',
|        # #463 the tenant's one CMDB owner (cmdb | servicenow) -- the catalog's cmdb_owner authority
|        [string]$CmdbOwner = 'cmdb',
|        # the catalog's resolved fields, read once for a whole set of CIs (Get-SICiFieldPlan -Catalog <the same catalog>);
|        # not given, it is read here -- the same result
|        [AllowNull()][object[]]$FieldPlan,
|        # #406 the lifecycle settings (Get-SICiLifecycleSettings: seen window, grace period per category); not given = the
|        # settings in force
|        $Lifecycle,
|        # what this CI was after the last build: @{ Lifecycle; Since; Reason } (Get-SICiBatchStored) -- none = a first build
|        $Previous,
|        # 60.5.0d provider -> the time its collection scope changed (Update-SICiScopeChanges)
|        [hashtable]$ScopeChangedAt,
|        # #1057 record key -> its source's proof of deletion (Get-SIRecordLink -DeletionProof)
|        [hashtable]$DeletionProof,
|        # #1054 the placeholder device names in force (Get-SICiPlaceholderNames -Model, read once per set); not given = the
|        # shipped list
|        [AllowNull()][AllowEmptyCollection()][string[]]$PlaceholderNames
|    )
|    if ($null -eq $Lifecycle) { $Lifecycle = Get-SICiLifecycleSettings }
|    if ($null -eq $PlaceholderNames) { $PlaceholderNames = Get-SICiPlaceholderNames }
|    $ci = [ordered]@{ si_ci_id = $CiId }
|    $class = 'identity'; $bestRank = 99
|    $cands = New-Object System.Collections.Generic.List[object]
|    $links = New-Object System.Collections.Generic.List[object]
|    foreach ($r in $Records) {
|        $rc = [string](Get-SIItemValue $r 'si_class')
|        $rk = Get-SICiClassRank $rc
|        if ($rk -lt $bestRank) { $bestRank = $rk; $class = $rc }
|        $ls = Get-SIRecordLink -Record $r -FeedLatest $FeedLatest -Now $Now -SeenWithinDays ([int]$Lifecycle.SeenWithinDays) -ScopeChangedAt $ScopeChangedAt -DeletionProof $DeletionProof
|        $state = [string]$ls.State
|        $p = [string](Get-SIItemValue $r 'si_provider')
|        $key = [string](Get-SIItemValue $r 'si_record_key')
|        $native = $key; $i = $key.IndexOf(':'); if ($i -ge 0) { $native = $key.Substring($i + 1) }
|        $lo = [pscustomobject][ordered]@{
|                provider = $p; type = [string](Get-SIItemValue $r 'si_record_type'); id = $native; record_key = $key
|                primary = $false; state = $state; last_seen = (ConvertTo-SIUtcOrNull (Get-SIItemValue $r 'si_source_last_seen'))
|            }
|        # the evidence of a link that is not active (dates only: it changes with the state, never by itself)
|        if ($ls.Reason) { $lo | Add-Member -NotePropertyName 'reason' -NotePropertyValue ([string]$ls.Reason) }
|        # #1057 the source the object was proven deleted in (Get-SICiLifecycle: retired at once)
|        if ($ls.PSObject.Properties['Deleted'] -and $ls.Deleted) { $lo | Add-Member -NotePropertyName 'deleted' -NotePropertyValue ([string]$ls.Deleted) }
|        $links.Add($lo)
|        $cands.Add([pscustomobject]@{ Record = $r; Provider = $p; Key = $key; State = $state })
|    }
|    # primary link per provider: active first, then the newest -- #1052 an AD computer account's link is never the primary
|    # one while the provider has another (si_link_eg names the device's own graph node, which the reports join by)
|    foreach ($grp in ($links | Group-Object provider)) {
|        $pick = @($grp.Group | Sort-Object @{ Expression = { if ($_.type -eq 'computer_account') { 1 } else { 0 } } }, @{ Expression = { if ($_.state -in 'active', 'frozen') { 0 } else { 1 } } }, @{ Expression = { if ($_.last_seen) { $_.last_seen } else { [datetime]::MinValue } }; Descending = $true })[0]
|        $pick.primary = $true
|    }
|    $ci['si_class'] = $class
|    $ci['si_collection_time'] = $Now.ToUniversalTime()
|    if ($RunId) { $ci['si_run_id'] = $RunId }
|    # #546 field authority by identity origin: synchronised from AD vs cloud-only decides which provider is authoritative
|    # for the on-premises facts (password age, on-premises sign-in); a field that cannot be decided is listed as unknown
|    $candArr = $cands.ToArray()
|    $origin = ''
|    if ($class -eq 'identity') { $origin = Get-SICiIdentityOrigin -Candidates $candArr; if ($origin) { $ci['si_identity_origin'] = $origin } }
|    $unknownFields = New-Object System.Collections.Generic.List[string]
|    $resolvedSources = [ordered]@{}
|    # THE FIELDS THE RECORDS CARRY AT ALL. A field no record of this CI carries resolves to nothing -- Resolve-SICiField
|    # only ever reads the candidates' own value of the field -- so it is not asked for: the catalog has several hundred
|    # fields, a CI's records carry a few dozen, and asking for every one was most of the CI build's time on a large tenant
|    # (2026-10-12). A name is looked up the way Get-SIItemValue finds it: without case on an object's properties and on a
|    # dictionary's keys, and through the dictionary's own Contains.
|    $carried = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $dictRecords = New-Object System.Collections.Generic.List[object]
|    foreach ($r in $Records) {
|        if ($null -eq $r) { continue }
|        if ($r -is [System.Collections.IDictionary]) { $dictRecords.Add($r); foreach ($k in $r.Keys) { [void]$carried.Add([string]$k) } }
|        else { foreach ($p in $r.PSObject.Properties) { [void]$carried.Add([string]$p.Name) } }
|    }
|    # a COMPUTED field (si_class, si_collection_time, si_run_id ...) is SecurityInsight's own on the CI -- never
|    # resolved from the records, or a record's value would overwrite what the CI build decided (Get-SICiFieldPlan)
|    if ($null -eq $FieldPlan) { $FieldPlan = @(Get-SICiFieldPlan -Catalog $Catalog) }
|    foreach ($fp in $FieldPlan) {
|        $f = $fp.Field
|        $fOrigin = ''
|        if ($class -eq 'identity' -and $fp.Identity) {
|            $fOrigin = $origin
|            # (a field without an origin-specific authority is never unknown: Test-SICiFieldUnknown answers false for it)
|            if ($fp.ByOrigin -and (Test-SICiFieldUnknown -Field $f -Origin $origin -Candidates $candArr)) { $unknownFields.Add([string]$f.name) }
|        }
|        $has = $carried.Contains($fp.Name)
|        if (-not $has) { foreach ($d in $dictRecords) { if ($d.Contains($fp.Name)) { $has = $true; break } } }
|        if (-not $has) { continue }
|        $fCands = $candArr
|        $placeholder = $null
|        if ($fp.Name -eq 'si_asset_name' -and $class -in 'device', 'cloud_resource') {
|            # #1054 a source's placeholder name never names a machine CI: the records that carry one are left out of the
|            # resolution, so the next source in the authority order gives the name; when only placeholders are left, a
|            # generated name (Get-SICiUnnamedDeviceName) from the record the authority order picks among them
|            $kept = New-Object System.Collections.Generic.List[object]
|            $phs = New-Object System.Collections.Generic.List[object]
|            foreach ($c in $candArr) {
|                if (Test-SICiPlaceholderName -Value (Get-SIItemValue $c.Record 'si_asset_name') -Names $PlaceholderNames) { $phs.Add($c) } else { $kept.Add($c) }
|            }
|            if ($phs.Count -gt 0) {
|                $placeholder = Resolve-SICiField -Field $f -Candidates $phs.ToArray() -Now $Now -CmdbOwner $CmdbOwner -Origin $fOrigin
|                $fCands = $kept.ToArray()
|            }
|        }
|        $res = $null
|        if ($fCands.Count -gt 0) { $res = Resolve-SICiField -Field $f -Candidates $fCands -Now $Now -CmdbOwner $CmdbOwner -Origin $fOrigin }
|        if ($null -eq $res -and $null -ne $placeholder) {
|            $gen = Get-SICiUnnamedDeviceName -RecordKey ([string]$placeholder.Record)
|            if ($gen) {
|                $ci[[string]$f.name] = $gen
|                $resolvedSources[[string]$f.name] = [ordered]@{ provider = $placeholder.Provider; record = $placeholder.Record; observed_at = $placeholder.ObservedAt; stale = [bool]$placeholder.Stale
|                    from = 'generated'; placeholder = ([string]$placeholder.Value).Trim().ToLowerInvariant() }
|                continue
|            }
|            # no id to build a name from: the placeholder stays (never a blank name) -- the check still flags it by its name
|            $res = $placeholder; $fCands = $candArr; $placeholder = $null
|        }
|        if ($null -eq $res) { continue }
|        $ci[[string]$f.name] = $res.Value
|        $resolvedSources[[string]$f.name] = [ordered]@{ provider = $res.Provider; record = $res.Record; observed_at = $res.ObservedAt; stale = [bool]$res.Stale }
|        # the name came from another source: which placeholder it replaced, and from which record
|        if ($null -ne $placeholder) { $resolvedSources[[string]$f.name]['placeholder'] = ([string]$placeholder.Value).Trim().ToLowerInvariant(); $resolvedSources[[string]$f.name]['placeholder_record'] = [string]$placeholder.Record }
|        if ($fOrigin -and $fp.ByOrigin -and $null -ne (Get-SIFieldOriginRule -Field $f -Origin $fOrigin)) { $resolvedSources[[string]$f.name]['origin'] = $fOrigin }
|        if ($unknownFields.Contains([string]$f.name)) { $resolvedSources[[string]$f.name]['unknown'] = $true }
|        if ($res.Providers -and @($res.Providers).Count -gt 1) { $resolvedSources[[string]$f.name]['providers'] = @($res.Providers) }
|        # a CI of ONE record has nothing to disagree with (Get-SICiFieldConflicts compares the other records only)
|        # (#1054 a placeholder name the resolution left out is no conflict: the candidates are the ones it resolved from)
|        if ($fCands.Count -ne 1 -or [string]$fCands[0].Key -ne [string]$res.Record) {
|            $conf = Get-SICiFieldConflicts -Field $f -Candidates $fCands -Resolved $res -Now $Now
|            if ($conf.Count -gt 0) { $resolvedSources[[string]$f.name]['conflicts'] = $conf }
|        }
|    }
|    if ($unknownFields.Count -gt 0) { $ci['si_unknown_fields'] = $unknownFields.ToArray() }
|    # NO MACHINE CI IS NAMELESS (owner 2026-11-05: a ring 1 install had 271 active device CIs with an EMPTY name, 270 with a
|    # Defender link). The placeholder rule above (#1054) names a CI only when a record CARRIES a placeholder; a Defender
|    # device with no computerDnsName carries NO name at all, so si_asset_name was never resolved and stayed empty. A device
|    # or cloud resource CI that no record names gets a name here: a cloud resource the name in its Azure resource id, else
|    # the generated 'unnamed-device-<short id>' from the record of the first source in this order: Defender, Azure,
|    # Defender for Cloud, Intune, Entra, Exposure Graph, any other (ordinal record key) -- the same on every build.
|    if ($class -in 'device', 'cloud_resource' -and [string]::IsNullOrWhiteSpace([string]$ci['si_asset_name'])) {
|        $order = @('mde', 'azure', 'mdc', 'intune', 'entra', 'eg')
|        $pickC = $null; $pickR = 999
|        foreach ($c in $candArr) {
|            $rk2 = [array]::IndexOf($order, [string]$c.Provider); if ($rk2 -lt 0) { $rk2 = 100 }
|            if ($null -eq $pickC -or $rk2 -lt $pickR -or ($rk2 -eq $pickR -and [string]::CompareOrdinal([string]$c.Key, [string]$pickC.Key) -lt 0)) { $pickC = $c; $pickR = $rk2 }
|        }
|        if ($null -ne $pickC) {
|            $gen = $null
|            if ($class -eq 'cloud_resource') {
|                $nid = [string]$pickC.Key; $ix = $nid.IndexOf(':'); if ($ix -ge 0) { $nid = $nid.Substring($ix + 1) }
|                if ($nid -match '^/subscriptions/') { $gen = ($nid.TrimEnd('/') -split '/')[-1] }
|            }
|            if (-not $gen) { $gen = Get-SICiUnnamedDeviceName -RecordKey ([string]$pickC.Key) }
|            if ($gen) {
|                $ci['si_asset_name'] = $gen
|                $resolvedSources['si_asset_name'] = [ordered]@{ provider = [string]$pickC.Provider; record = [string]$pickC.Key; observed_at = (ConvertTo-SIUtcOrNull (Get-SIItemValue $pickC.Record 'si_source_last_seen')); stale = $false; from = 'generated'; placeholder = '' }
|            }
|        }
|    }
|    $recordLinks = $links.ToArray()
|    # AZURE CHILD RESOURCES (owner 2026-10-11, SI-AzureChildren.ps1): every child resource a record of this CI lists
|    # (si_child_resources -- a VM extension, a disk, a network interface, a SQL database ...) is a LINKED OBJECT of this CI, so
|    # its id leads here (a finding reported on the child lands on its parent CI); a child is never a CI of its own. A child
|    # link has no record of its own (record_key '') and takes the state of the record that lists it. In id order.
|    $childLinks = New-Object System.Collections.Generic.List[object]
|    $childSeen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($c in $candArr) {
|        foreach ($ch in (Get-SIValueList (Get-SIItemValue $c.Record 'si_child_resources'))) {
|            $chId = ([string](Get-SIItemValue $ch 'id')).Trim().ToLowerInvariant()
|            if (-not $chId -or -not $childSeen.Add($chId)) { continue }
|            $childLinks.Add([pscustomobject][ordered]@{
|                    provider = [string]$c.Provider; type = 'child_resource'; id = $chId; record_key = ''; primary = $false; state = [string]$c.State
|                    last_seen = (ConvertTo-SIUtcOrNull (Get-SIItemValue $c.Record 'si_source_last_seen')); resource_type = [string](Get-SIItemValue $ch 'type')
|                })
|        }
|    }
|    $linkArr = @($recordLinks) + @($childLinks.ToArray() | Sort-Object { $_.id })
|    $ci['si_linked_objects'] = $linkArr
|    $ci['si_link_count'] = $linkArr.Count
|    $linkField = @{ mde = 'si_link_mde'; entra = 'si_link_entra'; intune = 'si_link_intune'; azure = 'si_link_azure'; eg = 'si_link_eg'; ad = 'si_link_ad'; mdi = 'si_link_mdi'; shodan = 'si_link_shodan'; cmdb = 'si_link_cmdb'; servicenow = 'si_link_servicenow' }
|    foreach ($l in $recordLinks) { if ($l.primary -and $linkField.ContainsKey($l.provider)) { $ci[$linkField[$l.provider]] = $l.id } }
|    # THE LIFECYCLE (V3-DATA-MODEL 2.5.5, #406 -- SI-CiLifecycle.ps1, one mechanism with the CMDB sync) follows the CI's own
|    # records (a child link carries its parent record's state): active when any link is active; not seen within the grace
|    # period of the CI's category; retired after it, or at once when every link is gone; a CI whose only current links are
|    # frozen keeps what it was. The evidence is on the CI: since when, how many days not seen, and why.
|    $life = Get-SICiLifecycle -Links $recordLinks -Category (Get-SICiRetireCategory -Ci $ci -Links $recordLinks) -Settings $Lifecycle -Now $Now -Previous $Previous
|    $ci['si_lifecycle'] = [string]$life.Lifecycle
|    # (ISO text, seconds: the same text on every host and in the stored document, so "since" never changes a CI by itself)
|    if ($null -ne $life.Since) { $ci['si_lifecycle_since'] = ([datetime]$life.Since).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) }
|    if ($life.Reason) { $ci['si_lifecycle_reason'] = [string]$life.Reason }
|    if ($life.Lifecycle -ne 'active' -and $null -ne $life.NotSeenDays) { $ci['si_not_seen_days'] = [int]$life.NotSeenDays }
|    # #642 A CLOUD RESOURCE'S LAST SEEN. Azure Resource Graph has no "last seen" of a resource (data-model/mappings/azure has no
|    # si_last_seen) and the exposure graph gives one only for some nodes, so sidata.Ci.LastSeen stayed empty for every cloud
|    # CI (found at a ring 1 install 2026-10-13). A resource is seen when its source lists it: the newest source time of its
|    # current (active / frozen) records -- else of any record. Only for cloud resources: an identity or a device keeps the
|    # last-seen its source reports (a sign-in, a check-in), never the collection time, or an account that never signs in would
|    # look active.
|    if ($class -eq 'cloud_resource' -and -not ($ci.Contains('si_last_seen') -and $ci['si_last_seen'])) {
|        $pick = $null; $pickT = $null; $pickCur = $false
|        foreach ($c in $candArr) {
|            $st = ConvertTo-SIUtcOrNull (Get-SIItemValue $c.Record 'si_source_last_seen')
|            if ($null -eq $st) { continue }
|            $cur = ([string]$c.State -in 'active', 'frozen')
|            if ($null -eq $pick -or ($cur -and -not $pickCur) -or ($cur -eq $pickCur -and $st -gt $pickT)) { $pick = $c; $pickT = $st; $pickCur = $cur }
|        }
|        if ($null -ne $pick) {
|            $ci['si_last_seen'] = $pickT
|            $resolvedSources['si_last_seen'] = [ordered]@{ provider = [string]$pick.Provider; record = [string]$pick.Key; observed_at = $pickT; stale = (-not $pickCur); from = 'listed_by_source' }
|        }
|    }
|    if ($ci.Contains('si_last_seen') -and $ci['si_last_seen']) {
|        $ls = ConvertTo-SIUtcOrNull $ci['si_last_seen']
|        if ($ls) { $ci['si_days_inactive'] = [int][Math]::Floor(($Now - $ls).TotalDays) }
|    }
|    $ci['si_field_sources'] = $resolvedSources
|    return $ci
|}
'@ }
$__siSupportFiles['engine/data-model/SI-Conditions.ps1'] = @{ Sha256 = 'd03c9b8ed4b1682d5d47e22ac3a93a5ad43d3096e9e0e3609ca0afc4da02d68b'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight condition evaluator -- the ONE implementation of the closed condition language that risk factors,
|    enrichment rules, coverage checks and lists use (data-model/*.json, V3-DATA-MODEL part 2).
|
|    A condition is a leaf or a group:
|        leaf   { "field": "si_tier", "op": "lte", "value": 1 }
|        group  { "all": [ ... ] }   { "any": [ ... ] }      (an empty "all" is true, an empty "any" is false)
|
|    THE OPERATION SET IS CLOSED. A template (and a customer override) can only combine these operations; there is no
|    expression language, so a customer-authored file can never run code in the engine:
|        eq ne in not_in is_true is_false is_empty not_empty gt gte lt lte like contains contains_any matches
|        older_than_days newer_than_days in_ranges in_list
|    An unknown operation throws -- a condition must never evaluate as something its author did not write.
|
|    The item is anything with named values: a hashtable, an ordered dictionary or a PSObject (a CI, a record, a finding).
|    String comparison is case-insensitive. Dates are read with InvariantCulture and compared in UTC.
|
|    Context (optional hashtable):
|        Lists = @{ <id> = <list object from lists.json: type conditions | values | ranges> }
|        Now   = [datetime] UTC   (default: the current time; tests pass a fixed one)
|
|    PowerShell 5.1: no ?. / ??, no ternary; no Set-StrictMode here (it would leak into the caller).
|#>
|
|function Get-SIItemValue {
|    <# The value of a named field on a hashtable / dictionary / PSObject, or $null. Case-insensitive. #>
|    param($Item, [string]$Name)
|    if ($null -eq $Item -or [string]::IsNullOrEmpty($Name)) { return $null }
|    if ($Item -is [System.Collections.IDictionary]) {
|        if ($Item.Contains($Name)) { return $Item[$Name] }
|        foreach ($k in $Item.Keys) { if ([string]::Equals([string]$k, $Name, [StringComparison]::OrdinalIgnoreCase)) { return $Item[$k] } }
|        return $null
|    }
|    $p = $Item.PSObject.Properties[$Name]
|    if ($p) { return $p.Value }
|    return $null
|}
|
|function Test-SIValueEmpty {
|    param($Value)
|    if ($null -eq $Value) { return $true }
|    if ($Value -is [string]) { return [string]::IsNullOrWhiteSpace($Value) }
|    if ($Value -is [System.Collections.IDictionary]) { return ($Value.Count -eq 0) }
|    if ($Value -is [System.Collections.IEnumerable]) { foreach ($x in $Value) { return $false }; return $true }
|    return $false
|}
|
|function ConvertTo-SIBoolOrNull {
|    param($Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [bool]) { return $Value }
|    $s = ([string]$Value).Trim()
|    if ($s -eq '') { return $null }
|    if ($s -in 'true', '1', 'yes', 'y', 'on', 'enabled') { return $true }
|    if ($s -in 'false', '0', 'no', 'n', 'off', 'disabled') { return $false }
|    return $null
|}
|
|function ConvertTo-SINumberOrNull {
|    <# A number, or the leading number of a version-like string ("12.6.1" -> 12.6), or $null. #>
|    param($Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [int] -or $Value -is [long] -or $Value -is [double] -or $Value -is [decimal] -or $Value -is [single]) { return [double]$Value }
|    $s = ([string]$Value).Trim()
|    if ($s -eq '') { return $null }
|    $d = 0.0
|    if ([double]::TryParse($s, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $d }
|    $m = [regex]::Match($s, '^-?\d+(\.\d+)?')
|    if ($m.Success -and [double]::TryParse($m.Value, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $d }
|    return $null
|}
|
|function ConvertTo-SIUtcOrNull {
|    param($Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [datetime]) { return $Value.ToUniversalTime() }
|    if ($Value -is [datetimeoffset]) { return $Value.UtcDateTime }
|    $s = ([string]$Value).Trim()
|    if ($s -eq '') { return $null }
|    $dto = [datetimeoffset]::MinValue
|    if ([datetimeoffset]::TryParse($s, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::AssumeUniversal, [ref]$dto)) { return $dto.UtcDateTime }
|    return $null
|}
|
|function Get-SIValueList {
|    <# A value as a flat list: $null -> empty; a scalar -> one item; a list -> its items. Strings are never split. #>
|    param($Value)
|    $out = [System.Collections.Generic.List[object]]::new()
|    if ($null -eq $Value) { return , $out }
|    if ($Value -is [string] -or $Value -is [System.Collections.IDictionary] -or -not ($Value -is [System.Collections.IEnumerable])) { $out.Add($Value); return , $out }
|    foreach ($x in $Value) { if ($null -ne $x) { $out.Add($x) } }
|    return , $out
|}
|
|function ConvertTo-SITagScopeText {
|    <# PURE. Where an inherited tag came from, in plain words: resourceGroup -> 'resource group', subscription ->
|       'subscription', managementGroup -> 'management group'; '' when the tag is the asset's own (no scope). #>
|    param([AllowNull()][AllowEmptyString()][string]$Scope)
|    $s = ([string]$Scope).Trim()
|    if (-not $s) { return '' }
|    switch ($s.ToLowerInvariant()) { 'resourcegroup' { return 'resource group' } 'subscription' { return 'subscription' } 'managementgroup' { return 'management group' } }
|    return ($s -creplace '([a-z])([A-Z])', '$1 $2').ToLowerInvariant()
|}
|
|function ConvertTo-SITagEntryText {
|    <#
|        PURE. ONE tag entry as text a person (and ServiceNow) reads: { name; value } -> 'name = value', a name without a value
|        -> 'name', an inherited tag (it has a scope) -> 'name = value (resource group)' / '(subscription)'. The same words the
|        web app's CI page shows (CiDocument.Item). $null when the item is not a tag entry: a name AND a value key, and no id
|        (an object with an id is a linked object, never a tag).
|    #>
|    param($Item)
|    if ($null -eq $Item -or $Item -is [string] -or $Item -is [ValueType]) { return $null }
|    $has = {
|        param($o, [string]$k)
|        if ($o -is [System.Collections.IDictionary]) { foreach ($x in $o.Keys) { if ([string]::Equals([string]$x, $k, [StringComparison]::OrdinalIgnoreCase)) { return $true } }; return $false }
|        return ($null -ne $o.PSObject.Properties[$k])
|    }
|    if (-not (& $has $Item 'name') -or -not (& $has $Item 'value') -or (& $has $Item 'id')) { return $null }
|    $n = ([string](Get-SIItemValue $Item 'name')).Trim()
|    if (-not $n) { return $null }
|    $v = ([string](Get-SIItemValue $Item 'value')).Trim()
|    $t = $n; if ($v) { $t = '{0} = {1}' -f $n, $v }
|    $sc = ConvertTo-SITagScopeText ([string](Get-SIItemValue $Item 'scope'))
|    if ($sc) { $t = '{0} ({1})' -f $t, $sc }
|    return $t
|}
|
|function ConvertTo-SITagListText {
|    <# PURE. A list of tag entries as ONE text, '; '-joined (ConvertTo-SITagEntryText each); $null when the value is not a
|       non-empty list made only of tag entries (every other value keeps its own form). #>
|    param($Value)
|    if ($null -eq $Value -or $Value -is [string] -or $Value -is [System.Collections.IDictionary] -or -not ($Value -is [System.Collections.IEnumerable])) { return $null }
|    $parts = [System.Collections.Generic.List[string]]::new()
|    foreach ($x in $Value) {
|        if ($null -eq $x) { continue }
|        $t = ConvertTo-SITagEntryText $x
|        if ($null -eq $t) { return $null }
|        $parts.Add($t)
|    }
|    if ($parts.Count -eq 0) { return $null }
|    return ($parts -join '; ')
|}
|
|function Test-SIScalarEqual {
|    param($A, $B)
|    if ($null -eq $A -or $null -eq $B) { return ($null -eq $A -and $null -eq $B) }
|    if ($A -is [bool] -or $B -is [bool]) {
|        $x = ConvertTo-SIBoolOrNull $A; $y = ConvertTo-SIBoolOrNull $B
|        return ($null -ne $x -and $x -eq $y)
|    }
|    $na = $null; $nb = $null
|    if (-not ($A -is [string]) -or -not ($B -is [string])) { $na = ConvertTo-SINumberOrNull $A; $nb = ConvertTo-SINumberOrNull $B }
|    if ($null -ne $na -and $null -ne $nb) { return ($na -eq $nb) }
|    return [string]::Equals(([string]$A).Trim(), ([string]$B).Trim(), [StringComparison]::OrdinalIgnoreCase)
|}
|
|function Test-SIIpInCidr {
|    <# True when the address is inside the CIDR (IPv4 or IPv6). A bare address is a /32 or /128. #>
|    param([string]$Ip, [string]$Cidr)
|    $addr = $null
|    if (-not [System.Net.IPAddress]::TryParse(($Ip -split '/')[0].Trim(), [ref]$addr)) { return $false }
|    $parts = $Cidr.Trim() -split '/'
|    $net = $null
|    if (-not [System.Net.IPAddress]::TryParse($parts[0], [ref]$net)) { return $false }
|    if ($addr.AddressFamily -ne $net.AddressFamily) {
|        if ($addr.IsIPv4MappedToIPv6) { $addr = $addr.MapToIPv4() } else { return $false }
|        if ($addr.AddressFamily -ne $net.AddressFamily) { return $false }
|    }
|    $a = $addr.GetAddressBytes(); $n = $net.GetAddressBytes()
|    $bits = $a.Length * 8
|    if ($parts.Count -gt 1) { $bits = [int]$parts[1] }
|    if ($bits -lt 0 -or $bits -gt $a.Length * 8) { return $false }
|    for ($i = 0; $i -lt $a.Length; $i++) {
|        $take = [Math]::Min(8, [Math]::Max(0, $bits - ($i * 8)))
|        if ($take -eq 0) { break }
|        $mask = [byte]((0xFF -shl (8 - $take)) -band 0xFF)
|        if (($a[$i] -band $mask) -ne ($n[$i] -band $mask)) { return $false }
|    }
|    return $true
|}
|
|function Resolve-SIListValues {
|    <# A "value" that names a list (a string id found in Context.Lists) -> that list's values; otherwise the value itself as a list. #>
|    param($Value, $Context)
|    if ($Value -is [string] -and $Context -and $Context.Lists -and $Context.Lists.ContainsKey($Value)) {
|        $l = $Context.Lists[$Value]
|        $v = Get-SIItemValue $l 'values'
|        return , (Get-SIValueList $v)
|    }
|    return , (Get-SIValueList $Value)
|}
|
|function Get-SIMatchTexts {
|    <# The texts a value is matched as: a tag entry {source, name, value} -> 'name=value', name, value; anything else -> itself. #>
|    param($Value)
|    if ($null -eq $Value) { return }
|    $n = Get-SIItemValue $Value 'name'
|    if ($null -ne $n -and -not ($Value -is [string])) {
|        $v = [string](Get-SIItemValue $Value 'value')
|        if ($v) { '{0}={1}' -f $n, $v }
|        [string]$n
|        if ($v) { $v }
|        return
|    }
|    [string]$Value
|    # #690 (48) an OBJECT value (an Azure role assignment {RoleName, Scope, EffectiveTier ...}) is matched as its compact
|    # JSON as well -- its text form alone is the type name for a dictionary, so no pattern could read its properties
|    if ($Value -is [System.Collections.IDictionary] -or $Value -is [System.Management.Automation.PSCustomObject]) {
|        try { ConvertTo-Json -InputObject $Value -Compress -Depth 4 } catch { }
|    }
|}
|
|# =====================================================================================================================
|#  A LONG LIST IS MATCHED ONCE PER PATTERN, NOT ONCE PER PATTERN AND VALUE (2026-10-13)
|#  A device's installed software is a list of several hundred to a few thousand names, and the device rules test it with
|#  about three thousand name patterns ('like'). Every test built its pattern again and walked the list value by value
|#  through a function call: a device with 1,200 names took MINUTES to classify, and a batch of such devices stood still
|#  for hours without a line in the log (measured on the test VM, tests/pester/SIv3-CiBuildHeavyResources.Tests.ps1).
|#    * a pattern is built once and kept (Get-SIConditionRegex, Get-SIConditionWildcard) -- the same pattern object, so
|#      the same answer;
|#    * a list of 16 values or more is turned into its match texts once per item and field (Get-SIMatchTextList), and
|#    * a wildcard made of plain text and '*' only is answered by ONE search over those texts joined together
|#      (Get-SIWildcardLineRegex). Every other wildcard ('?', '[a-z]', an escape) is matched text by text as before.
|#  The answers are the same as before. One known difference: the joined search compares the lower-case forms of the
|#  texts and the pattern (invariant rules), a wildcard compares letter by letter in the process's culture -- the same for the names SecurityInsight reads (they are
|#  lower-cased when they are mapped; only a culture with its own letter-case rules, such as Turkish, could differ).
|#  Kept per process (a parallel thread has its own): nothing here is shared between threads.
|# =====================================================================================================================
|
|function Get-SIConditionRegex {
|    <# A 'matches' pattern as its Regex (no case, invariant, 200 ms per match), built once. A pattern that is not valid throws, as before. #>
|    param([string]$Pattern)
|    $cache = $script:SIConditionRegexCache
|    if ($null -eq $cache -or $cache.Count -gt 20000) { $cache = New-Object 'System.Collections.Generic.Dictionary[string,object]' ([StringComparer]::Ordinal); $script:SIConditionRegexCache = $cache }
|    $rx = $null
|    if ($cache.TryGetValue($Pattern, [ref]$rx)) { return $rx }
|    $rx = New-Object System.Text.RegularExpressions.Regex($Pattern, ([System.Text.RegularExpressions.RegexOptions]::IgnoreCase -bor [System.Text.RegularExpressions.RegexOptions]::CultureInvariant), ([TimeSpan]::FromMilliseconds(200)))
|    $cache[$Pattern] = $rx
|    return $rx
|}
|
|function Get-SIConditionWildcard {
|    <# A 'like' pattern as its WildcardPattern (no case), built once. #>
|    param([string]$Pattern)
|    $cache = $script:SIConditionWildcardCache
|    if ($null -eq $cache -or $cache.Count -gt 20000) { $cache = New-Object 'System.Collections.Generic.Dictionary[string,object]' ([StringComparer]::Ordinal); $script:SIConditionWildcardCache = $cache }
|    $wc = $null
|    if ($cache.TryGetValue($Pattern, [ref]$wc)) { return $wc }
|    $wc = New-Object System.Management.Automation.WildcardPattern($Pattern, [System.Management.Automation.WildcardOptions]::IgnoreCase)
|    $cache[$Pattern] = $wc
|    return $wc
|}
|
|function Get-SIWildcardLineRegex {
|    <#
|        PURE. A wildcard made of plain text and '*' only -> the Regex that finds a WHOLE text matching it in texts joined
|        with the character U+0001 (also before the first and after the last text); $null for any other wildcard ('?',
|        '[', ']', an escape), which is matched text by text.
|          'sql*'    -> <sep>sql            '*/sql*' -> /sql            'a*b' -> <sep>a[^<sep>]*b<sep>
|    #>
|    param([string]$Pattern)
|    $cache = $script:SIConditionLineCache
|    if ($null -eq $cache -or $cache.Count -gt 20000) { $cache = New-Object 'System.Collections.Generic.Dictionary[string,object]' ([StringComparer]::Ordinal); $script:SIConditionLineCache = $cache }
|    $hit = $null
|    if ($cache.TryGetValue($Pattern, [ref]$hit)) { if ($hit -is [regex]) { return $hit }; return $null }
|    $rx = $null
|    if ($Pattern.IndexOfAny([char[]]@('?', '[', ']', '`', [char]1)) -lt 0) {
|        $sep = '\u0001'
|        # the texts are searched in lower case (Get-SIMatchTextList), so the pattern is lower case too and the search is exact
|        $parts = @($Pattern.ToLowerInvariant().Split('*') | Where-Object { $_ -ne '' } | ForEach-Object { [regex]::Escape($_) })
|        $text = ($parts -join ('[^' + $sep + ']*'))
|        if (-not $Pattern.StartsWith('*')) { $text = $sep + $text }
|        if (-not $Pattern.EndsWith('*')) { $text = $text + $sep }
|        try { $rx = New-Object System.Text.RegularExpressions.Regex($text, [System.Text.RegularExpressions.RegexOptions]::CultureInvariant, ([TimeSpan]::FromSeconds(2))) } catch { $rx = $null }
|    }
|    $cache[$Pattern] = $(if ($null -ne $rx) { $rx } else { $false })
|    return $rx
|}
|
|function Get-SIMatchTextList {
|    <#
|        The match texts of a LONG list value (16 values or more), made once per item and field: @{ Texts (every value's
|        Get-SIMatchTexts, in order); Joined (the texts in lower case joined with U+0001, one before and one after -- $null when a text
|        holds that character) }. $null for anything else (a scalar, a short list): the caller walks it as before.
|        Kept for the last value seen per field, recognised by the list object itself -- a rule set is evaluated item by
|        item, so every rule that reads the field of one item gets the same texts.
|    #>
|    param([string]$Field, $Actual)
|    if ($null -eq $Actual -or $Actual -is [string] -or $Actual -isnot [System.Collections.IList] -or $Actual -is [System.Collections.IDictionary]) { return $null }
|    $n = $Actual.Count
|    if ($n -lt 16) { return $null }
|    $cache = $script:SIConditionTextCache
|    if ($null -eq $cache) { $cache = @{}; $script:SIConditionTextCache = $cache }
|    $e = $cache[$Field]
|    if ($null -ne $e -and [object]::ReferenceEquals($e.Ref, $Actual) -and $e.Count -eq $n) { return $e }
|    $texts = New-Object System.Collections.Generic.List[string]
|    foreach ($v in $Actual) {
|        if ($null -eq $v) { continue }
|        if ($v -is [string]) { $texts.Add($v) } else { foreach ($s in (Get-SIMatchTexts $v)) { $texts.Add([string]$s) } }
|    }
|    $arr = $texts.ToArray()
|    $joined = $null
|    if ($arr.Length -gt 0) {
|        $sep = [string][char]1
|        $body = [string]::Join($sep, $arr)
|        # a text that holds the separator itself cannot be told apart: such a list is matched text by text
|        if ($body.Split([char]1).Length -eq $arr.Length) { $joined = ($sep + $body + $sep).ToLowerInvariant() }
|    }
|    $e = [pscustomobject]@{ Ref = $Actual; Count = $n; Texts = $arr; Joined = $joined }
|    $cache[$Field] = $e
|    return $e
|}
|
|function Get-SIConditionOps { return , @('eq', 'ne', 'in', 'not_in', 'is_true', 'is_false', 'is_empty', 'not_empty', 'gt', 'gte', 'lt', 'lte', 'like',
|        'contains', 'contains_any', 'matches', 'older_than_days', 'newer_than_days', 'in_ranges', 'in_list') }
|
|function Test-SICondition {
|    <#
|    .SYNOPSIS  Evaluates a condition (leaf or all/any group) against an item. Returns $true / $false.
|    #>
|    param([Parameter(Mandatory)]$Condition, $Item, [hashtable]$Context)
|    if ($null -eq $Condition) { return $true }
|    # (2026-10-16, the CI build of a large install: this runs some hundred times for every CI. A dictionary's group / leaf
|    # keys are read with its own Contains, an object's with its properties -- what Get-SIItemValue does, without a function
|    # call each time when the name is there as written. A dictionary has no 'all' / 'any' PROPERTY, so the group test is
|    # the one before.)
|    $isDict = $Condition -is [System.Collections.IDictionary]
|    if ($isDict) { $hasAll = $Condition.Contains('all'); $hasAny = $Condition.Contains('any') }
|    else { $hasAll = [bool]$Condition.PSObject.Properties['all']; $hasAny = [bool]$Condition.PSObject.Properties['any'] }
|    if ($hasAll) {
|        foreach ($c in (Get-SIValueList (Get-SIItemValue $Condition 'all'))) { if (-not (Test-SICondition -Condition $c -Item $Item -Context $Context)) { return $false } }
|        return $true
|    }
|    if ($hasAny) {
|        foreach ($c in (Get-SIValueList (Get-SIItemValue $Condition 'any'))) { if (Test-SICondition -Condition $c -Item $Item -Context $Context) { return $true } }
|        return $false
|    }
|
|    if ($isDict) {
|        if ($Condition.Contains('field')) { $field = [string]$Condition['field'] } else { $field = [string](Get-SIItemValue $Condition 'field') }
|        if ($Condition.Contains('op')) { $op = [string]$Condition['op'] } else { $op = [string](Get-SIItemValue $Condition 'op') }
|        if ($Condition.Contains('value')) { $expected = $Condition['value'] } else { $expected = Get-SIItemValue $Condition 'value' }
|    } else {
|        $pp = $Condition.PSObject.Properties['field']; if ($pp) { $field = [string]$pp.Value } else { $field = '' }
|        $pp = $Condition.PSObject.Properties['op']; if ($pp) { $op = [string]$pp.Value } else { $op = '' }
|        $pp = $Condition.PSObject.Properties['value']; if ($pp) { $expected = $pp.Value } else { $expected = $null }
|    }
|    if ([string]::IsNullOrEmpty($field)) { throw "condition without a field: $($Condition | ConvertTo-Json -Compress -Depth 5)" }
|    if ($Item -is [System.Collections.IDictionary] -and $Item.Contains($field)) { $actual = $Item[$field] } else { $actual = Get-SIItemValue $Item $field }
|
|    # TWO TEXTS ARE COMPARED IN PLACE (2026-10-16, the CI build of a large install): Test-SIScalarEqual compares two texts as
|    # trimmed and without case -- the same comparison is made here without a function call per value pair; every other pair
|    # (a number, a yes / no, an empty value) still goes through Test-SIScalarEqual. Same answers.
|    $ic = [StringComparison]::OrdinalIgnoreCase
|    switch ($op) {
|        'eq' {
|            foreach ($v in (Get-SIValueList $actual)) {
|                if ($v -is [string] -and $expected -is [string]) { if ([string]::Equals($v.Trim(), $expected.Trim(), $ic)) { return $true }; continue }
|                if (Test-SIScalarEqual $v $expected) { return $true }
|            }
|            return $false
|        }
|        'ne' {
|            foreach ($v in (Get-SIValueList $actual)) {
|                if ($v -is [string] -and $expected -is [string]) { if ([string]::Equals($v.Trim(), $expected.Trim(), $ic)) { return $false }; continue }
|                if (Test-SIScalarEqual $v $expected) { return $false }
|            }
|            return (-not (Test-SIValueEmpty $actual))
|        }
|        'in' {
|            $set = Resolve-SIListValues $expected $Context
|            foreach ($v in (Get-SIValueList $actual)) {
|                $vs = $null; if ($v -is [string]) { $vs = $v.Trim() }
|                foreach ($e in $set) {
|                    if ($null -ne $vs -and $e -is [string]) { if ([string]::Equals($vs, $e.Trim(), $ic)) { return $true }; continue }
|                    if (Test-SIScalarEqual $v $e) { return $true }
|                }
|            }
|            return $false
|        }
|        'not_in' {
|            if (Test-SIValueEmpty $actual) { return $false }
|            $set = Resolve-SIListValues $expected $Context
|            foreach ($v in (Get-SIValueList $actual)) {
|                $vs = $null; if ($v -is [string]) { $vs = $v.Trim() }
|                foreach ($e in $set) {
|                    if ($null -ne $vs -and $e -is [string]) { if ([string]::Equals($vs, $e.Trim(), $ic)) { return $false }; continue }
|                    if (Test-SIScalarEqual $v $e) { return $false }
|                }
|            }
|            return $true
|        }
|        'is_true' { return ((ConvertTo-SIBoolOrNull $actual) -eq $true) }
|        'is_false' { $b = ConvertTo-SIBoolOrNull $actual; return ($null -ne $b -and $b -eq $false) }
|        'is_empty' { return (Test-SIValueEmpty $actual) }
|        'not_empty' { return (-not (Test-SIValueEmpty $actual)) }
|        { $_ -in 'gt', 'gte', 'lt', 'lte' } {
|            $e = ConvertTo-SINumberOrNull $expected
|            if ($null -eq $e) { throw "condition '$field $op' needs a number, got '$expected'" }
|            foreach ($v in (Get-SIValueList $actual)) {
|                $n = ConvertTo-SINumberOrNull $v
|                if ($null -eq $n) { continue }
|                $ok = switch ($op) { 'gt' { $n -gt $e } 'gte' { $n -ge $e } 'lt' { $n -lt $e } 'lte' { $n -le $e } }
|                if ($ok) { return $true }
|            }
|            return $false
|        }
|        'contains' {
|            if ($actual -is [string]) { return ($actual.IndexOf([string]$expected, [StringComparison]::OrdinalIgnoreCase) -ge 0) }
|            foreach ($v in (Get-SIValueList $actual)) {
|                if (Test-SIScalarEqual $v $expected) { return $true }
|                $vn = Get-SIItemValue $v 'name'; $vv = Get-SIItemValue $v 'value'          # si_tags entries {source, name, value}
|                if ($null -ne $vn -and ((Test-SIScalarEqual $vn $expected) -or (Test-SIScalarEqual $vv $expected) -or (Test-SIScalarEqual ("{0}={1}" -f $vn, $vv) $expected))) { return $true }
|            }
|            return $false
|        }
|        'contains_any' {
|            $set = Resolve-SIListValues $expected $Context
|            foreach ($v in (Get-SIValueList $actual)) {
|                $vs = $null; if ($v -is [string]) { $vs = $v.Trim() }
|                foreach ($e in $set) {
|                    if ($null -ne $vs -and $e -is [string]) { if ([string]::Equals($vs, $e.Trim(), $ic)) { return $true }; continue }
|                    if (Test-SIScalarEqual $v $e) { return $true }
|                }
|            }
|            return $false
|        }
|        'matches' {
|            # bounded: a pathological pattern times out instead of hanging the run. value = one pattern or a list (any).
|            # A tag entry {source, name, value} is matched as "name=value", as its name and as its value.
|            # A pattern is built once and kept; a long list's match texts are made once per item (Get-SIMatchTextList).
|            $tl = Get-SIMatchTextList $field $actual
|            foreach ($pat in (Get-SIValueList $expected)) {
|                $rx = Get-SIConditionRegex ([string]$pat)
|                if ($null -ne $tl) { foreach ($s in $tl.Texts) { if ($rx.IsMatch($s)) { return $true } } }
|                else { foreach ($v in (Get-SIValueList $actual)) { foreach ($s in (Get-SIMatchTexts $v)) { if ($rx.IsMatch($s)) { return $true } } } }
|            }
|            return $false
|        }
|        'like' {
|            # PowerShell wildcards (* ? [ab]), case-insensitive; value = one pattern or a list (any). Tag entries as in matches.
|            # A pattern is built once and kept. A long list (a device's installed software) is matched ONCE per pattern: a
|            # wildcard of plain text and '*' by one search over the list's texts joined together, any other wildcard text
|            # by text -- never value by value through a function call (see the block above Get-SIConditionRegex).
|            $tl = Get-SIMatchTextList $field $actual
|            foreach ($pat in (Get-SIValueList $expected)) {
|                $p = [string]$pat
|                if ($null -ne $tl) {
|                    if ($tl.Texts.Length -eq 0) { continue }
|                    if ($null -ne $tl.Joined) {
|                        $line = Get-SIWildcardLineRegex $p
|                        if ($null -ne $line) {
|                            $found = $null
|                            try { $found = $line.IsMatch($tl.Joined) } catch { $found = $null }
|                            if ($found -eq $true) { return $true }
|                            if ($found -eq $false) { continue }
|                        }
|                    }
|                    $wc = Get-SIConditionWildcard $p
|                    foreach ($s in $tl.Texts) { if ($wc.IsMatch($s)) { return $true } }
|                    continue
|                }
|                $wc = Get-SIConditionWildcard $p
|                foreach ($v in (Get-SIValueList $actual)) { foreach ($s in (Get-SIMatchTexts $v)) { if ($wc.IsMatch($s)) { return $true } } }
|            }
|            return $false
|        }
|        { $_ -in 'older_than_days', 'newer_than_days' } {
|            $days = ConvertTo-SINumberOrNull $expected
|            if ($null -eq $days) { throw "condition '$field $op' needs a number of days, got '$expected'" }
|            $now = [datetime]::UtcNow
|            if ($Context -and $Context.Now) { $now = ([datetime]$Context.Now).ToUniversalTime() }
|            $t = ConvertTo-SIUtcOrNull $actual
|            if ($null -eq $t) { return $false }
|            $age = ($now - $t).TotalDays
|            if ($op -eq 'older_than_days') { return ($age -gt $days) }
|            return ($age -le $days)
|        }
|        'in_ranges' {
|            $ranges = Resolve-SIListValues $expected $Context
|            foreach ($ip in (Get-SIValueList $actual)) { foreach ($r in $ranges) { if (Test-SIIpInCidr ([string]$ip) ([string]$r)) { return $true } } }
|            return $false
|        }
|        'in_list' {
|            $id = [string]$expected
|            if (-not ($Context -and $Context.Lists -and $Context.Lists.ContainsKey($id))) { throw "condition '$field in_list $id': no such list" }
|            $l = $Context.Lists[$id]
|            $type = [string](Get-SIItemValue $l 'type')
|            if ($type -eq 'conditions') {
|                foreach ($entry in (Get-SIValueList (Get-SIItemValue $l 'entries'))) {
|                    $w = Get-SIItemValue $entry 'when'
|                    # an entry that needs a field the item does not carry is false (Get-SIConditionNullFalseField) -- not evaluated
|                    $rf = Get-SIConditionNullFalseField $w
|                    if ($rf -and $null -eq (Get-SIItemValue $Item $rf)) { continue }
|                    if (Test-SICondition -Condition $w -Item $Item -Context $Context) { return $true }
|                }
|                return $false
|            }
|            foreach ($v in (Get-SIValueList $actual)) { foreach ($e in (Get-SIValueList (Get-SIItemValue $l 'values'))) { if (Test-SIScalarEqual $v $e) { return $true } } }
|            return $false
|        }
|        default { throw "unknown condition operation '$op' (field '$field')" }
|    }
|}
|
|function Get-SIConditionNullFalseField {
|    <#
|        The field that makes a condition FALSE when the item does not carry it (no value at all), or '' when there is none:
|        a leaf -- or the FIRST condition of an 'all' group -- that compares the field (eq, ne, in, not_in, is_true, is_false,
|        not_empty, contains, contains_any, like, in_ranges; matches when its patterns are valid) answers false for no value,
|        and an 'all' stops at its first false. Such a condition need not be evaluated on an item without the field: the
|        answer is the same (2026-10-16: the unsupported_os list's 25 entries were evaluated on every identity). Kept per
|        condition object.
|    #>
|    param($Condition)
|    if ($null -eq $Condition -or $Condition -is [string] -or $Condition -is [ValueType]) { return '' }
|    $cache = $script:SIConditionNullFalseCache
|    if ($null -eq $cache) { $cache = New-Object 'System.Runtime.CompilerServices.ConditionalWeakTable[object,object]'; $script:SIConditionNullFalseCache = $cache }
|    $hit = $null
|    if ($cache.TryGetValue($Condition, [ref]$hit)) { return [string]$hit }
|    $leaf = $Condition
|    $isDict = $Condition -is [System.Collections.IDictionary]
|    if ($isDict) { $hasAll = $Condition.Contains('all'); $hasAny = $Condition.Contains('any') }
|    else { $hasAll = [bool]$Condition.PSObject.Properties['all']; $hasAny = [bool]$Condition.PSObject.Properties['any'] }
|    $field = ''
|    if ($hasAll) {
|        $kids = Get-SIValueList (Get-SIItemValue $Condition 'all')
|        $leaf = $null; if ($kids.Count -gt 0) { $leaf = $kids[0] }
|    } elseif ($hasAny) { $leaf = $null }
|    if ($null -ne $leaf -and $leaf -isnot [string] -and $leaf -isnot [ValueType]) {
|        $lAll = $false; $lAny = $false
|        if ($leaf -is [System.Collections.IDictionary]) { $lAll = $leaf.Contains('all'); $lAny = $leaf.Contains('any') } else { $lAll = [bool]$leaf.PSObject.Properties['all']; $lAny = [bool]$leaf.PSObject.Properties['any'] }
|        if (-not $lAll -and -not $lAny) {
|            $lf = [string](Get-SIItemValue $leaf 'field'); $op = [string](Get-SIItemValue $leaf 'op')
|            if ($lf -and $op -in 'eq', 'ne', 'in', 'not_in', 'is_true', 'is_false', 'not_empty', 'contains', 'contains_any', 'like', 'in_ranges') { $field = $lf }
|            elseif ($lf -and $op -eq 'matches') {
|                $ok = $true
|                try { foreach ($p in (Get-SIValueList (Get-SIItemValue $leaf 'value'))) { $null = Get-SIConditionRegex ([string]$p) } } catch { $ok = $false }
|                if ($ok) { $field = $lf }
|            }
|        }
|    }
|    try { $cache.Add($Condition, $field) } catch { }
|    return $field
|}
|
|function Test-SIConditionTri {
|    <#
|    .SYNOPSIS  #546 UNKNOWN IS NEVER A FINDING. A condition evaluated in THREE states: $true, $false, or $null = unknown.
|               A leaf is unknown when
|                 * its field is in -UnknownFields (the CI build could not decide the field: the provider that decides it for
|                   this identity's origin is not linked -- si_unknown_fields), or
|                 * it compares a date or a number (older_than_days, newer_than_days, gt, gte, lt, lte) and the value is empty:
|                   an age that was never read is not "older than 365 days".
|               Every other leaf is Test-SICondition (so an empty value in a population leaf -- in, eq -- stays false: the
|               item is simply not in the population). all: any false -> false, else any unknown -> unknown, else true.
|               any: any true -> true, else any unknown -> unknown, else false.
|               A caller counts a finding ONLY on $true; $null is counted as unknown.
|    #>
|    param([Parameter(Mandatory)]$Condition, $Item, [hashtable]$Context, [string[]]$UnknownFields = @())
|    if ($null -eq $Condition) { return $true }
|    # (the group test as in Test-SICondition: a dictionary's own Contains, an object's properties)
|    $isDict = $Condition -is [System.Collections.IDictionary]
|    if ($isDict) { $hasAll = $Condition.Contains('all'); $hasAny = $Condition.Contains('any') }
|    else { $hasAll = [bool]$Condition.PSObject.Properties['all']; $hasAny = [bool]$Condition.PSObject.Properties['any'] }
|    if ($hasAll) {
|        $unknown = $false
|        foreach ($c in (Get-SIValueList (Get-SIItemValue $Condition 'all'))) {
|            $r = Test-SIConditionTri -Condition $c -Item $Item -Context $Context -UnknownFields $UnknownFields
|            if ($r -eq $false) { return $false }
|            if ($null -eq $r) { $unknown = $true }
|        }
|        if ($unknown) { return $null }
|        return $true
|    }
|    if ($hasAny) {
|        $unknown = $false
|        foreach ($c in (Get-SIValueList (Get-SIItemValue $Condition 'any'))) {
|            $r = Test-SIConditionTri -Condition $c -Item $Item -Context $Context -UnknownFields $UnknownFields
|            if ($r -eq $true) { return $true }
|            if ($null -eq $r) { $unknown = $true }
|        }
|        if ($unknown) { return $null }
|        return $false
|    }
|    if ($isDict) {
|        if ($Condition.Contains('field')) { $field = [string]$Condition['field'] } else { $field = [string](Get-SIItemValue $Condition 'field') }
|        if ($Condition.Contains('op')) { $op = [string]$Condition['op'] } else { $op = [string](Get-SIItemValue $Condition 'op') }
|    } else {
|        $pp = $Condition.PSObject.Properties['field']; if ($pp) { $field = [string]$pp.Value } else { $field = '' }
|        $pp = $Condition.PSObject.Properties['op']; if ($pp) { $op = [string]$pp.Value } else { $op = '' }
|    }
|    foreach ($u in @($UnknownFields)) { if ($u -and [string]::Equals([string]$u, $field, [StringComparison]::OrdinalIgnoreCase)) { return $null } }
|    # A FIELD THE ITEM DOES NOT CARRY AT ALL (no value) is answered here, without a second evaluation (2026-10-16: most
|    # factor and classification leaves read a field the CI does not have) -- the answers Test-SICondition gives for $null:
|    # a comparison, a text or list test is false, is_empty is true, a date / number test is unknown (below). in_list,
|    # matches (an invalid pattern throws even on no value) and anything else are evaluated as before.
|    if ($field) {
|        if ($Item -is [System.Collections.IDictionary] -and $Item.Contains($field)) { $av = $Item[$field] } else { $av = Get-SIItemValue $Item $field }
|        if ($null -eq $av) {
|            if ($op -in 'eq', 'ne', 'in', 'not_in', 'is_true', 'is_false', 'not_empty', 'contains', 'contains_any', 'like', 'in_ranges') { return $false }
|            # matches: false too when its patterns are valid (an invalid one throws, as before)
|            if ($op -eq 'matches' -and (Get-SIConditionNullFalseField $Condition) -ceq $field) { return $false }
|            if ($op -eq 'is_empty') { return $true }
|            if ($op -in 'older_than_days', 'newer_than_days', 'gt', 'gte', 'lt', 'lte') { return $null }
|        }
|    }
|    if ($op -in 'older_than_days', 'newer_than_days', 'gt', 'gte', 'lt', 'lte') {
|        if (Test-SIValueEmpty (Get-SIItemValue $Item $field)) { return $null }
|    }
|    return [bool](Test-SICondition -Condition $Condition -Item $Item -Context $Context)
|}
|
|function Get-SIConditionFields {
|    <# Every field name a condition reads (for template validation). #>
|    param($Condition)
|    $out = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Condition) { return $out.ToArray() }
|    foreach ($k in 'all', 'any') {
|        $g = Get-SIItemValue $Condition $k
|        if ($null -ne $g -or (($Condition -is [System.Collections.IDictionary] -and $Condition.Contains($k)) -or $Condition.PSObject.Properties[$k])) {
|            foreach ($c in (Get-SIValueList $g)) { foreach ($f in (Get-SIConditionFields $c)) { $out.Add($f) } }
|            return $out.ToArray()
|        }
|    }
|    $f = [string](Get-SIItemValue $Condition 'field')
|    if ($f) { $out.Add($f) }
|    return $out.ToArray()
|}
'@ }
$__siSupportFiles['engine/data-model/SI-FieldResolution.ps1'] = @{ Sha256 = '7322f94eb50e97deb3f3f8da3e1ed213814a5eaadf7967d4ae5ebed72683b8b5'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight SOURCE OF TRUTH BY PROVIDER TIMESTAMPS -- REQUIREMENTS #459, V3-DATA-MODEL 2.6.
|
|    Resolve-SICiField (SI-CiBuild.ps1) picks each SI field's value on the CI: fresh candidates only (the record's provider
|    timestamp -- the mapping object's 'timestamp', si_source_last_seen -- within the field's staleDays), then the first
|    provider in the field's authority order; no fresh candidate -> the newest value, marked stale; risk booleans any-true;
|    lists union. The winner is recorded in si_field_sources {provider, record, observed_at, stale}.
|
|    This file adds what 2.6 asks for beyond the winner: CONFLICTS. When other FRESH providers hold a different value for a
|    single-value (authority) field, they are recorded beside the winner (si_field_sources.<field>.conflicts), so a
|    disagreement is visible on the CI page instead of silently lost -- "AD still says 10.0.0.5, Defender says 10.0.4.17".
|    It never changes the value.
|
|    Each provider's "last updated" field (the mapping object's timestamp; a missing value = the collection time):
|      mde     machine.lastSeen                          (sensor heartbeat)
|      entra   device.approximateLastSignInDateTime      (devices; users and service principals: the directory read)
|      intune  device.lastSyncDateTime
|      eg      node.NodeProperties.rawData.lastSeen
|      ad      lastLogonTimestamp                        (replicates with a 9-14 day lag)
|      mdi     identity.Timestamp
|      azure   the collection time                       (Resource Graph has no last seen)
|      shodan  host.last_update
|      cmdb    ci.UpdatedAt;  servicenow  ci.sys_updated_on
|    Get-SIProviderTimestampFields reads them from the mappings (the mappings are the one source).
|
|    PURE. PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Get-SIItemValue -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|
|$script:SIFieldConflictMax = 5
|
|function Get-SIProviderTimestampFields {
|    <# PURE. Per provider and record type: the source path of its "last updated" timestamp ('$collection_time' = none). #>
|    param([Parameter(Mandatory)]$Model)
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($p in $Model.Mappings.Keys) {
|        foreach ($o in @($Model.Mappings[$p].objects)) {
|            if ($null -eq $o) { continue }
|            $out.Add([pscustomobject]@{ Provider = [string]$p; RecordType = [string]$o.recordType; Timestamp = [string]$o.timestamp })
|        }
|    }
|    return $out.ToArray()   # unrolled: foreach and @() both read it as the list
|}
|
|function ConvertTo-SIFieldCompareText {
|    <# PURE. A value as comparable text: trimmed, case-insensitive; a list as its sorted, de-duplicated items. #>
|    param($Value)
|    if ($null -eq $Value) { return '' }
|    if ($Value -is [bool]) { return ([string]$Value).ToLowerInvariant() }
|    if ($Value -is [datetime]) { return $Value.ToUniversalTime().ToString('o') }
|    if ($Value -is [string]) { return $Value.Trim().ToLowerInvariant() }
|    if ($Value -is [System.Collections.IEnumerable] -and -not ($Value -is [System.Collections.IDictionary])) {
|        $xs = [string[]]@(foreach ($x in $Value) { ConvertTo-SIFieldCompareText $x } )
|        $xs = [string[]]@($xs | Where-Object { $_ } | Select-Object -Unique)
|        [Array]::Sort($xs, [StringComparer]::Ordinal)
|        return ($xs -join '|')
|    }
|    if ($Value -is [ValueType]) { return ([string]::Format([Globalization.CultureInfo]::InvariantCulture, '{0}', $Value)).ToLowerInvariant() }
|    return (($Value | ConvertTo-Json -Compress -Depth 6)).ToLowerInvariant()
|}
|
|function Get-SICiFieldConflicts {
|    <#
|    .SYNOPSIS  PURE. The fresh candidates of a single-value (authority) field that disagree with the resolved value.
|    .PARAMETER Candidates  as Resolve-SICiField takes them: @{ Record; Provider; Key; State }
|    .PARAMETER Resolved    Resolve-SICiField's result (@{ Value; Provider; Record; Stale })
|    .OUTPUTS   [ [ordered]@{ provider; record; value; observed_at } ] -- at most 5, freshest first; empty when the field
|               is not an authority field, the value is stale (nothing fresh to disagree with) or every source agrees.
|    #>
|    param([Parameter(Mandatory)]$Field, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Candidates, $Resolved, [datetime]$Now = [datetime]::UtcNow)
|    $out = New-Object System.Collections.Generic.List[object]
|    if ($null -eq $Resolved -or [bool]$Resolved.Stale) { return , $out.ToArray() }
|    if ([string]$Field.resolution.policy -ne 'authority') { return , $out.ToArray() }
|    $staleDays = 30
|    if ($null -ne $Field.resolution.staleDays) { $staleDays = [double]$Field.resolution.staleDays }
|    # (2026-10-16: the winner's text is made only when another candidate has to be compared with it -- most CIs have one
|    # record, and this runs for every field of every CI)
|    $other = $false
|    foreach ($c in $Candidates) { if ($null -ne $c -and [string]$c.Key -ne [string]$Resolved.Record) { $other = $true; break } }
|    if (-not $other) { return , $out.ToArray() }
|    $win = ConvertTo-SIFieldCompareText $Resolved.Value
|    $seenText = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::Ordinal)
|    $rows = New-Object System.Collections.Generic.List[object]
|    foreach ($c in $Candidates) {
|        if ($null -eq $c -or [string]$c.Key -eq [string]$Resolved.Record) { continue }
|        $v = Get-SIItemValue $c.Record ([string]$Field.name)
|        if (Test-SIValueEmpty $v) { if (-not ($v -is [bool])) { continue } }
|        $seen = ConvertTo-SIUtcOrNull (Get-SIItemValue $c.Record 'si_source_last_seen')
|        $fresh = ($c.State -in 'active', 'frozen') -and ($null -ne $seen) -and ((($Now - $seen).TotalDays) -le $staleDays)
|        if (-not $fresh) { continue }
|        $t = ConvertTo-SIFieldCompareText $v
|        if ($t -eq $win) { continue }
|        $rows.Add([pscustomobject]@{ Seen = $seen; Text = $t; Entry = [ordered]@{ provider = [string]$c.Provider; record = [string]$c.Key; value = $v; observed_at = $seen } })
|    }
|    foreach ($r in @($rows.ToArray() | Sort-Object -Property @{ Expression = { $_.Seen }; Descending = $true })) {
|        if ($out.Count -ge $script:SIFieldConflictMax) { break }
|        if (-not $seenText.Add(('{0}|{1}' -f $r.Entry.provider, $r.Text))) { continue }
|        $out.Add($r.Entry)
|    }
|    return , $out.ToArray()
|}
'@ }
$__siSupportFiles['engine/data-model/SI-CiLifecycle.ps1'] = @{ Sha256 = '69bd83af6a1b63a7789761c22b020f3032c232a4d528287a81e834bb043a7fd4'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE ASSET LIFECYCLE, ONE MECHANISM (V3-DATA-MODEL 2.5.5, REQUIREMENTS #406, 60.5.0c / 60.5.0d).
|
|    Owner 2026-10-06, verbatim: "14 day is not sufficient and auto-close graceperiod must be in the settings. for example a
|    person on summer vacation for 5 weeks will then be closed as his laptop is turned off after 14 days (wrong). ... default
|    auto close value should be 30 days but with option to override in the categories i listed".
|    Owner 2026-10-19: "we have already defined the lifecycle in the docs for design, read the req there. read also the code
|    of the actual impl." -- the core CI now carries the lifecycle the CMDB sync had alone.
|
|    The PURE parts both users share -- the CI build (SI-CiBuild.ps1, every edition) and the CMDB sync's asset lifecycle
|    (engine\asset-cmdb\_shared\SI-AssetLifecycle.ps1, Pro): the categories and their grace periods (the settings), the
|    seen window, the state LastSeen alone gives, a CI's category, and the CI lifecycle decision over its linked objects.
|
|    PER LINKED OBJECT (decided by Get-SIRecordLinkState, SI-CiBuild.ps1):
|        active    listed in its feed's newest collection, and -- a DEVICE record, whose source keeps listing a machine it has
|                  not heard from (Defender lists inactive devices) -- its source saw it within the seen window
|        not_seen  missing from a COMPLETE newer collection, or listed but its source has not seen it within the seen window
|        gone      POSITIVE evidence: offboarded
|        frozen    the newer collection was partial, or the provider's collection scope changed since the record was last
|                  listed (60.5.0d: an asset that leaves because we stopped looking has told us nothing) -- nothing changes
|    PER CI (Get-SICiLifecycle):
|        active    any link active
|        not_seen  no link active, newest last seen within the grace period of the CI's category
|        retired   beyond the grace period, or at once when EVERY link is gone; stays retired until a link is active again
|        reactivated (a transition, not a state): active again after not_seen / retired -- the reason says so
|        a CI whose only current links are frozen is active (absence proves nothing); one already retired stays retired
|    PowerShell 5.1: no ?. / ??, no ternary. No Set-StrictMode.
|#>
|
|$script:SIAssetRetireCategorySettings = [ordered]@{
|    'client-pc'         = 'SI_Pro_AssetRetire_GraceDays_ClientPc'
|    'server'            = 'SI_Pro_AssetRetire_GraceDays_Server'
|    'service-principal' = 'SI_Pro_AssetRetire_GraceDays_ServicePrincipal'
|    'user'              = 'SI_Pro_AssetRetire_GraceDays_User'
|    'azure-vm'          = 'SI_Pro_AssetRetire_GraceDays_AzureVm'
|    'azure-resource'    = 'SI_Pro_AssetRetire_GraceDays_AzureResource'
|}
|
|# a source whose own "last seen" lags by design (V3-DATA-MODEL 2.6): Entra updates approximateLastSignInDateTime at most every
|# ~14 days, AD replicates lastLogonTimestamp with a 9-14 day lag -- a device record of theirs is stale only past that lag
|$script:SICiProviderSeenLagDays = @{ entra = 14; ad = 14 }
|
|# =====================================================================================================================
|#  SETTINGS AND CATEGORIES -- pure
|# =====================================================================================================================
|function Resolve-SIAssetRetireSettings {
|    <#
|        PURE. The grace periods from a name -> value map (the live globals):
|          SI_Pro_AssetRetire_GraceDays                 default 30 -- every category without its own value, and 'other'
|          SI_Pro_AssetRetire_GraceDays_<Category>      a category's own value (ClientPc, Server, ServicePrincipal, User, AzureVm, AzureResource)
|          SI_Pro_CmdbSql_SeenWithinDays                default 8 -- seen this recently = active
|          SI_Cmdb_RetireAfterDays                      default 7 -- the CI retire brake (owner 2026-10-11): the floor of every grace period
|        A grace period shorter than the seen window would retire an asset the moment it is "not seen": it is raised to the
|        seen window (or SI_Cmdb_RetireAfterDays when that is longer) and the warning says so. A value that is not a whole
|        number uses the default and says so.
|        Returns @{ DefaultDays; Days (category -> days, 'other' included); SeenWithinDays; RetireAfterDays; Warnings }.
|    #>
|    param([hashtable]$Globals = @{})
|    if ($null -eq $Globals) { $Globals = @{} }
|    $warn = New-Object System.Collections.Generic.List[string]
|    $int = {
|        param([string]$name, [int]$default, [int]$min)
|        if (-not $Globals.ContainsKey($name) -or $null -eq $Globals[$name] -or "$($Globals[$name])".Trim() -eq '') { return $default }
|        $n = 0
|        if (-not [int]::TryParse("$($Globals[$name])".Trim(), [Globalization.NumberStyles]::Integer, [Globalization.CultureInfo]::InvariantCulture, [ref]$n)) {
|            $warn.Add(("{0} = '{1}' is not a whole number of days -- using {2}." -f $name, "$($Globals[$name])", $default)); return $default
|        }
|        if ($n -lt $min) { $warn.Add(("{0} = {1} is shorter than the minimum of {2} day(s) (the seen window, never under SI_Cmdb_RetireAfterDays) -- using {2}." -f $name, $n, $min)); return $min }
|        $n
|    }
|    $seen = & $int 'SI_Pro_CmdbSql_SeenWithinDays' 8 1
|    # the CI retire brake (owner 2026-10-11): no grace period is shorter than SI_Cmdb_RetireAfterDays (default 7), whatever the
|    # seen window -- an asset is never retired before it has been unseen that long
|    $retireDays = & $int 'SI_Cmdb_RetireAfterDays' 7 1
|    $floor = [Math]::Max($seen, $retireDays)
|    $def = [Math]::Max((& $int 'SI_Pro_AssetRetire_GraceDays' 30 $floor), $floor)
|    $days = [ordered]@{}
|    foreach ($c in @($script:SIAssetRetireCategorySettings.Keys)) { $days[$c] = & $int ([string]$script:SIAssetRetireCategorySettings[$c]) $def $floor }
|    $days['other'] = $def
|    [pscustomobject]@{ DefaultDays = $def; Days = $days; SeenWithinDays = $seen; RetireAfterDays = $retireDays; Warnings = $warn.ToArray() }
|}
|
|function Get-SICiLifecycleSettings {
|    <#
|        The lifecycle settings as they are in force: Resolve-SIAssetRetireSettings over the live globals (the Pro settings
|        store loads them; an edition without them gets the defaults: seen within 8 days, every grace period 30 days).
|        -Globals: a name -> value map instead (tests).
|    #>
|    param([hashtable]$Globals)
|    if ($null -eq $Globals) {
|        $Globals = @{}
|        $names = @('SI_Pro_CmdbSql_SeenWithinDays', 'SI_Cmdb_RetireAfterDays', 'SI_Pro_AssetRetire_GraceDays') + @($script:SIAssetRetireCategorySettings.Values)
|        foreach ($n in $names) { $v = Get-Variable -Scope Global -Name $n -ValueOnly -ErrorAction SilentlyContinue; if ($null -ne $v) { $Globals[$n] = $v } }
|    }
|    Resolve-SIAssetRetireSettings -Globals $Globals
|}
|
|function Get-SIAssetRetireCategory {
|    <#
|        PURE. The retire category of one CI from what the hand-off knows of it: its kind (endpoint | azure | identity), class
|        hint, proposed ServiceNow class and ARM id. An Azure VM is an azure-vm whichever profile describes it (Defender's
|        record of a VM comes first in the hand-off). Unknown = 'other' (the default grace period).
|    #>
|    param([AllowEmptyString()][string]$Kind = '', [AllowEmptyString()][string]$ClassHint = '', [AllowEmptyString()][string]$ProposedClass = '',
|          [AllowEmptyString()][string]$AzureResourceId = '')
|    $k = ([string]$Kind).Trim().ToLowerInvariant(); $h = ([string]$ClassHint).Trim().ToLowerInvariant(); $pc = ([string]$ProposedClass).Trim().ToLowerInvariant()
|    $arm = ([string]$AzureResourceId).Trim().ToLowerInvariant()
|    if ($pc -eq 'cmdb_ci_vm_instance' -or $arm -match '/providers/microsoft\.compute/virtualmachines(scalesets)?/') { return 'azure-vm' }
|    if ($pc -eq 'u_cmdb_ci_entra_user') { return 'user' }
|    if ($pc -eq 'u_cmdb_ci_entra_service_principal') { return 'service-principal' }
|    if ($h -eq 'identity' -or $k -eq 'identity') { return 'other' }
|    if ($pc -in 'cmdb_ci_win_server', 'cmdb_ci_linux_server', 'cmdb_ci_server') { return 'server' }
|    if ($h -eq 'azure-resource' -or $k -eq 'azure') { return 'azure-resource' }
|    if ($pc -eq 'cmdb_ci_computer' -or $h -eq 'device' -or $k -eq 'endpoint') { return 'client-pc' }
|    'other'
|}
|
|function Get-SIAssetLifecycleTarget {
|    <# PURE. The state LastSeen alone gives: active (within the seen window) | not-seen (within the grace) | retired. #>
|    param([Parameter(Mandatory)][datetime]$LastSeen, [Parameter(Mandatory)][datetime]$Now, [int]$SeenWithinDays = 8, [int]$GraceDays = 30)
|    $age = ($Now.ToUniversalTime() - $LastSeen.ToUniversalTime()).TotalDays
|    if ($age -le $SeenWithinDays) { return 'active' }
|    if ($age -le $GraceDays) { return 'not-seen' }
|    'retired'
|}
|
|function Get-SILifecycleValue {
|    <# PURE. A named value of a dictionary or an object ($null when it has none). #>
|    param($Item, [string]$Name)
|    if ($null -eq $Item) { return $null }
|    if ($Item -is [System.Collections.IDictionary]) { if ($Item.Contains($Name)) { return $Item[$Name] }; return $null }
|    $p = $Item.PSObject.Properties[$Name]; if ($p) { return $p.Value }
|    $null
|}
|
|function Get-SICiRetireCategory {
|    <#
|        PURE. The retire category of a CORE CI (the same categories and the same Get-SIAssetRetireCategory decision the CMDB
|        sync uses), from its class, its fields and its linked objects:
|          an Azure virtual machine (scale set) link       azure-vm  (also when Defender describes it)
|          a device whose OS is a server OS, or an Arc one server    -- any other device: client-pc
|          an identity with a service principal link       service-principal  -- with a user link: user
|          a cloud resource with an Azure link             azure-resource     -- anything else: other
|    #>
|    param([Parameter(Mandatory)]$Ci, [AllowEmptyCollection()][object[]]$Links = @())
|    $class = [string](Get-SILifecycleValue $Ci 'si_class')
|    $arm = ''
|    foreach ($l in @($Links)) {
|        if ($null -eq $l) { continue }
|        $id = [string](Get-SILifecycleValue $l 'id')
|        if ([string](Get-SILifecycleValue $l 'provider') -in 'azure', 'mdc' -and $id -match '^/subscriptions/') {
|            if (-not $arm -or $id -match '/providers/microsoft\.compute/virtualmachines(scalesets)?/') { $arm = $id }
|        }
|    }
|    switch ($class) {
|        'device' {
|            $os = ('{0} {1} {2}' -f (Get-SILifecycleValue $Ci 'si_os_name'), (Get-SILifecycleValue $Ci 'si_os_platform'), (Get-SILifecycleValue $Ci 'si_device_category')).ToLowerInvariant()
|            $pc = 'cmdb_ci_computer'
|            if ($os -match 'server' -or [string](Get-SILifecycleValue $Ci 'si_arc_status')) { $pc = 'cmdb_ci_server' }
|            return (Get-SIAssetRetireCategory -Kind 'endpoint' -ClassHint 'device' -ProposedClass $pc -AzureResourceId $arm)
|        }
|        'identity' {
|            $types = @(foreach ($l in @($Links)) { if ($l) { [string](Get-SILifecycleValue $l 'type') } })
|            if ($types -contains 'service_principal') { return (Get-SIAssetRetireCategory -Kind 'identity' -ProposedClass 'u_cmdb_ci_entra_service_principal') }
|            if ($types -contains 'user') { return (Get-SIAssetRetireCategory -Kind 'identity' -ProposedClass 'u_cmdb_ci_entra_user') }
|            return 'other'
|        }
|        'cloud_resource' {
|            if ($arm) { return (Get-SIAssetRetireCategory -Kind 'azure' -ClassHint 'azure-resource' -AzureResourceId $arm) }
|            return 'other'
|        }
|        default { return 'other' }
|    }
|}
|
|function Get-SIRecordSeenWindowDays {
|    <#
|        PURE. How long a record may go without its source seeing it before its link is not_seen, or 0 when the record's
|        listing alone decides: only a DEVICE record carries a source heartbeat that its source keeps listing past (Defender
|        lists a machine it has not heard from for months). An identity listed by Entra exists (a dormant account is a risk
|        to report, never an asset to retire), and a cloud resource listed by Azure Resource Graph exists (ARM existence).
|        A source whose last seen lags by design gets that lag (Entra devices, AD computers: 14 days).
|    #>
|    param($Record, [int]$SeenWithinDays = 8)
|    if ($SeenWithinDays -le 0 -or $null -eq $Record) { return 0 }
|    # EXPOSURE GRAPH AGES OUT (owner 2026-11-05, "ci object must be the stable id"): an Exposure Graph record of ANY class
|    # gets the seen window. Exposure Graph keeps LISTING nodes long after the asset is gone (a ring 1 install, 2026-11-05: a
|    # VM's old node ids stayed in ExposureGraphNodes for weeks; 13 CIs were kept active by Exposure Graph alone, unseen
|    # 14+ days). Listed is not "exists" for Exposure Graph -- its node's own observation time is the evidence:
|    # si_source_last_seen = the mapping's timestamp node.NodeProperties.rawData.lastSeen (eg.locked.json). On a VM node
|    # (azure_resource) it is the asset's observation (the stale node of mail-host-03 carried 2026-10-06 while still listed
|    # on 2026-11-03); on a device node it follows Exposure Graph's own refresh (2026-11-03 on every listed device), which is
|    # why an Exposure Graph link never decides a CI that another source links (Get-SICiLifecycle). Azure Resource Graph
|    # (provider azure) keeps "listed = exists".
|    # NOT an identity: a dormant account is a risk to report, never an asset to retire (the design's identity rule) -- an
|    # account Exposure Graph alone lists keeps 'listed = exists'
|    if ([string](Get-SILifecycleValue $Record 'si_provider') -eq 'eg' -and [string](Get-SILifecycleValue $Record 'si_class') -ne 'identity') { return $SeenWithinDays }
|    if ([string](Get-SILifecycleValue $Record 'si_class') -ne 'device') { return 0 }
|    $lag = $script:SICiProviderSeenLagDays[[string](Get-SILifecycleValue $Record 'si_provider')]
|    if ($lag -and [int]$lag -gt $SeenWithinDays) { return [int]$lag }
|    $SeenWithinDays
|}
|
|function Get-SICiSeenThresholdDays {
|    <# PURE. Every day count a CI's lifecycle can cross with time alone (the seen windows, every grace period) -- the CI build's time thresholds. #>
|    param([Parameter(Mandatory)]$Settings)
|    $out = New-Object System.Collections.Generic.List[int]
|    $add = { param([int]$d) if ($d -gt 0 -and -not $out.Contains($d)) { $out.Add($d) } }
|    & $add ([int]$Settings.SeenWithinDays)
|    foreach ($v in @($script:SICiProviderSeenLagDays.Values)) { & $add ([Math]::Max([int]$v, [int]$Settings.SeenWithinDays)) }
|    foreach ($k in @($Settings.Days.Keys)) { & $add ([int]$Settings.Days[$k]) }
|    & $add ([int]$Settings.DefaultDays)
|    $arr = $out.ToArray(); [Array]::Sort($arr); $arr
|}
|
|# =====================================================================================================================
|#  THE COLLECTION SCOPE (60.5.0d) -- pure
|# =====================================================================================================================
|# the settings that narrow what a provider LISTS (a change of one makes assets vanish from a complete run)
|$script:SICiCollectionScopeSettings = [ordered]@{
|    azure  = @('SI_AzSubscriptionId', 'SI_AzureExcludeTypes', 'SI_AzureSubscriptionExcludePatterns')
|    mdc    = @('SI_AzSubscriptionId', 'SI_AzureExcludeTypes', 'SI_AzureSubscriptionExcludePatterns')
|    entra  = @('SI_IncludeFirstPartySpns', 'SI_DisabledAssets_Collect')
|    mde    = @('SI_DisabledAssets_Collect')
|    intune = @('SI_DisabledAssets_Collect')
|    ad     = @('SI_DisabledAssets_Collect')
|    eg     = @('SI_DisabledAssets_Collect')
|    mdi    = @('SI_DisabledAssets_Collect')
|}
|
|function Get-SICiCollectionScope {
|    <#
|        PURE. The effective collection scope per provider: provider -> a hash of the scope settings' values (name=value, in
|        order; a list joined). -Globals: name -> value (default: the live globals).
|    #>
|    param([hashtable]$Globals)
|    $out = [ordered]@{}
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try {
|        foreach ($p in @($script:SICiCollectionScopeSettings.Keys)) {
|            $parts = foreach ($n in @($script:SICiCollectionScopeSettings[$p])) {
|                $v = $null
|                if ($null -ne $Globals) { if ($Globals.ContainsKey($n)) { $v = $Globals[$n] } }
|                else { $v = Get-Variable -Scope Global -Name $n -ValueOnly -ErrorAction SilentlyContinue }
|                $t = if ($null -eq $v) { '' } elseif ($v -is [string]) { $v.Trim() } elseif ($v -is [System.Collections.IEnumerable]) { (@($v) | ForEach-Object { ([string]$_).Trim() } | Sort-Object) -join ',' } else { ([string]$v).Trim() }
|                '{0}={1}' -f $n, $t
|            }
|            $bytes = [System.Text.Encoding]::UTF8.GetBytes((@($parts) -join "`n"))
|            $out[$p] = ([BitConverter]::ToString($sha.ComputeHash($bytes)) -replace '-', '').ToLowerInvariant()
|        }
|    } finally { $sha.Dispose() }
|    $out
|}
|
|function Update-SICiScopeChanges {
|    <#
|        PURE. The collection scope compared with the one the last build recorded: provider -> the time its scope last changed.
|        -Stored: the recorded state (provider -> @{ h; at }); -Current: Get-SICiCollectionScope; -Now. A provider seen for the
|        first time records its scope (nothing changed). Returns @{ State (provider -> @{ h; at }, to record); ChangedAt
|        (provider -> datetime, every provider whose scope ever changed); Changed (the providers that changed in THIS build) }.
|    #>
|    param([hashtable]$Stored = @{}, [Parameter(Mandatory)]$Current, [datetime]$Now = [datetime]::UtcNow)
|    if ($null -eq $Stored) { $Stored = @{} }
|    $state = [ordered]@{}; $at = @{}; $chg = New-Object System.Collections.Generic.List[string]
|    foreach ($p in @($Current.Keys)) {
|        $h = [string]$Current[$p]
|        $prev = $Stored[$p]
|        $ph = [string](Get-SILifecycleValue $prev 'h'); $pa = Get-SILifecycleValue $prev 'at'
|        $paT = $null
|        if ($pa -is [datetime]) { $paT = ([datetime]$pa).ToUniversalTime() } elseif ($pa) { $d = [datetime]::MinValue; if ([datetime]::TryParse([string]$pa, [Globalization.CultureInfo]::InvariantCulture, ([Globalization.DateTimeStyles]::AssumeUniversal -bor [Globalization.DateTimeStyles]::AdjustToUniversal), [ref]$d)) { $paT = $d } }
|        if (-not $ph) { $state[$p] = [ordered]@{ h = $h; at = $(if ($paT) { $paT.ToString('o') } else { '' }) } }
|        elseif ($ph -ne $h) { $state[$p] = [ordered]@{ h = $h; at = $Now.ToUniversalTime().ToString('o') }; $chg.Add($p); $paT = $Now.ToUniversalTime() }
|        else { $state[$p] = [ordered]@{ h = $h; at = $(if ($paT) { $paT.ToString('o') } else { '' }) } }
|        if ($paT) { $at[$p] = $paT }
|    }
|    [pscustomobject]@{ State = $state; ChangedAt = $at; Changed = $chg.ToArray() }
|}
|
|# =====================================================================================================================
|#  THE CI LIFECYCLE -- pure
|# =====================================================================================================================
|function Get-SICiLifecycle {
|    <#
|        PURE. A CI's lifecycle from its linked objects (the record links: provider, type, state, last_seen, reason).
|          -Category  Get-SICiRetireCategory      -Settings  Get-SICiLifecycleSettings      -Now  the build's time
|          -Previous  what the CI was after the last build: @{ Lifecycle; Since; Reason } (none = a first build)
|        Returns @{ Lifecycle (active | not_seen | retired); Since; NotSeenDays; Reason; Change ('' | not_seen | retired |
|        reactivated | held); LastSeen; GraceDays; Category }.
|          Since    active: when it became active (kept from the last build while it stays active) -- not_seen: the last time
|                   any source saw it -- retired: when its grace period ran out, or when the last link was gone
|          Reason   the evidence, in words (dates only, so it changes only with the state)
|    #>
|    param([AllowEmptyCollection()][object[]]$Links = @(), [string]$Category = 'other', [Parameter(Mandatory)]$Settings,
|          [datetime]$Now = [datetime]::UtcNow, $Previous)
|    $now = $Now.ToUniversalTime()
|    $cat = if ($Category) { $Category } else { 'other' }
|    $grace = [int]$Settings.DefaultDays; if ($Settings.Days.Contains($cat)) { $grace = [int]$Settings.Days[$cat] }
|    $prevState = [string](Get-SILifecycleValue $Previous 'Lifecycle')
|    $prevSince = Get-SILifecycleValue $Previous 'Since'
|    if ($prevSince -and -not ($prevSince -is [datetime])) { $d = [datetime]::MinValue; if ([datetime]::TryParse([string]$prevSince, [Globalization.CultureInfo]::InvariantCulture, ([Globalization.DateTimeStyles]::AssumeUniversal -bor [Globalization.DateTimeStyles]::AdjustToUniversal), [ref]$d)) { $prevSince = $d } else { $prevSince = $null } }
|    $prevReason = [string](Get-SILifecycleValue $Previous 'Reason')
|    $active = New-Object System.Collections.Generic.List[object]; $frozen = New-Object System.Collections.Generic.List[object]
|    $notSeen = New-Object System.Collections.Generic.List[object]; $gone = New-Object System.Collections.Generic.List[object]
|    # EXPOSURE GRAPH NEVER OUTVOTES THE SOURCE IT MIRRORS (owner 2026-11-05): Exposure Graph re-lists what Defender, Azure
|    # and Entra hold, and on a device node its last seen is its own refresh time -- at a ring 1 install its links kept 202
|    # stale devices (Azure resource nodes) and 122 (device nodes) active after their own source had stopped seeing them.
|    # When the CI links any other source, the Exposure Graph links are left out of the decision; a CI that ONLY Exposure
|    # Graph links is decided by Exposure Graph, with the seen window on its node's own observation time
|    # (Get-SIRecordSeenWindowDays) -- not seen after the window, retired after its grace period. Absence is never
|    # remediation: a not seen / retired CI's findings are never counted as fixed (unchanged).
|    # (another source = one that observes the asset itself: a CMDB record says what the CMDB holds, not that the asset exists)
|    $hasOther = $false
|    foreach ($l in @($Links)) { if ($null -ne $l -and [string](Get-SILifecycleValue $l 'provider') -notin 'eg', 'cmdb', 'servicenow') { $hasOther = $true; break } }
|    foreach ($l in @($Links)) {
|        if ($null -eq $l) { continue }
|        if ($hasOther -and [string](Get-SILifecycleValue $l 'provider') -eq 'eg') { continue }
|        switch ([string](Get-SILifecycleValue $l 'state')) { 'active' { $active.Add($l) } 'frozen' { $frozen.Add($l) } 'gone' { $gone.Add($l) } default { $notSeen.Add($l) } }
|    }
|    $newest = {
|        param($xs)
|        $best = $null
|        foreach ($x in $xs) { $t = Get-SILifecycleValue $x 'last_seen'; if ($t -is [datetime] -and ($null -eq $best -or $t -gt $best)) { $best = ([datetime]$t).ToUniversalTime() } }
|        $best
|    }
|    $fmt = { param($d) ([datetime]$d).ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture) }
|    $names = { param($xs) (@(foreach ($x in $xs) { [string](Get-SILifecycleValue $x 'provider') }) | Select-Object -Unique) -join ', ' }
|    $res = [ordered]@{ Lifecycle = 'active'; Since = $null; NotSeenDays = $null; Reason = ''; Change = ''; LastSeen = $null; GraceDays = $grace; Category = $cat }
|    if ($active.Count -gt 0) {
|        $last = & $newest $active
|        $res.LastSeen = $last
|        if ($prevState -eq 'active' -and $prevSince) { $res.Since = $prevSince; $res.Reason = $prevReason }
|        elseif ($prevState -in 'not_seen', 'retired') {
|            $res.Since = $now; $res.Change = 'reactivated'
|            $res.Reason = ('reactivated: seen again by {0}{1} after it was {2}' -f (& $names $active), $(if ($last) { ' on ' + (& $fmt $last) } else { '' }), ($prevState -replace '_', ' '))
|        } else {
|            $res.Since = $(if ($prevSince -and $prevState -eq 'active') { $prevSince } else { $now })
|            $res.Reason = ('seen by {0}' -f (& $names $active))
|        }
|        if (-not $res.Reason) { $res.Reason = ('seen by {0}' -f (& $names $active)) }
|        return [pscustomobject]$res
|    }
|    if ($frozen.Count -gt 0) {
|        # ABSENCE PROVES NOTHING: a link whose newest collection was partial (the source is on its last GOOD collection, which
|        # listed it), or whose provider's scope changed, counts as listed -- the CI is active, never moved to not seen or
|        # retired by it; only a CI already retired stays retired until a source sees it again
|        $why = @(foreach ($f in $frozen) { $r = [string](Get-SILifecycleValue $f 'reason'); if ($r) { $r } }) | Select-Object -Unique
|        $res.LastSeen = & $newest ($frozen.ToArray() + $notSeen.ToArray())
|        $res.Change = 'held'
|        if ($prevState -eq 'retired') { $res.Lifecycle = 'retired'; $res.Since = $prevSince; $res.Reason = $prevReason }
|        elseif ($prevState -eq 'active') { $res.Lifecycle = 'active'; $res.Since = $prevSince; $res.Reason = $prevReason }
|        else { $res.Lifecycle = 'active'; $res.Since = $now; $res.Reason = '' }
|        if ($null -eq $res.Since) { $res.Since = $now }
|        $held = ('held: {0} -- {1}' -f (& $names $frozen), $(if (@($why).Count) { @($why) -join '; ' } else { 'its newest collection was incomplete' }))
|        if (-not $res.Reason) { $res.Reason = $held } elseif ($res.Reason -notmatch '^held: ') { $res.Reason = $res.Reason + ' (' + $held + ')' } else { $res.Reason = $held }
|        if ($res.Lifecycle -ne 'active' -and $res.LastSeen) { $res.NotSeenDays = [int][Math]::Floor(($now - $res.LastSeen).TotalDays) }
|        return [pscustomobject]$res
|    }
|    # #1057 PROOF OF DELETION WINS over the not-seen / grace-period window (owner 2026-11-02): no link active or held, and a
|    # source proved its object deleted (a gone link with 'deleted') -- retired at once, "deleted in <source>"
|    $deleted = @($gone | Where-Object { [string](Get-SILifecycleValue $_ 'deleted') })
|    if ($deleted.Count -gt 0) {
|        $res.Lifecycle = 'retired'; $res.LastSeen = & $newest ($gone.ToArray() + $notSeen.ToArray())
|        $res.Since = $(if ($prevState -eq 'retired' -and $prevSince) { $prevSince } else { $now })
|        $srcs = (@(foreach ($x in $deleted) { [string](Get-SILifecycleValue $x 'deleted') }) | Select-Object -Unique) -join ', '
|        $res.Reason = ('retired at once: deleted in {0} ({1} -- {2})' -f $srcs, (& $names $deleted), [string](Get-SILifecycleValue $deleted[0] 'reason'))
|        if ($prevState -ne 'retired') { $res.Change = 'retired' } elseif ($prevReason) { $res.Reason = $prevReason }
|        if ($res.LastSeen) { $res.NotSeenDays = [int][Math]::Floor(($now - $res.LastSeen).TotalDays) }
|        return [pscustomobject]$res
|    }
|    if ($notSeen.Count -eq 0) {
|        # every link is gone (positive evidence): retired at once
|        $res.Lifecycle = 'retired'; $res.LastSeen = & $newest $gone
|        $res.Since = $(if ($prevState -eq 'retired' -and $prevSince) { $prevSince } else { $now })
|        $res.Reason = ('retired at once: every linked object is gone ({0} -- {1})' -f (& $names $gone), $(@(foreach ($g in $gone) { $r = [string](Get-SILifecycleValue $g 'reason'); if ($r) { $r } }) | Select-Object -Unique | Select-Object -First 1))
|        if ($res.Reason -match ' -- \)$') { $res.Reason = $res.Reason -replace ' -- \)$', ')' }
|        if ($prevState -ne 'retired') { $res.Change = 'retired' } elseif ($prevReason) { $res.Reason = $prevReason }
|        if ($res.LastSeen) { $res.NotSeenDays = [int][Math]::Floor(($now - $res.LastSeen).TotalDays) }
|        return [pscustomobject]$res
|    }
|    # not seen: the newest sighting of any link that is not gone decides, against the category's grace period
|    $last = & $newest $notSeen
|    $res.LastSeen = $last
|    if ($null -eq $last) {
|        $res.Lifecycle = $(if ($prevState -eq 'retired') { 'retired' } else { 'not_seen' })
|        $res.Since = $(if ($prevSince) { $prevSince } else { $now })
|        $res.Reason = $(if ($prevReason -and $prevState -eq $res.Lifecycle) { $prevReason } else { 'not seen: no source reports when it last saw it' })
|        if ($prevState -ne $res.Lifecycle) { $res.Change = $res.Lifecycle }
|        return [pscustomobject]$res
|    }
|    $res.NotSeenDays = [int][Math]::Floor(($now - $last).TotalDays)
|    $target = Get-SIAssetLifecycleTarget -LastSeen $last -Now $now -SeenWithinDays ([int]$Settings.SeenWithinDays) -GraceDays $grace
|    $stale = @(foreach ($x in $notSeen) { $r = [string](Get-SILifecycleValue $x 'reason'); if ($r) { $r } }) | Select-Object -Unique | Select-Object -First 2
|    $evidence = $(if (@($stale).Count) { ' (' + (@($stale) -join '; ') + ')' } else { '' })
|    if ($target -eq 'retired' -or $prevState -eq 'retired') {
|        $res.Lifecycle = 'retired'
|        if ($prevState -eq 'retired' -and $prevSince) { $res.Since = $prevSince; $res.Reason = $prevReason }
|        else {
|            $res.Since = $last.AddDays($grace); if ($res.Since -gt $now) { $res.Since = $now }
|            $res.Reason = ('retired: not seen since {0}, longer than the {1}-day grace period of a {2}{3}' -f (& $fmt $last), $grace, $cat, $evidence)
|        }
|        if (-not $res.Reason) { $res.Reason = ('retired: not seen since {0}, longer than the {1}-day grace period of a {2}{3}' -f (& $fmt $last), $grace, $cat, $evidence) }
|        if ($prevState -ne 'retired') { $res.Change = 'retired' }
|        return [pscustomobject]$res
|    }
|    $res.Lifecycle = 'not_seen'; $res.Since = $last
|    $res.Reason = ('not seen since {0} -- retired on {1} unless it is seen again ({2}-day grace period of a {3}){4}' -f (& $fmt $last), (& $fmt ($last.AddDays($grace))), $grace, $cat, $evidence)
|    if ($prevState -ne 'not_seen') { $res.Change = 'not_seen' }
|    [pscustomobject]$res
|}
|
|function Get-SICiLifecycleDefinitions {
|    <#
|        PURE. The lifecycle in plain words, from the settings in force -- what every page and report says it shows (owner
|        2026-10-19: "assumptions and filters should be transparent rgr lifecycle"). The web app has the same text
|        (SI.Management.Core.ProData.CiLifecycleDefinitions); the test keeps the two the same.
|    #>
|    param([Parameter(Mandatory)]$Settings)
|    $s = [int]$Settings.SeenWithinDays; $d = [int]$Settings.DefaultDays
|    [ordered]@{
|        active      = ('Active: at least one source lists the asset and -- for a device -- saw it within the last {0} days (Entra and Active Directory devices: 14 days, their last sign-in lags by design).' -f $s)
|        not_seen    = ('Not seen: no source has seen the asset for more than {0} days; it stays in its grace period (default {1} days, per category) before it is retired.' -f $s, $d)
|        retired     = 'Retired: not seen for longer than the grace period of its category, or every source gave positive evidence it is gone (offboarded). Its findings close as asset retired -- also those a source still reports -- never as fixed, and do not count as open; nothing is deleted.'
|        reactivated = 'Reactivated: a not seen or retired asset that a source sees again is active again, and the change is recorded.'
|    }
|}
'@ }
$__siSupportFiles['engine/asset-profiling/shared/SI-IdentityScopeChoice.ps1'] = @{ Sha256 = '1d1fcd21463e57ac0e58b6e43f45fcc08e084d34750a5f3930263dd38a743e54'; Text = @'
|#Requires -Version 5.1
|<#
|    A CUSTOMER'S CHOICE: WHICH EXPOSURE GRAPH IDENTITIES BECOME ASSETS (REQUIREMENTS #1056, owner approved 2026-11-01).
|
|    Three per-install switches. Each one's default is its Default in $script:SIIdentityScopeSettings below, the same value as
|    its default in config\settings.catalog.locked.json and launcher\_lib\SecurityInsight.shared-defaults.ps1 (the two
|    older ones ON -- an install turns one off to keep these objects as assets; SI_Identity_SkipNeverSyncedAd OFF, owner
|    2026-11-08 -- an install with very many never-synced AD accounts turns it on):
|      SI_Identity_SkipNeverSyncedAd          (owner 2026-11-08)  an on-premises AD account the Exposure Graph lists but that
|                                             was never synced to Entra ID (the node has no Entra object id) becomes an asset
|                                             only while it is PRIVILEGED -- whatever its enabled state (the graph often lists
|                                             such an account with its name only, and no enabled state). A non-privileged one
|                                             gets no record and no CI; it is counted. A user node that is NOT an on-premises
|                                             AD account (Test-SIEgIsAdAccount: no domain SID, no account name + domain) is
|                                             never left out by it. It is the wider form of the next switch: while it is on, it
|                                             decides the never-synced AD accounts and the next one decides nothing.
|      SI_Identity_SkipNeverSyncedDisabledAd  (customer choice "1C")  an on-premises AD account the Exposure Graph lists but
|                                             that was never synced to Entra ID (the node has no Entra object id) becomes an
|                                             asset only while it is ENABLED or PRIVILEGED. A disabled, non-privileged one gets
|                                             no record and no CI; it is counted. Applies only while SI_Identity_SkipNeverSyncedAd
|                                             is off (Get-SIIdentityNeverSyncedSetting).
|      SI_Identity_SkipDeletedGroups          (customer choice "2B")  a group node WITH an Entra object id becomes an asset
|                                             only while Entra ID still has the group (active, or in its deleted items). A
|                                             group Entra no longer returns at all gets no record and no CI; it is counted.
|    Real users, groups, devices and findings are not affected: an account synced to Entra (it has an Entra object id), an
|    AD-only group, a device, a service principal and every finding are never touched by any switch.
|
|    THE STAGES
|      collection   the Exposure Graph identity read (IdentityRoleFetcher.ps1) asks Get-SIEgIdentityScopeDecision for every
|                   Exposure Graph user / group node it would record; a node left out is not recorded (no record part, no
|                   full-metadata copy). The index that enriches the Entra objects is unchanged.
|                   The never-synced switch that applies (SI_Identity_SkipNeverSyncedAd, or SI_Identity_SkipNeverSyncedDisabledAd
|                   while the first is off) is ALSO applied in the hunting query itself
|                   (Get-SIEgNeverSyncedSkipKql): the user nodes the decision could only leave out are not fetched and do
|                   not count toward the buckets; the count probe counts them (NotFetched) and they join the left-out count.
|                   Every test in the query leans the safe way, so the decision after the read still sees -- and keeps --
|                   every node it would keep. A group Entra ID no longer has is decided after the read (it needs Entra's list).
|      run report   one plain line per switch in the identity step's log (Format-SIIdentityScopeLine) and one row per switch
|                   and run in sidata.CollectionLeftOut (Write-SIIdentityScopeCounts) -- the Data health page shows them.
|      asset drop   the collection's asset-drop check adds the records a switch left out this run back to the count it
|                   judges (Get-SIIdentityScopeLeftOutByFeed), so a customer's choice is never read as a broken source.
|      CI build     a CI whose Exposure Graph record a switch now leaves out RETIRES with a reason naming the switch -- the
|                   record's link is 'gone' (Get-SIRecordLeftOutByIdentityChoice, SI-CiBuild.ps1 Get-SIRecordLink), never
|                   a silent vanish and never a 30-day "not seen" wait. Switched off again, the next collection records the
|                   node again and the CI is reactivated.
|
|    THE SIGNALS (all already in SecurityInsight)
|      never synced  the node has no Entra object id (the identity read found none in EntityIds or rawData) --
|                    only AD ids (SecurityIdentifier / ActiveDirectoryObjectGuid)
|      AD account    a domain SID (S-1-5-21-...) in EntityIds or rawData, or an account name AND an account domain in rawData
|                    (Test-SIEgIsAdAccount; the query's _siIsAd)
|      disabled      rawData accountEnabled / isEnabled / enabled = false, or userAccountControl carries ACCOUNTDISABLE (the
|                    flag name, or bit 0x2 of the number). Unknown = NOT disabled: nothing is left out on a guess
|                    (the rule of SI-DisabledAssets.ps1)
|      privileged    any of: adminCount > 0 (AD's protected-account marker), a nested critical AD group
|                    (nestedCriticalAdGroups), membership of a tier 0 / tier 1 AD group of the privilege tier catalog
|                    (nestedAdGroupNames), an assigned role (assignedRoles), a service account (hasServicePrincipalName /
|                    isServiceAccount -- SI's service-account signal), a sensitive account (isSensitive), or a Microsoft
|                    criticality level (criticalityLevel)
|      group exists  its Entra object id is in Entra ID's groups or deleted groups (Read-SIEntraGroupIds: one paged read of
|                    /groups and /directory/deletedItems/microsoft.graph.group, ids only). A read that is not complete
|                    decides nothing: no group with an Entra id is recorded that run and the Exposure Graph pull is marked
|                    not complete, so nothing is retired and nothing comes back (absence proves nothing).
|
|    PURE functions except Read-SIEntraGroupIds (Graph, behind -Fetch), Write-SIIdentityScopeCounts and
|    Get-SIIdentityScopeLeftOutByFeed (SQL, behind -Invoke). PowerShell 5.1 and 7: no ?. / ??, no ternary.
|    Tests: tests\pester\SIv3-IdentityScopeChoice.Tests.ps1.
|#>
|
|# Default = the shipped default (config\settings.catalog.locked.json, launcher\_lib\SecurityInsight.shared-defaults.ps1):
|# used when the global is unset -- a container that never stored the setting runs as the catalog says (the two older
|# switches ON, SI_Identity_SkipNeverSyncedAd OFF). A stored value (true or false) is kept. (The container also applies every catalog default at start; this keeps the rule where the code reads it,
|# the pattern of SI-DisabledAssets.ps1.)
|$script:SIIdentityScopeSettings = [ordered]@{
|    SkipNeverSyncedAd         = @{ Setting = 'SI_Identity_SkipNeverSyncedAd';         Default = $false }
|    SkipNeverSyncedDisabledAd = @{ Setting = 'SI_Identity_SkipNeverSyncedDisabledAd'; Default = $true }
|    SkipDeletedGroups         = @{ Setting = 'SI_Identity_SkipDeletedGroups';         Default = $true }
|}
|
|function ConvertTo-SIIdentityScopeFlag {
|    <# PURE. $true / $false / $null from a bool, 'true' / 'false', 1 / 0. Anything else is unknown ($null). #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [bool]) { return $Value }
|    if ($Value -is [int] -or $Value -is [long]) { if ($Value -eq 1) { return $true }; if ($Value -eq 0) { return $false }; return $null }
|    $s = ([string]$Value).Trim()
|    if ($s -ieq 'true' -or $s -eq '1' -or $s -ieq 'on' -or $s -ieq 'yes') { return $true }
|    if ($s -ieq 'false' -or $s -eq '0' -or $s -ieq 'off' -or $s -ieq 'no') { return $false }
|    return $null
|}
|
|function Get-SIIdentityScopeChoice {
|    <#
|        PURE (reads the three globals unless -Values is passed). The install's choice:
|        @{ SkipNeverSyncedAd; SkipNeverSyncedDisabledAd; SkipDeletedGroups; Any }. Not set (or not readable as yes / no) =
|        each switch's shipped default (the two older ON, SI_Identity_SkipNeverSyncedAd OFF); a clear no (false, 0, off) =
|        OFF, a clear yes = ON. Which never-synced switch decides:
|        Get-SIIdentityNeverSyncedSetting.
|    #>
|    param([hashtable]$Values)
|    $out = [ordered]@{}
|    foreach ($k in $script:SIIdentityScopeSettings.Keys) {
|        $name = $script:SIIdentityScopeSettings[$k].Setting
|        $raw = $null
|        if ($Values) { if ($Values.ContainsKey($name)) { $raw = $Values[$name] } elseif ($Values.ContainsKey($k)) { $raw = $Values[$k] } }
|        else { $raw = Get-Variable -Name $name -Scope Global -ValueOnly -ErrorAction SilentlyContinue }
|        $flag = ConvertTo-SIIdentityScopeFlag $raw
|        $out[$k] = if ($null -eq $flag) { [bool]$script:SIIdentityScopeSettings[$k].Default } else { [bool]$flag }
|    }
|    $out['Any'] = [bool]($out.SkipNeverSyncedAd -or $out.SkipNeverSyncedDisabledAd -or $out.SkipDeletedGroups)
|    [pscustomobject]$out
|}
|
|function Get-SIIdentityNeverSyncedSetting {
|    <#
|        PURE. The ONE switch that decides the never-synced on-premises AD accounts under -Choice (Get-SIIdentityScopeChoice):
|        'SI_Identity_SkipNeverSyncedAd' while it is on (it is the wider form), else 'SI_Identity_SkipNeverSyncedDisabledAd'
|        while that is on, else '' (none: every never-synced AD account is kept, as before either switch existed).
|        A choice made before the wider switch existed (no SkipNeverSyncedAd property) reads it as off.
|    #>
|    param($Choice)
|    if ($null -eq $Choice) { return '' }
|    $p = $Choice.PSObject.Properties['SkipNeverSyncedAd']
|    if ($p -and [bool]$p.Value) { return $script:SIIdentityScopeSettings.SkipNeverSyncedAd.Setting }
|    $p = $Choice.PSObject.Properties['SkipNeverSyncedDisabledAd']
|    if ($p -and [bool]$p.Value) { return $script:SIIdentityScopeSettings.SkipNeverSyncedDisabledAd.Setting }
|    return ''
|}
|
|function Get-SIIdentityScopeValue {
|    <# PURE. A named value of a dictionary or an object (case-insensitive), $null when it has none. #>
|    param([AllowNull()]$Bag, [string]$Name)
|    if ($null -eq $Bag) { return $null }
|    if ($Bag -is [System.Collections.IDictionary]) {
|        foreach ($k in $Bag.Keys) { if ([string]$k -ieq $Name) { return $Bag[$k] } }
|        return $null
|    }
|    $p = $Bag.PSObject.Properties[$Name]
|    if ($p) { return $p.Value }
|    return $null
|}
|
|function Get-SIIdentityScopeList {
|    <# PURE. A value as a list of non-empty items: an array, a comma / semicolon list in one text, a JSON array in text. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return @() }
|    if ($Value -is [string]) {
|        $t = $Value.Trim()
|        if (-not $t) { return @() }
|        if ($t.StartsWith('[')) { try { return @(@($t | ConvertFrom-Json) | Where-Object { $null -ne $_ -and "$_".Trim() }) } catch { } }
|        return @($t -split '[,;]' | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|    }
|    if ($Value -is [System.Collections.IEnumerable] -and -not ($Value -is [System.Collections.IDictionary])) {
|        return @(@($Value) | Where-Object { $null -ne $_ -and "$_".Trim() })
|    }
|    return @($Value)
|}
|
|function Test-SIEgAdAccountDisabled {
|    <#
|        PURE. Does an Exposure Graph node's rawData SAY the account is disabled? $true, $false, or $null (it says nothing).
|        accountEnabled / isEnabled / enabled = false -> disabled; userAccountControl with ACCOUNTDISABLE (the flag name, or
|        bit 0x2 of the number) -> disabled. A DISABLED answer from any field wins; unknown is never disabled.
|    #>
|    param([AllowNull()]$RawData)
|    if ($null -eq $RawData) { return $null }
|    $sawEnabled = $false
|    foreach ($k in 'accountEnabled', 'isEnabled', 'enabled') {
|        $f = ConvertTo-SIIdentityScopeFlag (Get-SIIdentityScopeValue $RawData $k)
|        if ($f -eq $false) { return $true }
|        if ($f -eq $true) { $sawEnabled = $true }
|    }
|    $uac = Get-SIIdentityScopeValue $RawData 'userAccountControl'
|    if ($null -ne $uac) {
|        foreach ($v in (Get-SIIdentityScopeList $uac)) {
|            $s = ([string]$v).Trim()
|            if (-not $s) { continue }
|            $n = 0L
|            if ([long]::TryParse($s, [ref]$n)) { if ($n -band 2) { return $true }; $sawEnabled = $true; continue }
|            if ($s -match '^(?i)(AccountDisabled|ACCOUNTDISABLE|Account_Disabled|Disabled)$') { return $true }
|            $sawEnabled = $true   # a flag list without the disable flag says the account is enabled
|        }
|    }
|    if ($sawEnabled) { return $false }
|    return $null
|}
|
|function Test-SIEgIsAdAccount {
|    <#
|        PURE. Is an Exposure Graph node an on-premises AD account? The same test as the query's _siIsAd
|        (Get-SIEgNeverSyncedSkipKql): a domain SID (S-1-5-21-...) -- -Sid (the SID the identity read resolved from EntityIds
|        or rawData) or one of rawData's SID fields -- or an account name AND an account domain in rawData (both non-empty
|        text). Field names without case. Anything else (another identity provider, a node with no AD sign) = $false: a
|        switch about AD accounts never leaves it out.
|    #>
|    param([AllowNull()]$RawData, [AllowNull()][AllowEmptyString()][string]$Sid)
|    if ($Sid -and $Sid.Trim() -match '^(?i)s-1-5-21-') { return $true }
|    if ($null -eq $RawData) { return $false }
|    foreach ($k in 'adSid', 'accountSid', 'onPremSid', 'onPremisesSecurityIdentifier', 'securityIdentifier', 'sid') {
|        $v = Get-SIIdentityScopeValue $RawData $k
|        if ($v -is [string] -and $v.Trim() -match '^(?i)s-1-5-21-') { return $true }
|    }
|    $n = Get-SIIdentityScopeValue $RawData 'accountName'
|    $d = Get-SIIdentityScopeValue $RawData 'accountDomain'
|    if ($n -is [string] -and $n.Length -gt 0 -and $d -is [string] -and $d.Length -gt 0) { return $true }
|    return $false
|}
|
|function Get-SIIdentityCriticalAdGroupNames {
|    <#
|        The privilege tier catalog's tier 0 and tier 1 AD groups (Domain Admins, Enterprise Admins, Schema Admins, Account
|        Operators, Backup Operators ...) as a case-insensitive set: the shipped catalog plus the tenant's own catalog
|        (privilege-tier-catalog.custom.json) when it is there. -SIRoot: the solution folder. Never throws: a catalog that
|        cannot be read adds nothing (the other privilege signals still hold).
|    #>
|    param([string]$SIRoot)
|    $set = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    if (-not $SIRoot) { $SIRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) }
|    $dir = [IO.Path]::Combine($SIRoot, 'privilege-tier-catalog')
|    foreach ($file in @('privilege-tier-catalog.locked.json', 'privilege-tier-catalog.custom.json')) {
|        $p = [IO.Path]::Combine($dir, $file)
|        if (-not [IO.File]::Exists($p)) { continue }
|        try {
|            $doc = [IO.File]::ReadAllText($p) | ConvertFrom-Json
|            foreach ($sec in 'AD_BuiltInPermissionGroups_Tier0', 'AD_BuiltInPermissionGroups_Tier1', 'AD_CustomGroups_Tier0', 'AD_CustomGroups_Tier1') {
|                foreach ($e in @(Get-SIIdentityScopeValue $doc $sec)) {
|                    if ($null -eq $e) { continue }
|                    $n = [string](Get-SIIdentityScopeValue $e 'Name')
|                    if ($n -and $n.Trim()) { [void]$set.Add($n.Trim()) }
|                }
|            }
|        } catch { Write-Warning ('identity scope choice: the privilege tier catalog {0} could not be read -- {1}' -f $file, $_.Exception.Message) }
|    }
|    , $set
|}
|
|function Get-SIEgAdPrivilege {
|    <#
|        PURE. Is the account behind an Exposure Graph node privileged? @{ IsPrivileged; Why (the signals that said so) }.
|        -CriticalGroups: Get-SIIdentityCriticalAdGroupNames (names compared without case).
|    #>
|    param([AllowNull()]$RawData, [AllowNull()]$CriticalGroups)
|    $why = New-Object System.Collections.Generic.List[string]
|    if ($null -ne $RawData) {
|        $ac = 0; if ([int]::TryParse([string](Get-SIIdentityScopeValue $RawData 'adminCount'), [ref]$ac) -and $ac -gt 0) { $why.Add('admin count') }
|        # nestedCriticalAdGroups: the graph writes a dictionary { type, data: [ ... ] } (eg.locked.json #690 (29)); a plain list is read too
|        $crit = Get-SIIdentityScopeValue $RawData 'nestedCriticalAdGroups'
|        $critItems = @()
|        if ($null -ne $crit) {
|            $data = $null
|            if ($crit -is [System.Collections.IDictionary] -or $crit -is [System.Management.Automation.PSCustomObject]) { $data = Get-SIIdentityScopeValue $crit 'data' }
|            if ($null -ne $data) { $critItems = @(Get-SIIdentityScopeList $data) }
|            elseif (-not ($crit -is [System.Management.Automation.PSCustomObject]) -and -not ($crit -is [System.Collections.IDictionary])) { $critItems = @(Get-SIIdentityScopeList $crit) }
|        }
|        if ($critItems.Count -gt 0) { $why.Add('critical AD group') }
|        if ($null -ne $CriticalGroups -and $CriticalGroups.Count -gt 0) {
|            foreach ($g in (Get-SIIdentityScopeList (Get-SIIdentityScopeValue $RawData 'nestedAdGroupNames'))) {
|                $gn = ([string]$g).Trim()
|                if ($gn -and $CriticalGroups.Contains($gn)) { $why.Add('tier 0/1 AD group ' + $gn); break }
|            }
|        }
|        if (@(Get-SIIdentityScopeList (Get-SIIdentityScopeValue $RawData 'assignedRoles')).Count -gt 0) { $why.Add('assigned role') }
|        foreach ($k in 'hasServicePrincipalName', 'isServiceAccount') {
|            if ((ConvertTo-SIIdentityScopeFlag (Get-SIIdentityScopeValue $RawData $k)) -eq $true) { $why.Add('service account'); break }
|        }
|        if ((ConvertTo-SIIdentityScopeFlag (Get-SIIdentityScopeValue $RawData 'isSensitive')) -eq $true) { $why.Add('sensitive account') }
|        $cl = Get-SIIdentityScopeValue $RawData 'criticalityLevel'
|        if ($null -ne $cl) {
|            $lvl = $cl
|            if ($cl -is [System.Collections.IDictionary] -or $cl -is [System.Management.Automation.PSCustomObject]) { $lvl = Get-SIIdentityScopeValue $cl 'criticalityLevel' }
|            if ($null -ne $lvl -and "$lvl".Trim() -ne '') { $why.Add('Microsoft criticality level') }
|        }
|    }
|    [pscustomobject]@{ IsPrivileged = ($why.Count -gt 0); Why = $why.ToArray() }
|}
|
|function Get-SIEgNeverSyncedSkipKql {
|    <#
|        PURE. SI_Identity_SkipNeverSyncedDisabledAd IN THE HUNTING QUERY ITSELF: the KQL steps (to put after
|        "ExposureGraphNodes | where NodeLabel == 'user'") that set the column _siSkip -- true for a user node the Exposure
|        Graph read would only fetch to leave out (an on-premises AD account never synced to Entra ID, disabled and not
|        privileged). The read asks only for the nodes where _siSkip is false and counts the others; the decision after the
|        read (Get-SIEgIdentityScopeDecision) still runs on every node that is fetched.
|        NEVER LEAVES OUT A NODE SI KEEPS: every test leans the safe way --
|          rawData        only a node whose NodeProperties.rawData is an object (the object the decision reads) is ever skipped
|          never synced   ANY mention of AadObjectId in EntityIds, or a GUID in any of the rawData fields the read takes an
|                         Entra object id from, counts as synced (the read itself needs more to find one)
|          disabled       only what the decision reads as disabled for certain: accountEnabled / isEnabled / enabled false
|                         (false, 0, off, no), userAccountControl as a number with bit 0x2, or with the ACCOUNTDISABLE flag
|                         name as a list item; anything else is not disabled
|          privileged     ANY sign of a privilege signal: an admin count with a digit 1-9, nestedCriticalAdGroups that is not
|                         plainly empty, a tier 0/1 group name of the privilege tier catalog anywhere in nestedAdGroupNames,
|                         assignedRoles that is not plainly empty, a service-account or sensitive flag that is not plainly
|                         false, a criticality level with any value
|          AD identity    (so the count is the same count the decision makes) a domain SID, or an account name and domain
|        Field names are compared without case (the rawData text is lower-cased once). -CriticalGroups:
|        Get-SIIdentityCriticalAdGroupNames. A catalog name with characters outside letters, digits, space, '.', '_', '-'
|        cannot be matched safely in the text: then any non-empty nestedAdGroupNames counts as privileged.
|        -AnyEnabledState: SI_Identity_SkipNeverSyncedAd (the wider switch) -- the skip leaves out the enabled state:
|        _siSkip = isnotnull(_siRl) and not(_siHasOid) and _siIsAd and not(_siPriv). Every other test is the same, and
|        still leans the safe way (the AD identity test is what keeps a node of another identity provider).
|    #>
|    param([AllowNull()]$CriticalGroups, [switch]$AnyEnabledState)
|    $names = New-Object System.Collections.Generic.List[string]
|    $unsafeName = $false
|    foreach ($g in @($CriticalGroups)) {
|        if ($null -eq $g) { continue }
|        $n = ([string]$g).Trim().ToLowerInvariant()
|        if (-not $n) { continue }
|        if ($n -cmatch '^[a-z0-9]([a-z0-9 _.\-]*[a-z0-9])?$') { $names.Add($n.Replace('.', '\.')) } else { $unsafeName = $true }
|    }
|    $groupTest = 'false'
|    if ($unsafeName) { $groupTest = 'not(tostring(_siRl.nestedadgroupnames) in ("", "[]"))' }
|    elseif ($names.Count -gt 0) {
|        # a name as a whole item: what is before and after it is not a letter or digit (a quote, a comma, a space, an escape)
|        $groupTest = 'tostring(_siRl.nestedadgroupnames) matches regex @"(^|[^a-z0-9]|\\u[0-9a-f]{4})(' + ($names -join '|') + ')($|[^a-z0-9])"'
|    }
|    $flagNotFalse = { param($f) ('not(trim(@"\s+", tostring(_siRl.{0})) in ("", "false", "0", "off", "no"))' -f $f) }
|    $flagFalse = { param($f) ('trim(@"\s+", tostring(_siRl.{0})) in ("false", "0", "off", "no")' -f $f) }
|    $guid = '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
|    $sidKeys = @('adsid', 'accountsid', 'onpremsid', 'onpremisessecurityidentifier', 'securityidentifier', 'sid')
|    $rawSid = 'case(' + ((@($sidKeys | ForEach-Object { 'tostring(_siRl.{0}) matches regex @"^s-1-[0-9]", tostring(_siRl.{0})' -f $_ })) -join ', ') + ', "")'
|    $oidText = 'strcat(' + ((@('aadid', 'accountobjectid', 'objectid', 'aadobjectid', 'groupid', 'principalid', 'userid', 'id') | ForEach-Object { 'tostring(_siRl.{0})' -f $_ }) -join ', " ", ') + ')'
|    $uac = '_siRl.useraccountcontrol'
|    $uacNames = '"accountdisabled", "accountdisable", "account_disabled", "disabled"'
|    $parts = @(
|        '| extend _siIds = tolower(tostring(EntityIds)), _siRd = NodeProperties.rawData'
|        '| extend _siRl = iff(gettype(_siRd) == "dictionary" and not(_siIds contains "aadobjectid"), todynamic(tolower(tostring(_siRd))), dynamic(null))'
|        ('| extend _siHasOid = _siIds contains "aadobjectid" or {0} matches regex @"{1}"' -f $oidText, $guid)
|        ('| extend _siSid = coalesce(extract(@"securityidentifier[^}}]*?(s-1-[0-9-]+)", 1, _siIds), {0})' -f $rawSid)
|        '| extend _siIsAd = _siSid startswith "s-1-5-21-" or (gettype(_siRl.accountname) == "string" and isnotempty(tostring(_siRl.accountname)) and gettype(_siRl.accountdomain) == "string" and isnotempty(tostring(_siRl.accountdomain)))'
|    )
|    if (-not $AnyEnabledState) {
|        $parts += @(
|        ('| extend _siUacT = gettype({0}), _siUacS = trim(@"\s+", tostring({0}))' -f $uac)
|        ('| extend _siDisabled = {0} or {1} or {2}' -f (& $flagFalse 'accountenabled'), (& $flagFalse 'isenabled'), (& $flagFalse 'enabled')) +
|            (' or (_siUacT in ("long", "int") and binary_and(tolong({0}), 2) == 2)' -f $uac) +
|            ' or (_siUacT == "string" and _siUacS matches regex @"^[0-9]+$" and binary_and(tolong(_siUacS), 2) == 2)' +
|            (' or (_siUacT == "array" and array_length(set_intersect({0}, dynamic([{1}]))) > 0)' -f $uac, $uacNames) +
|            ' or (_siUacT == "string" and not(_siUacS startswith "[") and _siUacS matches regex @"(^|[,;])\s*(accountdisabled|accountdisable|account_disabled|disabled)\s*($|[,;])")'
|        )
|    }
|    $parts += @(
|        ('| extend _siPriv = tostring(_siRl.admincount) matches regex @"[1-9]"' +
|            ' or not(tostring(_siRl.nestedcriticaladgroups) in ("", "[]", "{}") or (gettype(_siRl.nestedcriticaladgroups) == "dictionary" and gettype(_siRl.nestedcriticaladgroups.data) == "array" and array_length(_siRl.nestedcriticaladgroups.data) == 0))' +
|            (' or {0}' -f $groupTest) +
|            ' or not(tostring(_siRl.assignedroles) in ("", "[]"))' +
|            (' or {0} or {1} or {2}' -f (& $flagNotFalse 'hasserviceprincipalname'), (& $flagNotFalse 'isserviceaccount'), (& $flagNotFalse 'issensitive')) +
|            ' or iff(gettype(_siRl.criticalitylevel) == "dictionary", isnotempty(tostring(_siRl.criticalitylevel.criticalitylevel)), isnotempty(tostring(_siRl.criticalitylevel))))')
|    )
|    if ($AnyEnabledState) { $parts += '| extend _siSkip = isnotnull(_siRl) and not(_siHasOid) and _siIsAd and not(_siPriv)' }
|    else { $parts += '| extend _siSkip = isnotnull(_siRl) and not(_siHasOid) and _siIsAd and _siDisabled and not(_siPriv)' }
|    ($parts -join ' ')
|}
|
|function Get-SIEgIdentityScopeDecision {
|    <#
|        PURE. Does one Exposure Graph identity node become a record (an asset) under the install's choice?
|          -NodeLabel     user | group | serviceprincipal | managedidentity
|          -AadObjectId   the Entra object id the identity read found ('' = never synced)
|          -RawData       the node's rawData
|          -Choice        Get-SIIdentityScopeChoice
|          -EntraGroups   the ids Entra ID returns (Read-SIEntraGroupIds .Ids); $null = not read
|          -GroupsUnknown the Entra group read was asked for and is NOT complete
|          -CriticalGroups Get-SIIdentityCriticalAdGroupNames
|          -Sid           the SID the identity read resolved (EntityIds or rawData), '' = none
|        Returns @{ Keep; Setting (the switch that left it out, ''); Why; Held ($true = left out this run only because the
|        Entra group read was not complete) }.
|        A never-synced user is decided by ONE switch (Get-SIIdentityNeverSyncedSetting): SI_Identity_SkipNeverSyncedAd while
|        it is on (kept when it is not an AD account, or privileged -- whatever its enabled state), else
|        SI_Identity_SkipNeverSyncedDisabledAd (kept when it is not disabled for certain, or privileged).
|    #>
|    param([AllowEmptyString()][string]$NodeLabel = '', [AllowEmptyString()][string]$AadObjectId = '', [AllowNull()]$RawData,
|          [Parameter(Mandatory)]$Choice, [AllowNull()]$EntraGroups, [switch]$GroupsUnknown, [AllowNull()]$CriticalGroups,
|          [AllowNull()][AllowEmptyString()][string]$Sid = '')
|    $keep = [pscustomobject]@{ Keep = $true; Setting = ''; Why = ''; Held = $false }
|    if (-not $Choice -or -not $Choice.Any) { return $keep }
|    $label = ([string]$NodeLabel).Trim().ToLowerInvariant()
|    $oid = ([string]$AadObjectId).Trim().ToLowerInvariant()
|    $neverSynced = Get-SIIdentityNeverSyncedSetting -Choice $Choice
|    if ($label -eq 'user' -and -not $oid -and $neverSynced -eq $script:SIIdentityScopeSettings.SkipNeverSyncedAd.Setting) {
|        if (-not (Test-SIEgIsAdAccount -RawData $RawData -Sid $Sid)) { return $keep }
|        $priv = Get-SIEgAdPrivilege -RawData $RawData -CriticalGroups $CriticalGroups
|        if ($priv.IsPrivileged) { return $keep }
|        return [pscustomobject]@{ Keep = $false; Setting = $neverSynced; Why = 'an on-premises AD account never synced to Entra ID and not privileged'; Held = $false }
|    }
|    if ($label -eq 'user' -and -not $oid -and $neverSynced -eq $script:SIIdentityScopeSettings.SkipNeverSyncedDisabledAd.Setting) {
|        if ((Test-SIEgAdAccountDisabled -RawData $RawData) -ne $true) { return $keep }
|        $priv = Get-SIEgAdPrivilege -RawData $RawData -CriticalGroups $CriticalGroups
|        if ($priv.IsPrivileged) { return $keep }
|        return [pscustomobject]@{ Keep = $false; Setting = $script:SIIdentityScopeSettings.SkipNeverSyncedDisabledAd.Setting; Why = 'an on-premises AD account never synced to Entra ID, disabled and not privileged'; Held = $false }
|    }
|    if ($label -eq 'group' -and $oid -and $Choice.SkipDeletedGroups) {
|        if ($GroupsUnknown) {
|            return [pscustomobject]@{ Keep = $false; Setting = $script:SIIdentityScopeSettings.SkipDeletedGroups.Setting; Why = 'the Entra ID group read was not complete this run -- the group keeps its last state'; Held = $true }
|        }
|        if ($null -eq $EntraGroups) { return $keep }
|        if ($EntraGroups.Contains($oid)) { return $keep }
|        return [pscustomobject]@{ Keep = $false; Setting = $script:SIIdentityScopeSettings.SkipDeletedGroups.Setting; Why = 'a group Entra ID no longer has (neither active nor in its deleted items)'; Held = $false }
|    }
|    return $keep
|}
|
|function Read-SIEntraGroupIds {
|    <#
|        Every group id Entra ID has: active (/groups) and recently deleted (/directory/deletedItems/microsoft.graph.group),
|        ids only, page by page. Returns @{ Ok; Ids (HashSet, lower-case); Active; Deleted; Error }. Ok = $false when either
|        read failed: the caller then decides nothing about groups this run.
|        -Fetch: test seam { param($Url, $OnPage) } -- calls $OnPage with each page's rows; throws on a failed read.
|    #>
|    param([scriptblock]$Fetch)
|    $ids = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $res = [ordered]@{ Ok = $false; Ids = $ids; Active = 0; Deleted = 0; Error = '' }
|    if (-not $Fetch) {
|        $Fetch = {
|            param($Url, $OnPage)
|            $tk = ''
|            if (Get-Command -Name Get-SIGraphToken -ErrorAction SilentlyContinue) { $tk = [string](Get-SIGraphToken -Resource Graph) }
|            if (-not $tk) { throw 'no Microsoft Graph token' }
|            $null = Invoke-SIGraphPaged -RelativeUrl $Url -Token $tk -OnPage $OnPage
|        }
|    }
|    $state = @{ Active = 0; Deleted = 0 }
|    try {
|        & $Fetch '/groups?$select=id&$top=999' { param($rows) foreach ($r in @($rows)) { $i = [string](Get-SIIdentityScopeValue $r 'id'); if ($i) { if ($ids.Add($i.Trim().ToLowerInvariant())) { $state.Active++ } } } }
|        & $Fetch '/directory/deletedItems/microsoft.graph.group?$select=id&$top=999' { param($rows) foreach ($r in @($rows)) { $i = [string](Get-SIIdentityScopeValue $r 'id'); if ($i) { if ($ids.Add($i.Trim().ToLowerInvariant())) { $state.Deleted++ } } } }
|        $res.Ok = $true
|    } catch {
|        $res.Error = [string]$_.Exception.Message
|    }
|    $res.Active = [int]$state.Active; $res.Deleted = [int]$state.Deleted
|    [pscustomobject]$res
|}
|
|function New-SIIdentityScopeCounter {
|    <# A counter per switch that decides this run: @{ <setting> = @{ LeftOut; Held; Kept; Applied; Detail } }. Of the two
|       never-synced switches only the one that decides (Get-SIIdentityNeverSyncedSetting) gets a counter. #>
|    param([Parameter(Mandatory)]$Choice)
|    $c = [ordered]@{}
|    $neverSynced = Get-SIIdentityNeverSyncedSetting -Choice $Choice
|    foreach ($k in $script:SIIdentityScopeSettings.Keys) {
|        if (-not $Choice.$k) { continue }
|        if (($k -in @('SkipNeverSyncedAd', 'SkipNeverSyncedDisabledAd')) -and ($script:SIIdentityScopeSettings[$k].Setting -ne $neverSynced)) { continue }
|        $c[$script:SIIdentityScopeSettings[$k].Setting] = [pscustomobject]@{ Setting = $script:SIIdentityScopeSettings[$k].Setting; Feed = 'eg|user'; LeftOut = 0L; Held = 0L; Kept = 0L; Applied = $true; Detail = ''; NotFetched = 0L }
|    }
|    $c
|}
|
|function Add-SIIdentityScopeCount {
|    <# Counts one node's decision on the counter (a left-out node, or a node the switch looked at and kept). #>
|    param([Parameter(Mandatory)]$Counter, [Parameter(Mandatory)]$Decision, [string]$KeptBy = '')
|    if (-not $Decision.Keep) {
|        $c = $Counter[[string]$Decision.Setting]
|        if ($null -eq $c) { return }
|        if ($Decision.Held) { $c.Held++ } else { $c.LeftOut++ }
|        return
|    }
|    if ($KeptBy) { $c = $Counter[$KeptBy]; if ($null -ne $c) { $c.Kept++ } }
|}
|
|function Format-SIIdentityScopeLine {
|    <# PURE. The one plain line the identity step logs per switch (customer-facing: the setting named, counts only). #>
|    param([Parameter(Mandatory)]$Count)
|    $n = '{0:N0}' -f [long]$Count.LeftOut
|    switch ([string]$Count.Setting) {
|        'SI_Identity_SkipNeverSyncedAd' {
|            # left out in the hunting query itself (Get-SIEgNeverSyncedSkipKql -AnyEnabledState): part of the count, never fetched
|            $nf = 0L; if ($Count.PSObject.Properties['NotFetched'] -and $null -ne $Count.NotFetched) { $nf = [long]$Count.NotFetched }
|            if ($nf -gt 0) {
|                return ('Exposure Graph identities: {0} on-premises AD account(s) never synced to Entra ID and not privileged got no asset (SI_Identity_SkipNeverSyncedAd is on): {1:N0} not fetched (left out in the Exposure Graph query itself), {2:N0} left out after the read; {3:N0} never-synced account(s) kept because they are privileged. Existing CIs of the accounts left out retire with that reason.' -f $n, $nf, ([long]$Count.LeftOut - $nf), [long]$Count.Kept)
|            }
|            return ('Exposure Graph identities: {0} on-premises AD account(s) never synced to Entra ID and not privileged got no asset (SI_Identity_SkipNeverSyncedAd is on); {1:N0} never-synced account(s) kept because they are privileged. Existing CIs of the accounts left out retire with that reason.' -f $n, [long]$Count.Kept)
|        }
|        'SI_Identity_SkipNeverSyncedDisabledAd' {
|            # left out in the hunting query itself (Get-SIEgNeverSyncedSkipKql): part of the count, never fetched
|            $nf = 0L; if ($Count.PSObject.Properties['NotFetched'] -and $null -ne $Count.NotFetched) { $nf = [long]$Count.NotFetched }
|            if ($nf -gt 0) {
|                return ('Exposure Graph identities: {0} on-premises AD account(s) never synced to Entra ID, disabled and not privileged, got no asset (SI_Identity_SkipNeverSyncedDisabledAd is on): {1:N0} not fetched (left out in the Exposure Graph query itself), {2:N0} left out after the read; {3:N0} never-synced account(s) kept because they are enabled or privileged. Existing CIs of the accounts left out retire with that reason.' -f $n, $nf, ([long]$Count.LeftOut - $nf), [long]$Count.Kept)
|            }
|            return ('Exposure Graph identities: {0} on-premises AD account(s) never synced to Entra ID, disabled and not privileged, got no asset (SI_Identity_SkipNeverSyncedDisabledAd is on); {1:N0} never-synced account(s) kept because they are enabled or privileged. Existing CIs of the accounts left out retire with that reason.' -f $n, [long]$Count.Kept)
|        }
|        'SI_Identity_SkipDeletedGroups' {
|            if (-not $Count.Applied) {
|                $why = 'no detail'; if ($Count.Detail) { $why = [string]$Count.Detail }
|                return ('Exposure Graph identities: SI_Identity_SkipDeletedGroups is on, but the Entra ID group list could not be read completely ({0}) -- {1:N0} group(s) with an Entra id were not recorded this run and keep their last state (nothing retires, nothing comes back).' -f $why, [long]$Count.Held)
|            }
|            return ('Exposure Graph identities: {0} group(s) Entra ID no longer has (neither active nor in its deleted items) got no asset (SI_Identity_SkipDeletedGroups is on); {1:N0} group(s) that still exist in Entra ID kept. Existing CIs of the groups left out retire with that reason.' -f $n, [long]$Count.Kept)
|        }
|    }
|    ('{0}: {1} left out' -f [string]$Count.Setting, $n)
|}
|
|function Get-SIIdentityScopeWriteSql {
|    <# The ONE statement that records this run's counts (sidata.CollectionLeftOut; nothing when the table is not there yet) and
|       keeps 400 days of them. @rows = [{ Setting; Feed; LeftOut; Kept; Held; Applied; Detail }], @engine. #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'sidata.CollectionLeftOut') IS NULL BEGIN SELECT 0 AS Written; RETURN; END
|INSERT sidata.CollectionLeftOut (Setting, Feed, Engine, LeftOut, Kept, Held, Applied, Detail)
|SELECT LEFT(x.Setting, 64), LEFT(ISNULL(x.Feed, N''), 64), LEFT(ISNULL(@engine, N''), 32), ISNULL(x.LeftOut, 0), x.Kept, ISNULL(x.Held, 0), ISNULL(x.Applied, 1), LEFT(x.Detail, 400)
|FROM OPENJSON(@rows) WITH (Setting NVARCHAR(64), Feed NVARCHAR(64), LeftOut BIGINT, Kept BIGINT, Held BIGINT, Applied BIT, Detail NVARCHAR(400)) x
|WHERE x.Setting IS NOT NULL;
|DECLARE @n INT = @@ROWCOUNT;
|DELETE FROM sidata.CollectionLeftOut WHERE CollectedAt < DATEADD(day, -400, SYSUTCDATETIME());
|SELECT @n AS Written;
|'@
|}
|
|function Write-SIIdentityScopeCounts {
|    <#
|        Records this run's counts in the install's database (one row per switch). -Invoke: the SQL seam
|        { param($Sql, $Params, $Mode) } (New-SIRecordSqlInvoke); none = no database, the log line is the record. Never throws.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Counts, [scriptblock]$Invoke, [string]$Engine = 'identity')
|    if (-not @($Counts).Count) { return 0 }
|    if (-not $Invoke) {
|        if (-not (Get-Command -Name New-SIRecordSqlInvoke -ErrorAction SilentlyContinue)) {
|            $rs = [IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'data-model', 'SI-RecordSql.ps1')
|            if ([IO.File]::Exists($rs)) { try { . $rs } catch { } }
|        }
|        if (Get-Command -Name New-SIRecordSqlInvoke -ErrorAction SilentlyContinue) { $Invoke = New-SIRecordSqlInvoke }
|    }
|    if (-not $Invoke) { return 0 }
|    try {
|        $rows = @(foreach ($c in @($Counts)) { [ordered]@{ Setting = [string]$c.Setting; Feed = [string]$c.Feed; LeftOut = [long]$c.LeftOut; Kept = [long]$c.Kept; Held = [long]$c.Held; Applied = [bool]$c.Applied; Detail = [string]$c.Detail } })
|        $j = ConvertTo-Json -InputObject @($rows) -Compress -Depth 4
|        if (-not $j.TrimStart().StartsWith('[')) { $j = '[' + $j + ']' }
|        $r = @(& $Invoke (Get-SIIdentityScopeWriteSql) @{ rows = $j; engine = $Engine } 'rows') | Select-Object -First 1
|        return [int](Get-SIIdentityScopeValue $r 'Written')
|    } catch {
|        Write-Warning ('identity scope choice: the counts could not be recorded in the database -- {0}. The run log has them.' -f $_.Exception.Message)
|        return 0
|    }
|}
|
|function Get-SIIdentityScopeLeftOutSql {
|    <# The records each feed's switches left out of the collection @ctText (rows written at or after it), per feed. #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'sidata.CollectionLeftOut') IS NULL BEGIN SELECT CAST(NULL AS NVARCHAR(64)) AS Feed, CAST(0 AS BIGINT) AS LeftOut WHERE 1 = 0; RETURN; END
|DECLARE @ct DATETIME2(3) = TRY_CONVERT(DATETIME2(3), NULLIF(@ctText, N''), 127);
|SELECT l.Feed, SUM(l.LeftOut) AS LeftOut
|FROM sidata.CollectionLeftOut l
|WHERE @ct IS NOT NULL AND l.CollectedAt >= @ct AND l.Applied = 1
|  AND l.Id IN (SELECT MAX(i.Id) FROM sidata.CollectionLeftOut i WHERE i.CollectedAt >= @ct GROUP BY i.Setting)
|GROUP BY l.Feed;
|'@
|}
|
|function Get-SIIdentityScopeLeftOutByFeed {
|    <#
|        The records the switches left out of one collection, per feed ('eg|user' -> count) -- what the asset-drop check adds
|        back before it judges a feed. Only read while a switch is on in this install (-Choice); otherwise, or on any failure,
|        an empty map (the check judges as before). Never throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$CollectionTimeText, $Choice)
|    $out = @{}
|    if (-not $Choice) { $Choice = Get-SIIdentityScopeChoice }
|    if (-not $Choice.Any) { return $out }
|    try {
|        foreach ($r in @(& $Invoke (Get-SIIdentityScopeLeftOutSql) @{ ctText = $CollectionTimeText } 'rows')) {
|            if ($null -eq $r) { continue }
|            $f = [string](Get-SIIdentityScopeValue $r 'Feed'); if (-not $f) { continue }
|            $n = Get-SIIdentityScopeValue $r 'LeftOut'; if ($null -eq $n -or $n -is [DBNull]) { $n = 0 }
|            $out[$f.ToLowerInvariant()] = [long]$n
|        }
|    } catch { Write-Warning ('identity scope choice: the left-out counts could not be read for the asset-drop check -- {0}' -f $_.Exception.Message) }
|    $out
|}
|
|function Get-SIRecordLeftOutByIdentityChoice {
|    <#
|        PURE. The CI build's side: is this Exposure Graph record -- MISSING from a complete newer collection -- one the
|        install's choice now leaves out? Decided from the record's own stored SI fields (the node is not read again):
|          SI_Identity_SkipNeverSyncedDisabledAd  an eg user record of a user (si_identity_type user) with no Entra object id,
|                                                 whose stored fields show no privilege (si_admin_count, si_ad_critical_groups,
|                                                 si_is_sensitive_account, si_ms_criticality): the switch keeps every enabled
|                                                 or privileged never-synced account listed, so one that is no longer listed
|                                                 is disabled now (or gone from AD)
|          SI_Identity_SkipNeverSyncedAd          the same record, while this wider switch is on (it then decides instead of
|                                                 the one above), and only when the record shows it is an AD account (a domain
|                                                 SID in ad_sid, or an account name + AD domain): the switch keeps every
|                                                 privileged never-synced account listed, so one no longer listed is not
|                                                 privileged (or gone from AD)
|          SI_Identity_SkipDeletedGroups         an eg user record of a group (si_identity_type group) with an Entra object id:
|                                                 the switch keeps every group Entra still has, so one no longer listed is gone
|        Returns @{ Gone; Reason } -- Gone = $false for anything else (the lifecycle's usual "not seen" applies).
|    #>
|    param([AllowNull()]$Record, [Parameter(Mandatory)]$Choice)
|    $no = [pscustomobject]@{ Gone = $false; Reason = '' }
|    if ($null -eq $Record -or -not $Choice -or -not $Choice.Any) { return $no }
|    if ([string](Get-SIIdentityScopeValue $Record 'si_provider') -ne 'eg' -or [string](Get-SIIdentityScopeValue $Record 'si_record_type') -ne 'user') { return $no }
|    $type = ([string](Get-SIIdentityScopeValue $Record 'si_identity_type')).Trim().ToLowerInvariant()
|    $oid = ([string]@(Get-SIIdentityScopeList (Get-SIIdentityScopeValue $Record 'entra_object_id'))[0]).Trim()
|    $neverSynced = Get-SIIdentityNeverSyncedSetting -Choice $Choice
|    if ($type -eq 'user' -and -not $oid -and $neverSynced) {
|        $wide = ($neverSynced -eq $script:SIIdentityScopeSettings.SkipNeverSyncedAd.Setting)
|        if ($wide) {
|            # the wider switch never leaves out a node that is not an AD account: a record without an AD sign keeps the
|            # usual "not seen" grace
|            $adSid = ([string]@(Get-SIIdentityScopeList (Get-SIIdentityScopeValue $Record 'ad_sid'))[0]).Trim()
|            $sam = [string](Get-SIIdentityScopeValue $Record 'si_sam_account_name')
|            $dom = [string](Get-SIIdentityScopeValue $Record 'si_ad_domain')
|            if (-not ($adSid -match '^(?i)s-1-5-21-') -and -not ($sam.Trim() -and $dom.Trim())) { return $no }
|        }
|        $ac = 0; if ([int]::TryParse([string](Get-SIIdentityScopeValue $Record 'si_admin_count'), [ref]$ac) -and $ac -gt 0) { return $no }
|        if (@(Get-SIIdentityScopeList (Get-SIIdentityScopeValue $Record 'si_ad_critical_groups')).Count -gt 0) { return $no }
|        if ((ConvertTo-SIIdentityScopeFlag (Get-SIIdentityScopeValue $Record 'si_is_sensitive_account')) -eq $true) { return $no }
|        if ((ConvertTo-SIIdentityScopeFlag (Get-SIIdentityScopeValue $Record 'si_is_service_account')) -eq $true) { return $no }
|        $crit = Get-SIIdentityScopeValue $Record 'si_ms_criticality'
|        if ($null -ne $crit -and "$crit".Trim() -ne '') { return $no }
|        if ($wide) {
|            return [pscustomobject]@{ Gone = $true; Reason = 'left out by the install''s choice SI_Identity_SkipNeverSyncedAd: an on-premises AD account never synced to Entra ID that the Exposure Graph no longer lists as privileged' }
|        }
|        return [pscustomobject]@{ Gone = $true; Reason = 'left out by the install''s choice SI_Identity_SkipNeverSyncedDisabledAd: an on-premises AD account never synced to Entra ID that the Exposure Graph no longer lists as enabled or privileged' }
|    }
|    if ($type -eq 'group' -and $oid -and $Choice.SkipDeletedGroups) {
|        return [pscustomobject]@{ Gone = $true; Reason = 'left out by the install''s choice SI_Identity_SkipDeletedGroups: a group Entra ID no longer has (neither active nor in its deleted items)' }
|    }
|    return $no
|}
'@ }
$__siSupportFiles['engine/asset-profiling/shared/SI-AssetName.ps1'] = @{ Sha256 = '3ea6186fc778998f9b99042bff7a3be25e8746290fe239b35feddd7ca519330c'; Text = @'
|#Requires -Version 5.1
|<#
|    SI v3 -- THE SYNTHETIC ASSET NAME. One rule, one place, four engines.
|
|    🔒 THE CONTRACT SI_AssetName MAKES: it is NEVER blank. When no source anywhere holds a name for an
|    asset, this produces a marked stand-in rather than a blank or a bare identifier.
|
|    🔴 WHY NOT JUST USE THE ID -- the question this file exists to answer. Falling back to the raw
|    identifier satisfies "never blank" and looks like data. MEASURED 2026-08-27: 78 of 198 endpoint rows
|    already carried a 40-hex MDE machine id in AssetName, and it reached the customer's Excel looking
|    exactly like a hostname that happened to be unreadable. A marked value says the true thing instead:
|    NOTHING KNOWS THIS ASSET'S NAME. Same stability, same uniqueness, no false impression.
|
|    🔑 PROPERTIES THAT MATTER, and each one is asserted by a test:
|      * DETERMINISTIC -- derived only from the id. No clock, no random, no run id. The same asset gets
|        the same synthetic name on every run, forever, which is what makes it safe to show in a report
|        and safe to group by.
|      * UNIQUE -- the id is unique per asset, so the name is too. Reports that group or count by name
|        stay correct; a shared placeholder would silently merge distinct assets into one row, which is
|        this codebase's oldest scar (a blank join key manufacturing 296 findings, v2.2.442).
|      * RECOGNISABLE -- the 'unnamed-' prefix is a contract a consumer can test without parsing.
|      * HARMLESS TO CMDB MATCHING -- it will never match a real CI, which is CORRECT: these assets have
|        no name to match on. A raw hash never matched either, so nothing regresses.
|
|    NO Set-StrictMode here -- it leaks into the caller's scope (measured 2026-08-12).
|#>
|
|function Get-SISyntheticAssetName {
|    <#
|        -Engine  'endpoint' | 'azure' | 'identity' | 'publicip'
|        -Id      the asset's stable identifier (PrimaryEntityId)
|
|        Returns 'unnamed-<engine>-<8 chars of the id>', or $null when there is no id at all -- because
|        with no id there is nothing stable to build from, and inventing one would be worse than a blank.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][AllowEmptyString()][string]$Engine,
|        [Parameter(Mandatory)][AllowEmptyString()][string]$Id
|    )
|
|    if ([string]::IsNullOrWhiteSpace($Id)) { return $null }
|
|    $eng = ([string]$Engine).Trim().ToLowerInvariant()
|    if ([string]::IsNullOrWhiteSpace($eng)) { $eng = 'asset' }
|
|    # 🪤 Strip to alphanumerics BEFORE truncating. Ids in this estate include ARM paths
|    # (/subscriptions/.../virtualMachines/x) and IP addresses -- taking the first 8 characters raw would
|    # yield '/subscri' for every Azure resource on earth, which is a shared placeholder wearing a unique
|    # name. Stripping first means the 8 characters carry actual entropy.
|    $clean = ($Id -replace '[^A-Za-z0-9]', '')
|    if ([string]::IsNullOrWhiteSpace($clean)) {
|        # An id made entirely of punctuation is not something to guess at.
|        return $null
|    }
|
|    # 🪤 And take the TAIL, not the head. An ARM resource id's entropy is at the end (the resource name);
|    # its first characters are the subscription guid, shared by every resource in the subscription.
|    $take = [Math]::Min(8, $clean.Length)
|    $frag = $clean.Substring($clean.Length - $take, $take).ToLowerInvariant()
|
|    return ('unnamed-{0}-{1}' -f $eng, $frag)
|}
|
|function Test-SISyntheticAssetName {
|    <# Is this value one of ours? A contract a consumer can test without parsing the shape. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Value)
|    if ([string]::IsNullOrWhiteSpace($Value)) { return $false }
|    return ($Value -like 'unnamed-*')
|}
'@ }
$__siSupportFiles['engine/risk-analysis/_shared/RA-Mail.ps1'] = @{ Sha256 = '34513dce339cd6a586eb628b8319290c4300ccef8e7481cbe9b9ce0c6a5b375c'; Text = @'
|#######################################################################################################
|#  SecurityInsight - Risk Analysis engine
|#  SMTP delivery: the anonymous and authenticated send paths.
|#
|#  The two transports the mail step chooses between. Separated so a change to delivery cannot be
|#  confused with a change to what is being delivered.
|#
|#  AUDIT #16: moved VERBATIM out of Invoke-RiskAnalysis.ps1 on 2026-08-05. Dot-sourced back in at
|#  exactly the position it occupied, so load order is unchanged. Every function body is
|#  byte-identical to before the move - verified with tests/Get-EngineFunctionInventory.ps1,
|#  which compares a SHA-256 of each function's source text before and after.
|#
|#  Do NOT add $PSScriptRoot-dependent code here: in this file it resolves to _shared/, one level
|#  deeper than the engine root the main script derives $siRoot from.
|#######################################################################################################
|
|function Test-SIMailAttachmentFits {
|    <#
|        Will this file fit inside the relay's message-size limit once it is attached?
|
|        🔑 THE ANSWER IS NOT THE FILE SIZE. MIME attachments are base64-encoded, which inflates them
|        by ~37%, so a 10 MB workbook is ~13.7 MB of message. A check against the on-disk size passes
|        and the relay still rejects -- and an oversized attachment does not arrive truncated, it takes
|        the WHOLE MESSAGE with it. The operator then loses the AI summary and the findings as well as
|        the spreadsheet, which is the opposite of the intended trade.
|
|        Pure and parameterised so the boundary is provable without a mail server or a 250 MB file.
|        Returns the numbers as well as the verdict, because the caller has to tell the operator what
|        was too big and by how much.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][long]$SizeBytes,
|        [Parameter()][double]$MaxMb = 24
|    )
|    $encodedMb = [Math]::Round(($SizeBytes * 1.37) / 1MB, 1)
|    [pscustomobject]@{
|        DiskMb    = [Math]::Round($SizeBytes / 1MB, 1)
|        EncodedMb = $encodedMb
|        MaxMb     = $MaxMb
|        Fits      = ($encodedMb -le $MaxMb)
|    }
|}
|
|function Get-RAMailSubject {
|    <# The Risk Analysis mail subject's <what happened> (MAIL-3, #653: the transport -- Get-SIMailSubject -- adds the
|       environment in front and '[SecurityInsight]' at the end, so the product is not named here). -TenantTag is
|       Get-SITenantDisplayName's '<domain> (<tenant id>)' (#243); empty leaves the tenant out. -NotComplete: a report of
|       this run is NOT COMPLETE (#641) -- the subject starts with the severity word 'Failed'. #>
|    param([string]$ReportTemplate, [string]$TenantTag, [switch]$NotComplete)
|    $s = if ($NotComplete) { 'Failed: Risk Analysis not complete | {0}' -f $ReportTemplate } else { 'Risk Analysis | {0}' -f $ReportTemplate }
|    if (-not [string]::IsNullOrWhiteSpace($TenantTag)) { $s += (' | {0}' -f $TenantTag.Trim()) }
|    return $s
|}
|
|function Get-RAMailReportName {
|    <# PURE. The report as the mail BODY names it: "Summary report" / "Detailed report" -- never the internal template id
|       ('RiskAnalysis_Summary_Bucket'); a template that is neither keeps its own name. #>
|    param([AllowNull()][AllowEmptyString()][string]$ReportTemplate)
|    $g = $null
|    if (Get-Command -Name Get-RAReportGrainLabel -ErrorAction SilentlyContinue) { try { $g = Get-RAReportGrainLabel -ReportTemplate $ReportTemplate } catch { $g = $null } }
|    if (-not $g) { if ("$ReportTemplate" -match '(?i)summary') { $g = 'Summary' } elseif ("$ReportTemplate" -match '(?i)detail') { $g = 'Detailed' } }
|    if ($g) { return ('{0} report' -f $g) }
|    "$ReportTemplate".Trim()
|}
|
|function Send-MailAnonymous {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)] [string]$SmtpServer,
|        [Parameter(Mandatory)] [int]$Port,
|        [Parameter()] [bool]$UseSsl = $false,
|
|        [Parameter(Mandatory)] [string]$From,
|        [Parameter(Mandatory)] [string[]]$To,
|        [Parameter(Mandatory)] [string]$Subject,
|        [Parameter(Mandatory)] [string]$BodyHtml,
|
|        [Parameter()] [string[]]$Attachments,
|        [Parameter()] [ValidateSet('Normal','High','Low')] [string]$Priority = 'High'
|    )
|
|    # v2.2.247 -- diagnostic-rich anonymous send. NEVER throws (operator: "no
|    # -stop as script must continue"). Returns $true on success, $false on
|    # failure, with the relay's actual status code / .NET exception chain
|    # printed inline so the operator can see WHY mail didn't arrive instead
|    # of a green "[OK] anonymous mail sent" line that lied about success.
|    #
|    # Two phases:
|    #   1. TCP pre-flight (5s, async with timeout). If we can't even open a
|    #      socket -- DNS failure, firewall ACL, listener down, source-IP
|    #      restriction -- skip the cmdlet call entirely and log the cause.
|    #   2. Send-MailMessage with -ErrorAction SilentlyContinue + -ErrorVariable.
|    #      Any non-terminating error from the cmdlet now lands in $smtpErr
|    #      instead of getting swallowed; we walk the .NET exception chain
|    #      (SmtpException -> SmtpStatusCode, InnerException) and print each
|    #      level. Then return $false so the caller knows not to log [OK].
|
|    Write-Output ("Sending mail (anonymous) to {0} with subject '{1}'" -f ($To -join ', '), $Subject)
|
|    # 1. TCP pre-flight
|    try {
|        $tcp = New-Object System.Net.Sockets.TcpClient
|        $iar = $tcp.BeginConnect($SmtpServer, $Port, $null, $null)
|        if (-not $iar.AsyncWaitHandle.WaitOne(5000, $false)) {
|            $tcp.Close()
|            Write-Output ("   TCP pre-flight FAILED (5s timeout) -- {0}:{1}" -f $SmtpServer, $Port)
|            Write-Output  "   (likely cause: DNS resolution slow / wrong, firewall ACL silently dropping, listener not on this port)"
|            return $false
|        }
|        $tcp.EndConnect($iar)
|        $tcp.Close()
|        Write-Output ("   TCP pre-flight OK -- {0}:{1} accepted connection" -f $SmtpServer, $Port)
|    } catch {
|        Write-Output ("   TCP pre-flight FAILED -- {0}:{1} :: {2}" -f $SmtpServer, $Port, $_.Exception.Message)
|        Write-Output  "   (likely cause: DNS resolution, firewall ACL, listener down, or relay restricting source IP)"
|        return $false
|    }
|
|    $params = @{
|        SmtpServer  = $SmtpServer
|        Port        = $Port
|        From        = $From
|        To          = $To
|        Subject     = $Subject
|        Body        = $BodyHtml
|        BodyAsHtml  = $true
|        Encoding    = 'UTF8'
|        Priority    = $Priority
|        ErrorAction = 'SilentlyContinue'
|    }
|    if ($UseSsl) { $params.UseSsl = $true }
|    if ($Attachments -and $Attachments.Count -gt 0) { $params.Attachments = $Attachments }
|
|    # 2. Send; capture any non-terminating error so we can surface details
|    $smtpErr = $null
|    Send-MailMessage @params -ErrorVariable smtpErr 2>$null
|
|    if ($smtpErr -and $smtpErr.Count -gt 0) {
|        Write-Output  "   SMTP send FAILED -- relay rejected or cmdlet hit a non-terminating error:"
|        foreach ($er in $smtpErr) {
|            $ex = $er.Exception
|            if ($null -eq $ex) { continue }
|            Write-Output ("   Exception type : {0}" -f $ex.GetType().FullName)
|            Write-Output ("   Message        : {0}" -f $ex.Message)
|            if ($ex.PSObject.Properties['StatusCode']) {
|                Write-Output ("   SMTP StatusCode: {0}" -f $ex.StatusCode)
|            }
|            $inner = $ex.InnerException
|            $depth = 0
|            while ($inner -and $depth -lt 5) {
|                Write-Output ("   InnerException : [{0}] {1}" -f $inner.GetType().FullName, $inner.Message)
|                if ($inner.PSObject.Properties['StatusCode']) {
|                    Write-Output ("   Inner StatusCode: {0}" -f $inner.StatusCode)
|                }
|                $inner = $inner.InnerException
|                $depth++
|            }
|        }
|        Write-Output  "   (common causes: relay requires AUTH, sender not whitelisted, RBL block, SPF/DMARC reject, TLS handshake mismatch)"
|        return $false
|    }
|
|    return $true
|}
|
|function Send-MailSecure {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)] [string]$SmtpServer,
|        [Parameter(Mandatory)] [int]$Port,
|        [Parameter()] [bool]$UseSsl = $false,
|
|        [Parameter(Mandatory)] [pscredential]$Credential,
|        [Parameter(Mandatory)] [string]$From,
|        [Parameter(Mandatory)] [string[]]$To,
|        [Parameter(Mandatory)] [string]$Subject,
|        [Parameter(Mandatory)] [string]$BodyHtml,
|
|        [Parameter()] [string[]]$Attachments,
|        [Parameter()] [ValidateSet('Normal','High','Low')] [string]$Priority = 'High'
|    )
|
|    $params = @{
|        SmtpServer  = $SmtpServer
|        Port        = $Port
|        Credential  = $Credential
|        From        = $From
|        To          = $To
|        Subject     = $Subject
|        Body        = $BodyHtml
|        BodyAsHtml  = $true
|        Encoding    = 'UTF8'
|        Priority    = $Priority
|    }
|
|    if ($UseSsl) { $params.UseSsl = $true }
|    if ($Attachments -and $Attachments.Count -gt 0) { $params.Attachments = $Attachments }
|
|    Write-Output ("Sending mail (secure) to {0} with subject '{1}'" -f ($To -join ', '), $Subject)
|    # A refused mail is a NON-terminating error by default, so the caller used to print "secure mail sent" after a
|    # rejection. Stop makes it throw; the callers catch it and print the relay's error (mail stays non-fatal for RA).
|    $params.ErrorAction = 'Stop'
|    Send-MailMessage @params
|}
'@ }
$__siSupportFiles['engine/_shared/SI-GuardHeal.ps1'] = @{ Sha256 = 'e9f0e8596f26a0a661390b8f0b662c2b76c0e942bd994a7c0b7271a2ac7cf3c5'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- GUARDS HEAL THEMSELVES, SAY WHICH RELEASE THEY TRIPPED ON, AND CAN BE ACCEPTED (owner 2026-10-17:
|    "can a guard autoheal itself if it was caused by bug in code and new release fix it. it must"; "can you make a way that
|    i can accept an guard everywhere by email or support app").
|
|    THREE THINGS, one file (loaded by SI-Guard.ps1; every function that talks to a store or a transport NEVER throws):
|
|    1. AUTO-HEAL. A guard that held or warned is an OPEN EPISODE in the guard state (cfg.GuardState on Pro, else the small
|       file / memory store of SI-Guard.ps1). Where a guard is checked, the caller names what it checked (Invoke-SIGuardCalls
|       -Checked) and whether the run was COMPLETE. A checked guard that did not trip, in a complete run, whose measured
|       values are within their limits again, CLEARS its episode (Get-SIGuardHealDecision, pure):
|         * the episode keeps who cleared it and when (ClearedUtc / ClearedRunId / ClearedVersion / ClearedHow);
|         * one cfg.GuardEvent row, Outcome 'cleared', "Back to normal in run <id> on version <v>";
|         * one run-health row (Phase Guard, ExitReason guard-cleared);
|         * Invardia gets the guard report GuardOutcome 'cleared', ClearedBy 'passed' (its receiver closes the ticket);
|         * nothing is mailed.
|       A run that is NOT complete never clears anything, and a run that trips again keeps the episode open. A held set
|       (cfg.GuardRelease) is never applied by a heal: the newer complete run decides again under the current rules and the
|       older held set is superseded by that run's own code (only current holds), so nothing is lost and no short
|       collection is published.
|
|    2. RELEASE ATTRIBUTION. Every trip carries the SecurityInsight version it happened on and the version before it, from
|       the guard's VERSION MARKER (state key 'ver|<guard key>': the version this check last ran on, the one before, the
|       first run on it, and whether that first run tripped). Get-SIGuardAttribution (pure) says it in plain words: "the
|       first run after the update to <v> (from <p>)" (our update is the likely cause), or "this check has run on <v> since
|       <time>" (a change in the source is more likely). A marker written by a passing check (kind 'check') is what makes
|       "first run after the update" a claim; a guard whose caller names no checks only compares with its own last trip.
|
|    3. ACCEPT EVERYWHERE. The owner accepts a guard situation at an install -- by guard id and a version range (or one
|       guard key) -- through the procedure cfg.GuardAcceptSet (sql\si-pro-settings.sql; setup\Invoke-SIGuardAcceptEverywhere.ps1
|       runs it through the Invardia Support app, one install at a time). The trips it covers are acknowledged, their
|       episodes cleared (Invardia is told ClearedBy 'released' by the mail job), and a held set is released only through
|       the release path with its checks (held, not expired, the plan the hash names). A later trip on a version inside an
|       accepted range is still recorded, but not mailed and not reported again (Test-SIGuardAcceptCovers, pure).
|
|    PS 5.1 and 7. No modules.
|#>
|
|$script:SIGuardHeal = @{
|    MarkerPrefix = 'ver|'
|    Hows         = @('passed', 'released', 'accepted', 'taken')
|    AuditClear   = 'guard.event.clear'
|}
|
|function Get-SIGuardHealSettings {
|    <#
|        This file's constants (and the run version it caches), read ONLY through here. $script: is the script scope of
|        the CALLER, not of this file: a script that runs after another one loaded this file (the vulnerability close-loop
|        runs itself again as a new script; a launcher loads the guards first) has no $script:SIGuardHeal, and reading it
|        failed every clear check with "You cannot call a method on a null-valued expression" (live 2026-10-19). A scope
|        without it gets the same constants.
|    #>
|    if ($null -eq $script:SIGuardHeal) {
|        $script:SIGuardHeal = @{ MarkerPrefix = 'ver|'; Hows = @('passed', 'released', 'accepted', 'taken'); AuditClear = 'guard.event.clear' }
|    }
|    $script:SIGuardHeal
|}
|
|# =====================================================================================================================
|#  Small helpers -- PURE
|# =====================================================================================================================
|function Get-SIGuardField {
|    <# PURE. One field of a hashtable / object / data row; $null when it is not there (DBNull reads $null). #>
|    param($Object, [Parameter(Mandatory)][string]$Name)
|    if ($null -eq $Object) { return $null }
|    $v = $null
|    if ($Object -is [System.Collections.IDictionary]) { if ($Object.Contains($Name)) { $v = $Object[$Name] } }
|    elseif ($Object -is [System.Data.DataRow]) { if ($Object.Table.Columns.Contains($Name)) { $v = $Object[$Name] } }
|    elseif ($Object.PSObject.Properties[$Name]) { $v = $Object.$Name }
|    if ($v -is [System.DBNull]) { return $null }
|    $v
|}
|
|function ConvertTo-SIGuardVersionParts {
|    <# PURE. '3.0.0.2138' -> 3,0,0,2138; '3.0.0-rc.12+0dc9062' -> 3,0,0,0 (the numeric part, padded to four); '' or not a
|       version -> $null. More than four parts -> $null. #>
|    param([AllowNull()][AllowEmptyString()][string]$Version)
|    $s = ([string]$Version).Trim()
|    $m = [regex]::Match($s, '^[0-9]+(\.[0-9]+)*')
|    if (-not $m.Success) { return $null }
|    $parts = @($m.Value.Split('.'))
|    if ($parts.Count -gt 4) { return $null }
|    $out = New-Object System.Collections.Generic.List[long]
|    foreach ($p in $parts) { $n = 0L; if (-not [long]::TryParse($p, [ref]$n)) { return $null }; $out.Add($n) }
|    while ($out.Count -lt 4) { $out.Add(0) }
|    , $out.ToArray()
|}
|
|function Compare-SIGuardVersion {
|    <# PURE. -1 / 0 / 1 for A < = > B by their numeric parts; $null when either is not a version. #>
|    param([AllowNull()][AllowEmptyString()][string]$A, [AllowNull()][AllowEmptyString()][string]$B)
|    # (not $a / $b: PowerShell names are case-blind, and -A / -B are [string] -- the parts would turn back into text)
|    $pa = ConvertTo-SIGuardVersionParts $A; $pb = ConvertTo-SIGuardVersionParts $B
|    if ($null -eq $pa -or $null -eq $pb) { return $null }
|    for ($i = 0; $i -lt 4; $i++) { if ($pa[$i] -lt $pb[$i]) { return -1 }; if ($pa[$i] -gt $pb[$i]) { return 1 } }
|    0
|}
|
|function Test-SIGuardVersionInRange {
|    <# PURE. Is -Version within [-From, -To] (either bound may be empty = open)? No bound at all = $true. A version that is
|       not one (empty, unreadable) is never inside a range that has a bound. #>
|    param([AllowNull()][AllowEmptyString()][string]$Version, [AllowNull()][AllowEmptyString()][string]$From, [AllowNull()][AllowEmptyString()][string]$To)
|    $f = ([string]$From).Trim(); $t = ([string]$To).Trim()
|    if (-not $f -and -not $t) { return $true }
|    if ($f) { $c = Compare-SIGuardVersion $Version $f; if ($null -eq $c -or $c -lt 0) { return $false } }
|    if ($t) { $c = Compare-SIGuardVersion $Version $t; if ($null -eq $c -or $c -gt 0) { return $false } }
|    $true
|}
|
|function Get-SIGuardRunVersion {
|    <# The SecurityInsight version this process runs (the release, e.g. 3.0.0.2138): $global:SI_GuardVersionOverride (a
|       test's), else the telemetry's release version, else the VERSION file. Cached for the process. '' when unknown. #>
|    if ($null -ne $global:SI_GuardVersionOverride) { return [string]$global:SI_GuardVersionOverride }
|    $gh = Get-SIGuardHealSettings
|    if ($gh.ContainsKey('Version') -and $null -ne $gh.Version) { return [string]$gh.Version }
|    $v = ''
|    try { if (Get-Command -Name Get-SITelemetryReleaseVersion -ErrorAction SilentlyContinue) { $v = [string](Get-SITelemetryReleaseVersion) } } catch { $v = '' }
|    if (-not $v.Trim()) {
|        try {
|            $f = [System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'VERSION')
|            if ([System.IO.File]::Exists($f)) { $v = ([System.IO.File]::ReadAllText($f)).Trim() }
|        } catch { $v = '' }
|    }
|    $gh.Version = $v.Trim()
|    $gh.Version
|}
|
|function Get-SIGuardKeyFor {
|    <# PURE. The guard key of a guard id and subject -- the same rule as New-SIGuardEvent. #>
|    param([Parameter(Mandatory)][string]$GuardId, [AllowNull()][AllowEmptyString()][string]$Subject)
|    $sub = ([string]$Subject).Trim(); if ($sub.Length -gt 400) { $sub = $sub.Substring(0, 400) }
|    if ($sub) { $GuardId + '|' + $sub.ToLowerInvariant() } else { $GuardId }
|}
|
|# =====================================================================================================================
|#  2. RELEASE ATTRIBUTION -- PURE
|# =====================================================================================================================
|function Get-SIGuardVersionMarker {
|    <# PURE. A stored marker row/object -> @{ Version; PreviousVersion; FirstRunId; SinceUtc; Kind; FirstRunTripped }, or
|       $null when there is none (or it names no version). A marker row in cfg.GuardState keeps SinceUtc in FirstSeenUtc and
|       FirstRunTripped in TripCount (1 / 0). #>
|    param($Stored)
|    if ($null -eq $Stored) { return $null }
|    $v = [string](Get-SIGuardField $Stored 'Version')
|    if (-not $v.Trim()) { return $null }
|    $since = Get-SIGuardField $Stored 'SinceUtc'; if ($null -eq $since) { $since = Get-SIGuardField $Stored 'FirstSeenUtc' }
|    $ft = Get-SIGuardField $Stored 'FirstRunTripped'
|    if ($null -eq $ft) { $tc = 0; [void][int]::TryParse([string](Get-SIGuardField $Stored 'TripCount'), [ref]$tc); $ft = ($tc -gt 0) }
|    $kind = [string](Get-SIGuardField $Stored 'MarkerKind'); if (-not $kind) { $kind = [string](Get-SIGuardField $Stored 'Kind') }
|    [pscustomobject]@{ Version = $v.Trim(); PreviousVersion = ([string](Get-SIGuardField $Stored 'PreviousVersion')).Trim(); FirstRunId = [string](Get-SIGuardField $Stored 'FirstRunId')
|                       SinceUtc = (ConvertTo-SIGuardHealUtc $since); Kind = $(if ($kind -eq 'check') { 'check' } else { 'trip' }); FirstRunTripped = [bool]$ft }
|}
|
|function ConvertTo-SIGuardHealUtc {
|    <# PURE. A stored time as UTC, or $null. A text without a zone is read AS UTC. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -is [System.DBNull] -or "$Value".Trim() -eq '') { return $null }
|    if ($Value -is [datetime]) { if ($Value.Kind -eq [DateTimeKind]::Local) { return $Value.ToUniversalTime() }; return [datetime]::SpecifyKind($Value, [DateTimeKind]::Utc) }
|    $d = [datetime]::MinValue
|    $styles = [System.Globalization.DateTimeStyles]::AssumeUniversal -bor [System.Globalization.DateTimeStyles]::AdjustToUniversal
|    if ([datetime]::TryParse("$Value", [System.Globalization.CultureInfo]::InvariantCulture, $styles, [ref]$d)) { return $d }
|    $null
|}
|
|function Update-SIGuardVersionMarker {
|    <#
|        PURE. The marker after this run's check of the guard. -Marker: the one before (Get-SIGuardVersionMarker) or $null;
|        -Kind 'check' (the caller names its checks, so a pass is recorded) or 'trip'; -Tripped: this run tripped it.
|          no marker / another version  a new marker: this version, the one before it, this run as the first on it
|          the same version             kept; the first run's trip is remembered when this IS the first run
|        A marker of kind 'check' stays 'check' (passes are recorded for this guard).
|    #>
|    param($Marker, [AllowEmptyString()][string]$Version, [string]$RunId, [Parameter(Mandatory)][datetime]$NowUtc, [ValidateSet('check', 'trip')][string]$Kind = 'trip', [bool]$Tripped = $false)
|    $v = ([string]$Version).Trim()
|    if (-not $v) { return $Marker }
|    $kind = if ($Kind -eq 'check' -or ($Marker -and $Marker.Kind -eq 'check')) { 'check' } else { 'trip' }
|    if (-not $Marker -or $Marker.Version -ne $v) {
|        return [pscustomobject]@{ Version = $v; PreviousVersion = $(if ($Marker) { [string]$Marker.Version } else { '' }); FirstRunId = [string]$RunId
|                                  SinceUtc = $NowUtc.ToUniversalTime(); Kind = $kind; FirstRunTripped = [bool]$Tripped }
|    }
|    $ft = [bool]$Marker.FirstRunTripped -or ($Tripped -and [string]$RunId -and [string]$RunId -eq [string]$Marker.FirstRunId)
|    [pscustomobject]@{ Version = $Marker.Version; PreviousVersion = [string]$Marker.PreviousVersion; FirstRunId = [string]$Marker.FirstRunId
|                       SinceUtc = $Marker.SinceUtc; Kind = $kind; FirstRunTripped = $ft }
|}
|
|function Get-SIGuardAttribution {
|    <#
|        PURE. Which release a trip happened on, in plain words. -Marker: the guard's marker BEFORE this run (or $null);
|        -Version: the version this run is on; -RunId: this run. Returns @{ Version; PreviousVersion; FirstRunAfterUpdate;
|        AfterUpdate (the update is the likely cause); Text }.
|          the first run after an update (the check last ran on another version, a recorded pass or trip)
|                                -> "This happened in the first run after the update to <v> (from <p>) ..."
|          the same version, its first run tripped too
|                                -> "It has tripped since the first run after the update to <v> (from <p>) ..."
|          the same version, it ran on it before without tripping in its first run (passes recorded)
|                                -> "This check has run on version <v> since <time> ... a change in the data source ..."
|          nothing known         -> "This happened on version <v>."
|        A marker made only by earlier TRIPS (the caller names no checks) never claims "first run after the update": it says
|        on which version the check last tripped.
|    #>
|    param($Marker, [AllowEmptyString()][string]$Version, [string]$RunId)
|    $v = ([string]$Version).Trim()
|    $out = [ordered]@{ Version = $v; PreviousVersion = ''; FirstRunAfterUpdate = $false; AfterUpdate = $false; Text = '' }
|    if (-not $v) { return [pscustomobject]$out }
|    if (-not $Marker) { $out.Text = ('This happened on version {0}.' -f $v); return [pscustomobject]$out }
|    if ($Marker.Version -ne $v) {
|        $out.PreviousVersion = [string]$Marker.Version
|        if ($Marker.Kind -eq 'check') {
|            $out.FirstRunAfterUpdate = $true; $out.AfterUpdate = $true
|            $out.Text = ('This happened in the first run after the update to {0} (from {1}). The update is the likely cause, not a change in your data source.' -f $v, $Marker.Version)
|        } else {
|            $out.Text = ('This happened on version {0}; the last time this check tripped, it was version {1}.' -f $v, $Marker.Version)
|        }
|        return [pscustomobject]$out
|    }
|    $out.PreviousVersion = [string]$Marker.PreviousVersion
|    $first = [string]$RunId -and [string]$RunId -eq [string]$Marker.FirstRunId
|    if ($Marker.PreviousVersion -and ($first -or $Marker.FirstRunTripped) -and $Marker.Kind -eq 'check') {
|        $out.AfterUpdate = $true; $out.FirstRunAfterUpdate = [bool]$first
|        $out.Text = if ($first) { ('This happened in the first run after the update to {0} (from {1}). The update is the likely cause, not a change in your data source.' -f $v, $Marker.PreviousVersion) }
|                    else { ('This has tripped since the first run after the update to {0} (from {1}). The update is the likely cause, not a change in your data source.' -f $v, $Marker.PreviousVersion) }
|        return [pscustomobject]$out
|    }
|    if ($Marker.Kind -eq 'check' -and $Marker.SinceUtc) {
|        $out.Text = ('This happened on version {0}, which this check has run on since {1:yyyy-MM-dd HH:mm} UTC without tripping at first. A change in your data source is more likely than the update.' -f $v, ([datetime]$Marker.SinceUtc))
|        return [pscustomobject]$out
|    }
|    $out.Text = ('This happened on version {0}.' -f $v)
|    [pscustomobject]$out
|}
|
|# =====================================================================================================================
|#  1. AUTO-HEAL -- PURE decision
|# =====================================================================================================================
|function Test-SIGuardValueWithinLimit {
|    <# PURE. One measured value against its limit: a NEGATIVE limit is a floor (a drop of -30 %: within while the change is
|       above it), any other limit a ceiling (within while at or below it). No limit or no measurement = within. #>
|    param($Value)
|    $m = Get-SIGuardField $Value 'Measured'; $l = Get-SIGuardField $Value 'Limit'
|    if ($null -eq $m -or $null -eq $l -or "$m".Trim() -eq '' -or "$l".Trim() -eq '') { return $true }
|    $md = 0.0; $ld = 0.0
|    $ic = [System.Globalization.CultureInfo]::InvariantCulture
|    if (-not [double]::TryParse("$m", [System.Globalization.NumberStyles]::Float, $ic, [ref]$md)) { return $true }
|    if (-not [double]::TryParse("$l", [System.Globalization.NumberStyles]::Float, $ic, [ref]$ld)) { return $true }
|    if ($ld -lt 0) { return ($md -gt $ld) }
|    ($md -le $ld)
|}
|
|function Test-SIGuardEpisodeOpen {
|    <# PURE. An episode (a cfg.GuardState row) is open when it has a trip that no clear came after. A version marker
|       ('ver|') or a cause key ('cause|') is never an episode. #>
|    param($Episode, [string]$Key = '')
|    if ($null -eq $Episode) { return $false }
|    if ($Key -match '^(ver|cause)\|') { return $false }
|    $last = ConvertTo-SIGuardHealUtc (Get-SIGuardField $Episode 'LastSeenUtc')
|    if ($null -eq $last) { return $false }
|    $tc = 0; [void][int]::TryParse([string](Get-SIGuardField $Episode 'TripCount'), [ref]$tc)
|    if ($tc -lt 1) { return $false }
|    $cl = ConvertTo-SIGuardHealUtc (Get-SIGuardField $Episode 'ClearedUtc')
|    -not ($cl -and $cl -ge $last)
|}
|
|function Get-SIGuardHealDecision {
|    <#
|        PURE. Does this run clear the guard's open episode? -Episode: its state (or $null); -Tripped: it tripped in this run;
|        -Complete: the run was complete; -Values: this run's measured values against their limits (optional).
|        Returns @{ Decision ('none' | 'stays' | 'cleared'); Reason }:
|          none     no open episode (never tripped, or cleared already)
|          stays    it tripped again; or the run was not complete (only a complete run shows the level is normal); or a
|                   measured value is still outside its limit
|          cleared  a complete run, no trip, every value within its limit -- whatever version it runs (the release that
|                   fixed it, or the same one when the source came back)
|    #>
|    param($Episode, [string]$Key = '', [bool]$Tripped = $false, [bool]$Complete = $false, [object[]]$Values = @())
|    if (-not (Test-SIGuardEpisodeOpen -Episode $Episode -Key $Key)) { return [pscustomobject]@{ Decision = 'none'; Reason = 'no open episode' } }
|    if ($Tripped) { return [pscustomobject]@{ Decision = 'stays'; Reason = 'it tripped again in this run' } }
|    if (-not $Complete) { return [pscustomobject]@{ Decision = 'stays'; Reason = 'this run was not complete -- only a complete run can show the level is normal again' } }
|    foreach ($v in @($Values | Where-Object { $_ })) {
|        if (-not (Test-SIGuardValueWithinLimit $v)) {
|            $lb = [string](Get-SIGuardField $v 'Label'); if (-not $lb) { $lb = [string](Get-SIGuardField $v 'Name') }
|            return [pscustomobject]@{ Decision = 'stays'; Reason = ('still outside its limit: {0} {1} (limit {2})' -f $lb, (Get-SIGuardField $v 'Measured'), (Get-SIGuardField $v 'Limit')) }
|        }
|    }
|    [pscustomobject]@{ Decision = 'cleared'; Reason = 'a complete run is back at the normal level' }
|}
|
|function Format-SIGuardClearText {
|    <# PURE. The plain sentence of a clear: "Back to normal in run <id> on version <v>." (+ the run's own words), or for an
|       acceptance "Accepted by <who>: <reason>." #>
|    param([ValidateSet('passed', 'released', 'accepted', 'taken')][string]$How = 'passed', [string]$RunId, [string]$Version, [string]$Detail, [string]$By, [string]$Reason)
|    $t = switch ($How) {
|        'accepted' { 'Accepted by {0}: {1}' -f $(if ($By) { $By } else { 'the owner' }), $(if ($Reason) { $Reason.Trim().TrimEnd('.') } else { 'no reason given' }) }
|        'released' { 'Released by {0}' -f $(if ($By) { $By } else { 'an Admin' }) }
|        # NOT a heal (owner review 2026-10-17): the lower level is real as far as SecurityInsight can tell
|        'taken'    { 'Taken as the new level after 2 runs at the same level -- not back to normal; check the source if this drop is not expected' }
|        default    { 'Back to normal in run {0} on version {1}' -f $(if ($RunId) { $RunId } else { '(unknown)' }), $(if ($Version) { $Version } else { '(unknown)' }) }
|    }
|    $t = $t.TrimEnd('.') + '.'
|    if (([string]$Detail).Trim()) { $t += ' ' + ([string]$Detail).Trim() }
|    $t
|}
|
|# =====================================================================================================================
|#  3. ACCEPT -- PURE coverage
|# =====================================================================================================================
|function Test-SIGuardAcceptCovers {
|    <#
|        PURE. Does an owner's acceptance cover this trip? -Accepts: cfg.GuardAccept rows of the guard (GuardKey, FromVersion,
|        ToVersion, AcceptedUtc, RevokedUtc). Covered = the same guard key (an acceptance without a key covers every key of
|        the guard), the trip's version inside [FromVersion, ToVersion], and -- for an acceptance with NO upper bound -- only a
|        trip at or before the acceptance (an open-ended acceptance never mutes the future). Returns the covering row or $null.
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Accepts, [Parameter(Mandatory)][string]$GuardKey, [AllowEmptyString()][string]$Version, [Parameter(Mandatory)][datetime]$TimeUtc)
|    foreach ($a in @($Accepts | Where-Object { $_ })) {
|        if ($null -ne (Get-SIGuardField $a 'RevokedUtc')) { continue }
|        $k = ([string](Get-SIGuardField $a 'GuardKey')).Trim()
|        if ($k -and $k.ToLowerInvariant() -ne $GuardKey.ToLowerInvariant()) { continue }
|        $from = [string](Get-SIGuardField $a 'FromVersion'); $to = [string](Get-SIGuardField $a 'ToVersion')
|        if (-not (Test-SIGuardVersionInRange -Version $Version -From $from -To $to)) { continue }
|        if (-not $to.Trim()) {
|            $at = ConvertTo-SIGuardHealUtc (Get-SIGuardField $a 'AcceptedUtc')
|            if ($null -eq $at -or $TimeUtc.ToUniversalTime() -gt $at) { continue }
|        }
|        return $a
|    }
|    $null
|}
|
|# =====================================================================================================================
|#  The SQL (sql\si-pro-settings.sql: the #733 columns, cfg.GuardAccept). Every statement survives a database the
|#  update has not reached yet: the new columns are written through a guarded dynamic statement.
|# =====================================================================================================================
|function Get-SIGuardHealSql {
|    param([Parameter(Mandatory)][ValidateSet('StateExtra', 'EventInfo', 'AcceptRead')][string]$Name)
|    switch ($Name) {
|        'StateExtra' { @'
|IF COL_LENGTH(N'cfg.GuardState', N'ClearedUtc') IS NOT NULL
|    EXEC sp_executesql N'UPDATE cfg.GuardState SET Version = @v, PreviousVersion = @pv, FirstRunId = @fr, MarkerKind = @mk, ClearedUtc = @cu, ClearedRunId = @cr, ClearedVersion = @cv, ClearedHow = @ch WHERE GuardKey = @k',
|        N'@k nvarchar(500), @v nvarchar(64), @pv nvarchar(64), @fr nvarchar(64), @mk nvarchar(16), @cu datetime2(0), @cr nvarchar(64), @cv nvarchar(64), @ch nvarchar(16)',
|        @k = @GuardKey, @v = @Version, @pv = @PreviousVersion, @fr = @FirstRunId, @mk = @MarkerKind, @cu = @ClearedUtc, @cr = @ClearedRunId, @cv = @ClearedVersion, @ch = @ClearedHow;
|'@ }
|        'EventInfo' { @'
|IF COL_LENGTH(N'cfg.GuardEvent', N'Attribution') IS NOT NULL
|    EXEC sp_executesql N'UPDATE cfg.GuardEvent SET SiVersion = @v, PreviousVersion = @pv, Attribution = @a WHERE Id = @id',
|        N'@id bigint, @v nvarchar(64), @pv nvarchar(64), @a nvarchar(400)', @id = @Id, @v = @SiVersion, @pv = @PreviousVersion, @a = @Attribution;
|'@ }
|        'AcceptRead' { "IF OBJECT_ID(N'cfg.GuardAccept') IS NULL SELECT CAST(NULL AS BIGINT) AS AcceptId WHERE 1 = 0; ELSE SELECT AcceptId, GuardKey, FromVersion, ToVersion, AcceptedBy, AcceptedUtc, RevokedUtc FROM cfg.GuardAccept WHERE GuardId = @GuardId;" }
|    }
|}
|
|function Get-SIGuardStateExtraParams {
|    <# PURE. The #733 fields of a state (episode or marker) as the 'StateExtra' statement's parameters. #>
|    param([Parameter(Mandatory)][string]$Key, $State)
|    $s = { param($n, $max) $x = [string](Get-SIGuardField $State $n); if ($x.Length -gt $max) { $x = $x.Substring(0, $max) }; if ($x) { $x } else { $null } }
|    @{ GuardKey = $Key; Version = (& $s 'Version' 64); PreviousVersion = (& $s 'PreviousVersion' 64); FirstRunId = (& $s 'FirstRunId' 64)
|       MarkerKind = (& $s 'MarkerKind' 16); ClearedUtc = (ConvertTo-SIGuardHealUtc (Get-SIGuardField $State 'ClearedUtc'))
|       ClearedRunId = (& $s 'ClearedRunId' 64); ClearedVersion = (& $s 'ClearedVersion' 64); ClearedHow = (& $s 'ClearedHow' 16) }
|}
|
|function ConvertTo-SIGuardMarkerState {
|    <# PURE. A marker as a state row (GuardState's columns): SinceUtc -> FirstSeenUtc, FirstRunTripped -> TripCount. #>
|    param([Parameter(Mandatory)]$Marker, [Parameter(Mandatory)][datetime]$NowUtc)
|    [pscustomobject]@{ FirstSeenUtc = $(if ($Marker.SinceUtc) { $Marker.SinceUtc } else { $NowUtc }); LastSeenUtc = $NowUtc; TripCount = $(if ($Marker.FirstRunTripped) { 1 } else { 0 }); LastMailUtc = $null
|                       Version = $Marker.Version; PreviousVersion = $Marker.PreviousVersion; FirstRunId = $Marker.FirstRunId; MarkerKind = $Marker.Kind
|                       SinceUtc = $Marker.SinceUtc; FirstRunTripped = [bool]$Marker.FirstRunTripped }
|}
|
|# =====================================================================================================================
|#  Talking to the store -- never throws
|# =====================================================================================================================
|function Resolve-SIGuardStore {
|    <# The (store, has-tables, invoke) a guard step uses: the -StateStore handed in, else the Pro database's when it has the
|       guard tables, else (a test session) the process's memory store, else the file store. Never throws. #>
|    param([scriptblock]$Invoke, $StateStore)
|    $isTest = [bool](Get-Module -Name Pester)
|    # #735: the same database the trips are written to -- a cleared episode shows on the Guards view next to its trip
|    if (Get-Command -Name Resolve-SIGuardEventInvoke -ErrorAction SilentlyContinue) { $Invoke = Resolve-SIGuardEventInvoke -Invoke $Invoke -IsTest $isTest }
|    elseif (-not $Invoke -and $global:SI_GuardInvoke -is [scriptblock] -and -not $isTest) { $Invoke = $global:SI_GuardInvoke }
|    $has = $false
|    if ($Invoke) { try { $has = ([int](& $Invoke (Get-SIGuardSql 'Exists') @{} 'scalar') -eq 1) } catch { $has = $false } }
|    if (-not $StateStore) {
|        if ($has) { $StateStore = New-SIGuardSqlStateStore -Invoke $Invoke }
|        elseif ($isTest) { if (-not $global:SI_GuardTestStore) { $global:SI_GuardTestStore = New-SIGuardMemoryStateStore }; $StateStore = $global:SI_GuardTestStore }
|        else { $StateStore = New-SIGuardFileStateStore -Directory (Get-SIGuardStateDirectory) }
|    }
|    [pscustomobject]@{ Store = $StateStore; HasTables = $has; Invoke = $Invoke; IsTest = $isTest }
|}
|
|function Read-SIGuardVersionMarker {
|    param([Parameter(Mandatory)]$StateStore, [Parameter(Mandatory)][string]$GuardKey)
|    try { return (Get-SIGuardVersionMarker (& $StateStore.Get ((Get-SIGuardHealSettings).MarkerPrefix + $GuardKey))) } catch { return $null }
|}
|
|function Save-SIGuardVersionMarker {
|    param([Parameter(Mandatory)]$StateStore, [Parameter(Mandatory)][string]$GuardKey, [Parameter(Mandatory)][string]$GuardId, $Marker, [Parameter(Mandatory)][datetime]$NowUtc)
|    if (-not $Marker) { return }
|    try { & $StateStore.Set ((Get-SIGuardHealSettings).MarkerPrefix + $GuardKey) $GuardId (ConvertTo-SIGuardMarkerState -Marker $Marker -NowUtc $NowUtc) } catch { }
|}
|
|# =====================================================================================================================
|#  The report to Invardia that a guard is cleared -- PURE builder (Invardia: GuardOutcome 'cleared', ClearedBy, ClearedUtc)
|# =====================================================================================================================
|function New-SIGuardClearTelemetryRecord {
|    <#
|        PURE. The guard report that says cleared (Invardia's receiver: the same report as a trip -- Schema 2, Kind guard,
|        Product, GuardId -- with GuardOutcome 'cleared', ClearedBy 'passed' (the next run passed the guard) or 'released' (a
|        person released or accepted it), ClearedUtc). No Severity, no numbers. ANONYMOUS adds only the InstallId; IDENTIFIED
|        adds ClaimedTenantId, Host and the plain sentence as ActionText (at most 500 characters, redacted).
|    #>
|    param([Parameter(Mandatory)][string]$GuardId, [Parameter(Mandatory)]$Context, [ValidateSet('passed', 'released', 'accepted')][string]$How = 'passed',
|          [Parameter(Mandatory)][datetime]$NowUtc, [string]$Job, [string]$Area, [string]$Text, [string]$HostName)
|    $anon = ([string]$Context.Mode -eq 'anonymous')
|    $iso = $NowUtc.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture)
|    $r = [ordered]@{ Schema = 2; Kind = 'guard'; Product = 'securityinsight' }
|    $ver = "$($Context.Version)".Trim(); if ($ver) { $r.Version = $ver }
|    if ($Context.PSObject.Properties['Ring'] -and $null -ne $Context.Ring -and "$($Context.Ring)" -ne '') { $r.Ring = [int]$Context.Ring }
|    foreach ($k in 'Edition', 'Hosting', 'RuntimeIdentity', 'LicenceState') { if ($Context.PSObject.Properties[$k]) { $val = "$($Context.$k)".Trim(); if ($val) { $r[$k] = $val } } }
|    if ($Job) { $r.Job = $Job }
|    $r.GuardId = $GuardId
|    $r.GuardOutcome = 'cleared'
|    $r.ClearedBy = $(if ($How -eq 'passed') { 'passed' } else { 'released' })
|    $r.ClearedUtc = $iso
|    if ($Area) { $r.Area = $Area }
|    if ($anon) { $r.InstallId = [string]$Context.InstallId }
|    else {
|        $r.ClaimedTenantId = [string]$Context.TenantId
|        $r.Host = $(if ($HostName) { $HostName } else { [string][System.Environment]::MachineName })
|        # Invardia S16: the install's LASTING id (SI-InstallId) on the identified report -- never the anonymous id; none = no field
|        if ($Context.PSObject.Properties['LastingInstallId'] -and (Get-Command -Name ConvertTo-SIInvardiaInstallId -ErrorAction SilentlyContinue)) {
|            $lid = ConvertTo-SIInvardiaInstallId ([string]$Context.LastingInstallId); if ($lid) { $r.InstallId = $lid }
|        }
|        $t = [string]$Text
|        if (Get-Command -Name ConvertTo-AitUplinkRedacted -ErrorAction SilentlyContinue) { try { $t = [string](ConvertTo-AitUplinkRedacted -Text $t) } catch { } }
|        $t = $t.Trim(); if ($t.Length -gt 500) { $t = $t.Substring(0, 497) + '...' }
|        if ($t) { $r.ActionText = $t }
|    }
|    $r.LastSeenUtc = $iso
|    [pscustomobject]$r
|}
|
|# =====================================================================================================================
|#  THE CLEAR -- one call, never throws
|# =====================================================================================================================
|function Send-SIGuardClear {
|    <#
|        Clears one guard episode: the state (ClearedUtc ...), one cfg.GuardEvent row Outcome 'cleared' (Pro), one run-health
|        row 'guard-cleared', one audit event 'guard.event.clear' (Pro), and the report to Invardia (cleared). Nothing is
|        mailed. NEVER throws. Returns @{ Status ('cleared' | 'error'); Text; Telemetry; Stored; RunHealth }.
|        -Episode: the open episode (read by the caller); -How passed | released | accepted; seams as Send-SIGuardEvent.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$GuardId, [string]$Subject, [string]$RunId, [string]$Version, [string]$Engine, [string]$Job,
|        [ValidateSet('passed', 'released', 'accepted', 'taken')][string]$How = 'passed', [string]$Detail, [object[]]$Values = @(), $Episode,
|        [scriptblock]$Invoke, $StateStore, [scriptblock]$TelemetryTransport, $TelemetryContext, [scriptblock]$RunHealth,
|        [System.Collections.IDictionary]$Globals, $Now, [switch]$NoTelemetry, [scriptblock]$Log, [string]$By, [string]$Reason
|    )
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) if ($level -eq 'WARN') { Write-Warning $msg } else { Write-Host (' [{0}] {1}' -f $level, $msg) } } }
|    $res = [ordered]@{ Status = 'error'; Text = ''; Telemetry = [pscustomobject]@{ State = 'not-tried'; Record = $null }; Stored = $false; RunHealth = 'not-tried'; Reason = '' }
|    try {
|        $nowUtc = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|        $def = Get-SIGuardDefinition -Id $GuardId
|        if (-not $RunId) { $RunId = $(if ($global:SI_GuardRunId) { [string]$global:SI_GuardRunId } else { '' }) }
|        if (-not $Version) { $Version = Get-SIGuardRunVersion }
|        $key = Get-SIGuardKeyFor -GuardId $GuardId -Subject $Subject
|        $text = Format-SIGuardClearText -How $How -RunId $RunId -Version $Version -Detail $Detail -By $By -Reason $Reason
|        $res.Text = $text
|        $rs = Resolve-SIGuardStore -Invoke $Invoke -StateStore $StateStore
|        $store = $rs.Store; $Invoke = $rs.Invoke
|        if (-not $Episode) { try { $Episode = & $store.Get $key } catch { $Episode = $null } }
|        $job = if ($Job) { $Job } elseif ([string]$def.job) { [string]$def.job } elseif ($Engine -and (Get-Command -Name Resolve-SITelemetryJob -ErrorAction SilentlyContinue)) { [string](Resolve-SITelemetryJob -Engine $Engine) } else { '' }
|        & $Log 'INFO' ('{0}{1}: {2}' -f $GuardId, $(if ($Subject) { ' (' + $Subject + ')' } else { '' }), $text)
|
|        # ---- the episode, cleared ----
|        $st = [pscustomobject]@{
|            FirstSeenUtc = $(if ($Episode) { ConvertTo-SIGuardHealUtc (Get-SIGuardField $Episode 'FirstSeenUtc') } else { $nowUtc })
|            LastSeenUtc  = $(if ($Episode -and (Get-SIGuardField $Episode 'LastSeenUtc')) { ConvertTo-SIGuardHealUtc (Get-SIGuardField $Episode 'LastSeenUtc') } else { $nowUtc })
|            TripCount    = $(if ($Episode) { [int]('0' + [string](Get-SIGuardField $Episode 'TripCount')) } else { 0 })
|            LastMailUtc  = $(if ($Episode) { ConvertTo-SIGuardHealUtc (Get-SIGuardField $Episode 'LastMailUtc') } else { $null })
|            Version = $(if ($Episode) { [string](Get-SIGuardField $Episode 'Version') } else { '' }); PreviousVersion = $(if ($Episode) { [string](Get-SIGuardField $Episode 'PreviousVersion') } else { '' })
|            ClearedUtc = $nowUtc; ClearedRunId = $RunId; ClearedVersion = $Version; ClearedHow = $How
|        }
|        if ($null -eq $st.FirstSeenUtc) { $st.FirstSeenUtc = $nowUtc }
|        try { & $store.Set $key $GuardId $st } catch { & $Log 'WARN' ('the guard''s clear could not be saved: {0}' -f $_.Exception.Message) }
|
|        # ---- the report to Invardia ----
|        $telState = 'off'; $rec = $null
|        try {
|            # a level TAKEN is not a clear: Invardia is not told the guard cleared (its ticket stays for a person)
|            if ($How -eq 'taken') { $telState = 'not-a-clear' }
|            elseif ($NoTelemetry -or -not (Get-Command -Name Test-SITelemetryEnabled -ErrorAction SilentlyContinue)) { $telState = 'off' }
|            elseif (-not $Globals -and -not (Test-SITelemetryEnabled)) { $telState = 'off' }
|            elseif ($Globals -and -not (Test-SIGuardFlag -Value (Get-SIGuardSetting -Name 'SI_Telemetry_Enabled' -Globals $Globals) -Default $true)) { $telState = 'off' }
|            elseif ($global:SI_TelemetryHalted -and -not $TelemetryTransport) { $telState = 'halted' }
|            elseif (-not $TelemetryTransport -and $rs.IsTest) { $telState = 'test-session' }
|            else {
|                $ctx = if ($TelemetryContext) { $TelemetryContext } else { Get-SITelemetryContext }
|                # Invardia's receiver does not take 'cleared' yet (2026-10-17): with SI_Uplink_SendGuardHealOutcomes off (the
|                # default) the clear is recorded here and NOT reported -- TelemetryState 'off', never sent later in a burst
|                $healOn = (Get-Command -Name Resolve-SIGuardHealOutcomesSwitch -ErrorAction SilentlyContinue) -and (Resolve-SIGuardHealOutcomesSwitch -Ring $ctx.Ring -Globals $Globals).On
|                if (-not $healOn) { $telState = 'off' }
|                else {
|                $rec = New-SIGuardClearTelemetryRecord -GuardId $GuardId -Context $ctx -How $How -NowUtc $nowUtc -Job $job -Area ([string]$def.area) -Text $text
|                if ([string]$ctx.Mode -eq 'anonymous' -and [string]$rec.InstallId -notmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$') { $telState = 'no-install-id'; $rec = $null }
|                else {
|                    if (-not $TelemetryTransport) { $TelemetryTransport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) if (Get-Command -Name Test-SITelemetryCommunitySendAllowed -ErrorAction SilentlyContinue) { $g = Test-SITelemetryCommunitySendAllowed -AccessCode $AccessCode; if (-not $g.Allowed) { return [pscustomobject]@{ Status = 'skipped'; Reason = $g.Reason; Sent = $false } } }; Send-AitUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec } }
|                    $r = & $TelemetryTransport $rec $ctx.Endpoint $ctx.AccessCode 5
|                    # a clear that was not accepted is said, not retried, and stops nothing else (the next clear or ok run closes it)
|                    $telState = if ("$($r.Status)" -eq 'ok') { 'sent' } else { 'failed' }
|                }
|                }
|            }
|        } catch { $telState = 'failed'; & $Log 'INFO' ('the guard''s clear could not be reported to Invardia: {0}' -f $_.Exception.Message) }
|        $res.Telemetry = [pscustomobject]@{ State = $telState; Record = $rec }
|
|        # ---- the Guards view row (Pro) ----
|        if ($rs.HasTables) {
|            try {
|                $vals = @($Values | Where-Object { $_ })
|                $id = & $Invoke (Get-SIGuardSql 'Insert') @{
|                    GuardId = $GuardId; GuardKey = $key; Area = [string]$def.area; Job = $job; Engine = $Engine; Source = 'job'
|                    Outcome = $(if ($How -eq 'taken') { 'taken' } else { 'cleared' }); Severity = $(if ($How -eq 'taken') { 'warning' } else { 'info' }); Protected = [string]$def.protects; Subject = ([string]$Subject).Trim(); Detail = $text
|                    MeasuredText = $(if ($vals.Count -and (Get-Command -Name Format-SIGuardValues -ErrorAction SilentlyContinue)) { try { Format-SIGuardValues -Values @(New-SIGuardEvent -GuardId $GuardId -Outcome warning -Values $vals).Values } catch { '' } } else { '' })
|                    ValuesJson = $null; HeldCount = 0L; ActionText = $null; Link = $null; RunId = $RunId; TripCount = [int]$st.TripCount; FirstSeenUtc = $st.FirstSeenUtc
|                    MailState = 'off'; MailTo = $null; TelemetryState = $telState } 'scalar'
|                $res.Stored = $true
|                $nid = 0L
|                if ([long]::TryParse([string]$(if ($id -is [array]) { $id[0] } else { $id }), [ref]$nid) -and $nid -gt 0) {
|                    try { $null = & $Invoke (Get-SIGuardHealSql 'EventInfo') @{ Id = $nid; SiVersion = $(if ($Version) { $Version } else { $null }); PreviousVersion = $null; Attribution = $null } 'nonquery' } catch { }
|                }
|            } catch { & $Log 'WARN' ('the guard''s clear could not be saved for the Guards view: {0}' -f $_.Exception.Message) }
|        }
|
|        # ---- run health ----
|        try {
|            $ctxRh = [pscustomobject]@{ RunId = $RunId; Engine = $(if ($Engine) { $Engine } else { 'guard' }); ShardIndex = 0; ShardCount = 1; CollectionTime = $nowUtc; StartedAt = $nowUtc }
|            $msg = '{0}: {1}' -f $GuardId, $text
|            if ($RunHealth) { $null = & $RunHealth $ctxRh $(if ($How -eq 'taken') { 'guard-taken' } else { 'guard-cleared' }) $msg 0L; $res.RunHealth = 'written' }
|            elseif (Get-Command -Name Send-SIRunHealthRow -ErrorAction SilentlyContinue) {
|                Send-SIRunHealthRow -RunContext $ctxRh -Phase Guard -AssetCount 0 -ExitReason $(if ($How -eq 'taken') { 'guard-taken' } else { 'guard-cleared' }) -ErrorMessage $msg -NoTelemetry
|                $res.RunHealth = 'written'
|            } else { $res.RunHealth = 'unavailable' }
|        } catch { $res.RunHealth = 'failed' }
|
|        # ---- audit (Pro) ----
|        if ($rs.HasTables -and (Get-Command -Name Write-SIAuditEvent -ErrorAction SilentlyContinue)) {
|            try {
|                $actor = if (Get-Command -Name Get-SIAuditActor -ErrorAction SilentlyContinue) { Get-SIAuditActor -Job $(if ($Engine) { $Engine } else { 'guard' }) } else { 'guard' }
|                $null = Write-SIAuditEvent -Invoke $Invoke -Action (Get-SIGuardHealSettings).AuditClear -Actor $actor -ActorSource 'job' -Target $(if ($Subject) { '{0} ({1})' -f $GuardId, $Subject } else { $GuardId }) `
|                        -Reason ([string]$def.protects) -Outcome 'ok' -OutcomeText $text -CorrelationId $RunId -After ([ordered]@{ guard = $GuardId; how = $How; version = $Version; run = $RunId; telemetry = $telState }) -Log { param($l, $m) }
|            } catch { }
|        }
|        $res.Status = 'cleared'
|        return [pscustomobject]$res
|    } catch {
|        $res.Status = 'error'; $res.Reason = [string]$_.Exception.Message
|        try { & $Log 'WARN' ('a guard could not be cleared: {0}. The job itself is not affected.' -f $_.Exception.Message) } catch { }
|        return [pscustomobject]$res
|    }
|}
|
|function ConvertTo-SIGuardCheckList {
|    <# PURE. -Checked as given (guard ids, or @{ GuardId; Subject; Values; Detail }) -> @(@{ GuardId; Subject; Key; Values;
|       Detail }), each key once. -Subject is the default subject of a bare id. #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Checked, [string]$Subject)
|    $seen = @{}
|    foreach ($c in @($Checked | Where-Object { $_ })) {
|        $gid = if ($c -is [string]) { $c } else { [string](Get-SIGuardField $c 'GuardId') }
|        if (-not $gid) { continue }
|        $sub = if ($c -is [string]) { $Subject } else { $s = Get-SIGuardField $c 'Subject'; if ($null -eq $s) { $Subject } else { [string]$s } }
|        $key = Get-SIGuardKeyFor -GuardId $gid -Subject $sub
|        if ($seen.ContainsKey($key)) { continue }
|        $seen[$key] = $true
|        [pscustomobject]@{ GuardId = $gid; Subject = ([string]$sub).Trim(); Key = $key
|                           Values = $(if ($c -is [string]) { @() } else { @(Get-SIGuardField $c 'Values') | Where-Object { $_ } })
|                           Detail = $(if ($c -is [string]) { '' } else { [string](Get-SIGuardField $c 'Detail') })
|                           # 'taken' (a drop confirmed at its new level) closes the episode WITHOUT being a heal; default passed
|                           How = $(if ($c -is [string]) { 'passed' } else { $h = [string](Get-SIGuardField $c 'How'); if ($h -in 'passed', 'taken') { $h } else { 'passed' } }) }
|    }
|}
|
|function Invoke-SIGuardHeal {
|    <#
|        After a step's guard calls: every CHECKED guard (and subject) that did NOT trip in this run records that it ran on
|        this version (its marker, kind 'check'), and -- when the run was -Complete and its values are within their limits --
|        clears an open episode (Send-SIGuardClear, How 'passed'). -Calls: the trips this step sent (their keys are not
|        cleared). -Common: the same extras the trips got (-Invoke, -Engine, -Job, -RunId, -Subject ...). NEVER throws.
|        Returns the clears made.
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Checked, [AllowNull()][AllowEmptyCollection()][object[]]$Calls = @(), [bool]$Complete = $false,
|          [hashtable]$Common = @{}, [scriptblock]$Log)
|    $out = New-Object System.Collections.Generic.List[object]
|    try {
|        $defSub = if ($Common.ContainsKey('Subject')) { [string]$Common['Subject'] } else { '' }
|        $list = @(ConvertTo-SIGuardCheckList -Checked $Checked -Subject $defSub)
|        if (-not $list.Count) { return , $out.ToArray() }
|        $tripped = @{}
|        foreach ($c in @($Calls | Where-Object { $_ })) {
|            $g = [string](Get-SIGuardField $c 'GuardId'); if (-not $g) { continue }
|            $s = Get-SIGuardField $c 'Subject'; if ($null -eq $s) { $s = $defSub }
|            $tripped[(Get-SIGuardKeyFor -GuardId $g -Subject ([string]$s))] = $true
|        }
|        $rs = Resolve-SIGuardStore -Invoke $(if ($Common.ContainsKey('Invoke')) { $Common['Invoke'] } else { $null }) -StateStore $(if ($Common.ContainsKey('StateStore')) { $Common['StateStore'] } else { $null })
|        $nowUtc = if ($Common.ContainsKey('Now') -and $Common['Now']) { ([datetime]$Common['Now']).ToUniversalTime() } else { [datetime]::UtcNow }
|        $runId = if ($Common.ContainsKey('RunId') -and $Common['RunId']) { [string]$Common['RunId'] } elseif ($global:SI_GuardRunId) { [string]$global:SI_GuardRunId } else { '' }
|        $ver = Get-SIGuardRunVersion
|        $globals = if ($Common.ContainsKey('Globals')) { $Common['Globals'] } else { $null }
|        foreach ($c in $list) {
|            if ($tripped.ContainsKey($c.Key)) { continue }
|            # a guard switched off neither trips nor clears (its own line is said by the trip path)
|            try { if (-not (Test-SIGuardOn -GuardId $c.GuardId -Globals $globals -Quiet)) { continue } } catch { }
|            $m = Read-SIGuardVersionMarker -StateStore $rs.Store -GuardKey $c.Key
|            Save-SIGuardVersionMarker -StateStore $rs.Store -GuardKey $c.Key -GuardId $c.GuardId -Marker (Update-SIGuardVersionMarker -Marker $m -Version $ver -RunId $runId -NowUtc $nowUtc -Kind check -Tripped $false) -NowUtc $nowUtc
|            $ep = $null; try { $ep = & $rs.Store.Get $c.Key } catch { $ep = $null }
|            $d = Get-SIGuardHealDecision -Episode $ep -Key $c.Key -Tripped $false -Complete $Complete -Values @($c.Values)
|            if ($d.Decision -ne 'cleared') {
|                if ($d.Decision -eq 'stays' -and $Log) { & $Log 'INFO' ('{0}{1} stays open: {2}' -f $c.GuardId, $(if ($c.Subject) { ' (' + $c.Subject + ')' } else { '' }), $d.Reason) }
|                continue
|            }
|            $a = @{ GuardId = $c.GuardId; Subject = $c.Subject; RunId = $runId; Version = $ver; How = $(if ($c.How) { $c.How } else { 'passed' }); Detail = $c.Detail; Values = @($c.Values); Episode = $ep; StateStore = $rs.Store }
|            if ($rs.Invoke) { $a['Invoke'] = $rs.Invoke }
|            foreach ($k in 'Engine', 'Job', 'TelemetryTransport', 'TelemetryContext', 'RunHealth', 'Globals', 'Now', 'NoTelemetry') { if ($Common.ContainsKey($k) -and $null -ne $Common[$k]) { $a[$k] = $Common[$k] } }
|            if ($Log) { $a['Log'] = $Log } elseif ($Common.ContainsKey('Log') -and $Common['Log']) { $a['Log'] = $Common['Log'] }
|            $out.Add((Send-SIGuardClear @a))
|        }
|    } catch {
|        try { if ($Log) { & $Log 'WARN' ('the guards could not be checked for a clear: {0}' -f $_.Exception.Message) } else { Write-Warning ('the guards could not be checked for a clear: {0}' -f $_.Exception.Message) } } catch { }
|    }
|    , $out.ToArray()
|}
'@ }
$__siSupportFiles['engine/_shared/data-sql/SI-DataSql.ps1'] = @{ Sha256 = 'f3384150f3e27f72d80980a5dee55a55c3a15b0c921c76da9acf760a685fa610'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight Pro -- the data sync's SQL side (REQUIREMENTS §9.3.3 phase B): the connection, the set-based
|    writes, the daily aggregates and the retention purge, against sql/si-data-schema.sql (schema `sidata`).
|
|    ONE SEAM. Every statement goes through -Invoke: a scriptblock (sql, params-hashtable, mode 'reader'|'nonquery'|
|    'scalar') -- the vulnerability target's seam (engine/asset-cmdb/_shared/SI-VulnTarget.ps1), so the tests replace
|    the database with a fake that records calls. The default opens a connection per call with an Entra token: the
|    container job's MANAGED IDENTITY when $global:SI_UseManagedIdentity, else the engine SPN's CERTIFICATE. No SQL
|    login, no secret. ONE token per ~45 minutes.
|
|    SET-BASED. Rows travel as ONE JSON parameter per chunk and land in one statement (OPENJSON), each chunk in its own
|    transaction. A collection is visible only once its LAST chunk landed and it is marked 'Complete'.
|
|    RETENTION is here, not in the schema file (that one is additive only). It purges sidata collections older than the
|    retention, in batches sized from their measured time; vuln.*, si.* and cfg.* are never touched.
|
|    PS 5.1 safe.
|#>
|
|# The certificate lookup and the SPN token are the identity ledger's (same SPN, same host). Loaded, not copied.
|if (-not (Get-Command -Name 'Get-SILedgerAccessToken' -ErrorAction SilentlyContinue)) {
|    $__ledger = Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'data-model\identity\SI-ObjectLedgerStore.ps1'
|    if (Test-Path -LiteralPath $__ledger) { . $__ledger }
|}
|
|function New-SIDataSqlInvoke {
|    <# The default -Invoke: a connection per call, Entra token (managed identity in a container, else certificate). #>
|    param(
|        [Parameter(Mandatory)][string]$Server,
|        [Parameter(Mandatory)][string]$Database,
|        [string]$AppId,
|        [string]$TenantId,
|        [string]$CertThumbprint,
|        # 0 = no limit (owner 2026-10-22: "i accept no limits"): deletes and aggregates touch many rows; long work is batched and says its progress
|        [int]$CommandTimeoutSec = 0,
|        # test seams: -TokenSeam { } -> a token (no sign-in); -Connect { param($Server, $Database, $Token) } -> an open
|        # connection; -Sleep { param($Seconds) }; -StatementWaits = the pauses of the statement retry (Get-SISqlStatementRetryWaits)
|        [scriptblock]$TokenSeam, [scriptblock]$Connect, [scriptblock]$Sleep, [int[]]$StatementWaits
|    )
|    $srv = $Server; $db = $Database; $app = $AppId; $ten = $TenantId; $timeout = $CommandTimeoutSec
|    # the engine's Azure SQL access token goes ONLY to an Azure SQL server (a test's own token seam is never a real token)
|    if (-not (Get-Command -Name New-SISqlConnectionString -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'SI-OutboundTrust.ps1')) }
|    if (-not $TokenSeam) {
|        $hostWhy = Test-SIAzureSqlHost -Server $Server
|        if ($hostWhy) { throw ("New-SIDataSqlInvoke: the database is not opened -- {0}" -f $hostWhy) }
|    }
|    # the database is a NAME, and the connection string is BUILT: a ';' in a setting never adds a keyword (another server)
|    $dbWhy = Test-SISqlDatabaseName -Database $Database
|    if ($dbWhy) { throw ("New-SIDataSqlInvoke: the database is not opened -- {0}" -f $dbWhy) }
|    $csText = New-SISqlConnectionString -Server $Server -Database $Database
|    # A GetNewClosure() block cannot see functions the caller dot-sourced, so the token function travels INTO the
|    # closure as a value (as in SI-VulnTarget.ps1).
|    if ($TokenSeam) {
|        $getToken = $TokenSeam
|    } elseif ($global:SI_UseManagedIdentity) {
|        if (-not (Get-Command -Name 'Get-SIManagedIdentityToken' -ErrorAction SilentlyContinue)) {
|            throw 'New-SIDataSqlInvoke: managed identity is on but the identity token helper is not loaded -- this sign-in works only inside a SecurityInsight container.'
|        }
|        $miFn = ${function:Get-SIManagedIdentityToken}
|        $getToken = { & $miFn -Resource 'https://database.windows.net/' }.GetNewClosure()
|    } else {
|        if (-not (Get-Command -Name 'Get-SILedgerAccessToken' -ErrorAction SilentlyContinue)) {
|            throw 'New-SIDataSqlInvoke: the SQL token helper (data-model\identity\SI-ObjectLedgerStore.ps1) is not installed.'
|        }
|        if (-not $AppId -or -not $TenantId -or -not $CertThumbprint) {
|            throw 'New-SIDataSqlInvoke: the engine identity (SI_SPN_AppId / SI_SPN_TenantId / SI_SPN_CertThumbprint) is not set.'
|        }
|        $cert = Get-SILedgerCertificate -Thumbprint $CertThumbprint
|        if (-not $cert) { throw ("New-SIDataSqlInvoke: certificate {0} with a private key was not found in LocalMachine or CurrentUser." -f $CertThumbprint) }
|        $tokenFn = ${function:Get-SILedgerAccessToken}
|        $getToken = { & $tokenFn -Certificate $cert -AppId $app -TenantId $ten }.GetNewClosure()
|    }
|    $tokenCache = @{ Token = $null; Until = [datetime]::MinValue }
|    # the shared open-with-retry, as a value (the closure below cannot see dot-sourced functions)
|    if (-not (Get-Command -Name 'Open-SISqlConnectionRetry' -ErrorAction SilentlyContinue)) { . (Join-Path (Split-Path -Parent $PSScriptRoot) 'SI-SqlRetry.ps1') }
|    $openSql = ${function:Open-SISqlConnectionRetry}
|    # the statement retry (SI-SqlRetry.ps1), as values: which failures are Azure SQL's platform answers, and the pauses
|    $isTransient = ${function:Test-SISqlStatementTransient}
|    $waits = if ($PSBoundParameters.ContainsKey('StatementWaits')) { @($StatementWaits) } else { @(Get-SISqlStatementRetryWaits) }
|    $sleepFn = if ($Sleep) { $Sleep } else { { param($s) Start-Sleep -Seconds $s } }
|    $connectFn = $Connect
|    # #738: what a reader on ANOTHER thread needs to make the same connection (Risk Analysis reads its next page while it
|    # posts the current one): the connection string and a current token -- values, never this script block
|    $connInfo = {
|        if (-not $tokenCache.Token -or [datetime]::UtcNow -ge $tokenCache.Until) {
|            $tokenCache.Token = & $getToken
|            $tokenCache.Until = [datetime]::UtcNow.AddMinutes(45)
|        }
|        @{ ConnectionString = $csText; AccessToken = $tokenCache.Token; CommandTimeout = $timeout }
|    }.GetNewClosure()
|    $invoke = {
|        # mode 'stream' (#639): each row is handed to -OnRow ({ param($Row) }, a hashtable) as it is read, never collected;
|        # the answer is the number of rows. 'reader' / 'rows' collect every row -- for a read that is bounded by its query.
|        param([string]$sql, $p, [string]$mode, [scriptblock]$OnRow)
|        # THE OPEN is retried (the shared Open-SISqlConnectionRetry, SI-SqlRetry.ps1): a failover, a serverless resume, a busy
|        # database or a client timeout -- with a fresh token each time (the sweep of 2026-10-22: one 40613 here failed the
|        # whole step). The STATEMENT has its own retry, below.
|        $tok = {
|            param([bool]$Fresh)
|            if ($Fresh -or -not $tokenCache.Token -or [datetime]::UtcNow -ge $tokenCache.Until) {
|                $tokenCache.Token = & $getToken
|                $tokenCache.Until = [datetime]::UtcNow.AddMinutes(45)
|            }
|            $tokenCache.Token
|        }
|        # A STATEMENT that meets one of Azure SQL's platform answers (Test-SISqlStatementTransient: the log not available, a
|        # rollback during recovery, a failover, busy, a reset connection, "a severe error occurred") is run again on a NEW
|        # connection after a pause (Get-SISqlStatementRetryWaits: 6 more attempts over about 9 minutes, owner 2026-10-29), and
|        # the log says so. Live 2026-10-28: one 9001 here ended a 52-hour data sync. Redoing is safe: those answers roll the
|        # statement back; a reset connection may hide a commit, and every writer of the data sync is checked by its own count
|        # (a collection is complete only when its rows equal the source's; the findings per CI and the key figures are
|        # replaced in one checked transaction). NEVER redone: a stream that has handed a row on (it would hand it on twice),
|        # an open that failed (Open-SISqlConnectionRetry retried it already), and every other error (a query defect fails on
|        # attempt 1). Past the last attempt the error is thrown tagged transient-sql (Exception.Data['SIErrorClass']).
|        $state = @{ Delivered = 0L; OpenFailed = $false }
|        $attemptOnce = {
|            $cn = $null
|            try { $cn = $(if ($connectFn) { & $openSql -Server $srv -Database $db -Token $tok -Connect $connectFn } else { & $openSql -Server $srv -Database $db -Token $tok }) }
|            catch { $state.OpenFailed = $true; throw }
|            try {
|                # mode 'session' (no fixed limits, owner 2026-10-22): ONE connection for several plain batches, so #temp tables
|                # live from one step to the next and each step is its own command -- the caller says its progress between them.
|                # -OnRow { param($Run) } gets $Run = { param($Sql, $Mode) } ('scalar' | 'reader' | anything else = no answer);
|                # a batch is sent WITHOUT parameters (a parameterised command runs in sp_executesql, which drops its #temp tables)
|                if ($mode -eq 'session') {
|                    if (-not $OnRow) { throw "SQL mode 'session' needs a step callback (OnRow)." }
|                    $sessionCn = $cn; $sessionTimeout = $timeout
|                    $run = {
|                        param([string]$StepSql, [string]$StepMode)
|                        $sc = $sessionCn.CreateCommand(); $sc.CommandText = $StepSql; $sc.CommandTimeout = $sessionTimeout
|                        switch ($StepMode) {
|                            'scalar' { $v = $sc.ExecuteScalar(); if ($v -is [System.DBNull]) { $null } else { $v } }
|                            'reader' {
|                                $rd = $sc.ExecuteReader(); $out = New-Object System.Collections.Generic.List[object]
|                                try { while ($rd.Read()) { $h = @{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $h[$rd.GetName($i)] = $(if ($rd.IsDBNull($i)) { $null } else { $rd.GetValue($i) }) }; $out.Add($h) } } finally { $rd.Close() }
|                                , $out.ToArray()
|                            }
|                            default { [void]$sc.ExecuteNonQuery() }
|                        }
|                    }.GetNewClosure()
|                    return (& $OnRow $run)
|                }
|                $cmd = $cn.CreateCommand(); $cmd.CommandText = $sql; $cmd.CommandTimeout = $timeout
|                if ($p) { foreach ($k in $p.Keys) { [void]$cmd.Parameters.AddWithValue('@' + $k, $(if ($null -eq $p[$k]) { [System.DBNull]::Value } else { $p[$k] })) } }
|                switch ($mode) {
|                    # 'rows' is the same read as 'reader': the callers of the v3 model (which CIs the collection scope leaves out, the
|                    # finding lifecycle's counts, the finding model's counts) ask for 'rows' -- unanswered, their statements ran
|                    # but nothing came back, so an out-of-scope CI's findings closed as fixed instead of freezing
|                    { $_ -in 'reader', 'rows' } {
|                        $rd = $cmd.ExecuteReader()
|                        $out = New-Object System.Collections.Generic.List[object]
|                        while ($rd.Read()) { $h = @{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $h[$rd.GetName($i)] = $rd.GetValue($i) }; $out.Add($h) }
|                        $rd.Close(); , $out.ToArray()
|                    }
|                    'stream' {
|                        if (-not $OnRow) { throw "SQL read mode 'stream' needs a row callback (OnRow)." }
|                        $rd = $cmd.ExecuteReader()
|                        $n = 0L
|                        try {
|                            $names = [string[]]::new($rd.FieldCount)
|                            for ($i = 0; $i -lt $rd.FieldCount; $i++) { $names[$i] = $rd.GetName($i) }
|                            while ($rd.Read()) {
|                                $h = @{}; for ($i = 0; $i -lt $names.Length; $i++) { $h[$names[$i]] = $rd.GetValue($i) }
|                                $state.Delivered++; $null = & $OnRow $h
|                                $n++
|                            }
|                        } finally { $rd.Close() }
|                        $n
|                    }
|                    'scalar' { $cmd.ExecuteScalar() }
|                    default  { [void]$cmd.ExecuteNonQuery() }
|                }
|            } catch {
|                # a broken connection is not handed out again by the pool
|                if ($cn -is [System.Data.SqlClient.SqlConnection]) { try { [System.Data.SqlClient.SqlConnection]::ClearPool($cn) } catch { } }
|                throw
|            } finally { if ($cn) { $cn.Dispose() } }
|        }
|        $try = 0
|        while ($true) {
|            try { & $attemptOnce; break }
|            catch {
|                $err = $_
|                $transient = [bool](& $isTransient $err)
|                if (-not $transient -or $state.OpenFailed) { throw }
|                $first = (([string]$err.Exception.Message) -split "`n")[0].Trim()
|                if ($state.Delivered -gt 0 -or $try -ge @($waits).Count) {
|                    $why = if ($state.Delivered -gt 0) { '{0:N0} row(s) were already read, so the read is not repeated' -f $state.Delivered } else { 'it was tried {0} time(s)' -f ($try + 1) }
|                    $ex = New-Object System.Exception(('the database {0} answered a temporary Azure SQL error ({1}); {2} -- transient-sql' -f $db, $first, $why), $err.Exception)
|                    $ex.Data['SIErrorClass'] = 'transient-sql'
|                    throw $ex
|                }
|                $w = [int]@($waits)[$try]; $try++
|                Write-Host ('       the database {0} answered a temporary Azure SQL error ({1}) -- connecting again and running the statement again in {2} s ({3}/{4})' -f $db, $first, $w, $try, @($waits).Count) -ForegroundColor DarkYellow
|                if ($w -gt 0) { & $sleepFn $w }
|            }
|        }
|    }.GetNewClosure()
|    $invoke | Add-Member -NotePropertyName SIConnectionInfo -NotePropertyValue $connInfo
|    # the database this seam writes to: the write pacing (SI-SqlPacing.ps1) reads ITS load -- only a seam marked so is read
|    $invoke | Add-Member -NotePropertyName SISqlTarget -NotePropertyValue ([pscustomobject]@{ Server = $srv; Database = $db })
|    # this seam reads row by row (mode 'stream', Invoke-SIDataSqlStream)
|    $invoke | Add-Member -NotePropertyName SISqlStream -NotePropertyValue $true
|    # this seam runs several batches on one connection (mode 'session': the key figures in steps, with progress)
|    $invoke | Add-Member -NotePropertyName SISqlSession -NotePropertyValue $true
|    # 2026-10-29 this seam runs the data sync's heavy steps in key ranges, each range one command (SI-DataCi.ps1 "KEY RANGES")
|    $invoke | Add-Member -NotePropertyName SISqlRanged -NotePropertyValue $true
|    $invoke
|}
|
|function Invoke-SIDataSqlStream {
|    <#
|        #639: a SQL read of ANY size, a row (or a page) at a time -- never every row collected. -OnRow { param($Row) } gets
|        each row (a hashtable: column -> value) as it is read; -OnPage { param($Rows) } gets them in pages of -PageRows
|        (both may be given). Returns the number of rows read.
|        A seam that reads row by row (New-SIDataSqlInvoke, marked SISqlStream) is asked in mode 'stream'; any other seam (a
|        test's fake) is asked in mode 'reader' and its rows are handed on the same way -- the same callbacks either way.
|        The 'reader' mode stays for reads bounded by their query (a count, a TOP, one key).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$Sql, $Params, [scriptblock]$OnRow,
|          [scriptblock]$OnPage, [int]$PageRows = 5000)
|    if (-not $OnRow -and -not $OnPage) { throw 'Invoke-SIDataSqlStream: give -OnRow or -OnPage.' }
|    if ($PageRows -lt 1) { $PageRows = 1 }
|    $state = @{ Page = (New-Object System.Collections.Generic.List[object]) }
|    $__on = $OnRow; $__pg = $OnPage; $__n = $PageRows
|    $each = {
|        param($Row)
|        if ($__on) { $null = & $__on $Row }
|        if ($__pg) {
|            $state.Page.Add($Row)
|            if ($state.Page.Count -ge $__n) { $pg = $state.Page.ToArray(); $state.Page.Clear(); $null = & $__pg $pg }
|        }
|    }.GetNewClosure()
|    $n = 0L
|    $streams = [bool]($Invoke.PSObject.Properties['SISqlStream'] -and $Invoke.SISqlStream)
|    if ($streams) {
|        $n = [long](& $Invoke $Sql $Params 'stream' $each)
|    } else {
|        # (a seam answers its rows as ONE array: , $rows -- assigned, then walked)
|        $got = & $Invoke $Sql $Params 'reader'
|        foreach ($r in @($got)) { if ($null -eq $r) { continue }; & $each $r; $n++ }
|        $got = $null
|    }
|    if ($__pg -and $state.Page.Count -gt 0) { $pg = $state.Page.ToArray(); $state.Page.Clear(); $null = & $__pg $pg }
|    $n
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE STATEMENTS -- pure text, so their shape is testable
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SIDataSchemaCheckSql {
|    "SELECT CASE WHEN OBJECT_ID('sidata.Collection') IS NOT NULL AND OBJECT_ID('sidata.Finding') IS NOT NULL AND OBJECT_ID('sidata.FindingDaily') IS NOT NULL AND OBJECT_ID('sidata.VulnLifecycleDaily') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataLoadedSql {
|    # #638: with who wrote it (Source 'risk-analysis' = Risk Analysis wrote it itself -- never loaded from Log Analytics again)
|    # #717: and whether the retention removed its rows (Retired = 1) -- such a collection is never loaded again either
|    @"
|IF COL_LENGTH('sidata.Collection', 'Source') IS NULL
|    SELECT CollectionId, CollectionTime, Status, CAST(NULL AS nvarchar(16)) AS Source FROM sidata.Collection WHERE Kind = @Kind AND CollectionTime >= CONVERT(datetime2(3), @Since, 126);
|ELSE IF COL_LENGTH('sidata.Collection', 'RetiredAt') IS NULL
|    EXEC sp_executesql N'SELECT CollectionId, CollectionTime, Status, Source FROM sidata.Collection WHERE Kind = @Kind AND CollectionTime >= CONVERT(datetime2(3), @Since, 126)', N'@Kind nvarchar(16), @Since nvarchar(40)', @Kind = @Kind, @Since = @Since;
|ELSE EXEC sp_executesql N'SELECT CollectionId, CollectionTime, Status, Source, CASE WHEN RetiredAt IS NULL THEN 0 ELSE 1 END AS Retired FROM sidata.Collection WHERE Kind = @Kind AND CollectionTime >= CONVERT(datetime2(3), @Since, 126)', N'@Kind nvarchar(16), @Since nvarchar(40)', @Kind = @Kind, @Since = @Since;
|"@
|}
|
|function Get-SIDataRunUpsertSql {
|    @'
|IF NOT EXISTS (SELECT 1 FROM sidata.Run WHERE RunId = @RunId)
|INSERT sidata.Run (RunId, Engine, CollectionTime, Verdict, StartedAt, EndedAt, SolutionVersion)
|VALUES (@RunId, @Engine, CONVERT(datetime2(3), @CollectionTime, 126), @Verdict,
|        CONVERT(datetime2(3), NULLIF(@StartedAt, ''), 126), CONVERT(datetime2(3), NULLIF(@EndedAt, ''), 126), NULLIF(@SolutionVersion, ''));
|'@
|}
|
|function Get-SIDataNewCollectionSql {
|    @'
|INSERT sidata.Collection (CollectionTime, Kind, RunId, Status, SolutionVersion)
|OUTPUT inserted.CollectionId
|VALUES (CONVERT(datetime2(3), @CollectionTime, 126), @Kind, NULLIF(@RunId, ''), 'Loading', NULLIF(@SolutionVersion, ''));
|'@
|}
|
|function Get-SIDataCompleteCollectionSql {
|    # Only a 'Loading' collection whose finding count equals what Log Analytics held is marked complete.
|    @'
|UPDATE sidata.Collection SET Status = 'Complete', [Rows] = @Rows, LoadedAt = SYSUTCDATETIME()
|WHERE CollectionId = @CollectionId AND Status = 'Loading'
|  AND (SELECT COUNT_BIG(*) FROM sidata.Finding WHERE CollectionId = @CollectionId) = @Rows;
|SELECT @@ROWCOUNT;
|'@
|}
|
|function Get-SIDataInsertFindingSql {
|    @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|INSERT sidata.Finding (CollectionId, AssetKey, AssetName, ReportName, SecurityDomain, ConfigurationId, Cve, Title, Severity, Tier, RiskScore, DetailJson,
|                       ExemptionId, ExemptedUntil, ExemptionRequestId)
|SELECT @CollectionId, NULLIF(j.AssetKey, ''), NULLIF(j.AssetName, ''), NULLIF(j.ReportName, ''), NULLIF(j.SecurityDomain, ''),
|       NULLIF(j.ConfigurationId, ''), NULLIF(j.Cve, ''), NULLIF(j.Title, ''), NULLIF(j.Severity, ''), j.Tier, j.RiskScore, j.DetailJson,
|       j.ExemptionId, CONVERT(datetime2(0), NULLIF(j.ExemptedUntil, ''), 126), j.ExemptionRequestId
|FROM OPENJSON(@j) WITH (AssetKey nvarchar(400), AssetName nvarchar(400), ReportName nvarchar(256), SecurityDomain nvarchar(128),
|                        ConfigurationId nvarchar(256), Cve nvarchar(100), Title nvarchar(1000), Severity nvarchar(30), Tier tinyint,
|                        RiskScore float, DetailJson nvarchar(max), ExemptionId bigint, ExemptedUntil nvarchar(40), ExemptionRequestId bigint) j;
|DECLARE @n int = @@ROWCOUNT;
|COMMIT;
|SELECT @n;
|'@
|}
|
|function Get-SIDataFindingTierFromAssetSql {
|    <#
|        A finding loaded WITHOUT a tier, on an asset that HAS one, takes its asset's tier (one collection). The row came
|        from a report whose own link to the profile missed (measured 2026-10-05: an attack-path report returned the same
|        asset twice, with Tier 3 on one row and none on the other) -- the finding was then "Unclassified" while its asset
|        was Tier 3 on the Tier board. A finding's tier is its asset's tier, so the two can no longer disagree.
|        Runs after the assets are written and before the collection is completed (the daily aggregates read it after).
|    #>
|    @'
|SET XACT_ABORT ON;
|UPDATE f SET f.Tier = a.Tier
|FROM sidata.Finding AS f JOIN sidata.Asset AS a ON a.AssetKey = f.AssetKey
|WHERE f.CollectionId = @CollectionId AND f.Tier IS NULL AND a.Tier IS NOT NULL;
|SELECT @@ROWCOUNT;
|'@
|}
|
|function Get-SIDataInsertRecommendationSql {
|    @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|INSERT sidata.Recommendation (CollectionId, AssetKey, RecommendationId, Name, Severity, Tier, DetailJson)
|SELECT @CollectionId, NULLIF(j.AssetKey, ''), NULLIF(j.RecommendationId, ''), NULLIF(j.Name, ''), NULLIF(j.Severity, ''), j.Tier, j.DetailJson
|FROM OPENJSON(@j) WITH (AssetKey nvarchar(400), RecommendationId nvarchar(400), Name nvarchar(1000), Severity nvarchar(30), Tier tinyint,
|                        DetailJson nvarchar(max)) j;
|DECLARE @n int = @@ROWCOUNT;
|COMMIT;
|SELECT @n;
|'@
|}
|
|function Get-SIDataUpsertAssetSql {
|    # Current state: a newer sighting moves LastSeen forward, never back; a value missing this time keeps the old one.
|    @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @a TABLE (AssetKey nvarchar(400) PRIMARY KEY, AssetName nvarchar(400), AssetKind nvarchar(16), AssetKinds nvarchar(64), Tier tinyint,
|                  KeySource nvarchar(16), LastSeen datetime2(3), PropertiesJson nvarchar(max));
|INSERT @a SELECT j.AssetKey, NULLIF(j.AssetName, ''), NULLIF(j.AssetKind, ''), NULLIF(j.AssetKinds, ''), j.Tier, j.KeySource, CONVERT(datetime2(3), j.LastSeen, 126), j.PropertiesJson
|FROM OPENJSON(@j) WITH (AssetKey nvarchar(400), AssetName nvarchar(400), AssetKind nvarchar(16), AssetKinds nvarchar(64), Tier tinyint, KeySource nvarchar(16),
|                        LastSeen nvarchar(40), PropertiesJson nvarchar(max)) j;
|UPDATE t SET AssetName = COALESCE(s.AssetName, t.AssetName), AssetKind = COALESCE(s.AssetKind, t.AssetKind),
|             AssetKinds = COALESCE(s.AssetKinds, t.AssetKinds), Tier = COALESCE(s.Tier, t.Tier),
|             KeySource = s.KeySource, LastSeen = CASE WHEN s.LastSeen > t.LastSeen THEN s.LastSeen ELSE t.LastSeen END,
|             PropertiesJson = COALESCE(s.PropertiesJson, t.PropertiesJson), UpdatedAt = SYSUTCDATETIME()
|FROM sidata.Asset t JOIN @a s ON s.AssetKey = t.AssetKey;
|INSERT sidata.Asset (AssetKey, AssetName, AssetKind, AssetKinds, Tier, KeySource, FirstSeen, LastSeen, PropertiesJson)
|SELECT s.AssetKey, s.AssetName, s.AssetKind, s.AssetKinds, s.Tier, s.KeySource, s.LastSeen, s.LastSeen, s.PropertiesJson
|FROM @a s WHERE NOT EXISTS (SELECT 1 FROM sidata.Asset t WHERE t.AssetKey = s.AssetKey);
|COMMIT;
|SELECT COUNT(*) FROM @a;
|'@
|}
|
|function Get-SIDataUpsertIdentifierSql {
|    @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @i TABLE (AssetKey nvarchar(400), IdentifierType nvarchar(64), IdentifierValue nvarchar(256), SeenAt datetime2(3));
|INSERT @i SELECT j.AssetKey, j.IdentifierType, j.IdentifierValue, CONVERT(datetime2(3), j.SeenAt, 126)
|FROM OPENJSON(@j) WITH (AssetKey nvarchar(400), IdentifierType nvarchar(64), IdentifierValue nvarchar(256), SeenAt nvarchar(40)) j;
|UPDATE t SET LastSeen = CASE WHEN s.SeenAt > t.LastSeen THEN s.SeenAt ELSE t.LastSeen END
|FROM sidata.AssetIdentifier t JOIN @i s ON s.AssetKey = t.AssetKey AND s.IdentifierType = t.IdentifierType AND s.IdentifierValue = t.IdentifierValue;
|INSERT sidata.AssetIdentifier (AssetKey, IdentifierType, IdentifierValue, FirstSeen, LastSeen)
|SELECT s.AssetKey, s.IdentifierType, s.IdentifierValue, s.SeenAt, s.SeenAt
|FROM @i s WHERE NOT EXISTS (SELECT 1 FROM sidata.AssetIdentifier t
|                            WHERE t.AssetKey = s.AssetKey AND t.IdentifierType = s.IdentifierType AND t.IdentifierValue = s.IdentifierValue);
|COMMIT;
|SELECT COUNT(*) FROM @i;
|'@
|}
|
|function Get-SIDataScoreMaxColumnSql {
|    <#
|        #245 -- adds FindingDaily.ScoreMax (the highest finding score per group) to a database set up before it existed.
|        The SAME guarded, additive statement as sql/si-data-schema.sql, run before the aggregate is written, so a
|        customer database does not need setup run again for the column to appear. Never alters or drops anything.
|    #>
|    "IF COL_LENGTH('sidata.FindingDaily', 'ScoreMax') IS NULL ALTER TABLE sidata.FindingDaily ADD ScoreMax FLOAT NULL; SELECT 1;"
|}
|
|function Get-SIDataExemptionColumnsSql {
|    <#
|        #264 -- the exemption MARK on sidata.Finding (ExemptionId, ExemptedUntil, ExemptionRequestId) and
|        Collection.ExemptedDerivedAt, added to a database set up before they existed: the SAME guarded, additive statements
|        as sql/si-data-schema.sql, run before a collection is loaded, so every finding lands with its mark even before setup
|        is run again. Also sidata.Asset.AssetKinds (#431, every kind a CI is made of), which the asset upsert writes.
|        Never alters or drops anything. (The counted twin TABLES come with setup; see
|        Get-SIDataExemptedSchemaCheckSql.)
|    #>
|    @'
|IF COL_LENGTH('sidata.Finding', 'ExemptionId') IS NULL ALTER TABLE sidata.Finding ADD ExemptionId BIGINT NULL;
|IF COL_LENGTH('sidata.Finding', 'ExemptedUntil') IS NULL ALTER TABLE sidata.Finding ADD ExemptedUntil DATETIME2(0) NULL;
|IF COL_LENGTH('sidata.Finding', 'ExemptionRequestId') IS NULL ALTER TABLE sidata.Finding ADD ExemptionRequestId BIGINT NULL;
|IF COL_LENGTH('sidata.Collection', 'ExemptedDerivedAt') IS NULL ALTER TABLE sidata.Collection ADD ExemptedDerivedAt DATETIME2(0) NULL;
|IF COL_LENGTH('sidata.Asset', 'AssetKinds') IS NULL ALTER TABLE sidata.Asset ADD AssetKinds NVARCHAR(64) NULL;
|SELECT 1;
|'@
|}
|
|function Get-SIDataPartialTableSql {
|    <#
|        A collection an Admin RELEASED although its run was not shown complete (Operations > Guards (safety checks), "Release: load this
|        collection anyway") is loaded ONCE and MARKED PARTIAL here (sidata.CollectionPartial: the reason, who released it,
|        when) -- the web app shows a "partial" badge wherever the collection is used (working rule 4: a partial result is
|        never shown as whole). The SAME guarded, additive statement as sql/si-data-schema.sql, run before such a load, so a
|        database does not need setup run again for it. Never alters or drops anything.
|    #>
|    @'
|IF OBJECT_ID('sidata.CollectionPartial') IS NULL
|CREATE TABLE sidata.CollectionPartial (
|    CollectionId     INT            NOT NULL CONSTRAINT PK_CollectionPartial PRIMARY KEY,
|    Reason           NVARCHAR(2000) NULL,
|    ReleasedBy       NVARCHAR(256)  NULL,
|    ReleasedUtc      DATETIME2(0)   NULL,
|    MarkedUtc        DATETIME2(0)   NOT NULL CONSTRAINT DF_CollectionPartial_MarkedUtc DEFAULT SYSUTCDATETIME()
|);
|SELECT 1;
|'@
|}
|
|function Get-SIDataMarkPartialSql {
|    <# One released collection, just loaded, marked partial (once); marks of collections that are gone are cleared. #>
|    @'
|DELETE FROM sidata.CollectionPartial WHERE NOT EXISTS (SELECT 1 FROM sidata.Collection AS c WHERE c.CollectionId = sidata.CollectionPartial.CollectionId);
|IF NOT EXISTS (SELECT 1 FROM sidata.CollectionPartial WHERE CollectionId = @CollectionId)
|INSERT sidata.CollectionPartial (CollectionId, Reason, ReleasedBy, ReleasedUtc)
|VALUES (@CollectionId, LEFT(@Reason, 2000), NULLIF(@By, ''), TRY_CONVERT(datetime2(0), NULLIF(@ReleasedUtc, ''), 126));
|SELECT 1;
|'@
|}
|
|function Get-SIDataFindingDailySql {
|    <#
|        The day's aggregate = the LATEST complete Detailed collection of that day, replacing whatever the day held.
|        Per group: findings, assets, the score total (kept ONLY so an average can be formed: ScoreTotal / Findings) and
|        the HIGHEST finding score (ScoreMax, #245). The web app shows the average and the highest, never the total.
|        -Counted (#264): the same day into sidata.FindingDailyCounted over the findings WITHOUT an exemption mark -- the
|        counted twin a dashboard reads when exempted findings are not counted.
|    #>
|    param([switch]$Counted)
|    $table = 'FindingDaily'; $mark = ''; $assets = 'AssetDaily'
|    if ($Counted) { $table = 'FindingDailyCounted'; $mark = ' AND f.ExemptionId IS NULL'; $assets = 'AssetDailyCounted' }
|    # #295: in the same transaction, the day's DISTINCT assets at every grain (sidata.AssetDaily, a CUBE of the four
|    # columns) -- the per-group Assets above is distinct only within its own group and must never be added up. Only where
|    # the table exists (the data sync adds it, Get-SIDataAssetDailyTablesSql): deferred name resolution, never executed
|    # otherwise.
|    (@'
|SET XACT_ABORT ON;
|DECLARE @d date = CONVERT(date, @Day, 126);
|DECLARE @c int = (SELECT TOP (1) CollectionId FROM sidata.Collection
|                  WHERE Kind = 'Detailed' AND Status = 'Complete' AND CollectionTime >= @d AND CollectionTime < DATEADD(day, 1, @d)
|                  ORDER BY CollectionTime DESC);
|-- #717: the day's collection had its finding rows removed by the retention -- its stored day totals are what is left of
|-- it, so they are KEPT as they are (never recomputed from no rows)
|IF @c IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RetiredAt') IS NOT NULL
|BEGIN
|    DECLARE @gone int = 0;
|    EXEC sp_executesql N'SELECT @g = COUNT(*) FROM sidata.Collection WHERE CollectionId = @c AND RetiredAt IS NOT NULL', N'@c int, @g int OUTPUT', @c = @c, @g = @gone OUTPUT;
|    IF @gone > 0 BEGIN SELECT 0; RETURN; END
|END
|BEGIN TRAN;
|DELETE FROM sidata.{TABLE} WHERE [Day] = @d;
|-- #855: the CI lifecycle is a KEY of every row (an asset has exactly one lifecycle, so the distinct assets of two lifecycles
|-- add up); a view reads the lifecycle a person chose (default: active)
|INSERT sidata.{TABLE} ([Day], CollectionId, Tier, Severity, SecurityDomain, ReportName, Findings, Assets, ScoreTotal, ScoreMax, CiLifecycle)
|SELECT @d, @c, f.Tier, ISNULL(f.Severity, ''), ISNULL(f.SecurityDomain, ''), ISNULL(f.ReportName, ''),
|       COUNT(*), COUNT(DISTINCT f.AssetKey), ISNULL(SUM(f.RiskScore), 0), MAX(f.RiskScore), f.CiLifecycle
|FROM sidata.Finding f
|WHERE @c IS NOT NULL AND f.CollectionId = @c{MARK}
|GROUP BY f.CiLifecycle, f.Tier, ISNULL(f.Severity, ''), ISNULL(f.SecurityDomain, ''), ISNULL(f.ReportName, '');
|DECLARE @n int = @@ROWCOUNT;
|IF OBJECT_ID('sidata.{ASSETS}') IS NOT NULL
|BEGIN
|    DELETE FROM sidata.{ASSETS} WHERE [Day] = @d;
|    -- GroupingId stays the CUBE of the four columns; the lifecycle is never grouped away
|    INSERT sidata.{ASSETS} ([Day], CollectionId, GroupingId, Tier, Severity, SecurityDomain, ReportName, Assets, CiLifecycle)
|    SELECT @d, @c, GROUPING_ID(g.Tier, g.Sev, g.Dom, g.Rep), g.Tier, g.Sev, g.Dom, g.Rep, COUNT(DISTINCT g.AssetKey), g.Lc
|    FROM (SELECT f.Tier, ISNULL(f.Severity, '') AS Sev, ISNULL(f.SecurityDomain, '') AS Dom, ISNULL(f.ReportName, '') AS Rep, f.AssetKey, f.CiLifecycle AS Lc
|          FROM sidata.Finding f WHERE @c IS NOT NULL AND f.CollectionId = @c{MARK}) AS g
|    GROUP BY g.Lc, CUBE (g.Tier, g.Sev, g.Dom, g.Rep);
|END;
|COMMIT;
|SELECT @n;
|'@).Replace('{TABLE}', $table).Replace('{MARK}', $mark).Replace('{ASSETS}', $assets)
|}
|
|function Get-SIDataAssetDailyTablesSql {
|    <#
|        #295 -- adds sidata.AssetDaily and its counted twin (the distinct assets at every grain) to a database set up before
|        they existed: the SAME guarded, additive statements as sql/si-data-schema.sql, so a customer database does not need
|        setup run again. Never alters or drops anything.
|    #>
|    $parts = foreach ($t in 'AssetDaily', 'AssetDailyCounted') {
|@"
|IF OBJECT_ID('sidata.$t') IS NULL
|CREATE TABLE sidata.$t (
|    AssetDailyId     BIGINT IDENTITY(1, 1) NOT NULL CONSTRAINT PK_$t PRIMARY KEY NONCLUSTERED,
|    [Day]            DATE           NOT NULL,
|    CollectionId     INT            NOT NULL CONSTRAINT FK_$($t)_Collection REFERENCES sidata.Collection (CollectionId),
|    GroupingId       TINYINT        NOT NULL,
|    Tier             TINYINT        NULL,
|    Severity         NVARCHAR(30)   NULL,
|    SecurityDomain   NVARCHAR(128)  NULL,
|    ReportName       NVARCHAR(256)  NULL,
|    Assets           INT            NOT NULL
|);
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'CX_$($t)_Day' AND object_id = OBJECT_ID('sidata.$t'))
|CREATE CLUSTERED INDEX CX_$($t)_Day ON sidata.$t ([Day], GroupingId);
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_$($t)_Collection' AND object_id = OBJECT_ID('sidata.$t'))
|CREATE INDEX IX_$($t)_Collection ON sidata.$t (CollectionId);
|"@
|    }
|    ($parts -join "`n") + "`nSELECT 1;"
|}
|
|function Get-SIDataAssetDailyPendingSql {
|    <#
|        #295 -- the days whose FindingDaily has rows but whose distinct-asset grains (AssetDaily) were never computed: every
|        day loaded before the table existed. The data sync recomputes each such day once (Get-SIDataFindingDailySql, and its
|        counted twin where the day's collection has twins). Nothing when the table does not exist yet.
|    #>
|    @'
|DECLARE @q nvarchar(max) = N'SELECT CAST(NULL AS nvarchar(10)) AS [Day], CAST(0 AS bit) AS Counted WHERE 1 = 0';
|IF OBJECT_ID('sidata.AssetDaily') IS NOT NULL
|    SET @q += N' UNION SELECT DISTINCT CONVERT(nvarchar(10), fd.[Day], 23), CAST(0 AS bit) FROM sidata.FindingDaily AS fd
|                 WHERE NOT EXISTS (SELECT 1 FROM sidata.AssetDaily AS ad WHERE ad.[Day] = fd.[Day])';
|IF OBJECT_ID('sidata.AssetDailyCounted') IS NOT NULL AND OBJECT_ID('sidata.FindingDailyCounted') IS NOT NULL
|    SET @q += N' UNION SELECT DISTINCT CONVERT(nvarchar(10), fc.[Day], 23), CAST(1 AS bit) FROM sidata.FindingDailyCounted AS fc
|                 WHERE NOT EXISTS (SELECT 1 FROM sidata.AssetDailyCounted AS ac WHERE ac.[Day] = fc.[Day])';
|SET @q += N' ORDER BY 1, 2';
|EXEC sp_executesql @q;
|'@
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  #855 W10 THE CI LIFECYCLE ON EVERY FINDING (sql\si-data-schema.sql "THE CI LIFECYCLE ON EVERY FINDING")
|# ------------------------------------------------------------------------------------------------------------------
|#  Owner 2026-10-21: "we need to be able to trust all data" / "default filter is active, so it should be active only". Risk
|#  Analysis keeps producing findings for CIs that are not seen or retired; what a view counts is decided by the CI's lifecycle
|#  (sidata.Ci.Lifecycle, the CI build's -- the settings in force), never by a day count of the view's own. Each finding of a
|#  collection is stamped with its CI's lifecycle when the collection is stored, BEFORE it is marked complete and before any
|#  aggregate is built from it, set-based in FindingId ranges sized from their measured time. A collection stored before the
|#  column existed is unstamped (every finding counts as active, as before); the newest one is stamped ONCE and derived again
|#  (Invoke-SIDataCiLifecycleRestamp), so the views are right from the first data sync after the update.
|
|# the derived tables that carry the lifecycle as a key / a column (the schema file's list; the data sync adds the columns too)
|$script:SIDataCiLifecycleTables = @('FindingDaily', 'FindingDailyCounted', 'AssetDaily', 'AssetDailyCounted', 'FindingPivotCell', 'FindingPivotCellCounted',
|                                     'PivotCell', 'AssetRiskSummary', 'AssetRiskSummaryCounted', 'Tier0Asset', 'Tier0AssetCounted', 'CiFindingSummary')
|
|function Get-SIDataCiLifecycleColumnsSql {
|    <#
|        The lifecycle columns -- the SAME guarded, additive statements as sql\si-data-schema.sql (a test holds the two equal),
|        so the data sync of an install whose schema was applied before them adds them itself. A column add is metadata only.
|        Never alters or drops anything.
|    #>
|    $l = New-Object System.Collections.Generic.List[string]
|    $l.Add("IF COL_LENGTH('sidata.Finding', 'CiLifecycle') IS NULL ALTER TABLE sidata.Finding ADD CiLifecycle NVARCHAR(16) NULL;")
|    $l.Add("IF COL_LENGTH('sidata.Collection', 'CiLifecycleAt') IS NULL ALTER TABLE sidata.Collection ADD CiLifecycleAt DATETIME2(0) NULL;")
|    foreach ($t in $script:SIDataCiLifecycleTables) {
|        if ($t -eq 'FindingDaily') { $l.Add("IF COL_LENGTH('sidata.FindingDaily', 'CiLifecycle') IS NULL ALTER TABLE sidata.FindingDaily ADD CiLifecycle NVARCHAR(16) NULL;"); continue }
|        $l.Add("IF COL_LENGTH('sidata.$t', 'CiLifecycle') IS NULL AND OBJECT_ID('sidata.$t') IS NOT NULL ALTER TABLE sidata.$t ADD CiLifecycle NVARCHAR(16) NULL;")
|        if ($t -like 'AssetRiskSummary*') { $l.Add("IF COL_LENGTH('sidata.$t', 'Unclassified') IS NULL AND OBJECT_ID('sidata.$t') IS NOT NULL ALTER TABLE sidata.$t ADD Unclassified BIGINT NULL;") }
|    }
|    # W9: the vulnerabilities' closes by reason
|    foreach ($c in 'ClosedFixed', 'ClosedRetired', 'ClosedOther') { $l.Add("IF COL_LENGTH('sidata.VulnLifecycleDaily', '$c') IS NULL ALTER TABLE sidata.VulnLifecycleDaily ADD $c INT NULL;") }
|    ($l -join "`r`n") + "`r`nSELECT 1;"
|}
|
|function Get-SIDataCiLifecycleReadySql {
|    <# 1 when the findings carry the lifecycle column and the CIs exist to stamp it from; else 0. #>
|    "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'CiLifecycle') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'CiLifecycleAt') IS NOT NULL AND OBJECT_ID('sidata.Ci') IS NOT NULL AND OBJECT_ID('sidata.CiLink') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataCiLifecycleStampSql {
|    <#
|        One FindingId range (@After, @Upto] of one collection: each finding's CI lifecycle, from the CI the key figures resolve
|        (SI-DataKeyFigures.ps1): the CI whose id is the finding's AssetKey, else the CI that carries the AssetKey as a linked
|        object (sidata.CiLink.NativeId, the primary and newest link first). A CI without a lifecycle is active; a finding no CI
|        carries is left NULL (not known to be gone: counted as active). Resolved ONCE per distinct asset of the range, then
|        one set-based update of only the rows whose value differs. Answers the rows written.
|    #>
|    @'
|SET NOCOUNT ON;
|CREATE TABLE #m (AssetKey NVARCHAR(400) COLLATE DATABASE_DEFAULT NOT NULL PRIMARY KEY, Lc NVARCHAR(16) COLLATE DATABASE_DEFAULT NULL);
|INSERT #m (AssetKey, Lc)
|SELECT a.AssetKey,
|       CASE WHEN ci.CiId IS NOT NULL THEN ISNULL(NULLIF(ci.Lifecycle, N''), N'active')
|            WHEN lk.CiId IS NOT NULL THEN ISNULL(NULLIF(lk.Lifecycle, N''), N'active') END
|FROM (SELECT DISTINCT f.AssetKey FROM sidata.Finding AS f
|      WHERE f.CollectionId = @CollectionId AND f.FindingId > @After AND f.FindingId <= @Upto AND f.AssetKey IS NOT NULL) AS a
|LEFT JOIN sidata.Ci AS ci ON LEN(a.AssetKey) <= 64 AND ci.CiId = a.AssetKey
|OUTER APPLY (SELECT TOP (1) l.CiId, c2.Lifecycle FROM sidata.CiLink AS l JOIN sidata.Ci AS c2 ON c2.CiId = l.CiId
|             WHERE ci.CiId IS NULL AND LEN(a.AssetKey) <= 450 AND l.NativeId = LOWER(a.AssetKey)
|             ORDER BY l.IsPrimary DESC, l.LastSeen DESC) AS lk;
|UPDATE f SET CiLifecycle = m.Lc
|FROM sidata.Finding AS f
|JOIN #m AS m ON m.AssetKey = f.AssetKey
|WHERE f.CollectionId = @CollectionId AND f.FindingId > @After AND f.FindingId <= @Upto
|  AND (f.CiLifecycle IS NULL AND m.Lc IS NOT NULL OR f.CiLifecycle IS NOT NULL AND m.Lc IS NULL OR f.CiLifecycle <> m.Lc);
|SELECT @@ROWCOUNT;
|'@
|}
|
|function Get-SIDataCiLifecycleStampedSql {
|    <# The collection's findings are stamped (Collection.CiLifecycleAt). #>
|    "UPDATE sidata.Collection SET CiLifecycleAt = SYSUTCDATETIME() WHERE CollectionId = @CollectionId; SELECT @@ROWCOUNT;"
|}
|
|function Invoke-SIDataCiLifecycleStamp {
|    <#
|        Stamps ONE collection's findings with their CI's lifecycle (Get-SIDataCiLifecycleStampSql) in FindingId ranges sized
|        from their measured time and paced by the database's load (as the derive), then CiLifecycleAt. A database without the
|        column or the CIs stamps nothing (answers -1). Returns the rows written.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$CollectionId, [ref]$BatchSize, [long]$TargetMs = 5000)
|    if (([int](& $Invoke (Get-SIDataCiLifecycleReadySql) @{} 'scalar')) -ne 1) { return -1L }
|    $bRaw = & $Invoke (Get-SIDataFindingBoundsSql) @{ CollectionId = $CollectionId } 'reader'
|    $b = @($bRaw) | Select-Object -First 1
|    $done = 0L
|    if ($b -and $null -ne $b['Lo'] -and -not ($b['Lo'] -is [System.DBNull])) {
|        $lo = [long]$b['Lo']; $hi = [long]$b['Hi']
|        $size = [long]50000; if ($BatchSize -and $BatchSize.Value -gt 0) { $size = [long]$BatchSize.Value }
|        $after = $lo - 1
|        $paced = [bool](Get-Command -Name Invoke-SISqlPacing -ErrorAction SilentlyContinue); $lastMs = 0L
|        $sql = Get-SIDataCiLifecycleStampSql
|        while ($after -lt $hi) {
|            if ($paced) { $pace = Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs; if ($pace.Shrink) { $size = [Math]::Max(500L, [long][Math]::Floor($size / 2)) } }
|            $upto = [Math]::Min($hi, $after + $size)
|            $sw = [Diagnostics.Stopwatch]::StartNew()
|            $done += [long](& $Invoke $sql @{ CollectionId = $CollectionId; After = $after; Upto = $upto } 'scalar')
|            $sw.Stop(); $lastMs = $sw.ElapsedMilliseconds
|            $after = $upto
|            $size = Get-SIDataNextSize -Current $size -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 500
|        }
|        if ($BatchSize) { $BatchSize.Value = $size }
|    }
|    [void](& $Invoke (Get-SIDataCiLifecycleStampedSql) @{ CollectionId = $CollectionId } 'scalar')
|    $done
|}
|
|function Get-SIDataCiLifecycleRestampSql {
|    <#
|        The collections the views open by default that were stored before the lifecycle was stamped: the newest complete
|        Detailed collection and the published one (sidata.PublishedRun), when their CiLifecycleAt is empty. Older collections
|        stay as they were (their findings count as active -- their trend days are what they were). Never a retired collection.
|    #>
|    $live = Get-SIDataLiveFilter -Alias 'c'
|    @"
|SELECT c.CollectionId, CONVERT(nvarchar(10), c.CollectionTime, 23) AS [Day], c.CollectionTime
|FROM sidata.Collection AS c
|WHERE c.Kind = 'Detailed' AND c.Status = 'Complete' AND c.CiLifecycleAt IS NULL$live
|  AND (c.CollectionId = (SELECT TOP (1) n.CollectionId FROM sidata.Collection AS n WHERE n.Kind = 'Detailed' AND n.Status = 'Complete' ORDER BY n.CollectionTime DESC)
|       OR (OBJECT_ID('sidata.PublishedRun') IS NOT NULL AND c.CollectionId IN (SELECT p.DetailedCollectionId FROM sidata.PublishedRun AS p WHERE p.Name = N'current')))
|ORDER BY c.CollectionTime DESC
|"@
|}
|
|function Get-SIDataCiLifecycleRederiveSql {
|    <#
|        A collection stamped after it was derived is derived again: its views' data (DerivedAt -- the facets, and through it
|        every per-collection aggregate, the prepared context, the summaries, the remediations and the key figures, which are
|        built again when they are older than the derive) and its departments (ResolvedVersion). Its day's FindingDaily is
|        worked out again by the caller.
|    #>
|    "UPDATE sidata.Collection SET DerivedAt = NULL, ResolvedVersion = NULL WHERE CollectionId = @CollectionId; SELECT @@ROWCOUNT;"
|}
|
|function Invoke-SIDataCiLifecycleRestamp {
|    <#
|    .SYNOPSIS  Stamps the newest and the published collection once when they were stored before the lifecycle was stamped, and
|               marks them to be derived again by this run's own steps. Never throws.
|    .NOTES     Returns @{ Status; Collections; Findings }. Bounded: at most these two collections, ever once each.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [switch]$DryRun, [scriptblock]$Log)
|    if (-not $Log) { $Log = { param($l, $m) Write-Host ('[{0}] {1}' -f $l, $m) } }
|    try {
|        if (([int](& $Invoke (Get-SIDataCiLifecycleReadySql) @{} 'scalar')) -ne 1) { return [pscustomobject]@{ Status = 'no-schema'; Collections = 0; Findings = 0 } }
|        $pending = @(@(& $Invoke (Get-SIDataCiLifecycleRestampSql) @{} 'reader') | ForEach-Object { $_ } | Where-Object { $_ })
|        if ($pending.Count -eq 0) { return [pscustomobject]@{ Status = 'ok'; Collections = 0; Findings = 0 } }
|        if ($DryRun) {
|            & $Log 'INFO' ("lifecycle   : {0} collection(s) would be stamped with their CIs' lifecycle and derived again; nothing is written." -f $pending.Count)
|            return [pscustomobject]@{ Status = 'dry-run'; Collections = 0; Findings = 0; Pending = $pending.Count }
|        }
|        $n = 0L; $bs = [long]0
|        foreach ($p in $pending) {
|            $cid = [int]$p['CollectionId']
|            $n += [long](Invoke-SIDataCiLifecycleStamp -Invoke $Invoke -CollectionId $cid -BatchSize ([ref]$bs))
|            [void](& $Invoke (Get-SIDataCiLifecycleRederiveSql) @{ CollectionId = $cid } 'scalar')
|            [void](Invoke-SIDataFindingDaily -Invoke $Invoke -Day ([string]$p['Day']))
|        }
|        & $Log 'OK' ("lifecycle   : {0} collection(s) stamped with their CIs' lifecycle ({1} finding row(s)) -- their views are worked out again in this run, active CIs by default" -f $pending.Count, $n)
|        [pscustomobject]@{ Status = 'ok'; Collections = $pending.Count; Findings = $n }
|    } catch {
|        & $Log 'WARN' ("lifecycle   : the CIs' lifecycle was not stamped on the newest collection this run -- {0}. It is tried again on the next run; until then its findings count as active." -f $_.Exception.Message)
|        [pscustomobject]@{ Status = 'failed'; Error = $_.Exception.Message; Collections = 0; Findings = 0 }
|    }
|}
|
|function Get-SIDataVulnLifecycleSql {
|    <#
|        Every day from the first close-loop event to today: opened, closed (by SI or an engineer), reopened, and the
|        number open at the end of the day (a running sum of the state changes). -1 when the close-loop is not installed.
|        #855 W9: the closes split by reason -- fixed (Remediated), asset retired (AssetRetired), any other reason.
|    #>
|    @'
|SET XACT_ABORT ON;
|IF OBJECT_ID('vuln.VulnerabilityEvent') IS NULL BEGIN SELECT -1; RETURN; END;
|DECLARE @first date = (SELECT CAST(MIN([At]) AS date) FROM vuln.VulnerabilityEvent);
|DECLARE @last date = CAST(SYSUTCDATETIME() AS date);
|IF @first IS NULL BEGIN SELECT 0; RETURN; END;
|CREATE TABLE #lc ([Day] date PRIMARY KEY, Opened int, Closed int, Reopened int, OpenAtEndOfDay int, ClosedFixed int, ClosedRetired int, ClosedOther int);
|WITH firstopen AS (
|    -- #292: THE BASELINE. The first snapshot a source sent is what was already there, not what is new: its Open
|    -- events (the source's first run, or its first day when the run is not recorded) count toward the open total but
|    -- never as "opened". Without this every finding of the connector's first snapshot read as new for a week.
|    SELECT i.Source, MIN(e.[At]) AS FirstAt
|    FROM vuln.VulnerabilityEvent AS e JOIN vuln.VulnerabilityItem AS i ON i.SysId = e.SysId
|    WHERE e.Action = 'Open'
|    GROUP BY i.Source
|), baseline AS (
|    SELECT f.Source, f.FirstAt,
|           (SELECT TOP (1) e2.RunId FROM vuln.VulnerabilityEvent AS e2 JOIN vuln.VulnerabilityItem AS i2 ON i2.SysId = e2.SysId
|             WHERE i2.Source = f.Source AND e2.Action = 'Open' AND e2.[At] = f.FirstAt) AS RunId
|    FROM firstopen AS f
|), ev AS (
|    SELECT CAST(e.[At] AS date) AS [Day],
|           SUM(CASE WHEN e.Action = 'Open'
|                     AND NOT (b.Source IS NOT NULL AND ((b.RunId IS NOT NULL AND e.RunId = b.RunId)
|                                                     OR (b.RunId IS NULL AND CAST(e.[At] AS date) = CAST(b.FirstAt AS date))))
|                    THEN 1 ELSE 0 END) AS Opened,
|           SUM(CASE WHEN e.Action IN ('Close', 'EngineerClose') THEN 1 ELSE 0 END) AS Closed,
|           -- #855 W9: a close is FIXED only when its reason is Remediated; an asset that retired is not fixed work, nor is any other reason
|           SUM(CASE WHEN e.Action IN ('Close', 'EngineerClose') AND LEFT(ISNULL(e.Reason, N''), CHARINDEX(N':', ISNULL(e.Reason, N'') + N':') - 1) = N'Remediated' THEN 1 ELSE 0 END) AS ClosedFixed,
|           SUM(CASE WHEN e.Action IN ('Close', 'EngineerClose') AND LEFT(ISNULL(e.Reason, N''), CHARINDEX(N':', ISNULL(e.Reason, N'') + N':') - 1) = N'AssetRetired' THEN 1 ELSE 0 END) AS ClosedRetired,
|           SUM(CASE WHEN e.Action = 'Reopen' THEN 1 ELSE 0 END) AS Reopened,
|           SUM(CASE WHEN e.ToState = 'Open' AND ISNULL(e.FromState, '') <> 'Open' THEN 1
|                    WHEN e.FromState = 'Open' AND ISNULL(e.ToState, '') <> 'Open' THEN -1 ELSE 0 END) AS Delta
|    FROM vuln.VulnerabilityEvent AS e
|    LEFT JOIN vuln.VulnerabilityItem AS i ON i.SysId = e.SysId
|    LEFT JOIN baseline AS b ON b.Source = i.Source
|    GROUP BY CAST(e.[At] AS date)
|), cal AS (
|    SELECT @first AS [Day] UNION ALL SELECT DATEADD(day, 1, [Day]) FROM cal WHERE [Day] < @last
|)
|INSERT #lc ([Day], Opened, Closed, Reopened, OpenAtEndOfDay, ClosedFixed, ClosedRetired, ClosedOther)
|SELECT cal.[Day], ISNULL(ev.Opened, 0), ISNULL(ev.Closed, 0), ISNULL(ev.Reopened, 0),
|       SUM(ISNULL(ev.Delta, 0)) OVER (ORDER BY cal.[Day] ROWS UNBOUNDED PRECEDING),
|       ISNULL(ev.ClosedFixed, 0), ISNULL(ev.ClosedRetired, 0), ISNULL(ev.Closed, 0) - ISNULL(ev.ClosedFixed, 0) - ISNULL(ev.ClosedRetired, 0)
|FROM cal LEFT JOIN ev ON ev.[Day] = cal.[Day]
|OPTION (MAXRECURSION 0);
|BEGIN TRAN;
|DELETE FROM sidata.VulnLifecycleDaily;
|INSERT sidata.VulnLifecycleDaily ([Day], Opened, Closed, Reopened, OpenAtEndOfDay)
|SELECT [Day], Opened, Closed, Reopened, OpenAtEndOfDay FROM #lc;
|-- #855 W9: the closes by reason, where the database carries the columns (the data sync adds them: Get-SIDataCiLifecycleColumnsSql)
|IF COL_LENGTH('sidata.VulnLifecycleDaily', 'ClosedFixed') IS NOT NULL
|    EXEC sp_executesql N'UPDATE d SET ClosedFixed = l.ClosedFixed, ClosedRetired = l.ClosedRetired, ClosedOther = l.ClosedOther FROM sidata.VulnLifecycleDaily AS d JOIN #lc AS l ON l.[Day] = d.[Day];';
|COMMIT;
|SELECT COUNT(*) FROM #lc;
|'@
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE COLLECTION VIEWS' DATA (#241): columns derived from DetailJson + the per-collection aggregate (sidata.FindingFacet)
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SIDataViewsSchemaCheckSql {
|    <# 1 when the database carries the collection views' columns and aggregate table (si-data-schema.sql, #241), else 0. #>
|    "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'RiskRating') IS NOT NULL AND COL_LENGTH('sidata.Finding', 'HasExploit') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'DerivedAt') IS NOT NULL AND OBJECT_ID('sidata.FindingFacet') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataUnderivedSql {
|    <#
|        Complete collections whose views' data is not computed yet -- new loads and, once, every collection loaded earlier.
|        Newest first. -Services (the database carries the Services view's tables, #255): also every collection whose
|        service membership is not computed yet, so an install extended later derives its older collections once.
|    #>
|    param([switch]$Services)
|    # #717: never a collection whose finding rows the retention removed (its aggregates are what is left of it)
|    $live = Get-SIDataLiveFilter
|    if ($Services) { return "SELECT CollectionId, CollectionTime FROM sidata.Collection WHERE Status = 'Complete' AND (DerivedAt IS NULL OR ServicesDerivedAt IS NULL)$live ORDER BY CollectionTime DESC" }
|    "SELECT CollectionId, CollectionTime FROM sidata.Collection WHERE Status = 'Complete' AND DerivedAt IS NULL$live ORDER BY CollectionTime DESC"
|}
|
|function Get-SIDataFindingBoundsSql {
|    "SELECT MIN(FindingId) AS Lo, MAX(FindingId) AS Hi FROM sidata.Finding WHERE CollectionId = @CollectionId"
|}
|
|# #830 / #834 THE RISK ANALYSIS ROW'S VALUES THE READERS READ ON EVERY FINDING, stored once at derive time (si-data-schema.sql
|# "RaRowAssetId ..."): column -> the row's fields, in the order the readers coalesce them; Kind 'value' = the value as text (a
|# list or an object as its JSON text), 'fill' = 1 when the field is not empty or blank (data quality's fill rule). The readers
|# (SI-VulnDesired.ps1, SI-DataQuality.ps1) name the same columns; SIv3-SqlOnlyReaders.Tests.ps1 keeps the three in step.
|$script:SIDataRowColumns = [ordered]@{
|    RaRowAssetId                = @{ Kind = 'value'; Fields = @('AssetId') }
|    RaRowSolutionVersion        = @{ Kind = 'value'; Fields = @('SolutionVersion') }
|    RaRowCriticalityTier        = @{ Kind = 'value'; Fields = @('CriticalityTier') }
|    RaRowSiComponent            = @{ Kind = 'value'; Fields = @('si_component') }
|    RaScopeRiskRating           = @{ Kind = 'value'; Fields = @('RiskRating', 'si_risk_rating') }
|    RaScopeCategory             = @{ Kind = 'value'; Fields = @('si_category', 'Category') }
|    RaScopeSubcategory          = @{ Kind = 'value'; Fields = @('si_subcategory', 'SubCategory', 'Subcategory') }
|    RaScopeClass                = @{ Kind = 'value'; Fields = @('si_class', 'AssetClass') }
|    RaScopeComponent            = @{ Kind = 'value'; Fields = @('si_component', 'Component') }
|    RaScopePatchCycle           = @{ Kind = 'value'; Fields = @('si_patch_cycle') }
|    RaScopeOsFamily             = @{ Kind = 'value'; Fields = @('si_os_family') }
|    RaScopeSubCi                = @{ Kind = 'value'; Fields = @('si_servicenow_subci') }
|    RaScopeAffectedProduct      = @{ Kind = 'value'; Fields = @('si_affected_product') }
|    RaFillRiskFactorProbability = @{ Kind = 'fill'; Fields = @('RiskFactor_Probability_Detailed') }
|    RaFillRiskFactorConsequence = @{ Kind = 'fill'; Fields = @('RiskFactor_Consequence_Detailed') }
|}
|
|function Get-SIDataRowColumnExpr {
|    <#
|        PURE. The SQL that fills one row column from -Json (an expression of the row's JSON text), exactly the readers' former
|        per-finding read: one field = COALESCE(JSON_VALUE, JSON_QUERY); several = the first that is not empty (the readers'
|        coalesce, which skips empty text); 'fill' = 1 when the value trimmed of white space is not empty, else 0.
|    #>
|    param([Parameter(Mandatory)][string]$Column, [string]$Json = 'f.DetailJson',
|          # read from the row's ONE parse (Get-SIDataRowFieldsApply, alias rj) instead of one JSON_VALUE / JSON_QUERY per field --
|          # the same value: the scalar as text (NULL past 4,000 characters, as JSON_VALUE), else the list or object as JSON text
|          [switch]$Parsed)
|    $c = $script:SIDataRowColumns[$Column]; if (-not $c) { throw ("not a row column: '{0}'" -f $Column) }
|    $one = if ($Parsed) { { param([string]$fld) $n = (Get-SIDataRowFieldList).IndexOf($fld); "COALESCE(CASE WHEN LEN(rj.[v$n]) <= 4000 THEN rj.[v$n] END, rj.[j$n])" } }
|           else { { param([string]$fld) "COALESCE(JSON_VALUE($Json, N'$.$fld'), JSON_QUERY($Json, N'$.$fld'))" } }
|    if ($c.Kind -eq 'fill') { return ("CASE WHEN LEN(TRIM(CHAR(9) + CHAR(10) + CHAR(13) + CHAR(32) FROM COALESCE({0}, N''))) > 0 THEN 1 ELSE 0 END" -f (& $one $c.Fields[0])) }
|    if ($c.Fields.Count -eq 1) { return (& $one $c.Fields[0]) }
|    'COALESCE(' + ((@($c.Fields | ForEach-Object { "NULLIF($(& $one $_), N'')" })) -join ', ') + ')'
|}
|
|function Get-SIDataRowFieldList {
|    <# PURE. Every field the row columns read, once each, in a fixed order (the place names its parsed column). #>
|    $flds = New-Object System.Collections.Generic.List[string]
|    foreach ($c in $script:SIDataRowColumns.Values) { foreach ($x in $c.Fields) { if (-not $flds.Contains($x)) { $flds.Add($x) } } }
|    , $flds
|}
|
|function Get-SIDataRowFieldsApply {
|    <#
|        PURE. #834 the row's fields the row columns read, parsed ONCE per finding: OUTER APPLY OPENJSON ... WITH -- for each
|        field its scalar text (v_<field>) and its list or object (j_<field>, AS JSON). Measured at 20,000 findings: one
|        JSON_VALUE + JSON_QUERY per column parsed every row ~30 times more and took the derive from 16.3 to 39.7 s.
|    #>
|    $flds = Get-SIDataRowFieldList
|    # the columns by the field's place (v<n> / j<n>): two fields may differ only in case (SubCategory, Subcategory), and SQL names do not
|    $w = @(for ($i = 0; $i -lt $flds.Count; $i++) { $x = $flds[$i]; "[v$i] nvarchar(max) N'$.$x'"; "[j$i] nvarchar(max) N'$.$x' AS JSON" }) -join ', '
|    "OUTER APPLY OPENJSON(CASE WHEN ISJSON(f.DetailJson) = 1 THEN f.DetailJson END) WITH ($w) AS rj"
|}
|
|function Get-SIDataRowColumnsSql {
|    <#
|        2026-10-25 ONLY the row values ($script:SIDataRowColumns) of one FindingId range: exactly the derive's expressions over
|        exactly the derive's rows (ISJSON = 1), so a collection filled here holds what the derive would have written. The
|        vulnerability step runs BEFORE the data sync and reads the row values typed (set-based, Test-SIVulnSetBasedReady); it
|        fills them here first (Invoke-SIDataRowColumnsFill). -Carried: only the rows the data sync carried in (CarriedFrom),
|        for a collection whose own rows were filled that way (Invoke-SIDataDeriveCollection). Idempotent.
|    #>
|    param([switch]$Carried, [switch]$NoCount)
|    $set = @(foreach ($rc in $script:SIDataRowColumns.Keys) { '    {0} = {1}' -f $rc, (Get-SIDataRowColumnExpr -Column $rc -Parsed) }) -join ",`r`n"
|    $only = if ($Carried) { ' AND f.CarriedFrom IS NOT NULL' } else { '' }
|    $count = if ($NoCount) { '' } else { "`r`nSELECT @@ROWCOUNT;" }
|    "UPDATE f SET`r`n$set`r`nFROM sidata.Finding AS f`r`n$(Get-SIDataRowFieldsApply)`r`nWHERE f.CollectionId = @CollectionId AND f.FindingId > @After AND f.FindingId <= @Upto AND ISJSON(f.DetailJson) = 1$only;$count"
|}
|
|function Get-SIDataDeriveFindingSql {
|    <#
|        One FindingId range of one collection: the views' columns from DetailJson (the whole Log Analytics row). A value
|        Log Analytics stored as an array is read as its items. Lists are stored ';'-separated without padding, so a
|        token filter matches ';' + list + ';'. Re-running a range writes the same values (idempotent).
|        -Services (#255): also the CMDB service the row carried (cmdbId / cmdbName), only when the database has those columns.
|        -Fix (#590): also the finding's fix -- how to fix it, the recommended security update and its id, the affected
|        software (si_fix_remediation / si_fix_recommended_update / si_fix_recommended_update_id / si_affected_software),
|        only when the database has those columns (Get-SIDataFixSchemaCheckSql).
|        -Category (#834): also the Risk Analysis row's Category (RaCategory) -- exactly the expression the Domain -> Category
|        pairs read (Get-SIDataDomainCategorySql), so the pairs come from a narrow index, never every finding's JSON again.
|    #>
|    param([switch]$Services, [switch]$Fix, [switch]$Category,
|          # #830 / #834 also the row values the readers read on every finding ($script:SIDataRowColumns)
|          [switch]$RowColumns,
|          # 2026-10-25 the collection's own rows already carry the row values (the vulnerability step filled them, RaRowsAt):
|          # only the rows the data sync carried in get them here (Get-SIDataRowColumnsSql -Carried)
|          [switch]$CarriedRowColumns)
|    $svc = ''
|    if ($Services) {
|        $svc = ",`r`n    CmdbId            = LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.cmdbId'))), N''), 256)," +
|               "`r`n    CmdbName          = LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.cmdbName'))), N''), 400)"
|    }
|    if ($Fix) {
|        $svc += ",`r`n    FixRemediation         = LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.si_fix_remediation'))), N''), 4000)," +
|                "`r`n    FixRecommendedUpdate   = LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.si_fix_recommended_update'))), N''), 1000)," +
|                "`r`n    FixRecommendedUpdateId = LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.si_fix_recommended_update_id'))), N''), 1000)," +
|                "`r`n    AffectedSoftware       = LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.si_affected_software'))), N''), 2000)"
|    }
|    if ($Category) { $svc += ",`r`n    RaCategory        = LEFT(JSON_VALUE(f.DetailJson, '$.Category'), 128)" }
|    if ($RowColumns) { foreach ($rc in $script:SIDataRowColumns.Keys) { $svc += (",`r`n    {0} = {1}" -f $rc, (Get-SIDataRowColumnExpr -Column $rc -Parsed)) } }
|    $apply = if ($RowColumns) { "`r`n" + (Get-SIDataRowFieldsApply) } else { '' }
|    $tail = if ($CarriedRowColumns -and -not $RowColumns) { "DECLARE @n int = @@ROWCOUNT;`r`n" + (Get-SIDataRowColumnsSql -Carried -NoCount) + "`r`nSELECT @n;" } else { 'SELECT @@ROWCOUNT;' }
|    (@'
|UPDATE f SET
|    RiskScoreWeighted = TRY_CONVERT(float, JSON_VALUE(f.DetailJson, '$.RiskScoreTotal_Weighted')),
|    RiskRating        = LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.RiskRating'))), N''), 16),
|    MitreTactics      = LEFT(NULLIF(REPLACE(REPLACE(REPLACE(REPLACE(COALESCE(JSON_VALUE(f.DetailJson, '$.MITRE_Tactics'),
|                            REPLACE(REPLACE(REPLACE(REPLACE(JSON_QUERY(f.DetailJson, '$.MITRE_Tactics'), N'","', N';'), N'[', N''), N']', N''), N'"', N'')),
|                            N', ', N';'), N',', N';'), N'; ', N';'), N' ;', N';'), N''), 1000),
|    MitreTechniques   = LEFT(NULLIF(REPLACE(REPLACE(REPLACE(REPLACE(COALESCE(JSON_VALUE(f.DetailJson, '$.MITRE_Techniques'),
|                            REPLACE(REPLACE(REPLACE(REPLACE(JSON_QUERY(f.DetailJson, '$.MITRE_Techniques'), N'","', N';'), N'[', N''), N']', N''), N'"', N'')),
|                            N', ', N';'), N',', N';'), N'; ', N';'), N' ;', N';'), N''), 2000),
|    ComplianceTags    = LEFT(NULLIF(REPLACE(REPLACE(COALESCE(JSON_VALUE(f.DetailJson, '$.ComplianceTags'),
|                            REPLACE(REPLACE(REPLACE(REPLACE(JSON_QUERY(f.DetailJson, '$.ComplianceTags'), N'","', N';'), N'[', N''), N']', N''), N'"', N'')),
|                            N'; ', N';'), N' ;', N';'), N''), 2000),
|    Cvss              = COALESCE(TRY_CONVERT(float, JSON_VALUE(f.DetailJson, '$.MaxCvssScore')),
|                                 CASE WHEN f.Cve IS NOT NULL THEN TRY_CONVERT(float, JSON_VALUE(f.DetailJson, '$.Impact')) END),
|    HasExploit        = CASE LOWER(JSON_VALUE(f.DetailJson, '$.HasExploit')) WHEN 'true' THEN 1 WHEN '1' THEN 1 WHEN 'false' THEN 0 WHEN '0' THEN 0 END{0}
|FROM sidata.Finding AS f{1}
|WHERE f.CollectionId = @CollectionId AND f.FindingId > @After AND f.FindingId <= @Upto AND ISJSON(f.DetailJson) = 1;
|{2}
|'@).Replace('{0}', $svc).Replace('{1}', $apply).Replace('{2}', $tail)
|}
|
|function Get-SIDataFacetSql {
|    <#
|        The collection's aggregates for the facet views, replacing what it held, and DerivedAt -- one transaction, so a
|        reader sees the old set or the new one, never half. A list value (tactic, technique, tag) counts each finding
|        once per distinct item. CVSS bands are the CVSS v3 qualitative ratings.
|        -Counted (#264): the same aggregates over the findings WITHOUT an exemption mark, into sidata.FindingFacetCounted;
|        DerivedAt is not touched (the exempted step stamps ExemptedDerivedAt; a DerivedAt newer than it makes the twin stale).
|    #>
|    param([switch]$Counted)
|    $table = 'FindingFacet'; $mark = ''
|    $stamp = "UPDATE sidata.Collection SET DerivedAt = SYSUTCDATETIME() WHERE CollectionId = @CollectionId;"
|    if ($Counted) { $table = 'FindingFacetCounted'; $mark = ' AND ExemptionId IS NULL'; $stamp = '' }
|    (@'
|SET XACT_ABORT ON;
|CREATE TABLE #ff (Facet nvarchar(16) NOT NULL, Value nvarchar(256) NOT NULL, Findings int NOT NULL, Assets int NOT NULL,
|                  ScoreTotal float NOT NULL, WeightedTotal float NULL, MaxScore float NULL);
|{FACTS}
|INSERT #ff (Facet, Value, Findings, Assets, ScoreTotal, WeightedTotal, MaxScore)
|SELECT Facet, Value, COUNT(*), COUNT(DISTINCT AssetKey), ISNULL(SUM(RiskScore), 0), SUM(RiskScoreWeighted), MAX(RiskScore)
|FROM d GROUP BY Facet, Value;
|BEGIN TRAN;
|DELETE FROM sidata.{TABLE} WHERE CollectionId = @CollectionId;
|INSERT sidata.{TABLE} (CollectionId, Facet, Value, Findings, Assets, ScoreTotal, WeightedTotal, MaxScore)
|SELECT @CollectionId, Facet, Value, Findings, Assets, ScoreTotal, WeightedTotal, MaxScore FROM #ff;
|DECLARE @n int = @@ROWCOUNT;
|{STAMP}
|COMMIT;
|SELECT @n;
|'@).Replace('{FACTS}', (Get-SIDataFacetFactsSql -Where ('CollectionId = @CollectionId' + $mark))).Replace('{TABLE}', $table).Replace('{STAMP}', $stamp)
|}
|
|function Get-SIDataFacetFactsSql {
|    <#
|        THE facts of the facet aggregates, ONE text for the whole-collection statement (Get-SIDataFacetSql) and the ranged
|        one (Get-SIDataFacetRangeSql): the CTE chain f -> facts -> d over the findings -Where selects -- d is one row per
|        (finding, facet, value), a value counted once per finding. -FixColumn: the recommended update from the finding's
|        stored column (FixRecommendedUpdate, written by the derive with the SAME expression just before) instead of
|        parsing DetailJson again -- the same value, one JSON parse less per finding.
|    #>
|    param([Parameter(Mandatory)][string]$Where, [switch]$FixColumn)
|    $fix = "CASE WHEN ISJSON(DetailJson) = 1 THEN LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(DetailJson, '$.si_fix_recommended_update'))), N''), 1000) END AS FixUpdate"
|    if ($FixColumn) { $fix = 'CASE WHEN ISJSON(DetailJson) = 1 THEN FixRecommendedUpdate END AS FixUpdate' }
|    (@'
|WITH f AS (
|    SELECT FindingId, AssetKey, RiskScore, RiskScoreWeighted, RiskRating, MitreTactics, MitreTechniques, ComplianceTags, Cvss,
|           Severity, Tier, SecurityDomain, ReportName, Category, Subcategory, DepartmentName,
|           CASE WHEN ISJSON(DetailJson) = 1 THEN LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(DetailJson, '$.si_component'))), N''), 64) END AS Component,
|           {FIX}
|    -- #855: the facets count ACTIVE CIs only (a finding no CI carries, or of an unstamped collection, counts as active) -- their
|    -- key (CollectionId, Facet, Value) cannot take the lifecycle in an additive schema; the views say so
|    FROM sidata.Finding WHERE {WHERE} AND (CiLifecycle IS NULL OR CiLifecycle = N'active')
|), facts AS (
|    SELECT FindingId, N'rating' AS Facet, COALESCE(RiskRating, N'(none)') AS Value, AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'cvss', CASE WHEN Cvss IS NULL THEN N'(none)' WHEN Cvss >= 9 THEN N'Critical (9.0-10)' WHEN Cvss >= 7 THEN N'High (7.0-8.9)'
|                                              WHEN Cvss >= 4 THEN N'Medium (4.0-6.9)' WHEN Cvss > 0 THEN N'Low (0.1-3.9)' ELSE N'None (0)' END, AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'score', COALESCE(CONVERT(nvarchar(32), CONVERT(decimal(19, 1), RiskScore)), N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'weighted', COALESCE(CONVERT(nvarchar(32), CONVERT(bigint, FLOOR(RiskScoreWeighted))), N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'severity', COALESCE(Severity, N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'tier', COALESCE(CONVERT(nvarchar(8), Tier), N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'domain', COALESCE(SecurityDomain, N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'report', COALESCE(ReportName, N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    -- the findings grid's Category / Subcategory / Department dropdowns (owner 2026-10-28: "i would like these to be dropdowns")
|    UNION ALL SELECT FindingId, N'category', COALESCE(Category, N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'subcategory', COALESCE(Subcategory, N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'department', COALESCE(DepartmentName, N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'component', COALESCE(Component, N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT f.FindingId, N'tactic', LTRIM(RTRIM(s.value)), f.AssetKey, f.RiskScore, f.RiskScoreWeighted FROM f CROSS APPLY STRING_SPLIT(f.MitreTactics, N';') AS s WHERE f.MitreTactics IS NOT NULL
|    UNION ALL SELECT f.FindingId, N'technique', LTRIM(RTRIM(s.value)), f.AssetKey, f.RiskScore, f.RiskScoreWeighted FROM f CROSS APPLY STRING_SPLIT(f.MitreTechniques, N';') AS s WHERE f.MitreTechniques IS NOT NULL
|    UNION ALL SELECT f.FindingId, N'tag', LTRIM(RTRIM(s.value)), f.AssetKey, f.RiskScore, f.RiskScoreWeighted FROM f CROSS APPLY STRING_SPLIT(f.ComplianceTags, N';') AS s WHERE f.ComplianceTags IS NOT NULL
|    UNION ALL SELECT f.FindingId, N'update', LTRIM(RTRIM(s.value)), f.AssetKey, f.RiskScore, f.RiskScoreWeighted FROM f CROSS APPLY STRING_SPLIT(f.FixUpdate, N';') AS s WHERE f.FixUpdate IS NOT NULL
|), d AS (
|    SELECT DISTINCT FindingId, Facet, LEFT(Value, 256) AS Value, AssetKey, RiskScore, RiskScoreWeighted FROM facts WHERE Value <> N''
|)
|'@).Replace('{FIX}', $fix).Replace('{WHERE}', $Where).TrimEnd()
|}
|
|# ---- THE FACETS IN FINDING RANGES (a large collection) --------------------------------------------------------------
|#  Live 2026-10-19 (two large installs, 885,300 and 1,164,897 findings in one collection): the whole-collection facet
|#  statement (Get-SIDataFacetSql) ran past the data sync's SQL limit, so DerivedAt was never stamped and every run derived
|#  the collection again and failed the same way. The SAME aggregates are now built in FindingId ranges -- sized from their
|#  measured time and paced by the database's load, exactly as the derive's ranges -- each range staging its partial
|#  aggregate per (facet, value, CI) in sidata.FindingFacetStage; ONE closing statement groups the staged rows per (facet,
|#  value) and replaces the collection's aggregate (and stamps DerivedAt) in one transaction, as before. The ranges cut the
|#  findings in disjoint sets, so: findings = the sum of the ranges' counts, CIs = the distinct CI keys over all ranges
|#  (COUNT(DISTINCT), a CI without a key is not counted -- as before), scores = the sums and the maximum. Same rows.
|#  A database without the stage table (its schema not applied yet) builds the facets in one statement, as before.
|
|function Get-SIDataFacetStageReadySql { "SELECT CASE WHEN OBJECT_ID('sidata.FindingFacetStage') IS NOT NULL THEN 1 ELSE 0 END" }
|
|function Get-SIDataFacetStageClearSql {
|    <# One batch of a collection's staged facet rows of one variant (-Counted = @Counted 1), for Invoke-SIDataBatchedDelete. #>
|    "DELETE TOP (@Batch) FROM sidata.FindingFacetStage WHERE CollectionId = @CollectionId AND Counted = @Counted; SELECT @@ROWCOUNT;"
|}
|
|function Get-SIDataFacetRangeSql {
|    <# One FindingId range (@After, @Upto] of one collection: its partial facet aggregate per (facet, value, CI), staged.
|       -Counted: the findings without an exemption mark. Returns the rows staged. #>
|    param([switch]$Counted, [switch]$FixColumn)
|    $where = 'CollectionId = @CollectionId AND FindingId > @After AND FindingId <= @Upto'
|    if ($Counted) { $where += ' AND ExemptionId IS NULL' }
|    (@'
|SET NOCOUNT ON;
|{FACTS}
|INSERT sidata.FindingFacetStage (CollectionId, Counted, Facet, Value, AssetKey, Findings, ScoreTotal, WeightedTotal, MaxScore)
|SELECT @CollectionId, {C}, Facet, Value, AssetKey, COUNT(*), SUM(RiskScore), SUM(RiskScoreWeighted), MAX(RiskScore)
|FROM d GROUP BY Facet, Value, AssetKey;
|SELECT @@ROWCOUNT;
|'@).Replace('{FACTS}', (Get-SIDataFacetFactsSql -Where $where -FixColumn:$FixColumn)).Replace('{C}', $(if ($Counted) { '1' } else { '0' }))
|}
|
|function Get-SIDataFacetFinishSql {
|    <# The collection's aggregate from its staged ranges, replacing what it held -- and DerivedAt (not for -Counted) -- in ONE
|       transaction (a reader sees the old set or the new one). Returns the aggregate's rows. #>
|    param([switch]$Counted)
|    $table = 'FindingFacet'; $c = '0'
|    $stamp = "UPDATE sidata.Collection SET DerivedAt = SYSUTCDATETIME() WHERE CollectionId = @CollectionId;"
|    if ($Counted) { $table = 'FindingFacetCounted'; $c = '1'; $stamp = '' }
|    (@'
|SET XACT_ABORT ON;
|CREATE TABLE #ff (Facet nvarchar(16) NOT NULL, Value nvarchar(256) NOT NULL, Findings int NOT NULL, Assets int NOT NULL,
|                  ScoreTotal float NOT NULL, WeightedTotal float NULL, MaxScore float NULL);
|INSERT #ff (Facet, Value, Findings, Assets, ScoreTotal, WeightedTotal, MaxScore)
|SELECT Facet, Value, SUM(Findings), COUNT(DISTINCT AssetKey), ISNULL(SUM(ScoreTotal), 0), SUM(WeightedTotal), MAX(MaxScore)
|FROM sidata.FindingFacetStage WHERE CollectionId = @CollectionId AND Counted = {C}
|GROUP BY Facet, Value;
|BEGIN TRAN;
|DELETE FROM sidata.{TABLE} WHERE CollectionId = @CollectionId;
|INSERT sidata.{TABLE} (CollectionId, Facet, Value, Findings, Assets, ScoreTotal, WeightedTotal, MaxScore)
|SELECT @CollectionId, Facet, Value, Findings, Assets, ScoreTotal, WeightedTotal, MaxScore FROM #ff;
|DECLARE @n int = @@ROWCOUNT;
|{STAMP}
|COMMIT;
|SELECT @n;
|'@).Replace('{TABLE}', $table).Replace('{C}', $c).Replace('{STAMP}', $stamp)
|}
|
|$script:SIDataFacetStageMissingSaid = $false
|
|function Invoke-SIDataFacet {
|    <#
|        ONE collection's facet aggregate (-Counted: its counted twin): in FindingId ranges through the stage table when the
|        database has it, else in one statement (said once per process). The ranges are sized from their measured time
|        (-TargetMs, -BatchSize carries the size between calls) and paced by the database's load. What an earlier run left
|        staged for the collection is removed first; the staged rows are removed after the aggregate is replaced.
|        -Log { param($Level, $Message) }: a line about once a minute while the ranges run, and the total at the end.
|        Returns the aggregate's rows (as the one statement did).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$CollectionId, [switch]$Counted, [switch]$FixColumn,
|          [ref]$BatchSize, [long]$TargetMs = 5000, [scriptblock]$Log)
|    $ready = $false
|    try { $ready = ([int](& $Invoke (Get-SIDataFacetStageReadySql) @{} 'scalar')) -eq 1 } catch { $ready = $false }
|    if (-not $ready) {
|        if (-not $script:SIDataFacetStageMissingSaid -and $Log) {
|            $script:SIDataFacetStageMissingSaid = $true
|            & $Log 'WARN' 'facets      : the database does not have the table that builds the facet counts in parts yet -- they are built in one statement (the next update adds the table).'
|        }
|        return [int](& $Invoke (Get-SIDataFacetSql -Counted:$Counted) @{ CollectionId = $CollectionId } 'scalar')
|    }
|    $cv = $(if ($Counted) { 1 } else { 0 })
|    $del = [long]0
|    [void](Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataFacetStageClearSql) -Params @{ CollectionId = $CollectionId; Counted = $cv } -BatchSize ([ref]$del))
|    $bRaw = & $Invoke (Get-SIDataFindingBoundsSql) @{ CollectionId = $CollectionId } 'reader'
|    $b = @($bRaw) | Select-Object -First 1
|    if ($b -and $null -ne $b['Lo'] -and -not ($b['Lo'] -is [System.DBNull])) {
|        $lo = [long]$b['Lo']; $hi = [long]$b['Hi']
|        $size = [long]20000; if ($BatchSize -and $BatchSize.Value -gt 0) { $size = [long]$BatchSize.Value }
|        $after = $lo - 1
|        $paced = [bool](Get-Command -Name Invoke-SISqlPacing -ErrorAction SilentlyContinue); $lastMs = 0L
|        $sql = Get-SIDataFacetRangeSql -Counted:$Counted -FixColumn:$FixColumn
|        $all = [Diagnostics.Stopwatch]::StartNew(); $saidAt = 0.0; $ranges = 0
|        while ($after -lt $hi) {
|            if ($paced) { $pace = Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs; if ($pace.Shrink) { $size = [Math]::Max(500L, [long][Math]::Floor($size / 2)) } }
|            $upto = [Math]::Min($hi, $after + $size)
|            $sw = [Diagnostics.Stopwatch]::StartNew()
|            [void](& $Invoke $sql @{ CollectionId = $CollectionId; After = $after; Upto = $upto } 'scalar')
|            $sw.Stop(); $lastMs = $sw.ElapsedMilliseconds
|            $after = $upto; $ranges++
|            $size = Get-SIDataNextSize -Current $size -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 500
|            if ($Log -and ($all.Elapsed.TotalSeconds - $saidAt) -ge 60) {
|                $saidAt = $all.Elapsed.TotalSeconds
|                $pct = [int][Math]::Floor(100.0 * [double]($after - $lo + 1) / [double]([Math]::Max(1L, $hi - $lo + 1)))
|                & $Log 'INFO' ("facets      : the facet counts of the collection are being built -- {0} % of its findings so far" -f $pct)
|            }
|        }
|        if ($BatchSize) { $BatchSize.Value = $size }
|    }
|    $n = [int](& $Invoke (Get-SIDataFacetFinishSql -Counted:$Counted) @{ CollectionId = $CollectionId } 'scalar')
|    $del = [long]0
|    [void](Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataFacetStageClearSql) -Params @{ CollectionId = $CollectionId; Counted = $cv } -BatchSize ([ref]$del))
|    $n
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE SERVICES VIEW (#255): which CMDB service(s) each CI belongs to -- ONE resolver -- and the risk per service
|# ------------------------------------------------------------------------------------------------------------------
|#
|#  THE RESOLVER CONTRACT. "Which service(s) does a CI belong to" is answered in ONE place: the ordered list of
|#  membership sources returned by Get-SIDataServiceSources. Each source is @{ Name; Sql }:
|#    Name  1-32 of [A-Za-z0-9._-]; stamped on every membership it contributes (ServiceMember.Source)
|#    Sql   ONE read-only SELECT (no ';', no write or DDL verb) returning the columns AssetKey (the sidata CI key),
|#          ServiceKey (the service's stable id -- its CMDB number), ServiceName (display name, may be NULL), for the
|#          collection @CollectionId (the only parameter). It may read sidata.* and cfg.* (an SI-homed CMDB).
|#  A CI may belong to several services (one row per service). The same (service, CI) from two sources is kept once,
|#  stamped with the EARLIER source in the list. Only CIs with findings in the collection are kept.
|#  A new source (the SI-homed CMDB, an external CSV / ServiceNow CMDB) plugs in with Register-SIDataServiceSource;
|#  -Replace makes the registered sources the whole list (e.g. an SI-homed CMDB that is authoritative).
|#  Get-SIDataServicesSql turns the list into ServiceMember (the resolver's output) and the two aggregates.
|#  A membership change after a collection was derived is picked up by setting its ServicesDerivedAt to NULL (the next
|#  data sync re-derives it); a collection's membership is otherwise frozen as it was when it was derived.
|
|$script:SIDataServiceSourcesRegistered = @()
|$script:SIDataServiceSourcesReplace = $false
|
|function Get-SIDataServiceSourceDefault {
|    <# The first source: the CMDB service Risk Analysis carried on the CI's finding rows (cmdbId, else cmdbName). #>
|    @{ Name = 'risk-analysis'; Sql = @'
|SELECT f.AssetKey, COALESCE(f.CmdbId, f.CmdbName) AS ServiceKey, MAX(COALESCE(f.CmdbName, f.CmdbId)) AS ServiceName
|FROM sidata.Finding AS f
|WHERE f.CollectionId = @CollectionId AND f.AssetKey IS NOT NULL AND COALESCE(f.CmdbId, f.CmdbName) IS NOT NULL
|GROUP BY f.AssetKey, COALESCE(f.CmdbId, f.CmdbName)
|'@ }
|}
|
|function Test-SIDataServiceSource {
|    <# Throws when a source does not keep the contract. #>
|    param([Parameter(Mandatory)]$Source)
|    $n = [string]$Source.Name; $q = [string]$Source.Sql
|    if ($n -notmatch '^[A-Za-z0-9._-]{1,32}$') { throw ("service source '{0}': the name must be 1-32 of letters, digits, '.', '_' or '-'." -f $n) }
|    if ($q -notmatch '^\s*SELECT\s') { throw ("service source '{0}': the statement must be ONE SELECT." -f $n) }
|    if ($q.Contains(';')) { throw ("service source '{0}': the statement must be ONE SELECT (no ';')." -f $n) }
|    if ($q -match '(?i)\b(INSERT|UPDATE|DELETE|MERGE|DROP|ALTER|TRUNCATE|CREATE|EXEC|EXECUTE|GRANT|INTO)\b') { throw ("service source '{0}': the statement must be read-only." -f $n) }
|    foreach ($c in 'AssetKey', 'ServiceKey', 'ServiceName') { if ($q -notmatch "\b$c\b") { throw ("service source '{0}': the statement must return {1}." -f $n, $c) } }
|    foreach ($m in [regex]::Matches($q, '@(\w+)')) { if ($m.Groups[1].Value -ne 'CollectionId') { throw ("service source '{0}': @CollectionId is the only parameter (found @{1})." -f $n, $m.Groups[1].Value) } }
|}
|
|function Register-SIDataServiceSource {
|    <# Adds a membership source after the ones already in the list; -Replace: the registered sources become the whole list. #>
|    param([Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$Sql, [switch]$Replace)
|    $src = @{ Name = $Name; Sql = $Sql }
|    Test-SIDataServiceSource -Source $src
|    $script:SIDataServiceSourcesRegistered = @(@($script:SIDataServiceSourcesRegistered | Where-Object { $_.Name -ne $Name }) + $src)
|    if ($Replace) { $script:SIDataServiceSourcesReplace = $true }
|}
|
|function Reset-SIDataServiceSources {
|    <# Back to the default list (the Risk Analysis source only). #>
|    $script:SIDataServiceSourcesRegistered = @()
|    $script:SIDataServiceSourcesReplace = $false
|}
|
|function Get-SIDataServiceSources {
|    <# THE resolver's source list, in precedence order. #>
|    $list = @()
|    if (-not $script:SIDataServiceSourcesReplace) { $list += (Get-SIDataServiceSourceDefault) }
|    $list += @($script:SIDataServiceSourcesRegistered)
|    foreach ($s in $list) { Test-SIDataServiceSource -Source $s }
|    , @($list)
|}
|
|# ---- THE CMDB AS A SERVICE SOURCE (#256) ---------------------------------------------------------------------------
|#  The Pro database's own CMDB (sql\si-pro-settings.sql: cfg.CmdbService / cfg.CmdbServiceAsset, SI-homed or filled
|#  from an external CSV / ServiceNow) plugs into the resolver above as ONE source, through cfg.vCmdbAssetService -- the
|#  memberships of the AUTHORITATIVE CMDB only. When it is configured it REPLACES the list (an authoritative CMDB is the
|#  answer, not one more opinion); when it is not, the Risk Analysis source (cmdbId / cmdbName from CMDB.csv via the
|#  Reconcile stage) stays the fallback. "Configured" = an external source is chosen, or the SI-homed CMDB holds at
|#  least one service in force.
|
|$script:SIDataCmdbSourceUsed = $false
|
|function Get-SIDataCmdbStateSql {
|    <# Whether the CMDB tables exist, the authoritative source and how many of its services are in force. #>
|    @'
|IF OBJECT_ID(N'cfg.vCmdbAssetService') IS NULL OR OBJECT_ID(N'cfg.vCmdbSource') IS NULL OR OBJECT_ID(N'cfg.vCmdbService') IS NULL
|    SELECT 0 AS HasCmdb, N'SI' AS ActiveSource, 0 AS Services
|ELSE
|    SELECT 1 AS HasCmdb, (SELECT ActiveSource FROM cfg.vCmdbSource) AS ActiveSource, (SELECT COUNT(*) FROM cfg.vCmdbService) AS Services
|'@
|}
|
|function Get-SIDataCmdbServiceSourceName {
|    <# The name stamped on the memberships the CMDB contributes (sidata.ServiceMember.Source). #>
|    param([string]$ActiveSource)
|    switch ($ActiveSource) { 'External-CSV' { 'cmdb-csv' } 'External-Connector' { 'cmdb-servicenow' } default { 'cmdb-si' } }
|}
|
|function Get-SIDataCmdbServiceSourceSql {
|    <# The CMDB's memberships of the CIs with findings in the collection: ServiceKey = the service number. #>
|    @'
|SELECT v.AssetKey, v.ServiceNumber AS ServiceKey, v.ServiceName AS ServiceName
|FROM cfg.vCmdbAssetService AS v
|WHERE v.AssetKey IN (SELECT f.AssetKey FROM sidata.Finding AS f WHERE f.CollectionId = @CollectionId)
|'@
|}
|
|function Get-SIDataCmdbRuleSourceSql {
|    <#
|        The CMDB's services the PROFILE RULES gave a CI (a rule's set.cmdbId, stamped on the findings by Risk Analysis): the
|        v2.2 way an asset belongs to a service, and how a migrated CMDB.csv (which has no links) keeps its members. Only a
|        service of the AUTHORITATIVE CMDB counts, under its service number: a migrated service answers to its v2.2 cmdbID
|        (ExternalId), every other one to its number -- the key Read-SICmdbProServices hands the profilers.
|    #>
|    @'
|SELECT f.AssetKey, v.ServiceNumber AS ServiceKey, MAX(v.Name) AS ServiceName
|FROM sidata.Finding AS f
|JOIN cfg.vCmdbService AS v ON f.CmdbId = (CASE WHEN v.Source = N'SI' AND NULLIF(v.ExternalId, N'') IS NOT NULL THEN v.ExternalId ELSE v.ServiceNumber END)
|WHERE f.CollectionId = @CollectionId AND f.AssetKey IS NOT NULL AND NULLIF(f.CmdbId, N'') IS NOT NULL
|GROUP BY f.AssetKey, v.ServiceNumber
|'@
|}
|
|function Use-SIDataCmdbServiceSource {
|    <#
|        Reads the CMDB's state and, when it is configured, makes it THE service source (Register-SIDataServiceSource
|        -Replace). Returns @{ HasCmdb; ActiveSource; Services; Used; Name }. A database without the CMDB tables keeps the
|        default list.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke)
|    if ($script:SIDataCmdbSourceUsed) { Reset-SIDataServiceSources; $script:SIDataCmdbSourceUsed = $false }
|    $raw = & $Invoke (Get-SIDataCmdbStateSql) @{} 'reader'
|    $row = @($raw) | Where-Object { $_ } | Select-Object -First 1
|    $st = [ordered]@{ HasCmdb = $false; ActiveSource = 'SI'; Services = 0; Used = $false; Name = $null }
|    if ($row) {
|        $st.HasCmdb = ([int]$row['HasCmdb'] -eq 1); $st.ActiveSource = [string]$row['ActiveSource']; $st.Services = [int]$row['Services']
|    }
|    if ($st.HasCmdb -and ($st.ActiveSource -ne 'SI' -or $st.Services -gt 0)) {
|        $st.Name = Get-SIDataCmdbServiceSourceName -ActiveSource $st.ActiveSource
|        Register-SIDataServiceSource -Name $st.Name -Sql (Get-SIDataCmdbServiceSourceSql) -Replace
|        # after the links: the services the profile rules gave a CI, mapped onto the same CMDB (a link wins on a tie)
|        Register-SIDataServiceSource -Name ($st.Name + '-rule') -Sql (Get-SIDataCmdbRuleSourceSql)
|        $script:SIDataCmdbSourceUsed = $true
|        $st.Used = $true
|    }
|    [pscustomobject]$st
|}
|
|function Get-SIDataFixSchemaCheckSql {
|    <# 1 when the database carries the finding's fix columns (si-data-schema.sql, #590), else 0. #>
|    "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'FixRemediation') IS NOT NULL AND COL_LENGTH('sidata.Finding', 'FixRecommendedUpdate') IS NOT NULL AND COL_LENGTH('sidata.Finding', 'FixRecommendedUpdateId') IS NOT NULL AND COL_LENGTH('sidata.Finding', 'AffectedSoftware') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataServicesSchemaCheckSql {
|    <# 1 when the database carries the Services view's columns and tables (si-data-schema.sql, #255), else 0. #>
|    "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'CmdbId') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'ServicesDerivedAt') IS NOT NULL AND OBJECT_ID('sidata.ServiceMember') IS NOT NULL AND OBJECT_ID('sidata.ServiceAsset') IS NOT NULL AND OBJECT_ID('sidata.ServiceRisk') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataServicesSql {
|    <#
|        ONE collection: the resolver's membership (every source, in order), the per-(service, CI) and per-service
|        aggregates, replacing what the collection held, and ServicesDerivedAt -- one transaction. Returns the number of
|        service rows (the no-service row included). Severity: Critical = critical / very high, Medium = medium-high / medium /
|        moderate; informational and unknown severities count in Findings only.
|        -Counted (#264): the same aggregates over the findings WITHOUT an exemption mark, into sidata.ServiceAssetCounted /
|        ServiceRiskCounted. Membership is NOT resolved again: the collection's sidata.ServiceMember (the resolver's output)
|        is reused, so a service holds the same CIs in both variants (minus a CI whose every finding is exempted).
|    #>
|    param([object[]]$Sources = (Get-SIDataServiceSources), [switch]$Counted)
|    $ins = New-Object System.Collections.Generic.List[string]
|    $i = 0
|    if ($Counted) {
|        $ins.Add("INSERT #m (AssetKey, ServiceKey, ServiceName, Source, Prio)`r`nSELECT sm.AssetKey, sm.ServiceKey, sm.ServiceName, sm.Source, 1 FROM sidata.ServiceMember AS sm WHERE sm.CollectionId = @CollectionId;")
|    }
|    else {
|        foreach ($s in @($Sources)) {
|            Test-SIDataServiceSource -Source $s
|            $i++
|            $ins.Add(("INSERT #m (AssetKey, ServiceKey, ServiceName, Source, Prio)`r`nSELECT LEFT(src.AssetKey, 400), LEFT(LTRIM(RTRIM(src.ServiceKey)), 256), LEFT(src.ServiceName, 400), N'{0}', {1}`r`nFROM (`r`n{2}`r`n) AS src`r`nWHERE src.AssetKey IS NOT NULL AND NULLIF(LTRIM(RTRIM(src.ServiceKey)), N'') IS NOT NULL;" -f $s.Name, $i, ([string]$s.Sql).Trim()))
|        }
|    }
|    $risk = 'ServiceRisk'; $asset = 'ServiceAsset'; $mark = ''
|    $member = "DELETE FROM sidata.ServiceMember WHERE CollectionId = @CollectionId;`r`nINSERT sidata.ServiceMember (CollectionId, ServiceKey, AssetKey, ServiceName, Source)`r`nSELECT @CollectionId, ServiceKey, AssetKey, ServiceName, Source FROM #mem;"
|    $stamp = "UPDATE sidata.Collection SET ServicesDerivedAt = SYSUTCDATETIME() WHERE CollectionId = @CollectionId;"
|    if ($Counted) { $risk = 'ServiceRiskCounted'; $asset = 'ServiceAssetCounted'; $mark = ' AND f.ExemptionId IS NULL'; $member = ''; $stamp = '' }
|    # the web app's one severity order (SeverityOrder.cs): case, spaces, '-' and '_' do not matter; Medium-High counts as Medium
|    $k = "LOWER(REPLACE(REPLACE(REPLACE(f.Severity, N' ', N''), N'-', N''), N'_', N''))"
|    $sev = @{
|        C = "CASE WHEN $k IN (N'critical', N'veryhigh') THEN 1 ELSE 0 END"
|        H = "CASE WHEN $k = N'high' THEN 1 ELSE 0 END"
|        M = "CASE WHEN $k IN (N'mediumhigh', N'medium', N'moderate') THEN 1 ELSE 0 END"
|        L = "CASE WHEN $k = N'low' THEN 1 ELSE 0 END"
|    }
|    (@'
|SET XACT_ABORT ON;
|CREATE TABLE #m (AssetKey nvarchar(400) NOT NULL, ServiceKey nvarchar(256) NOT NULL, ServiceName nvarchar(400) NULL, Source nvarchar(32) NOT NULL, Prio int NOT NULL);
|{SOURCES}
|CREATE TABLE #a (AssetKey nvarchar(400) NOT NULL PRIMARY KEY, AssetName nvarchar(400) NULL, Tier tinyint NULL, Findings int NOT NULL,
|                 Critical int NOT NULL, High int NOT NULL, Medium int NOT NULL, Low int NOT NULL,
|                 T0 int NOT NULL, T1 int NOT NULL, T2 int NOT NULL, T3 int NOT NULL, TU int NOT NULL,
|                 WeightedTotal float NULL, RiskTotal float NULL, MaxWeighted float NULL);
|INSERT #a
|SELECT f.AssetKey, MAX(f.AssetName), MIN(f.Tier), COUNT(*),
|       SUM({C}), SUM({H}), SUM({M}), SUM({L}),
|       SUM(CASE WHEN f.Tier = 0 THEN 1 ELSE 0 END), SUM(CASE WHEN f.Tier = 1 THEN 1 ELSE 0 END), SUM(CASE WHEN f.Tier = 2 THEN 1 ELSE 0 END),
|       SUM(CASE WHEN f.Tier = 3 THEN 1 ELSE 0 END), SUM(CASE WHEN f.Tier IS NULL OR f.Tier > 3 THEN 1 ELSE 0 END),
|       SUM(f.RiskScoreWeighted), SUM(f.RiskScore), MAX(f.RiskScoreWeighted)
|FROM sidata.Finding AS f
|WHERE f.CollectionId = @CollectionId AND f.AssetKey IS NOT NULL{MARK}
|GROUP BY f.AssetKey;
|CREATE TABLE #mem (ServiceKey nvarchar(256) NOT NULL, AssetKey nvarchar(400) NOT NULL, ServiceName nvarchar(400) NULL, Source nvarchar(32) NOT NULL);
|INSERT #mem (ServiceKey, AssetKey, ServiceName, Source)
|SELECT x.ServiceKey, x.AssetKey, x.ServiceName, x.Source
|FROM (SELECT m.ServiceKey, m.AssetKey, m.ServiceName, m.Source,
|             ROW_NUMBER() OVER (PARTITION BY m.ServiceKey, m.AssetKey ORDER BY m.Prio, m.ServiceName) AS Rn
|      FROM #m AS m) AS x
|JOIN #a AS a ON a.AssetKey = x.AssetKey
|WHERE x.Rn = 1;
|CREATE TABLE #sa (ServiceKey nvarchar(256) NOT NULL, AssetKey nvarchar(400) NOT NULL, ServiceName nvarchar(400) NULL, Source nvarchar(32) NULL,
|                  ServiceCount int NOT NULL);
|WITH cnt AS (SELECT AssetKey, COUNT(*) AS N FROM #mem GROUP BY AssetKey)
|INSERT #sa (ServiceKey, AssetKey, ServiceName, Source, ServiceCount)
|SELECT m.ServiceKey, m.AssetKey, m.ServiceName, m.Source, cnt.N
|FROM #mem AS m JOIN cnt ON cnt.AssetKey = m.AssetKey;
|INSERT #sa (ServiceKey, AssetKey, ServiceName, Source, ServiceCount)
|SELECT N'', a.AssetKey, NULL, NULL, 0
|FROM #a AS a LEFT JOIN #mem AS m ON m.AssetKey = a.AssetKey
|WHERE m.AssetKey IS NULL;
|-- the service's display name: the one most of its members carry
|WITH nm AS (
|    SELECT ServiceKey, ServiceName, ROW_NUMBER() OVER (PARTITION BY ServiceKey ORDER BY COUNT(*) DESC, ServiceName) AS Rn
|    FROM #sa WHERE ServiceName IS NOT NULL GROUP BY ServiceKey, ServiceName
|), top1 AS (
|    SELECT s.ServiceKey, s.AssetKey, a.AssetName, a.WeightedTotal,
|           ROW_NUMBER() OVER (PARTITION BY s.ServiceKey ORDER BY CASE WHEN a.WeightedTotal IS NULL THEN 1 ELSE 0 END, a.WeightedTotal DESC, s.AssetKey) AS Rn
|    FROM #sa AS s JOIN #a AS a ON a.AssetKey = s.AssetKey
|), src AS (
|    SELECT d.ServiceKey, STRING_AGG(CONVERT(nvarchar(200), d.Source), N', ') WITHIN GROUP (ORDER BY d.Source) AS Sources
|    FROM (SELECT DISTINCT ServiceKey, Source FROM #sa WHERE Source IS NOT NULL) AS d
|    GROUP BY d.ServiceKey
|), agg AS (
|    SELECT s.ServiceKey, COUNT(*) AS Assets, SUM(CASE WHEN s.ServiceCount > 1 THEN 1 ELSE 0 END) AS SharedAssets, SUM(a.Findings) AS Findings,
|           SUM(a.WeightedTotal) AS WeightedTotal, SUM(a.WeightedTotal) / COUNT(*) AS WeightedPerAsset, SUM(a.RiskTotal) AS RiskTotal, MAX(a.MaxWeighted) AS MaxWeighted,
|           SUM(a.Critical) AS Critical, SUM(a.High) AS High, SUM(a.Medium) AS Medium, SUM(a.Low) AS Low,
|           SUM(a.T0) AS Tier0, SUM(a.T1) AS Tier1, SUM(a.T2) AS Tier2, SUM(a.T3) AS Tier3, SUM(a.TU) AS TierUnclassified
|    FROM #sa AS s JOIN #a AS a ON a.AssetKey = s.AssetKey
|    GROUP BY s.ServiceKey
|)
|SELECT agg.*, nm.ServiceName, top1.AssetKey AS TopAssetKey, top1.AssetName AS TopAssetName, top1.WeightedTotal AS TopAssetWeighted, src.Sources
|INTO #sr
|FROM agg
|LEFT JOIN nm ON nm.ServiceKey = agg.ServiceKey AND nm.Rn = 1
|LEFT JOIN top1 ON top1.ServiceKey = agg.ServiceKey AND top1.Rn = 1
|LEFT JOIN src ON src.ServiceKey = agg.ServiceKey;
|BEGIN TRAN;
|DELETE FROM sidata.{RISK} WHERE CollectionId = @CollectionId;
|DELETE FROM sidata.{ASSET} WHERE CollectionId = @CollectionId;
|{MEMBER}
|INSERT sidata.{ASSET} (CollectionId, ServiceKey, AssetKey, ServiceName, Source, AssetName, Tier, ServiceCount, Findings, Critical, High, Medium, Low, WeightedTotal, RiskTotal, MaxWeighted)
|SELECT @CollectionId, s.ServiceKey, s.AssetKey, s.ServiceName, s.Source, a.AssetName, a.Tier, s.ServiceCount, a.Findings, a.Critical, a.High, a.Medium, a.Low, a.WeightedTotal, a.RiskTotal, a.MaxWeighted
|FROM #sa AS s JOIN #a AS a ON a.AssetKey = s.AssetKey;
|INSERT sidata.{RISK} (CollectionId, ServiceKey, ServiceName, Assets, SharedAssets, Findings, WeightedTotal, WeightedPerAsset, RiskTotal, MaxWeighted,
|                           Critical, High, Medium, Low, Tier0, Tier1, Tier2, Tier3, TierUnclassified, TopAssetKey, TopAssetName, TopAssetWeighted, Sources)
|SELECT @CollectionId, ServiceKey, ServiceName, Assets, SharedAssets, Findings, WeightedTotal, WeightedPerAsset, RiskTotal, MaxWeighted,
|       Critical, High, Medium, Low, Tier0, Tier1, Tier2, Tier3, TierUnclassified, TopAssetKey, TopAssetName, TopAssetWeighted, Sources
|FROM #sr;
|DECLARE @n int = @@ROWCOUNT;
|{STAMP}
|COMMIT;
|SELECT @n;
|'@).Replace('{RISK}', $risk).Replace('{ASSET}', $asset).Replace('{MEMBER}', $member).Replace('{STAMP}', $stamp).Replace('{MARK}', $mark).Replace('{SOURCES}', ($ins -join "`r`n")).Replace('{C}', $sev.C).Replace('{H}', $sev.H).Replace('{M}', $sev.M).Replace('{L}', $sev.L)
|}
|
|function Invoke-SIDataFindingRanges {
|    <#
|        One statement (-Sql: @CollectionId, @After, @Upto; answers its row count) over ONE collection's FindingId range
|        -Lo..-Hi, in ranges sized from their measured time and paced by the database's own load (SI-SqlPacing.ps1); every
|        range is still run. Returns the rows the statement counted. The derive and the row values' fill run the same loop.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$CollectionId, [long]$Lo, [long]$Hi,
|          [Parameter(Mandatory)][string]$Sql, [ref]$BatchSize, [long]$TargetMs = 5000)
|    $done = 0L
|    $size = [long]20000; if ($BatchSize -and $BatchSize.Value -gt 0) { $size = [long]$BatchSize.Value }
|    $after = $Lo - 1
|    $paced = [bool](Get-Command -Name Invoke-SISqlPacing -ErrorAction SilentlyContinue); $lastMs = 0L
|    while ($after -lt $Hi) {
|        if ($paced) { $pace = Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs; if ($pace.Shrink) { $size = [Math]::Max(500L, [long][Math]::Floor($size / 2)) } }
|        $upto = [Math]::Min($Hi, $after + $size)
|        $sw = [Diagnostics.Stopwatch]::StartNew()
|        $done += [long](& $Invoke $Sql @{ CollectionId = $CollectionId; After = $after; Upto = $upto } 'scalar')
|        $sw.Stop(); $lastMs = $sw.ElapsedMilliseconds
|        $after = $upto
|        $size = Get-SIDataNextSize -Current $size -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 500
|    }
|    if ($BatchSize) { $BatchSize.Value = $size }
|    $done
|}
|
|function Invoke-SIDataRowColumnsFill {
|    <#
|        2026-10-25 (internal, run 0e6bef53: "set-based not used: the collection carries no typed row values"): the row values
|        of ONE Risk Analysis Detailed collection, BEFORE the data sync derives it -- the vulnerability step runs first and reads
|        them typed. Only a collection Risk Analysis has completed (RaCompletedAt or Complete), not retired, whose RaRowsAt is
|        still empty; the same expressions and rows as the derive (Get-SIDataRowColumnsSql), so the data sync then writes them
|        once, not again. RaRowsAt is stamped only after the last range. NEVER THROWS: @{ Filled; Rows; Seconds; Why } --
|        Filled = $false with the reason, and the reader reads the collection from DetailJson as before.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$CollectionId, [long]$TargetMs = 5000)
|    $sw = [Diagnostics.Stopwatch]::StartNew()
|    $out = { param([bool]$f, [long]$n, [string]$w) [pscustomobject]@{ Filled = $f; Rows = $n; Seconds = [Math]::Round($sw.Elapsed.TotalSeconds, 2); Why = $w } }
|    try {
|        $ready = [string](& $Invoke "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'RaFillRiskFactorConsequence') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RaRowsAt') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RaCompletedAt') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RetiredAt') IS NOT NULL THEN 1 ELSE 0 END" @{} 'scalar')
|        if ($ready -ne '1') { return (& $out $false 0 'the database does not have the row value columns yet (the updater adds them)') }
|        # scalars only: every seam that runs the derive answers 'scalar' (the vulnerability step's seam has no 'reader')
|        $st = [string](& $Invoke "SELECT ISNULL((SELECT CASE WHEN RaRowsAt IS NOT NULL THEN N'done' WHEN RetiredAt IS NULL AND (Status = N'Complete' OR RaCompletedAt IS NOT NULL) THEN N'ok' ELSE N'not' END FROM sidata.Collection WHERE CollectionId = CONVERT(int, @CollectionId)), N'none')" @{ CollectionId = $CollectionId } 'scalar')
|        if ($st -eq 'none') { return (& $out $false 0 'the collection is not in the database') }
|        if ($st -eq 'done') { return (& $out $true 0 'already filled') }
|        if ($st -ne 'ok') { return (& $out $false 0 'the collection is not complete, or retired') }
|        $lo = & $Invoke "SELECT MIN(FindingId) FROM sidata.Finding WHERE CollectionId = CONVERT(int, @CollectionId)" @{ CollectionId = $CollectionId } 'scalar'
|        $hi = & $Invoke "SELECT MAX(FindingId) FROM sidata.Finding WHERE CollectionId = CONVERT(int, @CollectionId)" @{ CollectionId = $CollectionId } 'scalar'
|        $n = 0L
|        if ($null -ne $lo -and -not ($lo -is [System.DBNull])) {
|            $n = Invoke-SIDataFindingRanges -Invoke $Invoke -CollectionId $CollectionId -Lo ([long]$lo) -Hi ([long]$hi) -Sql (Get-SIDataRowColumnsSql) -TargetMs $TargetMs
|        }
|        $null = & $Invoke 'UPDATE sidata.Collection SET RaRowsAt = SYSUTCDATETIME() WHERE CollectionId = @CollectionId AND RaRowsAt IS NULL; SELECT 1;' @{ CollectionId = $CollectionId } 'scalar'
|        & $out $true $n ''
|    } catch { & $out $false 0 ('the row values could not be filled: ' + $_.Exception.Message) }
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE RISK SCORE'S PARTS AS COLUMNS (2026-10-29; owner: "it should be possible to see the Risk Score calculations as
|#  columns"). Risk Analysis writes every part of a finding's score on its row (Calculate-RiskScore, RA-RiskScore.ps1);
|#  this copies them into typed columns of sidata.Finding (sql/si-data-schema.sql, "THE RISK SCORE'S PARTS AS COLUMNS"), so
|#  the views show, sort and filter them without reading the row's JSON. The SAME rule as the web app's explained score
|#  (RiskExplanation.SideOf): a number is the value trimmed and read invariant (empty = none); a side whose base was recorded
|#  lists its factors with their points ("Name=n;..."), an older side's base is its score minus its factors' points (none =
|#  0) and lists the factors by name. Nothing else is worked out: the values are Risk Analysis's own.
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SIDataRiskPartsReadySql {
|    <# 1 = the database has the risk score's parts columns and the collection's stamp. #>
|    "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'RiskAssetDerived') IS NOT NULL AND COL_LENGTH('sidata.Finding', 'RiskWeightBy') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RiskPartsAt') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RiskPartsUpto') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Test-SIDataRiskPartsReady {
|    <# $true when the database has the columns; never throws. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke)
|    try { return ([string](& $Invoke (Get-SIDataRiskPartsReadySql) @{} 'scalar') -eq '1') } catch { return $false }
|}
|
|function Get-SIDataRiskPartsNumberExpr {
|    <#
|        PURE. A number as the explained score reads it: the text trimmed of white space, read as a float; empty or not a
|        number = NULL. A text longer than 400 characters is no number (SQL Server refuses TRY_CONVERT of a very long text
|        with an error instead of NULL -- a fill must never fail on one odd row).
|    #>
|    param([Parameter(Mandatory)][string]$Text)
|    "CASE WHEN LEN($Text) <= 400 THEN TRY_CONVERT(float, NULLIF(TRIM(CHAR(9) + CHAR(10) + CHAR(13) + CHAR(32) FROM $Text), N'')) END"
|}
|
|function Get-SIDataRiskPartsSql {
|    <#
|        ONE FindingId range (@CollectionId, @After < FindingId <= @Upto) of sidata.Finding: the risk score's parts from the
|        row's JSON, parsed once per row. Every row of the range is written (a row without JSON gets no parts and its sides
|        marked worked out, as the explained score shows it). Idempotent. Answers the rows written.
|        -Progress: also records the range's end on the collection (sidata.Collection.RiskPartsUpto) in the same batch, so a
|        fill stopped by its time budget goes on from there.
|    #>
|    param([switch]$Progress)
|    $n = { param($t) Get-SIDataRiskPartsNumberExpr -Text $t }
|    $prog = if ($Progress) { "`r`nUPDATE sidata.Collection SET RiskPartsUpto = @Upto WHERE CollectionId = @CollectionId;" } else { '' }
|    @"
|SET NOCOUNT ON;
|UPDATE f SET
|    RiskAssetSide    = p.ASide,
|    RiskAssetPoints  = p.APoints,
|    RiskAssetBase    = CASE WHEN p.ABase IS NOT NULL THEN p.ABase WHEN p.ASide IS NOT NULL THEN p.ASide - ISNULL(p.APoints, 0) END,
|    RiskAssetDerived = CASE WHEN p.ABase IS NOT NULL THEN 0 ELSE 1 END,
|    RiskAssetFactors = (SELECT CASE WHEN DATALENGTH(x.v) > 0 THEN x.v END FROM (SELECT CASE WHEN p.ABase IS NOT NULL THEN j.ci ELSE j.cn END AS v) AS x),
|    RiskVulnSide     = p.VSide,
|    RiskVulnPoints   = p.VPoints,
|    RiskVulnBase     = CASE WHEN p.VBase IS NOT NULL THEN p.VBase WHEN p.VSide IS NOT NULL THEN p.VSide - ISNULL(p.VPoints, 0) END,
|    RiskVulnDerived  = CASE WHEN p.VBase IS NOT NULL THEN 0 ELSE 1 END,
|    RiskVulnFactors  = (SELECT CASE WHEN DATALENGTH(x.v) > 0 THEN x.v END FROM (SELECT CASE WHEN p.VBase IS NOT NULL THEN j.pi ELSE j.pn END AS v) AS x),
|    RiskWeightPct    = p.Weight,
|    RiskWeightBy     = CASE WHEN DATALENGTH(j.wb) > 0 THEN LEFT(j.wb, 1000) END
|FROM sidata.Finding AS f
|OUTER APPLY OPENJSON(CASE WHEN ISJSON(f.DetailJson) = 1 THEN f.DetailJson END) WITH (
|    cb nvarchar(max) N'$.RiskConsequenceBase', cs nvarchar(max) N'$.RiskConsequenceScore', cp nvarchar(max) N'$.RiskFactor_Consequence',
|    ci nvarchar(max) N'$.RiskFactor_Consequence_Impacts', cn nvarchar(max) N'$.RiskFactor_Consequence_Detailed',
|    pb nvarchar(max) N'$.RiskProbabilityBase', ps nvarchar(max) N'$.RiskProbabilityScore', pp nvarchar(max) N'$.RiskFactor_Probability',
|    pi nvarchar(max) N'$.RiskFactor_Probability_Impacts', pn nvarchar(max) N'$.RiskFactor_Probability_Detailed',
|    w nvarchar(max) N'$.RiskScore_Weight_Factor', wb nvarchar(max) N'$.RiskScore_Weight_Detailed') AS j
|CROSS APPLY (SELECT $(& $n 'j.cb') AS ABase, $(& $n 'j.cs') AS ASide, $(& $n 'j.cp') AS APoints,
|                    $(& $n 'j.pb') AS VBase, $(& $n 'j.ps') AS VSide, $(& $n 'j.pp') AS VPoints,
|                    $(& $n 'j.w') AS Weight) AS p
|WHERE f.CollectionId = CONVERT(int, @CollectionId) AND f.FindingId > CONVERT(bigint, @After) AND f.FindingId <= CONVERT(bigint, @Upto);
|DECLARE @n bigint = @@ROWCOUNT;$prog
|SELECT @n;
|"@
|}
|
|function Get-SIDataRiskPartsStampSql {
|    <# The collection carries the parts on every row (@Upto: its last FindingId). #>
|    'UPDATE sidata.Collection SET RiskPartsAt = SYSUTCDATETIME(), RiskPartsUpto = CONVERT(bigint, @Upto) WHERE CollectionId = CONVERT(int, @CollectionId); SELECT 1;'
|}
|
|function Get-SIDataRiskPartsPendingSql {
|    <# The complete collections (rows not removed) whose rows do not all carry the parts yet, newest first, with how far a fill came. #>
|    @'
|SELECT c.CollectionId, c.RiskPartsUpto AS Upto,
|       (SELECT MIN(f.FindingId) FROM sidata.Finding AS f WHERE f.CollectionId = c.CollectionId) AS Lo,
|       (SELECT MAX(f.FindingId) FROM sidata.Finding AS f WHERE f.CollectionId = c.CollectionId) AS Hi
|FROM sidata.Collection AS c
|WHERE c.Status = N'Complete' AND c.RiskPartsAt IS NULL AND c.RetiredAt IS NULL
|ORDER BY c.CollectionTime DESC;
|'@
|}
|
|function Invoke-SIDataRiskPartsBackfill {
|    <#
|        The collections stored before the parts were columns get them: complete collections without RiskPartsAt, NEWEST
|        FIRST, in FindingId ranges sized from their measured time and paced by the database's load, within -BudgetSeconds
|        per run (the owner: 20 minutes); each range records how far it came (RiskPartsUpto), so the next run goes on from
|        there; a collection is stamped (RiskPartsAt) only after its last range. -DryRun: says what it would do. NEVER THROWS:
|        @{ Ready; Collections (stamped this run); Rows; Pending (left for the next run); Seconds; Error }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [scriptblock]$Log, [int]$BudgetSeconds = 1200, [long]$TargetMs = 5000, [switch]$DryRun)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Host ('[{0}] {1}' -f $level, $msg) } }
|    $clock = [Diagnostics.Stopwatch]::StartNew()
|    $res = [ordered]@{ Ready = $false; Collections = 0; Rows = 0L; Pending = 0; Seconds = 0; Error = '' }
|    try {
|        if (-not (Test-SIDataRiskPartsReady -Invoke $Invoke)) {
|            & $Log 'INFO' 'score parts : the database does not have the risk score''s part columns yet -- the next update adds them; until then the views show the parts empty.'
|            return [pscustomobject]$res
|        }
|        $res.Ready = $true
|        # ASSIGNED first, then enumerated: the seam answers a reader as ONE list (', rows') -- @(& ...) would hold the list as one item
|        $pendRaw = & $Invoke (Get-SIDataRiskPartsPendingSql) @{} 'reader'
|        $pending = @(@($pendRaw) | Where-Object { $_ })
|        $res.Pending = $pending.Count
|        if ($pending.Count -eq 0) { & $Log 'INFO' 'score parts : every collection carries the risk score''s parts.'; return [pscustomobject]$res }
|        if ($DryRun) { & $Log 'INFO' ("score parts : {0} collection(s) would get the risk score's parts; nothing is written." -f $pending.Count); return [pscustomobject]$res }
|        $sql = Get-SIDataRiskPartsSql -Progress
|        $paced = [bool](Get-Command -Name Invoke-SISqlPacing -ErrorAction SilentlyContinue)
|        $size = [long]20000; $lastMs = 0L
|        foreach ($c in $pending) {
|            if ($clock.Elapsed.TotalSeconds -ge $BudgetSeconds) { break }
|            $cid = [int]$c['CollectionId']
|            $hasRows = $null -ne $c['Lo'] -and -not ($c['Lo'] -is [System.DBNull])
|            $hi = if ($hasRows) { [long]$c['Hi'] } else { 0L }
|            $after = if ($hasRows) { [long]$c['Lo'] - 1 } else { 0L }
|            if ($hasRows -and $null -ne $c['Upto'] -and -not ($c['Upto'] -is [System.DBNull]) -and [long]$c['Upto'] -gt $after) { $after = [long]$c['Upto'] }
|            while ($hasRows -and $after -lt $hi) {
|                if ($clock.Elapsed.TotalSeconds -ge $BudgetSeconds) { break }
|                if ($paced) { $pace = Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs; if ($pace.Shrink) { $size = [Math]::Max(500L, [long][Math]::Floor($size / 2)) } }
|                $upto = [Math]::Min($hi, $after + $size)
|                $sw = [Diagnostics.Stopwatch]::StartNew()
|                $res.Rows += [long](& $Invoke $sql @{ CollectionId = $cid; After = $after; Upto = $upto } 'scalar')
|                $sw.Stop(); $lastMs = $sw.ElapsedMilliseconds
|                $after = $upto
|                $size = Get-SIDataNextSize -Current $size -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 500
|            }
|            if ($hasRows -and $after -lt $hi) { break }
|            $null = & $Invoke (Get-SIDataRiskPartsStampSql) @{ CollectionId = $cid; Upto = $hi } 'scalar'
|            $res.Collections++
|        }
|        $res.Pending = $pending.Count - $res.Collections
|        $res.Seconds = [Math]::Round($clock.Elapsed.TotalSeconds, 1)
|        if ($res.Pending -gt 0) {
|            & $Log 'OK' ("score parts : {0} earlier collection(s) got the risk score's parts ({1} finding row(s), {2} s); {3} more follow on the next run(s) -- the time this run may spend on it is used." -f $res.Collections, $res.Rows, $res.Seconds, $res.Pending)
|        } else {
|            & $Log 'OK' ("score parts : {0} earlier collection(s) got the risk score's parts ({1} finding row(s), {2} s)." -f $res.Collections, $res.Rows, $res.Seconds)
|        }
|    } catch {
|        $res.Error = $_.Exception.Message
|        & $Log 'WARN' ("score parts : the risk score's parts of earlier collections were not all written this run -- {0}. The next run goes on from where this one stopped." -f $_.Exception.Message)
|    }
|    [pscustomobject]$res
|}
|
|function Get-SIDataSummaryRiskPartsReadySql {
|    <# 1 = sidata.SummaryRow has the risk score's parts columns and the whole row (RowJson). #>
|    "SELECT CASE WHEN COL_LENGTH('sidata.SummaryRow', 'RiskAssetDerived') IS NOT NULL AND COL_LENGTH('sidata.SummaryRow', 'RiskVulnFactors') IS NOT NULL AND COL_LENGTH('sidata.SummaryRow', 'RowJson') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataSummaryRiskPartsSql {
|    <#
|        ONE batch (@Batch rows) of Summary rows without the risk score's parts: the base and the factors with their points
|        from the whole row (RowJson, written by Risk Analysis) where it carries the base; else -- a row loaded without it --
|        the base worked out as the side's score minus its factors' points and the factors by name, from the row's own columns
|        (the same rule as the findings, Get-SIDataRiskPartsSql). The sides' scores and points stay the row's own columns.
|        Answers the rows written; the caller repeats until 0.
|    #>
|    $n = { param($t) Get-SIDataRiskPartsNumberExpr -Text $t }
|    @"
|SET NOCOUNT ON;
|UPDATE TOP (CONVERT(int, @Batch)) s SET
|    RiskAssetBase    = CASE WHEN p.ABase IS NOT NULL THEN p.ABase WHEN s.RiskConsequenceScore IS NOT NULL THEN s.RiskConsequenceScore - ISNULL(s.RiskFactorConsequence, 0) END,
|    RiskAssetDerived = CASE WHEN p.ABase IS NOT NULL THEN 0 ELSE 1 END,
|    RiskAssetFactors = (SELECT CASE WHEN DATALENGTH(x.v) > 0 THEN x.v END FROM (SELECT CASE WHEN p.ABase IS NOT NULL THEN j.ci ELSE s.RiskFactorConsequenceDetailed END AS v) AS x),
|    RiskVulnBase     = CASE WHEN p.VBase IS NOT NULL THEN p.VBase WHEN s.RiskProbabilityScore IS NOT NULL THEN s.RiskProbabilityScore - ISNULL(s.RiskFactorProbability, 0) END,
|    RiskVulnDerived  = CASE WHEN p.VBase IS NOT NULL THEN 0 ELSE 1 END,
|    RiskVulnFactors  = (SELECT CASE WHEN DATALENGTH(x.v) > 0 THEN x.v END FROM (SELECT CASE WHEN p.VBase IS NOT NULL THEN j.pi ELSE s.RiskFactorProbabilityDetailed END AS v) AS x)
|FROM sidata.SummaryRow AS s
|OUTER APPLY OPENJSON(CASE WHEN ISJSON(s.RowJson) = 1 THEN s.RowJson END) WITH (
|    cb nvarchar(max) N'$.RiskConsequenceBase', ci nvarchar(max) N'$.RiskFactor_Consequence_Impacts',
|    pb nvarchar(max) N'$.RiskProbabilityBase', pi nvarchar(max) N'$.RiskFactor_Probability_Impacts') AS j
|CROSS APPLY (SELECT $(& $n 'j.cb') AS ABase, $(& $n 'j.pb') AS VBase) AS p
|WHERE s.RiskAssetDerived IS NULL;
|SELECT @@ROWCOUNT;
|"@
|}
|
|function Invoke-SIDataSummaryRiskParts {
|    <#
|        The Summary rows (new and earlier) get the risk score's parts, in batches, within -BudgetSeconds (the rest on the next
|        run). NEVER THROWS: @{ Ready; Rows; Error }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [scriptblock]$Log, [int]$BudgetSeconds = 300, [int]$Batch = 20000, [switch]$DryRun)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Host ('[{0}] {1}' -f $level, $msg) } }
|    $res = [ordered]@{ Ready = $false; Rows = 0L; Error = '' }
|    try {
|        if ([string](& $Invoke (Get-SIDataSummaryRiskPartsReadySql) @{} 'scalar') -ne '1') { return [pscustomobject]$res }
|        $res.Ready = $true
|        if ($DryRun) { return [pscustomobject]$res }
|        $clock = [Diagnostics.Stopwatch]::StartNew(); $sql = Get-SIDataSummaryRiskPartsSql
|        while ($clock.Elapsed.TotalSeconds -lt $BudgetSeconds) {
|            $n = [long](& $Invoke $sql @{ Batch = $Batch } 'scalar')
|            $res.Rows += $n
|            if ($n -lt $Batch) { break }
|        }
|        if ($res.Rows -gt 0) { & $Log 'OK' ("score parts : {0} Summary row(s) got the risk score's parts" -f $res.Rows) }
|    } catch {
|        $res.Error = $_.Exception.Message
|        & $Log 'WARN' ("score parts : the risk score's parts of the Summary rows were not all written this run -- {0}. Tried again on the next run." -f $_.Exception.Message)
|    }
|    [pscustomobject]$res
|}
|
|function Invoke-SIDataDeriveCollection {
|    <#
|        Fills the views' columns of ONE collection in FindingId ranges sized from their measured time, then its
|        aggregates and DerivedAt. -Services (#255): also the CMDB columns, then the service membership and its aggregates.
|        Returns @{ CollectionId; Findings; Facets; Services } (Services = $null without -Services).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$CollectionId, [ref]$BatchSize, [long]$TargetMs = 5000, [switch]$Services,
|          # #590 also the finding's fix columns (the database carries them: Get-SIDataFixSchemaCheckSql)
|          [switch]$Fix,
|          # the facets' progress lines (Invoke-SIDataFacet)
|          [scriptblock]$Log)
|    $bRaw = & $Invoke (Get-SIDataFindingBoundsSql) @{ CollectionId = $CollectionId } 'reader'
|    $b = @($bRaw) | Select-Object -First 1
|    $done = 0L
|    # #834 the Risk Analysis row's Category travels with the derive when the database has its column (the updater adds it)
|    $cat = $false
|    try { $cat = ([string](& $Invoke "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'RaCategory') IS NOT NULL THEN 1 ELSE 0 END" @{} 'scalar') -eq '1') } catch { $cat = $false }
|    # #830 / #834 the row values the readers read on every finding, when the database has their columns (the updater adds them)
|    $rowCols = $false
|    try { $rowCols = ([string](& $Invoke "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'RaFillRiskFactorConsequence') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RaRowsAt') IS NOT NULL THEN 1 ELSE 0 END" @{} 'scalar') -eq '1') } catch { $rowCols = $false }
|    # 2026-10-25 the vulnerability step (before the data sync) already filled this collection's row values with the same
|    # expressions (Invoke-SIDataRowColumnsFill, RaRowsAt set): written once, not again -- only rows carried in since get them
|    $rowsDone = $false; $carriedCol = $false
|    if ($rowCols) {
|        try { $rowsDone = ([string](& $Invoke "SELECT CASE WHEN EXISTS (SELECT 1 FROM sidata.Collection WHERE CollectionId = @CollectionId AND RaRowsAt IS NOT NULL) THEN 1 ELSE 0 END" @{ CollectionId = $CollectionId } 'scalar') -eq '1') } catch { $rowsDone = $false }
|        try { $carriedCol = ([string](& $Invoke "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'CarriedFrom') IS NOT NULL THEN 1 ELSE 0 END" @{} 'scalar') -eq '1') } catch { $carriedCol = $false }
|    }
|    $sql = if ($rowsDone) { Get-SIDataDeriveFindingSql -Services:$Services -Fix:$Fix -Category:$cat -CarriedRowColumns:$carriedCol }
|           else { Get-SIDataDeriveFindingSql -Services:$Services -Fix:$Fix -Category:$cat -RowColumns:$rowCols }
|    if ($b -and $null -ne $b['Lo'] -and -not ($b['Lo'] -is [System.DBNull])) {
|        $rg = @{ Invoke = $Invoke; CollectionId = $CollectionId; Lo = [long]$b['Lo']; Hi = [long]$b['Hi']; Sql = $sql; TargetMs = $TargetMs }
|        if ($BatchSize) { $rg.BatchSize = $BatchSize }
|        $done = Invoke-SIDataFindingRanges @rg
|    }
|    # #830 / #834 every range carried the row values: the readers read this collection from its typed columns from now on
|    if ($rowCols -and -not $rowsDone) { $null = & $Invoke 'UPDATE sidata.Collection SET RaRowsAt = SYSUTCDATETIME() WHERE CollectionId = @CollectionId; SELECT 1;' @{ CollectionId = $CollectionId } 'scalar' }
|    # the risk score's parts as columns, when the database has them (the updater adds them): every row, then the stamp
|    if (Test-SIDataRiskPartsReady -Invoke $Invoke) {
|        $parts = @{ Invoke = $Invoke; CollectionId = $CollectionId; Sql = (Get-SIDataRiskPartsSql); TargetMs = $TargetMs }
|        $hiPart = 0L
|        if ($b -and $null -ne $b['Lo'] -and -not ($b['Lo'] -is [System.DBNull])) {
|            $parts.Lo = [long]$b['Lo']; $parts.Hi = [long]$b['Hi']; $hiPart = [long]$b['Hi']
|            $null = Invoke-SIDataFindingRanges @parts
|        }
|        $null = & $Invoke (Get-SIDataRiskPartsStampSql) @{ CollectionId = $CollectionId; Upto = $hiPart } 'scalar'
|    }
|    # the facet aggregate in FindingId ranges (a large collection's one statement ran past the SQL limit)
|    $fsz = [long]0
|    $facets = Invoke-SIDataFacet -Invoke $Invoke -CollectionId $CollectionId -FixColumn:$Fix -BatchSize ([ref]$fsz) -TargetMs $TargetMs -Log $Log
|    $svc = $null
|    if ($Services) { $svc = [int](Invoke-SIDataServices -Invoke $Invoke -CollectionId $CollectionId -Log $Log) }
|    [pscustomobject]@{ CollectionId = $CollectionId; Findings = $done; Facets = $facets; Services = $svc }
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE COLLECTION'S AGGREGATES IN RANGES (2026-10-29): the day's totals, the services and the departments of a collection
|#  -- and their counted twins (the exempted step) -- ran as ONE statement over every finding of the collection: at the
|#  large installs past the SQL limit ("Invoke-SIDataExemptedVariants ... Timeout expired"). On a real database's seam they
|#  now run on ONE connection (mode 'session'): the findings are read a FindingId range at a time (the clustered key) into
|#  a #temp table of partial counts per group and asset, those are folded a range of asset keys at a time (every row of an
|#  asset in one range, so a distinct count of assets adds up exactly), and only the collection's aggregate rows are
|#  replaced, in one short transaction. Nothing is written to the database before that transaction, so a run that stops
|#  part-way leaves the aggregate as it was and the next run makes it again. Counts and highest values are the one
|#  statement's exactly; a sum of scores (float) may differ in its last digits only (the order of the additions -- the one
|#  statement's own sum varies with its plan the same way). Every range is its own command, measured and logged.
|# ------------------------------------------------------------------------------------------------------------------
|
|function Test-SIDataSessionRangedSeam {
|    <# PURE. A real database's seam that runs several batches on one connection and the heavy steps in ranges. #>
|    param($Invoke)
|    [bool]($null -ne $Invoke -and $Invoke.PSObject.Properties['SISqlSession'] -and $Invoke.SISqlSession -and $Invoke.PSObject.Properties['SISqlRanged'] -and $Invoke.SISqlRanged)
|}
|
|function ConvertTo-SIDataSqlText {
|    <# PURE. A value as a T-SQL text literal (N'...', quotes doubled); NULL for $null. A batch of a session takes no parameters. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -is [System.DBNull]) { return 'NULL' }
|    "N'" + ([string]$Value).Replace("'", "''") + "'"
|}
|
|function Invoke-SIDataSessionIdRanges {
|    <# In a session (-Run): -Text for every FindingId range of collection -CollectionId ({AFTER} / {UPTO} replaced), sized
|       from the measured time of the one before; one log line per range. Answers the ranges run. #>
|    param([Parameter(Mandatory)][scriptblock]$Run, [Parameter(Mandatory)][int]$CollectionId, [Parameter(Mandatory)][string]$Text, [string]$What = 'ranges',
|          [long]$FirstSize = 50000, [long]$TargetMs = 5000, [scriptblock]$Log)
|    $b = @(& $Run ('SELECT ISNULL(MIN(FindingId), 0) AS Lo, ISNULL(MAX(FindingId), -1) AS Hi FROM sidata.Finding WHERE CollectionId = {0};' -f $CollectionId) 'reader' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })[0]
|    $after = [long]$b['Lo'] - 1; $hi = [long]$b['Hi']; $size = [Math]::Max(1L, $FirstSize); $i = 0
|    while ($after -lt $hi) {
|        $upto = [long][Math]::Min([double]$hi, [double]$after + [double]$size)
|        $sw = [Diagnostics.Stopwatch]::StartNew()
|        & $Run ($Text.Replace('{AFTER}', [string]$after).Replace('{UPTO}', [string]$upto)) 'none'
|        $i++
|        if ($Log) { & $Log 'INFO' ('{0} -- findings range {1} (ids {2:N0}-{3:N0}) -- {4:N1} s' -f $What, $i, ($after + 1), $upto, ($sw.ElapsedMilliseconds / 1000.0)) }
|        $after = $upto
|        $size = Get-SIDataNextSize -Current $size -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 1
|    }
|    $i
|}
|
|function Invoke-SIDataSessionKeyRanges {
|    <# In a session (-Run): -Text for every range of the text key -Column of the #temp table -Table ({PRED} replaced by the range's
|       predicate, its bounds as literals; every row of one key value in one range), then once for the rows without a key
|       ({PRED} = ' AND <column> IS NULL'). Sized from the measured time of the one before; one log line per range. #>
|    param([Parameter(Mandatory)][scriptblock]$Run, [Parameter(Mandatory)][string]$Table, [Parameter(Mandatory)][string]$Column, [Parameter(Mandatory)][string]$Text,
|          [string]$What = 'ranges', [long]$FirstTake = 20000, [long]$TargetMs = 5000, [scriptblock]$Log)
|    $take = [Math]::Max(1L, $FirstTake); $lo = $null; $i = 0
|    while ($true) {
|        $lop = ''; if ($null -ne $lo) { $lop = (' AND {0} > {1}' -f $Column, (ConvertTo-SIDataSqlText $lo)) }
|        $b = @(& $Run ('SELECT MAX(x.k) AS Hi, COUNT_BIG(*) AS N FROM (SELECT TOP ({0}) {1} AS k FROM {2} WHERE {1} IS NOT NULL{3} ORDER BY {1}) AS x;' -f $take, $Column, $Table, $lop) 'reader' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })[0]
|        $hi = $b['Hi']; $n = [long]$b['N']
|        if ($n -eq 0 -or $null -eq $hi) { break }
|        $last = $n -lt $take
|        $pred = (' AND {0} IS NOT NULL' -f $Column) + $lop
|        if (-not $last) { $pred += (' AND {0} <= {1}' -f $Column, (ConvertTo-SIDataSqlText $hi)) }
|        $i++
|        $sw = [Diagnostics.Stopwatch]::StartNew()
|        & $Run ($Text.Replace('{PRED}', $pred)) 'none'
|        if ($Log) { & $Log 'INFO' ('{0} -- assets range {1} -- {2:N1} s' -f $What, $i, ($sw.ElapsedMilliseconds / 1000.0)) }
|        if ($last) { break }
|        $lo = [string]$hi
|        $take = Get-SIDataNextSize -Current $take -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 1
|    }
|    & $Run ($Text.Replace('{PRED}', (' AND {0} IS NULL' -f $Column))) 'none'
|    $i
|}
|
|function Invoke-SIDataFindingDaily {
|    <#
|        The day's aggregate (Get-SIDataFindingDailySql; -Counted: its counted twin) -- on a real database's seam in ranges (see
|        above), any other seam the one statement. -Day: 'yyyy-MM-dd'. Answers the day's rows written (as the statement).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$Day, [switch]$Counted, [scriptblock]$Log,
|          [long]$FirstSize = 50000, [long]$TargetMs = 5000)
|    if (-not (Test-SIDataSessionRangedSeam $Invoke)) { return [int](& $Invoke (Get-SIDataFindingDailySql -Counted:$Counted) @{ Day = $Day } 'scalar') }
|    if ($Invoke.PSObject.Properties['SIRangeFirstTake'] -and [long]$Invoke.SIRangeFirstTake -gt 0) { $FirstSize = [long]$Invoke.SIRangeFirstTake }
|    if ($Day -notmatch '^\d{4}-\d{2}-\d{2}$') { throw ("the day of the day's totals is not a date ('{0}')" -f $Day) }
|    $table = 'FindingDaily'; $mark = ''; $assets = 'AssetDaily'
|    if ($Counted) { $table = 'FindingDailyCounted'; $mark = ' AND f.ExemptionId IS NULL'; $assets = 'AssetDailyCounted' }
|    $what = $(if ($Counted) { "v3 model    : the day's totals without exempted findings ($Day)" } else { "v3 model    : the day's totals ($Day)" })
|    $onSession = {
|        param($Run)
|        $c = @(& $Run @"
|SET NOCOUNT ON;
|DECLARE @d date = '$Day';
|DECLARE @c int = (SELECT TOP (1) CollectionId FROM sidata.Collection
|                  WHERE Kind = 'Detailed' AND Status = 'Complete' AND CollectionTime >= @d AND CollectionTime < DATEADD(day, 1, @d)
|                  ORDER BY CollectionTime DESC);
|DECLARE @gone int = 0;
|IF @c IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RetiredAt') IS NOT NULL
|    EXEC sp_executesql N'SELECT @g = COUNT(*) FROM sidata.Collection WHERE CollectionId = @c AND RetiredAt IS NOT NULL', N'@c int, @g int OUTPUT', @c = @c, @g = @gone OUTPUT;
|SELECT @c AS C, @gone AS Gone;
|"@ 'reader' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })[0]
|        # #717: the day's collection had its finding rows removed by the retention -- its stored day totals are kept
|        if ([int]$c['Gone'] -gt 0) { return 0 }
|        $cid = $c['C']
|        & $Run @'
|SELECT TOP (0) f.CiLifecycle AS Lc, f.Tier, ISNULL(f.Severity, '') AS Sev, ISNULL(f.SecurityDomain, '') AS Dom, ISNULL(f.ReportName, '') AS Rep, f.AssetKey,
|       COUNT_BIG(*) AS Findings, SUM(f.RiskScore) AS ScoreSum, MAX(f.RiskScore) AS ScoreMax
|INTO #dp FROM sidata.Finding AS f GROUP BY f.CiLifecycle, f.Tier, ISNULL(f.Severity, ''), ISNULL(f.SecurityDomain, ''), ISNULL(f.ReportName, ''), f.AssetKey;
|CREATE CLUSTERED INDEX CX_dp ON #dp (AssetKey);
|SELECT TOP (0) Lc, Tier, Sev, Dom, Rep, Findings, CONVERT(bigint, 0) AS Assets, ScoreSum, ScoreMax INTO #dr FROM #dp;
|-- (the CUBE's rolled-up cells carry NULL in every column: all of them may be empty here)
|CREATE TABLE #da (G int NOT NULL, Tier tinyint NULL, Sev nvarchar(30) COLLATE DATABASE_DEFAULT NULL, Dom nvarchar(128) COLLATE DATABASE_DEFAULT NULL, Rep nvarchar(256) COLLATE DATABASE_DEFAULT NULL, Lc nvarchar(16) COLLATE DATABASE_DEFAULT NULL, Assets bigint NOT NULL);
|'@ 'none'
|        if ($null -ne $cid) {
|            $null = Invoke-SIDataSessionIdRanges -Run $Run -CollectionId ([int]$cid) -What $what -Log $Log -FirstSize $FirstSize -TargetMs $TargetMs -Text @"
|INSERT #dp (Lc, Tier, Sev, Dom, Rep, AssetKey, Findings, ScoreSum, ScoreMax)
|SELECT f.CiLifecycle, f.Tier, ISNULL(f.Severity, ''), ISNULL(f.SecurityDomain, ''), ISNULL(f.ReportName, ''), f.AssetKey, COUNT_BIG(*), SUM(f.RiskScore), MAX(f.RiskScore)
|FROM sidata.Finding AS f
|WHERE f.CollectionId = $([int]$cid) AND f.FindingId > {AFTER} AND f.FindingId <= {UPTO}$mark
|GROUP BY f.CiLifecycle, f.Tier, ISNULL(f.Severity, ''), ISNULL(f.SecurityDomain, ''), ISNULL(f.ReportName, ''), f.AssetKey;
|"@
|            # assets never span two asset ranges: their distinct counts add up -- per group, and per cell of the CUBE
|            $null = Invoke-SIDataSessionKeyRanges -Run $Run -Table '#dp' -Column 'AssetKey' -What $what -Log $Log -TargetMs $TargetMs -Text @'
|INSERT #dr (Lc, Tier, Sev, Dom, Rep, Findings, Assets, ScoreSum, ScoreMax)
|SELECT Lc, Tier, Sev, Dom, Rep, SUM(Findings), COUNT(DISTINCT AssetKey), SUM(ScoreSum), MAX(ScoreMax) FROM #dp WHERE 1 = 1{PRED} GROUP BY Lc, Tier, Sev, Dom, Rep;
|INSERT #da (G, Tier, Sev, Dom, Rep, Lc, Assets)
|SELECT GROUPING_ID(Tier, Sev, Dom, Rep), Tier, Sev, Dom, Rep, Lc, COUNT(DISTINCT AssetKey) FROM #dp WHERE 1 = 1{PRED} GROUP BY Lc, CUBE (Tier, Sev, Dom, Rep);
|'@
|        }
|        [int](& $Run @"
|SET NOCOUNT ON;
|SET XACT_ABORT ON;
|DECLARE @d date = '$Day';
|DECLARE @c int = $(if ($null -eq $cid) { 'NULL' } else { [int]$cid });
|BEGIN TRAN;
|DELETE FROM sidata.$table WHERE [Day] = @d;
|INSERT sidata.$table ([Day], CollectionId, Tier, Severity, SecurityDomain, ReportName, Findings, Assets, ScoreTotal, ScoreMax, CiLifecycle)
|SELECT @d, @c, Tier, Sev, Dom, Rep, SUM(Findings), SUM(Assets), ISNULL(SUM(ScoreSum), 0), MAX(ScoreMax), Lc
|FROM #dr GROUP BY Lc, Tier, Sev, Dom, Rep;
|DECLARE @n int = @@ROWCOUNT;
|IF OBJECT_ID('sidata.$assets') IS NOT NULL
|BEGIN
|    DELETE FROM sidata.$assets WHERE [Day] = @d;
|    INSERT sidata.$assets ([Day], CollectionId, GroupingId, Tier, Severity, SecurityDomain, ReportName, Assets, CiLifecycle)
|    SELECT @d, @c, G, Tier, Sev, Dom, Rep, SUM(Assets), Lc FROM #da GROUP BY G, Tier, Sev, Dom, Rep, Lc;
|END;
|COMMIT;
|DROP TABLE #dp; DROP TABLE #dr; DROP TABLE #da;
|SELECT @n;
|"@ 'scalar')
|    }
|    [int](& $Invoke $null $null 'session' $onSession)
|}
|
|function Invoke-SIDataServices {
|    <#
|        One collection's services (Get-SIDataServicesSql; -Counted: its counted twin) -- on a real database's seam in ranges:
|        the membership sources and everything after the per-asset counts run as the one statement's own text (they are per
|        asset and per service, not per finding); the per-asset counts (#a) are made a FindingId range at a time and folded a
|        range of assets at a time. Any other seam: the one statement. Answers the service rows written.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$CollectionId, [switch]$Counted, [object[]]$Sources = (Get-SIDataServiceSources),
|          [scriptblock]$Log, [long]$FirstSize = 50000, [long]$TargetMs = 5000)
|    $sql = Get-SIDataServicesSql -Sources $Sources -Counted:$Counted
|    if (-not (Test-SIDataSessionRangedSeam $Invoke)) { return [int](& $Invoke $sql @{ CollectionId = $CollectionId } 'scalar') }
|    if ($Invoke.PSObject.Properties['SIRangeFirstTake'] -and [long]$Invoke.SIRangeFirstTake -gt 0) { $FirstSize = [long]$Invoke.SIRangeFirstTake }
|    # a batch of a session takes no parameter: the collection's id (a number) is written in
|    $text = $sql.Replace('@CollectionId', [string][int]$CollectionId)
|    $iA = $text.IndexOf('CREATE TABLE #a ('); $iIns = $text.IndexOf("INSERT #a`r`nSELECT"); if ($iIns -lt 0) { $iIns = $text.IndexOf("INSERT #a`nSELECT") }
|    $iMem = $text.IndexOf('CREATE TABLE #mem')
|    if ($iA -lt 0 -or $iIns -lt $iA -or $iMem -lt $iIns) { throw 'the services statement is not in the shape its ranges are cut from' }
|    $head = $text.Substring(0, $iA); $createA = $text.Substring($iA, $iIns - $iA); $insA = $text.Substring($iIns, $iMem - $iIns); $tail = $text.Substring($iMem)
|    $gb = $insA.LastIndexOf('GROUP BY f.AssetKey;')
|    if ($gb -lt 0) { throw 'the services statement is not in the shape its ranges are cut from' }
|    # the per-asset counts of one FindingId range, into #ap (the same expressions)
|    $insAp = ($insA.Substring(0, $gb).Replace('INSERT #a', 'INSERT #ap').TrimEnd() + ' AND f.FindingId > {AFTER} AND f.FindingId <= {UPTO}' + "`r`n" + 'GROUP BY f.AssetKey;')
|    $what = $(if ($Counted) { 'v3 model    : the services without exempted findings' } else { 'v3 model    : the services' })
|    $cid = $CollectionId
|    $onSession = {
|        param($Run)
|        & $Run $head 'none'
|        & $Run ($createA + "SELECT TOP (0) * INTO #ap FROM #a;`r`nCREATE CLUSTERED INDEX CX_ap ON #ap (AssetKey);") 'none'
|        $null = Invoke-SIDataSessionIdRanges -Run $Run -CollectionId $cid -What $what -Log $Log -FirstSize $FirstSize -TargetMs $TargetMs -Text $insAp
|        $null = Invoke-SIDataSessionKeyRanges -Run $Run -Table '#ap' -Column 'AssetKey' -What $what -Log $Log -TargetMs $TargetMs -Text @'
|INSERT #a
|SELECT AssetKey, MAX(AssetName), MIN(Tier), SUM(Findings), SUM(Critical), SUM(High), SUM(Medium), SUM(Low), SUM(T0), SUM(T1), SUM(T2), SUM(T3), SUM(TU),
|       SUM(WeightedTotal), SUM(RiskTotal), MAX(MaxWeighted)
|FROM #ap WHERE 1 = 1{PRED} GROUP BY AssetKey;
|'@
|        [int](& $Run ("SET XACT_ABORT ON;`r`n" + $tail) 'scalar')
|    }
|    [int](& $Invoke $null $null 'session' $onSession)
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  EXEMPTED FINDINGS (#264): the counted twins of every pre-computed aggregate
|# ------------------------------------------------------------------------------------------------------------------
|#  An exemption never removes a finding: Risk Analysis marks it and the load copies the mark (sidata.Finding.ExemptionId).
|#  Each aggregate the pages read exists twice -- the table over EVERY finding and its "...Counted" twin over the findings
|#  without a mark -- so a page answers "exempted counted" and "not counted" from a pre-computed table, never from a live
|#  GROUP BY over finding rows. CHOICE (measured, see docs\DESIGN.md "Exempted findings"): aggregate both variants at sync
|#  time rather than subtract at read time -- the distinct counts (assets per group, CIs per service) and the highest scores
|#  cannot be subtracted, and the twin costs one more pass over ONE collection per load.
|
|function Get-SIDataExemptedSchemaCheckSql {
|    <# 1 when the database carries the mark columns and every counted twin (si-data-schema.sql, #264), else 0. #>
|    "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'ExemptionId') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'ExemptedDerivedAt') IS NOT NULL AND OBJECT_ID('sidata.FindingDailyCounted') IS NOT NULL AND OBJECT_ID('sidata.FindingFacetCounted') IS NOT NULL AND OBJECT_ID('sidata.DepartmentFacetCounted') IS NOT NULL AND OBJECT_ID('sidata.ServiceRiskCounted') IS NOT NULL AND OBJECT_ID('sidata.ServiceAssetCounted') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataUnexemptedSql {
|    <#
|        Complete collections whose counted twins are not computed yet (new loads, and once every earlier one) or are STALE: a
|        base aggregate (DerivedAt, ServicesDerivedAt, ResolvedAt) was recomputed after them. Newest first. The base steps
|        never touch the twins: the timestamps they already stamp are what makes a twin stale.
|    #>
|    "SELECT CollectionId, CollectionTime, CASE WHEN DerivedAt IS NULL THEN 0 ELSE 1 END AS Derived, CASE WHEN ResolvedVersion IS NULL THEN 0 ELSE 1 END AS Resolved, CASE WHEN ServicesDerivedAt IS NULL THEN 0 ELSE 1 END AS ServicesDerived FROM sidata.Collection WHERE Status = 'Complete' AND Kind = 'Detailed' AND (ExemptedDerivedAt IS NULL OR ExemptedDerivedAt < DerivedAt OR ExemptedDerivedAt < ServicesDerivedAt OR ExemptedDerivedAt < ResolvedAt)$(Get-SIDataLiveFilter) ORDER BY CollectionTime DESC"
|}
|
|function Get-SIDataExemptedStampSql {
|    "UPDATE sidata.Collection SET ExemptedDerivedAt = SYSUTCDATETIME() WHERE CollectionId = @CollectionId; SELECT @@ROWCOUNT;"
|}
|
|function Invoke-SIDataExemptedVariants {
|    <#
|        ONE collection's counted twins: the day's FindingDailyCounted (the day's latest collection, as the base table), its
|        FindingFacetCounted (when its views' data is derived), DepartmentFacetCounted (when its departments are resolved,
|        -Departments) and ServiceRiskCounted / ServiceAssetCounted (when its services are derived, -Services) -- then
|        ExemptedDerivedAt. A twin whose base is not computed yet (no departments resolved, no services derived) is skipped:
|        its base is empty for the collection too, and computing the base later stamps a time newer than ExemptedDerivedAt,
|        so the twin follows on the next sync. A collection whose views' data is not derived yet stays pending.
|        Returns @{ CollectionId; Daily; Facets; Departments; Services; Stamped }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)]$Collection, [switch]$Services, [switch]$Departments, [scriptblock]$Log)
|    $cid = [int]$Collection.CollectionId
|    $t = ConvertTo-SIDataUtc $Collection.CollectionTime
|    $out = [ordered]@{ CollectionId = $cid; Daily = $null; Facets = $null; Departments = $null; Services = $null; Stamped = $false }
|    $out.Daily = [int](Invoke-SIDataFindingDaily -Invoke $Invoke -Counted -Day $t.ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture) -Log $Log)
|    if ([int]$Collection.Derived -ne 1) { return [pscustomobject]$out }
|    $fsz = [long]0
|    $out.Facets = Invoke-SIDataFacet -Invoke $Invoke -CollectionId $cid -Counted -BatchSize ([ref]$fsz) -Log $Log
|    if ($Departments -and [int]$Collection.Resolved -eq 1) { $out.Departments = [int](Invoke-SIDataDepartmentFacet -Invoke $Invoke -CollectionId $cid -Counted -Log $Log) }
|    if ($Services -and [int]$Collection.ServicesDerived -eq 1) { $out.Services = [int](Invoke-SIDataServices -Invoke $Invoke -CollectionId $cid -Counted -Log $Log) }
|    $out.Stamped = ([int](& $Invoke (Get-SIDataExemptedStampSql) @{ CollectionId = $cid } 'scalar')) -eq 1
|    [pscustomobject]$out
|}
|
|function Get-SIDataPurgeTargetsSql {
|    <# Collections past retention, and loads that died outside the look-back window (they would never be retried). #>
|    @'
|SET NOCOUNT ON;
|-- ONE TRUSTED RUN: the collection the web app shows (sidata.PublishedRun) is never purged, however old it is
|DECLARE @pub int = NULL;
|IF OBJECT_ID('sidata.PublishedRun') IS NOT NULL
|    EXEC sp_executesql N'SELECT @p = DetailedCollectionId FROM sidata.PublishedRun WHERE Name = N''current''', N'@p int OUTPUT', @p = @pub OUTPUT;
|SELECT CollectionId, CollectionTime, Status FROM sidata.Collection
|WHERE (CollectionTime < CONVERT(datetime2(3), @Cutoff, 126)
|   OR (Status = 'Loading' AND CollectionTime < CONVERT(datetime2(3), @StaleLoading, 126)))
|  AND CollectionId <> ISNULL(@pub, -1)
|ORDER BY CollectionTime ASC
|'@
|}
|
|function Get-SIDataPurgeBatchSql {
|    <# One batch of one collection's child rows. -Table: Finding | Recommendation. The table name is from an allow-list, never input. #>
|    param([Parameter(Mandatory)][ValidateSet('Finding', 'Recommendation')][string]$Table)
|    "DELETE TOP (@Batch) FROM sidata.$Table WHERE CollectionId = @CollectionId; SELECT @@ROWCOUNT;"
|}
|
|function Get-SIDataPurgeCollectionSql {
|    @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DELETE FROM sidata.FindingDaily WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingDailyCounted') IS NOT NULL DELETE FROM sidata.FindingDailyCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetDaily') IS NOT NULL DELETE FROM sidata.AssetDaily WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetDailyCounted') IS NOT NULL DELETE FROM sidata.AssetDailyCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingFacetCounted') IS NOT NULL DELETE FROM sidata.FindingFacetCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.DepartmentFacetCounted') IS NOT NULL DELETE FROM sidata.DepartmentFacetCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ServiceRiskCounted') IS NOT NULL DELETE FROM sidata.ServiceRiskCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ServiceAssetCounted') IS NOT NULL DELETE FROM sidata.ServiceAssetCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingFacet') IS NOT NULL DELETE FROM sidata.FindingFacet WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.DepartmentFacet') IS NOT NULL DELETE FROM sidata.DepartmentFacet WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ServiceRisk') IS NOT NULL DELETE FROM sidata.ServiceRisk WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ServiceAsset') IS NOT NULL DELETE FROM sidata.ServiceAsset WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ServiceMember') IS NOT NULL DELETE FROM sidata.ServiceMember WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetCorrelation') IS NOT NULL DELETE FROM sidata.AssetCorrelation WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.CollectionPartial') IS NOT NULL DELETE FROM sidata.CollectionPartial WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.IssueContext') IS NOT NULL DELETE FROM sidata.IssueContext WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.CveSummary') IS NOT NULL DELETE FROM sidata.CveSummary WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.CveSummaryCounted') IS NOT NULL DELETE FROM sidata.CveSummaryCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.CveSummaryState') IS NOT NULL DELETE FROM sidata.CveSummaryState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetRiskSummary') IS NOT NULL DELETE FROM sidata.AssetRiskSummary WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetRiskSummaryCounted') IS NOT NULL DELETE FROM sidata.AssetRiskSummaryCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetRiskSummaryState') IS NOT NULL DELETE FROM sidata.AssetRiskSummaryState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.DomainCategory') IS NOT NULL DELETE FROM sidata.DomainCategory WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.DomainCategoryState') IS NOT NULL DELETE FROM sidata.DomainCategoryState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ReportPreviewCount') IS NOT NULL DELETE FROM sidata.ReportPreviewCount WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ReportPreviewState') IS NOT NULL DELETE FROM sidata.ReportPreviewState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.CiFindingSummary') IS NOT NULL DELETE FROM sidata.CiFindingSummary WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.CiFindingSummaryState') IS NOT NULL DELETE FROM sidata.CiFindingSummaryState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingChange') IS NOT NULL DELETE FROM sidata.FindingChange WHERE CollectionId = @CollectionId OR PrevCollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingChangeCounted') IS NOT NULL DELETE FROM sidata.FindingChangeCounted WHERE CollectionId = @CollectionId OR PrevCollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetChange') IS NOT NULL DELETE FROM sidata.AssetChange WHERE CollectionId = @CollectionId OR PrevCollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetChangeCounted') IS NOT NULL DELETE FROM sidata.AssetChangeCounted WHERE CollectionId = @CollectionId OR PrevCollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ChangeCount') IS NOT NULL DELETE FROM sidata.ChangeCount WHERE CollectionId = @CollectionId OR PrevCollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ChangeCountCounted') IS NOT NULL DELETE FROM sidata.ChangeCountCounted WHERE CollectionId = @CollectionId OR PrevCollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ChangeState') IS NOT NULL DELETE FROM sidata.ChangeState WHERE CollectionId = @CollectionId OR PrevCollectionId = @CollectionId;
|IF OBJECT_ID('sidata.Tier0Asset') IS NOT NULL DELETE FROM sidata.Tier0Asset WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.Tier0AssetCounted') IS NOT NULL DELETE FROM sidata.Tier0AssetCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.Tier0AssetState') IS NOT NULL DELETE FROM sidata.Tier0AssetState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingPivotCell') IS NOT NULL DELETE FROM sidata.FindingPivotCell WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingPivotCellCounted') IS NOT NULL DELETE FROM sidata.FindingPivotCellCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.PivotCell') IS NOT NULL DELETE FROM sidata.PivotCell WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingPivotState') IS NOT NULL DELETE FROM sidata.FindingPivotState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.SummaryGroup') IS NOT NULL DELETE FROM sidata.SummaryGroup WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.SummaryGroupCounted') IS NOT NULL DELETE FROM sidata.SummaryGroupCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.SummaryGroupState') IS NOT NULL DELETE FROM sidata.SummaryGroupState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.RemediationAsset') IS NOT NULL DELETE FROM sidata.RemediationAsset WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.Remediation') IS NOT NULL DELETE FROM sidata.Remediation WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.KeyFigure') IS NOT NULL DELETE FROM sidata.KeyFigure WHERE CollectionId = @CollectionId;
|DELETE FROM sidata.Collection WHERE CollectionId = @CollectionId
|  AND NOT EXISTS (SELECT 1 FROM sidata.Finding WHERE CollectionId = @CollectionId)
|  AND NOT EXISTS (SELECT 1 FROM sidata.Recommendation WHERE CollectionId = @CollectionId);
|DECLARE @n int = @@ROWCOUNT;
|COMMIT;
|SELECT @n;
|'@
|}
|
|function Get-SIDataPurgeOrphansSql {
|    <# Runs no collection refers to, and CIs not seen since the cutoff that no remaining finding refers to (identifiers first). #>
|    param([Parameter(Mandatory)][ValidateSet('Run', 'AssetIdentifier', 'AssetTag', 'Asset', 'AssetEvidence', 'AssetConflict', 'AssetIdHistory')][string]$What)
|    switch ($What) {
|        # #299: correlation evidence and conflicts no load has carried since the cutoff; the id history of CIs that are
|        # gone (after the CI purge) -- never the history of a CI that is still in sidata.Ci (the CI build's CI->CI merge
|        # events name the replacement the CMDB reconciles to; a CI is never deleted). Nothing on a database without the tables.
|        'AssetEvidence' { "IF OBJECT_ID('sidata.AssetEvidence') IS NULL BEGIN SELECT 0; RETURN; END; DELETE TOP (@Batch) e FROM sidata.AssetEvidence e WHERE e.LastSeen < CONVERT(datetime2(3), @Cutoff, 126); SELECT @@ROWCOUNT;" }
|        'AssetConflict' { "IF OBJECT_ID('sidata.AssetConflict') IS NULL BEGIN SELECT 0; RETURN; END; DELETE TOP (@Batch) c FROM sidata.AssetConflict c WHERE c.LastSeen < CONVERT(datetime2(3), @Cutoff, 126); SELECT @@ROWCOUNT;" }
|        'AssetIdHistory' { "IF OBJECT_ID('sidata.AssetIdHistory') IS NULL BEGIN SELECT 0; RETURN; END; DELETE TOP (@Batch) h FROM sidata.AssetIdHistory h WHERE h.DetectedAt < CONVERT(datetime2(3), @Cutoff, 126) AND NOT EXISTS (SELECT 1 FROM sidata.Asset a WHERE a.AssetKey = h.AssetKey) AND NOT EXISTS (SELECT 1 FROM sidata.Ci c WHERE c.CiId = h.AssetKey); SELECT @@ROWCOUNT;" }
|        # the responsibility tags of a CI that is purged (#254); nothing on a database without the table
|        'AssetTag' { "IF OBJECT_ID('sidata.AssetTag') IS NULL BEGIN SELECT 0; RETURN; END; DELETE TOP (@Batch) t FROM sidata.AssetTag t JOIN sidata.Asset a ON a.AssetKey = t.AssetKey WHERE a.LastSeen < CONVERT(datetime2(3), @Cutoff, 126) AND NOT EXISTS (SELECT 1 FROM sidata.Finding f WHERE f.AssetKey = a.AssetKey); SELECT @@ROWCOUNT;" }
|        'Run' { "DELETE TOP (@Batch) r FROM sidata.Run r WHERE r.CollectionTime < CONVERT(datetime2(3), @Cutoff, 126) AND NOT EXISTS (SELECT 1 FROM sidata.Collection c WHERE c.RunId = r.RunId); SELECT @@ROWCOUNT;" }
|        'AssetIdentifier' { "DELETE TOP (@Batch) i FROM sidata.AssetIdentifier i JOIN sidata.Asset a ON a.AssetKey = i.AssetKey WHERE a.LastSeen < CONVERT(datetime2(3), @Cutoff, 126) AND NOT EXISTS (SELECT 1 FROM sidata.Finding f WHERE f.AssetKey = a.AssetKey); SELECT @@ROWCOUNT;" }
|        'Asset' { "DELETE TOP (@Batch) a FROM sidata.Asset a WHERE a.LastSeen < CONVERT(datetime2(3), @Cutoff, 126) AND NOT EXISTS (SELECT 1 FROM sidata.Finding f WHERE f.AssetKey = a.AssetKey) AND NOT EXISTS (SELECT 1 FROM sidata.AssetIdentifier i WHERE i.AssetKey = a.AssetKey); SELECT @@ROWCOUNT;" }
|    }
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE WRITES
|# ------------------------------------------------------------------------------------------------------------------
|
|function Invoke-SIDataBatchedDelete {
|    <#
|        Runs one 'DELETE TOP (@Batch) ...; SELECT @@ROWCOUNT' until it removes nothing, sizing each batch from the last
|        one's measured time (Get-SIDataNextSize). Returns the rows removed. -DeadlineUtc (#816): no new batch after it -- the
|        caller's time budget (what is left is removed by its next call).
|        -Housekeeping (the removal of retired collections): the housekeeping rule of the pacing -- wait until the database is
|        calm, never past -DeadlineUtc (Invoke-SISqlPacingHousekeeping). -LockBound (> 0): no batch is ever larger -- the
|        lock-escalation bound of the table (Get-SIDataRetireBatchBound), the rule of the key ranges; 0 = none (as before).
|        -Stopped: set to $true when the housekeeping wait reached the deadline with rows possibly left.
|        -ShouldStop (the clean-up as housekeeping): asked before EVERY batch; a non-empty answer (why) stops the removal there
|        -- -Stopped is set and -StopWhy gets the answer; the next wake-up goes on. None given = as before.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$Sql, [hashtable]$Params = @{},
|          [ref]$BatchSize, [long]$TargetMs = 5000, [datetime]$DeadlineUtc = [datetime]::MaxValue,
|          [switch]$Housekeeping, [long]$LockBound = 0, [ref]$Stopped, [scriptblock]$ShouldStop, [ref]$StopWhy)
|    $total = 0L
|    $size = [long]5000; if ($BatchSize -and $BatchSize.Value -gt 0) { $size = [long]$BatchSize.Value }
|    if ($LockBound -gt 0 -and $size -gt $LockBound) { $size = $LockBound }
|    # the database's own load paces the batches (SI-SqlPacing.ps1): a pause and a smaller batch only while it is saturated
|    $paced = [bool](Get-Command -Name Invoke-SISqlPacing -ErrorAction SilentlyContinue); $lastMs = 0L
|    while ($true) {
|        if ($paced) {
|            $pace = if ($Housekeeping) { Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs -Housekeeping -DeadlineUtc $DeadlineUtc } else { Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs }
|            if ($pace.Shrink) { $size = [Math]::Max(100L, [long][Math]::Floor($size / 2)) }
|            if ($LockBound -gt 0 -and $size -gt $LockBound) { $size = $LockBound }
|            if ($Housekeeping -and $pace.PSObject.Properties['Deadline'] -and $pace.Deadline) { if ($Stopped) { $Stopped.Value = $true }; break }
|        }
|        # housekeeping: no new batch once the wait reached the deadline
|        if ($Housekeeping -and [datetime]::UtcNow -ge $DeadlineUtc) { break }
|        # housekeeping: no new batch once a run, a data sync or a data out has started (asked right before the statement)
|        if ($ShouldStop) {
|            $w = ''; try { $w = [string](& $ShouldStop) } catch { $w = ('whether a job started could not be read ({0})' -f $_.Exception.Message) }
|            if ($w) { if ($Stopped) { $Stopped.Value = $true }; if ($StopWhy) { $StopWhy.Value = $w }; break }
|        }
|        $p = @{}; foreach ($k in $Params.Keys) { $p[$k] = $Params[$k] }; $p['Batch'] = $size
|        $sw = [Diagnostics.Stopwatch]::StartNew()
|        $n = [long](& $Invoke $Sql $p 'scalar')
|        $sw.Stop(); $lastMs = $sw.ElapsedMilliseconds
|        $total += $n
|        if ($n -lt $size) { break }
|        $size = Get-SIDataNextSize -Current $size -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 100
|        if ($LockBound -gt 0 -and $size -gt $LockBound) { $size = $LockBound }
|        if ([datetime]::UtcNow -ge $DeadlineUtc) { break }
|    }
|    if ($BatchSize) { $BatchSize.Value = $size }
|    $total
|}
|
|function Get-SIDataIndexCountSql {
|    <# The live indexes of one table (@Table, 'schema.name'): the count the lock-escalation bound is worked out from -- the
|       same count Get-SIDataRetireRangeSql makes for its own @cap. 0 when the table is not there. #>
|    "SELECT COUNT(*) FROM sys.indexes WHERE object_id = OBJECT_ID(@Table) AND index_id > 0 AND is_hypothetical = 0 AND is_disabled = 0;"
|}
|
|function Get-SIDataRetireBatchBound {
|    <#
|        The most rows ONE batched delete of a retired collection's -Table may take: below SQL Server's lock escalation (5,000
|        locks of one statement), counting one lock in EVERY index of the table -- 4000 / the table's indexes, at least 1 --
|        the rule of the key ranges (Get-SIDataRetireRangeSql, review S5). A lock-escalation bound, not a limit on the work:
|        the removal goes on batch after batch until nothing is left. The table comes from the allow-list, never input.
|        Indexes that cannot be counted: the bound of a table with one index (4000). -IndexCount: the count (tests).
|    #>
|    param([scriptblock]$Invoke, [Parameter(Mandatory)][ValidateSet('IssueContext', 'RaStage', 'RaDefenderKey', 'Recommendation', 'Finding', 'SummaryAsset', 'SummaryRow')][string]$Table,
|          $IndexCount = $null)
|    $ix = $IndexCount
|    if ($null -eq $ix -and $Invoke) { try { $ix = & $Invoke (Get-SIDataIndexCountSql) @{ Table = ('sidata.' + $Table) } 'scalar' } catch { $ix = $null } }
|    $n = 0; if ($null -ne $ix -and -not ($ix -is [System.DBNull])) { try { $n = [int]$ix } catch { $n = 0 } }
|    # a table has at most 1,000 indexes (one clustered + 999): anything else is not a count
|    if ($n -lt 1 -or $n -gt 1000) { $n = 1 }
|    [long][Math]::Max(1, [Math]::Floor(4000 / $n))
|}
|
|function Write-SIDataJsonRows {
|    <#
|        Sends JSON object texts in chunks through one OPENJSON statement (-Sql reads @j and returns the rows it wrote).
|        Each chunk is checked: a chunk that wrote fewer rows than it carried FAILS the load -- it is never counted as
|        written. The chunk size follows the measured time of the last chunk. Returns the rows written.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$Sql,
|          [Parameter(Mandatory)][AllowEmptyCollection()][string[]]$Items, [hashtable]$Params = @{},
|          [ref]$ChunkChars, [long]$TargetMs = 10000, [string]$What = 'rows')
|    $total = 0L
|    $target = [long]2000000; if ($ChunkChars -and $ChunkChars.Value -gt 0) { $target = [long]$ChunkChars.Value }
|    $i = 0
|    # the database's own load paces the chunks (SI-SqlPacing.ps1): a pause and a smaller chunk only while it is saturated;
|    # every item is still written, in the same order
|    $paced = [bool](Get-Command -Name Invoke-SISqlPacing -ErrorAction SilentlyContinue); $lastMs = 0L
|    while ($i -lt $Items.Count) {
|        if ($paced) { $pace = Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs; if ($pace.Shrink) { $target = [Math]::Max(50000L, [long][Math]::Floor($target / 2)) } }
|        # one chunk at the CURRENT size, so a slow chunk shrinks the next one
|        $take = New-Object System.Collections.Generic.List[string]; $len = 0L
|        while ($i -lt $Items.Count -and ($take.Count -eq 0 -or ($len + $Items[$i].Length + 1) -le $target)) { $take.Add($Items[$i]); $len += $Items[$i].Length + 1; $i++ }
|        $p = @{}; foreach ($k in $Params.Keys) { $p[$k] = $Params[$k] }; $p['j'] = '[' + ($take -join ',') + ']'
|        $sw = [Diagnostics.Stopwatch]::StartNew()
|        $n = [long](& $Invoke $Sql $p 'scalar')
|        $sw.Stop(); $lastMs = $sw.ElapsedMilliseconds
|        if ($n -ne $take.Count) { throw ("{0}: a chunk of {1} wrote {2} -- the load stops; nothing of this collection is shown until a full load succeeds." -f $What, $take.Count, $n) }
|        $total += $n
|        # the time measured is the time of THIS chunk ($len characters), so the next size is worked out from $len: a small
|        # chunk that was fast (the last of a part, a small Risk Analysis bucket) says nothing about a larger one and never
|        # grows the size -- it grew on every such call before, doubling to an overflow over one run (live 2026-10-13)
|        $next = Get-SIDataNextSize -Current ([Math]::Max(1L, $len)) -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 50000
|        if ($len -ge $target -or $i -lt $Items.Count) { $target = $next }   # a full chunk (the size, not the items, ended it): its time sizes the next one (at most double)
|        elseif ($next -lt $len) { $target = $next }         # a part chunk that was SLOW: smaller at once
|    }
|    if ($ChunkChars) { $ChunkChars.Value = $target }
|    $total
|}
|
|function Get-SIDataPurgeDerivedTables {
|    <#
|        PURE. #881 The tables the purge of a collection empties for it, read from Get-SIDataPurgeCollectionSql itself (ONE
|        list: a table added there is emptied in batches too): @{ Table; Prev ($true = it also holds the collection as the
|        EARLIER one of a comparison, PrevCollectionId) }, in the purge's order.
|    #>
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($m in [regex]::Matches((Get-SIDataPurgeCollectionSql), '(?m)DELETE FROM sidata\.(\w+) WHERE CollectionId = @CollectionId( OR PrevCollectionId = @CollectionId)?;')) {
|        if ($m.Groups[1].Value -eq 'Collection') { continue }
|        $out.Add([pscustomobject]@{ Table = $m.Groups[1].Value; Prev = [bool]$m.Groups[2].Success })
|    }
|    $out.ToArray()
|}
|
|function Get-SIDataPurgeDerivedBatchSql {
|    <# #881 One batch of one derived table's rows of a collection (-Column CollectionId | PrevCollectionId); 0 on a database
|       without the table. -Table comes from Get-SIDataPurgeDerivedTables (the purge's own list), never input. #>
|    param([Parameter(Mandatory)][ValidatePattern('^\w+$')][string]$Table, [ValidateSet('CollectionId', 'PrevCollectionId')][string]$Column = 'CollectionId')
|    "IF OBJECT_ID(N'sidata.$Table') IS NULL BEGIN SELECT 0; RETURN; END; DELETE TOP (@Batch) FROM sidata.$Table WHERE $Column = @CollectionId; SELECT @@ROWCOUNT;"
|}
|
|function Remove-SIDataCollection {
|    <# Removes one collection and everything loaded under it (findings, recommendations, its daily rows), in batches.
|       #881 every derived table first, in measured batches (each its own short statement -- at the largest tenant the ~50
|       tables of a collection in ONE transaction filled the log), the comparisons that name it as the earlier collection too;
|       then the purge's own transaction removes whatever is left (nothing, normally) and the collection row. The same rows
|       go as before -- the last statement is the purge as it was. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$CollectionId, [ref]$BatchSize)
|    $f = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeBatchSql -Table Finding) -Params @{ CollectionId = $CollectionId } -BatchSize $BatchSize
|    $r = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeBatchSql -Table Recommendation) -Params @{ CollectionId = $CollectionId } -BatchSize $BatchSize
|    foreach ($d in (Get-SIDataPurgeDerivedTables)) {
|        $null = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeDerivedBatchSql -Table $d.Table) -Params @{ CollectionId = $CollectionId } -BatchSize $BatchSize
|        if ($d.Prev) { $null = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeDerivedBatchSql -Table $d.Table -Column PrevCollectionId) -Params @{ CollectionId = $CollectionId } -BatchSize $BatchSize }
|    }
|    $c = [int](& $Invoke (Get-SIDataPurgeCollectionSql) @{ CollectionId = $CollectionId } 'scalar')
|    if ($c -ne 1) { throw ("collection {0} could not be removed (rows still refer to it)" -f $CollectionId) }
|    [pscustomobject]@{ CollectionId = $CollectionId; Findings = $f; Recommendations = $r }
|}
|
|function Invoke-SIDataRetention {
|    <#
|        Purges collections taken before the cutoff (and loads that died outside the look-back window), then runs no
|        collection refers to and CIs not seen since the cutoff that no remaining finding refers to. sidata only.
|        Returns @{ Cutoff; Collections; Findings; Recommendations; Runs; Assets; Identifiers }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$RetentionDays, [int]$LookbackDays = 3,
|          [datetime]$Now = [datetime]::UtcNow)
|    $cutoff = Get-SIDataRetentionCutoff -RetentionDays $RetentionDays -Now $Now
|    $stale = $Now.ToUniversalTime().AddDays(-($LookbackDays + 1))
|    $targetsRaw = (& $Invoke (Get-SIDataPurgeTargetsSql) @{ Cutoff = (Format-SIDataSqlTime -Time $cutoff); StaleLoading = (Format-SIDataSqlTime -Time $stale) } 'reader')
|    $targets = @($targetsRaw)
|    $batch = [long]5000
|    $sum = [ordered]@{ Cutoff = $cutoff; Collections = 0; Findings = 0L; Recommendations = 0L; Runs = 0L; Assets = 0L; Identifiers = 0L; Tags = 0L; Evidence = 0L }
|    foreach ($t in $targets) {
|        if ($null -eq $t) { continue }
|        $r = Remove-SIDataCollection -Invoke $Invoke -CollectionId ([int]$t['CollectionId']) -BatchSize ([ref]$batch)
|        $sum.Collections++; $sum.Findings += $r.Findings; $sum.Recommendations += $r.Recommendations
|    }
|    $cp = @{ Cutoff = (Format-SIDataSqlTime -Time $cutoff) }
|    $sum.Runs = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeOrphansSql -What Run) -Params $cp -BatchSize ([ref]$batch)
|    $sum.Identifiers = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeOrphansSql -What AssetIdentifier) -Params $cp -BatchSize ([ref]$batch)
|    $sum.Tags = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeOrphansSql -What AssetTag) -Params $cp -BatchSize ([ref]$batch)
|    $sum.Assets = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeOrphansSql -What Asset) -Params $cp -BatchSize ([ref]$batch)
|    # #299: the correlation evidence past retention, then the id history of the CIs just purged
|    $sum.Evidence = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeOrphansSql -What AssetEvidence) -Params $cp -BatchSize ([ref]$batch)
|    $sum.Evidence += Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeOrphansSql -What AssetConflict) -Params $cp -BatchSize ([ref]$batch)
|    $sum.Evidence += Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeOrphansSql -What AssetIdHistory) -Params $cp -BatchSize ([ref]$batch)
|    [pscustomobject]$sum
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE FULL ASSET METADATA'S OWN RETENTION (#301, operator 2026-10-05: "3 days should be sufficient")
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SIDataAssetPropertiesPruneSql {
|    <#
|        One batch of the prune: the full asset metadata (the source-system bags from SI_AssetProperties_CL) is removed
|        from sidata.Asset.PropertiesJson when it was collected before @Cutoff ("_siPropertiesAt"), or carries no
|        collection time at all (written before the stamp existed, or not refreshed by this sync). The tier attribution
|        at the top of the bag (SI_TierSetBy / SI_TierReason / SI_TierClaims -- #244) is KEPT: it is SecurityInsight's
|        own data, not the metadata. Nothing on a database without the table. Returns the rows changed.
|    #>
|    @'
|IF OBJECT_ID('sidata.Asset') IS NULL BEGIN SELECT 0; RETURN; END;
|UPDATE TOP (@Batch) a SET
|    PropertiesJson = CASE
|        WHEN JSON_VALUE(a.PropertiesJson, '$.SI_TierSetBy') IS NULL THEN NULL
|        WHEN JSON_QUERY(a.PropertiesJson, '$.SI_TierClaims') IS NOT NULL THEN
|            JSON_MODIFY(JSON_MODIFY(JSON_MODIFY(N'{}', '$.SI_TierSetBy', JSON_VALUE(a.PropertiesJson, '$.SI_TierSetBy')),
|                '$.SI_TierReason', JSON_VALUE(a.PropertiesJson, '$.SI_TierReason')), '$.SI_TierClaims', JSON_QUERY(a.PropertiesJson, '$.SI_TierClaims'))
|        ELSE
|            JSON_MODIFY(JSON_MODIFY(JSON_MODIFY(N'{}', '$.SI_TierSetBy', JSON_VALUE(a.PropertiesJson, '$.SI_TierSetBy')),
|                '$.SI_TierReason', JSON_VALUE(a.PropertiesJson, '$.SI_TierReason')), '$.SI_TierClaims', JSON_VALUE(a.PropertiesJson, '$.SI_TierClaims'))
|    END
|FROM sidata.Asset a
|WHERE a.PropertiesJson IS NOT NULL AND ISJSON(a.PropertiesJson) = 1
|  AND EXISTS (SELECT 1 FROM OPENJSON(a.PropertiesJson) k WHERE k.[key] NOT IN (N'SI_TierSetBy', N'SI_TierReason', N'SI_TierClaims', N'_siPropertiesAt'))
|  AND (TRY_CONVERT(datetime2(3), JSON_VALUE(a.PropertiesJson, '$._siPropertiesAt'), 127) IS NULL
|       OR TRY_CONVERT(datetime2(3), JSON_VALUE(a.PropertiesJson, '$._siPropertiesAt'), 127) < CONVERT(datetime2(3), @Cutoff, 126));
|SELECT @@ROWCOUNT;
|'@
|}
|
|function Get-SIDataAssetPropertiesRetentionDays {
|    <# PURE. SI_AssetProperties_RetentionDays from a name -> value map: a whole number, at least 1; anything else = 3. #>
|    param([hashtable]$Globals = @{})
|    $raw = if ($Globals.ContainsKey('SI_AssetProperties_RetentionDays') -and $null -ne $Globals['SI_AssetProperties_RetentionDays']) { "$($Globals['SI_AssetProperties_RetentionDays'])".Trim() } else { '' }
|    $n = 0
|    if (-not $raw -or -not [int]::TryParse($raw, [Globalization.NumberStyles]::Integer, [Globalization.CultureInfo]::InvariantCulture, [ref]$n)) { return 3 }
|    [Math]::Max(1, $n)
|}
|
|function Invoke-SIDataAssetPropertiesPrune {
|    <#
|        Removes the full asset metadata older than -RetentionDays from the Pro database, in batches: the generic store
|        (sidata.AssetMetadata, #408) and the older per-asset bags in sidata.Asset.PropertiesJson. Returns @{ Cutoff;
|        RetentionDays; Assets (bags); MetadataRows }. The caller audits it (datasync.assetproperties.prune).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [int]$RetentionDays = 3, [datetime]$Now = [datetime]::UtcNow)
|    if ($RetentionDays -lt 1) { $RetentionDays = 1 }
|    $cutoff = $Now.ToUniversalTime().AddDays(-$RetentionDays)
|    $batch = [long]5000
|    $n = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataAssetPropertiesPruneSql) -Params @{ Cutoff = (Format-SIDataSqlTime -Time $cutoff) } -BatchSize ([ref]$batch)
|    # #408: the generic store (sidata.AssetMetadata) by the same cutoff -- at every level, so metadata stored while 'full'
|    # was on ages out after it is switched back
|    $m = 0L
|    if (Get-Command -Name Invoke-SIDataAssetMetadataPrune -ErrorAction SilentlyContinue) { $m = Invoke-SIDataAssetMetadataPrune -Invoke $Invoke -Cutoff $cutoff }
|    [pscustomobject]@{ Cutoff = $cutoff; RetentionDays = $RetentionDays; Assets = [long]$n; MetadataRows = [long]$m }
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE COLLECTIONS' OWN RETENTION (#717, owner 2026-10-16: "it can not grow full" / "i bet it is the old failed runs" /
|#  "which can be removed"). Measured at a large install: sidata.Finding 10.9M rows / 30.8 GB, ~1M rows per Risk Analysis
|#  run, six collections all still 'Loading' (a stopped run never reaches the step that marks it complete).
|#
|#  THE RULE, per grain (Risk Analysis Detailed = sidata.Collection; Risk Analysis Summary = sidata.SummaryLoad):
|#    KEEP     the newest COMPLETE collection (what every view shows) and the complete one before it (the comparison
|#             between runs reads it); a complete collection whose rows a kept collection's not-complete report shows
|#             (sidata.CollectionReportCarry: the last complete result of that report); every collection still 'Loading'
|#             that is NEWER than the newest complete one (a run in progress -- one run at a time per install, the pipeline
|#             lock -- or one not superseded yet); everything, while no complete collection of the grain exists.
|#    REMOVE   the finding rows of every older complete collection, and of every 'Loading' collection OLDER than the
|#             newest complete one (abandoned: its run stopped or failed; a newer run of the same grain completed).
|#             ALSO (#746, a large install 2026-10-18: six Detailed collections left Loading by stopped or failed runs; an install whose
|#             runs keep stopping never gets a complete one, and kept every attempt): a 'Loading' collection older than
|#             -StaleDays (7, the longest a pipeline run may take) that is NOT the newest collection of its grain -- a newer
|#             run of the same grain started after it -- and whose result is not waiting to be completed by the data sync
|#             (RaCompletedAt) is abandoned too, complete collection or not. The newest collection of a grain is never it.
|#  WHAT "REMOVE" REMOVES -- the row-level detail, which is the size: the findings (sidata.Finding, the data sync's rows and
|#  Risk Analysis' alike -- every row carries its CollectionId), the recommendations, the prepared issue rows
|#  (sidata.IssueContext), and what an abandoned run staged (sidata.RaStage / RaDefenderKey). A Summary collection: its
|#  rows and impacted assets. WHAT IT KEEPS: the collection row itself, marked (RetiredAt) -- so the data sync never loads
|#  it from Log Analytics again and no view lists it -- and every aggregate (the day totals behind the trends, the facets,
|#  the departments, the services, the correlation rows, the per-report verdicts behind the row-count comparison). Those
|#  go with the collection row when SI_Pro_DataRetentionDays (90) removes it, as before.
|#  ABSENCE IS NOT REMEDIATION: nothing here touches the newest collection, the close-loop (vuln.*) or the per-CI lifecycle
|#  (sidata.Ci*), so removing an old collection can never close or change a finding of the current one.
|#  SAFE BY CONSTRUCTION: the mark refuses (in SQL) a collection that does not have the newer complete collection(s) the
|#  rule needs; every delete removes rows only of a MARKED collection; batches on the clustered keys (CollectionId /
|#  CollectionTime / RunKey), sized from their measured time. Idempotent: a removal that stopped part way is finished by the
|#  next run (the collection is marked and still has rows). Never throws: a failure is said, and the next run tries again.
|# ------------------------------------------------------------------------------------------------------------------
|
|$script:SIDataRetiredReady = $false
|
|function Set-SIDataRetiredReady {
|    <# Whether the database carries the retention mark (sidata.Collection.RetiredAt) -- the readers below leave marked collections out only then. #>
|    param([bool]$Ready)
|    $script:SIDataRetiredReady = $Ready
|}
|
|function Get-SIDataLiveFilter {
|    <# ' AND <alias>RetiredAt IS NULL' when the database carries the mark (Set-SIDataRetiredReady), else '' -- a collection whose rows the retention removed is never derived, resolved, prepared or shown again. #>
|    param([string]$Alias = '')
|    if ($script:SIDataRetiredReady) { $p = if ($Alias) { $Alias.TrimEnd('.') + '.' } else { '' }; return (' AND {0}RetiredAt IS NULL' -f $p) }
|    ''
|}
|
|function Get-SIDataRetiredColumnsSql {
|    <# The mark on a database set up before it existed: the SAME guarded, additive statements as sql/si-data-schema.sql. Answers 1 when the mark is there. #>
|    @'
|IF COL_LENGTH('sidata.Collection', 'RetiredAt') IS NULL ALTER TABLE sidata.Collection ADD RetiredAt DATETIME2(0) NULL;
|IF COL_LENGTH('sidata.Collection', 'RetiredWhy') IS NULL ALTER TABLE sidata.Collection ADD RetiredWhy NVARCHAR(32) NULL;
|IF OBJECT_ID('sidata.SummaryLoad') IS NOT NULL AND COL_LENGTH('sidata.SummaryLoad', 'RetiredAt') IS NULL ALTER TABLE sidata.SummaryLoad ADD RetiredAt DATETIME2(0) NULL;
|IF OBJECT_ID('sidata.SummaryLoad') IS NOT NULL AND COL_LENGTH('sidata.SummaryLoad', 'RetiredWhy') IS NULL ALTER TABLE sidata.SummaryLoad ADD RetiredWhy NVARCHAR(32) NULL;
|SELECT CASE WHEN COL_LENGTH('sidata.Collection', 'RetiredAt') IS NOT NULL THEN 1 ELSE 0 END;
|'@
|}
|
|function Get-SIDataRetiredReadySql {
|    "SELECT CASE WHEN COL_LENGTH('sidata.Collection', 'RetiredAt') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataRetentionStateSql {
|    <#
|        Every collection of both grains, newest first per grain: its status, its mark, and -- for a marked one -- whether
|        rows are still left (a removal that stopped part way), and Pending = 1 when Risk Analysis' result is in and waits for
|        the data sync to complete it (RaCompletedAt). Small: one row per collection; each check is one seek on the clustered
|        key. Nothing on a database without the mark.
|    #>
|    @'
|SET NOCOUNT ON;
|IF COL_LENGTH('sidata.Collection', 'RetiredAt') IS NULL
|BEGIN
|    SELECT CAST(NULL AS nvarchar(16)) AS Grain, CAST(NULL AS int) AS CollectionId, CAST(NULL AS datetime2(3)) AS CollectionTime, CAST(NULL AS nvarchar(16)) AS Status,
|           CAST(NULL AS datetime2(0)) AS RetiredAt, CAST(0 AS int) AS HasRows, CAST(0 AS int) AS Pending, CAST(0 AS int) AS Published, CAST(NULL AS nvarchar(32)) AS RetiredWhy WHERE 1 = 0;
|    RETURN;
|END
|DECLARE @pend nvarchar(200) = CASE WHEN COL_LENGTH('sidata.Collection', 'RaCompletedAt') IS NOT NULL THEN N'CASE WHEN c.RaCompletedAt IS NOT NULL THEN 1 ELSE 0 END' ELSE N'0' END;
|-- ONE TRUSTED RUN: Published = 1 on the collection of each grain the web app shows (sidata.PublishedRun 'current')
|DECLARE @pubD nvarchar(300) = CASE WHEN OBJECT_ID('sidata.PublishedRun') IS NOT NULL THEN N'CASE WHEN EXISTS (SELECT 1 FROM sidata.PublishedRun AS p WHERE p.Name = N''current'' AND p.DetailedCollectionId = c.CollectionId) THEN 1 ELSE 0 END' ELSE N'0' END;
|DECLARE @pubS nvarchar(300) = CASE WHEN OBJECT_ID('sidata.PublishedRun') IS NOT NULL THEN N'CASE WHEN EXISTS (SELECT 1 FROM sidata.PublishedRun AS p WHERE p.Name = N''current'' AND p.SummaryCollectionTime = l.CollectionTime) THEN 1 ELSE 0 END' ELSE N'0' END;
|DECLARE @q nvarchar(max) = N'SELECT N''Detailed'' AS Grain, c.CollectionId, c.CollectionTime, c.Status, c.RetiredAt,
|       CASE WHEN c.RetiredAt IS NOT NULL AND EXISTS (SELECT 1 FROM sidata.Finding AS f WHERE f.CollectionId = c.CollectionId) THEN 1 ELSE 0 END AS HasRows, ' + @pend + N' AS Pending, ' + @pubD + N' AS Published, c.RetiredWhy
|FROM sidata.Collection AS c WHERE c.Kind = N''Detailed''';
|IF OBJECT_ID('sidata.SummaryLoad') IS NOT NULL AND COL_LENGTH('sidata.SummaryLoad', 'RetiredAt') IS NOT NULL AND OBJECT_ID('sidata.SummaryRow') IS NOT NULL
|    SET @q += N'
|UNION ALL
|SELECT N''Summary'', CAST(NULL AS int), l.CollectionTime, l.Status, l.RetiredAt,
|       CASE WHEN l.RetiredAt IS NOT NULL AND EXISTS (SELECT 1 FROM sidata.SummaryRow AS s WHERE s.CollectionTime = l.CollectionTime) THEN 1 ELSE 0 END, 0, ' + @pubS + N', l.RetiredWhy
|FROM sidata.SummaryLoad AS l';
|SET @q += N' ORDER BY 1, 3 DESC';
|EXEC sp_executesql @q;
|'@
|}
|
|function Get-SIDataRetentionCarrySql {
|    <# Which collection a kept collection's not-complete report shows its last complete rows from (sidata.CollectionReportCarry). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.CollectionReportCarry') IS NULL SELECT CAST(NULL AS int) AS CollectionId, CAST(NULL AS int) AS FromCollectionId WHERE 1 = 0;
|ELSE SELECT DISTINCT CollectionId, FromCollectionId FROM sidata.CollectionReportCarry WHERE FromCollectionId IS NOT NULL;
|'@
|}
|
|function Get-SIDataCollectionRetentionPlan {
|    <#
|        PURE. The rule above, per grain. -Collections: Get-SIDataRetentionStateSql's rows (Grain, CollectionId,
|        CollectionTime, Status, RetiredAt, HasRows). -CarryLinks: Get-SIDataRetentionCarrySql's rows. Returns one item per
|        collection that is KEPT or acted on -- @{ Grain; CollectionId; CollectionTime; Status; Action; Why; Reason }:
|          Keep     never touched (Reason says why)
|          Retire   its rows are removed now; Why = 'abandoned' (a 'Loading' collection older than the newest complete one)
|                   | 'superseded' (a complete one older than the newest complete one and the one before it)
|          Finish   marked by an earlier run whose removal did not finish -- the rest of its rows are removed now
|        A marked collection with no rows left is not listed. The newest complete collection of a grain is never Retire.
|        #746: a 'Loading' collection older than -StaleDays before -NowUtc that is not the newest collection of its grain and
|        not Pending (its result waits for the data sync) is Retire 'abandoned' too -- also while no collection of the grain
|        is complete. -StaleDays 0 = that rule off.
|        #816: -IdleStaleHours > 0 -- given ONLY when no pipeline run is running (the caller checked cfg.FlowRun) -- a Detailed
|        collection still 'Loading' that started more than that many hours before -NowUtc, not Pending, not the published one,
|        is Retire 'stopped run' even when it is the newest collection: no run is writing it. 0 = that rule off.
|        #882: -IdleBeforeUtc (instead of -IdleStaleHours) -- the start of the oldest Risk Analysis work that may still be
|        writing (Get-SIDataLoadingOwnerFloor): a Detailed collection still loading that started BEFORE it, not Pending, not
|        the published one, belongs to no live run -- Retire 'stopped run' (-IdleReason says why). Never a complete one.
|    #>
|    param([AllowEmptyCollection()][object[]]$Collections = @(), [AllowEmptyCollection()][object[]]$CarryLinks = @(),
|          [datetime]$NowUtc = [datetime]::UtcNow, [int]$StaleDays = 7, [double]$IdleStaleHours = 0, $IdleBeforeUtc = $null, [string]$IdleReason = '')
|    $g = { param($r, [string]$n) $v = $null; if ($r -is [System.Collections.IDictionary]) { if ($r.Contains($n)) { $v = $r[$n] } } elseif ($null -ne $r -and $r.PSObject.Properties[$n]) { $v = $r.$n }; if ($v -is [System.DBNull]) { $null } else { $v } }
|    $rows = New-Object System.Collections.Generic.List[object]
|    foreach ($r in @($Collections)) {
|        if ($null -eq $r) { continue }
|        $grain = [string](& $g $r 'Grain'); if ($grain -notin 'Detailed', 'Summary') { continue }
|        $t = ConvertTo-SIDataUtc (& $g $r 'CollectionTime'); if ($null -eq $t) { continue }
|        $id = & $g $r 'CollectionId'
|        $rows.Add([pscustomobject]@{ Grain = $grain; CollectionId = $(if ($null -ne $id) { [int]$id } else { $null }); CollectionTime = $t; Status = [string](& $g $r 'Status')
|                                     Retired = ($null -ne (& $g $r 'RetiredAt')); HasRows = ([int](& $g $r 'HasRows') -eq 1); Pending = ([int](& $g $r 'Pending') -eq 1)
|                                     Published = ([int](& $g $r 'Published') -eq 1)
|                                     # #892 B1: when and why it was marked (only a marked one has them)
|                                     RetiredAt = (ConvertTo-SIDataUtc (& $g $r 'RetiredAt')); RetiredWhy = [string](& $g $r 'RetiredWhy') })
|    }
|    $staleBefore = $null
|    if ($StaleDays -gt 0) { $staleBefore = $NowUtc.ToUniversalTime().AddDays(-$StaleDays) }
|    # carried-from links: kept collection id -> the collections its reports show rows from
|    $from = @{}
|    foreach ($l in @($CarryLinks)) {
|        if ($null -eq $l) { continue }
|        $c = & $g $l 'CollectionId'; $f = & $g $l 'FromCollectionId'
|        if ($null -eq $c -or $null -eq $f) { continue }
|        $k = [string][int]$c; if (-not $from.ContainsKey($k)) { $from[$k] = New-Object System.Collections.Generic.List[int] }
|        $from[$k].Add([int]$f)
|    }
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($grain in 'Detailed', 'Summary') {
|        $all = @($rows | Where-Object { $_.Grain -eq $grain } | Sort-Object CollectionTime -Descending)
|        if (-not $all.Count) { continue }
|        $item = { param($x, [string]$action, [string]$why, [string]$reason)
|            [pscustomobject]@{ Grain = $x.Grain; CollectionId = $x.CollectionId; CollectionTime = $x.CollectionTime; Status = $x.Status; Action = $action; Why = $why; Reason = $reason
|                               RetiredAt = $x.RetiredAt; RetiredWhy = $x.RetiredWhy } }
|        # a marked collection whose removal stopped part way is finished, whatever else is decided
|        # (#892: the published run's collection is never finished, also when it carries a mark -- the views read it)
|        foreach ($x in @($all | Where-Object { $_.Retired -and $_.HasRows })) {
|            if ($x.Published) { $out.Add((& $item $x 'Keep' '' 'the published run -- what every view shows; its rows are never removed, also when it carries a mark')); continue }
|            $out.Add((& $item $x 'Finish' '' 'its rows were being removed when an earlier run stopped -- the rest is removed now'))
|        }
|        $live = @($all | Where-Object { -not $_.Retired })
|        $complete = @($live | Where-Object { $_.Status -eq 'Complete' })
|        # #746: a run that stopped long ago, with a newer run of the same grain after it, is abandoned whether or not any
|        # collection is complete -- never the newest collection of the grain, never one whose result waits to be completed
|        $newestAny = if ($live.Count) { $live[0].CollectionTime } else { $null }
|        $stale = {
|            param($x)
|            $null -ne $staleBefore -and $x.Status -ne 'Complete' -and -not $x.Pending -and $x.CollectionTime -lt $staleBefore -and $null -ne $newestAny -and $x.CollectionTime -lt $newestAny
|        }
|        $staleReason = [string]::Format($inv, 'its run stopped or failed more than {0} days ago and a newer run of the same kind started after it -- no run can still be writing it', $StaleDays)
|        # #816: no pipeline run is running (the caller's check) -- a Detailed collection still loading after IdleStaleHours is a stopped run's
|        $idleBefore = if ($null -ne $IdleBeforeUtc -and $grain -eq 'Detailed') { ([datetime]$IdleBeforeUtc).ToUniversalTime() } elseif ($IdleStaleHours -gt 0 -and $grain -eq 'Detailed') { $NowUtc.ToUniversalTime().AddHours(-$IdleStaleHours) } else { $null }
|        $stopped = { param($x) $null -ne $idleBefore -and $x.Status -ne 'Complete' -and -not $x.Pending -and -not $x.Published -and $x.CollectionTime -lt $idleBefore }
|        $stoppedReason = if ($null -ne $IdleBeforeUtc -and $IdleReason) { $IdleReason } else { [string]::Format($inv, 'its run stopped before it was complete: it is still loading after {0:0.#} hours and no pipeline run is running', $IdleStaleHours) }
|        if (-not $complete.Count) {
|            foreach ($x in $live) {
|                if (& $stale $x) { $out.Add((& $item $x 'Retire' 'abandoned' $staleReason)); continue }
|                if (& $stopped $x) { $out.Add((& $item $x 'Retire' 'stopped run' $stoppedReason)); continue }
|                $out.Add((& $item $x 'Keep' '' 'no collection of this kind is complete yet -- nothing is removed until one is, or until a stopped run is older than the longest run may take'))
|            }
|            continue
|        }
|        $newest = $complete[0]
|        $keep = @{}
|        $keep[[string]$newest.CollectionTime.Ticks] = 'the newest complete collection -- what every view shows'
|        if ($complete.Count -gt 1) { $keep[[string]$complete[1].CollectionTime.Ticks] = 'the complete collection before the newest -- the comparison between runs reads it' }
|        # ONE TRUSTED RUN: the published run's collection is what every view shows -- kept, however many newer ones there are
|        foreach ($x in @($complete | Where-Object { $_.Published })) { $keep[[string]$x.CollectionTime.Ticks] = 'the published run -- what every view shows' }
|        # the collections a kept collection's not-complete reports show their last complete rows from (Detailed only), and theirs
|        if ($grain -eq 'Detailed') {
|            $byId = @{}; foreach ($x in $complete) { if ($null -ne $x.CollectionId) { $byId[[string]$x.CollectionId] = $x } }
|            $changed = $true
|            while ($changed) {
|                $changed = $false
|                foreach ($x in @($complete | Where-Object { $keep.ContainsKey([string]$_.CollectionTime.Ticks) })) {
|                    if ($null -eq $x.CollectionId -or -not $from.ContainsKey([string]$x.CollectionId)) { continue }
|                    foreach ($fid in $from[[string]$x.CollectionId]) {
|                        $src = $byId[[string]$fid]
|                        if ($src -and -not $keep.ContainsKey([string]$src.CollectionTime.Ticks)) {
|                            $keep[[string]$src.CollectionTime.Ticks] = [string]::Format($inv, 'a report of the kept collection of {0:yyyy-MM-dd HH:mm} UTC shows its last complete rows from here', $x.CollectionTime)
|                            $changed = $true
|                        }
|                    }
|                }
|            }
|        }
|        foreach ($x in $live) {
|            $k = [string]$x.CollectionTime.Ticks
|            if ($keep.ContainsKey($k)) { $out.Add((& $item $x 'Keep' '' $keep[$k])); continue }
|            if ($x.Status -ne 'Complete') {
|                if ($x.CollectionTime -ge $newest.CollectionTime) {
|                    if (& $stale $x) { $out.Add((& $item $x 'Retire' 'abandoned' $staleReason)); continue }
|                    if (& $stopped $x) { $out.Add((& $item $x 'Retire' 'stopped run' $stoppedReason)); continue }
|                    $out.Add((& $item $x 'Keep' '' 'still loading and newer than the newest complete collection -- a run in progress is never removed')); continue
|                }
|                $out.Add((& $item $x 'Retire' 'abandoned' ([string]::Format($inv, 'its run stopped or failed before it was complete; the newer collection of {0:yyyy-MM-dd HH:mm} UTC is complete', $newest.CollectionTime))))
|                continue
|            }
|            $out.Add((& $item $x 'Retire' 'superseded' 'older than the newest complete collection and the one before it'))
|        }
|    }
|    , $out.ToArray()
|}
|
|function Get-SIDataRetireMarkSql {
|    <#
|        Marks ONE collection retired (its rows are removed next). The database itself refuses -- answers 0 -- unless newer
|        COMPLETE collections of the same grain exist that are not marked: one for a 'Loading' collection, two for a complete
|        one. So the newest complete collection, and a run still loading after it, can never be marked whatever the caller
|        asks. A Detailed collection also leaves the collection views' list (ViewsReadyAt). Answers 1 when marked.
|        #746: a NOT complete collection is also accepted when it is older than @StaleBefore (ISO text; '' = never) and a
|        newer, unmarked collection of the same grain exists -- so the newest collection of a grain is never marked this way.
|        #816 -Idle (Detailed; the caller found no pipeline run running): a NOT complete collection that started before
|        @IdleBefore (ISO text) and whose Risk Analysis result does not wait for the data sync (RaCompletedAt) is accepted too --
|        the newest one included: no run is writing it. Never the published run's collection, never a complete one.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Detailed', 'Summary')][string]$Grain, [switch]$Idle)
|    if ($Grain -eq 'Summary') {
|        return @'
|SET NOCOUNT ON;
|DECLARE @stale datetime2(3) = TRY_CONVERT(datetime2(3), NULLIF(@StaleBefore, N''), 126);
|-- ONE TRUSTED RUN: the published run's Summary is never marked, whatever the caller asks (in ONE transaction
|-- under the publisher's app lock, the pointer checked again in the UPDATE)
|SET XACT_ABORT ON;
|BEGIN TRANSACTION;
|DECLARE @pubT datetime2(3) = NULL;
|IF OBJECT_ID('sidata.PublishedRun') IS NOT NULL
|BEGIN
|    DECLARE @lk int;
|    EXEC @lk = sp_getapplock @Resource = N'sidata.PublishedRun', @LockMode = N'Shared', @LockOwner = N'Transaction', @LockTimeout = 60000;
|    IF @lk < 0 BEGIN ROLLBACK TRANSACTION; SELECT 0; RETURN; END
|    EXEC sp_executesql N'SELECT @p = SummaryCollectionTime FROM sidata.PublishedRun WHERE Name = N''current''', N'@p datetime2(3) OUTPUT', @p = @pubT OUTPUT;
|    IF @pubT = CONVERT(datetime2(3), @CollectionTime, 126) BEGIN ROLLBACK TRANSACTION; SELECT 0; RETURN; END
|END
|UPDATE l SET RetiredAt = SYSUTCDATETIME(), RetiredWhy = LEFT(@Why, 32)
|FROM sidata.SummaryLoad AS l
|WHERE l.CollectionTime = CONVERT(datetime2(3), @CollectionTime, 126) AND l.RetiredAt IS NULL AND (@pubT IS NULL OR l.CollectionTime <> @pubT)
|  AND ((SELECT COUNT(*) FROM sidata.SummaryLoad AS x WHERE x.Status = N'Complete' AND x.RetiredAt IS NULL AND x.CollectionTime > l.CollectionTime)
|      >= CASE WHEN l.Status = N'Complete' THEN 2 ELSE 1 END
|    OR (l.Status <> N'Complete' AND @stale IS NOT NULL AND l.CollectionTime < @stale
|        AND EXISTS (SELECT 1 FROM sidata.SummaryLoad AS y WHERE y.RetiredAt IS NULL AND y.CollectionTime > l.CollectionTime)));
|DECLARE @n int = @@ROWCOUNT;
|COMMIT TRANSACTION;
|SELECT @n;
|'@
|    }
|    $idleDeclare = ''; $idleCase = ''
|    if ($Idle) {
|        $idleDeclare = @'
|DECLARE @idle datetime2(3) = TRY_CONVERT(datetime2(3), NULLIF(@IdleBefore, N''), 126);
|DECLARE @pending bit = 0;
|IF COL_LENGTH('sidata.Collection', 'RaCompletedAt') IS NOT NULL
|    EXEC sp_executesql N'SELECT @p = CASE WHEN RaCompletedAt IS NOT NULL THEN 1 ELSE 0 END FROM sidata.Collection WHERE CollectionId = @c', N'@c int, @p bit OUTPUT', @c = @c, @p = @pending OUTPUT;
|
|'@
|        $idleCase = "`n    OR (c.Status <> N'Complete' AND @idle IS NOT NULL AND @pending = 0 AND c.CollectionTime < @idle)"
|    }
|    $sql = @'
|SET NOCOUNT ON;
|DECLARE @c int = CONVERT(int, @CollectionId);
|DECLARE @stale datetime2(3) = TRY_CONVERT(datetime2(3), NULLIF(@StaleBefore, N''), 126);
|{IDLE}-- ONE TRUSTED RUN: the published run's collection is never marked, whatever the caller asks. The mark and
|-- the publisher never interleave -- the pointer is read and the mark made in ONE transaction under the publisher's own app lock
|-- (shared here; sidata.PublishedRunSet takes it exclusive before it reads a collection's mark and moves the pointer), and the
|-- pointer is checked again in the UPDATE itself.
|SET XACT_ABORT ON;
|BEGIN TRANSACTION;
|DECLARE @pub int = NULL;
|IF OBJECT_ID('sidata.PublishedRun') IS NOT NULL
|BEGIN
|    DECLARE @lk int;
|    EXEC @lk = sp_getapplock @Resource = N'sidata.PublishedRun', @LockMode = N'Shared', @LockOwner = N'Transaction', @LockTimeout = 60000;
|    IF @lk < 0 BEGIN ROLLBACK TRANSACTION; SELECT 0; RETURN; END
|    EXEC sp_executesql N'SELECT @p = DetailedCollectionId FROM sidata.PublishedRun WHERE Name = N''current''', N'@p int OUTPUT', @p = @pub OUTPUT;
|    IF @pub = @c BEGIN ROLLBACK TRANSACTION; SELECT 0; RETURN; END
|END
|UPDATE c SET RetiredAt = SYSUTCDATETIME(), RetiredWhy = LEFT(@Why, 32)
|FROM sidata.Collection AS c
|WHERE c.CollectionId = @c AND c.Kind = N'Detailed' AND c.RetiredAt IS NULL AND (@pub IS NULL OR c.CollectionId <> @pub)
|  AND ((SELECT COUNT(*) FROM sidata.Collection AS x WHERE x.Kind = N'Detailed' AND x.Status = N'Complete' AND x.RetiredAt IS NULL AND x.CollectionTime > c.CollectionTime)
|      >= CASE WHEN c.Status = N'Complete' THEN 2 ELSE 1 END
|    OR (c.Status <> N'Complete' AND @stale IS NOT NULL AND c.CollectionTime < @stale
|        AND EXISTS (SELECT 1 FROM sidata.Collection AS y WHERE y.Kind = N'Detailed' AND y.RetiredAt IS NULL AND y.CollectionTime > c.CollectionTime)){CASE});
|DECLARE @n int = @@ROWCOUNT;
|IF @n > 0 AND COL_LENGTH('sidata.Collection', 'ViewsReadyAt') IS NOT NULL
|    EXEC sp_executesql N'UPDATE sidata.Collection SET ViewsReadyAt = NULL WHERE CollectionId = @c', N'@c int', @c = @c;
|COMMIT TRANSACTION;
|SELECT @n;
|'@
|    $sql.Replace('{IDLE}', $idleDeclare).Replace('{CASE}', $idleCase)
|}
|
|$script:SIDataRetireTables = [ordered]@{
|    # removed in this order: the finding rows LAST, so a removal that stops part way still shows as rows left (HasRows)
|    Detailed = @('IssueContext', 'RaStage', 'RaDefenderKey', 'Recommendation', 'Finding')
|    Summary  = @('RaStage', 'RaDefenderKey', 'SummaryAsset', 'SummaryRow')
|}
|
|function Get-SIDataRetireBatchSql {
|    <#
|        One batch of one MARKED collection's rows of one table (from an allow-list, never input): 'DELETE TOP (@Batch) ...;
|        SELECT @@ROWCOUNT'. Every statement removes rows only while the collection is marked, on the table's clustered key.
|        A table the database does not have answers 0.
|        #892 (review B1) -DataSyncMarkedBefore (Detailed; while a pipeline run is going): only while the mark is one the data
|        sync made (superseded / abandoned) BEFORE @MarkedBefore (ISO text: the running run's start).
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Detailed', 'Summary')][string]$Grain,
|          [Parameter(Mandatory)][ValidateSet('IssueContext', 'RaStage', 'RaDefenderKey', 'Recommendation', 'Finding', 'SummaryAsset', 'SummaryRow')][string]$Table,
|          [switch]$DataSyncMarkedBefore)
|    $since = if ($DataSyncMarkedBefore -and $Grain -eq 'Detailed') { " AND m.RetiredAt < CONVERT(datetime2(0), @MarkedBefore, 126) AND m.RetiredWhy IN (N'superseded', N'abandoned', N'stopped run')" } else { '' }
|    $marked = if ($Grain -eq 'Summary') { "EXISTS (SELECT 1 FROM sidata.SummaryLoad AS m WHERE m.CollectionTime = CONVERT(datetime2(3), @CollectionTime, 126) AND m.RetiredAt IS NOT NULL)" }
|              else { "EXISTS (SELECT 1 FROM sidata.Collection AS m WHERE m.CollectionId = CONVERT(int, @CollectionId) AND m.Kind = N'Detailed' AND m.RetiredAt IS NOT NULL$since)" }
|    $where = switch ($Table) {
|        { $_ -in 'RaStage', 'RaDefenderKey' } { 'RunKey = @RunKey' }
|        { $_ -in 'SummaryAsset', 'SummaryRow' } { 'CollectionTime = CONVERT(datetime2(3), @CollectionTime, 126)' }
|        default { 'CollectionId = CONVERT(int, @CollectionId)' }
|    }
|    "IF OBJECT_ID('sidata.$Table') IS NULL BEGIN SELECT 0; RETURN; END; DELETE TOP (@Batch) FROM sidata.$Table WHERE $where AND $marked; SELECT @@ROWCOUNT;"
|}
|
|# #892 the two large tables of a MARKED Detailed collection are removed in KEY RANGES on their clustered key (CollectionId,
|# <row id>): each statement works out the end of its range first, then removes exactly that range -- so a batch never scans
|# the ghost rows of the batches before it, and a removal that is stopped goes on from the collection's first row left.
|$script:SIDataRetireRangeKeys = [ordered]@{ Finding = 'FindingId'; Recommendation = 'RecommendationRowId' }
|
|function Get-SIDataRetireRangeSql {
|    <#
|        ONE KEY RANGE of one MARKED Detailed collection's rows of -Table (Finding | Recommendation, an allow-list, never input).
|        Answers ONE row: N (rows removed), Hi (the range's last row id; NULL = nothing is left), Refused (1 = the database
|        refused: nothing removed although the caller asked), Cap (the most rows one range may take).
|          * @MarkedBefore (ISO text, '' = not asked; review B1): only a mark the data sync made (superseded / abandoned) before
|            it -- the running pipeline run's start, so nothing in that run can be writing the collection;
|          * the range is never larger than @Cap: below SQL Server's lock escalation (5,000 locks of one statement), counting
|            one lock in EVERY index of the table (review S5) -- a range never turns into a table lock that holds a run's writes;
|          * @After = 0 starts at the collection's first row (one seek on the clustered key; review M4);
|          * the published run's collection is refused INSIDE the DELETE, and the range runs under the publisher's own app lock
|            (shared; sidata.PublishedRunSet takes it exclusive), so a publish never interleaves with a range (review S4);
|          * the DELETE carries the mark (and the B1 condition) again.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Finding', 'Recommendation')][string]$Table)
|    $k = $script:SIDataRetireRangeKeys[$Table]
|    $mark = "EXISTS (SELECT 1 FROM sidata.Collection AS m WHERE m.CollectionId = @c AND m.Kind = N'Detailed' AND m.RetiredAt IS NOT NULL AND (@mb IS NULL OR (m.RetiredAt < @mb AND m.RetiredWhy IN (N'superseded', N'abandoned', N'stopped run'))))"
|    $markQ = $mark.Replace("'", "''")
|    @"
|SET NOCOUNT ON;
|SET XACT_ABORT ON;
|DECLARE @c int = CONVERT(int, @CollectionId); DECLARE @lo bigint = CONVERT(bigint, @After); DECLARE @hi bigint = NULL; DECLARE @n bigint = 0;
|DECLARE @mb datetime2(0) = TRY_CONVERT(datetime2(0), NULLIF(@MarkedBefore, N''), 126);
|IF OBJECT_ID('sidata.$Table') IS NULL OR NOT $mark
|BEGIN SELECT CAST(0 AS bigint) AS N, CAST(NULL AS bigint) AS Hi, CAST(1 AS int) AS Refused, CAST(0 AS int) AS Cap; RETURN; END
|DECLARE @ix int = (SELECT COUNT(*) FROM sys.indexes WHERE object_id = OBJECT_ID('sidata.$Table') AND index_id > 0 AND is_hypothetical = 0 AND is_disabled = 0);
|DECLARE @cap int = 4000 / CASE WHEN @ix < 1 THEN 1 ELSE @ix END;
|IF @cap < 1 SET @cap = 1;
|DECLARE @take int = TRY_CONVERT(int, @Batch);
|IF @take IS NULL OR @take < 1 OR @take > @cap SET @take = @cap;
|IF @lo <= 0 SELECT @lo = ISNULL(MIN($k) - 1, 0) FROM sidata.$Table WHERE CollectionId = @c;
|BEGIN TRANSACTION;
|IF OBJECT_ID('sidata.PublishedRun') IS NOT NULL
|BEGIN
|    DECLARE @lk int;
|    EXEC @lk = sp_getapplock @Resource = N'sidata.PublishedRun', @LockMode = N'Shared', @LockOwner = N'Transaction', @LockTimeout = 10000;
|    IF @lk < 0 BEGIN ROLLBACK TRANSACTION; SELECT CAST(0 AS bigint) AS N, CAST(NULL AS bigint) AS Hi, CAST(1 AS int) AS Refused, @cap AS Cap; RETURN; END
|END
|SELECT @hi = MAX(x.$k) FROM (SELECT TOP (@take) $k FROM sidata.$Table WHERE CollectionId = @c AND $k > @lo ORDER BY $k) AS x;
|IF @hi IS NULL BEGIN COMMIT TRANSACTION; SELECT CAST(0 AS bigint) AS N, CAST(NULL AS bigint) AS Hi, CAST(0 AS int) AS Refused, @cap AS Cap; RETURN; END
|IF OBJECT_ID('sidata.PublishedRun') IS NOT NULL
|    EXEC sp_executesql N'DELETE FROM sidata.$Table WHERE CollectionId = @c AND $k > @lo AND $k <= @hi
|  AND $markQ
|  AND NOT EXISTS (SELECT 1 FROM sidata.PublishedRun AS p WHERE p.Name = N''current'' AND p.DetailedCollectionId = @c);
|SET @n = @@ROWCOUNT;', N'@c int, @lo bigint, @hi bigint, @mb datetime2(0), @n bigint OUTPUT', @c = @c, @lo = @lo, @hi = @hi, @mb = @mb, @n = @n OUTPUT;
|ELSE
|BEGIN
|    DELETE FROM sidata.$Table WHERE CollectionId = @c AND $k > @lo AND $k <= @hi AND $mark;
|    SET @n = @@ROWCOUNT;
|END
|COMMIT TRANSACTION;
|SELECT @n AS N, @hi AS Hi, CASE WHEN @n = 0 THEN 1 ELSE 0 END AS Refused, @cap AS Cap;
|"@
|}
|
|function Invoke-SIDataRetireRangeDelete {
|    <#
|        #892 Removes one marked Detailed collection's rows of -Table range by range (Get-SIDataRetireRangeSql) until nothing
|        is left, the database refuses, or -DeadlineUtc is reached (no new range after it -- checked after the pacing pause,
|        review M7; the next call goes on from what is left). -MarkedBeforeUtc (review B1): only a mark the data sync made
|        before it. Each range's size follows the last one's measured time (Get-SIDataNextSize, aim -TargetMs), never above the
|        database's own cap (below lock escalation), and the database's load paces them (Invoke-SISqlPacing -Housekeeping: the
|        removal waits until the database is calm -- below the LOW mark once it reached the HIGH one -- never past
|        -DeadlineUtc, and the first range of a wake-up always runs). A measurement, never a limit on the work.
|        -ShouldStop (the clean-up as housekeeping): asked before EVERY range; a non-empty answer (why) stops the removal there
|        (Stopped, StopWhy) -- the next wake-up goes on from the collection's first row left.
|        Returns @{ Rows; Done ($true = nothing left); Refused ($true = the database refused); Stopped; StopWhy }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][ValidateSet('Finding', 'Recommendation')][string]$Table,
|          [Parameter(Mandatory)][string]$CollectionId, [ref]$BatchSize, [long]$TargetMs = 5000, [datetime]$DeadlineUtc = [datetime]::MaxValue,
|          $MarkedBeforeUtc = $null, [scriptblock]$ShouldStop)
|    $sql = Get-SIDataRetireRangeSql -Table $Table
|    $mbText = if ($null -ne $MarkedBeforeUtc) { Format-SIDataSqlTime -Time ([datetime]$MarkedBeforeUtc).ToUniversalTime() } else { '' }
|    $size = [long]5000; if ($BatchSize -and $BatchSize.Value -gt 0) { $size = [long]$BatchSize.Value }
|    $paced = [bool](Get-Command -Name Invoke-SISqlPacing -ErrorAction SilentlyContinue); $lastMs = 0L
|    $after = '0'; $total = 0L; $done = $false; $refused = $false; $stopWhy = ''
|    $g = { param($r, [string]$n) $v = $null
|           if ($r -is [System.Collections.IDictionary]) { if ($r.Contains($n)) { $v = $r[$n] } }
|           elseif ($r -is [System.Data.DataRow]) { $v = $r[$n] }
|           elseif ($null -ne $r -and $r.PSObject.Properties[$n]) { $v = $r.$n }
|           if ($v -is [System.DBNull]) { $null } else { $v } }
|    while ($true) {
|        # housekeeping: waits until the database is calm (never past the deadline); the first range of a wake-up always runs
|        if ($paced) {
|            $pace = Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs -Housekeeping -DeadlineUtc $DeadlineUtc
|            if ($pace.Shrink) { $size = [Math]::Max(1L, [long][Math]::Floor($size / 2)) }
|            if ($pace.PSObject.Properties['Deadline'] -and $pace.Deadline) { break }
|        }
|        if ([datetime]::UtcNow -ge $DeadlineUtc) { break }
|        # housekeeping: no new range once a run, a data sync or a data out has started (asked right before the statement)
|        if ($ShouldStop) {
|            $w = ''; try { $w = [string](& $ShouldStop) } catch { $w = ('whether a job started could not be read ({0})' -f $_.Exception.Message) }
|            if ($w) { $stopWhy = $w; break }
|        }
|        $sw = [Diagnostics.Stopwatch]::StartNew()
|        $row = @(@(& $Invoke $sql @{ CollectionId = $CollectionId; After = $after; Batch = $size; MarkedBefore = $mbText } 'reader') | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) | Select-Object -First 1
|        $sw.Stop(); $lastMs = $sw.ElapsedMilliseconds
|        $nv = & $g $row 'N'; $hi = & $g $row 'Hi'; $rf = & $g $row 'Refused'; $cap = & $g $row 'Cap'
|        if ($null -ne $nv) { $total += [long]$nv }
|        if ($null -ne $rf -and [int]$rf -eq 1) { $refused = $true; break }
|        if ($null -eq $hi) { $done = $true; break }
|        $after = ([long]$hi).ToString([Globalization.CultureInfo]::InvariantCulture)
|        $size = Get-SIDataNextSize -Current $size -ElapsedMs $lastMs -TargetMs $TargetMs -Minimum 1
|        # the database's cap is the most a range takes: a larger asked size only shows up as the same cap
|        if ($null -ne $cap -and [long]$cap -gt 0 -and $size -gt [long]$cap) { $size = [long]$cap }
|    }
|    if ($BatchSize) { $BatchSize.Value = $size }
|    [pscustomobject]@{ Rows = $total; Done = $done; Refused = $refused; Stopped = [bool]$stopWhy; StopWhy = $stopWhy }
|}
|
|function Remove-SIDataCollectionRows {
|    <#
|        THE ONE REMOVAL of a MARKED collection's rows (#1038 part 3: every caller that removes collection rows goes through
|        here -- the housekeeping wake-up, and the retention step behind it). One plan item's grain and collection: its tables
|        in the retire order ($script:SIDataRetireTables -- the finding rows LAST, so a removal that stops part way still shows
|        as rows left), the two large tables in key ranges (Invoke-SIDataRetireRangeDelete), the others in batches below lock
|        escalation (Invoke-SIDataBatchedDelete -Housekeeping -LockBound), all paced by the database's load. Today a row delete;
|        the seam where a partition truncate takes its place (#1038 part 2) -- the callers do not change.
|          -State: what is carried from one collection to the next (the batch size, each large table's range size, each batched
|           table's lock bound); the caller keeps it. -DeadlineUtc: no new range / batch after it. -MarkedBeforeUtc: only a
|           mark made before it (review B1; '' = any mark). -ShouldStop: asked before EVERY range and batch -- a non-empty answer
|           (why) stops here; the collection stays marked with its rows left and the next wake-up goes on.
|        Every statement removes rows only of a MARKED collection, never the published run's (the statements refuse it).
|        Returns @{ Rows (per table: the rows removed); Done ($true = nothing left); Refused (the database refused);
|        Stopped (not done, not refused: the deadline or -ShouldStop); Paused (-ShouldStop stopped it); StopWhy }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][ValidateSet('Detailed', 'Summary')][string]$Grain,
|          [string]$CollectionId = '', [Parameter(Mandatory)][string]$CollectionTime, [hashtable]$State,
|          [long]$BatchSize = 5000, [datetime]$DeadlineUtc = [datetime]::MaxValue, $MarkedBeforeUtc = $null, [scriptblock]$ShouldStop)
|    if ($null -eq $State) { $State = @{} }
|    if (-not $State.ContainsKey('Batch')) { $State['Batch'] = [long][Math]::Max(1L, $BatchSize) }
|    if (-not $State.ContainsKey('Range')) { $State['Range'] = @{} }
|    if (-not $State.ContainsKey('Bound')) { $State['Bound'] = @{} }
|    $deadline = $DeadlineUtc; $lockBound = $State['Bound']; $markedBefore = $MarkedBeforeUtc
|    $prm = @{ CollectionId = $CollectionId; CollectionTime = $CollectionTime; RunKey = ('{0}|{1}' -f $Grain, $CollectionTime) }
|    $rows = [ordered]@{}; $done = $true; $refused = $false; $why = ''
|    foreach ($t in $script:SIDataRetireTables[$Grain]) {
|        if ([datetime]::UtcNow -ge $deadline) { $done = $false; break }
|        if (-not $rows.Contains($t)) { $rows[$t] = 0L }
|        if ($Grain -eq 'Detailed' -and $script:SIDataRetireRangeKeys.Contains($t) -and $CollectionId) {
|            # #892 the large tables in key ranges; a range cut short leaves the collection unfinished
|            $rb = if ($State['Range'].ContainsKey($t)) { [long]$State['Range'][$t] } else { [long][Math]::Max(1L, $BatchSize) }
|            $rr = Invoke-SIDataRetireRangeDelete -Invoke $Invoke -Table $t -CollectionId $CollectionId -BatchSize ([ref]$rb) -DeadlineUtc $deadline -MarkedBeforeUtc $markedBefore -ShouldStop $ShouldStop
|            $State['Range'][$t] = $rb
|            $rows[$t] += [long]$rr.Rows
|            # review M3: a range the database refused is never counted as removed
|            if ($rr.Refused) { $refused = $true; $done = $false; break }
|            if ($rr.PSObject.Properties['StopWhy'] -and $rr.StopWhy) { $why = [string]$rr.StopWhy; $done = $false; break }
|            if (-not $rr.Done) { $done = $false; break }
|            continue
|        }
|        $bp = $prm; $bsql = Get-SIDataRetireBatchSql -Grain $Grain -Table $t
|        if ($null -ne $markedBefore -and $Grain -eq 'Detailed') { $bsql = Get-SIDataRetireBatchSql -Grain $Grain -Table $t -DataSyncMarkedBefore; $bp = @{} + $prm; $bp['MarkedBefore'] = (Format-SIDataSqlTime -Time ([datetime]$markedBefore).ToUniversalTime()) }
|        # the batches stay below lock escalation (the key ranges' rule, worked out once per table) and wait for the
|        # database to be calm (housekeeping)
|        if (-not $lockBound.ContainsKey($t)) { $lockBound[$t] = Get-SIDataRetireBatchBound -Invoke $Invoke -Table $t }
|        $hkStop = [ref]$false; $hkWhy = [ref]''
|        $batch = [long]$State['Batch']
|        $n = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql $bsql -Params $bp -BatchSize ([ref]$batch) -DeadlineUtc $deadline -Housekeeping -LockBound ([long]$lockBound[$t]) -Stopped $hkStop -ShouldStop $ShouldStop -StopWhy $hkWhy
|        $State['Batch'] = $batch
|        $rows[$t] += [long]$n
|        # the wait reached the deadline, or a job started: this table may still hold rows -- the next tables (the finding rows
|        # last) wait for the next call, so a collection with rows left always shows as one (HasRows)
|        if ($hkWhy.Value) { $why = [string]$hkWhy.Value; $done = $false; break }
|        if ($hkStop.Value) { $done = $false; break }
|    }
|    [pscustomobject]@{ Rows = $rows; Done = $done; Refused = $refused; Stopped = (-not $done -and -not $refused); Paused = [bool]$why; StopWhy = $why }
|}
|
|function Format-SIDataRetentionText {
|    <# PURE. The one plain line: what was kept, what was removed and how many rows per table. -Result: Invoke-SIDataCollectionRetention's (before its Text). #>
|    param([Parameter(Mandatory)]$Result, [switch]$DryRun)
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $label = @{ Detailed = 'Risk Analysis'; Summary = 'Risk Analysis Summary' }
|    $kept = foreach ($gr in 'Detailed', 'Summary') {
|        $k = @(@($Result.Plan) | Where-Object { $_ -and $_.Grain -eq $gr -and $_.Action -eq 'Keep' -and $_.Status -eq 'Complete' } | Sort-Object CollectionTime -Descending)
|        if ($k.Count) { '{0} {1}' -f $label[$gr], ((@($k | ForEach-Object { [string]::Format($inv, '{0:yyyy-MM-dd HH:mm}', $_.CollectionTime) })) -join ' + ') }
|    }
|    $keptText = if (@($kept).Count) { 'kept ' + (@($kept) -join '; ') + ' (UTC)' } else { 'no complete collection yet' }
|    $acted = @(@($Result.Plan) | Where-Object { $_ -and $_.Action -in 'Retire', 'Finish' })
|    if ($DryRun) {
|        return ('{0}; would remove the rows of {1} older or abandoned collection(s) -- nothing is written in a dry run' -f $keptText, $acted.Count)
|    }
|    $done = @($Result.Removed)
|    $refusedText = ''
|    if (@($Result.Refused).Count) { $refusedText = (' {0} collection(s) were not removed: the database did not confirm newer complete collections.' -f @($Result.Refused).Count) }
|    # #816: a removal cut short by its time budget -- the collection is marked (never shown again) and the next call finishes it
|    $stopped = $Result.PSObject.Properties['Stopped'] -and $Result.Stopped
|    # #1038 part 3: a job started -- the removal gives way between two ranges
|    $paused = if ($Result.PSObject.Properties['Paused'] -and $Result.Paused) { [string]$Result.Paused } else { '' }
|    if ($paused) { $refusedText += [string]::Format($inv, ' Paused part way ({0:N0} finding row(s) removed so far): {1} -- the rest is removed when nothing runs.', [long]$Result.Rows['findings'], $paused) }
|    elseif ($stopped) { $refusedText += [string]::Format($inv, ' The time budget of this step ended part way ({0:N0} finding row(s) removed so far) -- the rest is removed next time.', [long]$Result.Rows['findings']) }
|    if (-not $done.Count) { return ('{0}; {1}{2}' -f $keptText, $(if ($stopped) { 'removal in progress.' } else { 'nothing older to remove.' }), $refusedText) }
|    $ab = @($done | Where-Object { $_.Why -in 'abandoned', 'stopped run' }).Count
|    $r = $Result.Rows
|    $text = [string]::Format($inv, '{0}; removed the rows of {1} collection(s) ({2} abandoned by a run that stopped, {3} older) -- findings {4:N0}, recommendations {5:N0}, prepared issue rows {6:N0}, staged rows {7:N0}, Summary rows {8:N0}, Summary assets {9:N0}. Their day totals stay for the trends.',
|        $keptText, $done.Count, $ab, ($done.Count - $ab), $r['findings'], $r['recommendations'], $r['issueRows'], ($r['stagedRows'] + $r['defenderKeys']), $r['summaryRows'], $r['summaryAssets'])
|    $text + $refusedText
|}
|
|function Invoke-SIDataCollectionRetention {
|    <#
|        THE STEP (see above): reads every collection, plans, marks and removes in batches; a dry run plans only. NEVER
|        throws -- a failure is Status 'failed' with its Error, and the next run tries again (a marked collection with rows
|        left is finished then). Returns @{ Status (ok | nothing | dry-run | failed); Plan; Removed (the plan items done);
|        Refused; Rows (per table); Text (the one log line); Error }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [switch]$DryRun, [scriptblock]$Log,
|          # the FIRST batch's size; every next one follows the last one's measured time (Invoke-SIDataBatchedDelete)
|          [long]$BatchSize = 5000,
|          # #746: a stopped run's collection older than this many days, with a newer run of its grain after it, is abandoned
|          [int]$StaleDays = 7, [datetime]$NowUtc = [datetime]::UtcNow,
|          # #816: given ONLY when no pipeline run is running -- a Detailed collection still loading after this many hours is a
|          # stopped run's (Get-SIDataCollectionRetentionPlan -IdleStaleHours); 0 = that rule off
|          [double]$IdleStaleHours = 0,
|          # #816: the step's own time budget (the pipeline runner's wake-up): no new batch after it; the next call finishes
|          # what was marked (Finish). 0 = no budget (the data sync)
|          [int]$TimeBudgetSeconds = 0,
|          # #834: MARK only -- the collections the plan retires are marked (RetiredAt: never derived, prepared or shown again,
|          # the views and their own index ranges skip them at once) and NO row is removed. The data sync marks right after its
|          # loads (so it never derives a collection it removes in the same run), and -- when the pipeline started it -- leaves
|          # the rows to the pipeline runner's wake-ups, which remove them while no run is running (Invoke-SIDataStoppedRunCleanup:
|          # 'Finish' for a marked collection with rows left), never on a database the sync itself has saturated.
|          [switch]$MarkOnly,
|          # with -MarkOnly: the plain words of who removes the rows (said in the line)
|          [string]$RowsRemovedBy = '',
|          # #882: the owner floor (Get-SIDataLoadingOwnerFloor) in place of -IdleStaleHours, with its plain reason; and
|          # -OnlyWhy: act only on the plan's items of these kinds (e.g. 'stopped run' while a pipeline run is going)
|          $IdleBeforeUtc = $null, [string]$IdleReason = '', [string[]]$OnlyWhy = @(),
|          # #892 -FinishOnly: ONLY the collections that are marked already and still hold rows are removed (Finish); nothing
|          # is newly marked, nothing else in the plan is acted on. The pipeline runner's wake-up while a run is going.
|          # -FinishFloorUtc (required with -FinishOnly: the owner floor, Get-SIDataLoadingOwnerFloor): a marked collection
|          # that is NOT complete and started at or after it is left alone -- a live run may own it. Never the published one
|          # (the plan keeps it, and every range statement refuses it).
|          # -FinishMarkedBeforeUtc (required with -FinishOnly, review B1: the start of the running pipeline run): ONLY marks the data
|          # sync made (RetiredWhy superseded / abandoned) and the 'stopped run' marks (#882) made BEFORE it -- nothing in this run
|          # can be writing those. A 'stopped run' mark made while THIS run goes can hit a collection the data sync is still
|          # loading: its rows wait for the next run or a wake-up with no run going. The database checks the same on every
|          # statement. FAIL SAFE: none given = nothing removed;
|          # no time budget = nothing removed (review M5).
|          [switch]$FinishOnly, $FinishFloorUtc = $null, $FinishMarkedBeforeUtc = $null,
|          # #1038 part 3 -ShouldStop: asked before EVERY range and batch of the removal (Remove-SIDataCollectionRows); a
|          # non-empty answer (why: a pipeline run, a data sync or a data out started) stops the removal there -- Stopped, and
|          # Paused carries the why. The collection stays marked with its rows left; the next wake-up goes on.
|          [scriptblock]$ShouldStop)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Host ('[{0}] {1}' -f $level, $msg) } }
|    $staleText = if ($StaleDays -gt 0) { Format-SIDataSqlTime -Time ($NowUtc.ToUniversalTime().AddDays(-$StaleDays)) } else { '' }
|    $idleText = if ($null -ne $IdleBeforeUtc) { Format-SIDataSqlTime -Time (([datetime]$IdleBeforeUtc).ToUniversalTime()) } elseif ($IdleStaleHours -gt 0) { Format-SIDataSqlTime -Time ($NowUtc.ToUniversalTime().AddHours(-$IdleStaleHours)) } else { '' }
|    $deadline = if ($TimeBudgetSeconds -gt 0) { [datetime]::UtcNow.AddSeconds($TimeBudgetSeconds) } else { [datetime]::MaxValue }
|    $out = [ordered]@{ Status = 'ok'; Plan = @(); Removed = @(); Refused = @(); Stopped = $false; Paused = ''; Text = ''; Error = ''
|                       Rows = [ordered]@{ findings = 0L; recommendations = 0L; issueRows = 0L; stagedRows = 0L; defenderKeys = 0L; summaryRows = 0L; summaryAssets = 0L } }
|    $key = @{ Finding = 'findings'; Recommendation = 'recommendations'; IssueContext = 'issueRows'; RaStage = 'stagedRows'; RaDefenderKey = 'defenderKeys'; SummaryRow = 'summaryRows'; SummaryAsset = 'summaryAssets' }
|    try {
|        # the pacing of the batched deletes says its line through this step's log
|        if (Get-Command -Name Get-SISqlPacer -ErrorAction SilentlyContinue) { $null = Get-SISqlPacer -Invoke $Invoke -Log $Log }
|        $state = @(@(& $Invoke (Get-SIDataRetentionStateSql) @{} 'reader') | ForEach-Object { $_ } | Where-Object { $null -ne $_ })
|        if (-not $state.Count) {
|            $out.Status = 'nothing'
|            $out.Text = 'no collection is stored yet (or the database does not have the retention mark yet -- the updater adds it) -- nothing removed'
|            & $Log 'INFO' ('collections : ' + $out.Text)
|            return [pscustomobject]$out
|        }
|        $links = @(@(& $Invoke (Get-SIDataRetentionCarrySql) @{} 'reader') | ForEach-Object { $_ } | Where-Object { $null -ne $_ })
|        # the plan answers as ONE array (', $out.ToArray()'): assigned first, then enumerated -- @(...) around the call would
|        # make it a list holding that array as its one item
|        $planRaw = Get-SIDataCollectionRetentionPlan -Collections $state -CarryLinks $links -NowUtc $NowUtc -StaleDays $StaleDays -IdleStaleHours $IdleStaleHours -IdleBeforeUtc $IdleBeforeUtc -IdleReason $IdleReason
|        $plan = @(foreach ($x in @($planRaw)) { if ($null -ne $x) { $x } })
|        # #882: only the kinds asked for are acted on (the rest of the plan is kept as it is, and said as kept)
|        if (@($OnlyWhy).Count) { $plan = @(foreach ($x in $plan) { if ($x.Action -in 'Retire', 'Finish' -and @($OnlyWhy) -notcontains [string]$x.Why) { $x.Action = 'Keep'; $x.Reason = 'left to the data sync and to a wake-up with no run running' }; $x }) }
|        # #892: only what is marked already; FAIL SAFE -- no floor, no run start or no budget = nothing is removed
|        $markedBefore = $null
|        if ($FinishOnly) {
|            $floor = if ($null -ne $FinishFloorUtc) { ([datetime]$FinishFloorUtc).ToUniversalTime() } else { $null }
|            $markedBefore = if ($null -ne $FinishMarkedBeforeUtc) { ([datetime]$FinishMarkedBeforeUtc).ToUniversalTime() } else { $null }
|            $plan = @(foreach ($x in $plan) {
|                if ($x.Action -eq 'Retire') { $x.Action = 'Keep'; $x.Reason = 'not marked by this step -- only collections marked already are removed while a run is going' }
|                elseif ($x.Action -eq 'Finish' -and $TimeBudgetSeconds -le 0) { $x.Action = 'Keep'; $x.Reason = 'no time budget was given -- nothing is removed while a run is going' }
|                elseif ($x.Action -eq 'Finish' -and $null -eq $floor) { $x.Action = 'Keep'; $x.Reason = 'which collection the live run owns is not known -- nothing is removed' }
|                elseif ($x.Action -eq 'Finish' -and $null -eq $markedBefore) { $x.Action = 'Keep'; $x.Reason = 'when the running pipeline run started is not known -- nothing is removed' }
|                # 2026-10-23 (installs at 45-61 % of the database maximum, 4-7 'Loading' collections no live run owns, some with
|                # 1.4-1.8 M rows: a run is nearly always going there, so a wake-up with no run going never came): a 'stopped run'
|                # mark (#882) made BEFORE the running pipeline run started goes the same way as the data sync's marks -- the
|                # run that could have been loading it is over, and a marked collection is never derived or shown again. A mark
|                # made during this run still waits (the rule below), and the owner floor still applies.
|                elseif ($x.Action -eq 'Finish' -and [string]$x.RetiredWhy -notin 'superseded', 'abandoned', 'stopped run') { $x.Action = 'Keep'; $x.Reason = 'marked for another reason -- its rows are removed by a wake-up with no run going' }
|                elseif ($x.Action -eq 'Finish' -and ($null -eq $x.RetiredAt -or $x.RetiredAt -ge $markedBefore)) { $x.Action = 'Keep'; $x.Reason = 'marked after the running pipeline run started -- its rows are removed once that run is over' }
|                elseif ($x.Action -eq 'Finish' -and $x.Status -ne 'Complete' -and $x.CollectionTime -ge $floor) { $x.Action = 'Keep'; $x.Reason = 'still loading and started after the Risk Analysis going now -- a live run may own it' }
|                $x })
|        }
|        $out.Plan = $plan
|        if ($DryRun) {
|            $out.Status = 'dry-run'
|            $out.Text = Format-SIDataRetentionText -Result ([pscustomobject]$out) -DryRun
|            & $Log 'INFO' ('collections : ' + $out.Text)
|            return [pscustomobject]$out
|        }
|        # what the removal carries from one collection to the next: the batch size, each large table's range size (#892,
|        # each starts at -BatchSize) and each batched table's lock-escalation bound (Get-SIDataRetireBatchBound)
|        $rmState = @{ Batch = [long][Math]::Max(1L, $BatchSize); Range = @{}; Bound = @{} }
|        $marked = New-Object System.Collections.Generic.List[object]
|        foreach ($p in @($plan | Where-Object { $_.Action -in 'Retire', 'Finish' } | Sort-Object CollectionTime)) {
|            # #834 -MarkOnly: a collection marked already (Finish) is left as it is; a new one is only marked
|            if ($MarkOnly -and $p.Action -ne 'Retire') { $marked.Add($p); continue }
|            if ([datetime]::UtcNow -ge $deadline) { $out.Stopped = $true; break }
|            $tText = Format-SIDataSqlTime -Time $p.CollectionTime
|            $prm = @{ CollectionId = $(if ($null -ne $p.CollectionId) { [string]$p.CollectionId } else { '' }); CollectionTime = $tText; RunKey = ('{0}|{1}' -f $p.Grain, $tText) }
|            if ($p.Action -eq 'Retire') {
|                # #816: the idle rule's collection is accepted by the database only through its own guarded case
|                $isIdle = ($p.Why -eq 'stopped run' -and $p.Grain -eq 'Detailed' -and $idleText)
|                $mp = @{ CollectionId = $prm.CollectionId; CollectionTime = $tText; Why = [string]$p.Why; StaleBefore = $staleText }
|                if ($isIdle) { $mp['IdleBefore'] = $idleText }
|                $m = [int](& $Invoke (Get-SIDataRetireMarkSql -Grain $p.Grain -Idle:([bool]$isIdle)) $mp 'scalar')
|                if ($m -ne 1) { $out.Refused += $p; continue }
|                if ($MarkOnly) { $marked.Add($p); continue }
|            }
|            # #1038 part 3: THE ONE REMOVAL (Remove-SIDataCollectionRows) -- the seam a partition truncate takes over (part 2)
|            $rm = Remove-SIDataCollectionRows -Invoke $Invoke -Grain $p.Grain -CollectionId $prm.CollectionId -CollectionTime $tText -State $rmState -BatchSize $BatchSize -DeadlineUtc $deadline -MarkedBeforeUtc $markedBefore -ShouldStop $ShouldStop
|            foreach ($t in @($rm.Rows.Keys)) { $out.Rows[$key[$t]] += [long]$rm.Rows[$t] }
|            # review M3: the database refused this collection's rows (not marked as asked, or the published run) -- said as refused,
|            # never as removed; the next collection is looked at
|            if ($rm.Refused) { $out.Refused += $p; continue }
|            # a run, a data sync or a data out started: the removal stops between two ranges; the collection stays marked with
|            # its rows left and the next wake-up with nothing running goes on (Finish)
|            if ($rm.Paused) { $out.Stopped = $true; $out.Paused = [string]$rm.StopWhy; break }
|            # a removal its time budget cut short is marked (RetiredAt) and finished by the next call (Finish) -- never shown again
|            if (-not $rm.Done -or [datetime]::UtcNow -ge $deadline) { $out.Stopped = $true; break }
|            $out.Removed += $p
|        }
|        $out['Marked'] = $marked.ToArray()
|        if ($MarkOnly) {
|            $inv = [Globalization.CultureInfo]::InvariantCulture
|            $by = if ($RowsRemovedBy) { $RowsRemovedBy } else { 'by the end of this data sync' }
|            $newly = @($marked | Where-Object { $_.Action -eq 'Retire' }).Count
|            $out.Text = if ($marked.Count -eq 0) { 'nothing older to remove' }
|                        else { [string]::Format($inv, '{0} older or abandoned collection(s) are marked removed{1} -- never shown again; their rows are removed {2}', $marked.Count, $(if ($newly -lt $marked.Count) { [string]::Format($inv, ' ({0} newly)', $newly) } else { '' }), $by) }
|            if (@($out.Refused).Count) { $out.Text += [string]::Format($inv, '; {0} collection(s) were not marked: the database did not confirm newer complete collections', @($out.Refused).Count) }
|            & $Log 'INFO' ('collections : ' + $out.Text)
|            return [pscustomobject]$out
|        }
|        $out.Text = Format-SIDataRetentionText -Result ([pscustomobject]$out)
|        & $Log $(if (@($out.Removed).Count) { 'OK' } else { 'INFO' }) ('collections : ' + $out.Text)
|    } catch {
|        $out.Status = 'failed'; $out.Error = $_.Exception.Message
|        $out.Text = ('the older collections were not removed this run ({0}) -- nothing current is affected; the next run tries again' -f $_.Exception.Message)
|        & $Log 'WARN' ('collections : ' + $out.Text)
|    }
|    [pscustomobject]$out
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  STOPPED RUNS (#816, owner 2026-10-20: "put #816 cleanup in the next release too"). A run that failed or was cancelled
|#  leaves its Detailed collection 'Loading' with its rows (at a large install ~1 M per attempt; 80 % of one install's
|#  sidata.Finding). The collections' retention above removes them, but only at the END of a SUCCESSFUL data sync -- which
|#  an install whose runs keep failing never reaches. So the pipeline runner calls this on its wake-up, ONLY while no
|#  pipeline run is running: the same plan, marks and batched deletes (Invoke-SIDataCollectionRetention), plus the idle rule
|#  (a collection still loading after -IdleStaleHours with no run running is a stopped run's), inside a time budget. The
|#  published run's collection, a complete one the views read and a result waiting for the data sync are never touched.
|#  Afterwards it records how many collections are still loading and their rows (cfg.InstallState 'StoppedRuns').
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SIDataRunByPipelineSql {
|    <# The settings database: how many of this job's steps run in a running pipeline run (0 = not started by the pipeline). #>
|    "IF OBJECT_ID(N'cfg.FlowStepRun') IS NULL OR OBJECT_ID(N'cfg.FlowRun') IS NULL SELECT CAST(0 AS int) ELSE SELECT COUNT(*) FROM cfg.FlowStepRun AS s JOIN cfg.FlowRun AS r ON r.FlowRunId = s.FlowRunId WHERE s.Job = @Job AND s.State IN (N'Starting', N'Running') AND r.State = N'Running';"
|}
|
|function Test-SIDataRunByPipeline {
|    <#
|        #834 Did the pipeline start this data sync? Then the pipeline runner's wake-ups remove the rows of the collections it
|        marks, once the run has ended (Invoke-SIDataStoppedRunCleanup). Not shown -- no seam, no record, a database that
|        cannot be read -- is $false. #1037: either way the data sync only marks (its data out never waits on a removal);
|        the answer now only words its log line. Never throws.
|    #>
|    param([scriptblock]$Invoke, [string]$Job = 'asset-datasync')
|    if (-not $Invoke) { return $false }
|    try { return ([int](& $Invoke (Get-SIDataRunByPipelineSql) @{ Job = $Job } 'scalar') -gt 0) } catch { return $false }
|}
|
|function Get-SIDataLoadingStateSql {
|    <# The Detailed collections still 'Loading' (not retired) and -- -WithRows -- their finding rows (counted on the clustered
|       key per collection; else Rows = -1, not counted): one row (N, Rows). 0 / 0 on a database without the tables or the mark. #>
|    param([switch]$WithRows)
|    $rows = if ($WithRows) { '(SELECT COUNT_BIG(*) FROM sidata.Finding AS f WHERE f.CollectionId = c.CollectionId)' } else { 'CAST(0 AS bigint)' }
|    $sum = if ($WithRows) { 'ISNULL(SUM(x.R), 0)' } else { 'CAST(-1 AS bigint)' }
|    @"
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.Collection') IS NULL OR OBJECT_ID('sidata.Finding') IS NULL OR COL_LENGTH('sidata.Collection', 'RetiredAt') IS NULL
|BEGIN SELECT CAST(0 AS int) AS N, CAST(0 AS bigint) AS [Rows]; RETURN; END
|SELECT COUNT(*) AS N, $sum AS [Rows]
|FROM (SELECT c.CollectionId, $rows AS R
|      FROM sidata.Collection AS c WHERE c.Kind = N'Detailed' AND c.Status <> N'Complete' AND c.RetiredAt IS NULL) AS x;
|"@
|}
|
|function Get-SIDataStoppedRunsRecordSql {
|    <# The ONE statement that records the state in cfg.InstallState 'StoppedRuns' (settings database; the engine role holds
|       SELECT / INSERT / UPDATE there). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('cfg.InstallState') IS NOT NULL
|BEGIN
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N'StoppedRuns')
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'StoppedRuns';
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'StoppedRuns', @Value, NULL, @By);
|END
|'@
|}
|
|function Get-SIDataStoppedRunsValue {
|    <# PURE. The recorded value: compact JSON under 400 characters -- { loading, loadingRows, removed, removedRows, stopped, at }. #>
|    param([int]$Loading = 0, [long]$LoadingRows = 0, [int]$Removed = 0, [long]$RemovedRows = 0, [bool]$Stopped = $false, [datetime]$AtUtc = [datetime]::UtcNow)
|    ([ordered]@{ loading = $Loading; loadingRows = $LoadingRows; removed = $Removed; removedRows = $RemovedRows; stopped = $Stopped
|                 at = $AtUtc.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) } | ConvertTo-Json -Compress)
|}
|
|function Get-SIDataRaStepOwnerSql {
|    <# #882 The settings database: the Risk Analysis Detailed steps of RUNNING pipeline runs that are still open -- how many
|       (Open) and when the oldest started (Since; NULL when none, or when an open one has no start recorded: Unknown = 1). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.FlowStepRun') IS NULL OR OBJECT_ID(N'cfg.FlowRun') IS NULL
|BEGIN SELECT CAST(-1 AS int) AS [Open], CAST(NULL AS datetime2(3)) AS Since, CAST(1 AS int) AS Unknown; RETURN; END
|SELECT COUNT(*) AS [Open], MIN(s.StartedUtc) AS Since, CASE WHEN SUM(CASE WHEN s.StartedUtc IS NULL THEN 1 ELSE 0 END) > 0 THEN 1 ELSE 0 END AS Unknown
|FROM cfg.FlowStepRun AS s JOIN cfg.FlowRun AS r ON r.FlowRunId = s.FlowRunId
|WHERE s.Job = @Job AND s.State IN (N'Starting', N'Running') AND r.State = N'Running';
|'@
|}
|
|function Get-SIDataLoadingOwnerFloor {
|    <#
|        PURE. #882 -- WHICH 'Loading' COLLECTION DOES A LIVE RUN STILL OWN? (largest tenant 2026-10-21: collections 20, 21, 23
|        and 24 stayed 'Loading' after broken runs; at that install a pipeline run is nearly always going, so #816's cleanup --
|        which waits for NO run to be running -- never reached them.) The Risk Analysis Detailed producer begins its collection
|        when it starts, so the only collection a live run can still be writing is one that started at or after the oldest
|        Risk Analysis work that is going now: an open Detailed step of a running pipeline run (-OpenSteps / -StepSince /
|        -StepUnknown) or a running execution of its job (-ProbeKnown / -ProbeSince: the job's executions, also one started by
|        hand). Returns @{ Before; Why }: Before = that start minus 5 minutes (the clocks' slack) -- or, when nothing of Risk
|        Analysis is going at all, -NowUtc minus 5 minutes; every not-complete collection that started BEFORE it, not pending,
|        not published, belongs to no live run. Before = $null (Why says why) when it cannot be shown: an open step without a
|        start, or no open step and the executions could not be read. FAIL SAFE: unknown = nothing is touched.
|    #>
|    param([int]$OpenSteps = 0, $StepSince = $null, [bool]$StepUnknown = $false, [bool]$ProbeKnown = $false, $ProbeSince = $null,
|          [datetime]$NowUtc = [datetime]::UtcNow)
|    $o = { param($b, $w) [pscustomobject]@{ Before = $b; Why = [string]$w } }
|    if ($OpenSteps -lt 0) { return (& $o $null 'the run records could not be read') }
|    if ($OpenSteps -gt 0 -and ($StepUnknown -or $null -eq $StepSince)) { return (& $o $null 'an open Risk Analysis step has no start recorded') }
|    # the job's executions are always needed: a step can FOLLOW an execution that started before it (a job that was
|    # already running), whose collection then started before the step did
|    if (-not $ProbeKnown) { return (& $o $null 'whether Risk Analysis runs right now could not be read') }
|    $c = New-Object System.Collections.Generic.List[datetime]
|    if ($OpenSteps -gt 0) { $c.Add(([datetime]$StepSince).ToUniversalTime()) }
|    if ($null -ne $ProbeSince) { $c.Add(([datetime]$ProbeSince).ToUniversalTime()) }
|    if (-not $c.Count) { return (& $o $NowUtc.ToUniversalTime().AddMinutes(-5) 'no Risk Analysis runs now') }
|    $min = ($c | Sort-Object | Select-Object -First 1)
|    & $o $min.AddMinutes(-5) ([string]::Format([Globalization.CultureInfo]::InvariantCulture, 'the Risk Analysis going now started {0:yyyy-MM-dd HH:mm} UTC', $min))
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE CLEAN-UP AS HOUSEKEEPING (#1038 part 3, owner 2026-11-01: "servicenow is most critical" / "cleanup is low prio").
|#  No job removes collection rows in its own path any more: a sync only MARKS. ONE path removes the marked rows -- the
|#  pipeline runner's wake-up (Invoke-SIDataStoppedRunCleanup) -- and only while NOTHING that reads or loads the data is
|#  going: no pipeline run (cfg.FlowRun), no open step (cfg.FlowStepRun), no run holding the install's lock
|#  (cfg.PipelineLock), no data sync and no data out started on its own (the jobs' running executions). The same state the
|#  updater's run gate reads. Asked again before EVERY range: the moment one of them starts the removal stops between two
|#  ranges and the next wake-up goes on. What is left (collections, rows) is recorded in cfg.InstallState 'Housekeeping'.
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SIDataHousekeepingOpenWorkSql {
|    <# The settings database, ONE number: the steps still Starting / Running (of any run -- the run gate's rule) plus a
|       pipeline run holding the install's lock (cfg.PipelineLock with a run and a heartbeat under 15 minutes old). 0 = no
|       pipeline work is going. -1 = the run records are not there. #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.FlowStepRun') IS NULL BEGIN SELECT CAST(-1 AS int); RETURN; END
|DECLARE @n int = (SELECT COUNT(*) FROM cfg.FlowStepRun WHERE State IN (N'Starting', N'Running'));
|IF OBJECT_ID(N'cfg.PipelineLock') IS NOT NULL
|    SET @n += (SELECT COUNT(*) FROM cfg.PipelineLock WHERE LockId = N'install' AND FlowRunId IS NOT NULL AND Holder IS NOT NULL
|                  AND HeartbeatUtc >= DATEADD(minute, -15, SYSUTCDATETIME()));
|SELECT @n;
|'@
|}
|
|function Get-SIDataHousekeepingBusy {
|    <#
|        Is anything going that the clean-up must give way to? -SettingsInvoke: the settings database (run records).
|        -JobRunning { param($Job) } -> @{ Execution; StartedUtc } or $null (the job's running execution; a 404 = the job is not
|        installed = not running); -Jobs: the job keys asked (asset-datasync, data-out). Returns @{ Busy; Known; Run (a pipeline
|        run is going); Why }. NEVER throws. FAIL SAFE: anything that cannot be read = Known $false, Busy $true -- nothing is
|        removed. No -JobRunning (a host that cannot list executions): the jobs are not asked, said in Why.
|    #>
|    param([scriptblock]$SettingsInvoke, [scriptblock]$JobRunning, [string[]]$Jobs = @())
|    $o = { param([bool]$busy, [bool]$known, [bool]$run, [string]$why) [pscustomobject]@{ Busy = $busy; Known = $known; Run = $run; Why = $why } }
|    if (-not $SettingsInvoke) { return (& $o $true $false $false 'the run records cannot be read here') }
|    $runs = $null
|    try { $runs = [int](& $SettingsInvoke "IF OBJECT_ID('cfg.FlowRun') IS NULL SELECT CAST(-1 AS int) ELSE SELECT COUNT(*) FROM cfg.FlowRun WHERE State = N'Running'" @{} 'scalar') } catch { $runs = $null }
|    if ($null -eq $runs -or $runs -lt 0) { return (& $o $true $false $false 'the run records could not be read') }
|    if ($runs -gt 0) { return (& $o $true $true $true 'a pipeline run is running') }
|    $open = $null
|    try { $open = [int](& $SettingsInvoke (Get-SIDataHousekeepingOpenWorkSql) @{} 'scalar') } catch { $open = $null }
|    if ($null -eq $open -or $open -lt 0) { return (& $o $true $false $false 'the run records could not be read') }
|    if ($open -gt 0) { return (& $o $true $true $true 'a pipeline step is still running') }
|    $notAsked = ''
|    if (-not $JobRunning) { if (@($Jobs).Count) { $notAsked = ' (the jobs'' executions cannot be read on this host -- not asked)' } }
|    else {
|        foreach ($j in @($Jobs | Where-Object { $_ })) {
|            $x = $null
|            try { $x = & $JobRunning $j }
|            catch {
|                if ("$($_.Exception.Message)" -match '404|ResourceNotFound|not found') { continue }
|                return (& $o $true $false $false ('whether caj-si-{0} runs could not be read ({1})' -f $j, $_.Exception.Message))
|            }
|            if ($x) {
|                $what = switch ($j) { 'asset-datasync' { 'a data sync' } 'data-out' { 'a data out' } default { 'caj-si-' + $j } }
|                $ex = if ($x.PSObject.Properties['Execution'] -and $x.Execution) { ' ({0})' -f $x.Execution } else { '' }
|                return (& $o $true $true $false ('{0} is running{1}' -f $what, $ex))
|            }
|        }
|    }
|    & $o $false $true $false ('no pipeline run, data sync or data out is going' + $notAsked)
|}
|
|function Get-SIDataHousekeepingLeftSql {
|    <#
|        The DATA database, ONE row: what the clean-up still has to remove -- Collections (marked collections of both grains
|        with rows left) and Rows (NULL = the database has no retention mark yet). Index reads only, never a COUNT over
|        sidata.Finding: per marked Detailed collection the first and the last FindingId (the key span, never too low; the
|        removal goes from the lowest key up), per marked Summary load its loaded Rows while a row is left (an upper bound).
|    #>
|    @'
|SET NOCOUNT ON;
|DECLARE @c int = 0, @sc int = 0, @d bigint = NULL, @s bigint = NULL;
|IF OBJECT_ID(N'sidata.Collection') IS NOT NULL AND OBJECT_ID(N'sidata.Finding') IS NOT NULL AND COL_LENGTH(N'sidata.Collection', N'RetiredAt') IS NOT NULL
|    EXEC sp_executesql N'SELECT @c = COUNT(*), @d = ISNULL(SUM(x.F), 0)
|FROM sidata.Collection AS c
|CROSS APPLY (SELECT (SELECT TOP (1) f.FindingId FROM sidata.Finding AS f WHERE f.CollectionId = c.CollectionId ORDER BY f.FindingId DESC) - (SELECT TOP (1) f.FindingId FROM sidata.Finding AS f WHERE f.CollectionId = c.CollectionId ORDER BY f.FindingId ASC) + 1 AS F) AS x
|WHERE c.Kind = N''Detailed'' AND c.RetiredAt IS NOT NULL AND x.F IS NOT NULL;', N'@c int OUTPUT, @d bigint OUTPUT', @c = @c OUTPUT, @d = @d OUTPUT;
|IF OBJECT_ID(N'sidata.SummaryLoad') IS NOT NULL AND OBJECT_ID(N'sidata.SummaryRow') IS NOT NULL AND COL_LENGTH(N'sidata.SummaryLoad', N'RetiredAt') IS NOT NULL
|    EXEC sp_executesql N'SELECT @sc = COUNT(*), @s = ISNULL(SUM(CASE WHEN l.[Rows] > 0 THEN CAST(l.[Rows] AS bigint) ELSE CAST(1 AS bigint) END), 0)
|FROM sidata.SummaryLoad AS l
|WHERE l.RetiredAt IS NOT NULL AND EXISTS (SELECT 1 FROM sidata.SummaryRow AS r WHERE r.CollectionTime = l.CollectionTime);', N'@sc int OUTPUT, @s bigint OUTPUT', @sc = @sc OUTPUT, @s = @s OUTPUT;
|SELECT @c + @sc AS Collections, CASE WHEN @d IS NULL AND @s IS NULL THEN CAST(NULL AS bigint) ELSE ISNULL(@d, 0) + ISNULL(@s, 0) END AS [Rows];
|'@
|}
|
|function Get-SIDataHousekeepingRecordSql {
|    <# The ONE statement that records the clean-up's progress in cfg.InstallState 'Housekeeping' (settings database). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('cfg.InstallState') IS NOT NULL
|BEGIN
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N'Housekeeping')
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'Housekeeping';
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'Housekeeping', @Value, NULL, @By);
|END
|'@
|}
|
|function Get-SIDataHousekeepingValue {
|    <#
|        PURE. The recorded progress: compact JSON under 400 characters -- { state (removing | paused | done | failed),
|        collectionsLeft, rowsLeft (null = not known), removedRows (this wake-up), lastRemovedAt (the last wake-up that removed
|        rows; kept from the record before), why (at most 160 characters), at }.
|    #>
|    param([ValidateSet('removing', 'paused', 'done', 'failed')][string]$State = 'done', $CollectionsLeft = $null, $RowsLeft = $null, [long]$RemovedRows = 0,
|          $LastRemovedAtUtc = $null, [string]$Why = '', [datetime]$AtUtc = [datetime]::UtcNow)
|    $iso = { param($t) if ($null -eq $t) { $null } else { ([datetime]$t).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) } }
|    $w = if ($Why.Length -gt 160) { $Why.Substring(0, 157) + '...' } else { $Why }
|    ([ordered]@{ state = $State; collectionsLeft = $(if ($null -ne $CollectionsLeft) { [int]$CollectionsLeft } else { $null }); rowsLeft = $(if ($null -ne $RowsLeft) { [long]$RowsLeft } else { $null })
|                 removedRows = $RemovedRows; lastRemovedAt = (& $iso $LastRemovedAtUtc); why = $w; at = (& $iso $AtUtc) } | ConvertTo-Json -Compress)
|}
|
|function Read-SIDataHousekeepingRecord {
|    <# The record before (cfg.InstallState 'Housekeeping') as an object, or $null. Never throws. #>
|    param([scriptblock]$SettingsInvoke)
|    if (-not $SettingsInvoke) { return $null }
|    try {
|        $v = & $SettingsInvoke "IF OBJECT_ID('cfg.InstallState') IS NULL SELECT CAST(NULL AS nvarchar(400)) ELSE SELECT Value FROM cfg.InstallState WHERE Name = N'Housekeeping'" @{} 'scalar'
|        $v = @(@($v) | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) | Select-Object -First 1
|        if ($v -is [System.Collections.IDictionary]) { $v = $v['Value'] }
|        if ($v -isnot [string] -or -not $v.Trim().StartsWith('{')) { return $null }
|        return ($v | ConvertFrom-Json)
|    } catch { return $null }
|}
|
|function Write-SIDataHousekeepingProgress {
|    <#
|        Records (cfg.InstallState 'Housekeeping') and says the clean-up's progress. -Left: Get-SIDataHousekeepingLeftSql's
|        row ($null = not read now: the record before keeps its counts -- a paused wake-up never reads the data database).
|        Says one line through -Log when rows were removed, and on the first wake-up of each hour while rows wait. Never
|        throws. Returns the value recorded.
|    #>
|    param([scriptblock]$SettingsInvoke, [string]$State, $Left = $null, [long]$RemovedRows = 0, [string]$Why = '', [scriptblock]$Log,
|          [datetime]$NowUtc = [datetime]::UtcNow, [string]$By = 'caj-si-flow')
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $prev = Read-SIDataHousekeepingRecord -SettingsInvoke $SettingsInvoke
|    $pv = { param($n) if ($prev -and $prev.PSObject.Properties[$n]) { $prev.$n } else { $null } }
|    $cl = & $pv 'collectionsLeft'; $rl = & $pv 'rowsLeft'
|    if ($null -ne $Left) {
|        $g = { param($n) $x = if ($Left -is [System.Collections.IDictionary]) { $Left[$n] } elseif ($Left.PSObject.Properties[$n]) { $Left.$n } else { $null }; if ($x -is [System.DBNull]) { $null } else { $x } }
|        $cl = & $g 'Collections'; $rl = & $g 'Rows'
|    }
|    $last = & $pv 'lastRemovedAt'
|    if ($RemovedRows -gt 0) { $last = $NowUtc }
|    elseif ($last -is [datetime]) { $last = ([datetime]$last).ToUniversalTime() }
|    elseif ($last) { try { $last = [datetime]::Parse([string]$last, $inv, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal) } catch { $last = $null } }
|    # nothing left at all = done, whatever the wake-up did
|    if ($State -ne 'failed' -and $null -ne $cl -and [int]$cl -eq 0) { $State = 'done' }
|    # rows left after a wake-up that ended without a stop (a refused collection): still being removed
|    if ($State -eq 'done' -and $null -ne $cl -and [int]$cl -gt 0) { $State = 'removing' }
|    $v = Get-SIDataHousekeepingValue -State $State -CollectionsLeft $cl -RowsLeft $rl -RemovedRows $RemovedRows -LastRemovedAtUtc $last -Why $Why -AtUtc $NowUtc
|    if ($SettingsInvoke) { try { $null = & $SettingsInvoke (Get-SIDataHousekeepingRecordSql) @{ Value = $v; By = $By } 'nonquery' } catch { if ($Log) { & $Log 'INFO' ('housekeeping: its progress could not be recorded ({0})' -f $_.Exception.Message) } } }
|    if ($Log -and ($RemovedRows -gt 0 -or ($NowUtc.ToUniversalTime().Minute -lt 5 -and $null -ne $cl -and [int]$cl -gt 0))) {
|        $leftText = if ($null -ne $cl) { [string]::Format($inv, '{0} collection(s){1} left', [int]$cl, $(if ($null -ne $rl) { [string]::Format($inv, ', about {0:N0} row(s)', [long]$rl) } else { '' })) } else { 'what is left is not known yet' }
|        $stateText = switch ($State) { 'paused' { 'paused -- ' + $Why } 'removing' { 'removing' } 'done' { 'done' } default { 'not finished -- ' + $Why } }
|        & $Log 'OK' ([string]::Format($inv, 'housekeeping: old collections {0}; {1:N0} row(s) removed by this wake-up; {2}', $stateText, $RemovedRows, $leftText))
|    }
|    $v
|}
|
|function Get-SIDataHousekeepingLeaseSql {
|    <#
|        #1063 (3.0.30): ONE CLEAN-UP AT A TIME. Since the wake-ups during a run (FlowBusy) clean up too, two executions of the
|        pipeline runner can reach the clean-up at once (a wake-up during a run, and a Run now or the next run's own start).
|        The lease is one row in the settings database, cfg.InstallState 'HousekeepingLease' (Value = the holder, UpdatedAt =
|        when it was taken; '' = free). Take: -> 'taken' (free, ours already, or the other holder's lease ran out: older than
|        @LeaseSeconds -- an execution that died never holds it for ever) or 'held:<holder> since <time>'; 'none' = the table
|        is not there (an install before cfg.InstallState: no lease, as before). Release: frees it only when it is ours.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Take', 'Release')][string]$Action)
|    if ($Action -eq 'Release') {
|        return @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL
|    UPDATE cfg.InstallState SET Value = N'', UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'HousekeepingLease' AND Value = @Holder;
|'@
|    }
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.InstallState') IS NULL BEGIN SELECT N'none'; RETURN; END
|BEGIN TRANSACTION;
|DECLARE @h nvarchar(400) = NULL, @at datetime2(0) = NULL;
|SELECT @h = Value, @at = UpdatedAt FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N'HousekeepingLease';
|IF @h IS NULL
|    INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'HousekeepingLease', @Holder, NULL, @By);
|ELSE IF @h = N'' OR @h = @Holder OR @at < DATEADD(second, -@LeaseSeconds, SYSUTCDATETIME())
|    UPDATE cfg.InstallState SET Value = @Holder, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'HousekeepingLease';
|ELSE
|BEGIN
|    COMMIT TRANSACTION;
|    SELECT CONCAT(N'held:', @h, N' since ', CONVERT(nvarchar(20), @at, 126), N'Z');
|    RETURN;
|END
|COMMIT TRANSACTION;
|SELECT N'taken';
|'@
|}
|
|function Enter-SIDataHousekeepingLease {
|    <#
|        #1063 (3.0.30): takes the clean-up's lease (Get-SIDataHousekeepingLeaseSql). @{ Taken; Why }. NEVER throws. FAIL SAFE:
|        a lease that cannot be read or written = not taken (nothing is removed by this wake-up; the next one asks again).
|    #>
|    param([scriptblock]$SettingsInvoke, [Parameter(Mandatory)][string]$Holder, [int]$LeaseSeconds = 1020, [string]$By = 'caj-si-flow')
|    if (-not $SettingsInvoke) { return [pscustomobject]@{ Taken = $false; Why = 'the run records cannot be read here' } }
|    $v = $null
|    try { $v = & $SettingsInvoke (Get-SIDataHousekeepingLeaseSql -Action Take) @{ Holder = $Holder; LeaseSeconds = [int]$LeaseSeconds; By = $By } 'scalar' }
|    catch { return [pscustomobject]@{ Taken = $false; Why = ('whether another clean-up is going could not be read ({0})' -f $_.Exception.Message) } }
|    $v = @(@($v) | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) | Select-Object -First 1
|    if ($v -is [System.Collections.IDictionary]) { $v = @($v.Values)[0] }
|    if ($v -is [string] -and $v.StartsWith('held:')) { return [pscustomobject]@{ Taken = $false; Why = ('another wake-up is removing old collections ({0})' -f $v.Substring(5)) } }
|    [pscustomobject]@{ Taken = $true; Why = '' }
|}
|
|function Exit-SIDataHousekeepingLease {
|    <# #1063 (3.0.30): frees the clean-up's lease when it is ours. Never throws (a lease left behind runs out on its own). #>
|    param([scriptblock]$SettingsInvoke, [Parameter(Mandatory)][string]$Holder, [string]$By = 'caj-si-flow')
|    if (-not $SettingsInvoke) { return }
|    try { $null = & $SettingsInvoke (Get-SIDataHousekeepingLeaseSql -Action Release) @{ Holder = $Holder; By = $By } 'nonquery' } catch { }
|}
|
|function Invoke-SIDataStoppedRunCleanup {
|    <#
|        THE PIPELINE RUNNER'S CALL (#816). -Invoke: the data database (sql, params, mode 'reader' | 'nonquery' | 'scalar');
|        -SettingsInvoke: the settings database (cfg.FlowRun, cfg.InstallState), same seam. Does nothing -- not one statement on
|        the data database -- while a pipeline run is running, or when that cannot be read. NEVER throws. Returns
|        @{ Status (ok | skipped | failed); Why; Retention (Invoke-SIDataCollectionRetention's result); Loading; LoadingRows }.
|        #882 -RaRunning { } -> @{ Execution; StartedUtc } or $null (the Risk Analysis Detailed job's running execution; a throw
|        = cannot be read): WHILE a pipeline run is running, a Detailed collection still 'Loading' that NO live run owns
|        (Get-SIDataLoadingOwnerFloor) is MARKED retired at once -- never derived, prepared or shown again -- and its rows are
|        removed by a later wake-up with no run running (Finish). Only those ('stopped run'); never a complete collection,
|        never the published one, never a result waiting for the data sync, never the collection the live run writes -- the
|        plan AND the database's mark refuses them. Without the seam a running run means nothing is touched, as before.
|        #1038 part 3 -- THE ONE HOUSEKEEPING PATH. With nothing going (Get-SIDataHousekeepingBusy: no pipeline run, no open
|        step, no run holding the install's lock, no data sync and no data out -- -JobRunning / -Jobs, the jobs' running
|        executions, also one started by hand) every marked collection is removed; that is asked again before EVERY range and
|        batch, and the moment one starts the removal stops between two ranges. #1063 (owner 2026-11-03: "Both"): WHILE a
|        pipeline run goes (with -RaRunning), the #882 marks are made AND the rows of collections marked BEFORE the run began
|        are removed (#892's -FinishOnly guards), paced by the database's load, giving way to a data out. It never removes the newest complete collection
|        or the one before it (#717 -- the plan and the database's mark), never the published one. Progress -- collections and
|        rows left, paused and why -- is recorded in cfg.InstallState 'Housekeeping' (Write-SIDataHousekeepingProgress); the
|        hourly heartbeat sends the rows left (Pipeline.housekeepingRowsLeft). Never blocks or fails anything else.
|        #1063 (3.0.30): reached by EVERY wake-up of the runner, also one during a run (the container entry's FlowBusy path,
|        SI_FLOW_HOUSEKEEPING_ONLY) -- ONE clean-up at a time: the lease (Enter-SIDataHousekeepingLease, -Holder = this
|        execution, held at most -TimeBudgetSeconds + 15 min); a wake-up that finds it held does nothing (Status skipped,
|        LeaseHeld) and records nothing -- the holder records the progress.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [scriptblock]$SettingsInvoke, [double]$IdleStaleHours = 24,
|          [int]$TimeBudgetSeconds = 120, [scriptblock]$Log, [datetime]$NowUtc = [datetime]::UtcNow, [string]$By = 'caj-si-flow',
|          [scriptblock]$RaRunning, [string]$RaJob = 'risk-analysis-detailed',
|          [scriptblock]$JobRunning, [string[]]$Jobs = @('asset-datasync', 'data-out'),
|          [string]$Holder = $(if ($env:CONTAINER_APP_JOB_EXECUTION_NAME) { [string]$env:CONTAINER_APP_JOB_EXECUTION_NAME } else { '{0}:{1}' -f [Environment]::MachineName, $PID }))
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Host ('[{0}] {1}' -f $level, $msg) } }
|    $out = [ordered]@{ Status = 'skipped'; Why = ''; Retention = $null; Loading = $null; LoadingRows = $null; Housekeeping = ''; LeaseHeld = $false }
|    $hkStarted = [datetime]::UtcNow
|    $leaseTaken = $false
|    try {
|        if (-not $SettingsInvoke) { $out.Why = 'the run records cannot be read here -- nothing is removed'; return [pscustomobject]$out }
|        # #1063 (3.0.30): one clean-up at a time -- the lease first; held by another wake-up = this one does nothing
|        $lease = Enter-SIDataHousekeepingLease -SettingsInvoke $SettingsInvoke -Holder $Holder -LeaseSeconds ([Math]::Max(0, $TimeBudgetSeconds) + 900) -By $By
|        if (-not $lease.Taken) { $out.LeaseHeld = $true; $out.Why = ('{0} -- this wake-up removes nothing' -f $lease.Why); return [pscustomobject]$out }
|        $leaseTaken = $true
|        $busy = Get-SIDataHousekeepingBusy -SettingsInvoke $SettingsInvoke -JobRunning $JobRunning -Jobs $Jobs
|        $out['Busy'] = $busy
|        if (-not $busy.Known) {
|            $out.Why = ('{0} -- nothing removed' -f $busy.Why)
|            $out.Housekeeping = Write-SIDataHousekeepingProgress -SettingsInvoke $SettingsInvoke -State 'paused' -Why $busy.Why -Log $Log -NowUtc $NowUtc -By $By
|            return [pscustomobject]$out
|        }
|        $running = if ($busy.Run) { 1 } else { 0 }
|        if ($running -gt 0 -and $RaRunning -and $IdleStaleHours -gt 0) {
|            # #882: a run is going -- only the 'Loading' collections no live run owns are marked (no row is removed now)
|            $own = $null
|            try {
|                $os = @(@(& $SettingsInvoke (Get-SIDataRaStepOwnerSql) @{ Job = $RaJob } 'reader') | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) | Select-Object -First 1
|                $gv = { param($n) if ($null -eq $os) { $null } elseif ($os -is [System.Collections.IDictionary]) { $os[$n] } else { $os.$n } }
|                $open = if ($null -eq $os) { -1 } else { [int](& $gv 'Open') }
|                $sinceV = & $gv 'Since'; if ($sinceV -is [System.DBNull]) { $sinceV = $null }
|                $unk = [int](& $gv 'Unknown') -eq 1
|                $pk = $false; $ps = $null
|                try { $px = & $RaRunning; $pk = $true; if ($px -and $px.StartedUtc) { $ps = ([datetime]$px.StartedUtc).ToUniversalTime() } elseif ($px) { $pk = $false } } catch { $pk = $false }
|                $own = Get-SIDataLoadingOwnerFloor -OpenSteps $open -StepSince $sinceV -StepUnknown $unk -ProbeKnown $pk -ProbeSince $ps -NowUtc $NowUtc
|            } catch { $own = [pscustomobject]@{ Before = $null; Why = $_.Exception.Message } }
|            if ($null -eq $own -or $null -eq $own.Before) {
|                $out.Why = 'a pipeline run is running and which collection it owns could not be shown ({0}) -- nothing is touched' -f $(if ($own) { $own.Why } else { 'no answer' })
|                $out.Housekeeping = Write-SIDataHousekeepingProgress -SettingsInvoke $SettingsInvoke -State 'paused' -Why $busy.Why -Log $Log -NowUtc $NowUtc -By $By
|                return [pscustomobject]$out
|            }
|            $why = [string]::Format([Globalization.CultureInfo]::InvariantCulture, 'its run stopped before it was complete: no live run owns it ({0}; it started before that)', $own.Why)
|            $ret = Invoke-SIDataCollectionRetention -Invoke $Invoke -Log $Log -NowUtc $NowUtc -IdleBeforeUtc $own.Before -IdleReason $why -OnlyWhy @('stopped run') -MarkOnly `
|                       -RowsRemovedBy 'by a later wake-up of the pipeline runner when no run, data sync or data out is going, in key ranges' -TimeBudgetSeconds $TimeBudgetSeconds
|            $out.Retention = $ret
|            # #1063 (owner 2026-11-03: "Both" -- clean retired rows during runs, throttled when the database is busy, now; the
|            # per-collection partitions next): at an install whose runs go back to back (the large ring 1 install: 7.9 M retired
|            # rows, the findings table at 217 GB) a wake-up with nothing going never comes. So, while a run goes, the rows of
|            # collections that were marked BEFORE this run started are removed (#892's -FinishOnly, its guards unchanged: the
|            # owner floor, marks made before the run start, the database's own check on every statement, never the published
|            # one), in key ranges, paced by the database's load (the housekeeping rule: it WAITS while the load is high), inside
|            # what is left of this wake-up's time budget. It gives way to a data out (the ServiceNow send) the moment one runs:
|            # asked before every range and batch. The next wake-up goes on.
|            $runStart = $null
|            try {
|                $rs = & $SettingsInvoke "IF OBJECT_ID('cfg.FlowRun') IS NULL SELECT CAST(NULL AS datetime2(0)) ELSE SELECT MIN(StartedUtc) FROM cfg.FlowRun WHERE State = N'Running'" @{} 'scalar'
|                if ($rs -is [datetime]) { $runStart = [datetime]::SpecifyKind([datetime]$rs, [DateTimeKind]::Utc) }
|            } catch { $runStart = $null }
|            $left = if ($TimeBudgetSeconds -gt 0) { [int][Math]::Floor($TimeBudgetSeconds - ([datetime]::UtcNow - $hkStarted).TotalSeconds) } else { 0 }
|            $fin = $null
|            if ($left -gt 0 -and $null -ne $runStart) {
|                $hkJobRunning = $JobRunning
|                $doStop = {
|                    if (-not $hkJobRunning) { return '' }
|                    $x = $null
|                    try { $x = & $hkJobRunning 'data-out' }
|                    catch { if ("$($_.Exception.Message)" -match '404|ResourceNotFound|not found') { return '' }; return ('whether the data out runs could not be read ({0})' -f $_.Exception.Message) }
|                    if ($x) { 'a data out is running' } else { '' }
|                }
|                $fin = Invoke-SIDataCollectionRetention -Invoke $Invoke -Log $Log -NowUtc $NowUtc -FinishOnly -FinishFloorUtc $own.Before -FinishMarkedBeforeUtc $runStart -TimeBudgetSeconds $left -ShouldStop $doStop
|            }
|            $out['Finished'] = $fin
|            $out.Status = if ($ret.Status -eq 'failed' -or ($fin -and $fin.Status -eq 'failed')) { 'failed' } else { 'ok' }
|            $finRows = 0L; if ($fin -and $fin.Rows) { foreach ($k in @($fin.Rows.Keys)) { $finRows += [long]$fin.Rows[$k] } }
|            $hkLeft = $null
|            if ($finRows -gt 0 -or $NowUtc.ToUniversalTime().Minute -lt 5) {
|                try { $hkLeft = @(@(& $Invoke (Get-SIDataHousekeepingLeftSql) @{} 'reader') | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) | Select-Object -First 1 } catch { $hkLeft = $null }
|            }
|            if ($null -eq $fin) {
|                $out.Why = 'a pipeline run is running -- collections no live run owns were marked; ' + $(if ($null -eq $runStart) { 'when the run started could not be read, so no row is removed this time' } else { 'no time is left in this wake-up for removing rows' })
|                $out.Housekeeping = Write-SIDataHousekeepingProgress -SettingsInvoke $SettingsInvoke -State 'paused' -Left $hkLeft -Why $busy.Why -Log $Log -NowUtc $NowUtc -By $By
|            } else {
|                $fState = if ($fin.Status -eq 'failed') { 'failed' } elseif ($fin.Paused) { 'paused' } else { 'removing' }
|                $fWhy = if ($fState -eq 'failed') { [string]$fin.Error } elseif ($fState -eq 'paused') { [string]$fin.Paused } else { 'a pipeline run is going: the rows of collections marked before it began are removed, paced by the database''s load' }
|                $out.Why = 'a pipeline run is running -- collections no live run owns were marked; the rows of collections marked before this run began are removed in key ranges, paced by the database''s load, inside this wake-up''s time budget'
|                $out.Housekeeping = Write-SIDataHousekeepingProgress -SettingsInvoke $SettingsInvoke -State $fState -Left $hkLeft -RemovedRows $finRows -Why $fWhy -Log $Log -NowUtc $NowUtc -By $By
|            }
|            return [pscustomobject]$out
|        }
|        if ($busy.Busy) {
|            $out.Why = ('housekeeping paused: {0} -- the old collections'' rows are removed when nothing is going' -f $busy.Why)
|            $out.Housekeeping = Write-SIDataHousekeepingProgress -SettingsInvoke $SettingsInvoke -State 'paused' -Why $busy.Why -Log $Log -NowUtc $NowUtc -By $By
|            return [pscustomobject]$out
|        }
|        # nothing is going: plan, mark and remove -- asked again before EVERY range and batch whether something started
|        # (no GetNewClosure: a closure's own module scope cannot see functions dot-sourced into a script; the names are this
|        # function's own, so the ranges' callers never shadow them)
|        $hkSettings = $SettingsInvoke; $hkJobRunning = $JobRunning; $hkJobs = @($Jobs)
|        $stop = { $hkB = Get-SIDataHousekeepingBusy -SettingsInvoke $hkSettings -JobRunning $hkJobRunning -Jobs $hkJobs; if ($hkB.Busy) { [string]$hkB.Why } else { '' } }
|        $ret = Invoke-SIDataCollectionRetention -Invoke $Invoke -Log $Log -NowUtc $NowUtc -IdleStaleHours $IdleStaleHours -TimeBudgetSeconds $TimeBudgetSeconds -ShouldStop $stop
|        $out.Retention = $ret
|        $out.Status = if ($ret.Status -eq 'failed') { 'failed' } else { 'ok' }
|        $removed = @($ret.Removed).Count; $removedRows = if ($ret.Rows) { [long]$ret.Rows['findings'] } else { 0L }
|        # the progress: what is left (index reads only), paused / removing / done, recorded and said
|        $hkLeft = $null
|        try { $hkLeft = @(@(& $Invoke (Get-SIDataHousekeepingLeftSql) @{} 'reader') | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) | Select-Object -First 1 } catch { $hkLeft = $null }
|        $allRows = 0L; if ($ret.Rows) { foreach ($k in @($ret.Rows.Keys)) { $allRows += [long]$ret.Rows[$k] } }
|        $hkState = if ($ret.Status -eq 'failed') { 'failed' } elseif ($ret.PSObject.Properties['Paused'] -and $ret.Paused) { 'paused' } elseif ($ret.Stopped) { 'removing' } else { 'done' }
|        $hkWhy = if ($hkState -eq 'failed') { [string]$ret.Error } elseif ($hkState -eq 'paused') { [string]$ret.Paused } elseif ($hkState -eq 'removing') { 'this wake-up''s time budget ended -- the next one goes on' } else { '' }
|        $out.Housekeeping = Write-SIDataHousekeepingProgress -SettingsInvoke $SettingsInvoke -State $hkState -Left $hkLeft -RemovedRows $allRows -Why $hkWhy -Log $Log -NowUtc $NowUtc -By $By
|        # the rows of what is still loading are counted on the first wake-up of each hour, or when something was removed --
|        # never every five minutes on a database that may be at its limit
|        $withRows = ($NowUtc.ToUniversalTime().Minute -lt 5 -or $removed -gt 0 -or $removedRows -gt 0)
|        $st = $null
|        if ($withRows) { $st = @(@(& $Invoke (Get-SIDataLoadingStateSql -WithRows) @{} 'reader') | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) | Select-Object -First 1 }
|        if ($st) {
|            $g = { param($n) if ($st -is [System.Collections.IDictionary]) { $st[$n] } else { $st.$n } }
|            $out.Loading = [int](& $g 'N'); $out.LoadingRows = [long](& $g 'Rows')
|            $v = Get-SIDataStoppedRunsValue -Loading $out.Loading -LoadingRows $out.LoadingRows -Removed $removed -RemovedRows $removedRows -Stopped ([bool]$ret.Stopped) -AtUtc $NowUtc
|            try { $null = & $SettingsInvoke (Get-SIDataStoppedRunsRecordSql) @{ Value = $v; By = $By } 'nonquery' } catch { & $Log 'INFO' ('collections : the state of stopped runs could not be recorded ({0})' -f $_.Exception.Message) }
|            if ($out.Loading -gt 0) { & $Log 'INFO' ([string]::Format([Globalization.CultureInfo]::InvariantCulture, 'collections : {0} Risk Analysis collection(s) still loading ({1:N0} finding rows) -- removed once they are older than {2:0.#} h with no run running, or a newer run is complete', $out.Loading, $out.LoadingRows, $IdleStaleHours)) }
|        }
|    } catch {
|        $out.Status = 'failed'; $out.Why = $_.Exception.Message
|        & $Log 'WARN' ('collections : stopped runs were not removed this time ({0}) -- nothing current is affected; the next wake-up tries again' -f $_.Exception.Message)
|    } finally {
|        if ($leaseTaken) { Exit-SIDataHousekeepingLease -SettingsInvoke $SettingsInvoke -Holder $Holder -By $By }
|    }
|    [pscustomobject]$out
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  HOW FULL THE DATABASE IS (#717 (3)): the space its data uses against its maximum size, read with data rights only (the
|#  same reading as the heartbeat's sqlUsedMb / sqlMaxMb). Above -WarnPercent (70) the run says so in plain words.
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SIDataFillSql {
|    # ONE value, 'used|max' in MB -- read as a scalar
|    "SET NOCOUNT ON; SELECT CONCAT((SELECT SUM(CAST(FILEPROPERTY(name, 'SpaceUsed') AS bigint)) * 8 / 1024 FROM sys.database_files WHERE type_desc = 'ROWS'), '|', CAST(DATABASEPROPERTYEX(DB_NAME(), 'MaxSizeInBytes') AS bigint) / 1048576);"
|}
|
|function Get-SIDataFillVerdict {
|    <#
|        PURE. 'used|max' (MB) -> @{ UsedMb; MaxMb; Percent; Warn; Text }. Percent is $null when either is unknown (a database
|        without a maximum, an unreadable value) -- never guessed. Warn = Percent above -WarnPercent.
|    #>
|    param($Value, [int]$WarnPercent = 70)
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $o = [ordered]@{ UsedMb = $null; MaxMb = $null; Percent = $null; Warn = $false; Text = '' }
|    if ($null -ne $Value -and $Value -isnot [System.DBNull]) {
|        $p = ([string]$Value).Split('|'); $n = [long]0
|        if ($p.Count -ge 1 -and [long]::TryParse($p[0].Trim(), [Globalization.NumberStyles]::Integer, $inv, [ref]$n) -and $n -ge 0) { $o.UsedMb = $n }
|        if ($p.Count -ge 2 -and [long]::TryParse($p[1].Trim(), [Globalization.NumberStyles]::Integer, $inv, [ref]$n) -and $n -gt 0) { $o.MaxMb = $n }
|    }
|    if ($null -ne $o.UsedMb -and $null -ne $o.MaxMb) {
|        $o.Percent = [Math]::Round(100.0 * $o.UsedMb / $o.MaxMb, 1)
|        $o.Warn = $o.Percent -gt $WarnPercent
|        $o.Text = if ($o.Warn) {
|            [string]::Format($inv, 'the Pro database is {0:0.#} % full ({1:0.#} of {2:0.#} GB). SecurityInsight removes old collections by itself; if it keeps filling up, raise the database''s maximum size -- when it is full, nothing new can be stored.', $o.Percent, ($o.UsedMb / 1024.0), ($o.MaxMb / 1024.0))
|        } else {
|            [string]::Format($inv, 'the Pro database is {0:0.#} % full ({1:0.#} of {2:0.#} GB)', $o.Percent, ($o.UsedMb / 1024.0), ($o.MaxMb / 1024.0))
|        }
|    }
|    [pscustomobject]$o
|}
|
|function Get-SIDataFill {
|    <# How full the database is (Get-SIDataFillVerdict), said once in the log. Never throws: unreadable = Percent $null, said plainly. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [int]$WarnPercent = 70, [scriptblock]$Log)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Host ('[{0}] {1}' -f $level, $msg) } }
|    $v = $null
|    try { $v = & $Invoke (Get-SIDataFillSql) @{} 'scalar' } catch { & $Log 'INFO' ('database    : how full the database is could not be read ({0})' -f $_.Exception.Message) }
|    $f = Get-SIDataFillVerdict -Value $v -WarnPercent $WarnPercent
|    if ($f.Warn) { & $Log 'WARN' ('database    : ' + $f.Text) }
|    elseif ($null -ne $f.Percent) { & $Log 'INFO' ('database    : ' + $f.Text) }
|    $f
|}
'@ }
$__siSupportFiles['config/guard-catalog.locked.json'] = @{ Sha256 = 'd6e05ac9ecda989186738bfedfd3ab2b3056848fa8eb2ee4c1c75c706ac4bfac'; Text = @'
|{
|  "_": "THE CLOSED LIST of SecurityInsight's guards (#277): SWITCHES (#414): every guard can be turned off (SI_Guard_<Token>_Enabled, its mail SI_Guard_<Token>_Mail, all at once SI_Guards_Enabled; Settings > Guards) -- 'whenOff' says, in plain words, what turning it off means. RELEASING (framework GUARD-1.6, #404): only the kinds release-held-set and release-collection can be released -- by a SuperAdmin, with a reason, once (one run, or until a time of at most 24 hours), bound to the held plan's hash; every other guard carries 'neverReleasable': the reason, in plain words, it can never be released (the data is wrong, nothing is held, it would write where the customer did not allow it, or it protects integrity). every place where SecurityInsight holds, refuses or halts a step to protect data. Read by BOTH writers of a guard event: PowerShell (engine/_shared/SI-Guard.ps1, Send-SIGuardEvent) and the Pro web app (SI.Management.Web Guards/GuardEvents.cs, linked into the build). A test compares the two readers and checks every Send-SIGuardEvent call names a guard listed here. An id is stable and dotted (area.object.what): adding one = one entry here; renaming one breaks the history of the old id -- add, never rename. 'protects' and 'action' are the words a customer reads in the mail: plain language, no internal numbers. THE THREE PARTS a person reads on the Guards page, in the mail and (without detail) in the report to Invardia: 'what' (what happened, one sentence), 'why' (the cause of THIS event), 'consequence' (what the user sees or misses; 'nothing is lost' where it holds) and 'steps' (what to do, short). Placeholders, filled from the event: {held} (what was held), {v:<value name>} (a measured value), {detail}, {subject}, {when}, {latest} (the web app only: the newest collection it shows); {name|text} uses text when the value is empty; a [ ... ] part is left out when a placeholder in it is empty. 'what', 'consequence' and 'steps' never use {detail} or {subject} (they travel to Invardia). 'kind' says what a release means for the guard: release-held-set (an Admin releases the held set once), release-collection (an Admin loads a held collection once, marked partial), fix-source (cannot be released: fix the cause), next-run (resolved by the next successful run), rerun (re-run the job), setting (change a setting or the licence), review (check the result), info (nothing to do). Every event can be acknowledged. THE FOUR TEXTS of the Guards page (operator 2026-10-09: nobody understood the guards): 'name' (a short plain name), 'what' (what happened), 'why' (why it held: what it protects you from, then the run's own words), 'ifRelease' (what a release does -- or, for a guard that cannot be released, why not and what to do instead) and 'consequence' (if you leave it), plus 'steps'. 'limits' names the settings that tune a guard (edited on the Guards page under Control) and 'limitsInfo' says what changing them means. 'mail': 'never' = the check never sends a mail, whatever its outcome: its event is recorded and shown only on Operations > Guards (safety checks) (a check that accepts the change by itself asks nothing of anyone).",
|  "outcomes": [ "halted", "refused", "held", "skipped", "warning" ],
|  "severity": { "halted": "critical", "refused": "critical", "held": "warning", "skipped": "warning", "warning": "warning" },
|  "guards": [
|    {"id":"vuln.connector.close-ceiling","name":"Vulnerability close limit","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"open vulnerability records","action":"SecurityInsight would have closed far more vulnerability records in one run than it allows, so it closed none. Check that the newest Risk Analysis run was complete and that its vulnerability findings look right. If the large drop is real (for example a big patch round), run the vulnerability connector once with a higher close limit (SI_VulnSync_MaxClosePercent; the absolute limit SI_VulnSync_MaxCloseAbsolute is off by default), then set the limit back -- or turn the check off in Settings > Guards.","kind":"release-held-set","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- the vulnerability connector closes every record the run would close, however many; nothing is held for release.","what":"SecurityInsight held {held|many} vulnerability close(s): the vulnerability connector would have closed more records in one run than it may close at once.","why":"This check stops a broken or incomplete collection from closing many open vulnerabilities in your target by mistake. A big patch round looks the same, so SecurityInsight closes none and lets a person decide. {detail|The newest results no longer report far more of the open findings than usual.}","ifRelease":"The held closes go through once: the records are closed in the target with the next run of the connector -- only those that are still absent then, and only after the results are checked as complete. The release is for this held set only and ends by itself.","consequence":"Nothing is lost: the records stay open in the target exactly as they were. The held closes are kept for 7 days; after that they expire and the next complete run decides again.","steps":["Check that the newest Risk Analysis run finished completely (Operations > Jobs > Run health).","If the drop is real (for example a patch round), a SuperAdmin releases the held closes once with Release in \"Held now\" at the top of the Guards page.","If your patch rounds often close this many, raise the close limit under Control on the Guards page.","If it is not real, do nothing: the held closes expire after 7 days."],"limits":["SI_VulnSync_MaxClosePercent","SI_VulnSync_MaxCloseAbsolute"],"limitsInfo":"A higher limit lets more records close in one run without being held: a big patch round goes through by itself, but a broken collection can also close more records before the check stops it."},
|    {"id":"vuln.connector.empty-snapshot","name":"Vulnerabilities: empty result","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"open vulnerability records","action":"The newest Risk Analysis results held no vulnerabilities while records are still open, so nothing was closed. Check that the Risk Analysis Detailed run finished and found vulnerabilities; the next complete run is reconciled as normal.","kind":"next-run","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- an EMPTY result closes the open records it no longer reports, so a failed collection can close every open vulnerability.","what":"The vulnerability connector closed nothing, because the newest Risk Analysis results held no vulnerabilities at all.","why":"This check stops a failed collection from closing every open vulnerability in your target. An empty result almost always means the collection failed, not that everything is fixed. {detail|Records are open in the target, but the newest results report none.}","ifRelease":"This check cannot be released: a release would close every open vulnerability from a result that holds none. The data is wrong, not the limit.","consequence":"Nothing is lost: the open records stay open, and the next complete run is handled as normal.","steps":["Check that the newest Risk Analysis run finished and found vulnerabilities (Operations > Jobs > Run health).","Nothing else is needed: the next complete run is handled as normal."],"neverReleasable":"releasing it would close every open vulnerability from a snapshot that holds none -- the data is wrong, not the limit"},
|    {"id":"vuln.connector.collapse","name":"Vulnerabilities: result far smaller than usual","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"open vulnerability records","action":"Far fewer of the open vulnerability records are still reported than usual, which looks like a partial collection rather than a real fix, so nothing was closed. Check the newest Risk Analysis Detailed run and the endpoint data it read; the next complete run is reconciled as normal.","kind":"next-run","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- a result that lost most of its findings closes the records it no longer reports.","what":"The vulnerability connector closed nothing, because far fewer of the open records are still reported than usual.","why":"This check stops a partial collection from closing most of your open vulnerabilities. When most findings disappear at once, the collection is usually broken. {detail|The newest results look like a partial collection, not a real fix.}","ifRelease":"This check cannot be released: a release would close most open vulnerabilities from a result that lost most of its findings.","consequence":"Nothing is lost: the open records stay open, and the next complete run is handled as normal.","steps":["Check the newest Risk Analysis run and the device data it read (Operations > Jobs > Run health).","Nothing else is needed: the next complete run is handled as normal."],"neverReleasable":"releasing it would close most open vulnerabilities from a snapshot that lost most of its findings -- a broken run is never a reason to close","limits":["SI_VulnSync_CollapseFloor"],"limitsInfo":"The limit is the share of the open records that must still be reported. A lower share lets runs that report fewer findings close records; a higher share stops more runs. 0 turns the check off."},
|    {"id":"vuln.connector.scope-changed","name":"Vulnerabilities: scope changed","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"open vulnerability records","action":"The scope of the collection changed, so records that dropped out of it were not closed. If the narrower scope is intended, close or retire those records in the target yourself.","kind":"review","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- records that dropped out of the collection scope are closed like any other absent record.","what":"Vulnerability records that dropped out of the collection's scope were not closed.","why":"This check stops records from being closed only because their assets are no longer collected: a record outside the scope is not fixed, so closing it would report it as fixed. {detail|The scope of the collection changed since the previous run.}","ifRelease":"This check cannot be released: closing what left the scope would report it as fixed. Review the scope instead.","consequence":"Nothing is lost: those records stay open in the target, and SecurityInsight no longer updates them.","steps":["Check whether the narrower scope is what you want.","If it is, close or retire those records in the target yourself.","If it is not, put the scope back in the settings: the next run picks them up again."],"neverReleasable":"the set of assets the connector covers changed; closing what left the scope would read as fixed -- review the scope instead"},
|    {"id":"vuln.connector.run-incomplete","name":"Vulnerabilities: Risk Analysis run not finished","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"open vulnerability records","action":"The Risk Analysis run behind these results did not finish cleanly, so nothing was closed. Check the Risk Analysis Detailed run; the next complete run is reconciled as normal.","kind":"next-run","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- records are closed even when the Risk Analysis run behind the results did not finish cleanly.","what":"The vulnerability connector closed nothing, because the Risk Analysis run behind its results did not finish cleanly.","why":"This check stops records from being closed on the strength of a run that did not finish: missing results would look like fixed vulnerabilities. {detail|The Risk Analysis run ended with errors or only partly.}","ifRelease":"This check cannot be released: nothing is ever closed from a run that did not finish.","consequence":"Nothing is lost: the open records stay open until a complete run arrives.","steps":["Check the Risk Analysis run (Operations > Jobs > Run health).","Nothing else is needed: the next complete run is handled as normal."],"neverReleasable":"the Risk Analysis run behind the snapshot did not finish; nothing may be closed from an incomplete run"},
|    {"id":"vuln.connector.snapshot-incomplete","name":"Vulnerabilities: results not known to be complete","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"open vulnerability records","action":"The newest Risk Analysis results are not known to be complete, so findings were opened and updated but nothing was closed. Check that the Risk Analysis Detailed run finishes without errors.","kind":"next-run","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- absences are counted and records closed even when the newest results are not known to be complete.","what":"Vulnerability records were opened and updated, but none was closed.","why":"This check stops records from being closed while the newest results are not known to be complete: a missing finding would look like a fixed one. {detail|The newest Risk Analysis results are not known to be complete.}","ifRelease":"This check cannot be released: nothing is ever closed from results that are not known to be complete.","consequence":"Nothing is lost: records that would have closed stay open until a complete run confirms they are fixed.","steps":["Check that the Risk Analysis run finishes without errors (Operations > Jobs > Run health).","Nothing else is needed: the next complete run closes what is really fixed."],"neverReleasable":"the snapshot is incomplete; nothing may be closed from an incomplete snapshot"},
|    {"id":"vuln.connector.target-incomplete","name":"Vulnerabilities: target not read in full","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"your vulnerability target from duplicate records","action":"The vulnerability target (for example the ServiceNow table) could not be read in full, so nothing was written: every record the read missed would have been opened again as a duplicate. Check that the target is reachable and the account can read the whole table; the next run tries again.","kind":"next-run","whenOff":"Off: no event and no mail. The step itself still stops, because writing after a partial read of the target would open every record the read missed again as a duplicate.","what":"The vulnerability connector wrote nothing, because the vulnerability target could not be read in full.","why":"This check stops duplicate records: every record the read missed would have been opened again. {detail|Part of the target (for example the ServiceNow table) could not be read.}","ifRelease":"This check cannot be released: writing after a partial read would create duplicates or close the wrong records.","consequence":"Nothing is lost and nothing is duplicated: the target is unchanged. This run's new and fixed vulnerabilities reach it with the next run that reads it in full.","steps":["Check that the target is reachable and that the account can read the whole table.","Nothing else is needed: the next run tries again."],"neverReleasable":"the connector could not read the other system completely; closing from a partial read could close the wrong items"},
|    {"id":"vuln.connector.refused","name":"Vulnerabilities: connector not set up","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"your vulnerability target","action":"A vulnerability connector is not set up completely, so it did not run. Open Configuration > Connectors > Setup in the Pro web app and fix the settings it lists.","kind":"setting","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because the connector is not set up completely and cannot run.","what":"A vulnerability connector did not run, because it is not set up completely.","why":"This check stops a connector from writing to your target with missing or wrong settings. {detail|One or more of its settings are missing or not valid.}","ifRelease":"This check cannot be released: nothing is held. Fix the connector's setup and it runs again.","consequence":"Nothing was written to the target. Until the setup is fixed, the target does not receive new or fixed vulnerabilities.","steps":["Open Configuration > Connectors > Setup and fix the settings it lists.","The connector runs again on its next schedule."],"neverReleasable":"the connector definition is not valid (a setting or a secret is missing); there is nothing to release -- fix the definition"},
|    {"id":"cmdb.sql.snapshot-incomplete","name":"CMDB table: asset collection not complete","area":"cmdb-connector","job":"si-cmdb-sql","protects":"the configuration items (CIs) in your SQL CMDB table","action":"The newest asset collection is not known to be complete, so the CMDB table was not changed. Check that the profiling runs (endpoint, Azure) finish without errors; the next complete collection is written as normal.","kind":"next-run","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because a CI is never written from an asset collection that is not complete.","what":"The CMDB table was not changed, because the newest asset collection is not known to be complete.","why":"This check stops configuration items from being created, changed or retired from an incomplete collection: a missing asset would look like a retired one. {detail|One of the collection runs (devices, Azure) did not finish cleanly.}","ifRelease":"This check cannot be released: configuration items are never written from an incomplete collection.","consequence":"Nothing is lost: the CMDB table keeps its configuration items as they were. New or changed assets reach it with the next complete collection.","steps":["Check that the collection runs (devices, Azure) finish without errors (Operations > Jobs > Run health).","Nothing else is needed: the next complete collection is written as normal."],"neverReleasable":"the profile snapshot is incomplete; CIs are never created, changed or retired from an incomplete snapshot"},
|    {"id":"cmdb.sql.collapse","name":"CMDB table: far fewer assets than usual","area":"cmdb-connector","job":"si-cmdb-sql","protects":"the configuration items (CIs) in your SQL CMDB table","action":"SecurityInsight sees far fewer assets than are active in the CMDB table, which looks like a broken collection rather than assets gone, so nothing was retired. Check the newest profiling runs; the next complete collection is written as normal.","kind":"next-run","whenOff":"Off: the step goes on as if the check had not tripped -- CIs are retired even when SecurityInsight sees far fewer assets than are active in the CMDB table.","what":"No configuration item was retired, because SecurityInsight sees far fewer assets than are active in the CMDB table.","why":"This check stops a broken collection from retiring healthy configuration items. {detail|The newest collection looks broken rather than the assets being gone.}","ifRelease":"This check cannot be released: retiring from a collection that lost most of its assets would retire healthy configuration items.","consequence":"Nothing is lost: every active configuration item stays active until a complete collection confirms it is gone.","steps":["Check the newest collection runs (Operations > Jobs > Run health).","Nothing else is needed: the next complete collection is written as normal."],"neverReleasable":"the snapshot lost most of its assets; retiring CIs from it would retire healthy CIs"},
|    {"id":"cmdb.sql.empty-snapshot","name":"CMDB table: empty asset collection","area":"cmdb-connector","job":"si-cmdb-sql","protects":"the configuration items (CIs) in your SQL CMDB table","action":"The newest asset collection holds no assets at all, so nothing was written or retired. Check that the profiling runs collect assets.","kind":"next-run","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- an empty asset collection is written too, which can retire every CI.","what":"Nothing was written to or retired from the CMDB table, because the newest asset collection holds no assets.","why":"This check stops an empty collection from retiring every configuration item. {detail|The collection runs collected no assets.}","ifRelease":"This check cannot be released: a release would retire every configuration item.","consequence":"Nothing is lost: the CMDB table is unchanged.","steps":["Check that the collection runs collect assets (Operations > Jobs > Run health).","Nothing else is needed: the next collection with assets is written as normal."],"neverReleasable":"the snapshot is empty; releasing it would retire every CI"},
|    {"id":"cmdb.sql.no-correlation-map","name":"CMDB table: no correlation results","area":"cmdb-connector","job":"si-cmdb-sql","protects":"the configuration items (CIs) in your SQL CMDB table","action":"The asset correlation results are missing, so assets could not be matched to their CIs and nothing was written. Run the asset correlation job, then this connector again.","kind":"rerun","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because without the correlation results no asset can be matched to its CI.","what":"Nothing was written to the CMDB table, because the asset correlation results are missing.","why":"This check stops assets from being written to the wrong configuration item: without the correlation results, SecurityInsight cannot match them. {detail|The asset correlation results are missing.}","ifRelease":"This check cannot be released: without the correlation results no asset can be matched. Run the correlation job instead.","consequence":"Nothing is lost: the CMDB table is unchanged until the correlation results exist.","steps":["Run the asset correlation job (Operations > Jobs).","Then run the CMDB connector again, or wait for its next scheduled run."],"neverReleasable":"without the correlation map CIs cannot be matched to assets; re-run the correlation job instead"},
|    {"id":"cmdb.sql.stale","name":"CMDB table: changed by another run","area":"cmdb-connector","job":"si-cmdb-sql","protects":"the configuration items (CIs) in your SQL CMDB table","action":"Another run changed the CMDB table while this one was planning, so this run wrote nothing. Nothing is needed if it happens once; if it repeats, make sure the CMDB connector does not run twice at the same time.","kind":"next-run","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because another run changed the CMDB table meanwhile; the next run plans again.","what":"This CMDB run wrote nothing, because another run changed the CMDB table while it was planning.","why":"This check stops one run from overwriting what another run just wrote. {detail|Two runs of the CMDB connector overlapped.}","ifRelease":"This check cannot be released: its plan is out of date. The next run plans again from the current table.","consequence":"Nothing is lost: the other run's changes stand, and the next run plans again from the current table.","steps":["Nothing is needed if it happens once.","If it repeats, make sure the CMDB connector does not run twice at the same time."],"neverReleasable":"the snapshot is too old to be the truth about the estate; the next fresh run decides"},
|    {"id":"cmdb.handoff.mass-change","name":"CMDB hand-off: large change","area":"cmdb-connector","job":"si-cmdb-sql","protects":"the CIs your ServiceNow imports from the CMDB hand-off database","action":"Far more of the CIs handed to ServiceNow last time are missing from this run than the connector allows, which looks like a broken collection rather than assets gone, so this run's batch was held and ServiceNow keeps importing the previous one. Check the profiling and correlation runs (for example a lost permission or a failed sign-in). If the change is real, release it once in Operations > Guards (safety checks); otherwise the next run that is back within the limit (the connector's changeGuardPercent) is handed over by itself.","kind":"release-held-set","whenOff":"Off: the step goes on as if the check had not tripped -- the batch is handed over to ServiceNow however many CIs changed or disappeared.","what":"This run's CMDB hand-off batch was held, because far more of the configuration items handed to ServiceNow last time are missing from it than the connector allows.","why":"This check stops a broken collection (for example a lost permission or a failed sign-in) from making many configuration items disappear from ServiceNow. {detail|The change looks like a broken collection rather than assets gone.}","ifRelease":"The held batch is handed to ServiceNow once: ServiceNow imports it, and the configuration items missing from it are no longer in the hand-off. The release is for this batch only and ends by itself.","consequence":"Nothing is lost: ServiceNow keeps importing the previous batch until a run is back within the limit, or the held batch is released.","steps":["Check the collection and correlation runs (Operations > Jobs > Run health).","If the change is real, a SuperAdmin releases the batch once with Release in \"Held now\" at the top of the Guards page.","Otherwise do nothing: the next run that is back within the limit is handed over by itself."],"limitsInfo":"The allowed change is set on the CMDB hand-off connector (Configuration > Connectors > Setup). A higher limit hands bigger changes to ServiceNow without a hold."},
|    {"id":"cmdb.servicenow.unreachable","name":"ServiceNow: not reachable","area":"cmdb-connector","job":"si-datasync","protects":"the configuration items (CIs) in ServiceNow","action":"The ServiceNow instance could not be reached, so nothing was sent. Check the instance address and the account of the ServiceNow connector (Configuration > Connectors), and that ServiceNow is up.","kind":"fix-source","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because ServiceNow cannot be reached.","what":"Nothing was sent to the ServiceNow CMDB, because the instance could not be reached.","why":"This check stops SecurityInsight from sending half a set of changes to ServiceNow. {detail|The ServiceNow instance did not answer, or refused the account.}","ifRelease":"This check cannot be released: ServiceNow cannot be reached, and nothing is held.","consequence":"Nothing is lost: ServiceNow keeps its configuration items as they were, and the changes are sent with the next run that reaches it.","steps":["Check the instance address and the account of the ServiceNow connector (Configuration > Connectors).","Check that ServiceNow is up.","Nothing else is needed: the next run sends the changes."],"neverReleasable":"ServiceNow could not be reached; there is nothing held to release"},
|    {"id":"cmdb.servicenow.create-gate","name":"ServiceNow: CIs not accepted","area":"cmdb-connector","job":"si-datasync","protects":"the configuration items (CIs) in ServiceNow","action":"ServiceNow's import did not accept some of the CIs SecurityInsight sent, so this batch was not completed. Every row goes again with the next run. The reasons ServiceNow gave are in the data sync's run log; check the Import Set table and its transform map in ServiceNow.","kind":"fix-source","defaultOff":true,"whenOff":"Off: no event and no mail. The rows ServiceNow did not accept are still sent again with the next run.","what":"{held|Some} CI(s) were not accepted by ServiceNow's import.","why":"This check tells you when ServiceNow refuses part of what SecurityInsight sends, so the CMDB does not quietly miss CIs. {detail|ServiceNow's import refused some rows.}","ifRelease":"This check cannot be released: nothing is held. The rows ServiceNow did not accept are sent again with the next run.","consequence":"The batch is marked failed, so ServiceNow does not import it as complete; every row goes again with the next run. Until a batch is complete, the CIs in ServiceNow stay as they were.","steps":["See the data sync's run log for the reasons ServiceNow gave.","Check the Import Set table and its transform map in ServiceNow.","Nothing else is needed: the next run sends the rows again."],"neverReleasable":"nothing is held: the rows ServiceNow did not accept are sent again with the next run"},
|    {"id":"cmdb.servicenow.service-model","name":"ServiceNow: service model errors","area":"cmdb-connector","job":"si-cmdb","protects":"the placement of assets in your business services","action":"The service model has errors, so no asset was placed in a business service. Fix the problems listed in the run log.","kind":"fix-source","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because the service model has errors.","what":"No asset was placed in a business service, because the service model has errors.","why":"This check stops assets from being placed under the wrong business services. {detail|The service model has problems that must be fixed first.}","ifRelease":"This check cannot be released: a release would place configuration items under the wrong services. Fix the model.","consequence":"The placement of assets in your business services stays as it was until the model is fixed.","steps":["Fix the problems listed in the run log.","Nothing else is needed: the next run places the assets."],"neverReleasable":"the service model does not match ServiceNow; fix the model -- a release would write CIs under the wrong services"},
|    {"id":"asset.properties.collection-change","name":"Asset metadata: large change","area":"asset-properties","job":"si-asset-properties","protects":"the asset metadata handed to your CMDB and vulnerability system","action":"The full asset metadata collected from one source changed by more than the allowed share since the previous run, which looks like a broken collection rather than a real change, so the previous collection of that source was kept for the hand-off. Check the source (for example a lost permission or a failed sign-in). If the change is real, release it once in Operations > Guards (safety checks); otherwise the next run that is back within the limit (SI_AssetProperties_ChangeGuardPercent) ends the hold by itself.","kind":"release-held-set","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- a large change of the asset metadata is handed over like any other.","what":"The asset metadata from one source changed by more than the allowed share since the previous run, so the previous collection of that source is still used for the hand-off.","why":"This check stops a broken collection (for example a lost permission or a failed sign-in) from reaching your CMDB and vulnerability system. {detail|The change looks like a broken collection rather than a real change.}","ifRelease":"The new collection of that source is handed to your CMDB and vulnerability system once, instead of the previous one. The release is for this run only and ends by itself.","consequence":"Nothing is lost: your CMDB and vulnerability system keep receiving the previous collection of that source until a run is back within the limit, or the change is released.","steps":["Check the source (for example a lost permission or a failed sign-in).","If the change is real, a SuperAdmin releases it once with Release in \"Held now\" at the top of the Guards page.","Otherwise do nothing: the next run that is back within the limit ends the hold by itself."],"limits":["SI_AssetProperties_ChangeGuardPercent"],"limitsInfo":"A higher share lets bigger changes through to your CMDB and vulnerability system without a hold; a lower share holds smaller changes too."},
|    {"id":"collection.source.asset-drop","mail":"never","name":"Collection: far fewer assets from one source","area":"collection","job":"","protects":"your configuration items (CIs) and everything calculated from them","action":"One source returned far fewer assets than in its last good collection, although the collection completed. That can be a real clean-up (for example many Azure resources removed) or a source that answered only in part, so the assets it no longer lists were kept as they were instead of being marked not seen. Nothing is needed when the drop is real: when the next complete collection of that source shows the same level, it is accepted by itself. To accept such a drop at once instead, set SI_Pro_SourceDropout_AssetDropAction to accept.","kind":"next-run","whenOff":"Off: a collection with far fewer assets is taken as it comes -- the assets the source no longer lists are marked not seen at once, and their CIs retire after the usual days.","what":"A source returned far fewer assets than in its last good collection, so the assets it no longer lists were kept as they were.","why":"This check stops a source that answered only in part from making healthy assets look gone. {detail|The collection completed, but with far fewer assets than before.}","ifRelease":"This check cannot be released, and does not need to be: when the next complete collection of that source shows the same level, the drop is accepted by itself.","consequence":"Nothing is lost: the run went on, the assets the source no longer lists stay active with their last known data, and no CI is retired and no finding is closed because of the drop. A real clean-up takes effect one run later.","steps":["Check the source if the drop is not expected (for example a lost permission, a changed scope or a failed sign-in).","If the drop is real, do nothing: the next complete collection that shows the same level is accepted by itself.","To accept such drops at once from now on, choose accept for this check under Control on the Guards page."],"limits":["SI_Pro_DataQuality_AssetDropPercent","SI_Pro_SourceDropout_AssetDropAction"],"limitsInfo":"A higher share lets bigger drops through without keeping the last good collection; a lower share keeps it for smaller drops too. Accept takes every drop as it comes and only reports it.","neverReleasable":"nothing waits for a person: the next complete collection of that source that shows the same level is accepted by itself"},
|    {"id":"ci.build.concurrent","name":"CI build started while another was running","area":"job-flow","job":"","protects":"your configuration items (CIs) from being written by two builds at the same time","action":"A CI build was started while another CI build was still running. It did not build beside it: it waited for that build to finish and then built what was left. Nothing is needed. If it happens often, something starts the CI build a second time while it runs -- for example a job run by hand while the pipeline runs.","kind":"info","whenOff":"Off: no event. The second CI build still waits for the first one, because two builds never write the CIs at the same time.","what":"A CI build was started while another CI build was still running, so it waited for that build to finish and then built what was left.","why":"This check tells when two CI builds are asked for at the same time. Two builds side by side would write the same CIs, links and identity records at once, so only one builds at a time. {detail|A second CI build was started while one was running.}","ifRelease":"This check cannot be released: it is information only. Nothing is held -- the second build ran by itself when the first one had finished.","consequence":"Nothing is lost: the second build waited and then built what was left, so the CIs are up to date. That run took longer than usual by the time it waited.","steps":["Nothing is needed if it happens rarely.","If it happens often, check what starts the CI build while it runs (Operations > Jobs): a job run by hand, or a job on its own schedule beside the pipeline."],"neverReleasable":"information only: the second build waited and then ran by itself; there is nothing held"},
|    {"id":"datasync.collection.held","name":"Data sync: collection of an unfinished run","area":"data-sync","job":"si-datasync","protects":"the collections shown in the Pro web app","action":"Some Risk Analysis collections were not loaded into the Pro database because the run that produced them is not known to be complete. Nothing is lost: they are kept and tried again on the next data sync, and an Admin can load one anyway, marked partial, in Operations > Guards (safety checks). If this repeats, check the Risk Analysis Detailed runs.","kind":"release-collection","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- a collection whose Risk Analysis run did not finish completely is loaded anyway and MARKED PARTIAL in the web app.","what":"{v:collectionsHeld|Some} Risk Analysis collection(s) were not loaded into the web app.","why":"This check stops results of a Risk Analysis run that did not finish from being shown as complete: findings missing from it would look resolved. {detail|The Risk Analysis run that produced them did not finish completely.}","ifRelease":"The collection is loaded into the web app once and marked partial wherever it is shown. Findings missing from it stay unknown, not resolved.","consequence":"Nothing is lost: the results ({v:rowsHeld} findings) are kept and can be loaded. [The web app keeps showing the newest complete collection ({latest}) until then.] Pages and trends miss these collections until they are loaded.","steps":["Open the Risk Analysis run health to see which part of the run was incomplete.","If the missing part does not matter to you, a SuperAdmin releases the collection with Release in \"Held now\" at the top of the Guards page.","Otherwise do nothing: the next complete Risk Analysis run is loaded as normal."]},
|    {"id":"datasync.collection.refused","name":"Data sync: rows without their key","area":"data-sync","job":"si-datasync","protects":"the days shown in the Pro web app and its trends","action":"Risk Analysis data arrived without its key columns (its finding ids, or its collection time), so it was not loaded as a day. That day is missing until a complete Risk Analysis run arrives. Check the Risk Analysis Detailed run of that time: its run health says why its data was incomplete.","kind":"fix-source","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because rows without their finding id or collection time cannot be placed in a day.","what":"Risk Analysis data was not loaded as a day, because it arrived without its key columns.","why":"This check stops rows that cannot be placed in a day from mixing up your history and trends. {detail|The Risk Analysis run delivered rows without their finding ids or their collection time.}","ifRelease":"This check cannot be released: rows without their finding id or collection time are never loaded.","consequence":"That run is missing from the web app's history and trends; the collections before and after it are shown as normal. [The newest collection in the web app is {latest}.] This event repeats on every data sync until those rows are older than the look-back window (3 days by default).","steps":["Open the Risk Analysis run health of that time to see why its data was incomplete.","Fix the cause: a later complete run is loaded as normal.","Acknowledge this event once you have read it: repeats of exactly this event are hidden too."],"neverReleasable":"its rows have no key columns (ConfigurationId / CollectionTime): rows without keys are never loaded, released or not"},
|    {"id":"datasync.asset.kind-dropped","name":"Data sync: findings an asset kind filter cannot show","area":"data-sync","job":"si-datasync","protects":"the asset kind filters of the Pro web app","action":"Findings of an asset kind were loaded, but their assets were stored without that kind (or without any kind), so the web app's asset kind filter cannot show them. The findings themselves are loaded and counted under All. Check the profiling run of that kind (for example the Azure collector) and the data sync log; if it repeats, contact Invardia support.","kind":"review","defaultOff":true,"whenOff":"Off: no event and no mail when a loaded collection has findings of an asset kind that no asset of that kind carries; the findings are loaded as before.","what":"Some findings are loaded, but the asset kind filter cannot show them.","why":"This check warns you that a filtered page shows fewer findings than there are. {detail|Their assets were stored without the asset kind the findings belong to.}","ifRelease":"This check cannot be released: nothing is held. The findings are already loaded; the check only warns.","consequence":"The findings are in the web app and counted under All, but a page filtered on that asset kind shows fewer findings (or none) until the assets carry their kind again.","steps":["Open the data sync run log of that time to see which kind and how many assets.","Check the collection run of that kind (for example Azure): the next data sync stores the kind again once the collection carries it.","If it repeats, contact Invardia support."],"neverReleasable":"the collection is already loaded; the guard warns that a kind filter cannot show some of its findings -- review it, there is nothing held"},
|    {"id":"datasync.collection.short-read","name":"Data sync: collection not read in full","area":"data-sync","job":"si-datasync","protects":"the collections shown in the Pro web app","action":"A collection could not be read or written in full, so it was not loaded. Nothing is lost: the full collection is tried again on the next data sync. If this repeats, contact Invardia support.","kind":"next-run","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because a collection that could not be read or written in full is not loaded.","what":"A Risk Analysis collection could not be read or written in full, so it was not loaded.","why":"This check stops half a collection from being shown as the whole one. {detail|The read from Log Analytics or the write to the database stopped part way.}","ifRelease":"This check cannot be released: a collection read only in part is never loaded as complete. The next data sync reads it again.","consequence":"Nothing is lost: the full collection is tried again on the next data sync.","steps":["Nothing is needed if it happens once.","If it repeats, contact Invardia support."],"neverReleasable":"fewer rows were read than the run wrote; the next sync reads it again -- a short read is never loaded as complete"},
|    {"id":"ra.output.row-drop","name":"Risk Analysis: far fewer findings","area":"risk-analysis","job":"","protects":"the completeness of your Risk Analysis reports","action":"One or more reports produced far fewer findings than the previous run. Either the findings were really fixed, or a query stopped matching. Compare the listed reports with the previous run before trusting this export.","kind":"review","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- a report with far fewer findings than the previous run no longer makes the run partial (a failed query or a missing result still does).","what":"{v:reports|Some} Risk Analysis report(s) produced far fewer findings than the previous run.","why":"This check warns you before you trust a report that may be missing findings: either the findings were really fixed, or a query stopped matching. {detail|The reports produced far fewer findings than the previous run.}","ifRelease":"This check cannot be released: nothing is held. The reports were delivered; the check only warns.","consequence":"The reports were delivered as they are. If a query stopped matching, the missing findings are unknown, not resolved.","steps":["Compare the listed reports with the previous run.","If the drop is not real, check the report's query and the data it reads before trusting this export."],"neverReleasable":"the report is already produced; the guard warns that it lost rows -- review the run, there is nothing held"},
|    {"id":"ra.bucket.count-jump","name":"Risk Analysis: far more buckets than usual","area":"risk-analysis","job":"","protects":"the speed and correctness of your Risk Analysis reports","action":"One or more reports needed far more buckets (query slices) than usual. That usually means the report's query or the data it reads changed in a way that needs a look. The run completed.","kind":"review","whenOff":"Off: no event when a report needs far more buckets than usual; the run itself is unchanged.","what":"{v:reports|Some} Risk Analysis report(s) needed far more buckets than usual (largest {v:largest|unknown}).","why":"This check warns you that a report whose bucket count jumps to 4 times its usual count, or above 256, points at a query or data problem rather than normal growth. {detail|A report needed far more buckets than usual.}","ifRelease":"This check cannot be released: nothing is held. The reports were delivered; the check only warns.","consequence":"The reports were delivered as they are, but the listed reports took far more queries than usual, so the run was slower.","steps":["Open Operations > Risk Analysis query splitting and look at the listed reports.","If the count is wrong, reset that report there: the next run sizes it again."],"neverReleasable":"the reports are already produced; the guard warns about their bucket counts -- review them, there is nothing held"},
|    {"id":"ra.output.column-emptied","name":"Risk Analysis: column emptied","area":"risk-analysis","job":"","protects":"the completeness of your Risk Analysis reports","action":"One or more report columns are empty (or gone) while they had values in the previous run. Check the listed columns before trusting this export.","kind":"review","defaultOff":true,"whenOff":"Off: no event and no mail when a report column lost its content; the report itself is unchanged.","what":"{v:columns|Some} report column(s) are empty or gone, while they had values in the previous run.","why":"This check warns you that filters and scores reading those columns may be wrong for this run. {detail|A source stopped delivering a value, or a column was renamed.}","ifRelease":"This check cannot be released: nothing is held. The reports were delivered; the check only warns.","consequence":"The reports were delivered with these columns empty; filters and scores that read them may be wrong for this run.","steps":["Check the listed columns before trusting this export.","If a source stopped delivering, fix its permission or setting: the next run fills the columns again."],"neverReleasable":"the report is already produced; the guard warns that a column is empty -- review the run, there is nothing held"},
|    {"id":"ingest.rows.short-count","name":"Log Analytics: rows not accepted","area":"ingest","job":"","protects":"the results written to your Log Analytics workspace","action":"Not every row of a result was accepted by Log Analytics, so the run was stopped instead of reporting a partial result as complete. Nothing is closed or retired on the strength of it; the next run writes the full result again. If this repeats, contact Invardia support.","kind":"next-run","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because the rows Log Analytics did not accept are not there.","what":"The run was stopped, because Log Analytics did not accept every row of a result.","why":"This check stops later steps from closing or retiring anything because of a result that is only partly stored. {detail|Part of the result was refused while it was written to your Log Analytics workspace.}","ifRelease":"This check cannot be released: the rows that were not accepted are not there. The next run sends them again.","consequence":"Nothing is closed or retired on the strength of a partial result; the next run writes the full result again.","steps":["Nothing is needed if it happens once.","If it repeats, contact Invardia support."],"neverReleasable":"Log Analytics stored fewer rows than were sent; the next run sends them again -- nothing is held"},
|    {"id":"schema.gate.refused","name":"Database change that could remove data","area":"setup","job":"si-setup","protects":"your SecurityInsight database","action":"A database change was refused because it is not approved for this install, or because it could remove data. Nothing was applied. Contact Invardia support with the message from setup.","kind":"fix-source","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because a database change that could remove data is never applied automatically.","what":"A database change was refused, and nothing was applied.","why":"This check protects your data: SecurityInsight only adds to its database, and never applies a change that could remove data. {detail|The change is not approved for this install, or it could remove data.}","ifRelease":"This check cannot be released: a change that could remove data is never applied, whoever asks.","consequence":"Your SecurityInsight database is unchanged; features that need the change wait until it is applied.","steps":["Contact Invardia support with the message from setup."],"neverReleasable":"SecurityInsight applies additive schema only; a schema that drops or rewrites data is never applied, whoever asks (integrity)"},
|    {"id":"update.schema.failed","name":"Update: database update failed","area":"update","job":"si-updater","protects":"your SecurityInsight installation from running a new version on an old database","action":"An update stopped before it changed anything, because the new version's database changes could not be applied. Your installation keeps running the version it ran before. Make sure the updater's identity has the database rights the release notes name, then start the updater again; if it repeats, contact Invardia support with the message from the update.","kind":"fix-source","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because the database update failed.","what":"An update stopped before rolling out the new version, because its database changes could not be applied.","why":"This check stops a new version from running on an old database, which could break jobs or the web app. {detail|The database refused a change the new version needs, or the updater could not sign in to it.}","ifRelease":"This check cannot be released: new code never runs on an old database. The update waits until the database change applies.","consequence":"Nothing changed: every job and the web app keep running the version they ran before. The update is tried again on the next updater run.","steps":["Check that the updater's identity has the database rights the release notes name.","Start the updater again (or wait for its next daily run).","If it repeats, contact Invardia support with the message from the update."],"neverReleasable":"new code never runs on an old schema; the update waits until the schema applies (integrity)"},
|    {"id":"licence.state.invalid","name":"Licence not valid","area":"licence","job":"","protects":"the SecurityInsight Pro features","action":"The SecurityInsight Pro licence does not verify (it has expired or is not valid for this install), so the Pro jobs did not run. Install a current licence, or contact Invardia.","kind":"setting","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because the licence, not this switch, decides which Pro features run.","what":"The SecurityInsight Pro jobs did not run, because the licence does not verify.","why":"This check pauses the Pro features while the licence does not verify: the licence decides which Pro features run. {detail|The licence has expired or is not valid for this install.}","ifRelease":"This check cannot be released: a licence is checked, never released. Install a valid licence.","consequence":"The Pro features are paused; no data is removed. They start again as soon as a valid licence is installed.","steps":["Install a current licence, or contact Invardia."],"neverReleasable":"a licence is checked, never released: install a valid licence (integrity)"},
|    {"id":"licence.state.grace","name":"Licence grace period","area":"licence","job":"","protects":"the SecurityInsight Pro features","action":"The SecurityInsight Pro licence is in its grace period. Everything keeps running for now; renew the licence before the grace period ends.","kind":"setting","defaultOff":true,"whenOff":"Off: no event and no mail during the licence grace period; everything keeps running.","what":"The SecurityInsight Pro licence is in its grace period.","why":"This check tells you in time that the licence must be renewed. {detail|The licence has expired; the grace period keeps everything running for now.}","ifRelease":"This check cannot be released: a licence is checked, never released. Renew it before the grace period ends.","consequence":"Everything keeps running for now. When the grace period ends, the Pro jobs stop until the licence is renewed.","steps":["Renew the licence before the grace period ends."],"neverReleasable":"a licence is checked, never released: renew the licence before the grace period ends (integrity)"},
|    {"id":"audit.retention.refused","name":"Audit trail retention setting","area":"audit","job":"si-datasync","protects":"the audit trail","action":"The audit trail retention setting (SI_Pro_AuditRetentionMonths) is not a whole number of at least 13 months, so nothing was removed. Correct the setting on the Settings page.","kind":"setting","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because the retention setting is not valid.","what":"No audit trail entries were removed, because the retention setting is not valid.","why":"This check protects your audit trail: it is kept at least 13 months, so entries are never removed on a setting that is not valid. {detail|The audit retention setting is not a whole number of at least 13 months.}","ifRelease":"This check cannot be released: the audit trail is kept at least 13 months.","consequence":"Nothing is lost: the whole audit trail is kept until the setting is corrected.","steps":["Correct the audit trail retention on the Settings page (a whole number of months, at least 13)."],"neverReleasable":"the audit trail is kept at least 13 months; a retention guard is never released (integrity of the evidence)"},
|    {"id":"exemption.bulk.refused","name":"Bulk exemption limit","area":"exemptions","job":"si-web","protects":"your findings from being exempted in bulk by mistake","action":"A request to exempt or change many findings at once was refused (no narrowing filter, or more findings than the limit allows). Nothing was changed. If the request was intended, narrow the filter or raise SIWeb_Exemption_BulkMax deliberately.","kind":"info","defaultOff":true,"whenOff":"Off: no event and no mail. The request itself is still refused, because a whole collection is never exempted in one go -- raise the limit instead (Settings > Exemptions: Most findings in one bulk exemption request, up to 2,000).","what":"A request to exempt or change many findings at once was refused.","why":"This check stops many findings from being exempted in one click by mistake. {detail|The request had no narrowing filter, or more findings than the limit allows.}","ifRelease":"This check cannot be released: narrow the selection and send the request again, or raise the limit.","consequence":"Nothing was changed: every finding keeps its state.","steps":["If the request was intended, narrow the filter and send it again.","Or raise the limit on purpose (Settings > Exemptions: most findings in one bulk exemption request)."],"neverReleasable":"a bulk exemption over the limit is refused by design; narrow the selection instead","limitsInfo":"The limit is set under Settings > Exemptions (most findings in one bulk exemption request). A higher limit lets bigger requests through in one click."},
|    {"id":"flow.run.catch-up","name":"Daily flow: start held for the previous run","area":"job-flow","job":"si-flow","protects":"the order of the daily jobs","action":"A scheduled start of the daily job flow was held because the previous run was still running; it ran once as soon as that run finished. Nothing is needed if it happens rarely.","kind":"info","defaultOff":true,"whenOff":"Off: no event and no mail; the daily flow still waits for its previous run.","what":"A scheduled start of the daily job flow was missed: it started later than its time, and not only because the previous run was still going.","why":"This check tells when the daily jobs do not start at their time. A start that only waits for a long previous run is normal and is not reported; any other late start is. {detail|The start was not made at its scheduled time.}","ifRelease":"This check cannot be released: it is information only. The missed start already ran once, late.","consequence":"Nothing is lost: the missed start ran once, late, so the data was refreshed later than scheduled.","steps":["Nothing is needed if it happens rarely.","If it happens again, check that the pipeline's job is switched on and that nothing held it at its start time, for example an update that took long."],"neverReleasable":"information only: the pipeline made a missed start late; there is nothing held"},
|    {"id":"flow.step.skipped","name":"Daily flow: jobs skipped","area":"job-flow","job":"si-flow","protects":"the jobs that depend on an earlier job","action":"One or more jobs in the daily flow were skipped because a job they need did not succeed. Fix the failed job (see Operations > Jobs), then use Re-run from here.","kind":"next-run","defaultOff":true,"whenOff":"Off: no event and no mail; jobs that need a failed job are still skipped.","what":"{held|Some} job(s) in the daily flow were skipped, because a job they need did not succeed.","why":"This check stops jobs from working on missing or old data from a job that failed. {detail|An earlier job in the flow failed.}","ifRelease":"This check cannot be released: the skipped jobs need the failed job's data. Fix the failed job and run again.","consequence":"The skipped jobs did not update their data this time: their pages show the previous run until the next successful run. Nothing is lost.","steps":["Fix the failed job (see Operations > Jobs).","Use Re-run from here, or wait for the next scheduled run."],"neverReleasable":"the step did not run because its input was missing; the next run resolves it -- there is nothing held"},
|    {"id":"flow.step.start-failed","name":"Daily flow: job did not start","area":"job-flow","job":"si-flow","protects":"the jobs of the daily flow","action":"A job in the daily flow could not start: its container stopped before SecurityInsight ran (an Azure platform problem). It was started again automatically and did not start that time either. Check the job's executions in Operations > Jobs; when Azure is healthy again, use Re-run from here. If it happens again, contact Invardia support.","kind":"rerun","defaultOff":true,"whenOff":"Off: no event and no mail; a job that does not start is still not run.","what":"A job in the daily flow could not start, also not when it was started again.","why":"This check tells you that a job did not run, so you do not trust data that was not updated. {detail|Its container stopped before SecurityInsight ran (an Azure platform problem).}","ifRelease":"This check cannot be released: nothing is held. Run the job again when Azure is healthy.","consequence":"That job's data was not updated this time, and jobs that need it may have been skipped. Nothing else is lost.","steps":["Check the job's runs in Operations > Jobs.","When Azure is healthy again, use Re-run from here.","If it happens again, contact Invardia support."],"neverReleasable":"the job could not be started; re-run it on the Jobs page -- there is nothing held"},
|    {"id":"flow.step.interrupted","name":"Daily flow: job interrupted","area":"job-flow","job":"si-flow","protects":"the jobs that depend on an earlier job","action":"A job in the daily flow was interrupted and was not started again automatically. Check Operations > Jobs and use Re-run from here when ready.","kind":"rerun","defaultOff":true,"whenOff":"Off: no event and no mail; an interrupted job is still not started again.","what":"{held|Some} job(s) in the daily flow were interrupted and not started again automatically.","why":"This check tells you that a job stopped part way, so its data and the jobs that need it are not up to date. {detail|The job stopped part way, for example because its container was restarted.}","ifRelease":"This check cannot be released: nothing is held. Run the job again on the Jobs page.","consequence":"Those jobs did not update their data this time, and jobs that need them wait.","steps":["Check Operations > Jobs.","Use Re-run from here when ready."],"neverReleasable":"the job was interrupted; re-run it on the Jobs page -- there is nothing held"},
|    {"id":"job.execution.previous-running","name":"Job started while still running","area":"job-flow","job":"","protects":"a job from running twice at the same time","action":"A job was started while its previous run was still running, so the new run did nothing. If this happens every day, the job takes longer than its schedule allows: start it less often.","kind":"info","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because two runs of one job never run at the same time.","what":"A job was started while its previous run was still running, so the new run did nothing.","why":"This check stops one job from running twice at the same time, which would write the same data twice. {detail|The previous run of the job had not finished.}","ifRelease":"This check cannot be released: a job never runs twice at the same time.","consequence":"Nothing is lost: the running job finishes its work.","steps":["Nothing is needed if it happens rarely.","If it happens every day, the job takes longer than its schedule allows: start it less often."],"neverReleasable":"a job never runs twice at the same time (SCHED-1); the skipped start runs when the previous run finishes"},
|    {"id":"job.run.throttled-stuck","name":"Job stuck on throttling","area":"job-flow","job":"","protects":"the data of a job that Microsoft keeps throttling","action":"Microsoft has throttled this job on every run for a long time, so it has not completed since. Throttling on its own is normal and is never mailed; this mail means the job cannot catch up by itself. Check whether other tools use the same Microsoft services heavily at the same time, or run the job at a quieter time. The alert clears by itself after the next run that completes.","kind":"next-run","defaultOff":true,"whenOff":"Off: no event and no mail when a job is stuck on throttling. Throttled runs are still shown as throttled on the Jobs and Run health pages.","what":"A job has not completed for a long time, because Microsoft throttled every run of it.","why":"This check tells you when a job has not been able to complete for a long stretch, so you do not rely on data that is getting old. Throttling on its own is normal and is not reported. {detail|Every run of the job was throttled by Microsoft.}","ifRelease":"This check cannot be released: nothing is held. The next run that completes clears it.","consequence":"The job's data was not updated while it was stuck. The previous results stay in place, and findings it could not check are unknown, not resolved. Nothing is lost.","steps":["Check the job on the Jobs page (Operations > Jobs).","If other tools use the same Microsoft services heavily, run this job at a quieter time.","If it stays stuck, contact Invardia support."],"neverReleasable":"nothing is held; the alert clears by itself after the next run that completes"}
|  ]
|}
'@ }
$__siSupportFiles['engine/_shared/SI-CollectParts.ps1'] = @{ Sha256 = '07afa012bacd0e3e49114c023c231be5aac252da3b83e358311df20f73300036'; Text = @'
|#Requires -Version 5.1
|<#
|    THE COLLECT STAGE IN PARTS (#475, operator 2026-10-08: "in my opinion the collection phase is whre it makes sense to
|    scale via keda" / "i propose we have keda enabled by desin so it can automatically trigger it if enabled").
|
|    One code path for every tenant size:
|      PRODUCER  discovers ONCE, streaming: every page of objects goes straight into its PART (a stable hash of the
|                object's key), so its memory is one page, never the tenant. It decides the part count for THIS run from
|                what it found (Get-SICollectPartCount) and writes the MANIFEST: engine, run id, collection time, parts.
|      WORKERS   one per part (KEDA scales them from the queue; a VM, or a container without a managed identity, runs the
|                parts one after another in one process). A worker reads ONLY its part and ends with a MARKER:
|                done, or failed with the reason.
|      PIPELINE  the Collect step is the producer; it ends when the manifest's parts are all marked (Get-SICollectProgress):
|                every part done = succeeded; any part failed = failed, the parts named; a part not marked by the timeout =
|                incomplete -- never a quietly smaller collection.
|
|    Storage: <account>/sistate/collect/<engine>/<runId>/manifest.json and .../parts/part-NNNNN.json. Every function that
|    touches storage takes a -Store seam: @{ Read = { param($Path) <text or $null> }; Write = { param($Path, $Text) }; List =
|    { param($Prefix) <paths> } } -- tests pass an in-memory one. PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|# #639 (working rule 5): NO ceiling on the part count -- it follows the measured size. ObjectsPerPart is what one part holds
|# when nothing was measured; ReferenceBytesPerObject is the object size that number was set for, so a MEASURED object size
|# (-BytesPerObject) keeps a part at the same bytes: bigger objects -> fewer per part -> more parts. (The old ceiling of 500
|# parts put 100,000 objects in a part at 50 million objects -- ten times the memory the part was sized for.)
|$script:SICollectParts = @{ ObjectsPerPart = 10000; ReferenceBytesPerObject = 8KB }
|
|# =====================================================================================================================
|#  THE AZURE PARENT TAGS IN A RUN COLLECTED IN PARTS (#1089). The tags a resource inherits (resource group, subscription,
|#  management groups) are read ONCE per collection, by the PRODUCER (its discover phase -- RuleIndexes.ps1
|#  Save-SIParentChainForParts), and handed over in the state store next to the records (the parts design's way of sharing
|#  a run's data: the records and the full asset metadata go the same way). The process that MERGES the records reads it
|#  back (SI-RecordHandover.ps1 Publish-SIRecordHandover) and attaches the parts parentTags / parentTagScopes to every
|#  merged azure record -- the workers hold none of discovery's records, so they cannot attach them, and they never
|#  re-read the tenant.
|# =====================================================================================================================
|
|function Get-SIParentChainHandoverPath {
|    <# PURE. Where a run's parent chain is kept (beside its records, never matched as a record bucket). #>
|    param([Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][string]$RunId)
|    'collect/{0}/{1}/parent-chain.json' -f $Engine.ToLowerInvariant(), $RunId
|}
|
|function ConvertTo-SIParentChainHandover {
|    <# PURE. The parent-chain index -> what is handed over: every subscription's entry whole (its own tags, then its management
|       groups'), a resource group's own tags only (the subscription's are read from the subscription's entry), no resource's.
|       Get-SIParentTagScopes reads the two entries together, so nothing is lost. #>
|    param($Index, $Stats)
|    $chain = [ordered]@{}
|    if ($null -ne $Index) {
|        foreach ($k in @($Index.Keys)) {
|            $key = [string]$k
|            if ($key -match '^/subscriptions/[^/]+$') { $chain[$key] = @($Index[$k]); continue }
|            if ($key -match '^/subscriptions/[^/]+/resourcegroups/[^/]+$') {
|                $own = @(@($Index[$k]) | Where-Object { $null -ne $_ -and [string]$_.level -eq 'resourceGroup' })
|                if ($own.Count -gt 0) { $chain[$key] = $own }
|            }
|        }
|    }
|    [ordered]@{ Schema = 1; Stats = $Stats; Chain = $chain }
|}
|
|function Save-SIParentChainHandover {
|    <# The run's parent chain -> the state store. Throws on a failed write (the caller says it). Returns the entries kept. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][string]$RunId, $Index, $Stats)
|    $doc = ConvertTo-SIParentChainHandover -Index $Index -Stats $Stats
|    & $Store.Write (Get-SIParentChainHandoverPath -Engine $Engine -RunId $RunId) (ConvertTo-Json -InputObject $doc -Compress -Depth 6)
|    $doc.Chain.Count
|}
|
|function Read-SIParentChainHandover {
|    <# The run's parent chain from the state store -> the index (lower-case id -> entries), or $null when the producer kept none. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][string]$RunId)
|    $txt = & $Store.Read (Get-SIParentChainHandoverPath -Engine $Engine -RunId $RunId)
|    if (-not $txt) { return $null }
|    $doc = ConvertFrom-Json -InputObject ([string]$txt)
|    $idx = @{}
|    if ($doc.Chain) {
|        foreach ($p in $doc.Chain.PSObject.Properties) {
|            $list = New-Object System.Collections.Generic.List[object]
|            foreach ($e in @($p.Value)) {
|                if ($null -eq $e) { continue }
|                $list.Add(@{ tag = [string]$e.tag; value = [string]$e.value; level = [string]$e.level; from = [string]$e.from })
|            }
|            $idx[([string]$p.Name).ToLowerInvariant()] = $list.ToArray()
|        }
|    }
|    $idx
|}
|
|function Get-SICollectPartIndex {
|    <# PURE. The part an object belongs to: the first 8 hex digits of SHA-256(lower-case key) mod Parts -- the same hash the
|       engines already shard by (Invoke-Discover), so one object is always in one part. #>
|    param([AllowEmptyString()][string]$Key, [Parameter(Mandatory)][int]$Parts)
|    if ($Parts -le 1) { return 0 }
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $h = ([System.BitConverter]::ToString($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes(([string]$Key).ToLowerInvariant()))) -replace '-', '').Substring(0, 8) }
|    finally { $sha.Dispose() }
|    [int]([Convert]::ToInt64($h, 16) % $Parts)
|}
|
|function Get-SICollectPartCount {
|    <#
|        PURE. Parts for this run, from what was MEASURED: -Objects found, and (when known) -BytesPerObject, the measured size
|        of one object (e.g. a page's bytes / its objects). A part holds ~ObjectsPerPart objects of the reference size; a
|        measured size scales that (objects per part = ObjectsPerPart x reference / measured, at least 1). At least 1 part,
|        and NO upper bound (working rule 5): 50 million objects are 5,000 parts, each the size a part was sized for.
|        -MaxParts is accepted for older callers and ignored.
|    #>
|    param([long]$Objects, [int]$ObjectsPerPart = 0, [double]$BytesPerObject = 0, [int]$MaxParts = 0)
|    if ($ObjectsPerPart -le 0) { $ObjectsPerPart = [int]$script:SICollectParts.ObjectsPerPart }
|    if ($ObjectsPerPart -le 0) { $ObjectsPerPart = 10000 }
|    if ($Objects -le 0) { return 1 }
|    $per = [double]$ObjectsPerPart
|    $ref = [double]$script:SICollectParts.ReferenceBytesPerObject
|    if ($BytesPerObject -gt 0 -and $ref -gt 0) { $per = [Math]::Max(1.0, [Math]::Floor($ObjectsPerPart * $ref / $BytesPerObject)) }
|    $n = [Math]::Ceiling($Objects / $per)
|    if ($n -gt [int]::MaxValue) { $n = [int]::MaxValue }
|    [int][Math]::Max(1, $n)
|}
|
|function Get-SICollectPath {
|    <# PURE. Where a run's manifest / part marker lives in the install's state container. #>
|    param([Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][string]$RunId, [int]$Part = -1,
|          # the run's records marker (records.json) or the claim of the worker that publishes them (records.claim)
|          [ValidateSet('', 'records', 'claim')][string]$Kind = '')
|    $base = 'collect/{0}/{1}' -f $Engine.ToLowerInvariant(), $RunId
|    if ($Kind -eq 'records') { return "$base/records.json" }
|    if ($Kind -eq 'claim') { return "$base/records.claim" }
|    if ($Part -lt 0) { return "$base/manifest.json" }
|    '{0}/parts/part-{1:D5}.json' -f $base, $Part
|}
|
|function New-SICollectManifest {
|    <# PURE. The manifest a producer writes once it has put every object into its part. #>
|    param([Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][string]$RunId, [Parameter(Mandatory)][datetime]$CollectionTime,
|          [Parameter(Mandatory)][int]$Parts, [long]$Objects = 0, [datetime]$Now = [datetime]::UtcNow, [string]$ProducerExecution = '',
|          # the records are handed over (SI-RecordHandover.ps1) under the ENGINE run id and published once after the last
|          # part -- the step then ends only when that is done
|          [string]$EngineRunId = '', [switch]$RecordsHandover,
|          # how many buckets the run's records go into (Get-SIRecordBucketCount, decided by discovery); every worker hands its
|          # records over into the same buckets. 0 = a manifest from before that: one bucket per part
|          [int]$RecordBuckets = 0)
|    [ordered]@{ Schema = 1; Engine = $Engine.ToLowerInvariant(); RunId = $RunId; CollectionTime = $CollectionTime.ToUniversalTime().ToString('o')
|        Parts = $Parts; Objects = $Objects; WrittenUtc = $Now.ToUniversalTime().ToString('o'); ProducerExecution = $ProducerExecution
|        EngineRunId = $EngineRunId; RecordsHandover = [bool]$RecordsHandover; RecordBuckets = [Math]::Max(0, $RecordBuckets) }
|}
|
|function New-SICollectPartMarker {
|    <# PURE. A worker's end-of-part record: done (with its row count) or failed (with the reason). #>
|    param([Parameter(Mandatory)][int]$Part, [Parameter(Mandatory)][ValidateSet('done', 'failed')][string]$State,
|          [long]$Rows = 0, [string]$Reason = '', [string]$Worker = '', [datetime]$Now = [datetime]::UtcNow)
|    [ordered]@{ Part = $Part; State = $State; Rows = $Rows; Reason = $Reason; Worker = $Worker; EndedUtc = $Now.ToUniversalTime().ToString('o') }
|}
|
|function Write-SICollectManifest {
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)]$Manifest)
|    & $Store.Write (Get-SICollectPath -Engine $Manifest.Engine -RunId $Manifest.RunId) (ConvertTo-Json -InputObject $Manifest -Compress -Depth 4)
|}
|
|function Write-SICollectPartMarker {
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][string]$RunId, [Parameter(Mandatory)]$Marker)
|    & $Store.Write (Get-SICollectPath -Engine $Engine -RunId $RunId -Part ([int]$Marker.Part)) (ConvertTo-Json -InputObject $Marker -Compress -Depth 4)
|}
|
|function New-SICollectRecordsMarker {
|    <# PURE. The end of a run's records: done (published, with counts) or failed (with the reason). #>
|    param([Parameter(Mandatory)][ValidateSet('done', 'failed')][string]$State, [long]$Records = 0, [int]$Buckets = 0, [int]$FailedBuckets = 0,
|          [string]$Reason = '', [string]$Worker = '', [datetime]$Now = [datetime]::UtcNow)
|    [ordered]@{ State = $State; Records = $Records; Buckets = $Buckets; FailedBuckets = $FailedBuckets; Reason = $Reason; Worker = $Worker; EndedUtc = $Now.ToUniversalTime().ToString('o') }
|}
|
|function Read-SICollectRecordsMarker {
|    <# The run's records marker, or $null (not published yet). #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][string]$RunId)
|    $t = & $Store.Read (Get-SICollectPath -Engine $Engine -RunId $RunId -Kind records)
|    if ([string]::IsNullOrWhiteSpace([string]$t)) { return $null }
|    $t | ConvertFrom-Json
|}
|
|function Invoke-SICollectRecordsIfLast {
|    <#
|        #475 -- KEDA: the LAST worker publishes the run's records. Every worker calls this after it has marked its part
|        (done or failed). When every part of the manifest is marked, the worker CLAIMS the run (a create-only blob: exactly
|        one claimant wins, also when two finish at once), runs -Publish { -> @{ Records; Buckets; Failed } } and writes the
|        records marker -- failed (with the reason) when the publish threw or a bucket failed. Returns 'published', 'failed',
|        'not-last' (parts still open), 'claimed-elsewhere', or 'no-handover' (a manifest from before the hand-over).
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][string]$RunId,
|          [Parameter(Mandatory)][scriptblock]$Publish, [string]$Worker = '')
|    $m = Read-SICollectManifest -Store $Store -Engine $Engine -RunId $RunId
|    if ($null -eq $m -or -not ($m.PSObject.Properties['RecordsHandover'] -and [bool]$m.RecordsHandover)) { return 'no-handover' }
|    $seen = @{}; $failedParts = @{}
|    foreach ($k in @(Read-SICollectPartMarkers -Store $Store -Engine $Engine -RunId $RunId)) {
|        if ($null -ne $k -and $null -ne $k.Part) { $seen[[int]$k.Part] = $true; if ([string]$k.State -eq 'failed') { $failedParts[[int]$k.Part] = $true } }
|    }
|    for ($i = 0; $i -lt [int]$m.Parts; $i++) { if (-not $seen.ContainsKey($i)) { return 'not-last' } }
|    $claim = ConvertTo-Json -InputObject ([ordered]@{ Worker = $Worker; ClaimedUtc = [datetime]::UtcNow.ToString('o') }) -Compress
|    if (-not (& $Store.Claim (Get-SICollectPath -Engine $Engine -RunId $RunId -Kind claim) $claim)) { return 'claimed-elsewhere' }
|    $marker = $null
|    try {
|        # #720: the number of FAILED parts goes to -Publish (its first argument) -- the records of a run with a failed part
|        # are published, but the collection is never closed as complete (Publish-SIRecordHandover -PartsFailed): the failed
|        # part's objects keep their last good state, they are unknown, never read as removed. (The step itself already
|        # fails on the failed part's marker -- Get-SICollectProgress.)
|        $r = & $Publish ([int]$failedParts.Count)
|        if ($r -and [int]$r.Failed -gt 0) {
|            $marker = New-SICollectRecordsMarker -State failed -Records ([long]$r.Records) -Buckets ([int]$r.Buckets) -FailedBuckets ([int]$r.Failed) -Worker $Worker `
|                -Reason ('{0} of {1} record bucket(s) could not be published -- those records are missing from this collection' -f [int]$r.Failed, [int]$r.Buckets)
|        } else {
|            $recs = 0L; $bks = 0; if ($r) { $recs = [long]$r.Records; $bks = [int]$r.Buckets }
|            $marker = New-SICollectRecordsMarker -State done -Records $recs -Buckets $bks -Worker $Worker
|        }
|    } catch {
|        $marker = New-SICollectRecordsMarker -State failed -Worker $Worker -Reason ('the records could not be published: {0}' -f $_.Exception.Message)
|    }
|    & $Store.Write (Get-SICollectPath -Engine $Engine -RunId $RunId -Kind records) (ConvertTo-Json -InputObject $marker -Compress -Depth 4)
|    if ($marker.State -eq 'done') { 'published' } else { 'failed' }
|}
|
|function Read-SICollectManifest {
|    <# The manifest of a run, or $null (not written yet). #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][string]$RunId)
|    $t = & $Store.Read (Get-SICollectPath -Engine $Engine -RunId $RunId)
|    if ([string]::IsNullOrWhiteSpace([string]$t)) { return $null }
|    $t | ConvertFrom-Json
|}
|
|function Read-SICollectPartMarkers {
|    <# Every part marker of a run that exists (plain output). #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][string]$RunId)
|    $prefix = ((Get-SICollectPath -Engine $Engine -RunId $RunId) -replace 'manifest\.json$', 'parts/')
|    foreach ($p in @(& $Store.List $prefix)) {
|        if (-not $p) { continue }
|        $t = & $Store.Read $p
|        if ([string]::IsNullOrWhiteSpace([string]$t)) { continue }
|        try { $t | ConvertFrom-Json } catch { }
|    }
|}
|
|function New-SICollectBlobStore {
|    <# The state store over the install's storage account (<account>/sistate/<path>), signed in as the job (OAuth). #>
|    param([Parameter(Mandatory)][string]$Account, [string]$Container = 'sistate')
|    if (-not (Get-Command -Name Get-SIBlobContent -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-AzRest.ps1') }
|    $acc = $Account; $con = $Container
|    # The three blob functions travel INTO the store as values: its blocks are called long after this function returned,
|    # from wherever the caller is -- a name looked up at call time is whatever that scope can see (a GetNewClosure() block
|    # runs in its own scope). Missing ones are named in a plain throw at the first call.
|    $getFn = ${function:Get-SIBlobContent}; $setFn = ${function:Set-SIBlobContent}; $listFn = ${function:Get-SIBlobList}
|    $missing = @(@(@{ N = 'Get-SIBlobContent'; F = $getFn }, @{ N = 'Set-SIBlobContent'; F = $setFn }, @{ N = 'Get-SIBlobList'; F = $listFn }) | Where-Object { -not $_.F } | ForEach-Object { $_.N }) -join ', '
|    if ($missing) {
|        $fail = { param($Path, $Text) throw ("the state store cannot be read or written in this job ({0} not loaded from engine\_shared\SI-AzRest.ps1)" -f $missing) }.GetNewClosure()
|        return [pscustomobject]@{ Read = $fail; Write = $fail; List = $fail; Claim = $fail }
|    }
|    [pscustomobject]@{
|        # -AllowMissing: a marker that is not there yet (the records marker, a part, closed.json) is $null -- not an error
|        # raised and logged on every poll
|        Read  = { param($Path) try { $b = & $getFn -Account $acc -Container $con -Blob $Path -AllowMissing; if (-not $b -or $b.Length -eq 0) { $null } else { [Text.Encoding]::UTF8.GetString($b) } } catch { if ("$($_.Exception.Message)" -match '404|BlobNotFound|ContainerNotFound|not found') { $null } else { throw } } }.GetNewClosure()
|        Write = { param($Path, $Text) $null = & $setFn -Account $acc -Container $con -Blob $Path -Bytes ([Text.Encoding]::UTF8.GetBytes([string]$Text)) -ContentType 'application/json' }.GetNewClosure()
|        List  = { param($Prefix) try { @(& $listFn -Account $acc -Container $con -Prefix $Prefix | ForEach-Object { $_.Name }) } catch { if ("$($_.Exception.Message)" -match '404|ContainerNotFound|not found') { @() } else { throw } } }.GetNewClosure()
|        # create-only: $true for the one writer that created it, $false when it already exists (409 / 412)
|        Claim = { param($Path, $Text) try { $null = & $setFn -Account $acc -Container $con -Blob $Path -Bytes ([Text.Encoding]::UTF8.GetBytes([string]$Text)) -ContentType 'application/json' -IfNoneMatch; $true } catch { if ("$($_.Exception.Message)" -match '409|412|BlobAlreadyExists|ConditionNotMet') { $false } else { throw } } }.GetNewClosure()
|    }
|}
|
|function Get-SICollectProgress {
|    <#
|        PURE. Where a Collect step stands: the manifest + the part markers -> @{ State; Parts; Done; Failed; Missing; Text }.
|          State  waiting     no manifest yet (the producer is still discovering)
|                 running     parts still open, within the timeout
|                 succeeded   every part done
|                 failed      every part marked, one or more failed (they are named)
|                 incomplete  parts still unmarked after -TimeoutMinutes since the manifest -- never quietly smaller
|        A failed part ends the step as soon as nothing is still running (no wait for the timeout).
|    #>
|    param([AllowNull()]$Manifest, [AllowEmptyCollection()][object[]]$Markers = @(), [datetime]$Now = [datetime]::UtcNow, [int]$TimeoutMinutes = 180,
|          # the run's records marker (Read-SICollectRecordsMarker): waited for when the manifest says RecordsHandover
|          [AllowNull()]$Records)
|    if ($null -eq $Manifest) { return [pscustomobject]@{ State = 'waiting'; Parts = 0; Done = 0; Failed = @(); Missing = @(); Text = 'discovering -- the parts are not written yet' } }
|    $n = [int]$Manifest.Parts
|    $byPart = @{}
|    foreach ($m in @($Markers)) { if ($null -ne $m -and $null -ne $m.Part -and [int]$m.Part -ge 0 -and [int]$m.Part -lt $n) { $byPart[[int]$m.Part] = $m } }
|    $done = @($byPart.Values | Where-Object { $_.State -eq 'done' }).Count
|    $failed = @($byPart.Values | Where-Object { $_.State -eq 'failed' } | Sort-Object { [int]$_.Part })
|    $missing = @(0..($n - 1) | Where-Object { -not $byPart.ContainsKey($_) })
|    $failText = (@($failed | ForEach-Object { 'part {0}: {1}' -f ([int]$_.Part + 1), $(if ($_.Reason) { $_.Reason } else { 'no reason given' }) })) -join '; '
|    $handover = [bool]($Manifest.PSObject.Properties['RecordsHandover'] -and [bool]$Manifest.RecordsHandover)
|    $since = $null; try { $since = [datetime]::Parse([string]$Manifest.WrittenUtc, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal) } catch { }
|    # -TimeoutMinutes 0 (what the pipeline passes since 2026-10-13): no give-up on elapsed time -- never 'incomplete'
|    $timedOut = [bool]($TimeoutMinutes -gt 0 -and $since -and ($Now.ToUniversalTime() - $since).TotalMinutes -gt $TimeoutMinutes)
|    if ($missing.Count -eq 0 -and $handover) {
|        # every part is marked; the step ends when the last worker has published the run's records
|        if ($null -eq $Records) {
|            if ($timedOut) {
|                return [pscustomobject]@{ State = 'incomplete'; Parts = $n; Done = $done; Failed = $failed; Missing = @()
|                    Text = ('{0} of {1} part(s) done, but the records were not published after {2} minutes -- the collection is INCOMPLETE{3}' -f $done, $n, $TimeoutMinutes, $(if ($failText) { '; ' + $failText } else { '' })) }
|            }
|            return [pscustomobject]@{ State = 'running'; Parts = $n; Done = $done; Failed = $failed; Missing = @(); Text = ('{0} of {1} part(s) done -- publishing the records' -f $done, $n) }
|        }
|        if ([string]$Records.State -eq 'failed') {
|            return [pscustomobject]@{ State = 'failed'; Parts = $n; Done = $done; Failed = $failed; Missing = @()
|                Text = ('{0} of {1} part(s) done; {2}{3}' -f $done, $n, [string]$Records.Reason, $(if ($failText) { '; ' + $failText } else { '' })) }
|        }
|    }
|    if ($missing.Count -eq 0) {
|        if ($failed.Count) { return [pscustomobject]@{ State = 'failed'; Parts = $n; Done = $done; Failed = $failed; Missing = @(); Text = ('{0} of {1} part(s) done, {2} failed -- {3}' -f $done, $n, $failed.Count, $failText) } }
|        return [pscustomobject]@{ State = 'succeeded'; Parts = $n; Done = $done; Failed = @(); Missing = @(); Text = ('all {0} part(s) done' -f $n) }
|    }
|    if ($timedOut) {
|        $miss = (@($missing | Select-Object -First 10 | ForEach-Object { $_ + 1 })) -join ', '
|        return [pscustomobject]@{ State = 'incomplete'; Parts = $n; Done = $done; Failed = $failed; Missing = $missing
|            Text = ('{0} of {1} part(s) done; part(s) {2}{3} not finished after {4} minutes -- the collection is INCOMPLETE{5}' -f $done, $n, $miss, $(if ($missing.Count -gt 10) { ' ...' } else { '' }), $TimeoutMinutes, $(if ($failText) { '; ' + $failText } else { '' })) }
|    }
|    [pscustomobject]@{ State = 'running'; Parts = $n; Done = $done; Failed = $failed; Missing = $missing
|        Text = ('{0} of {1} part(s) done{2}' -f $done, $n, $(if ($failed.Count) { ', {0} failed' -f $failed.Count } else { '' })) }
|}
|
|# #720 (live 2026-10-16, the large ring-1 install: 195,524 devices in 16 parts) -- "[producer] the parts could not be
|# queued: OutOfMemoryException", six times, while the run-health END said "success": the engine wrote its END before the
|# container handed the parts over, and the hand-over's failure only set the exit code. A hand-over that fails now ENDS THE
|# RUN NOT COMPLETE: a second END record (error, with the out-of-memory class si-col-0501 when it was memory -- the update's
|# size rule reads it and raises the job one band), and every part the workers will never get is marked failed, so the
|# pipeline ends the step at once and the last worker's records never close the collection as complete.
|function Get-SICollectHandoverFailure {
|    <#
|        PURE. What a failed hand-over means. -Where: producer (the parts could not be queued), discover (a discovery child
|        could not hand its run to the parts), part (a part's records were not handed over). -ErrorText: the exception's
|        message. -Parts / -Queued: how many parts the run has and how many messages went out before the failure;
|        -ManifestWritten: the pipeline already follows the run (then the parts not queued get a FAILED marker).
|        Returns @{ OutOfMemory; Code ('si-col-0501' or ''); ExitReason ('error'); Text; FailParts (part indexes) }.
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [AllowEmptyString()][string]$ErrorText = '',
|          [Parameter(Mandatory)][ValidateSet('producer', 'discover', 'part')][string]$Where,
|          [int]$Parts = 0, [int]$Queued = 0, [int]$Part = -1, [switch]$ManifestWritten)
|    $err = ("$ErrorText" -replace '\s+', ' ').Trim()
|    if ($err.Length -gt 400) { $err = $err.Substring(0, 397) + '...' }
|    $oom = [bool]($err -match '(?i)OutOfMemory|out of memory|Insufficient memory|si-col-0501')
|    $code = if ($oom) { 'si-col-0501' } else { '' }
|    $why = if ($oom) { 'si-col-0501: out of memory' } else { 'the hand-over failed' }
|    $e = $Engine.ToLowerInvariant()
|    $what = switch ($Where) {
|        'producer' { 'The parts of this {0} collection could not be handed to its workers' -f $e }
|        'discover' { 'The discovered {0} run could not be handed to its parts' -f $e }
|        'part'     { 'Part {0} of this {1} collection could not hand its records over' -f $(if ($Part -ge 0) { $Part + 1 } else { '?' }), $e }
|    }
|    $text = '{0} ({1}) -- this {2} collection is NOT COMPLETE and stays on its last good collection; nothing in it is read as removed: {3}' -f $what, $why, $e, $(if ($err) { $err } else { 'no reason was given' })
|    $fail = @()
|    if ($Where -eq 'producer' -and $ManifestWritten -and $Parts -gt 0) {
|        $from = [Math]::Max(0, [Math]::Min($Queued, $Parts))
|        if ($from -lt $Parts) { $fail = @($from..($Parts - 1)) }
|    }
|    [pscustomobject]@{ OutOfMemory = $oom; Code = $code; ExitReason = 'error'; Text = $text; FailParts = $fail }
|}
|
|function Write-SICollectHandoverFailure {
|    <#
|        The parts a failed hand-over leaves without a worker (-Failure.FailParts) get a FAILED marker with the reason, so
|        the pipeline's step ends failed at once and the last worker's records are published without closing the collection.
|        -RunId: the manifest's run (the producer's execution).
|        When that leaves every part marked (nothing was queued, or the queued workers have all finished already) no worker
|        is left to end the run's records: this process takes the run's records claim and writes a FAILED records marker with
|        the reason (Invoke-SICollectRecordsIfLast) -- nothing is published, the collection stays on its last good state and
|        the step ends failed instead of waiting for ever. Never throws: @{ Written; Records ('' | failed | not-last |
|        claimed-elsewhere | no-handover); Why }.
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][string]$RunId,
|          [Parameter(Mandatory)]$Failure, [string]$Worker = '')
|    $n = 0; $why = ''; $rec = ''
|    foreach ($i in @($Failure.FailParts)) {
|        try {
|            Write-SICollectPartMarker -Store $Store -Engine $Engine -RunId $RunId -Marker (New-SICollectPartMarker -Part ([int]$i) -State failed -Reason ([string]$Failure.Text) -Worker $Worker)
|            $n++
|        } catch { if (-not $why) { $why = $_.Exception.Message } }
|    }
|    if ($n -gt 0) {
|        $reason = [string]$Failure.Text
|        try { $rec = [string](Invoke-SICollectRecordsIfLast -Store $Store -Engine $Engine -RunId $RunId -Worker $Worker -Publish { param($PartsFailed) throw $reason }) }
|        catch { if (-not $why) { $why = $_.Exception.Message } }
|    }
|    [pscustomobject]@{ Written = $n; Records = $rec; Why = $why }
|}
|
|function Close-SICollectRunsOf {
|    <#
|        #882 -- A STEP THE PIPELINE ENDED LEAVES NO RUN BEHIND FOR ITS WORKERS (live 2026-10-22, internal: the pipeline closed
|        the Detailed Risk Analysis step Interrupted at 09:40Z, and a queue worker of it went on querying until 10:30 and wrote
|        the remembered slice count the next run used). The pipeline marks the runs of the step's producer CLOSED in the state
|        store (collect/<engine>/<runId>/closed.json, the mark the Risk Analysis queue workers read: RA-ScaleOut.ps1): a
|        worker then discards every message of that run and writes nothing for it, also a worker the queue scaler starts later.
|        Which runs: those whose manifest names -ProducerExecution (the step's own execution -- exact); without it, those
|        written at or after -SinceUtc (5 minutes earlier, the clocks' slack); with neither, none (never every run).
|        A run already closed is left as it is. Never throws: @{ Closed (run ids); Why ('' or what could not be done) }.
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Engine, [AllowEmptyString()][string]$ProducerExecution = '',
|          $SinceUtc = $null, [string]$Why = 'the pipeline ended this step', [datetime]$Now = [datetime]::UtcNow)
|    $closed = New-Object System.Collections.Generic.List[string]
|    $err = ''
|    $exec = ([string]$ProducerExecution).Trim()
|    $since = $null; if ($SinceUtc) { try { $since = ([datetime]$SinceUtc).ToUniversalTime().AddMinutes(-5) } catch { $since = $null } }
|    if (-not $exec -and $null -eq $since) { return [pscustomobject]@{ Closed = @(); Why = 'neither the producer''s execution nor the step''s start is known -- no run is closed' } }
|    try {
|        $prefix = 'collect/{0}/' -f $Engine.ToLowerInvariant()
|        $runs = @{}
|        foreach ($p in @(& $Store.List $prefix)) {
|            if (-not $p) { continue }
|            $rest = ([string]$p).Substring([Math]::Min($prefix.Length, ([string]$p).Length))
|            $id = ($rest -split '/', 2)[0]
|            if (-not $id) { continue }
|            if (-not $runs.ContainsKey($id)) { $runs[$id] = @{ Manifest = $false; Closed = $false } }
|            if ($rest -eq "$id/manifest.json") { $runs[$id].Manifest = $true }
|            if ($rest -eq "$id/closed.json") { $runs[$id].Closed = $true }
|        }
|        foreach ($id in @($runs.Keys | Sort-Object)) {
|            if (-not $runs[$id].Manifest -or $runs[$id].Closed) { continue }
|            $m = $null
|            try { $t = & $Store.Read ('{0}{1}/manifest.json' -f $prefix, $id); if (-not [string]::IsNullOrWhiteSpace([string]$t)) { $m = $t | ConvertFrom-Json } } catch { $m = $null }
|            if ($null -eq $m) { continue }
|            $mine = $false
|            $pe = if ($m.PSObject.Properties['ProducerExecution']) { ([string]$m.ProducerExecution).Trim() } else { '' }
|            if ($exec) { $mine = ($pe -and [string]::Equals($pe, $exec, [System.StringComparison]::OrdinalIgnoreCase)) }
|            elseif ($m.PSObject.Properties['WrittenUtc'] -and $m.WrittenUtc) {
|                # (PowerShell 7's ConvertFrom-Json already reads an ISO text as a [datetime])
|                if ($m.WrittenUtc -is [datetime]) { $mine = (([datetime]$m.WrittenUtc).ToUniversalTime() -ge $since) }
|                else {
|                    $w = [datetime]::MinValue
|                    if ([datetime]::TryParse([string]$m.WrittenUtc, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::AdjustToUniversal, [ref]$w)) { $mine = ($w -ge $since) }
|                }
|            }
|            if (-not $mine) { continue }
|            & $Store.Write ('{0}{1}/closed.json' -f $prefix, $id) (ConvertTo-Json -InputObject ([ordered]@{ ClosedUtc = $Now.ToUniversalTime().ToString('o'); Why = $Why }) -Compress)
|            $closed.Add($id)
|        }
|    } catch { $err = [string]$_.Exception.Message }
|    [pscustomobject]@{ Closed = $closed.ToArray(); Why = $err }
|}
|
|# =====================================================================================================================
|#  THE RUN REPORT OF A RUN IN PARTS (2026-10-29): the producer reports its END before its hand-over, and each part its own,
|#  so an ok from any of them is no proof that the collection is whole (a failed hand-over's ticket was once closed by a
|#  later ok). Those executions no longer report the job's ok (SuppressJobOk); the execution that publishes the records does.
|# =====================================================================================================================
|function Get-SICollectRunStepsOk {
|    <# PURE. Every step of a whole collection run in parts, in order -- the stages of the engine (Invoke-SIEngineRun.ps1's
|       list: the azure engine adds 'recommendations'), then the hand-over and the records. #>
|    param([Parameter(Mandatory)][string]$Engine)
|    $st = @('schedule', 'discover', 'collect', 'enrich', 'classify', 'profile', 'reconcile', 'output', 'tagging')
|    if ($Engine -eq 'azure') { $st += 'recommendations' }
|    [string[]]@($st + @('handover', 'records'))
|}
|
|function Get-SICollectRunReport {
|    <#
|        PURE. What the execution that published a run's records reports for the job: -RecordsState 'published' | 'failed'
|        (Invoke-SICollectRecordsIfLast), -FailedParts (parts marked failed). Returns @{ RunContext; ExitReason; Message } or
|        $null (nothing more to report: a failed part has reported itself, and its collection is not whole).
|          every part done, the records published   success, StepsOk = every step (Get-SICollectRunStepsOk)
|          the records not all published            error, FailedStep 'records'
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)][string]$RecordsState, [int]$FailedParts = 0, [string]$RunId = '', $StartedAt)
|    $start = if ($StartedAt) { ([datetime]$StartedAt).ToUniversalTime() } else { [datetime]::UtcNow }
|    $ctx = [pscustomobject]@{ RunId = $RunId; Engine = $Engine; ShardIndex = 0; ShardCount = 1; CollectionTime = $start; StartedAt = $start }
|    if ($RecordsState -eq 'failed') {
|        $ctx | Add-Member -NotePropertyName FailedStep -NotePropertyValue 'records'
|        return [pscustomobject]@{ RunContext = $ctx; ExitReason = 'error'; Message = ('the records of this {0} collection were not all published -- it is not complete and stays on its last good collection' -f $Engine) }
|    }
|    if ($RecordsState -ne 'published' -or $FailedParts -gt 0) { return $null }
|    $ctx | Add-Member -NotePropertyName StepsOk -NotePropertyValue (Get-SICollectRunStepsOk -Engine $Engine)
|    [pscustomobject]@{ RunContext = $ctx; ExitReason = 'success'; Message = '' }
|}
'@ }
$__siSupportFiles['Update-SecurityInsight.ps1'] = @{ Sha256 = '92ea9cd458e16ddc3508af63b000fb437e0f26b99de2eb78cbcb61b2405ff550'; Text = @'
|<#
|.SYNOPSIS
|    Updates this SecurityInsight install to the version its update ring approves -- VM and container installs alike.
|
|.DESCRIPTION
|    The Community edition's update. It needs no git.
|
|      1. Reads Invardia's SIGNED Community manifest for this install's ring (3 = broad, the default;
|         2 = early release -- set it in config\update.custom.json: { "ring": 2 }).
|      2. Verifies it: signed by the SecurityInsight update key this version ships with, for this product and this ring, of
|         the major version installed (a new major version is a new installation, never an update),
|         never older than what this install already applied, and not held (a release can ask for a manual step first, or
|         need a newer starting version -- it then says so and waits).
|      3. Downloads the release zip and checks it is exactly the signed one (size and SHA-256).
|      4. Applies it: pauses this install's scheduled tasks (a running engine = the update waits for the next run), keeps a
|         backup, writes the release, checks the result, and restores the backup on any failure. Your *.custom.* files,
|         logs, output and data are never touched. On a container install the new release then rebuilds the engine image
|         in your registry and rolls the jobs (and restores the previous image on failure).
|
|    Running it updates when -- and only when -- your ring has a newer release. Schedule it, or let the job flow run it.
|
|.PARAMETER Ring
|    Use this ring for this run only (2 or 3). The lasting setting is config\update.custom.json.
|
|.PARAMETER AcceptManualStep
|    A release that asks for a manual step is held until you have done it; then re-run with the sequence number it printed.
|
|.PARAMETER ShowReleaseNotes
|    After an update, print the release notes of the new version.
|
|.PARAMETER SkipContainerUpdate
|    Update the files only; leave the container jobs where they are.
|
|.PARAMETER Apply
|    Accepted for compatibility; running the command always applies what the ring approves.
|
|.EXAMPLE
|    cd C:\SecurityInsight
|    .\Update-SecurityInsight.ps1
|
|.NOTES
|    Status: v2.2.152 -- new. 3.0.0 (and the 2.2 hand-over release) -- the signed, ring-gated update channel; no git.
|    Developed by Morten Knudsen, Microsoft MVP | https://mortenknudsen.net
|#>
|[CmdletBinding()]
|param(
|    [Parameter()] [ValidateSet(0, 2, 3)] [int]$Ring = 0,
|    [Parameter()] [long]$AcceptManualStep = -1,
|    [Parameter()] [switch]$ShowReleaseNotes,
|    [Parameter()] [switch]$SkipContainerUpdate,
|    [Parameter()] [switch]$Apply,
|    [Parameter(DontShow)] [string]$BaseUrl
|)
|
|$ErrorActionPreference = 'Stop'
|$repoRoot = $PSScriptRoot
|
|Write-Host ''
|Write-Host '===================================================================' -ForegroundColor Cyan
|Write-Host ' SecurityInsight Updater' -ForegroundColor Cyan
|Write-Host '===================================================================' -ForegroundColor Cyan
|
|$client = [IO.Path]::Combine($repoRoot, 'engine', '_shared', 'SI-CommunityUpdate.ps1')
|if (-not (Test-Path -LiteralPath $client)) {
|    Write-Host '  [ERR]  the update client (engine\_shared\SI-CommunityUpdate.ps1) is missing -- download the latest release zip from https://github.com/KnudsenMorten/SecurityInsight/releases' -ForegroundColor Red
|    exit 1
|}
|. $client
|
|$p = @{ Root = $repoRoot; Ring = $Ring; AcceptManualStepSequence = $AcceptManualStep; SkipContainerUpdate = $SkipContainerUpdate }
|if ($BaseUrl) { $p.BaseUrl = $BaseUrl }
|$r = Invoke-SICommunityUpdate @p
|
|foreach ($l in $r.Log) {
|    $c = if ($l -match '^(refused|rolledback|error|network):|^WARNING') { 'Red' } elseif ($l -match '^(hold|waiting):|^note:') { 'Yellow' } elseif ($l -match '^(updated|current|none):') { 'Green' } else { 'Gray' }
|    Write-Host ("  {0}" -f $l) -ForegroundColor $c
|}
|
|if ($r.Action -eq 'updated' -and $ShowReleaseNotes) {
|    $rn = [IO.Path]::Combine($repoRoot, 'RELEASENOTES.md')
|    if (Test-Path -LiteralPath $rn) {
|        Write-Host ''
|        Write-Host ("  release notes since v{0}:" -f $r.FromVersion) -ForegroundColor Gray
|        $emit = $false
|        foreach ($l in [IO.File]::ReadAllLines($rn)) {
|            if ($r.FromVersion -and $l -match ('^## v' + [regex]::Escape($r.FromVersion) + '\b')) { break }
|            $emit = $emit -or ($l -match '^## v')
|            if ($emit) { Write-Host "    $l" -ForegroundColor Gray }
|        }
|    }
|}
|if ($r.Action -eq 'updated') { Write-Host ("  Your scheduled engines run v{0} on their next cycle." -f $r.ToVersion) -ForegroundColor Gray }
|Write-Host ''
|if (@('refused', 'rolledback', 'error', 'network') -contains $r.Action) { exit 1 }
|exit 0
'@ }
$__siSupportFiles['engine/_shared/SI-CommunityUpdate.ps1'] = @{ Sha256 = '344256f23f37d5b39aed0a42ecad9dd410c4099400ebc5dc715176f855f03bc4'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight Community -- THE UPDATE CLIENT (framework UPDATE-1, SI #270).
|
|    A Community install updates from Invardia's signed Community channel, per RING -- never by "whatever is on main":
|
|      1. READ the manifest of THIS install's ring (owner + Invardia + PIM, 2026-10-28 -- the same route PIM's Community
|         edition reads): GET https://invardia.com/api/updates/securityinsight/community/<ring>, ANONYMOUS (no install key,
|         no code, no licence); 200 = { manifest, manifestB64, signature, keyId, downloadUrl } (the SAME shape and verifier as
|         a Pro install's answer), 204 = nothing released to the ring yet, 404 = no such ring. (The channel.json file on an
|         update-channel branch of the public repository is RETIRED, 2026-10-28.)
|      2. VERIFY the entry for THIS install's ring (engine/_shared/InvardiaUpdate.verify.ps1, byte-identical to the framework
|         verifier): RS256 over the base64-DECODED manifest bytes against the EMBEDDED trusted keys; product securityinsight,
|         kind community, a ring the manifest names IS this install's ring; the same MAJOR version as installed; the
|         sequence is not lower than the one applied here (no replay; a rollback is a NEW, higher sequence naming an older
|         version); manualStep / minFromVersion HOLD with the reason; the download link is https.
|      3. DOWNLOAD the release zip (no git needed) and prove it is the signed one: zip, the signed size AND the signed SHA-256.
|      4. APPLY BY HOST:
|           VM        -- the scheduled SecurityInsight tasks are paused (a running engine = wait for the next run), every
|                        file the release replaces or removes is backed up, the release files are written (*.custom.*, logs,
|                        output, data and this client's own state are NEVER touched), the install is health-checked
|                        (version, every file's hash, every script parses, the client is still there), and on ANY failure
|                        the backup is restored and verified. The tasks are resumed in every case.
|           container -- after the files, the NEW release's setup\Invoke-SIContainerUpdate.ps1 -Apply builds the image in
|                        your registry, rolls the jobs, verifies, and restores the previous image itself on failure; the
|                        files are then rolled back too, so the folder and the containers never disagree.
|      5. RECORD the applied sequence + version (.si-update\state.json) so an older manifest is never applied again.
|
|    🔒 Nothing here runs git, and nothing here trusts a key it did not ship with. Every call that leaves the process goes
|    through -Seams, so the tests run offline. PS 5.1 safe. NEVER THROWS: every outcome is a result with an Action + Reason.
|    There is no dry run (#276): running the update updates when -- and only when -- the channel for this ring says so.
|#>
|
|# NO Set-StrictMode HERE -- a dot-sourced file that sets it leaks into the caller's scope.
|
|. ([IO.Path]::Combine($PSScriptRoot, 'InvardiaUpdate.verify.ps1'))
|# The ONE trust list (UPDATE-1.2): the keys embedded in the framework verifier -- captured here, passed explicitly.
|$script:SICommunityTrustedKeys = @($script:InvardiaUpdateTrustedKeys)
|
|$script:SICommunityUpdateProduct        = 'securityinsight'
|$script:SICommunityUpdateKind           = 'community'
|# Invardia's Community route (rings 2 and 3); the signed manifest names the archive, which must be an https link
|$script:SICommunityUpdateBaseUrl        = 'https://invardia.com'
|$script:SICommunityUpdateDownloadPrefix = 'https://'
|$script:SICommunityUpdateRings          = @(2, 3)
|$script:SICommunityUpdateDefaultRing    = 3
|$script:SICommunityUpdateStateFolder    = '.si-update'
|# The files that carry the update itself: a release without them would strand every install that takes it.
|$script:SICommunityUpdateClientFiles    = @('Update-SecurityInsight.ps1', 'engine/_shared/SI-CommunityUpdate.ps1', 'engine/_shared/InvardiaUpdate.verify.ps1')
|# The files earlier releases shipped that a release no longer has, with the SHA-256 of every shipped version -- carried BY
|# the release being applied. The FIRST update by this client (no installed-files list yet) removes such a file only when it
|# is byte for byte a shipped version: a changed copy is kept, a customer file is never on the list.
|$script:SICommunityRetiredManifest      = 'engine/_shared/SI-PreviousReleaseFiles.locked.json'
|# Files only the PRO package carries (Get-SICommunityInstallKind): a folder with any of them is never updated from the
|# community channel -- that would replace SecurityInsight Pro with the public edition.
|$script:SICommunityProOnlyMarkers       = @('setup/_shared/SI-GuidedInstallPro.ps1', 'engine/_shared/SI-InvardiaUpdate.ps1', 'engine/asset-cmdb/Invoke-SICmdb.ps1')
|
|# =====================================================================================================================
|#  Pure helpers
|# =====================================================================================================================
|function ConvertTo-SICommunityRelPath {
|    <# PURE. A relative path in one form: forward slashes, no leading slash. #>
|    param([AllowEmptyString()][string]$Path)
|    "$Path".Replace('\', '/').TrimStart('/')
|}
|
|function Test-SICommunityCustomerPath {
|    <#
|        PURE. TRUE for a path the CUSTOMER owns -- never written, replaced, removed or backed up by an update:
|        any *.custom.* file (a shipped *.custom.sample.* is the product's), the run output folders (logs, output, data,
|        staging), the git folder, this client's own state, and config\asset-tagging.config.json.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$RelPath)
|    $p = ConvertTo-SICommunityRelPath $RelPath
|    if (-not $p) { return $true }
|    $parts = @($p -split '/')
|    $first = $parts[0].ToLowerInvariant()
|    if (@('.git', '.si-update', 'logs', 'output', 'data', 'staging') -contains $first) { return $true }
|    $leaf = $parts[-1]
|    if ($leaf -match '(?i)\.custom\.' -and $leaf -notmatch '(?i)\.custom\.sample\.') { return $true }
|    if ($leaf -match '(?i)\.corrupted$') { return $true }
|    if ($p -ieq 'config/asset-tagging.config.json') { return $true }
|    $false
|}
|
|function Get-SICommunityInstallKind {
|    <#
|        Which update path owns this folder?
|          community -- the public edition: this client updates it.
|          sync      -- a SOLUTIONS\SecurityInsight folder of an AutomateIT tree: Sync-AutomateIT updates it (ring 1 and the
|                       internal rings live in the framework's release map, not here).
|          private   -- the private payload (a Pro-only file present, $SICommunityProOnlyMarkers): the Pro updater / the sync updates it. The
|                       community channel would replace it with the public edition, so it is never applied here.
|    #>
|    param([Parameter(Mandatory)][string]$Root)
|    $parent = Split-Path -Parent $Root
|    if ($parent -and (Split-Path -Leaf $parent) -ieq 'SOLUTIONS') {
|        $top = Split-Path -Parent $parent
|        if ($top -and ((Test-Path -LiteralPath ([IO.Path]::Combine($top, 'bootstrap', 'Sync-AutomateIT.json'))) -or (Test-Path -LiteralPath ([IO.Path]::Combine($top, 'sync'))))) { return 'sync' }
|    }
|    # The private payload's markers: files ONLY the Pro package carries -- its guided-install steps, its Invardia update
|    # client, the ServiceNow CMDB connector. NOT a LICENSE-* file or an engine\pro-* folder any more: since 2026-10-27
|    # (SI #750) the Community edition ships LICENSE-PRO (the paid web pages it carries) and engine\pro-settings /
|    # engine\pro-data (its database), so those markers would have stopped every Community install from updating.
|    foreach ($m in $script:SICommunityProOnlyMarkers) {
|        # one segment at a time: [IO.Path]::Combine(object[]) binds to the wrong overload in PowerShell
|        $p = $Root; foreach ($seg in @($m -split '/')) { $p = [IO.Path]::Combine($p, $seg) }
|        if (Test-Path -LiteralPath $p) { return 'private' }
|    }
|    'community'
|}
|
|function Test-SICommunityMajorVersion {
|    <# PURE. '' when the release has the installed MAJOR version, else the reason (owner 2026-10-28: no update ever crosses a
|       major version; an installed version that cannot be read fails closed). #>
|    param([AllowEmptyString()][AllowNull()][string]$Installed, [AllowEmptyString()][AllowNull()][string]$Release)
|    $maj = { param($v) $m = [regex]::Match("$v".Trim(), '^v?(\d+)\.'); if ($m.Success) { [int]$m.Groups[1].Value } else { -1 } }
|    $i = & $maj $Installed; $r = & $maj $Release
|    if ($r -lt 0) { return ("the release names no readable version ('{0}')" -f $Release) }
|    if ($i -lt 0) { return ("the installed version cannot be read ('{0}'), so a release of another major version cannot be ruled out" -f $Installed) }
|    if ($i -ne $r) { return ("the release is SecurityInsight {0}, another major version than the installed {1} -- a new major version is installed beside the old one, never as an update" -f $Release, $Installed) }
|    ''
|}
|
|function Get-SICommunityRunningVersion {
|    param([Parameter(Mandatory)][string]$Root)
|    $f = [IO.Path]::Combine($Root, 'VERSION')
|    if (-not (Test-Path -LiteralPath $f)) { return '' }
|    "$([IO.File]::ReadAllText($f))".Trim().TrimStart([char]0xFEFF)
|}
|
|function Test-SICommunityReleasePayload {
|    <#
|        PURE over a folder. Would the update clients take this extracted release (-PayloadRoot) as -Version? Its VERSION is
|        -Version and it carries every file in -RequiredFiles (relative, '/'; default: the update client's own files). The
|        same rules the clients apply after the download (Invoke-SICommunityUpdate, the container updater); the publisher
|        checks the public zip with them before Invardia registers it. Returns @{ Ok; Version; Missing; Reason }.
|    #>
|    param([Parameter(Mandatory)][string]$PayloadRoot, [Parameter(Mandatory)][string]$Version, [string[]]$RequiredFiles = $script:SICommunityUpdateClientFiles)
|    $have = Get-SICommunityRunningVersion -Root $PayloadRoot
|    $missing = New-Object System.Collections.Generic.List[string]
|    foreach ($c in @($RequiredFiles | Where-Object { $_ })) {
|        $full = [string]$PayloadRoot; foreach ($seg in @("$c" -split '/')) { $full = [IO.Path]::Combine($full, $seg) }
|        if (-not (Test-Path -LiteralPath $full -PathType Leaf)) { $missing.Add([string]$c) }
|    }
|    $why = @()
|    if ($have -ne $Version.Trim()) { $why += ("its VERSION says '{0}', the release is {1} -- every install would refuse it" -f $have, $Version.Trim()) }
|    if ($missing.Count) { $why += ("it does not carry {0} -- installing it would end updates for the installs that take it" -f ($missing -join ', ')) }
|    [pscustomobject]@{ Ok = (-not $why.Count); Version = $have; Missing = @($missing.ToArray()); Reason = $(if ($why.Count) { $why -join '; ' } else { ('VERSION {0}, and every file the update clients need' -f $have) }) }
|}
|
|function Get-SICommunityUpdateSettings {
|    <#
|        This install's ring and channel. -Ring (this run only) > config\update.custom.json { "ring": 2 } > 3 (broad).
|        Only Community rings (2, 3) are valid here -- ring 1 is internal and is never read from the public channel.
|        Returns @{ Ring; RingSource; BaseUrl; DownloadPrefix; Problems }. Never throws. config\update.custom.json may also name
|        "baseUrl" (https, or a local folder for an offline rehearsal) instead of Invardia's.
|    #>
|    param([Parameter(Mandatory)][string]$Root, [int]$Ring = 0, [string]$BaseUrl)
|    $problems = New-Object System.Collections.Generic.List[string]
|    $cfg = $null
|    $file = [IO.Path]::Combine($Root, 'config', 'update.custom.json')
|    if (Test-Path -LiteralPath $file) {
|        try { $cfg = [IO.File]::ReadAllText($file).TrimStart([char]0xFEFF) | ConvertFrom-Json -ErrorAction Stop }
|        catch { $problems.Add(('config\update.custom.json cannot be read ({0}) -- ring {1} is used' -f $_.Exception.Message, $script:SICommunityUpdateDefaultRing)) }
|    }
|    $prop = { param($n) if ($cfg -and $cfg.PSObject.Properties[$n] -and "$($cfg.$n)".Trim()) { "$($cfg.$n)".Trim() } else { '' } }
|    $r = $script:SICommunityUpdateDefaultRing; $src = 'default'
|    if ($Ring -gt 0) { $r = $Ring; $src = 'parameter' }
|    elseif (& $prop 'ring') {
|        $n = 0
|        if ([int]::TryParse((& $prop 'ring'), [ref]$n)) { $r = $n; $src = 'config\update.custom.json' }
|        else { $problems.Add(("config\update.custom.json names ring '{0}', which is not a number -- ring {1} is used" -f (& $prop 'ring'), $script:SICommunityUpdateDefaultRing)) }
|    }
|    if ($script:SICommunityUpdateRings -notcontains $r) {
|        $problems.Add(('ring {0} is not a Community ring (2 = early release, 3 = broad) -- ring {1} is used' -f $r, $script:SICommunityUpdateDefaultRing))
|        $r = $script:SICommunityUpdateDefaultRing; $src = 'default'
|    }
|    $url = @($BaseUrl, (& $prop 'baseUrl')) | Where-Object { "$_".Trim() } | Select-Object -First 1
|    if ($url -and "$url" -match '^http://') { $problems.Add(("the update base '{0}' is not https -- Invardia's is used" -f $url)); $url = '' }
|    if (-not $url) { $url = $script:SICommunityUpdateBaseUrl }
|    $prefix = & $prop 'downloadPrefix'
|    if (-not $prefix) { $prefix = $script:SICommunityUpdateDownloadPrefix }
|    [pscustomobject]@{ Ring = [int]$r; RingSource = $src; BaseUrl = "$url".Trim(); DownloadPrefix = $prefix; Problems = $problems.ToArray() }
|}
|
|function Get-SICommunityManifestUri {
|    <# PURE. Invardia's Community route (the same one PIM's Community edition reads, 2026-10-28): <base>/api/updates/securityinsight/community/<ring>. #>
|    param([Parameter(Mandatory)][string]$BaseUrl, [Parameter(Mandatory)][int]$Ring)
|    '{0}/api/updates/{1}/community/{2}' -f $BaseUrl.TrimEnd('/', '\'), $script:SICommunityUpdateProduct, $Ring
|}
|
|function Invoke-SICommunityManifestHttp {
|    <#
|        The one anonymous GET of the Community manifest (the default GetManifest seam). Returns @{ Status; Body } -- an HTTP
|        error is a status, never a throw; no answer at all throws. A base that is a local folder (tests, an offline rehearsal)
|        reads <folder>\<ring>.json: present = 200, absent = 204.
|    #>
|    param([Parameter(Mandatory)][string]$Url)
|    if ($Url -notmatch '^[a-z][a-z0-9+.-]*://' -or $Url -match '^file://') {
|        $p = ($Url -replace '^file:///?', '')
|        $ring = Split-Path -Leaf $p
|        $file = Join-Path (Split-Path -Parent (Split-Path -Parent (Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $p))))) ($ring + '.json')
|        if (Test-Path -LiteralPath $file) { return [pscustomobject]@{ Status = 200; Body = [IO.File]::ReadAllText($file) } }
|        return [pscustomobject]@{ Status = 204; Body = '' }
|    }
|    try { [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 -bor [System.Net.ServicePointManager]::SecurityProtocol } catch { }
|    try {
|        $r = Invoke-WebRequest -Uri $Url -Method Get -UseBasicParsing -TimeoutSec 60 -Headers @{ Accept = 'application/json'; 'Cache-Control' = 'no-cache' } -ErrorAction Stop
|        [pscustomobject]@{ Status = [int]$r.StatusCode; Body = $(if ($r.Content -is [byte[]]) { [Text.Encoding]::UTF8.GetString($r.Content) } else { [string]$r.Content }) }
|    } catch {
|        $resp = $null; try { $resp = $_.Exception.Response } catch { }
|        if ($resp -and $resp.StatusCode) { return [pscustomobject]@{ Status = [int]$resp.StatusCode; Body = '' } }
|        throw
|    }
|}
|
|function Read-SICommunityManifestAnswer {
|    <#
|        PURE. Invardia's answer -> @{ Action; Entry; Reason }: 200 + JSON = 'entry' (the signed answer { manifest, manifestB64,
|        signature, keyId, downloadUrl }, checked by Test-SICommunityChannelEntry); 204 = 'none' (nothing released to the
|        ring yet); 404 = 'refused' (no such ring); 200 without JSON = 'refused'; anything else = 'network' (asked again later).
|    #>
|    param([AllowNull()]$Answer, [int]$Ring)
|    $st = if ($Answer) { [int]$Answer.Status } else { 0 }
|    if ($st -eq 204) { return [pscustomobject]@{ Action = 'none'; Entry = $null; Reason = ("nothing is released to ring {0} yet" -f $Ring) } }
|    if ($st -eq 404) { return [pscustomobject]@{ Action = 'refused'; Entry = $null; Reason = ("Invardia knows no Community ring {0} (404)" -f $Ring) } }
|    if ($st -ne 200) { return [pscustomobject]@{ Action = 'network'; Entry = $null; Reason = ("the Community manifest answered {0}" -f $st) } }
|    $e = $null; try { $e = "$($Answer.Body)".TrimStart([char]0xFEFF) | ConvertFrom-Json -ErrorAction Stop } catch { $e = $null }
|    if (-not $e) { return [pscustomobject]@{ Action = 'refused'; Entry = $null; Reason = 'the Community manifest answer is not JSON' } }
|    [pscustomobject]@{ Action = 'entry'; Entry = $e; Reason = '' }
|}
|function Test-SICommunityChannelEntry {
|    <#
|        PURE (given the keys). Everything about one ring's entry, BEFORE anything is downloaded.
|        Returns @{ Action; Reason; Version; Sequence; Sha256; Size; DownloadUrl; IsRollback; ManualStep }, Action:
|          update   -- verified, newer sequence, nothing holds it
|          current  -- this sequence is applied already (or this install already runs the version the ring names)
|          hold     -- verified, but manualStep (not accepted) or minFromVersion (this install is older) holds it
|          refused  -- signature, product, kind, ring binding, replay, link or shape -- nothing moves
|    #>
|    param([Parameter(Mandatory)]$Entry, [Parameter(Mandatory)][int]$Ring, [AllowNull()][object[]]$TrustedKeys,
|          [long]$AppliedSequence = 0, [AllowEmptyString()][string]$RunningVersion = '', [long]$AcceptManualStepSequence = -1,
|          [AllowEmptyString()][string]$DownloadPrefix = $script:SICommunityUpdateDownloadPrefix,
|          # Invardia signs the ring into every Community manifest, so the update clients no longer pass this: a manifest that
|          # names no ring is refused like one that names another ring. Kept only for callers that read an entry for display.
|          [switch]$RingOptional)
|    $out = { param($a, $why, $v = $null)
|        [pscustomobject]@{ Action = $a; Reason = $why
|            Version = $(if ($v) { $v.version } else { '' }); Sequence = $(if ($v) { [long]$v.sequence } else { [long]0 })
|            Sha256 = $(if ($v) { $v.sha256 } else { '' }); Size = $(if ($v) { [long]$v.size } else { [long]0 })
|            DownloadUrl = $(if ($v) { $v.downloadUrl } else { '' }); IsRollback = $false
|            ManualStep = $(if ($v -and $v.manifest) { "$($v.manifest.manualStep)".Trim() } else { '' }) } }
|    $keys = @($TrustedKeys | Where-Object { $_ })
|    $v = Test-InvardiaManifest -Response $Entry -TrustedKeys $keys -Kind $script:SICommunityUpdateKind -AppliedSequence ([int][Math]::Min([long][int]::MaxValue, [Math]::Max([long]0, $AppliedSequence))) `
|            -RunningVersion $RunningVersion -Product $script:SICommunityUpdateProduct
|    if (-not $v.ok) { return (& $out 'refused' $v.reason) }
|    $m = $v.manifest
|    # The signed ring IS the ring asked for: the ring-2 entry pasted into ring 3's slot must not reach ring 3 early.
|    $signedRing = 0
|    $hasRing = ($m.PSObject.Properties['ring'] -and "$($m.ring)".Trim())
|    if (($hasRing -or -not $RingOptional) -and (-not [int]::TryParse("$($m.ring)", [ref]$signedRing) -or $signedRing -ne $Ring)) {
|        return (& $out 'refused' ("the entry in ring {0}'s slot is signed for ring '{1}' -- refused" -f $Ring, $m.ring))
|    }
|    if ([long]$v.size -le 0) { return (& $out 'refused' 'the signed manifest carries no archive size') }
|    if ("$DownloadPrefix".Trim() -and -not "$($v.downloadUrl)".StartsWith("$DownloadPrefix".Trim(), [StringComparison]::OrdinalIgnoreCase)) {
|        return (& $out 'refused' ("the download link is not on the release host ({0})" -f "$DownloadPrefix".Trim()))
|    }
|    $r = & $out 'update' $v.reason $v
|    if ($v.hold) {
|        $ms = "$($m.manualStep)".Trim()
|        if (-not $ms -or $AcceptManualStepSequence -ne [long]$v.sequence) { $r.Action = 'hold'; $r.Reason = $v.reason; return $r }
|        # The manual step is accepted for exactly this sequence -- minFromVersion still holds on its own.
|        $mf = "$($m.minFromVersion)".Trim()
|        if ($mf -and "$RunningVersion".Trim() -and (Compare-InvardiaReleaseVersion "$RunningVersion" $mf) -lt 0) {
|            $r.Action = 'hold'; $r.Reason = ("HELD -- {0} can only be installed from {1} or later; this install runs {2}" -f $v.version, $mf, $RunningVersion); return $r
|        }
|    }
|    if ($AppliedSequence -gt 0 -and [long]$v.sequence -eq $AppliedSequence) {
|        $r.Action = 'current'; $r.Reason = ("{0} (sequence {1}) is applied already" -f $v.version, $v.sequence); return $r
|    }
|    if ($AppliedSequence -le 0 -and "$RunningVersion".Trim() -and (Compare-InvardiaReleaseVersion "$RunningVersion" $v.version) -eq 0) {
|        $r.Action = 'current'; $r.Reason = ("this install already runs {0}, the version ring {1} names (sequence {2})" -f $v.version, $Ring, $v.sequence); return $r
|    }
|    if ("$RunningVersion".Trim() -and (Compare-InvardiaReleaseVersion $v.version "$RunningVersion") -lt 0) {
|        $r.IsRollback = $true; $r.Reason = ("ROLLBACK: ring {0} names {1} (sequence {2}), older than the {3} this install runs" -f $Ring, $v.version, $v.sequence, $RunningVersion)
|    } else { $r.Reason = ("ring {0} has {1} (sequence {2})" -f $Ring, $v.version, $v.sequence) }
|    $r
|}
|
|function Get-SICommunityFileSha256 {
|    param([Parameter(Mandatory)][string]$Path)
|    $sha = [System.Security.Cryptography.SHA256]::Create(); $fs = [System.IO.File]::OpenRead($Path)
|    try { ([BitConverter]::ToString($sha.ComputeHash($fs))).Replace('-', '').ToLowerInvariant() } finally { $fs.Dispose(); $sha.Dispose() }
|}
|
|function Get-SICommunityShippedFileHash {
|    <#
|        SHA-256 (lower-case hex) of a file's bytes with every CRLF read as LF -- a git checkout with autocrlf and a zip of
|        the same release hash the same. -Bytes or -Path; $null when the file cannot be read.
|    #>
|    param([byte[]]$Bytes, [string]$Path)
|    try {
|        if ($Path) { $Bytes = [IO.File]::ReadAllBytes($Path) }
|        if ($null -eq $Bytes) { return $null }
|        if ([Array]::IndexOf($Bytes, [byte]13) -ge 0) {
|            # Latin-1 maps every byte to one char and back, so this is a byte-exact CRLF -> LF
|            $l1 = [System.Text.Encoding]::GetEncoding(28591)
|            $Bytes = $l1.GetBytes($l1.GetString($Bytes).Replace("`r`n", "`n"))
|        }
|        $sha = [System.Security.Cryptography.SHA256]::Create()
|        try { return ([BitConverter]::ToString($sha.ComputeHash($Bytes))).Replace('-', '').ToLowerInvariant() } finally { $sha.Dispose() }
|    } catch { return $null }
|}
|
|function Get-SICommunityRetiredFiles {
|    <#
|        The files under -Root that earlier releases shipped, that the release being applied (-PayloadRoot, its -Files) no
|        longer has, and that are still EXACTLY a shipped version (the release's retired-files list). Never a customer path.
|        Returns @{ Remove (relative paths); Kept (changed copies left in place) }. No list in the release = nothing.
|    #>
|    param([Parameter(Mandatory)][string]$Root, [Parameter(Mandatory)][string]$PayloadRoot, [Parameter(Mandatory)][AllowEmptyCollection()][string[]]$Files)
|    $res = [pscustomobject]@{ Remove = @(); Kept = @() }
|    $mf = [IO.Path]::Combine($PayloadRoot, $script:SICommunityRetiredManifest)
|    if (-not (Test-Path -LiteralPath $mf)) { return $res }
|    $doc = $null
|    try { $doc = [IO.File]::ReadAllText($mf) | ConvertFrom-Json -ErrorAction Stop } catch { return $res }
|    if (-not $doc -or -not $doc.PSObject.Properties['files'] -or $null -eq $doc.files) { return $res }
|    $set = @{}; foreach ($f in $Files) { $set[(ConvertTo-SICommunityRelPath $f).ToLowerInvariant()] = $true }
|    $remove = New-Object System.Collections.Generic.List[string]; $kept = New-Object System.Collections.Generic.List[string]
|    foreach ($p in $doc.files.PSObject.Properties) {
|        $rel = ConvertTo-SICommunityRelPath $p.Name
|        if (-not $rel -or $rel -match '(^|/)\.\.(/|$)' -or $rel -match ':') { continue }
|        if ($set.ContainsKey($rel.ToLowerInvariant()) -or (Test-SICommunityCustomerPath $rel)) { continue }
|        $local = [IO.Path]::Combine($Root, $rel)
|        if (-not (Test-Path -LiteralPath $local -PathType Leaf)) { continue }
|        $h = Get-SICommunityShippedFileHash -Path $local
|        if ($h -and (@($p.Value) -contains $h)) { $remove.Add($rel) } else { $kept.Add($rel) }
|    }
|    $res.Remove = @($remove.ToArray()); $res.Kept = @($kept.ToArray())
|    $res
|}
|
|function Expand-SICommunityArchive {
|    <#
|        The release zip -> -Destination, entry by entry: either slash, no rooted path, no '..' (a zip-slip entry is refused,
|        and so is the whole archive). Returns the PAYLOAD ROOT: the folder that holds VERSION (the zip's root, or its one
|        top folder). Throws with the reason.
|    #>
|    param([Parameter(Mandatory)][string]$ZipPath, [Parameter(Mandatory)][string]$Destination)
|    Add-Type -AssemblyName System.IO.Compression -ErrorAction SilentlyContinue
|    Add-Type -AssemblyName System.IO.Compression.FileSystem -ErrorAction SilentlyContinue
|    New-Item -ItemType Directory -Force -Path $Destination | Out-Null
|    $destFull = [IO.Path]::GetFullPath($Destination).TrimEnd('\', '/')
|    $zip = [System.IO.Compression.ZipFile]::OpenRead($ZipPath)
|    try {
|        foreach ($e in $zip.Entries) {
|            $name = ConvertTo-SICommunityRelPath $e.FullName
|            if (-not $name -or $name.EndsWith('/')) { continue }
|            if ($name -match '(^|/)\.\.(/|$)' -or $name -match ':' -or $e.FullName -match '^[\\/]') { throw ("the archive holds an unsafe path '{0}' -- refused" -f $e.FullName) }
|            $target = [IO.Path]::GetFullPath([IO.Path]::Combine($destFull, $name.Replace('/', [IO.Path]::DirectorySeparatorChar)))
|            if (-not $target.StartsWith($destFull + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase)) { throw ("the archive holds an unsafe path '{0}' -- refused" -f $e.FullName) }
|            New-Item -ItemType Directory -Force -Path (Split-Path -Parent $target) | Out-Null
|            [System.IO.Compression.ZipFileExtensions]::ExtractToFile($e, $target, $true)
|        }
|    } finally { $zip.Dispose() }
|    if (Test-Path -LiteralPath ([IO.Path]::Combine($destFull, 'VERSION'))) { return $destFull }
|    $tops = @(Get-ChildItem -LiteralPath $destFull -Force)
|    if ($tops.Count -eq 1 -and $tops[0].PSIsContainer -and (Test-Path -LiteralPath ([IO.Path]::Combine($tops[0].FullName, 'VERSION')))) { return $tops[0].FullName }
|    throw 'the archive holds no VERSION file -- it is not a SecurityInsight release'
|}
|
|function Get-SICommunityPayloadFiles {
|    <# The release's files (relative, '/'), customer-owned names left out. #>
|    param([Parameter(Mandatory)][string]$PayloadRoot)
|    $base = [IO.Path]::GetFullPath($PayloadRoot).TrimEnd('\', '/')
|    @(Get-ChildItem -LiteralPath $base -Recurse -File -Force | ForEach-Object { ConvertTo-SICommunityRelPath ($_.FullName.Substring($base.Length)) } |
|        Where-Object { -not (Test-SICommunityCustomerPath $_) } | Sort-Object)
|}
|
|function Test-SICommunityInstallHealth {
|    <#
|        The installed folder after the files were written: VERSION is the signed version; every release file is on disk with
|        the release's hash; every PowerShell file parses; the update client is still there (else the install could never
|        update again). Returns @{ Ok; Reason }.
|    #>
|    param([Parameter(Mandatory)][string]$Root, [Parameter(Mandatory)][string]$PayloadRoot, [Parameter(Mandatory)][string[]]$Files, [Parameter(Mandatory)][string]$Version)
|    $have = Get-SICommunityRunningVersion -Root $Root
|    if ($have -ne $Version) { return [pscustomobject]@{ Ok = $false; Reason = ("VERSION reads '{0}', the release is {1}" -f $have, $Version) } }
|    foreach ($c in $script:SICommunityUpdateClientFiles) {
|        if (-not (Test-Path -LiteralPath ([IO.Path]::Combine($Root, $c)))) { return [pscustomobject]@{ Ok = $false; Reason = ("the update client file {0} is missing" -f $c) } }
|    }
|    foreach ($rel in $Files) {
|        $dst = [IO.Path]::Combine($Root, $rel); $src = [IO.Path]::Combine($PayloadRoot, $rel)
|        if (-not (Test-Path -LiteralPath $dst)) { return [pscustomobject]@{ Ok = $false; Reason = ("{0} is missing after the update" -f $rel) } }
|        if ((Get-SICommunityFileSha256 $dst) -ne (Get-SICommunityFileSha256 $src)) { return [pscustomobject]@{ Ok = $false; Reason = ("{0} is not the release's file after the update" -f $rel) } }
|        if ($rel -match '(?i)\.ps(m|d)?1$') {
|            $tok = $null; $err = $null
|            [void][System.Management.Automation.Language.Parser]::ParseFile($dst, [ref]$tok, [ref]$err)
|            if ($err -and @($err).Count) { return [pscustomobject]@{ Ok = $false; Reason = ("{0} does not parse: {1}" -f $rel, @($err)[0].Message) } }
|        }
|    }
|    [pscustomobject]@{ Ok = $true; Reason = '' }
|}
|
|# =====================================================================================================================
|#  State
|# =====================================================================================================================
|function Get-SICommunityStateDir { param([Parameter(Mandatory)][string]$Root) [IO.Path]::Combine($Root, $script:SICommunityUpdateStateFolder) }
|
|function Read-SICommunityUpdateState {
|    param([Parameter(Mandatory)][string]$Root)
|    $s = [ordered]@{ ring = 0; appliedSequence = [long]0; appliedVersion = ''; appliedUtc = ''; lastCheckUtc = ''; lastAction = ''; lastReason = '' }
|    $f = [IO.Path]::Combine((Get-SICommunityStateDir $Root), 'state.json')
|    if (Test-Path -LiteralPath $f) {
|        try {
|            $j = [IO.File]::ReadAllText($f) | ConvertFrom-Json -ErrorAction Stop
|            foreach ($k in @($s.Keys)) { if ($j.PSObject.Properties[$k] -and $null -ne $j.$k) { $s[$k] = $j.$k } }
|            $n = [long]0; [void][long]::TryParse("$($s.appliedSequence)", [ref]$n); $s.appliedSequence = $n
|        } catch { }
|    }
|    $s
|}
|
|function Write-SICommunityUpdateState {
|    param([Parameter(Mandatory)][string]$Root, [Parameter(Mandatory)]$State)
|    $d = Get-SICommunityStateDir $Root
|    New-Item -ItemType Directory -Force -Path $d | Out-Null
|    [IO.File]::WriteAllText([IO.Path]::Combine($d, 'state.json'), (ConvertTo-Json -InputObject $State -Depth 4))
|}
|
|function Read-SICommunityInstalledFiles {
|    <# The files the last update installed ($null when no update by this client has run yet). #>
|    param([Parameter(Mandatory)][string]$Root)
|    $f = [IO.Path]::Combine((Get-SICommunityStateDir $Root), 'installed-files.txt')
|    if (-not (Test-Path -LiteralPath $f)) { return $null }
|    , @([IO.File]::ReadAllLines($f) | Where-Object { "$_".Trim() } | ForEach-Object { ConvertTo-SICommunityRelPath "$_".Trim() })
|}
|
|# =====================================================================================================================
|#  Seams (default: the real machine) -- every call that leaves the process
|# =====================================================================================================================
|function New-SICommunityUpdateSeams {
|    @{
|        GetManifest = { param($Url) Invoke-SICommunityManifestHttp -Url $Url }
|        Download = { param($Url, $OutFile)
|            try { [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 -bor [System.Net.ServicePointManager]::SecurityProtocol } catch { }
|            Invoke-WebRequest -Uri $Url -OutFile $OutFile -UseBasicParsing -TimeoutSec 600 -ErrorAction Stop | Out-Null }
|        GetTasks = {
|            param($Root)
|            if (-not (Get-Command -Name Get-ScheduledTask -ErrorAction SilentlyContinue)) { return @() }
|            @(Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
|                $a = @($_.Actions)[0]
|                [pscustomobject]@{ TaskPath = [string]$_.TaskPath; TaskName = [string]$_.TaskName; State = [string]$_.State
|                                   Execute = $(if ($a) { [string]$a.Execute } else { '' }); Arguments = $(if ($a) { [string]$a.Arguments } else { '' }) } }) }
|        DisableTask = { param($t) Disable-ScheduledTask -TaskPath $t.TaskPath -TaskName $t.TaskName -ErrorAction Stop | Out-Null }
|        EnableTask  = { param($t) Enable-ScheduledTask -TaskPath $t.TaskPath -TaskName $t.TaskName -ErrorAction Stop | Out-Null }
|        # The NEW release's container step, in a fresh process (the new code, not this process's loaded functions).
|        ContainerUpdate = { param($Root)
|            $hook = [IO.Path]::Combine($Root, 'setup', 'Invoke-SIContainerUpdate.ps1')
|            if (-not (Test-Path -LiteralPath $hook)) { return 0 }
|            $exe = [Diagnostics.Process]::GetCurrentProcess().MainModule.FileName
|            & $exe -NoProfile -ExecutionPolicy Bypass -File $hook -Apply | ForEach-Object { Write-Host "    $_" }
|            $LASTEXITCODE }
|        # Optional extra health check after the files: { param($Root, $Version) } -> @{ Ok; Reason }
|        HealthCheck = $null
|        Now = { [datetime]::UtcNow }
|    }
|}
|
|function Get-SICommunityUpdateTaskPlan {
|    <#
|        PURE. The scheduled tasks of THIS install: under \SecurityInsight\, or whose action names this folder.
|          Self    -- the task that runs this update (Update-SecurityInsight.ps1, or the job flow that runs it as a step):
|                     never a blocker, never paused.
|          Busy    -- another of this install's tasks is RUNNING: an engine mid-run -> the update waits for the next run.
|          Pause   -- Ready tasks, paused while the files are swapped and resumed afterwards (also after a rollback).
|        Disabled tasks are left exactly as they are.
|    #>
|    param([AllowNull()][object[]]$Tasks, [Parameter(Mandatory)][string]$Root)
|    $rootText = [IO.Path]::GetFullPath($Root).TrimEnd('\', '/')
|    $mine = @($Tasks | Where-Object { $_ } | Where-Object {
|        ("$($_.TaskPath)" -like '\SecurityInsight\*') -or ("$($_.Arguments) $($_.Execute)".IndexOf($rootText, [StringComparison]::OrdinalIgnoreCase) -ge 0) })
|    $isSelf = { param($t) "$($t.Arguments) $($t.Execute)" -match '(?i)Update-SecurityInsight\.ps1|Invoke-SIJobFlowRun\.ps1' }
|    [pscustomobject]@{
|        Self  = @($mine | Where-Object { & $isSelf $_ })
|        Busy  = @($mine | Where-Object { -not (& $isSelf $_) -and "$($_.State)" -eq 'Running' })
|        Pause = @($mine | Where-Object { -not (& $isSelf $_) -and "$($_.State)" -eq 'Ready' })
|    }
|}
|
|# =====================================================================================================================
|#  Apply on the VM folder: backup -> write -> health -> (container) -> commit, or restore
|# =====================================================================================================================
|function Invoke-SICommunityFileApply {
|    <#
|        Writes the release (-PayloadRoot, -Files) over -Root. Every file that is replaced or removed is backed up first;
|        files in -PreviousFiles (what the last update installed) that the release no longer has are removed; with no
|        previous list only -RetiredFiles are removed (unchanged copies of files earlier releases shipped,
|        Get-SICommunityRetiredFiles) -- backed up and restored like the rest.
|        Then the health check, then -AfterApply { } -> 0 / exit code (the container step). ANY failure restores the backup,
|        removes what was added, and VERIFIES the restore. Returns @{ Ok; RolledBack; Reason; Added; Replaced; Removed; Kept }.
|    #>
|    param([Parameter(Mandatory)][string]$Root, [Parameter(Mandatory)][string]$PayloadRoot, [Parameter(Mandatory)][string[]]$Files,
|          [Parameter(Mandatory)][string]$Version, [AllowNull()][string[]]$PreviousFiles, [Parameter(Mandatory)][string]$BackupDir,
|          [scriptblock]$HealthCheck, [scriptblock]$AfterApply, [AllowEmptyCollection()][string[]]$RetiredFiles = @())
|    $added = New-Object System.Collections.Generic.List[string]
|    $backed = New-Object System.Collections.Generic.List[string]
|    $removed = New-Object System.Collections.Generic.List[string]
|    $set = @{}; foreach ($f in $Files) { $set[$f.ToLowerInvariant()] = $true }
|    $toRemove = @()
|    if ($null -ne $PreviousFiles) {
|        $toRemove = @($PreviousFiles | Where-Object { -not $set.ContainsKey($_.ToLowerInvariant()) -and -not (Test-SICommunityCustomerPath $_) -and (Test-Path -LiteralPath ([IO.Path]::Combine($Root, $_))) })
|    }
|    $seen = @{}; foreach ($r in $toRemove) { $seen[$r.ToLowerInvariant()] = $true }
|    foreach ($r in @($RetiredFiles)) {
|        $r = ConvertTo-SICommunityRelPath $r
|        if (-not $r -or $seen.ContainsKey($r.ToLowerInvariant()) -or $set.ContainsKey($r.ToLowerInvariant()) -or (Test-SICommunityCustomerPath $r)) { continue }
|        if (Test-Path -LiteralPath ([IO.Path]::Combine($Root, $r))) { $toRemove += $r; $seen[$r.ToLowerInvariant()] = $true }
|    }
|    $res = [pscustomobject]@{ Ok = $false; RolledBack = $false; Reason = ''; Added = 0; Replaced = 0; Removed = 0; Kept = 0 }
|    $restore = {
|        param($why)
|        $problems = New-Object System.Collections.Generic.List[string]
|        foreach ($a in $added) { try { Remove-Item -LiteralPath ([IO.Path]::Combine($Root, $a)) -Force -ErrorAction Stop } catch { $problems.Add($a) } }
|        foreach ($b in $backed) {
|            try {
|                $dst = [IO.Path]::Combine($Root, $b); New-Item -ItemType Directory -Force -Path (Split-Path -Parent $dst) | Out-Null
|                Copy-Item -LiteralPath ([IO.Path]::Combine($BackupDir, $b)) -Destination $dst -Force -ErrorAction Stop
|                if ((Get-SICommunityFileSha256 $dst) -ne (Get-SICommunityFileSha256 ([IO.Path]::Combine($BackupDir, $b)))) { $problems.Add($b) }
|            } catch { $problems.Add($b) }
|        }
|        $res.RolledBack = ($problems.Count -eq 0)
|        $res.Reason = if ($problems.Count -eq 0) { "$why -- the previous version was restored and verified" }
|                      else { "$why -- AND THE RESTORE IS INCOMPLETE for $($problems.Count) file(s) (first: $($problems[0])); the backup is kept in $BackupDir" }
|    }
|    try {
|        New-Item -ItemType Directory -Force -Path $BackupDir | Out-Null
|        foreach ($rel in @($Files) + @($toRemove)) {
|            $dst = [IO.Path]::Combine($Root, $rel)
|            if (Test-Path -LiteralPath $dst) {
|                $bk = [IO.Path]::Combine($BackupDir, $rel); New-Item -ItemType Directory -Force -Path (Split-Path -Parent $bk) | Out-Null
|                Copy-Item -LiteralPath $dst -Destination $bk -Force -ErrorAction Stop
|                $backed.Add($rel)
|            }
|        }
|    } catch { $res.Reason = ("the backup could not be made ({0}) -- nothing was changed" -f $_.Exception.Message); return $res }
|    try {
|        foreach ($rel in $Files) {
|            $dst = [IO.Path]::Combine($Root, $rel)
|            $existed = Test-Path -LiteralPath $dst
|            New-Item -ItemType Directory -Force -Path (Split-Path -Parent $dst) | Out-Null
|            Copy-Item -LiteralPath ([IO.Path]::Combine($PayloadRoot, $rel)) -Destination $dst -Force -ErrorAction Stop
|            if ($existed) { $res.Replaced++ } else { $added.Add($rel) }
|        }
|        foreach ($rel in $toRemove) { Remove-Item -LiteralPath ([IO.Path]::Combine($Root, $rel)) -Force -ErrorAction Stop; $removed.Add($rel) }
|    } catch { & $restore ("writing the release failed ({0})" -f $_.Exception.Message); return $res }
|    $h = Test-SICommunityInstallHealth -Root $Root -PayloadRoot $PayloadRoot -Files $Files -Version $Version
|    if ($h.Ok -and $HealthCheck) { try { $h = & $HealthCheck $Root $Version } catch { $h = [pscustomobject]@{ Ok = $false; Reason = $_.Exception.Message } } }
|    if (-not $h.Ok) { & $restore ("the health check failed: {0}" -f $h.Reason); return $res }
|    if ($AfterApply) {
|        $code = 1
|        try { $code = [int](& $AfterApply) } catch { $code = 1 }
|        if ($code -ne 0) { & $restore ("the container update failed (exit {0}; it restores the containers' previous image itself)" -f $code); return $res }
|    }
|    $res.Ok = $true; $res.Added = $added.Count; $res.Removed = $removed.Count
|    $res
|}
|
|# =====================================================================================================================
|#  The update run
|# =====================================================================================================================
|function Invoke-SICommunityUpdate {
|    <#
|        One update run of a Community install. Returns @{ Action; Reason; Ring; FromVersion; ToVersion; Sequence; Log }.
|        Action: updated | current | none | hold | waiting | refused | network | rolledback | error | not-community.
|        Exit-code meaning for the caller: refused / rolledback / network / error are failures; the rest are not.
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$Root, [int]$Ring = 0, [string]$BaseUrl, [long]$AcceptManualStepSequence = -1,
|          [switch]$SkipContainerUpdate, [System.Collections.IDictionary]$Seams = @{}, [AllowNull()][object[]]$TrustedKeys)
|    $s = New-SICommunityUpdateSeams
|    foreach ($k in @($Seams.Keys)) { $s[$k] = $Seams[$k] }
|    $keys = if ($PSBoundParameters.ContainsKey('TrustedKeys')) { @($TrustedKeys) } else { @($script:SICommunityTrustedKeys) }
|    $log = New-Object System.Collections.Generic.List[string]
|    $Root = [IO.Path]::GetFullPath($Root).TrimEnd('\', '/')
|    $from = Get-SICommunityRunningVersion -Root $Root
|    $res = [pscustomobject]@{ Action = 'error'; Reason = ''; Ring = 0; FromVersion = $from; ToVersion = $from; Sequence = [long]0; Log = $log }
|    $done = { param($a, $why) $res.Action = $a; $res.Reason = $why; $log.Add(("{0}: {1}" -f $a, $why)); $res }
|    $state = $null; $paused = @()
|    try {
|        $kind = Get-SICommunityInstallKind -Root $Root
|        if ($kind -eq 'sync') { return (& $done 'not-community' 'this folder is part of an AutomateIT tree -- Sync-AutomateIT updates it; the community channel is not used here') }
|        if ($kind -eq 'private') { return (& $done 'not-community' 'this folder holds SecurityInsight Pro -- it is updated by the Pro updater (from Invardia) or by Sync-AutomateIT; the community channel would replace it with the public edition') }
|        $cfg = Get-SICommunityUpdateSettings -Root $Root -Ring $Ring -BaseUrl $BaseUrl
|        foreach ($p in $cfg.Problems) { $log.Add("note: $p") }
|        $res.Ring = $cfg.Ring
|        $log.Add(("this install: {0}, ring {1} ({2})" -f $(if ($from) { $from } else { 'unknown version' }), $cfg.Ring, $cfg.RingSource))
|        if (Test-Path -LiteralPath ([IO.Path]::Combine($Root, '.git'))) {
|            $log.Add('note: this folder is also a git clone. This command keeps it current from the signed channel; a scheduled "git pull" here stops working once an update moves it past the public main branch (git then reports local changes) -- remove that scheduled pull.')
|        }
|        $state = Read-SICommunityUpdateState -Root $Root
|        $state.lastCheckUtc = ([datetime](& $s.Now)).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
|
|        # ---- 1. the Community manifest of this ring, from Invardia (anonymous) ----
|        $ans = $null
|        try { $ans = & $s.GetManifest (Get-SICommunityManifestUri -BaseUrl $cfg.BaseUrl -Ring $cfg.Ring) } catch { return (& $done 'network' ("the Community manifest could not be read: {0} -- nothing changed; the next run asks again" -f $_.Exception.Message)) }
|        $rd = Read-SICommunityManifestAnswer -Answer $ans -Ring $cfg.Ring
|        if ($rd.Action -eq 'none') { return (& $done 'none' ("{0} -- this install stays on {1}" -f $rd.Reason, $from)) }
|        if ($rd.Action -eq 'network') { return (& $done 'network' ("{0} -- nothing changed; the next run asks again" -f $rd.Reason)) }
|        if ($rd.Action -eq 'refused') { return (& $done 'refused' ("{0} -- nothing changed" -f $rd.Reason)) }
|        $entry = $rd.Entry
|
|        # ---- 2. verify before anything is downloaded ----
|        $chk = Test-SICommunityChannelEntry -Entry $entry -Ring $cfg.Ring -TrustedKeys $keys -AppliedSequence ([long]$state.appliedSequence) `
|                    -RunningVersion $from -AcceptManualStepSequence $AcceptManualStepSequence -DownloadPrefix $cfg.DownloadPrefix
|        $res.Sequence = $chk.Sequence
|        if ($chk.Action -eq 'refused') { return (& $done 'refused' ("{0} -- nothing changed" -f $chk.Reason)) }
|        if ($chk.Action -eq 'hold') { return (& $done 'hold' ("{0} -- this install stays on {1}" -f $chk.Reason, $from)) }
|        if ($chk.Action -eq 'current') {
|            if ([long]$state.appliedSequence -lt $chk.Sequence) { $state.appliedSequence = $chk.Sequence; $state.appliedVersion = $chk.Version; $state.ring = $cfg.Ring }
|            return (& $done 'current' $chk.Reason)
|        }
|        # forward-only, as the container updater and Pro: a FIRST manifest (nothing applied from the channel here yet) that
|        # names a version older than the one this install runs is held, never installed
|        if ($chk.IsRollback -and [long]$state.appliedSequence -le 0) {
|            return (& $done 'hold' ("HELD: ring {0} names {1}, older than the {2} this install runs, and no release has been applied from the channel here yet -- an update never moves this install backward on a first manifest" -f $cfg.Ring, $chk.Version, $from))
|        }
|        # owner 2026-10-28: a release of ANOTHER MAJOR VERSION is never installed as an update (a new major version is a new
|        # installation beside the old one) -- refused before anything is downloaded
|        $mj = Test-SICommunityMajorVersion -Installed $from -Release ([string]$chk.Version)
|        if ($mj) { return (& $done 'refused' ("{0} -- nothing changed" -f $mj)) }
|        $log.Add($chk.Reason)
|
|        # ---- 3. an engine mid-run? wait for the next run ----
|        $plan = Get-SICommunityUpdateTaskPlan -Tasks @(& $s.GetTasks $Root) -Root $Root
|        if (@($plan.Busy).Count) { return (& $done 'waiting' ("{0} is running ({1}) -- the update waits for the next run; nothing changed" -f (@($plan.Busy | ForEach-Object { "$($_.TaskPath)$($_.TaskName)" }) -join ', '), $chk.Version)) }
|
|        # ---- 4. download + prove it is the signed archive ----
|        # SHORT paths: Windows PowerShell 5.1 cannot write a path over 260 characters, and a release path is up to ~170 long.
|        $work = [IO.Path]::Combine((Get-SICommunityStateDir $Root), 'w')
|        if (Test-Path -LiteralPath $work) { Remove-Item -LiteralPath $work -Recurse -Force -ErrorAction SilentlyContinue }
|        New-Item -ItemType Directory -Force -Path $work | Out-Null
|        $zip = [IO.Path]::Combine($work, 'r.zip')
|        try { & $s.Download $chk.DownloadUrl $zip | Out-Null } catch { return (& $done 'network' ("the release could not be downloaded: {0} -- nothing changed" -f $_.Exception.Message)) }
|        $a = Test-InvardiaArchiveFile -Path $zip -ExpectedSha256 $chk.Sha256 -ExpectedSize $chk.Size
|        if (-not $a.ok) { Remove-Item -LiteralPath $zip -Force -ErrorAction SilentlyContinue; return (& $done 'refused' ("{0} -- nothing changed" -f $a.reason)) }
|        $payload = $null
|        try { $payload = Expand-SICommunityArchive -ZipPath $zip -Destination ([IO.Path]::Combine($work, 'p')) } catch { return (& $done 'refused' ("{0} -- nothing changed" -f $_.Exception.Message)) }
|        $pv = Get-SICommunityRunningVersion -Root $payload
|        if ($pv -ne $chk.Version) { return (& $done 'refused' ("the archive says it is {0}, the signed manifest names {1} -- nothing changed" -f $pv, $chk.Version)) }
|        $files = Get-SICommunityPayloadFiles -PayloadRoot $payload
|        foreach ($c in $script:SICommunityUpdateClientFiles) {
|            if (@($files) -notcontains $c) { return (& $done 'refused' ("the release does not carry the update client ({0}) -- installing it would end updates for this install; nothing changed" -f $c)) }
|        }
|
|        # ---- 5. apply by host ----
|        foreach ($t in @($plan.Pause)) { try { & $s.DisableTask $t; $paused += $t } catch { $log.Add(("note: {0}{1} could not be paused: {2}" -f $t.TaskPath, $t.TaskName, $_.Exception.Message)) } }
|        $previous = Read-SICommunityInstalledFiles -Root $Root
|        $backup = [IO.Path]::Combine((Get-SICommunityStateDir $Root), 'b', $(if ($from) { $from } else { 'unknown' }))
|        if (Test-Path -LiteralPath $backup) { Remove-Item -LiteralPath $backup -Recurse -Force -ErrorAction SilentlyContinue }
|        $after = $null
|        if (-not $SkipContainerUpdate) { $cu = $s.ContainerUpdate; $rootForHook = $Root; $after = { & $cu $rootForHook }.GetNewClosure() }
|        # The first update by this client: no list of what an update installed, so the files an earlier release shipped and
|        # this one no longer has are found by the release's retired-files list -- removed only when unchanged.
|        $retired = [pscustomobject]@{ Remove = @(); Kept = @() }
|        if ($null -eq $previous) { $retired = Get-SICommunityRetiredFiles -Root $Root -PayloadRoot $payload -Files $files }
|        $apply = Invoke-SICommunityFileApply -Root $Root -PayloadRoot $payload -Files $files -Version $chk.Version -PreviousFiles $previous -BackupDir $backup -HealthCheck $s.HealthCheck -AfterApply $after -RetiredFiles @($retired.Remove)
|        if (-not $apply.Ok) {
|            $state.lastAction = 'rolledback'; $state.lastReason = $apply.Reason
|            return (& $done $(if ($apply.RolledBack -or -not $apply.Reason.Contains('INCOMPLETE')) { 'rolledback' } else { 'error' }) $apply.Reason)
|        }
|        $state.appliedSequence = $chk.Sequence; $state.appliedVersion = $chk.Version; $state.ring = $cfg.Ring
|        $state.appliedUtc = ([datetime](& $s.Now)).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
|        $d = Get-SICommunityStateDir $Root; New-Item -ItemType Directory -Force -Path $d | Out-Null
|        [IO.File]::WriteAllLines([IO.Path]::Combine($d, 'installed-files.txt'), [string[]]@($files))
|        # keep ONE backup: the version just replaced
|        foreach ($old in @(Get-ChildItem -LiteralPath ([IO.Path]::Combine($d, 'b')) -Directory -ErrorAction SilentlyContinue | Where-Object { $_.FullName -ne $backup })) { Remove-Item -LiteralPath $old.FullName -Recurse -Force -ErrorAction SilentlyContinue }
|        Remove-Item -LiteralPath $work -Recurse -Force -ErrorAction SilentlyContinue
|        $res.ToVersion = $chk.Version
|        if ($null -eq $previous) {
|            $log.Add(('note: this was the first update by the signed channel; {0} file(s) of the previous version that this release no longer has were removed (unchanged shipped files; kept in the backup)' -f @($retired.Remove).Count))
|            if (@($retired.Kept).Count) { $log.Add(('note: {0} file(s) of the previous version that this release no longer has were left in place because they were changed (first: {1}); delete them when you no longer need them' -f @($retired.Kept).Count, @($retired.Kept)[0])) }
|        }
|        $why = ("{0} -> {1} (ring {2}, sequence {3}): {4} replaced, {5} added, {6} removed; your *.custom.* files and run output were not touched; the previous version is kept in {7}" -f
|                $from, $chk.Version, $cfg.Ring, $chk.Sequence, $apply.Replaced, $apply.Added, $apply.Removed, $backup)
|        return (& $done 'updated' $why)
|    } catch {
|        return (& $done 'error' ("the update did not complete: {0}" -f $_.Exception.Message))
|    } finally {
|        foreach ($t in $paused) { try { & $s.EnableTask $t } catch { $log.Add(("WARNING: {0}{1} could not be resumed: {2} -- enable it by hand" -f $t.TaskPath, $t.TaskName, $_.Exception.Message)) } }
|        if ($state) {
|            if (-not $state.lastAction -or $state.lastAction -ne 'rolledback' -or $res.Action -ne 'rolledback') { $state.lastAction = $res.Action; $state.lastReason = $res.Reason }
|            try { Write-SICommunityUpdateState -Root $Root -State $state } catch { $log.Add(("WARNING: the update state could not be saved: {0}" -f $_.Exception.Message)) }
|        }
|    }
|}
'@ }
$__siSupportFiles['engine/_shared/InvardiaUpdate.verify.ps1'] = @{ Sha256 = 'b82ea0a4651938d8c02f14aea7f1aaf9f5df57a855c0b091c234e26327587e79'; Text = @'
|#Requires -Version 5.1
|<#
|.SYNOPSIS
|  The product-NEUTRAL half of an Invardia update client: verify a signed update manifest and the archive it names.
|  Framework contract UPDATE-1 (one signer for every product); Invardia docs/DESIGN.md §10 (the manifest + the pull).
|
|.DESCRIPTION
|  Copied BYTE-IDENTICAL into every product that takes updates from Invardia (PIM: engine/_shared/; SecurityInsight:
|  engine/_shared/) and pinned there by a whole-file drift test. So: NO product names, settings, environment variables or
|  layouts in this file -- the product is always PASSED IN (-Product). A change is made here first and copied.
|
|  * the trusted update-signing public keys, EMBEDDED (a key fetched at run time is never trusted);
|  * Test-InvardiaManifestSignature  RS256 (PKCS#1 v1.5, SHA-256) over the base64-DECODED manifest bytes;
|  * Test-InvardiaManifest           signature + product + kind + version + SHA-256 + sequence (no replay) + https link;
|                                    manualStep / minFromVersion HOLD;
|  * Invoke-InvardiaManifestPull     POST <base>/api/updates/<product>/manifest {kind, licence, ring} + X-Invardia-Install-Key
|                                    (+ X-Invardia-Install-Id when the product passes its lasting install id -- Invardia S16);
|  * Save-InvardiaArchive / Test-InvardiaArchiveFile   the download is a zip of the SIGNED size + SHA-256.
|  PS 5.1 + 7. No modules. Nothing here writes anything.
|#>
|
|$script:InvardiaUpdateDefaultBase = 'https://invardia.com'
|# The trusted update-signing public keys (RSA, JWK n/e base64url), Invardia's list at GET /api/updates/keys, EMBEDDED.
|# Add a key here -- never remove the old one in the same release.
|# CN=Invardia-Updates (RSA 4096, valid to 2036-10-04, cert SHA-1 DDFF1C84930C290ECF234FB4C3F3C1D5B3F532F2), delivered by
|# the Invardia session 2026-10-04 and checked here against Invardia's committed public certificate (modulus identical).
|# Then verified against the LIVE GET https://invardia.com/api/updates/keys (same keyId, n and e).
|$script:InvardiaUpdateTrustedKeys = @(
|    @{ keyId = 'https://kv-invardia-gml64wkoe7np.vault.azure.net/keys/invardia-updates'; e = 'AQAB'
|       n = 'tLDrlMq1et3H3vIomcjokhFXfkkyaYVT2F-BByLGk8Pa7lrN7xd-53AbJ3keqv0ZZSQG_V0rKFxbt5b0m7YTNKbBUXvsgLLFQQbouDu-Am-8blzNBjIyDKoQKYKYaYfCbL3Tjdil7RD5pFNV6Qt3wW54jzhPEmyArr2xRjVUOg2WYQe9CpD_pd6-ww9dFlGQwtT_VJvLs0xcXsJkitfxe5tJ7PV8BUKoDpXJQNl6j2M6iqILxAujBxFB3_fGHEfooDJGWu1jkqp2mW2yXots_3ZtKUlnAmwANQNAsVWAxLq-8bLy6b3VTIvMMWw9JyZubBhU8OriW3OBKK6O2k5CV_-O5b0zf_TaQSr64Mq2VPtKkzY1weiFRlwDzEfq-aiLzr-HWx1tB43QEISNoBkrdhC-G9wjCQRgWSoINWbnL--2HOnwdivT9GRaJ38Mng9gqPdrPFfrv6t2ZIn6g5X9GOz_ua1Fi0WyfRJ1ICzzQgiivB0bBdlUtxfV89b0TXwIT9JynV7VYS9uv5H56IXpcuDaWzIueq6bVlWqk6p-cEMviDKMdaME3JW_Q-qNBCF1Q-cCAGl269KtFWQt2aLU2f50JkwW8h5slY1I05PXbJaX26n-Zu9pdrq-us3la8D1v_V9ehsR2s6Xj4cKZRZAURd5ut42R8h7EIe7K17KeZE' }
|)
|
|function ConvertFrom-InvardiaBase64Url {
|    <# PURE. base64url (or plain base64) text -> bytes. #>
|    param([AllowEmptyString()][string]$Text)
|    $t = "$Text".Trim().Replace('-', '+').Replace('_', '/')
|    switch ($t.Length % 4) { 2 { $t += '==' } 3 { $t += '=' } }
|    return [Convert]::FromBase64String($t)
|}
|
|function Compare-InvardiaReleaseVersion {
|    <# PURE. -1 / 0 / 1 for two dotted numeric versions ('2.4.491'); a non-numeric part compares as 0. #>
|    param([string]$A, [string]$B)
|    $pa = @("$A".Trim() -split '\.'); $pb = @("$B".Trim() -split '\.')
|    for ($i = 0; $i -lt [Math]::Max($pa.Count, $pb.Count); $i++) {
|        $x = 0; $y = 0
|        if ($i -lt $pa.Count) { [void][int]::TryParse($pa[$i], [ref]$x) }
|        if ($i -lt $pb.Count) { [void][int]::TryParse($pb[$i], [ref]$y) }
|        if ($x -lt $y) { return -1 }; if ($x -gt $y) { return 1 }
|    }
|    return 0
|}
|
|function Test-InvardiaManifestSignature {
|    <#
|      PURE (crypto only). RS256 over the bytes behind -ManifestB64, signature base64, by the key -KeyId of -TrustedKeys
|      (@( @{ keyId; n; e } )). Returns @{ ok; reason }. PS 5.1-safe: RSAParameters + ImportParameters, no ImportFromPem.
|    #>
|    param([string]$ManifestB64, [string]$Signature, [string]$KeyId, [object[]]$TrustedKeys = $script:InvardiaUpdateTrustedKeys)
|    $keys = @($TrustedKeys | Where-Object { $_ })
|    if (-not $keys.Count) { return @{ ok = $false; reason = 'no trusted update-signing key is embedded in this version yet -- every manifest is refused until one is' } }
|    $k = @($keys | Where-Object { "$($_.keyId)" -ceq "$KeyId" })[0]
|    if (-not $k) { return @{ ok = $false; reason = "the manifest is signed by key '$KeyId', which this version does not trust" } }
|    try {
|        $data = [Convert]::FromBase64String("$ManifestB64".Trim())
|        $sig = [Convert]::FromBase64String("$Signature".Trim())
|        $p = New-Object System.Security.Cryptography.RSAParameters
|        $p.Modulus = ConvertFrom-InvardiaBase64Url "$($k.n)"
|        $p.Exponent = ConvertFrom-InvardiaBase64Url "$($k.e)"
|        $rsa = [System.Security.Cryptography.RSA]::Create()
|        try {
|            $rsa.ImportParameters($p)
|            $ok = $rsa.VerifyData($data, $sig, [System.Security.Cryptography.HashAlgorithmName]::SHA256, [System.Security.Cryptography.RSASignaturePadding]::Pkcs1)
|        } finally { $rsa.Dispose() }
|        if ($ok) { return @{ ok = $true; reason = '' } }
|        return @{ ok = $false; reason = 'the manifest signature does not verify' }
|    } catch { return @{ ok = $false; reason = "the manifest signature could not be checked: $($_.Exception.Message)" } }
|}
|
|function Test-InvardiaManifest {
|    <#
|      PURE (given the trusted keys). Everything about a 200 answer, before anything is downloaded. Returns
|      @{ ok; hold; reason; version; sequence; sha256; size; downloadUrl; manifest }.
|        ok=$false            refused (signature, shape, product, kind, replay) -- nothing moves
|        ok=$true, hold=$true  verified, but the release asks for a manual step or a newer starting version -- nothing moves
|    #>
|    # -Ring (framework UPDATE-1.7, 2026-10-06: the solution decides the ring, Invardia relays): the ring this environment
|    # asked for (0-3; every product caller passes the installation's own ring). A manifest for another ring, or one that names
|    # no ring, is refused. -1 = the caller names no ring.
|    param([Parameter(Mandatory)][object]$Response, [object[]]$TrustedKeys = $script:InvardiaUpdateTrustedKeys,
|          [string]$Kind = 'code', [int]$AppliedSequence = 0, [string]$RunningVersion = '', [Parameter(Mandatory)][string]$Product, [int]$Ring = -1)
|    $no = { param($why) @{ ok = $false; hold = $false; reason = $why; version = ''; sequence = 0; sha256 = ''; size = 0; downloadUrl = ''; manifest = $null } }
|    $g = { param($o, $n) if ($null -eq $o) { return $null }; if ($o -is [System.Collections.IDictionary]) { return $o[$n] }; $pp = $o.PSObject.Properties[$n]; if ($pp) { $pp.Value } }
|    $b64 = "$(& $g $Response 'manifestB64')".Trim()
|    if (-not $b64) { return (& $no 'the answer carries no manifest') }
|    $sv = Test-InvardiaManifestSignature -ManifestB64 $b64 -Signature "$(& $g $Response 'signature')" -KeyId "$(& $g $Response 'keyId')" -TrustedKeys $TrustedKeys
|    if (-not $sv.ok) { return (& $no $sv.reason) }
|    # Only the SIGNED bytes are read; the answer's own 'manifest' object is ignored.
|    $m = $null; try { $m = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b64)) | ConvertFrom-Json } catch { return (& $no 'the signed manifest is not JSON') }
|    if ("$($m.product)" -cne $Product) { return (& $no "the manifest is for '$($m.product)', not $Product") }
|    if ("$($m.kind)" -cne $Kind) { return (& $no "the manifest is kind '$($m.kind)', not $Kind") }
|    if ($Ring -ge 0) {
|        $mr = -1; if (-not [int]::TryParse("$($m.ring)", [ref]$mr)) { return (& $no "the manifest names no ring (this environment asked for ring $Ring)") }
|        if ($mr -ne $Ring) { return (& $no "the manifest is for ring $mr, not ring $Ring that this environment asked for") }
|    }
|    $ver = "$($m.version)".Trim(); if ($ver -notmatch '^\d+\.\d+\.\d+$') { return (& $no "the manifest names no release version ('$ver')") }
|    $sha = "$($m.sha256)".Trim().ToLowerInvariant(); if ($sha -notmatch '^[0-9a-f]{64}$') { return (& $no 'the manifest carries no SHA-256') }
|    $seq = 0; if (-not [int]::TryParse("$($m.sequence)", [ref]$seq) -or $seq -lt 1) { return (& $no 'the manifest carries no sequence') }
|    if ($seq -lt $AppliedSequence) { return (& $no "REPLAY refused: sequence $seq is lower than the $AppliedSequence already applied here") }
|    # F4 (framework UPDATE-1.5, 2026-10-05): the SIGNED size is required -- a manifest without it (or with 0) is refused,
|    # so the archive check below always compares the length, never only the hash.
|    $size = [int64]0; if (-not [int64]::TryParse("$($m.size)", [ref]$size) -or $size -lt 1) { return (& $no 'the manifest carries no archive size') }
|    $url = "$(& $g $Response 'downloadUrl')".Trim()
|    if ($url -notmatch '^https://') { return (& $no 'the download link is not https') }
|    $r = @{ ok = $true; hold = $false; reason = "signed manifest: $ver (ring $($m.ring), sequence $seq)"; version = $ver; sequence = $seq; sha256 = $sha; size = $size; downloadUrl = $url; manifest = $m }
|    if ("$($m.manualStep)".Trim()) { $r.hold = $true; $r.reason = "HELD -- $ver asks for a manual step first: $("$($m.manualStep)".Trim())" ; return $r }
|    $mf = "$($m.minFromVersion)".Trim()
|    if ($mf -and "$RunningVersion".Trim() -and (Compare-InvardiaReleaseVersion "$RunningVersion" $mf) -lt 0) {
|        $r.hold = $true; $r.reason = "HELD -- $ver can only be installed from $mf or later; this environment runs $RunningVersion"; return $r
|    }
|    return $r
|}
|
|function Get-InvardiaPullReason {
|    <# PURE. The admin's sentence for a non-200 pull answer. #>
|    param([int]$Status, [AllowNull()][object]$Body, [string]$ErrorText = '')
|    $why = if ($Body -and $Body.PSObject.Properties['reason']) { " ($($Body.reason))" } else { '' }
|    switch ($Status) {
|        204 { return 'nothing is released to this environment''s ring yet' }
|        401 { return 'Invardia refused the install key (revoked, reset or wrong) -- claim a new one, or set the install key again' }
|        403 { return "Invardia refused the licence$why -- updates need a valid Invardia-issued Pro licence for this tenant" }
|        404 { return 'Invardia does not know the product' }
|        422 { return "Invardia refused the request$why -- the pull must carry this environment's ring (0-3)" }
|        429 { return 'Invardia asked to wait (rate limit) -- the next run asks again' }
|        0   { return "Invardia could not be reached: $ErrorText" }
|        default { return "Invardia answered HTTP $Status$why" }
|    }
|}
|
|function Invoke-InvardiaManifestPull {
|    <# The pull. -Http { param($Method, $Url, $Body, $Headers) } -> @{ status; body; error } (the product's own HTTP helper). #>
|    # -Ring (UPDATE-1.7): the environment's OWN ring (0-3), set in the product; Invardia answers with what the product
|    # published for that ring (204 when nothing). Required -- Invardia answers 422 without it.
|    # -InstallId (Invardia S16): the install's own LASTING id, kept by the product. Sent as X-Invardia-Install-Id only when it
|    # is a GUID (lower-cased); '' = no header. Never made up here -- a wrong id would lock the install key.
|    param([Parameter(Mandatory)][string]$Product, [Parameter(Mandatory)][scriptblock]$Http, [string]$BaseUrl = '', [Parameter(Mandatory)][string]$InstallKey, [Parameter(Mandatory)][string]$LicenceText, [string]$Kind = 'code',
|          [AllowEmptyString()][AllowNull()][string]$InstallId = '',
|          [Parameter(Mandatory)][ValidateRange(0, 3)][int]$Ring)
|    $base = if ("$BaseUrl".Trim()) { "$BaseUrl".Trim().TrimEnd('/') } else { $script:InvardiaUpdateDefaultBase }
|    $h = @{ 'X-Invardia-Install-Key' = $InstallKey }
|    $iid = "$InstallId".Trim().ToLowerInvariant()
|    if ($iid -match '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$') { $h['X-Invardia-Install-Id'] = $iid }
|    $r = & $Http 'POST' "$base/api/updates/$Product/manifest" @{ kind = $Kind; licence = $LicenceText; ring = $Ring } $h
|    $pullStatus = [int]$r.status
|    return @{ status = $pullStatus; body = $r.body; reason = $(if ($pullStatus -eq 200) { '' } else { Get-InvardiaPullReason -Status $pullStatus -Body $r.body -ErrorText "$($r.error)" }) }
|}
|
|function Save-InvardiaArchive {
|    <# Download the release zip and prove it is the one the manifest names (zip magic, size, SHA-256). @{ ok; bytes; reason }. #>
|    param([Parameter(Mandatory)][string]$Url, [Parameter(Mandatory)][string]$OutFile, [Parameter(Mandatory)][string]$ExpectedSha256, [int64]$ExpectedSize = 0, [int]$TimeoutSeconds = 300)
|    try { [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 -bor [System.Net.ServicePointManager]::SecurityProtocol } catch { }
|    try { Invoke-WebRequest -Uri $Url -OutFile $OutFile -UseBasicParsing -TimeoutSec $TimeoutSeconds -ErrorAction Stop }
|    catch { return @{ ok = $false; bytes = 0; reason = "download failed: $($_.Exception.Message -replace '\?t=[^\s''"]+', '?t=***')" } }
|    return (Test-InvardiaArchiveFile -Path $OutFile -ExpectedSha256 $ExpectedSha256 -ExpectedSize $ExpectedSize)
|}
|
|function Test-InvardiaArchiveFile {
|    <# PURE (file read). The downloaded file is a zip of the size and SHA-256 the SIGNED manifest names. #>
|    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$ExpectedSha256, [int64]$ExpectedSize = 0)
|    # F4: the signed size is REQUIRED -- no expected size = refused (a caller that has none must not skip the length check)
|    if ($ExpectedSize -lt 1) { return @{ ok = $false; bytes = 0; reason = 'no signed archive size to check the download against -- refused' } }
|    if (-not (Test-Path -LiteralPath $Path)) { return @{ ok = $false; bytes = 0; reason = 'the download produced no file' } }
|    $len = (Get-Item -LiteralPath $Path).Length
|    $magic = New-Object byte[] 2
|    $fs = [System.IO.File]::OpenRead($Path); try { [void]$fs.Read($magic, 0, 2) } finally { $fs.Dispose() }
|    if ($magic[0] -ne 0x50 -or $magic[1] -ne 0x4B) { return @{ ok = $false; bytes = $len; reason = 'the downloaded file is not a zip' } }
|    if ($len -ne $ExpectedSize) { return @{ ok = $false; bytes = $len; reason = "the archive is $len bytes, the signed manifest says $ExpectedSize" } }
|    $sha = [System.Security.Cryptography.SHA256]::Create(); $fh = [System.IO.File]::OpenRead($Path)
|    try { $h = ([BitConverter]::ToString($sha.ComputeHash($fh))).Replace('-', '').ToLowerInvariant() } finally { $fh.Dispose(); $sha.Dispose() }
|    if ($h -ne "$ExpectedSha256".Trim().ToLowerInvariant()) { return @{ ok = $false; bytes = $len; reason = "the archive's SHA-256 ($h) is not the one the signed manifest names -- refused" } }
|    return @{ ok = $true; bytes = $len; reason = '' }
|}
'@ }
$__siSupportFiles['setup/Invoke-SIContainerUpdate.ps1'] = @{ Sha256 = '52d28883b1cad5955ae98eaa06f437dac009f15684d965ac4ab9e10c237f3ecd'; Text = @'
|<#
|.SYNOPSIS
|    SecurityInsight -- bring a CONTAINER-hosted install up to the code the sync just pulled:
|    detect -> build -> roll -> verify -> roll back on failure. A VM install is a clean no-op.
|
|.DESCRIPTION
|    Same flow as PIM4EntraPS's update hook (operator ruling 2026-09-29), run by the sync engine through
|    solution.deploy.json after a sync that changed SecurityInsight:
|
|      1. DETECT   -- is this a container install? (SI_Bootstrap_ResourceGroupName + SI_Bootstrap_AcrName in
|                     config\SecurityInsight.custom.ps1, or parameters). No -> "nothing to update", exit 0.
|                     Which jobs run this registry's si-orchestrator image, and is any not on the image
|                     built from THIS tree (tag = v<VERSION>-<content hash>)?
|      2. BUILD    -- the registry builds the image from this solution folder (never a fixed path), only when the tag
|                     is not already in the registry: packed here (.dockerignore applied), uploaded, built by ARM
|                     scheduleRun and followed to its end (setup/_shared/SI-AcrBuild.ps1).
|      3. ROLL     -- point each job at the new image, capturing its previous image first. #416: ONE ARM PATCH of its
|                     template per job, all sent at once (never a PUT, never one job update after another).
|      4. VERIFY   -- read every job back (one job list per poll); each must now carry the new image, and nothing else
|                     on it may have changed (trigger, secrets, env, resources, identity, tags ...).
|      5. ROLLBACK -- on any failure after a job changed, every changed job returns to its previous image,
|                     and the script exits 1 so the sync reports the solution as failed.
|      6. TEMPLATES -- SecurityInsight Pro (the Pro database is configured): once the jobs run this tree, the default
|                     templates are installed or kept current as template pack 1.0 (#250, setup\Publish-SITemplates.ps1
|                     -InstallDefault: the schema, names and CMDB ownership as configuration, the pack staged and
|                     recorded). A template change that needs a review is never written here -- it waits on the Template
|                     releases page. Never fails the update: a problem is reported, and the next run tries again.
|      7. SQL SIZE -- (#507, setup/_shared/SI-SqlTier.ps1) the install's SI databases are raised to the size the rule gives
|                     (never Basic: the Pro database S3, the identity ledger S1 -- #509) by one online ARM PATCH of the sku. Never
|                     lowers by itself, never touches a database above S3 / Premium / vCore / in an elastic pool, never
|                     fails the update; one line per database. A size the customer set (SI_Bootstrap_SqlServiceObjective,
|                     the Pro database's setting first) applies both ways, never below S1. -DetectOnly: the plan only.
|      9. QUEUE SCALING -- (#519, setup/_shared/SI-KedaConvert.ps1) identity / endpoint / Azure still running as one scheduled
|                     job (an install made before queue scaling) move to a producer + queue-scaled workers, as a new install
|                     gets them -- only a job SI's setup made that signs in with the managed identity, unless the install
|                     switched queue scaling off. The old job loses its timer only after both new jobs are read back, and
|                     is kept; any failure leaves it running. Never fails the update. -DetectOnly: the plan only.
|     9b. RISK ANALYSIS WORKERS -- (#742, setup/_shared/SI-RaWorkerJobs.ps1) ON BY DEFAULT where they can run (owner
|                     2026-10-18): the Detailed Risk Analysis job gets its queue-scaled worker job (caj-si-raworker-detailed)
|                     as a new install gets it, read back, and only then is told to hand its reports to it (SI_RA_SCALE_OUT /
|                     SI_RA_WORKER_JOB). Only a job SI's setup made that signs in with the managed identity; queue scaling
|                     switched off keeps it as it is (one line says why). SI_Bootstrap_RaScaleOut = $false (or
|                     SI_UPDATER_RA_SCALE_OUT = off on the updater job): no worker is made, and a Risk Analysis job still
|                     told it is a producer is told it is not (read back). Any failure leaves it running its reports itself.
|                     Never fails the update. -DetectOnly: the plan only.
|     9a. MISSING JOBS -- (#685, setup/_shared/SI-MissingJobs.ps1) a job this version needs that the install does not have
|                     (caj-si-verification; #714 the mail job caj-si-close-loop-mail, with the SMTP relay password a Risk
|                     Analysis job carries; #715 the ServiceNow connectors' caj-si-asset-vulns-servicenow and caj-si-asset-cmdb,
|                     only where a ServiceNow connector of that direction is in the Pro database or a setting says ServiceNow
|                     is used) is created as a new install gets it -- from a Pro job of the install (image,
|                     sign-in, settings, secrets), in flow mode as a step of the pipeline -- and read back; one that does not
|                     read back right is removed again. A job that exists is never touched. Never fails the update.
|     10. PERMISSIONS -- (setup/_shared/SI-PermissionNote.ps1) read only: what SecurityInsight's collection identity holds is
|                     compared with config\permissions.locked.json. Per read-only permission that is not granted yet: one
|                     line (what it is for, what stays empty without it) and the two lines that grant them. Nothing is
|                     granted or changed here, nothing is said when all are granted, and the update never fails on it.
|     9c. NIGHTLY SCHEDULE -- (setup/_shared/SI-NightlySchedule.ps1) ONCE per install: the update at 23:00 and the pipeline at
|                     23:30 in the time zone of the install's Azure region (an unknown region: Danish time, said in one line).
|                     The updater job on a shipped timer (the old 03:00 UTC, or the Danish-time ticks '0 21,22 * * *') gets the
|                     region zone's UTC ticks; a pipeline start on a shipped value (23:30 Europe/Copenhagen, or the old 22:00)
|                     gets 23:30 in the region's zone (Pro: the settings and the stored pipeline, with their change-log rows; a
|                     folder install: its config files). A time the customer chose is kept. Never fails the update.
|                     -DetectOnly: the plan only.
|     9d. PIPELINE LAYOUT -- (#754, #748, setup/_shared/SI-PipelineLayout.ps1) the stored pipeline (cfg.JobFlow) as a new
|                     install gets it: Risk Analysis Summary and Detailed side by side (layout level 3) on a pipeline still on
|                     the default layout of its level, the verification service (the daily data health check) added where its
|                     job is installed and the pipeline lacks it. Written only while nobody saved it meanwhile, read back, and
|                     reading it again changes nothing. A pipeline a person changed is never re-laid. #636 (level 4): the Risk
|                     Analysis Summary step switched off on a pipeline still the default of its level with every step on (one a
|                     person changed keeps it, said in one line); then the scheduled management summary reports of the Summary
|                     report's data show the Detailed report's (one line each). Never fails the update.
|                     -DetectOnly: the plan only.
|     9e. REPORT ROW COPY -- (#830, setup/_shared/SI-ReportCopyDefault.ps1) ONCE per install (cfg.InstallState
|                     'ReportRowCopyDefault'): the copy of the Risk Analysis report rows to Log Analytics (SendToLogAnalytics,
|                     SI_RiskAnalysis_Detailed_CL) is off, as in a new install (owner 2026-10-20: an optional output, off by
|                     default). A value setup wrote (an import of the generated config file, setup, an update) is set off with
|                     its change-log row; a value a person set on the Settings page is kept (one line); no stored value = the
|                     solution-wide value off, which the jobs read after their environment. Never fails the update.
|                     -DetectOnly: the plan only.
|     9f. SUMMARY VIEWS -- (#842, setup/_shared/SI-SummaryGroupsRebuild.ps1) Pro: when collections hold Summary views written
|                     from another definition than this release ships (data-model\summary-groupings.locked.json changed), ONE
|                     run of the data sync step is queued in the pipeline's queue (cfg.PipelineQueue, the same statement and
|                     dedup as Run now) -- it waits until no pipeline run is going -- so the views are written again now, not
|                     on the next nightly run. A pipeline run or data sync already waiting, an install on its own job
|                     schedules, or a pipeline without the data sync: nothing queued (one line says when they come). Nothing
|                     to write again: nothing queued, nothing said. Never fails the update. -DetectOnly: the plan only.
|     9i. KEY FIGURES -- (#855, engine/pro-data/_shared/SI-DataKeyFigures.ps1) Pro: the newest complete collections whose key
|                     figures lack this release's marker are worked out again HERE with the engine's own statement and the
|                     install's own protection-score settings -- no pipeline run, no data sync. Bounded (the newest 4, a time
|                     budget). Nothing to do: nothing said. Never fails the update. -DetectOnly: how many would be.
|     9j. PUBLISHED COPIES -- (engine/_shared/data-sql/SI-DataPublishedRun.ps1, Invoke-SIPublishedCopyCatchUp) Pro: a
|                     published run whose copies of the merged assets (sidata.CiPub, AssetPub, ...) are older than it
|                     (CopiedAt NULL or before PublishedAt) is refreshed now in the data database by sidata.PublishedCopyCatchUp
|                     (only what changed). Current copies: nothing done, nothing said. Never fails the update. -DetectOnly:
|                     only whether they are stale.
|     9g. SIGN-IN FRONT STORE -- (#852, pro-management/deploy/SI-SigninFrontStore.ps1) Pro: what the shared sign-in front
|                     1.3.0 needs before it starts, as a new install gets it -- the RSA key signin-front-dp in the install's Key
|                     Vault (SI_UPDATER_KEY_VAULT, else SI_KeyVaultName), "Key Vault Crypto Service Encryption User" for the
|                     web app's managed identity on THAT key only, the identity's contained user in the Pro database, the schema
|                     signin owned by it and GRANT CREATE TABLE. Each piece only when missing, one line each, read back. Only
|                     when ALL read back are the front's settings (SIGNIN_SQL_SERVER, SIGNIN_SQL_DATABASE,
|                     SIGNIN_KEYVAULT_KEY_ID, SIGNIN_STATE_MI_CLIENT_ID) handed to the web app's front roll in this run
|                     ($global:SI_SigninFrontStoreEnv): the front container gets them with every other setting kept. A piece
|                     this update may not make is one customer action (setup\Set-SISigninFront.ps1 -Apply through the Support
|                     app); a front 1.3.0 is then not rolled in -- the front keeps what it runs. An install that chose its own
|                     sign-in is left alone. Never fails the update. -DetectOnly: the plan only.
|     9k. OWN SQL TARGET -- (#865, setup/_shared/SI-OwnSqlConnector.ps1) Pro: SecurityInsight's own SQL vulnerability target
|                     (cfg.Connector kind sql + direction vulnerability, `vulnerability-sql`) is always apply with create
|                     and close -- one that is in test mode is set so, with its cfg.ChangeLog row, read back. A connector to
|                     a customer system (ServiceNow, REST) and the SQL CMDB hand-off keep their own mode. On every update
|                     (nothing to do: nothing said). Never fails the update. -DetectOnly: the plan only.
|     9l. NIGHTLY 19:00 -- (setup/_shared/SI-NightlySchedule.ps1; owner 2026-10-21: "move the start time for all si jobs to
|                     7pm on all sites" / "so they are done next morning") ONCE per install, right AFTER each part of 9c: the
|                     updater on the region step's value (the zone's 23:00 ticks, tag '23:00 <zone>') gets the zone's 18:30
|                     ticks and the tag '18:30 <zone>' (one PATCH of trigger + tags, read back; tag si-nightly-1900); a
|                     pipeline start on the region step's value (23:30 in the region's zone) becomes 19:00 in the same zone
|                     (Pro: the settings and the stored pipeline with their change-log rows, cfg.InstallState
|                     'NightlySchedule1900'; a folder install: its config files, .si-update\nightly-schedule-1900.json). The
|                     updater still runs before the pipeline the same evening. A time the customer chose is kept, said in
|                     one line. Never fails the update. -DetectOnly: the plan only.
|     9m. SERVICENOW DATA OUT -- (#903, setup/_shared/SI-SnowDataOutConnector.ps1) Pro: ONE ServiceNow connector (direction
|                     data-out, always apply) feeds both ServiceNow Import Set outputs. While none exists, the connector the
|                     data out used before becomes it (or one is created from the secret NAMES in use) -- keeping exactly
|                     what is sent: switched on only where a ServiceNow output is on in SI_DataOut_Outputs, left off and said
|                     where the outputs went to different instances; a table named only in its settings moves to its setting.
|                     One transaction per connector with its cfg.ChangeLog row, guarded by RowVersion and the one-on rule,
|                     read back. Never a delete, a secret value, an output switch, a close-loop / sql / rest row or a job.
|                     Never fails the update. -DetectOnly: the plan only.
|     9n. SERVICENOW STAGING STATUS -- (#912, setup/_shared/SI-SnowStagingStatus.ps1) Pro: a new install leaves
|                     SI_DataOut_ServiceNowStagingStatusTable unset (= u_si_staging_status: every push is one batch, and nothing
|                     is sent while that table cannot be written). The table is in the customer's ServiceNow, so an install that
|                     ALREADY sends there (an Import Set table setting is set) gets the setting EMPTY, once, only while it has no
|                     row: the rows go as before and the ServiceNow page warns until the customer's team creates the table and
|                     the setting names it. With its cfg.ChangeLog row, read back. Never fails the update. -DetectOnly: the plan.
|     9o. SERVICENOW ONE ROUTE -- (#914, setup/_shared/SI-SnowOneRoute.ps1) Pro: the older ServiceNow push was removed. ONCE per
|                     install (cfg.InstallState 'SnowOneRoute') a setting of the older push that still holds a value is named
|                     in one line of this log; nothing is deleted -- the rows stay and the code no longer reads them. Never
|                     fails the update. -DetectOnly: the plan.
|     11. SUPPORT ACCESS TO THE DATABASES -- NOT a step of the update: the Invardia Support app's database access (framework
|                     section 4.1b: its place in the admin group and its own database user) is never removed and never
|                     changed by an update. SecurityInsight reports both parts, read only, on the identified heartbeat;
|                     Invardia repairs a missing part (owner 2026-10-18).
|     12. DISPLAY NAMES -- (setup/_shared/SI-DisplayNames.ps1) the names people read, as a new install has them: the engine's
|                     application "SecurityInsight" -> "SecurityInsight Engine", the web app's sign-in application "SecurityInsight
|                     Management" -> "SecurityInsight", the SQL admin group shown as "SecurityInsight SQL admins" -- only from
|                     SecurityInsight's earlier default, found by id, read back, put back on failure, never twice. Azure resources
|                     keep their names. SI_Update_RenameDisplayNames (ON by default; the Pro setting first): off = the plan only.
|                     Without the rights: one line, and setup\Set-SIDisplayNames.ps1 for an administrator. Never fails the update.
|
|    -SizingOnly (#756): ONLY the size steps that read the customer's settings -- 7 (SQL database size), 8 (job size) and 8d
|                     (web app size) -- for a run where the code is current already (caj-si-updater: the ring's release is
|                     applied, so nothing is built or rolled). No image is built, no job is rolled, no template, config file or
|                     customisation file is written; each step is idempotent and never fails the update; exit 0.
|
|    -DetectOnly is the default (reports, changes nothing). -Apply performs the update.
|    -Save records the resource group / registry / subscription you pass in config\SecurityInsight.custom.ps1,
|    once, so every later sync finds the containers: the way an install made before 3.0.0 -- when setup never
|    saved them -- is brought under automatic updates (#166).
|    Authentication (#521, no az CLI, no PowerShell module): SecurityInsight's own REST token client, signed in ONCE
|    (setup/_shared/SI-UpdateRest.ps1) -- the updater job's identity (SI_UPDATER_AUTH / SI_UPDATER_CLIENT_ID: its managed
|    identity or its certificate), else the run's own sign-in from the config (the SI_SPN_* app or managed identity, as
|    the engines sign in). Every ARM call names its subscription in the URL.
|
|.LINK
|    https://invardia.com/docs/si/scripts/Invoke-SIContainerUpdate/
|#>
|[CmdletBinding(SupportsShouldProcess)]
|param(
|    [switch]$Apply,
|    [switch]$DetectOnly,
|    [string]$ResourceGroupName,
|    [string]$AcrName,
|    [string]$SubscriptionId,
|    [switch]$Save,
|    # Roll by hand even though an updater job owns this install's rollout (Upgrade-SIToPro.ps1). The job will
|    # move the containers back to the version your ring approves on its next run.
|    [switch]$Force,
|    # 90 (was 30): a private install builds on its agent pool inside its network, slower than the shared builders -- seen live
|    # 2026-11-05, the build of the release image was still going after 30 minutes and the update gave up ("Timeout")
|    [int]$BuildTimeoutMinutes = 90,
|    # #405: RING 1 (internal) -- the templates shipped with this tree installed DIRECTLY (Publish-SITemplates
|    # -InstallCurrent): no pack number, no gate, no pack recorded as a release. The ring 1 deploy passes it.
|    [switch]$InstallTemplatesDirect,
|    # #756: the code is current -- only the sizes the customer's settings set (steps 7, 8, 8d); nothing built or rolled.
|    # The updater passes it on a run with no new code to install.
|    [switch]$SizingOnly
|)
|
|#Requires -Version 5.1   # after the help and the param block: before the help, it hides the help from Get-Help
|# framework section 12.7 / 12.10: the documentation link first, a transcript of the run, -WhatIf writes nothing
|. ([IO.Path]::Combine($PSScriptRoot, '_shared', 'SI-ScriptRun.ps1'))
|$siRun = Start-SIScriptRun -Script 'Invoke-SIContainerUpdate' -Quiet:($false)
|if ($WhatIfPreference) { $Apply = [switch]$false; if ($Save) { $Save = [switch]$false; Write-Host '-WhatIf: the container hosting is not saved to config\SecurityInsight.custom.ps1.' -ForegroundColor Yellow } }   # -WhatIf = detect + plan: nothing is built or rolled
|try {
|
|$ErrorActionPreference = 'Stop'
|$solRoot = Split-Path -Parent $PSScriptRoot
|. (Join-Path $PSScriptRoot '_shared/SI-ContainerUpdate.ps1')
|# #350: a deep install path is built from a short copy (a Windows host cannot read paths over 260 characters everywhere)
|. (Join-Path $PSScriptRoot '_shared/SI-BuildStage.ps1')
|# #521: Azure over REST only -- the one sign-in, the one seam (SI-UpdateRest.ps1) and the registry's own build (SI-AcrBuild.ps1)
|. (Join-Path $PSScriptRoot '_shared/SI-UpdateRest.ps1')
|. (Join-Path $PSScriptRoot '_shared/SI-AcrBuild.ps1')
|# #416: the fast roll -- two-layer builds, queued builds, the parallel job swap
|. (Join-Path $PSScriptRoot '_shared/SI-FastRoll.ps1')
|# #911 (e): a step with no log line for 20 minutes says "still working: <step>" -- started here unless the updater runs one
|$updWatchLib = Join-Path $PSScriptRoot '_shared/SI-UpdateWatch.ps1'
|$script:SIUpdateWatchOwn = $false
|if (Test-Path -LiteralPath $updWatchLib) {
|    if (-not (Get-Command -Name Start-SIUpdateWatch -ErrorAction SilentlyContinue)) { . $updWatchLib }
|    if (-not $global:SI_UpdateWatch) { try { $null = Start-SIUpdateWatch -QuietMinutes 20; $script:SIUpdateWatchOwn = $true } catch { } }
|}
|
|# #427: the stage and the first warning are left for the updater (caj-si-updater), which reports a failed update to
|# Invardia with the step it stopped in (build / roll / restore) and its first error (the 400 "imageType" of 2026-10-06)
|# #911 (d) / (e): every step beats the install's lock (when the updater holds it -- Invoke-SIUpdaterLockBeat, the updater's
|# run gate), and every line tells the watch, so a long step says "still working" and is never mistaken for a hang
|function Step([string]$m) { $global:SI_UpdateStage = $m; Write-Host "==> $m" -ForegroundColor Cyan
|    if (Get-Command -Name Set-SIUpdateWatchLine -ErrorAction SilentlyContinue) { Set-SIUpdateWatchLine -Step $m }
|    if (Get-Command -Name Invoke-SIUpdaterLockBeat -ErrorAction SilentlyContinue) { $null = Invoke-SIUpdaterLockBeat -What $m -Force }
|}
|function Info([string]$m) { Write-Host "    $m"; if (Get-Command -Name Set-SIUpdateWatchLine -ErrorAction SilentlyContinue) { Set-SIUpdateWatchLine } }
|function Warn([string]$m) { if (-not "$global:SI_UpdateFirstWarn".Trim()) { $global:SI_UpdateFirstWarn = $m }; Write-Host "    $m" -ForegroundColor Yellow; if (Get-Command -Name Set-SIUpdateWatchLine -ErrorAction SilentlyContinue) { Set-SIUpdateWatchLine } }
|# framework rule 11g: a build pool that could not be brought back to 0 agents (or was removed and not made again) is a failure
|# line of its OWN (step 'build-pool') -- the updater reports it also when the update itself succeeded; it never changes the exit code
|function Add-SIUpdateBuildPoolFailure([string]$Text) {
|    if ($null -eq $global:SI_UpdateFailures) { $global:SI_UpdateFailures = New-Object System.Collections.Generic.List[object] }
|    $global:SI_UpdateFailures.Add([pscustomobject]@{ Step = 'build-pool'; Code = ''; Text = $Text })
|}
|# framework rule 11g: the build pool's scale up / down and the updater's tier step (setup\_shared\SI-AcrBuildPool.ps1)
|$bpLib = Join-Path $PSScriptRoot '_shared/SI-AcrBuildPool.ps1'
|if (Test-Path -LiteralPath $bpLib) { . $bpLib }
|
|# ---- 1. DETECT --------------------------------------------------------------------------------
|Step '1. DETECT'
|$customFile = Join-Path $solRoot 'config/SecurityInsight.custom.ps1'
|$globals = @{}
|if (Test-Path -LiteralPath $customFile) {
|    # Read the customer's values in a child scope and keep only the names this script needs.
|    # #182: a line in the customer's config that fails HERE (a Key Vault read this identity cannot make, say)
|    # must not fail the update: the four names below are plain assignments, and everything the file set before
|    # the failure is already in place. Say it once and carry on.
|    try { & { . $customFile } 3>$null } catch { Warn ("config\SecurityInsight.custom.ps1 did not load completely here ({0}) -- continuing with what it set." -f $_.Exception.Message) }
|    foreach ($n in 'SI_Bootstrap_ResourceGroupName', 'SI_Bootstrap_AcrName', 'SI_Bootstrap_SubscriptionId', 'SI_WorkspaceResourceId', 'SI_Bootstrap_UpdaterJob',
|                   # #507: the SQL databases this install uses, and a database size the customer set (step 7)
|                   'SI_ProSqlServer', 'SI_ProSqlDatabase', 'SI_LedgerSqlServer', 'SI_LedgerDatabase', 'SI_Pro_DataSqlServer', 'SI_Pro_DataSqlDatabase',
|                   'SI_Bootstrap_SqlServiceObjective',
|                   # the web app's size the customer set (step 8d; owner 2026-10-18)
|                   'SI_Bootstrap_WebAppCpu', 'SI_Bootstrap_WebAppMemory',
|                   # #519: queue scaling switched off by the customer, its worker cap, and the account of the shard queues (step 9)
|                   'SI_Bootstrap_UseKEDA', 'SI_Bootstrap_KedaMaxReplicas', 'SI_StorageAccount',
|                   # #742: the Risk Analysis workers -- on unless the customer switched them off -- and their cap (step 9b)
|                   'SI_Bootstrap_RaScaleOut', 'SI_Bootstrap_RaMaxWorkers',
|                   # #685: the timer a job this update creates gets in schedules mode (step 9a)
|                   'SI_Bootstrap_ScheduleVerification',
|                   # #714: the mail job's timer in schedules mode (its own setting, else the customer's send time)
|                   'SI_Bootstrap_ScheduleCloseLoopMail', 'Mail_CloseLoop_Daily_SendTimeUtc',
|                   # #715: whether ServiceNow is used (the settings Bootstrap reads) and the ServiceNow vulnerability job's timer
|                   'SI_VulnSync_Target', 'SI_VulnSync_ServiceNowTable', 'SI_Bootstrap_ServiceNowVulnerabilities', 'SI_Bootstrap_ServiceNowCmdb',
|                   'SI_EnableServiceNowCmdb', 'SI_Cmdb_Run', 'SI_Bootstrap_ScheduleVulnerabilitiesServiceNow',
|                   # #723: the status report's own timer -- set = the customer's, never moved to the 15-minute timer
|                   'SI_Bootstrap_ScheduleHeartbeat',
|                   # the display names at an existing install (step 12): the switch, and the engine application's client id
|                   'SI_Update_RenameDisplayNames', 'SI_SPN_AppId',
|                   # #852: the install's Key Vault -- the sign-in front's key (step 9g)
|                   'SI_KeyVaultName') {
|        $v = Get-Variable -Name $n -Scope Global -ValueOnly -ErrorAction Ignore
|        if ($null -ne $v) { $globals[$n] = $v }
|    }
|    # #509: a job size the customer set (step 8 keeps it)
|    foreach ($gvar in @(Get-Variable -Scope Global -ErrorAction Ignore | Where-Object { $_.Name -match '^SI_Bootstrap_(Cpu|Memory|ReplicaTimeout)_' })) {
|        if ($null -ne $gvar.Value) { $globals[$gvar.Name] = $gvar.Value }
|    }
|}
|# THE NIGHTLY SCHEDULE, the folder's part (setup/_shared/SI-NightlySchedule.ps1): a pipeline start time in this folder's config
|# files on a shipped value (23:30 Europe/Copenhagen, or the old 22:00) becomes 23:30 in the time zone of the install's Azure
|# region, once -- before the files are shared with the container jobs below (after the sign-in, which reads the region; with no
|# container hosting there is no region: Danish time). Only where the folder has its own config (an extracted release has
|# none). Never fails the update.
|$nightlyLib = Join-Path $PSScriptRoot '_shared/SI-NightlySchedule.ps1'
|$script:SINightlyRegion = $null
|if (Test-Path -LiteralPath $nightlyLib) { . $nightlyLib }
|# #830 the report-row copy's one-time step (9e)
|$reportCopyLib = Join-Path $PSScriptRoot '_shared/SI-ReportCopyDefault.ps1'
|if (Test-Path -LiteralPath $reportCopyLib) { . $reportCopyLib }
|# #865 SI's own SQL close-loop target always on (9k)
|$ownSqlConnectorLib = Join-Path $PSScriptRoot '_shared/SI-OwnSqlConnector.ps1'
|if (Test-Path -LiteralPath $ownSqlConnectorLib) { . $ownSqlConnectorLib }
|# #903 one ServiceNow data-out connector for both outputs (9m)
|$snowDataOutLib = Join-Path $PSScriptRoot '_shared/SI-SnowDataOutConnector.ps1'
|if (Test-Path -LiteralPath $snowDataOutLib) { . $snowDataOutLib }
|# #912 the ServiceNow staging status table: an install that already sends keeps sending (9n)
|$snowStagingStatusLib = Join-Path $PSScriptRoot '_shared/SI-SnowStagingStatus.ps1'
|if (Test-Path -LiteralPath $snowStagingStatusLib) { . $snowStagingStatusLib }
|# #914 one route into ServiceNow: the older push's settings are named once and left in place (9o)
|$snowOneRouteLib = Join-Path $PSScriptRoot '_shared/SI-SnowOneRoute.ps1'
|if (Test-Path -LiteralPath $snowOneRouteLib) { . $snowOneRouteLib }
|function Invoke-SIUpdateNightlyFiles {
|    # -NoHosting: no container hosting, so no Azure region -- Danish time. With hosting, a region that could not be read leaves
|    # the files for the next update (never records Danish time for an install whose region is simply not read yet).
|    param([switch]$NoHosting)
|    if ($SizingOnly) { return }   # #756: the settings-only size check writes no config file
|    if (-not (Get-Command -Name Invoke-SINightlyPipelineFiles -ErrorAction SilentlyContinue)) { return }
|    if (-not $NoHosting -and -not ($script:SINightlyRegion -and "$($script:SINightlyRegion.Region)".Trim())) { return }
|    $rz = if ($script:SINightlyRegion) { $script:SINightlyRegion } else { Get-SINightlyRegionZone '' }
|    $nf = Invoke-SINightlyPipelineFiles -Root $solRoot -Zone $rz.Zone -Region $rz.Region -WhatIf:(-not $Apply -or $DetectOnly)
|    if (@($nf.Lines).Count -and $rz.Line) { Info $rz.Line }
|    foreach ($l in @($nf.Lines)) { if ($nf.Action -eq 'failed') { Warn $l } else { Info $l } }
|    # 9l: the 19:00 move of the folder's pipeline start, once, after the region step's files (owner 2026-10-21)
|    if (Get-Command -Name Invoke-SINightly1900PipelineFiles -ErrorAction SilentlyContinue) {
|        $n9 = Invoke-SINightly1900PipelineFiles -Root $solRoot -Zone $rz.Zone -Region $rz.Region -WhatIf:(-not $Apply -or $DetectOnly)
|        if (@($n9.Lines).Count -and $rz.Line -and -not @($nf.Lines).Count) { Info $rz.Line }
|        foreach ($l in @($n9.Lines)) { if ($n9.Action -eq 'failed') { Warn $l } else { Info $l } }
|    }
|}
|$target =Resolve-SIContainerUpdateTarget -ResourceGroupName $ResourceGroupName -AcrName $AcrName -SubscriptionId $SubscriptionId -Globals $globals
|if (-not $target) {
|    if ($Save) { throw '-Save needs the containers to save: pass -ResourceGroupName and -AcrName (and -SubscriptionId unless the config has SI_WorkspaceResourceId).' }
|    Invoke-SIUpdateNightlyFiles -NoHosting
|    Info 'No container hosting is configured for this install -- nothing to update (the engines run from this folder).'
|    exit 0
|}
|$sub = $target.SubscriptionId
|Info ("resource group {0}, registry {1}" -f $target.ResourceGroupName, $target.AcrName)
|if ($Save) {
|    $saved = Save-SIContainerHostingConfig -ConfigPath $customFile -SubscriptionId $sub `
|        -ResourceGroupName $target.ResourceGroupName -AcrName $target.AcrName
|    Info ("saved in config\SecurityInsight.custom.ps1 ({0}) -- every later sync finds these containers." -f $(if ($saved.Changed) { 'written' } else { 'already there' }))
|}
|
|# #521: THE ONE SIGN-IN of this update -- SecurityInsight's own REST token client, no az, no module. The updater job's
|# identity (SI_UPDATER_*: managed identity or certificate), else the run's own sign-in from the config. A sign-in the
|# updater already made in this process is kept.
|$rest = $null; $signInError = ''
|try { $who = Connect-SIUpdateRest -SubscriptionId $sub; $rest = New-SIUpdateRestSeam; Info ("signed in to Azure over REST as {0}" -f $who) }
|catch { $signInError = $_.Exception.Message }
|# the install's Azure region (its Container Apps environment, else its resource group) -> the nightly schedule's time zone
|# (#756 -SizingOnly: no config file is written, so neither the region nor the folder's schedule is read)
|if ($rest -and -not $SizingOnly -and (Get-Command -Name Get-SINightlyInstallRegion -ErrorAction SilentlyContinue)) {
|    $script:SINightlyRegion = Get-SINightlyRegionZone (Get-SINightlyInstallRegion -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName)
|}
|Invoke-SIUpdateNightlyFiles
|
|# The install's customisation files (CMDB.csv, custom queries, exclusions, enrichment rules...) reach the container jobs
|# through its storage account, never through the image -- so a change made here since the last sync is shared now, whoever
|# rolls the image. Not on an install that keeps its configuration in the Pro settings database. Never fails the update.
|$ovAccount = [string](Get-Variable -Name SI_StorageAccount -Scope Global -ValueOnly -ErrorAction Ignore)
|$ovPro = (Get-Variable -Name SI_ProSqlServer -Scope Global -ValueOnly -ErrorAction Ignore) -and (Get-Variable -Name SI_ProSqlDatabase -Scope Global -ValueOnly -ErrorAction Ignore) -and
|         (Test-Path -LiteralPath (Join-Path $solRoot 'engine/pro-settings/SI-ProSettings.ps1'))
|$ovLib = Join-Path $solRoot 'container/_shared/SI-ContainerRunState.ps1'
|if ($ovAccount -and -not $ovPro -and -not $SizingOnly -and (Test-Path -LiteralPath $ovLib)) {
|    . $ovLib
|    if ($Apply -and -not $DetectOnly) {
|        if ($rest) {
|            $ov = Publish-SIContainerOverlay -Root $solRoot -AccountName $ovAccount -Rest $rest
|            if (@($ov.Failed).Count) { Warn $ov.Message } else { Info $ov.Message }
|        } else { Warn ("the customisation files were not shared: no Azure sign-in ({0})" -f $signInError) }
|    } else {
|        Info ("{0} customisation file(s) would be shared with the container jobs (re-run with -Apply)." -f @(Get-SIContainerOverlayFiles -Root $solRoot).Count)
|    }
|}
|# Pro: once Upgrade-SIToPro.ps1 has installed the updater job, the JOB rolls these containers -- to what this
|# customer's ring approves. A roll from here would put them on whatever this folder holds instead.
|# #250: Pro -- the default templates (template pack 1.0), installed or kept current once the jobs run this tree.
|$proTemplates = $ovPro -and (Test-Path -LiteralPath (Join-Path $solRoot 'setup/Publish-SITemplates.ps1'))
|function Install-SIUpdateDefaultTemplates {
|    if (-not $proTemplates) { return 0 }
|    if (-not $Apply -or $DetectOnly) { Info 'Pro: the default templates (template pack 1.0) are installed or kept current on -Apply.'; return 0 }
|    Step '6. TEMPLATES (Pro)'
|    try {
|        if ($InstallTemplatesDirect) {
|            # #405: ring 1 -- every template of this tree, directly (no pack, no gate)
|            $r = & (Join-Path $solRoot 'setup/Publish-SITemplates.ps1') -InstallCurrent -PassThru | Where-Object { $_ -and $_.PSObject.Properties['Mode'] } | Select-Object -Last 1
|        } else {
|        $r = & (Join-Path $solRoot 'setup/Publish-SITemplates.ps1') -InstallDefault -PassThru | Where-Object { $_ -and $_.PSObject.Properties['Mode'] } | Select-Object -Last 1
|        }
|        if ($r -and $r.Mode -eq 'blocked') { Info ("default templates: waiting for a review on the Template releases page -- {0}" -f $r.Reason) }
|        else { Info ("default templates: {0}" -f $(if ($r) { $r.Reason } else { 'done' })) }
|    } catch {
|        Warn ("The default templates were not installed: {0} -- the jobs run on; the next setup or update run tries again." -f $_.Exception.Message)
|    }
|    0
|}
|# A SIZE THE CUSTOMER SET, as the update reads it (owner 2026-10-18: support sets it per install through the product's settings
|# path): the Pro database's value (cfg.Setting, solution scope -- the Settings page, setup\Set-SIProSetting.ps1) first, then the
|# install's config, then the updater job's variable (-EnvName). '' when none is set. The Pro database is read ONCE per update,
|# every name below in one parameterised statement, signed in with this update's own token; a database that cannot be read is
|# one line, and the config and the variable still count.
|$script:SIUpdateProSettings = $null
|$script:SIUpdateProSettingNames = @('SI_Bootstrap_SqlServiceObjective', 'SI_Bootstrap_WebAppCpu', 'SI_Bootstrap_WebAppMemory')
|function ConvertFrom-SIUpdateSettingJson {
|    <# PURE. A cfg.Setting ValueJson ('"S2"', '2.5', 'null') -> its text ('' for none); text that is not JSON is taken as it is. #>
|    param([AllowNull()]$Json)
|    if ($null -eq $Json -or $Json -is [DBNull]) { return '' }
|    $raw = "$Json".Trim()
|    if (-not $raw) { return '' }
|    $v = $raw; try { $v = ConvertFrom-Json -InputObject $raw } catch { $v = $raw }
|    if ($null -eq $v) { return '' }
|    if ($v -is [double] -or $v -is [decimal] -or $v -is [single]) { return $v.ToString([Globalization.CultureInfo]::InvariantCulture) }
|    "$v".Trim()
|}
|function Get-SIUpdateSetting {
|    param([Parameter(Mandatory)][string]$Name, [string]$EnvName)
|    if ($null -eq $script:SIUpdateProSettings) {
|        $script:SIUpdateProSettings = @{}
|        $proSrv = "$([Environment]::GetEnvironmentVariable('SI_UPDATER_PRO_SQL_SERVER'))".Trim(); if (-not $proSrv -and $globals.ContainsKey('SI_ProSqlServer')) { $proSrv = "$($globals['SI_ProSqlServer'])".Trim() }
|        $proDb = "$([Environment]::GetEnvironmentVariable('SI_UPDATER_PRO_SQL_DATABASE'))".Trim(); if (-not $proDb -and $globals.ContainsKey('SI_ProSqlDatabase')) { $proDb = "$($globals['SI_ProSqlDatabase'])".Trim() }
|        if ($proSrv -and $proDb -and (Get-Command -Name Get-SIAzureToken -ErrorAction SilentlyContinue)) {
|            if ($proSrv -notmatch '\.') { $proSrv = $proSrv + '.database.windows.net' }
|            $cn = $null
|            try {
|                $tok = ([string](Get-SIAzureToken -Resource 'https://database.windows.net/')).Trim()
|                if (-not $tok) { throw 'no access token for the database' }
|                $cn = New-Object System.Data.SqlClient.SqlConnection
|                $cn.ConnectionString = "Server=tcp:$proSrv,1433;Database=$proDb;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
|                $cn.AccessToken = $tok
|                $cn.Open(); $cmd = $cn.CreateCommand(); $cmd.CommandTimeout = 0
|                $ps = @(); $i = 0
|                foreach ($n in $script:SIUpdateProSettingNames) { $p = '@n{0}' -f $i; $null = $cmd.Parameters.AddWithValue($p, $n); $ps += $p; $i++ }
|                $cmd.CommandText = "IF OBJECT_ID('cfg.Setting') IS NOT NULL SELECT Name, ValueJson FROM cfg.Setting WHERE Scope = N'solution' AND Name IN ({0});" -f ($ps -join ', ')
|                $rd = $cmd.ExecuteReader()
|                try { while ($rd.Read()) { $script:SIUpdateProSettings[[string]$rd.GetValue(0)] = ConvertFrom-SIUpdateSettingJson $rd.GetValue(1) } } finally { $rd.Dispose() }
|            } catch { Info ("settings: the Pro database's settings could not be read ({0}) -- the config and the job's variables count" -f $_.Exception.Message) }
|            finally { if ($cn) { $cn.Dispose() } }
|        }
|    }
|    if ($script:SIUpdateProSettings.ContainsKey($Name) -and "$($script:SIUpdateProSettings[$Name])".Trim()) { return "$($script:SIUpdateProSettings[$Name])".Trim() }
|    if ($globals.ContainsKey($Name) -and "$($globals[$Name])".Trim()) { return "$($globals[$Name])".Trim() }
|    if ($EnvName) { $v = [Environment]::GetEnvironmentVariable($EnvName); if ("$v".Trim()) { return "$v".Trim() } }
|    ''
|}
|# #507: THE SQL DATABASE SIZE (setup/_shared/SI-SqlTier.ps1) -- every update raises a Basic (or smaller-than-the-rule)
|# SI database to its size (#509: the Pro database S3, the identity ledger S1), by one online ARM PATCH of its sku. Without a
|# size the customer set it never lowers, and never touches a database above S3, on Premium, on vCore or in an elastic pool.
|# A size the customer set (SI_Bootstrap_SqlServiceObjective: the Pro database's setting, then the config, then the updater
|# job's SI_UPDATER_SQL_SERVICE_OBJECTIVE) applies in BOTH directions (owner 2026-10-18: S2 on an S3 database lowers it),
|# never below S1. One line per database in this log; the updater records the summary (cfg.InstallState 'SqlTier'). Never
|# fails the update.
|function Invoke-SIUpdateSqlTier {
|    $lib = Join-Path $PSScriptRoot '_shared/SI-SqlTier.ps1'
|    if (-not (Test-Path -LiteralPath $lib) -or -not $rest) { return }
|    try {
|        . $lib
|        Step '7. SQL DATABASE SIZE'
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        # the tenant's size: Graph $count as this identity; else the collection jobs setup sized for it; else S1
|        $objects = Get-SISqlTierObjectCount -Counts (Get-SISqlTierTenantCounts -Rest $rest -SubscriptionId $sub)
|        $sizeFrom = 'the directory'
|        if ($null -eq $objects) { $objects = Get-SISqlTierObjectsFromJobs -Jobs @($script:SISqlTierJobs); $sizeFrom = 'the collection jobs'' size' }
|        Info ("tenant size: {0}" -f $(if ($null -ne $objects) { '{0:N0}+ directory objects (from {1})' -f $objects, $sizeFrom } else { 'not readable by this identity (no directory read, no sized collection job)' }))
|        $override = Get-SIUpdateSetting -Name 'SI_Bootstrap_SqlServiceObjective' -EnvName 'SI_UPDATER_SQL_SERVICE_OBJECTIVE'
|        $servers = @((& $envOr 'SI_UPDATER_PRO_SQL_SERVER'), (& $gv 'SI_ProSqlServer'), (& $gv 'SI_LedgerSqlServer'), (& $gv 'SI_Pro_DataSqlServer')) | Where-Object { $_ }
|        $dbs = @((& $envOr 'SI_UPDATER_PRO_SQL_DATABASE'), (& $gv 'SI_ProSqlDatabase'), (& $gv 'SI_Pro_DataSqlDatabase')) | Where-Object { $_ }
|        # the identity ledger: S1 at any tenant size (identifiers only; the record writes are in the Pro database)
|        $ledger = @((& $gv 'SI_LedgerDatabase')) | Where-Object { $_ }
|        $up = Invoke-SISqlTierUpgrade -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -ServerFqdns @($servers) -DatabaseNames @($dbs) -LedgerDatabaseNames @($ledger) `
|                -Objects $objects -Override $override -WhatIf:(-not $Apply -or $DetectOnly)
|        foreach ($l in @($up.Lines)) { if ($l -match 'NOT raised|NOT lowered|may not change|refused this identity|was not found') { Warn $l } else { Info $l } }
|        $global:SI_UpdateSqlTier = Get-SISqlTierSummaryLine -Upgrade $up
|    } catch { Warn ("SQL database size: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|# #509: THE JOB SIZE (setup/_shared/SI-JobSizing.ps1) -- every update re-applies the sizing rule setup uses at install
|# (Get-SITenantSizedJobResources) to the identity / endpoint / CI build / Risk Analysis jobs, and raises a job whose last run
|# ran out of memory or hit its replica timeout one band. The run limit is not sized: every engine job has the longest one
|# Azure takes (the job floor, step 8c, sets it; this step applies the same value), and the pipeline job itself 7 days.
|# Raises only, never above 4 CPU / 8 GiB; a size the customer
|# set (SI_Bootstrap_Cpu_ / _Memory_ / _ReplicaTimeout_<Engine>) wins. One line per job changed. Never fails the update.
|function Invoke-SIUpdateJobSizing {
|    $lib = Join-Path $PSScriptRoot '_shared/SI-JobSizing.ps1'
|    if (-not (Test-Path -LiteralPath $lib) -or -not @($script:SISqlTierJobs).Count -or -not $rest) { return }
|    try {
|        . $lib
|        Step '8. JOB SIZE'
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        # the Pro database (the records the last collection wrote): signed in with this update's own token (REST client)
|        $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|        $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|        $sqlRows = $null
|        if ($proSrv -and $proDb) {
|            $sqlRows = {
|                param([string]$Sql)
|                $tok = ''; try { $tok = [string](Get-SIAzureToken -Resource 'https://database.windows.net/') } catch { $tok = '' }
|                if (-not $tok.Trim()) { return @() }
|                $cn = New-Object System.Data.SqlClient.SqlConnection
|                $cn.ConnectionString = "Server=tcp:$proSrv,1433;Database=$proDb;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
|                $cn.AccessToken = $tok.Trim()
|                try {
|                    $cn.Open(); $cmd = $cn.CreateCommand(); $cmd.CommandText = $Sql; $cmd.CommandTimeout = 0
|                    $rd = $cmd.ExecuteReader()
|                    try { while ($rd.Read()) { $o = [ordered]@{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $o[$rd.GetName($i)] = $rd.GetValue($i) }; [pscustomobject]$o } } finally { $rd.Dispose() }
|                } finally { $cn.Dispose() }
|            }   # dynamic scope: $proSrv, $proDb come from this function
|        }
|        $ws = & $envOr 'SI_UPDATER_WORKSPACE_RESOURCE_ID'; if (-not $ws) { $ws = & $gv 'SI_WorkspaceResourceId' }
|        $js = Invoke-SIJobSizing -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Jobs @($script:SISqlTierJobs) -Globals $globals `
|                -SqlRows $sqlRows -WorkspaceResourceId $ws -WhatIf:(-not $Apply -or $DetectOnly)
|        foreach ($l in @($js.Lines)) { if ($l -match 'NOT raised|not checked') { Warn $l } else { Info $l } }
|    } catch { Warn ("job size: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|# #519: QUEUE SCALING FOR EXISTING INSTALLS (setup/_shared/SI-KedaConvert.ps1) -- an install made before queue scaling still
|# runs identity / endpoint / Azure as one scheduled job each. Every update moves such a job to what setup gives a new
|# install: a producer + queue-scaled workers, built by Bootstrap's own job definitions from the old job (image, settings,
|# identity, size, schedule). Only a job SI's setup made, signed in with the managed identity, not switched off
|# (SI_Bootstrap_UseKEDA = $false / SI_UPDATER_USE_KEDA = false). The old job loses its timer only after both new jobs are
|# read back, and before the producer gets it; it is kept. Any failure: the old job runs on. Never fails the update.
|function Invoke-SIUpdateKedaConvert {
|    $lib = Join-Path $PSScriptRoot '_shared/SI-KedaConvert.ps1'
|    if (-not (Test-Path -LiteralPath $lib) -or -not @($script:SISqlTierJobs).Count) { return }
|    try {
|        . $lib
|        Step '9. QUEUE SCALING'
|        # ON for every install (owner 2026-10-10: "live for r1 and r2"); SI_UPDATER_KEDA_CONVERT = off on an install's updater
|        # job keeps that install on the PLAN only ("would move ..."), nothing changes there
|        $kcOn = -not ("$([Environment]::GetEnvironmentVariable('SI_UPDATER_KEDA_CONVERT'))".Trim() -match '^(?i)(0|false|off|no)$')
|        if ($Apply -and -not $DetectOnly -and -not $kcOn) { Info 'queue scaling: the plan only -- queue scaling is switched off for this install''s updater.' }
|        $kcWhatIf = (-not $Apply -or $DetectOnly -or -not $kcOn)
|        if (-not $rest) { $kcWhatIf = $true }   # no Azure sign-in here: the plan only
|        $kcJobs = @($script:SISqlTierJobs)
|        if (-not $kcWhatIf) {
|            # NO az CLI here (operator: "pure rest or arm only"): ARM and the queue data plane through this update's REST seam
|            # (setup/_shared/SI-UpdateRest.ps1 over engine/_shared/SI-AzRest.ps1); every 4xx but 401 is an ANSWER for the
|            # caller (409 = the queue exists, 404 = not there)
|            $kcRest = $rest
|            # the jobs as they are NOW (the roll and the job size above may have changed them): the new jobs take over their image and size
|            try { $v = @(Get-SIArmJobList -Rest $kcRest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName); if ($v.Count) { $kcJobs = $v } } catch { }
|        } else { $kcRest = { param($Method, $Uri, $Body, $Resource, $Headers) [pscustomobject]@{ Status = 0; Body = '-WhatIf' } } }
|        $kc = Invoke-SIKedaConvert -Rest $kcRest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Jobs $kcJobs -Globals $globals `
|                -UpdaterUseKeda ([string][Environment]::GetEnvironmentVariable('SI_UPDATER_USE_KEDA')) -WhatIf:$kcWhatIf
|        foreach ($l in @($kc.Lines)) { if ($l -match 'NOT moved|not checked|could not') { Warn $l } else { Info $l } }
|    } catch { Warn ("queue scaling: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|# #742: THE RISK ANALYSIS WORKERS FOR EXISTING INSTALLS (setup/_shared/SI-RaWorkerJobs.ps1) -- ON BY DEFAULT where they can
|# run (owner 2026-10-18: "pls dont turn off things that improve time, why do that"; rule: existing installs reach new-install
|# state): the update gives the install the worker job a new install gets, built from the Risk Analysis job (image, settings,
|# identity, size), read back, and only then tells the Risk Analysis job (SI_RA_SCALE_OUT / SI_RA_WORKER_JOB). Only a job SI's
|# setup made, signed in with the managed identity, queue scaling not switched off -- otherwise nothing changes and one line
|# says why. The customer's SI_Bootstrap_RaScaleOut = $false (or SI_UPDATER_RA_SCALE_OUT = off): no worker is made, and a Risk
|# Analysis job still told it is a producer is told it is not (read back). Idempotent: a second run finds 'present'. Any
|# failure: the job runs its reports itself, as before; the next update tries again. Never fails the update.
|function Invoke-SIUpdateRaWorkers {
|    $lib = Join-Path $PSScriptRoot '_shared/SI-RaWorkerJobs.ps1'
|    if (-not (Test-Path -LiteralPath $lib) -or -not @($script:SISqlTierJobs).Count) { return }
|    try {
|        . $lib
|        $rwJobs = @($script:SISqlTierJobs)
|        if (-not @($rwJobs | Where-Object { [string]$_.name -eq 'caj-si-risk-analysis-detailed' }).Count) { return }
|        Step '9b. RISK ANALYSIS WORKERS'
|        $rwWhatIf = (-not $Apply -or $DetectOnly)
|        if (-not $rest) { $rwWhatIf = $true }
|        if (-not $rwWhatIf) { try { $v = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName); if ($v.Count) { $rwJobs = $v } } catch { } }
|        $rwRest = if ($rwWhatIf) { { param($Method, $Uri, $Body, $Resource, $Headers) [pscustomobject]@{ Status = 0; Body = '-WhatIf' } } } else { $rest }
|        $rw = Invoke-SIRaWorkerJobs -Rest $rwRest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Jobs $rwJobs -Globals $globals `
|                -UpdaterUseKeda ([string][Environment]::GetEnvironmentVariable('SI_UPDATER_USE_KEDA')) -UpdaterRaScaleOut ([string][Environment]::GetEnvironmentVariable('SI_UPDATER_RA_SCALE_OUT')) -WhatIf:$rwWhatIf
|        foreach ($l in @($rw.Lines)) { if ($l -match 'NOT |not checked|could not') { Warn $l } else { Info $l } }
|    } catch { Warn ("risk analysis workers: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|# THE UPDATER'S OWN SIZE (owner 2026-10-10: the registry build ran out of memory on 0.5 CPU / 1 GiB): every update raises the
|# updater job to at least 4 CPU / 8 GiB -- what setup gives a new install -- keeping its image and everything else (one
|# read-modify-write PATCH of its template). Raises only; a bigger size is kept. The NEXT run uses it (this execution keeps
|# the size it started with). Never fails the update.
|function Invoke-SIUpdateUpdaterSize {
|    if (-not $rest) { return }
|    try {
|        $name = [string](Get-SIUpdaterManagedJob -Globals $globals)
|        if (-not $name.Trim()) { $name = [string][Environment]::GetEnvironmentVariable('CONTAINER_APP_JOB_NAME') }
|        if (-not $name.Trim()) { return }
|        Step '8b. UPDATER SIZE'
|        $uri = 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs/{2}?api-version=2025-07-01' -f $sub, $target.ResourceGroupName, $name.Trim()
|        $g = & $rest 'GET' $uri $null 'https://management.azure.com' @{}
|        if (-not $g -or [int]$g.Status -ne 200) { Warn ("updater size: {0} could not be read (HTTP {1}) -- the next update tries again" -f $name, $(if ($g) { $g.Status } else { 0 })); return }
|        $job = [string]$g.Body | ConvertFrom-Json
|        $first = @($job.properties.template.containers | Where-Object { $_ }) | Select-Object -First 1
|        if (-not $first) { return }
|        # THE UPDATER'S RUN LIMIT (owner 2026-10-22: "i accept no limits" / "remove those stupid breaks"): the updater works out
|        # key figures, published copies and schema batches over every row of a large install -- it gets the run limit every
|        # engine job gets (Get-SIJobRunLimit, the longest Azure takes; a refusal above 24 hours is sent again as 24 hours by
|        # Invoke-SIJobSizePatch). Raises only; the next updater run has it.
|        $jsLib = Join-Path $PSScriptRoot '_shared/SI-JobSizing.ps1'
|        if (-not (Get-Command -Name Invoke-SIJobSizePatch -ErrorAction SilentlyContinue) -and (Test-Path -LiteralPath $jsLib)) { . $jsLib }
|        if ((Get-Command -Name Get-SIJobRunLimit -ErrorAction SilentlyContinue) -and (Get-Command -Name Invoke-SIJobSizePatch -ErrorAction SilentlyContinue)) {
|            $rtNow = 0; try { $rtNow = [int]"$($job.properties.configuration.replicaTimeout)" } catch { $rtNow = 0 }
|            $rtWant = [int](Get-SIJobRunLimit)
|            if ($rtNow -gt 0 -and $rtNow -lt $rtWant) {
|                if (-not $Apply -or $DetectOnly) { Info ("updater run limit: {0} would be raised from {1} s to {2} s (re-run with -Apply)" -f $name, $rtNow, $rtWant) }
|                else {
|                    $rl = Invoke-SIJobSizePatch -Rest $rest -JobUri $uri -JobName $name.Trim() -ReplicaTimeout $rtWant -CurrentReplicaTimeout $rtNow
|                    foreach ($l in @($rl.Lines)) { Info $l }
|                    if ($rl.Ok) { Info ("updater run limit: {0} raised from {1} s to {2} s -- the next run uses it" -f $name, $rtNow, $rl.ReplicaTimeout) }
|                    else { Warn ("updater run limit: {0} was NOT raised ({1}) -- the next update tries again" -f $name, $rl.Why) }
|                    # the size below is worked out on the job as it is now
|                    $g = & $rest 'GET' $uri $null 'https://management.azure.com' @{}
|                    if ($g -and [int]$g.Status -eq 200) { $job = [string]$g.Body | ConvertFrom-Json; $first = @($job.properties.template.containers | Where-Object { $_ }) | Select-Object -First 1 }
|                }
|            }
|        }
|        $body = New-SITemplateImagePatchBody -Resource $job -Image ([string]$first.image) -MinCpu 4 -MinMemoryGi 8
|        $want = ($body | ConvertFrom-Json).properties.template.containers[0].resources
|        $cur = '{0} CPU / {1}' -f $first.resources.cpu, $first.resources.memory
|        if ([string]$want.cpu -eq [string]$first.resources.cpu -and [string]$want.memory -eq [string]$first.resources.memory) { Info ("updater size: {0} runs {1} -- nothing to raise" -f $name, $cur); return }
|        if (-not $Apply -or $DetectOnly) { Info ("updater size: {0} would be raised from {1} to {2} CPU / {3} (re-run with -Apply)" -f $name, $cur, $want.cpu, $want.memory); return }
|        $r = & $rest 'PATCH' $uri $body 'https://management.azure.com' @{ 'Content-Type' = 'application/json' }
|        if (-not $r -or [int]$r.Status -lt 200 -or [int]$r.Status -ge 300) { Warn ("updater size: {0} was NOT raised (HTTP {1}) -- the next update tries again" -f $name, $(if ($r) { $r.Status } else { 0 })); return }
|        Info ("updater size: {0} raised from {1} to {2} CPU / {3} -- the next run uses it" -f $name, $cur, $want.cpu, $want.memory)
|    } catch { Warn ("updater size: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|# THE JOB FLOOR (setup/_shared/SI-JobSizing.ps1, Invoke-SIJobFloor). Every update raises EVERY caj-si-* job (not the
|# updater -- its own step gives it 4 / 8) to at least 2 CPU / 4 GiB (owner 2026-10-10: "money must not be the case", "time
|# is critical"), a queue producer to at least its engine's single job, and gives it THE RUN LIMIT EVERY ENGINE JOB GETS:
|# the longest one Azure takes (Get-SIJobRunLimit; owner 2026-10-13: "we are not to judge that and it breaks the whole
|# solution") -- SecurityInsight chooses no run limit. It needs no run history: a job that never finished a run is raised
|# like any other (a customer's CI build was stopped at 2 hours three runs in a row and four updates left it there). The
|# pipeline job keeps its own rule; a run limit the customer set is left alone. Raises only. One line per job. The job list
|# is read again afterwards, so the steps after this one see what the jobs have now. Never fails the update.
|function Invoke-SIUpdateJobFloor {
|    $lib = Join-Path $PSScriptRoot '_shared/SI-JobSizing.ps1'
|    if (-not (Test-Path -LiteralPath $lib) -or -not $rest) { return }
|    try {
|        . $lib
|        $all = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName)
|        if (-not @($all | Where-Object { [string]$_.name -like 'caj-si-*' }).Count) { return }
|        Step ('8c. JOB FLOOR (heavy jobs 4 CPU / 8 GiB, the others 2 CPU / 4 GiB; run limit {0}, the longest Azure takes)' -f (Format-SIJobTimeout -Seconds ([int](Get-SIJobRunLimit))))
|        $fl = Invoke-SIJobFloor -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Jobs $all -Globals $globals `
|                -UpdaterName ([string](Get-SIUpdaterManagedJob -Globals $globals)) -WhatIf:(-not $Apply -or $DetectOnly)
|        foreach ($l in @($fl.Lines)) { if ($l -match 'NOT raised|not checked') { Warn $l } else { Info $l } }
|        if (@($fl.Results | Where-Object { $_.Action -eq 'raised' }).Count) {
|            try { $v = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName); if ($v.Count) { $script:SISqlTierJobs = $v } } catch { }
|        }
|    } catch { Warn ("job floor: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|# THE ENGINE JOBS' RETRY LIMIT (2026-10-16 for Risk Analysis, every engine job since 2026-10-23; setup/_shared/SI-JobSizing.ps1
|# Invoke-SIEngineJobRetryLimit): every job the pipeline starts gets replicaRetryLimit 0 -- a failed run is never restarted by
|# Azure inside the same execution (the pipeline decides). The runner (caj-si-flow), the updater and the jobs that are no step
|# keep theirs. One read-modify-write PATCH per job, read back; one line per job. The first time
|# this reaches an install it also says, once, that the detailed Excel workbook is now off by default. Never fails the update.
|function Invoke-SIUpdateEngineRetryLimit {
|    $lib = Join-Path $PSScriptRoot '_shared/SI-JobSizing.ps1'
|    if (-not (Test-Path -LiteralPath $lib) -or -not $rest) { return }
|    try {
|        . $lib
|        $all = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName)
|        $res = @(Invoke-SIEngineJobRetryLimit -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Jobs $all -WhatIf:(-not $Apply -or $DetectOnly))
|        if (-not $res.Count) { return }
|        Step '8e. ENGINE JOB RETRY LIMIT (0: a failed run is not restarted by Azure; the pipeline decides)'
|        foreach ($r in $res) { if ($r.Action -eq 'failed') { Warn $r.Line } else { Info $r.Line } }
|        if (@($res | Where-Object { $_.Action -eq 'set' -and [string]$_.Job -eq 'caj-si-risk-analysis-detailed' }).Count) {
|            Info 'excel export: the detailed Risk Analysis workbook is now off by default (SI_RA_ExcelExport_Detailed) -- an install that set it keeps its choice; every row is in the web app. The summary workbook stays on.'
|        }
|    } catch { Warn ("retry limit: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|# #873 E -- THE RISK ANALYSIS JOBS' .NET GEN0 BUDGET (setup/_shared/SI-RaGcSetting.ps1): every Risk Analysis job, its extra
|# report jobs and its queue workers get DOTNET_GCgen0size (256 MB) when it is missing -- what a new install gets
|# (Get-SIRaJobEnvArgs). One read-modify-write PATCH of the first container's environment per job, read back; one line per
|# job. A job that has the variable keeps its value. SI_Bootstrap_RaGcGen0Size = off: not added. Never fails the update.
|function Invoke-SIUpdateRaGcSetting {
|    $lib = Join-Path $PSScriptRoot '_shared/SI-RaGcSetting.ps1'
|    if (-not (Test-Path -LiteralPath $lib) -or -not $rest) { return }
|    try {
|        . $lib
|        if (-not (Get-Command -Name Get-SIArmJobList -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '_shared/SI-FastRoll.ps1') }
|        $all = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName)
|        $res = @(Invoke-SIRaGcSetting -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Jobs $all -Globals $globals -WhatIf:(-not $Apply -or $DetectOnly))
|        if (-not $res.Count) { return }
|        Step '8f. RISK ANALYSIS GC (a 256 MB gen0 budget for the scoring; no row changes)'
|        foreach ($r in $res) { if ($r.Action -eq 'failed') { Warn $r.Line } else { Info $r.Line } }
|    } catch { Warn ("risk analysis GC: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|# "NEITHER MODE" (found live on a ring 2 install 2026-10-10: caj-si-flow had no timer and no job of the pipeline had its own
|# -- nothing ran for 14 h): every update puts it back to the pipeline (flow mode), by the same plan and PATCH as
|# setup\Switch-SIJobOrchestration.ps1 -Mode flow (engine\_shared\SI-JobFlow.ps1 Invoke-SIJobOrchestrationRepair), one plain
|# warning line. -DetectOnly: the plan only. Any other state is left exactly as it is. Never fails the update.
|function Invoke-SIUpdateOrchestration {
|    if (-not $rest) { return }
|    try {
|        . (Join-Path $solRoot 'engine/_shared/SI-JobFlow.ps1')
|        Step '9b. PIPELINE SCHEDULE'
|        $all = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName)
|        # #732 (live 2026-10-17: one install's caj-si-flow was Manual and never ran; a queued run waited 6 h): the pipeline
|        # runner of an existing install gets the schedule a new install gets ("*/5 * * * *") -- one read-modify-write PATCH
|        # (whole template, run limit kept, no secret sent back), read back, one plain line. Never fails the update.
|        try {
|            $fr = Invoke-SIFlowRunnerSchedule -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Jobs $all -WhatIf:(-not $Apply -or $DetectOnly)
|            if ($fr.State -eq 'failed') { Warn $fr.Line } else { Info $fr.Line }
|            if ($fr.State -eq 'patched') { try { $v = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName); if ($v.Count) { $all = $v } } catch { } }
|            $global:SI_UpdateFlowRunner = $fr
|        } catch { Warn ("pipeline runner: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|        # #732 (owner 2026-10-17: ONE method everywhere): an install that runs its jobs on their own timers is moved to the
|        # pipeline -- only when nothing runs (else one line, the next update tries again), everything read back, put back on
|        # its timers if a step fails, one run queued when today's start would otherwise be skipped. -DetectOnly: the plan only.
|        if ($fr -and $fr.State -eq 'schedules-mode') {
|            try {
|                $migSql = $null
|                $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|                $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|                $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|                $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|                if ($proSrv -and $proDb) {
|                    if ($proSrv -notmatch '\.') { $proSrv = $proSrv + '.database.windows.net' }
|                    # parameterised statements on the Pro database, signed in with this update's own token (a new connection per call)
|                    $migSql = {
|                        param([string]$Query, $Params, [string]$Mode)
|                        $tok = ([string](Get-SIAzureToken -Resource 'https://database.windows.net/')).Trim()
|                        if (-not $tok) { throw 'no access token for the database' }
|                        $cn = New-Object System.Data.SqlClient.SqlConnection
|                        $cn.ConnectionString = "Server=tcp:$proSrv,1433;Database=$proDb;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
|                        $cn.AccessToken = $tok
|                        try {
|                            $cn.Open(); $cmd = $cn.CreateCommand(); $cmd.CommandText = $Query; $cmd.CommandTimeout = 0
|                            if ($Params) { foreach ($k in @($Params.Keys)) { $pv = $Params[$k]; $null = $cmd.Parameters.AddWithValue('@' + $k, $(if ($null -eq $pv) { [DBNull]::Value } else { $pv })) } }
|                            if ($Mode -eq 'nonquery') { return $cmd.ExecuteNonQuery() }
|                            $rd = $cmd.ExecuteReader()
|                            try { while ($rd.Read()) { $o = [ordered]@{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $o[$rd.GetName($i)] = $rd.GetValue($i) }; [pscustomobject]$o } } finally { $rd.Dispose() }
|                        } finally { $cn.Dispose() }
|                    }   # dynamic scope: $proSrv, $proDb come from this function
|                }
|                $mig = Invoke-SIJobFlowMigration -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Jobs $all -Sql $migSql -WhatIf:(-not $Apply -or $DetectOnly)
|                foreach ($l in @($mig.Lines)) { if ($mig.State -in @('failed', 'reverted')) { Warn $l } else { Info $l } }
|                $global:SI_UpdateFlowMigration = $mig
|                if (@($mig.Changed).Count) { try { $v = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName); if ($v.Count) { $all = $v } } catch { } }
|            } catch { Warn ("switch to the pipeline: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|        }
|        $arm = {
|            param($Method, $Path, $Body)
|            $u = 'https://management.azure.com{0}?api-version={1}' -f $Path, $script:SIFastRollArmApi
|            Invoke-SIRestJson -Rest $rest -Method $Method -Uri $u -Body $(if ($null -ne $Body) { $Body | ConvertTo-Json -Depth 10 -Compress } else { $null }) `
|                -Headers @{ 'Content-Type' = 'application/json' } -What ('{0} {1}' -f $Method, ($Path -split '/')[-1])
|        }
|        $r = Invoke-SIJobOrchestrationRepair -Jobs $all -Arm $arm -WhatIf:(-not $Apply -or $DetectOnly) -Log { param($l, $m) if ($l -eq 'WARN') { Warn $m } else { Info $m } }
|        $global:SI_UpdateOrchestration = $r
|        # #1096 (found live: a collect producer kept its own daily timer beside the pipeline -- a second, full collection every
|        # day that belonged to no run): in pipeline mode a producer whose engine is a step is started ONLY by the pipeline --
|        # Manual, its cron remembered, read back; the state a new install has. Idempotent. Never fails the update.
|        try { Invoke-SIUpdateCollectProducers -Arm $arm } catch { Warn ("collect producers: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|    } catch { Warn ("pipeline schedule: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|# #1096 THE COLLECT PRODUCERS IN THE PIPELINE (engine\_shared\SI-JobFlow.ps1 Invoke-SICollectProducerTrigger): the mode is the
|# stored one (cfg.JobFlow Mode), else caj-si-flow on its timer = the pipeline; the pipeline is the stored one, else the default
|# over the installed jobs. A Pro install whose stored pipeline cannot be read is left as it is (one line) -- a producer whose
|# engine is not a step of the stored pipeline is that engine's only collection and must keep its timer.
|function Invoke-SIUpdateCollectProducers {
|    param([Parameter(Mandatory)][scriptblock]$Arm)
|    $all = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName)
|    if (-not @($all | Where-Object { [string]$_.name -match '^caj-si-.+-producer$' }).Count) { return }
|    $def = $null; $storedMode = ''
|    $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|    $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|    $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|    $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|    if ($proSrv -and $proDb) {
|        if ($proSrv -notmatch '\.') { $proSrv = $proSrv + '.database.windows.net' }
|        try {
|            # the open through the shared retry (engine\_shared\SI-SqlRetry.ps1: a failover or a resume is tried again with a fresh token)
|            if (-not (Get-Command -Name Open-SISqlConnectionRetry -ErrorAction Ignore)) { . (Join-Path $solRoot 'engine/_shared/SI-SqlRetry.ps1') }
|            $cn = Open-SISqlConnectionRetry -Server $proSrv -Database $proDb -Token { param([bool]$Fresh) ([string](Get-SIAzureToken -Resource 'https://database.windows.net/' -ForceRefresh:$Fresh)).Trim() }
|            try {
|                $cmd = $cn.CreateCommand(); $cmd.CommandText = (Get-SIJobFlowSqlText -Name ReadDefinition); $cmd.CommandTimeout = 0
|                $rd = $cmd.ExecuteReader()
|                try { if ($rd.Read()) { if (-not $rd.IsDBNull(0)) { $def = ConvertFrom-SIJobFlowJson -Json ([string]$rd.GetValue(0)) }; if (-not $rd.IsDBNull(1)) { $storedMode = ([string]$rd.GetValue(1)).ToLowerInvariant() } } } finally { $rd.Dispose() }
|            } finally { $cn.Dispose() }
|        } catch { Warn ("collect producers: the stored pipeline could not be read ({0}) -- nothing changed; the next update tries again." -f $_.Exception.Message); return }
|    }
|    $flowJob = @($all | Where-Object { [string]$_.name -eq 'caj-si-flow' })[0]
|    $mode = if ($storedMode -in @('flow', 'schedules')) { $storedMode } elseif ($flowJob -and [string]$flowJob.properties.configuration.triggerType -eq 'Schedule') { 'flow' } else { 'schedules' }
|    Step '9q. COLLECT PRODUCERS (started only by the pipeline)'
|    $cp = Invoke-SICollectProducerTrigger -Jobs $all -Arm $Arm -Mode $mode -Definition $def -WhatIf:(-not $Apply -or $DetectOnly)
|    foreach ($l in @($cp.Lines)) { if ($l -match 'NOT taken off|not checked|not a step') { Warn $l } else { Info $l } }
|    $global:SI_UpdateCollectProducers = $cp
|}
|# THE WEB APP'S SIZE (owner 2026-10-18: "reduce web app to 2cpus 4 gb ram" -- 7 days of telemetry: at most 0.1 CPU / 0.5 GiB
|# used of 4 CPU / 8 GiB): every update SETS the Pro web app's own container (the name the install record gives, else
|# ca-si-management) to 2 CPU / 4 GiB -- what setup gives a new install -- by one read-modify-write PATCH of its template
|# (setup/_shared/SI-JobSizing.ps1, Invoke-SIWebAppSize): a smaller one is raised, one on the product's earlier 4 CPU / 8 GiB is
|# lowered, any other larger size is the customer's and kept. A size the customer set (SI_Bootstrap_WebAppCpu /
|# SI_Bootstrap_WebAppMemory: the Pro database's setting, then the config) wins, both ways. The sign-in front sidecar and the
|# MCP server are not touched. No web app (Community): nothing to do. Waits for the new revision and reads the size back, so
|# the web app roll after it is not refused as an operation in flight. Never fails the update.
|function Invoke-SIUpdateWebAppSize {
|    $lib = Join-Path $PSScriptRoot '_shared/SI-JobSizing.ps1'
|    if (-not (Test-Path -LiteralPath $lib) -or -not $rest) { return }
|    try {
|        . $lib
|        # CR5 step 1 (#655): the install record the updater resolved ($global:SI_InstallNames), then SI_UPDATER_WEB_APP, then
|        # today's name (engine/_shared/SI-InstallNames.ps1); a release without that file: the variable, then today's name
|        $namesLib = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'engine', '_shared', 'SI-InstallNames.ps1')
|        if (Test-Path -LiteralPath $namesLib) { . $namesLib; $name = Get-SIInstallName -Role web }
|        else { $name = "$([Environment]::GetEnvironmentVariable('SI_UPDATER_WEB_APP'))".Trim(); if (-not $name) { $name = 'ca-si-management' } }
|        Step '8d. WEB APP SIZE (2 CPU / 4 GiB)'
|        $webCpu = Get-SIUpdateSetting -Name 'SI_Bootstrap_WebAppCpu'; $webMem = Get-SIUpdateSetting -Name 'SI_Bootstrap_WebAppMemory'
|        $r = Invoke-SIWebAppSize -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Name $name -Cpu $webCpu -Memory $webMem -WhatIf:(-not $Apply -or $DetectOnly)
|        foreach ($l in @($r.Lines)) { if ($l -match 'NOT raised|NOT lowered|could not') { Warn $l } else { Info $l } }
|    } catch { Warn ("web app size: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|# THE PERMISSIONS AN EXISTING INSTALL HAS NOT GRANTED YET (setup/_shared/SI-PermissionNote.ps1; owner 2026-10-11: SecurityInsight
|# may ask for more read-only permissions, "customers grant on their next permission setup run"). Every update compares what
|# the collection identity holds with config/permissions.locked.json and says, per missing permission, ONE plain line (what
|# it is for, read-only, what stays empty) and the two lines that grant them. READ ONLY: it grants nothing, changes nothing,
|# never fails or holds the update, and says nothing when every permission is granted. A sign-in that may not read the
|# directory: the collection engines' own check on their newest run (exact when that run checked this very list), else one
|# line that it could not check -- never a guess.
|function Invoke-SIUpdatePermissionNote {
|    $lib = Join-Path $PSScriptRoot '_shared/SI-PermissionNote.ps1'
|    if (-not (Test-Path -LiteralPath $lib) -or -not $rest) { return }
|    try {
|        . $lib
|        $ws = "$([Environment]::GetEnvironmentVariable('SI_UPDATER_WORKSPACE_RESOURCE_ID'))".Trim()
|        $n = Invoke-SIPermissionNote -Rest $rest -Jobs @($script:SISqlTierJobs) -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Globals $globals -WorkspaceResourceId $ws
|        if (-not @($n.Lines).Count) { return }
|        Step '10. PERMISSIONS (read only)'
|        foreach ($l in @($n.Lines)) { Info $l }
|    } catch { Info ("permissions: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|# #685: THE JOBS A NEWER VERSION NEEDS (setup/_shared/SI-MissingJobs.ps1; rule: existing installs reach new-install state).
|# caj-si-verification (the verification service and the daily data health check it runs) was created by no setup and no
|# update until 2026-10-15. Every update creates such a job where it is missing -- from a Pro job of the install (its image,
|# sign-in, settings and secrets), with the trigger Bootstrap gives a new install (in flow mode a step of the pipeline, no
|# timer) -- and reads it back; a job that does not read back right is removed again. A job that exists is never touched.
|# After the job floor and the queue scaling (it takes the donor's floored size and run limit), before the pipeline-schedule
|# check (which then sees the new step). Never fails the update. -DetectOnly: the plan only.
|function Invoke-SIUpdateMissingJobs {
|    $lib = Join-Path $PSScriptRoot '_shared/SI-MissingJobs.ps1'
|    if (-not (Test-Path -LiteralPath $lib) -or -not $rest) { return }
|    try {
|        . $lib
|        $all = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName)
|        if (-not @($all | Where-Object { [string]$_.name -like 'caj-si-*' }).Count) { return }
|        Step '9a. MISSING JOBS'
|        # #715: the ServiceNow connectors the Pro database holds (cfg.Connector: what the web app's Connectors / Get Started
|        # pages write) -- a ServiceNow job is made only where the install uses ServiceNow. Not readable = the settings alone, said.
|        $connectors = @()
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|        $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|        if ($proSrv -and $proDb) {
|            if ($proSrv -notmatch '\.') { $proSrv = $proSrv + '.database.windows.net' }
|            try {
|                $tok = ([string](Get-SIAzureToken -Resource 'https://database.windows.net/')).Trim()
|                if (-not $tok) { throw 'no access token for the database' }
|                $cn = New-Object System.Data.SqlClient.SqlConnection
|                $cn.ConnectionString = "Server=tcp:$proSrv,1433;Database=$proDb;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
|                $cn.AccessToken = $tok
|                try {
|                    $cn.Open(); $cmd = $cn.CreateCommand(); $cmd.CommandTimeout = 0
|                    $cmd.CommandText = (Get-SIMissingJobConnectorSql)
|                    $rd = $cmd.ExecuteReader()
|                    try { while ($rd.Read()) { $connectors += [pscustomobject]@{ Kind = [string]$rd.GetValue(0); Direction = [string]$rd.GetValue(1) } } } finally { $rd.Dispose() }
|                } finally { $cn.Dispose() }
|            } catch { Info ("missing jobs: the connectors could not be read from the Pro database ({0}) -- a ServiceNow job is made only where a setting says ServiceNow is used; the next update reads them again." -f $_.Exception.Message) }
|        }
|        $conditions = Get-SIMissingJobConditions -Globals $globals -Connectors $connectors
|        $mj = Invoke-SIMissingJobs -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Root $solRoot -Jobs $all -Globals $globals -WhatIf:(-not $Apply -or $DetectOnly) -Conditions $conditions
|        foreach ($l in @($mj.Lines)) { if ($l -match 'NOT created|NOT moved|not checked') { Warn $l } else { Info $l } }
|        # review B1 (2026-10-22): an existing job gets the secret only another kind of job carries -- the data sync sends the
|        # Risk Analysis Detailed mail, so it needs the SMTP relay password as the mail jobs have it (a new install: Bootstrap)
|        $jb = Invoke-SIJobSecretBorrow -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Jobs $all -WhatIf:(-not $Apply -or $DetectOnly)
|        foreach ($l in @($jb.Lines)) { if ($l -match 'did NOT|not checked') { Warn $l } else { Info $l } }
|        if (@($mj.Results | Where-Object { $_.Action -eq 'created' }).Count) {
|            try { $v = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName); if ($v.Count) { $script:SISqlTierJobs = $v } } catch { }
|        }
|    } catch { Warn ("missing jobs: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|# THE NIGHTLY SCHEDULE (setup/_shared/SI-NightlySchedule.ps1; owner 2026-10-15: "complete by 8am" / "11pm local time for region"),
|# ONCE per install, in the time zone of the install's Azure region: (a) the updater job's timer -- on a shipped timer (the old
|# '0 3 * * *', or the Danish-time '0 21,22 * * *' with its tag '23:00 Europe/Copenhagen' or none) -> the UTC hours that are 23:00
|# in the region's zone (the updater ends the other tick itself), one read-modify-write PATCH of its trigger, read back, the zone
|# recorded on the job (tags si-nightly-schedule + si-nightly-region); a timer the customer chose is kept. (b) Pro: a pipeline
|# start on a shipped value (23:30 Europe/Copenhagen, or the old 22:00 where the Danish-time step never ran; cfg.Setting at any
|# scope, and the stored pipeline cfg.JobFlow) becomes 23:30 in the region's zone, in one transaction with its change-log rows,
|# recorded in cfg.InstallState 'NightlyScheduleRegion'. One plain line each. Never fails the update.
|function Invoke-SIUpdateNightlySchedule {
|    if (-not (Get-Command -Name Invoke-SINightlyUpdaterSchedule -ErrorAction SilentlyContinue)) { return }
|    $wi = (-not $Apply -or $DetectOnly)
|    $rz = if ($script:SINightlyRegion) { $script:SINightlyRegion } else { Get-SINightlyRegionZone '' }
|    $regionSaid = $false
|    try {
|        if ($rest) {
|            $name = [string](Get-SIUpdaterManagedJob -Globals $globals)
|            if (-not $name.Trim()) { $name = [string][Environment]::GetEnvironmentVariable('CONTAINER_APP_JOB_NAME') }
|            if (-not $name.Trim() -and @($script:SISqlTierJobs | Where-Object { [string]$_.name -eq 'caj-si-updater' }).Count) { $name = 'caj-si-updater' }
|            if ($name.Trim()) {
|                $u = Invoke-SINightlyUpdaterSchedule -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -JobName $name.Trim() -Region $rz.Region -WhatIf:$wi
|                if (@($u.Lines).Count) { Step '9c. NIGHTLY SCHEDULE' }
|                foreach ($l in @($u.Lines)) { if ($u.Action -eq 'failed') { Warn $l } else { Info $l } }
|                if ($rz.Line -and @($u.Lines) -contains $rz.Line) { $regionSaid = $true }
|                # no region was read: the job's own location decided the zone -- the pipeline follows it
|                if (-not $rz.Known -and "$($u.Region)".Trim()) { $rz = Get-SINightlyRegionZone $u.Region }
|                # 9l (owner 2026-10-21): the region step's 23:00 -> 18:30 in the same zone, once (tag si-nightly-1900)
|                if (Get-Command -Name Get-SINightly1900UpdaterPlan -ErrorAction SilentlyContinue) {
|                    $u9 = Invoke-SINightlyUpdaterSchedule -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -JobName $name.Trim() -Region $rz.Region -WhatIf:$wi -Step '1900'
|                    if (@($u9.Lines).Count) { Step '9l. NIGHTLY 19:00 (the nightly update)' }
|                    foreach ($l in @($u9.Lines)) { if ($u9.Action -eq 'failed') { Warn $l } elseif (-not ($regionSaid -and $l -eq $rz.Line)) { Info $l } }
|                }
|            }
|        }
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|        $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|        if (-not $proSrv -or -not $proDb) { return }
|        if (-not "$($rz.Region)".Trim()) { Warn "nightly schedule: the install's Azure region could not be read -- the daily pipeline's start time is checked on the next update."; return }
|        if ($proSrv -notmatch '\.') { $proSrv = $proSrv + '.database.windows.net' }
|        # parameterised statements on the Pro database, signed in with this update's own token (a new connection per call)
|        $sql = {
|            param([string]$Query, $Params, [string]$Mode)
|            $tok = ([string](Get-SIAzureToken -Resource 'https://database.windows.net/')).Trim()
|            if (-not $tok) { throw 'no access token for the database' }
|            $cn = New-Object System.Data.SqlClient.SqlConnection
|            $cn.ConnectionString = "Server=tcp:$proSrv,1433;Database=$proDb;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
|            $cn.AccessToken = $tok
|            try {
|                $cn.Open(); $cmd = $cn.CreateCommand(); $cmd.CommandText = $Query; $cmd.CommandTimeout = 0
|                if ($Params) { foreach ($k in @($Params.Keys)) { $pv = $Params[$k]; $null = $cmd.Parameters.AddWithValue('@' + $k, $(if ($null -eq $pv) { [DBNull]::Value } else { $pv })) } }
|                if ($Mode -eq 'nonquery') { return $cmd.ExecuteNonQuery() }
|                $rd = $cmd.ExecuteReader()
|                try { while ($rd.Read()) { $o = [ordered]@{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $o[$rd.GetName($i)] = $rd.GetValue($i) }; [pscustomobject]$o } } finally { $rd.Dispose() }
|            } finally { $cn.Dispose() }
|        }   # dynamic scope: $proSrv, $proDb come from this function
|        $p = Invoke-SINightlyPipelineStart -Sql $sql -Zone $rz.Zone -Region $rz.Region -WhatIf:$wi
|        if (@($p.Lines).Count) { Step '9c. NIGHTLY SCHEDULE (the daily pipeline)' }
|        if (@($p.Lines).Count -and $rz.Line -and -not $regionSaid) { Info $rz.Line }
|        foreach ($l in @($p.Lines)) { if ($p.Action -eq 'failed') { Warn $l } else { Info $l } }
|        # 9l (owner 2026-10-21): the region step's 23:30 -> 19:00 in the same zone, once (cfg.InstallState 'NightlySchedule1900')
|        if (Get-Command -Name Invoke-SINightly1900PipelineStart -ErrorAction SilentlyContinue) {
|            $p9 = Invoke-SINightly1900PipelineStart -Sql $sql -Zone $rz.Zone -Region $rz.Region -WhatIf:$wi
|            if (@($p9.Lines).Count) { Step '9l. NIGHTLY 19:00 (the daily pipeline)' }
|            foreach ($l in @($p9.Lines)) { if ($p9.Action -eq 'failed') { Warn $l } else { Info $l } }
|        }
|        # 9m #986: the pipeline's start time lives in the Pro database only -- its stale copy is removed from the jobs' settings
|        # (a start time the customer chose that exists only there is kept in the database first)
|        if ($rest -and (Get-Command -Name Invoke-SINightlyJobEnvCleanup -ErrorAction SilentlyContinue)) {
|            $je = Invoke-SINightlyJobEnvCleanup -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Sql $sql -WhatIf:$wi
|            if (@($je.Lines).Count) { Step '9m. THE PIPELINE''S START TIME (the database only)' }
|            foreach ($l in @($je.Lines)) { if ($je.Action -eq 'failed') { Warn $l } else { Info $l } }
|        }
|    } catch { Warn ("nightly schedule: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|# #830 THE REPORT-ROW COPY (setup/_shared/SI-ReportCopyDefault.ps1): the copy of the Risk Analysis report rows to Log Analytics
|# reaches the new-install state (off) once -- what setup wrote is set off, what a person chose is kept. One plain line. Never
|# fails the update.
|function Invoke-SIUpdateReportCopy {
|    if (-not (Get-Command -Name Invoke-SIReportCopyDefault -ErrorAction SilentlyContinue)) { return }
|    try {
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|        $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|        if (-not $proSrv -or -not $proDb) { return }
|        if ($proSrv -notmatch '\.') { $proSrv = $proSrv + '.database.windows.net' }
|        # parameterised statements on the Pro database, signed in with this update's own token (a new connection per call)
|        $sql = {
|            param([string]$Query, $Params, [string]$Mode)
|            $tok = ([string](Get-SIAzureToken -Resource 'https://database.windows.net/')).Trim()
|            if (-not $tok) { throw 'no access token for the database' }
|            $cn = New-Object System.Data.SqlClient.SqlConnection
|            $cn.ConnectionString = "Server=tcp:$proSrv,1433;Database=$proDb;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
|            $cn.AccessToken = $tok
|            try {
|                $cn.Open(); $cmd = $cn.CreateCommand(); $cmd.CommandText = $Query; $cmd.CommandTimeout = 0
|                if ($Params) { foreach ($k in @($Params.Keys)) { $pv = $Params[$k]; $null = $cmd.Parameters.AddWithValue('@' + $k, $(if ($null -eq $pv) { [DBNull]::Value } else { $pv })) } }
|                if ($Mode -eq 'nonquery') { return $cmd.ExecuteNonQuery() }
|                $rd = $cmd.ExecuteReader()
|                try { while ($rd.Read()) { $o = [ordered]@{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $o[$rd.GetName($i)] = $rd.GetValue($i) }; [pscustomobject]$o } } finally { $rd.Dispose() }
|            } finally { $cn.Dispose() }
|        }   # dynamic scope: $proSrv, $proDb come from this function
|        $r = Invoke-SIReportCopyDefault -Sql $sql -WhatIf:(-not $Apply -or $DetectOnly)
|        if (@($r.Lines).Count) { Step '9e. REPORT ROW COPY' }
|        foreach ($l in @($r.Lines)) { if ($r.Action -eq 'failed') { Warn $l } else { Info $l } }
|    } catch { Warn ("report rows: the copy to Log Analytics was not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|
|# #842 THE SUMMARY VIEWS WRITTEN AGAIN AFTER AN UPDATE THAT CHANGED THEM (setup/_shared/SI-SummaryGroupsRebuild.ps1): collections
|# whose Summary views were written from another definition than this release ships get ONE data sync queued in the pipeline's
|# queue (it waits until no run is going), instead of waiting for the nightly run. Pro only. One plain line. Never fails the
|# update; idempotent (nothing to write again = nothing queued, nothing said).
|function Invoke-SIUpdateSummaryRebuild {
|    $lib = Join-Path $PSScriptRoot '_shared/SI-SummaryGroupsRebuild.ps1'
|    $defLib = Join-Path $solRoot 'engine/_shared/SI-SummaryGroupings.ps1'
|    if (-not (Test-Path -LiteralPath $lib) -or -not (Test-Path -LiteralPath $defLib)) { return }
|    try {
|        . $lib
|        if (-not (Get-Command -Name Get-SISummaryGroupingDefinition -ErrorAction SilentlyContinue)) { . $defLib }
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|        $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|        if (-not $proSrv -or -not $proDb) { return }
|        # the data lives in the Pro database unless the install keeps it in another one (as the data sync reads it)
|        $dataSrv = & $gv 'SI_Pro_DataSqlServer'; $dataDb = & $gv 'SI_Pro_DataSqlDatabase'
|        if (-not $dataSrv -or -not $dataDb) { $dataSrv = $proSrv; $dataDb = $proDb }
|        if ($proSrv -notmatch '\.') { $proSrv = $proSrv + '.database.windows.net' }
|        if ($dataSrv -notmatch '\.') { $dataSrv = $dataSrv + '.database.windows.net' }
|        $jobs = @($script:SISqlTierJobs)
|        if ($rest) { try { $v = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName); if ($v.Count) { $jobs = $v } } catch { } }
|        $hasDataSync = [bool]@($jobs | Where-Object { [string]$_.name -eq 'caj-si-asset-datasync' }).Count
|        # parameterised statements, signed in with this update's own token (a new connection per call)
|        $open = {
|            param([string]$Server, [string]$Database, [string]$Query, $Params)
|            $tok = ([string](Get-SIAzureToken -Resource 'https://database.windows.net/')).Trim()
|            if (-not $tok) { throw 'no access token for the database' }
|            $cn = New-Object System.Data.SqlClient.SqlConnection
|            $cn.ConnectionString = "Server=tcp:$Server,1433;Database=$Database;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
|            $cn.AccessToken = $tok
|            try {
|                $cn.Open(); $cmd = $cn.CreateCommand(); $cmd.CommandText = $Query; $cmd.CommandTimeout = 0
|                if ($Params) { foreach ($k in @($Params.Keys)) { $pv = $Params[$k]; $null = $cmd.Parameters.AddWithValue('@' + $k, $(if ($null -eq $pv) { [DBNull]::Value } else { $pv })) } }
|                $rd = $cmd.ExecuteReader()
|                try { while ($rd.Read()) { $o = [ordered]@{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $o[$rd.GetName($i)] = $rd.GetValue($i) }; [pscustomobject]$o } } finally { $rd.Dispose() }
|            } finally { $cn.Dispose() }
|        }
|        $sql = { param([string]$Query, $Params, [string]$Mode) & $open $proSrv $proDb $Query $Params }        # dynamic scope: this function's values
|        $dataSql = { param([string]$Query, $Params, [string]$Mode) & $open $dataSrv $dataDb $Query $Params }
|        $r = Invoke-SISummaryGroupsRebuild -DataSql $dataSql -Sql $sql -Hash ([string](Get-SISummaryGroupingDefinition).Hash) -DataSyncInstalled $hasDataSync -WhatIf:(-not $Apply -or $DetectOnly)
|        if (@($r.Lines).Count) { Step '9f. SUMMARY VIEWS' }
|        foreach ($l in @($r.Lines)) { if ($r.Action -eq 'failed') { Warn $l } else { Info $l } }
|        $global:SI_UpdateSummaryRebuild = $r
|    } catch { Warn ("summary views: whether they must be written again was not checked ({0}) -- the next data sync writes them; the next update checks again." -f $_.Exception.Message) }
|}
|
|# THE SHOWN RUN'S COPIES OF THE MERGED ASSETS CAUGHT UP (engine/_shared/data-sql/SI-DataPublishedRun.ps1, Invoke-SIPublishedCopyCatchUp;
|# 2026-10-21: a publish that moved the pointer without refreshing the copies left the asset pages on a copy from before the CI
|# lifecycle). A published run whose copies (sidata.CiPub, AssetPub, ...) are older than it is refreshed now by the database's
|# own procedure (sidata.PublishedCopyCatchUp -> PublishedCopyRefreshAll: only what changed), in the data database -- existing
|# installs correct themselves with no hand SQL. Pro only. One plain line only when they were stale. Never fails the update;
|# idempotent (copies as new as the publish = nothing done, nothing said). No time limit on the statement: the refresh is as
|# long as the data that changed.
|function Invoke-SIUpdatePublishedCopy {
|    $lib = Join-Path $solRoot 'engine/_shared/data-sql/SI-DataPublishedRun.ps1'
|    if (-not (Test-Path -LiteralPath $lib)) { return }
|    try {
|        if (-not (Get-Command -Name Invoke-SIPublishedCopyCatchUp -ErrorAction SilentlyContinue)) { . $lib }
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|        $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|        if (-not $proSrv -or -not $proDb) { return }
|        # the data lives in the Pro database unless the install keeps it in another one (as the data sync and the web app read it)
|        $dataSrv = & $gv 'SI_Pro_DataSqlServer'; $dataDb = & $gv 'SI_Pro_DataSqlDatabase'
|        if (-not $dataSrv -or -not $dataDb) { $dataSrv = $proSrv; $dataDb = $proDb }
|        if ($dataSrv -notmatch '\.') { $dataSrv = $dataSrv + '.database.windows.net' }
|        # parameterised statements on the data database, signed in with this update's own token (a new connection per call)
|        $dataSql = {
|            param([string]$Query, $Params, [string]$Mode)
|            $tok = ([string](Get-SIAzureToken -Resource 'https://database.windows.net/')).Trim()
|            if (-not $tok) { throw 'no access token for the database' }
|            $cn = New-Object System.Data.SqlClient.SqlConnection
|            $cn.ConnectionString = "Server=tcp:$dataSrv,1433;Database=$dataDb;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
|            $cn.AccessToken = $tok
|            try {
|                $cn.Open(); $cmd = $cn.CreateCommand(); $cmd.CommandText = $Query; $cmd.CommandTimeout = 0
|                if ($Params) { foreach ($k in @($Params.Keys)) { $pv = $Params[$k]; $null = $cmd.Parameters.AddWithValue('@' + $k, $(if ($null -eq $pv) { [DBNull]::Value } else { $pv })) } }
|                $rd = $cmd.ExecuteReader()
|                try { while ($rd.Read()) { $o = [ordered]@{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $o[$rd.GetName($i)] = $rd.GetValue($i) }; [pscustomobject]$o } } finally { $rd.Dispose() }
|            } finally { $cn.Dispose() }
|        }   # dynamic scope: $dataSrv, $dataDb come from this function
|        $r = Invoke-SIPublishedCopyCatchUp -Invoke $dataSql -WhatIf:(-not $Apply -or $DetectOnly)
|        if (@($r.Lines).Count) { Step '9j. PUBLISHED COPIES' }
|        foreach ($l in @($r.Lines)) { if ($r.Action -in @('failed', 'held')) { Warn $l } else { Info $l } }
|        $global:SI_UpdatePublishedCopy = $r
|    } catch { Warn ("published copies: not checked ({0}) -- the update goes on; the pipeline runner checks them on its next wake-up." -f $_.Exception.Message) }
|}
|
|# #855 THE KEY FIGURES WORKED OUT AGAIN RIGHT AFTER AN UPDATE THAT CHANGED THEM (owner 2026-10-21: "can we then auto-fix the data
|# ... without running the full pipe" / "the trust of devices, executive numbers etc are important"): the newest complete
|# collections whose figures lack this release's marker (Get-SIDataUnfiguredSql) are figured again HERE, with the engine's own
|# statement (engine/pro-data/_shared/SI-DataKeyFigures.ps1) and the install's own protection-score settings -- no pipeline
|# run, no data sync. Pro only. Bounded (the newest 4, a time budget); what is left the next data sync figures. One plain line.
|# Never fails the update; idempotent (every collection carries the marker = nothing to do, nothing said).
|function Invoke-SIUpdateKeyFigures {
|    $lib = Join-Path $solRoot 'engine/pro-data/_shared/SI-DataKeyFigures.ps1'
|    $psLib = Join-Path $solRoot 'engine/_shared/SI-ProtectionScore.ps1'
|    if (-not (Test-Path -LiteralPath $lib) -or -not (Test-Path -LiteralPath $psLib)) { return }
|    try {
|        . $psLib; . $lib
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|        $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|        if (-not $proSrv -or -not $proDb) { return }
|        $dataSrv = & $gv 'SI_Pro_DataSqlServer'; $dataDb = & $gv 'SI_Pro_DataSqlDatabase'
|        if (-not $dataSrv -or -not $dataDb) { $dataSrv = $proSrv; $dataDb = $proDb }
|        if ($proSrv -notmatch '\.') { $proSrv = $proSrv + '.database.windows.net' }
|        if ($dataSrv -notmatch '\.') { $dataSrv = $dataSrv + '.database.windows.net' }
|        # parameterised statements, signed in with this update's own token (a new connection per call); 'scalar' = the first
|        # column of the first row, as the data sync's seam answers it
|        $open = {
|            param([string]$Server, [string]$Database, [string]$Query, $Params, [string]$Mode)
|            $tok = ([string](Get-SIAzureToken -Resource 'https://database.windows.net/')).Trim()
|            if (-not $tok) { throw 'no access token for the database' }
|            $cn = New-Object System.Data.SqlClient.SqlConnection
|            $cn.ConnectionString = "Server=tcp:$Server,1433;Database=$Database;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
|            $cn.AccessToken = $tok
|            try {
|                $cn.Open(); $cmd = $cn.CreateCommand(); $cmd.CommandText = $Query; $cmd.CommandTimeout = 0
|                if ($Params) { foreach ($k in @($Params.Keys)) { $pv = $Params[$k]; $null = $cmd.Parameters.AddWithValue('@' + $k, $(if ($null -eq $pv) { [DBNull]::Value } else { $pv })) } }
|                if ($Mode -eq 'scalar') { $v = $cmd.ExecuteScalar(); if ($v -is [DBNull]) { return $null }; return $v }
|                $rd = $cmd.ExecuteReader()
|                try { while ($rd.Read()) { $o = [ordered]@{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $o[$rd.GetName($i)] = $(if ($rd.IsDBNull($i)) { $null } else { $rd.GetValue($i) }) }; [pscustomobject]$o } } finally { $rd.Dispose() }
|            } finally { $cn.Dispose() }
|        }
|        $dataSql = {
|            param([string]$Query, $Params, [string]$Mode, [scriptblock]$OnRow)
|            if ($Mode -ne 'session') { return (& $open $dataSrv $dataDb $Query $Params $Mode) }
|            # NO TIME LIMIT (owner 2026-10-22: "i accept no limits"): the key figures of a large collection run as steps on ONE
|            # connection (plain batches, so the #temp tables live between them), each step with no command time limit and a
|            # progress line (Invoke-SIDataKeyFiguresStepped)
|            $tok = ([string](Get-SIAzureToken -Resource 'https://database.windows.net/')).Trim()
|            if (-not $tok) { throw 'no access token for the database' }
|            $scn = New-Object System.Data.SqlClient.SqlConnection
|            $scn.ConnectionString = "Server=tcp:$dataSrv,1433;Database=$dataDb;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
|            $scn.AccessToken = $tok
|            try {
|                $scn.Open()
|                $run = {
|                    param([string]$StepSql, [string]$StepMode)
|                    $sc = $scn.CreateCommand(); $sc.CommandText = $StepSql; $sc.CommandTimeout = 0
|                    if ($StepMode -eq 'scalar') { $v = $sc.ExecuteScalar(); if ($v -is [DBNull]) { return $null }; return $v }
|                    if ($StepMode -eq 'reader') {
|                        $rd = $sc.ExecuteReader()
|                        try { while ($rd.Read()) { $o = [ordered]@{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $o[$rd.GetName($i)] = $(if ($rd.IsDBNull($i)) { $null } else { $rd.GetValue($i) }) }; [pscustomobject]$o } } finally { $rd.Dispose() }
|                        return
|                    }
|                    [void]$sc.ExecuteNonQuery()
|                }.GetNewClosure()
|                & $OnRow $run
|            } finally { $scn.Dispose() }
|        }
|        $dataSql | Add-Member -NotePropertyName SISqlSession -NotePropertyValue $true
|        # the install's own protection-score settings (the Settings page's value, else the config's): a list is kept as one
|        # comma-separated value, as the score's reader takes it
|        $names = @('SI_ProtectionScore_TierWeights', 'SI_ProtectionScore_Severities', 'SI_ProtectionScore_GraceDays_Device', 'SI_ProtectionScore_GraceDays_Identity',
|                   'SI_ProtectionScore_GraceDays_CloudResource', 'SI_ProtectionScore_GraceDays_PublicIp', 'SI_PatchCycle_CatchUpDays',
|                   # #859: the key figures' windows (Get-SIKeyFigureWindowSettings) -- figured again with the install's own values
|                   'SI_KeyFigures_RecentDays', 'SI_KeyFigures_MeanTimeToFixDays', 'SI_KeyFigures_StaleAdminDays', 'SI_KeyFigures_CveAgeBands',
|                   # #860: the grace of the findings that are not patches (default 0) -- the refigure of existing installs uses them
|                   'SI_ProtectionScore_OtherGraceDays_Device', 'SI_ProtectionScore_OtherGraceDays_Identity', 'SI_ProtectionScore_OtherGraceDays_CloudResource', 'SI_ProtectionScore_OtherGraceDays_PublicIp')
|        $settings = @{}
|        foreach ($n in $names) { $v = & $gv $n; if ($v) { $settings[$n] = $v } }
|        try {
|            $q = "IF OBJECT_ID('cfg.Setting') IS NOT NULL SELECT Name, ValueJson FROM cfg.Setting WHERE Scope = N'solution' AND Name IN (" + ((0..($names.Count - 1) | ForEach-Object { '@n' + $_ }) -join ', ') + ');'
|            $p = @{}; for ($i = 0; $i -lt $names.Count; $i++) { $p['n' + $i] = $names[$i] }
|            foreach ($r in @(& $open $proSrv $proDb $q $p 'reader')) {
|                $raw = [string]$r.ValueJson; if (-not $raw.Trim()) { continue }
|                $v = $raw; try { $v = ConvertFrom-Json -InputObject $raw } catch { $v = $raw }
|                if ($null -eq $v) { continue }
|                $t = if ($v -is [System.Array]) { (@($v) | ForEach-Object { "$_".Trim() }) -join ',' } elseif ($v -is [double] -or $v -is [decimal]) { $v.ToString([Globalization.CultureInfo]::InvariantCulture) } else { "$v".Trim() }
|                if ($t) { $settings[[string]$r.Name] = $t }
|            }
|        } catch { Info ("key figures: the Settings page's protection-score values could not be read ({0}) -- the config's values count" -f $_.Exception.Message) }
|        if ($settings.ContainsKey('SI_PatchCycle_CatchUpDays')) { $global:SI_PatchCycle_CatchUpDays = $settings['SI_PatchCycle_CatchUpDays'] }
|        if (-not $Apply -or $DetectOnly) {
|            $n = @(& $dataSql (Get-SIDataUnfiguredSql) @{} 'reader').Count
|            if ($n) { Step '9i. KEY FIGURES'; Info ("key figures: {0} collection(s) would be figured again with this release's figures" -f $n) }
|            return
|        }
|        $lines = New-Object System.Collections.Generic.List[string]
|        $r = Invoke-SIDataKeyFigures -Invoke $dataSql -Settings $settings -BudgetSeconds 900 -Log { param($l, $m) $lines.Add(('{0}|{1}' -f $l, $m)) }
|        if ([string]$r.Status -eq 'ok' -and [int]$r.Collections -eq 0) { return }
|        Step '9i. KEY FIGURES'
|        foreach ($x in $lines) { $lv, $m = $x -split '\|', 2; if ($lv -eq 'WARN') { Warn $m } else { Info $m } }
|        $global:SI_UpdateKeyFigures = $r
|    } catch { Warn ("key figures: they were not worked out again ({0}) -- the update goes on; the next data sync works them out." -f $_.Exception.Message) }
|}
|
|# the update's parameterised statements on the Pro database, signed in with its own token (a new connection per call) --
|# ONE definition for the steps that hand a -Sql seam on (9k, 9m, 9n, 9o); $proSrv / $proDb are the calling step's (dynamic scope)
|$script:SIUpdateProSql = {
|    param([string]$Query, $Params, [string]$Mode)
|    $tok = ([string](Get-SIAzureToken -Resource 'https://database.windows.net/')).Trim()
|    if (-not $tok) { throw 'no access token for the database' }
|    $cn = New-Object System.Data.SqlClient.SqlConnection
|    $cn.ConnectionString = "Server=tcp:$proSrv,1433;Database=$proDb;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
|    $cn.AccessToken = $tok
|    try {
|        $cn.Open(); $cmd = $cn.CreateCommand(); $cmd.CommandText = $Query; $cmd.CommandTimeout = 0
|        if ($Params) { foreach ($k in @($Params.Keys)) { $pv = $Params[$k]; $null = $cmd.Parameters.AddWithValue('@' + $k, $(if ($null -eq $pv) { [DBNull]::Value } else { $pv })) } }
|        if ($Mode -eq 'nonquery') { return $cmd.ExecuteNonQuery() }
|        $rd = $cmd.ExecuteReader()
|        try { while ($rd.Read()) { $o = [ordered]@{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $o[$rd.GetName($i)] = $(if ($rd.IsDBNull($i)) { $null } else { $rd.GetValue($i) }) }; [pscustomobject]$o } } finally { $rd.Dispose() }
|    } finally { $cn.Dispose() }
|}
|
|# #865 SI'S OWN SQL CLOSE-LOOP TARGET ALWAYS ON (setup/_shared/SI-OwnSqlConnector.ps1; owner 2026-10-21: "for the sql it should
|# be on always"): the connector of kind sql + direction vulnerability (`vulnerability-sql`, SecurityInsight's own record of every
|# vulnerability's lifecycle -- Changes & trends) that is in test mode or cannot create / close is set to apply, create and
|# close, with its cfg.ChangeLog row, read back. ServiceNow / REST connectors and the SQL CMDB hand-off are never touched.
|# Pro only (the Pro database). On every update (nothing to do: nothing said). Never fails the update. -DetectOnly: the plan.
|function Invoke-SIUpdateOwnSqlConnector {
|    if (-not (Get-Command -Name Invoke-SIOwnSqlConnectorOn -ErrorAction SilentlyContinue)) { return }
|    try {
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|        $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|        if (-not $proSrv -or -not $proDb) { return }
|        if ($proSrv -notmatch '\.') { $proSrv = $proSrv + '.database.windows.net' }
|        # parameterised statements on the Pro database, signed in with this update's own token (a new connection per call)
|        $sql = $script:SIUpdateProSql   # dynamic scope: $proSrv, $proDb come from this function
|        $r = Invoke-SIOwnSqlConnectorOn -Sql $sql -WhatIf:(-not $Apply -or $DetectOnly)
|        if (@($r.Lines).Count) { Step '9k. OWN SQL TARGET' }
|        foreach ($l in @($r.Lines)) { if ($r.Action -eq 'failed') { Warn $l } else { Info $l } }
|        $global:SI_UpdateOwnSqlConnector = $r
|    } catch { Warn ("connectors: SecurityInsight's own SQL vulnerability target was not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|
|# #1021 THE SUPPORT GRANT (setup/_shared/SI-SupportGrantUpdate.ps1; rule: existing installs reach the new-install state): the
|# queue si-support-requests the Invardia Support session puts its request on (made, read back), and ONCE a DERIVED consent
|# from the Support app's Key Vault role (owner 2026-11-01) into an empty cfg.SupportConsent. The job itself comes from the
|# missing-jobs step; #1154: the job started by its queue (read back), then the Support app's rights on the jobs removed (read
|# back). Signing the procedures, the Support app's read-only user and its queue role need rights the updater does not have --
|# the one Support-session step per install (setup\Install-SISupportGrantProcedure.ps1). Pro only. Silent when there is
|# nothing to do. Never fails the update. -DetectOnly: the plan.
|function Invoke-SIUpdateSupportGrant {
|    $lib = Join-Path $PSScriptRoot '_shared/SI-SupportGrantUpdate.ps1'
|    if (-not (Test-Path -LiteralPath $lib) -or -not $rest) { return }
|    try {
|        . $lib
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|        $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|        if (-not $proSrv -or -not $proDb) { return }
|        if ($proSrv -notmatch '\.') { $proSrv = $proSrv + '.database.windows.net' }
|        $wi = (-not $Apply -or $DetectOnly)
|        $lines = New-Object System.Collections.Generic.List[object]
|        $q = Invoke-SISupportGrantQueueEnsure -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Account (& $gv 'SI_StorageAccount') -WhatIf:$wi
|        if ($q.Line) { $lines.Add(@($q.Action, $q.Line)) }
|        $sql = $script:SIUpdateProSql   # dynamic scope: $proSrv, $proDb come from this function
|        $dc = Invoke-SISupportGrantDerivedConsent -Rest $rest -Sql $sql -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -VaultName (& $gv 'SI_KeyVaultName') -WhatIf:$wi
|        if ($dc.Line) { $lines.Add(@($dc.Action, $dc.Line)) }
|        # #1154 (framework §5.5): the support grant job started by its queue (read back), THEN the Support app's rights on the
|        # jobs removed (read back) -- the same step the updater runs on every run
|        if (Get-Command -Name Invoke-SISupportGrantQueueTrigger -ErrorAction SilentlyContinue) {
|            $sgArm = { param([string]$Method, [string]$Path, $Body)
|                $b = if ($null -ne $Body -and -not ($Body -is [string])) { ConvertTo-Json -InputObject $Body -Depth 30 -Compress } else { $Body }
|                Invoke-SIRestJson -Rest $rest -Method $Method -Uri ('https://management.azure.com' + $Path) -Body $b -Headers @{ 'Content-Type' = 'application/json' } -AllowNotFound:($Method -eq 'GET') }
|            $sgSp = Resolve-SISupportGrantPrincipal -Rest $rest -AppId (Get-SISupportGrantRecordedApp -Sql $sql)
|            $tr = Invoke-SISupportGrantQueueTrigger -Arm $sgArm -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -StorageAccount (& $gv 'SI_StorageAccount') -SupportPrincipalId $sgSp -WhatIf:$wi
|            foreach ($l in @($tr.Lines)) { $lines.Add(@($(if ($l.Level -eq 'warn') { 'failed' } else { 'done' }), $l.Text)) }
|        }
|        if ($lines.Count) { Step '9p. SUPPORT ACCESS (just in time)' }
|        foreach ($l in $lines) { if ($l[0] -eq 'failed') { Warn $l[1] } else { Info $l[1] } }
|    } catch { Warn ("support access: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|
|# #903 ONE SERVICENOW CONNECTOR FEEDS BOTH DATA-OUT OUTPUTS (setup/_shared/SI-SnowDataOutConnector.ps1; owner 2026-10-26: "if
|# active they should be part of the data out for both cmdb and vulnerability"): the connector the ServiceNow data out used
|# before becomes the data-out connector (or one is made from the secret names in use) -- keeping exactly what is sent, said,
|# with its cfg.ChangeLog rows, read back. Pro only. Never fails the update. -DetectOnly: the plan.
|function Invoke-SIUpdateSnowDataOut {
|    if (-not (Get-Command -Name Invoke-SISnowDataOutConnectorOn -ErrorAction SilentlyContinue)) { return }
|    try {
|        # the engine's own reading of a connector row (which connector data out used before), when this tree carries it
|        $connLib = Join-Path (Split-Path -Parent $PSScriptRoot) 'engine/asset-cmdb/_shared/SI-Connector.ps1'
|        if (-not (Get-Command -Name ConvertFrom-SIConnectorRow -ErrorAction SilentlyContinue) -and (Test-Path -LiteralPath $connLib)) { try { . $connLib } catch { } }
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|        $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|        if (-not $proSrv -or -not $proDb) { return }
|        if ($proSrv -notmatch '\.') { $proSrv = $proSrv + '.database.windows.net' }
|        $sql = $script:SIUpdateProSql   # dynamic scope: $proSrv, $proDb come from this function
|        $r = Invoke-SISnowDataOutConnectorOn -Sql $sql -WhatIf:(-not $Apply -or $DetectOnly)
|        if (@($r.Lines).Count -or @($r.Warnings).Count) { Step '9m. SERVICENOW DATA OUT' }
|        foreach ($l in @($r.Lines)) { if ($r.Action -eq 'failed') { Warn $l } else { Info $l } }
|        foreach ($w in @($r.Warnings)) { Warn $w }
|        $global:SI_UpdateSnowDataOut = $r
|    } catch { Warn ("connectors: the ServiceNow data-out connector was not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|
|# #912 THE SERVICENOW STAGING STATUS TABLE (setup/_shared/SI-SnowStagingStatus.ps1): an install that already sends to ServiceNow
|# gets SI_DataOut_ServiceNowStagingStatusTable EMPTY, once (its rows go as before, with a warning) -- the table is created in the
|# customer's ServiceNow first. Pro only. Never fails the update. -DetectOnly: the plan.
|function Invoke-SIUpdateSnowStagingStatus {
|    if (-not (Get-Command -Name Invoke-SISnowStagingStatusUpdate -ErrorAction SilentlyContinue)) { return }
|    try {
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|        $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|        if (-not $proSrv -or -not $proDb) { return }
|        if ($proSrv -notmatch '\.') { $proSrv = $proSrv + '.database.windows.net' }
|        $sql = $script:SIUpdateProSql   # dynamic scope: $proSrv, $proDb come from this function
|        $r = Invoke-SISnowStagingStatusUpdate -Sql $sql -WhatIf:(-not $Apply -or $DetectOnly)
|        if (@($r.Lines).Count -or @($r.Warnings).Count) { Step '9n. SERVICENOW STAGING STATUS' }
|        foreach ($l in @($r.Lines)) { if ($r.Action -eq 'failed') { Warn $l } else { Info $l } }
|        foreach ($w in @($r.Warnings)) { Warn $w }
|        $global:SI_UpdateSnowStagingStatus = $r
|    } catch { Warn ("ServiceNow: the staging status setting was not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|
|# #914 ONE ROUTE INTO SERVICENOW (setup/_shared/SI-SnowOneRoute.ps1): the older push's settings are named ONCE in this log and
|# left in place (never deleted). Pro only. Never fails the update. -DetectOnly: the plan.
|function Invoke-SIUpdateSnowOneRoute {
|    if (-not (Get-Command -Name Invoke-SISnowOneRouteUpdate -ErrorAction SilentlyContinue)) { return }
|    try {
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|        $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|        if (-not $proSrv -or -not $proDb) { return }
|        if ($proSrv -notmatch '\.') { $proSrv = $proSrv + '.database.windows.net' }
|        $sql = $script:SIUpdateProSql   # dynamic scope: $proSrv, $proDb come from this function
|        $r = Invoke-SISnowOneRouteUpdate -Sql $sql -WhatIf:(-not $Apply -or $DetectOnly)
|        if (@($r.Lines).Count -or @($r.Warnings).Count) { Step '9o. SERVICENOW ONE ROUTE' }
|        foreach ($l in @($r.Lines)) { Info $l }
|        foreach ($w in @($r.Warnings)) { Warn $w }
|        $global:SI_UpdateSnowOneRoute = $r
|    } catch { Warn ("ServiceNow: the older push's settings were not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|
|# THE PIPELINE A NEW INSTALL GETS (#754, #748; setup/_shared/SI-PipelineLayout.ps1): the stored pipeline (cfg.JobFlow) gets
|# the current layout -- Risk Analysis Summary and Detailed side by side -- where it is still on the default layout of its own
|# level, and the verification service (the daily data health check) where its job is installed and the pipeline lacks it.
|# One parameterised UPDATE only while nobody saved the pipeline meanwhile, read back, idempotent. Pro only (the database).
|# Never fails the update.
|function Invoke-SIUpdatePipelineLayout {
|    $lib = Join-Path $PSScriptRoot '_shared/SI-PipelineLayout.ps1'
|    if (-not (Test-Path -LiteralPath $lib)) { return }
|    try {
|        . $lib
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|        $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|        if (-not $proSrv -or -not $proDb) { return }
|        if ($proSrv -notmatch '\.') { $proSrv = $proSrv + '.database.windows.net' }
|        # the install's jobs (after the missing jobs were made): the required step is added only where its job exists
|        $jobs = @($script:SISqlTierJobs)
|        if ($rest) { try { $v = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName); if ($v.Count) { $jobs = $v } } catch { } }
|        $installed = @($jobs | ForEach-Object { [string]$_.name } | Where-Object { $_ -like 'caj-si-*' })
|        if (-not $installed.Count) { return }
|        # parameterised statements on the Pro database, signed in with this update's own token (a new connection per call)
|        $sql = {
|            param([string]$Query, $Params, [string]$Mode)
|            $tok = ([string](Get-SIAzureToken -Resource 'https://database.windows.net/')).Trim()
|            if (-not $tok) { throw 'no access token for the database' }
|            $cn = New-Object System.Data.SqlClient.SqlConnection
|            $cn.ConnectionString = "Server=tcp:$proSrv,1433;Database=$proDb;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
|            $cn.AccessToken = $tok
|            try {
|                $cn.Open(); $cmd = $cn.CreateCommand(); $cmd.CommandText = $Query; $cmd.CommandTimeout = 0
|                if ($Params) { foreach ($k in @($Params.Keys)) { $pv = $Params[$k]; $null = $cmd.Parameters.AddWithValue('@' + $k, $(if ($null -eq $pv) { [DBNull]::Value } else { $pv })) } }
|                if ($Mode -eq 'nonquery') { return $cmd.ExecuteNonQuery() }
|                $rd = $cmd.ExecuteReader()
|                try { while ($rd.Read()) { $o = [ordered]@{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $o[$rd.GetName($i)] = $rd.GetValue($i) }; [pscustomobject]$o } } finally { $rd.Dispose() }
|            } finally { $cn.Dispose() }
|        }   # dynamic scope: $proSrv, $proDb come from this function
|        $r = Invoke-SIPipelineLayout -Sql $sql -Installed $installed -WhatIf:(-not $Apply -or $DetectOnly)
|        if (@($r.Lines).Count) { Step '9d. PIPELINE LAYOUT' }
|        foreach ($l in @($r.Lines)) { if ($r.Action -eq 'failed') { Warn $l } else { Info $l } }
|        $global:SI_UpdatePipelineLayout = $r
|        # #636: the scheduled management summary reports of the Summary report's data show the Detailed report's once the Summary step is off
|        $m = Invoke-SIMgmtReportsDetailed -Sql $sql -WhatIf:(-not $Apply -or $DetectOnly)
|        if (@($m.Lines).Count -and -not @($r.Lines).Count) { Step '9d. PIPELINE LAYOUT' }
|        foreach ($l in @($m.Lines)) { if ($m.Action -eq 'failed') { Warn $l } else { Info $l } }
|    } catch { Warn ("pipeline layout: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|# THE NAMES PEOPLE READ (setup/_shared/SI-DisplayNames.ps1; framework 12.11c item 5, #655; owner: "if a resource can be renamed,
|# we do that. if not, we keep for now, display names are updated"). An existing install's directory objects get the names a new
|# install gets: the engine's application "SecurityInsight" -> "SecurityInsight Engine", the web app's sign-in application
|# "SecurityInsight Management" -> "SecurityInsight", the SQL admin group "grp-si-sql-admins" shown as "SecurityInsight SQL
|# admins" -- only from SecurityInsight's earlier default, each found by its id, read back, put back on failure, recorded (never
|# twice). Azure resources keep their names. SI_Update_RenameDisplayNames is ON by default (owner 2026-10-18: "everything that we
|# can rename, must follow agreed naming. consistent" -- every existing install reaches the names a new install gets): the Pro
|# database's value (the Settings page) first, then the config, then the job's variable; $false = one line per rename it WOULD
|# make, nothing changed. It renames only where the record of earlier renames can be kept and read (the Pro database): without
|# it, the plan only. Without the rights (the update's identity usually may not change an application or a role-assignable
|# group) it says so in one plain line and names setup\Set-SIDisplayNames.ps1 for an administrator -- no right is ever granted
|# here. Never fails the update.
|function Invoke-SIUpdateDisplayNames {
|    $lib = Join-Path $PSScriptRoot '_shared/SI-DisplayNames.ps1'
|    if (-not (Test-Path -LiteralPath $lib) -or -not $rest) { return }
|    try {
|        . $lib
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        $rg = $target.ResourceGroupName
|        # the web app's sign-in application: the client id its web app signs in with (the install record's name, then today's, then the new)
|        $webAppId = ''
|        $namesLib = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'engine', '_shared', 'SI-InstallNames.ps1')
|        $webNames = if (Test-Path -LiteralPath $namesLib) { . $namesLib; @(Get-SIInstallNameCandidates -Role web) } else { @('ca-si-management') }
|        foreach ($wn in @(@($webNames) + @('ca-si-web') | Select-Object -Unique)) {
|            $app = $null
|            try { $app = Invoke-SIRestJson -Rest $rest -Uri (Get-SIArmUri -Path ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/containerApps/{2}' -f $sub, $rg, $wn) -ApiVersion '2025-07-01') -AllowNotFound -What 'reading the web app' } catch { $app = $null }
|            if (-not $app) { continue }
|            foreach ($c in @($app.properties.template.containers)) { foreach ($e in @($c.env)) { if ($e -and [string]$e.name -eq 'AzureAd__ClientId' -and [string]$e.value -match '^[0-9a-fA-F-]{36}$') { $webAppId = [string]$e.value } } }
|            if ($webAppId) { break }
|        }
|        $engineAppId = & $envOr 'SI_SPN_AppId'; if (-not $engineAppId) { $engineAppId = & $gv 'SI_SPN_AppId' }
|        if ($engineAppId -notmatch '^[0-9a-fA-F-]{36}$') { $engineAppId = '' }
|        # the SQL admin group = the Pro SQL server's Entra admin (its sid)
|        $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|        $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|        $adminSid = ''
|        if ($proSrv) {
|            try {
|                $srv = Invoke-SIRestJson -Rest $rest -Uri (Get-SIArmUri -Path ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Sql/servers/{2}' -f $sub, $rg, $proSrv.Split('.')[0]) -ApiVersion '2021-11-01') -AllowNotFound -What 'reading the database server'
|                if ($srv -and $srv.properties -and $srv.properties.PSObject.Properties['administrators'] -and $srv.properties.administrators) { $adminSid = [string]$srv.properties.administrators.sid }
|            } catch { }
|        }
|        if (-not $webAppId -and -not $engineAppId -and -not $adminSid) { return }
|        $graph = {
|            param([string]$Method, [string]$Uri, $Body)
|            Invoke-SIRestJson -Rest $rest -Method $Method -Uri $Uri -Body $Body -Resource 'https://graph.microsoft.com/' -Headers @{ 'Content-Type' = 'application/json' }
|        }
|        # the record of earlier renames (never twice): cfg.InstallState 'DisplayNames' in the Pro database
|        if ($proSrv -and $proSrv -notmatch '\.') { $proSrv = $proSrv + '.database.windows.net' }
|        $sql = {
|            param([string]$Query, $Params, [string]$Mode)
|            $tok = ([string](Get-SIAzureToken -Resource 'https://database.windows.net/')).Trim()
|            if (-not $tok) { throw 'no access token for the database' }
|            $cn = New-Object System.Data.SqlClient.SqlConnection
|            $cn.ConnectionString = "Server=tcp:$proSrv,1433;Database=$proDb;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
|            $cn.AccessToken = $tok
|            try {
|                $cn.Open(); $cmd = $cn.CreateCommand(); $cmd.CommandText = $Query; $cmd.CommandTimeout = 0
|                if ($Params) { foreach ($k in @($Params.Keys)) { $null = $cmd.Parameters.AddWithValue('@' + $k, [string]$Params[$k]) } }
|                if ($Mode -eq 'nonquery') { return $cmd.ExecuteNonQuery() }
|                $cmd.ExecuteScalar()
|            } finally { $cn.Dispose() }
|        }   # dynamic scope: $proSrv, $proDb come from this function
|        # the switch: the Pro database's value (the web app's Settings page) first, then the config, then the job's variable --
|        # not set anywhere = ON (the default)
|        $switchValues = @{}
|        if ($globals.ContainsKey('SI_Update_RenameDisplayNames')) { $switchValues['SI_Update_RenameDisplayNames'] = $globals['SI_Update_RenameDisplayNames'] }
|        if ($proSrv -and $proDb) { try { $sv = [string](& $sql (Get-SIDisplayNameSettingSql) $null 'scalar'); if ("$sv".Trim()) { $switchValues['SI_Update_RenameDisplayNames'] = $sv } } catch { } }
|        $on = Test-SIDisplayNameRenameOn -Values $switchValues
|        $wi = (-not $Apply -or $DetectOnly -or -not $on)
|        $record = @{}; $recordRead = $false
|        if ($on -and $proSrv -and $proDb) { try { $record = ConvertFrom-SIDisplayNamesRecord -Value ([string](& $sql (Get-SIDisplayNamesRecordSql -Read) $null 'scalar')); $recordRead = $true } catch { $record = @{} } }
|        $plan = @(Get-SIDisplayNamePlan -Graph $graph -WebAppId $webAppId -EngineAppId $engineAppId -SqlAdminSid $adminSid -Done $record)
|        # off: only what it WOULD rename (and what is held); a read this identity may not make is said only when the switch is on
|        $shown = @('rename', 'held'); if ($on) { $shown += 'unchecked' }
|        $todo = @($plan | Where-Object { $shown -contains $_.Action })
|        if (-not $todo.Count) { return }
|        Step '12. DISPLAY NAMES'
|        if (-not $on) { Info 'SI_Update_RenameDisplayNames is off: nothing is renamed; this is what the update would do.' }
|        # an install whose record could not be read is never renamed by the update (the record keeps it from renaming twice)
|        if (-not $wi -and $proSrv -and $proDb -and -not $recordRead) { $wi = $true; Info 'the record of earlier renames could not be read from the Pro database -- nothing is renamed in this run.' }
|        # no Pro database = no record: the update could rename an object twice, so it only says what it would rename
|        if (-not $wi -and -not ($proSrv -and $proDb)) { $wi = $true; Info 'this install has no Pro database to record renames in -- nothing is renamed by the update; an administrator renames with setup\Set-SIDisplayNames.ps1 -Apply.' }
|        $r = Invoke-SIDisplayNameRenames -Graph $graph -Plan $plan -Apply:(-not $wi)
|        foreach ($it in @($r.Items | Where-Object { $_.Action -ne 'rename' -and $shown -contains $_.Action })) { Info $it.Line }
|        # a missing right is the customer's action (one plain line), not a warning of the update
|        foreach ($it in @($r.Items | Where-Object { $_.Action -eq 'rename' })) { if ($it.State -in 'failed', 'put-back-failed') { Warn $it.Line } else { Info $it.Line } }
|        if ($r.Renamed -gt 0 -and $proSrv -and $proDb) {
|            try { $null = & $sql (Get-SIDisplayNamesRecordSql) @{ Value = (Merge-SIDisplayNamesRecord -Current $record -Done $r.Done); By = 'update' } 'nonquery' }
|            catch { Warn ("display names: renamed, but the record could not be written ({0}) -- the next update reads the new names and leaves them." -f $_.Exception.Message) }
|        }
|    } catch { Warn ("display names: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|# #852 THE SIGN-IN FRONT'S STORE (pro-management/deploy/SI-SigninFrontStore.ps1; step 9g in the help above): the key, the
|# identity's right on it, its database user, its schema and CREATE TABLE -- each only when missing, read back; the front's
|# settings handed to this run's front roll only when everything reads back. Never fails the update.
|function Invoke-SIUpdateSigninStore {
|    $global:SI_SigninFrontStoreEnv = $null
|    $planLib = [IO.Path]::Combine($solRoot, 'pro-management', 'deploy', 'SI-SigninFrontPlan.ps1')
|    $storeLib = [IO.Path]::Combine($solRoot, 'pro-management', 'deploy', 'SI-SigninFrontStore.ps1')
|    if (-not $rest -or -not (Test-Path -LiteralPath $planLib) -or -not (Test-Path -LiteralPath $storeLib)) { return $null }
|    try {
|        . $planLib
|        if (-not (Get-Command -Name Invoke-SISigninFrontStore -ErrorAction SilentlyContinue)) { . $storeLib }
|        $envOr = { param($n) $v = [Environment]::GetEnvironmentVariable($n); if ("$v".Trim()) { "$v".Trim() } else { '' } }
|        $gv = { param($n) if ($globals.ContainsKey($n) -and "$($globals[$n])".Trim()) { "$($globals[$n])".Trim() } else { '' } }
|        $proSrv = & $envOr 'SI_UPDATER_PRO_SQL_SERVER'; if (-not $proSrv) { $proSrv = & $gv 'SI_ProSqlServer' }
|        $proDb = & $envOr 'SI_UPDATER_PRO_SQL_DATABASE'; if (-not $proDb) { $proDb = & $gv 'SI_ProSqlDatabase' }
|        if (-not $proSrv -or -not $proDb) { return $null }   # Community / no Pro database: no web app, no front
|        $proSrv = Get-SISigninStoreSqlFqdn -Server $proSrv
|        $kvName = & $envOr 'SI_UPDATER_KEY_VAULT'; if (-not $kvName) { $kvName = & $gv 'SI_KeyVaultName' }
|        $rg = $target.ResourceGroupName
|        # the web app (the install record's name, then today's) and its identity -- the front's identity
|        $namesLib = [IO.Path]::Combine($solRoot, 'engine', '_shared', 'SI-InstallNames.ps1')
|        $webNames = if (Test-Path -LiteralPath $namesLib) { . $namesLib; @(Get-SIInstallNameCandidates -Role web) } else { @('ca-si-management') }
|        $app = $null; $webName = ''
|        foreach ($wn in @(@($webNames) + @('ca-si-management') | Where-Object { $_ } | Select-Object -Unique)) {
|            try { $app = Invoke-SIRestJson -Rest $rest -Uri (Get-SIArmUri -Path ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/containerApps/{2}' -f $sub, $rg, $wn) -ApiVersion '2025-07-01') -AllowNotFound -What 'reading the web app' } catch { $app = $null }
|            if ($app) { $webName = $wn; break }
|        }
|        if (-not $app) { return $null }
|        if ((Get-SISigninFrontChoice -App $app) -eq 'own') { return $null }   # its own sign-in, chosen: no front to prepare for
|        Step '9g. SIGN-IN FRONT STORE'
|        if (-not $kvName) { Warn ('sign-in front store: the install''s Key Vault is not known here (SI_UPDATER_KEY_VAULT / SI_KeyVaultName) -- not checked; the front keeps what it runs.'); return $null }
|        $id = Get-SISigninFrontWebIdentity -App $app
|        if (-not $id) { Warn ('sign-in front store: {0} has no single user-assigned managed identity to give the store to -- not checked.' -f $webName); return $null }
|        $arm = {
|            param([string]$Method, [string]$Path, $Body)
|            $u = if ($Path -match '^https://') { $Path } else { 'https://management.azure.com' + $Path }
|            Invoke-SIRestJson -Rest $rest -Method $Method -Uri $u -Body $Body -AllowNotFound -What ('{0} {1}' -f $Method, ($Path -replace '\?.*$', ''))
|        }
|        # parameterised statements on the Pro database, signed in with this update's own token (a new connection per call)
|        $sql = {
|            param([string]$Query, $Params, [string]$Mode)
|            $tok = ([string](Get-SIAzureToken -Resource 'https://database.windows.net/')).Trim()
|            if (-not $tok) { throw 'no access token for the database' }
|            $cn = New-Object System.Data.SqlClient.SqlConnection
|            $cn.ConnectionString = "Server=tcp:$proSrv,1433;Database=$proDb;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
|            $cn.AccessToken = $tok
|            try {
|                $cn.Open(); $cmd = $cn.CreateCommand(); $cmd.CommandText = $Query; $cmd.CommandTimeout = 0
|                if ($Params) { foreach ($k in @($Params.Keys)) { $pv = $Params[$k]; $null = $cmd.Parameters.AddWithValue('@' + $k, $(if ($null -eq $pv) { [DBNull]::Value } else { [string]$pv })) } }
|                if ($Mode -eq 'nonquery') { return $cmd.ExecuteNonQuery() }
|                $rd = $cmd.ExecuteReader()
|                try { while ($rd.Read()) { $o = [ordered]@{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $o[$rd.GetName($i)] = $rd.GetValue($i) }; [pscustomobject]$o } } finally { $rd.Dispose() }
|            } finally { $cn.Dispose() }
|        }   # dynamic scope: $proSrv, $proDb come from this function
|        $wi = (-not $Apply -or $DetectOnly)
|        $r = Invoke-SISigninFrontStore -Arm $arm -Sql $sql -SubscriptionId $sub -ResourceGroup $rg -VaultName $kvName -SqlServer $proSrv -SqlDatabase $proDb `
|                 -Identity $id -Apply:(-not $wi) -Log { param($m) Info $m }
|        $global:SI_UpdateSigninStore = $r
|        # the marker (cfg.InstallState 'SigninFrontStore'): when it was checked, ready or not, what was made -- read by
|        # people and support; the step itself always decides from what it reads (idempotent), never from this record
|        if (-not $wi) {
|            try {
|                $v = ConvertTo-Json -Compress -InputObject ([ordered]@{ at = [datetime]::UtcNow.ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture)
|                        ready = [bool]$r.Ok; made = @($r.Actions); failed = [string]$r.Failed; key = 'signin-front-dp' })
|                $null = & $sql (Get-SISigninStoreRecordSql) ([ordered]@{ Value = $v; By = 'update' }) 'nonquery'
|            } catch { Info ('sign-in front store: the record could not be written ({0}) -- the next update writes it' -f $_.Exception.Message) }
|        }
|        if ($r.Ok) {
|            $storeEnv = @($r.Env)
|            # 9h (#852, front 1.4.0 on): the web app's own API -- api://<client id>, the scope user_impersonation and the app's
|            # organisation-wide consent to it (SI-SigninFrontApi.ps1), read back; ONLY then SIGNIN_UPSTREAM_SCOPE (an access
|            # token for the app's own API). #905: three outcomes kept apart (Get-SISigninFrontApiUpdateOutcome) -- the update
|            # could not READ them (its identity has no directory read): an Info line only, the front stays on the ID token;
|            # read and in place (or added): the scope handed out here; read, missing, and the WRITE refused: the ONE customer
|            # action, naming setup\Set-SISigninFront.ps1 and what else it does.
|            $pinNow = $null; try { $pinNow = Get-SISigninFrontPin -SIRoot $solRoot } catch { $pinNow = $null }
|            if ($pinNow -and (Get-Command -Name Test-SISigninFrontWantsScope -ErrorAction SilentlyContinue) -and (Test-SISigninFrontWantsScope -Pin $pinNow) -and (Get-Command -Name Get-SISigninFrontApiUpdateOutcome -ErrorAction SilentlyContinue)) {
|                Step '9h. SIGN-IN FRONT API SCOPE'
|                $clientId = (Get-SISigninFrontWebSetting -App $app -Name 'AzureAd__ClientId').Trim()
|                $graph = { param([string]$Method, [string]$Uri, $Body) Invoke-SIRestJson -Rest $rest -Method $Method -Uri $Uri -Body $Body -Resource 'https://graph.microsoft.com/' -Headers @{ 'Content-Type' = 'application/json' } }
|                $fa = Invoke-SISigninFrontApi -Graph $graph -ClientId $clientId -Apply:(-not $wi)
|                $global:SI_UpdateSigninApi = $fa
|                $fo = Get-SISigninFrontApiUpdateOutcome -Result $fa -WebApp $webName -WhatIf:$wi
|                foreach ($l in @($fo.Info)) { Info $l }
|                foreach ($l in @($fo.Warn)) { Warn $l }
|                if ($fa.Ok) { $storeEnv += ('SIGNIN_UPSTREAM_SCOPE={0}' -f $fa.Scope) }
|                if ($fo.Action -and (Get-Command -Name Add-SIUpdaterCustomerAction -ErrorAction SilentlyContinue)) { Add-SIUpdaterCustomerAction -Step 'post-roll' -Text $fo.Action -Class 'config-missing' }
|            }
|            $global:SI_SigninFrontStoreEnv = @($storeEnv)
|            Info ('sign-in front store: the front gets {0} with its other settings kept' -f ((@($storeEnv) | ForEach-Object { ($_ -split '=', 2)[0] }) -join ', '))
|            return $r
|        }
|        if ($wi) { return $r }
|        $t = ('{0}: the shared sign-in front''s store is not ready ({1}). Run setup\Set-SISigninFront.ps1 -Apply through the Support app (as an administrator): it makes the key, the identity''s right on it and its database user, schema and grant, and reads them back. Until then a sign-in front that needs the store (1.3.0 on) is not rolled in -- the front keeps the version it runs.' -f $webName, $r.Why)
|        Warn $t
|        if (Get-Command -Name Add-SIUpdaterCustomerAction -ErrorAction SilentlyContinue) { Add-SIUpdaterCustomerAction -Step 'post-roll' -Text $t -Class 'config-missing' }
|        $r
|    } catch { Warn ("sign-in front store: not checked ({0}) -- the update goes on; the front keeps what it runs; the next update tries again." -f $_.Exception.Message); $null }
|}
|function Complete-SIUpdate { $null = Invoke-SIUpdateSqlTier; $null = Invoke-SIUpdateJobFloor; $null = Invoke-SIUpdateJobSizing; $null = Invoke-SIUpdateUpdaterSize; $null = Invoke-SIUpdateKedaConvert; $null = Invoke-SIUpdateRaWorkers; $null = Invoke-SIUpdateEngineRetryLimit; $null = Invoke-SIUpdateRaGcSetting; $null = Invoke-SIUpdateMissingJobs; $null = Invoke-SIUpdateNightlySchedule; $null = Invoke-SIUpdateReportCopy; $null = Invoke-SIUpdateOrchestration; $null = Invoke-SIUpdatePipelineLayout; $null = Invoke-SIUpdateSummaryRebuild; $null = Invoke-SIUpdatePublishedCopy; $null = Invoke-SIUpdateKeyFigures; $null = Invoke-SIUpdateOwnSqlConnector; $null = Invoke-SIUpdateSnowDataOut; $null = Invoke-SIUpdateSnowStagingStatus; $null = Invoke-SIUpdateSnowOneRoute; $null = Invoke-SIUpdateSupportGrant; $null = Invoke-SIUpdateWebAppSize; $null = Invoke-SIUpdateSigninStore; $null = Invoke-SIUpdatePermissionNote; $null = Invoke-SIUpdateDisplayNames; Install-SIUpdateDefaultTemplates }
|$script:SISqlTierJobs = @()
|
|# #756 THE CODE IS CURRENT, THE SIZES STILL FOLLOW THE SETTINGS (live 2026-10-19: SI_Bootstrap_SqlServiceObjective = S2 set,
|# the updater found its release applied already and the database stayed S3). -SizingOnly runs only the size steps that read
|# the customer's settings -- the SQL database (7), the jobs (8) and the web app (8d) -- each idempotent and never fatal. The
|# registry is not read, no image is built, no job is rolled: the one job list is the tenant-size fallback and the jobs sized.
|if ($SizingOnly) {
|    if (-not $rest) { Warn ("sizes: not checked -- no Azure sign-in ({0}); the next update tries again." -f $signInError); exit 0 }
|    try { $script:SISqlTierJobs = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName) }
|    catch { Info ("sizes: the jobs could not be listed ({0}) -- the job size is not checked this run" -f $_.Exception.Message) }
|    $null = Invoke-SIUpdateSqlTier; $null = Invoke-SIUpdateJobSizing; $null = Invoke-SIUpdateWebAppSize
|    Info 'sizes: the code is current -- the SQL database, job and web app sizes were checked against the settings; no image was built or rolled.'
|    exit 0
|}
|
|$managedBy = Get-SIUpdaterManagedJob -Globals $globals
|if ($managedBy -and -not $Force) {
|    Info ("These containers are updated by the updater job '{0}' (SecurityInsight Pro), to the version your update ring approves -- nothing to do here." -f $managedBy)
|    Info 'To roll this folder''s code by hand anyway, re-run with -Force; the job moves them back to the approved version on its next run.'
|    exit 0
|}
|
|# #178 / #521: this needs a sign-in with rights on the registry and the jobs. When the sync runs this hook on a VM that
|# manages container hosting and nothing here can sign in, say the cause, once, and how to fix it -- not a message about
|# the registry.
|$acr = $null
|if ($rest) { try { $acr = Get-SIAcrRegistry -Rest $rest -SubscriptionId $sub -AcrName $target.AcrName -ResourceGroup $target.ResourceGroupName } catch { $signInError = $_.Exception.Message } }
|if (-not $acr) {
|    Warn ("Container hosting is configured ({0} / {1}) but this machine cannot reach Azure with access to subscription {2}: {3}" -f $target.ResourceGroupName, $target.AcrName, $sub, $signInError)
|    Warn 'Give the identity that runs this sync a sign-in SecurityInsight can use (SI_SPN_AppId + SI_SPN_TenantId + SI_SPN_CertThumbprint in the config, or a managed identity), or -- if the containers'
|    Warn 'are updated by their own updater job -- remove SI_Bootstrap_ResourceGroupName / SI_Bootstrap_AcrName from this machine''s config.'
|    exit 1
|}
|
|# ---- 1b. PRIVATE REGISTRY (framework installer rule 11 / 11b) ---------------------------------------------------------
|# Rule 11 (general since 2026-11-04): made, recovered OR FOUND, every resource of a PRIVATE install ends private, read
|# back; rule 11b: its registry is Premium, behind its private endpoint, admin user off, images built inside the network.
|# The owner the same day: "if we have leftovers that are wrong, then we must handle that" -- existing installs reach the
|# new-install state through the updater, not by a person's hand. A private install's registry made by an earlier release
|# (Basic, public, admin user on) is converged HERE, before the build, so the build already runs on the agent pool in the
|# network. Public installs: nothing (read only). Never fails the update: what cannot be done yet is said, and kept open.
|$pnLib = Join-Path $PSScriptRoot '_shared/SI-PrivateNetwork.ps1'
|if ($Apply -and -not $DetectOnly -and (Test-Path -LiteralPath $pnLib)) {
|    try {
|        if (-not (Get-Command -Name Invoke-SIUpdatePrivateRegistry -ErrorAction SilentlyContinue)) { . $pnLib }
|        $pnArm = {
|            param([string]$Method, [string]$Path, $Body)
|            $u = if ($Path -match '^https://') { $Path } else { 'https://management.azure.com' + $Path }
|            Invoke-SIRestJson -Rest $rest -Method $Method -Uri $u -Body $Body -AllowNotFound -What ('{0} {1}' -f $Method, ($Path -replace '\?.*$', ''))
|        }
|        $pr = Invoke-SIUpdatePrivateRegistry -Arm $pnArm -ResourceGroupId ('/subscriptions/{0}/resourceGroups/{1}' -f $sub, $acr.ResourceGroup) -RegistryId ([string]$acr.Id)
|        if ($pr.Private) {
|            Step '1b. PRIVATE REGISTRY'
|            foreach ($l in @($pr.Lines)) { if ($pr.Ok) { Info $l } else { Warn $l } }
|            if (@($pr.Changed).Count) {
|                # the registry read at the start is stale now (its public access): read again, so the build picks the agent pool
|                $script:SIAcrRegistryCache = @{}
|                $acr = Get-SIAcrRegistry -Rest $rest -SubscriptionId $sub -AcrName $target.AcrName -ResourceGroup $target.ResourceGroupName
|            }
|            # framework rule 11g: the build pool at tier S2 with 0 agents between builds -- an older pool is made again at S2
|            # ONLY while no build runs (same subnet, read back); anything uncertain leaves it as it is (said). An updater image
|            # from before rule 11g builds without scaling the pool: its pool is left as it is until the updater's next image.
|            if (Get-Command -Name Invoke-SIBuildPoolConverge -ErrorAction SilentlyContinue) {
|                if (-not (Test-SIBuildPoolOldUpdater)) {
|                    $bc = Invoke-SIBuildPoolConverge -Arm $pnArm -RegistryId ([string]$acr.Id) -Pool (Get-SIPrivateNetworkNames).AgentPool
|                    if ($bc.Line) { if ($bc.Ok) { Info $bc.Line } else { Warn $bc.Line } }
|                    if ($bc.Failure) { Add-SIUpdateBuildPoolFailure $bc.Line }
|                } else { Info 'the build pool is left as it is in this update: this updater image builds without scaling the pool; its next image (this update''s last step) scales it from the next update on' }
|            }
|        }
|    } catch { Warn ("private registry: not checked ({0}) -- the update goes on; the next update tries again." -f $_.Exception.Message) }
|}
|
|# ---- 1c. RETURN ROUTE (#1095) -- REPORT ONLY ------------------------------------------------------------------------------
|# A private install whose apps subnet has no route table (or one with neither a 0.0.0.0/0 nor a VirtualAppliance route): behind
|# a firewall in a hub, replies to the customer's people time out. The updater only SAYS it (a warning in its log) -- it never
|# makes a route: the next hop is the customer's firewall IP, a value it cannot know. Never fails the update.
|if (Test-Path -LiteralPath $pnLib) {
|    try {
|        if (-not (Get-Command -Name Get-SIUpdateReturnRouteReport -ErrorAction SilentlyContinue)) { . $pnLib }
|        $rrArm = {
|            param([string]$Method, [string]$Path, $Body)
|            if ($Method -ne 'GET') { throw 'the return-route report only reads' }
|            $u = if ($Path -match '^https://') { $Path } else { 'https://management.azure.com' + $Path }
|            Invoke-SIRestJson -Rest $rest -Method $Method -Uri $u -Body $Body -AllowNotFound -What ('{0} {1}' -f $Method, ($Path -replace '\?.*$', ''))
|        }
|        $rrRep = Get-SIUpdateReturnRouteReport -Arm $rrArm -ResourceGroupId ('/subscriptions/{0}/resourceGroups/{1}' -f $sub, $acr.ResourceGroup)
|        if ($rrRep.Private -and $rrRep.Line) { Step '1c. RETURN ROUTE'; if ($rrRep.Warn) { Warn $rrRep.Line } else { Info $rrRep.Line } }
|    } catch { Warn ("return route: not checked ({0}) -- the update goes on." -f $_.Exception.Message) }
|}
|
|$version = (Get-Content -LiteralPath (Join-Path $solRoot 'VERSION') -Raw).Trim()
|$tag     = Get-SIContainerImageTag -Version $version -ContentHash (Get-SIContainerContentHash -SolutionRoot $solRoot)
|$newImage = ('{0}/si-orchestrator:{1}' -f $acr.LoginServer, $tag)
|Info "image for this tree: $newImage"
|
|$jobsRaw = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName)
|$script:SISqlTierJobs = @($jobsRaw)   # #507: the tenant-size fallback (the collection jobs setup sized for the tenant)
|$jobs = foreach ($j in $jobsRaw) {
|    $img = $null
|    try { $img = [string]$j.properties.template.containers[0].image } catch { }
|    [pscustomobject]@{ Name = [string]$j.name; Image = $img }
|}
|$plan = @(Get-SIContainerUpdatePlan -Jobs @($jobs) -LoginServer $acr.LoginServer -TargetImage $newImage)
|if ($plan.Count -eq 0) {
|    Warn ("No job in {0} runs {1}/si-orchestrator -- nothing to roll. Run the container setup to create the jobs first." -f $target.ResourceGroupName, $acr.LoginServer)
|    exit 0
|}
|$toUpdate = @($plan | Where-Object { $_.Action -eq 'update' })
|foreach ($p in $plan) { Info ("{0,-40} {1}  ({2})" -f $p.Name, $p.Action, $p.PreviousImage) }
|if ($toUpdate.Count -eq 0) { Info 'Every job already runs this tree -- nothing to roll.'; exit (Complete-SIUpdate) }
|if (-not $Apply -or $DetectOnly) { Info ("{0} job(s) would move to the new image. Re-run with -Apply to update." -f $toUpdate.Count); exit (Complete-SIUpdate) }
|
|# ---- 2. BUILD ---------------------------------------------------------------------------------
|# #416 (the fast roll, setup/_shared/SI-FastRoll.ps1): a Dockerfile with expensive lines before its first COPY is built in
|# two layers -- the cached base (built only when its hash is missing) and the thin code layer per release.
|# #521: the registry builds it over ARM (setup/_shared/SI-AcrBuild.ps1): packed here, uploaded, scheduled, followed; a
|# failed build prints the end of its log.
|Step '2. BUILD'
|$bArgs = @{ Rest = $rest; AcrName = $target.AcrName; SubscriptionId = $sub; ResourceGroup = $acr.ResourceGroup }
|# framework rule 11g: a private install's build pool is scaled up before the first build (read back) and back to 0 agents in
|# the FINALLY below -- after a success, a failed or a timed-out build (read back). Inside the updater, its run holds the pool
|# (one session for every image of the update) and the close here only leaves it.
|$poolSession = [bool](Get-Command -Name Open-SIBuildPoolSession -ErrorAction SilentlyContinue)
|$poolKeepUp = $false
|if ($poolSession) { $poolKeepUp = Test-SIBuildPoolOldUpdater; $null = Open-SIBuildPoolSession }
|try {
|if (Test-SIAcrTag @bArgs -Repo 'si-orchestrator' -Tag $tag -LoginServer $acr.LoginServer) {
|    Info "tag $tag is already in the registry -- not rebuilding."
|} else {
|    if ($poolSession) {
|        $poolName = Resolve-SIAcrAgentPool -Rest $rest -Registry $acr
|        if ($poolName) {
|            $poolUp = Request-SIBuildPoolUp -Rest $rest -RegistryId ([string]$acr.Id) -Pool $poolName
|            if ($poolUp.Line) { if ($poolUp.Ok) { Info $poolUp.Line } else { Warn $poolUp.Line } }
|            if (-not $poolUp.Ok) { throw ("{0}. No job was changed." -f $poolUp.Line) }
|        }
|    }
|    $layer = Get-SIImageLayerPlan -DockerfilePath (Join-Path $solRoot 'container/Dockerfile') -BaseRepo 'si-base' -LoginServer $acr.LoginServer
|    $work = Join-Path ([IO.Path]::GetTempPath()) ('si-build-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
|    New-Item -ItemType Directory -Force -Path $work | Out-Null
|    try {
|        $file = 'container/Dockerfile'
|        if ($layer.HasBase) {
|            Info $layer.Reason
|            $file = Join-Path $work 'Dockerfile.app'
|            [IO.File]::WriteAllText($file, $layer.AppDockerfile)
|            if (Test-SIAcrTag @bArgs -Repo $layer.BaseRepo -Tag $layer.BaseTag -LoginServer $acr.LoginServer) { Info ("base {0} is in the registry -- reused" -f $layer.BaseImage) }
|            else {
|                $baseCtx = Join-Path $work 'base-ctx'; New-Item -ItemType Directory -Force -Path $baseCtx | Out-Null
|                $baseFile = Join-Path $work 'Dockerfile.base'; [IO.File]::WriteAllText($baseFile, $layer.BaseDockerfile)
|                Push-Location -LiteralPath $baseCtx
|                try { $b = Start-SIAcrBuild @bArgs -Image $layer.BaseImage -File $baseFile } finally { Pop-Location }
|                $b = @(Wait-SIAcrBuilds @bArgs -Builds @($b) -TimeoutMinutes $BuildTimeoutMinutes -Log { param($m) Info $m })[0]
|                if ($b.Status -ne 'Succeeded') { throw "The base image build did not succeed ($($b.Status)). No job was changed." }
|            }
|        } else { Info $layer.Reason }
|        # queued, then followed: one build run, polled until it ends
|        $script:EngineBuild = $null
|        Invoke-SIInBuildContext -Path $solRoot -Log { param($m) Info $m } -Action {
|            $script:EngineBuild = Start-SIAcrBuild @bArgs -Image "si-orchestrator:$tag" -File $file
|        }
|        $eb = @(Wait-SIAcrBuilds @bArgs -Builds @($script:EngineBuild) -TimeoutMinutes $BuildTimeoutMinutes -Log { param($m) Info $m })[0]
|        if ($eb.Status -ne 'Succeeded') { throw "The image build did not succeed ($($eb.Status)). No job was changed." }
|    } finally { Remove-Item -LiteralPath $work -Recurse -Force -ErrorAction SilentlyContinue }
|}
|} finally {
|    if ($poolSession) {
|        # -KeepUp only while an updater image from before rule 11g builds the rest of this update without scaling the pool
|        $pc = Close-SIBuildPoolSession -KeepUp:$poolKeepUp
|        if ($pc.Line) { if ($pc.Ok) { Info $pc.Line } else { Warn $pc.Line } }
|        if ($pc.Closed -and $pc.Touched -and -not $pc.Ok) { Add-SIUpdateBuildPoolFailure $pc.Line }
|    }
|}
|
|# ---- 3. ROLL / 4. VERIFY / 5. ROLLBACK ---------------------------------------------------------
|# #416: every job by ONE ARM PATCH of its template (never a PUT -- secrets; never one job update after another -- 16 jobs
|# took ~11 min), all sent at once, then every job read back: its image, and nothing else changed.
|Step '3. ROLL (all jobs at once)'
|$repoPrefix = ('{0}/si-orchestrator' -f $acr.LoginServer)
|$rollLog = { param($m) Info $m }
|$targets = @($toUpdate | ForEach-Object { [pscustomobject]@{ Name = $_.Name; Image = $newImage } })
|$results = @(Invoke-SIJobImageRoll -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Targets $targets -Jobs $jobsRaw -RepoPrefix $repoPrefix -Log $rollLog)
|Step '4. VERIFY'
|foreach ($r in $results) { if ($r.Ok) { Info ("{0} verified: {1}; nothing else changed" -f $r.Name, $tag) } else { Warn ("{0}: {1}" -f $r.Name, $r.Error) } }
|$failed = @($results | Where-Object { -not $_.Ok })
|$updated = @($toUpdate | Where-Object { $n = $_.Name; @($results | Where-Object { $_.Name -eq $n -and $_.Sent }).Count })
|
|if ($failed.Count) {
|    Warn ("Update failed: {0} of {1} job(s) -- {2}" -f $failed.Count, $toUpdate.Count, (($failed | ForEach-Object { $_.Name }) -join ', '))
|    # SUP-2026-00198: each failure the updater reports is recorded with ITS step and its catalogue code -- the roll's own
|    # failure is 'roll' (si-upd-0803 refused / si-upd-0805 not verified), and only a job that could not be PUT BACK is a
|    # 'restore' failure (si-upd-0804). Until then a clean rollback was reported as "restore failed" with the roll's 400.
|    # (a build-pool failure line recorded before the roll stays on the list -- rule 11g)
|    if ($null -eq $global:SI_UpdateFailures) { $global:SI_UpdateFailures = New-Object System.Collections.Generic.List[object] }
|    foreach ($grp in @($failed | Group-Object -Property { Get-SIRollFailureCode -Result $_ })) {
|        $first = $grp.Group[0]
|        $global:SI_UpdateFailures.Add([pscustomobject]@{ Step = 'roll'; Code = $grp.Name
|            Text = ("{0}: {1} of {2} job(s) not rolled to {3} ({4}); first: {5}: {6}" -f $grp.Name, $grp.Count, $toUpdate.Count, $tag, (($grp.Group | ForEach-Object { $_.Name }) -join ', '), $first.Name, $first.Error) })
|    }
|    # #350: restore only what still runs the image THIS update set -- a job someone else moved meanwhile keeps theirs.
|    # The image each job goes back to is the one DETECT read BEFORE the roll (PreviousImage of the plan), never one read now.
|    $nowList = @(); $nowImages = $null
|    try {
|        $nowList = @(Get-SIArmJobList -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName)
|        $nowImages = @{}
|        foreach ($j in $nowList) { if ($j) { try { $nowImages[[string]$j.name] = [string]$j.properties.template.containers[0].image } catch { } } }
|    } catch { Warn ("the jobs could not be read before the rollback ({0}) -- every job this update sent is put back" -f $_.Exception.Message); $nowList = @($jobsRaw) }
|    # a job whose PATCH answer was lost but which DOES run the new image now is put back too
|    if ($nowImages) { $updated = @($toUpdate | Where-Object { $n = $_.Name; @($results | Where-Object { $_.Name -eq $n -and $_.Sent }).Count -or ($nowImages.ContainsKey($n) -and $nowImages[$n] -eq $newImage) }) }
|    if ($updated.Count -eq 0) { Info 'no job runs the new image -- nothing to put back; every job runs the version it ran before' }
|    else { Step '5. ROLLBACK' }
|    $back = New-Object System.Collections.Generic.List[object]
|    foreach ($r in @(Get-SIContainerRollbackPlan -Updated $updated -NewImage $newImage -Current $nowImages)) {
|        if ($r.Action -eq 'skip') { Info ("{0} now runs {1} (changed by someone else since) -- left as it is" -f $r.Name, $r.Now); continue }
|        $back.Add([pscustomobject]@{ Name = $r.Name; Image = $r.Image })
|    }
|    if ($back.Count) {
|        foreach ($r in @(Invoke-SIJobImageRoll -Rest $rest -SubscriptionId $sub -ResourceGroup $target.ResourceGroupName -Targets $back.ToArray() -Jobs $nowList -RepoPrefix $repoPrefix -Log $rollLog)) {
|            $prev = @($back | Where-Object { $_.Name -eq $r.Name })[0].Image
|            if ($r.Ok) { Info ("{0} restored to {1}" -f $r.Name, $prev) }
|            else {
|                $rc = Get-SIRollFailureCode -Result $r -Restore
|                Warn ("{0}: {1} could NOT be restored to {2}: {3} -- restore it by hand." -f $rc, $r.Name, $prev, $r.Error)
|                $global:SI_UpdateFailures.Add([pscustomobject]@{ Step = 'restore'; Code = $rc; Text = ("{0}: {1} could not be put back on {2}: {3}" -f $rc, $r.Name, $prev, $r.Error) })
|            }
|        }
|    }
|    exit 1
|}
|Info ("{0} job(s) now run {1}." -f $toUpdate.Count, $tag)
|# The update NEVER stops a running pipeline (owner 2026-10-16, reversing 2026-10-15: "i dont want it to stop it ... otherwise it
|# will newer complete on large env where it takes more than 24 hr to complete"). A run in progress finishes: a job already
|# running ends on the version it started with, every job started after the roll runs the new version.
|exit (Complete-SIUpdate)
|} finally {
|    if ($script:SIUpdateWatchOwn -and (Get-Command -Name Stop-SIUpdateWatch -ErrorAction SilentlyContinue)) { Stop-SIUpdateWatch }
|    Stop-SIScriptRun -Run $siRun
|}
'@ }
$__siSupportFiles['setup/_shared/SI-BuildStage.ps1'] = @{ Sha256 = '407457f620902c0b67665b1ea927e90757ed7409a7336a121f46c57475e9275d'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- the image build context, at a SHORT path when the install's own path is too deep for the build.
|
|    `az acr build <folder>` packs the folder with the Azure CLI's own Python. On Windows that packer cannot open a file whose
|    full path is longer than 260 characters (unless long paths are switched on for the machine), so an install that lives in
|    a deep folder -- a git worktree, a nested sync target -- fails the build on the longest rule files (a relative path in this
|    solution is up to ~150 characters). Found building ring 1 from a deep worktree (#350).
|
|    The fix stays inside the product: when the longest file path would pass the limit, the build context is copied to a short
|    folder under the temp directory first (robocopy: it reads long paths), and the build runs from there. The image is the same:
|    the build context is the same files (the .dockerignore travels with them), and the image tag is computed from the install
|    itself, never from the stage. Linux (the updater container) never stages.
|
|    Used by setup\Invoke-SIContainerUpdate.ps1 (the engine image), setup\Install-SIUpdaterJob.ps1 (the updater image) and the
|    updater's own builds of the web app and of itself (container\updater).
|#>
|
|function Get-SIBuildStageDecision {
|    <#
|      PURE. Whether a build context at -ContextPath must be staged at a short path before `az acr build`.
|      -LongestRelative = the longest file path below the context (characters, relative); -1 = the tree could not be read
|      (on PowerShell 5.1 a path over the limit already fails to enumerate -- that alone means "stage").
|      Returns @{ Stage; Longest; Reason }.
|    #>
|    param([Parameter(Mandatory)][string]$ContextPath, [int]$LongestRelative = 0, [bool]$IsWindowsHost = $true, [int]$Limit = 240)
|    if (-not $IsWindowsHost) { return [pscustomobject]@{ Stage = $false; Longest = 0; Reason = 'not Windows -- the build reads the folder as it is' } }
|    $root = $ContextPath.TrimEnd('\', '/')
|    if ($LongestRelative -lt 0) { return [pscustomobject]@{ Stage = $true; Longest = -1; Reason = ('the folder {0} holds paths too long to read -- the build runs from a short copy' -f $root) } }
|    $longest = $root.Length + 1 + $LongestRelative
|    if ($longest -gt $Limit) { return [pscustomobject]@{ Stage = $true; Longest = $longest; Reason = ('the longest file path is {0} characters (limit {1}) -- the build runs from a short copy' -f $longest, $Limit) } }
|    [pscustomobject]@{ Stage = $false; Longest = $longest; Reason = ('the longest file path is {0} characters -- the build reads the folder as it is' -f $longest) }
|}
|
|function Test-SIBuildHostIsWindows {
|    if ($PSVersionTable.PSVersion.Major -lt 6) { return $true }
|    [bool]$IsWindows
|}
|
|function Get-SIBuildContextLongestPath {
|    <# The longest relative file path below -Path, or -1 when the tree cannot be enumerated (a path too long for this host). #>
|    param([Parameter(Mandatory)][string]$Path)
|    $root = [IO.Path]::GetFullPath($Path).TrimEnd('\', '/')
|    $max = 0
|    try {
|        foreach ($f in [IO.Directory]::EnumerateFiles($root, '*', [IO.SearchOption]::AllDirectories)) {
|            $n = $f.Length - $root.Length - 1
|            if ($n -gt $max) { $max = $n }
|        }
|    } catch { return -1 }
|    $max
|}
|
|function New-SIBuildStageCopy {
|    <#
|      Copies -Source to the short folder -Destination with robocopy (it reads and writes paths longer than 260 characters).
|      Leaves out what a build never needs: .git, bin, obj, node_modules. robocopy exit codes 0-7 are success, 8+ a failure.
|    #>
|    param([Parameter(Mandatory)][string]$Source, [Parameter(Mandatory)][string]$Destination)
|    $out = & robocopy $Source $Destination /E /XD .git bin obj node_modules /R:1 /W:1 /NFL /NDL /NJH /NJS /NP 2>&1
|    $code = $LASTEXITCODE; $global:LASTEXITCODE = 0
|    if ($code -ge 8) { throw ("the build context could not be copied to {0} (robocopy {1}): {2}" -f $Destination, $code, (($out | ForEach-Object { "$_" }) -join ' ').Trim()) }
|}
|
|function Get-SIBuildStageRoot {
|    <# A short, new folder for one stage: <temp>\sib-<8 hex>; a temp path longer than 60 characters uses <system drive>\sib instead. #>
|    $tmp = [IO.Path]::GetTempPath()
|    if ($tmp.Length -gt 60 -and $env:SystemDrive) { $tmp = $env:SystemDrive + '\sib' }
|    Join-Path $tmp ('sib-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
|}
|
|function Invoke-SIInBuildContext {
|    <#
|      Runs -Action with the current directory at the build context of -Path: the folder itself, or -- when its paths are too
|      long for the build on this host -- a short copy of it, removed afterwards. -Action gets the context path as $args[0].
|      -Copy / -IsWindowsHost / -Limit: tests only.
|    #>
|    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][scriptblock]$Action, [scriptblock]$Copy, [object]$IsWindowsHost, [int]$Limit = 240,
|          [scriptblock]$Log)
|    $win = if ($null -ne $IsWindowsHost) { [bool]$IsWindowsHost } else { Test-SIBuildHostIsWindows }
|    $longest = if ($win) { Get-SIBuildContextLongestPath -Path $Path } else { 0 }
|    $d = Get-SIBuildStageDecision -ContextPath ([IO.Path]::GetFullPath($Path)) -LongestRelative $longest -IsWindowsHost $win -Limit $Limit
|    $ctx = $Path; $stage = $null
|    if ($d.Stage) {
|        $stage = Get-SIBuildStageRoot
|        if ($Log) { & $Log ("{0}: {1}" -f $d.Reason, $stage) }
|        if ($Copy) { & $Copy $Path $stage } else { New-SIBuildStageCopy -Source $Path -Destination $stage }
|        $ctx = $stage
|    }
|    Push-Location -LiteralPath $ctx
|    try { & $Action $ctx }
|    finally {
|        Pop-Location
|        if ($stage -and (Test-Path -LiteralPath $stage)) {
|            Remove-Item -LiteralPath $stage -Recurse -Force -ErrorAction SilentlyContinue
|            # a long path the stage itself holds is removed by robocopy mirroring an empty folder over it
|            if (Test-Path -LiteralPath $stage) {
|                $empty = Join-Path ([IO.Path]::GetTempPath()) ('sib-empty-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
|                New-Item -ItemType Directory -Force -Path $empty | Out-Null
|                try { $null = & robocopy $empty $stage /MIR /R:0 /W:0 /NFL /NDL /NJH /NJS /NP 2>&1; $global:LASTEXITCODE = 0 } catch { }
|                Remove-Item -LiteralPath $stage -Recurse -Force -ErrorAction SilentlyContinue
|                Remove-Item -LiteralPath $empty -Recurse -Force -ErrorAction SilentlyContinue
|            }
|        }
|    }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-UpdateRest.ps1'] = @{ Sha256 = '586b9f564e753867b9d673fb6abc7a57342e098480fa34cf5697078ce8a4497d'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE UPDATE TALKS TO AZURE OVER REST ONLY (#521, operator 2026-10-09: "we dont support az modules. pure
|    rest or arm only", "want to not be dependent on it", "modern single connect only"; framework section 12.17: ONE connect
|    path -- the product's own REST token client; no az login, no Connect-AzAccount, not even as a fallback).
|
|    The updater job (container/updater/Start-SIUpdater.ps1) and the update script it runs (setup/Invoke-SIContainerUpdate.ps1)
|    sign in ONCE with SecurityInsight's own token client (engine/_shared/SI-AzRest.ps1 + auth/SI-ManagedIdentity.ps1):
|
|      * SI_UPDATER_AUTH = ManagedIdentity  -> the job's user-assigned identity (SI_UPDATER_CLIENT_ID = its client id);
|      * SI_UPDATER_AUTH = Certificate (the default) -> the SPN SI_UPDATER_CLIENT_ID in SI_UPDATER_TENANT_ID with the PFX in
|        SI_UPDATER_CERT_PFX_B64 (+ SI_UPDATER_CERT_PASSWORD). The PFX goes into the X509 store the token signer reads; the
|        temporary file is removed at once;
|      * none of these set (the VM sync hook): the run's own sign-in -- the config's SI_SPN_* app or managed identity, as the
|        engines sign in (Resolve-SIAzRestAuth).
|
|    EVERY CALL goes through ONE seam with the shape setup/_shared/SI-KedaConvert.ps1 introduced:
|        -Rest { param([string]$Method, [string]$Uri, $Body, [string]$Resource, [hashtable]$Headers) } -> @{ Status; Body; Headers }
|    $Resource is the token audience (https://management.azure.com/, https://storage.azure.com/, https://graph.microsoft.com/,
|    https://vault.azure.net/) -- or '' for a call that must carry NO bearer token (a SAS upload, a SAS log download, the
|    registry's own token exchange). Every 4xx but 401 is an ANSWER for the caller (404 = not there, 409 = busy); 401 refreshes
|    the token once; 429 / 5xx / no answer are retried. The seam never throws: no answer at all is Status 0.
|
|    PowerShell 5.1-compatible (the VM sync hook); the updater container runs pwsh 7.
|#>
|
|$script:SIUpdateRestRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|if (-not (Get-Command -Name Invoke-SIAzRestRequest -ErrorAction SilentlyContinue)) { . ([IO.Path]::Combine($script:SIUpdateRestRoot, 'engine', '_shared', 'SI-AzRest.ps1')) }
|if (-not (Get-Command -Name Get-SIManagedIdentityToken -ErrorAction SilentlyContinue)) {
|    $siUpdMi = [IO.Path]::Combine($script:SIUpdateRestRoot, 'auth', 'SI-ManagedIdentity.ps1')
|    if (Test-Path -LiteralPath $siUpdMi) { . $siUpdMi }
|}
|$script:SIUpdateArmBase = 'https://management.azure.com'
|$script:SIUpdateArmResource = 'https://management.azure.com/'
|
|function Get-SIUpdateRestSignIn {
|    <#
|        PURE. Which identity the update signs in as, from the updater job's settings (-Env first, then the process
|        environment): @{ Mode = ManagedIdentity | Certificate | Config; ClientId; TenantId; PfxB64; PfxPassword; Reason }.
|        Config = no updater identity is configured here: the run's own sign-in (the config's SI_SPN_* app / managed identity).
|        Throws on an SI_UPDATER_AUTH that is neither ManagedIdentity nor Certificate, and on a certificate sign-in without its PFX.
|    #>
|    param([hashtable]$Env = @{})
|    $g = { param($k) $v = if ($Env -and $Env.ContainsKey($k)) { $Env[$k] } else { [Environment]::GetEnvironmentVariable($k) }; "$v".Trim() }
|    $client = & $g 'SI_UPDATER_CLIENT_ID'
|    if (-not $client) { return [pscustomobject]@{ Mode = 'Config'; ClientId = ''; TenantId = ''; PfxB64 = ''; PfxPassword = ''; Reason = 'the run''s own sign-in (the config''s SI_SPN_* app or managed identity)' } }
|    $auth = & $g 'SI_UPDATER_AUTH'
|    if ($auth -ieq 'ManagedIdentity') { return [pscustomobject]@{ Mode = 'ManagedIdentity'; ClientId = $client; TenantId = (& $g 'SI_UPDATER_TENANT_ID'); PfxB64 = ''; PfxPassword = ''; Reason = ('the managed identity {0}' -f $client) } }
|    if ($auth -and $auth -ine 'Certificate') { throw "SI_UPDATER_AUTH must be 'ManagedIdentity' or 'Certificate', not '$auth'." }
|    $pfx = & $g 'SI_UPDATER_CERT_PFX_B64'
|    if (-not $pfx) { throw 'SI_UPDATER_CERT_PFX_B64 is not set on the updater job (the certificate sign-in needs it; or set SI_UPDATER_AUTH = ManagedIdentity).' }
|    [pscustomobject]@{ Mode = 'Certificate'; ClientId = $client; TenantId = (& $g 'SI_UPDATER_TENANT_ID'); PfxB64 = $pfx; PfxPassword = (& $g 'SI_UPDATER_CERT_PASSWORD'); Reason = ('the service principal {0} (certificate)' -f $client) }
|}
|
|function Connect-SIUpdateRest {
|    <#
|        THE ONE SIGN-IN of an update: records the identity in SecurityInsight's REST client (Connect-SIAzAccountRest; tokens
|        are minted per call). A sign-in this process already recorded is kept (the updater signed in before it ran the
|        release's update script). Returns one plain line naming the identity. No az, no PowerShell module.
|    #>
|    param([string]$SubscriptionId, [hashtable]$Env = @{})
|    $st = Get-SIAzRestState
|    if ($st.Connection -is [hashtable]) {
|        if ($SubscriptionId -and -not $st.SubscriptionId) { $st.SubscriptionId = $SubscriptionId }
|        return 'the sign-in this process already has'
|    }
|    $s = Get-SIUpdateRestSignIn -Env $Env
|    switch ($s.Mode) {
|        'ManagedIdentity' {
|            $null = Connect-SIAzAccountRest -Identity -AccountId $s.ClientId -Tenant $s.TenantId -Subscription $SubscriptionId
|        }
|        'Certificate' {
|            $pfxFile = Join-Path ([IO.Path]::GetTempPath()) ('si-upd-' + [guid]::NewGuid().ToString('N').Substring(0, 12) + '.pfx')
|            [IO.File]::WriteAllBytes($pfxFile, [Convert]::FromBase64String($s.PfxB64))
|            try {
|                $c = @{ ServicePrincipal = $true; ApplicationId = $s.ClientId; CertificatePath = $pfxFile; Tenant = $s.TenantId; Subscription = $SubscriptionId }
|                if ($s.PfxPassword) { $c['CertificatePassword'] = (ConvertTo-SecureString -String $s.PfxPassword -AsPlainText -Force) }
|                $null = Connect-SIAzAccountRest @c
|            } finally { [IO.File]::Delete($pfxFile) }
|        }
|        default {
|            if ($SubscriptionId -and -not $st.SubscriptionId) { $st.SubscriptionId = $SubscriptionId }
|        }
|    }
|    $s.Reason
|}
|
|function Get-SIUpdateRestSubscription {
|    <# The subscription of this update: SI_UPDATER_SUBSCRIPTION_ID, else the one the sign-in recorded. '' when neither. #>
|    $v = "$([Environment]::GetEnvironmentVariable('SI_UPDATER_SUBSCRIPTION_ID'))".Trim()
|    if ($v) { return $v }
|    try { $st = Get-SIAzRestState; if ($st.SubscriptionId) { return [string]$st.SubscriptionId } } catch { }
|    ''
|}
|
|function Get-SIUpdateRestAudience {
|    <# PURE. The REST client's audience for a token resource; '' = no bearer token at all (SAS / registry token exchange). #>
|    param([AllowEmptyString()][string]$Resource)
|    $r = "$Resource".Trim().ToLowerInvariant()
|    if (-not $r) { return '' }
|    if ($r -like 'https://management.*') { return 'Arm' }
|    if ($r -like 'https://storage.*') { return 'Storage' }
|    if ($r -like 'https://graph.*') { return 'Graph' }
|    if ($r -like 'https://vault.*') { return 'KeyVault' }
|    if ($r -like 'https://api.loganalytics.*') { return 'LaQuery' }
|    if ($r -like 'https://monitor.*') { return 'Monitor' }
|    throw ("no token audience is known for '{0}'" -f $Resource)
|}
|
|function Invoke-SIUpdateRestCall {
|    <#
|        The real seam behind New-SIUpdateRestSeam. Never throws: @{ Status (0 = no answer); Body (text); Headers }.
|        A Content-Type in -Headers is the request's content type; a body that is not text or bytes is sent as JSON.
|        #911 (c) (live 2026-10-27: an update was silent for an hour after a step): EVERY call with a token (ARM, Graph, Key
|        Vault, Log Analytics) has a timeout (-TimeoutSec, 120 s: a control-plane answer takes seconds) and a bounded retry
|        (4 attempts on 408 / 429 / 5xx / no answer), and when it gives up its answer NAMES the call ("<METHOD> <url> failed
|        after 4 attempts" / "... timed out after 120 s"). A call without a token (a SAS upload or download) keeps its own
|        longer timeout (it carries a build context or a log).
|    #>
|    param([string]$Method = 'GET', [Parameter(Mandatory)][string]$Uri, $Body, [AllowEmptyString()][string]$Resource = '', [hashtable]$Headers, [int]$TimeoutSec = 120)
|    $ct = 'application/json'; $h = @{}
|    if ($Headers) { foreach ($k in @($Headers.Keys)) { if ([string]$k -ieq 'Content-Type') { $ct = [string]$Headers[$k] } else { $h[[string]$k] = $Headers[$k] } } }
|    if ($null -ne $Body -and -not ($Body -is [string]) -and -not ($Body -is [byte[]])) { $Body = ConvertTo-Json -InputObject $Body -Depth 60 -Compress }
|    try { $aud = Get-SIUpdateRestAudience -Resource $Resource } catch { return [pscustomobject]@{ Status = 0; Body = $_.Exception.Message; Headers = @{} } }
|    # #564 (PIM's install at customer I): an ARM POST action with no body (listSecrets, listBuildSourceUploadUrl, listLogSasUrl, a
|    # revision restart) sends '{}' -- an empty body with a JSON content type was refused with HTTP 415
|    if ($aud -eq 'Arm' -and "$Method".ToUpperInvariant() -eq 'POST' -and ($null -eq $Body -or ([string]$Body) -eq '')) { $Body = '{}' }
|    if (-not $aud) {
|        # NO bearer token: the SAS in the URL, or the caller's own Authorization header, is the credential.
|        # Inside an Invardia Support session a URL that carries its own SAS (sig=) goes through the session's recording
|        # command, which adds no token to such a URL -- so an upload to, or a download from, the environment is recorded.
|        $viaSupport = ([string]$Uri -match '[?&]sig=') -and (Test-Path -LiteralPath 'Function:\Test-SISupportRequestRoute') -and (Test-SISupportRequestRoute -Audience Storage)
|        for ($a = 1; $a -le 4; $a++) {
|            if ($viaSupport) { $r = Invoke-SISupportHttp -Method $Method -Uri $Uri -Headers $h -Body $Body -ContentType $ct -Audience Storage }
|            else { $r = Invoke-SIAzRestHttp -Method $Method -Uri $Uri -Headers $h -Body $Body -ContentType $ct }
|            $code = [int]$r.StatusCode
|            if (($code -eq 0 -or $code -eq 408 -or $code -eq 429 -or $code -ge 500) -and $a -lt 4) { Start-Sleep -Seconds ([int][Math]::Min(30, [Math]::Pow(2, $a))); continue }
|            return [pscustomobject]@{ Status = $code; Body = [string]$r.Content; Headers = $r.Headers }
|        }
|    }
|    try {
|        $what = '{0} {1}' -f $Method, ($Uri -replace '\?.*$', '')
|        $r = Invoke-SIAzRestRequest -Method $Method -Uri $Uri -Audience $aud -Body $Body -ContentType $ct -Headers $h -AllowStatus (@(400) + @(402..499)) -MaxAttempts 4 -TimeoutSec $TimeoutSec -What $what
|        [pscustomobject]@{ Status = [int]$r.StatusCode; Body = [string]$r.Content; Headers = $r.Headers }
|    } catch {
|        $st = 0; $resp = $_.Exception.PSObject.Properties['Response']
|        if ($resp -and $resp.Value -and $resp.Value.PSObject.Properties['StatusCode']) { try { $st = [int]$resp.Value.StatusCode } catch { $st = 0 } }
|        # #911 (c): the answer names the call that gave up (and its timeout), never only what the network said
|        $m = [string]$_.Exception.Message
|        $w = '{0} {1}' -f $Method, ($Uri -replace '\?.*$', '')
|        if ($m -notlike "*$w*") { $m = ('{0} gave up (timeout {1} s, 4 attempts): {2}' -f $w, $TimeoutSec, $m) }
|        [pscustomobject]@{ Status = $st; Body = $m; Headers = @{} }
|    }
|}
|
|function New-SIUpdateRestSeam {
|    <# The REST seam of an update (see the file header), over SecurityInsight's own token client. Sign in first (Connect-SIUpdateRest). #>
|    { param([string]$Method, [string]$Uri, $Body, [string]$Resource, [hashtable]$Headers) Invoke-SIUpdateRestCall -Method $Method -Uri $Uri -Body $Body -Resource $Resource -Headers $Headers }
|}
|
|function Get-SIUpdateRestSeam {
|    <# Signs in (Connect-SIUpdateRest: the updater job's identity, else the run's own) and returns the seam. For a caller that passed none. #>
|    param([string]$SubscriptionId)
|    if (-not $SubscriptionId) { $SubscriptionId = Get-SIUpdateRestSubscription }
|    $null = Connect-SIUpdateRest -SubscriptionId $SubscriptionId
|    New-SIUpdateRestSeam
|}
|
|function Format-SIRestFailure {
|    <# PURE. One readable line for a REST answer that is not a success: 'HTTP <code>: <ARM code: message | the body>' (max 400 characters). #>
|    param($Response)
|    $code = 0; try { $code = [int]$Response.Status } catch { }
|    $body = ("$($Response.Body)" -replace '\s+', ' ').Trim()
|    try {
|        $j = $body | ConvertFrom-Json -ErrorAction Stop
|        if ($j -and $j.PSObject.Properties['error'] -and $j.error) { $body = ('{0}: {1}' -f $j.error.code, $j.error.message) }
|    } catch { }
|    if ($body.Length -gt 400) { $body = $body.Substring(0, 397) + '...' }
|    if ($code -le 0) { return ('no answer: {0}' -f $body) }
|    'HTTP {0}: {1}' -f $code, $body
|}
|
|function Invoke-SIRestJson {
|    <#
|        One call through -Rest, the answer parsed. 2xx -> the parsed body ($null when it is empty); 404 with -AllowNotFound ->
|        $null; anything else THROWS '<What> failed: HTTP <code>: <reason>' (the reason is what Azure said).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [string]$Method = 'GET', [Parameter(Mandatory)][string]$Uri, $Body,
|          [AllowEmptyString()][string]$Resource = 'https://management.azure.com/', [hashtable]$Headers, [switch]$AllowNotFound, [string]$What = '')
|    $r = & $Rest $Method $Uri $Body $Resource $Headers
|    $code = 0; try { $code = [int]$r.Status } catch { }
|    if ($code -eq 404 -and $AllowNotFound) { return $null }
|    if ($code -lt 200 -or $code -ge 300) {
|        throw ('{0} failed: {1}' -f $(if ($What) { $What } else { '{0} {1}' -f $Method, ($Uri -replace '\?.*$', '') }), (Format-SIRestFailure -Response $r))
|    }
|    $t = "$($r.Body)".Trim()
|    if (-not $t) { return $null }
|    ConvertFrom-Json -InputObject $t
|}
|
|function Get-SIRestList {
|    <# Every item of an ARM list (value[]), following nextLink. Throws when a page cannot be read (Invoke-SIRestJson). #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$Uri, [string]$What = '', [int]$MaxPages = 50)
|    $all = New-Object System.Collections.Generic.List[object]
|    $url = $Uri
|    for ($p = 0; $url -and $p -lt $MaxPages; $p++) {
|        $page = Invoke-SIRestJson -Rest $Rest -Uri $url -What $What
|        $url = ''
|        if ($page -and $page.PSObject.Properties['value']) {
|            foreach ($x in @($page.value)) { if ($null -ne $x) { $all.Add($x) } }
|            if ($page.PSObject.Properties['nextLink']) { $url = [string]$page.nextLink }
|        } elseif ($page) { $all.Add($page) }
|    }
|    $all.ToArray()   # enumerated: wrap the call in @( )
|}
|
|function Get-SIArmUri {
|    <# PURE. https://management.azure.com<path>?api-version=<v> (a path that already names one keeps it). #>
|    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$ApiVersion)
|    # the base is written out here, NOT read from a script variable: a script that finds these functions already defined
|    # by its caller does not dot-source this file again, so this file's script variables do not exist in its scope --
|    # the URL then went out without a host (a new install in a Support session stopped at the registry, 2026-10-12)
|    $u = if ($Path -match '^https://') { $Path } else { 'https://management.azure.com' + $Path }
|    if ($u -match '[?&]api-version=') { return $u }
|    $u + $(if ($u.Contains('?')) { '&' } else { '?' }) + 'api-version=' + $ApiVersion
|}
|
|function New-SITemplateImagePatchBody {
|    <#
|        PURE. The ARM PATCH body that points a Container Apps job's or app's FIRST container at -Image -- what
|        `az containerapp (job) update --image` did, as ONE read-modify-write of properties.template: the resource's own
|        template as read, only that image changed; never the configuration (ARM returns secrets without values). The
|        default imageType and the read-only ephemeralStorage are left out (the live 400 of 2026-10-06). Returns the JSON text.
|        -MinCpu / -MinMemoryGi (both or neither): the first container is RAISED to at least that size; a bigger one is kept.
|    #>
|    param([Parameter(Mandatory)]$Resource, [Parameter(Mandatory)][string]$Image, [double]$MinCpu = 0, [double]$MinMemoryGi = 0)
|    $tpl = ConvertTo-Json -InputObject $Resource.properties.template -Depth 60 | ConvertFrom-Json
|    $first = @($tpl.containers | Where-Object { $_ }) | Select-Object -First 1
|    if (-not $first) { throw 'the resource has no container to point at the image' }
|    $first.image = $Image
|    if ($MinCpu -gt 0 -and $MinMemoryGi -gt 0) {
|        $inv = [Globalization.CultureInfo]::InvariantCulture
|        $cpuNow = 0.0; $memNow = 0.0
|        if ($first.PSObject.Properties['resources'] -and $first.resources) {
|            try { $cpuNow = [double]::Parse([string]$first.resources.cpu, $inv) } catch { $cpuNow = 0.0 }
|            $m = [regex]::Match([string]$first.resources.memory, '^\s*([0-9]+(?:\.[0-9]+)?)\s*Gi\s*$')
|            if ($m.Success) { $memNow = [double]::Parse($m.Groups[1].Value, $inv) }
|        }
|        if ($cpuNow -lt $MinCpu -or $memNow -lt $MinMemoryGi) {
|            # Container Apps takes a cpu / memory PAIR it supports: both are set together, to the larger of now and the minimum
|            $cpu = [Math]::Max($cpuNow, $MinCpu); $mem = [Math]::Max($memNow, $MinMemoryGi)
|            $res = [ordered]@{ cpu = $cpu; memory = ('{0}Gi' -f $mem.ToString($inv)) }
|            if ($first.PSObject.Properties['resources']) { $first.resources = [pscustomobject]$res } else { $first | Add-Member -NotePropertyName resources -NotePropertyValue ([pscustomobject]$res) }
|        }
|    }
|    foreach ($c in (@($tpl.containers) + @($tpl.initContainers))) {
|        if (-not $c) { continue }
|        if ($c.PSObject.Properties['imageType'] -and ([string]$c.imageType -in '', 'ContainerImage')) { $c.PSObject.Properties.Remove('imageType') }
|        if ($c.PSObject.Properties['resources'] -and $c.resources -and $c.resources.PSObject.Properties['ephemeralStorage']) { $c.resources.PSObject.Properties.Remove('ephemeralStorage') }
|    }
|    ConvertTo-Json -InputObject ([ordered]@{ properties = [ordered]@{ template = $tpl } }) -Depth 60 -Compress
|}
'@ }
$__siSupportFiles['setup/_shared/SI-AcrBuild.ps1'] = @{ Sha256 = '15253389b631c72f4c70f5527d5ee78d9343fd62131fdd695daae434014e03c3'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- BUILD AN IMAGE IN THE INSTALL'S OWN REGISTRY OVER ARM REST (#521: no az CLI). Ported from PIM4EntraPS's
|    proven engine/_shared/PIM-AcrBuild.ps1 (live since 2026-09). `az acr build` never built anything locally: it packed the
|    folder, uploaded it and asked the registry to build. These are the same four HTTPS calls:
|
|        1. POST  .../registries/<acr>/listBuildSourceUploadUrl   -> { uploadUrl; relativePath }
|        2. PUT   <uploadUrl>                                     -> the .tar.gz build context
|        3. POST  .../registries/<acr>/scheduleRun                -> a DockerBuildRequest
|        4. GET   .../registries/<acr>/runs/<runId>               -> polled until it ends
|
|    🪤 STEP 2 IS NOT AN ARM CALL. The upload URL is a blob SAS of the ACR task service: it takes NO bearer token (the SAS is
|       the credential) and it REQUIRES `x-ms-blob-type: BlockBlob`. Both mistakes fail as a 40x from a storage host that
|       reads like an identity problem and is not.
|    🪤 IMAGE NAMES ARE REGISTRY-RELATIVE ("si-orchestrator:v3.0.1-abc"): a name with the login server in front becomes
|       <acr>.azurecr.io/<acr>.azurecr.io/... and fails only at push time, minutes in.
|    🪤 'Queued', 'Started' and 'Running' all mean STILL GOING; only Succeeded / Failed / Canceled / Error / Timeout end it.
|    🪤 A registry with public access Disabled refuses ACR's shared build agents -- it needs an agent pool inside its network
|       (SI_UPDATER_ACR_AGENT_POOL, else the registry's first agent pool).
|    The runId of scheduleRun sits at the root or under .properties depending on the version -- both are read. The ACR tasks
|    API version is PINNED (2019-06-01-preview, as PIM). A failed run's log is fetched (POST runs/<id>/listLogSasUrl, the
|    SAS link read without a token) and its tail printed.
|
|    THE BUILD CONTEXT is packed here with .NET -- no tar.exe, no Python: System.Formats.Tar (PowerShell 7 / .NET 7+: the
|    updater container) and, on Windows PowerShell 5.1 (the VM sync hook), a small ustar writer of this file; both gzip with
|    System.IO.Compression.GZipStream. The context's .dockerignore is applied BEFORE anything leaves the machine (as
|    `az acr build` did): customer files (*.custom.*, config/) are never uploaded. .git is never packed. A Dockerfile outside
|    the context (the two-layer build's derived file) travels in the archive as .si-build/<name>.
|
|    THE TAG CHECK (was `az acr repository show-tags`) reads the registry itself: the identity's ARM token is exchanged for a
|    registry token (POST https://<login>/oauth2/exchange, then /oauth2/token with scope repository:<repo>:pull) and the
|    manifest is asked for (HEAD /v2/<repo>/manifests/<tag>: 200 = there, 404 = not). Same right as before (AcrPull).
|
|    Every call goes through -Rest (setup/_shared/SI-UpdateRest.ps1); tests drive a fake registry. PowerShell 5.1-compatible.
|#>
|
|if (-not (Get-Command -Name Invoke-SIRestJson -ErrorAction SilentlyContinue)) { . ([IO.Path]::Combine($PSScriptRoot, 'SI-UpdateRest.ps1')) }
|# framework rule 11g: a private install's build pool is at 0 agents between builds -- scaled up just before a build on it
|if (-not (Get-Command -Name Request-SIBuildPoolUp -ErrorAction SilentlyContinue) -and (Test-Path -LiteralPath ([IO.Path]::Combine($PSScriptRoot, 'SI-AcrBuildPool.ps1')))) { . ([IO.Path]::Combine($PSScriptRoot, 'SI-AcrBuildPool.ps1')) }
|
|$script:SIAcrTasksApi = '2019-06-01-preview'
|$script:SIAcrRegistryApi = '2023-07-01'
|$script:SIAcrRunDone = @('Succeeded', 'Failed', 'Canceled', 'Cancelled', 'Error', 'Timeout')
|if (-not ($script:SIAcrRegistryCache -is [hashtable])) { $script:SIAcrRegistryCache = @{} }
|
|function Get-SIAcrRegistry {
|    <#
|        The registry -AcrName as ARM knows it: @{ Id; Name; ResourceGroup; LoginServer; PublicNetworkAccess }. Looked up in
|        -ResourceGroup first, else among every registry of the subscription (as `az acr show --name`). Cached per run.
|        Throws when it cannot be found or read.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$AcrName, [string]$ResourceGroup)
|    $key = ('{0}|{1}' -f $SubscriptionId, $AcrName).ToLowerInvariant()
|    if ($script:SIAcrRegistryCache -is [hashtable] -and $script:SIAcrRegistryCache.ContainsKey($key)) { return $script:SIAcrRegistryCache[$key] }
|    $reg = $null
|    if ($ResourceGroup) {
|        $reg = Invoke-SIRestJson -Rest $Rest -Uri (Get-SIArmUri -Path ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.ContainerRegistry/registries/{2}' -f $SubscriptionId, $ResourceGroup, $AcrName) -ApiVersion $script:SIAcrRegistryApi) `
|                   -AllowNotFound -What ("the container registry '{0}'" -f $AcrName)
|    }
|    if (-not $reg) {
|        $all = @(Get-SIRestList -Rest $Rest -Uri (Get-SIArmUri -Path ('/subscriptions/{0}/providers/Microsoft.ContainerRegistry/registries' -f $SubscriptionId) -ApiVersion $script:SIAcrRegistryApi) -What 'the container registries of the subscription')
|        $reg = @($all | Where-Object { $_ -and ([string]$_.name) -ieq $AcrName }) | Select-Object -First 1
|    }
|    if (-not $reg) { throw ("the container registry '{0}' was not found in subscription {1} (or this identity cannot read it)" -f $AcrName, $SubscriptionId) }
|    $id = [string]$reg.id
|    $rg = if ($id -match '/resourceGroups/([^/]+)/') { $Matches[1] } else { $ResourceGroup }
|    $p = $reg.properties
|    $o = [pscustomobject]@{ Id = $id; Name = [string]$reg.name; ResourceGroup = $rg
|        LoginServer = $(if ($p -and $p.PSObject.Properties['loginServer']) { [string]$p.loginServer } else { ('{0}.azurecr.io' -f $AcrName.ToLowerInvariant()) })
|        PublicNetworkAccess = $(if ($p -and $p.PSObject.Properties['publicNetworkAccess']) { [string]$p.publicNetworkAccess } else { '' }) }
|    if (-not ($script:SIAcrRegistryCache -is [hashtable])) { $script:SIAcrRegistryCache = @{} }
|    $script:SIAcrRegistryCache[$key] = $o
|    $o
|}
|
|# ---- the build context ----------------------------------------------------------------------------------------------
|function ConvertTo-SIDockerIgnoreRegex {
|    <# PURE. One .dockerignore pattern (Go filepath.Match plus **, as Docker reads it) -> an anchored regex over '/' paths. #>
|    param([Parameter(Mandatory)][string]$Pattern)
|    $p = $Pattern.Trim() -replace '\\', '/'
|    while ($p.StartsWith('./')) { $p = $p.Substring(2) }
|    $p = $p.TrimStart('/').TrimEnd('/')
|    $sb = New-Object System.Text.StringBuilder
|    $i = 0
|    while ($i -lt $p.Length) {
|        $ch = $p[$i]
|        if ($ch -eq '*') {
|            if ($i + 1 -lt $p.Length -and $p[$i + 1] -eq '*') {
|                if ($i + 2 -lt $p.Length -and $p[$i + 2] -eq '/') { [void]$sb.Append('(?:.*/)?'); $i += 3; continue }
|                [void]$sb.Append('.*'); $i += 2; continue
|            }
|            [void]$sb.Append('[^/]*'); $i++; continue
|        }
|        if ($ch -eq '?') { [void]$sb.Append('[^/]'); $i++; continue }
|        if ($ch -eq '[') {
|            $j = $p.IndexOf(']', $i + 1)
|            if ($j -gt $i) {
|                $cls = $p.Substring($i + 1, $j - $i - 1)
|                if ($cls.StartsWith('!') -or $cls.StartsWith('^')) { $cls = '^' + $cls.Substring(1) }
|                [void]$sb.Append('[' + ($cls -replace '\\', '\\') + ']'); $i = $j + 1; continue
|            }
|        }
|        [void]$sb.Append([regex]::Escape([string]$ch)); $i++
|    }
|    '^' + $sb.ToString() + '$'
|}
|
|function Get-SIDockerIgnoreRules {
|    <# PURE. The rules of a .dockerignore text, in order: @{ Regex; Negate; Pattern }. Comments and blank lines are skipped. #>
|    param([AllowEmptyString()][string]$Text)
|    $rules = New-Object System.Collections.Generic.List[object]
|    foreach ($l in ("$Text" -split "`r?`n")) {
|        $t = $l.Trim()
|        if (-not $t -or $t.StartsWith('#')) { continue }
|        $neg = $false
|        if ($t.StartsWith('!')) { $neg = $true; $t = $t.Substring(1).Trim() }
|        if (-not $t) { continue }
|        $rules.Add([pscustomobject]@{ Regex = (ConvertTo-SIDockerIgnoreRegex -Pattern $t); Negate = $neg; Pattern = $t })
|    }
|    $rules.ToArray()
|}
|
|function Test-SIDockerIgnored {
|    <#
|        PURE. Is -RelativePath ('/' separated, from the context root) left out by -Rules? Docker's rule: a pattern matches the
|        path itself or any folder above it; the LAST matching pattern decides (! = keep it).
|    #>
|    param([Parameter(Mandatory)][string]$RelativePath, [object[]]$Rules = @())
|    $path = ($RelativePath -replace '\\', '/').TrimStart('/')
|    $parts = $path.Split('/')
|    $cands = New-Object System.Collections.Generic.List[string]
|    for ($n = 1; $n -le $parts.Count; $n++) { $cands.Add(($parts[0..($n - 1)] -join '/')) }
|    $ignored = $false
|    foreach ($r in @($Rules)) {
|        if (-not $r) { continue }
|        $hit = $false
|        foreach ($c in $cands) { if ($c -match $r.Regex) { $hit = $true; break } }
|        if ($hit) { $ignored = -not $r.Negate }
|    }
|    $ignored
|}
|
|function Get-SIBuildContextFiles {
|    <#
|        The files of the build context -Path that are uploaded: everything but .git and what the context's own .dockerignore
|        leaves out. Returns @(@{ Rel ('/' separated); Full }), sorted ordinally (a stable archive). -Keep: relative paths
|        always packed (the Dockerfile the build names -- Docker never leaves it out either).
|    #>
|    param([Parameter(Mandatory)][string]$Path, [string[]]$Keep = @())
|    $root = [IO.Path]::GetFullPath($Path).TrimEnd('\', '/')
|    $diFile = [IO.Path]::Combine($root, '.dockerignore')
|    $rules = if (Test-Path -LiteralPath $diFile) { @(Get-SIDockerIgnoreRules -Text ([IO.File]::ReadAllText($diFile))) } else { @() }
|    $keepSet = @{}; foreach ($k in @($Keep)) { if ($k) { $keepSet[($k -replace '\\', '/').TrimStart('/').ToLowerInvariant()] = $true } }
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($f in [IO.Directory]::EnumerateFiles($root, '*', [IO.SearchOption]::AllDirectories)) {
|        $rel = $f.Substring($root.Length).TrimStart('\', '/') -replace '\\', '/'
|        if ($rel -match '(^|/)\.git(/|$)') { continue }
|        if (-not $keepSet.ContainsKey($rel.ToLowerInvariant()) -and $rules.Count -and (Test-SIDockerIgnored -RelativePath $rel -Rules $rules)) { continue }
|        $out.Add([pscustomobject]@{ Rel = $rel; Full = $f })
|    }
|    $arr = $out.ToArray()
|    [Array]::Sort($arr, [System.Collections.Generic.Comparer[object]]::Create([Comparison[object]] { param($a, $b) [string]::CompareOrdinal($a.Rel, $b.Rel) }))
|    $arr
|}
|
|function Write-SIUstarEntry {
|    <# One regular file into a ustar stream (a GNU long-name entry first when the name does not fit). 5.1 fallback writer. #>
|    param([Parameter(Mandatory)][System.IO.Stream]$Stream, [Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][AllowEmptyCollection()][byte[]]$Data, [char]$Type = '0')
|    $enc = [System.Text.Encoding]::UTF8
|    $nb = $enc.GetBytes($Name)
|    $prefix = [byte[]]@(); $short = $nb
|    if ($nb.Length -gt 100) {
|        $cut = -1
|        for ($i = [Math]::Min($nb.Length - 1, 155); $i -gt 0; $i--) { if ($nb[$i] -eq 47 -and ($nb.Length - $i - 1) -le 100 -and ($nb.Length - $i - 1) -gt 0) { $cut = $i; break } }
|        if ($cut -gt 0) { $prefix = $nb[0..($cut - 1)]; $short = $nb[($cut + 1)..($nb.Length - 1)] }
|        else {
|            # GNU long name: a '././@LongLink' entry of type L carries the full name
|            Write-SIUstarEntry -Stream $Stream -Name '././@LongLink' -Data ([byte[]]($nb + [byte[]]@(0))) -Type 'L'
|            $short = $nb[0..99]
|        }
|    }
|    $h = New-Object byte[] 512
|    [Array]::Copy([byte[]]$short, 0, $h, 0, [Math]::Min(100, $short.Length))
|    $oct = { param([long]$v, [int]$len) $s = [Convert]::ToString($v, 8).PadLeft($len - 1, '0') + [char]0; $enc.GetBytes($s) }
|    [Array]::Copy((& $oct 420 8), 0, $h, 100, 8)          # mode 0644
|    [Array]::Copy((& $oct 0 8), 0, $h, 108, 8)            # uid
|    [Array]::Copy((& $oct 0 8), 0, $h, 116, 8)            # gid
|    [Array]::Copy((& $oct $Data.Length 12), 0, $h, 124, 12)
|    [Array]::Copy((& $oct 1577836800 12), 0, $h, 136, 12) # mtime: fixed (a stable archive)
|    for ($i = 148; $i -lt 156; $i++) { $h[$i] = 32 }      # checksum field = spaces while summing
|    $h[156] = [byte][char]$Type
|    [Array]::Copy($enc.GetBytes("ustar`0"), 0, $h, 257, 6)
|    $h[263] = 48; $h[264] = 48                             # version '00'
|    if ($prefix.Length) { [Array]::Copy([byte[]]$prefix, 0, $h, 345, [Math]::Min(155, $prefix.Length)) }
|    $sum = 0; foreach ($b in $h) { $sum += $b }
|    $cs = $enc.GetBytes(([Convert]::ToString($sum, 8).PadLeft(6, '0') + [char]0 + ' '))
|    [Array]::Copy($cs, 0, $h, 148, 8)
|    $Stream.Write($h, 0, 512)
|    if ($Data.Length) { $Stream.Write($Data, 0, $Data.Length) }
|    $pad = (512 - ($Data.Length % 512)) % 512
|    if ($pad) { $Stream.Write((New-Object byte[] $pad), 0, $pad) }
|}
|
|function New-SIBuildContextArchive {
|    <#
|        Packs the build context -Path (Get-SIBuildContextFiles) plus -Extra (@{ '<relative name>' = '<file>' }) into the
|        .tar.gz -OutFile. -Format: Auto (System.Formats.Tar when .NET has it, else the ustar writer) | Ustar. Returns
|        @{ Path; Files; Bytes; Writer }.
|    #>
|    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$OutFile, [hashtable]$Extra = @{}, [string[]]$Keep = @(),
|          [ValidateSet('Auto', 'Ustar')][string]$Format = 'Auto')
|    $files = New-Object System.Collections.Generic.List[object]
|    foreach ($f in @(Get-SIBuildContextFiles -Path $Path -Keep $Keep)) { $files.Add($f) }
|    foreach ($k in @($Extra.Keys | Sort-Object)) { $files.Add([pscustomobject]@{ Rel = ([string]$k -replace '\\', '/').TrimStart('/'); Full = [string]$Extra[$k] }) }
|    $useNet = ($Format -eq 'Auto') -and [bool]('System.Formats.Tar.TarWriter' -as [type])
|    $fs = [IO.File]::Create($OutFile)
|    try {
|        $gz = New-Object System.IO.Compression.GZipStream($fs, [System.IO.Compression.CompressionLevel]::Optimal, $true)
|        try {
|            if ($useNet) {
|                $tw = New-Object System.Formats.Tar.TarWriter($gz, [System.Formats.Tar.TarEntryFormat]::Pax, $true)
|                try {
|                    foreach ($f in $files) {
|                        $e = New-Object System.Formats.Tar.PaxTarEntry([System.Formats.Tar.TarEntryType]::RegularFile, $f.Rel)
|                        $e.Mode = [System.IO.UnixFileMode]420
|                        $e.ModificationTime = [DateTimeOffset]::FromUnixTimeSeconds(1577836800)
|                        $src = [IO.File]::OpenRead($f.Full)
|                        try { $e.DataStream = $src; $tw.WriteEntry($e) } finally { $src.Dispose() }
|                    }
|                } finally { $tw.Dispose() }
|            } else {
|                foreach ($f in $files) { Write-SIUstarEntry -Stream $gz -Name $f.Rel -Data ([IO.File]::ReadAllBytes($f.Full)) }
|                $gz.Write((New-Object byte[] 1024), 0, 1024)   # two empty blocks end the archive
|            }
|        } finally { $gz.Dispose() }
|    } finally { $fs.Dispose() }
|    [pscustomobject]@{ Path = $OutFile; Files = @($files | ForEach-Object { $_.Rel }); Bytes = (Get-Item -LiteralPath $OutFile).Length; Writer = $(if ($useNet) { 'System.Formats.Tar' } else { 'ustar' }) }
|}
|
|# ---- the four calls -------------------------------------------------------------------------------------------------
|function ConvertTo-SIAcrRelativeImage {
|    <# PURE. 'reg.azurecr.io/si-x:1' -> 'si-x:1' (a registry-relative name is what scheduleRun takes). #>
|    param([Parameter(Mandatory)][string]$Image, [string]$LoginServer = '')
|    $i = $Image.Trim()
|    if ($LoginServer -and $i.ToLowerInvariant().StartsWith($LoginServer.ToLowerInvariant() + '/')) { return $i.Substring($LoginServer.Length + 1) }
|    if ($i -match '^[^/]+\.azurecr\.io/(.+)$') { return $Matches[1] }
|    $i
|}
|
|function New-SIAcrDockerBuildRequest {
|    <# PURE. The scheduleRun body: a DockerBuildRequest, Linux / amd64, push on, cache allowed, the image registry-relative. #>
|    param([Parameter(Mandatory)][string]$SourceLocation, [Parameter(Mandatory)][string]$Image, [Parameter(Mandatory)][string]$DockerfilePath,
|          [string]$LoginServer = '', [int]$TimeoutSeconds = 3600, [string]$AgentPoolName = '')
|    $b = [ordered]@{
|        type           = 'DockerBuildRequest'
|        isPushEnabled  = $true
|        noCache        = $false
|        dockerFilePath = ($DockerfilePath -replace '\\', '/')
|        imageNames     = @(ConvertTo-SIAcrRelativeImage -Image $Image -LoginServer $LoginServer)
|        sourceLocation = $SourceLocation
|        platform       = [ordered]@{ os = 'Linux'; architecture = 'amd64' }
|        timeout        = $TimeoutSeconds
|    }
|    if ("$AgentPoolName".Trim()) { $b['agentPoolName'] = "$AgentPoolName".Trim() }
|    $b
|}
|
|function Get-SIAcrRunId {
|    <# PURE. scheduleRun's run id: at the root or under .properties, depending on the API version. #>
|    param($Run)
|    if (-not $Run) { return '' }
|    $id = ''
|    if ($Run.PSObject.Properties['runId']) { $id = "$($Run.runId)".Trim() }
|    if (-not $id -and $Run.PSObject.Properties['properties'] -and $Run.properties -and $Run.properties.PSObject.Properties['runId']) { $id = "$($Run.properties.runId)".Trim() }
|    $id
|}
|
|function Resolve-SIAcrAgentPool {
|    <#
|        The agent pool a build runs on: SI_UPDATER_ACR_AGENT_POOL (or $global:SI_Bootstrap_AcrAgentPool) when set; else, for a
|        registry with public access Disabled (the shared agents are refused there), its first agent pool; else '' (shared).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)]$Registry)
|    $set = "$([Environment]::GetEnvironmentVariable('SI_UPDATER_ACR_AGENT_POOL'))".Trim()
|    if (-not $set) { $set = "$(Get-Variable -Name SI_Bootstrap_AcrAgentPool -Scope Global -ValueOnly -ErrorAction Ignore)".Trim() }
|    if ($set) { return $set }
|    if ([string]$Registry.PublicNetworkAccess -ine 'Disabled') { return '' }
|    try {
|        $pools = @(Get-SIRestList -Rest $Rest -Uri (Get-SIArmUri -Path ($Registry.Id + '/agentPools') -ApiVersion $script:SIAcrTasksApi) -What 'the registry''s agent pools')
|        $p = @($pools | Where-Object { $_ }) | Select-Object -First 1
|        if ($p) { return [string]$p.name }
|    } catch { }
|    ''
|}
|
|function Send-SIAcrBuildContext {
|    <# PUT the .tar.gz to the upload SAS. NO bearer token (Resource ''), `x-ms-blob-type: BlockBlob` mandatory. Returns the bytes sent. #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$UploadUrl, [Parameter(Mandatory)][string]$Path)
|    $bytes = [IO.File]::ReadAllBytes($Path)
|    $r = & $Rest 'PUT' $UploadUrl $bytes '' @{ 'x-ms-blob-type' = 'BlockBlob'; 'Content-Type' = 'application/octet-stream' }
|    if ([int]$r.Status -lt 200 -or [int]$r.Status -ge 300) { throw ('the build context upload failed: {0}' -f (Format-SIRestFailure -Response $r)) }
|    $bytes.Length
|}
|
|function Invoke-SIAcrQueueBuild {
|    <#
|        Packs -ContextPath, uploads it and SCHEDULES the build of -Image (registry-relative) from -DockerfilePath (relative to the
|        context, or a file outside it -- then packed as .si-build/<name>). Does not wait. Returns @{ RunId; Image; Bytes; Files;
|        Writer; Registry }. Throws when a call fails.
|        Framework rule 11g: a build on an agent pool asks for the pool's scale-up FIRST (Request-SIBuildPoolUp, inside the
|        build-pool session the caller holds -- it scales the pool back to 0 when its builds are done); a pool that cannot be
|        scaled up stops the build here (it would wait in the queue for agents that never come).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$AcrName,
|          [Parameter(Mandatory)][string]$ContextPath, [Parameter(Mandatory)][string]$Image, [Parameter(Mandatory)][string]$DockerfilePath,
|          [string]$ResourceGroup, [int]$TimeoutSeconds = 3600, [string]$WorkDir,
|          # framework installer rule 11b: a private install's builds run on its agent pool in the network from the FIRST build
|          [string]$AgentPoolName = '', [scriptblock]$Say = { param($t) Write-Host $t })
|    $reg = Get-SIAcrRegistry -Rest $Rest -SubscriptionId $SubscriptionId -AcrName $AcrName -ResourceGroup $ResourceGroup
|    $pool = if ("$AgentPoolName".Trim()) { "$AgentPoolName".Trim() } else { Resolve-SIAcrAgentPool -Rest $Rest -Registry $reg }
|    if ($pool -and (Get-Command -Name Request-SIBuildPoolUp -ErrorAction SilentlyContinue)) {
|        $up = Request-SIBuildPoolUp -Rest $Rest -RegistryId ([string]$reg.Id) -Pool $pool
|        if ($up.Line) { try { & $Say $up.Line } catch { } }
|        if (-not $up.Ok) { throw $up.Line }
|    }
|    $ctx = [IO.Path]::GetFullPath($ContextPath).TrimEnd('\', '/')
|    $extra = @{}; $dfRel = ($DockerfilePath -replace '\\', '/')
|    $dfFull = if ([IO.Path]::IsPathRooted($DockerfilePath)) { [IO.Path]::GetFullPath($DockerfilePath) } else { [IO.Path]::GetFullPath([IO.Path]::Combine($ctx, $DockerfilePath)) }
|    $inside = $dfFull.StartsWith($ctx + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase)
|    if (-not $inside) { $dfRel = '.si-build/' + [IO.Path]::GetFileName($dfFull); $extra[$dfRel] = $dfFull }
|    else { $dfRel = $dfFull.Substring($ctx.Length + 1) -replace '\\', '/' }
|    $own = -not $WorkDir
|    if ($own) { $WorkDir = Join-Path ([IO.Path]::GetTempPath()) ('si-acr-' + [guid]::NewGuid().ToString('N').Substring(0, 8)) }
|    New-Item -ItemType Directory -Force -Path $WorkDir | Out-Null
|    try {
|        $tgz = Join-Path $WorkDir 'context.tar.gz'
|        $pack = New-SIBuildContextArchive -Path $ctx -OutFile $tgz -Extra $extra -Keep @($dfRel)
|        $slot = Invoke-SIRestJson -Rest $Rest -Method POST -Uri (Get-SIArmUri -Path ($reg.Id + '/listBuildSourceUploadUrl') -ApiVersion $script:SIAcrTasksApi) -What 'the build upload slot'
|        if (-not $slot -or -not "$($slot.uploadUrl)".Trim()) { throw ("registry '{0}' returned no upload URL" -f $AcrName) }
|        $bytes = Send-SIAcrBuildContext -Rest $Rest -UploadUrl ([string]$slot.uploadUrl) -Path $tgz
|        $body = New-SIAcrDockerBuildRequest -SourceLocation ([string]$slot.relativePath) -Image $Image -DockerfilePath $dfRel -LoginServer $reg.LoginServer -TimeoutSeconds $TimeoutSeconds -AgentPoolName $pool
|        $run = Invoke-SIRestJson -Rest $Rest -Method POST -Uri (Get-SIArmUri -Path ($reg.Id + '/scheduleRun') -ApiVersion $script:SIAcrTasksApi) -Body (ConvertTo-Json -InputObject $body -Depth 10 -Compress) -What ('the build of {0}' -f $Image)
|        [pscustomobject]@{ RunId = (Get-SIAcrRunId -Run $run); Image = $body.imageNames[0]; Bytes = $bytes; Files = @($pack.Files).Count; Writer = $pack.Writer; Registry = $reg }
|    } finally { if ($own) { Remove-Item -LiteralPath $WorkDir -Recurse -Force -ErrorAction SilentlyContinue } }
|}
|
|function Get-SIAcrRunStatus {
|    <# The status of run -RunId ('' when it cannot be read -- the caller polls again). Never throws. #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)]$Registry, [Parameter(Mandatory)][string]$RunId)
|    try {
|        $r = Invoke-SIRestJson -Rest $Rest -Uri (Get-SIArmUri -Path ($Registry.Id + '/runs/' + $RunId) -ApiVersion $script:SIAcrTasksApi) -What ('build run {0}' -f $RunId)
|        $s = ''
|        if ($r -and $r.PSObject.Properties['properties'] -and $r.properties) { $s = "$($r.properties.status)".Trim() }
|        if (-not $s -and $r -and $r.PSObject.Properties['status']) { $s = "$($r.status)".Trim() }
|        $s
|    } catch { '' }
|}
|
|function Get-SIAcrRunLogTail {
|    <# The last -Lines lines of a run's log (POST runs/<id>/listLogSasUrl, then the SAS link read WITHOUT a token). @() when unreadable. #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)]$Registry, [Parameter(Mandatory)][string]$RunId, [int]$Lines = 30)
|    try {
|        $l = Invoke-SIRestJson -Rest $Rest -Method POST -Uri (Get-SIArmUri -Path ($Registry.Id + '/runs/' + $RunId + '/listLogSasUrl') -ApiVersion $script:SIAcrTasksApi) -What ('the log link of run {0}' -f $RunId)
|        $link = if ($l -and $l.PSObject.Properties['logLink']) { [string]$l.logLink } else { '' }
|        if (-not $link) { return @() }
|        $t = & $Rest 'GET' $link $null '' @{ Accept = 'text/plain' }
|        if ([int]$t.Status -lt 200 -or [int]$t.Status -ge 300) { return @() }
|        $all = @(("$($t.Body)" -split "`r?`n") | Where-Object { "$_".Trim() })
|        if ($all.Count -le $Lines) { return $all }
|        @($all[($all.Count - $Lines)..($all.Count - 1)])
|    } catch { @() }
|}
|
|function Find-SIAcrRunId {
|    <# The newest run of the registry whose output images name -Image (repo:tag); '' when none. Never throws. #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)]$Registry, [Parameter(Mandatory)][string]$Image)
|    $img = ConvertTo-SIAcrRelativeImage -Image $Image -LoginServer $Registry.LoginServer
|    $repo = ($img -split ':')[0]; $tag = ($img -split ':')[-1]
|    try {
|        $runs = @(Invoke-SIRestJson -Rest $Rest -Uri ((Get-SIArmUri -Path ($Registry.Id + '/runs') -ApiVersion $script:SIAcrTasksApi) + '&$top=10') -What 'the registry''s runs').value
|        foreach ($r in @($runs)) {
|            if (-not $r) { continue }
|            $p = if ($r.PSObject.Properties['properties']) { $r.properties } else { $r }
|            foreach ($o in @($p.outputImages)) { if ($o -and "$($o.repository)" -eq $repo -and "$($o.tag)" -eq $tag) { return [string]$p.runId } }
|        }
|    } catch { }
|    ''
|}
|
|# ---- the tag check: the registry's own data plane -------------------------------------------------------------------
|function Get-SIAcrPullToken {
|    <#
|        A registry token for -Repo: the identity's ARM token (-Token { param($Resource) }) exchanged at https://<login>/oauth2/exchange
|        for a refresh token, then /oauth2/token with scope repository:<repo>:pull. Throws when either step is refused.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$LoginServer, [Parameter(Mandatory)][string]$Repo, [scriptblock]$Token)
|    if (-not $Token) { $Token = { param($Resource) Get-SIAzureToken -Resource $Resource } }
|    $aad = [string](& $Token 'https://management.azure.com/')
|    if (-not $aad) { throw 'no access token for the registry exchange' }
|    $form = @{ 'Content-Type' = 'application/x-www-form-urlencoded' }
|    $ex = & $Rest 'POST' ('https://{0}/oauth2/exchange' -f $LoginServer) ('grant_type=access_token&service={0}&access_token={1}' -f [uri]::EscapeDataString($LoginServer), [uri]::EscapeDataString($aad)) '' $form
|    if ([int]$ex.Status -lt 200 -or [int]$ex.Status -ge 300) { throw ('the registry refused the token exchange: {0}' -f (Format-SIRestFailure -Response $ex)) }
|    $refresh = [string](("$($ex.Body)" | ConvertFrom-Json).refresh_token)
|    $tk = & $Rest 'POST' ('https://{0}/oauth2/token' -f $LoginServer) ('grant_type=refresh_token&service={0}&scope={1}&refresh_token={2}' -f [uri]::EscapeDataString($LoginServer), [uri]::EscapeDataString(('repository:{0}:pull' -f $Repo)), [uri]::EscapeDataString($refresh)) '' $form
|    if ([int]$tk.Status -lt 200 -or [int]$tk.Status -ge 300) { throw ('the registry refused a pull token for {0}: {1}' -f $Repo, (Format-SIRestFailure -Response $tk)) }
|    [string](("$($tk.Body)" | ConvertFrom-Json).access_token)
|}
|
|function Test-SIAcrManifest {
|    <# Is <login>/<repo>:<tag> in the registry? HEAD /v2/<repo>/manifests/<tag>: 200 $true, 404 $false; anything else THROWS. #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$LoginServer, [Parameter(Mandatory)][string]$Repo, [Parameter(Mandatory)][string]$Tag, [scriptblock]$Token)
|    $bearer = Get-SIAcrPullToken -Rest $Rest -LoginServer $LoginServer -Repo $Repo -Token $Token
|    $acc = 'application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json'
|    $r = & $Rest 'HEAD' ('https://{0}/v2/{1}/manifests/{2}' -f $LoginServer, $Repo, $Tag) $null '' @{ Authorization = ('Bearer ' + $bearer); Accept = $acc }
|    if ([int]$r.Status -ge 200 -and [int]$r.Status -lt 300) { return $true }
|    if ([int]$r.Status -eq 404) { return $false }
|    throw ('the registry could not say whether {0}:{1} exists: {2}' -f $Repo, $Tag, (Format-SIRestFailure -Response $r))
|}
'@ }
$__siSupportFiles['setup/_shared/SI-AcrBuildPool.ps1'] = @{ Sha256 = '247287f045638533af7c110d7c4671400bf0f640243ce848cdbf2d7be624f6aa'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE BUILD POOL OF A PRIVATE INSTALL (framework installer rule 11g, Invardia, owner-approved 2026-11-05).
|
|    A private install's registry (Premium, public access Disabled) builds its images on its OWN agent pool inside its network
|    (si-vnet-pool, setup\_shared\SI-PrivateNetwork.ps1). The rule:
|      1. The pool's count is 0 BETWEEN builds. It only builds images; no job runs on it.
|      2. Before the first build of an install / update / setup step, the pool is scaled to S2 x 2 (count 2) and read back
|         (provisioningState Succeeded AND the count); after the last build it goes back to 0 in a FINALLY -- also after a
|         failed or timed-out build -- read back. A scale-down that fails is said plainly and reported as a failure line of
|         its own; it never hides the build result.
|      3. Tier S2. The tier cannot change in place (Azure: delete + create the pool again with the same subnet and OS). The
|         installer creates the pool at S2 with count 0; the UPDATER moves an existing pool of another tier to S2 ONLY while no
|         run of the registry is Queued / Started / Running (and no build of this process holds the pool), same subnet, read
|         back. Anything uncertain = the pool is left as it is and that is said -- never a pool deleted without being made again.
|      4. The build waits stay as they are (the update: 90 min).
|
|    THE SESSION. A process may build several images (the updater queues the web app / MCP / updater images in parallel with
|    the engine build and waits for them later). The pool is held for the whole of that by ONE session (global, nested by a
|    depth counter): Open-SIBuildPoolSession / Close-SIBuildPoolSession, or Invoke-SIWithBuildPool around a block. The scale-up
|    is LAZY -- Invoke-SIAcrQueueBuild asks for it (Request-SIBuildPoolUp) just before it schedules a build on the pool -- so a
|    run that builds nothing never scales the pool. Only the OUTERMOST close scales back to 0, and only when the session
|    scaled (or tried to scale) the pool up. Without an open session nothing here touches the pool.
|
|    Every call goes through -Arm { param([string]$Method, [string]$Path, $Body) } (parsed answer, $null for not found, throws
|    otherwise -- the seam of SI-PrivateNetwork.ps1) or, when no -Arm is given, -Rest (setup\_shared\SI-UpdateRest.ps1,
|    Invoke-SIRestJson). No module, no az. Values live in Get-SIBuildPoolSettings (a function, not a script variable: a script
|    that finds these functions already defined does not dot-source this file again). PowerShell 5.1-compatible.
|#>
|
|function Get-SIBuildPoolSettings {
|    <# PURE. Rule 11g's values. #>
|    [pscustomobject]@{
|        Tier            = 'S2'
|        BuildCount      = 2
|        IdleCount       = 0
|        Api             = '2019-06-01-preview'
|        WaitMinutes     = 30
|        PauseSeconds    = 15
|        ActiveRunStates = @('Queued', 'Started', 'Running')
|        RunsRead        = 20
|    }
|}
|
|function Get-SIBuildPoolProp {
|    <# PURE. A nested property (PSCustomObject or hashtable), $null when any step is missing. #>
|    param($Object, [string[]]$Names)
|    $o = $Object
|    foreach ($n in $Names) {
|        if ($null -eq $o) { return $null }
|        if ($o -is [System.Collections.IDictionary]) { if ($o.Contains($n)) { $o = $o[$n] } else { return $null }; continue }
|        $p = $o.PSObject.Properties[$n]
|        if (-not $p) { return $null }
|        $o = $p.Value
|    }
|    $o
|}
|
|function Invoke-SIBuildPoolCall {
|    <# One ARM call: through -Arm when given, else through -Rest (Invoke-SIRestJson, 404 = $null). Throws on any other error. #>
|    param([scriptblock]$Arm, [scriptblock]$Rest, [Parameter(Mandatory)][string]$Method, [Parameter(Mandatory)][string]$Path, $Body)
|    if ($Arm) { return (& $Arm $Method $Path $Body) }
|    if (-not $Rest) { throw 'no Azure seam (-Arm or -Rest) for the build pool' }
|    $u = if ($Path -match '^https://') { $Path } else { 'https://management.azure.com' + $Path }
|    Invoke-SIRestJson -Rest $Rest -Method $Method -Uri $u -Body $Body -AllowNotFound -What ('{0} {1}' -f $Method, ($Path -replace '\?.*$', ''))
|}
|
|function Get-SIBuildPoolPath {
|    <# PURE. The ARM path of agent pool -Pool of -RegistryId (or -PoolId as it is), with the pinned api-version. #>
|    param([string]$RegistryId = '', [string]$Pool = '', [string]$PoolId = '')
|    $id = if ($PoolId) { $PoolId.TrimEnd('/') } else { '{0}/agentPools/{1}' -f $RegistryId.TrimEnd('/'), $Pool }
|    '{0}?api-version={1}' -f $id, (Get-SIBuildPoolSettings).Api
|}
|
|function ConvertTo-SIBuildPoolState {
|    <# PURE. What a pool (as ARM returns it) reads: @{ Tier; Count; State; Subnet; Os; Location } (Count -1 = not readable). #>
|    param($Pool)
|    $cnt = -1; $c = Get-SIBuildPoolProp $Pool @('properties', 'count')
|    if ($null -ne $c -and "$c" -match '^\d+$') { $cnt = [int]"$c" }
|    [pscustomobject]@{
|        Tier     = [string](Get-SIBuildPoolProp $Pool @('properties', 'tier'))
|        Count    = $cnt
|        State    = [string](Get-SIBuildPoolProp $Pool @('properties', 'provisioningState'))
|        Subnet   = [string](Get-SIBuildPoolProp $Pool @('properties', 'virtualNetworkSubnetResourceId'))
|        Os       = [string](Get-SIBuildPoolProp $Pool @('properties', 'os'))
|        Location = [string](Get-SIBuildPoolProp $Pool @('location'))
|    }
|}
|
|function Set-SIBuildPoolCount {
|    <#
|        Scales the agent pool -PoolId to -Count agents (PATCH properties.count), then READS IT BACK until Azure reads it
|        Succeeded with exactly that count, Failed / Canceled, or -LimitMinutes pass (the clock is -Now, so tests do not wait).
|        Never throws. Returns @{ Ok; Count; Tier; State; TimedOut; Line }.
|    #>
|    param([scriptblock]$Arm, [scriptblock]$Rest, [Parameter(Mandatory)][string]$PoolId, [Parameter(Mandatory)][int]$Count,
|          [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s }, [scriptblock]$Now = { [datetime]::UtcNow },
|          [int]$LimitMinutes = (Get-SIBuildPoolSettings).WaitMinutes, [int]$PauseSeconds = (Get-SIBuildPoolSettings).PauseSeconds)
|    $name = ($PoolId.TrimEnd('/') -split '/')[-1]
|    $path = Get-SIBuildPoolPath -PoolId $PoolId
|    try { $null = Invoke-SIBuildPoolCall -Arm $Arm -Rest $Rest -Method 'PATCH' -Path $path -Body ([ordered]@{ properties = [ordered]@{ count = $Count } }) }
|    catch { return @{ Ok = $false; Count = -1; Tier = ''; State = ''; TimedOut = $false; Line = ('the build pool {0} could not be set to {1} agent(s): Azure refused the change ({2})' -f $name, $Count, $_.Exception.Message) } }
|    $start = [datetime](& $Now); $deadline = $start.AddMinutes($LimitMinutes)
|    $st = $null; $timedOut = $false; $missing = $false
|    while ($true) {
|        $p = $null; $readOk = $true
|        try { $p = Invoke-SIBuildPoolCall -Arm $Arm -Rest $Rest -Method 'GET' -Path $path } catch { $p = $null; $readOk = $false }
|        $st = ConvertTo-SIBuildPoolState $p
|        # Azure answers "not found": there is no such pool -- never a wait for one
|        if ($readOk -and -not $p) { $missing = $true; break }
|        if ($p -and $st.State -eq 'Succeeded' -and $st.Count -eq $Count) { break }
|        if ($p -and $st.State -in 'Failed', 'Canceled') { break }
|        if ([datetime](& $Now) -ge $deadline) { $timedOut = $true; break }
|        & $Sleep $PauseSeconds
|    }
|    $ok = ($st.State -eq 'Succeeded' -and $st.Count -eq $Count)
|    $line = if ($ok) { 'the build pool {0} reads {1} agent(s) (tier {2}; read back)' -f $name, $Count, $st.Tier }
|            elseif ($missing) { 'the build pool {0} does not exist in the registry' -f $name }
|            elseif ($timedOut) { 'the build pool {0} does not read back {1} agent(s) after {2} min (Azure shows: {3}, {4} agent(s))' -f $name, $Count, $LimitMinutes, $(if ($st.State) { $st.State } else { 'not readable' }), $(if ($st.Count -ge 0) { $st.Count } else { '?' }) }
|            else { 'Azure did not set the build pool {0} to {1} agent(s) (Azure shows: {2}, {3} agent(s))' -f $name, $Count, $st.State, $(if ($st.Count -ge 0) { $st.Count } else { '?' }) }
|    @{ Ok = [bool]$ok; Count = $st.Count; Tier = $st.Tier; State = $st.State; TimedOut = [bool]$timedOut; Line = $line }
|}
|
|# ---- the session ------------------------------------------------------------------------------------------------------
|function Get-SIBuildPoolSession { <# The open session of this process ($null = none). #> $global:SI_BuildPoolSession }
|
|function Open-SIBuildPoolSession {
|    <# Opens (or joins) the build-pool session of this process. Returns the depth after it (1 = this caller is the outermost). #>
|    $s = $global:SI_BuildPoolSession
|    if (-not ($s -is [hashtable])) {
|        $s = @{ Depth = 0; Touched = $false; Up = $false; PoolId = ''; Arm = $null; Rest = $null; Tier = ''; Line = '' }
|        $global:SI_BuildPoolSession = $s
|    }
|    $s.Depth = [int]$s.Depth + 1
|    $s.Depth
|}
|
|function Request-SIBuildPoolUp {
|    <#
|        THE LAZY SCALE-UP, asked for just before a build is scheduled on pool -Pool of -RegistryId. Without an open session:
|        nothing (Acted = $false). In a session that has the pool up already: nothing. Otherwise the pool is scaled to S2's
|        build count (2) and read back; the session is marked as having touched the pool BEFORE the change, so its close
|        always brings it back to 0 -- also when the scale-up fails. Never throws: @{ Ok; Acted; Line }.
|    #>
|    param([scriptblock]$Arm, [scriptblock]$Rest, [Parameter(Mandatory)][string]$RegistryId, [Parameter(Mandatory)][string]$Pool,
|          [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s }, [scriptblock]$Now = { [datetime]::UtcNow })
|    $s = $global:SI_BuildPoolSession
|    if (-not ($s -is [hashtable]) -or [int]$s.Depth -lt 1) { return @{ Ok = $true; Acted = $false; Line = '' } }
|    $poolId = '{0}/agentPools/{1}' -f $RegistryId.TrimEnd('/'), $Pool
|    if ($s.Up -and [string]::Equals([string]$s.PoolId, $poolId, [StringComparison]::OrdinalIgnoreCase)) { return @{ Ok = $true; Acted = $false; Line = '' } }
|    $cfg = Get-SIBuildPoolSettings
|    $s.Touched = $true; $s.PoolId = $poolId; $s.Arm = $Arm; $s.Rest = $Rest
|    $r = Set-SIBuildPoolCount -Arm $Arm -Rest $Rest -PoolId $poolId -Count $cfg.BuildCount -Sleep $Sleep -Now $Now
|    $s.Tier = [string]$r.Tier
|    if ($r.Ok) {
|        $s.Up = $true
|        $line = 'the build pool {0} is up for the build: {1} agent(s), tier {2} (read back){3}' -f $Pool, $cfg.BuildCount, $r.Tier, $(if ($r.Tier -and $r.Tier -ne $cfg.Tier) { ('; the update moves it to {0} when no build runs' -f $cfg.Tier) } else { '' })
|        return @{ Ok = $true; Acted = $true; Line = $line }
|    }
|    @{ Ok = $false; Acted = $true; Line = ('the build pool could not be scaled up, so the image cannot be built: {0}' -f $r.Line) }
|}
|
|function Test-SIBuildPoolOldUpdater {
|    <#
|        Is this update run by an updater image from BEFORE rule 11g? Such an image runs the newer release's update script but
|        builds its other images (web app, MCP server, its own image) with ITS OWN older build function, which queues on the
|        pool as it finds it and holds no build-pool session. Seen as: inside an updater run (its Write-UpdLog is visible)
|        with no build-pool session open. Asked BEFORE the update script opens its own session. While such an image runs, the
|        release leaves the pool's tier and size as they are, and keeps the pool up for the rest of the update (Close -KeepUp)
|        -- the updater's next image (its self-update, the last step of the same update) scales it from the next update on.
|    #>
|    [bool]((Get-Command -Name Write-UpdLog -ErrorAction SilentlyContinue) -and -not ($global:SI_BuildPoolSession -is [hashtable]))
|}
|
|function Close-SIBuildPoolSession {
|    <#
|        Leaves the session. Only the OUTERMOST close acts, and only when the session touched the pool: the pool goes back to
|        0 agents, READ BACK. Never throws: @{ Closed (the session ended here); Touched; Ok; Line }. A scale-down that fails is
|        Ok = $false with a plain line (the caller reports it as a failure of its own; the build result stays as it was).
|        -KeepUp (only while an updater image older than rule 11g builds the rest of this update, Test-SIBuildPoolOldUpdater):
|        the pool keeps its build size, said; the next update brings it to 0.
|    #>
|    param([scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s }, [scriptblock]$Now = { [datetime]::UtcNow }, [switch]$KeepUp)
|    $s = $global:SI_BuildPoolSession
|    if (-not ($s -is [hashtable])) { return @{ Closed = $false; Touched = $false; Ok = $true; Line = '' } }
|    $s.Depth = [int]$s.Depth - 1
|    if ($s.Depth -gt 0) { return @{ Closed = $false; Touched = [bool]$s.Touched; Ok = $true; Line = '' } }
|    $global:SI_BuildPoolSession = $null
|    if (-not $s.Touched) { return @{ Closed = $true; Touched = $false; Ok = $true; Line = '' } }
|    $name = ([string]$s.PoolId -split '/')[-1]
|    if ($KeepUp) { return @{ Closed = $true; Touched = $true; Ok = $true; Line = ('the build pool {0} keeps its build size for the rest of this update (this updater image builds without scaling the pool); the next update brings it back to 0' -f $name) } }
|    $r = $null
|    try { $r = Set-SIBuildPoolCount -Arm $s.Arm -Rest $s.Rest -PoolId ([string]$s.PoolId) -Count (Get-SIBuildPoolSettings).IdleCount -Sleep $Sleep -Now $Now }
|    catch { $r = @{ Ok = $false; Line = $_.Exception.Message } }
|    if ($r.Ok) { return @{ Closed = $true; Touched = $true; Ok = $true; Line = ('the build pool {0} is back at 0 agents (read back)' -f $name) } }
|    @{ Closed = $true; Touched = $true; Ok = $false
|       Line = ('the build pool {0} could NOT be scaled back to 0 agents after the build -- it keeps its agents (and their cost) until it is; the next update scales it down: {1}' -f $name, $r.Line) }
|}
|
|function Invoke-SIWithBuildPool {
|    <#
|        Runs -Action inside a build-pool session: whatever it builds scales the pool up first (lazily), and the pool goes back
|        to 0 in a FINALLY -- after a success, a failed build, a timed-out build or a throw. The close's line goes to -Say; a
|        scale-down that fails goes to -OnScaleDownFailed { param($Line) } too. The action's output is returned and its error
|        rethrown: the scale-down never hides the build result.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Action, [scriptblock]$Say = { param($t) Write-Host $t }, [scriptblock]$OnScaleDownFailed,
|          [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s }, [scriptblock]$Now = { [datetime]::UtcNow })
|    $null = Open-SIBuildPoolSession
|    try { & $Action }
|    finally {
|        $c = Close-SIBuildPoolSession -Sleep $Sleep -Now $Now
|        if ($c.Line) { try { & $Say $c.Line } catch { } }
|        if ($c.Touched -and $c.Closed -and -not $c.Ok -and $OnScaleDownFailed) { try { & $OnScaleDownFailed $c.Line } catch { } }
|    }
|}
|
|# ---- the updater's convergence: tier S2, 0 agents between builds --------------------------------------------------------
|function Get-SIAcrActiveRuns {
|    <# The runs of -RegistryId that still go (Queued / Started / Running) among its newest runs. @{ Known; Active } -- Known =
|       $false when the runs could not be read (the caller then changes nothing). Never throws. #>
|    param([scriptblock]$Arm, [scriptblock]$Rest, [Parameter(Mandatory)][string]$RegistryId)
|    $cfg = Get-SIBuildPoolSettings
|    try {
|        $page = Invoke-SIBuildPoolCall -Arm $Arm -Rest $Rest -Method 'GET' -Path ('{0}/runs?api-version={1}&$top={2}' -f $RegistryId.TrimEnd('/'), $cfg.Api, $cfg.RunsRead)
|        $runs = @(if ($page -and $page.PSObject.Properties['value']) { @($page.value) } else { @() }) | Where-Object { $_ }
|        $active = @($runs | Where-Object { $st = [string](Get-SIBuildPoolProp $_ @('properties', 'status')); if (-not $st) { $st = [string](Get-SIBuildPoolProp $_ @('status')) }; @($cfg.ActiveRunStates) -contains $st })
|        @{ Known = $true; Active = $active.Count }
|    } catch { @{ Known = $false; Active = 0 } }
|}
|
|function Invoke-SIBuildPoolConverge {
|    <#
|        THE UPDATER'S STEP (rule 11g point 3): an existing pool reaches the new-install state -- tier S2, 0 agents between
|        builds. Changes NOTHING while a build of this process holds the pool, while any run of the registry goes, when the
|        runs cannot be read, when the pool is not Succeeded or its subnet is not known. A pool of another tier: DELETE, wait
|        until it is gone, PUT it again (tier S2, count 0, the SAME subnet, OS and location), read back. If Azure does not make
|        it again, that is said LOUDLY (Failure): the next update makes it again (the private registry step makes a missing pool
|        in the endpoints subnet). An S2 pool left with agents: back to 0, read back. No pool: nothing (a public install).
|        -WhatIf: the plan only. Never throws: @{ Action (none | skip | scaled | recreated | failed | plan); Ok; Failure; Line }.
|    #>
|    param([scriptblock]$Arm, [scriptblock]$Rest, [Parameter(Mandatory)][string]$RegistryId, [string]$Pool = 'si-vnet-pool',
|          [switch]$WhatIf, [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s }, [scriptblock]$Now = { [datetime]::UtcNow })
|    $cfg = Get-SIBuildPoolSettings
|    $poolId = '{0}/agentPools/{1}' -f $RegistryId.TrimEnd('/'), $Pool
|    $path = Get-SIBuildPoolPath -PoolId $poolId
|    $res = { param($a, $ok, $fail, $line) @{ Action = $a; Ok = [bool]$ok; Failure = [bool]$fail; Line = $line } }
|    $s = $global:SI_BuildPoolSession
|    if ($s -is [hashtable] -and $s.Touched) { return (& $res 'skip' $true $false ('the build pool {0} is in use by a build of this update -- its tier and size are checked by the next update' -f $Pool)) }
|    $p = $null
|    try { $p = Invoke-SIBuildPoolCall -Arm $Arm -Rest $Rest -Method 'GET' -Path $path }
|    catch { return (& $res 'skip' $true $false ('the build pool {0} could not be read ({1}) -- it is left as it is' -f $Pool, $_.Exception.Message)) }
|    if (-not $p) { return (& $res 'none' $true $false '') }
|    $cur = ConvertTo-SIBuildPoolState $p
|    if ($cur.State -ne 'Succeeded') { return (& $res 'skip' $true $false ('the build pool {0} reads {1} -- it is left as it is' -f $Pool, $(if ($cur.State) { $cur.State } else { 'no state' }))) }
|    $needTier = $cur.Tier -ne $cfg.Tier
|    $needCount = $cur.Count -ne $cfg.IdleCount
|    # HOTFIX 2026-11-05 (framework 11g update d3adfdd2, from PIM at a customer the same day): Azure REFUSES to create an agent
|    # pool at count 0 (AgentPoolInvalidCount), and a delete can take longer than one update waits -- the re-make at S2 below
|    # deleted the pool and could not make it again, and a later run read "missing" as "install again" at count 0 (refused
|    # again): no build pool, no image builds. Until the re-make is one intent kept across updates (create at 1 -> Succeeded ->
|    # scale to 0, read back), a pool of another tier KEEPS its tier: it is only scaled to 0 agents between builds. Never a
|    # delete here.
|    if ($needTier) {
|        $tierNote = ' (tier {0} is kept: Azure cannot change a tier in place, and the move to {1} is made by a later update as one step kept across updates)' -f $cur.Tier, $cfg.Tier
|        if (-not $needCount) { return (& $res 'none' $true $false ('the build pool {0}: 0 agents between builds{1}' -f $Pool, $tierNote)) }
|        $runs = Get-SIAcrActiveRuns -Arm $Arm -Rest $Rest -RegistryId $RegistryId
|        if (-not $runs.Known) { return (& $res 'skip' $true $false ('whether a build runs in the registry could not be read -- the build pool {0} (tier {1}, {2} agent(s)) is left as it is; the next update looks again' -f $Pool, $cur.Tier, $cur.Count)) }
|        if ($runs.Active -gt 0) { return (& $res 'skip' $true $false ('{0} build run(s) of the registry still go -- the build pool {1} (tier {2}, {3} agent(s)) is left as it is; the next update looks again' -f $runs.Active, $Pool, $cur.Tier, $cur.Count)) }
|        if ($WhatIf) { return (& $res 'plan' $true $false ('the build pool {0} would go back to 0 agents (it has {1} between builds){2}' -f $Pool, $cur.Count, $tierNote)) }
|        $r = Set-SIBuildPoolCount -Arm $Arm -Rest $Rest -PoolId $poolId -Count $cfg.IdleCount -Sleep $Sleep -Now $Now
|        if ($r.Ok) { return (& $res 'scaled' $true $false ('the build pool {0} had {1} agent(s) between builds: back at 0 (read back){2}' -f $Pool, $cur.Count, $tierNote)) }
|        return (& $res 'failed' $false $true ('the build pool {0} could NOT be scaled back to 0 agents: {1}' -f $Pool, $r.Line))
|    }
|    if (-not $needCount) { return (& $res 'none' $true $false ('the build pool {0}: tier {1}, 0 agents between builds' -f $Pool, $cfg.Tier)) }
|    $runs = Get-SIAcrActiveRuns -Arm $Arm -Rest $Rest -RegistryId $RegistryId
|    if (-not $runs.Known) { return (& $res 'skip' $true $false ('whether a build runs in the registry could not be read -- the build pool {0} (tier {1}, {2} agent(s)) is left as it is; the next update looks again' -f $Pool, $cur.Tier, $cur.Count)) }
|    if ($runs.Active -gt 0) { return (& $res 'skip' $true $false ('{0} build run(s) of the registry still go -- the build pool {1} (tier {2}, {3} agent(s)) is left as it is; the next update looks again' -f $runs.Active, $Pool, $cur.Tier, $cur.Count)) }
|    if (-not $needTier) {
|        if ($WhatIf) { return (& $res 'plan' $true $false ('the build pool {0} would go back to 0 agents (it has {1} between builds)' -f $Pool, $cur.Count)) }
|        $r = Set-SIBuildPoolCount -Arm $Arm -Rest $Rest -PoolId $poolId -Count $cfg.IdleCount -Sleep $Sleep -Now $Now
|        if ($r.Ok) { return (& $res 'scaled' $true $false ('the build pool {0} had {1} agent(s) between builds: back at 0 (read back)' -f $Pool, $cur.Count)) }
|        return (& $res 'failed' $false $true ('the build pool {0} could NOT be scaled back to 0 agents: {1}' -f $Pool, $r.Line))
|    }
|    if (-not $cur.Subnet) { return (& $res 'skip' $true $false ('the build pool {0} is tier {1}; its subnet cannot be read, so it is NOT made again at {2} -- left as it is' -f $Pool, $cur.Tier, $cfg.Tier)) }
|    $os = if ($cur.Os) { $cur.Os } else { 'Linux' }
|    $loc = $cur.Location
|    if (-not $loc) {
|        try { $loc = [string](Get-SIBuildPoolProp (Invoke-SIBuildPoolCall -Arm $Arm -Rest $Rest -Method 'GET' -Path ('{0}?api-version=2023-07-01' -f $RegistryId.TrimEnd('/'))) @('location')) } catch { $loc = '' }
|    }
|    if (-not $loc) { return (& $res 'skip' $true $false ('the build pool {0} is tier {1}; its location cannot be read, so it is NOT made again at {2} -- left as it is' -f $Pool, $cur.Tier, $cfg.Tier)) }
|    if ($WhatIf) { return (& $res 'plan' $true $false ('the build pool {0} would be made again at tier {1} with 0 agents (it is {2}; Azure cannot change the tier in place), in the same subnet' -f $Pool, $cfg.Tier, $cur.Tier)) }
|    # DELETE, then wait until it is gone -- a PUT on a pool Azure still deletes is refused
|    try { $null = Invoke-SIBuildPoolCall -Arm $Arm -Rest $Rest -Method 'DELETE' -Path $path }
|    catch { return (& $res 'skip' $true $false ('the build pool {0} (tier {1}) could not be removed to move it to {2} ({3}) -- it is left as it is' -f $Pool, $cur.Tier, $cfg.Tier, $_.Exception.Message)) }
|    $deadline = ([datetime](& $Now)).AddMinutes($cfg.WaitMinutes)
|    $gone = $false
|    while ($true) {
|        $x = $null; $readOk = $true
|        try { $x = Invoke-SIBuildPoolCall -Arm $Arm -Rest $Rest -Method 'GET' -Path $path } catch { $readOk = $false }
|        if ($readOk -and -not $x) { $gone = $true; break }
|        if ([datetime](& $Now) -ge $deadline) { break }
|        & $Sleep $cfg.PauseSeconds
|    }
|    $body = [ordered]@{ location = $loc; properties = [ordered]@{ count = $cfg.IdleCount; tier = $cfg.Tier; os = $os; virtualNetworkSubnetResourceId = $cur.Subnet } }
|    $why = ''
|    if ($gone) {
|        try { $null = Invoke-SIBuildPoolCall -Arm $Arm -Rest $Rest -Method 'PUT' -Path $path -Body $body } catch { $why = $_.Exception.Message }
|    } else { $why = 'Azure did not finish removing it within {0} min' -f $cfg.WaitMinutes }
|    if (-not $why) {
|        $deadline = ([datetime](& $Now)).AddMinutes($cfg.WaitMinutes)
|        $b = $null
|        while ($true) {
|            try { $b = Invoke-SIBuildPoolCall -Arm $Arm -Rest $Rest -Method 'GET' -Path $path } catch { $b = $null }
|            $bs = ConvertTo-SIBuildPoolState $b
|            if ($b -and $bs.State -in 'Succeeded', 'Failed', 'Canceled') { break }
|            if ([datetime](& $Now) -ge $deadline) { break }
|            & $Sleep $cfg.PauseSeconds
|        }
|        $bs = ConvertTo-SIBuildPoolState $b
|        $same = [string]::Equals($bs.Subnet.TrimEnd('/'), $cur.Subnet.TrimEnd('/'), [StringComparison]::OrdinalIgnoreCase)
|        if ($b -and $bs.State -eq 'Succeeded' -and $bs.Tier -eq $cfg.Tier -and $bs.Count -eq $cfg.IdleCount -and $same) {
|            return (& $res 'recreated' $true $false ('the build pool {0} was tier {1}: made again at tier {2} with 0 agents, in the same subnet (read back)' -f $Pool, $cur.Tier, $cfg.Tier))
|        }
|        $why = 'it reads back {0}, tier {1}, {2} agent(s){3}' -f $(if ($bs.State) { $bs.State } else { 'not there' }), $bs.Tier, $bs.Count, $(if ($b -and -not $same) { ', another subnet' } else { '' })
|    }
|    & $res 'failed' $false $true ('THE BUILD POOL {0} WAS REMOVED TO MOVE IT FROM TIER {1} TO {2}, AND AZURE DID NOT MAKE IT AGAIN ({3}). Image builds of this private install cannot run until it exists; the next update makes it again in the same subnet.' -f $Pool, $cur.Tier, $cfg.Tier, $why)
|}
'@ }
$__siSupportFiles['setup/_shared/SI-FastRoll.ps1'] = @{ Sha256 = 'b618765837fa692cc6acc303bc83c9b3860ddf360d87f4feeb77386f9de007db'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE FAST ROLL (#416, operator 2026-10-06: "release must comedown to 10 min", "we solved the updater
|    yesterday by the changes you made like paralle", "where did those learning go"). The learnings of the machine-local
|    fast deploy (2026-10-05), now in the product, used by every install that builds its own images (operator, same day:
|    "i dont ike that we deiver a image out" -- every install keeps building its images in its OWN registry from the signed
|    source package; nothing prebuilt is delivered):
|
|      (a) TWO-LAYER IMAGES. A Dockerfile whose expensive lines come before the first COPY (the updater image: apt) is
|          split: <repo>-base:<hash> = the same FROM (pinned to its current digest) + those lines, built ONLY when that hash
|          is not in the registry; the per-release image = FROM that base + the COPY lines -- the thin code layer. The hash
|          covers the FROM digest, the base instructions, the newest gallery version of any -MinimumVersion module, and --
|          when the base RUNs anything (apt) -- the ISO week, so OS patches still arrive weekly. A Dockerfile whose first
|          instruction after FROM is a COPY has no base: it is built as it is.
|      (b) THE JOBS SWAP IN PARALLEL. Every job gets the new image by ONE ARM PATCH of properties.template only -- never a PUT
|          (ARM returns secrets without values; a PUT would drop them, see ConvertTo-SIArmJobTrigger in SI-JobFlow.ps1),
|          never one job update after another (~40 s each, 16 jobs = 11 min, measured). All PATCHes go out back to back
|          (ARM answers at once and provisions asynchronously), then ONE job list per poll reads every job back; each job is
|          verified: the image, and that NOTHING else changed (trigger, schedule, secrets, env, resources, identity,
|          registries, tags, volumes).
|      (c) THE WEB APP AND MCP SERVER ARE BUILT ONLY WHEN THEIR SOURCES CHANGED. Their image tag is a hash of exactly what
|          their Dockerfile copies (BUILD.json left out), so an app that already runs that tag is left alone. Every build of
|          a release is QUEUED together and waited for together.
|
|    #521 NO az CLI: every call is ARM / registry REST through ONE seam, -Rest { param([string]$Method, [string]$Uri, $Body,
|    [string]$Resource, [hashtable]$Headers) } -> @{ Status; Body } (setup/_shared/SI-UpdateRest.ps1). An image build is the
|    registry's own build over ARM (setup/_shared/SI-AcrBuild.ps1, ported from PIM4EntraPS). A caller that passes no -Rest
|    gets SecurityInsight's own sign-in (Get-SIUpdateRestSeam). An updater image from before #521 still passes -Az to the
|    build functions: it is accepted and IGNORED (the release builds over REST itself), so that image can still roll this
|    release and, last, itself onto an image without the Azure CLI. The decisions are tested offline against a fake REST.
|    PowerShell 5.1-compatible: the VM sync hook runs Invoke-SIContainerUpdate.ps1 on Windows PowerShell; the updater
|    container runs pwsh 7.
|#>
|
|if (-not (Get-Command -Name Invoke-SIAcrQueueBuild -ErrorAction SilentlyContinue)) { . ([IO.Path]::Combine($PSScriptRoot, 'SI-AcrBuild.ps1')) }
|
|# ONE api-version for the read AND the PATCH (live 2026-10-06, ring 1, first fast roll: all 16 PATCHes at 2024-03-01 were
|# refused 400 "Unknown properties imageType in ContainerAppContainer are not supported" -- the template had been read by
|# the CLI's job list, which read with its own newer api-version (2025-07-01 on azure-cli 2.85) and returned imageType; the
|# round trip sent it back to an api-version that does not know it). The roll reads the jobs itself with this api-version,
|# so a template always goes back in the schema it came out in.
|$script:SIFastRollArmApi = '2025-07-01'
|
|function Get-SISha256Hex {
|    <# PURE. SHA-256 of a UTF-8 string, lower-case hex (5.1: no [Convert]::ToHexString / SHA256.HashData). #>
|    param([AllowEmptyString()][string]$Text)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $b = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes([string]$Text)) } finally { $sha.Dispose() }
|    ([BitConverter]::ToString($b) -replace '-', '').ToLowerInvariant()
|}
|
|function Split-SIDockerfile {
|    <#
|        PURE. A single-stage Dockerfile's text -> @{ From; Base (instructions before the first COPY/ADD); App (the rest) }.
|        Anything the split cannot map safely (a parser directive, several FROM lines, FROM with options, COPY --from, an
|        instruction before the first COPY that is not RUN/ENV/ARG/SHELL/LABEL/USER/WORKDIR) THROWS -- the caller then builds
|        the Dockerfile as it is, never a guessed split.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text)
|    $instr = New-Object System.Collections.Generic.List[object]
|    $buf = New-Object System.Collections.Generic.List[string]
|    $n = 0
|    foreach ($l in ($Text -split "`r?`n")) {
|        $n++
|        if ($n -le 3 -and $buf.Count -eq 0 -and $instr.Count -eq 0 -and $l -match '^\s*#\s*(syntax|escape|check)\s*=') { throw ("parser directive '{0}' -- not split" -f $l.Trim()) }
|        if ($l.Trim() -eq '' -or $l.TrimStart().StartsWith('#')) { continue }
|        $buf.Add($l.TrimEnd())
|        if ($l.TrimEnd().EndsWith('\')) { continue }
|        $t = $buf -join "`n"; $buf.Clear()
|        $instr.Add([pscustomobject]@{ Keyword = ($t.TrimStart() -split '\s+', 2)[0].ToUpperInvariant(); Text = $t })
|    }
|    if ($buf.Count) { throw 'the file ends inside a continued instruction' }
|    if (-not $instr.Count -or $instr[0].Keyword -ne 'FROM') { throw 'the first instruction is not FROM' }
|    if (@($instr | Where-Object { $_.Keyword -eq 'FROM' }).Count -ne 1) { throw 'several FROM lines (multi-stage) -- not split' }
|    $fromParts = @($instr[0].Text.Trim() -split '\s+')
|    if ($fromParts.Count -ne 2) { throw ("FROM with options or an alias ('{0}') -- not split" -f $instr[0].Text.Trim()) }
|    $first = -1
|    for ($i = 1; $i -lt $instr.Count; $i++) { if ($instr[$i].Keyword -in 'COPY', 'ADD') { $first = $i; break } }
|    if ($first -lt 0) { throw 'no COPY -- nothing to split' }
|    # 1..0 counts DOWN in PowerShell: a COPY right after FROM is an EMPTY base
|    $base = if ($first -gt 1) { @($instr[1..($first - 1)]) } else { @() }
|    $app = @($instr[$first..($instr.Count - 1)])
|    foreach ($x in $base) { if ($x.Keyword -notin 'RUN', 'ENV', 'ARG', 'SHELL', 'LABEL', 'USER', 'WORKDIR') { throw ("'{0}' before the first COPY -- not split" -f $x.Keyword) } }
|    foreach ($x in $app) { if ($x.Keyword -eq 'COPY' -and $x.Text -match '--from') { throw 'COPY --from -- not split' } }
|    [pscustomobject]@{ From = $fromParts[1]; Base = $base; App = $app }
|}
|
|function Get-SIRegistryImageDigest {
|    <# The registry's current manifest digest of <registry>/<repo>:<tag> (anonymous HEAD -- mcr.microsoft.com); '' when it cannot be read. Never throws. #>
|    param([Parameter(Mandatory)][string]$Ref, [int]$TimeoutSec = 20)
|    if ($Ref -notmatch '^(?<reg>[^/]+\.[^/]+)/(?<repo>[^:@]+):(?<tag>[^@]+)$') { return '' }
|    try {
|        $r = Invoke-WebRequest -Method Head -UseBasicParsing -TimeoutSec $TimeoutSec -Uri ('https://{0}/v2/{1}/manifests/{2}' -f $Matches.reg, $Matches.repo, $Matches.tag) `
|            -Headers @{ Accept = 'application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.v2+json, application/vnd.oci.image.manifest.v1+json' }
|        $d = $r.Headers['Docker-Content-Digest']
|        if ($d -is [array]) { $d = $d[0] }
|        "$d".Trim()
|    } catch { '' }
|}
|
|function Get-SIIsoWeek {
|    <# PURE. 'yyyy-Www' of a date (ISO 8601 week) -- the weekly refresh of a base that installs OS packages. #>
|    param([datetime]$Date = [datetime]::UtcNow)
|    $cal = [Globalization.CultureInfo]::InvariantCulture.Calendar
|    $d = $Date.Date
|    # ISO: the week of the Thursday of this week
|    $dow = [int]$d.DayOfWeek; if ($dow -eq 0) { $dow = 7 }
|    $thu = $d.AddDays(4 - $dow)
|    '{0}-W{1:00}' -f $thu.Year, $cal.GetWeekOfYear($thu, [Globalization.CalendarWeekRule]::FirstFourDayWeek, [DayOfWeek]::Monday)
|}
|
|function New-SIImageLayerPlan {
|    <#
|        PURE. The two-layer plan of one Dockerfile's text. -FromDigest: the FROM image's current digest ('' = unknown: the
|        hash covers the tag only). -Floating: 'Module=version' strings (the newest gallery version of every -MinimumVersion
|        module). -Week: Get-SIIsoWeek (part of the hash only when the base RUNs something).
|        Returns @{ HasBase; BaseRepo; BaseTag; BaseImage (repo:tag); BaseDockerfile; AppDockerfile (FROM <login>/<base>);
|        Reason }. HasBase = $false -> build the original Dockerfile as it is (no base lines, or the split refused).
|    #>
|    param([Parameter(Mandatory)][string]$DockerfileText, [Parameter(Mandatory)][string]$BaseRepo, [Parameter(Mandatory)][string]$LoginServer,
|          [AllowEmptyString()][string]$FromDigest = '', [string[]]$Floating = @(), [string]$Week = '')
|    $none = { param($why) [pscustomobject]@{ HasBase = $false; BaseRepo = $BaseRepo; BaseTag = ''; BaseImage = ''; BaseDockerfile = ''; AppDockerfile = ''; Reason = $why } }
|    try { $s = Split-SIDockerfile -Text $DockerfileText } catch { return (& $none ("built as it is: {0}" -f $_.Exception.Message)) }
|    if (-not @($s.Base).Count) { return (& $none 'built as it is: no instruction before the first COPY (nothing to cache)') }
|    # a FROM PINNED to a digest in the release's Dockerfile (image:tag@sha256:...) is built exactly as pinned: the pin is the
|    # digest -- a live digest read for the tag never replaces it (and is never appended to it)
|    if ($s.From -match '@sha256:[0-9a-fA-F]{64}$') { $FromDigest = '' }
|    $baseText = (@($s.Base | ForEach-Object { $_.Text }) -join "`n")
|    $runs = [bool](@($s.Base | Where-Object { $_.Keyword -eq 'RUN' }).Count)
|    $hashIn = "FROM $($s.From)@$FromDigest`n$baseText`n" + (@($Floating) -join "`n") + $(if ($runs -and $Week) { "`nweek=$Week" } else { '' })
|    $tag = (Get-SISha256Hex -Text $hashIn).Substring(0, 16)
|    $from = if ($FromDigest) { 'FROM {0}@{1}' -f $s.From, $FromDigest } else { 'FROM {0}' -f $s.From }
|    $hdr = '# GENERATED from the release''s Dockerfile by setup/_shared/SI-FastRoll.ps1 -- do not edit'
|    [pscustomobject]@{
|        HasBase = $true; BaseRepo = $BaseRepo; BaseTag = $tag; BaseImage = ('{0}:{1}' -f $BaseRepo, $tag)
|        BaseDockerfile = ((@($hdr, $from) + @($s.Base | ForEach-Object { $_.Text })) -join "`n") + "`n"
|        AppDockerfile  = ((@($hdr, ('FROM {0}/{1}:{2}' -f $LoginServer, $BaseRepo, $tag)) + @($s.App | ForEach-Object { $_.Text })) -join "`n") + "`n"
|        Reason = ('base {0}:{1} (FROM {2}{3})' -f $BaseRepo, $tag, $s.From, $(if ($FromDigest) { '@' + $FromDigest.Substring(0, [Math]::Min(19, $FromDigest.Length)) } elseif ($s.From -match '@sha256:') { ', pinned' } else { ', digest unknown' }))
|    }
|}
|
|function Get-SIImageLayerPlan {
|    <# New-SIImageLayerPlan for a Dockerfile on disk, with the FROM digest and the floating module versions read live. Never throws. #>
|    param([Parameter(Mandatory)][string]$DockerfilePath, [Parameter(Mandatory)][string]$BaseRepo, [Parameter(Mandatory)][string]$LoginServer)
|    $text = [IO.File]::ReadAllText($DockerfilePath)
|    $digest = ''; $floating = @()
|    try {
|        $s = Split-SIDockerfile -Text $text
|        if (@($s.Base).Count) {
|            $digest = Get-SIRegistryImageDigest -Ref $s.From
|            $bt = (@($s.Base | ForEach-Object { $_.Text }) -join "`n")
|            foreach ($m in [regex]::Matches($bt, '-Name\s+(?<n>[A-Za-z0-9_.-]+)\s+-MinimumVersion\s+(?<v>[0-9.]+)')) {
|                $latest = ''
|                try { $latest = [string]@(Invoke-RestMethod -TimeoutSec 20 -Uri ("https://www.powershellgallery.com/api/v2/FindPackagesById()?id='{0}'&`$filter=IsLatestVersion" -f $m.Groups['n'].Value))[0].properties.Version } catch { }
|                $floating += ('{0}={1}' -f $m.Groups['n'].Value, $latest)
|            }
|        }
|    } catch { }
|    New-SIImageLayerPlan -DockerfileText $text -BaseRepo $BaseRepo -LoginServer $LoginServer -FromDigest $digest -Floating $floating -Week (Get-SIIsoWeek)
|}
|
|# ---- (c) a tag per SOURCE, so an image whose sources did not change is never rebuilt (the Pro web app / MCP server:
|#      container/updater/_shared/SI-UpdaterWebApp.ps1 names their sources) -------------------------------------------------
|function Get-SISourceHash {
|    <#
|        A stable hash of the files under -Paths (relative to -Root): relative path + SHA-256 per file, sorted ordinally.
|        Left out: bin/ obj/ (local builds), customer files (*.custom.*), BUILD.json. '' when none of the paths exists.
|    #>
|    param([Parameter(Mandatory)][string]$Root, [Parameter(Mandatory)][string[]]$Paths)
|    $rootFull = [IO.Path]::GetFullPath($Root).TrimEnd('\', '/')
|    $lines = New-Object System.Collections.Generic.List[string]
|    foreach ($p in $Paths) {
|        $full = [IO.Path]::Combine($rootFull, ($p -replace '/', [IO.Path]::DirectorySeparatorChar))
|        $files = if (Test-Path -LiteralPath $full -PathType Leaf) { @(Get-Item -LiteralPath $full) }
|                 elseif (Test-Path -LiteralPath $full -PathType Container) { @(Get-ChildItem -LiteralPath $full -Recurse -File -Force -ErrorAction SilentlyContinue) }
|                 else { @() }
|        foreach ($f in $files) {
|            $rel = $f.FullName.Substring($rootFull.Length).TrimStart('\', '/') -replace '\\', '/'
|            if ($rel -match '(?i)(^|/)(bin|obj)/' -or ((Split-Path -Leaf $rel) -like '*.custom.*' -and (Split-Path -Leaf $rel) -notlike '*.custom.sample.*') -or (Split-Path -Leaf $rel) -eq 'BUILD.json') { continue }
|            $lines.Add(('{0}|{1}' -f $rel, (Get-FileHash -LiteralPath $f.FullName -Algorithm SHA256).Hash))
|        }
|    }
|    if (-not $lines.Count) { return '' }
|    $arr = @($lines | Sort-Object -Unique); [Array]::Sort($arr, [StringComparer]::Ordinal)
|    Get-SISha256Hex -Text ($arr -join "`n")
|}
|
|# ---- builds: queued together, waited for together (the registry's own build over ARM, setup/_shared/SI-AcrBuild.ps1) -----
|$script:SIAcrDone = @('Succeeded', 'Failed', 'Canceled', 'Cancelled', 'Error', 'Timeout')
|
|function Resolve-SIFastRollRest {
|    <# The seam a build / roll function uses: the caller's -Rest, else SecurityInsight's own sign-in (Get-SIUpdateRestSeam). #>
|    param([scriptblock]$Rest, [string]$SubscriptionId)
|    if ($Rest) { return $Rest }
|    Get-SIUpdateRestSeam -SubscriptionId $SubscriptionId
|}
|
|function Start-SIAcrBuild {
|    <#
|        Queues ONE image build in the registry from the CURRENT directory as the context (packed, .dockerignore applied,
|        uploaded, scheduled -- Invoke-SIAcrQueueBuild) and returns @{ Image; RunId; File; Started; Status = Queued; LogTail }.
|        -File may lie outside the context (a derived Dockerfile in a temp folder): it travels in the archive. The run id
|        comes from the registry's answer, else from the newest run that names the image. Throws when the build cannot be
|        queued. -Az: accepted from an updater image made before #521, and ignored.
|    #>
|    param([scriptblock]$Rest, [scriptblock]$Az, [Parameter(Mandatory)][string]$AcrName, [Parameter(Mandatory)][string]$Image, [Parameter(Mandatory)][string]$File,
|          [string]$SubscriptionId, [string]$ResourceGroup,
|          # the registry's own limit for the build task: above every wait (Wait-SIAcrBuilds -TimeoutMinutes, 90 in an update),
|          # so the wait decides and a slow private agent pool is not cut by the registry first
|          [int]$TimeoutSeconds = 6000)
|    if (-not $SubscriptionId) { $SubscriptionId = Get-SIUpdateRestSubscription }
|    $Rest = Resolve-SIFastRollRest -Rest $Rest -SubscriptionId $SubscriptionId
|    $q = Invoke-SIAcrQueueBuild -Rest $Rest -SubscriptionId $SubscriptionId -AcrName $AcrName -ResourceGroup $ResourceGroup -ContextPath ((Get-Location).ProviderPath) -Image $Image -DockerfilePath $File -TimeoutSeconds $TimeoutSeconds
|    $runId = [string]$q.RunId
|    if (-not $runId) { $runId = Find-SIAcrRunId -Rest $Rest -Registry $q.Registry -Image $Image }
|    [pscustomobject]@{ Image = $Image; RunId = $runId; File = $File; Started = [datetime]::UtcNow; Status = 'Queued'; LogTail = @() }
|}
|
|function Wait-SIAcrBuilds {
|    <#
|        Waits for every queued build (-Builds from Start-SIAcrBuild) together: GET runs/<id> per build per poll ('Queued',
|        'Started', 'Running' = still going). Returns the builds with Status set. A build that ends in anything but Succeeded
|        gets its log's tail (LogTail), and -Log prints it. Never throws -- the caller decides per image. -Az: ignored (see
|        Start-SIAcrBuild).
|    #>
|    param([scriptblock]$Rest, [scriptblock]$Az, [Parameter(Mandatory)][string]$AcrName, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Builds,
|          [int]$TimeoutMinutes = 30, [int]$PollSeconds = 15, [scriptblock]$Log, [string]$SubscriptionId, [string]$ResourceGroup)
|    if (-not $SubscriptionId) { $SubscriptionId = Get-SIUpdateRestSubscription }
|    $reg = $null
|    try { $Rest = Resolve-SIFastRollRest -Rest $Rest -SubscriptionId $SubscriptionId; $reg = Get-SIAcrRegistry -Rest $Rest -SubscriptionId $SubscriptionId -AcrName $AcrName -ResourceGroup $ResourceGroup }
|    catch { if ($Log) { & $Log ("the registry {0} could not be read ({1}) -- the builds are not known" -f $AcrName, $_.Exception.Message) }; foreach ($b in @($Builds | Where-Object { $_.Status -notin $script:SIAcrDone })) { $b.Status = 'Error' }; return $Builds }
|    $deadline = [datetime]::UtcNow.AddMinutes($TimeoutMinutes)
|    while ($true) {
|        foreach ($b in @($Builds | Where-Object { $_.Status -notin $script:SIAcrDone })) {
|            if (-not $b.RunId) {
|                $b.RunId = Find-SIAcrRunId -Rest $Rest -Registry $reg -Image $b.Image
|                if (-not $b.RunId) { continue }
|            }
|            $s = Get-SIAcrRunStatus -Rest $Rest -Registry $reg -RunId $b.RunId
|            if ($s) { $b.Status = $s }
|            if ($b.Status -in $script:SIAcrDone) {
|                if ($Log) { & $Log ("build {0}: {1} after {2:N0}s" -f $b.Image, $b.Status, ([datetime]::UtcNow - $b.Started).TotalSeconds) }
|                if ($b.Status -ne 'Succeeded') {
|                    $tail = @(Get-SIAcrRunLogTail -Rest $Rest -Registry $reg -RunId $b.RunId)
|                    Add-Member -InputObject $b -NotePropertyName LogTail -NotePropertyValue $tail -Force
|                    if ($Log -and $tail.Count) { & $Log ("the build log of {0} (run {1}) ends:" -f $b.Image, $b.RunId); foreach ($l in $tail) { & $Log ('  | ' + $l) } }
|                }
|            }
|        }
|        if (-not @($Builds | Where-Object { $_.Status -notin $script:SIAcrDone }).Count) { break }
|        if ([datetime]::UtcNow -ge $deadline) {
|            foreach ($b in @($Builds | Where-Object { $_.Status -notin $script:SIAcrDone })) { $b.Status = 'Timeout' }
|            break
|        }
|        if ($PollSeconds -gt 0) { Start-Sleep -Seconds $PollSeconds }
|    }
|    $Builds
|}
|
|function Test-SIAcrTag {
|    <#
|        Is repo:tag in the registry? The registry's own data plane (Test-SIAcrManifest: HEAD of the manifest with a pull
|        token). Never throws ($false on any error -- the image is then built). -Az: ignored (see Start-SIAcrBuild).
|    #>
|    param([scriptblock]$Rest, [scriptblock]$Az, [Parameter(Mandatory)][string]$AcrName, [Parameter(Mandatory)][string]$Repo, [Parameter(Mandatory)][string]$Tag,
|          [string]$SubscriptionId, [string]$ResourceGroup, [string]$LoginServer, [scriptblock]$Token)
|    try {
|        if (-not $SubscriptionId) { $SubscriptionId = Get-SIUpdateRestSubscription }
|        $Rest = Resolve-SIFastRollRest -Rest $Rest -SubscriptionId $SubscriptionId
|        if (-not $LoginServer) { $LoginServer = (Get-SIAcrRegistry -Rest $Rest -SubscriptionId $SubscriptionId -AcrName $AcrName -ResourceGroup $ResourceGroup).LoginServer }
|        [bool](Test-SIAcrManifest -Rest $Rest -LoginServer $LoginServer -Repo $Repo -Tag $Tag -Token $Token)
|    } catch { $false }
|}
|
|# ---- (b) the jobs: one ARM PATCH of properties.template each, all at once, verified ---------------------------------
|function Get-SIJobFingerprint {
|    <# PURE. What an image swap must NOT change on a Container Apps job (ARM shape), as comparable strings. #>
|    param([Parameter(Mandatory)]$Job)
|    $c = $Job.properties.configuration; $t = $Job.properties.template
|    $tags = @(); if ($Job.tags) { $tags = @($Job.tags.PSObject.Properties | Sort-Object Name | ForEach-Object { '{0}={1}' -f $_.Name, $_.Value }) }
|    $js = { param($o) if ($null -eq $o) { '' } else { ConvertTo-Json -InputObject $o -Depth 20 -Compress } }
|    [ordered]@{
|        Trigger    = [string]$c.triggerType
|        Schedule   = (& $js $c.scheduleTriggerConfig)
|        Manual     = (& $js $c.manualTriggerConfig)
|        Event      = (& $js $c.eventTriggerConfig)
|        Timeout    = [string]$c.replicaTimeout
|        Retry      = [string]$c.replicaRetryLimit
|        Secrets    = (@(@($c.secrets) | Where-Object { $_ } | ForEach-Object { '{0}|{1}|{2}' -f $_.name, $_.keyVaultUrl, $_.identity }) | Sort-Object) -join ';'
|        Registries = (& $js $c.registries)
|        Identity   = $(if ($Job.identity -and $Job.identity.userAssignedIdentities) { (@($Job.identity.userAssignedIdentities.PSObject.Properties | ForEach-Object { $_.Name }) | Sort-Object) -join ';' } else { '' })
|        Tags       = ($tags -join ';')
|        Env        = (@(@($t.containers) | Where-Object { $_ } | ForEach-Object { $cn = $_.name; @(@($_.env) | Where-Object { $_ } | ForEach-Object { '{0}/{1}={2}{3}' -f $cn, $_.name, $_.value, $(if ($_.secretRef) { ' secretref:' + $_.secretRef } else { '' }) }) }) | Sort-Object) -join "`n"
|        Command    = (@(@($t.containers) | Where-Object { $_ } | ForEach-Object { '{0}: {1} | {2}' -f $_.name, (@($_.command) -join ' '), (@($_.args) -join ' ') })) -join ';'
|        Resources  = (@(@($t.containers) | Where-Object { $_ } | ForEach-Object { '{0}: {1}/{2}' -f $_.name, $_.resources.cpu, $_.resources.memory })) -join ';'
|        Volumes    = (& $js $t.volumes)
|        Init       = (@(@($t.initContainers) | Where-Object { $_ } | ForEach-Object { '{0}={1}' -f $_.name, $_.image })) -join ';'
|    }
|}
|
|function Compare-SIJobFingerprint {
|    <# PURE. The names of the fingerprint parts that differ (empty = nothing but the image changed). #>
|    param([Parameter(Mandatory)]$Before, [Parameter(Mandatory)]$After)
|    @($Before.Keys | Where-Object { [string]$Before[$_] -cne [string]$After[$_] })
|}
|
|function New-SIJobImagePatchBody {
|    <#
|        PURE. The ARM PATCH body that swaps a job's image: { properties: { template } } -- the job's OWN template (as read),
|        with the image of every container that runs -RepoPrefix (e.g. <login>/si-orchestrator:) set to -Image. NEVER the
|        configuration (secrets come back from ARM without values; sending them would drop them). Read-only fields removed.
|        Returns the JSON text.
|    #>
|    param([Parameter(Mandatory)]$Job, [Parameter(Mandatory)][string]$Image, [string]$RepoPrefix = '')
|    $tpl = ConvertTo-Json -InputObject $Job.properties.template -Depth 60 | ConvertFrom-Json
|    foreach ($c in @($tpl.containers)) {
|        if (-not $c) { continue }
|        if (-not $RepoPrefix -or ([string]$c.image).ToLowerInvariant().StartsWith($RepoPrefix.ToLowerInvariant())) { $c.image = $Image }
|        if ($c.resources -and $c.resources.PSObject.Properties['ephemeralStorage']) { $c.resources.PSObject.Properties.Remove('ephemeralStorage') }
|    }
|    # imageType = ContainerImage is the default and is unknown to older api-versions (the live 400 of 2026-10-06): never sent
|    foreach ($c in (@($tpl.containers) + @($tpl.initContainers))) {
|        if ($c -and $c.PSObject.Properties['imageType'] -and ([string]$c.imageType -in '', 'ContainerImage')) { $c.PSObject.Properties.Remove('imageType') }
|    }
|    ConvertTo-Json -InputObject ([ordered]@{ properties = [ordered]@{ template = $tpl } }) -Depth 60 -Compress
|}
|
|function Test-SIArmRetryable {
|    <# PURE. An ARM answer that means "try again shortly" (another operation on the job, throttling). #>
|    param([AllowEmptyString()][string]$Message)
|    if ("$Message" -match '(?i)OperationInProgress|active provisioning operation|Conflict|\b409\b|\b429\b|TooManyRequests') { return $true }
|    # SUP-2026-00198 (customer D 2026-10-19): Azure checks the new image against the registry while it takes the
|    # PATCH, and a registry that does not answer at that moment is a 400 -- a TRANSIENT one, sent again like a 409
|    Test-SIArmRegistryTransient -Message $Message
|}
|
|function Test-SIArmRegistryTransient {
|    <#
|        PURE. SUP-2026-00198 (customer D, ring 2, 2026-10-19 14:09Z): Container Apps checks a job's new image against
|        its registry while it takes the PATCH. When the registry does not answer at that moment, ARM refuses the PATCH with
|        400 InvalidParameterValueInContainerTemplate "Field 'template.containers.<job>.image' is invalid ... Get
|        "https://<acr>/v2/": dial tcp <ip>:443: connect: connection refused" -- 2 of 22 PATCHes there, the 20 around them
|        accepted. That is the registry's network, not the image: the same PATCH is accepted a few seconds later. $true ONLY
|        for that shape (an image field refused AND a network failure reaching the registry); an image that does not exist
|        (MANIFEST_UNKNOWN / NAME_UNKNOWN / not found) or a registry that refuses the identity (401 / 403 / UNAUTHORIZED)
|        is not transient and is never sent again.
|    #>
|    param([AllowEmptyString()][string]$Message)
|    $t = "$Message"
|    if ($t -notmatch '(?i)InvalidParameterValueInContainerTemplate|InvalidContainerImage|\.image''? is invalid') { return $false }
|    if ($t -match '(?i)MANIFEST_UNKNOWN|manifest unknown|NAME_UNKNOWN|\bnot found\b|UNAUTHORIZED|DENIED|\b401\b|\b403\b|authentication required') { return $false }
|    [bool]($t -match '(?i)connection refused|connection reset|i/o timeout|TLS handshake timeout|no such host|context deadline exceeded|Client\.Timeout|network is unreachable|temporary failure|unexpected EOF|\b50[234]\b|Service Unavailable|Bad Gateway|Gateway Time-?out')
|}
|
|# SUP-2026-00198: the error catalogue's codes for the update's roll and restore (data-model/errors.locked.json) -- a failed
|# update is reported to Invardia with one of these, never as 'unknown'
|$script:SIUpdateErrorCodes = @{
|    RollRejected  = 'si-upd-0803'   # Azure refused a job's image PATCH (the 400 InvalidParameterValueInContainerTemplate)
|    RestoreFailed = 'si-upd-0804'   # a job could not be put back on its previous image after a failed update
|    RollNotVerified = 'si-upd-0805' # a job took the PATCH but does not read back the new image alone (or never finished)
|}
|function Get-SIUpdateErrorCodes { $script:SIUpdateErrorCodes }
|
|function Get-SIRollFailureCode {
|    <# PURE. The catalogue code of one failed roll / restore result (Invoke-SIJobImageRoll): -Restore = si-upd-0804; else a
|       PATCH Azure refused (Sent $false) = si-upd-0803, one it took that did not verify = si-upd-0805. '' for a result that is Ok. #>
|    param([Parameter(Mandatory)]$Result, [switch]$Restore)
|    if ($Result.Ok) { return '' }
|    if ($Restore) { return $script:SIUpdateErrorCodes.RestoreFailed }
|    if (-not $Result.Sent) { return $script:SIUpdateErrorCodes.RollRejected }
|    $script:SIUpdateErrorCodes.RollNotVerified
|}
|
|function Get-SIArmJobList {
|    <#
|        Every Container Apps job of -ResourceGroup, read by ONE ARM list at $script:SIFastRollArmApi -- the api-version the
|        PATCH is sent with (a template read in a newer schema is refused by an older one). Follows nextLink. Throws when the
|        read fails.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup)
|    $url = Get-SIArmUri -Path ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs' -f $SubscriptionId, $ResourceGroup) -ApiVersion $script:SIFastRollArmApi
|    @(Get-SIRestList -Rest $Rest -Uri $url -What ('the Container Apps jobs of {0}' -f $ResourceGroup) | Where-Object { $_ -and $_.PSObject.Properties['name'] })
|}
|
|function Invoke-SIJobImageRoll {
|    <#
|        THE PARALLEL SWAP. -Targets: @{ Name; Image } (the image each job must run). The jobs are read ONCE with
|        Get-SIArmJobList (the PATCH's own api-version) -- the template each PATCH carries and the fingerprint before;
|        -Jobs (ARM shape) is used only when that read fails. One ARM PATCH per job, sent back to back in this one process
|        (409 / throttled = sent again in the next pass, max -MaxPasses), then ONE job list per poll (Get-SIArmJobList)
|        until every target has finished provisioning. Each job is then verified: it runs its image and nothing else changed.
|        Returns one @{ Name; Ok; Sent; Image; Changed; Error } per target. Never throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Targets, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Jobs,
|          [string]$RepoPrefix = '', [int]$MaxPasses = 18, [int]$RetrySeconds = 10, [int]$TimeoutMinutes = 8, [int]$PollSeconds = 5, [scriptblock]$Log)
|    $armJobs = $null
|    try { $armJobs = @(Get-SIArmJobList -Rest $Rest -SubscriptionId $SubscriptionId -ResourceGroup $ResourceGroup) }
|    catch { if ($Log) { & $Log ("the jobs could not be read at api-version {0} ({1}) -- using the job list read before" -f $script:SIFastRollArmApi, $_.Exception.Message) } }
|    if ($null -ne $armJobs -and $armJobs.Count) { $Jobs = $armJobs }
|    $byName = @{}; foreach ($j in $Jobs) { if ($j) { $byName[[string]$j.name] = $j } }
|    $res = @{}
|    foreach ($t in $Targets) { $res[$t.Name] = [pscustomobject]@{ Name = $t.Name; Ok = $false; Sent = $false; Image = ''; Changed = @(); Error = ''; Want = $t.Image; Before = $null } }
|    try {
|        # 1. every PATCH, back to back
|        $pending = @($Targets | ForEach-Object { $_.Name })
|        for ($pass = 1; $pending.Count -and $pass -le $MaxPasses; $pass++) {
|            if ($pass -gt 1) { if ($Log) { & $Log ("{0} job(s) busy with another operation, or their registry did not answer Azure -- sending again in {1}s (pass {2} of {3})" -f $pending.Count, $RetrySeconds, $pass, $MaxPasses) }; if ($RetrySeconds -gt 0) { Start-Sleep -Seconds $RetrySeconds } }
|            $again = New-Object System.Collections.Generic.List[string]
|            foreach ($name in $pending) {
|                $r = $res[$name]; $job = $byName[$name]
|                if (-not $job) { $r.Error = 'the job was not in the job list'; continue }
|                if (-not $r.Before) { $r.Before = Get-SIJobFingerprint -Job $job }
|                $url = Get-SIArmUri -Path ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs/{2}' -f $SubscriptionId, $ResourceGroup, $name) -ApiVersion $script:SIFastRollArmApi
|                $m = ''; $raw = ''
|                try {
|                    $ans = & $Rest 'PATCH' $url (New-SIJobImagePatchBody -Job $job -Image $r.Want -RepoPrefix $RepoPrefix) 'https://management.azure.com/' @{ 'Content-Type' = 'application/json' }
|                    if ([int]$ans.Status -ge 200 -and [int]$ans.Status -lt 300) { $r.Sent = $true; $r.Error = '' } else { $m = Format-SIRestFailure -Response $ans; $raw = "$($ans.Body)" }
|                } catch { $m = $_.Exception.Message }
|                # the whole answer is classified, not the 400-character line (the registry's words come at its end)
|                if ($m) { if (Test-SIArmRetryable -Message ("{0} {1}" -f $m, $raw)) { $again.Add($name) }; $r.Error = $m }
|            }
|            $pending = @($again)
|        }
|        $sent = @($res.Values | Where-Object { $_.Sent })
|        if ($Log) { & $Log ("{0} of {1} job PATCH(es) accepted" -f $sent.Count, @($Targets).Count) }
|        # 2. read every job back with ONE list per poll until each has finished provisioning
|        $deadline = [datetime]::UtcNow.AddMinutes($TimeoutMinutes)
|        $open = @($sent | ForEach-Object { $_.Name })
|        while ($open.Count) {
|            $list = @()
|            try { $list = @(Get-SIArmJobList -Rest $Rest -SubscriptionId $SubscriptionId -ResourceGroup $ResourceGroup); $listErrors = 0 }
|            catch {
|                # a read that keeps failing is reported, never waited out for the whole timeout
|                $listErrors = 1 + $(if ($listErrors) { $listErrors } else { 0 })
|                if ($listErrors -ge 5) { foreach ($n in $open) { $res[$n].Error = ('the jobs could not be read back: {0}' -f $_.Exception.Message) }; break }
|            }
|            $now = @{}; foreach ($j in $list) { if ($j) { $now[[string]$j.name] = $j } }
|            $still = New-Object System.Collections.Generic.List[string]
|            foreach ($name in $open) {
|                $j = $now[$name]; $r = $res[$name]
|                if (-not $j) { $still.Add($name); continue }
|                $state = "$($j.properties.provisioningState)"
|                if ($state -in 'InProgress', 'Updating', 'Creating', 'Pending', 'Accepted') { $still.Add($name); continue }
|                $imgs = @(@($j.properties.template.containers) | Where-Object { $_ } | ForEach-Object { [string]$_.image })
|                $r.Image = (@($imgs | Where-Object { -not $RepoPrefix -or $_.ToLowerInvariant().StartsWith($RepoPrefix.ToLowerInvariant()) }) | Select-Object -First 1)
|                $r.Changed = @(Compare-SIJobFingerprint -Before $r.Before -After (Get-SIJobFingerprint -Job $j))
|                if ($state -eq 'Failed') { $r.Error = 'provisioning failed' }
|                elseif ($r.Image -ne $r.Want) { $r.Error = ("reads back '{0}', expected '{1}'" -f $r.Image, $r.Want) }
|                elseif ($r.Changed.Count) { $r.Error = ('more than the image changed: {0}' -f ($r.Changed -join ', ')) }
|                else { $r.Ok = $true }
|            }
|            $open = @($still)
|            if (-not $open.Count) { break }
|            if ([datetime]::UtcNow -ge $deadline) { foreach ($n in $open) { $res[$n].Error = ('still provisioning after {0} min' -f $TimeoutMinutes) }; break }
|            if ($PollSeconds -gt 0) { Start-Sleep -Seconds $PollSeconds }
|        }
|    } catch {
|        foreach ($r in @($res.Values | Where-Object { -not $_.Ok -and -not $_.Error })) { $r.Error = $_.Exception.Message }
|    }
|    foreach ($t in $Targets) { $r = $res[$t.Name]; [pscustomobject]@{ Name = $r.Name; Ok = $r.Ok; Sent = $r.Sent; Image = $r.Image; Changed = @($r.Changed); Error = $r.Error } }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-UpdateWatch.ps1'] = @{ Sha256 = 'b673c613f6c549e684b0815ad3d0a9238dc0504650b1ff7177a7d5d807c3795b'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- A LONG STEP OF THE UPDATE IS NEVER MISTAKEN FOR A HANG (#911 (e), live 2026-10-27: an update logged
|    "==> 9b. PIPELINE SCHEDULE" and then nothing for an hour; the install looked hung).
|
|    Start-SIUpdateWatch starts ONE background thread (its own runspace -- it never touches the update's variables) that
|    looks every -CheckSeconds at the time of the update's last log line. When no line came for -QuietMinutes (20), it
|    writes one line of its own to the process's standard output -- what the container's log keeps:
|        [<utc>]     still working: <step> (no log line for 20 min)
|    and again every -QuietMinutes while the step goes on. The update tells it each line (Set-SIUpdateWatchLine -Step),
|    and also beats the install's lock at each step (Invoke-SIUpdaterLockBeat, the updater's run gate -- the thread does
|    not touch SQL). Stop-SIUpdateWatch ends the thread. Nothing here throws. PS 5.1 and 7, no module.
|#>
|
|function New-SIUpdateWatchState {
|    <# PURE. The state the update and the watch share (a synchronized table): Step, LastLineUtc, QuietMinutes, Said, Stop. #>
|    param([double]$QuietMinutes = 20, $NowUtc)
|    $now = if ($NowUtc) { ([datetime]$NowUtc).ToUniversalTime() } else { [datetime]::UtcNow }
|    [hashtable]::Synchronized(@{ Step = ''; LastLineUtc = $now; QuietMinutes = [double]$QuietMinutes; Said = 0; Stop = $false })
|}
|
|function Get-SIUpdateWatchLine {
|    <# PURE. The "still working" line due at -NowUtc for -State, or '' (a line came within QuietMinutes, or the watch is
|       stopped). A line said moves LastLineUtc, so it is said again only after another QuietMinutes. #>
|    param([Parameter(Mandatory)][hashtable]$State, [Parameter(Mandatory)][datetime]$NowUtc)
|    if ($State.Stop) { return '' }
|    $quiet = ($NowUtc.ToUniversalTime() - [datetime]$State.LastLineUtc).TotalMinutes
|    if ($quiet -lt [double]$State.QuietMinutes) { return '' }
|    $State.LastLineUtc = $NowUtc.ToUniversalTime(); $State.Said = [int]$State.Said + 1
|    $step = if ("$($State.Step)".Trim()) { "$($State.Step)".Trim() } else { 'the update' }
|    ('[{0:u}]     still working: {1} (no log line for {2:N0} min)' -f $NowUtc.ToUniversalTime(), $step, [Math]::Floor($quiet))
|}
|
|function Set-SIUpdateWatchLine {
|    <# The update wrote a line (-Step: the step it is in now, when it changed). Never throws. #>
|    param([string]$Step, [hashtable]$State = $global:SI_UpdateWatch)
|    if (-not $State) { return }
|    try { $State.LastLineUtc = [datetime]::UtcNow; if ("$Step".Trim()) { $State.Step = "$Step".Trim() } } catch { }
|}
|
|function Start-SIUpdateWatch {
|    <#
|        Starts the watch (one per process: a running one is kept) and returns its state ($global:SI_UpdateWatch). The thread
|        writes to the process's standard output with [Console]::Out (a scriptblock of the update cannot cross runspaces).
|        -NoThread: only the state (tests).
|    #>
|    param([double]$QuietMinutes = 20, [int]$CheckSeconds = 60, [switch]$NoThread)
|    if ($global:SI_UpdateWatch -and $global:SI_UpdateWatchThread) { return $global:SI_UpdateWatch }
|    $st = New-SIUpdateWatchState -QuietMinutes $QuietMinutes
|    $global:SI_UpdateWatch = $st
|    if ($NoThread) { return $st }
|    try {
|        $rs = [runspacefactory]::CreateRunspace(); $rs.Open()
|        $ps = [powershell]::Create(); $ps.Runspace = $rs
|        $null = $ps.AddScript({
|            param($State, $Check, $LineFn)
|            $fn = [scriptblock]::Create($LineFn)
|            while (-not $State.Stop) {
|                for ($i = 0; $i -lt $Check -and -not $State.Stop; $i++) { Start-Sleep -Seconds 1 }
|                if ($State.Stop) { break }
|                try { $l = & $fn $State ([datetime]::UtcNow); if ($l) { [Console]::Out.WriteLine($l); [Console]::Out.Flush() } } catch { }
|            }
|        }).AddArgument($st).AddArgument([Math]::Max(1, $CheckSeconds)).AddArgument(${function:Get-SIUpdateWatchLine}.ToString())
|        $h = $ps.BeginInvoke()
|        $global:SI_UpdateWatchThread = [pscustomobject]@{ PowerShell = $ps; Runspace = $rs; Handle = $h }
|    } catch { $global:SI_UpdateWatchThread = $null }
|    $st
|}
|
|function Stop-SIUpdateWatch {
|    <# Ends the watch's thread. Never throws. #>
|    try { if ($global:SI_UpdateWatch) { $global:SI_UpdateWatch.Stop = $true } } catch { }
|    $t = $global:SI_UpdateWatchThread
|    if ($t) {
|        try { $null = $t.Handle.AsyncWaitHandle.WaitOne(3000) } catch { }
|        try { $t.PowerShell.Stop() } catch { }
|        try { $t.PowerShell.Dispose(); $t.Runspace.Dispose() } catch { }
|    }
|    $global:SI_UpdateWatchThread = $null; $global:SI_UpdateWatch = $null
|}
'@ }
$__siSupportFiles['setup/_shared/SI-NightlySchedule.ps1'] = @{ Sha256 = 'e3ee04446bf4f81b5c5c853076267aaccffd73451a4898ab94ec161b05428590'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE NIGHTLY SCHEDULE (owner 2026-10-21: "i propose that we move the start time for all si jobs to 7pm
|    on all sites" / "so they are done next morning"; before that, 2026-10-15: "we need it to be complete hopefully by 8am
|    next day" / "11pm danish time", then "can we take 11pm local time for region"): on EVERY install,
|      * the UPDATER runs at 18:30, and
|      * the Daily PIPELINE starts after it, at 19:00,
|    in the time zone of THE AZURE REGION the install runs in
|
|    THE 19:00 MOVE (2026-10-21; step 9l of the update, AFTER the region step 9c below). The region step (2026-10-15) put
|    every install on 23:00 / 23:30 in its region's zone; this step moves ONLY those SHIPPED values, ONCE, under its own
|    marker (job tag si-nightly-1900; Pro cfg.InstallState 'NightlySchedule1900'; a folder .si-update\nightly-schedule-1900.json):
|      * the updater's job: the region zone's 23:00 ticks with the tag '23:00 <zone>' -> the zone's 18:30 ticks (e.g.
|        Europe/Amsterdam '30 16,17 * * *'; a zone without daylight saving one tick) and the tag '18:30 <zone>' (one
|        read-modify-write PATCH of trigger + tags, read back);
|      * the pipeline start: '23:30' with the region's zone (the region step's value) -> '19:00' in the same zone (Pro:
|        cfg.Setting + cfg.JobFlow in one transaction with change-log rows; a folder: config\SecurityInsight.custom.ps1 +
|        config\job-flow.custom.json). Where the region step has not run yet (a plan, or a region step that failed this
|        time), the values IT would move are this step's shipped values too, so the end state is the same.
|    A value the customer set (anything else) stays, said in one plain line. Never fails the update; -DetectOnly plans only.
|    The updater still runs BEFORE the pipeline the same evening (18:30 < 19:00); a release roll started by hand is unaffected.
|    The text below describes the region step (23:00 / 23:30), which stays as the first of the two moves.
|
|    (the region step, 2026-10-15:) the updater at 23:00 and the pipeline at 23:30 in the time zone of the install's region (the location of its Container Apps environment, else of its
|    resource group) -- westeurope -> Europe/Amsterdam, northeurope -> Europe/Dublin, eastus -> America/New_York, ... -- so
|    the night's collection, correlation and delivery are complete by 08:00 local time. Not the install's own configured
|    zone. A region SecurityInsight does not know uses Danish time (Europe/Copenhagen), said in one plain line.
|
|    THE UPDATER'S TIMER. A Container Apps job's cron is UTC only. The UTC hours that are 23:00 in the zone are computed FROM
|    THE ZONE (Get-SINightlyUpdaterCron: its standard and its daylight-saving offset) -- Europe/Amsterdam 21:00 + 22:00 UTC
|    ('0 21,22 * * *'), America/New_York '0 3,4 * * *', a zone without daylight saving (Asia/Tokyo) ONE tick ('0 14 * * *').
|    The job records the zone in its tag si-nightly-schedule ('23:00 <zone>'), and the updater checks that zone's clock when
|    it starts (Test-SIUpdaterNightlyTick): the tick that is 23:00 there runs; the other one ends at once with one plain line
|    -- not a failure. The check applies only to an updater on exactly its zone's ticks; a timer the customer chose, and a run
|    started by hand, by a release or by the web app, always run. Right all year, daylight saving included.
|
|    EXISTING INSTALLS reach the new state through the update (rule: every setup default change needs an updater step), ONCE
|    under the marker of this step (job tag si-nightly-region; Pro cfg.InstallState 'NightlyScheduleRegion'; a folder
|    .si-update\nightly-schedule-region.json). Only SHIPPED values move; a customer's own value stays untouched:
|      * the updater's job: the old shipped '0 3 * * *' (a job the Danish-time step never reached), and the Danish-time
|        step's own values -- '0 21,22 * * *' with the tag '23:00 Europe/Copenhagen' (or without a tag: what a new install
|        of that release wrote) -- get the region's ticks (one read-modify-write PATCH of trigger + tags, read back).
|      * the pipeline start (Pro: cfg.Setting + cfg.JobFlow, in one transaction with its change-log rows; a folder:
|        config\SecurityInsight.custom.ps1 + config\job-flow.custom.json): '23:30' + 'Europe/Copenhagen' (the Danish-time
|        step's value) gets the region's zone; the old shipped '22:00' becomes 23:30 in the region's zone -- only where the
|        Danish-time step never ran (after it, a 22:00 is a value the customer set again). The zone is STORED with the time.
|    NEW INSTALLS use the region's time FROM THE START: the guided install (SI-GuidedInstall.ps1) writes the pipeline's 19:00
|    with the region's zone, Install-SIUpdaterJob.ps1 gives the updater the region zone's 18:30 ticks and the tags
|    ('18:30 <zone>', the region, si-nightly-1900) -- all from Get-SINightlyNewInstallSchedule -- and the install records BOTH
|    one-time steps' markers (the job tags si-nightly-region + si-nightly-1900, cfg.InstallState 'NightlyScheduleRegion' +
|    'NightlySchedule1900', .si-update\nightly-schedule-region.json + nightly-schedule-1900.json), so the update finds nothing
|    to move. A region SecurityInsight does not know: Danish time, said in one plain line.
|    Everything that decides is PURE; the Azure / SQL / file calls go through seams.
|#>
|
|$script:SINightly = @{
|    Zone             = 'Europe/Copenhagen'     # the fallback for a region SecurityInsight does not know
|    ZoneWindows      = 'Romance Standard Time'
|    UpdaterHour      = 23
|    UpdaterCron      = '0 21,22 * * *'         # the Danish-time step's ticks (a new install writes its region zone's ticks)
|    OldUpdaterCron   = '0 3 * * *'
|    ShippedJobTag    = '23:00 Europe/Copenhagen'
|    TickWindowMin    = 10
|    PipelineStart    = '23:30'
|    OldPipelineStart = '22:00'
|    Marker           = 'NightlyScheduleRegion'
|    OldMarker        = 'NightlySchedule'
|    JobTag           = 'si-nightly-schedule'
|    RegionTag        = 'si-nightly-region'
|    MarkerFile       = 'nightly-schedule-region.json'
|    OldMarkerFile    = 'nightly-schedule.json'
|    By               = 'SecurityInsight update'
|    # the 19:00 move (owner 2026-10-21): what a new install writes and what step 9l moves the region step's values to
|    At               = '18:30'                 # the updater, local time of the region
|    Start            = '19:00'                 # the pipeline, local time of the region
|    RegionAt         = '23:00'                 # the region step's updater time (what step 9l moves from)
|    AtCron           = '30 16,17 * * *'        # 18:30 Danish time in UTC -- the fallback when a zone's ticks cannot be computed
|    Marker1900       = 'NightlySchedule1900'
|    Tag1900          = 'si-nightly-1900'
|    MarkerFile1900   = 'nightly-schedule-1900.json'
|}
|
|# Azure public regions -> the IANA time zone of the region's location.
|$script:SIRegionZones = [ordered]@{
|    # Americas
|    'eastus' = 'America/New_York'; 'eastus2' = 'America/New_York'; 'eastus3' = 'America/New_York'; 'eastus2euap' = 'America/New_York'
|    'centralus' = 'America/Chicago'; 'northcentralus' = 'America/Chicago'; 'southcentralus' = 'America/Chicago'; 'centraluseuap' = 'America/Chicago'
|    'westcentralus' = 'America/Denver'; 'westus' = 'America/Los_Angeles'; 'westus2' = 'America/Los_Angeles'; 'westus3' = 'America/Phoenix'
|    'canadacentral' = 'America/Toronto'; 'canadaeast' = 'America/Toronto'
|    'brazilsouth' = 'America/Sao_Paulo'; 'brazilsoutheast' = 'America/Sao_Paulo'
|    'mexicocentral' = 'America/Mexico_City'; 'chilecentral' = 'America/Santiago'
|    # Europe
|    'northeurope' = 'Europe/Dublin'; 'westeurope' = 'Europe/Amsterdam'
|    'uksouth' = 'Europe/London'; 'ukwest' = 'Europe/London'
|    'francecentral' = 'Europe/Paris'; 'francesouth' = 'Europe/Paris'
|    'germanywestcentral' = 'Europe/Berlin'; 'germanynorth' = 'Europe/Berlin'
|    'switzerlandnorth' = 'Europe/Zurich'; 'switzerlandwest' = 'Europe/Zurich'
|    'norwayeast' = 'Europe/Oslo'; 'norwaywest' = 'Europe/Oslo'
|    'swedencentral' = 'Europe/Stockholm'; 'swedensouth' = 'Europe/Stockholm'
|    'denmarkeast' = 'Europe/Copenhagen'; 'finlandcentral' = 'Europe/Helsinki'
|    'polandcentral' = 'Europe/Warsaw'; 'italynorth' = 'Europe/Rome'; 'spaincentral' = 'Europe/Madrid'
|    'austriaeast' = 'Europe/Vienna'; 'belgiumcentral' = 'Europe/Brussels'; 'greececentral' = 'Europe/Athens'
|    # Middle East and Africa
|    'israelcentral' = 'Asia/Jerusalem'; 'qatarcentral' = 'Asia/Qatar'
|    'uaenorth' = 'Asia/Dubai'; 'uaecentral' = 'Asia/Dubai'; 'saudiarabiaeast' = 'Asia/Riyadh'
|    'southafricanorth' = 'Africa/Johannesburg'; 'southafricawest' = 'Africa/Johannesburg'
|    # Asia Pacific
|    'centralindia' = 'Asia/Kolkata'; 'southindia' = 'Asia/Kolkata'; 'westindia' = 'Asia/Kolkata'
|    'jioindiacentral' = 'Asia/Kolkata'; 'jioindiawest' = 'Asia/Kolkata'
|    'eastasia' = 'Asia/Hong_Kong'; 'southeastasia' = 'Asia/Singapore'
|    'japaneast' = 'Asia/Tokyo'; 'japanwest' = 'Asia/Tokyo'
|    'koreacentral' = 'Asia/Seoul'; 'koreasouth' = 'Asia/Seoul'
|    'australiaeast' = 'Australia/Sydney'; 'australiasoutheast' = 'Australia/Melbourne'
|    'australiacentral' = 'Australia/Sydney'; 'australiacentral2' = 'Australia/Sydney'
|    'newzealandnorth' = 'Pacific/Auckland'; 'indonesiacentral' = 'Asia/Jakarta'; 'malaysiawest' = 'Asia/Kuala_Lumpur'
|    'taiwannorth' = 'Asia/Taipei'; 'taiwannorthwest' = 'Asia/Taipei'
|}
|
|function Get-SINightlyRegionZone {
|    <#
|        PURE. The install's Azure region (a name, 'westeurope', or the display form 'West Europe') -> @{ Region; Zone; Known;
|        Line }. A region not in the map (or none) -> Europe/Copenhagen, and Line says so in one plain line ('' when known).
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Region)
|    $r = ("$Region".ToLowerInvariant()) -replace '[^a-z0-9]', ''
|    if ($r -and $script:SIRegionZones.Contains($r)) { return [pscustomobject]@{ Region = $r; Zone = [string]$script:SIRegionZones[$r]; Known = $true; Line = '' } }
|    $line = if ($r) { "The Azure region '$r' has no time zone known to SecurityInsight -- the nightly update and pipeline use Danish time (Europe/Copenhagen)." }
|            else { "The install's Azure region is not known -- the nightly update and pipeline use Danish time (Europe/Copenhagen)." }
|    [pscustomobject]@{ Region = $r; Zone = $script:SINightly.Zone; Known = $false; Line = $line }
|}
|
|function Get-SINightlyZone {
|    <# A time zone on this machine: -Id an IANA id (default Europe/Copenhagen) or a TimeZoneInfo; $null when not known. #>
|    param($Id = $script:SINightly.Zone)
|    if ($Id -is [TimeZoneInfo]) { return $Id }
|    $s = "$Id".Trim(); if (-not $s) { return $null }
|    $ids = @($s)
|    if ($s -eq $script:SINightly.Zone) { $ids += $script:SINightly.ZoneWindows }
|    try { $w = $null; if ([TimeZoneInfo].GetMethod('TryConvertIanaIdToWindowsId', [type[]]@([string], [string].MakeByRefType())) -and [TimeZoneInfo]::TryConvertIanaIdToWindowsId($s, [ref]$w)) { $ids += $w } } catch { }
|    foreach ($x in $ids) { try { return [TimeZoneInfo]::FindSystemTimeZoneById($x) } catch { } }
|    $null
|}
|
|function Get-SINightlyZoneId {
|    <# PURE. The IANA id to show / store for -Zone (a string id, or a TimeZoneInfo). #>
|    param($Zone)
|    if ($Zone -is [TimeZoneInfo]) { if ($Zone.Id -eq $script:SINightly.ZoneWindows) { return $script:SINightly.Zone }; return $Zone.Id }
|    "$Zone".Trim()
|}
|
|function Get-SINightlyUpdaterTicks {
|    <#
|        PURE. The UTC times that are -At (HH:mm; default 18:30, the updater's time) in -Zone over a year (every day's -At,
|        converted): one per offset the zone uses -- two for a zone with daylight saving, one for a zone without. Sorted.
|        @( @{ Hour; Minute } ); empty = zone not known.
|    #>
|    param($Zone, [int]$Year = [datetime]::UtcNow.Year, [string]$At = $script:SINightly.At)
|    $tz = Get-SINightlyZone $Zone
|    if (-not $tz) { return @() }
|    $hm = [regex]::Match("$At", '^\s*(\d{1,2}):(\d{2})\s*$'); if (-not $hm.Success) { return @() }
|    $seen = @{}
|    $d = New-Object datetime($Year, 1, 1, [int]$hm.Groups[1].Value, [int]$hm.Groups[2].Value, 0, [DateTimeKind]::Unspecified)
|    for ($i = 0; $i -lt 366; $i++) {
|        $l = $d.AddDays($i); if ($l.Year -ne $Year) { break }
|        if ($tz.IsInvalidTime($l)) { continue }
|        $u = [TimeZoneInfo]::ConvertTimeToUtc($l, $tz)
|        $seen['{0:00}:{1:00}' -f $u.Hour, $u.Minute] = [pscustomobject]@{ Hour = $u.Hour; Minute = $u.Minute }
|    }
|    @($seen.Keys | Sort-Object | ForEach-Object { $seen[$_] })
|}
|
|function Get-SINightlyUpdaterCron {
|    <#
|        PURE. The updater's cron for -Zone: its -At ticks in UTC (default 18:30: Europe/Amsterdam '30 16,17 * * *'; the region
|        step's -At '23:00': '0 21,22 * * *'); '' = zone not known. A half-hour zone whose ticks differ in minutes is not one cron
|        ('' -- the caller falls back).
|    #>
|    param($Zone, [int]$Year = [datetime]::UtcNow.Year, [string]$At = $script:SINightly.At)
|    $t = @(Get-SINightlyUpdaterTicks -Zone $Zone -Year $Year -At $At)
|    if (-not $t.Count) { return '' }
|    if (@($t | ForEach-Object { $_.Minute } | Sort-Object -Unique).Count -gt 1) { return '' }
|    '{0} {1} * * *' -f $t[0].Minute, ((@($t | ForEach-Object { $_.Hour } | Sort-Object -Unique)) -join ',')
|}
|
|function Test-SIUpdaterNightlyTick {
|    <#
|        PURE. Does THIS start of the updater go on? -Cron: the updater job's own cron ('' = not known). -Zone: the zone the
|        job records (tag si-nightly-schedule; an IANA id or a TimeZoneInfo). -Mode: SI_UPDATER_MODE (a run started for a
|        purpose). Only a start on one of the zone's ticks, on exactly the zone's timer, is checked: it goes on when it is 18:30
|        in the zone (or 23:00 on the region step's ticks, a job the 19:00 move has not reached yet), and ends (Go $false) on
|        the other tick. Everything else goes on. Returns @{ Go; Why; LocalTime }.
|    #>
|    param([Parameter(Mandatory)][datetime]$NowUtc, [AllowEmptyString()][string]$Cron = '', [AllowEmptyString()][string]$Mode = '', $Zone = $script:SINightly.Zone)
|    $u = if ($NowUtc.Kind -eq 'Local') { $NowUtc.ToUniversalTime() } else { [datetime]::SpecifyKind($NowUtc, 'Utc') }
|    $go = { param($why, $lt) [pscustomobject]@{ Go = $true; Why = $why; LocalTime = $lt } }
|    if ("$Mode".Trim()) { return (& $go 'a run started for a purpose' $null) }
|    $tz = if ($null -eq $Zone) { $null } else { Get-SINightlyZone $Zone }
|    if (-not $tz) { return (& $go 'the time zone is not known on this machine -- the update runs' $null) }
|    $zid = Get-SINightlyZoneId $(if ($Zone -is [TimeZoneInfo]) { $Zone } else { "$Zone" })
|    $have = ("$Cron".Trim()) -replace '\s+', ' '
|    $at = $null
|    foreach ($a in @($script:SINightly.At, $script:SINightly.RegionAt)) {
|        $want = Get-SINightlyUpdaterCron -Zone $tz -Year $u.Year -At $a
|        if ($want -and $have -eq $want) { $at = $a; break }
|    }
|    if (-not $at) { return (& $go 'the updater runs on its own timer' $null) }
|    $ticks = @(Get-SINightlyUpdaterTicks -Zone $tz -Year $u.Year -At $at)
|    $onTick = @($ticks | Where-Object { $m = ($u.Hour * 60 + $u.Minute) - ($_.Hour * 60 + $_.Minute); $m -ge 0 -and $m -lt $script:SINightly.TickWindowMin }).Count
|    if (-not $onTick) { return (& $go 'started by hand or by a release' $null) }
|    $local = [TimeZoneInfo]::ConvertTimeFromUtc($u, $tz)
|    if ($local.Hour -eq [int]($at.Split(':')[0])) { return (& $go ('{0:HH:mm} in {1}' -f $local, $zid) $local) }
|    [pscustomobject]@{ Go = $false; LocalTime = $local
|        Why = ('It is {0:HH:mm} in {1}: SecurityInsight updates at {2} in the time zone of its Azure region, so this start ends here (not a failure; the update runs at the other start time tonight).' -f $local, $zid, $at) }
|}
|
|function Test-SINightlyOldPipelineStart {
|    <# PURE. Is -Value the old shipped start time -- '22:00' (also '22:00 local time', a JSON string '"22:00"')? #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -is [DBNull]) { return $false }
|    $t = ([string]$Value).Trim().Trim('"').Trim()
|    $t -match '^22:00( local( time)?)?$'
|}
|
|function Test-SINightlyShippedPipeline {
|    <# PURE. Is -Start / -Zone exactly the Danish-time step's value: '23:30' with 'Europe/Copenhagen' (JSON strings allowed)? #>
|    param([AllowNull()]$Start, [AllowNull()]$Zone)
|    if ($null -eq $Start -or $Start -is [DBNull] -or $null -eq $Zone -or $Zone -is [DBNull]) { return $false }
|    (([string]$Start).Trim().Trim('"').Trim() -eq $script:SINightly.PipelineStart) -and (([string]$Zone).Trim().Trim('"').Trim() -eq $script:SINightly.Zone)
|}
|
|function ConvertTo-SINightlyTagMap {
|    <# PURE. A job's tags (object or dictionary) as an ordered dictionary. #>
|    param($Job)
|    $tags = [ordered]@{}
|    if ($Job -and $Job.PSObject.Properties['tags'] -and $null -ne $Job.tags) {
|        if ($Job.tags -is [System.Collections.IDictionary]) { foreach ($k in $Job.tags.Keys) { $tags[[string]$k] = [string]$Job.tags[$k] } }
|        else { foreach ($p in $Job.tags.PSObject.Properties) { $tags[$p.Name] = [string]$p.Value } }
|    }
|    $tags
|}
|
|function Get-SINightlyJobCron {
|    <# PURE. The job's cron ('' when it has no timer). #>
|    param($Job)
|    try { $c = $Job.properties.configuration; if ([string]$c.triggerType -eq 'Schedule' -and $c.scheduleTriggerConfig) { return ([string]$c.scheduleTriggerConfig.cronExpression).Trim() } } catch { }
|    ''
|}
|
|function Get-SINightlyJobZone {
|    <# PURE. The zone the updater job records (tag si-nightly-schedule '23:00 <zone>'); none -> Europe/Copenhagen (what a job without it was set to). #>
|    param($Job)
|    $t = ConvertTo-SINightlyTagMap $Job
|    if ($t.Contains($script:SINightly.JobTag)) { $m = [regex]::Match([string]$t[$script:SINightly.JobTag], '^\s*\d{1,2}:\d{2}\s+(\S+)\s*$'); if ($m.Success) { return $m.Groups[1].Value } }
|    $script:SINightly.Zone
|}
|
|function Get-SINightlyUpdaterCronPlan {
|    <#
|        PURE. What the update does to the updater job's timer (-Job: ARM GET shape; -Region: the install's Azure region, else
|        the job's own location). @{ Action = done | change | keep; Cron; Zone; Region; Body (the PATCH: tags + the trigger
|        only -- never the template or the secrets); Why; RegionLine }.
|          done   -- the job carries the tag si-nightly-region: this step ran before, nothing changes
|          change -- on a shipped timer (the old '0 3 * * *' the Danish-time step never reached, or that step's '0 21,22 * * *'
|                    with its tag '23:00 Europe/Copenhagen' or no tag) -> the region's ticks, plus the tags
|          keep   -- a timer the customer chose: kept; only the tags are added so the step never looks again
|    #>
|    param([Parameter(Mandatory)]$Job, [AllowEmptyString()][AllowNull()][string]$Region = '')
|    $tags = ConvertTo-SINightlyTagMap $Job
|    $name = [string]$Job.name
|    if ($tags.Contains($script:SINightly.RegionTag)) { return [pscustomobject]@{ Action = 'done'; Cron = (Get-SINightlyJobCron $Job); Zone = (Get-SINightlyJobZone $Job); Region = [string]$tags[$script:SINightly.RegionTag]; Body = $null; Why = ('{0}: the nightly update time was set before -- nothing to change' -f $name); RegionLine = '' } }
|    if (-not "$Region".Trim() -and $Job.PSObject.Properties['location']) { $Region = [string]$Job.location }
|    $rz = Get-SINightlyRegionZone $Region
|    $zone = $rz.Zone
|    $zoneCron = Get-SINightlyUpdaterCron -Zone $zone -At $script:SINightly.RegionAt
|    if (-not $zoneCron) { $zone = $script:SINightly.Zone; $zoneCron = $script:SINightly.UpdaterCron }
|    $hadTag = $tags.Contains($script:SINightly.JobTag)
|    $oldTag = if ($hadTag) { ([string]$tags[$script:SINightly.JobTag]).Trim() } else { '' }
|    $isShipped = {
|        param([string]$c)
|        $n = ("$c".Trim()) -replace '\s+', ' '
|        ($n -eq $script:SINightly.OldUpdaterCron -and -not $hadTag) -or ($n -eq $script:SINightly.UpdaterCron -and (-not $hadTag -or $oldTag -eq $script:SINightly.ShippedJobTag))
|    }
|    $cfg = $null; try { $cfg = $Job.properties.configuration } catch { }
|    $cron = Get-SINightlyJobCron $Job
|    $tags[$script:SINightly.JobTag] = '23:00 ' + $zone
|    $tags[$script:SINightly.RegionTag] = $(if ($rz.Region) { $rz.Region } else { 'unknown' })
|    $where = if ($rz.Known) { '{0}, the time zone of its Azure region ({1})' -f $zone, $rz.Region } else { $zone }
|    $res = { param($a, $c, $b, $w) [pscustomobject]@{ Action = $a; Cron = $c; Zone = $zone; Region = $rz.Region; Body = $b; Why = $w; RegionLine = $rz.Line } }
|    if ($cfg -and [string]$cfg.triggerType -eq 'Schedule' -and (& $isShipped $cron)) {
|        $src = $cfg.scheduleTriggerConfig
|        $par = 1; $rcc = 1
|        if ($src.PSObject.Properties['parallelism'] -and $src.parallelism) { $par = $src.parallelism }
|        if ($src.PSObject.Properties['replicaCompletionCount'] -and $src.replicaCompletionCount) { $rcc = $src.replicaCompletionCount }
|        $c = [ordered]@{ triggerType = 'Schedule' }
|        if ($cfg.PSObject.Properties['replicaTimeout'] -and $cfg.replicaTimeout) { $c.replicaTimeout = $cfg.replicaTimeout }
|        $c.scheduleTriggerConfig = [ordered]@{ cronExpression = $zoneCron; parallelism = $par; replicaCompletionCount = $rcc }
|        return (& $res 'change' $zoneCron ([ordered]@{ tags = $tags; properties = [ordered]@{ configuration = $c } }) ('{0}: the update runs at 23:00 in {1} (timer ''{2}'' UTC)' -f $name, $where, $zoneCron))
|    }
|    if ($cfg -and [string]$cfg.triggerType -ne 'Schedule' -and $tags.Contains('si-disabled-cron') -and (& $isShipped ([string]$tags['si-disabled-cron']))) {
|        $tags['si-disabled-cron'] = $zoneCron
|        return (& $res 'change' '' ([ordered]@{ tags = $tags }) ('{0} has no timer now; when it gets it back, it runs at 23:00 in {1}' -f $name, $where))
|    }
|    & $res 'keep' $cron ([ordered]@{ tags = $tags }) ('{0} runs on a timer of your own ({1}) -- kept' -f $name, $(if ($cron) { "'$cron' UTC" } else { 'none' }))
|}
|
|function Get-SINightly1900UpdaterPlan {
|    <#
|        PURE. The 19:00 move of the updater job's timer (owner 2026-10-21), once. -Job: ARM GET shape; -Region: the install's
|        Azure region (else the job's own location). Same shape as Get-SINightlyUpdaterCronPlan: @{ Action = done | change |
|        keep; Cron; Zone; Region; Body (tags + the trigger only); Why; RegionLine }.
|          done   -- the job carries the tag si-nightly-1900
|          change -- the region step's value: the zone's 23:00 ticks with the tag '23:00 <zone>' (or, where the region step
|                    has not run yet, a value IT would move) -> the zone's 18:30 ticks + the tag '18:30 <zone>'
|          keep   -- a timer the customer chose: kept; only the tag si-nightly-1900 is added so the step never looks again
|    #>
|    param([Parameter(Mandatory)]$Job, [AllowEmptyString()][AllowNull()][string]$Region = '')
|    $tags = ConvertTo-SINightlyTagMap $Job
|    $name = [string]$Job.name
|    $S = $script:SINightly
|    if ($tags.Contains($S.Tag1900)) { return [pscustomobject]@{ Action = 'done'; Cron = (Get-SINightlyJobCron $Job); Zone = (Get-SINightlyJobZone $Job); Region = [string]$tags[$S.RegionTag]; Body = $null; Why = ('{0}: the nightly update time was set before -- nothing to change' -f $name); RegionLine = '' } }
|    $cfg = $null; try { $cfg = $Job.properties.configuration } catch { }
|    $cron = Get-SINightlyJobCron $Job
|    $line = ''; $reg = ''
|    if ($tags.Contains($S.RegionTag)) {
|        # the region step ran: its value is the zone's 23:00 ticks with the tag '23:00 <zone>'
|        $zone = Get-SINightlyJobZone $Job
|        $reg = [string]$tags[$S.RegionTag]
|        $tag = if ($tags.Contains($S.JobTag)) { ([string]$tags[$S.JobTag]).Trim() } else { '' }
|        $from = Get-SINightlyUpdaterCron -Zone $zone -At $S.RegionAt
|        if (-not $from -and $zone -eq $S.Zone) { $from = $S.UpdaterCron }
|        $isShipped = { param([string]$c) $from -and $tag -eq ($S.RegionAt + ' ' + $zone) -and ((("$c".Trim()) -replace '\s+', ' ') -eq $from) }
|        $shippedNow = $cfg -and [string]$cfg.triggerType -eq 'Schedule' -and (& $isShipped $cron)
|        $shippedOff = $cfg -and [string]$cfg.triggerType -ne 'Schedule' -and $tags.Contains('si-disabled-cron') -and (& $isShipped ([string]$tags['si-disabled-cron']))
|    } else {
|        # the region step has not run (a plan, or it failed this time): what IT would move is shipped here too
|        $rp = Get-SINightlyUpdaterCronPlan -Job $Job -Region $Region
|        $zone = $rp.Zone; $reg = $(if ($rp.Region) { $rp.Region } else { 'unknown' }); $line = $rp.RegionLine
|        $shippedNow = $rp.Action -eq 'change' -and [bool]$rp.Cron
|        $shippedOff = $rp.Action -eq 'change' -and -not $rp.Cron
|    }
|    $toCron = Get-SINightlyUpdaterCron -Zone $zone
|    if (-not $toCron) { if ($zone -eq $S.Zone) { $toCron = $S.AtCron } else { $shippedNow = $false; $shippedOff = $false } }
|    $tags[$S.Tag1900] = $zone
|    if (-not $tags.Contains($S.RegionTag)) { $tags[$S.RegionTag] = $reg }
|    $where = if ($reg -and $reg -ne 'unknown') { '{0}, the time zone of its Azure region ({1})' -f $zone, $reg } else { $zone }
|    $res = { param($a, $c, $b, $w) [pscustomobject]@{ Action = $a; Cron = $c; Zone = $zone; Region = $reg; Body = $b; Why = $w; RegionLine = $line } }
|    if ($shippedNow) {
|        $tags[$S.JobTag] = $S.At + ' ' + $zone
|        $src = $cfg.scheduleTriggerConfig
|        $par = 1; $rcc = 1
|        if ($src.PSObject.Properties['parallelism'] -and $src.parallelism) { $par = $src.parallelism }
|        if ($src.PSObject.Properties['replicaCompletionCount'] -and $src.replicaCompletionCount) { $rcc = $src.replicaCompletionCount }
|        $c = [ordered]@{ triggerType = 'Schedule' }
|        if ($cfg.PSObject.Properties['replicaTimeout'] -and $cfg.replicaTimeout) { $c.replicaTimeout = $cfg.replicaTimeout }
|        $c.scheduleTriggerConfig = [ordered]@{ cronExpression = $toCron; parallelism = $par; replicaCompletionCount = $rcc }
|        return (& $res 'change' $toCron ([ordered]@{ tags = $tags; properties = [ordered]@{ configuration = $c } }) ('{0}: the update runs at {1} in {2} (timer ''{3}'' UTC), before the daily pipeline at {4}' -f $name, $S.At, $where, $toCron, $S.Start))
|    }
|    if ($shippedOff) {
|        $tags[$S.JobTag] = $S.At + ' ' + $zone
|        $tags['si-disabled-cron'] = $toCron
|        return (& $res 'change' '' ([ordered]@{ tags = $tags }) ('{0} has no timer now; when it gets it back, it runs at {1} in {2}' -f $name, $S.At, $where))
|    }
|    & $res 'keep' $cron ([ordered]@{ tags = $tags }) ('{0} runs on a timer of your own ({1}) -- kept' -f $name, $(if ($cron) { "'$cron' UTC" } else { 'none' }))
|}
|
|function Get-SINightlyNewInstallSchedule {
|    <#
|        PURE. What a NEW install writes for -Region (the Azure region it goes into; '' = not known): @{ Region; Zone; Known;
|        Line (one plain line when the region is not known, else ''); UpdaterCron (the zone's 18:30 ticks in UTC); UpdaterTags
|        (the job's tags si-nightly-schedule '18:30 <zone>' + si-nightly-region '<region>' | 'unknown' + si-nightly-1900
|        '<zone>' -- the update's one-time steps then see nothing to move); UpdaterTagArgs (the same as k=v); PipelineStart
|        '19:00'; PipelineZone; Marker (the JSON the Pro markers / the folder markers record) }.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Region = '', [int]$Year = [datetime]::UtcNow.Year)
|    $S = $script:SINightly
|    $rz = Get-SINightlyRegionZone $Region
|    $zone = $rz.Zone
|    $cron = Get-SINightlyUpdaterCron -Zone $zone -Year $Year
|    if (-not $cron) { $zone = $S.Zone; $cron = $S.AtCron }
|    $reg = if ($rz.Region) { $rz.Region } else { 'unknown' }
|    $tags = [ordered]@{}; $tags[$S.JobTag] = $S.At + ' ' + $zone; $tags[$S.RegionTag] = $reg; $tags[$S.Tag1900] = $zone
|    $marker = [ordered]@{ region = $reg; zone = $zone; updater = ($S.At + ' ' + $zone); pipeline = ($S.Start + ' ' + $zone); by = 'install' } | ConvertTo-Json -Compress
|    [pscustomobject]@{ Region = $rz.Region; Zone = $zone; Known = [bool]$rz.Known; Line = $rz.Line; UpdaterCron = $cron; UpdaterTags = $tags
|                       UpdaterTagArgs = @($tags.Keys | ForEach-Object { '{0}={1}' -f $_, $tags[$_] }); PipelineStart = $S.Start; PipelineZone = $zone; Marker = $marker }
|}
|
|function Get-SINightlyScheduleText {
|    <# PURE. The schedule in plain words for -Zone: "18:30 local time (Europe/Amsterdam, the install's Azure region)"; the fallback zone without a known region: "18:30 Danish time (Europe/Copenhagen)". -At: the time (default the updater's 18:30; the pipeline's '19:00'). #>
|    param([string]$Zone = $script:SINightly.Zone, [bool]$Known = $true, [string]$At = $script:SINightly.At)
|    if (-not $Known) { return ('{0} Danish time ({1}; the install''s Azure region is not known)' -f $At, $script:SINightly.Zone) }
|    '{0} local time ({1}, the install''s Azure region)' -f $At, $Zone
|}
|
|function Get-SINightlyInstallMarkerSql {
|    <#
|        PURE. A NEW Pro install's markers: cfg.InstallState 'NightlyScheduleRegion' and 'NightlySchedule1900' (the update's
|        one-time steps then see nothing to move), each written only when it is not there yet and the table exists. -Marker:
|        the JSON of Get-SINightlyNewInstallSchedule. Literal values (no parameters), quotes doubled.
|    #>
|    param([Parameter(Mandatory)][string]$Marker, [string]$By = 'guided install')
|    $q = { param($s) ([string]$s).Replace("'", "''") }
|    @(foreach ($n in @($script:SINightly.Marker, $script:SINightly.Marker1900)) {
|        "IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL AND NOT EXISTS (SELECT 1 FROM cfg.InstallState WHERE Name = N'{0}') INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'{0}', N'{1}', NULL, N'{2}');" -f (& $q $n), (& $q $Marker), (& $q $By)
|    }) -join "`n"
|}
|
|function Set-SINightlyInstallMarkerFile {
|    <# A NEW folder's markers .si-update\nightly-schedule-region.json + nightly-schedule-1900.json under -Root (each written only when it is not there). Never throws; $true when one was written. #>
|    param([Parameter(Mandatory)][string]$Root, [Parameter(Mandatory)][string]$Marker)
|    try {
|        $dir = [IO.Path]::Combine($Root, '.si-update'); $wrote = $false
|        foreach ($n in @($script:SINightly.MarkerFile, $script:SINightly.MarkerFile1900)) {
|            $f = [IO.Path]::Combine($dir, $n)
|            if (Test-Path -LiteralPath $f) { continue }
|            if (-not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Force -Path $dir | Out-Null }
|            [IO.File]::WriteAllText($f, $Marker); $wrote = $true
|        }
|        $wrote
|    } catch { $false }
|}
|
|function Get-SINightlyInstallRegion {
|    <#
|        The install's Azure region: the location of its Container Apps environment, else of its resource group (ARM REST
|        through the update's seam, -Rest { param($Method, $Uri, $Body, $Resource, $Headers) } -> @{ Status; Body }). '' when
|        neither can be read. Never throws.
|    #>
|    param([Parameter(Mandatory)]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup)
|    $arm = 'https://management.azure.com'
|    $base = '{0}/subscriptions/{1}/resourceGroups/{2}' -f $arm, $SubscriptionId, $ResourceGroup
|    foreach ($uri in @(($base + '/providers/Microsoft.App/managedEnvironments?api-version=2025-07-01'), ($base + '?api-version=2021-04-01'))) {
|        try {
|            $r = & $Rest 'GET' $uri $null $arm @{}
|            if (-not $r -or [int]$r.Status -ne 200) { continue }
|            $b = [string]$r.Body | ConvertFrom-Json
|            $loc = if ($b.PSObject.Properties['value']) { @($b.value | Where-Object { $_ -and [string]$_.location } | ForEach-Object { [string]$_.location })[0] } else { [string]$b.location }
|            if ("$loc".Trim()) { return "$loc".Trim() }
|        } catch { }
|    }
|    ''
|}
|
|function Invoke-SINightlyUpdaterSchedule {
|    <#
|        The updater job's timer, once (Get-SINightlyUpdaterCronPlan): GET, PATCH (read-modify-write), GET again and check.
|        -Rest: the update's REST seam. -Region: the install's Azure region ('' = the job's own location). -Step: 'region' (the
|        region step 9c, Get-SINightlyUpdaterCronPlan) or '1900' (the 19:00 move 9l, Get-SINightly1900UpdaterPlan). Never throws.
|        Returns @{ Action; Zone; Region; Lines }.
|    #>
|    param([Parameter(Mandatory)]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [Parameter(Mandatory)][string]$JobName, [AllowEmptyString()][string]$Region = '', [switch]$WhatIf, [string]$ApiVersion = '2025-07-01',
|          [ValidateSet('region', '1900')][string]$Step = 'region')
|    $doneTag = if ($Step -eq '1900') { $script:SINightly.Tag1900 } else { $script:SINightly.RegionTag }
|    $lines = New-Object System.Collections.Generic.List[string]
|    $uri = 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs/{2}?api-version={3}' -f $SubscriptionId, $ResourceGroup, $JobName, $ApiVersion
|    $arm = 'https://management.azure.com'
|    $out = { param($a, $p) [pscustomobject]@{ Action = $a; Zone = $(if ($p) { $p.Zone } else { '' }); Region = $(if ($p) { $p.Region } else { '' }); Lines = $lines.ToArray() } }
|    try {
|        $g = & $Rest 'GET' $uri $null $arm @{}
|        if (-not $g -or [int]$g.Status -ne 200) { $lines.Add(('nightly update time: {0} could not be read (HTTP {1}) -- the next update tries again' -f $JobName, $(if ($g) { $g.Status } else { 0 }))); return (& $out 'failed' $null) }
|        $job = [string]$g.Body | ConvertFrom-Json
|        $p = if ($Step -eq '1900') { Get-SINightly1900UpdaterPlan -Job $job -Region $Region } else { Get-SINightlyUpdaterCronPlan -Job $job -Region $Region }
|        if ($p.Action -eq 'done') { return (& $out 'done' $p) }
|        if ($p.RegionLine) { $lines.Add($p.RegionLine) }
|        if ($WhatIf) { $lines.Add(('nightly update time: {0} (re-run with -Apply)' -f $p.Why)); return (& $out ('plan-' + $p.Action) $p) }
|        $r = & $Rest 'PATCH' $uri ($p.Body | ConvertTo-Json -Depth 10 -Compress) $arm @{ 'Content-Type' = 'application/json' }
|        if (-not $r -or [int]$r.Status -lt 200 -or [int]$r.Status -ge 300) { $lines.Add(('nightly update time: {0} was NOT changed (HTTP {1}) -- the next update tries again' -f $JobName, $(if ($r) { $r.Status } else { 0 }))); return (& $out 'failed' $p) }
|        # read back: ARM answers the PATCH before the job carries it
|        $ok = $false
|        for ($i = 0; $i -lt 6 -and -not $ok; $i++) {
|            if ($i) { Start-Sleep -Seconds 5 }
|            $b = & $Rest 'GET' $uri $null $arm @{}
|            if ($b -and [int]$b.Status -eq 200) {
|                $now = [string]$b.Body | ConvertFrom-Json
|                $ok = (ConvertTo-SINightlyTagMap $now).Contains($doneTag) -and (-not $p.Cron -or (Get-SINightlyJobCron $now) -eq $p.Cron)
|            }
|        }
|        if (-not $ok) { $lines.Add(('nightly update time: {0} did not read back as changed -- the next update checks it again' -f $JobName)); return (& $out 'failed' $p) }
|        $lines.Add(('nightly update time: {0}' -f $p.Why))
|        & $out $p.Action $p
|    } catch { $lines.Add(('nightly update time: not checked ({0}) -- the next update tries again' -f $_.Exception.Message)); & $out 'failed' $null }
|}
|
|function ConvertTo-SINightlyFlowJson {
|    <#
|        PURE. A stored pipeline (cfg.JobFlow / job-flow.custom.json) on a shipped start -> the region's zone (-Zone):
|          '23:30' + 'Europe/Copenhagen' (the Danish-time step's value) -> its timeZone becomes -Zone;
|          the old '22:00' -> '23:30' + -Zone, only with -MoveOld (the Danish-time step never ran here).
|        Only a definition that HAS a time zone (one stored before time zones reads its time as UTC and is kept). The text is
|        changed in place (the rest stays byte for byte). $null = nothing to change.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Json, [string]$Zone = $script:SINightly.Zone, [bool]$MoveOld = $true)
|    if (-not "$Json".Trim()) { return $null }
|    $st = [regex]::Match($Json, '"startTime"\s*:\s*"([^"]*)"')
|    $tz = [regex]::Match($Json, '"timeZone"\s*:\s*"([^"]*)"')
|    if (-not $st.Success -or -not $tz.Success) { return $null }
|    $parts = @()
|    if ($MoveOld -and (Test-SINightlyOldPipelineStart $st.Groups[1].Value)) {
|        $parts = @(@{ M = $st; New = ('"startTime":"{0}"' -f $script:SINightly.PipelineStart) }, @{ M = $tz; New = ('"timeZone":"{0}"' -f $Zone) })
|    } elseif ((Test-SINightlyShippedPipeline $st.Groups[1].Value $tz.Groups[1].Value) -and $Zone -ne $script:SINightly.Zone) {
|        $parts = @(@{ M = $tz; New = ('"timeZone":"{0}"' -f $Zone) })
|    } else { return $null }
|    # the later match first, so the earlier index stays right
|    $out = $Json
|    foreach ($x in @($parts | Sort-Object { $_.M.Index } -Descending)) { $out = $out.Substring(0, $x.M.Index) + $x.New + $out.Substring($x.M.Index + $x.M.Length) }
|    $out
|}
|
|function Get-SINightlyPipelineLine {
|    <# PURE. The one plain line for the customer. #>
|    param([string]$Zone, [bool]$Changed, [bool]$HasOwn)
|    if ($Changed) { return ('The daily pipeline now starts at 23:30 in {0} (the time zone of the install''s Azure region), after the nightly update at 23:00.' -f $Zone) }
|    if ($HasOwn) { return 'The daily pipeline keeps the start time you chose.' }
|    ''
|}
|
|function Get-SINightlyPipelinePlan {
|    <#
|        PURE. The Pro database's part: -Rows = cfg.Setting rows of SI_Pipeline_StartTime / SI_Pipeline_TimeZone (Name, Scope,
|        ValueJson), -FlowJson = cfg.JobFlow's daily definition ('' none), -Done = this step's marker exists, -OldDone = the
|        Danish-time step's marker exists, -Zone = the region's zone. Returns @{ Done; Settings = [@{ Name; Scope; Old; New;
|        Insert }]; FlowJson (the new definition, or $null); Lines }. Any other value is the customer's: nothing at that scope changes.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [AllowEmptyString()][AllowNull()][string]$FlowJson = '', [bool]$Done = $false,
|          [bool]$OldDone = $false, [string]$Zone = $script:SINightly.Zone)
|    $set = New-Object System.Collections.Generic.List[object]
|    $lines = New-Object System.Collections.Generic.List[string]
|    if ($Done) { return [pscustomobject]@{ Done = $true; Settings = @(); FlowJson = $null; Lines = @() } }
|    $rows = @($Rows | Where-Object { $_ })
|    $zoneJson = '"{0}"' -f $Zone
|    $shippedSeen = $false
|    foreach ($r in @($rows | Where-Object { [string]$_.Name -eq 'SI_Pipeline_StartTime' })) {
|        $scope = [string]$r.Scope
|        $z = @($rows | Where-Object { [string]$_.Name -eq 'SI_Pipeline_TimeZone' -and [string]$_.Scope -eq $scope })[0]
|        if (-not $OldDone -and (Test-SINightlyOldPipelineStart ([string]$r.ValueJson))) {
|            $set.Add([pscustomobject]@{ Name = 'SI_Pipeline_StartTime'; Scope = $scope; Old = [string]$r.ValueJson; New = ('"{0}"' -f $script:SINightly.PipelineStart); Insert = $false })
|        } elseif ($z -and (Test-SINightlyShippedPipeline ([string]$r.ValueJson) ([string]$z.ValueJson))) {
|            $shippedSeen = $true
|        } else { continue }
|        if (-not $z) { $set.Add([pscustomobject]@{ Name = 'SI_Pipeline_TimeZone'; Scope = $scope; Old = $null; New = $zoneJson; Insert = $true }) }
|        elseif (([string]$z.ValueJson).Trim() -ne $zoneJson) { $set.Add([pscustomobject]@{ Name = 'SI_Pipeline_TimeZone'; Scope = $scope; Old = [string]$z.ValueJson; New = $zoneJson; Insert = $false }) }
|    }
|    $flow = ConvertTo-SINightlyFlowJson -Json $FlowJson -Zone $Zone -MoveOld (-not $OldDone)
|    $changed = [bool]($set.Count -or $flow)
|    $hasOwn = (-not $shippedSeen) -and ([string]$FlowJson -match '"startTime"\s*:\s*"([^"]*)"' -or @($rows | Where-Object { [string]$_.Name -eq 'SI_Pipeline_StartTime' }).Count)
|    $l = Get-SINightlyPipelineLine -Zone $Zone -Changed $changed -HasOwn $hasOwn
|    if ($l) { $lines.Add($l) }
|    [pscustomobject]@{ Done = $false; Settings = $set.ToArray(); FlowJson = $flow; Lines = $lines.ToArray() }
|}
|
|function Get-SINightlyPipelineSql {
|    <#
|        The Pro database's statements. 'Read': the two markers, the two settings' rows and the daily pipeline. 'Apply' (-Plan):
|        ONE transaction -- each setting written with its cfg.ChangeLog row (the same writes as Set-SIProSetting: the
|        Settings page's history shows them), the pipeline definition (cfg.JobFlow keeps its own journal), and the marker
|        last. A marker that appeared meanwhile (another run) = nothing is written. Returns @{ Sql; Params }.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Read', 'Apply')][string]$Name, $Plan, [string]$By = $script:SINightly.By,
|          [string]$Zone = $script:SINightly.Zone, [AllowEmptyString()][string]$Region = '')
|    if ($Name -eq 'Read') {
|        return [pscustomobject]@{ Params = @{}; Sql = @"
|SELECT CASE WHEN Name = N'$($script:SINightly.Marker)' THEN N'marker' ELSE N'oldmarker' END AS Kind, Name, CAST(N'' AS nvarchar(64)) AS Scope, Value AS ValueJson FROM cfg.InstallState WHERE OBJECT_ID(N'cfg.InstallState') IS NOT NULL AND Name IN (N'$($script:SINightly.Marker)', N'$($script:SINightly.OldMarker)')
|UNION ALL SELECT N'setting', Name, Scope, ValueJson FROM cfg.Setting WHERE Name IN (N'SI_Pipeline_StartTime', N'SI_Pipeline_TimeZone')
|UNION ALL SELECT N'flow', FlowId, CAST(N'' AS nvarchar(64)), DefinitionJson FROM cfg.JobFlow WHERE OBJECT_ID(N'cfg.JobFlow') IS NOT NULL AND FlowId = N'daily';
|"@ }
|    }
|    $p = [ordered]@{ By = $By; Reason = ('the nightly schedule: the update at 23:00 and the pipeline at 23:30 in {0}, the time zone of the install''s Azure region (owner decision 2026-10-15)' -f $Zone)
|                     Marker = $script:SINightly.Marker; MarkerValue = ''; FlowJson = [DBNull]::Value }
|    $sb = New-Object System.Text.StringBuilder
|    $null = $sb.AppendLine('SET XACT_ABORT ON;')
|    $null = $sb.AppendLine('BEGIN TRAN;')
|    $null = $sb.AppendLine('IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @Marker) BEGIN COMMIT; RETURN; END')
|    $i = 0
|    foreach ($s in @($Plan.Settings)) {
|        $i++
|        $p["N$i"] = [string]$s.Name; $p["S$i"] = [string]$s.Scope; $p["V$i"] = [string]$s.New
|        $null = $sb.AppendLine(("DECLARE @old$i nvarchar(max) = (SELECT ValueJson FROM cfg.Setting WHERE Name = @N$i AND Scope = @S$i);"))
|        $null = $sb.AppendLine(("IF EXISTS (SELECT 1 FROM cfg.Setting WHERE Name = @N$i AND Scope = @S$i) UPDATE cfg.Setting SET ValueJson = @V$i, KeyVaultSecretName = NULL, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @N$i AND Scope = @S$i;"))
|        $null = $sb.AppendLine(("ELSE INSERT cfg.Setting (Name, Scope, ValueJson, KeyVaultSecretName, UpdatedBy) VALUES (@N$i, @S$i, @V$i, NULL, @By);"))
|        $null = $sb.AppendLine(("INSERT cfg.ChangeLog (Name, Scope, Action, OldValue, NewValue, ChangedBy, Reason) VALUES (@N$i, @S$i, N'Set', @old$i, @V$i, @By, @Reason);"))
|    }
|    if ($Plan.FlowJson) {
|        $p.FlowJson = [string]$Plan.FlowJson
|        $null = $sb.AppendLine("UPDATE cfg.JobFlow SET DefinitionJson = @FlowJson, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE FlowId = N'daily';")
|    }
|    $p.MarkerValue = ([ordered]@{ region = $(if ($Region) { $Region } else { 'unknown' }); zone = $Zone; updater = ('23:00 ' + $Zone); pipeline = $(if (@($Plan.Settings).Count -or $Plan.FlowJson) { '23:30 ' + $Zone } else { 'kept' }); settings = @(@($Plan.Settings) | ForEach-Object { '{0} ({1})' -f $_.Name, $_.Scope }); at = [datetime]::UtcNow.ToString('o') } | ConvertTo-Json -Compress)
|    $null = $sb.AppendLine('INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@Marker, @MarkerValue, NULL, @By);')
|    $null = $sb.AppendLine('COMMIT;')
|    [pscustomobject]@{ Sql = $sb.ToString(); Params = $p }
|}
|
|function Invoke-SINightlyPipelineStart {
|    <#
|        The Pro database's part, once. -Sql { param($Query, $Params, $Mode) } ('reader' -> rows, 'nonquery'). -Zone: the
|        region's zone; -Region: the region (recorded). Never throws. Returns @{ Action = done | changed | kept | plan | failed; Lines }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Sql, [string]$Zone = $script:SINightly.Zone, [AllowEmptyString()][string]$Region = '', [switch]$WhatIf)
|    try {
|        $q = Get-SINightlyPipelineSql -Name Read
|        $rows = @(& $Sql $q.Sql $q.Params 'reader' | ForEach-Object { $_ } | Where-Object { $_ } | ForEach-Object { if ($_ -is [System.Collections.IDictionary]) { [pscustomobject]$_ } else { $_ } })
|        $done = [bool]@($rows | Where-Object { [string]$_.Kind -eq 'marker' }).Count
|        $oldDone = [bool]@($rows | Where-Object { [string]$_.Kind -eq 'oldmarker' }).Count
|        $flow = @($rows | Where-Object { [string]$_.Kind -eq 'flow' })[0]
|        $plan = Get-SINightlyPipelinePlan -Rows @($rows | Where-Object { [string]$_.Kind -eq 'setting' }) -FlowJson $(if ($flow -and -not ($flow.ValueJson -is [DBNull])) { [string]$flow.ValueJson } else { '' }) -Done $done -OldDone $oldDone -Zone $Zone
|        if ($plan.Done) { return [pscustomobject]@{ Action = 'done'; Lines = @() } }
|        if ($WhatIf) { return [pscustomobject]@{ Action = 'plan'; Lines = @($plan.Lines | ForEach-Object { '{0} (re-run with -Apply)' -f $_ }) } }
|        $a = Get-SINightlyPipelineSql -Name Apply -Plan $plan -Zone $Zone -Region $Region
|        $null = & $Sql $a.Sql $a.Params 'nonquery'
|        [pscustomobject]@{ Action = $(if (@($plan.Settings).Count -or $plan.FlowJson) { 'changed' } else { 'kept' }); Lines = @($plan.Lines) }
|    } catch { [pscustomobject]@{ Action = 'failed'; Lines = @(('The daily pipeline''s start time was not checked ({0}) -- the next update tries again.' -f $_.Exception.Message)) } }
|}
|
|function ConvertTo-SINightlyConfigText {
|    <#
|        PURE. config\SecurityInsight.custom.ps1 on a shipped start -> the region's zone (-Zone):
|          $global:SI_Pipeline_StartTime = '23:30' with SI_Pipeline_TimeZone 'Europe/Copenhagen' -> the zone line becomes -Zone;
|          the old '22:00' -> '23:30' and the zone line -Zone (changed, else added right after the start time), only with -MoveOld.
|        A commented line is not a setting and is left alone. $null = nothing to change.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Text, [string]$Zone = $script:SINightly.Zone, [bool]$MoveOld = $true)
|    if (-not "$Text") { return $null }
|    $rxStart = [regex]'(?m)^(?<pre>[ \t]*\$global:SI_Pipeline_StartTime[ \t]*=[ \t]*)(?<q>[''"])(?<v>[^''"\r\n]*)\k<q>'
|    $rxZone = [regex]'(?m)^(?<pre>[ \t]*\$global:SI_Pipeline_TimeZone[ \t]*=[ \t]*)(?<q>[''"])(?<v>[^''"\r\n]*)\k<q>'
|    $m = @($rxStart.Matches($Text))
|    if (-not $m.Count) { return $null }
|    $last = $m[-1]   # the last one wins in PowerShell
|    $z0 = @($rxZone.Matches($Text))
|    $setZone = { param($t)
|        $z = @($rxZone.Matches($t))
|        if ($z.Count) { $zl = $z[-1]; return ($t.Substring(0, $zl.Index) + $zl.Groups['pre'].Value + "'" + $Zone + "'" + $t.Substring($zl.Index + $zl.Length)) }
|        $at = [regex]::Match($t.Substring($last.Index), '\r?\n')
|        $nl = if ($t -match "`r`n") { "`r`n" } else { "`n" }
|        $line = "`$global:SI_Pipeline_TimeZone = '{0}'" -f $Zone
|        if ($at.Success) { $pos = $last.Index + $at.Index + $at.Length; return ($t.Substring(0, $pos) + $line + $nl + $t.Substring($pos)) }
|        $t + $nl + $line + $nl
|    }
|    if ($MoveOld -and (Test-SINightlyOldPipelineStart $last.Groups['v'].Value)) {
|        $out = $Text.Substring(0, $last.Index) + $last.Groups['pre'].Value + "'" + $script:SINightly.PipelineStart + "'" + $Text.Substring($last.Index + $last.Length)
|        return (& $setZone $out)
|    }
|    if ($z0.Count -and (Test-SINightlyShippedPipeline $last.Groups['v'].Value $z0[-1].Groups['v'].Value) -and $Zone -ne $script:SINightly.Zone) { return (& $setZone $Text) }
|    $null
|}
|
|function Invoke-SINightlyPipelineFiles {
|    <#
|        A folder install's part (Community; the files a container install shares with its jobs), once: -Root = the
|        SecurityInsight folder, -Zone = the region's zone. Only when config\SecurityInsight.custom.ps1 exists (an extracted
|        release has none: nothing done, nothing recorded). The marker .si-update\nightly-schedule-region.json records that it
|        ran; the Danish-time step's marker (nightly-schedule.json) means a 22:00 found now is the customer's. Never throws.
|        Returns @{ Action = none | done | changed | kept | plan | failed; Lines }.
|    #>
|    param([Parameter(Mandatory)][string]$Root, [string]$Zone = $script:SINightly.Zone, [AllowEmptyString()][string]$Region = '', [switch]$WhatIf)
|    try {
|        $cfg = [IO.Path]::Combine($Root, 'config', 'SecurityInsight.custom.ps1')
|        if (-not (Test-Path -LiteralPath $cfg)) { return [pscustomobject]@{ Action = 'none'; Lines = @() } }
|        $markerDir = [IO.Path]::Combine($Root, '.si-update')
|        $marker = [IO.Path]::Combine($markerDir, $script:SINightly.MarkerFile)
|        if (Test-Path -LiteralPath $marker) { return [pscustomobject]@{ Action = 'done'; Lines = @() } }
|        $moveOld = -not (Test-Path -LiteralPath ([IO.Path]::Combine($markerDir, $script:SINightly.OldMarkerFile)))
|        $flowFile = [IO.Path]::Combine($Root, 'config', 'job-flow.custom.json')
|        $read = { param($p) $b = [IO.File]::ReadAllBytes($p); $bom = ($b.Length -ge 3 -and $b[0] -eq 0xEF -and $b[1] -eq 0xBB -and $b[2] -eq 0xBF); [pscustomobject]@{ Text = [Text.Encoding]::UTF8.GetString($b, $(if ($bom) { 3 } else { 0 }), $b.Length - $(if ($bom) { 3 } else { 0 })); Bom = $bom } }
|        $c = & $read $cfg
|        $newCfg = ConvertTo-SINightlyConfigText -Text $c.Text -Zone $Zone -MoveOld $moveOld
|        $f = if (Test-Path -LiteralPath $flowFile) { & $read $flowFile } else { $null }
|        $newFlow = if ($f) { ConvertTo-SINightlyFlowJson -Json $f.Text -Zone $Zone -MoveOld $moveOld } else { $null }
|        $changed = [bool]($newCfg -or $newFlow)
|        $rxS = [regex]'(?m)^[ \t]*\$global:SI_Pipeline_StartTime[ \t]*=[ \t]*[''"](?<v>[^''"\r\n]*)[''"]'
|        $rxZ = [regex]'(?m)^[ \t]*\$global:SI_Pipeline_TimeZone[ \t]*=[ \t]*[''"](?<v>[^''"\r\n]*)[''"]'
|        $sM = @($rxS.Matches($c.Text)); $zM = @($rxZ.Matches($c.Text))
|        $shipped = $sM.Count -and $zM.Count -and (Test-SINightlyShippedPipeline $sM[-1].Groups['v'].Value $zM[-1].Groups['v'].Value)
|        $hasOwn = (-not $shipped) -and ($sM.Count -or ($f -and $f.Text -match '"startTime"'))
|        $line = Get-SINightlyPipelineLine -Zone $Zone -Changed $changed -HasOwn $hasOwn
|        if ($WhatIf) { return [pscustomobject]@{ Action = 'plan'; Lines = @($(if ($line) { '{0} (re-run with -Apply)' -f $line })) } }
|        $write = { param($p, $t, $bom) [IO.File]::WriteAllText($p, $t, (New-Object System.Text.UTF8Encoding($bom))) }
|        if ($newCfg) { & $write $cfg $newCfg $c.Bom }
|        if ($newFlow) { & $write $flowFile $newFlow $f.Bom }
|        if (-not (Test-Path -LiteralPath $markerDir)) { New-Item -ItemType Directory -Force -Path $markerDir | Out-Null }
|        [IO.File]::WriteAllText($marker, ([ordered]@{ region = $(if ($Region) { $Region } else { 'unknown' }); zone = $Zone; updater = ('23:00 ' + $Zone); pipeline = $(if ($changed) { '23:30 ' + $Zone } else { 'kept' }); at = [datetime]::UtcNow.ToString('o') } | ConvertTo-Json -Compress))
|        [pscustomobject]@{ Action = $(if ($changed) { 'changed' } else { 'kept' }); Lines = @($(if ($line) { $line })) }
|    } catch { [pscustomobject]@{ Action = 'failed'; Lines = @(('The daily pipeline''s start time was not checked ({0}) -- the next update tries again.' -f $_.Exception.Message)) } }
|}
|
|# ---------------------------------------------------------------------------------------------------------------------------
|# THE 19:00 MOVE of the pipeline start (owner 2026-10-21: "move the start time for all si jobs to 7pm on all sites" / "so they
|# are done next morning"), step 9l of the update, once, AFTER the region step. Shipped = the region step's value ('23:30' with
|# the region's zone); where the region step has not run yet (-RegionDone $false: a plan, or that step failed this time), also
|# the values IT would move ('23:30' Europe/Copenhagen; the old '22:00' where the Danish-time step never ran). Anything else is
|# the customer's. The zone is stored with the time.
|# ---------------------------------------------------------------------------------------------------------------------------
|
|function Test-SINightly1900ShippedStart {
|    <# PURE. Is -Start / -StartZone (JSON strings allowed; -StartZone may be $null) a shipped pipeline start for the 19:00 move, in the region zone -Zone? #>
|    param([AllowNull()]$Start, [AllowNull()]$StartZone, [string]$Zone = $script:SINightly.Zone, [bool]$RegionDone = $true, [bool]$OldDone = $true)
|    if ($null -eq $Start -or $Start -is [DBNull]) { return $false }
|    $s = ([string]$Start).Trim().Trim('"').Trim()
|    $z = if ($null -eq $StartZone -or $StartZone -is [DBNull]) { '' } else { ([string]$StartZone).Trim().Trim('"').Trim() }
|    if ($s -eq $script:SINightly.PipelineStart -and $z -eq $Zone) { return $true }
|    if ($RegionDone) { return $false }
|    if ($s -eq $script:SINightly.PipelineStart -and $z -eq $script:SINightly.Zone) { return $true }
|    (-not $OldDone) -and (Test-SINightlyOldPipelineStart $Start)
|}
|
|function ConvertTo-SINightly1900FlowJson {
|    <#
|        PURE. A stored pipeline (cfg.JobFlow / job-flow.custom.json) on a shipped start (Test-SINightly1900ShippedStart) ->
|        "startTime":"19:00" with "timeZone" -Zone. Only a definition that HAS a time zone (one stored before time zones reads
|        its time as UTC and is kept). The text is changed in place (the rest byte for byte). $null = nothing to change.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Json, [string]$Zone = $script:SINightly.Zone, [bool]$RegionDone = $true, [bool]$OldDone = $true)
|    if (-not "$Json".Trim()) { return $null }
|    $st = [regex]::Match($Json, '"startTime"\s*:\s*"([^"]*)"')
|    $tz = [regex]::Match($Json, '"timeZone"\s*:\s*"([^"]*)"')
|    if (-not $st.Success -or -not $tz.Success) { return $null }
|    if (-not (Test-SINightly1900ShippedStart $st.Groups[1].Value $tz.Groups[1].Value -Zone $Zone -RegionDone $RegionDone -OldDone $OldDone)) { return $null }
|    $parts = @(@{ M = $st; New = ('"startTime":"{0}"' -f $script:SINightly.Start) }, @{ M = $tz; New = ('"timeZone":"{0}"' -f $Zone) })
|    $out = $Json
|    foreach ($x in @($parts | Sort-Object { $_.M.Index } -Descending)) { $out = $out.Substring(0, $x.M.Index) + $x.New + $out.Substring($x.M.Index + $x.M.Length) }
|    $out
|}
|
|function Get-SINightly1900Line {
|    <# PURE. The one plain line for the customer. #>
|    param([string]$Zone, [bool]$Changed, [bool]$HasOwn)
|    if ($Changed) { return ('The daily pipeline now starts at {0} in {1} (the time zone of the install''s Azure region), after the nightly update at {2} -- so the night''s results are ready the next morning.' -f $script:SINightly.Start, $Zone, $script:SINightly.At) }
|    if ($HasOwn) { return 'The daily pipeline keeps the start time you chose.' }
|    ''
|}
|
|function Get-SINightly1900PipelinePlan {
|    <#
|        PURE. The Pro database's part of the 19:00 move: -Rows = cfg.Setting rows of SI_Pipeline_StartTime /
|        SI_Pipeline_TimeZone (Name, Scope, ValueJson), -FlowJson = cfg.JobFlow's daily definition, -Done = this step's marker,
|        -RegionDone / -OldDone = the region / Danish-time step's marker, -Zone = the region's zone. Returns @{ Done; Settings =
|        [@{ Name; Scope; Old; New; Insert }]; FlowJson; Lines }. Any other value is the customer's: nothing at that scope changes.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [AllowEmptyString()][AllowNull()][string]$FlowJson = '', [bool]$Done = $false,
|          [bool]$RegionDone = $true, [bool]$OldDone = $true, [string]$Zone = $script:SINightly.Zone)
|    if ($Done) { return [pscustomobject]@{ Done = $true; Settings = @(); FlowJson = $null; Lines = @() } }
|    $set = New-Object System.Collections.Generic.List[object]
|    $rows = @($Rows | Where-Object { $_ })
|    $zoneJson = '"{0}"' -f $Zone
|    $startRows = @($rows | Where-Object { [string]$_.Name -eq 'SI_Pipeline_StartTime' })
|    foreach ($r in $startRows) {
|        $scope = [string]$r.Scope
|        $z = @($rows | Where-Object { [string]$_.Name -eq 'SI_Pipeline_TimeZone' -and [string]$_.Scope -eq $scope })[0]
|        if (-not (Test-SINightly1900ShippedStart ([string]$r.ValueJson) $(if ($z) { [string]$z.ValueJson } else { $null }) -Zone $Zone -RegionDone $RegionDone -OldDone $OldDone)) { continue }
|        $set.Add([pscustomobject]@{ Name = 'SI_Pipeline_StartTime'; Scope = $scope; Old = [string]$r.ValueJson; New = ('"{0}"' -f $script:SINightly.Start); Insert = $false })
|        if (-not $z) { $set.Add([pscustomobject]@{ Name = 'SI_Pipeline_TimeZone'; Scope = $scope; Old = $null; New = $zoneJson; Insert = $true }) }
|        elseif (([string]$z.ValueJson).Trim() -ne $zoneJson) { $set.Add([pscustomobject]@{ Name = 'SI_Pipeline_TimeZone'; Scope = $scope; Old = [string]$z.ValueJson; New = $zoneJson; Insert = $false }) }
|    }
|    $flow = ConvertTo-SINightly1900FlowJson -Json $FlowJson -Zone $Zone -RegionDone $RegionDone -OldDone $OldDone
|    $changed = [bool]($set.Count -or $flow)
|    $hasOwn = (-not $changed) -and ($startRows.Count -or ([string]$FlowJson -match '"startTime"\s*:\s*"([^"]*)"'))
|    $l = Get-SINightly1900Line -Zone $Zone -Changed $changed -HasOwn $hasOwn
|    [pscustomobject]@{ Done = $false; Settings = $set.ToArray(); FlowJson = $flow; Lines = @($(if ($l) { $l })) }
|}
|
|function Get-SINightly1900PipelineSql {
|    <#
|        The Pro database's statements for the 19:00 move. 'Read': the three markers (this step's, the region step's, the
|        Danish-time step's), the two settings' rows and the daily pipeline. 'Apply' (-Plan): ONE transaction -- each setting
|        with its cfg.ChangeLog row (as Set-SIProSetting writes them), the pipeline definition, and the marker
|        'NightlySchedule1900' last; a marker that appeared meanwhile = nothing is written. Returns @{ Sql; Params }.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Read', 'Apply')][string]$Name, $Plan, [string]$By = $script:SINightly.By,
|          [string]$Zone = $script:SINightly.Zone, [AllowEmptyString()][string]$Region = '')
|    $S = $script:SINightly
|    if ($Name -eq 'Read') {
|        $q = "SELECT CASE WHEN Name = N'{0}' THEN N'marker1900' WHEN Name = N'{1}' THEN N'marker' ELSE N'oldmarker' END AS Kind, Name, CAST(N'' AS nvarchar(64)) AS Scope, Value AS ValueJson FROM cfg.InstallState WHERE OBJECT_ID(N'cfg.InstallState') IS NOT NULL AND Name IN (N'{0}', N'{1}', N'{2}')" -f $S.Marker1900, $S.Marker, $S.OldMarker
|        $q += "`nUNION ALL SELECT N'setting', Name, Scope, ValueJson FROM cfg.Setting WHERE Name IN (N'SI_Pipeline_StartTime', N'SI_Pipeline_TimeZone')"
|        $q += "`nUNION ALL SELECT N'flow', FlowId, CAST(N'' AS nvarchar(64)), DefinitionJson FROM cfg.JobFlow WHERE OBJECT_ID(N'cfg.JobFlow') IS NOT NULL AND FlowId = N'daily';"
|        return [pscustomobject]@{ Params = @{}; Sql = $q }
|    }
|    $p = [ordered]@{ By = $By; Reason = ('the nightly schedule: the update at {0} and the pipeline at {1} in {2}, the time zone of the install''s Azure region, so the night''s results are ready the next morning (owner decision 2026-10-21)' -f $S.At, $S.Start, $Zone)
|                     Marker = $S.Marker1900; MarkerValue = ''; FlowJson = [DBNull]::Value }
|    $sb = New-Object System.Text.StringBuilder
|    $null = $sb.AppendLine('SET XACT_ABORT ON;')
|    $null = $sb.AppendLine('BEGIN TRAN;')
|    $null = $sb.AppendLine('IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @Marker) BEGIN COMMIT; RETURN; END')
|    $i = 0
|    foreach ($row in @($Plan.Settings)) {   # not $s: PowerShell names are case-insensitive, $S is the schedule
|        $i++
|        $p["N$i"] = [string]$row.Name; $p["S$i"] = [string]$row.Scope; $p["V$i"] = [string]$row.New
|        $null = $sb.AppendLine(("DECLARE @old$i nvarchar(max) = (SELECT ValueJson FROM cfg.Setting WHERE Name = @N$i AND Scope = @S$i);"))
|        $null = $sb.AppendLine(("IF EXISTS (SELECT 1 FROM cfg.Setting WHERE Name = @N$i AND Scope = @S$i) UPDATE cfg.Setting SET ValueJson = @V$i, KeyVaultSecretName = NULL, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @N$i AND Scope = @S$i;"))
|        $null = $sb.AppendLine(("ELSE INSERT cfg.Setting (Name, Scope, ValueJson, KeyVaultSecretName, UpdatedBy) VALUES (@N$i, @S$i, @V$i, NULL, @By);"))
|        $null = $sb.AppendLine(("INSERT cfg.ChangeLog (Name, Scope, Action, OldValue, NewValue, ChangedBy, Reason) VALUES (@N$i, @S$i, N'Set', @old$i, @V$i, @By, @Reason);"))
|    }
|    if ($Plan.FlowJson) {
|        $p.FlowJson = [string]$Plan.FlowJson
|        $null = $sb.AppendLine("UPDATE cfg.JobFlow SET DefinitionJson = @FlowJson, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE FlowId = N'daily';")
|    }
|    $moved = [bool](@($Plan.Settings).Count -or $Plan.FlowJson)
|    $p.MarkerValue = ([ordered]@{ region = $(if ($Region) { $Region } else { 'unknown' }); zone = $Zone; updater = ($S.At + ' ' + $Zone); pipeline = $(if ($moved) { $S.Start + ' ' + $Zone } else { 'kept' }); settings = @(@($Plan.Settings) | ForEach-Object { '{0} ({1})' -f $_.Name, $_.Scope }); at = [datetime]::UtcNow.ToString('o') } | ConvertTo-Json -Compress)
|    $null = $sb.AppendLine('INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@Marker, @MarkerValue, NULL, @By);')
|    $null = $sb.AppendLine('COMMIT;')
|    [pscustomobject]@{ Sql = $sb.ToString(); Params = $p }
|}
|
|function Invoke-SINightly1900PipelineStart {
|    <#
|        The Pro database's part of the 19:00 move, once. -Sql { param($Query, $Params, $Mode) } ('reader' -> rows,
|        'nonquery'). -Zone: the region's zone; -Region: recorded. Never throws. Returns @{ Action = done | changed | kept |
|        plan | failed; Lines }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Sql, [string]$Zone = $script:SINightly.Zone, [AllowEmptyString()][string]$Region = '', [switch]$WhatIf)
|    try {
|        $q = Get-SINightly1900PipelineSql -Name Read
|        $rows = @(& $Sql $q.Sql $q.Params 'reader' | ForEach-Object { $_ } | Where-Object { $_ } | ForEach-Object { if ($_ -is [System.Collections.IDictionary]) { [pscustomobject]$_ } else { $_ } })
|        $kind = { param($k) [bool]@($rows | Where-Object { [string]$_.Kind -eq $k }).Count }
|        $flow = @($rows | Where-Object { [string]$_.Kind -eq 'flow' })[0]
|        $flowJson = if ($flow -and -not ($flow.ValueJson -is [DBNull])) { [string]$flow.ValueJson } else { '' }
|        $plan = Get-SINightly1900PipelinePlan -Rows @($rows | Where-Object { [string]$_.Kind -eq 'setting' }) -FlowJson $flowJson -Done (& $kind 'marker1900') -RegionDone (& $kind 'marker') -OldDone (& $kind 'oldmarker') -Zone $Zone
|        if ($plan.Done) { return [pscustomobject]@{ Action = 'done'; Lines = @() } }
|        if ($WhatIf) { return [pscustomobject]@{ Action = 'plan'; Lines = @($plan.Lines | ForEach-Object { '{0} (re-run with -Apply)' -f $_ }) } }
|        $a = Get-SINightly1900PipelineSql -Name Apply -Plan $plan -Zone $Zone -Region $Region
|        $null = & $Sql $a.Sql $a.Params 'nonquery'
|        [pscustomobject]@{ Action = $(if (@($plan.Settings).Count -or $plan.FlowJson) { 'changed' } else { 'kept' }); Lines = @($plan.Lines) }
|    } catch { [pscustomobject]@{ Action = 'failed'; Lines = @(('The daily pipeline''s start time was not checked ({0}) -- the next update tries again.' -f $_.Exception.Message)) } }
|}
|
|function ConvertTo-SINightly1900ConfigText {
|    <#
|        PURE. config\SecurityInsight.custom.ps1 on a shipped start (Test-SINightly1900ShippedStart: the last
|        $global:SI_Pipeline_StartTime with the last $global:SI_Pipeline_TimeZone) -> '19:00' and the zone line -Zone (changed,
|        else added right after the start time). A commented line is not a setting. $null = nothing to change.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Text, [string]$Zone = $script:SINightly.Zone, [bool]$RegionDone = $true, [bool]$OldDone = $true)
|    if (-not "$Text") { return $null }
|    $rxStart = [regex]'(?m)^(?<pre>[ \t]*\$global:SI_Pipeline_StartTime[ \t]*=[ \t]*)(?<q>[''"])(?<v>[^''"\r\n]*)\k<q>'
|    $rxZone = [regex]'(?m)^(?<pre>[ \t]*\$global:SI_Pipeline_TimeZone[ \t]*=[ \t]*)(?<q>[''"])(?<v>[^''"\r\n]*)\k<q>'
|    $m = @($rxStart.Matches($Text))
|    if (-not $m.Count) { return $null }
|    $last = $m[-1]
|    $z0 = @($rxZone.Matches($Text))
|    $zv = if ($z0.Count) { $z0[-1].Groups['v'].Value } else { $null }
|    if (-not (Test-SINightly1900ShippedStart $last.Groups['v'].Value $zv -Zone $Zone -RegionDone $RegionDone -OldDone $OldDone)) { return $null }
|    $t = $Text.Substring(0, $last.Index) + $last.Groups['pre'].Value + "'" + $script:SINightly.Start + "'" + $Text.Substring($last.Index + $last.Length)
|    $z = @($rxZone.Matches($t))
|    if ($z.Count) { $zl = $z[-1]; return ($t.Substring(0, $zl.Index) + $zl.Groups['pre'].Value + "'" + $Zone + "'" + $t.Substring($zl.Index + $zl.Length)) }
|    $at = [regex]::Match($t.Substring($last.Index), '\r?\n')
|    $nl = if ($t -match "`r`n") { "`r`n" } else { "`n" }
|    $line = "`$global:SI_Pipeline_TimeZone = '{0}'" -f $Zone
|    if ($at.Success) { $pos = $last.Index + $at.Index + $at.Length; return ($t.Substring(0, $pos) + $line + $nl + $t.Substring($pos)) }
|    $t + $nl + $line + $nl
|}
|
|function Invoke-SINightly1900PipelineFiles {
|    <#
|        A folder install's part of the 19:00 move (Community; the files a container install shares with its jobs), once:
|        -Root = the SecurityInsight folder, -Zone = the region's zone. Only when config\SecurityInsight.custom.ps1 exists. The
|        marker .si-update\nightly-schedule-1900.json records that it ran; the region step's marker (nightly-schedule-region.json)
|        and the Danish-time step's (nightly-schedule.json) say which earlier values are still shipped. Never throws.
|        Returns @{ Action = none | done | changed | kept | plan | failed; Lines }.
|    #>
|    param([Parameter(Mandatory)][string]$Root, [string]$Zone = $script:SINightly.Zone, [AllowEmptyString()][string]$Region = '', [switch]$WhatIf)
|    try {
|        $S = $script:SINightly
|        $cfg = [IO.Path]::Combine($Root, 'config', 'SecurityInsight.custom.ps1')
|        if (-not (Test-Path -LiteralPath $cfg)) { return [pscustomobject]@{ Action = 'none'; Lines = @() } }
|        $markerDir = [IO.Path]::Combine($Root, '.si-update')
|        $marker = [IO.Path]::Combine($markerDir, $S.MarkerFile1900)
|        if (Test-Path -LiteralPath $marker) { return [pscustomobject]@{ Action = 'done'; Lines = @() } }
|        $regionDone = Test-Path -LiteralPath ([IO.Path]::Combine($markerDir, $S.MarkerFile))
|        $oldDone = Test-Path -LiteralPath ([IO.Path]::Combine($markerDir, $S.OldMarkerFile))
|        $flowFile = [IO.Path]::Combine($Root, 'config', 'job-flow.custom.json')
|        $read = { param($p) $b = [IO.File]::ReadAllBytes($p); $bom = ($b.Length -ge 3 -and $b[0] -eq 0xEF -and $b[1] -eq 0xBB -and $b[2] -eq 0xBF); [pscustomobject]@{ Text = [Text.Encoding]::UTF8.GetString($b, $(if ($bom) { 3 } else { 0 }), $b.Length - $(if ($bom) { 3 } else { 0 })); Bom = $bom } }
|        $c = & $read $cfg
|        $newCfg = ConvertTo-SINightly1900ConfigText -Text $c.Text -Zone $Zone -RegionDone $regionDone -OldDone $oldDone
|        $f = if (Test-Path -LiteralPath $flowFile) { & $read $flowFile } else { $null }
|        $newFlow = if ($f) { ConvertTo-SINightly1900FlowJson -Json $f.Text -Zone $Zone -RegionDone $regionDone -OldDone $oldDone } else { $null }
|        $changed = [bool]($newCfg -or $newFlow)
|        $hasOwn = (-not $changed) -and (($c.Text -match '(?m)^[ \t]*\$global:SI_Pipeline_StartTime[ \t]*=') -or ($f -and $f.Text -match '"startTime"'))
|        $line = Get-SINightly1900Line -Zone $Zone -Changed $changed -HasOwn $hasOwn
|        if ($WhatIf) { return [pscustomobject]@{ Action = 'plan'; Lines = @($(if ($line) { '{0} (re-run with -Apply)' -f $line })) } }
|        $write = { param($p, $t, $bom) [IO.File]::WriteAllText($p, $t, (New-Object System.Text.UTF8Encoding($bom))) }
|        if ($newCfg) { & $write $cfg $newCfg $c.Bom }
|        if ($newFlow) { & $write $flowFile $newFlow $f.Bom }
|        if (-not (Test-Path -LiteralPath $markerDir)) { New-Item -ItemType Directory -Force -Path $markerDir | Out-Null }
|        [IO.File]::WriteAllText($marker, ([ordered]@{ region = $(if ($Region) { $Region } else { 'unknown' }); zone = $Zone; updater = ($S.At + ' ' + $Zone); pipeline = $(if ($changed) { $S.Start + ' ' + $Zone } else { 'kept' }); at = [datetime]::UtcNow.ToString('o') } | ConvertTo-Json -Compress))
|        [pscustomobject]@{ Action = $(if ($changed) { 'changed' } else { 'kept' }); Lines = @($(if ($line) { $line })) }
|    } catch { [pscustomobject]@{ Action = 'failed'; Lines = @(('The daily pipeline''s start time was not checked ({0}) -- the next update tries again.' -f $_.Exception.Message)) } }
|}
|
|# ---- #986 (found 2026-10-31): THE PIPELINE'S START TIME IS NOT IN A JOB'S ENVIRONMENT ON A PRO INSTALL -----------------------
|# Bootstrap passed every setting the customer's config sets to every job as SI_CFG_<name>, the pipeline's start time and zone
|# too. On a Pro install the pipeline runner reads them from the database (cfg.JobFlow / cfg.Setting) and the job's copy went
|# stale: one install's job said SI_CFG_SI_Pipeline_StartTime=22:00 / Europe/Paris (21:00Z) while its runs started at
|# 19:00 Europe/Amsterdam (18:00Z) -- a person reading the job expected a run that never came. New installs no longer write
|# them (Get-SIConfigDbOwnedNames); this step brings EXISTING Pro installs to that state (owner rule: existing installs reach
|# the new-install state): the two entries are removed from every job that carries them -- nothing else of the job changes.
|# A start time the customer chose that exists ONLY in a job's environment (no cfg.Setting row at any scope, no start time in
|# the stored pipeline) is written to cfg.Setting first, with its change-log row, so no start time changes. A shipped value
|# (22:00 / 23:30 / 19:00) is never written: the database's own (or the default) is the start time already.
|$script:SINightlyJobEnvNames = @('SI_CFG_SI_Pipeline_StartTime', 'SI_CFG_SI_Pipeline_TimeZone')
|$script:SINightlyShippedStarts = @('22:00', '23:30', '19:00')
|
|function Get-SINightlyArmProp {
|    <# PURE. A property of a parsed ARM object, $null when absent. #>
|    param($Object, [string[]]$Path)
|    $o = $Object
|    foreach ($p in $Path) {
|        if ($null -eq $o) { return $null }
|        if ($o -is [System.Collections.IDictionary]) { if ($o.Contains($p)) { $o = $o[$p] } else { return $null }; continue }
|        $pp = $o.PSObject.Properties[$p]; if (-not $pp) { return $null }; $o = $pp.Value
|    }
|    $o
|}
|
|function Get-SINightlyJobEnvPlan {
|    <#
|        PURE. -Jobs: the resource group's jobs as ARM lists them; -Rows: cfg.Setting rows of SI_Pipeline_StartTime /
|        SI_Pipeline_TimeZone (Name, Scope, ValueJson); -FlowJson: the stored daily pipeline. Returns @{ Jobs = [@{ Name; Body
|        (the PATCH: the job's template with the two entries gone from every container); Removed }]; Settings = [@{ Name; Scope;
|        New }] (a customer's own start time kept in the database first); Lines }. Nothing to do = no jobs, no settings.
|    #>
|    param([object[]]$Jobs = @(), [AllowEmptyCollection()][object[]]$Rows = @(), [AllowEmptyString()][AllowNull()][string]$FlowJson = '')
|    $names = $script:SINightlyJobEnvNames
|    $patches = New-Object System.Collections.Generic.List[object]
|    $seen = [ordered]@{}
|    foreach ($j in @($Jobs | Where-Object { $_ })) {
|        $tpl = Get-SINightlyArmProp $j @('properties', 'template')
|        $cts = @(Get-SINightlyArmProp $tpl @('containers') | Where-Object { $_ })
|        $hit = @()
|        foreach ($ct in $cts) {
|            foreach ($e in @(Get-SINightlyArmProp $ct @('env') | Where-Object { $_ })) {
|                $n = [string](Get-SINightlyArmProp $e @('name'))
|                if ($names -contains $n) { $hit += $n; if (-not $seen.Contains($n)) { $v = Get-SINightlyArmProp $e @('value'); if ($null -ne $v) { $seen[$n] = [string]$v } } }
|            }
|        }
|        if (-not $hit.Count) { continue }
|        $t = [ordered]@{}; foreach ($p in $tpl.PSObject.Properties) { $t[$p.Name] = $p.Value }
|        $t['containers'] = @(foreach ($ct in $cts) {
|            $copy = [ordered]@{}; foreach ($p in $ct.PSObject.Properties) { $copy[$p.Name] = $p.Value }
|            # (not "$env": that name is the environment drive)
|            $kept = @(Get-SINightlyArmProp $ct @('env') | Where-Object { $_ -and $names -notcontains [string](Get-SINightlyArmProp $_ @('name')) })
|            $copy['env'] = $kept
|            $copy
|        })
|        $patches.Add([pscustomobject]@{ Name = [string](Get-SINightlyArmProp $j @('name')); Body = [ordered]@{ properties = [ordered]@{ template = $t } }; Removed = @($hit | Select-Object -Unique) })
|    }
|    $settings = New-Object System.Collections.Generic.List[object]
|    $lines = New-Object System.Collections.Generic.List[string]
|    $start = if ($seen.Contains('SI_CFG_SI_Pipeline_StartTime')) { "$($seen['SI_CFG_SI_Pipeline_StartTime'])".Trim() } else { '' }
|    $zone = if ($seen.Contains('SI_CFG_SI_Pipeline_TimeZone')) { "$($seen['SI_CFG_SI_Pipeline_TimeZone'])".Trim() } else { '' }
|    $dbHasStart = [bool]@($Rows | Where-Object { $_ -and [string]$_.Name -eq 'SI_Pipeline_StartTime' }).Count
|    $flowHasStart = [string]$FlowJson -match '"startTime"\s*:\s*"[^"]+"'
|    if ($patches.Count -and $start -match '^([01]\d|2[0-3]):[0-5]\d$' -and $script:SINightlyShippedStarts -notcontains $start -and -not $dbHasStart -and -not $flowHasStart) {
|        $settings.Add([pscustomobject]@{ Name = 'SI_Pipeline_StartTime'; Scope = 'global'; New = ('"{0}"' -f $start) })
|        if ($zone) { $settings.Add([pscustomobject]@{ Name = 'SI_Pipeline_TimeZone'; Scope = 'global'; New = ('"{0}"' -f $zone) }) }
|        $lines.Add(('The daily pipeline''s start time you chose ({0}{1}) was kept only in the jobs'' settings -- it is now kept in the database, its one place.' -f $start, $(if ($zone) { " $zone" } else { '' })))
|    }
|    if ($patches.Count) {
|        $lines.Add(('The daily pipeline''s start time is read from the database only: the copy in the job settings is removed from {0} ({1}) -- it could differ from the time the runs really start.' -f $(if ($patches.Count -eq 1) { 'one job' } else { "$($patches.Count) jobs" }), (($patches | ForEach-Object { $_.Name }) -join ', ')))
|    }
|    [pscustomobject]@{ Jobs = $patches.ToArray(); Settings = $settings.ToArray(); Lines = $lines.ToArray() }
|}
|
|function Get-SINightlyJobEnvSettingSql {
|    <# The statement that keeps a customer's own start time in the database (-Plan.Settings): ONE transaction, a row only where
|       none exists at that scope, each with its cfg.ChangeLog row (as Set-SIProSetting writes them). Returns @{ Sql; Params }. #>
|    param([Parameter(Mandatory)]$Plan, [string]$By = $script:SINightly.By)
|    $p = [ordered]@{ By = $By; Reason = 'the pipeline''s start time is kept in the database only (it was found only in the jobs'' settings)' }
|    $sb = New-Object System.Text.StringBuilder
|    $null = $sb.AppendLine('SET XACT_ABORT ON;')
|    $null = $sb.AppendLine('BEGIN TRAN;')
|    $i = 0
|    foreach ($row in @($Plan.Settings)) {
|        $i++
|        $p["N$i"] = [string]$row.Name; $p["S$i"] = [string]$row.Scope; $p["V$i"] = [string]$row.New
|        $null = $sb.AppendLine(("IF NOT EXISTS (SELECT 1 FROM cfg.Setting WITH (UPDLOCK, HOLDLOCK) WHERE Name = @N$i AND Scope = @S$i)"))
|        $null = $sb.AppendLine('BEGIN')
|        $null = $sb.AppendLine(("    INSERT cfg.Setting (Name, Scope, ValueJson, KeyVaultSecretName, UpdatedBy) VALUES (@N$i, @S$i, @V$i, NULL, @By);"))
|        $null = $sb.AppendLine(("    INSERT cfg.ChangeLog (Name, Scope, Action, OldValue, NewValue, ChangedBy, Reason) VALUES (@N$i, @S$i, N'Set', NULL, @V$i, @By, @Reason);"))
|        $null = $sb.AppendLine('END')
|    }
|    $null = $sb.AppendLine('COMMIT;')
|    [pscustomobject]@{ Sql = $sb.ToString(); Params = $p }
|}
|
|function Invoke-SINightlyJobEnvCleanup {
|    <#
|        #986: the pipeline's start time out of every job's environment on a Pro install (Get-SINightlyJobEnvPlan): a customer's
|        own start time found only there is kept in the database first; then one PATCH per job that carries it (its template,
|        the two entries gone), read back. -Rest: the update's REST seam; -Sql { param($Query, $Params, $Mode) }: the Pro
|        database. Never throws. Returns @{ Action = none | plan | changed | failed; Lines }.
|    #>
|    param([Parameter(Mandatory)]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [Parameter(Mandatory)][scriptblock]$Sql, [switch]$WhatIf, [string]$ApiVersion = '2025-07-01', [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $lines = New-Object System.Collections.Generic.List[string]
|    $arm = 'https://management.azure.com'
|    $base = 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs' -f $SubscriptionId, $ResourceGroup
|    $out = { param($a) [pscustomobject]@{ Action = $a; Lines = $lines.ToArray() } }
|    try {
|        $g = & $Rest 'GET' ('{0}?api-version={1}' -f $base, $ApiVersion) $null $arm @{}
|        if (-not $g -or [int]$g.Status -ne 200) { $lines.Add(('The jobs could not be read (HTTP {0}) -- the pipeline''s start time in their settings is checked on the next update.' -f $(if ($g) { $g.Status } else { 0 }))); return (& $out 'failed') }
|        $jobs = @(([string]$g.Body | ConvertFrom-Json).value)
|        $q = Get-SINightly1900PipelineSql -Name Read
|        $rows = @(& $Sql $q.Sql $q.Params 'reader' | ForEach-Object { $_ } | Where-Object { $_ } | ForEach-Object { if ($_ -is [System.Collections.IDictionary]) { [pscustomobject]$_ } else { $_ } })
|        $flow = @($rows | Where-Object { [string]$_.Kind -eq 'flow' })[0]
|        $plan = Get-SINightlyJobEnvPlan -Jobs $jobs -Rows @($rows | Where-Object { [string]$_.Kind -eq 'setting' }) -FlowJson $(if ($flow -and -not ($flow.ValueJson -is [DBNull])) { [string]$flow.ValueJson } else { '' })
|        if (-not @($plan.Jobs).Count) { return (& $out 'none') }
|        if ($WhatIf) { foreach ($l in @($plan.Lines)) { $lines.Add(('{0} (re-run with -Apply)' -f $l)) }; return (& $out 'plan') }
|        if (@($plan.Settings).Count) { $a = Get-SINightlyJobEnvSettingSql -Plan $plan; $null = & $Sql $a.Sql $a.Params 'nonquery' }
|        $failed = New-Object System.Collections.Generic.List[string]
|        foreach ($p in @($plan.Jobs)) {
|            $uri = '{0}/{1}?api-version={2}' -f $base, $p.Name, $ApiVersion
|            $r = & $Rest 'PATCH' $uri ($p.Body | ConvertTo-Json -Depth 20 -Compress) $arm @{ 'Content-Type' = 'application/json' }
|            if (-not $r -or [int]$r.Status -lt 200 -or [int]$r.Status -ge 300) { $failed.Add(('{0} (HTTP {1})' -f $p.Name, $(if ($r) { $r.Status } else { 0 }))); continue }
|            # read back: ARM answers the PATCH before the job carries it
|            $ok = $false
|            for ($i = 0; $i -lt 6 -and -not $ok; $i++) {
|                if ($i) { & $Sleep 5 }
|                $b = & $Rest 'GET' $uri $null $arm @{}
|                if ($b -and [int]$b.Status -eq 200) { $ok = -not @((Get-SINightlyJobEnvPlan -Jobs @([string]$b.Body | ConvertFrom-Json)).Jobs).Count }
|            }
|            if (-not $ok) { $failed.Add(('{0} (did not read back as changed)' -f $p.Name)) }
|        }
|        foreach ($l in @($plan.Lines)) { $lines.Add($l) }
|        if ($failed.Count) { $lines.Add(('The start time is still in the settings of {0} -- the next update removes it.' -f ($failed -join ', '))); return (& $out 'failed') }
|        & $out 'changed'
|    } catch { $lines.Add(('The pipeline''s start time in the job settings was not checked ({0}) -- the next update tries again.' -f $_.Exception.Message)); & $out 'failed' }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-ReportCopyDefault.ps1'] = @{ Sha256 = '32164aee03d1a6c7fb58e274dfa24167156fefb580848fd06daa57e282660d5c'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- #830 (owner 2026-10-20): THE COPY OF THE RISK ANALYSIS REPORT ROWS TO LOG ANALYTICS IS AN OPTIONAL
|    OUTPUT, OFF BY DEFAULT IN EVERY INSTALL ("Copy Risk Analysis report rows to Log Analytics (SI_RiskAnalysis_Detailed_CL)",
|    the setting SendToLogAnalytics). SecurityInsight reads the Risk Analysis result from its database; the copy is for the
|    customer's own workbooks, Sentinel or KQL.
|
|    EXISTING INSTALLS reach the new-install state through the update, ONCE (cfg.InstallState 'ReportRowCopyDefault'), the
|    rule "every setup default change needs an updater step". What setup WROTE is moved; what a PERSON chose stays:
|      * until now every guided install carried the copy ON without anyone choosing it: the generated config file wrote
|        `$global:SendToLogAnalytics = $true` (imported into cfg.Setting with UpdatedBy '<who> (import)'), the Risk Analysis
|        jobs were made with SI_RA_SEND_TO_LOG_ANALYTICS=1, and the defaults file said $true;
|      * so a stored value that is ON is a SHIPPED value when its row was written by an import, by setup or by an update
|        (Test-SIReportCopyShippedWriter) -- it is set to off, with its change-log row; a value ON that a person set on the
|        Settings page (UpdatedBy = that person) is KEPT, said in one line;
|      * an install with no stored value at all gets the solution-wide value off: the database's value is applied after the
|        job's environment (the Pro settings layer), so a job made with SI_RA_SEND_TO_LOG_ANALYTICS=1 follows it -- nothing
|        on the jobs is changed;
|      * a NEW install writes the marker itself (Get-SIReportCopyInstallMarkerSql), so the step finds nothing to do.
|    What cannot be told apart: a value a person once typed into the config file and imported looks exactly like the
|    shipped line -- it is turned off too, and the one line says how to turn it on again (the Settings page).
|    PURE planning (Get-SIReportCopyPlan) over a SQL seam; never throws (Invoke-SIReportCopyDefault).
|#>
|
|$script:SIReportCopy = @{ Marker = 'ReportRowCopyDefault'; By = 'SecurityInsight update'; Name = 'SendToLogAnalytics'; Scope = 'solution' }
|
|function Test-SIReportCopyValueOn {
|    <# PURE. A stored value (cfg.Setting.ValueJson) that is ON -- the engine's rule (Test-SIRaReportCopyOn): true / 1 / "on" / "yes". #>
|    param([AllowNull()][AllowEmptyString()][string]$ValueJson)
|    $v = ([string]$ValueJson).Trim().Trim('"').Trim().ToLowerInvariant()
|    $v -in 'true', '1', 'yes', 'on'
|}
|
|function Test-SIReportCopyShippedWriter {
|    <#
|        PURE. Was the row written by SecurityInsight (an import of the generated config file, setup, an update) rather than by
|        a person on the Settings page? '<who> (import)', 'guided install', 'setup ...', 'SecurityInsight update' (and an empty
|        writer) are SecurityInsight's; anything else is a person.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$UpdatedBy)
|    $b = ([string]$UpdatedBy).Trim()
|    if (-not $b) { return $true }
|    ($b -match '\(import\)\s*$') -or ($b -match '^(?i)(guided install|setup\b|securityinsight update|securityinsight setup|install\b)')
|}
|
|function Get-SIReportCopyPlan {
|    <#
|        PURE. -Rows: the stored values of SendToLogAnalytics (Scope, ValueJson, UpdatedBy); -Done: the marker is there.
|        Returns @{ Done; Settings (@{ Scope; New; Insert }); Kept (scopes a person set on); Lines }.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [bool]$Done = $false)
|    $g = { param($r, $n) if ($r -is [System.Collections.IDictionary]) { $r[$n] } else { $p = $r.PSObject.Properties[$n]; if ($p) { $p.Value } else { $null } } }
|    $set = New-Object System.Collections.Generic.List[object]; $kept = New-Object System.Collections.Generic.List[string]; $lines = New-Object System.Collections.Generic.List[string]
|    if ($Done) { return [pscustomobject]@{ Done = $true; Settings = @(); Kept = @(); Lines = @() } }
|    $rows = @($Rows | Where-Object { $_ })
|    foreach ($r in $rows) {
|        $scope = [string](& $g $r 'Scope'); $val = [string](& $g $r 'ValueJson'); $by = [string](& $g $r 'UpdatedBy')
|        if (-not (Test-SIReportCopyValueOn $val)) { continue }
|        if (Test-SIReportCopyShippedWriter $by) { $set.Add([pscustomobject]@{ Scope = $scope; New = 'false'; Insert = $false }) }
|        else { $kept.Add($scope); $lines.Add(('report rows: the copy of the Risk Analysis report rows to Log Analytics stays ON ({0}) -- set by {1} on the Settings page' -f $scope, $by)) }
|    }
|    if ($rows.Count -eq 0) { $set.Add([pscustomobject]@{ Scope = $script:SIReportCopy.Scope; New = 'false'; Insert = $true }) }
|    if ($set.Count) {
|        $lines.Add('report rows: the copy of the Risk Analysis report rows to Log Analytics (SI_RiskAnalysis_Detailed_CL) is now off, as in a new install -- SecurityInsight reads the results from its database; your own workbooks, Sentinel rules or KQL on that table need it on again (Settings: Copy Risk Analysis report rows to Log Analytics)')
|    }
|    [pscustomobject]@{ Done = $false; Settings = $set.ToArray(); Kept = $kept.ToArray(); Lines = $lines.ToArray() }
|}
|
|function Get-SIReportCopySql {
|    <#
|        The Pro database's statements. 'Read': the marker and the stored values. 'Apply' (-Plan): ONE transaction -- each value
|        written with its cfg.ChangeLog row (the Settings page's history shows it), the marker last; a marker that appeared
|        meanwhile = nothing is written. Returns @{ Sql; Params }.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Read', 'Apply')][string]$Name, $Plan, [string]$By = $script:SIReportCopy.By)
|    if ($Name -eq 'Read') {
|        return [pscustomobject]@{ Params = @{ Marker = $script:SIReportCopy.Marker; Setting = $script:SIReportCopy.Name }; Sql = @'
|SELECT N'marker' AS Kind, CAST(N'' AS nvarchar(64)) AS Scope, Value AS ValueJson, UpdatedBy FROM cfg.InstallState WHERE OBJECT_ID(N'cfg.InstallState') IS NOT NULL AND Name = @Marker
|UNION ALL SELECT N'setting', Scope, ValueJson, UpdatedBy FROM cfg.Setting WHERE Name = @Setting;
|'@ }
|    }
|    $p = [ordered]@{ By = $By; Marker = $script:SIReportCopy.Marker; Setting = $script:SIReportCopy.Name; MarkerValue = ''
|                     Reason = 'the copy of the Risk Analysis report rows to Log Analytics is an optional output, off by default in every install (owner decision 2026-10-20)' }
|    $sb = New-Object System.Text.StringBuilder
|    $null = $sb.AppendLine('SET XACT_ABORT ON;')
|    $null = $sb.AppendLine('BEGIN TRAN;')
|    $null = $sb.AppendLine('IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @Marker) BEGIN COMMIT; RETURN; END')
|    $i = 0
|    foreach ($s in @($Plan.Settings)) {
|        $i++
|        $p["S$i"] = [string]$s.Scope; $p["V$i"] = [string]$s.New
|        $null = $sb.AppendLine(("DECLARE @old$i nvarchar(max) = (SELECT ValueJson FROM cfg.Setting WHERE Name = @Setting AND Scope = @S$i);"))
|        $null = $sb.AppendLine(("IF EXISTS (SELECT 1 FROM cfg.Setting WHERE Name = @Setting AND Scope = @S$i) UPDATE cfg.Setting SET ValueJson = @V$i, KeyVaultSecretName = NULL, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @Setting AND Scope = @S$i;"))
|        $null = $sb.AppendLine(("ELSE INSERT cfg.Setting (Name, Scope, ValueJson, KeyVaultSecretName, UpdatedBy) VALUES (@Setting, @S$i, @V$i, NULL, @By);"))
|        $null = $sb.AppendLine(("INSERT cfg.ChangeLog (Name, Scope, Action, OldValue, NewValue, ChangedBy, Reason) VALUES (@Setting, @S$i, N'Set', @old$i, @V$i, @By, @Reason);"))
|    }
|    $p.MarkerValue = ([ordered]@{ off = @(@($Plan.Settings) | ForEach-Object { [string]$_.Scope }); kept = @($Plan.Kept); by = 'update'; at = [datetime]::UtcNow.ToString('o') } | ConvertTo-Json -Compress)
|    $null = $sb.AppendLine('INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@Marker, @MarkerValue, NULL, @By);')
|    $null = $sb.AppendLine('COMMIT;')
|    [pscustomobject]@{ Sql = $sb.ToString(); Params = $p }
|}
|
|function Get-SIReportCopyInstallMarkerSql {
|    <# PURE. A NEW Pro install's marker (the update's one-time step then has nothing to move); only when the table exists and the marker is not there. #>
|    param([string]$By = 'guided install')
|    $q = { param($s) ([string]$s).Replace("'", "''") }
|    "IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL AND NOT EXISTS (SELECT 1 FROM cfg.InstallState WHERE Name = N'{0}') INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'{0}', N'{1}', NULL, N'{2}');" -f (& $q $script:SIReportCopy.Marker), (& $q '{"off":[],"kept":[],"by":"install"}'), (& $q $By)
|}
|
|function Invoke-SIReportCopyDefault {
|    <#
|        The Pro database's part, once. -Sql { param($Query, $Params, $Mode) } ('reader' -> rows, 'nonquery'). Never throws.
|        Returns @{ Action = done | changed | kept | plan | failed; Lines }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Sql, [switch]$WhatIf)
|    try {
|        $q = Get-SIReportCopySql -Name Read
|        $rows = @(& $Sql $q.Sql $q.Params 'reader' | ForEach-Object { $_ } | Where-Object { $_ } | ForEach-Object { if ($_ -is [System.Collections.IDictionary]) { [pscustomobject]$_ } else { $_ } })
|        $plan = Get-SIReportCopyPlan -Rows @($rows | Where-Object { [string]$_.Kind -eq 'setting' }) -Done ([bool]@($rows | Where-Object { [string]$_.Kind -eq 'marker' }).Count)
|        if ($plan.Done) { return [pscustomobject]@{ Action = 'done'; Lines = @() } }
|        if ($WhatIf) { return [pscustomobject]@{ Action = 'plan'; Lines = @($plan.Lines | ForEach-Object { '{0} (re-run with -Apply)' -f $_ }) } }
|        $a = Get-SIReportCopySql -Name Apply -Plan $plan
|        $null = & $Sql $a.Sql $a.Params 'nonquery'
|        [pscustomobject]@{ Action = $(if (@($plan.Settings).Count) { 'changed' } else { 'kept' }); Lines = @($plan.Lines) }
|    } catch {
|        [pscustomobject]@{ Action = 'failed'; Lines = @(('report rows: the copy of the report rows to Log Analytics was not checked ({0}) -- the update goes on; the next update tries again' -f $_.Exception.Message)) }
|    }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-OwnSqlConnector.ps1'] = @{ Sha256 = 'adf54933c5759f147b8566f3d502f59bc52d93954f65df56501d0e2f1cb13c49'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- #865 (owner 2026-10-21: "turn off test mode, my mistake" / "for the sql it should be on always"):
|    SI'S OWN SQL CLOSE-LOOP TARGET IS ALWAYS ON.
|
|    The connector of kind sql, direction vulnerability (`vulnerability-sql`) is SecurityInsight's own record of every
|    vulnerability's lifecycle -- the source of Changes & trends > Vulnerabilities over time and Vulnerabilities per
|    collection. The import created it with Mode 'whatif', AllowCreate 0, AllowClose 0, so it recorded nothing and both pages
|    stayed empty. New installs / the import now create it apply + create + close (Get-SIConnectorImportPlan); the web app
|    saves it so (ConnectorRepository.AlwaysOn).
|
|    EXISTING INSTALLS reach that state through the update (Invoke-SIContainerUpdate.ps1 step 9k), on EVERY update -- the
|    rule is "always on", not a one-time default, so there is no marker:
|      * every cfg.Connector row of kind sql + direction vulnerability that is not apply / create / close is set to
|        Mode 'apply', AllowCreate 1, AllowClose 1 -- ONE transaction per connector with its cfg.ChangeLog row
|        (Name 'connector/<name>', Scope 'connector', Kind 'connector'; the Connectors page's history shows it), only while
|        the row is still off (a row a person changed meanwhile is left);
|      * READ BACK afterwards: a row that did not reach apply / create / close is said, as a warning;
|      * a connector to a CUSTOMER system (servicenow, rest) and the SQL CMDB hand-off (sql + cmdb) are never touched --
|        the statements name kind 'sql' AND direction 'vulnerability';
|      * Enabled is left as it is (switching a connector on or off stays the customer's); a switched-off one is said.
|    Pro only (the Pro database). Never throws (Invoke-SIOwnSqlConnectorOn); -WhatIf (-DetectOnly) plans only.
|    PURE planning (Get-SIOwnSqlConnectorPlan) over a SQL seam.
|#>
|
|$script:SIOwnSqlConnector = @{
|    By     = 'SecurityInsight update'
|    Reason = 'SecurityInsight''s own SQL vulnerability target is always on (apply, create and close): in test mode it records nothing and Changes & trends stays empty (owner decision 2026-10-21)'
|}
|
|function Test-SIOwnSqlConnectorOn {
|    <# PURE. Is the row on: Mode apply, AllowCreate and AllowClose set (bit, int, bool or text). #>
|    param([Parameter(Mandatory)]$Row)
|    $g = { param($r, $n) if ($r -is [System.Collections.IDictionary]) { $r[$n] } else { $p = $r.PSObject.Properties[$n]; if ($p) { $p.Value } else { $null } } }
|    $bit = { param($v) if ($v -is [bool]) { $v } else { [string]$v -match '^(?i)(1|true)$' } }
|    ([string](& $g $Row 'Mode')).Trim().ToLowerInvariant() -eq 'apply' -and (& $bit (& $g $Row 'AllowCreate')) -and (& $bit (& $g $Row 'AllowClose'))
|}
|
|function Get-SIOwnSqlConnectorPlan {
|    <#
|        PURE. -Rows: the cfg.Connector rows (Name, Kind, Direction, Enabled, Mode, AllowCreate, AllowClose). Only kind sql +
|        direction vulnerability are looked at. Returns @{ Change = @(names); Same = @(names); Off = @(switched-off names); Lines }.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @())
|    $g = { param($r, $n) if ($r -is [System.Collections.IDictionary]) { $r[$n] } else { $p = $r.PSObject.Properties[$n]; if ($p) { $p.Value } else { $null } } }
|    $change = New-Object System.Collections.Generic.List[string]; $same = New-Object System.Collections.Generic.List[string]
|    $off = New-Object System.Collections.Generic.List[string]; $lines = New-Object System.Collections.Generic.List[string]
|    foreach ($r in @($Rows | Where-Object { $_ })) {
|        $kind = ([string](& $g $r 'Kind')).Trim().ToLowerInvariant(); $dir = ([string](& $g $r 'Direction')).Trim().ToLowerInvariant()
|        if (-not $dir) { $dir = 'vulnerability' }
|        if ($kind -ne 'sql' -or $dir -ne 'vulnerability') { continue }
|        $name = [string](& $g $r 'Name')
|        if (Test-SIOwnSqlConnectorOn -Row $r) { $same.Add($name) } else { $change.Add($name) }
|        if (-not ([string](& $g $r 'Enabled') -match '^(?i)(1|true)$')) { $off.Add($name) }
|    }
|    foreach ($n in $change) {
|        $lines.Add(("connectors: SecurityInsight's own SQL vulnerability target '{0}' was in test mode (or could not create / close) -- now apply, create and close, so it records every vulnerability's lifecycle (Changes & trends > Vulnerabilities over time / per collection)" -f $n))
|    }
|    foreach ($n in $off) {
|        $lines.Add(("connectors: SecurityInsight's own SQL vulnerability target '{0}' is switched off -- Changes & trends > Vulnerabilities over time stays empty until it is switched on (Connectors)" -f $n))
|    }
|    [pscustomobject]@{ Change = $change.ToArray(); Same = $same.ToArray(); Off = $off.ToArray(); Lines = $lines.ToArray() }
|}
|
|function Get-SIOwnSqlConnectorSql {
|    <#
|        The Pro database's statements. 'Read': the connectors (none when the table does not exist). 'Apply' (-Name): ONE
|        transaction -- the row set to apply / create / close with its cfg.ChangeLog row, only while it is still off and still
|        sql + vulnerability; returns Outcome 'changed' | 'same'. Returns @{ Sql; Params }.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Read', 'Apply')][string]$Statement, [string]$Name, [string]$By = $script:SIOwnSqlConnector.By)
|    if ($Statement -eq 'Read') {
|        return [pscustomobject]@{ Params = @{}; Sql = @'
|IF OBJECT_ID(N'cfg.Connector') IS NOT NULL
|SELECT Name, Kind, Direction, CONVERT(int, Enabled) AS Enabled, Mode, CONVERT(int, AllowCreate) AS AllowCreate, CONVERT(int, AllowClose) AS AllowClose
|FROM cfg.Connector ORDER BY Name;
|'@ }
|    }
|    [pscustomobject]@{ Params = [ordered]@{ Name = $Name; By = $By; Reason = $script:SIOwnSqlConnector.Reason }; Sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @old nvarchar(max) = (SELECT c.Name, c.Kind, c.Direction, c.Enabled, c.Mode, c.AllowCreate, c.AllowClose, c.SettingsJson, c.SecretRefsJson, c.MappingJson
|    FROM cfg.Connector c WITH (UPDLOCK, HOLDLOCK)
|    WHERE c.Name = @Name AND LOWER(c.Kind) = N'sql' AND LOWER(c.Direction) = N'vulnerability' AND (c.Mode <> N'apply' OR c.AllowCreate = 0 OR c.AllowClose = 0)
|    FOR JSON PATH, WITHOUT_ARRAY_WRAPPER);
|IF @old IS NULL
|BEGIN
|    COMMIT;
|    SELECT N'same' AS Outcome;
|    RETURN;
|END;
|UPDATE cfg.Connector SET Mode = N'apply', AllowCreate = 1, AllowClose = 1, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By
|WHERE Name = @Name AND LOWER(Kind) = N'sql' AND LOWER(Direction) = N'vulnerability';
|DECLARE @new nvarchar(max) = (SELECT c.Name, c.Kind, c.Direction, c.Enabled, c.Mode, c.AllowCreate, c.AllowClose, c.SettingsJson, c.SecretRefsJson, c.MappingJson
|    FROM cfg.Connector c WHERE c.Name = @Name FOR JSON PATH, WITHOUT_ARRAY_WRAPPER);
|INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (N'connector/' + @Name, N'connector', N'connector', N'Set', @old, @new, @By, @Reason);
|COMMIT;
|SELECT N'changed' AS Outcome;
|'@ }
|}
|
|function Invoke-SIOwnSqlConnectorOn {
|    <#
|        The Pro database's part. -Sql { param($Query, $Params, $Mode) } ('reader' -> rows). Never throws.
|        Returns @{ Action = same | changed | plan | failed | none; Changed = @(names); Lines }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Sql, [switch]$WhatIf)
|    $norm = { param($x) @($x | ForEach-Object { $_ } | Where-Object { $_ } | ForEach-Object { if ($_ -is [System.Collections.IDictionary]) { [pscustomobject]$_ } else { $_ } }) }
|    try {
|        $q = Get-SIOwnSqlConnectorSql -Statement Read
|        $rows = & $norm (& $Sql $q.Sql $q.Params 'reader')
|        $plan = Get-SIOwnSqlConnectorPlan -Rows $rows
|        if (-not @($plan.Change).Count -and -not @($plan.Same).Count) { return [pscustomobject]@{ Action = 'none'; Changed = @(); Lines = @() } }
|        if (-not @($plan.Change).Count) { return [pscustomobject]@{ Action = 'same'; Changed = @(); Lines = @($plan.Lines) } }
|        if ($WhatIf) { return [pscustomobject]@{ Action = 'plan'; Changed = @(); Lines = @($plan.Lines | ForEach-Object { '{0} (re-run with -Apply)' -f $_ }) } }
|        $done = New-Object System.Collections.Generic.List[string]
|        foreach ($n in @($plan.Change)) {
|            $a = Get-SIOwnSqlConnectorSql -Statement Apply -Name $n
|            $o = & $norm (& $Sql $a.Sql $a.Params 'reader')
|            if (@($o | Where-Object { [string]$_.Outcome -eq 'changed' }).Count) { $done.Add($n) }
|        }
|        # READ BACK: every own SQL target the plan moved must now be on
|        $after = Get-SIOwnSqlConnectorPlan -Rows (& $norm (& $Sql $q.Sql $q.Params 'reader'))
|        $still = @($after.Change | Where-Object { $plan.Change -contains $_ })
|        if ($still.Count) {
|            return [pscustomobject]@{ Action = 'failed'; Changed = $done.ToArray(); Lines = @(('connectors: SecurityInsight''s own SQL vulnerability target {0} is still not apply / create / close after the update set it -- check the Connectors page; the next update tries again' -f (($still | ForEach-Object { "'$_'" }) -join ', '))) }
|        }
|        [pscustomobject]@{ Action = 'changed'; Changed = $done.ToArray(); Lines = @($plan.Lines) }
|    } catch {
|        [pscustomobject]@{ Action = 'failed'; Changed = @(); Lines = @(('connectors: SecurityInsight''s own SQL vulnerability target was not checked ({0}) -- the update goes on; the next update tries again' -f $_.Exception.Message)) }
|    }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-SnowDataOutConnector.ps1'] = @{ Sha256 = '1443fc2b6afba2032173a73c5f8341bb91117f311481022efd28d029e83fb11f'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- #903 (owner 2026-10-26: "if active they should be part of the data out for both cmdb and
|    vulnerability"): ONE SERVICENOW CONNECTOR FEEDS BOTH DATA-OUT OUTPUTS -- existing installs reach the new-install state.
|
|    THE NEW-INSTALL STATE: the ServiceNow Import Set outputs (servicenow-ci, servicenow-vulnerable-item) send through the
|    ONE switched-on connector of kind servicenow + direction 'data-out' (always apply; Enabled = sends). Before, data out
|    took a ServiceNow connector of the output's direction (cmdb for the CIs, the close-loop's vulnerability connector for the
|    vulnerable items) -- switched on or not, its Mode ignored -- else the install's own ServiceNow secrets.
|
|    THE RULE OF THIS STEP: KEEP EXACTLY WHAT IS SENT TODAY, make it visible, NEVER send anywhere new.
|      * "today's connector" of an output = what data out picked before (Get-SISnowDataOutTodayPick: a valid ServiceNow row
|        of the output's old direction, switched on first, then by name; none = the install's own secrets);
|      * only while NO data-out connector exists yet (once one exists, a person owns it -- the step then only keeps it apply);
|      * the connector the CI output uses today, and every servicenow + cmdb row named data-out-*, become direction data-out,
|        Mode apply (names, references and settings kept). The one that feeds the outputs is switched ON only when a
|        ServiceNow output is on in SI_DataOut_Outputs (it was sending through it, although it said "off"); else its switch
|        is left as it is. Others are switched off (at most one on -- today's pick is the one kept);
|      * no such row but a ServiceNow output on: a connector `servicenow-data-out` is CREATED from the secret NAMES in use
|        today (the close-loop connector's, or the install's own SI-ServiceNow-Instance / -User / -Password) -- no value is
|        ever read;
|      * the outputs that are on went to DIFFERENT instances today (the vulnerable items through the close-loop's connector
|        on another instance): the connector is made, but left SWITCHED OFF, and said -- nothing goes to the wrong place;
|      * a converted row that names no credential gets the names the install's own lookup read (it signed in with them);
|      * a table key in a data-out connector's settings (SI_DataOut_ServiceNowCiTable / SI_DataOut_ServiceNowVulnTable) is
|        not read by anything: setting empty -> the value is copied into the setting, then the key removed; the same value
|        -> the key is removed; a different value -> nothing changes (the setting stays in force, as it always was), said;
|      * a servicenow + cmdb row with no sign of data out is the ServiceNow CMDB job's connector -- never touched.
|    GUARDS: one transaction per connector with its cfg.ChangeLog row (Name 'connector/<name>', By 'SecurityInsight update',
|    the reason in words), only while the row is unchanged since it was read (RowVersion), the one-on rule inside the
|    transaction; a setting with its own cfg.ChangeLog row, only while it is still what was read. READ BACK afterwards. Never a
|    delete, never a secret value, never an output switch (SI_DataOut_Outputs) changed, never a sql / rest / close-loop row,
|    never a job. Pro only (the Pro database). Never throws (Invoke-SISnowDataOutConnectorOn); -WhatIf (-DetectOnly) plans only.
|    PURE planning (Get-SISnowDataOutPlan) over a SQL seam.
|#>
|
|$script:SISnowDataOut = @{
|    By       = 'SecurityInsight update'
|    NewName  = 'servicenow-data-out'
|    Outputs  = @('servicenow-ci', 'servicenow-vulnerable-item')
|    Tables   = [ordered]@{ 'servicenow-ci' = 'SI_DataOut_ServiceNowCiTable'; 'servicenow-vulnerable-item' = 'SI_DataOut_ServiceNowVulnTable' }
|    # the names the install's own ServiceNow lookup read (auth\Get-SIVaultName.ps1, canonical names)
|    InstallRefs = [ordered]@{ instance = 'SI-ServiceNow-Instance'; user = 'SI-ServiceNow-User'; password = 'SI-ServiceNow-Password' }
|}
|
|function ConvertFrom-SISnowDataOutJson {
|    <# PURE. A JSON object text -> an ordered hashtable (keys as written); empty / unreadable -> empty. #>
|    param([AllowEmptyString()][AllowNull()][string]$Json)
|    $h = [ordered]@{}
|    if ([string]::IsNullOrWhiteSpace($Json)) { return $h }
|    try { $o = ConvertFrom-Json -InputObject $Json } catch { return $h }
|    if ($null -eq $o -or $o -isnot [psobject]) { return $h }
|    foreach ($p in $o.PSObject.Properties) { $h[$p.Name] = $p.Value }
|    $h
|}
|
|function Get-SISnowDataOutValue {
|    <# PURE. A row's column (hashtable or object); DBNull = $null. #>
|    param($Row, [string]$Name)
|    if ($null -eq $Row) { return $null }
|    $v = if ($Row -is [System.Collections.IDictionary]) { $Row[$Name] } else { $p = $Row.PSObject.Properties[$Name]; if ($p) { $p.Value } else { $null } }
|    if ($v -is [System.DBNull]) { $null } else { $v }
|}
|
|function Get-SISnowDataOutKey {
|    <# PURE. Where a ServiceNow row sends to, for comparing two of them: its instance URL, else its instance secret NAME. #>
|    param($Row)
|    if ($null -eq $Row) { return ('ref:' + $script:SISnowDataOut.InstallRefs.instance).ToLowerInvariant() }
|    $s = ConvertFrom-SISnowDataOutJson ([string](Get-SISnowDataOutValue $Row 'SettingsJson'))
|    $r = ConvertFrom-SISnowDataOutJson ([string](Get-SISnowDataOutValue $Row 'SecretRefsJson'))
|    $ref = @($r.Keys | Where-Object { $_ -ieq 'instance' })
|    if ($ref.Count -and "$($r[$ref[0]])".Trim()) { return ('ref:' + "$($r[$ref[0]])".Trim()).ToLowerInvariant() }
|    $ins = @($s.Keys | Where-Object { $_ -ieq 'instance' })
|    if ($ins.Count -and "$($s[$ins[0]])".Trim()) { return ("$($s[$ins[0]])".Trim().TrimEnd('/') -replace '^(?i)https?://', '').ToLowerInvariant() }
|    # no instance named: before #903 it used the install's own instance
|    ('ref:' + $script:SISnowDataOut.InstallRefs.instance).ToLowerInvariant()
|}
|
|function Test-SISnowDataOutOn {
|    <# PURE. The ServiceNow outputs on in SI_DataOut_Outputs (a list, comma / semicolon separated; empty = every output's default -- off for both). #>
|    param([AllowEmptyString()][AllowNull()][string]$Setting)
|    $chosen = @(([string]$Setting) -split '[,;]' | ForEach-Object { $_.Trim().ToLowerInvariant() } | Where-Object { $_ })
|    $on = [ordered]@{}
|    foreach ($o in $script:SISnowDataOut.Outputs) { $on[$o] = ($chosen -contains $o) }
|    $on
|}
|
|function Get-SISnowDataOutTodayPick {
|    <#
|        PURE. What data out used BEFORE #903 for one output: the valid ServiceNow row of -Direction (cmdb for the CIs, the
|        close-loop's vulnerability for the vulnerable items), switched on first, then by name; $null = the install's own
|        ServiceNow secrets. Validity as the engine reads a row (ConvertFrom-SIConnectorRow) when it is loaded; else the
|        row's kind and direction only.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [Parameter(Mandatory)][string]$Direction)
|    $list = foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $kind = ([string](Get-SISnowDataOutValue $r 'Kind')).Trim().ToLowerInvariant()
|        $dir = ([string](Get-SISnowDataOutValue $r 'Direction')).Trim().ToLowerInvariant(); if (-not $dir) { $dir = 'vulnerability' }
|        if ($kind -ne 'servicenow' -or $dir -ne $Direction) { continue }
|        if (Get-Command -Name ConvertFrom-SIConnectorRow -ErrorAction SilentlyContinue) {
|            $c = ConvertFrom-SIConnectorRow -Row $r
|            # the #903 credential rule is new: a row that names half a credential could not sign in before either
|            if (@($c.Problems | Where-Object { $_ -notmatch 'a user needs a password' }).Count) { continue }
|        }
|        $r
|    }
|    @(@($list) | Sort-Object -Property @{ Expression = { -not ([string](Get-SISnowDataOutValue $_ 'Enabled') -match '^(?i)(1|true)$') } }, @{ Expression = { [string](Get-SISnowDataOutValue $_ 'Name') } }) | Select-Object -First 1
|}
|
|function Get-SISnowDataOutPlan {
|    <#
|        PURE. -Rows: the cfg.Connector rows (Name, Kind, Direction, Enabled, Mode, AllowCreate, AllowClose, SettingsJson,
|        SecretRefsJson, Ver = the RowVersion as a number). -Settings: @{ SI_DataOut_Outputs; SI_DataOut_ServiceNowCiTable;
|        SI_DataOut_ServiceNowVulnTable } (values as text, $null = not set; SettingVer = @{ name = the ValueJson read }).
|        Returns @{ Updates (connector rows to write: Name, Expected, Direction, Enabled, Mode, SettingsJson, SecretRefsJson,
|        Reason); Inserts (new connectors); Settings (Name, Expected (the ValueJson read), New (ValueJson), Reason);
|        Lines (what is said); Warnings }.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [hashtable]$Settings = @{})
|    $g = { param($n) if ($Settings.ContainsKey($n) -and $null -ne $Settings[$n]) { ([string]$Settings[$n]).Trim() } else { '' } }
|    $bit = { param($v) [string]$v -match '^(?i)(1|true)$' }
|    $updates = New-Object System.Collections.Generic.List[object]; $inserts = New-Object System.Collections.Generic.List[object]
|    $sets = New-Object System.Collections.Generic.List[object]; $lines = New-Object System.Collections.Generic.List[string]
|    $warnings = New-Object System.Collections.Generic.List[string]
|    $on = Test-SISnowDataOutOn -Setting (& $g 'SI_DataOut_Outputs')
|    $anyOn = [bool]($on['servicenow-ci'] -or $on['servicenow-vulnerable-item'])
|    $snow = @(@($Rows) | Where-Object { $_ -and ([string](Get-SISnowDataOutValue $_ 'Kind')).Trim() -ieq 'servicenow' })
|    $dirOf = { param($r) $d = ([string](Get-SISnowDataOutValue $r 'Direction')).Trim().ToLowerInvariant(); if ($d) { $d } else { 'vulnerability' } }
|    $dataOut = @($snow | Where-Object { (& $dirOf $_) -eq 'data-out' })
|    # the row as it will be written: start from what is there
|    $final = [ordered]@{}
|    $want = {
|        param($r, [string]$why)
|        $n = [string](Get-SISnowDataOutValue $r 'Name')
|        if (-not $final.Contains($n)) {
|            $final[$n] = [ordered]@{ Name = $n; Expected = (Get-SISnowDataOutValue $r 'Ver'); Direction = (& $dirOf $r); Enabled = (& $bit (Get-SISnowDataOutValue $r 'Enabled'))
|                                     Mode = ([string](Get-SISnowDataOutValue $r 'Mode')).Trim().ToLowerInvariant(); SettingsJson = [string](Get-SISnowDataOutValue $r 'SettingsJson')
|                                     SecretRefsJson = [string](Get-SISnowDataOutValue $r 'SecretRefsJson'); Reasons = (New-Object System.Collections.Generic.List[string]); Row = $r }
|        }
|        if ($why) { $final[$n].Reasons.Add($why) }
|        $final[$n]
|    }
|
|    if ($dataOut.Count -eq 0) {
|        $ciPick = Get-SISnowDataOutTodayPick -Rows $snow -Direction cmdb
|        $viPick = Get-SISnowDataOutTodayPick -Rows $snow -Direction vulnerability
|        $ciTable = & $g 'SI_DataOut_ServiceNowCiTable'
|        # the rows that served data out: the CI output's connector (when the output is on or has a table), and every
|        # servicenow + cmdb row named data-out-*
|        $convert = New-Object System.Collections.Generic.List[object]
|        if ($ciPick -and ($on['servicenow-ci'] -or $ciTable)) { $convert.Add($ciPick) }
|        foreach ($r in @($snow | Where-Object { (& $dirOf $_) -eq 'cmdb' -and ([string](Get-SISnowDataOutValue $_ 'Name')) -like 'data-out-*' })) {
|            if (-not @($convert | Where-Object { [string](Get-SISnowDataOutValue $_ 'Name') -eq [string](Get-SISnowDataOutValue $r 'Name') }).Count) { $convert.Add($r) }
|        }
|        # where each output that is on went today ($null row = the install's own secrets)
|        $used = [ordered]@{}
|        if ($on['servicenow-ci']) { $used['servicenow-ci'] = $ciPick }
|        if ($on['servicenow-vulnerable-item']) { $used['servicenow-vulnerable-item'] = $viPick }
|        $keys = @($used.Keys | ForEach-Object { Get-SISnowDataOutKey $used[$_] } | Select-Object -Unique)
|        $mixed = $keys.Count -gt 1
|        if ($convert.Count) {
|            $primary = if ($ciPick -and @($convert | Where-Object { [string](Get-SISnowDataOutValue $_ 'Name') -eq [string](Get-SISnowDataOutValue $ciPick 'Name') }).Count) { $ciPick } else { $convert[0] }
|            $pName = [string](Get-SISnowDataOutValue $primary 'Name')
|            # the vulnerable items went elsewhere than this connector: they would move -- never; it stays off, said
|            $moves = $on['servicenow-vulnerable-item'] -and ((Get-SISnowDataOutKey $viPick) -ne (Get-SISnowDataOutKey $primary))
|            foreach ($r in $convert) {
|                $n = [string](Get-SISnowDataOutValue $r 'Name')
|                $f = & $want $r ''
|                $f.Direction = 'data-out'; $f.Mode = 'apply'
|                $f.Reasons.Add('one ServiceNow connector feeds both data-out outputs -- this connector served the ServiceNow data out, so its direction is now data-out (always apply; it is never run by the vulnerability close-loop)')
|                # it signed in with the install's own credential when it named none
|                $refs = ConvertFrom-SISnowDataOutJson $f.SecretRefsJson
|                $named = @($refs.Keys | Where-Object { $_ -in @('apikey', 'user', 'password') }).Count
|                if (-not $named) {
|                    foreach ($k in @('user', 'password')) { $refs[$k] = $script:SISnowDataOut.InstallRefs[$k] }
|                    $hasInst = @($refs.Keys | Where-Object { $_ -ieq 'instance' }).Count -or @((ConvertFrom-SISnowDataOutJson $f.SettingsJson).Keys | Where-Object { $_ -ieq 'instance' }).Count
|                    if (-not $hasInst) { $refs['instance'] = $script:SISnowDataOut.InstallRefs.instance }
|                    $f.SecretRefsJson = ConvertTo-Json -InputObject $refs -Compress
|                    $f.Reasons.Add('it named no credential and signed in with the install''s own ServiceNow secrets -- those secret NAMES are now on the connector')
|                }
|                if ($n -eq $pName) {
|                    if ($moves -or $mixed) {
|                        if ($f.Enabled) { $f.Enabled = $false; $f.Reasons.Add('switched off: the ServiceNow outputs that are on went to different instances before -- switch it on on its page once its instance is the right one') }
|                        $warnings.Add(("connectors: the ServiceNow data-out connector '{0}' is left SWITCHED OFF -- the vulnerable items went to another ServiceNow instance before (through the close-loop's connector), and this connector points elsewhere. Nothing is sent to ServiceNow until a person checks its instance and switches it on (Connectors > {0})." -f $n))
|                    } elseif ($anyOn -and -not $f.Enabled) {
|                        $f.Enabled = $true
|                        $f.Reasons.Add('switched on: a ServiceNow output is on (SI_DataOut_Outputs) and this connector was what it sent through, although it said off -- what is sent does not change')
|                    }
|                } elseif ($f.Enabled) {
|                    $f.Enabled = $false
|                    $f.Reasons.Add(('switched off: at most one ServiceNow data-out connector is on, and data out sent through {0} -- what is sent does not change' -f $pName))
|                }
|                $lines.Add(("connectors: '{0}' is now the ServiceNow data-out connector{1}" -f $n, $(if ($n -eq $pName) { $(if ($f.Enabled) { ' (switched on -- it feeds both ServiceNow outputs)' } else { ' (switched off)' }) } else { ' (switched off)' })))
|            }
|        } elseif ($anyOn) {
|            # no row served data out: a connector from the names in use today
|            $src = if ($on['servicenow-vulnerable-item'] -and $viPick) { $viPick } elseif ($on['servicenow-ci'] -and $ciPick) { $ciPick } else { $null }
|            $refs = [ordered]@{}; $set = [ordered]@{}
|            if ($src) {
|                $sr = ConvertFrom-SISnowDataOutJson ([string](Get-SISnowDataOutValue $src 'SecretRefsJson'))
|                foreach ($k in @($sr.Keys)) { if ($k -in @('instance', 'apikey', 'user', 'password')) { $refs[$k] = $sr[$k] } }
|                $ss = ConvertFrom-SISnowDataOutJson ([string](Get-SISnowDataOutValue $src 'SettingsJson'))
|                foreach ($k in @($ss.Keys)) { if ($k -ieq 'instance') { $set['instance'] = $ss[$k] } }
|            }
|            if (-not @($refs.Keys | Where-Object { $_ -in @('apikey', 'user', 'password') }).Count) { foreach ($k in @('user', 'password')) { $refs[$k] = $script:SISnowDataOut.InstallRefs[$k] } }
|            if (-not $refs.Contains('instance') -and -not $set.Contains('instance')) { $refs['instance'] = $script:SISnowDataOut.InstallRefs.instance }
|            $name = $script:SISnowDataOut.NewName
|            if (@($Rows | Where-Object { [string](Get-SISnowDataOutValue $_ 'Name') -eq $name }).Count) { $name = $name + '-1' }
|            $from = if ($src) { ('the secret names of the connector {0}' -f (Get-SISnowDataOutValue $src 'Name')) } else { 'the install''s own ServiceNow secret names' }
|            $reason = ('one ServiceNow connector feeds both data-out outputs -- created from {0}, which the ServiceNow data out signed in with before' -f $from)
|            if ($mixed) { $reason += '; left SWITCHED OFF: the ServiceNow outputs that are on went to different instances before' }
|            $inserts.Add([pscustomobject]@{ Name = $name; Kind = 'servicenow'; Direction = 'data-out'; Enabled = (-not $mixed); Mode = 'apply'
|                                            SettingsJson = $(if ($set.Count) { ConvertTo-Json -InputObject $set -Compress } else { $null }); SecretRefsJson = (ConvertTo-Json -InputObject $refs -Compress); Reason = $reason })
|            if ($mixed) { $warnings.Add(("connectors: the ServiceNow data-out connector '{0}' was created SWITCHED OFF -- the ServiceNow outputs that are on went to different ServiceNow instances before. Nothing is sent to ServiceNow until a person checks its instance and switches it on (Connectors > {0})." -f $name)) }
|            else { $lines.Add(("connectors: '{0}' was created from {1} -- the ServiceNow data-out connector, switched on; it feeds both ServiceNow outputs (what is sent does not change)" -f $name, $from)) }
|        }
|        foreach ($r in @($snow | Where-Object { (& $dirOf $_) -eq 'cmdb' })) {
|            $n = [string](Get-SISnowDataOutValue $r 'Name')
|            if (-not $final.Contains($n)) { $lines.Add(("connectors: '{0}' (servicenow, cmdb) is the ServiceNow CMDB job's connector -- not touched; the ServiceNow data out no longer reads it" -f $n)) }
|        }
|    }
|
|    # every data-out connector (existing, or converted above): always apply, and no table key in its settings
|    $doNames = @($dataOut | ForEach-Object { [string](Get-SISnowDataOutValue $_ 'Name') })
|    $doRows = @($dataOut) + @($final.Values | Where-Object { $_.Direction -eq 'data-out' -and $doNames -notcontains $_.Name } | ForEach-Object { $_.Row })
|    foreach ($r in $doRows) {
|        $f = & $want $r ''
|        if ($f.Mode -ne 'apply') { $f.Mode = 'apply'; $f.Reasons.Add('a ServiceNow data-out connector is always apply -- data out has no test mode (it always sent; the mode was never read)') }
|        $s = ConvertFrom-SISnowDataOutJson $f.SettingsJson
|        $changed = $false
|        foreach ($o in $script:SISnowDataOut.Outputs) {
|            $setting = $script:SISnowDataOut.Tables[$o]
|            $k = @($s.Keys | Where-Object { $_ -ieq $setting }) | Select-Object -First 1
|            if (-not $k) { continue }
|            $val = ([string]$s[$k]).Trim(); $cur = & $g $setting
|            if (-not $val -or $val -eq $cur) {
|                $s.Remove($k); $changed = $true
|                $f.Reasons.Add(('the key {0} in its settings was never read (the table is the setting {0}, which holds the same value) -- removed' -f $setting))
|            } elseif (-not $cur) {
|                $exp = if ($Settings.ContainsKey('SettingVer') -and $Settings['SettingVer'] -and $Settings['SettingVer'].Contains($setting)) { $Settings['SettingVer'][$setting] } else { $null }
|                $sets.Add([pscustomobject]@{ Name = $setting; Expected = $exp; New = (ConvertTo-Json -InputObject $val -Compress)
|                                             Reason = ('the Import Set table was named only in the ServiceNow data-out connector {0}''s settings, where nothing read it -- now in the setting, which is where the table is read from' -f $f.Name) })
|                $lines.Add(("connectors: the Import Set table {0} named in '{1}' is now the setting {2} (the next update removes the unread key)" -f $val, $f.Name, $setting))
|            } else {
|                $warnings.Add(("connectors: '{0}' names the Import Set table {1} in its settings, but the setting {2} is {3} -- the setting is what is used (as always); nothing was changed. Remove the key on the connector, or change the setting." -f $f.Name, $val, $setting, $cur))
|            }
|        }
|        if ($changed) { $f.SettingsJson = $(if ($s.Count) { ConvertTo-Json -InputObject $s -Compress -Depth 10 } else { $null }) }
|    }
|    foreach ($f in $final.Values) {
|        $r = $f.Row
|        $same = ($f.Direction -eq (& $dirOf $r)) -and ($f.Enabled -eq (& $bit (Get-SISnowDataOutValue $r 'Enabled'))) -and ($f.Mode -eq ([string](Get-SISnowDataOutValue $r 'Mode')).Trim().ToLowerInvariant()) -and
|                ("$($f.SettingsJson)" -eq "$(Get-SISnowDataOutValue $r 'SettingsJson')") -and ("$($f.SecretRefsJson)" -eq "$(Get-SISnowDataOutValue $r 'SecretRefsJson')")
|        if ($same) { continue }
|        $updates.Add([pscustomobject]@{ Name = $f.Name; Expected = $f.Expected; Direction = $f.Direction; Enabled = [bool]$f.Enabled; Mode = $f.Mode
|                                        SettingsJson = $(if ("$($f.SettingsJson)".Trim()) { $f.SettingsJson } else { $null }); SecretRefsJson = $(if ("$($f.SecretRefsJson)".Trim()) { $f.SecretRefsJson } else { $null })
|                                        Reason = ((@($f.Reasons) | Select-Object -Unique) -join '; ') })
|    }
|    $onAfter = @(@($final.Values | Where-Object { $_.Direction -eq 'data-out' -and $_.Enabled } | ForEach-Object { $_.Name }) + @($dataOut | Where-Object { -not $final.Contains([string](Get-SISnowDataOutValue $_ 'Name')) -and (& $bit (Get-SISnowDataOutValue $_ 'Enabled')) } | ForEach-Object { [string](Get-SISnowDataOutValue $_ 'Name') }) + @($inserts | Where-Object { $_.Enabled } | ForEach-Object { $_.Name }))
|    if ($onAfter.Count -gt 1) { $warnings.Add(("connectors: {0} ServiceNow data-out connectors are switched on ({1}) -- nothing is sent to ServiceNow until one is switched off (Connectors)" -f $onAfter.Count, ($onAfter -join ', '))) }
|    # switch-offs first, so the one-on rule holds after every single write
|    $ordered = @(@($updates | Where-Object { -not $_.Enabled }) + @($updates | Where-Object { $_.Enabled }))
|    [pscustomobject]@{ Updates = $ordered; Inserts = $inserts.ToArray(); Settings = $sets.ToArray(); Lines = $lines.ToArray(); Warnings = $warnings.ToArray() }
|}
|
|function Get-SISnowDataOutSql {
|    <#
|        The Pro database's statements. 'Read': the connectors (none when the table does not exist); 'ReadSettings': the
|        three settings; 'Update' (-Item): ONE transaction -- the row written with its cfg.ChangeLog row, only while it is
|        unchanged since it was read (RowVersion), refused when two data-out connectors would be on; 'Insert' (-Item): the
|        new connector, only while no row has the name; 'Setting' (-Item): the setting with its cfg.ChangeLog row, only while
|        it is still what was read. Each returns Outcome 'changed' | 'stale' | 'conflict'. Returns @{ Sql; Params }.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Read', 'ReadSettings', 'Update', 'Insert', 'Setting')][string]$Statement, $Item, [string]$By = $script:SISnowDataOut.By)
|    $guard = @'
|IF (SELECT COUNT(*) FROM cfg.Connector WHERE LOWER(Kind) = N'servicenow' AND LOWER(Direction) = N'data-out' AND Enabled = 1) > 1
|BEGIN
|    ROLLBACK;
|    SELECT N'conflict' AS Outcome;
|    RETURN;
|END;
|'@
|    $json = 'SELECT c.Name, c.Kind, c.Direction, c.Enabled, c.Mode, c.AllowCreate, c.AllowClose, c.SettingsJson, c.SecretRefsJson, c.MappingJson'
|    switch ($Statement) {
|        'Read' {
|            return [pscustomobject]@{ Params = @{}; Sql = @'
|IF OBJECT_ID(N'cfg.Connector') IS NOT NULL
|SELECT Name, Kind, Direction, CONVERT(int, Enabled) AS Enabled, Mode, CONVERT(int, AllowCreate) AS AllowCreate, CONVERT(int, AllowClose) AS AllowClose,
|       SettingsJson, SecretRefsJson, CONVERT(bigint, RowVersion) AS Ver
|FROM cfg.Connector ORDER BY Name;
|'@ }
|        }
|        'ReadSettings' {
|            return [pscustomobject]@{ Params = @{}; Sql = @'
|IF OBJECT_ID(N'cfg.Setting') IS NOT NULL
|SELECT Name, ValueJson FROM cfg.Setting
|WHERE Scope = N'solution' AND Name IN (N'SI_DataOut_Outputs', N'SI_DataOut_ServiceNowCiTable', N'SI_DataOut_ServiceNowVulnTable');
|'@ }
|        }
|        'Update' {
|            return [pscustomobject]@{ Params = [ordered]@{ Name = [string]$Item.Name; Expected = $Item.Expected; Direction = [string]$Item.Direction; Enabled = [bool]$Item.Enabled; Mode = [string]$Item.Mode
|                                                          SettingsJson = $Item.SettingsJson; SecretRefsJson = $Item.SecretRefsJson; By = $By; Reason = [string]$Item.Reason }; Sql = @"
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @old nvarchar(max) = ($json
|    FROM cfg.Connector c WITH (UPDLOCK, HOLDLOCK)
|    WHERE c.Name = @Name AND LOWER(c.Kind) = N'servicenow' AND CONVERT(bigint, c.RowVersion) = @Expected
|    FOR JSON PATH, WITHOUT_ARRAY_WRAPPER);
|IF @old IS NULL
|BEGIN
|    COMMIT;
|    SELECT N'stale' AS Outcome;
|    RETURN;
|END;
|UPDATE cfg.Connector SET Direction = @Direction, Enabled = @Enabled, Mode = @Mode, SettingsJson = @SettingsJson, SecretRefsJson = @SecretRefsJson,
|       UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By
|WHERE Name = @Name;
|$guard
|DECLARE @new nvarchar(max) = ($json FROM cfg.Connector c WHERE c.Name = @Name FOR JSON PATH, WITHOUT_ARRAY_WRAPPER);
|INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (N'connector/' + @Name, N'connector', N'connector', N'Set', @old, @new, @By, LEFT(@Reason, 400));
|COMMIT;
|SELECT N'changed' AS Outcome;
|"@ }
|        }
|        'Insert' {
|            return [pscustomobject]@{ Params = [ordered]@{ Name = [string]$Item.Name; Enabled = [bool]$Item.Enabled; SettingsJson = $Item.SettingsJson; SecretRefsJson = $Item.SecretRefsJson; By = $By; Reason = [string]$Item.Reason }; Sql = @"
|SET XACT_ABORT ON;
|BEGIN TRAN;
|IF EXISTS (SELECT 1 FROM cfg.Connector WITH (UPDLOCK, HOLDLOCK) WHERE Name = @Name)
|BEGIN
|    COMMIT;
|    SELECT N'stale' AS Outcome;
|    RETURN;
|END;
|INSERT cfg.Connector (Name, Kind, Direction, Enabled, Mode, AllowCreate, AllowClose, SettingsJson, SecretRefsJson, MappingJson, CreatedBy, UpdatedBy)
|VALUES (@Name, N'servicenow', N'data-out', @Enabled, N'apply', 0, 0, @SettingsJson, @SecretRefsJson, NULL, @By, @By);
|$guard
|DECLARE @new nvarchar(max) = ($json FROM cfg.Connector c WHERE c.Name = @Name FOR JSON PATH, WITHOUT_ARRAY_WRAPPER);
|INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (N'connector/' + @Name, N'connector', N'connector', N'Set', NULL, @new, @By, LEFT(@Reason, 400));
|COMMIT;
|SELECT N'changed' AS Outcome;
|"@ }
|        }
|        'Setting' {
|            return [pscustomobject]@{ Params = [ordered]@{ N = [string]$Item.Name; Expected = $Item.Expected; V = [string]$Item.New; By = $By; Reason = [string]$Item.Reason }; Sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @old nvarchar(max) = (SELECT ValueJson FROM cfg.Setting WITH (UPDLOCK, HOLDLOCK) WHERE Name = @N AND Scope = N'solution');
|IF NOT ((@old IS NULL AND @Expected IS NULL) OR (@old IS NOT NULL AND @Expected IS NOT NULL AND @old = @Expected))   -- never NULL-unknown: a value read as NULL that is set now is stale
|BEGIN
|    COMMIT;
|    SELECT N'stale' AS Outcome;
|    RETURN;
|END;
|IF EXISTS (SELECT 1 FROM cfg.Setting WHERE Name = @N AND Scope = N'solution')
|    UPDATE cfg.Setting SET ValueJson = @V, KeyVaultSecretName = NULL, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @N AND Scope = N'solution';
|ELSE
|    INSERT cfg.Setting (Name, Scope, ValueJson, KeyVaultSecretName, UpdatedBy) VALUES (@N, N'solution', @V, NULL, @By);
|INSERT cfg.ChangeLog (Name, Scope, Action, OldValue, NewValue, ChangedBy, Reason) VALUES (@N, N'solution', N'Set', @old, @V, @By, LEFT(@Reason, 400));
|COMMIT;
|SELECT N'changed' AS Outcome;
|'@ }
|        }
|    }
|}
|
|function Read-SISnowDataOutState {
|    <# The connectors and the three settings, through the seam. Returns @{ Rows; Settings }. #>
|    param([Parameter(Mandatory)][scriptblock]$Sql)
|    $norm = { param($x) @($x | ForEach-Object { $_ } | Where-Object { $_ } | ForEach-Object { if ($_ -is [System.Collections.IDictionary]) { [pscustomobject]$_ } else { $_ } }) }
|    $q = Get-SISnowDataOutSql -Statement Read
|    $rows = & $norm (& $Sql $q.Sql $q.Params 'reader')
|    $qs = Get-SISnowDataOutSql -Statement ReadSettings
|    $set = @{ SettingVer = @{} }
|    foreach ($s in (& $norm (& $Sql $qs.Sql $qs.Params 'reader'))) {
|        $n = [string]$s.Name; $vj = $s.ValueJson; if ($vj -is [System.DBNull]) { $vj = $null }
|        $set['SettingVer'][$n] = $vj
|        $v = $null
|        if ($null -ne $vj -and "$vj".Trim()) { try { $v = ConvertFrom-Json -InputObject ([string]$vj) } catch { $v = [string]$vj } }
|        $set[$n] = $(if ($v -is [array]) { ($v -join ';') } elseif ($null -ne $v) { [string]$v } else { $null })
|    }
|    [pscustomobject]@{ Rows = $rows; Settings = $set }
|}
|
|function Invoke-SISnowDataOutConnectorOn {
|    <#
|        The Pro database's part. -Sql { param($Query, $Params, $Mode) } ('reader' -> rows). Never throws.
|        Returns @{ Action = none | changed | plan | failed; Changed = @(names); Lines; Warnings }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Sql, [switch]$WhatIf)
|    $norm = { param($x) @($x | ForEach-Object { $_ } | Where-Object { $_ } | ForEach-Object { if ($_ -is [System.Collections.IDictionary]) { [pscustomobject]$_ } else { $_ } }) }
|    $out = { param($a, $c, $l, $w) [pscustomobject]@{ Action = $a; Changed = @($c); Lines = @($l); Warnings = @($w) } }
|    try {
|        $st = Read-SISnowDataOutState -Sql $Sql
|        $plan = Get-SISnowDataOutPlan -Rows $st.Rows -Settings $st.Settings
|        $todo = @($plan.Updates).Count + @($plan.Inserts).Count + @($plan.Settings).Count
|        if (-not $todo) { return (& $out 'none' @() @() @($plan.Warnings)) }
|        if ($WhatIf) { return (& $out 'plan' @() @($plan.Lines | ForEach-Object { '{0} (re-run with -Apply)' -f $_ }) @($plan.Warnings)) }
|        $done = New-Object System.Collections.Generic.List[string]; $warn = New-Object System.Collections.Generic.List[string]
|        foreach ($w in @($plan.Warnings)) { $warn.Add($w) }
|        $run = {
|            param($stmt, $item)
|            $q = Get-SISnowDataOutSql -Statement $stmt -Item $item
|            $o = [string](@(& $norm (& $Sql $q.Sql $q.Params 'reader')) | ForEach-Object { $_.Outcome } | Select-Object -First 1)
|            if ($o -eq 'changed') { $done.Add([string]$item.Name) }
|            elseif ($o -eq 'conflict') { $warn.Add(("connectors: '{0}' was not changed -- two ServiceNow data-out connectors would have been switched on" -f $item.Name)) }
|            else { $warn.Add(("connectors: '{0}' changed while the update read it -- not touched; the next update looks again" -f $item.Name)) }
|        }
|        # 1. the settings first (a table key is removed only once its setting holds the value)
|        foreach ($s in @($plan.Settings)) { & $run 'Setting' $s }
|        if (@($plan.Settings).Count) { $st = Read-SISnowDataOutState -Sql $Sql; $plan = Get-SISnowDataOutPlan -Rows $st.Rows -Settings $st.Settings }
|        # 2. the connectors: switch-offs first, then the rest, then the new one
|        foreach ($u in @($plan.Updates)) { & $run 'Update' $u }
|        foreach ($i in @($plan.Inserts)) { & $run 'Insert' $i }
|        # READ BACK: nothing the plan wanted is left undone
|        $after = Read-SISnowDataOutState -Sql $Sql
|        $left = Get-SISnowDataOutPlan -Rows $after.Rows -Settings $after.Settings
|        $still = @(@($left.Updates | ForEach-Object { $_.Name }) + @($left.Inserts | ForEach-Object { $_.Name }) + @($left.Settings | ForEach-Object { $_.Name }))
|        if ($still.Count) {
|            $warn.Add(('connectors: {0} did not reach the new state after the update wrote it -- check Connectors; the next update tries again' -f (($still | Select-Object -Unique | ForEach-Object { "'$_'" }) -join ', ')))
|            return (& $out 'failed' $done.ToArray() @($plan.Lines) $warn.ToArray())
|        }
|        & $out 'changed' $done.ToArray() @($plan.Lines) $warn.ToArray()
|    } catch {
|        & $out 'failed' @() @() @(('connectors: the ServiceNow data-out connector was not checked ({0}) -- the update goes on; the next update tries again' -f $_.Exception.Message))
|    }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-SnowStagingStatus.ps1'] = @{ Sha256 = 'a0e9028540fa075fb558d2bdaa8d8a1a578f37d49913848ccef93b00512b02bd'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- #912 THE SERVICENOW STAGING STATUS TABLE: existing installs reach the new-install state SAFELY.
|
|    THE NEW-INSTALL STATE: the setting SI_DataOut_ServiceNowStagingStatusTable is not set, so the engine uses the default
|    u_si_staging_status (Get-SISnowStagingStatusTable, engine\asset-cmdb\_shared\SI-SnowImportSet.ps1): every push to ServiceNow
|    is one batch -- a writing row, u_si_batch_id on every data row, an end row (complete | failed | held) -- and when the table
|    cannot be written NOTHING is sent (data trust: never rows without their batch marker).
|
|    WHY AN UPDATE CANNOT SIMPLY TAKE THE DEFAULT: the staging status table lives in the CUSTOMER's ServiceNow instance, and only
|    their ServiceNow team can create it. An install that already sends to ServiceNow would stop sending on the night of the
|    update. So, ONCE per install, this step writes the setting EMPTY ('') where the install already sends to ServiceNow
|    through the Import Set API -- either of SI_DataOut_ServiceNowCiTable, SI_DataOut_ServiceNowVulnTable
|    is set (the older push's two tables are retired, #914). Empty = the rows go exactly as before, and the
|    run log, the ServiceNow check (Data health, the daily mail) and "For your ServiceNow team" say that the staging status table
|    is missing and how to create it. The customer then creates the table and sets the setting (or clears the row to take the
|    default).
|    An install that does not send to ServiceNow is left alone: when it is set up later, its ServiceNow team follows the guide,
|    which includes the staging status table.
|
|    GUARDS: only while the setting has NO row (a value anyone set is never touched); one transaction with its cfg.ChangeLog row
|    (By 'SecurityInsight update', the reason in words); read back. Never a delete, never another setting. Pro only (the Pro
|    database). Never throws (Invoke-SISnowStagingStatusUpdate); -WhatIf (-DetectOnly) plans only. PURE planning
|    (Get-SISnowStagingStatusPlan) over a SQL seam.
|#>
|
|$script:SISnowStagingStatusUpdate = @{
|    By       = 'SecurityInsight update'
|    Setting  = 'SI_DataOut_ServiceNowStagingStatusTable'
|    Default  = 'u_si_staging_status'
|    # the settings that say this install already sends rows to ServiceNow through the Import Set API
|    Pushing  = @('SI_DataOut_ServiceNowCiTable', 'SI_DataOut_ServiceNowVulnTable')   # #914: the older push's tables are retired
|}
|
|function Get-SISnowStagingStatusPlan {
|    <#
|        PURE. -Settings: name -> the stored ValueJson (a name with no row is absent; $null = a row with NULL).
|        Returns @{ Action = none | set-empty; Line; Pushing (the table settings that are set) }.
|    #>
|    param([hashtable]$Settings = @{})
|    $c = $script:SISnowStagingStatusUpdate
|    $text = {
|        param($vj)
|        if ($null -eq $vj -or $vj -is [System.DBNull]) { return '' }
|        $s = [string]$vj
|        try { $o = ConvertFrom-Json -InputObject $s; if ($o -is [array]) { return (($o | ForEach-Object { [string]$_ }) -join ';').Trim() }; return ([string]$o).Trim() } catch { return $s.Trim() }
|    }
|    if ($Settings.ContainsKey($c.Setting)) { return [pscustomobject]@{ Action = 'none'; Line = ''; Pushing = @() } }
|    $pushing = @(foreach ($n in $c.Pushing) { if ($Settings.ContainsKey($n) -and (& $text $Settings[$n])) { $n } })
|    if (-not $pushing.Count) { return [pscustomobject]@{ Action = 'none'; Line = ''; Pushing = @() } }
|    [pscustomobject]@{ Action = 'set-empty'; Pushing = $pushing
|        Line = ('ServiceNow: this install already sends to ServiceNow ({0}), so {1} is set empty: the rows go as before, and the ServiceNow page warns until your ServiceNow team creates the staging status table ({2}) and the setting names it.' -f ($pushing -join ', '), $c.Setting, $c.Default) }
|}
|
|function Get-SISnowStagingStatusSql {
|    <# PURE. The statements: Read (the settings) and Set (the empty value, only while no row exists, with its cfg.ChangeLog row). #>
|    param([ValidateSet('Read', 'Set')][string]$Statement)
|    $c = $script:SISnowStagingStatusUpdate
|    if ($Statement -eq 'Read') {
|        $names = (@($c.Setting) + @($c.Pushing) | ForEach-Object { "N'$_'" }) -join ', '
|        return [pscustomobject]@{ Params = @{}; Sql = ("IF OBJECT_ID(N'cfg.Setting') IS NOT NULL`nSELECT Name, ValueJson FROM cfg.Setting WHERE Scope = N'solution' AND Name IN ({0});" -f $names) }
|    }
|    [pscustomobject]@{ Params = [ordered]@{ N = $c.Setting; V = '""'; By = $c.By; Reason = 'the staging status table is created by your ServiceNow team first -- until then the rows go as before, with a warning' }; Sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|IF EXISTS (SELECT 1 FROM cfg.Setting WITH (UPDLOCK, HOLDLOCK) WHERE Name = @N AND Scope = N'solution')
|BEGIN
|    COMMIT;
|    SELECT N'stale' AS Outcome;
|    RETURN;
|END;
|INSERT cfg.Setting (Name, Scope, ValueJson, KeyVaultSecretName, UpdatedBy) VALUES (@N, N'solution', @V, NULL, @By);
|INSERT cfg.ChangeLog (Name, Scope, Action, OldValue, NewValue, ChangedBy, Reason) VALUES (@N, N'solution', N'Set', NULL, @V, @By, LEFT(@Reason, 400));
|COMMIT;
|SELECT N'changed' AS Outcome;
|'@ }
|}
|
|function Read-SISnowStagingStatusSettings {
|    <# The settings through the seam: name -> ValueJson (only names that have a row). #>
|    param([Parameter(Mandatory)][scriptblock]$Sql)
|    $q = Get-SISnowStagingStatusSql -Statement Read
|    $h = @{}
|    foreach ($r in @(& $Sql $q.Sql $q.Params 'reader' | ForEach-Object { $_ } | Where-Object { $_ })) {
|        $n = if ($r -is [System.Collections.IDictionary]) { [string]$r['Name'] } else { [string]$r.Name }
|        $v = if ($r -is [System.Collections.IDictionary]) { $r['ValueJson'] } else { $r.ValueJson }
|        if ($v -is [System.DBNull]) { $v = $null }
|        if ($n) { $h[$n] = $v }
|    }
|    $h
|}
|
|function Invoke-SISnowStagingStatusUpdate {
|    <#
|        The Pro database's part. -Sql { param($Query, $Params, $Mode) } ('reader' -> rows). Never throws.
|        Returns @{ Action = none | plan | changed | failed; Lines; Warnings }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Sql, [switch]$WhatIf)
|    $out = { param($a, $l, $w) [pscustomobject]@{ Action = $a; Lines = @($l | Where-Object { $_ }); Warnings = @($w | Where-Object { $_ }) } }
|    try {
|        $plan = Get-SISnowStagingStatusPlan -Settings (Read-SISnowStagingStatusSettings -Sql $Sql)
|        if ($plan.Action -eq 'none') { return (& $out 'none' @() @()) }
|        if ($WhatIf) { return (& $out 'plan' @(('{0} (re-run with -Apply)' -f $plan.Line)) @()) }
|        $q = Get-SISnowStagingStatusSql -Statement Set
|        $o = [string](@(& $Sql $q.Sql $q.Params 'reader' | ForEach-Object { $_ } | Where-Object { $_ }) | ForEach-Object { if ($_ -is [System.Collections.IDictionary]) { $_['Outcome'] } else { $_.Outcome } } | Select-Object -First 1)
|        if ($o -ne 'changed') { return (& $out 'none' @() @(('ServiceNow: {0} was set by someone while the update read it -- left as it is' -f $script:SISnowStagingStatusUpdate.Setting))) }
|        # READ BACK
|        $after = Read-SISnowStagingStatusSettings -Sql $Sql
|        if (-not $after.ContainsKey($script:SISnowStagingStatusUpdate.Setting)) { return (& $out 'failed' @(('ServiceNow: {0} could not be read back after it was set -- the next update tries again' -f $script:SISnowStagingStatusUpdate.Setting)) @()) }
|        & $out 'changed' @($plan.Line) @()
|    } catch { & $out 'failed' @(('ServiceNow: the staging status setting was not checked ({0}) -- the update goes on; the next update tries again.' -f $_.Exception.Message)) @() }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-SnowOneRoute.ps1'] = @{ Sha256 = 'eccb9b86cd4fdb66cbb5d91459aa5cb966edd78d10adc2c0893dd2f145d8d737'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight Pro -- UPDATE STEP 9o: ONE ROUTE INTO SERVICENOW (#914, owner 2026-10-27).
|
|    The older ServiceNow push -- the CMDB job's Import Set push and direct write, the vulnerability close-loop's ServiceNow
|    connector -- was REMOVED; the ServiceNow data-out connector is the one ServiceNow push. No customer used the older push,
|    but an existing install may still hold one of its settings. This step reads them ONCE per install:
|
|      * a setting of the older push that holds a value (SI_ServiceNow_ImportSetTable, SI_ServiceNow_ImportSetMaxRows,
|        SI_VulnSync_ServiceNowImportSetTable, SI_ServiceNow_DirectWrite, SI_VulnSync_ServiceNowDirectWrite) is NAMED in ONE
|        line of the update log: the code no longer reads it (retired in the settings catalog), the ServiceNow data-out
|        connector is the one push;
|      * NOTHING is deleted: the setting rows stay in the settings database (never customer data deleted) and are ignored;
|      * the step records that it said so (cfg.InstallState 'SnowOneRoute'), so the line is said once, never on every update.
|
|    Never fails the update: a database that cannot be read is one warning, and the next update tries again. -WhatIf: the plan.
|    PowerShell 7; parses on 5.1. No modules.
|#>
|
|$script:SISnowOneRoute = [pscustomobject]@{
|    Marker   = 'SnowOneRoute'
|    By       = 'SecurityInsight update'
|    Settings = @('SI_ServiceNow_ImportSetTable', 'SI_ServiceNow_ImportSetMaxRows', 'SI_VulnSync_ServiceNowImportSetTable', 'SI_ServiceNow_DirectWrite', 'SI_VulnSync_ServiceNowDirectWrite')
|}
|
|function Get-SISnowOneRouteSettings { <# PURE. The older push's settings this step names. #> , @($script:SISnowOneRoute.Settings) }
|
|function Get-SISnowOneRouteReadSql {
|    <# The marker and the older push's setting rows (every scope). #>
|    @'
|SET NOCOUNT ON;
|SELECT N'marker' AS Kind, Name, CAST(N'' AS nvarchar(64)) AS Scope, Value AS ValueJson FROM cfg.InstallState WHERE OBJECT_ID(N'cfg.InstallState') IS NOT NULL AND Name = @Marker
|UNION ALL
|SELECT N'setting', Name, Scope, ValueJson FROM cfg.Setting WHERE Name IN (SELECT value FROM OPENJSON(@names));
|'@
|}
|
|function Get-SISnowOneRouteMarkSql {
|    <# The marker, written once (never overwritten). #>
|    "IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL AND NOT EXISTS (SELECT 1 FROM cfg.InstallState WHERE Name = @Marker) INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@Marker, @Value, NULL, @By);"
|}
|
|function Test-SISnowOneRouteValueSet {
|    <# PURE. Does a stored value hold something (not empty, not false, not 0)? #>
|    param([AllowNull()][AllowEmptyString()][string]$ValueJson)
|    $v = ([string]$ValueJson).Trim().Trim('"').Trim()
|    if (-not $v) { return $false }
|    return (@('false', '0', 'null', 'off', 'no') -notcontains $v.ToLowerInvariant())
|}
|
|function Get-SISnowOneRoutePlan {
|    <#
|        PURE. The step's decision from the rows read (Get-SISnowOneRouteReadSql): @{ Action ('none' | 'say' | 'mark');
|        Named (the settings that hold a value); Lines }. Said already (the marker) = none. No setting holds a value = mark
|        only (nothing to say, the marker so the step is not read again).
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @())
|    $g = { param($r, $n) if ($r -is [System.Collections.IDictionary]) { $r[$n] } else { $r.$n } }
|    if (@($Rows | Where-Object { [string](& $g $_ 'Kind') -eq 'marker' }).Count) { return [pscustomobject]@{ Action = 'none'; Named = @(); Lines = @() } }
|    $named = @(@($Rows | Where-Object { [string](& $g $_ 'Kind') -eq 'setting' -and (Test-SISnowOneRouteValueSet ([string](& $g $_ 'ValueJson'))) } |
|               ForEach-Object { [string](& $g $_ 'Name') }) | Select-Object -Unique | Sort-Object)
|    if ($named.Count -eq 0) { return [pscustomobject]@{ Action = 'mark'; Named = @(); Lines = @() } }
|    $line = ('ServiceNow: the older ServiceNow push was removed -- {0} {1} no longer read (the values stay in the settings database). The ServiceNow data-out connector is the one ServiceNow push: set it up on Configuration > Connectors > Setup (direction data-out).' -f ($named -join ', '), $(if ($named.Count -eq 1) { 'is' } else { 'are' }))
|    [pscustomobject]@{ Action = 'say'; Named = $named; Lines = @($line) }
|}
|
|function Invoke-SISnowOneRouteUpdate {
|    <#
|        Update step 9o through -Sql { param($Query, $Params, $Mode) } (the Pro database). Returns @{ Action; Named; Lines;
|        Warnings }. -WhatIf: the plan only (nothing marked). Never throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Sql, [switch]$WhatIf)
|    try {
|        $rows = @(& $Sql (Get-SISnowOneRouteReadSql) @{ Marker = $script:SISnowOneRoute.Marker; names = (ConvertTo-Json -InputObject @($script:SISnowOneRoute.Settings) -Compress) } 'reader')
|        $plan = Get-SISnowOneRoutePlan -Rows $rows
|        if ($plan.Action -eq 'none' -or $WhatIf) { return [pscustomobject]@{ Action = $plan.Action; Named = $plan.Named; Lines = @($plan.Lines); Warnings = @() } }
|        $null = & $Sql (Get-SISnowOneRouteMarkSql) @{ Marker = $script:SISnowOneRoute.Marker; Value = ('said: {0}' -f $(if ($plan.Named.Count) { $plan.Named -join ',' } else { 'nothing set' })); By = $script:SISnowOneRoute.By } 'nonquery'
|        [pscustomobject]@{ Action = $plan.Action; Named = $plan.Named; Lines = @($plan.Lines); Warnings = @() }
|    } catch {
|        [pscustomobject]@{ Action = 'failed'; Named = @(); Lines = @(); Warnings = @(('ServiceNow: the older push''s settings could not be read ({0}) -- the update goes on; the next update tries again.' -f $_.Exception.Message)) }
|    }
|}
'@ }
$__siSupportFiles['container/_shared/SI-ContainerRunState.ps1'] = @{ Sha256 = 'fa86c16a1700cbb12e6118eb2975f5bafb7d7886afc8023ff2b187bfb448fc16'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- what a CONTAINER job keeps in the install's own storage account, because its disk does not outlive it.
|
|    On a VM the install's folder holds two things a container job never has:
|
|      1. THE CUSTOMER'S CUSTOMISATION FILES -- their CMDB.csv, custom Risk Analysis queries, exclusion files, enrichment
|         rules, schema overlays and decision files. A container image must never carry a tenant's files (the image is a
|         shared artifact; .dockerignore keeps them out), and an updater rebuild from the published archive could not carry
|         them anyway. So setup (Bootstrap-ContainerAppJob.ps1, and the update hook after every sync) copies the install's
|         customisation files to the 'sioverlay' container of the install's storage account, and every job restores them
|         into its own folder tree at start -- to the same places a VM reads them. Community needs no licence for this.
|         A Pro install with the settings database keeps its configuration in the database; the overlay is then not used.
|      2. THE RISK ANALYSIS BUCKET CACHE (OUTPUT/AutoBucketCache.json) -- the bucket counts that let a run skip the probe.
|         Kept per report template in the 'sistate' container: loaded before the run, saved after it.
|
|    Contract (the same as the privilege-tier catalog blob, engine/_shared/SI-CatalogBlob.ps1):
|      * Never fails a run: a storage error is a warning, and the run continues without the copy.
|      * No storage account configured = silent no-op.
|      * OAuth through the job's identity only. No account key.
|      * ONLY customisation files travel -- an allow-list of names (Test-SIOverlayPath), checked when uploading AND when
|        restoring. Never a script, never a config .ps1 (those carry secrets; settings travel as SI_CFG_*), never a
|        sample, never a shipped file.
|#>
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../../engine/_shared/SI-AzRest.ps1') }
|
|$script:SIOverlayContainer = 'sioverlay'
|$script:SIStateContainer   = 'sistate'
|
|# The customisation files, as paths relative to the solution root ('/' separators, any letter case). Nothing else.
|$script:SIOverlayPatterns = @(
|    '^asset-profiling-enrichment/.+\.custom\.ya?ml$',                                 # enrichment / tier rules
|    '^asset-profiling-schema/[^/]+\.schema\.custom\.json$',                            # schema overlays
|    '^asset-profiling-providers/(generic-cmdb|servicenow-cmdb)/cmdb\.csv$',            # the customer's CMDB export
|    '^risk-analysis-detection/(custom/)?riskanalysis_queries_custom\.yaml$',           # custom Risk Analysis queries
|    '^risk-analysis-detection/(custom/)?[^/]+\.exclude(\.custom)?\.json$',             # per-report exclusions
|    '^risk-analysis-detection/riskanalysisglobalexclusions\.custom\.json$',            # global exclusions
|    '^risk-analysis-detection/[^/]+\.weighted\.custom\.json$',                         # per-report weights
|    '^risk-analysis-detection/riskscore_weighted\.schema\.custom\.json$',              # solution-wide weights
|    '^risk-analysis-detection/riskscore\.index\.custom\.csv$',                         # the customer's own risk index rows (#398)
|    '^config/(asset-decisions|correlation-decisions)\.custom\.ya?ml$',                 # operator decisions
|    '^config/cmdb-source-ownership\.custom\.json$',                                    # CMDB ownership overrides
|    '^config/job-flow\.custom\.json$',                                                 # the daily job flow (#269)
|    '^config/asset-tagging\.config\.json$',                                            # asset-tagging AutoExclude gates (#275 G13)
|    '^asset-profiling-enrichment/endpoint/server-applications\.json$',                 # server-application catalog override (#275 G13)
|    '^data-model/(mappings/|outputs/)?[a-z0-9][a-z0-9_\-]*\.custom\.json$'             # data-model overrides: catalog, mappings, ... (#456)
|)
|
|function ConvertTo-SIOverlayRelativePath {
|    <# PURE. A relative path in the overlay's form: '/' separators, no leading './' or '/'. $null when it is not relative
|       or climbs out of the tree. #>
|    param([AllowNull()][AllowEmptyString()][string]$Path)
|    if ([string]::IsNullOrWhiteSpace($Path)) { return $null }
|    $p = ($Path.Trim() -replace '\\', '/')
|    while ($p.StartsWith('./')) { $p = $p.Substring(2) }
|    if ($p.StartsWith('/') -or $p -match '^[A-Za-z]:' -or $p -match '(^|/)\.\.(/|$)' -or $p -match '//' ) { return $null }
|    return $p
|}
|
|function Test-SIOverlayPath {
|    <# PURE. Is this relative path a customisation file the overlay may carry? Samples, scripts and anything outside the
|       allow-list are refused. #>
|    param([AllowNull()][AllowEmptyString()][string]$RelativePath)
|    $p = ConvertTo-SIOverlayRelativePath -Path $RelativePath
|    if (-not $p) { return $false }
|    if ($p -match '(?i)\.sample(\.|$)' -or $p -match '(?i)\.(ps1|psm1|psd1|exe|dll|sh|cmd|bat)$') { return $false }
|    foreach ($rx in $script:SIOverlayPatterns) { if ($p -match ('(?i)' + $rx)) { return $true } }
|    return $false
|}
|
|function Get-SIContainerOverlayFiles {
|    <# The install's customisation files under -Root: @{ RelativePath; FullName; Length }, sorted. Run output, the
|       internal folder and the web app are never walked. #>
|    param([Parameter(Mandatory)][string]$Root)
|    $rootFull = (Resolve-Path -LiteralPath $Root).ProviderPath.TrimEnd('\', '/')
|    $skip = '^(\.git|output|data|logs|staging|internal|analyzer-web|tests|docs|demo)(/|$)'
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($top in @('asset-profiling-enrichment', 'asset-profiling-schema', 'asset-profiling-providers', 'risk-analysis-detection', 'config')) {
|        $dir = Join-Path $rootFull $top
|        if (-not (Test-Path -LiteralPath $dir -PathType Container)) { continue }
|        foreach ($f in @(Get-ChildItem -LiteralPath $dir -Recurse -File -ErrorAction SilentlyContinue)) {
|            $rel = ConvertTo-SIOverlayRelativePath -Path ($f.FullName.Substring($rootFull.Length + 1))
|            if (-not $rel -or $rel -match ('(?i)' + $skip) -or -not (Test-SIOverlayPath -RelativePath $rel)) { continue }
|            $out.Add([pscustomobject]@{ RelativePath = $rel; FullName = $f.FullName; Length = $f.Length })
|        }
|    }
|    $out.ToArray() | Sort-Object RelativePath
|}
|
|function Publish-SIContainerOverlay {
|    <#
|        Setup side. Copies the install's customisation files to the 'sioverlay' container of -AccountName, and removes a
|        file there that the install no longer has (so deleting a customisation takes effect too). Never throws. Returns
|        @{ Files; Uploaded; Removed; Failed; Message }.
|        -Rest: the update's REST seam (setup/_shared/SI-UpdateRest.ps1; #521, no az CLI): the blob data plane over OAuth.
|        The only path: the az seam (-Az) is gone.
|    #>
|    param([Parameter(Mandatory)][string]$Root, [string]$AccountName, [scriptblock]$Rest)
|    $res = [ordered]@{ Files = @(); Uploaded = 0; Removed = @(); Failed = @(); Message = '' }
|    if ([string]::IsNullOrWhiteSpace($AccountName)) { $res.Message = 'no storage account configured -- customisation files are not shared with the container jobs'; return [pscustomobject]$res }
|    if (-not $Rest) { throw 'Publish-SIContainerOverlay: pass -Rest (the REST seam of setup\_shared\SI-UpdateRest.ps1).' }
|    $files = @(Get-SIContainerOverlayFiles -Root $Root)
|    $res.Files = @($files | ForEach-Object { $_.RelativePath })
|    Publish-SIContainerOverlayRest -Files $files -AccountName $AccountName -Rest $Rest -Result $res
|}
|
|function Publish-SIContainerOverlayRest {
|    <#
|        Publish-SIContainerOverlay over the blob data plane (-Rest seam, audience https://storage.azure.com/, OAuth only):
|        the container (PUT ?restype=container; 409 = it exists), one PUT BlockBlob per file, the list (GET ?comp=list, every
|        page), one DELETE per blob the install no longer has. Only names the overlay may hold are ever removed. Never throws.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Files, [Parameter(Mandatory)][string]$AccountName, [Parameter(Mandatory)][scriptblock]$Rest,
|          [Parameter(Mandatory)][System.Collections.IDictionary]$Result)
|    $res = $Result
|    $st = 'https://storage.azure.com/'
|    $ver = @{ 'x-ms-version' = '2021-08-06' }
|    $base = 'https://{0}.blob.core.windows.net/{1}' -f $AccountName, $script:SIOverlayContainer
|    $blobUri = { param($name) $base + '/' + ((@(([string]$name) -split '/') | ForEach-Object { [uri]::EscapeDataString($_) }) -join '/') }
|    $why = { param($r) $b = ("$($r.Body)" -replace '\s+', ' ').Trim(); if ($b.Length -gt 300) { $b = $b.Substring(0, 297) + '...' }; 'HTTP {0}: {1}' -f $r.Status, $b }
|    try {
|        $r = & $Rest 'PUT' ($base + '?restype=container') $null $st $ver
|        $cs = [int]$r.Status
|        if (-not ($cs -eq 409 -or ($cs -ge 200 -and $cs -lt 300))) {
|            $res.Failed = @('(container)')
|            $res.Message = ("could not reach the '{0}' container in storage account '{1}' ({2}) -- the container jobs keep the customisation files shared last time. Setup needs Storage Blob Data Contributor there." -f $script:SIOverlayContainer, $AccountName, (& $why $r))
|            return [pscustomobject]$res
|        }
|        $up = 0; $bad = New-Object System.Collections.Generic.List[string]; $firstErr = ''
|        foreach ($f in @($Files)) {
|            $h = @{ 'x-ms-version' = '2021-08-06'; 'x-ms-blob-type' = 'BlockBlob'; 'Content-Type' = 'application/octet-stream' }
|            $u = & $Rest 'PUT' (& $blobUri $f.RelativePath) ([IO.File]::ReadAllBytes($f.FullName)) $st $h
|            if ([int]$u.Status -ge 200 -and [int]$u.Status -lt 300) { $up++ } else { $bad.Add([string]$f.RelativePath); if (-not $firstErr) { $firstErr = & $why $u } }
|        }
|        $res.Uploaded = $up
|        if ($bad.Count) { $res.Failed = @($bad); $res.Message = ('upload failed: {0}' -f $firstErr) }
|        # the blobs there now (every page), then what the install no longer has
|        $remote = New-Object System.Collections.Generic.List[string]; $marker = ''; $listed = $true
|        for ($p = 0; $p -lt 50; $p++) {
|            $l = & $Rest 'GET' ($base + '?restype=container&comp=list' + $(if ($marker) { '&marker=' + [uri]::EscapeDataString($marker) } else { '' })) $null $st $ver
|            if ([int]$l.Status -lt 200 -or [int]$l.Status -ge 300) { $listed = $false; break }
|            $xml = [string]$l.Body; if ($xml.Length -and $xml[0] -eq [char]0xFEFF) { $xml = $xml.Substring(1) }
|            $doc = [xml]$xml
|            foreach ($n in @($doc.SelectNodes('//Blobs/Blob/Name'))) { if ($n) { $remote.Add([string]$n.InnerText) } }
|            $nm = $doc.SelectSingleNode('//NextMarker'); $marker = if ($nm) { [string]$nm.InnerText } else { '' }
|            if (-not $marker) { break }
|        }
|        if ($listed) {
|            $have = @{}; foreach ($n in $res.Files) { $have[$n.ToLowerInvariant()] = $true }
|            $removed = New-Object System.Collections.Generic.List[string]
|            foreach ($b in $remote) {
|                if (-not (Test-SIOverlayPath -RelativePath $b) -or $have.ContainsKey(([string]$b).ToLowerInvariant())) { continue }
|                $d = & $Rest 'DELETE' (& $blobUri $b) $null $st $ver
|                $ds = [int]$d.Status
|                if (($ds -ge 200 -and $ds -lt 300) -or $ds -eq 404) { $removed.Add([string]$b) } else { $res.Failed = @($res.Failed) + @([string]$b) }
|            }
|            $res.Removed = $removed.ToArray()
|        }
|    } catch { $res.Failed = @($res.Failed) + @('(overlay)'); $res.Message = ('the customisation files were not shared: {0}' -f $_.Exception.Message) }
|    if (-not $res.Message) { $res.Message = ('{0} customisation file(s) shared with the container jobs{1}' -f $res.Uploaded, $(if (@($res.Removed).Count) { ('; {0} no longer present removed' -f @($res.Removed).Count) } else { '' })) }
|    [pscustomobject]$res
|}
|
|function Get-SIRunStateContext {
|    param([string]$AccountName)
|    if ([string]::IsNullOrWhiteSpace($AccountName)) { return $null }
|    return (New-SIAzStorageContext -StorageAccountName $AccountName -UseConnectedAccount -ErrorAction Stop)
|}
|
|function Restore-SIContainerOverlay {
|    <#
|        Container side. Downloads the install's customisation files from 'sioverlay' into a run-local folder, then puts
|        each where a VM has it: -TargetRoot\<relative path>. A name outside the allow-list is skipped, whoever uploaded
|        it. Never throws. Returns @{ Applied; Skipped; Source } -- Source 'storage' or 'none'.
|    #>
|    param([string]$AccountName, [Parameter(Mandatory)][string]$TargetRoot, [string]$RunFolder)
|    $applied = New-Object System.Collections.Generic.List[string]
|    $skipped = New-Object System.Collections.Generic.List[string]
|    $none = { [pscustomobject]@{ Applied = $applied.ToArray(); Skipped = $skipped.ToArray(); Source = 'none' } }
|    if ([string]::IsNullOrWhiteSpace($AccountName)) { return (& $none) }
|    if ([string]::IsNullOrWhiteSpace($RunFolder)) { $RunFolder = Join-Path ([IO.Path]::GetTempPath()) ('si-overlay-{0}' -f [guid]::NewGuid().ToString('N')) }
|    try {
|        $ctx = Get-SIRunStateContext -AccountName $AccountName
|        $blobs = @()
|        try { $blobs = @(Get-SIAzStorageBlob -Container $script:SIOverlayContainer -Context $ctx -ErrorAction Stop | Where-Object { $_ }) }
|        catch {
|            if ("$($_.Exception.Message)" -match '(?i)ContainerNotFound|does not exist|404|Can not find the container') { return (& $none) }   # nothing shared yet
|            throw
|        }
|        foreach ($b in $blobs) {
|            $rel = ConvertTo-SIOverlayRelativePath -Path ([string]$b.Name)
|            if (-not $rel -or -not (Test-SIOverlayPath -RelativePath $rel)) { $skipped.Add([string]$b.Name); continue }
|            $local = Join-Path $RunFolder ($rel -replace '/', [IO.Path]::DirectorySeparatorChar)
|            $d = Split-Path -Parent $local
|            if (-not (Test-Path -LiteralPath $d)) { New-Item -ItemType Directory -Force -Path $d | Out-Null }
|            Get-SIAzStorageBlobContent -Container $script:SIOverlayContainer -Blob ([string]$b.Name) -Destination $local -Context $ctx -Force -ErrorAction Stop | Out-Null
|            $target = Join-Path $TargetRoot ($rel -replace '/', [IO.Path]::DirectorySeparatorChar)
|            $td = Split-Path -Parent $target
|            if (-not (Test-Path -LiteralPath $td)) { New-Item -ItemType Directory -Force -Path $td | Out-Null }
|            Copy-Item -LiteralPath $local -Destination $target -Force
|            $applied.Add($rel)
|        }
|        return [pscustomobject]@{ Applied = $applied.ToArray(); Skipped = $skipped.ToArray(); Source = $(if ($applied.Count) { 'storage' } else { 'none' }) }
|    } catch {
|        Write-Warning ("Could not restore the customisation files from storage account '{0}' ({1}); this run uses {2}." -f $AccountName, $_.Exception.Message, $(if ($applied.Count) { ('the {0} restored before the error' -f $applied.Count) } else { 'the shipped files only' }))
|        return [pscustomobject]@{ Applied = $applied.ToArray(); Skipped = $skipped.ToArray(); Source = $(if ($applied.Count) { 'storage' } else { 'none' }) }
|    }
|}
|
|function Get-SIRaAutoBucketCacheBlobName {
|    <# PURE. The bucket cache's blob, one per report template (the Summary and Detailed jobs never overwrite each other). #>
|    param([Parameter(Mandatory)][string]$Template)
|    $t = ($Template.Trim() -replace '[^A-Za-z0-9_.-]', '_')
|    return ('risk-analysis/AutoBucketCache.{0}.json' -f $t)
|}
|
|function Get-SIRaAutoBucketCacheLocalPath {
|    <# PURE. Where the Risk Analysis engine keeps the bucket cache -- the same path as Get-AutoBucketCachePath. #>
|    param([Parameter(Mandatory)][string]$SettingsPath)
|    Join-Path $SettingsPath "OUTPUT\AutoBucketCache.json"
|}
|
|function Restore-SIRaAutoBucketCache {
|    <# Container side, before the run. Loads the template's bucket cache from 'sistate' when there is one. Never throws.
|       Returns 'storage' (loaded) or 'none'. #>
|    param([string]$AccountName, [Parameter(Mandatory)][string]$LocalPath, [Parameter(Mandatory)][string]$Template)
|    if ([string]::IsNullOrWhiteSpace($AccountName)) { return 'none' }
|    try {
|        $ctx = Get-SIRunStateContext -AccountName $AccountName
|        $blobName = Get-SIRaAutoBucketCacheBlobName -Template $Template
|        $blob = $null
|        try { $blob = Get-SIAzStorageBlob -Container $script:SIStateContainer -Blob $blobName -Context $ctx -ErrorAction Stop } catch { $blob = $null }
|        if (-not $blob) { return 'none' }
|        $dir = Split-Path -Parent $LocalPath
|        if (-not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Force -Path $dir | Out-Null }
|        $tmp = Join-Path $dir ('.bucketcache-{0}.tmp' -f [guid]::NewGuid().ToString('N'))
|        try {
|            Get-SIAzStorageBlobContent -Container $script:SIStateContainer -Blob $blobName -Destination $tmp -Context $ctx -Force -ErrorAction Stop | Out-Null
|            $null = Get-Content -LiteralPath $tmp -Raw -Encoding UTF8 | ConvertFrom-Json -ErrorAction Stop
|            Move-Item -LiteralPath $tmp -Destination $LocalPath -Force
|        } finally {
|            if (Test-Path -LiteralPath $tmp) { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue }
|        }
|        return 'storage'
|    } catch {
|        Write-Warning ("Could not load the Risk Analysis bucket cache from storage account '{0}' ({1}); this run probes the bucket counts again." -f $AccountName, $_.Exception.Message)
|        return 'none'
|    }
|}
|
|function ConvertFrom-SIRaAutoBucketCacheJson {
|    <# PURE. The text of an earlier bucket cache -> the counts as a hashtable ('<report>|<fingerprint>' -> count, '__confirmed'); @{} when unreadable. #>
|    param([AllowEmptyString()][string]$Json)
|    if ([string]::IsNullOrWhiteSpace($Json)) { return @{} }
|    try { $h = ConvertFrom-Json -InputObject $Json -AsHashtable -ErrorAction Stop } catch { return @{} }
|    if ($h -isnot [System.Collections.IDictionary]) { return @{} }
|    foreach ($w in 'Entries', 'Cache', 'Data', 'AutoBucket') { if ($h.Contains($w) -and $h[$w] -is [System.Collections.IDictionary]) { $h = $h[$w]; break } }
|    $out = @{}
|    foreach ($k in @($h.Keys)) {
|        if ([string]$k -eq '__confirmed' -and $h[$k] -is [System.Collections.IDictionary]) {
|            # ConvertFrom-Json turns an ISO time into a DateTime: kept as ISO 8601 (UTC), never in a regional format
|            $c = @{}
|            foreach ($ck in @($h[$k].Keys)) { $v = $h[$k][$ck]; $c[[string]$ck] = $(if ($v -is [datetime]) { $v.ToUniversalTime().ToString('o', [Globalization.CultureInfo]::InvariantCulture) } else { [string]$v }) }
|            $out['__confirmed'] = $c; continue
|        }
|        $out[[string]$k] = $h[$k]
|    }
|    return $out
|}
|
|function Get-SIRaAutoBucketCacheForImport {
|    <#
|        #640: the ONE-TIME import. The counts this template learned while they were kept in the storage account, read once so
|        the database can take them over (no install loses its learned counts). $null when there are none. Never throws.
|    #>
|    param([string]$AccountName, [Parameter(Mandatory)][string]$Template)
|    if ([string]::IsNullOrWhiteSpace($AccountName)) { return $null }
|    $tmp = Join-Path ([IO.Path]::GetTempPath()) ('si-bucketimport-{0}.json' -f [guid]::NewGuid().ToString('N'))
|    try {
|        $ctx = Get-SIRunStateContext -AccountName $AccountName
|        $blobName = Get-SIRaAutoBucketCacheBlobName -Template $Template
|        $blob = $null
|        try { $blob = Get-SIAzStorageBlob -Container $script:SIStateContainer -Blob $blobName -Context $ctx -ErrorAction Stop } catch { $blob = $null }
|        if (-not $blob) { return $null }
|        Get-SIAzStorageBlobContent -Container $script:SIStateContainer -Blob $blobName -Destination $tmp -Context $ctx -Force -ErrorAction Stop | Out-Null
|        return (ConvertFrom-SIRaAutoBucketCacheJson -Json ([IO.File]::ReadAllText($tmp)))
|    } catch {
|        Write-Warning ("The earlier bucket counts could not be read from storage account '{0}' ({1}); the reports are sized again where the database has no count." -f $AccountName, $_.Exception.Message)
|        return $null
|    } finally {
|        if (Test-Path -LiteralPath $tmp) { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue }
|    }
|}
|
|function Save-SIRaAutoBucketCache {
|    <# Container side, after the run. Saves the template's bucket cache to 'sistate'. Never throws; $true when saved. #>
|    param([string]$AccountName, [Parameter(Mandatory)][string]$LocalPath, [Parameter(Mandatory)][string]$Template)
|    if ([string]::IsNullOrWhiteSpace($AccountName) -or -not (Test-Path -LiteralPath $LocalPath)) { return $false }
|    try {
|        $ctx = Get-SIRunStateContext -AccountName $AccountName
|        if (-not (Get-SIAzStorageContainer -Name $script:SIStateContainer -Context $ctx -ErrorAction SilentlyContinue)) {
|            New-SIAzStorageContainer -Name $script:SIStateContainer -Context $ctx -Permission Off -ErrorAction Stop | Out-Null
|        }
|        Set-SIAzStorageBlobContent -File $LocalPath -Container $script:SIStateContainer -Blob (Get-SIRaAutoBucketCacheBlobName -Template $Template) `
|            -Context $ctx -Force -ErrorAction Stop | Out-Null
|        return $true
|    } catch {
|        Write-Warning ("The Risk Analysis bucket cache was not saved to storage account '{0}' ({1}); the next run probes the bucket counts again." -f $AccountName, $_.Exception.Message)
|        return $false
|    }
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|# THE RISK ANALYSIS COMPLETENESS HISTORY (OUTPUT/RowCountHistory.json, OUTPUT/ColumnFillHistory.json): the per-report
|# finding counts and column fill of the previous run. The completeness check compares every report with its previous
|# run; in a container the folder dies with the replica, so every run read "no prior run recorded" and could never see
|# a report that lost most of its findings (measured on ring 1, 2026-10-05: every run of both templates). Kept per
|# report template in 'sistate' like the bucket cache -- the Summary and Detailed jobs never overwrite each other.
|# ---------------------------------------------------------------------------------------------------------------------
|
|function Get-SIRaGuardHistoryFiles {
|    <# PURE. The completeness history files: the engine's own local paths and their blob names for one template. #>
|    param([Parameter(Mandatory)][string]$SettingsPath, [Parameter(Mandatory)][string]$Template)
|    $t = ($Template.Trim() -replace '[^A-Za-z0-9_.-]', '_')
|    foreach ($base in 'RowCountHistory', 'ColumnFillHistory') {
|        [pscustomobject]@{
|            LocalPath = (Join-Path $SettingsPath ("OUTPUT\{0}.json" -f $base))
|            BlobName  = ('risk-analysis/{0}.{1}.json' -f $base, $t)
|        }
|    }
|}
|
|function Restore-SIRaGuardHistory {
|    <# Container side, before the run. Loads the template's completeness history from 'sistate'. Never throws.
|       Returns the number of files restored (0 = none stored yet, or storage unavailable). #>
|    param([string]$AccountName, [Parameter(Mandatory)][string]$SettingsPath, [Parameter(Mandatory)][string]$Template)
|    if ([string]::IsNullOrWhiteSpace($AccountName)) { return 0 }
|    $n = 0
|    try {
|        $ctx = Get-SIRunStateContext -AccountName $AccountName
|        foreach ($f in @(Get-SIRaGuardHistoryFiles -SettingsPath $SettingsPath -Template $Template)) {
|            $blob = $null
|            try { $blob = Get-SIAzStorageBlob -Container $script:SIStateContainer -Blob $f.BlobName -Context $ctx -ErrorAction Stop } catch { $blob = $null }
|            if (-not $blob) { continue }
|            $dir = Split-Path -Parent $f.LocalPath
|            if (-not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Force -Path $dir | Out-Null }
|            $tmp = Join-Path $dir ('.guardhistory-{0}.tmp' -f [guid]::NewGuid().ToString('N'))
|            try {
|                Get-SIAzStorageBlobContent -Container $script:SIStateContainer -Blob $f.BlobName -Destination $tmp -Context $ctx -Force -ErrorAction Stop | Out-Null
|                $null = Get-Content -LiteralPath $tmp -Raw -Encoding UTF8 | ConvertFrom-Json -ErrorAction Stop
|                Move-Item -LiteralPath $tmp -Destination $f.LocalPath -Force
|                $n++
|            } finally {
|                if (Test-Path -LiteralPath $tmp) { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue }
|            }
|        }
|    } catch {
|        Write-Warning ("Could not load the Risk Analysis completeness history from storage account '{0}' ({1}); this run cannot compare its reports with the previous run." -f $AccountName, $_.Exception.Message)
|    }
|    return $n
|}
|
|function Save-SIRaGuardHistory {
|    <# Container side, after the run. Saves the template's completeness history to 'sistate'. Never throws.
|       Returns the number of files saved. #>
|    param([string]$AccountName, [Parameter(Mandatory)][string]$SettingsPath, [Parameter(Mandatory)][string]$Template)
|    if ([string]::IsNullOrWhiteSpace($AccountName)) { return 0 }
|    $files = @(Get-SIRaGuardHistoryFiles -SettingsPath $SettingsPath -Template $Template | Where-Object { Test-Path -LiteralPath $_.LocalPath })
|    if ($files.Count -eq 0) { return 0 }
|    $n = 0
|    try {
|        $ctx = Get-SIRunStateContext -AccountName $AccountName
|        if (-not (Get-SIAzStorageContainer -Name $script:SIStateContainer -Context $ctx -ErrorAction SilentlyContinue)) {
|            New-SIAzStorageContainer -Name $script:SIStateContainer -Context $ctx -Permission Off -ErrorAction Stop | Out-Null
|        }
|        foreach ($f in $files) {
|            Set-SIAzStorageBlobContent -File $f.LocalPath -Container $script:SIStateContainer -Blob $f.BlobName -Context $ctx -Force -ErrorAction Stop | Out-Null
|            $n++
|        }
|    } catch {
|        Write-Warning ("The Risk Analysis completeness history was not saved to storage account '{0}' ({1}); the next run cannot compare its reports with this one." -f $AccountName, $_.Exception.Message)
|    }
|    return $n
|}
'@ }
$__siSupportFiles['setup/Publish-SITemplates.ps1'] = @{ Sha256 = '3927c03b6562598afb4f054ce3f9b8b082e6445fcb428d5f2347e6fba8f733fd'; Text = @'
|<#
|.SYNOPSIS
|    SecurityInsight Pro -- publish configuration TEMPLATES into the Pro settings database: this release's own, a
|    template pack the vendor released, or a previous version (roll back).
|
|.DESCRIPTION
|    In Pro the shipped *.locked files are replaced by templates (REQUIREMENTS §9.3.3 phase C): one cfg.Template row per
|    item. Templates hold only VENDOR-DEVELOPED content (#251). Built from the shipped files of THIS installation:
|      rareport      risk-analysis-detection\RiskAnalysis_Queries_Locked.yaml        (reports and report templates)
|      riskindex     risk-analysis-detection\riskscore.index.locked.csv              (one row per item)
|      rule          asset-profiling-enrichment\<engine>\**\*.locked.yaml             (every shipped tier rule)
|      assettagging  asset-profiling-enrichment\endpoint\AssetTagging.locked.yaml     (one tagging rule per item)
|      servicemodel  config\service-model.locked.json
|    The profile schemas are not templates: they are the engines' data contract, shipped with the code. The names of
|    tables / DCRs / DCE / workspace are SETTINGS, and the CMDB ownership map is the customer's CONFIGURATION (#251).
|
|    THE SHIPPED TEMPLATES ARE TEMPLATE PACK 1.0 (#250), "Default templates 1.0" (engine\pro-settings\
|    shipped-template-pack.json) -- like the old .locked files: they arrive with the install and are in force at once; the
|    customer's own changes live beside them. Template pack versions are their own series (1.0, 1.1, ...), not the code
|    version. A FULL publish of the shipped templates with -Apply (-InstallDefault = -Apply -CreateSchema, what setup and
|    the update hook run) also:
|      * carries naming and CMDB ownership over to configuration (#251, Invoke-SIProConfigurationMigration: naming
|        overrides -> cfg.Setting rows 1:1, the ownership map -> the configuration document cmdbownership/map, the former
|        template rows retired -- nothing removed);
|      * stages the shipped templates as template pack 1.0 (cfg.TemplatePackStaged), so the web app lists it;
|      * installs it (fresh install), ADOPTS it (templates already there with the same content -> recorded as installed),
|        or records the install as "customised, based on 1.0" (other content: kept, and 1.0 is offered on the Template
|        releases page) -- and records the installed pack (cfg.InstallState TemplatePack / TemplatePackStatus).
|      A newer pack already installed (from the update ring) is never taken back to the shipped one.
|
|    THE SPLIT INSTALL (#405, operator decision 2026-10-06 -- customers never import template packs by hand). Every shipped
|    template is one of three classes (config\template-classification.locked.json):
|      fix        our own queries / logic the engines rely on: installed WITH THE CODE, always, never held
|      default    customer business logic (tier rules, risk index, service model, asset tagging): SecurityInsight's default is
|                 installed with the code; a customer's edit is an override beside it and is never changed -- Template
|                 conformance shows "SecurityInsight's default changed" with compare / keep yours / take ours
|      microsoft  a new Microsoft data surface: a MICROSOFT CONTENT PACK between releases (its own series, 1.3, 1.4, ...),
|                 ring by ring, installed AUTOMATICALLY by the updater once the install runs the pack's MinCodeVersion --
|                 unless "Hold" (SI_InvardiaUpdate_HoldMicrosoftContent, default off) is on, or the customer
|                 rolled back from it (-RollbackToVersion <v> -Class microsoft): then it waits on Template releases with Install.
|                 Owner decision 2026-10-11 ("Automatic"): a pack that carries MORE than Microsoft content (SecurityInsight's
|                 own templates) installs automatically the same way -- a customer's edit is an override, never written. A
|                 pack without MinCodeVersion waits for the code it was built by (Get-SIProTemplatePackDecision).
|    It is on when the shipped pack's ClassificationReviewed is true; false keeps the old behaviour below (every change
|    waits for a review). A full shipped publish in split mode records what is installed per class: cfg.InstallState
|    TemplateCode (the code release), TemplatePack (the Microsoft content -- a NEWER pack in force is kept, never taken
|    back), TemplateMode. -InstallCurrent (RING 1, internal): every shipped template installed directly, no gate
|    (TemplateDirect); the shipped pack it put in force is recorded as the installed pack (TemplatePack, as-released), so
|    the staged pack of that version reads installed -- a NEWER pack in force is kept, as on a code roll.
|
|    THREE SOURCES (#235, template versions released per ring):
|      (default)            the templates shipped with this installation
|      -PackPath / -FromStaged
|                           a TEMPLATE PACK (si-templates-<packVersion>.json) the vendor released -- a file (checked against
|                           its .sha256), or one staged in cfg.TemplatePackStaged by the updater (checked against the
|                           SHA-256 it was staged with). Every item is checked: its body matches its hash, its content hash
|                           is what this code computes, and it validates here.
|      -RollbackToVersion   the items as they were at that pack / release version, from cfg.TemplateRevision
|    -Method publishes only those DETECTION METHODS (e.g. AssetProfileByIPSubnet, endpoint/AssetProfileByIPSubnet,
|    riskanalysis/Endpoint); an item of another method is neither written nor retired.
|
|    Shows the plan by default (insert / update / same / retire per item). -Apply writes it, each item with a
|    cfg.ChangeLog entry. A customer's overrides (cfg.ItemOverride) are never read or changed: publishing a new release
|    keeps every override, and an override made against older template CONTENT reads "upgrade available".
|    An item this release no longer ships is RETIRED (RetiredAt), never removed.
|
|    A template that does not validate is never published; with any such template -Apply refuses (a release with an
|    invalid shipped file is a defect to fix, not to half-publish).
|
|    THE FINGERPRINT GATE (adopted from PIM4EntraPS). The templates in force are fingerprinted by CONTENT (comments,
|    key order, `_*` keys and descriptions do not count). The install records the fingerprint it last published
|    (cfg.InstallState 'TemplateFingerprint'). When this publish would put a DIFFERENT fingerprint in force, -Apply writes
|    nothing unless -AcceptTemplateChange is given -- the plan lists what changes. -AcceptFingerprint narrows the
|    acceptance to exactly the fingerprint the plan showed (the updater uses it, so an acceptance is never a standing
|    blank cheque). A publish that changes only comments or descriptions needs no acceptance.
|    From a pack, a roll-back or a -Method selection, -AcceptFingerprint names the SELECTION fingerprint (what is
|    accepted: the selected methods' items and retirements, the plan prints it) and any other is refused; and a selection
|    that changes an item the customer overrides or switched off is never written without an acceptance.
|    The fingerprint is recorded ONLY after the written templates are read back and verified: every body matches its
|    hash, every row carries its content hash, and the set in force is exactly the planned one. A pack / roll-back release
|    is recorded then too (cfg.ChangeLog 'template-release'; a whole pack also as cfg.InstallState 'TemplatePack').
|
|    -Stage puts the pack (or, without one, the templates shipped with this installation) in cfg.TemplatePackStaged, where
|    the web app's Template releases page offers it. It writes nothing else.
|
|    Callable from setup, from the container updater after a new release is synced, and as the Container Apps job
|    caj-si-templates the web app starts after an Admin accepted a release:
|        & .\setup\Publish-SITemplates.ps1 -Apply -Server <sql> -Database <db> [-AcceptTemplateChange]
|    The database is reached as the engine identity (certificate, or the managed identity in a container), like the
|    run-time settings layer; it needs write access to the cfg schema.
|
|.EXAMPLE
|    .\setup\Publish-SITemplates.ps1 -Server s -Database d -InstallDefault   # what setup runs: schema, carry-over, pack 1.0
|    .\setup\Publish-SITemplates.ps1                           # what would be published (no database needed)
|    .\setup\Publish-SITemplates.ps1 -Server s -Database d     # the plan against the database's templates
|    .\setup\Publish-SITemplates.ps1 -Server s -Database d -Apply -CreateSchema
|    .\setup\Publish-SITemplates.ps1 -Server s -Database d -Apply -AcceptTemplateChange   # after reviewing the plan
|    .\setup\Publish-SITemplates.ps1 -Server s -Database d -PackPath .\si-templates-3.0.1.202610031200.json -Method AssetProfileByIPSubnet
|    .\setup\Publish-SITemplates.ps1 -Server s -Database d -FromStaged 3.0.1.202610031200 -Apply -AcceptFingerprint <selection fingerprint>
|    .\setup\Publish-SITemplates.ps1 -Server s -Database d -RollbackToVersion 3.0.0 -Method riskanalysis/Endpoint
|
|.LINK
|    https://invardia.com/docs/si/scripts/Publish-SITemplates/
|#>
|[CmdletBinding(SupportsShouldProcess)]
|param(
|    [string]$InstallPath,
|    [switch]$Apply,
|    [switch]$CreateSchema,
|    # What every setup / update path runs (#250): -Apply -CreateSchema of the shipped templates -- the schema, the #251
|    # carry-over, and the default templates installed (or adopted) as template pack 1.0.
|    [switch]$InstallDefault,
|    # The templates in force may change (the plan listed what changes). Without it a moved fingerprint writes nothing.
|    [switch]$AcceptTemplateChange,
|    # Accept only this fingerprint (at least its first 12 characters) -- what the plan printed.
|    [string]$AcceptFingerprint,
|    [string]$Server = [string]$global:SI_ProSqlServer,
|    [string]$Database = [string]$global:SI_ProSqlDatabase,
|    [string]$AppId = [string]$global:SI_SPN_AppId,
|    [string]$TenantId = [string]$global:SI_SPN_TenantId,
|    [string]$CertThumbprint = [string]$global:SI_SPN_CertThumbprint,
|    # Publish only these kinds (default: all). Retiring is limited to the same kinds.
|    [ValidateSet('rareport', 'riskindex', 'rule', 'assettagging', 'servicemodel')]
|    [string[]]$Families,
|    # The version to stamp (default: the shipped template pack's version, engine\pro-settings\shipped-template-pack.json).
|    [string]$Version,
|    # A template pack file (si-templates-<packVersion>.json); its .sha256 beside it is checked when present.
|    [string]$PackPath,
|    # The pack's SHA-256 (overrides the .sha256 file).
|    [string]$PackSha256,
|    # A pack staged in cfg.TemplatePackStaged, by version.
|    [string]$FromStaged,
|    # Republish the items as they were at this pack / release version (cfg.TemplateRevision).
|    [string]$RollbackToVersion,
|    # Only these detection methods ('<method>' or '<engine>/<method>'; '*' = all).
|    [string[]]$Method,
|    # Put the pack (or the shipped templates) in cfg.TemplatePackStaged for the web app.
|    [switch]$Stage,
|    [ValidateSet('feed', 'shipped', 'file')][string]$StageOrigin,
|    [string]$StageRing,
|    # A pack from Invardia: the SIGNED manifest it came with (manifestB64, signature, keyId), kept with the staged pack --
|    # -FromStaged verifies it again against the keys embedded in this release before anything is installed.
|    [string]$StageManifestB64,
|    [string]$StageSignature,
|    [string]$StageKeyId,
|    # A job run: a publish that is blocked FAILS (the web app shows the job as failed) instead of ending as a plan.
|    [switch]$StrictJob,
|    # Who accepted this release in the web app (recorded in the release's reason; the actor stays the session).
|    [string]$RequestedBy,
|    # The database, already open (New-SIProSettingsStore -Invoke ...): the container updater's token, or a test's fake.
|    $Store,
|    # Return the outcome as an object (the updater reads it).
|    [switch]$PassThru,
|    # #405: RING 1 (internal) -- every template shipped with this code installed DIRECTLY: no pack number, no gate, no
|    # pack recorded as a release (the r1 deploy passes it; setup\Invoke-SIContainerUpdate.ps1 -InstallTemplatesDirect).
|    [switch]$InstallCurrent,
|    # #405: with -RollbackToVersion, only the items of these classes (the one-click roll back of Microsoft content).
|    [ValidateSet('fix', 'default', 'microsoft')][string[]]$Class,
|    # Test seam: $true / $false instead of the shipped pack's ClassificationReviewed flag ($null = the flag decides).
|    $ClassificationReviewed = $null
|)
|
|#Requires -Version 5.1   # after the help and the param block: before the help, it hides the help from Get-Help
|# framework section 12.7 / 12.10: the documentation link first, a transcript of the run, -WhatIf writes nothing
|. ([IO.Path]::Combine($PSScriptRoot, '_shared', 'SI-ScriptRun.ps1'))
|$siRun = Start-SIScriptRun -Script 'Publish-SITemplates' -Quiet:([bool]$PSBoundParameters.ContainsKey('Store'))
|try {
|$ErrorActionPreference = 'Stop'
|$siRoot = Split-Path -Parent $PSScriptRoot
|if ($InstallPath) {
|    $siRoot = @((Join-Path $InstallPath 'SOLUTIONS\SecurityInsight'), $InstallPath) | Where-Object { Test-Path -LiteralPath (Join-Path $_ 'config') } | Select-Object -First 1
|    if (-not $siRoot) { throw "no SecurityInsight installation under $InstallPath" }
|}
|. (Join-Path $siRoot 'engine\pro-settings\SI-ProSettings.ps1')
|. (Join-Path $siRoot 'engine\pro-settings\SI-TemplatePacks.ps1')
|
|if (@($PackPath, $FromStaged, $RollbackToVersion | Where-Object { $_ }).Count -gt 1) { throw 'give ONE source: -PackPath, -FromStaged or -RollbackToVersion' }
|if ($InstallDefault) {
|    if ($PackPath -or $FromStaged -or $RollbackToVersion -or $Families -or $Method) { throw '-InstallDefault installs the shipped templates as a whole -- it takes no -PackPath, -FromStaged, -RollbackToVersion, -Families or -Method' }
|    $Apply = [switch]$true; $CreateSchema = [switch]$true
|}
|if ($InstallCurrent) {
|    if ($PackPath -or $FromStaged -or $RollbackToVersion -or $Families -or $Method -or $InstallDefault) { throw '-InstallCurrent installs every shipped template directly -- it takes no -PackPath, -FromStaged, -RollbackToVersion, -Families, -Method or -InstallDefault' }
|    $Apply = [switch]$true; $CreateSchema = [switch]$true
|}
|# -WhatIf = the plan, also for -InstallDefault / -InstallCurrent / -Stage: nothing is written to the Pro database
|if ($WhatIfPreference) { $Apply = [switch]$false; $CreateSchema = [switch]$false; $Stage = [switch]$false }
|if ($Class -and -not $RollbackToVersion) { throw '-Class selects the items of a roll back (e.g. -RollbackToVersion 1.3 -Class microsoft)' }
|$source = if ($PackPath -or $FromStaged) { 'pack' } elseif ($RollbackToVersion) { 'rollback' } else { 'shipped' }
|$selective = ($source -ne 'shipped') -or [bool]$Method
|# #250: a publish of EVERY shipped template is the default-templates path -- the carry-over, pack 1.0, the installed pack
|$fullShipped = ($source -eq 'shipped') -and -not $Families -and -not $Method
|$shippedInfo = Get-SIProShippedPackInfo -SIRoot $siRoot
|# #405 (operator decision 2026-10-06): THE SPLIT INSTALL -- every shipped template is fix | default | microsoft
|# (config\template-classification.locked.json). It runs when the vendor marked that classification as reviewed (the
|# shipped pack's ClassificationReviewed): the code's fix + default templates are installed with the code, never held (a
|# customer's edit is an override beside them and is never changed); a Microsoft content pack is installed automatically
|# unless the install holds Microsoft content. Not reviewed = the old behaviour: every change waits for a review.
|$classification = Get-SIProTemplateClassification -SIRoot $siRoot
|$reviewed = if ($null -ne $ClassificationReviewed) { [bool]$ClassificationReviewed } else { [bool]$shippedInfo.ClassificationReviewed }
|$split = $reviewed -and [bool]$classification.Present
|$codeVersion = Get-SIProShippedVersion -SIRoot $siRoot
|# the shipped templates, installed with the code (split) or directly (ring 1)
|$splitShipped = $fullShipped -and ($split -or $InstallCurrent)
|
|$result = [ordered]@{ Mode = 'plan'; Source = $source; Version = ''; PackVersion = ''; Fingerprint = ''; Baseline = ''; Recorded = ''; Moved = $false; Initial = $false
|    Allowed = $false; Changes = @(); Written = 0; Verified = $false; Reason = ''; SelectionFingerprint = ''; Methods = @(); Selected = @(); Affected = 0; Staged = ''
|    PackName = ''; Decision = ''; InstalledPack = ''; PackStatus = ''; Migration = $null
|    Split = [bool]$split; Auto = $false; CodeVersion = $codeVersion; KeptMicrosoft = $false; Direct = [bool]$InstallCurrent; Class = @($Class | Where-Object { $_ }) }
|$finish = {
|    param($mode, $reason)
|    $result.Mode = $mode; $result.Reason = $reason
|    # #260: a publish that wrote, or that was blocked, is on the audit trail (a plan writes nothing and is not recorded)
|    if ($Store -and $mode -in 'applied', 'blocked' -and -not $WhatIfPreference -and (Get-Command -Name Write-SIAuditEvent -ErrorAction SilentlyContinue)) {
|        # #302 (AUDIT-1.1): a release an Admin accepted in the web app names the Admin (the job's start carries who it was,
|        # SI_AUDIT_CID); the request's own name (SI_TEMPLATES_REQUESTED_BY) is the fallback when the start carried none
|        $tplAttr = $null
|        if ($global:SI_UseManagedIdentity -and [string]$RequestedBy -and -not (Get-SIJobAttribution -Invoke $Store.Invoke)) {
|            $tplAttr = [pscustomobject]@{ Actor = [string]$RequestedBy; ApprovedBy = ''; CorrelationId = ''; Via = 'request' }
|        }
|        [void](Write-SIAuditEvent -Store $Store -Action 'template.pack.publish' -Actor (Get-SIAuditActor) -ActorSource $(if ($global:SI_UseManagedIdentity) { 'job' } else { 'setup' }) -Attribution $tplAttr `
|            -Target ('template pack ' + [string]$result.Version) -Reason ([string]$reason) -Outcome $(if ($mode -eq 'applied') { 'ok' } else { 'refused' }) `
|            -OutcomeText $(if ($mode -eq 'blocked') { [string]$reason } else { $null }) `
|            -After ([ordered]@{ version = [string]$result.Version; written = $result.Written; fingerprint = [string]$result.Fingerprint; verified = [bool]$result.Verified; requestedBy = [string]$RequestedBy }))
|    }
|    if ($StrictJob -and $mode -eq 'blocked') { throw ('nothing written -- {0}' -f $reason) }
|    if ($PassThru) { [pscustomobject]$result }
|}
|
|if (-not $Store -and $Server -and $Database) {
|    try { $Store = New-SIProSettingsStore -Server $Server -Database $Database -AppId $AppId -TenantId $TenantId -CertThumbprint $CertThumbprint }
|    catch { if ($Apply -or $FromStaged -or $RollbackToVersion -or $Stage) { throw }; Write-Host ("[WARN] the Pro database cannot be reached from here ({0}) -- planning without it" -f $_.Exception.Message) -ForegroundColor Yellow }
|}
|if ($Apply -and -not $Store) { throw 'nothing written: -Apply needs the Pro database (SI_ProSqlServer / SI_ProSqlDatabase, or -Server / -Database)' }
|if (($FromStaged -or $RollbackToVersion -or $Stage) -and -not $Store) { throw 'the Pro database is needed for -FromStaged, -RollbackToVersion and -Stage (SI_ProSqlServer / SI_ProSqlDatabase, or -Server / -Database)' }
|if ($Apply -and $CreateSchema) {
|    $ddl = [System.IO.File]::ReadAllText((Join-Path $siRoot 'sql\si-pro-settings.sql'))
|    foreach ($batch in ($ddl -split '(?m)^\s*$') | Where-Object { ($_ -replace '(?m)^\s*--.*$', '').Trim() }) { & $Store.Invoke $batch @{} 'nonquery' }
|    Write-Host '[OK]   cfg schema present'
|}
|# ---- #251: naming and CMDB ownership become configuration -- carried over 1:1 before anything else is planned ----------
|if ($Apply -and $fullShipped -and $Store -and -not @(Test-SIProVersioningSchema -Store $Store).Count) {
|    $mig = Invoke-SIProConfigurationMigration -Store $Store -SIRoot $siRoot
|    $result.Migration = [pscustomobject]@{ Settings = $mig.Written.Settings; Map = $mig.Written.Map; Retired = $mig.Written.Retired; Kept = @($mig.Kept).Count; NotCarried = @($mig.NotCarried).Count; Refused = @($mig.Refused) }
|    if (-not $mig.Empty) {
|        Write-Host ("[OK]   names and CMDB ownership are configuration now: {0} name(s) carried over as settings, CMDB ownership map {1}, {2} former template row(s) kept as history" -f $mig.Written.Settings, $(if ($mig.Written.Map) { 'written (' + $mig.Map.From + ')' } else { 'unchanged' }), $mig.Written.Retired)
|    }
|    foreach ($k in @($mig.Kept)) { Write-Host ("[INFO] {0}: your setting ({1}) already decides this name -- kept" -f $k.Name, $k.Setting) }
|    foreach ($k in @($mig.NotCarried)) { Write-Host ("[WARN] {0}: {1}" -f $k.Name, $k.Reason) -ForegroundColor Yellow }
|    foreach ($k in @($mig.Refused)) { Write-Host ("[WARN] {0}" -f $k) -ForegroundColor Yellow }
|}
|# #405: how this code installs templates -- 'split' (fix + default with the code, Microsoft content automatic) or 'gated'
|# (every change reviewed) -- recorded on every setup / update run, so the web app's pages say what the install does
|if ($Apply -and $fullShipped -and $Store -and -not @(Test-SIProVersioningSchema -Store $Store).Count) {
|    Set-SIProInstallStateValue -Store $Store -Name 'TemplateMode' -Value $(if ($split) { 'split' } else { 'gated' }) -Version $codeVersion
|}
|$existing = @(); $recorded = ''; $overrides = @(); $translated = $false
|# #405: what the install recorded per class -- ring 1's direct install, the Microsoft content rolled back from, the hold
|$installedBefore = ''; $installedStatusBefore = ''; $directState = ''; $declinedState = ''; $holdMs = $false
|if ($Store) {
|    try {
|        $existing = @(Read-SIProTemplates -Store $Store)
|        $rec = Read-SIProInstallState -Store $Store
|        if ($rec) { $recorded = ([string](Get-SIProRowValue $rec 'Value')).Trim() }
|        if ($selective) { $overrides = @(Read-SIProItemOverrides -Store $Store) }
|        if ($split -or $InstallCurrent -or $source -eq 'pack') {
|            $installedBefore = Read-SIProInstalledPack -Store $Store
|            $installedStatusBefore = Read-SIProInstalledPackStatus -Store $Store
|            $directState = Read-SIProInstallStateValue -Store $Store -Name 'TemplateDirect'
|            $declinedState = Read-SIProInstallStateValue -Store $Store -Name 'TemplatePackDeclined'
|            if ($source -eq 'pack') { $holdMs = Read-SIProHoldMicrosoftContent -Store $Store }
|        }
|    }
|    catch { if ($Apply -or $source -eq 'rollback') { throw }; Write-Host ("[WARN] the database's templates could not be read ({0}) -- the plan assumes none" -f $_.Exception.Message) -ForegroundColor Yellow }
|}
|# #251: the template fingerprint counts template CONTENT only now (names and the CMDB ownership map are configuration). A
|# fingerprint recorded under the old definition, for exactly the templates in force, is the same baseline -- not a change.
|# The former template rows count as they stood when that fingerprint was recorded -- live -- also after the carry-over
|# above retired them.
|if ($recorded) {
|    $curNow = Get-SIProTemplateSetFingerprint -Rows $existing
|    $asRecorded = @($existing | ForEach-Object {
|        if ((Test-SIProFormerTemplateKind ([string](Get-SIProRowValue $_ 'Kind'))) -and $null -ne (Get-SIProRowValue $_ 'RetiredAt')) {
|            [pscustomobject]@{ Kind = (Get-SIProRowValue $_ 'Kind'); ItemKey = (Get-SIProRowValue $_ 'ItemKey'); ContentHash = (Get-SIProRowValue $_ 'ContentHash'); BodyJson = (Get-SIProRowValue $_ 'BodyJson'); Format = (Get-SIProRowValue $_ 'Format'); RetiredAt = $null }
|        } else { $_ } })
|    if ($recorded -ne $curNow -and ($recorded -eq (Get-SIProTemplateSetFingerprint -Rows $existing -AllKinds) -or $recorded -eq (Get-SIProTemplateSetFingerprint -Rows $asRecorded -AllKinds))) { $recorded = $curNow; $translated = $true }
|}
|
|# ---- the candidate rows: shipped, a pack, or a roll-back ----------------------------------------------------------------
|$packText = $null; $packSha = ''; $scope = $null; $refused = @()
|switch ($source) {
|    'shipped' {
|        $built = Get-SITemplateRows -SIRoot $siRoot -Version $Version -Families $Families
|        $rows = @($built.Rows); $refused = @($built.Refused); $result.Version = $built.Version
|        $scope = [pscustomobject]@{ Full = (-not $Families); Kinds = @($(if ($Families) { $Families } else { Get-SIProTemplatedKinds })); Methods = @(); Items = @() }
|        if ($built.Version -eq $shippedInfo.PackVersion) { $result.PackVersion = $built.Version; $result.PackName = $shippedInfo.Name }
|        Write-Host ("[INFO] the templates shipped with this release -- {0}: {1} item(s)" -f $(if ($result.PackName) { $result.PackName } else { 'version ' + $built.Version }), $rows.Count)
|    }
|    'pack' {
|        if ($PackPath) {
|            if (-not (Test-Path -LiteralPath $PackPath)) { throw "no template pack at $PackPath" }
|            $packText = [System.IO.File]::ReadAllText((Resolve-Path -LiteralPath $PackPath).Path)
|            $expect = $PackSha256
|            $shaFile = "$PackPath.sha256"
|            if (-not $expect -and (Test-Path -LiteralPath $shaFile)) { $expect = Read-SIProSha256Line -Text ([System.IO.File]::ReadAllText($shaFile)) -FileName (Split-Path -Leaf $PackPath) }
|            if (-not $expect) { Write-Host '[WARN] no .sha256 beside the pack and no -PackSha256: only the items'' own hashes are checked' -ForegroundColor Yellow }
|        } else {
|            $st = Read-SIProStagedPackText -Store $Store -PackVersion $FromStaged
|            # THE PACK'S HASH IS ANCHORED OUTSIDE ITS ROW: a pack from Invardia is installed only when the signed manifest
|            # kept with it verifies against the keys EMBEDDED in this release and names this version and this SHA-256
|            # a pack staged as 'shipped' must be the templates THIS release ships (its own build, compared item by item)
|            $shippedDigest = ''
|            if ([string]$st.Origin -eq 'shipped') {
|                try { $shippedDigest = Get-SIProPackItemsDigest -Rows @((Get-SITemplateRows -SIRoot $siRoot).Rows) } catch { $shippedDigest = '' }
|            }
|            $anchor = Test-SIProStagedPackAnchor -Staged $st -PackVersion $FromStaged -SIRoot $siRoot -ShippedDigest $shippedDigest
|            if (-not $anchor.Ok) { throw ("template pack {0} is not installed: {1}" -f $FromStaged, $anchor.Reason) }
|            if ($anchor.Reason) { Write-Host ('[INFO] {0}' -f $anchor.Reason) }
|            $packText = $st.Text; $expect = $st.Sha256
|        }
|        $parsed = ConvertFrom-SIProTemplatePack -Text $packText -ExpectedSha256 $expect -Context (Get-SIProConfigContext -SIRoot $siRoot)
|        $packSha = $parsed.Sha256
|        $rows = @($parsed.Rows); $refused = @($parsed.Refused); $scope = Get-SIProPackScope $parsed.Pack
|        $result.Version = [string]$parsed.Pack.PackVersion; $result.PackVersion = $result.Version
|        Write-Host ("[INFO] template pack {0} (built by SecurityInsight {1}, {2}): {3} item(s), SHA-256 {4}" -f $parsed.Pack.PackVersion, $parsed.Pack.CodeVersion, $(if ($scope.Full) { 'full' } else { 'partial' }), $rows.Count, $packSha.Substring(0, 12))
|    }
|    'rollback' {
|        if (-not (Test-SIProPackVersion $RollbackToVersion)) { throw "'$RollbackToVersion' is not a version" }
|        $revisions = @(Read-SIProTemplateRevisions -Store $Store)
|        $rows = @(Get-SIProRollbackRows -Templates $existing -Revisions $revisions -Version $RollbackToVersion -Class @($Class | Where-Object { $_ }) -Classification $classification)
|        $scope = [pscustomobject]@{ Full = $true; Kinds = @(Get-SIProTemplatedKinds); Methods = @(); Items = @(); Classes = @($Class | Where-Object { $_ }) }
|        $result.Version = $RollbackToVersion; $result.PackVersion = $RollbackToVersion
|        Write-Host ("[INFO] roll back to {0}{1}: {2} item(s) found in the template revisions" -f $RollbackToVersion, $(if ($Class) { ' (' + (@($Class) -join ', ') + ' content only)' } else { '' }), $rows.Count)
|    }
|}
|# ---- risk factor model v2: the customer's overrides keyed the pre-v2 way follow the new keys (CONVERGE-DEFAULTS) ---------
|# A risk index override under a 2.2 key, a factor override with 'stage' and without the v2 fields, an override of a removed
|# factor: translated through the shipped translation table, the customer's values kept (engine\pro-settings\
|# SI-ProOverrideMigration.ps1). Every setup / update path runs a full shipped publish, so every install converges once.
|if ($Apply -and $fullShipped -and $Store) {
|    try {
|        $ovm = Invoke-SIProOverrideMigration -Store $Store -SIRoot $siRoot -Templates (@($existing) + @($rows))
|        $result['OverrideMigration'] = [pscustomobject]@{ Applied = @($ovm.Applied).Count; Refused = @($ovm.Refused).Count }
|        foreach ($a in @($ovm.Applied)) { Write-Host ("[OK]   your override {0}/{1}: {2}" -f $a.Kind, $a.OldKey, $a.Reason) }
|        foreach ($x in @($ovm.Refused)) { Write-Host ("[WARN] your override {0}/{1} was left as it was -- it does not validate after translation: {2}" -f $x.Action.Kind, $x.Action.OldKey, $x.Reason) -ForegroundColor Yellow }
|    } catch { Write-Host ("[WARN] your overrides could not be checked for the risk factor model v2 ({0}) -- they are unchanged; the next update tries again" -f $_.Exception.Message) -ForegroundColor Yellow }
|}
|# #405 + owner decision 2026-10-11: what THIS code does with a template pack -- every pack installs automatically (also
|# one with more than Microsoft content); it is held only by the customer's Hold or a roll back from it, waits for newer
|# code, or is the one in force already
|$msDecision = $null; $autoAccept = $false
|if ($source -eq 'pack') {
|    $inForce = if (Test-SIProInstalledPackIsPack $installedBefore $installedStatusBefore) { $installedBefore } else { '' }
|    $msDecision = Get-SIProTemplatePackDecision -Split $split -Pack $parsed.Pack -CodeVersion $codeVersion -Hold $holdMs -Declined $declinedState -Direct ([bool]$directState) -Installed $inForce
|    $result.Decision = $msDecision.Action; $result.Auto = [bool]$msDecision.Auto; $autoAccept = [bool]$msDecision.Auto
|    Write-Host ("[INFO] {0}" -f $msDecision.Reason)
|}
|# #405: the shipped templates in split mode (and ring 1's direct install) are installed with the code -- never held. A
|# NEWER Microsoft content pack already in force (from the update ring) is kept: the code's Microsoft items are left out,
|# and nothing of that class is retired.
|$keepMicrosoft = $false; $stageRows = $rows
|if ($splitShipped) {
|    $autoAccept = $true
|    # (ring 1's direct install too: a newer pack in force is not taken back by the next deploy)
|    if (($InstallCurrent -or -not $directState) -and (Test-SIProInstalledPackIsPack $installedBefore $installedStatusBefore) -and
|        (Compare-SIProPackVersion $installedBefore $shippedInfo.PackVersion) -gt 0) { $keepMicrosoft = $true }
|    if ($keepMicrosoft) { $rows = @($rows | Where-Object { (Get-SIProRowClass -Row $_ -Classification $classification) -ne 'microsoft' }) }
|    $result.Decision = $(if ($InstallCurrent) { 'direct' } else { 'code' }); $result.Auto = $true; $result.KeptMicrosoft = $keepMicrosoft; $result.InstalledPack = $installedBefore
|    Write-Host ("[INFO] {0}" -f $(if ($InstallCurrent -and $keepMicrosoft) { "ring 1: the fix and default templates of SecurityInsight $codeVersion are installed directly; the newer pack $installedBefore in force is kept" }
|        elseif ($InstallCurrent) { "ring 1: every template shipped with SecurityInsight $codeVersion is installed directly (no gate) -- recorded as template pack $($shippedInfo.PackVersion)" }
|        elseif ($keepMicrosoft) { "the fix and default templates of SecurityInsight $codeVersion are installed with the code; the newer Microsoft content $installedBefore in force is kept" }
|        else { "the templates of SecurityInsight $codeVersion are installed with the code (fixes, defaults and Microsoft content $($shippedInfo.PackVersion)); your own changes are kept" }))
|}
|foreach ($g in @($rows | Group-Object Kind | Sort-Object Name)) { Write-Host ("  {0,-14} {1}" -f $g.Name, $g.Count) }
|foreach ($r in @($refused)) { Write-Host ("  refused {0} -- {1}" -f $r.Name, $r.Reason) -ForegroundColor Red }
|
|# ---- #250: the default templates -- install, adopt, or leave a newer / customised install as it is ---------------------
|$decision = $null; $dbFp = Get-SIProTemplateSetFingerprint -Rows $existing
|# (#405: in split mode -- and for ring 1's direct install -- the shipped templates are always installed with the code)
|if ($fullShipped -and $Store -and -not $splitShipped) {
|    $installedPack = ''; $installedStatus = ''
|    try { $installedPack = Read-SIProInstalledPack -Store $Store; $installedStatus = Read-SIProInstalledPackStatus -Store $Store } catch { if ($Apply) { throw } }
|    $live = @($existing | Where-Object { $null -eq (Get-SIProRowValue $_ 'RetiredAt') -and -not (Test-SIProFormerTemplateKind ([string](Get-SIProRowValue $_ 'Kind'))) })
|    $decision = Get-SIProDefaultTemplateDecision -InstalledPack $installedPack -InstalledStatus $installedStatus -LiveCount $live.Count -InstalledFingerprint $dbFp `
|        -ShippedVersion $shippedInfo.PackVersion -ShippedFingerprint (Get-SIProTemplateSetFingerprint -Rows $rows) -ShippedName $shippedInfo.Name
|    $result.Decision = $decision.Action; $result.InstalledPack = $installedPack; $result.PackStatus = $installedStatus
|    Write-Host ("[INFO] default templates: {0}" -f $decision.Reason)
|    # the templates in force ARE the shipped pack: that is the baseline, whatever was recorded before
|    if ($decision.Action -eq 'adopt') { $recorded = $dbFp }
|}
|
|# ---- the detection methods, and the selection ----------------------------------------------------------------------------
|$diff = $null; $methods = @()
|if ($selective) {
|    $diff = Get-SIProTemplatePackDiff -Rows $rows -Existing $existing -Scope $scope -Overrides $overrides
|    $known = [string[]]@($diff.Methods | ForEach-Object { $_.Id })
|    $methods = @(Resolve-SIProMethodSelection -Selection @($Method) -Known $known)
|    $selAll = (-not $Method) -or (@($Method) -contains '*')
|    $selRows = if ($selAll) { $rows } else { @($rows | Where-Object { $methods -contains (Get-SIProRowMethodId $_) }) }
|    $result.SelectionFingerprint = Get-SIProSelectionFingerprint -Diff $diff -Methods $(if ($selAll) { @() } else { $methods })
|    $result.Methods = @($diff.Methods); $result.Selected = @($methods)
|    $affected = @($diff.Items | Where-Object { $_.Affected -and ($selAll -or $methods -contains $_.MethodId) })
|    $result.Affected = $affected.Count
|    Write-Host ("[INFO] detection methods: {0} selected of {1}" -f $methods.Count, $known.Count)
|    foreach ($m in @($diff.Methods | Where-Object { $selAll -or $methods -contains $_.Id })) {
|        if ($m.Added + $m.Changed + $m.Retired -eq 0) { continue }
|        Write-Host ("  {0,-60} new {1}, changed {2}, retired {3}{4}" -f $m.Id, $m.Added, $m.Changed, $m.Retired, $(if ($m.Affected) { ", YOUR OVERRIDES AFFECTED: $($m.Affected)" } else { '' }))
|    }
|    Write-Host ("[INFO] selection fingerprint (what an acceptance names): {0}" -f $result.SelectionFingerprint)
|} else { $selRows = $rows; $selAll = $true }
|
|# ---- stage it for the web app (cfg.TemplatePackStaged) -------------------------------------------------------------------
|# A full apply of the shipped templates always stages them (#250): the web app lists the pack the install runs on.
|if ($Stage -or ($Apply -and $fullShipped -and $Store)) {
|    if (-not (Test-SIProTemplatePackSchema -Store $Store)) { Write-Host '[WARN] not staged: the Pro database has no cfg.TemplatePackStaged yet -- the next setup or update run (with -CreateSchema) adds it' -ForegroundColor Yellow }
|    else {
|        if ($source -eq 'rollback') { throw '-Stage stages a pack or the shipped templates, not a roll-back' }
|        $origin = if ($StageOrigin) { $StageOrigin } elseif ($source -eq 'pack') { if ($FromStaged) { 'feed' } else { 'file' } } else { 'shipped' }
|        $text = if ($packText) { $packText } else {
|            # (#405: the shipped pack as shipped -- also when a newer Microsoft content pack in force is kept)
|            # #416: built once per process for the same rows (Get-SIProPackTextFor)
|            Get-SIProPackTextFor -Rows $stageRows -PackVersion $result.Version -CodeVersion (Get-SIProShippedVersion -SIRoot $siRoot) -Kind $(if ($Families) { $Families } else { $null }) -Name $result.PackName -Classification $classification
|        }
|        $stg = @{ Store = $Store; Text = $text; Origin = $origin; Ring = $StageRing }
|        if ($StageManifestB64) { $stg.ManifestB64 = $StageManifestB64; $stg.Signature = $StageSignature; $stg.KeyId = $StageKeyId }
|        $result.Staged = Save-SIProTemplatePackStaged @stg
|        if ($result.Staged -eq 'Conflict' -and $splitShipped) {
|            Write-Host ("[INFO] {0} is already staged with other content; the templates shipped with SecurityInsight {1} are installed with the code" -f $(if ($result.PackName) { $result.PackName } else { $result.Version }), $codeVersion)
|        } elseif ($result.Staged -eq 'Conflict') {
|            if ($source -ne 'shipped') { throw ("a DIFFERENT template pack {0} is already staged on this install -- a published pack never changes" -f $result.Version) }
|            # the shipped templates changed under an unchanged pack version: never applied under that name
|            Write-Host ("[WARN] this release ships other template content as {0} than the {0} already on this install -- not staged, not applied (template changes arrive as a new pack)" -f $(if ($result.PackName) { $result.PackName } else { $result.Version })) -ForegroundColor Yellow
|            if ($decision -and $decision.Publish -and $decision.Action -ne 'install') {
|                $decision = [pscustomobject]@{ Action = 'shipped-differs'; Publish = $false; Record = $false; Status = $result.PackStatus; Reason = ('{0} is already on this install with other content -- the templates in force are kept' -f $result.Version) }
|                $result.Decision = $decision.Action
|            }
|        } else {
|            Write-Host ("[OK]   template pack {0} staged for the web app's Template releases page ({1})" -f $(if ($result.PackName) { $result.PackName } else { $result.Version }), $result.Staged)
|        }
|    }
|}
|
|# ---- #250: nothing to publish (customised, newer, or other content under the same version) -- record, and stop here -----
|if ($decision -and -not $decision.Publish) {
|    if ($Apply) {
|        if ($decision.Record) {
|            Set-SIProTemplateRelease -Store $Store -PackVersion $shippedInfo.PackVersion -Mode adopted -Whole $true -Status $decision.Status -Fingerprint $dbFp -Changed 0 -RequestedBy $RequestedBy
|            Write-Host ("[OK]   recorded: {0} -- {1}" -f $shippedInfo.Name, $(if ($decision.Status -eq 'customised') { 'customised (your templates are kept)' } else { 'installed' }))
|        }
|        if ($translated) { Set-SIProTemplateFingerprint -Store $Store -Fingerprint $recorded -Version $result.Version -Reason 'the template fingerprint counts template content only (names and the CMDB ownership map are configuration)' }
|    }
|    $result.Fingerprint = $dbFp; $result.Recorded = $recorded; $result.Baseline = $recorded; $result.Allowed = $true; $result.Moved = $false
|    if ($decision.Record -and $Apply) { $result.InstalledPack = $shippedInfo.PackVersion; $result.PackStatus = $decision.Status }
|    return (& $finish $(if ($Apply) { 'applied' } else { 'plan' }) $decision.Reason)
|}
|if ($decision -and $decision.Record -and $Apply) {
|    # adopt: the templates in force are the shipped pack -- recorded as installed, and that content is the baseline
|    Set-SIProTemplateRelease -Store $Store -PackVersion $shippedInfo.PackVersion -Mode adopted -Whole $true -Status 'as-released' -Fingerprint $dbFp -Changed 0 -RequestedBy $RequestedBy
|    Set-SIProTemplateFingerprint -Store $Store -Fingerprint $dbFp -Version $shippedInfo.PackVersion -Reason ('the templates in force are {0} -- recorded as installed' -f $shippedInfo.Name)
|    Write-Host ("[OK]   recorded: {0} is installed (the templates in force are exactly its content)" -f $shippedInfo.Name)
|}
|
|$plan = @(Get-SITemplatePublishPlan -Rows @($selRows) -Existing $existing -Families $(if ($source -eq 'shipped') { $Families } else { @($scope.Kinds) }) -RefreshMissingContentHash)
|if ($selective) { $plan = @(Get-SIProSelectionPlan -Plan $plan -Existing $existing -Scope $scope -Methods $(if ($selAll) { @() } else { $methods })) }
|# #405: the newer Microsoft content in force is kept -- nothing of that class is retired by the code's templates
|if ($keepMicrosoft) { $plan = @($plan | Where-Object { -not ($_.Action -eq 'retire' -and (Get-SIProTemplateClass -Kind ([string]$_.Kind) -ItemKey ([string]$_.ItemKey) -Classification $classification) -eq 'microsoft') }) }
|$byAction = @{}; foreach ($p in $plan) { $byAction[$p.Action] = 1 + [int]$byAction[$p.Action] }
|Write-Host ("[INFO] plan: {0} insert, {1} update, {2} unchanged, {3} retire, {4} revive{5}" -f [int]$byAction['insert'], [int]$byAction['update'], [int]$byAction['same'], [int]$byAction['retire'], [int]$byAction['revive'], $(if ($Store) { " (against $($Store.Name))" } else { ' (no database configured -- every item would be new)' }))
|foreach ($p in @($plan | Where-Object { $_.Action -in 'update', 'retire', 'revive' })) { Write-Host ("  {0,-7} {1}/{2}" -f $p.Action, $p.Kind, $p.ItemKey) }
|# #529 (3): the items that follow the template and move to new content -- each gets an "upgraded" entry in the change log
|# when written (Invoke-SITemplatePublish), so an inherited change is never silent
|$upgOverrides = $overrides
|if (-not $selective -and $Store) { try { $upgOverrides = @(Read-SIProItemOverrides -Store $Store) } catch { $upgOverrides = @() } }
|$upgrades = @(Get-SIProTemplateUpgrades -Existing $existing -Plan $plan -Overrides @($upgOverrides))
|$result.Upgraded = $upgrades.Count
|if ($upgrades.Count) {
|    Write-Host ("[INFO] {0} item(s) you do not override follow the new shipped version (recorded as upgraded):" -f $upgrades.Count)
|    foreach ($u in ($upgrades | Select-Object -First 50)) { Write-Host ("  upgraded {0}  {1} -> {2}" -f $u.Name, $(if ($u.FromVersion) { $u.FromVersion } else { '(none)' }), $u.ToVersion) }
|    if ($upgrades.Count -gt 50) { Write-Host ("  ... and {0} more" -f ($upgrades.Count - 50)) }
|}
|
|# ---- the fingerprint gate: what the templates in force would SAY after this publish, against what the install recorded
|$expectedSet = @(Get-SIProPlannedTemplateSet -Existing $existing -Plan $plan)
|$expected = Get-SIProTemplateSetFingerprint -Rows $expectedSet
|$current = Get-SIProTemplateSetFingerprint -Rows $existing
|$changes = @(Get-SIProTemplateChanges -Existing $existing -Plan $plan)
|$selRefusal = ''
|if ($selective) {
|    # an acceptance from a pack, a roll-back or a selection names the SELECTION fingerprint -- exactly what was reviewed
|    $sel = $result.SelectionFingerprint
|    $acceptedSel = $AcceptFingerprint -and $AcceptFingerprint.Length -ge 12 -and $sel -and $sel.StartsWith($AcceptFingerprint, [StringComparison]::OrdinalIgnoreCase)
|    # #405: Microsoft content installed automatically is accepted by the decision itself (an override of yours stays beside it)
|    $gate = Get-SIProTemplateGateDecision -Recorded $recorded -Current $current -Expected $expected -Accept:($AcceptTemplateChange -or $acceptedSel -or $autoAccept)
|    $pending = @($diff.Items | Where-Object { $_.Change -ne 'unchanged' -and ($selAll -or $methods -contains $_.MethodId) }).Count
|    if ($AcceptFingerprint -and -not $acceptedSel) {
|        $selRefusal = 'the acceptance names selection fingerprint {0}, but this release would put {1} in force -- the pack, the selection or your templates changed since it was reviewed; review it again' -f $AcceptFingerprint.Substring(0, [Math]::Min(12, $AcceptFingerprint.Length)), $(if ($sel) { $sel.Substring(0, 12) } else { '(nothing)' })
|    } elseif ($msDecision -and $msDecision.Action -eq 'wait-code') {
|        # never installed by code older than the pack names -- not even by hand
|        $selRefusal = $msDecision.Reason
|    } elseif ($msDecision -and $msDecision.Action -eq 'installed' -and $pending -gt 0 -and -not ($AcceptTemplateChange -or $acceptedSel)) {
|        # a pack older than the one in force is never put back automatically (a roll back is its own path)
|        $selRefusal = $msDecision.Reason
|    } elseif ($msDecision -and $msDecision.Action -eq 'hold' -and $pending -gt 0 -and -not ($AcceptTemplateChange -or $acceptedSel)) {
|        $selRefusal = '{0} -- nothing is written without an Install (-AcceptFingerprint {1})' -f $msDecision.Reason, $(if ($sel) { $sel.Substring(0, 12) } else { '' })
|    } elseif ($result.Affected -gt 0 -and -not ($AcceptTemplateChange -or $acceptedSel -or $autoAccept)) {
|        $selRefusal = '{0} of your overridden or switched-off item(s) change in this release -- nothing is written without an acceptance (-AcceptFingerprint {1})' -f $result.Affected, $(if ($sel) { $sel.Substring(0, 12) } else { '' })
|    }
|} else {
|    # #405: the code's own templates in split mode (and ring 1's direct install) are installed with the code, never held
|    $gate = Get-SIProTemplateGateDecision -Recorded $recorded -Current $current -Expected $expected -Accept:($AcceptTemplateChange -or $autoAccept) -AcceptFingerprint $(if ($autoAccept) { '' } else { $AcceptFingerprint })
|}
|$result.Fingerprint = $expected; $result.Recorded = $recorded; $result.Baseline = $gate.Baseline; $result.Moved = $gate.Moved
|$result.Initial = $gate.Initial; $result.Allowed = ($gate.Allowed -and -not $selRefusal); $result.Changes = $changes
|Write-Host ("[INFO] template fingerprint after this publish: {0} -- {1}" -f $expected, $(if ($selRefusal) { $selRefusal } else { $gate.Reason }))
|if ($changes.Count) {
|    Write-Host ("[INFO] {0} item(s) change what they do:" -f $changes.Count)
|    foreach ($c in ($changes | Select-Object -First 50)) { Write-Host ("  {0,-8} {1}" -f $c.Change, $c.Name) }
|    if ($changes.Count -gt 50) { Write-Host ("  ... and {0} more" -f ($changes.Count - 50)) }
|}
|if (-not $Apply) { Write-Host '[INFO] nothing written -- run with -Apply to publish.'; return (& $finish 'plan' $(if ($selRefusal) { $selRefusal } else { $gate.Reason })) }
|if (@($refused).Count) { throw ('nothing written: {0} shipped item(s) do not validate -- fix the release first' -f @($refused).Count) }
|if ($selRefusal -or -not $gate.Allowed) {
|    $why = if ($selRefusal) { $selRefusal } else { $gate.Reason }
|    Write-Host ('[BLOCKED] nothing written: {0}' -f $why) -ForegroundColor Red
|    $name = if ($selective) { $result.SelectionFingerprint } else { $expected }
|    Write-Host ('          review the items above, then run again with -AcceptTemplateChange (or -AcceptFingerprint {0})' -f $name.Substring(0, [Math]::Min(12, $name.Length))) -ForegroundColor Red
|    return (& $finish 'blocked' $why)
|}
|$missing = @(Test-SIProVersioningSchema -Store $Store)
|if ($missing.Count) { throw ('nothing written: the Pro database lacks {0} -- run again with -CreateSchema' -f ($missing -join ', ')) }
|
|$by = '{0} (publish {1})' -f (Get-SIProSessionActor), $result.Version
|$n = Invoke-SITemplatePublish -Store $Store -Plan $plan -ChangedBy $by
|$result.Written = $n
|Write-Host ("[OK]   {0} template change(s) written to {1}; customer overrides untouched" -f $n, $Store.Name)
|
|# ---- verify by reading back, and only then record the fingerprint on the install
|$after = @(Read-SIProTemplates -Store $Store)
|$bad = New-Object System.Collections.Generic.List[string]
|foreach ($r in @($after | Where-Object { $null -eq (Get-SIProRowValue $_ 'RetiredAt') })) {
|    $name = '{0}/{1}' -f (Get-SIProRowValue $r 'Kind'), (Get-SIProRowValue $r 'ItemKey')
|    if ((Get-SIProTextHash ([string](Get-SIProRowValue $r 'BodyJson'))) -ne ([string](Get-SIProRowValue $r 'BodyHash')).Trim()) { $bad.Add("$name (body does not match its hash)") }
|    elseif (-not ([string](Get-SIProRowValue $r 'ContentHash')).Trim()) { $bad.Add("$name (no content hash)") }
|}
|$readBack = Get-SIProTemplateSetFingerprint -Rows $after
|if ($readBack -ne $expected) { $bad.Add(('the templates in force read back as fingerprint {0}, not the published {1}' -f $readBack, $expected)) }
|if ($bad.Count) {
|    throw ('the publish could not be verified -- the template fingerprint was NOT recorded, so the next publish is gated again: {0}' -f (($bad | Select-Object -First 10) -join '; '))
|}
|$result.Verified = $true
|$why = if ($gate.Initial) { 'first publish (baseline)' } elseif ($gate.Moved) { 'template change accepted: ' + $changes.Count + ' item(s)' } else { 'templates unchanged' }
|Set-SIProTemplateFingerprint -Store $Store -Fingerprint $expected -Version $result.Version -Reason $why
|Write-Host ("[OK]   verified; template fingerprint {0} recorded on the install ({1})" -f $expected, $why)
|if ($source -ne 'shipped') {
|    # every method of the pack (or of the roll-back) released: the install now runs this pack -- what the updater compares
|    # the ring's approval with, so the same pack is not offered again
|    $whole = [bool]$selAll
|    # #405: a Microsoft content pack nobody had to accept was installed automatically; an explicit acceptance is a release
|    $relMode = if ($source -eq 'rollback') { 'rollback' } elseif ($autoAccept -and -not ($AcceptTemplateChange -or $AcceptFingerprint)) { 'auto' } else { 'release' }
|    $relClasses = if ($source -eq 'rollback') { @($Class | Where-Object { $_ }) } elseif ($parsed.Pack.PSObject.Properties['Content'] -and [string]$parsed.Pack.Content) { @([string]$parsed.Pack.Content) } else { @() }
|    Set-SIProTemplateRelease -Store $Store -PackVersion $result.Version -Mode $relMode -Methods $methods `
|        -SelectionFingerprint $result.SelectionFingerprint -Fingerprint $expected -Whole $whole -Changed $changes.Count -RequestedBy $RequestedBy -Classes $relClasses
|    Write-Host ("[OK]   {0} of template pack {1} recorded ({2})" -f $(switch ($relMode) { 'rollback' { 'roll back' } 'auto' { 'automatic install' } default { 'release' } }), $result.Version, $(if ($whole) { 'the whole pack' } else { "$($methods.Count) detection method(s)" }))
|    if ($split -and $source -eq 'rollback' -and @($Class) -contains 'microsoft' -and $installedBefore -and (Compare-SIProPackVersion $installedBefore $RollbackToVersion) -gt 0) {
|        # the one-click roll back of Microsoft content: the pack rolled back from is never installed automatically again
|        Set-SIProInstallStateValue -Store $Store -Name 'TemplatePackDeclined' -Value $installedBefore -Version $RollbackToVersion
|        Write-Host ("[OK]   Microsoft content {0} will not be installed automatically again (a newer pack will)" -f $installedBefore)
|    } elseif ($split -and $source -eq 'pack' -and $declinedState -and (Compare-SIProPackVersion $result.Version $declinedState) -ge 0) {
|        Set-SIProInstallStateValue -Store $Store -Name 'TemplatePackDeclined' -Value '' -Version $result.Version
|    }
|} elseif ($splitShipped) {
|    # #405: what is installed per class -- the code release's fix + default templates (TemplateCode); its Microsoft content
|    # unless a newer pack was kept (TemplatePack); ring 1's direct install (TemplateDirect; no pack recorded as a release)
|    if ($InstallCurrent) {
|        # owner decision 2026-10-11: the record follows what the direct deploy installed -- the shipped pack it put in force
|        # is the installed pack (TemplatePack + TemplatePackStatus as-released), unless a newer pack in force was kept
|        Set-SIProTemplateRelease -Store $Store -PackVersion $result.Version -Mode direct -Fingerprint $expected -Whole (-not $keepMicrosoft) -Changed $changes.Count -RequestedBy $RequestedBy -Status 'as-released' -CodeVersion $codeVersion
|        if (-not $keepMicrosoft) { $result.InstalledPack = $result.Version; $result.PackStatus = 'as-released' }
|        Set-SIProInstallStateValue -Store $Store -Name 'TemplateDirect' -Value $codeVersion -Version $codeVersion
|    } else {
|        Set-SIProTemplateRelease -Store $Store -PackVersion $result.Version -Mode code -Fingerprint $expected -Whole (-not $keepMicrosoft) -Changed $changes.Count -RequestedBy $RequestedBy -Status 'as-released' -CodeVersion $codeVersion
|        if (-not $keepMicrosoft) { $result.InstalledPack = $result.Version; $result.PackStatus = 'as-released' }
|    }
|    Set-SIProInstallStateValue -Store $Store -Name 'TemplateCode' -Value $codeVersion -Version $codeVersion
|    Write-Host ("[OK]   the templates of SecurityInsight {0} are installed{1}" -f $codeVersion, $(if ($InstallCurrent) { $(if ($keepMicrosoft) { " directly (ring 1; the newer pack $installedBefore kept)" } else { " directly (ring 1; template pack $($result.Version))" }) } elseif ($keepMicrosoft) { " (Microsoft content $installedBefore kept)" } else { " (Microsoft content $($result.Version))" }))
|} elseif ($fullShipped) {
|    # #250: the shipped templates in force ARE the shipped pack (1.0): the install records it, as released
|    Set-SIProTemplateRelease -Store $Store -PackVersion $result.Version -Mode shipped -Fingerprint $expected -Whole $true -Changed $changes.Count -RequestedBy $RequestedBy -Status 'as-released'
|    $result.InstalledPack = $result.Version; $result.PackStatus = 'as-released'
|    Write-Host ("[OK]   {0} is installed" -f $(if ($result.PackName) { $result.PackName } else { 'template pack ' + $result.Version }))
|}
|& $finish 'applied' $gate.Reason
|} finally { Stop-SIScriptRun -Run $siRun }
'@ }
$__siSupportFiles['engine/pro-settings/SI-ProSettings.ps1'] = @{ Sha256 = '5e4df5378cff1ac0886188081185f40dda9afc32e75c5242fbd0d6f830d34d1b'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- THE SETTINGS STORE (REQUIREMENTS §9.2, Pro-1).
|
|    In Pro every setting lives in SQL (cfg.Setting, sql\si-pro-settings.sql) and the launcher loads it at run start as
|    the CLOSEST configuration layer: shipped defaults and the files load first, then this. Engines are unchanged -- they
|    see the same $global: values a Community install sets in files.
|
|    🔒 FAIL CLOSED (operator, 2026-10-02): "SQL unreachable at run start = the run FAILS". A Pro install's settings are
|    authoritative; running on whatever the files happen to say instead would be a silent, wrong run. The same goes for a
|    row that does not validate -- it is refused, and the run stops with the reason, rather than handing an engine a bad
|    value.
|
|    The validation is the Community Settings page's own (engine\pro-settings\SI-Settings.ps1: the catalog and
|    Test-SISettingValue), so a value is checked by the same rules whichever edition wrote it.
|    Everything here except the store's default Invoke and Invoke-SIProSettingsLayer is pure and tested directly.
|#>
|
|$script:SIProRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|# Azure access (Log Analytics: has any run ever ended well -- Get-SIProSettingsGoodRunCount): plain REST, no modules
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../_shared/SI-AzRest.ps1') }
|if (-not (Get-Command Test-SISettingValue -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-Settings.ps1'))
|}
|# Phase C: templates, item overrides, exemptions and the materialisation of every configuration family.
|. ([System.IO.Path]::Combine($PSScriptRoot, 'SI-ProConfig.ps1'))
|# #260: the audit trail's PowerShell writer (Write-SIAuditEvent) -- every Pro tool that opens the store can record its steps.
|. ([System.IO.Path]::Combine($PSScriptRoot, 'SI-Audit.ps1'))
|# the install's update ring (Read-SIInstallRingFacts): read at run start for the ring every status report carries
|if (-not (Get-Command -Name Read-SIInstallRingFacts -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, '..', '_shared', 'SI-InstallRing.ps1')) }
|
|function Get-SIProTokenCacheUntil {
|    <#
|        PURE. How long a SQL access token may be reused: until 5 minutes before its OWN expiry (the JWT 'exp' claim), never
|        longer than 45 minutes. A token that cannot be read keeps the 45 minutes (the sign-in retry covers it). customer G
|        2026-10-09: a managed-identity token can arrive with minutes left -- held for a fixed 45 it expired mid-run.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Token, [datetime]$Now = [datetime]::UtcNow)
|    $max = $Now.AddMinutes(45)
|    try {
|        $part = ([string]$Token).Split('.')[1]
|        $part = $part.Replace('-', '+').Replace('_', '/'); switch ($part.Length % 4) { 2 { $part += '==' } 3 { $part += '=' } }
|        $exp = [long](([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($part)) | ConvertFrom-Json).exp)
|        if ($exp -le 0) { return $max }
|        $until = [DateTimeOffset]::FromUnixTimeSeconds($exp).UtcDateTime.AddMinutes(-5)
|        if ($until -lt $max) { return $until }
|        return $max
|    } catch { return $max }
|}
|
|function Get-SIProSqlLoginFailureText {
|    <#
|        PURE. The plain words for a sign-in the Pro database refused TWICE (the second time with a fresh token): WHICH
|        identity needs a database user, from the token's own claims (appid / oid, and the audience it was issued for), and
|        how to grant it. Keeps the server's text ("Login failed for user ...") so the error class stays sql-login. A token
|        for another resource than the database is said as such (that is a product defect, not a missing grant).
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Token, [string]$Server, [string]$Database, [AllowEmptyString()][string]$ServerText)
|    $c = $null
|    try {
|        $part = ([string]$Token).Split('.')[1]
|        $part = $part.Replace('-', '+').Replace('_', '/'); switch ($part.Length % 4) { 2 { $part += '==' } 3 { $part += '=' } }
|        $c = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($part)) | ConvertFrom-Json
|    } catch { $c = $null }
|    $app = ''; $oid = ''; $aud = ''
|    if ($c) {
|        if ($c.PSObject.Properties['appid']) { $app = [string]$c.appid } elseif ($c.PSObject.Properties['azp']) { $app = [string]$c.azp }
|        if ($c.PSObject.Properties['oid']) { $oid = [string]$c.oid }
|        if ($c.PSObject.Properties['aud']) { $aud = [string]$c.aud }
|    }
|    $who = if ($app -or $oid) { ('the identity with client id {0}{1}' -f $(if ($app) { $app } else { '(unknown)' }), $(if ($oid) { " (object id $oid)" } else { '' })) } else { "this job's identity" }
|    if ($aud -and $aud.TrimEnd('/') -notmatch '^https://database\.windows\.net$') {
|        return ("the Pro database {0}/{1} refused the sign-in: the token was issued for '{2}', not for the database (https://database.windows.net/) -- a product defect, please report it. {3}" -f $Server, $Database, $aud, $ServerText)
|    }
|    ("the Pro database {0}/{1} refused the sign-in of {2}, also with a fresh token: it has no user in that database. Re-run the setup's database step (it grants every job's identity), or in the database as an Entra admin: CREATE USER [<the job's identity name>] FROM EXTERNAL PROVIDER; then give it the SecurityInsight roles. {3}" -f $Server, $Database, $who, $ServerText)
|}
|
|function New-SIProSettingsStore {
|    <#
|        The Pro database. -Invoke is the ONE seam (sql, params, mode 'reader' | 'nonquery' | 'scalar') -- tests pass a
|        fake; the default opens a connection per call with an Entra token for the engine SPN (certificate), the same way
|        the vulnerability close-loop reaches the same database.
|    #>
|    param([string]$Server, [string]$Database, [string]$AppId, [string]$TenantId, [string]$CertThumbprint, [scriptblock]$Invoke)
|    if (-not $Invoke) {
|        if ([string]::IsNullOrWhiteSpace($Server) -or [string]::IsNullOrWhiteSpace($Database)) { throw 'the Pro database is not configured (SI_ProSqlServer / SI_ProSqlDatabase)' }
|        $srv = $Server; $db = $Database; $app = $AppId; $ten = $TenantId
|        $tokenCache = @{ Token = $null; Until = [datetime]::MinValue }
|        if ($global:SI_UseManagedIdentity) {
|            # #211 (2): a container signed in as the job's managed identity (#209) -- Pro is container-only. The SQL
|            # token comes from the identity endpoint; no certificate exists there.
|            # The container entry point loads the identity helper; an engine never loads it itself.
|            if (-not (Get-Command -Name 'Get-SIManagedIdentityToken' -ErrorAction SilentlyContinue)) {
|                throw 'managed identity: the identity token helper is not loaded -- this sign-in works only inside a SecurityInsight container.'
|            }
|            $miFn = ${function:Get-SIManagedIdentityToken}
|            $getToken = { param([switch]$Fresh) & $miFn -Resource 'https://database.windows.net/' -ForceRefresh:$Fresh }.GetNewClosure()
|        } else {
|            if (-not (Get-Command -Name 'Get-SILedgerAccessToken' -ErrorAction SilentlyContinue)) {
|                . (Join-Path $script:SIProRoot 'engine\data-model\identity\SI-ObjectLedgerStore.ps1')
|            }
|            $cert = Get-SILedgerCertificate -Thumbprint $CertThumbprint
|            if (-not $cert) { throw ("the engine certificate {0} with a private key was not found" -f $CertThumbprint) }
|            $tokenFn = ${function:Get-SILedgerAccessToken}
|            # (a certificate token is requested new on every call -- -Fresh changes nothing here)
|            $getToken = { param([switch]$Fresh) & $tokenFn -Certificate $cert -AppId $app -TenantId $ten }.GetNewClosure()
|        }
|        $untilOf = ${function:Get-SIProTokenCacheUntil}
|        $loginText = ${function:Get-SIProSqlLoginFailureText}
|        # 2026-10-28 (a small install, a pipeline wake-up): the open failed on a broken pooled connection ("Internal .NET
|        # Framework Data Provider error 6") while the token was fine and the next wake-ups read the database. A temporary
|        # Azure SQL answer at the OPEN (Test-SISqlStatementTransient, SI-SqlRetry.ps1 -- nothing was sent yet) is tried again
|        # on a new connection after 2, 5, 10, 20 and 30 s, the pool of the broken one cleared first.
|        if (-not (Get-Command -Name Test-SISqlStatementTransient -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-SqlRetry.ps1')) }
|        $openTransient = ${function:Test-SISqlStatementTransient}
|        $openWaits = @(2, 5, 10, 20, 30)
|        # the ONE place this store builds a connection (the first open, the retry after a broken open, the fresh-token open)
|        $newCn = { param([string]$cs, [string]$tok) $c = New-Object System.Data.SqlClient.SqlConnection($cs); $c.AccessToken = $tok; $c }
|        $Invoke = {
|            param([string]$sql, $p, [string]$mode)
|            if (-not $tokenCache.Token -or [datetime]::UtcNow -ge $tokenCache.Until) {
|                $tokenCache.Token = & $getToken
|                $tokenCache.Until = & $untilOf -Token $tokenCache.Token -Now ([datetime]::UtcNow)
|            }
|            $cs = 'Server=tcp:{0},1433;Database={1};Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;' -f $srv, $db
|            $cn = & $newCn $cs $tokenCache.Token
|            try {
|                # customer G 2026-10-09: a token held for a fixed 45 minutes expired mid-run and every call answered "Login
|                # failed" (18456). A failed sign-in takes a FRESH token and opens once more; a second failure is the answer.
|                $openTry = 0; $openErr = $null
|                while ($true) {
|                    try { $cn.Open(); $openErr = $null; break }
|                    catch {
|                        if ($openTry -lt $openWaits.Count -and (& $openTransient $_)) {
|                            $ow = [int]$openWaits[$openTry]; $openTry++
|                            Write-Host ('       the database {0} could not be opened for a moment ({1}) -- trying again on a new connection in {2} s ({3}/{4})' -f $db, (([string]$_.Exception.Message) -split "`n")[0].Trim(), $ow, $openTry, $openWaits.Count) -ForegroundColor DarkYellow
|                            try { [System.Data.SqlClient.SqlConnection]::ClearPool($cn) } catch { }
|                            $cn.Dispose(); Start-Sleep -Seconds $ow
|                            $cn = & $newCn $cs $tokenCache.Token
|                            continue
|                        }
|                        $openErr = $_; break
|                    }
|                }
|                if ($openErr) {
|                    $sx = $openErr.Exception; while ($sx -and -not ($sx -is [System.Data.SqlClient.SqlException]) -and $sx.InnerException) { $sx = $sx.InnerException }
|                    if (-not ($sx -is [System.Data.SqlClient.SqlException]) -or [int]$sx.Number -ne 18456) { throw $openErr }
|                    $cn.Dispose()
|                    Start-Sleep -Seconds 3
|                    $tokenCache.Token = & $getToken -Fresh
|                    $tokenCache.Until = & $untilOf -Token $tokenCache.Token -Now ([datetime]::UtcNow)
|                    $cn = & $newCn $cs $tokenCache.Token
|                    # refused again with a fresh token: say WHICH identity needs the grant, in plain words (rc.465, MarkDone)
|                    try { $cn.Open() }
|                    catch {
|                        $sx2 = $_.Exception; while ($sx2 -and -not ($sx2 -is [System.Data.SqlClient.SqlException]) -and $sx2.InnerException) { $sx2 = $sx2.InnerException }
|                        if (-not ($sx2 -is [System.Data.SqlClient.SqlException]) -or [int]$sx2.Number -ne 18456) { throw }
|                        throw (& $loginText -Token $tokenCache.Token -Server $srv -Database $db -ServerText $sx2.Message)
|                    }
|                }
|                # mode 'transaction' (-p = { param($TxInvoke) }): ONE connection, ONE transaction for everything the body sends
|                # through $TxInvoke (sql, params, mode) -- committed when the body returns, rolled back on any error (the template
|                # publish: a run never reads a half-written set)
|                if ($mode -eq 'transaction') {
|                    $tx = $cn.BeginTransaction()
|                    $txInvoke = {
|                        param([string]$tsql, $tp, [string]$tmode)
|                        $tc = $cn.CreateCommand(); $tc.Transaction = $tx; $tc.CommandText = $tsql; $tc.CommandTimeout = 0
|                        if ($tp) { foreach ($k in $tp.Keys) { [void]$tc.Parameters.AddWithValue('@' + $k, $(if ($null -eq $tp[$k]) { [System.DBNull]::Value } else { $tp[$k] })) } }
|                        if ($tmode -eq 'reader') { $rd = $tc.ExecuteReader(); $out = New-Object System.Collections.Generic.List[object]; while ($rd.Read()) { $h = @{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $h[$rd.GetName($i)] = $(if ($rd.IsDBNull($i)) { $null } else { $rd.GetValue($i) }) }; $out.Add($h) }; $rd.Close(); return , $out.ToArray() }
|                        if ($tmode -eq 'scalar') { return $tc.ExecuteScalar() }
|                        [void]$tc.ExecuteNonQuery()
|                    }.GetNewClosure()
|                    try { $r = & $p $txInvoke; $tx.Commit(); $tx = $null; return $r }
|                    catch { if ($tx) { try { $tx.Rollback() } catch { } }; throw }
|                }
|                $cmd = $cn.CreateCommand(); $cmd.CommandText = $sql; $cmd.CommandTimeout = 0
|                if ($p) { foreach ($k in $p.Keys) { [void]$cmd.Parameters.AddWithValue('@' + $k, $(if ($null -eq $p[$k]) { [System.DBNull]::Value } else { $p[$k] })) } }
|                switch ($mode) {
|                    'reader' {
|                        $rd = $cmd.ExecuteReader()
|                        $out = New-Object System.Collections.Generic.List[object]
|                        while ($rd.Read()) { $h = @{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $h[$rd.GetName($i)] = $(if ($rd.IsDBNull($i)) { $null } else { $rd.GetValue($i) }) }; $out.Add($h) }
|                        $rd.Close(); , $out.ToArray()
|                    }
|                    'scalar' { $cmd.ExecuteScalar() }
|                    default  { [void]$cmd.ExecuteNonQuery() }
|                }
|            } finally { $cn.Dispose() }
|        }.GetNewClosure()
|        $own = $Invoke
|        $txn = { param([scriptblock]$Body) & $own '' $Body 'transaction' }.GetNewClosure()
|        return [pscustomobject]@{ Name = ('{0}/{1}' -f $Server, $Database); Invoke = $Invoke; Transaction = $txn }
|    }
|    [pscustomobject]@{ Name = ('{0}/{1}' -f $Server, $Database); Invoke = $Invoke }
|}
|
|function Read-SIProSettings {
|    <# Every row of cfg.Setting, one per pipeline item (the reader returns its rows as ONE array -- unrolled here, so
|       @(Read-SIProSettings) counts rows, not result sets). #>
|    param([Parameter(Mandatory)]$Store)
|    & $Store.Invoke 'SELECT Name, Scope, ValueJson, KeyVaultSecretName, CONVERT(varchar(30), CONVERT(bigint, RowVersion)) AS Version FROM cfg.Setting' @{} 'reader' | ForEach-Object { $_ }
|}
|
|# WHICH KEY VAULT SECRET A SECRET SETTING MAY NAME -- the SAME lists as the web app's SecretSettingPolicy.cs
|# (pro-management/src/SI.Management.Web/Settings; a test keeps the two equal). A secret setting names its OWN secret only:
|# the product's name for it or a name under its fixed prefix; never a secret the product keeps for another purpose, never
|# another setting's. A name a customer chose before this rule, outside the product's SI- names, keeps working.
|$script:SISecretSettingFamilies = @(
|    [pscustomobject]@{ Key = 'openai'; Settings = @('OpenAI_apiKey'); Names = @('SI-OpenAI-Key'); Prefix = 'SI-OpenAI-' }
|    [pscustomobject]@{ Key = 'smtp'; Settings = @('SMTPPassword'); Names = @('SI-Smtp-Password'); Prefix = 'SI-Smtp-' }
|    [pscustomobject]@{ Key = 'shodan'; Settings = @('SI_Shodan_ApiKey', 'SHODAN_ApiKey'); Names = @('SI-Shodan-ApiKey'); Prefix = 'SI-Shodan-' }
|    [pscustomobject]@{ Key = 'spn'; Settings = @('SI_SPN_Secret', 'SpnClientSecret', 'SpnSecretName', 'SI_Graph_Secret', 'SI_LogIngest_Secret'); Names = @('SI-SPN-Secret', 'SecurityInsight-Secret'); Prefix = 'SI-SPN-Secret' }
|)
|$script:SISecretSettingReserved = @('SI-Invardia-InstallKey', 'SI-InstallId', 'SI-License', 'SI-Update-State', 'SI-Settings-Handover',
|    'SI-LicenceRequest-State', 'SI-LicenceRequest-Notice', 'SI-LicenceRequest-PullToken', 'SI-SPN-Cert')
|$script:SISecretSettingReservedPrefixes = @('SI-Invardia-', 'SI-LicenceRequest-', 'SI-SPN-Cert', 'SI-Connector-', 'SI-ServiceNow-', 'SI-Web-')
|
|if (-not (Get-Command -Name Test-SIAzureSqlHost -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($script:SIProRoot, 'engine', '_shared', 'SI-OutboundTrust.ps1')) }
|
|function Test-SIProSettingHost {
|    <#
|        PURE. '' = a stored value of -Name may be put in force; else why not. The settings that name where a credential goes:
|          SI_Pro_DataSqlServer    the engine sends its Azure SQL access token there: an Azure SQL host only
|          SI_Pro_DataSqlDatabase  a database name only (it is never part of the connection's server)
|          SI_Telemetry_Endpoint   the install key goes there: Invardia's own https address only
|          SI_LicenseRequest_BaseUrl  the install key and the licence pull token go there: Invardia's own https address only
|        Empty = the default applies (allowed).
|    #>
|    param([Parameter(Mandatory)][string]$Name, $Value)
|    $v = "$Value".Trim()
|    if (-not $v) { return '' }
|    switch ($Name) {
|        'SI_Pro_DataSqlServer'      { return (Test-SIAzureSqlHost -Server $v) }
|        'SI_Pro_DataSqlDatabase'    { return (Test-SISqlDatabaseName -Database $v) }
|        'SI_Telemetry_Endpoint'     { return (Test-SITelemetryEndpointHost -Endpoint $v) }
|        'SI_LicenseRequest_BaseUrl' { return (Test-SITelemetryEndpointHost -Endpoint $v) }
|    }
|    ''
|}
|
|function Get-SISecretSettingFamily {
|    <# PURE. The family of a secret setting; one the list does not name gets its own: prefix SI-<name with dashes>. #>
|    param([Parameter(Mandatory)][string]$Setting)
|    foreach ($f in $script:SISecretSettingFamilies) { if (@($f.Settings | Where-Object { $_ -ieq $Setting }).Count) { return $f } }
|    [pscustomobject]@{ Key = $Setting; Settings = @(); Names = @(); Prefix = ('SI-' + $Setting.Replace('_', '-')) }
|}
|
|function Test-SISecretSettingReference {
|    <#
|        PURE. '' = -SecretName may be used for -Setting; else why not, in plain words.
|        Default: a reference ALREADY STORED (the engine's read, setup's import) -- its own names, or a name the customer chose
|        before the rule (not under the product's SI- names, not another setting's). -New: a new or changed reference -- its
|        own names only (the web app's save).
|    #>
|    param([Parameter(Mandatory)][string]$Setting, [AllowEmptyString()][string]$SecretName = '', [switch]$New,
|          # the other secret settings whose stored rows name the SAME Key Vault secret: a customer's own name belongs to one
|          # setting (family) only -- named by two, it is used by neither (ConvertFrom-SIProSettingRows passes them)
|          [AllowNull()][AllowEmptyCollection()][string[]]$AlsoNamedBy = @())
|    $n = "$SecretName".Trim()
|    if ($n -cnotmatch '^[0-9A-Za-z-]{1,127}$') { return ("'{0}' is not a Key Vault secret name" -f $n) }
|    $f = Get-SISecretSettingFamily -Setting $Setting
|    $allowed = '{0}a name that starts with {1}' -f $(if (@($f.Names).Count) { (@($f.Names) -join ' or ') + ', or ' } else { '' }), $f.Prefix
|    $reserved = @($script:SISecretSettingReserved | Where-Object { $_ -ieq $n }).Count -or @($script:SISecretSettingReservedPrefixes | Where-Object { $n.StartsWith($_, [StringComparison]::OrdinalIgnoreCase) }).Count
|    if ($reserved) { return ('{0} is a secret SecurityInsight keeps for another purpose -- {1} names its own secret: {2}' -f $n, $Setting, $allowed) }
|    $isOwn = { param($fam) @($fam.Names | Where-Object { $_ -ieq $n }).Count -or $n.StartsWith([string]$fam.Prefix, [StringComparison]::OrdinalIgnoreCase) }
|    if (& $isOwn $f) { return '' }
|    if ($New) { return ('{0} names its own Key Vault secret: {1}' -f $Setting, $allowed) }
|    foreach ($o in $script:SISecretSettingFamilies) { if ($o.Key -ne $f.Key -and (& $isOwn $o)) { return ('{0} is another setting''s secret -- {1} names its own: {2}' -f $n, $Setting, $allowed) } }
|    if ($n.StartsWith('SI-', [StringComparison]::OrdinalIgnoreCase)) { return ('{0} is not {1}''s own secret -- {1} names {2}' -f $n, $Setting, $allowed) }
|    foreach ($o in @($AlsoNamedBy | Where-Object { $_ })) {
|        if ((Get-SISecretSettingFamily -Setting $o).Key -ne $f.Key) { return ('{0} is also named by {1} -- a secret belongs to one setting; {2} names {3}' -f $n, $o, $Setting, $allowed) }
|    }
|    ''
|}
|
|function ConvertFrom-SIProSettingRows {
|    <#
|        PURE. cfg.Setting rows -> the values this engine runs with, validated against the catalog.
|        Scope: 'solution' rows apply to every engine, 'engine:<folder>' rows to that engine only and win over 'solution'.
|        Refused (the caller stops the run): an unknown setting, a Pro setting row that does not parse, a value of the
|        wrong type, a secret stored as a value, or a non-secret stored as a Key Vault reference.
|        -Retired: settings that no longer exist (Get-SISettingsRetiredNames) -- a row for one is skipped without a word.
|        Returns @{ Values = name -> value; Secrets = name -> Key Vault secret name; Refused = [@{ Name; Scope; Reason }] }.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Rows, [Parameter(Mandatory)][object[]]$Catalog, [Parameter(Mandatory)][string]$Engine,
|          [AllowEmptyCollection()][string[]]$Retired = @())
|    $byName = @{}; foreach ($s in $Catalog) { $byName[[string]$s.name] = $s }
|    $values = [ordered]@{}; $secrets = [ordered]@{}; $refused = New-Object System.Collections.Generic.List[object]
|    $skippedSecret = New-Object System.Collections.Generic.List[object]
|    $ordered = @($Rows | Where-Object { $_ } | Sort-Object { if ([string]$_.Scope -eq 'solution') { 0 } else { 1 } })
|    # which secret settings name each Key Vault secret (every scope): a customer's own name belongs to ONE setting
|    $namedBy = @{}
|    foreach ($r in $ordered) {
|        $kvn = "$([string]$r.KeyVaultSecretName)".Trim(); $sdef = $byName[[string]$r.Name]
|        if (-not $kvn -or -not $sdef -or -not $sdef.secret) { continue }
|        $kk = $kvn.ToLowerInvariant()
|        if (-not $namedBy.ContainsKey($kk)) { $namedBy[$kk] = New-Object System.Collections.Generic.List[string] }
|        if (-not $namedBy[$kk].Contains([string]$r.Name)) { $namedBy[$kk].Add([string]$r.Name) }
|    }
|    foreach ($r in $ordered) {
|        $name = [string]$r.Name; $scope = [string]$r.Scope
|        if ($scope -ne 'solution' -and $scope -ne ('engine:' + $Engine)) { continue }    # another engine's setting
|        if (@($Retired) -contains $name) { continue }                                     # a setting that no longer exists
|        $s = $byName[$name]
|        if (-not $s) { $refused.Add([pscustomobject]@{ Name = $name; Scope = $scope; Reason = 'not a known setting' }); continue }
|        $kv = [string]$r.KeyVaultSecretName
|        if ($s.secret) {
|            if ($null -ne $r.ValueJson -and [string]$r.ValueJson -ne '') { $refused.Add([pscustomobject]@{ Name = $name; Scope = $scope; Reason = 'a secret must be a Key Vault reference, never a stored value' }); continue }
|            if (-not $kv) { $refused.Add([pscustomobject]@{ Name = $name; Scope = $scope; Reason = 'a secret setting without a Key Vault secret name' }); continue }
|            # a secret setting names its OWN Key Vault secret only: another name is left out of the run and said (never a stop)
|            $also = @($namedBy[$kv.Trim().ToLowerInvariant()] | Where-Object { $_ -and $_ -ne $name })
|            $own = Test-SISecretSettingReference -Setting $name -SecretName $kv -AlsoNamedBy $also
|            if ($own) { $skippedSecret.Add([pscustomobject]@{ Name = $name; Scope = $scope; Reason = $own }); continue }
|            $secrets[$name] = $kv; continue
|        }
|        if ($kv) { $refused.Add([pscustomobject]@{ Name = $name; Scope = $scope; Reason = 'only a secret setting may point at Key Vault' }); continue }
|        $v = $null
|        try { $v = ([string]$r.ValueJson) | ConvertFrom-Json -ErrorAction Stop } catch { $refused.Add([pscustomobject]@{ Name = $name; Scope = $scope; Reason = 'the stored value is not valid JSON' }); continue }
|        if ($s.type -eq 'list' -and $null -ne $v) { $v = @($v | ForEach-Object { [string]$_ }) }
|        if ($s.type -eq 'int' -and $null -ne $v) { $n = 0L; if ([long]::TryParse([string]$v, [ref]$n)) { $v = [int]$n } }
|        $why = Test-SISettingValue -Setting $s -Value $v
|        if ($why) { $refused.Add([pscustomobject]@{ Name = $name; Scope = $scope; Reason = $why }); continue }
|        # a number reaches the engine as a [double] whether it was stored as 0.01 or as the text "0.01"
|        if ($s.type -eq 'number') { $v = ConvertTo-SISettingNumber $v }
|        $values[$name] = $v
|    }
|    [pscustomobject]@{ Values = $values; Secrets = $secrets; Refused = $refused.ToArray(); SkippedSecrets = $skippedSecret.ToArray() }
|}
|
|# The web app's own settings (stored at scope engine:management-web, never in the engines' catalog) that an ENGINE reads too.
|# ConvertFrom-SIProSettingRows skips that scope -- it belongs to the web app -- so these are read here, as plain text:
|#   SIWeb_EnvironmentName, SIWeb_TenantName, SIWeb_PublicBaseUrl   every mail's subject, footer and links (MAIL-1)
|#   SIWeb_CmdbSource                                                the ONE CMDB owner the CI build takes CMDB values from
|#                                                                   (engine\data-model\SI-CiBuildRun.ps1 Get-SICmdbOwner)
|#   SIWeb_NumberFormatDefault                                       the number format of the guard mails (SI-Guard.ps1)
|$script:SIProWebSettingsForEngines = @('SIWeb_EnvironmentName', 'SIWeb_TenantName', 'SIWeb_PublicBaseUrl', 'SIWeb_CmdbSource', 'SIWeb_NumberFormatDefault')
|
|# the names, one by one (a ', @()' here made @(Get-SIProWebSettingsForEngines) ONE item holding the whole list)
|function Get-SIProWebSettingsForEngines { foreach ($n in @($script:SIProWebSettingsForEngines)) { $n } }
|
|function ConvertFrom-SIProWebSettingRows {
|    <#
|        PURE. cfg.Setting rows -> the web-app settings an engine reads (Get-SIProWebSettingsForEngines), each @{ Name; Value }.
|        Only rows at scope engine:management-web whose value is a non-empty JSON string count; anything else is skipped
|        without a word (the web app validates its own settings).
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @())
|    foreach ($wr in @($Rows | Where-Object { $_ -and [string]$_.Scope -eq 'engine:management-web' -and $script:SIProWebSettingsForEngines -contains [string]$_.Name })) {
|        $wv = $null
|        try { $wv = ([string]$wr.ValueJson) | ConvertFrom-Json -ErrorAction Stop } catch { continue }
|        if ($wv -is [string] -and $wv.Trim()) { [pscustomobject]@{ Name = [string]$wr.Name; Value = $wv.Trim() } }
|    }
|}
|
|function Read-SIProDocuments {
|    <# Every row of cfg.Document, one per pipeline item. A database that has not had the Pro-1b schema applied yet has no
|       documents: the read is guarded, so it returns nothing instead of failing on a missing table. #>
|    param([Parameter(Mandatory)]$Store)
|    & $Store.Invoke "IF OBJECT_ID('cfg.Document') IS NOT NULL SELECT Kind, [Key] AS DocKey, Body, CONVERT(varchar(30), CONVERT(bigint, [Version])) AS Version FROM cfg.Document" @{} 'reader' | ForEach-Object { $_ }
|}
|
|# =====================================================================================================================
|#  Pro-1b -- STRUCTURED SETTINGS AS DOCUMENTS (cfg.Document, REQUIREMENTS §9.2 B / C.3)
|#  The validation is the Community Settings page's own (Test-SIJsonChange for exclusions and weights, Test-SIRuleText for
|#  tier rules) -- called, not copied -- so a document is checked by the same rules whichever edition wrote it.
|# =====================================================================================================================
|$script:SIProDocKinds = @('exclusions', 'weights', 'rule')
|
|function Get-SIProDocumentContext {
|    <# What validating a document needs from the installation: the shipped Risk Analysis report names and the rule kinds
|       the engine knows. Read once per run (and only when there are documents). #>
|    param([string]$SIRoot = $script:SIProRoot)
|    [pscustomobject]@{ SIRoot = $SIRoot; Reports = @(Get-SIRaReportNames -SIRoot $SIRoot); Kinds = @(Get-SIRuleKinds -SIRoot $SIRoot) }
|}
|
|function Test-SIProDocumentKey {
|    <# PURE. $null when the key is valid for the kind, else the reason. #>
|    param([AllowEmptyString()][string]$Kind, [AllowEmptyString()][string]$Key)
|    if ($script:SIProDocKinds -notcontains $Kind) { return ("'{0}' is not a document kind (exclusions, weights, rule)" -f $Kind) }
|    if ([string]::IsNullOrEmpty($Key) -or $Key.Length -gt 128) { return 'the key must be 1 to 128 characters' }
|    switch ($Kind) {
|        'exclusions' { if ($Key -ne 'global' -and $Key -notmatch '^[A-Za-z0-9_]+$') { return ("'{0}' is not 'global' or a report name" -f $Key) } }
|        'weights'    { if ($Key -ne 'solution') { return "the weights document has the key 'solution'" } }
|        'rule'       { if ($Key -notmatch '^(endpoint|identity|azure|shared)/[A-Za-z0-9][A-Za-z0-9_\-]{0,99}$') { return ("'{0}' is not '<engine>/<rule id>' (engine: endpoint, identity, azure or shared)" -f $Key) } }
|    }
|    $null
|}
|
|function Test-SIProDocument {
|    <#
|        The reasons a document is not accepted (empty = accepted). -Context from Get-SIProDocumentContext.
|          exclusions -- a JSON object; every property is checked by Test-SIJsonChange (CVE ids, configuration ids, tags,
|                        CveMinAgeDays). Notes ('_'-prefixed, or Comment) are allowed and never reach a query. Anything
|                        else -- including the engine's legacy alias names, which it would paste into KQL unchecked -- is
|                        refused.
|          weights    -- a JSON object with weightedRiskFactors (each engine checked by Test-SIJsonChange), $schema and
|                        notes. Other sections of the weights file are not managed as a document and are refused.
|          rule       -- the tier rule YAML, checked by Test-SIRuleText: it parses, carries the key's id, uses only the
|                        kinds the engine knows, tiers 0-3.
|    #>
|    param([AllowEmptyString()][string]$Kind, [AllowEmptyString()][string]$Key, [AllowEmptyString()][AllowNull()][string]$Body, [Parameter(Mandatory)]$Context)
|    $why = New-Object System.Collections.Generic.List[string]
|    $k = Test-SIProDocumentKey -Kind $Kind -Key $Key
|    if ($k) { $why.Add($k); return $why.ToArray() }
|    if ([string]::IsNullOrWhiteSpace($Body)) { $why.Add('the document is empty'); return $why.ToArray() }
|    $isNote = { param([string]$n) $n.StartsWith('_') -or $n -eq 'Comment' }
|    $parseObject = {
|        param([string]$text)
|        $o = $null
|        try { $o = $text | ConvertFrom-Json -ErrorAction Stop } catch { $why.Add('the document is not valid JSON: ' + $_.Exception.Message); return $null }
|        if ($o -isnot [System.Management.Automation.PSCustomObject]) { $why.Add('the document must be a JSON object'); return $null }
|        $o
|    }
|    switch ($Kind) {
|        'exclusions' {
|            if ($Key -ne 'global' -and @($Context.Reports) -notcontains $Key) { $why.Add(("'{0}' is not a shipped Risk Analysis report" -f $Key)); break }
|            $o = & $parseObject $Body
|            if ($null -eq $o) { break }
|            $fileKey = if ($Key -eq 'global') { 'exclusions:global' } else { 'exclusions:' + $Key }
|            foreach ($p in $o.PSObject.Properties) {
|                if (& $isNote $p.Name) { continue }
|                foreach ($w in @(Test-SIJsonChange -Key $fileKey -Property $p.Name -Value $p.Value)) { $why.Add($w) }
|            }
|        }
|        'weights' {
|            $o = & $parseObject $Body
|            if ($null -eq $o) { break }
|            foreach ($p in $o.PSObject.Properties) {
|                if ((& $isNote $p.Name) -or $p.Name -eq '$schema') { continue }
|                if ($p.Name -ne 'weightedRiskFactors') { $why.Add(("'{0}' is not managed as a Pro document -- only weightedRiskFactors (keep other sections in the file)" -f $p.Name)); continue }
|                if ($p.Value -isnot [System.Management.Automation.PSCustomObject]) { $why.Add('weightedRiskFactors must be an object keyed by engine'); continue }
|                foreach ($e in $p.Value.PSObject.Properties) {
|                    if (& $isNote $e.Name) { continue }
|                    foreach ($w in @(Test-SIJsonChange -Key 'weights' -Property $e.Name -Value $e.Value)) { $why.Add($w) }
|                }
|            }
|        }
|        'rule' {
|            $id = $Key.Substring($Key.IndexOf('/') + 1)
|            foreach ($w in @(Test-SIRuleText -Text $Body.TrimStart([char]0xFEFF) -Id $id -Kinds @($Context.Kinds))) { $why.Add($w) }
|        }
|    }
|    $why.ToArray()
|}
|
|function ConvertFrom-SIProDocumentRows {
|    <# cfg.Document rows -> the accepted documents and the refused ones (Name = kind/key, Scope = 'document', Reason). #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Rows, [Parameter(Mandatory)]$Context)
|    $docs = New-Object System.Collections.Generic.List[object]; $refused = New-Object System.Collections.Generic.List[object]
|    foreach ($r in @($Rows | Where-Object { $_ })) {
|        $kind = [string]$r.Kind; $key = [string]$r.DocKey
|        $why = @(Test-SIProDocument -Kind $kind -Key $key -Body ([string]$r.Body) -Context $Context)
|        if ($why.Count) { $refused.Add([pscustomobject]@{ Name = ('{0}/{1}' -f $kind, $key); Scope = 'document'; Reason = ($why -join '; ') }); continue }
|        $docs.Add([pscustomobject]@{ Kind = $kind; Key = $key; Body = ([string]$r.Body).TrimStart([char]0xFEFF) })
|    }
|    [pscustomobject]@{ Documents = $docs.ToArray(); Refused = $refused.ToArray() }
|}
|
|function Get-SIProSettingsVersion {
|    <#
|        PURE. The version of the settings a run used (REQUIREMENTS §9.2 C.5): '<highest row version>-<12 hex>'. The row
|        version (SQL rowversion, database-wide and increasing) says WHEN; the hash of every (Name, Scope, ValueJson,
|        KeyVaultSecretName) and (Kind, Key, Body), sorted ordinally, says WHAT -- so two runs with the same version ran
|        on the same settings, and a removed row changes the version even though no row version moved.
|    #>
|    param([AllowEmptyCollection()][object[]]$Settings = @(), [AllowEmptyCollection()][object[]]$Documents = @(),
|          # Phase C: templates (by hash -- the body is large), item overrides and exemptions count too. A database without
|          # them hashes exactly as before.
|          [AllowEmptyCollection()][object[]]$Templates = @(), [AllowEmptyCollection()][object[]]$Overrides = @(),
|          [AllowEmptyCollection()][object[]]$Exemptions = @())
|    $us = [string][char]0x1F; $nul = [string][char]0
|    $max = 0L
|    $recs = New-Object System.Collections.Generic.List[string]
|    $rec = {
|        param([string]$tag, $row, [string[]]$fields)
|        $v = 0L; if ([long]::TryParse([string](Get-SIProRowValue $row 'Version'), [ref]$v) -and $v -gt $script:__siVerMax) { $script:__siVerMax = $v }
|        $f = foreach ($n in $fields) { $x = Get-SIProRowValue $row $n; if ($null -eq $x -or $x -is [System.DBNull]) { $nul } elseif ($x -is [datetime]) { $x.ToString('o', [System.Globalization.CultureInfo]::InvariantCulture) } else { [string]$x } }
|        $recs.Add($tag + $us + ($f -join $us))
|    }
|    $script:__siVerMax = 0L
|    foreach ($r in @($Settings | Where-Object { $_ })) { & $rec 'S' $r @('Name', 'Scope', 'ValueJson', 'KeyVaultSecretName') }
|    foreach ($r in @($Documents | Where-Object { $_ })) { & $rec 'D' $r @('Kind', 'DocKey', 'Body') }
|    foreach ($r in @($Templates | Where-Object { $_ })) { & $rec 'T' $r @('Kind', 'ItemKey', 'TemplateVersion', 'BodyHash', 'Format', 'SortOrder', 'RetiredAt') }
|    foreach ($r in @($Overrides | Where-Object { $_ })) { & $rec 'O' $r @('Kind', 'ItemKey', 'State', 'BodyJson', 'Format') }
|    foreach ($r in @($Exemptions | Where-Object { $_ })) { & $rec 'E' $r @('ExemptionId', 'Scope', 'ReportName', 'ConfigurationId', 'Cve', 'AssetKey', 'ExpiresAt', 'RevokedAt') }
|    $max = $script:__siVerMax
|    $recs.Sort([System.StringComparer]::Ordinal)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $h = -join ($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes(($recs.ToArray() -join [string][char]0x1E))) | ForEach-Object { $_.ToString('x2') }) } finally { $sha.Dispose() }
|    '{0}-{1}' -f $max, $h.Substring(0, 12)
|}
|
|function New-SIProRunFolder {
|    <# The run's own folder for materialised documents: under the temp folder (never the installation), unique per run.
|       Folders of earlier runs older than two days are cleared on the way (best effort). #>
|    param([Parameter(Mandatory)][string]$Engine, [string]$Root)
|    if (-not $Root) { $Root = Join-Path ([System.IO.Path]::GetTempPath()) 'si-pro-run' }
|    if (-not (Test-Path -LiteralPath $Root)) { New-Item -ItemType Directory -Path $Root -Force | Out-Null }
|    $cut = (Get-Date).AddDays(-2)
|    foreach ($old in @(Get-ChildItem -LiteralPath $Root -Directory -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -lt $cut })) {
|        Remove-Item -LiteralPath $old.FullName -Recurse -Force -ErrorAction SilentlyContinue
|    }
|    $dir = Join-Path $Root ('{0}-{1}-{2}' -f ($Engine -replace '[^A-Za-z0-9_\-]', '_'), (Get-Date).ToUniversalTime().ToString('yyyyMMdd-HHmmss'), [guid]::NewGuid().ToString('N').Substring(0, 8))
|    New-Item -ItemType Directory -Path $dir -Force | Out-Null
|    $dir
|}
|
|function Export-SIProDocuments {
|    <#
|        Materialise validated documents into the run-local folder, in exactly the shape the engines' own loaders read:
|          rule       -> <run>\rules\<engine>\<id>.custom.yaml  -- returned as RulesRoot, to be set as SI_EnrichmentDataRoot.
|                        The overlay a run had before (-ExistingOverlay: other operator rules, asset / correlation decision
|                        files at its root) is COPIED in first, so nothing it supplied is lost; a document then replaces a
|                        copied rule with the same id. The original overlay is only read.
|          exclusions -> <run>\risk-analysis\RiskAnalysisGlobalExclusions.custom.json | <Report>.exclude.custom.json
|          weights    -> <run>\risk-analysis\riskscore_weighted.schema.custom.json   -- returned as RaSettingsPath.
|        The file names come from the Settings page's own mapping (Resolve-SIJsonTarget). Refuses a run folder inside the
|        SecurityInsight folder: the shipped tree is never written.
|        Phase C: the documents-only form of Export-SIProConfig (SI-ProConfig.ps1), which also materialises templates,
|        item overrides and exemptions.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Documents, [Parameter(Mandatory)][string]$RunFolder,
|          [Parameter(Mandatory)]$Context, [string]$ExistingOverlay)
|    $m = Export-SIProConfig -Documents @($Documents) -RunFolder $RunFolder -Context $Context -ExistingOverlay $ExistingOverlay
|    [pscustomobject]@{ RulesRoot = $m.RulesRoot; RaSettingsPath = $m.RaSettingsPath; Rules = $m.Rules; Exclusions = $m.Exclusions; Weights = $m.Weights }
|}
|# =====================================================================================================================
|#  RUN HEALTH ON A SETTINGS FAILURE (REQUIREMENTS §9.2 C.4): the run still FAILS, and leaves one END record saying why.
|# =====================================================================================================================
|function ConvertTo-SIProSafeText {
|    <# PURE. A failure message made safe for a log record: tokens, keys and passwords redacted, one line, bounded. #>
|    param([AllowEmptyString()][AllowNull()][string]$Text, [int]$Max = 2000)
|    if ([string]::IsNullOrEmpty($Text)) { return '' }
|    $t = $Text -replace '(?i)(bearer\s+)[A-Za-z0-9\-\._~\+/]+=*', '$1[redacted]'
|    $t = $t -replace 'eyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]*', '[redacted-token]'
|    $t = $t -replace '(?i)\b(password|pwd|accountkey|sharedaccesskey|sig|client_secret|clientsecret|secret|accesstoken|access_token)(\s*[=:]\s*)([^;&\s,]+)', '$1$2[redacted]'
|    $t = ($t -replace '\s*\r?\n\s*', ' ').Trim()
|    if ($t.Length -gt $Max) { $t = $t.Substring(0, $Max) + '...' }
|    $t
|}
|
|function Send-SIProSettingsFailureRow {
|    <#
|        One run-health END record for a run the settings layer stopped: ExitReason 'settings-error', the reason (made safe)
|        and, when the rows were read, the settings version. NEVER THROWS -- it runs while another failure is on its way
|        out, and must neither mask it nor replace it with a second error.
|        Posted with the engines' own Send-SIRunHealthRow, using what layers 1-5 loaded (workspace, endpoint, identity).
|        When no Log Analytics target is configured at this point the record cannot be posted; the same line is written to
|        the console -- the launcher's transcript, which is where the launcher's own "Failed to load layered config"
|        failure lands -- so the reason is kept either way. -Send is a test seam: & $Send <RunContext> <ExitReason> <Message>.
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [AllowEmptyString()][string]$Message, [string]$Version, [datetime]$StartedAt = ([datetime]::UtcNow), [scriptblock]$Send,
|          # UPLINK-FIX: 'success-partial' for an install that is not finished yet (Test-SIProSettingsInstallPending) -- a warning
|          [ValidateSet('settings-error', 'success-partial')][string]$ExitReason = 'settings-error')
|    $runId = [guid]::NewGuid().ToString()
|    $msg = ''; $status = 'not posted'
|    try {
|        $msg = ConvertTo-SIProSafeText $Message
|        if ($Version) { $msg = '{0} [settings version {1}]' -f $msg, $Version }
|        $ctx = [pscustomobject]@{ RunId = $runId; Engine = $Engine; ShardIndex = 0; ShardCount = 1; StartedAt = $StartedAt.ToUniversalTime(); CollectionTime = [datetime]::SpecifyKind($StartedAt.ToUniversalTime(), [DateTimeKind]::Utc); FailedStep = 'settings' }
|        if ($Send) {
|            & $Send $ctx $ExitReason $msg
|            $status = 'handed to the run-health sender'
|        } elseif (-not $global:SI_WorkspaceResourceId -or -not $global:SI_DceName -or -not $global:SI_DcrResourceGroup) {
|            $status = 'not posted -- no Log Analytics target (SI_WorkspaceResourceId / SI_DceName / SI_DcrResourceGroup) is configured at this point'
|        } else {
|            if (-not (Get-Command -Name 'Send-SIRunHealthRow' -ErrorAction SilentlyContinue)) { . (Join-Path $script:SIProRoot 'engine\asset-profiling\shared\Send-SIRunHealthRow.ps1') }
|            if (-not (Get-Command -Name 'Initialize-SIIngestGlobals' -ErrorAction SilentlyContinue)) { . (Join-Path $script:SIProRoot 'engine\_shared\SI-LogIngest.ps1') }
|            Initialize-SIIngestGlobals
|            Send-SIRunHealthRow -RunContext $ctx -Phase 'End' -AssetCount -1 -ExitReason $ExitReason -ErrorMessage $msg
|            $status = 'posted (best effort -- a failed post is warned above)'
|        }
|    } catch {
|        $status = 'not posted -- ' + (ConvertTo-SIProSafeText $_.Exception.Message 300)
|    }
|    try { Write-Host ('[RUN-HEALTH] End  Engine={0}  RunId={1}  ExitReason={4}  {2}  -- {3}' -f $Engine, $runId, $status, $msg, $ExitReason) -ForegroundColor Yellow } catch { }
|    [pscustomobject]@{ RunId = $runId; ExitReason = $ExitReason; ErrorMessage = $msg; Status = $status }
|}
|
|function Invoke-SIProSettingsLayer {
|    <#
|        Run start, Pro: read cfg.Setting, cfg.Document and (Phase C) cfg.Template, cfg.ItemOverride and cfg.Exemption; set
|        the $global: values for this engine and materialise everything else to a run-local folder. THROWS -- and so fails
|        the run -- when the database cannot be read, a setting, document, template, override or exemption is refused, a
|        Key Vault secret cannot be resolved, or the configuration cannot be materialised. Before the failure leaves, ONE
|        run-health END record says why (Send-SIProSettingsFailureRow); the failure itself is rethrown unchanged.
|        On success:
|          $global:SI_ProSettingsVersion   the settings version this run used (every row of every table counts)
|          $global:SI_EnrichmentDataRoot   the run-local rules overlay (tier rules, decision files)
|          $global:SI_ProRulesFromSql      $true when the tier rules come from the templates -- the shipped tree is not read
|          $global:SI_ProRaSettingsPath    Risk Analysis: exclusions (+ exemptions), weights, the report catalog, the risk index
|          $global:SI_ProConfigRoot        CMDB ownership, service model, asset-tagging config, schema overlays
|          $global:SI_ProAssetTaggingPath  the asset-tagging rules
|          $global:SI_DataModelRoot        the data model (field catalog, provider mappings, ...): templates + overrides (#456)
|          $global:SI_ProTemplateVersion   the release the templates were published from
|          names (tables, DCRs, ...)     cfg.Setting rows like every setting (#251: names are settings, the catalog
|                                        default is the default); a naming override row from before setup carried it
|                                        over still sets its name, and a cfg.Setting row wins over it
|        -Store, -Catalog, -ResolveSecret, -DocumentContext, -RunRoot, -RunHealth and -Now are seams for tests; by default
|        the store is built from SI_ProSqlServer / SI_ProSqlDatabase and the engine SPN.
|    #>
|    param([Parameter(Mandatory)][string]$Engine, $Store, [object[]]$Catalog, [scriptblock]$ResolveSecret,
|          $DocumentContext, [string]$RunRoot, [scriptblock]$RunHealth,
|          # Names this host owns and the database must not override -- a container passes its container-owned list
|          # (SI-ContainerConfig's protected names). Live 2026-10-02: an internal install's AutomationFramework = true,
|          # imported into the database, re-enabled the internal platform framework inside a container and Risk Analysis
|          # failed. Skipped names are reported in $global:SI_ProSettingsSkipped, never applied.
|          [string[]]$ExcludeNames = @(),
|          [datetime]$Now = ([datetime]::UtcNow),
|          # UPLINK-FIX: { } -> how many runs ever ended well on this install (Test-SIProSettingsInstallPending; tests)
|          [scriptblock]$RunsBefore,
|          # #1147: the waits (seconds) before each new read after a network-level connect error (default Get-SISqlConnectRetryWaits),
|          # and the wait itself { param($Seconds) } (tests)
|          [int[]]$ReadRetryWaits, [scriptblock]$ReadSleep)
|    $global:SI_ProSettingsInstallPending = $null; $global:SI_ProSettingsTaggingNoAccess = $null
|    # the permission self-check's database part (engine\_shared\SI-PermissionCheck.ps1): what this run saw of its own access
|    $global:SI_ProDatabaseAccess = $null
|    $started = [datetime]::UtcNow
|    $version = ''
|    foreach ($n in 'SI_ProSettingsVersion', 'SI_ProRaSettingsPath', 'SI_ProConfigRoot', 'SI_ProAssetTaggingPath', 'SI_ProRulesFromSql', 'SI_ProTemplateVersion', 'SI_DataModelRoot') { Remove-Variable -Name $n -Scope Global -ErrorAction SilentlyContinue }
|    try {
|        if (-not $Catalog) { $Catalog = @(Get-SISettingsCatalog -SIRoot $script:SIProRoot) }
|        if (-not $Store) {
|            # The settings database ('settings-database') is in BOTH versions since 2026-10-18 (owner: the free version has
|            # the database): a free feature, so this check never consults a licence. It stays at this one place: should the
|            # feature ever be paid again, a refusal stops the run with the reason (one run-health record, below) -- never a
|            # run on other settings.
|            if (-not (Get-Command -Name Test-SIFeatureAvailable -ErrorAction SilentlyContinue)) {
|                . ([System.IO.Path]::Combine($script:SIProRoot, 'engine', 'SI-FeatureCatalog.ps1'))
|            }
|            $gate = Test-SIFeatureAvailable -Feature 'settings-database'
|            if (-not $gate.Allowed) { throw ("SecurityInsight Pro: the settings database is not licensed for this tenant ({0}) -- install a licence that includes it." -f $gate.Reason) }
|            # the engine SPN: SI_SPN_* where set, else the identity Connect-Platform set in layer 1 (internal installs) --
|            # the same fallback the vulnerability close-loop uses. Read only; no global is changed here.
|            $first = { param([object[]]$v) foreach ($x in $v) { if (-not [string]::IsNullOrWhiteSpace([string]$x)) { return [string]$x } }; '' }
|            $Store = New-SIProSettingsStore -Server ([string]$global:SI_ProSqlServer) -Database ([string]$global:SI_ProSqlDatabase) `
|                        -AppId (& $first @($global:SI_SPN_AppId, $global:HighPriv_Modern_ApplicationID_Azure)) `
|                        -TenantId (& $first @($global:SI_SPN_TenantId, $global:AzureTenantId)) `
|                        -CertThumbprint (& $first @($global:SI_SPN_CertThumbprint, $global:HighPriv_Modern_CertificateThumbprint_Azure))
|        }
|        $rows = $null; $docRows = $null; $tplRows = $null; $ovrRows = $null; $exRows = $null; $revRows = @()
|        # #1147 (an install's runner, 2026-11-07): ONE network-level failure to connect ("TCP Provider, error: 40 - Could not
|        # open a connection to SQL Server") stopped the run, and the daily run was missed. A connect error at the network /
|        # transport level (Test-SISqlConnectTransient -- nothing was read or written yet; every read here is a SELECT) is
|        # tried again after a short growing wait, each said; any other error, or the last attempt, stops the run as before.
|        if (-not (Get-Command -Name Test-SISqlConnectTransient -ErrorAction SilentlyContinue)) {
|            $rp = [System.IO.Path]::Combine($script:SIProRoot, 'engine', '_shared', 'SI-SqlRetry.ps1'); if (Test-Path -LiteralPath $rp) { . $rp }
|        }
|        $readWaits = if ($PSBoundParameters.ContainsKey('ReadRetryWaits')) { @($ReadRetryWaits) } elseif (Get-Command -Name Get-SISqlConnectRetryWaits -ErrorAction SilentlyContinue) { @(Get-SISqlConnectRetryWaits) } else { @() }
|        $readTry = 0
|        while ($true) {
|            try {
|                $rows = @(Read-SIProSettings -Store $Store); $docRows = @(Read-SIProDocuments -Store $Store)
|                $tplRows = @(Read-SIProTemplates -Store $Store); $ovrRows = @(Read-SIProItemOverrides -Store $Store); $exRows = @(Read-SIProExemptions -Store $Store)
|                # the shipped bodies the stale overrides were made on -- for the additive upgrade (only those rows are read)
|                # (never fails the run: without them an override behind the shipped content stays as stored, upgrade available)
|                $revRows = @()
|                try { $revRows = @(Read-SIProOverrideBaseRevisions -Store $Store | Where-Object { $_ }) } catch { $revRows = @() }
|                if ($readTry -gt 0) { Write-Host ('[pro-settings] the settings database {0} was read on attempt {1}' -f $Store.Name, ($readTry + 1)) }
|                break
|            }
|            catch {
|                $err = $_
|                $netErr = [bool]((Get-Command -Name Test-SISqlConnectTransient -ErrorAction SilentlyContinue) -and (Test-SISqlConnectTransient -ErrorRecord $err))
|                if ($netErr -and $readTry -lt $readWaits.Count) {
|                    $w = [int]$readWaits[$readTry]; $readTry++
|                    Write-Host ('[pro-settings] the settings database {0} could not be reached ({1}) -- a network-level connect error; tried again in {2} s (attempt {3} of {4})' -f $Store.Name, (([string]$err.Exception.Message) -split "`n")[0].Trim(), $w, ($readTry + 1), ($readWaits.Count + 1)) -ForegroundColor DarkYellow
|                    if ($ReadSleep) { & $ReadSleep $w } else { Start-Sleep -Seconds $w }
|                    continue
|                }
|                $after = if ($readTry -gt 0) { ' (after {0} attempts)' -f ($readTry + 1) } else { '' }
|                throw ("SecurityInsight Pro: the settings database {0} could not be read{1} -- the run stops rather than use other settings. {2}" -f $Store.Name, $after, $err.Exception.Message)
|            }
|        }
|        # signed in and read: the identity's own database roles, for the permission self-check (never fails the run)
|        $global:SI_ProDatabaseAccess = Read-SIProDatabaseAccess -Store $Store
|        # the ring this install reports to Invardia (SI-TelemetrySend): the updater's state and the recorded ring, read on
|        # the connection already open -- never a second sign-in at run end. Never fails the run.
|        $global:SI_InstallRingFacts = $null
|        if (Get-Command -Name Read-SIInstallRingFacts -ErrorAction SilentlyContinue) { $global:SI_InstallRingFacts = Read-SIInstallRingFacts -Store $Store }
|        # #517: the same store records Invardia's "your licence was re-issued" answer for the updater (SI-TelemetrySend) --
|        # never a second sign-in at run end
|        $global:SI_ProSettingsStore = $Store
|        $version = Get-SIProSettingsVersion -Settings @($rows) -Documents @($docRows) -Templates @($tplRows) -Overrides @($ovrRows) -Exemptions @($exRows)
|        $c = ConvertFrom-SIProSettingRows -Rows @($rows) -Catalog $Catalog -Engine $Engine -Retired @(Get-SISettingsRetiredNames)
|        $d = [pscustomobject]@{ Documents = @(); Refused = @() }
|        $any = @($docRows).Count + @($tplRows).Count + @($ovrRows).Count + @($exRows).Count
|        $m = [pscustomobject]@{ Items = @(); Disabled = @(); Refused = @(); Notes = @(); TemplateVersion = ''; Families = @{} }
|        $x = [pscustomobject]@{ Active = @(); Inactive = @(); Refused = @() }
|        if ($any) {
|            if (-not $DocumentContext) { $DocumentContext = Get-SIProDocumentContext -SIRoot $script:SIProRoot }
|            # the customer's own Risk Analysis reports (and the templates' reports) are reports too
|            $reports = New-Object System.Collections.Generic.List[string]
|            foreach ($r in @($DocumentContext.Reports)) { $reports.Add([string]$r) }
|            foreach ($r in @(@($tplRows) + @($ovrRows) | Where-Object { [string](Get-SIProRowValue $_ 'Kind') -eq 'rareport' -and [string](Get-SIProRowValue $_ 'ItemKey') -like 'report/*' })) {
|                $n = ([string](Get-SIProRowValue $r 'ItemKey')).Substring(7); if (-not $reports.Contains($n)) { $reports.Add($n) }
|            }
|            $ctx = [pscustomobject]@{ SIRoot = $DocumentContext.SIRoot; Reports = $reports.ToArray(); Kinds = @($DocumentContext.Kinds); Catalog = @($Catalog) }
|            if (@($docRows).Count) { $d = ConvertFrom-SIProDocumentRows -Rows @($docRows) -Context $ctx }
|            # A STORED OVERRIDE NEVER STOPS THE RUN (owner 2026-10-10): one from the previous model is migrated for this run
|            # (Resolve-SIProRunOverrides, the update's own translation, in memory -- the update writes it), one that still
|            # does not validate is left out and its template applies -- each said, per item.
|            $ovRes = Resolve-SIProRunOverrides -Overrides @($ovrRows) -SIRoot $script:SIProRoot
|            $ovrRows = @($ovRes.Overrides)
|            $m = Merge-SIProItems -Templates @($tplRows) -Overrides @($ovrRows) -Documents @($d.Documents) -Context $ctx -Revisions @($revRows)
|            $badOvr = @($m.Refused | Where-Object { $_.Scope -eq 'override' })
|            if ($badOvr.Count) {
|                $skip = @{}; foreach ($b in $badOvr) { $skip[[string]$b.Name] = [string]$b.Reason }
|                $ovrRows = @($ovrRows | Where-Object { -not $skip.ContainsKey(('{0}/{1}' -f (Get-SIProRowValue $_ 'Kind'), (Get-SIProRowValue $_ 'ItemKey'))) })
|                $m = Merge-SIProItems -Templates @($tplRows) -Overrides @($ovrRows) -Documents @($d.Documents) -Context $ctx -Revisions @($revRows)
|                $more = New-Object System.Collections.Generic.List[string]
|                foreach ($n in @($ovRes.Notes)) { $more.Add([string]$n) }
|                foreach ($k in $skip.Keys) { $more.Add(("{0}: your change does not validate ({1}) -- this run uses the shipped template for it; fix or reset it on the web app" -f $k, $skip[$k])) }
|                foreach ($n in @($m.Notes)) { $more.Add([string]$n) }
|                $m.Notes = $more.ToArray()
|            } elseif (@($ovRes.Notes).Count) {
|                $m.Notes = @(@($ovRes.Notes) + @($m.Notes) | Where-Object { $_ })
|            }
|            $x = ConvertFrom-SIProExemptionRows -Rows @($exRows) -Context $ctx -Now $Now
|            $DocumentContext = $ctx
|        }
|        $bad = New-Object System.Collections.Generic.List[string]
|        if (@($c.Refused).Count) {
|            $list = (@($c.Refused) | ForEach-Object { '{0} ({1}): {2}' -f $_.Name, $_.Scope, $_.Reason }) -join '; '
|            $bad.Add(("{0} setting(s) in the settings database are not valid -- the run stops. {1}" -f @($c.Refused).Count, $list))
|        }
|        if (@($d.Refused).Count) {
|            $list = (@($d.Refused) | ForEach-Object { '{0}: {1}' -f $_.Name, $_.Reason }) -join '; '
|            $bad.Add(("{0} document(s) in the settings database are not valid -- the run stops. {1}" -f @($d.Refused).Count, $list))
|        }
|        if (@($m.Refused).Count) {
|            $list = (@($m.Refused) | ForEach-Object { '{0} ({1}): {2}' -f $_.Name, $_.Scope, $_.Reason }) -join '; '
|            $bad.Add(("{0} configuration item(s) in the settings database are not valid -- the run stops. {1}" -f @($m.Refused).Count, $list))
|        }
|        if (@($x.Refused).Count) {
|            $list = (@($x.Refused) | ForEach-Object { '{0}: {1}' -f $_.Name, $_.Reason }) -join '; '
|            $bad.Add(("{0} exemption(s) in the settings database are not valid -- the run stops. {1}" -f @($x.Refused).Count, $list))
|        }
|        if ($bad.Count) { throw ('SecurityInsight Pro: ' + ($bad -join ' ')) }
|
|        $skipped = New-Object System.Collections.Generic.List[string]
|        # Names first, so a cfg.Setting row for the same name still wins below. #251: names are settings -- only a naming
|        # override row written before setup carried it over to cfg.Setting reaches here (a naming template is history).
|        foreach ($it in @($m.Items | Where-Object { $_.Kind -eq 'naming' })) {
|            if ($ExcludeNames -contains $it.Key) { if (-not $skipped.Contains($it.Key)) { $skipped.Add($it.Key) }; continue }
|            $val = [string](ConvertFrom-SIProJson $it.Body)
|            $cur = Get-Variable -Name $it.Key -Scope Global -ErrorAction SilentlyContinue
|            if ($it.Origin -eq 'template' -and $cur -and -not [string]::IsNullOrWhiteSpace([string]$cur.Value)) { continue }
|            Set-Variable -Name $it.Key -Value $val -Scope Global
|        }
|        foreach ($k in @($c.Values.Keys)) {
|            if ($ExcludeNames -contains $k) { if (-not $skipped.Contains($k)) { $skipped.Add($k) }; continue }
|            # where a credential goes: the SQL server the engine's token is sent to (an Azure SQL host) and the uplink the
|            # install key is sent to (Invardia's own) -- another value is left out of this run and said, never a stop
|            $hostWhy = Test-SIProSettingHost -Name $k -Value $c.Values[$k]
|            if ($hostWhy) { Write-Warning ('[pro-settings] {0} is not used in this run: {1}. The value from the job''s own settings applies.' -f $k, $hostWhy); continue }
|            Set-Variable -Name $k -Value $c.Values[$k] -Scope Global
|        }
|        # MAIL-1: every mail's footer and subject name the environment as the web app's header does -- its name, tenant name and
|        # address are web-app settings (scope engine:management-web); read here (read only, plain text) for the mail transport.
|        # The same for every other web-app setting an engine reads (Get-SIProWebSettingsForEngines): the CMDB owner the CI build
|        # uses and the number format of the guard mails. Without this they were never set in a run, so the customer's choice
|        # on the web app was ignored by the engines.
|        foreach ($wv in @(ConvertFrom-SIProWebSettingRows -Rows @($rows))) {
|            if (-not [string](Get-Variable -Name ([string]$wv.Name) -Scope Global -ValueOnly -ErrorAction SilentlyContinue)) { Set-Variable -Name ([string]$wv.Name) -Value $wv.Value -Scope Global }
|        }
|        foreach ($k in @($c.Secrets.Keys)) { if ($ExcludeNames -contains $k) { $skipped.Add($k); [void]$c.Secrets.Remove($k) } }
|        foreach ($sk in @($c.SkippedSecrets | Where-Object { $_ })) {
|            Write-Warning ('[pro-settings] {0} ({1}) is not used in this run: {2}. A SuperAdmin points it at its own secret on Settings.' -f $sk.Name, $sk.Scope, $sk.Reason)
|        }
|        $global:SI_ProSettingsSkipped = $skipped.ToArray()
|        # the Key Vault secret NAMES the secret settings name (names only, never a value): a connector never names one of
|        # them (Test-SIConnectorSecretBinding)
|        $global:SI_ProSecretSettingNames = @(@($rows) | Where-Object { $_ -and "$([string]$_.KeyVaultSecretName)".Trim() } | ForEach-Object { "$([string]$_.KeyVaultSecretName)".Trim() } | Sort-Object -Unique)
|        if ($c.Secrets.Count) {
|            if (-not $ResolveSecret) {
|                if (-not (Get-Command Get-SIKvSecret -ErrorAction SilentlyContinue)) { . (Join-Path $script:SIProRoot 'auth\Get-SIKvSecret.ps1') }
|                if (-not (Get-Command Get-SIVaultName -ErrorAction SilentlyContinue)) { . (Join-Path $script:SIProRoot 'auth\Get-SIVaultName.ps1') }
|                $ResolveSecret = { param($secretName) Get-SIKvSecret -VaultName (Get-SIVaultName) -SecretName $secretName }
|            }
|            foreach ($k in $c.Secrets.Keys) {
|                $val = $null
|                try { $val = & $ResolveSecret ([string]$c.Secrets[$k]) } catch { $val = $null }
|                if ([string]::IsNullOrEmpty([string]$val)) { throw ("SecurityInsight Pro: the Key Vault secret '{0}' for {1} could not be read -- the run stops." -f $c.Secrets[$k], $k) }
|                Set-Variable -Name $k -Value $val -Scope Global
|            }
|        }
|
|        $mat = [pscustomobject]@{ RulesRoot = $null; RaSettingsPath = $null; ConfigRoot = $null; AssetTaggingPath = $null; RulesFromSql = $false; Rules = 0; Exclusions = 0; Weights = 0 }
|        $toWrite = @($m.Items | Where-Object { $_.Kind -ne 'naming' })
|        if (@($d.Documents).Count -or $toWrite.Count -or @($x.Active).Count -or @($m.Families.Keys | Where-Object { $_ -ne 'naming' }).Count) {
|            try {
|                $runFolder = New-SIProRunFolder -Engine $Engine -Root $RunRoot
|                $mat = Export-SIProConfig -Items $toWrite -Documents @($d.Documents) -Exemptions @($x.Active) -Families $m.Families -RunFolder $runFolder -Context $DocumentContext -ExistingOverlay ([string]$global:SI_EnrichmentDataRoot)
|            } catch { throw ("SecurityInsight Pro: the settings documents could not be prepared for this run -- the run stops. {0}" -f $_.Exception.Message) }
|            if ($mat.RulesRoot) { $global:SI_EnrichmentDataRoot = [string]$mat.RulesRoot }
|            if ($mat.RulesFromSql) { $global:SI_ProRulesFromSql = $true }
|            if ($mat.RaSettingsPath) { $global:SI_ProRaSettingsPath = [string]$mat.RaSettingsPath }
|            if ($mat.ConfigRoot) { $global:SI_ProConfigRoot = [string]$mat.ConfigRoot }
|            if ($mat.AssetTaggingPath) { $global:SI_ProAssetTaggingPath = [string]$mat.AssetTaggingPath }
|            # #456: the data model (catalog, mappings, ...) from the templates + the customer's overrides -- what the record
|            # writer, the CI build and the outputs read (Get-SIDataModelRoot)
|            if ($mat.PSObject.Properties['DataModelRoot'] -and $mat.DataModelRoot) { $global:SI_DataModelRoot = [string]$mat.DataModelRoot }
|        }
|        if ($m.TemplateVersion) {
|            $global:SI_ProTemplateVersion = $m.TemplateVersion
|            # #250: template versions are their own series (pack 1.0, 1.1, ...); the code ships one of them
|            $shippedPack = Get-SIProShippedPackInfo -SIRoot $script:SIProRoot
|            $fam = [string[]]@($m.Families.Keys); [Array]::Sort($fam, [System.StringComparer]::Ordinal)
|            Write-Host ('[pro-settings] configuration from the database: {0} item(s) from templates {1} ({2}), {3} disabled, {4} exemption(s) in force ({5} expired or revoked)' -f `
|                @($m.Items).Count, $m.TemplateVersion, ($fam -join ', '), @($m.Disabled).Count, @($x.Active).Count, @($x.Inactive).Count)
|            $older = @(([string]$m.TemplateVersion).Split(',') | ForEach-Object { $_.Trim() } | Where-Object { $_ -and (Compare-SIProVersionParts $_ $shippedPack.PackVersion) -lt 0 })
|            if ($older.Count -and $older.Count -eq @(([string]$m.TemplateVersion).Split(',') | Where-Object { $_.Trim() }).Count) {
|                Write-Host ('[pro-settings] the templates in force are {0}; this release ships {1} -- the next setup or update run installs them (your own changes are kept)' -f $m.TemplateVersion, $shippedPack.Name) -ForegroundColor Yellow
|            }
|        }
|        foreach ($note in @(@($m.Notes) + @($mat.Notes) | Where-Object { $_ })) { Write-Host ('[pro-settings] {0}' -f $note) -ForegroundColor Yellow }
|        $global:SI_ProSettingsVersion = $version
|        # #302 (AUDIT-1.1): the changes people committed in the web app are in force for this job from now -- one audit
|        # event per change, naming the person who asked for it (and the approver). Never fails the run.
|        $applied = 0
|        if ($Store.Invoke -and (Get-Command -Name Invoke-SIChangeAttributionApply -ErrorAction SilentlyContinue)) {
|            try { $applied = Invoke-SIChangeAttributionApply -Invoke $Store.Invoke -Job $Engine -Log { param($l, $msg) Write-Host ('[pro-settings] {0}' -f $msg) -ForegroundColor Yellow } } catch { $applied = 0 }
|            if ($applied -gt 0) { Write-Host ('[pro-settings] {0} change(s) committed in the web app are in force from this run (recorded on the audit trail with who asked for them)' -f $applied) }
|        }
|        [pscustomobject]@{ Store = $Store.Name; Values = $c.Values.Count; Secrets = $c.Secrets.Count; Documents = @($d.Documents).Count
|            Items = @($m.Items).Count; Disabled = @($m.Disabled).Count; Exemptions = @($x.Active).Count; TemplateVersion = $m.TemplateVersion
|            Version = $version; RulesRoot = $mat.RulesRoot; RaSettingsPath = $mat.RaSettingsPath; ConfigRoot = $mat.ConfigRoot
|            AssetTaggingPath = $mat.AssetTaggingPath; RulesFromSql = [bool]$mat.RulesFromSql }
|    } catch {
|        $failure = $_
|        $fmsg = [string]$failure.Exception.Message
|        # the permission self-check: the failed sign-in is recorded WITH its error text -- the check reads from it whether
|        # the database refused the identity (no database user) or its server's firewall refused the job before any
|        # sign-in (Get-SIPermissionDatabaseFailure, engine\_shared\SI-PermissionCheck.ps1); the run-health record says which
|        if ($null -eq $global:SI_ProDatabaseAccess -and (Test-SIProSettingsSqlNotReady $fmsg)) { $global:SI_ProDatabaseAccess = @{ SignIn = 'failed'; Roles = $null; Error = $fmsg } }
|        # UPLINK-FIX (customer G 2026-10-07): the guided install creates the jobs (step container-jobs) BEFORE the Pro
|        # database and the identity's database user (pro-sql / pro-schema), so the flow's 5-minute wake-ups during the
|        # install cannot sign in to it. While NO run has ever ended well on this install, that is "the install is not
|        # finished", not a failure: a warning record, and the container ends cleanly ($global:SI_ProSettingsInstallPending).
|        if (Test-SIProSettingsInstallPending -Message $fmsg -RunsBefore $RunsBefore) {
|            $global:SI_ProSettingsInstallPending = $true
|            $null = Send-SIProSettingsFailureRow -Engine $Engine -ExitReason 'success-partial' -Version $version -StartedAt $started -Send $RunHealth `
|                -Message ('install not finished: the settings database cannot be signed in to yet (its database user is created later in the install); this run did nothing. ' + $fmsg)
|        } elseif ($Engine -eq 'asset-tagging' -and (Test-SIProSettingsSqlNotReady $fmsg)) {
|            # Fix request 85bd728f: asset tagging runs under its OWN identity (#236), and installs made before the fix never
|            # gave it a database user. Nothing is tagged (it reports only by default) and nothing else is affected: a warning
|            # that says how to fix it, and the container ends cleanly -- never a failed run every morning (#448).
|            $global:SI_ProSettingsTaggingNoAccess = $true
|            $tagWhy = 'its own identity has no user in the Pro database; this run did nothing. Fix once, as the SQL server''s Entra admin: setup\Grant-SITaggingDatabase.ps1 -Apply. '
|            # the server's firewall refused the job before any sign-in: the database user is not the problem, and the record says so
|            if ((Get-Command -Name Get-SIPermissionDatabaseFailure -ErrorAction SilentlyContinue) -and (Get-SIPermissionDatabaseFailure -Message $fmsg) -eq 'firewall') {
|                $tagWhy = 'the database server''s firewall refused this job before it could sign in (its database user is not the problem); this run did nothing. Fix: in the Azure portal allow Azure services and resources to access the SQL server (Networking), or run the guided install again. '
|            }
|            $null = Send-SIProSettingsFailureRow -Engine $Engine -ExitReason 'success-partial' -Version $version -StartedAt $started -Send $RunHealth `
|                -Message ('asset tagging cannot read its settings: ' + $tagWhy + $fmsg)
|        } else {
|            $null = Send-SIProSettingsFailureRow -Engine $Engine -Message $fmsg -Version $version -StartedAt $started -Send $RunHealth
|        }
|        throw $failure
|    }
|}
|
|function Read-SIProDatabaseAccess {
|    <#
|        After a successful sign-in: this identity's own roles in the Pro database (IS_ROLEMEMBER), for the permission
|        self-check (engine\_shared\SI-PermissionCheck.ps1). Returns @{ SignIn = 'ok'; Roles = @{ db_owner; db_datareader;
|        db_datawriter } -> '1' / '0' / $null (unknown); User }. NEVER THROWS: a role query that fails leaves the roles
|        unknown (the check then says "not checked", never "missing").
|    #>
|    param([Parameter(Mandatory)]$Store)
|    $out = @{ SignIn = 'ok'; Roles = @{}; User = ''; Error = '' }
|    try {
|        $rows = @(& $Store.Invoke "SELECT USER_NAME() AS UserName, IS_ROLEMEMBER(N'db_owner') AS db_owner, IS_ROLEMEMBER(N'db_datareader') AS db_datareader, IS_ROLEMEMBER(N'db_datawriter') AS db_datawriter" @{} 'reader' | ForEach-Object { $_ })
|        $r = $rows | Where-Object { $_ } | Select-Object -First 1
|        if ($r) {
|            $get = { param($n) if ($r -is [System.Collections.IDictionary]) { if ($r.Contains($n)) { $r[$n] } else { $null } } elseif ($r.PSObject.Properties[$n]) { $r.$n } else { $null } }
|            foreach ($n in 'db_owner', 'db_datareader', 'db_datawriter') {
|                $v = & $get $n
|                $out.Roles[$n] = $(if ($null -eq $v -or $v -is [System.DBNull]) { $null } else { [string][int]$v })
|            }
|            $out.User = [string](& $get 'UserName')
|        }
|    } catch { $out.Error = [string]$_.Exception.Message }
|    $out
|}
|
|function Test-SIProSettingsSqlNotReady {
|    <# PURE. The settings database refused the SIGN-IN (no login / no database user yet) -- not a bad row, not a network fault. #>
|    param([AllowEmptyString()][AllowNull()][string]$Message)
|    [bool]("$Message" -match "(?i)Login failed for user|Cannot open (server|database) .* requested by the login|token-identified principal")
|}
|
|function Test-SIProSettingsSqlNotCreated {
|    <# PURE. The settings database's SERVER does not exist (yet): its name does not resolve, or the database is not there.
|       customer H 2026-10-08: the flow woke while the install was still creating the server. Only "install pending" uses it --
|       together with "no run ever ended well"; on an established install it stays a settings-error. #>
|    param([AllowEmptyString()][AllowNull()][string]$Message)
|    [bool]("$Message" -match "(?i)No such host is known|Name or service not known|nodename nor servname|could not be resolved|Database '[^']+' on server '[^']+' is not currently available|Cannot open database .* The login failed")
|}
|
|function Test-SIProSettingsInstallPending {
|    <#
|        Is a settings-database sign-in failure the install still running (UPLINK-FIX, customer G 2026-10-07)? Only when the
|        failure is a sign-in refusal (Test-SIProSettingsSqlNotReady) AND no run has EVER ended well on this install
|        (SI_RunHealth_CL: an End with success / success-partial; a table that does not exist yet = none). Anything that
|        cannot be told is NOT pending -- the failure is then reported as before. -RunsBefore { } -> [long] (tests).
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Message, [scriptblock]$RunsBefore)
|    if (-not (Test-SIProSettingsSqlNotReady $Message) -and -not (Test-SIProSettingsSqlNotCreated $Message)) { return $false }
|    $n = -1L
|    try {
|        if ($RunsBefore) { $n = [long](& $RunsBefore) }
|        elseif (-not (Get-Module -Name Pester)) { $n = Get-SIProSettingsGoodRunCount }
|    } catch { $n = -1L }
|    return ($n -eq 0)
|}
|
|function Get-SIProSettingsGoodRunCount {
|    <# How many runs ever ended well on this install (0 or 1 -- 'take 1'): SI_RunHealth_CL in its workspace. A table that
|       does not exist yet is 0; anything else that fails throws (the caller then treats it as unknown). #>
|    if (-not (Get-Command -Name Resolve-SIV3WorkspaceId -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($script:SIProRoot, 'engine', '_shared', 'SI-V3Snapshot.ps1')) }
|    if (-not (Get-Command -Name Test-SIKqlTableMissing -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($script:SIProRoot, 'engine', '_shared', 'SI-KqlError.ps1')) }
|    $ws = Resolve-SIV3WorkspaceId
|    # A GOOD RUN IS A RUN OF AN ENGINE. The pipeline's own records do not count (Engine 'flow' and 'flow:<step>'): the
|    # "install not finished" record this very check writes is Engine 'flow', ExitReason success-partial -- counted, it made
|    # the SECOND wake-up of an unfinished install a failed run the customer had to fix (the first customer install,
|    # 2026-10-12: one such report every 5 minutes). Neither does any record that says the install is not finished.
|    $kql = "SI_RunHealth_CL | where Phase == 'End' and ExitReason in ('success', 'success-partial') and Engine != 'flow' and not(Engine startswith 'flow:') and not(tostring(column_ifexists('ErrorMessage', '')) startswith 'install not finished') | take 1 | count | project n = Count"
|    try { $r = @((Invoke-SIAzOperationalInsightsQuery -WorkspaceId $ws -Query $kql -ErrorAction Stop).Results) }
|    catch { if (Test-SIKqlTableMissing -ErrorRecord $_ -TableName 'SI_RunHealth_CL') { return 0L }; throw }
|    if (-not $r.Count) { return 0L }
|    [long]$r[0].n
|}
|function Set-SIProSetting {
|    <#
|        Write one setting: Set (a value, or for a secret a Key Vault secret name) or Reset (remove the row), with its
|        cfg.ChangeLog entry in the SAME transaction. Validated first by the same rules the reader applies.
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][object[]]$Catalog, [Parameter(Mandatory)][string]$Name,
|          [Parameter(Mandatory)][string]$Scope, [ValidateSet('Set', 'Reset')][string]$Action = 'Set', $Value, [string]$KeyVaultSecretName,
|          [Parameter(Mandatory)][string]$ChangedBy, [string]$Reason = '')
|    $s = $Catalog | Where-Object { $_.name -eq $Name } | Select-Object -First 1
|    if (-not $s) { throw "'$Name' is not a known setting" }
|    if ($Scope -ne 'solution' -and $Scope -notmatch '^engine:[a-z0-9\-]+$') { throw "'$Scope' is not a valid scope" }
|    $json = $null; $kv = $null
|    if ($Action -eq 'Set') {
|        if ($s.secret) {
|            if (-not $KeyVaultSecretName) { throw "$Name is a secret: give its Key Vault secret name, never the value" }
|            # the same rule the engine reads with: a secret setting names its own Key Vault secret
|            $ownWhy = Test-SISecretSettingReference -Setting $Name -SecretName $KeyVaultSecretName
|            if ($ownWhy) { throw "${Name}: $ownWhy" }
|            $kv = $KeyVaultSecretName
|        }
|        else {
|            $why = Test-SISettingValue -Setting $s -Value $Value
|            if ($why) { throw "$Name $why" }
|            $json = ConvertTo-SIJsonText $Value
|        }
|    }
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @old nvarchar(max) = (SELECT COALESCE(ValueJson, 'keyvault:' + KeyVaultSecretName) FROM cfg.Setting WHERE Name = @Name AND Scope = @Scope);
|IF @Action = 'Reset'
|    DELETE FROM cfg.Setting WHERE Name = @Name AND Scope = @Scope;
|ELSE IF EXISTS (SELECT 1 FROM cfg.Setting WHERE Name = @Name AND Scope = @Scope)
|    UPDATE cfg.Setting SET ValueJson = @ValueJson, KeyVaultSecretName = @Kv, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @Name AND Scope = @Scope;
|ELSE
|    INSERT cfg.Setting (Name, Scope, ValueJson, KeyVaultSecretName, UpdatedBy) VALUES (@Name, @Scope, @ValueJson, @Kv, @By);
|INSERT cfg.ChangeLog (Name, Scope, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (@Name, @Scope, @Action, @old, COALESCE(@ValueJson, 'keyvault:' + @Kv), @By, @Reason);
|COMMIT;
|'@
|    & $Store.Invoke $sql ([ordered]@{ Name = $Name; Scope = $Scope; Action = $Action; ValueJson = $json; Kv = $kv; By = $ChangedBy; Reason = $Reason }) 'nonquery'
|}
|
|function Set-SIProDocument {
|    <#
|        Write one document: Set (create or replace its Body) or Reset (remove it), with its cfg.ChangeLog entry (Name = the
|        key, Scope = 'document', Kind) in the SAME transaction. Validated BEFORE any SQL by the same rules the run-start
|        reader applies (Test-SIProDocument), so the writer can never store what the reader would refuse.
|        -Context is a seam (Get-SIProDocumentContext by default).
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Kind, [Parameter(Mandatory)][string]$Key,
|          [ValidateSet('Set', 'Reset')][string]$Action = 'Set', [AllowEmptyString()][string]$Body,
|          [Parameter(Mandatory)][string]$ChangedBy, [string]$Reason = '', $Context)
|    $bad = Test-SIProDocumentKey -Kind $Kind -Key $Key
|    if ($bad) { throw ("{0}/{1}: {2}" -f $Kind, $Key, $bad) }
|    $text = $null
|    if ($Action -eq 'Set') {
|        if (-not $Context) { $Context = Get-SIProDocumentContext -SIRoot $script:SIProRoot }
|        $text = ([string]$Body).TrimStart([char]0xFEFF)
|        $why = @(Test-SIProDocument -Kind $Kind -Key $Key -Body $text -Context $Context)
|        if ($why.Count) { throw ("{0}/{1} is not valid: {2}" -f $Kind, $Key, ($why -join '; ')) }
|    }
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @old nvarchar(max) = (SELECT Body FROM cfg.Document WITH (UPDLOCK, HOLDLOCK) WHERE Kind = @Kind AND [Key] = @Key);
|IF @Action = 'Reset'
|    DELETE FROM cfg.Document WHERE Kind = @Kind AND [Key] = @Key;
|ELSE IF @old IS NOT NULL
|    UPDATE cfg.Document SET Body = @Body, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Kind = @Kind AND [Key] = @Key;
|ELSE
|    INSERT cfg.Document (Kind, [Key], Body, UpdatedBy) VALUES (@Kind, @Key, @Body, @By);
|INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (@Key, 'document', @Kind, @Action, @old, @Body, @By, @Reason);
|COMMIT;
|'@
|    & $Store.Invoke $sql ([ordered]@{ Kind = $Kind; Key = $Key; Action = $Action; Body = $text; By = $ChangedBy; Reason = $Reason }) 'nonquery'
|}
|
|function Get-SIProDocumentImportPlan {
|    <#
|        What importing an install's structured settings into cfg.Document would write, each validated exactly as the run
|        will validate it:
|          exclusions  risk-analysis-detection\RiskAnalysisGlobalExclusions.custom.json -> exclusions/global
|                      risk-analysis-detection\<Report>.exclude.custom.json            -> exclusions/<Report>
|                      ...else <Report>.exclude.json (the shipped sample's name; the engine's own order, #275 R1)
|                      config\*.exclude*.json is read by nothing: LISTED with where it belongs, not imported (#275 G10)
|          weights     risk-analysis-detection\riskscore_weighted.schema.custom.json   -> weights/solution
|          rule        every custom tier rule -- page-created or hand-written, in the tree or in the overlay
|                      (-OverlayRoot); where both exist the overlay one is the rule in force -> rule/<engine>/<id>
|        Not imported, with the reason: a file that does not validate, a per-report *.weighted.custom.json (not a document
|        kind), and an asset-tagging file (it is not a tier rule). The files are left as they are.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$OverlayRoot, $Context)
|    if (-not $Context) { $Context = Get-SIProDocumentContext -SIRoot $SIRoot }
|    $rows = New-Object System.Collections.Generic.List[object]; $skipped = New-Object System.Collections.Generic.List[object]
|    $cands = New-Object System.Collections.Generic.List[object]
|    $dir = Join-Path $SIRoot 'risk-analysis-detection'
|    $info = New-Object System.Collections.Generic.List[object]
|    $relOf = { param([string]$p) if ($p.StartsWith($SIRoot, [StringComparison]::OrdinalIgnoreCase)) { $p.Substring($SIRoot.Length).TrimStart('\', '/') } else { $p } }
|    $g = Join-Path $dir 'RiskAnalysisGlobalExclusions.custom.json'
|    if (Test-Path -LiteralPath $g) { $cands.Add([pscustomobject]@{ Kind = 'exclusions'; Key = 'global'; Path = $g }) }
|    # #275 R1: per report, the file the 2.2 engine reads (RA-ExcludeLists.ps1 Get-ReportExcludeJson): <R>.exclude.custom.json,
|    # else <R>.exclude.json -- the name the shipped *.exclude.json.sample becomes -- the FIRST that parses. The other one,
|    # when both exist, was never read; it is said, not imported.
|    $byReport = [ordered]@{}
|    foreach ($f in @(Get-ChildItem -LiteralPath $dir -File -ErrorAction SilentlyContinue | Where-Object { $_.Name -match '(?i)^[^.]+\.exclude(\.custom)?\.json$' } | Sort-Object Name)) {
|        $rep = $f.Name -replace '(?i)\.exclude(\.custom)?\.json$', ''
|        if (-not $byReport.Contains($rep)) { $byReport[$rep] = @{ Custom = $null; Plain = $null } }
|        if ($f.Name -match '(?i)\.exclude\.custom\.json$') { $byReport[$rep].Custom = $f.FullName } else { $byReport[$rep].Plain = $f.FullName }
|    }
|    $parses = { param([string]$p) try { $null = ([System.IO.File]::ReadAllText($p)).TrimStart([char]0xFEFF) | ConvertFrom-Json -ErrorAction Stop; $true } catch { $false } }
|    foreach ($rep in @($byReport.Keys)) {
|        $pair = $byReport[$rep]
|        $use = $pair.Custom
|        if ($pair.Custom -and $pair.Plain) {
|            if (& $parses $pair.Custom) { $info.Add([pscustomobject]@{ Name = ('exclusions/{0}' -f $rep); Path = (& $relOf $pair.Plain); Reason = ('never read -- {0} comes first; not imported' -f (Split-Path -Leaf $pair.Custom)) }) }
|            else {
|                # the engine skips a file it cannot parse and reads the next one: so does the import (and says so)
|                $use = $pair.Plain
|                $skipped.Add([pscustomobject]@{ Name = ('exclusions/{0}' -f $rep); Scope = 'document'; Path = (& $relOf $pair.Custom); Reason = ('{0}: not valid JSON -- the run skipped it and read {1}, which is what is imported' -f (& $relOf $pair.Custom), (Split-Path -Leaf $pair.Plain)) })
|            }
|        } elseif (-not $use) { $use = $pair.Plain }
|        $cands.Add([pscustomobject]@{ Kind = 'exclusions'; Key = $rep; Path = $use })
|    }
|    # #275 G10: exclusion files in config\ -- where the README once said to put them. Nothing has ever read them (2.2 or
|    # 3.0), so they are not imported (that would switch on exclusions that were never in force); each is listed with the
|    # place it belongs.
|    if (-not (Get-Command -Name Get-SIMisplacedExcludeFiles -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'risk-analysis', '_shared', 'RA-ExcludeLists.ps1')) }
|    foreach ($m in @(Get-SIMisplacedExcludeFiles -SIRoot $SIRoot)) {
|        $skipped.Add([pscustomobject]@{ Name = ('exclusions/' + ($m.Name -replace '(?i)\.exclude(\.custom)?\.json$|\.custom\.json$', '')); Scope = 'document'; Path = (& $relOf $m.Path)
|            Reason = ('nothing reads exclusion files in config\ (2.2 or 3.0) -- these exclusions were never in force. To use them, move the file to {0}, check it, and import again' -f (& $relOf $m.ShouldBe)) })
|    }
|    $w = Join-Path $dir 'riskscore_weighted.schema.custom.json'
|    if (Test-Path -LiteralPath $w) { $cands.Add([pscustomobject]@{ Kind = 'weights'; Key = 'solution'; Path = $w }) }
|    foreach ($f in @(Get-ChildItem -LiteralPath $dir -Filter '*.weighted.custom.json' -File -ErrorAction SilentlyContinue)) {
|        $skipped.Add([pscustomobject]@{ Name = $f.Name; Scope = 'document'; Info = $true; Reason = ('a per-report weights file is not a document kind -- it is imported as the configuration item weights/report/{0}' -f ($f.Name -replace '\.weighted\.custom\.json$', '')) })
|    }
|    foreach ($r in @(Get-SIRuleView -SIRoot $SIRoot -OverlayRoot $OverlayRoot)) {
|        $own = if ($r.overlay) { $r.overlay } elseif ($r.custom) { $r.custom } else { $null }
|        if (-not $own) { continue }
|        # Phase C: turning a SHIPPED rule off is a state of its template (cfg.ItemOverride 'disable'), planned by
|        # Get-SIProConfigImportPlan -- not a document.
|        if ($r.locked -and $own.mode -eq 'disable') { continue }
|        $path = if ($own.path -like 'overlay:*') { Join-Path $OverlayRoot $own.path.Substring(8) } else { Join-Path $SIRoot $own.path }
|        $cands.Add([pscustomobject]@{ Kind = 'rule'; Key = ('{0}/{1}' -f $r.engine, $r.id); Path = $path })
|    }
|    foreach ($c in $cands) {
|        $text = ([System.IO.File]::ReadAllText($c.Path)).TrimStart([char]0xFEFF)
|        $rel = if ($c.Path.StartsWith($SIRoot, [StringComparison]::OrdinalIgnoreCase)) { $c.Path.Substring($SIRoot.Length).TrimStart('\') } else { $c.Path }
|        $name = '{0}/{1}' -f $c.Kind, $c.Key
|        if ($c.Kind -eq 'rule' -and $text -match '(?m)^AssetTagging\s*:') { $skipped.Add([pscustomobject]@{ Name = $name; Scope = 'document'; Info = $true; Path = $rel; Reason = ('{0} is an asset-tagging file, not a tier rule -- it stays in the files' -f $rel) }); continue }
|        if ($c.Kind -eq 'rule') {
|            # #908: a copied sample is an EXAMPLE, never a live rule -- the IP-subnet sample's 10.100.1.0/24 -> Tier 0 became
|            # one on an install this way. Refused (listed under "Not imported -- review"), the file is left as it is.
|            $sp = Get-SIRuleSamplePath -SIRoot $SIRoot -Path $c.Path -OverlayRoot $OverlayRoot
|            $st = if ($sp) { [System.IO.File]::ReadAllText($sp) } else { $null }
|            $sw = Get-SIRuleSampleReason -Text $text -SampleText $st
|            if ($sw) { $skipped.Add([pscustomobject]@{ Name = $name; Scope = 'document'; Path = $rel; Reason = ('{0}: the shipped example -- {1}' -f $rel, $sw) }); continue }
|        }
|        if ($c.Kind -eq 'weights') {
|            # An install's weights file is often the full risk-score model (mappers, normalizers, notes). Only its
|            # weightedRiskFactors is a Pro document -- that is all Risk Analysis reads from the Pro copy -- so that section
|            # is imported (with $schema and the file's notes) and every other section stays in the file, listed here.
|            $o = $null; try { $o = ConvertFrom-SIProJson $text } catch { $o = $null }
|            if ($o -is [System.Management.Automation.PSCustomObject]) {
|                $keep = { param([string]$n) $n.StartsWith('_') -or $n -eq 'Comment' -or $n -eq '$schema' -or $n -eq 'weightedRiskFactors' }
|                $other = @($o.PSObject.Properties | Where-Object { -not (& $keep $_.Name) } | ForEach-Object { $_.Name })
|                if (-not $o.PSObject.Properties['weightedRiskFactors']) {
|                    $skipped.Add([pscustomobject]@{ Name = $name; Scope = 'document'; Reason = ('{0}: it has no weightedRiskFactors -- only weightedRiskFactors is managed as a Pro document (keep other sections in the file)' -f $rel) }); continue
|                }
|                if ($other.Count -gt 0) {
|                    $doc = [ordered]@{}
|                    foreach ($p in $o.PSObject.Properties) { if (& $keep $p.Name) { $doc[$p.Name] = $p.Value } }
|                    $text = ConvertTo-SIJsonText $doc
|                    # #224: the sections are listed in FILE order (never a culture sort, which differs between PS 5.1 and 7).
|                    $skipped.Add([pscustomobject]@{ Name = ('{0} (other sections)' -f $name); Scope = 'document'; Info = $true; Reason = ('{0}: {1} -- not part of the weights document; they are imported as the configuration item weights/model (Get-SIProConfigImportPlan)' -f $rel, ($other -join ', ')) })
|                }
|            }
|        }
|        $why = @(Test-SIProDocument -Kind $c.Kind -Key $c.Key -Body $text -Context $Context)
|        if ($why.Count) { $skipped.Add([pscustomobject]@{ Name = $name; Scope = 'document'; Reason = ('{0}: {1}' -f $rel, ($why -join '; ')) }); continue }
|        $rows.Add([pscustomobject]@{ Kind = $c.Kind; Key = $c.Key; Body = $text; Source = $rel })
|    }
|    [pscustomobject]@{ Rows = $rows.ToArray(); Skipped = $skipped.ToArray(); Info = $info.ToArray() }
|}
|
|function Get-SIProLauncherOverrideFiles {
|    <#
|        #275 R4. Every launcher\<engine>\launcher.override.ps1 of an installation: free PowerShell the 2.2 internal launchers
|        dot-source AFTER the configuration layers (so it wins over LauncherConfig.custom.ps1). A container never runs it, so
|        Pro would silently lose what it sets: the importer lists every one. @{ Path; Rel; Engine; Scope = 'engine:<engine>' }.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    foreach ($d in @(Get-ChildItem -LiteralPath (Join-Path $SIRoot 'launcher') -Directory -ErrorAction SilentlyContinue | Sort-Object Name)) {
|        $p = Join-Path $d.FullName 'launcher.override.ps1'
|        if (-not (Test-Path -LiteralPath $p)) { continue }
|        [pscustomobject]@{ Path = $p; Rel = ('launcher\{0}\launcher.override.ps1' -f $d.Name); Engine = $d.Name; Scope = ('engine:{0}' -f $d.Name.ToLowerInvariant()) }
|    }
|}
|
|function Get-SIPs1CodeStatements {
|    <#
|        PURE. The top-level statements of a PowerShell text that are NOT a `$global:Name = ...` assignment -- code a settings
|        import cannot carry (a function, a condition, a command, a local variable). Per statement: Line, Text (its first line).
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text)
|    $tokens = $null; $errors = $null
|    $ast = [System.Management.Automation.Language.Parser]::ParseInput($Text, [ref]$tokens, [ref]$errors)
|    if (@($errors).Count) {
|        $e = @($errors)[0]
|        [pscustomobject]@{ Line = $e.Extent.StartLineNumber; Text = ('the file does not parse: ' + $e.Message) }
|        return
|    }
|    $stmts = New-Object System.Collections.Generic.List[object]
|    if ($ast.ParamBlock) { $stmts.Add($ast.ParamBlock) }
|    foreach ($b in @($ast.DynamicParamBlock, $ast.BeginBlock, $ast.ProcessBlock, $ast.EndBlock)) { if ($b) { foreach ($s in $b.Statements) { $stmts.Add($s) } } }
|    foreach ($s in $stmts) {
|        if ($s -is [System.Management.Automation.Language.AssignmentStatementAst] -and $s.Left -is [System.Management.Automation.Language.VariableExpressionAst] -and
|            $s.Left.VariablePath.UserPath -match '^global:[A-Za-z_][A-Za-z0-9_]*$') { continue }
|        $first = ($s.Extent.Text -split "`r?`n")[0].Trim()
|        if ($first.Length -gt 120) { $first = $first.Substring(0, 117) + '...' }
|        [pscustomobject]@{ Line = $s.Extent.StartLineNumber; Text = $first }
|    }
|}
|
|function Get-SIProImportPlan {
|    <#
|        PURE given a root. What importing an install's custom files into cfg.Setting would write: every catalog setting
|        the solution file or an engine file sets as a plain value. A value set by code, and any secret, is NOT imported
|        -- it is listed with the reason, so the operator moves it by hand (a secret becomes a Key Vault reference).
|        A name that ANY imported file sets by code is not imported at any scope: the database layer is read last, so a
|        row would override that code (a Key Vault pull, an engine's own condition). The files stay in place in Pro, so
|        leaving the name out keeps exactly today's behaviour.
|        #275 R4: every launcher\<engine>\launcher.override.ps1 is read after the custom files (the launcher dot-sources it
|        last, so it wins at its engine's scope): its plain top-level `$global:Name = <literal>` catalog settings are
|        imported at scope engine:<engine>; everything else in it (code) is listed as needing manual review, with the line.
|        Returns @{ Rows; Skipped; Overrides (one per override file: Rel, Scope, Imported, Review) }. Every skipped entry
|        carries Path (the file) and, where there is one, Line.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][object[]]$Catalog)
|    $byName = @{}; foreach ($s in $Catalog) { $byName[[string]$s.name] = $s }
|    $retired = @(Get-SISettingsRetiredNames)
|    $rows = New-Object System.Collections.Generic.List[object]; $skipped = New-Object System.Collections.Generic.List[object]
|    $sources = New-Object System.Collections.Generic.List[object]
|    $targets = Get-SISettingsTargets -SIRoot $SIRoot
|    foreach ($key in $targets.Keys) {
|        $scope = if ($key -eq 'solution') { 'solution' } else { $key }
|        $p = $targets[$key]
|        $rel = if ($p.StartsWith($SIRoot, [StringComparison]::OrdinalIgnoreCase)) { $p.Substring($SIRoot.Length).TrimStart('\', '/') } else { $p }
|        $sources.Add([pscustomobject]@{ Path = $p; Rel = $rel; Scope = $scope; Override = $null })
|    }
|    $overrides = New-Object System.Collections.Generic.List[object]
|    foreach ($o in @(Get-SIProLauncherOverrideFiles -SIRoot $SIRoot)) {
|        $entry = [pscustomobject]@{ Rel = $o.Rel; Engine = $o.Engine; Scope = $o.Scope; Imported = 0; Review = 0 }
|        $overrides.Add($entry)
|        $sources.Add([pscustomobject]@{ Path = $o.Path; Rel = $o.Rel; Scope = $o.Scope; Override = $entry })
|    }
|    foreach ($src in $sources) {
|        $r = Read-SISettingsText -Path $src.Path
|        if (-not $r.Exists) { continue }
|        $scope = $src.Scope
|        $skip = { param([string]$name, $line, [string]$reason) $skipped.Add([pscustomobject]@{ Name = $name; Scope = $scope; Path = $src.Rel; Line = $line; Reason = $reason }); if ($src.Override) { $src.Override.Review++ } }
|        if ($src.Override) {
|            # the code in an override file: listed line by line -- a Pro run never executes it
|            foreach ($c in @(Get-SIPs1CodeStatements -Text $r.Text)) {
|                & $skip ('{0}:{1}' -f $src.Rel, $c.Line) $c.Line ('code at line {0} ({1}) -- a Pro run does not run launcher.override.ps1; move what it does into Settings' -f $c.Line, $c.Text)
|            }
|        }
|        foreach ($a in @(Get-SIPs1Assignments -Text $r.Text)) {
|            if ($retired -contains $a.Name) { continue }    # a setting that no longer exists: not imported, not listed
|            $s = $byName[$a.Name]
|            # Phase C: a name the catalog does not know is REPORTED (it stays in the file, and a Pro run without the file
|            # will not have it), and a Pro-edition setting is imported like any other -- this is the Pro database.
|            if (-not $s) { & $skip $a.Name $a.Line ('not in the settings catalog (line {0}) -- not imported; a Pro run reads only catalog settings from the database' -f $a.Line); continue }
|            if ($s.secret) {
|                # A secret's VALUE never enters the database. When the file pulls it from Key Vault by a literal secret
|                # name, that name becomes the database's Key Vault reference; otherwise it is listed for the operator.
|                $kv = [regex]::Match([string]$a.ValueText, '(?i)(Get-SIKvSecret|Get-AzKeyVaultSecret|keyvault\s+secret\s+show)\b.*?(-SecretName|-Name|--name)\s+[''"]([A-Za-z0-9\-]{1,127})[''"]')
|                if ($kv.Success) {
|                    $prev = $rows | Where-Object { $_.Name -eq $a.Name -and $_.Scope -eq $scope } | Select-Object -First 1
|                    if ($prev) { [void]$rows.Remove($prev) }
|                    $rows.Add([pscustomobject]@{ Name = $a.Name; Scope = $scope; Value = $null; KeyVaultSecretName = $kv.Groups[3].Value; Line = $a.Line; Source = $src.Rel })
|                    if ($src.Override) { $src.Override.Imported++ }
|                    continue
|                }
|                & $skip $a.Name $a.Line 'a secret -- store it in Key Vault and set its secret name'; continue
|            }
|            if (-not ($a.TopLevel -and $a.Literal)) { & $skip $a.Name $a.Line ('set by code at line {0}' -f $a.Line); continue }
|            $why = Test-SISettingValue -Setting $s -Value $a.Value
|            if ($why) { & $skip $a.Name $a.Line $why; continue }
|            # the last assignment in a file is the one that runs (and an override file runs after the custom file)
|            $prev = $rows | Where-Object { $_.Name -eq $a.Name -and $_.Scope -eq $scope } | Select-Object -First 1
|            if ($prev) { [void]$rows.Remove($prev) }
|            $rows.Add([pscustomobject]@{ Name = $a.Name; Scope = $scope; Value = $a.Value; Line = $a.Line; Source = $src.Rel })
|            if ($src.Override) { $src.Override.Imported++ }
|        }
|    }
|    $byCode = @{}; foreach ($s in $skipped) { if ($s.Reason -like 'set by code*') { $byCode[$s.Name] = $s } }
|    foreach ($r in @($rows | Where-Object { $byCode.ContainsKey($_.Name) })) {
|        [void]$rows.Remove($r)
|        $skipped.Add([pscustomobject]@{ Name = $r.Name; Scope = $r.Scope; Path = $r.Source; Line = $r.Line; Reason = ('kept in the files -- {0} also sets it by code; a database value would override that code' -f $byCode[$r.Name].Scope) })
|        $ov = @($overrides | Where-Object { $_.Rel -eq $r.Source }) | Select-Object -First 1
|        if ($ov) { $ov.Imported--; $ov.Review++ }
|    }
|    [pscustomobject]@{ Rows = $rows.ToArray(); Skipped = $skipped.ToArray(); Overrides = $overrides.ToArray() }
|}
|
|function Get-SIProImportReview {
|    <#
|        #275. PURE. The import report's final section, "Not imported -- review": every entry any plan did NOT import, as one
|        line a person can act on, plus the exit code a wizard and the upgrade test check:
|            0 = everything was imported          2 = items need review (listed)
|        Entry kinds: 'not-imported' ("not imported: <path> -- <reason>") and 'needs-review' (code, or a value set by code:
|        "needs manual review: <file>:<line> -- <reason>"). Entries a plan marks Info -- nothing is lost (a file the run never
|        read, sections imported elsewhere) -- go to Informational and do not change the exit code.
|        Also returns LauncherOverrides: every launcher.override.ps1 found, with what was imported from it.
|    #>
|    param($Settings, $Documents, $Items, $Connectors)
|    $review = New-Object System.Collections.Generic.List[object]; $infos = New-Object System.Collections.Generic.List[object]
|    $prop = { param($o, [string]$n) if ($o -and $o.PSObject.Properties[$n]) { $o.$n } else { $null } }
|    $sections = @(@{ N = 'settings'; P = $Settings }, @{ N = 'documents'; P = $Documents }, @{ N = 'items'; P = $Items }, @{ N = 'connectors'; P = $Connectors })
|    foreach ($sec in $sections) {
|        if (-not $sec.P) { continue }
|        foreach ($s in @(& $prop $sec.P 'Skipped')) {
|            if (-not $s) { continue }
|            $path = [string](& $prop $s 'Path'); $line = & $prop $s 'Line'; $name = [string](& $prop $s 'Name'); $reason = [string](& $prop $s 'Reason')
|            if (-not $path) { $path = $name }
|            if ([bool](& $prop $s 'Info')) {
|                $infos.Add([pscustomobject]@{ Section = $sec.N; Name = $name; Path = $path; Reason = $reason; Text = ('note: {0} -- {1}' -f $path, $reason) }); continue
|            }
|            $isCode = ($reason -match '^(code at line|set by code)') -and $null -ne $line
|            $kind = if ($isCode) { 'needs-review' } else { 'not-imported' }
|            $where = if ($isCode -and $null -ne $line) { '{0}:{1}' -f $path, $line } elseif ($name -and $name -ne $path) { '{0} ({1})' -f $path, $name } else { $path }
|            $text = if ($isCode) { 'needs manual review: {0} -- {1}' -f $where, $reason } else { 'not imported: {0} -- {1}' -f $where, $reason }
|            $review.Add([pscustomobject]@{ Section = $sec.N; Kind = $kind; Name = $name; Path = $path; Line = $line; Reason = $reason; Text = $text })
|        }
|        foreach ($s in @(& $prop $sec.P 'Info')) {
|            if (-not $s) { continue }
|            $path = [string](& $prop $s 'Path'); $reason = [string](& $prop $s 'Reason')
|            $infos.Add([pscustomobject]@{ Section = $sec.N; Name = [string](& $prop $s 'Name'); Path = $path; Reason = $reason; Text = ('note: {0} -- {1}' -f $path, $reason) })
|        }
|    }
|    $ov = @(& $prop $Settings 'Overrides' | Where-Object { $_ })
|    [pscustomobject]@{
|        NotImported = $review.ToArray(); Informational = $infos.ToArray(); LauncherOverrides = $ov
|        ExitCode = $(if ($review.Count) { 2 } else { 0 })
|    }
|}
|
|function ConvertTo-SIProImportReportJson {
|    <# PURE. The import report as JSON (-ReportPath): what was planned / imported per part, the launcher overrides found, the
|       informational notes and the "Not imported -- review" section with the exit code. #>
|    param([Parameter(Mandatory)]$Review, $Settings, $Documents, $Items, $Connectors, [string]$SIRoot, [bool]$Applied, [string]$GeneratedAt)
|    $rep = [ordered]@{
|        schema      = 'securityinsight.import-report/1'
|        generatedAt = $GeneratedAt
|        installPath = $SIRoot
|        applied     = $Applied
|        exitCode    = $Review.ExitCode
|        result      = $(if ($Review.ExitCode -eq 0) { 'everything imported' } else { 'items need review' })
|        imported    = [ordered]@{
|            settings   = @(@($Settings.Rows) | Where-Object { $_ } | ForEach-Object { [ordered]@{ name = $_.Name; scope = $_.Scope; source = [string]$_.Source; line = $_.Line; keyVaultSecretName = [string]$_.KeyVaultSecretName } })
|            documents  = @(@($Documents.Rows) | Where-Object { $_ } | ForEach-Object { [ordered]@{ kind = $_.Kind; key = $_.Key; source = $_.Source } })
|            items      = @(@($Items.Rows) | Where-Object { $_ } | ForEach-Object { [ordered]@{ kind = $_.Kind; key = $_.Key; state = $_.State; source = $_.Source } })
|            connectors = @(@($(if ($Connectors) { $Connectors.Rows })) | Where-Object { $_ -and $_.Action -ne 'same' } | ForEach-Object { [ordered]@{ name = [string]$_.Definition.Name; action = $_.Action } })
|            sameAsTemplate = @(@($(if ($Items) { $Items.Same })) | Where-Object { $_ })
|        }
|        launcherOverrides = @($Review.LauncherOverrides | ForEach-Object { [ordered]@{ path = $_.Rel; scope = $_.Scope; settingsImported = $_.Imported; needsReview = $_.Review } })
|        informational     = @($Review.Informational | ForEach-Object { [ordered]@{ section = $_.Section; path = $_.Path; name = $_.Name; reason = $_.Reason } })
|        notImported       = @($Review.NotImported | ForEach-Object { [ordered]@{ section = $_.Section; kind = $_.Kind; path = $_.Path; line = $_.Line; name = $_.Name; reason = $_.Reason; text = $_.Text } })
|    }
|    ConvertTo-Json -InputObject $rep -Depth 6
|}
|
|function Get-SIProSettingsEngineName {
|    <#
|        PURE. The engine folder a container job's SI_ENGINE maps to -- the name `engine:<folder>` settings rows use (#211 (2)).
|        The two Risk Analysis jobs share one folder, the close-loop job uses asset-cmdb's; every other container
|        engine IS its launcher folder.
|    #>
|    param([Parameter(Mandatory)][string]$ContainerEngine)
|    $e = $ContainerEngine.Trim().ToLowerInvariant()
|    switch ($e) {
|        'risk-analysis-detailed' { return 'risk-analysis' }
|        'ptc'                    { return 'privilege-tier-classifier' }
|        # the close-loop job is the VM's `asset-cmdb launcher -Vulnerabilities` (#216)
|        'asset-vulnerabilities'  { return 'asset-cmdb' }
|        # ...and so does the close-loop's daily mail job (engine\asset-cmdb\Invoke-SICloseLoopMail.ps1)
|        'close-loop-mail'        { return 'asset-cmdb' }
|        # ...and the SQL CMDB connector (#271, engine\asset-cmdb\Invoke-SICmdbSql.ps1)
|        'asset-cmdb-sql'         { return 'asset-cmdb' }
|        # the Pro data sync job (L-DATA) is the engine\pro-data folder
|        'asset-datasync'         { return 'pro-data' }
|        default                  { return $e }
|    }
|}
'@ }
$__siSupportFiles['engine/pro-settings/SI-Settings.ps1'] = @{ Sha256 = '82551d4087cdaad8d009379dae924547d5a312f43ffeb925aaf1c96a4689b9e9'; Text = @'
|#Requires -Version 5.1
|<#
|    The Settings page's backend: read every settings layer, plan a change as a reviewable diff, write it safely.
|
|    🔒 SURGICAL, NEVER REGENERATED. A custom config file is hand-edited by operators and carries code (Key Vault
|    pulls, conditionals) next to plain values. A change here replaces ONLY the value of one top-level
|    `$global:Name = <literal>` assignment, or appends one line to a marked block. Write-SICustomConfig's
|    whole-file render is for first setup and must never be used from this page -- it would drop every hand edit
|    it does not model. An assignment that is not a plain literal is refused, never rewritten.
|
|    Everything in this file except Write-SISettingsFile is pure (text in, text out) and tested directly.
|#>
|
|$script:SISettingsMarker = '# --- set by the Settings page (SecurityInsight Config Wizard) ---'
|function Get-SIPs1Assignments {
|    <#
|        PURE. Every `$global:Name = ...` assignment in a PowerShell text. Per assignment: Name, Line, TopLevel (not
|        inside an if / function / loop), Literal (a plain value: string, number, $true/$false/$null, or an array of
|        those), Value (when literal), ValueText, and the offsets needed to edit it.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text)
|    $tokens = $null; $errors = $null
|    $ast = [System.Management.Automation.Language.Parser]::ParseInput($Text, [ref]$tokens, [ref]$errors)
|    $found = $ast.FindAll({ param($n)
|        $n -is [System.Management.Automation.Language.AssignmentStatementAst] -and
|        $n.Left -is [System.Management.Automation.Language.VariableExpressionAst] -and
|        $n.Left.VariablePath.UserPath -match '^global:[A-Za-z_][A-Za-z0-9_]*$'
|    }, $true)
|    foreach ($a in $found) {
|        $name = ($a.Left.VariablePath.UserPath -replace '^global:', '')
|        # Top level = the statement's parent chain reaches the script block without an if / loop / function / try.
|        $p = $a.Parent; $top = $true
|        while ($p -and -not ($p -is [System.Management.Automation.Language.ScriptBlockAst] -and $null -eq $p.Parent)) {
|            if ($p -isnot [System.Management.Automation.Language.NamedBlockAst] -and $p -isnot [System.Management.Automation.Language.ScriptBlockAst]) { $top = $false; break }
|            $p = $p.Parent
|        }
|        $expr = $null
|        $right = $a.Right
|        if ($right -is [System.Management.Automation.Language.PipelineAst] -and $right.PipelineElements.Count -eq 1 -and
|            $right.PipelineElements[0] -is [System.Management.Automation.Language.CommandExpressionAst]) {
|            $expr = $right.PipelineElements[0].Expression
|        } elseif ($right -is [System.Management.Automation.Language.CommandExpressionAst]) {
|            $expr = $right.Expression
|        }
|        $literal = $false; $value = $null
|        if ($expr -and $a.Operator -eq [System.Management.Automation.Language.TokenKind]::Equals) {
|            $isVar = $expr -is [System.Management.Automation.Language.VariableExpressionAst]
|            $okVar = (-not $isVar) -or ($expr.VariablePath.UserPath -in 'true', 'false', 'null')
|            $hasVar = @($expr.FindAll({ param($n) $n -is [System.Management.Automation.Language.VariableExpressionAst] -and $n.VariablePath.UserPath -notin 'true', 'false', 'null' }, $true)).Count -gt 0
|            $hasCall = @($expr.FindAll({ param($n) $n -is [System.Management.Automation.Language.CommandAst] -or $n -is [System.Management.Automation.Language.InvokeMemberExpressionAst] -or $n -is [System.Management.Automation.Language.SubExpressionAst] }, $true)).Count -gt 0
|            $isHash = @($expr.FindAll({ param($n) $n -is [System.Management.Automation.Language.HashtableAst] -or $n -is [System.Management.Automation.Language.ScriptBlockExpressionAst] }, $true)).Count -gt 0
|            if ($okVar -and -not $hasVar -and -not $hasCall -and -not $isHash) {
|                try { $value = $expr.SafeGetValue(); $literal = $true } catch { $literal = $false }
|            }
|        }
|        $vs = if ($expr) { $expr.Extent.StartOffset } else { $right.Extent.StartOffset }
|        $ve = if ($expr) { $expr.Extent.EndOffset } else { $right.Extent.EndOffset }
|        [pscustomobject]@{
|            Name = $name; Line = $a.Extent.StartLineNumber; TopLevel = $top; Literal = $literal
|            Value = $value; ValueText = $Text.Substring($vs, $ve - $vs)
|            StatementStart = $a.Extent.StartOffset; StatementEnd = $a.Extent.EndOffset; ValueStart = $vs; ValueEnd = $ve
|        }
|    }
|}
|
|function ConvertTo-SIPs1Literal {
|    <# PURE. A value as PowerShell source: 'text' (quotes doubled), numbers invariant, $true/$false/$null, @('a', 'b'). #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return '$null' }
|    if ($Value -is [bool]) { if ($Value) { return '$true' } else { return '$false' } }
|    if ($Value -is [int] -or $Value -is [long] -or $Value -is [double] -or $Value -is [decimal]) {
|        return ([string]::Format([System.Globalization.CultureInfo]::InvariantCulture, '{0}', $Value))
|    }
|    if ($Value -is [string]) { return ("'{0}'" -f $Value.Replace("'", "''")) }
|    if ($Value -is [System.Collections.IEnumerable] -and $Value -isnot [System.Collections.IDictionary]) {
|        $items = @(foreach ($v in $Value) {
|            if ($v -is [System.Collections.IEnumerable] -and $v -isnot [string]) { throw 'nested lists are not supported' }
|            ConvertTo-SIPs1Literal $v
|        })
|        return ('@(' + ($items -join ', ') + ')')
|    }
|    throw ("a value of type {0} cannot be written as a setting" -f $Value.GetType().Name)
|}
|
|function Edit-SIPs1Settings {
|    <#
|        PURE. Apply changes to a custom config text. Each change: @{ Name; Action = 'Set' | 'Reset'; Value }.
|          Set   -- the file's top-level literal assignment gets the new value (only its value text changes); with no
|                   assignment, one line is appended to the marked block at the end.
|          Reset -- the top-level literal assignment's line is removed, so the layer below applies again.
|        Refused (and listed, the text untouched for that name): any assignment of the name that is code, inside an
|        if / function, or shares its line with other code. Returns @{ Text; Applied; Refused }.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text, [Parameter(Mandatory)][object[]]$Changes)
|    $nl = if ($Text.Contains("`r`n")) { "`r`n" } elseif ($Text.Contains("`n")) { "`n" } else { "`r`n" }
|    $assign = @(Get-SIPs1Assignments -Text $Text)
|    $edits = New-Object System.Collections.Generic.List[object]     # @{ Start; End; Text }
|    $appends = New-Object System.Collections.Generic.List[string]
|    $applied = New-Object System.Collections.Generic.List[object]
|    $refused = New-Object System.Collections.Generic.List[object]
|    foreach ($c in $Changes) {
|        $name = [string]$c.Name
|        if ($name -notmatch '^[A-Za-z_][A-Za-z0-9_]*$') { $refused.Add([pscustomobject]@{ Name = $name; Reason = 'not a valid setting name' }); continue }
|        $mine = @($assign | Where-Object { $_.Name -eq $name })
|        $bad = @($mine | Where-Object { -not $_.TopLevel -or -not $_.Literal })
|        if ($bad.Count -gt 0) {
|            $refused.Add([pscustomobject]@{ Name = $name; Reason = ('set by code at line {0} -- edit it in the file' -f $bad[0].Line) }); continue
|        }
|        if ($c.Action -eq 'Set') {
|            try { $lit = ConvertTo-SIPs1Literal $c.Value } catch { $refused.Add([pscustomobject]@{ Name = $name; Reason = $_.Exception.Message }); continue }
|            if ($mine.Count -gt 0) {
|                # Every literal top-level assignment gets the value -- the last one wins at run time, and leaving an
|                # earlier one stale would make the file read one way and run another.
|                foreach ($m in $mine) { $edits.Add(@{ Start = $m.ValueStart; End = $m.ValueEnd; Text = $lit }) }
|            } else {
|                $appends.Add(('$global:{0} = {1}' -f $name, $lit))
|            }
|            $applied.Add([pscustomobject]@{ Name = $name; Action = 'Set'; Value = $c.Value })
|        } elseif ($c.Action -eq 'Reset') {
|            if ($mine.Count -eq 0) { continue }    # nothing set here: already the layer below
|            $ok = $true; $cuts = @()
|            foreach ($m in $mine) {
|                $ls = $Text.LastIndexOf("`n", [Math]::Max(0, $m.StatementStart - 1)); $ls = if ($m.StatementStart -eq 0 -or $ls -lt 0) { 0 } else { $ls + 1 }
|                $le = $Text.IndexOf("`n", $m.StatementEnd); $le = if ($le -lt 0) { $Text.Length } else { $le + 1 }
|                $before = $Text.Substring($ls, $m.StatementStart - $ls)
|                $after  = $Text.Substring($m.StatementEnd, $le - $m.StatementEnd).TrimEnd("`r", "`n")
|                if ($before.Trim() -ne '' -or ($after.Trim() -ne '' -and -not $after.Trim().StartsWith('#'))) { $ok = $false; break }
|                $cuts += @{ Start = $ls; End = $le; Text = '' }
|            }
|            if (-not $ok) { $refused.Add([pscustomobject]@{ Name = $name; Reason = 'shares its line with other code -- edit it in the file' }); continue }
|            foreach ($x in $cuts) { $edits.Add($x) }
|            $applied.Add([pscustomobject]@{ Name = $name; Action = 'Reset'; Value = $null })
|        } else {
|            $refused.Add([pscustomobject]@{ Name = $name; Reason = ('unknown action {0}' -f $c.Action) })
|        }
|    }
|    $out = $Text
|    foreach ($e in @($edits | Sort-Object { $_.Start } -Descending)) {
|        $out = $out.Substring(0, $e.Start) + $e.Text + $out.Substring($e.End)
|    }
|    if ($appends.Count -gt 0) {
|        $idx = $out.IndexOf($script:SISettingsMarker)
|        if ($idx -ge 0) {
|            $le = $out.IndexOf("`n", $idx); $le = if ($le -lt 0) { $out.Length } else { $le + 1 }
|            $block = ($appends -join $nl) + $nl
|            if ($le -eq $out.Length -and -not $out.EndsWith("`n")) { $block = $nl + $block }
|            $out = $out.Substring(0, $le) + $block + $out.Substring($le)
|        } else {
|            $sep = if ($out.Length -eq 0) { '' } elseif ($out.EndsWith("`n")) { $nl } else { $nl + $nl }
|            $out = $out + $sep + $script:SISettingsMarker + $nl + ($appends -join $nl) + $nl
|        }
|    }
|    # Self-check: the result parses, and every Set reads back as the value asked for.
|    $perr = $null; $tk = $null
|    [void][System.Management.Automation.Language.Parser]::ParseInput($out, [ref]$tk, [ref]$perr)
|    if (@($perr).Count -gt 0) { throw ('the edited file would not parse: {0}' -f $perr[0].Message) }
|    $check = @(Get-SIPs1Assignments -Text $out)
|    foreach ($a in @($applied | Where-Object { $_.Action -eq 'Set' })) {
|        $last = @($check | Where-Object { $_.Name -eq $a.Name -and $_.TopLevel -and $_.Literal }) | Select-Object -Last 1
|        if (-not $last -or (ConvertTo-SIPs1Literal $last.Value) -ne (ConvertTo-SIPs1Literal $a.Value)) { throw ('{0} did not read back as the value written' -f $a.Name) }
|    }
|    [pscustomobject]@{ Text = $out; Applied = $applied.ToArray(); Refused = $refused.ToArray() }
|}
|
|function Get-SITextDiff {
|    <# PURE. A unified diff (3 lines of context) between two texts; empty when they are equal. #>
|    param([AllowEmptyString()][string]$Old, [AllowEmptyString()][string]$New, [string]$Label = 'file', [int]$Context = 3)
|    $a = @($Old -split "`r?`n"); $b = @($New -split "`r?`n")
|    if ($Old -ceq $New) { return '' }
|    $pre = 0; while ($pre -lt $a.Count -and $pre -lt $b.Count -and $a[$pre] -ceq $b[$pre]) { $pre++ }
|    $suf = 0; while ($suf -lt ($a.Count - $pre) -and $suf -lt ($b.Count - $pre) -and $a[$a.Count - 1 - $suf] -ceq $b[$b.Count - 1 - $suf]) { $suf++ }
|    $am = @(if ($a.Count - $pre - $suf -gt 0) { $a[$pre..($a.Count - $suf - 1)] })
|    $bm = @(if ($b.Count - $pre - $suf -gt 0) { $b[$pre..($b.Count - $suf - 1)] })
|    # LCS over the changed middle only -- a settings change touches a few lines.
|    $n = $am.Count; $m = $bm.Count
|    # jagged, not [int[,]]: PS 5.1 cannot parse a computed second index like $L[$i, ($j + 1)]
|    $L = New-Object 'object[]' ($n + 1)
|    for ($i = 0; $i -le $n; $i++) { $L[$i] = New-Object 'int[]' ($m + 1) }
|    for ($i = $n - 1; $i -ge 0; $i--) { $row = $L[$i]; $down = $L[$i + 1]; for ($j = $m - 1; $j -ge 0; $j--) {
|        if ($am[$i] -ceq $bm[$j]) { $row[$j] = $down[$j + 1] + 1 } else { $row[$j] = [Math]::Max($down[$j], $row[$j + 1]) } } }
|    $body = New-Object System.Collections.Generic.List[string]
|    $cs = [Math]::Max(0, $pre - $Context)
|    for ($k = $cs; $k -lt $pre; $k++) { $body.Add(' ' + $a[$k]) }
|    $i = 0; $j = 0
|    while ($i -lt $n -or $j -lt $m) {
|        if ($i -lt $n -and $j -lt $m -and $am[$i] -ceq $bm[$j]) { $body.Add(' ' + $am[$i]); $i++; $j++ }
|        # on a tie the removed line comes first, so a changed line reads "- old" then "+ new"
|        elseif ($j -lt $m -and ($i -ge $n -or $L[$i][$j + 1] -gt $L[$i + 1][$j])) { $body.Add('+' + $bm[$j]); $j++ }
|        else { $body.Add('-' + $am[$i]); $i++ }
|    }
|    $ce = [Math]::Min($a.Count, $a.Count - $suf + $Context)
|    for ($k = $a.Count - $suf; $k -lt $ce; $k++) { $body.Add(' ' + $a[$k]) }
|    $hdr = '@@ -{0} +{1} @@' -f ($cs + 1), ($cs + 1)
|    (@("--- $Label", "+++ $Label", $hdr) + $body.ToArray()) -join "`n"
|}
|
|function Get-SISettingsTargets {
|    <#
|        PURE given a root. The ONLY files the page may write, by key -- the browser names a key, never a path:
|        'solution' = config\SecurityInsight.custom.ps1; 'engine:<name>' = launcher\<name>\LauncherConfig.custom.ps1 for
|        every engine folder that ships a LauncherConfig.defaults.ps1 or LauncherConfig.custom.sample.ps1.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $t = [ordered]@{ 'solution' = (Join-Path $SIRoot 'config\SecurityInsight.custom.ps1') }
|    foreach ($d in @(Get-ChildItem -LiteralPath (Join-Path $SIRoot 'launcher') -Directory -ErrorAction SilentlyContinue | Sort-Object Name)) {
|        if ($d.Name -eq '_lib') { continue }
|        if ((Test-Path -LiteralPath (Join-Path $d.FullName 'LauncherConfig.defaults.ps1')) -or (Test-Path -LiteralPath (Join-Path $d.FullName 'LauncherConfig.custom.sample.ps1'))) {
|            $t[('engine:{0}' -f $d.Name)] = (Join-Path $d.FullName 'LauncherConfig.custom.ps1')
|        }
|    }
|    $t
|}
|
|function Get-SIFileHash {
|    param([Parameter(Mandatory)][string]$Path)
|    if (-not (Test-Path -LiteralPath $Path)) { return '' }
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { -join ($sha.ComputeHash([System.IO.File]::ReadAllBytes($Path)) | ForEach-Object { $_.ToString('x2') }) } finally { $sha.Dispose() }
|}
|
|function Read-SISettingsText {
|    <# The text of a settings file (empty when absent) and whether it carries a UTF-8 BOM. #>
|    param([Parameter(Mandatory)][string]$Path)
|    if (-not (Test-Path -LiteralPath $Path)) { return [pscustomobject]@{ Text = ''; Bom = $true; Exists = $false } }
|    $bytes = [System.IO.File]::ReadAllBytes($Path)
|    $bom = $bytes.Length -ge 3 -and $bytes[0] -eq 0xEF -and $bytes[1] -eq 0xBB -and $bytes[2] -eq 0xBF
|    $text = if ($bom) { [System.Text.Encoding]::UTF8.GetString($bytes, 3, $bytes.Length - 3) } else { [System.Text.Encoding]::UTF8.GetString($bytes) }
|    [pscustomobject]@{ Text = $text; Bom = $bom; Exists = $true }
|}
|
|function Write-SISettingsFile {
|    <#
|        Write one settings file: refused when it changed since it was read (hash), backed up first
|        (<file>.bak.<timestamp>), written to a temp file and swapped in, so it is never half-written. Keeps a BOM the
|        file had, and adds one when the text is not plain ASCII (PowerShell 5.1 misreads UTF-8 without it).
|    #>
|    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][AllowEmptyString()][string]$Text,
|          [Parameter(Mandatory)][AllowEmptyString()][string]$ExpectedHash, [bool]$Bom = $true)
|    $now = Get-SIFileHash -Path $Path
|    if ($now -ne $ExpectedHash) { throw ('{0} changed since it was read -- reload and review again' -f (Split-Path -Leaf $Path)) }
|    $useBom = $Bom -or ($Text -match '[^\x00-\x7F]')
|    $dir = Split-Path -Parent $Path
|    if (-not (Test-Path -LiteralPath $dir)) { throw ('folder not found: {0}' -f $dir) }
|    # Short on purpose: PS 5.1 (.NET Framework) refuses paths over 260 characters, and "<long report name>.<guid>.tmp"
|    # crossed it in a deep install folder (measured 2026-10-02). Same folder, so the swap below stays one step.
|    $tmp = Join-Path $dir ('.si-{0}.tmp' -f [guid]::NewGuid().ToString('N').Substring(0, 8))
|    [System.IO.File]::WriteAllText($tmp, $Text, (New-Object System.Text.UTF8Encoding($useBom)))
|    $backup = $null
|    if (Test-Path -LiteralPath $Path) {
|        $backup = '{0}.bak.{1}' -f $Path, (Get-Date).ToString('yyyyMMdd-HHmmss')
|        [System.IO.File]::Replace($tmp, $Path, $backup)
|    } else {
|        [System.IO.File]::Move($tmp, $Path)
|    }
|    [pscustomobject]@{ Path = $Path; Backup = $backup; Hash = (Get-SIFileHash -Path $Path) }
|}
|
|function Get-SISettingsCatalog {
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $p = Join-Path $SIRoot 'config\settings.catalog.locked.json'
|    if (-not (Test-Path -LiteralPath $p)) { throw "settings catalog not found: $p" }
|    (Get-Content -LiteralPath $p -Raw -Encoding UTF8 | ConvertFrom-Json).settings
|}
|
|function Get-SISettingsRetiredNames {
|    <#
|        The settings that no longer exist (the catalog's "retired" list). A value left for one -- in a configuration file
|        or a Pro settings row -- is ignored without a message: never imported, never refused, never applied.
|    #>
|    param([string]$SIRoot)
|    # default: the solution root this function's own file ships in (engine\pro-settings\ -> root) -- read from the
|    # function itself, so it holds however and from whichever scope this file was loaded
|    if (-not $SIRoot) { $SIRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $MyInvocation.MyCommand.ScriptBlock.File)) }
|    if (-not $SIRoot) { return @() }
|    $p = Join-Path $SIRoot 'config\settings.catalog.locked.json'
|    if (-not (Test-Path -LiteralPath $p)) { return @() }
|    $c = Get-Content -LiteralPath $p -Raw -Encoding UTF8 | ConvertFrom-Json
|    if (-not $c.PSObject.Properties['retired']) { return @() }
|    @($c.retired | Where-Object { $_ } | ForEach-Object { [string]$_ })
|}
|
|function Get-SISettingsView {
|    <#
|        Every catalog setting with the value each layer gives it, the effective one, and where it comes from.
|        Layers, closest last: shared default -> engine default -> solution custom -> engine custom. A secret's value is
|        NEVER returned -- only whether it is set, and whether by code. Pro-only settings are left out: this page is the
|        Community edition's; Pro keeps its settings in SQL and manages them from its own page (operator, 2026-10-02).
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][object[]]$Catalog)
|    $targets = Get-SISettingsTargets -SIRoot $SIRoot
|    $read = @{}
|    function _layer([string]$key, [string]$path) {
|        $r = Read-SISettingsText -Path $path
|        $read[$key] = [pscustomobject]@{ Path = $path; Exists = $r.Exists; Assign = @(Get-SIPs1Assignments -Text $r.Text); Hash = (Get-SIFileHash -Path $path) }
|    }
|    _layer 'shared' (Join-Path $SIRoot 'launcher\_lib\SecurityInsight.shared-defaults.ps1')
|    foreach ($k in $targets.Keys) {
|        _layer $k $targets[$k]
|        if ($k -like 'engine:*') { _layer ('default:' + $k.Substring(7)) (Join-Path $SIRoot ('launcher\{0}\LauncherConfig.defaults.ps1' -f $k.Substring(7))) }
|    }
|    $rows = foreach ($s in $Catalog) {
|        if ($s.edition -eq 'pro') { continue }
|        $engines = @($s.engines)
|        $order = @(@{ Key = 'shared'; Label = 'shared default' })
|        foreach ($e in $engines) { $order += @{ Key = "default:$e"; Label = "$e default" } }
|        $order += @{ Key = 'solution'; Label = 'solution custom' }
|        foreach ($e in $engines) { $order += @{ Key = "engine:$e"; Label = "$e custom" } }
|        $layers = foreach ($o in $order) {
|            $L = $read[$o.Key]
|            if (-not $L) { continue }
|            $hits = @($L.Assign | Where-Object { $_.Name -eq $s.name })
|            if ($hits.Count -eq 0) { continue }
|            $h = $hits[-1]
|            $code = -not ($h.Literal -and $h.TopLevel)
|            [pscustomobject]@{
|                layer = $o.Label; key = $o.Key; line = $h.Line; byCode = $code
|                value = if ($s.secret -or $code) { $null } else { $h.Value }
|                text  = if ($s.secret) { $(if ($code) { '(set by code)' } else { '(set -- hidden)' }) } elseif ($code) { $h.ValueText } else { $null }
|            }
|        }
|        $layers = @($layers)
|        $eff = if ($layers.Count) { $layers[-1] } else { $null }
|        [pscustomobject]@{
|            name = $s.name; label = $s.label; group = $s.group; type = $s.type; engines = $engines; edition = $s.edition
|            secret = [bool]$s.secret; advanced = [bool]$s.advanced; description = $s.description
|            purpose = $s.purpose; defaultText = $s.defaultText; effect = $s.effect; whenToChange = $s.whenToChange; unit = $s.unit
|            values = $s.values; valueLabels = $s.valueLabels   # a fixed set of choices (type 'enum'): shown as a dropdown
|            target = if ($engines.Count -eq 1) { "engine:$($engines[0])" } else { 'solution' }
|            layers = $layers; effective = $eff
|            editable = (-not $s.secret)
|        }
|    }
|    [pscustomobject]@{
|        root = $SIRoot
|        files = @(foreach ($k in $read.Keys | Sort-Object) { [pscustomobject]@{ key = $k; path = $read[$k].Path; exists = $read[$k].Exists; hash = $read[$k].Hash; writable = $targets.Contains($k) } })
|        settings = @($rows)
|    }
|}
|
|function ConvertTo-SISettingNumber {
|    <#
|        PURE. A 'number' setting's value as a finite [double], or $null when it is not one. A real number (any integer or
|        decimal type) is taken as is; text is parsed with the INVARIANT culture only -- '0.01' is a number, '0,01' is not,
|        whatever the machine's culture -- so the same text means the same value on every host. NaN and infinity are not
|        numbers here. Booleans, lists and everything else are refused.
|    #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -is [bool]) { return $null }
|    $d = [double]::NaN
|    if ($Value -is [string]) {
|        if (-not [double]::TryParse($Value, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $null }
|    } elseif ($Value -is [int] -or $Value -is [long] -or $Value -is [double] -or $Value -is [decimal] -or $Value -is [single] -or
|              $Value -is [int16] -or $Value -is [byte] -or $Value -is [sbyte] -or $Value -is [uint16] -or $Value -is [uint32] -or $Value -is [uint64]) {
|        $d = [double]$Value
|    } else { return $null }
|    if ([double]::IsNaN($d) -or [double]::IsInfinity($d)) { return $null }
|    $d
|}
|
|function Test-SISettingValue {
|    <# PURE. $null when the value fits the setting's type, else the reason. #>
|    param([Parameter(Mandatory)]$Setting, [AllowNull()]$Value)
|    switch ([string]$Setting.type) {
|        'number' {
|            $d = ConvertTo-SISettingNumber $Value
|            if ($null -eq $d) { return 'must be a number' }
|            $inv = [System.Globalization.CultureInfo]::InvariantCulture
|            if ($null -ne $Setting.min -and $d -lt [double]$Setting.min) { return [string]::Format($inv, 'must be at least {0}', [double]$Setting.min) }
|            if ($null -ne $Setting.max -and $d -gt [double]$Setting.max) { return [string]::Format($inv, 'must be at most {0}', [double]$Setting.max) }
|        }
|        'bool'   { if ($Value -isnot [bool]) { return 'must be true or false' } }
|        'int'    {
|            $n = 0L
|            if (-not [long]::TryParse([string]$Value, [ref]$n)) { return 'must be a whole number' }
|            if ($null -ne $Setting.min -and $n -lt [long]$Setting.min) { return ('must be at least {0}' -f $Setting.min) }
|            if ($null -ne $Setting.max -and $n -gt [long]$Setting.max) { return ('must be at most {0}' -f $Setting.max) }
|        }
|        'list'   { if ($null -ne $Value -and -not ($Value -is [System.Collections.IEnumerable] -and $Value -isnot [string])) { return 'must be a list' } }
|        'enum'   { if (@($Setting.values) -notcontains [string]$Value) { return ('must be one of: {0}' -f (@($Setting.values) -join ', ')) } }
|        default  { if ($null -ne $Value -and $Value -isnot [string]) { return 'must be text' } }
|    }
|    if ($Setting.pattern -and $null -ne $Value -and [string]$Value -ne '' -and [string]$Value -notmatch [string]$Setting.pattern) { return ('does not match the expected format ({0})' -f $Setting.patternHint) }
|    $null
|}
|
|function Invoke-SISettingsPlan {
|    <#
|        A list of changes -> what each custom file would become, as a diff. Nothing is written. A change:
|        @{ name; action = 'Set' | 'Reset'; value }; its file comes from the catalog (one engine -> that engine's
|        custom file, else the solution file) -- the browser never names a file. Unknown settings, secrets, Pro settings
|        and values of the wrong type are refused with the reason. Returns @{ files; refused } where each file carries
|        its key, relative path, current hash, diff and (internal, not for the browser) the new text.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][object[]]$Catalog, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Changes)
|    $targets = Get-SISettingsTargets -SIRoot $SIRoot
|    $byName = @{}; foreach ($s in $Catalog) { $byName[[string]$s.name] = $s }
|    $refused = New-Object System.Collections.Generic.List[object]
|    $perFile = [ordered]@{}
|    foreach ($c in $Changes) {
|        $name = [string]$c.name; $action = [string]$c.action
|        $s = $byName[$name]
|        if (-not $s) { $refused.Add([pscustomobject]@{ name = $name; reason = 'not a known setting' }); continue }
|        if ($s.secret) { $refused.Add([pscustomobject]@{ name = $name; reason = 'a secret is never set from this page -- keep it in Key Vault' }); continue }
|        if ($s.edition -eq 'pro') { $refused.Add([pscustomobject]@{ name = $name; reason = 'a Pro setting is managed from the Pro settings page' }); continue }
|        if ($action -notin 'Set', 'Reset') { $refused.Add([pscustomobject]@{ name = $name; reason = "unknown action '$action'" }); continue }
|        $value = $c.value
|        if ($action -eq 'Set') {
|            if ($s.type -eq 'int' -and $value -is [string]) { $n = 0L; if ([long]::TryParse($value, [ref]$n)) { $value = [int]$n } }
|            if ($s.type -eq 'list' -and $null -ne $value) { $value = @($value | ForEach-Object { [string]$_ }) }
|            $why = Test-SISettingValue -Setting $s -Value $value
|            # a number is written as a number literal, invariant ('0.01', never '0,01' or a quoted '0.01'); a [double] also
|            # reads back as itself -- a [decimal] from PS 5.1's ConvertFrom-Json would keep '0.010' and fail the read-back
|            if (-not $why -and $s.type -eq 'number') { $value = ConvertTo-SISettingNumber $value }
|            if ($why) { $refused.Add([pscustomobject]@{ name = $name; reason = $why }); continue }
|        }
|        $engines = @($s.engines)
|        $key = if ($engines.Count -eq 1) { "engine:$($engines[0])" } else { 'solution' }
|        if (-not $targets.Contains($key)) { $refused.Add([pscustomobject]@{ name = $name; reason = "no custom file for $key" }); continue }
|        if (-not $perFile.Contains($key)) { $perFile[$key] = New-Object System.Collections.Generic.List[object] }
|        $perFile[$key].Add(@{ Name = $name; Action = $action; Value = $value })
|    }
|    $files = foreach ($key in $perFile.Keys) {
|        $path = $targets[$key]
|        $r = Read-SISettingsText -Path $path
|        $ed = Edit-SIPs1Settings -Text $r.Text -Changes $perFile[$key].ToArray()
|        foreach ($x in $ed.Refused) { $refused.Add([pscustomobject]@{ name = $x.Name; reason = $x.Reason }) }
|        $rel = $path.Substring($SIRoot.Length).TrimStart('\', '/').Replace('/', '\')
|        [pscustomobject]@{
|            key = $key; path = $rel; exists = $r.Exists; hash = (Get-SIFileHash -Path $path)
|            diff = (Get-SITextDiff -Old $r.Text -New $ed.Text -Label $rel)
|            applied = @($ed.Applied | ForEach-Object { [pscustomobject]@{ name = $_.Name; action = $_.Action; value = $_.Value } })
|            NewText = $ed.Text; Bom = $r.Bom; OldAssign = @(Get-SIPs1Assignments -Text $r.Text)
|        }
|    }
|    [pscustomobject]@{ files = @($files); refused = $refused.ToArray() }
|}
|
|function Invoke-SISettingsWrite {
|    <#
|        Re-plans the same changes on the server (the browser's text is never trusted) and writes each file only when
|        its hash is still the one the operator reviewed. Every applied change is logged to logs\settings-changes.log.
|        Nothing is written when any change is refused or any file is stale.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][object[]]$Catalog, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Changes,
|          [Parameter(Mandatory)][hashtable]$Hashes, [string]$User = ('{0}\{1}' -f $env:USERDOMAIN, $env:USERNAME))
|    $plan = Invoke-SISettingsPlan -SIRoot $SIRoot -Catalog $Catalog -Changes $Changes
|    if (@($plan.refused).Count -gt 0) { return [pscustomobject]@{ written = @(); refused = $plan.refused; error = 'some changes were refused -- nothing was written' } }
|    foreach ($f in $plan.files) {
|        if (-not $Hashes.ContainsKey($f.key) -or [string]$Hashes[$f.key] -ne $f.hash) {
|            return [pscustomobject]@{ written = @(); refused = @(); error = ('{0} changed since it was reviewed -- review again' -f $f.path) }
|        }
|    }
|    $written = New-Object System.Collections.Generic.List[object]
|    $logDir = Join-Path $SIRoot 'logs'
|    if (-not (Test-Path -LiteralPath $logDir)) { New-Item -ItemType Directory -Path $logDir -Force | Out-Null }
|    $log = Join-Path $logDir 'settings-changes.log'
|    foreach ($f in $plan.files) {
|        if (-not $f.diff) { continue }
|        $w = Write-SISettingsFile -Path (Join-Path $SIRoot $f.path) -Text $f.NewText -ExpectedHash $f.hash -Bom $f.Bom
|        foreach ($a in $f.applied) {
|            $old = @($f.OldAssign | Where-Object { $_.Name -eq $a.name }) | Select-Object -Last 1
|            $line = [ordered]@{
|                time = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ'); user = $User; file = $f.path; setting = $a.name; action = $a.action
|                old = $(if ($old) { $old.ValueText } else { $null }); new = $(if ($a.action -eq 'Set') { ConvertTo-SIPs1Literal $a.value } else { $null })
|            }
|            [System.IO.File]::AppendAllText($log, (($line | ConvertTo-Json -Compress) + "`r`n"), (New-Object System.Text.UTF8Encoding($false)))
|        }
|        $written.Add([pscustomobject]@{ key = $f.key; path = $f.path; backup = $(if ($w.Backup) { $w.Backup.Substring($SIRoot.Length).TrimStart('\', '/').Replace('/', '\') } else { $null }); hash = $w.Hash })
|    }
|    [pscustomobject]@{ written = $written.ToArray(); refused = @(); error = $null }
|}
|
|# =====================================================================================================================
|#  PHASE 2 -- the JSON settings: Risk Analysis exclusions and risk weights (risk-analysis-detection\*.custom.json)
|#  🔴 Every exclusion value and every weight field / value-map key is pasted into a KQL query by the engine, which
|#  escapes only a double quote. A backslash, a quote or a line break could break or change the query, so each value
|#  is checked against a strict pattern here -- the page's only way in.
|# =====================================================================================================================
|$script:SIJsonPatterns = @{
|    Cve      = '^CVE-\d{4}-\d{4,7}$'
|    ConfigId = '^[A-Za-z0-9._:\-]{1,128}$'
|    Tag      = '^[^"\\\r\n]{1,128}$'
|    Field    = '^[A-Za-z_][A-Za-z0-9_]{0,63}$'
|    MapKey   = '^[^"\\\r\n]{1,64}$'
|    IpRange  = '^\d{1,3}(\.\d{1,3}){3}(/\d{1,2})?$'
|}
|$script:SIWeightEngines = @('endpoint', 'identity', 'azure', 'publicip')
|
|function ConvertTo-SIJsonText {
|    <# PURE. Stable, readable JSON (2-space indent). A list is ALWAYS an array -- PS 5.1's ConvertTo-Json writes a one-item list as a bare value. #>
|    param([AllowNull()]$Value, [int]$Level = 0)
|    $pad = '  ' * $Level; $pad1 = '  ' * ($Level + 1)
|    if ($null -eq $Value) { return 'null' }
|    if ($Value -is [bool]) { if ($Value) { return 'true' } else { return 'false' } }
|    if ($Value -is [int] -or $Value -is [long] -or $Value -is [double] -or $Value -is [decimal] -or $Value -is [single]) {
|        return ([string]::Format([System.Globalization.CultureInfo]::InvariantCulture, '{0}', $Value))
|    }
|    if ($Value -is [string]) {
|        $sb = New-Object System.Text.StringBuilder
|        [void]$sb.Append('"')
|        foreach ($ch in $Value.ToCharArray()) {
|            switch ($ch) {
|                '"'  { [void]$sb.Append('\"') } '\' { [void]$sb.Append('\\') }
|                "`n" { [void]$sb.Append('\n') } "`r" { [void]$sb.Append('\r') } "`t" { [void]$sb.Append('\t') }
|                default { if ([int]$ch -lt 32) { [void]$sb.Append(('\u{0:x4}' -f [int]$ch)) } else { [void]$sb.Append($ch) } }
|            }
|        }
|        [void]$sb.Append('"'); return $sb.ToString()
|    }
|    $pairs = $null
|    if ($Value -is [System.Collections.IDictionary]) { $pairs = @(foreach ($k in $Value.get_Keys()) { ,@([string]$k, $Value[$k]) }) }
|    elseif ($Value -is [pscustomobject]) { $pairs = @(foreach ($p in $Value.PSObject.Properties) { ,@($p.Name, $p.Value) }) }
|    if ($null -ne $pairs) {
|        if ($pairs.Count -eq 0) { return '{}' }
|        $items = foreach ($p in $pairs) { $pad1 + (ConvertTo-SIJsonText $p[0]) + ': ' + (ConvertTo-SIJsonText $p[1] ($Level + 1)) }
|        return "{`n" + ($items -join ",`n") + "`n$pad}"
|    }
|    if ($Value -is [System.Collections.IEnumerable]) {
|        $arr = @($Value)
|        if ($arr.Count -eq 0) { return '[]' }
|        $items = foreach ($v in $arr) { $pad1 + (ConvertTo-SIJsonText $v ($Level + 1)) }
|        return "[`n" + ($items -join ",`n") + "`n$pad]"
|    }
|    return (ConvertTo-SIJsonText ([string]$Value) $Level)
|}
|
|function Get-SIRaReportNames {
|    <# The Risk Analysis report names in the shipped query file -- the only names an exclusion file may be created for. #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $p = Join-Path $SIRoot 'risk-analysis-detection\RiskAnalysis_Queries_Locked.yaml'
|    if (-not (Test-Path -LiteralPath $p)) { return @() }
|    @([regex]::Matches([System.IO.File]::ReadAllText($p), '(?m)^\s*-\s*ReportName:\s*([A-Za-z0-9_]+)\s*$') | ForEach-Object { $_.Groups[1].Value } | Sort-Object -Unique)
|}
|
|function Resolve-SIJsonTarget {
|    <# A JSON settings key -> its file, or $null. 'exclusions:global' | 'exclusions:<Report>' (a shipped report) | 'weights'. #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][string]$Key, [string[]]$Reports)
|    $dir = Join-Path $SIRoot 'risk-analysis-detection'
|    if ($Key -eq 'exclusions:global') { return (Join-Path $dir 'RiskAnalysisGlobalExclusions.custom.json') }
|    if ($Key -eq 'weights') { return (Join-Path $dir 'riskscore_weighted.schema.custom.json') }
|    if ($Key -match '^exclusions:([A-Za-z0-9_]+)$') {
|        $r = $Matches[1]
|        if (-not $Reports) { $Reports = Get-SIRaReportNames -SIRoot $SIRoot }
|        if ($Reports -contains $r) { return (Join-Path $dir ('{0}.exclude.custom.json' -f $r)) }
|    }
|    $null
|}
|
|function Test-SIJsonChange {
|    <# PURE. The reasons a change to a JSON settings file is not allowed (empty = allowed). #>
|    param([Parameter(Mandatory)][string]$Key, [Parameter(Mandatory)][string]$Property, [AllowNull()]$Value)
|    $why = New-Object System.Collections.Generic.List[string]
|    function _list($v, $rx, $what) {
|        foreach ($x in @($v)) { if ([string]$x -notmatch $rx) { $why.Add(("'{0}' is not a valid {1}" -f $x, $what)) } }
|    }
|    if ($Key -eq 'exclusions:global') {
|        # #541: the global exclusions -- asset tags, assets (CI ids or names) and address ranges -- reach every report whose
|        # scope declares them (data-model/report-scope, the Risk Analysis scope preamble)
|        switch ($Property) {
|            'ExcludedAssetTags' { _list $Value $script:SIJsonPatterns.Tag 'tag (no quotes, backslashes or line breaks)' }
|            'ExcludedAssets'    { _list $Value $script:SIJsonPatterns.Tag 'asset id or name (no quotes, backslashes or line breaks)' }
|            'ExcludedIpRanges'  { _list $Value $script:SIJsonPatterns.IpRange 'IPv4 address or range (a.b.c.d/nn)' }
|            default             { $why.Add('only ExcludedAssetTags, ExcludedAssets and ExcludedIpRanges can be set globally'); return $why.ToArray() }
|        }
|    } elseif ($Key -like 'exclusions:*') {
|        switch ($Property) {
|            'ExcludedCves'             { _list $Value $script:SIJsonPatterns.Cve 'CVE id (CVE-YYYY-NNNN)' }
|            'ExcludedConfigurationIds' { _list $Value $script:SIJsonPatterns.ConfigId 'configuration id (letters, digits, . _ : -)' }
|            'ExcludedAssetTags'        { _list $Value $script:SIJsonPatterns.Tag 'tag (no quotes, backslashes or line breaks)' }
|            'ExcludedAssets'           { _list $Value $script:SIJsonPatterns.Tag 'asset id or name (no quotes, backslashes or line breaks)' }
|            'ExcludedIpRanges'         { _list $Value $script:SIJsonPatterns.IpRange 'IPv4 address or range (a.b.c.d/nn)' }
|            'CveMinAgeDays'            { $n = 0; if (-not [int]::TryParse([string]$Value, [ref]$n) -or $n -lt 0 -or $n -gt 3650) { $why.Add('CveMinAgeDays must be a whole number from 0 to 3650') } }
|            default                    { $why.Add("'$Property' is not an exclusion setting") }
|        }
|    } elseif ($Key -eq 'weights') {
|        if ($script:SIWeightEngines -notcontains $Property) { $why.Add("'$Property' is not an engine (endpoint, identity, azure, publicip)"); return $why.ToArray() }
|        if ($null -eq $Value) { return $why.ToArray() }   # null = remove this engine's weights
|        # Multipliers are BASIS-100 WHOLE NUMBERS, as the engine reads them (RA-WeightedFactors.ps1 casts each to [int]
|        # and divides by 100): 100 = 1.0x, 150 = 1.5x. A decimal like 1.5 would become 2 = 0.02x -- silently no weight --
|        # so it is refused rather than accepted. A multiplier is 1..1000 (up to 10x); the cap is 0 (none) .. 10000 (100x,
|        # what two fields at 10x can reach). The real weights in use run 100..175.
|        function _whole($v, [double]$lo, [double]$hi) {
|            $d = 0.0
|            if (-not [double]::TryParse([string]$v, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $false }
|            ($d -eq [Math]::Floor($d)) -and $d -ge $lo -and $d -le $hi
|        }
|        $combine = [string]$Value.combine
|        if ($combine -and $combine -notin 'product', 'max', 'sum-of-deltas') { $why.Add("combine must be product, max or sum-of-deltas") }
|        if ($null -ne $Value.maxMultiplier -and -not (_whole $Value.maxMultiplier 0 10000)) { $why.Add('maxMultiplier must be a whole number from 0 to 10000 (100 = 1.0x, 500 = a 5x cap, 0 = no cap)') }
|        $fields = @($Value.fields)
|        if ($fields.Count -eq 0) { $why.Add('at least one weighted field is needed') }
|        foreach ($fl in $fields) {
|            if ([string]$fl.field -notmatch $script:SIJsonPatterns.Field) { $why.Add(("'{0}' is not a valid field name" -f $fl.field)); continue }
|            $map = $fl.valueMap
|            $props = if ($map -is [System.Collections.IDictionary]) { @($map.get_Keys()) } elseif ($map) { @($map.PSObject.Properties.Name) } else { @() }
|            if ($props.Count -eq 0) { $why.Add(("{0}: the value map is empty" -f $fl.field)) }
|            foreach ($k in $props) {
|                if ([string]$k -notmatch $script:SIJsonPatterns.MapKey) { $why.Add(("{0}: '{1}' is not a valid value" -f $fl.field, $k)) }
|                $mv = if ($map -is [System.Collections.IDictionary]) { $map[$k] } else { $map.$k }
|                if (-not (_whole $mv 1 1000)) { $why.Add(("{0}: the multiplier for '{1}' must be a whole number from 1 to 1000 (100 = 1.0x, 150 = 1.5x)" -f $fl.field, $k)) }
|            }
|            if ($null -ne $fl.default -and -not (_whole $fl.default 1 1000)) { $why.Add(("{0}: the default multiplier must be a whole number from 1 to 1000 (100 = 1.0x)" -f $fl.field)) }
|        }
|    } else {
|        $why.Add("unknown settings file '$Key'")
|    }
|    $why.ToArray()
|}
|
|function ConvertTo-SIOrderedJson {
|    <# PURE. ConvertFrom-Json output -> ordered dictionaries / lists, so a property can be set while every other key keeps its place. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [pscustomobject]) {
|        $o = [ordered]@{}; foreach ($p in $Value.PSObject.Properties) { $o[$p.Name] = ConvertTo-SIOrderedJson $p.Value }; return $o
|    }
|    if ($Value -is [System.Collections.IDictionary]) {
|        $o = [ordered]@{}; foreach ($k in $Value.get_Keys()) { $o[[string]$k] = ConvertTo-SIOrderedJson $Value[$k] }; return $o
|    }
|    if ($Value -is [System.Collections.IEnumerable] -and $Value -isnot [string]) { return ,@(foreach ($v in $Value) { ConvertTo-SIOrderedJson $v }) }
|    $Value
|}
|
|function Edit-SIJsonSettings {
|    <#
|        PURE. Apply property changes to one JSON settings file's text (empty / absent = {}). Every other key -- the
|        `_`-prefixed notes included -- keeps its value and place. For 'weights' the property is an engine under
|        weightedRiskFactors; $null removes it. For exclusions $null removes the property.
|    #>
|    param([Parameter(Mandatory)][string]$Key, [AllowEmptyString()][string]$Text, [Parameter(Mandatory)][object[]]$Changes)
|    $doc = if ([string]::IsNullOrWhiteSpace($Text)) { [ordered]@{} } else { ConvertTo-SIOrderedJson ($Text | ConvertFrom-Json) }
|    if ($doc -isnot [System.Collections.IDictionary]) { throw 'the file is not a JSON object' }
|    foreach ($c in $Changes) {
|        $prop = [string]$c.property
|        $val = ConvertTo-SIOrderedJson $c.value
|        if ($Key -eq 'weights') {
|            if (-not $doc.Contains('weightedRiskFactors') -or $doc['weightedRiskFactors'] -isnot [System.Collections.IDictionary]) { $doc['weightedRiskFactors'] = [ordered]@{} }
|            $w = $doc['weightedRiskFactors']
|            if ($null -eq $val) { if ($w.Contains($prop)) { $w.Remove($prop) } } else { $w[$prop] = $val }
|        } else {
|            if ($null -eq $val) { if ($doc.Contains($prop)) { $doc.Remove($prop) } }
|            elseif ($prop -eq 'CveMinAgeDays') { $doc[$prop] = [int]$val }
|            else { $doc[$prop] = @(@($val) | ForEach-Object { [string]$_ }) }
|        }
|    }
|    (ConvertTo-SIJsonText $doc) + "`n"
|}
|
|function Get-SIJsonSettingsView {
|    <# What the Exclusions and Risk weights pages show: the report names, the current global / per-report exclusions, and the current weights per engine. #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $reports = @(Get-SIRaReportNames -SIRoot $SIRoot)
|    $dir = Join-Path $SIRoot 'risk-analysis-detection'
|    function _read([string]$path) {
|        if (-not (Test-Path -LiteralPath $path)) { return $null }
|        try { Get-Content -LiteralPath $path -Raw -Encoding UTF8 | ConvertFrom-Json } catch { [pscustomobject]@{ _unreadable = $_.Exception.Message } }
|    }
|    $g = _read (Join-Path $dir 'RiskAnalysisGlobalExclusions.custom.json')
|    $per = foreach ($f in @(Get-ChildItem -LiteralPath $dir -Filter '*.exclude.custom.json' -ErrorAction SilentlyContinue)) {
|        $name = $f.Name -replace '\.exclude\.custom\.json$', ''
|        $b = _read $f.FullName
|        [pscustomobject]@{ report = $name; known = ($reports -contains $name); hash = (Get-SIFileHash -Path $f.FullName)
|            ExcludedCves = @($b.ExcludedCves | Where-Object { $_ }); ExcludedConfigurationIds = @($b.ExcludedConfigurationIds | Where-Object { $_ })
|            ExcludedAssetTags = @($b.ExcludedAssetTags | Where-Object { $_ }); CveMinAgeDays = $b.CveMinAgeDays }
|    }
|    $wpath = Join-Path $dir 'riskscore_weighted.schema.custom.json'
|    $w = _read $wpath
|    $sample = _read (Join-Path $dir 'riskscore_weighted.schema.custom.sample.json')
|    $engines = foreach ($e in $script:SIWeightEngines) {
|        $sec = if ($w -and $w.weightedRiskFactors -and $w.weightedRiskFactors.PSObject.Properties[$e]) { $w.weightedRiskFactors.$e } else { $null }
|        $ex = if ($sample -and $sample.weightedRiskFactors -and $sample.weightedRiskFactors.PSObject.Properties[$e]) { $sample.weightedRiskFactors.$e } else { $null }
|        [pscustomobject]@{ engine = $e; current = $sec; example = $ex }
|    }
|    [pscustomobject]@{
|        reports = $reports
|        global  = [pscustomobject]@{ ExcludedAssetTags = @($g.ExcludedAssetTags | Where-Object { $_ }); hash = (Get-SIFileHash -Path (Join-Path $dir 'RiskAnalysisGlobalExclusions.custom.json')) }
|        perReport = @($per)
|        weights = [pscustomobject]@{ engines = @($engines); hash = (Get-SIFileHash -Path $wpath); exists = (Test-Path -LiteralPath $wpath) }
|    }
|}
|
|function Invoke-SIJsonSettingsPlan {
|    <# Changes @{ key; property; value } -> per-file diff + hash, nothing written. Refused changes carry the reasons. #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Changes)
|    $reports = @(Get-SIRaReportNames -SIRoot $SIRoot)
|    $refused = New-Object System.Collections.Generic.List[object]
|    $perFile = [ordered]@{}
|    foreach ($c in $Changes) {
|        $key = [string]$c.key; $prop = [string]$c.property
|        $path = Resolve-SIJsonTarget -SIRoot $SIRoot -Key $key -Reports $reports
|        if (-not $path) { $refused.Add([pscustomobject]@{ name = "$key/$prop"; reason = "'$key' is not a settings file this page may change" }); continue }
|        $why = @(Test-SIJsonChange -Key $key -Property $prop -Value $c.value)
|        if ($why.Count) { $refused.Add([pscustomobject]@{ name = "$key/$prop"; reason = ($why -join '; ') }); continue }
|        if (-not $perFile.Contains($key)) { $perFile[$key] = @{ Path = $path; Changes = New-Object System.Collections.Generic.List[object] } }
|        $perFile[$key].Changes.Add(@{ property = $prop; value = $c.value })
|    }
|    $files = foreach ($key in $perFile.Keys) {
|        $path = $perFile[$key].Path
|        $r = Read-SISettingsText -Path $path
|        try { $new = Edit-SIJsonSettings -Key $key -Text $r.Text -Changes $perFile[$key].Changes.ToArray() }
|        catch { $refused.Add([pscustomobject]@{ name = $key; reason = ('the current file could not be read: {0}' -f $_.Exception.Message) }); continue }
|        $rel = $path.Substring($SIRoot.Length).TrimStart('\', '/').Replace('/', '\')
|        [pscustomobject]@{ key = $key; path = $rel; exists = $r.Exists; hash = (Get-SIFileHash -Path $path)
|            diff = (Get-SITextDiff -Old $r.Text -New $new -Label $rel); applied = @($perFile[$key].Changes | ForEach-Object { [pscustomobject]@{ property = $_.property } })
|            NewText = $new; OldText = $r.Text }
|    }
|    [pscustomobject]@{ files = @($files); refused = $refused.ToArray() }
|}
|
|function Invoke-SIJsonSettingsWrite {
|    <# Re-plans on the server and writes only files whose hash is still the reviewed one; logs each change. Nothing is written when anything is refused or stale. #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Changes,
|          [Parameter(Mandatory)][hashtable]$Hashes, [string]$User = ('{0}\{1}' -f $env:USERDOMAIN, $env:USERNAME))
|    $plan = Invoke-SIJsonSettingsPlan -SIRoot $SIRoot -Changes $Changes
|    if (@($plan.refused).Count) { return [pscustomobject]@{ written = @(); refused = $plan.refused; error = 'some changes were refused -- nothing was written' } }
|    foreach ($f in $plan.files) {
|        if (-not $Hashes.ContainsKey($f.key) -or [string]$Hashes[$f.key] -ne $f.hash) { return [pscustomobject]@{ written = @(); refused = @(); error = ('{0} changed since it was reviewed -- review again' -f $f.path) } }
|    }
|    $logDir = Join-Path $SIRoot 'logs'
|    if (-not (Test-Path -LiteralPath $logDir)) { New-Item -ItemType Directory -Path $logDir -Force | Out-Null }
|    $log = Join-Path $logDir 'settings-changes.log'
|    $written = New-Object System.Collections.Generic.List[object]
|    foreach ($f in $plan.files) {
|        if (-not $f.diff) { continue }
|        $w = Write-SISettingsFile -Path (Join-Path $SIRoot $f.path) -Text $f.NewText -ExpectedHash $f.hash -Bom $false
|        foreach ($a in $f.applied) {
|            $line = [ordered]@{ time = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ'); user = $User; file = $f.path; setting = $a.property; action = 'Set' }
|            [System.IO.File]::AppendAllText($log, (($line | ConvertTo-Json -Compress) + "`r`n"), (New-Object System.Text.UTF8Encoding($false)))
|        }
|        $written.Add([pscustomobject]@{ key = $f.key; path = $f.path; backup = $(if ($w.Backup) { $w.Backup.Substring($SIRoot.Length).TrimStart('\', '/').Replace('/', '\') } else { $null }); hash = $w.Hash })
|    }
|    [pscustomobject]@{ written = $written.ToArray(); refused = @(); error = $null }
|}
|
|# =====================================================================================================================
|#  PHASE 3 -- tier rules (asset-profiling-enrichment\<engine>\...\<id>.custom.yaml)
|#  A custom rule with the same id REPLACES the shipped one; `mode: disable` turns it off; a rule in the overlay folder
|#  (SI_EnrichmentDataRoot, outside the code tree) wins over both. The page writes only rules it created (marked on the
|#  first line) -- a hand-written custom rule is shown read-only, because a YAML round trip would drop its comments.
|# =====================================================================================================================
|$script:SIRuleMarker = '# Created by the SecurityInsight Settings page'
|$script:SIRuleEngines = @('endpoint', 'identity', 'azure', 'shared')
|
|function Get-SIRuleKinds {
|    <# The detection kinds the engine evaluates, read from its registry (the page never guesses). #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $p = Join-Path $SIRoot 'engine\asset-profiling\shared\RuleEval.ps1'
|    if (-not (Test-Path -LiteralPath $p)) { return @() }
|    $t = [System.IO.File]::ReadAllText($p)
|    $i = $t.IndexOf('$script:SIKindRegistry = @{'); if ($i -lt 0) { return @() }
|    $j = $t.IndexOf("`n}", $i)
|    @([regex]::Matches($t.Substring($i, $j - $i), "(?m)^\s*'([A-Za-z]+)'\s*=") | ForEach-Object { $_.Groups[1].Value })
|}
|
|function Get-SIRuleHeader {
|    <# PURE. The few fields the list shows, read from the text (no YAML round trip): id, mode, purpose, category, tiers set, page-created. #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text)
|    $f = { param($k) $m = [regex]::Match($Text, "(?m)^$k\s*:\s*(.+?)\s*$"); if ($m.Success) { $m.Groups[1].Value.Trim("'", '"', ' ') } else { '' } }
|    [pscustomobject]@{
|        Id = (& $f 'id'); Mode = (& $f 'mode'); Purpose = (& $f 'purpose'); Category = (& $f 'category')
|        Tiers = @([regex]::Matches($Text, '(?m)^\s*Tier\s*:\s*(\d+)') | ForEach-Object { [int]$_.Groups[1].Value } | Sort-Object -Unique)
|        PageCreated = $Text.TrimStart([char]0xFEFF).StartsWith($script:SIRuleMarker)
|    }
|}
|
|function Get-SIRuleView {
|    <#
|        Every rule by id: its shipped file, an in-tree custom file, an overlay custom file, which one the engine uses, and
|        whether the page may edit it. Paths are relative (to the solution, or to the overlay as 'overlay:...').
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$OverlayRoot)
|    $tree = Join-Path $SIRoot 'asset-profiling-enrichment'
|    $byId = [ordered]@{}
|    function _add($file, $base, $where) {
|        $rel = $file.FullName.Substring($base.Length).TrimStart('\', '/').Replace('/', '\')
|        $parts = $rel -split '\\'
|        $engine = $parts[0].ToLowerInvariant()
|        if ($script:SIRuleEngines -notcontains $engine) { return }
|        $relDir = if ($parts.Count -gt 2) { ($parts[1..($parts.Count - 2)] -join '\') } else { '' }
|        $text = [System.IO.File]::ReadAllText($file.FullName)
|        $h = Get-SIRuleHeader -Text $text
|        $id = if ($h.Id) { $h.Id } else { $file.Name -replace '\.(locked|custom)\.yaml$', '' }
|        $key = "$engine|$id"
|        if (-not $byId.Contains($key)) { $byId[$key] = [ordered]@{ id = $id; engine = $engine; relDir = $relDir; locked = $null; custom = $null; overlay = $null } }
|        $entry = [pscustomobject]@{ path = $(if ($where -eq 'overlay') { 'overlay:' + $rel } else { 'asset-profiling-enrichment\' + $rel }); mode = $h.Mode
|            purpose = $h.Purpose; category = $h.Category; tiers = $h.Tiers; pageCreated = $h.PageCreated; hash = (Get-SIFileHash -Path $file.FullName) }
|        $byId[$key][$where] = $entry
|        if (-not $byId[$key].relDir -and $relDir) { $byId[$key].relDir = $relDir }
|    }
|    foreach ($f in @(Get-ChildItem -LiteralPath $tree -Recurse -File -Filter '*.yaml' -ErrorAction SilentlyContinue)) {
|        if ($f.Name -like '*.locked.yaml') { _add $f $tree 'locked' } elseif ($f.Name -like '*.custom.yaml') { _add $f $tree 'custom' }
|    }
|    if ($OverlayRoot -and (Test-Path -LiteralPath $OverlayRoot)) {
|        foreach ($f in @(Get-ChildItem -LiteralPath $OverlayRoot -Recurse -File -Filter '*.custom.yaml' -ErrorAction SilentlyContinue)) { _add $f $OverlayRoot 'overlay' }
|    }
|    $rows = foreach ($k in $byId.Keys) {
|        $r = $byId[$k]
|        $eff = if ($r.overlay) { $r.overlay } elseif ($r.custom) { $r.custom } else { $r.locked }
|        $state = if (-not $r.locked) { 'added' } elseif ($eff -eq $r.locked) { 'shipped' } elseif ($eff.mode -eq 'disable') { 'turned off' } else { 'overridden' }
|        $show = if ($eff.mode -eq 'disable' -and $r.locked) { $r.locked } else { $eff }
|        [pscustomobject]@{ id = $r.id; engine = $r.engine; relDir = $r.relDir; state = $state
|            purpose = $show.purpose; category = $show.category; tiers = $show.tiers
|            locked = $r.locked; custom = $r.custom; overlay = $r.overlay; effective = $eff.path
|            editable = ($eff -ne $r.locked -and $eff.pageCreated) }
|    }
|    @($rows | Sort-Object engine, relDir, id)
|}
|
|function Get-SIRuleTargetPath {
|    <# Where the page writes a custom rule: the overlay when one is set, else beside the shipped rule. Id and folder are checked -- no path from the browser. #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$OverlayRoot, [Parameter(Mandatory)][string]$Engine, [AllowEmptyString()][string]$RelDir, [Parameter(Mandatory)][string]$Id)
|    if ($script:SIRuleEngines -notcontains $Engine) { throw "unknown rule engine '$Engine'" }
|    if ($Id -notmatch '^[A-Za-z][A-Za-z0-9_\-]{0,99}$') { throw "'$Id' is not a valid rule id (letters, digits, _ and -)" }
|    if ($RelDir -and $RelDir -notmatch '^[A-Za-z0-9_\-]+(\\[A-Za-z0-9_\-]+)*$') { throw "'$RelDir' is not a valid rule folder" }
|    $base = if ($OverlayRoot) { $OverlayRoot } else { Join-Path $SIRoot 'asset-profiling-enrichment' }
|    $dir = if ($RelDir) { Join-Path (Join-Path $base $Engine) $RelDir } else { Join-Path $base $Engine }
|    Join-Path $dir ('{0}.custom.yaml' -f $Id)
|}
|
|function New-SIRuleText {
|    <# PURE. The text the page writes: turn a shipped rule off, start an override from the shipped text, or a new rule. #>
|    param([Parameter(Mandatory)][ValidateSet('disable', 'override', 'add')][string]$Kind, [Parameter(Mandatory)][string]$Id,
|          [string]$Engine = 'endpoint', [AllowEmptyString()][string]$LockedText = '')
|    switch ($Kind) {
|        'disable'  { return ("{0} -- turns off the shipped rule {1}.`r`nid: {1}`r`nmode: disable`r`n" -f $script:SIRuleMarker, $Id) }
|        'override' {
|            $body = ($LockedText.TrimStart([char]0xFEFF) -replace '(?m)^mode:\s*\S+', 'mode: overwrite')
|            return ("{0} -- replaces the shipped rule {1}; edit below.`r`n{2}" -f $script:SIRuleMarker, $Id, $body)
|        }
|        'add' {
|            $applies = if ($Engine -eq 'shared') { 'any' } else { $Engine }
|            return (@(
|                "$($script:SIRuleMarker) -- a rule of this installation.",
|                "id: $Id", "appliesTo: $applies", 'mode: append', "purpose: 'Describe what this rule finds'", "category: 'Custom'", "description: ''",
|                '', 'detections:', "  - id: $Id", '    detect:', '      any:', '        - kind: nameMatches', '          namePatterns:', "            - '(?i)^example-'",
|                '    set:', '      Tier: 3', "      Purpose: 'Describe what this rule finds'", "      Category: 'Custom'", ''
|            ) -join "`r`n")
|        }
|    }
|}
|
|function Test-SIRuleText {
|    <# The reasons a rule text is not accepted (empty = accepted): it must parse, carry the expected id, and use only known kinds and tiers 0-3. #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text, [Parameter(Mandatory)][string]$Id, [Parameter(Mandatory)][string[]]$Kinds)
|    $why = New-Object System.Collections.Generic.List[string]
|    if (-not (Get-Command -Name ConvertFrom-SIYaml -ErrorAction SilentlyContinue)) {
|        . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-Yaml.ps1'))
|    }
|    $o = $null
|    try { $o = ConvertFrom-SIYaml -Yaml $Text -SourceName ('rule ' + $Id) } catch { $why.Add('the rule is not valid YAML: ' + $_.Exception.Message); return $why.ToArray() }
|    if ($o -isnot [System.Collections.IDictionary]) { $why.Add('the rule must be a YAML mapping'); return $why.ToArray() }
|    if ([string]$o['id'] -ne $Id) { $why.Add("the id must stay '$Id' -- it is what replaces the shipped rule") }
|    if ([string]$o['mode'] -eq 'disable') { return $why.ToArray() }
|    $ap = @($o['appliesTo'] | ForEach-Object { ([string]$_) -split '[,;]\s*' } | Where-Object { $_ })
|    foreach ($a in $ap) { if ($a.ToLowerInvariant() -notin 'endpoint', 'identity', 'azure', 'publicip', 'any') { $why.Add("appliesTo '$a' is not an engine") } }
|    $dets = @($o['detections'])
|    if ($dets.Count -eq 0 -or $null -eq $dets[0]) { $why.Add('a rule needs at least one detection'); return $why.ToArray() }
|    foreach ($d in $dets) {
|        $dt = $d['detect']
|        $list = if ($dt -and $dt['any']) { @($dt['any']) } elseif ($dt -and $dt['all']) { @($dt['all']) } else { @() }
|        if ($list.Count -eq 0) { $why.Add(("detection '{0}': detect needs an 'any' or 'all' list" -f $d['id'])) }
|        foreach ($k in $list) { if ($Kinds -notcontains [string]$k['kind']) { $why.Add(("detection '{0}': '{1}' is not a detection kind the engine knows" -f $d['id'], $k['kind'])) } }
|        $set = $d['set']
|        if ($set -and $null -ne $set['Tier']) { $n = 0; if (-not [int]::TryParse([string]$set['Tier'], [ref]$n) -or $n -lt 0 -or $n -gt 3) { $why.Add(("detection '{0}': Tier must be 0, 1, 2 or 3" -f $d['id'])) } }
|    }
|    $why.ToArray()
|}
|
|# #908: every shipped sample rule (*.custom.sample.yaml) starts with this header line. A live rule that still carries it
|# is the shipped EXAMPLE copied as it was -- on one install the IP-subnet sample (10.100.1.0/24 -> Tier 0, a "Domain
|# Controller") became a live rule that way. The web app keys on the same text (RuleEntry.IsShippedExample).
|$script:SIRuleSampleMarkerPattern = '(?m)^[ \t]*#[ \t]*SAMPLE[ \t]*/[ \t]*TEMPLATE\b'
|
|function Test-SIRuleSampleMarker {
|    <# PURE. $true when the rule text declares itself a shipped sample / template (the '# SAMPLE / TEMPLATE' header line). #>
|    param([AllowEmptyString()][AllowNull()][string]$Text)
|    if ([string]::IsNullOrEmpty($Text)) { return $false }
|    [regex]::IsMatch($Text, $script:SIRuleSampleMarkerPattern)
|}
|
|function Get-SIRuleSamplePath {
|    <#
|        The shipped sample a custom rule file was copied from: <rel>.custom.yaml -> asset-profiling-enrichment\<rel>.custom.sample.yaml,
|        for a file in the tree or in the overlay (whose paths are relative to the overlay root, engine first). $null when none.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][string]$Path, [string]$OverlayRoot)
|    $tree = Join-Path $SIRoot 'asset-profiling-enrichment'
|    $full = [System.IO.Path]::GetFullPath($Path)
|    $rel = $null
|    foreach ($base in @($tree, $OverlayRoot)) {
|        if (-not $base) { continue }
|        $b = [System.IO.Path]::GetFullPath($base).TrimEnd('\', '/') + [System.IO.Path]::DirectorySeparatorChar
|        if ($full.StartsWith($b, [StringComparison]::OrdinalIgnoreCase)) { $rel = $full.Substring($b.Length); break }
|    }
|    if (-not $rel -or $rel -notmatch '(?i)\.custom\.yaml$') { return $null }
|    $p = Join-Path $tree ($rel -replace '(?i)\.custom\.yaml$', '.custom.sample.yaml')
|    if (Test-Path -LiteralPath $p) { $p } else { $null }
|}
|
|function Get-SIRuleSampleReason {
|    <#
|        PURE (#908). Why a custom rule text must NOT become a live rule, or $null:
|          * it still carries the sample header ('# SAMPLE / TEMPLATE -- not loaded by the engine ...'), or
|          * it is the shipped sample unchanged (-SampleText; compared with all whitespace removed).
|        The importer refuses such a document and says so; the run only warns (it never drops a rule on suspicion).
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Text, [AllowEmptyString()][AllowNull()][string]$SampleText)
|    if ([string]::IsNullOrWhiteSpace($Text)) { return $null }
|    $squash = { param([string]$s) [regex]::Replace($s.TrimStart([char]0xFEFF), '\s+', '') }
|    if (-not [string]::IsNullOrWhiteSpace($SampleText) -and (& $squash $Text) -ceq (& $squash $SampleText)) {
|        return 'it is the shipped sample (.custom.sample.yaml) copied unchanged -- an example, not your rule. Edit it to describe your own assets (and remove the SAMPLE / TEMPLATE header), then import again'
|    }
|    if (Test-SIRuleSampleMarker -Text $Text) {
|        return "it still starts with the shipped sample's '# SAMPLE / TEMPLATE -- not loaded by the engine' header, so it is the example, not a reviewed rule. Check every detection (example names, subnets and tiers), remove that header line, then import again"
|    }
|    $null
|}
|
|function Invoke-SIRulePlan {
|    <#
|        Rule changes -> per-file diffs, nothing written. A change: @{ action = disable|override|add|edit|remove; id; engine; relDir; text }.
|          disable / override / add -- create the page's custom rule (refused if a custom rule for that id already exists);
|          edit   -- replace the text of a rule the page created;   remove -- take a page-created rule away (it is kept as a backup).
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$OverlayRoot, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Changes)
|    $view = @(Get-SIRuleView -SIRoot $SIRoot -OverlayRoot $OverlayRoot)
|    $kinds = @(Get-SIRuleKinds -SIRoot $SIRoot)
|    $refused = New-Object System.Collections.Generic.List[object]
|    $files = New-Object System.Collections.Generic.List[object]
|    foreach ($c in $Changes) {
|        $id = [string]$c.id; $engine = ([string]$c.engine).ToLowerInvariant(); $action = [string]$c.action
|        $name = "$engine/$id"
|        $row = $view | Where-Object { $_.id -eq $id -and $_.engine -eq $engine } | Select-Object -First 1
|        try {
|            $relDir = if ($row) { $row.relDir } else { [string]$c.relDir }
|            $target = Get-SIRuleTargetPath -SIRoot $SIRoot -OverlayRoot $OverlayRoot -Engine $engine -RelDir $relDir -Id $id
|        } catch { $refused.Add([pscustomobject]@{ name = $name; reason = $_.Exception.Message }); continue }
|        $own = if ($row) { if ($row.overlay) { $row.overlay } elseif ($row.custom) { $row.custom } } else { $null }
|        $old = ''; $new = $null; $path = $target
|        switch ($action) {
|            { $_ -in 'disable', 'override' } {
|                if (-not $row -or -not $row.locked) { $refused.Add([pscustomobject]@{ name = $name; reason = 'no shipped rule with that id' }); continue }
|                if ($own) { $refused.Add([pscustomobject]@{ name = $name; reason = 'this rule already has a custom version -- edit or remove that one' }); continue }
|                $lockedText = [System.IO.File]::ReadAllText((Join-Path $SIRoot $row.locked.path))
|                $new = New-SIRuleText -Kind $action -Id $id -Engine $engine -LockedText $lockedText
|            }
|            'add' {
|                if ($row) { $refused.Add([pscustomobject]@{ name = $name; reason = 'a rule with that id already exists' }); continue }
|                $new = if ($c.text) { [string]$c.text } else { New-SIRuleText -Kind add -Id $id -Engine $engine }
|            }
|            'edit' {
|                if (-not $own -or -not $own.pageCreated) { $refused.Add([pscustomobject]@{ name = $name; reason = 'only a rule this page created can be edited here -- edit a hand-written rule in its file' }); continue }
|                $path = if ($own.path -like 'overlay:*') { Join-Path $OverlayRoot $own.path.Substring(8) } else { Join-Path $SIRoot $own.path }
|                $old = [System.IO.File]::ReadAllText($path); $new = [string]$c.text
|                if (-not $new.TrimStart([char]0xFEFF).StartsWith($script:SIRuleMarker)) { $new = $script:SIRuleMarker + "`r`n" + $new }
|            }
|            'remove' {
|                if (-not $own -or -not $own.pageCreated) { $refused.Add([pscustomobject]@{ name = $name; reason = 'only a rule this page created can be removed here' }); continue }
|                $path = if ($own.path -like 'overlay:*') { Join-Path $OverlayRoot $own.path.Substring(8) } else { Join-Path $SIRoot $own.path }
|                $old = [System.IO.File]::ReadAllText($path); $new = ''
|            }
|            default { $refused.Add([pscustomobject]@{ name = $name; reason = "unknown action '$action'" }); continue }
|        }
|        if ($action -ne 'remove') {
|            $why = @(Test-SIRuleText -Text $new -Id $id -Kinds $kinds)
|            if ($why.Count) { $refused.Add([pscustomobject]@{ name = $name; reason = ($why -join '; ') }); continue }
|        }
|        $label = if ($OverlayRoot -and $path.StartsWith($OverlayRoot, [StringComparison]::OrdinalIgnoreCase)) { 'overlay:' + $path.Substring($OverlayRoot.Length).TrimStart('\', '/').Replace('/', '\') } else { $path.Substring($SIRoot.Length).TrimStart('\', '/').Replace('/', '\') }
|        $files.Add([pscustomobject]@{ key = $name; action = $action; path = $label; exists = (Test-Path -LiteralPath $path); hash = (Get-SIFileHash -Path $path)
|            diff = (Get-SITextDiff -Old $old -New $new -Label $label); FullPath = $path; NewText = $new })
|    }
|    [pscustomobject]@{ files = $files.ToArray(); refused = $refused.ToArray() }
|}
|
|function Invoke-SIRuleWrite {
|    <# Re-plans on the server; writes each rule only when its hash is the reviewed one; a removal keeps the file as a backup. Logged. #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$OverlayRoot, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Changes,
|          [Parameter(Mandatory)][hashtable]$Hashes, [string]$User = ('{0}\{1}' -f $env:USERDOMAIN, $env:USERNAME))
|    $plan = Invoke-SIRulePlan -SIRoot $SIRoot -OverlayRoot $OverlayRoot -Changes $Changes
|    if (@($plan.refused).Count) { return [pscustomobject]@{ written = @(); refused = $plan.refused; error = 'some changes were refused -- nothing was written' } }
|    foreach ($f in $plan.files) {
|        if (-not $Hashes.ContainsKey($f.key) -or [string]$Hashes[$f.key] -ne $f.hash) { return [pscustomobject]@{ written = @(); refused = @(); error = ('{0} changed since it was reviewed -- review again' -f $f.path) } }
|    }
|    $logDir = Join-Path $SIRoot 'logs'
|    if (-not (Test-Path -LiteralPath $logDir)) { New-Item -ItemType Directory -Path $logDir -Force | Out-Null }
|    $log = Join-Path $logDir 'settings-changes.log'
|    $written = New-Object System.Collections.Generic.List[object]
|    foreach ($f in $plan.files) {
|        $backup = $null
|        if ($f.action -eq 'remove') {
|            if ((Get-SIFileHash -Path $f.FullPath) -ne $f.hash) { throw ('{0} changed since it was reviewed' -f $f.path) }
|            $backup = '{0}.removed.{1}.bak' -f $f.FullPath, (Get-Date).ToString('yyyyMMdd-HHmmss')
|            [System.IO.File]::Move($f.FullPath, $backup)
|        } else {
|            $dir = Split-Path -Parent $f.FullPath
|            if (-not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null }
|            $w = Write-SISettingsFile -Path $f.FullPath -Text $f.NewText -ExpectedHash $f.hash -Bom $false
|            $backup = $w.Backup
|        }
|        $line = [ordered]@{ time = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ'); user = $User; file = $f.path; setting = $f.key; action = $f.action }
|        [System.IO.File]::AppendAllText($log, (($line | ConvertTo-Json -Compress) + "`r`n"), (New-Object System.Text.UTF8Encoding($false)))
|        $written.Add([pscustomobject]@{ key = $f.key; path = $f.path; backup = $backup })
|    }
|    [pscustomobject]@{ written = $written.ToArray(); refused = @(); error = $null }
|}
|
|function Invoke-SIRuleOverlayPlan {
|    <#
|        Setting up the rules folder outside the code tree: every in-tree *.custom.yaml moves there (same relative path),
|        and SI_EnrichmentDataRoot is set in the solution's custom file. Returns the moves and the config diff.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][string]$Target)
|    if (-not [System.IO.Path]::IsPathRooted($Target)) { throw 'the rules folder must be a full path' }
|    $full = [System.IO.Path]::GetFullPath($Target)
|    if ($full.StartsWith([System.IO.Path]::GetFullPath($SIRoot), [StringComparison]::OrdinalIgnoreCase)) { throw 'the rules folder must be outside the SecurityInsight folder -- an update replaces that folder' }
|    $tree = Join-Path $SIRoot 'asset-profiling-enrichment'
|    $moves = foreach ($f in @(Get-ChildItem -LiteralPath $tree -Recurse -File -Filter '*.custom.yaml' -ErrorAction SilentlyContinue)) {
|        $rel = $f.FullName.Substring($tree.Length).TrimStart('\', '/').Replace('/', '\')
|        [pscustomobject]@{ from = 'asset-profiling-enrichment\' + $rel; to = $rel; FromFull = $f.FullName; ToFull = (Join-Path $full $rel)
|            exists = (Test-Path -LiteralPath (Join-Path $full $rel)); hash = (Get-SIFileHash -Path $f.FullName) }
|    }
|    $cfg = Join-Path $SIRoot 'config\SecurityInsight.custom.ps1'
|    $r = Read-SISettingsText -Path $cfg
|    $ed = Edit-SIPs1Settings -Text $r.Text -Changes @(@{ Name = 'SI_EnrichmentDataRoot'; Action = 'Set'; Value = $full })
|    [pscustomobject]@{ target = $full; moves = @($moves); conflicts = @($moves | Where-Object exists | ForEach-Object to)
|        configDiff = (Get-SITextDiff -Old $r.Text -New $ed.Text -Label 'config\SecurityInsight.custom.ps1'); configHash = (Get-SIFileHash -Path $cfg); refused = $ed.Refused
|        ConfigText = $ed.Text; ConfigBom = $r.Bom; ConfigPath = $cfg }
|}
|
|function Invoke-SIRuleOverlayWrite {
|    <# Copies each rule, checks the copy is byte-identical, then keeps the in-tree original as <file>.moved.<time>.bak (out of the loader's reach) and sets SI_EnrichmentDataRoot. #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][string]$Target, [Parameter(Mandatory)][string]$ConfigHash, [string]$User = ('{0}\{1}' -f $env:USERDOMAIN, $env:USERNAME))
|    $p = Invoke-SIRuleOverlayPlan -SIRoot $SIRoot -Target $Target
|    if (@($p.refused).Count) { return [pscustomobject]@{ moved = @(); error = ('SI_EnrichmentDataRoot is set by code in the config file -- set it there: {0}' -f $p.refused[0].Reason) } }
|    if (@($p.conflicts).Count) { return [pscustomobject]@{ moved = @(); error = ('the rules folder already has: {0}' -f (@($p.conflicts) -join ', ')) } }
|    if ($p.configHash -ne $ConfigHash) { return [pscustomobject]@{ moved = @(); error = 'config\SecurityInsight.custom.ps1 changed since it was reviewed -- review again' } }
|    $stamp = (Get-Date).ToString('yyyyMMdd-HHmmss')
|    $moved = New-Object System.Collections.Generic.List[object]
|    foreach ($m in $p.moves) {
|        $dir = Split-Path -Parent $m.ToFull
|        if (-not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null }
|        [System.IO.File]::Copy($m.FromFull, $m.ToFull, $false)
|        if ((Get-SIFileHash -Path $m.ToFull) -ne $m.hash) { throw ('the copy of {0} is not identical -- stopped; nothing else was moved' -f $m.from) }
|        [System.IO.File]::Move($m.FromFull, ('{0}.moved.{1}.bak' -f $m.FromFull, $stamp))
|        $moved.Add([pscustomobject]@{ from = $m.from; to = $m.to })
|    }
|    if (-not (Test-Path -LiteralPath $p.target)) { New-Item -ItemType Directory -Path $p.target -Force | Out-Null }
|    $w = Write-SISettingsFile -Path $p.ConfigPath -Text $p.ConfigText -ExpectedHash $p.configHash -Bom $p.ConfigBom
|    $log = Join-Path (Join-Path $SIRoot 'logs') 'settings-changes.log'
|    if (-not (Test-Path -LiteralPath (Split-Path -Parent $log))) { New-Item -ItemType Directory -Path (Split-Path -Parent $log) -Force | Out-Null }
|    $line = [ordered]@{ time = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ'); user = $User; file = 'config\SecurityInsight.custom.ps1'; setting = 'SI_EnrichmentDataRoot'; action = 'Set'; new = $p.target; movedRules = $moved.Count }
|    [System.IO.File]::AppendAllText($log, (($line | ConvertTo-Json -Compress) + "`r`n"), (New-Object System.Text.UTF8Encoding($false)))
|    [pscustomobject]@{ moved = $moved.ToArray(); target = $p.target; configBackup = $w.Backup; error = $null }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-Yaml.ps1'] = @{ Sha256 = 'd131c52595f32fd6ff7e92ddbe17fa933d17c825acd5e2236fd18a1284993b04'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight's own YAML reader -- replaces the powershell-yaml module.
|
|    WHY. SecurityInsight v3 carries no PowerShell module dependencies. About 1,100 shipped YAML files
|    (tier rules, the Risk Analysis report catalogue, asset tagging, operator decisions) were read
|    with powershell-yaml's ConvertFrom-Yaml. This file reads them with plain PowerShell instead.
|
|    WHAT IT READS -- exactly the YAML subset the shipped files use (measured over every shipped
|    *.yaml, see docs/DESIGN.md "YAML reader"):
|      - block mappings and block sequences, including a sequence written at the same indentation as
|        its parent key, and "- key: value" maps inside a sequence
|      - flow sequences on one line:  [a, 'b c', 3]   (a trailing comma is allowed)
|      - plain scalars, also over several lines (folded with spaces, as YAML does)
|      - 'single-quoted' ('' escapes a quote) and "double-quoted" (backslash escapes) on one line
|      - literal and folded block scalars:  |  |-  >  >-   (KQL with | # : // inside is plain text)
|      - full-line and trailing comments, CRLF or LF line ends, a UTF-8 BOM, one leading ---
|    Anything else -- anchors, aliases, tags, flow mappings, multi-line quoted strings, |+ / >+,
|    explicit indentation indicators, more than one document, tab indentation, quoted keys,
|    duplicate keys -- is REFUSED with "<file>:<line>: <reason>". A rule file must never load as
|    something different from what its author wrote.
|
|    WHAT IT RETURNS -- the same shapes and types as powershell-yaml 0.4.12, so callers do not change:
|      mapping  -> [hashtable] (case-insensitive), or [ordered] with -Ordered
|      sequence -> [System.Collections.Generic.List[object]]
|      plain    -> [bool] / [int] / [long] / [BigInteger] / [decimal] / [double] / $null / [string],
|                  decided by the same .NET TryParse calls in the same order
|      quoted / block scalars -> [string]
|      an empty or comment-only text -> nothing ($null)
|    tests/pester/SIv3-SIYaml.Tests.ps1 proves this deep-equal against powershell-yaml on every
|    shipped file whenever that module is present.
|
|    PERFORMANCE. One function, one pass over the lines, explicit stacks instead of recursion, and
|    the number test only for plain values whose first character could start a number, a boolean or
|    a null. Measured against powershell-yaml in docs/TESTS.md.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|# NO script-scope variables either: callers dot-source this file from inside functions as well as
|# at file level, and a $script: value set in one place is not the one read in the other.
|
|function ConvertTo-SIYamlPlainValue {
|    <# The plain-scalar typing rule of powershell-yaml 0.4.12, call for call. #>
|    param([string]$Value)
|    $inv = [System.Globalization.CultureInfo]::InvariantCulture
|    $b = $false
|    if ([bool]::TryParse($Value, [ref]$b)) { return $b }
|    $bi = [System.Numerics.BigInteger]::Zero
|    if ([System.Numerics.BigInteger]::TryParse($Value, ([System.Globalization.NumberStyles]::Float -bor [System.Globalization.NumberStyles]::Integer), $inv, [ref]$bi)) {
|        $x = $bi -as [int];  if ($null -ne $x) { return $x }
|        $x = $bi -as [long]; if ($null -ne $x) { return $x }
|        return $bi
|    }
|    $d = [decimal]0
|    if ([decimal]::TryParse($Value, [System.Globalization.NumberStyles]::Float, $inv, [ref]$d)) { return $d }
|    $db = [double]0
|    if ([double]::TryParse($Value, [System.Globalization.NumberStyles]::Float, $inv, [ref]$db)) { return $db }
|    if ($Value -in '', '~', 'null', 'Null', 'NULL') { return $null }
|    return $Value
|}
|
|function ConvertFrom-SIYamlJsonValue {
|    <#
|        One value of a JSON document, in powershell-yaml's shapes. JSON is valid YAML, and SecurityInsight Pro
|        materialises its catalogues as JSON in *.yaml files. JSON strings are double-quoted YAML scalars, so they
|        stay strings; numbers / true / false / null are plain scalars, so they get the same typing as plain YAML.
|    #>
|    param($Value, [bool]$Ordered)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [string] -or $Value -is [bool]) { return $Value }
|    if ($Value -is [datetime]) { return $Value.ToString('o', [System.Globalization.CultureInfo]::InvariantCulture) }   # only a pwsh without -DateKind
|    if ($Value -is [System.Management.Automation.PSCustomObject]) {
|        $cmp = [System.StringComparer]::CurrentCultureIgnoreCase
|        $h = if ($Ordered) { [System.Collections.Specialized.OrderedDictionary]::new($cmp) } else { [hashtable]::new($cmp) }
|        foreach ($p in $Value.PSObject.Properties) { $h[$p.Name] = ConvertFrom-SIYamlJsonValue -Value $p.Value -Ordered $Ordered }
|        return $h
|    }
|    if ($Value -is [System.Collections.IEnumerable]) {
|        $l = [System.Collections.Generic.List[object]]::new()
|        foreach ($x in $Value) { $l.Add((ConvertFrom-SIYamlJsonValue -Value $x -Ordered $Ordered)) }
|        return , $l
|    }
|    return (ConvertTo-SIYamlPlainValue -Value ([System.Convert]::ToString($Value, [System.Globalization.CultureInfo]::InvariantCulture)))
|}
|
|function ConvertFrom-SIYamlDoubleQuoted {
|    <# Body of a one-line "double-quoted" scalar (without the quotes) -> string. #>
|    param([string]$Body, [string]$Where)
|    if ($Body.IndexOf([char]'\') -lt 0) { return $Body }
|    $sb = [System.Text.StringBuilder]::new()
|    $k = 0
|    while ($k -lt $Body.Length) {
|        $c = $Body[$k]
|        if ($c -ne [char]'\') { [void]$sb.Append($c); $k++; continue }
|        if ($k + 1 -ge $Body.Length) { throw ('{0}: a double-quoted string ends in a lone backslash' -f $Where) }
|        $e = $Body[$k + 1]; $k += 2
|        switch -CaseSensitive ([string]$e) {
|            '0'  { [void]$sb.Append([char]0) }
|            'a'  { [void]$sb.Append([char]7) }
|            'b'  { [void]$sb.Append([char]8) }
|            't'  { [void]$sb.Append([char]9) }
|            "`t" { [void]$sb.Append([char]9) }
|            'n'  { [void]$sb.Append([char]10) }
|            'v'  { [void]$sb.Append([char]11) }
|            'f'  { [void]$sb.Append([char]12) }
|            'r'  { [void]$sb.Append([char]13) }
|            'e'  { [void]$sb.Append([char]27) }
|            ' '  { [void]$sb.Append(' ') }
|            '"'  { [void]$sb.Append('"') }
|            '/'  { [void]$sb.Append('/') }
|            '\'  { [void]$sb.Append('\') }
|            'N'  { [void]$sb.Append([char]0x85) }
|            '_'  { [void]$sb.Append([char]0xA0) }
|            'L'  { [void]$sb.Append([char]0x2028) }
|            'P'  { [void]$sb.Append([char]0x2029) }
|            { $_ -ceq 'x' -or $_ -ceq 'u' -or $_ -ceq 'U' } {
|                $len = if ($e -ceq 'x') { 2 } elseif ($e -ceq 'u') { 4 } else { 8 }
|                $hex = if ($k + $len -le $Body.Length) { $Body.Substring($k, $len) } else { '' }
|                if ($hex -notmatch '^[0-9A-Fa-f]+$' -or $hex.Length -ne $len) { throw ('{0}: a double-quoted string has a bad \{1} escape' -f $Where, $e) }
|                [void]$sb.Append([char]::ConvertFromUtf32([Convert]::ToInt32($hex, 16)))
|                $k += $len
|            }
|            default { throw ('{0}: a double-quoted string uses the unknown escape \{1}' -f $Where, $e) }
|        }
|    }
|    return $sb.ToString()
|}
|
|function ConvertFrom-SIYaml {
|    <#
|    .SYNOPSIS
|        Read SecurityInsight YAML into hashtables / lists / scalars -- the drop-in for powershell-yaml's
|        ConvertFrom-Yaml, for the YAML subset SecurityInsight's files use.
|    .PARAMETER Yaml
|        The YAML text. Pipeline input is joined with line breaks, as ConvertFrom-Yaml does.
|    .PARAMETER Path
|        Read this file (UTF-8) instead; its path is named in every error.
|    .PARAMETER SourceName
|        The name errors cite for -Yaml text (a file path, usually). Default '<yaml>'.
|    .PARAMETER Ordered
|        Mappings become [ordered] dictionaries (key order kept), as ConvertFrom-Yaml -Ordered.
|    #>
|    [CmdletBinding(DefaultParameterSetName = 'Text')]
|    param(
|        [Parameter(ParameterSetName = 'Text', Position = 0, ValueFromPipeline = $true)]
|        [AllowEmptyString()][AllowNull()]
|        [string]$Yaml,
|        [Parameter(ParameterSetName = 'Path', Mandatory = $true)]
|        [string]$Path,
|        [string]$SourceName,
|        [switch]$Ordered
|    )
|    begin { $text = $null }
|    process {
|        # Pipeline pieces are joined with line breaks, as ConvertFrom-Yaml does.
|        if ($null -ne $Yaml) { if ($null -eq $text) { $text = $Yaml + "`n" } else { $text = $text + $Yaml + "`n" } }
|    }
|    end {
|        if ($Path) {
|            $text = [System.IO.File]::ReadAllText($Path)
|            if ([string]::IsNullOrEmpty($SourceName)) { $SourceName = $Path }
|        } elseif ($null -eq $text) { return }
|        if ([string]::IsNullOrEmpty($SourceName)) { $SourceName = '<yaml>' }
|        $result = ConvertFrom-SIYamlText -Text $text -Source $SourceName -Ordered:$Ordered
|        if ($result -is [System.Collections.Generic.List[object]]) { return , $result }
|        return $result
|    }
|}
|
|function ConvertFrom-SIYamlText {
|    <#
|        The parser. One pass over the lines, explicit stacks instead of recursion. Internal: call
|        ConvertFrom-SIYaml. Written for speed on PowerShell 5.1: no function calls on the common
|        paths, ordinal string searches (the culture-aware overloads cost ~10x), characters and
|        comparers held in locals.
|    #>
|    param([string]$Text, [string]$Source, [switch]$Ordered)
|
|    if ($Text.Length -gt 0 -and $Text[0] -eq [char]0xFEFF) { $Text = $Text.Substring(1) }
|    # A JSON document (SecurityInsight Pro writes its materialised catalogues as JSON, which is YAML).
|    $first = $Text.TrimStart()
|    if ($first.Length -gt 0 -and ($first[0] -eq [char]'{' -or $first[0] -eq [char]'[')) {
|        $cj = Get-Command -Name ConvertFrom-Json
|        $ja = @{ InputObject = $Text; ErrorAction = 'Stop' }
|        if ($cj.Parameters.ContainsKey('DateKind')) { $ja['DateKind'] = 'String' }
|        if ($cj.Parameters.ContainsKey('Depth')) { $ja['Depth'] = 1024 }
|        if ($cj.Parameters.ContainsKey('NoEnumerate')) { $ja['NoEnumerate'] = $true }   # a one-item top-level array stays an array
|        try { $doc = ConvertFrom-Json @ja }
|        catch { throw ('{0}:1: the document starts with "{1}" but is not valid JSON (YAML flow style is only read as JSON): {2}' -f $Source, $first[0], $_.Exception.Message) }
|        $r = ConvertFrom-SIYamlJsonValue -Value $doc -Ordered ([bool]$Ordered)
|        if ($r -is [System.Collections.Generic.List[object]]) { return , $r }
|        return $r
|    }
|    $lines = $Text.Replace("`r`n", "`n").Split([char]"`n")
|    $n = $lines.Length
|    $useOrdered = [bool]$Ordered
|    # First characters a plain value needs to become anything but a string: digits, sign, dot (numbers),
|    # t/f (true/false), n/N (null, NaN), i/I (Infinity), ~ (null).
|    $typedFirst = '0123456789+-.tTfFnNiI~'
|    $inv = [System.Globalization.CultureInfo]::InvariantCulture
|    $ORD = [System.StringComparison]::Ordinal
|    # The comparer PowerShell gives @{} and [ordered]@{} -- so these are the same dictionaries.
|    $cmp = [System.StringComparer]::CurrentCultureIgnoreCase
|    $SP = [char]' '; $TAB = [char]"`t"; $HASH = [char]'#'; $DASH = [char]'-'; $COLON = [char]':'
|    $SQ = [char]"'"; $DQ = [char]'"'; $LB = [char]'['; $RB = [char]']'; $LC = [char]'{'
|    $PIPE = [char]'|'; $GT = [char]'>'; $BS = [char]'\'; $COMMA = [char]','; $CR = [char]"`r"
|    $SPTAB = [char[]]@(' ', "`t")
|    $keyBad   = '[{&*!|>@`?:,]}'
|    $plainBad = '{]},&*!%@`'
|    $flowBad  = '#&*!|>%@`'
|    # Only these plain values can come out as anything but a string (bool / number / null), so only
|    # these go through the full replica of powershell-yaml's typing; the rest stay strings untouched.
|    # .NET's number parsing (Float | Integer, invariant) accepts nothing outside [0-9.eE+-] apart from
|    # the NaN / Infinity words; bool.TryParse accepts true/false in any case; null is ~ / null.
|    $numLike  = '^[0-9.eE+\-]+$'
|    $wordLike = '^[+-]?(true|false|null|nan|infinity|~)$'
|
|    # Frame stacks: indentation, kind (1 = mapping, 2 = sequence), container.
|    $fInd  = [System.Collections.Generic.List[int]]::new()
|    $fKind = [System.Collections.Generic.List[int]]::new()
|    $fObj  = [System.Collections.Generic.List[object]]::new()
|
|    $root = $null; $rootSet = $false; $sawDocStart = $false
|    # A slot waiting for its value from the following lines: 1 = mapping key, 2 = sequence item.
|    $pend = 0; $pObj = $null; $pKey = $null; $pInd = -1
|
|    $i = 0
|    while ($i -lt $n) {
|        $line = $lines[$i]
|        $t = $line.TrimStart($SP)
|        $tl = $t.Length
|        if ($tl -eq 0) { $i++; continue }
|        $c0 = $t[0]
|        if ($c0 -eq $HASH) { $i++; continue }
|        if ($c0 -eq $TAB -or $c0 -eq $CR) {
|            if ($t.Trim().Length -eq 0) { $i++; continue }
|            throw ('{0}:{1}: a tab is used for indentation (YAML allows spaces only)' -f $Source, ($i + 1))
|        }
|        $ind = $line.Length - $tl
|        $ln = $i + 1
|        $last = $t[$tl - 1]
|        if ($last -eq $SP -or $last -eq $TAB -or $last -eq $CR) { $t = $t.TrimEnd(); $tl = $t.Length }
|
|        $isSeq = $false
|        if ($c0 -eq $DASH) {
|            if ($tl -eq 1 -or $t[1] -eq $SP) { $isSeq = $true }
|            elseif ($ind -eq 0 -and $t.StartsWith('---', $ORD) -and ($tl -eq 3 -or $t[3] -eq $SP)) {
|                if ($rootSet -or $sawDocStart) { throw ('{0}:{1}: more than one YAML document in one file is not supported' -f $Source, $ln) }
|                if ($tl -gt 3 -and $t.Substring(3).TrimStart()[0] -ne $HASH) { throw ('{0}:{1}: content on the --- line is not supported' -f $Source, $ln) }
|                $sawDocStart = $true; $i++; continue
|            }
|        } elseif ($c0 -eq [char]'.' -and $ind -eq 0 -and $t.StartsWith('...', $ORD)) {
|            throw ('{0}:{1}: a YAML document end marker (...) is not supported' -f $Source, $ln)
|        } elseif ($c0 -eq [char]'%') {
|            throw ('{0}:{1}: YAML directives (%) are not supported' -f $Source, $ln)
|        }
|
|        # ---- where does this line's value go? -------------------------------------------------
|        $slot = 0; $sObj = $null; $sKey = $null; $vt = $null; $vp = 0
|
|        if ($pend -ne 0) {
|            $newObj = $null; $newKind = 0
|            if ($isSeq -and ($ind -gt $pInd -or ($ind -eq $pInd -and $pend -eq 1))) {
|                $newObj = [System.Collections.Generic.List[object]]::new(); $newKind = 2
|            } elseif ($ind -gt $pInd) {
|                # A mapping key on this line, or a scalar value written on its own line?
|                $isKey = $false
|                if ($c0 -ne $SQ -and $c0 -ne $DQ -and $c0 -ne $LB -and $c0 -ne $LC -and $c0 -ne $PIPE -and $c0 -ne $GT) {
|                    $ci = $t.IndexOf(': ', $ORD)
|                    if ($ci -lt 0 -and $t[$tl - 1] -eq $COLON) { $ci = $tl - 1 }
|                    if ($ci -gt 0) { $hi = $t.IndexOf(' #', $ORD); if ($hi -lt 0 -or $hi -gt $ci) { $isKey = $true } }
|                }
|                if ($isKey) {
|                    if ($useOrdered) { $newObj = [System.Collections.Specialized.OrderedDictionary]::new($cmp) } else { $newObj = [hashtable]::new($cmp) }
|                    $newKind = 1
|                } else {
|                    $slot = $pend; $sObj = $pObj; $sKey = $pKey; $vt = $t; $vp = $pInd
|                }
|            }
|            if ($slot -eq 0) {
|                if ($pend -eq 1) { $pObj[$pKey] = $newObj } else { $pObj.Add($newObj) }
|                if ($newKind -ne 0) { $fInd.Add($ind); $fKind.Add($newKind); $fObj.Add($newObj) }
|            }
|            $pend = 0
|        }
|
|        if ($slot -eq 0) {
|            if ($fInd.Count -eq 0) {
|                if ($rootSet) { throw ('{0}:{1}: this line is outside the document (indented less than its first line)' -f $Source, $ln) }
|                $rootSet = $true
|                if ($isSeq) { $root = [System.Collections.Generic.List[object]]::new(); $rk = 2 }
|                else {
|                    if ($useOrdered) { $root = [System.Collections.Specialized.OrderedDictionary]::new($cmp) } else { $root = [hashtable]::new($cmp) }
|                    $rk = 1
|                }
|                $fInd.Add($ind); $fKind.Add($rk); $fObj.Add($root)
|            }
|            $top = $fInd.Count - 1
|            while ($top -ge 0 -and $fInd[$top] -gt $ind) { $fInd.RemoveAt($top); $fKind.RemoveAt($top); $fObj.RemoveAt($top); $top-- }
|            if ($top -ge 0 -and -not $isSeq -and $fInd[$top] -eq $ind -and $fKind[$top] -eq 2) {
|                # the end of a sequence written at the same indentation as its parent key
|                $fInd.RemoveAt($top); $fKind.RemoveAt($top); $fObj.RemoveAt($top); $top--
|            }
|            if ($top -lt 0 -or $fInd[$top] -ne $ind) { throw ('{0}:{1}: the indentation of this line does not match any open mapping or sequence' -f $Source, $ln) }
|
|            $mapText = $null
|            if ($fKind[$top] -eq 2) {
|                if (-not $isSeq) { throw ('{0}:{1}: expected a "- item" line in this sequence' -f $Source, $ln) }
|                $seqObj = $fObj[$top]
|                $rest = if ($tl -gt 2) { $t.Substring(2).TrimStart($SP) } else { '' }
|                $rl = $rest.Length
|                if ($rl -eq 0 -or $rest[0] -eq $HASH) {
|                    $pend = 2; $pObj = $seqObj; $pKey = $null; $pInd = $ind
|                    $i++; continue
|                }
|                $r0 = $rest[0]
|                if ($r0 -eq $DASH -and ($rl -eq 1 -or $rest[1] -eq $SP)) { throw ('{0}:{1}: a sequence written directly inside a sequence item ("- - x") is not supported' -f $Source, $ln) }
|                $isKey = $false
|                if ($r0 -ne $SQ -and $r0 -ne $DQ -and $r0 -ne $LB -and $r0 -ne $LC -and $r0 -ne $PIPE -and $r0 -ne $GT) {
|                    $ci = $rest.IndexOf(': ', $ORD)
|                    if ($ci -lt 0 -and $rest[$rl - 1] -eq $COLON) { $ci = $rl - 1 }
|                    if ($ci -gt 0) { $hi = $rest.IndexOf(' #', $ORD); if ($hi -lt 0 -or $hi -gt $ci) { $isKey = $true } }
|                } elseif ($r0 -eq $SQ -or $r0 -eq $DQ) {
|                    $q = $rest.IndexOf($r0, 1)
|                    if ($q -gt 0 -and $rl -gt $q + 1 -and $rest[$q + 1] -eq $COLON) { throw ('{0}:{1}: quoted mapping keys are not supported' -f $Source, $ln) }
|                }
|                if ($isKey) {
|                    if ($useOrdered) { $mapObj = [System.Collections.Specialized.OrderedDictionary]::new($cmp) } else { $mapObj = [hashtable]::new($cmp) }
|                    $seqObj.Add($mapObj)
|                    $mapInd = $ind + ($tl - $rl)
|                    $fInd.Add($mapInd); $fKind.Add(1); $fObj.Add($mapObj)
|                    $mapText = $rest
|                } else {
|                    $slot = 2; $sObj = $seqObj; $vt = $rest; $vp = $ind
|                }
|            } else {
|                if ($isSeq) { throw ('{0}:{1}: a "- item" line where a "key: value" line was expected' -f $Source, $ln) }
|                $mapObj = $fObj[$top]; $mapInd = $ind; $mapText = $t
|            }
|
|            if ($null -ne $mapText) {
|                # ---- key: value ----
|                $m0 = $mapText[0]
|                $ml = $mapText.Length
|                if ($m0 -eq $SQ -or $m0 -eq $DQ) { throw ('{0}:{1}: quoted mapping keys are not supported' -f $Source, $ln) }
|                if ($keyBad.IndexOf($m0) -ge 0) { throw ('{0}:{1}: this line is not a "key: value" line (it starts with "{2}")' -f $Source, $ln, $m0) }
|                $ci = $mapText.IndexOf(': ', $ORD)
|                if ($ci -lt 0 -and $mapText[$ml - 1] -eq $COLON) { $ci = $ml - 1 }
|                if ($ci -le 0) { throw ('{0}:{1}: expected "key: value" (a colon followed by a space)' -f $Source, $ln) }
|                $hi = $mapText.IndexOf(' #', 0, $ci, $ORD)
|                if ($hi -ge 0) { throw ('{0}:{1}: expected "key: value" (a colon followed by a space)' -f $Source, $ln) }
|                $key = $mapText.Substring(0, $ci)
|                if ($key[$ci - 1] -eq $SP -or $key[$ci - 1] -eq $TAB) { $key = $key.TrimEnd() }
|                if ($mapObj.Contains($key)) {
|                    foreach ($ek in @($mapObj.Keys)) {
|                        if ([string]::Equals([string]$ek, $key, $ORD)) { throw ('{0}:{1}: duplicate key "{2}"' -f $Source, $ln, $key) }
|                    }
|                }
|                $after = if ($ci + 2 -lt $ml) { $mapText.Substring($ci + 2).TrimStart($SP) } else { '' }
|                if ($after.Length -eq 0 -or $after[0] -eq $HASH) {
|                    $mapObj[$key] = $null
|                    $pend = 1; $pObj = $mapObj; $pKey = $key; $pInd = $mapInd
|                    $i++; continue
|                }
|                $slot = 1; $sObj = $mapObj; $sKey = $key; $vt = $after; $vp = $mapInd
|            }
|        }
|
|        # ---- the value text $vt (first line), its parent indentation $vp ----------------------------
|        $v0 = $vt[0]
|        $vl = $vt.Length
|        $val = $null
|        if ($v0 -eq $SQ) {
|            $k = 1; $closed = -1
|            while ($k -lt $vl) {
|                $q = $vt.IndexOf($SQ, $k)
|                if ($q -lt 0) { break }
|                if ($q + 1 -lt $vl -and $vt[$q + 1] -eq $SQ) { $k = $q + 2; continue }
|                $closed = $q; break
|            }
|            if ($closed -lt 0) { throw ('{0}:{1}: a single-quoted string must end on the same line' -f $Source, $ln) }
|            $val = $vt.Substring(1, $closed - 1)
|            if ($val.IndexOf($SQ) -ge 0) { $val = $val.Replace("''", "'") }
|            if ($closed + 1 -lt $vl) {
|                $tail = $vt.Substring($closed + 1); $tt = $tail.TrimStart($SPTAB)
|                if ($tt.Length -gt 0 -and ($tt[0] -ne $HASH -or $tt.Length -eq $tail.Length)) { throw ('{0}:{1}: unexpected text after a quoted string' -f $Source, $ln) }
|            }
|        } elseif ($v0 -eq $DQ) {
|            $k = 1; $closed = -1
|            while ($k -lt $vl) {
|                $ch = $vt[$k]
|                if ($ch -eq $BS) { $k += 2; continue }
|                if ($ch -eq $DQ) { $closed = $k; break }
|                $k++
|            }
|            if ($closed -lt 0) { throw ('{0}:{1}: a double-quoted string must end on the same line' -f $Source, $ln) }
|            $val = $vt.Substring(1, $closed - 1)
|            if ($val.IndexOf($BS) -ge 0) { $val = ConvertFrom-SIYamlDoubleQuoted -Body $val -Where ('{0}:{1}' -f $Source, $ln) }
|            if ($closed + 1 -lt $vl) {
|                $tail = $vt.Substring($closed + 1); $tt = $tail.TrimStart($SPTAB)
|                if ($tt.Length -gt 0 -and ($tt[0] -ne $HASH -or $tt.Length -eq $tail.Length)) { throw ('{0}:{1}: unexpected text after a quoted string' -f $Source, $ln) }
|            }
|        } elseif ($v0 -eq $LB) {
|            $val = [System.Collections.Generic.List[object]]::new()
|            $k = 1; $closed = $false; $needItem = $true
|            while ($k -lt $vl) {
|                $ch = $vt[$k]
|                if ($ch -eq $SP -or $ch -eq $TAB) { $k++; continue }
|                if ($ch -eq $RB) { $closed = $true; $k++; break }
|                if ($ch -eq $COMMA) {
|                    if ($needItem) { throw ('{0}:{1}: an empty item in a [ ] list' -f $Source, $ln) }
|                    $needItem = $true; $k++; continue
|                }
|                if (-not $needItem) { throw ('{0}:{1}: a comma is missing between items of a [ ] list' -f $Source, $ln) }
|                if ($ch -eq $LB -or $ch -eq $LC) { throw ('{0}:{1}: nested [ ] / {{ }} inside a [ ] list are not supported' -f $Source, $ln) }
|                if ($ch -eq $SQ) {
|                    $s = $k + 1; $e = -1
|                    while ($s -lt $vl) {
|                        $q = $vt.IndexOf($SQ, $s)
|                        if ($q -lt 0) { break }
|                        if ($q + 1 -lt $vl -and $vt[$q + 1] -eq $SQ) { $s = $q + 2; continue }
|                        $e = $q; break
|                    }
|                    if ($e -lt 0) { throw ('{0}:{1}: a quoted item in a [ ] list is not closed on the same line' -f $Source, $ln) }
|                    $val.Add($vt.Substring($k + 1, $e - $k - 1).Replace("''", "'")); $k = $e + 1
|                } elseif ($ch -eq $DQ) {
|                    $s = $k + 1; $e = -1
|                    while ($s -lt $vl) { $cc = $vt[$s]; if ($cc -eq $BS) { $s += 2; continue }; if ($cc -eq $DQ) { $e = $s; break }; $s++ }
|                    if ($e -lt 0) { throw ('{0}:{1}: a quoted item in a [ ] list is not closed on the same line' -f $Source, $ln) }
|                    $val.Add((ConvertFrom-SIYamlDoubleQuoted -Body $vt.Substring($k + 1, $e - $k - 1) -Where ('{0}:{1}' -f $Source, $ln))); $k = $e + 1
|                } else {
|                    if ($flowBad.IndexOf($ch) -ge 0) { throw ('{0}:{1}: a [ ] list item starts with "{2}", which is not supported' -f $Source, $ln, $ch) }
|                    $s = $k
|                    while ($k -lt $vl -and $vt[$k] -ne $COMMA -and $vt[$k] -ne $RB) { $k++ }
|                    $item = $vt.Substring($s, $k - $s).TrimEnd($SPTAB)
|                    if ($item.IndexOf(': ', $ORD) -ge 0 -or $item[$item.Length - 1] -eq $COLON -or $item.IndexOf(' #', $ORD) -ge 0 -or $item.IndexOf($LB) -ge 0 -or $item.IndexOf($LC) -ge 0) {
|                        throw ('{0}:{1}: a [ ] list item "{2}" is not a plain value' -f $Source, $ln, $item)
|                    }
|                    if ($typedFirst.IndexOf($item[0]) -lt 0) { $val.Add($item) }
|                    elseif ($item.Length -le 9 -and $item -cmatch '^[0-9]+$') { $val.Add([int]::Parse($item, $inv)) }
|                    elseif ($item -cmatch $numLike -or $item -match $wordLike) { $val.Add((ConvertTo-SIYamlPlainValue -Value $item)) }
|                    else { $val.Add($item) }
|                }
|                $needItem = $false
|            }
|            if (-not $closed) { throw ('{0}:{1}: a [ ] list must end on the same line' -f $Source, $ln) }
|            if ($k -lt $vl) {
|                $tail = $vt.Substring($k); $tt = $tail.TrimStart($SPTAB)
|                if ($tt.Length -gt 0 -and ($tt[0] -ne $HASH -or $tt.Length -eq $tail.Length)) { throw ('{0}:{1}: unexpected text after a [ ] list' -f $Source, $ln) }
|            }
|        } elseif ($v0 -eq $PIPE -or $v0 -eq $GT) {
|            # ---- block scalar ----
|            $hdr = $vt
|            $hc = $hdr.IndexOf($HASH)
|            if ($hc -ge 0) {
|                if ($hc -eq 0 -or ($hdr[$hc - 1] -ne $SP -and $hdr[$hc - 1] -ne $TAB)) { throw ('{0}:{1}: unexpected text after a block scalar indicator' -f $Source, $ln) }
|                $hdr = $hdr.Substring(0, $hc).TrimEnd()
|            }
|            $strip = $false
|            if ($hdr.Length -eq 2 -and $hdr[1] -eq $DASH) { $strip = $true }
|            elseif ($hdr.Length -ne 1) { throw ('{0}:{1}: block scalar header "{2}" is not supported (use | |- > >-)' -f $Source, $ln, $hdr) }
|            $folded = ($v0 -eq $GT)
|            # List[object], not List[string]: PowerShell turns $null into '' on the way into a string list,
|            # and $null is how an empty line is told apart from content.
|            $buf = [System.Collections.Generic.List[object]]::new()
|            $mi = -1; $j = $i + 1
|            while ($j -lt $n) {
|                $l = $lines[$j]
|                $lt = $l.TrimStart($SP)
|                if ($lt.Length -eq 0) {
|                    if ($mi -ge 0 -and $l.Length -gt $mi) { $buf.Add($l.Substring($mi)) } else { $buf.Add($null) }
|                    $j++; continue
|                }
|                $li = $l.Length - $lt.Length
|                if ($mi -lt 0) {
|                    if ($li -le $vp) { break }
|                    if ($lt[0] -eq $TAB) { throw ('{0}:{1}: a tab is used for indentation (YAML allows spaces only)' -f $Source, ($j + 1)) }
|                    $mi = $li
|                } elseif ($li -lt $mi) { break }
|                $buf.Add($l.Substring($mi)); $j++
|            }
|            # $null entries are empty lines. Trailing empty lines are dropped (clip / strip).
|            $lastC = $buf.Count - 1
|            while ($lastC -ge 0 -and $null -eq $buf[$lastC]) { $lastC-- }
|            if ($lastC -lt 0) { $val = '' }
|            else {
|                $sb = [System.Text.StringBuilder]::new()
|                if (-not $folded) {
|                    for ($x = 0; $x -le $lastC; $x++) {
|                        if ($x -gt 0) { [void]$sb.Append("`n") }
|                        if ($null -ne $buf[$x]) { [void]$sb.Append($buf[$x]) }
|                    }
|                } else {
|                    # Folding: a line break between two ordinary lines becomes a space; N empty lines
|                    # become N line breaks; around a more-indented line the break is kept.
|                    $x = 0
|                    while ($x -le $lastC -and $null -eq $buf[$x]) { [void]$sb.Append("`n"); $x++ }
|                    $prev = $buf[$x]; [void]$sb.Append($prev); $x++
|                    while ($x -le $lastC) {
|                        $empties = 0
|                        while ($null -eq $buf[$x]) { $empties++; $x++ }
|                        $cur = $buf[$x]
|                        $spaced = ($prev.Length -gt 0 -and ($prev[0] -eq $SP -or $prev[0] -eq $TAB)) -or
|                                  ($cur.Length -gt 0 -and ($cur[0] -eq $SP -or $cur[0] -eq $TAB))
|                        if ($spaced) { [void]$sb.Append("`n"); if ($empties -gt 0) { [void]$sb.Append("`n" * $empties) } }
|                        elseif ($empties -eq 0) { [void]$sb.Append(' ') }
|                        else { [void]$sb.Append("`n" * $empties) }
|                        [void]$sb.Append($cur); $prev = $cur; $x++
|                    }
|                }
|                if (-not $strip) { [void]$sb.Append("`n") }
|                $val = $sb.ToString()
|            }
|            $i = $j - 1
|        } else {
|            # ---- plain scalar ----
|            if ($plainBad.IndexOf($v0) -ge 0) { throw ('{0}:{1}: a value starting with "{2}" is not supported (anchors, aliases, tags and {{ }} maps are not used by SecurityInsight)' -f $Source, $ln, $v0) }
|            if (($v0 -eq $DASH -or $v0 -eq [char]'?' -or $v0 -eq $COLON) -and ($vl -eq 1 -or $vt[1] -eq $SP)) {
|                throw ('{0}:{1}: a value cannot start with "{2} " here' -f $Source, $ln, $v0)
|            }
|            $ended = $false
|            $hi = $vt.IndexOf(' #', $ORD)
|            if ($vt.IndexOf($TAB) -ge 0) { $ti = $vt.IndexOf("`t#", $ORD); if ($ti -ge 0 -and ($hi -lt 0 -or $ti -lt $hi)) { $hi = $ti } }
|            if ($hi -ge 0) { $pv = $vt.Substring(0, $hi).TrimEnd($SPTAB); $ended = $true } else { $pv = $vt }
|            if ($pv.IndexOf($COLON) -ge 0 -and ($pv.IndexOf(': ', $ORD) -ge 0 -or $pv[$pv.Length - 1] -eq $COLON -or $pv.IndexOf(":`t", $ORD) -ge 0)) {
|                throw ('{0}:{1}: a plain value contains ": " -- quote it' -f $Source, $ln)
|            }
|            if (-not $ended) {
|                # continuation lines: more indented than the parent, until a comment or a less-indented line
|                $j = $i + 1; $empt = 0; $sb = $null; $lastJ = $i
|                while ($j -lt $n) {
|                    $l = $lines[$j]
|                    $lt = $l.TrimStart($SP)
|                    if ($lt.Length -eq 0) { $empt++; $j++; continue }
|                    $li = $l.Length - $lt.Length
|                    if ($li -le $vp) { break }
|                    $ct = $lt.Trim()
|                    if ($ct.Length -eq 0) { $empt++; $j++; continue }
|                    if ($ct[0] -eq $HASH) { break }
|                    $hi = $ct.IndexOf(' #', $ORD); $ti = $ct.IndexOf("`t#", $ORD)
|                    if ($ti -ge 0 -and ($hi -lt 0 -or $ti -lt $hi)) { $hi = $ti }
|                    $stop = $false
|                    if ($hi -ge 0) { $ct = $ct.Substring(0, $hi).TrimEnd($SPTAB); $stop = $true }
|                    if ($ct.IndexOf(': ', $ORD) -ge 0 -or $ct[$ct.Length - 1] -eq $COLON -or $ct.IndexOf(":`t", $ORD) -ge 0) {
|                        throw ('{0}:{1}: this line continues a plain value but contains ": " (a key indented too far, or a value that needs quotes)' -f $Source, ($j + 1))
|                    }
|                    if ($null -eq $sb) { $sb = [System.Text.StringBuilder]::new(); [void]$sb.Append($pv) }
|                    if ($empt -eq 0) { [void]$sb.Append(' ') } else { [void]$sb.Append("`n" * $empt) }
|                    [void]$sb.Append($ct)
|                    $empt = 0; $lastJ = $j; $j++
|                    if ($stop) { break }
|                }
|                if ($null -ne $sb) { $pv = $sb.ToString() }
|                $i = $lastJ
|            }
|            # Typing, as powershell-yaml does it. Common cases inline (a function call costs more than
|            # the rest of the line); everything else through the call-for-call replica.
|            if ($typedFirst.IndexOf($pv[0]) -lt 0) { $val = $pv }
|            elseif ($pv.Length -le 9 -and $pv -cmatch '^[0-9]+$') { $val = [int]::Parse($pv, $inv) }
|            elseif ($pv -cmatch $numLike -or $pv -match $wordLike) { $val = ConvertTo-SIYamlPlainValue -Value $pv }
|            else { $val = $pv }
|        }
|
|        if ($slot -eq 1) { $sObj[$sKey] = $val } else { $sObj.Add($val) }
|        $i++
|    }
|
|    # A "- " item with nothing after it at the end of the text is a null item (a "key:" was set to null already).
|    if ($pend -eq 2) { $pObj.Add($null) }
|    if (-not $rootSet) { return $null }
|    if ($root -is [System.Collections.Generic.List[object]]) { return , $root }
|    return $root
|}
'@ }
$__siSupportFiles['config/settings.catalog.locked.json'] = @{ Sha256 = '3166a42e9997e865fd52e444bdd18b7e9c435b77d12c044576fa8c95b47a692a'; Text = @'
|{
|  "_purpose": "The settings SecurityInsight Pro manages (its web app validates by them). GENERATED by engine\\pro-settings\\Build-SISettingsCatalog.ps1 from the shipped configuration files -- do not edit by hand; re-run the tool.",
|  "sources": [
|    "config\\SecurityInsight.custom.reference.ps1",
|    "launcher\\_lib\\SecurityInsight.shared-defaults.ps1",
|    "launcher\\<engine>\\LauncherConfig.defaults.ps1",
|    "config\\*.sample.ps1",
|    "launcher\\<engine>\\LauncherConfig.custom.sample.ps1",
|    "config\\settings.descriptions.locked.json"
|  ],
|  "groups": [
|    {
|      "name": "Mail & notifications",
|      "description": "Who receives the report mails, when they are sent, and the mail server they go through."
|    },
|    {
|      "name": "Guards (safety checks)",
|      "description": "The safety checks that hold, refuse or stop a step to protect your data: each can be turned off, its mail turned off, and its limits tuned."
|    },
|    {
|      "name": "Schedules & what runs",
|      "description": "Which jobs run and when; how many run side by side."
|    },
|    {
|      "name": "Collection scope & limits",
|      "description": "What each collection includes or skips, and the limits that keep runs fast. Engine tags show which collection a setting belongs to."
|    },
|    {
|      "name": "Risk Analysis reports",
|      "description": "What the Risk Analysis reports contain, how findings are filtered and scored, and where the reports go."
|    },
|    {
|      "name": "Risk Analysis -- mails and executive view",
|      "description": "Whether the Summary and Detailed mails show the same headline figures, which report leads, and the matching executive view in the web app."
|    },
|    {
|      "name": "AI",
|      "description": "Azure OpenAI: whether AI is used, for what, and how much it may spend."
|    },
|    {
|      "name": "Connectors & CMDB",
|      "description": "What SecurityInsight reads from and writes to other systems: the CMDB, ServiceNow and asset tags."
|    },
|    {
|      "name": "Data & retention",
|      "description": "Where collected data is written, how much detail it keeps, and how long it is kept."
|    },
|    {
|      "name": "Sign-in & Azure resources",
|      "description": "Set at install and rarely changed: how SecurityInsight signs in, and the names of the Azure resources it uses."
|    },
|    {
|      "name": "Advanced / diagnostics",
|      "description": "Diagnostic switches, older names kept for existing configuration files, and internal plumbing. Leave alone unless support asks."
|    }
|  ],
|  "categories": [
|    {
|      "name": "Environment",
|      "description": "This environment's name and the tenant it serves, as the header at the top of every page shows them.",
|      "groups": []
|    },
|    {
|      "name": "Mail & notifications",
|      "description": "Who gets which mail, and the mail server it goes through.",
|      "groups": [
|        "Mail & notifications"
|      ]
|    },
|    {
|      "name": "Guards (safety checks)",
|      "description": "Turn each safety check (or all of them) off, turn its mail off, and tune its limits.",
|      "groups": [
|        "Guards (safety checks)"
|      ]
|    },
|    {
|      "name": "Schedules & what runs",
|      "description": "Which container jobs run, and when.",
|      "groups": [
|        "Schedules & what runs"
|      ]
|    },
|    {
|      "name": "Collection scope & limits",
|      "description": "What each collection includes or skips.",
|      "groups": [
|        "Collection scope & limits"
|      ]
|    },
|    {
|      "name": "Risk Analysis reports",
|      "description": "What the Risk Analysis reports contain and where they go.",
|      "groups": [
|        "Risk Analysis reports",
|        "Risk Analysis -- mails and executive view"
|      ]
|    },
|    {
|      "name": "AI",
|      "description": "Whether Azure OpenAI is used, for what, and how much it may spend.",
|      "groups": [
|        "AI"
|      ]
|    },
|    {
|      "name": "Departments & owners",
|      "description": "Who is responsible for each asset, and when findings count as overdue.",
|      "groups": []
|    },
|    {
|      "name": "Connectors & CMDB",
|      "description": "The CMDB, ServiceNow and asset tags.",
|      "groups": [
|        "Connectors & CMDB"
|      ]
|    },
|    {
|      "name": "Data & retention",
|      "description": "Where collected data is written and how long it is kept.",
|      "groups": [
|        "Data & retention"
|      ]
|    },
|    {
|      "name": "Licence & updates",
|      "description": "Your licence and updates from Invardia.",
|      "groups": []
|    },
|    {
|      "name": "Sign-in & Azure resources",
|      "description": "How SecurityInsight signs in, and the Azure resources it uses. Set at install.",
|      "groups": [
|        "Sign-in & Azure resources"
|      ]
|    },
|    {
|      "name": "Web app",
|      "description": "The header, the chat, the wall board and number formats of this web app.",
|      "groups": [
|        "Web app"
|      ]
|    },
|    {
|      "name": "Exemptions",
|      "description": "How exemptions are requested, reviewed and shown.",
|      "groups": [
|        "Exemptions"
|      ]
|    },
|    {
|      "name": "Advanced / diagnostics",
|      "description": "Diagnostic switches and older names. Leave alone unless support asks.",
|      "groups": [
|        "Advanced / diagnostics"
|      ]
|    }
|  ],
|  "cards": [
|    {
|      "name": "Environment and tenant",
|      "category": "Environment",
|      "description": "The names the header shows. The tenant's own name is read from Entra ID when SecurityInsight is installed; set a name here only to show a different one.",
|      "settings": []
|    },
|    {
|      "name": "Mail",
|      "category": "Mail & notifications",
|      "description": "How SecurityInsight sends every mail: an Office 365 shared mailbox (recommended) or your own SMTP relay.",
|      "settings": [
|        "SI_Mail_Mode",
|        "SI_Mail_From",
|        "SI_Mail_ProbeMailbox",
|        "SI_Mail_RestrictionAttestation",
|        "SI_Mail_SmtpKept"
|      ]
|    },
|    {
|      "name": "Mail server",
|      "category": "Mail & notifications",
|      "description": "Your own SMTP relay -- used when How mail is sent (SI_Mail_Mode) is smtp.",
|      "settings": [
|        "SmtpServer",
|        "SMTPPort",
|        "SMTP_UseSSL",
|        "SMTPFrom",
|        "Mail_SendAnonymous",
|        "SMTPUser",
|        "SMTPPassword"
|      ]
|    },
|    {
|      "name": "Risk Analysis report mails",
|      "category": "Mail & notifications",
|      "description": "Who receives the Summary and Detailed reports. A report's own list wins over the default list.",
|      "settings": [
|        "SendMail",
|        "MailTo",
|        "RiskAnalysis_Summary_SendMail",
|        "RiskAnalysis_Summary_To",
|        "RiskAnalysis_Detailed_SendMail",
|        "RiskAnalysis_Detailed_To",
|        "RA_MailEvenIfEmpty",
|        "SI_MaxMailAttachmentMB",
|        "SI_RA_ExcelExport_Summary",
|        "SI_RA_ExcelExport_Detailed"
|      ]
|    },
|    {
|      "name": "Daily vulnerability mail",
|      "category": "Mail & notifications",
|      "description": "One mail a day with the vulnerabilities opened, closed and reopened in the last 24 hours.",
|      "settings": [
|        "Mail_CloseLoop_Daily_SendMail",
|        "Mail_CloseLoop_Daily_To",
|        "Mail_CloseLoop_Daily_SendTimeUtc"
|      ]
|    },
|    {
|      "name": "Mails to departments",
|      "category": "Mail & notifications",
|      "description": "Monthly reports and new-findings digests to each department's owners. A department needs an owner with a mail address.",
|      "settings": [
|        "SI_Pro_DepartmentReport_SendMail",
|        "SI_Pro_DepartmentReport_DayOfMonth",
|        "SI_Pro_TechnicalReview_SendMail",
|        "SI_Pro_TechnicalReview_DayOfMonth",
|        "SI_Pro_GovernanceNotify_SendMail",
|        "SI_Pro_GovernanceNotify_MinSeverity",
|        "SI_Pro_GovernanceNotify_Mode",
|        "SI_Exempted_InDepartmentReports"
|      ]
|    },
|    {
|      "name": "Task reminders",
|      "category": "Mail & notifications",
|      "description": "A daily mail to each person whose follow-up tasks are due.",
|      "settings": [
|        "SI_Pro_TaskDigest_SendMail",
|        "SI_Pro_TaskDigest_DueSoonDays"
|      ]
|    },
|    {
|      "name": "Safety-check mails",
|      "category": "Mail & notifications",
|      "description": "A mail when a safety check holds or stops a step to protect your data.",
|      "settings": [
|        "SI_GuardMail_Enabled",
|        "SI_GuardMail_To"
|      ]
|    },
|    {
|      "name": "Guards (safety checks)",
|      "category": "Guards (safety checks)",
|      "description": "One switch for all safety checks. Turning it off means SecurityInsight acts on data that looks broken or incomplete -- read the warning first.",
|      "settings": [
|        "SI_Guards_Enabled"
|      ]
|    },
|    {
|      "name": "Data-quality warnings",
|      "category": "Guards (safety checks)",
|      "description": "Each pipeline run's key numbers against the median of the last 3 runs: shown on Operations > Data quality and in Run health, and one mail a day when something is off. Never blocks anything.",
|      "settings": [
|        "SI_Pro_DataQuality_Mail_Enabled",
|        "SI_Pro_DataQuality_Mail_To",
|        "SI_Pro_DataQuality_AssetDropPercent",
|        "SI_Pro_DataQuality_ReportDropPercent",
|        "SI_Pro_DataQuality_FillDropPoints",
|        "SI_Pro_DataQuality_TierShiftPercent",
|        "SI_Pro_SourceDropout_HoldDeliveryDays",
|        "SI_Pro_Pipeline_GoOnAfterFailedStep",
|        "SI_Pro_PublishPartialRun",
|        "SI_Pro_Pipeline_FirstRunRestarts",
|        "SI_Pro_SourceDropout_AssetDropAction",
|        "SI_Pro_LifecycleStaleOpenRepair"
|      ]
|    },
|    {
|      "name": "Data health",
|      "category": "Guards (safety checks)",
|      "description": "Every day SecurityInsight checks a random 10% of each source's records against its newest collection, and re-asks Defender about a random 10% of the devices with vulnerability findings. Three anomalous days in a row make the data Unhealthy: then nothing is sent out (tickets, CMDB, connectors, tagging, outputs) until one good day, or until a SuperAdmin lets one channel through on Configuration > Connectors > Data-health hold.",
|      "settings": [
|        "SI_DataHealth_Enabled",
|        "SI_DataHealth_Margin_EntraUsers",
|        "SI_DataHealth_Margin_EntraApps",
|        "SI_DataHealth_Margin_Devices",
|        "SI_DataHealth_Margin_Azure",
|        "SI_DataHealth_Margin_DefenderForCloud",
|        "SI_DataHealth_Margin_Vulnerabilities",
|        "SI_DataHealth_Margin_RiskAnalysis",
|        "SI_DataHealth_MarginMinimum",
|        "SI_Telemetry_SendHealth"
|      ]
|    },
|    {
|      "name": "Vulnerability connector checks",
|      "category": "Guards (safety checks)",
|      "description": "The checks before the vulnerability connector opens or closes records in your vulnerability system, and their limits.",
|      "settings": [
|        "SI_VulnSync_MaxClosePercent",
|        "SI_VulnSync_MaxCloseAbsolute",
|        "SI_VulnSync_CollapseFloor",
|        "SI_Guard_VulnConnectorCloseCeiling_Enabled",
|        "SI_Guard_VulnConnectorCloseCeiling_Mail",
|        "SI_Guard_VulnConnectorEmptySnapshot_Enabled",
|        "SI_Guard_VulnConnectorEmptySnapshot_Mail",
|        "SI_Guard_VulnConnectorCollapse_Enabled",
|        "SI_Guard_VulnConnectorCollapse_Mail",
|        "SI_Guard_VulnConnectorScopeChanged_Enabled",
|        "SI_Guard_VulnConnectorScopeChanged_Mail",
|        "SI_Guard_VulnConnectorRunIncomplete_Enabled",
|        "SI_Guard_VulnConnectorRunIncomplete_Mail",
|        "SI_Guard_VulnConnectorSnapshotIncomplete_Enabled",
|        "SI_Guard_VulnConnectorSnapshotIncomplete_Mail",
|        "SI_Guard_VulnConnectorTargetIncomplete_Enabled",
|        "SI_Guard_VulnConnectorTargetIncomplete_Mail",
|        "SI_Guard_VulnConnectorRefused_Enabled",
|        "SI_Guard_VulnConnectorRefused_Mail"
|      ]
|    },
|    {
|      "name": "CMDB, ServiceNow and asset metadata checks",
|      "category": "Guards (safety checks)",
|      "description": "The checks before CIs are written, retired or handed over, and before asset metadata is handed off. The allowed change of the asset metadata is set on the Asset properties card.",
|      "settings": [
|        "SI_Guard_CmdbSqlSnapshotIncomplete_Enabled",
|        "SI_Guard_CmdbSqlSnapshotIncomplete_Mail",
|        "SI_Guard_CmdbSqlCollapse_Enabled",
|        "SI_Guard_CmdbSqlCollapse_Mail",
|        "SI_Guard_CmdbSqlEmptySnapshot_Enabled",
|        "SI_Guard_CmdbSqlEmptySnapshot_Mail",
|        "SI_Guard_CmdbSqlNoCorrelationMap_Enabled",
|        "SI_Guard_CmdbSqlNoCorrelationMap_Mail",
|        "SI_Guard_CmdbSqlStale_Enabled",
|        "SI_Guard_CmdbSqlStale_Mail",
|        "SI_Guard_CmdbHandoffMassChange_Enabled",
|        "SI_Guard_CmdbHandoffMassChange_Mail",
|        "SI_Guard_CmdbServicenowUnreachable_Enabled",
|        "SI_Guard_CmdbServicenowUnreachable_Mail",
|        "SI_Guard_CmdbServicenowCreateGate_Enabled",
|        "SI_Guard_CmdbServicenowCreateGate_Mail",
|        "SI_Guard_CmdbServicenowServiceModel_Enabled",
|        "SI_Guard_CmdbServicenowServiceModel_Mail",
|        "SI_Guard_AssetPropertiesCollectionChange_Enabled",
|        "SI_Guard_AssetPropertiesCollectionChange_Mail",
|        "SI_Guard_CollectionSourceAssetDrop_Enabled",
|        "SI_Guard_CollectionSourceAssetDrop_Mail",
|        "SI_Guard_CiBuildConcurrent_Enabled",
|        "SI_Guard_CiBuildConcurrent_Mail"
|      ]
|    },
|    {
|      "name": "Data sync and Risk Analysis checks",
|      "category": "Guards (safety checks)",
|      "description": "The checks before a Risk Analysis collection is loaded into the web app, and on the Risk Analysis results themselves.",
|      "settings": [
|        "SI_Guard_DatasyncCollectionHeld_Enabled",
|        "SI_Guard_DatasyncCollectionHeld_Mail",
|        "SI_Guard_DatasyncCollectionRefused_Enabled",
|        "SI_Guard_DatasyncCollectionRefused_Mail",
|        "SI_Guard_DatasyncAssetKindDropped_Enabled",
|        "SI_Guard_DatasyncAssetKindDropped_Mail",
|        "SI_Guard_DatasyncCollectionShortRead_Enabled",
|        "SI_Guard_DatasyncCollectionShortRead_Mail",
|        "SI_Guard_RaOutputRowDrop_Enabled",
|        "SI_Guard_RaOutputRowDrop_Mail",
|        "SI_Guard_RaOutputColumnEmptied_Enabled",
|        "SI_Guard_RaOutputColumnEmptied_Mail",
|        "SI_Guard_RaBucketCountJump_Enabled",
|        "SI_Guard_RaBucketCountJump_Mail",
|        "SI_Guard_IngestRowsShortCount_Enabled",
|        "SI_Guard_IngestRowsShortCount_Mail"
|      ]
|    },
|    {
|      "name": "Other checks",
|      "category": "Guards (safety checks)",
|      "description": "Setup, updates, the licence, the audit trail, bulk exemptions and the daily job flow.",
|      "settings": [
|        "SI_Guard_SchemaGateRefused_Enabled",
|        "SI_Guard_SchemaGateRefused_Mail",
|        "SI_Guard_UpdateSchemaFailed_Enabled",
|        "SI_Guard_UpdateSchemaFailed_Mail",
|        "SI_Guard_LicenceStateInvalid_Enabled",
|        "SI_Guard_LicenceStateInvalid_Mail",
|        "SI_Guard_LicenceStateGrace_Enabled",
|        "SI_Guard_LicenceStateGrace_Mail",
|        "SI_Guard_AuditRetentionRefused_Enabled",
|        "SI_Guard_AuditRetentionRefused_Mail",
|        "SI_Guard_ExemptionBulkRefused_Enabled",
|        "SI_Guard_ExemptionBulkRefused_Mail",
|        "SI_Guard_FlowRunCatchUp_Enabled",
|        "SI_Guard_FlowRunCatchUp_Mail",
|        "SI_Guard_FlowStepSkipped_Enabled",
|        "SI_Guard_FlowStepSkipped_Mail",
|        "SI_Guard_FlowStepStartFailed_Enabled",
|        "SI_Guard_FlowStepStartFailed_Mail",
|        "SI_Guard_FlowStepInterrupted_Enabled",
|        "SI_Guard_FlowStepInterrupted_Mail",
|        "SI_Guard_JobExecutionPreviousRunning_Enabled",
|        "SI_Guard_JobExecutionPreviousRunning_Mail",
|        "SI_Guard_JobRunThrottledStuck_Enabled",
|        "SI_Guard_JobRunThrottledStuck_Mail",
|        "SI_Throttle_StuckHours",
|        "SI_Throttle_StuckRuns"
|      ]
|    },
|    {
|      "name": "Links in e-mails",
|      "category": "Mail & notifications",
|      "description": "How the links in mails open this web app.",
|      "settings": []
|    },
|    {
|      "name": "Daily pipeline",
|      "category": "Schedules & what runs",
|      "description": "When the daily flow starts: data in, correlate, data out.",
|      "settings": [
|        "SI_Pipeline_StartTime",
|        "SI_Pipeline_TimeZone",
|        "SI_CiBuild_FullReconcileDays",
|        "SI_CiRulesBudgetSeconds"
|      ]
|    },
|    {
|      "name": "Container jobs",
|      "category": "Schedules & what runs",
|      "description": "Which jobs container setup creates and when each runs (cron, UTC). Takes effect when setup runs again.",
|      "settings": [
|        "SI_Bootstrap_Engines",
|        "SI_Bootstrap_ScheduleEndpoint",
|        "SI_Bootstrap_ScheduleIdentity",
|        "SI_Bootstrap_ScheduleAzure",
|        "SI_Bootstrap_ScheduleAssetTagging",
|        "SI_Bootstrap_ScheduleRiskAnalysis"
|      ]
|    },
|    {
|      "name": "Daily pipeline",
|      "category": "Schedules & what runs",
|      "description": "When a new install's daily pipeline (Collect, Correlate, Deliver) starts, and the time zone that time is read in.",
|      "settings": [
|        "SI_Pipeline_StartTime",
|        "SI_Pipeline_TimeZone",
|        "SI_CiBuild_FullReconcileDays",
|        "SI_CiRulesBudgetSeconds"
|      ]
|    },
|    {
|      "name": "Which assets are included",
|      "category": "Collection scope & limits",
|      "description": "Which devices, identities and subscriptions the collections keep.",
|      "settings": [
|        "SI_ActiveStaleDays",
|        "SI_IncludeInactive_Endpoint",
|        "SI_RequireMdeActive_Endpoint",
|        "SI_IncludeInactive_Identity",
|        "SI_RequireRecentSignIn_Identity",
|        "SI_IncludeFirstPartySpns",
|        "SI_AzureSubscriptionExcludePatterns",
|        "SI_AssetDecisionsPath"
|      ]
|    },
|    {
|      "name": "Disabled accounts and devices",
|      "category": "Collection scope & limits",
|      "description": "What happens to users, service principals, managed identities and computers whose account is disabled in their own directory -- one setting per stage. Read on every run: an account that is enabled again is included again everywhere.",
|      "settings": [
|        "SI_DisabledAssets_Collect",
|        "SI_DisabledAssets_Correlate",
|        "SI_DisabledAssets_RiskAnalysis",
|        "SI_DisabledAssets_StateActions",
|        "SI_DisabledAssets_Connectors"
|      ]
|    },
|    {
|      "name": "Exposure Graph identities without an asset",
|      "category": "Collection scope & limits",
|      "description": "On by default (an install that chose a value keeps it): Exposure Graph identities that get no asset. What is left out is counted in each run's log and on the Data health page; existing CIs retire with a reason naming the setting.",
|      "settings": [
|        "SI_Identity_SkipNeverSyncedAd",
|        "SI_Identity_SkipNeverSyncedDisabledAd",
|        "SI_Identity_SkipDeletedGroups"
|      ]
|    },
|    {
|      "name": "Users' sign-in methods in full",
|      "category": "Collection scope & limits",
|      "description": "Every sign-in method of each user with its details and the device a key lives on, read in the background (one read per user, Microsoft throttles: about 8-9 hours of reading at 150,000 users the first time, privileged users first). Collections never wait for it; not read yet shows as unknown, never as no.",
|      "settings": [
|        "SI_Identity_SignInMethodsPerUser",
|        "SI_Identity_SignInMethodsMaxAgeDays",
|        "SI_Identity_SignInMethodsFillMinutes"
|      ]
|    },
|    {
|      "name": "Extra details",
|      "category": "Collection scope & limits",
|      "description": "Optional data the collections can add.",
|      "settings": [
|        "SI_CollectDefenderRecommendations",
|        "SI_EnableSignInEnrich"
|      ]
|    },
|    {
|      "name": "Public IP checks (Shodan)",
|      "category": "Collection scope & limits",
|      "description": "Which public addresses are checked with Shodan, and how much it may spend.",
|      "settings": [
|        "SI_PublicIP_DiscoverySource",
|        "SI_PublicIP_ExtraTargets",
|        "SI_Shodan_ApiKey",
|        "SI_Shodan_TierMax",
|        "SI_Shodan_ForceFreshScan",
|        "SI_ShodanMonthlyCreditCap"
|      ]
|    },
|    {
|      "name": "Vulnerability (CVE) filters",
|      "category": "Risk Analysis reports",
|      "description": "Which vulnerabilities the CVE reports include.",
|      "settings": [
|        "SI_CVE_MinSeverity",
|        "SI_CVE_MinCvssScore",
|        "SI_CVE_MaxPublishedAgeDays",
|        "SI_CVE_RequireExploit",
|        "SI_PatchCycle_CatchUpDays",
|        "SI_PatchCycle_MsrcDates"
|      ]
|    },
|    {
|      "name": "Report mode and output",
|      "category": "Risk Analysis reports",
|      "description": "Which report runs by default, and where its results are written.",
|      "settings": [
|        "RiskAnalysis_Summary_Override",
|        "RiskAnalysis_Detailed_Override",
|        "ExportDestination",
|        "WriteJsonOutput",
|        "SendToLogAnalytics",
|        "SI_RiskAnalysis_SendToLogAnalytics"
|      ]
|    },
|    {
|      "name": "Summary and Detailed agreement",
|      "category": "Risk Analysis reports",
|      "description": "Whether both reports show the same headline figures.",
|      "settings": [
|        "SI_AISummary_Mode",
|        "SI_AISummary_Leader"
|      ]
|    },
|    {
|      "name": "Internet exposure",
|      "category": "Risk Analysis reports",
|      "description": "Your own internet-facing network ranges: an asset with an address in them counts as internet exposed, together with what Defender, Exposure Management, Azure and Shodan report.",
|      "settings": [
|        "SI_InternetExposedRanges"
|      ]
|    },
|    {
|      "name": "Sources and links",
|      "category": "Risk Analysis reports",
|      "description": "Data the reports read, and the tenant their links point to.",
|      "settings": [
|        "SI_HasExposureGraphInLA",
|        "SI_TenantDomain"
|      ]
|    },
|    {
|      "name": "Azure OpenAI connection",
|      "category": "AI",
|      "description": "The Azure OpenAI resource every AI feature uses.",
|      "settings": [
|        "OpenAI_endpoint",
|        "OpenAI_deployment",
|        "OpenAI_apiKey"
|      ]
|    },
|    {
|      "name": "Where AI is used",
|      "category": "AI",
|      "description": "Switch AI on or off per feature. Each needs the Azure OpenAI connection.",
|      "settings": [
|        "SI_EnableAI",
|        "SI_EnableAI_azure",
|        "SI_EnableAI_endpoint",
|        "SI_DisableAI",
|        "SI_DisableAI_endpoint",
|        "SI_PrivilegeTierClassifier_RunAI",
|        "BuildSummaryByAI",
|        "SI_RiskAnalysis_BuildSummaryByAI"
|      ]
|    },
|    {
|      "name": "AI spending",
|      "category": "AI",
|      "description": "Limits on what AI may cost.",
|      "settings": [
|        "SI_PrivilegeTierClassifier_RefreshDays",
|        "SI_SchemaProposeAiCeiling"
|      ]
|    },
|    {
|      "name": "Which department owns an asset",
|      "category": "Departments & owners",
|      "description": "How SecurityInsight finds the department responsible for each asset.",
|      "settings": [
|        "SI_Pro_Responsibility_Sources",
|        "SI_Pro_Responsibility_TagNames",
|        "SI_Pro_Responsibility_DefaultDepartment"
|      ]
|    },
|    {
|      "name": "Overdue and planning",
|      "category": "Departments & owners",
|      "description": "When open findings count as overdue, and automatic planning.",
|      "settings": [
|        "SI_Pro_Responsibility_OverdueDays",
|        "SI_Pro_Remediation_AutoSchedule"
|      ]
|    },
|    {
|      "name": "CMDB",
|      "category": "Connectors & CMDB",
|      "description": "Where business services come from.",
|      "settings": [
|        "SI_EnableCmdbProvider"
|      ]
|    },
|    {
|      "name": "ServiceNow CMDB connector",
|      "category": "Connectors & CMDB",
|      "description": "Whether the ServiceNow CMDB connector writes to your ServiceNow instance or only plans and reports.",
|      "settings": [
|        "SI_Cmdb_Run"
|      ]
|    },
|    {
|      "name": "Data out",
|      "category": "Connectors & CMDB",
|      "description": "Which workbooks and ServiceNow Import Set hand-offs are written after each data sync.",
|      "settings": [
|        "SI_DataOut_Outputs"
|      ]
|    },
|    {
|      "name": "Asset properties",
|      "category": "Connectors & CMDB",
|      "description": "How much SecurityInsight keeps about each asset: security (what it needs for risk) or full (all metadata from every source, shown on the asset page and handed to the CMDB).",
|      "settings": [
|        "SI_AssetProperties",
|        "SI_AssetProperties_RetentionDays",
|        "SI_AssetProperties_ChangeGuardPercent"
|      ]
|    },
|    {
|      "name": "SQL CMDB connector",
|      "category": "Connectors & CMDB",
|      "description": "Writes every asset as a CI row in the Pro database.",
|      "settings": [
|        "SI_Pro_CmdbSql_Enabled",
|        "SI_Pro_CmdbSql_Kinds",
|        "SI_Pro_CmdbSql_RetireAfterRuns",
|        "SI_Cmdb_RetireAfterDays"
|      ]
|    },
|    {
|      "name": "Assets no longer seen",
|      "category": "Connectors & CMDB",
|      "description": "How long an asset SecurityInsight no longer sees stays open before it is retired -- in general and per kind of asset.",
|      "settings": [
|        "SI_Pro_AssetRetire_GraceDays",
|        "SI_Pro_AssetRetire_GraceDays_ClientPc",
|        "SI_Pro_AssetRetire_GraceDays_Server",
|        "SI_Pro_AssetRetire_GraceDays_ServicePrincipal",
|        "SI_Pro_AssetRetire_GraceDays_User",
|        "SI_Pro_AssetRetire_GraceDays_AzureVm",
|        "SI_Pro_AssetRetire_GraceDays_AzureResource",
|        "SI_DeletionProof_Entra",
|        "SI_DeletionProof_Azure",
|        "SI_DeletionProof_Intune"
|      ]
|    },
|    {
|      "name": "Asset tagging",
|      "category": "Connectors & CMDB",
|      "description": "Whether asset tagging is on at all, whether the tagging job writes tags, and where.",
|      "settings": [
|        "SI_AssetTagging_Enabled",
|        "SI_AssetTagging_Apply",
|        "SI_Pro_AssetTagging_Apply",
|        "SI_Bootstrap_GrantTaggingRoles",
|        "SI_Bootstrap_TaggingScopes"
|      ]
|    },
|    {
|      "name": "Where collected data goes",
|      "category": "Data & retention",
|      "description": "Log Analytics, JSON and/or Excel, per collection.",
|      "settings": [
|        "SI_Sinks_Endpoint",
|        "SI_Sinks_Identity",
|        "SI_Sinks_Azure",
|        "SI_Sinks_PublicIp",
|        "SI_LaExport",
|        "SI_RA_Findings"
|      ]
|    },
|    {
|      "name": "How long data is kept",
|      "category": "Data & retention",
|      "description": "Run logs, the Pro database and the configuration backups.",
|      "settings": [
|        "SI_LogRetentionDays",
|        "SI_Pro_DataRetentionDays",
|        "SI_Pro_ConfigBackupRetentionDays"
|      ]
|    },
|    {
|      "name": "Counting and closing findings",
|      "category": "Data & retention",
|      "description": "How exempted findings are counted, and when a vulnerability that is gone is closed.",
|      "settings": [
|        "SI_Exempted_CountInManagement",
|        "SI_VulnSync_CloseAfterRuns"
|      ]
|    },
|    {
|      "name": "Database write pace",
|      "category": "Data & retention",
|      "description": "The large writers slow down while the database is at its limit, so the web app stays usable -- nothing is left out.",
|      "settings": [
|        "SI_SqlPacing_Enabled",
|        "SI_SqlPacing_HighPercent",
|        "SI_SqlPacing_LowPercent"
|      ]
|    },
|    {
|      "name": "Licence and updates",
|      "category": "Licence & updates",
|      "description": "The licence and updates come from Invardia by themselves. Only a SuperAdmin changes the licence settings.",
|      "settings": [
|        "SI_LicenseRequest_Auto",
|        "SI_LicenseRequest_ContactEmail",
|        "SI_InvardiaUpdate_Enabled",
|        "SI_InvardiaUpdate_HoldMicrosoftContent",
|        "SI_Update_RenameDisplayNames",
|        "SI_UpdateRing",
|        "SI_Telemetry_Enabled",
|        "SI_Telemetry_SetupControls",
|        "SI_Telemetry_SendEndpoints"
|      ]
|    },
|    {
|      "name": "How SecurityInsight signs in",
|      "category": "Sign-in & Azure resources",
|      "description": "The identity the jobs sign in as, and the Key Vault holding its secrets.",
|      "settings": [
|        "SI_AuthMethod",
|        "SI_SPN_TenantId",
|        "SI_SPN_AppId",
|        "SI_SPN_CertThumbprint",
|        "SI_SPN_Secret",
|        "SI_ManagedIdentityClientId",
|        "SI_KeyVaultName"
|      ]
|    },
|    {
|      "name": "Log Analytics",
|      "category": "Sign-in & Azure resources",
|      "description": "The workspace the data goes to, and how it is sent.",
|      "settings": [
|        "SI_WorkspaceResourceId",
|        "SI_WorkspaceName",
|        "SI_WorkspaceResourceGroup",
|        "SI_DceName",
|        "SI_DcrResourceGroup",
|        "SI_DefenderWorkspaceResourceId",
|        "SI_Location"
|      ]
|    },
|    {
|      "name": "Storage",
|      "category": "Sign-in & Azure resources",
|      "description": "The storage account the collections stage data in.",
|      "settings": [
|        "SI_StorageAccount",
|        "SI_StorageResourceGroup"
|      ]
|    },
|    {
|      "name": "Container hosting",
|      "category": "Sign-in & Azure resources",
|      "description": "Where container setup creates the jobs.",
|      "settings": [
|        "SI_Bootstrap_Location",
|        "SI_Bootstrap_ResourceGroupName",
|        "SI_Bootstrap_UseManagedIdentity"
|      ]
|    },
|    {
|      "name": "Wall board",
|      "category": "Web app",
|      "description": "The big-screen page.",
|      "settings": []
|    },
|    {
|      "name": "Named views",
|      "category": "Web app",
|      "description": "The views at the top of Security recommendations, Summary and Detailed.",
|      "settings": [
|        "SI_Pro_HiddenViews"
|      ]
|    },
|    {
|      "name": "Key figure windows",
|      "category": "Web app",
|      "description": "The windows the key figures of the Executive overview, the Executive report and the management mail count over: opened / fixed in the last N days, the mean time to fix, stale privileged accounts and the age bands of open CVE findings.",
|      "settings": [
|        "SI_KeyFigures_RecentDays",
|        "SI_KeyFigures_MeanTimeToFixDays",
|        "SI_KeyFigures_StaleAdminDays",
|        "SI_KeyFigures_CveAgeBands"
|      ]
|    },
|    {
|      "name": "Protection score",
|      "category": "Web app",
|      "description": "The protection score of the Executive overview, the Executive report, the management mail and the wall board: its accepted lifecycle per asset type, the tier weights and the severities that count.",
|      "settings": [
|        "SI_ProtectionScore_GraceDays_Device",
|        "SI_ProtectionScore_GraceDays_Identity",
|        "SI_ProtectionScore_GraceDays_CloudResource",
|        "SI_ProtectionScore_GraceDays_PublicIp",
|        "SI_ProtectionScore_OtherGraceDays_Device",
|        "SI_ProtectionScore_OtherGraceDays_Identity",
|        "SI_ProtectionScore_OtherGraceDays_CloudResource",
|        "SI_ProtectionScore_OtherGraceDays_PublicIp",
|        "SI_ProtectionScore_TierWeights",
|        "SI_ProtectionScore_Severities",
|        "SI_RA_SourceFirstSeen"
|      ]
|    }
|  ],
|  "settings": [
|    {
|      "name": "AI_MaxAttempts",
|      "label": "AI call attempts",
|      "group": "AI",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "4 attempts.",
|      "description": "Attempts for each AI call (default 4).",
|      "purpose": "How many times Risk Analysis tries an AI request when the AI service times out, throttles or has a temporary failure.",
|      "effect": "More attempts make the AI summary more likely to succeed under load, but a failing service makes the run take longer. Other errors fail at once regardless.",
|      "whenToChange": "Raise if AI summaries often fail on throttling or timeouts.",
|      "unit": "attempts",
|      "info": {
|        "what": "How many times Risk Analysis tries an AI request when the AI service times out, throttles or has a temporary failure.",
|        "whenChanged": "More attempts make the AI summary more likely to succeed under load, but a failing service makes the run take longer. Other errors fail at once regardless.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Nothing else.",
|        "default": "4 attempts.",
|        "recommended": "Keep the default. Change it when: Raise if AI summaries often fail on throttling or timeouts.",
|        "docUrl": "https://invardia.com/docs/si/settings/AI_MaxAttempts/"
|      }
|    },
|    {
|      "name": "AutoBucketCache",
|      "label": "Remember query split counts",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": true,
|      "defaultText": "On: split counts are saved and reused.",
|      "description": "reuse last-known-good bucket count",
|      "purpose": "Saves how many parts each large risk analysis query had to be split into, so later runs start at the right number.",
|      "effect": "Off, every run probes again from one part upward, which makes large estates noticeably slower. On, a changed query is detected and re-probed automatically.",
|      "whenToChange": "Rarely; turn off only while troubleshooting query splitting.",
|      "info": {
|        "what": "Saves how many parts each large risk analysis query had to be split into, so later runs start at the right number.",
|        "whenOn": "split counts are saved and reused.",
|        "whenOff": "Off, every run probes again from one part upward, which makes large estates noticeably slower. On, a changed query is detected and re-probed automatically.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "On: split counts are saved and reused.",
|        "recommended": "Keep the default. Change it when: Rarely; turn off only while troubleshooting query splitting.",
|        "docUrl": "https://invardia.com/docs/si/settings/AutoBucketCache/"
|      }
|    },
|    {
|      "name": "AutoBucketChallenger_ConfirmDays",
|      "label": "Split count re-test pause",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "7 days.",
|      "description": "... and at most once in this many days after a run decided the count.",
|      "purpose": "After a run decided a report's split count, how many days pass before a suspiciously high count is tested again.",
|      "effect": "Shorter re-tests a count that looks too high sooner, at the cost of extra queries; longer keeps a wrong count longer.",
|      "whenToChange": "Rarely; only with support while tuning query splitting.",
|      "unit": "days",
|      "info": {
|        "what": "After a run decided a report's split count, how many days pass before a suspiciously high count is tested again.",
|        "whenChanged": "Shorter re-tests a count that looks too high sooner, at the cost of extra queries; longer keeps a wrong count longer.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "7 days.",
|        "recommended": "Keep the default. Change it when: Rarely; only with support while tuning query splitting.",
|        "docUrl": "https://invardia.com/docs/si/settings/AutoBucketChallenger_ConfirmDays/"
|      }
|    },
|    {
|      "name": "AutoBucketChallenger_MedianMultiplier",
|      "label": "Split count re-test threshold",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "10 times the median.",
|      "description": "Re-test of a suspicious split count: a count this many times the median of the other reports is re-tested ...",
|      "purpose": "A report's split count this many times the median of the other reports' counts is treated as suspicious and tested again.",
|      "effect": "Lower re-tests more reports (more queries); higher re-tests only extreme counts.",
|      "whenToChange": "Rarely; only with support while tuning query splitting.",
|      "unit": "times",
|      "info": {
|        "what": "A report's split count this many times the median of the other reports' counts is treated as suspicious and tested again.",
|        "whenChanged": "Lower re-tests more reports (more queries); higher re-tests only extreme counts.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "10 times the median.",
|        "recommended": "Keep the default. Change it when: Rarely; only with support while tuning query splitting.",
|        "docUrl": "https://invardia.com/docs/si/settings/AutoBucketChallenger_MedianMultiplier/"
|      }
|    },
|    {
|      "name": "AutoBucketChallenger_MinEntries",
|      "label": "Split count re-test sample size",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "10 reports.",
|      "description": "... once at least this many reports have a count to compare with ...",
|      "purpose": "How many reports must have a split count before one count is compared with the others at all.",
|      "effect": "Lower compares sooner on small installs; higher waits for more reports before re-testing anything.",
|      "whenToChange": "Rarely; only with support while tuning query splitting.",
|      "unit": "reports",
|      "info": {
|        "what": "How many reports must have a split count before one count is compared with the others at all.",
|        "whenChanged": "Lower compares sooner on small installs; higher waits for more reports before re-testing anything.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "10 reports.",
|        "recommended": "Keep the default. Change it when: Rarely; only with support while tuning query splitting.",
|        "docUrl": "https://invardia.com/docs/si/settings/AutoBucketChallenger_MinEntries/"
|      }
|    },
|    {
|      "name": "AutoBucketCount",
|      "label": "Automatic query splitting",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": true,
|      "defaultText": "On.",
|      "description": "Adaptive bucketing (handles Defender's 30k-row query ceiling).",
|      "purpose": "Splits large risk analysis queries into smaller parts automatically so results stay under Defender's row limit.",
|      "effect": "Off, large queries run at a fixed split and can exceed Defender's limit, giving incomplete or failed reports on big estates.",
|      "whenToChange": "Leave on; turn off only for troubleshooting.",
|      "info": {
|        "what": "Splits large risk analysis queries into smaller parts automatically so results stay under Defender's row limit.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Off, large queries run at a fixed split and can exceed Defender's limit, giving incomplete or failed reports on big estates.",
|        "risk": "Large queries run at a fixed split and can exceed Defender's row limit: reports on big estates can be incomplete or fail. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "On.",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/AutoBucketCount/",
|        "confirmWhen": "off",
|        "confirm": "Off, large queries run at a fixed split and can exceed Defender's limit, giving incomplete or failed reports on big estates. Large queries run at a fixed split and can exceed Defender's row limit: reports on big estates can be incomplete or fail. Reversible at once."
|      }
|    },
|    {
|      "name": "AutoBucketMax",
|      "label": "Query split upper limit",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 131072,
|      "defaultText": "131072 parts (sized for very large estates).",
|      "description": "safety cap. Sized for 1M+ asset estates;",
|      "purpose": "The most parts automatic query splitting may divide a risk analysis query into.",
|      "effect": "A lower limit stops probing sooner, so a query too large for that many parts can still fail or return incomplete rows; a higher limit is accepted but rarely needed.",
|      "whenToChange": "Almost never.",
|      "unit": "parts",
|      "info": {
|        "what": "The most parts automatic query splitting may divide a risk analysis query into.",
|        "whenChanged": "A lower limit stops probing sooner, so a query too large for that many parts can still fail or return incomplete rows; a higher limit is accepted but rarely needed.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "131072 parts (sized for very large estates).",
|        "recommended": "Keep the default. Change it when: Almost never.",
|        "docUrl": "https://invardia.com/docs/si/settings/AutoBucketMax/"
|      }
|    },
|    {
|      "name": "AutomationFramework",
|      "label": "Internal platform sign-in mode",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: SecurityInsight's own sign-in settings are used.",
|      "description": "Internal: when $true, AutomationFramework long-name globals win (set by Initialize-PlatformAutomationFramework). Customer doesn't usually set this.",
|      "purpose": "Marks a run as hosted on the vendor's internal automation platform, which provides the sign-in identity instead of SecurityInsight's own settings.",
|      "effect": "When on, engines take their identity and connections from the internal platform and skip their own sign-in. On a normal install this breaks sign-in.",
|      "whenToChange": "Never on a customer install; it is set automatically by the internal platform.",
|      "info": {
|        "what": "Marks a run as hosted on the vendor's internal automation platform, which provides the sign-in identity instead of SecurityInsight's own settings.",
|        "whenOn": "When on, engines take their identity and connections from the internal platform and skip their own sign-in. On a normal install this breaks sign-in.",
|        "whenOff": "SecurityInsight's own sign-in settings are used.",
|        "risk": "On a normal install this breaks sign-in: every engine takes its identity from an internal platform that is not there, and runs fail. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Off: SecurityInsight's own sign-in settings are used.",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/AutomationFramework/",
|        "confirmWhen": "on",
|        "confirm": "When on, engines take their identity and connections from the internal platform and skip their own sign-in. On a normal install this breaks sign-in. On a normal install this breaks sign-in: every engine takes its identity from an internal platform that is not there, and runs fail. Reversible at once."
|      }
|    },
|    {
|      "name": "BuildSummaryByAI",
|      "label": "AI summary in the report mail",
|      "group": "AI",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off",
|      "description": "RiskAnalysis: master ON/OFF for the AI executive summary in the email body.",
|      "purpose": "Adds an AI-written executive summary of the Risk Analysis findings to the report email.",
|      "effect": "When on, each Risk Analysis run calls your Azure OpenAI deployment, adding run time and AI cost. If the AI settings are missing, a VM run stops with an error; a container run skips the summary.",
|      "whenToChange": "Turn on when you have Azure OpenAI set up and want a narrative summary in the mail.",
|      "card": "Where AI is used",
|      "hint": "When the reports run on a server.",
|      "info": {
|        "what": "Adds an AI-written executive summary of the Risk Analysis findings to the report email.",
|        "whenOn": "When on, each Risk Analysis run calls your Azure OpenAI deployment, adding run time and AI cost. If the AI settings are missing, a VM run stops with an error; a container run skips the summary.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "Report content is sent to YOUR Azure OpenAI deployment for a summary, and each run costs. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off",
|        "recommended": "As your organisation prefers; on gives readers a written summary.",
|        "docUrl": "https://invardia.com/docs/si/settings/BuildSummaryByAI/",
|        "confirmWhen": "on",
|        "confirm": "When on, each Risk Analysis run calls your Azure OpenAI deployment, adding run time and AI cost. If the AI settings are missing, a VM run stops with an error; a container run skips the summary. Report content is sent to YOUR Azure OpenAI deployment for a summary, and each run costs. Reversible at once."
|      }
|    },
|    {
|      "name": "CsaAttributeSet",
|      "label": "Custom security attribute set",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [
|        "asset-tagging"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "SecurityInsight",
|      "description": "Custom Security Attribute set name used by Entra tagging logic. Default 'SecurityInsight'.",
|      "purpose": "The Entra custom security attribute set that identity tagging rules write their tags into.",
|      "effect": "Identity tags are written into the named attribute set instead. The set must exist in Entra; a rule that names its own set still wins over this value.",
|      "whenToChange": "Only if your Entra tenant uses a different attribute set name for these tags.",
|      "info": {
|        "what": "The Entra custom security attribute set that identity tagging rules write their tags into.",
|        "whenChanged": "Identity tags are written into the named attribute set instead. The set must exist in Entra; a rule that names its own set still wins over this value.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Read by: asset-tagging.",
|        "default": "SecurityInsight",
|        "recommended": "Keep the default. Change it when: Only if your Entra tenant uses a different attribute set name for these tags.",
|        "docUrl": "https://invardia.com/docs/si/settings/CsaAttributeSet/"
|      }
|    },
|    {
|      "name": "CustomYamlFile",
|      "label": "Your asset tagging rules file",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [
|        "asset-tagging"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "AssetTagging.custom.yaml",
|      "defaultText": "AssetTagging.custom.yaml",
|      "description": "File name of your own asset-tagging rules YAML, loaded from the settings folder on top of the shipped rules; defaults to AssetTagging.custom.yaml.",
|      "purpose": "File name of your own asset tagging rules, loaded from the rules folder on top of the shipped rules.",
|      "effect": "Rules in this file are added to the shipped rules. If the file does not exist, only the shipped rules run. Ignored when rules come from the Pro settings database.",
|      "whenToChange": "Only if you keep your tagging rules under another file name.",
|      "info": {
|        "what": "File name of your own asset tagging rules, loaded from the rules folder on top of the shipped rules.",
|        "whenChanged": "Rules in this file are added to the shipped rules. If the file does not exist, only the shipped rules run. Ignored when rules come from the Pro settings database.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Read by: asset-tagging.",
|        "default": "AssetTagging.custom.yaml",
|        "recommended": "Keep the default. Change it when: Only if you keep your tagging rules under another file name.",
|        "docUrl": "https://invardia.com/docs/si/settings/CustomYamlFile/"
|      }
|    },
|    {
|      "name": "DceIngestionUri",
|      "label": "Ingestion endpoint address (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: looked up from the endpoint name",
|      "description": "Optional: explicit DCE ingestion URI (auto-resolved from SI_DceName otherwise).",
|      "purpose": "Older name for the data collection endpoint's ingestion address, used by Risk Analysis when sending results to Log Analytics.",
|      "effect": "Used only when SI_RiskAnalysis_DceIngestionUri and SI_DceIngestionUri are not set. A wrong address makes Risk Analysis ingestion fail.",
|      "whenToChange": "Never on new installs; use SI_DceIngestionUri or leave it to automatic lookup.",
|      "info": {
|        "what": "Older name for the data collection endpoint's ingestion address, used by Risk Analysis when sending results to Log Analytics.",
|        "whenChanged": "Used only when SI_RiskAnalysis_DceIngestionUri and SI_DceIngestionUri are not set. A wrong address makes Risk Analysis ingestion fail.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: looked up from the endpoint name",
|        "recommended": "Keep the default. Change it when: Never on new installs; use SI_DceIngestionUri or leave it to automatic lookup.",
|        "docUrl": "https://invardia.com/docs/si/settings/DceIngestionUri/"
|      }
|    },
|    {
|      "name": "DceName",
|      "label": "Data collection endpoint name (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "dce-securityinsight",
|      "defaultText": "dce-securityinsight",
|      "description": "--- Data Collection Endpoint (shared across all SI ingestion engines) ---",
|      "purpose": "Older name for the data collection endpoint that Risk Analysis sends its results through.",
|      "effect": "Used by Risk Analysis only when SI_RiskAnalysis_DceName and SI_DceName are not set; in a container it also fills SI_DceName. A wrong name stops Risk Analysis ingestion or creates a new endpoint.",
|      "whenToChange": "Never on new installs; set SI_DceName instead.",
|      "info": {
|        "what": "Older name for the data collection endpoint that Risk Analysis sends its results through.",
|        "whenChanged": "Used by Risk Analysis only when SI_RiskAnalysis_DceName and SI_DceName are not set; in a container it also fills SI_DceName. A wrong name stops Risk Analysis ingestion or creates a new endpoint.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "dce-securityinsight",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_DceName instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/DceName/"
|      }
|    },
|    {
|      "name": "DceResourceGroup",
|      "label": "Endpoint resource group (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "rg-dce-securityinsight",
|      "defaultText": "rg-dce-securityinsight",
|      "description": "Resource group of the data collection endpoint used when risk-analysis results are sent to Log Analytics; the newer SI_DcrResourceGroup takes precedence when set.",
|      "purpose": "Older name for the resource group of the data collection endpoint used by Risk Analysis and setup checks.",
|      "effect": "Used only when SI_DceResourceGroup (and, for other engines, SI_DcrResourceGroup) is not set. A wrong group makes the engine look in, or create resources in, the wrong place.",
|      "whenToChange": "Never on new installs; set SI_DceResourceGroup only if you split resource groups.",
|      "info": {
|        "what": "Older name for the resource group of the data collection endpoint used by Risk Analysis and setup checks.",
|        "whenChanged": "Used only when SI_DceResourceGroup (and, for other engines, SI_DcrResourceGroup) is not set. A wrong group makes the engine look in, or create resources in, the wrong place.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "rg-dce-securityinsight",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_DceResourceGroup only if you split resource groups.",
|        "docUrl": "https://invardia.com/docs/si/settings/DceResourceGroup/"
|      }
|    },
|    {
|      "name": "DcrResourceGroup",
|      "label": "Rules resource group (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "rg-dcr-securityinsight",
|      "defaultText": "rg-dcr-securityinsight",
|      "description": "--- Data Collection Rules (one RG holds ALL SI DCRs; DCR NAMES are engine-specific) ---",
|      "purpose": "Older name for the resource group holding the data collection rules that Risk Analysis uses.",
|      "effect": "Used by Risk Analysis only when SI_RiskAnalysis_DcrResourceGroup and SI_DcrResourceGroup are not set; in a container it also fills SI_DcrResourceGroup. A wrong group puts rules in the wrong place.",
|      "whenToChange": "Never on new installs; set SI_DcrResourceGroup instead.",
|      "info": {
|        "what": "Older name for the resource group holding the data collection rules that Risk Analysis uses.",
|        "whenChanged": "Used by Risk Analysis only when SI_RiskAnalysis_DcrResourceGroup and SI_DcrResourceGroup are not set; in a container it also fills SI_DcrResourceGroup. A wrong group puts rules in the wrong place.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "rg-dcr-securityinsight",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_DcrResourceGroup instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/DcrResourceGroup/"
|      }
|    },
|    {
|      "name": "DebugQueryHash",
|      "label": "Query fingerprint debug output",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off.",
|      "description": "When on, risk analysis logs each auto-bucketed report's query fingerprint and writes the hashed query to an OUTPUT\\Debug folder for troubleshooting; off by default.",
|      "purpose": "Logs each split query's fingerprint and saves the query to a debug folder for troubleshooting.",
|      "effect": "On writes one query file per report to the output Debug folder and adds log lines; no effect on report content.",
|      "whenToChange": "Only when asked to diagnose query splitting.",
|      "info": {
|        "what": "Logs each split query's fingerprint and saves the query to a debug folder for troubleshooting.",
|        "whenOn": "On writes one query file per report to the output Debug folder and adds log lines; no effect on report content.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off.",
|        "recommended": "Keep the default. Change it when: Only when asked to diagnose query splitting.",
|        "docUrl": "https://invardia.com/docs/si/settings/DebugQueryHash/"
|      }
|    },
|    {
|      "name": "Detailed",
|      "label": "Detailed run mode",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: Summary mode.",
|      "description": "Runs risk analysis in Detailed mode (one row per affected asset finding) using the Detailed report template, table and recipients; cannot be combined with Summary.",
|      "purpose": "Runs risk analysis in Detailed mode: one row per affected asset, with the Detailed template, table and mail recipients.",
|      "effect": "Honoured when the engine is run directly. The launchers and containers decide the mode themselves (command-line switch, RiskAnalysis_Detailed_Override, or the template name) and replace this value.",
|      "whenToChange": "Use the -Detailed switch or RiskAnalysis_Detailed_Override instead.",
|      "info": {
|        "what": "Runs risk analysis in Detailed mode: one row per affected asset, with the Detailed template, table and mail recipients.",
|        "whenOn": "Honoured when the engine is run directly. The launchers and containers decide the mode themselves (command-line switch, RiskAnalysis_Detailed_Override, or the template name) and replace this value.",
|        "whenOff": "Summary mode.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off: Summary mode.",
|        "recommended": "Keep the default. Change it when: Use the -Detailed switch or RiskAnalysis_Detailed_Override instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/Detailed/"
|      }
|    },
|    {
|      "name": "ExportDestination",
|      "label": "Report upload destination",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On a server: no upload. In a container: the staging storage account's report folder",
|      "description": "RiskAnalysis: blob/UNC upload after Excel/JSON write. Type auto-detected from prefix: 'https://...' = Azure Blob, '\\\\server\\share' = UNC. Backup-then-overwrite: existing files renamed <name>.<ts>.<ext>.bak.",
|      "purpose": "Where Risk Analysis copies its Excel (and JSON) report after a run: an Azure Blob container URL or a Windows file share path.",
|      "effect": "Reports are also uploaded there; an existing file with the same name is first kept as a timestamped backup. The run's identity needs write access to that location.",
|      "whenToChange": "Set it when reports should land on a share or storage container people or tools read from.",
|      "card": "Report mode and output",
|      "info": {
|        "what": "Where Risk Analysis copies its Excel (and JSON) report after a run: an Azure Blob container URL or a Windows file share path.",
|        "whenChanged": "Reports are also uploaded there; an existing file with the same name is first kept as a timestamped backup. The run's identity needs write access to that location.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "On a server: no upload. In a container: the staging storage account's report folder",
|        "recommended": "Keep the default. Change it when: Set it when reports should land on a share or storage container people or tools read from.",
|        "docUrl": "https://invardia.com/docs/si/settings/ExportDestination/"
|      }
|    },
|    {
|      "name": "GraphQueryMaxRetries",
|      "label": "Defender query retries",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 4,
|      "defaultText": "4 attempts.",
|      "description": "How many times risk analysis retries a Defender advanced-hunting query after a transient error before giving up; defaults to 4 attempts.",
|      "purpose": "How many attempts risk analysis makes for a Defender advanced hunting query before giving up.",
|      "effect": "More attempts ride out longer outages but can make a failing run take much longer; fewer attempts fail sooner and risk missing report sections after a brief error.",
|      "whenToChange": "Raise it if transient Defender errors often break runs.",
|      "unit": "attempts",
|      "info": {
|        "what": "How many attempts risk analysis makes for a Defender advanced hunting query before giving up.",
|        "whenChanged": "More attempts ride out longer outages but can make a failing run take much longer; fewer attempts fail sooner and risk missing report sections after a brief error.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "4 attempts.",
|        "recommended": "Keep the default. Change it when: Raise it if transient Defender errors often break runs.",
|        "docUrl": "https://invardia.com/docs/si/settings/GraphQueryMaxRetries/"
|      }
|    },
|    {
|      "name": "GraphReconnectMaxAgeMinutes",
|      "label": "Graph reconnect interval",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 45,
|      "defaultText": "45 minutes.",
|      "description": "Graph reconnect / retry tuning.",
|      "purpose": "How old the Microsoft Graph sign-in may get before risk analysis signs in again before a query.",
|      "effect": "Shorter reconnects more often (small overhead); longer risks a sign-in expiring during long runs and queries failing.",
|      "whenToChange": "Only if long runs fail with expired sign-ins.",
|      "unit": "minutes",
|      "info": {
|        "what": "How old the Microsoft Graph sign-in may get before risk analysis signs in again before a query.",
|        "whenChanged": "Shorter reconnects more often (small overhead); longer risks a sign-in expiring during long runs and queries failing.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "45 minutes.",
|        "recommended": "Keep the default. Change it when: Only if long runs fail with expired sign-ins.",
|        "docUrl": "https://invardia.com/docs/si/settings/GraphReconnectMaxAgeMinutes/"
|      }
|    },
|    {
|      "name": "Location",
|      "label": "Azure region (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "westeurope",
|      "defaultText": "westeurope; the workspace resource group's region wins when it exists",
|      "description": "--- Region (used when the engine has to create any missing infra) ---",
|      "purpose": "Older name for the Azure region Risk Analysis uses when it has to create a missing workspace or ingestion resources.",
|      "effect": "Used only when SI_Location is not set, and only when Risk Analysis creates missing resources. Existing resources are not moved.",
|      "whenToChange": "Never on new installs; set SI_Location instead.",
|      "info": {
|        "what": "Older name for the Azure region Risk Analysis uses when it has to create a missing workspace or ingestion resources.",
|        "whenChanged": "Used only when SI_Location is not set, and only when Risk Analysis creates missing resources. Existing resources are not moved.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "westeurope; the workspace resource group's region wins when it exists",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_Location instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/Location/"
|      }
|    },
|    {
|      "name": "LockedYamlFile",
|      "label": "Shipped asset tagging rules file",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [
|        "asset-tagging"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "AssetTagging.locked.yaml",
|      "defaultText": "AssetTagging.locked.yaml",
|      "description": "The rule files, in the engine's rules folder (SettingsPath).",
|      "purpose": "File name of the shipped asset tagging rules in the rules folder.",
|      "effect": "The engine loads the shipped rules from this file. A wrong name loses the shipped rules; with neither rules file present the run stops. Ignored when rules come from the Pro settings database.",
|      "whenToChange": "Practically never; the shipped name should be kept.",
|      "info": {
|        "what": "File name of the shipped asset tagging rules in the rules folder.",
|        "whenChanged": "The engine loads the shipped rules from this file. A wrong name loses the shipped rules; with neither rules file present the run stops. Ignored when rules come from the Pro settings database.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Read by: asset-tagging.",
|        "default": "AssetTagging.locked.yaml",
|        "recommended": "Keep the default. Change it when: Practically never; the shipped name should be kept.",
|        "docUrl": "https://invardia.com/docs/si/settings/LockedYamlFile/"
|      }
|    },
|    {
|      "name": "Mail_CloseLoop_Daily_SendMail",
|      "label": "Send the daily vulnerability mail",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "SERVICENOW -- ONE ROUTE (#914). SecurityInsight never writes ServiceNow configuration items or vulnerable items itself: it delivers to STAGING -- the hand-off database (SQL views ServiceNow imports through a JDBC data source) or the ServiceNow data-out connector (Import Set tables, the SI_DataOut_ServiceNow* settings above) -- and ServiceNow's own import / transform rules make every change. The older push and its settings (SI_ServiceNow_ImportSetTable, SI_ServiceNow_ImportSetMaxRows, SI_VulnSync_ServiceNowImportSetTable, SI_ServiceNow_DirectWrite, SI_VulnSync_ServiceNowDirectWrite) were removed. The vulnerability close-loop's DAILY MAIL (Pro; edited on the management GUI's e-mail settings page): the last 24 hours' opened, closed and reopened vulnerabilities by severity and asset tier, what is open now, and the mean time to fix, sent after the close-loop run through the same relay as the Risk Analysis mail. Off by default.",
|      "purpose": "Sends one mail a day with the vulnerabilities opened, closed and reopened in the last 24 hours, what is open now and the mean time to fix.",
|      "effect": "On: a daily job mails the summary to the close-loop recipients through the same mail server as the Risk Analysis mail. Nothing is sent without recipients.",
|      "whenToChange": "Turn on when the team should get a daily view of vulnerability progress.",
|      "card": "Daily vulnerability mail",
|      "info": {
|        "what": "Sends one mail a day with the vulnerabilities opened, closed and reopened in the last 24 hours, what is open now and the mean time to fix.",
|        "whenOn": "a daily job mails the summary to the close-loop recipients through the same mail server as the Risk Analysis mail. Nothing is sent without recipients.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off",
|        "recommended": "Keep the default. Change it when: Turn on when the team should get a daily view of vulnerability progress.",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_CloseLoop_Daily_SendMail/"
|      }
|    },
|    {
|      "name": "Mail_CloseLoop_Daily_SendTimeUtc",
|      "label": "Daily vulnerability mail time (UTC)",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "10:45 UTC, after the close-loop and data sync",
|      "description": "The time of day (UTC, HH:mm) the daily mail job runs. Default 10:45, after the close-loop; a changed time takes effect when setup (Bootstrap-ContainerAppJob.ps1) is run again.",
|      "purpose": "The time of day, in UTC, the daily vulnerability mail is sent.",
|      "effect": "Moves when the daily mail is sent. A time before the close-loop finishes mails yesterday's state. An invalid value falls back to 10:45. Takes effect when setup is run again.",
|      "whenToChange": "Only to fit recipients' working hours; keep it after the close-loop run.",
|      "patternHint": "HH:mm, UTC",
|      "pattern": "^([01][0-9]|2[0-3]):[0-5][0-9]$",
|      "card": "Daily vulnerability mail",
|      "hint": "HH:mm. Takes effect when setup runs again.",
|      "needs": "Mail_CloseLoop_Daily_SendMail",
|      "info": {
|        "what": "The time of day, in UTC, the daily vulnerability mail is sent.",
|        "whenChanged": "Moves when the daily mail is sent. A time before the close-loop finishes mails yesterday's state. An invalid value falls back to 10:45. Takes effect when setup is run again.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"Send the daily vulnerability mail\" is on. A SecurityInsight Pro licence.",
|        "default": "10:45 UTC, after the close-loop and data sync",
|        "recommended": "Keep the default. Change it when: Only to fit recipients' working hours; keep it after the close-loop run.",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_CloseLoop_Daily_SendTimeUtc/"
|      }
|    },
|    {
|      "name": "Mail_CloseLoop_Daily_To",
|      "label": "Daily vulnerability mail recipients",
|      "group": "Mail & notifications",
|      "type": "list",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "No recipients: the mail is not sent, and the run says so",
|      "description": "Who receives the close-loop daily mail.",
|      "purpose": "The addresses that receive the daily vulnerability mail.",
|      "effect": "Adding addresses makes the daily close-loop mail go to them, provided Mail_CloseLoop_Daily_SendMail is on. Removing them all stops the mail without failing the job.",
|      "whenToChange": "Set it when you turn on the close-loop daily mail, or when the team that follows up on fixes changes.",
|      "card": "Daily vulnerability mail",
|      "needs": "Mail_CloseLoop_Daily_SendMail",
|      "itemFormat": "email",
|      "info": {
|        "what": "The addresses that receive the daily vulnerability mail.",
|        "whenChanged": "Adding addresses makes the daily close-loop mail go to them, provided Mail_CloseLoop_Daily_SendMail is on. Removing them all stops the mail without failing the job.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"Send the daily vulnerability mail\" is on. A SecurityInsight Pro licence.",
|        "default": "No recipients: the mail is not sent, and the run says so",
|        "recommended": "Keep the default. Change it when: Set it when you turn on the close-loop daily mail, or when the team that follows up on fixes changes.",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_CloseLoop_Daily_To/"
|      }
|    },
|    {
|      "name": "Mail_SecurityInsight_Detailed_SendMail",
|      "label": "Detailed report mail on (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: RiskAnalysis_Detailed_SendMail or SendMail decides",
|      "description": "Older name for turning on e-mail of the Detailed risk-analysis report; used only when RiskAnalysis_Detailed_SendMail is not set.",
|      "purpose": "Older name for switching e-mail of the Detailed Risk Analysis report on or off.",
|      "effect": "Same as RiskAnalysis_Detailed_SendMail, which wins when both are set.",
|      "whenToChange": "Only kept for older configuration files; use RiskAnalysis_Detailed_SendMail instead.",
|      "info": {
|        "what": "Older name for switching e-mail of the Detailed Risk Analysis report on or off.",
|        "whenOn": "Same as RiskAnalysis_Detailed_SendMail, which wins when both are set.",
|        "whenOff": "Not set: RiskAnalysis_Detailed_SendMail or SendMail decides",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: RiskAnalysis_Detailed_SendMail or SendMail decides",
|        "recommended": "Keep the default. Change it when: Only kept for older configuration files; use RiskAnalysis_Detailed_SendMail instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_SecurityInsight_Detailed_SendMail/"
|      }
|    },
|    {
|      "name": "Mail_SecurityInsight_Detailed_To",
|      "label": "Detailed report recipients (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: RiskAnalysis_Detailed_To, else MailTo, is used",
|      "description": "Older name for the Detailed report recipient list; used only when RiskAnalysis_Detailed_To is empty.",
|      "purpose": "Older name for the recipient list of the Detailed Risk Analysis report.",
|      "effect": "Same as RiskAnalysis_Detailed_To, which wins when both are set.",
|      "whenToChange": "Only kept for older configuration files; use RiskAnalysis_Detailed_To instead.",
|      "itemFormat": "email",
|      "info": {
|        "what": "Older name for the recipient list of the Detailed Risk Analysis report.",
|        "whenChanged": "Same as RiskAnalysis_Detailed_To, which wins when both are set.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: RiskAnalysis_Detailed_To, else MailTo, is used",
|        "recommended": "Keep the default. Change it when: Only kept for older configuration files; use RiskAnalysis_Detailed_To instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_SecurityInsight_Detailed_To/"
|      }
|    },
|    {
|      "name": "Mail_SecurityInsight_Summary_SendMail",
|      "label": "Summary report mail on (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: RiskAnalysis_Summary_SendMail or SendMail decides",
|      "description": "AF-prefixed equivalents (internal AutomationFramework reads these).",
|      "purpose": "Older name for switching e-mail of the Summary Risk Analysis report on or off.",
|      "effect": "Same as RiskAnalysis_Summary_SendMail, which wins when both are set.",
|      "whenToChange": "Only kept for older configuration files; use RiskAnalysis_Summary_SendMail instead.",
|      "info": {
|        "what": "Older name for switching e-mail of the Summary Risk Analysis report on or off.",
|        "whenOn": "Same as RiskAnalysis_Summary_SendMail, which wins when both are set.",
|        "whenOff": "Not set: RiskAnalysis_Summary_SendMail or SendMail decides",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: RiskAnalysis_Summary_SendMail or SendMail decides",
|        "recommended": "Keep the default. Change it when: Only kept for older configuration files; use RiskAnalysis_Summary_SendMail instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_SecurityInsight_Summary_SendMail/"
|      }
|    },
|    {
|      "name": "Mail_SecurityInsight_Summary_To",
|      "label": "Summary report recipients (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: RiskAnalysis_Summary_To, else MailTo, is used",
|      "description": "Older name for the Summary report recipient list; used only when RiskAnalysis_Summary_To is empty.",
|      "purpose": "Older name for the recipient list of the Summary Risk Analysis report.",
|      "effect": "Same as RiskAnalysis_Summary_To, which wins when both are set.",
|      "whenToChange": "Only kept for older configuration files; use RiskAnalysis_Summary_To instead.",
|      "itemFormat": "email",
|      "info": {
|        "what": "Older name for the recipient list of the Summary Risk Analysis report.",
|        "whenChanged": "Same as RiskAnalysis_Summary_To, which wins when both are set.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: RiskAnalysis_Summary_To, else MailTo, is used",
|        "recommended": "Keep the default. Change it when: Only kept for older configuration files; use RiskAnalysis_Summary_To instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_SecurityInsight_Summary_To/"
|      }
|    },
|    {
|      "name": "Mail_SendAnonymous",
|      "label": "Send mail without sign-in",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off: the mail server sign-in (user, password, sender) is required",
|      "description": "anonymous relay (no creds; not common)",
|      "purpose": "Sends mail through a relay that accepts mail without a user name and password.",
|      "effect": "On: no SMTP credentials are needed or checked. Off with mail switched on: the run stops at start if the sender, user or password is missing. A relay that requires sign-in rejects anonymous mail.",
|      "whenToChange": "Only when your internal relay accepts unauthenticated mail from this host.",
|      "card": "Mail server",
|      "info": {
|        "what": "Sends mail through a relay that accepts mail without a user name and password.",
|        "whenOn": "no SMTP credentials are needed or checked. Off with mail switched on: the run stops at start if the sender, user or password is missing. A relay that requires sign-in rejects anonymous mail.",
|        "whenOff": "the mail server sign-in (user, password, sender) is required",
|        "risk": "Mail is sent without signing in to the mail server: only safe through an internal relay that accepts mail from this host alone. With an open relay, report mails can be spoofed or intercepted. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off: the mail server sign-in (user, password, sender) is required",
|        "recommended": "Off (sign in to the mail server, or use the shared mailbox).",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_SendAnonymous/",
|        "confirmWhen": "on",
|        "confirm": "no SMTP credentials are needed or checked. Off with mail switched on: the run stops at start if the sender, user or password is missing. A relay that requires sign-in rejects anonymous mail. Mail is sent without signing in to the mail server: only safe through an internal relay that accepts mail from this host alone. With an open relay, report mails can be spoofed or intercepted. Reversible at once."
|      }
|    },
|    {
|      "name": "MailTo",
|      "label": "Default recipients",
|      "group": "Mail & notifications",
|      "type": "list",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Empty (no recipients)",
|      "description": "Fallback list of e-mail recipients for risk-analysis reports, used when no report-specific (Summary or Detailed) recipient list is set.",
|      "purpose": "The addresses that receive every Risk Analysis report that has no recipient list of its own.",
|      "effect": "Reports go to these addresses unless a report-specific list exists. If mail is switched on and no recipient list is set anywhere, the run stops at start.",
|      "whenToChange": "Set it when one group should receive every Risk Analysis report.",
|      "card": "Risk Analysis report mails",
|      "hint": "Get every report without a list of its own.",
|      "itemFormat": "email",
|      "info": {
|        "what": "The addresses that receive every Risk Analysis report that has no recipient list of its own.",
|        "whenChanged": "Reports go to these addresses unless a report-specific list exists. If mail is switched on and no recipient list is set anywhere, the run stops at start.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Empty (no recipients)",
|        "recommended": "Keep the default. Change it when: Set it when one group should receive every Risk Analysis report.",
|        "docUrl": "https://invardia.com/docs/si/settings/MailTo/"
|      }
|    },
|    {
|      "name": "MaxAiSpendPerRun",
|      "label": "AI spend limit per run",
|      "group": "AI",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Container jobs: 4 US dollars. VM runs: no limit",
|      "description": "AI spend ceiling for one orchestrator run (USD). Stage Classify stops when reached; remaining rows tagged SI_Classify_Status='budget-capped'. Default 4.",
|      "purpose": "Caps the estimated Azure OpenAI spend (in US dollars) of AI classification in one profiling run.",
|      "effect": "When the estimate reaches the cap, remaining assets are classified without AI and marked as budget-capped. Higher caps allow more AI classification at more cost.",
|      "whenToChange": "Raise for large estates using AI classification; lower to control cost.",
|      "unit": "USD",
|      "info": {
|        "what": "Caps the estimated Azure OpenAI spend (in US dollars) of AI classification in one profiling run.",
|        "whenChanged": "When the estimate reaches the cap, remaining assets are classified without AI and marked as budget-capped. Higher caps allow more AI classification at more cost.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Nothing else.",
|        "default": "Container jobs: 4 US dollars. VM runs: no limit",
|        "recommended": "Keep the default. Change it when: Raise for large estates using AI classification; lower to control cost.",
|        "docUrl": "https://invardia.com/docs/si/settings/MaxAiSpendPerRun/"
|      }
|    },
|    {
|      "name": "OpenAI_apiKey",
|      "label": "Azure OpenAI key (Key Vault secret name)",
|      "group": "AI",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": true,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: AI classification is skipped; an AI summary request fails",
|      "description": "These four values are required when ANY engine has AI enabled (SI_EnableAI, SI_EnableAI_<engine>, BuildSummaryByAI, or SI_PrivilegeTierClassifier_RunAI).",
|      "purpose": "The NAME of the Key Vault secret that holds the key of your Azure OpenAI resource -- never the key itself. Get Started > AI integration stores the key in your Key Vault and fills this in.",
|      "effect": "With endpoint and deployment set, AI features can run. Keep it in Key Vault rather than in a file.",
|      "whenToChange": "When turning on AI features or rotating the key.",
|      "card": "Azure OpenAI connection",
|      "info": {
|        "what": "The NAME of the Key Vault secret that holds the key of your Azure OpenAI resource -- never the key itself. Get Started > AI integration stores the key in your Key Vault and fills this in.",
|        "whenChanged": "With endpoint and deployment set, AI features can run. Keep it in Key Vault rather than in a file.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault. Read by: risk-analysis.",
|        "default": "Not set: AI classification is skipped; an AI summary request fails",
|        "recommended": "Keep the default. Change it when: When turning on AI features or rotating the key.",
|        "docUrl": "https://invardia.com/docs/si/settings/OpenAI_apiKey/"
|      }
|    },
|    {
|      "name": "OpenAI_apiVersion",
|      "label": "Azure OpenAI API version",
|      "group": "AI",
|      "type": "text",
|      "engines": [
|        "privilege-tier-classifier",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "2024-08-01-preview",
|      "defaultText": "2024-08-01-preview (Risk Analysis, the tier classifier and the profiling engines alike)",
|      "description": "OpenAI API version default. Engine reads this to build the chat-completions URL. Setup-SecurityInsight's OpenAI phase will overwrite if it provisioned the AOAI deployment; this default protects ad-hoc classifier runs that never touched Setup. Carried over from v2.1 Build_Tier_Definitions defaults.",
|      "purpose": "The Azure OpenAI API version used when calling your model deployment.",
|      "effect": "Must be a version your Azure OpenAI resource supports; an unsupported version makes AI calls fail.",
|      "whenToChange": "Rarely; when your deployment needs a newer API version.",
|      "info": {
|        "what": "The Azure OpenAI API version used when calling your model deployment.",
|        "whenChanged": "Must be a version your Azure OpenAI resource supports; an unsupported version makes AI calls fail.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: privilege-tier-classifier, risk-analysis.",
|        "default": "2024-08-01-preview (Risk Analysis, the tier classifier and the profiling engines alike)",
|        "recommended": "Keep the default. Change it when: Rarely; when your deployment needs a newer API version.",
|        "docUrl": "https://invardia.com/docs/si/settings/OpenAI_apiVersion/"
|      }
|    },
|    {
|      "name": "OpenAI_deployment",
|      "label": "Azure OpenAI deployment",
|      "group": "AI",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: AI classification is skipped; an AI summary request fails",
|      "description": "Name of the Azure OpenAI model deployment used for AI classification and AI summaries; AI features stay off unless endpoint, key and deployment are all set.",
|      "purpose": "Name of the Azure OpenAI model deployment used for AI classification and AI summaries.",
|      "effect": "Chooses which model answers; a larger model may give better text at higher cost. AI features stay off unless endpoint, key and deployment are all set.",
|      "whenToChange": "When turning on AI features or moving to another model deployment.",
|      "card": "Azure OpenAI connection",
|      "info": {
|        "what": "Name of the Azure OpenAI model deployment used for AI classification and AI summaries.",
|        "whenChanged": "Chooses which model answers; a larger model may give better text at higher cost. AI features stay off unless endpoint, key and deployment are all set.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: AI classification is skipped; an AI summary request fails",
|        "recommended": "Keep the default. Change it when: When turning on AI features or moving to another model deployment.",
|        "docUrl": "https://invardia.com/docs/si/settings/OpenAI_deployment/"
|      }
|    },
|    {
|      "name": "OpenAI_endpoint",
|      "label": "Azure OpenAI endpoint",
|      "group": "AI",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: AI classification is skipped and AI summaries cannot run.",
|      "description": "URL of your Azure OpenAI resource used for AI classification and AI summaries; AI features stay off unless endpoint, key and deployment are all set.",
|      "purpose": "The web address of your Azure OpenAI resource, used for AI classification, AI tiering of roles and AI report summaries.",
|      "effect": "With endpoint, key and deployment all set, engines that have AI switched on call your Azure OpenAI. Missing it, profiling falls back to rule-based tiers, role tiering marks items for manual review, and an AI summary request stops the report run.",
|      "whenToChange": "Set it when you want AI features; change it only when you move to another Azure OpenAI resource.",
|      "card": "Azure OpenAI connection",
|      "info": {
|        "what": "The web address of your Azure OpenAI resource, used for AI classification, AI tiering of roles and AI report summaries.",
|        "whenChanged": "With endpoint, key and deployment all set, engines that have AI switched on call your Azure OpenAI. Missing it, profiling falls back to rule-based tiers, role tiering marks items for manual review, and an AI summary request stops the report run.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: AI classification is skipped and AI summaries cannot run.",
|        "recommended": "Keep the default. Change it when: Set it when you want AI features; change it only when you move to another Azure OpenAI resource.",
|        "docUrl": "https://invardia.com/docs/si/settings/OpenAI_endpoint/"
|      }
|    },
|    {
|      "name": "OpenAI_MaxTokensPerRequest",
|      "label": "AI summary answer length",
|      "group": "AI",
|      "type": "int",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 16384,
|      "defaultText": "16384 tokens, unless the older AI_MaxTokensPerRequest is set",
|      "description": "Maximum number of tokens the AI may return per request when building risk-analysis summaries; defaults to 16384.",
|      "purpose": "The largest answer, in tokens, the AI may return for each risk-analysis summary request.",
|      "effect": "Higher allows longer AI summaries but costs more per call and may exceed what your model deployment allows; lower gives shorter, cheaper summaries that may be cut off.",
|      "whenToChange": "Rarely; lower it if your model has a smaller limit, raise it if summaries are cut short.",
|      "unit": "tokens",
|      "info": {
|        "what": "The largest answer, in tokens, the AI may return for each risk-analysis summary request.",
|        "whenChanged": "Higher allows longer AI summaries but costs more per call and may exceed what your model deployment allows; lower gives shorter, cheaper summaries that may be cut off.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: risk-analysis.",
|        "default": "16384 tokens, unless the older AI_MaxTokensPerRequest is set",
|        "recommended": "Keep the default. Change it when: Rarely; lower it if your model has a smaller limit, raise it if summaries are cut short.",
|        "docUrl": "https://invardia.com/docs/si/settings/OpenAI_MaxTokensPerRequest/"
|      }
|    },
|    {
|      "name": "OverwriteXlsx",
|      "label": "Replace Excel workbook each run",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": true,
|      "defaultText": "On: a fresh workbook every run.",
|      "description": "When on (default), risk analysis deletes the previous Excel workbook at the start of a run and writes a fresh one instead of adding to it.",
|      "purpose": "Deletes the previous risk analysis Excel workbook at the start of a run and writes a fresh one.",
|      "effect": "Off, the run writes into the existing workbook instead, so older content can remain alongside new results.",
|      "whenToChange": "Almost never.",
|      "info": {
|        "what": "Deletes the previous risk analysis Excel workbook at the start of a run and writes a fresh one.",
|        "whenOn": "a fresh workbook every run.",
|        "whenOff": "Off, the run writes into the existing workbook instead, so older content can remain alongside new results.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "On: a fresh workbook every run.",
|        "recommended": "Keep the default. Change it when: Almost never.",
|        "docUrl": "https://invardia.com/docs/si/settings/OverwriteXlsx/"
|      }
|    },
|    {
|      "name": "RA_MailEvenIfEmpty",
|      "label": "Mail reports with no findings",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: a report with no rows is not mailed.",
|      "description": "Send the report mail even when a run produced 0 rows (a heartbeat). Default: an empty report is not mailed.",
|      "purpose": "Sends the report mail even when a run found nothing, as a sign the job ran.",
|      "effect": "When on, recipients get a mail after every run, including empty ones, confirming the job is alive. When off, an empty run sends nothing.",
|      "whenToChange": "Turn on if you want a daily confirmation mail even when there are no findings.",
|      "card": "Risk Analysis report mails",
|      "info": {
|        "what": "Sends the report mail even when a run found nothing, as a sign the job ran.",
|        "whenOn": "When on, recipients get a mail after every run, including empty ones, confirming the job is alive. When off, an empty run sends nothing.",
|        "whenOff": "a report with no rows is not mailed.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Nothing else.",
|        "default": "Off: a report with no rows is not mailed.",
|        "recommended": "Keep the default. Change it when: Turn on if you want a daily confirmation mail even when there are no findings.",
|        "docUrl": "https://invardia.com/docs/si/settings/RA_MailEvenIfEmpty/"
|      }
|    },
|    {
|      "name": "ReportTemplate",
|      "label": "Risk analysis report template",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "RiskAnalysis_Summary",
|      "defaultText": "RiskAnalysis_Summary.",
|      "description": "Two templates ship in the Locked YAML: RiskAnalysis_Summary (default; compact summary across all areas) RiskAnalysis_Detailed (full per-row detail, larger Excel, slower)",
|      "purpose": "Names the report template risk analysis runs: RiskAnalysis_Summary (compact) or RiskAnalysis_Detailed (one row per finding).",
|      "effect": "The launchers and containers set this themselves from the command line or the per-mode template settings, so a value in the config file is only honoured when the engine is run directly.",
|      "whenToChange": "Use RiskAnalysis_ReportTemplate_Default_Summary or _Detailed, or -ReportTemplate, instead.",
|      "info": {
|        "what": "Names the report template risk analysis runs: RiskAnalysis_Summary (compact) or RiskAnalysis_Detailed (one row per finding).",
|        "whenChanged": "The launchers and containers set this themselves from the command line or the per-mode template settings, so a value in the config file is only honoured when the engine is run directly.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "RiskAnalysis_Summary.",
|        "recommended": "Keep the default. Change it when: Use RiskAnalysis_ReportTemplate_Default_Summary or _Detailed, or -ReportTemplate, instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/ReportTemplate/"
|      }
|    },
|    {
|      "name": "ResetCache",
|      "label": "Reset query split memory",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off.",
|      "description": "force fresh bucket probe",
|      "purpose": "Deletes the saved query split counts at the start of a run so they are probed again.",
|      "effect": "On, the next run re-probes every large query from scratch, so it takes longer; the new counts are saved again afterwards.",
|      "whenToChange": "For one run when reports look incomplete or after a large estate change.",
|      "info": {
|        "what": "Deletes the saved query split counts at the start of a run so they are probed again.",
|        "whenOn": "On, the next run re-probes every large query from scratch, so it takes longer; the new counts are saved again afterwards.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off.",
|        "recommended": "Keep the default. Change it when: For one run when reports look incomplete or after a large estate change.",
|        "docUrl": "https://invardia.com/docs/si/settings/ResetCache/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_Detailed_Override",
|      "label": "Default to Detailed mode",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: runs default to Summary mode.",
|      "description": "When on, risk analysis runs in Detailed mode by default unless Summary is explicitly requested on the command line; off by default.",
|      "purpose": "Makes risk analysis run in Detailed mode unless Summary is asked for on the command line.",
|      "effect": "On, scheduled runs produce one row per affected asset: larger Excel files, longer runs, more data ingested, and the Detailed mail recipients. Cannot be on together with RiskAnalysis_Summary_Override.",
|      "whenToChange": "When a host should produce Detailed reports by default.",
|      "card": "Report mode and output",
|      "hint": "Used when a run does not say which report.",
|      "info": {
|        "what": "Makes risk analysis run in Detailed mode unless Summary is asked for on the command line.",
|        "whenOn": "On, scheduled runs produce one row per affected asset: larger Excel files, longer runs, more data ingested, and the Detailed mail recipients. Cannot be on together with RiskAnalysis_Summary_Override.",
|        "whenOff": "runs default to Summary mode.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off: runs default to Summary mode.",
|        "recommended": "Keep the default. Change it when: When a host should produce Detailed reports by default.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_Detailed_Override/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_Detailed_SendMail",
|      "label": "Mail the Detailed report",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the older name, else SendMail (off) decides",
|      "description": "# Required by Hosted relays. # Omit to fall back to $SMTPUser (legacy). Per-template recipients (also works in AF mode; legacy $global:Mail_SecurityInsight_* names are still accepted as a fallback):",
|      "purpose": "Mails the Detailed Risk Analysis report after each run.",
|      "effect": "On: each Detailed run mails the full report to its recipients; this needs working mail server settings. A report template's own mail switch still wins.",
|      "whenToChange": "Turn on when the security team should receive the full Detailed report by mail.",
|      "card": "Risk Analysis report mails",
|      "hint": "Not set: Mail every report decides.",
|      "info": {
|        "what": "Mails the Detailed Risk Analysis report after each run.",
|        "whenOn": "each Detailed run mails the full report to its recipients; this needs working mail server settings. A report template's own mail switch still wins.",
|        "whenOff": "Not set: the older name, else SendMail (off) decides",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: the older name, else SendMail (off) decides",
|        "recommended": "Keep the default. Change it when: Turn on when the security team should receive the full Detailed report by mail.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_Detailed_SendMail/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_Detailed_To",
|      "label": "Detailed report recipients",
|      "group": "Mail & notifications",
|      "type": "list",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the older name, else MailTo, is used",
|      "description": "E-mail recipients for the Detailed risk-analysis report; falls back to MailTo when empty.",
|      "purpose": "The addresses that receive the Detailed Risk Analysis report.",
|      "effect": "Detailed reports go to these addresses instead of the default list. Blank entries are dropped with a warning. A report template's own recipients still win.",
|      "whenToChange": "Set it when the Detailed report should go to different people than the default list.",
|      "card": "Risk Analysis report mails",
|      "hint": "Empty: the default recipients get it.",
|      "itemFormat": "email",
|      "info": {
|        "what": "The addresses that receive the Detailed Risk Analysis report.",
|        "whenChanged": "Detailed reports go to these addresses instead of the default list. Blank entries are dropped with a warning. A report template's own recipients still win.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: the older name, else MailTo, is used",
|        "recommended": "Keep the default. Change it when: Set it when the Detailed report should go to different people than the default list.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_Detailed_To/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_ReportTemplate_Default_Detailed",
|      "label": "Detailed report template",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "RiskAnalysis_Detailed.",
|      "description": "Report template used when risk analysis runs in Detailed mode and no template is named explicitly; defaults to RiskAnalysis_Detailed.",
|      "purpose": "The report template used for Detailed runs when no template is named explicitly.",
|      "effect": "Detailed runs and the Detailed container job use the named template instead. A template name that does not exist makes the run fail.",
|      "whenToChange": "When you have created your own Detailed template.",
|      "info": {
|        "what": "The report template used for Detailed runs when no template is named explicitly.",
|        "whenChanged": "Detailed runs and the Detailed container job use the named template instead. A template name that does not exist makes the run fail.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "RiskAnalysis_Detailed.",
|        "recommended": "Keep the default. Change it when: When you have created your own Detailed template.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_ReportTemplate_Default_Detailed/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_ReportTemplate_Default_Summary",
|      "label": "Summary report template",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "RiskAnalysis_Summary.",
|      "description": "Per-mode ReportTemplate override (every template is auto-bucketed for large estates).",
|      "purpose": "The report template used for Summary runs when no template is named explicitly.",
|      "effect": "Summary runs and the Summary container job use the named template instead. A template name that does not exist makes the run fail.",
|      "whenToChange": "When you have created your own Summary template.",
|      "info": {
|        "what": "The report template used for Summary runs when no template is named explicitly.",
|        "whenChanged": "Summary runs and the Summary container job use the named template instead. A template name that does not exist makes the run fail.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "RiskAnalysis_Summary.",
|        "recommended": "Keep the default. Change it when: When you have created your own Summary template.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_ReportTemplate_Default_Summary/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_Summary_Override",
|      "label": "Default to Summary mode",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Summary mode is already the launcher's default.",
|      "description": "Mode override (per-run). Mutually exclusive: Summary (tier-rolled-up) vs Detailed (one row per affected identity/device).",
|      "purpose": "Makes risk analysis run in Summary mode unless Detailed is asked for on the command line.",
|      "effect": "On keeps runs in compact Summary mode with the Summary table and recipients. Cannot be on together with RiskAnalysis_Detailed_Override; set it off when you switch a host to Detailed.",
|      "whenToChange": "Rarely; only to make the Summary choice explicit.",
|      "card": "Report mode and output",
|      "hint": "Used when a run does not say which report.",
|      "info": {
|        "what": "Makes risk analysis run in Summary mode unless Detailed is asked for on the command line.",
|        "whenOn": "On keeps runs in compact Summary mode with the Summary table and recipients. Cannot be on together with RiskAnalysis_Detailed_Override; set it off when you switch a host to Detailed.",
|        "whenOff": "Summary mode is already the launcher's default.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Summary mode is already the launcher's default.",
|        "recommended": "Keep the default. Change it when: Rarely; only to make the Summary choice explicit.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_Summary_Override/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_Summary_SendMail",
|      "label": "Mail the Summary report",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the older name, else SendMail (off) decides",
|      "description": "Per-mode mail routing for RiskAnalysis (community short names).",
|      "purpose": "Mails the Summary Risk Analysis report after each run.",
|      "effect": "On: each Summary run mails the report to its recipients; this needs working mail server settings. A report template's own mail switch still wins. While the Summary step is off (the default since 2026-10), the management mail -- the Detailed report's mail, with its management summary -- goes to these recipients instead.",
|      "whenToChange": "Turn on when management or the security team should receive the Summary report by mail.",
|      "card": "Risk Analysis report mails",
|      "hint": "Not set: Mail every report decides.",
|      "info": {
|        "what": "Mails the Summary Risk Analysis report after each run.",
|        "whenOn": "each Summary run mails the report to its recipients; this needs working mail server settings. A report template's own mail switch still wins. While the Summary step is off (the default since 2026-10), the management mail -- the Detailed report's mail, with its management summary -- goes to these recipients instead.",
|        "whenOff": "Not set: the older name, else SendMail (off) decides",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: the older name, else SendMail (off) decides",
|        "recommended": "Keep the default. Change it when: Turn on when management or the security team should receive the Summary report by mail.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_Summary_SendMail/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_Summary_To",
|      "label": "Summary report recipients",
|      "group": "Mail & notifications",
|      "type": "list",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the older name, else MailTo, is used",
|      "description": "E-mail recipients for the Summary risk-analysis report; falls back to MailTo when empty.",
|      "purpose": "The addresses that receive the Summary Risk Analysis report.",
|      "effect": "Summary reports go to these addresses instead of the default list. Blank entries are dropped with a warning. A report template's own recipients still win. While the Summary step is off (the default since 2026-10), these addresses receive the management mail -- the Detailed report's mail -- when Mail the Summary report is on.",
|      "whenToChange": "Set it when the Summary report should go to different people than the default list.",
|      "card": "Risk Analysis report mails",
|      "hint": "Empty: the default recipients get it.",
|      "itemFormat": "email",
|      "info": {
|        "what": "The addresses that receive the Summary Risk Analysis report.",
|        "whenChanged": "Summary reports go to these addresses instead of the default list. Blank entries are dropped with a warning. A report template's own recipients still win. While the Summary step is off (the default since 2026-10), these addresses receive the management mail -- the Detailed report's mail -- when Mail the Summary report is on.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: the older name, else MailTo, is used",
|        "recommended": "Keep the default. Change it when: Set it when the Summary report should go to different people than the default list.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_Summary_To/"
|      }
|    },
|    {
|      "name": "Scope",
|      "label": "Asset tagging rule scope",
|      "group": "Connectors & CMDB",
|      "type": "list",
|      "engines": [
|        "asset-tagging",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "PROD",
|      "defaultText": "PROD: only production rules run.",
|      "description": "or @('TEST')",
|      "purpose": "Which asset tagging rules run, by the mode each rule is marked with: PROD, TEST, or both.",
|      "effect": "Adding TEST also runs rules marked as test rules, which can tag assets with untried logic. Rules whose mode is not listed are skipped. Risk analysis does not read this setting.",
|      "whenToChange": "To try new tagging rules marked TEST before promoting them.",
|      "info": {
|        "what": "Which asset tagging rules run, by the mode each rule is marked with: PROD, TEST, or both.",
|        "whenChanged": "Adding TEST also runs rules marked as test rules, which can tag assets with untried logic. Rules whose mode is not listed are skipped. Risk analysis does not read this setting.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Read by: asset-tagging, risk-analysis.",
|        "default": "PROD: only production rules run.",
|        "recommended": "Keep the default. Change it when: To try new tagging rules marked TEST before promoting them.",
|        "docUrl": "https://invardia.com/docs/si/settings/Scope/"
|      }
|    },
|    {
|      "name": "SendMail",
|      "label": "Mail every report",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off",
|      "description": "--- SMTP (RiskAnalysis email delivery) --- Hosted relays REJECT mail when From != verified sender, so $SMTPFrom must be a verified-sender address -- NOT the relay login.",
|      "purpose": "Mails each Risk Analysis report, unless a report's own switch says otherwise.",
|      "effect": "On: reports are mailed to MailTo (or the report-specific lists). The run stops at start if mail is on but no recipients or required mail server sign-in details are set.",
|      "whenToChange": "Turn on to mail every report; use the Summary/Detailed switches for finer control.",
|      "card": "Risk Analysis report mails",
|      "hint": "Used when a report's own switch below is not set.",
|      "info": {
|        "what": "Mails each Risk Analysis report, unless a report's own switch says otherwise.",
|        "whenOn": "reports are mailed to MailTo (or the report-specific lists). The run stops at start if mail is on but no recipients or required mail server sign-in details are set.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off",
|        "recommended": "Keep the default. Change it when: Turn on to mail every report; use the Summary/Detailed switches for finer control.",
|        "docUrl": "https://invardia.com/docs/si/settings/SendMail/"
|      }
|    },
|    {
|      "name": "SendToLogAnalytics",
|      "label": "Copy Risk Analysis report rows to Log Analytics (SI_RiskAnalysis_Detailed_CL)",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off: the report rows are kept in the database only",
|      "description": "--- Copy Risk Analysis report rows to Log Analytics (SI_RiskAnalysis_Detailed_CL) -- optional, off by default --- After each Risk Analysis run, copies its report rows (SI_RiskAnalysis_Detailed_CL; SI_RiskAnalysis_Summary_CL for the Summary report; the day's trend row in SI_Trend_CL) into your Log Analytics workspace, for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages read the results from its database. Adds ingestion cost.",
|      "purpose": "Optional. After each Risk Analysis run, copies its report rows into your Log Analytics workspace (SI_RiskAnalysis_Detailed_CL, and SI_RiskAnalysis_Summary_CL when the Summary report runs; the day's trend row in SI_Trend_CL), for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages, the data sync, the vulnerability connectors and the trends read the results from its database. On a large estate the copy takes a long time and adds Log Analytics ingestion cost. Off by default.",
|      "effect": "On: after every Risk Analysis run its report rows are also posted to SI_RiskAnalysis_Detailed_CL (SI_RiskAnalysis_Summary_CL for the Summary report), after the result is complete in the database, and the day's trend row to SI_Trend_CL. On a large estate that is close to an hour, and it costs ingestion for every row, every run. Off: nothing is copied; the Excel reports, the mail and everything SecurityInsight shows are unchanged. The Azure workbook in preview\\AzureWorkbook reads the copy, so it needs it on.",
|      "whenToChange": "Only when your own workbooks, Sentinel rules or KQL queries read SI_RiskAnalysis_Detailed_CL, SI_RiskAnalysis_Summary_CL or SI_Trend_CL; leave off otherwise.",
|      "card": "Report mode and output",
|      "hint": "Off = the report rows stay in the database. On = also a copy in Log Analytics (takes long on a large estate, costs ingestion).",
|      "info": {
|        "what": "Optional. After each Risk Analysis run, copies its report rows into your Log Analytics workspace (SI_RiskAnalysis_Detailed_CL, and SI_RiskAnalysis_Summary_CL when the Summary report runs; the day's trend row in SI_Trend_CL), for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages, the data sync, the vulnerability connectors and the trends read the results from its database. On a large estate the copy takes a long time and adds Log Analytics ingestion cost. Off by default.",
|        "whenOn": "after every Risk Analysis run its report rows are also posted to SI_RiskAnalysis_Detailed_CL (SI_RiskAnalysis_Summary_CL for the Summary report), after the result is complete in the database, and the day's trend row to SI_Trend_CL. On a large estate that is close to an hour, and it costs ingestion for every row, every run.",
|        "whenOff": "nothing is copied; the Excel reports, the mail and everything SecurityInsight shows are unchanged. The Azure workbook in preview\\AzureWorkbook reads the copy, so it needs it on.",
|        "risk": "Log Analytics ingestion cost for every report row, every run, and a longer run on a large estate. SecurityInsight itself does not need the copy: its pages, the data sync, the vulnerability connectors and the trends read the database. Reversible: turn it off and the next run copies nothing.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off: the report rows are kept in the database only",
|        "recommended": "Off, unless your own workbooks, Sentinel rules or KQL read the report rows in Log Analytics.",
|        "docUrl": "https://invardia.com/docs/si/settings/SendToLogAnalytics/",
|        "confirmWhen": "on",
|        "confirm": "Every Risk Analysis run will also copy its report rows to Log Analytics (SI_RiskAnalysis_Detailed_CL; SI_RiskAnalysis_Summary_CL for the Summary report; the trend row in SI_Trend_CL). On a large estate the copy takes close to an hour after each run; it adds ingestion cost."
|      }
|    },
|    {
|      "name": "SettingsPath",
|      "label": "Asset tagging rules folder",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [
|        "asset-tagging"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The shipped rule files next to the endpoint enrichment rules.",
|      "description": "Your own rules folder and file names (default: asset-profiling-enrichment\\endpoint, AssetTagging.*.yaml).",
|      "purpose": "The folder the asset tagging engine reads its tagging rule files from.",
|      "effect": "Point it at your own folder to tag with your own rule files instead of the shipped ones. A missing folder stops the run with a clear error. The Risk Analysis and privilege tier launchers set their own folder and ignore this value.",
|      "whenToChange": "Only when you keep your own tagging rule files outside the installation.",
|      "info": {
|        "what": "The folder the asset tagging engine reads its tagging rule files from.",
|        "whenChanged": "Point it at your own folder to tag with your own rule files instead of the shipped ones. A missing folder stops the run with a clear error. The Risk Analysis and privilege tier launchers set their own folder and ignore this value.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Read by: asset-tagging.",
|        "default": "The shipped rule files next to the endpoint enrichment rules.",
|        "recommended": "Keep the default. Change it when: Only when you keep your own tagging rule files outside the installation.",
|        "docUrl": "https://invardia.com/docs/si/settings/SettingsPath/"
|      }
|    },
|    {
|      "name": "SHODAN_ApiKey",
|      "label": "Shodan API key (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": true,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: the key under its current name is used; without any key, Shodan details stay empty.",
|      "description": "Shodan API key (required for the engine to do anything useful).",
|      "purpose": "Older name for the Shodan API key the public IP engine uses to look up your public IP addresses.",
|      "effect": "Used only when SI_Shodan_ApiKey is not set. Without any key the public IP engine still runs, but every Shodan field (open ports, services, vulnerabilities) is empty.",
|      "whenToChange": "Prefer SI_Shodan_ApiKey; keep this only for older configuration files.",
|      "info": {
|        "what": "Older name for the Shodan API key the public IP engine uses to look up your public IP addresses.",
|        "whenChanged": "Used only when SI_Shodan_ApiKey is not set. Without any key the public IP engine still runs, but every Shodan field (open ports, services, vulnerabilities) is empty.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault.",
|        "default": "Not set: the key under its current name is used; without any key, Shodan details stay empty.",
|        "recommended": "Keep the default. Change it when: Prefer SI_Shodan_ApiKey; keep this only for older configuration files.",
|        "docUrl": "https://invardia.com/docs/si/settings/SHODAN_ApiKey/"
|      }
|    },
|    {
|      "name": "ShowConfig",
|      "label": "Show resolved configuration",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off.",
|      "description": "When on, risk analysis prints the fully resolved configuration at start-up so you can see which values are in effect; off by default.",
|      "purpose": "Prints the configuration risk analysis actually uses at start-up, so you can see which values are in effect.",
|      "effect": "On adds a configuration listing to the run log, including identifiers from your setup; no effect on reports.",
|      "whenToChange": "When troubleshooting which value is in effect.",
|      "info": {
|        "what": "Prints the configuration risk analysis actually uses at start-up, so you can see which values are in effect.",
|        "whenOn": "On adds a configuration listing to the run log, including identifiers from your setup; no effect on reports.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off.",
|        "recommended": "Keep the default. Change it when: When troubleshooting which value is in effect.",
|        "docUrl": "https://invardia.com/docs/si/settings/ShowConfig/"
|      }
|    },
|    {
|      "name": "SI_ActiveStaleDays",
|      "label": "Active asset freshness window",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": 30,
|      "defaultText": "30 days",
|      "description": "--- Active-asset freshness threshold (preview.87+) --- Asset is IsEnabledActive=$true when seen by a provider within N days.",
|      "purpose": "Sets how recently an asset must have been seen (or an identity signed in) to count as active.",
|      "effect": "Lower values mark more assets inactive; inactive endpoints are left out of the profile output and identities without a recent sign-in are flagged inactive. Higher values keep older, possibly retired assets in reports.",
|      "whenToChange": "Most installs keep 30. Lower for tighter hygiene reporting; raise if devices are often offline for long periods.",
|      "unit": "days",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Sets how recently an asset must have been seen (or an identity signed in) to count as active.",
|        "whenChanged": "Lower values mark more assets inactive; inactive endpoints are left out of the profile output and identities without a recent sign-in are flagged inactive. Higher values keep older, possibly retired assets in reports.",
|        "risk": "A shorter value marks more assets inactive: devices not seen within it leave the profiles and reports (a device offline for a week or two can drop out). Reversible: the next run includes them again.",
|        "requires": "Read by: azure, endpoint, identity, publicip.",
|        "default": "30 days",
|        "recommended": "30 days.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ActiveStaleDays/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter value marks more assets inactive: devices not seen within it leave the profiles and reports (a device offline for a week or two can drop out). Reversible: the next run includes them again."
|      }
|    },
|    {
|      "name": "SI_AI_CostPerCallEstimate",
|      "label": "AI cost per call estimate",
|      "group": "AI",
|      "type": "number",
|      "engines": [
|        "identity"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 0.01,
|      "defaultText": "0.01 USD per call",
|      "description": "Per-call cost estimate (USD). Default 0.01. Tune after observing actuals.",
|      "purpose": "The estimated price in US dollars of one AI call, used to keep each run within its AI spending budget.",
|      "effect": "The engines count this amount per AI call against the run's AI budget. A higher estimate stops AI calls sooner (more assets classified by rules only); a lower one allows more calls and higher real cost.",
|      "whenToChange": "After a few real runs, set it to your observed cost per call.",
|      "unit": "USD",
|      "info": {
|        "what": "The estimated price in US dollars of one AI call, used to keep each run within its AI spending budget.",
|        "whenChanged": "The engines count this amount per AI call against the run's AI budget. A higher estimate stops AI calls sooner (more assets classified by rules only); a lower one allows more calls and higher real cost.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: identity.",
|        "default": "0.01 USD per call",
|        "recommended": "Keep the default. Change it when: After a few real runs, set it to your observed cost per call.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AI_CostPerCallEstimate/"
|      }
|    },
|    {
|      "name": "SI_AISummary_Leader",
|      "label": "Leading report for AI summary",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "enum",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Detailed is the leading report.",
|      "description": "WHICH REPORT IS THE SOURCE OF TRUTH in 'Consistent' mode. The leader always builds its own figures and never adopts anyone else's; the other report adopts the leader's. Default 'Summary', because that is the grain an executive audience usually reads -- set 'Detailed' if your management receives the Detailed report instead and the relationship inverts cleanly. There is deliberately NO time window deciding who wins. An earlier design said \"the first report of the cycle wins\", but a cycle cannot be identified from a clock: your two runs may legitimately fall on different UTC days (Summary late evening, Detailed early morning), and a long run can straddle midnight by itself. Naming a leader removes the question entirely -- the pairing survives any schedule, timezone or run duration, and the follower's figures can never appear in the leader's mail.",
|      "purpose": "In Consistent mode, chooses which report (Summary or Detailed) builds the AI summary, risk score and top list that the other report reuses.",
|      "effect": "The leading report always computes its own figures; the other copies them so both mails agree. An unknown value falls back to Detailed with a warning. Ignored in PerReport mode. With the Summary step off (the default) only the Detailed report runs, so it always leads.",
|      "whenToChange": "Set to Summary only when the Summary step is switched on and management mainly receives the Summary report.",
|      "values": [
|        "Summary",
|        "Detailed"
|      ],
|      "valueLabels": {
|        "Summary": "Summary report leads",
|        "Detailed": "Detailed report leads"
|      },
|      "card": "Summary and Detailed agreement",
|      "info": {
|        "what": "In Consistent mode, chooses which report (Summary or Detailed) builds the AI summary, risk score and top list that the other report reuses.",
|        "whenChanged": "The leading report always computes its own figures; the other copies them so both mails agree. An unknown value falls back to Detailed with a warning. Ignored in PerReport mode. With the Summary step off (the default) only the Detailed report runs, so it always leads.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Detailed is the leading report.",
|        "recommended": "Keep the default. Change it when: Set to Summary only when the Summary step is switched on and management mainly receives the Summary report.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AISummary_Leader/"
|      }
|    },
|    {
|      "name": "SI_AISummary_MaxAgeHours",
|      "label": "AI summary reuse age limit",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "24 hours.",
|      "description": "How stale the leader's snapshot may be before the other report stops adopting it and builds its own instead. A BACKSTOP only -- it does not decide who leads. It exists so a snapshot left behind by a host that was offline for a week is not carried into today's mail. Ignored in 'PerReport' mode, which never adopts.",
|      "purpose": "How old the leading report's saved summary may be before the other report stops reusing it and builds its own.",
|      "effect": "Higher lets an older summary be reused, so figures can be stale after a missed run. Lower makes the follower build its own figures more often, costing more AI calls.",
|      "whenToChange": "Only if your two reports run more than a day apart.",
|      "unit": "hours",
|      "info": {
|        "what": "How old the leading report's saved summary may be before the other report stops reusing it and builds its own.",
|        "whenChanged": "Higher lets an older summary be reused, so figures can be stale after a missed run. Lower makes the follower build its own figures more often, costing more AI calls.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "24 hours.",
|        "recommended": "Keep the default. Change it when: Only if your two reports run more than a day apart.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AISummary_MaxAgeHours/"
|      }
|    },
|    {
|      "name": "SI_AISummary_Mode",
|      "label": "Summary and Detailed agreement",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "enum",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Depends on the edition. SecurityInsight Pro: PerReport -- each report shows its own figures (Summary counts distinct assets, Detailed counts individual findings). Community: Consistent -- both reports show the same figures. A value you set wins in both editions.",
|      "description": "--- AI executive summary (RA) --------------------------------------------- HOW THE SUMMARY AND DETAILED REPORTS RELATE TO EACH OTHER. The two reports count different things and always will: Summary counts distinct ASSETS, Detailed counts individual ASSET FINDINGS (one asset can carry many). The same estate therefore produces different totals and percentages in the two reports. What you choose here is whether the two reports are made to AGREE, or whether each simply reports its own grain. Either way both mails now carry a line under the KPI explaining why the figures differ. 'Consistent' (Community default) -- the leading report builds the AI narrative, the headline Risk Score KPI and the Top-50 list, and the other report REUSES them verbatim, so both mails show identical figures. Choose this where management receives BOTH reports. 'PerReport' (Pro default) -- each report computes and shows its own numbers and never adopts the other's. Choose this where management receives ONE report, or where each report should be true to its own grain. Leave unset for the edition's default: 'Consistent' in Community -- what every install did before this setting existed, so upgrading changes nothing -- and 'PerReport' in SecurityInsight Pro, where the web app shows Summary and Detailed side by side. A value you set here wins in both editions.",
|      "purpose": "Chooses whether the Summary and Detailed reports show identical AI summary, risk score and top list, or each shows its own figures.",
|      "effect": "Consistent makes one report reuse the other's figures, saving AI calls. PerReport makes each report compute its own, so totals differ. Unknown values fall back to the edition's default.",
|      "whenToChange": "Choose PerReport when each audience receives only one report, or (Pro) to compare Summary and Detailed in the web app. Choose Consistent when management receives both mails and they must show the same figures.",
|      "values": [
|        "Consistent",
|        "PerReport"
|      ],
|      "valueLabels": {
|        "Consistent": "Same figures in both reports, from the leading report",
|        "PerReport": "Each report shows its own figures"
|      },
|      "card": "Summary and Detailed agreement",
|      "info": {
|        "what": "Chooses whether the Summary and Detailed reports show identical AI summary, risk score and top list, or each shows its own figures.",
|        "whenChanged": "Consistent makes one report reuse the other's figures, saving AI calls. PerReport makes each report compute its own, so totals differ. Unknown values fall back to the edition's default.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Depends on the edition. SecurityInsight Pro: PerReport -- each report shows its own figures (Summary counts distinct assets, Detailed counts individual findings). Community: Consistent -- both reports show the same figures. A value you set wins in both editions.",
|        "recommended": "Keep the default. Change it when: Choose PerReport when each audience receives only one report, or (Pro) to compare Summary and Detailed in the web app. Choose Consistent when management receives both mails and they must show the same figures.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AISummary_Mode/"
|      }
|    },
|    {
|      "name": "SI_AssetDecisionsPath",
|      "label": "Asset decisions file",
|      "group": "Collection scope & limits",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "The asset decisions file in the config folder and in your enrichment data folder, if they exist.",
|      "description": "--- asset decisions (tier overrides, exceptions, exemptions) ----------------- Default: config\\asset-decisions.custom.yaml (copy the .sample.yaml next to it).",
|      "purpose": "Path to your file of asset decisions: tier overrides, exceptions and exemptions applied during profiling.",
|      "effect": "When set, only this file is read and the default locations are ignored. A path that does not exist is reported, and none of your decisions are applied.",
|      "whenToChange": "When you keep the decisions file outside the installation folder.",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Path to your file of asset decisions: tier overrides, exceptions and exemptions applied during profiling.",
|        "whenChanged": "When set, only this file is read and the default locations are ignored. A path that does not exist is reported, and none of your decisions are applied.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "The asset decisions file in the config folder and in your enrichment data folder, if they exist.",
|        "recommended": "Keep the default. Change it when: When you keep the decisions file outside the installation folder.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetDecisionsPath/"
|      }
|    },
|    {
|      "name": "SI_AssetLimit_Azure",
|      "label": "Azure asset limit",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "azure"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 0,
|      "defaultText": "No limit (every discovered resource).",
|      "description": "Asset limit -- 0 means no limit. Smoke tests on production tenants MUST keep this at 0; sliced samples hide pagination, throttling, and rare-type bugs.",
|      "purpose": "Caps how many discovered Azure resources the Azure engine processes in one run, for testing.",
|      "effect": "Keeps only the first N resources after discovery, so runs are faster but the inventory and every report built on it are incomplete. A command-line value wins over this.",
|      "whenToChange": "Never in production; only for quick local tests.",
|      "unit": "assets",
|      "info": {
|        "what": "Caps how many discovered Azure resources the Azure engine processes in one run, for testing.",
|        "whenChanged": "Keeps only the first N resources after discovery, so runs are faster but the inventory and every report built on it are incomplete. A command-line value wins over this.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: azure.",
|        "default": "No limit (every discovered resource).",
|        "recommended": "Keep the default. Change it when: Never in production; only for quick local tests.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetLimit_Azure/"
|      }
|    },
|    {
|      "name": "SI_AssetLimit_Endpoint",
|      "label": "Endpoint asset limit",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "endpoint"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 0,
|      "defaultText": "No limit (every discovered device).",
|      "description": "Cap discovered assets (0 = unlimited). KEEP at 0 for production smoke tests.",
|      "purpose": "Caps how many discovered devices the endpoint engine processes in one run, for testing.",
|      "effect": "Keeps only the first N devices after discovery, so runs are faster but the inventory and every report built on it are incomplete. A command-line value wins over this.",
|      "whenToChange": "Never in production; only for quick local tests.",
|      "unit": "assets",
|      "info": {
|        "what": "Caps how many discovered devices the endpoint engine processes in one run, for testing.",
|        "whenChanged": "Keeps only the first N devices after discovery, so runs are faster but the inventory and every report built on it are incomplete. A command-line value wins over this.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: endpoint.",
|        "default": "No limit (every discovered device).",
|        "recommended": "Keep the default. Change it when: Never in production; only for quick local tests.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetLimit_Endpoint/"
|      }
|    },
|    {
|      "name": "SI_AssetLimit_Identity",
|      "label": "Identity asset limit",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "identity"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 0,
|      "defaultText": "No limit (every discovered identity).",
|      "description": "Asset limit -- 0 means no limit (process all discovered assets). Customer-side override: set $global:SI_AssetLimit_Identity in custom.ps1. Smoke tests on production tenants MUST keep this at 0; sliced samples hide scale-only bugs (pagination, throttling, large-array serialization, rare-type schema drift). Use only for local dev with mock data.",
|      "purpose": "Caps how many discovered users and service principals the identity engine processes in one run, for testing.",
|      "effect": "Keeps only the first N identities after discovery, so runs are faster but the inventory and every report built on it are incomplete. A command-line value wins over this.",
|      "whenToChange": "Never in production; only for quick local tests.",
|      "unit": "assets",
|      "info": {
|        "what": "Caps how many discovered users and service principals the identity engine processes in one run, for testing.",
|        "whenChanged": "Keeps only the first N identities after discovery, so runs are faster but the inventory and every report built on it are incomplete. A command-line value wins over this.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: identity.",
|        "default": "No limit (every discovered identity).",
|        "recommended": "Keep the default. Change it when: Never in production; only for quick local tests.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetLimit_Identity/"
|      }
|    },
|    {
|      "name": "SI_AssetLimit_PublicIp",
|      "label": "Public IP asset limit",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 0,
|      "defaultText": "No limit (every discovered public IP).",
|      "description": "Asset limit -- 0 means no limit. Smoke tests on production tenants MUST keep this at 0; sliced samples hide pagination, throttling, and rare-type bugs.",
|      "purpose": "Caps how many public IP addresses the public IP engine processes in one run, for testing.",
|      "effect": "Keeps only the first N addresses after discovery, so runs are faster and use fewer Shodan credits, but the inventory and reports are incomplete. A command-line value wins over this.",
|      "whenToChange": "Never in production; only for quick local tests.",
|      "unit": "assets",
|      "info": {
|        "what": "Caps how many public IP addresses the public IP engine processes in one run, for testing.",
|        "whenChanged": "Keeps only the first N addresses after discovery, so runs are faster and use fewer Shodan credits, but the inventory and reports are incomplete. A command-line value wins over this.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "No limit (every discovered public IP).",
|        "recommended": "Keep the default. Change it when: Never in production; only for quick local tests.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetLimit_PublicIp/"
|      }
|    },
|    {
|      "name": "SI_AssetProperties",
|      "label": "Asset properties",
|      "group": "Connectors & CMDB",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "security: the security profile only -- what SecurityInsight needs for risk",
|      "description": "Asset properties, two levels. 'security' (the default) = what SecurityInsight needs for risk: the profilers read their sources exactly as always and nothing extra is stored. 'full' = each profiler reads each source ONCE with every property, builds the same security profile from it, and publishes the whole object (Defender, Entra, Intune, AD, Azure, Exposure Graph, VM extensions) to SI_AssetProperties_CL for the CMDB hand-off; (Pro) the data sync stores every snapshot for the web app's asset page, with its history.",
|      "purpose": "How much SecurityInsight keeps about each asset: security (what SecurityInsight needs for risk) or full (all metadata from every source, kept a few days).",
|      "effect": "'security' (the default) keeps what SecurityInsight needs for risk -- name, kind, tier and the security fields each profile carries -- and stores nothing extra. 'full' also keeps every property each source knows about an asset -- Defender, Entra, Intune, Active Directory, Azure, Exposure Graph and VM extensions, including serial numbers and MAC addresses. Each source is still read only once: the profiler reads it with every property and builds the same security profile from it, so the profile does not change. The whole objects go to SI_AssetProperties_CL for the CMDB and vulnerability hand-off, and the data sync stores them in the Pro database, where the asset page shows them under \"Full metadata\" per source (lists stay lists), with a history of every snapshot kept and what changed between them. It is kept for the days set in \"Full asset metadata: days kept\" (default 3). Full adds Log Analytics ingest on every run; switching back to security stops the collection, and what was stored ages out after those days.",
|      "whenToChange": "Choose full when you want to see every property of an asset in the web app, or when SecurityInsight should hand asset metadata to a CMDB (for example ServiceNow); leave security otherwise.",
|      "values": [
|        "security",
|        "full"
|      ],
|      "valueLabels": {
|        "security": "Security: what SecurityInsight needs for risk",
|        "full": "Full: all metadata from every source, kept a few days"
|      },
|      "card": "Asset properties",
|      "hint": "Security = what SecurityInsight needs for risk. Full = all metadata from every source, kept a few days.",
|      "info": {
|        "what": "How much SecurityInsight keeps about each asset: security (what SecurityInsight needs for risk) or full (all metadata from every source, kept a few days).",
|        "whenChanged": "'security' (the default) keeps what SecurityInsight needs for risk -- name, kind, tier and the security fields each profile carries -- and stores nothing extra. 'full' also keeps every property each source knows about an asset -- Defender, Entra, Intune, Active Directory, Azure, Exposure Graph and VM extensions, including serial numbers and MAC addresses. Each source is still read only once: the profiler reads it with every property and builds the same security profile from it, so the profile does not change. The whole objects go to SI_AssetProperties_CL for the CMDB and vulnerability hand-off, and the data sync stores them in the Pro database, where the asset page shows them under \"Full metadata\" per source (lists stay lists), with a history of every snapshot kept and what changed between them. It is kept for the days set in \"Full asset metadata: days kept\" (default 3). Full adds Log Analytics ingest on every run; switching back to security stops the collection, and what was stored ages out after those days.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "security: the security profile only -- what SecurityInsight needs for risk",
|        "recommended": "Keep the default. Change it when: Choose full when you want to see every property of an asset in the web app, or when SecurityInsight should hand asset metadata to a CMDB (for example ServiceNow); leave security otherwise.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetProperties/"
|      }
|    },
|    {
|      "name": "SI_AssetProperties_ChangeGuardPercent",
|      "label": "Full asset metadata: allowed change between runs",
|      "group": "Connectors & CMDB",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "10 %",
|      "description": "How much (in percent) the full asset metadata collected from one source may change from one run to the next before the run holds that source's hand-off and raises a guard event. Default 10.",
|      "purpose": "How much the full asset metadata collected from one source may change from one run to the next before the hand-off of that source is held.",
|      "effect": "When a source (for example Defender, Entra or Azure) returns more than this share more or fewer objects than in the previous run, the previous collection of that source is kept for the CMDB and vulnerability hand-off, and a guard event is raised (mail and Operations > Guards (safety checks)). The hold ends by itself on the next run that is back within the limit, or once when an Admin releases it.",
|      "whenToChange": "Raise it if your estate legitimately changes a lot between runs; lower it to be warned of smaller changes.",
|      "unit": "%",
|      "min": 1,
|      "max": 100,
|      "card": "Asset properties",
|      "info": {
|        "what": "How much the full asset metadata collected from one source may change from one run to the next before the hand-off of that source is held.",
|        "whenChanged": "When a source (for example Defender, Entra or Azure) returns more than this share more or fewer objects than in the previous run, the previous collection of that source is kept for the CMDB and vulnerability hand-off, and a guard event is raised (mail and Operations > Guards (safety checks)). The hold ends by itself on the next run that is back within the limit, or once when an Admin releases it.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "10 %",
|        "recommended": "Keep the default. Change it when: Raise it if your estate legitimately changes a lot between runs; lower it to be warned of smaller changes.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetProperties_ChangeGuardPercent/"
|      }
|    },
|    {
|      "name": "SI_AssetProperties_RetentionDays",
|      "label": "Full asset metadata: days kept",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "3 days",
|      "description": "Days the full asset metadata is kept -- in Log Analytics (the table's retention, set by the run; Log Analytics keeps a table at least 4 days, so a lower value is raised to 4) and in the Pro database (pruned by the data sync). Default 3.",
|      "purpose": "How many days the full asset metadata is kept, in Log Analytics and in the Pro database.",
|      "effect": "The run sets the retention of SI_AssetProperties_CL to this many days (Log Analytics keeps a table at least 4 days, so a lower value is raised to 4 and the run says so), and the data sync removes older full metadata from the Pro database. Every snapshot inside these days is kept, so the asset page's history goes back this far. The data is only needed for the hand-off, the history and the change guard, so a short retention keeps the cost low.",
|      "whenToChange": "Raise it only if the full asset metadata must be looked up further back.",
|      "unit": "days",
|      "min": 1,
|      "card": "Asset properties",
|      "info": {
|        "what": "How many days the full asset metadata is kept, in Log Analytics and in the Pro database.",
|        "whenChanged": "The run sets the retention of SI_AssetProperties_CL to this many days (Log Analytics keeps a table at least 4 days, so a lower value is raised to 4 and the run says so), and the data sync removes older full metadata from the Pro database. Every snapshot inside these days is kept, so the asset page's history goes back this far. The data is only needed for the hand-off, the history and the change guard, so a short retention keeps the cost low.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "3 days",
|        "recommended": "Keep the default. Change it when: Raise it only if the full asset metadata must be looked up further back.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetProperties_RetentionDays/"
|      }
|    },
|    {
|      "name": "SI_AssetTagActivityDcr",
|      "label": "Tag activity collection rule",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "dcr-si-assettag-activity",
|      "description": "Optional: override the asset-tagging audit DCR / table (Invoke-Tagging).",
|      "purpose": "Name of the data collection rule used to send the asset-tagging activity log to Log Analytics.",
|      "effect": "Tagging activity rows are sent through this rule instead. A rule that does not match the activity table makes the activity log stop arriving.",
|      "whenToChange": "Almost never; only to avoid a name clash with an existing rule.",
|      "info": {
|        "what": "Name of the data collection rule used to send the asset-tagging activity log to Log Analytics.",
|        "whenChanged": "Tagging activity rows are sent through this rule instead. A rule that does not match the activity table makes the activity log stop arriving.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "dcr-si-assettag-activity",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a name clash with an existing rule.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetTagActivityDcr/"
|      }
|    },
|    {
|      "name": "SI_AssetTagActivityTable",
|      "label": "Tag activity table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "SI_AssetTagActivity (stored as SI_AssetTagActivity_CL).",
|      "description": "Log Analytics table that receives the asset-tagging activity log (which tags were applied or removed); defaults to SI_AssetTagActivity.",
|      "purpose": "Log Analytics table receiving the asset-tagging activity log: which tags were or would be applied or removed.",
|      "effect": "Tagging activity from both the tagging engine and the profilers' read-only tagging check goes to this table. Queries reading the standard table will no longer see new rows.",
|      "whenToChange": "Almost never; only to avoid a clash with an existing table.",
|      "info": {
|        "what": "Log Analytics table receiving the asset-tagging activity log: which tags were or would be applied or removed.",
|        "whenChanged": "Tagging activity from both the tagging engine and the profilers' read-only tagging check goes to this table. Queries reading the standard table will no longer see new rows.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "SI_AssetTagActivity (stored as SI_AssetTagActivity_CL).",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a clash with an existing table.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetTagActivityTable/"
|      }
|    },
|    {
|      "name": "SI_AssetTagging_Apply",
|      "label": "Asset tagging on a server writes tags",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [
|        "asset-tagging"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: report only, every planned tag is logged, nothing is changed",
|      "description": "Write the tags on every run (default: report only -- every planned tag is logged, nothing is changed).",
|      "purpose": "Lets the asset-tagging script on a server (launcher.community-vm.ps1) write the tags its rules select in Defender, Azure and Entra on every run, instead of only reporting them.",
|      "effect": "On, every run changes Defender machine tags, Azure resource tags and Entra custom security attributes in your tenant; -WhatIfMode on a run still makes that run report only. The identity also needs the write grants. For one run only, use -Apply instead.",
|      "whenToChange": "Turn it on after reviewing the report-only results and granting the tagging write grants. An install that wrote tags before 3.0 sets it to keep writing.",
|      "card": "Asset tagging",
|      "info": {
|        "what": "Lets the asset-tagging script on a server (launcher.community-vm.ps1) write the tags its rules select in Defender, Azure and Entra on every run, instead of only reporting them.",
|        "whenOn": "On, every run changes Defender machine tags, Azure resource tags and Entra custom security attributes in your tenant; -WhatIfMode on a run still makes that run report only. The identity also needs the write grants. For one run only, use -Apply instead.",
|        "whenOff": "report only, every planned tag is logged, nothing is changed",
|        "risk": "Writes to your tenant: every run changes Defender machine tags, Azure resource tags and Entra custom security attributes. A wrong rule tags or untags many objects at once. Reversible only by changing the rules and running again (or by hand); the audit trail records every change.",
|        "requires": "Read by: asset-tagging.",
|        "default": "Off: report only, every planned tag is logged, nothing is changed",
|        "recommended": "Off until the report-only output has been reviewed; then on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetTagging_Apply/",
|        "confirmWhen": "on",
|        "confirm": "On, every run changes Defender machine tags, Azure resource tags and Entra custom security attributes in your tenant; -WhatIfMode on a run still makes that run report only. The identity also needs the write grants. For one run only, use -Apply instead. Writes to your tenant: every run changes Defender machine tags, Azure resource tags and Entra custom security attributes. A wrong rule tags or untags many objects at once. Reversible only by changing the rules and running again (or by hand); the audit trail records every change."
|      }
|    },
|    {
|      "name": "SI_AssetTagging_Enabled",
|      "label": "Asset tagging",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: no tagging rule sets a tag anywhere and no report treats a device as excluded because of one",
|      "description": "Asset tagging (#643). Off by default: the asset-tagging rules (e.g. Auto-CanBeOnboarded--Excluded--SI) set no tag anywhere -- not on the CIs inside SecurityInsight, not in Defender, Azure or Entra -- and no report treats a device as excluded because of a tagging rule (a tag an earlier tagging run wrote is ignored). Your own exclusion tags keep working. On: the rules apply inside SecurityInsight; writing to your tenant is still the separate SI_Pro_AssetTagging_Apply / SI_AssetTagging_Apply.",
|      "purpose": "Turns asset tagging on: the asset-tagging rules (for example Auto-CanBeOnboarded--Excluded--SI for the devices Defender can onboard) apply inside SecurityInsight, and the tagging job may run.",
|      "effect": "On, the asset-tagging rules you have switched on tag the CIs inside SecurityInsight, and a rule whose tag ends in --Excluded--SI takes the device out of every report. Writing the tags to Defender, Azure and Entra stays the separate 'Asset tagging writes tags' setting. Off, no tagging rule tags anything, the tagging job does not run, and a tag an earlier tagging run wrote is ignored; your own exclusion tags keep working.",
|      "whenToChange": "Turn it on when you want the automatic exclusion rules (devices Defender cannot onboard, name patterns) to take devices out of the reports -- and check the Excluded assets report afterwards.",
|      "card": "Asset tagging",
|      "info": {
|        "what": "Turns asset tagging on: the asset-tagging rules (for example Auto-CanBeOnboarded--Excluded--SI for the devices Defender can onboard) apply inside SecurityInsight, and the tagging job may run.",
|        "whenOn": "On, the asset-tagging rules you have switched on tag the CIs inside SecurityInsight, and a rule whose tag ends in --Excluded--SI takes the device out of every report. Writing the tags to Defender, Azure and Entra stays the separate 'Asset tagging writes tags' setting. Off, no tagging rule tags anything, the tagging job does not run, and a tag an earlier tagging run wrote is ignored; your own exclusion tags keep working.",
|        "whenOff": "no tagging rule sets a tag anywhere and no report treats a device as excluded because of one",
|        "risk": "The tagging rules you have switched on take devices out of every report (a tag ending in --Excluded--SI). A wrong rule hides many devices at once. Reversible: turn it off and the next CI build puts them back.",
|        "requires": "Nothing else.",
|        "default": "Off: no tagging rule sets a tag anywhere and no report treats a device as excluded because of one",
|        "recommended": "Off until you have decided which automatic exclusions you want; then on, and check the Excluded assets report.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetTagging_Enabled/",
|        "confirmWhen": "on",
|        "confirm": "On, the asset-tagging rules you have switched on tag the CIs inside SecurityInsight, and a rule whose tag ends in --Excluded--SI takes the device out of every report. Writing the tags to Defender, Azure and Entra stays the separate 'Asset tagging writes tags' setting. Off, no tagging rule tags anything, the tagging job does not run, and a tag an earlier tagging run wrote is ignored; your own exclusion tags keep working. The tagging rules you have switched on take devices out of every report (a tag ending in --Excluded--SI). A wrong rule hides many devices at once. Reversible: turn it off and the next CI build puts them back."
|      }
|    },
|    {
|      "name": "SI_AuthMethod",
|      "label": "Sign-in method",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Keeps a configured service principal; otherwise the host's managed identity",
|      "description": "THE sign-in choice. Managed identity is the default for a new install: an Azure VM or an Azure Arc-enabled server uses its system-assigned identity; give a client id to use a user-assigned one. When SI_AuthMethod is NOT set, an existing install keeps what it has: a configured SPN stays the SPN.",
|      "purpose": "Chooses how SecurityInsight signs in to Microsoft services: managed identity, service principal with certificate, or service principal with client secret.",
|      "effect": "Decides which identity every engine uses, and therefore which permissions must be granted. An unknown value stops the run with an error. Choosing a service principal switches managed-identity sign-in off.",
|      "whenToChange": "Set during setup. Change when moving between managed identity and a service principal.",
|      "card": "How SecurityInsight signs in",
|      "info": {
|        "what": "Chooses how SecurityInsight signs in to Microsoft services: managed identity, service principal with certificate, or service principal with client secret.",
|        "whenChanged": "Decides which identity every engine uses, and therefore which permissions must be granted. An unknown value stops the run with an error. Choosing a service principal switches managed-identity sign-in off.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Keeps a configured service principal; otherwise the host's managed identity",
|        "recommended": "Keep the default. Change it when: Set during setup. Change when moving between managed identity and a service principal.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AuthMethod/"
|      }
|    },
|    {
|      "name": "SI_AutoBucketDefaultDetailed",
|      "label": "Detailed report starting buckets",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "2 slices.",
|      "description": "Default bucket count for the Detailed run before adaptive bucketing takes over (default 2).",
|      "purpose": "How many slices a Detailed Risk Analysis query is split into on the first try, before automatic splitting adapts.",
|      "effect": "More slices avoid query timeouts on very large tenants but add overhead per slice, making small tenants slower. A per-report bucket count in the report template still wins.",
|      "whenToChange": "Only if Detailed reports repeatedly time out on a very large tenant.",
|      "unit": "buckets",
|      "info": {
|        "what": "How many slices a Detailed Risk Analysis query is split into on the first try, before automatic splitting adapts.",
|        "whenChanged": "More slices avoid query timeouts on very large tenants but add overhead per slice, making small tenants slower. A per-report bucket count in the report template still wins.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "2 slices.",
|        "recommended": "Keep the default. Change it when: Only if Detailed reports repeatedly time out on a very large tenant.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AutoBucketDefaultDetailed/"
|      }
|    },
|    {
|      "name": "SI_AutoBucketSubFanOut",
|      "label": "Query split fan-out",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "4 pieces per split.",
|      "description": "sub-buckets created per split",
|      "purpose": "How many smaller pieces a timed-out Risk Analysis query slice is split into each time.",
|      "effect": "More pieces shrink heavy slices faster but run more queries; fewer pieces mean more split rounds. No rows are lost either way.",
|      "whenToChange": "Rarely; only when tuning very large tenants with support.",
|      "unit": "pieces",
|      "info": {
|        "what": "How many smaller pieces a timed-out Risk Analysis query slice is split into each time.",
|        "whenChanged": "More pieces shrink heavy slices faster but run more queries; fewer pieces mean more split rounds. No rows are lost either way.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "4 pieces per split.",
|        "recommended": "Keep the default. Change it when: Rarely; only when tuning very large tenants with support.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AutoBucketSubFanOut/"
|      }
|    },
|    {
|      "name": "SI_AzSubscriptionId",
|      "label": "Azure subscription for ingestion",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Taken from the workspace resource id, else SubscriptionId",
|      "description": "Subscription override for DCR merge diagnostics + ad-hoc setup helpers.",
|      "purpose": "The Azure subscription in which the engines look up and create the data collection endpoint and rules.",
|      "effect": "Scopes all endpoint and rule lookups and resource creation to this subscription. A wrong value makes ingestion refuse to post or create resources in the wrong subscription.",
|      "whenToChange": "Only when the ingestion resources live in a different subscription than the workspace.",
|      "info": {
|        "what": "The Azure subscription in which the engines look up and create the data collection endpoint and rules.",
|        "whenChanged": "Scopes all endpoint and rule lookups and resource creation to this subscription. A wrong value makes ingestion refuse to post or create resources in the wrong subscription.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Taken from the workspace resource id, else SubscriptionId",
|        "recommended": "Keep the default. Change it when: Only when the ingestion resources live in a different subscription than the workspace.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzSubscriptionId/"
|      }
|    },
|    {
|      "name": "SI_Azure_DcrName",
|      "label": "Azure profile collection rule",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "dcr-si-azure-profile (from the standard naming pattern).",
|      "description": "Overrides the data collection rule name the Azure profiling engine ingests through; when empty, the standard naming pattern is used.",
|      "purpose": "Name of the data collection rule the Azure profiling engine sends its results through.",
|      "effect": "Azure profile rows are ingested through this rule instead. Useful to avoid picking up a same-named rule from an older install; a wrong name makes ingestion fail.",
|      "whenToChange": "Only when another rule with the standard name is visible to the identity.",
|      "info": {
|        "what": "Name of the data collection rule the Azure profiling engine sends its results through.",
|        "whenChanged": "Azure profile rows are ingested through this rule instead. Useful to avoid picking up a same-named rule from an older install; a wrong name makes ingestion fail.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "dcr-si-azure-profile (from the standard naming pattern).",
|        "recommended": "Keep the default. Change it when: Only when another rule with the standard name is visible to the identity.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Azure_DcrName/"
|      }
|    },
|    {
|      "name": "SI_Azure_TableName",
|      "label": "Azure profile table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "SI_Azure_Profile (stored as SI_Azure_Profile_CL).",
|      "description": "Overrides the Log Analytics table the Azure profiling engine writes to; when empty, the standard SI_Azure_Profile table is used.",
|      "purpose": "Log Analytics table the Azure profiling engine writes its asset profiles to.",
|      "effect": "Azure profiles go to this table instead. Risk Analysis and workbooks that read the standard table will no longer see new Azure data unless changed too.",
|      "whenToChange": "Almost never; only to avoid a clash with an existing table.",
|      "info": {
|        "what": "Log Analytics table the Azure profiling engine writes its asset profiles to.",
|        "whenChanged": "Azure profiles go to this table instead. Risk Analysis and workbooks that read the standard table will no longer see new Azure data unless changed too.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "SI_Azure_Profile (stored as SI_Azure_Profile_CL).",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a clash with an existing table.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Azure_TableName/"
|      }
|    },
|    {
|      "name": "SI_AzureEgNonAssetTypes",
|      "label": "Azure types not treated as assets",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Role and policy assignments and definitions, locks and diagnostic settings.",
|      "description": "Exposure Graph node types treated as NOT assets (extension resources). Default: role/policy assignments, locks, diagnostic settings.",
|      "purpose": "Azure resource types from the exposure graph that are settings on other resources, not assets, and are left out of Azure collection.",
|      "effect": "Replaces the list. Removing a type brings those items back as Azure assets, which can greatly increase row counts and duplicates; adding a type removes it from collection.",
|      "whenToChange": "Only if you genuinely want one of these types profiled, or another type excluded.",
|      "info": {
|        "what": "Azure resource types from the exposure graph that are settings on other resources, not assets, and are left out of Azure collection.",
|        "whenChanged": "Replaces the list. Removing a type brings those items back as Azure assets, which can greatly increase row counts and duplicates; adding a type removes it from collection.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "Role and policy assignments and definitions, locks and diagnostic settings.",
|        "recommended": "Keep the default. Change it when: Only if you genuinely want one of these types profiled, or another type excluded.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureEgNonAssetTypes/"
|      }
|    },
|    {
|      "name": "SI_AzureEgTypeAllowlist",
|      "label": "Azure exposure graph type list",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Every Azure type in the exposure graph, minus role/policy assignments, locks and diagnostic settings.",
|      "description": "EG node-label allowlist for Azure types (default = enumerated weekly).",
|      "purpose": "Fixes which Azure resource types are read from the Defender exposure graph, the Azure engine's main source.",
|      "effect": "Replaces the automatically discovered type list entirely, so only the types you list are collected from the exposure graph. New Azure types are no longer picked up automatically, and the built-in exclusion of non-asset types no longer applies.",
|      "whenToChange": "Only to narrow collection to specific types, for example in a very large estate.",
|      "info": {
|        "what": "Fixes which Azure resource types are read from the Defender exposure graph, the Azure engine's main source.",
|        "whenChanged": "Replaces the automatically discovered type list entirely, so only the types you list are collected from the exposure graph. New Azure types are no longer picked up automatically, and the built-in exclusion of non-asset types no longer applies.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "Every Azure type in the exposure graph, minus role/policy assignments, locks and diagnostic settings.",
|        "recommended": "Keep the default. Change it when: Only to narrow collection to specific types, for example in a very large estate.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureEgTypeAllowlist/"
|      }
|    },
|    {
|      "name": "SI_AzureExcludeTypes",
|      "label": "Azure resource types to skip",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Only the built-in list of 7 noisy types (alerts, assessments, policy states and similar) is skipped.",
|      "description": "Additional types to EXCLUDE on top of the engine's noisy-types list.",
|      "purpose": "Extra Azure resource types the Resource Graph source leaves out, on top of the built-in list of noisy types.",
|      "effect": "The types you list are added to the built-in skip list for the Resource Graph source, reducing data volume and run time. Resources of those types disappear from the Azure inventory unless the exposure graph also returns them.",
|      "whenToChange": "When a high-volume type adds noise to your Azure inventory.",
|      "info": {
|        "what": "Extra Azure resource types the Resource Graph source leaves out, on top of the built-in list of noisy types.",
|        "whenChanged": "The types you list are added to the built-in skip list for the Resource Graph source, reducing data volume and run time. Resources of those types disappear from the Azure inventory unless the exposure graph also returns them.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "Only the built-in list of 7 noisy types (alerts, assessments, policy states and similar) is skipped.",
|        "recommended": "Keep the default. Change it when: When a high-volume type adds noise to your Azure inventory.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureExcludeTypes/"
|      }
|    },
|    {
|      "name": "SI_AzureExposureGraph_AccessEdgeLabels",
|      "label": "Azure access relationship types",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The shipped list of 6 relationship types, such as 'has access to' and 'has permissions to'.",
|      "description": "Exposure-graph relationship types (such as \"has access to\") treated as access paths from identities to Azure resources; the shipped list is used when empty.",
|      "purpose": "Which exposure graph relationship types count as an identity having access to an Azure resource.",
|      "effect": "Changes which access paths are counted when the engine works out which privileged identities can reach each Azure resource. A list that misses real relationship names leaves those counts empty.",
|      "whenToChange": "Only if your Defender exposure graph uses non-standard relationship names.",
|      "info": {
|        "what": "Which exposure graph relationship types count as an identity having access to an Azure resource.",
|        "whenChanged": "Changes which access paths are counted when the engine works out which privileged identities can reach each Azure resource. A list that misses real relationship names leaves those counts empty.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "The shipped list of 6 relationship types, such as 'has access to' and 'has permissions to'.",
|        "recommended": "Keep the default. Change it when: Only if your Defender exposure graph uses non-standard relationship names.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureExposureGraph_AccessEdgeLabels/"
|      }
|    },
|    {
|      "name": "SI_AzureExposureGraph_IdentityLabels",
|      "label": "Azure access identity types",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "User, service principal, managed identity and group.",
|      "description": "Exposure-graph node types treated as identities (such as user and service principal) when mapping who can access Azure resources; the shipped list is used when empty.",
|      "purpose": "Which exposure graph node types are treated as identities when mapping who can access Azure resources.",
|      "effect": "Changes which kinds of identity are counted as having access to Azure resources. Leaving a type out hides access held by that kind of identity.",
|      "whenToChange": "Only if your Defender exposure graph uses non-standard node names.",
|      "info": {
|        "what": "Which exposure graph node types are treated as identities when mapping who can access Azure resources.",
|        "whenChanged": "Changes which kinds of identity are counted as having access to Azure resources. Leaving a type out hides access held by that kind of identity.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "User, service principal, managed identity and group.",
|        "recommended": "Keep the default. Change it when: Only if your Defender exposure graph uses non-standard node names.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureExposureGraph_IdentityLabels/"
|      }
|    },
|    {
|      "name": "SI_AzureExposureGraph_ResourceLabels",
|      "label": "Azure exposure graph resource types",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The shipped list of 16 resource types; access mapping also includes every other Azure resource type.",
|      "description": "EG node + edge label overrides (only when XDR schema is non-standard).",
|      "purpose": "Which exposure graph node types are treated as Azure resources for extra exposure details and access mapping.",
|      "effect": "Restricts exposure detail lookups and access mapping to the types you list. Once set, access mapping no longer covers every other Azure resource type, so access counts can shrink.",
|      "whenToChange": "Only if your Defender exposure graph uses non-standard node names.",
|      "info": {
|        "what": "Which exposure graph node types are treated as Azure resources for extra exposure details and access mapping.",
|        "whenChanged": "Restricts exposure detail lookups and access mapping to the types you list. Once set, access mapping no longer covers every other Azure resource type, so access counts can shrink.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "The shipped list of 16 resource types; access mapping also includes every other Azure resource type.",
|        "recommended": "Keep the default. Change it when: Only if your Defender exposure graph uses non-standard node names.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureExposureGraph_ResourceLabels/"
|      }
|    },
|    {
|      "name": "SI_AzureMaxResources",
|      "label": "Azure Resource Graph row cap",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "No cap of its own; Resource Graph's own limit still applies.",
|      "description": "Hard cap on resources pulled from ARG in one run (0 = ARG's own 100k cap applies). Use a smaller value for first-runs in big tenants (limits AI metaprofile spend).",
|      "purpose": "A safety cap on how many resources the Azure engine pulls from Azure Resource Graph in one run.",
|      "effect": "Stops reading Resource Graph once the cap is reached, which shortens first runs in large estates and limits AI spend. Resources beyond the cap are missing unless the exposure graph returns them.",
|      "whenToChange": "For a first run in a very large estate; remove it afterwards.",
|      "unit": "rows",
|      "info": {
|        "what": "A safety cap on how many resources the Azure engine pulls from Azure Resource Graph in one run.",
|        "whenChanged": "Stops reading Resource Graph once the cap is reached, which shortens first runs in large estates and limits AI spend. Resources beyond the cap are missing unless the exposure graph returns them.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "No cap of its own; Resource Graph's own limit still applies.",
|        "recommended": "Keep the default. Change it when: For a first run in a very large estate; remove it afterwards.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureMaxResources/"
|      }
|    },
|    {
|      "name": "SI_AzureRecommendation_DcrName",
|      "label": "Azure recommendations collection rule",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "dcr-si-azure-recommendation",
|      "description": "Data collection rule name used to ingest Azure (Defender for Cloud) recommendations; defaults to dcr-si-azure-recommendation.",
|      "purpose": "Name of the data collection rule used to send Defender for Cloud recommendations to Log Analytics.",
|      "effect": "Recommendations are sent through this rule instead. A rule that does not match the recommendations table makes them stop arriving.",
|      "whenToChange": "Almost never; only to avoid a name clash with an existing rule.",
|      "info": {
|        "what": "Name of the data collection rule used to send Defender for Cloud recommendations to Log Analytics.",
|        "whenChanged": "Recommendations are sent through this rule instead. A rule that does not match the recommendations table makes them stop arriving.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "dcr-si-azure-recommendation",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a name clash with an existing rule.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureRecommendation_DcrName/"
|      }
|    },
|    {
|      "name": "SI_AzureRecommendation_TableName",
|      "label": "Azure recommendations table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "SI_AzureRecommendation (stored as SI_AzureRecommendation_CL).",
|      "description": "Log Analytics table that receives Azure (Defender for Cloud) recommendations; defaults to SI_AzureRecommendation.",
|      "purpose": "Log Analytics table that receives Defender for Cloud recommendations collected with the Azure engine.",
|      "effect": "Recommendations go to this table instead. Queries reading the standard table will no longer see new rows.",
|      "whenToChange": "Almost never; only to avoid a clash with an existing table.",
|      "info": {
|        "what": "Log Analytics table that receives Defender for Cloud recommendations collected with the Azure engine.",
|        "whenChanged": "Recommendations go to this table instead. Queries reading the standard table will no longer see new rows.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "SI_AzureRecommendation (stored as SI_AzureRecommendation_CL).",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a clash with an existing table.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureRecommendation_TableName/"
|      }
|    },
|    {
|      "name": "SI_AzureResourceTypes",
|      "label": "Azure resource types to collect",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Every resource type the sign-in identity can read.",
|      "description": "Restrict discovery to a hand-picked allowlist (default = ALL ARG-readable types).",
|      "purpose": "Restricts the Azure Resource Graph source to a hand-picked list of resource types.",
|      "effect": "Only the listed types are read from Resource Graph, which lowers run time and data volume. Other types then come only from the exposure graph, so brand-new resources of those types may be missed.",
|      "whenToChange": "Only when you deliberately want a narrow Azure inventory.",
|      "info": {
|        "what": "Restricts the Azure Resource Graph source to a hand-picked list of resource types.",
|        "whenChanged": "Only the listed types are read from Resource Graph, which lowers run time and data volume. Other types then come only from the exposure graph, so brand-new resources of those types may be missed.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "Every resource type the sign-in identity can read.",
|        "recommended": "Keep the default. Change it when: Only when you deliberately want a narrow Azure inventory.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureResourceTypes/"
|      }
|    },
|    {
|      "name": "SI_AzureSubscriptionExcludePatterns",
|      "label": "Subscriptions skipped for identity roles",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [
|        "identity"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "No subscriptions skipped; every visible subscription is scanned.",
|      "description": "Subscriptions to EXCLUDE from delegation enumeration (wildcard match).",
|      "purpose": "Subscription names (wildcards allowed) skipped when the identity engine scans Azure role assignments.",
|      "effect": "Role assignments in matching subscriptions are ignored, which speeds up the scan but hides privileges granted there, so identities may get a lower tier than they really hold.",
|      "whenToChange": "To skip personal, trial or lab subscriptions that do not matter for privilege.",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Subscription names (wildcards allowed) skipped when the identity engine scans Azure role assignments.",
|        "whenChanged": "Role assignments in matching subscriptions are ignored, which speeds up the scan but hides privileges granted there, so identities may get a lower tier than they really hold.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: identity.",
|        "default": "No subscriptions skipped; every visible subscription is scanned.",
|        "recommended": "Keep the default. Change it when: To skip personal, trial or lab subscriptions that do not matter for privilege.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureSubscriptionExcludePatterns/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_AcrName",
|      "label": "Container registry name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "acrsecurityinsight (new installs get a name chosen by setup)",
|      "description": "Name of the Azure Container Registry that holds the SecurityInsight container image; created by the container setup if it does not exist.",
|      "purpose": "Name of the Azure Container Registry that holds the SecurityInsight container image; container setup creates it if it does not exist.",
|      "effect": "Setup builds and stores the image in this registry and the jobs pull from it. A new name creates a new registry and image; updates also use it to find a container install.",
|      "whenToChange": "Only before the first container setup, to follow your naming rules.",
|      "info": {
|        "what": "Name of the Azure Container Registry that holds the SecurityInsight container image; container setup creates it if it does not exist.",
|        "whenChanged": "Setup builds and stores the image in this registry and the jobs pull from it. A new name creates a new registry and image; updates also use it to find a container install.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "acrsecurityinsight (new installs get a name chosen by setup)",
|        "recommended": "Keep the default. Change it when: Only before the first container setup, to follow your naming rules.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_AcrName/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_Engines",
|      "label": "Container jobs to deploy",
|      "group": "Schedules & what runs",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "All standard engines, plus asset trend and the Pro engines where installed",
|      "description": "the default (+ the Pro engines where present)",
|      "purpose": "The list of engines container setup creates scheduled jobs for.",
|      "effect": "Only the listed engines get a job. When you set a list it is used exactly as given, so Pro and trend jobs are not added automatically. The role classifier is left out when Azure OpenAI is not configured.",
|      "whenToChange": "When you want fewer jobs, or an engine not deployed by default, such as schema discovery.",
|      "card": "Container jobs",
|      "setupOnly": true,
|      "info": {
|        "what": "The list of engines container setup creates scheduled jobs for.",
|        "whenChanged": "Only the listed engines get a job. When you set a list it is used exactly as given, so Pro and trend jobs are not added automatically. The role classifier is left out when Azure OpenAI is not configured.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "All standard engines, plus asset trend and the Pro engines where installed",
|        "recommended": "Keep the default. Change it when: When you want fewer jobs, or an engine not deployed by default, such as schema discovery.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_Engines/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_EnvName",
|      "label": "Container Apps environment name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "cae-securityinsight (new installs get a name chosen by setup)",
|      "description": "Name of the Azure Container Apps environment the SecurityInsight jobs run in; created by the container setup if it does not exist.",
|      "purpose": "Name of the Azure Container Apps environment the SecurityInsight jobs run in; container setup creates it if it does not exist.",
|      "effect": "All jobs are created in this environment. A new name creates a new environment and new jobs there; the old ones are left in place.",
|      "whenToChange": "Only before the first container setup, to follow your naming rules.",
|      "setupOnly": true,
|      "info": {
|        "what": "Name of the Azure Container Apps environment the SecurityInsight jobs run in; container setup creates it if it does not exist.",
|        "whenChanged": "All jobs are created in this environment. A new name creates a new environment and new jobs there; the old ones are left in place.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "cae-securityinsight (new installs get a name chosen by setup)",
|        "recommended": "Keep the default. Change it when: Only before the first container setup, to follow your naming rules.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_EnvName/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_GrantTaggingRoles",
|      "label": "Grant asset tagging write rights",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: rights are only listed, and the job can only report.",
|      "description": "grant asset tagging's write permissions (opt-in)",
|      "purpose": "Lets container setup give the asset tagging job's own identity the rights it needs, including writing tags.",
|      "effect": "When on, setup grants the tagging identity its read rights plus write rights for Defender machine tags, Azure resource tags and Entra security attributes. Tags are written only when asset tagging is also set to apply.",
|      "whenToChange": "When you have decided SecurityInsight may write tags in your tenant.",
|      "card": "Asset tagging",
|      "setupOnly": true,
|      "info": {
|        "what": "Lets container setup give the asset tagging job's own identity the rights it needs, including writing tags.",
|        "whenOn": "When on, setup grants the tagging identity its read rights plus write rights for Defender machine tags, Azure resource tags and Entra security attributes. Tags are written only when asset tagging is also set to apply.",
|        "whenOff": "rights are only listed, and the job can only report.",
|        "risk": "Gives the asset tagging identity WRITE rights in your tenant (Defender machine tags, Azure tags, Entra security attributes). Reversible: remove the role assignments; turning the setting off does not remove rights already granted.",
|        "requires": "Nothing else.",
|        "default": "Off: rights are only listed, and the job can only report.",
|        "recommended": "Off unless asset tagging should write; then on for one setup run.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_GrantTaggingRoles/",
|        "confirmWhen": "on",
|        "confirm": "When on, setup grants the tagging identity its read rights plus write rights for Defender machine tags, Azure resource tags and Entra security attributes. Tags are written only when asset tagging is also set to apply. Gives the asset tagging identity WRITE rights in your tenant (Defender machine tags, Azure tags, Entra security attributes). Reversible: remove the role assignments; turning the setting off does not remove rights already granted."
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ImageTag",
|      "label": "Container image tag",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "latest",
|      "description": "Container image tag the container setup builds and the scheduled jobs run; defaults to latest.",
|      "purpose": "The tag of the container image that setup builds and every scheduled job runs.",
|      "effect": "Jobs run the image with this tag. A different tag lets you keep or test a specific build; a tag that was never built makes the jobs fail to start.",
|      "whenToChange": "Only to pin or test a specific image build.",
|      "setupOnly": true,
|      "info": {
|        "what": "The tag of the container image that setup builds and every scheduled job runs.",
|        "whenChanged": "Jobs run the image with this tag. A different tag lets you keep or test a specific build; a tag that was never built makes the jobs fail to start.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "latest",
|        "recommended": "Keep the default. Change it when: Only to pin or test a specific image build.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ImageTag/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_KedaMaxReplicas",
|      "label": "Maximum queue-driven workers",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "30 workers",
|      "description": "Maximum number of worker containers that may run at the same time when queue-driven scaling (UseKEDA) is on; defaults to 30.",
|      "purpose": "The most worker containers that may run at the same time per engine when queue-driven scaling is on.",
|      "effect": "Higher finishes large collections faster but runs more containers at once, raising peak cost and load on the source APIs. Has no effect unless queue-driven scaling is on.",
|      "whenToChange": "Only with queue-driven scaling, to speed up very large tenants or cap cost.",
|      "unit": "containers",
|      "setupOnly": true,
|      "info": {
|        "what": "The most worker containers that may run at the same time per engine when queue-driven scaling is on.",
|        "whenChanged": "Higher finishes large collections faster but runs more containers at once, raising peak cost and load on the source APIs. Has no effect unless queue-driven scaling is on.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "30 workers",
|        "recommended": "Keep the default. Change it when: Only with queue-driven scaling, to speed up very large tenants or cap cost.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_KedaMaxReplicas/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_Location",
|      "label": "Container hosting region",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Uses SI_Location; setup stops if neither is set.",
|      "description": "REQUIRED. Match $global:SI_Location above.",
|      "purpose": "The Azure region where container setup creates the registry, environment and identities.",
|      "effect": "All container resources are created in this region. It should match your other SecurityInsight resources; changing it later creates new resources in the new region.",
|      "whenToChange": "Set it once at setup if containers should live in a different region than SI_Location.",
|      "card": "Container hosting",
|      "setupOnly": true,
|      "info": {
|        "what": "The Azure region where container setup creates the registry, environment and identities.",
|        "whenChanged": "All container resources are created in this region. It should match your other SecurityInsight resources; changing it later creates new resources in the new region.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Uses SI_Location; setup stops if neither is set.",
|        "recommended": "Keep the default. Change it when: Set it once at setup if containers should live in a different region than SI_Location.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_Location/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ParallelismAzure",
|      "label": "Azure job containers in parallel",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 container",
|      "description": "Number of containers the Azure profiling job runs in parallel per execution; defaults to 1.",
|      "purpose": "How many containers the Azure profiling job runs side by side in each run.",
|      "effect": "More containers split the Azure collection and finish sooner, at higher compute cost per run and more parallel load on Azure APIs.",
|      "whenToChange": "Only for large Azure estates where the job runs too long.",
|      "unit": "containers",
|      "setupOnly": true,
|      "info": {
|        "what": "How many containers the Azure profiling job runs side by side in each run.",
|        "whenChanged": "More containers split the Azure collection and finish sooner, at higher compute cost per run and more parallel load on Azure APIs.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "1 container",
|        "recommended": "Keep the default. Change it when: Only for large Azure estates where the job runs too long.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ParallelismAzure/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ParallelismEndpoint",
|      "label": "Endpoint job containers in parallel",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 container",
|      "description": "Per-engine parallelism (collection only; RA never shards).",
|      "purpose": "How many containers the endpoint profiling job runs side by side; also used for jobs that have no parallel setting of their own.",
|      "effect": "More containers split the collection and finish sooner, at higher compute cost per run. It also applies to other collection jobs without their own setting, such as public IP.",
|      "whenToChange": "Only for large estates where the endpoint job runs too long.",
|      "unit": "containers",
|      "setupOnly": true,
|      "info": {
|        "what": "How many containers the endpoint profiling job runs side by side; also used for jobs that have no parallel setting of their own.",
|        "whenChanged": "More containers split the collection and finish sooner, at higher compute cost per run. It also applies to other collection jobs without their own setting, such as public IP.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "1 container",
|        "recommended": "Keep the default. Change it when: Only for large estates where the endpoint job runs too long.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ParallelismEndpoint/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ParallelismIdentity",
|      "label": "Identity job containers in parallel",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 container",
|      "description": "Number of containers the identity profiling job runs in parallel per execution; defaults to 1.",
|      "purpose": "How many containers the identity profiling job runs side by side in each run.",
|      "effect": "More containers split the identity collection and finish sooner, at higher compute cost per run and more parallel load on Microsoft Graph.",
|      "whenToChange": "Only for large directories where the job runs too long.",
|      "unit": "containers",
|      "setupOnly": true,
|      "info": {
|        "what": "How many containers the identity profiling job runs side by side in each run.",
|        "whenChanged": "More containers split the identity collection and finish sooner, at higher compute cost per run and more parallel load on Microsoft Graph.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "1 container",
|        "recommended": "Keep the default. Change it when: Only for large directories where the job runs too long.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ParallelismIdentity/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ParallelismSchemaDiscovery",
|      "label": "Schema discovery containers in parallel",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 container",
|      "description": "Number of containers the schema-discovery job runs in parallel per execution; defaults to 1.",
|      "purpose": "How many containers the schema discovery job runs side by side in each run.",
|      "effect": "More containers finish schema discovery sooner at higher compute cost. Only matters when schema discovery is in the list of container jobs, which it is not by default.",
|      "whenToChange": "Rarely; only when schema discovery is deployed and runs too long.",
|      "unit": "containers",
|      "setupOnly": true,
|      "info": {
|        "what": "How many containers the schema discovery job runs side by side in each run.",
|        "whenChanged": "More containers finish schema discovery sooner at higher compute cost. Only matters when schema discovery is in the list of container jobs, which it is not by default.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "1 container",
|        "recommended": "Keep the default. Change it when: Rarely; only when schema discovery is deployed and runs too long.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ParallelismSchemaDiscovery/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_RaMaxWorkers",
|      "label": "Risk Analysis workers at once",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "4 workers",
|      "description": "How many Risk Analysis queue workers may run Detailed reports at the same time; defaults to 4.",
|      "purpose": "How many Risk Analysis queue workers may run Detailed reports at the same time.",
|      "effect": "More workers finish a long Risk Analysis sooner but run more containers at once. The workers share the parts one Risk Analysis job may ask Defender at a time (each at least one), so more workers do not multiply what Defender is asked at once. Has no effect when the Risk Analysis workers are off.",
|      "whenToChange": "Rarely; only when Risk Analysis Detailed runs too long on a very large tenant.",
|      "unit": "containers",
|      "info": {
|        "what": "How many Risk Analysis queue workers may run Detailed reports at the same time.",
|        "whenChanged": "More workers finish a long Risk Analysis sooner but run more containers at once. The workers share the parts one Risk Analysis job may ask Defender at a time (each at least one), so more workers do not multiply what Defender is asked at once. Has no effect when the Risk Analysis workers are off.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "4 workers",
|        "recommended": "Keep the default. Change it when: Rarely; only when Risk Analysis Detailed runs too long on a very large tenant.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_RaMaxWorkers/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_RaScaleOut",
|      "label": "Risk Analysis on queue workers",
|      "group": "Schedules & what runs",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On wherever queue scaling and the managed identity let it run; otherwise the reports run in their job.",
|      "description": "Risk Analysis Detailed reports on queue workers, several reports at once: ON by default wherever queue scaling and the managed identity let them run (setup and every update give them). $false switches them off: the reports run one after another in the Risk Analysis job. RaMaxWorkers = how many workers run at once (default 4).",
|      "purpose": "Runs the Risk Analysis Detailed reports on queue workers, several reports at the same time, instead of one after another in one job.",
|      "effect": "On: setup and every update give the install a worker job that scales from zero with the reports to run, and the Detailed run finishes sooner; the stored findings and what Log Analytics receives are the same. Off: the reports run one after another in the Risk Analysis job.",
|      "whenToChange": "Only switch it off if support asks you to.",
|      "info": {
|        "what": "Runs the Risk Analysis Detailed reports on queue workers, several reports at the same time, instead of one after another in one job.",
|        "whenOn": "setup and every update give the install a worker job that scales from zero with the reports to run, and the Detailed run finishes sooner; the stored findings and what Log Analytics receives are the same.",
|        "whenOff": "the reports run one after another in the Risk Analysis job.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "On wherever queue scaling and the managed identity let it run; otherwise the reports run in their job.",
|        "recommended": "Keep the default. Change it when: Only switch it off if support asks you to.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_RaScaleOut/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ResourceGroupName",
|      "label": "Container resource group",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "rg-securityinsight (new installs get a name chosen by setup)",
|      "description": "ARM resource naming.",
|      "purpose": "The Azure resource group where container setup creates the registry, environment, identities and jobs.",
|      "effect": "All container resources go into this group. Its presence also marks the install as container-hosted, so updates and checks treat it that way; a new name creates everything anew there.",
|      "whenToChange": "Set once at setup to follow your naming rules; remove it on a machine-only install.",
|      "card": "Container hosting",
|      "info": {
|        "what": "The Azure resource group where container setup creates the registry, environment, identities and jobs.",
|        "whenChanged": "All container resources go into this group. Its presence also marks the install as container-hosted, so updates and checks treat it that way; a new name creates everything anew there.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "rg-securityinsight (new installs get a name chosen by setup)",
|        "recommended": "Keep the default. Change it when: Set once at setup to follow your naming rules; remove it on a machine-only install.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ResourceGroupName/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleAssetTagging",
|      "label": "Asset tagging schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Daily at 05:50 UTC, after the collection jobs",
|      "description": "Asset tagging (Community edition and Pro): its job runs under its OWN identity, never the read-only collection identity, after the profilers. Its write grants (Defender machine tags, Tag Contributor, Entra custom security attributes) are given only when GrantTaggingRoles is on; TaggingScopes is where Azure tags may be written (default: the collection scope).",
|      "purpose": "When the asset tagging container job runs, as a cron expression in UTC.",
|      "effect": "Sets when tagging rules are evaluated. Running before the collection jobs finish means rules see the previous day's assets.",
|      "whenToChange": "When you move the collection schedules, to keep tagging after them.",
|      "card": "Container jobs",
|      "setupOnly": true,
|      "info": {
|        "what": "When the asset tagging container job runs, as a cron expression in UTC.",
|        "whenChanged": "Sets when tagging rules are evaluated. Running before the collection jobs finish means rules see the previous day's assets.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Daily at 05:50 UTC, after the collection jobs",
|        "recommended": "Keep the default. Change it when: When you move the collection schedules, to keep tagging after them.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleAssetTagging/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleAzure",
|      "label": "Azure collection schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Daily at 05:00 UTC",
|      "description": "Cron schedule (UTC) for the Azure profiling container job; defaults to daily at 05:00.",
|      "purpose": "When the Azure profiling container job runs, as a cron expression in UTC.",
|      "effect": "Sets when Azure assets are collected. Reports and later jobs read the result, so keep it before risk analysis.",
|      "whenToChange": "To fit your own maintenance window or time zone.",
|      "card": "Container jobs",
|      "setupOnly": true,
|      "info": {
|        "what": "When the Azure profiling container job runs, as a cron expression in UTC.",
|        "whenChanged": "Sets when Azure assets are collected. Reports and later jobs read the result, so keep it before risk analysis.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Daily at 05:00 UTC",
|        "recommended": "Keep the default. Change it when: To fit your own maintenance window or time zone.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleAzure/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleConfigBackup",
|      "label": "Configuration backup job schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Daily at 18:00 UTC: after the working day, before the evening pipeline, never at the 23:00 update.",
|      "description": "the daily configuration backup -- its own timer, outside the pipeline",
|      "purpose": "Schedule (cron, UTC) of the container job that backs up your configuration once a day.",
|      "effect": "Container setup gives the configuration backup job this schedule on its next run. The job is never a step of the pipeline and never runs twice at the same time.",
|      "whenToChange": "Only if your configuration changes happen at another time of day, or the pipeline starts earlier.",
|      "setupOnly": true,
|      "info": {
|        "what": "Schedule (cron, UTC) of the container job that backs up your configuration once a day.",
|        "whenChanged": "Container setup gives the configuration backup job this schedule on its next run. The job is never a step of the pipeline and never runs twice at the same time.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Daily at 18:00 UTC: after the working day, before the evening pipeline, never at the 23:00 update.",
|        "recommended": "Keep the default. Change it when: Only if your configuration changes happen at another time of day, or the pipeline starts earlier.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleConfigBackup/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleEndpoint",
|      "label": "Endpoint collection schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Daily at 04:00 UTC",
|      "description": "Cron schedules (UTC).",
|      "purpose": "When the endpoint profiling container job runs, as a cron expression in UTC; also used for jobs without a schedule of their own.",
|      "effect": "Sets when endpoints are collected. Reports and later jobs read the result, so keep it before risk analysis.",
|      "whenToChange": "To fit your own maintenance window or time zone.",
|      "card": "Container jobs",
|      "setupOnly": true,
|      "info": {
|        "what": "When the endpoint profiling container job runs, as a cron expression in UTC; also used for jobs without a schedule of their own.",
|        "whenChanged": "Sets when endpoints are collected. Reports and later jobs read the result, so keep it before risk analysis.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Daily at 04:00 UTC",
|        "recommended": "Keep the default. Change it when: To fit your own maintenance window or time zone.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleEndpoint/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleIdentity",
|      "label": "Identity collection schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Daily at 04:30 UTC",
|      "description": "Cron schedule (UTC) for the identity profiling container job; defaults to daily at 04:30.",
|      "purpose": "When the identity profiling container job runs, as a cron expression in UTC.",
|      "effect": "Sets when identities are collected. Reports and later jobs read the result, so keep it before risk analysis.",
|      "whenToChange": "To fit your own maintenance window or time zone.",
|      "card": "Container jobs",
|      "setupOnly": true,
|      "info": {
|        "what": "When the identity profiling container job runs, as a cron expression in UTC.",
|        "whenChanged": "Sets when identities are collected. Reports and later jobs read the result, so keep it before risk analysis.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Daily at 04:30 UTC",
|        "recommended": "Keep the default. Change it when: To fit your own maintenance window or time zone.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleIdentity/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleRiskAnalysis",
|      "label": "Summary report schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Daily at 06:00 UTC, after collection",
|      "description": "Cron schedule (UTC) for the Summary risk-analysis container job; defaults to daily at 06:00, after collection has finished.",
|      "purpose": "When the Summary risk-analysis container job runs, as a cron expression in UTC.",
|      "effect": "Sets when the Summary report is built. Running it before collection finishes reports on the previous day's data.",
|      "whenToChange": "When you move the collection schedules or want the report at another time.",
|      "card": "Container jobs",
|      "setupOnly": true,
|      "info": {
|        "what": "When the Summary risk-analysis container job runs, as a cron expression in UTC.",
|        "whenChanged": "Sets when the Summary report is built. Running it before collection finishes reports on the previous day's data.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Daily at 06:00 UTC, after collection",
|        "recommended": "Keep the default. Change it when: When you move the collection schedules or want the report at another time.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleRiskAnalysis/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleSchemaDiscovery",
|      "label": "Schema discovery schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Sundays at 03:00 UTC",
|      "description": "Cron schedule (UTC) for the schema-discovery container job; defaults to Sundays at 03:00.",
|      "purpose": "When the schema discovery container job runs, as a cron expression in UTC.",
|      "effect": "Sets how often schema discovery runs. Only used when schema discovery is in the list of container jobs, which it is not by default.",
|      "whenToChange": "Only when schema discovery is deployed and you want another day or time.",
|      "setupOnly": true,
|      "info": {
|        "what": "When the schema discovery container job runs, as a cron expression in UTC.",
|        "whenChanged": "Sets how often schema discovery runs. Only used when schema discovery is in the list of container jobs, which it is not by default.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Sundays at 03:00 UTC",
|        "recommended": "Keep the default. Change it when: Only when schema discovery is deployed and you want another day or time.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleSchemaDiscovery/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleTrend",
|      "label": "Asset trend job schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Daily at 09:00 UTC, moved with the start hour chosen in guided setup.",
|      "description": "Every NON-SECRET setting in this file is passed to the container jobs automatically; secrets travel only as job secrets. Trend and (with Pro) the Pro engines get their own jobs; schedules can be changed with:",
|      "purpose": "Schedule (cron, UTC) of the container job that builds the asset trend; it should run after the Detailed report.",
|      "effect": "Container setup gives the trend job this schedule on its next run (an explicit -ScheduleTrend on the setup command still wins). Running it before the Detailed report trends the previous day's data.",
|      "whenToChange": "Only if the trend job must run at another time, for example after you moved the Detailed report.",
|      "setupOnly": true,
|      "info": {
|        "what": "Schedule (cron, UTC) of the container job that builds the asset trend; it should run after the Detailed report.",
|        "whenChanged": "Container setup gives the trend job this schedule on its next run (an explicit -ScheduleTrend on the setup command still wins). Running it before the Detailed report trends the previous day's data.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Daily at 09:00 UTC, moved with the start hour chosen in guided setup.",
|        "recommended": "Keep the default. Change it when: Only if the trend job must run at another time, for example after you moved the Detailed report.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleTrend/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_SkipImageBuild",
|      "label": "Skip container image build",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: setup builds the image each time.",
|      "description": "When on, container setup skips building the container image and reuses the image already in the registry; off by default.",
|      "purpose": "Lets container setup reuse the image already in the registry instead of building a new one.",
|      "effect": "When on, setup is much faster but the jobs keep running the image already stored, so code changes are not picked up. If no image exists, the jobs fail to start.",
|      "whenToChange": "When re-running setup only to change settings and the image is already current.",
|      "setupOnly": true,
|      "info": {
|        "what": "Lets container setup reuse the image already in the registry instead of building a new one.",
|        "whenOn": "When on, setup is much faster but the jobs keep running the image already stored, so code changes are not picked up. If no image exists, the jobs fail to start.",
|        "whenOff": "setup builds the image each time.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Off: setup builds the image each time.",
|        "recommended": "Keep the default. Change it when: When re-running setup only to change settings and the image is already current.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_SkipImageBuild/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_SqlServiceObjective",
|      "label": "Pro database size",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Empty: the product's rule -- Standard S3 for every install, raised to it when smaller, never lowered.",
|      "description": "The Pro database's size (Azure SQL service objective, S1 to S12) that setup and every update keep, also when it is smaller than the product's; empty = the product's rule (Standard S3).",
|      "purpose": "The size (Azure SQL service objective) of the Pro database. Allowed values: S1, S2, S3, S4, S6, S7, S9, S12. Empty = the product's rule.",
|      "effect": "Every update sets the Pro database to this size, raising or LOWERING it, by one online change (no data loss; open connections reconnect once). Never below S1. A database on Premium, vCore or in an elastic pool is left as it is. The identity database is not affected: it stays S1. A smaller size costs less but makes pages and the nightly writes slower.",
|      "whenToChange": "Only when support advises it -- for example S2 for a small install whose database is mostly idle.",
|      "patternHint": "S1, S2, S3, S4, S6, S7, S9 or S12; empty = the product's rule",
|      "pattern": "^[Ss](1|2|3|4|6|7|9|12)$",
|      "info": {
|        "what": "The size (Azure SQL service objective) of the Pro database. Allowed values: S1, S2, S3, S4, S6, S7, S9, S12. Empty = the product's rule.",
|        "whenChanged": "Every update sets the Pro database to this size, raising or LOWERING it, by one online change (no data loss; open connections reconnect once). Never below S1. A database on Premium, vCore or in an elastic pool is left as it is. The identity database is not affected: it stays S1. A smaller size costs less but makes pages and the nightly writes slower.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Empty: the product's rule -- Standard S3 for every install, raised to it when smaller, never lowered.",
|        "recommended": "Keep the default. Change it when: Only when support advises it -- for example S2 for a small install whose database is mostly idle.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_SqlServiceObjective/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_SubscriptionId",
|      "label": "Container hosting subscription",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Falls back to SI_AzSubscriptionId, then the workspace subscription, then the signed-in Azure context.",
|      "description": "--- container hosting (written by setup; see Bootstrap-ContainerAppJob.ps1) ---- Where the containers live -- setup saves these so every update can find them. An install made before 3.0.0 records them once with: setup\\Invoke-SIContainerUpdate.ps1 -ResourceGroupName <rg> -AcrName <acr> -Save",
|      "purpose": "The Azure subscription the SecurityInsight containers are installed in, saved by setup so later updates and upgrades work in the same subscription.",
|      "effect": "Container setup, updates and upgrades create and look for the containers in this subscription. A wrong value points updates at a subscription where the containers do not exist.",
|      "whenToChange": "Setup writes it. Change only if the container hosting was moved to another subscription.",
|      "info": {
|        "what": "The Azure subscription the SecurityInsight containers are installed in, saved by setup so later updates and upgrades work in the same subscription.",
|        "whenChanged": "Container setup, updates and upgrades create and look for the containers in this subscription. A wrong value points updates at a subscription where the containers do not exist.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Falls back to SI_AzSubscriptionId, then the workspace subscription, then the signed-in Azure context.",
|        "recommended": "Keep the default. Change it when: Setup writes it. Change only if the container hosting was moved to another subscription.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_SubscriptionId/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_TaggingIdentityName",
|      "label": "Asset tagging identity name",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "uami-securityinsight-tagging",
|      "description": "asset tagging's own identity (never the collection one)",
|      "purpose": "Name of the separate managed identity the asset tagging job runs as, so the collection identity stays read-only.",
|      "effect": "Setup creates or reuses this identity for the tagging job. It must differ from the collection identity, or setup stops.",
|      "whenToChange": "Only to follow your naming rules before first deployment.",
|      "setupOnly": true,
|      "info": {
|        "what": "Name of the separate managed identity the asset tagging job runs as, so the collection identity stays read-only.",
|        "whenChanged": "Setup creates or reuses this identity for the tagging job. It must differ from the collection identity, or setup stops.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Nothing else.",
|        "default": "uami-securityinsight-tagging",
|        "recommended": "Keep the default. Change it when: Only to follow your naming rules before first deployment.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_TaggingIdentityName/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_TaggingScopes",
|      "label": "Where Azure tags may be written",
|      "group": "Connectors & CMDB",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "The same scopes the jobs read from (the subscription by default)",
|      "description": "where Azure tags may be written (Tag Contributor)",
|      "purpose": "The Azure scopes, such as subscriptions or resource groups, where the asset tagging identity may write resource tags.",
|      "effect": "A narrower list limits where tags can ever be written; a wider list allows tagging in more places. Rights are granted only when tagging write rights are granted.",
|      "whenToChange": "When tags should only be written in part of your estate.",
|      "card": "Asset tagging",
|      "setupOnly": true,
|      "info": {
|        "what": "The Azure scopes, such as subscriptions or resource groups, where the asset tagging identity may write resource tags.",
|        "whenChanged": "A narrower list limits where tags can ever be written; a wider list allows tagging in more places. Rights are granted only when tagging write rights are granted.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Nothing else.",
|        "default": "The same scopes the jobs read from (the subscription by default)",
|        "recommended": "Keep the default. Change it when: When tags should only be written in part of your estate.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_TaggingScopes/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_TriggerNowAfter",
|      "label": "Start jobs right after setup",
|      "group": "Schedules & what runs",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: jobs wait for their schedule.",
|      "description": "Deployment behaviour switches.",
|      "purpose": "Makes container setup start each job once immediately after creating or updating it.",
|      "effect": "When on, every deployed job runs at once, giving results straight away but running all engines at the same time, out of their normal order, with the compute and API load that brings.",
|      "whenToChange": "For a first test run after setup; leave off otherwise.",
|      "setupOnly": true,
|      "info": {
|        "what": "Makes container setup start each job once immediately after creating or updating it.",
|        "whenOn": "When on, every deployed job runs at once, giving results straight away but running all engines at the same time, out of their normal order, with the compute and API load that brings.",
|        "whenOff": "jobs wait for their schedule.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Off: jobs wait for their schedule.",
|        "recommended": "Keep the default. Change it when: For a first test run after setup; leave off otherwise.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_TriggerNowAfter/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_UseClientSecret",
|      "label": "Jobs sign in with a client secret",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": true,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: the jobs sign in as a managed identity, unless the configuration already carries a client secret.",
|      "description": "Sign-in of the jobs: a managed identity by default. A client secret only when chosen (a supported choice):",
|      "purpose": "Makes all container jobs sign in as the app registration (service principal) with its client secret instead of a managed identity.",
|      "effect": "On, every job carries the client secret as a job secret. Queue scaling is not available with it. A supported choice, never the default.",
|      "whenToChange": "Only when a managed identity or a certificate cannot be used.",
|      "setupOnly": true,
|      "info": {
|        "what": "Makes all container jobs sign in as the app registration (service principal) with its client secret instead of a managed identity.",
|        "whenOn": "On, every job carries the client secret as a job secret. Queue scaling is not available with it. A supported choice, never the default.",
|        "whenOff": "the jobs sign in as a managed identity, unless the configuration already carries a client secret.",
|        "risk": "Every job carries the client secret: a secret to store, rotate and protect, and queue scaling is not available. A supported choice, but weaker than a managed identity. Reversible: run setup with the managed identity.",
|        "requires": "Kept in the install's Key Vault.",
|        "default": "Off: the jobs sign in as a managed identity, unless the configuration already carries a client secret.",
|        "recommended": "Off (the managed identity).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_UseClientSecret/",
|        "confirmWhen": "on",
|        "confirm": "On, every job carries the client secret as a job secret. Queue scaling is not available with it. A supported choice, never the default. Every job carries the client secret: a secret to store, rotate and protect, and queue scaling is not available. A supported choice, but weaker than a managed identity. Reversible: run setup with the managed identity."
|      }
|    },
|    {
|      "name": "SI_Bootstrap_UseKEDA",
|      "label": "Queue-driven scaling",
|      "group": "Schedules & what runs",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: one scheduled job per engine.",
|      "description": "When on, collection engines run as queue-driven workers that scale from zero with the amount of work instead of one scheduled job each; risk analysis is unaffected.",
|      "purpose": "Runs the collection engines as queue-driven workers that scale from zero with the amount of work, instead of one scheduled job each.",
|      "effect": "When on, each collection engine gets a scheduler and a worker job that scales up to the worker maximum, speeding up large tenants. Risk analysis and asset tagging are not affected.",
|      "whenToChange": "Only for very large tenants where scheduled jobs run too long.",
|      "info": {
|        "what": "Runs the collection engines as queue-driven workers that scale from zero with the amount of work, instead of one scheduled job each.",
|        "whenOn": "When on, each collection engine gets a scheduler and a worker job that scales up to the worker maximum, speeding up large tenants. Risk analysis and asset tagging are not affected.",
|        "whenOff": "one scheduled job per engine.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Off: one scheduled job per engine.",
|        "recommended": "Keep the default. Change it when: Only for very large tenants where scheduled jobs run too long.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_UseKEDA/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_UseManagedIdentity",
|      "label": "Jobs sign in with managed identity",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the managed identity anyway, unless the configuration carries a client secret (an existing install keeps it).",
|      "description": "Container setup signs the jobs in as one user-assigned managed identity (the default unless the configuration carries a client secret).",
|      "purpose": "Makes all container jobs sign in as one user-assigned managed identity, said explicitly.",
|      "effect": "On, setup creates the identity and the jobs carry no secret; the image is also pulled as that identity. Its rights are listed, and granted only when setup is told to grant them; some database access is a one-time manual step.",
|      "whenToChange": "To move an existing install that signs in with a client secret to a managed identity; guided installs switch it on.",
|      "card": "Container hosting",
|      "setupOnly": true,
|      "info": {
|        "what": "Makes all container jobs sign in as one user-assigned managed identity, said explicitly.",
|        "whenOn": "On, setup creates the identity and the jobs carry no secret; the image is also pulled as that identity. Its rights are listed, and granted only when setup is told to grant them; some database access is a one-time manual step.",
|        "whenOff": "Not set: the managed identity anyway, unless the configuration carries a client secret (an existing install keeps it).",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Not set: the managed identity anyway, unless the configuration carries a client secret (an existing install keeps it).",
|        "recommended": "Keep the default. Change it when: To move an existing install that signs in with a client secret to a managed identity; guided installs switch it on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_UseManagedIdentity/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_WebAppCpu",
|      "label": "Web app CPU",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Empty: the product's size, 2 CPU / 4 GiB.",
|      "description": "Sizes (Pro). Empty = the product's size, which setup and every update give: the web app 2 CPU / 4 GiB, the Pro database Standard S3. A size set here is kept by every update, also when it is SMALLER: the web app's CPU (0.5 to 4 in steps of 0.25; memory is 2 x CPU unless WebAppMemory says it), and the Pro database's service objective (S1, S2, S3, S4, S6, S7, S9, S12 -- never below S1). Support sets them per install in the Pro database (Settings page, setup\\Set-SIProSetting.ps1).",
|      "purpose": "The CPU of the web app's own container: 0.5 to 4, in steps of 0.25. Empty = the product's size.",
|      "effect": "Every update sets the web app to this CPU, raising or lowering it, with memory twice the CPU unless Web app memory says otherwise. The sign-in front next to it keeps its own 0.25 CPU / 0.5 GiB; together they stay within 4 CPU / 8 GiB.",
|      "whenToChange": "Only when support advises it -- the web app normally uses a small part of 2 CPU.",
|      "unit": "CPU",
|      "patternHint": "0.5 to 4 in steps of 0.25; empty = the product's size",
|      "pattern": "^(0\\.5|0\\.75|[1-3](\\.(0|25|5|75))?|4(\\.0)?)$",
|      "info": {
|        "what": "The CPU of the web app's own container: 0.5 to 4, in steps of 0.25. Empty = the product's size.",
|        "whenChanged": "Every update sets the web app to this CPU, raising or lowering it, with memory twice the CPU unless Web app memory says otherwise. The sign-in front next to it keeps its own 0.25 CPU / 0.5 GiB; together they stay within 4 CPU / 8 GiB.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Empty: the product's size, 2 CPU / 4 GiB.",
|        "recommended": "Keep the default. Change it when: Only when support advises it -- the web app normally uses a small part of 2 CPU.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_WebAppCpu/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_WebAppMemory",
|      "label": "Web app memory",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Empty: twice the CPU (4 GiB with the product's 2 CPU).",
|      "description": "The web app's memory (for example 4Gi) that every update keeps; empty = twice the CPU.",
|      "purpose": "The memory of the web app's own container, for example 4Gi. Empty = twice the web app's CPU.",
|      "effect": "Every update sets the web app to this memory. Azure takes memory as twice the CPU, so a memory set alone also sets the CPU to half of it.",
|      "whenToChange": "Rarely; set Web app CPU instead.",
|      "unit": "GiB",
|      "patternHint": "1Gi to 8Gi in steps of 0.5Gi; empty = twice the CPU",
|      "pattern": "^([1-8](\\.(0|5))?)(Gi)?$",
|      "info": {
|        "what": "The memory of the web app's own container, for example 4Gi. Empty = twice the web app's CPU.",
|        "whenChanged": "Every update sets the web app to this memory. Azure takes memory as twice the CPU, so a memory set alone also sets the CPU to half of it.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Empty: twice the CPU (4 GiB with the product's 2 CPU).",
|        "recommended": "Keep the default. Change it when: Rarely; set Web app CPU instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_WebAppMemory/"
|      }
|    },
|    {
|      "name": "SI_BucketLateRetries",
|      "label": "Risk Analysis late bucket retries",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "3 attempts",
|      "description": "--- risk analysis ----------------------------------------------------------- Late retries of a bucket that failed transiently, after the main pass (default 3).",
|      "purpose": "How many extra attempts a query slice gets at the end of a Risk Analysis report when it failed earlier because the service was throttling or unavailable.",
|      "effect": "More attempts recover more slices on a busy tenant but lengthen the run (each waits up to 10 minutes). Fewer, or 0, ends sooner but the rows of a failed slice are missing from the report.",
|      "whenToChange": "Most installs never should. Raise it if reports often miss rows because of throttling.",
|      "unit": "attempts",
|      "info": {
|        "what": "How many extra attempts a query slice gets at the end of a Risk Analysis report when it failed earlier because the service was throttling or unavailable.",
|        "whenChanged": "More attempts recover more slices on a busy tenant but lengthen the run (each waits up to 10 minutes). Fewer, or 0, ends sooner but the rows of a failed slice are missing from the report.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "3 attempts",
|        "recommended": "Keep the default. Change it when: Most installs never should. Raise it if reports often miss rows because of throttling.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_BucketLateRetries/"
|      }
|    },
|    {
|      "name": "SI_BucketOverflowRetries",
|      "label": "Risk Analysis too-large slice retries",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 attempt (split at once)",
|      "description": "1 = split a too-large slice at once",
|      "purpose": "How many times a Risk Analysis query slice that the service answers as too large is sent at the same size before it is split into smaller slices. 1 splits it on the first too-large answer.",
|      "effect": "Higher sends the same too-large request again, after a 30 s and then a 60 s pause, before splitting it. The same request at the same size fails the same way, so this only adds time. Throttling, timeouts and service errors are retried separately (Risk Analysis transient error retries).",
|      "whenToChange": "Most installs never should. Keep 1.",
|      "unit": "attempts",
|      "info": {
|        "what": "How many times a Risk Analysis query slice that the service answers as too large is sent at the same size before it is split into smaller slices. 1 splits it on the first too-large answer.",
|        "whenChanged": "Higher sends the same too-large request again, after a 30 s and then a 60 s pause, before splitting it. The same request at the same size fails the same way, so this only adds time. Throttling, timeouts and service errors are retried separately (Risk Analysis transient error retries).",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "1 attempt (split at once)",
|        "recommended": "Keep the default. Change it when: Most installs never should. Keep 1.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_BucketOverflowRetries/"
|      }
|    },
|    {
|      "name": "SI_BucketTransientRetries",
|      "label": "Risk Analysis transient error retries",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "3 attempts",
|      "description": "retry a bucket on a transient error",
|      "purpose": "How many times a Risk Analysis query slice is retried, after signing in again, when it fails with a temporary error such as an expired token or a gateway timeout.",
|      "effect": "More attempts make long reports more robust against brief outages, at the cost of a longer run when the service stays unavailable. Fewer gives up on a slice sooner.",
|      "whenToChange": "Most installs never should. Raise it on tenants with frequent temporary service errors.",
|      "unit": "attempts",
|      "info": {
|        "what": "How many times a Risk Analysis query slice is retried, after signing in again, when it fails with a temporary error such as an expired token or a gateway timeout.",
|        "whenChanged": "More attempts make long reports more robust against brief outages, at the cost of a longer run when the service stays unavailable. Fewer gives up on a slice sooner.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "3 attempts",
|        "recommended": "Keep the default. Change it when: Most installs never should. Raise it on tenants with frequent temporary service errors.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_BucketTransientRetries/"
|      }
|    },
|    {
|      "name": "SI_CiBuild_FullReconcileDays",
|      "label": "CI build: days between full rebuilds",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 7,
|      "defaultText": "7 days: every CI is rebuilt at least once a week; the days between build only what changed",
|      "description": "The CI build (correlation) rebuilds only the CIs whose records, link states, time thresholds, identity anchors or manual overrides changed since their last build; every CI is rebuilt (a full reconcile) when the last full build is this many days old, when the data model, rules, mappings or CMDB change, and after a build that failed. 0 = a full build every run.",
|      "purpose": "The CI build (correlation) rebuilds only the CIs whose input changed since their last build: a record new, changed, moved or gone, a link state, a time threshold, an identity anchor or a manual override. Every CI is rebuilt (a full reconcile) when the last full build is this many days old; also at once when the data model, rules, mappings or CMDB change, and after a build that failed.",
|      "effect": "A lower value rebuilds every CI more often (a longer correlation run on those days); 0 rebuilds every CI on every run, as before. A full reconcile that finds a CI the daily builds should have changed says so in the run log.",
|      "whenToChange": "Set 0 while support investigates a CI that looks out of date; otherwise keep the default.",
|      "unit": "days",
|      "min": 0,
|      "max": 365,
|      "card": "Daily pipeline",
|      "info": {
|        "what": "The CI build (correlation) rebuilds only the CIs whose input changed since their last build: a record new, changed, moved or gone, a link state, a time threshold, an identity anchor or a manual override. Every CI is rebuilt (a full reconcile) when the last full build is this many days old; also at once when the data model, rules, mappings or CMDB change, and after a build that failed.",
|        "whenChanged": "A lower value rebuilds every CI more often (a longer correlation run on those days); 0 rebuilds every CI on every run, as before. A full reconcile that finds a CI the daily builds should have changed says so in the run log.",
|        "risk": "None to the data: a change to what the CIs are built from always rebuilds every CI on the next run; the setting only decides how often an unchanged estate is rebuilt in full. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "7 days: every CI is rebuilt at least once a week; the days between build only what changed",
|        "recommended": "Keep the default (7).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CiBuild_FullReconcileDays/"
|      }
|    },
|    {
|      "name": "SI_CiRulesBudgetSeconds",
|      "label": "CI build: time limit for the rules of one asset",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 60,
|      "defaultText": "60 seconds per asset",
|      "description": "The seconds the rules of ONE asset may take in the CI build. An asset that takes longer is not fully evaluated in that run: it keeps what it had from its last complete evaluation (a new asset is left out), is named in the run log and is evaluated again in the next run -- one asset never holds the build. 0 = no limit.",
|      "purpose": "How long the rules of one asset may take in the CI build (correlation) before the build goes on with the next asset. Applying the rules to one asset normally takes milliseconds; an asset with unusually large data could otherwise hold the whole build, and with it every step after it.",
|      "effect": "An asset that takes longer is not fully evaluated in that run. Nothing of the half evaluation is stored: Risk Analysis and the views keep what the asset had from its last complete evaluation, and a new asset is left out until it is fully evaluated. It is named in the run log, counted (\"N asset(s) not fully evaluated in this run\") and evaluated again in the next run. A higher value gives a slow asset more time; 0 removes the limit, and one asset can then hold the build for as long as its rules take.",
|      "whenToChange": "Raise it when the run log names the same assets as not fully evaluated run after run and they must be included before the cause is fixed; otherwise keep the default.",
|      "unit": "seconds",
|      "min": 0,
|      "card": "Daily pipeline",
|      "info": {
|        "what": "How long the rules of one asset may take in the CI build (correlation) before the build goes on with the next asset. Applying the rules to one asset normally takes milliseconds; an asset with unusually large data could otherwise hold the whole build, and with it every step after it.",
|        "whenChanged": "An asset that takes longer is not fully evaluated in that run. Nothing of the half evaluation is stored: Risk Analysis and the views keep what the asset had from its last complete evaluation, and a new asset is left out until it is fully evaluated. It is named in the run log, counted (\"N asset(s) not fully evaluated in this run\") and evaluated again in the next run. A higher value gives a slow asset more time; 0 removes the limit, and one asset can then hold the build for as long as its rules take.",
|        "risk": "None to the data either way: an asset that is not fully evaluated keeps its last complete result, and no tier or finding is based on part of the rules. A very high value, or 0, lets one asset hold the build and with it the steps after it. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "60 seconds per asset",
|        "recommended": "Keep the default (60).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CiRulesBudgetSeconds/"
|      }
|    },
|    {
|      "name": "SI_Cmdb_AllowCreate",
|      "label": "ServiceNow CMDB: allow creating CIs",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: no CI is created",
|      "description": "the second switch before a CI is created",
|      "purpose": "The second switch needed before the ServiceNow CMDB connector creates a CI.",
|      "effect": "On, with the create-if-unmatched mode and apply, unmatched assets are created as CIs in ServiceNow.",
|      "whenToChange": "Together with the create-if-unmatched mode.",
|      "info": {
|        "what": "The second switch needed before the ServiceNow CMDB connector creates a CI.",
|        "whenOn": "On, with the create-if-unmatched mode and apply, unmatched assets are created as CIs in ServiceNow.",
|        "whenOff": "no CI is created",
|        "risk": "New CIs are created in ServiceNow (with apply and the create-if-unmatched mode); created CIs stay when it is turned off again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off: no CI is created",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Cmdb_AllowCreate/",
|        "confirmWhen": "on",
|        "confirm": "SecurityInsight will create CIs in your ServiceNow CMDB for assets it could not match."
|      }
|    },
|    {
|      "name": "SI_Cmdb_Mode",
|      "label": "ServiceNow CMDB: match mode",
|      "group": "Connectors & CMDB",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "match-only: only matched CIs are updated",
|      "description": "'match-only' | 'create-if-unmatched'",
|      "purpose": "Whether the ServiceNow CMDB connector only updates CIs it matched, or may also create CIs for assets it could not match.",
|      "effect": "create-if-unmatched creates a CI for an asset ServiceNow does not know, when creating is also allowed (SI_Cmdb_AllowCreate).",
|      "whenToChange": "When SecurityInsight should add the assets your CMDB is missing.",
|      "values": [
|        "match-only",
|        "create-if-unmatched"
|      ],
|      "info": {
|        "what": "Whether the ServiceNow CMDB connector only updates CIs it matched, or may also create CIs for assets it could not match.",
|        "whenChanged": "create-if-unmatched creates a CI for an asset ServiceNow does not know, when creating is also allowed (SI_Cmdb_AllowCreate).",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "match-only: only matched CIs are updated",
|        "recommended": "Keep the default. Change it when: When SecurityInsight should add the assets your CMDB is missing.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Cmdb_Mode/"
|      }
|    },
|    {
|      "name": "SI_Cmdb_RetireAfterDays",
|      "label": "Days unseen before a CI may be retired",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "7 days",
|      "description": "The least number of days an asset must go unseen before its CI is retired (in the CI table and in the state handed to ServiceNow) -- a brake under every other rule (the grace period, the runs missing, an early retirement). Default 7, at least 1.",
|      "purpose": "The least number of days an asset must go unseen before its CI is retired -- in the CI table and in the state handed to ServiceNow. A brake under every other rule: whatever decided the retirement (the grace period, the runs missing, an early retirement on the Not seen anymore page), the CI waits until its asset has been unseen this long.",
|      "effect": "Higher keeps CIs of assets that are away for a while; a CI retired too early is the one mistake that does not heal by itself. No grace period can be shorter than this. Below 1 is raised to 1; non-numbers use 7.",
|      "whenToChange": "Raise it if CIs are retired for assets that come back after a week or more.",
|      "unit": "days",
|      "min": 1,
|      "card": "SQL CMDB connector",
|      "info": {
|        "what": "The least number of days an asset must go unseen before its CI is retired -- in the CI table and in the state handed to ServiceNow. A brake under every other rule: whatever decided the retirement (the grace period, the runs missing, an early retirement on the Not seen anymore page), the CI waits until its asset has been unseen this long.",
|        "whenChanged": "Higher keeps CIs of assets that are away for a while; a CI retired too early is the one mistake that does not heal by itself. No grace period can be shorter than this. Below 1 is raised to 1; non-numbers use 7.",
|        "risk": "A lower value lets a CI retire sooner after its asset was last seen -- a device that is only offline for a few days can lose its CI (in the CI table and in ServiceNow). A CI retired by mistake does not heal by itself until the asset is seen again. Reversible for the future.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "7 days",
|        "recommended": "7 days (the brake against CIs retired by mistake).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Cmdb_RetireAfterDays/",
|        "confirmWhen": "lower",
|        "confirm": "A lower value lets a CI retire sooner after its asset was last seen -- a device that is only offline for a few days can lose its CI (in the CI table and in ServiceNow). A CI retired by mistake does not heal by itself until the asset is seen again. Reversible for the future."
|      }
|    },
|    {
|      "name": "SI_Cmdb_RowLimit",
|      "label": "ServiceNow CMDB: row limit",
|      "group": "Connectors & CMDB",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0: no limit, every asset",
|      "description": "0 = every asset; a number = only that many (testing)",
|      "purpose": "A limit on how many assets one ServiceNow CMDB run handles, for trying the connector on a few assets first.",
|      "effect": "A number above 0 handles only that many assets per run.",
|      "whenToChange": "Only while testing the connector.",
|      "min": 0,
|      "info": {
|        "what": "A limit on how many assets one ServiceNow CMDB run handles, for trying the connector on a few assets first.",
|        "whenChanged": "A number above 0 handles only that many assets per run.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "0: no limit, every asset",
|        "recommended": "Keep the default. Change it when: Only while testing the connector.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Cmdb_RowLimit/"
|      }
|    },
|    {
|      "name": "SI_Cmdb_Run",
|      "label": "ServiceNow CMDB: write or plan",
|      "group": "Connectors & CMDB",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "plan: nothing is written to ServiceNow; the match report is produced",
|      "description": "--- ServiceNow CMDB connector (the asset-cmdb job) and the asset correlation ---",
|      "purpose": "Whether the ServiceNow CMDB connector writes to your ServiceNow instance or only plans and reports what it would write.",
|      "effect": "apply writes the matched CIs (and, with creating allowed, new ones) to ServiceNow on every run. plan writes nothing.",
|      "whenToChange": "Set apply once the plan report shows the matches you expect.",
|      "values": [
|        "plan",
|        "apply"
|      ],
|      "card": "ServiceNow CMDB connector",
|      "info": {
|        "what": "Whether the ServiceNow CMDB connector writes to your ServiceNow instance or only plans and reports what it would write.",
|        "whenChanged": "apply writes the matched CIs (and, with creating allowed, new ones) to ServiceNow on every run. plan writes nothing.",
|        "risk": "apply writes to your ServiceNow CMDB on every run; plan writes nothing. Reversible for future runs; what was written stays in ServiceNow.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "plan: nothing is written to ServiceNow; the match report is produced",
|        "recommended": "plan until the match report shows what you expect.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Cmdb_Run/"
|      }
|    },
|    {
|      "name": "SI_CmdbCsvPath",
|      "label": "CMDB export file location",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The CMDB.csv in the CMDB provider folder is used",
|      "description": "Full path to your CMDB export CSV when it is kept outside the SecurityInsight folder; when empty, the CSV is looked for in the CMDB provider folder.",
|      "purpose": "Points the CMDB provider at your CMDB export CSV when it is stored outside the SecurityInsight folder, for example on a file share.",
|      "effect": "The CMDB cache is loaded from this file instead of the provider folder. A wrong path means no CMDB data, so CMDB columns stay empty. In SecurityInsight Pro the file is read once, by setup, to move it into the CMDB in the Pro database; runs then read the Pro CMDB.",
|      "whenToChange": "Only when your CMDB export lives on a share or other folder; leave empty when you drop CMDB.csv in the provider folder.",
|      "info": {
|        "what": "Points the CMDB provider at your CMDB export CSV when it is stored outside the SecurityInsight folder, for example on a file share.",
|        "whenChanged": "The CMDB cache is loaded from this file instead of the provider folder. A wrong path means no CMDB data, so CMDB columns stay empty. In SecurityInsight Pro the file is read once, by setup, to move it into the CMDB in the Pro database; runs then read the Pro CMDB.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Nothing else.",
|        "default": "The CMDB.csv in the CMDB provider folder is used",
|        "recommended": "Keep the default. Change it when: Only when your CMDB export lives on a share or other folder; leave empty when you drop CMDB.csv in the provider folder.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CmdbCsvPath/"
|      }
|    },
|    {
|      "name": "SI_CmdbRefreshIntervalHours",
|      "label": "CMDB cache refresh interval",
|      "group": "Connectors & CMDB",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "24 hours",
|      "description": "How many hours the cached CMDB data is reused before it is refreshed from the CSV; defaults to 24.",
|      "purpose": "How long the cached CMDB data is reused before it is reloaded from the CSV at the start of a profiling run.",
|      "effect": "Lower values pick up CMDB changes sooner but re-read the CSV more often; higher values save work but CMDB changes appear later. A full run always refreshes.",
|      "whenToChange": "Rarely. Lower it if your CMDB export changes several times a day.",
|      "unit": "hours",
|      "info": {
|        "what": "How long the cached CMDB data is reused before it is reloaded from the CSV at the start of a profiling run.",
|        "whenChanged": "Lower values pick up CMDB changes sooner but re-read the CSV more often; higher values save work but CMDB changes appear later. A full run always refreshes.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Nothing else.",
|        "default": "24 hours",
|        "recommended": "Keep the default. Change it when: Rarely. Lower it if your CMDB export changes several times a day.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CmdbRefreshIntervalHours/"
|      }
|    },
|    {
|      "name": "SI_CollectDefenderRecommendations",
|      "label": "Defender for Cloud recommendations",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On: recommendations are collected on every Azure run",
|      "description": "--- azure engine: Defender for Cloud recommendations + CVEs ------------------- Collected by default into their own table. Opt out, or rename the destination:",
|      "purpose": "Whether the Azure engine also collects every unhealthy Defender for Cloud recommendation into its own table for the Risk Analysis reports.",
|      "effect": "Setting it to false skips the recommendations step: the Azure run is a little shorter and ingests less data, but reports have no Defender for Cloud recommendation findings.",
|      "whenToChange": "Turn off only if you do not use Defender for Cloud or do not want these findings.",
|      "card": "Extra details",
|      "info": {
|        "what": "Whether the Azure engine also collects every unhealthy Defender for Cloud recommendation into its own table for the Risk Analysis reports.",
|        "whenOn": "recommendations are collected on every Azure run",
|        "whenOff": "Setting it to false skips the recommendations step: the Azure run is a little shorter and ingests less data, but reports have no Defender for Cloud recommendation findings.",
|        "risk": "Defender for Cloud recommendations are no longer collected: those findings disappear from the reports (they are not fixed). Reversible: the next Azure run collects them again.",
|        "requires": "Nothing else.",
|        "default": "On: recommendations are collected on every Azure run",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CollectDefenderRecommendations/",
|        "confirmWhen": "off",
|        "confirm": "Setting it to false skips the recommendations step: the Azure run is a little shorter and ingests less data, but reports have no Defender for Cloud recommendation findings. Defender for Cloud recommendations are no longer collected: those findings disappear from the reports (they are not fixed). Reversible: the next Azure run collects them again."
|      }
|    },
|    {
|      "name": "SI_Correlation_DryRun",
|      "label": "Asset correlation: plan only",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: the correlation results are published",
|      "description": "compute and report, publish nothing",
|      "purpose": "Makes the asset correlation compute and report its results without publishing them.",
|      "effect": "On, nothing is published, so the CI keys stay as they were on the last published run.",
|      "whenToChange": "Only while checking a change to the correlation.",
|      "info": {
|        "what": "Makes the asset correlation compute and report its results without publishing them.",
|        "whenOn": "On, nothing is published, so the CI keys stay as they were on the last published run.",
|        "whenOff": "the correlation results are published",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off: the correlation results are published",
|        "recommended": "Keep the default. Change it when: Only while checking a change to the correlation.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Correlation_DryRun/"
|      }
|    },
|    {
|      "name": "SI_Correlation_RowLimit",
|      "label": "Asset correlation: row limit",
|      "group": "Connectors & CMDB",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0: no limit, every asset",
|      "description": "0 = every asset (troubleshooting only)",
|      "purpose": "A limit on how many assets one correlation run reads, for troubleshooting.",
|      "effect": "A number above 0 correlates only that many assets; the rest keep their previous result.",
|      "whenToChange": "Only while troubleshooting.",
|      "min": 0,
|      "info": {
|        "what": "A limit on how many assets one correlation run reads, for troubleshooting.",
|        "whenChanged": "A number above 0 correlates only that many assets; the rest keep their previous result.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "0: no limit, every asset",
|        "recommended": "Keep the default. Change it when: Only while troubleshooting.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Correlation_RowLimit/"
|      }
|    },
|    {
|      "name": "SI_CustomConfigPath",
|      "label": "Custom configuration file path",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The standard custom configuration file in the config folder",
|      "description": "Path to a non-default custom config file (only when this file lives outside the canonical config/ folder; very rare).",
|      "purpose": "Points the asset-profiling engine at a custom configuration file kept outside the standard config folder.",
|      "effect": "When set, the profiling engine loads this file at start, even when started by a launcher. A wrong path means your settings are not applied.",
|      "whenToChange": "Very rarely; only if your custom configuration file lives outside the config folder.",
|      "info": {
|        "what": "Points the asset-profiling engine at a custom configuration file kept outside the standard config folder.",
|        "whenChanged": "When set, the profiling engine loads this file at start, even when started by a launcher. A wrong path means your settings are not applied.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "The standard custom configuration file in the config folder",
|        "recommended": "Keep the default. Change it when: Very rarely; only if your custom configuration file lives outside the config folder.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CustomConfigPath/"
|      }
|    },
|    {
|      "name": "SI_CVE_MaxPublishedAgeDays",
|      "label": "CVE maximum age",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: CVEs of every age are reported",
|      "description": "0 = off",
|      "purpose": "Limits the vulnerability (CVE) reports to vulnerabilities published within the last number of days.",
|      "effect": "Any value above 0 removes older CVEs from the reports, making them shorter and faster, but old unpatched vulnerabilities are no longer shown.",
|      "whenToChange": "Only if you deliberately want to focus on recently published vulnerabilities.",
|      "unit": "days",
|      "card": "Vulnerability (CVE) filters",
|      "info": {
|        "what": "Limits the vulnerability (CVE) reports to vulnerabilities published within the last number of days.",
|        "whenChanged": "Any value above 0 removes older CVEs from the reports, making them shorter and faster, but old unpatched vulnerabilities are no longer shown.",
|        "risk": "Any value above 0 hides older CVEs from the reports: old unpatched vulnerabilities -- often the most exploited -- become invisible to readers. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Off: CVEs of every age are reported",
|        "recommended": "0 (every CVE, whatever its age).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CVE_MaxPublishedAgeDays/"
|      }
|    },
|    {
|      "name": "SI_CVE_MinCvssScore",
|      "label": "CVE minimum CVSS score",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: CVEs of every score are reported",
|      "description": "0..10; 0 = off",
|      "purpose": "Limits the vulnerability (CVE) reports to vulnerabilities at or above this CVSS score (0 to 10).",
|      "effect": "A value above 0 removes lower-scored CVEs from the reports, making them shorter and faster but hiding those findings completely.",
|      "whenToChange": "Only if you want to focus on high-impact vulnerabilities, for example 7.0.",
|      "card": "Vulnerability (CVE) filters",
|      "info": {
|        "what": "Limits the vulnerability (CVE) reports to vulnerabilities at or above this CVSS score (0 to 10).",
|        "whenChanged": "A value above 0 removes lower-scored CVEs from the reports, making them shorter and faster but hiding those findings completely.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Off: CVEs of every score are reported",
|        "recommended": "Keep the default. Change it when: Only if you want to focus on high-impact vulnerabilities, for example 7.0.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CVE_MinCvssScore/"
|      }
|    },
|    {
|      "name": "SI_CVE_MinSeverity",
|      "label": "CVE minimum severity",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: CVEs of every severity are reported",
|      "description": "--- CVE report filters (RA) ----------------------------------------------- All OFF by default -- every CVE is reported. Each one REMOVES findings.",
|      "purpose": "Limits the vulnerability (CVE) reports to this severity and above: Critical, High or Medium.",
|      "effect": "Setting it removes all less severe CVEs from the reports. Shorter, faster reports, but those findings are not shown anywhere in the report. An unknown value is ignored.",
|      "whenToChange": "Only if you want the reports to focus on the most severe vulnerabilities.",
|      "card": "Vulnerability (CVE) filters",
|      "info": {
|        "what": "Limits the vulnerability (CVE) reports to this severity and above: Critical, High or Medium.",
|        "whenChanged": "Setting it removes all less severe CVEs from the reports. Shorter, faster reports, but those findings are not shown anywhere in the report. An unknown value is ignored.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Off: CVEs of every severity are reported",
|        "recommended": "Keep the default. Change it when: Only if you want the reports to focus on the most severe vulnerabilities.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CVE_MinSeverity/"
|      }
|    },
|    {
|      "name": "SI_CVE_RequireExploit",
|      "label": "Only CVEs with known exploits",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: CVEs are reported whether or not an exploit is known",
|      "description": "only CVEs with exploit signals",
|      "purpose": "Limits the vulnerability (CVE) reports to vulnerabilities for which an exploit is known to exist.",
|      "effect": "When on, every CVE without a known exploit is removed from the reports. Much shorter reports, but unexploited vulnerabilities are hidden.",
|      "whenToChange": "Only if you want to prioritise vulnerabilities that are actively exploitable.",
|      "card": "Vulnerability (CVE) filters",
|      "info": {
|        "what": "Limits the vulnerability (CVE) reports to vulnerabilities for which an exploit is known to exist.",
|        "whenOn": "When on, every CVE without a known exploit is removed from the reports. Much shorter reports, but unexploited vulnerabilities are hidden.",
|        "whenOff": "CVEs are reported whether or not an exploit is known",
|        "risk": "Hides every vulnerability without a known exploit from the reports: real, patchable exposure becomes invisible to readers. Reversible at once (the next report shows them again).",
|        "requires": "Nothing else.",
|        "default": "Off: CVEs are reported whether or not an exploit is known",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CVE_RequireExploit/",
|        "confirmWhen": "on",
|        "confirm": "When on, every CVE without a known exploit is removed from the reports. Much shorter reports, but unexploited vulnerabilities are hidden. Hides every vulnerability without a known exploit from the reports: real, patchable exposure becomes invisible to readers. Reversible at once (the next report shows them again)."
|      }
|    },
|    {
|      "name": "SI_DataHealth_Enabled",
|      "label": "Data health check",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On",
|      "description": "DATA HEALTH (Pro): every day a random 10% of each source's records are looked up in the newest collection, and a random 10% of the devices with vulnerability findings are asked again from Defender. Read-only. Three anomalous days in a row make the data Unhealthy (nothing is sent out until one good day, or a SuperAdmin lets one channel through); one good day, Healthy.",
|      "purpose": "Every day SecurityInsight checks its own data: a random 10% of each source's records (at least 50) are read from the source and looked up in the newest collection, and a random 10% of the devices with vulnerability findings are asked again from Defender. It only reads. Three anomalous days in a row make the data Unhealthy, one good day makes it Healthy again; while Unhealthy nothing is sent out unless a SuperAdmin lets a channel through.",
|      "effect": "Off: nothing is checked, the state is no longer updated and nothing is held because of data health. On: the check runs with the verification job every day.",
|      "whenToChange": "Keep it on. Switch it off only for a short time while Microsoft support confirms a problem in a source.",
|      "card": "Data health",
|      "info": {
|        "what": "Every day SecurityInsight checks its own data: a random 10% of each source's records (at least 50) are read from the source and looked up in the newest collection, and a random 10% of the devices with vulnerability findings are asked again from Defender. It only reads. Three anomalous days in a row make the data Unhealthy, one good day makes it Healthy again; while Unhealthy nothing is sent out unless a SuperAdmin lets a channel through.",
|        "whenOn": "the check runs with the verification job every day.",
|        "whenOff": "nothing is checked, the state is no longer updated and nothing is held because of data health.",
|        "risk": "Off: SecurityInsight no longer checks its own data, and nothing is held when the data goes wrong -- a short or wrong collection can reach tickets, the CMDB and the connectors. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "Keep the default. Change it when: Keep it on. Switch it off only for a short time while Microsoft support confirms a problem in a source.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Enabled/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_Margin_Azure",
|      "label": "Data health margin: Azure resources",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "3 %",
|      "description": "Data health margin, Azure resources: percent of those checked that may differ.",
|      "purpose": "How many of the checked Azure resources may be missing from the newest collection or differ from Azure before the day counts as anomalous, as a percent of the resources checked (never fewer than the minimum records below).",
|      "effect": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|      "whenToChange": "Raise it only when resources are created and deleted all day (for example short-lived test environments).",
|      "unit": "%",
|      "card": "Data health",
|      "info": {
|        "what": "How many of the checked Azure resources may be missing from the newest collection or differ from Azure before the day counts as anomalous, as a percent of the resources checked (never fewer than the minimum records below).",
|        "whenChanged": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|        "risk": "Higher: more missing or different Azure resources are tolerated before data-out is held. Lower: data-out is held sooner. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "3 %",
|        "recommended": "Keep the default. Change it when: Raise it only when resources are created and deleted all day (for example short-lived test environments).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Margin_Azure/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_Margin_DefenderForCloud",
|      "label": "Data health margin: Defender for Cloud recommendations",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "5 %",
|      "description": "Data health margin, Defender for Cloud recommendations: percent of those checked that may differ.",
|      "purpose": "How many of the checked resources with Defender for Cloud recommendations may be missing from the newest collection or have a different number of open recommendations before the day counts as anomalous, as a percent of those checked (never fewer than the minimum records below).",
|      "effect": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|      "whenToChange": "Raise it only when Defender for Cloud re-evaluates many resources between the collection and the check.",
|      "unit": "%",
|      "card": "Data health",
|      "info": {
|        "what": "How many of the checked resources with Defender for Cloud recommendations may be missing from the newest collection or have a different number of open recommendations before the day counts as anomalous, as a percent of those checked (never fewer than the minimum records below).",
|        "whenChanged": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|        "risk": "Higher: more differences in Defender for Cloud recommendations are tolerated before data-out is held. Lower: data-out is held sooner. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "5 %",
|        "recommended": "Keep the default. Change it when: Raise it only when Defender for Cloud re-evaluates many resources between the collection and the check.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Margin_DefenderForCloud/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_Margin_Devices",
|      "label": "Data health margin: Defender devices",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "2 %",
|      "description": "Data health margin, Defender devices: percent of those checked that may differ.",
|      "purpose": "How many of the checked Defender for Endpoint devices may be missing from the newest collection or differ from Defender before the day counts as anomalous, as a percent of the devices checked (never fewer than the minimum records below).",
|      "effect": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|      "whenToChange": "Raise it only when many devices are onboarded or removed every day.",
|      "unit": "%",
|      "card": "Data health",
|      "info": {
|        "what": "How many of the checked Defender for Endpoint devices may be missing from the newest collection or differ from Defender before the day counts as anomalous, as a percent of the devices checked (never fewer than the minimum records below).",
|        "whenChanged": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|        "risk": "Higher: more missing or different devices are tolerated before data-out is held. Lower: data-out is held sooner. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "2 %",
|        "recommended": "Keep the default. Change it when: Raise it only when many devices are onboarded or removed every day.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Margin_Devices/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_Margin_EntraApps",
|      "label": "Data health margin: Entra apps and service principals",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 %",
|      "description": "Data health margin, Entra apps and service principals: percent of those checked that may differ.",
|      "purpose": "How many of the checked Entra apps and service principals may be missing from the newest collection or differ from Entra before the day counts as anomalous, as a percent of those checked (never fewer than the minimum records below).",
|      "effect": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|      "whenToChange": "Raise it only when apps are added and removed so often that normal changes count as differences.",
|      "unit": "%",
|      "card": "Data health",
|      "info": {
|        "what": "How many of the checked Entra apps and service principals may be missing from the newest collection or differ from Entra before the day counts as anomalous, as a percent of those checked (never fewer than the minimum records below).",
|        "whenChanged": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|        "risk": "Higher: more missing or different apps are tolerated before data-out is held. Lower: data-out is held sooner. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "1 %",
|        "recommended": "Keep the default. Change it when: Raise it only when apps are added and removed so often that normal changes count as differences.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Margin_EntraApps/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_Margin_EntraUsers",
|      "label": "Data health margin: Entra users",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 %",
|      "description": "Margins: how many of the checked records may differ, in percent of those checked, per source (never fewer than the minimum).",
|      "purpose": "How many of the checked Entra users may be missing from the newest collection or differ from Entra before the day counts as anomalous, as a percent of the users checked (never fewer than the minimum records below).",
|      "effect": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|      "whenToChange": "Raise it only when the users change so fast that the daily check sees normal changes as differences.",
|      "unit": "%",
|      "card": "Data health",
|      "info": {
|        "what": "How many of the checked Entra users may be missing from the newest collection or differ from Entra before the day counts as anomalous, as a percent of the users checked (never fewer than the minimum records below).",
|        "whenChanged": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|        "risk": "Higher: more missing or different users are tolerated before data-out is held. Lower: data-out is held sooner. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "1 %",
|        "recommended": "Keep the default. Change it when: Raise it only when the users change so fast that the daily check sees normal changes as differences.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Margin_EntraUsers/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_Margin_RiskAnalysis",
|      "label": "Data health margin: Risk Analysis reports",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "3 %",
|      "description": "Data health margin, each Risk Analysis report: percent of the checked findings that may differ from Defender.",
|      "purpose": "Per Risk Analysis report with vulnerability findings: how many of the checked findings may differ from what Defender reports now (missing, or no longer reported) before the day counts as anomalous, as a percent of those checked (never fewer than the minimum records below).",
|      "effect": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|      "whenToChange": "Raise it only when devices are patched so often that findings fixed since the run count as differences.",
|      "unit": "%",
|      "card": "Data health",
|      "info": {
|        "what": "Per Risk Analysis report with vulnerability findings: how many of the checked findings may differ from what Defender reports now (missing, or no longer reported) before the day counts as anomalous, as a percent of those checked (never fewer than the minimum records below).",
|        "whenChanged": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|        "risk": "Higher: more differences between a report and Defender are tolerated before data-out is held. Lower: data-out is held sooner. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "3 %",
|        "recommended": "Keep the default. Change it when: Raise it only when devices are patched so often that findings fixed since the run count as differences.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Margin_RiskAnalysis/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_Margin_Vulnerabilities",
|      "label": "Data health margin: vulnerabilities",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "5 %",
|      "description": "Data health margin, vulnerabilities: percent of Defender's vulnerabilities of the checked devices that may be missing.",
|      "purpose": "How many of the vulnerabilities Defender reports for the checked devices may be missing from SecurityInsight's findings before the day counts as anomalous, as a percent of those vulnerabilities (never fewer than the minimum records below).",
|      "effect": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|      "whenToChange": "Raise it when vulnerabilities are left out on purpose (excluded vulnerabilities, a minimum age) and the check counts them.",
|      "unit": "%",
|      "card": "Data health",
|      "info": {
|        "what": "How many of the vulnerabilities Defender reports for the checked devices may be missing from SecurityInsight's findings before the day counts as anomalous, as a percent of those vulnerabilities (never fewer than the minimum records below).",
|        "whenChanged": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|        "risk": "Higher: more vulnerabilities missing from the findings are tolerated before data-out is held. Lower: data-out is held sooner. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "5 %",
|        "recommended": "Keep the default. Change it when: Raise it when vulnerabilities are left out on purpose (excluded vulnerabilities, a minimum age) and the check counts them.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Margin_Vulnerabilities/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_MarginMinimum",
|      "label": "Data health margin: minimum records",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "5 records",
|      "description": "Data health margins: the fewest differences any margin allows, whatever its percent.",
|      "purpose": "The fewest differences any data health margin allows, whatever its percent -- so a small source does not turn the data Unhealthy over one or two records.",
|      "effect": "Higher tolerates more differences in small sources; lower makes small sources stricter.",
|      "whenToChange": "Keep the default.",
|      "unit": "records",
|      "card": "Data health",
|      "info": {
|        "what": "The fewest differences any data health margin allows, whatever its percent -- so a small source does not turn the data Unhealthy over one or two records.",
|        "whenChanged": "Higher tolerates more differences in small sources; lower makes small sources stricter.",
|        "risk": "Higher: small sources tolerate more differences before data-out is held. Lower: small sources are stricter. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "5 records",
|        "recommended": "Keep the default. Change it when: Keep the default.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_MarginMinimum/"
|      }
|    },
|    {
|      "name": "SI_DataOut_Outputs",
|      "label": "Data out: outputs written",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the outputs that are on by default are written",
|      "description": "--- Data out: the workbooks and ServiceNow Import Set hand-offs written after each data sync --- Which outputs are written (ids from config\\data-out.locked.json, comma separated); not set = the outputs on by default.",
|      "purpose": "Which data-out outputs SecurityInsight writes after each data sync: the Excel workbooks (CIs, findings, the findings summary, records) and the ServiceNow Import Set hand-offs. Each is a listed connector whose runs and items are recorded.",
|      "effect": "A list of output ids (for example excel-ci, excel-findings-detailed, servicenow-ci) writes exactly those and no others; an id that is not an output is left out with a warning. Outputs of the other edition are never written.",
|      "whenToChange": "When you want a workbook or a ServiceNow hand-off that is off by default, or want to stop one that is on.",
|      "card": "Data out",
|      "info": {
|        "what": "Which data-out outputs SecurityInsight writes after each data sync: the Excel workbooks (CIs, findings, the findings summary, records) and the ServiceNow Import Set hand-offs. Each is a listed connector whose runs and items are recorded.",
|        "whenChanged": "A list of output ids (for example excel-ci, excel-findings-detailed, servicenow-ci) writes exactly those and no others; an id that is not an output is left out with a warning. Outputs of the other edition are never written.",
|        "risk": "Changes which workbooks and ServiceNow hand-offs are written from the next data sync; an output switched off stops being refreshed, what it wrote before stays where it is. Reversible: switch it on again.",
|        "requires": "Nothing else.",
|        "default": "Not set: the outputs that are on by default are written",
|        "recommended": "Leave it empty for the default outputs; name the outputs you need.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataOut_Outputs/"
|      }
|    },
|    {
|      "name": "SI_DataOut_ServiceNowCiTable",
|      "label": "Data out: ServiceNow CI Import Set table",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: the ServiceNow CI hand-off output is not written, and its run says so",
|      "description": "The Import Set tables of the two ServiceNow outputs (an output without its table is not written, and says so).",
|      "purpose": "The ServiceNow Import Set table the CI hand-off output (servicenow-ci) sends its rows to.",
|      "effect": "Rows are sent to this Import Set table, where your transform map creates and updates CIs. Without it the output does nothing.",
|      "whenToChange": "When you switch the servicenow-ci output on.",
|      "info": {
|        "what": "The ServiceNow Import Set table the CI hand-off output (servicenow-ci) sends its rows to.",
|        "whenChanged": "Rows are sent to this Import Set table, where your transform map creates and updates CIs. Without it the output does nothing.",
|        "risk": "Rows go to the named ServiceNow Import Set table; a wrong table name means the rows land where no transform map reads them. Reversible at once.",
|        "requires": "The servicenow-ci output switched on (SI_DataOut_Outputs) and the ServiceNow connection.",
|        "default": "Not set: the ServiceNow CI hand-off output is not written, and its run says so",
|        "recommended": "Keep the default. Change it when: When you switch the servicenow-ci output on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataOut_ServiceNowCiTable/"
|      }
|    },
|    {
|      "name": "SI_DataOut_ServiceNowRequest",
|      "label": "Data out: ServiceNow resync or test batch",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Empty: no request. Each request is carried out once.",
|      "description": "A one-time request for the ServiceNow outputs, carried out on the next sync: 'resync:<token>' sends every record in scope again as new (one batch, mode resync); 'test:<token>' first sends at most 5 rows per output as a test batch the importer never imports. A token is carried out once. Set from Connectors > ServiceNow: one route.",
|      "purpose": "A one-time request for the ServiceNow outputs, carried out on the next sync: a full resync (every record in scope sent again as new, in one batch) or a test batch (at most 5 rows per output, which your importer never imports).",
|      "effect": "resync:<token> sends every record in scope as new in the next batch (mode resync, imported like a normal batch). test:<token> first sends a test batch of at most 5 rows per output (mode test, never imported), then the normal batch.",
|      "whenToChange": "After your ServiceNow team rebuilt or emptied its tables (resync), or while it builds and checks its importer (test batch). Use the buttons on Connectors > ServiceNow: one route.",
|      "info": {
|        "what": "A one-time request for the ServiceNow outputs, carried out on the next sync: a full resync (every record in scope sent again as new, in one batch) or a test batch (at most 5 rows per output, which your importer never imports).",
|        "whenChanged": "resync:<token> sends every record in scope as new in the next batch (mode resync, imported like a normal batch). test:<token> first sends a test batch of at most 5 rows per output (mode test, never imported), then the normal batch.",
|        "risk": "A resync sends every record in scope again in one batch; a test batch sends at most 5 rows per output that the importer never imports. Carried out once per token; nothing is deleted.",
|        "requires": "A ServiceNow output switched on and the ServiceNow data-out connector.",
|        "default": "Empty: no request. Each request is carried out once.",
|        "recommended": "Keep the default. Change it when: After your ServiceNow team rebuilt or emptied its tables (resync), or while it builds and checks its importer (test batch). Use the buttons on Connectors > ServiceNow: one route.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataOut_ServiceNowRequest/"
|      }
|    },
|    {
|      "name": "SI_DataOut_ServiceNowStagingStatusTable",
|      "label": "Data out: ServiceNow staging status table",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "u_si_staging_status. An install that sent to ServiceNow before the staging status table existed has it empty: the rows are sent without it, with a warning, until your ServiceNow team creates the table and you set its name here.",
|      "description": "The staging status table: one row when a push of an output starts (writing) and one when it ends (complete, failed or held), so your ServiceNow importer knows when a batch is complete. Every data row carries the batch id (u_si_batch_id). Not set = u_si_staging_status. '' = no staging status table: the rows are sent without it, with a warning.",
|      "purpose": "The ServiceNow import set table where SecurityInsight says when each push of a ServiceNow output starts (writing) and ends (complete, failed or held). Every data row carries the same batch id, so your importer imports a batch only once it is complete.",
|      "effect": "Set: each push is one batch -- a writing row first, the batch id on every data row, then a complete, failed or held row. If the table is missing or lacks a column, nothing is sent. Empty: the rows are sent without a batch, and the ServiceNow check warns.",
|      "whenToChange": "After your ServiceNow team has created the staging status table (Connectors > the ServiceNow data-out connector > For your ServiceNow team), if it has another name than the default -- or, on an install that has it empty, to switch it on.",
|      "info": {
|        "what": "The ServiceNow import set table where SecurityInsight says when each push of a ServiceNow output starts (writing) and ends (complete, failed or held). Every data row carries the same batch id, so your importer imports a batch only once it is complete.",
|        "whenChanged": "Set: each push is one batch -- a writing row first, the batch id on every data row, then a complete, failed or held row. If the table is missing or lacks a column, nothing is sent. Empty: the rows are sent without a batch, and the ServiceNow check warns.",
|        "risk": "Set to a table that does not exist on the instance, nothing is sent to ServiceNow until it is there (the ServiceNow check says why). Empty, your importer cannot tell a finished push from one that stopped halfway. Reversible at once.",
|        "requires": "A ServiceNow output switched on (SI_DataOut_Outputs), the ServiceNow data-out connector and the table created in ServiceNow.",
|        "default": "u_si_staging_status. An install that sent to ServiceNow before the staging status table existed has it empty: the rows are sent without it, with a warning, until your ServiceNow team creates the table and you set its name here.",
|        "recommended": "Keep the default. Change it when: After your ServiceNow team has created the staging status table (Connectors > the ServiceNow data-out connector > For your ServiceNow team), if it has another name than the default -- or, on an install that has it empty, to switch it on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataOut_ServiceNowStagingStatusTable/"
|      }
|    },
|    {
|      "name": "SI_DataOut_ServiceNowVulnTable",
|      "label": "Data out: ServiceNow vulnerable item Import Set table",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: the ServiceNow vulnerable item output is not written, and its run says so",
|      "description": "the vulnerable item output's Import Set table (not set = that output is not written, and says so)",
|      "purpose": "The ServiceNow Import Set table the vulnerable item output (servicenow-vulnerable-item) sends its rows to.",
|      "effect": "Rows are sent to this Import Set table, where your transform map creates and updates vulnerable items. Without it the output does nothing.",
|      "whenToChange": "When you switch the servicenow-vulnerable-item output on.",
|      "info": {
|        "what": "The ServiceNow Import Set table the vulnerable item output (servicenow-vulnerable-item) sends its rows to.",
|        "whenChanged": "Rows are sent to this Import Set table, where your transform map creates and updates vulnerable items. Without it the output does nothing.",
|        "risk": "Rows go to the named ServiceNow Import Set table; a wrong table name means the rows land where no transform map reads them. Reversible at once.",
|        "requires": "The servicenow-vulnerable-item output switched on (SI_DataOut_Outputs) and the ServiceNow connection.",
|        "default": "Not set: the ServiceNow vulnerable item output is not written, and its run says so",
|        "recommended": "Keep the default. Change it when: When you switch the servicenow-vulnerable-item output on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataOut_ServiceNowVulnTable/"
|      }
|    },
|    {
|      "name": "SI_DceIngestionUri",
|      "label": "Ingestion endpoint address",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: looked up from the endpoint name",
|      "description": "canonical SI alias",
|      "purpose": "The ingestion address of the data collection endpoint that Risk Analysis sends results to.",
|      "effect": "Used by Risk Analysis unless SI_RiskAnalysis_DceIngestionUri is set. A wrong address makes Risk Analysis ingestion fail; the collection engines do not read it.",
|      "whenToChange": "Rarely; only if automatic lookup of the endpoint cannot work in your environment.",
|      "info": {
|        "what": "The ingestion address of the data collection endpoint that Risk Analysis sends results to.",
|        "whenChanged": "Used by Risk Analysis unless SI_RiskAnalysis_DceIngestionUri is set. A wrong address makes Risk Analysis ingestion fail; the collection engines do not read it.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Not set: looked up from the endpoint name",
|        "recommended": "Keep the default. Change it when: Rarely; only if automatic lookup of the endpoint cannot work in your environment.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DceIngestionUri/"
|      }
|    },
|    {
|      "name": "SI_DceName",
|      "label": "Data collection endpoint name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: endpoint pinning is skipped; setup may create dce-si-securityinsight",
|      "description": "DCE / DCR resource layout (auto-resolved when the canonical short names below match your tenant; override only when they don't).",
|      "purpose": "Name of the data collection endpoint all engines send their data to Log Analytics through.",
|      "effect": "Tells the engines which endpoint to use. A wrong name stops ingestion or, during setup, creates a new endpoint. Run health rows are not sent without it.",
|      "whenToChange": "Set at install to the endpoint your setup created; change only if you rename or move it.",
|      "card": "Log Analytics",
|      "info": {
|        "what": "Name of the data collection endpoint all engines send their data to Log Analytics through.",
|        "whenChanged": "Tells the engines which endpoint to use. A wrong name stops ingestion or, during setup, creates a new endpoint. Run health rows are not sent without it.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Not set: endpoint pinning is skipped; setup may create dce-si-securityinsight",
|        "recommended": "Keep the default. Change it when: Set at install to the endpoint your setup created; change only if you rename or move it.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DceName/"
|      }
|    },
|    {
|      "name": "SI_DceResourceGroup",
|      "label": "Data collection endpoint resource group",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Same resource group as the data collection rules",
|      "description": "DCE and DCR live in the SAME RG as the workspace by default (engine derives via Az lookup; explicit override only needed when you split resources across multiple RGs, which is unusual). Don't set these unless you've intentionally split -- stale value makes the engine print a wrong \"ingest -> DCR\" line.",
|      "purpose": "The resource group that holds the data collection endpoint used to send data to Log Analytics.",
|      "effect": "Tells the engines where to find the endpoint. A wrong value makes runs refuse to post when several endpoints share the name, or print misleading ingestion lines.",
|      "whenToChange": "Only when you have deliberately placed the endpoint in a different resource group than the rules.",
|      "info": {
|        "what": "The resource group that holds the data collection endpoint used to send data to Log Analytics.",
|        "whenChanged": "Tells the engines where to find the endpoint. A wrong value makes runs refuse to post when several endpoints share the name, or print misleading ingestion lines.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Same resource group as the data collection rules",
|        "recommended": "Keep the default. Change it when: Only when you have deliberately placed the endpoint in a different resource group than the rules.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DceResourceGroup/"
|      }
|    },
|    {
|      "name": "SI_DcrMergeDiagnostic",
|      "label": "Rule column diagnostic",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Diagnostic: dump pre-/post-merge column diff for every DCR ingest call. Off by default; turn on briefly when investigating \"column dropped\" warnings.",
|      "purpose": "Logs the difference between a data collection rule's columns and the data being sent, on every ingestion call.",
|      "effect": "On, each ingestion call logs added, removed and changed columns. Makes logs longer and runs slightly slower; never stops ingestion.",
|      "whenToChange": "Turn on briefly when investigating warnings about dropped columns.",
|      "info": {
|        "what": "Logs the difference between a data collection rule's columns and the data being sent, on every ingestion call.",
|        "whenOn": "On, each ingestion call logs added, removed and changed columns. Makes logs longer and runs slightly slower; never stops ingestion.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Off",
|        "recommended": "Keep the default. Change it when: Turn on briefly when investigating warnings about dropped columns.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DcrMergeDiagnostic/"
|      }
|    },
|    {
|      "name": "SI_DcrNamePattern",
|      "label": "Rule name pattern",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "dcr-si-{0}-profile",
|      "description": "engine default",
|      "purpose": "The pattern used to name each collection engine's data collection rule, where {0} is replaced by the engine name.",
|      "effect": "Changing it makes engines create and use differently named rules; existing rules are left behind and new ones are made.",
|      "whenToChange": "Only if you maintain a parallel naming scheme; most installs never should.",
|      "info": {
|        "what": "The pattern used to name each collection engine's data collection rule, where {0} is replaced by the engine name.",
|        "whenChanged": "Changing it makes engines create and use differently named rules; existing rules are left behind and new ones are made.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "dcr-si-{0}-profile",
|        "recommended": "Keep the default. Change it when: Only if you maintain a parallel naming scheme; most installs never should.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DcrNamePattern/"
|      }
|    },
|    {
|      "name": "SI_DcrResourceGroup",
|      "label": "Data collection rules resource group",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: Risk Analysis uses DcrResourceGroup; setup uses rg-securityinsight",
|      "description": "Resource group holding the data collection rules (and, by default, the data collection endpoint) used to ingest SecurityInsight data into Log Analytics.",
|      "purpose": "Resource group holding the data collection rules (and, by default, the endpoint) used to send data to Log Analytics.",
|      "effect": "Tells engines where to find and create rules. A wrong group creates duplicate rules or refuses to post. Run health rows are not sent without it.",
|      "whenToChange": "Set at install; change only if you move the rules.",
|      "card": "Log Analytics",
|      "info": {
|        "what": "Resource group holding the data collection rules (and, by default, the endpoint) used to send data to Log Analytics.",
|        "whenChanged": "Tells engines where to find and create rules. A wrong group creates duplicate rules or refuses to post. Run health rows are not sent without it.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Not set: Risk Analysis uses DcrResourceGroup; setup uses rg-securityinsight",
|        "recommended": "Keep the default. Change it when: Set at install; change only if you move the rules.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DcrResourceGroup/"
|      }
|    },
|    {
|      "name": "SI_DefenderWorkspaceResourceId",
|      "label": "Defender data workspace",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "endpoint"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: Defender data is read from the SecurityInsight workspace",
|      "description": "only when MDE/IdentityInfo lives in a DIFFERENT workspace",
|      "purpose": "Full resource id of a separate Log Analytics workspace holding Defender data, when it is not the SecurityInsight workspace.",
|      "effect": "Identity discovery and Risk Analysis queries read Defender tables from this workspace. A wrong value makes those queries return nothing or fail.",
|      "whenToChange": "Only when your Defender data is in a different workspace than SecurityInsight's own.",
|      "card": "Log Analytics",
|      "info": {
|        "what": "Full resource id of a separate Log Analytics workspace holding Defender data, when it is not the SecurityInsight workspace.",
|        "whenChanged": "Identity discovery and Risk Analysis queries read Defender tables from this workspace. A wrong value makes those queries return nothing or fail.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: endpoint.",
|        "default": "Not set: Defender data is read from the SecurityInsight workspace",
|        "recommended": "Keep the default. Change it when: Only when your Defender data is in a different workspace than SecurityInsight's own.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DefenderWorkspaceResourceId/"
|      }
|    },
|    {
|      "name": "SI_DeletionProof_Azure",
|      "label": "Retire at once: resources deleted in Azure",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: an Azure resource Azure no longer lists waits the not-seen grace period, as before",
|      "description": "an Azure resource with a Delete in the Resource Graph resource changes",
|      "purpose": "Retires an asset at once when Azure PROVES its resource was deleted: a Delete in Azure Resource Graph's resource changes (the last 14 days). Merely missing from a list is never proof -- it keeps the not-seen grace period.",
|      "effect": "Stages: the CI build checks the Azure records missing from a complete collection against the resource changes; a proven one is recorded, its CI retires at once ('retired at once: deleted in Azure') -- the proof wins over the grace period -- and its open vulnerabilities close as 'asset deleted in Azure', never as fixed. A CI another source still sees stays active. A resource listed again is active again and its findings reopen. A read that is not complete decides nothing for what it did not return.",
|      "whenToChange": "When an asset deleted in Azure should not wait the grace period before it and its vulnerabilities are retired.",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "Retires an asset at once when Azure PROVES its resource was deleted: a Delete in Azure Resource Graph's resource changes (the last 14 days). Merely missing from a list is never proof -- it keeps the not-seen grace period.",
|        "whenOn": "Stages: the CI build checks the Azure records missing from a complete collection against the resource changes; a proven one is recorded, its CI retires at once ('retired at once: deleted in Azure') -- the proof wins over the grace period -- and its open vulnerabilities close as 'asset deleted in Azure', never as fixed. A CI another source still sees stays active. A resource listed again is active again and its findings reopen. A read that is not complete decides nothing for what it did not return.",
|        "whenOff": "an Azure resource Azure no longer lists waits the not-seen grace period, as before",
|        "risk": "Assets of resources deleted in Azure retire from the next CI build and their vulnerabilities close as deleted (ServiceNow closures follow). Reversible: turn it off and the next build decides them by the grace period again.",
|        "requires": "Read access to Azure Resource Graph (Reader, which the engine identity already has).",
|        "default": "Off: an Azure resource Azure no longer lists waits the not-seen grace period, as before",
|        "recommended": "Off, unless your organisation chose it.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DeletionProof_Azure/",
|        "confirmWhen": "on",
|        "confirm": "Assets whose Azure resource Azure proves deleted retire at once from the next CI build; their open vulnerabilities close as asset deleted in Azure."
|      }
|    },
|    {
|      "name": "SI_DeletionProof_Entra",
|      "label": "Retire at once: objects deleted in Entra ID",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: a user, device or group Entra ID no longer lists waits the not-seen grace period, as before",
|      "description": "Retire at once on PROOF of deletion, per source. Off by default. On, an asset whose source proves it deleted (never merely missing from a list -- that keeps the not-seen grace period) retires at once, and its open vulnerabilities close as 'asset deleted in <source>', never as fixed. Restored / listed again = active again, its findings reopen.",
|      "purpose": "Retires an asset at once when Entra ID PROVES its object was deleted: the user, device or group is in Entra ID's deleted items. Merely missing from a list is never proof -- it keeps the not-seen grace period.",
|      "effect": "Stages: the CI build checks the Entra ID records (and the Exposure Graph users and groups) missing from a complete collection against Entra ID's deleted items; a proven one is recorded, its CI retires at once ('retired at once: deleted in Entra ID') -- the proof wins over the grace period -- and its open vulnerabilities close as 'asset deleted in Entra ID', never as fixed. A CI another source still sees stays active. An object restored in Entra ID is listed again: its CI is active again and its findings reopen. A read that is not complete decides nothing for what it did not return.",
|      "whenToChange": "When an object deleted in Entra ID should not wait the grace period before it and its vulnerabilities are retired.",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "Retires an asset at once when Entra ID PROVES its object was deleted: the user, device or group is in Entra ID's deleted items. Merely missing from a list is never proof -- it keeps the not-seen grace period.",
|        "whenOn": "Stages: the CI build checks the Entra ID records (and the Exposure Graph users and groups) missing from a complete collection against Entra ID's deleted items; a proven one is recorded, its CI retires at once ('retired at once: deleted in Entra ID') -- the proof wins over the grace period -- and its open vulnerabilities close as 'asset deleted in Entra ID', never as fixed. A CI another source still sees stays active. An object restored in Entra ID is listed again: its CI is active again and its findings reopen. A read that is not complete decides nothing for what it did not return.",
|        "whenOff": "a user, device or group Entra ID no longer lists waits the not-seen grace period, as before",
|        "risk": "Assets of objects deleted in Entra ID retire from the next CI build and their vulnerabilities close as deleted (ServiceNow closures follow). Reversible: turn it off and the next build decides them by the grace period again.",
|        "requires": "Read access to Entra ID's deleted items (Directory.Read.All, which the engine identity already has).",
|        "default": "Off: a user, device or group Entra ID no longer lists waits the not-seen grace period, as before",
|        "recommended": "Off, unless your organisation chose it.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DeletionProof_Entra/",
|        "confirmWhen": "on",
|        "confirm": "Assets whose object Entra ID lists in its deleted items retire at once from the next CI build; their open vulnerabilities close as asset deleted in Entra ID."
|      }
|    },
|    {
|      "name": "SI_DeletionProof_Intune",
|      "label": "Retire at once: devices deleted in Intune",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: a device Intune no longer lists waits the not-seen grace period, as before",
|      "description": "a managed device deleted in Intune's audit events (needs DeviceManagementApps.Read.All)",
|      "purpose": "Retires an asset at once when Intune PROVES its managed device was deleted: a successful Delete of the managed device in Intune's audit events. Merely missing from a list is never proof -- it keeps the not-seen grace period.",
|      "effect": "Stages: the CI build checks the Intune records missing from a complete collection against Intune's audit events; a proven one is recorded, its CI retires at once ('retired at once: deleted in Intune') -- the proof wins over the grace period -- and its open vulnerabilities close as 'asset deleted in Intune', never as fixed. A CI another source still sees stays active. A device listed again is active again and its findings reopen. A read that is not complete (for example without the permission) decides nothing for what it did not return.",
|      "whenToChange": "When a device deleted in Intune should not wait the grace period before it and its vulnerabilities are retired.",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "Retires an asset at once when Intune PROVES its managed device was deleted: a successful Delete of the managed device in Intune's audit events. Merely missing from a list is never proof -- it keeps the not-seen grace period.",
|        "whenOn": "Stages: the CI build checks the Intune records missing from a complete collection against Intune's audit events; a proven one is recorded, its CI retires at once ('retired at once: deleted in Intune') -- the proof wins over the grace period -- and its open vulnerabilities close as 'asset deleted in Intune', never as fixed. A CI another source still sees stays active. A device listed again is active again and its findings reopen. A read that is not complete (for example without the permission) decides nothing for what it did not return.",
|        "whenOff": "a device Intune no longer lists waits the not-seen grace period, as before",
|        "risk": "Assets of devices deleted in Intune retire from the next CI build and their vulnerabilities close as deleted (ServiceNow closures follow). Reversible: turn it off and the next build decides them by the grace period again.",
|        "requires": "Read access to Intune's audit events (DeviceManagementApps.Read.All -- not granted to the engine identity by setup today; without it the read answers 403 and decides nothing).",
|        "default": "Off: a device Intune no longer lists waits the not-seen grace period, as before",
|        "recommended": "Off, unless your organisation chose it.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DeletionProof_Intune/",
|        "confirmWhen": "on",
|        "confirm": "Assets whose managed device Intune's audit events show deleted retire at once from the next CI build; their open vulnerabilities close as asset deleted in Intune."
|      }
|    },
|    {
|      "name": "SI_DisableAI",
|      "label": "Turn off AI classification (all engines)",
|      "group": "AI",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: AI runs where it has been switched on.",
|      "description": "Tenant-wide AI kill-switch (wins over every opt-in above).",
|      "purpose": "A master switch that turns off AI asset classification for every collection engine, whatever else is switched on.",
|      "effect": "When on, asset profiling, signal maps and schema proposals use rules only and send nothing to Azure OpenAI. It does not stop the role tiering classifier or the risk-analysis AI summary, which have their own switches.",
|      "whenToChange": "When AI must not be used, for example for a policy or cost reason.",
|      "card": "Where AI is used",
|      "hint": "Wins over every switch above.",
|      "info": {
|        "what": "A master switch that turns off AI asset classification for every collection engine, whatever else is switched on.",
|        "whenOn": "When on, asset profiling, signal maps and schema proposals use rules only and send nothing to Azure OpenAI. It does not stop the role tiering classifier or the risk-analysis AI summary, which have their own switches.",
|        "whenOff": "AI runs where it has been switched on.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Nothing else.",
|        "default": "Off: AI runs where it has been switched on.",
|        "recommended": "Keep the default. Change it when: When AI must not be used, for example for a policy or cost reason.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisableAI/"
|      }
|    },
|    {
|      "name": "SI_DisableAI_endpoint",
|      "label": "Turn off AI for the endpoint engine",
|      "group": "AI",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: the endpoint engine follows the general AI switches.",
|      "description": "When on, switches off AI classification for the endpoint engine only, even if Azure OpenAI is configured; AI stays on for the other engines.",
|      "purpose": "Switches off AI classification for the endpoint engine only, even when AI is on for all engines.",
|      "effect": "Devices are classified by rules only; any device without a rule-based tier gets the default tier. Removes AI cost for endpoints. Wins over every AI turn-on switch.",
|      "whenToChange": "When you use AI elsewhere but want rule-only tiering for devices.",
|      "card": "Where AI is used",
|      "hint": "Wins over the switches above, for endpoints only.",
|      "info": {
|        "what": "Switches off AI classification for the endpoint engine only, even when AI is on for all engines.",
|        "whenOn": "Devices are classified by rules only; any device without a rule-based tier gets the default tier. Removes AI cost for endpoints. Wins over every AI turn-on switch.",
|        "whenOff": "the endpoint engine follows the general AI switches.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Nothing else.",
|        "default": "Off: the endpoint engine follows the general AI switches.",
|        "recommended": "Keep the default. Change it when: When you use AI elsewhere but want rule-only tiering for devices.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisableAI_endpoint/"
|      }
|    },
|    {
|      "name": "SI_DisabledAssets_Collect",
|      "label": "Disabled accounts and devices: collect them",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": true,
|      "defaultText": "On: disabled accounts and devices are collected",
|      "description": "Disabled accounts and devices, one setting per stage. Disabled = the account is disabled in its own directory (Entra accountEnabled = false, AD userAccountControl disabled) -- users, service principals / managed identities and computers alike; never inferred from inactivity. Read on every run: an account that is enabled again is included again everywhere. A stage that leaves disabled assets out logs how many, and their open findings, actions and tickets are kept (never resolved or closed). The later stages only see what collection kept, so the last four need SI_DisabledAssets_Collect on.",
|      "purpose": "Whether disabled users, service principals and managed identities, and disabled computers are collected from the sources. Disabled means the account is disabled in its own directory (Entra accountEnabled false, AD account disabled); it is never guessed from inactivity.",
|      "effect": "Off leaves them out of the profiles, so no later stage can see them -- the correlation, Risk Analysis, finding actions and connector settings below then have no effect for disabled assets. Their open findings, actions and tickets are kept as they are (never resolved or closed). The state is read on every run: an account that is enabled again is collected again on the next run. Each run logs how many were left out.",
|      "whenToChange": "Turn it off only if you never want to see disabled accounts or devices anywhere in SecurityInsight.",
|      "card": "Disabled accounts and devices",
|      "hint": "Later stages only see what is collected.",
|      "info": {
|        "what": "Whether disabled users, service principals and managed identities, and disabled computers are collected from the sources. Disabled means the account is disabled in its own directory (Entra accountEnabled false, AD account disabled); it is never guessed from inactivity.",
|        "whenOn": "disabled accounts and devices are collected",
|        "whenOff": "Off leaves them out of the profiles, so no later stage can see them -- the correlation, Risk Analysis, finding actions and connector settings below then have no effect for disabled assets. Their open findings, actions and tickets are kept as they are (never resolved or closed). The state is read on every run: an account that is enabled again is collected again on the next run. Each run logs how many were left out.",
|        "risk": "Disabled accounts and devices disappear from profiles, CIs, reports and connectors from the next run; their open findings and tickets are kept (never closed). Reversible: the next run collects them again.",
|        "requires": "Nothing else.",
|        "default": "On: disabled accounts and devices are collected",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisabledAssets_Collect/",
|        "confirmWhen": "off",
|        "confirm": "Off leaves them out of the profiles, so no later stage can see them -- the correlation, Risk Analysis, finding actions and connector settings below then have no effect for disabled assets. Their open findings, actions and tickets are kept as they are (never resolved or closed). The state is read on every run: an account that is enabled again is collected again on the next run. Each run logs how many were left out. Disabled accounts and devices disappear from profiles, CIs, reports and connectors from the next run; their open findings and tickets are kept (never closed). Reversible: the next run collects them again."
|      }
|    },
|    {
|      "name": "SI_DisabledAssets_Connectors",
|      "label": "Disabled accounts and devices: connectors and exports",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off: connectors and exports leave disabled assets out",
|      "description": "sent out by connectors and exports",
|      "purpose": "Whether connectors and exports send disabled users, service principals, managed identities and computers out of SecurityInsight (ServiceNow, Jira, risk register, CMDB, data exports).",
|      "effect": "Off leaves disabled assets out of what is sent; a ticket or record already sent for one is kept as it is (never resolved or closed because the asset was left out) and carries on when the account is enabled again. On sends them like any other. Has no effect while collection of disabled assets is off. Each run logs how many were left out.",
|      "whenToChange": "Turn it on when your CMDB or ticketing system should also hold disabled accounts and devices.",
|      "card": "Disabled accounts and devices",
|      "needs": "SI_DisabledAssets_Collect",
|      "info": {
|        "what": "Whether connectors and exports send disabled users, service principals, managed identities and computers out of SecurityInsight (ServiceNow, Jira, risk register, CMDB, data exports).",
|        "whenOn": "Off leaves disabled assets out of what is sent; a ticket or record already sent for one is kept as it is (never resolved or closed because the asset was left out) and carries on when the account is enabled again. On sends them like any other. Has no effect while collection of disabled assets is off. Each run logs how many were left out.",
|        "whenOff": "connectors and exports leave disabled assets out",
|        "risk": "On sends disabled accounts and devices to your CMDB, ticketing systems and exports. Reversible for future runs; records already written there stay.",
|        "requires": "Works only while \"Disabled accounts and devices: collect them\" is on.",
|        "default": "Off: connectors and exports leave disabled assets out",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisabledAssets_Connectors/",
|        "confirmWhen": "on",
|        "confirm": "Off leaves disabled assets out of what is sent; a ticket or record already sent for one is kept as it is (never resolved or closed because the asset was left out) and carries on when the account is enabled again. On sends them like any other. Has no effect while collection of disabled assets is off. Each run logs how many were left out. On sends disabled accounts and devices to your CMDB, ticketing systems and exports. Reversible for future runs; records already written there stay."
|      }
|    },
|    {
|      "name": "SI_DisabledAssets_Correlate",
|      "label": "Disabled accounts and devices: CI correlation",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": true,
|      "defaultText": "On: disabled assets are correlated into CIs",
|      "description": "take part in CI correlation",
|      "purpose": "Whether disabled users, service principals, managed identities and computers take part in the correlation that builds configuration items (CIs).",
|      "effect": "Off keeps disabled assets out of the CI build: no CI is built or changed from them, and the findings of an existing CI are kept as they are (never resolved or closed) until the account is enabled again. Has no effect while collection of disabled assets is off -- they are not collected then. Each run logs how many were left out.",
|      "whenToChange": "Turn it off when disabled assets should not appear as CIs or reach your CMDB.",
|      "card": "Disabled accounts and devices",
|      "needs": "SI_DisabledAssets_Collect",
|      "info": {
|        "what": "Whether disabled users, service principals, managed identities and computers take part in the correlation that builds configuration items (CIs).",
|        "whenOn": "disabled assets are correlated into CIs",
|        "whenOff": "Off keeps disabled assets out of the CI build: no CI is built or changed from them, and the findings of an existing CI are kept as they are (never resolved or closed) until the account is enabled again. Has no effect while collection of disabled assets is off -- they are not collected then. Each run logs how many were left out.",
|        "risk": "Disabled assets are not built into CIs from the next run; findings of existing CIs are kept (never closed). Reversible: the next run correlates them again.",
|        "requires": "Works only while \"Disabled accounts and devices: collect them\" is on.",
|        "default": "On: disabled assets are correlated into CIs",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisabledAssets_Correlate/"
|      }
|    },
|    {
|      "name": "SI_DisabledAssets_RiskAnalysis",
|      "label": "Disabled accounts and devices: Risk Analysis",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off: the reports leave disabled assets out, except the reports where the disabled state is the finding",
|      "description": "reach the Risk Analysis reports",
|      "purpose": "Whether the Risk Analysis reports include disabled users, service principals, managed identities and computers.",
|      "effect": "On lets every report see disabled assets. Two reports always see them, whatever this says, because the disabled state is the finding there: a disabled guest still holding a privileged role, and a disabled service principal still owning a publicly reachable resource. Reports that ask about usable accounts (for example accounts without MFA) keep their own enabled filter. Has no effect while collection of disabled assets is off.",
|      "whenToChange": "Turn it on when you also want findings for disabled accounts and devices in the reports, for example while cleaning them up.",
|      "card": "Disabled accounts and devices",
|      "needs": "SI_DisabledAssets_Collect",
|      "info": {
|        "what": "Whether the Risk Analysis reports include disabled users, service principals, managed identities and computers.",
|        "whenOn": "On lets every report see disabled assets. Two reports always see them, whatever this says, because the disabled state is the finding there: a disabled guest still holding a privileged role, and a disabled service principal still owning a publicly reachable resource. Reports that ask about usable accounts (for example accounts without MFA) keep their own enabled filter. Has no effect while collection of disabled assets is off.",
|        "whenOff": "the reports leave disabled assets out, except the reports where the disabled state is the finding",
|        "risk": "On adds findings for disabled accounts and devices to the reports: more rows to read. Off is the default; the two reports where the disabled state is the finding always include them. Reversible at once.",
|        "requires": "Works only while \"Disabled accounts and devices: collect them\" is on.",
|        "default": "Off: the reports leave disabled assets out, except the reports where the disabled state is the finding",
|        "recommended": "Off, unless you are cleaning up disabled accounts and devices.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisabledAssets_RiskAnalysis/"
|      }
|    },
|    {
|      "name": "SI_DisabledAssets_StateActions",
|      "label": "Disabled accounts and devices: finding actions",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off: findings of disabled assets are kept as they are",
|      "description": "finding / vulnerability lifecycle, close-loop, tickets",
|      "purpose": "Whether the finding and vulnerability lifecycle acts on disabled assets: opening, resolving and closing findings, the close-loop mail and opening or closing tickets.",
|      "effect": "Off freezes the findings of a disabled asset: they are shown as excluded (disabled), never resolved or closed, and a missing finding is not counted as fixed. When the account is enabled again, the same findings carry on. On treats disabled assets like any other. Has no effect while collection of disabled assets is off. Each run logs how many were left out.",
|      "whenToChange": "Turn it on when findings on disabled assets should be opened and closed like any other.",
|      "card": "Disabled accounts and devices",
|      "needs": "SI_DisabledAssets_Collect",
|      "info": {
|        "what": "Whether the finding and vulnerability lifecycle acts on disabled assets: opening, resolving and closing findings, the close-loop mail and opening or closing tickets.",
|        "whenOn": "Off freezes the findings of a disabled asset: they are shown as excluded (disabled), never resolved or closed, and a missing finding is not counted as fixed. When the account is enabled again, the same findings carry on. On treats disabled assets like any other. Has no effect while collection of disabled assets is off. Each run logs how many were left out.",
|        "whenOff": "findings of disabled assets are kept as they are",
|        "risk": "On lets the lifecycle resolve and close findings and tickets of disabled assets like any other, and a finding that is missing for a disabled asset can then be closed. Reversible for future runs; what was closed stays closed.",
|        "requires": "Works only while \"Disabled accounts and devices: collect them\" is on.",
|        "default": "Off: findings of disabled assets are kept as they are",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisabledAssets_StateActions/",
|        "confirmWhen": "on",
|        "confirm": "Off freezes the findings of a disabled asset: they are shown as excluded (disabled), never resolved or closed, and a missing finding is not counted as fixed. When the account is enabled again, the same findings carry on. On treats disabled assets like any other. Has no effect while collection of disabled assets is off. Each run logs how many were left out. On lets the lifecycle resolve and close findings and tickets of disabled assets like any other, and a finding that is missing for a disabled asset can then be closed. Reversible for future runs; what was closed stays closed."
|      }
|    },
|    {
|      "name": "SI_DisableEndpointAzureCorrelation",
|      "label": "Azure VM to device tier linking off",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: an Azure VM takes the tier of the matching endpoint device.",
|      "description": "Disable the EndpointAzureCorrelation cache (only after diagnosing a cache bug).",
|      "purpose": "Stops the Azure engine from giving an Azure VM or Arc machine the same tier as its matching Defender device.",
|      "effect": "When on, Azure VMs and Arc machines keep their own Azure-side tier and lose the link to their endpoint record, so the same machine can show different tiers in the two views.",
|      "whenToChange": "Only while diagnosing a problem with this linking.",
|      "info": {
|        "what": "Stops the Azure engine from giving an Azure VM or Arc machine the same tier as its matching Defender device.",
|        "whenOn": "When on, Azure VMs and Arc machines keep their own Azure-side tier and lose the link to their endpoint record, so the same machine can show different tiers in the two views.",
|        "whenOff": "an Azure VM takes the tier of the matching endpoint device.",
|        "risk": "Azure VMs and Arc machines lose the link to their endpoint record, so one machine can show two different tiers. Reversible at once (the next run links them again).",
|        "requires": "Nothing else.",
|        "default": "Off: an Azure VM takes the tier of the matching endpoint device.",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisableEndpointAzureCorrelation/",
|        "confirmWhen": "on",
|        "confirm": "When on, Azure VMs and Arc machines keep their own Azure-side tier and lose the link to their endpoint record, so the same machine can show different tiers in the two views. Azure VMs and Arc machines lose the link to their endpoint record, so one machine can show two different tiers. Reversible at once (the next run links them again)."
|      }
|    },
|    {
|      "name": "SI_DisableTranscript",
|      "label": "Turn off run logs",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: every run writes and keeps a run log.",
|      "description": "Disable launcher transcript writing entirely (lab/CI use only).",
|      "purpose": "Stops the launchers from writing a run log (transcript) to disk and uploading it to storage.",
|      "effect": "No run log is kept, so failed runs cannot be investigated afterwards. Collection and reports are unaffected.",
|      "whenToChange": "Only in lab or test pipelines where logs are not wanted.",
|      "info": {
|        "what": "Stops the launchers from writing a run log (transcript) to disk and uploading it to storage.",
|        "whenOn": "No run log is kept, so failed runs cannot be investigated afterwards. Collection and reports are unaffected.",
|        "whenOff": "every run writes and keeps a run log.",
|        "risk": "No run log is kept: a failed run cannot be investigated afterwards and support has nothing to read. Reversible at once (from the next run).",
|        "requires": "Nothing else.",
|        "default": "Off: every run writes and keeps a run log.",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisableTranscript/",
|        "confirmWhen": "on",
|        "confirm": "No run log is kept, so failed runs cannot be investigated afterwards. Collection and reports are unaffected. No run log is kept: a failed run cannot be investigated afterwards and support has nothing to read. Reversible at once (from the next run)."
|      }
|    },
|    {
|      "name": "SI_DumpAIPayload",
|      "label": "Save AI requests to disk",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: nothing is saved.",
|      "description": "Dump AI request/response payloads to disk (debug only; verbose I/O).",
|      "purpose": "A troubleshooting switch that saves every AI classification request to a file in the machine's temp folder.",
|      "effect": "When on, each AI call writes one file holding the prompt and the asset data sent, so prompts can be inspected. This adds disk writes and leaves asset details on disk.",
|      "whenToChange": "Only while diagnosing AI results; switch it off again afterwards.",
|      "info": {
|        "what": "A troubleshooting switch that saves every AI classification request to a file in the machine's temp folder.",
|        "whenOn": "When on, each AI call writes one file holding the prompt and the asset data sent, so prompts can be inspected. This adds disk writes and leaves asset details on disk.",
|        "whenOff": "nothing is saved.",
|        "risk": "Writes the prompts and the asset data sent to AI to files on disk, where they stay until removed. Reversible: turn it off and delete the files.",
|        "requires": "Nothing else.",
|        "default": "Off: nothing is saved.",
|        "recommended": "Off; on only briefly when support asks.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DumpAIPayload/",
|        "confirmWhen": "on",
|        "confirm": "When on, each AI call writes one file holding the prompt and the asset data sent, so prompts can be inspected. This adds disk writes and leaves asset details on disk. Writes the prompts and the asset data sent to AI to files on disk, where they stay until removed. Reversible: turn it off and delete the files."
|      }
|    },
|    {
|      "name": "SI_EgIdentityBucketThreshold",
|      "label": "Identity exposure graph split size",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "30000 identities.",
|      "description": "Switch from EG bucket-paging to single-pass when bucket count exceeds N. Default 30000 (matches Defender's per-query row ceiling).",
|      "purpose": "Above this many identities of one kind, the identity engine reads the exposure graph in several smaller queries instead of one.",
|      "effect": "A lower value splits reads sooner: more queries, but each stays within response limits. A higher value risks a single oversized query failing in very large tenants.",
|      "whenToChange": "Only if exposure graph reads for identities fail or time out.",
|      "unit": "rows",
|      "info": {
|        "what": "Above this many identities of one kind, the identity engine reads the exposure graph in several smaller queries instead of one.",
|        "whenChanged": "A lower value splits reads sooner: more queries, but each stays within response limits. A higher value risks a single oversized query failing in very large tenants.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "30000 identities.",
|        "recommended": "Keep the default. Change it when: Only if exposure graph reads for identities fail or time out.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EgIdentityBucketThreshold/"
|      }
|    },
|    {
|      "name": "SI_EnableAI",
|      "label": "AI integration",
|      "group": "AI",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: assets are classified by rules only.",
|      "description": "Tenant-wide AI opt-in for asset-profiling Classify (turns AI on for endpoint+ azure+publicip; identity is hard-disabled). Per-engine opt-in is preferred.",
|      "purpose": "ONE switch for AI: on = AI for every engine that has an AI step (the endpoint and Azure engines classify the assets their rules cannot place). It needs the Azure OpenAI endpoint, deployment and key.",
|      "effect": "When on, and Azure OpenAI is configured, assets that rules cannot place are sent to Azure OpenAI for a tier and service type. This adds AI cost and run time. The identity and public IP engines never use AI.",
|      "whenToChange": "When you want AI help classifying assets -- in Get Started > AI integration, with the endpoint, deployment and key.",
|      "card": "Where AI is used",
|      "hint": "On = on for all engines. The per-engine switches (Advanced) only matter to turn ONE engine on or off against this switch.",
|      "info": {
|        "what": "ONE switch for AI: on = AI for every engine that has an AI step (the endpoint and Azure engines classify the assets their rules cannot place). It needs the Azure OpenAI endpoint, deployment and key.",
|        "whenOn": "When on, and Azure OpenAI is configured, assets that rules cannot place are sent to Azure OpenAI for a tier and service type. This adds AI cost and run time. The identity and public IP engines never use AI.",
|        "whenOff": "assets are classified by rules only.",
|        "risk": "Asset data (names, properties) of assets the rules cannot place is sent to YOUR Azure OpenAI deployment, and each call costs. Reversible at once; tiers already set by AI stay until the next full run.",
|        "requires": "Nothing else.",
|        "default": "Off: assets are classified by rules only.",
|        "recommended": "Off unless rules leave many assets untiered.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EnableAI/",
|        "confirmWhen": "on",
|        "confirm": "When on, and Azure OpenAI is configured, assets that rules cannot place are sent to Azure OpenAI for a tier and service type. This adds AI cost and run time. The identity and public IP engines never use AI. Asset data (names, properties) of assets the rules cannot place is sent to YOUR Azure OpenAI deployment, and each call costs. Reversible at once; tiers already set by AI stay until the next full run."
|      }
|    },
|    {
|      "name": "SI_EnableAI_azure",
|      "label": "AI for the Azure engine",
|      "group": "AI",
|      "type": "bool",
|      "engines": [
|        "azure"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off, unless AI is turned on for all engines.",
|      "description": "AI integration -- per-engine opt-in. Tenant-wide $global:SI_EnableAI also turns it on for ALL engines; this per-engine flag is the targeted opt-in.",
|      "purpose": "An override for ONE engine: turns on Azure OpenAI classification and application grouping for the Azure engine only, while AI integration is off. With AI integration on it changes nothing.",
|      "effect": "Resources without a rule-based tier are classified by AI, and resource groups are named as applications. Adds AI cost and run time. Needs the Azure OpenAI settings; without them AI stays off. A disable switch wins.",
|      "whenToChange": "Only to use AI in the Azure engine alone; normally use AI integration (on = on for all engines).",
|      "card": "Where AI is used",
|      "info": {
|        "what": "An override for ONE engine: turns on Azure OpenAI classification and application grouping for the Azure engine only, while AI integration is off. With AI integration on it changes nothing.",
|        "whenOn": "Resources without a rule-based tier are classified by AI, and resource groups are named as applications. Adds AI cost and run time. Needs the Azure OpenAI settings; without them AI stays off. A disable switch wins.",
|        "whenOff": "unless AI is turned on for all engines.",
|        "risk": "Resource data of untiered Azure resources is sent to YOUR Azure OpenAI deployment, and each call costs. Reversible at once.",
|        "requires": "Read by: azure.",
|        "default": "Off, unless AI is turned on for all engines.",
|        "recommended": "Leave it off and use AI integration (on = on for all engines); this only turns the Azure engine on alone.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EnableAI_azure/",
|        "confirmWhen": "on",
|        "confirm": "Resources without a rule-based tier are classified by AI, and resource groups are named as applications. Adds AI cost and run time. Needs the Azure OpenAI settings; without them AI stays off. A disable switch wins. Resource data of untiered Azure resources is sent to YOUR Azure OpenAI deployment, and each call costs. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_EnableAI_endpoint",
|      "label": "AI for the endpoint engine",
|      "group": "AI",
|      "type": "bool",
|      "engines": [
|        "endpoint"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off, unless AI is turned on for all engines.",
|      "description": "Per-engine AI opt-in (force-off via SI_DisableAI_endpoint = $true).",
|      "purpose": "An override for ONE engine: turns on Azure OpenAI classification for the endpoint engine only, while AI integration is off. With AI integration on it changes nothing.",
|      "effect": "Devices without a rule-based tier are classified by AI instead of getting the default tier. Adds AI cost and run time. Needs the Azure OpenAI settings; SI_DisableAI_endpoint wins over it.",
|      "whenToChange": "Only to use AI in the endpoint engine alone; normally use AI integration (on = on for all engines).",
|      "card": "Where AI is used",
|      "info": {
|        "what": "An override for ONE engine: turns on Azure OpenAI classification for the endpoint engine only, while AI integration is off. With AI integration on it changes nothing.",
|        "whenOn": "Devices without a rule-based tier are classified by AI instead of getting the default tier. Adds AI cost and run time. Needs the Azure OpenAI settings; SI_DisableAI_endpoint wins over it.",
|        "whenOff": "unless AI is turned on for all engines.",
|        "risk": "Device data of untiered devices is sent to YOUR Azure OpenAI deployment, and each call costs. Reversible at once.",
|        "requires": "Read by: endpoint.",
|        "default": "Off, unless AI is turned on for all engines.",
|        "recommended": "Leave it off and use AI integration (on = on for all engines); this only turns the endpoint engine on alone.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EnableAI_endpoint/",
|        "confirmWhen": "on",
|        "confirm": "Devices without a rule-based tier are classified by AI instead of getting the default tier. Adds AI cost and run time. Needs the Azure OpenAI settings; SI_DisableAI_endpoint wins over it. Device data of untiered devices is sent to YOUR Azure OpenAI deployment, and each call costs. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_EnableAI_identity",
|      "label": "AI for the identity engine",
|      "group": "AI",
|      "type": "bool",
|      "engines": [
|        "identity"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off; identity classification never uses AI.",
|      "description": "AI integration -- per-engine opt-in. Tenant-wide $global:SI_EnableAI also turns it on for ALL engines; this per-engine flag is the targeted opt-in. Force-off: $global:SI_DisableAI_identity = $true.",
|      "purpose": "Per-engine AI switch for the identity engine.",
|      "effect": "No effect today: identity tiers always come from the built-in role and permission catalog, whatever this is set to.",
|      "whenToChange": "Never at present; it is kept for consistency with the other engines.",
|      "info": {
|        "what": "Per-engine AI switch for the identity engine.",
|        "whenOn": "No effect today: identity tiers always come from the built-in role and permission catalog, whatever this is set to.",
|        "whenOff": "identity classification never uses AI.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: identity.",
|        "default": "Off; identity classification never uses AI.",
|        "recommended": "Keep the default. Change it when: Never at present; it is kept for consistency with the other engines.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EnableAI_identity/"
|      }
|    },
|    {
|      "name": "SI_EnableCmdbProvider",
|      "label": "CMDB enrichment on",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: CMDB data is not used",
|      "description": "--- CMDB provider auto-refresh (preview.87+) --- When ENABLED, Stage Schedule auto-refreshes the CMDB cache at run start (gated by cache age). Reconcile then folds matched rows into Properties.collect.cmdb.",
|      "purpose": "Turns on enrichment of assets with data from your CMDB export (CMDB id, name, criticality, data sensitivity).",
|      "effect": "When on and a CMDB.csv is present, profiling runs refresh the CMDB cache and stamp CMDB fields onto matched assets; CMDB ids in custom rules take effect. When off, they are ignored. In SecurityInsight Pro the services come from the CMDB in the Pro database (the CMDB page) instead of a file; a v2.2 CMDB.csv is moved there once by setup, and a CMDB.csv left on disk is not read (the run warns when the Pro CMDB is empty and a CSV was never moved).",
|      "whenToChange": "Turn on when you have a CMDB export (or, in Pro, services on the CMDB page) you want reflected in reports.",
|      "card": "CMDB",
|      "info": {
|        "what": "Turns on enrichment of assets with data from your CMDB export (CMDB id, name, criticality, data sensitivity).",
|        "whenOn": "When on and a CMDB.csv is present, profiling runs refresh the CMDB cache and stamp CMDB fields onto matched assets; CMDB ids in custom rules take effect. When off, they are ignored. In SecurityInsight Pro the services come from the CMDB in the Pro database (the CMDB page) instead of a file; a v2.2 CMDB.csv is moved there once by setup, and a CMDB.csv left on disk is not read (the run warns when the Pro CMDB is empty and a CSV was never moved).",
|        "whenOff": "CMDB data is not used",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Nothing else.",
|        "default": "Off: CMDB data is not used",
|        "recommended": "Keep the default. Change it when: Turn on when you have a CMDB export (or, in Pro, services on the CMDB page) you want reflected in reports.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EnableCmdbProvider/"
|      }
|    },
|    {
|      "name": "SI_EnableServiceNowCmdb",
|      "label": "ServiceNow CMDB source",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: the generic CMDB file is used when one is provided",
|      "description": "Enable the ServiceNow CMDB source in the Reconcile stage.",
|      "purpose": "Marks the live ServiceNow CMDB as the asset-inventory (CMDB) source used to enrich profiled assets.",
|      "effect": "The ServiceNow CMDB source is not available in this version: turning this on is refused with an error and the CMDB columns stay empty. It also does not fall back to the CMDB file.",
|      "whenToChange": "Leave off. Not usable until the ServiceNow CMDB connector is released.",
|      "info": {
|        "what": "Marks the live ServiceNow CMDB as the asset-inventory (CMDB) source used to enrich profiled assets.",
|        "whenOn": "The ServiceNow CMDB source is not available in this version: turning this on is refused with an error and the CMDB columns stay empty. It also does not fall back to the CMDB file.",
|        "whenOff": "the generic CMDB file is used when one is provided",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off: the generic CMDB file is used when one is provided",
|        "recommended": "Keep the default. Change it when: Leave off. Not usable until the ServiceNow CMDB connector is released.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EnableServiceNowCmdb/"
|      }
|    },
|    {
|      "name": "SI_EnableSignInEnrich",
|      "label": "Identity sign-in details",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On.",
|      "description": "Sign-in enrichment (per-identity SignInActivity reads from Graph).",
|      "purpose": "Lets the identity engine add sign-in statistics per user, such as sign-in counts, apps, IP addresses and countries.",
|      "effect": "Turning it off skips the sign-in log queries, so runs are faster and cheaper, but sign-in counts, apps and locations stay empty. Last sign-in date still comes from Entra.",
|      "whenToChange": "Turn off if sign-in queries are too slow or costly in your tenant.",
|      "card": "Extra details",
|      "info": {
|        "what": "Lets the identity engine add sign-in statistics per user, such as sign-in counts, apps, IP addresses and countries.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Turning it off skips the sign-in log queries, so runs are faster and cheaper, but sign-in counts, apps and locations stay empty. Last sign-in date still comes from Entra.",
|        "risk": "Sign-in counts, apps and locations stay empty: findings that depend on sign-in activity lose that context. Reversible: the next run collects it again.",
|        "requires": "Nothing else.",
|        "default": "On.",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EnableSignInEnrich/",
|        "confirmWhen": "off",
|        "confirm": "Turning it off skips the sign-in log queries, so runs are faster and cheaper, but sign-in counts, apps and locations stay empty. Last sign-in date still comes from Entra. Sign-in counts, apps and locations stay empty: findings that depend on sign-in activity lose that context. Reversible: the next run collects it again."
|      }
|    },
|    {
|      "name": "SI_Endpoint_DcrName",
|      "label": "Endpoint data collection rule name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The standard name, dcr-si-endpoint-profile (from the naming pattern)",
|      "description": "Overrides the data collection rule name the endpoint profiling engine ingests through; when empty, the standard naming pattern is used.",
|      "purpose": "The name of the data collection rule the endpoint engine sends its asset rows through to Log Analytics.",
|      "effect": "Rows are sent through the named rule. A name that does not match an existing or creatable rule makes the endpoint ingest fail.",
|      "whenToChange": "Only if you renamed the rule or must avoid a name clash with another install.",
|      "info": {
|        "what": "The name of the data collection rule the endpoint engine sends its asset rows through to Log Analytics.",
|        "whenChanged": "Rows are sent through the named rule. A name that does not match an existing or creatable rule makes the endpoint ingest fail.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "The standard name, dcr-si-endpoint-profile (from the naming pattern)",
|        "recommended": "Keep the default. Change it when: Only if you renamed the rule or must avoid a name clash with another install.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Endpoint_DcrName/"
|      }
|    },
|    {
|      "name": "SI_Endpoint_TableName",
|      "label": "Endpoint table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The standard table, SI_Endpoint_Profile_CL",
|      "description": "--- Table / DCR name overrides -------------------------------------------- Only set these if you renamed the destination objects. The engine resolves the shipped names when unset; there is no hard-coded fallback in this file.",
|      "purpose": "The Log Analytics table the endpoint engine writes its asset rows to.",
|      "effect": "Rows go to the named table instead. Reports, queries and dashboards that read the standard table then no longer see new endpoint data.",
|      "whenToChange": "Only if you renamed the destination table.",
|      "info": {
|        "what": "The Log Analytics table the endpoint engine writes its asset rows to.",
|        "whenChanged": "Rows go to the named table instead. Reports, queries and dashboards that read the standard table then no longer see new endpoint data.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "The standard table, SI_Endpoint_Profile_CL",
|        "recommended": "Keep the default. Change it when: Only if you renamed the destination table.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Endpoint_TableName/"
|      }
|    },
|    {
|      "name": "SI_ExcelMaxDataRows",
|      "label": "Excel report row limit",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1,000,000 rows",
|      "description": "--- Delivery limits (added v2.2.441) -------------------------------------- Excel holds 1,048,576 rows INCLUDING the header. Above this the workbook keeps the TOP N by the sort column (highest risk first) and says how many were left out; the .json sibling and the LA ingest still carry every row.",
|      "purpose": "The most rows written to one worksheet of an Excel report; above it, the highest-risk rows are kept and the rest are left out of the workbook.",
|      "effect": "A lower value gives smaller, quicker workbooks but more rows are left out of the Excel file. Nothing is lost from the run: the JSON file and Log Analytics still hold every row.",
|      "whenToChange": "Most installs never should. Lower it if workbooks are too large to open or mail.",
|      "unit": "rows",
|      "info": {
|        "what": "The most rows written to one worksheet of an Excel report; above it, the highest-risk rows are kept and the rest are left out of the workbook.",
|        "whenChanged": "A lower value gives smaller, quicker workbooks but more rows are left out of the Excel file. Nothing is lost from the run: the JSON file and Log Analytics still hold every row.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "1,000,000 rows",
|        "recommended": "Keep the default. Change it when: Most installs never should. Lower it if workbooks are too large to open or mail.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ExcelMaxDataRows/"
|      }
|    },
|    {
|      "name": "SI_Exempted_CountInManagement",
|      "label": "Count exempted findings in the management numbers",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "off (exempted findings are not counted)",
|      "description": "EXEMPTED FINDINGS: an approved exemption never removes a finding -- Risk Analysis keeps it, marked, in Log Analytics and the Pro database, and each report decides whether to count it. Count exempted findings in the management numbers: Risk Analysis's workbook, JSON, summary and mail, and the web app's dashboards, KPIs, trends, closure and Services view and the wall board. Off by default: exempted findings are left out, and every surface says how many.",
|      "purpose": "Whether findings covered by an approved exemption are counted in the management numbers: Risk Analysis's workbook, JSON, summary and mail, and the web app's dashboards, KPIs, trends, closure and Services view and the wall board.",
|      "effect": "An exemption never removes a finding: it is kept, marked, in Log Analytics and the Pro database either way. Off: every management number leaves exempted findings out and says how many it left out; each dashboard has an 'Include exempted' tick that recomputes its figures with them (shown as simulated, never saved). On: they are counted everywhere by default.",
|      "whenToChange": "Turn on if management should see the risk including accepted exemptions.",
|      "card": "Counting and closing findings",
|      "info": {
|        "what": "Whether findings covered by an approved exemption are counted in the management numbers: Risk Analysis's workbook, JSON, summary and mail, and the web app's dashboards, KPIs, trends, closure and Services view and the wall board.",
|        "whenOn": "they are counted everywhere by default.",
|        "whenOff": "every management number leaves exempted findings out and says how many it left out; each dashboard has an 'Include exempted' tick that recomputes its figures with them (shown as simulated, never saved).",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off (exempted findings are not counted)",
|        "recommended": "Keep the default. Change it when: Turn on if management should see the risk including accepted exemptions.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Exempted_CountInManagement/"
|      }
|    },
|    {
|      "name": "SI_Exempted_InDepartmentReports",
|      "label": "Count exempted findings for departments",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "off (exempted findings are not counted)",
|      "description": "Count exempted findings in the department reports: the department pages, the business owners' monthly report and the technical owners' digest and review. Off by default: exempted findings are left out, and the report says how many.",
|      "purpose": "Whether findings with an approved exemption count on the department pages and in the department mails.",
|      "effect": "Off: department pages and mails leave exempted findings out and say how many they left out; a department page's 'Include exempted' tick shows them for that view only. On: they are counted by default. The data keeps them either way.",
|      "whenToChange": "Turn on if departments should keep seeing the findings they have an exemption for.",
|      "card": "Mails to departments",
|      "info": {
|        "what": "Whether findings with an approved exemption count on the department pages and in the department mails.",
|        "whenOn": "they are counted by default. The data keeps them either way.",
|        "whenOff": "department pages and mails leave exempted findings out and say how many they left out; a department page's 'Include exempted' tick shows them for that view only.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off (exempted findings are not counted)",
|        "recommended": "Keep the default. Change it when: Turn on if departments should keep seeing the findings they have an exemption for.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Exempted_InDepartmentReports/"
|      }
|    },
|    {
|      "name": "SI_FingerprintCache_Enabled",
|      "label": "Asset fingerprint cache",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: every asset is processed on every run",
|      "description": "Fingerprint cache is OPT-IN (the gate is `-eq $true`); default is OFF.",
|      "purpose": "Remembers each asset between runs so incremental runs can skip assets that are not yet due for re-processing.",
|      "effect": "On can shorten incremental runs, but adds storage writes, and it has no effect on full runs. Off is safe: every row is still produced.",
|      "whenToChange": "Only on installs that run incremental (not full) runs and want shorter run times.",
|      "info": {
|        "what": "Remembers each asset between runs so incremental runs can skip assets that are not yet due for re-processing.",
|        "whenOn": "On can shorten incremental runs, but adds storage writes, and it has no effect on full runs. Off is safe: every row is still produced.",
|        "whenOff": "every asset is processed on every run",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: azure, endpoint, identity, publicip.",
|        "default": "Off: every asset is processed on every run",
|        "recommended": "Keep the default. Change it when: Only on installs that run incremental (not full) runs and want shorter run times.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_FingerprintCache_Enabled/"
|      }
|    },
|    {
|      "name": "SI_ForceFullRun",
|      "label": "Full run for all profilers",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Force a full re-run for ALL profile engines this invocation. Per-engine overrides (SI_ForceFullRun_<Engine>) win over this tenant-wide switch.",
|      "purpose": "Makes every asset-profiling engine process all assets on the next run, ignoring the per-asset skip schedule and cached CMDB data.",
|      "effect": "Every asset is re-collected and re-classified, so runs take longer and use more AI calls when AI is on. A per-engine full-run setting that is on wins; a job's own SI_FORCE_FULL_RUN wins over both. Applies the same way on a VM and in container jobs.",
|      "whenToChange": "After changing rules or fixing bad cached data, when you want every asset refreshed at once.",
|      "info": {
|        "what": "Makes every asset-profiling engine process all assets on the next run, ignoring the per-asset skip schedule and cached CMDB data.",
|        "whenOn": "Every asset is re-collected and re-classified, so runs take longer and use more AI calls when AI is on. A per-engine full-run setting that is on wins; a job's own SI_FORCE_FULL_RUN wins over both. Applies the same way on a VM and in container jobs.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "Off",
|        "recommended": "Keep the default. Change it when: After changing rules or fixing bad cached data, when you want every asset refreshed at once.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ForceFullRun/"
|      }
|    },
|    {
|      "name": "SI_ForceFullRun_Azure",
|      "label": "Azure full re-run",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [
|        "azure"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: unchanged resources are skipped.",
|      "description": "Force-full-run -- skip the fingerprint cadence short-circuit. Use after rule changes or schema updates. Default $false (cadence wins).",
|      "purpose": "Makes the Azure engine reprocess every resource instead of skipping ones that have not changed since the last run.",
|      "effect": "Every resource is reclassified, so the run takes longer and, with AI on, costs more. Overrides the all-engine full re-run switch for this engine.",
|      "whenToChange": "Once after changing rules or the schema; then switch it back off.",
|      "info": {
|        "what": "Makes the Azure engine reprocess every resource instead of skipping ones that have not changed since the last run.",
|        "whenOn": "Every resource is reclassified, so the run takes longer and, with AI on, costs more. Overrides the all-engine full re-run switch for this engine.",
|        "whenOff": "unchanged resources are skipped.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: azure.",
|        "default": "Off: unchanged resources are skipped.",
|        "recommended": "Keep the default. Change it when: Once after changing rules or the schema; then switch it back off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ForceFullRun_Azure/"
|      }
|    },
|    {
|      "name": "SI_ForceFullRun_Endpoint",
|      "label": "Endpoint full re-run",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [
|        "endpoint"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: unchanged devices are skipped.",
|      "description": "Skip the per-asset cadence short-circuit; re-classify every asset this run.",
|      "purpose": "Makes the endpoint engine reprocess every device instead of skipping ones that have not changed since the last run.",
|      "effect": "Every device is reclassified, so the run takes longer and, with AI on, costs more. Overrides the all-engine full re-run switch for this engine.",
|      "whenToChange": "Once after changing rules or the schema; then switch it back off.",
|      "info": {
|        "what": "Makes the endpoint engine reprocess every device instead of skipping ones that have not changed since the last run.",
|        "whenOn": "Every device is reclassified, so the run takes longer and, with AI on, costs more. Overrides the all-engine full re-run switch for this engine.",
|        "whenOff": "unchanged devices are skipped.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: endpoint.",
|        "default": "Off: unchanged devices are skipped.",
|        "recommended": "Keep the default. Change it when: Once after changing rules or the schema; then switch it back off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ForceFullRun_Endpoint/"
|      }
|    },
|    {
|      "name": "SI_ForceFullRun_Identity",
|      "label": "Identity full re-run",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [
|        "identity"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: unchanged identities are skipped.",
|      "description": "Force-full-run -- skip the fingerprint cadence short-circuit; re-process every asset. Use after rule changes or schema updates. Default $false (cadence wins).",
|      "purpose": "Makes the identity engine reprocess every identity instead of skipping ones that have not changed since the last run.",
|      "effect": "Every identity is reprocessed, so the run takes longer. Overrides the all-engine full re-run switch for this engine.",
|      "whenToChange": "Once after changing rules or the schema; then switch it back off.",
|      "info": {
|        "what": "Makes the identity engine reprocess every identity instead of skipping ones that have not changed since the last run.",
|        "whenOn": "Every identity is reprocessed, so the run takes longer. Overrides the all-engine full re-run switch for this engine.",
|        "whenOff": "unchanged identities are skipped.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: identity.",
|        "default": "Off: unchanged identities are skipped.",
|        "recommended": "Keep the default. Change it when: Once after changing rules or the schema; then switch it back off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ForceFullRun_Identity/"
|      }
|    },
|    {
|      "name": "SI_ForceFullRun_PublicIp",
|      "label": "Public IP force full run",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off; falls back to SI_ForceFullRun, which is also off.",
|      "description": "Force-full-run -- skip the fingerprint cadence short-circuit. Use after rule changes or schema updates. Default $false (cadence wins).",
|      "purpose": "Makes the public IP engine process every address, ignoring the per-tier re-check cadence, for this engine only.",
|      "effect": "On, every address is re-processed on every run. It only changes anything when the fingerprint cache (SI_FingerprintCache_Enabled) is on; without it every address is processed anyway. More run time when it matters.",
|      "whenToChange": "Once after changing tier rules or the schema, then turn it off again.",
|      "info": {
|        "what": "Makes the public IP engine process every address, ignoring the per-tier re-check cadence, for this engine only.",
|        "whenOn": "On, every address is re-processed on every run. It only changes anything when the fingerprint cache (SI_FingerprintCache_Enabled) is on; without it every address is processed anyway. More run time when it matters.",
|        "whenOff": "falls back to SI_ForceFullRun, which is also off.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "Off; falls back to SI_ForceFullRun, which is also off.",
|        "recommended": "Keep the default. Change it when: Once after changing tier rules or the schema, then turn it off again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ForceFullRun_PublicIp/"
|      }
|    },
|    {
|      "name": "SI_Graph_AppId",
|      "label": "App id (older Graph name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_SPN_AppId is used",
|      "description": "Legacy split-SPN aliases (still honoured as fallback by the engine; set only if you can't use the unified SI_SPN_* names above):",
|      "purpose": "Older name for the service principal's application id; still read when SI_SPN_AppId is not set.",
|      "effect": "Only matters when SI_SPN_AppId is empty; then this app id is used for Microsoft Graph sign-in and setup copies it forward.",
|      "whenToChange": "Never on new installs; use SI_SPN_AppId instead.",
|      "info": {
|        "what": "Older name for the service principal's application id; still read when SI_SPN_AppId is not set.",
|        "whenChanged": "Only matters when SI_SPN_AppId is empty; then this app id is used for Microsoft Graph sign-in and setup copies it forward.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: SI_SPN_AppId is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; use SI_SPN_AppId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Graph_AppId/"
|      }
|    },
|    {
|      "name": "SI_Graph_Secret",
|      "label": "Client secret (older Graph name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": true,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_SPN_Secret is used",
|      "description": "Older name for the service principal's client secret; used only when SI_SPN_Secret is not set.",
|      "purpose": "Older name for the service principal's client secret; used only when SI_SPN_Secret is not set.",
|      "effect": "Only matters when SI_SPN_Secret is empty; then this secret is used for Microsoft Graph sign-in.",
|      "whenToChange": "Never on new installs; use SI_SPN_Secret, a certificate or managed identity.",
|      "info": {
|        "what": "Older name for the service principal's client secret; used only when SI_SPN_Secret is not set.",
|        "whenChanged": "Only matters when SI_SPN_Secret is empty; then this secret is used for Microsoft Graph sign-in.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault.",
|        "default": "Not set: SI_SPN_Secret is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; use SI_SPN_Secret, a certificate or managed identity.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Graph_Secret/"
|      }
|    },
|    {
|      "name": "SI_Graph_TenantId",
|      "label": "Tenant id (older Graph name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_SPN_TenantId is used",
|      "description": "Older name for the Entra tenant id the service principal signs in to; used only when SI_SPN_TenantId is not set.",
|      "purpose": "Older name for the Entra tenant id the service principal signs in to; used only when SI_SPN_TenantId is not set.",
|      "effect": "Only matters when SI_SPN_TenantId is empty; then this tenant is used for Microsoft Graph sign-in.",
|      "whenToChange": "Never on new installs; use SI_SPN_TenantId instead.",
|      "info": {
|        "what": "Older name for the Entra tenant id the service principal signs in to; used only when SI_SPN_TenantId is not set.",
|        "whenChanged": "Only matters when SI_SPN_TenantId is empty; then this tenant is used for Microsoft Graph sign-in.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: SI_SPN_TenantId is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; use SI_SPN_TenantId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Graph_TenantId/"
|      }
|    },
|    {
|      "name": "SI_Guard_AssetPropertiesCollectionChange_Enabled",
|      "label": "Asset metadata: large change",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Asset metadata: large change (asset.properties.collection-change). Off: the step goes on as if the check had not tripped -- a large change of the asset metadata is handed over like any other.",
|      "purpose": "The safety check that protects the asset metadata handed to your CMDB and vulnerability system: The full asset metadata collected from one source changed by more than the allowed share since the previous run, which looks like a broken collection rather than a real change, so the previous collection of that source was kept for the hand-off.",
|      "effect": "Off: the step goes on as if the check had not tripped -- a large change of the asset metadata is handed over like any other. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the asset metadata handed to your CMDB and vulnerability system: The full asset metadata collected from one source changed by more than the allowed share since the previous run, which looks like a broken collection rather than a real change, so the previous collection of that source was kept for the hand-off.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- a large change of the asset metadata is handed over like any other.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_AssetPropertiesCollectionChange_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- a large change of the asset metadata is handed over like any other. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_AssetPropertiesCollectionChange_Mail",
|      "label": "Asset metadata: large change: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_AssetPropertiesCollectionChange_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Asset metadata: large change\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_AssetPropertiesCollectionChange_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_AuditRetentionRefused_Enabled",
|      "label": "Audit trail retention setting",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Audit trail retention setting (audit.retention.refused). Off: no event and no mail. The step itself still stops, because the retention setting is not valid.",
|      "purpose": "The safety check that protects the audit trail: The audit trail retention setting (SI_Pro_AuditRetentionMonths) is not a whole number of at least 13 months, so nothing was removed.",
|      "effect": "Off: no event and no mail. The step itself still stops, because the retention setting is not valid. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the audit trail: The audit trail retention setting (SI_Pro_AuditRetentionMonths) is not a whole number of at least 13 months, so nothing was removed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because the retention setting is not valid.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_AuditRetentionRefused_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because the retention setting is not valid. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_AuditRetentionRefused_Mail",
|      "label": "Audit trail retention setting: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_AuditRetentionRefused_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Audit trail retention setting\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_AuditRetentionRefused_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CiBuildConcurrent_Enabled",
|      "label": "CI build started while another was running",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "CI build started while another was running (ci.build.concurrent). Off: no event. The second CI build still waits for the first one, because two builds never write the CIs at the same time.",
|      "purpose": "The safety check that protects your configuration items (CIs) from being written by two builds at the same time: A CI build was started while another CI build was still running.",
|      "effect": "Off: no event. The second CI build still waits for the first one, because two builds never write the CIs at the same time. On: the check works as described on the Guards page.",
|      "whenToChange": "Leave it on: it only reports, and nothing is stopped by it. Turn it off when you do not need to know that a CI build had to wait.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects your configuration items (CIs) from being written by two builds at the same time: A CI build was started while another CI build was still running.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event. The second CI build still waits for the first one, because two builds never write the CIs at the same time.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: Leave it on: it only reports, and nothing is stopped by it. Turn it off when you do not need to know that a CI build had to wait.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CiBuildConcurrent_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event. The second CI build still waits for the first one, because two builds never write the CIs at the same time. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CiBuildConcurrent_Mail",
|      "label": "CI build started while another was running: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "This check only reports and stops nothing, so it sends no mail either way: the event is shown on the Guards page and kept in run health and the audit trail.",
|      "whenToChange": "Nothing to change: a check that only reports is not mailed.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CiBuildConcurrent_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "This check only reports and stops nothing, so it sends no mail either way: the event is shown on the Guards page and kept in run health and the audit trail.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"CI build started while another was running\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Nothing to change: a check that only reports is not mailed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CiBuildConcurrent_Mail/",
|        "confirmWhen": "off",
|        "confirm": "This check only reports and stops nothing, so it sends no mail either way: the event is shown on the Guards page and kept in run health and the audit trail. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbHandoffMassChange_Enabled",
|      "label": "CMDB hand-off: large change",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "CMDB hand-off: large change (cmdb.handoff.mass-change). Off: the step goes on as if the check had not tripped -- the batch is handed over to ServiceNow however many CIs changed or disappeared.",
|      "purpose": "The safety check that protects the CIs your ServiceNow imports from the CMDB hand-off database: Far more of the CIs handed to ServiceNow last time are missing from this run than the connector allows, which looks like a broken collection rather than assets gone, so this run's batch was held and ServiceNow keeps importing the previous one.",
|      "effect": "Off: the step goes on as if the check had not tripped -- the batch is handed over to ServiceNow however many CIs changed or disappeared. On: the check works as described on the Guards page.",
|      "whenToChange": "Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the CIs your ServiceNow imports from the CMDB hand-off database: Far more of the CIs handed to ServiceNow last time are missing from this run than the connector allows, which looks like a broken collection rather than assets gone, so this run's batch was held and ServiceNow keeps importing the previous one.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- the batch is handed over to ServiceNow however many CIs changed or disappeared.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbHandoffMassChange_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- the batch is handed over to ServiceNow however many CIs changed or disappeared. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbHandoffMassChange_Mail",
|      "label": "CMDB hand-off: large change: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbHandoffMassChange_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"CMDB hand-off: large change\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbHandoffMassChange_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbServicenowCreateGate_Enabled",
|      "label": "ServiceNow: CIs not accepted",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "ServiceNow: CIs not accepted (cmdb.servicenow.create-gate). Off: no event and no mail. The rows ServiceNow did not accept are still sent again with the next run.",
|      "purpose": "The safety check that protects the configuration items (CIs) in ServiceNow: ServiceNow's import did not accept some of the CIs SecurityInsight sent, so this batch was not completed.",
|      "effect": "Off: no event and no mail. The rows ServiceNow did not accept are still sent again with the next run. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the configuration items (CIs) in ServiceNow: ServiceNow's import did not accept some of the CIs SecurityInsight sent, so this batch was not completed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The rows ServiceNow did not accept are still sent again with the next run.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbServicenowCreateGate_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The rows ServiceNow did not accept are still sent again with the next run. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbServicenowCreateGate_Mail",
|      "label": "ServiceNow: CIs not accepted: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbServicenowCreateGate_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"ServiceNow: CIs not accepted\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbServicenowCreateGate_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbServicenowServiceModel_Enabled",
|      "label": "ServiceNow: service model errors",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "ServiceNow: service model errors (cmdb.servicenow.service-model). Off: no event and no mail. The step itself still stops, because the service model has errors.",
|      "purpose": "The safety check that protects the placement of assets in your business services: The service model has errors, so no asset was placed in a business service.",
|      "effect": "Off: no event and no mail. The step itself still stops, because the service model has errors. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the placement of assets in your business services: The service model has errors, so no asset was placed in a business service.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because the service model has errors.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbServicenowServiceModel_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because the service model has errors. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbServicenowServiceModel_Mail",
|      "label": "ServiceNow: service model errors: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbServicenowServiceModel_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"ServiceNow: service model errors\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbServicenowServiceModel_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbServicenowUnreachable_Enabled",
|      "label": "ServiceNow: not reachable",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "ServiceNow: not reachable (cmdb.servicenow.unreachable). Off: no event and no mail. The step itself still stops, because ServiceNow cannot be reached.",
|      "purpose": "The safety check that protects the configuration items (CIs) in ServiceNow: The ServiceNow instance could not be reached, so nothing was sent.",
|      "effect": "Off: no event and no mail. The step itself still stops, because ServiceNow cannot be reached. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the configuration items (CIs) in ServiceNow: The ServiceNow instance could not be reached, so nothing was sent.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because ServiceNow cannot be reached.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbServicenowUnreachable_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because ServiceNow cannot be reached. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbServicenowUnreachable_Mail",
|      "label": "ServiceNow: not reachable: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbServicenowUnreachable_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"ServiceNow: not reachable\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbServicenowUnreachable_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlCollapse_Enabled",
|      "label": "CMDB table: far fewer assets than usual",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "CMDB table: far fewer assets than usual (cmdb.sql.collapse). Off: the step goes on as if the check had not tripped -- CIs are retired even when SecurityInsight sees far fewer assets than are active in the CMDB table.",
|      "purpose": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: SecurityInsight sees far fewer assets than are active in the CMDB table, which looks like a broken collection rather than assets gone, so nothing was retired.",
|      "effect": "Off: the step goes on as if the check had not tripped -- CIs are retired even when SecurityInsight sees far fewer assets than are active in the CMDB table. On: the check works as described on the Guards page.",
|      "whenToChange": "Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: SecurityInsight sees far fewer assets than are active in the CMDB table, which looks like a broken collection rather than assets gone, so nothing was retired.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- CIs are retired even when SecurityInsight sees far fewer assets than are active in the CMDB table.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlCollapse_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- CIs are retired even when SecurityInsight sees far fewer assets than are active in the CMDB table. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlCollapse_Mail",
|      "label": "CMDB table: far fewer assets than usual: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbSqlCollapse_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"CMDB table: far fewer assets than usual\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlCollapse_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlEmptySnapshot_Enabled",
|      "label": "CMDB table: empty asset collection",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "CMDB table: empty asset collection (cmdb.sql.empty-snapshot). Off: the step goes on as if the check had not tripped -- an empty asset collection is written too, which can retire every CI.",
|      "purpose": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: The newest asset collection holds no assets at all, so nothing was written or retired.",
|      "effect": "Off: the step goes on as if the check had not tripped -- an empty asset collection is written too, which can retire every CI. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: The newest asset collection holds no assets at all, so nothing was written or retired.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- an empty asset collection is written too, which can retire every CI.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlEmptySnapshot_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- an empty asset collection is written too, which can retire every CI. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlEmptySnapshot_Mail",
|      "label": "CMDB table: empty asset collection: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbSqlEmptySnapshot_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"CMDB table: empty asset collection\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlEmptySnapshot_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlNoCorrelationMap_Enabled",
|      "label": "CMDB table: no correlation results",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "CMDB table: no correlation results (cmdb.sql.no-correlation-map). Off: no event and no mail. The step itself still stops, because without the correlation results no asset can be matched to its CI.",
|      "purpose": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: The asset correlation results are missing, so assets could not be matched to their CIs and nothing was written.",
|      "effect": "Off: no event and no mail. The step itself still stops, because without the correlation results no asset can be matched to its CI. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: The asset correlation results are missing, so assets could not be matched to their CIs and nothing was written.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because without the correlation results no asset can be matched to its CI.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlNoCorrelationMap_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because without the correlation results no asset can be matched to its CI. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlNoCorrelationMap_Mail",
|      "label": "CMDB table: no correlation results: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbSqlNoCorrelationMap_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"CMDB table: no correlation results\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlNoCorrelationMap_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlSnapshotIncomplete_Enabled",
|      "label": "CMDB table: asset collection not complete",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "CMDB table: asset collection not complete (cmdb.sql.snapshot-incomplete). Off: no event and no mail. The step itself still stops, because a CI is never written from an asset collection that is not complete.",
|      "purpose": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: The newest asset collection is not known to be complete, so the CMDB table was not changed.",
|      "effect": "Off: no event and no mail. The step itself still stops, because a CI is never written from an asset collection that is not complete. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: The newest asset collection is not known to be complete, so the CMDB table was not changed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because a CI is never written from an asset collection that is not complete.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlSnapshotIncomplete_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because a CI is never written from an asset collection that is not complete. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlSnapshotIncomplete_Mail",
|      "label": "CMDB table: asset collection not complete: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbSqlSnapshotIncomplete_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"CMDB table: asset collection not complete\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlSnapshotIncomplete_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlStale_Enabled",
|      "label": "CMDB table: changed by another run",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "CMDB table: changed by another run (cmdb.sql.stale). Off: no event and no mail. The step itself still stops, because another run changed the CMDB table meanwhile; the next run plans again.",
|      "purpose": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: Another run changed the CMDB table while this one was planning, so this run wrote nothing.",
|      "effect": "Off: no event and no mail. The step itself still stops, because another run changed the CMDB table meanwhile; the next run plans again. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: Another run changed the CMDB table while this one was planning, so this run wrote nothing.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because another run changed the CMDB table meanwhile; the next run plans again.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlStale_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because another run changed the CMDB table meanwhile; the next run plans again. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlStale_Mail",
|      "label": "CMDB table: changed by another run: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbSqlStale_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"CMDB table: changed by another run\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlStale_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CollectionSourceAssetDrop_Enabled",
|      "label": "Collection: far fewer assets from one source",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "Collection: far fewer assets from one source (collection.source.asset-drop). Off: a collection with far fewer assets is taken as it comes -- the assets the source no longer lists are marked not seen at once, and their CIs retire after the usual days.",
|      "purpose": "The safety check that protects your configuration items (CIs) and everything calculated from them: One source returned far fewer assets than in its last good collection, although the collection completed.",
|      "effect": "Off: a collection with far fewer assets is taken as it comes -- the assets the source no longer lists are marked not seen at once, and their CIs retire after the usual days. On: the check works as described on the Guards page.",
|      "whenToChange": "Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects your configuration items (CIs) and everything calculated from them: One source returned far fewer assets than in its last good collection, although the collection completed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "a collection with far fewer assets is taken as it comes -- the assets the source no longer lists are marked not seen at once, and their CIs retire after the usual days.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CollectionSourceAssetDrop_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "a collection with far fewer assets is taken as it comes -- the assets the source no longer lists are marked not seen at once, and their CIs retire after the usual days. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CollectionSourceAssetDrop_Mail",
|      "label": "Collection: far fewer assets from one source: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: this check never sends a mail -- its event is shown on the Guards page only; a value here changes nothing.",
|      "purpose": "This safety check never sends a mail: it accepts a real drop by itself on the next complete collection, so its event is shown on the Guards page only. This switch changes nothing and is not shown on the Settings page.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Never: this check sends no mail either way.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CollectionSourceAssetDrop_Enabled",
|      "info": {
|        "what": "This safety check never sends a mail: it accepts a real drop by itself on the next complete collection, so its event is shown on the Guards page only. This switch changes nothing and is not shown on the Settings page.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Collection: far fewer assets from one source\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Never: this check sends no mail either way.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CollectionSourceAssetDrop_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncAssetKindDropped_Enabled",
|      "label": "Data sync: findings an asset kind filter cannot show",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Data sync: findings an asset kind filter cannot show (datasync.asset.kind-dropped). Off: no event and no mail when a loaded collection has findings of an asset kind that no asset of that kind carries; the findings are loaded as before.",
|      "purpose": "The safety check that protects the asset kind filters of the Pro web app: findings of an asset kind were loaded, but their assets were stored without that kind (or without any kind), so the asset kind filter cannot show them.",
|      "effect": "Off: no event and no mail when a loaded collection has findings of an asset kind that no asset of that kind carries; the findings are loaded as before. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the asset kind filters of the Pro web app: findings of an asset kind were loaded, but their assets were stored without that kind (or without any kind), so the asset kind filter cannot show them.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail when a loaded collection has findings of an asset kind that no asset of that kind carries; the findings are loaded as before.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncAssetKindDropped_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail when a loaded collection has findings of an asset kind that no asset of that kind carries; the findings are loaded as before. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncAssetKindDropped_Mail",
|      "label": "Data sync: findings an asset kind filter cannot show: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_DatasyncAssetKindDropped_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Data sync: findings an asset kind filter cannot show\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncAssetKindDropped_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncCollectionHeld_Enabled",
|      "label": "Data sync: collection of an unfinished run",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Data sync: collection of an unfinished run (datasync.collection.held). Off: the step goes on as if the check had not tripped -- a collection whose Risk Analysis run did not finish completely is loaded anyway and MARKED PARTIAL in the web app.",
|      "purpose": "The safety check that protects the collections shown in the Pro web app: Some Risk Analysis collections were not loaded into the Pro database because the run that produced them is not known to be complete.",
|      "effect": "Off: the step goes on as if the check had not tripped -- a collection whose Risk Analysis run did not finish completely is loaded anyway and MARKED PARTIAL in the web app. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the collections shown in the Pro web app: Some Risk Analysis collections were not loaded into the Pro database because the run that produced them is not known to be complete.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- a collection whose Risk Analysis run did not finish completely is loaded anyway and MARKED PARTIAL in the web app.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncCollectionHeld_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- a collection whose Risk Analysis run did not finish completely is loaded anyway and MARKED PARTIAL in the web app. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncCollectionHeld_Mail",
|      "label": "Data sync: collection of an unfinished run: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_DatasyncCollectionHeld_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Data sync: collection of an unfinished run\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncCollectionHeld_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncCollectionRefused_Enabled",
|      "label": "Data sync: rows without their key",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Data sync: rows without their key (datasync.collection.refused). Off: no event and no mail. The step itself still stops, because rows without their finding id or collection time cannot be placed in a day.",
|      "purpose": "The safety check that protects the days shown in the Pro web app and its trends: Risk Analysis data arrived without its key columns (its finding ids, or its collection time), so it was not loaded as a day.",
|      "effect": "Off: no event and no mail. The step itself still stops, because rows without their finding id or collection time cannot be placed in a day. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the days shown in the Pro web app and its trends: Risk Analysis data arrived without its key columns (its finding ids, or its collection time), so it was not loaded as a day.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because rows without their finding id or collection time cannot be placed in a day.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncCollectionRefused_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because rows without their finding id or collection time cannot be placed in a day. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncCollectionRefused_Mail",
|      "label": "Data sync: rows without their key: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_DatasyncCollectionRefused_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Data sync: rows without their key\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncCollectionRefused_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncCollectionShortRead_Enabled",
|      "label": "Data sync: collection not read in full",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Data sync: collection not read in full (datasync.collection.short-read). Off: no event and no mail. The step itself still stops, because a collection that could not be read or written in full is not loaded.",
|      "purpose": "The safety check that protects the collections shown in the Pro web app: A collection could not be read or written in full, so it was not loaded.",
|      "effect": "Off: no event and no mail. The step itself still stops, because a collection that could not be read or written in full is not loaded. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the collections shown in the Pro web app: A collection could not be read or written in full, so it was not loaded.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because a collection that could not be read or written in full is not loaded.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncCollectionShortRead_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because a collection that could not be read or written in full is not loaded. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncCollectionShortRead_Mail",
|      "label": "Data sync: collection not read in full: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_DatasyncCollectionShortRead_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Data sync: collection not read in full\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncCollectionShortRead_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_ExemptionBulkRefused_Enabled",
|      "label": "Bulk exemption limit",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Bulk exemption limit (exemption.bulk.refused). Off: no event and no mail. The request itself is still refused, because a whole collection is never exempted in one go -- raise the limit instead (Settings > Exemptions: Most findings in one bulk exemption request, up to 2,000).",
|      "purpose": "The safety check that protects your findings from being exempted in bulk by mistake: A request to exempt or change many findings at once was refused (no narrowing filter, or more findings than the limit allows).",
|      "effect": "Off: no event and no mail. The request itself is still refused, because a whole collection is never exempted in one go -- raise the limit instead (Settings > Exemptions: Most findings in one bulk exemption request, up to 2,000). On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects your findings from being exempted in bulk by mistake: A request to exempt or change many findings at once was refused (no narrowing filter, or more findings than the limit allows).",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The request itself is still refused, because a whole collection is never exempted in one go -- raise the limit instead (Settings > Exemptions: Most findings in one bulk exemption request, up to 2,000).",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_ExemptionBulkRefused_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The request itself is still refused, because a whole collection is never exempted in one go -- raise the limit instead (Settings > Exemptions: Most findings in one bulk exemption request, up to 2,000). Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_ExemptionBulkRefused_Mail",
|      "label": "Bulk exemption limit: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_ExemptionBulkRefused_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Bulk exemption limit\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_ExemptionBulkRefused_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowRunCatchUp_Enabled",
|      "label": "Daily flow: start held for the previous run",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Daily flow: start held for the previous run (flow.run.catch-up). Off: no event and no mail; the daily flow still waits for its previous run.",
|      "purpose": "The safety check that protects the order of the daily jobs: A scheduled start of the daily job flow was held because the previous run was still running; it ran once as soon as that run finished.",
|      "effect": "Off: no event and no mail; the daily flow still waits for its previous run. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the order of the daily jobs: A scheduled start of the daily job flow was held because the previous run was still running; it ran once as soon as that run finished.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail; the daily flow still waits for its previous run.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowRunCatchUp_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail; the daily flow still waits for its previous run. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowRunCatchUp_Mail",
|      "label": "Daily flow: start held for the previous run: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_FlowRunCatchUp_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Daily flow: start held for the previous run\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowRunCatchUp_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowStepInterrupted_Enabled",
|      "label": "Daily flow: job interrupted",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Daily flow: job interrupted (flow.step.interrupted). Off: no event and no mail; an interrupted job is still not started again.",
|      "purpose": "The safety check that protects the jobs that depend on an earlier job: A job in the daily flow was interrupted and was not started again automatically.",
|      "effect": "Off: no event and no mail; an interrupted job is still not started again. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the jobs that depend on an earlier job: A job in the daily flow was interrupted and was not started again automatically.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail; an interrupted job is still not started again.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowStepInterrupted_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail; an interrupted job is still not started again. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowStepInterrupted_Mail",
|      "label": "Daily flow: job interrupted: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_FlowStepInterrupted_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Daily flow: job interrupted\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowStepInterrupted_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowStepSkipped_Enabled",
|      "label": "Daily flow: jobs skipped",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Daily flow: jobs skipped (flow.step.skipped). Off: no event and no mail; jobs that need a failed job are still skipped.",
|      "purpose": "The safety check that protects the jobs that depend on an earlier job: One or more jobs in the daily flow were skipped because a job they need did not succeed.",
|      "effect": "Off: no event and no mail; jobs that need a failed job are still skipped. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the jobs that depend on an earlier job: One or more jobs in the daily flow were skipped because a job they need did not succeed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail; jobs that need a failed job are still skipped.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowStepSkipped_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail; jobs that need a failed job are still skipped. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowStepSkipped_Mail",
|      "label": "Daily flow: jobs skipped: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_FlowStepSkipped_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Daily flow: jobs skipped\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowStepSkipped_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowStepStartFailed_Enabled",
|      "label": "Daily flow: job did not start",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Daily flow: job did not start (flow.step.start-failed). Off: no event and no mail; a job that does not start is still not run.",
|      "purpose": "The safety check that protects the jobs of the daily flow: A job in the daily flow could not start: its container stopped before SecurityInsight ran (an Azure platform problem).",
|      "effect": "Off: no event and no mail; a job that does not start is still not run. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the jobs of the daily flow: A job in the daily flow could not start: its container stopped before SecurityInsight ran (an Azure platform problem).",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail; a job that does not start is still not run.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowStepStartFailed_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail; a job that does not start is still not run. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowStepStartFailed_Mail",
|      "label": "Daily flow: job did not start: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_FlowStepStartFailed_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Daily flow: job did not start\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowStepStartFailed_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_IngestRowsShortCount_Enabled",
|      "label": "Log Analytics: rows not accepted",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Log Analytics: rows not accepted (ingest.rows.short-count). Off: no event and no mail. The step itself still stops, because the rows Log Analytics did not accept are not there.",
|      "purpose": "The safety check that protects the results written to your Log Analytics workspace: Not every row of a result was accepted by Log Analytics, so the run was stopped instead of reporting a partial result as complete.",
|      "effect": "Off: no event and no mail. The step itself still stops, because the rows Log Analytics did not accept are not there. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the results written to your Log Analytics workspace: Not every row of a result was accepted by Log Analytics, so the run was stopped instead of reporting a partial result as complete.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because the rows Log Analytics did not accept are not there.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_IngestRowsShortCount_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because the rows Log Analytics did not accept are not there. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_IngestRowsShortCount_Mail",
|      "label": "Log Analytics: rows not accepted: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_IngestRowsShortCount_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Log Analytics: rows not accepted\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_IngestRowsShortCount_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_JobExecutionPreviousRunning_Enabled",
|      "label": "Job started while still running",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Job started while still running (job.execution.previous-running). Off: no event and no mail. The step itself still stops, because two runs of one job never run at the same time.",
|      "purpose": "The safety check that protects a job from running twice at the same time: A job was started while its previous run was still running, so the new run did nothing.",
|      "effect": "Off: no event and no mail. The step itself still stops, because two runs of one job never run at the same time. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects a job from running twice at the same time: A job was started while its previous run was still running, so the new run did nothing.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because two runs of one job never run at the same time.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_JobExecutionPreviousRunning_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because two runs of one job never run at the same time. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_JobExecutionPreviousRunning_Mail",
|      "label": "Job started while still running: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_JobExecutionPreviousRunning_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Job started while still running\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_JobExecutionPreviousRunning_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_JobRunThrottledStuck_Enabled",
|      "label": "Job stuck on throttling",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Job stuck on throttling (job.run.throttled-stuck). Off: no event and no mail when a job is stuck on throttling. Throttled runs are still shown as throttled on the Jobs and Run health pages.",
|      "purpose": "The safety check that protects the data of a job that Microsoft keeps throttling: A job has not completed for a long time, because Microsoft throttled every run of it.",
|      "effect": "Off: no event and no mail when a job is stuck on throttling. Throttled runs are still shown as throttled on the Jobs and Run health pages. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the data of a job that Microsoft keeps throttling: A job has not completed for a long time, because Microsoft throttled every run of it.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail when a job is stuck on throttling. Throttled runs are still shown as throttled on the Jobs and Run health pages.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_JobRunThrottledStuck_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail when a job is stuck on throttling. Throttled runs are still shown as throttled on the Jobs and Run health pages. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_JobRunThrottledStuck_Mail",
|      "label": "Job stuck on throttling: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_JobRunThrottledStuck_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Job stuck on throttling\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_JobRunThrottledStuck_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_LicenceStateGrace_Enabled",
|      "label": "Licence grace period",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Licence grace period (licence.state.grace). Off: no event and no mail during the licence grace period; everything keeps running.",
|      "purpose": "The safety check that protects the SecurityInsight Pro features: The SecurityInsight Pro licence is in its grace period.",
|      "effect": "Off: no event and no mail during the licence grace period; everything keeps running. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the SecurityInsight Pro features: The SecurityInsight Pro licence is in its grace period.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail during the licence grace period; everything keeps running.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_LicenceStateGrace_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail during the licence grace period; everything keeps running. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_LicenceStateGrace_Mail",
|      "label": "Licence grace period: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_LicenceStateGrace_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Licence grace period\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_LicenceStateGrace_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_LicenceStateInvalid_Enabled",
|      "label": "Licence not valid",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Licence not valid (licence.state.invalid). Off: no event and no mail. The step itself still stops, because the licence, not this switch, decides which Pro features run.",
|      "purpose": "The safety check that protects the SecurityInsight Pro features: The SecurityInsight Pro licence does not verify (it has expired or is not valid for this install), so the Pro jobs did not run.",
|      "effect": "Off: no event and no mail. The step itself still stops, because the licence, not this switch, decides which Pro features run. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the SecurityInsight Pro features: The SecurityInsight Pro licence does not verify (it has expired or is not valid for this install), so the Pro jobs did not run.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because the licence, not this switch, decides which Pro features run.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_LicenceStateInvalid_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because the licence, not this switch, decides which Pro features run. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_LicenceStateInvalid_Mail",
|      "label": "Licence not valid: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_LicenceStateInvalid_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Licence not valid\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_LicenceStateInvalid_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_RaBucketCountJump_Enabled",
|      "label": "Risk Analysis: far more buckets than usual",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "Risk Analysis: far more buckets than usual (ra.bucket.count-jump). Off: no event when a report needs far more buckets than usual; the run itself is unchanged.",
|      "purpose": "The safety check that protects the speed and correctness of your Risk Analysis reports: One or more reports needed far more buckets (query slices) than usual.",
|      "effect": "Off: no event when a report needs far more buckets than usual; the run itself is unchanged. On: the check works as described on the Guards page.",
|      "whenToChange": "On by default (owner-approved bucket sizing design): it only warns and never stops a run. Turn it off only if you do not want these warnings.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the speed and correctness of your Risk Analysis reports: One or more reports needed far more buckets (query slices) than usual.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event when a report needs far more buckets than usual; the run itself is unchanged.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: On by default (owner-approved bucket sizing design): it only warns and never stops a run. Turn it off only if you do not want these warnings.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_RaBucketCountJump_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event when a report needs far more buckets than usual; the run itself is unchanged. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_RaBucketCountJump_Mail",
|      "label": "Risk Analysis: far more buckets than usual: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_RaBucketCountJump_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Risk Analysis: far more buckets than usual\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_RaBucketCountJump_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_RaOutputColumnEmptied_Enabled",
|      "label": "Risk Analysis: column emptied",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Risk Analysis: column emptied (ra.output.column-emptied). Off: no event and no mail when a report column lost its content; the report itself is unchanged.",
|      "purpose": "The safety check that protects the completeness of your Risk Analysis reports: One or more report columns are empty (or gone) while they had values in the previous run.",
|      "effect": "Off: no event and no mail when a report column lost its content; the report itself is unchanged. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the completeness of your Risk Analysis reports: One or more report columns are empty (or gone) while they had values in the previous run.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail when a report column lost its content; the report itself is unchanged.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_RaOutputColumnEmptied_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail when a report column lost its content; the report itself is unchanged. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_RaOutputColumnEmptied_Mail",
|      "label": "Risk Analysis: column emptied: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_RaOutputColumnEmptied_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Risk Analysis: column emptied\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_RaOutputColumnEmptied_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_RaOutputRowDrop_Enabled",
|      "label": "Risk Analysis: far fewer findings",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Risk Analysis: far fewer findings (ra.output.row-drop). Off: the step goes on as if the check had not tripped -- a report with far fewer findings than the previous run no longer makes the run partial (a failed query or a missing result still does).",
|      "purpose": "The safety check that protects the completeness of your Risk Analysis reports: One or more reports produced far fewer findings than the previous run.",
|      "effect": "Off: the step goes on as if the check had not tripped -- a report with far fewer findings than the previous run no longer makes the run partial (a failed query or a missing result still does). On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the completeness of your Risk Analysis reports: One or more reports produced far fewer findings than the previous run.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- a report with far fewer findings than the previous run no longer makes the run partial (a failed query or a missing result still does).",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_RaOutputRowDrop_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- a report with far fewer findings than the previous run no longer makes the run partial (a failed query or a missing result still does). Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_RaOutputRowDrop_Mail",
|      "label": "Risk Analysis: far fewer findings: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_RaOutputRowDrop_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Risk Analysis: far fewer findings\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_RaOutputRowDrop_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_SchemaGateRefused_Enabled",
|      "label": "Database change that could remove data",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Database change that could remove data (schema.gate.refused). Off: no event and no mail. The step itself still stops, because a database change that could remove data is never applied automatically.",
|      "purpose": "The safety check that protects your SecurityInsight database: A database change was refused because it is not approved for this install, or because it could remove data.",
|      "effect": "Off: no event and no mail. The step itself still stops, because a database change that could remove data is never applied automatically. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects your SecurityInsight database: A database change was refused because it is not approved for this install, or because it could remove data.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because a database change that could remove data is never applied automatically.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_SchemaGateRefused_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because a database change that could remove data is never applied automatically. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_SchemaGateRefused_Mail",
|      "label": "Database change that could remove data: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_SchemaGateRefused_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Database change that could remove data\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_SchemaGateRefused_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_UpdateSchemaFailed_Enabled",
|      "label": "Update: database update failed",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Update: database update failed (update.schema.failed). Off: no event and no mail. The step itself still stops, because the database update failed.",
|      "purpose": "The safety check that protects your SecurityInsight installation from running a new version on an old database: An update stopped before it changed anything, because the new version's database changes could not be applied.",
|      "effect": "Off: no event and no mail. The step itself still stops, because the database update failed. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects your SecurityInsight installation from running a new version on an old database: An update stopped before it changed anything, because the new version's database changes could not be applied.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because the database update failed.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_UpdateSchemaFailed_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because the database update failed. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_UpdateSchemaFailed_Mail",
|      "label": "Update: database update failed: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_UpdateSchemaFailed_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Update: database update failed\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_UpdateSchemaFailed_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorCloseCeiling_Enabled",
|      "label": "Vulnerability close limit",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Vulnerability close limit (vuln.connector.close-ceiling). Off: the step goes on as if the check had not tripped -- the vulnerability connector closes every record the run would close, however many; nothing is held for release.",
|      "purpose": "The safety check that protects open vulnerability records: SecurityInsight would have closed far more vulnerability records in one run than it allows, so it closed none.",
|      "effect": "Off: the step goes on as if the check had not tripped -- the vulnerability connector closes every record the run would close, however many; nothing is held for release. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects open vulnerability records: SecurityInsight would have closed far more vulnerability records in one run than it allows, so it closed none.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- the vulnerability connector closes every record the run would close, however many; nothing is held for release.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorCloseCeiling_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- the vulnerability connector closes every record the run would close, however many; nothing is held for release. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorCloseCeiling_Mail",
|      "label": "Vulnerability close limit: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorCloseCeiling_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerability close limit\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorCloseCeiling_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorCollapse_Enabled",
|      "label": "Vulnerabilities: result far smaller than usual",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Vulnerabilities: result far smaller than usual (vuln.connector.collapse). Off: the step goes on as if the check had not tripped -- a result that lost most of its findings closes the records it no longer reports.",
|      "purpose": "The safety check that protects open vulnerability records: Far fewer of the open vulnerability records are still reported than usual, which looks like a partial collection rather than a real fix, so nothing was closed.",
|      "effect": "Off: the step goes on as if the check had not tripped -- a result that lost most of its findings closes the records it no longer reports. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects open vulnerability records: Far fewer of the open vulnerability records are still reported than usual, which looks like a partial collection rather than a real fix, so nothing was closed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- a result that lost most of its findings closes the records it no longer reports.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorCollapse_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- a result that lost most of its findings closes the records it no longer reports. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorCollapse_Mail",
|      "label": "Vulnerabilities: result far smaller than usual: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorCollapse_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: result far smaller than usual\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorCollapse_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorEmptySnapshot_Enabled",
|      "label": "Vulnerabilities: empty result",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Vulnerabilities: empty result (vuln.connector.empty-snapshot). Off: the step goes on as if the check had not tripped -- an EMPTY result closes the open records it no longer reports, so a failed collection can close every open vulnerability.",
|      "purpose": "The safety check that protects open vulnerability records: The newest Risk Analysis results held no vulnerabilities while records are still open, so nothing was closed.",
|      "effect": "Off: the step goes on as if the check had not tripped -- an EMPTY result closes the open records it no longer reports, so a failed collection can close every open vulnerability. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects open vulnerability records: The newest Risk Analysis results held no vulnerabilities while records are still open, so nothing was closed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- an EMPTY result closes the open records it no longer reports, so a failed collection can close every open vulnerability.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorEmptySnapshot_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- an EMPTY result closes the open records it no longer reports, so a failed collection can close every open vulnerability. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorEmptySnapshot_Mail",
|      "label": "Vulnerabilities: empty result: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorEmptySnapshot_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: empty result\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorEmptySnapshot_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorRefused_Enabled",
|      "label": "Vulnerabilities: connector not set up",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Vulnerabilities: connector not set up (vuln.connector.refused). Off: no event and no mail. The step itself still stops, because the connector is not set up completely and cannot run.",
|      "purpose": "The safety check that protects your vulnerability target: A vulnerability connector is not set up completely, so it did not run.",
|      "effect": "Off: no event and no mail. The step itself still stops, because the connector is not set up completely and cannot run. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects your vulnerability target: A vulnerability connector is not set up completely, so it did not run.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because the connector is not set up completely and cannot run.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorRefused_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because the connector is not set up completely and cannot run. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorRefused_Mail",
|      "label": "Vulnerabilities: connector not set up: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorRefused_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: connector not set up\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorRefused_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorRunIncomplete_Enabled",
|      "label": "Vulnerabilities: Risk Analysis run not finished",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Vulnerabilities: Risk Analysis run not finished (vuln.connector.run-incomplete). Off: the step goes on as if the check had not tripped -- records are closed even when the Risk Analysis run behind the results did not finish cleanly.",
|      "purpose": "The safety check that protects open vulnerability records: The Risk Analysis run behind these results did not finish cleanly, so nothing was closed.",
|      "effect": "Off: the step goes on as if the check had not tripped -- records are closed even when the Risk Analysis run behind the results did not finish cleanly. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects open vulnerability records: The Risk Analysis run behind these results did not finish cleanly, so nothing was closed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- records are closed even when the Risk Analysis run behind the results did not finish cleanly.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorRunIncomplete_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- records are closed even when the Risk Analysis run behind the results did not finish cleanly. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorRunIncomplete_Mail",
|      "label": "Vulnerabilities: Risk Analysis run not finished: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorRunIncomplete_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: Risk Analysis run not finished\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorRunIncomplete_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorScopeChanged_Enabled",
|      "label": "Vulnerabilities: scope changed",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Vulnerabilities: scope changed (vuln.connector.scope-changed). Off: the step goes on as if the check had not tripped -- records that dropped out of the collection scope are closed like any other absent record.",
|      "purpose": "The safety check that protects open vulnerability records: The scope of the collection changed, so records that dropped out of it were not closed.",
|      "effect": "Off: the step goes on as if the check had not tripped -- records that dropped out of the collection scope are closed like any other absent record. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects open vulnerability records: The scope of the collection changed, so records that dropped out of it were not closed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- records that dropped out of the collection scope are closed like any other absent record.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorScopeChanged_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- records that dropped out of the collection scope are closed like any other absent record. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorScopeChanged_Mail",
|      "label": "Vulnerabilities: scope changed: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorScopeChanged_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: scope changed\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorScopeChanged_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorSnapshotIncomplete_Enabled",
|      "label": "Vulnerabilities: results not known to be complete",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Vulnerabilities: results not known to be complete (vuln.connector.snapshot-incomplete). Off: the step goes on as if the check had not tripped -- absences are counted and records closed even when the newest results are not known to be complete.",
|      "purpose": "The safety check that protects open vulnerability records: The newest Risk Analysis results are not known to be complete, so findings were opened and updated but nothing was closed.",
|      "effect": "Off: the step goes on as if the check had not tripped -- absences are counted and records closed even when the newest results are not known to be complete. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects open vulnerability records: The newest Risk Analysis results are not known to be complete, so findings were opened and updated but nothing was closed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- absences are counted and records closed even when the newest results are not known to be complete.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorSnapshotIncomplete_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- absences are counted and records closed even when the newest results are not known to be complete. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorSnapshotIncomplete_Mail",
|      "label": "Vulnerabilities: results not known to be complete: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorSnapshotIncomplete_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: results not known to be complete\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorSnapshotIncomplete_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorTargetIncomplete_Enabled",
|      "label": "Vulnerabilities: target not read in full",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "Vulnerabilities: target not read in full (vuln.connector.target-incomplete). Off: no event and no mail. The step itself still stops, because writing after a partial read of the target would open every record the read missed again as a duplicate.",
|      "purpose": "The safety check that protects your vulnerability target from duplicate records: The vulnerability target (for example the ServiceNow table) could not be read in full, so nothing was written: every record the read missed would have been opened again as a duplicate.",
|      "effect": "Off: no event and no mail. The step itself still stops, because writing after a partial read of the target would open every record the read missed again as a duplicate. On: the check works as described on the Guards page.",
|      "whenToChange": "Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects your vulnerability target from duplicate records: The vulnerability target (for example the ServiceNow table) could not be read in full, so nothing was written: every record the read missed would have been opened again as a duplicate.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because writing after a partial read of the target would open every record the read missed again as a duplicate.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorTargetIncomplete_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because writing after a partial read of the target would open every record the read missed again as a duplicate. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorTargetIncomplete_Mail",
|      "label": "Vulnerabilities: target not read in full: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorTargetIncomplete_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: target not read in full\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorTargetIncomplete_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_GuardMail_Enabled",
|      "label": "Mail when a safety check stops a step",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "When SecurityInsight holds, refuses or stops a step to protect your data (for example the vulnerability connector refusing to close far more records than usual), it mails the people below -- at most once a day per guard while it keeps happening. On by default.",
|      "purpose": "Mails a person when a safety check holds, refuses or stops a step to protect your data -- for example when far more vulnerabilities would close than usual.",
|      "effect": "Off sends no such mail: the event is still recorded in run health, on the Guards page of the Pro web app and in the audit trail, and still reported to Invardia when status reports are on. While a check keeps tripping, at most one mail a day is sent, saying how many times it happened.",
|      "whenToChange": "Leave it on. Turn it off only if another system already watches these events for you.",
|      "card": "Safety-check mails",
|      "info": {
|        "what": "Mails a person when a safety check holds, refuses or stops a step to protect your data -- for example when far more vulnerabilities would close than usual.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Off sends no such mail: the event is still recorded in run health, on the Guards page of the Pro web app and in the audit trail, and still reported to Invardia when status reports are on. While a check keeps tripping, at most one mail a day is sent, saying how many times it happened.",
|        "risk": "No check mails anyone any more: a held or stopped step is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: Leave it on. Turn it off only if another system already watches these events for you.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_GuardMail_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "Off sends no such mail: the event is still recorded in run health, on the Guards page of the Pro web app and in the audit trail, and still reported to Invardia when status reports are on. While a check keeps tripping, at most one mail a day is sent, saying how many times it happened. No check mails anyone any more: a held or stopped step is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_GuardMail_To",
|      "label": "Safety-check mail recipients",
|      "group": "Mail & notifications",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "The report recipients (MailTo); without those, the SecurityInsight Pro SuperAdmins whose sign-in name is a mail address",
|      "description": "Who gets them. Default: the report recipients (MailTo), else the SecurityInsight Pro SuperAdmins.",
|      "purpose": "The addresses that receive the mail when a safety check holds, refuses or stops a step.",
|      "effect": "These addresses get the mails instead of the report recipients.",
|      "whenToChange": "Set it to the team that runs SecurityInsight day to day, when that is not the team that reads the reports.",
|      "card": "Safety-check mails",
|      "hint": "Empty: the default recipients, else the SuperAdmins.",
|      "needs": "SI_GuardMail_Enabled",
|      "itemFormat": "email",
|      "info": {
|        "what": "The addresses that receive the mail when a safety check holds, refuses or stops a step.",
|        "whenChanged": "These addresses get the mails instead of the report recipients.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"Mail when a safety check stops a step\" is on.",
|        "default": "The report recipients (MailTo); without those, the SecurityInsight Pro SuperAdmins whose sign-in name is a mail address",
|        "recommended": "Keep the default. Change it when: Set it to the team that runs SecurityInsight day to day, when that is not the team that reads the reports.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_GuardMail_To/"
|      }
|    },
|    {
|      "name": "SI_Guards_Enabled",
|      "label": "All guards (safety checks)",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "Every safety check can be turned on or off, and its mail turned off (Pro: Settings > Guards). Since the guard relief (2026-10-11) only the two brakes are ON by default: CIs retired by mistake (cmdb.sql.collapse, cmdb.handoff.mass-change) and duplicate vulnerability records (vuln.connector.target-incomplete); every other check is OFF until you switch it on (the examples below show the switch, not the default -- the glossary at the end says each default). Off = the check does not hold, refuse or stop: it says so once in the job log and the step goes on (config\\guard-catalog .locked.json 'whenOff' says what that means per check). WARNING: SecurityInsight then acts on data that may be broken. All checks at once:",
|      "purpose": "One switch for every safety check that holds, refuses or stops a step to protect your data (the list below and the Guards page).",
|      "effect": "WARNING -- Off turns EVERY safety check off at once: SecurityInsight then closes vulnerability records, retires CIs, hands over batches and loads collections even when the data looks broken or incomplete, so a failed collection can close or retire everything it no longer sees. Nothing is held for release and no guard mail is sent; each check says once in its job log that it is off. The checks that only report a stop SecurityInsight cannot skip (the source failed, the licence) stop reporting it. On: every check works as set below.",
|      "whenToChange": "Leave it on. Turn it off only for a short time, when the checks stop work you know is right -- and prefer turning off or tuning the one check that is in the way.",
|      "card": "Guards (safety checks)",
|      "hint": "Off = every check below is off.",
|      "info": {
|        "what": "One switch for every safety check that holds, refuses or stops a step to protect your data (the list below and the Guards page).",
|        "whenOn": "every check works as set below.",
|        "whenOff": "WARNING -- Off turns EVERY safety check off at once: SecurityInsight then closes vulnerability records, retires CIs, hands over batches and loads collections even when the data looks broken or incomplete, so a failed collection can close or retire everything it no longer sees. Nothing is held for release and no guard mail is sent; each check says once in its job log that it is off. The checks that only report a stop SecurityInsight cannot skip (the source failed, the licence) stop reporting it. On: every check works as set below.",
|        "risk": "Turning this off removes EVERY safety check at once: no step is held or stopped to protect your data, whatever happens. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: Leave it on. Turn it off only for a short time, when the checks stop work you know is right -- and prefer turning off or tuning the one check that is in the way.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guards_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "WARNING -- Off turns EVERY safety check off at once: SecurityInsight then closes vulnerability records, retires CIs, hands over batches and loads collections even when the data looks broken or incomplete, so a failed collection can close or retire everything it no longer sees. Nothing is held for release and no guard mail is sent; each check says once in its job log that it is off. The checks that only report a stop SecurityInsight cannot skip (the source failed, the licence) stop reporting it. On: every check works as set below. Turning this off removes EVERY safety check at once: no step is held or stopped to protect your data, whatever happens. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_HasExposureGraphInLA",
|      "label": "Exposure graph available in workspace",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: reports needing exposure graph tables are skipped",
|      "description": "set when ExposureGraph is mirrored to LA (Sentinel data lake); enables RA queries that need EG tables",
|      "purpose": "Tells Risk Analysis that Defender exposure graph tables are mirrored into Log Analytics, so reports needing them can run.",
|      "effect": "On, Risk Analysis runs the reports that query exposure graph tables in the workspace. Turning it on without the tables present makes those reports fail.",
|      "whenToChange": "Turn on after enabling exposure graph table mirroring to Log Analytics.",
|      "card": "Sources and links",
|      "info": {
|        "what": "Tells Risk Analysis that Defender exposure graph tables are mirrored into Log Analytics, so reports needing them can run.",
|        "whenOn": "On, Risk Analysis runs the reports that query exposure graph tables in the workspace. Turning it on without the tables present makes those reports fail.",
|        "whenOff": "reports needing exposure graph tables are skipped",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Off: reports needing exposure graph tables are skipped",
|        "recommended": "Keep the default. Change it when: Turn on after enabling exposure graph table mirroring to Log Analytics.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_HasExposureGraphInLA/"
|      }
|    },
|    {
|      "name": "SI_Identity_DcrName",
|      "label": "Identity data collection rule name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The standard name, dcr-si-identity-profile (from the naming pattern)",
|      "description": "Overrides the data collection rule name the identity profiling engine ingests through; when empty, the standard naming pattern is used.",
|      "purpose": "The name of the data collection rule the identity engine sends its rows through to Log Analytics.",
|      "effect": "Rows are sent through the named rule. A name that does not match an existing or creatable rule makes the identity ingest fail.",
|      "whenToChange": "Only if you renamed the rule or must avoid a name clash with another install.",
|      "info": {
|        "what": "The name of the data collection rule the identity engine sends its rows through to Log Analytics.",
|        "whenChanged": "Rows are sent through the named rule. A name that does not match an existing or creatable rule makes the identity ingest fail.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "The standard name, dcr-si-identity-profile (from the naming pattern)",
|        "recommended": "Keep the default. Change it when: Only if you renamed the rule or must avoid a name clash with another install.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_DcrName/"
|      }
|    },
|    {
|      "name": "SI_Identity_SignInMethodsFillMinutes",
|      "label": "Users' sign-in methods: background reading per slice (minutes)",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 8,
|      "defaultText": "8 minutes",
|      "description": "minutes of background reading per 15-minute run",
|      "purpose": "How many minutes of each 15-minute run of its own job (caj-si-signin-methods) the background read of the users' sign-in methods may use.",
|      "effect": "More minutes fill the detail sooner (about 250-300 users a minute, depending on how much Microsoft throttles); fewer leave more of the tick idle. A slice that is still running is never started twice.",
|      "whenToChange": "Raise it to fill a large tenant faster the first time; lower it to keep the job's runs short.",
|      "unit": "minutes",
|      "min": 1,
|      "max": 25,
|      "card": "Users' sign-in methods in full",
|      "needs": "SI_Identity_SignInMethodsPerUser",
|      "info": {
|        "what": "How many minutes of each 15-minute run of its own job (caj-si-signin-methods) the background read of the users' sign-in methods may use.",
|        "whenChanged": "More minutes fill the detail sooner (about 250-300 users a minute, depending on how much Microsoft throttles); fewer leave more of the tick idle. A slice that is still running is never started twice.",
|        "risk": "More minutes make each run of the job caj-si-signin-methods longer (its limit is 30 minutes); fewer fill the detail more slowly. Nothing collected is changed. Reversible at once.",
|        "requires": "SI_Identity_SignInMethodsPerUser all or privileged. Works only while \"Users' sign-in methods in full: which users are read\" is on.",
|        "default": "8 minutes",
|        "recommended": "8 minutes (the default).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_SignInMethodsFillMinutes/"
|      }
|    },
|    {
|      "name": "SI_Identity_SignInMethodsMaxAgeDays",
|      "label": "Users' sign-in methods: read again after (days)",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 90,
|      "defaultText": "90 days",
|      "description": "read again at the latest after this many days",
|      "purpose": "How old a user's full sign-in method detail may get before the background read reads that user again, even when the registration report says nothing changed (it also catches changes the report does not show, such as a renamed device).",
|      "effect": "Lower: details are fresher, and more of each 15-minute slice goes to reading users again (at 150,000 users and 90 days, about 1,700 users a day). Higher: fewer reads. A user whose registered methods changed is read again at once, whatever this is.",
|      "whenToChange": "Lower it when you rely on the device names and app versions being recent; raise it on a very large tenant.",
|      "unit": "days",
|      "min": 1,
|      "max": 365,
|      "card": "Users' sign-in methods in full",
|      "needs": "SI_Identity_SignInMethodsPerUser",
|      "info": {
|        "what": "How old a user's full sign-in method detail may get before the background read reads that user again, even when the registration report says nothing changed (it also catches changes the report does not show, such as a renamed device).",
|        "whenChanged": "Lower: details are fresher, and more of each 15-minute slice goes to reading users again (at 150,000 users and 90 days, about 1,700 users a day). Higher: fewer reads. A user whose registered methods changed is read again at once, whatever this is.",
|        "risk": "A long age keeps details such as device names and app versions older; a short one spends more of the background reading on users that did not change. No data is lost either way. Reversible at once.",
|        "requires": "SI_Identity_SignInMethodsPerUser all or privileged. Works only while \"Users' sign-in methods in full: which users are read\" is on.",
|        "default": "90 days",
|        "recommended": "90 days (the default).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_SignInMethodsMaxAgeDays/"
|      }
|    },
|    {
|      "name": "SI_Identity_SignInMethodsPerUser",
|      "label": "Users' sign-in methods in full: which users are read",
|      "group": "Collection scope & limits",
|      "type": "enum",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": "all",
|      "defaultText": "All: every member user is read in the background, privileged users first",
|      "description": "The users' sign-in methods in full -- every method with its details (phone, e-mail, Authenticator app, FIDO2 key, Windows Hello ...) and the device a Windows Hello or Authenticator key lives on -- need one read per user, which Microsoft throttles: about 8-9 hours at 150,000 users. The collections never wait for it: its own job (caj-si-signin-methods) reads users in the background, privileged users first, a slice every 15 minutes, and the next collection shows what was read with its date. Not read yet = unknown, never no. 'privileged' and 'off' are faster to fill but leave the other users' per-user facts unknown; the tenant-wide registration report (MFA, SSPR, passwordless capable, registered methods) is read for everyone.",
|      "purpose": "Which users get their sign-in methods read in full: every method with its details (phone number and type, e-mail address, Microsoft Authenticator app and version, FIDO2 key or passkey model and attestation, Windows Hello key strength, Temporary Access Pass) and, for a Windows Hello or Microsoft Authenticator key, the device it lives on (name, operating system, compliant, managed) linked to that device's CI. It also decides whether a user has a password and signs in passwordless only. This needs one read per user, which Microsoft throttles, so it runs in the background: a slice every 15 minutes in its own job (caj-si-signin-methods), privileged users first, then users whose methods changed, then users never read, then the oldest. Collections never wait for it; each collection shows what was read, with the date it was read. The tenant-wide registration report (MFA registered and capable, passwordless capable, self-service password reset, the registered and preferred methods) is read for every user on every collection, whatever this setting is.",
|      "effect": "All: every member user. At 150,000 users the first full read takes about 8-9 hours of reading, spread through the day (about 2,000 users per 15-minute slice); after that only users whose methods changed, and each user again after the maximum age. Until a user is read, its per-user facts (each method's details and device, password present, passwordless only) show as unknown, never as no. Privileged: only users with an Entra role (permanent or eligible, also through a group), an Azure role, or marked admin -- a few minutes on any tenant; every other user keeps those facts unknown. Off: no per-user read at all; only the registration report's facts, and the per-user facts are unknown for everyone. Changing it takes effect at the next 15-minute slice and the next collection.",
|      "whenToChange": "Choose privileged when you only need the full detail for your admins and want it filled quickly; choose off only when you do not want SecurityInsight to read each user's sign-in methods.",
|      "values": [
|        "all",
|        "privileged",
|        "off"
|      ],
|      "valueLabels": {
|        "all": "All member users (privileged first) -- the full detail, filled in the background",
|        "privileged": "Privileged users only -- fast; other users' per-user facts stay unknown",
|        "off": "Off -- the tenant-wide registration report only; per-user facts unknown"
|      },
|      "card": "Users' sign-in methods in full",
|      "info": {
|        "what": "Which users get their sign-in methods read in full: every method with its details (phone number and type, e-mail address, Microsoft Authenticator app and version, FIDO2 key or passkey model and attestation, Windows Hello key strength, Temporary Access Pass) and, for a Windows Hello or Microsoft Authenticator key, the device it lives on (name, operating system, compliant, managed) linked to that device's CI. It also decides whether a user has a password and signs in passwordless only. This needs one read per user, which Microsoft throttles, so it runs in the background: a slice every 15 minutes in its own job (caj-si-signin-methods), privileged users first, then users whose methods changed, then users never read, then the oldest. Collections never wait for it; each collection shows what was read, with the date it was read. The tenant-wide registration report (MFA registered and capable, passwordless capable, self-service password reset, the registered and preferred methods) is read for every user on every collection, whatever this setting is.",
|        "whenChanged": "All: every member user. At 150,000 users the first full read takes about 8-9 hours of reading, spread through the day (about 2,000 users per 15-minute slice); after that only users whose methods changed, and each user again after the maximum age. Until a user is read, its per-user facts (each method's details and device, password present, passwordless only) show as unknown, never as no. Privileged: only users with an Entra role (permanent or eligible, also through a group), an Azure role, or marked admin -- a few minutes on any tenant; every other user keeps those facts unknown. Off: no per-user read at all; only the registration report's facts, and the per-user facts are unknown for everyone. Changing it takes effect at the next 15-minute slice and the next collection.",
|        "risk": "All reads every member user's sign-in methods one by one in the background: on a large tenant the first full read takes 8-9 hours of reading spread over the day, and the users not read yet show unknown, never no. Privileged and off leave every other user's per-user facts (each method's details and device, password present, passwordless only) unknown, so reports cannot say who still has a password or which devices hold sign-in keys. No collection waits for it either way. Reversible: change it back; the next slices read again.",
|        "requires": "The Microsoft Graph application permission UserAuthenticationMethod.Read.All for the collection identity (the setup grants it), and the install's database.",
|        "default": "All: every member user is read in the background, privileged users first",
|        "recommended": "All (the default).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_SignInMethodsPerUser/"
|      }
|    },
|    {
|      "name": "SI_Identity_SkipDeletedGroups",
|      "label": "Exposure Graph: no asset for groups Entra ID no longer has",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": true,
|      "defaultText": "On: a group becomes an asset only while Entra ID still has it",
|      "description": "groups: only those Entra ID still has (active or recently deleted) become assets",
|      "purpose": "A customer's choice for groups the Exposure Graph still lists although Entra ID no longer has them (neither active nor in its deleted items). On, only groups that still exist in Entra ID (active or recently deleted) become assets. The others are counted and get no asset.",
|      "effect": "Stages: the identity collection reads the ids of Entra ID's groups and deleted groups once per run and records no asset for an Exposure Graph group with an Entra object id that Entra ID does not return; the run log and the Data health page show how many per run; the CI build retires the existing CI of such a group at once, with a reason naming this setting. A run whose Entra ID group read is not complete decides nothing: groups keep their last state. On-premises groups that were never synced, users, devices and findings are not affected. Off again, the next run records them again and their CIs come back.",
|      "whenToChange": "Turn it off only when your organisation wants every group the Exposure Graph lists as an asset, also groups Entra ID no longer has.",
|      "card": "Exposure Graph identities without an asset",
|      "info": {
|        "what": "A customer's choice for groups the Exposure Graph still lists although Entra ID no longer has them (neither active nor in its deleted items). On, only groups that still exist in Entra ID (active or recently deleted) become assets. The others are counted and get no asset.",
|        "whenOn": "a group becomes an asset only while Entra ID still has it",
|        "whenOff": "Stages: the identity collection reads the ids of Entra ID's groups and deleted groups once per run and records no asset for an Exposure Graph group with an Entra object id that Entra ID does not return; the run log and the Data health page show how many per run; the CI build retires the existing CI of such a group at once, with a reason naming this setting. A run whose Entra ID group read is not complete decides nothing: groups keep their last state. On-premises groups that were never synced, users, devices and findings are not affected. Off again, the next run records them again and their CIs come back.",
|        "risk": "Groups the customer chose not to keep stop being assets from the next run and their CIs retire (CMDB / ServiceNow closures follow the retired CIs). A run whose Entra ID group read is not complete changes nothing. Reversible: turn it off and the next run records them again and their CIs come back.",
|        "requires": "The identity collection with the Exposure Graph, and read access to Entra ID groups (Group.Read.All or Directory.Read.All, which the engine identity already has).",
|        "default": "On: a group becomes an asset only while Entra ID still has it",
|        "recommended": "On (the default). Off only when your organisation wants these objects as assets.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_SkipDeletedGroups/",
|        "confirmWhen": "on",
|        "confirm": "Groups the Exposure Graph lists that Entra ID no longer has (neither active nor in its deleted items) stop being assets from the next run; their existing CIs retire at once with this setting as the reason."
|      }
|    },
|    {
|      "name": "SI_Identity_SkipNeverSyncedAd",
|      "label": "Exposure Graph: no asset for never-synced AD accounts that are not privileged",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: never-synced on-premises AD accounts are decided by SI_Identity_SkipNeverSyncedDisabledAd (only disabled, non-privileged ones are left out)",
|      "description": "off by default; on: on-prem AD accounts never synced to Entra become assets only while privileged",
|      "purpose": "A customer's choice for on-premises Active Directory accounts that the Exposure Graph lists but that were never synced to Entra ID (no Entra object id). On, only the privileged ones become assets, whether they are enabled or disabled: privileged = an admin count, a critical or tier 0/1 AD group (Domain Admins, Enterprise Admins ...), an assigned role, a service account, a sensitive account or a Microsoft criticality level. The others are counted and get no asset. It is the wider form of SI_Identity_SkipNeverSyncedDisabledAd: while it is on, that setting decides nothing.",
|      "effect": "Stages: the identity collection records no asset for a never-synced AD account that is not privileged, whatever its enabled state (the Exposure Graph often lists such accounts with their name only); the run log and the Data health page show how many per run; the CI build retires the existing CI of such an account at once, with a reason naming this setting (its findings close as asset retired, never as fixed). Only on-premises AD accounts are affected (a domain SID, or an account name and domain): accounts synced to Entra ID, identities from other sources, groups, devices and findings are not. Off, SI_Identity_SkipNeverSyncedDisabledAd decides these accounts again (only disabled ones are left out), and the next run records the others again and their CIs come back.",
|      "whenToChange": "Off by default. Turn it on only for a tenant with very many on-premises AD accounts that never sync to Entra ID (hundreds of thousands), where they would otherwise become assets that nobody manages; with a few of them, keep it off so they stay assets.",
|      "card": "Exposure Graph identities without an asset",
|      "info": {
|        "what": "A customer's choice for on-premises Active Directory accounts that the Exposure Graph lists but that were never synced to Entra ID (no Entra object id). On, only the privileged ones become assets, whether they are enabled or disabled: privileged = an admin count, a critical or tier 0/1 AD group (Domain Admins, Enterprise Admins ...), an assigned role, a service account, a sensitive account or a Microsoft criticality level. The others are counted and get no asset. It is the wider form of SI_Identity_SkipNeverSyncedDisabledAd: while it is on, that setting decides nothing.",
|        "whenOn": "Stages: the identity collection records no asset for a never-synced AD account that is not privileged, whatever its enabled state (the Exposure Graph often lists such accounts with their name only); the run log and the Data health page show how many per run; the CI build retires the existing CI of such an account at once, with a reason naming this setting (its findings close as asset retired, never as fixed). Only on-premises AD accounts are affected (a domain SID, or an account name and domain): accounts synced to Entra ID, identities from other sources, groups, devices and findings are not. Off, SI_Identity_SkipNeverSyncedDisabledAd decides these accounts again (only disabled ones are left out), and the next run records the others again and their CIs come back.",
|        "whenOff": "never-synced on-premises AD accounts are decided by SI_Identity_SkipNeverSyncedDisabledAd (only disabled, non-privileged ones are left out)",
|        "risk": "Objects the customer chose not to keep stop being assets from the next run and their CIs retire (CMDB / ServiceNow closures follow the retired CIs). Accounts synced to Entra ID, identities from other sources, groups, devices and findings are not affected. Reversible: turn it off and the next run records them again and their CIs come back.",
|        "requires": "The identity collection with the Exposure Graph (Defender XDR advanced hunting).",
|        "default": "Off: never-synced on-premises AD accounts are decided by SI_Identity_SkipNeverSyncedDisabledAd (only disabled, non-privileged ones are left out)",
|        "recommended": "Off (the default). On only for a tenant with very many on-premises AD accounts that never sync to Entra ID.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_SkipNeverSyncedAd/",
|        "confirmWhen": "on",
|        "confirm": "On-premises AD accounts the Exposure Graph lists that were never synced to Entra ID and are not privileged stop being assets from the next run, enabled or not; their existing CIs retire at once with this setting as the reason, and their findings close as asset retired."
|      }
|    },
|    {
|      "name": "SI_Identity_SkipNeverSyncedDisabledAd",
|      "label": "Exposure Graph: no asset for never-synced, disabled AD accounts",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": true,
|      "defaultText": "On: a never-synced on-premises AD account becomes an asset only while it is enabled or privileged",
|      "description": "on-prem AD accounts never synced to Entra: only enabled or privileged ones become assets",
|      "purpose": "A customer's choice for on-premises Active Directory accounts that the Exposure Graph lists but that were never synced to Entra ID (no Entra object id). On, only the enabled or privileged ones become assets: privileged = an admin count, a critical or tier 0/1 AD group (Domain Admins, Enterprise Admins ...), an assigned role, a service account, a sensitive account or a Microsoft criticality level. The others are counted and get no asset.",
|      "effect": "Stages: the identity collection records no asset for a never-synced AD account that is disabled and not privileged; the run log and the Data health page show how many per run; the CI build retires the existing CI of such an account at once, with a reason naming this setting (its findings close as asset retired, never as fixed). Disabled = the account says so itself (accountEnabled false, or the disabled flag of userAccountControl); an account that does not say is kept. Accounts synced to Entra ID, groups, devices and findings are not affected. Off again, the next run records them again and their CIs come back.",
|      "whenToChange": "Turn it off only when your organisation wants every on-premises AD account the Exposure Graph lists as an asset, also the disabled ones that never reached Entra ID.",
|      "card": "Exposure Graph identities without an asset",
|      "info": {
|        "what": "A customer's choice for on-premises Active Directory accounts that the Exposure Graph lists but that were never synced to Entra ID (no Entra object id). On, only the enabled or privileged ones become assets: privileged = an admin count, a critical or tier 0/1 AD group (Domain Admins, Enterprise Admins ...), an assigned role, a service account, a sensitive account or a Microsoft criticality level. The others are counted and get no asset.",
|        "whenOn": "a never-synced on-premises AD account becomes an asset only while it is enabled or privileged",
|        "whenOff": "Stages: the identity collection records no asset for a never-synced AD account that is disabled and not privileged; the run log and the Data health page show how many per run; the CI build retires the existing CI of such an account at once, with a reason naming this setting (its findings close as asset retired, never as fixed). Disabled = the account says so itself (accountEnabled false, or the disabled flag of userAccountControl); an account that does not say is kept. Accounts synced to Entra ID, groups, devices and findings are not affected. Off again, the next run records them again and their CIs come back.",
|        "risk": "Objects the customer chose not to keep stop being assets from the next run and their CIs retire (CMDB / ServiceNow closures follow the retired CIs). Accounts synced to Entra ID, groups, devices and findings are not affected. Reversible: turn it off and the next run records them again and their CIs come back.",
|        "requires": "The identity collection with the Exposure Graph (Defender XDR advanced hunting).",
|        "default": "On: a never-synced on-premises AD account becomes an asset only while it is enabled or privileged",
|        "recommended": "On (the default). Off only when your organisation wants these objects as assets.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_SkipNeverSyncedDisabledAd/",
|        "confirmWhen": "on",
|        "confirm": "On-premises AD accounts the Exposure Graph lists that were never synced to Entra ID, are disabled and are not privileged stop being assets from the next run; their existing CIs retire at once with this setting as the reason, and their findings close as asset retired."
|      }
|    },
|    {
|      "name": "SI_Identity_TableName",
|      "label": "Identity table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The standard table, SI_Identity_Profile_CL",
|      "description": "Overrides the Log Analytics table the identity profiling engine writes to; when empty, the standard SI_Identity_Profile table is used.",
|      "purpose": "The Log Analytics table the identity engine writes its rows to.",
|      "effect": "Rows go to the named table instead. Reports, queries and dashboards that read the standard table then no longer see new identity data.",
|      "whenToChange": "Only if you renamed the destination table.",
|      "info": {
|        "what": "The Log Analytics table the identity engine writes its rows to.",
|        "whenChanged": "Rows go to the named table instead. Reports, queries and dashboards that read the standard table then no longer see new identity data.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "The standard table, SI_Identity_Profile_CL",
|        "recommended": "Keep the default. Change it when: Only if you renamed the destination table.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_TableName/"
|      }
|    },
|    {
|      "name": "SI_IncludeFirstPartySpns",
|      "label": "Include Microsoft service principals",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On: Microsoft service principals are included.",
|      "description": "Include 1st-party Microsoft service principals in discovery. Default $true (preview.87+; was opt-in in earlier previews -- noisier but more complete).",
|      "purpose": "Whether the identity engine includes Microsoft's own built-in service principals in its inventory.",
|      "effect": "Turning it off drops the hundreds of Microsoft-published service principals, giving a smaller, less noisy inventory, but privileged ones among them are no longer reported.",
|      "whenToChange": "Turn off if Microsoft service principals add noise you do not want in reports.",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Whether the identity engine includes Microsoft's own built-in service principals in its inventory.",
|        "whenOn": "Microsoft service principals are included.",
|        "whenOff": "Turning it off drops the hundreds of Microsoft-published service principals, giving a smaller, less noisy inventory, but privileged ones among them are no longer reported.",
|        "risk": "Microsoft-published service principals are left out -- including privileged ones, whose exposure then disappears from the reports. Reversible: the next run includes them again.",
|        "requires": "Nothing else.",
|        "default": "On: Microsoft service principals are included.",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_IncludeFirstPartySpns/",
|        "confirmWhen": "off",
|        "confirm": "Turning it off drops the hundreds of Microsoft-published service principals, giving a smaller, less noisy inventory, but privileged ones among them are no longer reported. Microsoft-published service principals are left out -- including privileged ones, whose exposure then disappears from the reports. Reversible: the next run includes them again."
|      }
|    },
|    {
|      "name": "SI_IncludeInactive_Endpoint",
|      "label": "Include inactive endpoints",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: devices not seen by any source within the stale-days window are left out",
|      "description": "--- Asset filters: these DROP ROWS from the output ------------------------ The engine filters inactive/stale assets by default and reports how many it dropped. These change that decision.",
|      "purpose": "Turns off the filter that leaves out stale or offboarded devices, so every known device is published.",
|      "effect": "On publishes every device, including stale registrations and offboarded machines: more rows, more ingested data, and more noise in reports. Useful when cleaning up stale devices.",
|      "whenToChange": "When you want to find and clean up stale or ghost devices.",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Turns off the filter that leaves out stale or offboarded devices, so every known device is published.",
|        "whenOn": "On publishes every device, including stale registrations and offboarded machines: more rows, more ingested data, and more noise in reports. Useful when cleaning up stale devices.",
|        "whenOff": "devices not seen by any source within the stale-days window are left out",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "Off: devices not seen by any source within the stale-days window are left out",
|        "recommended": "Keep the default. Change it when: When you want to find and clean up stale or ghost devices.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_IncludeInactive_Endpoint/"
|      }
|    },
|    {
|      "name": "SI_IncludeInactive_Identity",
|      "label": "Include inactive identities",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: only Microsoft apps this tenant granted nothing are left out",
|      "description": "also publish Microsoft apps granted nothing",
|      "purpose": "Turns off the one identity filter left: Microsoft-published applications this tenant granted nothing. Every user (disabled accounts and guests too) and every service principal and managed identity the tenant owns is always published.",
|      "effect": "On publishes the Microsoft-published applications too (hundreds in most tenants): more rows, more ingested data, and more noise in reports.",
|      "whenToChange": "When you need a complete identity inventory, for example for an audit.",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Turns off the one identity filter left: Microsoft-published applications this tenant granted nothing. Every user (disabled accounts and guests too) and every service principal and managed identity the tenant owns is always published.",
|        "whenOn": "On publishes the Microsoft-published applications too (hundreds in most tenants): more rows, more ingested data, and more noise in reports.",
|        "whenOff": "only Microsoft apps this tenant granted nothing are left out",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "Off: only Microsoft apps this tenant granted nothing are left out",
|        "recommended": "Keep the default. Change it when: When you need a complete identity inventory, for example for an audit.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_IncludeInactive_Identity/"
|      }
|    },
|    {
|      "name": "SI_InternetExposedRanges",
|      "label": "Internet-exposed network ranges",
|      "group": "Risk Analysis reports",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "None: only what Defender, Exposure Graph, Azure and Shodan report counts as exposure.",
|      "description": "Address ranges that are internet-facing by design (DMZ, online landing zones), as CIDRs or addresses: an asset with an address in them gets the 'Internet exposed' risk factor, whatever the providers say (added to the internet_exposed_ranges list of data-model\\lists.locked.json; lists.custom.json works too). Default: none.",
|      "purpose": "Address ranges that are reachable from the internet by design, such as a DMZ or an online landing zone. An asset with an address in them counts as internet exposed in the risk score.",
|      "effect": "Assets with an address in these ranges get the Internet exposed risk factor, which adds its impact (default 4) to the asset side of their findings' risk score.",
|      "whenToChange": "When you have network segments that face the internet that the providers do not flag, for example a DMZ behind a firewall NAT.",
|      "card": "Internet exposure",
|      "info": {
|        "what": "Address ranges that are reachable from the internet by design, such as a DMZ or an online landing zone. An asset with an address in them counts as internet exposed in the risk score.",
|        "whenChanged": "Assets with an address in these ranges get the Internet exposed risk factor, which adds its impact (default 4) to the asset side of their findings' risk score.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "None: only what Defender, Exposure Graph, Azure and Shodan report counts as exposure.",
|        "recommended": "Keep the default. Change it when: When you have network segments that face the internet that the providers do not flag, for example a DMZ behind a firewall NAT.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_InternetExposedRanges/"
|      }
|    },
|    {
|      "name": "SI_InvardiaUpdate_Enabled",
|      "label": "Pro updates from Invardia",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "SecurityInsight Pro: the updater job checks Invardia every night for a release approved for this install's ring and applies it (signed, verified, restored on failure). On by default; $false never checks or applies anything.",
|      "purpose": "Whether SecurityInsight Pro takes its updates from Invardia by itself. Every night the updater job asks Invardia for the release approved for this installation's ring, checks its signature and contents, and applies it; if anything fails the previous version is restored. A release that needs a manual step first, or a newer version than this installation can move to directly, is held and shown on this page.",
|      "effect": "Off: the updater job never asks Invardia for updates and applies nothing; the Settings page and the job's log say that Pro updates from Invardia are off. The installation stays on its current version until you turn it on again.",
|      "whenToChange": "Turn it off only to hold an installation on its current version for a while, for example during an audit or a change freeze; turn it on again afterwards.",
|      "card": "Licence and updates",
|      "info": {
|        "what": "Whether SecurityInsight Pro takes its updates from Invardia by itself. Every night the updater job asks Invardia for the release approved for this installation's ring, checks its signature and contents, and applies it; if anything fails the previous version is restored. A release that needs a manual step first, or a newer version than this installation can move to directly, is held and shown on this page.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "the updater job never asks Invardia for updates and applies nothing; the Settings page and the job's log say that Pro updates from Invardia are off. The installation stays on its current version until you turn it on again.",
|        "risk": "No updates are applied any more -- including security fixes -- until it is turned on again. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "On",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_InvardiaUpdate_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the updater job never asks Invardia for updates and applies nothing; the Settings page and the job's log say that Pro updates from Invardia are off. The installation stays on its current version until you turn it on again. No updates are applied any more -- including security fixes -- until it is turned on again. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_InvardiaUpdate_HoldMicrosoftContent",
|      "label": "Hold template packs",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: template packs are installed automatically",
|      "description": "SecurityInsight Pro: template packs (new Microsoft content and template updates between releases) wait on Template releases for a manual Install instead of being installed automatically by the updater job. Off by default.",
|      "purpose": "Whether new template packs wait for you. Between releases SecurityInsight ships template packs: reports and rules for data that Microsoft added to Defender and the Exposure Graph, such as a new attack-path type, and updates to the templates SecurityInsight ships. Normally the updater job installs them by itself once your installation runs the SecurityInsight version a pack needs; your own changes are never overwritten by a pack.",
|      "effect": "On: a template pack is kept on the Template releases page, with what it changes, until you select Install there. Off: it is installed automatically the next time the updater job runs. Your own changes to templates are never touched either way, and an installed pack can be rolled back on Template releases.",
|      "whenToChange": "Turn it on when every change to what SecurityInsight reports must be reviewed first, for example during a change freeze or an audit.",
|      "card": "Licence and updates",
|      "info": {
|        "what": "Whether new template packs wait for you. Between releases SecurityInsight ships template packs: reports and rules for data that Microsoft added to Defender and the Exposure Graph, such as a new attack-path type, and updates to the templates SecurityInsight ships. Normally the updater job installs them by itself once your installation runs the SecurityInsight version a pack needs; your own changes are never overwritten by a pack.",
|        "whenOn": "a template pack is kept on the Template releases page, with what it changes, until you select Install there.",
|        "whenOff": "it is installed automatically the next time the updater job runs. Your own changes to templates are never touched either way, and an installed pack can be rolled back on Template releases.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off: template packs are installed automatically",
|        "recommended": "Keep the default. Change it when: Turn it on when every change to what SecurityInsight reports must be reviewed first, for example during a change freeze or an audit.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_InvardiaUpdate_HoldMicrosoftContent/"
|      }
|    },
|    {
|      "name": "SI_KeyFigures_CveAgeBands",
|      "label": "Key figures: age bands of open CVE findings (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30,60,90",
|      "description": "The key figures' age bands of open CVE findings (\"older than N days\"), one band per number, comma-separated. Default '30,60,90'.",
|      "purpose": "The bands of the key figures' table \"Age of open CVE findings\": one row \"older than N days\" per number, separated by commas.",
|      "effect": "The next data sync counts the open CVE findings first detected more than each number of days before the collection. Whole numbers 1 to 3650; a list with none = the default.",
|      "whenToChange": "Your patch policy has other milestones (for example 14,30,90).",
|      "unit": "days",
|      "card": "Key figure windows",
|      "info": {
|        "what": "The bands of the key figures' table \"Age of open CVE findings\": one row \"older than N days\" per number, separated by commas.",
|        "whenChanged": "The next data sync counts the open CVE findings first detected more than each number of days before the collection. Whole numbers 1 to 3650; a list with none = the default.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "30,60,90",
|        "recommended": "Keep the default. Change it when: Your patch policy has other milestones (for example 14,30,90).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_KeyFigures_CveAgeBands/"
|      }
|    },
|    {
|      "name": "SI_KeyFigures_MeanTimeToFixDays",
|      "label": "Key figures: mean time to fix over the last (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "90 days",
|      "description": "The key figures' mean time to fix is worked out over the vulnerabilities fixed in the last N days (default 90).",
|      "purpose": "Which fixed vulnerabilities the key figure \"Mean time to fix\" averages: those remediated within this many days before the collection.",
|      "effect": "The next data sync averages the days from first detection to remediation of the CVE findings remediated in this window; the label says the number in force.",
|      "whenToChange": "A longer window gives a steadier number, a shorter one shows a recent change sooner.",
|      "unit": "days",
|      "min": 1,
|      "max": 3650,
|      "card": "Key figure windows",
|      "info": {
|        "what": "Which fixed vulnerabilities the key figure \"Mean time to fix\" averages: those remediated within this many days before the collection.",
|        "whenChanged": "The next data sync averages the days from first detection to remediation of the CVE findings remediated in this window; the label says the number in force.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "90 days",
|        "recommended": "Keep the default. Change it when: A longer window gives a steadier number, a shorter one shows a recent change sooner.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_KeyFigures_MeanTimeToFixDays/"
|      }
|    },
|    {
|      "name": "SI_KeyFigures_RecentDays",
|      "label": "Key figures: opened / fixed in the last (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days",
|      "description": "The key figures' windows (the Executive overview, report and management mail; every window a figure counts over is a setting -- #859). \"Vulnerabilities opened / fixed in the last N days\", in days (default 30).",
|      "purpose": "The window of the key figures \"Vulnerabilities opened in the last N days\" and \"Vulnerabilities fixed in the last N days\" (the Executive overview, the Executive report and the management mail).",
|      "effect": "The next data sync counts the CVE findings first detected, and the CVE findings remediated, within this many days before the collection; the labels say the number in force. Collections already figured keep the window they were worked out with; an update works the newest ones out again.",
|      "whenToChange": "Your management reports per quarter or per sprint (for example 90 or 14).",
|      "unit": "days",
|      "min": 1,
|      "max": 3650,
|      "card": "Key figure windows",
|      "info": {
|        "what": "The window of the key figures \"Vulnerabilities opened in the last N days\" and \"Vulnerabilities fixed in the last N days\" (the Executive overview, the Executive report and the management mail).",
|        "whenChanged": "The next data sync counts the CVE findings first detected, and the CVE findings remediated, within this many days before the collection; the labels say the number in force. Collections already figured keep the window they were worked out with; an update works the newest ones out again.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "30 days",
|        "recommended": "Keep the default. Change it when: Your management reports per quarter or per sprint (for example 90 or 14).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_KeyFigures_RecentDays/"
|      }
|    },
|    {
|      "name": "SI_KeyFigures_StaleAdminDays",
|      "label": "Key figures: privileged accounts without a sign-in for (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "90 days",
|      "description": "The key figures' \"privileged accounts without a sign-in for N days\", in days (default 90).",
|      "purpose": "When the key figure \"Privileged accounts without a sign-in for N days\" counts an enabled, active privileged account: its last sign-in is longer ago than this.",
|      "effect": "The next data sync counts the privileged accounts whose last sign-in (Entra ID sign-in activity) is older than this many days before the collection; the label says the number in force.",
|      "whenToChange": "Your access review calls an admin account stale sooner (for example 30 or 45 days).",
|      "unit": "days",
|      "min": 1,
|      "max": 3650,
|      "card": "Key figure windows",
|      "info": {
|        "what": "When the key figure \"Privileged accounts without a sign-in for N days\" counts an enabled, active privileged account: its last sign-in is longer ago than this.",
|        "whenChanged": "The next data sync counts the privileged accounts whose last sign-in (Entra ID sign-in activity) is older than this many days before the collection; the label says the number in force.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "90 days",
|        "recommended": "Keep the default. Change it when: Your access review calls an admin account stale sooner (for example 30 or 45 days).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_KeyFigures_StaleAdminDays/"
|      }
|    },
|    {
|      "name": "SI_KeyVaultName",
|      "label": "Key Vault name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Falls back to SpnKeyVaultName; with neither set, secret reads stop with an error",
|      "description": "--- Key Vault + licence ----------------------------------------------------- The ONE Key Vault SecurityInsight reads secrets from (the SPN secret, integration credentials, a Pro licence). Setup writes it. $global:SpnKeyVaultName is still accepted on installs that predate this name.",
|      "purpose": "The one Key Vault SecurityInsight reads its secrets from: the sign-in secret, integration credentials and a Pro licence.",
|      "effect": "All secrets are read from the named vault. A wrong name means sign-in secrets, keys and the licence cannot be read and runs fail or run as Community.",
|      "whenToChange": "Setup writes it. Change only if you move secrets to another Key Vault.",
|      "card": "How SecurityInsight signs in",
|      "info": {
|        "what": "The one Key Vault SecurityInsight reads its secrets from: the sign-in secret, integration credentials and a Pro licence.",
|        "whenChanged": "All secrets are read from the named vault. A wrong name means sign-in secrets, keys and the licence cannot be read and runs fail or run as Community.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Falls back to SpnKeyVaultName; with neither set, secret reads stop with an error",
|        "recommended": "Keep the default. Change it when: Setup writes it. Change only if you move secrets to another Key Vault.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_KeyVaultName/"
|      }
|    },
|    {
|      "name": "SI_KvMiClientId",
|      "label": "Key Vault managed identity (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Uses SI_ManagedIdentityClientId; otherwise the machine's own system managed identity",
|      "description": "Key Vault reads by a user-assigned managed identity (default: the machine's system identity / the SPN).",
|      "purpose": "The client id of a user-assigned managed identity used to read Key Vault when no Azure sign-in exists yet. Older name for SI_ManagedIdentityClientId.",
|      "effect": "Key Vault reads sign in as this user-assigned identity. It is ignored when SI_ManagedIdentityClientId is set, or when an Azure sign-in already exists.",
|      "whenToChange": "Only on older configurations that use a user-assigned identity; new installs use SI_ManagedIdentityClientId.",
|      "info": {
|        "what": "The client id of a user-assigned managed identity used to read Key Vault when no Azure sign-in exists yet. Older name for SI_ManagedIdentityClientId.",
|        "whenChanged": "Key Vault reads sign in as this user-assigned identity. It is ignored when SI_ManagedIdentityClientId is set, or when an Azure sign-in already exists.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Uses SI_ManagedIdentityClientId; otherwise the machine's own system managed identity",
|        "recommended": "Keep the default. Change it when: Only on older configurations that use a user-assigned identity; new installs use SI_ManagedIdentityClientId.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_KvMiClientId/"
|      }
|    },
|    {
|      "name": "SI_LaExport",
|      "label": "Copy records to Log Analytics",
|      "group": "Data & retention",
|      "type": "enum",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "off: the records are kept only in the database",
|      "description": "--- Optional copy of the provider records to Log Analytics --- The records live in the database (correlation and the CI build run in SQL only). 'records' also posts them to SI_Record_CL (+ SI_RecordRaw_CL for raw data) for Azure Monitor or workbooks -- a one-way copy; it costs ingestion.",
|      "purpose": "Optionally copies the provider records (every object a collection reads, mapped to SI fields) to Log Analytics, for Azure Monitor or your own workbooks.",
|      "effect": "'records' also posts every record to SI_Record_CL (and, for the providers raw data is on for, the whole object to SI_RecordRaw_CL) on every collection run. This costs Log Analytics ingestion for every record, every run. It is a one-way copy: correlation, the CI build and the data sync read the records from the database only and never read this copy back. The CIs (SI_CI_CL) are in Log Analytics in every install, because Risk Analysis reads them there, so they need no setting; the findings per CI are copied there only when Copy findings per CI to Log Analytics (SI_Finding_CL) is on.",
|      "whenToChange": "Only when you build your own Azure Monitor alerts or workbooks on the raw provider records; leave off otherwise.",
|      "values": [
|        "off",
|        "records"
|      ],
|      "valueLabels": {
|        "off": "Off: records in the database only",
|        "records": "Records: also copy them to Log Analytics"
|      },
|      "card": "Where collected data goes",
|      "hint": "Off = records in the database only. Records = also a copy in Log Analytics (costs ingestion).",
|      "info": {
|        "what": "Optionally copies the provider records (every object a collection reads, mapped to SI fields) to Log Analytics, for Azure Monitor or your own workbooks.",
|        "whenChanged": "'records' also posts every record to SI_Record_CL (and, for the providers raw data is on for, the whole object to SI_RecordRaw_CL) on every collection run. This costs Log Analytics ingestion for every record, every run. It is a one-way copy: correlation, the CI build and the data sync read the records from the database only and never read this copy back. The CIs (SI_CI_CL) are in Log Analytics in every install, because Risk Analysis reads them there, so they need no setting; the findings per CI are copied there only when Copy findings per CI to Log Analytics (SI_Finding_CL) is on.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "Nothing else.",
|        "default": "off: the records are kept only in the database",
|        "recommended": "Keep the default. Change it when: Only when you build your own Azure Monitor alerts or workbooks on the raw provider records; leave off otherwise.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LaExport/"
|      }
|    },
|    {
|      "name": "SI_LAQueryMaxRetries",
|      "label": "Log Analytics query retries",
|      "group": "Advanced / diagnostics",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "3 attempts (1, 3 and 7 seconds apart)",
|      "description": "--- Retries and query bucketing (RA) --------------------------------------",
|      "purpose": "How many attempts the asset engines make for a Log Analytics query that fails with a temporary error.",
|      "effect": "More attempts ride out brief workspace errors at the cost of a slightly longer run; fewer (minimum 1) fails faster and may drop the affected data from the run.",
|      "whenToChange": "Most installs never should. Raise it if runs log intermittent Log Analytics query failures.",
|      "unit": "attempts",
|      "info": {
|        "what": "How many attempts the asset engines make for a Log Analytics query that fails with a temporary error.",
|        "whenChanged": "More attempts ride out brief workspace errors at the cost of a slightly longer run; fewer (minimum 1) fails faster and may drop the affected data from the run.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "3 attempts (1, 3 and 7 seconds apart)",
|        "recommended": "Keep the default. Change it when: Most installs never should. Raise it if runs log intermittent Log Analytics query failures.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LAQueryMaxRetries/"
|      }
|    },
|    {
|      "name": "SI_LicenseRequest_Auto",
|      "label": "Automatic licence request",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "SecurityInsight Pro: the updater job asks Invardia for the licence by itself every night when there is none, it ends within 30 days or it is in its grace period, installs it and mails the result. On by default; $false never asks.",
|      "purpose": "Whether SecurityInsight Pro asks Invardia for its licence by itself. Every night the updater job checks the licence; when there is none, it ends within 30 days, or it is in its grace period, the job asks Invardia for one, checks the licence it gets and installs it. The result is written to the audit trail and mailed to you. While the licence is valid nothing is asked.",
|      "effect": "Off: Invardia is never asked for a licence by the updater job, and the Settings page and the job's log say that the automatic licence request is off. A licence then has to be requested by hand (setup\\Request-SILicense.ps1) or installed by hand before the current one ends.",
|      "whenToChange": "Turn it off only if your organisation does not allow the installation to contact Invardia by itself; then renew the licence by hand.",
|      "card": "Licence and updates",
|      "info": {
|        "what": "Whether SecurityInsight Pro asks Invardia for its licence by itself. Every night the updater job checks the licence; when there is none, it ends within 30 days, or it is in its grace period, the job asks Invardia for one, checks the licence it gets and installs it. The result is written to the audit trail and mailed to you. While the licence is valid nothing is asked.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Invardia is never asked for a licence by the updater job, and the Settings page and the job's log say that the automatic licence request is off. A licence then has to be requested by hand (setup\\Request-SILicense.ps1) or installed by hand before the current one ends.",
|        "risk": "The licence is not renewed automatically: when it expires, Pro features stop until a licence is installed by hand. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "On",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LicenseRequest_Auto/",
|        "confirmWhen": "off",
|        "confirm": "Invardia is never asked for a licence by the updater job, and the Settings page and the job's log say that the automatic licence request is off. A licence then has to be requested by hand (setup\\Request-SILicense.ps1) or installed by hand before the current one ends. The licence is not renewed automatically: when it expires, Pro features stop until a licence is installed by hand. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_LicenseRequest_BaseUrl",
|      "label": "Licence service address",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "https://invardia.com",
|      "description": "SecurityInsight Pro: the licence is read from the Key Vault secret 'SI-License' (setup\\Set-SILicense.ps1 installs it). Without one the install runs the Community edition -- complete on its own; Pro components print one line. The Pro updater job asks Invardia for the licence itself, and renews it before it ends (setup\\Request-SILicense.ps1 does the same by hand). Where Invardia's licence service is (https only; default https://invardia.com).",
|      "purpose": "The address of the licence service that a manual licence request contacts. Must be an https address.",
|      "effect": "Licence requests go to this address instead. A wrong address means licences cannot be requested or renewed by hand. The updater job uses its own environment setting.",
|      "whenToChange": "Practically never; only if the licence service tells you to use another address.",
|      "info": {
|        "what": "The address of the licence service that a manual licence request contacts. Must be an https address.",
|        "whenChanged": "Licence requests go to this address instead. A wrong address means licences cannot be requested or renewed by hand. The updater job uses its own environment setting.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "https://invardia.com",
|        "recommended": "Keep the default. Change it when: Practically never; only if the licence service tells you to use another address.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LicenseRequest_BaseUrl/"
|      }
|    },
|    {
|      "name": "SI_LicenseRequest_ContactEmail",
|      "label": "Licence contact e-mail",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: no contact address is sent with the request",
|      "description": "Who Invardia may contact about a licence request. Sent only when set.",
|      "purpose": "The email address the licence provider may use to contact you about a manual licence request.",
|      "effect": "When set, the address is sent with the licence request so the provider can reach you about it. It changes nothing else.",
|      "whenToChange": "Set it if you want to be contacted about your licence requests.",
|      "card": "Licence and updates",
|      "info": {
|        "what": "The email address the licence provider may use to contact you about a manual licence request.",
|        "whenChanged": "When set, the address is sent with the licence request so the provider can reach you about it. It changes nothing else.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Not set: no contact address is sent with the request",
|        "recommended": "Keep the default. Change it when: Set it if you want to be contacted about your licence requests.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LicenseRequest_ContactEmail/"
|      }
|    },
|    {
|      "name": "SI_LicenseRequest_Edition",
|      "label": "Licence request edition",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: no edition is named in the request",
|      "description": "The edition asked for in a licence request (optional; Invardia's owner decides). Sent only when set.",
|      "purpose": "The edition you ask for when requesting a licence by hand. The licence provider decides what is granted.",
|      "effect": "The named edition is included in the request as a wish; the licence issued is decided by the provider.",
|      "whenToChange": "Only when asked to name an edition in your licence request.",
|      "setupOnly": true,
|      "info": {
|        "what": "The edition you ask for when requesting a licence by hand. The licence provider decides what is granted.",
|        "whenChanged": "The named edition is included in the request as a wish; the licence issued is decided by the provider.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Not set: no edition is named in the request",
|        "recommended": "Keep the default. Change it when: Only when asked to name an edition in your licence request.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LicenseRequest_Edition/"
|      }
|    },
|    {
|      "name": "SI_LoadPendingRules",
|      "label": "Use AI-proposed draft rules",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: only shipped and your own custom rules are used.",
|      "description": "Auto-load AI-proposed pending rules into the live engine. Default OFF (drafts must be reviewed + promoted via human PR first).",
|      "purpose": "Lets the profiling engines also load draft posture rules proposed by schema discovery, before anyone has reviewed them.",
|      "effect": "When on, unreviewed AI-drafted rules also affect findings and tiers. This can add useful detections but also wrong or noisy results.",
|      "whenToChange": "Only for testing drafts in a lab; normally review and promote drafts instead.",
|      "info": {
|        "what": "Lets the profiling engines also load draft posture rules proposed by schema discovery, before anyone has reviewed them.",
|        "whenOn": "When on, unreviewed AI-drafted rules also affect findings and tiers. This can add useful detections but also wrong or noisy results.",
|        "whenOff": "only shipped and your own custom rules are used.",
|        "risk": "Unreviewed, AI-drafted rules change tiers and findings: wrong tiers or noisy findings can follow. Reversible: turn it off; the next run uses reviewed rules only.",
|        "requires": "Nothing else.",
|        "default": "Off: only shipped and your own custom rules are used.",
|        "recommended": "Off; review pending rules and approve the good ones instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LoadPendingRules/",
|        "confirmWhen": "on",
|        "confirm": "When on, unreviewed AI-drafted rules also affect findings and tiers. This can add useful detections but also wrong or noisy results. Unreviewed, AI-drafted rules change tiers and findings: wrong tiers or noisy findings can follow. Reversible: turn it off; the next run uses reviewed rules only."
|      }
|    },
|    {
|      "name": "SI_Location",
|      "label": "Azure region",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: setup asks for the region; a collection run does not use it",
|      "description": "Region override (used during workspace/DCE/DCR creation when missing).",
|      "purpose": "The Azure region setup creates the workspace, endpoint, storage and container resources in. A collection run creates no Azure resource, so it does not need it.",
|      "effect": "Decides where setup creates new resources. Existing resources are not moved. Risk Analysis falls back to Location, then westeurope.",
|      "whenToChange": "Set once at install to your preferred region.",
|      "card": "Log Analytics",
|      "info": {
|        "what": "The Azure region setup creates the workspace, endpoint, storage and container resources in. A collection run creates no Azure resource, so it does not need it.",
|        "whenChanged": "Decides where setup creates new resources. Existing resources are not moved. Risk Analysis falls back to Location, then westeurope.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Not set: setup asks for the region; a collection run does not use it",
|        "recommended": "Keep the default. Change it when: Set once at install to your preferred region.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Location/"
|      }
|    },
|    {
|      "name": "SI_LogIngest_AppId",
|      "label": "Ingestion app id (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_SPN_AppId is used",
|      "description": "Older name for the app id used to ingest data into Log Analytics; used only when SI_SPN_AppId is not set.",
|      "purpose": "Older name for the app id used to send data to Log Analytics; used only when SI_SPN_AppId is not set.",
|      "effect": "Only matters when SI_SPN_AppId is empty; then data ingestion signs in with this app.",
|      "whenToChange": "Never on new installs; use SI_SPN_AppId instead.",
|      "info": {
|        "what": "Older name for the app id used to send data to Log Analytics; used only when SI_SPN_AppId is not set.",
|        "whenChanged": "Only matters when SI_SPN_AppId is empty; then data ingestion signs in with this app.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: SI_SPN_AppId is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; use SI_SPN_AppId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LogIngest_AppId/"
|      }
|    },
|    {
|      "name": "SI_LogIngest_ObjectId",
|      "label": "Ingestion object id (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_SPN_ObjectId is used",
|      "description": "Older name for the object id of the ingesting service principal, used to grant it rights on data collection rules; used only when SI_SPN_ObjectId is not set.",
|      "purpose": "Older name for the object id of the ingesting service principal, used to grant it rights on data collection rules; used when SI_SPN_ObjectId is not set.",
|      "effect": "Used only when SI_SPN_ObjectId is empty: every output path that grants ingest rights on a data collection rule takes SI_SPN_ObjectId first and this name second.",
|      "whenToChange": "Never on new installs; set SI_SPN_ObjectId instead.",
|      "info": {
|        "what": "Older name for the object id of the ingesting service principal, used to grant it rights on data collection rules; used when SI_SPN_ObjectId is not set.",
|        "whenChanged": "Used only when SI_SPN_ObjectId is empty: every output path that grants ingest rights on a data collection rule takes SI_SPN_ObjectId first and this name second.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: SI_SPN_ObjectId is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_SPN_ObjectId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LogIngest_ObjectId/"
|      }
|    },
|    {
|      "name": "SI_LogIngest_Secret",
|      "label": "Ingestion secret (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": true,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_SPN_Secret is used",
|      "description": "Older name for the client secret used to ingest data into Log Analytics; used only when SI_SPN_Secret is not set.",
|      "purpose": "Older name for the client secret used to send data to Log Analytics; used only when SI_SPN_Secret is not set.",
|      "effect": "Only matters when SI_SPN_Secret is empty; then data ingestion signs in with this secret.",
|      "whenToChange": "Never on new installs; use SI_SPN_Secret, a certificate or managed identity.",
|      "info": {
|        "what": "Older name for the client secret used to send data to Log Analytics; used only when SI_SPN_Secret is not set.",
|        "whenChanged": "Only matters when SI_SPN_Secret is empty; then data ingestion signs in with this secret.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault.",
|        "default": "Not set: SI_SPN_Secret is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; use SI_SPN_Secret, a certificate or managed identity.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LogIngest_Secret/"
|      }
|    },
|    {
|      "name": "SI_LogIngest_TenantId",
|      "label": "Ingestion tenant id (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_SPN_TenantId is used",
|      "description": "Older name for the Entra tenant id used to ingest data into Log Analytics; used only when SI_SPN_TenantId is not set.",
|      "purpose": "Older name for the Entra tenant id used to send data to Log Analytics; used only when SI_SPN_TenantId is not set.",
|      "effect": "Only matters when SI_SPN_TenantId is empty; then data ingestion signs in to this tenant.",
|      "whenToChange": "Never on new installs; use SI_SPN_TenantId instead.",
|      "info": {
|        "what": "Older name for the Entra tenant id used to send data to Log Analytics; used only when SI_SPN_TenantId is not set.",
|        "whenChanged": "Only matters when SI_SPN_TenantId is empty; then data ingestion signs in to this tenant.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: SI_SPN_TenantId is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; use SI_SPN_TenantId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LogIngest_TenantId/"
|      }
|    },
|    {
|      "name": "SI_LogRetentionDays",
|      "label": "Run log retention",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days.",
|      "description": "Days to keep launcher transcripts before pruning. Default 30.",
|      "purpose": "How many days run logs are kept, both on the local disk and in the storage account, before being deleted.",
|      "effect": "Longer keeps more history for investigating past runs, using more disk and storage space. Shorter frees space but older runs can no longer be checked.",
|      "whenToChange": "When your audit or troubleshooting needs require a longer or shorter history.",
|      "unit": "days",
|      "card": "How long data is kept",
|      "info": {
|        "what": "How many days run logs are kept, both on the local disk and in the storage account, before being deleted.",
|        "whenChanged": "Longer keeps more history for investigating past runs, using more disk and storage space. Shorter frees space but older runs can no longer be checked.",
|        "risk": "A shorter value deletes older run logs: past runs can no longer be investigated. Cannot be undone.",
|        "requires": "Nothing else.",
|        "default": "30 days.",
|        "recommended": "30 days.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LogRetentionDays/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter value deletes older run logs: past runs can no longer be investigated. Cannot be undone."
|      }
|    },
|    {
|      "name": "SI_Mail_From",
|      "label": "Shared mailbox (sender)",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: with a shared mailbox nothing is sent; with SMTP the older sender setting is used",
|      "description": "The shared mailbox SecurityInsight sends as (also the From address for smtp).",
|      "purpose": "The shared mailbox SecurityInsight sends as. With an SMTP relay it is the From address (and wins over the older sender settings).",
|      "effect": "Mail comes from this address. With a shared mailbox, Exchange must allow SecurityInsight's identity to send as it (and only as it).",
|      "whenToChange": "Set when you set up mail, or when the mailbox changes.",
|      "card": "Mail",
|      "info": {
|        "what": "The shared mailbox SecurityInsight sends as. With an SMTP relay it is the From address (and wins over the older sender settings).",
|        "whenChanged": "Mail comes from this address. With a shared mailbox, Exchange must allow SecurityInsight's identity to send as it (and only as it).",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Nothing else.",
|        "default": "Not set: with a shared mailbox nothing is sent; with SMTP the older sender setting is used",
|        "recommended": "Keep the default. Change it when: Set when you set up mail, or when the mailbox changes.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Mail_From/"
|      }
|    },
|    {
|      "name": "SI_Mail_Mode",
|      "label": "How mail is sent",
|      "group": "Mail & notifications",
|      "type": "enum",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: your SMTP relay when a mail server is set, else no mail",
|      "description": "--- MAIL: how SecurityInsight sends every mail (MAIL-1) --- sharedMailbox (recommended): an Office 365 shared mailbox, through Microsoft Graph as SecurityInsight's own identity; Mail.Send is granted in Exchange only, scoped to that mailbox (setup\\Set-SIMail.ps1 sets it up). smtp: your own SMTP relay (the settings below). none: no mail. Not set: smtp when SmtpServer is set, else none.",
|      "purpose": "How SecurityInsight sends every mail: sharedMailbox = an Office 365 shared mailbox through Microsoft Graph as SecurityInsight's own identity (recommended); smtp = your own SMTP relay; none = no mail.",
|      "effect": "Every mail (reports, safety-check alerts, close-loop, exemption, governance and digest mails, licence notices) goes this way. With sharedMailbox SecurityInsight sends only once it has verified that Mail.Send is restricted to the shared mailbox.",
|      "whenToChange": "Set up with Settings > E-mail > Set up mail, or setup\\Set-SIMail.ps1.",
|      "editor": "radio",
|      "values": [
|        "sharedMailbox",
|        "smtp",
|        "none"
|      ],
|      "valueLabels": {
|        "sharedMailbox": "Shared mailbox (Office 365) -- recommended",
|        "smtp": "SMTP relay (your own mail server)",
|        "none": "No mail"
|      },
|      "card": "Mail",
|      "hint": "The shared mailbox is recommended: no password to keep, and Exchange lets SecurityInsight send only as that one mailbox.",
|      "info": {
|        "what": "How SecurityInsight sends every mail: sharedMailbox = an Office 365 shared mailbox through Microsoft Graph as SecurityInsight's own identity (recommended); smtp = your own SMTP relay; none = no mail.",
|        "whenChanged": "Every mail (reports, safety-check alerts, close-loop, exemption, governance and digest mails, licence notices) goes this way. With sharedMailbox SecurityInsight sends only once it has verified that Mail.Send is restricted to the shared mailbox.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Nothing else.",
|        "default": "Not set: your SMTP relay when a mail server is set, else no mail",
|        "recommended": "Keep the default. Change it when: Set up with Settings > E-mail > Set up mail, or setup\\Set-SIMail.ps1.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Mail_Mode/"
|      }
|    },
|    {
|      "name": "SI_Mail_ProbeMailbox",
|      "label": "Mailbox to prove the restriction",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: the restriction counts as verified only when an Exchange administrator confirmed it",
|      "description": "A mailbox OUTSIDE the scope: SecurityInsight checks that it may NOT send as it before it sends anything.",
|      "purpose": "An ordinary mailbox OUTSIDE the shared mailbox's scope. Before it sends, SecurityInsight checks that it may NOT send as this mailbox -- which proves Mail.Send is restricted. Nothing is delivered by the check.",
|      "effect": "Without it (and without a confirmation) SecurityInsight does not send through the shared mailbox.",
|      "whenToChange": "Set once, to an administrator's own mailbox; setup fills it in.",
|      "card": "Mail",
|      "hint": "An e-mail address (name@domain) of a different, ordinary mailbox -- never the shared mailbox itself, and not a display name.",
|      "info": {
|        "what": "An ordinary mailbox OUTSIDE the shared mailbox's scope. Before it sends, SecurityInsight checks that it may NOT send as this mailbox -- which proves Mail.Send is restricted. Nothing is delivered by the check.",
|        "whenChanged": "Without it (and without a confirmation) SecurityInsight does not send through the shared mailbox.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Nothing else.",
|        "default": "Not set: the restriction counts as verified only when an Exchange administrator confirmed it",
|        "recommended": "Keep the default. Change it when: Set once, to an administrator's own mailbox; setup fills it in.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Mail_ProbeMailbox/"
|      }
|    },
|    {
|      "name": "SI_Mail_RestrictionAttestation",
|      "label": "Restriction confirmed by",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set",
|      "description": "When no such mailbox can be tested: who confirmed the restriction (Test-ServicePrincipalAuthorization), and when.",
|      "purpose": "Who confirmed that Mail.Send is restricted to the shared mailbox (Test-ServicePrincipalAuthorization), and when. Used only when no other mailbox can be tested.",
|      "effect": "Counts as verified when the check against another mailbox cannot run.",
|      "whenToChange": "Set by the mail setup, or after your Exchange administrator ran the check.",
|      "card": "Mail",
|      "info": {
|        "what": "Who confirmed that Mail.Send is restricted to the shared mailbox (Test-ServicePrincipalAuthorization), and when. Used only when no other mailbox can be tested.",
|        "whenChanged": "Counts as verified when the check against another mailbox cannot run.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Nothing else.",
|        "default": "Not set",
|        "recommended": "Keep the default. Change it when: Set by the mail setup, or after your Exchange administrator ran the check.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Mail_RestrictionAttestation/"
|      }
|    },
|    {
|      "name": "SI_Mail_SmtpKept",
|      "label": "Keep the SMTP relay (by choice)",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: SecurityInsight recommends moving to an Office 365 shared mailbox, and Home and Settings > E-mail show that hint",
|      "description": "Your own SMTP relay is kept by choice: the hint to move to a shared mailbox is no longer shown. Default $false.",
|      "purpose": "Says that your own SMTP relay is kept on purpose, so SecurityInsight stops suggesting the move to an Office 365 shared mailbox.",
|      "effect": "On: the SMTP relay is kept by choice -- the amber \"move to an Office 365 shared mailbox\" hint is hidden on Home and on Settings > E-mail, and mail shows as set up. A failed test mail is still shown in red. Mail is sent exactly as before.",
|      "whenToChange": "When you decide to keep your own SMTP relay; Ignore on the Home banner sets it, Undo on Settings > E-mail clears it.",
|      "card": "Mail",
|      "info": {
|        "what": "Says that your own SMTP relay is kept on purpose, so SecurityInsight stops suggesting the move to an Office 365 shared mailbox.",
|        "whenOn": "the SMTP relay is kept by choice -- the amber \"move to an Office 365 shared mailbox\" hint is hidden on Home and on Settings > E-mail, and mail shows as set up. A failed test mail is still shown in red. Mail is sent exactly as before.",
|        "whenOff": "SecurityInsight recommends moving to an Office 365 shared mailbox, and Home and Settings > E-mail show that hint",
|        "risk": "Low: only the advice to move to a shared mailbox is hidden; how mail is sent does not change, and a failed test mail still shows in red. Reversible at once (Undo on Settings > E-mail).",
|        "requires": "Nothing else.",
|        "default": "Off: SecurityInsight recommends moving to an Office 365 shared mailbox, and Home and Settings > E-mail show that hint",
|        "recommended": "Off, unless you keep your own SMTP relay on purpose.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Mail_SmtpKept/"
|      }
|    },
|    {
|      "name": "SI_ManagedIdentityClientId",
|      "label": "User-assigned managed identity",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Empty: the host's system-assigned identity",
|      "description": "empty = system-assigned",
|      "purpose": "Client id of a user-assigned managed identity to sign in with when the sign-in method is managed identity.",
|      "effect": "Selects which managed identity holds the permissions. A wrong client id makes sign-in fail; empty uses the Azure VM's or Arc server's own identity.",
|      "whenToChange": "Only when you sign in with a user-assigned identity instead of the host's system-assigned one.",
|      "card": "How SecurityInsight signs in",
|      "info": {
|        "what": "Client id of a user-assigned managed identity to sign in with when the sign-in method is managed identity.",
|        "whenChanged": "Selects which managed identity holds the permissions. A wrong client id makes sign-in fail; empty uses the Azure VM's or Arc server's own identity.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Empty: the host's system-assigned identity",
|        "recommended": "Keep the default. Change it when: Only when you sign in with a user-assigned identity instead of the host's system-assigned one.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ManagedIdentityClientId/"
|      }
|    },
|    {
|      "name": "SI_MaxMailAttachmentMB",
|      "label": "Largest mail attachment",
|      "group": "Mail & notifications",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "24 MB (fits a 25 MB mail server limit)",
|      "description": "Mail attachment budget in MB of MESSAGE, measured base64-ENCODED (attachments inflate ~37%, so a 20 MB file is ~27 MB on the wire). Over budget, the report is sent WITHOUT the attachment rather than the relay rejecting the whole mail.",
|      "purpose": "The largest Excel attachment, measured as encoded for mail, that a Risk Analysis mail carries; larger reports are mailed without the attachment.",
|      "effect": "Raising it lets bigger workbooks be attached, but above your mail server's limit the whole mail is rejected and nothing arrives. Lowering it is always safe.",
|      "whenToChange": "Raise only if your mail server accepts larger messages; lower if mails are rejected.",
|      "unit": "MB",
|      "card": "Risk Analysis report mails",
|      "hint": "A larger report is mailed without its Excel file.",
|      "info": {
|        "what": "The largest Excel attachment, measured as encoded for mail, that a Risk Analysis mail carries; larger reports are mailed without the attachment.",
|        "whenChanged": "Raising it lets bigger workbooks be attached, but above your mail server's limit the whole mail is rejected and nothing arrives. Lowering it is always safe.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Nothing else.",
|        "default": "24 MB (fits a 25 MB mail server limit)",
|        "recommended": "Keep the default. Change it when: Raise only if your mail server accepts larger messages; lower if mails are rejected.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_MaxMailAttachmentMB/"
|      }
|    },
|    {
|      "name": "SI_PatchCycle_CatchUpDays",
|      "label": "Patch cycle: catch-up after",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days.",
|      "description": "Patch cycle: a finding whose fix was released (or, without one dated update, that was first detected) more than this many days before the collection is Catch-up, else In monthly cycle (default 30; exactly 30 is still in the cycle).",
|      "purpose": "When a finding counts as catch-up instead of being fixed in the monthly patch cycle: its fix was released (the month a \"October 2026 Security Updates\" text names -> that month's Patch Tuesday), or -- without one dated update -- the finding was first detected, more than this many days before the collection.",
|      "effect": "The Patch cycle column of every finding (In monthly cycle / Catch-up / No fix available / Unknown) and its filter use this number from the next Risk Analysis run; findings already stored keep the value they were given.",
|      "whenToChange": "Match your patch policy: e.g. 45 when monthly patches are allowed six weeks.",
|      "unit": "days",
|      "min": 1,
|      "card": "Vulnerability (CVE) filters",
|      "info": {
|        "what": "When a finding counts as catch-up instead of being fixed in the monthly patch cycle: its fix was released (the month a \"October 2026 Security Updates\" text names -> that month's Patch Tuesday), or -- without one dated update -- the finding was first detected, more than this many days before the collection.",
|        "whenChanged": "The Patch cycle column of every finding (In monthly cycle / Catch-up / No fix available / Unknown) and its filter use this number from the next Risk Analysis run; findings already stored keep the value they were given.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "30 days.",
|        "recommended": "Keep the default. Change it when: Match your patch policy: e.g. 45 when monthly patches are allowed six weeks.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PatchCycle_CatchUpDays/"
|      }
|    },
|    {
|      "name": "SI_PatchCycle_MsrcDates",
|      "label": "Patch cycle: read Microsoft update release dates",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On.",
|      "description": "Patch cycle: read the release date of each Microsoft update (by its KB) from Microsoft's public Security Update Guide (https://api.msrc.microsoft.com, once a day, cached). Off: no call; the month the update's name says is used (default on).",
|      "purpose": "Reads the release date of each Microsoft update (by its KB number) from Microsoft's public Security Update Guide (api.msrc.microsoft.com, no sign-in), once a day, and keeps it in the install. Defender names the update and its KB but not when it was released.",
|      "effect": "On: a Microsoft fix's own release date decides In monthly cycle / Catch-up (an out-of-band update by its own date). Off: no call to api.msrc.microsoft.com; the month the update's name says (its Patch Tuesday) is used. A third-party fix uses the first detection either way.",
|      "whenToChange": "Turn off when the install must not call out to api.msrc.microsoft.com (a private network that does not allow it). A failed call is said once per run and the name rule is used.",
|      "card": "Vulnerability (CVE) filters",
|      "info": {
|        "what": "Reads the release date of each Microsoft update (by its KB number) from Microsoft's public Security Update Guide (api.msrc.microsoft.com, no sign-in), once a day, and keeps it in the install. Defender names the update and its KB but not when it was released.",
|        "whenOn": "a Microsoft fix's own release date decides In monthly cycle / Catch-up (an out-of-band update by its own date).",
|        "whenOff": "no call to api.msrc.microsoft.com; the month the update's name says (its Patch Tuesday) is used. A third-party fix uses the first detection either way.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "On.",
|        "recommended": "Keep the default. Change it when: Turn off when the install must not call out to api.msrc.microsoft.com (a private network that does not allow it). A failed call is said once per run and the name rule is used.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PatchCycle_MsrcDates/"
|      }
|    },
|    {
|      "name": "SI_PayloadProfile",
|      "label": "Asset detail level",
|      "group": "Data & retention",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "cmdb: every collected property is kept",
|      "description": "--- profile payload --------------------------------------------------------- 'cmdb' (default) = every collected property; 'security' = only the schema-declared columns (default-deny, smaller).",
|      "purpose": "Chooses how much detail is kept per asset: everything collected (cmdb) or only the columns the schema declares (security).",
|      "effect": "security gives smaller rows and lower ingest cost, but drops undeclared properties that queries or dashboards may use; dropped fields are listed in the run log. An unknown value falls back to cmdb.",
|      "whenToChange": "Consider security only if ingest volume matters more than a full asset inventory.",
|      "info": {
|        "what": "Chooses how much detail is kept per asset: everything collected (cmdb) or only the columns the schema declares (security).",
|        "whenChanged": "security gives smaller rows and lower ingest cost, but drops undeclared properties that queries or dashboards may use; dropped fields are listed in the run log. An unknown value falls back to cmdb.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "Nothing else.",
|        "default": "cmdb: every collected property is kept",
|        "recommended": "Keep the default. Change it when: Consider security only if ingest volume matters more than a full asset inventory.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PayloadProfile/"
|      }
|    },
|    {
|      "name": "SI_Pipeline_StartTime",
|      "label": "Daily pipeline start time",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "19:00 in the local time of the install's Azure region (Danish time when the region is not known)",
|      "description": "The daily pipeline (Collect -> Correlate -> Deliver): when a NEW install's pipeline starts -- a time of day in its own time zone, the same local time all year (summer time included). A pipeline already stored (Operations > Jobs, or config\\job-flow.custom.json) keeps its own time. The guided installer asks for the time zone.",
|      "purpose": "The time of day a new install's daily pipeline (Collect, Correlate, Deliver) starts, in the pipeline's time zone.",
|      "effect": "The pipeline starts at this local time every day; summer time moves the time in UTC, never the local time. A pipeline already stored on Operations > Jobs or in config\\job-flow.custom.json keeps its own time -- change that one there.",
|      "whenToChange": "When the collection should run at another time of day, for example to finish before the working day starts.",
|      "patternHint": "HH:mm, local time",
|      "pattern": "^([01][0-9]|2[0-3]):[0-5][0-9]$",
|      "card": "Daily pipeline",
|      "info": {
|        "what": "The time of day a new install's daily pipeline (Collect, Correlate, Deliver) starts, in the pipeline's time zone.",
|        "whenChanged": "The pipeline starts at this local time every day; summer time moves the time in UTC, never the local time. A pipeline already stored on Operations > Jobs or in config\\job-flow.custom.json keeps its own time -- change that one there.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "19:00 in the local time of the install's Azure region (Danish time when the region is not known)",
|        "recommended": "Keep the default. Change it when: When the collection should run at another time of day, for example to finish before the working day starts.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pipeline_StartTime/"
|      }
|    },
|    {
|      "name": "SI_Pipeline_TimeZone",
|      "label": "Daily pipeline time zone",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "The time zone of the install's Azure region, written by the install (Europe/Copenhagen, Danish time, when the region is not known)",
|      "description": "an IANA id (Europe/Oslo, America/New_York) or a Windows id; unknown = UTC",
|      "purpose": "The time zone the daily pipeline's start time is read in.",
|      "effect": "An IANA id such as Europe/Oslo or America/New_York, or a Windows id. The start time stays the same local time all year. An id the machine does not know is read as UTC, with a warning in the run log.",
|      "whenToChange": "Set it to the time zone of the people who read the results; the guided installer asks for it.",
|      "card": "Daily pipeline",
|      "info": {
|        "what": "The time zone the daily pipeline's start time is read in.",
|        "whenChanged": "An IANA id such as Europe/Oslo or America/New_York, or a Windows id. The start time stays the same local time all year. An id the machine does not know is read as UTC, with a warning in the run log.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "The time zone of the install's Azure region, written by the install (Europe/Copenhagen, Danish time, when the region is not known)",
|        "recommended": "Keep the default. Change it when: Set it to the time zone of the people who read the results; the guided installer asks for it.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pipeline_TimeZone/"
|      }
|    },
|    {
|      "name": "SI_PreferUami",
|      "label": "Managed identity switch (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off, unless the sign-in choice selects managed identity",
|      "description": "Older managed-identity switch, still honoured (SI_AuthMethod is the one to use).",
|      "purpose": "Older switch to sign in with a managed identity, still honoured; SI_AuthMethod is the setting to use.",
|      "effect": "When on and no service principal is configured, managed identity is used. For Log Analytics ingestion it takes effect only together with a user-assigned client id.",
|      "whenToChange": "Never on new installs; set SI_AuthMethod instead.",
|      "info": {
|        "what": "Older switch to sign in with a managed identity, still honoured; SI_AuthMethod is the setting to use.",
|        "whenOn": "When on and no service principal is configured, managed identity is used. For Log Analytics ingestion it takes effect only together with a user-assigned client id.",
|        "whenOff": "unless the sign-in choice selects managed identity",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Off, unless the sign-in choice selects managed identity",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_AuthMethod instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PreferUami/"
|      }
|    },
|    {
|      "name": "SI_PrivilegeTierClassifier_RefreshDays",
|      "label": "Privilege tier catalog: days kept while unchanged",
|      "group": "AI",
|      "type": "int",
|      "engines": [
|        "privilege-tier-classifier"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 7,
|      "defaultText": "7 days: the catalog is rebuilt as soon as a role or permission changes, and at least once a week",
|      "description": "Days a catalog is kept while its inputs are unchanged. Each run collects the role definitions and permission catalogs (seconds) and skips the AI pass when they, the engine and the AI settings are the same as for the last complete catalog and that catalog is younger than this. 0 = rebuild on every run.",
|      "purpose": "How long the privilege tier classifier keeps its catalog while nothing it is made from changed. Every run reads the Entra role definitions, the API permission catalog and the Azure role definitions (seconds); when they, the engine and the AI settings are the same as for the last complete catalog and that catalog is younger than this, the AI pass is skipped and the catalog is kept.",
|      "effect": "A lower value rebuilds (and sends the AI requests) more often; 0 rebuilds on every run, as before. A catalog that left items untiered is always rebuilt on the next run.",
|      "whenToChange": "Set 0 to rebuild every run, for example while you test new tiering prompts; raise it to cut AI calls further.",
|      "unit": "days",
|      "min": 0,
|      "max": 365,
|      "card": "AI spending",
|      "info": {
|        "what": "How long the privilege tier classifier keeps its catalog while nothing it is made from changed. Every run reads the Entra role definitions, the API permission catalog and the Azure role definitions (seconds); when they, the engine and the AI settings are the same as for the last complete catalog and that catalog is younger than this, the AI pass is skipped and the catalog is kept.",
|        "whenChanged": "A lower value rebuilds (and sends the AI requests) more often; 0 rebuilds on every run, as before. A catalog that left items untiered is always rebuilt on the next run.",
|        "risk": "None to the data: a changed role or permission always rebuilds the catalog on the next run; the setting only decides how long an unchanged catalog is kept. Reversible at once.",
|        "requires": "Read by: privilege-tier-classifier.",
|        "default": "7 days: the catalog is rebuilt as soon as a role or permission changes, and at least once a week",
|        "recommended": "Keep the default (7).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PrivilegeTierClassifier_RefreshDays/"
|      }
|    },
|    {
|      "name": "SI_PrivilegeTierClassifier_RunAI",
|      "label": "AI for privilege tier catalog",
|      "group": "AI",
|      "type": "bool",
|      "engines": [
|        "privilege-tier-classifier"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": true,
|      "defaultText": "On.",
|      "description": "Master switch. $true (default) runs all 4 AI categories; $false short-circuits to the static built-in tier map.",
|      "purpose": "An override for ONE engine: whether the privilege tier classifier asks Azure OpenAI to tier new roles and permissions. It follows its own switch, not AI integration: it calls AI whenever the Azure OpenAI settings are set, unless this is off.",
|      "effect": "Turning it off sends nothing to Azure OpenAI: roles and permissions already in the catalog keep their tier, and new ones are left unresolved for manual review. Removes AI cost for this engine.",
|      "whenToChange": "Only to keep AI out of the privilege tier classifier while it is used elsewhere; or turn it off if you tier new roles yourself.",
|      "card": "Where AI is used",
|      "info": {
|        "what": "An override for ONE engine: whether the privilege tier classifier asks Azure OpenAI to tier new roles and permissions. It follows its own switch, not AI integration: it calls AI whenever the Azure OpenAI settings are set, unless this is off.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Turning it off sends nothing to Azure OpenAI: roles and permissions already in the catalog keep their tier, and new ones are left unresolved for manual review. Removes AI cost for this engine.",
|        "risk": "With the Azure OpenAI settings set, new role and permission names are sent to YOUR Azure OpenAI deployment, and each call costs; off leaves new ones untiered for manual review. Reversible at once.",
|        "requires": "Read by: privilege-tier-classifier.",
|        "default": "On.",
|        "recommended": "Keep the default; turn it off only to keep AI out of this engine.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PrivilegeTierClassifier_RunAI/"
|      }
|    },
|    {
|      "name": "SI_Pro_AssetRetire_GraceDays",
|      "label": "Days before an unseen asset is retired",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days",
|      "description": "AN ASSET SECURITYINSIGHT NO LONGER SEES (#406): how many days an asset may go unseen before SecurityInsight retires it -- its open vulnerabilities then close as AssetRetired (never as fixed), its CI is retired, and ServiceNow gets the state (u_si_state). Seen again = active again. Default for every category; each category below can override it. Default 30.",
|      "purpose": "How many days an asset SecurityInsight no longer sees may stay unseen before it is retired: its open vulnerabilities close as AssetRetired (never as fixed), its CI in the CI table is retired, and ServiceNow gets the state (u_si_state = retired). Used for every category that has no value of its own.",
|      "effect": "Until then the asset is listed on Assets & services > CMDB > Not seen anymore with its open findings, where an Admin may retire it early. Seen again = active again, and its findings reopen. Shorter than the seen-window (8 days) is raised to the seen-window; non-numbers use 30.",
|      "whenToChange": "Raise it if assets are away longer than this and come back (for example laptops during a long holiday); lower it to close the findings of removed assets sooner.",
|      "unit": "days",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "How many days an asset SecurityInsight no longer sees may stay unseen before it is retired: its open vulnerabilities close as AssetRetired (never as fixed), its CI in the CI table is retired, and ServiceNow gets the state (u_si_state = retired). Used for every category that has no value of its own.",
|        "whenChanged": "Until then the asset is listed on Assets & services > CMDB > Not seen anymore with its open findings, where an Admin may retire it early. Seen again = active again, and its findings reopen. Shorter than the seen-window (8 days) is raised to the seen-window; non-numbers use 30.",
|        "risk": "A shorter grace period retires unseen assets sooner -- and closes their open vulnerabilities as retired. A device that is only offline for a while can be retired by mistake. Reversible for the future; closed findings reopen only when the asset is seen again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "30 days",
|        "recommended": "30 days (devices can be offline for weeks).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetRetire_GraceDays/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter grace period retires unseen assets sooner -- and closes their open vulnerabilities as retired. A device that is only offline for a while can be retired by mistake. Reversible for the future; closed findings reopen only when the asset is seen again."
|      }
|    },
|    {
|      "name": "SI_Pro_AssetRetire_GraceDays_AzureResource",
|      "label": "Days before an unseen asset is retired: other Azure resources",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The general value (30 days)",
|      "description": "Grace period for other Azure resources: any Azure resource that is not a virtual machine. Empty = SI_Pro_AssetRetire_GraceDays.",
|      "purpose": "The grace period for other Azure resources -- any Azure resource that is not a virtual machine. Overrides the general value for this category.",
|      "effect": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|      "whenToChange": "Lower it if Azure resources are deleted for good and you want their findings closed sooner.",
|      "unit": "days",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "The grace period for other Azure resources -- any Azure resource that is not a virtual machine. Overrides the general value for this category.",
|        "whenChanged": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|        "risk": "A shorter grace period retires unseen Azure resources sooner and closes their open vulnerabilities as retired. Reversible for the future.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "The general value (30 days)",
|        "recommended": "The general value.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetRetire_GraceDays_AzureResource/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter grace period retires unseen Azure resources sooner and closes their open vulnerabilities as retired. Reversible for the future."
|      }
|    },
|    {
|      "name": "SI_Pro_AssetRetire_GraceDays_AzureVm",
|      "label": "Days before an unseen asset is retired: Azure virtual machines",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The general value (30 days)",
|      "description": "Grace period for Azure virtual machines: an Azure virtual machine or scale set, also when Defender reports it as a device. Empty = SI_Pro_AssetRetire_GraceDays.",
|      "purpose": "The grace period for Azure virtual machines -- an Azure virtual machine or scale set, also when Defender reports it as a device. Overrides the general value for this category.",
|      "effect": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|      "whenToChange": "Raise it for VMs that are deallocated for long periods.",
|      "unit": "days",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "The grace period for Azure virtual machines -- an Azure virtual machine or scale set, also when Defender reports it as a device. Overrides the general value for this category.",
|        "whenChanged": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|        "risk": "A shorter grace period retires unseen Azure VMs sooner (a stopped VM can be retired by mistake) and closes their open vulnerabilities as retired. Reversible for the future.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "The general value (30 days)",
|        "recommended": "The general value.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetRetire_GraceDays_AzureVm/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter grace period retires unseen Azure VMs sooner (a stopped VM can be retired by mistake) and closes their open vulnerabilities as retired. Reversible for the future."
|      }
|    },
|    {
|      "name": "SI_Pro_AssetRetire_GraceDays_ClientPc",
|      "label": "Days before an unseen asset is retired: client PCs",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The general value (30 days)",
|      "description": "Grace period for client PCs: a device whose operating system is not a server (laptops, desktops). Empty = SI_Pro_AssetRetire_GraceDays.",
|      "purpose": "The grace period for client PCs -- a device whose operating system is not a server (laptops, desktops). Overrides the general value for this category.",
|      "effect": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|      "whenToChange": "Raise it if people are away longer than this with their laptop switched off (holidays, leave).",
|      "unit": "days",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "The grace period for client PCs -- a device whose operating system is not a server (laptops, desktops). Overrides the general value for this category.",
|        "whenChanged": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|        "risk": "A shorter grace period retires unseen client PCs sooner (laptops are often offline for weeks) and closes their open vulnerabilities as retired. Reversible for the future.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "The general value (30 days)",
|        "recommended": "The general value (30 days) or longer.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetRetire_GraceDays_ClientPc/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter grace period retires unseen client PCs sooner (laptops are often offline for weeks) and closes their open vulnerabilities as retired. Reversible for the future."
|      }
|    },
|    {
|      "name": "SI_Pro_AssetRetire_GraceDays_Server",
|      "label": "Days before an unseen asset is retired: servers",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The general value (30 days)",
|      "description": "Grace period for servers: a device with a server operating system, or an Arc-connected machine. Empty = SI_Pro_AssetRetire_GraceDays.",
|      "purpose": "The grace period for servers -- a device with a server operating system, or an Arc-connected machine. Overrides the general value for this category.",
|      "effect": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|      "whenToChange": "Lower it if your servers are decommissioned through a process you trust and you want their findings closed sooner.",
|      "unit": "days",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "The grace period for servers -- a device with a server operating system, or an Arc-connected machine. Overrides the general value for this category.",
|        "whenChanged": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|        "risk": "A shorter grace period retires unseen servers sooner and closes their open vulnerabilities as retired. Reversible for the future.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "The general value (30 days)",
|        "recommended": "The general value.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetRetire_GraceDays_Server/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter grace period retires unseen servers sooner and closes their open vulnerabilities as retired. Reversible for the future."
|      }
|    },
|    {
|      "name": "SI_Pro_AssetRetire_GraceDays_ServicePrincipal",
|      "label": "Days before an unseen asset is retired: service principals",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The general value (30 days)",
|      "description": "Grace period for service principals: an Entra service principal or managed identity. Empty = SI_Pro_AssetRetire_GraceDays.",
|      "purpose": "The grace period for service principals -- an Entra service principal or managed identity. Overrides the general value for this category.",
|      "effect": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|      "whenToChange": "Raise it for service principals that are used only now and then.",
|      "unit": "days",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "The grace period for service principals -- an Entra service principal or managed identity. Overrides the general value for this category.",
|        "whenChanged": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|        "risk": "A shorter grace period retires unseen service principals sooner and closes their open findings as retired. Reversible for the future.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "The general value (30 days)",
|        "recommended": "The general value.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetRetire_GraceDays_ServicePrincipal/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter grace period retires unseen service principals sooner and closes their open findings as retired. Reversible for the future."
|      }
|    },
|    {
|      "name": "SI_Pro_AssetRetire_GraceDays_User",
|      "label": "Days before an unseen asset is retired: users",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The general value (30 days)",
|      "description": "Grace period for users: an Entra user account. Empty = SI_Pro_AssetRetire_GraceDays.",
|      "purpose": "The grace period for users -- an Entra user account. Overrides the general value for this category.",
|      "effect": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|      "whenToChange": "Raise it if accounts are disabled for long periods (leave) and come back.",
|      "unit": "days",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "The grace period for users -- an Entra user account. Overrides the general value for this category.",
|        "whenChanged": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|        "risk": "A shorter grace period retires unseen users sooner and closes their open findings as retired. Reversible for the future.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "The general value (30 days)",
|        "recommended": "The general value.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetRetire_GraceDays_User/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter grace period retires unseen users sooner and closes their open findings as retired. Reversible for the future."
|      }
|    },
|    {
|      "name": "SI_Pro_AssetTagging_Apply",
|      "label": "Asset tagging writes tags",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: report only, every planned tag is logged, nothing is changed",
|      "description": "Let the asset-tagging job WRITE the tags its rules select (Defender machine tags, Azure resource tags, Entra custom security attributes). Off by default: the job then only reports what it would tag, and every planned tag is logged to the asset-tag activity table. Writing also needs the job's own identity to hold the write permissions (setup -GrantTaggingRoles).",
|      "purpose": "Lets the asset-tagging job actually write the tags its rules select in Defender, Azure and Entra, instead of only reporting them.",
|      "effect": "On, the job changes Defender machine tags, Azure resource tags and Entra custom security attributes in your tenant. Only a real true turns it on; the job identity also needs the write roles.",
|      "whenToChange": "Turn it on after reviewing the report-only results and granting the tagging write roles.",
|      "card": "Asset tagging",
|      "info": {
|        "what": "Lets the asset-tagging job actually write the tags its rules select in Defender, Azure and Entra, instead of only reporting them.",
|        "whenOn": "On, the job changes Defender machine tags, Azure resource tags and Entra custom security attributes in your tenant. Only a real true turns it on; the job identity also needs the write roles.",
|        "whenOff": "report only, every planned tag is logged, nothing is changed",
|        "risk": "Writes to your tenant: the job changes Defender machine tags, Azure resource tags and Entra custom security attributes. A wrong rule tags or untags many objects at once. Reversible only by changing the rules and running again (or by hand); every change is on the audit trail.",
|        "requires": "The asset tagging identity's write rights (granted by setup only when asked). A SecurityInsight Pro licence.",
|        "default": "Off: report only, every planned tag is logged, nothing is changed",
|        "recommended": "Off until the report-only plan has been reviewed on the Asset tagging page; then on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetTagging_Apply/",
|        "confirmWhen": "on",
|        "confirm": "On, the job changes Defender machine tags, Azure resource tags and Entra custom security attributes in your tenant. Only a real true turns it on; the job identity also needs the write roles. Writes to your tenant: the job changes Defender machine tags, Azure resource tags and Entra custom security attributes. A wrong rule tags or untags many objects at once. Reversible only by changing the rules and running again (or by hand); every change is on the audit trail."
|      }
|    },
|    {
|      "name": "SI_Pro_AuditRetentionMonths",
|      "label": "Audit trail retention",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "not set: the audit trail is kept forever",
|      "description": "Months the Pro audit trail (cfg.AuditEvent: every action in the web app, the jobs and setup) keeps its rows. Not set = kept forever. At least 13; older rows are removed only by the data sync's retention step, which records itself.",
|      "purpose": "How many months the Pro audit trail (every action in the web app, the jobs and setup: who, when, why, before and after) keeps its rows.",
|      "effect": "When set, the data sync removes audit rows older than this many months and records that removal on the trail itself. It cannot be shorter than 13 months; a smaller value or one that is not a whole number is refused and the trail is kept in full.",
|      "whenToChange": "Set it when your retention policy requires audit evidence to be removed after a period -- keep it at least as long as the data the trail explains.",
|      "unit": "months",
|      "min": 13,
|      "info": {
|        "what": "How many months the Pro audit trail (every action in the web app, the jobs and setup: who, when, why, before and after) keeps its rows.",
|        "whenChanged": "When set, the data sync removes audit rows older than this many months and records that removal on the trail itself. It cannot be shorter than 13 months; a smaller value or one that is not a whole number is refused and the trail is kept in full.",
|        "risk": "Setting it, or lowering it, PERMANENTLY deletes audit rows older than this at the next sync (at least 13 months is enforced). Cannot be undone; check your audit obligations first.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "not set: the audit trail is kept forever",
|        "recommended": "Not set (keep the audit trail), or your audit policy's period.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AuditRetentionMonths/",
|        "confirmWhen": "lower",
|        "confirm": "Setting it, or lowering it, PERMANENTLY deletes audit rows older than this at the next sync (at least 13 months is enforced). Cannot be undone; check your audit obligations first."
|      }
|    },
|    {
|      "name": "SI_Pro_CiChangeRetentionDays",
|      "label": "CI change history kept",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "730 days",
|      "description": "--- Pro database: how long the CI history is kept (days; removed after each data sync) ---",
|      "purpose": "How many days the change history of each configuration item (CI) is kept in the Pro database.",
|      "effect": "Older CI changes are removed after each data sync. Longer keeps more history on the CI page but grows the database.",
|      "whenToChange": "Shorten it to keep the database small; lengthen it when you need a longer audit of CI changes.",
|      "unit": "days",
|      "min": 1,
|      "info": {
|        "what": "How many days the change history of each configuration item (CI) is kept in the Pro database.",
|        "whenChanged": "Older CI changes are removed after each data sync. Longer keeps more history on the CI page but grows the database.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "730 days",
|        "recommended": "Keep the default. Change it when: Shorten it to keep the database small; lengthen it when you need a longer audit of CI changes.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_CiChangeRetentionDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_CiDailyRetentionDays",
|      "label": "CI daily trend kept",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "400 days",
|      "description": "each CI's daily trend",
|      "purpose": "How many days of each CI's daily trend (risk score, open findings by severity) the Pro database keeps.",
|      "effect": "Older daily rows are removed after each data sync, so trend charts go back this far.",
|      "whenToChange": "Shorten it to keep the database small; lengthen it for longer trend charts.",
|      "unit": "days",
|      "min": 1,
|      "info": {
|        "what": "How many days of each CI's daily trend (risk score, open findings by severity) the Pro database keeps.",
|        "whenChanged": "Older daily rows are removed after each data sync, so trend charts go back this far.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "400 days",
|        "recommended": "Keep the default. Change it when: Shorten it to keep the database small; lengthen it for longer trend charts.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_CiDailyRetentionDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_CmdbSql_DryRun",
|      "label": "SQL CMDB connector dry run",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: the connector writes the CI table",
|      "description": "Plan the SQL CMDB connector (what it would create, update and retire) without writing to SQL.",
|      "purpose": "Makes the SQL CMDB connector plan what it would create, update and retire without writing anything to SQL.",
|      "effect": "On, the CI table is not changed and no run is recorded there; the plan is in the job's log and on the audit trail as a plan.",
|      "whenToChange": "Turn on briefly to check a new setup; turn off again afterwards.",
|      "info": {
|        "what": "Makes the SQL CMDB connector plan what it would create, update and retire without writing anything to SQL.",
|        "whenOn": "On, the CI table is not changed and no run is recorded there; the plan is in the job's log and on the audit trail as a plan.",
|        "whenOff": "the connector writes the CI table",
|        "risk": "The CMDB table is not updated while it is on: consumers of the CMDB hand-off keep the last state. Reversible: turn it off.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off: the connector writes the CI table",
|        "recommended": "Off; on only to check a change safely.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_CmdbSql_DryRun/",
|        "confirmWhen": "on",
|        "confirm": "On, the CI table is not changed and no run is recorded there; the plan is in the job's log and on the audit trail as a plan. The CMDB table is not updated while it is on: consumers of the CMDB hand-off keep the last state. Reversible: turn it off."
|      }
|    },
|    {
|      "name": "SI_Pro_CmdbSql_Enabled",
|      "label": "SQL CMDB connector",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On when a Pro database is configured",
|      "description": "THE SQL CMDB CONNECTOR: writes every asset SecurityInsight knows (one row per asset, with its tier, department, owner, business services, identifiers and history) into the CI table of the Pro database (cmdbsync.ConfigurationItem, and the view cmdbsync.vConfigurationItem for Power BI). On by default when there is a Pro database; $false switches it off.",
|      "purpose": "Writes every asset SecurityInsight knows into a CI table in the Pro database (one row per asset with its tier, department, owner, business services, identifiers and change history), for reporting and Power BI.",
|      "effect": "Off, the CMDB connector job ends at once and the CI table keeps what it last held; nothing is deleted. On, each run creates new CIs, updates changed ones and retires CIs that are gone.",
|      "whenToChange": "Turn off only if you do not want the CI table kept up to date.",
|      "card": "SQL CMDB connector",
|      "info": {
|        "what": "Writes every asset SecurityInsight knows into a CI table in the Pro database (one row per asset with its tier, department, owner, business services, identifiers and change history), for reporting and Power BI.",
|        "whenOn": "when a Pro database is configured",
|        "whenOff": "Off, the CMDB connector job ends at once and the CI table keeps what it last held; nothing is deleted. On, each run creates new CIs, updates changed ones and retires CIs that are gone.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "On when a Pro database is configured",
|        "recommended": "Keep the default. Change it when: Turn off only if you do not want the CI table kept up to date.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_CmdbSql_Enabled/"
|      }
|    },
|    {
|      "name": "SI_Pro_CmdbSql_Kinds",
|      "label": "Asset kinds written as CIs",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "endpoint and azure",
|      "description": "Which kinds of asset become CIs: 'endpoint' (devices), 'azure' (Azure resources) and, if you want them, 'publicip'. Identities are never written as CIs.",
|      "purpose": "Which kinds of asset the SQL CMDB connector writes to the CI table: endpoint (devices), azure (Azure resources) and publicip (public IP addresses).",
|      "effect": "A kind you add gets its CIs on the next run. CIs of a kind you remove are kept as they are (not retired). Identities are never written as CIs; unknown values are ignored.",
|      "whenToChange": "Add publicip if you want public IP addresses in the CI table as well.",
|      "card": "SQL CMDB connector",
|      "info": {
|        "what": "Which kinds of asset the SQL CMDB connector writes to the CI table: endpoint (devices), azure (Azure resources) and publicip (public IP addresses).",
|        "whenChanged": "A kind you add gets its CIs on the next run. CIs of a kind you remove are kept as they are (not retired). Identities are never written as CIs; unknown values are ignored.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "endpoint and azure",
|        "recommended": "Keep the default. Change it when: Add publicip if you want public IP addresses in the CI table as well.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_CmdbSql_Kinds/"
|      }
|    },
|    {
|      "name": "SI_Pro_CmdbSql_RetireAfterRuns",
|      "label": "Runs before a CI is retired",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "2 runs",
|      "description": "How many complete runs in a row an asset must be missing before its CI is retired (kept, never deleted). Each new snapshot counts once; a run that reads the same snapshot again counts nothing. Default 2, at least 1.",
|      "purpose": "How many complete runs in a row an asset must be missing before the SQL CMDB connector retires its CI.",
|      "effect": "Higher keeps CIs of assets that drop out now and then, but marks really removed assets as retired later. A retired CI is kept with its history and comes back if the asset is seen again. A run that reads the same snapshot as the last one does not count. Below 1 is raised to 1; non-numbers use 2.",
|      "whenToChange": "Raise it if CIs are retired and reactivated for assets that are still there.",
|      "unit": "runs",
|      "min": 1,
|      "card": "SQL CMDB connector",
|      "info": {
|        "what": "How many complete runs in a row an asset must be missing before the SQL CMDB connector retires its CI.",
|        "whenChanged": "Higher keeps CIs of assets that drop out now and then, but marks really removed assets as retired later. A retired CI is kept with its history and comes back if the asset is seen again. A run that reads the same snapshot as the last one does not count. Below 1 is raised to 1; non-numbers use 2.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "2 runs",
|        "recommended": "Keep the default. Change it when: Raise it if CIs are retired and reactivated for assets that are still there.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_CmdbSql_RetireAfterRuns/"
|      }
|    },
|    {
|      "name": "SI_Pro_CmdbSql_SeenWithinDays",
|      "label": "CI seen-window",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "8 days",
|      "description": "An asset counts as present when its profile was published within this many days. Low tiers are re-profiled weekly, so keep it above the slowest tier's re-check interval. Default 8, at least 1.",
|      "purpose": "How recently an asset's profile must have been published for the SQL CMDB connector to count the asset as present.",
|      "effect": "Shorter notices removed assets sooner but can count low-tier assets as missing, because they are re-profiled only weekly. A kind whose newest snapshot is older than this is not used at all and the run changes nothing. Below 1 is raised to 1.",
|      "whenToChange": "Only if you changed how often low-tier assets are re-profiled; keep it above the slowest re-check interval.",
|      "unit": "days",
|      "min": 1,
|      "info": {
|        "what": "How recently an asset's profile must have been published for the SQL CMDB connector to count the asset as present.",
|        "whenChanged": "Shorter notices removed assets sooner but can count low-tier assets as missing, because they are re-profiled only weekly. A kind whose newest snapshot is older than this is not used at all and the run changes nothing. Below 1 is raised to 1.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "8 days",
|        "recommended": "Keep the default. Change it when: Only if you changed how often low-tier assets are re-profiled; keep it above the slowest re-check interval.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_CmdbSql_SeenWithinDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_ConfigBackupRetentionDays",
|      "label": "Configuration backups kept (days)",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "90 days",
|      "description": "Days the configuration backups are kept (the daily backup job and Back up now; Configuration > Backups (restore)). Default 90, at least 1. A pinned backup is kept until it is unpinned; removals are recorded on the audit trail.",
|      "purpose": "How many days the configuration backups are kept (the daily backup and Back up now).",
|      "effect": "The backup job removes backups older than this, except pinned ones and a backup whose content a newer one points at; each removal is recorded on the audit trail. A day without changes is recorded as no change, not copied again.",
|      "whenToChange": "When your policy needs backups for a longer or shorter time. The change journal is always kept at least this long.",
|      "unit": "days",
|      "min": 1,
|      "card": "How long data is kept",
|      "info": {
|        "what": "How many days the configuration backups are kept (the daily backup and Back up now).",
|        "whenChanged": "The backup job removes backups older than this, except pinned ones and a backup whose content a newer one points at; each removal is recorded on the audit trail. A day without changes is recorded as no change, not copied again.",
|        "risk": "A shorter value deletes older configuration backups at the next backup run (pinned ones are kept). Cannot be undone.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "90 days",
|        "recommended": "90 days.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_ConfigBackupRetentionDays/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter value deletes older configuration backups at the next backup run (pinned ones are kept). Cannot be undone."
|      }
|    },
|    {
|      "name": "SI_Pro_ConfigJournalRetentionDays",
|      "label": "Change journal kept (days)",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "not set: the change journal is kept forever",
|      "description": "Days the change journal (every configuration change, record by record -- what undo and restore are built on) keeps its rows. Not set = kept forever (the default). Never shorter than the backup retention: a shorter value is refused and the journal is kept.",
|      "purpose": "How many days the change journal keeps its rows -- every configuration change, record by record, that undo and restore are built on.",
|      "effect": "When set, the backup job removes journal rows older than this and records that on the audit trail. It can never be shorter than the backup retention: a shorter value is refused and the journal is kept, because an undo needs its evidence.",
|      "whenToChange": "Only when your retention policy requires configuration history to be removed after a period.",
|      "unit": "days",
|      "min": 1,
|      "info": {
|        "what": "How many days the change journal keeps its rows -- every configuration change, record by record, that undo and restore are built on.",
|        "whenChanged": "When set, the backup job removes journal rows older than this and records that on the audit trail. It can never be shorter than the backup retention: a shorter value is refused and the journal is kept, because an undo needs its evidence.",
|        "risk": "Setting it, or lowering it, deletes older change-journal rows at the next backup run. Cannot be undone.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "not set: the change journal is kept forever",
|        "recommended": "Not set (keep the journal).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_ConfigJournalRetentionDays/",
|        "confirmWhen": "lower",
|        "confirm": "Setting it, or lowering it, deletes older change-journal rows at the next backup run. Cannot be undone."
|      }
|    },
|    {
|      "name": "SI_Pro_DataLookbackDays",
|      "label": "Pro data sync look-back",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "3 days",
|      "description": "Days of Log Analytics the data sync looks back for complete runs it has not copied yet.",
|      "purpose": "How many days back in Log Analytics the Pro data sync looks for complete runs it has not copied yet.",
|      "effect": "A longer look-back catches up after longer outages but makes each sync query more data and take longer. Too short can leave runs from a long outage uncopied. A value below 1 or not a whole number stops the sync.",
|      "whenToChange": "Raise it temporarily after the sync has been down for more than a few days.",
|      "unit": "days",
|      "min": 1,
|      "info": {
|        "what": "How many days back in Log Analytics the Pro data sync looks for complete runs it has not copied yet.",
|        "whenChanged": "A longer look-back catches up after longer outages but makes each sync query more data and take longer. Too short can leave runs from a long outage uncopied. A value below 1 or not a whole number stops the sync.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "3 days",
|        "recommended": "Keep the default. Change it when: Raise it temporarily after the sync has been down for more than a few days.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataLookbackDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataQuality_AssetDropPercent",
|      "label": "Data quality: asset drop",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "30 %",
|      "description": "Assets (per source, active CIs): warn when down this many percent or more from the median of the last 3 runs.",
|      "purpose": "When the assets of a source (Defender for Endpoint, Entra ID, Azure, public IPs) or the active CIs fall this many percent or more below the median of the last 3 runs, it is shown as a data-quality warning.",
|      "effect": "Lower warns about smaller drops; higher only about large ones. A warning never blocks anything.",
|      "whenToChange": "Raise it when the number of assets moves a lot from day to day on purpose.",
|      "unit": "%",
|      "min": 1,
|      "max": 100,
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "When the assets of a source (Defender for Endpoint, Entra ID, Azure, public IPs) or the active CIs fall this many percent or more below the median of the last 3 runs, it is shown as a data-quality warning.",
|        "whenChanged": "Lower warns about smaller drops; higher only about large ones. A warning never blocks anything.",
|        "risk": "Only changes when a data-quality WARNING is shown and mailed; nothing is ever held or stopped by it. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "30 %",
|        "recommended": "Keep the default. Change it when: Raise it when the number of assets moves a lot from day to day on purpose.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataQuality_AssetDropPercent/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataQuality_FillDropPoints",
|      "label": "Data quality: column fill drop",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "30 points",
|      "description": "A key column's fill (risk factors, tier, owner, asset type, SQL tag): warn when down this many percentage points or more.",
|      "purpose": "When the share of rows that carry a key value -- the probability and consequence risk factors, the tier, the SQL tag, and the CIs' asset type and owner -- falls this many percentage points or more below the median of the last 3 runs, it is shown as a data-quality warning.",
|      "effect": "Lower warns about smaller drops in fill; higher only about large ones. A warning never blocks anything.",
|      "whenToChange": "Lower it if you want to hear early about owners or factors going missing.",
|      "unit": "points",
|      "min": 1,
|      "max": 100,
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "When the share of rows that carry a key value -- the probability and consequence risk factors, the tier, the SQL tag, and the CIs' asset type and owner -- falls this many percentage points or more below the median of the last 3 runs, it is shown as a data-quality warning.",
|        "whenChanged": "Lower warns about smaller drops in fill; higher only about large ones. A warning never blocks anything.",
|        "risk": "Only changes when a data-quality WARNING is shown and mailed; nothing is ever held or stopped by it. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "30 points",
|        "recommended": "Keep the default. Change it when: Lower it if you want to hear early about owners or factors going missing.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataQuality_FillDropPoints/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataQuality_Mail_Enabled",
|      "label": "Data-quality mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "Every pipeline run stores its key numbers (assets per source, rows per Risk Analysis report, fill of the key columns, CIs per tier, active CIs, CIs to retire) and compares each with the median of the last 3 runs. A number off its range is shown on the Data quality panel and in the run health -- it never blocks anything. ONE mail a day, only when a number is off. On by default.",
|      "purpose": "One mail a day when a key number of the latest pipeline run is far off its usual range -- for example far fewer assets, a report with no rows, or risk factors suddenly missing.",
|      "effect": "Off sends no data-quality mail: the warnings are still shown on Operations > Data quality and in Run health. Nothing is ever blocked by them either way.",
|      "whenToChange": "Leave it on. Turn it off only if another system already watches these numbers for you.",
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "One mail a day when a key number of the latest pipeline run is far off its usual range -- for example far fewer assets, a report with no rows, or risk factors suddenly missing.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Off sends no data-quality mail: the warnings are still shown on Operations > Data quality and in Run health. Nothing is ever blocked by them either way.",
|        "risk": "Off: nobody is mailed when a key number of a run is far off its usual range; the warnings are still on the Data quality panel and in Run health. Nothing is ever held or stopped by them. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "On",
|        "recommended": "Keep the default. Change it when: Leave it on. Turn it off only if another system already watches these numbers for you.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataQuality_Mail_Enabled/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataQuality_Mail_To",
|      "label": "Data-quality mail recipients",
|      "group": "Guards (safety checks)",
|      "type": "list",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "The safety-check mail recipients (SI_GuardMail_To); without those the report recipients (MailTo), else the SecurityInsight Pro SuperAdmins",
|      "description": "Who gets the data-quality mail. Default: the safety-check mail recipients (SI_GuardMail_To), else MailTo, else the SuperAdmins.",
|      "purpose": "The addresses that receive the daily data-quality mail.",
|      "effect": "These addresses get the data-quality mail instead of the default recipients.",
|      "whenToChange": "Set it to the people who change SecurityInsight's settings, so a setting that caused a drop is corrected quickly.",
|      "card": "Data-quality warnings",
|      "hint": "Empty: the safety-check mail recipients.",
|      "needs": "SI_Pro_DataQuality_Mail_Enabled",
|      "itemFormat": "email",
|      "info": {
|        "what": "The addresses that receive the daily data-quality mail.",
|        "whenChanged": "These addresses get the data-quality mail instead of the default recipients.",
|        "risk": "A wrong address means the daily data-quality mail reaches the wrong people or nobody; nothing is held or stopped. Reversible at once.",
|        "requires": "Works only while \"Data-quality mail\" is on. A SecurityInsight Pro licence.",
|        "default": "The safety-check mail recipients (SI_GuardMail_To); without those the report recipients (MailTo), else the SecurityInsight Pro SuperAdmins",
|        "recommended": "Keep the default. Change it when: Set it to the people who change SecurityInsight's settings, so a setting that caused a drop is corrected quickly.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataQuality_Mail_To/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataQuality_ReportDropPercent",
|      "label": "Data quality: report drop",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "50 %",
|      "description": "A Risk Analysis report: warn when it has 0 rows, or is down this many percent or more.",
|      "purpose": "When a Risk Analysis report has 0 rows, or falls this many percent or more below the median of the last 3 runs, it is shown as a data-quality warning -- the sign of a query that suddenly returns nothing.",
|      "effect": "Lower warns about smaller drops; higher only about large ones. A report at 0 rows always warns. A warning never blocks anything.",
|      "whenToChange": "Raise it when your reports shrink a lot on purpose (a large remediation round).",
|      "unit": "%",
|      "min": 1,
|      "max": 100,
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "When a Risk Analysis report has 0 rows, or falls this many percent or more below the median of the last 3 runs, it is shown as a data-quality warning -- the sign of a query that suddenly returns nothing.",
|        "whenChanged": "Lower warns about smaller drops; higher only about large ones. A report at 0 rows always warns. A warning never blocks anything.",
|        "risk": "Only changes when a data-quality WARNING is shown and mailed; nothing is ever held or stopped by it. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "50 %",
|        "recommended": "Keep the default. Change it when: Raise it when your reports shrink a lot on purpose (a large remediation round).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataQuality_ReportDropPercent/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataQuality_TierShiftPercent",
|      "label": "Data quality: tier shift",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "20 % of all active CIs",
|      "description": "A tier: warn when it moved by this share of all active CIs or more (up or down); also CIs to retire rising by it.",
|      "purpose": "When the active CIs in a tier (0 to 3) change by this share of all active CIs or more compared with the median of the last 3 runs -- or the CIs about to retire rise by it -- it is shown as a data-quality warning. The typical cause: a customised rule that moved all servers to one tier.",
|      "effect": "Lower warns about smaller moves between tiers; higher only about large ones. A warning never blocks anything.",
|      "whenToChange": "Raise it while you re-tier your estate on purpose.",
|      "unit": "%",
|      "min": 1,
|      "max": 100,
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "When the active CIs in a tier (0 to 3) change by this share of all active CIs or more compared with the median of the last 3 runs -- or the CIs about to retire rise by it -- it is shown as a data-quality warning. The typical cause: a customised rule that moved all servers to one tier.",
|        "whenChanged": "Lower warns about smaller moves between tiers; higher only about large ones. A warning never blocks anything.",
|        "risk": "Only changes when a data-quality WARNING is shown and mailed; nothing is ever held or stopped by it. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "20 % of all active CIs",
|        "recommended": "Keep the default. Change it when: Raise it while you re-tier your estate on purpose.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataQuality_TierShiftPercent/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataRetentionDays",
|      "label": "Pro data retention",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "90 days",
|      "description": "Days of run data the Pro database keeps (findings, assets, daily aggregates); older collections are purged. Default 90, at least 1. The vulnerability current state and the identity ledger are never purged.",
|      "purpose": "How many days of run data (findings, assets, daily aggregates) the Pro database keeps before older collections are removed.",
|      "effect": "Longer keeps more history for trends but grows the database and its cost; shorter purges history permanently. Current vulnerability state and the identity ledger are never purged. An invalid value stops the sync.",
|      "whenToChange": "Change it when you need longer history for reporting or must limit database size.",
|      "unit": "days",
|      "min": 1,
|      "card": "How long data is kept",
|      "info": {
|        "what": "How many days of run data (findings, assets, daily aggregates) the Pro database keeps before older collections are removed.",
|        "whenChanged": "Longer keeps more history for trends but grows the database and its cost; shorter purges history permanently. Current vulnerability state and the identity ledger are never purged. An invalid value stops the sync.",
|        "risk": "A shorter value PERMANENTLY deletes older history (trends, past collections) at the next sync; current state is kept. Cannot be undone. Longer grows the database and its cost.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "90 days",
|        "recommended": "Keep 90 days or longer for trends across quarters.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataRetentionDays/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter value PERMANENTLY deletes older history (trends, past collections) at the next sync; current state is kept. Cannot be undone. Longer grows the database and its cost."
|      }
|    },
|    {
|      "name": "SI_Pro_DataSqlDatabase",
|      "label": "Pro data sync database",
|      "group": "Data & retention",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Same database as SI_ProSqlDatabase",
|      "description": "The SQL database the data sync writes to (default: SI_ProSqlDatabase).",
|      "purpose": "The SQL database the Pro data sync writes run data to, when it should differ from the Pro settings database.",
|      "effect": "Points the data sync, the close-loop mail and data setup at another database. Without any Pro database configured the data sync job is skipped.",
|      "whenToChange": "Only when you deliberately keep run data in a separate database from the Pro settings.",
|      "info": {
|        "what": "The SQL database the Pro data sync writes run data to, when it should differ from the Pro settings database.",
|        "whenChanged": "Points the data sync, the close-loop mail and data setup at another database. Without any Pro database configured the data sync job is skipped.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Same database as SI_ProSqlDatabase",
|        "recommended": "Keep the default. Change it when: Only when you deliberately keep run data in a separate database from the Pro settings.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataSqlDatabase/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataSqlServer",
|      "label": "Pro data sync SQL server",
|      "group": "Data & retention",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Same server as SI_ProSqlServer",
|      "description": "The SQL server the data sync writes to (default: SI_ProSqlServer, the Pro settings database's server).",
|      "purpose": "The SQL server the Pro data sync writes run data to, when it should differ from the Pro settings database's server.",
|      "effect": "Points the data sync (and the close-loop mail's data source) at another server; the identity must have access there. Without any Pro database configured the data sync job is skipped.",
|      "whenToChange": "Only when run data lives on a different SQL server than the Pro settings.",
|      "info": {
|        "what": "The SQL server the Pro data sync writes run data to, when it should differ from the Pro settings database's server.",
|        "whenChanged": "Points the data sync (and the close-loop mail's data source) at another server; the identity must have access there. Without any Pro database configured the data sync job is skipped.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Same server as SI_ProSqlServer",
|        "recommended": "Keep the default. Change it when: Only when run data lives on a different SQL server than the Pro settings.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataSqlServer/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataSync_DryRun",
|      "label": "Pro data sync dry run",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: the data sync writes to the database",
|      "description": "Plan the data sync (what would be copied and purged) without writing to SQL.",
|      "purpose": "Makes the Pro data sync plan what it would copy and purge without writing anything to SQL.",
|      "effect": "On, no run data reaches the Pro database and nothing is purged, so Pro pages stop getting new data. Useful to check a new setup safely.",
|      "whenToChange": "Turn on briefly when testing a new database setup; turn off again afterwards.",
|      "info": {
|        "what": "Makes the Pro data sync plan what it would copy and purge without writing anything to SQL.",
|        "whenOn": "On, no run data reaches the Pro database and nothing is purged, so Pro pages stop getting new data. Useful to check a new setup safely.",
|        "whenOff": "the data sync writes to the database",
|        "risk": "No run data reaches the Pro database: the web app's pages stop getting new data while it is on. Reversible: turn it off; the next sync catches up within its look-back.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off: the data sync writes to the database",
|        "recommended": "Off; on only to check a new setup safely.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataSync_DryRun/",
|        "confirmWhen": "on",
|        "confirm": "On, no run data reaches the Pro database and nothing is purged, so Pro pages stop getting new data. Useful to check a new setup safely. No run data reaches the Pro database: the web app's pages stop getting new data while it is on. Reversible: turn it off; the next sync catches up within its look-back."
|      }
|    },
|    {
|      "name": "SI_Pro_DepartmentReport_DayOfMonth",
|      "label": "Monthly report day",
|      "group": "Mail & notifications",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "1",
|      "description": "The day of the month (1 to 28) from which the monthly report for the previous month is sent.",
|      "purpose": "The day of the month from which the report for the previous month is sent.",
|      "effect": "The report goes out on the first daily run on or after this day; a day the mail relay fails is retried the next day.",
|      "whenToChange": "When the previous month's data settles later (for example after a monthly patch window).",
|      "unit": "day of the month (1-28)",
|      "card": "Mails to departments",
|      "needs": "SI_Pro_DepartmentReport_SendMail",
|      "info": {
|        "what": "The day of the month from which the report for the previous month is sent.",
|        "whenChanged": "The report goes out on the first daily run on or after this day; a day the mail relay fails is retried the next day.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"Monthly report to business owners\" is on. A SecurityInsight Pro licence.",
|        "default": "1",
|        "recommended": "Keep the default. Change it when: When the previous month's data settles later (for example after a monthly patch window).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DepartmentReport_DayOfMonth/"
|      }
|    },
|    {
|      "name": "SI_Pro_DepartmentReport_SendMail",
|      "label": "Monthly report to business owners",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "off",
|      "description": "Send each department's business owners a monthly status mail (their assets and services, with a link to the department page). Off by default. Sent by the close-loop mail job through the same relay as the Risk Analysis mail.",
|      "purpose": "Sends each department's business owners a monthly mail with the status of their assets and services.",
|      "effect": "When on, the daily close-loop mail job sends each department its report for the previous month from the chosen day on, once per month, through the same mail relay as the Risk Analysis mail. Departments without a business owner with a mail address get none.",
|      "whenToChange": "Once departments and their business owners are set up.",
|      "card": "Mails to departments",
|      "info": {
|        "what": "Sends each department's business owners a monthly mail with the status of their assets and services.",
|        "whenOn": "When on, the daily close-loop mail job sends each department its report for the previous month from the chosen day on, once per month, through the same mail relay as the Risk Analysis mail. Departments without a business owner with a mail address get none.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off",
|        "recommended": "Keep the default. Change it when: Once departments and their business owners are set up.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DepartmentReport_SendMail/"
|      }
|    },
|    {
|      "name": "SI_Pro_FindingSla_CriticalDays",
|      "label": "Days to fix a critical finding",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "15 days",
|      "description": "--- Findings per CI: the days a finding has to be fixed, per severity (its due date; 0 = no due date) ---",
|      "purpose": "How many days a critical finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|      "effect": "Sets the due date of every critical finding. A finding past its due date is shown as overdue on the CI page, the service views and the trend. 0 = critical findings have no due date.",
|      "whenToChange": "Set it to the deadline your security policy gives critical findings.",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "info": {
|        "what": "How many days a critical finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|        "whenChanged": "Sets the due date of every critical finding. A finding past its due date is shown as overdue on the CI page, the service views and the trend. 0 = critical findings have no due date.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "15 days",
|        "recommended": "Keep the default. Change it when: Set it to the deadline your security policy gives critical findings.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_FindingSla_CriticalDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_FindingSla_HighDays",
|      "label": "Days to fix a high finding",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "30 days",
|      "description": "the days a high finding has to be fixed (0 = no due date)",
|      "purpose": "How many days a high finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|      "effect": "Sets the due date of every high finding. A finding past its due date is shown as overdue. 0 = high findings have no due date.",
|      "whenToChange": "Set it to the deadline your security policy gives high findings.",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "info": {
|        "what": "How many days a high finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|        "whenChanged": "Sets the due date of every high finding. A finding past its due date is shown as overdue. 0 = high findings have no due date.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "30 days",
|        "recommended": "Keep the default. Change it when: Set it to the deadline your security policy gives high findings.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_FindingSla_HighDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_FindingSla_LowDays",
|      "label": "Days to fix a low finding",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "180 days",
|      "description": "the days a low finding has to be fixed (0 = no due date)",
|      "purpose": "How many days a low finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|      "effect": "Sets the due date of every low finding. A finding past its due date is shown as overdue. 0 = low findings have no due date.",
|      "whenToChange": "Set it to the deadline your security policy gives low findings.",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "info": {
|        "what": "How many days a low finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|        "whenChanged": "Sets the due date of every low finding. A finding past its due date is shown as overdue. 0 = low findings have no due date.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "180 days",
|        "recommended": "Keep the default. Change it when: Set it to the deadline your security policy gives low findings.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_FindingSla_LowDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_FindingSla_MediumDays",
|      "label": "Days to fix a medium finding",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "90 days",
|      "description": "the days a medium finding has to be fixed (0 = no due date)",
|      "purpose": "How many days a medium finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|      "effect": "Sets the due date of every medium finding. A finding past its due date is shown as overdue. 0 = medium findings have no due date.",
|      "whenToChange": "Set it to the deadline your security policy gives medium findings.",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "info": {
|        "what": "How many days a medium finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|        "whenChanged": "Sets the due date of every medium finding. A finding past its due date is shown as overdue. 0 = medium findings have no due date.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "90 days",
|        "recommended": "Keep the default. Change it when: Set it to the deadline your security policy gives medium findings.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_FindingSla_MediumDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_FindingStateRetentionDays",
|      "label": "Closed finding history kept",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "365 days",
|      "description": "closed findings' lifecycle rows (open ones are never removed)",
|      "purpose": "How many days a closed finding's lifecycle row (first detected, closed, close reason) is kept in the Pro database.",
|      "effect": "Closed lifecycle rows older than this are removed after each data sync; open findings are never removed.",
|      "whenToChange": "Lengthen it when you report on fixes over a longer period.",
|      "unit": "days",
|      "min": 1,
|      "info": {
|        "what": "How many days a closed finding's lifecycle row (first detected, closed, close reason) is kept in the Pro database.",
|        "whenChanged": "Closed lifecycle rows older than this are removed after each data sync; open findings are never removed.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "365 days",
|        "recommended": "Keep the default. Change it when: Lengthen it when you report on fixes over a longer period.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_FindingStateRetentionDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_GovernanceNotify_MinSeverity",
|      "label": "New-findings digest: lowest severity",
|      "group": "Mail & notifications",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "High -- critical and high findings",
|      "description": "The lowest severity the technical owners' digest announces: Critical, High, Medium or Low.",
|      "purpose": "The lowest severity the technical owners' digest announces (Critical, High, Medium or Low).",
|      "effect": "Findings below this severity are not announced (they are still on the department page and in the monthly review).",
|      "whenToChange": "Lower it for a team that wants to hear about every new finding; raise it to Critical when the digest is too long.",
|      "values": [
|        "Critical",
|        "High",
|        "Medium",
|        "Low"
|      ],
|      "valueLabels": {
|        "Critical": "Critical only",
|        "High": "High and critical",
|        "Medium": "Medium and up",
|        "Low": "Every severity"
|      },
|      "card": "Mails to departments",
|      "needs": "SI_Pro_GovernanceNotify_SendMail",
|      "info": {
|        "what": "The lowest severity the technical owners' digest announces (Critical, High, Medium or Low).",
|        "whenChanged": "Findings below this severity are not announced (they are still on the department page and in the monthly review).",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"New-findings digest to technical owners\" is on. A SecurityInsight Pro licence.",
|        "default": "High -- critical and high findings",
|        "recommended": "Keep the default. Change it when: Lower it for a team that wants to hear about every new finding; raise it to Critical when the digest is too long.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_GovernanceNotify_MinSeverity/"
|      }
|    },
|    {
|      "name": "SI_Pro_GovernanceNotify_Mode",
|      "label": "New-findings digest: one row per",
|      "group": "Mail & notifications",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "vulnerability",
|      "description": "How the technical owners' digest lists the new findings: 'vulnerability' (one row per finding) or 'asset' (one row per asset).",
|      "purpose": "How the technical owners' digest lists what is new: one row per vulnerability, or one row per asset with how many new findings it has and the highest severity.",
|      "effect": "Only the layout of the digest changes; it is still one mail per department per collection, listing the 50 most severe rows with the rest counted.",
|      "whenToChange": "Choose asset when the team works machine by machine (for example a server team patching hosts), vulnerability when it works issue by issue.",
|      "values": [
|        "vulnerability",
|        "asset"
|      ],
|      "valueLabels": {
|        "vulnerability": "Vulnerability",
|        "asset": "Asset"
|      },
|      "card": "Mails to departments",
|      "needs": "SI_Pro_GovernanceNotify_SendMail",
|      "info": {
|        "what": "How the technical owners' digest lists what is new: one row per vulnerability, or one row per asset with how many new findings it has and the highest severity.",
|        "whenChanged": "Only the layout of the digest changes; it is still one mail per department per collection, listing the 50 most severe rows with the rest counted.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"New-findings digest to technical owners\" is on. A SecurityInsight Pro licence.",
|        "default": "vulnerability",
|        "recommended": "Keep the default. Change it when: Choose asset when the team works machine by machine (for example a server team patching hosts), vulnerability when it works issue by issue.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_GovernanceNotify_Mode/"
|      }
|    },
|    {
|      "name": "SI_Pro_GovernanceNotify_SendMail",
|      "label": "New-findings digest to technical owners",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "off",
|      "description": "GOVERNANCE (departments, phase 2): after each data sync, send each department's technical owners ONE digest of the findings that are new for the department. Off by default. Sent by the close-loop mail job through the same relay as the Risk Analysis mail.",
|      "purpose": "After each data sync, sends each department's technical owners one mail with their new findings.",
|      "effect": "When on, the daily close-loop mail job compares the newest collection with the last one each department was told about and sends one digest per department (nothing new means no mail), through the same mail relay as the Risk Analysis mail. Each collection is announced once per department; the very first collection is only recorded as the starting point. Departments without a technical owner with a mail address get none.",
|      "whenToChange": "Once departments and their technical owners are set up and they want to hear about new findings without opening the web app.",
|      "card": "Mails to departments",
|      "info": {
|        "what": "After each data sync, sends each department's technical owners one mail with their new findings.",
|        "whenOn": "When on, the daily close-loop mail job compares the newest collection with the last one each department was told about and sends one digest per department (nothing new means no mail), through the same mail relay as the Risk Analysis mail. Each collection is announced once per department; the very first collection is only recorded as the starting point. Departments without a technical owner with a mail address get none.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off",
|        "recommended": "Keep the default. Change it when: Once departments and their technical owners are set up and they want to hear about new findings without opening the web app.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_GovernanceNotify_SendMail/"
|      }
|    },
|    {
|      "name": "SI_Pro_HiddenViews",
|      "label": "Hidden named views",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "list",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "None hidden: every shipped view is in the picker",
|      "description": "The shipped named views hidden from the view picker of Security recommendations > Summary and Detailed, for everyone: critical-high, tier0, cve, exploited, mitre, compliance, cvss (summary:<view> / detailed:<view> = one page). Default none.",
|      "purpose": "The named views SecurityInsight ships for Security recommendations, Summary and Detailed (Critical and High, On Tier 0, Vulnerabilities (CVE), Known exploited, MITRE, Compliance, CVSS) that are hidden from the view picker for everyone.",
|      "effect": "A view on the list is no longer offered in the picker of either page (critical-high, tier0, cve, exploited, mitre, compliance, cvss); summary:<view> or detailed:<view> hides it on one page only. Its address still opens it. The findings are unchanged.",
|      "whenToChange": "Hide a view your organisation does not use, so the picker shows only the ones people need.",
|      "card": "Named views",
|      "info": {
|        "what": "The named views SecurityInsight ships for Security recommendations, Summary and Detailed (Critical and High, On Tier 0, Vulnerabilities (CVE), Known exploited, MITRE, Compliance, CVSS) that are hidden from the view picker for everyone.",
|        "whenChanged": "A view on the list is no longer offered in the picker of either page (critical-high, tier0, cve, exploited, mitre, compliance, cvss); summary:<view> or detailed:<view> hides it on one page only. Its address still opens it. The findings are unchanged.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "None hidden: every shipped view is in the picker",
|        "recommended": "Keep the default. Change it when: Hide a view your organisation does not use, so the picker shows only the ones people need.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_HiddenViews/"
|      }
|    },
|    {
|      "name": "SI_Pro_LifecycleStaleOpenRepair",
|      "label": "One-time repair of stale finding records",
|      "group": "Guards (safety checks)",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "off -- nothing is changed",
|      "description": "REMOVE-ME once it has run everywhere: the one-time repair of finding lifecycle rows left open or mislabelled before the empty-CI-id fix. off = nothing (the default); count = read only, the data sync's log says how many rows it would change and what they would become; apply = once, after a complete collection: an empty CI id becomes none, and a finding still open under an old asset key that the newest collection reports open under its CI closes as rekeyed. Nothing is deleted.",
|      "purpose": "A one-time clean-up of the finding history. Before a fix of October 2026, a finding that no CI held could be closed as no longer monitored when it had only moved to a CI, and such a finding could stay open under its old asset key. This repair puts those records right once.",
|      "effect": "off: nothing. count: nothing is changed; the data sync's log says how many finding records the repair would change and what they would become. apply: once, after a complete collection -- a record whose CI id is empty gets none (nothing visible changes), and a finding still open under an old asset key that the newest collection reports open under its CI is closed as rekeyed (the same finding, now under its CI; not a fix). Nothing is deleted; every other record goes through the usual rule.",
|      "whenToChange": "Only when support asks for it: first count, then apply. It is removed in a later release once it has run everywhere.",
|      "values": [
|        "off",
|        "count",
|        "apply"
|      ],
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "A one-time clean-up of the finding history. Before a fix of October 2026, a finding that no CI held could be closed as no longer monitored when it had only moved to a CI, and such a finding could stay open under its old asset key. This repair puts those records right once.",
|        "whenChanged": "off: nothing. count: nothing is changed; the data sync's log says how many finding records the repair would change and what they would become. apply: once, after a complete collection -- a record whose CI id is empty gets none (nothing visible changes), and a finding still open under an old asset key that the newest collection reports open under its CI is closed as rekeyed (the same finding, now under its CI; not a fix). Nothing is deleted; every other record goes through the usual rule.",
|        "risk": "count changes nothing. apply changes finding records once: an empty CI id is cleared, and a finding still open under an old asset key that is open under its CI is closed as rekeyed -- its CI's own record stays open, so no finding disappears from the open list; it only stops being counted twice. Not reversible by the setting (turning it off later does not reopen them); nothing is deleted.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off -- nothing is changed",
|        "recommended": "off; count first when support asks, then apply.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_LifecycleStaleOpenRepair/"
|      }
|    },
|    {
|      "name": "SI_Pro_Pipeline_FirstRunRestarts",
|      "label": "First collection: restarts of a failed step",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "2 restarts",
|      "description": "A new install's first collection: a step that fails or is stopped is started again at once -- it carries on from what it finished -- this many times. After that the run ends with a warning that names the step and who must act. Only the steps that collect, correlate and load the web app are started again; never a step that writes to a CMDB, to ServiceNow or to a ticket, and never after the first complete collection. 0 = a failed step is not started again.",
|      "purpose": "On a new install's first collection, a step that fails or is stopped is started again at once and carries on from what it finished, this many times. After that the run ends with a warning that names the step and who must act.",
|      "effect": "Higher tries more often before the first collection ends with a warning; 0 means a failed step is not started again. Only the steps that collect, correlate and load the web app are started again -- never a step that writes to a CMDB, to ServiceNow or to a ticket. It has no effect after the first complete collection.",
|      "whenToChange": "Leave it at 2. Set 0 only when a failed step of the first collection must be looked at before anything is started again.",
|      "unit": "restarts",
|      "min": 0,
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "On a new install's first collection, a step that fails or is stopped is started again at once and carries on from what it finished, this many times. After that the run ends with a warning that names the step and who must act.",
|        "whenChanged": "Higher tries more often before the first collection ends with a warning; 0 means a failed step is not started again. Only the steps that collect, correlate and load the web app are started again -- never a step that writes to a CMDB, to ServiceNow or to a ticket. It has no effect after the first complete collection.",
|        "risk": "0: a step that fails on a new install's first collection is not started again, so the first data arrives a run later. Higher: a step that cannot succeed is tried that many times more before the warning. Nothing is written to a CMDB, to ServiceNow or to a ticket by a restart, and nothing is closed. Reversible at once; it applies from the next run and only until the first complete collection.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "2 restarts",
|        "recommended": "Keep the default. Change it when: Leave it at 2. Set 0 only when a failed step of the first collection must be looked at before anything is started again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_Pipeline_FirstRunRestarts/"
|      }
|    },
|    {
|      "name": "SI_Pro_Pipeline_GoOnAfterFailedStep",
|      "label": "Failed step: show what was collected all the same",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On",
|      "description": "One failed step does not cost the rest of the run: when the correlation or Risk Analysis fails after the collections completed, the data sync and the verification still run on what is stored, so the web app shows what was collected. Nothing is closed, no ticket is changed and no mail is sent from such a run, and it is marked as not complete. $false = every step after a failed one waits for the next good run, as before.",
|      "purpose": "When the correlation or Risk Analysis fails after the collections completed, the data sync and the verification still run on what is stored, so the web app shows what was collected instead of nothing. The run is marked as not complete and says what is missing.",
|      "effect": "Off holds every step after a failed one until the next good run, as before: a new install then shows nothing until its first run completes. On or off, nothing is closed, no ticket is changed and no mail is sent from a run that is not complete.",
|      "whenToChange": "Leave it on. Turn it off only if the web app must never show data of a run in which a step failed.",
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "When the correlation or Risk Analysis fails after the collections completed, the data sync and the verification still run on what is stored, so the web app shows what was collected instead of nothing. The run is marked as not complete and says what is missing.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Off holds every step after a failed one until the next good run, as before: a new install then shows nothing until its first run completes. On or off, nothing is closed, no ticket is changed and no mail is sent from a run that is not complete.",
|        "risk": "Off: after one failed step the web app gets nothing from that run -- a new install stays empty until its first run completes. On: the web app shows what the completed collections brought, marked as not complete. Either way nothing is closed, no ticket is changed and no mail is sent from a run that is not complete. Reversible at once; it applies from the next run.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "On",
|        "recommended": "Keep the default. Change it when: Leave it on. Turn it off only if the web app must never show data of a run in which a step failed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_Pipeline_GoOnAfterFailedStep/"
|      }
|    },
|    {
|      "name": "SI_Pro_PublishPartialRun",
|      "label": "Show a run in which a report fell back to an earlier result",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Every page shows ONE run: the last run that completed in full. A run in which a report could not be completed and fell back to its last complete result is not shown either, and the pages keep the last complete run. $true = show such a run, marked \"a part of this run is from an earlier result\".",
|      "purpose": "Every page shows one run: the last run that completed in full. A run in which a report could not be completed and fell back to its last complete result is not shown by default -- the pages keep the last complete run, so nothing on a page is from two runs.",
|      "effect": "On: such a run is shown, marked \"a part of this run is from an earlier result\". Off: the pages keep the last complete run until a run completes in full.",
|      "whenToChange": "Leave it off. Turn it on only when a report keeps failing and the rest of the newest run must be shown all the same.",
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "Every page shows one run: the last run that completed in full. A run in which a report could not be completed and fell back to its last complete result is not shown by default -- the pages keep the last complete run, so nothing on a page is from two runs.",
|        "whenOn": "such a run is shown, marked \"a part of this run is from an earlier result\".",
|        "whenOff": "the pages keep the last complete run until a run completes in full.",
|        "risk": "On: a run in which a report fell back to its last complete result is shown, marked -- a page can then show a part from an earlier run. Off (the default): the pages keep the last complete run until a run completes in full, so a newer result can wait a day. Nothing is closed or sent by it. Reversible at once; it applies from the next run.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off",
|        "recommended": "Keep the default. Change it when: Leave it off. Turn it on only when a report keeps failing and the rest of the newest run must be shown all the same.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_PublishPartialRun/"
|      }
|    },
|    {
|      "name": "SI_Pro_Remediation_AutoSchedule",
|      "label": "Plan findings automatically (Auto in the maintenance window)",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "off -- findings are planned only when a person applies the flow on the finding's page",
|      "description": "REMEDIATION FLOWS (departments, phase 3): let the daily mail job plan every finding without a status whose flow is \"Auto in the maintenance window\" for the department's next window. Off by default. It records a planned state; it never changes Defender, Intune, Entra or Azure.",
|      "purpose": "Lets the daily mail job plan every finding that has no governance status yet and whose department's remediation flow is 'Auto in the maintenance window' for that department's next maintenance window.",
|      "effect": "When on, such findings get a 'planned' entry in their governance log (by SecurityInsight, with the window) and show as planned on the department page and in the technical owners' mails. SecurityInsight never pushes a change to Defender, Intune, Entra or Azure: the fix itself is made by the platform's own tooling, and the next collections show whether it worked. A department without a maintenance window gets nothing planned.",
|      "whenToChange": "Once the remediation flows and the departments' maintenance windows are set up and agreed.",
|      "card": "Overdue and planning",
|      "info": {
|        "what": "Lets the daily mail job plan every finding that has no governance status yet and whose department's remediation flow is 'Auto in the maintenance window' for that department's next maintenance window.",
|        "whenOn": "When on, such findings get a 'planned' entry in their governance log (by SecurityInsight, with the window) and show as planned on the department page and in the technical owners' mails. SecurityInsight never pushes a change to Defender, Intune, Entra or Azure: the fix itself is made by the platform's own tooling, and the next collections show whether it worked. A department without a maintenance window gets nothing planned.",
|        "whenOff": "- findings are planned only when a person applies the flow on the finding's page",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off -- findings are planned only when a person applies the flow on the finding's page",
|        "recommended": "Keep the default. Change it when: Once the remediation flows and the departments' maintenance windows are set up and agreed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_Remediation_AutoSchedule/"
|      }
|    },
|    {
|      "name": "SI_Pro_Responsibility_DefaultDepartment",
|      "label": "Default department",
|      "group": "Data & retention",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "none -- such assets go to the Unassigned queue",
|      "description": "The department an asset goes to when no override, tag or rule places it. Empty = the Unassigned queue.",
|      "purpose": "The department that receives every asset no override, tag or rule places.",
|      "effect": "With a default set, nothing is Unassigned: the default department sees and is reported on every unplaced asset. Without one, unplaced assets wait in the Unassigned triage view. A name that is not an active department counts as none.",
|      "whenToChange": "When one team (for example central IT) should own everything nobody else does.",
|      "card": "Which department owns an asset",
|      "info": {
|        "what": "The department that receives every asset no override, tag or rule places.",
|        "whenChanged": "With a default set, nothing is Unassigned: the default department sees and is reported on every unplaced asset. Without one, unplaced assets wait in the Unassigned triage view. A name that is not an active department counts as none.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "none -- such assets go to the Unassigned queue",
|        "recommended": "Keep the default. Change it when: When one team (for example central IT) should own everything nobody else does.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_Responsibility_DefaultDepartment/"
|      }
|    },
|    {
|      "name": "SI_Pro_Responsibility_OverdueDays",
|      "label": "Overdue after (days, per severity)",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Critical=15, High=30, Medium=90, Low=180",
|      "description": "When an open vulnerability counts as OVERDUE in the business owners' monthly report: days since it was first seen, per severity.",
|      "purpose": "When an open vulnerability counts as overdue in the business owners' monthly report, counted from when it was first seen.",
|      "effect": "Only the Overdue section of the monthly report changes; nothing is closed or escalated.",
|      "whenToChange": "To match the remediation targets your organisation has agreed.",
|      "card": "Overdue and planning",
|      "info": {
|        "what": "When an open vulnerability counts as overdue in the business owners' monthly report, counted from when it was first seen.",
|        "whenChanged": "Only the Overdue section of the monthly report changes; nothing is closed or escalated.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Critical=15, High=30, Medium=90, Low=180",
|        "recommended": "Keep the default. Change it when: To match the remediation targets your organisation has agreed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_Responsibility_OverdueDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_Responsibility_Sources",
|      "label": "Department sources, in order",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "tags, then rules",
|      "description": "ASSET RESPONSIBILITY (departments): where the data sync looks, in order, to decide which department an asset belongs to. 'tags' = the platform tags named below (Azure resource tags, Defender device tags, Entra attributes); 'rules' = the department rules defined on the web app (asset name, group, CMDB service, kind). Leave one out to switch it off. Overrides set on the web app always win; an asset nothing matches goes to the default department, else Unassigned.",
|      "purpose": "Where SecurityInsight looks to decide which department is responsible for an asset: the platform tags (tags) and the department rules defined on the web app (rules), in the order listed.",
|      "effect": "Changes which department owns which assets and findings. Every retained collection is re-resolved on the next data sync, so the department pages, trends and monthly reports follow the new order. Overrides set on the web app always win; an asset nothing places goes to the default department, else Unassigned. Leave a source out to switch it off.",
|      "whenToChange": "When your rules are more reliable than your tags (put rules first), or when one of the two is not used at all.",
|      "card": "Which department owns an asset",
|      "info": {
|        "what": "Where SecurityInsight looks to decide which department is responsible for an asset: the platform tags (tags) and the department rules defined on the web app (rules), in the order listed.",
|        "whenChanged": "Changes which department owns which assets and findings. Every retained collection is re-resolved on the next data sync, so the department pages, trends and monthly reports follow the new order. Overrides set on the web app always win; an asset nothing places goes to the default department, else Unassigned. Leave a source out to switch it off.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "tags, then rules",
|        "recommended": "Keep the default. Change it when: When your rules are more reliable than your tags (put rules first), or when one of the two is not used at all.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_Responsibility_Sources/"
|      }
|    },
|    {
|      "name": "SI_Pro_Responsibility_TagNames",
|      "label": "Tag names that name a department",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Department, Owner, CostCenter",
|      "description": "The tag names that name a department, earliest first. A tag's value matches a department by its name or one of its \"also matches\" values (e.g. a cost centre number). Defender tags count as Name:Value or Name=Value.",
|      "purpose": "The tag names whose value names the responsible department: Azure resource tags (and the subscription's), Defender device tags written as Name:Value, and the Entra Department attribute.",
|      "effect": "An asset whose tag value equals a department's name, or one of its 'also matches' values, is placed in that department; an earlier name wins over a later one. Every retained collection is re-resolved on the next data sync.",
|      "whenToChange": "When your organisation tags ownership under another name (for example BusinessUnit or cost-center).",
|      "card": "Which department owns an asset",
|      "info": {
|        "what": "The tag names whose value names the responsible department: Azure resource tags (and the subscription's), Defender device tags written as Name:Value, and the Entra Department attribute.",
|        "whenChanged": "An asset whose tag value equals a department's name, or one of its 'also matches' values, is placed in that department; an earlier name wins over a later one. Every retained collection is re-resolved on the next data sync.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Department, Owner, CostCenter",
|        "recommended": "Keep the default. Change it when: When your organisation tags ownership under another name (for example BusinessUnit or cost-center).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_Responsibility_TagNames/"
|      }
|    },
|    {
|      "name": "SI_Pro_SourceDropout_AssetDropAction",
|      "label": "Far fewer assets from a source: what to do",
|      "group": "Guards (safety checks)",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "confirm",
|      "description": "A collection that COMPLETES with far fewer assets than the last good one (down by SI_Pro_DataQuality_AssetDropPercent or more): confirm = keep the last good collection and accept the drop by itself when the next complete collection shows the same level (a real clean-up costs one run); accept = take it as it comes, the safety check only reports.",
|      "purpose": "What happens when a source's collection completes with far fewer assets than its last good collection (down by the data-quality asset drop limit or more). That can be a real clean-up, for example many Azure resources removed, or a source that answered only in part.",
|      "effect": "confirm: the last good collection is kept (nothing is marked not seen), the run goes on, and the drop is accepted by itself when the next complete collection of that source shows the same level -- a real clean-up takes effect one run later. accept: the collection is taken as it comes and the safety check only reports it.",
|      "whenToChange": "Set accept when large clean-ups are normal for you and must show at once.",
|      "values": [
|        "confirm",
|        "accept"
|      ],
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "What happens when a source's collection completes with far fewer assets than its last good collection (down by the data-quality asset drop limit or more). That can be a real clean-up, for example many Azure resources removed, or a source that answered only in part.",
|        "whenChanged": "confirm: the last good collection is kept (nothing is marked not seen), the run goes on, and the drop is accepted by itself when the next complete collection of that source shows the same level -- a real clean-up takes effect one run later. accept: the collection is taken as it comes and the safety check only reports it.",
|        "risk": "Accept: a source that answered only in part is taken as the truth at once -- the assets it no longer lists are marked not seen, and their CIs retire after the usual days. Confirm (the default) costs one run when a clean-up is real. Reversible at once; it applies from the next collection.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "confirm",
|        "recommended": "Keep the default. Change it when: Set accept when large clean-ups are normal for you and must show at once.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_SourceDropout_AssetDropAction/"
|      }
|    },
|    {
|      "name": "SI_Pro_SourceDropout_HoldDeliveryDays",
|      "label": "Source down: days until delivery waits",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "7 days",
|      "description": "A source whose collection fails does not stop the run: the calculation goes on with that source's last good collection, and every run says how old it is. When a source has had no good collection for this many days or more, delivery waits (no mail, no ticket change) until it collects again; the calculation still goes on. 0 = delivery never waits for a source.",
|      "purpose": "When the collection of one source (identities, Azure resources, endpoints, the public IP scan) fails, the run goes on with that source's last good collection and says how old it is. When a source has had no good collection for this many days or more, delivery waits: no mail is sent and no ticket is changed until that source collects again.",
|      "effect": "Lower makes delivery wait sooner; higher lets mails and ticket updates go out longer on older data. 0 means delivery never waits for a source. The calculation always goes on, and nothing is closed or retired because a source is down.",
|      "whenToChange": "Raise it when a source is known to be down for longer and the mails should keep going out meanwhile.",
|      "unit": "days",
|      "min": 0,
|      "max": 365,
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "When the collection of one source (identities, Azure resources, endpoints, the public IP scan) fails, the run goes on with that source's last good collection and says how old it is. When a source has had no good collection for this many days or more, delivery waits: no mail is sent and no ticket is changed until that source collects again.",
|        "whenChanged": "Lower makes delivery wait sooner; higher lets mails and ticket updates go out longer on older data. 0 means delivery never waits for a source. The calculation always goes on, and nothing is closed or retired because a source is down.",
|        "risk": "Higher, or 0: mails and ticket updates keep going out although one source's data is that many days old. Lower: delivery waits sooner when a source stays down. The calculation is never held by it, and nothing is closed or retired by it. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "7 days",
|        "recommended": "Keep the default. Change it when: Raise it when a source is known to be down for longer and the mails should keep going out meanwhile.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_SourceDropout_HoldDeliveryDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_TaskDigest_DueSoonDays",
|      "label": "Task reminder: due soon means within",
|      "group": "Mail & notifications",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "7",
|      "description": "How many days ahead the task digest counts an open task as due soon (0 to 60).",
|      "purpose": "How many days ahead the daily task digest counts an open task as due soon.",
|      "effect": "An open task due within this many days (or already overdue, or whose reminder day has come) is in the assignee's digest. 0 lists only overdue tasks, tasks due today and reminders.",
|      "whenToChange": "Shorten it when people find the digest too long; lengthen it for teams that plan further ahead.",
|      "unit": "days (0-60)",
|      "card": "Task reminders",
|      "needs": "SI_Pro_TaskDigest_SendMail",
|      "info": {
|        "what": "How many days ahead the daily task digest counts an open task as due soon.",
|        "whenChanged": "An open task due within this many days (or already overdue, or whose reminder day has come) is in the assignee's digest. 0 lists only overdue tasks, tasks due today and reminders.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"Daily task reminder to assignees\" is on. A SecurityInsight Pro licence.",
|        "default": "7",
|        "recommended": "Keep the default. Change it when: Shorten it when people find the digest too long; lengthen it for teams that plan further ahead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_TaskDigest_DueSoonDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_TaskDigest_SendMail",
|      "label": "Daily task reminder to assignees",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "off",
|      "description": "FOLLOW-UP TASKS: once a day, send each person who has open tasks that are overdue, due soon or whose reminder day has come ONE digest of them, with a link to each task. Off by default. Sent by the close-loop mail job through the same relay as the Risk Analysis mail.",
|      "purpose": "Once a day, mails each person whose follow-up tasks are overdue, due soon or have a reminder today.",
|      "effect": "When on, the daily close-loop mail job sends one digest per assignee per day (overdue first), through the same mail relay as the Risk Analysis mail, and records it so nobody gets two the same day; a day the relay fails is tried again on the next run. A task's mail address is the department person's or advisor's, or the one given when the task was created; a task without one gets no mail. Nobody with nothing due gets a mail.",
|      "whenToChange": "Once follow-up tasks are in use and people want a reminder without opening the web app.",
|      "card": "Task reminders",
|      "info": {
|        "what": "Once a day, mails each person whose follow-up tasks are overdue, due soon or have a reminder today.",
|        "whenOn": "When on, the daily close-loop mail job sends one digest per assignee per day (overdue first), through the same mail relay as the Risk Analysis mail, and records it so nobody gets two the same day; a day the relay fails is tried again on the next run. A task's mail address is the department person's or advisor's, or the one given when the task was created; a task without one gets no mail. Nobody with nothing due gets a mail.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off",
|        "recommended": "Keep the default. Change it when: Once follow-up tasks are in use and people want a reminder without opening the web app.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_TaskDigest_SendMail/"
|      }
|    },
|    {
|      "name": "SI_Pro_TechnicalReview_DayOfMonth",
|      "label": "Monthly review day (technical owners)",
|      "group": "Mail & notifications",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "1",
|      "description": "The day of the month (1 to 28) from which the technical owners' review of the previous month is sent.",
|      "purpose": "The day of the month from which the technical owners' review of the previous month is sent.",
|      "effect": "The review goes out on the first daily run on or after this day; a day the mail relay fails is retried the next day.",
|      "whenToChange": "To send it after your monthly patch window, so the review shows what the window fixed.",
|      "unit": "day of the month (1-28)",
|      "card": "Mails to departments",
|      "needs": "SI_Pro_TechnicalReview_SendMail",
|      "info": {
|        "what": "The day of the month from which the technical owners' review of the previous month is sent.",
|        "whenChanged": "The review goes out on the first daily run on or after this day; a day the mail relay fails is retried the next day.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"Monthly review to technical owners\" is on. A SecurityInsight Pro licence.",
|        "default": "1",
|        "recommended": "Keep the default. Change it when: To send it after your monthly patch window, so the review shows what the window fixed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_TechnicalReview_DayOfMonth/"
|      }
|    },
|    {
|      "name": "SI_Pro_TechnicalReview_SendMail",
|      "label": "Monthly review to technical owners",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "off",
|      "description": "Send each department's technical owners a monthly review (statuses, what is still seen after its window, what has no decision yet). Off by default. Sent by the close-loop mail job through the same relay as the Risk Analysis mail.",
|      "purpose": "Sends each department's technical owners a monthly mail to review their findings.",
|      "effect": "When on, the daily close-loop mail job sends each department its review of the previous month from the chosen day on, once per month, through the same mail relay as the Risk Analysis mail. Nothing is closed or changed by it.",
|      "whenToChange": "Once departments and their technical owners are set up and the governance log is in use.",
|      "card": "Mails to departments",
|      "info": {
|        "what": "Sends each department's technical owners a monthly mail to review their findings.",
|        "whenOn": "When on, the daily close-loop mail job sends each department its review of the previous month from the chosen day on, once per month, through the same mail relay as the Risk Analysis mail. Nothing is closed or changed by it.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off",
|        "recommended": "Keep the default. Change it when: Once departments and their technical owners are set up and the governance log is in use.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_TechnicalReview_SendMail/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_GraceDays_CloudResource",
|      "label": "Protection Score: accepted lifecycle for cloud resources (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days",
|      "description": "The protection score's accepted lifecycle for cloud resources (Azure), in days (default 30).",
|      "purpose": "The protection score's accepted lifecycle for cloud resources (Azure): how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A cloud resource patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|      "whenToChange": "Your patching or remediation process gives cloud resources a different grace (for example 14 days for identities).",
|      "card": "Protection score",
|      "info": {
|        "what": "The protection score's accepted lifecycle for cloud resources (Azure): how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A cloud resource patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "30 days",
|        "recommended": "Keep the default. Change it when: Your patching or remediation process gives cloud resources a different grace (for example 14 days for identities).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_GraceDays_CloudResource/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_GraceDays_Device",
|      "label": "Protection Score: accepted lifecycle for devices (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days",
|      "description": "The protection score (the share of active assets in good standing, 0-100, higher is better; the Executive overview, report, management mail and wall board): the accepted lifecycle -- days a Very High / High finding may be open before it counts in the \"within accepted lifecycle\" view -- per asset type. Default 30 each; 0 = the view equals the technical one.",
|      "purpose": "The protection score's accepted lifecycle for devices: how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A device patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|      "whenToChange": "Your patching or remediation process gives devices a different grace (for example 14 days for identities).",
|      "card": "Protection score",
|      "info": {
|        "what": "The protection score's accepted lifecycle for devices: how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A device patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "30 days",
|        "recommended": "Keep the default. Change it when: Your patching or remediation process gives devices a different grace (for example 14 days for identities).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_GraceDays_Device/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_GraceDays_Identity",
|      "label": "Protection Score: accepted lifecycle for identities (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days",
|      "description": "The protection score's accepted lifecycle for identities, in days (default 30).",
|      "purpose": "The protection score's accepted lifecycle for identities: how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A identity patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|      "whenToChange": "Your patching or remediation process gives identities a different grace (for example 14 days for identities).",
|      "card": "Protection score",
|      "info": {
|        "what": "The protection score's accepted lifecycle for identities: how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A identity patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "30 days",
|        "recommended": "Keep the default. Change it when: Your patching or remediation process gives identities a different grace (for example 14 days for identities).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_GraceDays_Identity/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_GraceDays_PublicIp",
|      "label": "Protection Score: accepted lifecycle for public IPs (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days",
|      "description": "The protection score's accepted lifecycle for public IP addresses, in days (default 30).",
|      "purpose": "The protection score's accepted lifecycle for public IP addresses: how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A public IP patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|      "whenToChange": "Your patching or remediation process gives public IPs a different grace (for example 14 days for identities).",
|      "card": "Protection score",
|      "info": {
|        "what": "The protection score's accepted lifecycle for public IP addresses: how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A public IP patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "30 days",
|        "recommended": "Keep the default. Change it when: Your patching or remediation process gives public IPs a different grace (for example 14 days for identities).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_GraceDays_PublicIp/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_OtherGraceDays_CloudResource",
|      "label": "Protection Score: grace for Azure findings (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "0 days: it counts from the day it is found",
|      "description": "The protection score's grace for findings on cloud resources (Azure) that are not patches, in days (default 0).",
|      "purpose": "How many days a Very High or High finding on a cloud resource that is not a patch (an Azure / Defender for Cloud recommendation, an attack path) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "0: such a finding is a risk from day one in both views. A higher number gives it a grace (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|      "whenToChange": "Your cloud team has an agreed time to fix recommendations (for example 30 days).",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "card": "Protection score",
|      "info": {
|        "what": "How many days a Very High or High finding on a cloud resource that is not a patch (an Azure / Defender for Cloud recommendation, an attack path) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "0: such a finding is a risk from day one in both views. A higher number gives it a grace (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "0 days: it counts from the day it is found",
|        "recommended": "Keep the default. Change it when: Your cloud team has an agreed time to fix recommendations (for example 30 days).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_OtherGraceDays_CloudResource/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_OtherGraceDays_Device",
|      "label": "Protection Score: grace for other device findings (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "0 days: it counts from the day it is found",
|      "description": "(#860) The accepted lifecycle above is for PATCH findings only (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle). Every other finding -- configuration, identity, Azure, attack paths -- has its own grace per asset type, in days; default 0 = it counts as a risk from the day it is found.",
|      "purpose": "How many days a Very High or High device finding that is NOT a patch (a configuration, an attack path, a vulnerability with no vendor fix) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "0: such a finding is a risk from day one in both views. A higher number gives it a grace like a patch's (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|      "whenToChange": "Your process accepts a time to fix configuration findings too (for example 14 days).",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "card": "Protection score",
|      "info": {
|        "what": "How many days a Very High or High device finding that is NOT a patch (a configuration, an attack path, a vulnerability with no vendor fix) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "0: such a finding is a risk from day one in both views. A higher number gives it a grace like a patch's (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "0 days: it counts from the day it is found",
|        "recommended": "Keep the default. Change it when: Your process accepts a time to fix configuration findings too (for example 14 days).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_OtherGraceDays_Device/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_OtherGraceDays_Identity",
|      "label": "Protection Score: grace for identity findings (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "0 days: it counts from the day it is found",
|      "description": "The protection score's grace for identity findings (not patches), in days (default 0).",
|      "purpose": "How many days a Very High or High identity finding (MFA, roles, sign-ins, attack paths -- anything that is not a patch) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "0: such a finding is a risk from day one in both views. A higher number gives it a grace (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|      "whenToChange": "Your identity team has an agreed time to fix (for example 7 days).",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "card": "Protection score",
|      "info": {
|        "what": "How many days a Very High or High identity finding (MFA, roles, sign-ins, attack paths -- anything that is not a patch) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "0: such a finding is a risk from day one in both views. A higher number gives it a grace (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "0 days: it counts from the day it is found",
|        "recommended": "Keep the default. Change it when: Your identity team has an agreed time to fix (for example 7 days).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_OtherGraceDays_Identity/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_OtherGraceDays_PublicIp",
|      "label": "Protection Score: grace for other public IP findings (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "0 days: it counts from the day it is found",
|      "description": "The protection score's grace for findings on public IPs that are not patches, in days (default 0).",
|      "purpose": "How many days a Very High or High finding on a public IP that is not a patch (an open port, an exposed service) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "0: such a finding is a risk from day one in both views. A higher number gives it a grace (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|      "whenToChange": "Your network team has an agreed time to close exposures.",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "card": "Protection score",
|      "info": {
|        "what": "How many days a Very High or High finding on a public IP that is not a patch (an open port, an exposed service) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "0: such a finding is a risk from day one in both views. A higher number gives it a grace (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "0 days: it counts from the day it is found",
|        "recommended": "Keep the default. Change it when: Your network team has an agreed time to close exposures.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_OtherGraceDays_PublicIp/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_Severities",
|      "label": "Protection score: severities that count",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Very High, Critical, High",
|      "description": "The severities that take an asset out of good standing. Default 'Very High,Critical,High'.",
|      "purpose": "The finding severities that take an asset out of good standing in the protection score.",
|      "effect": "An asset with an open, non-exempted finding of one of these severities is not in good standing. Separate with commas.",
|      "whenToChange": "Also count Medium findings, for a stricter score.",
|      "card": "Protection score",
|      "info": {
|        "what": "The finding severities that take an asset out of good standing in the protection score.",
|        "whenChanged": "An asset with an open, non-exempted finding of one of these severities is not in good standing. Separate with commas.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Very High, Critical, High",
|        "recommended": "Keep the default. Change it when: Also count Medium findings, for a stricter score.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_Severities/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_TierWeights",
|      "label": "Protection score: tier weights",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "8,4,2,1 (an unclassified asset weighs as Tier 3)",
|      "description": "The protection score's tier weights, Tier 0..3 (an unclassified asset weighs as Tier 3). Default '8,4,2,1'.",
|      "purpose": "How much an asset of each tier weighs in the protection score, Tier 0 to Tier 3, separated by commas.",
|      "effect": "A Tier 0 asset out of good standing lowers the score as much as eight Tier 3 assets with the default. Four numbers, 0 or more; anything else = the default.",
|      "whenToChange": "Your management weighs tiers differently.",
|      "card": "Protection score",
|      "info": {
|        "what": "How much an asset of each tier weighs in the protection score, Tier 0 to Tier 3, separated by commas.",
|        "whenChanged": "A Tier 0 asset out of good standing lowers the score as much as eight Tier 3 assets with the default. Four numbers, 0 or more; anything else = the default.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "8,4,2,1 (an unclassified asset weighs as Tier 3)",
|        "recommended": "Keep the default. Change it when: Your management weighs tiers differently.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_TierWeights/"
|      }
|    },
|    {
|      "name": "SI_PublicIp_DcrName",
|      "label": "Public IP data collection rule",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "dcr-si-publicip-profile",
|      "defaultText": "dcr-si-publicip-profile (the standard naming pattern).",
|      "description": "Data collection rule name the public-IP engine ingests its results through; defaults to dcr-si-publicip-profile.",
|      "purpose": "Names the data collection rule the public IP engine sends its results through.",
|      "effect": "Results are ingested through the named rule instead. A name that does not exist, or matches a rule from another install, makes ingestion fail or land in the wrong place.",
|      "whenToChange": "Only when a same-named rule from another install collides, or you deployed a uniquely named rule.",
|      "info": {
|        "what": "Names the data collection rule the public IP engine sends its results through.",
|        "whenChanged": "Results are ingested through the named rule instead. A name that does not exist, or matches a rule from another install, makes ingestion fail or land in the wrong place.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: publicip.",
|        "default": "dcr-si-publicip-profile (the standard naming pattern).",
|        "recommended": "Keep the default. Change it when: Only when a same-named rule from another install collides, or you deployed a uniquely named rule.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PublicIp_DcrName/"
|      }
|    },
|    {
|      "name": "SI_PublicIP_DiscoverySource",
|      "label": "Public IP discovery source",
|      "group": "Collection scope & limits",
|      "type": "enum",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": "profile-cl",
|      "defaultText": "profile-cl: public IPs of already classified servers, plus your extra targets.",
|      "description": "How to find IPs to scan. Three modes: 'profile-cl' (DEFAULT) -- Tier 0-N servers from SI_Endpoint_Profile_CL + SI_Azure_Profile_CL + customer extras. Preserves the legacy \"scan only IPs attached to assets we already classified\" behaviour. Recommended. 'arg-eg' -- ARG publicIPAddresses + EG NodeLabel + extras. Broader coverage; no per-IP tier or cmdb context. 'union' -- All sources merged. Maximum coverage; Profile_CL metadata wins on same-IP collisions.",
|      "purpose": "Chooses where the engine finds public IP addresses to check: classified assets (profile-cl), Azure and Defender inventory (arg-eg), or both (union).",
|      "effect": "arg-eg covers every Azure public IP and Defender node but without tier or CMDB context; union checks everything. Broader modes mean more addresses, longer runs and more Shodan lookups. Unknown values fall back to profile-cl.",
|      "whenToChange": "When you want Azure public IPs that are not attached to a classified asset to be checked too.",
|      "values": [
|        "profile-cl",
|        "arg-eg",
|        "union"
|      ],
|      "valueLabels": {
|        "profile-cl": "Classified servers (and your extra addresses)",
|        "arg-eg": "Azure and Defender inventory",
|        "union": "Both"
|      },
|      "card": "Public IP checks (Shodan)",
|      "info": {
|        "what": "Chooses where the engine finds public IP addresses to check: classified assets (profile-cl), Azure and Defender inventory (arg-eg), or both (union).",
|        "whenChanged": "arg-eg covers every Azure public IP and Defender node but without tier or CMDB context; union checks everything. Broader modes mean more addresses, longer runs and more Shodan lookups. Unknown values fall back to profile-cl.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "profile-cl: public IPs of already classified servers, plus your extra targets.",
|        "recommended": "Keep the default. Change it when: When you want Azure public IPs that are not attached to a classified asset to be checked too.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PublicIP_DiscoverySource/"
|      }
|    },
|    {
|      "name": "SI_PublicIP_ExtraTargets",
|      "label": "Extra public IPs to scan",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Empty: only discovered addresses are checked.",
|      "description": "Customer-supplied extra targets (partner / supply-chain IPs to monitor).",
|      "purpose": "A list of additional public IP addresses to check every run, such as partner or supply-chain addresses.",
|      "effect": "Listed addresses are always added to the candidate set and looked up in Shodan, adding a lookup per address. They carry no tier or CMDB details unless given in the public IP schema overlay file.",
|      "whenToChange": "When you want to watch external addresses you care about but that SecurityInsight cannot discover.",
|      "card": "Public IP checks (Shodan)",
|      "info": {
|        "what": "A list of additional public IP addresses to check every run, such as partner or supply-chain addresses.",
|        "whenChanged": "Listed addresses are always added to the candidate set and looked up in Shodan, adding a lookup per address. They carry no tier or CMDB details unless given in the public IP schema overlay file.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "Empty: only discovered addresses are checked.",
|        "recommended": "Keep the default. Change it when: When you want to watch external addresses you care about but that SecurityInsight cannot discover.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PublicIP_ExtraTargets/"
|      }
|    },
|    {
|      "name": "SI_PublicIp_TableName",
|      "label": "Public IP table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "SI_PublicIP_Profile",
|      "defaultText": "SI_PublicIP_Profile (stored as SI_PublicIP_Profile_CL).",
|      "description": "--- public IP --------------------------------------------------------------- Destination overrides (defaults: SI_PublicIP_Profile_CL via dcr-si-publicip-profile).",
|      "purpose": "Names the Log Analytics table the public IP engine writes to.",
|      "effect": "Results go to the named table. Reports, risk analysis and the web app read the standard name, so a different name hides public IP data from them.",
|      "whenToChange": "Practically never; keep the standard name.",
|      "info": {
|        "what": "Names the Log Analytics table the public IP engine writes to.",
|        "whenChanged": "Results go to the named table. Reports, risk analysis and the web app read the standard name, so a different name hides public IP data from them.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: publicip.",
|        "default": "SI_PublicIP_Profile (stored as SI_PublicIP_Profile_CL).",
|        "recommended": "Keep the default. Change it when: Practically never; keep the standard name.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PublicIp_TableName/"
|      }
|    },
|    {
|      "name": "SI_RA_ExcelExport_Detailed",
|      "label": "Excel workbook of the detailed report",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "The detailed workbook is off by default: the detailed results can hold millions of rows, and every row is in the web app.",
|      "purpose": "Whether a Risk Analysis detailed run writes its results to an Excel workbook. The detailed results can hold millions of rows; they are in the web app.",
|      "effect": "On: the detailed run writes its workbook, as long as the results are not larger than a workbook can hold here -- above that no workbook is written and the Settings page shows the switch greyed out. Off: no workbook is written; the mail says the results are in the web app. Every row is in the web app and in Log Analytics either way.",
|      "whenToChange": "Switch it on only when someone needs the detailed results as a file.",
|      "card": "Risk Analysis report mails",
|      "info": {
|        "what": "Whether a Risk Analysis detailed run writes its results to an Excel workbook. The detailed results can hold millions of rows; they are in the web app.",
|        "whenOn": "the detailed run writes its workbook, as long as the results are not larger than a workbook can hold here -- above that no workbook is written and the Settings page shows the switch greyed out.",
|        "whenOff": "no workbook is written; the mail says the results are in the web app. Every row is in the web app and in Log Analytics either way.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Off",
|        "recommended": "Keep the default. Change it when: Switch it on only when someone needs the detailed results as a file.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RA_ExcelExport_Detailed/"
|      }
|    },
|    {
|      "name": "SI_RA_ExcelExport_Summary",
|      "label": "Excel workbook of the summary report",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "The Excel workbook of each Risk Analysis report, on or off: the summary workbook is written, the detailed one is not (every row is in the web app). Above the size a workbook holds the detailed workbook is not written even when on.",
|      "purpose": "Whether a Risk Analysis summary run writes its results to an Excel workbook (attached to the summary mail when it fits).",
|      "effect": "On: the summary run writes its workbook. Off: no workbook is written; the mail says the results are in the web app. The results themselves are the same either way: every row is in the web app and in Log Analytics.",
|      "whenToChange": "Switch it off when nobody uses the summary workbook.",
|      "card": "Risk Analysis report mails",
|      "info": {
|        "what": "Whether a Risk Analysis summary run writes its results to an Excel workbook (attached to the summary mail when it fits).",
|        "whenOn": "the summary run writes its workbook.",
|        "whenOff": "no workbook is written; the mail says the results are in the web app. The results themselves are the same either way: every row is in the web app and in Log Analytics.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "Keep the default. Change it when: Switch it off when nobody uses the summary workbook.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RA_ExcelExport_Summary/"
|      }
|    },
|    {
|      "name": "SI_RA_Findings",
|      "label": "Copy findings per CI to Log Analytics (SI_Finding_CL)",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off: the findings per CI are kept in the database only",
|      "description": "--- Copy findings per CI to Log Analytics (SI_Finding_CL) -- optional, off by default --- After each Risk Analysis Detailed run, copies the de-duplicated findings (one row per CI and finding) into your Log Analytics workspace, for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages read the findings from its database. On a large estate the copy can take hours and adds ingestion cost. Not the report rows (SendToLogAnalytics, SI_RiskAnalysis_Detailed_CL).",
|      "purpose": "Optional. After each Risk Analysis Detailed run, copies the de-duplicated findings (one row per CI and finding) into your Log Analytics workspace, for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages read the findings from its database. On a large estate the copy can take hours and adds Log Analytics ingestion cost. Off by default.",
|      "effect": "On: at the end of every Risk Analysis Detailed run its findings per CI are also posted to SI_Finding_CL, and the run ends when the copy has ended. On a large estate that is hours, and it costs ingestion for every finding, every run. The data sync reads that copy back only when it is the newest and whole; otherwise it makes the findings per CI from the database, as it does with the copy off. Off: nothing is copied. This is not the Risk Analysis report rows (SI_RiskAnalysis_Detailed_CL): they are their own optional output, Copy Risk Analysis report rows to Log Analytics, off by default.",
|      "whenToChange": "Only when your own workbooks, Sentinel rules or KQL queries read SI_Finding_CL; leave off otherwise.",
|      "card": "Where collected data goes",
|      "hint": "Off = the findings per CI stay in the database. On = also a copy in Log Analytics (can take hours, costs ingestion).",
|      "info": {
|        "what": "Optional. After each Risk Analysis Detailed run, copies the de-duplicated findings (one row per CI and finding) into your Log Analytics workspace, for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages read the findings from its database. On a large estate the copy can take hours and adds Log Analytics ingestion cost. Off by default.",
|        "whenOn": "at the end of every Risk Analysis Detailed run its findings per CI are also posted to SI_Finding_CL, and the run ends when the copy has ended. On a large estate that is hours, and it costs ingestion for every finding, every run. The data sync reads that copy back only when it is the newest and whole; otherwise it makes the findings per CI from the database, as it does with the copy off.",
|        "whenOff": "nothing is copied. This is not the Risk Analysis report rows (SI_RiskAnalysis_Detailed_CL): they are their own optional output, Copy Risk Analysis report rows to Log Analytics, off by default.",
|        "risk": "Longer Risk Analysis Detailed runs and Log Analytics ingestion cost for every finding, every run. SecurityInsight itself does not need the copy. Reversible: turn it off and the next run copies nothing.",
|        "requires": "Nothing else.",
|        "default": "Off: the findings per CI are kept in the database only",
|        "recommended": "Off, unless your own workbooks, Sentinel rules or KQL read SI_Finding_CL.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RA_Findings/",
|        "confirmWhen": "on",
|        "confirm": "Every Risk Analysis Detailed run will also copy its findings per CI to Log Analytics (SI_Finding_CL). On a large estate the copy takes hours and the run ends only when it has ended; it adds ingestion cost."
|      }
|    },
|    {
|      "name": "SI_RA_PartsInParallel_Max",
|      "label": "Risk Analysis parts asked at a time (most)",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "6 (never more than 4 per processor core)",
|      "description": "The most parts of one Risk Analysis report asked from Defender at a time (the next parts' answers are on their way while a part is processed). Adapts by itself: starts at 2, more while Defender answers quickly, fewer when it asks to slow down. 1 = one part at a time.",
|      "purpose": "A large Risk Analysis report is asked from Microsoft Defender in parts. While one part is processed (risk scores, the database), the next parts are already asked, so Defender and SecurityInsight work at the same time. This is the most parts asked at a time.",
|      "effect": "The number adapts by itself: each report starts at 2, asks more while Defender answers quickly, and halves at once when Defender asks to slow down (it then waits as long as Defender says). A higher maximum lets a large report finish sooner when Defender keeps up; 1 asks one part at a time. The parts are processed in their order either way: the stored findings are the same.",
|      "whenToChange": "Most installs never should. Set 1 only if support asks you to; lower it if other tools in the tenant share Defender's advanced hunting limits.",
|      "unit": "parts",
|      "info": {
|        "what": "A large Risk Analysis report is asked from Microsoft Defender in parts. While one part is processed (risk scores, the database), the next parts are already asked, so Defender and SecurityInsight work at the same time. This is the most parts asked at a time.",
|        "whenChanged": "The number adapts by itself: each report starts at 2, asks more while Defender answers quickly, and halves at once when Defender asks to slow down (it then waits as long as Defender says). A higher maximum lets a large report finish sooner when Defender keeps up; 1 asks one part at a time. The parts are processed in their order either way: the stored findings are the same.",
|        "risk": "Only changes how many parts of a report are asked from Defender at a time, so how long Risk Analysis takes: 1 makes a large report take much longer; a higher number can make Defender ask SecurityInsight to slow down more often (it then does). The findings are the same either way. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "6 (never more than 4 per processor core)",
|        "recommended": "Keep 6 (the default).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RA_PartsInParallel_Max/"
|      }
|    },
|    {
|      "name": "SI_RA_SourceFirstSeen",
|      "label": "Read Defender's first sighting of each vulnerability",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On",
|      "description": "Risk Analysis reads Defender's software vulnerabilities export once per run (Vulnerability.Read.All) for the first time each CVE was seen on each device (si_source_first_seen; the protection score's accepted-lifecycle view ages findings by it). on | off. Default on.",
|      "purpose": "Risk Analysis reads Defender for Endpoint's software vulnerabilities export once per run for the first time each CVE was seen on each device (si_source_first_seen).",
|      "effect": "The protection score's \"within Accepted Lifecycle\" view ages a vulnerability by Defender's own first sighting instead of SecurityInsight's first detection. Off: the export is not read and the vulnerability findings carry no source first-seen.",
|      "whenToChange": "Turn it off only when the export takes too long or the permission Vulnerability.Read.All is not granted.",
|      "card": "Protection score",
|      "info": {
|        "what": "Risk Analysis reads Defender for Endpoint's software vulnerabilities export once per run for the first time each CVE was seen on each device (si_source_first_seen).",
|        "whenChanged": "The protection score's \"within Accepted Lifecycle\" view ages a vulnerability by Defender's own first sighting instead of SecurityInsight's first detection. Off: the export is not read and the vulnerability findings carry no source first-seen.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "Keep the default. Change it when: Turn it off only when the export takes too long or the permission Vulnerability.Read.All is not granted.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RA_SourceFirstSeen/"
|      }
|    },
|    {
|      "name": "SI_RA_StaleDeviceFilter",
|      "label": "Risk Analysis stale device filter",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: no devices are filtered out",
|      "description": "'off' (default)|'lenient'|'strict'",
|      "purpose": "Optionally removes devices not seen recently from the heavy attack-path Risk Analysis reports: off, lenient or strict.",
|      "effect": "lenient drops devices last seen longer ago than SI_ActiveStaleDays; strict also drops devices with no last-seen date. Smaller, faster reports, but findings on those devices are hidden.",
|      "whenToChange": "Only if attack-path reports are swamped by devices that no longer exist.",
|      "info": {
|        "what": "Optionally removes devices not seen recently from the heavy attack-path Risk Analysis reports: off, lenient or strict.",
|        "whenChanged": "lenient drops devices last seen longer ago than SI_ActiveStaleDays; strict also drops devices with no last-seen date. Smaller, faster reports, but findings on those devices are hidden.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Off: no devices are filtered out",
|        "recommended": "Keep the default. Change it when: Only if attack-path reports are swamped by devices that no longer exist.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RA_StaleDeviceFilter/"
|      }
|    },
|    {
|      "name": "SI_RATop50_BlobContainer",
|      "label": "Shared top-50 cache container",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "sistaging",
|      "description": "Where the shared Top-50 asset cache lives. Unused in 'PerReport' mode.",
|      "purpose": "The storage container holding the shared top-50 risk summary, so several hosts or containers reuse one summary instead of each building it.",
|      "effect": "The shared summary is read from and written to this container in the staging storage account. Hosts pointing at different containers each build their own summary.",
|      "whenToChange": "Practically never; only if the staging container was renamed.",
|      "info": {
|        "what": "The storage container holding the shared top-50 risk summary, so several hosts or containers reuse one summary instead of each building it.",
|        "whenChanged": "The shared summary is read from and written to this container in the staging storage account. Hosts pointing at different containers each build their own summary.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "sistaging",
|        "recommended": "Keep the default. Change it when: Practically never; only if the staging container was renamed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RATop50_BlobContainer/"
|      }
|    },
|    {
|      "name": "SI_RATop50_BlobName",
|      "label": "Shared top-50 cache file",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "risk-analysis/RiskAnalysis_Top50_Shared.json",
|      "description": "Blob path of the shared top-50 risk cache, so several hosts or containers reuse one AI summary instead of each building it; defaults to risk-analysis/RiskAnalysis_Top50_Shared.json.",
|      "purpose": "The file path, inside the container, of the shared top-50 risk summary that several hosts or containers reuse.",
|      "effect": "The shared summary is stored under this path. Hosts using different paths each build their own summary, which costs extra time and AI calls.",
|      "whenToChange": "Practically never; only to keep separate installs from sharing one summary.",
|      "info": {
|        "what": "The file path, inside the container, of the shared top-50 risk summary that several hosts or containers reuse.",
|        "whenChanged": "The shared summary is stored under this path. Hosts using different paths each build their own summary, which costs extra time and AI calls.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "risk-analysis/RiskAnalysis_Top50_Shared.json",
|        "recommended": "Keep the default. Change it when: Practically never; only to keep separate installs from sharing one summary.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RATop50_BlobName/"
|      }
|    },
|    {
|      "name": "SI_RebuildAuthBlock",
|      "label": "Re-pull sign-in from Key Vault",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: existing credentials are kept and only tested",
|      "description": "Force Bootstrap-Auth.ps1 to re-pull from KV even when SI_SPN_AppId is already present in this file (rotates a leaked secret from the vault).",
|      "purpose": "Makes the authentication setup script re-read service principal credentials from Key Vault and rewrite them, even when they are already in the configuration file.",
|      "effect": "When on, the next setup run replaces the sign-in block in your configuration file with fresh values from Key Vault, for example after rotating a secret.",
|      "whenToChange": "Only after rotating or replacing the service principal credential in Key Vault.",
|      "setupOnly": true,
|      "info": {
|        "what": "Makes the authentication setup script re-read service principal credentials from Key Vault and rewrite them, even when they are already in the configuration file.",
|        "whenOn": "When on, the next setup run replaces the sign-in block in your configuration file with fresh values from Key Vault, for example after rotating a secret.",
|        "whenOff": "existing credentials are kept and only tested",
|        "risk": "The next setup run REPLACES the sign-in block in your configuration file with fresh values from Key Vault. Wrong Key Vault values stop every run until corrected. Reversible from a configuration backup.",
|        "requires": "Nothing else.",
|        "default": "Off: existing credentials are kept and only tested",
|        "recommended": "Off; on once after rotating a secret.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RebuildAuthBlock/",
|        "confirmWhen": "on",
|        "confirm": "When on, the next setup run replaces the sign-in block in your configuration file with fresh values from Key Vault, for example after rotating a secret. The next setup run REPLACES the sign-in block in your configuration file with fresh values from Key Vault. Wrong Key Vault values stop every run until corrected. Reversible from a configuration backup."
|      }
|    },
|    {
|      "name": "SI_RequireMdeActive_Endpoint",
|      "label": "Only Defender-active endpoints",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: a device seen recently by Defender, Exposure Management or Entra is kept",
|      "description": "TIGHTEN: MDE-active only",
|      "purpose": "Narrows the endpoint inventory to devices that Defender for Endpoint reports as active or recently seen.",
|      "effect": "On drops devices known only to Exposure Management or Entra, such as some Azure VMs, personal and IoT devices: fewer rows, but less coverage. Ignored when SI_IncludeInactive_Endpoint is on.",
|      "whenToChange": "Only if you want the inventory to match the Defender portal's active device list.",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Narrows the endpoint inventory to devices that Defender for Endpoint reports as active or recently seen.",
|        "whenOn": "On drops devices known only to Exposure Management or Entra, such as some Azure VMs, personal and IoT devices: fewer rows, but less coverage. Ignored when SI_IncludeInactive_Endpoint is on.",
|        "whenOff": "a device seen recently by Defender, Exposure Management or Entra is kept",
|        "risk": "Drops every device known only to Exposure Management or Entra (some Azure VMs, personal and IoT devices): those devices disappear from profiles and reports, and their exposure with them. Reversible: the next run includes them again.",
|        "requires": "Nothing else.",
|        "default": "Off: a device seen recently by Defender, Exposure Management or Entra is kept",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RequireMdeActive_Endpoint/",
|        "confirmWhen": "on",
|        "confirm": "On drops devices known only to Exposure Management or Entra, such as some Azure VMs, personal and IoT devices: fewer rows, but less coverage. Ignored when SI_IncludeInactive_Endpoint is on. Drops every device known only to Exposure Management or Entra (some Azure VMs, personal and IoT devices): those devices disappear from profiles and reports, and their exposure with them. Reversible: the next run includes them again."
|      }
|    },
|    {
|      "name": "SI_RequireRecentSignIn_Identity",
|      "label": "Require recent identity sign-in",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: identities without recent or available sign-in data are still published",
|      "description": "--- identity engine --------------------------------------------------------- 3.0 includes identities whose sign-in history is unavailable. $true restores the 2.2 rule: a sign-in within SI_ActiveStaleDays is REQUIRED (fewer identities, and any without sign-in data are excluded).",
|      "purpose": "Restores the older, stricter rule that an identity must have signed in recently to be published.",
|      "effect": "On also drops every identity without a sign-in within SI_ActiveStaleDays, including ones whose sign-in history is unavailable: fewer rows, but real accounts may be missing.",
|      "whenToChange": "Only if you need the behaviour of the previous major version.",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Restores the older, stricter rule that an identity must have signed in recently to be published.",
|        "whenOn": "On also drops every identity without a sign-in within SI_ActiveStaleDays, including ones whose sign-in history is unavailable: fewer rows, but real accounts may be missing.",
|        "whenOff": "identities without recent or available sign-in data are still published",
|        "risk": "Drops every identity without a recent or available sign-in, including privileged accounts that are rarely used: they disappear from profiles and reports. Reversible: the next run includes them again.",
|        "requires": "Nothing else.",
|        "default": "Off: identities without recent or available sign-in data are still published",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RequireRecentSignIn_Identity/",
|        "confirmWhen": "on",
|        "confirm": "On also drops every identity without a sign-in within SI_ActiveStaleDays, including ones whose sign-in history is unavailable: fewer rows, but real accounts may be missing. Drops every identity without a recent or available sign-in, including privileged accounts that are rarely used: they disappear from profiles and reports. Reversible: the next run includes them again."
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_BuildSummaryByAI",
|      "label": "AI summary in the report mail (container jobs)",
|      "group": "AI",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the jobs follow your general AI summary setting, otherwise off.",
|      "description": "When on, the risk-analysis container job asks Azure OpenAI to write an AI summary of the findings; off by default.",
|      "purpose": "Decides whether the risk-analysis container jobs ask Azure OpenAI to write a summary of the findings.",
|      "effect": "When on, each report run makes AI calls, adding cost and run time; the run stops if Azure OpenAI details are missing. When off, reports have no AI summary.",
|      "whenToChange": "When you want AI-written summaries in scheduled container reports.",
|      "card": "Where AI is used",
|      "hint": "When the reports run as container jobs.",
|      "setupOnly": true,
|      "info": {
|        "what": "Decides whether the risk-analysis container jobs ask Azure OpenAI to write a summary of the findings.",
|        "whenOn": "When on, each report run makes AI calls, adding cost and run time; the run stops if Azure OpenAI details are missing. When off, reports have no AI summary.",
|        "whenOff": "Not set: the jobs follow your general AI summary setting, otherwise off.",
|        "risk": "Report content is sent to YOUR Azure OpenAI deployment for a summary, and each run costs; a run stops if Azure OpenAI is not configured. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: the jobs follow your general AI summary setting, otherwise off.",
|        "recommended": "As your organisation prefers.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_BuildSummaryByAI/",
|        "confirmWhen": "on",
|        "confirm": "When on, each report run makes AI calls, adding cost and run time; the run stops if Azure OpenAI details are missing. When off, reports have no AI summary. Report content is sent to YOUR Azure OpenAI deployment for a summary, and each run costs; a run stops if Azure OpenAI is not configured. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_DceIngestionUri",
|      "label": "Risk analysis ingestion address",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Falls back to SI_DceIngestionUri, else found automatically from the endpoint name.",
|      "description": "auto-resolved from DceName -- rarely set explicitly",
|      "purpose": "The data collection endpoint address risk analysis sends its results to in Log Analytics.",
|      "effect": "Forces results to this address. A wrong address makes Log Analytics ingestion fail; the Excel and JSON output are still written.",
|      "whenToChange": "Rarely; only when the address cannot be found automatically.",
|      "info": {
|        "what": "The data collection endpoint address risk analysis sends its results to in Log Analytics.",
|        "whenChanged": "Forces results to this address. A wrong address makes Log Analytics ingestion fail; the Excel and JSON output are still written.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Falls back to SI_DceIngestionUri, else found automatically from the endpoint name.",
|        "recommended": "Keep the default. Change it when: Rarely; only when the address cannot be found automatically.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_DceIngestionUri/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_DceName",
|      "label": "Risk analysis collection endpoint",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Falls back to SI_DceName, then DceName, then the standard SecurityInsight endpoint name.",
|      "description": "override: falls back to $global:DceName",
|      "purpose": "Names the data collection endpoint risk analysis uses for its Log Analytics results.",
|      "effect": "Risk analysis ingests through the named endpoint instead of the shared one. A wrong name makes ingestion fail; local output is still written.",
|      "whenToChange": "Only when risk analysis must use a different endpoint than the other engines.",
|      "info": {
|        "what": "Names the data collection endpoint risk analysis uses for its Log Analytics results.",
|        "whenChanged": "Risk analysis ingests through the named endpoint instead of the shared one. A wrong name makes ingestion fail; local output is still written.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Falls back to SI_DceName, then DceName, then the standard SecurityInsight endpoint name.",
|        "recommended": "Keep the default. Change it when: Only when risk analysis must use a different endpoint than the other engines.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_DceName/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_DcrName_Detailed",
|      "label": "Detailed report data collection rule",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "dcr-si-risk-analysis-detailed",
|      "description": "Data collection rule name used to send Detailed risk-analysis rows to Log Analytics; defaults to dcr-si-risk-analysis-detailed.",
|      "purpose": "The name of the data collection rule the detailed Risk Analysis rows are sent through to Log Analytics.",
|      "effect": "Detailed rows are sent through the named rule. A wrong name makes the detailed report ingest fail.",
|      "whenToChange": "Only if you renamed the rule or must avoid a name clash with another install.",
|      "info": {
|        "what": "The name of the data collection rule the detailed Risk Analysis rows are sent through to Log Analytics.",
|        "whenChanged": "Detailed rows are sent through the named rule. A wrong name makes the detailed report ingest fail.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "dcr-si-risk-analysis-detailed",
|        "recommended": "Keep the default. Change it when: Only if you renamed the rule or must avoid a name clash with another install.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_DcrName_Detailed/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_DcrName_Summary",
|      "label": "Summary report data collection rule",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "dcr-si-risk-analysis-summary",
|      "description": "Data collection rule name used to send Summary risk-analysis rows to Log Analytics; defaults to dcr-si-risk-analysis-summary.",
|      "purpose": "The name of the data collection rule the summary Risk Analysis rows are sent through to Log Analytics.",
|      "effect": "Summary rows are sent through the named rule. A wrong name makes the summary report ingest fail.",
|      "whenToChange": "Only if you renamed the rule or must avoid a name clash with another install.",
|      "info": {
|        "what": "The name of the data collection rule the summary Risk Analysis rows are sent through to Log Analytics.",
|        "whenChanged": "Summary rows are sent through the named rule. A wrong name makes the summary report ingest fail.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "dcr-si-risk-analysis-summary",
|        "recommended": "Keep the default. Change it when: Only if you renamed the rule or must avoid a name clash with another install.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_DcrName_Summary/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_DcrResourceGroup",
|      "label": "Risk Analysis rule resource group",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Uses SI_DcrResourceGroup (then DcrResourceGroup); if none is set, the standard SecurityInsight rules group.",
|      "description": "Two DCRs (one per table) -- HARDCODED in the engine ('dcr-si-risk-analysis-summary' + 'dcr-si-risk-analysis-detailed'); customer doesn't pick the names. EVERYTHING AUTO-RESOLVES. The solution-wide shared defaults (Layer 0, SecurityInsight.shared-defaults.ps1 in _lib) set $global:WorkspaceName, $global:DceName, $global:DceResourceGroup, $global:DcrResourceGroup to the canonical SecurityInsight layout. The engine auto-creates anything missing (workspace, DCE, DCE RG, DCR RG) and assigns the SPN the roles it needs. SI_RiskAnalysis_* per-engine overrides win over the shared short names. Only set them if this engine needs to deviate from the solution baseline.",
|      "purpose": "Resource group holding the data collection rules Risk Analysis uses to send its results to Log Analytics, when it should differ from the solution-wide one.",
|      "effect": "Risk Analysis looks up, and creates if missing, its two collection rules in this resource group. A wrong group means new rules are created there, separate from the rest of the solution.",
|      "whenToChange": "Rarely; only when Risk Analysis must ingest through rules kept apart from the other engines.",
|      "info": {
|        "what": "Resource group holding the data collection rules Risk Analysis uses to send its results to Log Analytics, when it should differ from the solution-wide one.",
|        "whenChanged": "Risk Analysis looks up, and creates if missing, its two collection rules in this resource group. A wrong group means new rules are created there, separate from the rest of the solution.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Uses SI_DcrResourceGroup (then DcrResourceGroup); if none is set, the standard SecurityInsight rules group.",
|        "recommended": "Keep the default. Change it when: Rarely; only when Risk Analysis must ingest through rules kept apart from the other engines.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_DcrResourceGroup/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_ExportContainer",
|      "label": "Report storage container",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "sistaging",
|      "description": "Storage container the risk-analysis container job saves its Excel and JSON reports to; defaults to sistaging.",
|      "purpose": "The storage container in your staging storage account where the risk-analysis container jobs save their reports.",
|      "effect": "Reports are saved to this container. It is ignored when a full export destination is set, or when no staging storage account is configured.",
|      "whenToChange": "Only if reports must be kept apart from the staging data.",
|      "setupOnly": true,
|      "info": {
|        "what": "The storage container in your staging storage account where the risk-analysis container jobs save their reports.",
|        "whenChanged": "Reports are saved to this container. It is ignored when a full export destination is set, or when no staging storage account is configured.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "sistaging",
|        "recommended": "Keep the default. Change it when: Only if reports must be kept apart from the staging data.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_ExportContainer/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_ExportDestination",
|      "label": "Risk Analysis report export location",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Built at setup from the staging storage account, folder risk-analysis in the staging container.",
|      "description": "Full storage URL the risk-analysis container job saves its reports to; when empty it is built from the storage account, export container and export prefix.",
|      "purpose": "Storage URL where container-hosted Risk Analysis jobs save their report workbooks and data files.",
|      "effect": "Read by container setup and passed to the Risk Analysis jobs. Reports are uploaded to this URL instead; the identity must be able to write there. On a server install the ExportDestination setting is used instead.",
|      "whenToChange": "When reports must land in a different storage account or container. Re-run setup for it to take effect.",
|      "setupOnly": true,
|      "info": {
|        "what": "Storage URL where container-hosted Risk Analysis jobs save their report workbooks and data files.",
|        "whenChanged": "Read by container setup and passed to the Risk Analysis jobs. Reports are uploaded to this URL instead; the identity must be able to write there. On a server install the ExportDestination setting is used instead.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Built at setup from the staging storage account, folder risk-analysis in the staging container.",
|        "recommended": "Keep the default. Change it when: When reports must land in a different storage account or container. Re-run setup for it to take effect.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_ExportDestination/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_ExportPrefix",
|      "label": "Report storage folder",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "risk-analysis",
|      "description": "Folder inside the export container where the risk-analysis container job saves its reports; defaults to risk-analysis.",
|      "purpose": "The folder inside the report storage container where the risk-analysis container jobs save their reports.",
|      "effect": "Reports are saved under this folder; empty saves them at the container's top level. Ignored when a full export destination is set.",
|      "whenToChange": "Only if your report readers expect another folder.",
|      "setupOnly": true,
|      "info": {
|        "what": "The folder inside the report storage container where the risk-analysis container jobs save their reports.",
|        "whenChanged": "Reports are saved under this folder; empty saves them at the container's top level. Ignored when a full export destination is set.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "risk-analysis",
|        "recommended": "Keep the default. Change it when: Only if your report readers expect another folder.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_ExportPrefix/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_Mode",
|      "label": "Container report mode",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Summary",
|      "description": "Whether the scheduled risk-analysis container job produces the Summary or the Detailed report; must be Summary or Detailed and defaults to Summary.",
|      "purpose": "Summary or Detailed, for the scheduled Summary report job; used only when the report template's name does not say which.",
|      "effect": "Decides which report and Log Analytics table the job uses when a custom template does not name its mode. With the shipped templates the template decides and this has no effect; a separate job builds the Detailed report.",
|      "whenToChange": "Only with a custom report template whose name contains neither Summary nor Detailed.",
|      "setupOnly": true,
|      "info": {
|        "what": "Summary or Detailed, for the scheduled Summary report job; used only when the report template's name does not say which.",
|        "whenChanged": "Decides which report and Log Analytics table the job uses when a custom template does not name its mode. With the shipped templates the template decides and this has no effect; a separate job builds the Detailed report.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Summary",
|        "recommended": "Keep the default. Change it when: Only with a custom report template whose name contains neither Summary nor Detailed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_Mode/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_ReportTemplate",
|      "label": "Container summary report template",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Your default Summary template if set, otherwise the shipped Summary template",
|      "description": "RiskAnalysis-in-container knobs.",
|      "purpose": "The report template the scheduled Summary risk-analysis container job uses.",
|      "effect": "The Summary job builds this template instead. A Detailed template here makes that job build a Detailed report.",
|      "whenToChange": "When the scheduled Summary job should use your own template.",
|      "setupOnly": true,
|      "info": {
|        "what": "The report template the scheduled Summary risk-analysis container job uses.",
|        "whenChanged": "The Summary job builds this template instead. A Detailed template here makes that job build a Detailed report.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Your default Summary template if set, otherwise the shipped Summary template",
|        "recommended": "Keep the default. Change it when: When the scheduled Summary job should use your own template.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_ReportTemplate/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_SendToLogAnalytics",
|      "label": "Copy Risk Analysis report rows to Log Analytics (container jobs, at setup)",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the jobs follow Copy Risk Analysis report rows to Log Analytics, which is off by default.",
|      "description": "When on, the risk-analysis container jobs are made with the copy of their report rows to Log Analytics switched on; not set = they follow Copy Risk Analysis report rows to Log Analytics, off by default.",
|      "purpose": "Optional, at setup only: whether the Risk Analysis container jobs are made with the copy of their report rows to Log Analytics (SI_RiskAnalysis_Detailed_CL) switched on. SecurityInsight itself does not need it: its pages read the results from its database. Off by default.",
|      "effect": "On: the jobs are made with the copy on (see Copy Risk Analysis report rows to Log Analytics). Not set or off: the jobs follow that setting, off by default.",
|      "whenToChange": "Only when your own workbooks, Sentinel rules or KQL read the report rows in Log Analytics; leave it not set otherwise.",
|      "card": "Report mode and output",
|      "hint": "When the reports run as container jobs.",
|      "setupOnly": true,
|      "info": {
|        "what": "Optional, at setup only: whether the Risk Analysis container jobs are made with the copy of their report rows to Log Analytics (SI_RiskAnalysis_Detailed_CL) switched on. SecurityInsight itself does not need it: its pages read the results from its database. Off by default.",
|        "whenOn": "the jobs are made with the copy on (see Copy Risk Analysis report rows to Log Analytics). Not set or off: the jobs follow that setting, off by default.",
|        "whenOff": "Not set: the jobs follow Copy Risk Analysis report rows to Log Analytics, which is off by default.",
|        "risk": "Log Analytics ingestion cost for every report row, every run. SecurityInsight itself does not need the copy. Reversible: Copy Risk Analysis report rows to Log Analytics turns it off again.",
|        "requires": "Nothing else.",
|        "default": "Not set: the jobs follow Copy Risk Analysis report rows to Log Analytics, which is off by default.",
|        "recommended": "Not set (off).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_SendToLogAnalytics/",
|        "confirmWhen": "on",
|        "confirm": "The Risk Analysis jobs made at setup will copy their report rows to Log Analytics after every run; it adds ingestion cost."
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_TableName_Detailed",
|      "label": "Detailed Risk Analysis table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "SI_RiskAnalysis_Detailed",
|      "defaultText": "SI_RiskAnalysis_Detailed (stored as SI_RiskAnalysis_Detailed_CL).",
|      "description": "Log Analytics table that receives Detailed risk-analysis rows; defaults to SI_RiskAnalysis_Detailed.",
|      "purpose": "Name of the Log Analytics table that receives rows from the Detailed Risk Analysis report.",
|      "effect": "Detailed results are written to a different table. Workbooks, queries and the trend engine that read the standard table will no longer see new data unless they are changed too.",
|      "whenToChange": "Almost never; only to avoid a clash with an existing table of the same name.",
|      "info": {
|        "what": "Name of the Log Analytics table that receives rows from the Detailed Risk Analysis report.",
|        "whenChanged": "Detailed results are written to a different table. Workbooks, queries and the trend engine that read the standard table will no longer see new data unless they are changed too.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "SI_RiskAnalysis_Detailed (stored as SI_RiskAnalysis_Detailed_CL).",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a clash with an existing table of the same name.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_TableName_Detailed/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_TableName_Summary",
|      "label": "Summary Risk Analysis table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "SI_RiskAnalysis_Summary",
|      "defaultText": "SI_RiskAnalysis_Summary (stored as SI_RiskAnalysis_Summary_CL).",
|      "description": "Custom table base names (engine appends _CL when LA creates the table).",
|      "purpose": "Name of the Log Analytics table that receives rows from the Summary Risk Analysis report.",
|      "effect": "Summary results are written to a different table. Anything reading the standard table, such as workbooks, queries and trend, stops seeing new data unless changed too.",
|      "whenToChange": "Almost never; only to avoid a clash with an existing table of the same name.",
|      "info": {
|        "what": "Name of the Log Analytics table that receives rows from the Summary Risk Analysis report.",
|        "whenChanged": "Summary results are written to a different table. Anything reading the standard table, such as workbooks, queries and trend, stops seeing new data unless changed too.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "SI_RiskAnalysis_Summary (stored as SI_RiskAnalysis_Summary_CL).",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a clash with an existing table of the same name.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_TableName_Summary/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_WorkspaceName",
|      "label": "Risk Analysis workspace name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Uses SI_WorkspaceName (then WorkspaceName); if none, the standard SecurityInsight workspace name.",
|      "description": "override: falls back to $global:WorkspaceName",
|      "purpose": "Name of the Log Analytics workspace Risk Analysis writes its results to, when it should differ from the solution-wide workspace.",
|      "effect": "Risk Analysis results go to this workspace, which is created if it does not exist. Ignored when SI_RiskAnalysis_WorkspaceResourceId or a workspace resource id is set.",
|      "whenToChange": "Only when Risk Analysis results must go to a separate workspace from collection data.",
|      "info": {
|        "what": "Name of the Log Analytics workspace Risk Analysis writes its results to, when it should differ from the solution-wide workspace.",
|        "whenChanged": "Risk Analysis results go to this workspace, which is created if it does not exist. Ignored when SI_RiskAnalysis_WorkspaceResourceId or a workspace resource id is set.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Uses SI_WorkspaceName (then WorkspaceName); if none, the standard SecurityInsight workspace name.",
|        "recommended": "Keep the default. Change it when: Only when Risk Analysis results must go to a separate workspace from collection data.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_WorkspaceName/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_WorkspaceResourceGroup",
|      "label": "Risk Analysis workspace resource group",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Uses WorkspaceResourceGroup; if not set, the standard SecurityInsight resource group.",
|      "description": "override: falls back to $global:WorkspaceResourceGroup",
|      "purpose": "Resource group used to find or create the Risk Analysis workspace when it is given by name.",
|      "effect": "Changes where Risk Analysis looks for, and creates, its workspace when only a workspace name is known. Has no effect when a full workspace resource id is set.",
|      "whenToChange": "Only with SI_RiskAnalysis_WorkspaceName, when that workspace lives in a different resource group.",
|      "info": {
|        "what": "Resource group used to find or create the Risk Analysis workspace when it is given by name.",
|        "whenChanged": "Changes where Risk Analysis looks for, and creates, its workspace when only a workspace name is known. Has no effect when a full workspace resource id is set.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Uses WorkspaceResourceGroup; if not set, the standard SecurityInsight resource group.",
|        "recommended": "Keep the default. Change it when: Only with SI_RiskAnalysis_WorkspaceName, when that workspace lives in a different resource group.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_WorkspaceResourceGroup/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_WorkspaceResourceId",
|      "label": "Risk Analysis workspace resource id",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Uses SI_WorkspaceResourceId (then WorkspaceResourceId); otherwise the workspace is found by name.",
|      "description": "RA-specific workspace + DCR overrides (override the shared values in section 2).",
|      "purpose": "Full resource id of the Log Analytics workspace Risk Analysis writes to and reads collected data from, overriding the shared workspace.",
|      "effect": "Risk Analysis ingests its results into, and reads the SecurityInsight tables from, this workspace, which may be in another subscription. A workspace without the collected data gives empty or partial reports.",
|      "whenToChange": "Only for split setups where Risk Analysis uses a different workspace than the rest of the solution.",
|      "info": {
|        "what": "Full resource id of the Log Analytics workspace Risk Analysis writes to and reads collected data from, overriding the shared workspace.",
|        "whenChanged": "Risk Analysis ingests its results into, and reads the SecurityInsight tables from, this workspace, which may be in another subscription. A workspace without the collected data gives empty or partial reports.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Uses SI_WorkspaceResourceId (then WorkspaceResourceId); otherwise the workspace is found by name.",
|        "recommended": "Keep the default. Change it when: Only for split setups where Risk Analysis uses a different workspace than the rest of the solution.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_WorkspaceResourceId/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_GlobalWeight_Azure",
|      "label": "Azure share of overall score",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0.20",
|      "description": "Share of the overall risk score contributed by Azure findings, as a fraction; defaults to 0.20.",
|      "purpose": "How much the Azure score counts in the overall risk score, relative to the other domains.",
|      "effect": "A higher value makes Azure findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|      "whenToChange": "Only if Azure matters more or less to your organisation than the default balance.",
|      "info": {
|        "what": "How much the Azure score counts in the overall risk score, relative to the other domains.",
|        "whenChanged": "A higher value makes Azure findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "0.20",
|        "recommended": "Keep the default. Change it when: Only if Azure matters more or less to your organisation than the default balance.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_GlobalWeight_Azure/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_GlobalWeight_Endpoint",
|      "label": "Endpoint share of overall score",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0.30",
|      "description": "--- Risk scoring: domain weights (RA) ------------------------------------- Relative weight of each domain in the cross-domain risk score. Defaults sum to 1.0. Raising one domain lowers the others' relative influence.",
|      "purpose": "How much the endpoint score counts in the overall risk score, relative to the other domains.",
|      "effect": "A higher value makes endpoint findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|      "whenToChange": "Only if endpoints matter more or less to your organisation than the default balance.",
|      "info": {
|        "what": "How much the endpoint score counts in the overall risk score, relative to the other domains.",
|        "whenChanged": "A higher value makes endpoint findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "0.30",
|        "recommended": "Keep the default. Change it when: Only if endpoints matter more or less to your organisation than the default balance.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_GlobalWeight_Endpoint/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_GlobalWeight_Identity",
|      "label": "Identity share of overall score",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0.30",
|      "description": "Share of the overall risk score contributed by identity findings, as a fraction; defaults to 0.30.",
|      "purpose": "How much the identity score counts in the overall risk score, relative to the other domains.",
|      "effect": "A higher value makes identity findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|      "whenToChange": "Only if identities matter more or less to your organisation than the default balance.",
|      "info": {
|        "what": "How much the identity score counts in the overall risk score, relative to the other domains.",
|        "whenChanged": "A higher value makes identity findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "0.30",
|        "recommended": "Keep the default. Change it when: Only if identities matter more or less to your organisation than the default balance.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_GlobalWeight_Identity/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_GlobalWeight_PublicIP",
|      "label": "Public IP share of overall score",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0.20",
|      "description": "Share of the overall risk score contributed by public-IP findings, as a fraction; defaults to 0.20.",
|      "purpose": "How much the public IP score counts in the overall risk score, relative to the other domains.",
|      "effect": "A higher value makes public IP findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|      "whenToChange": "Only if internet exposure matters more or less to your organisation than the default balance.",
|      "info": {
|        "what": "How much the public IP score counts in the overall risk score, relative to the other domains.",
|        "whenChanged": "A higher value makes public IP findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "0.20",
|        "recommended": "Keep the default. Change it when: Only if internet exposure matters more or less to your organisation than the default balance.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_GlobalWeight_PublicIP/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_SeverityWeight_Critical",
|      "label": "Critical finding weight",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "10",
|      "description": "--- Risk scoring: severity weights (RA) ----------------------------------- What each severity band contributes before tier multiplication.",
|      "purpose": "How heavily a Critical finding lowers the score in the management risk score (on a 0 to 10 scale, where 10 is the full penalty).",
|      "effect": "A lower value makes Critical findings pull the domain and overall scores down less. Values above 10 act as 10. The original per-finding risk score is not affected.",
|      "whenToChange": "Rarely; only to tune the management score to your own risk appetite.",
|      "info": {
|        "what": "How heavily a Critical finding lowers the score in the management risk score (on a 0 to 10 scale, where 10 is the full penalty).",
|        "whenChanged": "A lower value makes Critical findings pull the domain and overall scores down less. Values above 10 act as 10. The original per-finding risk score is not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "10",
|        "recommended": "Keep the default. Change it when: Rarely; only to tune the management score to your own risk appetite.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_SeverityWeight_Critical/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_SeverityWeight_High",
|      "label": "High severity weight",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "5 (Critical is 10, Medium 2, Low 1)",
|      "description": "Score weight given to a High (or Medium-High) severity finding in the risk report; defaults to 5.0.",
|      "purpose": "Sets how heavily a High (or Medium-High) severity finding counts in the Risk Analysis score columns used for management reporting.",
|      "effect": "A higher weight lowers the secure-score value of High findings and raises their share of the domain and overall scores. The original risk score columns are not affected.",
|      "whenToChange": "Most installs never should; change only to align the scores with your own risk model.",
|      "info": {
|        "what": "Sets how heavily a High (or Medium-High) severity finding counts in the Risk Analysis score columns used for management reporting.",
|        "whenChanged": "A higher weight lowers the secure-score value of High findings and raises their share of the domain and overall scores. The original risk score columns are not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "5 (Critical is 10, Medium 2, Low 1)",
|        "recommended": "Keep the default. Change it when: Most installs never should; change only to align the scores with your own risk model.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_SeverityWeight_High/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_SeverityWeight_Low",
|      "label": "Low severity weight",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1",
|      "description": "Score weight given to a Low severity finding in the risk report; defaults to 1.0.",
|      "purpose": "Sets how heavily a Low severity finding counts in the Risk Analysis score columns used for management reporting.",
|      "effect": "A higher weight lowers the secure-score value of Low findings and gives them more influence on the domain and overall scores. The original risk score columns are not affected.",
|      "whenToChange": "Most installs never should; change only to align the scores with your own risk model.",
|      "info": {
|        "what": "Sets how heavily a Low severity finding counts in the Risk Analysis score columns used for management reporting.",
|        "whenChanged": "A higher weight lowers the secure-score value of Low findings and gives them more influence on the domain and overall scores. The original risk score columns are not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "1",
|        "recommended": "Keep the default. Change it when: Most installs never should; change only to align the scores with your own risk model.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_SeverityWeight_Low/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_SeverityWeight_Medium",
|      "label": "Medium severity weight",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "2",
|      "description": "Score weight given to a Medium severity finding in the risk report; defaults to 2.0.",
|      "purpose": "Sets how heavily a Medium severity finding counts in the Risk Analysis score columns used for management reporting.",
|      "effect": "A higher weight lowers the secure-score value of Medium findings and gives them more influence on the domain and overall scores. The original risk score columns are not affected.",
|      "whenToChange": "Most installs never should; change only to align the scores with your own risk model.",
|      "info": {
|        "what": "Sets how heavily a Medium severity finding counts in the Risk Analysis score columns used for management reporting.",
|        "whenChanged": "A higher weight lowers the secure-score value of Medium findings and gives them more influence on the domain and overall scores. The original risk score columns are not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "2",
|        "recommended": "Keep the default. Change it when: Most installs never should; change only to align the scores with your own risk model.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_SeverityWeight_Medium/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_TierMultiplier_T0",
|      "label": "Tier 0 score multiplier",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "4 (four times a Tier 2 asset)",
|      "description": "--- Risk scoring: tier multipliers (RA) ----------------------------------- How much an asset's criticality tier amplifies its score. T0 = 4x a T2 asset.",
|      "purpose": "Sets how much more a finding on a Tier 0 (most critical) asset counts in the Risk Analysis domain and overall scores.",
|      "effect": "A higher value makes Tier 0 findings dominate the domain and overall scores; a lower value spreads attention to less critical assets. The original risk score columns are not affected.",
|      "whenToChange": "Most installs never should; change only if your tier model weighs critical assets differently.",
|      "info": {
|        "what": "Sets how much more a finding on a Tier 0 (most critical) asset counts in the Risk Analysis domain and overall scores.",
|        "whenChanged": "A higher value makes Tier 0 findings dominate the domain and overall scores; a lower value spreads attention to less critical assets. The original risk score columns are not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "4 (four times a Tier 2 asset)",
|        "recommended": "Keep the default. Change it when: Most installs never should; change only if your tier model weighs critical assets differently.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_TierMultiplier_T0/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_TierMultiplier_T1",
|      "label": "Tier 1 score multiplier",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "2 (twice a Tier 2 asset)",
|      "description": "Multiplier applied to the risk score of findings on Tier 1 assets; defaults to 2.0.",
|      "purpose": "Sets how much a finding on a Tier 1 asset counts in the Risk Analysis domain and overall scores.",
|      "effect": "A higher value gives Tier 1 findings more influence on the domain and overall scores. The original risk score columns are not affected.",
|      "whenToChange": "Most installs never should; change only if your tier model weighs assets differently.",
|      "info": {
|        "what": "Sets how much a finding on a Tier 1 asset counts in the Risk Analysis domain and overall scores.",
|        "whenChanged": "A higher value gives Tier 1 findings more influence on the domain and overall scores. The original risk score columns are not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "2 (twice a Tier 2 asset)",
|        "recommended": "Keep the default. Change it when: Most installs never should; change only if your tier model weighs assets differently.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_TierMultiplier_T1/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_TierMultiplier_T2",
|      "label": "Tier 2 score multiplier",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 (the baseline); assets with no tier also count 1",
|      "description": "Multiplier applied to the risk score of findings on Tier 2 assets; defaults to 1.0.",
|      "purpose": "Sets how much a finding on a Tier 2 asset counts in the Risk Analysis domain and overall scores; the baseline the other tiers compare to.",
|      "effect": "Changing it shifts the balance between Tier 2 assets and the other tiers in the domain and overall scores. The original risk score columns are not affected.",
|      "whenToChange": "Most installs never should; change only if your tier model weighs assets differently.",
|      "info": {
|        "what": "Sets how much a finding on a Tier 2 asset counts in the Risk Analysis domain and overall scores; the baseline the other tiers compare to.",
|        "whenChanged": "Changing it shifts the balance between Tier 2 assets and the other tiers in the domain and overall scores. The original risk score columns are not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "1 (the baseline); assets with no tier also count 1",
|        "recommended": "Keep the default. Change it when: Most installs never should; change only if your tier model weighs assets differently.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_TierMultiplier_T2/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_TierMultiplier_T3",
|      "label": "Tier 3 score multiplier",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0.5 (half a Tier 2 asset)",
|      "description": "Multiplier applied to the risk score of findings on Tier 3 assets; defaults to 0.5.",
|      "purpose": "Sets how much a finding on a Tier 3 (least critical) asset counts in the Risk Analysis domain and overall scores.",
|      "effect": "A higher value gives low-criticality assets more influence on the domain and overall scores; a lower value nearly ignores them. The original risk score columns are not affected.",
|      "whenToChange": "Most installs never should; change only if your tier model weighs assets differently.",
|      "info": {
|        "what": "Sets how much a finding on a Tier 3 (least critical) asset counts in the Risk Analysis domain and overall scores.",
|        "whenChanged": "A higher value gives low-criticality assets more influence on the domain and overall scores; a lower value nearly ignores them. The original risk score columns are not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "0.5 (half a Tier 2 asset)",
|        "recommended": "Keep the default. Change it when: Most installs never should; change only if your tier model weighs assets differently.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_TierMultiplier_T3/"
|      }
|    },
|    {
|      "name": "SI_SchemaCatalogDcr",
|      "label": "Schema catalog collection rule",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "dcr-si-schema-catalog",
|      "description": "Optional: override the default schema-catalog DCR / table names.",
|      "purpose": "Name of the data collection rule schema discovery uses to send its catalog of found data fields to Log Analytics.",
|      "effect": "Schema catalog rows are sent through this rule instead. A rule that does not match the catalog table makes the catalog stop arriving.",
|      "whenToChange": "Almost never; only to avoid a name clash with an existing rule.",
|      "info": {
|        "what": "Name of the data collection rule schema discovery uses to send its catalog of found data fields to Log Analytics.",
|        "whenChanged": "Schema catalog rows are sent through this rule instead. A rule that does not match the catalog table makes the catalog stop arriving.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "dcr-si-schema-catalog",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a name clash with an existing rule.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SchemaCatalogDcr/"
|      }
|    },
|    {
|      "name": "SI_SchemaCatalogTable",
|      "label": "Schema catalog table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "SI_SchemaCatalog (stored as SI_SchemaCatalog_CL).",
|      "description": "default",
|      "purpose": "Log Analytics table receiving the schema catalog: new data fields, relationships and draft proposals found by schema discovery.",
|      "effect": "Schema discovery writes its catalog to this table. Queries reading the standard table will no longer see new rows.",
|      "whenToChange": "Almost never; only to avoid a clash with an existing table.",
|      "info": {
|        "what": "Log Analytics table receiving the schema catalog: new data fields, relationships and draft proposals found by schema discovery.",
|        "whenChanged": "Schema discovery writes its catalog to this table. Queries reading the standard table will no longer see new rows.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "SI_SchemaCatalog (stored as SI_SchemaCatalog_CL).",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a clash with an existing table.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SchemaCatalogTable/"
|      }
|    },
|    {
|      "name": "SI_SchemaProposeAiCeiling",
|      "label": "Schema discovery AI budget",
|      "group": "AI",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "5 US dollars per run.",
|      "description": "AI cost ceiling for one schema-discovery run (USD; per-finding ~$0.01).",
|      "purpose": "Maximum estimated AI spend, in US dollars, for drafting rules from new findings in one schema-discovery run.",
|      "effect": "Raising it lets more new findings get an AI-drafted rule per run, at higher AI cost. Findings beyond the budget wait for the next weekly run.",
|      "whenToChange": "Lower it to cap AI cost; raise it if many findings keep being deferred.",
|      "unit": "USD",
|      "card": "AI spending",
|      "info": {
|        "what": "Maximum estimated AI spend, in US dollars, for drafting rules from new findings in one schema-discovery run.",
|        "whenChanged": "Raising it lets more new findings get an AI-drafted rule per run, at higher AI cost. Findings beyond the budget wait for the next weekly run.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Nothing else.",
|        "default": "5 US dollars per run.",
|        "recommended": "Keep the default. Change it when: Lower it to cap AI cost; raise it if many findings keep being deferred.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SchemaProposeAiCeiling/"
|      }
|    },
|    {
|      "name": "SI_SchemaTables",
|      "label": "Schema discovery hunting tables",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "A shipped list of 17 high-signal tables (device, identity, alert, email, cloud app, exposure graph).",
|      "description": "Override the curated hunting-table list (default = 16 high-signal tables).",
|      "purpose": "List of Defender advanced-hunting tables whose columns schema discovery checks for new fields.",
|      "effect": "Replaces the shipped list entirely. Fewer tables means a faster run but new fields elsewhere go unnoticed; tables you cannot query cause errors for that table.",
|      "whenToChange": "Only to add newly released tables or drop ones your licences do not include.",
|      "info": {
|        "what": "List of Defender advanced-hunting tables whose columns schema discovery checks for new fields.",
|        "whenChanged": "Replaces the shipped list entirely. Fewer tables means a faster run but new fields elsewhere go unnoticed; tables you cannot query cause errors for that table.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "A shipped list of 17 high-signal tables (device, identity, alert, email, cloud app, exposure graph).",
|        "recommended": "Keep the default. Change it when: Only to add newly released tables or drop ones your licences do not include.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SchemaTables/"
|      }
|    },
|    {
|      "name": "SI_Shodan_ApiKey",
|      "label": "Shodan API key",
|      "group": "Collection scope & limits",
|      "type": "text",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": true,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: older SHODAN_ApiKey name or SHODAN_API_KEY environment variable is tried; else Shodan lookups are skipped.",
|      "description": "canonical SI-prefixed alias",
|      "purpose": "The Shodan API key used to look up what is exposed on your public IP addresses.",
|      "effect": "With a key, each address is enriched with open ports, services and vulnerabilities from Shodan, using your Shodan plan's quota. Without it the engine still writes rows, but every Shodan field is empty.",
|      "whenToChange": "Set it when you use the public IP engine; rotate it when you reset the key in Shodan.",
|      "card": "Public IP checks (Shodan)",
|      "info": {
|        "what": "The Shodan API key used to look up what is exposed on your public IP addresses.",
|        "whenChanged": "With a key, each address is enriched with open ports, services and vulnerabilities from Shodan, using your Shodan plan's quota. Without it the engine still writes rows, but every Shodan field is empty.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault. Read by: publicip.",
|        "default": "Not set: older SHODAN_ApiKey name or SHODAN_API_KEY environment variable is tried; else Shodan lookups are skipped.",
|        "recommended": "Keep the default. Change it when: Set it when you use the public IP engine; rotate it when you reset the key in Shodan.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_ApiKey/"
|      }
|    },
|    {
|      "name": "SI_Shodan_AssetLimit",
|      "label": "Shodan address limit (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0: no limit (every candidate address).",
|      "description": "Maximum number of public IP addresses sent to Shodan per run; 0 (default) means no limit.",
|      "purpose": "Caps how many public IP addresses are checked per run.",
|      "effect": "A positive number trims the candidate list to that many addresses, so the run is shorter and uses fewer Shodan lookups, but results are incomplete.",
|      "whenToChange": "Only for testing or a quick trial run.",
|      "unit": "assets",
|      "info": {
|        "what": "Caps how many public IP addresses are checked per run.",
|        "whenChanged": "A positive number trims the candidate list to that many addresses, so the run is shorter and uses fewer Shodan lookups, but results are incomplete.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "0: no limit (every candidate address).",
|        "recommended": "Keep the default. Change it when: Only for testing or a quick trial run.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_AssetLimit/"
|      }
|    },
|    {
|      "name": "SI_Shodan_ForceFreshScan",
|      "label": "Shodan fresh scans",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off: cached and existing Shodan data only, no scan credits spent.",
|      "description": "Set ForceFreshScan = $true and schedule the launcher to run at 02:00 + 03:00 (and optionally 04:00). First run submits + waits up to 5 min, persisting scan_id to data/shodan-pending-scans.json if it can't sync-complete. Later runs check pending state + a skip-if-recent guard (data/shodan-last-fresh-scan.json) so credits don't burn on duplicate submits. Defaults are OFF -- cache-only mode -- so passive enrichment doesn't burn scan credits. Turn ON in LauncherConfig.custom.ps1 when you want fresh data.",
|      "purpose": "Asks Shodan to actively re-scan your addresses before reading results, instead of using only data Shodan already has.",
|      "effect": "On, a batch scan is submitted (at most once per fresh scan interval) and the run waits for it; if it does not finish in time the run writes no rows and the next run picks it up. Spends Shodan scan credits.",
|      "whenToChange": "When you need current results and your Shodan plan has scan credits; schedule extra runs a few hours apart.",
|      "card": "Public IP checks (Shodan)",
|      "info": {
|        "what": "Asks Shodan to actively re-scan your addresses before reading results, instead of using only data Shodan already has.",
|        "whenOn": "On, a batch scan is submitted (at most once per fresh scan interval) and the run waits for it; if it does not finish in time the run writes no rows and the next run picks it up. Spends Shodan scan credits.",
|        "whenOff": "cached and existing Shodan data only, no scan credits spent.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "Off: cached and existing Shodan data only, no scan credits spent.",
|        "recommended": "Keep the default. Change it when: When you need current results and your Shodan plan has scan credits; schedule extra runs a few hours apart.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_ForceFreshScan/"
|      }
|    },
|    {
|      "name": "SI_Shodan_FreshScanIntervalHours",
|      "label": "Shodan fresh scan interval",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 20,
|      "defaultText": "20 hours.",
|      "description": "don't re-submit within this window",
|      "purpose": "The minimum time between two fresh Shodan scans when fresh scans are on.",
|      "effect": "Lower values submit new scans more often, spending more scan credits; higher values reuse the last scan longer. Only matters when SI_Shodan_ForceFreshScan is on.",
|      "whenToChange": "When your schedule or Shodan credit budget calls for more or fewer scans.",
|      "unit": "hours",
|      "info": {
|        "what": "The minimum time between two fresh Shodan scans when fresh scans are on.",
|        "whenChanged": "Lower values submit new scans more often, spending more scan credits; higher values reuse the last scan longer. Only matters when SI_Shodan_ForceFreshScan is on.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "20 hours.",
|        "recommended": "Keep the default. Change it when: When your schedule or Shodan credit budget calls for more or fewer scans.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_FreshScanIntervalHours/"
|      }
|    },
|    {
|      "name": "SI_Shodan_LastFreshScanPath",
|      "label": "Shodan last scan state file",
|      "group": "Collection scope & limits",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "A file in the solution's data folder.",
|      "description": "default: a file in the solution's data folder",
|      "purpose": "Where the engine records when the last fresh Shodan scan finished.",
|      "effect": "The interval check reads this file. Pointing it somewhere that is lost between runs means scans may be re-submitted early, spending extra credits.",
|      "whenToChange": "Only when the data folder is not kept between runs.",
|      "info": {
|        "what": "Where the engine records when the last fresh Shodan scan finished.",
|        "whenChanged": "The interval check reads this file. Pointing it somewhere that is lost between runs means scans may be re-submitted early, spending extra credits.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "A file in the solution's data folder.",
|        "recommended": "Keep the default. Change it when: Only when the data folder is not kept between runs.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_LastFreshScanPath/"
|      }
|    },
|    {
|      "name": "SI_Shodan_LookbackDays",
|      "label": "Public IP discovery lookback",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 8,
|      "defaultText": "8 days.",
|      "description": "Lookback window for Profile_CL discovery (days). Latest snapshot per PrimaryEntityId within this window is used. Default 8 days.",
|      "purpose": "How far back the engine looks in the endpoint and Azure profile tables to find classified assets with public IPs.",
|      "effect": "Each asset's latest snapshot within the window is used. A shorter window drops assets not seen recently; a longer one keeps retired assets in scope.",
|      "whenToChange": "When profiling runs less often than weekly.",
|      "unit": "days",
|      "info": {
|        "what": "How far back the engine looks in the endpoint and Azure profile tables to find classified assets with public IPs.",
|        "whenChanged": "Each asset's latest snapshot within the window is used. A shorter window drops assets not seen recently; a longer one keeps retired assets in scope.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "8 days.",
|        "recommended": "Keep the default. Change it when: When profiling runs less often than weekly.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_LookbackDays/"
|      }
|    },
|    {
|      "name": "SI_Shodan_PendingScansPath",
|      "label": "Shodan pending scan state file",
|      "group": "Collection scope & limits",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "A file in the solution's data folder.",
|      "description": "default: a file in the solution's data folder",
|      "purpose": "Where the engine remembers a submitted Shodan scan that has not finished yet.",
|      "effect": "The next run reads this file to collect the pending scan. If the file is lost between runs, the scan result is not picked up and a new scan may be submitted.",
|      "whenToChange": "Only when the data folder is not kept between runs.",
|      "info": {
|        "what": "Where the engine remembers a submitted Shodan scan that has not finished yet.",
|        "whenChanged": "The next run reads this file to collect the pending scan. If the file is lost between runs, the scan result is not picked up and a new scan may be submitted.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "A file in the solution's data folder.",
|        "recommended": "Keep the default. Change it when: Only when the data folder is not kept between runs.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_PendingScansPath/"
|      }
|    },
|    {
|      "name": "SI_Shodan_ScanPollIntervalSec",
|      "label": "Shodan scan poll interval",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 30,
|      "defaultText": "30 seconds.",
|      "description": "default 30 seconds between scan-status checks",
|      "purpose": "How often the engine checks whether a submitted fresh Shodan scan has finished.",
|      "effect": "Shorter checks notice completion sooner but make more status calls; longer checks may wait past completion. Only used with fresh scans on.",
|      "whenToChange": "Rarely; the default suits most installs.",
|      "unit": "seconds",
|      "info": {
|        "what": "How often the engine checks whether a submitted fresh Shodan scan has finished.",
|        "whenChanged": "Shorter checks notice completion sooner but make more status calls; longer checks may wait past completion. Only used with fresh scans on.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "30 seconds.",
|        "recommended": "Keep the default. Change it when: Rarely; the default suits most installs.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_ScanPollIntervalSec/"
|      }
|    },
|    {
|      "name": "SI_Shodan_ScanWaitMaxSec",
|      "label": "Shodan scan wait limit",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 300,
|      "defaultText": "300 seconds (5 minutes).",
|      "description": "5-min sync deadline per run",
|      "purpose": "How long one run waits for a submitted fresh Shodan scan to finish.",
|      "effect": "Longer waits make the run take longer but finish more scans in the same run; if the limit passes, the run writes no rows and the next run collects the scan.",
|      "whenToChange": "When scans routinely take longer than five minutes for your address count.",
|      "unit": "seconds",
|      "info": {
|        "what": "How long one run waits for a submitted fresh Shodan scan to finish.",
|        "whenChanged": "Longer waits make the run take longer but finish more scans in the same run; if the limit passes, the run writes no rows and the next run collects the scan.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "300 seconds (5 minutes).",
|        "recommended": "Keep the default. Change it when: When scans routinely take longer than five minutes for your address count.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_ScanWaitMaxSec/"
|      }
|    },
|    {
|      "name": "SI_Shodan_ServerOnly",
|      "label": "Scan server IPs only",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": true,
|      "defaultText": "On: only servers' public IPs are checked.",
|      "description": "Server-only filter for Profile_CL discovery from SI_Endpoint_Profile_CL. Workstation PublicIp = user's home/cafe/cellular ISP NAT, not a scannable asset the customer owns. Default $true.",
|      "purpose": "Limits endpoint-derived public IPs to servers, because a workstation's public IP is usually a home or mobile network you do not own.",
|      "effect": "Off adds workstation public IPs, which are mostly internet provider addresses: more lookups and results that do not describe your own exposure.",
|      "whenToChange": "Almost never.",
|      "info": {
|        "what": "Limits endpoint-derived public IPs to servers, because a workstation's public IP is usually a home or mobile network you do not own.",
|        "whenOn": "only servers' public IPs are checked.",
|        "whenOff": "Off adds workstation public IPs, which are mostly internet provider addresses: more lookups and results that do not describe your own exposure.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "On: only servers' public IPs are checked.",
|        "recommended": "Keep the default. Change it when: Almost never.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_ServerOnly/"
|      }
|    },
|    {
|      "name": "SI_Shodan_ThrottleMs",
|      "label": "Shodan call spacing",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 1100,
|      "defaultText": "1100 milliseconds (about one call per second).",
|      "description": "1 req/sec (Shodan free-tier rate)",
|      "purpose": "Pause between live Shodan lookups so the engine stays within Shodan's rate limit.",
|      "effect": "A lower value speeds up large runs but may hit Shodan's rate limit and cause failed lookups on lower plans. Cached lookups are not delayed.",
|      "whenToChange": "Lower it only if your Shodan plan allows faster calls.",
|      "unit": "milliseconds",
|      "info": {
|        "what": "Pause between live Shodan lookups so the engine stays within Shodan's rate limit.",
|        "whenChanged": "A lower value speeds up large runs but may hit Shodan's rate limit and cause failed lookups on lower plans. Cached lookups are not delayed.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "1100 milliseconds (about one call per second).",
|        "recommended": "Keep the default. Change it when: Lower it only if your Shodan plan allows faster calls.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_ThrottleMs/"
|      }
|    },
|    {
|      "name": "SI_Shodan_TierMax",
|      "label": "Highest tier to check",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": 3,
|      "defaultText": "3: all tiers (0 to 3).",
|      "description": "default 3 = scan all tiers (T0-T3). Lower to 1 for T0/T1 only (Shodan cost control).",
|      "purpose": "Checks public IPs only for assets at or below this privilege tier (0 is most critical).",
|      "effect": "Lowering it, for example to 1, checks only the most critical assets, cutting Shodan lookups and cost but leaving lower-tier exposure unchecked.",
|      "whenToChange": "To control Shodan cost on a small plan.",
|      "card": "Public IP checks (Shodan)",
|      "hint": "0 is the most critical tier.",
|      "info": {
|        "what": "Checks public IPs only for assets at or below this privilege tier (0 is most critical).",
|        "whenChanged": "Lowering it, for example to 1, checks only the most critical assets, cutting Shodan lookups and cost but leaving lower-tier exposure unchecked.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "3: all tiers (0 to 3).",
|        "recommended": "Keep the default. Change it when: To control Shodan cost on a small plan.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_TierMax/"
|      }
|    },
|    {
|      "name": "SI_Shodan_TimeoutSec",
|      "label": "Shodan call timeout",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 15,
|      "defaultText": "15 seconds.",
|      "description": "Per-call timeout (seconds) for both /host and /scan submissions.",
|      "purpose": "How long each Shodan lookup or scan submission may take before it is abandoned.",
|      "effect": "Longer timeouts tolerate a slow service at the cost of longer runs; shorter ones fail faster, leaving that address without Shodan data for the run.",
|      "whenToChange": "Only if lookups time out on a slow network.",
|      "unit": "seconds",
|      "info": {
|        "what": "How long each Shodan lookup or scan submission may take before it is abandoned.",
|        "whenChanged": "Longer timeouts tolerate a slow service at the cost of longer runs; shorter ones fail faster, leaving that address without Shodan data for the run.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "15 seconds.",
|        "recommended": "Keep the default. Change it when: Only if lookups time out on a slow network.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_TimeoutSec/"
|      }
|    },
|    {
|      "name": "SI_ShodanCacheAgeDays",
|      "label": "Shodan cache age",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 7,
|      "defaultText": "7 days.",
|      "description": "Cache + spend guards.",
|      "purpose": "How long a stored Shodan result is reused before the address is looked up again.",
|      "effect": "Shorter means fresher data but more live Shodan calls and longer runs; longer saves calls but results can be out of date.",
|      "whenToChange": "When you need fresher exposure data or must save Shodan quota.",
|      "unit": "days",
|      "info": {
|        "what": "How long a stored Shodan result is reused before the address is looked up again.",
|        "whenChanged": "Shorter means fresher data but more live Shodan calls and longer runs; longer saves calls but results can be out of date.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "7 days.",
|        "recommended": "Keep the default. Change it when: When you need fresher exposure data or must save Shodan quota.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ShodanCacheAgeDays/"
|      }
|    },
|    {
|      "name": "SI_ShodanMonthlyCreditCap",
|      "label": "Shodan monthly credit cap",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": 4000,
|      "defaultText": "4000 credits per month.",
|      "description": "Shodan monthly credit cap -- soft ceiling. The engine refuses new live calls when the rolling-month counter exceeds this. Default 4000 (matches a typical Small Business plan). Bump or lower based on your subscription tier.",
|      "purpose": "A safety ceiling on the Shodan scan credits spent per month, by per-address on-demand scans and by the batch fresh scan.",
|      "effect": "A scan that would take the month past the cap is refused (the batch fresh scan counts one credit per address), and so is any scan while the month's count cannot be read. Normal host lookups are not limited.",
|      "whenToChange": "Match it to your Shodan plan's monthly scan credits.",
|      "unit": "credits",
|      "card": "Public IP checks (Shodan)",
|      "info": {
|        "what": "A safety ceiling on the Shodan scan credits spent per month, by per-address on-demand scans and by the batch fresh scan.",
|        "whenChanged": "A scan that would take the month past the cap is refused (the batch fresh scan counts one credit per address), and so is any scan while the month's count cannot be read. Normal host lookups are not limited.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "4000 credits per month.",
|        "recommended": "Keep the default. Change it when: Match it to your Shodan plan's monthly scan credits.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ShodanMonthlyCreditCap/"
|      }
|    },
|    {
|      "name": "SI_SignalMap_PromptVersion",
|      "label": "AI signal map version",
|      "group": "AI",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "v1",
|      "description": "Bump to invalidate the cached per-engine signal-map weights (forces re-AI).",
|      "purpose": "A version label for the stored AI signal weights per engine and asset type; changing it makes the engines ask the AI again.",
|      "effect": "A new value ignores the stored weights and rebuilds them with fresh AI calls on the next run, which adds AI cost once. Keeping the value reuses the stored weights.",
|      "whenToChange": "Only when you want the AI signal weights rebuilt, for example after a model change.",
|      "info": {
|        "what": "A version label for the stored AI signal weights per engine and asset type; changing it makes the engines ask the AI again.",
|        "whenChanged": "A new value ignores the stored weights and rebuilds them with fresh AI calls on the next run, which adds AI cost once. Keeping the value reuses the stored weights.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Nothing else.",
|        "default": "v1",
|        "recommended": "Keep the default. Change it when: Only when you want the AI signal weights rebuilt, for example after a model change.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SignalMap_PromptVersion/"
|      }
|    },
|    {
|      "name": "SI_SignInBatchSize",
|      "label": "Sign-in query batch size",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "200 users per query.",
|      "description": "default 200 user ids per sign-in query batch",
|      "purpose": "How many users are looked up in one sign-in log query during identity sign-in enrichment.",
|      "effect": "Larger batches mean fewer queries but each is heavier and may hit query size or memory limits; smaller batches are safer but slower.",
|      "whenToChange": "Only if sign-in queries fail on size limits or run too slowly.",
|      "unit": "users",
|      "info": {
|        "what": "How many users are looked up in one sign-in log query during identity sign-in enrichment.",
|        "whenChanged": "Larger batches mean fewer queries but each is heavier and may hit query size or memory limits; smaller batches are safer but slower.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "200 users per query.",
|        "recommended": "Keep the default. Change it when: Only if sign-in queries fail on size limits or run too slowly.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SignInBatchSize/"
|      }
|    },
|    {
|      "name": "SI_SignInLookbackDays",
|      "label": "Sign-in history window",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "7 days.",
|      "description": "How many days of sign-in history identity enrichment looks back over; defaults to 7.",
|      "purpose": "How many days of sign-in and device logon history the identity and endpoint enrichment look back over.",
|      "effect": "A longer window catches less frequent sign-ins and device users but makes the queries slower and costlier; a shorter one is cheaper but may miss occasional use.",
|      "whenToChange": "When weekly activity is too short a window for your users' patterns.",
|      "unit": "days",
|      "info": {
|        "what": "How many days of sign-in and device logon history the identity and endpoint enrichment look back over.",
|        "whenChanged": "A longer window catches less frequent sign-ins and device users but makes the queries slower and costlier; a shorter one is cheaper but may miss occasional use.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "7 days.",
|        "recommended": "Keep the default. Change it when: When weekly activity is too short a window for your users' patterns.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SignInLookbackDays/"
|      }
|    },
|    {
|      "name": "SI_SimulateCLRowCount",
|      "label": "Simulated table row count",
|      "group": "Advanced / diagnostics",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off (no simulation)",
|      "description": "Simulation only -- forces a synthetic CL row count for scale testing.",
|      "purpose": "Test-only setting that pads the data Risk Analysis reads from your workspace with synthetic rows, to test behaviour at large scale on a small tenant.",
|      "effect": "Risk Analysis handles the extra synthetic rows, so runs get slower and heavier; the fake rows never match real assets and do not appear in the report. A warning is shown while active.",
|      "whenToChange": "Never in normal use; only for scale testing. Usually set by the launcher's asset-simulation option.",
|      "unit": "rows",
|      "info": {
|        "what": "Test-only setting that pads the data Risk Analysis reads from your workspace with synthetic rows, to test behaviour at large scale on a small tenant.",
|        "whenChanged": "Risk Analysis handles the extra synthetic rows, so runs get slower and heavier; the fake rows never match real assets and do not appear in the report. A warning is shown while active.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Off (no simulation)",
|        "recommended": "Keep the default. Change it when: Never in normal use; only for scale testing. Usually set by the launcher's asset-simulation option.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SimulateCLRowCount/"
|      }
|    },
|    {
|      "name": "SI_SingleProcess",
|      "label": "Keep stage data in memory",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: data between stages goes through staging storage.",
|      "description": "Single-process mode (no parallel runspaces; easier debugging, slower).",
|      "purpose": "Makes the profiling engines pass data between stages in memory instead of through the staging storage account.",
|      "effect": "On a single server run this can be much faster. It must stay off for parallel container jobs, where each worker only sees its own memory.",
|      "whenToChange": "Only for single-server troubleshooting or speed tests; leave off otherwise.",
|      "info": {
|        "what": "Makes the profiling engines pass data between stages in memory instead of through the staging storage account.",
|        "whenOn": "On a single server run this can be much faster. It must stay off for parallel container jobs, where each worker only sees its own memory.",
|        "whenOff": "data between stages goes through staging storage.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Off: data between stages goes through staging storage.",
|        "recommended": "Keep the default. Change it when: Only for single-server troubleshooting or speed tests; leave off otherwise.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SingleProcess/"
|      }
|    },
|    {
|      "name": "SI_Sinks_Azure",
|      "label": "Azure collection outputs",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [
|        "azure"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": [
|        "LA",
|        "JSON",
|        "Excel"
|      ],
|      "defaultText": "All three: Log Analytics, JSON and Excel",
|      "description": "Sinks -- which destinations to write the engine's output to. Allowed entries: 'LA' (Log Analytics), 'JSON', 'Excel'.",
|      "purpose": "Chooses where the Azure collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|      "effect": "Leaving out LA means no Azure data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|      "whenToChange": "Most installs never should; drop file outputs if nobody uses them.",
|      "card": "Where collected data goes",
|      "info": {
|        "what": "Chooses where the Azure collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|        "whenChanged": "Leaving out LA means no Azure data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "Read by: azure.",
|        "default": "All three: Log Analytics, JSON and Excel",
|        "recommended": "Keep the default. Change it when: Most installs never should; drop file outputs if nobody uses them.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Sinks_Azure/"
|      }
|    },
|    {
|      "name": "SI_Sinks_Endpoint",
|      "label": "Endpoint collection outputs",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [
|        "endpoint"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": [
|        "LA",
|        "JSON",
|        "Excel"
|      ],
|      "defaultText": "All three: Log Analytics, JSON and Excel",
|      "description": "Per-engine sinks: any subset of @('LA','JSON','Excel'). Default = all three.",
|      "purpose": "Chooses where the endpoint collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|      "effect": "Leaving out LA means no endpoint data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|      "whenToChange": "Most installs never should; drop file outputs if nobody uses them.",
|      "card": "Where collected data goes",
|      "info": {
|        "what": "Chooses where the endpoint collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|        "whenChanged": "Leaving out LA means no endpoint data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "Read by: endpoint.",
|        "default": "All three: Log Analytics, JSON and Excel",
|        "recommended": "Keep the default. Change it when: Most installs never should; drop file outputs if nobody uses them.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Sinks_Endpoint/"
|      }
|    },
|    {
|      "name": "SI_Sinks_Identity",
|      "label": "Identity collection outputs",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [
|        "identity"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": [
|        "LA",
|        "JSON",
|        "Excel"
|      ],
|      "defaultText": "All three: Log Analytics, JSON and Excel",
|      "description": "Sinks -- which destinations to write the engine's output to. Allowed entries: 'LA' (Log Analytics), 'JSON', 'Excel'.",
|      "purpose": "Chooses where the identity collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|      "effect": "Leaving out LA means no identity data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|      "whenToChange": "Most installs never should; drop file outputs if nobody uses them.",
|      "card": "Where collected data goes",
|      "info": {
|        "what": "Chooses where the identity collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|        "whenChanged": "Leaving out LA means no identity data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "Read by: identity.",
|        "default": "All three: Log Analytics, JSON and Excel",
|        "recommended": "Keep the default. Change it when: Most installs never should; drop file outputs if nobody uses them.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Sinks_Identity/"
|      }
|    },
|    {
|      "name": "SI_Sinks_PublicIp",
|      "label": "Public IP collection outputs",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": [
|        "LA",
|        "JSON",
|        "Excel"
|      ],
|      "defaultText": "All three: Log Analytics, JSON and Excel",
|      "description": "Sinks -- which destinations to write the engine's output to. Allowed entries: 'LA' (Log Analytics), 'JSON', 'Excel'.",
|      "purpose": "Chooses where the public IP collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|      "effect": "Leaving out LA means no public IP data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|      "whenToChange": "Most installs never should; drop file outputs if nobody uses them.",
|      "card": "Where collected data goes",
|      "info": {
|        "what": "Chooses where the public IP collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|        "whenChanged": "Leaving out LA means no public IP data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "Read by: publicip.",
|        "default": "All three: Log Analytics, JSON and Excel",
|        "recommended": "Keep the default. Change it when: Most installs never should; drop file outputs if nobody uses them.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Sinks_PublicIp/"
|      }
|    },
|    {
|      "name": "SI_SPN_AppId",
|      "label": "Service principal app id",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Taken from SpnClientId or the platform; if none, managed identity",
|      "description": "Service principal instead: set SI_AuthMethod = 'Certificate' (recommended) or 'Secret', then fill in the app below.",
|      "purpose": "Application (client) id of the service principal the engines sign in as when not using managed identity.",
|      "effect": "Decides which app registration reads data and ingests results; that app needs the required Graph, Azure and Log Analytics permissions. Without it, no service principal sign-in happens.",
|      "whenToChange": "Set during setup when you use a service principal; change when moving to a different app.",
|      "card": "How SecurityInsight signs in",
|      "info": {
|        "what": "Application (client) id of the service principal the engines sign in as when not using managed identity.",
|        "whenChanged": "Decides which app registration reads data and ingests results; that app needs the required Graph, Azure and Log Analytics permissions. Without it, no service principal sign-in happens.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Taken from SpnClientId or the platform; if none, managed identity",
|        "recommended": "Keep the default. Change it when: Set during setup when you use a service principal; change when moving to a different app.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SPN_AppId/"
|      }
|    },
|    {
|      "name": "SI_SPN_CertStoreLocation",
|      "label": "Certificate store location",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Detected: the store that holds the certificate with its key, else LocalMachine",
|      "description": "or 'CurrentUser'",
|      "purpose": "Which Windows certificate store (LocalMachine or CurrentUser) holds the sign-in certificate of the service principal.",
|      "effect": "Forces the store used for certificate sign-in. A wrong store makes certificate sign-in fail. Containers always use CurrentUser.",
|      "whenToChange": "Rarely; only if automatic detection picks the wrong store on your host.",
|      "info": {
|        "what": "Which Windows certificate store (LocalMachine or CurrentUser) holds the sign-in certificate of the service principal.",
|        "whenChanged": "Forces the store used for certificate sign-in. A wrong store makes certificate sign-in fail. Containers always use CurrentUser.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Detected: the store that holds the certificate with its key, else LocalMachine",
|        "recommended": "Keep the default. Change it when: Rarely; only if automatic detection picks the wrong store on your host.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SPN_CertStoreLocation/"
|      }
|    },
|    {
|      "name": "SI_SPN_CertThumbprint",
|      "label": "Sign-in certificate thumbprint",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Taken from the platform's certificate setting if present; else no certificate sign-in",
|      "description": "Thumbprint of the service principal's certificate (with its private key in the machine or user certificate store); used when SI_AuthMethod is Certificate.",
|      "purpose": "Thumbprint of the service principal's certificate, with its private key in the certificate store, used for certificate sign-in.",
|      "effect": "Lets the engines, ingestion and SQL connections sign in with this certificate. A wrong or missing certificate makes certificate sign-in fail; with both certificate and secret set, the certificate is preferred.",
|      "whenToChange": "Set at install and when the certificate is renewed.",
|      "card": "How SecurityInsight signs in",
|      "info": {
|        "what": "Thumbprint of the service principal's certificate, with its private key in the certificate store, used for certificate sign-in.",
|        "whenChanged": "Lets the engines, ingestion and SQL connections sign in with this certificate. A wrong or missing certificate makes certificate sign-in fail; with both certificate and secret set, the certificate is preferred.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Taken from the platform's certificate setting if present; else no certificate sign-in",
|        "recommended": "Keep the default. Change it when: Set at install and when the certificate is renewed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SPN_CertThumbprint/"
|      }
|    },
|    {
|      "name": "SI_SPN_ObjectId",
|      "label": "Service principal object id",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Looked up from the app id at run start",
|      "description": "SP ObjectId, NOT AppId",
|      "purpose": "Object id (not app id) of the service principal, used to grant it rights on data collection rules and storage.",
|      "effect": "If it cannot be found, infrastructure preparation is skipped and new data collection rules may lack the ingest permission. A wrong id grants rights to the wrong principal.",
|      "whenToChange": "Only when the automatic lookup fails because the signing-in identity cannot read service principals.",
|      "info": {
|        "what": "Object id (not app id) of the service principal, used to grant it rights on data collection rules and storage.",
|        "whenChanged": "If it cannot be found, infrastructure preparation is skipped and new data collection rules may lack the ingest permission. A wrong id grants rights to the wrong principal.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Looked up from the app id at run start",
|        "recommended": "Keep the default. Change it when: Only when the automatic lookup fails because the signing-in identity cannot read service principals.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SPN_ObjectId/"
|      }
|    },
|    {
|      "name": "SI_SPN_Secret",
|      "label": "Service principal client secret",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": true,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: certificate or managed identity is used",
|      "description": "Secret only; rotate via your Key Vault procedure",
|      "purpose": "Client secret of the service principal when the sign-in method is Secret.",
|      "effect": "Enables secret-based sign-in. If a certificate thumbprint is also set, the certificate wins and the secret is ignored. Secrets expire and must be rotated.",
|      "whenToChange": "Only when you cannot use managed identity or a certificate; rotate via your Key Vault procedure.",
|      "card": "How SecurityInsight signs in",
|      "info": {
|        "what": "Client secret of the service principal when the sign-in method is Secret.",
|        "whenChanged": "Enables secret-based sign-in. If a certificate thumbprint is also set, the certificate wins and the secret is ignored. Secrets expire and must be rotated.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault.",
|        "default": "Not set: certificate or managed identity is used",
|        "recommended": "Keep the default. Change it when: Only when you cannot use managed identity or a certificate; rotate via your Key Vault procedure.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SPN_Secret/"
|      }
|    },
|    {
|      "name": "SI_SPN_TenantId",
|      "label": "Service principal tenant id",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Taken from SpnTenantId, the platform, or the managed identity's sign-in",
|      "description": "v2.2 uses ONE SPN for everything: Defender Graph reads, ARG, and Log Analytics DCR ingest. SPN must hold ThreatHunting.Read.All, Device.Read.All, User.Read.All, Application.Read.All Graph app-roles + Reader on the sub + Monitoring Metrics Publisher on the DCR RG + Storage Blob/Table/Queue Data Contributor on the staging account (storage is reached only with this identity). These four are REQUIRED. Bootstrap-Auth.ps1 pulls them from KV when blank.",
|      "purpose": "The Entra tenant the service principal signs in to, for data reads and Log Analytics ingestion.",
|      "effect": "Decides which tenant is read. A wrong value makes sign-in fail or targets the wrong tenant.",
|      "whenToChange": "Set during setup when you use a service principal.",
|      "card": "How SecurityInsight signs in",
|      "info": {
|        "what": "The Entra tenant the service principal signs in to, for data reads and Log Analytics ingestion.",
|        "whenChanged": "Decides which tenant is read. A wrong value makes sign-in fail or targets the wrong tenant.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Taken from SpnTenantId, the platform, or the managed identity's sign-in",
|        "recommended": "Keep the default. Change it when: Set during setup when you use a service principal.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SPN_TenantId/"
|      }
|    },
|    {
|      "name": "SI_SqlPacing_Enabled",
|      "label": "Slow down large writes when the database is busy",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On",
|      "description": "DATABASE WRITE PACE: the large writers (Risk Analysis storing its findings, the data sync preparing the views, the removal of old collections) read how busy the database is before each batch. Above the high mark (the highest of log write, data reads and CPU, in percent of the tier) they pause and write smaller batches; below the low mark they go back to full pace. Nothing is left out -- only slower while the database is saturated. On by default; $false switches it off.",
|      "purpose": "Whether the large database writers (Risk Analysis storing its findings, the data sync preparing the views, the removal of old collections) look at how busy the database is before each batch.",
|      "effect": "On: while the database is at its limit (log write, data reads or CPU above the high mark), each writer pauses before its next batch and writes smaller batches, so the web app and the other jobs keep a share; below the low mark it writes at full pace again. Nothing is left out -- the same rows are written, only slower while the database is saturated. Off: the writers always write at full pace.",
|      "whenToChange": "Leave it on. Switch it off only if support asks you to.",
|      "card": "Database write pace",
|      "info": {
|        "what": "Whether the large database writers (Risk Analysis storing its findings, the data sync preparing the views, the removal of old collections) look at how busy the database is before each batch.",
|        "whenOn": "while the database is at its limit (log write, data reads or CPU above the high mark), each writer pauses before its next batch and writes smaller batches, so the web app and the other jobs keep a share; below the low mark it writes at full pace again. Nothing is left out -- the same rows are written, only slower while the database is saturated.",
|        "whenOff": "the writers always write at full pace.",
|        "risk": "Off: on a busy database the large writers keep it at its limit for as long as the daily run writes, and the web app is slow meanwhile. No data is changed either way. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "On (the default).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SqlPacing_Enabled/"
|      }
|    },
|    {
|      "name": "SI_SqlPacing_HighPercent",
|      "label": "Database busy above (percent)",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "85",
|      "description": "The database load (percent) above which the writers slow down. Default 85.",
|      "purpose": "The database load (the highest of log write, data reads and CPU, in percent of what its tier allows) above which the large writers slow down.",
|      "effect": "Lower: the writers make room for the web app sooner, and a full run takes longer on a busy database. Higher: the writers keep their pace until the database is closer to its limit. A value that is not a number from 1 to 100 uses 85.",
|      "whenToChange": "Lower it if the web app is slow during the daily run; raise it if the run must finish sooner and nobody uses the web app then.",
|      "unit": "percent",
|      "min": 1,
|      "max": 100,
|      "card": "Database write pace",
|      "needs": "SI_SqlPacing_Enabled",
|      "info": {
|        "what": "The database load (the highest of log write, data reads and CPU, in percent of what its tier allows) above which the large writers slow down.",
|        "whenChanged": "Lower: the writers make room for the web app sooner, and a full run takes longer on a busy database. Higher: the writers keep their pace until the database is closer to its limit. A value that is not a number from 1 to 100 uses 85.",
|        "risk": "Only changes how soon the large writers slow down: a lower value gives the web app more room and makes a full run take longer on a busy database. No data is changed. Reversible at once.",
|        "requires": "Works only while \"Slow down large writes when the database is busy\" is on.",
|        "default": "85",
|        "recommended": "Keep 85.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SqlPacing_HighPercent/"
|      }
|    },
|    {
|      "name": "SI_SqlPacing_LowPercent",
|      "label": "Database calm again below (percent)",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "70",
|      "description": "The database load (percent) below which they go back to full pace. Default 70; must be below the high mark.",
|      "purpose": "The database load below which the large writers go back to their full pace after they slowed down.",
|      "effect": "Between this and the busy mark a writer keeps the pause it has. Must be below the busy mark; a value at or above it uses the busy mark minus 15.",
|      "whenToChange": "Rarely. Lower it if the writers speed up and slow down again and again.",
|      "unit": "percent",
|      "min": 0,
|      "max": 99,
|      "card": "Database write pace",
|      "needs": "SI_SqlPacing_Enabled",
|      "info": {
|        "what": "The database load below which the large writers go back to their full pace after they slowed down.",
|        "whenChanged": "Between this and the busy mark a writer keeps the pause it has. Must be below the busy mark; a value at or above it uses the busy mark minus 15.",
|        "risk": "Only changes when the large writers go back to full pace. No data is changed. Reversible at once.",
|        "requires": "Works only while \"Slow down large writes when the database is busy\" is on.",
|        "default": "70",
|        "recommended": "Keep 70.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SqlPacing_LowPercent/"
|      }
|    },
|    {
|      "name": "SI_StagingPath",
|      "label": "Risk Analysis local staging folder",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "A staging folder under the output path, else the temp folder",
|      "description": "Optional staging directory override (defaults under SI_StorageAccount sistaging).",
|      "purpose": "A local folder where Risk Analysis writes its temporary query files and query error details.",
|      "effect": "Moves Risk Analysis's temporary query files to this folder. It does not change the staging storage account.",
|      "whenToChange": "Only if the default folder is not writable or too small on your host.",
|      "info": {
|        "what": "A local folder where Risk Analysis writes its temporary query files and query error details.",
|        "whenChanged": "Moves Risk Analysis's temporary query files to this folder. It does not change the staging storage account.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "A staging folder under the output path, else the temp folder",
|        "recommended": "Keep the default. Change it when: Only if the default folder is not writable or too small on your host.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_StagingPath/"
|      }
|    },
|    {
|      "name": "SI_StorageAccount",
|      "label": "Staging storage account",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: collection engines stop with an error",
|      "description": "REQUIRED for v2.2 collection engines: the storage account for the 'sistaging' container (per-asset shards, cache JSONs, schema diffs). It is reached only with the signed-in identity, which needs Storage Blob/Table/Queue Data Contributor on it.",
|      "purpose": "The storage account the collection engines use for staging data, caches, the shared catalog and the identity ledger.",
|      "effect": "Required for endpoint, identity, Azure and public IP collection. It is reached only with the signed-in identity, which needs the Storage Blob, Queue and Table Data Contributor roles on it. Changing it starts staging and caches from empty.",
|      "whenToChange": "Set at install; change only when moving to a new storage account.",
|      "card": "Storage",
|      "info": {
|        "what": "The storage account the collection engines use for staging data, caches, the shared catalog and the identity ledger.",
|        "whenChanged": "Required for endpoint, identity, Azure and public IP collection. It is reached only with the signed-in identity, which needs the Storage Blob, Queue and Table Data Contributor roles on it. Changing it starts staging and caches from empty.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: azure, endpoint, identity, publicip.",
|        "default": "Not set: collection engines stop with an error",
|        "recommended": "Keep the default. Change it when: Set at install; change only when moving to a new storage account.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_StorageAccount/"
|      }
|    },
|    {
|      "name": "SI_StorageResourceGroup",
|      "label": "Storage account resource group",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Same resource group as the workspace (or the data collection rules)",
|      "description": "Resource group of the SecurityInsight storage account, used when setup checks or creates the storage account and its permissions; defaults to the workspace's resource group.",
|      "purpose": "Names the Azure resource group that holds the SecurityInsight storage account. Setup creates the account and grants its permissions there; a collection run only checks that the account is there.",
|      "effect": "Setup looks the storage account up, creates it and grants permissions in this resource group; a run that does not find it there says so in one line and creates nothing. A wrong value makes setup create a second account in the wrong place.",
|      "whenToChange": "Only when your storage account lives in a different resource group from the workspace; setup normally writes it.",
|      "card": "Storage",
|      "info": {
|        "what": "Names the Azure resource group that holds the SecurityInsight storage account. Setup creates the account and grants its permissions there; a collection run only checks that the account is there.",
|        "whenChanged": "Setup looks the storage account up, creates it and grants permissions in this resource group; a run that does not find it there says so in one line and creates nothing. A wrong value makes setup create a second account in the wrong place.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Same resource group as the workspace (or the data collection rules)",
|        "recommended": "Keep the default. Change it when: Only when your storage account lives in a different resource group from the workspace; setup normally writes it.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_StorageResourceGroup/"
|      }
|    },
|    {
|      "name": "SI_SystemPrompt_azure",
|      "label": "Azure AI instructions",
|      "group": "AI",
|      "type": "text",
|      "engines": [
|        "azure"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The built-in Azure classification instructions.",
|      "description": "System prompt override for the Azure AI Classify call. $null = ship default from engine/asset-profiling/stages/Invoke-Classify.ps1.",
|      "purpose": "Replaces the built-in instructions sent to Azure OpenAI when it classifies Azure resources.",
|      "effect": "Changes how AI decides tiers and service types for Azure resources. A poorly written prompt can produce wrong tiers or unreadable answers, which fall back to a default tier. Has no effect while AI is off for the Azure engine.",
|      "whenToChange": "Rarely; only to tune AI classification for your estate.",
|      "info": {
|        "what": "Replaces the built-in instructions sent to Azure OpenAI when it classifies Azure resources.",
|        "whenChanged": "Changes how AI decides tiers and service types for Azure resources. A poorly written prompt can produce wrong tiers or unreadable answers, which fall back to a default tier. Has no effect while AI is off for the Azure engine.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: azure.",
|        "default": "The built-in Azure classification instructions.",
|        "recommended": "Keep the default. Change it when: Rarely; only to tune AI classification for your estate.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SystemPrompt_azure/"
|      }
|    },
|    {
|      "name": "SI_SystemPrompt_endpoint",
|      "label": "Endpoint AI instructions",
|      "group": "AI",
|      "type": "text",
|      "engines": [
|        "endpoint"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The built-in device classification instructions.",
|      "description": "AI system-prompt override for the Endpoint Classify call.",
|      "purpose": "Replaces the built-in instructions sent to Azure OpenAI when it classifies devices.",
|      "effect": "Changes how AI decides tiers and service types for devices. A poorly written prompt can produce wrong tiers or unreadable answers, which fall back to a default tier. Has no effect while AI is off for endpoints.",
|      "whenToChange": "Rarely; only to tune AI classification for your estate.",
|      "info": {
|        "what": "Replaces the built-in instructions sent to Azure OpenAI when it classifies devices.",
|        "whenChanged": "Changes how AI decides tiers and service types for devices. A poorly written prompt can produce wrong tiers or unreadable answers, which fall back to a default tier. Has no effect while AI is off for endpoints.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: endpoint.",
|        "default": "The built-in device classification instructions.",
|        "recommended": "Keep the default. Change it when: Rarely; only to tune AI classification for your estate.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SystemPrompt_endpoint/"
|      }
|    },
|    {
|      "name": "SI_SystemPrompt_identity",
|      "label": "Identity AI instructions",
|      "group": "AI",
|      "type": "text",
|      "engines": [
|        "identity"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not used; identity classification never uses AI.",
|      "description": "AI system-prompt override -- engine HARD-DISABLES identity AI today, so this is read but currently no-op; here for forward-compat.",
|      "purpose": "Reserved for replacing the AI instructions for identity classification.",
|      "effect": "No effect today: the identity engine never calls AI, so this text is never sent.",
|      "whenToChange": "Never at present; it is kept for future use.",
|      "info": {
|        "what": "Reserved for replacing the AI instructions for identity classification.",
|        "whenChanged": "No effect today: the identity engine never calls AI, so this text is never sent.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: identity.",
|        "default": "Not used; identity classification never uses AI.",
|        "recommended": "Keep the default. Change it when: Never at present; it is kept for future use.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SystemPrompt_identity/"
|      }
|    },
|    {
|      "name": "SI_TableNamePattern",
|      "label": "Profile table name pattern",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "SI_{0}_Profile",
|      "description": "v2.2 LA table + DCR naming patterns. {0} placeholder is filled with engine name. Defaults: 'SI_{0}_Profile' + 'dcr-si-{0}-profile'. Override only if you maintain a parallel naming scheme.",
|      "purpose": "The pattern used to name each collection engine's Log Analytics table, where {0} is replaced by the engine name.",
|      "effect": "Changing it sends collection data to new tables; reports and workbooks expecting the standard names will not find the data.",
|      "whenToChange": "Only if you maintain a parallel naming scheme; most installs never should.",
|      "info": {
|        "what": "The pattern used to name each collection engine's Log Analytics table, where {0} is replaced by the engine name.",
|        "whenChanged": "Changing it sends collection data to new tables; reports and workbooks expecting the standard names will not find the data.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "SI_{0}_Profile",
|        "recommended": "Keep the default. Change it when: Only if you maintain a parallel naming scheme; most installs never should.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_TableNamePattern/"
|      }
|    },
|    {
|      "name": "SI_Telemetry_Enabled",
|      "label": "Status reports to Invardia",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "One status report a day and one short report per engine run (which engine, ok / warning / failed, how long, the stage and the kind of error). Community: anonymous -- a random install id, no tenant, no host name, no error text, counts only as ranges. Pro: identified by the install key, with the error text shortened and secrets removed. On by default; $false sends nothing at all.",
|      "purpose": "Whether the install sends Invardia one status report a day and one short report per engine run: which engine ran, whether it ended ok, with warnings or failed, how long it took, the stage and the kind of error. Community reports are anonymous (a random install id; no tenant, host name or error text; counts only as ranges). Pro reports are identified by the install key and carry the error text with secrets removed.",
|      "effect": "Off sends nothing at all: no report is built, no file is written and Invardia is never contacted for this. For Pro, Invardia then cannot see failed or silent runs and warn you about them.",
|      "whenToChange": "Turn it off if your organisation does not allow status reports to leave the environment.",
|      "card": "Licence and updates",
|      "info": {
|        "what": "Whether the install sends Invardia one status report a day and one short report per engine run: which engine ran, whether it ended ok, with warnings or failed, how long it took, the stage and the kind of error. Community reports are anonymous (a random install id; no tenant, host name or error text; counts only as ranges). Pro reports are identified by the install key and carry the error text with secrets removed.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Off sends nothing at all: no report is built, no file is written and Invardia is never contacted for this. For Pro, Invardia then cannot see failed or silent runs and warn you about them.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "Keep the default. Change it when: Turn it off if your organisation does not allow status reports to leave the environment.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Telemetry_Enabled/"
|      }
|    },
|    {
|      "name": "SI_Telemetry_Endpoint",
|      "label": "Status report address",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Invardia's report address (https://invardia.com/api/uplink/v1/report)",
|      "description": "Where the reports go (https only). Default: Invardia's report address.",
|      "purpose": "The https address the status reports are sent to.",
|      "effect": "Reports go to this address instead. Only https addresses are used; anything else sends nothing.",
|      "whenToChange": "Practically never; only if Invardia tells you to use another address.",
|      "info": {
|        "what": "The https address the status reports are sent to.",
|        "whenChanged": "Reports go to this address instead. Only https addresses are used; anything else sends nothing.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Invardia's report address (https://invardia.com/api/uplink/v1/report)",
|        "recommended": "Keep the default. Change it when: Practically never; only if Invardia tells you to use another address.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Telemetry_Endpoint/"
|      }
|    },
|    {
|      "name": "SI_Telemetry_SendEndpoints",
|      "label": "Send this install's links to Invardia",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On -- switch it off to send no links",
|      "description": "Whether the daily status report (Pro, with an install key) carries this install's own links -- the web app's and the MCP server's addresses -- so Invardia's mails about this environment can open it. On by default; switch it off to send no links.",
|      "purpose": "Pro installs with an install key can send Invardia this install's own links -- the web app's and the MCP server's addresses -- with the daily status report, so every mail Invardia sends about this environment carries an Open SecurityInsight button. Only the addresses are sent: no names, no secrets.",
|      "effect": "On: the daily status report carries the web app's and the MCP server's addresses (read from the install's own hosting). Off: it carries no links. A failed run's report links to the run health page either way.",
|      "whenToChange": "Switch it off only if Invardia should not see this install's web app and MCP addresses.",
|      "card": "Licence and updates",
|      "info": {
|        "what": "Pro installs with an install key can send Invardia this install's own links -- the web app's and the MCP server's addresses -- with the daily status report, so every mail Invardia sends about this environment carries an Open SecurityInsight button. Only the addresses are sent: no names, no secrets.",
|        "whenOn": "the daily status report carries the web app's and the MCP server's addresses (read from the install's own hosting).",
|        "whenOff": "it carries no links. A failed run's report links to the run health page either way.",
|        "risk": "Changes only what Invardia sees: the web app's and the MCP server's addresses; nothing in your tenant changes. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "On -- switch it off to send no links",
|        "recommended": "Keep the default (on).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Telemetry_SendEndpoints/"
|      }
|    },
|    {
|      "name": "SI_Telemetry_SendHealth",
|      "label": "Send the data health result to Invardia",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On -- switch it off to send nothing about data health",
|      "description": "Send the daily data health result (counts only) to Invardia. On by default; switched off, nothing about data health is sent.",
|      "purpose": "Pro installs with an install key send Invardia the daily data health result -- the state and, per source and report, how many records were checked, found, missing and different. Counts only: no names, ids or values.",
|      "effect": "On: every daily check, and at once when the state changes, the counts go to Invardia, which uses them to hold an update ring from moving on. Off: nothing about data health is sent.",
|      "whenToChange": "Keep it on. Switch it off only if your organisation does not allow the data health counts to leave the environment.",
|      "card": "Data health",
|      "info": {
|        "what": "Pro installs with an install key send Invardia the daily data health result -- the state and, per source and report, how many records were checked, found, missing and different. Counts only: no names, ids or values.",
|        "whenOn": "every daily check, and at once when the state changes, the counts go to Invardia, which uses them to hold an update ring from moving on.",
|        "whenOff": "nothing about data health is sent.",
|        "risk": "On: the daily data health counts go to Invardia (no names or ids); an Unhealthy install then holds the update ring from moving on. Off: Invardia does not know the data health of this install. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "On -- switch it off to send nothing about data health",
|        "recommended": "Keep the default. Change it when: Keep it on. Switch it off only if your organisation does not allow the data health counts to leave the environment.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Telemetry_SendHealth/"
|      }
|    },
|    {
|      "name": "SI_Telemetry_SetupControls",
|      "label": "Setup report to Invardia",
|      "group": "Data & retention",
|      "type": "enum",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "all: every control, SecurityInsight's own too (sent again with only the minimum list when Invardia does not take it)",
|      "description": "Which controls the daily setup report to Invardia carries (Pro, with an install key): 'all' (default) = the framework's minimum control list and SecurityInsight's own controls (when Invardia does not take that report, it goes again once with only the minimum list); 'minimum' = only the framework's minimum list; 'off' = no setup report.",
|      "purpose": "Pro installs with an install key send Invardia one setup report a day: a list of critical settings (updater, update ring, install key, licence, mail, permissions, last run, backup) with ok / missing / wrong / unknown, so Invardia can see what is not set up and help you. No secrets, no names of people and no error text are sent.",
|      "effect": "'all' (the default) sends the minimum list every product shares and SecurityInsight's own controls (SQL database reachable, job layout, run limits, last daily run, data sources, last CI build, Log Analytics ingestion, licence edition); when Invardia does not take that report, it is sent again once with only the minimum list, and the run log says so. 'minimum' sends only the minimum list. 'off' sends no setup report; the daily status report and the run reports are not affected. Status reports to Invardia off (SI_Telemetry_Enabled) turns this off too.",
|      "whenToChange": "Keep 'all'. Choose 'minimum' to send only the shared list, or 'off' if your organisation does not allow the setup state to leave the environment.",
|      "values": [
|        "minimum",
|        "all",
|        "off"
|      ],
|      "card": "Licence and updates",
|      "hint": "all = also SecurityInsight's own controls (default). minimum = the shared control list only. off = no setup report.",
|      "info": {
|        "what": "Pro installs with an install key send Invardia one setup report a day: a list of critical settings (updater, update ring, install key, licence, mail, permissions, last run, backup) with ok / missing / wrong / unknown, so Invardia can see what is not set up and help you. No secrets, no names of people and no error text are sent.",
|        "whenChanged": "'all' (the default) sends the minimum list every product shares and SecurityInsight's own controls (SQL database reachable, job layout, run limits, last daily run, data sources, last CI build, Log Analytics ingestion, licence edition); when Invardia does not take that report, it is sent again once with only the minimum list, and the run log says so. 'minimum' sends only the minimum list. 'off' sends no setup report; the daily status report and the run reports are not affected. Status reports to Invardia off (SI_Telemetry_Enabled) turns this off too.",
|        "risk": "Changes only what Invardia sees about this install's setup; nothing in your tenant changes. When Invardia does not take the full list ('all'), the report goes again once with the minimum list; the daily status report and the run reports are not affected. 'off' means Invardia cannot see a missing setting and offer help.",
|        "requires": "Nothing else.",
|        "default": "all: every control, SecurityInsight's own too (sent again with only the minimum list when Invardia does not take it)",
|        "recommended": "Keep the default (all).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Telemetry_SetupControls/"
|      }
|    },
|    {
|      "name": "SI_TenantDomain",
|      "label": "Tenant domain in mails and links",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Read from Microsoft Graph for mail subjects; the tenant id is used in portal links",
|      "description": "Tenant domain shown in the risk score links (default: the tenant id) and, with the tenant id, in the mail subjects (default: the tenant's onmicrosoft.com domain, read from Microsoft Graph).",
|      "purpose": "Tenant domain shown in report mail subjects and used in the Azure portal links Risk Analysis adds to findings on Azure resources.",
|      "effect": "Changes the domain in mail subjects and how Azure portal links are written; links work either way. A wrong domain mislabels the mails and opens links in the wrong directory.",
|      "whenToChange": "Optional; set it if the run cannot read the domain from Microsoft Graph, or you prefer another domain in subjects and links.",
|      "card": "Sources and links",
|      "info": {
|        "what": "Tenant domain shown in report mail subjects and used in the Azure portal links Risk Analysis adds to findings on Azure resources.",
|        "whenChanged": "Changes the domain in mail subjects and how Azure portal links are written; links work either way. A wrong domain mislabels the mails and opens links in the wrong directory.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Read from Microsoft Graph for mail subjects; the tenant id is used in portal links",
|        "recommended": "Keep the default. Change it when: Optional; set it if the run cannot read the domain from Microsoft Graph, or you prefer another domain in subjects and links.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_TenantDomain/"
|      }
|    },
|    {
|      "name": "SI_Throttle_StuckHours",
|      "label": "Stuck on throttling after (hours)",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "6",
|      "description": "THROTTLE-IS-NORMAL: a run Microsoft only throttled is shown as throttled, is never mailed and runs again at its next scheduled time. The ONE alert (\"stuck\") goes out when a job has been throttled on every run for this many hours, or this many runs in a row -- whichever comes first, never on one run alone. The next run that completes clears it.",
|      "purpose": "How long a job may keep being throttled by Microsoft, without completing, before the one \"stuck\" alert is sent.",
|      "effect": "A throttled run is normal: it is shown as throttled, it is not mailed, and the job runs again at its next scheduled time. When a job has been throttled on every run for this many hours (and at least two runs), one alert says it is stuck. Whichever comes first of this and the number of runs below. The next run that completes clears it.",
|      "whenToChange": "Raise it if you get the alert for jobs that catch up by themselves; lower it if you need to know sooner.",
|      "unit": "hours",
|      "card": "Other checks",
|      "needs": "SI_Guard_JobRunThrottledStuck_Enabled",
|      "info": {
|        "what": "How long a job may keep being throttled by Microsoft, without completing, before the one \"stuck\" alert is sent.",
|        "whenChanged": "A throttled run is normal: it is shown as throttled, it is not mailed, and the job runs again at its next scheduled time. When a job has been throttled on every run for this many hours (and at least two runs), one alert says it is stuck. Whichever comes first of this and the number of runs below. The next run that completes clears it.",
|        "risk": "A safety check protects your data from a broken run; changing it changes when a step is held or stopped. Reversible at once.",
|        "requires": "Works only while \"Job stuck on throttling\" is on.",
|        "default": "6",
|        "recommended": "Keep the default. Change it when: Raise it if you get the alert for jobs that catch up by themselves; lower it if you need to know sooner.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Throttle_StuckHours/"
|      }
|    },
|    {
|      "name": "SI_Throttle_StuckRuns",
|      "label": "Stuck on throttling after (runs)",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "12",
|      "description": "How many throttled runs in a row, without one that completes, send the one \"stuck\" alert (whichever comes first).",
|      "purpose": "How many throttled runs in a row, without one that completes, send the one \"stuck\" alert.",
|      "effect": "When a job has been throttled this many runs in a row, one alert says it is stuck -- whichever comes first of this and the number of hours above. The next run that completes clears it.",
|      "whenToChange": "Raise it for jobs that run very often; lower it if you need to know sooner.",
|      "unit": "runs",
|      "card": "Other checks",
|      "needs": "SI_Guard_JobRunThrottledStuck_Enabled",
|      "info": {
|        "what": "How many throttled runs in a row, without one that completes, send the one \"stuck\" alert.",
|        "whenChanged": "When a job has been throttled this many runs in a row, one alert says it is stuck -- whichever comes first of this and the number of hours above. The next run that completes clears it.",
|        "risk": "A safety check protects your data from a broken run; changing it changes when a step is held or stopped. Reversible at once.",
|        "requires": "Works only while \"Job stuck on throttling\" is on.",
|        "default": "12",
|        "recommended": "Keep the default. Change it when: Raise it for jobs that run very often; lower it if you need to know sooner.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Throttle_StuckRuns/"
|      }
|    },
|    {
|      "name": "SI_TierCadence_Default",
|      "label": "Re-check interval, unknown tier",
|      "group": "Collection scope & limits",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "24 hours",
|      "description": "used when cached tier is null/unknown",
|      "purpose": "How often an asset whose privilege tier is not yet known is re-processed when the per-asset skip schedule is in use.",
|      "effect": "Shorter intervals refresh such assets more often at the cost of run time; longer ones skip them more. Only applies when the fingerprint cache is turned on and the run is not a full run.",
|      "whenToChange": "Rarely; only when you run incremental profiling with the fingerprint cache on.",
|      "unit": "hours",
|      "info": {
|        "what": "How often an asset whose privilege tier is not yet known is re-processed when the per-asset skip schedule is in use.",
|        "whenChanged": "Shorter intervals refresh such assets more often at the cost of run time; longer ones skip them more. Only applies when the fingerprint cache is turned on and the run is not a full run.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "24 hours",
|        "recommended": "Keep the default. Change it when: Rarely; only when you run incremental profiling with the fingerprint cache on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_TierCadence_Default/"
|      }
|    },
|    {
|      "name": "SI_TierCadence_T0",
|      "label": "Re-check interval, tier 0",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 12,
|      "defaultText": "12 hours",
|      "description": "--- Tier-driven cadence (asset-profiling Stage Collect skip gate) --- Strings: '12h', '24h', '3d', '7d', or combos like '1d12h'. Engine defaults: T0='12h' T1='24h' T2='3d' T3='7d' Default='24h'",
|      "purpose": "How often tier 0 assets (domain controllers, break-glass and global admins) are re-processed when the per-asset skip schedule is in use.",
|      "effect": "A number is read as hours; text such as '3d' also works. Shorter keeps the most critical assets fresher but costs run time. Only applies with the fingerprint cache on and outside full runs.",
|      "whenToChange": "Rarely; only when you run incremental profiling with the fingerprint cache on.",
|      "unit": "hours",
|      "info": {
|        "what": "How often tier 0 assets (domain controllers, break-glass and global admins) are re-processed when the per-asset skip schedule is in use.",
|        "whenChanged": "A number is read as hours; text such as '3d' also works. Shorter keeps the most critical assets fresher but costs run time. Only applies with the fingerprint cache on and outside full runs.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: azure, endpoint, identity, publicip.",
|        "default": "12 hours",
|        "recommended": "Keep the default. Change it when: Rarely; only when you run incremental profiling with the fingerprint cache on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_TierCadence_T0/"
|      }
|    },
|    {
|      "name": "SI_TierCadence_T1",
|      "label": "Re-check interval, tier 1",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 24,
|      "defaultText": "24 hours",
|      "description": "production servers, privileged users",
|      "purpose": "How often tier 1 assets (production servers, privileged users) are re-processed when the per-asset skip schedule is in use.",
|      "effect": "A number is read as hours; text such as '3d' also works. Shorter means fresher data and longer runs. Only applies with the fingerprint cache on and outside full runs.",
|      "whenToChange": "Rarely; only when you run incremental profiling with the fingerprint cache on.",
|      "unit": "hours",
|      "info": {
|        "what": "How often tier 1 assets (production servers, privileged users) are re-processed when the per-asset skip schedule is in use.",
|        "whenChanged": "A number is read as hours; text such as '3d' also works. Shorter means fresher data and longer runs. Only applies with the fingerprint cache on and outside full runs.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: azure, endpoint, identity, publicip.",
|        "default": "24 hours",
|        "recommended": "Keep the default. Change it when: Rarely; only when you run incremental profiling with the fingerprint cache on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_TierCadence_T1/"
|      }
|    },
|    {
|      "name": "SI_TierCadence_T2",
|      "label": "Re-check interval, tier 2",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 72,
|      "defaultText": "3 days",
|      "description": "workstations, regular users",
|      "purpose": "How often tier 2 assets (workstations, regular users) are re-processed when the per-asset skip schedule is in use.",
|      "effect": "A number is read as hours; text such as '3d' also works. Shorter means fresher data and longer runs. Only applies with the fingerprint cache on and outside full runs.",
|      "whenToChange": "Rarely; only when you run incremental profiling with the fingerprint cache on.",
|      "unit": "hours",
|      "info": {
|        "what": "How often tier 2 assets (workstations, regular users) are re-processed when the per-asset skip schedule is in use.",
|        "whenChanged": "A number is read as hours; text such as '3d' also works. Shorter means fresher data and longer runs. Only applies with the fingerprint cache on and outside full runs.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: azure, endpoint, identity, publicip.",
|        "default": "3 days",
|        "recommended": "Keep the default. Change it when: Rarely; only when you run incremental profiling with the fingerprint cache on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_TierCadence_T2/"
|      }
|    },
|    {
|      "name": "SI_TierCadence_T3",
|      "label": "Re-check interval, tier 3",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 168,
|      "defaultText": "7 days",
|      "description": "test/dev, externals, guests, shadow IT",
|      "purpose": "How often tier 3 assets (test and development, externals, guests, unmanaged) are re-processed when the per-asset skip schedule is in use.",
|      "effect": "A number is read as hours; text such as '7d' also works. Shorter means fresher data and longer runs. Only applies with the fingerprint cache on and outside full runs.",
|      "whenToChange": "Rarely; only when you run incremental profiling with the fingerprint cache on.",
|      "unit": "hours",
|      "info": {
|        "what": "How often tier 3 assets (test and development, externals, guests, unmanaged) are re-processed when the per-asset skip schedule is in use.",
|        "whenChanged": "A number is read as hours; text such as '7d' also works. Shorter means fresher data and longer runs. Only applies with the fingerprint cache on and outside full runs.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: azure, endpoint, identity, publicip.",
|        "default": "7 days",
|        "recommended": "Keep the default. Change it when: Rarely; only when you run incremental profiling with the fingerprint cache on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_TierCadence_T3/"
|      }
|    },
|    {
|      "name": "SI_Trend_AtEndOfRiskAnalysis",
|      "label": "Write the risk trend at the end of Risk Analysis",
|      "group": "Schedules & what runs",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On",
|      "description": "Risk Analysis writes the day's risk trend row itself at the end of a summary run (the trend job is then not needed).",
|      "purpose": "Whether a Risk Analysis summary run writes the day's risk trend row itself, from the rows it has just published.",
|      "effect": "On: one trend row per day, written by Risk Analysis -- the separate risk trend job is not needed and waits for a run by hand. Off: no trend row unless the risk trend job runs. A run that was partial writes no row (a gap, not a drop).",
|      "whenToChange": "Only when you run the risk trend job on its own schedule instead.",
|      "info": {
|        "what": "Whether a Risk Analysis summary run writes the day's risk trend row itself, from the rows it has just published.",
|        "whenOn": "one trend row per day, written by Risk Analysis -- the separate risk trend job is not needed and waits for a run by hand.",
|        "whenOff": "no trend row unless the risk trend job runs. A run that was partial writes no row (a gap, not a drop).",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "Keep the default. Change it when: Only when you run the risk trend job on its own schedule instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Trend_AtEndOfRiskAnalysis/"
|      }
|    },
|    {
|      "name": "SI_Trend_DcrName",
|      "label": "Trend data collection rule name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "asset-trend"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The engine's own rule name for the trend table.",
|      "description": "A different DCR name for SI_Trend_CL (default: the engine's own).",
|      "purpose": "The name of the data collection rule the trend engine publishes its daily rollup through.",
|      "effect": "Sends the trend rollup through a differently named data collection rule. A wrong name means the rollup is published through a rule you did not intend, or fails to publish.",
|      "whenToChange": "Only when the default rule name clashes with an existing one in your workspace.",
|      "info": {
|        "what": "The name of the data collection rule the trend engine publishes its daily rollup through.",
|        "whenChanged": "Sends the trend rollup through a differently named data collection rule. A wrong name means the rollup is published through a rule you did not intend, or fails to publish.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: asset-trend.",
|        "default": "The engine's own rule name for the trend table.",
|        "recommended": "Keep the default. Change it when: Only when the default rule name clashes with an existing one in your workspace.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Trend_DcrName/"
|      }
|    },
|    {
|      "name": "SI_Trend_DryRun",
|      "label": "Trend dry run",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "asset-trend"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: the rollup is published every run.",
|      "description": "$true computes and prints the rollup without publishing it.",
|      "purpose": "Lets the trend engine compute and print its rollup without publishing anything.",
|      "effect": "When on, nothing is written to the trend table, so the trend line and weekly history get a gap for every dry-run day. A command-line switch on the run wins over this value.",
|      "whenToChange": "For a first trial run, or while checking numbers; switch it back off afterwards.",
|      "info": {
|        "what": "Lets the trend engine compute and print its rollup without publishing anything.",
|        "whenOn": "When on, nothing is written to the trend table, so the trend line and weekly history get a gap for every dry-run day. A command-line switch on the run wins over this value.",
|        "whenOff": "the rollup is published every run.",
|        "risk": "No trend rows are written while it is on: the trend line and weekly history get a gap for every such day, which cannot be filled later. Reversible from the next day.",
|        "requires": "Read by: asset-trend.",
|        "default": "Off: the rollup is published every run.",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Trend_DryRun/",
|        "confirmWhen": "on",
|        "confirm": "When on, nothing is written to the trend table, so the trend line and weekly history get a gap for every dry-run day. A command-line switch on the run wins over this value. No trend rows are written while it is on: the trend line and weekly history get a gap for every such day, which cannot be filled later. Reversible from the next day."
|      }
|    },
|    {
|      "name": "SI_Trend_Grain",
|      "label": "Trend source detail level",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [
|        "asset-trend"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "Summary",
|      "defaultText": "Summary (the Risk Analysis summary results).",
|      "description": "--- trend (asset-trend engine) ----------------------------------------------",
|      "purpose": "Chooses whether the trend rollup is built from the Risk Analysis summary results or the detailed per-asset results.",
|      "effect": "'Detailed' rolls up from the detailed Risk Analysis table instead, which only helps if your reports publish at that level. Any value other than Summary or Detailed falls back to Summary with a warning.",
|      "whenToChange": "Only if your Risk Analysis reports are published at the detailed level and you want the trend built from that.",
|      "info": {
|        "what": "Chooses whether the trend rollup is built from the Risk Analysis summary results or the detailed per-asset results.",
|        "whenChanged": "'Detailed' rolls up from the detailed Risk Analysis table instead, which only helps if your reports publish at that level. Any value other than Summary or Detailed falls back to Summary with a warning.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: asset-trend.",
|        "default": "Summary (the Risk Analysis summary results).",
|        "recommended": "Keep the default. Change it when: Only if your Risk Analysis reports are published at the detailed level and you want the trend built from that.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Trend_Grain/"
|      }
|    },
|    {
|      "name": "SI_Trend_Weeks",
|      "label": "Weekly rate weeks shown",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [
|        "asset-trend"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 12,
|      "defaultText": "12 weeks.",
|      "description": "weeks -ShowWeeklyRate looks back over",
|      "purpose": "How many weeks the printed weekly opened/closed view covers when the trend engine is run by hand with the weekly rate view.",
|      "effect": "Only changes how many weeks are printed when a person asks for the weekly rate view on a VM run. The weekly history that is stored is unaffected, and scheduled container runs do not print the view.",
|      "whenToChange": "Rarely; when you want a longer or shorter printed history during a manual run.",
|      "unit": "weeks",
|      "info": {
|        "what": "How many weeks the printed weekly opened/closed view covers when the trend engine is run by hand with the weekly rate view.",
|        "whenChanged": "Only changes how many weeks are printed when a person asks for the weekly rate view on a VM run. The weekly history that is stored is unaffected, and scheduled container runs do not print the view.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: asset-trend.",
|        "default": "12 weeks.",
|        "recommended": "Keep the default. Change it when: Rarely; when you want a longer or shorter printed history during a manual run.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Trend_Weeks/"
|      }
|    },
|    {
|      "name": "SI_UAMI_ClientId",
|      "label": "Managed identity client id (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Copied from SI_ManagedIdentityClientId; empty means system-assigned",
|      "description": "Client id of a user-assigned managed identity that container jobs use to sign in instead of the service principal, when managed-identity sign-in is enabled.",
|      "purpose": "Client id of a user-assigned managed identity; the older name for SI_ManagedIdentityClientId, and the one container jobs and ingestion read.",
|      "effect": "Selects the user-assigned identity used for sign-in and ingestion. Several ingestion paths use managed identity only when this is set.",
|      "whenToChange": "Rarely; set SI_ManagedIdentityClientId instead, unless configuring a container job directly.",
|      "info": {
|        "what": "Client id of a user-assigned managed identity; the older name for SI_ManagedIdentityClientId, and the one container jobs and ingestion read.",
|        "whenChanged": "Selects the user-assigned identity used for sign-in and ingestion. Several ingestion paths use managed identity only when this is set.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Copied from SI_ManagedIdentityClientId; empty means system-assigned",
|        "recommended": "Keep the default. Change it when: Rarely; set SI_ManagedIdentityClientId instead, unless configuring a container job directly.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_UAMI_ClientId/"
|      }
|    },
|    {
|      "name": "SI_Update_RenameDisplayNames",
|      "label": "Rename to the agreed names",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "SecurityInsight Pro: the update gives this install's directory objects the names a new install gets -- the engine's application \"SecurityInsight Engine\", the web app's sign-in application \"SecurityInsight\", the SQL admin group shown as \"SecurityInsight SQL admins\" -- only from SecurityInsight's earlier names (a name you chose is kept), each once, read back and put back if it does not take. On by default; $false leaves the names as they are (the update only says what it would do).",
|      "purpose": "Whether the update gives this installation's directory objects the names a new installation gets: the engine's application \"SecurityInsight Engine\", the web app's sign-in application \"SecurityInsight\" and the SQL admin group shown as \"SecurityInsight SQL admins\". Only SecurityInsight's earlier names are renamed; a name you chose is kept. Each object is renamed once, read back, and put back if the rename does not take. Azure resources keep their names.",
|      "effect": "Off: the update renames nothing and only says, one line each, what it would rename. Where the updater's identity may not rename an application or the SQL admin group, the update says so in one line and an administrator renames with setup\\Set-SIDisplayNames.ps1.",
|      "whenToChange": "Turn it off only when your own processes still look for SecurityInsight's applications or the SQL admin group by their earlier names; turn it on again once they use the new names.",
|      "card": "Licence and updates",
|      "info": {
|        "what": "Whether the update gives this installation's directory objects the names a new installation gets: the engine's application \"SecurityInsight Engine\", the web app's sign-in application \"SecurityInsight\" and the SQL admin group shown as \"SecurityInsight SQL admins\". Only SecurityInsight's earlier names are renamed; a name you chose is kept. Each object is renamed once, read back, and put back if the rename does not take. Azure resources keep their names.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "the update renames nothing and only says, one line each, what it would rename. Where the updater's identity may not rename an application or the SQL admin group, the update says so in one line and an administrator renames with setup\\Set-SIDisplayNames.ps1.",
|        "risk": "SecurityInsight's applications and the SQL admin group keep their earlier names, unlike a new installation. Nothing else changes. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "On",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Update_RenameDisplayNames/",
|        "confirmWhen": "off",
|        "confirm": "the update renames nothing and only says, one line each, what it would rename. Where the updater's identity may not rename an application or the SQL admin group, the update says so in one line and an administrator renames with setup\\Set-SIDisplayNames.ps1. SecurityInsight's applications and the SQL admin group keep their earlier names, unlike a new installation. Nothing else changes. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_UpdateRing",
|      "label": "Update ring",
|      "group": "Sign-in & Azure resources",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the ring the installation recorded at install time (from its resource-group name), until the updater records the ring it updates by",
|      "description": "SecurityInsight Pro: this install's update ring (0 dev, 1 internal, 2 early release, 3 broad), recorded with the install so the web app shows it before the updater has run. Not set = the ring in the resource-group name.",
|      "purpose": "The update ring this installation belongs to: 0 = development, 1 = internal test, 2 = early release, 3 = broad. It is shown in the header (UPDATE RING) and recorded with the installation, so the ring is known from the day it is installed -- also before the updater job has run.",
|      "effect": "The header shows this ring and setup records it as the installation's ring. Once the updater job has run, the header shows the ring the updater actually updated by -- which ring an installation receives releases on is decided by the update service, not by this setting.",
|      "whenToChange": "Once, when the installation's ring is not shown, or was recorded wrongly at install time.",
|      "min": 0,
|      "max": 3,
|      "card": "Licence and updates",
|      "info": {
|        "what": "The update ring this installation belongs to: 0 = development, 1 = internal test, 2 = early release, 3 = broad. It is shown in the header (UPDATE RING) and recorded with the installation, so the ring is known from the day it is installed -- also before the updater job has run.",
|        "whenChanged": "The header shows this ring and setup records it as the installation's ring. Once the updater job has run, the header shows the ring the updater actually updated by -- which ring an installation receives releases on is decided by the update service, not by this setting.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Not set: the ring the installation recorded at install time (from its resource-group name), until the updater records the ring it updates by",
|        "recommended": "Keep the default. Change it when: Once, when the installation's ring is not shown, or was recorded wrongly at install time.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_UpdateRing/"
|      }
|    },
|    {
|      "name": "SI_Verbose",
|      "label": "Verbose diagnostic logging",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: normal log detail.",
|      "description": "Verbose engine logging (writes Properties.run.debug into every profile row).",
|      "purpose": "Adds detailed diagnostic lines (routing, timing, merge statistics, samples) to the run log.",
|      "effect": "Run logs become much longer and more detailed, which helps support find problems. Collected data and reports are unchanged.",
|      "whenToChange": "When investigating a problem or when support asks for it; turn off again afterwards.",
|      "info": {
|        "what": "Adds detailed diagnostic lines (routing, timing, merge statistics, samples) to the run log.",
|        "whenOn": "Run logs become much longer and more detailed, which helps support find problems. Collected data and reports are unchanged.",
|        "whenOff": "normal log detail.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Off: normal log detail.",
|        "recommended": "Keep the default. Change it when: When investigating a problem or when support asks for it; turn off again afterwards.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Verbose/"
|      }
|    },
|    {
|      "name": "SI_VulnSync_CloseAfterRuns",
|      "label": "Runs before a vulnerability closes",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "2 runs",
|      "description": "How many complete runs in a row a vulnerability must be missing from an asset before the close-loop closes it as fixed. Each run only counts when the asset itself was seen in that run with its vulnerability data; a run in which the asset was not seen counts for nothing and keeps the vulnerability open. Default 2, at least 1. Raise it if devices report a vulnerability on and off.",
|      "purpose": "How many complete runs in a row a vulnerability must be missing from an asset that was seen before the close-loop marks it fixed.",
|      "effect": "Higher avoids closing and reopening vulnerabilities that devices report on and off, but confirms real fixes later. Runs where the asset was not seen do not count. Below 1 is raised to 1; non-numbers use 2.",
|      "whenToChange": "Raise it if vulnerabilities keep closing and reopening on the same devices.",
|      "unit": "runs",
|      "min": 1,
|      "card": "Counting and closing findings",
|      "info": {
|        "what": "How many complete runs in a row a vulnerability must be missing from an asset that was seen before the close-loop marks it fixed.",
|        "whenChanged": "Higher avoids closing and reopening vulnerabilities that devices report on and off, but confirms real fixes later. Runs where the asset was not seen do not count. Below 1 is raised to 1; non-numbers use 2.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "2 runs",
|        "recommended": "Keep the default. Change it when: Raise it if vulnerabilities keep closing and reopening on the same devices.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_VulnSync_CloseAfterRuns/"
|      }
|    },
|    {
|      "name": "SI_VulnSync_CollapseFloor",
|      "label": "Vulnerabilities: share that must still be reported",
|      "group": "Guards (safety checks)",
|      "type": "number",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0.5 (half)",
|      "description": "The share of the open records that must still be reported (0 to 1).",
|      "purpose": "The share (0 to 1) of the open vulnerability records the newest results must still report before anything may close.",
|      "effect": "When fewer of the open records are still reported, the run looks like a partial collection and closes nothing. 0 switches this check off; 1 forbids every close.",
|      "whenToChange": "Lower it if your estate legitimately shrinks a lot between runs.",
|      "min": 0,
|      "max": 1,
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorCollapse_Enabled",
|      "info": {
|        "what": "The share (0 to 1) of the open vulnerability records the newest results must still report before anything may close.",
|        "whenChanged": "When fewer of the open records are still reported, the run looks like a partial collection and closes nothing. 0 switches this check off; 1 forbids every close.",
|        "risk": "A safety check protects your data from a broken run; changing it changes when a step is held or stopped. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: result far smaller than usual\" is on. A SecurityInsight Pro licence.",
|        "default": "0.5 (half)",
|        "recommended": "Keep the default. Change it when: Lower it if your estate legitimately shrinks a lot between runs.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_VulnSync_CollapseFloor/"
|      }
|    },
|    {
|      "name": "SI_VulnSync_MaxCloseAbsolute",
|      "label": "Vulnerability close limit (number of records)",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0 = no limit on the number (only the share counts)",
|      "description": "The number limit: 0 = none (the default for vulnerabilities).",
|      "purpose": "An optional limit on HOW MANY vulnerability records the connector may close in one run, on top of the share above.",
|      "effect": "0: only the share of the open records decides -- a patch round that closes hundreds of records out of thousands goes through. Above 0: a run that would close more records than this is held as well.",
|      "whenToChange": "Leave it at 0 for vulnerabilities. Set a number only if you want a hard cap regardless of the size of your estate.",
|      "min": 0,
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorCloseCeiling_Enabled",
|      "info": {
|        "what": "An optional limit on HOW MANY vulnerability records the connector may close in one run, on top of the share above.",
|        "whenChanged": "0: only the share of the open records decides -- a patch round that closes hundreds of records out of thousands goes through. Above 0: a run that would close more records than this is held as well.",
|        "risk": "A safety check protects your data from a broken run; changing it changes when a step is held or stopped. Reversible at once.",
|        "requires": "Works only while \"Vulnerability close limit\" is on. A SecurityInsight Pro licence.",
|        "default": "0 = no limit on the number (only the share counts)",
|        "recommended": "Keep the default. Change it when: Leave it at 0 for vulnerabilities. Set a number only if you want a hard cap regardless of the size of your estate.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_VulnSync_MaxCloseAbsolute/"
|      }
|    },
|    {
|      "name": "SI_VulnSync_MaxClosePercent",
|      "label": "Vulnerability close limit (% of open records)",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "10 %",
|      "description": "The vulnerability close limit: the share of the open records (default 10), an optional number (default 0 = no number limit -- a patch round closes hundreds), and the share that must still be reported (0 to 1, default 0.5).",
|      "purpose": "The largest share of the open vulnerability records the connector may close in one run before it holds the closes for an Admin to release.",
|      "effect": "A run that would close more than this share of the open records closes none of them and holds them (Guards page: release once). Only the records that really close count -- not first absences, held or out-of-scope records, and not closes a fresh Defender assessment confirms.",
|      "whenToChange": "Raise it if your patch rounds regularly fix more than this share at once.",
|      "unit": "%",
|      "min": 0,
|      "max": 100,
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorCloseCeiling_Enabled",
|      "info": {
|        "what": "The largest share of the open vulnerability records the connector may close in one run before it holds the closes for an Admin to release.",
|        "whenChanged": "A run that would close more than this share of the open records closes none of them and holds them (Guards page: release once). Only the records that really close count -- not first absences, held or out-of-scope records, and not closes a fresh Defender assessment confirms.",
|        "risk": "A safety check protects your data from a broken run; changing it changes when a step is held or stopped. Reversible at once.",
|        "requires": "Works only while \"Vulnerability close limit\" is on. A SecurityInsight Pro licence.",
|        "default": "10 %",
|        "recommended": "Keep the default. Change it when: Raise it if your patch rounds regularly fix more than this share at once.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_VulnSync_MaxClosePercent/"
|      }
|    },
|    {
|      "name": "SI_VulnSync_Run",
|      "label": "Vulnerability connectors: plan only",
|      "group": "Connectors & CMDB",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: each connector's own mode decides",
|      "description": "Vulnerability connectors: 'plan' keeps every connector in plan mode whatever its own mode; not set = each connector's mode.",
|      "purpose": "plan keeps every vulnerability connector in plan mode, whatever mode each connector has; it writes nothing.",
|      "effect": "plan: no vulnerability, ticket or row is written or closed by any connector; each run reports what it would do. apply or not set: each connector runs in its own mode.",
|      "whenToChange": "To pause every vulnerability connector at once, for example during a change in ServiceNow.",
|      "values": [
|        "plan",
|        "apply"
|      ],
|      "info": {
|        "what": "plan keeps every vulnerability connector in plan mode, whatever mode each connector has; it writes nothing.",
|        "whenChanged": "plan: no vulnerability, ticket or row is written or closed by any connector; each run reports what it would do. apply or not set: each connector runs in its own mode.",
|        "risk": "plan stops every vulnerability connector from writing or closing anything until it is cleared; nothing is lost, the next run catches up. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Not set: each connector's own mode decides",
|        "recommended": "Leave it empty.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_VulnSync_Run/"
|      }
|    },
|    {
|      "name": "SI_WorkspaceName",
|      "label": "Log Analytics workspace name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "log-platform-management-securityinsight when the resource id gives none",
|      "description": "Name of the Log Analytics workspace SecurityInsight writes its data to and reads from.",
|      "purpose": "Name of the Log Analytics workspace SecurityInsight writes its data to and reads from.",
|      "effect": "Used when creating a missing workspace and in run messages; Risk Analysis uses it when no workspace resource id is set. A wrong name can make setup create a new workspace.",
|      "whenToChange": "Set at install; the workspace resource id is the main setting.",
|      "card": "Log Analytics",
|      "info": {
|        "what": "Name of the Log Analytics workspace SecurityInsight writes its data to and reads from.",
|        "whenChanged": "Used when creating a missing workspace and in run messages; Risk Analysis uses it when no workspace resource id is set. A wrong name can make setup create a new workspace.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "log-platform-management-securityinsight when the resource id gives none",
|        "recommended": "Keep the default. Change it when: Set at install; the workspace resource id is the main setting.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_WorkspaceName/"
|      }
|    },
|    {
|      "name": "SI_WorkspaceResourceGroup",
|      "label": "Workspace resource group",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Taken from the workspace resource id; otherwise 'rg-securityinsight'",
|      "description": "--- Infrastructure + misc -------------------------------------------------- Resource groups of the workspace and the storage account. Setup creates both there; a collection run creates no Azure resource and assigns no role -- it only checks that they are there.",
|      "purpose": "Names the Azure resource group of the Log Analytics workspace the engines write to.",
|      "effect": "The workspace is looked up in this resource group (setup creates it there). A collection run creates nothing: a workspace it does not find is said in one line, and the send fails.",
|      "whenToChange": "Set once during setup to match your workspace; change only if the workspace moves.",
|      "card": "Log Analytics",
|      "info": {
|        "what": "Names the Azure resource group of the Log Analytics workspace the engines write to.",
|        "whenChanged": "The workspace is looked up in this resource group (setup creates it there). A collection run creates nothing: a workspace it does not find is said in one line, and the send fails.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Taken from the workspace resource id; otherwise 'rg-securityinsight'",
|        "recommended": "Keep the default. Change it when: Set once during setup to match your workspace; change only if the workspace moves.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_WorkspaceResourceGroup/"
|      }
|    },
|    {
|      "name": "SI_WorkspaceResourceId",
|      "label": "Log Analytics workspace",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: correlation, CMDB and vulnerability engines stop; others fall back",
|      "description": "REQUIRED for v2.2: full /subscriptions/.../workspaces/<ws> ARM resource ID. Engines that ingest to LA need this (the v2.1 short name was deprecated).",
|      "purpose": "Full Azure resource id of the Log Analytics workspace all engines write to and query.",
|      "effect": "Decides where all SecurityInsight data lands and is read from; also gives the subscription for ingestion. Changing it starts a new data history in the new workspace.",
|      "whenToChange": "Set at install; change only when moving to another workspace.",
|      "card": "Log Analytics",
|      "info": {
|        "what": "Full Azure resource id of the Log Analytics workspace all engines write to and query.",
|        "whenChanged": "Decides where all SecurityInsight data lands and is read from; also gives the subscription for ingestion. Changing it starts a new data history in the new workspace.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Not set: correlation, CMDB and vulnerability engines stop; others fall back",
|        "recommended": "Keep the default. Change it when: Set at install; change only when moving to another workspace.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_WorkspaceResourceId/"
|      }
|    },
|    {
|      "name": "SMTP_UseSSL",
|      "label": "Encrypted mail connection",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: Risk Analysis mail fails (run continues); the daily close-loop mail sends unencrypted",
|      "description": "Whether e-mails of risk-analysis reports are sent to the SMTP server over an encrypted (SSL/TLS) connection.",
|      "purpose": "Whether report e-mails are sent to the mail server over an encrypted (SSL/TLS) connection.",
|      "effect": "On: the connection is encrypted, as most cloud relays require. Off: plain connection, typical for an internal relay on port 25. A mismatch with the server makes sending fail.",
|      "whenToChange": "Set it to match your mail server; setup asks for it.",
|      "card": "Mail server",
|      "hint": "Must match the mail server.",
|      "info": {
|        "what": "Whether report e-mails are sent to the mail server over an encrypted (SSL/TLS) connection.",
|        "whenOn": "the connection is encrypted, as most cloud relays require.",
|        "whenOff": "plain connection, typical for an internal relay on port 25. A mismatch with the server makes sending fail.",
|        "risk": "Report mails (with asset and finding details) travel unencrypted to the mail server: only acceptable on an internal relay. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: Risk Analysis mail fails (run continues); the daily close-loop mail sends unencrypted",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SMTP_UseSSL/",
|        "confirmWhen": "off",
|        "confirm": "plain connection, typical for an internal relay on port 25. A mismatch with the server makes sending fail. Report mails (with asset and finding details) travel unencrypted to the mail server: only acceptable on an internal relay. Reversible at once."
|      }
|    },
|    {
|      "name": "SMTPFrom",
|      "label": "Mail sender address",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Left empty: the mail server user name",
|      "description": "verified-sender address (From header).",
|      "purpose": "The From address on every mail.",
|      "effect": "Sets who the mail appears to come from. A sender the relay has not verified gets the mail rejected. With no sender at all and anonymous mail, mail is skipped with a warning.",
|      "whenToChange": "Set it whenever mail is on; use an address your mail relay accepts as sender.",
|      "card": "Mail server",
|      "hint": "Use an address your mail server accepts as sender.",
|      "info": {
|        "what": "The From address on every mail.",
|        "whenChanged": "Sets who the mail appears to come from. A sender the relay has not verified gets the mail rejected. With no sender at all and anonymous mail, mail is skipped with a warning.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Left empty: the mail server user name",
|        "recommended": "Keep the default. Change it when: Set it whenever mail is on; use an address your mail relay accepts as sender.",
|        "docUrl": "https://invardia.com/docs/si/settings/SMTPFrom/"
|      }
|    },
|    {
|      "name": "SMTPPassword",
|      "label": "Mail server password",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": true,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: signed-in mail cannot start; containers read it from your Key Vault",
|      "description": "Password (or app password) for the SMTP account used to send risk-analysis report e-mails; required when sending with authentication.",
|      "purpose": "Password (or app password) of the mail server account.",
|      "effect": "Needed whenever mail is sent with sign-in. Without it, a Risk Analysis run with mail on stops at start and the daily close-loop mail is not sent.",
|      "whenToChange": "Set it when you turn mail on with a relay that needs sign-in, and when the password changes.",
|      "card": "Mail server",
|      "needs": "!Mail_SendAnonymous",
|      "info": {
|        "what": "Password (or app password) of the mail server account.",
|        "whenChanged": "Needed whenever mail is sent with sign-in. Without it, a Risk Analysis run with mail on stops at start and the daily close-loop mail is not sent.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Works only while \"Send mail without sign-in\" is off. Kept in the install's Key Vault. Read by: risk-analysis.",
|        "default": "Not set: signed-in mail cannot start; containers read it from your Key Vault",
|        "recommended": "Keep the default. Change it when: Set it when you turn mail on with a relay that needs sign-in, and when the password changes.",
|        "docUrl": "https://invardia.com/docs/si/settings/SMTPPassword/"
|      }
|    },
|    {
|      "name": "SMTPPort",
|      "label": "Mail server port",
|      "group": "Mail & notifications",
|      "type": "int",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Needed for report mails, e.g. 587",
|      "description": "25=plain/STARTTLS, 465=SMTPS, 587=submission",
|      "purpose": "The network port of the mail server used for report e-mails, for example 25, 465 or 587.",
|      "effect": "Must match the mail server and the encryption setting; a wrong port makes sending fail (the run itself continues).",
|      "whenToChange": "Set it to match your mail server; setup asks for it.",
|      "card": "Mail server",
|      "hint": "Usually 587 with an encrypted connection, 25 without.",
|      "info": {
|        "what": "The network port of the mail server used for report e-mails, for example 25, 465 or 587.",
|        "whenChanged": "Must match the mail server and the encryption setting; a wrong port makes sending fail (the run itself continues).",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Needed for report mails, e.g. 587",
|        "recommended": "Keep the default. Change it when: Set it to match your mail server; setup asks for it.",
|        "docUrl": "https://invardia.com/docs/si/settings/SMTPPort/"
|      }
|    },
|    {
|      "name": "SmtpServer",
|      "label": "Mail server",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: no mail can be sent (reports are still written)",
|      "description": "your relay's host name",
|      "purpose": "Host name of the mail server (SMTP relay) every SecurityInsight mail is sent through.",
|      "effect": "All Risk Analysis and close-loop mail goes through this server. Without it, sending fails with an error but the run completes.",
|      "whenToChange": "Set it when you turn report mail on.",
|      "card": "Mail server",
|      "info": {
|        "what": "Host name of the mail server (SMTP relay) every SecurityInsight mail is sent through.",
|        "whenChanged": "All Risk Analysis and close-loop mail goes through this server. Without it, sending fails with an error but the run completes.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: no mail can be sent (reports are still written)",
|        "recommended": "Keep the default. Change it when: Set it when you turn report mail on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SmtpServer/"
|      }
|    },
|    {
|      "name": "SMTPUser",
|      "label": "Mail server user name",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: signed-in mail cannot start; some installs read it from your Key Vault",
|      "description": "--- SMTP credential resolution ---------------------------------------------- Convention (canonical, post-v2.2.366):",
|      "purpose": "User name of the mail server account that sends the mails.",
|      "effect": "Needed with the password whenever mail is sent with sign-in. Without it, a Risk Analysis run with mail on stops at start, unless anonymous mail is on.",
|      "whenToChange": "Set it when you turn mail on with a relay that needs sign-in.",
|      "card": "Mail server",
|      "needs": "!Mail_SendAnonymous",
|      "info": {
|        "what": "User name of the mail server account that sends the mails.",
|        "whenChanged": "Needed with the password whenever mail is sent with sign-in. Without it, a Risk Analysis run with mail on stops at start, unless anonymous mail is on.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"Send mail without sign-in\" is off. Read by: risk-analysis.",
|        "default": "Not set: signed-in mail cannot start; some installs read it from your Key Vault",
|        "recommended": "Keep the default. Change it when: Set it when you turn mail on with a relay that needs sign-in.",
|        "docUrl": "https://invardia.com/docs/si/settings/SMTPUser/"
|      }
|    },
|    {
|      "name": "SpnCertificateThumbprint",
|      "label": "Certificate thumbprint (launcher name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "asset-tagging",
|        "asset-trend",
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Copied from SI_SPN_CertThumbprint; empty means no certificate sign-in",
|      "description": "Thumbprint of the certificate (in the local certificate store) the service principal signs in with; the recommended alternative to a client secret.",
|      "purpose": "Thumbprint of the certificate in the local certificate store that the service principal signs in with; the recommended alternative to a client secret.",
|      "effect": "When set with an app id, the launchers sign in with the certificate. A thumbprint that is not in the store makes sign-in fail.",
|      "whenToChange": "When you sign in with a certificate and do not use the SI_SPN_ names.",
|      "info": {
|        "what": "Thumbprint of the certificate in the local certificate store that the service principal signs in with; the recommended alternative to a client secret.",
|        "whenChanged": "When set with an app id, the launchers sign in with the certificate. A thumbprint that is not in the store makes sign-in fail.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: asset-tagging, asset-trend, azure, endpoint, identity, publicip, risk-analysis.",
|        "default": "Copied from SI_SPN_CertThumbprint; empty means no certificate sign-in",
|        "recommended": "Keep the default. Change it when: When you sign in with a certificate and do not use the SI_SPN_ names.",
|        "docUrl": "https://invardia.com/docs/si/settings/SpnCertificateThumbprint/"
|      }
|    },
|    {
|      "name": "SpnClientId",
|      "label": "App id (launcher name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "asset-tagging",
|        "asset-trend",
|        "azure",
|        "endpoint",
|        "identity",
|        "privilege-tier-classifier",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Copied from SI_SPN_AppId",
|      "description": "Application (client) id of the service principal the engines sign in as; older name kept in step with SI_SPN_AppId.",
|      "purpose": "Application (client) id of the service principal the launchers sign in as; older name kept in step with SI_SPN_AppId.",
|      "effect": "Used by the launchers for certificate, Key Vault and secret sign-in; without it those methods stop with an error.",
|      "whenToChange": "Rarely; set SI_SPN_AppId instead.",
|      "info": {
|        "what": "Application (client) id of the service principal the launchers sign in as; older name kept in step with SI_SPN_AppId.",
|        "whenChanged": "Used by the launchers for certificate, Key Vault and secret sign-in; without it those methods stop with an error.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: asset-tagging, asset-trend, azure, endpoint, identity, privilege-tier-classifier, publicip, risk-analysis.",
|        "default": "Copied from SI_SPN_AppId",
|        "recommended": "Keep the default. Change it when: Rarely; set SI_SPN_AppId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SpnClientId/"
|      }
|    },
|    {
|      "name": "SpnClientSecret",
|      "label": "Client secret (launcher name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "asset-trend",
|        "azure",
|        "endpoint",
|        "identity",
|        "privilege-tier-classifier",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": true,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Copied from SI_SPN_Secret; not set means no secret sign-in",
|      "description": "Client secret of the service principal the engines sign in as, used when no certificate thumbprint is set; prefer a certificate or Key Vault.",
|      "purpose": "Plain client secret the launchers sign in with when no managed identity, Key Vault secret or certificate is configured.",
|      "effect": "Enables plain-secret sign-in, which the launcher warns is for testing only. Storing a secret in a file is a security risk.",
|      "whenToChange": "Only in labs; prefer managed identity, a certificate or a Key Vault secret.",
|      "info": {
|        "what": "Plain client secret the launchers sign in with when no managed identity, Key Vault secret or certificate is configured.",
|        "whenChanged": "Enables plain-secret sign-in, which the launcher warns is for testing only. Storing a secret in a file is a security risk.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault. Read by: asset-trend, azure, endpoint, identity, privilege-tier-classifier, publicip, risk-analysis.",
|        "default": "Copied from SI_SPN_Secret; not set means no secret sign-in",
|        "recommended": "Keep the default. Change it when: Only in labs; prefer managed identity, a certificate or a Key Vault secret.",
|        "docUrl": "https://invardia.com/docs/si/settings/SpnClientSecret/"
|      }
|    },
|    {
|      "name": "SpnKeyVaultName",
|      "label": "Key Vault name (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "asset-tagging",
|        "asset-trend",
|        "azure",
|        "endpoint",
|        "identity",
|        "privilege-tier-classifier",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_KeyVaultName is used; no vault means no vault reads",
|      "description": "Name of the Azure Key Vault SecurityInsight reads its service principal secret and other credentials from; older name accepted alongside SI_KeyVaultName.",
|      "purpose": "Name of the Azure Key Vault holding the service principal secret and other credentials; older name accepted alongside SI_KeyVaultName.",
|      "effect": "With a secret name, the launchers read the client secret from this vault using the host's managed identity. SI_KeyVaultName wins when both are set.",
|      "whenToChange": "Rarely; set SI_KeyVaultName instead on new installs.",
|      "info": {
|        "what": "Name of the Azure Key Vault holding the service principal secret and other credentials; older name accepted alongside SI_KeyVaultName.",
|        "whenChanged": "With a secret name, the launchers read the client secret from this vault using the host's managed identity. SI_KeyVaultName wins when both are set.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: asset-tagging, asset-trend, azure, endpoint, identity, privilege-tier-classifier, publicip, risk-analysis.",
|        "default": "Not set: SI_KeyVaultName is used; no vault means no vault reads",
|        "recommended": "Keep the default. Change it when: Rarely; set SI_KeyVaultName instead on new installs.",
|        "docUrl": "https://invardia.com/docs/si/settings/SpnKeyVaultName/"
|      }
|    },
|    {
|      "name": "SpnSecretName",
|      "label": "Key Vault secret name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "asset-tagging",
|        "asset-trend",
|        "azure",
|        "endpoint",
|        "identity",
|        "privilege-tier-classifier",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": true,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: the secret is not read from Key Vault",
|      "description": "Name of the Key Vault secret that holds the service principal's client secret, used when no certificate thumbprint or direct secret is set.",
|      "purpose": "Name of the Key Vault secret that holds the service principal's client secret.",
|      "effect": "With a vault name and app id, the launchers fetch the client secret from Key Vault at each run, so no secret is stored on disk. A wrong name stops the run.",
|      "whenToChange": "When the service principal secret is kept in Key Vault rather than using a certificate or managed identity.",
|      "info": {
|        "what": "Name of the Key Vault secret that holds the service principal's client secret.",
|        "whenChanged": "With a vault name and app id, the launchers fetch the client secret from Key Vault at each run, so no secret is stored on disk. A wrong name stops the run.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault. Read by: asset-tagging, asset-trend, azure, endpoint, identity, privilege-tier-classifier, publicip, risk-analysis.",
|        "default": "Not set: the secret is not read from Key Vault",
|        "recommended": "Keep the default. Change it when: When the service principal secret is kept in Key Vault rather than using a certificate or managed identity.",
|        "docUrl": "https://invardia.com/docs/si/settings/SpnSecretName/"
|      }
|    },
|    {
|      "name": "SpnTenantId",
|      "label": "Tenant id (launcher name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "asset-tagging",
|        "asset-trend",
|        "azure",
|        "endpoint",
|        "identity",
|        "privilege-tier-classifier",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Copied from SI_SPN_TenantId; with managed identity, read from the sign-in",
|      "description": "Method 2 -- SPN + Key Vault secret:",
|      "purpose": "The Entra tenant id the launchers sign in to; older name kept in step with SI_SPN_TenantId.",
|      "effect": "Required for service principal sign-in; without it and without managed identity the launcher stops with an error.",
|      "whenToChange": "Rarely; set SI_SPN_TenantId instead.",
|      "info": {
|        "what": "The Entra tenant id the launchers sign in to; older name kept in step with SI_SPN_TenantId.",
|        "whenChanged": "Required for service principal sign-in; without it and without managed identity the launcher stops with an error.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: asset-tagging, asset-trend, azure, endpoint, identity, privilege-tier-classifier, publicip, risk-analysis.",
|        "default": "Copied from SI_SPN_TenantId; with managed identity, read from the sign-in",
|        "recommended": "Keep the default. Change it when: Rarely; set SI_SPN_TenantId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SpnTenantId/"
|      }
|    },
|    {
|      "name": "SubscriptionId",
|      "label": "Azure subscription (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Derived from the workspace resource id, else the signed-in subscription",
|      "description": "--- Subscription --- INTERNAL (AF) mode: the platform-defaults.ps1 layer sets $global:MainLogAnalyticsWorkspaceSubId; Initialize-LauncherConfig derives $global:SubscriptionId from it after all layers load (see the \"derived defaults\" step at the bottom of Initialize-LauncherConfig.ps1), so this eager assignment below is just a safety hint -- it's a no-op at Layer 0. COMMUNITY mode: customer sets $global:SubscriptionId directly in LauncherConfig.custom.ps1.",
|      "purpose": "Older name for the subscription Risk Analysis uses to find or create its workspace and ingestion resources.",
|      "effect": "Risk Analysis uses it first when resolving the workspace; other engines use it only when SI_AzSubscriptionId and the workspace resource id give none. A wrong value points at the wrong subscription.",
|      "whenToChange": "Rarely; prefer setting the full workspace resource id.",
|      "info": {
|        "what": "Older name for the subscription Risk Analysis uses to find or create its workspace and ingestion resources.",
|        "whenChanged": "Risk Analysis uses it first when resolving the workspace; other engines use it only when SI_AzSubscriptionId and the workspace resource id give none. A wrong value points at the wrong subscription.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Derived from the workspace resource id, else the signed-in subscription",
|        "recommended": "Keep the default. Change it when: Rarely; prefer setting the full workspace resource id.",
|        "docUrl": "https://invardia.com/docs/si/settings/SubscriptionId/"
|      }
|    },
|    {
|      "name": "Summary",
|      "label": "Run Summary report",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off; with neither Summary nor Detailed set, the Summary report is still built by default.",
|      "description": "Run-mode + scope flags.",
|      "purpose": "Run-mode switch telling Risk Analysis to build the Summary report and use the Summary mail settings and table.",
|      "effect": "Selects the Summary report template, its mail recipients and its Log Analytics table. Setting it together with Detailed stops the run with an error.",
|      "whenToChange": "Normally set by the launcher or container job, not in the configuration file.",
|      "info": {
|        "what": "Run-mode switch telling Risk Analysis to build the Summary report and use the Summary mail settings and table.",
|        "whenOn": "Selects the Summary report template, its mail recipients and its Log Analytics table. Setting it together with Detailed stops the run with an error.",
|        "whenOff": "with neither Summary nor Detailed set, the Summary report is still built by default.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off; with neither Summary nor Detailed set, the Summary report is still built by default.",
|        "recommended": "Keep the default. Change it when: Normally set by the launcher or container job, not in the configuration file.",
|        "docUrl": "https://invardia.com/docs/si/settings/Summary/"
|      }
|    },
|    {
|      "name": "UseManagedIdentity",
|      "label": "Managed identity on (launcher name)",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [
|        "asset-trend",
|        "azure",
|        "endpoint",
|        "identity",
|        "privilege-tier-classifier",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On when no service principal is configured; otherwise off",
|      "description": "--- Launcher auth surface (community-vm + internal-vm launcher dispatch) --- The launchers (NOT the engines) read $global:Spn* + $global:UseManagedIdentity to decide HOW to log in to Azure. Pick ONE method block. The launcher then also exports the resolved values into SI_SPN_* for engine consumption, so you don't usually need both blocks set. Method 1 -- Managed Identity:",
|      "purpose": "Tells the launchers to sign in with the host's managed identity; set automatically by the sign-in method choice.",
|      "effect": "When on, launchers sign in as the Azure VM's or Arc server's identity (or a user-assigned one), and that identity needs the permissions.",
|      "whenToChange": "Rarely; set SI_AuthMethod instead.",
|      "info": {
|        "what": "Tells the launchers to sign in with the host's managed identity; set automatically by the sign-in method choice.",
|        "whenOn": "when no service principal is configured; otherwise off",
|        "whenOff": "When on, launchers sign in as the Azure VM's or Arc server's identity (or a user-assigned one), and that identity needs the permissions.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: asset-trend, azure, endpoint, identity, privilege-tier-classifier, publicip, risk-analysis.",
|        "default": "On when no service principal is configured; otherwise off",
|        "recommended": "Keep the default. Change it when: Rarely; set SI_AuthMethod instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/UseManagedIdentity/"
|      }
|    },
|    {
|      "name": "WhatIfMode",
|      "label": "Dry run",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: a normal run.",
|      "description": "Dry run. Here, in the configuration, only asset tagging reads it (report only, no tag changed). Every other engine ignores it here and publishes as normal; start that one run with -WhatIfMode for a dry run instead.",
|      "purpose": "Requests a run that shows what would change without changing anything.",
|      "effect": "In the configuration it is read only by asset tagging, which then only reports the tags it would apply or remove. Every other engine ignores it in the configuration (scheduled runs always publish, and each run says the value was ignored): a dry run of profiling, Risk Analysis or the tier classifier is asked for per run -- start the launcher with -WhatIfMode, or set SI_WHATIF=1 on one container job execution. Such a run says so at its start and its end. Profiling and Risk Analysis then write their results to local files only -- nothing goes to Log Analytics, the mail, the export location or the caches; the run-health record says dry run. The tier classifier writes its result beside the catalog, never over it.",
|      "whenToChange": "In the configuration: only before the first real asset-tagging run. To preview any other engine, use -WhatIfMode on that one run.",
|      "info": {
|        "what": "Requests a run that shows what would change without changing anything.",
|        "whenOn": "In the configuration it is read only by asset tagging, which then only reports the tags it would apply or remove. Every other engine ignores it in the configuration (scheduled runs always publish, and each run says the value was ignored): a dry run of profiling, Risk Analysis or the tier classifier is asked for per run -- start the launcher with -WhatIfMode, or set SI_WHATIF=1 on one container job execution. Such a run says so at its start and its end. Profiling and Risk Analysis then write their results to local files only -- nothing goes to Log Analytics, the mail, the export location or the caches; the run-health record says dry run. The tier classifier writes its result beside the catalog, never over it.",
|        "whenOff": "a normal run.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: azure, endpoint, identity, publicip, risk-analysis.",
|        "default": "Off: a normal run.",
|        "recommended": "Keep the default. Change it when: In the configuration: only before the first real asset-tagging run. To preview any other engine, use -WhatIfMode on that one run.",
|        "docUrl": "https://invardia.com/docs/si/settings/WhatIfMode/"
|      }
|    },
|    {
|      "name": "WorkspaceName",
|      "label": "Workspace name (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "log-platform-management-securityinsight",
|      "defaultText": "log-platform-management-securityinsight",
|      "description": "Legacy short aliases (still read by the launchers + Setup script + RA fallback):",
|      "purpose": "Older name for the Log Analytics workspace name, read by Risk Analysis and setup checks.",
|      "effect": "Used by Risk Analysis only when no workspace resource id and no SI_WorkspaceName is set; it may then find or create a workspace with this name.",
|      "whenToChange": "Never on new installs; set SI_WorkspaceResourceId instead.",
|      "info": {
|        "what": "Older name for the Log Analytics workspace name, read by Risk Analysis and setup checks.",
|        "whenChanged": "Used by Risk Analysis only when no workspace resource id and no SI_WorkspaceName is set; it may then find or create a workspace with this name.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "log-platform-management-securityinsight",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_WorkspaceResourceId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/WorkspaceName/"
|      }
|    },
|    {
|      "name": "WorkspaceResourceGroup",
|      "label": "Workspace resource group (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "rg-securityinsight",
|      "defaultText": "rg-securityinsight",
|      "description": "Resource group of the Log Analytics workspace used when risk-analysis results are sent to Log Analytics; a risk-analysis-specific override takes precedence when set.",
|      "purpose": "Resource group of the Log Analytics workspace, used by Risk Analysis when it must find or create the workspace.",
|      "effect": "Used when SI_RiskAnalysis_WorkspaceResourceGroup is not set; its region also decides where missing resources are created. A wrong group can create a new workspace.",
|      "whenToChange": "Rarely; prefer setting the full workspace resource id.",
|      "info": {
|        "what": "Resource group of the Log Analytics workspace, used by Risk Analysis when it must find or create the workspace.",
|        "whenChanged": "Used when SI_RiskAnalysis_WorkspaceResourceGroup is not set; its region also decides where missing resources are created. A wrong group can create a new workspace.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "rg-securityinsight",
|        "recommended": "Keep the default. Change it when: Rarely; prefer setting the full workspace resource id.",
|        "docUrl": "https://invardia.com/docs/si/settings/WorkspaceResourceGroup/"
|      }
|    },
|    {
|      "name": "WorkspaceResourceId",
|      "label": "Workspace resource id (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_WorkspaceResourceId is used",
|      "description": "RA falls back to this when SI_WorkspaceResourceId is unset",
|      "purpose": "Older name for the full workspace resource id, read by Risk Analysis when the newer setting is not set.",
|      "effect": "Used only when SI_RiskAnalysis_WorkspaceResourceId and SI_WorkspaceResourceId are not set. A wrong value sends Risk Analysis data and queries to another workspace.",
|      "whenToChange": "Never on new installs; set SI_WorkspaceResourceId instead.",
|      "info": {
|        "what": "Older name for the full workspace resource id, read by Risk Analysis when the newer setting is not set.",
|        "whenChanged": "Used only when SI_RiskAnalysis_WorkspaceResourceId and SI_WorkspaceResourceId are not set. A wrong value sends Risk Analysis data and queries to another workspace.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: SI_WorkspaceResourceId is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_WorkspaceResourceId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/WorkspaceResourceId/"
|      }
|    },
|    {
|      "name": "WriteJsonOutput",
|      "label": "Risk report JSON copy",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off (shipped default)",
|      "description": "RiskAnalysis: write a JSON copy of the report next to the .xlsx. Default OFF (the shipped risk-analysis defaults set it); set $true when a downstream tool or the viewer needs it.",
|      "purpose": "Also writes the Risk Analysis report as a JSON file next to the Excel file, for tools that read machine-readable data.",
|      "effect": "On: an extra JSON file is written and uploaded with the Excel file; slightly more disk space and run time.",
|      "whenToChange": "Turn on when another tool or pipeline needs the report as JSON.",
|      "card": "Report mode and output",
|      "info": {
|        "what": "Also writes the Risk Analysis report as a JSON file next to the Excel file, for tools that read machine-readable data.",
|        "whenOn": "an extra JSON file is written and uploaded with the Excel file; slightly more disk space and run time.",
|        "whenOff": "(shipped default)",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off (shipped default)",
|        "recommended": "Keep the default. Change it when: Turn on when another tool or pipeline needs the report as JSON.",
|        "docUrl": "https://invardia.com/docs/si/settings/WriteJsonOutput/"
|      }
|    }
|  ],
|  "retired": [
|    "SI_PrestageInfra",
|    "SI_ServiceNow_DirectWrite",
|    "SI_ServiceNow_ImportSetMaxRows",
|    "SI_ServiceNow_ImportSetTable",
|    "SI_StorageKey",
|    "SI_UseStorageOAuth",
|    "SI_VulnSync_ServiceNowDirectWrite",
|    "SI_VulnSync_ServiceNowImportSetTable"
|  ]
|}
'@ }
$__siSupportFiles['launcher/_lib/SecurityInsight.shared-defaults.ps1'] = @{ Sha256 = '25fbd34ef415126d9429744be620d852b29b0a6dfc90465007418204d3c0c63c'; Text = @'
|#Requires -Version 5.1
|<#
|.SYNOPSIS
|    Solution-wide shared defaults for SecurityInsight engines.
|
|.DESCRIPTION
|    Loaded by Initialize-LauncherConfig as Layer 0 -- BEFORE any per-engine
|    defaults.ps1, platform-defaults, solution-custom or launcher-custom file.
|    Customer overrides (any later layer) win.
|
|    These four values define the canonical SecurityInsight infrastructure
|    layout that ALL engines in the solution share by default:
|
|        $global:WorkspaceName     = 'log-platform-management-securityinsight'
|        $global:DceName           = 'dce-securityinsight'
|        $global:DceResourceGroup  = 'rg-dce-securityinsight'
|        $global:DcrResourceGroup  = 'rg-dcr-securityinsight'
|
|    The ingestion engines (RiskAnalysis + IdentityAssetsCollectDefineTierIngestLog)
|    auto-create the Workspace + DCE + RGs if any are missing, and assign the
|    ingestion SPN the roles it needs. Customers only need to override when
|    deviating from this standard layout.
|
|    To override a value SOLUTION-WIDE (all SI engines):
|      edit SOLUTIONS/SecurityInsight/config/SecurityInsight.custom.ps1
|
|    To override for a SINGLE engine:
|      edit LauncherConfig.custom.ps1 in that engine's launcher folder.
|
|.NOTES
|    File         : SecurityInsight.shared-defaults.ps1
|    Solution     : SecurityInsight
|    Developed by : Morten Knudsen, Microsoft MVP
|#>
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../../engine/_shared/SI-AzRest.ps1') }
|
|# --- Log Analytics workspace (shared by RiskAnalysis + Identity + Onboarding) ---
|$global:WorkspaceName          = 'log-platform-management-securityinsight'
|$global:WorkspaceResourceGroup = 'rg-securityinsight'
|
|# --- Data Collection Endpoint (shared across all SI ingestion engines) ---
|$global:DceName                = 'dce-securityinsight'
|$global:DceResourceGroup       = 'rg-dce-securityinsight'
|
|# --- Data Collection Rules (one RG holds ALL SI DCRs; DCR NAMES are engine-specific) ---
|$global:DcrResourceGroup       = 'rg-dcr-securityinsight'
|
|# --- Region (used when the engine has to create any missing infra) ---
|$global:Location               = 'westeurope'
|
|# --- Fingerprint cache (default = DISABLED, opt-in) ---
|# The fingerprint cache (Azure Table 'sifingerprint') stores per-asset hash +
|# computed SI_Tier verdict so the Collect stage can SKIP assets whose source
|# signals haven't changed since the prior run (cadence-not-due short-circuit).
|#
|# Default is OFF because:
|#   (a) tenants running ForceFullRun=true on every cron tick (the common case)
|#       never read the cache -- the writes are pure overhead + 64KB property
|#       limit collisions on identity rows with large role/permission JSON;
|#   (b) the cache writes generate transcript noise (PS>TerminatingError(Invoke-
|#       RestMethod) lines) that obscure real errors during operator review;
|#   (c) when disabled, the Collect skip-gate degrades to "ForceFullRun-only" --
|#       safe because the engine still emits every row, just without the
|#       per-asset shortcut.
|#
|# Customers running incremental (ForceFullRun=$false) WHERE the cache actually
|# saves classifier work opt in via:
|#   $global:SI_FingerprintCache_Enabled = $true   # in SecurityInsight.custom.ps1
|#
|# Containers are unaffected either way -- the cache is a per-asset optimization,
|# not a coordination mechanism. KEDA replicas don't share state through it.
|$global:SI_FingerprintCache_Enabled = $false
|
|# --- Mail ---
|# Your own SMTP relay kept by choice: the Pro web app then stops suggesting the move to an Office 365 shared mailbox.
|# Mail is sent the same way either way.
|$global:SI_Mail_SmtpKept = $false
|
|# --- Copy findings per CI to Log Analytics (SI_Finding_CL) -- optional, OFF by default ---
|# After each Risk Analysis Detailed run, copies the de-duplicated findings (one row per CI and finding) into the Log
|# Analytics workspace, for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages read the
|# findings from its database. On a large estate the copy can take hours and adds ingestion cost. Not the report rows
|# (SendToLogAnalytics -> SI_RiskAnalysis_Detailed_CL: their own optional output, off by default -- #830). Read by Risk Analysis and the data sync
|# (engine\risk-analysis\_shared\RA-Findings.ps1, Test-SIFindingsCopyOn): on only for $true / 'on'.
|$global:SI_RA_Findings = $false
|
|# --- Disabled accounts and devices: one setting per stage ---
|# A disabled user, service principal / managed identity or computer = its account is disabled in its own directory
|# (Entra accountEnabled = false, AD userAccountControl disabled), never inferred from inactivity. The state is read
|# on every run, so an account that is enabled again is included again everywhere. A stage that leaves disabled
|# assets out says how many in its log, and their open findings, actions and tickets are kept as they are (never
|# resolved or closed) until the account is enabled again. Read by engine\_shared\SI-DisabledAssets.ps1.
|$global:SI_DisabledAssets_Collect      = $true    # collected from the sources
|$global:SI_DisabledAssets_Correlate    = $true    # take part in CI correlation (needs collection)
|$global:SI_DisabledAssets_RiskAnalysis = $false   # reach the Risk Analysis reports (needs collection)
|$global:SI_DisabledAssets_StateActions = $false   # finding / vulnerability lifecycle, close-loop, ticket open and close (needs collection)
|$global:SI_DisabledAssets_Connectors   = $false   # sent out by connectors and exports (needs collection)
|
|# --- A customer's choice: Exposure Graph identities that get no asset (#1056) ---
|# Off by default -- an install that does not turn them on works exactly as before. On (per install, the customer's own
|# choice): the identity collection records no asset for the objects below, counts them in its log and on the Data health
|# page, and their existing CIs retire with a reason naming the setting. Real users, groups, devices and findings are not
|# affected. Read by engine\asset-profiling\shared\SI-IdentityScopeChoice.ps1.
|$global:SI_Identity_SkipNeverSyncedAd         = $false   # OFF by default; on: on-prem AD accounts never synced to Entra become assets only while privileged (for tenants with very many of them; decides instead of the next one while on)
|$global:SI_Identity_SkipNeverSyncedDisabledAd = $true    # on-prem AD accounts never synced to Entra: only enabled or privileged ones become assets
|$global:SI_Identity_SkipDeletedGroups         = $true    # groups: only those Entra ID still has (active or recently deleted) become assets
|
|# --- The users' sign-in methods in full, read in the background ---
|# Every property of every sign-in method of a user (and the device of a Windows Hello / Authenticator method) needs one read
|# per user, which Microsoft throttles: about 8-9 hours at 150,000 users. The collections never make it -- its own job
|# (caj-si-signin-methods, every 15 minutes) reads users in the background, privileged first, and the collections take what it saved (with its read date; not read
|# yet = unknown, never no). Read by engine\asset-profiling\shared\SI-SignInMethodsChoice.ps1.
|$global:SI_Identity_SignInMethodsPerUser     = 'all'   # all = every member user | privileged = privileged users only | off = the tenant-wide registration report only
|$global:SI_Identity_SignInMethodsMaxAgeDays  = 90      # a user's detail is read again at the latest after this many days (sooner when its methods change)
|$global:SI_Identity_SignInMethodsFillMinutes = 8       # minutes of background reading per 15-minute run
|
|# --- Retire at once on proof of deletion (#1057) ---
|# Off by default -- an install that does not turn them on works exactly as before. On (per install, per source): an asset
|# whose source PROVES it deleted (never merely missing) retires at once instead of after the grace period, and its open
|# vulnerabilities close as 'asset deleted in <source>'. Read by engine\data-model\SI-DeletionProof.ps1.
|$global:SI_DeletionProof_Entra  = $false   # a user, device or group in Entra ID's deleted items retires at once
|$global:SI_DeletionProof_Azure  = $false   # an Azure resource with a Delete in the resource changes retires at once
|$global:SI_DeletionProof_Intune = $false   # a managed device deleted in Intune's audit events retires at once
|
|# --- CI build ---
|# Every CI is rebuilt in full at least this often (days); the runs between build only the CIs whose input changed.
|# 0 = a full build every run. Read by engine\data-model\SI-CiBuildSql.ps1 (Get-SICiFullReconcileDecision).
|$global:SI_CiBuild_FullReconcileDays  = 7
|# One asset never holds the CI build: the seconds the rules of ONE asset may take. An asset that takes longer is not fully
|# evaluated in that run -- nothing of the half evaluation is stored: it keeps what it had from its last complete evaluation
|# (a new asset is left out), is named in the run log and is evaluated again in the next run. 0 = no limit.
|# Read by engine\data-model\SI-CiEnrich.ps1 (Get-SICiRulesBudgetSeconds).
|$global:SI_CiRulesBudgetSeconds       = 60
|
|# --- Subscription ---
|# INTERNAL (AF) mode: the platform-defaults.ps1 layer sets
|# $global:MainLogAnalyticsWorkspaceSubId; Initialize-LauncherConfig derives
|# $global:SubscriptionId from it after all layers load (see the "derived
|# defaults" step at the bottom of Initialize-LauncherConfig.ps1), so this
|# eager assignment below is just a safety hint -- it's a no-op at Layer 0.
|# COMMUNITY mode: customer sets $global:SubscriptionId directly in LauncherConfig.custom.ps1.
|$global:SubscriptionId         = $global:MainLogAnalyticsWorkspaceSubId
|
|# --- SPN bridge: v2.3 -> v2.2 SI engine contract -----------------------------
|# 16 engine sites (Invoke-RiskAnalysis, Invoke-SIEngineRun, Send-SIRunHealthRow,
|# Build-IdentityProfileRow, Invoke-Output) still read $global:SI_SPN_*. v2.3
|# platform sign-in sets $global:HighPriv_Modern_* + $global:AzureTenantId.
|# Bridge here so customer custom files don't need to repeat the mapping. All
|# four assignments are conditional ("if not already set") so a customer can
|# still override any of them later in custom.ps1 if needed.
|if (-not $global:SI_SPN_TenantId -and $global:AzureTenantId) {
|    $global:SI_SPN_TenantId = $global:AzureTenantId
|}
|if (-not $global:SI_SPN_AppId -and $global:HighPriv_Modern_ApplicationID_Azure) {
|    $global:SI_SPN_AppId = $global:HighPriv_Modern_ApplicationID_Azure
|}
|if (-not $global:SI_SPN_Secret -and $global:HighPriv_Modern_Secret_Azure) {
|    $global:SI_SPN_Secret = $global:HighPriv_Modern_Secret_Azure
|}
|if (-not $global:SI_SPN_ObjectId -and $global:SI_SPN_AppId) {
|    try {
|        $global:SI_SPN_ObjectId = (Get-SIAzADServicePrincipal -ApplicationId $global:SI_SPN_AppId -ErrorAction Stop).Id
|    } catch {
|        Write-Verbose ("SI shared-defaults: SPN ObjectId lookup failed -- engines that need it will retry: $($_.Exception.Message)")
|    }
|}
|
|# --- SMTP credential resolution ----------------------------------------------
|# Convention (canonical, post-v2.2.366):
|#   $global:SMTPUser     = SMTP relay LOGIN (auth username)
|#   $global:SMTPPassword = SMTP relay PASSWORD
|#   $global:SMTPFrom     = visible from-address header on outbound mail
|#
|# INTERNAL automation pattern (this is your case):
|#   Platform-defaults sets $global:SMTPUser to the FROM ADDRESS (legacy
|#   convention -- the variable name is "SMTPUser" but its content is semantically
|#   the from-address). The actual SMTP relay LOGIN + PASSWORD live in Key Vault
|#   under secret names 'SMTPuser' + 'SMTPpassword'. When we have a platform
|#   Context AND Mail_SendAnonymous is OFF, we:
|#     1. Promote platform-defaults' $global:SMTPUser -> $global:SMTPFrom
|#     2. Force-pull SMTPUser + SMTPPassword from KV (override the from-value)
|#   Bridges from $global:HighPriv_SMTP_* (if your platform-defaults uses those)
|#   are honored as a final fallback.
|#
|# COMMUNITY pattern (no platform Context):
|#   Customer sets the actual login in $global:SMTPUser via custom.ps1 directly.
|#   No promote, no KV pull (skipped silently). Customer sets SMTPFrom too if
|#   different from SMTPUser.
|
|# 1. INTERNAL automation: promote from-address + force-pull KV creds
|# v2.2.384 -- gate flipped from `-eq $false` to `-ne $true`. The previous gate
|# only fired when SOMETHING upstream (Layer 1b or earlier) had explicitly set
|# $global:Mail_SendAnonymous = $false. Most launchers set it via Layer 4
|# (LauncherConfig.defaults), which runs AFTER this Layer 2 file -- so at gate
|# evaluation time the variable was still $null, and `$null -eq $false` evaluates
|# to $false in PowerShell, so the KV pull silently no-op'd. The new condition
|# fires whenever Context is present UNLESS the customer has explicitly opted
|# in to anonymous SMTP via $global:Mail_SendAnonymous = $true (which still
|# correctly bypasses KV credential resolution).
|if ($global:Context -and ($global:Mail_SendAnonymous -ne $true)) {
|    # the platform Key Vault is read natively (auth\SI-PlatformConnect.ps1, plain REST -- no PowerShell module)
|    if (-not (Get-Command -Name Get-SIPlatformSecret -ErrorAction SilentlyContinue)) {
|        $_siPlatformConnect = [System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'auth', 'SI-PlatformConnect.ps1')
|        if (Test-Path -LiteralPath $_siPlatformConnect) { . $_siPlatformConnect }
|    }
|    # Promote platform-defaults' SMTPUser -> SMTPFrom (preserves the from address)
|    if (-not $global:SMTPFrom -and $global:SMTPUser) {
|        $global:SMTPFrom = $global:SMTPUser
|        $global:SMTPUser = $null   # clear so KV pull below populates the actual login
|        Write-Verbose "SI shared-defaults: promoted platform-defaults `$global:SMTPUser to `$global:SMTPFrom (legacy convention); will pull actual SMTPUser+Password from KV below"
|    }
|    # Force-pull SMTPUser from KV (overrides any earlier value)
|    if (-not $global:SMTPUser) {
|        foreach ($_smtpKvName in @('SMTPuser','SMTP-User')) {
|            try {
|                $_val = Get-SIPlatformSecret -Context $global:Context -Name $_smtpKvName -AsPlainText -ErrorAction Stop
|                if ($_val) {
|                    $global:SMTPUser = $_val
|                    Write-Verbose ("SI shared-defaults: SMTPUser resolved from KV name '$_smtpKvName' (internal automation, Anonymous=false)")
|                    break
|                }
|            } catch {
|                Write-Verbose ("SI shared-defaults: KV name '$_smtpKvName' not present -- trying next ($($_.Exception.Message))")
|            }
|        }
|    }
|    # Pull SMTPPassword from KV
|    if (-not $global:SMTPPassword) {
|        foreach ($_smtpKvName in @('SMTPpassword','SMTP-Password')) {
|            try {
|                $_val = Get-SIPlatformSecret -Context $global:Context -Name $_smtpKvName -AsPlainText -ErrorAction Stop
|                if ($_val) {
|                    $global:SMTPPassword = $_val
|                    Write-Verbose ("SI shared-defaults: SMTPPassword resolved from KV name '$_smtpKvName' (internal automation, Anonymous=false)")
|                    break
|                }
|            } catch {
|                Write-Verbose ("SI shared-defaults: KV name '$_smtpKvName' not present -- trying next ($($_.Exception.Message))")
|            }
|        }
|    }
|}
|
|# 2. Final fallback bridges from HighPriv_SMTP_* (fire only if still unset)
|if (-not $global:SMTPUser     -and $global:HighPriv_SMTP_UserName) { $global:SMTPUser     = $global:HighPriv_SMTP_UserName }
|if (-not $global:SMTPPassword -and $global:HighPriv_SMTP_Password) { $global:SMTPPassword = $global:HighPriv_SMTP_Password }
|if (-not $global:SMTPFrom     -and $global:HighPriv_SMTP_From)     { $global:SMTPFrom     = $global:HighPriv_SMTP_From }
|
|# 3. Log resolved values (length-only for password) so operators can verify at run start
|Write-Host ("[shared-defaults] SMTP resolved: From={0} | User={1} | Password=[len={2}] | Anonymous={3} | Context={4}" -f `
|    ($(if ($global:SMTPFrom) { $global:SMTPFrom } else { '<NULL>' })), `
|    ($(if ($global:SMTPUser) { $global:SMTPUser } else { '<NULL>' })), `
|    ($(if ($global:SMTPPassword) { ([string]$global:SMTPPassword).Length } else { 0 })), `
|    ($(if ($null -ne $global:Mail_SendAnonymous) { $global:Mail_SendAnonymous } else { '<unset>' })), `
|    ($(if ($global:Context) { 'present' } else { 'absent' })))
'@ }
$__siSupportFiles['risk-analysis-detection/RiskAnalysis_Queries_Locked.yaml'] = @{ Sha256 = '15d277a7e1d7d7e4cf21566d2bac44ef2cadc21ba36eed6b5e9414b1b1d1f212'; Text = @'
|Reports:
|    - ReportName: Device_Missing_CVEs_Summary
|      ReportPurpose: This report highlights open endpoint CVEs (every age, unless a minimum age is set), excluding out-of-scope assets, and prioritizes
|        them using asset criticality, tag-based tiering, and exploit and exposure risk factors to focus remediation on the most
|        critical and likely exploitable vulnerabilities.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - IssueList
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // CVE MIN-age filter (only show CVEs older than SI_CveMinAgeDays). Engine
|          // substitutes SI_CveMinAgeDays from per-report exclude.custom.json
|          // (CveMinAgeDays). 0 = no age filter (default; show all).
|          // The keep-set explicitly includes isnull(CVELastModified) -- DELIBERATE,
|          // a CVE is not dropped just because the lastModifiedDate metadata is missing.
|          // Report   Device_Missing_CVEs_Summary
|          // Purpose  Overdue endpoint CVEs prioritised by criticality + exploit + exposure.
|          // Output   One row per (Tier x Severity) bucket; lists carry detail.
|          //
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Tier, CMDB values, tags and the asset risk factors
|          // (internet exposed, unsupported OS) are the CI's. The FINDINGS still come from the providers (Exposure
|          // Graph CVE edges + Defender vulnerability management) and are tied to their CI through _ciKey, the CI's
|          // link ids. DeviceKey is the Defender device id (EG EntityIds SenseDeviceId, DeviceTvm DeviceId), else
|          // the EG node id -- the same ids the CI links, so the hybrid path buckets both sides alike.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|
|          let _Assets =
|              ExposureGraphNodes
|              // v2.2.420 (audit #57.1b) -- HEDGED across property paths (NodeProperties is a payload bag, not a schema).
|              | where tostring(coalesce(NodeProperties.rawData.deviceCategory,
|                                        NodeProperties.raw.deviceCategory,
|                                        NodeProperties.deviceCategory)) == "Endpoint"
|              | extend EG_IsExcluded = tobool(coalesce(NodeProperties.rawData.isExcluded, NodeProperties.raw.isExcluded))
|              | where EG_IsExcluded == false
|              | extend _ids = tostring(EntityIds)
|              | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|              | project
|                  AssetNodeId = NodeId,
|                  AssetName   = NodeName,
|                  AssetLabel  = NodeLabel,
|                  MdeDeviceId,
|                  EG_IsExcluded
|              // v2.2.429 -- PARTITION THE EG WORK here (the identical bucket block below is the safety net).
|              | extend DeviceKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(AssetNodeId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              ;
|
|          // v2.2.212 -- 3-let architecture (materialize() of filtered edges + _RelevantFindingIds + separate _Findings).
|          let _AssetNodeIdSet = _Assets | distinct AssetNodeId;
|          let _OurAffectingEdges = materialize(
|              ExposureGraphEdges
|              | where EdgeLabel has "affecting"
|              | where TargetNodeId in (_AssetNodeIdSet)
|          );
|          let _RelevantFindingIds = _OurAffectingEdges | distinct SourceNodeId;
|          let _Findings =
|              ExposureGraphNodes
|              | where NodeLabel startswith "cve"
|              | where Categories has_any ("vulnerability_finding")
|              | where NodeId in (_RelevantFindingIds)
|              //__CVE_FILTER_BEGIN__
|              | where 1 == 1
|              //__CVE_FILTER_END__
|              | project FindingNodeId            = NodeId,
|                        FindingName              = NodeName,
|                        FindingLabel             = NodeLabel,
|                        FindingCategories        = Categories,
|                        FindingSeverity          = tostring(NodeProperties.rawData.severity),
|                        FindingCvssScore         = todouble(NodeProperties.rawData.cvssScore),
|                        FindingHasExploit        = tobool(NodeProperties.rawData.hasExploit),
|                        FindingIsExploitVerified = tobool(NodeProperties.rawData.isExploitVerified),
|                        FindingIsInExploitKit    = tobool(NodeProperties.rawData.isInExploitKit),
|                        FindingIsZeroDay         = tobool(NodeProperties.rawData.isZeroDay),
|                        CVELastModified          = todatetime(NodeProperties.rawData.lastModifiedDate),
|                        FindingDescription       = tostring(NodeProperties.rawData.description),
|                        FindingReferenceUrl      = tostring(coalesce(NodeProperties.rawData.referenceUrl, NodeProperties.rawData.url));
|
|          // v2.2.215 -- pre-collapse the multi-NodeId fanout at the edge level (one device, many EG node ids --
|          // they share the Defender device id, so they collapse onto one DeviceKey).
|          let _DeviceMap =
|              _Assets
|              | project AssetNodeId, DeviceKey, AssetName, AssetLabel, MdeDeviceId;
|
|          let _DeviceFindingEdges =
|              _OurAffectingEdges
|              | join kind=inner (_DeviceMap) on $left.TargetNodeId == $right.AssetNodeId
|              | summarize
|                  EdgeLabels  = make_set(EdgeLabel),
|                  AssetName   = any(AssetName),
|                  AssetLabel  = any(AssetLabel),
|                  MdeDeviceId = min(tostring(MdeDeviceId))
|                  by DeviceKey, SourceNodeId;
|
|          // #690 (28) -- when Defender vulnerability management holds the same device and CVE, ITS severity is the one shown (the MDE
|          // portal shows it), the graph's only where vulnerability management lacks the pair
|          let _TvmSeverityByPair =
|              DeviceTvmSoftwareVulnerabilities
|              | extend DeviceKey = tolower(tostring(DeviceId)), _cveKey = toupper(tostring(CveId))
|              | where DeviceKey in (_DeviceMap | distinct DeviceKey)
|              | summarize TvmPairSeverity = take_any(tostring(VulnerabilitySeverityLevel)) by DeviceKey, _cveKey;
|          let _AssetFindingEdges =
|              _DeviceFindingEdges
|              | join kind=inner (_Findings) on $left.SourceNodeId == $right.FindingNodeId
|              | extend _cveKey = toupper(tostring(FindingName))
|              | join kind=leftouter (_TvmSeverityByPair) on DeviceKey, _cveKey
|              | extend FindingSeverity = iff(isnotempty(TvmPairSeverity), TvmPairSeverity, FindingSeverity)
|              | project DeviceKey, AssetName, AssetLabel, MdeDeviceId, EdgeLabels,
|                        FindingName, FindingLabel, FindingCategories,
|                        FindingSeverity, FindingCvssScore,
|                        FindingHasExploit, FindingIsExploitVerified, FindingIsInExploitKit, FindingIsZeroDay,
|                        CVELastModified, FindingDescription, FindingReferenceUrl;
|
|          // #150 -- EVERY CVE DEFENDER VULNERABILITY MANAGEMENT REPORTS, NOT ONLY THOSE THE GRAPH CARRIES.
|          // Vulnerability-management rows the graph lacks are ADDED, same columns, same DeviceKey, de-duplicated
|          // on device + CVE. #505 -- the pair key is the Defender device id, no longer a host name.
|          let _egCvePairs = _AssetFindingEdges
|              | distinct _pairKey = strcat(DeviceKey, "|", toupper(FindingName));
|          // #880 -- THE SLICE'S OWN DEVICES: vulnerability management is read for the devices of THIS slice only (the same key
|          // and hash as the slice filter on the union below), so a slice reads its own share of the table, not all of it before
|          // the joins. Without slices the block is a no-op and every device is kept -- the rows are the same either way.
|          let _sliceTvmDevices = DeviceTvmSoftwareVulnerabilities
|              | summarize by DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              | project DeviceKey;
|          let _TvmOnly = DeviceTvmSoftwareVulnerabilities
|              | where tolower(tostring(DeviceId)) in (_sliceTvmDevices)
|              | summarize DeviceName = any(DeviceName), TvmSeverity = any(VulnerabilitySeverityLevel) by DeviceId, CveId
|              | join kind=leftouter (union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime)[]), (DeviceInfo) | extend ExclusionReason = tostring(column_ifexists("ExclusionReason", "")) | summarize arg_max(Timestamp, ExclusionReason) by DeviceId) on DeviceId
|              // an MDE-excluded device is dropped from the graph rows (EG_IsExcluded) -- drop it here too
|              | where isempty(ExclusionReason)
|              | join kind=leftouter (DeviceTvmSoftwareVulnerabilitiesKB | project CveId, CvssScore, IsExploitAvailable, LastModifiedTime, PublishedDate, VulnerabilityDescription) on CveId
|              //__CVE_FILTER_TVM_BEGIN__
|              | where 1 == 1
|              //__CVE_FILTER_TVM_END__
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              | extend _pairKey = strcat(DeviceKey, "|", toupper(CveId))
|              | join kind=leftanti (_egCvePairs) on _pairKey
|              | project
|                  DeviceKey,
|                  AssetName                = tostring(DeviceName),
|                  AssetLabel               = "device",
|                  MdeDeviceId              = DeviceKey,
|                  EdgeLabels               = dynamic(["vulnerability management"]),
|                  FindingName              = tostring(CveId),
|                  FindingLabel             = "cve",
|                  FindingCategories        = dynamic(["vulnerability_finding"]),
|                  FindingSeverity          = tostring(TvmSeverity),
|                  FindingCvssScore         = todouble(CvssScore),
|                  FindingHasExploit        = tobool(IsExploitAvailable),
|                  FindingIsExploitVerified = false,
|                  FindingIsInExploitKit    = false,
|                  FindingIsZeroDay         = false,
|                  CVELastModified          = todatetime(LastModifiedTime),
|                  FindingDescription       = tostring(VulnerabilityDescription),
|                  FindingReferenceUrl      = strcat("https://nvd.nist.gov/vuln/detail/", tostring(CveId));
|
|          union _AssetFindingEdges, _TvmOnly
|              | where (SI_CveMinAgeDays == 0) or (isnull(CVELastModified)) or (CVELastModified < ago(SI_CveMinAgeDays * 1d))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // #505 -- the finding's CI, by the Defender device id or the EG node id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(AssetName)),     tostring(AssetName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  tostring(DeviceKey))
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, tostring(DeviceKey))
|              | extend AssetType = iif(isnotempty(tostring(si_class)), "Endpoint", tostring(AssetLabel))
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.endpoint.fields[].
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend Impact = FindingCvssScore
|              | extend SecuritySeverity = case(
|                  tolower(FindingSeverity) == "critical", "Very High",
|                  tolower(FindingSeverity) == "high",     "High",
|                  tolower(FindingSeverity) == "medium",   "Medium",
|                  tolower(FindingSeverity) == "low",      "Low",
|                  "Low")
|              | where not (FindingName in (SI_ExcludedCves))
|              | extend HasExploit        = FindingHasExploit
|              | extend IsExploitVerified = FindingIsExploitVerified
|              | extend IsInExploitKit    = FindingIsInExploitKit
|              | extend IsZeroDay         = FindingIsZeroDay
|              | extend CveUrl = iif(isempty(FindingReferenceUrl), strcat("https://nvd.nist.gov/vuln/detail/", FindingName), FindingReferenceUrl)
|              // the fix of each finding (Defender vulnerability management, by device and CVE) -- the security update Defender recommends,
|              // its id and the affected software as Name Version (Vendor), listed per Summary row below
|              | extend _swKey = strcat(tolower(tostring(MdeDeviceId)), "|", toupper(tostring(FindingName)))
|              | join kind=leftouter (DeviceTvmSoftwareVulnerabilities
|                  | where tolower(tostring(DeviceId)) in (_sliceTvmDevices)
|                  | extend _swKey = strcat(tolower(tostring(DeviceId)), "|", toupper(tostring(CveId)))
|                  | extend _swDisplay = strcat(trim(" ", strcat(tostring(SoftwareName), " ", tostring(SoftwareVersion))), iff(isempty(tostring(SoftwareVendor)), "", strcat(" (", tostring(SoftwareVendor), ")")))
|                  | extend _fixUpdate = tostring(RecommendedSecurityUpdate), _fixUpdateId = tostring(column_ifexists("RecommendedSecurityUpdateId", ""))
|                  | extend _cveTagText = strcat_array(todynamic(column_ifexists("CveTags", dynamic([]))), ";")
|                  | summarize _swDisplaySet = make_set_if(_swDisplay, isnotempty(trim(" ", _swDisplay)), 8),
|                              _fixUpdateSet = make_set_if(_fixUpdate, isnotempty(_fixUpdate), 8),
|                              _fixUpdateIdSet = make_set_if(_fixUpdateId, isnotempty(_fixUpdateId), 8),
|                              _cveTagSet = make_set_if(_cveTagText, isnotempty(_cveTagText), 8) by _swKey) on _swKey
|              | extend _swText = strcat_array(coalesce(_swDisplaySet, dynamic([])), ";"),
|                       _fixText = strcat_array(coalesce(_fixUpdateSet, dynamic([])), ";"),
|                       _fixIdText = strcat_array(coalesce(_fixUpdateIdSet, dynamic([])), ";"),
|                       _cveTagRow = strcat_array(coalesce(_cveTagSet, dynamic([])), ";")
|              // the CVE's own context from the Defender knowledge base -- when it was published and its EPSS score
|              | extend _cveUpper = toupper(tostring(FindingName))
|              | join kind=leftouter (DeviceTvmSoftwareVulnerabilitiesKB
|                  | extend _kbEpss = round(todouble(column_ifexists("EpssScore", real(null))), 5)
|                  | project CveId = toupper(tostring(CveId)), _kbPublished = todatetime(PublishedDate), _kbEpss) on $left._cveUpper == $right.CveId
|              // finding factors (exploit, RCE) -- the report evaluates them on the provider finding
|              | extend RF_P_ExploitSignals  = iff(HasExploit == true or IsExploitVerified == true or IsInExploitKit == true or IsZeroDay == true, 1, 0)
|              | extend RF_C_RemoteCodeExec  = iff(HasExploit == true or IsExploitVerified == true or IsInExploitKit == true, 1, 0)
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              | extend RiskFactor_Probability = RF_P_ExploitSignals + array_length(RF_P_CiFactors)
|              | extend RiskFactor_Consequence = RF_C_RemoteCodeExec
|              | extend RiskFactor_Consequence_Detailed = strcat_array(array_concat(
|                  iff(RF_C_RemoteCodeExec == 1, dynamic(["RemoteCodeExecutionRisk"]), dynamic([]))), ";")
|              | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|                  iff(RF_P_ExploitSignals  == 1, dynamic(["ExploitSignals"]),     dynamic([])),
|                  RF_P_CiFactorNames), ";")
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain    = "Endpoint"
|              | extend ConfigurationName = "Update vulnerable software"
|              | extend ConfigurationId   = "CVE"
|              | extend Category          = "Vulnerabilities"
|              | extend Subcategory       = "CVEs (Missing Updates)"
|              // si_exploited_cves -- the CVE ids of the row that have a known exploit (HasExploit, as the Detailed report and
|              // the finding carry it). tostring() keeps the bucket merge recounting UniqueIssues from IssueList alone
|              | summarize
|                  UniqueIssues              = dcount(FindingName),
|                  ImpactedAssetsList        = make_set(AssetName),
|                  ImpactedAssetPairs        = make_set(strcat(AssetName, "|", AssetId)),
|                  IssueList                 = make_set(FindingName),
|                  si_exploited_cves         = make_set_if(tostring(FindingName), HasExploit == true),
|                  MoreDetails               = strcat_array(make_set(strcat(FindingName, " => ", CveUrl)), "; "),
|                  _swAll                    = make_set_if(_swText, isnotempty(_swText)),
|                  _fixAll                   = make_set_if(_fixText, isnotempty(_fixText)),
|                  _fixIdAll                 = make_set_if(_fixIdText, isnotempty(_fixIdText)),
|                  _cveTagAll                = make_set_if(_cveTagRow, isnotempty(_cveTagRow)),
|                  si_epss                   = max(_kbEpss),
|                  si_published              = min(_kbPublished),
|                  RiskFactor_Consequence    = max(RiskFactor_Consequence),
|                  RiskFactor_Consequence_Detailed = strcat_array(make_set_if(RiskFactor_Consequence_Detailed, isnotempty(RiskFactor_Consequence_Detailed)), ";"),
|                  RiskScore_Weight_Factor   = max(RiskScore_Weight_Factor),
|                  RiskFactor_Weight         = max(RiskFactor_Weight),
|                  RiskScore_Weight_Detailed = any(RiskScore_Weight_Detailed),
|                  Impact                    = max(Impact),
|                  arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|                  MdeDeviceId               = min(tostring(MdeDeviceId)),
|                  EntraAccountObjectId      = min(tostring("")),
|                  AzureResourceId           = min(tostring("")),
|                  AssetId                   = min(AssetId),
|                  MITRE_Tactics             = min(tostring(column_ifexists("MITRE_Tactics",""))),
|                  MITRE_Techniques          = min(tostring(column_ifexists("MITRE_Techniques",""))),
|                  ComplianceTags            = min(tostring(column_ifexists("ComplianceTags","")))
|                by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                   CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|                   cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|              // audit #25 -- the count is derived from the list that is actually DISPLAYED
|              | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|              // how many of the row's CVE ids have a known exploit (0 when none -- the stored row always says it)
|              | extend si_exploited_cve_count = array_length(si_exploited_cves)
|              // the row's fixes and affected software, each value once (a finding may carry several, joined with ;)
|              | extend si_affected_software = iff(array_length(_swAll) == 0, "", strcat_array(set_difference(set_union(split(strcat_array(_swAll, ";"), ";"), dynamic([])), dynamic([""])), ";")),
|                       si_fix_recommended_update = iff(array_length(_fixAll) == 0, "", strcat_array(set_difference(set_union(split(strcat_array(_fixAll, ";"), ";"), dynamic([])), dynamic([""])), ";")),
|                       si_fix_recommended_update_id = iff(array_length(_fixIdAll) == 0, "", strcat_array(set_difference(set_union(split(strcat_array(_fixIdAll, ";"), ";"), dynamic([])), dynamic([""])), ";"))
|              | extend si_fix_remediation = iff(isnotempty(si_fix_recommended_update),
|                  strcat("Install the security updates ", replace_string(si_fix_recommended_update, ";", ", "), " on the impacted devices; update the other affected software to versions that fix the listed CVEs."),
|                  "Update the affected software on the impacted devices to versions that fix the listed CVEs.")
|              | extend si_cve_tags = iff(array_length(_cveTagAll) == 0, "", strcat_array(set_difference(set_union(split(strcat_array(_cveTagAll, ";"), ";"), dynamic([])), dynamic([""])), ";"))
|              | project
|                  SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Consequence_Detailed, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetPairs, UniqueIssues,
|                  IssueList, si_exploited_cves, si_exploited_cve_count, MoreDetails,
|                  si_affected_software, si_fix_recommended_update, si_fix_recommended_update_id, si_fix_remediation,
|                  si_epss, si_published, si_cve_tags
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, ImpactedAssetCount desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|          // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|          // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, IssueList, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_description <- FindingDescription, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation
|          // si si_fix_recommended_update <- si_fix_recommended_update, si_fix_recommended_update_id <- si_fix_recommended_update_id, si_affected_software <- si_affected_software, si_epss <- si_epss
|          // si si_cve_tags <- si_cve_tags, si_fix_reference <- RecommendedSecurityUpdate, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics
|          // si si_mitre_techniques <- MITRE_Techniques, si_reference_url <- CveUrl, si_published <- si_published, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_Missing_CVEs_Detailed
|      ReportPurpose: Per-row detail of overdue endpoint CVEs, prioritised by asset criticality, exploit signals, and exposure.
|        Same CL-correlation pattern as the Summary, but emits one row per (Asset x CVE) with full per-CVE context.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      # Every severity and every tier is in scope (#643, owner 2026-10-13 "Follow scope 0-3") -- the
|      # report shows what Defender shows; the risk score ranks it.
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // CVE MIN-age filter (only show CVEs older than SI_CveMinAgeDays). Engine
|          // substitutes SI_CveMinAgeDays from per-report exclude.custom.json
|          // (CveMinAgeDays). 0 = no age filter (default; show all).
|          // The keep-set explicitly includes isnull(CVELastModified) -- DELIBERATE,
|          // a CVE is not dropped just because the lastModifiedDate metadata is missing.
|          // Report   Device_Missing_CVEs_Detailed
|          // Purpose  Per-row detail of overdue endpoint CVEs prioritised by criticality + exploit + exposure.
|          // Output   One row per (Asset x CVE), with the per-CVE context (CVE id, URL, exploit flags, description, last-modified date).
|          // Mirrors  Device_Missing_CVEs_Summary; differs only in skipping the final summarize.
|          //
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Tier, CMDB values, tags and the asset risk factors
|          // (internet exposed, unsupported OS) are the CI's. The FINDINGS still come from the providers (Exposure
|          // Graph CVE edges + Defender vulnerability management) and are tied to their CI through _ciKey, the CI's
|          // link ids. DeviceKey is the Defender device id (EG EntityIds SenseDeviceId, DeviceTvm DeviceId), else
|          // the EG node id -- the same ids the CI links, so the hybrid path buckets both sides alike.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|
|          let _Assets =
|              ExposureGraphNodes
|              // v2.2.420 (audit #57.1b) -- HEDGED across property paths (NodeProperties is a payload bag, not a schema).
|              | where tostring(coalesce(NodeProperties.rawData.deviceCategory,
|                                        NodeProperties.raw.deviceCategory,
|                                        NodeProperties.deviceCategory)) == "Endpoint"
|              | extend EG_IsExcluded = tobool(coalesce(NodeProperties.rawData.isExcluded, NodeProperties.raw.isExcluded))
|              | where EG_IsExcluded == false
|              | extend _ids = tostring(EntityIds)
|              | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|              | project
|                  AssetNodeId = NodeId,
|                  AssetName   = NodeName,
|                  AssetLabel  = NodeLabel,
|                  MdeDeviceId,
|                  EG_IsExcluded
|              // v2.2.429 -- PARTITION THE EG WORK here (the identical bucket block below is the safety net).
|              | extend DeviceKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(AssetNodeId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              ;
|
|          // v2.2.212 -- 3-let architecture (materialize() of filtered edges + _RelevantFindingIds + separate _Findings).
|          let _AssetNodeIdSet = _Assets | distinct AssetNodeId;
|          let _OurAffectingEdges = materialize(
|              ExposureGraphEdges
|              | where EdgeLabel has "affecting"
|              | where TargetNodeId in (_AssetNodeIdSet)
|          );
|          let _RelevantFindingIds = _OurAffectingEdges | distinct SourceNodeId;
|          let _Findings =
|              ExposureGraphNodes
|              | where NodeLabel startswith "cve"
|              | where Categories has_any ("vulnerability_finding")
|              | where NodeId in (_RelevantFindingIds)
|              //__CVE_FILTER_BEGIN__
|              | where 1 == 1
|              //__CVE_FILTER_END__
|              | project FindingNodeId            = NodeId,
|                        FindingName              = NodeName,
|                        FindingLabel             = NodeLabel,
|                        FindingCategories        = Categories,
|                        FindingSeverity          = tostring(NodeProperties.rawData.severity),
|                        FindingCvssScore         = todouble(NodeProperties.rawData.cvssScore),
|                        FindingHasExploit        = tobool(NodeProperties.rawData.hasExploit),
|                        FindingIsExploitVerified = tobool(NodeProperties.rawData.isExploitVerified),
|                        FindingIsInExploitKit    = tobool(NodeProperties.rawData.isInExploitKit),
|                        FindingIsZeroDay         = tobool(NodeProperties.rawData.isZeroDay),
|                        CVELastModified          = todatetime(NodeProperties.rawData.lastModifiedDate),
|                        FindingDescription       = tostring(NodeProperties.rawData.description),
|                        FindingReferenceUrl      = tostring(coalesce(NodeProperties.rawData.referenceUrl, NodeProperties.rawData.url));
|
|          // v2.2.215 -- pre-collapse the multi-NodeId fanout at the edge level (one device, many EG node ids --
|          // they share the Defender device id, so they collapse onto one DeviceKey).
|          let _DeviceMap =
|              _Assets
|              | project AssetNodeId, DeviceKey, AssetName, AssetLabel, MdeDeviceId;
|
|          let _DeviceFindingEdges =
|              _OurAffectingEdges
|              | join kind=inner (_DeviceMap) on $left.TargetNodeId == $right.AssetNodeId
|              | summarize
|                  EdgeLabels  = make_set(EdgeLabel),
|                  AssetName   = any(AssetName),
|                  AssetLabel  = any(AssetLabel),
|                  MdeDeviceId = min(tostring(MdeDeviceId))
|                  by DeviceKey, SourceNodeId;
|
|          // #690 (28) -- when Defender vulnerability management holds the same device and CVE, ITS severity is the one shown (the MDE
|          // portal shows it), the graph's only where vulnerability management lacks the pair
|          let _TvmSeverityByPair =
|              DeviceTvmSoftwareVulnerabilities
|              | extend DeviceKey = tolower(tostring(DeviceId)), _cveKey = toupper(tostring(CveId))
|              | where DeviceKey in (_DeviceMap | distinct DeviceKey)
|              | summarize TvmPairSeverity = take_any(tostring(VulnerabilitySeverityLevel)) by DeviceKey, _cveKey;
|          let _AssetFindingEdges =
|              _DeviceFindingEdges
|              | join kind=inner (_Findings) on $left.SourceNodeId == $right.FindingNodeId
|              | extend _cveKey = toupper(tostring(FindingName))
|              | join kind=leftouter (_TvmSeverityByPair) on DeviceKey, _cveKey
|              | extend FindingSeverity = iff(isnotempty(TvmPairSeverity), TvmPairSeverity, FindingSeverity)
|              | project DeviceKey, AssetName, AssetLabel, MdeDeviceId, EdgeLabels,
|                        FindingName, FindingLabel, FindingCategories,
|                        FindingSeverity, FindingCvssScore,
|                        FindingHasExploit, FindingIsExploitVerified, FindingIsInExploitKit, FindingIsZeroDay,
|                        CVELastModified, FindingDescription, FindingReferenceUrl, _fromGraph = true;
|
|          // #150 -- EVERY CVE DEFENDER VULNERABILITY MANAGEMENT REPORTS, NOT ONLY THOSE THE GRAPH CARRIES.
|          // Vulnerability-management rows the graph lacks are ADDED, same columns, same DeviceKey, de-duplicated
|          // on device + CVE. #505 -- the pair key is the Defender device id, no longer a host name.
|          let _egCvePairs = _AssetFindingEdges
|              | distinct _pairKey = strcat(DeviceKey, "|", toupper(FindingName));
|          // #880 -- THE SLICE'S OWN DEVICES: vulnerability management is read for the devices of THIS slice only (the same key
|          // and hash as the slice filter on the union below), so a slice reads its own share of the table, not all of it before
|          // the joins. Without slices the block is a no-op and every device is kept -- the rows are the same either way.
|          let _sliceTvmDevices = DeviceTvmSoftwareVulnerabilities
|              | summarize by DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              | project DeviceKey;
|          let _TvmOnly = DeviceTvmSoftwareVulnerabilities
|              | where tolower(tostring(DeviceId)) in (_sliceTvmDevices)
|              | summarize DeviceName = any(DeviceName), TvmSeverity = any(VulnerabilitySeverityLevel) by DeviceId, CveId
|              | join kind=leftouter (union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime)[]), (DeviceInfo) | extend ExclusionReason = tostring(column_ifexists("ExclusionReason", "")) | summarize arg_max(Timestamp, ExclusionReason) by DeviceId) on DeviceId
|              // an MDE-excluded device is dropped from the graph rows (EG_IsExcluded) -- drop it here too
|              | where isempty(ExclusionReason)
|              | join kind=leftouter (DeviceTvmSoftwareVulnerabilitiesKB | project CveId, CvssScore, IsExploitAvailable, LastModifiedTime, PublishedDate, VulnerabilityDescription) on CveId
|              //__CVE_FILTER_TVM_BEGIN__
|              | where 1 == 1
|              //__CVE_FILTER_TVM_END__
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              | extend _pairKey = strcat(DeviceKey, "|", toupper(CveId))
|              | join kind=leftanti (_egCvePairs) on _pairKey
|              | project
|                  DeviceKey,
|                  AssetName                = tostring(DeviceName),
|                  AssetLabel               = "device",
|                  MdeDeviceId              = DeviceKey,
|                  EdgeLabels               = dynamic(["vulnerability management"]),
|                  FindingName              = tostring(CveId),
|                  FindingLabel             = "cve",
|                  FindingCategories        = dynamic(["vulnerability_finding"]),
|                  FindingSeverity          = tostring(TvmSeverity),
|                  FindingCvssScore         = todouble(CvssScore),
|                  FindingHasExploit        = tobool(IsExploitAvailable),
|                  FindingIsExploitVerified = false,
|                  FindingIsInExploitKit    = false,
|                  FindingIsZeroDay         = false,
|                  CVELastModified          = todatetime(LastModifiedTime),
|                  FindingDescription       = tostring(VulnerabilityDescription),
|                  FindingReferenceUrl      = strcat("https://nvd.nist.gov/vuln/detail/", tostring(CveId)),
|                  _fromGraph               = false;
|
|          // #666 -- the devices of the tenant exposed to each CVE, counted in advanced hunting (Defender vulnerability
|          // management, every device that is not excluded, the whole tenant and not only this slice). Each device once per CVE.
|          let _cveExposedDevices = DeviceTvmSoftwareVulnerabilities
|              | summarize by _expCve = toupper(tostring(CveId)), _expDevice = tolower(tostring(DeviceId))
|              | where isnotempty(_expCve) and isnotempty(_expDevice)
|              | join kind=leftanti (union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime)[]), (DeviceInfo)
|                  | extend ExclusionReason = tostring(column_ifexists("ExclusionReason", ""))
|                  | summarize arg_max(Timestamp, ExclusionReason) by DeviceId
|                  | where isnotempty(ExclusionReason)
|                  | project _expDevice = tolower(tostring(DeviceId))
|                  | where isnotempty(_expDevice)) on _expDevice
|              | summarize _expDevices = count() by _expCve
|              | where isnotempty(_expCve);
|
|          union _AssetFindingEdges, _TvmOnly
|              | where (SI_CveMinAgeDays == 0) or (isnull(CVELastModified)) or (CVELastModified < ago(SI_CveMinAgeDays * 1d))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // #505 -- the finding's CI, by the Defender device id or the EG node id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(AssetName)),     tostring(AssetName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  tostring(DeviceKey))
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, tostring(DeviceKey))
|              | extend AssetType = iif(isnotempty(tostring(si_class)), "Endpoint", tostring(AssetLabel))
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.endpoint.fields[].
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend Impact = FindingCvssScore
|              | extend SecuritySeverity = case(
|                  tolower(FindingSeverity) == "critical", "Very High",
|                  tolower(FindingSeverity) == "high",     "High",
|                  tolower(FindingSeverity) == "medium",   "Medium",
|                  tolower(FindingSeverity) == "low",      "Low",
|                  "Low")
|              | where not (FindingName in (SI_ExcludedCves))
|              | extend HasExploit        = FindingHasExploit
|              | extend IsExploitVerified = FindingIsExploitVerified
|              | extend IsInExploitKit    = FindingIsInExploitKit
|              | extend IsZeroDay         = FindingIsZeroDay
|              | extend CveUrl = iif(isempty(FindingReferenceUrl), strcat("https://nvd.nist.gov/vuln/detail/", FindingName), FindingReferenceUrl)
|              // the CVE's description from the Defender knowledge base when the graph node carries none
|              | extend _cveUpper = toupper(tostring(FindingName))
|              // and the CVE's own context from the same knowledge base -- when it was published, its EPSS score, its CVSS vector and
|              // whether Defender supports it (a column a tenant does not have yet reads as empty, never as an error)
|              | join kind=leftouter (DeviceTvmSoftwareVulnerabilitiesKB
|                  | extend _kbEpss = todouble(column_ifexists("EpssScore", real(null))), _kbVector = tostring(column_ifexists("CvssVector", "")), _kbSupport = tostring(column_ifexists("CveSupportability", ""))
|                  | project CveId = toupper(tostring(CveId)), _kbDescription = tostring(VulnerabilityDescription), _kbPublished = todatetime(PublishedDate), _kbEpss, _kbVector, _kbSupport) on $left._cveUpper == $right.CveId
|              | extend CVSSDesc = iff(isnotempty(tostring(FindingDescription)), tostring(FindingDescription), tostring(_kbDescription))
|              | extend si_reference_url = tostring(CveUrl), si_published = _kbPublished, si_epss = round(_kbEpss, 5), si_cvss_vector = _kbVector, si_cve_supportability = _kbSupport
|              // #666 -- the exposed devices of the CVE (counted above) and the graph's verified exploit and exploit kit. A row the
|              // graph does not carry leaves both unknown (empty), never false. A CVE no device is exposed to stays unknown too.
|              | join kind=leftouter (_cveExposedDevices) on $left._cveUpper == $right._expCve
|              | extend si_exposed_devices = toint(_expDevices),
|                       si_exploit_verified = iff(_fromGraph == true, FindingIsExploitVerified, bool(null)),
|                       si_in_exploit_kit = iff(_fromGraph == true, FindingIsInExploitKit, bool(null))
|              // #560 #561 the affected software of the device and CVE (Defender vulnerability management) -- the finding's product, vendor, version
|              // and fix, so the classification rows can tell a SQL Server CVE from an operating-system CVE on the same server
|              // the fix of the finding -- the security update Defender recommends and its id, the affected software as Name Version (Vendor)
|              | extend _swKey = strcat(tolower(tostring(MdeDeviceId)), "|", toupper(tostring(FindingName)))
|              | join kind=leftouter (DeviceTvmSoftwareVulnerabilities
|                  | where tolower(tostring(DeviceId)) in (_sliceTvmDevices)
|                  | extend _swKey = strcat(tolower(tostring(DeviceId)), "|", toupper(tostring(CveId)))
|                  | extend _swDisplay = strcat(trim(" ", strcat(tostring(SoftwareName), " ", tostring(SoftwareVersion))), iff(isempty(tostring(SoftwareVendor)), "", strcat(" (", tostring(SoftwareVendor), ")")))
|                  | extend _fixUpdate = tostring(RecommendedSecurityUpdate), _fixUpdateId = tostring(column_ifexists("RecommendedSecurityUpdateId", ""))
|                  | extend _cveTagText = strcat_array(todynamic(column_ifexists("CveTags", dynamic([]))), ";"), _cveMitigation = tostring(column_ifexists("CveMitigationStatus", ""))
|                  | extend _invKey = strcat(tolower(tostring(DeviceId)), "|", tolower(tostring(SoftwareVendor)), "|", tolower(tostring(SoftwareName)), "|", tostring(SoftwareVersion))
|                  | join kind=leftouter (DeviceTvmSoftwareInventory
|                      | where tolower(tostring(DeviceId)) in (_sliceTvmDevices)
|                      | extend _eosStatus = tostring(column_ifexists("EndOfSupportStatus", "")), _eosDate = todatetime(column_ifexists("EndOfSupportDate", datetime(null)))
|                      | where isnotempty(_eosStatus)
|                      | extend _invKey = iff(isempty(tostring(DeviceId)) or isempty(tostring(SoftwareName)), "", strcat(tolower(tostring(DeviceId)), "|", tolower(tostring(SoftwareVendor)), "|", tolower(tostring(SoftwareName)), "|", tostring(SoftwareVersion)))
|                      | where isnotempty(_invKey)
|                      | summarize _eosStatus = take_any(_eosStatus), _eosDate = min(_eosDate) by _invKey) on _invKey
|                  | join kind=leftouter (union isfuzzy=true (datatable(DeviceId:string)[]), (DeviceTvmSoftwareEvidenceBeta)
|                      | where tolower(tostring(DeviceId)) in (_sliceTvmDevices)
|                      | extend _invKey = iff(isempty(tostring(DeviceId)) or isempty(tostring(column_ifexists("SoftwareName", ""))), "", strcat(tolower(tostring(DeviceId)), "|", tolower(tostring(column_ifexists("SoftwareVendor", ""))), "|", tolower(tostring(column_ifexists("SoftwareName", ""))), "|", tostring(column_ifexists("SoftwareVersion", ""))))
|                      | where isnotempty(_invKey)
|                      | extend _evDisk = todynamic(column_ifexists("DiskPaths", dynamic([]))), _evRegistry = todynamic(column_ifexists("RegistryPaths", dynamic([])))
|                      | extend _evPaths = array_slice(array_concat(coalesce(_evDisk, dynamic([])), coalesce(_evRegistry, dynamic([]))), 0, 4)
|                      | where array_length(_evPaths) > 0
|                      | summarize _evPaths = take_any(_evPaths) by _invKey) on _invKey
|                  | extend _evPathText = strcat_array(coalesce(_evPaths, dynamic([])), ";")
|                  | summarize SI_AffectedVendorSet = make_set(tolower(tostring(SoftwareVendor)), 8), SI_AffectedProductSet = make_set(tolower(tostring(SoftwareName)), 8),
|                              SI_AffectedVersionSet = make_set(tostring(SoftwareVersion), 8), SI_FixReferenceSet = make_set(tostring(RecommendedSecurityUpdate), 8),
|                              _swDisplaySet = make_set_if(_swDisplay, isnotempty(trim(" ", _swDisplay)), 8),
|                              _fixUpdateSet = make_set_if(_fixUpdate, isnotempty(_fixUpdate), 8),
|                              _fixUpdateIdSet = make_set_if(_fixUpdateId, isnotempty(_fixUpdateId), 8),
|                              _cveTagSet = make_set_if(_cveTagText, isnotempty(_cveTagText), 8),
|                              _cveMitigationSet = make_set_if(_cveMitigation, isnotempty(_cveMitigation), 4),
|                              _eosStatusSet = make_set_if(_eosStatus, isnotempty(_eosStatus), 4),
|                              _eosDateMin = min(_eosDate),
|                              _evPathSet = make_set_if(_evPathText, isnotempty(_evPathText), 4) by _swKey) on _swKey
|              | extend SI_AffectedVendor = strcat_array(SI_AffectedVendorSet, ";"), SI_AffectedProduct = strcat_array(SI_AffectedProductSet, ";"),
|                       SI_AffectedVersion = strcat_array(SI_AffectedVersionSet, ";"), SI_FixReference = strcat_array(SI_FixReferenceSet, ";")
|              // the CVE as Defender tags it on this device (ZeroDay, NoSecurityUpdate), its mitigation status, whether the affected
|              // software is past or near its end of support, and where on the device the software was found (a few paths per finding)
|              | extend si_cve_tags = strcat_array(coalesce(_cveTagSet, dynamic([])), ";"),
|                       si_cve_mitigation_status = strcat_array(coalesce(_cveMitigationSet, dynamic([])), ";"),
|                       si_eos_status = strcat_array(coalesce(_eosStatusSet, dynamic([])), ";"),
|                       si_eos_date = _eosDateMin,
|                       si_affected_path = strcat_array(coalesce(_evPathSet, dynamic([])), ";")
|              | extend si_affected_software = strcat_array(coalesce(_swDisplaySet, dynamic([])), ";"),
|                       si_fix_recommended_update = strcat_array(coalesce(_fixUpdateSet, dynamic([])), ";"),
|                       si_fix_recommended_update_id = strcat_array(coalesce(_fixUpdateIdSet, dynamic([])), ";")
|              | extend si_fix_remediation = case(
|                  isnotempty(si_fix_recommended_update), strcat("Install the security update ", strcat_array(_fixUpdateSet, ", "), " on the device."),
|                  isnotempty(si_affected_software),      strcat("Update ", strcat_array(_swDisplaySet, ", "), " to a version that fixes ", FindingName, "."),
|                  strcat("Update the affected software to a version that fixes ", FindingName, "."))
|              // finding factors (exploit, RCE) -- the report evaluates them on the provider finding
|              | extend RF_P_ExploitSignals  = iff(HasExploit == true or IsExploitVerified == true or IsInExploitKit == true or IsZeroDay == true, 1, 0)
|              | extend RF_C_RemoteCodeExec  = iff(HasExploit == true or IsExploitVerified == true or IsInExploitKit == true, 1, 0)
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              | extend RiskFactor_Probability = RF_P_ExploitSignals + array_length(RF_P_CiFactors)
|              | extend RiskFactor_Consequence = RF_C_RemoteCodeExec
|              | extend RiskFactor_Consequence_Detailed = strcat_array(array_concat(
|                  iff(RF_C_RemoteCodeExec == 1, dynamic(["RemoteCodeExecutionRisk"]), dynamic([]))), ";")
|              | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|                  iff(RF_P_ExploitSignals  == 1, dynamic(["ExploitSignals"]),     dynamic([])),
|                  RF_P_CiFactorNames), ";")
|              | extend CriticalityTier = toint(si_tier)
|              // #643 NO tier filter of its own -- the report follows its declared scope (CriticalityTierLevelScope, the scope
|              // block's SI_ScopeTiers), so a Tier 3 device's CVEs are in it, ranked by their risk score. A device without a tier
|              // yet passes; the engine gives it the tier the rules give it, then applies the declared scope -- the same answer
|              // it gets once it has that tier. (A hidden Detailed-only default of tiers 0-2 dropped every Tier 3 CVE until 2026-10-13.)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain    = "Endpoint"
|              | extend ConfigurationName = "Update vulnerable software"
|              // ConfigurationId carries the per-row CVE id so (AssetName, ConfigurationId) is unique per row.
|              | extend ConfigurationId   = FindingName
|              | extend Category          = "Vulnerabilities"
|              | extend Subcategory       = "CVEs (Missing Updates)"
|              | project
|                  SecurityDomain, Category, Subcategory,
|                  ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Consequence_Detailed, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  HasExploit, IsExploitVerified, IsInExploitKit, IsZeroDay,
|                  CVELastModified, CVSSDesc,
|                  SI_AffectedVendor, SI_AffectedProduct, SI_AffectedVersion, SI_FixReference,
|                  si_affected_software, si_fix_recommended_update, si_fix_recommended_update_id, si_fix_remediation,
|                  MdeDeviceId = tostring(MdeDeviceId),
|                  si_reference_url, si_published, si_epss, si_cvss_vector, si_cve_supportability,
|                  si_cve_tags, si_cve_mitigation_status, si_eos_status, si_eos_date, si_affected_path,
|                  si_exposed_devices, si_exploit_verified, si_in_exploit_kit
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, Impact desc, AssetName asc, ConfigurationId asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|          // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|          // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_description <- CVSSDesc, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation
|          // si si_fix_recommended_update <- si_fix_recommended_update, si_fix_recommended_update_id <- si_fix_recommended_update_id, si_affected_software <- si_affected_software, si_epss <- si_epss
|          // si si_cvss_vector <- si_cvss_vector, si_cve_supportability <- si_cve_supportability, si_cve_tags <- si_cve_tags, si_cve_mitigation_status <- si_cve_mitigation_status
|          // si si_eos_status <- si_eos_status, si_eos_date <- si_eos_date, si_affected_path <- si_affected_path, si_exploit_verified <- si_exploit_verified
|          // si si_in_exploit_kit <- si_in_exploit_kit, si_exposed_devices <- si_exposed_devices, si_fix_reference <- SI_FixReference, si_reference_url <- si_reference_url
|          // si si_published <- si_published, si_affected_product <- SI_AffectedProduct, si_affected_vendor <- SI_AffectedVendor, si_affected_version <- SI_AffectedVersion
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_Recommendations_Summary
|      ReportPurpose: Non-compliant TVM secure configuration controls on endpoints, prioritised by criticality + exposure + legacy-OS.
|        Same CI pattern as Device_Missing_CVEs_Summary -- tier, tags, the asset risk factors and the CMDB values come from
|        the CI (SI_CI_CL, requirement 505), joined on the Defender device id.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_Recommendations_Summary
|          // Purpose  Non-compliant TVM secure configuration controls on endpoints, prioritised by criticality + exposure + legacy-OS.
|          // Output   One row per (Tier x Severity x ConfigurationId x cmdb*) bucket; lists carry impacted-asset detail.
|          //
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Tier, CMDB values, tags and the asset risk factors
|          // (internet exposed, unsupported OS) are the CI's. The FINDINGS are the Defender secure-configuration
|          // assessments, tied to their CI through _ciKey by the Defender device id (DeviceId, lower-cased).
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          // Step 0c  Excluded ConfigurationIds -- block-marker substituted by engine from the per-report exclude.custom.json.
|
|          // Step 0e  Optional category/subcategory description lookups. Empty when key is missing.
|          let CategoryLookup = datatable(Category:string, CategoryDescription:string)
|          [
|            "Security controls", "Endpoint protection and attack-surface policies that block common malware and attacker techniques.",
|            "Network",           "Network security policies that limit attack surface and lateral movement.",
|            "BitLocker",         "Full-disk encryption to prevent data exposure on lost or stolen devices.",
|            "OS",                "Operating system baseline hardening and core protections.",
|            "Credentials",       "Controls that prevent credential theft and reuse.",
|            "Browser",           "Safe browsing and web threat protections.",
|            "Application",       "Application control and exploit protection to restrict unauthorized code execution.",
|            "Device",            "General endpoint configuration and health requirements.",
|            "Audit",             "Monitoring-focused baselines to validate configuration posture."
|          ];
|          let SubCategoryLookup = datatable(Subcategory:string, SubCategoryDescription:string)
|          [
|            "EDR",                        "Defender for Endpoint sensor presence and reporting health.",
|            "Attack Surface Reduction",   "Blocks common malware execution paths from email, web and Office content.",
|            "Firewall",                   "Enforces inbound/outbound traffic policy and host firewall state.",
|            "Antivirus",                  "Ensures Microsoft Defender Antivirus is active and properly configured.",
|            "BitLocker",                  "Enforces full-disk encryption and key escrow.",
|            "Exploit Guard",              "Hardens OS/apps against memory corruption and exploit chains.",
|            "Authentication",             "Strengthens sign-in security and protects credential boundaries.",
|            "Remote Access",              "Restricts remote shell/administrative entry points.",
|            "TLS/Communication",          "Requires secure protocols and prevents crypto downgrade.",
|            "Removable Storage",          "Controls external media to reduce malware risk and data exfiltration."
|          ];
|
|          let lookback       = 30d;
|          let onlyApplicable = true;
|
|          // Step 1  Latest DeviceInfo per device (DeviceName for the impacted-asset list).
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(lookback)
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project
|                  DeviceId,
|                  DI_DeviceName  = DeviceName;
|
|          // Step 2  Load TVM secure configuration data and KB enrichment.
|          let TVM_Base =
|              DeviceTvmSecureConfigurationAssessment
|              | where Timestamp >= ago(lookback)
|              // #690 (12) the LATEST assessment of each device and setting decides -- taken before the applicable filter, so a
|              // setting whose newest assessment says it no longer applies is not reported from an older row
|              | summarize arg_max(Timestamp, *) by DeviceId, ConfigurationId
|              | where iff(onlyApplicable, IsApplicable == 1, true)
|              | where not (ConfigurationId in (SI_ExcludedConfigurationIds))
|              | join kind=leftouter (
|                  DeviceTvmSecureConfigurationAssessmentKB
|                  | project
|                      ConfigurationId,
|                      KB_ConfigurationName        = ConfigurationName,
|                      KB_ConfigurationCategory    = ConfigurationCategory,
|                      KB_ConfigurationSubcategory = ConfigurationSubcategory,
|                      KB_Impact                   = toint(ConfigurationImpact),
|                      KB_RiskDescription          = tostring(RiskDescription),
|                      KB_Description              = tostring(ConfigurationDescription),
|                      KB_Remediation              = tostring(RemediationOptions),
|                      KB_MitreTactics             = column_ifexists("RelatedMitreTactics", dynamic([])),
|                      KB_MitreTechniques          = column_ifexists("RelatedMitreTechniques", dynamic([])),
|                      KB_Tags                     = Tags,
|                      KB_Benchmarks               = ConfigurationBenchmarks
|                ) on ConfigurationId
|              | extend ImpactInt = toint(coalesce(KB_Impact, toint(ConfigurationImpact)))
|              | extend
|                  Category          = coalesce(KB_ConfigurationCategory, ConfigurationCategory),
|                  Subcategory       = coalesce(KB_ConfigurationSubcategory, tostring(column_ifexists("ConfigurationSubcategory", ""))),
|                  ConfigurationName = coalesce(KB_ConfigurationName, tostring(ConfigurationId)),
|                  IsCompliant       = tobool(IsCompliant),
|                  MITRE_Tactics     = strcat_array(KB_MitreTactics, ";"),
|                  MITRE_Techniques  = strcat_array(KB_MitreTechniques, ";"),
|                  ComplianceTags    = strcat_array(array_concat(coalesce(KB_Tags, dynamic([])), coalesce(KB_Benchmarks, dynamic([]))), ";")
|              | extend SecuritySeverity = case(
|                  ImpactInt == 10, "Very High",
|                  ImpactInt == 9,  "High",
|                  ImpactInt == 8,  "Medium-High",
|                  ImpactInt >= 5,  "Medium",
|                  "Low")
|              | summarize arg_max(Timestamp, *) by DeviceId, ConfigurationId
|              | where IsCompliant == false
|              | lookup CategoryLookup on Category
|              | lookup SubCategoryLookup on Subcategory
|              | extend
|                  CategoryDescription    = coalesce(CategoryDescription, ""),
|                  SubCategoryDescription = coalesce(SubCategoryDescription, "");
|
|          // Step 3  Join the TVM findings to DeviceInfo (name) and to their CI (by the Defender device id).
|          TVM_Base
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // #505 -- the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(DeviceName)),    tostring(DeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.endpoint.fields[].
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100   // basis-100, 100 = 1.0x = no lift
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              | summarize
|                  UniqueIssues              = dcount(ConfigurationId),
|                  ImpactedAssetsList        = make_set(AssetName),
|                  ImpactedAssetPairs        = make_set(strcat(AssetName, "|", AssetId)),
|                  ConfigurationDescription  = take_anyif(KB_Description, isnotempty(KB_Description)),
|                  RiskDescription           = take_anyif(KB_RiskDescription, isnotempty(KB_RiskDescription)),
|                  si_fix_remediation        = take_anyif(KB_Remediation, isnotempty(KB_Remediation)),
|                  RiskFactor_Consequence    = max(RiskFactor_Consequence),
|                  RiskScore_Weight_Factor   = max(RiskScore_Weight_Factor),
|                  RiskFactor_Weight         = max(RiskFactor_Weight),
|                  RiskScore_Weight_Detailed = any(RiskScore_Weight_Detailed),
|                  Impact                    = max(ImpactInt),
|                  arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|                  MdeDeviceId               = min(tostring(DeviceKey)),
|                  EntraAccountObjectId      = min(tostring("")),
|                  AzureResourceId           = min(tostring("")),
|                  AssetId                   = min(AssetId),
|                  MITRE_Tactics             = min(tostring(column_ifexists("MITRE_Tactics",""))),
|                  MITRE_Techniques          = min(tostring(column_ifexists("MITRE_Techniques",""))),
|                  ComplianceTags            = min(tostring(column_ifexists("ComplianceTags","")))
|                by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                   CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|                   cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|              // audit #25 -- the count is derived from the list that is actually DISPLAYED
|              | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|              | project
|                  SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetPairs, UniqueIssues,
|                  ConfigurationDescription, RiskDescription, si_fix_remediation
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, ImpactedAssetCount desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|          // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|          // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_description <- ConfigurationDescription, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation
|          // si si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_Recommendations_Detailed
|      ReportPurpose: Per-row detail of non-compliant TVM secure configuration controls on endpoints, prioritised by criticality + exposure + legacy-OS.
|        Same CL-correlation pattern as Device_Recommendations_Summary; differs only in skipping the final summarize and emitting one row per (Asset x ConfigurationId) with full per-row context (RecommendedAction, RemediationOptions, Benchmarks, etc.).
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      # Low + Medium intentionally excluded from Detailed scope -- TVM configuration
|      # baselines are hygiene-heavy at Medium tier (CIS-style optional hardening) and
|      # produce 80K+ per-(Asset x ConfigurationId) rows on 13K-asset tenants. Summary
|      # variant aggregates the full distribution; LA still receives every row.
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - RecommendedAction
|      - RemediationOptions
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_Recommendations_Detailed
|          // Purpose  Per-row detail of non-compliant TVM secure configuration controls on endpoints, prioritised by criticality + exposure + legacy-OS.
|          // Output   One row per (Asset x ConfigurationId), with the per-row context (RecommendedAction, RemediationOptions, Benchmarks ...).
|          // Mirrors  Device_Recommendations_Summary.
|          //
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Tier, CMDB values, tags and the asset risk factors
|          // (internet exposed, unsupported OS) are the CI's. The FINDINGS are the Defender secure-configuration
|          // assessments, tied to their CI through _ciKey by the Defender device id (DeviceId, lower-cased).
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          // Step 0c  Excluded ConfigurationIds -- block-marker substituted by engine from the per-report exclude.custom.json.
|
|          // Step 0e  Optional category/subcategory description lookups. Empty when key is missing.
|          let CategoryLookup = datatable(Category:string, CategoryDescription:string)
|          [
|            "Security controls", "Endpoint protection and attack-surface policies that block common malware and attacker techniques.",
|            "Network",           "Network security policies that limit attack surface and lateral movement.",
|            "BitLocker",         "Full-disk encryption to prevent data exposure on lost or stolen devices.",
|            "OS",                "Operating system baseline hardening and core protections.",
|            "Credentials",       "Controls that prevent credential theft and reuse.",
|            "Browser",           "Safe browsing and web threat protections.",
|            "Application",       "Application control and exploit protection to restrict unauthorized code execution.",
|            "Device",            "General endpoint configuration and health requirements.",
|            "Audit",             "Monitoring-focused baselines to validate configuration posture."
|          ];
|          let SubCategoryLookup = datatable(Subcategory:string, SubCategoryDescription:string)
|          [
|            "EDR",                        "Defender for Endpoint sensor presence and reporting health.",
|            "Attack Surface Reduction",   "Blocks common malware execution paths from email, web and Office content.",
|            "Firewall",                   "Enforces inbound/outbound traffic policy and host firewall state.",
|            "Antivirus",                  "Ensures Microsoft Defender Antivirus is active and properly configured.",
|            "BitLocker",                  "Enforces full-disk encryption and key escrow.",
|            "Exploit Guard",              "Hardens OS/apps against memory corruption and exploit chains.",
|            "Authentication",             "Strengthens sign-in security and protects credential boundaries.",
|            "Remote Access",              "Restricts remote shell/administrative entry points.",
|            "TLS/Communication",          "Requires secure protocols and prevents crypto downgrade.",
|            "Removable Storage",          "Controls external media to reduce malware risk and data exfiltration."
|          ];
|
|          let lookback       = 30d;
|          let onlyApplicable = true;
|
|          // Step 1  Latest DeviceInfo per device (DeviceName + OS for display).
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(lookback)
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project
|                  DeviceId,
|                  DI_DeviceName  = DeviceName,
|                  DI_OSPlatform  = tostring(OSPlatform);
|
|          // Step 2  Load TVM secure configuration data and KB enrichment.
|          let TVM_Base =
|              DeviceTvmSecureConfigurationAssessment
|              | where Timestamp >= ago(lookback)
|              // #690 (12) the LATEST assessment of each device and setting decides -- taken before the applicable filter, so a
|              // setting whose newest assessment says it no longer applies is not reported from an older row
|              | summarize arg_max(Timestamp, *) by DeviceId, ConfigurationId
|              | where iff(onlyApplicable, IsApplicable == 1, true)
|              | where not (ConfigurationId in (SI_ExcludedConfigurationIds))
|              | join kind=leftouter (
|                  DeviceTvmSecureConfigurationAssessmentKB
|                  | project
|                      ConfigurationId,
|                      KB_ConfigurationName        = ConfigurationName,
|                      KB_ConfigurationCategory    = ConfigurationCategory,
|                      KB_ConfigurationSubcategory = ConfigurationSubcategory,
|                      KB_Impact                   = toint(ConfigurationImpact),
|                      KB_RiskDescription          = tostring(RiskDescription),
|                      KB_Description              = tostring(ConfigurationDescription),
|                      KB_Remediation              = tostring(RemediationOptions),
|                      KB_Benchmarks               = ConfigurationBenchmarks,
|                      KB_MitreTactics             = column_ifexists("RelatedMitreTactics", dynamic([])),
|                      KB_MitreTechniques          = column_ifexists("RelatedMitreTechniques", dynamic([])),
|                      KB_Tags                     = Tags
|                ) on ConfigurationId
|              | extend ImpactInt = toint(coalesce(KB_Impact, toint(ConfigurationImpact)))
|              | extend
|                  Category          = coalesce(KB_ConfigurationCategory, ConfigurationCategory),
|                  Subcategory       = coalesce(KB_ConfigurationSubcategory, tostring(column_ifexists("ConfigurationSubcategory", ""))),
|                  ConfigurationName = coalesce(KB_ConfigurationName, tostring(ConfigurationId)),
|                  IsCompliant       = tobool(IsCompliant),
|                  IsApplicable      = tobool(IsApplicable),
|                  MITRE_Tactics     = strcat_array(KB_MitreTactics, ";"),
|                  MITRE_Techniques  = strcat_array(KB_MitreTechniques, ";"),
|                  ComplianceTags    = strcat_array(array_concat(coalesce(KB_Tags, dynamic([])), coalesce(KB_Benchmarks, dynamic([]))), ";")
|              | extend
|                  RecommendedAction = case(
|                      ImpactInt >= 9, "Fix immediately - Security Change Queue / Intune / GPO rollout",
|                      ImpactInt == 8, "Schedule within quarterly hardening cycle",
|                      ImpactInt >= 5 and ImpactInt < 8, "Fix opportunistically (during upgrades / refresh)",
|                      "Monitor, document as baseline exceptions"),
|                  SecuritySeverity = case(
|                      ImpactInt == 10, "Very High",
|                      ImpactInt == 9,  "High",
|                      ImpactInt == 8,  "Medium-High",
|                      ImpactInt >= 5,  "Medium",
|                      "Low"),
|                  SecuritySeverityDescription = case(
|                      ImpactInt == 10, "If this configuration is not applied, attackers gain a major foothold or common attack vector remains wide open.",
|                      ImpactInt == 9,  "Strongly recommended to fix ASAP; commonly exploited by real-world malware and ransomware.",
|                      ImpactInt == 8,  "Important baseline security hardening; reduces attack surface and lateral movement.",
|                      ImpactInt >= 5,  "Security best practice; helps reduce exposure but less frequently exploited.",
|                      "Hardening / hygiene controls; helps, but attackers less likely to target.")
|              | summarize arg_max(Timestamp, *) by DeviceId, ConfigurationId
|              | where IsCompliant == false
|              | lookup CategoryLookup on Category
|              | lookup SubCategoryLookup on Subcategory
|              | extend
|                  CategoryDescription    = coalesce(CategoryDescription, ""),
|                  SubCategoryDescription = coalesce(SubCategoryDescription, "");
|
|          // Step 3  Join the TVM findings to DeviceInfo (name, OS) and to their CI (by the Defender device id).
|          TVM_Base
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // #505 -- the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(DeviceName)),    tostring(DeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend AssetType = "Endpoint"
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.endpoint.fields[].
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100   // basis-100, 100 = 1.0x = no lift
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              // what Defender found on the device for this setting (the offending value) and whether applying the fix is
|              // expected to affect users -- columns a tenant does not have read as empty
|              | extend _siContext = tostring(column_ifexists("Context", "")), _siImpactFlag = tobool(column_ifexists("IsExpectedUserImpact", bool(null)))
|              | extend _siEvidence = iff(_siContext in ("", "[]", "[[]]", "null"), "", substring(_siContext, 0, 4000)),
|                       _siUserImpact = case(_siImpactFlag == true, "User impact expected", _siImpactFlag == false, "No user impact expected", "")
|              | project
|                  SecurityDomain, Category, Subcategory,
|                  ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  Impact = ImpactInt, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  OSPlatform = coalesce(DI_OSPlatform, OSPlatform),
|                  IsCompliant, IsApplicable,
|                  RecommendedAction,
|                  RiskDescription          = KB_RiskDescription,
|                  ConfigurationDescription = KB_Description,
|                  RemediationOptions       = KB_Remediation,
|                  si_fix_remediation       = KB_Remediation,
|                  Benchmarks               = KB_Benchmarks,
|                  CategoryDescription, SubCategoryDescription,
|                  SecuritySeverityDescription,
|                  MdeDeviceId              = DeviceKey,
|                  MITRE_Tactics, MITRE_Techniques, ComplianceTags,
|                  si_evidence              = _siEvidence,
|                  si_user_impact           = _siUserImpact
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, Impact desc, AssetName asc, ConfigurationId asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|          // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|          // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RecommendedAction, RemediationOptions, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_description <- ConfigurationDescription, si_remediation <- RemediationOptions, si_fix_remediation <- RemediationOptions
|          // si si_evidence <- si_evidence, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|          // si si_user_impact <- si_user_impact, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_EndOfSupport_Software_Summary
|      ReportPurpose: >-
|        Software on endpoints that is past or near its end of support (Defender vulnerability management), prioritised by asset criticality and exposure. The asset (tier, tags, risk factors, CMDB values) comes from the CI, joined on the Defender device id. One row per finding with the impacted devices listed.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_EndOfSupport_Software_Summary
|          // Purpose  Endpoints with software that has reached or is nearing its end of support, from Defender vulnerability management, on the CI of the device.
|          // The asset comes from the CI (SI_CI_CL), the findings from Defender advanced hunting, tied through the Defender device id.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          let _src =
|              DeviceTvmSoftwareInventory
|              | extend _eosStatus = tostring(column_ifexists("EndOfSupportStatus", "")), _eosDate = todatetime(column_ifexists("EndOfSupportDate", datetime(null))), _cpe = tostring(column_ifexists("ProductCodeCpe", ""))
|              | where isnotempty(_eosStatus) and _eosStatus !~ "None"
|              | extend SoftwareVendor = tostring(SoftwareVendor), SoftwareName = tostring(SoftwareName), SoftwareVersion = tostring(SoftwareVersion)
|              // #690 (13) the inventory's own device name -- the name shown when DeviceInfo has no row for the device
|              | summarize _eosStatus = take_any(_eosStatus), _eosDate = min(_eosDate), _cpe = take_anyif(_cpe, isnotempty(_cpe)), _invDeviceName = take_anyif(tostring(DeviceName), isnotempty(tostring(DeviceName))) by DeviceId, SoftwareVendor, SoftwareName, SoftwareVersion
|              | extend _ended = (isnotnull(_eosDate) and _eosDate <= now()) or (isnull(_eosDate) and _eosStatus startswith "EOS")
|              | extend _days = iff(isnull(_eosDate), int(null), toint(datetime_diff("day", _eosDate, now())))
|              | extend ImpactInt = case(_ended, 9, isnotnull(_days) and _days <= 90, 8, 5)
|              | extend Category = "Vulnerabilities", Subcategory = "End of support software"
|              | extend _swShort = trim(" ", strcat(SoftwareName, " ", SoftwareVersion))
|              | extend ConfigurationName = strcat(iff(_ended, "Software past its end of support - ", "Software nearing its end of support - "), _swShort)
|              | extend ConfigurationId = tolower(strcat("eos:", SoftwareVendor, ":", SoftwareName, ":", SoftwareVersion))
|              | extend si_affected_software = strcat(_swShort, iff(isempty(SoftwareVendor), "", strcat(" (", SoftwareVendor, ")"))),
|                       SI_AffectedVendor = tolower(SoftwareVendor), SI_AffectedProduct = tolower(SoftwareName), SI_AffectedVersion = SoftwareVersion,
|                       si_affected_cpe = coalesce(_cpe, ""), si_eos_status = _eosStatus, si_eos_date = _eosDate,
|                       si_certificate_expiry = datetime(null), si_certificate_thumbprint = "",
|                       si_evidence = strcat(_eosStatus, iff(isnull(_eosDate), "", strcat(", support ends ", format_datetime(_eosDate, "yyyy-MM-dd")))),
|                       si_fix_remediation = strcat("Upgrade ", SoftwareName, " to a version the vendor still supports, or remove it from the device.");
|
|          // the newest device row -- its name and operating system for display, and whether Defender excludes the device
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(30d)
|              | extend DI_Excluded = tostring(column_ifexists("ExclusionReason", ""))
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project DeviceId, DI_DeviceName = DeviceName, DI_OSPlatform = tostring(OSPlatform), DI_Excluded;
|
|          _src
|              | extend DeviceId = tostring(DeviceId)
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              // a device Defender excludes is not reported
|              | where isempty(DI_Excluded)
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(_invDeviceName)), tostring(_invDeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend AssetType = "Endpoint"
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecuritySeverity = case(
|                  ImpactInt >= 10, "Very High",
|                  ImpactInt == 9,  "High",
|                  ImpactInt == 8,  "Medium-High",
|                  ImpactInt >= 5,  "Medium",
|                  "Low")
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              | summarize
|                  UniqueIssues              = dcount(ConfigurationId),
|                  ImpactedAssetsList        = make_set(AssetName),
|                  ImpactedAssetPairs        = make_set(strcat(AssetName, "|", AssetId)),
|                  si_fix_remediation        = take_anyif(si_fix_remediation, isnotempty(si_fix_remediation)),
|                  si_evidence               = take_anyif(si_evidence, isnotempty(si_evidence)),
|                  si_affected_software      = take_anyif(si_affected_software, isnotempty(si_affected_software)),
|                  si_eos_status             = take_anyif(si_eos_status, isnotempty(si_eos_status)),
|                  si_eos_date               = min(si_eos_date),
|                  si_certificate_expiry     = min(si_certificate_expiry),
|                  RiskFactor_Consequence    = max(RiskFactor_Consequence),
|                  RiskScore_Weight_Factor   = max(RiskScore_Weight_Factor),
|                  RiskFactor_Weight         = max(RiskFactor_Weight),
|                  RiskScore_Weight_Detailed = any(RiskScore_Weight_Detailed),
|                  Impact                    = max(ImpactInt),
|                  arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|                  MdeDeviceId               = min(tostring(DeviceKey)),
|                  EntraAccountObjectId      = min(tostring("")),
|                  AzureResourceId           = min(tostring("")),
|                  AssetId                   = min(AssetId)
|                by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                   CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|                   cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|              | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|              | project
|                  SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetPairs, UniqueIssues,
|                  si_fix_remediation, si_evidence, si_affected_software, si_eos_status, si_eos_date, si_certificate_expiry
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, ImpactedAssetCount desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|          // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|          // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software
|          // si si_eos_status <- si_eos_status, si_eos_date <- si_eos_date, si_evidence <- si_evidence, si_certificate_expiry <- si_certificate_expiry
|          // si si_certificate_thumbprint <- si_certificate_thumbprint, si_affected_product <- SI_AffectedProduct, si_affected_vendor <- SI_AffectedVendor, si_affected_version <- SI_AffectedVersion
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_EndOfSupport_Software_Detailed
|      ReportPurpose: >-
|        Software on endpoints that is past or near its end of support (Defender vulnerability management), prioritised by asset criticality and exposure. The asset (tier, tags, risk factors, CMDB values) comes from the CI, joined on the Defender device id. One row per device and finding.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_EndOfSupport_Software_Detailed
|          // Purpose  Endpoints with software that has reached or is nearing its end of support, from Defender vulnerability management, on the CI of the device.
|          // The asset comes from the CI (SI_CI_CL), the findings from Defender advanced hunting, tied through the Defender device id.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          let _src =
|              DeviceTvmSoftwareInventory
|              | extend _eosStatus = tostring(column_ifexists("EndOfSupportStatus", "")), _eosDate = todatetime(column_ifexists("EndOfSupportDate", datetime(null))), _cpe = tostring(column_ifexists("ProductCodeCpe", ""))
|              | where isnotempty(_eosStatus) and _eosStatus !~ "None"
|              | extend SoftwareVendor = tostring(SoftwareVendor), SoftwareName = tostring(SoftwareName), SoftwareVersion = tostring(SoftwareVersion)
|              // #690 (13) the inventory's own device name -- the name shown when DeviceInfo has no row for the device
|              | summarize _eosStatus = take_any(_eosStatus), _eosDate = min(_eosDate), _cpe = take_anyif(_cpe, isnotempty(_cpe)), _invDeviceName = take_anyif(tostring(DeviceName), isnotempty(tostring(DeviceName))) by DeviceId, SoftwareVendor, SoftwareName, SoftwareVersion
|              | extend _ended = (isnotnull(_eosDate) and _eosDate <= now()) or (isnull(_eosDate) and _eosStatus startswith "EOS")
|              | extend _days = iff(isnull(_eosDate), int(null), toint(datetime_diff("day", _eosDate, now())))
|              | extend ImpactInt = case(_ended, 9, isnotnull(_days) and _days <= 90, 8, 5)
|              | extend Category = "Vulnerabilities", Subcategory = "End of support software"
|              | extend _swShort = trim(" ", strcat(SoftwareName, " ", SoftwareVersion))
|              | extend ConfigurationName = strcat(iff(_ended, "Software past its end of support - ", "Software nearing its end of support - "), _swShort)
|              | extend ConfigurationId = tolower(strcat("eos:", SoftwareVendor, ":", SoftwareName, ":", SoftwareVersion))
|              | extend si_affected_software = strcat(_swShort, iff(isempty(SoftwareVendor), "", strcat(" (", SoftwareVendor, ")"))),
|                       SI_AffectedVendor = tolower(SoftwareVendor), SI_AffectedProduct = tolower(SoftwareName), SI_AffectedVersion = SoftwareVersion,
|                       si_affected_cpe = coalesce(_cpe, ""), si_eos_status = _eosStatus, si_eos_date = _eosDate,
|                       si_certificate_expiry = datetime(null), si_certificate_thumbprint = "",
|                       si_evidence = strcat(_eosStatus, iff(isnull(_eosDate), "", strcat(", support ends ", format_datetime(_eosDate, "yyyy-MM-dd")))),
|                       si_fix_remediation = strcat("Upgrade ", SoftwareName, " to a version the vendor still supports, or remove it from the device.");
|
|          // the newest device row -- its name and operating system for display, and whether Defender excludes the device
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(30d)
|              | extend DI_Excluded = tostring(column_ifexists("ExclusionReason", ""))
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project DeviceId, DI_DeviceName = DeviceName, DI_OSPlatform = tostring(OSPlatform), DI_Excluded;
|
|          _src
|              | extend DeviceId = tostring(DeviceId)
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              // a device Defender excludes is not reported
|              | where isempty(DI_Excluded)
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(_invDeviceName)), tostring(_invDeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend AssetType = "Endpoint"
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecuritySeverity = case(
|                  ImpactInt >= 10, "Very High",
|                  ImpactInt == 9,  "High",
|                  ImpactInt == 8,  "Medium-High",
|                  ImpactInt >= 5,  "Medium",
|                  "Low")
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              | project
|                  SecurityDomain, Category, Subcategory,
|                  ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  Impact = ImpactInt, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  OSPlatform = DI_OSPlatform,
|                  MdeDeviceId = DeviceKey,
|                  si_evidence, si_fix_remediation, si_affected_software,
|                  SI_AffectedVendor, SI_AffectedProduct, SI_AffectedVersion, si_affected_cpe,
|                  si_eos_status, si_eos_date, si_certificate_expiry, si_certificate_thumbprint
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, Impact desc, AssetName asc, ConfigurationId asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|          // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|          // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software
|          // si si_eos_status <- si_eos_status, si_eos_date <- si_eos_date, si_evidence <- si_evidence, si_certificate_expiry <- si_certificate_expiry
|          // si si_certificate_thumbprint <- si_certificate_thumbprint, si_affected_product <- SI_AffectedProduct, si_affected_vendor <- SI_AffectedVendor, si_affected_version <- SI_AffectedVersion
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_Certificates_Summary
|      ReportPurpose: >-
|        Certificates on endpoints that expire within 30 days, expired in the last 30 days, or use a weak key or signature (Defender vulnerability management certificate inventory), one finding per device and kind of problem with the certificates listed. Needs the Defender Vulnerability Management add-on; without it the report is empty. One row per finding with the impacted devices listed.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_Certificates_Summary
|          // Purpose  Endpoints with expiring, recently expired and weak certificates, from Defender vulnerability management, on the CI of the device.
|          // The asset comes from the CI (SI_CI_CL), the findings from Defender advanced hunting, tied through the Defender device id.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          let _src =
|              union isfuzzy=true (datatable(DeviceId:string)[]), (DeviceTvmCertificateInfo)
|              | extend _thumb = tostring(column_ifexists("Thumbprint", "")), _exp = todatetime(column_ifexists("ExpirationDate", datetime(null))), _alg = tolower(tostring(column_ifexists("SignatureAlgorithm", ""))),
|                       _key = toint(column_ifexists("KeySize", int(null))), _friendly = tostring(column_ifexists("FriendlyName", "")), _to = todynamic(column_ifexists("IssuedTo", dynamic(null))),
|                       _by = todynamic(column_ifexists("IssuedBy", dynamic(null)))
|              | where isnotempty(_thumb)
|              | summarize _exp = max(_exp), _alg = take_any(_alg), _key = max(_key), _friendly = take_any(_friendly), _to = take_any(_to), _by = take_any(_by) by DeviceId, _thumb
|              | extend _valid = isnull(_exp) or _exp >= now()
|              // #690 (29) -- Defender writes the algorithm as ONE token (sha1rsa, md5rsa, sha1dsa) and has matches whole terms only, so
|              // the test reads the token's start (the hash) and its end (the key type). A DSA key is weak below 2048 bits as an RSA key
|              // is -- an ECDSA key is not measured in the same bits and is left to the signature test.
|              | extend _weakAlg = _valid and (_alg startswith "sha1" or _alg startswith "md5" or _alg startswith "md2" or _alg startswith "md4"),
|                       _weakKey = _valid and (_alg endswith "rsa" or (_alg endswith "dsa" and not(_alg endswith "ecdsa"))) and isnotnull(_key) and _key > 0 and _key < 2048,
|                       _expiring = isnotnull(_exp) and _exp >= now() and _exp < now() + 30d,
|                       _expired = isnotnull(_exp) and _exp < now() and _exp > now() - 30d
|              | where _weakAlg or _weakKey or _expiring or _expired
|              // every problem a certificate has is its own finding (a weak certificate that also expires is listed under both)
|              | extend _kinds = array_concat(iff(_expiring, dynamic(["expiring"]), dynamic([])), iff(_expired, dynamic(["expired"]), dynamic([])),
|                                             iff(_weakAlg, dynamic(["weak-signature"]), dynamic([])), iff(_weakKey, dynamic(["weak-key"]), dynamic([])))
|              | mv-expand _kind = _kinds to typeof(string)
|              // every weak certificate is listed, a self-signed root (issued to itself) is labelled (owner 2026-10-15 "List all, label roots")
|              | extend _root = isnotempty(tostring(_to)) and tostring(_to) == tostring(_by)
|              | extend _subject = case(isnotempty(tostring(_to.CommonName)), tostring(_to.CommonName), isnotempty(tostring(_to.commonName)), tostring(_to.commonName), isnotempty(_friendly), _friendly, _thumb)
|              | extend _item = strcat(_subject, " [", _thumb, "]", iff(_root, " (self-signed root)", ""), iff(isnull(_exp), "", strcat(" expires ", format_datetime(_exp, "yyyy-MM-dd"))))
|              | summarize _n = count(), _nRoot = countif(_root), _soonest = min(_exp), _itemsOther = make_set_if(_item, not(_root), 10), _itemsRoot = make_set_if(_item, _root, 10), _firstThumb = take_any(_thumb) by DeviceId, _kind
|              | extend _items = array_concat(_itemsOther, _itemsRoot)
|              | extend _daysLeft = iff(isnull(_soonest), int(null), toint(datetime_diff("day", _soonest, now())))
|              | extend ImpactInt = case(_kind == "weak-signature", 8, _kind == "weak-key", 8, _kind == "expiring" and _daysLeft <= 7, 8, 5)
|              | extend Category = "Security controls", Subcategory = "Certificates"
|              | extend ConfigurationName = case(
|                  _kind == "expiring",       "Certificates that expire within 30 days",
|                  _kind == "expired",        "Certificates that expired in the last 30 days",
|                  _kind == "weak-signature", "Certificates signed with a weak algorithm (SHA-1, MD5 or MD2)",
|                  "Certificates with an RSA or DSA key shorter than 2048 bits")
|              | extend ConfigurationId = strcat("certificate:", _kind)
|              | extend si_affected_software = "", SI_AffectedVendor = "", SI_AffectedProduct = "", SI_AffectedVersion = "", si_affected_cpe = "",
|                       si_eos_status = "", si_eos_date = datetime(null),
|                       si_certificate_expiry = _soonest, si_certificate_thumbprint = iff(_n == 1, _firstThumb, ""),
|                       si_evidence = strcat(tostring(_n), " certificate(s)", iff(_nRoot > 0, strcat(", ", tostring(_nRoot), " of them self-signed root(s)"), ""), " - ", strcat_array(_items, " / "), iff(_n > array_length(_items), " ...", "")),
|                       si_fix_remediation = case(
|                          _kind == "expiring", "Renew the listed certificates before they expire and install the new ones on the device.",
|                          _kind == "expired",  "Replace the listed certificates with valid ones, or remove them when nothing uses them any more.",
|                          strcat("Reissue the listed certificates with SHA-256 or stronger and an RSA or DSA key of at least 2048 bits, then remove the old ones.",
|                                 iff(_nRoot > 0, " A self-signed root is trusted because it is in the store, not by its own signature -- remove an old root when nothing relies on it.", "")));
|
|          // the newest device row -- its name and operating system for display, and whether Defender excludes the device
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(30d)
|              | extend DI_Excluded = tostring(column_ifexists("ExclusionReason", ""))
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project DeviceId, DI_DeviceName = DeviceName, DI_OSPlatform = tostring(OSPlatform), DI_Excluded;
|
|          _src
|              | extend DeviceId = tostring(DeviceId)
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              // a device Defender excludes is not reported
|              | where isempty(DI_Excluded)
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend AssetType = "Endpoint"
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecuritySeverity = case(
|                  ImpactInt >= 10, "Very High",
|                  ImpactInt == 9,  "High",
|                  ImpactInt == 8,  "Medium-High",
|                  ImpactInt >= 5,  "Medium",
|                  "Low")
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              | summarize
|                  UniqueIssues              = dcount(ConfigurationId),
|                  ImpactedAssetsList        = make_set(AssetName),
|                  ImpactedAssetPairs        = make_set(strcat(AssetName, "|", AssetId)),
|                  si_fix_remediation        = take_anyif(si_fix_remediation, isnotempty(si_fix_remediation)),
|                  si_evidence               = take_anyif(si_evidence, isnotempty(si_evidence)),
|                  si_affected_software      = take_anyif(si_affected_software, isnotempty(si_affected_software)),
|                  si_eos_status             = take_anyif(si_eos_status, isnotempty(si_eos_status)),
|                  si_eos_date               = min(si_eos_date),
|                  si_certificate_expiry     = min(si_certificate_expiry),
|                  RiskFactor_Consequence    = max(RiskFactor_Consequence),
|                  RiskScore_Weight_Factor   = max(RiskScore_Weight_Factor),
|                  RiskFactor_Weight         = max(RiskFactor_Weight),
|                  RiskScore_Weight_Detailed = any(RiskScore_Weight_Detailed),
|                  Impact                    = max(ImpactInt),
|                  arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|                  MdeDeviceId               = min(tostring(DeviceKey)),
|                  EntraAccountObjectId      = min(tostring("")),
|                  AzureResourceId           = min(tostring("")),
|                  AssetId                   = min(AssetId)
|                by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                   CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|                   cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|              | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|              | project
|                  SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetPairs, UniqueIssues,
|                  si_fix_remediation, si_evidence, si_affected_software, si_eos_status, si_eos_date, si_certificate_expiry
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, ImpactedAssetCount desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|          // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|          // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software
|          // si si_eos_status <- si_eos_status, si_eos_date <- si_eos_date, si_evidence <- si_evidence, si_certificate_expiry <- si_certificate_expiry
|          // si si_certificate_thumbprint <- si_certificate_thumbprint, si_affected_product <- SI_AffectedProduct, si_affected_vendor <- SI_AffectedVendor, si_affected_version <- SI_AffectedVersion
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_Certificates_Detailed
|      ReportPurpose: >-
|        Certificates on endpoints that expire within 30 days, expired in the last 30 days, or use a weak key or signature (Defender vulnerability management certificate inventory), one finding per device and kind of problem with the certificates listed. Needs the Defender Vulnerability Management add-on; without it the report is empty. One row per device and finding.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_Certificates_Detailed
|          // Purpose  Endpoints with expiring, recently expired and weak certificates, from Defender vulnerability management, on the CI of the device.
|          // The asset comes from the CI (SI_CI_CL), the findings from Defender advanced hunting, tied through the Defender device id.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          let _src =
|              union isfuzzy=true (datatable(DeviceId:string)[]), (DeviceTvmCertificateInfo)
|              | extend _thumb = tostring(column_ifexists("Thumbprint", "")), _exp = todatetime(column_ifexists("ExpirationDate", datetime(null))), _alg = tolower(tostring(column_ifexists("SignatureAlgorithm", ""))),
|                       _key = toint(column_ifexists("KeySize", int(null))), _friendly = tostring(column_ifexists("FriendlyName", "")), _to = todynamic(column_ifexists("IssuedTo", dynamic(null))),
|                       _by = todynamic(column_ifexists("IssuedBy", dynamic(null)))
|              | where isnotempty(_thumb)
|              | summarize _exp = max(_exp), _alg = take_any(_alg), _key = max(_key), _friendly = take_any(_friendly), _to = take_any(_to), _by = take_any(_by) by DeviceId, _thumb
|              | extend _valid = isnull(_exp) or _exp >= now()
|              // #690 (29) -- Defender writes the algorithm as ONE token (sha1rsa, md5rsa, sha1dsa) and has matches whole terms only, so
|              // the test reads the token's start (the hash) and its end (the key type). A DSA key is weak below 2048 bits as an RSA key
|              // is -- an ECDSA key is not measured in the same bits and is left to the signature test.
|              | extend _weakAlg = _valid and (_alg startswith "sha1" or _alg startswith "md5" or _alg startswith "md2" or _alg startswith "md4"),
|                       _weakKey = _valid and (_alg endswith "rsa" or (_alg endswith "dsa" and not(_alg endswith "ecdsa"))) and isnotnull(_key) and _key > 0 and _key < 2048,
|                       _expiring = isnotnull(_exp) and _exp >= now() and _exp < now() + 30d,
|                       _expired = isnotnull(_exp) and _exp < now() and _exp > now() - 30d
|              | where _weakAlg or _weakKey or _expiring or _expired
|              // every problem a certificate has is its own finding (a weak certificate that also expires is listed under both)
|              | extend _kinds = array_concat(iff(_expiring, dynamic(["expiring"]), dynamic([])), iff(_expired, dynamic(["expired"]), dynamic([])),
|                                             iff(_weakAlg, dynamic(["weak-signature"]), dynamic([])), iff(_weakKey, dynamic(["weak-key"]), dynamic([])))
|              | mv-expand _kind = _kinds to typeof(string)
|              // every weak certificate is listed, a self-signed root (issued to itself) is labelled (owner 2026-10-15 "List all, label roots")
|              | extend _root = isnotempty(tostring(_to)) and tostring(_to) == tostring(_by)
|              | extend _subject = case(isnotempty(tostring(_to.CommonName)), tostring(_to.CommonName), isnotempty(tostring(_to.commonName)), tostring(_to.commonName), isnotempty(_friendly), _friendly, _thumb)
|              | extend _item = strcat(_subject, " [", _thumb, "]", iff(_root, " (self-signed root)", ""), iff(isnull(_exp), "", strcat(" expires ", format_datetime(_exp, "yyyy-MM-dd"))))
|              | summarize _n = count(), _nRoot = countif(_root), _soonest = min(_exp), _itemsOther = make_set_if(_item, not(_root), 10), _itemsRoot = make_set_if(_item, _root, 10), _firstThumb = take_any(_thumb) by DeviceId, _kind
|              | extend _items = array_concat(_itemsOther, _itemsRoot)
|              | extend _daysLeft = iff(isnull(_soonest), int(null), toint(datetime_diff("day", _soonest, now())))
|              | extend ImpactInt = case(_kind == "weak-signature", 8, _kind == "weak-key", 8, _kind == "expiring" and _daysLeft <= 7, 8, 5)
|              | extend Category = "Security controls", Subcategory = "Certificates"
|              | extend ConfigurationName = case(
|                  _kind == "expiring",       "Certificates that expire within 30 days",
|                  _kind == "expired",        "Certificates that expired in the last 30 days",
|                  _kind == "weak-signature", "Certificates signed with a weak algorithm (SHA-1, MD5 or MD2)",
|                  "Certificates with an RSA or DSA key shorter than 2048 bits")
|              | extend ConfigurationId = strcat("certificate:", _kind)
|              | extend si_affected_software = "", SI_AffectedVendor = "", SI_AffectedProduct = "", SI_AffectedVersion = "", si_affected_cpe = "",
|                       si_eos_status = "", si_eos_date = datetime(null),
|                       si_certificate_expiry = _soonest, si_certificate_thumbprint = iff(_n == 1, _firstThumb, ""),
|                       si_evidence = strcat(tostring(_n), " certificate(s)", iff(_nRoot > 0, strcat(", ", tostring(_nRoot), " of them self-signed root(s)"), ""), " - ", strcat_array(_items, " / "), iff(_n > array_length(_items), " ...", "")),
|                       si_fix_remediation = case(
|                          _kind == "expiring", "Renew the listed certificates before they expire and install the new ones on the device.",
|                          _kind == "expired",  "Replace the listed certificates with valid ones, or remove them when nothing uses them any more.",
|                          strcat("Reissue the listed certificates with SHA-256 or stronger and an RSA or DSA key of at least 2048 bits, then remove the old ones.",
|                                 iff(_nRoot > 0, " A self-signed root is trusted because it is in the store, not by its own signature -- remove an old root when nothing relies on it.", "")));
|
|          // the newest device row -- its name and operating system for display, and whether Defender excludes the device
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(30d)
|              | extend DI_Excluded = tostring(column_ifexists("ExclusionReason", ""))
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project DeviceId, DI_DeviceName = DeviceName, DI_OSPlatform = tostring(OSPlatform), DI_Excluded;
|
|          _src
|              | extend DeviceId = tostring(DeviceId)
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              // a device Defender excludes is not reported
|              | where isempty(DI_Excluded)
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend AssetType = "Endpoint"
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecuritySeverity = case(
|                  ImpactInt >= 10, "Very High",
|                  ImpactInt == 9,  "High",
|                  ImpactInt == 8,  "Medium-High",
|                  ImpactInt >= 5,  "Medium",
|                  "Low")
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              | project
|                  SecurityDomain, Category, Subcategory,
|                  ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  Impact = ImpactInt, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  OSPlatform = DI_OSPlatform,
|                  MdeDeviceId = DeviceKey,
|                  si_evidence, si_fix_remediation, si_affected_software,
|                  SI_AffectedVendor, SI_AffectedProduct, SI_AffectedVersion, si_affected_cpe,
|                  si_eos_status, si_eos_date, si_certificate_expiry, si_certificate_thumbprint
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, Impact desc, AssetName asc, ConfigurationId asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|          // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|          // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software
|          // si si_eos_status <- si_eos_status, si_eos_date <- si_eos_date, si_evidence <- si_evidence, si_certificate_expiry <- si_certificate_expiry
|          // si si_certificate_thumbprint <- si_certificate_thumbprint, si_affected_product <- SI_AffectedProduct, si_affected_vendor <- SI_AffectedVendor, si_affected_version <- SI_AffectedVersion
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_BrowserExtensions_Summary
|      ReportPurpose: >-
|        Browser extensions on endpoints that Defender vulnerability management rates High or Critical risk because of the permissions they hold, one finding per device and extension. Needs the Defender Vulnerability Management add-on; without it the report is empty. One row per finding with the impacted devices listed.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_BrowserExtensions_Summary
|          // Purpose  Endpoints with high-risk browser extensions, from Defender vulnerability management, on the CI of the device.
|          // The asset comes from the CI (SI_CI_CL), the findings from Defender advanced hunting, tied through the Defender device id.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          let _src =
|              union isfuzzy=true (datatable(DeviceId:string)[]), (DeviceTvmBrowserExtensions)
|              | extend _risk = tostring(column_ifexists("ExtensionRisk", "")), _extId = tostring(column_ifexists("ExtensionId", "")), _extName = tostring(column_ifexists("ExtensionName", "")),
|                       _extVer = tostring(column_ifexists("ExtensionVersion", "")), _extVendor = tostring(column_ifexists("ExtensionVendor", "")), _browser = tostring(column_ifexists("BrowserName", "")),
|                       _on = tobool(column_ifexists("IsActivated", bool(null)))
|              | where _risk in~ ("Critical", "High") and isnotempty(_extId)
|              | summarize _risk = take_any(_risk), _extName = take_any(_extName), _extVer = max(_extVer), _extVendor = take_any(_extVendor), _browsers = make_set(_browser, 6), _on = max(toint(_on)) by DeviceId, _extId
|              | extend _extName = iff(isempty(_extName), _extId, _extName)
|              | extend ImpactInt = case(_on == 0, 5, _risk =~ "Critical", 9, 8)
|              | extend Category = "Browser", Subcategory = "Browser extensions"
|              | extend ConfigurationName = strcat("High-risk browser extension - ", _extName)
|              | extend ConfigurationId = strcat("browser-extension:", tolower(_extId))
|              | extend si_affected_software = strcat(trim(" ", strcat(_extName, " ", _extVer)), iff(isempty(_extVendor), "", strcat(" (", _extVendor, ")"))),
|                       SI_AffectedVendor = tolower(_extVendor), SI_AffectedProduct = tolower(_extName), SI_AffectedVersion = _extVer, si_affected_cpe = "",
|                       si_eos_status = "", si_eos_date = datetime(null), si_certificate_expiry = datetime(null), si_certificate_thumbprint = "",
|                       si_evidence = strcat("Risk ", _risk, " in ", strcat_array(_browsers, ", "), case(isnull(_on), "", _on == 0, " (installed, not turned on)", " (turned on)")),
|                       si_fix_remediation = strcat("Remove the extension ", _extName, " from the browser on the device, or block it by browser policy, unless the business needs it and accepts the permissions it holds.");
|
|          // the newest device row -- its name and operating system for display, and whether Defender excludes the device
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(30d)
|              | extend DI_Excluded = tostring(column_ifexists("ExclusionReason", ""))
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project DeviceId, DI_DeviceName = DeviceName, DI_OSPlatform = tostring(OSPlatform), DI_Excluded;
|
|          _src
|              | extend DeviceId = tostring(DeviceId)
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              // a device Defender excludes is not reported
|              | where isempty(DI_Excluded)
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend AssetType = "Endpoint"
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecuritySeverity = case(
|                  ImpactInt >= 10, "Very High",
|                  ImpactInt == 9,  "High",
|                  ImpactInt == 8,  "Medium-High",
|                  ImpactInt >= 5,  "Medium",
|                  "Low")
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              | summarize
|                  UniqueIssues              = dcount(ConfigurationId),
|                  ImpactedAssetsList        = make_set(AssetName),
|                  ImpactedAssetPairs        = make_set(strcat(AssetName, "|", AssetId)),
|                  si_fix_remediation        = take_anyif(si_fix_remediation, isnotempty(si_fix_remediation)),
|                  si_evidence               = take_anyif(si_evidence, isnotempty(si_evidence)),
|                  si_affected_software      = take_anyif(si_affected_software, isnotempty(si_affected_software)),
|                  si_eos_status             = take_anyif(si_eos_status, isnotempty(si_eos_status)),
|                  si_eos_date               = min(si_eos_date),
|                  si_certificate_expiry     = min(si_certificate_expiry),
|                  RiskFactor_Consequence    = max(RiskFactor_Consequence),
|                  RiskScore_Weight_Factor   = max(RiskScore_Weight_Factor),
|                  RiskFactor_Weight         = max(RiskFactor_Weight),
|                  RiskScore_Weight_Detailed = any(RiskScore_Weight_Detailed),
|                  Impact                    = max(ImpactInt),
|                  arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|                  MdeDeviceId               = min(tostring(DeviceKey)),
|                  EntraAccountObjectId      = min(tostring("")),
|                  AzureResourceId           = min(tostring("")),
|                  AssetId                   = min(AssetId)
|                by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                   CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|                   cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|              | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|              | project
|                  SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetPairs, UniqueIssues,
|                  si_fix_remediation, si_evidence, si_affected_software, si_eos_status, si_eos_date, si_certificate_expiry
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, ImpactedAssetCount desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|          // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|          // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software
|          // si si_eos_status <- si_eos_status, si_eos_date <- si_eos_date, si_evidence <- si_evidence, si_certificate_expiry <- si_certificate_expiry
|          // si si_certificate_thumbprint <- si_certificate_thumbprint, si_affected_product <- SI_AffectedProduct, si_affected_vendor <- SI_AffectedVendor, si_affected_version <- SI_AffectedVersion
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_BrowserExtensions_Detailed
|      ReportPurpose: >-
|        Browser extensions on endpoints that Defender vulnerability management rates High or Critical risk because of the permissions they hold, one finding per device and extension. Needs the Defender Vulnerability Management add-on; without it the report is empty. One row per device and finding.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_BrowserExtensions_Detailed
|          // Purpose  Endpoints with high-risk browser extensions, from Defender vulnerability management, on the CI of the device.
|          // The asset comes from the CI (SI_CI_CL), the findings from Defender advanced hunting, tied through the Defender device id.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          let _src =
|              union isfuzzy=true (datatable(DeviceId:string)[]), (DeviceTvmBrowserExtensions)
|              | extend _risk = tostring(column_ifexists("ExtensionRisk", "")), _extId = tostring(column_ifexists("ExtensionId", "")), _extName = tostring(column_ifexists("ExtensionName", "")),
|                       _extVer = tostring(column_ifexists("ExtensionVersion", "")), _extVendor = tostring(column_ifexists("ExtensionVendor", "")), _browser = tostring(column_ifexists("BrowserName", "")),
|                       _on = tobool(column_ifexists("IsActivated", bool(null)))
|              | where _risk in~ ("Critical", "High") and isnotempty(_extId)
|              | summarize _risk = take_any(_risk), _extName = take_any(_extName), _extVer = max(_extVer), _extVendor = take_any(_extVendor), _browsers = make_set(_browser, 6), _on = max(toint(_on)) by DeviceId, _extId
|              | extend _extName = iff(isempty(_extName), _extId, _extName)
|              | extend ImpactInt = case(_on == 0, 5, _risk =~ "Critical", 9, 8)
|              | extend Category = "Browser", Subcategory = "Browser extensions"
|              | extend ConfigurationName = strcat("High-risk browser extension - ", _extName)
|              | extend ConfigurationId = strcat("browser-extension:", tolower(_extId))
|              | extend si_affected_software = strcat(trim(" ", strcat(_extName, " ", _extVer)), iff(isempty(_extVendor), "", strcat(" (", _extVendor, ")"))),
|                       SI_AffectedVendor = tolower(_extVendor), SI_AffectedProduct = tolower(_extName), SI_AffectedVersion = _extVer, si_affected_cpe = "",
|                       si_eos_status = "", si_eos_date = datetime(null), si_certificate_expiry = datetime(null), si_certificate_thumbprint = "",
|                       si_evidence = strcat("Risk ", _risk, " in ", strcat_array(_browsers, ", "), case(isnull(_on), "", _on == 0, " (installed, not turned on)", " (turned on)")),
|                       si_fix_remediation = strcat("Remove the extension ", _extName, " from the browser on the device, or block it by browser policy, unless the business needs it and accepts the permissions it holds.");
|
|          // the newest device row -- its name and operating system for display, and whether Defender excludes the device
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(30d)
|              | extend DI_Excluded = tostring(column_ifexists("ExclusionReason", ""))
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project DeviceId, DI_DeviceName = DeviceName, DI_OSPlatform = tostring(OSPlatform), DI_Excluded;
|
|          _src
|              | extend DeviceId = tostring(DeviceId)
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              // a device Defender excludes is not reported
|              | where isempty(DI_Excluded)
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend AssetType = "Endpoint"
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecuritySeverity = case(
|                  ImpactInt >= 10, "Very High",
|                  ImpactInt == 9,  "High",
|                  ImpactInt == 8,  "Medium-High",
|                  ImpactInt >= 5,  "Medium",
|                  "Low")
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              | project
|                  SecurityDomain, Category, Subcategory,
|                  ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  Impact = ImpactInt, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  OSPlatform = DI_OSPlatform,
|                  MdeDeviceId = DeviceKey,
|                  si_evidence, si_fix_remediation, si_affected_software,
|                  SI_AffectedVendor, SI_AffectedProduct, SI_AffectedVersion, si_affected_cpe,
|                  si_eos_status, si_eos_date, si_certificate_expiry, si_certificate_thumbprint
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, Impact desc, AssetName asc, ConfigurationId asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|          // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|          // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software
|          // si si_eos_status <- si_eos_status, si_eos_date <- si_eos_date, si_evidence <- si_evidence, si_certificate_expiry <- si_certificate_expiry
|          // si si_certificate_thumbprint <- si_certificate_thumbprint, si_affected_product <- SI_AffectedProduct, si_affected_vendor <- SI_AffectedVendor, si_affected_version <- SI_AffectedVersion
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Azure_Recommendations_Summary
|      LookupNeededKeys:
|      - Lookup: _dfcPairs
|        Column: _dfcKey
|        Keys: |-
|          | extend _dfcKey = strcat("h", tostring(hash(strcat(tolower(tostring(AssetName)), "|", tolower(tostring(FindingName))))))
|          | extend _dfcIdKey = iff(isnotempty(AssetArmId), strcat("h", tostring(hash(strcat(AssetArmId, "|", tolower(tostring(FindingName)))))), "-")
|          | extend _egRecArm = tolower(tostring(EdgePropsAny.rawData.recommendationAzureResourceId))
|          | extend _dfcAkKey = iff(_egRecArm matches regex @"/providers/microsoft\.security/assessments/[^/]+$", strcat("h", tostring(hash(strcat(extract(@"^(.*)/providers/microsoft\.security/assessments/[^/]+$", 1, _egRecArm), "|", extract(@"/assessments/([^/]+)$", 1, _egRecArm))))), "-")
|          | project __siNeeded = pack_array(_dfcKey, _dfcIdKey, _dfcAkKey)
|      ReportPurpose: Azure ExposureGraph recommendations prioritised by criticality + Internet-Exposed + risk factors.
|        Same CI pattern as Device_Missing_CVEs_Summary -- tier, tags and the CMDB values come from
|        the CI (SI_CI_CL, requirement 505), joined on the lower-cased ARM id (_ciKey).
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - Recommendation
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Azure_Recommendations_Summary
|          // Purpose  Azure ExposureGraph recommendations prioritised by criticality + Internet-Exposed + edge risk factors.
|          // Output   One row per (Tier x Severity x ConfigurationName x cmdb*) bucket; lists carry impacted-asset detail.
|          //
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Tier, CMDB values, tags and the internet-exposed factor are the
|          // CI's. The FINDINGS still come from the Exposure Graph (recommendation edges) and are tied to their CI through
|          // _ciKey. DeviceKey is the lower-cased ARM resource id the graph node carries (EntityIds), for a subscription or
|          // resource-group node the ARM id of that scope, else the Defender device id, else the node id -- the same ids the
|          // CI links, so the hybrid path buckets both sides alike.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          // #192 a subscription-level recommendation takes the subscription's most critical CI.
|          // #675 read on its own, once per run, never from the sliced _ciLink -- a query slice holds only its share of the
|          // subscription's CIs, so the minimum over that share could be a less critical tier than the subscription has.
|          //__SI_CI_SUBTIER_BEGIN__
|              let _subTierG =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where _ciKey startswith "/subscriptions/"
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | extend _sub = tostring(split(_ciKey, "/")[2])
|                  | where isnotempty(_sub)
|                  | summarize Tier_BySub = min(toint(column_ifexists("si_tier", int(null)))) by _sub;
|          //__SI_CI_SUBTIER_END__
|
|          // Step 0c  Excluded ConfigurationIds -- block-marker substituted by engine from the per-report exclude.custom.json.
|          // Items are matched against the recommendation FindingName (e.g. "Storage account public access disabled").
|
|          // #147 -- (resource, recommendation) pairs the Defender recommendation reports already carry. The graph
|          // report drops ONLY those, so a recommendation is reported once; everything the graph knows beyond
|          // Defender (e.g. per-setting machine baselines) stays. Latest snapshot only; a missing or empty table
|          // removes nothing. The final project stays OUTSIDE the union -- the engine pre-fetches this binding and
|          // reads that last project for the column list of an empty result.
|          // #278 the engine empties this block when the Defender recommendation report of the same grain is NOT in
|          // the run -- handing findings to a report that does not run puts them in no report at all.
|          //__DEFENDER_HANDOFF_BEGIN__
|          // The pairs are compared as strcat("h", hash(text)) on both sides -- the lookup is inlined into every bucket of the
|          // Advanced Hunting request (1 MB cap). The "h" keeps the inlined column a string (an all-digit column is inlined as long).
|          let _dfcPairs = union isfuzzy=true
|              (datatable(_dfcKey:string)[]),
|              (SI_AzureRecommendation_CL
|                  | where TimeGenerated > ago(8d)
|                  // #200 the ARM id pair too -- the graph names a VM by the machine, Defender by its Azure name.
|                  // #349 and the (resource, assessment key) pair -- the graph edge names the Defender assessment it came from.
|                  | extend _akL = tolower(tostring(column_ifexists("AssessmentKey", "")))
|                  | summarize _keys = make_set(strcat("h", tostring(hash(strcat(tolower(tostring(ResourceName)), "|", tolower(tostring(Recommendation))))))),
|                              _ids = make_set_if(strcat("h", tostring(hash(strcat(tolower(tostring(ResourceIdLower)), "|", tolower(tostring(Recommendation)))))), isnotempty(ResourceIdLower)),
|                              _aks = make_set_if(strcat("h", tostring(hash(strcat(tolower(tostring(ResourceIdLower)), "|", _akL)))), isnotempty(ResourceIdLower) and isnotempty(_akL)) by CollectionTime
|                  | top 1 by CollectionTime desc
|                  | extend _keys = array_concat(_keys, _ids, _aks)
|                  | mv-expand _dfcKey = _keys to typeof(string))
|              | project _dfcKey;
|          //__DEFENDER_HANDOFF_END__
|
|          // #349 -- Defender's own severity and security issue per assessment key, for a recommendation whose node
|          // the graph has lost (see _AssetFindingEdges_orphan). Latest snapshot per key. A missing table leaves it empty.
|          // This is a lookup, not a hand-off, so it stays outside the hand-off block above.
|          let _dfcRecByKey = union isfuzzy=true
|              (datatable(_akKey:string, _akSeverity:string, _akIssue:string)[]),
|              (SI_AzureRecommendation_CL
|                  | where TimeGenerated > ago(8d)
|                  | extend _akKey = tolower(tostring(column_ifexists("AssessmentKey", "")))
|                  | where isnotempty(_akKey) and isnotempty(tostring(Severity))
|                  | summarize arg_max(CollectionTime, Severity, SecurityIssue) by _akKey
|                  | project _akKey, _akSeverity = tostring(Severity), _akIssue = tostring(SecurityIssue))
|              | project _akKey, _akSeverity, _akIssue;
|
|          let _Assets =
|              ExposureGraphNodes
|              // v2.2.417 -- NodeLabel is the durable identifier (environmentName stopped discriminating on 2026-08-10).
|              | where NodeLabel startswith "microsoft." or NodeLabel in ("subscriptions", "resourcegroups")
|              | extend EG_IsCustomerFacing = tobool(coalesce(NodeProperties.rawData.isCustomerFacing, NodeProperties.raw.isCustomerFacing))
|              | extend EG_IsExcluded       = tobool(coalesce(NodeProperties.rawData.isExcluded,       NodeProperties.raw.isExcluded))
|              | where isnull(EG_IsExcluded) or EG_IsExcluded == false
|              | extend _ids = tostring(EntityIds)
|              | extend _armId = tolower(coalesce(extract(@'"type"\s*:\s*"AzureResourceId"\s*,\s*"id"\s*:\s*"([^"]+)"', 1, _ids), extract(@'"id"\s*:\s*"([^"]+)"\s*,\s*"type"\s*:\s*"AzureResourceId"', 1, _ids)))
|              | extend _senseId = tolower(coalesce(extract(@'"type"\s*:\s*"SenseDeviceId"\s*,\s*"id"\s*:\s*"([^"]+)"', 1, _ids), extract(@'"id"\s*:\s*"([^"]+)"\s*,\s*"type"\s*:\s*"SenseDeviceId"', 1, _ids)))
|              // #78 -- a subscription or resource-group node carries its scope in rawData.hierarchyIdentifier (the subscription
|              // guid on both kinds), so the scope's ARM id is built from it, switched on NodeLabel.
|              | extend _egHierarchyId = tolower(tostring(NodeProperties.rawData.hierarchyIdentifier))
|              | extend _scopeArmId = case(
|                    NodeLabel == "subscriptions"  and isnotempty(_egHierarchyId), strcat("/subscriptions/", _egHierarchyId),
|                    NodeLabel == "resourcegroups" and isnotempty(_egHierarchyId), strcat("/subscriptions/", _egHierarchyId, "/resourcegroups/", tolower(tostring(NodeName))),
|                    "")
|              | extend AssetArmId = iff(isnotempty(_armId), _armId, _scopeArmId)
|              | extend DeviceKey = case(isnotempty(AssetArmId), AssetArmId, isnotempty(_senseId), _senseId, tolower(NodeId))
|              | project
|                  AssetNodeId = NodeId,
|                  AssetName   = NodeName,
|                  AssetLabel  = NodeLabel,
|                  AssetArmId,
|                  DeviceKey,
|                  EG_IsCustomerFacing,
|                  EG_IsExcluded;
|
|          let _Findings =
|              ExposureGraphNodes
|              | mv-expand Category = Categories
|              | where tostring(Category) contains "finding"
|              | where NodeLabel !contains "cve"
|              | project FindingNodeId = NodeId, FindingName = NodeName, FindingLabel = NodeLabel,
|                        FindingCategories = Categories, FindingProps = NodeProperties;
|
|          let _Edges =
|              ExposureGraphEdges
|              | where EdgeLabel has "affecting"
|              | extend EdgeProps = column_ifexists("EdgeProperties", dynamic({}))
|              | project SourceNodeId, TargetNodeId, EdgeLabel, EdgeProps;
|
|          let _AssetFindingEdges_oneway =
|              _Edges
|              | join kind=inner (_Assets)   on $left.SourceNodeId == $right.AssetNodeId
|              | join kind=inner (_Findings) on $left.TargetNodeId == $right.FindingNodeId
|              | project AssetNodeId, AssetName, AssetLabel, AssetArmId, DeviceKey, EG_IsCustomerFacing, EG_IsExcluded,
|                        FindingName, FindingLabel, FindingCategories, FindingProps,
|                        EdgeLabel, EdgeProps;
|
|          let _AssetFindingEdges_otherway =
|              _Edges
|              | join kind=inner (_Assets)   on $left.TargetNodeId == $right.AssetNodeId
|              | join kind=inner (_Findings) on $left.SourceNodeId == $right.FindingNodeId
|              | project AssetNodeId, AssetName, AssetLabel, AssetArmId, DeviceKey, EG_IsCustomerFacing, EG_IsExcluded,
|                        FindingName, FindingLabel, FindingCategories, FindingProps,
|                        EdgeLabel, EdgeProps;
|
|          // #349 -- A RECOMMENDATION EDGE WHOSE RECOMMENDATION NODE IS MISSING. The graph keeps "affecting" edges after
|          // the recommendation's own node has gone from ExposureGraphNodes, and absence is not remediation, so the row is
|          // rebuilt from the edge itself. The edge carries the recommendation's name, label and categories (SourceNode*) and
|          // the Defender assessment it came from. Severity and security issue come from Defender by that key (_dfcRecByKey),
|          // and only where Defender has no row for it from the risk level the graph puts on the edge. A dangling edge whose
|          // ASSET node is missing has nothing to report on and stays out.
|          let _AssetFindingEdges_orphan =
|              ExposureGraphEdges
|              | where EdgeLabel has "affecting"
|              | where tostring(SourceNodeCategories) contains "finding" and SourceNodeLabel !contains "cve"
|              | join kind=leftanti (ExposureGraphNodes | project NodeId) on $left.SourceNodeId == $right.NodeId
|              | extend EdgeProps = column_ifexists("EdgeProperties", dynamic({}))
|              | extend _akKey = tolower(extract(@"/assessments/([^/]+)$", 1, tostring(EdgeProps.rawData.recommendationAzureResourceId)))
|              | join kind=leftouter (_dfcRecByKey) on _akKey
|              | extend _akSeverity = iff(isnotempty(_akSeverity), _akSeverity, tostring(EdgeProps.rawData.risk.riskLevel))
|              | join kind=inner (_Assets) on $left.TargetNodeId == $right.AssetNodeId
|              | project AssetNodeId, AssetName, AssetLabel, AssetArmId, DeviceKey, EG_IsCustomerFacing, EG_IsExcluded,
|                        FindingName = SourceNodeName, FindingLabel = SourceNodeLabel, FindingCategories = SourceNodeCategories,
|                        FindingProps = bag_pack("rawData", bag_pack("severity", _akSeverity, "securityIssue", bag_pack("securityIssue", _akIssue), "assessmentKey", _akKey)),
|                        EdgeLabel, EdgeProps;
|
|          let _AssetFindingEdges = union _AssetFindingEdges_oneway, _AssetFindingEdges_otherway, _AssetFindingEdges_orphan;
|
|          _AssetFindingEdges
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              | where not (FindingName in (SI_ExcludedConfigurationIds)) and not (trim(@"\s+", tostring(FindingName)) in (SI_ExcludedConfigurationIds))
|              | summarize
|                  AssetArmId            = any(AssetArmId),
|                  DeviceKey             = any(DeviceKey),
|                  EdgeLabels            = make_set(EdgeLabel),
|                  EdgePropsAny          = any(EdgeProps),
|                  FindingLabel          = any(FindingLabel),
|                  FindingCategories     = any(FindingCategories),
|                  FindingProps          = any(FindingProps),
|                  EG_IsCustomerFacing   = any(EG_IsCustomerFacing),
|                  EG_IsExcluded         = any(EG_IsExcluded)
|                by AssetNodeId, AssetName, AssetLabel, FindingName
|              // The hand-off lookup _dfcPairs has no per-asset key. When it is too large to travel whole in every slice, the
|              // engine asks the graph, per slice, which pair keys the rows at this point can have and inlines only those pairs
|              // (the report field LookupNeededKeys). Everything below this line is unchanged by that.
|              //__SI_LOOKUP_KEYS_HERE__
|              // #505 -- the finding's CI, by the ARM id / Defender device id / node id the graph node carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend _dfcKey = strcat("h", tostring(hash(strcat(tolower(tostring(AssetName)), "|", tolower(tostring(FindingName))))))
|              // #673 the three anti-joins below sit between markers the engine can take out (SI_RA_DefenderFilterInEngine)
|              // -- it then removes the same rows itself against the Defender list held in SQL, and the query returns the three keys.
|              // Pasted as it is, the query still de-duplicates on its own.
|              //__SI_DFC_ANTIJOIN_BEGIN__
|              | join kind=leftanti (_dfcPairs) on _dfcKey
|              | project-away _dfcKey
|              //__SI_DFC_ANTIJOIN_END__
|              | extend AssetName = case(
|                  isnotempty(tostring(AssetName)),     tostring(AssetName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  tostring(DeviceKey))
|              | extend AssetId   = case(
|                  isnotempty(si_ci_id),   tostring(si_ci_id),
|                  isnotempty(AssetArmId), strcat("az:", AssetArmId),
|                  tostring(AssetNodeId))
|              | extend AssetType = case(si_class == "device", "Endpoint", isnotempty(tostring(AssetLabel)), tostring(AssetLabel), "Azure")
|              | extend AzureResourceId = AssetArmId
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // #200 the same drop by ARM id. Defender names a VM by its Azure name, the graph by the machine, so the name pair
|              // above never matched a VM. The ARM id the graph node carries is the ARM id Defender reports.
|              | extend _dfcIdKey = iff(isnotempty(AssetArmId), strcat("h", tostring(hash(strcat(AssetArmId, "|", tolower(tostring(FindingName)))))), "-")
|              //__SI_DFC_ANTIJOIN_BEGIN__
|              | join kind=leftanti (_dfcPairs) on $left._dfcIdKey == $right._dfcKey
|              | project-away _dfcIdKey
|              //__SI_DFC_ANTIJOIN_END__
|              // #349 the same drop by the Defender assessment the graph edge names -- its resource and assessment key.
|              | extend _egRecArm = tolower(tostring(EdgePropsAny.rawData.recommendationAzureResourceId))
|              | extend _dfcAkKey = iff(_egRecArm matches regex @"/providers/microsoft\.security/assessments/[^/]+$", strcat("h", tostring(hash(strcat(extract(@"^(.*)/providers/microsoft\.security/assessments/[^/]+$", 1, _egRecArm), "|", extract(@"/assessments/([^/]+)$", 1, _egRecArm))))), "-")
|              //__SI_DFC_ANTIJOIN_BEGIN__
|              | join kind=leftanti (_dfcPairs) on $left._dfcAkKey == $right._dfcKey
|              | project-away _egRecArm, _dfcAkKey
|              //__SI_DFC_ANTIJOIN_END__
|              // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100   // basis-100, 100 = 1.0x = no lift
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend Properties =
|                  bag_merge(
|                      bag_pack("finding", FindingProps),
|                      bag_pack("raw", iif(isnull(FindingProps.rawData), dynamic({}), FindingProps.rawData)),
|                      bag_pack("edge", EdgePropsAny)
|                  )
|              | extend Subcategory = tostring(Properties.raw.securityIssue.securityIssue)
|              // finding factors -- the distinct risk factors the graph puts on the recommendation edge
|              | extend RiskFactorsArray = todynamic(Properties.edge.rawData.risk.riskFactors)
|              | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|              | mv-apply rf = RiskFactorsArray on (
|                  where isnotempty(trim(" ", tostring(rf)))
|                  | summarize RiskFactorSet = make_set(tostring(rf)))
|              | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              | extend RiskFactor_Probability = array_length(RiskFactorSet) + array_length(RF_P_CiFactors)
|              | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|              | extend RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(array_concat(
|                  RiskFactorSet,
|                  RF_P_CiFactorNames)), ";")
|              | extend Severity = tostring(Properties.raw.severity)
|              // #690 (37) a finding without a severity on its node is never dropped -- the risk level the graph puts on the
|              // edge is the source severity next, else the report's owner-defined severity (severity model, Low)
|              | extend Severity = iff(isnotempty(Severity), Severity, tostring(Properties.edge.rawData.risk.riskLevel))
|              | extend SecuritySeverity = case(
|                  tolower(Severity) == "critical", "Very High",
|                  tolower(Severity) == "high",     "High",
|                  tolower(Severity) == "medium",   "Medium",
|                  tolower(Severity) == "low",      "Low",
|                  "Low")
|              | extend Impact = case(
|                  tolower(Severity) == "critical", 10.0,
|                  tolower(Severity) == "high",     9.0,
|                  tolower(Severity) == "medium",   7.0,
|                  tolower(Severity) == "low",      3.0,
|                  0.0)
|              // #192 a subscription-level row no CI links takes the subscription's most critical CI.
|              | extend _subK = iff(AssetArmId matches regex @"^/subscriptions/[^/]+/?$", tostring(split(AssetArmId, "/")[2]), "")
|              | join kind=leftouter (_subTierG) on $left._subK == $right._sub
|              | extend CriticalityTier = iff(isnull(si_tier) and isnotempty(_subK), toint(Tier_BySub), toint(si_tier))
|              | project-away _subK, _sub, Tier_BySub
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain    = "Azure"
|              | extend Category          = tostring(FindingLabel)
|              // #690 (14) the graph writes some recommendation names with leading spaces -- the name and id are shown trimmed
|              // (the hand-off to the Defender report keeps comparing the name as the graph writes it)
|              | extend ConfigurationName = trim(@"\s+", tostring(FindingName))
|              | extend ConfigurationId   = "Recommendation"
|              | summarize
|                  UniqueIssues              = dcount(FindingName),
|                  ImpactedAssetsList        = make_set(AssetName),
|                  ImpactedAssetPairs        = make_set(strcat(AssetName, "|", AssetId)),
|                  RiskFactor_Consequence    = max(RiskFactor_Consequence),
|                  RiskScore_Weight_Factor   = max(RiskScore_Weight_Factor),
|                  RiskFactor_Weight         = max(RiskFactor_Weight),
|                  RiskScore_Weight_Detailed = any(RiskScore_Weight_Detailed),
|                  Impact                    = max(Impact),
|                  arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|                  MdeDeviceId               = min(tostring("")),
|                  EntraAccountObjectId      = min(tostring("")),
|                  AzureResourceId           = min(tostring(AzureResourceId)),
|                  AssetId                   = min(AssetId),
|                  MITRE_Tactics             = min(tostring(column_ifexists("MITRE_Tactics",""))),
|                  MITRE_Techniques          = min(tostring(column_ifexists("MITRE_Techniques",""))),
|                  ComplianceTags            = min(tostring(column_ifexists("ComplianceTags","")))
|                by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                   CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|                   cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|              // audit #25 -- the count is derived from the list that is actually DISPLAYED
|              | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|              | project
|                  SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetPairs, UniqueIssues
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, ImpactedAssetCount desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|          // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|          // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, Recommendation, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|
|    - ReportName: Azure_Recommendations_Detailed
|      LookupNeededKeys:
|      - Lookup: _dfcPairs
|        Column: _dfcKey
|        Keys: |-
|          | extend _dfcKey = strcat("h", tostring(hash(strcat(tolower(tostring(AssetName)), "|", tolower(tostring(FindingName))))))
|          | extend _dfcIdKey = iff(isnotempty(AssetArmId), strcat("h", tostring(hash(strcat(AssetArmId, "|", tolower(tostring(FindingName)))))), "-")
|          | extend _egRecArm = tolower(tostring(EdgePropsAny.rawData.recommendationAzureResourceId))
|          | extend _dfcAkKey = iff(_egRecArm matches regex @"/providers/microsoft\.security/assessments/[^/]+$", strcat("h", tostring(hash(strcat(extract(@"^(.*)/providers/microsoft\.security/assessments/[^/]+$", 1, _egRecArm), "|", extract(@"/assessments/([^/]+)$", 1, _egRecArm))))), "-")
|          | project __siNeeded = pack_array(_dfcKey, _dfcIdKey, _dfcAkKey)
|      ReportPurpose: Per-row detail of Azure ExposureGraph recommendations, prioritised by criticality + Internet-Exposed + edge risk factors.
|        Same CL-correlation pattern as Azure_Recommendations_Summary; differs only in skipping the final summarize and emitting one row per
|        (Asset x Recommendation) with full per-row context (AzureResourceId, EG_IsCustomerFacing, RiskFactorSet, etc.).
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      # Low + Medium intentionally excluded from Detailed scope -- Azure EG recommendations
|      # are hygiene-heavy at Medium tier (cost/perf/best-practice drift, not security risk)
|      # and per-(Asset x Recommendation) rows explode at scale. Summary aggregates the full
|      # distribution; LA still receives every row.
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Azure_Recommendations_Detailed
|          // Purpose  Per-row detail of Azure ExposureGraph recommendations, prioritised by criticality + Internet-Exposed + edge risk factors.
|          // Output   One row per (Asset x Recommendation), with per-row context (AzureResourceId, EG_IsCustomerFacing, RiskFactorSet, etc.).
|          //
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Tier, CMDB values, tags and the internet-exposed factor are the
|          // CI's. The FINDINGS still come from the Exposure Graph (recommendation edges) and are tied to their CI through
|          // _ciKey. DeviceKey is the lower-cased ARM resource id the graph node carries (EntityIds), for a subscription or
|          // resource-group node the ARM id of that scope, else the Defender device id, else the node id -- the same ids the
|          // CI links, so the hybrid path buckets both sides alike.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          // #192 a subscription-level recommendation takes the subscription's most critical CI.
|          // #675 read on its own, once per run, never from the sliced _ciLink -- a query slice holds only its share of the
|          // subscription's CIs, so the minimum over that share could be a less critical tier than the subscription has.
|          //__SI_CI_SUBTIER_BEGIN__
|              let _subTierG =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where _ciKey startswith "/subscriptions/"
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | extend _sub = tostring(split(_ciKey, "/")[2])
|                  | where isnotempty(_sub)
|                  | summarize Tier_BySub = min(toint(column_ifexists("si_tier", int(null)))) by _sub;
|          //__SI_CI_SUBTIER_END__
|
|          // Step 0c  Excluded ConfigurationIds -- block-marker substituted by engine from the per-report exclude.custom.json.
|          // Items are matched against the recommendation FindingName (e.g. "Storage account public access disabled").
|
|          // #147 -- (resource, recommendation) pairs the Defender recommendation reports already carry. The graph
|          // report drops ONLY those, so a recommendation is reported once; everything the graph knows beyond
|          // Defender (e.g. per-setting machine baselines) stays. Latest snapshot only; a missing or empty table
|          // removes nothing. The final project stays OUTSIDE the union -- the engine pre-fetches this binding and
|          // reads that last project for the column list of an empty result.
|          // #278 the engine empties this block when the Defender recommendation report of the same grain is NOT in
|          // the run -- handing findings to a report that does not run puts them in no report at all.
|          //__DEFENDER_HANDOFF_BEGIN__
|          // The pairs are compared as strcat("h", hash(text)) on both sides -- the lookup is inlined into every bucket of the
|          // Advanced Hunting request (1 MB cap). The "h" keeps the inlined column a string (an all-digit column is inlined as long).
|          let _dfcPairs = union isfuzzy=true
|              (datatable(_dfcKey:string)[]),
|              (SI_AzureRecommendation_CL
|                  | where TimeGenerated > ago(8d)
|                  // #200 the ARM id pair too -- the graph names a VM by the machine, Defender by its Azure name.
|                  // #349 and the (resource, assessment key) pair -- the graph edge names the Defender assessment it came from.
|                  | extend _akL = tolower(tostring(column_ifexists("AssessmentKey", "")))
|                  | summarize _keys = make_set(strcat("h", tostring(hash(strcat(tolower(tostring(ResourceName)), "|", tolower(tostring(Recommendation))))))),
|                              _ids = make_set_if(strcat("h", tostring(hash(strcat(tolower(tostring(ResourceIdLower)), "|", tolower(tostring(Recommendation)))))), isnotempty(ResourceIdLower)),
|                              _aks = make_set_if(strcat("h", tostring(hash(strcat(tolower(tostring(ResourceIdLower)), "|", _akL)))), isnotempty(ResourceIdLower) and isnotempty(_akL)) by CollectionTime
|                  | top 1 by CollectionTime desc
|                  | extend _keys = array_concat(_keys, _ids, _aks)
|                  | mv-expand _dfcKey = _keys to typeof(string))
|              | project _dfcKey;
|          //__DEFENDER_HANDOFF_END__
|
|          // #349 -- Defender's own severity and security issue per assessment key, for a recommendation whose node
|          // the graph has lost (see _AssetFindingEdges_orphan). Latest snapshot per key. A missing table leaves it empty.
|          // This is a lookup, not a hand-off, so it stays outside the hand-off block above.
|          let _dfcRecByKey = union isfuzzy=true
|              (datatable(_akKey:string, _akSeverity:string, _akIssue:string)[]),
|              (SI_AzureRecommendation_CL
|                  | where TimeGenerated > ago(8d)
|                  | extend _akKey = tolower(tostring(column_ifexists("AssessmentKey", "")))
|                  | where isnotempty(_akKey) and isnotempty(tostring(Severity))
|                  | summarize arg_max(CollectionTime, Severity, SecurityIssue) by _akKey
|                  | project _akKey, _akSeverity = tostring(Severity), _akIssue = tostring(SecurityIssue))
|              | project _akKey, _akSeverity, _akIssue;
|
|          let _Assets =
|              ExposureGraphNodes
|              // v2.2.417 -- NodeLabel is the durable identifier (environmentName stopped discriminating on 2026-08-10).
|              | where NodeLabel startswith "microsoft." or NodeLabel in ("subscriptions", "resourcegroups")
|              | extend EG_IsCustomerFacing = tobool(coalesce(NodeProperties.rawData.isCustomerFacing, NodeProperties.raw.isCustomerFacing))
|              | extend EG_IsExcluded       = tobool(coalesce(NodeProperties.rawData.isExcluded,       NodeProperties.raw.isExcluded))
|              | where isnull(EG_IsExcluded) or EG_IsExcluded == false
|              | extend _ids = tostring(EntityIds)
|              | extend _armId = tolower(coalesce(extract(@'"type"\s*:\s*"AzureResourceId"\s*,\s*"id"\s*:\s*"([^"]+)"', 1, _ids), extract(@'"id"\s*:\s*"([^"]+)"\s*,\s*"type"\s*:\s*"AzureResourceId"', 1, _ids)))
|              | extend _senseId = tolower(coalesce(extract(@'"type"\s*:\s*"SenseDeviceId"\s*,\s*"id"\s*:\s*"([^"]+)"', 1, _ids), extract(@'"id"\s*:\s*"([^"]+)"\s*,\s*"type"\s*:\s*"SenseDeviceId"', 1, _ids)))
|              // #78 -- a subscription or resource-group node carries its scope in rawData.hierarchyIdentifier (the subscription
|              // guid on both kinds), so the scope's ARM id is built from it, switched on NodeLabel.
|              | extend _egHierarchyId = tolower(tostring(NodeProperties.rawData.hierarchyIdentifier))
|              | extend _scopeArmId = case(
|                    NodeLabel == "subscriptions"  and isnotempty(_egHierarchyId), strcat("/subscriptions/", _egHierarchyId),
|                    NodeLabel == "resourcegroups" and isnotempty(_egHierarchyId), strcat("/subscriptions/", _egHierarchyId, "/resourcegroups/", tolower(tostring(NodeName))),
|                    "")
|              | extend AssetArmId = iff(isnotempty(_armId), _armId, _scopeArmId)
|              | extend DeviceKey = case(isnotempty(AssetArmId), AssetArmId, isnotempty(_senseId), _senseId, tolower(NodeId))
|              | project
|                  AssetNodeId = NodeId,
|                  AssetName   = NodeName,
|                  AssetLabel  = NodeLabel,
|                  AssetArmId,
|                  DeviceKey,
|                  EG_IsCustomerFacing,
|                  EG_IsExcluded;
|
|          let _Findings =
|              ExposureGraphNodes
|              | mv-expand Category = Categories
|              | where tostring(Category) contains "finding"
|              | where NodeLabel !contains "cve"
|              | project FindingNodeId = NodeId, FindingName = NodeName, FindingLabel = NodeLabel,
|                        FindingCategories = Categories, FindingProps = NodeProperties;
|
|          let _Edges =
|              ExposureGraphEdges
|              | where EdgeLabel has "affecting"
|              | extend EdgeProps = column_ifexists("EdgeProperties", dynamic({}))
|              | project SourceNodeId, TargetNodeId, EdgeLabel, EdgeProps;
|
|          let _AssetFindingEdges_oneway =
|              _Edges
|              | join kind=inner (_Assets)   on $left.SourceNodeId == $right.AssetNodeId
|              | join kind=inner (_Findings) on $left.TargetNodeId == $right.FindingNodeId
|              | project AssetNodeId, AssetName, AssetLabel, AssetArmId, DeviceKey, EG_IsCustomerFacing, EG_IsExcluded,
|                        FindingName, FindingLabel, FindingCategories, FindingProps,
|                        EdgeLabel, EdgeProps;
|
|          let _AssetFindingEdges_otherway =
|              _Edges
|              | join kind=inner (_Assets)   on $left.TargetNodeId == $right.AssetNodeId
|              | join kind=inner (_Findings) on $left.SourceNodeId == $right.FindingNodeId
|              | project AssetNodeId, AssetName, AssetLabel, AssetArmId, DeviceKey, EG_IsCustomerFacing, EG_IsExcluded,
|                        FindingName, FindingLabel, FindingCategories, FindingProps,
|                        EdgeLabel, EdgeProps;
|
|          // #349 -- A RECOMMENDATION EDGE WHOSE RECOMMENDATION NODE IS MISSING. The graph keeps "affecting" edges after
|          // the recommendation's own node has gone from ExposureGraphNodes, and absence is not remediation, so the row is
|          // rebuilt from the edge itself. The edge carries the recommendation's name, label and categories (SourceNode*) and
|          // the Defender assessment it came from. Severity and security issue come from Defender by that key (_dfcRecByKey),
|          // and only where Defender has no row for it from the risk level the graph puts on the edge. A dangling edge whose
|          // ASSET node is missing has nothing to report on and stays out.
|          let _AssetFindingEdges_orphan =
|              ExposureGraphEdges
|              | where EdgeLabel has "affecting"
|              | where tostring(SourceNodeCategories) contains "finding" and SourceNodeLabel !contains "cve"
|              | join kind=leftanti (ExposureGraphNodes | project NodeId) on $left.SourceNodeId == $right.NodeId
|              | extend EdgeProps = column_ifexists("EdgeProperties", dynamic({}))
|              | extend _akKey = tolower(extract(@"/assessments/([^/]+)$", 1, tostring(EdgeProps.rawData.recommendationAzureResourceId)))
|              | join kind=leftouter (_dfcRecByKey) on _akKey
|              | extend _akSeverity = iff(isnotempty(_akSeverity), _akSeverity, tostring(EdgeProps.rawData.risk.riskLevel))
|              | join kind=inner (_Assets) on $left.TargetNodeId == $right.AssetNodeId
|              | project AssetNodeId, AssetName, AssetLabel, AssetArmId, DeviceKey, EG_IsCustomerFacing, EG_IsExcluded,
|                        FindingName = SourceNodeName, FindingLabel = SourceNodeLabel, FindingCategories = SourceNodeCategories,
|                        FindingProps = bag_pack("rawData", bag_pack("severity", _akSeverity, "securityIssue", bag_pack("securityIssue", _akIssue), "assessmentKey", _akKey)),
|                        EdgeLabel, EdgeProps;
|
|          let _AssetFindingEdges = union _AssetFindingEdges_oneway, _AssetFindingEdges_otherway, _AssetFindingEdges_orphan;
|
|          _AssetFindingEdges
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              | where not (FindingName in (SI_ExcludedConfigurationIds)) and not (trim(@"\s+", tostring(FindingName)) in (SI_ExcludedConfigurationIds))
|              | summarize
|                  AssetArmId            = any(AssetArmId),
|                  DeviceKey             = any(DeviceKey),
|                  EdgeLabels            = make_set(EdgeLabel),
|                  EdgePropsAny          = any(EdgeProps),
|                  FindingLabel          = any(FindingLabel),
|                  FindingCategories     = any(FindingCategories),
|                  FindingProps          = any(FindingProps),
|                  EG_IsCustomerFacing   = any(EG_IsCustomerFacing),
|                  EG_IsExcluded         = any(EG_IsExcluded)
|                by AssetNodeId, AssetName, AssetLabel, FindingName
|              // The hand-off lookup _dfcPairs has no per-asset key. When it is too large to travel whole in every slice, the
|              // engine asks the graph, per slice, which pair keys the rows at this point can have and inlines only those pairs
|              // (the report field LookupNeededKeys). Everything below this line is unchanged by that.
|              //__SI_LOOKUP_KEYS_HERE__
|              // #505 -- the finding's CI, by the ARM id / Defender device id / node id the graph node carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend _dfcKey = strcat("h", tostring(hash(strcat(tolower(tostring(AssetName)), "|", tolower(tostring(FindingName))))))
|              // #673 the three anti-joins below sit between markers the engine can take out (SI_RA_DefenderFilterInEngine)
|              // -- it then removes the same rows itself against the Defender list held in SQL, and the query returns the three keys.
|              // Pasted as it is, the query still de-duplicates on its own.
|              //__SI_DFC_ANTIJOIN_BEGIN__
|              | join kind=leftanti (_dfcPairs) on _dfcKey
|              | project-away _dfcKey
|              //__SI_DFC_ANTIJOIN_END__
|              | extend AssetName = case(
|                  isnotempty(tostring(AssetName)),     tostring(AssetName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  tostring(DeviceKey))
|              | extend AssetId   = case(
|                  isnotempty(si_ci_id),   tostring(si_ci_id),
|                  isnotempty(AssetArmId), strcat("az:", AssetArmId),
|                  tostring(AssetNodeId))
|              | extend AssetType = case(si_class == "device", "Endpoint", isnotempty(tostring(AssetLabel)), tostring(AssetLabel), "Azure")
|              // #690 (38) the resource is the one the Defender assessment on the edge names (the resource the portal shows),
|              // rolled up to its parent like the Defender recommendation report, else the ARM id of the node itself -- a graph node can
|              // carry two ARM ids (a VM moved to another subscription keeps its old id first)
|              | extend _assessedRes = extract(@"^(.*)/providers/microsoft\.security/assessments/[^/]+$", 1, tolower(tostring(EdgePropsAny.rawData.recommendationAzureResourceId)))
|              | extend AzureResourceId = coalesce(iff(_assessedRes contains "/securityentitydata/", substring(_assessedRes, 0, indexof(_assessedRes, "/securityentitydata/")), _assessedRes), AssetArmId)
|              | project-away _assessedRes
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // #200 the same drop by ARM id. Defender names a VM by its Azure name, the graph by the machine, so the name pair
|              // above never matched a VM. The ARM id the graph node carries is the ARM id Defender reports.
|              | extend _dfcIdKey = iff(isnotempty(AssetArmId), strcat("h", tostring(hash(strcat(AssetArmId, "|", tolower(tostring(FindingName)))))), "-")
|              //__SI_DFC_ANTIJOIN_BEGIN__
|              | join kind=leftanti (_dfcPairs) on $left._dfcIdKey == $right._dfcKey
|              | project-away _dfcIdKey
|              //__SI_DFC_ANTIJOIN_END__
|              // #349 the same drop by the Defender assessment the graph edge names -- its resource and assessment key.
|              | extend _egRecArm = tolower(tostring(EdgePropsAny.rawData.recommendationAzureResourceId))
|              | extend _dfcAkKey = iff(_egRecArm matches regex @"/providers/microsoft\.security/assessments/[^/]+$", strcat("h", tostring(hash(strcat(extract(@"^(.*)/providers/microsoft\.security/assessments/[^/]+$", 1, _egRecArm), "|", extract(@"/assessments/([^/]+)$", 1, _egRecArm))))), "-")
|              //__SI_DFC_ANTIJOIN_BEGIN__
|              | join kind=leftanti (_dfcPairs) on $left._dfcAkKey == $right._dfcKey
|              | project-away _egRecArm, _dfcAkKey
|              //__SI_DFC_ANTIJOIN_END__
|              // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100   // basis-100, 100 = 1.0x = no lift
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend Properties =
|                  bag_merge(
|                      bag_pack("finding", FindingProps),
|                      bag_pack("raw", iif(isnull(FindingProps.rawData), dynamic({}), FindingProps.rawData)),
|                      bag_pack("edge", EdgePropsAny)
|                  )
|              | extend Subcategory = tostring(Properties.raw.securityIssue.securityIssue)
|              // finding factors -- the distinct risk factors the graph puts on the recommendation edge
|              | extend RiskFactorsArray = todynamic(Properties.edge.rawData.risk.riskFactors)
|              | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|              | mv-apply rf = RiskFactorsArray on (
|                  where isnotempty(trim(" ", tostring(rf)))
|                  | summarize RiskFactorSet = make_set(tostring(rf)))
|              | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              | extend RiskFactor_Probability = array_length(RiskFactorSet) + array_length(RF_P_CiFactors)
|              | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|              | extend RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(array_concat(
|                  RiskFactorSet,
|                  RF_P_CiFactorNames)), ";")
|              | extend Severity = tostring(Properties.raw.severity)
|              // #690 (37) a finding without a severity on its node is never dropped -- the risk level the graph puts on the
|              // edge is the source severity next, else the report's owner-defined severity (severity model, Low)
|              | extend Severity = iff(isnotempty(Severity), Severity, tostring(Properties.edge.rawData.risk.riskLevel))
|              | extend SecuritySeverity = case(
|                  tolower(Severity) == "critical", "Very High",
|                  tolower(Severity) == "high",     "High",
|                  tolower(Severity) == "medium",   "Medium",
|                  tolower(Severity) == "low",      "Low",
|                  "Low")
|              | extend Impact = case(
|                  tolower(Severity) == "critical", 10.0,
|                  tolower(Severity) == "high",     9.0,
|                  tolower(Severity) == "medium",   7.0,
|                  tolower(Severity) == "low",      3.0,
|                  0.0)
|              // #192 a subscription-level row no CI links takes the subscription's most critical CI.
|              | extend _subK = iff(AssetArmId matches regex @"^/subscriptions/[^/]+/?$", tostring(split(AssetArmId, "/")[2]), "")
|              | join kind=leftouter (_subTierG) on $left._subK == $right._sub
|              | extend CriticalityTier = iff(isnull(si_tier) and isnotempty(_subK), toint(Tier_BySub), toint(si_tier))
|              | project-away _subK, _sub, Tier_BySub
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain    = "Azure"
|              | extend Category          = tostring(FindingLabel)
|              // #690 (14) the graph writes some recommendation names with leading spaces -- the name and id are shown trimmed
|              // (the hand-off to the Defender report keeps comparing the name as the graph writes it)
|              | extend ConfigurationName = trim(@"\s+", tostring(FindingName))
|              // ConfigurationId carries the per-row recommendation id so (AssetName, ConfigurationId) is unique per row.
|              // Engine dedup keys on ConfigurationId via $cnInName -- this is what keeps Detailed rows alive.
|              | extend ConfigurationId   = trim(@"\s+", tostring(FindingName))
|              | project
|                  SecurityDomain, Category, Subcategory,
|                  ConfigurationName, ConfigurationId,
|                            AssetName,
|                            AssetId,
|                            AssetType,
|                  AzureResourceId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  EG_IsCustomerFacing
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, Impact desc, AssetName asc, ConfigurationId asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|          // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|          // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|
|    - ReportName: Azure_DefenderRecommendations_Summary
|      ReportPurpose: >-
|        Every Defender for Cloud (Secure Score) recommendation, summarised per recommendation x tier x severity with the impacted assets listed; container-image and cloud-posture entities rolled up to their parent. The Exposure Graph is not required.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - ImpactedEntityCount
|      - SubFindingCount
|      - RecommendedAction
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Azure_DefenderRecommendations_Summary
|          // #147 -- EVERY Defender for Cloud (Secure Score) recommendation, collected by the azure engine into
|          // SI_AzureRecommendation_CL (container-image and cloud-posture entities rolled up to their parent with
|          // the affected entities listed). This is the BASE of the report -- nothing depends on the Exposure Graph.
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Each recommendation is tied to its CI by the lower-cased
|          // ARM resource id (_ciKey). Tier, CMDB values, tags and the internet-exposed factor are the CI's.
|          // union isfuzzy -- an install that has not collected yet returns an empty report, never a failed one.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|          let _recAll = union isfuzzy=true
|              (datatable(CollectionTime:datetime, ResourceId:string, ResourceIdLower:string, ResourceName:string, ResourceType:string, RowKind:string, Recommendation:string, AssessmentKey:string, Severity:string, RecommendationCategory:string, SecurityIssue:string, Categories:string, Tactics:string, RiskFactors:string, PortalLink:string, MaxCvssScore:string, AffectedEntityKind:string, AffectedEntities:string, SubscriptionId:string, ResourceGroup:string, Description:string, Remediation:string, SubFindingMaxSeverity:string, SubFindings:string)[]),
|              (SI_AzureRecommendation_CL | where TimeGenerated > ago(8d))
|              // #278 the two counts are NOT declared in the stub above. A Log Analytics column type is fixed by whoever
|              // created the table (int on one install, long on another), and a typed stub that disagrees splits the column.
|              // Read whatever type the table has, or null when there is no table yet.
|              | extend AffectedEntityCount = toint(column_ifexists("AffectedEntityCount", int(null))), SubFindingCount = toint(column_ifexists("SubFindingCount", int(null)));
|          let _recLatest = toscalar(_recAll | summarize max(CollectionTime));
|          let _rec = _recAll
|              | where CollectionTime == _recLatest
|              | extend _k = tolower(tostring(ResourceIdLower))
|              // #692 the slices of a large tenant -- one per hash of the recommendation's resource (every row has a key)
|              | extend DeviceKey = iff(isnotempty(_k), _k, strcat("rec|", tolower(tostring(Recommendation)), "|", tolower(tostring(SubscriptionId))))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              ;
|
|
|          // #190 a subscription-level finding governs everything in the subscription, so its most critical CI sets the tier.
|          // #690 (14) read on its own, once per run, never from the sliced _ciLink (the #675 fix of the graph report) -- a query
|          // slice holds only its share of the subscription's CIs, so the minimum over that share could be a less critical tier.
|          //__SI_CI_SUBTIER_BEGIN__
|              let _subTierG =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where _ciKey startswith "/subscriptions/"
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | extend _sub = tostring(split(_ciKey, "/")[2])
|                  | where isnotempty(_sub)
|                  | summarize Tier_BySub = min(toint(column_ifexists("si_tier", int(null)))) by _sub;
|          //__SI_CI_SUBTIER_END__
|
|          _rec
|              // #505 -- the recommendation's CI, by the lower-cased ARM resource id (never a name)
|              | join kind=leftouter (_ciLink) on $left._k == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend _sub = iff(RowKind == "Subscription" or tolower(ResourceType) startswith "microsoft.security/pricings", tolower(tostring(SubscriptionId)), "")
|              | join kind=leftouter (_subTierG) on _sub
|              // #190 a child resource no CI links (a SQL server's encryption protector) takes its parent's tier.
|              | extend _seg = split(_k, "/")
|              | extend _kp = iff(isempty(si_ci_id) and array_length(_seg) > 9, strcat_array(array_slice(_seg, 0, array_length(_seg) - 3), "/"), "")
|              | join kind=leftouter (_ciLink | project _kp = _ciKey, Tier_ByParent = si_tier) on _kp
|              | where not (Recommendation in (SI_ExcludedConfigurationIds)) and not (AssessmentKey in (SI_ExcludedConfigurationIds))
|              | extend AssetName = case(isnotempty(si_asset_name), si_asset_name, isnotempty(ResourceName), ResourceName, ResourceId)
|              | extend AssetId   = case(isnotempty(si_ci_id), si_ci_id, strcat("az:", ResourceIdLower))
|              | extend AssetType = case(RowKind == "Subscription", "Subscription", isnotempty(ResourceType), ResourceType, "Azure")
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // finding factors -- the risk factors Defender puts on the recommendation
|              | extend _rf = split(RiskFactors, "; ")
|              | mv-apply rf = _rf on (where isnotempty(trim(" ", tostring(rf))) | summarize RiskFactorSet = make_set(tostring(rf)))
|              | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              | extend RiskFactor_Probability = array_length(RiskFactorSet) + array_length(RF_P_CiFactors)
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(array_concat(
|                  RiskFactorSet,
|                  RF_P_CiFactorNames)), ";")
|              | extend SecuritySeverity = case(
|                  tolower(Severity) == "critical", "Very High",
|                  tolower(Severity) == "high",     "High",
|                  tolower(Severity) == "medium",   "Medium",
|                  tolower(Severity) == "low",      "Low",
|                  "Low")
|              | extend Impact = case(
|                  tolower(Severity) == "critical", 10.0,
|                  tolower(Severity) == "high",     9.0,
|                  tolower(Severity) == "medium",   7.0,
|                  tolower(Severity) == "low",      3.0,
|                  0.0)
|              | extend CriticalityTier = toint(array_sort_asc(pack_array(toint(si_tier), toint(Tier_BySub), toint(Tier_ByParent)))[0])
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecurityDomain    = "Azure"
|              | extend Category          = iff(isnotempty(RecommendationCategory), RecommendationCategory, "Defender for Cloud")
|              | extend Subcategory       = SecurityIssue
|              | extend ConfigurationName = Recommendation
|              | extend PortalUrl         = iff(isnotempty(PortalLink) and not(PortalLink startswith "http"), strcat("https://", PortalLink), PortalLink)
|              // what Defender for Cloud knows around the recommendation -- every column read with column_ifexists, so a table
|              // that has not received a column yet gives an empty cell, never a failed report
|              | extend MITRE_Tactics = replace_string(tostring(column_ifexists("Tactics", "")), "; ", ";"),
|                       MITRE_Techniques = replace_string(tostring(column_ifexists("Techniques", "")), "; ", ";"),
|                       ComplianceTags = tostring(column_ifexists("ComplianceTags", "")),
|                       si_source_first_detected = todatetime(column_ifexists("FirstEvaluated", "")),
|                       si_last_seen = todatetime(column_ifexists("StatusChanged", "")),
|                       si_fix_owner = tostring(column_ifexists("GovernanceOwner", "")),
|                       si_fix_due_date = todatetime(column_ifexists("GovernanceDueDate", "")),
|                       si_fix_grace_period = tostring(column_ifexists("GovernanceGracePeriod", "")),
|                       si_secure_score_control = tostring(column_ifexists("SecureScoreControl", "")),
|                       si_secure_score_gain = todouble(column_ifexists("SecureScoreGain", "")),
|                       si_attack_path_count = toint(column_ifexists("AttackPathCount", "")),
|                       si_attack_paths = tostring(column_ifexists("AttackPaths", "")),
|                       si_policy_definition_id = tostring(column_ifexists("PolicyDefinitionId", "")),
|                       si_status_cause = trim(" ", strcat(tostring(column_ifexists("StatusCause", "")), " ", tostring(column_ifexists("StatusDescription", "")))),
|                       si_affected_software = tostring(column_ifexists("SubFindingProducts", "")),
|                       SI_FixReference = tostring(column_ifexists("SubFindingFixedVersions", "")),
|                       SubFindingRemediation = tostring(column_ifexists("SubFindingRemediation", "")),
|                       si_image_digest = tostring(column_ifexists("ImageDigest", "")),
|                       si_image_repository = tostring(column_ifexists("ImageRepository", ""))
|              | extend ConfigurationId   = "Recommendation"
|              | summarize
|                  ImpactedAssetsList        = make_set(AssetName),
|                  ImpactedAssetPairs        = make_set(strcat(AssetName, "|", AssetId)),
|                  ImpactedEntityCount       = sum(AffectedEntityCount),
|                  RiskFactor_Consequence    = max(RiskFactor_Consequence),
|                  RiskScore_Weight_Factor   = max(RiskScore_Weight_Factor),
|                  RiskFactor_Weight         = max(RiskFactor_Weight),
|                  RiskScore_Weight_Detailed = any(RiskScore_Weight_Detailed),
|                  Impact                    = max(Impact),
|                  arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|                  PortalUrl                 = any(PortalUrl),
|                  RecommendedAction         = take_any(Remediation),
|                  si_fix_remediation        = take_anyif(Remediation, isnotempty(Remediation)),
|                  MITRE_Tactics             = take_anyif(MITRE_Tactics, isnotempty(MITRE_Tactics)),
|                  MITRE_Techniques          = take_anyif(MITRE_Techniques, isnotempty(MITRE_Techniques)),
|                  ComplianceTags            = take_anyif(ComplianceTags, isnotempty(ComplianceTags)),
|                  si_source_first_detected  = min(si_source_first_detected),
|                  si_last_seen              = max(si_last_seen),
|                  si_secure_score_control   = take_anyif(si_secure_score_control, isnotempty(si_secure_score_control)),
|                  si_secure_score_gain      = max(si_secure_score_gain),
|                  si_attack_path_count      = max(si_attack_path_count),
|                  _fixOwners                = make_set_if(si_fix_owner, isnotempty(si_fix_owner), 20),
|                  si_fix_due_date           = min(si_fix_due_date),
|                  SubFindingCount           = sum(SubFindingCount)
|                by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                   CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|                   cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|              | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|              // #692 the owners as an extend (not inside the project) -- a group the slices split is merged into one row again
|              | extend si_fix_owner = strcat_array(_fixOwners, ", ")
|              | project
|                  SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetPairs, ImpactedEntityCount, SubFindingCount, RecommendedAction, PortalUrl, si_fix_remediation,
|                  MITRE_Tactics, MITRE_Techniques, ComplianceTags, si_source_first_detected, si_last_seen,
|                  si_secure_score_control, si_secure_score_gain, si_attack_path_count, si_fix_owner, si_fix_due_date
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, ImpactedAssetCount desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|          // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|          // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, ImpactedEntityCount, SubFindingCount, RecommendedAction, MoreDetails
|          // out AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|          // si si_category <- Category, si_subcategory <- Subcategory, si_description <- Description, si_remediation <- RecommendedAction
|          // si si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software, si_source_first_detected <- si_source_first_detected, si_source_first_seen <- si_source_first_detected
|          // si si_last_seen <- si_last_seen, si_fix_owner <- si_fix_owner, si_fix_due_date <- si_fix_due_date, si_fix_grace_period <- si_fix_grace_period
|          // si si_secure_score_control <- si_secure_score_control, si_secure_score_gain <- si_secure_score_gain, si_attack_path_count <- si_attack_path_count, si_attack_paths <- si_attack_paths
|          // si si_policy_definition_id <- si_policy_definition_id, si_status_cause <- si_status_cause, si_image_digest <- si_image_digest, si_image_repository <- si_image_repository
|          // si si_fix_reference <- SI_FixReference, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|          // si si_portal_link <- PortalUrl, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|    - ReportName: Azure_DefenderRecommendations_Detailed
|      ReportPurpose: >-
|        Every Defender for Cloud (Secure Score) recommendation, one row per (resource x recommendation); container-image and cloud-posture entities rolled up to their parent with the affected entities listed. Tier / cmdb / exclusion from the Azure profile by ARM id. The Exposure Graph is not required.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - AffectedEntityKind
|      - AffectedEntityCount
|      - AffectedEntities
|      - SubFindingCount
|      - SubFindingMaxSeverity
|      - SubFindings
|      - RecommendedAction
|      - ConfigurationDescription
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Azure_DefenderRecommendations_Detailed
|          // #147 -- EVERY Defender for Cloud (Secure Score) recommendation, collected by the azure engine into
|          // SI_AzureRecommendation_CL (container-image and cloud-posture entities rolled up to their parent with
|          // the affected entities listed). This is the BASE of the report -- nothing depends on the Exposure Graph.
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Each recommendation is tied to its CI by the lower-cased
|          // ARM resource id (_ciKey). Tier, CMDB values, tags and the internet-exposed factor are the CI's.
|          // union isfuzzy -- an install that has not collected yet returns an empty report, never a failed one.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|          let _recAll = union isfuzzy=true
|              (datatable(CollectionTime:datetime, ResourceId:string, ResourceIdLower:string, ResourceName:string, ResourceType:string, RowKind:string, Recommendation:string, AssessmentKey:string, Severity:string, RecommendationCategory:string, SecurityIssue:string, Categories:string, Tactics:string, RiskFactors:string, PortalLink:string, MaxCvssScore:string, AffectedEntityKind:string, AffectedEntities:string, SubscriptionId:string, ResourceGroup:string, Description:string, Remediation:string, SubFindingMaxSeverity:string, SubFindings:string)[]),
|              (SI_AzureRecommendation_CL | where TimeGenerated > ago(8d))
|              // #278 the two counts are NOT declared in the stub above. A Log Analytics column type is fixed by whoever
|              // created the table (int on one install, long on another), and a typed stub that disagrees splits the column.
|              // Read whatever type the table has, or null when there is no table yet.
|              | extend AffectedEntityCount = toint(column_ifexists("AffectedEntityCount", int(null))), SubFindingCount = toint(column_ifexists("SubFindingCount", int(null)));
|          let _recLatest = toscalar(_recAll | summarize max(CollectionTime));
|          let _rec = _recAll
|              | where CollectionTime == _recLatest
|              | extend _k = tolower(tostring(ResourceIdLower))
|              // #692 the slices of a large tenant -- one per hash of the recommendation's resource (every row has a key)
|              | extend DeviceKey = iff(isnotempty(_k), _k, strcat("rec|", tolower(tostring(Recommendation)), "|", tolower(tostring(SubscriptionId))))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              ;
|
|
|          // #190 a subscription-level finding governs everything in the subscription, so its most critical CI sets the tier.
|          // #690 (14) read on its own, once per run, never from the sliced _ciLink (the #675 fix of the graph report) -- a query
|          // slice holds only its share of the subscription's CIs, so the minimum over that share could be a less critical tier.
|          //__SI_CI_SUBTIER_BEGIN__
|              let _subTierG =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where _ciKey startswith "/subscriptions/"
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | extend _sub = tostring(split(_ciKey, "/")[2])
|                  | where isnotempty(_sub)
|                  | summarize Tier_BySub = min(toint(column_ifexists("si_tier", int(null)))) by _sub;
|          //__SI_CI_SUBTIER_END__
|
|          _rec
|              // #505 -- the recommendation's CI, by the lower-cased ARM resource id (never a name)
|              | join kind=leftouter (_ciLink) on $left._k == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend _sub = iff(RowKind == "Subscription" or tolower(ResourceType) startswith "microsoft.security/pricings", tolower(tostring(SubscriptionId)), "")
|              | join kind=leftouter (_subTierG) on _sub
|              // #190 a child resource no CI links (a SQL server's encryption protector) takes its parent's tier.
|              | extend _seg = split(_k, "/")
|              | extend _kp = iff(isempty(si_ci_id) and array_length(_seg) > 9, strcat_array(array_slice(_seg, 0, array_length(_seg) - 3), "/"), "")
|              | join kind=leftouter (_ciLink | project _kp = _ciKey, Tier_ByParent = si_tier) on _kp
|              | where not (Recommendation in (SI_ExcludedConfigurationIds)) and not (AssessmentKey in (SI_ExcludedConfigurationIds))
|              | extend AssetName = case(isnotempty(si_asset_name), si_asset_name, isnotempty(ResourceName), ResourceName, ResourceId)
|              | extend AssetId   = case(isnotempty(si_ci_id), si_ci_id, strcat("az:", ResourceIdLower))
|              | extend AssetType = case(RowKind == "Subscription", "Subscription", isnotempty(ResourceType), ResourceType, "Azure")
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // finding factors -- the risk factors Defender puts on the recommendation
|              | extend _rf = split(RiskFactors, "; ")
|              | mv-apply rf = _rf on (where isnotempty(trim(" ", tostring(rf))) | summarize RiskFactorSet = make_set(tostring(rf)))
|              | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              | extend RiskFactor_Probability = array_length(RiskFactorSet) + array_length(RF_P_CiFactors)
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(array_concat(
|                  RiskFactorSet,
|                  RF_P_CiFactorNames)), ";")
|              | extend SecuritySeverity = case(
|                  tolower(Severity) == "critical", "Very High",
|                  tolower(Severity) == "high",     "High",
|                  tolower(Severity) == "medium",   "Medium",
|                  tolower(Severity) == "low",      "Low",
|                  "Low")
|              | extend Impact = case(
|                  tolower(Severity) == "critical", 10.0,
|                  tolower(Severity) == "high",     9.0,
|                  tolower(Severity) == "medium",   7.0,
|                  tolower(Severity) == "low",      3.0,
|                  0.0)
|              | extend CriticalityTier = toint(array_sort_asc(pack_array(toint(si_tier), toint(Tier_BySub), toint(Tier_ByParent)))[0])
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecurityDomain    = "Azure"
|              | extend Category          = iff(isnotempty(RecommendationCategory), RecommendationCategory, "Defender for Cloud")
|              | extend Subcategory       = SecurityIssue
|              | extend ConfigurationName = Recommendation
|              | extend PortalUrl         = iff(isnotempty(PortalLink) and not(PortalLink startswith "http"), strcat("https://", PortalLink), PortalLink)
|              // what Defender for Cloud knows around the recommendation -- every column read with column_ifexists, so a table
|              // that has not received a column yet gives an empty cell, never a failed report
|              | extend MITRE_Tactics = replace_string(tostring(column_ifexists("Tactics", "")), "; ", ";"),
|                       MITRE_Techniques = replace_string(tostring(column_ifexists("Techniques", "")), "; ", ";"),
|                       ComplianceTags = tostring(column_ifexists("ComplianceTags", "")),
|                       si_source_first_detected = todatetime(column_ifexists("FirstEvaluated", "")),
|                       si_last_seen = todatetime(column_ifexists("StatusChanged", "")),
|                       si_fix_owner = tostring(column_ifexists("GovernanceOwner", "")),
|                       si_fix_due_date = todatetime(column_ifexists("GovernanceDueDate", "")),
|                       si_fix_grace_period = tostring(column_ifexists("GovernanceGracePeriod", "")),
|                       si_secure_score_control = tostring(column_ifexists("SecureScoreControl", "")),
|                       si_secure_score_gain = todouble(column_ifexists("SecureScoreGain", "")),
|                       si_attack_path_count = toint(column_ifexists("AttackPathCount", "")),
|                       si_attack_paths = tostring(column_ifexists("AttackPaths", "")),
|                       si_policy_definition_id = tostring(column_ifexists("PolicyDefinitionId", "")),
|                       si_status_cause = trim(" ", strcat(tostring(column_ifexists("StatusCause", "")), " ", tostring(column_ifexists("StatusDescription", "")))),
|                       si_affected_software = tostring(column_ifexists("SubFindingProducts", "")),
|                       SI_FixReference = tostring(column_ifexists("SubFindingFixedVersions", "")),
|                       SubFindingRemediation = tostring(column_ifexists("SubFindingRemediation", "")),
|                       si_image_digest = tostring(column_ifexists("ImageDigest", "")),
|                       si_image_repository = tostring(column_ifexists("ImageRepository", ""))
|              | extend ConfigurationId   = AssessmentKey
|              | project
|                  SecurityDomain, Category, Subcategory,
|                  ConfigurationName, ConfigurationId,
|                  AssetName, AssetId, AssetType,
|                  AzureResourceId = ResourceId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  AffectedEntityKind, AffectedEntityCount, AffectedEntities,
|                  SubFindingCount, SubFindingMaxSeverity, SubFindings,
|                  RecommendedAction = Remediation, si_fix_remediation = Remediation, ConfigurationDescription = Description,
|                  Tactics, MaxCvssScore, PortalUrl,
|                  MITRE_Tactics, MITRE_Techniques, ComplianceTags, si_source_first_detected, si_last_seen,
|                  si_fix_owner, si_fix_due_date, si_fix_grace_period,
|                  si_secure_score_control, si_secure_score_gain, si_attack_path_count, si_attack_paths,
|                  si_policy_definition_id, si_status_cause,
|                  si_affected_software, SI_FixReference, SubFindingRemediation, si_image_digest, si_image_repository,
|                  UserImpact = tostring(column_ifexists("UserImpact", "")), ImplementationEffort = tostring(column_ifexists("ImplementationEffort", "")),
|                  DefenderRiskLevel = tostring(column_ifexists("RiskLevel", "")), Threats = tostring(column_ifexists("Threats", ""))
|              | order by CriticalityTier asc, Impact desc, AssetName asc, ConfigurationId asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|          // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|          // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, AffectedEntityKind, AffectedEntityCount, AffectedEntities, SubFindingCount
|          // out SubFindingMaxSeverity, SubFindings, RecommendedAction, ConfigurationDescription, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|          // si si_category <- Category, si_subcategory <- Subcategory, si_description <- ConfigurationDescription, si_remediation <- RecommendedAction
|          // si si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software, si_source_first_detected <- si_source_first_detected, si_source_first_seen <- si_source_first_detected
|          // si si_last_seen <- si_last_seen, si_fix_owner <- si_fix_owner, si_fix_due_date <- si_fix_due_date, si_fix_grace_period <- si_fix_grace_period
|          // si si_secure_score_control <- si_secure_score_control, si_secure_score_gain <- si_secure_score_gain, si_attack_path_count <- si_attack_path_count, si_attack_paths <- si_attack_paths
|          // si si_policy_definition_id <- si_policy_definition_id, si_status_cause <- si_status_cause, si_image_digest <- si_image_digest, si_image_repository <- si_image_repository
|          // si si_fix_reference <- SI_FixReference, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|          // si si_portal_link <- PortalUrl, si_user_impact <- UserImpact, si_remediation_effort <- ImplementationEffort, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_Github_to_Azure_Resources
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|          | project __siNeeded = pack_array(TargetCiKey)
|      ReportPurpose: Credential-driven attack paths from GitHub to Azure targets, prioritized by FINAL TARGET business impact.
|        EG provides the path detection + lateral-movement scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - UniqueIssues
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - IssueList
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  Credential driven attack paths from GitHub to Azure using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify credentials stored in GitHub workflows or repositories and trace credential driven
|        // attack paths into Azure targets. Paths are prioritized by the business impact of the FINAL TARGET.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the TARGET criticality tier first
|        // - Then by tier escalation where source tier is higher than target tier
|        // - Then by Internet exposure where target exposure is weighted higher than source exposure
|        // - GitHub sources are treated as Internet exposed and low trust by default
|        // - A low tier source can never outrank a tier 0 or tier 1 target
|        //
|        // Output description
|        // Detailed output produces one row per unique credential to target attack path enriched with
|        // - Internet exposure flags
|        // - Asset tier from tags
|        // - Legacy operating system and end of support signals
|        // - Risk factor probability including detailed breakdown
|        // - Attack path priority score and severity
|        // - Human readable attack path strings
|        //
|        // Collapsed summary output merges duplicates caused by many credentials or sources
|        // - Collapse key uses source identity target triple
|        // - Summaries include RiskFactor_Probability_Detailed and DetailedScore derived from target
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone
|        // Step 2  Normalize node labels to avoid filter issues
|        // Step 3  Identify credentials stored in GitHub workflows and repositories
|        // Step 4  Hop 1 credential authenticates as an identity
|        // Step 5  Hop 2 identity can reach Azure target resources
|        // Step 6  Assemble attack paths and de duplicate
|        // Step 7  Enrich source target intermediate and credential using Nodes catalog
|        // Step 8  Calculate tier escalation lateral movement and priority score
|        // Step 9  Build human readable AttackPath and AttackPathDetailed
|        // Step 10 Emit detailed output table
|        // Step 11 Collapse to unique logical path
|        // Step 12 Build main summary
|        // Step 13 Build probability detail summary
|        // Step 14 Build probability detail score summary
|        // Step 15 Emit final collapsed output
|        // =================================================================================================
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich attack paths
|        // - Bucket filtering is applied once at node scope using DeviceKey
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|
|            | extend AssetName = NodeNameNorm
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(NodeProperties.rawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    NodeProperties.rawData.isCustomerFacing,
|                    NodeProperties.raw.isCustomerFacing,
|                    false
|                ))
|
|            | extend IsExcluded =
|                tobool(coalesce(
|                    NodeProperties.rawData.isExcluded,
|                    NodeProperties.raw.isExcluded,
|                    false
|                ))
|
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    NodeProperties.rawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | mv-apply rf = array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                ) on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize ScoreParts = make_set(strcat(tostring(rf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                Categories        = CategoriesStr,
|                NodeProperties,
|                EgCriticalityLevel,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                EgNodeTags,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactorsArray,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|        // Step 2  Normalize labels to avoid typos breaking filters
|        let NormalizeLabel = (s:string) { tolower(trim(" ", replace_string(s, " ", ""))) };
|
|        // Step 3  Identify credentials stored in GitHub workflows and repositories
|        // Fixes applied
|        // - GitHub graph label variations are common, allow a small set of normalized variants
|        // - Also support reverse edge direction (credential contains github object) with isfuzzy union
|        let GitHubSourceLabelAllow =
|            dynamic([
|                "githubworkflow",
|                "githubrepository",
|                "githubactionsworkflow",
|                "githubactions",
|                "github"
|            ]);
|
|        let CredentialLabelAllow =
|            dynamic([
|                "azure-active-directory-app-secret",
|                "user-azure-cli-secret",
|                "azure-storage-shared-access-signature",
|                "azure-storage-connection-string",
|                "azure-database-connection-string",
|                "azure-active-directory-user-credentials",
|                "service-principal-azure-cli-secret",
|                "azure-app-configuration-key"
|            ]);
|
|        let GitHubCredentials_Forward =
|            ExposureGraphEdges
|            | where EdgeLabel in ("contains", "defined in")
|            | extend SourceNodeLabelNorm = NormalizeLabel(SourceNodeLabel),
|                     TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where SourceNodeLabelNorm in (GitHubSourceLabelAllow)
|            | where TargetNodeLabelNorm in (CredentialLabelAllow)
|            | project
|                SourceGitHubNodeId    = SourceNodeId,
|                SourceGitHubNodeName  = SourceNodeName,
|                SourceGitHubNodeLabel = SourceNodeLabel,
|                CredentialNodeId      = TargetNodeId,
|                CredentialNodeName    = TargetNodeName,
|                CredentialNodeLabel   = TargetNodeLabel;
|
|        let GitHubCredentials_Reverse =
|            ExposureGraphEdges
|            | where EdgeLabel in ("contains", "defined in")
|            | extend SourceNodeLabelNorm = NormalizeLabel(SourceNodeLabel),
|                     TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where TargetNodeLabelNorm in (GitHubSourceLabelAllow)
|            | where SourceNodeLabelNorm in (CredentialLabelAllow)
|            | project
|                SourceGitHubNodeId    = TargetNodeId,
|                SourceGitHubNodeName  = TargetNodeName,
|                SourceGitHubNodeLabel = TargetNodeLabel,
|                CredentialNodeId      = SourceNodeId,
|                CredentialNodeName    = SourceNodeName,
|                CredentialNodeLabel   = SourceNodeLabel;
|
|        let GitHubCredentials =
|            union isfuzzy=true GitHubCredentials_Forward, GitHubCredentials_Reverse
|            | summarize
|                GitHubSources          = make_set(SourceGitHubNodeName),
|                GitHubSourceTypes      = make_set(SourceGitHubNodeLabel),
|                GitHubSourceCount      = dcount(SourceGitHubNodeId),
|                FirstGitHubSource      = any(SourceGitHubNodeId),
|                FirstGitHubSourceName  = any(SourceGitHubNodeName),
|                FirstGitHubSourceLabel = any(SourceGitHubNodeLabel),
|                CredentialNodeName     = any(CredentialNodeName),
|                CredentialNodeLabel    = any(CredentialNodeLabel),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                CredentialNodeId;
|
|        // Step 4  Hop 1 credential authenticates as an identity
|        // Fixes applied
|        // - Many graphs store the identity as Source and credential as Target, support both directions
|        // v2.2.419 (audit #56.2b) -- BOUND both directions to the credentials found in Step 3.
|        // These two scanned every "has credentials of" / "can authenticate as" /
|        // "can authenticate to" edge in the tenant, on the assumption that the Step 6 join would
|        // keep the work small. It does not: a join constrains the RESULT, not the SCAN, so the hop
|        // set stayed tenant-wide however the report was bucketed. Identical defect to #56 in
|        // Credential_Based_Lateral_Movement.
|        // Provably lossless: GitHubCredentials is summarized `by CredentialNodeId`, and Step 6 does
|        // `join kind=inner (Hop1) on CredentialNodeId`, so the semi-join removes EXACTLY the rows
|        // that inner join would discard. Note the two directions key the credential to opposite
|        // ends of the edge, so each is bounded on the end IT projects as CredentialNodeId.
|        let _GhCredIds = GitHubCredentials | distinct CredentialNodeId;
|        let Hop1_Forward =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "can authenticate as", "can authenticate to")
|            | where SourceNodeId in (_GhCredIds)
|            | project
|                CredentialNodeId           = SourceNodeId,
|                Hop1_EdgeLabel             = EdgeLabel,
|                IntermediateIdentityId     = TargetNodeId,
|                IntermediateIdentity       = TargetNodeName,
|                IntermediateIdentityLabel  = TargetNodeLabel;
|
|        let Hop1_Reverse =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "can authenticate as", "can authenticate to")
|            | where TargetNodeId in (_GhCredIds)
|            | project
|                CredentialNodeId           = TargetNodeId,
|                Hop1_EdgeLabel             = EdgeLabel,
|                IntermediateIdentityId     = SourceNodeId,
|                IntermediateIdentity       = SourceNodeName,
|                IntermediateIdentityLabel  = SourceNodeLabel;
|
|        let Hop1 =
|            union isfuzzy=true Hop1_Forward, Hop1_Reverse;
|
|        // Step 5  Hop 2 identity can reach Azure target resources
|        let Hop2 =
|            ExposureGraphEdges
|            | where EdgeLabel in ("can authenticate to", "has permissions to", "has role on")
|            // v2.2.419 (audit #56.2b) -- bound to the identities Hop 1 actually reached. Step 6 does
|            // `join kind=inner (Hop2) on $left.IntermediateIdentityId == $right.Hop2_SourceIdentityId`,
|            // so this removes EXACTLY the rows that inner join would discard. This is the more
|            // dangerous of the two hops -- its target list includes `subscriptions` and
|            // `resourcegroups`, node types that legitimately carry thousands of inbound edges, so
|            // left tenant-wide it is what turns the join into a cartesian product on a hub identity.
|            | where SourceNodeId in (Hop1 | distinct IntermediateIdentityId)
|            // #677 the slices are cut on the path's FINAL TARGET (TargetNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            | extend DeviceKey = TargetNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | extend TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where _SI_ViaScope or TargetNodeLabelNorm in (
|                "microsoft.compute/virtualmachines",
|                "microsoft.storage/storageaccounts",
|                "microsoft.keyvault/vaults",
|                "microsoft.sql/servers",
|                "microsoft.sql/servers/databases",
|                "microsoft.cognitiveservices/accounts",
|                "microsoft.cognitiveservices/accounts_openai",
|                "subscriptions",
|                "resourcegroups",
|                "blobcontainer"
|            )
|            | project
|                Hop2_SourceIdentityId = SourceNodeId,
|                Hop2_EdgeLabel        = EdgeLabel,
|                FinalTargetId         = TargetNodeId,
|                FinalTargetName       = TargetNodeName,
|                FinalTargetLabel      = TargetNodeLabel;
|
|        // Step 6  Assemble attack paths and de duplicate
|        // Fixes applied
|        // - Original summarize by CredentialNodeId, FinalTargetId collapsed away IntermediateIdentityId
|        //   which breaks PathKey later and can create null or wrong joins
|        // - Stable detailed grain should include CredentialNodeId, IntermediateIdentityId, FinalTargetId
|        let Detailed =
|            GitHubCredentials
|            | join kind=inner (Hop1) on CredentialNodeId
|            | join kind=inner (Hop2) on $left.IntermediateIdentityId == $right.Hop2_SourceIdentityId
|            | where FirstGitHubSource != FinalTargetId
|            | summarize
|                GitHubSources          = any(GitHubSources),
|                GitHubSourceTypes      = any(GitHubSourceTypes),
|                GitHubSourceCount      = any(GitHubSourceCount),
|                FirstGitHubSource      = any(FirstGitHubSource),
|                FirstGitHubSourceName  = any(FirstGitHubSourceName),
|                FirstGitHubSourceLabel = any(FirstGitHubSourceLabel),
|
|                CredentialNodeName     = any(CredentialNodeName),
|                CredentialNodeLabel    = any(CredentialNodeLabel),
|
|                IntermediateIdentity      = any(IntermediateIdentity),
|                IntermediateIdentityLabel = any(IntermediateIdentityLabel),
|
|                Hop1Edge = any(Hop1_EdgeLabel),
|                Hop2Edge = any(Hop2_EdgeLabel),
|
|                FinalTargetName  = any(FinalTargetName),
|                FinalTargetLabel = any(FinalTargetLabel)
|              by
|                CredentialNodeId,
|                IntermediateIdentityId,
|                FinalTargetId;
|
|        // Step 7  Enrich source target intermediate and credential using Nodes catalog
|        let DetailedEnriched =
|            Detailed
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    TargetNodeId                = NodeId,
|                    TargetNodeCiKey = NodeCiKey,
|                    TargetRiskFactorSet = RiskFactorSet,
|                    TargetNodeName              = NodeName,
|                    TargetNodeLabel             = NodeLabel,
|                    TargetCriticalityTier       = CriticalityTier,
|                    TargetCriticalityTierLevel  = CriticalityTierLevel,
|                    TargetIsInternetExposed     = IsInternetExposed,
|                    TargetIsExcluded            = IsExcluded,
|                    TargetAssetTierByTag        = AssetTierByTag,
|                    TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                    TargetRiskProb              = RiskFactor_Probability,
|                    TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                    TargetNodeProperties        = NodeProperties
|            ) on $left.FinalTargetId == $right.TargetNodeId
|
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    IntermediateNodeId                = NodeId,
|                    IntermediateNodeName              = NodeName,
|                    IntermediateNodeLabel             = NodeLabel,
|                    IntermediateCriticalityTier       = CriticalityTier,
|                    IntermediateCriticalityTierLevel  = CriticalityTierLevel,
|                    IntermediateIsInternetExposed     = IsInternetExposed,
|                    IntermediateIsExcluded            = IsExcluded,
|                    IntermediateAssetTierByTag        = AssetTierByTag,
|                    IntermediateLegacyEndOfSupport    = LegacyEndOfSupport,
|                    IntermediateRiskProb              = RiskFactor_Probability,
|                    IntermediateRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    IntermediateRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                    IntermediateNodeProperties        = NodeProperties
|            ) on $left.IntermediateIdentityId == $right.IntermediateNodeId
|
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    CredentialNodeId_join    = NodeId,
|                    CredentialNodeName_join  = NodeName,
|                    CredentialNodeLabel_join = NodeLabel,
|                    CredentialNodeProperties = NodeProperties
|            ) on $left.CredentialNodeId == $right.CredentialNodeId_join
|
|            // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|            // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|            | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|            // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|            // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|            // the keys its own rows have (the report field LookupNeededKeys).
|            //__SI_LOOKUP_KEYS_HERE__
|            | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|            | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|            | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                     si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|            | project-away _peerKey, peer_*
|            | where coalesce(si_in_scope_, true)
|            | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(FinalTargetId))
|            | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|            | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|            // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|            | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|            | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|            | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|            | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|            | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|            | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|            | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|            | project-away _tgtRf, _tgtScore
|            | extend
|                cmdbId            = si_cmdb_id,
|                cmdbName            = si_cmdb_name,
|                cmdbCriticality     = si_cmdb_criticality,
|                cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|            // GitHub sources are treated as internet exposed and low trust by default
|            // Fixes applied
|            // - SourceCriticalityTier and SourceCriticalityTierLevel were taken from Nodes join on FirstGitHubSource
|            //   but GitHub nodes often are not in Nodes catalog or lack tier, so set safe defaults directly
|            | extend SourceIsInternetExposed = true
|            | extend SourceCriticalityTier = 3
|            | extend SourceCriticalityTierLevel = "Low - tier 3"
|            | extend SourceAssetTierByTag = ""
|            | extend SourceLegacyEndOfSupport = 0
|            | extend SourceRiskProb = 0
|            | extend SourceRiskProbDetailed = ""
|            | extend SourceRiskProbDetailedScore = ""
|
|            // Step 8  Calculate tier escalation lateral movement and priority score
|            | extend TierEscalation =
|                case(
|                    isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier,
|                        SourceCriticalityTier - TargetCriticalityTier,
|                    0
|                )
|            | extend IsLateralMovement = TierEscalation > 0
|            | extend LateralMovementType =
|                case(
|                    TierEscalation >= 3, "Privilege escalation large tier jump",
|                    TierEscalation == 2, "Privilege escalation two tiers",
|                    TierEscalation == 1, "Privilege escalation one tier",
|                    "Direct access same tier"
|                )
|
|            | extend TargetTierWeight =
|                case(
|                    TargetCriticalityTier == 0, 100,
|                    TargetCriticalityTier == 1, 60,
|                    TargetCriticalityTier == 2, 30,
|                    10
|                )
|            | extend EscalationWeight = TierEscalation * 10
|            | extend ExposureWeight   = iff(TargetIsInternetExposed == true, 8, 0) + 3
|            | extend SourceTierAmplifier =
|                case(
|                    SourceCriticalityTier == 0, 8,
|                    SourceCriticalityTier == 1, 5,
|                    SourceCriticalityTier == 2, 2,
|                    0
|                )
|
|            | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|
|            | extend AttackPathPriority =
|                case(
|                    AttackPathPriorityScore >= 90,  "Very High",
|                    AttackPathPriorityScore >= 60,  "High",
|                    AttackPathPriorityScore >= 30,  "Medium-High",
|                    AttackPathPriorityScore >= 15,  "Medium",
|                    "Low"
|                )
|
|            // Step 9  Build human readable AttackPath and AttackPathDetailed
|            | extend InternetExposureTarget = iff(TargetIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|            | extend InternetExposureSource = "Internet-Exposed"
|
|            | extend AttackPath =
|                strcat(
|                    FirstGitHubSourceLabel, " [", FirstGitHubSourceName, "] -> ",
|                    CredentialNodeLabel, " [", CredentialNodeName, "] -> ",
|                    IntermediateIdentityLabel, " [", IntermediateIdentity, "] -> ",
|                    FinalTargetLabel, " [", FinalTargetName, "]"
|                )
|
|            | extend AttackPathDetailed =
|                strcat(
|                    "SOURCE ", FirstGitHubSourceLabel, " [", FirstGitHubSourceName, "] ",
|                    "tier ", tostring(SourceCriticalityTier), " ", SourceCriticalityTierLevel, " | ", InternetExposureSource,
|                    iff(GitHubSourceCount > 1, strcat(" | + ", tostring(GitHubSourceCount - 1), " other GitHub source(s)"), ""),
|                    " -> CREDENTIAL ", CredentialNodeLabel, " [", CredentialNodeName, "] ",
|                    " -> IDENTITY ", IntermediateIdentityLabel, " [", IntermediateIdentity, "] ",
|                    " -> TARGET ", FinalTargetLabel, " [", FinalTargetName, "] ",
|                    "tier ", tostring(TargetCriticalityTier), " ", TargetCriticalityTierLevel, " | ", InternetExposureTarget,
|                    " | escalation ", tostring(TierEscalation),
|                    " | ", LateralMovementType
|                );
|
|        // Step 10 Emit detailed output table
|        let DetailedOutput =
|            DetailedEnriched
|            | extend SecurityDomain = "Azure"
|            | extend Category = "AttackPath_GitHubToAzure"
|            | extend Subcategory =
|                case(
|                    TierEscalation >= 3, strcat("GitHub to Tier ", tostring(TargetCriticalityTier), " - Critical Supply Chain Risk"),
|                    TierEscalation >= 2, strcat("GitHub to Tier ", tostring(TargetCriticalityTier), " - High Supply Chain Risk"),
|                    TierEscalation >= 1, strcat("GitHub to Tier ", tostring(TargetCriticalityTier), " - Moderate Supply Chain Risk"),
|                    "GitHub to Azure - Direct Access"
|                )
|            | project
|                SecurityDomain,
|                Category,
|                Subcategory,
|
|                AttackPathPriority,
|                AttackPathPriorityScore,
|                TierEscalation,
|                IsLateralMovement,
|                LateralMovementType,
|                EscalationWeight,
|                ExposureWeight,
|
|                FirstGitHubSource,
|                FirstGitHubSourceName,
|                FirstGitHubSourceLabel,
|                TotalGitHubSourcesWithCredential = GitHubSourceCount,
|                AllGitHubSources = GitHubSources,
|                GitHubSourceTypes,
|
|                CredentialNodeId,
|                CredentialNodeName,
|                CredentialNodeLabel,
|
|                IntermediateIdentityId,
|                IntermediateIdentity,
|                IntermediateIdentityType = IntermediateIdentityLabel,
|
|                FinalTargetId,
|                FinalTarget = FinalTargetName,
|                FinalTargetType = FinalTargetLabel,
|
|                CriticalityTier = TargetCriticalityTier,
|                CriticalityTierLevel = TargetCriticalityTierLevel,
|                TargetAssetTierByTag,
|                TargetIsInternetExposed,
|                TargetLegacyEndOfSupport,
|                TargetRiskProb,
|                TargetRiskProbDetailed,
|                TargetRiskProbDetailedScore,
|
|                IntermediateCriticalityTier,
|                IntermediateCriticalityTierLevel,
|                IntermediateIsInternetExposed,
|                IntermediateLegacyEndOfSupport,
|                IntermediateRiskProb,
|                IntermediateRiskProbDetailed,
|                IntermediateRiskProbDetailedScore,
|
|                Hop1Edge,
|                Hop2Edge,
|
|                AttackPath,
|                AttackPathDetailed,
|
|                IntermediateNodeProperties,
|                TargetNodeProperties,
|                CredentialNodeProperties;
|
|        // Step 11 Collapse to unique logical path
|        // Fixes applied
|        // - Collapse key uses source identity target triple but now uses stable IDs
|        // - Summary uses credential label set, impacted assets are GitHub sources
|        let CollapsedPaths =
|            DetailedEnriched
|            | extend PathKey = strcat(FirstGitHubSource, "->", IntermediateIdentityId, "->", FinalTargetId)
|            | extend SecurityDomain =
|                case(
|                    FinalTargetLabel in ("device","computer-account","microsoft.compute/virtualmachines"), "Endpoint",
|                    "Azure"
|                )
|            | extend
|                Category    = "Attack Paths",
|                SubCategory = "LateralMovement",
|                ConfigurationName = tostring(LateralMovementType),
|                SecuritySeverity  = tostring(AttackPathPriority),
|                RiskFactor_Consequence = 0
|            | summarize
|                AttackPathPriorityScore_Path = max(AttackPathPriorityScore),
|                AttackPathPriority_Path      = any(AttackPathPriority),
|
|                TargetCriticalityTier_Path      = any(TargetCriticalityTier),
|                TargetCriticalityTierLevel_Path = any(TargetCriticalityTierLevel),
|                TargetRiskProb_Path             = max(TargetRiskProb),
|
|                TargetRiskProbDetailed_Path      = any(TargetRiskProbDetailed),
|                TargetRiskProbDetailedScore_Path = any(TargetRiskProbDetailedScore),
|
|                // the FINAL TARGET's CMDB values (its CI)
|                cmdbId_Path              = any(cmdbId),
|                cmdbName_Path            = any(cmdbName),
|                cmdbCriticality_Path     = any(cmdbCriticality),
|                cmdbDataSensitivity_Path = any(cmdbDataSensitivity),
|
|                CredentialLabels_Path = make_set(tostring(CredentialNodeLabel)),
|                SourceAssets_Path     = make_set(tostring(FirstGitHubSourceName)),
|                // TargetAssets_Path is what AssetCount (dcount(FinalTargetId)) actually counts --
|                // the Azure resources under attack. ImpactedAssets below uses this so the
|                // asset-count and the asset-names match the same entity (targets).
|                TargetAssets_Path     = make_set(tostring(FinalTargetName)),
|                TotalIssues_Path      = count(),
|                TargetAssetId = any(TargetAssetId)
|              by
|                PathKey,
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                FinalTargetId;
|
|        // Step 12 Build main summary
|        // cmdbCriticality + cmdbDataSensitivity in by-clause so cmdb-bucketed rows survive
|        // (matches Summary pattern in Device_Missing_CVEs_Summary). SummaryDetail / SummaryDetailScore
|        // include them in their by-clauses too so the final left-outer joins line up.
|        let SummaryMain =
|            CollapsedPaths
|            | summarize
|                ConfigurationId = strcat_array(array_sort_asc(make_set(strcat_array(CredentialLabels_Path, ";"))), ";"),
|
|                SecuritySeverity = any(AttackPathPriority_Path),
|                CriticalityTier = toint(any(TargetCriticalityTier_Path)),
|                CriticalityTierLevel = tostring(any(TargetCriticalityTierLevel_Path)),
|
|                RiskFactor_Consequence = 0,
|                RiskFactor_Probability = max(TargetRiskProb_Path),
|
|                AssetCount   = dcount(FinalTargetId),
|                TotalIssues  = sum(TotalIssues_Path),
|
|                ImpactedAssets = strcat_array(array_sort_asc(make_set(strcat_array(TargetAssets_Path, ";"))), ";"),
|                ImpactedAssetPairs = make_set(strcat(strcat_array(TargetAssets_Path, ";"), "|", tostring(TargetAssetId)))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        // Step 13 Build probability detail summary
|        let SummaryDetail =
|            CollapsedPaths
|            | extend _d = split(tostring(TargetRiskProbDetailed_Path), ";")
|            | mv-expand _d to typeof(string)
|            | extend _d = trim(" ", _d)
|            | where isnotempty(_d)
|            | summarize
|                RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(make_set(_d)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        // Step 14 Build probability detail score summary
|        let SummaryDetailScore =
|            CollapsedPaths
|            | extend _s = split(tostring(TargetRiskProbDetailedScore_Path), ";")
|            | mv-expand _s to typeof(string)
|            | extend _s = trim(" ", _s)
|            | where isnotempty(_s)
|            | summarize
|                RiskFactor_Probability_DetailedScore = strcat_array(array_sort_asc(make_set(_s)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        // Step 15 Emit final collapsed output
|        SummaryMain
|        | join kind=leftouter SummaryDetail      on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        | join kind=leftouter SummaryDetailScore on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            SubCategory,
|            ConfigurationName,
|            ConfigurationId,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AssetCount,
|            TotalIssues,
|            ImpactedAssets, ImpactedAssetPairs
|        | order by
|            RiskScore_Weight_Factor desc,
|            RiskFactor_Probability desc,
|            CriticalityTier asc,
|            TotalIssues desc,
|            AssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, UniqueIssues, ImpactedAssetsList, ImpactedAssetIds, IssueList, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|
|    - ReportName: Attack_Paths_Detailed_Github_to_Azure_Resources
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|          | project __siNeeded = pack_array(TargetCiKey)
|      ReportPurpose: Per-row detail of credential-driven attack paths from GitHub to Azure targets, prioritized by FINAL TARGET business impact.
|        EG drives path detection + lateral-movement scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  Credential driven attack paths from GitHub to Azure using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify credentials stored in GitHub workflows or repositories and trace credential driven
|        // attack paths into Azure targets. Paths are prioritized by the business impact of the FINAL TARGET.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the TARGET criticality tier first
|        // - Then by tier escalation where source tier is higher than target tier
|        // - Then by Internet exposure where target exposure is weighted higher than source exposure
|        // - GitHub sources are treated as Internet exposed and low trust by default
|        // - A low tier source can never outrank a tier 0 or tier 1 target
|        //
|        // Output description
|        // One row per unique credential to target attack path enriched with
|        // - Internet exposure flags
|        // - Asset tier from tags
|        // - Legacy operating system and end of support signals
|        // - Risk factor probability including detailed breakdown
|        // - Attack path priority score and severity
|        // - Human readable attack path strings
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone
|        // Step 2  Normalize node labels to avoid filter issues
|        // Step 3  Identify credentials stored in GitHub workflows and repositories
|        // Step 4  Hop 1 credential authenticates as an identity
|        // Step 5  Hop 2 identity can reach Azure target resources
|        // Step 6  De duplicate attack paths to a stable grain
|        // Step 7  Enrich source and target nodes using Nodes catalog
|        // Step 8  Calculate tier escalation lateral movement and priority score
|        // Step 9  Build human readable AttackPath and AttackPathDetailed
|        // Step 10 Project final report columns and apply ordering
|        // =================================================================================================
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich attack paths (UPDATED to match your standard context)
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            // Criticality extraction from multiple possible fields
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(NodeProperties.rawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            // Internet exposure flag derived from graph property isCustomerFacing renamed
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    NodeProperties.rawData.isCustomerFacing,
|                    NodeProperties.raw.isCustomerFacing,
|                    false
|                ))
|
|            // Exclusion flag
|            | extend IsExcluded =
|                tobool(coalesce(
|                    NodeProperties.rawData.isExcluded,
|                    NodeProperties.raw.isExcluded,
|                    false
|                ))
|
|            // Normalize rawData and raw for tag and OS reading
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            // AssetTierByTag preferred bag key AssetTier fallback tag array scan
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            // Tag fallback mapping only used when Defender criticality is missing
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // Prefer Defender criticality over tag
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            // LegacyEndOfSupport detection same as CVE report
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            // Risk factors on nodes count distinct plus Internet-Exposed plus LegacyEoS
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    NodeProperties.rawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | mv-apply rf = array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                ) on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize ScoreParts = make_set(strcat(tostring(rf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                Categories        = CategoriesStr,
|                NodeProperties,
|                EgCriticalityLevel,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                EgNodeTags,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactorsArray,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|        // Step 2  Normalize labels to avoid typos breaking filters
|        let NormalizeLabel = (s:string) { tolower(trim(" ", replace_string(s, " ", ""))) };
|
|        // Step 3  Find credentials in GitHub workflows/repositories
|        let GitHubCredentials =
|            ExposureGraphEdges
|            | where EdgeLabel in ("contains", "defined in")
|            | extend SourceNodeLabelNorm = NormalizeLabel(SourceNodeLabel),
|                     TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where SourceNodeLabelNorm in ("githubworkflow", "githubrepository")
|            | where TargetNodeLabelNorm in (
|                "azure-active-directory-app-secret",
|                "user-azure-cli-secret",
|                "azure-storage-shared-access-signature",
|                "azure-storage-connection-string",
|                "azure-database-connection-string",
|                "azure-active-directory-user-credentials",
|                "service-principal-azure-cli-secret",
|                "azure-app-configuration-key"
|            )
|            | project
|                SourceGitHubNodeId    = SourceNodeId,
|                SourceGitHubNodeName  = SourceNodeName,
|                SourceGitHubNodeLabel = SourceNodeLabel,
|                CredentialNodeId      = TargetNodeId,
|                CredentialNodeName    = TargetNodeName,
|                CredentialNodeLabel   = TargetNodeLabel
|            | summarize
|                GitHubSources          = make_set(SourceGitHubNodeName),
|                GitHubSourceTypes      = make_set(SourceGitHubNodeLabel),
|                GitHubSourceCount      = dcount(SourceGitHubNodeId),
|                FirstGitHubSource      = any(SourceGitHubNodeId),
|                FirstGitHubSourceName  = any(SourceGitHubNodeName),
|                FirstGitHubSourceLabel = any(SourceGitHubNodeLabel),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by CredentialNodeId, CredentialNodeName, CredentialNodeLabel;
|
|        // v2.2.419 (audit #56.2b) -- hop-bounding sets. This variant expresses its hops as INLINE
|        // join subqueries rather than named lets, so the bounds are hoisted here to be referenced
|        // below. Without them each hop scanned every matching edge in the tenant, because a join
|        // constrains the RESULT and not the SCAN. Same defect and same lossless remedy as #56.
|        let _GhCredIds = GitHubCredentials | distinct CredentialNodeId;
|        let _GhHop1IdentityIds =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "can authenticate as", "can authenticate to")
|            | where SourceNodeId in (_GhCredIds)
|            | distinct TargetNodeId;
|
|        // Step 4  Main attack path query GitHub Credential -> Identity
|        GitHubCredentials
|        | join kind=inner (
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "can authenticate as", "can authenticate to")
|            // bound to the credentials found in Step 3 -- exactly what the ON clause below requires
|            | where SourceNodeId in (_GhCredIds)
|            | project
|                Hop1_SourceCredentialId = SourceNodeId,
|                Hop1_EdgeLabel          = EdgeLabel,
|                IntermediateIdentityId  = TargetNodeId,
|                IntermediateIdentity    = TargetNodeName,
|                IntermediateIdentityLabel = TargetNodeLabel
|        ) on $left.CredentialNodeId == $right.Hop1_SourceCredentialId
|
|        // Step 5  Hop 2 Identity -> Azure Target
|        | join kind=inner (
|            ExposureGraphEdges
|            | where EdgeLabel in ("can authenticate to", "has permissions to", "has role on")
|            // bound to the identities Hop 1 reached -- exactly what the ON clause below requires
|            | where SourceNodeId in (_GhHop1IdentityIds)
|            // #677 the slices are cut on the path's FINAL TARGET (TargetNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            | extend DeviceKey = TargetNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | extend TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where _SI_ViaScope or TargetNodeLabelNorm in (
|                "microsoft.compute/virtualmachines",
|                "microsoft.storage/storageaccounts",
|                "microsoft.keyvault/vaults",
|                "microsoft.sql/servers",
|                "microsoft.sql/servers/databases",
|                "microsoft.cognitiveservices/accounts",
|                "microsoft.cognitiveservices/accounts_openai",
|                "subscriptions",
|                "resourcegroups",
|                "blobcontainer"
|            )
|            | project
|                Hop2_SourceIdentityId = SourceNodeId,
|                Hop2_EdgeLabel        = EdgeLabel,
|                FinalTargetId         = TargetNodeId,
|                FinalTargetName       = TargetNodeName,
|                FinalTargetLabel      = TargetNodeLabel
|        ) on $left.IntermediateIdentityId == $right.Hop2_SourceIdentityId
|
|        // Optional avoid ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Â ÃƒÂ¢Ã¢â€šÂ¬Ã¢â€žÂ¢ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã¢â‚¬Â¦Ãƒâ€šÃ‚Â¡ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â‚¬Å¡Ã‚Â¬Ãƒâ€šÃ‚Â¦ÃƒÆ’Ã†â€™Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã¢â‚¬Â¦ÃƒÂ¢Ã¢â€šÂ¬Ã…â€œGitHub sourceÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Â ÃƒÂ¢Ã¢â€šÂ¬Ã¢â€žÂ¢ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã¢â‚¬Â¦Ãƒâ€šÃ‚Â¡ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â‚¬Å¡Ã‚Â¬Ãƒâ€¦Ã‚Â¡ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â == ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Â ÃƒÂ¢Ã¢â€šÂ¬Ã¢â€žÂ¢ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã¢â‚¬Â¦Ãƒâ€šÃ‚Â¡ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â‚¬Å¡Ã‚Â¬Ãƒâ€šÃ‚Â¦ÃƒÆ’Ã†â€™Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã¢â‚¬Â¦ÃƒÂ¢Ã¢â€šÂ¬Ã…â€œtarget assetÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Â ÃƒÂ¢Ã¢â€šÂ¬Ã¢â€žÂ¢ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã¢â‚¬Â¦Ãƒâ€šÃ‚Â¡ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â‚¬Å¡Ã‚Â¬Ãƒâ€¦Ã‚Â¡ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â scenarios (usually not needed but safe)
|        | where FirstGitHubSource != FinalTargetId
|
|        // Step 6  De-duplicate to stable grain
|        | summarize
|            GitHubSources          = any(GitHubSources),
|            GitHubSourceTypes      = any(GitHubSourceTypes),
|            GitHubSourceCount      = any(GitHubSourceCount),
|            FirstGitHubSource      = any(FirstGitHubSource),
|            FirstGitHubSourceName  = any(FirstGitHubSourceName),
|            FirstGitHubSourceLabel = any(FirstGitHubSourceLabel),
|
|            CredentialNodeName     = any(CredentialNodeName),
|            CredentialNodeLabel    = any(CredentialNodeLabel),
|
|            IntermediateIdentityId    = any(IntermediateIdentityId),
|            IntermediateIdentity      = any(IntermediateIdentity),
|            IntermediateIdentityLabel = any(IntermediateIdentityLabel),
|
|            Hop1Edge = any(Hop1_EdgeLabel),
|            Hop2Edge = any(Hop2_EdgeLabel),
|
|            FinalTargetName  = any(FinalTargetName),
|            FinalTargetLabel = any(FinalTargetLabel)
|          by CredentialNodeId, FinalTargetId
|
|        // Step 7  Enrich SOURCE + TARGET using Nodes (context-standard fields)
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                SourceNodeId                = NodeId,
|                SourceNodeCiKey = NodeCiKey,
|                SourceNodeName              = NodeName,
|                SourceNodeLabel             = NodeLabel,
|                SourceCriticalityTier       = CriticalityTier,
|                SourceCriticalityTierLevel  = CriticalityTierLevel,
|                SourceIsInternetExposed     = IsInternetExposed,
|                SourceIsExcluded            = IsExcluded,
|                SourceAssetTierByTag        = AssetTierByTag,
|                SourceLegacyEndOfSupport    = LegacyEndOfSupport,
|                SourceRiskProb              = RiskFactor_Probability,
|                SourceRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                SourceRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                SourceNodeProperties        = NodeProperties
|        ) on $left.FirstGitHubSource == $right.SourceNodeId
|
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                TargetNodeId                = NodeId,
|                TargetNodeCiKey = NodeCiKey,
|                TargetRiskFactorSet = RiskFactorSet,
|                TargetNodeName              = NodeName,
|                TargetNodeLabel             = NodeLabel,
|                TargetCriticalityTier       = CriticalityTier,
|                TargetCriticalityTierLevel  = CriticalityTierLevel,
|                TargetIsInternetExposed     = IsInternetExposed,
|                TargetIsExcluded            = IsExcluded,
|                TargetAssetTierByTag        = AssetTierByTag,
|                TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                TargetRiskProb              = RiskFactor_Probability,
|                TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                TargetNodeProperties        = NodeProperties
|        ) on $left.FinalTargetId == $right.TargetNodeId
|
|        // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|        // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|        // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|        // the keys its own rows have (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(si_in_scope_, true)
|        | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(FinalTargetId))
|        | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|        | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|        | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|        // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|        // Step 8  Apply your standard prioritization logic (GitHub treated as Internet-exposed / low trust)
|        | extend
|            // GitHub is internet-facing by default (override if Nodes is missing or false)
|            SourceIsInternetExposed = true,
|            // GitHub treated as low trust force source tier=3 if Nodes did not map it
|            SourceCriticalityTier   = toint(coalesce(SourceCriticalityTier, 3)),
|            SourceCriticalityTierLevel = tostring(coalesce(SourceCriticalityTierLevel, "Low - tier 3"))
|
|        // Tier escalation (only if source tier > target tier)
|        | extend TierEscalation =
|            case(
|                isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier,
|                    SourceCriticalityTier - TargetCriticalityTier,
|                0
|            )
|        | extend IsLateralMovement = TierEscalation > 0
|        | extend LateralMovementType =
|            case(
|                TierEscalation >= 3, "Privilege escalation large tier jump",
|                TierEscalation == 2, "Privilege escalation two tiers",
|                TierEscalation == 1, "Privilege escalation one tier",
|                "Direct access same tier"
|            )
|
|        // Standard AttackPathPriorityScore components
|        | extend TargetTierWeight =
|            case(
|                TargetCriticalityTier == 0, 100,
|                TargetCriticalityTier == 1, 60,
|                TargetCriticalityTier == 2, 30,
|                10
|            )
|        | extend EscalationWeight = TierEscalation * 10
|        | extend ExposureWeight   = iff(TargetIsInternetExposed == true, 8, 0) + iff(SourceIsInternetExposed == true, 3, 0)
|        | extend SourceTierAmplifier =
|            case(
|                SourceCriticalityTier == 0, 8,
|                SourceCriticalityTier == 1, 5,
|                SourceCriticalityTier == 2, 2,
|                0
|            )
|        | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|
|        | extend AttackPathPriority =
|            case(
|                AttackPathPriorityScore >= 90,  "Very High",
|                AttackPathPriorityScore >= 60,  "High",
|                AttackPathPriorityScore >= 30,  "Medium-High",
|                AttackPathPriorityScore >= 15,  "Medium",
|                "Low"
|            )
|
|        // Step 9  Human readable paths and Internet-Exposed wording
|        | extend InternetExposureTarget = iff(TargetIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|        | extend InternetExposureSource = iff(SourceIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|
|        | extend AttackPath =
|            strcat(
|                FirstGitHubSourceLabel, " [", FirstGitHubSourceName, "] -> ",
|                CredentialNodeLabel, " [", CredentialNodeName, "] -> ",
|                IntermediateIdentityLabel, " [", IntermediateIdentity, "] -> ",
|                FinalTargetLabel, " [", FinalTargetName, "]"
|            )
|
|        | extend AttackPathDetailed =
|            strcat(
|                "SOURCE ", FirstGitHubSourceLabel, " [", FirstGitHubSourceName, "] ",
|                "tier ", tostring(SourceCriticalityTier), " ", SourceCriticalityTierLevel, " | ", InternetExposureSource,
|                iff(GitHubSourceCount > 1, strcat(" | + ", tostring(GitHubSourceCount - 1), " other GitHub source(s)"), ""),
|                " -> CREDENTIAL ", CredentialNodeLabel, " [", CredentialNodeName, "] ",
|                " -> IDENTITY ", IntermediateIdentityLabel, " [", IntermediateIdentity, "] ",
|                " -> TARGET ", FinalTargetLabel, " [", FinalTargetName, "] ",
|                "tier ", tostring(TargetCriticalityTier), " ", TargetCriticalityTierLevel, " | ", InternetExposureTarget,
|                " | escalation ", tostring(TierEscalation),
|                " | ", LateralMovementType
|            )
|
|        // Final projection (keeps your original taxonomy fields but aligned to the context-standard logic)
|        | extend SecurityDomain = "Azure"
|        | extend Category = "AttackPath_GitHubToAzure"
|        | extend Subcategory =
|            case(
|                TierEscalation >= 3, strcat("GitHub to Tier ", tostring(TargetCriticalityTier), " - Critical Supply Chain Risk"),
|                TierEscalation >= 2, strcat("GitHub to Tier ", tostring(TargetCriticalityTier), " - High Supply Chain Risk"),
|                TierEscalation >= 1, strcat("GitHub to Tier ", tostring(TargetCriticalityTier), " - Moderate Supply Chain Risk"),
|                "GitHub to Azure - Direct Access"
|            )
|        // Per-row identity columns expected by engine dedup (AssetName, ConfigurationName/Id).
|        // ConfigurationId carries the FINAL TARGET id so (AssetName, ConfigurationId) is unique per row.
|        | extend
|            AssetName         = FinalTargetName,
|            AssetLabel        = FinalTargetLabel,
|            ConfigurationName = tostring(LateralMovementType),
|            ConfigurationId   = tostring(FinalTargetId),
|            SecuritySeverity  = tostring(AttackPathPriority),
|            Impact            = todouble(AttackPathPriorityScore),
|            CriticalityTier      = TargetCriticalityTier,
|            CriticalityTierLevel = TargetCriticalityTierLevel,
|            RiskFactor_Consequence = 0,
|            RiskFactor_Probability = TargetRiskProb,
|            RiskFactor_Probability_Detailed      = TargetRiskProbDetailed,
|            RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            Subcategory,
|            ConfigurationName,
|            ConfigurationId,
|            AssetName,
|            AssetId=coalesce(column_ifexists("AssetId", ""), column_ifexists("TargetAssetId", ""), column_ifexists("ConfigurationId", "")),
|            AssetType=coalesce(column_ifexists("AssetType", ""), column_ifexists("AssetLabel", ""), "Azure"),
|            Impact,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AttackPath,
|            AttackPathDetailed,
|            AttackPathPriority,
|            AttackPathPriorityScore,
|            TierEscalation,
|            IsLateralMovement,
|            LateralMovementType,
|            FirstGitHubSource,
|            FirstGitHubSourceName,
|            FirstGitHubSourceLabel,
|            TotalGitHubSourcesWithCredential = GitHubSourceCount,
|            AllGitHubSources = GitHubSources,
|            GitHubSourceTypes,
|            CredentialNodeId,
|            CredentialNodeName,
|            CredentialNodeLabel,
|            IntermediateIdentityId,
|            IntermediateIdentity,
|            IntermediateIdentityType = IntermediateIdentityLabel,
|            FinalTargetId,
|            FinalTarget = FinalTargetName,
|            FinalTargetType = FinalTargetLabel,
|            TargetAssetTierByTag,
|            TargetIsInternetExposed,
|            TargetLegacyEndOfSupport,
|            SourceAssetTierByTag,
|            SourceLegacyEndOfSupport,
|            Hop1Edge,
|            Hop2Edge,
|            SourceNodeProperties,
|            TargetNodeProperties
|        | order by RiskScore_Weight_Factor desc, AttackPathPriorityScore desc, TierEscalation desc, CriticalityTier asc, AssetName asc, ConfigurationId asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_Public_IP_to_VM_with_CVE_Exploitation
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(ExposedResourceNodeId)))
|          | project __siNeeded = pack_array(TargetCiKey)
|      ReportPurpose: Internet-exposed vulnerable assets prioritized by FINAL TARGET business impact.
|        EG provides the path detection (PublicIP -> ExposedResource <- CVE) + scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - UniqueIssues
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - IssueList
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "has_secret": "ClientSecret", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  Internet exposed assets with vulnerabilities using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify Azure and endpoint resources that are connected to Public IP addresses and are affected by CVEs.
|        // Each finding represents an internet reachable resource with at least one known vulnerability.
|        // Results are prioritized by the business impact of the exposed resource and by CVE severity signals.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the exposed TARGET resource criticality tier first
|        // - Internet exposure is implied by the presence of a Public IP connection
|        // - CVE severity increases priority as an additional amplifier
|        // - Target criticality tier comes from Defender criticality when present with tag fallback
|        // - RiskFactor probability is derived from graph risk factors plus Internet-Exposed plus LegacyEndOfSupport
|        //
|        // Output description detailed table
|        // One row per unique PublicIP -> ExposedResource -> CVE combination enriched with
|        // - Target criticality tier and tier label
|        // - Target Internet exposure flags and tag derived asset tier
|        // - Target legacy OS end of support signal
|        // - Target risk probability including detailed breakdown fields
|        // - CVE severity text and a numeric CVESeverityScore
|        // - Priority score and mapped severity label
|        // - Human readable AttackPath and AttackPathDetailed strings
|        //
|        // Output description collapsed summary
|        // One row per report grain grouped by SecurityDomain Category SubCategory ConfigurationName where
|        // - Duplicate paths are collapsed so repeated Public IPs or CVEs do not inflate counts
|        // - ConfigurationId becomes a semicolon list of distinct CVE names in the group
|        // - ImpactedAssets becomes a semicolon list of distinct exposed resources
|        // - RiskFactor_Probability_Detailed fields are preserved via split expand and re aggregation
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone
|        // Step 2  Normalize node labels to avoid filter issues
|        // Step 3  Identify Public IP connections to resources
|        // Step 4  Identify CVEs affecting resources
|        // Step 5  Join Public IP connections with CVE affected resources and de duplicate to stable grain
|        // Step 6  Enrich exposed resource using Nodes and enrich CVE node for severity text
|        // Step 7  Compute CVE severity score and target tier weighted priority score
|        // Step 8  Create AttackPath and AttackPathDetailed strings and project detailed output table
|        // Step 9  Create DetailedForSummary table with only required columns for collapsing
|        // Step 10 Collapse to unique logical PathKey to prevent count inflation
|        // Step 11 Build SummaryMain counts and key fields
|        // Step 12 Re build RiskFactor_Probability_Detailed and DetailedScore via split expand and re aggregation
|        // Step 13 Join summary parts and output final collapsed summary ordering
|        // =================================================================================================
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "exploit_available", "exploit_kit", "has_secret", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "multitenant_app", "network_no_user_action", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "publisher_not_verified", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "exploit_available", "exploit_kit", "has_secret", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "multitenant_app", "network_no_user_action", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "publisher_not_verified", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "has_secret": "ClientSecret", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich attack paths
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|
|            | extend AssetName = NodeNameNorm
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(NodeProperties.rawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    NodeProperties.rawData.isCustomerFacing,
|                    NodeProperties.raw.isCustomerFacing,
|                    false
|                ))
|
|            | extend IsExcluded =
|                tobool(coalesce(
|                    NodeProperties.rawData.isExcluded,
|                    NodeProperties.raw.isExcluded,
|                    false
|                ))
|
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    NodeProperties.rawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | mv-apply rf = array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                ) on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize ScoreParts = make_set(strcat(tostring(rf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            // CVESeverity only makes sense for CVE nodes but keeping it for compatibility
|            | extend CVESeverity =
|                tostring(coalesce(
|                    NodeProperties.rawData.severity,
|                    NodeProperties.rawData.Severity,
|                    NodeProperties.rawData.cvssScore,
|                    ""
|                ))
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                Categories        = CategoriesStr,
|                NodeProperties,
|                EgCriticalityLevel,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                EgNodeTags,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactorsArray,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence,
|                CVESeverity;
|
|        // Step 2  Normalize labels to avoid typos breaking filters
|        let NormalizeLabel = (s:string) { tolower(trim(" ", replace_string(s, " ", ""))) };
|
|        // Step 3  Find Public IPs connected to resources
|        // Fixes applied
|        // - Public IP edges can point in either direction, include both directions (union)
|        // - Include NIC pivot without losing VM mapping (keep NIC as an exposed resource too)
|        // - The graph's routing nodes are labelled "IP address" (an Azure public IP resource is
|        //   microsoft.network/publicipaddresses) -- both, compared ignoring case
|        // - A network interface the address routes to is followed one hop to its machine, and the machine is tied to the
|        //   graph node of the same name that carries its CVEs (a virtual-machine node and a node with the Defender device id)
|        let PublicIPConnections_Forward =
|            ExposureGraphEdges
|            | where SourceNodeLabel in~ ("microsoft.network/publicipaddresses", "IP address")
|            | where EdgeLabel in~ ("routes traffic to", "contains", "connected to", "assigned to")
|            | project
|                PublicIPNodeId           = SourceNodeId,
|                PublicIPNodeName         = SourceNodeName,
|                ExposedResourceNodeId    = TargetNodeId,
|                ExposedResourceNodeName  = TargetNodeName,
|                ExposedResourceNodeLabel = TargetNodeLabel;
|
|        let PublicIPConnections_Reverse =
|            ExposureGraphEdges
|            | where TargetNodeLabel in~ ("microsoft.network/publicipaddresses", "IP address")
|            | where EdgeLabel in~ ("routes traffic to", "contains", "connected to", "assigned to")
|            | project
|                PublicIPNodeId           = TargetNodeId,
|                PublicIPNodeName         = TargetNodeName,
|                ExposedResourceNodeId    = SourceNodeId,
|                ExposedResourceNodeName  = SourceNodeName,
|                ExposedResourceNodeLabel = SourceNodeLabel;
|
|        let _PublicIpDirect = union isfuzzy=true PublicIPConnections_Forward, PublicIPConnections_Reverse;
|        let _NicToMachine =
|            ExposureGraphEdges
|            | where SourceNodeLabel =~ "microsoft.network/networkinterfaces"
|            | where EdgeLabel =~ "routes traffic to"
|            | where NormalizeLabel(TargetNodeLabel) in ("microsoft.compute/virtualmachines", "device")
|            | project NicNodeId = SourceNodeId, MachineNodeId = TargetNodeId, MachineNodeName = TargetNodeName, MachineNodeLabel = TargetNodeLabel;
|        let _PublicIpMachines =
|            union
|                (_PublicIpDirect | project PublicIPNodeId, PublicIPNodeName, MachineNodeId = ExposedResourceNodeId, MachineNodeName = ExposedResourceNodeName, MachineNodeLabel = ExposedResourceNodeLabel),
|                (_PublicIpDirect | join kind=inner (_NicToMachine) on $left.ExposedResourceNodeId == $right.NicNodeId | project PublicIPNodeId, PublicIPNodeName, MachineNodeId, MachineNodeName, MachineNodeLabel);
|        let _CveCarrierNodes =
|            ExposureGraphEdges
|            | where SourceNodeLabel =~ "Cve"
|            | where EdgeLabel =~ "affecting"
|            | where NormalizeLabel(TargetNodeLabel) in ("microsoft.compute/virtualmachines", "device")
|            | project CarrierNodeId = TargetNodeId, CarrierNodeName = TargetNodeName, CarrierNodeLabel = TargetNodeLabel
|            | distinct CarrierNodeId, CarrierNodeName, CarrierNodeLabel
|            | extend _carrierName = tolower(CarrierNodeName)
|            | where isnotempty(_carrierName);
|        let _PublicIpExposed =
|            union
|                (_PublicIpMachines | project PublicIPNodeId, PublicIPNodeName, ExposedResourceNodeId = MachineNodeId, ExposedResourceNodeName = MachineNodeName, ExposedResourceNodeLabel = MachineNodeLabel),
|                (_PublicIpMachines
|                    | where NormalizeLabel(MachineNodeLabel) in ("microsoft.compute/virtualmachines", "device")
|                    | extend _machineName = tolower(MachineNodeName)
|                    | join kind=inner (_CveCarrierNodes) on $left._machineName == $right._carrierName
|                    | where CarrierNodeId != MachineNodeId
|                    | project PublicIPNodeId, PublicIPNodeName, ExposedResourceNodeId = CarrierNodeId, ExposedResourceNodeName = CarrierNodeName, ExposedResourceNodeLabel = CarrierNodeLabel);
|
|        let PublicIPConnections =
|            _PublicIpExposed
|            | extend ExposedLabelNorm = NormalizeLabel(ExposedResourceNodeLabel)
|            | where ExposedLabelNorm in (
|                "microsoft.network/networkinterfaces",
|                "microsoft.compute/virtualmachines",
|                "device",
|                "computer-account"
|            )
|            | summarize
|                PublicIPs         = make_set(PublicIPNodeName),
|                PublicIPCount     = dcount(PublicIPNodeId),
|                FirstPublicIPId   = any(PublicIPNodeId),
|                FirstPublicIPName = any(PublicIPNodeName),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by ExposedResourceNodeId, ExposedResourceNodeName, ExposedResourceNodeLabel
|            // #677 the slices are cut on the path's FINAL TARGET (ExposedResourceNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            | extend DeviceKey = ExposedResourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | project-away DeviceKey;
|
|        // Step 3b  The CVEs in scope -- the customer CVE filters (SI_CVE_MinSeverity / MinCvssScore / RequireExploit /
|        // MaxPublishedAgeDays, substituted by the engine) and the report exclusions (excluded CVEs, minimum age)
|        let _ScopedCveNodeIds =
|            ExposureGraphNodes
|            | where NodeLabel =~ "Cve" or NodeLabel startswith "cve"
|              //__CVE_FILTER_BEGIN__
|              | where 1 == 1
|              //__CVE_FILTER_END__
|            | where SI_InScopeCve(NodeName, todatetime(coalesce(NodeProperties.rawData.lastModifiedDate, NodeProperties.raw.lastModifiedDate)))
|            | distinct NodeId;
|
|        // Step 4  Find CVEs affecting resources
|        // Fixes applied
|        // - CVE edges can point either direction depending on graph shape, include both directions
|        let CVEsAffectingResources_Forward =
|            ExposureGraphEdges
|            | where SourceNodeLabel == "Cve"
|            | where EdgeLabel == "affecting"
|            | project
|                CVENodeId                 = SourceNodeId,
|                CVENodeName               = SourceNodeName,
|                AffectedResourceNodeId    = TargetNodeId,
|                AffectedResourceNodeName  = TargetNodeName,
|                AffectedResourceNodeLabel = TargetNodeLabel;
|
|        let CVEsAffectingResources_Reverse =
|            ExposureGraphEdges
|            | where TargetNodeLabel == "Cve"
|            | where EdgeLabel == "affecting"
|            | project
|                CVENodeId                 = TargetNodeId,
|                CVENodeName               = TargetNodeName,
|                AffectedResourceNodeId    = SourceNodeId,
|                AffectedResourceNodeName  = SourceNodeName,
|                AffectedResourceNodeLabel = SourceNodeLabel;
|
|        let CVEsAffectingResources =
|            union isfuzzy=true CVEsAffectingResources_Forward, CVEsAffectingResources_Reverse
|            | where CVENodeId in (_ScopedCveNodeIds)
|            | extend TargetNodeLabelNorm = NormalizeLabel(AffectedResourceNodeLabel)
|            | where TargetNodeLabelNorm in (
|                "microsoft.compute/virtualmachines",
|                "device",
|                "computer-account",
|                "microsoft.network/networkinterfaces"
|            )
|            | summarize
|                CVEs         = make_set(CVENodeName),
|                CVECount     = dcount(CVENodeId),
|                FirstCVEId   = any(CVENodeId),
|                FirstCVEName = any(CVENodeName),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by AffectedResourceNodeId, AffectedResourceNodeName, AffectedResourceNodeLabel;
|
|        // Step 5  Join Public IP connections with CVE affected resources and de duplicate to stable grain
|        // Fixes applied
|        // - Original summarize grouped by ExposedResourceNodeId but also by FirstPublicIPId and FirstCVEId
|        //   which are aggregated values and can create unstable grains
|        // - Stable grain should be (PublicIPNodeId, ExposedResourceNodeId, CVENodeId)
|        let Paths =
|            PublicIPConnections
|            | join kind=inner (CVEsAffectingResources) on $left.ExposedResourceNodeId == $right.AffectedResourceNodeId
|            | extend PublicIPNodeId = FirstPublicIPId
|            | extend CVENodeId      = FirstCVEId
|            | summarize
|                PublicIPs               = any(PublicIPs),
|                PublicIPCount           = any(PublicIPCount),
|                FirstPublicIPName       = any(FirstPublicIPName),
|
|                CVEs                    = any(CVEs),
|                CVECount                = any(CVECount),
|                FirstCVEName            = any(FirstCVEName),
|
|                ExposedResourceNodeName  = any(ExposedResourceNodeName),
|                ExposedResourceNodeLabel = any(ExposedResourceNodeLabel)
|              by
|                PublicIPNodeId,
|                ExposedResourceNodeId,
|                CVENodeId;
|
|        // Step 6  Enrich exposed resource using Nodes and enrich CVE node for severity text
|        // Step 7  Compute CVE severity score and target tier weighted priority score
|        // Step 8  Create AttackPath and AttackPathDetailed strings and project detailed output table
|        let Detailed =
|            Paths
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    TargetNodeId                = NodeId,
|                    TargetNodeCiKey = NodeCiKey,
|                    TargetRiskFactorSet = RiskFactorSet,
|                    TargetNodeName              = NodeName,
|                    TargetNodeLabel             = NodeLabel,
|                    TargetCriticalityTier       = CriticalityTier,
|                    TargetCriticalityTierLevel  = CriticalityTierLevel,
|                    TargetCriticalityRuleBased  = CriticalityRuleBased,
|                    TargetCriticalityRuleNames  = EgCriticalityRuleNames,
|                    TargetIsInternetExposed     = IsInternetExposed,
|                    TargetIsExcluded            = IsExcluded,
|                    TargetAssetTierByTag        = AssetTierByTag,
|                    TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                    TargetRiskProb              = RiskFactor_Probability,
|                    TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                    TargetNodeProperties        = NodeProperties
|            ) on $left.ExposedResourceNodeId == $right.TargetNodeId
|
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    PublicIPNodeId_join    = NodeId,
|                    PublicIPNodeName_join  = NodeName,
|                    PublicIPNodeProperties = NodeProperties
|            ) on $left.PublicIPNodeId == $right.PublicIPNodeId_join
|
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    CVENodeId_join     = NodeId,
|                    CVENodeName_join   = NodeName,
|                    CVESeverity_join   = CVESeverity,
|                    CVENodeProperties  = NodeProperties
|            ) on $left.CVENodeId == $right.CVENodeId_join
|
|            // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|            // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|            | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|            // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|            // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|            // the keys its own rows have (the report field LookupNeededKeys).
|            //__SI_LOOKUP_KEYS_HERE__
|            | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(ExposedResourceNodeId)))
|            | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|            | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                     si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|            | project-away _peerKey, peer_*
|            | where coalesce(si_in_scope_, true)
|            | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(ExposedResourceNodeId))
|            | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|            | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|            // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|            | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|            | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|            | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|            | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|            | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|            | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|            | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|            | project-away _tgtRf, _tgtScore
|            | extend
|                cmdbId            = si_cmdb_id,
|                cmdbName            = si_cmdb_name,
|                cmdbCriticality     = si_cmdb_criticality,
|                cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|            | extend CVESev = tostring(coalesce(CVESeverity_join, ""))
|
|            | extend CVESeverityScore =
|                case(
|                    tolower(CVESev) has "critical", 5,
|                    tolower(CVESev) has "high",     4,
|                    tolower(CVESev) has "medium",   3,
|                    tolower(CVESev) has "low",      2,
|                    1
|                )
|
|            | extend TargetTierWeight =
|                case(
|                    TargetCriticalityTier == 0, 100,
|                    TargetCriticalityTier == 1, 60,
|                    TargetCriticalityTier == 2, 30,
|                    10
|                )
|
|            // Internet exposure is implied by Public IP connection
|            | extend ExposureWeight = 8
|
|            | extend AttackPathPriorityScore = TargetTierWeight + ExposureWeight + (CVESeverityScore * 2)
|
|            | extend AttackPathPriority =
|                case(
|                    AttackPathPriorityScore >= 90,  "Very High",
|                    AttackPathPriorityScore >= 60,  "High",
|                    AttackPathPriorityScore >= 30,  "Medium-High",
|                    AttackPathPriorityScore >= 15,  "Medium",
|                    "Low"
|                )
|
|            | extend AttackPath =
|                strcat(
|                    "PublicIP [", PublicIPNodeName_join, "] -> ",
|                    ExposedResourceNodeLabel, " [", ExposedResourceNodeName, "] <- ",
|                    "CVE [", FirstCVEName, "]"
|                )
|
|            | extend AttackPathDetailed =
|                strcat(
|                    "PUBLICIP [", PublicIPNodeName_join, "] ",
|                    " -> TARGET ", ExposedResourceNodeLabel, " [", ExposedResourceNodeName, "] ",
|                    "tier ", tostring(TargetCriticalityTier), " ", tostring(TargetCriticalityTierLevel),
|                    " | CVE [", FirstCVEName, "]",
|                    " | CVESeverity ", CVESev
|                )
|
|            | extend SecurityDomain = "Azure"
|            | extend Category = "Attack Paths"
|            | extend SubCategory = "InternetExposedVulnerability"
|            | extend ConfigurationName = "PublicIPWithCVE"
|            | extend ConfigurationId = tostring(FirstCVEName)
|            | extend SecuritySeverity = AttackPathPriority
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | project
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                ConfigurationId,
|
|                SecuritySeverity,
|                AttackPathPriorityScore,
|
|                ExposedResourceNodeId,
|                ExposedResourceNodeName,
|                ExposedResourceNodeLabel,
|
|                TargetCriticalityTier,
|                TargetCriticalityTierLevel,
|                TargetCriticalityRuleBased,
|                TargetCriticalityRuleNames,
|
|                TargetAssetTierByTag,
|                TargetLegacyEndOfSupport,
|                TargetRiskProb,
|                TargetRiskProbDetailed,
|                TargetRiskProbDetailedScore,
|
|                PublicIPNodeId,
|                PublicIPName = PublicIPNodeName_join,
|
|                CVENodeId,
|                CVEName = FirstCVEName,
|                CVESev,
|                CVESeverityScore,
|
|                AttackPath,
|                AttackPathDetailed,
|
|                TargetNodeProperties,
|                PublicIPNodeProperties,
|                CVENodeProperties,
|
|                cmdbId,
|                cmdbName,
|                cmdbCriticality,
|                cmdbDataSensitivity,
|                TargetAssetId;
|
|        // ===================== COLLAPSED SUMMARY VERSION (FINAL OUTPUT) =====================
|
|        // Step 9  Create DetailedForSummary table with only required columns for collapsing
|        let DetailedForSummary =
|            Detailed
|            | project
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|
|                ExposedResourceNodeId,
|                ExposedResourceNodeName,
|
|                TargetCriticalityTier,
|                TargetCriticalityTierLevel,
|                TargetRiskProb,
|                TargetRiskProbDetailed,
|                TargetRiskProbDetailedScore,
|
|                cmdbId,
|                cmdbName,
|                cmdbCriticality,
|                cmdbDataSensitivity,
|
|                AttackPathPriorityScore,
|                SecuritySeverity,
|
|                PublicIPNodeId,
|                PublicIPName,
|                CVENodeId,
|                CVEName,
|                TargetAssetId;
|
|        // Step 10 Collapse to unique logical PathKey to prevent count inflation
|        // Fixes applied
|        // - Use the true IDs for uniqueness instead of aggregated First* fields
|        let CollapsedPaths =
|            DetailedForSummary
|            | extend PathKey = strcat(PublicIPNodeId, "->", ExposedResourceNodeId, "->", CVENodeId)
|            | summarize
|                AttackPathPriorityScore_Path = max(AttackPathPriorityScore),
|                SecuritySeverity_Path        = any(SecuritySeverity),
|
|                TargetCriticalityTier_Path      = any(TargetCriticalityTier),
|                TargetCriticalityTierLevel_Path = any(TargetCriticalityTierLevel),
|                TargetRiskProb_Path             = max(TargetRiskProb),
|
|                TargetRiskProbDetailed_Path      = any(TargetRiskProbDetailed),
|                TargetRiskProbDetailedScore_Path = any(TargetRiskProbDetailedScore),
|
|                // the FINAL TARGET's CMDB values (its CI)
|                cmdbId_Path              = any(cmdbId),
|                cmdbName_Path            = any(cmdbName),
|                cmdbCriticality_Path     = any(cmdbCriticality),
|                cmdbDataSensitivity_Path = any(cmdbDataSensitivity),
|
|                CVEs_Path       = make_set(tostring(CVEName)),
|                PublicIPs_Path  = make_set(tostring(PublicIPName)),
|
|                SourceAssets_Path = make_set(tostring(ExposedResourceNodeName)),
|                TotalIssues_Path  = count(),
|                TargetAssetId = any(TargetAssetId)
|              by
|                PathKey,
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                ExposedResourceNodeId;
|
|        // Step 11 Build SummaryMain counts and key fields
|        // cmdbCriticality + cmdbDataSensitivity in by-clause so cmdb-bucketed rows survive.
|        let SummaryMain =
|            CollapsedPaths
|            | summarize
|                ConfigurationId = strcat_array(array_sort_asc(make_set(strcat_array(CVEs_Path, ";"))), ";"),
|
|                SecuritySeverity = any(SecuritySeverity_Path),
|                CriticalityTier = toint(any(TargetCriticalityTier_Path)),
|                CriticalityTierLevel = tostring(any(TargetCriticalityTierLevel_Path)),
|
|                RiskFactor_Consequence = 0,
|                RiskFactor_Probability = max(TargetRiskProb_Path),
|
|                AssetCount   = dcount(ExposedResourceNodeId),
|                TotalIssues  = sum(TotalIssues_Path),
|
|                ImpactedAssets = strcat_array(array_sort_asc(make_set(strcat_array(SourceAssets_Path, ";"))), ";"),
|                ImpactedAssetPairs = make_set(strcat(strcat_array(SourceAssets_Path, ";"), "|", tostring(TargetAssetId)))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        // Step 12 Re build RiskFactor_Probability_Detailed and DetailedScore via split expand and re aggregation
|        let SummaryDetail =
|            CollapsedPaths
|            | extend _d = split(tostring(TargetRiskProbDetailed_Path), ";")
|            | mv-expand _d to typeof(string)
|            | extend _d = trim(" ", _d)
|            | where isnotempty(_d)
|            | summarize
|                RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(make_set(_d)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        let SummaryDetailScore =
|            CollapsedPaths
|            | extend _s = split(tostring(TargetRiskProbDetailedScore_Path), ";")
|            | mv-expand _s to typeof(string)
|            | extend _s = trim(" ", _s)
|            | where isnotempty(_s)
|            | summarize
|                RiskFactor_Probability_DetailedScore = strcat_array(array_sort_asc(make_set(_s)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        // Step 13 Join summary parts and output final collapsed summary ordering
|        SummaryMain
|        | join kind=leftouter SummaryDetail      on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        | join kind=leftouter SummaryDetailScore on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            SubCategory,
|            ConfigurationName,
|            ConfigurationId,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AssetCount,
|            TotalIssues,
|            ImpactedAssets, ImpactedAssetPairs
|        | order by
|            RiskScore_Weight_Factor desc,
|            RiskFactor_Probability desc,
|            CriticalityTier asc,
|            TotalIssues desc,
|            AssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, UniqueIssues, ImpactedAssetsList, ImpactedAssetIds, IssueList, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|
|    - ReportName: Attack_Paths_Detailed_Public_IP_to_VM_with_CVE_Exploitation
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(ExposedResourceNodeId)))
|          | project __siNeeded = pack_array(TargetCiKey)
|      ReportPurpose: Per-row detail of internet-exposed vulnerable assets prioritized by FINAL TARGET business impact.
|        EG drives path detection (PublicIP -> ExposedResource <- CVE) + scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "has_secret": "ClientSecret", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // REPORT  Internet exposed assets with vulnerabilities using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify resources that are reachable from a Public IP and have CVEs affecting them.
|        // Results are prioritized by the business impact of the exposed resource.
|        // Uses the same enrichment backbone as your credential driven attack path reports.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the EXPOSED RESOURCE criticality tier first
|        // - Internet exposure is explicit because a Public IP is the entry point
|        // - Legacy end of support and risk factors increase probability scoring
|        // - CVE severity is included as supporting signal not the primary driver
|        //
|        // Output description
|        // One row per exposed resource with at least one Public IP connection and at least one CVE
|        // Includes enrichment fields
|        // - IsInternetExposed
|        // - AssetTierByTag
|        // - LegacyEndOfSupport
|        // - RiskFactor_Probability and detailed breakdown
|        // - AttackPathPriorityScore and severity
|        // - Human readable AttackPath strings
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone
|        // Step 2  Normalize node labels to avoid filter issues
|        // Step 3  Find Public IP connections to resources
|        // Step 4  Find CVEs affecting resources
|        // Step 5  Join Public IP connections with CVEs and de duplicate
|        // Step 6  Enrich exposed resource and CVE using Nodes
|        // Step 7  Compute CVE severity score and attack path priority score
|        // Step 8  Build AttackPath and AttackPathDetailed
|        // Step 9  Project final columns and apply ordering
|        // =================================================================================================
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "exploit_available", "exploit_kit", "has_secret", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "multitenant_app", "network_no_user_action", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "publisher_not_verified", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "exploit_available", "exploit_kit", "has_secret", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "multitenant_app", "network_no_user_action", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "publisher_not_verified", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "has_secret": "ClientSecret", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich results (context standard)
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(NodeProperties.rawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    NodeProperties.rawData.isCustomerFacing,
|                    NodeProperties.raw.isCustomerFacing,
|                    false
|                ))
|
|            | extend IsExcluded =
|                tobool(coalesce(
|                    NodeProperties.rawData.isExcluded,
|                    NodeProperties.raw.isExcluded,
|                    false
|                ))
|
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    NodeProperties.rawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | mv-apply rf = array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                ) on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize ScoreParts = make_set(strcat(tostring(rf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            | extend CVESeverity =
|                tostring(coalesce(
|                    NodeProperties.rawData.severity,
|                    NodeProperties.rawData.Severity,
|                    NodeProperties.rawData.cvssScore,
|                    ""
|                ))
|
|            | extend IsEntryPoint =
|                        (CategoriesStr has "ip_address")
|                     or (CategoriesStr has "device")
|                     or (CategoriesStr has "virtual_machine")
|                     or (CategoriesStr has "computer"),
|                     IsAzureResource =
|                        (CategoriesStr has "environmentazure")
|                     or (CategoriesStr has "environmentcloud")
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                Categories        = CategoriesStr,
|                NodeProperties,
|                EgCriticalityLevel,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                EgNodeTags,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactorsArray,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence,
|                CVESeverity,
|                IsEntryPoint,
|                IsAzureResource;
|
|        // Step 2  Helper to avoid label typos or spaces
|        let NormalizeLabel = (s:string) { tolower(trim(" ", replace_string(s, " ", ""))) };
|
|        // Step 3  Find Public IPs connected to resources
|        // The graph's routing nodes are labelled "IP address" (an Azure public IP resource is
|        // microsoft.network/publicipaddresses) -- both, compared ignoring case. A network interface the address routes
|        // to is followed one hop to its machine, and the machine is tied to the graph node of the same name that carries
|        // its CVEs (one machine can have a virtual-machine node and a node with the Defender device id).
|        let _PublicIpHop =
|            ExposureGraphEdges
|            | where SourceNodeLabel in~ ("microsoft.network/publicipaddresses", "IP address")
|            | where EdgeLabel in~ ("routes traffic to", "contains")
|            | project PublicIPNodeId = SourceNodeId, PublicIPNodeName = SourceNodeName, HopNodeId = TargetNodeId, HopNodeName = TargetNodeName, HopNodeLabel = TargetNodeLabel;
|        let _NicToMachine =
|            ExposureGraphEdges
|            | where SourceNodeLabel =~ "microsoft.network/networkinterfaces"
|            | where EdgeLabel =~ "routes traffic to"
|            | where NormalizeLabel(TargetNodeLabel) in ("microsoft.compute/virtualmachines", "device")
|            | project NicNodeId = SourceNodeId, MachineNodeId = TargetNodeId, MachineNodeName = TargetNodeName, MachineNodeLabel = TargetNodeLabel;
|        let _PublicIpMachines =
|            union
|                (_PublicIpHop | project PublicIPNodeId, PublicIPNodeName, MachineNodeId = HopNodeId, MachineNodeName = HopNodeName, MachineNodeLabel = HopNodeLabel),
|                (_PublicIpHop | join kind=inner (_NicToMachine) on $left.HopNodeId == $right.NicNodeId | project PublicIPNodeId, PublicIPNodeName, MachineNodeId, MachineNodeName, MachineNodeLabel);
|        let _CveCarrierNodes =
|            ExposureGraphEdges
|            | where SourceNodeLabel =~ "Cve"
|            | where EdgeLabel =~ "affecting"
|            | where NormalizeLabel(TargetNodeLabel) in ("microsoft.compute/virtualmachines", "device")
|            | project CarrierNodeId = TargetNodeId, CarrierNodeName = TargetNodeName, CarrierNodeLabel = TargetNodeLabel
|            | distinct CarrierNodeId, CarrierNodeName, CarrierNodeLabel
|            | extend _carrierName = tolower(CarrierNodeName)
|            | where isnotempty(_carrierName);
|        let _PublicIpExposed =
|            union
|                (_PublicIpMachines | project PublicIPNodeId, PublicIPNodeName, ExposedResourceNodeId = MachineNodeId, ExposedResourceNodeName = MachineNodeName, ExposedResourceNodeLabel = MachineNodeLabel),
|                (_PublicIpMachines
|                    | where NormalizeLabel(MachineNodeLabel) in ("microsoft.compute/virtualmachines", "device")
|                    | extend _machineName = tolower(MachineNodeName)
|                    | join kind=inner (_CveCarrierNodes) on $left._machineName == $right._carrierName
|                    | where CarrierNodeId != MachineNodeId
|                    | project PublicIPNodeId, PublicIPNodeName, ExposedResourceNodeId = CarrierNodeId, ExposedResourceNodeName = CarrierNodeName, ExposedResourceNodeLabel = CarrierNodeLabel);
|        let PublicIPConnections =
|            _PublicIpExposed
|            | where NormalizeLabel(ExposedResourceNodeLabel) in (
|                "microsoft.network/networkinterfaces",
|                "microsoft.compute/virtualmachines",
|                "device"
|            )
|            | summarize
|                PublicIPs         = make_set(PublicIPNodeName),
|                PublicIPCount     = dcount(PublicIPNodeId),
|                FirstPublicIP     = any(PublicIPNodeId),
|                FirstPublicIPName = any(PublicIPNodeName),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by ExposedResourceNodeId, ExposedResourceNodeName, ExposedResourceNodeLabel
|            // #677 the slices are cut on the path's FINAL TARGET (ExposedResourceNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            | extend DeviceKey = ExposedResourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | project-away DeviceKey;
|
|        // Step 3b  The CVEs in scope -- the customer CVE filters (SI_CVE_MinSeverity / MinCvssScore / RequireExploit /
|        // MaxPublishedAgeDays, substituted by the engine) and the report exclusions (excluded CVEs, minimum age)
|        let _ScopedCveNodeIds =
|            ExposureGraphNodes
|            | where NodeLabel =~ "Cve" or NodeLabel startswith "cve"
|              //__CVE_FILTER_BEGIN__
|              | where 1 == 1
|              //__CVE_FILTER_END__
|            | where SI_InScopeCve(NodeName, todatetime(coalesce(NodeProperties.rawData.lastModifiedDate, NodeProperties.raw.lastModifiedDate)))
|            | distinct NodeId;
|
|        // Step 4  Find CVEs affecting resources
|        let CVEsAffectingResources =
|            ExposureGraphEdges
|            | where SourceNodeLabel == "Cve"
|            | where SourceNodeId in (_ScopedCveNodeIds)
|            | where EdgeLabel == "affecting"
|            | extend TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where TargetNodeLabelNorm in (
|                "microsoft.compute/virtualmachines",
|                "device",
|                "computer-account"
|            )
|            | project
|                CVENodeId                  = SourceNodeId,
|                CVENodeName                = SourceNodeName,
|                AffectedResourceNodeId     = TargetNodeId,
|                AffectedResourceNodeName   = TargetNodeName,
|                AffectedResourceNodeLabel  = TargetNodeLabel
|            | summarize
|                CVEs         = make_set(CVENodeName),
|                CVECount     = dcount(CVENodeId),
|                FirstCVE     = any(CVENodeId),
|                FirstCVEName = any(CVENodeName),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by AffectedResourceNodeId, AffectedResourceNodeName, AffectedResourceNodeLabel;
|
|        // Step 5  Join Public IPs with CVEs and de duplicate
|        PublicIPConnections
|        | join kind=inner CVEsAffectingResources on $left.ExposedResourceNodeId == $right.AffectedResourceNodeId
|        | summarize
|            PublicIPs         = any(PublicIPs),
|            PublicIPCount     = any(PublicIPCount),
|            FirstPublicIPName = any(FirstPublicIPName),
|
|            CVEs              = any(CVEs),
|            CVECount          = any(CVECount),
|            FirstCVEName      = any(FirstCVEName),
|            FirstCVE          = any(FirstCVE)
|          by ExposedResourceNodeId, ExposedResourceNodeName, ExposedResourceNodeLabel
|
|        // Step 6  Enrich exposed resource and CVE using Nodes
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                TargetNodeId                = NodeId,
|                TargetNodeCiKey = NodeCiKey,
|                TargetRiskFactorSet = RiskFactorSet,
|                TargetNodeName              = NodeName,
|                TargetNodeLabel             = NodeLabel,
|                TargetCriticalityTier       = CriticalityTier,
|                TargetCriticalityTierLevel  = CriticalityTierLevel,
|                TargetCriticalityRuleBased  = CriticalityRuleBased,
|                TargetCriticalityRuleNames  = EgCriticalityRuleNames,
|                TargetIsInternetExposed     = IsInternetExposed,
|                TargetIsExcluded            = IsExcluded,
|                TargetAssetTierByTag        = AssetTierByTag,
|                TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                TargetRiskProb              = RiskFactor_Probability,
|                TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                TargetNodeProperties        = NodeProperties
|        ) on $left.ExposedResourceNodeId == $right.TargetNodeId
|
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                CVENodeId_join      = NodeId,
|                CVENodeName_join    = NodeName,
|                CVESeverity_join    = CVESeverity,
|                CVENodeProperties   = NodeProperties
|        ) on $left.FirstCVE == $right.CVENodeId_join
|
|        // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|        // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|        // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|        // the keys its own rows have (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(ExposedResourceNodeId)))
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(si_in_scope_, true)
|        | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(ExposedResourceNodeId))
|        | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|        | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|        | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|        // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|        // Step 7  Compute CVE severity score and attack path priority score
|        | extend CVESev = tostring(coalesce(CVESeverity_join, ""))
|
|        | extend CVESeverityScore =
|            case(
|                tolower(CVESev) has "critical", 5,
|                tolower(CVESev) has "high", 4,
|                tolower(CVESev) has "medium", 3,
|                tolower(CVESev) has "low", 2,
|                1
|            )
|
|        | extend
|            SourceIsInternetExposed = true,
|            SourceCriticalityTier   = 3,
|            SourceCriticalityTierLevel = "Low - tier 3"
|
|        | extend TierEscalation =
|            case(
|                SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier,
|                0
|            )
|
|        | extend IsLateralMovement = TierEscalation > 0
|        | extend LateralMovementType =
|            case(
|                TierEscalation >= 3, "Privilege escalation large tier jump",
|                TierEscalation == 2, "Privilege escalation two tiers",
|                TierEscalation == 1, "Privilege escalation one tier",
|                "Direct access same tier"
|            )
|
|        | extend TargetTierWeight =
|            case(
|                TargetCriticalityTier == 0, 100,
|                TargetCriticalityTier == 1, 60,
|                TargetCriticalityTier == 2, 30,
|                10
|            )
|
|        | extend EscalationWeight = TierEscalation * 10
|        | extend ExposureWeight   = 8
|        | extend SourceTierAmplifier = 0
|        | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|
|        | extend AttackPathPriority =
|            case(
|                AttackPathPriorityScore >= 90,  "Very High",
|                AttackPathPriorityScore >= 60,  "High",
|                AttackPathPriorityScore >= 30,  "Medium-High",
|                AttackPathPriorityScore >= 15,  "Medium",
|                "Low"
|            )
|
|        | extend SecuritySeverityScore =
|            case(
|                TargetCriticalityTier == 0 and CVESeverityScore >= 4, 10,
|                TargetCriticalityTier == 0 and CVESeverityScore >= 3, 9,
|                TargetCriticalityTier == 1 and CVESeverityScore >= 4, 8,
|                TargetCriticalityTier == 1 and CVESeverityScore >= 3, 7,
|                TargetCriticalityTier == 2 and CVESeverityScore >= 4, 6,
|                CVESeverityScore >= 4, 5,
|                CVESeverityScore >= 3, 4,
|                3
|            )
|
|        | extend SecuritySeverityLevel =
|            case(
|                SecuritySeverityScore >= 9, "Very High",
|                SecuritySeverityScore >= 7, "Very High",
|                SecuritySeverityScore >= 5, "High",
|                SecuritySeverityScore >= 3, "Medium-High",
|                "Medium"
|            )
|
|        | extend SecurityDomain = "Azure"
|        | extend Category = "AttackPath_PublicIPWithCVE"
|        | extend Subcategory =
|            case(
|                TargetCriticalityTier == 0 and CVESeverityScore >= 4, "Tier 0 - Internet-Exposed with Critical CVE",
|                TargetCriticalityTier == 0, "Tier 0 - Internet-Exposed with Vulnerability",
|                TargetCriticalityTier == 1 and CVESeverityScore >= 4, "Tier 1 - Internet-Exposed with Critical CVE",
|                TargetCriticalityTier == 1, "Tier 1 - Internet-Exposed with Vulnerability",
|                CVESeverityScore >= 4, "Internet-Exposed with Critical CVE",
|                "Internet-Exposed with Vulnerability"
|            )
|
|        // Step 8  Build AttackPath and AttackPathDetailed
|        | extend AttackPath =
|            strcat(
|                "Public IP [", FirstPublicIPName, "] -> ",
|                ExposedResourceNodeLabel, " [", ExposedResourceNodeName, "] <- ",
|                "CVE [", FirstCVEName, "]"
|            )
|
|        | extend AttackPathDetailed =
|            strcat(
|                "PUBLIC IP [", FirstPublicIPName, "] ",
|                iff(PublicIPCount > 1, strcat("| + ", tostring(PublicIPCount - 1), " other IP(s)"), ""),
|                " -> EXPOSED ", ExposedResourceNodeLabel, " [", ExposedResourceNodeName, "] ",
|                "tier ", tostring(TargetCriticalityTier), " ", TargetCriticalityTierLevel, " | Internet-Exposed",
|                " | AssetTierByTag ", tostring(TargetAssetTierByTag),
|                " | LegacyEndOfSupport ", tostring(TargetLegacyEndOfSupport),
|                " <- CVE [", FirstCVEName, "] ",
|                "severity ", CVESev,
|                iff(CVECount > 1, strcat("| + ", tostring(CVECount - 1), " other CVE(s)"), "")
|            )
|
|        // Per-row identity columns expected by engine dedup (AssetName, ConfigurationName/Id).
|        // ConfigurationId carries the FINAL TARGET id so (AssetName, ConfigurationId) is unique per row.
|        | extend
|            AssetName              = ExposedResourceNodeName,
|            AssetLabel             = ExposedResourceNodeLabel,
|            ConfigurationName      = tostring(LateralMovementType),
|            ConfigurationId        = tostring(ExposedResourceNodeId),
|            CriticalityTier        = TargetCriticalityTier,
|            CriticalityTierLevel   = TargetCriticalityTierLevel,
|            RiskFactor_Consequence = 0,
|            RiskFactor_Probability = TargetRiskProb,
|            RiskFactor_Probability_Detailed      = TargetRiskProbDetailed,
|            RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore,
|            Impact                 = todouble(AttackPathPriorityScore)
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|
|        // Step 9  Project final columns and apply ordering
|        | order by RiskScore_Weight_Factor desc, AttackPathPriorityScore desc, CriticalityTier asc, CVESeverityScore desc
|
|        | project
|            SecurityDomain,
|            Category,
|            Subcategory,
|            ConfigurationName,
|            ConfigurationId,
|            AssetName,
|            AssetId=coalesce(column_ifexists("AssetId", ""), column_ifexists("TargetAssetId", ""), column_ifexists("ConfigurationId", "")),
|            AssetType=coalesce(column_ifexists("AssetType", ""), column_ifexists("AssetLabel", ""), "Azure"),
|            Impact,
|            SecuritySeverity = SecuritySeverityLevel,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AttackPath,
|            AttackPathDetailed,
|            AttackPathPriority,
|            AttackPathPriorityScore,
|            TierEscalation,
|            IsLateralMovement,
|            LateralMovementType,
|            EscalationWeight,
|            ExposureWeight,
|            PublicIPAddress = FirstPublicIPName,
|            TotalPublicIPs = PublicIPCount,
|            AllPublicIPs = PublicIPs,
|            CVE = FirstCVEName,
|            TotalCVEs = CVECount,
|            AllCVEs = CVEs,
|            CVESeverity = CVESev,
|            ExposedResource = ExposedResourceNodeName,
|            ExposedResourceType = ExposedResourceNodeLabel,
|            CriticalityRuleBased = TargetCriticalityRuleBased,
|            CriticalityRuleNames = TargetCriticalityRuleNames,
|            IsInternetExposed = true,
|            AssetTierByTag = TargetAssetTierByTag,
|            LegacyEndOfSupport = TargetLegacyEndOfSupport,
|            SecurityScore = SecuritySeverityScore,
|            TargetNodeProperties,
|            CVENodeProperties
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_Identity_Group_Membership_to_Privileged_Resources
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(IdentityNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: Group-membership privilege paths to Azure resources prioritized by FINAL TARGET business impact.
|        EG provides path detection (Identity -> Group -> Target) + scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - UniqueIssues
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - IssueList
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  Group membership privilege paths to Azure resources using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify identities that are members of groups and where those groups have permissions or roles on
|        // privileged Azure targets. Enrich each path with the standard node context and prioritize by the
|        // business impact of the final target. Provide both detailed rows and a collapsed summary output.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the target criticality tier first
|        // - Then by tier escalation where source tier is higher than target tier
|        // - Then by internet exposure where target exposure is weighted higher than source exposure
|        // - The source identity matters as an amplifier but the target drives the priority
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone using standard context fields
|        // Step 2  Find group permissions or roles on Azure targets  (declared FIRST since 2026-08-08
|        //          so the membership scan below can be pruned to only groups that hold such access)
|        // Step 3  Find identity to group membership edges at stable grain, pruned by step 2
|        // Step 4  Assemble Identity -> Group -> Target paths at stable grain
|        // Step 5  Enrich source identity and target using Nodes
|        // Step 6  Apply prioritization logic and build attack path strings
|        // Step 7  Build detailed output table
|        // Step 8  Collapse to unique logical path key so identity spam does not multiply counts
|        // Step 9  Build summary counts and key fields
|        // Step 10 Rebuild probability detail fields via split expand and re aggregation
|        // Step 11 Emit final collapsed summary ordering
|        // =================================================================================================
|
|
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich attack paths
|        // Fixes applied
|        // - NodeCiKey (= DeviceKey), AssetName defined in Nodes scope
|        // - Slice filter on the path's final target, not on the node scope (#677)
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend AssetName = NodeNameNorm
|
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|
|            // (no slice filter here since #677 -- the paths are cut on their final target)
|            // DeviceKey stays for distinct counting
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(NodeProperties.rawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    NodeProperties.rawData.isCustomerFacing,
|                    NodeProperties.raw.isCustomerFacing,
|                    false
|                ))
|
|            | extend IsExcluded =
|                tobool(coalesce(
|                    NodeProperties.rawData.isExcluded,
|                    NodeProperties.raw.isExcluded,
|                    false
|                ))
|
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    NodeProperties.rawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | extend _ScoreFactors =
|                array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                )
|            | mv-apply sf = _ScoreFactors on (
|                where isnotempty(trim(" ", tostring(sf)))
|                | summarize ScoreParts = make_set(strcat(tostring(sf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                NodeProperties,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|
|        // Step 2  Find group permissions or roles on Azure targets
|        // NOTE  this let is declared BEFORE the membership let (they were the other way round until
|        // 2026-08-08) so the membership scan can be pruned by it. See the PRUNE note in step 3.
|        let GroupAccessToTargets =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has role on", "has permissions to")
|            | where SourceNodeLabel == "group"
|            | where TargetNodeLabel in (
|                "subscriptions",
|                "resourcegroups",
|                "microsoft.keyvault/vaults",
|                "microsoft.storage/storageaccounts",
|                "microsoft.sql/servers",
|                "microsoft.compute/virtualmachines",
|                "microsoft.cognitiveservices/accounts"
|            )
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            // distinct edge grain -- EG can carry several edge rows for the same group/target pair
|            // (different role definitions). They collapse in step 4's summarize anyway, so removing
|            // them HERE avoids multiplying them across every member of the group first.
|            | summarize by
|                GroupNodeId      = SourceNodeId,
|                EdgeLabel        = EdgeLabel,
|                FinalTargetId    = TargetNodeId,
|                FinalTargetName  = TargetNodeName,
|                FinalTargetLabel = TargetNodeLabel
|            // #677 the slices are cut on the path's FINAL TARGET (FinalTargetId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            | extend DeviceKey = FinalTargetId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | project-away DeviceKey;
|
|
|        // Only the groups that actually hold access on one of the Azure target types above. Usually a
|        // tiny fraction of all groups in the tenant.
|        let GroupsWithAzureAccess =
|            GroupAccessToTargets
|            | distinct GroupNodeId;
|
|
|        // Step 3  Find identity to group membership edges at stable grain
|        // PRUNE (2026-08-08)  the membership scan is restricted to GroupsWithAzureAccess. This is
|        // SEMANTICALLY IDENTICAL -- step 4 inner-joins these two sets on GroupNodeId, so any member
|        // of a group with no Azure access was always discarded -- but it discards them BEFORE the
|        // cartesian instead of after. Without it this let materialises EVERY "member of" edge in the
|        // tenant and the join expands to (members x targets) per group, which is what made this
|        // report run 10 x 900s deterministic timeouts and return 0 rows on 2026-08-08 while the
|        // whole rest of the Summary template finished in ~25 minutes. Bucketing could not rescue it
|        // because the bucket filter lands on the CL enrichment let, not on this EG expansion, which
|        // is exactly what the engine's FUTILE-PRUNE message reports.
|        let IdentityGroupMembership =
|            ExposureGraphEdges
|            | where EdgeLabel == "member of"
|            | where SourceNodeLabel in ("user", "serviceprincipal", "managedidentity")
|            | where TargetNodeLabel == "group"
|            | where TargetNodeId in (GroupsWithAzureAccess)
|            | summarize by
|                IdentityNodeId    = SourceNodeId,
|                IdentityNodeName  = SourceNodeName,
|                IdentityNodeLabel = SourceNodeLabel,
|                GroupNodeId       = TargetNodeId,
|                GroupNodeName     = TargetNodeName;
|
|
|        // Step 4  Assemble Identity -> Group -> Target paths at stable grain
|        let Paths =
|            IdentityGroupMembership
|            | join kind=inner (GroupAccessToTargets) on GroupNodeId
|            | project
|                IdentityNodeId,
|                IdentityNodeName,
|                IdentityNodeLabel,
|                GroupNodeId,
|                GroupNodeName,
|                EdgeLabel,
|                FinalTargetId,
|                FinalTargetName,
|                FinalTargetLabel
|            | summarize by
|                IdentityNodeId,
|                GroupNodeId,
|                FinalTargetId,
|                IdentityNodeName,
|                IdentityNodeLabel,
|                GroupNodeName,
|                EdgeLabel,
|                FinalTargetName,
|                FinalTargetLabel;
|
|
|        // Step 5-7  Build the detailed output table
|        let Detailed =
|            Paths
|
|            // Enrich identity
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    SourceNodeId                = NodeId,
|                    SourceNodeCiKey = NodeCiKey,
|                    SourceRiskFactorSet = RiskFactorSet,
|                    SourceNodeName              = NodeName,
|                    SourceNodeLabel             = NodeLabel,
|                    SourceCriticalityTier       = CriticalityTier,
|                    SourceCriticalityTierLevel  = CriticalityTierLevel,
|                    SourceIsInternetExposed     = IsInternetExposed,
|                    SourceIsExcluded            = IsExcluded,
|                    SourceAssetTierByTag        = AssetTierByTag,
|                    SourceLegacyEndOfSupport    = LegacyEndOfSupport,
|                    SourceRiskProb              = RiskFactor_Probability,
|                    SourceRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    SourceRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                    SourceNodeProperties        = NodeProperties
|            ) on $left.IdentityNodeId == $right.SourceNodeId
|
|            // Enrich target
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    TargetNodeId                = NodeId,
|                    TargetNodeCiKey = NodeCiKey,
|                    TargetRiskFactorSet = RiskFactorSet,
|                    TargetNodeName              = NodeName,
|                    TargetNodeLabel             = NodeLabel,
|                    TargetCriticalityTier       = CriticalityTier,
|                    TargetCriticalityTierLevel  = CriticalityTierLevel,
|                    TargetCriticalityRuleBased  = CriticalityRuleBased,
|                    TargetCriticalityRuleNames  = EgCriticalityRuleNames,
|                    TargetIsInternetExposed     = IsInternetExposed,
|                    TargetIsExcluded            = IsExcluded,
|                    TargetAssetTierByTag        = AssetTierByTag,
|                    TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                    TargetRiskProb              = RiskFactor_Probability,
|                    TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                    TargetNodeProperties        = NodeProperties
|            ) on $left.FinalTargetId == $right.TargetNodeId
|
|            // Group context for strings and counts
|            | join kind=leftouter (
|                IdentityGroupMembership
|                | summarize
|                    IdentitiesInGroup     = make_set(IdentityNodeName),
|                    IdentityTypesInGroup  = make_set(IdentityNodeLabel),
|                    IdentityCountInGroup  = dcount(IdentityNodeId),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|                  by GroupNodeId
|            ) on GroupNodeId
|
|            // the SOURCE's CI (#505) -- tier (the EG criticality only where the CI has no tier) and the asset factors,
|            // the same way as the target. A source without a CI keeps its EG tier and has no asset factors.
|            | extend SourceRiskFactorSet = iff(isnull(SourceRiskFactorSet), dynamic([]), SourceRiskFactorSet)
|            // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|            // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|            // the keys its own rows have (the report field LookupNeededKeys).
|            //__SI_LOOKUP_KEYS_HERE__
|            | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(IdentityNodeId)))
|            | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|            | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|            | extend Source_si_ci_id = peer_ci_id, Source_si_tier = peer_tier, Source_si_rf_p = peer_rf_p, Source_si_rf_names = peer_rf_names
|            | project-away _peerKey, peer_*
|            | extend SourceAssetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(IdentityNodeId))
|            | extend SourceCriticalityTier = toint(coalesce(Source_si_tier, SourceCriticalityTier))
|            | extend SourceCriticalityTierLevel = case(SourceCriticalityTier == 0, "Critical - tier 0", SourceCriticalityTier == 1, "High - tier 1", SourceCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend _srcIds = coalesce(Source_si_rf_p, dynamic([])), _srcNames = coalesce(Source_si_rf_names, dynamic([]))
|            | extend SourceIsInternetExposed = set_has_element(_srcIds, "internet_exposed"), SourceLegacyEndOfSupport = iff(set_has_element(_srcIds, "unsupported_os"), 1, 0)
|            | extend _srcRf = array_concat(SourceRiskFactorSet, _srcNames)
|            | extend SourceRiskProb = array_length(SourceRiskFactorSet) + array_length(_srcIds)
|            | extend SourceRiskProbDetailed = strcat_array(array_sort_asc(_srcRf), ";")
|            | mv-apply _rf = _srcRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _srcScore = make_set(strcat(_rf, "=1")))
|            | extend SourceRiskProbDetailedScore = strcat_array(array_sort_asc(_srcScore), ";")
|            | project-away _srcRf, _srcScore, _srcIds, _srcNames
|            // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|            // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|            | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|            | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|            | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                     si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|            | project-away _peerKey, peer_*
|            | where coalesce(si_in_scope_, true)
|            | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(FinalTargetId))
|            | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|            | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|            // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|            | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|            | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|            | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|            | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|            | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|            | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|            | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|            | project-away _tgtRf, _tgtScore
|            | extend
|                cmdbId            = si_cmdb_id,
|                cmdbName            = si_cmdb_name,
|                cmdbCriticality     = si_cmdb_criticality,
|                cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|            | extend TierEscalation =
|                case(
|                    isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier,
|                        SourceCriticalityTier - TargetCriticalityTier,
|                    0
|                )
|            | extend IsLateralMovement = TierEscalation > 0
|            | extend LateralMovementType =
|                case(
|                    TierEscalation >= 3, "Privilege escalation large tier jump",
|                    TierEscalation == 2, "Privilege escalation two tiers",
|                    TierEscalation == 1, "Privilege escalation one tier",
|                    "Direct access same tier"
|                )
|
|            | extend TargetTierWeight =
|                case(
|                    TargetCriticalityTier == 0, 100,
|                    TargetCriticalityTier == 1, 60,
|                    TargetCriticalityTier == 2, 30,
|                    10
|                )
|            | extend EscalationWeight = TierEscalation * 10
|            | extend ExposureWeight   = iff(TargetIsInternetExposed == true, 8, 0) + iff(SourceIsInternetExposed == true, 3, 0)
|            | extend SourceTierAmplifier =
|                case(
|                    SourceCriticalityTier == 0, 8,
|                    SourceCriticalityTier == 1, 5,
|                    SourceCriticalityTier == 2, 2,
|                    0
|                )
|            | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|
|            | extend AttackPathPriority =
|                case(
|                    AttackPathPriorityScore >= 90,  "Very High",
|                    AttackPathPriorityScore >= 60,  "High",
|                    AttackPathPriorityScore >= 30,  "Medium-High",
|                    AttackPathPriorityScore >= 15,  "Medium",
|                    "Low"
|                )
|
|            | extend InternetExposureTarget = iff(TargetIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|            | extend InternetExposureSource = iff(SourceIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|
|            | extend AttackPath =
|                strcat(
|                    IdentityNodeLabel, " [", IdentityNodeName, "] -> ",
|                    "group [", GroupNodeName, "] -> ",
|                    TargetNodeLabel, " [", FinalTargetName, "]"
|                )
|
|            | extend AttackPathDetailed =
|                strcat(
|                    "SOURCE ", IdentityNodeLabel, " [", IdentityNodeName, "] ",
|                    "tier ", tostring(SourceCriticalityTier), " ", tostring(SourceCriticalityTierLevel), " | ", InternetExposureSource,
|                    iff(IdentityCountInGroup > 1, strcat(" | + ", tostring(IdentityCountInGroup - 1), " other identity/ies"), ""),
|                    " -> GROUP [", GroupNodeName, "] ",
|                    " -> TARGET ", TargetNodeLabel, " [", FinalTargetName, "] ",
|                    "tier ", tostring(TargetCriticalityTier), " ", tostring(TargetCriticalityTierLevel), " | ", InternetExposureTarget,
|                    " | escalation ", tostring(TierEscalation),
|                    " | ", LateralMovementType
|                )
|
|            | extend SecurityDomain = "Azure"
|            | extend Category = "Attack Paths"
|            | extend SubCategory = "GroupMembershipPrivilege"
|            | extend ConfigurationName = tostring(LateralMovementType)
|            | extend SecuritySeverity  = tostring(AttackPathPriority)
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | project
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|
|                SecuritySeverity,
|                AttackPathPriorityScore,
|                TierEscalation,
|                IsLateralMovement,
|                LateralMovementType,
|
|                GroupNodeId,
|                GroupNodeName,
|                EdgeLabel,
|
|                IdentityNodeId,
|                IdentityNodeName,
|                IdentityNodeLabel,
|
|                TotalIdentitiesInGroup = IdentityCountInGroup,
|                AllIdentities = IdentitiesInGroup,
|
|                FinalTargetId,
|                FinalTarget = FinalTargetName,
|                FinalTargetType = FinalTargetLabel,
|
|                TargetCriticalityTier,
|                TargetCriticalityTierLevel,
|                TargetAssetTierByTag,
|                TargetIsInternetExposed,
|                TargetLegacyEndOfSupport,
|                TargetRiskProb,
|                TargetRiskProbDetailed,
|                TargetRiskProbDetailedScore,
|
|                cmdbId,
|                cmdbName,
|                cmdbCriticality,
|                cmdbDataSensitivity,
|
|                AttackPath,
|                AttackPathDetailed,
|
|                SourceNodeProperties,
|                TargetNodeProperties,
|                TargetAssetId;
|
|
|        // ===================== COLLAPSED SUMMARY VERSION FINAL OUTPUT =====================
|
|        // Step 8  Collapse to unique logical path key so identity spam does not multiply counts
|        let CollapsedPaths =
|            Detailed
|            | extend PathKey = strcat(IdentityNodeId, "->", GroupNodeId, "->", FinalTargetId)
|            | summarize
|                AttackPathPriorityScore_Path = max(AttackPathPriorityScore),
|                SecuritySeverity_Path        = any(SecuritySeverity),
|
|                TargetCriticalityTier_Path      = any(TargetCriticalityTier),
|                TargetCriticalityTierLevel_Path = any(TargetCriticalityTierLevel),
|                TargetRiskProb_Path             = max(TargetRiskProb),
|
|                TargetRiskProbDetailed_Path      = any(TargetRiskProbDetailed),
|                TargetRiskProbDetailedScore_Path = any(TargetRiskProbDetailedScore),
|
|                // the FINAL TARGET's CMDB values (its CI)
|                cmdbId_Path              = any(cmdbId),
|                cmdbName_Path            = any(cmdbName),
|                cmdbCriticality_Path     = any(cmdbCriticality),
|                cmdbDataSensitivity_Path = any(cmdbDataSensitivity),
|
|                IdentityTypes_Path     = make_set(tostring(IdentityNodeLabel)),
|                SourceIdentities_Path  = make_set(tostring(IdentityNodeName)),
|                TargetAssets_Path      = make_set(tostring(FinalTarget)),
|                TotalIssues_Path       = count(),
|                TargetAssetId = any(TargetAssetId)
|              by
|                PathKey,
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                FinalTargetId;
|
|
|        // Step 9  Main summary counts stay correct
|        // cmdbCriticality + cmdbDataSensitivity in by-clause so cmdb-bucketed rows survive.
|        let SummaryMain =
|            CollapsedPaths
|            | summarize
|                ConfigurationId = strcat_array(array_sort_asc(make_set(strcat_array(IdentityTypes_Path, ";"))), ";"),
|
|                SecuritySeverity = any(SecuritySeverity_Path),
|                CriticalityTier = toint(any(TargetCriticalityTier_Path)),
|                CriticalityTierLevel = tostring(any(TargetCriticalityTierLevel_Path)),
|
|                RiskFactor_Consequence = 0,
|                RiskFactor_Probability = max(TargetRiskProb_Path),
|
|                AssetCount   = dcount(FinalTargetId),
|                TotalIssues  = sum(TotalIssues_Path),
|
|                ImpactedAssets = strcat_array(array_sort_asc(make_set(strcat_array(TargetAssets_Path, ";"))), ";"),
|                ImpactedAssetPairs = make_set(strcat(strcat_array(TargetAssets_Path, ";"), "|", tostring(TargetAssetId)))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|
|        // Step 10  Rebuild probability detail strings
|        let SummaryDetail =
|            CollapsedPaths
|            | extend _d = split(tostring(TargetRiskProbDetailed_Path), ";")
|            | mv-expand _d to typeof(string)
|            | extend _d = trim(" ", _d)
|            | where isnotempty(_d)
|            | summarize
|                RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(make_set(_d)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        let SummaryDetailScore =
|            CollapsedPaths
|            | extend _s = split(tostring(TargetRiskProbDetailedScore_Path), ";")
|            | mv-expand _s to typeof(string)
|            | extend _s = trim(" ", _s)
|            | where isnotempty(_s)
|            | summarize
|                RiskFactor_Probability_DetailedScore = strcat_array(array_sort_asc(make_set(_s)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|
|        // Step 11  Final output
|        SummaryMain
|        | join kind=leftouter SummaryDetail      on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        | join kind=leftouter SummaryDetailScore on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            SubCategory,
|            ConfigurationName,
|            ConfigurationId,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AssetCount,
|            TotalIssues,
|            ImpactedAssets, ImpactedAssetPairs
|        | order by
|            RiskScore_Weight_Factor desc,
|            RiskFactor_Probability desc,
|            CriticalityTier asc,
|            TotalIssues desc,
|            AssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, UniqueIssues, ImpactedAssetsList, ImpactedAssetIds, IssueList, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|
|    - ReportName: Attack_Paths_Detailed_Identity_Group_Membership_to_Privileged_Resources
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(FirstIdentityId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: Per-row detail of group-membership privilege paths to Azure resources prioritized by FINAL TARGET business impact.
|        EG drives path detection (Identity -> Group -> Target) + scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  Group membership privilege paths to Azure resources using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify identities that are members of groups and where those groups have permissions or roles on
|        // privileged Azure targets. Enrich each path with the standard node context and prioritize by the
|        // business impact of the FINAL TARGET.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the TARGET criticality tier first
|        // - Then by tier escalation where source tier is higher than target tier
|        // - Then by internet exposure where target exposure is weighted higher than source exposure
|        // - The source identity matters as an amplifier but the target drives the priority
|        //
|        // Output description detailed rows
|        // One row per unique path
|        // Identity -> Group -> Target
|        // Enriched with
|        // - IsInternetExposed for source and target
|        // - AssetTierByTag for source and target
|        // - LegacyEndOfSupport for source and target
|        // - RiskFactor probability fields including detailed breakdown for source and target
|        // - AttackPathPriorityScore components and mapped severity label
|        // - Human readable AttackPath and AttackPathDetailed strings
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone using standard context fields
|        // Step 2  Find identities in groups and de duplicate to a stable group membership grain
|        // Step 3  Find group permissions or roles on Azure targets
|        // Step 4  Assemble Identity -> Group -> Target paths and de duplicate
|        // Step 5  Enrich source identity and target using Nodes catalog
|        // Step 6  Apply standard prioritization logic and build attack path strings
|        // Step 7  Project detailed output columns and apply ordering
|        // =================================================================================================
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich attack paths
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(NodeProperties.rawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    NodeProperties.rawData.isCustomerFacing,
|                    NodeProperties.raw.isCustomerFacing,
|                    false
|                ))
|
|            | extend IsExcluded =
|                tobool(coalesce(
|                    NodeProperties.rawData.isExcluded,
|                    NodeProperties.raw.isExcluded,
|                    false
|                ))
|
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    NodeProperties.rawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | mv-apply rf = array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                ) on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize ScoreParts = make_set(strcat(tostring(rf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                Categories        = CategoriesStr,
|                NodeProperties,
|                EgCriticalityLevel,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                EgNodeTags,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactorsArray,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|        // Step 2  Find identities in groups and de duplicate
|        let IdentityGroupMembership =
|            ExposureGraphEdges
|            | where EdgeLabel == "member of"
|            | where SourceNodeLabel in ("user", "serviceprincipal", "managedidentity")
|            | where TargetNodeLabel == "group"
|            | project
|                IdentityNodeId    = SourceNodeId,
|                IdentityNodeName  = SourceNodeName,
|                IdentityNodeLabel = SourceNodeLabel,
|                GroupNodeId       = TargetNodeId,
|                GroupNodeName     = TargetNodeName
|            | summarize
|                Identities        = make_set(IdentityNodeName),
|                IdentityTypes     = make_set(IdentityNodeLabel),
|                IdentityCount     = dcount(IdentityNodeId),
|                FirstIdentityId   = any(IdentityNodeId),
|                FirstIdentityName = any(IdentityNodeName),
|                FirstIdentityLabel= any(IdentityNodeLabel),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by GroupNodeId, GroupNodeName;
|
|        // Step 3  Find group permissions or roles on Azure targets
|        let GroupAccessToTargets =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has role on", "has permissions to")
|            | where SourceNodeLabel == "group"
|            | where TargetNodeLabel in (
|                "subscriptions",
|                "resourcegroups",
|                "microsoft.keyvault/vaults",
|                "microsoft.storage/storageaccounts",
|                "microsoft.sql/servers",
|                "microsoft.compute/virtualmachines",
|                "microsoft.cognitiveservices/accounts"
|            )
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            | project
|                GroupNodeId      = SourceNodeId,
|                EdgeLabel        = EdgeLabel,
|                FinalTargetId    = TargetNodeId,
|                FinalTargetName  = TargetNodeName,
|                FinalTargetLabel = TargetNodeLabel
|            // #677 the slices are cut on the path's FINAL TARGET (FinalTargetId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            | extend DeviceKey = FinalTargetId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | project-away DeviceKey;
|
|        // Step 4  Assemble Identity -> Group -> Target paths and de duplicate
|        let Paths =
|            IdentityGroupMembership
|            | join kind=inner (GroupAccessToTargets) on GroupNodeId
|            | summarize
|                Identities         = any(Identities),
|                IdentityTypes      = any(IdentityTypes),
|                IdentityCount      = any(IdentityCount),
|                FirstIdentityId    = any(FirstIdentityId),
|                FirstIdentityName  = any(FirstIdentityName),
|                FirstIdentityLabel = any(FirstIdentityLabel),
|                GroupNodeName      = any(GroupNodeName),
|                EdgeLabel          = any(EdgeLabel),
|                FinalTargetName    = any(FinalTargetName),
|                FinalTargetLabel   = any(FinalTargetLabel),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by FinalTargetId, GroupNodeId;
|
|        // Step 5-7  Enrich source and target and apply standard prioritization logic
|        Paths
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                SourceNodeId                = NodeId,
|                SourceNodeCiKey = NodeCiKey,
|                SourceRiskFactorSet = RiskFactorSet,
|                SourceNodeName              = NodeName,
|                SourceNodeLabel             = NodeLabel,
|                SourceCriticalityTier       = CriticalityTier,
|                SourceCriticalityTierLevel  = CriticalityTierLevel,
|                SourceIsInternetExposed     = IsInternetExposed,
|                SourceIsExcluded            = IsExcluded,
|                SourceAssetTierByTag        = AssetTierByTag,
|                SourceLegacyEndOfSupport    = LegacyEndOfSupport,
|                SourceRiskProb              = RiskFactor_Probability,
|                SourceRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                SourceRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                SourceNodeProperties        = NodeProperties
|        ) on $left.FirstIdentityId == $right.SourceNodeId
|
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                TargetNodeId                = NodeId,
|                TargetNodeCiKey = NodeCiKey,
|                TargetRiskFactorSet = RiskFactorSet,
|                TargetNodeName              = NodeName,
|                TargetNodeLabel             = NodeLabel,
|                TargetCriticalityTier       = CriticalityTier,
|                TargetCriticalityTierLevel  = CriticalityTierLevel,
|                TargetCriticalityRuleBased  = CriticalityRuleBased,
|                TargetCriticalityRuleNames  = EgCriticalityRuleNames,
|                TargetIsInternetExposed     = IsInternetExposed,
|                TargetIsExcluded            = IsExcluded,
|                TargetAssetTierByTag        = AssetTierByTag,
|                TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                TargetRiskProb              = RiskFactor_Probability,
|                TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                TargetNodeProperties        = NodeProperties
|        ) on $left.FinalTargetId == $right.TargetNodeId
|
|        // the SOURCE's CI (#505) -- tier (the EG criticality only where the CI has no tier) and the asset factors,
|        // the same way as the target. A source without a CI keeps its EG tier and has no asset factors.
|        | extend SourceRiskFactorSet = iff(isnull(SourceRiskFactorSet), dynamic([]), SourceRiskFactorSet)
|        // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|        // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|        // the keys its own rows have (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(FirstIdentityId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, Source_si_tier = peer_tier, Source_si_rf_p = peer_rf_p, Source_si_rf_names = peer_rf_names
|        | project-away _peerKey, peer_*
|        | extend SourceAssetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(FirstIdentityId))
|        | extend SourceCriticalityTier = toint(coalesce(Source_si_tier, SourceCriticalityTier))
|        | extend SourceCriticalityTierLevel = case(SourceCriticalityTier == 0, "Critical - tier 0", SourceCriticalityTier == 1, "High - tier 1", SourceCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|        | extend _srcIds = coalesce(Source_si_rf_p, dynamic([])), _srcNames = coalesce(Source_si_rf_names, dynamic([]))
|        | extend SourceIsInternetExposed = set_has_element(_srcIds, "internet_exposed"), SourceLegacyEndOfSupport = iff(set_has_element(_srcIds, "unsupported_os"), 1, 0)
|        | extend _srcRf = array_concat(SourceRiskFactorSet, _srcNames)
|        | extend SourceRiskProb = array_length(SourceRiskFactorSet) + array_length(_srcIds)
|        | extend SourceRiskProbDetailed = strcat_array(array_sort_asc(_srcRf), ";")
|        | mv-apply _rf = _srcRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _srcScore = make_set(strcat(_rf, "=1")))
|        | extend SourceRiskProbDetailedScore = strcat_array(array_sort_asc(_srcScore), ";")
|        | project-away _srcRf, _srcScore, _srcIds, _srcNames
|        // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|        // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(si_in_scope_, true)
|        | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(FinalTargetId))
|        | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|        | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|        | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|        // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|        // Step 6  Attack path prioritization logic
|        | extend TierEscalation =
|            case(
|                isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier,
|                    SourceCriticalityTier - TargetCriticalityTier,
|                0
|            )
|        | extend IsLateralMovement = TierEscalation > 0
|        | extend LateralMovementType =
|            case(
|                TierEscalation >= 3, "Privilege escalation large tier jump",
|                TierEscalation == 2, "Privilege escalation two tiers",
|                TierEscalation == 1, "Privilege escalation one tier",
|                "Direct access same tier"
|            )
|
|        | extend TargetTierWeight =
|            case(
|                TargetCriticalityTier == 0, 100,
|                TargetCriticalityTier == 1, 60,
|                TargetCriticalityTier == 2, 30,
|                10
|            )
|        | extend EscalationWeight = TierEscalation * 10
|        | extend ExposureWeight   = iff(TargetIsInternetExposed == true, 8, 0) + iff(SourceIsInternetExposed == true, 3, 0)
|        | extend SourceTierAmplifier =
|            case(
|                SourceCriticalityTier == 0, 8,
|                SourceCriticalityTier == 1, 5,
|                SourceCriticalityTier == 2, 2,
|                0
|            )
|        | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|
|        | extend AttackPathPriority =
|            case(
|                AttackPathPriorityScore >= 90,  "Very High",
|                AttackPathPriorityScore >= 60,  "High",
|                AttackPathPriorityScore >= 30,  "Medium-High",
|                AttackPathPriorityScore >= 15,  "Medium",
|                "Low"
|            )
|
|        // Step 7  Human readable paths
|        | extend InternetExposureTarget = iff(TargetIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|        | extend InternetExposureSource = iff(SourceIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|
|        | extend AttackPath =
|            strcat(
|                FirstIdentityLabel, " [", FirstIdentityName, "] -> ",
|                "group [", GroupNodeName, "] -> ",
|                TargetNodeLabel, " [", FinalTargetName, "]"
|            )
|
|        | extend AttackPathDetailed =
|            strcat(
|                "SOURCE ", FirstIdentityLabel, " [", FirstIdentityName, "] ",
|                "tier ", tostring(SourceCriticalityTier), " ", tostring(SourceCriticalityTierLevel), " | ", InternetExposureSource,
|                iff(IdentityCount > 1, strcat(" | + ", tostring(IdentityCount - 1), " other identity/ies"), ""),
|                " -> GROUP [", GroupNodeName, "] ",
|                " -> TARGET ", TargetNodeLabel, " [", FinalTargetName, "] ",
|                "tier ", tostring(TargetCriticalityTier), " ", tostring(TargetCriticalityTierLevel), " | ", InternetExposureTarget,
|                " | escalation ", tostring(TierEscalation),
|                " | ", LateralMovementType
|            )
|
|        | extend SecurityDomain = "Azure"
|        | extend Category = "Attack Paths"
|        | extend Subcategory = "GroupMembershipPrivilege"
|        // Per-row identity columns expected by engine dedup (AssetName, ConfigurationName/Id).
|        // ConfigurationId carries the FINAL TARGET id so (AssetName, ConfigurationId) is unique per row.
|        | extend
|            AssetName              = FinalTargetName,
|            AssetLabel             = FinalTargetLabel,
|            ConfigurationName      = tostring(LateralMovementType),
|            ConfigurationId        = tostring(FinalTargetId),
|            SecuritySeverity       = tostring(AttackPathPriority),
|            Impact                 = todouble(AttackPathPriorityScore),
|            CriticalityTier        = TargetCriticalityTier,
|            CriticalityTierLevel   = TargetCriticalityTierLevel,
|            RiskFactor_Consequence = 0,
|            RiskFactor_Probability = TargetRiskProb,
|            RiskFactor_Probability_Detailed      = TargetRiskProbDetailed,
|            RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            Subcategory,
|            ConfigurationName,
|            ConfigurationId,
|            AssetName,
|            AssetId=coalesce(column_ifexists("AssetId", ""), column_ifexists("TargetAssetId", ""), column_ifexists("ConfigurationId", "")),
|            AssetType=coalesce(column_ifexists("AssetType", ""), column_ifexists("AssetLabel", ""), "Azure"),
|            Impact,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AttackPath,
|            AttackPathDetailed,
|            AttackPathPriority,
|            AttackPathPriorityScore,
|            TierEscalation,
|            IsLateralMovement,
|            LateralMovementType,
|            EscalationWeight,
|            ExposureWeight,
|            GroupNodeId,
|            GroupNodeName,
|            EdgeLabel,
|            FirstIdentityId,
|            FirstIdentityName,
|            FirstIdentityLabel,
|            TotalIdentitiesInGroup = IdentityCount,
|            AllIdentities = Identities,
|            IdentityTypes,
|            FinalTargetId,
|            FinalTarget = FinalTargetName,
|            FinalTargetType = FinalTargetLabel,
|            TargetCriticalityRuleBased,
|            TargetCriticalityRuleNames,
|            TargetAssetTierByTag,
|            TargetIsInternetExposed,
|            TargetLegacyEndOfSupport,
|            SourceCriticalityTier,
|            SourceCriticalityTierLevel,
|            SourceAssetTierByTag,
|            SourceIsInternetExposed,
|            SourceLegacyEndOfSupport,
|            SourceRiskProb,
|            SourceRiskProbDetailed,
|            SourceRiskProbDetailedScore,
|            SourceNodeProperties,
|            TargetNodeProperties
|
|        | order by RiskScore_Weight_Factor desc, AttackPathPriorityScore desc, TierEscalation desc, CriticalityTier asc, FinalTarget asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_Data_Sensitivity_to_Exposed_Credentials
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(IdentityNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(DataLocationNodeId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: Credential-driven attack paths to sensitive data locations prioritized by FINAL TARGET business impact.
|        EG provides path detection (ExposedCredential -> Identity -> DataLocation <- DataSensitivityScan) + scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - UniqueIssues
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - IssueList
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  Exposed credentials enabling access to sensitive data locations using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify sensitive data locations and the credential driven attack paths that can reach them.
|        // The path shape is
|        // ExposedCredential -> Identity -> DataLocation <- DataSensitivityScan
|        // Results are enriched using the standard Nodes context and prioritized by the business impact of the
|        // final target which is the data location. Output is a collapsed summary suitable for your risk engine.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the target criticality tier first
|        // - Then by tier escalation where source tier is higher than target tier
|        // - Then by internet exposure where target exposure is weighted higher than source exposure
|        // - The source identity matters as an amplifier but the target drives the priority
|        //
|        // Output description summary rows
|        // One row per ConfigurationName which is LateralMovementType grouped within the report taxonomy
|        // and collapsed so many credentials and identities do not multiply the counts.
|        // RiskFactor detailed strings are rebuilt from TargetRiskProbDetailed and TargetRiskProbDetailedScore.
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone using standard context fields
|        // Step 2  Normalize labels for allowlists
|        // Step 3  Identify sensitive data locations from dataSensitivityScan edges
|        // Step 4  Identify identity access to data locations
|        // Step 5  Identify exposed credentials linked to identities and filter to credential allowlist
|        // Step 6  Build detailed enriched table as Detailed
|        // Step 7  Collapse to PathKey so credential spam does not multiply counts
|        // Step 8  Build SummaryMain with correct counts
|        // Step 9  Rebuild RiskFactor_Probability_Detailed via split expand and re aggregation
|        // Step 10 Rebuild RiskFactor_Probability_DetailedScore via split expand and re aggregation
|        // Step 11 Join summary parts and output final collapsed summary ordering
|        // =================================================================================================
|
|
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich attack paths
|        // Fixes applied
|        // - NodeCiKey (= DeviceKey), AssetName defined in Nodes scope
|        // - Slice filter on the path's final target, not on the node scope (#677)
|        // - RawData and Raw extracted once and then reused
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend AssetName     = NodeNameNorm
|
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(RawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(RawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(RawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    RawData.isCustomerFacing,
|                    Raw.isCustomerFacing,
|                    false
|                ))
|
|            | extend IsExcluded =
|                tobool(coalesce(
|                    RawData.isExcluded,
|                    Raw.isExcluded,
|                    false
|                ))
|
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    RawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | extend _ScoreFactors =
|                array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                )
|            | mv-apply sf = _ScoreFactors on (
|                where isnotempty(trim(" ", tostring(sf)))
|                | summarize ScoreParts = make_set(strcat(tostring(sf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                NodeProperties,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|
|        // Step 2  Normalize labels to avoid typos breaking allowlists
|        let NormalizeLabel = (s:string) { tolower(trim(" ", replace_string(s, " ", ""))) };
|
|
|        // Step 3  Data location allowlist normalized
|        let DataLocationLabels =
|            dynamic([
|                "blobcontainer",
|                "microsoft.storage/storageaccounts",
|                "microsoft.sql/servers/databases",
|                "microsoft.sql/servers",
|                "microsoft.storage/storageaccounts/blobservices/containers",
|                "microsoft.storage/storageaccounts/fileservices/shares"
|            ]);
|
|
|        // Step 4  Credential allowlist normalized
|        let CredentialLabels =
|            dynamic([
|                "azure-storage-shared-access-signature",
|                "azure-storage-connection-string",
|                "azure-database-connection-string",
|                "azure-active-directory-app-secret",
|                "service-principal-azure-cli-secret",
|                "user-azure-cli-secret",
|                "azure-active-directory-user-credentials",
|                "entra-usercookie"
|            ]);
|
|
|        // Step 5  Find sensitive data locations
|        let SensitiveDataLocations =
|            ExposureGraphEdges
|            | extend TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where SourceNodeLabel == "dataSensitivityScan"
|            // #677 the slices are cut on the path's FINAL TARGET (TargetNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            | extend DeviceKey = TargetNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | where EdgeLabel in ("defined in", "contains")
|            | where TargetNodeLabelNorm in (DataLocationLabels)
|            | project
|                SensitiveDataNodeId   = SourceNodeId,
|                SensitiveDataNodeName = SourceNodeName,
|                DataLocationNodeId    = TargetNodeId,
|                DataLocationNodeName  = TargetNodeName,
|                DataLocationNodeLabel = TargetNodeLabel;
|
|
|        // Step 6  Identity to data location access edges
|        // v2.2.419 (audit #56.2b) -- bound to the data locations a sensitivity scan actually found.
|        // This scanned every permission/role/access edge to any data-location-shaped node in the
|        // tenant. The Step 8 `join kind=inner SensitiveDataLocations on DataLocationNodeId` then
|        // discarded most of them -- but a join constrains the RESULT, not the SCAN, so the set was
|        // still materialised in full. Provably lossless: this removes exactly the rows that inner
|        // join would drop. Same defect and remedy as #56.
|        let _DsDataLocIds = SensitiveDataLocations | distinct DataLocationNodeId;
|        let IdentityAccessToData =
|            ExposureGraphEdges
|            | extend TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where EdgeLabel in ("has permissions to", "has role on", "can authenticate to", "has access to", "can access")
|            | where TargetNodeLabelNorm in (DataLocationLabels)
|            | where TargetNodeId in (_DsDataLocIds)
|            | project
|                IdentityNodeId     = SourceNodeId,
|                DataLocationNodeId = TargetNodeId;
|        // Identities that actually reach sensitive data -- the only ones the Step 8 credential
|        // inner join can keep, so both credential-edge directions below are bounded by it.
|        let _DsIdentityIds = IdentityAccessToData | distinct IdentityNodeId;
|
|
|        // Step 7  Credential exposure edges support both directions
|        let ExposedCredentialsToIdentity =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "can authenticate as", "can authenticate to")
|            // v2.2.419 (#56.2b) -- identity is the TARGET in this direction, so bound that end.
|            | where TargetNodeId in (_DsIdentityIds)
|            | project
|                CredentialNodeId    = SourceNodeId,
|                CredentialName      = SourceNodeName,
|                CredentialLabel     = SourceNodeLabel,
|                IdentityNodeId      = TargetNodeId;
|
|        let IdentityToExposedCredentials =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "uses credential", "uses credentials", "authenticated by")
|            // v2.2.419 (#56.2b) -- identity is the SOURCE in this direction, so bound that end.
|            | where SourceNodeId in (_DsIdentityIds)
|            | project
|                IdentityNodeId      = SourceNodeId,
|                CredentialNodeId    = TargetNodeId,
|                CredentialName      = TargetNodeName,
|                CredentialLabel     = TargetNodeLabel;
|
|        let ExposedCreds =
|            union isfuzzy=true ExposedCredentialsToIdentity, IdentityToExposedCredentials
|            | extend CredentialNodeLabelNorm = NormalizeLabel(CredentialLabel)
|            | where CredentialNodeLabelNorm in (CredentialLabels);
|
|
|        // Step 8  Build the detailed output table
|        let Detailed =
|            IdentityAccessToData
|            | join kind=inner SensitiveDataLocations on DataLocationNodeId
|            | join kind=inner (
|                ExposedCreds
|                | project-rename IdentityNodeId_join = IdentityNodeId
|            ) on $left.IdentityNodeId == $right.IdentityNodeId_join
|            | project
|                DataLocationNodeId,
|                DataLocationNodeName,
|                DataLocationNodeLabel,
|                SensitiveDataNodeId,
|                SensitiveDataNodeName,
|                IdentityNodeId,
|                CredentialNodeId,
|                CredentialName,
|                CredentialLabel
|            | summarize
|                SensitiveDataItems = make_set(SensitiveDataNodeName),
|                SensitiveDataCount = dcount(SensitiveDataNodeId),
|
|                ExposedCredentials     = make_set(CredentialName),
|                ExposedCredentialTypes = make_set(CredentialLabel),
|                ExposedCredentialCount = dcount(CredentialNodeId)
|              by
|                DataLocationNodeId,
|                DataLocationNodeName,
|                DataLocationNodeLabel,
|                IdentityNodeId,
|                CredentialNodeId,
|                CredentialName,
|                CredentialLabel
|
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    TargetNodeId                = NodeId,
|                    TargetNodeCiKey = NodeCiKey,
|                    TargetRiskFactorSet = RiskFactorSet,
|                    TargetCriticalityTier       = CriticalityTier,
|                    TargetCriticalityTierLevel  = CriticalityTierLevel,
|                    TargetCriticalityRuleBased  = CriticalityRuleBased,
|                    TargetCriticalityRuleNames  = EgCriticalityRuleNames,
|                    TargetIsInternetExposed     = IsInternetExposed,
|                    TargetAssetTierByTag        = AssetTierByTag,
|                    TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                    TargetRiskProb              = RiskFactor_Probability,
|                    TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|            ) on $left.DataLocationNodeId == $right.TargetNodeId
|
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    SourceNodeId                = NodeId,
|                    SourceNodeCiKey = NodeCiKey,
|                    SourceRiskFactorSet = RiskFactorSet,
|                    SourceCriticalityTier       = CriticalityTier,
|                    SourceCriticalityTierLevel  = CriticalityTierLevel,
|                    SourceIsInternetExposed     = IsInternetExposed,
|                    SourceAssetTierByTag        = AssetTierByTag,
|                    SourceLegacyEndOfSupport    = LegacyEndOfSupport,
|                    SourceRiskProb              = RiskFactor_Probability,
|                    SourceRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    SourceRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|            ) on $left.IdentityNodeId == $right.SourceNodeId
|
|            // the SOURCE's CI (#505) -- tier (the EG criticality only where the CI has no tier) and the asset factors,
|            // the same way as the target. A source without a CI keeps its EG tier and has no asset factors.
|            | extend SourceRiskFactorSet = iff(isnull(SourceRiskFactorSet), dynamic([]), SourceRiskFactorSet)
|            // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|            // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|            // the keys its own rows have (the report field LookupNeededKeys).
|            //__SI_LOOKUP_KEYS_HERE__
|            | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(IdentityNodeId)))
|            | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(DataLocationNodeId)))
|            | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|            | extend Source_si_ci_id = peer_ci_id, Source_si_tier = peer_tier, Source_si_rf_p = peer_rf_p, Source_si_rf_names = peer_rf_names
|            | project-away _peerKey, peer_*
|            | extend SourceAssetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(IdentityNodeId))
|            | extend SourceCriticalityTier = toint(coalesce(Source_si_tier, SourceCriticalityTier))
|            | extend SourceCriticalityTierLevel = case(SourceCriticalityTier == 0, "Critical - tier 0", SourceCriticalityTier == 1, "High - tier 1", SourceCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend _srcIds = coalesce(Source_si_rf_p, dynamic([])), _srcNames = coalesce(Source_si_rf_names, dynamic([]))
|            | extend SourceIsInternetExposed = set_has_element(_srcIds, "internet_exposed"), SourceLegacyEndOfSupport = iff(set_has_element(_srcIds, "unsupported_os"), 1, 0)
|            | extend _srcRf = array_concat(SourceRiskFactorSet, _srcNames)
|            | extend SourceRiskProb = array_length(SourceRiskFactorSet) + array_length(_srcIds)
|            | extend SourceRiskProbDetailed = strcat_array(array_sort_asc(_srcRf), ";")
|            | mv-apply _rf = _srcRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _srcScore = make_set(strcat(_rf, "=1")))
|            | extend SourceRiskProbDetailedScore = strcat_array(array_sort_asc(_srcScore), ";")
|            | project-away _srcRf, _srcScore, _srcIds, _srcNames
|            // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|            // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|            | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|            | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|            | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                     si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|            | project-away _peerKey, peer_*
|            | where coalesce(si_in_scope_, true)
|            | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(DataLocationNodeId))
|            | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|            | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|            // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|            | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|            | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|            | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|            | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|            | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|            | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|            | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|            | project-away _tgtRf, _tgtScore
|            | extend
|                cmdbId            = si_cmdb_id,
|                cmdbName            = si_cmdb_name,
|                cmdbCriticality     = si_cmdb_criticality,
|                cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|            | extend TierEscalation =
|                case(
|                    isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier,
|                        SourceCriticalityTier - TargetCriticalityTier,
|                    0
|                )
|            | extend IsLateralMovement = TierEscalation > 0
|            | extend LateralMovementType =
|                case(
|                    TierEscalation >= 3, "Privilege escalation large tier jump",
|                    TierEscalation == 2, "Privilege escalation two tiers",
|                    TierEscalation == 1, "Privilege escalation one tier",
|                    "Direct access same tier"
|                )
|
|            | extend TargetTierWeight =
|                case(
|                    TargetCriticalityTier == 0, 100,
|                    TargetCriticalityTier == 1, 60,
|                    TargetCriticalityTier == 2, 30,
|                    10
|                )
|            | extend EscalationWeight = TierEscalation * 10
|            | extend ExposureWeight   = iff(TargetIsInternetExposed == true, 8, 0) + iff(SourceIsInternetExposed == true, 3, 0)
|            | extend SourceTierAmplifier =
|                case(
|                    SourceCriticalityTier == 0, 8,
|                    SourceCriticalityTier == 1, 5,
|                    SourceCriticalityTier == 2, 2,
|                    0
|                )
|            | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|
|            | extend AttackPathPriority =
|                case(
|                    AttackPathPriorityScore >= 90,  "Very High",
|                    AttackPathPriorityScore >= 60,  "High",
|                    AttackPathPriorityScore >= 30,  "Medium-High",
|                    AttackPathPriorityScore >= 15,  "Medium",
|                    "Low"
|                )
|
|            | extend SecurityDomain = "Azure"
|            | extend Category = "Attack Paths"
|            | extend SubCategory = "SensitiveDataExposure"
|            | extend ConfigurationName = tostring(LateralMovementType)
|            | extend SecuritySeverity  = tostring(AttackPathPriority)
|            | extend RiskFactor_Consequence = 0;
|
|
|        // ===================== COLLAPSED SUMMARY VERSION FINAL OUTPUT =====================
|
|        // Step 9  Collapse to unique logical path so credential spam does not multiply counts
|        let CollapsedPaths =
|            Detailed
|            | extend PathKey = strcat(CredentialNodeId, "->", IdentityNodeId, "->", DataLocationNodeId)
|            | summarize
|                AttackPathPriorityScore_Path = max(AttackPathPriorityScore),
|                SecuritySeverity_Path        = any(SecuritySeverity),
|
|                TargetCriticalityTier_Path      = any(TargetCriticalityTier),
|                TargetCriticalityTierLevel_Path = any(TargetCriticalityTierLevel),
|                TargetRiskProb_Path             = max(TargetRiskProb),
|
|                TargetRiskProbDetailed_Path      = any(TargetRiskProbDetailed),
|                TargetRiskProbDetailedScore_Path = any(TargetRiskProbDetailedScore),
|
|                // the FINAL TARGET's CMDB values (its CI)
|                cmdbId_Path              = any(cmdbId),
|                cmdbName_Path            = any(cmdbName),
|                cmdbCriticality_Path     = any(cmdbCriticality),
|                cmdbDataSensitivity_Path = any(cmdbDataSensitivity),
|
|                CredentialTypes_Path = make_set(tostring(CredentialLabel)),
|                TargetAssets_Path    = make_set(tostring(DataLocationNodeName)),
|                TotalIssues_Path     = count(),
|                TargetAssetId = any(TargetAssetId)
|              by
|                PathKey,
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                DataLocationNodeId;
|
|
|        // Step 10  Main summary counts stay correct
|        // cmdbCriticality + cmdbDataSensitivity in by-clause so cmdb-bucketed rows survive.
|        let SummaryMain =
|            CollapsedPaths
|            | summarize
|                ConfigurationId = strcat_array(array_sort_asc(make_set(strcat_array(CredentialTypes_Path, ";"))), ";"),
|
|                SecuritySeverity = any(SecuritySeverity_Path),
|                CriticalityTier = toint(any(TargetCriticalityTier_Path)),
|                CriticalityTierLevel = tostring(any(TargetCriticalityTierLevel_Path)),
|
|                RiskFactor_Consequence = 0,
|                RiskFactor_Probability = max(TargetRiskProb_Path),
|
|                AssetCount   = dcount(DataLocationNodeId),
|                TotalIssues  = sum(TotalIssues_Path),
|
|                ImpactedAssets = strcat_array(array_sort_asc(make_set(strcat_array(TargetAssets_Path, ";"))), ";"),
|                ImpactedAssetPairs = make_set(strcat(strcat_array(TargetAssets_Path, ";"), "|", tostring(TargetAssetId)))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|
|        // Step 11  Rebuild probability detail fields via split expand and re aggregation
|        let SummaryDetail =
|            CollapsedPaths
|            | extend _d = split(tostring(TargetRiskProbDetailed_Path), ";")
|            | mv-expand _d to typeof(string)
|            | extend _d = trim(" ", _d)
|            | where isnotempty(_d)
|            | summarize
|                RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(make_set(_d)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        let SummaryDetailScore =
|            CollapsedPaths
|            | extend _s = split(tostring(TargetRiskProbDetailedScore_Path), ";")
|            | mv-expand _s to typeof(string)
|            | extend _s = trim(" ", _s)
|            | where isnotempty(_s)
|            | summarize
|                RiskFactor_Probability_DetailedScore = strcat_array(array_sort_asc(make_set(_s)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|
|        // Step 12  Final output
|        SummaryMain
|        | join kind=leftouter SummaryDetail      on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        | join kind=leftouter SummaryDetailScore on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            SubCategory,
|            ConfigurationName,
|            ConfigurationId,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AssetCount,
|            TotalIssues,
|            ImpactedAssets, ImpactedAssetPairs
|        | order by
|            RiskScore_Weight_Factor desc,
|            RiskFactor_Probability desc,
|            CriticalityTier asc,
|            TotalIssues desc,
|            AssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, UniqueIssues, ImpactedAssetsList, ImpactedAssetIds, IssueList, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Detailed_Data_Sensitivity_to_Exposed_Credentials
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(IdentityNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(DataLocationNodeId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: Per-row detail of credential-driven attack paths to sensitive data locations prioritized by FINAL TARGET business impact.
|        EG drives path detection (ExposedCredential -> Identity -> DataLocation <- DataSensitivityScan) + scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  Exposed credentials enabling access to sensitive data locations using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify sensitive data locations and the credential driven attack paths that can reach them.
|        // The path shape is
|        // ExposedCredential -> Identity -> DataLocation <- DataSensitivityScan
|        // Results are enriched using the standard Nodes context and prioritized by the business impact of the
|        // FINAL TARGET which is the data location.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the TARGET criticality tier first
|        // - Then by tier escalation where source tier is higher than target tier
|        // - Then by internet exposure where target exposure is weighted higher than source exposure
|        // - A low tier credential source can never outrank a tier 0 or tier 1 target
|        //
|        // Output description detailed rows
|        // One row per unique ExposedCredential -> Identity -> DataLocation path enriched with
|        // - IsInternetExposed for credential source and target location
|        // - AssetTierByTag for source and target
|        // - LegacyEndOfSupport for source and target
|        // - RiskFactor probability fields including detailed breakdown for source and target
|        // - AttackPathPriorityScore and severity label
|        // - Human readable AttackPath and AttackPathDetailed strings
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone using standard context fields
|        // Step 2  Normalize labels for allowlists
|        // Step 3  Identify sensitive data locations from dataSensitivityScan edges
|        // Step 4  Identify identity access to data locations
|        // Step 5  Identify exposed credentials linked to identities and filter to credential allowlist
|        // Step 6  Assemble credential driven paths and de duplicate to stable grain
|        // Step 7  Enrich credential source identity and target location using Nodes
|        // Step 8  Apply standard prioritization logic and build attack path strings
|        // Step 9  Project detailed output columns and apply ordering
|        // =================================================================================================
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich attack paths
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(NodeProperties.rawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    NodeProperties.rawData.isCustomerFacing,
|                    NodeProperties.raw.isCustomerFacing,
|                    false
|                ))
|
|            | extend IsExcluded =
|                tobool(coalesce(
|                    NodeProperties.rawData.isExcluded,
|                    NodeProperties.raw.isExcluded,
|                    false
|                ))
|
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    NodeProperties.rawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | mv-apply rf = array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                ) on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize ScoreParts = make_set(strcat(tostring(rf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                NodeProperties,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|        // Step 2  Normalize labels to avoid typos breaking allowlists
|        let NormalizeLabel = (s:string) { tolower(trim(" ", replace_string(s, " ", ""))) };
|
|        // Step 3  Data location allowlist (normalized)
|        let DataLocationLabels =
|            dynamic([
|                "blobcontainer",
|                "microsoft.storage/storageaccounts",
|                "microsoft.sql/servers/databases",
|                "microsoft.sql/servers",
|                "microsoft.storage/storageaccounts/blobservices/containers",
|                "microsoft.storage/storageaccounts/fileservices/shares"
|            ]);
|
|        // Step 4  Credential allowlist (normalized)
|        let CredentialLabels =
|            dynamic([
|                "azure-storage-shared-access-signature",
|                "azure-storage-connection-string",
|                "azure-database-connection-string",
|                "azure-active-directory-app-secret",
|                "service-principal-azure-cli-secret",
|                "user-azure-cli-secret",
|                "azure-active-directory-user-credentials",
|                "entra-usercookie"
|            ]);
|
|        // Step 5  Find sensitive data locations
|        let SensitiveDataLocations =
|            ExposureGraphEdges
|            | extend TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where SourceNodeLabel == "dataSensitivityScan"
|            // #677 the slices are cut on the path's FINAL TARGET (TargetNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            | extend DeviceKey = TargetNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | where EdgeLabel in ("defined in", "contains")
|            | where TargetNodeLabelNorm in (DataLocationLabels)
|            | project
|                SensitiveDataNodeId   = SourceNodeId,
|                SensitiveDataNodeName = SourceNodeName,
|                DataLocationNodeId    = TargetNodeId,
|                DataLocationNodeName  = TargetNodeName,
|                DataLocationNodeLabel = TargetNodeLabel;
|
|        // Step 6  Identity -> data location access edges
|        // v2.2.419 (audit #56.2b) -- same bounding as the Summary sibling. This variant projects
|        // three extra identity columns, which is why it needs its own copy of these lets.
|        let _DsDataLocIds = SensitiveDataLocations | distinct DataLocationNodeId;
|        let IdentityAccessToData =
|            ExposureGraphEdges
|            | extend TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where EdgeLabel in ("has permissions to", "has role on", "can authenticate to", "has access to", "can access")
|            | where TargetNodeLabelNorm in (DataLocationLabels)
|            | where TargetNodeId in (_DsDataLocIds)
|            | project
|                IdentityNodeId     = SourceNodeId,
|                IdentityNodeName   = SourceNodeName,
|                IdentityNodeLabel  = SourceNodeLabel,
|                DataLocationNodeId = TargetNodeId;
|        let _DsIdentityIds = IdentityAccessToData | distinct IdentityNodeId;
|
|        // Step 7  Credential exposure edges (support both directions)
|        let ExposedCredentialsToIdentity =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "can authenticate as", "can authenticate to")
|            | project
|                CredentialNodeId    = SourceNodeId,
|                CredentialNodeName  = SourceNodeName,
|                CredentialNodeLabel = SourceNodeLabel,
|                IdentityNodeId      = TargetNodeId;
|
|        let IdentityToExposedCredentials =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "uses credential", "uses credentials", "authenticated by")
|            // v2.2.419 (#56.2b) -- identity is the SOURCE in this direction, so bound that end.
|            | where SourceNodeId in (_DsIdentityIds)
|            | project
|                IdentityNodeId      = SourceNodeId,
|                CredentialNodeId    = TargetNodeId,
|                CredentialNodeName  = TargetNodeName,
|                CredentialNodeLabel = TargetNodeLabel;
|
|        // Step 8  Union both forms and then filter credential types
|        let ExposedCreds =
|            union isfuzzy=true ExposedCredentialsToIdentity, IdentityToExposedCredentials
|            | extend CredentialNodeLabelNorm = NormalizeLabel(CredentialNodeLabel)
|            | where CredentialNodeLabelNorm in (CredentialLabels);
|
|        // Step 9  Assemble detailed paths and enrich source and target using Nodes
|        IdentityAccessToData
|        | join kind=inner SensitiveDataLocations on DataLocationNodeId
|        | join kind=inner ExposedCreds on IdentityNodeId
|        | summarize
|            SensitiveDataItems        = make_set(SensitiveDataNodeName),
|            SensitiveDataCount        = dcount(SensitiveDataNodeId),
|
|            CredentialNodeId          = any(CredentialNodeId),
|            CredentialName            = any(CredentialNodeName),
|            CredentialLabel           = any(CredentialNodeLabel),
|
|            ExposedCredentials        = make_set(CredentialNodeName),
|            ExposedCredentialTypes    = make_set(CredentialNodeLabel),
|            ExposedCredentialCount    = dcount(CredentialNodeId),
|
|            IdentityNodeId            = any(IdentityNodeId),
|            IdentityName              = any(IdentityNodeName),
|            IdentityLabel             = any(IdentityNodeLabel),
|
|            DataLocationNodeName      = any(DataLocationNodeName),
|            DataLocationNodeLabel     = any(DataLocationNodeLabel)
|          by DataLocationNodeId
|
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                TargetNodeId                = NodeId,
|                TargetNodeCiKey = NodeCiKey,
|                TargetRiskFactorSet = RiskFactorSet,
|                TargetNodeName              = NodeName,
|                TargetNodeLabel             = NodeLabel,
|                TargetCriticalityTier       = CriticalityTier,
|                TargetCriticalityTierLevel  = CriticalityTierLevel,
|                TargetCriticalityRuleBased  = CriticalityRuleBased,
|                TargetCriticalityRuleNames  = EgCriticalityRuleNames,
|                TargetIsInternetExposed     = IsInternetExposed,
|                TargetIsExcluded            = IsExcluded,
|                TargetAssetTierByTag        = AssetTierByTag,
|                TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                TargetRiskProb              = RiskFactor_Probability,
|                TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                TargetNodeProperties        = NodeProperties
|        ) on $left.DataLocationNodeId == $right.TargetNodeId
|
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                SourceNodeId                = NodeId,
|                SourceNodeCiKey = NodeCiKey,
|                SourceRiskFactorSet = RiskFactorSet,
|                SourceNodeName              = NodeName,
|                SourceNodeLabel             = NodeLabel,
|                SourceCriticalityTier       = CriticalityTier,
|                SourceCriticalityTierLevel  = CriticalityTierLevel,
|                SourceIsInternetExposed     = IsInternetExposed,
|                SourceIsExcluded            = IsExcluded,
|                SourceAssetTierByTag        = AssetTierByTag,
|                SourceLegacyEndOfSupport    = LegacyEndOfSupport,
|                SourceRiskProb              = RiskFactor_Probability,
|                SourceRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                SourceRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                SourceNodeProperties        = NodeProperties
|        ) on $left.IdentityNodeId == $right.SourceNodeId
|
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                CredentialNodeId_join       = NodeId,
|                CredentialNodeName_join     = NodeName,
|                CredentialNodeLabel_join    = NodeLabel,
|                CredentialIsInternetExposed = IsInternetExposed,
|                CredentialAssetTierByTag    = AssetTierByTag,
|                CredentialLegacyEndOfSupport= LegacyEndOfSupport,
|                CredentialRiskProb          = RiskFactor_Probability,
|                CredentialRiskProbDetailed  = RiskFactor_Probability_Detailed,
|                CredentialRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                CredentialNodeProperties    = NodeProperties
|        ) on $left.CredentialNodeId == $right.CredentialNodeId_join
|
|        // the SOURCE's CI (#505) -- tier (the EG criticality only where the CI has no tier) and the asset factors,
|        // the same way as the target. A source without a CI keeps its EG tier and has no asset factors.
|        | extend SourceRiskFactorSet = iff(isnull(SourceRiskFactorSet), dynamic([]), SourceRiskFactorSet)
|        // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|        // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|        // the keys its own rows have (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(IdentityNodeId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(DataLocationNodeId)))
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, Source_si_tier = peer_tier, Source_si_rf_p = peer_rf_p, Source_si_rf_names = peer_rf_names
|        | project-away _peerKey, peer_*
|        | extend SourceAssetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(IdentityNodeId))
|        | extend SourceCriticalityTier = toint(coalesce(Source_si_tier, SourceCriticalityTier))
|        | extend SourceCriticalityTierLevel = case(SourceCriticalityTier == 0, "Critical - tier 0", SourceCriticalityTier == 1, "High - tier 1", SourceCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|        | extend _srcIds = coalesce(Source_si_rf_p, dynamic([])), _srcNames = coalesce(Source_si_rf_names, dynamic([]))
|        | extend SourceIsInternetExposed = set_has_element(_srcIds, "internet_exposed"), SourceLegacyEndOfSupport = iff(set_has_element(_srcIds, "unsupported_os"), 1, 0)
|        | extend _srcRf = array_concat(SourceRiskFactorSet, _srcNames)
|        | extend SourceRiskProb = array_length(SourceRiskFactorSet) + array_length(_srcIds)
|        | extend SourceRiskProbDetailed = strcat_array(array_sort_asc(_srcRf), ";")
|        | mv-apply _rf = _srcRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _srcScore = make_set(strcat(_rf, "=1")))
|        | extend SourceRiskProbDetailedScore = strcat_array(array_sort_asc(_srcScore), ";")
|        | project-away _srcRf, _srcScore, _srcIds, _srcNames
|        // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|        // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(si_in_scope_, true)
|        | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(DataLocationNodeId))
|        | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|        | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|        | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|        // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|        // Step 10  Apply standard prioritization logic based on FINAL TARGET
|        | extend TierEscalation =
|            case(
|                isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier,
|                    SourceCriticalityTier - TargetCriticalityTier,
|                0
|            )
|        | extend IsLateralMovement = TierEscalation > 0
|        | extend LateralMovementType =
|            case(
|                TierEscalation >= 3, "Privilege escalation large tier jump",
|                TierEscalation == 2, "Privilege escalation two tiers",
|                TierEscalation == 1, "Privilege escalation one tier",
|                "Direct access same tier"
|            )
|
|        | extend TargetTierWeight =
|            case(
|                TargetCriticalityTier == 0, 100,
|                TargetCriticalityTier == 1, 60,
|                TargetCriticalityTier == 2, 30,
|                10
|            )
|        | extend EscalationWeight = TierEscalation * 10
|        | extend ExposureWeight   = iff(TargetIsInternetExposed == true, 8, 0) + iff(SourceIsInternetExposed == true, 3, 0)
|        | extend SourceTierAmplifier =
|            case(
|                SourceCriticalityTier == 0, 8,
|                SourceCriticalityTier == 1, 5,
|                SourceCriticalityTier == 2, 2,
|                0
|            )
|        | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|
|        | extend AttackPathPriority =
|            case(
|                AttackPathPriorityScore >= 90,  "Very High",
|                AttackPathPriorityScore >= 60,  "High",
|                AttackPathPriorityScore >= 30,  "Medium-High",
|                AttackPathPriorityScore >= 15,  "Medium",
|                "Low"
|            )
|
|        | extend InternetExposureTarget = iff(TargetIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|        | extend InternetExposureSource = iff(SourceIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|
|        | extend SecurityDomain = "Azure"
|        | extend Category = "Attack Paths"
|        | extend Subcategory = "SensitiveDataExposure"
|
|        // Step 11  Human readable paths
|        | extend AttackPath =
|            strcat(
|                CredentialLabel, " [", CredentialName, "] -> ",
|                IdentityLabel, " [", IdentityName, "] -> ",
|                DataLocationNodeLabel, " [", DataLocationNodeName, "]"
|            )
|
|        | extend AttackPathDetailed =
|            strcat(
|                "CREDENTIAL ", CredentialLabel, " [", CredentialName, "] ",
|                iff(ExposedCredentialCount > 1, strcat("| + ", tostring(ExposedCredentialCount - 1), " other credential(s) "), ""),
|                "-> IDENTITY ", IdentityLabel, " [", IdentityName, "] ",
|                "tier ", tostring(SourceCriticalityTier), " ", tostring(SourceCriticalityTierLevel), " | ", InternetExposureSource,
|                " -> TARGET ", DataLocationNodeLabel, " [", DataLocationNodeName, "] ",
|                "tier ", tostring(TargetCriticalityTier), " ", tostring(TargetCriticalityTierLevel), " | ", InternetExposureTarget,
|                " | escalation ", tostring(TierEscalation),
|                " | ", LateralMovementType,
|                " | sensitive items ", tostring(SensitiveDataCount)
|            )
|
|        // Per-row identity columns expected by engine dedup (AssetName, ConfigurationName/Id).
|        // ConfigurationId carries the FINAL TARGET id (DataLocationNodeId) so (AssetName, ConfigurationId) is unique per row.
|        | extend
|            AssetName              = DataLocationNodeName,
|            AssetLabel             = DataLocationNodeLabel,
|            ConfigurationName      = tostring(LateralMovementType),
|            ConfigurationId        = tostring(DataLocationNodeId),
|            SecuritySeverity       = tostring(AttackPathPriority),
|            Impact                 = todouble(AttackPathPriorityScore),
|            CriticalityTier        = TargetCriticalityTier,
|            CriticalityTierLevel   = TargetCriticalityTierLevel,
|            RiskFactor_Consequence = 0,
|            RiskFactor_Probability = TargetRiskProb,
|            RiskFactor_Probability_Detailed      = TargetRiskProbDetailed,
|            RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|
|        // Step 12  Final projection detailed output
|        | project
|            SecurityDomain,
|            Category,
|            Subcategory,
|            ConfigurationName,
|            ConfigurationId,
|            AssetName,
|            AssetId=coalesce(column_ifexists("AssetId", ""), column_ifexists("TargetAssetId", ""), column_ifexists("ConfigurationId", "")),
|            AssetType=coalesce(column_ifexists("AssetType", ""), column_ifexists("AssetLabel", ""), "Azure"),
|            Impact,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AttackPath,
|            AttackPathDetailed,
|            AttackPathPriority,
|            AttackPathPriorityScore,
|            TierEscalation,
|            IsLateralMovement,
|            LateralMovementType,
|            EscalationWeight,
|            ExposureWeight,
|            DataLocationNodeId,
|            DataLocationNodeName,
|            DataLocationNodeLabel,
|            SensitiveDataCount,
|            SensitiveDataItems,
|            CredentialNodeId,
|            CredentialName,
|            CredentialLabel,
|            ExposedCredentialCount,
|            ExposedCredentials,
|            ExposedCredentialTypes,
|            IdentityNodeId,
|            IdentityName,
|            IdentityLabel,
|            TargetAssetTierByTag,
|            TargetIsInternetExposed,
|            TargetLegacyEndOfSupport,
|            TargetCriticalityRuleBased,
|            TargetCriticalityRuleNames,
|            SourceCriticalityTier,
|            SourceCriticalityTierLevel,
|            SourceAssetTierByTag,
|            SourceIsInternetExposed,
|            SourceLegacyEndOfSupport,
|            SourceRiskProb,
|            SourceRiskProbDetailed,
|            SourceRiskProbDetailedScore,
|            CredentialIsInternetExposed,
|            CredentialAssetTierByTag,
|            CredentialLegacyEndOfSupport,
|            CredentialRiskProb,
|            CredentialRiskProbDetailed,
|            CredentialRiskProbDetailedScore,
|            SourceNodeProperties,
|            TargetNodeProperties,
|            CredentialNodeProperties
|
|        | order by RiskScore_Weight_Factor desc, AttackPathPriorityScore desc, TierEscalation desc, CriticalityTier asc, DataLocationNodeName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|
|    - ReportName: Attack_Paths_Summary_Credential_Based_Lateral_Movement
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(FirstSourceAssetId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: Credential-driven lateral-movement paths to Azure and Endpoint targets prioritized by FINAL TARGET business impact.
|        EG provides path detection (SourceAsset -> Credential -> Identity -> AzureTarget) + scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - UniqueIssues
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - IssueList
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  Credential driven lateral movement paths to Azure and Endpoint targets using Exposure Graph
|        // Bucketing applied to the Hop 2 edges on the FINAL TARGET (#677) - each path in exactly one slice
|        // =================================================================================================
|
|        // Step 0  Legacy OS definitions for probability scoring
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Credential edges (not sliced since #677 -- every source of a credential is needed in its slice)
|        // EdgeLabel + SourceNodeLabel + TargetNodeLabel filters narrow the set BEFORE bucketing
|        // (the slice key is the Hop 2 TargetNodeId, the path's final target, see Step 3)
|        let CredentialEdges =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("contains", "defined in", "runs on", "has credentials of")
|            // #690 every credential the graph holds, wherever it sits -- a node of the secret category, or one of the credential
|            // labels below, compared case-insensitively (the graph writes entra-userCookie -- the exact-case entra-usercookie
|            // lost every session-cookie path). No list of source kinds -- the asset a credential sits on is the path's source,
|            // whatever its kind (the fixed lists reached 32 of 97 targets on a live install).
|            | where set_has_element(TargetNodeCategories, "secret") or TargetNodeLabel in~ (
|                "azure-active-directory-app-secret",
|                "user-azure-cli-secret",
|                "azure-storage-shared-access-signature",
|                "azure-storage-connection-string",
|                "azure-database-connection-string",
|                "azure-active-directory-user-credentials",
|                "service-principal-azure-cli-secret",
|                "entra-userCookie",
|                "lsa-secret",
|                "github-personal-access-token",
|                "azure-app-configuration-key",
|                "certificate",
|                "openai-api-key"
|            )
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|            | project
|                SourceNodeId, SourceNodeName, SourceNodeLabel,
|                TargetNodeId, TargetNodeName, TargetNodeLabel,
|                EdgeLabel;
|
|        // Step 2  Hop 1 edges -- BOUND to the credentials found in Step 1.
|        // v2.2.417 -- this previously claimed "no bucketing needed, naturally constrained by
|        // downstream join to CredentialEdges". That premise is FALSE. A join constrains the
|        // RESULT, not the SCAN -- Kusto still materialises every "has credentials of" /
|        // "can authenticate as" / "can authenticate to" edge in the tenant and only then
|        // discards non-matches. So this hop set never shrank, with or without bucketing, and
|        // the Step 7 inner joins exploded on hub identities (inbound x outbound edges). No
|        // bucket depth can split that, because a hub is a SINGLE node -- which is why
|        // sub-bucketing bisected forever with 3 of 4 children returning 0 rows in ~5s.
|        // The semi-join below removes EXACTLY the rows the Step 7 inner join would discard
|        // (CredentialsOnAssets groups by CredentialNodeId = CredentialEdges.TargetNodeId), so
|        // it is provably lossless -- and it makes bucketing actually work, because the hop set
|        // now shrinks WITH the bucket instead of staying tenant-wide.
|        let Hop1Edges =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("has credentials of", "can authenticate as", "can authenticate to")
|            | where SourceNodeId in (CredentialEdges | distinct TargetNodeId)
|            | project
|                SourceNodeId, SourceNodeName, SourceNodeLabel,
|                TargetNodeId, TargetNodeName, TargetNodeLabel,
|                EdgeLabel;
|
|        // Step 3  Hop 2 edges -- BOUND to the identities reached in Step 2.
|        // Same defect and same lossless remedy as Step 2. This set is the more dangerous of the
|        // two, because its TargetNodeLabel list includes "subscriptions" and "resourcegroups" --
|        // node types that legitimately carry thousands of inbound edges -- so leaving it
|        // tenant-wide is what turned the Step 7 join into a cartesian product on hub nodes.
|        let Hop2Edges =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("can authenticate to", "runs on", "has permissions to", "has role on")
|            // #690 every Azure resource the identity reaches (any microsoft.* type, startswith ignores case), the subscription and
|            // resource group scopes, devices and blob containers -- the fixed list of 21 types left out container registries,
|            // network interfaces, locks, ...
|            | where TargetNodeLabel startswith "microsoft." or TargetNodeLabel in~ ("subscriptions", "resourcegroups", "device", "computer-account", "BlobContainer")
|            | where SourceNodeId in (Hop1Edges | distinct TargetNodeId)
|            // #677 the slices are cut on the path's FINAL TARGET (TargetNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            | extend DeviceKey = TargetNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | project
|                SourceNodeId, SourceNodeName, SourceNodeLabel,
|                TargetNodeId, TargetNodeName, TargetNodeLabel,
|                EdgeLabel;
|
|        // Step 4  Identify credentials on source assets
|        let CredentialsOnAssets =
|            CredentialEdges
|            | summarize
|                SourceAssets          = make_set(SourceNodeName),
|                SourceAssetTypes      = make_set(SourceNodeLabel),
|                SourceAssetCount      = dcount(SourceNodeId),
|                FirstSourceAssetId    = min(SourceNodeId),
|                FirstSourceAssetName  = any(SourceNodeName),
|                FirstSourceAssetLabel = any(SourceNodeLabel),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                CredentialNodeId  = TargetNodeId,
|                CredentialName    = TargetNodeName,
|                CredentialLabel   = TargetNodeLabel;
|
|        // Step 5  Hop 1 -- credential authenticates as identity
|        let Hop1 =
|            Hop1Edges
|            | project
|                CredentialNodeId          = SourceNodeId,
|                Hop1_EdgeLabel            = EdgeLabel,
|                IntermediateIdentityId    = TargetNodeId,
|                IntermediateIdentity      = TargetNodeName,
|                IntermediateIdentityLabel = TargetNodeLabel;
|
|        // Step 6  Hop 2 -- identity reaches target resource
|        let Hop2 =
|            Hop2Edges
|            | project
|                Hop2_SourceIdentityId = SourceNodeId,
|                Hop2_EdgeLabel        = EdgeLabel,
|                FinalTargetId         = TargetNodeId,
|                FinalTargetName       = TargetNodeName,
|                FinalTargetLabel      = TargetNodeLabel;
|
|        // Step 7  Assemble and stabilize paths
|        let Paths =
|            CredentialsOnAssets
|            | join kind=inner (Hop1) on CredentialNodeId
|            | join kind=inner (Hop2) on $left.IntermediateIdentityId == $right.Hop2_SourceIdentityId
|            | where FirstSourceAssetId != FinalTargetId
|            | summarize
|                FirstSourceAssetName      = any(FirstSourceAssetName),
|                FirstSourceAssetLabel     = any(FirstSourceAssetLabel),
|                CredentialName            = any(CredentialName),
|                CredentialLabel           = any(CredentialLabel),
|                IntermediateIdentity      = any(IntermediateIdentity),
|                IntermediateIdentityLabel = any(IntermediateIdentityLabel),
|                Hop1Edge                  = any(Hop1_EdgeLabel),
|                Hop2Edge                  = any(Hop2_EdgeLabel),
|                FinalTargetName           = any(FinalTargetName),
|                FinalTargetLabel          = any(FinalTargetLabel),
|                SourceAssets              = any(SourceAssets),
|                SourceAssetTypes          = any(SourceAssetTypes),
|                SourceAssetCount          = any(SourceAssetCount),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                FirstSourceAssetId,
|                CredentialNodeId,
|                IntermediateIdentityId,
|                FinalTargetId;
|
|        // Step 8  Collect node IDs that need enrichment
|        let EnrichIds =
|            union
|                (Paths | project NodeId = FirstSourceAssetId),
|                (Paths | project NodeId = CredentialNodeId),
|                (Paths | project NodeId = IntermediateIdentityId),
|                (Paths | project NodeId = FinalTargetId)
|            | where isnotempty(tostring(column_ifexists("NodeId", "")))
|            | summarize by NodeId;
|
|        // Step 9  Enrich only the nodes actually used in paths
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds | project NodeId)
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(RawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    RawData.isCustomerFacing,
|                    Raw.isCustomerFacing,
|                    false
|                ))
|            | extend IsExcluded =
|                tobool(coalesce(
|                    RawData.isExcluded,
|                    Raw.isExcluded,
|                    false
|                ))
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            // #690 a node without a tier tag keeps no tier (an empty level) -- never shown as tier 3
|            | extend CriticalityTier = toint(CriticalityTierFromTag)
|            | extend CriticalityTierLevel =
|                case(
|                    isnull(CriticalityTier), "",
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    RawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|            | extend _ScoreFactors =
|                array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                )
|            | mv-apply sf = _ScoreFactors on (
|                where isnotempty(trim(" ", tostring(sf)))
|                | summarize ScoreParts = make_set(strcat(tostring(sf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName              = NodeNameNorm,
|                NodeLabel,
|                CriticalityTier,
|                CriticalityTierLevel,
|                IsInternetExposed,
|                IsExcluded,
|                EgNodeTags,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|        // Step 10  Enrich paths with node metadata
|        let Detailed =
|            Paths
|            | join kind=leftouter (
|                Nodes
|                | project
|                    SourceNodeId                = NodeId,
|                    SourceNodeCiKey = NodeCiKey,
|                    SourceRiskFactorSet = RiskFactorSet,
|                    SourceCriticalityTier       = CriticalityTier,
|                    SourceCriticalityTierLevel  = CriticalityTierLevel,
|                    SourceIsInternetExposed     = IsInternetExposed,
|                    SourceIsExcluded            = IsExcluded,
|                    SourceAssetTierByTag        = AssetTierByTag,
|                    SourceLegacyEndOfSupport    = LegacyEndOfSupport,
|                    SourceRiskProb              = RiskFactor_Probability,
|                    SourceRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    SourceRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|              ) on $left.FirstSourceAssetId == $right.SourceNodeId
|            | join kind=leftouter (
|                Nodes
|                | project
|                    IntermediateNodeId                = NodeId,
|                    IntermediateCriticalityTier       = CriticalityTier,
|                    IntermediateCriticalityTierLevel  = CriticalityTierLevel,
|                    IntermediateIsInternetExposed     = IsInternetExposed,
|                    IntermediateLegacyEndOfSupport    = LegacyEndOfSupport,
|                    IntermediateRiskProb              = RiskFactor_Probability,
|                    IntermediateRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    IntermediateRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|              ) on $left.IntermediateIdentityId == $right.IntermediateNodeId
|            | join kind=leftouter (
|                Nodes
|                | project
|                    TargetNodeId                = NodeId,
|                    TargetNodeCiKey = NodeCiKey,
|                    TargetRiskFactorSet = RiskFactorSet,
|                    TargetCriticalityTier       = CriticalityTier,
|                    TargetCriticalityTierLevel  = CriticalityTierLevel,
|                    TargetIsInternetExposed     = IsInternetExposed,
|                    TargetIsExcluded            = IsExcluded,
|                    TargetAssetTierByTag        = AssetTierByTag,
|                    TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                    TargetRiskProb              = RiskFactor_Probability,
|                    TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|              ) on $left.FinalTargetId == $right.TargetNodeId
|            // the SOURCE's CI (#505) -- tier (the EG criticality only where the CI has no tier) and the asset factors,
|            // the same way as the target. A source without a CI keeps its EG tier and has no asset factors.
|            | extend SourceRiskFactorSet = iff(isnull(SourceRiskFactorSet), dynamic([]), SourceRiskFactorSet)
|            // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|            // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|            // the keys its own rows have (the report field LookupNeededKeys).
|            //__SI_LOOKUP_KEYS_HERE__
|            | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(FirstSourceAssetId)))
|            | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|            | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|            | extend Source_si_ci_id = peer_ci_id, Source_si_tier = peer_tier, Source_si_rf_p = peer_rf_p, Source_si_rf_names = peer_rf_names
|            | project-away _peerKey, peer_*
|            | extend SourceAssetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(FirstSourceAssetId))
|            | extend SourceCriticalityTier = toint(coalesce(Source_si_tier, SourceCriticalityTier))
|            | extend SourceCriticalityTierLevel = case(isnull(SourceCriticalityTier), "", SourceCriticalityTier == 0, "Critical - tier 0", SourceCriticalityTier == 1, "High - tier 1", SourceCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend _srcIds = coalesce(Source_si_rf_p, dynamic([])), _srcNames = coalesce(Source_si_rf_names, dynamic([]))
|            | extend SourceIsInternetExposed = set_has_element(_srcIds, "internet_exposed"), SourceLegacyEndOfSupport = iff(set_has_element(_srcIds, "unsupported_os"), 1, 0)
|            | extend _srcRf = array_concat(SourceRiskFactorSet, _srcNames)
|            | extend SourceRiskProb = array_length(SourceRiskFactorSet) + array_length(_srcIds)
|            | extend SourceRiskProbDetailed = strcat_array(array_sort_asc(_srcRf), ";")
|            | mv-apply _rf = _srcRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _srcScore = make_set(strcat(_rf, "=1")))
|            | extend SourceRiskProbDetailedScore = strcat_array(array_sort_asc(_srcScore), ";")
|            | project-away _srcRf, _srcScore, _srcIds, _srcNames
|            // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|            // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|            | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|            | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|            | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                     si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|            | project-away _peerKey, peer_*
|            | where coalesce(si_in_scope_, true)
|            | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(FinalTargetId))
|            | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|            | extend TargetCriticalityTierLevel = case(isnull(TargetCriticalityTier), "", TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|            // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|            | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|            | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|            | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|            | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|            | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|            | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|            | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|            | project-away _tgtRf, _tgtScore
|            | extend
|                cmdbId            = si_cmdb_id,
|                cmdbName            = si_cmdb_name,
|                cmdbCriticality     = si_cmdb_criticality,
|                cmdbDataSensitivity = si_cmdb_data_sensitivity
|            | extend TierEscalation =
|                case(
|                    isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier)
|                        and SourceCriticalityTier > TargetCriticalityTier,
|                        SourceCriticalityTier - TargetCriticalityTier,
|                    0
|                )
|            | extend LateralMovementType =
|                case(
|                    isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|                    TierEscalation >= 3, "Privilege escalation large tier jump",
|                    TierEscalation == 2, "Privilege escalation two tiers",
|                    TierEscalation == 1, "Privilege escalation one tier",
|                    "Direct access same tier"
|                )
|            | extend TargetTierWeight =
|                case(
|                    TargetCriticalityTier == 0, 100,
|                    TargetCriticalityTier == 1, 60,
|                    TargetCriticalityTier == 2, 30,
|                    10
|                )
|            | extend EscalationWeight    = TierEscalation * 10
|            | extend ExposureWeight      = iff(TargetIsInternetExposed == true, 8, 0)
|                                         + iff(SourceIsInternetExposed == true, 3, 0)
|            | extend SourceTierAmplifier =
|                case(
|                    SourceCriticalityTier == 0, 8,
|                    SourceCriticalityTier == 1, 5,
|                    SourceCriticalityTier == 2, 2,
|                    0
|                )
|            | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|            | extend AttackPathPriority =
|                case(
|                    AttackPathPriorityScore >= 90, "Very High",
|                    AttackPathPriorityScore >= 60, "High",
|                    AttackPathPriorityScore >= 30, "Medium-High",
|                    AttackPathPriorityScore >= 15, "Medium",
|                    "Low"
|                )
|            | project
|                AttackPathPriority,
|                AttackPathPriorityScore,
|                TierEscalation,
|                LateralMovementType,
|                FirstSourceAssetId,
|                FirstSourceAssetName,
|                FirstSourceAssetLabel,
|                IntermediateIdentityId,
|                IntermediateIdentity,
|                IntermediateIdentityLabel,
|                CredentialNodeId,
|                CredentialName,
|                CredentialLabel,
|                FinalTargetId,
|                FinalTargetName,
|                FinalTargetLabel,
|                TargetCriticalityTier,
|                TargetCriticalityTierLevel,
|                TargetAssetTierByTag,
|                TargetIsInternetExposed,
|                TargetLegacyEndOfSupport,
|                TargetRiskProb              = coalesce(TargetRiskProb, 0),
|                TargetRiskProbDetailed      = coalesce(TargetRiskProbDetailed, ""),
|                TargetRiskProbDetailedScore = coalesce(TargetRiskProbDetailedScore, ""),
|                SourceCriticalityTier,
|                SourceCriticalityTierLevel,
|                SourceIsInternetExposed,
|                SourceLegacyEndOfSupport,
|                SourceRiskProb              = coalesce(SourceRiskProb, 0),
|                SourceRiskProbDetailed      = coalesce(SourceRiskProbDetailed, ""),
|                SourceRiskProbDetailedScore = coalesce(SourceRiskProbDetailedScore, ""),
|                SourceAssetCount,
|                SourceAssets,
|                SourceAssetTypes,
|                Hop1Edge,
|                Hop2Edge,
|                cmdbId,
|                cmdbName,
|                cmdbCriticality,
|                cmdbDataSensitivity,
|                TargetAssetId;
|
|        // Step 11  Collapse to unique logical path key
|        let CollapsedPaths =
|            Detailed
|            | extend PathKey = strcat(FirstSourceAssetId, "->", IntermediateIdentityId, "->", FinalTargetId)
|            | extend SecurityDomain = "Azure"
|            | extend
|                Category               = "Attack Paths",
|                SubCategory            = "LateralMovement",
|                ConfigurationName      = tostring(LateralMovementType),
|                SecuritySeverity       = tostring(AttackPathPriority),
|                RiskFactor_Consequence = 0
|            | summarize
|                SecuritySeverity_Path            = any(SecuritySeverity),
|                TargetCriticalityTier_Path       = any(TargetCriticalityTier),
|                TargetCriticalityTierLevel_Path  = any(TargetCriticalityTierLevel),
|                TargetRiskProb_Path              = max(TargetRiskProb),
|                TargetRiskProbDetailed_Path      = any(TargetRiskProbDetailed),
|                TargetRiskProbDetailedScore_Path = any(TargetRiskProbDetailedScore),
|                // the FINAL TARGET's CMDB values (its CI)
|                cmdbId_Path              = any(cmdbId),
|                cmdbName_Path            = any(cmdbName),
|                cmdbCriticality_Path             = any(cmdbCriticality),
|                cmdbDataSensitivity_Path         = any(cmdbDataSensitivity),
|                CredentialLabels_Path            = make_set(tostring(CredentialLabel)),
|                SourceAssets_Path                = make_set(tostring(FirstSourceAssetName)),
|                // TargetAssets_Path is what AssetCount (dcount(FinalTargetId)) actually counts --
|                // the Azure resources under attack. ImpactedAssets below uses this so the
|                // asset-count and the asset-names match the same entity (targets).
|                TargetAssets_Path                = make_set(tostring(FinalTargetName)),
|                TotalIssues_Path                 = count(),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                PathKey,
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                FinalTargetId;
|
|        // Step 12  Summarize to report grain
|        // cmdbCriticality + cmdbDataSensitivity in by-clause so cmdb-bucketed rows survive.
|        let SummaryMain =
|            CollapsedPaths
|            | summarize
|                ConfigurationId        = strcat_array(array_sort_asc(make_set(strcat_array(CredentialLabels_Path, ";"))), ";"),
|                SecuritySeverity       = any(SecuritySeverity_Path),
|                CriticalityTier        = toint(any(TargetCriticalityTier_Path)),
|                CriticalityTierLevel   = tostring(any(TargetCriticalityTierLevel_Path)),
|                RiskFactor_Consequence = 0,
|                RiskFactor_Probability = max(TargetRiskProb_Path),
|                AssetCount             = dcount(FinalTargetId),
|                TotalIssues            = sum(TotalIssues_Path),
|                ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat_array(TargetAssets_Path, ";"))), ";"),
|                ImpactedAssetPairs = make_set(strcat(strcat_array(TargetAssets_Path, ";"), "|", tostring(AssetId))),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        // Step 13  Flatten probability detail strings
|        let SummaryDetail =
|            CollapsedPaths
|            | extend _d = split(tostring(TargetRiskProbDetailed_Path), ";")
|            | mv-expand _d to typeof(string)
|            | extend _d = trim(" ", _d)
|            | where isnotempty(_d)
|            | summarize RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(make_set(_d)), ";")
|              by SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId_Path, cmdbName_Path, cmdbCriticality_Path, cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        let SummaryDetailScore =
|            CollapsedPaths
|            | extend _s = split(tostring(TargetRiskProbDetailedScore_Path), ";")
|            | mv-expand _s to typeof(string)
|            | extend _s = trim(" ", _s)
|            | where isnotempty(_s)
|            | summarize RiskFactor_Probability_DetailedScore = strcat_array(array_sort_asc(make_set(_s)), ";")
|              by SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId_Path, cmdbName_Path, cmdbCriticality_Path, cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        // Step 14  Final output
|        SummaryMain
|        | join kind=leftouter SummaryDetail      on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        | join kind=leftouter SummaryDetailScore on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            SubCategory,
|            ConfigurationName,
|            ConfigurationId,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AssetCount,
|            TotalIssues,
|            ImpactedAssets, ImpactedAssetPairs
|        | order by
|            RiskScore_Weight_Factor desc,
|            RiskFactor_Probability desc,
|            CriticalityTier asc,
|            TotalIssues desc,
|            AssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, UniqueIssues, ImpactedAssetsList, ImpactedAssetIds, IssueList, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_Device_with_high_severity_vulnerabilities_allows_lateral_movement_Azure
|      # v2.2.418 -- per-report bucket FLOOR. On 2026-08-10 this report hit the 900s
|      # ceiling on bucket 2 of 2 and only completed through the sub-bucket recovery
|      # pass (~640s extra); the 4 children then returned in 105-286s each. That is the
|      # signature of a partition that is simply too coarse, not of a broken query.
|      # 🔑 Deliberately NOT the #56 semi-join treatment. That fix was provably lossless
|      # because the credential report is a chain of INNER JOINS, so bounding a hop only
|      # removed rows the join would discard anyway. This report is a real graph
|      # traversal -- `[bridge*0..3]` and `[inherit*0..2]` carry NO node predicates, so
|      # paths may legitimately pass through nodes outside RelevantNodes. Restricting
|      # the edge set here would silently DROP valid attack paths. Wrong tool.
|      # The engine ignores a cached count below this floor and re-probes from it
|      # (RA-AutoBucketing.ps1 ~:634), and AutoBucket may still escalate above it.
|      # BucketCount is metadata, not query text, so the query hash is unchanged.
|      BucketCount: 8
|      crossDomainBucketCoalesce:
|      # Source-device CL key drives the EG-side partition: the bucket filter sits on
|      # the VulnerableDevices source-node scan (the hot path before make-graph), and
|      # its AadDeviceId equals _SourceCmdb.Source_AadDeviceId for matched rows.
|      - ClColumn: Source_AadDeviceId
|        EgNativeKey: AadDeviceId
|      # Target Azure CL key is enriched downstream (post graph-match); declare it so
|      # the engine does not fall back to EG-filter suppression for this report.
|      - ClColumn: Target_AzureResourceId_Guid
|      ReportPurpose: Vulnerable-device-to-Azure-target attack paths prioritized by FINAL TARGET business impact.
|        EG provides path detection (VulnerableDevice -> Credential -> Identity -> AzureTarget) + scoring + tier;
|        the CI (SI_CI_CL, requirement 505) contributes the target asset's tier, risk factors and CMDB values (cmdbName, cmdbCriticality, cmdbDataSensitivity)
|        joined on the FINAL TARGET through the CI link key (_ciKey).
|      # v2.2.305 -- BucketCount removed; let AutoBucket calculate from default
|      # (2) and escalate only if needed. Graph-match shape doesn't cartesian-
|      # explode like the v2.2.277 4-hop join chain did, so the pre-set 64 is
|      # wasteful (~35s overhead per empty bucket).
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // v2.2.306 -- Summary variant of the graph-match shape used by the Detailed
|        // sibling. Same make-graph + graph-match traversal; instead of one row per
|        // (entry-device, target) path the output aggregates by (Subcategory, cmdb*)
|        // bucket. Bucket placeholder is INSIDE VulnerableDevices (before make-graph)
|        // so partitioning shrinks the graph SEED, not just the output rows.
|        //
|        // #505 -- GRAPH-ONLY PATH, CI END ASSET. The path (device -> credential / identity -> role -> Azure
|        // resource) is an Exposure Graph walk no SI field can express, so it stays a provider query. The
|        // analyzed asset is the ENTRY DEVICE, and its tier, CMDB values and asset risk factors (internet
|        // exposed, unsupported OS) come from its CI through _ciLink, keyed on the Defender device id
|        // (EG EntityIds SenseDeviceId), else the EG node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|
|        let VulnerableDevices = ExposureGraphNodes
|        | where set_has_element(Categories, "device")
|        // v2.2.420 (audit #57.1b) -- hedged across property paths. This gates the vulnerable-device attack
|        // paths, so a silent miss here reports "no attack paths" rather than "the source data moved".
|        | where tobool(coalesce(NodeProperties.rawData.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                NodeProperties.raw.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                NodeProperties.highRiskVulnerabilityInsights.hasHighOrCritical)) == true
|        // DeviceKey = the CI link key (Defender device id, else the EG node id), so the EG partition and the
|        // CI side bucket alike.
|        | extend _ids = tostring(EntityIds)
|        | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|        | extend DeviceKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(NodeId))
|        // Source-side bucket filter -- partitions 1M-device tenants BEFORE make-graph.
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | project NodeId, NodeName, NodeLabel, Categories, NodeProperties, DeviceKey;
|        let Identities = ExposureGraphNodes
|        | where set_has_element(Categories, "identity")
|        | project NodeId, NodeName, NodeLabel, Categories;
|        let Credentials = ExposureGraphNodes
|        | where set_has_element(Categories, "secret")
|        | project NodeId, NodeName, NodeLabel, Categories;
|        let AzureNodes = ExposureGraphNodes
|        | where set_has_element(Categories, "environmentAzure")
|        | project NodeId, NodeName, NodeLabel, Categories;
|        // #401 -- ONE node per NodeId. An Azure VM with a vulnerable device record is in VulnerableDevices
|        // AND in AzureNodes (without NodeProperties); make-graph keeps an arbitrary one of two rows with the
|        // same id. The vulnerable-device row wins.
|        let RelevantNodes = union VulnerableDevices, (union Credentials, Identities, AzureNodes | join kind=leftanti (VulnerableDevices | project NodeId) on NodeId);
|
|        // Source-device EG signals -- the count of EG riskFactors[] on the device (a report-scoped factor).
|        // Joined post-graph-match on EntryPointDeviceId == NodeId.
|        let _DeviceEnrichment = VulnerableDevices
|        | extend RawData = todynamic(NodeProperties).rawData
|        | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, todynamic(NodeProperties).risk.riskFactors, dynamic([])))
|        | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|        | mv-apply rf = RiskFactorsArray on (
|            where isnotempty(trim(" ", tostring(rf)))
|            | summarize RiskFactorSet = make_set(tostring(rf))
|          )
|        | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|        | project NodeId, DeviceKey, RiskFactorSet;
|
|        // #690 the target labels as the Exposure Graph writes them, compared case-insensitively -- the graph labels a subscription
|        // node "subscriptions" (the ARM type microsoft.resources/subscriptions is kept for a graph that writes it). Matching the
|        // ARM type only left every subscription path out (23 of 135 paths on a live install).
|        let _Paths = ExposureGraphEdges
|        | where EdgeLabel in~ (
|            "contains",
|            "has credentials of", "frequently logged in by",
|            "can authenticate as",
|            "member of",
|            "has role on"
|          )
|        | make-graph SourceNodeId --> TargetNodeId with RelevantNodes on NodeId
|        | graph-match (Device)-[devEdge]->(CredOrIdent)-[bridge*0..3]->(Principal)-[role]->(RoleScope)-[inherit*0..2]->(AzureAsset)
|            where set_has_element(Device.Categories, "device")
|              and tobool(coalesce(Device.NodeProperties.rawData.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                  Device.NodeProperties.raw.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                  Device.NodeProperties.highRiskVulnerabilityInsights.hasHighOrCritical)) == true
|              and (set_has_element(CredOrIdent.Categories, "secret") or set_has_element(CredOrIdent.Categories, "identity"))
|              and set_has_element(AzureAsset.Categories, "environmentAzure")
|              and (AzureAsset.NodeLabel =~ "microsoft.storage/storageaccounts" or (RoleScope.NodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups") and AzureAsset.NodeLabel startswith "microsoft." and not(AzureAsset.NodeLabel startswith "microsoft.resources/") and not(AzureAsset.NodeLabel startswith "microsoft.authorization/")))
|              and devEdge.EdgeLabel in~ ("contains", "has credentials of", "frequently logged in by")
|              and role.EdgeLabel =~ "has role on"
|            project
|                EntryPointDeviceId = Device.NodeId,
|                EntryPointDevice   = Device.NodeName,
|                MaxCvssScore       = todouble(Device.NodeProperties.rawData.highRiskVulnerabilityInsights.maxCvssScore),
|                FirstHopLabel      = CredOrIdent.NodeLabel,
|                DeviceEdge         = devEdge.EdgeLabel,
|                TargetAzureAssetId = AzureAsset.NodeId,
|                TargetAzureAsset   = AzureAsset.NodeName,
|                TargetLabel        = AzureAsset.NodeLabel
|        | extend TargetType = case(
|            TargetLabel =~ "microsoft.storage/storageaccounts", "Storage account",
|            "Azure resource")
|        | extend AttackPathName = strcat(
|            "Device with high severity vulnerabilities allows lateral movement to Azure ",
|            iff(TargetType == "Storage account", "storage account", "resource"));
|
|        _Paths
|        | join kind=leftouter (_DeviceEnrichment) on $left.EntryPointDeviceId == $right.NodeId
|        // #505 -- the ENTRY DEVICE's CI (the analyzed asset), by the Defender device id or EG node id
|        | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|        | where coalesce(si_in_scope_, true)
|        // report-scoped factor -- the count of EG risk factors on the device
|        | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend Source_RiskFactor_Probability = coalesce(RF_P_RiskFactorsCount, 0) + array_length(RF_P_CiFactors)
|        | extend Source_RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(array_concat(
|            coalesce(RiskFactorSet, dynamic([])),
|            RF_P_CiFactorNames
|          )), ";")
|        | extend Source_AssetId        = iif(isnotempty(si_ci_id), si_ci_id, coalesce(DeviceKey, tolower(EntryPointDeviceId)))
|        // #690 a device without a tier keeps none (an empty level, kept by the scope filter) -- never shown as tier 3
|        | extend CriticalityTier      = toint(si_tier)
|        | extend cmdbId               = tostring(si_cmdb_id)
|        | extend cmdbName             = tostring(si_cmdb_name)
|        | extend cmdbCriticality      = tostring(si_cmdb_criticality)
|        | extend cmdbDataSensitivity  = tostring(si_cmdb_data_sensitivity)
|        | extend CriticalityTierLevel = case(
|            isnull(CriticalityTier), "",
|            CriticalityTier == 0, "Critical - tier 0",
|            CriticalityTier == 1, "High - tier 1",
|            CriticalityTier == 2, "Medium - tier 2",
|            "Low - tier 3")
|        | extend SecurityDomain = "Endpoint"
|        | extend Category       = "AttackPath_VulnerableDeviceToAzure"
|        | extend Subcategory    = TargetType
|        | extend ConfigurationName = AttackPathName
|        | extend ConfigurationId   = AttackPathName
|        // Aggregate to (Subcategory x cmdb*) buckets -- one row per attack-path category per
|        // criticality combo. ImpactedAssetPairs and AssetId name the ENTRY DEVICE (the analyzed asset),
|        // never the Azure target.
|        | summarize
|            Impact                    = max(MaxCvssScore),
|            UniqueIssues              = dcount(TargetAzureAssetId),
|            ImpactedAssetsList        = make_set(EntryPointDevice),
|            ImpactedAssetPairs        = make_set(strcat(EntryPointDevice, "|", Source_AssetId)),
|            IssueList                 = make_set(TargetAzureAsset),
|            AssetId                   = min(Source_AssetId),
|            EntryVectorTypes          = make_set(FirstHopLabel),
|            DeviceEdgeTypes           = make_set(DeviceEdge),
|            Max_Source_RiskFactor_Probability          = max(toint(Source_RiskFactor_Probability)),
|            RiskFactorIds = strcat_array(array_sort_asc(make_set_if(RiskFactorIds, isnotempty(RiskFactorIds))), ";"),
|            All_Source_RiskFactor_Probability_Detailed = make_set(Source_RiskFactor_Probability_Detailed)
|            by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|               CriticalityTier, CriticalityTierLevel,
|               cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // audit #25 -- the count is derived from the list that is actually DISPLAYED
|        | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|        | extend SecuritySeverity = case(
|            Impact >= 9.0, "Very High",
|            Impact >= 7.0, "High",
|            Impact >= 5.0, "Medium-High",
|            Impact >= 3.0, "Medium",
|            "Low")
|        | extend AssetName = strcat_array(ImpactedAssetsList, "; ")
|        | extend AssetType = Subcategory
|        // Consequence = 0 (engine auto-derives tokens). Probability = the source-device signal count
|        // (max across all paths in this group). CVSS already contributes via Impact -> SecuritySeverity.
|        | extend RiskFactor_Consequence          = 0
|        | extend RiskFactor_Probability          = coalesce(Max_Source_RiskFactor_Probability, 0)
|        | extend RiskFactor_Probability_Detailed = strcat_array(All_Source_RiskFactor_Probability_Detailed, ";")
|        // Engine weighted-factor block (cmdbCriticality * cmdbDataSensitivity multiplier).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName, AssetId, AssetType, Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|                  ImpactedAssetCount, UniqueIssues,
|                  ImpactedAssetsList, ImpactedAssetPairs, IssueList
|        | sort by RiskScore_Weight_Factor desc, RiskFactor_Probability desc, CriticalityTier asc, ImpactedAssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|        // si si_category <- Category, si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Detailed_Device_with_high_severity_vulnerabilities_allows_lateral_movement_Azure
|      # v2.2.418 -- same bucket FLOOR as the Summary sibling. This variant did NOT time
|      # out on 2026-08-10, but it is the same graph traversal over the same seed set at
|      # a finer grain, so it sits on the same margin. Raised together deliberately --
|      # leaving the pair inconsistent would mean the next slow XDR day takes out the
|      # one nobody had looked at. See the Summary entry for why the #56 semi-join fix
|      # is NOT applicable to a make-graph traversal.
|      BucketCount: 8
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend TargetKey = tolower(TargetAzureAssetId)
|          | project __siNeeded = pack_array(TargetKey)
|      ReportPurpose: Per-row detail of credential-driven attack paths from vulnerable devices to Azure targets,
|        prioritized by FINAL TARGET business impact. EG drives path detection (VulnerableDevice -> Credential -> Identity -> AzureTarget) +
|        scoring; the CI (SI_CI_CL, requirement 505) contributes the target asset's tier, risk factors and CMDB values (cmdbName, cmdbCriticality, cmdbDataSensitivity)
|        joined on the FINAL TARGET through the CI link key (_ciKey).
|      # v2.2.306 -- bucket placeholder positioned INSIDE the VulnerableDevices
|      # let-binding (BEFORE make-graph). Each bucket then starts with 1/N source
|      # devices -> make-graph operates on a smaller seed -> graph-match walks a
|      # smaller subgraph -> compute scales sub-linearly with bucket count.
|      # Critical for scaling to 1M+ devices. AutoBucket calculates from default.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // v2.2.303 -- graph-match shape (replaces v2.2.295 cartesian).
|        //
|        // #505 -- GRAPH-ONLY PATH, CI END ASSETS. The path (device -> credential / identity -> role -> Azure
|        // resource) is an Exposure Graph walk no SI field can express, so it stays a provider query. Both
|        // ends take their SI context from their CI through _ciLink.
|        //   * the ENTRY DEVICE (the row's asset) -- name, id and its asset risk factors (internet exposed,
|        //     unsupported OS), keyed on the Defender device id (EG EntityIds SenseDeviceId), else the EG node id;
|        //   * the AZURE TARGET -- tier and CMDB values (as before), keyed on the target's EG node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device", "cloud_resource")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let VulnerableDevices = ExposureGraphNodes
|        | where set_has_element(Categories, "device")
|        // v2.2.420 (audit #57.1b) -- hedged across property paths. This gates the vulnerable-device attack
|        // paths, so a silent miss here reports "no attack paths" rather than "the source data moved".
|        | where tobool(coalesce(NodeProperties.rawData.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                NodeProperties.raw.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                NodeProperties.highRiskVulnerabilityInsights.hasHighOrCritical)) == true
|        // DeviceKey = the CI link key (Defender device id, else the EG node id), so the EG partition and the
|        // CI side bucket alike.
|        | extend _ids = tostring(EntityIds)
|        | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|        | extend DeviceKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(NodeId))
|        // Bucket filter at SOURCE -- partitions 1M-device tenants into shards BEFORE make-graph.
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | project NodeId, NodeName, NodeLabel, Categories, NodeProperties, DeviceKey;
|        let Identities = ExposureGraphNodes
|        | where set_has_element(Categories, "identity")
|        | project NodeId, NodeName, NodeLabel, Categories;
|        let Credentials = ExposureGraphNodes
|        | where set_has_element(Categories, "secret")
|        | project NodeId, NodeName, NodeLabel, Categories;
|        let AzureNodes = ExposureGraphNodes
|        | where set_has_element(Categories, "environmentAzure")
|        | project NodeId, NodeName, NodeLabel, Categories;
|        // #401 -- ONE node per NodeId. An Azure VM with a vulnerable device record is in VulnerableDevices
|        // AND in AzureNodes (without NodeProperties); make-graph keeps an arbitrary one of two rows with the
|        // same id. The vulnerable-device row wins.
|        let RelevantNodes = union VulnerableDevices, (union Credentials, Identities, AzureNodes | join kind=leftanti (VulnerableDevices | project NodeId) on NodeId);
|
|        // Source-device EG signals -- the count of EG riskFactors[] on the device (a report-scoped factor).
|        // Joined post-graph-match on EntryPointDeviceId == NodeId.
|        let _DeviceEnrichment = VulnerableDevices
|        | extend RawData = todynamic(NodeProperties).rawData
|        | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, todynamic(NodeProperties).risk.riskFactors, dynamic([])))
|        | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|        | mv-apply rf = RiskFactorsArray on (
|            where isnotempty(trim(" ", tostring(rf)))
|            | summarize RiskFactorSet = make_set(tostring(rf))
|          )
|        | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|        | project NodeId, DeviceKey, RiskFactorSet;
|
|        // #690 the target labels as the Exposure Graph writes them, compared case-insensitively -- the graph labels a subscription
|        // node "subscriptions" (the ARM type microsoft.resources/subscriptions is kept for a graph that writes it). Matching the
|        // ARM type only left every subscription path out (23 of 135 paths on a live install).
|        let _Paths = ExposureGraphEdges
|        | where EdgeLabel in~ (
|            "contains",
|            "has credentials of", "frequently logged in by",
|            "can authenticate as",
|            "member of",
|            "has role on"
|          )
|        | make-graph SourceNodeId --> TargetNodeId with RelevantNodes on NodeId
|        | graph-match (Device)-[devEdge]->(CredOrIdent)-[bridge*0..3]->(Principal)-[role]->(RoleScope)-[inherit*0..2]->(AzureAsset)
|            where set_has_element(Device.Categories, "device")
|              and tobool(coalesce(Device.NodeProperties.rawData.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                  Device.NodeProperties.raw.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                  Device.NodeProperties.highRiskVulnerabilityInsights.hasHighOrCritical)) == true
|              and (set_has_element(CredOrIdent.Categories, "secret") or set_has_element(CredOrIdent.Categories, "identity"))
|              and set_has_element(AzureAsset.Categories, "environmentAzure")
|              and (AzureAsset.NodeLabel =~ "microsoft.storage/storageaccounts" or (RoleScope.NodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups") and AzureAsset.NodeLabel startswith "microsoft." and not(AzureAsset.NodeLabel startswith "microsoft.resources/") and not(AzureAsset.NodeLabel startswith "microsoft.authorization/")))
|              and devEdge.EdgeLabel in~ ("contains", "has credentials of", "frequently logged in by")
|              and role.EdgeLabel =~ "has role on"
|            project
|                EntryPointDeviceId = Device.NodeId,
|                EntryPointDevice   = Device.NodeName,
|                MaxCvssScore       = todouble(Device.NodeProperties.rawData.highRiskVulnerabilityInsights.maxCvssScore),
|                FirstHopNode       = CredOrIdent.NodeName,
|                FirstHopLabel      = CredOrIdent.NodeLabel,
|                FirstHopCategories = CredOrIdent.Categories,
|                DeviceEdge         = devEdge.EdgeLabel,
|                ReachedIdentity    = Principal.NodeName,
|                RoleScopeName      = RoleScope.NodeName,
|                RoleScopeLabel     = RoleScope.NodeLabel,
|                TargetAzureAssetId = AzureAsset.NodeId,
|                TargetAzureAsset   = AzureAsset.NodeName,
|                TargetLabel        = AzureAsset.NodeLabel
|        | extend EntryVector = case(
|                DeviceEdge =~ "contains" and FirstHopLabel == "entra-userCookie",                       "Entra session cookie",
|                DeviceEdge =~ "contains" and FirstHopLabel == "azure-active-directory-app-secret",      "AAD app secret",
|                DeviceEdge =~ "contains" and FirstHopLabel == "azure-active-directory-user-credentials", "Cached AAD user credentials",
|                DeviceEdge =~ "contains" and FirstHopLabel == "azure-storage-shared-access-signature",  "SAS token",
|                DeviceEdge =~ "contains" and FirstHopLabel == "azure-storage-connection-string",        "Storage connection string",
|                DeviceEdge =~ "contains" and FirstHopLabel == "azure-database-connection-string",       "DB connection string",
|                DeviceEdge =~ "contains" and FirstHopLabel == "azure-app-configuration-key",            "App Configuration key",
|                DeviceEdge =~ "contains" and FirstHopLabel == "github-personal-access-token",           "GitHub PAT",
|                DeviceEdge =~ "contains" and FirstHopLabel == "openai-api-key",                         "OpenAI API key",
|                DeviceEdge =~ "contains" and FirstHopLabel == "user-azure-cli-secret",                  "Cached Azure CLI token",
|                DeviceEdge =~ "contains",                                                                strcat("Other secret: ", tostring(FirstHopLabel)),
|                DeviceEdge =~ "has credentials of",                                                      "Owner / cached credential",
|                DeviceEdge =~ "frequently logged in by",                                                 "Interactive logon",
|                tostring(DeviceEdge))
|        | summarize
|                EntryVectors          = make_set(EntryVector),
|                DeviceEdges           = make_set(DeviceEdge),
|                CredentialNodes       = make_set(iff(set_has_element(FirstHopCategories, "secret"), FirstHopNode, ""), 10),
|                FirstHopLabels        = make_set(FirstHopLabel),
|                ReachedIdentities     = make_set(ReachedIdentity),
|                ViaRoleScope          = take_any(RoleScopeName),
|                ViaRoleScopeType      = take_any(RoleScopeLabel),
|                MaxCvssScore          = max(MaxCvssScore)
|            by EntryPointDeviceId, EntryPointDevice, TargetAzureAssetId, TargetAzureAsset, TargetLabel
|        | extend CredentialNodes = set_difference(CredentialNodes, dynamic([""]))
|        | extend TargetType = case(
|            TargetLabel =~ "microsoft.storage/storageaccounts", "Storage account",
|            "Azure resource")
|        | extend AttackPathName = strcat(
|            "Device with high severity vulnerabilities allows lateral movement to Azure ",
|            iff(TargetType == "Storage account", "storage account", "resource"));
|
|        _Paths
|        | join kind=leftouter (_DeviceEnrichment) on $left.EntryPointDeviceId == $right.NodeId
|        // #505 -- the ENTRY DEVICE's CI (the row's asset), by the Defender device id or EG node id
|        | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|        | where coalesce(si_in_scope_, true)
|        // the AZURE TARGET's CI (tier, CMDB), by its EG node id
|        // #677 the Azure target's CI -- its own lookup (_ciPeer), joined here on the target's own key. The rows are sliced on
|        // the ENTRY DEVICE, so the target's CI is never cut with them -- it travels whole while it fits, else each slice gets
|        // only its own targets (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend TargetKey = tolower(TargetAzureAssetId)
|        | join kind=leftouter (_ciPeer) on $left.TargetKey == $right._peerKey
|        | extend Target_Tier = peer_tier, Target_cmdbId = peer_cmdb_id, Target_cmdbName = peer_cmdb_name,
|                 Target_cmdbCriticality = peer_cmdb_criticality, Target_cmdbDataSensitivity = peer_cmdb_data_sensitivity
|        | project-away _peerKey, peer_*
|        | extend cmdbId = tostring(Target_cmdbId), cmdbName = tostring(Target_cmdbName), cmdbCriticality = tostring(Target_cmdbCriticality), cmdbDataSensitivity = tostring(Target_cmdbDataSensitivity)
|        // #690 a target without a tier keeps none (an empty level, kept by the scope filter) -- never shown as tier 3
|        | extend CriticalityTier = toint(Target_Tier)
|        | extend CriticalityTierLevel = case(
|            isnull(CriticalityTier), "",
|            CriticalityTier == 0, "Critical - tier 0",
|            CriticalityTier == 1, "High - tier 1",
|            CriticalityTier == 2, "Medium - tier 2",
|            "Low - tier 3")
|        | extend SecurityDomain = "Endpoint"
|        | extend Category       = "AttackPath_VulnerableDeviceToAzure"
|        | extend Subcategory    = TargetType
|        | extend ConfigurationName = AttackPathName
|        | extend ConfigurationId   = strcat(EntryPointDevice, "->", iff(TargetType == "Storage account", TargetAzureAsset, TargetAzureAssetId))
|        | extend AssetName = iif(isnotempty(tostring(si_asset_name)), tostring(si_asset_name), EntryPointDevice)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, coalesce(DeviceKey, tolower(EntryPointDeviceId)))
|        | extend AssetType = iif(isnotempty(tostring(si_class)), "Endpoint", "Device")
|        | extend Impact = MaxCvssScore
|        | extend SecuritySeverity = case(
|            MaxCvssScore >= 9.0, "Very High",
|            MaxCvssScore >= 7.0, "High",
|            MaxCvssScore >= 5.0, "Medium-High",
|            MaxCvssScore >= 3.0, "Medium",
|            "Low")
|        // RiskFactor_Consequence stays 0 -- the engine auto-derives tokens from CriticalityTier + cmdb fields.
|        | extend RiskFactor_Consequence          = 0
|        // report-scoped factor -- the count of EG risk factors on the device
|        | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        // RiskFactor_Probability = COUNT of source-device signals, ADDED ON TOP of the engine's probBase.
|        // CVSS is not added here -- it already drives SecuritySeverity.
|        | extend RiskFactor_Probability          = coalesce(RF_P_RiskFactorsCount, 0) + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(array_concat(
|            coalesce(RiskFactorSet, dynamic([])),
|            RF_P_CiFactorNames
|          )), ";")
|        // Engine weighted-factor block. Substituted at run time from
|        // riskscore_weighted.schema.custom.json -> weightedRiskFactors.endpoint.fields[].
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName, AssetId, AssetType, Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|                  EntryPointDevice, EntryVectors, ReachedIdentities, TargetAzureAsset,
|                  ViaRoleScope, ViaRoleScopeType, MaxCvssScore, CredentialNodes
|        | sort by EntryPointDevice asc, TargetAzureAsset asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|        // si si_category <- Category, si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Detailed_Credential_Based_Lateral_Movement
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(FirstSourceAssetId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: Per-row detail of credential-driven lateral-movement paths to Azure and Endpoint targets,
|        prioritized by FINAL TARGET business impact. EG drives path detection (SourceAsset -> Credential -> Identity -> AzureTarget) +
|        scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  Credential driven lateral movement paths to Azure and Endpoint targets using Exposure Graph
|        // Bucketing applied to the Hop 2 edges on the FINAL TARGET (#677) - each path in exactly one slice
|        // =================================================================================================
|
|        // Step 0  Legacy OS definitions for probability scoring
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Credential edges (not sliced since #677 -- every source of a credential is needed in its slice)
|        // EdgeLabel + SourceNodeLabel + TargetNodeLabel filters narrow the set BEFORE bucketing
|        // (the slice key is the Hop 2 TargetNodeId, the path's final target, see Step 3)
|        let CredentialEdges =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("contains", "defined in", "runs on", "has credentials of")
|            // #690 every credential the graph holds, wherever it sits -- a node of the secret category, or one of the credential
|            // labels below, compared case-insensitively (the graph writes entra-userCookie -- the exact-case entra-usercookie
|            // lost every session-cookie path). No list of source kinds -- the asset a credential sits on is the path's source,
|            // whatever its kind (the fixed lists reached 32 of 97 targets on a live install).
|            | where set_has_element(TargetNodeCategories, "secret") or TargetNodeLabel in~ (
|                "azure-active-directory-app-secret",
|                "user-azure-cli-secret",
|                "azure-storage-shared-access-signature",
|                "azure-storage-connection-string",
|                "azure-database-connection-string",
|                "azure-active-directory-user-credentials",
|                "service-principal-azure-cli-secret",
|                "entra-userCookie",
|                "lsa-secret",
|                "github-personal-access-token",
|                "azure-app-configuration-key",
|                "certificate",
|                "openai-api-key"
|            )
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|            | project
|                SourceNodeId, SourceNodeName, SourceNodeLabel,
|                TargetNodeId, TargetNodeName, TargetNodeLabel,
|                EdgeLabel;
|
|        // Step 2  Hop 1 edges -- BOUND to the credentials found in Step 1.
|        // v2.2.417 -- this previously claimed "no bucketing needed, naturally constrained by
|        // downstream join to CredentialEdges". That premise is FALSE. A join constrains the
|        // RESULT, not the SCAN -- Kusto still materialises every "has credentials of" /
|        // "can authenticate as" / "can authenticate to" edge in the tenant and only then
|        // discards non-matches. So this hop set never shrank, with or without bucketing, and
|        // the Step 7 inner joins exploded on hub identities (inbound x outbound edges). No
|        // bucket depth can split that, because a hub is a SINGLE node -- which is why
|        // sub-bucketing bisected forever with 3 of 4 children returning 0 rows in ~5s.
|        // The semi-join below removes EXACTLY the rows the Step 7 inner join would discard
|        // (CredentialsOnAssets groups by CredentialNodeId = CredentialEdges.TargetNodeId), so
|        // it is provably lossless -- and it makes bucketing actually work, because the hop set
|        // now shrinks WITH the bucket instead of staying tenant-wide.
|        let Hop1Edges =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("has credentials of", "can authenticate as", "can authenticate to")
|            | where SourceNodeId in (CredentialEdges | distinct TargetNodeId)
|            | project
|                SourceNodeId, SourceNodeName, SourceNodeLabel,
|                TargetNodeId, TargetNodeName, TargetNodeLabel,
|                EdgeLabel;
|
|        // Step 3  Hop 2 edges -- BOUND to the identities reached in Step 2.
|        // Same defect and same lossless remedy as Step 2. This set is the more dangerous of the
|        // two, because its TargetNodeLabel list includes "subscriptions" and "resourcegroups" --
|        // node types that legitimately carry thousands of inbound edges -- so leaving it
|        // tenant-wide is what turned the Step 7 join into a cartesian product on hub nodes.
|        let Hop2Edges =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("can authenticate to", "runs on", "has permissions to", "has role on")
|            // #690 every Azure resource the identity reaches (any microsoft.* type, startswith ignores case), the subscription and
|            // resource group scopes, devices and blob containers -- the fixed list of 21 types left out container registries,
|            // network interfaces, locks, ...
|            | where TargetNodeLabel startswith "microsoft." or TargetNodeLabel in~ ("subscriptions", "resourcegroups", "device", "computer-account", "BlobContainer")
|            | where SourceNodeId in (Hop1Edges | distinct TargetNodeId)
|            // #677 the slices are cut on the path's FINAL TARGET (TargetNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            | extend DeviceKey = TargetNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | project
|                SourceNodeId, SourceNodeName, SourceNodeLabel,
|                TargetNodeId, TargetNodeName, TargetNodeLabel,
|                EdgeLabel;
|
|        // Step 4  Credentials on source assets -- one row per (source asset, credential) (#690 -- the Detailed grain keeps every
|        // asset a credential sits on -- a credential found on three devices is three paths, each naming its own device)
|        let CredentialsOnAssets =
|            CredentialEdges
|            | summarize
|                FirstSourceAssetName  = take_any(SourceNodeName),
|                FirstSourceAssetLabel = take_any(SourceNodeLabel),
|                CredentialEdge        = strcat_array(array_sort_asc(make_set(EdgeLabel)), ", ")
|              by
|                FirstSourceAssetId = SourceNodeId,
|                CredentialNodeId   = TargetNodeId,
|                CredentialName     = TargetNodeName,
|                CredentialLabel    = TargetNodeLabel;
|
|        // Step 5  Hop 1 -- credential authenticates as identity
|        let Hop1 =
|            Hop1Edges
|            | project
|                CredentialNodeId          = SourceNodeId,
|                Hop1_EdgeLabel            = EdgeLabel,
|                IntermediateIdentityId    = TargetNodeId,
|                IntermediateIdentity      = TargetNodeName,
|                IntermediateIdentityLabel = TargetNodeLabel;
|
|        // Step 6  Hop 2 -- identity reaches target resource
|        let Hop2 =
|            Hop2Edges
|            | project
|                Hop2_SourceIdentityId = SourceNodeId,
|                Hop2_EdgeLabel        = EdgeLabel,
|                FinalTargetId         = TargetNodeId,
|                FinalTargetName       = TargetNodeName,
|                FinalTargetLabel      = TargetNodeLabel;
|
|        // Step 7  Assemble and stabilize paths
|        let Paths =
|            CredentialsOnAssets
|            | join kind=inner (Hop1) on CredentialNodeId
|            | join kind=inner (Hop2) on $left.IntermediateIdentityId == $right.Hop2_SourceIdentityId
|            | where FirstSourceAssetId != FinalTargetId
|            // one row per path -- source asset x credential x identity x target, every edge label between two hops kept
|            | summarize
|                FirstSourceAssetName      = take_any(FirstSourceAssetName),
|                FirstSourceAssetLabel     = take_any(FirstSourceAssetLabel),
|                CredentialName            = take_any(CredentialName),
|                CredentialLabel           = take_any(CredentialLabel),
|                CredentialEdge            = take_any(CredentialEdge),
|                IntermediateIdentity      = take_any(IntermediateIdentity),
|                IntermediateIdentityLabel = take_any(IntermediateIdentityLabel),
|                Hop1Edge                  = strcat_array(array_sort_asc(make_set(Hop1_EdgeLabel)), ", "),
|                Hop2Edge                  = strcat_array(array_sort_asc(make_set(Hop2_EdgeLabel)), ", "),
|                FinalTargetName           = take_any(FinalTargetName),
|                FinalTargetLabel          = take_any(FinalTargetLabel)
|              by
|                FirstSourceAssetId,
|                CredentialNodeId,
|                IntermediateIdentityId,
|                FinalTargetId;
|
|        // Step 8  Collect node IDs that need enrichment
|        let EnrichIds =
|            union
|                (Paths | project NodeId = FirstSourceAssetId),
|                (Paths | project NodeId = CredentialNodeId),
|                (Paths | project NodeId = IntermediateIdentityId),
|                (Paths | project NodeId = FinalTargetId)
|            | where isnotempty(tostring(column_ifexists("NodeId", "")))
|            | summarize by NodeId;
|
|        // Step 9  Enrich only the nodes actually used in paths
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds | project NodeId)
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(RawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    RawData.isCustomerFacing,
|                    Raw.isCustomerFacing,
|                    false
|                ))
|            | extend IsExcluded =
|                tobool(coalesce(
|                    RawData.isExcluded,
|                    Raw.isExcluded,
|                    false
|                ))
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            // #690 a node without a tier tag keeps no tier (an empty level) -- never shown as tier 3
|            | extend CriticalityTier = toint(CriticalityTierFromTag)
|            | extend CriticalityTierLevel =
|                case(
|                    isnull(CriticalityTier), "",
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    RawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|            | extend _ScoreFactors =
|                array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                )
|            | mv-apply sf = _ScoreFactors on (
|                where isnotempty(trim(" ", tostring(sf)))
|                | summarize ScoreParts = make_set(strcat(tostring(sf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName              = NodeNameNorm,
|                NodeLabel,
|                CriticalityTier,
|                CriticalityTierLevel,
|                IsInternetExposed,
|                IsExcluded,
|                EgNodeTags,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|        // Step 10  Enrich paths with node metadata
|        let Detailed =
|            Paths
|            | join kind=leftouter (
|                Nodes
|                | project
|                    SourceNodeId                = NodeId,
|                    SourceNodeCiKey = NodeCiKey,
|                    SourceRiskFactorSet = RiskFactorSet,
|                    SourceCriticalityTier       = CriticalityTier,
|                    SourceCriticalityTierLevel  = CriticalityTierLevel,
|                    SourceIsInternetExposed     = IsInternetExposed,
|                    SourceIsExcluded            = IsExcluded,
|                    SourceAssetTierByTag        = AssetTierByTag,
|                    SourceLegacyEndOfSupport    = LegacyEndOfSupport,
|                    SourceRiskProb              = RiskFactor_Probability,
|                    SourceRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    SourceRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|              ) on $left.FirstSourceAssetId == $right.SourceNodeId
|            | join kind=leftouter (
|                Nodes
|                | project
|                    IntermediateNodeId                = NodeId,
|                    IntermediateCriticalityTier       = CriticalityTier,
|                    IntermediateCriticalityTierLevel  = CriticalityTierLevel,
|                    IntermediateIsInternetExposed     = IsInternetExposed,
|                    IntermediateLegacyEndOfSupport    = LegacyEndOfSupport,
|                    IntermediateRiskProb              = RiskFactor_Probability,
|                    IntermediateRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    IntermediateRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|              ) on $left.IntermediateIdentityId == $right.IntermediateNodeId
|            | join kind=leftouter (
|                Nodes
|                | project
|                    TargetNodeId                = NodeId,
|                    TargetNodeCiKey = NodeCiKey,
|                    TargetRiskFactorSet = RiskFactorSet,
|                    TargetCriticalityTier       = CriticalityTier,
|                    TargetCriticalityTierLevel  = CriticalityTierLevel,
|                    TargetIsInternetExposed     = IsInternetExposed,
|                    TargetIsExcluded            = IsExcluded,
|                    TargetAssetTierByTag        = AssetTierByTag,
|                    TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                    TargetRiskProb              = RiskFactor_Probability,
|                    TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|              ) on $left.FinalTargetId == $right.TargetNodeId
|            // the SOURCE's CI (#505) -- tier (the EG criticality only where the CI has no tier) and the asset factors,
|            // the same way as the target. A source without a CI keeps its EG tier and has no asset factors.
|            | extend SourceRiskFactorSet = iff(isnull(SourceRiskFactorSet), dynamic([]), SourceRiskFactorSet)
|            // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|            // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|            // the keys its own rows have (the report field LookupNeededKeys).
|            //__SI_LOOKUP_KEYS_HERE__
|            | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(FirstSourceAssetId)))
|            | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|            | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|            | extend Source_si_ci_id = peer_ci_id, Source_si_tier = peer_tier, Source_si_rf_p = peer_rf_p, Source_si_rf_names = peer_rf_names
|            | project-away _peerKey, peer_*
|            | extend SourceAssetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(FirstSourceAssetId))
|            | extend SourceCriticalityTier = toint(coalesce(Source_si_tier, SourceCriticalityTier))
|            | extend SourceCriticalityTierLevel = case(isnull(SourceCriticalityTier), "", SourceCriticalityTier == 0, "Critical - tier 0", SourceCriticalityTier == 1, "High - tier 1", SourceCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend _srcIds = coalesce(Source_si_rf_p, dynamic([])), _srcNames = coalesce(Source_si_rf_names, dynamic([]))
|            | extend SourceIsInternetExposed = set_has_element(_srcIds, "internet_exposed"), SourceLegacyEndOfSupport = iff(set_has_element(_srcIds, "unsupported_os"), 1, 0)
|            | extend _srcRf = array_concat(SourceRiskFactorSet, _srcNames)
|            | extend SourceRiskProb = array_length(SourceRiskFactorSet) + array_length(_srcIds)
|            | extend SourceRiskProbDetailed = strcat_array(array_sort_asc(_srcRf), ";")
|            | mv-apply _rf = _srcRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _srcScore = make_set(strcat(_rf, "=1")))
|            | extend SourceRiskProbDetailedScore = strcat_array(array_sort_asc(_srcScore), ";")
|            | project-away _srcRf, _srcScore, _srcIds, _srcNames
|            // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|            // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|            | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|            | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|            | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                     si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|            | project-away _peerKey, peer_*
|            | where coalesce(si_in_scope_, true)
|            | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(FinalTargetId))
|            | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|            | extend TargetCriticalityTierLevel = case(isnull(TargetCriticalityTier), "", TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|            // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|            | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|            | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|            | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|            | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|            | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|            | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|            | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|            | project-away _tgtRf, _tgtScore
|            | extend
|                cmdbId            = si_cmdb_id,
|                cmdbName            = si_cmdb_name,
|                cmdbCriticality     = si_cmdb_criticality,
|                cmdbDataSensitivity = si_cmdb_data_sensitivity
|            | extend TierEscalation =
|                case(
|                    isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier)
|                        and SourceCriticalityTier > TargetCriticalityTier,
|                        SourceCriticalityTier - TargetCriticalityTier,
|                    0
|                )
|            | extend LateralMovementType =
|                case(
|                    isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|                    TierEscalation >= 3, "Privilege escalation large tier jump",
|                    TierEscalation == 2, "Privilege escalation two tiers",
|                    TierEscalation == 1, "Privilege escalation one tier",
|                    "Direct access same tier"
|                )
|            | extend TargetTierWeight =
|                case(
|                    TargetCriticalityTier == 0, 100,
|                    TargetCriticalityTier == 1, 60,
|                    TargetCriticalityTier == 2, 30,
|                    10
|                )
|            | extend EscalationWeight    = TierEscalation * 10
|            | extend ExposureWeight      = iff(TargetIsInternetExposed == true, 8, 0)
|                                         + iff(SourceIsInternetExposed == true, 3, 0)
|            | extend SourceTierAmplifier =
|                case(
|                    SourceCriticalityTier == 0, 8,
|                    SourceCriticalityTier == 1, 5,
|                    SourceCriticalityTier == 2, 2,
|                    0
|                )
|            | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|            | extend AttackPathPriority =
|                case(
|                    AttackPathPriorityScore >= 90, "Very High",
|                    AttackPathPriorityScore >= 60, "High",
|                    AttackPathPriorityScore >= 30, "Medium-High",
|                    AttackPathPriorityScore >= 15, "Medium",
|                    "Low"
|                )
|            | project
|                AttackPathPriority,
|                AttackPathPriorityScore,
|                TierEscalation,
|                LateralMovementType,
|                FirstSourceAssetId,
|                FirstSourceAssetName,
|                FirstSourceAssetLabel,
|                IntermediateIdentityId,
|                IntermediateIdentity,
|                IntermediateIdentityLabel,
|                CredentialNodeId,
|                CredentialName,
|                CredentialLabel,
|                FinalTargetId,
|                FinalTargetName,
|                FinalTargetLabel,
|                TargetCriticalityTier,
|                TargetCriticalityTierLevel,
|                TargetAssetTierByTag,
|                TargetIsInternetExposed,
|                TargetLegacyEndOfSupport,
|                TargetRiskProb              = coalesce(TargetRiskProb, 0),
|                TargetRiskProbDetailed      = coalesce(TargetRiskProbDetailed, ""),
|                TargetRiskProbDetailedScore = coalesce(TargetRiskProbDetailedScore, ""),
|                SourceCriticalityTier,
|                SourceCriticalityTierLevel,
|                SourceIsInternetExposed,
|                SourceLegacyEndOfSupport,
|                SourceRiskProb              = coalesce(SourceRiskProb, 0),
|                SourceRiskProbDetailed      = coalesce(SourceRiskProbDetailed, ""),
|                SourceRiskProbDetailedScore = coalesce(SourceRiskProbDetailedScore, ""),
|                SourceAssetId,
|                CredentialEdge,
|                Hop1Edge,
|                Hop2Edge,
|                cmdbId,
|                cmdbName,
|                cmdbCriticality,
|                cmdbDataSensitivity,
|                TargetAssetId;
|
|        // Step 11  One row per path -- source asset x credential x identity x target (#690 -- this report summarised its paths to
|        // one row per lateral-movement type and CMDB values -- a Summary inside the Detailed report, naming no path, AssetId
|        // always empty). The row's asset is the path's SOURCE (where the credential sits -- the thing to clean) -- its CI id,
|        // else its graph node id. The tier is the TARGET's (what the path reaches), the source's tier is SourceCriticalityTier.
|        // ConfigurationId names the path by its graph node ids, so two paths never share one.
|        Detailed
|        | extend PathKey = strcat(FirstSourceAssetId, "->", CredentialNodeId, "->", IntermediateIdentityId, "->", FinalTargetId)
|        | extend SecurityDomain       = "Azure"
|        | extend Category             = "Attack Paths"
|        | extend SubCategory          = "LateralMovement"
|        | extend ConfigurationName    = tostring(LateralMovementType)
|        | extend ConfigurationId      = PathKey
|        | extend SecuritySeverity     = tostring(AttackPathPriority)
|        | extend CriticalityTier      = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = tostring(TargetCriticalityTierLevel)
|        | extend AssetName = iif(isnotempty(tostring(FirstSourceAssetName)), tostring(FirstSourceAssetName), tostring(FirstSourceAssetId))
|        | extend AssetId   = tostring(SourceAssetId)
|        | extend AssetType = tostring(FirstSourceAssetLabel)
|        | extend RiskFactor_Consequence               = 0
|        | extend RiskFactor_Probability               = TargetRiskProb
|        | extend RiskFactor_Probability_Detailed      = TargetRiskProbDetailed
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            SubCategory,
|            ConfigurationName,
|            ConfigurationId,
|            AssetName,
|            AssetId,
|            AssetType,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            SourceCriticalityTier
|        | order by
|            RiskScore_Weight_Factor desc,
|            RiskFactor_Probability desc,
|            CriticalityTier asc,
|            AssetName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_ServicePrincipal_Impersonates_Users
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: >-
|        Service principals (applications) the Exposure Graph says can impersonate users, grouped by the tier of the users they can act as and the tiers the path climbs. Exposure Graph drives the path; the CI (SI_CI_CL) gives the tier, CMDB values and asset risk factors of both ends.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  An application can impersonate users (Exposure Graph can-impersonate-as edges)
|        // Step 1  the application -> user edge.  Step 2  the user's tier and factors from the CI.
|        // Sliced on the path's SOURCE (the application) -- every path is in exactly one slice.
|        // =================================================================================================
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        let ImpersonationEdges =
|            ExposureGraphEdges
|            | where EdgeLabel =~ "can impersonate as"
|            | where SourceNodeId != TargetNodeId
|            | extend DeviceKey = SourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | summarize PathEdge = strcat_array(array_sort_asc(make_set(EdgeLabel)), ", ") by SourceNodeId, TargetNodeId;
|        let EnrichIds =
|            union (ImpersonationEdges | project NodeId = SourceNodeId), (ImpersonationEdges | project NodeId = TargetNodeId)
|            | summarize by NodeId;
|        // the path's nodes -- the name and label the graph shows, the graph's own risk factors, and the CI key (the id the CI
|        // links -- Defender device id, Azure resource id, Entra object id -- else the node id). No tier is read from the graph.
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds)
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend NodeNameNorm = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, NodeProperties.risk.riskFactors, dynamic([])))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | project NodeId, NodeCiKey, NodeName = NodeNameNorm, NodeLabel, RiskFactorSet;
|        let Paths =
|            ImpersonationEdges
|            | join kind=leftouter (Nodes | project SourceNodeId = NodeId, SourceNodeCiKey = NodeCiKey, SourceName = NodeName, SourceLabel = NodeLabel) on SourceNodeId
|            | join kind=leftouter (Nodes | project TargetNodeId = NodeId, TargetNodeCiKey = NodeCiKey, TargetName = NodeName, TargetLabel = NodeLabel, TargetRiskFactorSet = RiskFactorSet) on TargetNodeId
|            | project-away SourceNodeId1, TargetNodeId1
|            | extend PathKey = strcat(SourceNodeId, "->", TargetNodeId)
|            | extend RouteName = "Application can impersonate users";
|        Paths
|        // both ends' CI -- the lookup _ciPeer on each end's own key, after the slice filter (the row's tier, CMDB values and
|        // asset risk factors are the TARGET's; the source's tier is SourceCriticalityTier)
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, Source_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend Target_si_ci_id = peer_ci_id, TargetCriticalityTier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, Target_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(Source_in_scope, true) and coalesce(Target_in_scope, true)
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's CI tier (what the path reaches) -- a target without a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Identity", Category = "Attack Paths", Subcategory = "Impersonation"
|        | extend ConfigurationName = strcat(RouteName, " -- ", LateralMovementType)
|        | extend RiskFactor_Probability = TargetRiskProb
|        | extend RiskFactor_Probability_Detailed = TargetRiskProbDetailed
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | extend AssetName = iif(isnotempty(tostring(SourceName)), tostring(SourceName), tostring(SourceNodeId))
|        | extend si_ci_id = Source_si_ci_id
|        | extend _assetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(SourceNodeId))
|        | extend AssetType = tostring(SourceLabel)
|        // the slice key the bucket merge adds the counts up on
|        | extend DeviceKey = SourceNodeId
|        | extend ConfigurationId = "ATTACKPATH-APP-IMPERSONATES-USER"
|        | extend RouteImpact = "Applications that can impersonate users act with those users' access -- remove the impersonation permission (delegated or application) or limit it to the users the application must serve"
|        | summarize
|            AssetCount             = dcount(DeviceKey),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", _assetId)),
|            Impact                 = take_any(RouteImpact),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId                 = min(tostring(cmdbId)),
|            cmdbName               = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring("")),
|            EntraAccountObjectId   = min(tostring("")),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(_assetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Detailed_ServicePrincipal_Impersonates_Users
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: >-
|        Per row, a service principal (application) the Exposure Graph says can impersonate a user, and what that user reaches. Step one is the graph's can-impersonate-as edge (application to user), step two the impersonated user's own tier and asset risk factors from the CI (SI_CI_CL). The row's asset is the application (the permission to remove), its tier the impersonated user's; a path that climbs tiers is prioritised.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  An application can impersonate users (Exposure Graph can-impersonate-as edges)
|        // Step 1  the application -> user edge.  Step 2  the user's tier and factors from the CI.
|        // Sliced on the path's SOURCE (the application) -- every path is in exactly one slice.
|        // =================================================================================================
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        let ImpersonationEdges =
|            ExposureGraphEdges
|            | where EdgeLabel =~ "can impersonate as"
|            | where SourceNodeId != TargetNodeId
|            | extend DeviceKey = SourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | summarize PathEdge = strcat_array(array_sort_asc(make_set(EdgeLabel)), ", ") by SourceNodeId, TargetNodeId;
|        let EnrichIds =
|            union (ImpersonationEdges | project NodeId = SourceNodeId), (ImpersonationEdges | project NodeId = TargetNodeId)
|            | summarize by NodeId;
|        // the path's nodes -- the name and label the graph shows, the graph's own risk factors, and the CI key (the id the CI
|        // links -- Defender device id, Azure resource id, Entra object id -- else the node id). No tier is read from the graph.
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds)
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend NodeNameNorm = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, NodeProperties.risk.riskFactors, dynamic([])))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | project NodeId, NodeCiKey, NodeName = NodeNameNorm, NodeLabel, RiskFactorSet;
|        let Paths =
|            ImpersonationEdges
|            | join kind=leftouter (Nodes | project SourceNodeId = NodeId, SourceNodeCiKey = NodeCiKey, SourceName = NodeName, SourceLabel = NodeLabel) on SourceNodeId
|            | join kind=leftouter (Nodes | project TargetNodeId = NodeId, TargetNodeCiKey = NodeCiKey, TargetName = NodeName, TargetLabel = NodeLabel, TargetRiskFactorSet = RiskFactorSet) on TargetNodeId
|            | project-away SourceNodeId1, TargetNodeId1
|            | extend PathKey = strcat(SourceNodeId, "->", TargetNodeId)
|            | extend RouteName = "Application can impersonate users";
|        Paths
|        // both ends' CI -- the lookup _ciPeer on each end's own key, after the slice filter (the row's tier, CMDB values and
|        // asset risk factors are the TARGET's; the source's tier is SourceCriticalityTier)
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, Source_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend Target_si_ci_id = peer_ci_id, TargetCriticalityTier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, Target_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(Source_in_scope, true) and coalesce(Target_in_scope, true)
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's CI tier (what the path reaches) -- a target without a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Identity", Category = "Attack Paths", Subcategory = "Impersonation"
|        | extend ConfigurationName = strcat(RouteName, " -- ", LateralMovementType)
|        | extend RiskFactor_Probability = TargetRiskProb
|        | extend RiskFactor_Probability_Detailed = TargetRiskProbDetailed
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | extend AssetName = iif(isnotempty(tostring(SourceName)), tostring(SourceName), tostring(SourceNodeId))
|        | extend _assetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(SourceNodeId))
|        | extend AssetType = tostring(SourceLabel)
|        | extend Impact = strcat(AssetName, " can impersonate ", tostring(TargetName), " (", iff(isnull(TargetCriticalityTier), "no tier", strcat("tier ", tostring(TargetCriticalityTier))), ") and act with that user's access")
|        // one row per path -- the path names its graph node ids, so two paths never share a ConfigurationId
|        | extend ConfigurationId = PathKey
|        | extend AssetId = _assetId
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType, Impact,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight, SourceCriticalityTier
|        | order by RiskScore_Weight_Factor desc, RiskFactor_Probability desc, CriticalityTier asc, AssetName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_Workload_ManagedIdentity_to_Azure_Resources
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|          | extend TargetParentCiKey = iff(TargetCiKey startswith "/subscriptions/" and array_length(split(TargetCiKey, "/")) > 9, strcat_array(array_slice(split(TargetCiKey, "/"), 0, 8), "/"), "")
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey, TargetParentCiKey)
|      ReportPurpose: >-
|        Workloads that sign in as a managed identity holding access to Azure resources, grouped by the tier of the resources reached and the tiers the path climbs. Exposure Graph drives the path; the CI (SI_CI_CL) gives the tier, CMDB values and asset risk factors of both ends.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  A workload signs in as a managed identity that reaches Azure resources (Exposure Graph)
|        // Step 1  workload -> managed identity (can authenticate as).  Step 2  identity -> resource (role / permission).
|        // No credential node in between (that path is the credential-based report). Sliced on the workload.
|        // =================================================================================================
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        // a target no CI links takes the tier its own resource tree gives it -- the top-level resource it belongs to (#190),
|        // else its subscription's most critical CI (#192) -- read on its own, never from a slice's share (#675)
|        //__SI_CI_SUBTIER_BEGIN__
|            let _subTierG =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device")
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where _ciKey startswith "/subscriptions/"
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | extend _sub = tostring(split(_ciKey, "/")[2])
|                | where isnotempty(_sub)
|                | summarize Tier_BySub = min(toint(column_ifexists("si_tier", int(null)))) by _sub;
|        //__SI_CI_SUBTIER_END__
|        let WorkloadIdentity =
|            ExposureGraphEdges
|            | where EdgeLabel =~ "can authenticate as"
|            | where TargetNodeLabel =~ "managedidentity"
|            | where not(set_has_element(SourceNodeCategories, "secret"))
|            | extend DeviceKey = SourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | summarize Hop1Edge = strcat_array(array_sort_asc(make_set(EdgeLabel)), ", ") by SourceNodeId, IntermediateNodeId = TargetNodeId;
|        // Step 2 is BOUND to the identities of step 1 (a semi-join, so the scan shrinks with the slice)
|        let IdentityAccess =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("has permissions to", "has role on")
|            | where TargetNodeLabel startswith "microsoft." or TargetNodeLabel in~ ("subscriptions", "resourcegroups", "BlobContainer")
|            | where SourceNodeId in (WorkloadIdentity | distinct IntermediateNodeId)
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            | summarize PathEdge = strcat_array(array_sort_asc(make_set(EdgeLabel)), ", ") by IntermediateNodeId = SourceNodeId, TargetNodeId;
|        let Joined =
|            WorkloadIdentity
|            | join kind=inner (IdentityAccess) on IntermediateNodeId
|            | project-away IntermediateNodeId1
|            | where SourceNodeId != TargetNodeId;
|        let EnrichIds =
|            union (Joined | project NodeId = SourceNodeId), (Joined | project NodeId = IntermediateNodeId), (Joined | project NodeId = TargetNodeId)
|            | summarize by NodeId;
|        // the path's nodes -- the name and label the graph shows, the graph's own risk factors, and the CI key (the id the CI
|        // links -- Defender device id, Azure resource id, Entra object id -- else the node id). No tier is read from the graph.
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds)
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend NodeNameNorm = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, NodeProperties.risk.riskFactors, dynamic([])))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | project NodeId, NodeCiKey, NodeName = NodeNameNorm, NodeLabel, RiskFactorSet;
|        let Paths =
|            Joined
|            | join kind=leftouter (Nodes | project SourceNodeId = NodeId, SourceNodeCiKey = NodeCiKey, SourceName = NodeName, SourceLabel = NodeLabel) on SourceNodeId
|            | join kind=leftouter (Nodes | project IntermediateNodeId = NodeId, IntermediateName = NodeName) on IntermediateNodeId
|            | join kind=leftouter (Nodes | project TargetNodeId = NodeId, TargetNodeCiKey = NodeCiKey, TargetName = NodeName, TargetLabel = NodeLabel, TargetRiskFactorSet = RiskFactorSet) on TargetNodeId
|            | project-away SourceNodeId1, IntermediateNodeId1, TargetNodeId1
|            | extend PathKey = strcat(SourceNodeId, "->", IntermediateNodeId, "->", TargetNodeId)
|            | extend RouteName = "Workload signs in as a managed identity with access to Azure resources";
|        Paths
|        // both ends' CI -- the lookup _ciPeer on each end's own key, after the slice filter (the row's tier, CMDB values and
|        // asset risk factors are the TARGET's; the source's tier is SourceCriticalityTier)
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|        | extend TargetParentCiKey = iff(TargetCiKey startswith "/subscriptions/" and array_length(split(TargetCiKey, "/")) > 9, strcat_array(array_slice(split(TargetCiKey, "/"), 0, 8), "/"), "")
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, Source_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend Target_si_ci_id = peer_ci_id, TargetCriticalityTier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, Target_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer | where isnotempty(_peerKey) | project TargetParentCiKey = _peerKey, Tier_ByParent = peer_tier) on TargetParentCiKey
|        | extend _tSub = iff(TargetCiKey startswith "/subscriptions/", tostring(split(TargetCiKey, "/")[2]), "")
|        | join kind=leftouter (_subTierG) on $left._tSub == $right._sub
|        | extend TargetTierFrom = case(isnotnull(TargetCriticalityTier), "ci", isnotnull(Tier_ByParent), "parent resource", isnotnull(Tier_BySub), "subscription", "")
|        | extend TargetCriticalityTier = coalesce(toint(TargetCriticalityTier), toint(Tier_ByParent), toint(Tier_BySub))
|        | project-away TargetParentCiKey1, _tSub, _sub, Tier_ByParent, Tier_BySub
|        | where coalesce(Source_in_scope, true) and coalesce(Target_in_scope, true)
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's (what the path reaches) -- its CI's, else its top-level resource's, else its subscription's
|        // most critical CI -- a target none of them gives a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Azure", Category = "Attack Paths", Subcategory = "WorkloadIdentity"
|        | extend ConfigurationName = strcat(RouteName, " -- ", LateralMovementType)
|        | extend RiskFactor_Probability = TargetRiskProb
|        | extend RiskFactor_Probability_Detailed = TargetRiskProbDetailed
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | extend AssetName = iif(isnotempty(tostring(SourceName)), tostring(SourceName), tostring(SourceNodeId))
|        | extend si_ci_id = Source_si_ci_id
|        | extend _assetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(SourceNodeId))
|        | extend AssetType = tostring(SourceLabel)
|        // the slice key the bucket merge adds the counts up on
|        | extend DeviceKey = SourceNodeId
|        | extend ConfigurationId = "ATTACKPATH-WORKLOAD-MI-AZURE"
|        | extend RouteImpact = "Code running on these workloads acts as their managed identity -- give the identity only the roles the workload needs, on the narrowest scope, and protect the workload as the tier of what it reaches"
|        | summarize
|            AssetCount             = dcount(DeviceKey),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", _assetId)),
|            Impact                 = take_any(RouteImpact),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId                 = min(tostring(cmdbId)),
|            cmdbName               = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring("")),
|            EntraAccountObjectId   = min(tostring("")),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(_assetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Detailed_Workload_ManagedIdentity_to_Azure_Resources
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|          | extend TargetParentCiKey = iff(TargetCiKey startswith "/subscriptions/" and array_length(split(TargetCiKey, "/")) > 9, strcat_array(array_slice(split(TargetCiKey, "/"), 0, 8), "/"), "")
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey, TargetParentCiKey)
|      ReportPurpose: >-
|        Per row, a workload (virtual machine, container app, web app, function, database, AI service) that signs in as a managed identity, and an Azure resource that identity holds a role or permission on. Step one is the graph's can-authenticate-as edge (workload to managed identity), step two the identity's has-role-on / has-permissions-to edge to the resource. Whoever runs code on the workload reaches the resource. The row's asset is the workload, its tier the target resource's (CI).
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  A workload signs in as a managed identity that reaches Azure resources (Exposure Graph)
|        // Step 1  workload -> managed identity (can authenticate as).  Step 2  identity -> resource (role / permission).
|        // No credential node in between (that path is the credential-based report). Sliced on the workload.
|        // =================================================================================================
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        // a target no CI links takes the tier its own resource tree gives it -- the top-level resource it belongs to (#190),
|        // else its subscription's most critical CI (#192) -- read on its own, never from a slice's share (#675)
|        //__SI_CI_SUBTIER_BEGIN__
|            let _subTierG =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device")
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where _ciKey startswith "/subscriptions/"
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | extend _sub = tostring(split(_ciKey, "/")[2])
|                | where isnotempty(_sub)
|                | summarize Tier_BySub = min(toint(column_ifexists("si_tier", int(null)))) by _sub;
|        //__SI_CI_SUBTIER_END__
|        let WorkloadIdentity =
|            ExposureGraphEdges
|            | where EdgeLabel =~ "can authenticate as"
|            | where TargetNodeLabel =~ "managedidentity"
|            | where not(set_has_element(SourceNodeCategories, "secret"))
|            | extend DeviceKey = SourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | summarize Hop1Edge = strcat_array(array_sort_asc(make_set(EdgeLabel)), ", ") by SourceNodeId, IntermediateNodeId = TargetNodeId;
|        // Step 2 is BOUND to the identities of step 1 (a semi-join, so the scan shrinks with the slice)
|        let IdentityAccess =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("has permissions to", "has role on")
|            | where TargetNodeLabel startswith "microsoft." or TargetNodeLabel in~ ("subscriptions", "resourcegroups", "BlobContainer")
|            | where SourceNodeId in (WorkloadIdentity | distinct IntermediateNodeId)
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            | summarize PathEdge = strcat_array(array_sort_asc(make_set(EdgeLabel)), ", ") by IntermediateNodeId = SourceNodeId, TargetNodeId;
|        let Joined =
|            WorkloadIdentity
|            | join kind=inner (IdentityAccess) on IntermediateNodeId
|            | project-away IntermediateNodeId1
|            | where SourceNodeId != TargetNodeId;
|        let EnrichIds =
|            union (Joined | project NodeId = SourceNodeId), (Joined | project NodeId = IntermediateNodeId), (Joined | project NodeId = TargetNodeId)
|            | summarize by NodeId;
|        // the path's nodes -- the name and label the graph shows, the graph's own risk factors, and the CI key (the id the CI
|        // links -- Defender device id, Azure resource id, Entra object id -- else the node id). No tier is read from the graph.
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds)
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend NodeNameNorm = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, NodeProperties.risk.riskFactors, dynamic([])))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | project NodeId, NodeCiKey, NodeName = NodeNameNorm, NodeLabel, RiskFactorSet;
|        let Paths =
|            Joined
|            | join kind=leftouter (Nodes | project SourceNodeId = NodeId, SourceNodeCiKey = NodeCiKey, SourceName = NodeName, SourceLabel = NodeLabel) on SourceNodeId
|            | join kind=leftouter (Nodes | project IntermediateNodeId = NodeId, IntermediateName = NodeName) on IntermediateNodeId
|            | join kind=leftouter (Nodes | project TargetNodeId = NodeId, TargetNodeCiKey = NodeCiKey, TargetName = NodeName, TargetLabel = NodeLabel, TargetRiskFactorSet = RiskFactorSet) on TargetNodeId
|            | project-away SourceNodeId1, IntermediateNodeId1, TargetNodeId1
|            | extend PathKey = strcat(SourceNodeId, "->", IntermediateNodeId, "->", TargetNodeId)
|            | extend RouteName = "Workload signs in as a managed identity with access to Azure resources";
|        Paths
|        // both ends' CI -- the lookup _ciPeer on each end's own key, after the slice filter (the row's tier, CMDB values and
|        // asset risk factors are the TARGET's; the source's tier is SourceCriticalityTier)
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|        | extend TargetParentCiKey = iff(TargetCiKey startswith "/subscriptions/" and array_length(split(TargetCiKey, "/")) > 9, strcat_array(array_slice(split(TargetCiKey, "/"), 0, 8), "/"), "")
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, Source_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend Target_si_ci_id = peer_ci_id, TargetCriticalityTier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, Target_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer | where isnotempty(_peerKey) | project TargetParentCiKey = _peerKey, Tier_ByParent = peer_tier) on TargetParentCiKey
|        | extend _tSub = iff(TargetCiKey startswith "/subscriptions/", tostring(split(TargetCiKey, "/")[2]), "")
|        | join kind=leftouter (_subTierG) on $left._tSub == $right._sub
|        | extend TargetTierFrom = case(isnotnull(TargetCriticalityTier), "ci", isnotnull(Tier_ByParent), "parent resource", isnotnull(Tier_BySub), "subscription", "")
|        | extend TargetCriticalityTier = coalesce(toint(TargetCriticalityTier), toint(Tier_ByParent), toint(Tier_BySub))
|        | project-away TargetParentCiKey1, _tSub, _sub, Tier_ByParent, Tier_BySub
|        | where coalesce(Source_in_scope, true) and coalesce(Target_in_scope, true)
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's (what the path reaches) -- its CI's, else its top-level resource's, else its subscription's
|        // most critical CI -- a target none of them gives a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Azure", Category = "Attack Paths", Subcategory = "WorkloadIdentity"
|        | extend ConfigurationName = strcat(RouteName, " -- ", LateralMovementType)
|        | extend RiskFactor_Probability = TargetRiskProb
|        | extend RiskFactor_Probability_Detailed = TargetRiskProbDetailed
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | extend AssetName = iif(isnotempty(tostring(SourceName)), tostring(SourceName), tostring(SourceNodeId))
|        | extend _assetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(SourceNodeId))
|        | extend AssetType = tostring(SourceLabel)
|        | extend Impact = strcat(AssetName, " (", AssetType, ") signs in as the managed identity ", tostring(IntermediateName), ", which ", PathEdge, " ", tostring(TargetName), " (", tostring(TargetLabel), ", ", iff(isnull(TargetCriticalityTier), "no tier", strcat("tier ", tostring(TargetCriticalityTier))), ")")
|        // one row per path -- the path names its graph node ids, so two paths never share a ConfigurationId
|        | extend ConfigurationId = PathKey
|        | extend AssetId = _assetId
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType, Impact,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight, SourceCriticalityTier
|        | order by RiskScore_Weight_Factor desc, RiskFactor_Probability desc, CriticalityTier asc, AssetName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_SignIn_Entitlement_to_Tier0_Servers
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: >-
|        Users who are entitled to sign in to or administer Tier 0 servers without being Tier 0 themselves, directly or through a group, grouped by the tiers the path climbs. Exposure Graph drives the path; the CI (SI_CI_CL) gives the tier, CMDB values and asset risk factors of both ends.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  Users entitled to sign in to Tier 0 servers (Exposure Graph role / permission edges)
|        // Step 1  user -> group (member of), or the user itself.  Step 2  user or group -> server (has role on / has permissions to).
|        // The logon EVENTS are the admin logon reports -- this reads the ENTITLEMENT only (no can-authenticate-to edge).
|        // Sliced on the user.
|        // =================================================================================================
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        let ServerGrants =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("has role on", "has permissions to")
|            | where TargetNodeLabel in~ ("microsoft.compute/virtualmachines", "microsoft.hybridcompute/machines", "device", "computer-account")
|            | where SourceNodeLabel in~ ("user", "group")
|            | project GrantHolderId = SourceNodeId, GrantHolderLabel = SourceNodeLabel, TargetNodeId, AccessEdge = EdgeLabel;
|        let DirectGrants =
|            ServerGrants
|            | where GrantHolderLabel =~ "user"
|            | project SourceNodeId = GrantHolderId, IntermediateNodeId = "", TargetNodeId, AccessEdge;
|        let GroupGrants =
|            ExposureGraphEdges
|            | where EdgeLabel =~ "member of"
|            | where SourceNodeLabel =~ "user"
|            | where TargetNodeId in (ServerGrants | where GrantHolderLabel =~ "group" | distinct GrantHolderId)
|            | project SourceNodeId, IntermediateNodeId = TargetNodeId
|            | join kind=inner (ServerGrants | where GrantHolderLabel =~ "group" | project IntermediateNodeId = GrantHolderId, TargetNodeId, AccessEdge) on IntermediateNodeId
|            | project SourceNodeId, IntermediateNodeId, TargetNodeId, AccessEdge;
|        let Joined =
|            union DirectGrants, GroupGrants
|            | where SourceNodeId != TargetNodeId
|            | extend DeviceKey = SourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | summarize PathEdge = strcat_array(array_sort_asc(make_set(AccessEdge)), ", "), ViaGroupCount = dcountif(IntermediateNodeId, isnotempty(IntermediateNodeId)),
|                        Direct = max(toint(isempty(IntermediateNodeId))) by SourceNodeId, TargetNodeId;
|        let EnrichIds =
|            union (Joined | project NodeId = SourceNodeId), (Joined | project NodeId = TargetNodeId)
|            | summarize by NodeId;
|        // the path's nodes -- the name and label the graph shows, the graph's own risk factors, and the CI key (the id the CI
|        // links -- Defender device id, Azure resource id, Entra object id -- else the node id). No tier is read from the graph.
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds)
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend NodeNameNorm = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, NodeProperties.risk.riskFactors, dynamic([])))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | project NodeId, NodeCiKey, NodeName = NodeNameNorm, NodeLabel, RiskFactorSet;
|        let Paths =
|            Joined
|            | join kind=leftouter (Nodes | project SourceNodeId = NodeId, SourceNodeCiKey = NodeCiKey, SourceName = NodeName, SourceLabel = NodeLabel) on SourceNodeId
|            | join kind=leftouter (Nodes | project TargetNodeId = NodeId, TargetNodeCiKey = NodeCiKey, TargetName = NodeName, TargetLabel = NodeLabel, TargetRiskFactorSet = RiskFactorSet) on TargetNodeId
|            | project-away SourceNodeId1, TargetNodeId1
|            | extend PathKey = strcat(SourceNodeId, "->", TargetNodeId)
|            | extend RouteName = "User entitled to sign in to a Tier 0 server";
|        Paths
|        // both ends' CI -- the lookup _ciPeer on each end's own key, after the slice filter (the row's tier, CMDB values and
|        // asset risk factors are the TARGET's; the source's tier is SourceCriticalityTier)
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, Source_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend Target_si_ci_id = peer_ci_id, TargetCriticalityTier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, Target_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(Source_in_scope, true) and coalesce(Target_in_scope, true)
|        // the question -- the server is Tier 0 and the user is not (a user without a tier is not a known Tier 0 admin)
|        | where TargetCriticalityTier == 0
|        | where isnull(SourceCriticalityTier) or SourceCriticalityTier > 0
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's CI tier (what the path reaches) -- a target without a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Identity", Category = "Attack Paths", Subcategory = "SignInEntitlement"
|        | extend ConfigurationName = strcat(RouteName, " -- ", LateralMovementType)
|        | extend RiskFactor_Probability = TargetRiskProb
|        | extend RiskFactor_Probability_Detailed = TargetRiskProbDetailed
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | extend AssetName = iif(isnotempty(tostring(SourceName)), tostring(SourceName), tostring(SourceNodeId))
|        | extend si_ci_id = Source_si_ci_id
|        | extend _assetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(SourceNodeId))
|        | extend AssetType = tostring(SourceLabel)
|        // the slice key the bucket merge adds the counts up on
|        | extend DeviceKey = SourceNodeId
|        | extend ConfigurationId = "ATTACKPATH-ENTITLED-TIER0-SERVER"
|        | extend RouteImpact = "Accounts below Tier 0 that may sign in to or administer Tier 0 servers break the tier model -- give Tier 0 server access only to Tier 0 administration accounts (and the groups that hold it)"
|        | summarize
|            AssetCount             = dcount(DeviceKey),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", _assetId)),
|            Impact                 = take_any(RouteImpact),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId                 = min(tostring(cmdbId)),
|            cmdbName               = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring("")),
|            EntraAccountObjectId   = min(tostring("")),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(_assetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Detailed_SignIn_Entitlement_to_Tier0_Servers
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: >-
|        Per row, a user who is entitled to sign in to or administer a Tier 0 server and is not Tier 0 -- directly, or through a group the user is a member of. Step one is the user's group membership (member of), step two the role or permission the user or group holds on the virtual machine, Arc machine or device (has role on / has permissions to). It reads the entitlement, not the logon events (the admin logon reports cover those). The row's asset is the user, its tier the server's (CI).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  Users entitled to sign in to Tier 0 servers (Exposure Graph role / permission edges)
|        // Step 1  user -> group (member of), or the user itself.  Step 2  user or group -> server (has role on / has permissions to).
|        // The logon EVENTS are the admin logon reports -- this reads the ENTITLEMENT only (no can-authenticate-to edge).
|        // Sliced on the user.
|        // =================================================================================================
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        let ServerGrants =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("has role on", "has permissions to")
|            | where TargetNodeLabel in~ ("microsoft.compute/virtualmachines", "microsoft.hybridcompute/machines", "device", "computer-account")
|            | where SourceNodeLabel in~ ("user", "group")
|            | project GrantHolderId = SourceNodeId, GrantHolderLabel = SourceNodeLabel, TargetNodeId, AccessEdge = EdgeLabel;
|        let DirectGrants =
|            ServerGrants
|            | where GrantHolderLabel =~ "user"
|            | project SourceNodeId = GrantHolderId, IntermediateNodeId = "", TargetNodeId, AccessEdge;
|        let GroupGrants =
|            ExposureGraphEdges
|            | where EdgeLabel =~ "member of"
|            | where SourceNodeLabel =~ "user"
|            | where TargetNodeId in (ServerGrants | where GrantHolderLabel =~ "group" | distinct GrantHolderId)
|            | project SourceNodeId, IntermediateNodeId = TargetNodeId
|            | join kind=inner (ServerGrants | where GrantHolderLabel =~ "group" | project IntermediateNodeId = GrantHolderId, TargetNodeId, AccessEdge) on IntermediateNodeId
|            | project SourceNodeId, IntermediateNodeId, TargetNodeId, AccessEdge;
|        let Joined =
|            union DirectGrants, GroupGrants
|            | where SourceNodeId != TargetNodeId
|            | extend DeviceKey = SourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | summarize PathEdge = strcat_array(array_sort_asc(make_set(AccessEdge)), ", "), ViaGroupCount = dcountif(IntermediateNodeId, isnotempty(IntermediateNodeId)),
|                        Direct = max(toint(isempty(IntermediateNodeId))) by SourceNodeId, TargetNodeId;
|        let EnrichIds =
|            union (Joined | project NodeId = SourceNodeId), (Joined | project NodeId = TargetNodeId)
|            | summarize by NodeId;
|        // the path's nodes -- the name and label the graph shows, the graph's own risk factors, and the CI key (the id the CI
|        // links -- Defender device id, Azure resource id, Entra object id -- else the node id). No tier is read from the graph.
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds)
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend NodeNameNorm = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, NodeProperties.risk.riskFactors, dynamic([])))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | project NodeId, NodeCiKey, NodeName = NodeNameNorm, NodeLabel, RiskFactorSet;
|        let Paths =
|            Joined
|            | join kind=leftouter (Nodes | project SourceNodeId = NodeId, SourceNodeCiKey = NodeCiKey, SourceName = NodeName, SourceLabel = NodeLabel) on SourceNodeId
|            | join kind=leftouter (Nodes | project TargetNodeId = NodeId, TargetNodeCiKey = NodeCiKey, TargetName = NodeName, TargetLabel = NodeLabel, TargetRiskFactorSet = RiskFactorSet) on TargetNodeId
|            | project-away SourceNodeId1, TargetNodeId1
|            | extend PathKey = strcat(SourceNodeId, "->", TargetNodeId)
|            | extend RouteName = "User entitled to sign in to a Tier 0 server";
|        Paths
|        // both ends' CI -- the lookup _ciPeer on each end's own key, after the slice filter (the row's tier, CMDB values and
|        // asset risk factors are the TARGET's; the source's tier is SourceCriticalityTier)
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, Source_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend Target_si_ci_id = peer_ci_id, TargetCriticalityTier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, Target_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(Source_in_scope, true) and coalesce(Target_in_scope, true)
|        // the question -- the server is Tier 0 and the user is not (a user without a tier is not a known Tier 0 admin)
|        | where TargetCriticalityTier == 0
|        | where isnull(SourceCriticalityTier) or SourceCriticalityTier > 0
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's CI tier (what the path reaches) -- a target without a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Identity", Category = "Attack Paths", Subcategory = "SignInEntitlement"
|        | extend ConfigurationName = strcat(RouteName, " -- ", LateralMovementType)
|        | extend RiskFactor_Probability = TargetRiskProb
|        | extend RiskFactor_Probability_Detailed = TargetRiskProbDetailed
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | extend AssetName = iif(isnotempty(tostring(SourceName)), tostring(SourceName), tostring(SourceNodeId))
|        | extend _assetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(SourceNodeId))
|        | extend AssetType = tostring(SourceLabel)
|        | extend Impact = strcat(AssetName, " holds ", PathEdge, " on the Tier 0 server ", tostring(TargetName), iff(Direct == 1, " directly", ""), iff(ViaGroupCount > 0, strcat(iff(Direct == 1, " and", ""), " through ", tostring(ViaGroupCount), " group(s)"), ""), " but is ", iff(isnull(SourceCriticalityTier), "not tiered", strcat("tier ", tostring(SourceCriticalityTier))))
|        // one row per path -- the path names its graph node ids, so two paths never share a ConfigurationId
|        | extend ConfigurationId = PathKey
|        | extend AssetId = _assetId
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType, Impact,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight, SourceCriticalityTier
|        | order by RiskScore_Weight_Factor desc, RiskFactor_Probability desc, CriticalityTier asc, AssetName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_Owner_to_Privileged_Service_Principal
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend OwnerCiKey = OwnerId
|          | project __siNeeded = pack_array(OwnerCiKey)
|      ReportPurpose: >-
|        Tier 0 and Tier 1 service principals owned by accounts on a less critical tier -- each owner can add a credential and sign in as the application. Both sides come from the CI (SI_CI_CL), the ownership from Entra.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  A lower-tier owner of a privileged application (the CI -- Entra ownership and the tiers)
|        // Step 1  owner -> application (ownership).  Step 2  the application's tier (its roles and permissions, CI).
|        // An owner can add a credential and sign in as the application. Sliced on the application.
|        // =================================================================================================
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        // the question -- a privileged application (its CI tier, Tier 0 or Tier 1)
|        | where si_tier in (0, 1)
|        // every owner of the application, wherever they own it (enterprise application, application registration or both)
|        | extend _owners = coalesce(todynamic(tostring(si_owners)), dynamic([]))
|        | mv-expand _ow = _owners to typeof(dynamic)
|        | extend OwnerId = tolower(tostring(_ow.id)), OwnerName = coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), OwnerOf = tostring(_ow["of"])
|        | where isnotempty(OwnerId)
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // the owner's CI -- the lookup _ciPeer on the owner's Entra object id, after the slice filter
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend OwnerCiKey = OwnerId
|        | join kind=leftouter (_ciPeer) on $left.OwnerCiKey == $right._peerKey
|        | extend Owner_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, OwnerFactorNames = coalesce(peer_rf_names, dynamic([])), Owner_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(Owner_in_scope, true)
|        // the question -- the owner is on a less critical tier than the application (an owner without a tier is not a known admin)
|        | where isnull(SourceCriticalityTier) or SourceCriticalityTier > si_tier
|        | extend TargetCriticalityTier = toint(si_tier), TargetRiskFactorSet = dynamic([])
|        | extend OwnerWhere = iff(tostring(_ow["of"]) == "application", "application registration", iff(tostring(_ow["of"]) == "service principal", "enterprise application", "enterprise application and application registration"))
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's CI tier (what the path reaches) -- a target without a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Identity", Category = "Attack Paths", Subcategory = "OwnerTakeover"
|        | extend ConfigurationName = strcat("Lower-tier owner of a privileged application -- ", LateralMovementType)
|        // the probability -- the application's factors and the OWNER's (an owner without MFA or with leaked credentials is the easier route)
|        | extend _ownerRf = OwnerFactorNames
|        | mv-apply _of = _ownerRf to typeof(string) on (where isnotempty(trim(" ", _of)) | summarize _ownerTokens = make_set(strcat("Owner", _of)))
|        | extend RiskFactor_Probability = TargetRiskProb + array_length(_ownerTokens)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(set_difference(array_concat(split(TargetRiskProbDetailed, ";"), _ownerTokens), dynamic([""]))), ";")
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | project-away _ownerRf, _ownerTokens
|        | extend AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id)
|        | extend _assetId = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, si_identity_type, "Identity")
|        | extend ConfigurationId = "ATTACKPATH-OWNER-PRIVILEGED-APP"
|        | extend RouteImpact = "Owners of privileged applications can add a credential and sign in as them -- remove owners who are not administrators of the application's tier, or move the ownership to a Tier 0 / Tier 1 administration account"
|        | summarize
|            AssetCount             = dcount(DeviceKey),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            Impact                 = take_any(RouteImpact),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId                 = min(tostring(cmdbId)),
|            cmdbName               = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring("")),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(_assetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Detailed_Owner_to_Privileged_Service_Principal
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend OwnerCiKey = OwnerId
|          | project __siNeeded = pack_array(OwnerCiKey)
|      ReportPurpose: >-
|        Per row, an owner of a Tier 0 or Tier 1 service principal (enterprise application or its application registration) who is on a less critical tier than the application. An owner can add a credential to the application and sign in as it, so the owner's account is a route to the application's privileges. Step one is the ownership (Entra, from the CI), step two the application's own tier and privileges (CI). The row's asset is the application, its tier the application's; the owner's tier is SourceCriticalityTier.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  A lower-tier owner of a privileged application (the CI -- Entra ownership and the tiers)
|        // Step 1  owner -> application (ownership).  Step 2  the application's tier (its roles and permissions, CI).
|        // An owner can add a credential and sign in as the application. Sliced on the application.
|        // =================================================================================================
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        // the question -- a privileged application (its CI tier, Tier 0 or Tier 1)
|        | where si_tier in (0, 1)
|        // every owner of the application, wherever they own it (enterprise application, application registration or both)
|        | extend _owners = coalesce(todynamic(tostring(si_owners)), dynamic([]))
|        | mv-expand _ow = _owners to typeof(dynamic)
|        | extend OwnerId = tolower(tostring(_ow.id)), OwnerName = coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), OwnerOf = tostring(_ow["of"])
|        | where isnotempty(OwnerId)
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // the owner's CI -- the lookup _ciPeer on the owner's Entra object id, after the slice filter
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend OwnerCiKey = OwnerId
|        | join kind=leftouter (_ciPeer) on $left.OwnerCiKey == $right._peerKey
|        | extend Owner_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, OwnerFactorNames = coalesce(peer_rf_names, dynamic([])), Owner_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(Owner_in_scope, true)
|        // the question -- the owner is on a less critical tier than the application (an owner without a tier is not a known admin)
|        | where isnull(SourceCriticalityTier) or SourceCriticalityTier > si_tier
|        | extend TargetCriticalityTier = toint(si_tier), TargetRiskFactorSet = dynamic([])
|        | extend OwnerWhere = iff(tostring(_ow["of"]) == "application", "application registration", iff(tostring(_ow["of"]) == "service principal", "enterprise application", "enterprise application and application registration"))
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's CI tier (what the path reaches) -- a target without a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Identity", Category = "Attack Paths", Subcategory = "OwnerTakeover"
|        | extend ConfigurationName = strcat("Lower-tier owner of a privileged application -- ", LateralMovementType)
|        // the probability -- the application's factors and the OWNER's (an owner without MFA or with leaked credentials is the easier route)
|        | extend _ownerRf = OwnerFactorNames
|        | mv-apply _of = _ownerRf to typeof(string) on (where isnotempty(trim(" ", _of)) | summarize _ownerTokens = make_set(strcat("Owner", _of)))
|        | extend RiskFactor_Probability = TargetRiskProb + array_length(_ownerTokens)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(set_difference(array_concat(split(TargetRiskProbDetailed, ";"), _ownerTokens), dynamic([""]))), ";")
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | project-away _ownerRf, _ownerTokens
|        | extend AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id)
|        | extend _assetId = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, si_identity_type, "Identity")
|        | extend Impact = strcat("Owned by ", OwnerName, " (", iff(isnull(SourceCriticalityTier), "not tiered", strcat("tier ", tostring(SourceCriticalityTier))), ", owner of the ", OwnerWhere, ") -- the owner can add a credential and sign in as this tier ", tostring(si_tier), " application")
|        // one row per owner and application
|        | extend ConfigurationId = strcat(OwnerId, "->", si_ci_id)
|        | extend AssetId = _assetId
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType, Impact,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight, SourceCriticalityTier
|        | order by RiskScore_Weight_Factor desc, RiskFactor_Probability desc, CriticalityTier asc, AssetName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_NoMFA_Summary
|      ReportPurpose: >
|        All enabled users with no MFA registration, across all tiers. Excludes accounts created within the last 7 days. Severity scales with tier.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_NoMFA_Summary
|        // Purpose  Enabled users without MFA registration, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type == "user"
|        // #690 (27) -- a user whose MFA registration was not read is LISTED and labelled by its cause, not readable from Entra (ConfigurationName), never dropped
|        | extend _mfaUnknown = isnull(si_mfa_registered) or coalesce(set_has_element(si_unknown_fields, "si_mfa_registered"), false)
|        | where si_mfa_registered == false or _mfaUnknown
|        | where coalesce(si_is_external, false) == false
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | where isnull(CreatedDays) or CreatedDays > 7
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", CriticalityTier == 2, "Medium", "Low")
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Authentication"
|        | extend Subcategory       = "MFA Registration"
|        | extend ConfigurationName = iff(_mfaUnknown, "User MFA registration not readable from Entra", "User missing MFA registration")
|        | extend ConfigurationId   = "IDENTITY-MFA-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_StaleUser_NoLogin180Days_Summary
|      ReportPurpose: >
|        Enabled user accounts with no interactive or non-interactive sign-in for 180+ days. Excludes guest/B2B accounts (handled separately). Stale privileged accounts are particularly dangerous as they may be forgotten but still retain active permissions.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_StaleUser_NoLogin180Days_Summary
|        // Purpose  Enabled member users with no sign-in for 180+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_is_external, false) == false
|        | where not(si_external_user_state in ("Accepted", "PendingAcceptance"))
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        // #690 (27) -- an account whose last sign-in the CI could not decide is LISTED and labelled by its cause, no data source (ConfigurationName)
|        | where LastSignInDays > 180 or (LastSignInDays == -1 and CreatedDays > 180) or (isnull(LastSignInDays) and (isnull(CreatedDays) or CreatedDays > 180))
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Low"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Account Lifecycle"
|        | extend Subcategory       = "Stale Accounts"
|        | extend ConfigurationName = iff(isnull(LastSignInDays), "User account inactive for 180+ days - no data source for the last sign-in", "User account inactive for 180+ days")
|        | extend ConfigurationId   = "IDENTITY-STALE-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_StaleUser_NoLogin180Days_Detailed
|      ReportPurpose: >
|        Per-user detail for enabled accounts with no sign-in for 180+ days. Excludes guest/B2B. Includes last sign-in dates, role details, and tier.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_StaleUser_NoLogin180Days_Detailed
|        // Purpose  Enabled member users with no sign-in for 180+ days, one row per account, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_is_external, false) == false
|        | where not(si_external_user_state in ("Accepted", "PendingAcceptance"))
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        // #690 (27) -- an account whose last sign-in the CI could not decide is LISTED and labelled by its cause, no data source (ConfigurationName)
|        | where LastSignInDays > 180 or (LastSignInDays == -1 and CreatedDays > 180) or (isnull(LastSignInDays) and (isnull(CreatedDays) or CreatedDays > 180))
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Low"
|        | extend SecurityDomain     = "Identity"
|        | extend Category           = "Account Lifecycle"
|        | extend Subcategory        = "Stale Accounts"
|        | extend ConfigurationName  = iff(isnull(LastSignInDays), "User account inactive for 180+ days - no data source for the last sign-in", "User account inactive for 180+ days")
|        | extend ConfigurationId    = "IDENTITY-STALE-001"
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        // asset risk factors -- the CI's evaluation (data-model/risk-factors.locked.json), never this report's own
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_link_entra, Department = si_org_department,
|                  LastSignInDateTime = si_last_sign_in, LastSignInDays,
|                  CreatedDays, Tier = si_tier, IsPrivileged, EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, LastSignInDays desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_StaleGuest_NoLogin90Days_Summary
|      ReportPurpose: >
|        B2B guest/external collaborator accounts with no sign-in for 90+ days. Guests have a shorter stale threshold than internal users as they represent external access that should be regularly re-validated. Stale guest accounts are a common vector for supply chain and partner-related compromises.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_StaleGuest_NoLogin90Days_Summary
|        // Purpose  Enabled guest / external users with no sign-in for 90+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_is_external == true or si_external_user_state in ("Accepted", "PendingAcceptance")
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        // #690 (27) -- a guest whose last sign-in the CI could not decide is LISTED and labelled by its cause, no data source (ConfigurationName)
|        | where LastSignInDays > 90 or (LastSignInDays == -1 and CreatedDays > 90) or (isnull(LastSignInDays) and (isnull(CreatedDays) or CreatedDays > 90))
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Low"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Account Lifecycle"
|        | extend Subcategory       = "Guest / External Access"
|        | extend ConfigurationName = iff(isnull(LastSignInDays), "Guest account inactive for 90+ days - no data source for the last sign-in", "Guest account inactive for 90+ days")
|        | extend ConfigurationId   = "IDENTITY-GUEST-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(si_display_name, " (", tostring(split(si_upn, '@')[1]), ")"))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(strcat(si_display_name, " (", tostring(split(si_upn, '@')[1]), ")"), "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedSPN_NoLogin180Days_Summary
|      ReportPurpose: >
|        Service Principals and Managed Identities with Tier 0/1 permissions (high-privilege app roles or directory roles) that have not authenticated for 180+ days. Dormant privileged workload identities are attractive targets as they may retain permissions long after the business use case has ended.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_high_privilege_app_permissions = dynamic(["RoleManagement.ReadWrite.Directory", "AppRoleAssignment.ReadWrite.All", "Directory.ReadWrite.All", "Application.ReadWrite.All", "Application.ReadWrite.OwnedBy", "Group.ReadWrite.All", "GroupMember.ReadWrite.All", "User.ReadWrite.All", "UserAuthenticationMethod.ReadWrite.All", "Policy.ReadWrite.ConditionalAccess", "Policy.ReadWrite.AuthenticationMethod", "Domain.ReadWrite.All", "IdentityRiskyUser.ReadWrite.All", "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementRBAC.ReadWrite.All", "RoleEligibilitySchedule.ReadWrite.Directory", "RoleAssignmentSchedule.ReadWrite.Directory", "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup", "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup", "RoleManagementPolicy.ReadWrite.Directory", "RoleManagementPolicy.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureAD", "PrivilegedAccess.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureResources", "Mail.ReadWrite", "Mail.Send", "full_access_as_app", "EWS.AccessAsApp", "Files.ReadWrite.All", "Sites.FullControl.All", "Sites.ReadWrite.All", "Exchange.ManageAsApp"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedSPN_NoLogin180Days_Summary
|        // Purpose  Enabled service principals / managed identities with no sign-in for 180+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | where LastSignInDays > 180 or (LastSignInDays == -1 and CreatedDays > 180)
|        // privileged (the name and purpose) -- a Tier 0 / 1 application permission (data-model list high_privilege_app_permissions), the privilege tier catalog's high-risk permission, a Tier 0 / 1 Entra role (permanent or eligible), or a Tier 0 / 1 CI
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend HighPermissions = set_intersect(_permsD, SI_List_high_privilege_app_permissions)
|        | extend HighPermissions = iff(array_length(HighPermissions) > 0, HighPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_high_privilege_app_permissions)))))
|        // #690 the Azure side of privileged -- an Owner, Contributor or User Access Administrator role at any Azure scope (si_azure_role_assignments, one item or a list)
|        | extend AzurePrivilegedRoles = coalesce(extract_all(@'"RoleName"\s*:\s*"(Owner|Contributor|User Access Administrator)"', tostring(si_azure_role_assignments)), dynamic([]))
|        | extend _privKnown = isnotnull(si_high_risk_permission_grant) or isnotnull(si_privilege_tier_permanent) or isnotnull(si_tier) or array_length(_permsD) > 0 or isnotempty(tostring(si_azure_role_assignments))
|        | extend _isPrivileged = array_length(HighPermissions) > 0 or si_high_risk_permission_grant == true or si_privilege_tier_permanent in (0, 1) or si_privilege_tier_eligible in (0, 1) or si_tier in (0, 1) or array_length(AzurePrivilegedRoles) > 0
|        // a workload whose permissions and tier SI could not read stays in, labelled -- never dropped as not privileged
|        | where _isPrivileged or not(_privKnown)
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Stale Privileged Workloads"
|        | extend ConfigurationName = "Privileged SPN/MI inactive for 180+ days"
|        | extend ConfigurationId   = "IDENTITY-SPN-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedSPN_NoLogin180Days_Detailed
|      ReportPurpose: >
|        Per-SPN/MI detail for privileged workloads inactive for 180+ days. Includes permission details, credential info, and owner status.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_high_privilege_app_permissions = dynamic(["RoleManagement.ReadWrite.Directory", "AppRoleAssignment.ReadWrite.All", "Directory.ReadWrite.All", "Application.ReadWrite.All", "Application.ReadWrite.OwnedBy", "Group.ReadWrite.All", "GroupMember.ReadWrite.All", "User.ReadWrite.All", "UserAuthenticationMethod.ReadWrite.All", "Policy.ReadWrite.ConditionalAccess", "Policy.ReadWrite.AuthenticationMethod", "Domain.ReadWrite.All", "IdentityRiskyUser.ReadWrite.All", "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementRBAC.ReadWrite.All", "RoleEligibilitySchedule.ReadWrite.Directory", "RoleAssignmentSchedule.ReadWrite.Directory", "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup", "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup", "RoleManagementPolicy.ReadWrite.Directory", "RoleManagementPolicy.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureAD", "PrivilegedAccess.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureResources", "Mail.ReadWrite", "Mail.Send", "full_access_as_app", "EWS.AccessAsApp", "Files.ReadWrite.All", "Sites.FullControl.All", "Sites.ReadWrite.All", "Exchange.ManageAsApp"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedSPN_NoLogin180Days_Detailed
|        // Purpose  Enabled service principals / managed identities with no sign-in for 180+ days, one row per identity, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | where LastSignInDays > 180 or (LastSignInDays == -1 and CreatedDays > 180)
|        // privileged (the name and purpose) -- a Tier 0 / 1 application permission (data-model list high_privilege_app_permissions), the privilege tier catalog's high-risk permission, a Tier 0 / 1 Entra role (permanent or eligible), or a Tier 0 / 1 CI
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend HighPermissions = set_intersect(_permsD, SI_List_high_privilege_app_permissions)
|        | extend HighPermissions = iff(array_length(HighPermissions) > 0, HighPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_high_privilege_app_permissions)))))
|        // #690 the Azure side of privileged -- an Owner, Contributor or User Access Administrator role at any Azure scope (si_azure_role_assignments, one item or a list)
|        | extend AzurePrivilegedRoles = coalesce(extract_all(@'"RoleName"\s*:\s*"(Owner|Contributor|User Access Administrator)"', tostring(si_azure_role_assignments)), dynamic([]))
|        | extend _privKnown = isnotnull(si_high_risk_permission_grant) or isnotnull(si_privilege_tier_permanent) or isnotnull(si_tier) or array_length(_permsD) > 0 or isnotempty(tostring(si_azure_role_assignments))
|        | extend _isPrivileged = array_length(HighPermissions) > 0 or si_high_risk_permission_grant == true or si_privilege_tier_permanent in (0, 1) or si_privilege_tier_eligible in (0, 1) or si_tier in (0, 1) or array_length(AzurePrivilegedRoles) > 0
|        // a workload whose permissions and tier SI could not read stays in, labelled -- never dropped as not privileged
|        | where _isPrivileged or not(_privKnown)
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        | extend SecurityDomain     = "Identity"
|        | extend Category           = "Workload Identities"
|        | extend Subcategory        = "Stale Privileged Workloads"
|        | extend ConfigurationName  = "Privileged SPN/MI inactive for 180+ days"
|        | extend ConfigurationId    = "IDENTITY-SPN-001"
|        | extend _why = array_concat(HighPermissions,
|            iff(si_privilege_tier_permanent in (0, 1), pack_array(strcat("Tier ", tostring(si_privilege_tier_permanent), " Entra role")), dynamic([])),
|            iff(si_privilege_tier_eligible in (0, 1), pack_array(strcat("eligible Tier ", tostring(si_privilege_tier_eligible), " Entra role")), dynamic([])),
|            iff(si_high_risk_permission_grant == true and array_length(HighPermissions) == 0, dynamic(["a high-risk application permission"]), dynamic([])),
|            iff(si_tier in (0, 1), pack_array(strcat("CI tier ", tostring(si_tier))), dynamic([])),
|            iff(array_length(AzurePrivilegedRoles) > 0, pack_array(strcat("Azure ", strcat_array(set_union(AzurePrivilegedRoles, dynamic([])), " / "))), dynamic([])))
|        | extend Impact = iff(not(_privKnown), "Privilege not readable -- SI could not read this workload's permissions, roles or tier", strcat("Privileged - ", strcat_array(_why, ", ")))
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        // asset risk factors -- the CI's evaluation (data-model/risk-factors.locked.json), never this report's own
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | extend si_fix_remediation = strcat("Confirm with the owner that ", coalesce(si_display_name, si_asset_name), " is still needed", iff(isempty(si_owner), " (no owner is recorded)", strcat(" (owner - ", si_owner, ")")), ". ", iff(isnull(si_last_sign_in), "No sign-in is recorded for it", strcat("Its last sign-in was ", format_datetime(si_last_sign_in, "yyyy-MM-dd"))), ". If it is not needed, remove its roles and permissions and disable it. If it is needed, keep only the roles and permissions it uses.", iff(isempty(si_attached_resource), "", strcat(" It is the managed identity of ", si_attached_resource, ".")))
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  Impact,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_link_entra, ObjectType = si_identity_type, ServicePrincipalType = si_sp_type,
|                  LastSignInDateTime = si_last_sign_in, LastSignInDays, CreatedDays, Tier = si_tier,
|                  EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent, CredentialExpiryDays = si_credential_expiry_days,
|                  IsOrphanSPN = si_is_orphan_sp, IsManagedIdentity, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor,
|                  si_owner, si_owner_upns, si_credentials, si_attached_resource, si_fix_remediation
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_ExpiringCredentials_Summary
|      ReportPurpose: >
|        Service Principals with client secrets or certificates that have expired or will expire within 30 days. Expired credentials cause service outages. Credentials expiring on privileged SPNs are especially urgent as emergency secret rotation under pressure increases risk of mistakes or insecure handling.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_ExpiringCredentials_Summary
|        // Purpose  Service principals / managed identities with expired or expiring credentials, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | where si_credential_expiry_days between (-3650 .. 30)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Credential Hygiene"
|        | extend ConfigurationName = "SPN with expired or expiring credentials"
|        | extend ConfigurationId   = "IDENTITY-SPN-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_Orphan_NoOwner_Summary
|      ReportPurpose: >
|        Service Principals with no registered owner. Ownerless SPNs have no accountability for credential rotation, permission review, or decommissioning. Privileged orphaned SPNs are critical: no one is responsible for monitoring or revoking access.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_Orphan_NoOwner_Summary
|        // Purpose  Service principals with no registered owner, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        | where si_is_orphan_sp == true
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Low"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Orphaned Applications"
|        | extend ConfigurationName = "Service principal with no registered owner"
|        | extend ConfigurationId   = "IDENTITY-SPN-003"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PermanentPrivilegedRole_Summary
|      ReportPurpose: >
|        Privileged users with permanent (non-PIM) role assignments. Best practice requires all Tier 0/1 roles to be assigned via PIM (just-in-time) to reduce the standing attack surface. Permanent assignments mean the role is always active, even when not in use, providing a persistent target for attackers.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PermanentPrivilegedRole_Summary
|        // Purpose  Enabled users with a permanent (not PIM) privileged Entra role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_privilege_tier_permanent, 99) <= 1
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Just-In-Time Access"
|        | extend ConfigurationName = "Permanent privileged role assignment - PIM not used"
|        | extend ConfigurationId   = "IDENTITY-PIM-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ShadowAdmin_Summary
|      ReportPurpose: >
|        Users classified as shadow admins: they hold Tier 0/1 AD group membership (e.g. Domain Admins inherited via group nesting) but have no visible Entra ID role assignments. These accounts exercise privileged AD access that may not be tracked by standard Entra ID governance tooling, creating a blind spot in access reviews and PIM coverage.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ShadowAdmin_Summary -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | where si_identity_type in ("user", "guest")
|        // #690 (29) -- a shadow admin is read from the CI fields -- critical AD group membership (si_ad_critical_groups, from the
|        // Exposure Graph and Defender for Identity) and NO Entra role, permanent or eligible. The profile flag si_is_shadow_admin
|        // is still honoured, but it is never set for an AD-only account (no Entra record) -- exactly the shadow admins.
|        // A dictionary-shaped value (type + data) is read through .data, and a missing role list is no role
|        // (array_length of null is null, never 0).
|        | extend _critAdGroups = iff(gettype(si_ad_critical_groups) == "dictionary", si_ad_critical_groups.data, si_ad_critical_groups)
|        | extend _hasCritAdGroup = coalesce(array_length(_critAdGroups), 0) > 0
|        | extend _entraRoleCount = coalesce(array_length(si_entra_roles_permanent), 0) + coalesce(array_length(si_entra_roles_eligible), 0)
|        | where coalesce(si_is_shadow_admin, false) == true or (_hasCritAdGroup and _entraRoleCount == 0)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Shadow Admins"
|        | extend ConfigurationName = "Shadow admin - privileged AD access not visible in Entra ID"
|        | extend ConfigurationId   = "IDENTITY-SHADOW-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PasswordNeverExpires_Privileged_Summary
|      ReportPurpose: >
|        Privileged accounts with password-never-expires flag set. While passwordless and MFA mitigate this, a non-expiring password on a privileged account means a compromised credential remains valid indefinitely. Combined with no MFA or stale sign-in, this represents a critical unmanaged risk.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PasswordNeverExpires_Privileged_Summary -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | where si_identity_type in ("user", "guest")
|        // an UNKNOWN never-expires flag (no source could read it, e.g. a synced account) is listed and labelled
|        // PasswordNeverExpiresNoDataSource (the cause), never dropped
|        | extend _pneUnknown = isnull(si_password_never_expires) or set_has_element(si_unknown_fields, "si_password_never_expires")
|        | where coalesce(si_password_never_expires, false) == true or _pneUnknown
|        | extend si_rf_names_ = iff(_pneUnknown, array_concat(coalesce(si_rf_names_, dynamic([])), dynamic(["PasswordNeverExpiresNoDataSource"])), si_rf_names_)
|        | where coalesce(si_passwordless_only, false) == false
|        // #690 (23) -- the purpose is PRIVILEGED accounts -- a Tier 0/1 Entra role (permanent or eligible) or membership of a
|        // critical Active Directory group (Domain Admins and the like, the usual home of a never-expiring password)
|        | where coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1 or coalesce(array_length(iff(gettype(si_ad_critical_groups) == "dictionary", si_ad_critical_groups.data, si_ad_critical_groups)), 0) > 0
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Password Policy"
|        | extend Subcategory       = "Password Never Expires"
|        | extend ConfigurationName = "Privileged account with password-never-expires"
|        | extend ConfigurationId   = "IDENTITY-PWD-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_MultiTenant_HighPermission_SPN_Summary
|      ReportPurpose: >
|        Multi-tenant service principals (accessible from external tenants) with Tier 0/1 permissions. Multi-tenant apps expose credentials and permissions to external party control. If a partner tenant is compromised, the SPN can be leveraged to attack your tenant with full privileges.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_directory_write_permissions = dynamic(["Directory.ReadWrite.All"]);
|        let SI_List_high_privilege_app_permissions = dynamic(["RoleManagement.ReadWrite.Directory", "AppRoleAssignment.ReadWrite.All", "Directory.ReadWrite.All", "Application.ReadWrite.All", "Application.ReadWrite.OwnedBy", "Group.ReadWrite.All", "GroupMember.ReadWrite.All", "User.ReadWrite.All", "UserAuthenticationMethod.ReadWrite.All", "Policy.ReadWrite.ConditionalAccess", "Policy.ReadWrite.AuthenticationMethod", "Domain.ReadWrite.All", "IdentityRiskyUser.ReadWrite.All", "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementRBAC.ReadWrite.All", "RoleEligibilitySchedule.ReadWrite.Directory", "RoleAssignmentSchedule.ReadWrite.Directory", "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup", "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup", "RoleManagementPolicy.ReadWrite.Directory", "RoleManagementPolicy.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureAD", "PrivilegedAccess.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureResources", "Mail.ReadWrite", "Mail.Send", "full_access_as_app", "EWS.AccessAsApp", "Files.ReadWrite.All", "Sites.FullControl.All", "Sites.ReadWrite.All", "Exchange.ManageAsApp"]);
|        let SI_List_microsoft_first_party_tenants = dynamic(["f8cdef31-a31e-4b4a-93e4-5f571e91255a", "72f988bf-86f1-41af-91ab-2d7cd011db47"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_MultiTenant_HighPermission_SPN_Summary
|        // Purpose  Third-party multi-tenant service principals, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        | extend _perms = tostring(si_app_permissions)
|        | extend IsMultiTenant = si_is_third_party_multitenant
|        | where IsMultiTenant == true
|        // high privilege (the purpose) -- a Tier 0 / 1 application permission (data-model list high_privilege_app_permissions), the privilege tier catalog's high-risk permission, or a Tier 0 / 1 Entra role
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend HighPermissions = set_intersect(_permsD, SI_List_high_privilege_app_permissions)
|        | extend HighPermissions = iff(array_length(HighPermissions) > 0, HighPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_high_privilege_app_permissions)))))
|        | extend _privKnown = isnotnull(si_high_risk_permission_grant) or isnotnull(si_privilege_tier_permanent) or array_length(_permsD) > 0
|        | extend _isPrivileged = array_length(HighPermissions) > 0 or si_high_risk_permission_grant == true or si_privilege_tier_permanent in (0, 1)
|        // a service principal whose permissions SI could not read stays in, labelled -- never dropped as not privileged
|        | where _isPrivileged or not(_privKnown)
|        // Microsoft's own applications are owned by another tenant but are not a partner's -- kept, labelled apart (a view filters them)
|        | extend _isMicrosoft = tolower(si_app_owner_org_id) in (SI_List_microsoft_first_party_tenants)
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RF_P_HasDirectoryWrite = iff(_perms has_any (SI_List_directory_write_permissions), 1, 0)
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors) + RF_P_HasDirectoryWrite
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            RF_P_CiFactorNames,
|            iff(RF_P_HasDirectoryWrite == 1, dynamic(["HasDirectoryWrite"]),     dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("HasDirectoryWrite=", tostring(RF_P_HasDirectoryWrite))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = iff(_isMicrosoft, "Multi-Tenant Exposure - Microsoft first-party application", "Multi-Tenant Exposure")
|        | extend ConfigurationName = "Multi-tenant SPN with high-privilege permissions"
|        | extend ConfigurationId   = "IDENTITY-SPN-004"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ExternalUser_PrivilegedRole_Summary
|      ReportPurpose: >
|        External/B2B guest users with Tier 0/1 Entra ID roles. External identities should never hold privileged directory roles. Their accounts are governed by their home tenant's security posture which may be significantly lower than yours. A compromised partner account with Global Admin in your tenant is a catastrophic risk.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ExternalUser_PrivilegedRole_Summary
|        // Purpose  Enabled guest / external users, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_is_external == true or si_external_user_state in ("Accepted", "PendingAcceptance")
|        // #690 (23) -- the purpose is an external user WITH a Tier 0/1 Entra role, permanent or eligible
|        | where coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "External Identity Risk"
|        | extend ConfigurationName = "External user with privileged Entra ID role"
|        | extend ConfigurationId   = "IDENTITY-EXT-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(si_display_name, " (", tostring(split(si_upn, '@')[1]), ")"))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(strcat(si_display_name, " (", tostring(split(si_upn, '@')[1]), ")"), "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedUser_StalePassword_Summary
|      ReportPurpose: >
|        Privileged accounts whose password has not been changed in over 365 days. Long-lived passwords increase the window of exploitation if credentials were exposed in a breach that was never detected. Applies to accounts where password authentication is still a factor (non-passwordless-only accounts).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedUser_StalePassword_Summary -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_passwordless_only, false) == false
|        // an UNKNOWN password age (no date from any source) is listed and labelled PasswordAgeNoDataSource (the cause), never dropped
|        | extend _pwAgeUnknown = isnull(PasswordLastChangedDays) and not(set_has_element(si_rf_p, "old_password"))
|        | where set_has_element(si_rf_p, "old_password") or _pwAgeUnknown
|        // the report's question is a privileged ROLE -- the identity's role tier (a Tier 0 / Tier 1 Entra role held
|        // permanently or eligible) decides, and the account's own tier still counts (never fewer rows than before)
|        | extend _roleTier = min_of(coalesce(si_privilege_tier_permanent, 99), coalesce(si_privilege_tier_eligible, 99))
|        | where _roleTier <= 1 or isnull(si_tier) or si_tier in (0, 1)
|        | extend CriticalityTier = toint(case(isnull(si_tier) and _roleTier > 3, int(null), isnull(si_tier), _roleTier, _roleTier > 3, toint(si_tier), min_of(_roleTier, toint(si_tier))))
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        | extend _pwOver730       = iff(PasswordLastChangedDays > 730, 1, 0)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = _pwOver730 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            iff(_pwOver730      == 1, dynamic(["PasswordOver730Days"]),    dynamic([])),
|            iff(_pwAgeUnknown, dynamic(["PasswordAgeNoDataSource"]), dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("PasswordOver730Days=", tostring(_pwOver730))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Password Policy"
|        | extend Subcategory       = "Stale Passwords"
|        | extend ConfigurationName = "Privileged user with password unchanged for 365+ days"
|        | extend ConfigurationId   = "IDENTITY-PWD-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_MailboxAccess_Summary
|      ReportPurpose: >
|        Service Principals with mailbox-level Microsoft Graph permissions (Mail.ReadWrite, Mail.Send, MailboxSettings.ReadWrite or equivalent). These permissions allow an app to read all email in the organisation or send as any user - a high-value target for data exfiltration and business email compromise (BEC). SPNs with mailbox access and no active usage are especially concerning.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_mail_access_permissions = dynamic(["Mail.Read", "Mail.ReadWrite", "Mail.Send", "Mail.ReadBasic", "Mail.ReadBasic.All", "Mail-Advanced.ReadWrite.All", "MailboxSettings.ReadWrite", "MailboxItem.Read.All", "MailboxItem.ImportExport.All", "MailboxFolder.Read.All", "MailboxFolder.ReadWrite.All", "Mailbox.Migration", "full_access_as_app", "EWS.AccessAsApp", "EWS.AccessAsUser.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_MailboxAccess_Summary
|        // Purpose  Enabled service principals / managed identities with organisation-wide mailbox permissions, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend _perms = tostring(si_app_permissions)
|        | extend IsMultiTenant = si_is_third_party_multitenant
|        // every mail / mailbox application permission (data-model list mail_access_permissions), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_permsD, SI_List_mail_access_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_mail_access_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Low"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier <= 1, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Overprivileged Applications"
|        | extend ConfigurationName = "SPN with organisation-wide mailbox access"
|        | extend ConfigurationId   = "IDENTITY-SPN-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_HighValueTarget_MDIRisk_Summary
|      ReportPurpose: >
|        Identities flagged by Microsoft Defender for Identity as high or critical risk, cross-referenced with our asset tier classification. MDI risk signals include observed lateral movement, credential exposure, anomalous behaviour, and UEBA scoring. When a Tier 0/1 identity has elevated MDI risk, it indicates an active or recent threat that requires immediate investigation.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_HighValueTarget_MDIRisk_Summary
|        // Purpose  Enabled users that Defender for Identity rates high risk or at risk, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_mdi_risk_state in ("high", "at_risk")
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Threat Intelligence"
|        | extend Subcategory       = "MDI Risk Signals"
|        | extend ConfigurationName = "Identity with elevated MDI risk score"
|        | extend ConfigurationId   = "IDENTITY-THREAT-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedUser_SignIn_NonTrustedLocation_Summary
|      ReportPurpose: >
|        Privileged users (Tier 0/1) who have successfully signed in from a network location that is NOT defined as a trusted named location in Conditional Access. Admin accounts should only authenticate from managed, trusted networks (corporate VPN, PAW networks, known office IPs). Sign-in from an untrusted location on a privileged account is a strong indicator of credential compromise, policy bypass, or an admin using personal devices/networks for privileged tasks. Severity: Very High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedUser_SignIn_NonTrustedLocation_Summary
|        // Purpose  Privileged users with successful sign-ins from a network location that is not a trusted named location
|        // (30 days), one row per user.
|        // The sign-ins come from Entra's sign-in events in advanced hunting (EntraIdSignInEvents, interactive and
|        // non-interactive) -- SigninLogs is only in a workspace that receives Entra's diagnostic export, and where the
|        // install's workspace has none the report was silently empty (#690 (45)). A privileged user is an account Defender
|        // for Identity lists with an Entra role (AssignedRoles, or a PIM role), or a CI with a permanent privileged role or
|        // tier 0 / 1. Tier, CMDB values and factors come from the CI (_ciLink), joined on the Entra object id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        let _roleHolders =
|            IdentityInfo
|            | where Timestamp > ago(14d)
|            | where isnotempty(AccountObjectId)
|            | summarize arg_max(Timestamp, *) by AccountObjectId
|            | where Type == "User"
|            | extend HasEntraRole = coalesce(array_length(AssignedRoles), 0) > 0 or coalesce(array_length(bag_keys(PrivilegedEntraPimRoles)), 0) > 0
|            | extend RoleHolderKey = tolower(AccountObjectId)
|            | where isnotempty(RoleHolderKey)
|            | project RoleHolderKey, HasEntraRole;
|        EntraIdSignInEvents
|        | where Timestamp > ago(30d)
|        | where ErrorCode == 0
|        | extend UserKey = tolower(AccountObjectId)
|        | where isnotempty(UserKey)
|        // one row per sign-in, also when its location list is empty (mv-expand drops such a sign-in -- the untrusted case
|        // itself) -- a sign-in is from a trusted location when ANY of its locations is a trusted named location
|        | extend IsTrusted = iff(tostring(NetworkLocationDetails) has "trustedNamedLocation", 1, 0)
|        | where IsTrusted == 0
|        | summarize
|            NonTrustedSigninCount = count(),
|            LastNonTrustedSignin  = max(Timestamp),
|            UniqueIPs             = dcount(IPAddress),
|            SampleIPs             = strcat_array(make_set(IPAddress, 5), ";"),
|            Countries             = strcat_array(make_set(Country, 5), ";"),
|            SignInUpn             = tolower(take_any(AccountUpn)),
|            SignInDisplayName     = take_any(AccountDisplayName)
|          by UserKey
|        | join kind=leftouter _roleHolders on $left.UserKey == $right.RoleHolderKey
|        | extend DeviceKey = UserKey
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | where coalesce(si_in_scope_, true)
|        | extend HasPermanentPrivilegedRole = set_has_element(coalesce(si_rf_p, dynamic([])), "permanent_privileged_role")
|        | where coalesce(HasEntraRole, false) or HasPermanentPrivilegedRole or toint(si_tier) in (0, 1)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        // sign-in behaviour -- this report's own
|        | extend RF_P_Frequent       = iff(NonTrustedSigninCount > 5, 1, 0)
|        | extend RF_P_MultipleIPs    = iff(UniqueIPs > 3, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_Frequent + RF_P_MultipleIPs + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["NonTrustedLocationSignin"]),
|            iff(RF_P_Frequent    == 1, dynamic(["FrequentNonTrusted5plus"]),dynamic([])),
|            iff(RF_P_MultipleIPs == 1, dynamic(["MultipleUniqueIPs"]),      dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("NonTrustedLocationSignin=1;FrequentNonTrusted5plus=", tostring(RF_P_Frequent),
|                   ";MultipleUniqueIPs=", tostring(RF_P_MultipleIPs))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Sign-in Behaviour"
|        | extend Subcategory       = "Location Anomalies"
|        | extend ConfigurationName = "Privileged user signed in from non-trusted network location"
|        | extend ConfigurationId   = "IDENTITY-SIGNIN-001"
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, UserKey)
|        | extend AssetName = coalesce(si_asset_name, SignInDisplayName, SignInUpn, AssetId)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(AssetId),
|            TotalIssues            = sum(NonTrustedSigninCount),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", AssetId)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(UserKey),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(AssetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedUser_SignIn_NonTrustedLocation_Detailed
|      ReportPurpose: >
|        Per-user detail: privileged accounts with non-trusted location sign-ins. Shows sign-in count, IPs, countries, and last occurrence.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedUser_SignIn_NonTrustedLocation_Detailed
|        // Purpose  Privileged users with successful sign-ins from a network location that is not a trusted named location
|        // (30 days), one row per user.
|        // The sign-ins come from Entra's sign-in events in advanced hunting (EntraIdSignInEvents, interactive and
|        // non-interactive) -- SigninLogs is only in a workspace that receives Entra's diagnostic export, and where the
|        // install's workspace has none the report was silently empty (#690 (45)). A privileged user is an account Defender
|        // for Identity lists with an Entra role (AssignedRoles, or a PIM role), or a CI with a permanent privileged role or
|        // tier 0 / 1. Tier, CMDB values and factors come from the CI (_ciLink), joined on the Entra object id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        let _roleHolders =
|            IdentityInfo
|            | where Timestamp > ago(14d)
|            | where isnotempty(AccountObjectId)
|            | summarize arg_max(Timestamp, *) by AccountObjectId
|            | where Type == "User"
|            | extend HasEntraRole = coalesce(array_length(AssignedRoles), 0) > 0 or coalesce(array_length(bag_keys(PrivilegedEntraPimRoles)), 0) > 0
|            | extend RoleHolderKey = tolower(AccountObjectId)
|            | where isnotempty(RoleHolderKey)
|            | project RoleHolderKey, HasEntraRole;
|        EntraIdSignInEvents
|        | where Timestamp > ago(30d)
|        | where ErrorCode == 0
|        | extend UserKey = tolower(AccountObjectId)
|        | where isnotempty(UserKey)
|        // one row per sign-in, also when its location list is empty (mv-expand drops such a sign-in -- the untrusted case
|        // itself) -- a sign-in is from a trusted location when ANY of its locations is a trusted named location
|        | extend IsTrusted = iff(tostring(NetworkLocationDetails) has "trustedNamedLocation", 1, 0)
|        | where IsTrusted == 0
|        | summarize
|            NonTrustedSigninCount = count(),
|            LastNonTrustedSignin  = max(Timestamp),
|            UniqueIPs             = dcount(IPAddress),
|            SampleIPs             = strcat_array(make_set(IPAddress, 5), ";"),
|            Countries             = strcat_array(make_set(Country, 10), ";"),
|            SignInUpn             = tolower(take_any(AccountUpn)),
|            SignInDisplayName     = take_any(AccountDisplayName)
|          by UserKey
|        | join kind=leftouter _roleHolders on $left.UserKey == $right.RoleHolderKey
|        | extend DeviceKey = UserKey
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | where coalesce(si_in_scope_, true)
|        | extend HasPermanentPrivilegedRole = set_has_element(coalesce(si_rf_p, dynamic([])), "permanent_privileged_role")
|        | where coalesce(HasEntraRole, false) or HasPermanentPrivilegedRole or toint(si_tier) in (0, 1)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity      = "High"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Sign-in Behaviour"
|        | extend Subcategory           = "Location Anomalies"
|        | extend ConfigurationName     = "Privileged user signed in from non-trusted network location"
|        | extend ConfigurationId       = "IDENTITY-SIGNIN-001"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RF_P_Frequent       = iff(NonTrustedSigninCount > 5, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_Frequent + array_length(RF_P_CiFactors)
|        | extend AssetName = coalesce(si_asset_name, SignInDisplayName, SignInUpn, UserKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, UserKey)
|        | extend AssetType = "Identity"
|        // MFA as the CI's no_mfa factor says it (the link block carries the factors, not the field) -- unknown otherwise
|        | extend DisplayName = SignInDisplayName, Upn = SignInUpn, PrimaryEntityId = AssetId, Tier = si_tier, MfaIsRegistered = iff(set_has_element(RF_P_CiFactors, "no_mfa"), false, bool(null))
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  DisplayName, Upn, PrimaryEntityId, Tier, MfaIsRegistered, HasPermanentPrivilegedRole,
|                  NonTrustedSigninCount, LastNonTrustedSignin, UniqueIPs, SampleIPs, Countries,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, NonTrustedSigninCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ServiceAccount_SignIn_NonTrustedLocation_Summary
|      ReportPurpose: >
|        Accounts classified as service accounts by MDI (MDI_IsServiceAccount = true) that have successfully authenticated from non-trusted network locations. Service accounts are expected to authenticate exclusively from known, trusted infrastructure (application servers, automation agents). Authentication from an untrusted location strongly suggests the service account credentials have been harvested and are being used by a threat actor. Severity: High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ServiceAccount_SignIn_NonTrustedLocation_Summary -- the service accounts come from the CI (SI_CI_CL), REQUIREMENTS #505; their sign-ins join on the Entra object id.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        let ServiceAccounts =
|            _ciAsset
|            | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|            | where si_identity_type in ("user", "guest")
|            | where coalesce(si_is_service_account, false) == true
|            | extend CriticalityTier = toint(si_tier)
|            | extend EntraId = tolower(si_link_entra)
|            | project EntraId, DisplayName = coalesce(si_display_name, si_upn, si_asset_name), si_ci_id, si_rf_p,
|                      si_cmdb_id, si_cmdb_name, si_cmdb_criticality, si_cmdb_data_sensitivity, si_asset_type, si_link_entra,
|                      CriticalityTier, IsPrivileged;
|
|        let NonTrustedSignins =
|            union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
|            | where TimeGenerated >= ago(90d)
|            | where ResultType == 0
|            | extend EntraId = tolower(tostring(UserId))
|            | where isnotempty(EntraId)
|            // one row per sign-in, also when its location list is empty (mv-expand drops such a sign-in -- the untrusted case
|            // itself) -- a sign-in is from a trusted location when ANY of its locations is a trusted named location
|            | extend IsTrusted = iff(tostring(NetworkLocationDetails) has "trustedNamedLocation", 1, 0)
|            | where IsTrusted == 0
|            | summarize
|                NonTrustedSigninCount = count(),
|                LastNonTrustedSignin  = max(TimeGenerated),
|                UniqueIPs             = dcount(IPAddress),
|                SampleIPs             = strcat_array(make_set(IPAddress, 5), ";"),
|                Countries             = strcat_array(make_set(Location, 10), ";")
|              by EntraId;
|
|        ServiceAccounts
|        | join kind=inner NonTrustedSignins on EntraId
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity    = "High"
|        | extend RF_P_Frequent       = iff(NonTrustedSigninCount > 3, 1, 0)
|        | extend RF_P_MultiCountry   = iff(array_length(split(Countries, ";")) > 1, 1, 0)
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1 + RF_P_Frequent + RF_P_MultiCountry
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["NonTrustedLocationSignin"]),
|            iff(RF_P_Frequent     == 1, dynamic(["FrequentNonTrusted3plus"]), dynamic([])),
|            iff(RF_P_MultiCountry == 1, dynamic(["MultipleCountries"]),       dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("NonTrustedLocationSignin=1;FrequentNonTrusted3plus=", tostring(RF_P_Frequent),
|                   ";MultipleCountries=", tostring(RF_P_MultiCountry))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Sign-in Behaviour"
|        | extend Subcategory       = "Location Anomalies"
|        | extend ConfigurationName = "Service account authenticated from non-trusted network location"
|        | extend ConfigurationId   = "IDENTITY-SIGNIN-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = DisplayName
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = sum(NonTrustedSigninCount),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            AssetId                = min(si_ci_id)
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_BreakGlass_SignIn_Detected_Summary
|      ReportPurpose: >
|        Any successful sign-in by an account flagged as a break-glass emergency account. Break-glass accounts are only valid for use during genuine catastrophic failures where normal admin access is unavailable. Every sign-in by a break-glass account must be investigated to confirm it was authorised and justified. This is an operational alert that should trigger an immediate review process. Severity: Very High (fixed)  --  all break-glass usage is critical regardless of context.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_BreakGlass_SignIn_Detected_Summary
|        // Purpose  Successful sign-ins by an emergency-access (break-glass) account in the last 30 days.
|        // The accounts come from the CI (si_is_break_glass, REQUIREMENTS #505), the sign-ins from SigninLogs (provider),
|        // joined on the Entra object id (SigninLogs UserId), never on the UPN.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        // #690 (23) -- the sign-ins themselves (interactive and non-interactive, successful, 30 days) where the tenant sends them to
|        // the workspace. A sign-in with no named location is NOT trusted -- tested on the text, so an empty location list never drops it.
|        let _bgSignIns =
|            union isfuzzy=true (datatable(UserId:string, ResultType:string, TimeGenerated:datetime, IPAddress:string, Location:string, NetworkLocationDetails:string)[]), SigninLogs, AADNonInteractiveUserSignInLogs
|            | where TimeGenerated >= ago(30d)
|            | where tostring(ResultType) == "0"
|            | extend UserKey = tolower(tostring(UserId))
|            | where isnotempty(UserKey)
|            | extend IsTrusted = iff(tostring(NetworkLocationDetails) has "trustedNamedLocation", 1, 0)
|            | summarize SigninCount = count(), LastSignin = max(TimeGenerated),
|                        SigninCountries = strcat_array(make_set(Location, 5), ", "), SigninIPs = strcat_array(make_set(IPAddress, 5), ", "),
|                        NonTrustedSignins = countif(IsTrusted == 0)
|              by UserKey;
|        _ciAsset
|        | where si_is_break_glass == true
|        // #690 (23) -- the purpose is a break-glass account that SIGNED IN -- a sign-in in the last 30 days, from the sign-in logs, or
|        // from the account's own last sign-in (si_last_sign_in, Entra and Active Directory) when the logs do not hold it
|        | extend UserKey = tolower(si_link_entra)
|        | join kind=leftouter _bgSignIns on UserKey
|        | extend _lastSignInKnown = iff(coalesce(set_has_element(si_unknown_fields, "si_last_sign_in"), false), datetime(null), si_last_sign_in)
|        | where isnotnull(LastSignin) or (isnotnull(_lastSignInKnown) and _lastSignInKnown >= ago(30d))
|        | extend SignInEvidence = iff(isnotnull(LastSignin),
|            strcat(tostring(SigninCount), " successful sign-in(s) in 30 days, last ", format_datetime(LastSignin, "yyyy-MM-dd HH:mm"), " UTC",
|                   iff(isnotempty(SigninIPs), strcat(" from ", SigninIPs), ""), iff(isnotempty(SigninCountries), strcat(" (", SigninCountries, ")"), ""),
|                   iff(NonTrustedSignins > 0, strcat(", ", tostring(NonTrustedSignins), " from a location that is not trusted"), "")),
|            strcat("Last sign-in ", format_datetime(_lastSignInKnown, "yyyy-MM-dd HH:mm"), " UTC (the account's last sign-in in Entra or Active Directory)"))
|        | extend LastSignin = coalesce(LastSignin, _lastSignInKnown), SigninCount = coalesce(SigninCount, 1), NonTrustedSignins = coalesce(NonTrustedSignins, 0)
|        | extend CriticalityTier      = 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity = "Very High"
|        | extend RF_P_NonTrusted      = iff(NonTrustedSignins > 0, 1, 0)
|        | extend RF_P_MultipleSignins = iff(SigninCount > 1, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_NonTrusted + RF_P_MultipleSignins
|        | extend RiskFactor_Consequence_Detailed = "LastResortAccessLoss;EmergencyRecoveryCompromise;TenantTakeoverPotential"
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["BreakGlassSignInDetected"]),
|            iff(RF_P_NonTrusted      == 1, dynamic(["SignedInFromNonTrustedLocation"]),dynamic([])),
|            iff(RF_P_MultipleSignins == 1, dynamic(["MultipleSignins"]),               dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("BreakGlassSignInDetected=1;SignedInFromNonTrustedLocation=", tostring(RF_P_NonTrusted),
|                   ";MultipleSignins=", tostring(RF_P_MultipleSignins))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Sign-in Behaviour"
|        | extend Subcategory       = "Break-Glass Usage"
|        | extend ConfigurationName = "Break-glass emergency account sign-in detected - immediate review required"
|        | extend ConfigurationId   = "IDENTITY-SIGNIN-008"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend DisplayName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = sum(SigninCount),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(DisplayName, " [", tostring(LastSignin), "]"))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(DisplayName, " [", tostring(LastSignin), "]", "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            RiskFactor_Consequence_Detailed = any(RiskFactor_Consequence_Detailed),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring("")),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_security_domain <- SecurityDomain
|        // si si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal, si_weighted_risk_score <- RiskScoreTotal_Weighted
|        // si si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category, si_subcategory <- Subcategory
|        // si si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_RoleManagementWrite_Summary
|      ReportPurpose: >
|        Service Principals with the RoleManagement.ReadWrite.Directory Graph permission. This permission allows the SPN to assign ANY Entra ID role to ANY principal, including Global Administrator. A compromised SPN with this permission can immediately elevate any account to full tenant administrator  --  the equivalent of a skeleton key to the entire Entra ID tenant. This is arguably the most dangerous single Graph permission that exists. Severity: Very High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_role_management_write_permissions = dynamic(["RoleManagement.ReadWrite.Directory"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_RoleManagementWrite_Summary
|        // Purpose  Enabled service principals that can assign any Entra role (RoleManagement.ReadWrite.Directory), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend _perms = tostring(si_app_permissions)
|        | extend IsMultiTenant = si_is_third_party_multitenant
|        // the permissions this report is about, matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_permsD, SI_List_role_management_write_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_role_management_write_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a constant -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier      = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "Very High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Consequence_Detailed = "DomainTakeoverPotential;AnyEntraRoleAssignable;GlobalAdminGrantable"
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["RoleManagementWritePermission"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("RoleManagementWritePermission=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "Role Assignment Abuse"
|        | extend ConfigurationName = "SPN with RoleManagement.ReadWrite.Directory - can grant Global Admin to any account"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            RiskFactor_Consequence_Detailed = any(RiskFactor_Consequence_Detailed),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_AppRoleAssignmentWrite_Summary
|      ReportPurpose: >
|        Service Principals with AppRoleAssignment.ReadWrite.All permission. This allows the SPN to grant any Graph application permission to any other SPN, including granting itself Global Admin-equivalent permissions such as RoleManagement.ReadWrite.Directory or Directory.ReadWrite.All. A compromised SPN with this permission can bootstrap full tenant takeover in two API calls: grant itself dangerous permissions, then use them. Severity: Very High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_app_role_assignment_write_permissions = dynamic(["AppRoleAssignment.ReadWrite.All"]);
|        let SI_List_directory_write_permissions = dynamic(["Directory.ReadWrite.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_AppRoleAssignmentWrite_Summary
|        // Purpose  Enabled service principals that can grant any Graph permission (AppRoleAssignment.ReadWrite.All), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend _perms = tostring(si_app_permissions)
|        | extend IsMultiTenant = si_is_third_party_multitenant
|        // the permissions this report is about (its own list only), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_permsD, SI_List_app_role_assignment_write_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_app_role_assignment_write_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a constant -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier      = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "Very High"
|        // asset risk factors -- the CI's evaluation (data-model/risk-factors.locked.json), never this report's own
|        | extend RF_P_AlsoHasDirectoryWrite = iff(_perms has_any (SI_List_directory_write_permissions), 1, 0)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_AlsoHasDirectoryWrite + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["AppRoleAssignmentWritePermission"]),
|            iff(RF_P_AlsoHasDirectoryWrite == 1, dynamic(["AlsoHasDirectoryWrite"]),  dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("AppRoleAssignmentWritePermission=1;AlsoHasDirectoryWrite=", tostring(RF_P_AlsoHasDirectoryWrite))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "Permission Escalation"
|        | extend ConfigurationName = "SPN with AppRoleAssignment.ReadWrite.All - can grant any Graph permission to any app"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_PrivilegedAccessWrite_Summary
|      ReportPurpose: >
|        Service Principals with a permission that writes Privileged Identity Management directly -- RoleEligibilitySchedule / RoleAssignmentSchedule .ReadWrite.Directory, PrivilegedEligibilitySchedule / PrivilegedAssignmentSchedule .ReadWrite.AzureADGroup, RoleManagementPolicy.ReadWrite.*, or the legacy PrivilegedAccess.ReadWrite.AzureAD / AzureADGroup / AzureResources. This allows the SPN to directly create, modify, or remove PIM role eligibility and assignment schedules. A compromised SPN with this permission can make any account permanently eligible for Global Administrator with no approval workflow, or remove existing PIM assignments to cover tracks. Severity: Very High (fixed)  --  direct PIM manipulation capability.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_pim_write_permissions = dynamic(["RoleEligibilitySchedule.ReadWrite.Directory", "RoleAssignmentSchedule.ReadWrite.Directory", "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup", "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup", "RoleManagementPolicy.ReadWrite.Directory", "RoleManagementPolicy.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureAD", "PrivilegedAccess.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureResources"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_PrivilegedAccessWrite_Summary
|        // Purpose  Enabled service principals that can create or change PIM assignments (PrivilegedAccess.ReadWrite), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend _perms = tostring(si_app_permissions)
|        | extend IsMultiTenant = si_is_third_party_multitenant
|        // every permission that writes PIM directly (data-model list pim_write_permissions -- the current schedule and policy permissions and the legacy PrivilegedAccess ones), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_permsD, SI_List_pim_write_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_pim_write_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a constant -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier      = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "Very High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["PIMManipulationPermission"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("PIMManipulationPermission=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "PIM Abuse"
|        | extend ConfigurationName = "SPN with PrivilegedAccess.ReadWrite - can create/modify PIM assignments directly"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_UnverifiedPublisher_HighPermission_Summary
|      ReportPurpose: >
|        Service Principals with Tier 0/1 permissions whose publisher has not been verified by Microsoft. Unverified publishers are anonymous  --  there is no accountability for the code running in your tenant. High-privilege unverified apps represent a supply chain risk: the app developer could push malicious updates, and there is no way to validate the publisher's identity or intent. Severity: High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_directory_write_permissions = dynamic(["Directory.ReadWrite.All"]);
|        let SI_List_microsoft_first_party_tenants = dynamic(["f8cdef31-a31e-4b4a-93e4-5f571e91255a", "72f988bf-86f1-41af-91ab-2d7cd011db47"]);
|        let SI_List_role_assignment_write_permissions = dynamic(["RoleManagement.ReadWrite.Directory", "AppRoleAssignment.ReadWrite.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_UnverifiedPublisher_HighPermission_Summary
|        // Purpose  Enabled service principals whose publisher is not verified, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        | where si_publisher_verified == false
|        // Microsoft's own apps are not a supply-chain risk (and are never "verified" -- Graph leaves them without a verified publisher)
|        | where not(si_app_owner_org_id in (SI_List_microsoft_first_party_tenants))
|        // Tier 0/1 high permission = an application permission or role the privilege tier catalog rates high risk, or a permanent Tier 0/1 role
|        | where si_high_risk_permission_grant == true or si_privilege_tier_permanent in (0, 1)
|        | extend _perms = tostring(si_app_permissions)
|        | extend IsMultiTenant = si_is_third_party_multitenant
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RF_P_HasRoleWrite = iff(_perms has_any (SI_List_role_assignment_write_permissions), 1, 0)
|        | extend RF_P_HasDirWrite = iff(_perms has_any (SI_List_directory_write_permissions), 1, 0)
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors) + RF_P_HasRoleWrite + RF_P_HasDirWrite
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["UnverifiedPublisher"]),
|            RF_P_CiFactorNames,
|            iff(RF_P_HasRoleWrite == 1, dynamic(["HasRoleWrite"]),        dynamic([])),
|            iff(RF_P_HasDirWrite  == 1, dynamic(["HasDirectoryWrite"]),   dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("UnverifiedPublisher=1;HasRoleWrite=", tostring(RF_P_HasRoleWrite), ";HasDirectoryWrite=", tostring(RF_P_HasDirWrite))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "Supply Chain Risk"
|        | extend ConfigurationName = "Unverified-publisher SPN with Tier 0/1 Graph permissions"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-006"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_NewAccount_ImmediateTier0Role_Summary
|      ReportPurpose: >
|        User accounts created within the last 24 hours that already have a Tier 0 Entra ID role assigned. In a healthy environment, newly created accounts go through a provisioning workflow and role assignments require approval. Immediate Tier 0 role on a brand-new account indicates either a provisioning process bypass, a compromised privileged account creating rogue admin accounts, or a misconfigured automation script with excessive initial permissions. Severity: Very High (fixed)  --  immediate Tier 0 access on new account.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_NewAccount_ImmediateTier0Role_Summary
|        // Purpose  Users created in the last 24 hours that are already tier 0, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        // a Tier 0 ROLE (permanent or eligible -- the identity's role tier), or an account SI rates Tier 0
|        | where si_privilege_tier_permanent == 0 or si_privilege_tier_eligible == 0 or si_tier == 0
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | where CreatedDays == 0
|        | extend CriticalityTier      = 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity = "Very High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RF_P_AlreadySignedIn = iff(LastSignInDays == 0, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors) + RF_P_AlreadySignedIn
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["ImmediateTier0OnNewAccount"]),
|            RF_P_CiFactorNames,
|            iff(RF_P_AlreadySignedIn == 1, dynamic(["AlreadySignedInToday"]),    dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("ImmediateTier0OnNewAccount=1;AlreadySignedInToday=", tostring(RF_P_AlreadySignedIn))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Identity Lifecycle"
|        | extend Subcategory       = "Provisioning Anomalies"
|        | extend ConfigurationName = "Account created < 24 hours ago already has Tier 0 role - possible rogue admin"
|        | extend ConfigurationId   = "IDENTITY-LIFECYCLE-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(si_display_name, " [Created:", tostring(si_created), "]"))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(strcat(si_display_name, " [Created:", tostring(si_created), "]"), "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_DisabledAccount_ActivePIMAssignment_Summary
|      ReportPurpose: >
|        Disabled user accounts that still have PIM eligible role assignments active. When an account is disabled (e.g. employee leaving), all role assignments should be removed as part of the offboarding process. An eligible assignment on a disabled account means the account could be re-enabled and immediately used to activate privileged access  --  a common post-compromise technique. Severity: High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_DisabledAccount_ActivePIMAssignment_Summary
|        // Purpose  Disabled users that still hold a privileged PIM-eligible role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_account_enabled == false
|        | where coalesce(si_privilege_tier_eligible, 99) <= 1
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium-High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RF_P_RecentlyDisabled = iff(LastSignInDays between (0 .. 30), 1, 0)
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors) + RF_P_RecentlyDisabled
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["DisabledAccountWithEligibleRole"]),
|            RF_P_CiFactorNames,
|            iff(RF_P_RecentlyDisabled == 1, dynamic(["RecentlyDisabled30days"]),  dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("DisabledAccountWithEligibleRole=1;RecentlyDisabled30days=", tostring(RF_P_RecentlyDisabled))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Identity Lifecycle"
|        | extend Subcategory       = "Offboarding Gaps"
|        | extend ConfigurationName = "Disabled account with active PIM eligible role assignment - offboarding incomplete"
|        | extend ConfigurationId   = "IDENTITY-LIFECYCLE-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ServiceAccount_InteractiveSignIn_Summary
|      ReportPurpose: >
|        Accounts classified by MDI as service accounts (MDI_IsServiceAccount = true) that have interactive human sign-ins recorded in SigninLogs. Service accounts should authenticate exclusively via non-interactive flows (daemon credentials, managed identity, service principal). Interactive logins indicate the service account credentials are being used by a human  --  either a shared password problem, a developer using service credentials to bypass controls, or a threat actor who harvested the credentials and is performing hands-on-keyboard activity. Severity: High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ServiceAccount_InteractiveSignIn_Summary -- the service accounts come from the CI (SI_CI_CL), REQUIREMENTS #505; their sign-ins join on the Entra object id.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        let ServiceAccounts =
|            _ciAsset
|            | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|            | where si_identity_type in ("user", "guest")
|            | where coalesce(si_is_service_account, false) == true
|            | extend CriticalityTier = toint(si_tier)
|            | extend EntraId = tolower(si_link_entra)
|            | project EntraId, DisplayName = coalesce(si_display_name, si_upn, si_asset_name), si_ci_id, si_rf_p,
|                      si_cmdb_id, si_cmdb_name, si_cmdb_criticality, si_cmdb_data_sensitivity, si_asset_type, si_link_entra,
|                      CriticalityTier, IsPrivileged;
|
|        let InteractiveSignins =
|            SigninLogs
|            | where TimeGenerated >= ago(90d)
|            | where ResultType == 0
|            | extend EntraId = tolower(tostring(UserId))
|            | where isnotempty(EntraId)
|            // one row per sign-in, also when its location list is empty (mv-expand drops such a sign-in -- the untrusted case
|            // itself) -- a sign-in is from a trusted location when ANY of its locations is a trusted named location
|            | extend IsTrusted = iff(tostring(NetworkLocationDetails) has "trustedNamedLocation", 1, 0)
|            | summarize
|                InteractiveSigninCount = count(),
|                LastInteractiveSignin  = max(TimeGenerated),
|                NonTrustedCount        = countif(IsTrusted == 0),
|                Countries              = strcat_array(make_set(Location, 5), ";"),
|                UniqueIPs              = dcount(IPAddress)
|              by EntraId;
|
|        ServiceAccounts
|        | join kind=inner InteractiveSignins on EntraId
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity    = "Medium-High"
|        | extend RF_P_NonTrusted     = iff(NonTrustedCount > 0, 1, 0)
|        | extend RF_P_Frequent       = iff(InteractiveSigninCount > 5, 1, 0)
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = 1 + RF_P_NonTrusted + RF_P_Frequent
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["ServiceAccountInteractiveLogin"]),
|            iff(RF_P_NonTrusted  == 1, dynamic(["FromNonTrustedLocation"]),      dynamic([])),
|            iff(RF_P_Frequent    == 1, dynamic(["FrequentInteractive5plus"]),    dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("ServiceAccountInteractiveLogin=1;FromNonTrustedLocation=", tostring(RF_P_NonTrusted),
|                   ";FrequentInteractive5plus=", tostring(RF_P_Frequent))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Identity Lifecycle"
|        | extend Subcategory       = "Service Account Misuse"
|        | extend ConfigurationName = "Service account has interactive sign-ins - credential shared or harvested"
|        | extend ConfigurationId   = "IDENTITY-LIFECYCLE-003"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = DisplayName
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = sum(InteractiveSigninCount),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            AssetId                = min(si_ci_id)
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_HighMDIInvestigationPriority_Summary
|      ReportPurpose: >
|        Active accounts with MDI Investigation Priority Percentile in the top 10% (MDI_InvestigationPriorityPct >= 90). MDI calculates this score based on observed anomalous behaviours, lateral movement signals, unusual access patterns, and UEBA risk scoring. A high investigation priority means MDI has observed behaviour that warrants review. When this is combined with a privileged identity, it represents a potentially active threat that requires immediate attention. Severity: High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_HighMDIInvestigationPriority_Summary -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_mdi_investigation_priority_pct, 0) >= 90
|        | where coalesce(si_mdi_investigation_priority_pct, 0) > 0
|
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|
|        | extend RF_P_Top5Pct           = iff(coalesce(si_mdi_investigation_priority_pct, 0) >= 95, 1, 0)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = 1 + RF_P_Top5Pct + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["HighMDIInvestigationPriority"]),
|            iff(RF_P_Top5Pct         == 1, dynamic(["Top5PercentileMDIScore"]), dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("HighMDIInvestigationPriority=1;Top5PercentileMDIScore=", tostring(RF_P_Top5Pct))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Threat Intelligence"
|        | extend Subcategory       = "MDI Behavioural Signals"
|        | extend ConfigurationName = strcat("High MDI investigation priority (top 10%) - anomalous behaviour observed")
|        | extend ConfigurationId   = "IDENTITY-LIFECYCLE-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(
|                strcat(AssetName, " [Score:", tostring(coalesce(si_mdi_investigation_priority_pct, 0)), "]"))), ";"),
|            ImpactedAssetPairs = make_set(strcat(strcat(AssetName, " [Score:", tostring(coalesce(si_mdi_investigation_priority_pct, 0)), "]"), "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_AdminAccount_OnPremSynced_Summary
|      ReportPurpose: >
|        Privileged admin accounts (Tier 0/1) that are synchronised from on-premises AD rather than being cloud-only. Admin accounts should be cloud-native to avoid on-prem compromise pivoting to cloud. A compromised AD environment (e.g. via ransomware) can directly take over cloud admin accounts that are synced from AD. Severity: Very High - on-prem sync of privileged accounts breaks cloud/AD separation.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_AdminAccount_OnPremSynced_Summary
|        // Purpose  Enabled users synchronised from on-premises AD, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_onprem_synced == true
|        // the report's question is a privileged ROLE -- the identity's role tier (a Tier 0 / Tier 1 Entra role held
|        // permanently or eligible) decides, and the account's own tier still counts (never fewer rows than before)
|        | extend _roleTier = min_of(coalesce(si_privilege_tier_permanent, 99), coalesce(si_privilege_tier_eligible, 99))
|        | where _roleTier <= 1 or isnull(si_tier) or si_tier in (0, 1)
|        | extend CriticalityTier = toint(case(isnull(si_tier) and _roleTier > 3, int(null), isnull(si_tier), _roleTier, _roleTier > 3, toint(si_tier), min_of(_roleTier, toint(si_tier))))
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["OnPremisesSyncEnabled"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("OnPremisesSyncEnabled=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Admin Account Hygiene"
|        | extend Subcategory       = "Cloud-AD Separation"
|        | extend ConfigurationName = "Privileged account synced from on-prem AD - cloud isolation broken"
|        | extend ConfigurationId   = "IDENTITY-ADMIN-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_AdminAccount_NeverUsed_Summary
|      ReportPurpose: >
|        Privileged accounts (Tier 0/1) created more than 14 days ago that have never signed in. Unused privileged accounts represent dormant attack surface - they hold permissions but have no operational owner actively monitoring them. Common cause: accounts created for a project that never started, or provisioned for a consultant who never onboarded. Severity: High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_AdminAccount_NeverUsed_Summary
|        // Purpose  Enabled users that never signed in after a 14-day grace period, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | where LastSignInDays == -1
|        | where CreatedDays > 14
|        // the report's question is a privileged ROLE -- the identity's role tier (a Tier 0 / Tier 1 Entra role held
|        // permanently or eligible) decides, and the account's own tier still counts (never fewer rows than before)
|        | extend _roleTier = min_of(coalesce(si_privilege_tier_permanent, 99), coalesce(si_privilege_tier_eligible, 99))
|        | where _roleTier <= 1 or isnull(si_tier) or si_tier in (0, 1)
|        | extend CriticalityTier = toint(case(isnull(si_tier) and _roleTier > 3, int(null), isnull(si_tier), _roleTier, _roleTier > 3, toint(si_tier), min_of(_roleTier, toint(si_tier))))
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["NeverSignedIn"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("NeverSignedIn=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Admin Account Hygiene"
|        | extend Subcategory       = "Unused Accounts"
|        | extend ConfigurationName = "Privileged account never signed in after 14-day grace period"
|        | extend ConfigurationId   = "IDENTITY-ADMIN-003"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_TooManyGlobalAdmins_Summary
|      ReportPurpose: >
|        Detects when the organisation has more than 5 active Global Administrator accounts. Microsoft recommends 2-5 Global Admins maximum. Each additional Global Admin increases the attack surface proportionally. Organisations with 10+ Global Admins typically have role assignment hygiene problems and lack a formal review process. Severity: High (fixed) - excessive Global Admin count is always a significant risk.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - UniqueIssues
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - IssueList
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_TooManyGlobalAdmins_Summary
|        // Purpose  More than 5 enabled users with a permanent Global Administrator role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // One tenant-level row; the CI decides which identities count.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        let GlobalAdmins =
|            _ciAsset
|            // #690 (23) -- every identity that holds Global Administrator -- active (permanent or time-bound) or eligible, directly or
|            // through a group (the role read resolves group and PIM-for-groups roles), users, guests and service principals
|            | where tostring(si_entra_roles_permanent) has "Global Administrator" or tostring(si_entra_roles_eligible) has "Global Administrator"
|            | extend DeviceKey = "tenant"
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | summarize
|                GACount        = dcount(si_ci_id),
|                ImpactedAssets = strcat_array(array_sort_asc(make_set(si_display_name)), ";"),
|                ImpactedAssetPairs = make_set(strcat(si_display_name, "|", si_ci_id));
|        GlobalAdmins
|        | where GACount > 5
|        | extend CriticalityTier      = 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity     = "Medium"
|        | extend RF_P_ExcessiveCount  = iff(GACount > 10, 2, 1)
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = RF_P_ExcessiveCount
|        | extend RiskFactor_Probability_Detailed =
|            iff(GACount > 10, "ExcessiveGlobalAdminCount_Critical", "ExcessiveGlobalAdminCount")
|        | extend RiskFactor_Probability_DetailedScore = strcat("GlobalAdminCount=", GACount)
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Admin Account Hygiene"
|        | extend Subcategory       = "Role Assignment Governance"
|        | extend ConfigurationName = "Excessive Global Administrator count - more than 5 active accounts"
|        | extend ConfigurationId   = "IDENTITY-ADMIN-004"
|        | extend AssetCount        = GACount
|        | extend TotalIssues       = GACount
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  RiskFactor_Consequence, RiskFactor_Probability,
|                  RiskFactor_Probability_Detailed, RiskFactor_Probability_DetailedScore,
|                  AssetCount, TotalIssues, ImpactedAssets, ImpactedAssetPairs
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, UniqueIssues, ImpactedAssetsList, ImpactedAssetIds, IssueList, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_security_domain <- SecurityDomain
|        // si si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal, si_weighted_risk_score <- RiskScoreTotal_Weighted
|        // si si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category, si_subcategory <- Subcategory
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_BreakGlass_Anomaly_Summary
|      ReportPurpose: >
|        Break-glass emergency access accounts with anomalous sign-in patterns. Detects two opposite problems: (1) Break-glass account used recently (< 30 days) WITHOUT an incident - possible misuse (2) Break-glass account has never been tested OR last test was > 180 days ago Break-glass accounts should only be used in genuine emergencies and tested periodically. Severity: Very High (fixed) - any break-glass anomaly is a critical governance failure.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_BreakGlass_Anomaly_Summary
|        // Purpose  Break-glass accounts used recently, never tested, or not tested for 180+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_is_break_glass == true
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        // #690 (27) -- a break-glass account whose last sign-in the CI could not decide is LISTED as anomaly NoSignInDataSource (the cause), never dropped
|        | where LastSignInDays <= 30 or LastSignInDays > 180 or LastSignInDays == -1 or isnull(LastSignInDays)
|        | extend CriticalityTier      = 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity     = "High"
|        | extend AnomalyType =
|            case(isnull(LastSignInDays),                        "NoSignInDataSource",
|                 LastSignInDays >= 0 and LastSignInDays <= 30, "RecentUnexpectedUsage",
|                 LastSignInDays == -1,                          "NeverTested",
|                 "TestingOverdue")
|        // asset risk factors -- the CI's evaluation (data-model/risk-factors.locked.json), never this report's own
|        | extend RF_P_RecentUse    = iff(LastSignInDays >= 0 and LastSignInDays <= 30, 1, 0)
|        | extend RF_P_NeverTested  = iff(LastSignInDays == -1, 1, 0)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_RecentUse + RF_P_NeverTested + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["BreakGlassAnomaly"]),
|            iff(RF_P_RecentUse   == 1, dynamic(["RecentUnexpectedUsage"]), dynamic([])),
|            iff(RF_P_NeverTested == 1, dynamic(["NeverTested"]),           dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("BreakGlassAnomaly=1;RecentUnexpectedUsage=", tostring(RF_P_RecentUse),
|                   ";NeverTested=", tostring(RF_P_NeverTested))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Admin Account Hygiene"
|        | extend Subcategory       = "Break-Glass Governance"
|        | extend ConfigurationName = iff(AnomalyType == "NoSignInDataSource", "Break-glass account anomaly: no data source for the last sign-in", strcat("Break-glass account anomaly: ", AnomalyType))
|        | extend ConfigurationId   = "IDENTITY-ADMIN-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(si_display_name, " [", AnomalyType, "]"))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(strcat(si_display_name, " [", AnomalyType, "]"), "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PIM_EligibleNeverActivated_Summary
|      ReportPurpose: >
|        Users with PIM-eligible Tier 0/1 role assignments that have never been activated (no interactive sign-in with the role active). Eligible roles that are never used suggest the assignment is unnecessary and should be removed to reduce blast radius. This also applies to identities with eligible roles but no sign-in at all. Severity: Medium (fixed) - eligible roles are safer than permanent but unused assignments still represent unnecessary standing access that should be cleaned up.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PIM_EligibleNeverActivated_Summary
|        // Purpose  Enabled users with a privileged PIM eligible role and no sign-in for 180+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where IsPrivilegedEligible == true
|        | where IsPrivileged == false or HasPermanentPrivilegedRole == false
|        | where LastSignInDays > 180 or LastSignInDays == -1
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 1
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "PIM Hygiene"
|        | extend ConfigurationName = "PIM eligible role never activated in 180+ days - unnecessary assignment"
|        | extend ConfigurationId   = "IDENTITY-PIM-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PIM_DuplicateRoleAssignment_Summary
|      ReportPurpose: >
|        Users who have the same Entra ID role assigned both permanently AND as PIM eligible. This is a misconfiguration: the permanent assignment makes the PIM eligible one redundant and indicates the PIM policy was not followed. The permanent assignment should be removed and only the PIM eligible retained. Severity: Medium-High (fixed) - redundant permanent assignment defeats PIM purpose.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PIM_DuplicateRoleAssignment_Summary
|        // Purpose  Enabled users holding the same privileged role permanently and through PIM, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        // the same role held both as an active assignment (permanent or time-bound -- every active assignment that is not a
|        // PIM activation, as Entra lists it) and as a PIM eligibility -- whatever the role's tier
|        | extend _rolesPermanent = iff(gettype(si_entra_roles_permanent) == "array", si_entra_roles_permanent, iff(isempty(tostring(si_entra_roles_permanent)), dynamic([]), pack_array(tostring(si_entra_roles_permanent))))
|        | extend _rolesEligible  = iff(gettype(si_entra_roles_eligible) == "array", si_entra_roles_eligible, iff(isempty(tostring(si_entra_roles_eligible)), dynamic([]), pack_array(tostring(si_entra_roles_eligible))))
|        | where array_length(set_intersect(_rolesPermanent, _rolesEligible)) > 0
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium-High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 1
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["DuplicateRoleAssignment"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("DuplicateRoleAssignment=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "PIM Hygiene"
|        | extend ConfigurationName = "Duplicate role assignment - permanent and eligible overlap for same role"
|        | extend ConfigurationId   = "IDENTITY-PIM-003"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_OverCredentialed_Summary
|      ReportPurpose: >
|        Service Principals that have both a client secret AND a certificate registered. Over-credentialed SPNs increase the credential attack surface - two different authentication paths must both be managed and rotated. Often indicates legacy credentials were not cleaned up when the SPN was migrated to certificate auth. Severity: Medium (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_OverCredentialed_Summary
|        // Purpose  Service principals with credentials expiring within 30 days or expired, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type == "service_principal"
|        // both kinds of credential registered (the purpose) -- every secret and certificate of the principal and of its application registration, in any state
|        | extend _creds = coalesce(todynamic(tostring(si_credentials)), dynamic([]))
|        | mv-apply _cr = _creds to typeof(dynamic) on (summarize SecretCount = countif(tostring(_cr.type) == "secret"), CertificateCount = countif(tostring(_cr.type) == "certificate"))
|        | where SecretCount > 0 and CertificateCount > 0
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 1
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["BothSecretAndCert"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("BothSecretAndCert=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Credential Hygiene"
|        | extend ConfigurationName = "SPN with both client secret and certificate - over-credentialed"
|        | extend ConfigurationId   = "IDENTITY-SPN-006"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_Admin_LogonTo_VulnerableDevice_Summary
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >
|        Privileged users (permanent or PIM-eligible Tier 0/1 roles) who are observed authenticating to devices that have high or critical severity CVEs outstanding. When an admin logs on to a vulnerable device, their privileged token/credential is exposed on that device. An attacker who exploits the CVE could harvest the admin credential via memory dumps, token theft, or keylogging. Severity: Very High (fixed) - privileged credential exposure on vulnerable device.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Admin_LogonTo_VulnerableDevice_Summary
|        // Purpose  Users that can authenticate to a device with High or Critical CVEs.
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            | extend HasHighCriticalCVE = tobool(rawData.highRiskVulnerabilityInsights.hasHighOrCritical)
|            | where HasHighCriticalCVE == true
|            | extend MaxCvssScore     = todouble(rawData.highRiskVulnerabilityInsights.maxCvssScore)
|            | extend DeviceRiskScore  = tostring(rawData.riskScore)
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, MaxCvssScore, DeviceRiskScore;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend UserEntraId = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        // the device's asset factors -- the device CI's evaluation
|        // the device's asset factors -- the set the engine feeds (the device CI evaluation, the report's factors), its question left out
|        | extend DeviceFactorIds = set_difference(coalesce(peer_rf_p, dynamic([])), dynamic([])), DeviceFactorNames = set_difference(coalesce(peer_rf_names, dynamic([])), dynamic([]))
|        | extend IsInternetFacing = set_has_element(coalesce(peer_rf_p, dynamic([])), "internet_exposed")
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "Medium-High"
|        // the CVSS of the device's worst CVE is a finding value (Exposure Graph), not an asset factor
|        | extend RF_P_HighCvss        = iff(MaxCvssScore >= 9.0, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(DeviceFactorIds) + RF_P_HighCvss
|        | extend RiskFactorIds = strcat_array(DeviceFactorIds, ";")
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["AdminOnVulnerableDevice"]),
|            DeviceFactorNames,
|            iff(RF_P_HighCvss == 1, dynamic(["CVSS9plus"]),           dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("AdminOnVulnerableDevice=1;CVSS9plus=", tostring(RF_P_HighCvss))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(DeviceFactorNames) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(DeviceFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Credential Exposure via Device"
|        | extend ConfigurationName = "Privileged user authenticating to device with High/Critical CVEs"
|        | extend ConfigurationId   = "IDENTITY-DEVICE-001"
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(AssetId),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(UserDisplayName, " -> ", DeviceName))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(UserDisplayName, " -> ", DeviceName, "|", AssetId)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(MdeDeviceId)),
|            EntraAccountObjectId   = min(tostring(UserEntraId)),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(AssetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|        // si si_category <- Category, si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics
|        // si si_mitre_techniques <- MITRE_Techniques, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_Admin_LogonTo_VulnerableDevice_Detailed
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >
|        Per-pair detail: privileged admin and the specific vulnerable device they can authenticate to. Includes CVE score, internet exposure and device risk.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Admin_LogonTo_VulnerableDevice_Detailed
|        // Purpose  Users that can authenticate to a device with High or Critical CVEs.
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            | extend HasHighCriticalCVE = tobool(rawData.highRiskVulnerabilityInsights.hasHighOrCritical)
|            | where HasHighCriticalCVE == true
|            | extend MaxCvssScore     = todouble(rawData.highRiskVulnerabilityInsights.maxCvssScore)
|            | extend DeviceRiskScore  = tostring(rawData.riskScore)
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, MaxCvssScore, DeviceRiskScore;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend UserEntraId = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        // #690 (17b) the machine is the finding's TARGET -- one finding per account x machine survives the engine's de-duplication
|        | extend TargetAssetId = iif(isnotempty(DeviceCiId), DeviceCiId, iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId)))
|        // the device's asset factors -- the device CI's evaluation
|        // the device's asset factors -- the set the engine feeds (the device CI evaluation, the report's factors), its question left out
|        | extend DeviceFactorIds = set_difference(coalesce(peer_rf_p, dynamic([])), dynamic([])), DeviceFactorNames = set_difference(coalesce(peer_rf_names, dynamic([])), dynamic([]))
|        | extend IsInternetFacing = set_has_element(coalesce(peer_rf_p, dynamic([])), "internet_exposed")
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity      = "Medium-High"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Privileged Access"
|        | extend Subcategory           = "Credential Exposure via Device"
|        | extend ConfigurationName     = "Privileged user authenticating to device with High/Critical CVEs"
|        | extend ConfigurationId       = "IDENTITY-DEVICE-001"
|        // the CVSS of the device's worst CVE is a finding value (Exposure Graph), not an asset factor
|        | extend RF_P_HighCvss        = iff(MaxCvssScore >= 9.0, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(DeviceFactorIds) + RF_P_HighCvss
|        | extend RiskFactorIds = strcat_array(DeviceFactorIds, ";")
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project TargetAssetId, SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  UserDisplayName, UserUPN, UserNodeId,
|                  DeviceName, MaxCvssScore, IsInternetFacing, DeviceRiskScore,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, MaxCvssScore desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|        // si si_category <- Category, si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_Admin_LogonTo_InternetExposedDevice_Summary
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >
|        Privileged users (Tier 0/1) authenticated to internet-facing devices. Privileged sessions should never occur on internet-exposed assets as these devices have a significantly higher chance of being compromised remotely. Even without CVEs, internet-exposed devices face constant attack attempts. An attacker who breaches an internet-exposed device gains access to any privileged credential or token present on that device. Severity: High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Admin_LogonTo_InternetExposedDevice_Summary
|        // Purpose  Users that can authenticate to an internet-exposed device.
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            | extend HasCVEs          = tobool(rawData.highRiskVulnerabilityInsights.hasHighOrCritical)
|            | extend DeviceRiskScore  = tostring(rawData.riskScore)
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, HasCVEs, DeviceRiskScore;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend UserEntraId = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        // internet exposure and machine risk are the device CI's asset factors
|        | where set_has_element(peer_rf_p, "internet_exposed")
|        // the device's asset factors -- the set the engine feeds (the device CI evaluation, the report's factors), its question left out
|        | extend DeviceFactorIds = set_difference(coalesce(peer_rf_p, dynamic([])), dynamic(["internet_exposed"])), DeviceFactorNames = set_difference(coalesce(peer_rf_names, dynamic([])), pack_array(tostring(SI_FactorNames["internet_exposed"])))
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "High"
|        | extend RF_P_HasCVEs        = iff(HasCVEs == true, 1, 0)
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1 + RF_P_HasCVEs + array_length(DeviceFactorIds)
|        | extend RiskFactorIds = strcat_array(DeviceFactorIds, ";")
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["InternetExposedDevice"]),
|            iff(RF_P_HasCVEs  == 1, dynamic(["DeviceHasHighCVEs"]),  dynamic([])),
|            DeviceFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("InternetExposedDevice=1;DeviceHasHighCVEs=", tostring(RF_P_HasCVEs))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(DeviceFactorNames) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(DeviceFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Credential Exposure via Device"
|        | extend ConfigurationName = "Privileged user authenticating to internet-exposed device"
|        | extend ConfigurationId   = "IDENTITY-DEVICE-002"
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(AssetId),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(UserDisplayName, " -> ", DeviceName))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(UserDisplayName, " -> ", DeviceName, "|", AssetId)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(MdeDeviceId)),
|            EntraAccountObjectId   = min(tostring(UserEntraId)),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(AssetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_Admin_LogonTo_LowTierDevice_Summary
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      - Lookup: _deviceTierOwn
|        Column: _dtKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >
|        Tier 0 privileged users (Global Admin, Domain Admin etc) authenticating to devices that are NOT classified as Tier 0 assets. Tier 0 admins should only use Tier 0 Privileged Access Workstations (PAWs). Logging on to a standard workstation, developer machine, or shared device exposes Tier 0 credentials to a device with a broader attack surface and potentially lower security controls. Severity: Very High (fixed) - Tier 0 admin on non-PAW device is a tiering violation.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Admin_LogonTo_LowTierDevice_Summary
|        // Purpose  Tier 0 users that can authenticate to a device that is not tier 0 (tiering violation).
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            | extend DeviceRiskScore = tostring(rawData.riskScore)
|            | extend HasCVEs         = tobool(rawData.highRiskVulnerabilityInsights.hasHighOrCritical)
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, DeviceRiskScore, HasCVEs;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            // most graph user nodes carry the Entra id as a tenant id and object id pair (TenantId=... ObjectId=...) -- only
|            // the object id is the key the account's CI is linked on (si_link_entra), so the pair joined no CI
|            | extend _aadId          = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | extend UserEntraId     = iff(_aadId has "objectid=", extract(@'objectid=([0-9a-f-]+)', 1, _aadId), _aadId)
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // #690 (49) the DEVICE's own tier -- decided by every tier claim on its CI EXCEPT the rule that inherits the tier of
|        // its most frequent logon user (AssetProfileByLogonUser/LogonByT0User). That rule makes a workstation Tier 0 BECAUSE a
|        // Tier 0 admin uses it, which would hide exactly the violation this report finds (owner 2026-10-15 -- the rule stays,
|        // this report judges the device without it). The same decision as the CI build -- an observed rule claim first, else
|        // the operator's tier tag, else the default -- and a manual override as it is.
|        let _deviceTierOwn =
|            SI_CI_CL
|            | where TimeGenerated > ago(30d)
|            | where tostring(si_class) == "device" and tostring(column_ifexists("si_row_kind", "")) != "seen"
|            | summarize arg_max(todatetime(si_collection_time), *) by _dtCiId = tostring(si_ci_id)
|            | where isnotempty(_dtCiId)
|            | extend _dtSetBy = tostring(column_ifexists("si_tier_set_by", "")), _dtCiTier = toint(column_ifexists("si_tier", int(null)))
|            | mv-apply _dtClaim = todynamic(tostring(column_ifexists("si_tier_claims", dynamic(null)))) to typeof(dynamic) on (
|                where tobool(_dtClaim.admissible) == true and not(tostring(_dtClaim.rule) endswith "/LogonByT0User") and isnotnull(toint(_dtClaim.tier))
|                | summarize _dtRule = min(iff(tostring(_dtClaim.kind) == "rule", toint(_dtClaim.tier), int(null))),
|                            _dtTag = min(iff(tostring(_dtClaim.kind) == "tag", toint(_dtClaim.tier), int(null))),
|                            _dtDefault = min(iff(tostring(_dtClaim.kind) == "default", toint(_dtClaim.tier), int(null)))
|              )
|            | extend _dtTier = iff(_dtSetBy == "override", _dtCiTier, coalesce(_dtRule, _dtTag, _dtDefault))
|            // #741 (2) one row per LINK KEY of the CI (the keys _ciPeer is matched on), so the lookup can be cut to the devices
|            // of each query slice (LookupNeededKeys) -- whole it is too large for one request at a large tenant
|            | extend _dtKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|            | mv-expand _dtKey = _dtKeys to typeof(string)
|            | where isnotempty(_dtKey)
|            | project _dtKey, _dtCiId, _dtTier;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        // the device's tier and machine risk are the device CI's
|        // the device's own tier without the logon-user rule (_deviceTierOwn), else the device CI's tier
|        // (one row per CI again -- the lookup carries one row per link key of a CI, every one with the CI's own tier)
|        | join kind=leftouter (_deviceTierOwn | summarize _dtTier = min(_dtTier) by _dtCiId) on $left.DeviceCiId == $right._dtCiId
|        | extend DeviceCritLvl = toint(coalesce(_dtTier, toint(peer_tier)))
|        | where isnull(DeviceCritLvl) or DeviceCritLvl > 0
|        // the device's asset factors -- the set the engine feeds (the device CI evaluation, the report's factors), its question left out
|        | extend DeviceFactorIds = set_difference(coalesce(peer_rf_p, dynamic([])), dynamic([])), DeviceFactorNames = set_difference(coalesce(peer_rf_names, dynamic([])), dynamic([]))
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        // a Tier 0 ACCOUNT -- the account CI's tier, decided by the identity privilege tier rules (#690 (48), the tier of the
|        // highest privilege it holds today)
|        | extend CriticalityTier = toint(si_tier)
|        | where CriticalityTier == 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity     = "Medium"
|        | extend RF_P_DeviceTier2Plus = iff(isnull(DeviceCritLvl) or DeviceCritLvl >= 2, 1, 0)
|        | extend RF_P_HasCVEs         = iff(HasCVEs == true, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_DeviceTier2Plus + RF_P_HasCVEs + array_length(DeviceFactorIds)
|        | extend RiskFactorIds = strcat_array(DeviceFactorIds, ";")
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["Tier0AdminOnNonPAW"]),
|            iff(RF_P_DeviceTier2Plus == 1, dynamic(["DeviceTier2OrUnclassified"]),dynamic([])),
|            iff(RF_P_HasCVEs         == 1, dynamic(["DeviceHasHighCVEs"]),        dynamic([])),
|            DeviceFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("Tier0AdminOnNonPAW=1;DeviceTier2OrUnclassified=", tostring(RF_P_DeviceTier2Plus),
|                   ";DeviceHasHighCVEs=", tostring(RF_P_HasCVEs))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(DeviceFactorNames) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(DeviceFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Privileged Access Workstation Compliance"
|        | extend ConfigurationName = "Tier 0 admin authenticating to non-PAW (tiering violation)"
|        | extend ConfigurationId   = "IDENTITY-DEVICE-003"
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(AssetId),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(UserDisplayName, " -> ", DeviceName))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(UserDisplayName, " -> ", DeviceName, "|", AssetId)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(MdeDeviceId)),
|            EntraAccountObjectId   = min(tostring(UserEntraId)),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(AssetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_EligibleAdmin_LogonTo_ExploitableDevice_Summary
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >
|        Users with PIM-eligible Tier 0/1 roles authenticated to devices that have vulnerabilities with a known exploit (public, verified or in an exploit kit, as Defender vulnerability management and the Exposure Graph report it). Even if the PIM role is not currently activated, the credential harvested from an exploitable device could be used to activate PIM and gain full admin access. Severity: Very High (fixed) - eligible admin credential on actively exploitable device.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_EligibleAdmin_LogonTo_ExploitableDevice_Summary
|        // Purpose  Users that can authenticate to a device with a known exploit.
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            // the graph's exploit evidence -- the exploitability levels of the device's remote-code-execution and
|            // privilege-escalation CVEs (NoExploit, ExploitIsPublic, ExploitIsVerified, ExploitIsInKit)
|            | extend _xLevels   = strcat(tostring(rawData.highRiskVulnerabilityInsights.vulnerableToRemoteCodeExecution.explotabilityLevels), tostring(rawData.highRiskVulnerabilityInsights.vulnerableToPrivilegeEscalation.explotabilityLevels))
|            | extend IsInKit    = _xLevels has "ExploitIsInKit"
|            | extend IsVerified = _xLevels has "ExploitIsVerified"
|            | extend HasExploit = IsInKit or IsVerified or _xLevels has "ExploitIsPublic"
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, HasExploit, IsInKit, IsVerified;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            // most graph user nodes carry the Entra id as a tenant id and object id pair (TenantId=... ObjectId=...) -- only
|            // the object id is the key the account's CI is linked on (si_link_entra), so the pair joined no CI
|            | extend _aadId          = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | extend UserEntraId     = iff(_aadId has "objectid=", extract(@'objectid=([0-9a-f-]+)', 1, _aadId), _aadId)
|            // the report's question -- an account Entra lists as eligible for a role through PIM (the graph's eligibleRoles)
|            | where array_length(rawData.eligibleRoles) > 0
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        // Defender vulnerability management -- a device with a CVE that has a known exploit (the knowledge base's
|        // IsExploitAvailable), read only for the devices an account can authenticate to
|        let _authTargetMde = _authTo | join kind=inner (_devices) on $left.TargetNodeId == $right.DeviceNodeId | where isnotempty(MdeDeviceId) | distinct MdeDeviceId;
|        let _tvmExploitDevices =
|            DeviceTvmSoftwareVulnerabilities
|            | where tolower(DeviceId) in (_authTargetMde)
|            | join kind=inner (DeviceTvmSoftwareVulnerabilitiesKB | where IsExploitAvailable == true | project CveId) on CveId
|            | project TvmExploitDeviceId = tolower(DeviceId)
|            | where isnotempty(TvmExploitDeviceId)
|            | distinct TvmExploitDeviceId;        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        | join kind=leftouter (_tvmExploitDevices) on $left.MdeDeviceId == $right.TvmExploitDeviceId
|        | extend HasExploit = HasExploit or isnotempty(TvmExploitDeviceId)
|        | where HasExploit        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "High"
|        // exploit signals are finding values (Exposure Graph)
|        | extend RF_P_Verified        = iff(IsVerified == true, 1, 0)
|        | extend RF_P_InKit           = iff(IsInKit == true, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_Verified + RF_P_InKit
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["EligibleAdminOnExploitableDevice"]),
|            iff(RF_P_Verified == 1, dynamic(["VerifiedExploit"]),   dynamic([])),
|            iff(RF_P_InKit    == 1, dynamic(["InExploitKit"]),      dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("EligibleAdminOnExploitableDevice=1;VerifiedExploit=", tostring(RF_P_Verified),
|                   ";InExploitKit=", tostring(RF_P_InKit))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Credential Exposure via Device"
|        | extend ConfigurationName = "PIM-eligible admin authenticated to device with known exploits"
|        | extend ConfigurationId   = "IDENTITY-DEVICE-004"
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(AssetId),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(UserDisplayName, " -> ", DeviceName))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(UserDisplayName, " -> ", DeviceName, "|", AssetId)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(MdeDeviceId)),
|            EntraAccountObjectId   = min(tostring(UserEntraId)),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(AssetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_AdminAccount_NeverUsed_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_AdminAccount_NeverUsed_Summary. Privileged accounts (Tier 0/1) created more than 14 days ago that have never signed in. Unused privileged accounts represent dormant attack surface - they hold permissions but have no operational owner actively monitoring them. Common cause: accounts created for a project that never started, or provisioned for a consultant who never onboarded. Severity: High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for AdminAccount NeverUsed Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_AdminAccount_NeverUsed_Detailed
|        // Purpose  Enabled users that never signed in, 14+ days after creation, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where LastSignInDays == -1
|        | where CreatedDays > 14
|        // the report's question is a privileged ROLE -- the identity's role tier (a Tier 0 / Tier 1 Entra role held
|        // permanently or eligible) decides, and the account's own tier still counts (never fewer rows than before)
|        | extend _roleTier = min_of(coalesce(si_privilege_tier_permanent, 99), coalesce(si_privilege_tier_eligible, 99))
|        | where _roleTier <= 1 or isnull(si_tier) or si_tier in (0, 1)
|        | extend CriticalityTier = toint(case(isnull(si_tier) and _roleTier > 3, int(null), isnull(si_tier), _roleTier, _roleTier > 3, toint(si_tier), min_of(_roleTier, toint(si_tier))))
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["NeverSignedIn"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("NeverSignedIn=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Admin Account Hygiene"
|        | extend Subcategory       = "Unused Accounts"
|        | extend ConfigurationName = "Privileged account never signed in after 14-day grace period"
|        | extend ConfigurationId   = "IDENTITY-ADMIN-003"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_AdminAccount_OnPremSynced_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_AdminAccount_OnPremSynced_Summary. Privileged admin accounts (Tier 0/1) that are synchronised from on-premises AD rather than being cloud-only. Admin accounts should be cloud-native to avoid on-prem compromise pivoting to cloud. A compromised AD environment (e.g. via ransomware) can directly take over cloud admin accounts that are synced from AD. Severity: Very High - on-prem sync of privileged accounts breaks cloud/AD separation. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for AdminAccount OnPremisesSyncEnabled Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_AdminAccount_OnPremSynced_Detailed
|        // Purpose  Enabled users synchronised from on-premises AD, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where si_onprem_synced == true
|        // the report's question is a privileged ROLE -- the identity's role tier (a Tier 0 / Tier 1 Entra role held
|        // permanently or eligible) decides, and the account's own tier still counts (never fewer rows than before)
|        | extend _roleTier = min_of(coalesce(si_privilege_tier_permanent, 99), coalesce(si_privilege_tier_eligible, 99))
|        | where _roleTier <= 1 or isnull(si_tier) or si_tier in (0, 1)
|        | extend CriticalityTier = toint(case(isnull(si_tier) and _roleTier > 3, int(null), isnull(si_tier), _roleTier, _roleTier > 3, toint(si_tier), min_of(_roleTier, toint(si_tier))))
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["OnPremisesSyncEnabled"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("OnPremisesSyncEnabled=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Admin Account Hygiene"
|        | extend Subcategory       = "Cloud-AD Separation"
|        | extend ConfigurationName = "Privileged account synced from on-prem AD - cloud isolation broken"
|        | extend ConfigurationId   = "IDENTITY-ADMIN-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_Admin_LogonTo_InternetExposedDevice_Detailed
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >-
|        Per-row detail view for Identity_Admin_LogonTo_InternetExposedDevice_Summary. Privileged users (Tier 0/1) authenticated to internet-facing devices. Privileged sessions should never occur on internet-exposed assets as these devices have a significantly higher chance of being compromised remotely. Even without CVEs, internet-exposed devices face constant attack attempts. An attacker who breaches an internet-exposed device gains access to any privileged credential or token present on that device. Severity: High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for Admin LogonTo InternetExposedDevice Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Admin_LogonTo_InternetExposedDevice_Detailed
|        // Purpose  Users that can authenticate to an internet-exposed device.
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            | extend HasCVEs          = tobool(rawData.highRiskVulnerabilityInsights.hasHighOrCritical)
|            | extend DeviceRiskScore  = tostring(rawData.riskScore)
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, HasCVEs, DeviceRiskScore;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend UserEntraId = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        // #690 (17b) the machine is the finding's TARGET -- one finding per account x machine survives the engine's de-duplication
|        | extend TargetAssetId = iif(isnotempty(DeviceCiId), DeviceCiId, iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId)))
|        // internet exposure and machine risk are the device CI's asset factors
|        | where set_has_element(peer_rf_p, "internet_exposed")
|        // the device's asset factors -- the set the engine feeds (the device CI evaluation, the report's factors), its question left out
|        | extend DeviceFactorIds = set_difference(coalesce(peer_rf_p, dynamic([])), dynamic(["internet_exposed"])), DeviceFactorNames = set_difference(coalesce(peer_rf_names, dynamic([])), pack_array(tostring(SI_FactorNames["internet_exposed"])))
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity      = "High"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Privileged Access"
|        | extend Subcategory           = "Credential Exposure via Device"
|        | extend ConfigurationName     = "Privileged user authenticating to internet-exposed device"
|        | extend ConfigurationId       = "IDENTITY-DEVICE-002"
|        | extend RF_P_HasCVEs        = iff(HasCVEs == true, 1, 0)
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1 + RF_P_HasCVEs + array_length(DeviceFactorIds)
|        | extend RiskFactorIds = strcat_array(DeviceFactorIds, ";")
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project TargetAssetId, SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  UserDisplayName, UserUPN, UserNodeId,
|                  DeviceName, HasCVEs, DeviceRiskScore,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_Admin_LogonTo_LowTierDevice_Detailed
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      - Lookup: _deviceTierOwn
|        Column: _dtKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >-
|        Per-row detail view for Identity_Admin_LogonTo_LowTierDevice_Summary. Tier 0 privileged users (Global Admin, Domain Admin etc) authenticating to devices that are NOT classified as Tier 0 assets. Tier 0 admins should only use Tier 0 Privileged Access Workstations (PAWs). Logging on to a standard workstation, developer machine, or shared device exposes Tier 0 credentials to a device with a broader attack surface and potentially lower security controls. Severity: Very High (fixed) - Tier 0 admin on non-PAW device is a tiering violation. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for Admin LogonTo LowTierDevice Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Admin_LogonTo_LowTierDevice_Detailed
|        // Purpose  Tier 0 users that can authenticate to a device that is not tier 0 (tiering violation).
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            | extend DeviceRiskScore = tostring(rawData.riskScore)
|            | extend HasCVEs         = tobool(rawData.highRiskVulnerabilityInsights.hasHighOrCritical)
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, DeviceRiskScore, HasCVEs;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            // most graph user nodes carry the Entra id as a tenant id and object id pair (TenantId=... ObjectId=...) -- only
|            // the object id is the key the account's CI is linked on (si_link_entra), so the pair joined no CI
|            | extend _aadId          = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | extend UserEntraId     = iff(_aadId has "objectid=", extract(@'objectid=([0-9a-f-]+)', 1, _aadId), _aadId)
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // #690 (49) the DEVICE's own tier -- decided by every tier claim on its CI EXCEPT the rule that inherits the tier of
|        // its most frequent logon user (AssetProfileByLogonUser/LogonByT0User). That rule makes a workstation Tier 0 BECAUSE a
|        // Tier 0 admin uses it, which would hide exactly the violation this report finds (owner 2026-10-15 -- the rule stays,
|        // this report judges the device without it). The same decision as the CI build -- an observed rule claim first, else
|        // the operator's tier tag, else the default -- and a manual override as it is.
|        let _deviceTierOwn =
|            SI_CI_CL
|            | where TimeGenerated > ago(30d)
|            | where tostring(si_class) == "device" and tostring(column_ifexists("si_row_kind", "")) != "seen"
|            | summarize arg_max(todatetime(si_collection_time), *) by _dtCiId = tostring(si_ci_id)
|            | where isnotempty(_dtCiId)
|            | extend _dtSetBy = tostring(column_ifexists("si_tier_set_by", "")), _dtCiTier = toint(column_ifexists("si_tier", int(null)))
|            | mv-apply _dtClaim = todynamic(tostring(column_ifexists("si_tier_claims", dynamic(null)))) to typeof(dynamic) on (
|                where tobool(_dtClaim.admissible) == true and not(tostring(_dtClaim.rule) endswith "/LogonByT0User") and isnotnull(toint(_dtClaim.tier))
|                | summarize _dtRule = min(iff(tostring(_dtClaim.kind) == "rule", toint(_dtClaim.tier), int(null))),
|                            _dtTag = min(iff(tostring(_dtClaim.kind) == "tag", toint(_dtClaim.tier), int(null))),
|                            _dtDefault = min(iff(tostring(_dtClaim.kind) == "default", toint(_dtClaim.tier), int(null)))
|              )
|            | extend _dtTier = iff(_dtSetBy == "override", _dtCiTier, coalesce(_dtRule, _dtTag, _dtDefault))
|            // #741 (2) one row per LINK KEY of the CI (the keys _ciPeer is matched on), so the lookup can be cut to the devices
|            // of each query slice (LookupNeededKeys) -- whole it is too large for one request at a large tenant
|            | extend _dtKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|            | mv-expand _dtKey = _dtKeys to typeof(string)
|            | where isnotempty(_dtKey)
|            | project _dtKey, _dtCiId, _dtTier;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        // #690 (17b) the machine is the finding's TARGET -- one finding per account x machine survives the engine's de-duplication
|        | extend TargetAssetId = iif(isnotempty(DeviceCiId), DeviceCiId, iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId)))
|        // the device's tier and machine risk are the device CI's
|        // the device's own tier without the logon-user rule (_deviceTierOwn), else the device CI's tier
|        // (one row per CI again -- the lookup carries one row per link key of a CI, every one with the CI's own tier)
|        | join kind=leftouter (_deviceTierOwn | summarize _dtTier = min(_dtTier) by _dtCiId) on $left.DeviceCiId == $right._dtCiId
|        | extend DeviceCritLvl = toint(coalesce(_dtTier, toint(peer_tier)))
|        | where isnull(DeviceCritLvl) or DeviceCritLvl > 0
|        // the device's asset factors -- the set the engine feeds (the device CI evaluation, the report's factors), its question left out
|        | extend DeviceFactorIds = set_difference(coalesce(peer_rf_p, dynamic([])), dynamic([])), DeviceFactorNames = set_difference(coalesce(peer_rf_names, dynamic([])), dynamic([]))
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        // a Tier 0 ACCOUNT -- the account CI's tier, decided by the identity privilege tier rules (#690 (48), the tier of the
|        // highest privilege it holds today)
|        | extend CriticalityTier = toint(si_tier)
|        | where CriticalityTier == 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity      = "Medium"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Privileged Access"
|        | extend Subcategory           = "Privileged Access Workstation Compliance"
|        | extend ConfigurationName     = "Tier 0 admin authenticating to non-PAW (tiering violation)"
|        | extend ConfigurationId       = "IDENTITY-DEVICE-003"
|        | extend RF_P_DeviceTier2Plus = iff(isnull(DeviceCritLvl) or DeviceCritLvl >= 2, 1, 0)
|        | extend RF_P_HasCVEs         = iff(HasCVEs == true, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_DeviceTier2Plus + RF_P_HasCVEs + array_length(DeviceFactorIds)
|        | extend RiskFactorIds = strcat_array(DeviceFactorIds, ";")
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project TargetAssetId, SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  UserDisplayName, UserUPN, UserNodeId,
|                  DeviceName, DeviceCritLvl, DeviceRiskScore, HasCVEs,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_NoMFA_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_AnyUser_NoMFA_Summary. All enabled users with no MFA registration, across all tiers. Excludes accounts created within the last 7 days. Severity scales with tier. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for AnyUser NoMFA Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_NoMFA_Detailed
|        // Purpose  Enabled users without MFA registration, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        // #690 (27) -- a user whose MFA registration was not read is LISTED and labelled by its cause, not readable from Entra (ConfigurationName), never dropped
|        | extend _mfaUnknown = isnull(si_mfa_registered) or coalesce(set_has_element(si_unknown_fields, "si_mfa_registered"), false)
|        | where si_mfa_registered == false or _mfaUnknown
|        | where isnull(CreatedDays) or CreatedDays > 7
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", CriticalityTier == 2, "Medium", "Low")
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Authentication"
|        | extend Subcategory       = "MFA Registration"
|        | extend ConfigurationName = iff(_mfaUnknown, "User MFA registration not readable from Entra", "User missing MFA registration")
|        | extend ConfigurationId   = "IDENTITY-MFA-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_BreakGlass_Anomaly_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_BreakGlass_Anomaly_Summary. Break-glass emergency access accounts with anomalous sign-in patterns. Detects two opposite problems: (1) Break-glass account used recently (< 30 days) WITHOUT an incident - possible misuse (2) Break-glass account has never been tested OR last test was > 180 days ago Break-glass accounts should only be used in genuine emergencies and tested periodically. Severity: Very High (fixed) - any break-glass anomaly is a critical governance failure. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for BreakGlass Anomaly Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_BreakGlass_Anomaly_Detailed
|        // Purpose  Break-glass accounts used recently, never tested or not tested for 180+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where si_is_break_glass == true
|        // #690 (27) -- a break-glass account whose last sign-in the CI could not decide is LISTED as anomaly NoSignInDataSource (the cause), never dropped
|        | where LastSignInDays <= 30 or LastSignInDays > 180 or LastSignInDays == -1 or isnull(LastSignInDays)
|        | extend CriticalityTier      = 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity     = "High"
|        | extend AnomalyType =
|            case(isnull(LastSignInDays),                        "NoSignInDataSource",
|                 LastSignInDays >= 0 and LastSignInDays <= 30, "RecentUnexpectedUsage",
|                 LastSignInDays == -1,                          "NeverTested",
|                 "TestingOverdue")
|        // report-scoped flags (this report's own finding)
|        | extend RF_P_RecentUse   = iff(LastSignInDays >= 0 and LastSignInDays <= 30, 1, 0)
|        | extend RF_P_NeverTested = iff(LastSignInDays == -1, 1, 0)
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_RecentUse + RF_P_NeverTested + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["BreakGlassAnomaly"]),
|            iff(RF_P_RecentUse   == 1, dynamic(["RecentUnexpectedUsage"]), dynamic([])),
|            iff(RF_P_NeverTested == 1, dynamic(["NeverTested"]),           dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("BreakGlassAnomaly=1;RecentUnexpectedUsage=", tostring(RF_P_RecentUse),
|                   ";NeverTested=", tostring(RF_P_NeverTested))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Admin Account Hygiene"
|        | extend Subcategory       = "Break-Glass Governance"
|        | extend ConfigurationName = iff(AnomalyType == "NoSignInDataSource", "Break-glass account anomaly: no data source for the last sign-in", strcat("Break-glass account anomaly: ", AnomalyType))
|        | extend ConfigurationId   = "IDENTITY-ADMIN-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_BreakGlass_SignIn_Detected_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_BreakGlass_SignIn_Detected_Summary. Any successful sign-in by an account flagged as a break-glass emergency account. Break-glass accounts are only valid for use during genuine catastrophic failures where normal admin access is unavailable. Every sign-in by a break-glass account must be investigated to confirm it was authorised and justified. This is an operational alert that should trigger an immediate review process. Severity: Very High (fixed)  --  all break-glass usage is critical regardless of context. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for BreakGlass SignIn Detected Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_BreakGlass_SignIn_Detected_Detailed
|        // Purpose  Break-glass (emergency-access) accounts, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        // #690 (23) -- the sign-ins themselves (interactive and non-interactive, successful, 30 days) where the tenant sends them to
|        // the workspace. A sign-in with no named location is NOT trusted -- tested on the text, so an empty location list never drops it.
|        let _bgSignIns =
|            union isfuzzy=true (datatable(UserId:string, ResultType:string, TimeGenerated:datetime, IPAddress:string, Location:string, NetworkLocationDetails:string)[]), SigninLogs, AADNonInteractiveUserSignInLogs
|            | where TimeGenerated >= ago(30d)
|            | where tostring(ResultType) == "0"
|            | extend UserKey = tolower(tostring(UserId))
|            | where isnotempty(UserKey)
|            | extend IsTrusted = iff(tostring(NetworkLocationDetails) has "trustedNamedLocation", 1, 0)
|            | summarize SigninCount = count(), LastSignin = max(TimeGenerated),
|                        SigninCountries = strcat_array(make_set(Location, 5), ", "), SigninIPs = strcat_array(make_set(IPAddress, 5), ", "),
|                        NonTrustedSignins = countif(IsTrusted == 0)
|              by UserKey;
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where si_is_break_glass == true
|        // #690 (23) -- the purpose is a break-glass account that SIGNED IN -- a sign-in in the last 30 days, from the sign-in logs, or
|        // from the account's own last sign-in (si_last_sign_in, Entra and Active Directory) when the logs do not hold it
|        | extend UserKey = tolower(si_link_entra)
|        | join kind=leftouter _bgSignIns on UserKey
|        | extend _lastSignInKnown = iff(coalesce(set_has_element(si_unknown_fields, "si_last_sign_in"), false), datetime(null), si_last_sign_in)
|        | where isnotnull(LastSignin) or (isnotnull(_lastSignInKnown) and _lastSignInKnown >= ago(30d))
|        | extend SignInEvidence = iff(isnotnull(LastSignin),
|            strcat(tostring(SigninCount), " successful sign-in(s) in 30 days, last ", format_datetime(LastSignin, "yyyy-MM-dd HH:mm"), " UTC",
|                   iff(isnotempty(SigninIPs), strcat(" from ", SigninIPs), ""), iff(isnotempty(SigninCountries), strcat(" (", SigninCountries, ")"), ""),
|                   iff(NonTrustedSignins > 0, strcat(", ", tostring(NonTrustedSignins), " from a location that is not trusted"), "")),
|            strcat("Last sign-in ", format_datetime(_lastSignInKnown, "yyyy-MM-dd HH:mm"), " UTC (the account's last sign-in in Entra or Active Directory)"))
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Very High"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Sign-in Behaviour"
|        | extend Subcategory           = "Break-Glass Usage"
|        | extend ConfigurationName     = "Break-glass emergency account sign-in detected - immediate review required"
|        | extend ConfigurationId       = "IDENTITY-SIGNIN-008"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence  = 3
|        | extend RiskFactor_Probability  = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["BreakGlassAccount"]),
|            RF_P_CiFactorNames), ";")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, Impact = SignInEvidence, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Tier = si_tier,
|            MfaIsRegistered = si_mfa_registered, HasPermanentPrivilegedRole,
|            LastSignInDays, EntraRoles_Permanent = si_entra_roles_permanent,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_DisabledAccount_ActivePIMAssignment_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_DisabledAccount_ActivePIMAssignment_Summary. Disabled user accounts that still have PIM eligible role assignments active. When an account is disabled (e.g. employee leaving), all role assignments should be removed as part of the offboarding process. An eligible assignment on a disabled account means the account could be re-enabled and immediately used to activate privileged access  --  a common post-compromise technique. Severity: High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for DisabledAccount ActivePIMAssignment Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_DisabledAccount_ActivePIMAssignment_Detailed
|        // Purpose  Disabled users that still hold a privileged PIM eligible role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where si_account_enabled == false
|        | where IsPrivilegedEligible == true
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium-High"
|        // report-scoped flag (this report's own finding)
|        | extend RF_P_RecentlyDisabled = iff(LastSignInDays between (0 .. 30), 1, 0)
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors) + RF_P_RecentlyDisabled
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["DisabledAccountWithEligibleRole"]),
|            RF_P_CiFactorNames,
|            iff(RF_P_RecentlyDisabled == 1, dynamic(["RecentlyDisabled30days"]),  dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("DisabledAccountWithEligibleRole=1;RecentlyDisabled30days=", tostring(RF_P_RecentlyDisabled))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Identity Lifecycle"
|        | extend Subcategory       = "Offboarding Gaps"
|        | extend ConfigurationName = "Disabled account with active PIM eligible role assignment - offboarding incomplete"
|        | extend ConfigurationId   = "IDENTITY-LIFECYCLE-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_EligibleAdmin_LogonTo_ExploitableDevice_Detailed
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >-
|        Per-row detail view for Identity_EligibleAdmin_LogonTo_ExploitableDevice_Summary. Users with PIM-eligible Tier 0/1 roles authenticated to devices that have vulnerabilities with a known exploit (public, verified or in an exploit kit, as Defender vulnerability management and the Exposure Graph report it). Even if the PIM role is not currently activated, the credential harvested from an exploitable device could be used to activate PIM and gain full admin access. Severity: Very High (fixed) - eligible admin credential on actively exploitable device. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for EligibleAdmin LogonTo ExploitableDevice Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_EligibleAdmin_LogonTo_ExploitableDevice_Detailed
|        // Purpose  Users that can authenticate to a device with a known exploit.
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            // the graph's exploit evidence -- the exploitability levels of the device's remote-code-execution and
|            // privilege-escalation CVEs (NoExploit, ExploitIsPublic, ExploitIsVerified, ExploitIsInKit)
|            | extend _xLevels   = strcat(tostring(rawData.highRiskVulnerabilityInsights.vulnerableToRemoteCodeExecution.explotabilityLevels), tostring(rawData.highRiskVulnerabilityInsights.vulnerableToPrivilegeEscalation.explotabilityLevels))
|            | extend IsInKit    = _xLevels has "ExploitIsInKit"
|            | extend IsVerified = _xLevels has "ExploitIsVerified"
|            | extend HasExploit = IsInKit or IsVerified or _xLevels has "ExploitIsPublic"
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, HasExploit, IsInKit, IsVerified;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            // most graph user nodes carry the Entra id as a tenant id and object id pair (TenantId=... ObjectId=...) -- only
|            // the object id is the key the account's CI is linked on (si_link_entra), so the pair joined no CI
|            | extend _aadId          = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | extend UserEntraId     = iff(_aadId has "objectid=", extract(@'objectid=([0-9a-f-]+)', 1, _aadId), _aadId)
|            // the report's question -- an account Entra lists as eligible for a role through PIM (the graph's eligibleRoles)
|            | where array_length(rawData.eligibleRoles) > 0
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        // Defender vulnerability management -- a device with a CVE that has a known exploit (the knowledge base's
|        // IsExploitAvailable), read only for the devices an account can authenticate to
|        let _authTargetMde = _authTo | join kind=inner (_devices) on $left.TargetNodeId == $right.DeviceNodeId | where isnotempty(MdeDeviceId) | distinct MdeDeviceId;
|        let _tvmExploitDevices =
|            DeviceTvmSoftwareVulnerabilities
|            | where tolower(DeviceId) in (_authTargetMde)
|            | join kind=inner (DeviceTvmSoftwareVulnerabilitiesKB | where IsExploitAvailable == true | project CveId) on CveId
|            | project TvmExploitDeviceId = tolower(DeviceId)
|            | where isnotempty(TvmExploitDeviceId)
|            | distinct TvmExploitDeviceId;        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        | join kind=leftouter (_tvmExploitDevices) on $left.MdeDeviceId == $right.TvmExploitDeviceId
|        | extend HasExploit = HasExploit or isnotempty(TvmExploitDeviceId)
|        | where HasExploit        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        // #690 (17b) the machine is the finding's TARGET -- one finding per account x machine survives the engine's de-duplication
|        | extend TargetAssetId = iif(isnotempty(DeviceCiId), DeviceCiId, iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId)))
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity      = "High"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Privileged Access"
|        | extend Subcategory           = "Credential Exposure via Device"
|        | extend ConfigurationName     = "PIM-eligible admin authenticated to device with known exploits"
|        | extend ConfigurationId       = "IDENTITY-DEVICE-004"
|        // exploit signals are finding values (Exposure Graph)
|        | extend RF_P_Verified        = iff(IsVerified == true, 1, 0)
|        | extend RF_P_InKit           = iff(IsInKit == true, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_Verified + RF_P_InKit
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project TargetAssetId, SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  UserDisplayName, UserUPN, UserNodeId,
|                  DeviceName, HasExploit, IsInKit, IsVerified,
|                  RiskFactor_Consequence, RiskFactor_Probability,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ExternalUser_PrivilegedRole_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_ExternalUser_PrivilegedRole_Summary. External/B2B guest users with Tier 0/1 Entra ID roles. External identities should never hold privileged directory roles. Their accounts are governed by their home tenant's security posture which may be significantly lower than yours. A compromised partner account with Global Admin in your tenant is a catastrophic risk. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for ExternalUser PrivilegedRole Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ExternalUser_PrivilegedRole_Detailed
|        // Purpose  Enabled external (guest / B2B) users, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where si_is_external == true or si_external_user_state in ("Accepted", "PendingAcceptance")
|        // #690 (23) -- the purpose is an external user WITH a Tier 0/1 Entra role, permanent or eligible (IsPrivileged above)
|        | where IsPrivileged
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "External Identity Risk"
|        | extend ConfigurationName = "External user with privileged Entra ID role"
|        | extend ConfigurationId   = "IDENTITY-EXT-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_HighMDIInvestigationPriority_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_HighMDIInvestigationPriority_Summary. Active accounts with MDI Investigation Priority Percentile in the top 10% (MDI_InvestigationPriorityPct >= 90). MDI calculates this score based on observed anomalous behaviours, lateral movement signals, unusual access patterns, and UEBA risk scoring. A high investigation priority means MDI has observed behaviour that warrants review. When this is combined with a privileged identity, it represents a potentially active threat that requires immediate attention. Severity: High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for HighMDIInvestigationPriority Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_HighMDIInvestigationPriority_Detailed -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_mdi_investigation_priority_pct, 0) >= 90
|        | where coalesce(si_mdi_investigation_priority_pct, 0) > 0
|
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|
|        | extend RF_P_Top5Pct           = iff(coalesce(si_mdi_investigation_priority_pct, 0) >= 95, 1, 0)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = 1 + RF_P_Top5Pct + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["HighMDIInvestigationPriority"]),
|            iff(RF_P_Top5Pct         == 1, dynamic(["Top5PercentileMDIScore"]), dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("HighMDIInvestigationPriority=1;Top5PercentileMDIScore=", tostring(RF_P_Top5Pct))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Threat Intelligence"
|        | extend Subcategory       = "MDI Behavioural Signals"
|        | extend ConfigurationName = strcat("High MDI investigation priority (top 10%) - anomalous behaviour observed")
|        | extend ConfigurationId   = "IDENTITY-LIFECYCLE-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|                | project
|                  SecurityDomain,
|                  Category,
|                  Subcategory,
|                  ConfigurationName,
|                  ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity,
|                  CriticalityTier,
|                  CriticalityTierLevel,
|                  DisplayName = si_display_name,
|                  Upn = si_upn,
|                  PrimaryEntityId = si_ci_id,
|                  Department = si_org_department,
|                  Tier = si_tier,
|                  IsPrivileged,
|                  HasPermanentPrivilegedRole,
|                  IsPrivilegedEligible,
|                  MfaIsRegistered = si_mfa_registered,
|                  AccountEnabled = si_account_enabled,
|                  LastSignInDays,
|                  LastSignInDateTime = si_last_sign_in,
|                  CreatedDays,
|                  EntraRoles_Permanent = si_entra_roles_permanent,
|                  NestedGroups = si_group_memberships,
|                  RiskFactor_Consequence,
|                  RiskFactor_Probability,
|                  RiskFactor_Probability_Detailed, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|                | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_HighValueTarget_MDIRisk_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_HighValueTarget_MDIRisk_Summary. Identities flagged by Microsoft Defender for Identity as high or critical risk, cross-referenced with our asset tier classification. MDI risk signals include observed lateral movement, credential exposure, anomalous behaviour, and UEBA scoring. When a Tier 0/1 identity has elevated MDI risk, it indicates an active or recent threat that requires immediate investigation. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for HighValueTarget MDIRisk Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_HighValueTarget_MDIRisk_Detailed
|        // Purpose  Enabled users that Defender for Identity rates at risk or high risk, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where si_mdi_risk_state in ("high", "at_risk")
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Threat Intelligence"
|        | extend Subcategory       = "MDI Risk Signals"
|        | extend ConfigurationName = "Identity with elevated MDI risk score"
|        | extend ConfigurationId   = "IDENTITY-THREAT-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_MultiTenant_HighPermission_SPN_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_MultiTenant_HighPermission_SPN_Summary. Multi-tenant service principals (accessible from external tenants) with Tier 0/1 permissions. Multi-tenant apps expose credentials and permissions to external party control. If a partner tenant is compromised, the SPN can be leveraged to attack your tenant with full privileges. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for MultiTenant HighPermission SPN Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_directory_write_permissions = dynamic(["Directory.ReadWrite.All"]);
|        let SI_List_high_privilege_app_permissions = dynamic(["RoleManagement.ReadWrite.Directory", "AppRoleAssignment.ReadWrite.All", "Directory.ReadWrite.All", "Application.ReadWrite.All", "Application.ReadWrite.OwnedBy", "Group.ReadWrite.All", "GroupMember.ReadWrite.All", "User.ReadWrite.All", "UserAuthenticationMethod.ReadWrite.All", "Policy.ReadWrite.ConditionalAccess", "Policy.ReadWrite.AuthenticationMethod", "Domain.ReadWrite.All", "IdentityRiskyUser.ReadWrite.All", "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementRBAC.ReadWrite.All", "RoleEligibilitySchedule.ReadWrite.Directory", "RoleAssignmentSchedule.ReadWrite.Directory", "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup", "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup", "RoleManagementPolicy.ReadWrite.Directory", "RoleManagementPolicy.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureAD", "PrivilegedAccess.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureResources", "Mail.ReadWrite", "Mail.Send", "full_access_as_app", "EWS.AccessAsApp", "Files.ReadWrite.All", "Sites.FullControl.All", "Sites.ReadWrite.All", "Exchange.ManageAsApp"]);
|        let SI_List_microsoft_first_party_tenants = dynamic(["f8cdef31-a31e-4b4a-93e4-5f571e91255a", "72f988bf-86f1-41af-91ab-2d7cd011db47"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_MultiTenant_HighPermission_SPN_Detailed
|        // Purpose  Multi-tenant service principals owned by another tenant, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type == "service_principal"
|        | where IsMultiTenant == true
|        // high privilege (the purpose) -- a Tier 0 / 1 application permission (data-model list high_privilege_app_permissions), the privilege tier catalog's high-risk permission, or a Tier 0 / 1 Entra role
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend HighPermissions = set_intersect(_permsD, SI_List_high_privilege_app_permissions)
|        | extend HighPermissions = iff(array_length(HighPermissions) > 0, HighPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_high_privilege_app_permissions)))))
|        | extend _privKnown = isnotnull(si_high_risk_permission_grant) or isnotnull(si_privilege_tier_permanent) or array_length(_permsD) > 0
|        | extend _isPrivileged = array_length(HighPermissions) > 0 or si_high_risk_permission_grant == true or si_privilege_tier_permanent in (0, 1)
|        // a service principal whose permissions SI could not read stays in, labelled -- never dropped as not privileged
|        | where _isPrivileged or not(_privKnown)
|        // Microsoft's own applications are owned by another tenant but are not a partner's -- kept, labelled apart (a view filters them)
|        | extend _isMicrosoft = tolower(si_app_owner_org_id) in (SI_List_microsoft_first_party_tenants)
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // report-scoped flag (this report's own finding)
|        | extend RF_P_HasDirectoryWrite = iff(tostring(si_app_permissions) has_any (SI_List_directory_write_permissions), 1, 0)
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors) + RF_P_HasDirectoryWrite
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            RF_P_CiFactorNames,
|            iff(RF_P_HasDirectoryWrite == 1, dynamic(["HasDirectoryWrite"]),    dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("HasDirectoryWrite=", tostring(RF_P_HasDirectoryWrite))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = iff(_isMicrosoft, "Multi-Tenant Exposure - Microsoft first-party application", "Multi-Tenant Exposure")
|        | extend ConfigurationName = "Multi-tenant SPN with high-privilege permissions"
|        | extend ConfigurationId   = "IDENTITY-SPN-004"
|        | extend _why = array_concat(HighPermissions,
|            iff(si_privilege_tier_permanent in (0, 1), pack_array(strcat("Tier ", tostring(si_privilege_tier_permanent), " Entra role")), dynamic([])),
|            iff(si_high_risk_permission_grant == true and array_length(HighPermissions) == 0, dynamic(["a high-risk application permission"]), dynamic([])))
|        | extend Impact = case(
|            not(_privKnown), strcat("Owned by tenant ", si_app_owner_org_id, " -- SI could not read its permissions, so its privilege is not readable - check it in Entra"),
|            _isMicrosoft, strcat("Microsoft first-party application (owner tenant ", si_app_owner_org_id, ") with high privilege - ", strcat_array(_why, ", ")),
|            strcat("Application owned by another organisation (owner tenant ", si_app_owner_org_id, ") with high privilege - ", strcat_array(_why, ", ")))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_NewAccount_ImmediateTier0Role_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_NewAccount_ImmediateTier0Role_Summary. User accounts created within the last 24 hours that already have a Tier 0 Entra ID role assigned. In a healthy environment, newly created accounts go through a provisioning workflow and role assignments require approval. Immediate Tier 0 role on a brand-new account indicates either a provisioning process bypass, a compromised privileged account creating rogue admin accounts, or a misconfigured automation script with excessive initial permissions. Severity: Very High (fixed)  --  immediate Tier 0 access on new account. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for NewAccount ImmediateTier0Role Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_NewAccount_ImmediateTier0Role_Detailed
|        // Purpose  Enabled tier 0 users created within the last day, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        // a Tier 0 ROLE (permanent or eligible -- the identity's role tier), or an account SI rates Tier 0
|        | where si_privilege_tier_permanent == 0 or si_privilege_tier_eligible == 0 or si_tier == 0
|        | where CreatedDays == 0
|        | extend CriticalityTier      = 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity = "Very High"
|        // report-scoped flag (this report's own finding)
|        | extend RF_P_AlreadySignedIn = iff(LastSignInDays == 0, 1, 0)
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors) + RF_P_AlreadySignedIn
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["ImmediateTier0OnNewAccount"]),
|            RF_P_CiFactorNames,
|            iff(RF_P_AlreadySignedIn == 1, dynamic(["AlreadySignedInToday"]),    dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("ImmediateTier0OnNewAccount=1;AlreadySignedInToday=", tostring(RF_P_AlreadySignedIn))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Identity Lifecycle"
|        | extend Subcategory       = "Provisioning Anomalies"
|        | extend ConfigurationName = "Account created < 24 hours ago already has Tier 0 role - possible rogue admin"
|        | extend ConfigurationId   = "IDENTITY-LIFECYCLE-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PIM_DuplicateRoleAssignment_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_PIM_DuplicateRoleAssignment_Summary. Users who have the same Entra ID role assigned both permanently AND as PIM eligible. This is a misconfiguration: the permanent assignment makes the PIM eligible one redundant and indicates the PIM policy was not followed. The permanent assignment should be removed and only the PIM eligible retained. Severity: Medium-High (fixed) - redundant permanent assignment defeats PIM purpose. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for PIM DuplicateRoleAssignment Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PIM_DuplicateRoleAssignment_Detailed
|        // Purpose  Enabled users holding the same privileged role permanently and through PIM, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        // the same role held both as an active assignment (permanent or time-bound -- every active assignment that is not a
|        // PIM activation, as Entra lists it) and as a PIM eligibility -- whatever the role's tier
|        | extend _rolesPermanent = iff(gettype(si_entra_roles_permanent) == "array", si_entra_roles_permanent, iff(isempty(tostring(si_entra_roles_permanent)), dynamic([]), pack_array(tostring(si_entra_roles_permanent))))
|        | extend _rolesEligible  = iff(gettype(si_entra_roles_eligible) == "array", si_entra_roles_eligible, iff(isempty(tostring(si_entra_roles_eligible)), dynamic([]), pack_array(tostring(si_entra_roles_eligible))))
|        | where array_length(set_intersect(_rolesPermanent, _rolesEligible)) > 0
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium-High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 1
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["DuplicateRoleAssignment"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("DuplicateRoleAssignment=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "PIM Hygiene"
|        | extend ConfigurationName = "Duplicate role assignment - permanent and eligible overlap for same role"
|        | extend ConfigurationId   = "IDENTITY-PIM-003"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PIM_EligibleNeverActivated_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_PIM_EligibleNeverActivated_Summary. Users with PIM-eligible Tier 0/1 role assignments that have never been activated (no interactive sign-in with the role active). Eligible roles that are never used suggest the assignment is unnecessary and should be removed to reduce blast radius. This also applies to identities with eligible roles but no sign-in at all. Severity: Medium (fixed) - eligible roles are safer than permanent but unused assignments still represent unnecessary standing access that should be cleaned up. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for PIM EligibleNeverActivated Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PIM_EligibleNeverActivated_Detailed
|        // Purpose  Enabled users with a privileged PIM eligible role and no sign-in for 180+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where IsPrivilegedEligible == true
|        | where IsPrivileged == false or HasPermanentPrivilegedRole == false
|        | where LastSignInDays > 180 or LastSignInDays == -1
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 1
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "PIM Hygiene"
|        | extend ConfigurationName = "PIM eligible role never activated in 180+ days - unnecessary assignment"
|        | extend ConfigurationId   = "IDENTITY-PIM-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PasswordNeverExpires_Privileged_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_PasswordNeverExpires_Privileged_Summary. Privileged accounts with password-never-expires flag set. While passwordless and MFA mitigate this, a non-expiring password on a privileged account means a compromised credential remains valid indefinitely. Combined with no MFA or stale sign-in, this represents a critical unmanaged risk. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for PasswordNeverExpires Privileged Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PasswordNeverExpires_Privileged_Detailed -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        // privileged = a Tier 0/1 Entra role (permanent or eligible) or membership of a critical Active Directory group (#690 (23))
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1 or coalesce(array_length(iff(gettype(si_ad_critical_groups) == "dictionary", si_ad_critical_groups.data, si_ad_critical_groups)), 0) > 0)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        // an UNKNOWN never-expires flag (no source could read it, e.g. a synced account) is listed and labelled
|        // PasswordNeverExpiresNoDataSource (the cause), never dropped
|        | extend _pneUnknown = isnull(si_password_never_expires) or set_has_element(si_unknown_fields, "si_password_never_expires")
|        | where coalesce(si_password_never_expires, false) == true or _pneUnknown
|        | extend si_rf_names_ = iff(_pneUnknown, array_concat(coalesce(si_rf_names_, dynamic([])), dynamic(["PasswordNeverExpiresNoDataSource"])), si_rf_names_)
|        | where coalesce(si_passwordless_only, false) == false
|        // #690 (23) -- the purpose is PRIVILEGED accounts (IsPrivileged above)
|        | where IsPrivileged
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Password Policy"
|        | extend Subcategory       = "Password Never Expires"
|        | extend ConfigurationName = "Privileged account with password-never-expires"
|        | extend ConfigurationId   = "IDENTITY-PWD-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|                | project
|                  SecurityDomain,
|                  Category,
|                  Subcategory,
|                  ConfigurationName,
|                  ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity,
|                  CriticalityTier,
|                  CriticalityTierLevel,
|                  DisplayName = si_display_name,
|                  Upn = si_upn,
|                  PrimaryEntityId = si_ci_id,
|                  Department = si_org_department,
|                  Tier = si_tier,
|                  IsPrivileged,
|                  HasPermanentPrivilegedRole,
|                  IsPrivilegedEligible,
|                  MfaIsRegistered = si_mfa_registered,
|                  AccountEnabled = si_account_enabled,
|                  LastSignInDays,
|                  LastSignInDateTime = si_last_sign_in,
|                  CreatedDays,
|                  EntraRoles_Permanent = si_entra_roles_permanent,
|                  NestedGroups = si_group_memberships,
|                  RiskFactor_Consequence,
|                  RiskFactor_Probability,
|                  RiskFactor_Probability_Detailed, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|                | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PermanentPrivilegedRole_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_PermanentPrivilegedRole_Summary. Privileged users with permanent (non-PIM) role assignments. Best practice requires all Tier 0/1 roles to be assigned via PIM (just-in-time) to reduce the standing attack surface. Permanent assignments mean the role is always active, even when not in use, providing a persistent target for attackers. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for PermanentPrivilegedRole Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PermanentPrivilegedRole_Detailed
|        // Purpose  Enabled users with a permanent privileged role (PIM not used), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where HasPermanentPrivilegedRole == true
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Just-In-Time Access"
|        | extend ConfigurationName = "Permanent privileged role assignment - PIM not used"
|        | extend ConfigurationId   = "IDENTITY-PIM-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedUser_StalePassword_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_PrivilegedUser_StalePassword_Summary. Privileged accounts whose password has not been changed in over 365 days. Long-lived passwords increase the window of exploitation if credentials were exposed in a breach that was never detected. Applies to accounts where password authentication is still a factor (non-passwordless-only accounts). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for PrivilegedUser StalePassword Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedUser_StalePassword_Detailed -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_passwordless_only, false) == false
|        // an UNKNOWN password age (no date from any source) is listed and labelled PasswordAgeNoDataSource (the cause), never dropped
|        | extend _pwAgeUnknown = isnull(PasswordLastChangedDays) and not(set_has_element(si_rf_p, "old_password"))
|        | where set_has_element(si_rf_p, "old_password") or _pwAgeUnknown
|        // the report's question is a privileged ROLE -- the identity's role tier (a Tier 0 / Tier 1 Entra role held
|        // permanently or eligible) decides, and the account's own tier still counts (never fewer rows than before)
|        | extend _roleTier = min_of(coalesce(si_privilege_tier_permanent, 99), coalesce(si_privilege_tier_eligible, 99))
|        | where _roleTier <= 1 or isnull(si_tier) or si_tier in (0, 1)
|        | extend CriticalityTier = toint(case(isnull(si_tier) and _roleTier > 3, int(null), isnull(si_tier), _roleTier, _roleTier > 3, toint(si_tier), min_of(_roleTier, toint(si_tier))))
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        | extend _pwOver730       = iff(PasswordLastChangedDays > 730, 1, 0)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = _pwOver730 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            iff(_pwOver730      == 1, dynamic(["PasswordOver730Days"]),    dynamic([])),
|            iff(_pwAgeUnknown, dynamic(["PasswordAgeNoDataSource"]), dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("PasswordOver730Days=", tostring(_pwOver730))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Password Policy"
|        | extend Subcategory       = "Stale Passwords"
|        | extend ConfigurationName = "Privileged user with password unchanged for 365+ days"
|        | extend ConfigurationId   = "IDENTITY-PWD-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|                | project
|                  SecurityDomain,
|                  Category,
|                  Subcategory,
|                  ConfigurationName,
|                  ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity,
|                  CriticalityTier,
|                  CriticalityTierLevel,
|                  DisplayName = si_display_name,
|                  Upn = si_upn,
|                  PrimaryEntityId = si_ci_id,
|                  Department = si_org_department,
|                  Tier = si_tier,
|                  IsPrivileged,
|                  HasPermanentPrivilegedRole,
|                  IsPrivilegedEligible,
|                  MfaIsRegistered = si_mfa_registered,
|                  AccountEnabled = si_account_enabled,
|                  LastSignInDays,
|                  LastSignInDateTime = si_last_sign_in,
|                  CreatedDays,
|                  EntraRoles_Permanent = si_entra_roles_permanent,
|                  NestedGroups = si_group_memberships,
|                  RiskFactor_Consequence,
|                  RiskFactor_Probability,
|                  RiskFactor_Probability_Detailed, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|                | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_AppRoleAssignmentWrite_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_AppRoleAssignmentWrite_Summary. Service Principals with AppRoleAssignment.ReadWrite.All permission. This allows the SPN to grant any Graph application permission to any other SPN, including granting itself Global Admin-equivalent permissions such as RoleManagement.ReadWrite.Directory or Directory.ReadWrite.All. A compromised SPN with this permission can bootstrap full tenant takeover in two API calls: grant itself dangerous permissions, then use them. Severity: Very High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN AppRoleAssignmentWrite Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_app_role_assignment_write_permissions = dynamic(["AppRoleAssignment.ReadWrite.All"]);
|        let SI_List_directory_write_permissions = dynamic(["Directory.ReadWrite.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_AppRoleAssignmentWrite_Detailed
|        // Purpose  Enabled service principals / managed identities holding AppRoleAssignment.ReadWrite.All, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type in ("service_principal", "managed_identity")
|        // the permissions this report is about (its own list only), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_permsD, SI_List_app_role_assignment_write_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_app_role_assignment_write_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a constant -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier      = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "Very High"
|        | extend Impact = strcat("Holds ", strcat_array(MatchedPermissions, ", "), " -- can grant any application permission to any application, itself included")
|        // report-scoped flag (this report's own finding)
|        | extend RF_P_AlsoHasDirectoryWrite = iff(tostring(si_app_permissions) has_any (SI_List_directory_write_permissions), 1, 0)
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_AlsoHasDirectoryWrite + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["AppRoleAssignmentWritePermission"]),
|            iff(RF_P_AlsoHasDirectoryWrite == 1, dynamic(["AlsoHasDirectoryWrite"]), dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("AppRoleAssignmentWritePermission=1;AlsoHasDirectoryWrite=", tostring(RF_P_AlsoHasDirectoryWrite))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "Permission Escalation"
|        | extend ConfigurationName = "SPN with AppRoleAssignment.ReadWrite.All - can grant any Graph permission to any app"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_ExpiringCredentials_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_ExpiringCredentials_Summary. Service Principals with client secrets or certificates that have expired or will expire within 30 days. Expired credentials cause service outages. Credentials expiring on privileged SPNs are especially urgent as emergency secret rotation under pressure increases risk of mistakes or insecure handling. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN ExpiringCredentials Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_ExpiringCredentials_Detailed
|        // Purpose  Service principals / managed identities with expired or expiring credentials, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | where si_credential_expiry_days between (-3650 .. 30)
|        | extend ExpiryDays = si_credential_expiry_days
|        | extend HasExpired = si_credential_expiry_days < 0
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Credential Hygiene"
|        | extend ConfigurationName = "SPN with expired or expiring credentials"
|        | extend ConfigurationId   = "IDENTITY-SPN-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | extend si_fix_remediation = iff(isempty(si_credential_fix), "", strcat(si_credential_fix, iff(isempty(si_owner), " No owner is recorded for this application, so assign one before rotating.", strcat(" Owner to contact - ", si_owner, "."))))
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor,
|            si_owner, si_owner_upns, si_credentials, si_attached_resource, si_fix_remediation
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_MailboxAccess_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_MailboxAccess_Summary. Service Principals with mailbox-level Microsoft Graph permissions (Mail.ReadWrite, Mail.Send, MailboxSettings.ReadWrite or equivalent). These permissions allow an app to read all email in the organisation or send as any user - a high-value target for data exfiltration and business email compromise (BEC). SPNs with mailbox access and no active usage are especially concerning. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN MailboxAccess Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_mail_access_permissions = dynamic(["Mail.Read", "Mail.ReadWrite", "Mail.Send", "Mail.ReadBasic", "Mail.ReadBasic.All", "Mail-Advanced.ReadWrite.All", "MailboxSettings.ReadWrite", "MailboxItem.Read.All", "MailboxItem.ImportExport.All", "MailboxFolder.Read.All", "MailboxFolder.ReadWrite.All", "Mailbox.Migration", "full_access_as_app", "EWS.AccessAsApp", "EWS.AccessAsUser.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_MailboxAccess_Detailed
|        // Purpose  Enabled service principals / managed identities with organisation-wide mailbox permissions, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type in ("service_principal", "managed_identity")
|        // every mail / mailbox application permission (data-model list mail_access_permissions), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_permsD, SI_List_mail_access_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_mail_access_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend Impact = strcat("Mail permissions held - ", strcat_array(MatchedPermissions, ", "))
|        | extend SecuritySeverity = "Low"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier <= 1, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Overprivileged Applications"
|        | extend ConfigurationName = "SPN with organisation-wide mailbox access"
|        | extend ConfigurationId   = "IDENTITY-SPN-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_Orphan_NoOwner_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_Orphan_NoOwner_Summary. Service Principals with no registered owner. Ownerless SPNs have no accountability for credential rotation, permission review, or decommissioning. Privileged orphaned SPNs are critical: no one is responsible for monitoring or revoking access. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN Orphan NoOwner Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_Orphan_NoOwner_Detailed
|        // Purpose  Service principals without a registered owner, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type == "service_principal"
|        | where si_is_orphan_sp == true
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Low"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Orphaned Applications"
|        | extend ConfigurationName = "Service principal with no registered owner"
|        | extend ConfigurationId   = "IDENTITY-SPN-003"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | extend si_fix_remediation = strcat("Assign at least two owners to the application ", coalesce(si_display_name, si_asset_name), iff(isempty(si_app_id), "", strcat(" (application id ", si_app_id, ")")), " in Entra ID, on the service principal or on its app registration. If nobody needs it, disable it and then delete it.", iff(isnull(si_last_sign_in), " No sign-in is recorded for it.", strcat(" Its last sign-in was ", format_datetime(si_last_sign_in, "yyyy-MM-dd"), ".")))
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor,
|            si_owner, si_owner_upns, si_credentials, si_attached_resource, si_fix_remediation
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_OverCredentialed_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_OverCredentialed_Summary. Service Principals that have both a client secret AND a certificate registered. Over-credentialed SPNs increase the credential attack surface - two different authentication paths must both be managed and rotated. Often indicates legacy credentials were not cleaned up when the SPN was migrated to certificate auth. Severity: Medium (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN OverCredentialed Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_OverCredentialed_Detailed
|        // Purpose  Service principals with credentials expiring within 30 days or expired, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type == "service_principal"
|        // both kinds of credential registered (the purpose) -- every secret and certificate of the principal and of its application registration, in any state
|        | extend _creds = coalesce(todynamic(tostring(si_credentials)), dynamic([]))
|        | mv-apply _cr = _creds to typeof(dynamic) on (summarize SecretCount = countif(tostring(_cr.type) == "secret"), CertificateCount = countif(tostring(_cr.type) == "certificate"))
|        | where SecretCount > 0 and CertificateCount > 0
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 1
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["BothSecretAndCert"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("BothSecretAndCert=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Credential Hygiene"
|        | extend ConfigurationName = "SPN with both client secret and certificate - over-credentialed"
|        | extend ConfigurationId   = "IDENTITY-SPN-006"
|        | extend Impact = strcat(SecretCount, " client secret(s) and ", CertificateCount, " certificate(s) registered (a SAML signing certificate counts too) -- remove the kind it no longer uses")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | extend si_fix_remediation = iff(isempty(si_credential_fix), "", strcat(si_credential_fix, iff(isempty(si_owner), " No owner is recorded for this application, so assign one before rotating.", strcat(" Owner to contact - ", si_owner, "."))))
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor,
|            si_owner, si_owner_upns, si_credentials, si_attached_resource, si_fix_remediation
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_PrivilegedAccessWrite_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_PrivilegedAccessWrite_Summary. Service Principals with a permission that writes Privileged Identity Management directly -- RoleEligibilitySchedule / RoleAssignmentSchedule .ReadWrite.Directory, PrivilegedEligibilitySchedule / PrivilegedAssignmentSchedule .ReadWrite.AzureADGroup, RoleManagementPolicy.ReadWrite.*, or the legacy PrivilegedAccess.ReadWrite.AzureAD / AzureADGroup / AzureResources. This allows the SPN to directly create, modify, or remove PIM role eligibility and assignment schedules. A compromised SPN with this permission can make any account permanently eligible for Global Administrator with no approval workflow, or remove existing PIM assignments to cover tracks. Severity: Very High (fixed)  --  direct PIM manipulation capability. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN PrivilegedAccessWrite Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_pim_write_permissions = dynamic(["RoleEligibilitySchedule.ReadWrite.Directory", "RoleAssignmentSchedule.ReadWrite.Directory", "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup", "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup", "RoleManagementPolicy.ReadWrite.Directory", "RoleManagementPolicy.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureAD", "PrivilegedAccess.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureResources"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_PrivilegedAccessWrite_Detailed
|        // Purpose  Enabled service principals / managed identities holding PrivilegedAccess.ReadWrite (PIM manipulation), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type in ("service_principal", "managed_identity")
|        // every permission that writes PIM directly (data-model list pim_write_permissions -- the current schedule and policy permissions and the legacy PrivilegedAccess ones), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_permsD, SI_List_pim_write_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_pim_write_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a constant -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier      = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "Very High"
|        | extend Impact = strcat("Holds ", strcat_array(MatchedPermissions, ", "), " -- can create, change or remove PIM eligibilities, assignments or their policies directly")
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["PIMManipulationPermission"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("PIMManipulationPermission=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "PIM Abuse"
|        | extend ConfigurationName = "SPN with PrivilegedAccess.ReadWrite - can create/modify PIM assignments directly"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_RoleManagementWrite_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_RoleManagementWrite_Summary. Service Principals with the RoleManagement.ReadWrite.Directory Graph permission. This permission allows the SPN to assign ANY Entra ID role to ANY principal, including Global Administrator. A compromised SPN with this permission can immediately elevate any account to full tenant administrator  --  the equivalent of a skeleton key to the entire Entra ID tenant. This is arguably the most dangerous single Graph permission that exists. Severity: Very High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN RoleManagementWrite Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_role_management_write_permissions = dynamic(["RoleManagement.ReadWrite.Directory"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_RoleManagementWrite_Detailed
|        // Purpose  Enabled service principals / managed identities that can write directory role assignments, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type in ("service_principal", "managed_identity")
|        // the permissions this report is about (its own list only), matched exactly and without regard to case
|        | extend _perms = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_perms, SI_List_role_management_write_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_perms))), todynamic(tolower(tostring(SI_List_role_management_write_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a constant -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier      = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "Very High"
|        | extend Impact = strcat("Holds ", strcat_array(MatchedPermissions, ", "), " -- can assign any Entra role to any account, Global Administrator included")
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Consequence_Detailed = "DomainTakeoverPotential;AnyEntraRoleAssignable;GlobalAdminGrantable"
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["RoleManagementWritePermission"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("RoleManagementWritePermission=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "Role Assignment Abuse"
|        | extend ConfigurationName = "SPN with RoleManagement.ReadWrite.Directory - can grant Global Admin to any account"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Consequence_Detailed, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_UnverifiedPublisher_HighPermission_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_UnverifiedPublisher_HighPermission_Summary. Service Principals with Tier 0/1 permissions whose publisher has not been verified by Microsoft. Unverified publishers are anonymous  --  there is no accountability for the code running in your tenant. High-privilege unverified apps represent a supply chain risk: the app developer could push malicious updates, and there is no way to validate the publisher's identity or intent. Severity: High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN UnverifiedPublisher HighPermission Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_directory_write_permissions = dynamic(["Directory.ReadWrite.All"]);
|        let SI_List_microsoft_first_party_tenants = dynamic(["f8cdef31-a31e-4b4a-93e4-5f571e91255a", "72f988bf-86f1-41af-91ab-2d7cd011db47"]);
|        let SI_List_role_assignment_write_permissions = dynamic(["RoleManagement.ReadWrite.Directory", "AppRoleAssignment.ReadWrite.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_UnverifiedPublisher_HighPermission_Detailed
|        // Purpose  Enabled service principals whose publisher is not verified, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        | where si_publisher_verified == false
|        // Microsoft's own apps are not a supply-chain risk (and are never "verified" -- Graph leaves them without a verified publisher)
|        | where not(si_app_owner_org_id in (SI_List_microsoft_first_party_tenants))
|        // Tier 0/1 high permission = an application permission or role the privilege tier catalog rates high risk, or a permanent Tier 0/1 role
|        | where si_high_risk_permission_grant == true or si_privilege_tier_permanent in (0, 1)
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant = si_is_multitenant_app
|        | extend PublisherVerified = si_publisher_verified
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        // report-scoped flags -- application permissions by name
|        | extend RF_P_HasRoleWrite = iff(tostring(si_app_permissions) has_any (SI_List_role_assignment_write_permissions), 1, 0)
|        | extend RF_P_HasDirWrite = iff(tostring(si_app_permissions) has_any (SI_List_directory_write_permissions), 1, 0)
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors) + RF_P_HasRoleWrite + RF_P_HasDirWrite
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["UnverifiedPublisher"]),
|            RF_P_CiFactorNames,
|            iff(RF_P_HasRoleWrite == 1, dynamic(["HasRoleWrite"]),        dynamic([])),
|            iff(RF_P_HasDirWrite  == 1, dynamic(["HasDirectoryWrite"]),   dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("UnverifiedPublisher=1;HasRoleWrite=", tostring(RF_P_HasRoleWrite), ";HasDirectoryWrite=", tostring(RF_P_HasDirWrite))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "Supply Chain Risk"
|        | extend ConfigurationName = "Unverified-publisher SPN with Tier 0/1 Graph permissions"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-006"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, si_identity_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            Subcategory,
|            ConfigurationName,
|            ConfigurationId,
|            AssetName,
|            AssetId,
|            AssetType,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            DisplayName = si_display_name,
|            AppId = si_app_id,
|            PrimaryEntityId = si_link_entra,
|            ObjectType = si_identity_type,
|            ServicePrincipalType = si_sp_type,
|            Tier = si_tier,
|            AccountEnabled = si_account_enabled,
|            LastSignInDays,
|            LastSignInDateTime = si_last_sign_in,
|            CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions,
|            EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days,
|            IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity,
|            IsMultiTenant,
|            PublisherVerified,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ServiceAccount_InteractiveSignIn_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_ServiceAccount_InteractiveSignIn_Summary. Accounts classified by MDI as service accounts (MDI_IsServiceAccount = true) that have interactive human sign-ins recorded in SigninLogs. Service accounts should authenticate exclusively via non-interactive flows (daemon credentials, managed identity, service principal). Interactive logins indicate the service account credentials are being used by a human  --  either a shared password problem, a developer using service credentials to bypass controls, or a threat actor who harvested the credentials and is performing hands-on-keyboard activity. Severity: High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for ServiceAccount InteractiveSignIn Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ServiceAccount_InteractiveSignIn_Detailed -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_is_service_account, false) == true
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity      = "Medium-High"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Identity Lifecycle"
|        | extend Subcategory           = "Service Account Misuse"
|        | extend ConfigurationName     = "Service account has interactive sign-ins - credential shared or harvested"
|        | extend ConfigurationId       = "IDENTITY-LIFECYCLE-003"
|        | extend RiskFactor_Consequence  = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability  = 1
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["ServiceAccountInteractiveLogin"])), ";")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Tier = si_tier, MfaIsRegistered = si_mfa_registered, HasPermanentPrivilegedRole,
|                  LastSignInDays, EntraRoles_Permanent = si_entra_roles_permanent, RiskFactor_Consequence, RiskFactor_Probability,
|                  RiskFactor_Probability_Detailed,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ServiceAccount_SignIn_NonTrustedLocation_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_ServiceAccount_SignIn_NonTrustedLocation_Summary. Accounts classified as service accounts by MDI (MDI_IsServiceAccount = true) that have successfully authenticated from non-trusted network locations. Service accounts are expected to authenticate exclusively from known, trusted infrastructure (application servers, automation agents). Authentication from an untrusted location strongly suggests the service account credentials have been harvested and are being used by a threat actor. Severity: High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for ServiceAccount SignIn NonTrustedLocation Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ServiceAccount_SignIn_NonTrustedLocation_Detailed -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_is_service_account, false) == true
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity      = "High"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Sign-in Behaviour"
|        | extend Subcategory           = "Location Anomalies"
|        | extend ConfigurationName     = "Service account authenticated from non-trusted network location"
|        | extend ConfigurationId       = "IDENTITY-SIGNIN-002"
|        | extend RiskFactor_Consequence  = 2
|        | extend RiskFactor_Probability  = 1
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["NonTrustedLocationSignin"])), ";")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Tier = si_tier, MfaIsRegistered = si_mfa_registered, HasPermanentPrivilegedRole,
|                  LastSignInDays, EntraRoles_Permanent = si_entra_roles_permanent, RiskFactor_Consequence, RiskFactor_Probability,
|                  RiskFactor_Probability_Detailed,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ShadowAdmin_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_ShadowAdmin_Summary. Users classified as shadow admins: they hold Tier 0/1 AD group membership (e.g. Domain Admins inherited via group nesting) but have no visible Entra ID role assignments. These accounts exercise privileged AD access that may not be tracked by standard Entra ID governance tooling, creating a blind spot in access reviews and PIM coverage. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for ShadowAdmin Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ShadowAdmin_Detailed -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        // #690 (29) -- a shadow admin is read from the CI fields -- critical AD group membership (si_ad_critical_groups, from the
|        // Exposure Graph and Defender for Identity) and NO Entra role, permanent or eligible. The profile flag si_is_shadow_admin
|        // is still honoured, but it is never set for an AD-only account (no Entra record) -- exactly the shadow admins.
|        // A dictionary-shaped value (type + data) is read through .data, and a missing role list is no role
|        // (array_length of null is null, never 0).
|        | extend _critAdGroups = iff(gettype(si_ad_critical_groups) == "dictionary", si_ad_critical_groups.data, si_ad_critical_groups)
|        | extend _hasCritAdGroup = coalesce(array_length(_critAdGroups), 0) > 0
|        | extend _entraRoleCount = coalesce(array_length(si_entra_roles_permanent), 0) + coalesce(array_length(si_entra_roles_eligible), 0)
|        | where coalesce(si_is_shadow_admin, false) == true or (_hasCritAdGroup and _entraRoleCount == 0)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Shadow Admins"
|        | extend ConfigurationName = "Shadow admin - privileged AD access not visible in Entra ID"
|        | extend ConfigurationId   = "IDENTITY-SHADOW-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|                | project
|                  SecurityDomain,
|                  Category,
|                  Subcategory,
|                  ConfigurationName,
|                  ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity,
|                  CriticalityTier,
|                  CriticalityTierLevel,
|                  DisplayName = si_display_name,
|                  Upn = si_upn,
|                  PrimaryEntityId = si_ci_id,
|                  Department = si_org_department,
|                  Tier = si_tier,
|                  IsPrivileged,
|                  HasPermanentPrivilegedRole,
|                  IsPrivilegedEligible,
|                  MfaIsRegistered = si_mfa_registered,
|                  AccountEnabled = si_account_enabled,
|                  LastSignInDays,
|                  LastSignInDateTime = si_last_sign_in,
|                  CreatedDays,
|                  EntraRoles_Permanent = si_entra_roles_permanent,
|                  NestedGroups = si_group_memberships,
|                  RiskFactor_Consequence,
|                  RiskFactor_Probability,
|                  RiskFactor_Probability_Detailed, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|                | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_StaleGuest_NoLogin90Days_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_StaleGuest_NoLogin90Days_Summary. B2B guest/external collaborator accounts with no sign-in for 90+ days. Guests have a shorter stale threshold than internal users as they represent external access that should be regularly re-validated. Stale guest accounts are a common vector for supply chain and partner-related compromises. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for StaleGuest NoLogin90Days Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_StaleGuest_NoLogin90Days_Detailed
|        // Purpose  Enabled guest / external accounts with no sign-in for 90+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsB2BCollaborator = (si_external_user_state in~ ("Accepted", "PendingAcceptance"))
|        | where si_is_external == true or IsB2BCollaborator == true
|        // #690 (27) -- a guest whose last sign-in the CI could not decide is LISTED and labelled by its cause, no data source (ConfigurationName)
|        | where LastSignInDays > 90 or (LastSignInDays == -1 and CreatedDays > 90) or (isnull(LastSignInDays) and (isnull(CreatedDays) or CreatedDays > 90))
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Low"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        // report-scoped flag -- a privileged (tier 0/1) Entra role
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Account Lifecycle"
|        | extend Subcategory       = "Guest / External Access"
|        | extend ConfigurationName = iff(isnull(LastSignInDays), "Guest account inactive for 90+ days - no data source for the last sign-in", "Guest account inactive for 90+ days")
|        | extend ConfigurationId   = "IDENTITY-GUEST-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, si_identity_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            Subcategory,
|            ConfigurationName,
|            ConfigurationId,
|            AssetName,
|            AssetId,
|            AssetType,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            DisplayName = si_display_name,
|            Upn = si_upn,
|            PrimaryEntityId = si_link_entra,
|            Department = si_org_department,
|            Tier = si_tier,
|            IsPrivileged,
|            HasPermanentPrivilegedRole,
|            IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered,
|            AccountEnabled = si_account_enabled,
|            LastSignInDays,
|            LastSignInDateTime = si_last_sign_in,
|            CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent,
|            NestedGroups = si_group_memberships,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_TooManyGlobalAdmins_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_TooManyGlobalAdmins_Summary. Detects when the organisation has more than 5 active Global Administrator accounts. Microsoft recommends 2-5 Global Admins maximum. Each additional Global Admin increases the attack surface proportionally. Organisations with 10+ Global Admins typically have role assignment hygiene problems and lack a formal review process. Severity: High (fixed) - excessive Global Admin count is always a significant risk. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for TooManyGlobalAdmins Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_TooManyGlobalAdmins_Detailed
|        // Purpose  Enabled users holding a permanent Global Administrator role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier and CMDB values.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        // #690 (23) -- every identity that holds Global Administrator -- active (permanent or time-bound) or eligible, directly or
|        // through a group (the role read resolves group and PIM-for-groups roles), users, guests and service principals -- and the
|        // purpose's threshold, MORE THAN 5, counted over the whole tenant before the slice (the same count as the Summary report)
|        let _gaAll =
|            _ciAsset
|            | where tostring(si_entra_roles_permanent) has "Global Administrator" or tostring(si_entra_roles_eligible) has "Global Administrator";
|        let _gaCount = toscalar(_gaAll | summarize _gaCount = dcount(si_ci_id));
|        _gaAll
|        | where _gaCount > 5
|        | extend GaEvidence = strcat("Global Administrator ", iff(tostring(si_entra_roles_permanent) has "Global Administrator", "active", "eligible"), " - one of ", tostring(_gaCount), " identities holding it (more than 5)")
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity      = "Medium"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Admin Account Hygiene"
|        | extend Subcategory           = "Role Assignment Governance"
|        | extend ConfigurationName     = "Excessive Global Administrator count - more than 5 active accounts"
|        | extend ConfigurationId       = "IDENTITY-ADMIN-004"
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1
|        | extend RiskFactor_Probability_Detailed = "GlobalAdmin"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, si_identity_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName,
|            AssetId,
|            AssetType,
|            Impact = GaEvidence,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_link_entra, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships, RiskFactor_Consequence, RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: PublicIP_OpenPorts_Summary
|      ReportPurpose: >
|        Public IPs that Shodan reports with one or more open ports, aggregated per asset. Severity follows the criticality tier of the asset the IP belongs to. High-severity ports (SSH 22, RDP 3389, MSSQL 1433, MySQL 3306, PostgreSQL 5432, WinRM 5985/5986) tagged separately. Source: the public IP CI (SI_CI_CL), from the Shodan scanner.
|      SecurityDomain: PublicIP
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["high_risk_port_open", "restricted_data", "confidential_data", "report_scoped"]);
|        let SI_FactorNames = dynamic({"confidential_data": "ConfidentialData", "high_risk_port_open": "PortOpenInternet", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   PublicIP_OpenPorts_Summary
|        // Purpose  Public IPs with open ports seen by Shodan, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["confidential_data", "high_risk_port_open", "report_scoped", "restricted_data"])), si_rf_c = set_intersect(si_rf_c, dynamic(["confidential_data", "high_risk_port_open", "report_scoped", "restricted_data"]))
|                | extend _ciRfNames = dynamic({"confidential_data": "ConfidentialData", "high_risk_port_open": "PortOpenInternet", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        // #690 (35) every CI Shodan scans, whatever its class -- an Azure public IP resource is a cloud_resource CI with a Shodan link, so the block has no class filter
|        _ciAsset
|        | where isnotempty(si_link_shodan) and si_open_port_count > 0
|        | extend IpAddress = si_ip_address
|        | extend AssetName = coalesce(si_asset_name, si_ip_address)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | mv-expand Port = si_open_ports to typeof(int)
|        | extend IsHighRiskPort = iff(Port in (22, 3389, 1433, 3306, 5432, 5985, 5986), 1, 0)
|        // Impact -- 0-10, the same scale the CVE reports take from CVSS. Shodan reports no score for an open port, so
|        // these are the authored values for this domain (Open admin port 9.0, Exposed service 7.0).
|        | extend Impact = iff(IsHighRiskPort == 1, 9.0, 7.0)
|        // CriticalityTier -- the CI's tier (the owning asset's criticality)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0",
|                 CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",
|                 CriticalityTier == 3, "Low - tier 3", "")
|        // severity label = pure tier; port risk and tier 0 raise the score through the probability tokens
|        | extend SecuritySeverity =
|            case(CriticalityTier == 0, "Very High",
|                 CriticalityTier == 1, "High",
|                 CriticalityTier == 2, "Medium",
|                 "Low")
|        | extend SecurityDomain    = "PublicIP"
|        | extend Category          = "External Exposure"
|        | extend Subcategory       = "Open Port"
|        | extend ConfigurationName = strcat("Public IP with open port ", tostring(Port))
|        | extend ConfigurationId   = strcat("PUBLICIP-OPENPORT-", tostring(Port))
|        | extend RiskFactor_Consequence = 3   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)   // engine overrides this from RiskFactor_Probability_Detailed token count (or 0 if empty) -- schema scaffolding only
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["InternetExposed"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("InternetExposed=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(AssetName, " (", IpAddress, ")"))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(strcat(AssetName, " (", IpAddress, ")"), "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|             cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: PublicIP_OpenPorts_Detailed
|      ReportPurpose: >
|        Per-row Detailed view of public-IP open ports. Severity follows the criticality tier of the asset the IP belongs to. One row per (AssetName, IpAddress, Port). Source: the public IP CI (SI_CI_CL), from the Shodan scanner.
|      SecurityDomain: PublicIP
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["high_risk_port_open", "restricted_data", "confidential_data", "report_scoped"]);
|        let SI_FactorNames = dynamic({"confidential_data": "ConfidentialData", "high_risk_port_open": "PortOpenInternet", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   PublicIP_OpenPorts_Detailed
|        // Purpose  Public IPs with open ports seen by Shodan, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["confidential_data", "high_risk_port_open", "report_scoped", "restricted_data"])), si_rf_c = set_intersect(si_rf_c, dynamic(["confidential_data", "high_risk_port_open", "report_scoped", "restricted_data"]))
|                | extend _ciRfNames = dynamic({"confidential_data": "ConfidentialData", "high_risk_port_open": "PortOpenInternet", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        // #690 (35) every CI Shodan scans, whatever its class -- an Azure public IP resource is a cloud_resource CI with a Shodan link, so the block has no class filter
|        _ciAsset
|        | where isnotempty(si_link_shodan) and si_open_port_count > 0
|        | extend IpAddress = si_ip_address
|        | extend AssetName = coalesce(si_asset_name, si_ip_address)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | mv-expand Port = si_open_ports to typeof(int)
|        | extend IsHighRiskPort = iff(Port in (22, 3389, 1433, 3306, 5432, 5985, 5986), 1, 0)
|        // Impact -- 0-10, the same scale the CVE reports take from CVSS. Shodan reports no score for an open port, so
|        // these are the authored values for this domain (Open admin port 9.0, Exposed service 7.0).
|        | extend Impact = iff(IsHighRiskPort == 1, 9.0, 7.0)
|        // CriticalityTier -- the CI's tier (the owning asset's criticality)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0",
|                 CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",
|                 CriticalityTier == 3, "Low - tier 3", "")
|        // severity label = pure tier; port risk and tier 0 raise the score through the probability tokens
|        | extend SecuritySeverity =
|            case(CriticalityTier == 0, "Very High",
|                 CriticalityTier == 1, "High",
|                 CriticalityTier == 2, "Medium",
|                 "Low")
|        | extend SecurityDomain    = "PublicIP"
|        | extend Category          = "External Exposure"
|        | extend Subcategory       = "Open Port"
|        | extend ConfigurationName = strcat("Public IP with open port ", tostring(Port))
|        | extend ConfigurationId   = strcat("PUBLICIP-OPENPORT-", tostring(Port))
|        | extend RiskFactor_Consequence = 3   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)   // engine overrides this from RiskFactor_Probability_Detailed token count (or 0 if empty) -- schema scaffolding only
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId = si_ci_id,
|                  AssetType = si_asset_type,
|                  Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  AssetEngine = si_class, IpAddress, Port,
|                  cmdbName, cmdbCriticality, Country = si_country,
|                  OrgName        = si_org_name,
|                  Isp            = si_isp,
|                  Hostnames      = si_hostnames,
|                  ShodanLastSeen = tostring(si_last_seen_),
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: PublicIP_Vulnerabilities_Summary
|      ReportPurpose: >
|        Public IPs that Shodan reports with one or more known CVEs. A vulnerability reachable from the internet is treated as Very High severity whatever the asset tier, because the exposure itself is the risk; the tier of the owning asset then ranks the findings within that severity. Source: the public IP CI (SI_CI_CL), from the Shodan scanner.
|      SecurityDomain: PublicIP
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["high_risk_port_open", "restricted_data", "confidential_data", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"confidential_data": "ConfidentialData", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_risk_port_open": "PortOpenInternet", "known_exploited": "KnownExploited", "network_no_user_action": "NetworkNoUserAction", "old_vuln": "OldVuln", "overdue": "Overdue", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_Factor_high_cvss_public_ip = (si_cvss:string) { (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_cvss))) >= 9) };
|        //__SI_SCOPE_END__
|        // Report   PublicIP_Vulnerabilities_Summary
|        // Purpose  Public IPs with known CVEs reported by Shodan, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["confidential_data", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_risk_port_open", "known_exploited", "network_no_user_action", "old_vuln", "overdue", "remote_code_execution", "report_scoped", "restricted_data", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["confidential_data", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_risk_port_open", "known_exploited", "network_no_user_action", "old_vuln", "overdue", "remote_code_execution", "report_scoped", "restricted_data", "zero_day"]))
|                | extend _ciRfNames = dynamic({"confidential_data": "ConfidentialData", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_risk_port_open": "PortOpenInternet", "known_exploited": "KnownExploited", "network_no_user_action": "NetworkNoUserAction", "old_vuln": "OldVuln", "overdue": "Overdue", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        // #690 (35) every CI Shodan scans, whatever its class -- an Azure public IP resource is a cloud_resource CI with a Shodan link, so the block has no class filter
|        _ciAsset
|        | where isnotempty(si_link_shodan) and array_length(si_vulns) > 0
|        | extend IpAddress = si_ip_address
|        | extend AssetName = coalesce(si_asset_name, si_ip_address)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | extend MaxCvssScore = si_max_cvss
|        | mv-expand Cve = si_vulns to typeof(string)
|        // the CVE exclusions of the Exclusions page (excluded CVEs -- Shodan reports no CVE date, so the minimum age cannot apply)
|        | where SI_InScopeCve(Cve, datetime(null))
|        // CriticalityTier -- the CI's tier (the owning asset's criticality)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0",
|                 CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",
|                 CriticalityTier == 3, "Low - tier 3", "")
|        // Impact -- the CVSS score of the worst CVE Shodan reports on this IP (0-10, as the endpoint CVE report).
|        // Shodan returns the score only on higher plans, so it can be null while CVEs are listed. A null must NOT read
|        // as a low score -- absence is not remediation -- so it falls back to 8.0, the authored impact for an
|        // internet-reachable vulnerability.
|        | extend Impact = toreal(coalesce(MaxCvssScore, 8.0))
|        // Severity bands -- the house CVSS mapping. A CVE's severity is a property of the CVE, not of the asset it
|        // sits on; the asset's tier is carried in CriticalityTier.
|        | extend SecuritySeverity = case(
|            Impact >= 9.0, "Very High",
|            Impact >= 7.0, "High",
|            Impact >= 5.0, "Medium-High",
|            Impact >= 3.0, "Medium",
|            "Low")
|        | extend SecurityDomain    = "PublicIP"
|        | extend Category          = "External Exposure"
|        | extend Subcategory       = "Vulnerability"
|        | extend ConfigurationName = strcat("Public IP with known CVE: ", Cve)
|        | extend ConfigurationId   = Cve
|        | extend RiskFactor_Consequence = 3   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|        // asset risk factor -- the CI's evaluation (data-model/risk-factors.locked.json), never this report's own
|        | extend RiskFactor_Probability = 2   // engine overrides this from RiskFactor_Probability_Detailed token count (or 0 if empty) -- schema scaffolding only
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["InternetExposedCVE"]),
|            iff(SI_Factor_high_cvss_public_ip(tostring(MaxCvssScore)), dynamic(["CVSS9plus"]), dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("InternetExposedCVE=1", iff(SI_Factor_high_cvss_public_ip(tostring(MaxCvssScore)), ";CVSS9plus=1", ""))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(AssetName, " (", IpAddress, ")"))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(strcat(AssetName, " (", IpAddress, ")"), "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|             cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|        // si si_category <- Category, si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics
|        // si si_mitre_techniques <- MITRE_Techniques, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: PublicIP_Vulnerabilities_Detailed
|      ReportPurpose: >
|        Per-row Detailed view of public-IP CVEs. Every row is Very High severity because the vulnerability is reachable from the internet. One row per (AssetName, IpAddress, CVE). Source: the public IP CI (SI_CI_CL), from the Shodan scanner.
|      SecurityDomain: PublicIP
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["high_risk_port_open", "restricted_data", "confidential_data", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"confidential_data": "ConfidentialData", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_risk_port_open": "PortOpenInternet", "known_exploited": "KnownExploited", "network_no_user_action": "NetworkNoUserAction", "old_vuln": "OldVuln", "overdue": "Overdue", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_Factor_high_cvss_public_ip = (si_cvss:string) { (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_cvss))) >= 9) };
|        //__SI_SCOPE_END__
|        // Report   PublicIP_Vulnerabilities_Detailed
|        // Purpose  Public IPs with known CVEs reported by Shodan, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["confidential_data", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_risk_port_open", "known_exploited", "network_no_user_action", "old_vuln", "overdue", "remote_code_execution", "report_scoped", "restricted_data", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["confidential_data", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_risk_port_open", "known_exploited", "network_no_user_action", "old_vuln", "overdue", "remote_code_execution", "report_scoped", "restricted_data", "zero_day"]))
|                | extend _ciRfNames = dynamic({"confidential_data": "ConfidentialData", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_risk_port_open": "PortOpenInternet", "known_exploited": "KnownExploited", "network_no_user_action": "NetworkNoUserAction", "old_vuln": "OldVuln", "overdue": "Overdue", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        // #690 (35) every CI Shodan scans, whatever its class -- an Azure public IP resource is a cloud_resource CI with a Shodan link, so the block has no class filter
|        _ciAsset
|        | where isnotempty(si_link_shodan) and array_length(si_vulns) > 0
|        | extend IpAddress = si_ip_address
|        | extend AssetName = coalesce(si_asset_name, si_ip_address)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | extend MaxCvssScore = si_max_cvss
|        | mv-expand Cve = si_vulns to typeof(string)
|        // the CVE exclusions of the Exclusions page (excluded CVEs -- Shodan reports no CVE date, so the minimum age cannot apply)
|        | where SI_InScopeCve(Cve, datetime(null))
|        // CriticalityTier -- the CI's tier (the owning asset's criticality)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0",
|                 CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",
|                 CriticalityTier == 3, "Low - tier 3", "")
|        // Impact -- the CVSS score of the worst CVE Shodan reports on this IP (0-10, as the endpoint CVE report).
|        // Shodan returns the score only on higher plans, so it can be null while CVEs are listed. A null must NOT read
|        // as a low score -- absence is not remediation -- so it falls back to 8.0, the authored impact for an
|        // internet-reachable vulnerability.
|        | extend Impact = toreal(coalesce(MaxCvssScore, 8.0))
|        // Severity bands -- the house CVSS mapping. A CVE's severity is a property of the CVE, not of the asset it
|        // sits on; the asset's tier is carried in CriticalityTier.
|        | extend SecuritySeverity = case(
|            Impact >= 9.0, "Very High",
|            Impact >= 7.0, "High",
|            Impact >= 5.0, "Medium-High",
|            Impact >= 3.0, "Medium",
|            "Low")
|        | extend SecurityDomain    = "PublicIP"
|        | extend Category          = "External Exposure"
|        | extend Subcategory       = "Vulnerability"
|        | extend ConfigurationName = strcat("Public IP with known CVE: ", Cve)
|        | extend ConfigurationId   = Cve
|        | extend RiskFactor_Consequence = 3   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|        // asset risk factor -- the CI's evaluation (data-model/risk-factors.locked.json), never this report's own
|        | extend RiskFactor_Probability = 2   // engine overrides this from RiskFactor_Probability_Detailed token count (or 0 if empty) -- schema scaffolding only
|        // the finding factor high_cvss_public_ip -- the catalog's definition (SI_Factor_high_cvss_public_ip, its threshold the customer may change)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["InternetExposedCVE"]),
|            iff(SI_Factor_high_cvss_public_ip(tostring(MaxCvssScore)), dynamic(["CVSS9plus"]), dynamic([]))), ";")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId = si_ci_id,
|                  AssetType = si_asset_type,
|                  Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  AssetEngine = si_class, IpAddress, Cve, MaxCvssScore,
|                  cmdbName, cmdbCriticality, Country = si_country,
|                  OrgName        = si_org_name,
|                  Isp            = si_isp,
|                  ShodanLastSeen = tostring(si_last_seen_),
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|        // si si_category <- Category, si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Endpoint_ActiveCompromise_Detected_Summary
|      ReportPurpose: >
|        Endpoints of every tier (ranked by tier) where Microsoft Exposure Mgmt has flagged recent compromise indicators (NodeProperties.rawData.isCompromisedRecently). New v2.2 lens enabled by EG-derived IsCompromisedRecently signal (MS-computed). Aggregated per (Tier x Severity x cmdb*) bucket; lists carry impacted-asset detail.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Endpoint_ActiveCompromise_Detected_Summary
|          // Purpose  Tier 0/1 endpoints Microsoft Exposure Management flags as recently compromised, per tier.
|          // #505 -- the asset is the CI (SI_CI_CL), class device. Log Analytics only.
|          //__SI_CI_ASSET_BEGIN__
|              let _ciAsset =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_stale_) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                            si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                            si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                            si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                            si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                            si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                            si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                            si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                            si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                            si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                            si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                            si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                            si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                            si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                            si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                            si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                            si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                            si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                            si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                            si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                            si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                            si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                            si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                            si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                            si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                            si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                            si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                            si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                            si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                            si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                            si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                            si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                            si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                            si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                            si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                            si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                            si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                            si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                            si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                            si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                            si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                            si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                            si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                            si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                            si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                            si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                            si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                            si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                            si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                            si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                            si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                            si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                            si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                            si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                            si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                            si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                            si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                            si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                            si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                            si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                            si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                            si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                            si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                            si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                            si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                            si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                            si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                            si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                            si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                            si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                            si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                            si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                            si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                            si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                            si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|          //__SI_CI_ASSET_END__
|          _ciAsset
|          | where si_is_compromised_recently == true
|          // an asset Defender excludes, or an excluded tag marks, is not reported
|          | where coalesce(si_is_excluded, false) == false
|          // #643 every tier the report declares (CriticalityTierLevelScope 0-3) -- a compromised device is reported whatever its tier,
|          // Defender shows it, so SecurityInsight shows it. A device without a tier yet passes here; the engine gives it the
|          // tier the rules give it before the declared scope applies (never kept now and dropped once it has a tier).
|          | extend CriticalityTier = toint(si_tier)
|          | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|          | extend SecuritySeverity = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", "Medium")
|          | extend SecurityDomain    = "Endpoint"
|          | extend Category          = "Active Threats"
|          | extend Subcategory       = "Compromise Indicators"
|          | extend ConfigurationName = "Asset shows recent compromise indicators (Microsoft Exposure Mgmt)"
|          | extend ConfigurationId   = "ENDPOINT-ACTIVE-COMPROMISE-001"
|          | extend AssetName         = coalesce(si_asset_name, si_hostname, si_ci_id)
|          | extend MsCriticalityLevel = si_ms_criticality
|          | extend MachineRiskState   = si_machine_risk
|          | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|          | extend DeviceKey = si_ci_id
|          //__BUCKET_FILTER_BEGIN__
|          | where 1 == 1
|          //__BUCKET_FILTER_END__
|          // audit #25 -- ImpactedAssetCount is DERIVED from ImpactedAssetsList (a bare make_set), and
|          // ImpactedAssetPairs pairs name and id in one token the engine splits on the LAST '|'.
|          | summarize
|              TotalIssues          = count(),
|              ImpactedAssetsList   = make_set(AssetName),
|              ImpactedAssetPairs   = make_set(strcat(AssetName, "|", si_ci_id)),
|              MdeDeviceId          = min(tostring(si_link_mde)),
|              EntraAccountObjectId = min(tostring(si_link_entra)),
|              AzureResourceId      = min(tostring(si_link_azure)),
|              AssetId              = min(si_ci_id)
|            by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|               CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|               cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MsCriticalityLevel, MachineRiskState
|          | extend ImpactedAssetsList = array_sort_asc(ImpactedAssetsList)
|          | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|          //__WEIGHTED_FACTORS_BEGIN__
|          | extend RiskScore_Weight_Detailed = ""
|          | extend RiskScore_Weight_Factor   = 100
|          | extend RiskFactor_Weight         = 100
|          //__WEIGHTED_FACTORS_END__
|          | order by RiskScore_Weight_Factor desc, CriticalityTier asc, TotalIssues desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|          // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|          // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Endpoint_ActiveCompromise_Detected_Detailed
|      ReportPurpose: >
|        Per-asset detail view of endpoints of every tier flagged by Microsoft Exposure Mgmt as recently compromised. One row per asset.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Endpoint_ActiveCompromise_Detected_Detailed
|          // Purpose  Tier 0/1 endpoints Microsoft Exposure Management flags as recently compromised. One row per asset.
|          // #505 -- the asset is the CI (SI_CI_CL), class device. Log Analytics only.
|          //__SI_CI_ASSET_BEGIN__
|              let _ciAsset =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_stale_) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                            si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                            si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                            si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                            si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                            si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                            si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                            si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                            si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                            si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                            si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                            si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                            si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                            si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                            si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                            si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                            si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                            si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                            si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                            si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                            si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                            si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                            si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                            si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                            si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                            si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                            si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                            si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                            si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                            si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                            si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                            si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                            si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                            si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                            si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                            si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                            si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                            si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                            si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                            si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                            si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                            si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                            si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                            si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                            si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                            si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                            si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                            si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                            si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                            si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                            si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                            si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                            si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                            si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                            si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                            si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                            si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                            si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                            si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                            si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                            si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                            si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                            si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                            si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                            si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                            si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                            si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                            si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                            si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                            si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                            si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                            si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                            si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                            si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                            si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|          //__SI_CI_ASSET_END__
|          _ciAsset
|          | where si_is_compromised_recently == true
|          // an asset Defender excludes, or an excluded tag marks, is not reported
|          | where coalesce(si_is_excluded, false) == false
|          // #643 every tier the report declares (CriticalityTierLevelScope 0-3) -- a compromised device is reported whatever its tier,
|          // Defender shows it, so SecurityInsight shows it. A device without a tier yet passes here; the engine gives it the
|          // tier the rules give it before the declared scope applies (never kept now and dropped once it has a tier).
|          | extend CriticalityTier = toint(si_tier)
|          | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|          | extend SecuritySeverity = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", "Medium")
|          | extend SecurityDomain    = "Endpoint"
|          | extend Category          = "Active Threats"
|          | extend Subcategory       = "Compromise Indicators"
|          | extend ConfigurationName = "Asset shows recent compromise indicators (Microsoft Exposure Mgmt)"
|          | extend ConfigurationId   = "ENDPOINT-ACTIVE-COMPROMISE-001"
|          | extend AssetName         = coalesce(si_asset_name, si_hostname, si_ci_id)
|          | extend AssetId           = si_ci_id
|          | extend AssetType         = "Endpoint"
|          | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|          | extend MsCriticalityLevel        = si_ms_criticality
|          | extend MachineRiskState          = si_machine_risk
|          | extend HasInternetExposureSignal = si_internet_exposed
|          | extend IsProductionEnvironment   = set_has_element(si_rf_c, "production_environment")
|          | extend LastSeen                  = tostring(si_last_seen_)
|          | extend DeviceKey = si_ci_id
|          //__BUCKET_FILTER_BEGIN__
|          | where 1 == 1
|          //__BUCKET_FILTER_END__
|          //__WEIGHTED_FACTORS_BEGIN__
|          | extend RiskScore_Weight_Detailed = ""
|          | extend RiskScore_Weight_Factor   = 100
|          | extend RiskFactor_Weight         = 100
|          //__WEIGHTED_FACTORS_END__
|          | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                    AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                    RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                    cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|                    MsCriticalityLevel, MachineRiskState, HasInternetExposureSignal, IsProductionEnvironment, LastSeen,
|                    MdeDeviceId = si_link_mde, EntraAccountObjectId = si_link_entra, AzureResourceId = si_link_azure
|          | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|          // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|          // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|
|    - ReportName: Identity_Departed_AccountStillEnabled_Detailed
|      ReportPurpose: Users whose EmployeeLeaveDateTime is in the past but the account is still enabled. HR off-boarding gap; common attack path.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Departed_AccountStillEnabled_Detailed
|        // Purpose  Departed users (leave date passed) whose account is still enabled, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_account_enabled == true
|        | where isnotnull(si_leave_date) and si_leave_date < now()
|        | extend DaysSinceLeave = datetime_diff('day', now(), si_leave_date)
|        | extend MoreInfoUrl = strcat("https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/", coalesce(si_link_entra, si_upn))
|        | extend Links = dynamic_to_json(pack_array(
|            pack("label", "User profile", "url", MoreInfoUrl),
|            pack("label", "Sign-in logs", "url", strcat("https://entra.microsoft.com/#view/Microsoft_AAD_IAM/SigninLogsMenuBlade/userId/", coalesce(si_link_entra, si_upn)))))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = si_upn,
|            Impact = strcat("User departed ", DaysSinceLeave, " days ago, account still enabled"),
|            EmployeeLeaveDateTime = si_leave_date, DaysSinceLeave, MoreInfoUrl, Links,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_reference_url <- MoreInfoUrl, si_portal_link <- MoreInfoUrl, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_DisabledPrivilegedUser_Detailed
|      ReportPurpose: Identities flagged DisabledPrivilegedUser by the engine -- account disabled but still carries privileged role assignment.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_DisabledPrivilegedUser_Detailed
|        // Purpose  Disabled accounts that still hold a privileged (tier 0/1) Entra role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_account_enabled == false
|        | extend DisabledPrivilegedUser = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where DisabledPrivilegedUser == true
|        | extend MoreInfoUrl = strcat("https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/", coalesce(si_link_entra, si_upn))
|        | extend Links = dynamic_to_json(pack_array(pack("label", "User profile", "url", MoreInfoUrl)))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = si_upn,
|            Impact = "Disabled account still has privileged role -- re-enable resurrects access",
|            DisabledPrivilegedUser, MoreInfoUrl, Links,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_reference_url <- MoreInfoUrl, si_portal_link <- MoreInfoUrl, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_DisabledUser_StillInCriticalGroup_Detailed
|      ReportPurpose: |-
|        Disabled users still in critical AD nested groups OR with active Entra
|        roles. Cleanup gap; account re-enable would resurrect privilege.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_DisabledUser_StillInCriticalGroup_Detailed
|        // Purpose  Disabled accounts still in a critical AD group or holding an Entra role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_account_enabled == false
|        | where array_length(si_ad_critical_groups) > 0
|            or array_length(si_entra_roles_permanent) > 0
|            or array_length(si_entra_roles_eligible) > 0
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = si_upn,
|            Impact = "Disabled account still has privileged group / role -- re-enable resurrects privilege",
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_GuestWithPrivilegedRole_Detailed
|      ReportPurpose: B2B Guest users (UserType=Guest) holding ANY Entra role -- guests should never have privileged roles.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_GuestWithPrivilegedRole_Detailed
|        // Purpose  External (guest) identities holding an Entra role assignment, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_is_external == true
|        | where array_length(si_entra_roles_permanent) > 0 or array_length(si_entra_roles_eligible) > 0
|        | extend MoreInfoUrl = strcat("https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/AssignedRoles/userId/", coalesce(si_link_entra, si_upn))
|        | extend Links = dynamic_to_json(pack_array(
|            pack("label", "Guest user", "url", MoreInfoUrl),
|            pack("label", "External collaboration policy", "url", "https://entra.microsoft.com/#view/Microsoft_AAD_IAM/CompanyRelationshipsMenuBlade/~/Settings")))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = si_upn,
|            Impact = "External guest holds Entra role assignment",
|            EntraRoles_Permanent = si_entra_roles_permanent, MoreInfoUrl, Links,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_reference_url <- MoreInfoUrl, si_portal_link <- MoreInfoUrl, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedRole_PermanentNotEligible_Detailed
|      ReportPurpose: Users / SPNs holding PERMANENT (always-on) privileged role assignments instead of PIM-eligible. Standing privilege violates JIT/JEA.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_microsoft_first_party_tenants = dynamic(["f8cdef31-a31e-4b4a-93e4-5f571e91255a", "72f988bf-86f1-41af-91ab-2d7cd011db47"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedRole_PermanentNotEligible_Detailed
|        // Purpose  Enabled identities with always-on (permanent) Entra roles instead of PIM-eligible, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        // a list of ONE role can reach the CI as the bare role name (text, not a list) -- counted as one role, never dropped
|        | extend _rolesPermanent = iff(gettype(si_entra_roles_permanent) == "array", si_entra_roles_permanent, iff(isempty(tostring(si_entra_roles_permanent)), dynamic([]), pack_array(tostring(si_entra_roles_permanent))))
|        | extend _rolesEligible  = iff(gettype(si_entra_roles_eligible) == "array", si_entra_roles_eligible, iff(isempty(tostring(si_entra_roles_eligible)), dynamic([]), pack_array(tostring(si_entra_roles_eligible))))
|        | extend PermanentRoleCount = array_length(_rolesPermanent)
|        | extend EligibleRoleCount  = array_length(_rolesEligible)
|        | where PermanentRoleCount > 0
|        // owner 2026-10-15 (#690 (50)) -- Microsoft's own first-party service principals (an application Microsoft owns,
|        // the data-model list microsoft_first_party_tenants) are left out -- a service principal cannot be made eligible in PIM,
|        // and the role is one Microsoft gave its own application
|        | where not(tolower(si_app_owner_org_id) in (SI_List_microsoft_first_party_tenants))
|        | extend MoreInfoUrl = "https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/CommonMenuBlade/~/quickStart"
|        | extend Links = dynamic_to_json(pack_array(
|            pack("label", "PIM overview", "url", MoreInfoUrl),
|            pack("label", "Role assignments", "url", "https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles")))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_upn, si_app_id, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = coalesce(si_upn, si_app_id),
|            Impact = strcat(PermanentRoleCount, " always-on role(s) instead of PIM-eligible"),
|            PermanentRoleCount, EligibleRoleCount, MoreInfoUrl, Links,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_reference_url <- MoreInfoUrl, si_portal_link <- MoreInfoUrl, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedUser_NoConditionalAccess_Detailed
|      ReportPurpose: |-
|        Privileged users whose recent successful sign-ins did NOT trigger any
|        Conditional Access policy. Effectively bypasses CA enforcement.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedUser_NoConditionalAccess_Detailed
|        // Purpose  Users holding an Entra role whose successful sign-ins (30 days) had no Conditional Access policy applied.
|        // The sign-ins come from Entra's sign-in events in advanced hunting (EntraIdSignInEvents, interactive and
|        // non-interactive) -- SigninLogs is only in a workspace that receives Entra's diagnostic export, and where the
|        // install's workspace has none the report was silently empty (#690 (45)). A role holder is an account Defender for
|        // Identity lists with an Entra role (AssignedRoles, or a PIM role), or a CI with a permanent privileged role or tier
|        // 0 / 1. Tier, CMDB values and factors come from the CI (_ciLink), joined on the Entra object id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        let _roleHolders =
|            IdentityInfo
|            | where Timestamp > ago(14d)
|            | where isnotempty(AccountObjectId)
|            | summarize arg_max(Timestamp, *) by AccountObjectId
|            | where Type == "User"
|            | extend HasEntraRole = coalesce(array_length(AssignedRoles), 0) > 0 or coalesce(array_length(bag_keys(PrivilegedEntraPimRoles)), 0) > 0
|            | extend RoleHolderKey = tolower(AccountObjectId)
|            | where isnotempty(RoleHolderKey)
|            | project RoleHolderKey, HasEntraRole;
|        EntraIdSignInEvents
|        | where Timestamp > ago(30d)
|        | where ErrorCode == 0
|        | where ConditionalAccessStatus == 2
|        | extend UserKey = tolower(AccountObjectId)
|        | where isnotempty(UserKey)
|        | summarize SignInCount = count(), InteractiveSignInCount = countif(LogonType has "interactiveUser"), NonInteractiveSignInCount = countif(LogonType has "nonInteractiveUser"),
|                    SignInUpn = tolower(take_any(AccountUpn)), SignInDisplayName = take_any(AccountDisplayName) by UserKey
|        | join kind=leftouter _roleHolders on $left.UserKey == $right.RoleHolderKey
|        | extend DeviceKey = UserKey
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | where coalesce(si_in_scope_, true)
|        | where coalesce(HasEntraRole, false) or set_has_element(coalesce(si_rf_p, dynamic([])), "permanent_privileged_role") or toint(si_tier) in (0, 1)
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend IsExternalIdentity = (SignInUpn has "#ext#"), IsCmdbOrphan = isempty(si_cmdb_id)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = toint(iff(IsExternalIdentity, 1, 0)) + toint(iff(IsCmdbOrphan, 1, 0))
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(IsExternalIdentity, "IsExternalIdentity", ""), iff(IsCmdbOrphan, "IsCmdbOrphan", "")), ", ")
|        // the labels the report always showed (identity type, user type) -- a guest signs in with an #EXT# name
|        | extend Category = "User"
|        | extend Subcategory = iff(IsExternalIdentity, "Guest", "Member")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|                  AssetName = coalesce(si_asset_name, SignInDisplayName, SignInUpn, UserKey),
|                  AssetId = iif(isnotempty(si_ci_id), si_ci_id, UserKey),
|                  AssetType = "Identity",
|                  ConfigurationName = SignInDisplayName, ConfigurationId = SignInUpn,
|                  Impact = strcat(SignInCount, " sign-ins (30d) where no Conditional Access policy applied (", InteractiveSignInCount, " interactive, ", NonInteractiveSignInCount, " non-interactive)"), SignInCount, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_MailboxImpersonation_Detailed
|      ReportPurpose: |-
|        SPNs holding Mail.Read / Mail.Send / Mail.ReadWrite as APPLICATION
|        permission (impersonates ANY user mailbox tenant-wide). Common path
|        for phishing-as-a-service compromise.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_mail_access_permissions = dynamic(["Mail.Read", "Mail.ReadWrite", "Mail.Send", "Mail.ReadBasic", "Mail.ReadBasic.All", "Mail-Advanced.ReadWrite.All", "MailboxSettings.ReadWrite", "MailboxItem.Read.All", "MailboxItem.ImportExport.All", "MailboxFolder.Read.All", "MailboxFolder.ReadWrite.All", "Mailbox.Migration", "full_access_as_app", "EWS.AccessAsApp", "EWS.AccessAsUser.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_MailboxImpersonation_Detailed
|        // Purpose  Service principals granted application-scope mailbox permissions (impersonate any mailbox), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        // service principals AND managed identities (a managed identity granted mail permissions impersonates the same)
|        | where si_identity_type in ("service_principal", "managed_identity")
|        // every mail / mailbox application permission (data-model list mail_access_permissions), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MailScopes = set_intersect(_permsD, SI_List_mail_access_permissions)
|        | extend MailScopes = iff(array_length(MailScopes) > 0, MailScopes, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_mail_access_permissions)))))
|        | where array_length(MailScopes) > 0
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = si_app_id,
|            Impact = strcat("Granted ", array_length(MailScopes), " mailbox-impersonation permission(s) - ", strcat_array(MailScopes, ", ")), MailScopes,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_OwnerMismatch_Detailed
|      ReportPurpose: SPNs whose Owner is different from the Application Owner -- common in apps inherited from a departed employee where ownership got cleaned up only on one side.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_OwnerMismatch_Detailed
|        // Purpose  Enabled service principals whose owner differs from the app registration owner, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        // only an application registered in THIS tenant has a second owner list here (another organisation's application has none) -- an unknown owning tenant stays in
|        | where coalesce(si_is_third_party_multitenant, false) == false
|        // each owner with where they own (si_owners.of) -- service principal only, application registration only, or both
|        | extend _owners = coalesce(todynamic(tostring(si_owners)), dynamic([]))
|        | mv-apply _ow = _owners to typeof(dynamic) on (summarize
|              SpOnlyOwners  = make_set_if(coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), tostring(_ow["of"]) == "service principal"),
|              AppOnlyOwners = make_set_if(coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), tostring(_ow["of"]) == "application"),
|              BothOwners    = make_set_if(coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), tostring(_ow["of"]) == "both"))
|        // the purpose -- one side has owners the other does not (one side cleaned up, or different people)
|        | where array_length(SpOnlyOwners) > 0 or array_length(AppOnlyOwners) > 0
|        | extend SpnOwner = strcat_array(array_concat(SpOnlyOwners, BothOwners), "; ")
|        | extend AppOwner = strcat_array(array_concat(AppOnlyOwners, BothOwners), "; ")
|        | extend MoreInfoUrl = strcat("https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/~/Owners/appId/", si_app_id)
|        | extend Links = dynamic_to_json(pack_array(
|            pack("label", "App registration owners", "url", MoreInfoUrl),
|            pack("label", "Enterprise app owners", "url", strcat("https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Owners/objectId/", coalesce(si_link_entra, si_app_id)))))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = si_app_id,
|            Impact = case(
|                array_length(AppOnlyOwners) == 0 and array_length(BothOwners) == 0, strcat("Owners on the enterprise application only (", strcat_array(SpOnlyOwners, "; "), ") -- the application registration lists none of them, or its owners could not be read"),
|                array_length(SpOnlyOwners) == 0 and array_length(BothOwners) == 0, strcat("Owners on the application registration only (", strcat_array(AppOnlyOwners, "; "), ") -- the enterprise application lists none of them"),
|                strcat("Owners differ -- enterprise application only ", iff(array_length(SpOnlyOwners) == 0, "none", strcat_array(SpOnlyOwners, "; ")), " / application registration only ", iff(array_length(AppOnlyOwners) == 0, "none", strcat_array(AppOnlyOwners, "; ")))),
|            SpnOwner, AppOwner, MoreInfoUrl, Links,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_reference_url <- MoreInfoUrl, si_portal_link <- MoreInfoUrl, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_OwnsResourcePublicAccess_Detailed
|      ReportPurpose: |-
|        Service principals and managed identities that hold an Azure role on a
|        publicly exposed resource -- any role assigned on the resource itself,
|        or Owner / Contributor / access administration inherited from its
|        resource group or subscription. One row per identity and resource.
|        Each row says whether the identity is inactive (90+ days) or holds a
|        high-risk permission grant (the "hot" identities with maximum blast
|        radius if compromised); a view filters on it, the report keeps all.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_OwnsResourcePublicAccess_Detailed
|        // Purpose  Service principals and managed identities holding an Azure role (direct, or Owner / Contributor inherited) on a publicly exposed resource.
|        // Both sides come from the CI (SI_CI_CL, REQUIREMENTS #505) -- the service principal (identity) and the resource
|        // (cloud_resource, internet_exposed factor) -- joined on the Azure resource id (role scope == si_link_azure).
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity", "cloud_resource")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        let _publicResources =
|            _ciAsset
|            | where si_class == "cloud_resource"
|            | where set_has_element(si_rf_p, "internet_exposed")
|            | extend LinkedAzureResourceId = tolower(si_link_azure)
|            // an empty id must never be a join key
|            | where isnotempty(LinkedAzureResourceId)
|            | project LinkedAzureResourceId, ResourceType = si_asset_type, ResourceCiId = si_ci_id, ResourceName = si_asset_name;
|        // #690 (3): every scope a role on the resource can be assigned at -- the resource itself, a parent resource, its
|        // resource group, its subscription -- so a role INHERITED from the resource group or subscription counts
|        let _publicResourceScopes =
|            _publicResources
|            | extend _idParts = split(LinkedAzureResourceId, "/")
|            | mv-expand _n = range(2, array_length(_idParts) - 1, 1) to typeof(int)
|            | extend _roleScope = strcat_array(array_slice(_idParts, 0, _n), "/")
|            // an empty scope must never be a join key
|            | where isnotempty(_roleScope)
|            | extend IsDirectRole = (_roleScope == LinkedAzureResourceId)
|            | project _roleScope, IsDirectRole, LinkedAzureResourceId, ResourceType, ResourceCiId, ResourceName;
|        _ciAsset
|        | where si_class == "identity"
|        // service principals AND managed identities (a managed identity is a service principal in Entra)
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend DaysInactive = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), datetime_diff('day', now(), si_last_sign_in))
|        | mv-expand _role = si_azure_role_assignments
|        // the role's scope property is `Scope` (case-sensitive)
|        | extend _scope = tolower(tostring(_role.Scope))
|        | extend RoleName = coalesce(tostring(_role.RoleDefinitionName), tostring(_role.roleDefinitionName), tostring(_role.roleName), tostring(_role.role), tostring(_role.name))
|        // an empty scope must never join an empty resource id
|        | where isnotempty(_scope)
|        | join kind=inner _publicResourceScopes on $left._scope == $right._roleScope
|        // a role directly on the resource counts whatever it is (as before); one inherited from a parent scope counts when
|        // it can change the resource (Owner / Contributor / access administration) or its name is not known
|        | where IsDirectRole or isempty(RoleName) or RoleName in~ ("Owner", "Contributor", "User Access Administrator", "Role Based Access Control Administrator") or RoleName endswith "Contributor"
|        | extend _roleRank = case(RoleName =~ "Owner", 4, RoleName in~ ("User Access Administrator", "Role Based Access Control Administrator"), 3, RoleName endswith "Contributor", 2, 1)
|        | extend _roleText = strcat(iff(isempty(RoleName), "an Azure role (name not collected)", RoleName), iff(IsDirectRole, " on the resource", strcat(" inherited from ", _scope)))
|        // one finding per service principal x resource (several roles on one resource are one finding, every role named)
|        | summarize RoleAssignments = strcat_array(array_sort_asc(make_set(_roleText)), "; "), arg_max(_roleRank, *) by si_ci_id, LinkedAzureResourceId
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend IsStaleAsset = (si_stale_ == true), IsCmdbOrphan = isempty(si_cmdb_id)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = toint(iff(IsStaleAsset, 1, 0)) + toint(iff(IsCmdbOrphan, 1, 0))
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(IsStaleAsset, "IsStaleAsset", ""), iff(IsCmdbOrphan, "IsCmdbOrphan", "")), ", ")
|        | extend Category = ""
|        | extend Subcategory = ""
|        | extend IsHighRiskPermissionGrant = si_high_risk_permission_grant
|        // #690 (3) owner 2026-10-15 ("narrowing belongs in views"): the "inactive or privileged" condition no longer drops a
|        // row -- every row says which of it holds, so a view can filter on it
|        | extend _condition = case(
|            DaysInactive >= 90 and si_high_risk_permission_grant == true, strcat("inactive ", tostring(DaysInactive), " days and holds a high-risk permission grant"),
|            DaysInactive >= 90, strcat("inactive ", tostring(DaysInactive), " days"),
|            si_high_risk_permission_grant == true, "holds a high-risk permission grant",
|            isnull(DaysInactive), "sign-in activity not collected; no high-risk permission grant known",
|            strcat("active (last sign-in ", tostring(DaysInactive), " days ago), no high-risk permission grant"))
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|                  AssetId = si_ci_id,
|                  AssetType = coalesce(si_asset_type, "Identity"),
|                  AssetName = coalesce(si_asset_name, si_display_name, si_ci_id),
|                  ConfigurationName = si_display_name, ConfigurationId = si_app_id,
|                  Impact = strcat(iff(si_identity_type == "managed_identity", "Managed identity", "Service principal"), " holds ", RoleAssignments, " -- publicly exposed resource ", coalesce(ResourceName, LinkedAzureResourceId), " (", ResourceType, "); ", _condition),
|                  DaysInactive, IsHighRiskPermissionGrant, LinkedAzureResourceId, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_AdNestedCriticalGroup_NoEntraRole_Detailed
|      ReportPurpose: |-
|        Users in an AD nested critical group (Domain Admins / Schema Admins /
|        Enterprise Admins via nesting) but holding NO Entra role. Indicates
|        AD-side privilege that isn't visible in Entra-only audits.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_AdNestedCriticalGroup_NoEntraRole_Detailed
|        // Purpose  Enabled users in a critical on-premises AD group but with no Entra role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where array_length(si_ad_critical_groups) > 0
|        | where coalesce(array_length(si_entra_roles_permanent), 0) == 0
|        | where coalesce(array_length(si_entra_roles_eligible), 0) == 0
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = si_upn,
|            Impact = "User has on-prem AD critical-group membership but no Entra role -- privilege is invisible to Entra-only audits",
|            AdNestedCriticalGroups = si_ad_critical_groups,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_HighRiskFactorComposite4Plus_Detailed
|      ReportPurpose: Identities with 4+ risk factors flagged. Above the I16 threshold (3+) -- these are the worst offenders.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_HighRiskFactorComposite4Plus_Detailed
|        // Purpose  Identities carrying 4 or more of the CI's asset risk factors at once (tier factors not counted), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        // the CI's production asset risk factors, without the tier ones (the tier is already the probability base)
|        | extend RiskFactorCount = array_length(array_concat(si_rf_p, si_rf_c))
|        | where RiskFactorCount >= 4
|        | extend MoreInfoUrl = iff(si_identity_type == "service_principal",
|            strcat("https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/~/Overview/appId/", si_app_id),
|            strcat("https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/", coalesce(si_link_entra, si_upn)))
|        | extend Links = dynamic_to_json(pack_array(pack("label", "Identity portal", "url", MoreInfoUrl)))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory = strcat(RiskFactorCount, " concurrent risk factors"),
|            AssetName = coalesce(si_display_name, si_upn, si_app_id, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = coalesce(si_upn, si_app_id),
|            Impact = strcat("Identity hits ", RiskFactorCount, " risk-factor flags simultaneously"), RiskFactorCount, MoreInfoUrl, Links,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_reference_url <- MoreInfoUrl, si_portal_link <- MoreInfoUrl, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|
|    - ReportName: Identity_Departed_AccountStillEnabled_Summary
|      ReportPurpose: >-
|        Users whose EmployeeLeaveDateTime is in the past but the account is still enabled. HR off-boarding gap; common attack path. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Departed_AccountStillEnabled_Summary
|        // Purpose  Departed users (leave date passed) whose account is still enabled, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_account_enabled == true
|        | where isnotnull(si_leave_date) and si_leave_date < now()
|        | extend DaysSinceLeave = datetime_diff('day', now(), si_leave_date)
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Departed user account still enabled"
|        | extend ConfigurationId   = "IDENTITY-OFFBOARD-001"
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_DisabledPrivilegedUser_Summary
|      ReportPurpose: >-
|        Identities flagged DisabledPrivilegedUser by the engine -- account disabled but still carries privileged role assignment. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_DisabledPrivilegedUser_Summary
|        // Purpose  Disabled accounts that still hold a privileged (tier 0/1) Entra role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_account_enabled == false
|        | extend DisabledPrivilegedUser = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where DisabledPrivilegedUser == true
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Disabled privileged user retains role"
|        | extend ConfigurationId   = "IDENTITY-PRIVRETAIN-001"
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_DisabledUser_StillInCriticalGroup_Summary
|      ReportPurpose: >-
|        Disabled users still in critical AD nested groups OR with active Entra roles. Cleanup gap; account re-enable would resurrect privilege. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_DisabledUser_StillInCriticalGroup_Summary
|        // Purpose  Disabled accounts still in a critical AD group or holding an Entra role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_account_enabled == false
|        | where array_length(si_ad_critical_groups) > 0
|            or array_length(si_entra_roles_permanent) > 0
|            or array_length(si_entra_roles_eligible) > 0
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Disabled user still in critical group / role"
|        | extend ConfigurationId   = "IDENTITY-DISABLED-CRITGROUP-001"
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_GuestWithPrivilegedRole_Summary
|      ReportPurpose: >-
|        B2B Guest users (UserType=Guest) holding ANY Entra role -- guests should never have privileged roles. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_GuestWithPrivilegedRole_Summary
|        // Purpose  External (guest) identities holding an Entra role assignment, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_is_external == true
|        | where array_length(si_entra_roles_permanent) > 0 or array_length(si_entra_roles_eligible) > 0
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Guest user holds Entra role"
|        | extend ConfigurationId   = "IDENTITY-GUEST-PRIVROLE-001"
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedRole_PermanentNotEligible_Summary
|      ReportPurpose: >-
|        Users / SPNs holding PERMANENT (always-on) privileged role assignments instead of PIM-eligible. Standing privilege violates JIT/JEA. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_microsoft_first_party_tenants = dynamic(["f8cdef31-a31e-4b4a-93e4-5f571e91255a", "72f988bf-86f1-41af-91ab-2d7cd011db47"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedRole_PermanentNotEligible_Summary
|        // Purpose  Enabled identities with always-on (permanent) Entra roles instead of PIM-eligible, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        // a list of ONE role can reach the CI as the bare role name (text, not a list) -- counted as one role, never dropped
|        | extend _rolesPermanent = iff(gettype(si_entra_roles_permanent) == "array", si_entra_roles_permanent, iff(isempty(tostring(si_entra_roles_permanent)), dynamic([]), pack_array(tostring(si_entra_roles_permanent))))
|        | extend _rolesEligible  = iff(gettype(si_entra_roles_eligible) == "array", si_entra_roles_eligible, iff(isempty(tostring(si_entra_roles_eligible)), dynamic([]), pack_array(tostring(si_entra_roles_eligible))))
|        | extend PermanentRoleCount = array_length(_rolesPermanent)
|        | extend EligibleRoleCount  = array_length(_rolesEligible)
|        | where PermanentRoleCount > 0
|        // owner 2026-10-15 (#690 (50)) -- Microsoft's own first-party service principals (an application Microsoft owns,
|        // the data-model list microsoft_first_party_tenants) are left out -- a service principal cannot be made eligible in PIM,
|        // and the role is one Microsoft gave its own application
|        | where not(tolower(si_app_owner_org_id) in (SI_List_microsoft_first_party_tenants))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Permanent privileged role instead of PIM-eligible"
|        | extend ConfigurationId   = "IDENTITY-PIM-PERMANENT-001"
|        | extend AssetName = coalesce(si_display_name, si_upn, si_app_id, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedUser_NoConditionalAccess_Summary
|      ReportPurpose: >-
|        Privileged users whose recent successful sign-ins did NOT trigger any Conditional Access policy. Effectively bypasses CA enforcement. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedUser_NoConditionalAccess_Summary
|        // Purpose  Users holding an Entra role whose successful sign-ins (30 days) had no Conditional Access policy applied.
|        // The sign-ins come from Entra's sign-in events in advanced hunting (EntraIdSignInEvents, interactive and
|        // non-interactive) -- SigninLogs is only in a workspace that receives Entra's diagnostic export, and where the
|        // install's workspace has none the report was silently empty (#690 (45)). A role holder is an account Defender for
|        // Identity lists with an Entra role (AssignedRoles, or a PIM role), or a CI with a permanent privileged role or tier
|        // 0 / 1. Tier, CMDB values and factors come from the CI (_ciLink), joined on the Entra object id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        let _roleHolders =
|            IdentityInfo
|            | where Timestamp > ago(14d)
|            | where isnotempty(AccountObjectId)
|            | summarize arg_max(Timestamp, *) by AccountObjectId
|            | where Type == "User"
|            | extend HasEntraRole = coalesce(array_length(AssignedRoles), 0) > 0 or coalesce(array_length(bag_keys(PrivilegedEntraPimRoles)), 0) > 0
|            | extend RoleHolderKey = tolower(AccountObjectId)
|            | where isnotempty(RoleHolderKey)
|            | project RoleHolderKey, HasEntraRole;
|        EntraIdSignInEvents
|        | where Timestamp > ago(30d)
|        | where ErrorCode == 0
|        | where ConditionalAccessStatus == 2
|        | extend UserKey = tolower(AccountObjectId)
|        | where isnotempty(UserKey)
|        | summarize SignInCount = count(), InteractiveSignInCount = countif(LogonType has "interactiveUser"), NonInteractiveSignInCount = countif(LogonType has "nonInteractiveUser"),
|                    SignInUpn = tolower(take_any(AccountUpn)), SignInDisplayName = take_any(AccountDisplayName) by UserKey
|        | join kind=leftouter _roleHolders on $left.UserKey == $right.RoleHolderKey
|        | extend DeviceKey = UserKey
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | where coalesce(si_in_scope_, true)
|        | where coalesce(HasEntraRole, false) or set_has_element(coalesce(si_rf_p, dynamic([])), "permanent_privileged_role") or toint(si_tier) in (0, 1)
|        | extend Impact = real(null)
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend IsExternalIdentity = (SignInUpn has "#ext#"), IsCmdbOrphan = isempty(si_cmdb_id)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = toint(iff(IsExternalIdentity, 1, 0)) + toint(iff(IsCmdbOrphan, 1, 0))
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(IsExternalIdentity, "IsExternalIdentity", ""), iff(IsCmdbOrphan, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(toint(iff(IsExternalIdentity, 1, 0))), ";IsCmdbOrphan=", tostring(toint(iff(IsCmdbOrphan, 1, 0))))
|        // the labels the report always showed (identity type, user type) -- a guest signs in with an #EXT# name
|        | extend Category = "User"
|        | extend Subcategory = iff(IsExternalIdentity, "Guest", "Member")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Privileged user sign-ins bypassing Conditional Access"
|        | extend ConfigurationId   = "IDENTITY-CA-BYPASS-001"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | extend AssetId = iif(isnotempty(si_ci_id), si_ci_id, UserKey)
|        | extend AssetName = coalesce(si_asset_name, SignInDisplayName, SignInUpn, AssetId)
|        | summarize
|            AssetCount             = dcount(AssetId),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", AssetId)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(UserKey),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(AssetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_MailboxImpersonation_Summary
|      ReportPurpose: >-
|        SPNs holding Mail.Read / Mail.Send / Mail.ReadWrite as APPLICATION permission (impersonates ANY user mailbox tenant-wide). Common path for phishing-as-a-service compromise. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_mail_access_permissions = dynamic(["Mail.Read", "Mail.ReadWrite", "Mail.Send", "Mail.ReadBasic", "Mail.ReadBasic.All", "Mail-Advanced.ReadWrite.All", "MailboxSettings.ReadWrite", "MailboxItem.Read.All", "MailboxItem.ImportExport.All", "MailboxFolder.Read.All", "MailboxFolder.ReadWrite.All", "Mailbox.Migration", "full_access_as_app", "EWS.AccessAsApp", "EWS.AccessAsUser.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_MailboxImpersonation_Summary
|        // Purpose  Service principals granted application-scope mailbox permissions (impersonate any mailbox), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        // service principals AND managed identities (a managed identity granted mail permissions impersonates the same)
|        | where si_identity_type in ("service_principal", "managed_identity")
|        // every mail / mailbox application permission (data-model list mail_access_permissions), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MailScopes = set_intersect(_permsD, SI_List_mail_access_permissions)
|        | extend MailScopes = iff(array_length(MailScopes) > 0, MailScopes, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_mail_access_permissions)))))
|        | where array_length(MailScopes) > 0
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "SPN granted application-scope mailbox impersonation"
|        | extend ConfigurationId   = "IDENTITY-SPN-MAILBOX-IMPERSONATION-001"
|        | extend AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_OwnerMismatch_Summary
|      ReportPurpose: >-
|        SPNs whose Owner is different from the Application Owner -- common in apps inherited from a departed employee where ownership got cleaned up only on one side. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_OwnerMismatch_Summary
|        // Purpose  Enabled service principals whose owner differs from the app registration owner, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        // only an application registered in THIS tenant has a second owner list here (another organisation's application has none) -- an unknown owning tenant stays in
|        | where coalesce(si_is_third_party_multitenant, false) == false
|        // each owner with where they own (si_owners.of) -- service principal only, application registration only, or both
|        | extend _owners = coalesce(todynamic(tostring(si_owners)), dynamic([]))
|        | mv-apply _ow = _owners to typeof(dynamic) on (summarize
|              SpOnlyOwners  = make_set_if(coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), tostring(_ow["of"]) == "service principal"),
|              AppOnlyOwners = make_set_if(coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), tostring(_ow["of"]) == "application"),
|              BothOwners    = make_set_if(coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), tostring(_ow["of"]) == "both"))
|        // the purpose -- one side has owners the other does not (one side cleaned up, or different people)
|        | where array_length(SpOnlyOwners) > 0 or array_length(AppOnlyOwners) > 0
|        | extend SpnOwner = strcat_array(array_concat(SpOnlyOwners, BothOwners), "; ")
|        | extend AppOwner = strcat_array(array_concat(AppOnlyOwners, BothOwners), "; ")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "SPN owner mismatched with App owner"
|        | extend ConfigurationId   = "IDENTITY-SPN-OWNER-MISMATCH-001"
|        | extend AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_OwnsResourcePublicAccess_Summary
|      ReportPurpose: >-
|        Service principals and managed identities that hold an Azure role on a publicly exposed resource -- any role on the resource itself, or Owner / Contributor / access administration inherited from its resource group or subscription (one finding per identity and resource; whether the identity is inactive or holds a high-risk permission grant is shown on the Detailed rows, never filtered). Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_OwnsResourcePublicAccess_Summary
|        // Purpose  Service principals and managed identities holding an Azure role (direct, or Owner / Contributor inherited) on a publicly exposed resource.
|        // Both sides come from the CI (SI_CI_CL, REQUIREMENTS #505) -- the service principal (identity) and the resource
|        // (cloud_resource, internet_exposed factor) -- joined on the Azure resource id (role scope == si_link_azure).
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity", "cloud_resource")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        let _publicResources =
|            _ciAsset
|            | where si_class == "cloud_resource"
|            | where set_has_element(si_rf_p, "internet_exposed")
|            | extend LinkedAzureResourceId = tolower(si_link_azure)
|            // an empty id must never be a join key
|            | where isnotempty(LinkedAzureResourceId)
|            | project LinkedAzureResourceId, ResourceType = si_asset_type, ResourceCiId = si_ci_id;
|        // #690 (3): every scope a role on the resource can be assigned at (resource, parent, resource group, subscription)
|        let _publicResourceScopes =
|            _publicResources
|            | extend _idParts = split(LinkedAzureResourceId, "/")
|            | mv-expand _n = range(2, array_length(_idParts) - 1, 1) to typeof(int)
|            | extend _roleScope = strcat_array(array_slice(_idParts, 0, _n), "/")
|            // an empty scope must never be a join key
|            | where isnotempty(_roleScope)
|            | extend IsDirectRole = (_roleScope == LinkedAzureResourceId)
|            | project _roleScope, IsDirectRole, LinkedAzureResourceId, ResourceType, ResourceCiId;
|        _ciAsset
|        | where si_class == "identity"
|        // service principals AND managed identities (a managed identity is a service principal in Entra)
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend DaysInactive = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), datetime_diff('day', now(), si_last_sign_in))
|        | mv-expand _role = si_azure_role_assignments
|        // the role's scope property is `Scope` (case-sensitive)
|        | extend _scope = tolower(tostring(_role.Scope))
|        | extend RoleName = coalesce(tostring(_role.RoleDefinitionName), tostring(_role.roleDefinitionName), tostring(_role.roleName), tostring(_role.role), tostring(_role.name))
|        // an empty scope must never join an empty resource id
|        | where isnotempty(_scope)
|        | join kind=inner _publicResourceScopes on $left._scope == $right._roleScope
|        // as the Detailed report: a direct role counts whatever it is; an inherited one when it can change the resource
|        | where IsDirectRole or isempty(RoleName) or RoleName in~ ("Owner", "Contributor", "User Access Administrator", "Role Based Access Control Administrator") or RoleName endswith "Contributor"
|        // one finding per service principal x resource (as the Detailed report)
|        | extend _direct = toint(IsDirectRole)
|        | summarize arg_max(_direct, *) by si_ci_id, LinkedAzureResourceId
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend IsStaleAsset = (si_stale_ == true), IsCmdbOrphan = isempty(si_cmdb_id)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = toint(iff(IsStaleAsset, 1, 0)) + toint(iff(IsCmdbOrphan, 1, 0))
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(IsStaleAsset, "IsStaleAsset", ""), iff(IsCmdbOrphan, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsStaleAsset=", tostring(toint(iff(IsStaleAsset, 1, 0))), ";IsCmdbOrphan=", tostring(toint(iff(IsCmdbOrphan, 1, 0))))
|        | extend Category = ""
|        | extend Subcategory = ""
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Service principal or managed identity holds an Azure role on a publicly exposed resource"
|        | extend ConfigurationId   = "IDENTITY-SPN-PUBLICRES-001"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | extend AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id)
|        | summarize
|            AssetCount             = dcount(DeviceKey),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring("")),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(LinkedAzureResourceId)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_AdNestedCriticalGroup_NoEntraRole_Summary
|      ReportPurpose: >-
|        Users in an AD nested critical group (Domain Admins / Schema Admins / Enterprise Admins via nesting) but holding NO Entra role. Indicates AD-side privilege that isn't visible in Entra-only audits. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_AdNestedCriticalGroup_NoEntraRole_Summary
|        // Purpose  Enabled users in a critical on-premises AD group but with no Entra role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where array_length(si_ad_critical_groups) > 0
|        | where coalesce(array_length(si_entra_roles_permanent), 0) == 0
|        | where coalesce(array_length(si_entra_roles_eligible), 0) == 0
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "AD nested critical group membership without Entra role"
|        | extend ConfigurationId   = "IDENTITY-AD-NESTED-NOENTRA-001"
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_HighRiskFactorComposite4Plus_Summary
|      ReportPurpose: >-
|        Identities with 4+ risk factors flagged. Above the I16 threshold (3+) -- these are the worst offenders. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_HighRiskFactorComposite4Plus_Summary
|        // Purpose  Identities carrying 4 or more of the CI's asset risk factors at once (tier factors not counted), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        // the CI's production asset risk factors, without the tier ones (the tier is already the probability base)
|        | extend RiskFactorCount = array_length(array_concat(si_rf_p, si_rf_c))
|        | where RiskFactorCount >= 4
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Identity with 4+ concurrent risk factors"
|        | extend ConfigurationId   = "IDENTITY-COMPOSITE-RISK-4PLUS-001"
|        | extend AssetName = coalesce(si_display_name, si_upn, si_app_id, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Endpoint_ExcludedAssets_Detailed
|      ReportPurpose: Every endpoint currently suppressed from Risk Analysis by an operator exclusion tag, and the exact tag that
|        did it. This is the INVERSE of every other report -- it deliberately does not filter excluded assets out, because they are
|        the subject. Exclusion was previously invisible - a tagged asset simply vanished from every report with nothing recording
|        that it had been dropped or why, which an operator cannot tell apart from collection having broken. Severity follows the
|        asset's own criticality tier, so a suppressed Tier 0 asset surfaces at the top - suppressing a critical asset is the
|        governance risk worth reviewing, and a stale exclusion tag never expires on its own.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      SecuritySeverityInputName: SecuritySeverity
|      RiskScoreOutputName: RiskScoreTotal
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      SortBy:
|      - RiskScoreTotal_Weighted
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - ExcludedReason
|      - AssetTags
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - LastSeen
|      - MoreDetails
|      - AssetDetectedInReportName
|      ReportQuery: |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Endpoint_ExcludedAssets_Detailed
|        // Purpose  What is being suppressed, and by which tag. One row per excluded asset.
|        //
|        // THIS REPORT DELIBERATELY KEEPS THE ASSETS every other endpoint report drops. Excluded assets
|        // are the subject here -- an asset is excluded when one of the CI's tags matches SI_ExcludedAssetTags,
|        // and ExcludedReason is the matching tag text.
|        //
|        // #505 -- the asset is the CI (SI_CI_CL), class device. Log Analytics only.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_stale_)
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where array_length(SI_ExcludedAssetTags) > 0
|        | where coalesce(si_tags_, "") has_any (SI_ExcludedAssetTags)
|        | mv-apply _xt = si_tags to typeof(string) on (
|            where tolower(_xt) has_any (SI_ExcludedAssetTags)
|            | summarize _xTags = make_set(_xt)
|          )
|        | extend ExcludedReason = strcat_array(array_sort_asc(_xTags), "; ")
|        | extend CriticalityTier      = toint(si_tier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        // Severity tracks the asset's own tier. Suppressing a Tier 0 asset is the finding.
|        | extend SecuritySeverity     = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", CriticalityTier == 2, "Medium", "Low")
|        | extend SecurityDomain    = "Endpoint"
|        | extend Category          = "Governance"
|        | extend Subcategory       = "Suppressed Assets"
|        | extend ConfigurationName = "Asset is excluded from Risk Analysis by an operator tag"
|        | extend ConfigurationId   = "ENDPOINT-EXCLUDED-BY-TAG-001"
|        | extend AssetName         = coalesce(si_asset_name, si_hostname, si_ci_id)
|        | extend AssetId           = si_ci_id
|        | extend AssetType         = "Endpoint"
|        | extend AssetTags         = strcat_array(si_tags, ";")
|        | extend LastSeen          = tostring(si_last_seen_)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | extend Impact            = strcat("Suppressed from every Risk Analysis report. Tier ", tostring(CriticalityTier), ".")
|        | extend MoreDetails       = strcat("Excluded by -> ", ExcludedReason, " | All tags ", AssetTags)
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName, AssetId, AssetType, ExcludedReason, AssetTags, Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, LastSeen, MoreDetails,
|                  MdeDeviceId = si_link_mde, EntraAccountObjectId = si_link_entra, AzureResourceId = si_link_azure
|        | order by CriticalityTier asc, AssetName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out ExcludedReason, AssetTags, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence
|        // out RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted
|        // out RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, LastSeen, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Endpoint_ExcludedAssets_Summary
|      ReportPurpose: How many endpoints are currently suppressed from Risk Analysis by an operator exclusion tag, grouped by
|        criticality tier, with the assets and the exact tags listed. The Summary answers "how much of the estate am I not
|        looking at, and is any of it critical"; the Detailed pair lists it asset by asset. Exclusion was previously invisible -
|        a tagged asset simply vanished from every report with nothing recording that it had been dropped or why. Severity
|        follows the asset's own tier, so suppressed Tier 0 assets sort to the top - exclusion tags never expire, and a critical
|        asset suppressed by a tag added months ago is a governance gap rather than a preference.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      SecuritySeverityInputName: SecuritySeverity
|      RiskScoreOutputName: RiskScoreTotal
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      SortBy:
|      - RiskScoreTotal_Weighted
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - ExcludedReasons
|      - MoreDetails
|      - AssetDetectedInReportName
|      ReportQuery: |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Endpoint_ExcludedAssets_Summary
|        // Purpose  How much of the estate is suppressed, per tier -- and by which tags.
|        //
|        // THIS REPORT DELIBERATELY KEEPS THE ASSETS every other endpoint report drops. Excluded assets
|        // are the subject here -- an asset is excluded when one of the CI's tags matches SI_ExcludedAssetTags,
|        // and ExcludedReason is the matching tag text.
|        //
|        // #505 -- the asset is the CI (SI_CI_CL), class device. Log Analytics only.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_stale_)
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where array_length(SI_ExcludedAssetTags) > 0
|        | where coalesce(si_tags_, "") has_any (SI_ExcludedAssetTags)
|        | mv-apply _xt = si_tags to typeof(string) on (
|            where tolower(_xt) has_any (SI_ExcludedAssetTags)
|            | summarize _xTags = make_set(_xt)
|          )
|        | extend ExcludedReason = strcat_array(array_sort_asc(_xTags), "; ")
|        | extend CriticalityTier      = toint(si_tier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", CriticalityTier == 2, "Medium", "Low")
|        | extend SecurityDomain    = "Endpoint"
|        | extend Category          = "Governance"
|        | extend Subcategory       = "Suppressed Assets"
|        | extend ConfigurationName = "Assets excluded from Risk Analysis by an operator tag"
|        | extend ConfigurationId   = "ENDPOINT-EXCLUDED-BY-TAG-001"
|        | extend AssetName         = coalesce(si_asset_name, si_hostname, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // audit #25 -- ImpactedAssetCount is DERIVED from ImpactedAssetsList (a bare make_set), and
|        // ImpactedAssetPairs pairs name and id in one token the engine splits on the LAST '|'.
|        | summarize
|            ImpactedAssetsList   = make_set(AssetName),
|            ImpactedAssetPairs   = make_set(strcat(AssetName, "|", si_ci_id)),
|            ExcludedReasons      = strcat_array(array_sort_asc(make_set(ExcludedReason)), " | "),
|            MdeDeviceId          = min(tostring(si_link_mde)),
|            EntraAccountObjectId = min(tostring(si_link_entra)),
|            AzureResourceId      = min(tostring(si_link_azure)),
|            AssetId              = min(si_ci_id)
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|             cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | extend ImpactedAssetsList = array_sort_asc(ImpactedAssetsList)
|        | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|        | extend Impact      = strcat(tostring(ImpactedAssetCount), " asset(s) at tier ", tostring(CriticalityTier), " are suppressed from every Risk Analysis report.")
|        | extend MoreDetails = strcat("Excluded by -> ", ExcludedReasons)
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by CriticalityTier asc, ImpactedAssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, ExcludedReasons, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Endpoint_ConflictingTierTags_Detailed
|      ReportPurpose: Every endpoint whose operator tags assert TWO OR MORE different criticality tiers at once, with the exact
|        conflicting tags. Tier is computed as a MIN across all signals, so the most critical tag silently wins and nothing
|        breaks - which is precisely why this has never been visible. The estate can assert that one machine is both Tier 0 and
|        Tier 3 and no report says so. Measured on a live estate, 16 of 19 tagged endpoints carried contradictory tier tags,
|        including a privileged-access workstation tagged both PAWDevices tier 0 and EmployeeWorkstations tier 3, and a domain
|        controller whose certificate-services tag claimed tier 0 and tier 1 simultaneously. Severity follows the MOST critical
|        tier claimed, because a conflict involving a Tier 0 claim is the one where being wrong costs the most.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      SecuritySeverityInputName: SecuritySeverity
|      RiskScoreOutputName: RiskScoreTotal
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      SortBy:
|      - RiskScoreTotal_Weighted
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - ConflictingTags
|      - ClaimedTiers
|      - AssetTags
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - LastSeen
|      - MoreDetails
|      - AssetDetectedInReportName
|      ReportQuery: |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Endpoint_ConflictingTierTags_Detailed
|        // Purpose  Which machines are tagged with two different tiers at once, and with which tags.
|        //
|        // WHY THIS IS INVISIBLE WITHOUT A REPORT. Tier is a MIN across signals, so a machine tagged
|        // both tier0 and tier3 simply becomes tier0. Nothing errors, nothing is dropped, every number
|        // downstream looks right -- and the estate is quietly asserting two answers about one asset.
|        //
|        // #505 -- the asset is the CI (SI_CI_CL), class device; the tags are the CI's tags (si_tags_,
|        // lower-case, every source that tags the device). Log Analytics only.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_stale_) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where isnotempty(si_tags_)
|        | extend AssetName = coalesce(si_asset_name, si_hostname, si_ci_id)
|        | extend AssetId   = si_ci_id
|        // One row per tag of the si_tags ARRAY (each tag a {source, name, value} object, or a plain text), read as a
|        // dynamic array -- never the array's JSON text split on commas. The tier a tag claims is read from its name and
|        // value: tier0, Tier 0, tier-0, tier_0, Tier=0 (any case); only tiers 0-3 are tiers.
|        | mv-expand _t = si_tags to typeof(dynamic)
|        | extend _tagText = iff(gettype(_t) == "string", tostring(_t), strcat(tostring(_t.name), iff(isnotempty(tostring(_t.value)), strcat("=", tostring(_t.value)), "")))
|        | extend _tagSource = iff(gettype(_t) == "string", "", tostring(_t.source))
|        | extend _tag  = iff(isnotempty(_tagSource), strcat(_tagText, " (", _tagSource, ")"), _tagText)
|        | extend _tier = extract(@"(?i)tier[\s_\-:=]*([0-3])(?:[^0-9]|$)", 1, _tagText)
|        | summarize
|            _tiers   = make_set_if(_tier, isnotempty(_tier)),
|            _tags    = make_set_if(_tag, isnotempty(_tier)),
|            _allTags = make_set_if(_tag, isnotempty(_tagText)),
|            _tierCol = take_any(toint(si_tier)),
|            _lastSeen = any(tostring(si_last_seen_)),
|            cmdbId = min(tostring(si_cmdb_id)), cmdbName = min(tostring(si_cmdb_name)),
|            cmdbCriticality = any(si_cmdb_criticality), cmdbDataSensitivity = any(si_cmdb_data_sensitivity),
|            MdeDeviceId = min(tostring(si_link_mde)), EntraAccountObjectId = min(tostring(si_link_entra)), AzureResourceId = min(tostring(si_link_azure))
|          by AssetName, AssetId
|        | extend AssetTags = strcat_array(array_sort_asc(_allTags), "; ")
|        // the engine's tier when the CI has one -- a CI without a tier says not tiered (no tier rule matches), never 3
|        | extend _engineTier = iff(isnull(_tierCol), "not tiered (no tier rule matches)", tostring(_tierCol))
|        // THE WHOLE REPORT IS THIS LINE. One distinct tier is agreement; two or more is the finding.
|        | where array_length(_tiers) > 1
|        | extend ClaimedTiers    = strcat_array(array_sort_asc(_tiers), ", ")
|        | extend ConflictingTags = strcat_array(array_sort_asc(_tags), " | ")
|        | extend AssetType       = "Endpoint"
|        | extend LastSeen        = _lastSeen
|        // Severity follows the MOST critical tier CLAIMED, not the tier the engine settled on.
|        | extend CriticalityTier      = toint(array_sort_asc(_tiers)[0])
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", CriticalityTier == 2, "Medium", "Low")
|        | extend SecurityDomain    = "Endpoint"
|        | extend Category          = "Governance"
|        | extend Subcategory       = "Conflicting Tier Tags"
|        | extend ConfigurationName = "Asset carries operator tags asserting more than one criticality tier"
|        | extend ConfigurationId   = "ENDPOINT-CONFLICTING-TIER-TAGS-001"
|        | extend Impact            = iff(isnull(_tierCol), strcat("Tags claim tiers ", ClaimedTiers, ". The engine has no tier for this asset yet - no tier rule matches it."), strcat("Tags claim tiers ", ClaimedTiers, ". The engine resolved tier ", _engineTier, " by MIN, so the most critical claim wins silently."))
|        | extend MoreDetails       = strcat("Conflicting tags -> ", ConflictingTags, " | engine tier ", _engineTier, " | all tags ", AssetTags)
|        | extend DeviceKey = AssetId
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName, AssetId, AssetType, ConflictingTags, ClaimedTiers, AssetTags, Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, LastSeen, MoreDetails,
|                  MdeDeviceId, EntraAccountObjectId, AzureResourceId
|        | order by CriticalityTier asc, AssetName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out ConflictingTags, ClaimedTiers, AssetTags, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed
|        // out RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        // out RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, LastSeen, MoreDetails
|        // out AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Endpoint_ConflictingTierTags_Summary
|      ReportPurpose: How many endpoints carry operator tags that assert more than one criticality tier, grouped by the most
|        critical tier claimed, with the assets listed. The Summary answers "how much of my tagging disagrees with itself";
|        the Detailed pair names the tags per asset. Because tier is a MIN, a conflict never fails - the most critical tag
|        wins and the estate looks healthy, so the only way to see this is to ask. A cluster of assets sharing one conflicting
|        pair usually means a tagging rule was changed and the old tag was never removed, which is a single fix rather than
|        one per machine.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      SecuritySeverityInputName: SecuritySeverity
|      RiskScoreOutputName: RiskScoreTotal
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      SortBy:
|      - RiskScoreTotal_Weighted
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - ConflictingTagPairs
|      - MoreDetails
|      - AssetDetectedInReportName
|      ReportQuery: |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Endpoint_ConflictingTierTags_Summary
|        // Purpose  How much of the tagging disagrees with itself, per most-critical-tier-claimed.
|        //
|        // Tier is a MIN, so a conflict never fails and the estate looks healthy. The only way to see
|        // it is to ask, which is what this report is.
|        //
|        // #505 -- the asset is the CI (SI_CI_CL), class device; the tags are the CI's tags (si_tags_,
|        // lower-case, every source that tags the device). Log Analytics only.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_stale_) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where isnotempty(si_tags_)
|        | extend AssetName = coalesce(si_asset_name, si_hostname, si_ci_id)
|        | extend AssetId   = si_ci_id
|        // one row per tag of the si_tags ARRAY (as the Detailed report): tier0 / Tier 0 / tier-0 / tier_0 / Tier=0, tiers 0-3
|        | mv-expand _t = si_tags to typeof(dynamic)
|        | extend _tagText = iff(gettype(_t) == "string", tostring(_t), strcat(tostring(_t.name), iff(isnotempty(tostring(_t.value)), strcat("=", tostring(_t.value)), "")))
|        | extend _tagSource = iff(gettype(_t) == "string", "", tostring(_t.source))
|        | extend _tag  = iff(isnotempty(_tagSource), strcat(_tagText, " (", _tagSource, ")"), _tagText)
|        | extend _tier = extract(@"(?i)tier[\s_\-:=]*([0-3])(?:[^0-9]|$)", 1, _tagText)
|        | where isnotempty(_tier)
|        | summarize _tiers = make_set(_tier), _tags = make_set(_tag),
|                    cmdbId = min(tostring(si_cmdb_id)), cmdbName = min(tostring(si_cmdb_name)),
|                    cmdbCriticality = any(si_cmdb_criticality), cmdbDataSensitivity = any(si_cmdb_data_sensitivity),
|                    MdeDeviceId = min(tostring(si_link_mde)), EntraAccountObjectId = min(tostring(si_link_entra)), AzureResourceId = min(tostring(si_link_azure))
|          by AssetName, AssetId
|        | where array_length(_tiers) > 1
|        | extend _pair                = strcat_array(array_sort_asc(_tags), " + ")
|        | extend CriticalityTier      = toint(array_sort_asc(_tiers)[0])
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", CriticalityTier == 2, "Medium", "Low")
|        | extend SecurityDomain    = "Endpoint"
|        | extend Category          = "Governance"
|        | extend Subcategory       = "Conflicting Tier Tags"
|        | extend ConfigurationName = "Assets carrying operator tags that assert more than one criticality tier"
|        | extend ConfigurationId   = "ENDPOINT-CONFLICTING-TIER-TAGS-001"
|        | extend DeviceKey = AssetId
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // audit #25 -- ImpactedAssetCount is DERIVED from ImpactedAssetsList (a bare make_set), and
|        // ImpactedAssetPairs pairs name and id in one token the engine splits on the LAST '|'.
|        | summarize
|            ImpactedAssetsList   = make_set(AssetName),
|            ImpactedAssetPairs   = make_set(strcat(AssetName, "|", AssetId)),
|            ConflictingTagPairs  = strcat_array(array_sort_asc(make_set(_pair)), "  ||  "),
|            MdeDeviceId          = min(tostring(MdeDeviceId)),
|            EntraAccountObjectId = min(tostring(EntraAccountObjectId)),
|            AzureResourceId      = min(tostring(AzureResourceId)),
|            AssetId              = min(AssetId)
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|             cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | extend ImpactedAssetsList = array_sort_asc(ImpactedAssetsList)
|        | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|        | extend Impact      = strcat(tostring(ImpactedAssetCount), " asset(s) carry tags claiming more than one tier, the most critical being tier ", tostring(CriticalityTier), ".")
|        | extend MoreDetails = strcat("Conflicting tag pairs -> ", ConflictingTagPairs)
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by CriticalityTier asc, ImpactedAssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, ConflictingTagPairs, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|ReportTemplates:
|
|    - ReportName: RiskAnalysis_Detailed
|      ReportPurpose: Detailed
|      ReportsIncluded:
|      - Name: Device_Missing_CVEs_Detailed
|      - Name: Endpoint_ExcludedAssets_Detailed
|      - Name: Endpoint_ConflictingTierTags_Detailed
|      - Name: Device_Recommendations_Detailed
|      - Name: Device_EndOfSupport_Software_Detailed
|      - Name: Device_Certificates_Detailed
|      - Name: Device_BrowserExtensions_Detailed
|      - Name: Endpoint_ActiveCompromise_Detected_Detailed
|      - Name: Azure_Recommendations_Detailed
|      - Name: Azure_DefenderRecommendations_Detailed
|      - Name: Attack_Paths_Detailed_Github_to_Azure_Resources
|      - Name: Attack_Paths_Detailed_Public_IP_to_VM_with_CVE_Exploitation
|      - Name: Attack_Paths_Detailed_Identity_Group_Membership_to_Privileged_Resources
|      - Name: Attack_Paths_Detailed_Data_Sensitivity_to_Exposed_Credentials
|      - Name: Attack_Paths_Detailed_Device_with_high_severity_vulnerabilities_allows_lateral_movement_Azure
|      - Name: Attack_Paths_Detailed_Credential_Based_Lateral_Movement
|      - Name: Attack_Paths_Detailed_ServicePrincipal_Impersonates_Users
|      - Name: Attack_Paths_Detailed_Workload_ManagedIdentity_to_Azure_Resources
|      - Name: Attack_Paths_Detailed_SignIn_Entitlement_to_Tier0_Servers
|      - Name: Attack_Paths_Detailed_Owner_to_Privileged_Service_Principal
|      - Name: Identity_PrivilegedSPN_NoLogin180Days_Detailed
|      - Name: Identity_PrivilegedUser_SignIn_NonTrustedLocation_Detailed
|      - Name: Identity_Admin_LogonTo_VulnerableDevice_Detailed
|      - Name: Identity_AdminAccount_NeverUsed_Detailed
|      - Name: Identity_AdminAccount_OnPremSynced_Detailed
|      - Name: Identity_Admin_LogonTo_InternetExposedDevice_Detailed
|      - Name: Identity_Admin_LogonTo_LowTierDevice_Detailed
|      - Name: Identity_NoMFA_Detailed
|      - Name: Identity_BreakGlass_Anomaly_Detailed
|      - Name: Identity_BreakGlass_SignIn_Detected_Detailed
|      - Name: Identity_DisabledAccount_ActivePIMAssignment_Detailed
|      - Name: Identity_EligibleAdmin_LogonTo_ExploitableDevice_Detailed
|      - Name: Identity_ExternalUser_PrivilegedRole_Detailed
|      - Name: Identity_HighMDIInvestigationPriority_Detailed
|      - Name: Identity_HighValueTarget_MDIRisk_Detailed
|      - Name: Identity_MultiTenant_HighPermission_SPN_Detailed
|      - Name: Identity_NewAccount_ImmediateTier0Role_Detailed
|      - Name: Identity_PIM_DuplicateRoleAssignment_Detailed
|      - Name: Identity_PIM_EligibleNeverActivated_Detailed
|      - Name: Identity_PasswordNeverExpires_Privileged_Detailed
|      - Name: Identity_PermanentPrivilegedRole_Detailed
|      - Name: Identity_PrivilegedUser_StalePassword_Detailed
|      - Name: Identity_SPN_AppRoleAssignmentWrite_Detailed
|      - Name: Identity_SPN_ExpiringCredentials_Detailed
|      - Name: Identity_SPN_MailboxAccess_Detailed
|      - Name: Identity_SPN_Orphan_NoOwner_Detailed
|      - Name: Identity_SPN_OverCredentialed_Detailed
|      - Name: Identity_SPN_PrivilegedAccessWrite_Detailed
|      - Name: Identity_SPN_RoleManagementWrite_Detailed
|      - Name: Identity_SPN_UnverifiedPublisher_HighPermission_Detailed
|      - Name: Identity_ServiceAccount_InteractiveSignIn_Detailed
|      - Name: Identity_ServiceAccount_SignIn_NonTrustedLocation_Detailed
|      - Name: Identity_ShadowAdmin_Detailed
|      - Name: Identity_StaleGuest_NoLogin90Days_Detailed
|      - Name: Identity_TooManyGlobalAdmins_Detailed
|      - Name: Identity_StaleUser_NoLogin180Days_Detailed
|      - Name: Identity_Departed_AccountStillEnabled_Detailed
|      - Name: Identity_DisabledPrivilegedUser_Detailed
|      - Name: Identity_DisabledUser_StillInCriticalGroup_Detailed
|      - Name: Identity_GuestWithPrivilegedRole_Detailed
|      - Name: Identity_PrivilegedRole_PermanentNotEligible_Detailed
|      - Name: Identity_PrivilegedUser_NoConditionalAccess_Detailed
|      - Name: Identity_SPN_MailboxImpersonation_Detailed
|      - Name: Identity_SPN_OwnerMismatch_Detailed
|      - Name: Identity_SPN_OwnsResourcePublicAccess_Detailed
|      - Name: Identity_AdNestedCriticalGroup_NoEntraRole_Detailed
|      - Name: Identity_HighRiskFactorComposite4Plus_Detailed
|      - Name: PublicIP_OpenPorts_Detailed
|      - Name: PublicIP_Vulnerabilities_Detailed
|
|    - ReportName: RiskAnalysis_Summary
|      ReportPurpose: Overview
|      ReportsIncluded:
|      - Name: Device_Missing_CVEs_Summary
|      - Name: Endpoint_ExcludedAssets_Summary
|      - Name: Endpoint_ConflictingTierTags_Summary
|      - Name: Device_Recommendations_Summary
|      - Name: Device_EndOfSupport_Software_Summary
|      - Name: Device_Certificates_Summary
|      - Name: Device_BrowserExtensions_Summary
|      - Name: Endpoint_ActiveCompromise_Detected_Summary
|      - Name: Azure_Recommendations_Summary
|      - Name: Azure_DefenderRecommendations_Summary
|      - Name: Attack_Paths_Summary_Github_to_Azure_Resources
|      - Name: Attack_Paths_Summary_Public_IP_to_VM_with_CVE_Exploitation
|      - Name: Attack_Paths_Summary_Identity_Group_Membership_to_Privileged_Resources
|      - Name: Attack_Paths_Summary_Data_Sensitivity_to_Exposed_Credentials
|      - Name: Attack_Paths_Summary_Device_with_high_severity_vulnerabilities_allows_lateral_movement_Azure
|      - Name: Attack_Paths_Summary_Credential_Based_Lateral_Movement
|      - Name: Attack_Paths_Summary_ServicePrincipal_Impersonates_Users
|      - Name: Attack_Paths_Summary_Workload_ManagedIdentity_to_Azure_Resources
|      - Name: Attack_Paths_Summary_SignIn_Entitlement_to_Tier0_Servers
|      - Name: Attack_Paths_Summary_Owner_to_Privileged_Service_Principal
|      - Name: Identity_NoMFA_Summary
|      - Name: Identity_StaleUser_NoLogin180Days_Summary
|      - Name: Identity_StaleGuest_NoLogin90Days_Summary
|      - Name: Identity_PrivilegedSPN_NoLogin180Days_Summary
|      - Name: Identity_SPN_ExpiringCredentials_Summary
|      - Name: Identity_SPN_Orphan_NoOwner_Summary
|      - Name: Identity_PermanentPrivilegedRole_Summary
|      - Name: Identity_ShadowAdmin_Summary
|      - Name: Identity_PasswordNeverExpires_Privileged_Summary
|      - Name: Identity_MultiTenant_HighPermission_SPN_Summary
|      - Name: Identity_ExternalUser_PrivilegedRole_Summary
|      - Name: Identity_PrivilegedUser_StalePassword_Summary
|      - Name: Identity_SPN_MailboxAccess_Summary
|      - Name: Identity_HighValueTarget_MDIRisk_Summary
|      - Name: Identity_PrivilegedUser_SignIn_NonTrustedLocation_Summary
|      - Name: Identity_ServiceAccount_SignIn_NonTrustedLocation_Summary
|      - Name: Identity_BreakGlass_SignIn_Detected_Summary
|      - Name: Identity_SPN_RoleManagementWrite_Summary
|      - Name: Identity_SPN_AppRoleAssignmentWrite_Summary
|      - Name: Identity_SPN_PrivilegedAccessWrite_Summary
|      - Name: Identity_SPN_UnverifiedPublisher_HighPermission_Summary
|      - Name: Identity_NewAccount_ImmediateTier0Role_Summary
|      - Name: Identity_DisabledAccount_ActivePIMAssignment_Summary
|      - Name: Identity_ServiceAccount_InteractiveSignIn_Summary
|      - Name: Identity_HighMDIInvestigationPriority_Summary
|      - Name: Identity_AdminAccount_OnPremSynced_Summary
|      - Name: Identity_AdminAccount_NeverUsed_Summary
|      - Name: Identity_TooManyGlobalAdmins_Summary
|      - Name: Identity_BreakGlass_Anomaly_Summary
|      - Name: Identity_PIM_EligibleNeverActivated_Summary
|      - Name: Identity_PIM_DuplicateRoleAssignment_Summary
|      - Name: Identity_SPN_OverCredentialed_Summary
|      - Name: Identity_Admin_LogonTo_VulnerableDevice_Summary
|      - Name: Identity_Admin_LogonTo_InternetExposedDevice_Summary
|      - Name: Identity_Admin_LogonTo_LowTierDevice_Summary
|      - Name: Identity_EligibleAdmin_LogonTo_ExploitableDevice_Summary
|      - Name: Identity_Departed_AccountStillEnabled_Summary
|      - Name: Identity_DisabledPrivilegedUser_Summary
|      - Name: Identity_DisabledUser_StillInCriticalGroup_Summary
|      - Name: Identity_GuestWithPrivilegedRole_Summary
|      - Name: Identity_PrivilegedRole_PermanentNotEligible_Summary
|      - Name: Identity_PrivilegedUser_NoConditionalAccess_Summary
|      - Name: Identity_SPN_MailboxImpersonation_Summary
|      - Name: Identity_SPN_OwnerMismatch_Summary
|      - Name: Identity_SPN_OwnsResourcePublicAccess_Summary
|      - Name: Identity_AdNestedCriticalGroup_NoEntraRole_Summary
|      - Name: Identity_HighRiskFactorComposite4Plus_Summary
|      - Name: PublicIP_OpenPorts_Summary
|      - Name: PublicIP_Vulnerabilities_Summary
|
|    - ReportName: AssetSimulationComplexSummary
|      ReportPurpose: |
|        A load test over 10 Summary reports covering EVERY cross-domain
|        Attack_Paths_Summary_* (all 6 use `summarize` + `_TargetCmdb` and were the
|        primary cascade-blowup offenders in earlier releases). Single-let Endpoint
|        (Device_Missing_CVEs, Device_Recommendations), single-let Azure
|        (Azure_Recommendations), 6 cross-domain Attack_Paths Summary (covers
|        Github->Azure, PublicIP->VM, Identity Group Membership, Data Sensitivity,
|        Device-high-sev-vuln lateral, and Credential-based lateral), plus 1
|        cross-domain Identity_Admin_LogonTo_VulnerableDevice. Pair with the
|        launcher's `-RunAssetSimulation ComplexSummary -AssetSimulationAmount N`
|        knob to validate the futile-prune, the error-body surfacing
|        + bucketing under load in ~10-15 min.
|      ReportsIncluded:
|      - Name: Device_Missing_CVEs_Summary
|      - Name: Device_Recommendations_Summary
|      - Name: Azure_Recommendations_Summary
|      - Name: Azure_DefenderRecommendations_Summary
|      - Name: Attack_Paths_Summary_Github_to_Azure_Resources
|      - Name: Attack_Paths_Summary_Public_IP_to_VM_with_CVE_Exploitation
|      - Name: Attack_Paths_Summary_Identity_Group_Membership_to_Privileged_Resources
|      - Name: Attack_Paths_Summary_Data_Sensitivity_to_Exposed_Credentials
|      - Name: Attack_Paths_Summary_Device_with_high_severity_vulnerabilities_allows_lateral_movement_Azure
|      - Name: Attack_Paths_Summary_Credential_Based_Lateral_Movement
|      - Name: Identity_Admin_LogonTo_VulnerableDevice_Summary
|
|    - ReportName: AssetSimulationComplexDetailed
|      ReportPurpose: |
|        Detailed counterparts to AssetSimulationComplexSummary (same reports,
|        per-(asset, finding) rows). Use with
|        `-RunAssetSimulation ComplexDetailed -AssetSimulationAmount N`.
|      ReportsIncluded:
|      - Name: Device_Missing_CVEs_Detailed
|      - Name: Device_Recommendations_Detailed
|      - Name: Attack_Paths_Detailed_Identity_Group_Membership_to_Privileged_Resources
|      - Name: Attack_Paths_Detailed_Device_with_high_severity_vulnerabilities_allows_lateral_movement_Azure
|      - Name: Attack_Paths_Detailed_Credential_Based_Lateral_Movement
|      - Name: Identity_Admin_LogonTo_VulnerableDevice_Detailed
|      - Name: Azure_Recommendations_Detailed
|      - Name: Azure_DefenderRecommendations_Detailed
'@ }
$__siSupportFiles['engine/asset-profiling/shared/RuleEval.ps1'] = @{ Sha256 = '10c2df6a6ee608dad2f0c55987abe15490083389f96ca2fab852293ef3e8bb5d'; Text = @'
|#Requires -Version 5.1
|<#
|    RuleEval.ps1
|
|    `detect.kind` registry + per-asset evaluator for the AssetProfileBy*
|    rule shape (ARCHITECTURE.md §§ 7, 9). Companion to Get-SIRuleSet.ps1.
|
|    Two-layer design:
|
|      LAYER 1 -- Per-kind handler functions
|        Each handler implements one `detect.kind`. Signature:
|          handler -Asset <pscustomobject> -Args <hashtable> -> [bool]
|        Asset is the row from Stage Collect (engine-specific shape, but
|        common fields like PrimaryEntityId, Name, Hostname, MDE_*,
|        ENTRA_*, AZ_* available). Args is the kind's parameter hashtable
|        from the YAML (e.g. for nameMatches: @{ namePatterns = [...] }).
|
|      LAYER 2 -- Detection / rule evaluator
|        Invoke-SIDetect -Asset $a -Detect $d -> [bool]
|          Walks $d.any[] (true if ANY kind handler returns true) or
|          $d.all[] (true only if ALL handlers return true). Per ARCHITECTURE
|          .md § 7 each detection has an `any:` or `all:` array.
|
|        Invoke-SIRuleEval -Asset $a -Rule $r -> [pscustomobject] | $null
|          Walks $r.Detections in array order. Returns the FIRST detection
|          whose Detect block matches, with its Set values bundled. Returns
|          $null when no detection matches (asset doesn't fit this rule).
|
|    Performance contract (ARCHITECTURE.md § 9):
|
|      Per-asset handlers MUST NOT make external network calls. They read
|      either from the asset row itself or from a pre-built bulk index.
|      Index builders for kinds that need external data (hasSoftwareInstalled,
|      groupMembership, hasAzureTagDirectOrParent, egKustoQuery, entraKustoQuery)
|      live in companion files added in .
|
|    4 kinds implemented (asset-row-only, no bulk fetch):
|      * nameMatches
|      * hasMdeMachineGroupTag
|      * egDetectedRoles
|      * hasEntraExtensionAttributeTag
|
|    4 kinds STUBBED (throw 'not yet implemented'):
|      * hasSoftwareInstalled       <- needs DeviceTvmSoftwareInventory bulk index
|      * groupMembership            <- needs Entra group-member bulk index
|      * hasAzureTagDirectOrParent  <- needs sub/MG hierarchy bulk index
|      * egKustoQuery               <- needs per-rule pre-fetch
|
|    Stage integration is NOT done in . Use Test-SIRuleEval to
|    exercise this against a sample asset object; engine integration ships
|    later. No stage calls it today and no setting turns it on.
|#>
|
|# ----------------------------------------------------------------------------
|# Helpers (asset-row reader + safe regex match)
|# ----------------------------------------------------------------------------
|
|function Get-SIAssetField {
|    <#
|        Reads a field from an asset, tolerating both [hashtable] and
|        [pscustomobject] shapes (assets can arrive as either depending on
|        the stage -- post-staging-blob round-trip they're PSCustomObject).
|        Returns $null when the field doesn't exist.
|
|        also walks $Asset.Metadata.<Name> as a fallback. Azure
|        records (and endpoint records cross-source merge)
|        carry AZ_*/MDE_*/ENTRA_*/EG_* fields under .Metadata, not at top
|        level. Without this fallback, Test-SIKind_hasAzureTagDirectOrParent
|        and other rule kinds saw $null for AZ_ResourceId on every asset and
|        no rules ever matched.
|    #>
|    param(
|        [Parameter(Mandatory)]$Asset,
|        [Parameter(Mandatory)][string]$Name
|    )
|    if ($null -eq $Asset) { return $null }
|
|    # Top-level lookup
|    $val = $null
|    if ($Asset -is [System.Collections.IDictionary]) {
|        if ($Asset.Contains($Name)) { $val = $Asset[$Name] }
|    } else {
|        $prop = $Asset.PSObject.Properties[$Name]
|        if ($prop) { $val = $prop.Value }
|    }
|    if ($null -ne $val -and "$val" -ne '') { return $val }
|
|    # Metadata-bag fallback
|    $meta = $null
|    if ($Asset -is [System.Collections.IDictionary]) {
|        if ($Asset.Contains('Metadata')) { $meta = $Asset['Metadata'] }
|    } else {
|        $mp = $Asset.PSObject.Properties['Metadata']
|        if ($mp) { $meta = $mp.Value }
|    }
|    if ($null -ne $meta) {
|        if ($meta -is [System.Collections.IDictionary]) {
|            if ($meta.Contains($Name)) { return $meta[$Name] }
|        } else {
|            $mp2 = $meta.PSObject.Properties[$Name]
|            if ($mp2) { return $mp2.Value }
|        }
|    }
|    return $null
|}
|
|function Test-SIPatternMatch {
|    <#
|        Tests $Value against an array of regex patterns. Returns $true on
|        first hit. Empty/null Value or empty pattern array -> $false.
|        Regex compile failures are logged and swallowed (one bad pattern
|        in a 500-rule set must not stop evaluation).
|    #>
|    param(
|        [string]$Value,
|        [string[]]$Patterns
|    )
|    if ([string]::IsNullOrEmpty($Value) -or -not $Patterns -or $Patterns.Count -eq 0) {
|        return $false
|    }
|    foreach ($p in $Patterns) {
|        if ([string]::IsNullOrWhiteSpace($p)) { continue }
|        try {
|            if ([System.Text.RegularExpressions.Regex]::IsMatch($Value, $p)) { return $true }
|        } catch {
|            Write-Verbose ('Test-SIPatternMatch: invalid regex {0} -- {1}' -f $p, $_.Exception.Message)
|        }
|    }
|    return $false
|}
|
|# ----------------------------------------------------------------------------
|# Implemented handlers (asset-row-only, no bulk fetch needed)
|# ----------------------------------------------------------------------------
|
|function Test-SIKind_osPlatform {
|    <#
|        kind: osPlatform
|          osPatterns:                      # any-match (regex; case-insensitive)
|            - '(?i)^Windows10$'
|            - '(?i)^Windows11$'
|            - '(?i)^macOS'
|        Reads MDE_OSPlatform / ENTRA_OS / EG.osPlatform / EG.osPlatformFriendlyName.
|    #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $patterns = @($Args.osPatterns)
|    if (-not $patterns) { $patterns = @($Args.patterns) }
|    if (-not $patterns -or $patterns.Count -eq 0) { return $false }
|    foreach ($field in @('MDE_OSPlatform','ENTRA_OS','EG_OS')) {
|        $val = [string](Get-SIAssetField -Asset $Asset -Name $field)
|        if ($val -and (Test-SIPatternMatch -Value $val -Patterns $patterns)) { return $true }
|    }
|    return $false
|}
|
|function Get-SIAssetOsClass {
|    <#
|    .SYNOPSIS
|        Coarse OS classification for fast per-rule scope filtering in Stage Profile.
|
|    .DESCRIPTION
|        Returns one of: WindowsServer, WindowsClient, Linux, macOS, iOS, Android,
|        IoT, Other. Reads the same MDE_OSPlatform / ENTRA_OS / EG_OS fields the
|        existing osPlatform rule kind uses. First non-empty wins.
|
|        Used by Invoke-Profile.ps1 to short-circuit rule evaluation when a rule
|        declares `osPlatformScope: [WindowsServer,...]` and the asset's class
|        isn't in the list. Avoids running ~589 server-app rules against
|        workstations / IoT / mobile and similar wasted permutations.
|
|        Match table (case-insensitive prefix on the raw OS string):
|          WindowsServer  : Windows Server, WindowsServer
|          WindowsClient  : Windows10, Windows11, Windows7, Windows8
|          Linux          : Linux, Ubuntu, Debian, RHEL, CentOS, Fedora, SUSE,
|                           Oracle, AmazonLinux, AlmaLinux, Rocky
|          macOS          : macOS, Mac OS, OSX
|          iOS            : iOS, iPadOS
|          Android        : Android
|          IoT            : TvOS, WatchOS, IoT, Embedded, ChromeOS
|          Other          : nothing matched (empty / unknown OS)
|    #>
|    param([Parameter(Mandatory)]$Asset)
|    $os = $null
|    foreach ($field in @('MDE_OSPlatform','ENTRA_OS','EG_OS')) {
|        $v = [string](Get-SIAssetField -Asset $Asset -Name $field)
|        if (-not [string]::IsNullOrWhiteSpace($v)) { $os = $v; break }
|    }
|    if ([string]::IsNullOrWhiteSpace($os)) { return 'Other' }
|    switch -Regex ($os) {
|        '(?i)windows[\s_-]*server'                                                 { return 'WindowsServer' }
|        '(?i)^windowsserver'                                                       { return 'WindowsServer' }
|        '(?i)^windows(7|8|8\.1|10|11)$'                                            { return 'WindowsClient' }
|        '(?i)^windows[\s_-]?(10|11)'                                               { return 'WindowsClient' }
|        '(?i)^(linux|ubuntu|debian|rhel|redhat|centos|fedora|suse|oracle|amazonlinux|almalinux|rocky)' { return 'Linux' }
|        '(?i)^(macos|mac os|osx)'                                                  { return 'macOS' }
|        '(?i)^(ios|ipados)'                                                        { return 'iOS' }
|        '(?i)^android'                                                             { return 'Android' }
|        '(?i)^(tvos|watchos|iot|embedded|chromeos)'                                { return 'IoT' }
|        default                                                                    { return 'Other' }
|    }
|}
|
|function Test-SIKind_nameMatches {
|    <#
|        kind: nameMatches
|          namePatterns:
|            - '(?i)^dc\d'
|            - '(?i)domain.controller'
|        Reads asset Name / Hostname / DisplayName fields and tests each
|        regex pattern. Hits any -> true.
|    #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $patterns = @($Args.namePatterns)
|    if (-not $patterns) { $patterns = @($Args.patterns) }   # accept either spelling
|    if (-not $patterns -or $patterns.Count -eq 0) { return $false }
|
|    foreach ($field in @('Name','Hostname','DisplayName','Fqdn','MDE_DeviceName','ENTRA_DisplayName','AZ_Name')) {
|        $val = [string](Get-SIAssetField -Asset $Asset -Name $field)
|        if ($val -and (Test-SIPatternMatch -Value $val -Patterns $patterns)) { return $true }
|    }
|    return $false
|}
|
|function Test-SIKind_hasMdeMachineGroupTag {
|    <#
|        kind: hasMdeMachineGroupTag
|          machineTagPatterns: [ '(?i)domain.controller', '(?i)tier.?0' ]
|        Reads asset MDE_MachineGroup (a string, comma- or semicolon-
|        separated when multiple groups) and tests each regex against it.
|    #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $patterns = @($Args.machineTagPatterns)
|    if (-not $patterns) { $patterns = @($Args.patterns) }
|    # a bare tier pattern ('(?i)tier.?0') matches every operator tier tag, so it is no evidence of the rule's role (a PAW
|    # tagged PAWDevices--tier0--SI became a Domain Controller); the tier tag is its own contributor (tenant_si_manual_tag)
|    $patterns = @($patterns | Where-Object { $_ -and ([string]$_ -notmatch '^(\(\?i\))?\^?tier(\.|\[[^\]]*\]|[_-])?[?*]?\d\$?$') })
|    if (-not $patterns -or $patterns.Count -eq 0) { return $false }
|
|    $val = [string](Get-SIAssetField -Asset $Asset -Name 'MDE_MachineGroup')
|    if (-not $val) { return $false }
|    return (Test-SIPatternMatch -Value $val -Patterns $patterns)
|}
|
|function Test-SIKind_egDetectedRoles {
|    <#
|        kind: egDetectedRoles
|          egSignals: [ 'isDomainController' ]
|        Reads asset EG_DetectedRoles (semicolon-joined string from
|        ExposureGraphNodes confidenceHigh/confidenceLow arrays) AND
|        EG_RawData (full JSON blob) for properties like isDomainController.
|    #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $signals = @()
|    if ($Args.egSignals) { $signals = @($Args.egSignals) }
|    elseif ($Args.roles) { $signals = @($Args.roles) }
|    if ($signals.Count -eq 0) { return $false }
|
|    $detectedRoles = [string](Get-SIAssetField -Asset $Asset -Name 'EG_DetectedRoles')
|    foreach ($s in $signals) {
|        if ([string]::IsNullOrWhiteSpace($s)) { continue }
|        # Two match modes:
|        #   1) substring match against EG_DetectedRoles string
|        #   2) boolean property match against EG_RawData (e.g. isDomainController=true)
|        if ($detectedRoles -and $detectedRoles -match [regex]::Escape($s)) { return $true }
|
|        $rawData = Get-SIAssetField -Asset $Asset -Name 'EG_RawData'
|        if ($rawData) {
|            $propVal = if ($rawData -is [System.Collections.IDictionary]) {
|                if ($rawData.ContainsKey($s)) { $rawData[$s] } else { $null }
|            } else {
|                $p = $rawData.PSObject.Properties[$s]
|                if ($p) { $p.Value } else { $null }
|            }
|            if ($propVal -eq $true -or $propVal -eq 'true') { return $true }
|        }
|    }
|    return $false
|}
|
|function Test-SIKind_hasEntraExtensionAttributeTag {
|    <#
|        kind: hasEntraExtensionAttributeTag
|          attribute: extensionAttribute6
|          value:     'Internal_User'
|          match:     exact
|        Reads ENTRA_ExtensionAttributes (a JSON blob or hashtable with
|        extensionAttribute1..15 keys). 'exact' requires full string match;
|        anything else allows substring (case-insensitive).
|    #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $attrName = [string]$Args.attribute
|    $value    = [string]$Args.value
|    $matchKind = if ($Args.match) { [string]$Args.match } else { 'exact' }
|    if ([string]::IsNullOrWhiteSpace($attrName) -or [string]::IsNullOrWhiteSpace($value)) { return $false }
|
|    # First try direct flat field (some collectors flatten extensionAttributeN to top-level)
|    $direct = [string](Get-SIAssetField -Asset $Asset -Name ('ENTRA_' + $attrName))
|    if ($direct) {
|        # PS 5.1 has no ternary -- explicit if/else (ternary lands in PS 7+).
|        if ($matchKind -eq 'exact') { return ($direct -ceq $value) }
|        return ($direct -like ('*' + $value + '*'))
|    }
|
|    # Fallback to nested ENTRA_ExtensionAttributes / ExtensionAttributes object
|    foreach ($container in @('ENTRA_ExtensionAttributes','ExtensionAttributes','extensionAttributes')) {
|        $obj = Get-SIAssetField -Asset $Asset -Name $container
|        if ($null -eq $obj) { continue }
|        $val = if ($obj -is [System.Collections.IDictionary]) {
|            if ($obj.ContainsKey($attrName)) { $obj[$attrName] } else { $null }
|        } else {
|            $p = $obj.PSObject.Properties[$attrName]
|            if ($p) { $p.Value } else { $null }
|        }
|        if ($null -ne $val) {
|            $sval = [string]$val
|            if ($matchKind -eq 'exact') { if ($sval -ceq $value) { return $true } }
|            else                        { if ($sval -like ('*' + $value + '*')) { return $true } }
|        }
|    }
|    return $false
|}
|
|# ----------------------------------------------------------------------------
|# Bulk-index handlers
|# ----------------------------------------------------------------------------
|
|function Test-SIKind_hasSoftwareInstalled {
|    <# Looks up MDE_DeviceId in tvmSoftware index. Pattern '<vendor>/<name>'
|       allows wildcards via -like. Returns true on first match. #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $patterns = @($Args.tvmSoftwareNames)
|    if (-not $patterns -or $patterns.Count -eq 0) { return $false }
|
|    $devId = [string](Get-SIAssetField -Asset $Asset -Name 'MDE_DeviceId')
|    if (-not $devId) { $devId = [string](Get-SIAssetField -Asset $Asset -Name 'PrimaryEntityId') }
|    if (-not $devId) { return $false }
|
|    $idx = if (Get-Variable -Name SIRuleIndexes -Scope Script -ErrorAction SilentlyContinue) { $script:SIRuleIndexes.tvmSoftware } else { $null }
|    if (-not $idx) { Write-Verbose 'hasSoftwareInstalled: tvmSoftware index not built (call Build-SIRuleIndexes first)'; return $false }
|    $pairs = $idx[$devId.ToLower()]
|    if (-not $pairs) { return $false }
|
|    foreach ($pair in $pairs) {
|        foreach ($p in $patterns) {
|            $glob = ([string]$p).ToLower()
|            if ($pair -like $glob -or $pair -like ('*/' + $glob)) { return $true }
|        }
|    }
|    return $false
|}
|
|function Test-SIKind_groupMembership {
|    <# renamed from adGroupMember. Looks up identity object id
|       in GroupMembership index (sourced from ENTRA_Groups field on the asset row).
|       Exact (case-insensitive) group-name match.
|       index renamed adGroups -> GroupMembership; align key
|       candidates with Build-SIGroupMembershipIndex --
|       discovery emits ENTRA_UserId (not AccountObjectId; that's IdentityInfo's
|       field name). PrimaryEntityId is only set by the row-builder at Output
|       stage, NOT during Profile when this matcher runs. Without ENTRA_UserId
|       in the candidate list, the lookup misses every identity even when the
|       index correctly contains them -> SIRules ends up empty. Last-resort
|       fallback also added: extract from AssetId 'entra-user:<guid>'. #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $target = [string]$Args.group
|    if ([string]::IsNullOrWhiteSpace($target)) { return $false }
|
|    # short-circuit for non-user assets. SPs/MIs are not members
|    # of org-finance / org-hr / etc. for tier-classification purposes -- the
|    # builder doesn't index them (would always miss anyway). This skips the
|    # AssetId regex + Get-SIAssetField calls per non-user iteration.
|    $aid = [string](Get-SIAssetField -Asset $Asset -Name 'AssetId')
|    if ($aid -and $aid -notmatch '^entra-user:') { return $false }
|
|    $key = $null
|    foreach ($f in @('PrimaryEntityId','AccountObjectId','ENTRA_UserId','ENTRA_ObjectId')) {
|        $v = [string](Get-SIAssetField -Asset $Asset -Name $f)
|        if ($v) { $key = $v.ToLower(); break }
|    }
|    if (-not $key) {
|        $aid = [string](Get-SIAssetField -Asset $Asset -Name 'AssetId')
|        if ($aid -match '^entra-user:(?<id>.+)$') { $key = $matches.id.ToLower() }
|    }
|    if (-not $key) { return $false }
|
|    $idx = if (Get-Variable -Name SIRuleIndexes -Scope Script -ErrorAction SilentlyContinue) { $script:SIRuleIndexes.GroupMembership } else { $null }
|    if (-not $idx) { Write-Verbose 'groupMembership: GroupMembership index not built'; return $false }
|    $groups = $idx[$key]
|    if (-not $groups) { return $false }
|    # case-insensitive end-to-end. Both sides .ToLowerInvariant()
|    # (locale-safe -- ToLower() in tr-TR locale would map "I" -> "i_" not "i").
|    # -icontains is explicit case-insensitive (-contains is also CI but the
|    # explicit form documents intent).
|    return ($groups -icontains $target.ToLowerInvariant())
|}
|
|function Test-SIMatchOperator {
|    <# shared match-operator helper. Used by tag-related detect kinds
|       so YAML rules can express richer comparisons than raw equality.
|       Operators (case-insensitive on operator name AND value):
|         equal   (default) -- exact string match
|         like              -- PowerShell -like wildcard ('*foo*', 'bar?')
|         has               -- contains substring (case-insensitive)
|         regex / matches   -- .NET regex match (caller can write '(?i)' inline for case)
|         in                -- value appears in a list/array
|         startswith        -- prefix match
|         endswith          -- suffix match
|       Returns $false on $null Actual or unknown operator. #>
|    param([string]$Actual, $Expected, [string]$Op = 'equal')
|    if ($null -eq $Actual) { return $false }
|    $opLc = if ($Op) { $Op.ToLowerInvariant() } else { 'equal' }
|    switch ($opLc) {
|        'equal'      { return ([string]$Actual -ieq [string]$Expected) }
|        'like'       { return ([string]$Actual -ilike [string]$Expected) }
|        'has'        { return ([string]$Actual -imatch [regex]::Escape([string]$Expected)) }
|        'startswith' { return ([string]$Actual).ToLowerInvariant().StartsWith(([string]$Expected).ToLowerInvariant()) }
|        'endswith'   { return ([string]$Actual).ToLowerInvariant().EndsWith(([string]$Expected).ToLowerInvariant()) }
|        'regex'      { try { return ([string]$Actual -imatch [string]$Expected) } catch { return $false } }
|        'matches'    { try { return ([string]$Actual -imatch [string]$Expected) } catch { return $false } }
|        'in' {
|            $list = if ($Expected -is [System.Collections.IEnumerable] -and $Expected -isnot [string]) { @($Expected) } else { @($Expected) }
|            foreach ($v in $list) { if ([string]$Actual -ieq [string]$v) { return $true } }
|            return $false
|        }
|        default {
|            Write-Verbose ("Test-SIMatchOperator: unknown operator '{0}', defaulting to 'equal'" -f $Op)
|            return ([string]$Actual -ieq [string]$Expected)
|        }
|    }
|}
|
|function Test-SIKind_hasAzureTagDirectOrParent {
|    <# Checks an Azure tag directly on the resource, OR inherited from any parent
|       container (RG -> subscription -> management group). Consults the parentChain
|       index built once per run by Build-SIParentResourceChainIndex.
|       optional `match` arg supports equal|like|has|regex|matches|in|
|       startswith|endswith. Default 'equal'. Tag KEY is always exact (case-insensitive). #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $tagKey = [string]$Args.tag
|    $tagVal = $Args.value
|    $op     = if ($Args.match) { [string]$Args.match } else { 'equal' }
|    if ([string]::IsNullOrWhiteSpace($tagKey)) { return $false }
|
|    $resourceId = [string](Get-SIAssetField -Asset $Asset -Name 'AZ_ResourceId')
|    if (-not $resourceId) { $resourceId = [string](Get-SIAssetField -Asset $Asset -Name 'PrimaryEntityId') }
|    if (-not $resourceId) { return $false }
|
|    $idx = if (Get-Variable -Name SIRuleIndexes -Scope Script -ErrorAction SilentlyContinue) { $script:SIRuleIndexes.parentChain } else { $null }
|    if (-not $idx) { Write-Verbose 'hasAzureTagDirectOrParent: parentChain index not built'; return $false }
|
|    $chain = @()
|    $rid = $resourceId.ToLower()
|    if ($idx.ContainsKey($rid)) { $chain += $idx[$rid] }
|    if ($rid -match '^(/subscriptions/[^/]+/resourcegroups/[^/]+)') {
|        $rgKey = $matches[1].ToLower()
|        if ($idx.ContainsKey($rgKey)) { $chain += $idx[$rgKey] }
|    }
|    if ($rid -match '^(/subscriptions/[^/]+)') {
|        $subKey = $matches[1].ToLower()
|        if ($idx.ContainsKey($subKey)) { $chain += $idx[$subKey] }
|    }
|
|    foreach ($t in $chain) {
|        if ([string]$t.tag -ieq $tagKey) {
|            # No value supplied -> presence-only check (any non-empty value matches)
|            if ($null -eq $tagVal -or ($tagVal -is [string] -and [string]::IsNullOrEmpty([string]$tagVal))) { return $true }
|            if (Test-SIMatchOperator -Actual ([string]$t.value) -Expected $tagVal -Op $op) { return $true }
|        }
|    }
|    return $false
|}
|
|function Test-SIIpInCidr {
|    <# Returns $true if $Ip is inside the IPv4 / IPv6 $Cidr ('a.b.c.d/N').
|       Pure byte-mask compare so it works in PS 5.1. Bad input -> $false. #>
|    param([string]$Ip, [string]$Cidr)
|    if ([string]::IsNullOrWhiteSpace($Ip) -or [string]::IsNullOrWhiteSpace($Cidr)) { return $false }
|    $parts = $Cidr -split '/'
|    if ($parts.Count -ne 2) { return $false }
|    try {
|        $ipObj  = [System.Net.IPAddress]::Parse($Ip.Trim())
|        $netObj = [System.Net.IPAddress]::Parse($parts[0].Trim())
|        if ($ipObj.AddressFamily -ne $netObj.AddressFamily) { return $false }
|        $ipBytes  = $ipObj.GetAddressBytes()
|        $netBytes = $netObj.GetAddressBytes()
|        $bits = [int]$parts[1]
|        for ($i = 0; $i -lt $ipBytes.Length; $i++) {
|            $byteBits = [Math]::Min(8, [Math]::Max(0, $bits - ($i * 8)))
|            if ($byteBits -eq 0) { return $true }
|            $mask = [byte](256 - [Math]::Pow(2, 8 - $byteBits))
|            if (($ipBytes[$i] -band $mask) -ne ($netBytes[$i] -band $mask)) { return $false }
|        }
|        return $true
|    } catch { return $false }
|}
|
|function Test-SIKind_ipInRange {
|    <# detect kind: matches when ANY of the asset's IP-bearing
|       fields falls within ANY of the supplied CIDR ranges. Cross-engine:
|       walks well-known endpoint AND azure IP carriers.
|
|         - kind: ipInRange
|           cidrs: ['10.100.1.0/24', '10.100.2.0/24']
|           # Optional: restrict which fields to read
|           # fields: ['MDE_EffectiveIpAddresses','MDE_PublicIp']
|
|       Default fields scanned (in order):
|         endpoint:  MDE_EffectiveIpAddresses, MDE_PublicIp,
|                    MDE_LastIpAddress, EG_PublicIp, EG_PrivateIp
|         azure:     AZ_PropertiesJson.ipAddress (publicIPAddress),
|                    AZ_PropertiesJson.ipConfigurations[*].properties.privateIPAddress
|                    (network interface; walked at runtime via JSON parse)
|
|       Field values may be a single IP string, a comma-separated string,
|       a JSON string array, or a [string[]] array -- all flattened. #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|
|    $cidrs = @(if ($Args.cidrs) { @($Args.cidrs) } elseif ($Args.cidr) { @($Args.cidr) } else { @() })
|    $cidrs = $cidrs | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }
|    if ($cidrs.Count -eq 0) { return $false }
|
|    # scan ALL SOURCES OF TRUTH, not just MDE. Order = priority but
|    # ANY hit suffices. MDE_EffectiveIpAddresses is already a UNION of MDE
|    # DeviceInfo + EG internalIpAddresses + EG lastIpAddress + Entra + ARG NIC +
|    # AD + CMDB (Collect stage merges them per record, see contract).
|    # The per-source backstops below catch records where the union didn't run --
|    # e.g. EG-only assets or azure-engine resources.
|    $defaultFields = @(
|        # MDE (Microsoft Defender for Endpoint -- machine + DeviceInfo)
|        'MDE_EffectiveIpAddresses','MDE_PublicIp','MDE_LastIpAddress',
|        # Exposure Graph (Microsoft Security Exposure Management -- security view)
|        'EG_PublicIp','EG_PrivateIp','EG_LastIpAddress','EG_InternalIpAddresses',
|        # Entra (Entra ID joined device record)
|        'ENTRA_PrivateIp','ENTRA_PublicIp','ENTRA_IpAddress',
|        # Azure (ARG: VM NIC private IPs / PIP ipAddress)
|        'AZ_PrivateIp','AZ_PrivateIpAddresses','AZ_PublicIp',
|        # AD (on-prem Active Directory computer object -- enrichment coming)
|        'AD_IpAddress','AD_IpAddresses',
|        # CMDB (matched CI's IP fields -- folded by Reconcile from CMDB.csv columns)
|        'CMDB_PrivateIp','CMDB_IpAddresses','CMDB_ip','CMDB_private_ip'
|    )
|    $fields = if ($Args.fields) { @($Args.fields) } else { $defaultFields }
|
|    # Collect candidate IP strings
|    $ips = New-Object System.Collections.Generic.List[string]
|    foreach ($f in $fields) {
|        $v = Get-SIAssetField -Asset $Asset -Name $f
|        if ($null -eq $v) { continue }
|        # Flatten: single IP, comma-list, JSON array, or [string[]] array
|        if ($v -is [System.Collections.IEnumerable] -and -not ($v -is [string])) {
|            foreach ($x in $v) { if ($x) { $ips.Add([string]$x) } }
|            continue
|        }
|        $s = [string]$v
|        if ([string]::IsNullOrWhiteSpace($s)) { continue }
|        # JSON array string?
|        if ($s.StartsWith('[')) {
|            try { foreach ($x in ($s | ConvertFrom-Json)) { if ($x) { $ips.Add([string]$x) } } } catch { $ips.Add($s) }
|            continue
|        }
|        # Comma / semicolon list
|        foreach ($p in ($s -split '[,;]\s*')) { if ($p) { $ips.Add($p.Trim()) } }
|    }
|
|    # Azure VM/NIC fallback -- pull privateIP / ipAddress from AZ_PropertiesJson
|    $azPropsJson = [string](Get-SIAssetField -Asset $Asset -Name 'AZ_PropertiesJson')
|    if ($azPropsJson) {
|        try {
|            $p = $azPropsJson | ConvertFrom-Json
|            if ($p.PSObject.Properties['ipAddress']) { $ips.Add([string]$p.ipAddress) }
|            if ($p.PSObject.Properties['ipConfigurations']) {
|                foreach ($cfg in $p.ipConfigurations) {
|                    if ($cfg.properties -and $cfg.properties.PSObject.Properties['privateIPAddress']) {
|                        $ips.Add([string]$cfg.properties.privateIPAddress)
|                    }
|                }
|            }
|        } catch {}
|    }
|
|    if ($ips.Count -eq 0) { return $false }
|    foreach ($ip in $ips) {
|        if ([string]::IsNullOrWhiteSpace($ip)) { continue }
|        foreach ($cidr in $cidrs) {
|            if (Test-SIIpInCidr -Ip $ip -Cidr $cidr) { return $true }
|        }
|    }
|    return $false
|}
|
|function Get-SIAssetTagPairs {
|    <# cross-source-of-truth tag carrier walker. Returns a flat
|       list of @{ Key=<string|null>; Value=<string>; Source=<string> } pairs
|       for an asset by walking every supported tag carrier on its Metadata.
|
|       Carriers walked (works for endpoint, identity, AND azure assets --
|       absent fields just don't contribute):
|
|         MDE   value-only:  MDE_MachineTags
|         EG    value-only:  EG_RawData.deviceDynamicTags / deviceManualTags
|         EG    key:value:   EG_RawData.tags (some node types)
|         Entra key:value:   ENTRA_ExtensionAttribute1..15
|         Entra key:value:   ENTRA_OnPremisesExtensionAttributes (dict)
|         ARM   key:value:   AZ_TagsJson (parsed) -- direct on the resource
|         ARM   key:value:   parentChain index lookup (sub/RG inheritance)
|         CMDB  key:value:   Metadata.CMDB_<col> (Reconcile-folded CSV columns)
|         AD    value-only:  AD_GroupMemberships (placeholder, when present)
|
|       Pairs with $null Key are "value-only" (presence in a list); pairs with
|       a non-null Key are "key:value". The matcher in Test-SIKind_hasTag
|       handles both shapes, including the convention where a value-only list
|       carries a literal "key:value" or "key=value" string. #>
|    param([Parameter(Mandatory)]$Asset)
|    $pairs = New-Object System.Collections.Generic.List[object]
|
|    $meta = $null
|    if ($Asset -is [System.Collections.IDictionary]) { if ($Asset.Contains('Metadata')) { $meta = $Asset['Metadata'] } }
|    elseif ($Asset.PSObject.Properties['Metadata'])  { $meta = $Asset.PSObject.Properties['Metadata'].Value }
|
|    function _flattenList($v) {
|        if ($null -eq $v) { return @() }
|        if ($v -is [string]) {
|            $s = [string]$v
|            # PS 5.1 note -- `@(pipeline | ConvertFrom-Json)` collapses to a SINGLE element on 5.1
|            # (7 unrolls). This line is CORRECT anyway, but only because `return` unrolls a second
|            # time. Verified on 5.1.20348: this form yields the real element count. Do NOT copy the
|            # shape into a plain ASSIGNMENT (`$x = @(... | ConvertFrom-Json)`) -- that keeps the
|            # collapse and hands you one opaque array. See Invoke-Enrich.ps1's signals_json parse.
|            if ($s.StartsWith('[')) { try { return @($s | ConvertFrom-Json -ErrorAction Stop) } catch { return @($s -split '[,;]\s*') } }
|            return @($s -split '[,;]\s*')
|        }
|        if ($v -is [System.Collections.IEnumerable]) { return @($v) }
|        return @($v)
|    }
|    function _flattenDict($obj) {
|        # Returns @( @{k=..; v=..}, ... ) for a hashtable / pscustomobject / JSON-string dict.
|        if ($null -eq $obj) { return @() }
|        if ($obj -is [string]) { try { $obj = $obj | ConvertFrom-Json -ErrorAction Stop } catch { return @() } }
|        $out = @()
|        if ($obj -is [System.Collections.IDictionary]) {
|            foreach ($k in $obj.Keys) { $out += @{ k=[string]$k; v=[string]$obj[$k] } }
|        } elseif ($obj.PSObject -and $obj.PSObject.Properties) {
|            foreach ($p in $obj.PSObject.Properties) { $out += @{ k=[string]$p.Name; v=[string]$p.Value } }
|        }
|        return $out
|    }
|
|    # MDE machine tags (value-only)
|    foreach ($t in (_flattenList (Get-SIAssetField -Asset $Asset -Name 'MDE_MachineTags'))) {
|        if ($t) { [void]$pairs.Add(@{ Key=$null; Value=[string]$t; Source='mde' }) }
|    }
|
|    # EG rawData.deviceDynamicTags / deviceManualTags / tags (mix shapes)
|    $egRaw = Get-SIAssetField -Asset $Asset -Name 'EG_RawData'
|    if (-not $egRaw) {
|        $egRawJson = Get-SIAssetField -Asset $Asset -Name 'AZ_PropertiesRawJson'
|        if ($egRawJson -is [string]) {
|            try {
|                $parsed = $egRawJson | ConvertFrom-Json -ErrorAction Stop
|                $egRaw = if ($parsed.PSObject.Properties['rawData']) { $parsed.rawData } else { $parsed }
|            } catch {}
|        }
|    }
|    if ($egRaw) {
|        foreach ($f in @('deviceDynamicTags','deviceManualTags')) {
|            if ($egRaw.PSObject.Properties[$f]) {
|                foreach ($t in @($egRaw.$f)) { if ($t) { [void]$pairs.Add(@{ Key=$null; Value=[string]$t; Source='eg' }) } }
|            }
|        }
|        if ($egRaw.PSObject.Properties['tags']) {
|            foreach ($p in (_flattenDict $egRaw.tags)) { [void]$pairs.Add(@{ Key=$p.k; Value=$p.v; Source='eg' }) }
|        }
|    }
|
|    # Entra extensionAttribute1..15
|    for ($i = 1; $i -le 15; $i++) {
|        $v = Get-SIAssetField -Asset $Asset -Name ("ENTRA_ExtensionAttribute$i")
|        if ($v) { [void]$pairs.Add(@{ Key=("extensionAttribute$i"); Value=[string]$v; Source='entra' }) }
|    }
|    # Entra onPremisesExtensionAttributes (key:value dict)
|    foreach ($p in (_flattenDict (Get-SIAssetField -Asset $Asset -Name 'ENTRA_OnPremisesExtensionAttributes'))) {
|        [void]$pairs.Add(@{ Key=$p.k; Value=$p.v; Source='entra' })
|    }
|
|    # ARM tags directly on the resource (azure engine)
|    foreach ($p in (_flattenDict (Get-SIAssetField -Asset $Asset -Name 'AZ_TagsJson'))) {
|        [void]$pairs.Add(@{ Key=$p.k; Value=$p.v; Source='arm' })
|    }
|
|    # ARM tags via parent chain (cross-engine: endpoint linked to Azure VM, etc.)
|    $resId = Get-SIAssetField -Asset $Asset -Name 'AZ_ResourceId'
|    if (-not $resId) { $resId = Get-SIAssetField -Asset $Asset -Name 'MDE_AzureResourceId' }
|    if (-not $resId) { $resId = Get-SIAssetField -Asset $Asset -Name 'AzureResourceId' }
|    if ($resId) {
|        $idx = if (Get-Variable -Name SIRuleIndexes -Scope Script -ErrorAction SilentlyContinue) { $script:SIRuleIndexes.parentChain } else { $null }
|        if ($idx) {
|            $rid = ([string]$resId).ToLower()
|            $chain = @()
|            if ($idx.ContainsKey($rid)) { $chain += $idx[$rid] }
|            if ($rid -match '^(/subscriptions/[^/]+/resourcegroups/[^/]+)') {
|                $rgKey = $matches[1].ToLower()
|                if ($idx.ContainsKey($rgKey)) { $chain += $idx[$rgKey] }
|            }
|            if ($rid -match '^(/subscriptions/[^/]+)') {
|                $subKey = $matches[1].ToLower()
|                if ($idx.ContainsKey($subKey)) { $chain += $idx[$subKey] }
|            }
|            foreach ($t in $chain) { [void]$pairs.Add(@{ Key=[string]$t.tag; Value=[string]$t.value; Source=('arm:' + $t.level) }) }
|        }
|    }
|
|    # CMDB-folded fields (Reconcile stamps Metadata.CMDB_<col> = value)
|    if ($meta) {
|        $cmdbKeys = if ($meta -is [System.Collections.IDictionary]) { @($meta.Keys) } else { @($meta.PSObject.Properties.Name) }
|        foreach ($k in $cmdbKeys) {
|            if ($k -like 'CMDB_*') {
|                $val = if ($meta -is [System.Collections.IDictionary]) { $meta[$k] } else { $meta.$k }
|                if ($val) { [void]$pairs.Add(@{ Key=$k.Substring(5); Value=[string]$val; Source='cmdb' }) }
|            }
|        }
|    }
|
|    # AD security-group memberships (placeholder for the AD enricher -- value-only)
|    foreach ($t in (_flattenList (Get-SIAssetField -Asset $Asset -Name 'AD_GroupMemberships'))) {
|        if ($t) { [void]$pairs.Add(@{ Key=$null; Value=[string]$t; Source='ad' }) }
|    }
|
|    return $pairs
|}
|
|function Test-SIKind_hasTag {
|    <# unified cross-source tag matcher. Three modes (per
|       user-direction "tags are defined in 2 ways - value (only) and
|       key:value"):
|
|         tag only           -> key presence (any source has that key with non-empty value)
|         value only         -> value presence (any list contains it OR any dict has it as a value)
|         tag + value        -> exact pair (key:value carrier) OR literal "key:value" /
|                                "key=value" string in a value-only carrier
|
|       Refusal: plain `value: '<single-string>'` with no `match:` operator
|       is too broad (would match any 'cmdb:1' / 'Tier:1' / etc. lookalike
|       in any source). Author must use match: in/regex/like, OR pair with
|       `tag:`. Value alone with match: in [list] is allowed.
|
|       Operator support: equal | like | has | regex | matches |
|       in | startswith | endswith. Default 'equal'. All comparisons are
|       case-insensitive on both key and value.
|
|       Optional: `sources: ['mde','eg','entra','arm','cmdb','ad']` -- restrict
|       which carriers contribute. Default: all. #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|
|    $tagKey = if ($Args.tag)   { [string]$Args.tag }   else { $null }
|    $hasVal = $false
|    $tagVal = $null
|    if ($Args -is [System.Collections.IDictionary]) {
|        if ($Args.Contains('value')) { $hasVal = $true; $tagVal = $Args['value'] }
|    } elseif ($Args.PSObject.Properties['value']) {
|        $hasVal = $true; $tagVal = $Args.value
|    }
|    $op = if ($Args.match) { [string]$Args.match } else { 'equal' }
|
|    if ([string]::IsNullOrWhiteSpace($tagKey) -and -not $hasVal) {
|        Write-Verbose 'hasTag: refusing rule with neither tag nor value'
|        return $false
|    }
|    # Refuse value-only with op=equal AND value is a single scalar -- too broad
|    if ([string]::IsNullOrWhiteSpace($tagKey) -and $op -eq 'equal' -and $hasVal -and -not ($tagVal -is [System.Collections.IEnumerable] -and -not ($tagVal -is [string]))) {
|        Write-Verbose 'hasTag: refusing value-only equal rule (use match: in/regex/like or pair with tag:)'
|        return $false
|    }
|
|    $pairs = Get-SIAssetTagPairs -Asset $Asset
|    if ($pairs.Count -eq 0) { return $false }
|
|    # Optional source restriction
|    if ($Args.sources) {
|        $allow = @($Args.sources | ForEach-Object { ([string]$_).ToLowerInvariant() })
|        $pairs = @($pairs | Where-Object {
|            $src = ([string]$_.Source).ToLowerInvariant()
|            $base = $src.Split(':')[0]
|            ($src -in $allow) -or ($base -in $allow)
|        })
|    }
|
|    foreach ($p in $pairs) {
|        $pKey = [string]$p.Key
|        $pVal = [string]$p.Value
|        $isValueOnly = [string]::IsNullOrWhiteSpace($pKey)
|
|        if ($tagKey -and $hasVal) {
|            # MODE 3: exact key:value pair
|            if (-not $isValueOnly -and ($pKey -ieq $tagKey) -and (Test-SIMatchOperator -Actual $pVal -Expected $tagVal -Op $op)) { return $true }
|            # MODE 3 fallback: literal "key:value" or "key=value" inside a value-only list
|            if ($isValueOnly -and ($tagVal -isnot [System.Collections.IEnumerable] -or $tagVal -is [string])) {
|                $literal1 = ('{0}:{1}' -f $tagKey, $tagVal)
|                $literal2 = ('{0}={1}' -f $tagKey, $tagVal)
|                if (($pVal -ieq $literal1) -or ($pVal -ieq $literal2)) { return $true }
|            }
|        } elseif ($tagKey) {
|            # MODE 1: key presence
|            if (-not $isValueOnly -and ($pKey -ieq $tagKey) -and -not [string]::IsNullOrWhiteSpace($pVal)) { return $true }
|            # value-only carrier: literal "key:" / "key=" prefix
|            if ($isValueOnly) {
|                $prefixColon = ($tagKey + ':')
|                $prefixEqual = ($tagKey + '=')
|                if ($pVal.StartsWith($prefixColon, [StringComparison]::OrdinalIgnoreCase) -or
|                    $pVal.StartsWith($prefixEqual, [StringComparison]::OrdinalIgnoreCase)) { return $true }
|            }
|        } else {
|            # MODE 2: value presence anywhere (with operator -- usually 'in' or 'regex')
|            if (Test-SIMatchOperator -Actual $pVal -Expected $tagVal -Op $op) { return $true }
|        }
|    }
|    return $false
|}
|
|function Test-SIKind_mostFrequentUserTier {
|    <# Reads MostFrequentUserTier from asset Metadata (stamped by Enrich/
|       Get-SIBulkDeviceUserCorrelation from logon-graph + SI_Identity_Profile_CL).
|       Returns $true when the value is in the rule's tierValues list.
|       Used by AssetProfileByLogonUser to inherit endpoint tier from frequent
|       logon user (admin's PC -> T1, T2 user -> T2, T3 user -> T3). #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $v = Get-SIAssetField -Asset $Asset -Name 'MostFrequentUserTier'
|    if ($null -eq $v -or "$v" -eq '') { return $false }
|    try { $userTier = [int]$v } catch { return $false }
|    $vals = @($Args.tierValues)
|    if ($vals.Count -eq 0) { return $false }
|    foreach ($t in $vals) { if ([int]$t -eq $userTier) { return $true } }
|    return $false
|}
|
|function Test-SIKind_assetKind {
|    <# kind: assetKind
|         kinds: [endpoint, identity, azure, publicip]
|       Matches when the asset's kind (SI_AssetKind, stamped by whoever evaluates the rule -- the default tier
|       resolver, Resolve-SIDefaultTier.ps1) is in the list. Used by the default tier rule
|       (asset-profiling-enrichment/shared/AssetProfileByDefaultTier.locked.yaml) to give each asset kind its own
|       default. An asset without a kind never matches. #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $k = [string](Get-SIAssetField -Asset $Asset -Name 'SI_AssetKind')
|    if ([string]::IsNullOrWhiteSpace($k)) { return $false }
|    $vals = @($Args.kinds)
|    if ($vals.Count -eq 0) { $vals = @($Args.values) }
|    foreach ($v in $vals) {
|        foreach ($one in @(([string]$v) -split '[,;]\s*')) { if ($one.Trim() -and $one.Trim() -ieq $k.Trim()) { return $true } }
|    }
|    return $false
|}
|
|function Test-SIKind_egKustoQuery {
|    <# Consults per-rule kustoSets (built by Build-SIEgKustoQuerySets at IN).
|       Caller (Invoke-SIDetect) injects __ruleId into Args so we know which set. #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $ruleId = [string]$Args.__ruleId
|    if ([string]::IsNullOrWhiteSpace($ruleId)) { return $false }
|
|    $sets = if (Get-Variable -Name SIRuleIndexes -Scope Script -ErrorAction SilentlyContinue) { $script:SIRuleIndexes.kustoSets } else { $null }
|    if (-not $sets -or -not $sets.ContainsKey($ruleId)) { return $false }
|    $set = $sets[$ruleId]
|
|    foreach ($f in @('PrimaryEntityId','EG_NodeId','MDE_DeviceId','AccountObjectId')) {
|        $v = [string](Get-SIAssetField -Asset $Asset -Name $f)
|        if ($v -and $set.Contains($v.ToLower())) { return $true }
|    }
|    return $false
|}
|
|# ----------------------------------------------------------------------------
|# Registry (kind name -> handler function name)
|# ----------------------------------------------------------------------------
|
|# AUDIT #35 -- the 'nameMatches' entry below was CODE that a bulk comment-rewrite
|# turned into a COMMENT, and it shipped that way for the whole v2.2 lifetime.
|# 0412976e added it under a header comment naming the preview it landed in. The
|# v2.2.0 flatten (536e1405, 2026-05-04) stripped the version framing out of that
|# header and JOINED THE TWO LINES, so the registration became the tail of a
|# comment. The handler (Test-SIKind_nameMatches, above) was never touched -- only
|# its registration vanished, so Invoke-SIDetect treated the kind as unknown and
|# skipped it: 95 detections across 93 rule files silently lost their name-pattern
|# arm, on every customer, for every v2.2 release. Same family as #29 (a bulk
|# rewrite corrupting a file nobody re-read) and the same fail-open shape -- the
|# only trace was a Write-Verbose that prints for nobody.
|#
|# Kept OUTSIDE the hashtable on purpose: SI-RuleKindRegistry.Tests.ps1 scans the
|# registry BODY for a commented-out entry, which is the corruption's signature.
|# Prose inside the body would be indistinguishable from the thing being detected.
|$script:SIKindRegistry = @{
|    'nameMatches'                   = 'Test-SIKind_nameMatches'
|    'osPlatform'                    = 'Test-SIKind_osPlatform'
|    'hasMdeMachineGroupTag'         = 'Test-SIKind_hasMdeMachineGroupTag'
|    'egDetectedRoles'               = 'Test-SIKind_egDetectedRoles'
|    'hasEntraExtensionAttributeTag' = 'Test-SIKind_hasEntraExtensionAttributeTag'
|
|    # Stubbed -- implemented in alongside their bulk-source builders:
|    'hasSoftwareInstalled'          = 'Test-SIKind_hasSoftwareInstalled'
|    'groupMembership'               = 'Test-SIKind_groupMembership'
|    'hasAzureTagDirectOrParent'     = 'Test-SIKind_hasAzureTagDirectOrParent'
|    'egKustoQuery'                  = 'Test-SIKind_egKustoQuery'
|    'mostFrequentUserTier'          = 'Test-SIKind_mostFrequentUserTier'
|
|    # IP-subnet match for CMDB / role mapping
|    'ipInRange'                     = 'Test-SIKind_ipInRange'
|
|    # cross-source-of-truth tag matcher (works on endpoint, identity,
|    # azure -- walks MDE / EG / Entra / ARM / CMDB / AD carriers in one shot)
|    'hasTag'                        = 'Test-SIKind_hasTag'
|
|    # the asset's kind (endpoint / identity / azure / publicip) -- the default tier rule's per-kind detections
|    'assetKind'                     = 'Test-SIKind_assetKind'
|}
|
|function Get-SIKindRegistry { $script:SIKindRegistry }
|
|# ----------------------------------------------------------------------------
|# Detection + rule evaluators
|# ----------------------------------------------------------------------------
|
|function Invoke-SIDetect {
|    <#
|        Walks the `any` (OR-semantics) or `all` (AND-semantics) list of
|        kind specifications inside one detection. Returns $true on first
|        match (any) or first non-match (all).
|
|        $RuleId is optional context -- injected into each handler's Args
|        as `__ruleId` so per-rule index handlers (egKustoQuery) can look
|        up their pre-fetched set.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)]$Asset,
|        [Parameter(Mandatory)]$Detect,
|        [Parameter()][string]$RuleId
|    )
|
|    # Detect comes from YAML as @{ any = [...] } or @{ all = [...] }
|    $any = $false
|    $all = $false
|    $list = $null
|    if ($Detect.any) { $list = @($Detect.any); $any = $true }
|    elseif ($Detect.all) { $list = @($Detect.all); $all = $true }
|    if (-not $list) { return $false }
|
|    foreach ($spec in $list) {
|        $kind = [string]$spec.kind
|        if ([string]::IsNullOrWhiteSpace($kind)) { continue }
|        if (-not $script:SIKindRegistry.ContainsKey($kind)) {
|            Write-Verbose ('Invoke-SIDetect: unknown kind {0} -- skipping' -f $kind)
|            if ($all) { return $false }   # all-mode: unknown kind = AND-failure
|            continue
|        }
|        $handler = $script:SIKindRegistry[$kind]
|        $argsHash = @{}
|        # Strip 'kind' from the spec; everything else flows to the handler as Args
|        if ($spec -is [System.Collections.IDictionary]) {
|            foreach ($k in $spec.Keys) { if ($k -ne 'kind') { $argsHash[$k] = $spec[$k] } }
|        } else {
|            foreach ($p in $spec.PSObject.Properties) { if ($p.Name -ne 'kind') { $argsHash[$p.Name] = $p.Value } }
|        }
|        if ($RuleId) { $argsHash['__ruleId'] = $RuleId }
|        try {
|            $hit = & $handler -Asset $Asset -Args $argsHash
|        } catch {
|            Write-Verbose ('Invoke-SIDetect: handler {0} threw: {1}' -f $handler, $_.Exception.Message)
|            $hit = $false
|        }
|        if ($any -and $hit) { return $true }
|        if ($all -and -not $hit) { return $false }
|    }
|    return ($all)   # all-mode: reaching the end means every spec matched
|}
|
|function Invoke-SIRuleEval {
|    <#
|        Evaluates a single rule (one [pscustomobject] from Get-SIRuleSet)
|        against one asset. Walks $Rule.Detections in array order (first
|        match wins per ARCHITECTURE.md § 7). Returns either:
|          $null                        when no detection matched
|          [pscustomobject] @{          when a detection matched
|              RuleId        = $Rule.Id
|              DetectionId   = $matchedDet.Id
|              Set           = $matchedDet.Set      # tier / purpose / category / cmdb*
|              MatchedKinds  = @( ... )             # which kinds inside the match fired
|          }
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)]$Asset,
|        [Parameter(Mandatory)]$Rule
|    )
|
|    if ($Rule.Mode -eq 'disable') { return $null }
|    if (-not $Rule.Detections -or @($Rule.Detections).Count -eq 0) { return $null }
|
|    # Asset name used for per-detection ExcludeAssets matching. Pulled
|    # once outside the detection loop because the asset is constant for
|    # this call. Fallbacks (DeviceName -> FQDN -> ComputerName) cover
|    # the schema differences across MDE / EG / Entra / ARM inputs.
|    $assetName = $null
|    foreach ($f in 'Name','DeviceName','FQDN','ComputerName','HostName') {
|        $v = Get-SIAssetField -Asset $Asset -Name $f
|        if (-not [string]::IsNullOrWhiteSpace([string]$v)) { $assetName = [string]$v; break }
|    }
|
|    foreach ($det in $Rule.Detections) {
|        # Per-detection ExcludeAssets: device names / wildcards that
|        # should be skipped by THIS detection even if the detect block
|        # would match. Use when you can't remove the signal (legacy
|        # software installed for compatibility reasons, etc.) but want
|        # the asset out-of-scope for THIS specific detection. CI -like
|        # match supports * and ? wildcards. Exact strings work too.
|        if ($det.ExcludeAssets -and @($det.ExcludeAssets).Count -gt 0 -and $assetName) {
|            $skip = $false
|            foreach ($pat in $det.ExcludeAssets) {
|                if ($assetName -like $pat) { $skip = $true; break }
|            }
|            if ($skip) { continue }
|        }
|
|        $hit = Invoke-SIDetect -Asset $Asset -Detect $det.Detect -RuleId $Rule.Id
|        if ($hit) {
|            return [pscustomobject]@{
|                RuleId      = $Rule.Id
|                DetectionId = $det.Id
|                Set         = $det.Set
|            }
|        }
|    }
|    return $null
|}
|
|# ----------------------------------------------------------------------------
|# Test harness (no engine integration -- run interactively)
|# ----------------------------------------------------------------------------
|
|function Test-SIRuleEval {
|    <#
|        Quick validator: loads all rules for an engine via Get-SIRuleSet,
|        evaluates each against the supplied $Asset, returns matching rules
|        as a list. Useful for "would this asset get tagged?" pre-flight.
|
|        Usage:
|          $sample = @{ Name='dc01'; MDE_MachineGroup='DomainControllers' }
|          Test-SIRuleEval -Engine endpoint -Asset $sample
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)]
|        [ValidateSet('endpoint','identity','azure','publicip')]
|        [string]$Engine,
|
|        [Parameter(Mandatory)]
|        $Asset
|    )
|    . (Join-Path $PSScriptRoot 'Get-SIRuleSet.ps1')
|    $rules = Get-SIRuleSet -Engine $Engine
|    $hits = New-Object System.Collections.ArrayList
|    foreach ($r in $rules) {
|        $hit = Invoke-SIRuleEval -Asset $Asset -Rule $r
|        if ($hit) { [void]$hits.Add($hit) }
|    }
|    Write-Verbose ('Test-SIRuleEval: {0} rules evaluated, {1} matched' -f $rules.Count, $hits.Count)
|    return $hits.ToArray()
|}
'@ }
$__siSupportFiles['engine/asset-profiling/shared/Get-SIRuleSet.ps1'] = @{ Sha256 = '5c76912d582b83f1f0ea8ea924fdae87c5298f358e28bca31f99b691c1060ac3'; Text = @'
|#Requires -Version 5.1
|<#
|    Get-SIRuleSet.ps1
|
|    New rule loader for the AssetProfileBy* rules introduced in (ARCHITECTURE.md § 7). Reads YAMLs from:
|
|      v2.2/asset-profiling-enrichment/<engine>/AssetProfileBy*/*.yaml          (locked, ships in repo)
|      v2.2/asset-profiling-enrichment/<engine>/AssetProfileBy*.yaml            (locked, single-file flavour)
|      v2.2/asset-profiling-enrichment/shared/AssetProfileBy*.yaml
|      v2.2/asset-profiling-enrichment/<engine>/AssetProfileBy*/*.yaml   (customer overrides)
|      v2.2/asset-profiling-enrichment/<engine>/AssetProfileBy*.yaml     (customer overrides)
|      v2.2/asset-profiling-enrichment/shared/AssetProfileBy*.yaml
|
|    appliesTo accepts:
|      'endpoint' | 'identity' | 'azure' | 'publicip' (single)
|      'any'                                          (loads in every engine)
|      ['endpoint','identity']                        (YAML list)
|      'endpoint,identity'                            (comma-separated)
|
|    Returns array of [pscustomobject] in the schema:
|
|        Id          : <filename-basename, must equal $y.id>     -- string
|        AppliesTo   : 'endpoint' | 'identity' | 'azure'         -- string
|        Mode        : 'locked' | 'append' | 'merge' | 'overwrite' | 'disable'
|        Purpose     : free text                                 -- string
|        Category    : group label (e.g. 'Server Roles')         -- string
|        Description : multi-line                                -- string
|        Detections  : array of [pscustomobject] per detection block:
|            Id      : <inner detection id, mirrors file id when single-detection>
|            Detect  : @{ any=[detect-kinds] } OR @{ all=[detect-kinds] }
|            Set     : @{ Tier=N; Purpose='...'; Category='...'; cmdbId='...'; ... }
|        File        : repo-relative path, for diagnostics
|        Folder      : 'rules' | 'rules-custom'
|        SchemaShape : 'AssetProfileBy'                          -- discriminator
|                      so callers can tell new-loader rules apart
|                      from legacy Get-SIPostureRules output.
|
|    Backward compat note:
|
|      This loader does NOT replace Get-SIPostureRules. Both run side-by-side.
|      Callers opt in to the new loader explicitly. Old engine code that
|      reads from posture-rules-locked/ continues to work unchanged.
|
|      Future introduces RuleEval.ps1 (the kind: registry +
|      bulk-source builder). Until then, Get-SIRuleSet output is for
|      inspection / lint / new-stage prototyping only.
|
|    Locked + custom merge:
|
|      one rule per id: the highest-ranked custom file is combined with the
|      shipped (*.locked.yaml) rule of the same id by its mode -- overwrite /
|      append / merge / disable (#470, Merge-SIRuleOverride below).
|#>
|
|function Get-SIRuleSet {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)]
|        [ValidateSet('endpoint','identity','azure','publicip')]
|        [string]$Engine,
|
|        # Pass to restrict to a single AssetProfileBy* method (folder or file
|        # basename, e.g. 'AssetProfileByApplicationServiceDetection',
|        # 'AssetProfileByExtensionAttributes'). Empty = all methods.
|        [Parameter()]
|        [string]$Method,
|
|        # Pass $false to skip rules-custom/. Default loads both locked + custom.
|        [Parameter()]
|        [bool]$IncludeCustom = $true,
|
|        # AUDIT #29 -- test seam. Overrides the solution root this function would otherwise
|        # derive from $PSScriptRoot, so the rule-loading behaviour (notably the parse-failure
|        # reporting below) can be exercised against a scratch folder instead of the real
|        # enrichment tree. Production callers never pass it.
|        [Parameter()]
|        [string]$SolutionRootOverride,
|
|        # AUDIT #34 phase 1 -- OPERATOR DATA OVERLAY.
|        # An external directory holding the operator's own *.custom.yaml rules, laid out with
|        # the same <engine>/ + shared/ subfolders as asset-profiling-enrichment/. When set, its
|        # rules load ALONGSIDE the shipped tree and WIN on a colliding id.
|        #
|        # Why: today a customer's rules live INSIDE the directory the sync overwrites, and they
|        # survive only because they happen to be absent from the update zip -- not because
|        # anything protects them. One tracked file with a colliding name would overwrite a
|        # customer's rule, and a .gitignore slip publishes their data to the public mirror.
|        # An overlay puts operator data outside the code tree, so the shipped tree is pure code
|        # and a fresh clone behaves identically to a real install.
|        #
|        # Defaults to $global:SI_EnrichmentDataRoot so config sets it once. UNSET = every
|        # existing installation behaves exactly as before; this is opt-in by construction.
|        [Parameter()]
|        [string]$EnrichmentDataRoot,
|
|        # The DEFAULT tier rule(s) -- a rule file with `fallback: true` (asset-profiling-enrichment/shared/
|        # AssetProfileByDefaultTier.locked.yaml). A fallback rule is not one more vote in the MIN across matched
|        # rules: it applies only when nothing else gave the asset a tier (Resolve-SIDefaultTier.ps1). So the normal
|        # call leaves fallback rules OUT, and -Fallback returns ONLY them (plus every turned-off rule, so the caller
|        # can tell "the default rule is turned off" from "there is no default rule here").
|        [Parameter()]
|        [switch]$Fallback
|    )
|
|    # SecurityInsight's own YAML reader (no powershell-yaml module).
|    if (-not (Get-Command -Name ConvertFrom-SIYaml -ErrorAction SilentlyContinue)) {
|        . (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) '_shared/SI-Yaml.ps1')
|    }
|
|    # Resolve v2.2 root from this script's location.
|    # $PSScriptRoot = v2.2/engine/asset-profiling/shared -> three parents up = v2.2 root.
|    $siRoot = if (-not [string]::IsNullOrWhiteSpace($SolutionRootOverride)) { $SolutionRootOverride }
|              else { Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) }
|
|    # rules now live under asset-profiling-enrichment/<engine>/
|    # (locked + custom coexist in the same dir, distinguished by file suffix
|    # *.locked.yaml vs *.custom.yaml -- handled by the .custom/.locked-strip
|    # logic in the file-loop below). Old layout with separate rules/ +
|    # rules-custom/ folders is deprecated -- the doc comment at the top of
|    # this file already says asset-profiling-enrichment/, the code just never
|    # got updated. -IncludeCustom remains honored at the file-suffix level.
|    $folders = @('asset-profiling-enrichment')
|
|    $results = New-Object System.Collections.ArrayList
|    $loaded  = 0
|    $skipped = 0
|    # AUDIT #29 -- parse failures tracked apart from the benign skips; see the catch below.
|    $parseFailed = 0
|    $parseFailedNames = New-Object System.Collections.Generic.List[string]
|
|    # also walk rules/shared/ + rules-custom/shared/ for cross-engine rules.
|    # Each rules root contributes two scan folders: <Engine>/ and shared/.
|    $scanRoots = @()
|    # SecurityInsight Pro (Phase C): when the settings layer materialised the rules from the database's TEMPLATES into the
|    # overlay (shipped rules as *.locked.yaml, overrides as *.custom.yaml, turned-off rules left out), the overlay IS the
|    # rule set and the shipped tree is not read. Only together with an overlay that exists -- otherwise exactly as before.
|    $proRulesOnly = ([bool]$global:SI_ProRulesFromSql) -and [string]::IsNullOrWhiteSpace($SolutionRootOverride) -and
|                    -not [string]::IsNullOrWhiteSpace([string]$global:SI_EnrichmentDataRoot) -and (Test-Path -LiteralPath ([string]$global:SI_EnrichmentDataRoot)) -and
|                    ([string]::IsNullOrWhiteSpace($EnrichmentDataRoot) -or $EnrichmentDataRoot -eq [string]$global:SI_EnrichmentDataRoot)
|    if ($proRulesOnly) { $folders = @() }
|    foreach ($folder in $folders) {
|        foreach ($sub in @($Engine, 'shared')) {
|            $p = Join-Path $siRoot (Join-Path $folder $sub)
|            if (Test-Path $p) { $scanRoots += [pscustomobject]@{ Folder = $folder; Path = $p; Sub = $sub; Base = $siRoot; Source = 'tree' } }
|        }
|    }
|
|    # AUDIT #34 phase 1 -- the operator data overlay, appended AFTER the shipped tree so a
|    # colliding id resolves overlay-wins in the dedup below. Same <engine>/ + shared/ layout,
|    # so an operator moves files across without renaming anything.
|    $overlayRoot = if (-not [string]::IsNullOrWhiteSpace($EnrichmentDataRoot)) { $EnrichmentDataRoot }
|                   elseif (-not [string]::IsNullOrWhiteSpace([string]$global:SI_EnrichmentDataRoot)) { [string]$global:SI_EnrichmentDataRoot }
|                   else { $null }
|    $overlayActive = $false
|    if (-not [string]::IsNullOrWhiteSpace($overlayRoot)) {
|        if (-not (Test-Path -LiteralPath $overlayRoot)) {
|            # Configured but absent is NOT a silent fall-back to the in-tree rules. That would be
|            # #29's shape a third time: the run would look clean while every operator rule the
|            # overlay was supposed to supply is missing.
|            Write-Warning ("Get-SIRuleSet: SI_EnrichmentDataRoot is set to '{0}' but that path does not exist. NO overlay rules were loaded for engine '{1}' -- only the shipped tree is in force. Fix the path or clear the setting." -f $overlayRoot, $Engine)
|        } else {
|            $overlayActive = $true
|            foreach ($sub in @($Engine, 'shared')) {
|                $p = Join-Path $overlayRoot $sub
|                if (Test-Path $p) { $scanRoots += [pscustomobject]@{ Folder = 'overlay'; Path = $p; Sub = $sub; Base = $overlayRoot; Source = 'overlay' } }
|            }
|        }
|    }
|
|    foreach ($root in $scanRoots) {
|        $folder      = $root.Folder
|        $engineRoot  = $root.Path
|        $isShared    = ($root.Sub -eq 'shared')
|        $ruleBase    = $root.Base       # #34 -- File is relative to the root the file came from
|        $ruleSource  = $root.Source     # 'tree' | 'overlay'
|
|        # Both shapes are legal:
|        #   1) <engineRoot>/<MethodName>.yaml                     (single file)
|        #   2) <engineRoot>/<MethodName>/<roleName>.yaml          (folder per method)
|        # Walk both with one Get-ChildItem -Recurse.
|        $yamls = @(Get-ChildItem -Path $engineRoot -Filter '*.yaml' -Recurse -File -ErrorAction SilentlyContinue)
|
|        foreach ($f in $yamls) {
|            # ALLOW-LIST -- a rule is *.locked.yaml (shipped) or *.custom.yaml
|            # (customer override). NOTHING else in this tree is a rule: samples,
|            # editor backups, "- Copy" duplicates, .gitkeep and _scratch files
|            # must never load.
|            #
|            # This used to be a blacklist ('_*', '.*', '*.sample.*'). It let
|            # 'ADDomainController.custom.sample - Copy.yaml' through, because
|            # -like '*.sample.*' needs the literal '.sample.' and that name reads
|            # '.sample - Copy.yaml'. The file loaded as a live rule and -- on any
|            # host without its own ADDomainController.custom.yaml -- WON over the
|            # shipped ADDomainController.locked.yaml, making sample content the
|            # effective detection rule. Verified, and it shipped in v2.2.405.
|            # A blacklist has to predict every wrong name; an allow-list does not.
|            if ($f.Name -notlike '*.locked.yaml' -and $f.Name -notlike '*.custom.yaml') { $skipped++; continue }
|            # honor -IncludeCustom at the file-suffix level since
|            # locked + custom now share one folder.
|            if (-not $IncludeCustom -and $f.Name -like '*.custom.yaml') { continue }
|
|            # Optional method filter
|            if ($Method) {
|                # Match either: file basename = $Method, or parent folder name = $Method
|                $parentName = (Split-Path -Parent $f.FullName | Split-Path -Leaf)
|                if ($f.BaseName -ne $Method -and $parentName -ne $Method) { continue }
|            }
|
|            try {
|                $ruleText = Get-Content -Raw $f.FullName
|                # #908: a custom rule that still carries the shipped sample's header is the EXAMPLE copied as it was (on one
|                # install the IP-subnet sample made a network device a Tier 0 "Domain Controller"). It is loaded as before --
|                # the run never drops a rule on suspicion -- but it is said every run. Same marker as Test-SIRuleSampleMarker.
|                if ($f.Name -like '*.custom.yaml' -and $ruleText -match '(?m)^[ \t]*#[ \t]*SAMPLE[ \t]*/[ \t]*TEMPLATE\b') {
|                    Write-Warning ("Get-SIRuleSet: {0} is the shipped EXAMPLE (it still starts with the '# SAMPLE / TEMPLATE' header) and is loaded as a live rule -- review it: check its detections (example names, subnets, tiers) and remove the header, or remove the file" -f $f.Name)
|                }
|                $obj = ConvertFrom-SIYaml -Yaml $ruleText -SourceName $f.FullName
|            } catch {
|                Write-Warning ('Get-SIRuleSet: skipping {0} (parse error: {1})' -f $f.Name, $_.Exception.Message)
|                $skipped++
|                # AUDIT #29 -- counted SEPARATELY from $skipped on purpose. Most skips above are
|                # deliberate and benign (sample files, foreign schemas, engine filters), so a
|                # blanket "skipped=N" says nothing. A file that fails to PARSE is different: it is
|                # a rule the operator wrote and believes is in force, and it is not.
|                $parseFailed++
|                [void]$parseFailedNames.Add($f.Name)
|                continue
|            }
|
|            # Required: id (must match filename basename per ARCHITECTURE.md § 7).
|            # customer files in rules-custom/ may use the .custom.yaml
|            # naming convention (AssetProfileByTags.custom.yaml). Strip the .custom
|            # infix from basename before id-comparison so the override file pairs
|            # cleanly with the locked file's id.
|            #
|            # Silently skip foreign schemas that live in the same engine folder
|            # but belong to other engines (e.g. AssetTagging.custom.yaml uses
|            # the asset-tagging-engine shape `AssetTagging: [...]` -- not a
|            # rule shape). These should not produce a noisy WARN every run.
|            # ConvertFrom-Yaml returns a Hashtable, so .PSObject.Properties lists the
|            # HASHTABLE's own members (IsReadOnly, Keys, Values, Count, ...) and never
|            # the YAML keys -- this test was ALWAYS false. The AssetTagging files fell
|            # through to the 'no id field' branch instead and emitted a misleading
|            # WARNING every run, which is exactly the noise this guard exists to
|            # prevent. Ask the dictionary itself.
|            if ($obj -is [System.Collections.IDictionary] -and $obj.Contains('AssetTagging')) {
|                $skipped++; continue
|            }
|            $id = [string]$obj.id
|            if ([string]::IsNullOrWhiteSpace($id)) {
|                Write-Warning ('Get-SIRuleSet: skipping {0} (no id field)' -f $f.Name)
|                $skipped++; continue
|            }
|            $effectiveBaseName = $f.BaseName
|            if ($effectiveBaseName -like '*.custom') { $effectiveBaseName = $effectiveBaseName.Substring(0, $effectiveBaseName.Length - 7) }
|            elseif ($effectiveBaseName -like '*.locked') { $effectiveBaseName = $effectiveBaseName.Substring(0, $effectiveBaseName.Length - 7) }
|            if ($id -ne $effectiveBaseName) {
|                Write-Warning ("Get-SIRuleSet: id/filename mismatch in {0} (id='{1}', basename='{2}'). Per ARCHITECTURE.md § 7 the id MUST equal the file basename (or '<id>.custom'/'<id>.locked' in asset-profiling-enrichment/). Loading anyway." -f $f.Name, $id, $f.BaseName)
|            }
|
|            # appliesTo can be a string ('endpoint'), 'any', a comma-
|            # separated string ('endpoint,identity'), or a YAML list ([endpoint,
|            # identity]). Normalise to a [string[]] of lowercased engine names.
|            $appliesToList = @()
|            if ($null -eq $obj.appliesTo) {
|                # Per-engine folders default to that engine; shared/ defaults to 'any'.
|                $appliesToList = if ($isShared) { @('any') } else { @($Engine) }
|            } elseif ($obj.appliesTo -is [System.Collections.IEnumerable] -and -not ($obj.appliesTo -is [string])) {
|                $appliesToList = @($obj.appliesTo | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() })
|            } else {
|                $appliesToList = @(([string]$obj.appliesTo) -split '[,;]\s*' | ForEach-Object { $_.Trim().ToLowerInvariant() } | Where-Object { $_ })
|            }
|            $appliesTo = ($appliesToList -join ',')   # preserved for diagnostic output
|
|            # Engine-match: rule loads if appliesTo contains 'any' or the current Engine
|            $matchesEngine = ($appliesToList -contains 'any') -or ($appliesToList -contains $Engine.ToLowerInvariant())
|            if (-not $matchesEngine) {
|                if (-not $isShared) {
|                    # Engine-folder rule that explicitly targets a different engine -- legacy warning.
|                    Write-Warning ("Get-SIRuleSet: appliesTo='{0}' in {1} doesn't match folder engine='{2}', skipping" -f $appliesTo, $f.Name, $Engine)
|                }
|                # Shared-folder rules silently skip when the current engine isn't in their appliesTo list.
|                $skipped++; continue
|            }
|
|            $mode = if ($obj.mode) { [string]$obj.mode } else { 'locked' }
|
|            # Disable mode: customer wants this rule's locked counterpart suppressed.
|            # Surface in result so the merge step in can act on it.
|            if ($mode -eq 'disable') {
|                # #470: `detections:` listing ids turns off ONLY those shipped detections (the ids are all that is read)
|                $offIds = @(@($obj.detections) | Where-Object { $null -ne $_ -and $_.id } | ForEach-Object { [string]$_.id })
|                [void]$results.Add([pscustomobject]@{
|                    Id          = $id
|                    AppliesTo   = $appliesTo
|                    Mode        = 'disable'
|                    DisableDetections = $offIds
|                    Purpose     = $null
|                    Category    = $null
|                    Description = $null
|                    Detections  = @()
|                    File        = $f.FullName.Substring($ruleBase.Length).TrimStart('\','/')
|                    Folder      = $folder
|                    Source      = $ruleSource
|                    SchemaShape = 'AssetProfileBy'
|                    Fallback    = $false
|                })
|                $loaded++
|                continue
|            }
|
|            # Detections array — required for non-disable modes
|            $detections = New-Object System.Collections.ArrayList
|            if ($obj.detections) {
|                foreach ($d in $obj.detections) {
|                    $detId = if ($d.id) { [string]$d.id } else { $id }
|
|                    # Per-detection asset exclusion list. Read from
|                    # `excludeAssets:` on the detection (alias
|                    # `excludeNames:`). Accepted shapes:
|                    #   excludeAssets: ['my-old-box', '*-legacy-*']
|                    #   excludeAssets:
|                    #     - my-old-box
|                    #     - '*-legacy-*'
|                    # Comparison happens against the asset's Name field
|                    # (case-insensitive) in Invoke-SIRuleEval. Wildcards
|                    # supported via PowerShell -like (*, ?). Use this
|                    # when you can't remove the matching software /
|                    # signal from the asset itself but want the asset
|                    # out-of-scope FOR THIS DETECTION only -- the rule
|                    # continues to fire for every other asset.
|                    $exclude = @()
|                    $rawEx = if ($d.excludeAssets) { $d.excludeAssets } elseif ($d.excludeNames) { $d.excludeNames } else { $null }
|                    if ($rawEx) {
|                        if ($rawEx -is [System.Collections.IEnumerable] -and -not ($rawEx -is [string])) {
|                            $exclude = @($rawEx | ForEach-Object { [string]$_ } | Where-Object { $_ })
|                        } else {
|                            $exclude = @(([string]$rawEx) -split '[,;]\s*' | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|                        }
|                    }
|
|                    [void]$detections.Add([pscustomobject]@{
|                        Id            = $detId
|                        Detect        = $d.detect      # leave nested @{ any|all = [...]} as-is for RuleEval to consume
|                        Set           = $d.set
|                        ExcludeAssets = $exclude        # @() when not configured -- empty means "exclusion disabled"
|                    })
|                }
|            }
|
|            # osPlatformScope: optional per-rule list of OS classes the rule applies to.
|            # When non-empty, Invoke-Profile.ps1 Pass 2.5 buckets the rule into ONLY
|            # those OS-class buckets. When empty/missing, rule lands in EVERY bucket
|            # (unscoped) and runs against every asset. Without this field on the
|            # rule object, the bucketing optimization is silently disabled.
|            $osScope = @()
|            if ($obj.osPlatformScope) {
|                if ($obj.osPlatformScope -is [System.Collections.IEnumerable] -and -not ($obj.osPlatformScope -is [string])) {
|                    $osScope = @($obj.osPlatformScope | ForEach-Object { [string]$_ } | Where-Object { $_ })
|                } else {
|                    $osScope = @(([string]$obj.osPlatformScope) -split '[,;]\s*' | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|                }
|            }
|
|            [void]$results.Add([pscustomobject]@{
|                Id              = $id
|                AppliesTo       = $appliesTo
|                Mode            = $mode
|                osPlatformScope = $osScope
|                Purpose         = if ($obj.purpose)     { [string]$obj.purpose }     else { $null }
|                Category        = if ($obj.category)    { [string]$obj.category }    else { $null }
|                Description     = if ($obj.description) { [string]$obj.description } else { $null }
|                Detections      = $detections.ToArray()
|                File            = $f.FullName.Substring($ruleBase.Length).TrimStart('\','/')
|                Folder          = $folder
|                Source          = $ruleSource
|                SchemaShape     = 'AssetProfileBy'
|                Fallback        = ([string]$obj.fallback) -match '^(?i:true|1|yes)$'
|                # #462 the truth stage (production decides; testing is evaluated and shown, never deciding; not_used is
|                # not evaluated) and the priority (higher wins a single-value field) -- read by the CI enrichment
|                Stage           = $(if ([string]$obj.stage -match '^(?i)(production|testing|not_used)$') { ([string]$obj.stage).ToLowerInvariant() } else { 'production' })
|                Priority        = $(if ($null -ne $obj.priority -and [string]$obj.priority -match '^-?\d+$') { [int]$obj.priority } else { 100 })
|            })
|            $loaded++
|        }
|    }
|
|    # dedup by id -- locked + custom both load (same folder, just
|    # *.locked.yaml vs *.custom.yaml suffix). Preference: custom wins over
|    # locked (the customer-edited file is the override). Without this dedup
|    # the same rule fires twice per asset (you'd see e.g. OrgFinanceMember
|    # appearing 2x in SIRules with identical Tier/Purpose/Category, doubling
|    # match counts and inflating risk-factor probabilities).
|    # AUDIT #34 -- precedence is now RANKED rather than "custom replaces whatever came before",
|    # because a third source exists. Highest rank wins; equal rank keeps the first seen:
|    #   2 = overlay *.custom.yaml   (operator data root -- the most specific statement)
|    #   1 = in-tree *.custom.yaml   (today's customer override, same as before)
|    #   0 = *.locked.yaml           (shipped)
|    # With no overlay configured this collapses to exactly the previous behaviour: every rule is
|    # rank 0 or 1 and custom still beats locked.
|    # #470 -- the winning custom rule is then COMBINED with the shipped rule of the same id by its
|    # mode (V3-DATA-MODEL §2.4.5: the override grain is the item -- one detection -- not the file):
|    #   overwrite (and a custom file with no mode / 'locked')  the custom rule replaces the shipped one
|    #   append    the shipped detections stay; the custom detections are added (a colliding detection
|    #             id is NOT replaced -- append never changes a shipped detection; use merge for that)
|    #   merge     per detection id: a custom detection EXTENDS the shipped one of the same id (any:/all:
|    #             entries added, set: keys win), the others are added; the custom rule's purpose /
|    #             category / description win where set
|    #   disable   the shipped rule is turned off (or, with detection ids listed, only those detections)
|    # With no shipped counterpart every mode is the custom rule as written. See Merge-SIRuleOverride.
|    if ($results.Count -gt 1) {
|        $deduped = New-Object System.Collections.ArrayList
|        $byId    = @{}
|        $lockedById = @{}
|        $order   = New-Object System.Collections.Generic.List[string]
|        $rankOf  = {
|            param($r)
|            if ($r.File -notlike '*.custom.yaml') { return 0 }
|            if ($r.Source -eq 'overlay') { return 2 }
|            return 1
|        }
|        foreach ($r in $results) {
|            if ((& $rankOf $r) -eq 0 -and -not $lockedById.ContainsKey($r.Id)) { $lockedById[$r.Id] = $r }
|            if (-not $byId.ContainsKey($r.Id)) {
|                $byId[$r.Id] = $r
|                $order.Add($r.Id)
|            } elseif ((& $rankOf $r) -gt (& $rankOf $byId[$r.Id])) {
|                $byId[$r.Id] = $r
|            }
|            # else: same or lower rank than what we already hold -- ignore.
|        }
|        foreach ($rid in $order) {
|            $win = $byId[$rid]
|            if ((& $rankOf $win) -gt 0 -and $lockedById.ContainsKey($rid)) { $win = Merge-SIRuleOverride -Locked $lockedById[$rid] -Custom $win }
|            [void]$deduped.Add($win)
|        }
|        $dropped = $results.Count - $deduped.Count
|        if ($dropped -gt 0) {
|            Write-SIInfo ("Get-SIRuleSet: deduped {0} rule(s) (locked/custom pair) -- {1} unique rules remain" -f $dropped, $deduped.Count)
|        }
|        $results = $deduped
|    }
|
|    # The default tier rule(s) are kept apart from the rules that vote (see -Fallback). After the dedup, so a custom copy
|    # (or a turn-off) of the default rule has already replaced the shipped one.
|    $kept = New-Object System.Collections.ArrayList
|    foreach ($r in $results) {
|        $isFallback = [bool]$r.Fallback
|        if ($Fallback) { if ($isFallback -or $r.Mode -eq 'disable') { [void]$kept.Add($r) } }
|        elseif (-not $isFallback) { [void]$kept.Add($r) }
|    }
|    $results = $kept
|
|    Write-Verbose ("Get-SIRuleSet: engine={0} loaded={1} skipped={2} folders={3}" -f $Engine, $loaded, $skipped, ($folders -join ','))
|
|    # AUDIT #34 -- CUTOVER VISIBILITY. When an overlay is configured, operator rules still sitting in
|    # the shipped tree are read (never ignored -- silently dropping them would be #29 a third time)
|    # but they are the OLD location, and on a colliding id the overlay now outranks them. Say so once
|    # per run, naming the files, so a half-finished migration cannot look like a finished one.
|    if ($overlayActive) {
|        $overlayRules = @($results | Where-Object { $_.Source -eq 'overlay' })
|        $strayCustom  = @($results | Where-Object { $_.Source -eq 'tree' -and $_.File -like '*.custom.yaml' })
|        Write-SIInfo ("Get-SIRuleSet: operator data overlay ACTIVE at '{0}' -- {1} of {2} rule(s) for engine '{3}' come from the overlay." -f `
|            $overlayRoot, $overlayRules.Count, @($results).Count, $Engine)
|        if ($strayCustom.Count -gt 0) {
|            Write-Warning ("Get-SIRuleSet: {0} operator rule(s) for engine '{1}' are still in the SHIPPED TREE while an overlay is configured -- {2}. They ARE loaded, but they live in the directory the updater writes to and the overlay outranks them on a colliding id. Move them under '{3}\<engine>\' to complete the migration." -f `
|                $strayCustom.Count, $Engine, (($strayCustom | ForEach-Object { $_.File }) -join ', '), $overlayRoot)
|        }
|    }
|
|    # AUDIT #29 -- a rule file that will not PARSE must be visible on a normal run.
|    #
|    # Found by running the endpoint profiler live: all 8 *.custom.yaml files in this environment
|    # had been unparseable since 2026-06-11 (the space after each `key:` was stripped), so every
|    # customer tagging/profiling rule was inert -- while the run still reported
|    # "Engine completed successfully". The per-file warnings above scroll past in a long log, and
|    # the only aggregate was the Write-Verbose line above, which prints for nobody by default.
|    # Same defect shape as #27: the engine knew, and never said so where anyone would look.
|    #
|    # Deliberately a WARNING, not a throw: a broken custom rule must not stop a security run that
|    # still produces useful output -- consistent with the standing "a source failing must never
|    # block the run" decision. But it must not be silent either.
|    if ($parseFailed -gt 0) {
|        Write-Warning ("Get-SIRuleSet: {0} of {1} rule file(s) for engine '{2}' FAILED TO PARSE and were not applied -- {3}. These rules are NOT in force for this run; classification and tagging ran without them. Fix the YAML (a common cause is a missing space after 'key:') and re-run." -f `
|            $parseFailed, ($loaded + $parseFailed), $Engine, ($parseFailedNames -join ', '))
|    }
|
|    # AUDIT #36 -- a rule that LOADS with zero detections does nothing, and said so
|    # to nobody. Parsing is not the only way a rule can be inert: the #29 repair left
|    # asset-profiling-enrichment/azure/AssetProfileByTags.custom.yaml ending at a bare
|    # `detections:` with nothing under it. It parses, it loads, it dedups -- and it
|    # matches no asset, ever. There is no *.locked.yaml sibling for it, so the whole
|    # Azure CMDB tag mapping was running on a rule with no rules in it.
|    # `mode: disable` is the ONE legitimate zero-detection case (the customer is
|    # suppressing a locked rule on purpose) and is excluded.
|    $emptyRules = @($results | Where-Object { $_.Mode -ne 'disable' -and @($_.Detections).Count -eq 0 })
|    if ($emptyRules.Count -gt 0) {
|        Write-Warning ("Get-SIRuleSet: {0} rule(s) for engine '{1}' loaded with ZERO detections and can never match -- {2}. A rule with no detections is inert; check the file's 'detections:' block is not empty (use 'mode: disable' if suppression was intended)." -f `
|            $emptyRules.Count, $Engine, (($emptyRules | ForEach-Object { $_.File }) -join ', '))
|    }
|
|    # AUDIT #35 -- a detect kind the evaluator does not know is DROPPED, silently.
|    # Invoke-SIDetect logs an unknown kind with Write-Verbose (prints for nobody) and
|    # then continues in any-mode / returns $false in all-mode. That is how the
|    # unregistered 'nameMatches' cost 95 detections their name-pattern arm for the
|    # whole v2.2 lifetime without a single visible symptom. Checked here, at load, so
|    # it costs one pass over the final rule set instead of a test in the per-asset
|    # hot loop -- and so a customer's typo'd kind is reported on the run that uses it,
|    # not just by the lint they may never run.
|    # Soft dependency: RuleEval.ps1 is dot-sourced alongside this file by the profile
|    # stage, but not by every caller, so absence of the registry is not an error.
|    if (Get-Command -Name 'Get-SIKindRegistry' -ErrorAction SilentlyContinue) {
|        $kindRegistry = Get-SIKindRegistry
|        $unknownKinds = @{}
|        foreach ($r in $results) {
|            foreach ($det in @($r.Detections)) {
|                $dmode = if ($det.Detect.any) { 'any' } elseif ($det.Detect.all) { 'all' } else { $null }
|                if (-not $dmode) { continue }
|                foreach ($spec in @($det.Detect.$dmode)) {
|                    $k = [string]$spec.kind
|                    if ([string]::IsNullOrWhiteSpace($k)) { continue }
|                    if (-not $kindRegistry.ContainsKey($k)) {
|                        if (-not $unknownKinds.ContainsKey($k)) { $unknownKinds[$k] = 0 }
|                        $unknownKinds[$k]++
|                    }
|                }
|            }
|        }
|        if ($unknownKinds.Count -gt 0) {
|            $kindDetail = (($unknownKinds.Keys | Sort-Object | ForEach-Object { '{0} ({1} detection(s))' -f $_, $unknownKinds[$_] }) -join ', ')
|            Write-Warning ("Get-SIRuleSet: {0} detect kind(s) used by engine '{1}' rules are NOT in the RuleEval registry and are SKIPPED at evaluation -- {2}. Those detection arms never match, and a detection whose only arm is unknown can never fire. Check the spelling, or that the kind is registered in RuleEval.ps1." -f `
|                $unknownKinds.Count, $Engine, $kindDetail)
|        }
|    }
|
|    ,$results.ToArray()
|}
|
|function Merge-SIRuleOverride {
|    <#
|        PURE (#470). A customer rule (*.custom.yaml) combined with the shipped rule of the same id, by the customer
|        rule's mode. Returns the rule the engine evaluates; the shipped rule's file is kept as BaseFile.
|          overwrite | locked | (none)   the custom rule as written (the shipped rule is replaced)
|          append                        shipped detections + the custom detections whose id is new; a colliding id is
|                                        skipped with a warning (append never changes a shipped detection)
|          merge                         deep merge per detection id (DESIGN "Custom override"): a custom detection with
|                                        a shipped id EXTENDS it -- its any: (or all:) entries are added to the shipped
|                                        ones, its set: keys win over the shipped set: keys, excludeAssets are united;
|                                        new ids are added; purpose / category / description / osPlatformScope from the
|                                        custom rule where it sets them
|          disable                       no detections listed: the rule is off (Mode disable). Detection ids listed:
|                                        ONLY those shipped detections are dropped, the rest of the rule stays
|        An unknown mode warns and is treated as overwrite (today's behaviour for every custom file).
|        osPlatformScope for append: the union of both (empty on either side = every OS, so empty).
|    #>
|    param([Parameter(Mandatory)]$Locked, [Parameter(Mandatory)]$Custom)
|    $mode = ([string]$Custom.Mode).Trim().ToLowerInvariant()
|    if ($mode -eq 'disable') {
|        $off = @($Custom.DisableDetections | Where-Object { $_ })
|        if ($off.Count -eq 0) { return $Custom }
|        $keep = @(@($Locked.Detections) | Where-Object { $null -ne $_ -and $off -notcontains [string]$_.Id })
|        $missing = @($off | Where-Object { @($Locked.Detections | ForEach-Object { [string]$_.Id }) -notcontains $_ })
|        if ($missing.Count) { Write-Warning ("Get-SIRuleSet: rule '{0}' ({1}, mode disable) names detection id(s) {2} that the shipped rule does not have -- nothing to turn off for them." -f $Custom.Id, $Custom.File, ($missing -join ', ')) }
|        $r = $Locked.PSObject.Copy()
|        $r.Detections = $keep
|        $r.File = $Custom.File
|        $r.Source = $Custom.Source
|        $r | Add-Member -NotePropertyName BaseFile -NotePropertyValue $Locked.File -Force
|        $r | Add-Member -NotePropertyName DisabledDetections -NotePropertyValue $off -Force
|        return $r
|    }
|    if ($mode -in '', 'locked', 'overwrite') { return $Custom }
|    if ($mode -notin 'append', 'merge') {
|        Write-Warning ("Get-SIRuleSet: rule '{0}' ({1}) has mode '{2}', which is not one of overwrite / append / merge / disable -- it REPLACES the shipped rule (overwrite)." -f $Custom.Id, $Custom.File, $Custom.Mode)
|        return $Custom
|    }
|    $dets = New-Object System.Collections.Generic.List[object]
|    $pos = @{}
|    foreach ($d in @($Locked.Detections)) { if ($null -eq $d) { continue }; $pos[[string]$d.Id] = $dets.Count; $dets.Add($d) }
|    $skippedIds = New-Object System.Collections.Generic.List[string]
|    foreach ($d in @($Custom.Detections)) {
|        if ($null -eq $d) { continue }
|        $did = [string]$d.Id
|        if ($pos.ContainsKey($did)) {
|            if ($mode -eq 'merge') { $dets[$pos[$did]] = Merge-SIRuleDetection -Locked $dets[$pos[$did]] -Custom $d -RuleId $Custom.Id }
|            else { $skippedIds.Add($did) }
|            continue
|        }
|        $pos[$did] = $dets.Count
|        $dets.Add($d)
|    }
|    if ($skippedIds.Count -gt 0) {
|        Write-Warning ("Get-SIRuleSet: rule '{0}' ({1}, mode append) repeats shipped detection id(s) {2} -- append never changes a shipped detection, so they were NOT applied. Use mode: merge to replace a shipped detection, or give the detection a new id." -f $Custom.Id, $Custom.File, ($skippedIds -join ', '))
|    }
|    $pick = { param($c, $l) if ($null -ne $c -and -not [string]::IsNullOrWhiteSpace([string]$c)) { $c } else { $l } }
|    $scope = @()
|    $ls = @($Locked.osPlatformScope | Where-Object { $_ }); $cs = @($Custom.osPlatformScope | Where-Object { $_ })
|    if ($mode -eq 'merge') { $scope = if ($cs.Count) { $cs } else { $ls } }
|    elseif ($ls.Count -and $cs.Count) { $scope = @(@($ls) + @($cs) | Select-Object -Unique) }
|    [pscustomobject]@{
|        Id              = $Custom.Id
|        AppliesTo       = $Custom.AppliesTo
|        Mode            = $mode
|        osPlatformScope = $scope
|        Purpose         = $(if ($mode -eq 'merge') { & $pick $Custom.Purpose $Locked.Purpose } else { & $pick $Locked.Purpose $Custom.Purpose })
|        Category        = $(if ($mode -eq 'merge') { & $pick $Custom.Category $Locked.Category } else { & $pick $Locked.Category $Custom.Category })
|        Description     = $(if ($mode -eq 'merge') { & $pick $Custom.Description $Locked.Description } else { & $pick $Locked.Description $Custom.Description })
|        Detections      = $dets.ToArray()
|        File            = $Custom.File
|        BaseFile        = $Locked.File
|        Folder          = $Custom.Folder
|        Source          = $Custom.Source
|        SchemaShape     = 'AssetProfileBy'
|        Fallback        = [bool]$Locked.Fallback
|        Stage           = $(if ($Custom.PSObject.Properties['Stage'] -and $Custom.Stage) { $Custom.Stage } else { $Locked.Stage })
|        Priority        = $(if ($Custom.PSObject.Properties['Priority'] -and $null -ne $Custom.Priority) { $Custom.Priority } else { $Locked.Priority })
|    }
|}
|
|function Merge-SIRuleDetection {
|    <#
|        PURE (#470, mode merge). One shipped detection extended by the customer detection of the same id: the custom
|        any: (or all:) entries are ADDED to the shipped ones; set: keys of the custom detection win; excludeAssets are
|        united. A custom detection whose block is the other kind (all: against a shipped any:) cannot be added to it --
|        it replaces the shipped detect block, with a warning.
|    #>
|    param([Parameter(Mandatory)]$Locked, [Parameter(Mandatory)]$Custom, [string]$RuleId = '')
|    $cmp = [System.StringComparer]::OrdinalIgnoreCase
|    $detect = $Locked.Detect
|    if ($Custom.Detect) {
|        $lk = if ($Locked.Detect -and $Locked.Detect.any) { 'any' } elseif ($Locked.Detect -and $Locked.Detect.all) { 'all' } else { '' }
|        $ck = if ($Custom.Detect.any) { 'any' } elseif ($Custom.Detect.all) { 'all' } else { '' }
|        if ($ck -and $lk -eq $ck) {
|            $detect = [hashtable]::new($cmp)
|            $detect[$lk] = @(@($Locked.Detect.$lk) + @($Custom.Detect.$ck))
|        } elseif ($ck) {
|            if ($lk) { Write-Warning ("Get-SIRuleSet: rule '{0}' detection '{1}' (mode merge) uses {2}: where the shipped detection uses {3}: -- the two cannot be combined, so the custom detect block REPLACES the shipped one." -f $RuleId, $Custom.Id, $ck, $lk) }
|            $detect = $Custom.Detect
|        }
|    }
|    $set = [hashtable]::new($cmp)
|    foreach ($src in @($Locked.Set, $Custom.Set)) {
|        if ($src -is [System.Collections.IDictionary]) { foreach ($k in @($src.Keys)) { $set[[string]$k] = $src[$k] } }
|        elseif ($null -ne $src) { foreach ($p in $src.PSObject.Properties) { $set[$p.Name] = $p.Value } }
|    }
|    [pscustomobject]@{
|        Id            = $Locked.Id
|        Detect        = $detect
|        Set           = $set
|        ExcludeAssets = @(@($Locked.ExcludeAssets) + @($Custom.ExcludeAssets) | Where-Object { $_ } | Select-Object -Unique)
|    }
|}
|
|function Get-SIRuleSetSummary {
|    <#
|        Diagnostic helper. Returns a one-row-per-rule summary table:
|        Id, AppliesTo, Mode, DetectionCount, KindsUsed, TierRange, Folder.
|
|        Useful for lint runs ('how many rules per engine?') and pre-flight
|        checks before the new RuleEval ships.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)]
|        [ValidateSet('endpoint','identity','azure','publicip')]
|        [string]$Engine
|    )
|
|    Get-SIRuleSet -Engine $Engine | ForEach-Object {
|        $kindsUsed = New-Object System.Collections.Generic.HashSet[string]
|        $tiers     = New-Object System.Collections.Generic.HashSet[int]
|        foreach ($d in $_.Detections) {
|            if ($d.Detect) {
|                $kindList = if ($d.Detect.any)  { $d.Detect.any }
|                            elseif ($d.Detect.all) { $d.Detect.all }
|                            else { @() }
|                foreach ($k in $kindList) { if ($k.kind) { [void]$kindsUsed.Add([string]$k.kind) } }
|            }
|            if ($d.Set -and $null -ne $d.Set.Tier) { [void]$tiers.Add([int]$d.Set.Tier) }
|        }
|        [pscustomobject]@{
|            Id             = $_.Id
|            AppliesTo      = $_.AppliesTo
|            Mode           = $_.Mode
|            DetectionCount = $_.Detections.Count
|            KindsUsed      = (($kindsUsed | Sort-Object) -join ',')
|            TierRange      = if ($tiers.Count -gt 0) { "T$($tiers | Sort-Object | Select-Object -First 1)..T$($tiers | Sort-Object | Select-Object -Last 1)" } else { '' }
|            Folder         = $_.Folder
|        }
|    }
|}
'@ }
$__siSupportFiles['engine/pro-settings/SI-ProConfig.ps1'] = @{ Sha256 = '4b73c86473036151ca131fec04b4a6b99a75b3ca792b97522f19035726b3623b'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- ALL CONFIGURATION IN SQL, WITH VENDOR TEMPLATES (REQUIREMENTS §9.3.3 phase C).
|
|    Operator, 2026-10-03: "pro version must have all configurations stored in the sql database, so no configuration
|    files .custom + .default + .locked" ... "templates, to replace the locked files today, where i provide central
|    configurations, customers can choose to import in their environment - but with option to customize".
|
|    THE MODEL (sql\si-pro-settings.sql):
|      cfg.Template      the vendor baseline, ONE ROW PER ITEM (a report, a risk index row, a tier rule, a tagging rule,
|                        an ownership entry, the service model, a naming default). Published from the shipped *.locked
|                        files of a release by setup\Publish-SITemplates.ps1.
|      cfg.ItemOverride  the customer's state per item: inherit (or no row) | override (their body) | disable.
|      cfg.Document      unchanged (Pro-1b): the customer's own exclusions, weights and tier rules.
|      cfg.Exemption     "exempt this finding" from the GUI; expired / revoked rows are not applied.
|
|    RUN START: the template and the customer state are MERGED per item and MATERIALISED into a run-local folder, in
|    exactly the files the engines' own loaders already read -- so the engines stay as they are. A Pro run then needs no
|    configuration file of the installation: only SI_ProSqlServer / SI_ProSqlDatabase.
|
|    PER FAMILY, NEVER HALF: a family (rules, the Risk Analysis catalog, the risk index, ...) is served from SQL as soon
|    as it has template rows; until its templates are published it is read from the installation exactly as before. A
|    database without the Phase C tables behaves exactly as Pro-1b.
|
|    🔒 FAIL CLOSED, as the rest of the layer: a row that does not validate, an unknown kind, a template whose body does
|    not match its hash, an exemption that is not well-formed, the same item set in two places -- the run stops with
|    the reason.
|
|    Everything here except the file writers is pure (rows in, objects out) and tested directly.
|#>
|
|$script:SIProConfigSIRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|if (-not (Get-Command Test-SISettingValue -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-Settings.ps1'))
|}
|# SecurityInsight's own YAML reader (no powershell-yaml module).
|if (-not (Get-Command -Name ConvertFrom-SIYaml -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-Yaml.ps1'))
|}
|# Template versioning: the normalised content hash, the fingerprint gate, conformance (adopted from PIM4EntraPS).
|. ([System.IO.Path]::Combine($PSScriptRoot, 'SI-TemplateVersioning.ps1'))
|# Mandatory controls on top of templates: what SecurityInsight's own code requires, never switched off by an override.
|. ([System.IO.Path]::Combine($PSScriptRoot, 'SI-TemplateMandatory.ps1'))
|# #275 R3: where the asset-tagging engine finds its rules -- the launchers' and the engine's own resolution, shared.
|if (-not (Get-Command -Name Resolve-SIAssetTaggingFiles -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'asset-tagging', 'AssetTagging.Resolve.ps1'))
|}
|# The risk index rule: first match wins in Precedence order, and the conversion of a v2.2 index (same scores).
|if (-not (Get-Command -Name ConvertTo-SIRiskIndexFirstMatch -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'risk-analysis', '_shared', 'RA-RiskIndexOrder.ps1'))
|}
|# #559: the index keyed by the SI generic fields, and the 2.2 -> SI translation of rows stored with the old columns.
|if (-not (Get-Command -Name ConvertTo-SIRiskIndexSiRows -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'risk-analysis', '_shared', 'RA-RiskIndexSi.ps1'))
|}
|# the customer's overrides keyed the pre-v2 way are translated on the next template publish (CONVERGE-DEFAULTS)
|. ([System.IO.Path]::Combine($PSScriptRoot, 'SI-ProOverrideMigration.ps1'))
|# #398: the shipped index is riskscore.index.locked.csv; riskscore.index.custom.csv is the customer's own rows, unless it
|# is an unchanged copy of an earlier version's shipped index.
|if (-not (Get-Command -Name Test-SIRiskIndexShippedCopy -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'risk-analysis', '_shared', 'RA-RiskIndexFiles.ps1'))
|}
|# #456: the data model (field catalog, provider mappings, ...) as 'datamodel' template items -- rows, validation, the run's folder.
|. ([System.IO.Path]::Combine($PSScriptRoot, 'SI-DataModelTemplateRows.ps1'))
|# #274: the output scope per destination (validation and the file the engines read).
|if (-not (Get-Command -Name Test-SIOutputScopeBody -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-OutputScope.ps1'))
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|#  THE KINDS. Templated = the vendor publishes a baseline for it; Format = how BodyJson is read; Key = the item key.
|#  A kind not listed here is REFUSED at run start (there is deliberately no CHECK constraint on Kind in SQL -- see the
|#  schema file -- so this list is the guard).
|# ---------------------------------------------------------------------------------------------------------------------
|#  #251 (operator decision 2026-10-04): templates hold only VENDOR-DEVELOPED content (rules, Risk Analysis reports, the risk
|#  index, tagging rules, the service model). naming and cmdbownership are CONFIGURATION now:
|#    naming         a name is a setting (cfg.Setting) -- the catalog default is the only default. Existing naming overrides
|#                   are carried over 1:1 as setting rows by setup; a legacy override row is still read (never refused) until
|#                   then, and nothing new is written as a naming item.
|#    cmdbownership  ONE configuration document, key 'map' (the cmdbSourceOwnership object), seeded from the shipped file at
|#                   setup and owned by the customer. The per-entry keys (defaults, assettype/<type>) are the legacy rows: read
|#                   only, to carry them over (ConvertTo-SIProOwnershipMap).
|$script:SIProItemKinds = [ordered]@{
|    rareport      = @{ Templated = $true;  Format = 'json'; Key = '^(report|template)/[A-Za-z0-9_]{1,100}$' }
|    riskindex     = @{ Templated = $true;  Format = 'json'; Key = '^row/[^\r\n]{1,124}$' }
|    rule          = @{ Templated = $true;  Format = 'yaml'; Key = '^(endpoint|identity|azure|shared)/[A-Za-z0-9][A-Za-z0-9_\-]{0,99}$' }
|    assettagging  = @{ Templated = $true;  Format = 'json'; Key = '^(config|tag/[^\r\n/\\]{1,120})$' }
|    cmdbownership = @{ Templated = $false; Format = 'json'; Key = '^(map|defaults|assettype/[a-z0-9][a-z0-9_\-\.]{0,99})$' }
|    servicemodel  = @{ Templated = $true;  Format = 'json'; Key = '^model$' }
|    # #456: the data model, one item per field / mapping / factor / output column (SI-DataModelTemplateRows.ps1): '<template>' (its
|    # header) or '<template>:<item key>', e.g. 'mappings/mde:si_os_version|device|'
|    datamodel     = @{ Templated = $true;  Format = 'json'; Key = (Get-SIDataModelProKeyPattern) }
|    schemaoverlay = @{ Templated = $false; Format = 'json'; Key = '^(endpoint|identity|azure|publicip)$' }
|    decision      = @{ Templated = $false; Format = 'yaml'; Key = '^(asset|correlation)$' }
|    naming        = @{ Templated = $false; Format = 'json'; Key = '^[A-Za-z_][A-Za-z0-9_]{0,127}$' }
|    weights       = @{ Templated = $false; Format = 'json'; Key = '^(model|report/[A-Za-z0-9_]{1,100})$' }
|    # the tier board's 'move this whole rule to tier N': { "ruleKey": "<engine>/<id>", "tier": 0-3 } -- applied to the rule in force
|    ruletier      = @{ Templated = $false; Format = 'json'; Key = '^(endpoint|identity|azure|shared)/[A-Za-z0-9][A-Za-z0-9_\-]{0,99}$' }
|    # #275 R6: the customer's override of the server-application catalog (asset-profiling-enrichment\endpoint\
|    # server-applications.json: { "applications": [ { software_vendor, software_name, tier, ... } ] }), merged over the
|    # shipped catalog by its own loader (EndpointCatalogTierComputer.ps1) -- materialised to SI_ProConfigRoot.
|    serverapps    = @{ Templated = $false; Format = 'json'; Key = '^catalog$' }
|    # #274: what each output destination receives (Excel + mail, the vulnerability and CMDB connectors) -- one item per
|    # destination, materialised into config\output-scope.json (engine\_shared\SI-OutputScope.ps1 reads it)
|    outputscope   = @{ Templated = $false; Format = 'json'; Key = '^(excel|vuln-sql|vuln-servicenow|cmdb-sql|cmdb-servicenow)$' }
|}
|# The risk index columns the engine reads (#559: keyed by the SI generic fields -- RA-RiskIndexSi.ps1) plus the notes
|# column and Precedence (the row's place: first match wins, 1 = checked first).
|$script:SIRiskIndexColumns = @('si_finding_type', 'si_category', 'si_subcategory', 'si_component', 'si_finding_key', 'asset_class',
|    'si_severity', 'VulnerabilityBase', 'si_tier', 'AssetBase', 'Comments', 'Precedence')
|$script:SIRiskIndexKeyColumns = @('si_finding_type', 'si_category', 'si_subcategory', 'si_component', 'si_finding_key', 'asset_class', 'si_severity', 'si_tier')
|# #559: a row stored before the re-key carries the 2.2 columns -- still accepted, translated where it is written
|# (riskscore.index.translation.locked.json); its item key is the 2.2 one until it is saved again.
|$script:SIRiskIndexV22Columns = @('SecurityDomain', 'Category', 'SubCategory', 'ConfigurationId', 'SecuritySeverity',
|    'RiskConsequenceScore_SecuritySeverity', 'CriticalityTierLevel', 'RiskProbablityScore_CriticialityTierLevel', 'Comments', 'Precedence')
|$script:SIRiskIndexV22KeyColumns = @('SecurityDomain', 'Category', 'SubCategory', 'ConfigurationId', 'SecuritySeverity', 'CriticalityTierLevel')
|# Naming conventions: catalog text settings that name a table, a DCR, a DCE or a workspace.
|$script:SIProNamingPattern = '(?i)(dcr|dce|table|workspacename)'
|# The run-local file names the engines read.
|$script:SIProRaCatalogFile  = 'RiskAnalysis_Queries_Locked.yaml'
|$script:SIProRiskIndexFile  = 'riskscore.index.custom.csv'
|$script:SIProExemptionsFile = 'RiskAnalysisExemptions.json'
|
|function Get-SIProItemKinds { $script:SIProItemKinds }
|
|# =====================================================================================================================
|#  JSON: one reader and one canonical writer, so a body means the same thing -- and hashes the same -- on PowerShell
|#  5.1 and 7 (pwsh 7 turns date-like strings into DateTime and decimals into double; 5.1 does neither).
|# =====================================================================================================================
|function ConvertFrom-SIProJson {
|    <# ConvertFrom-Json that keeps date-like strings as strings where the runtime allows it (pwsh 7.5+ -DateKind). #>
|    param([AllowEmptyString()][AllowNull()][string]$Text)
|    if ($null -eq $script:SIProJsonDateKind) { $script:SIProJsonDateKind = (Get-Command ConvertFrom-Json).Parameters.ContainsKey('DateKind') }
|    if ($script:SIProJsonDateKind) { return ($Text | ConvertFrom-Json -DateKind String -ErrorAction Stop) }
|    $Text | ConvertFrom-Json -ErrorAction Stop
|}
|
|function ConvertTo-SIProJsonString {
|    <# PURE. A string as a JSON literal. Escapes every control character and the characters YAML refuses unescaped
|       (C1 controls, line / paragraph separators) -- the materialised JSON is read by a YAML parser too. #>
|    param([AllowEmptyString()][string]$Value)
|    $sb = New-Object System.Text.StringBuilder ($Value.Length + 2)
|    [void]$sb.Append('"')
|    foreach ($ch in $Value.ToCharArray()) {
|        $c = [int]$ch
|        if ($ch -eq '"') { [void]$sb.Append('\"') }
|        elseif ($ch -eq '\') { [void]$sb.Append('\\') }
|        elseif ($c -eq 10) { [void]$sb.Append('\n') }
|        elseif ($c -eq 13) { [void]$sb.Append('\r') }
|        elseif ($c -eq 9) { [void]$sb.Append('\t') }
|        elseif ($c -lt 32 -or ($c -ge 0x7F -and $c -le 0x9F) -or $c -eq 0x2028 -or $c -eq 0x2029 -or $c -eq 0xFEFF) { [void]$sb.Append(('\u{0:x4}' -f $c)) }
|        else { [void]$sb.Append($ch) }
|    }
|    [void]$sb.Append('"')
|    $sb.ToString()
|}
|
|function ConvertTo-SIProJson {
|    <#
|        PURE. A value as JSON. -Canonical sorts object keys ordinally and writes compactly (for hashing and comparing);
|        without it keys keep their order and the text is indented (for storing and materialising). A list is always an
|        array; a number is invariant (a non-integer as its shortest round-trip form, whatever type the runtime parsed
|        it into); a DateTime is ISO 8601.
|    #>
|    param([AllowNull()]$Value, [switch]$Canonical, [int]$Level = 0)
|    if ($null -eq $Value) { return 'null' }
|    if ($Value -is [bool]) { if ($Value) { return 'true' } else { return 'false' } }
|    if ($Value -is [int] -or $Value -is [long] -or $Value -is [int16] -or $Value -is [byte] -or $Value -is [uint32] -or $Value -is [uint64] -or $Value -is [System.Numerics.BigInteger]) {
|        return ([string]::Format([System.Globalization.CultureInfo]::InvariantCulture, '{0}', $Value))
|    }
|    if ($Value -is [double] -or $Value -is [single] -or $Value -is [decimal]) {
|        $d = [double]$Value
|        if ($d -eq [Math]::Floor($d) -and [Math]::Abs($d) -lt 1e15) { return ([long]$d).ToString([System.Globalization.CultureInfo]::InvariantCulture) }
|        return $d.ToString('R', [System.Globalization.CultureInfo]::InvariantCulture)
|    }
|    if ($Value -is [datetime]) { return (ConvertTo-SIProJsonString $Value.ToString('o', [System.Globalization.CultureInfo]::InvariantCulture)) }
|    if ($Value -is [string] -or $Value -is [char] -or $Value -is [guid]) { return (ConvertTo-SIProJsonString ([string]$Value)) }
|    $nl = if ($Canonical) { '' } else { "`n" }
|    $pad = if ($Canonical) { '' } else { '  ' * $Level }
|    $pad1 = if ($Canonical) { '' } else { '  ' * ($Level + 1) }
|    $sep = if ($Canonical) { ':' } else { ': ' }
|    $pairs = $null
|    if ($Value -is [System.Collections.IDictionary]) { $pairs = @(foreach ($k in $Value.get_Keys()) { , @([string]$k, $Value[$k]) }) }
|    elseif ($Value -is [System.Management.Automation.PSCustomObject]) { $pairs = @(foreach ($p in $Value.PSObject.Properties) { , @($p.Name, $p.Value) }) }
|    if ($null -ne $pairs) {
|        if ($pairs.Count -eq 0) { return '{}' }
|        if ($Canonical) {
|            $names = [string[]]@($pairs | ForEach-Object { $_[0] })
|            $idx = [int[]](0..($pairs.Count - 1))
|            [Array]::Sort($names, $idx, [System.StringComparer]::Ordinal)
|            $pairs = @(foreach ($i in $idx) { , $pairs[$i] })
|        }
|        $items = foreach ($p in $pairs) { $pad1 + (ConvertTo-SIProJsonString $p[0]) + $sep + (ConvertTo-SIProJson -Value $p[1] -Canonical:$Canonical -Level ($Level + 1)) }
|        return ('{' + $nl + ($items -join (',' + $nl)) + $nl + $pad + '}')
|    }
|    if ($Value -is [System.Collections.IEnumerable]) {
|        $arr = @($Value)
|        if ($arr.Count -eq 0) { return '[]' }
|        $items = foreach ($v in $arr) { $pad1 + (ConvertTo-SIProJson -Value $v -Canonical:$Canonical -Level ($Level + 1)) }
|        return ('[' + $nl + ($items -join (',' + $nl)) + $nl + $pad + ']')
|    }
|    ConvertTo-SIProJsonString ([string]$Value)
|}
|
|function Get-SIProTextHash {
|    <# PURE. SHA-256 (hex) of a text as UTF-8. #>
|    param([AllowEmptyString()][AllowNull()][string]$Text)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { -join ($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes([string]$Text)) | ForEach-Object { $_.ToString('x2') }) } finally { $sha.Dispose() }
|}
|
|function Get-SIProItemFingerprint {
|    <#
|        PURE. What an item SAYS, independent of how it was written: JSON -> the canonical form (key order, spacing and
|        number formatting do not count); YAML -> the text with line endings, a BOM and trailing spaces normalised (its
|        comments DO count -- they are part of what the operator wrote). Used to store only real differences.
|    #>
|    param([AllowEmptyString()][string]$Body, [string]$Format = 'json')
|    if ($Format -eq 'yaml') {
|        $t = $Body.TrimStart([char]0xFEFF) -replace "`r`n", "`n" -replace "`r", "`n"
|        return ((($t -split "`n") | ForEach-Object { $_.TrimEnd() }) -join "`n").Trim()
|    }
|    try { ConvertTo-SIProJson -Value (ConvertFrom-SIProJson $Body) -Canonical } catch { $Body.Trim() }
|}
|
|function Test-SIProSameItem {
|    <# PURE. Do two bodies say the same thing? #>
|    param([AllowEmptyString()][string]$A, [AllowEmptyString()][string]$B, [string]$Format = 'json')
|    (Get-SIProItemFingerprint -Body $A -Format $Format) -ceq (Get-SIProItemFingerprint -Body $B -Format $Format)
|}
|
|# =====================================================================================================================
|#  KEYS that are derived from a body
|# =====================================================================================================================
|function Get-SIRiskIndexKey {
|    <# PURE. A risk index row's item key: its dimension columns, '|'-joined (#559: the eight SI dimensions; a row still
|       written with the 2.2 columns keeps its six 2.2 dimensions -- -V22). #>
|    param([Parameter(Mandatory)]$Row, [switch]$V22)
|    $get = { param($n) if ($Row -is [System.Collections.IDictionary]) { [string]$Row[$n] } elseif ($Row.PSObject.Properties[$n]) { [string]$Row.$n } else { '' } }
|    $cols = $script:SIRiskIndexKeyColumns; if ($V22) { $cols = $script:SIRiskIndexV22KeyColumns }
|    'row/' + ((@($cols | ForEach-Object { (& $get $_).Trim() })) -join '|')
|}
|
|function Get-SIProAssetTagStemKey {
|    <#
|        PURE. The asset-tagging merge key of a tag name -- the SAME rule as the engine's Get-AssetTagStemKey
|        (engine\asset-tagging\AssetTagging.ps1; a test runs both on the same names): '<stem>--tier<N>--SI' and
|        '<stem>--excluded--SI' share the key '<STEM>--SI'. $null when the name does not follow the convention.
|    #>
|    param([AllowEmptyString()][string]$Name)
|    if ([string]::IsNullOrWhiteSpace($Name)) { return $null }
|    $m = [regex]::Match($Name.Trim(), '^(?<stem>.+?)--(?:tier(?<tier>\d+)|excluded)--SI$', [System.Text.RegularExpressions.RegexOptions]::IgnoreCase)
|    if (-not $m.Success) { return $null }
|    ($m.Groups['stem'].Value + '--SI').ToUpperInvariant()
|}
|
|# =====================================================================================================================
|#  VALIDATION -- the same rules for a template (at publish), an override (writer and run start) and an import.
|# =====================================================================================================================
|function Get-SIProConfigContext {
|    <# What validating items needs from the installation (read once per run): the Pro-1b document context plus the
|       settings catalog (for naming). #>
|    param([string]$SIRoot, [object[]]$Catalog)
|    if (-not $SIRoot) { $SIRoot = $script:SIProConfigSIRoot }
|    if (-not $Catalog) { $Catalog = @(Get-SISettingsCatalog -SIRoot $SIRoot) }
|    [pscustomobject]@{ SIRoot = $SIRoot; Reports = @(Get-SIRaReportNames -SIRoot $SIRoot); Kinds = @(Get-SIRuleKinds -SIRoot $SIRoot); Catalog = @($Catalog) }
|}
|
|function Test-SIProOwnershipMap {
|    <#
|        PURE. The reasons a CMDB ownership map (the configuration document cmdbownership/map, #251) is not accepted -- empty =
|        accepted. The map is the cmdbSourceOwnership object of config\cmdb-source-ownership.locked.json. The web app's
|        OwnershipMapValidator applies the same rules (both test suites read pro-management\tests\fixtures\ownership-map-cases.json).
|        -Value: the JSON text, or (-Parsed) the value ConvertFrom-SIProJson made of it.
|    #>
|    param([AllowNull()]$Value, [switch]$Parsed)
|    $why = New-Object System.Collections.Generic.List[string]
|    $o = $Value
|    if (-not $Parsed) {
|        try { $o = ConvertFrom-SIProJson ([string]$Value) } catch { $why.Add('the ownership map is not valid JSON: ' + $_.Exception.Message); return $why.ToArray() }
|    }
|    if ($o -isnot [System.Management.Automation.PSCustomObject]) { $why.Add('the ownership map must be a JSON object'); return $why.ToArray() }
|    $isNote = { param([string]$n) $n.StartsWith('_') -or $n -eq 'Comment' }
|    $isList = { param($v) ($null -ne $v) -and ($v -is [System.Collections.IEnumerable]) -and ($v -isnot [string]) -and ($v -isnot [System.Management.Automation.PSCustomObject]) }
|    $whole = { param($v) if ($null -eq $v -or $v -is [bool] -or (& $isList $v) -or $v -is [System.Management.Automation.PSCustomObject]) { return $false }
|               $d = 0.0; if (-not [double]::TryParse([string]$v, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $false }
|               ($d -eq [Math]::Floor($d)) -and $d -ge 0 -and $d -le 3650 }
|    $text = { param($v) ($v -is [string]) -and -not [string]::IsNullOrWhiteSpace($v) }
|    foreach ($p in $o.PSObject.Properties) {
|        if (& $isNote $p.Name) { continue }
|        $v = $p.Value
|        switch -CaseSensitive ($p.Name) {
|            'notACiResourceTypes' { if (-not (& $isList $v) -or @(@($v) | Where-Object { -not (& $text $_) }).Count) { $why.Add('notACiResourceTypes must be a list of resource types') } }
|            'defaultSiMayCreate' { if ($v -isnot [bool]) { $why.Add('defaultSiMayCreate must be true or false') } }
|            'defaultExpectedWithinDays' { if (-not (& $whole $v)) { $why.Add('defaultExpectedWithinDays must be a whole number from 0 to 3650') } }
|            'defaultCiClass' { if (-not (& $text $v)) { $why.Add('defaultCiClass must be a CI class name') } }
|            'assetTypes' {
|                if (-not (& $isList $v)) { $why.Add('assetTypes must be a list'); break }
|                $seen = @{}; $n = 0
|                foreach ($e in @($v)) {
|                    $n++
|                    if ($e -isnot [System.Management.Automation.PSCustomObject]) { $why.Add(('assetTypes[{0}] must be an object' -f $n)); continue }
|                    if (-not $e.PSObject.Properties['siAssetType']) { $why.Add(('assetTypes[{0}] has no siAssetType' -f $n)); continue }
|                    $raw = $e.siAssetType
|                    $t = if ($raw -is [string]) { $raw.Trim().ToLowerInvariant() } else { '' }
|                    if ($t -cnotmatch '^[a-z0-9][a-z0-9_\-\.]{0,99}$') { $why.Add(("assetTypes[{0}]: '{1}' is not an asset type (lower-case letters, digits, _ - .)" -f $n, $raw)); continue }
|                    if ($seen.ContainsKey($t)) { $why.Add(("assetTypes: '{0}' is listed twice" -f $t)); continue }
|                    $seen[$t] = $true
|                    foreach ($q in $e.PSObject.Properties) {
|                        if ((& $isNote $q.Name) -or $q.Name -ceq 'siAssetType') { continue }
|                        switch -CaseSensitive ($q.Name) {
|                            'siMayCreate' { if ($q.Value -isnot [bool]) { $why.Add(('assetTypes[{0}] ({1}): siMayCreate must be true or false' -f $n, $t)) } }
|                            'expectedWithinDays' { if (-not (& $whole $q.Value)) { $why.Add(('assetTypes[{0}] ({1}): expectedWithinDays must be a whole number from 0 to 3650' -f $n, $t)) } }
|                            'ciClass' { if (-not (& $text $q.Value)) { $why.Add(('assetTypes[{0}] ({1}): ciClass must be a CI class name' -f $n, $t)) } }
|                            'ownedBy' { if ($null -ne $q.Value -and $q.Value -isnot [string]) { $why.Add(('assetTypes[{0}] ({1}): ownedBy must be text or null' -f $n, $t)) } }
|                            default { $why.Add(("assetTypes[{0}] ({1}): '{2}' is not an asset type setting" -f $n, $t, $q.Name)) }
|                        }
|                    }
|                }
|            }
|            default { $why.Add(("'{0}' is not an ownership setting" -f $p.Name)) }
|        }
|    }
|    $why.ToArray()
|}
|
|function Test-SIProItem {
|    <#
|        The reasons an item body is not accepted (empty = accepted). -Context: Get-SIProConfigContext (Reports may be
|        widened by the caller with the customer's own reports).
|    #>
|    param([AllowEmptyString()][string]$Kind, [AllowEmptyString()][string]$Key, [AllowEmptyString()][AllowNull()][string]$Body,
|          [string]$Format, [Parameter(Mandatory)]$Context)
|    $why = New-Object System.Collections.Generic.List[string]
|    $spec = $script:SIProItemKinds[$Kind]
|    if (-not $spec) { $why.Add(("'{0}' is not a configuration kind ({1})" -f $Kind, ($script:SIProItemKinds.Keys -join ', '))); return $why.ToArray() }
|    if ([string]::IsNullOrEmpty($Key) -or $Key -notmatch $spec.Key) { $why.Add(("'{0}' is not a valid {1} key" -f $Key, $Kind)); return $why.ToArray() }
|    if (-not $Format) { $Format = $spec.Format }
|    if ($Format -ne $spec.Format) { $why.Add(("a {0} item is {1}, not {2}" -f $Kind, $spec.Format, $Format)); return $why.ToArray() }
|    if ([string]::IsNullOrWhiteSpace($Body)) { $why.Add('the body is empty'); return $why.ToArray() }
|    $o = $null
|    if ($Format -eq 'json') {
|        try { $o = ConvertFrom-SIProJson $Body } catch { $why.Add('the body is not valid JSON: ' + $_.Exception.Message); return $why.ToArray() }
|    }
|    $isObj = $o -is [System.Management.Automation.PSCustomObject]
|    $prop = { param($n) if ($isObj -and $o.PSObject.Properties[$n]) { , $o.$n } else { $null } }   # ',' keeps a one-item list a list
|    switch ($Kind) {
|        'rareport' {
|            if (-not $isObj) { $why.Add('a report must be a JSON object'); break }
|            $name = $Key.Substring($Key.IndexOf('/') + 1)
|            if ([string](& $prop 'ReportName') -cne $name) { $why.Add(("ReportName must be '{0}' -- the key names the report" -f $name)) }
|            if ($Key -like 'report/*') {
|                $q = & $prop 'ReportQuery'
|                # the shipped catalog writes ReportQuery as a one-item YAML list; text works as well
|                $qt = @(@($q) | Where-Object { $_ -is [string] -and -not [string]::IsNullOrWhiteSpace($_) })
|                if ($qt.Count -eq 0 -or @(@($q) | Where-Object { $_ -isnot [string] }).Count) { $why.Add('a report needs a ReportQuery (text, or a list of text)') }
|            } else {
|                $incRaw = & $prop 'ReportsIncluded'
|                $inc = @($incRaw | Where-Object { $null -ne $_ })
|                if ($inc.Count -eq 0) { $why.Add('a report template needs ReportsIncluded') }
|                foreach ($i in $inc) {
|                    $n = if ($i -is [string]) { $i } elseif ($i.PSObject.Properties['Name']) { [string]$i.Name } elseif ($i.PSObject.Properties['ReportName']) { [string]$i.ReportName } else { '' }
|                    if ($n -notmatch '^[A-Za-z0-9_]{1,100}$') { $why.Add(("ReportsIncluded: '{0}' is not a report name" -f $n)) }
|                }
|            }
|        }
|        'riskindex' {
|            if (-not $isObj) { $why.Add('a risk index row must be a JSON object'); break }
|            # #559: SI-keyed (the columns of today) or a row stored with the 2.2 columns (translated where it is written)
|            $isV22 = (@($o.PSObject.Properties.Name) | Where-Object { $_ -in 'RiskConsequenceScore_SecuritySeverity', 'RiskProbablityScore_CriticialityTierLevel', 'SecurityDomain', 'CriticalityTierLevel' }).Count -gt 0
|            $allowed = $script:SIRiskIndexColumns; if ($isV22) { $allowed = $script:SIRiskIndexV22Columns }
|            foreach ($p in $o.PSObject.Properties) {
|                if ($allowed -notcontains $p.Name) { $why.Add(("'{0}' is not a risk index column" -f $p.Name)); continue }
|                if ($null -ne $p.Value -and ($p.Value -is [System.Collections.IEnumerable] -and $p.Value -isnot [string])) { $why.Add(("{0} must be a single value" -f $p.Name)); continue }
|                if ([string]$p.Value -match '[\r\n"]') { $why.Add(("{0} may not hold quotes or line breaks" -f $p.Name)) }
|            }
|            $nums = @('AssetBase', 'VulnerabilityBase', 'si_tier', 'Precedence'); if ($isV22) { $nums = @('RiskConsequenceScore_SecuritySeverity', 'RiskProbablityScore_CriticialityTierLevel', 'Precedence') }
|            foreach ($n in $nums) {
|                $v = [string](& $prop $n); $d = 0.0
|                if ($v -and -not [double]::TryParse($v, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { $why.Add(("{0} must be a number" -f $n)) }
|            }
|            if (-not $isV22) {
|                $ac = [string](& $prop 'asset_class')
|                if ($ac -and @('device_server', 'device_client', 'device', 'identity', 'cloud_resource', 'public_ip') -notcontains $ac) { $why.Add(("asset_class '{0}' (device_server, device_client, device, identity, cloud_resource, public_ip or blank)" -f $ac)) }
|            }
|            # an empty dimension is a wildcard row (the shipped index has rows matched by configuration id at any severity)
|            # a repeated row keeps its place as '<dimensions>#<n>' (the engine's index keeps every row, so a repeat is kept too)
|            if ($why.Count -eq 0 -and ($Key -replace '#\d+$', '') -cne (Get-SIRiskIndexKey -Row $o -V22:$isV22)) { $why.Add(("the key must be '{0}' (or '{0}#<n>' for a repeated row) -- it is made of the row's dimension columns" -f (Get-SIRiskIndexKey -Row $o -V22:$isV22))) }
|        }
|        'rule' {
|            $id = $Key.Substring($Key.IndexOf('/') + 1)
|            foreach ($w in @(Test-SIRuleText -Text $Body.TrimStart([char]0xFEFF) -Id $id -Kinds @($Context.Kinds))) { $why.Add($w) }
|        }
|        'assettagging' {
|            if (-not $isObj) { $why.Add('an asset-tagging item must be a JSON object'); break }
|            if ($Key -eq 'config') { break }   # asset-tagging.config.json: the gates the rules name, free-form
|            $stem = Get-SIProAssetTagStemKey ([string](& $prop 'AssetTagName'))
|            if (-not $stem) { $why.Add("AssetTagName must be '<stem>--tier<N>--SI' or '<stem>--excluded--SI'"); break }
|            if (('tag/' + $stem) -cne $Key) { $why.Add(("the key must be 'tag/{0}' -- it is the tag's merge key" -f $stem)) }
|        }
|        'cmdbownership' {
|            if ($Key -eq 'map') { foreach ($w in @(Test-SIProOwnershipMap -Value $o -Parsed)) { $why.Add($w) }; break }
|            if (-not $isObj) { $why.Add('an ownership item must be a JSON object'); break }
|            if ($Key -eq 'defaults') {
|                if ($o.PSObject.Properties['assetTypes']) { $why.Add("the defaults item holds no assetTypes -- each asset type is its own item (assettype/<type>)") }
|                $sc = & $prop 'defaultSiMayCreate'; if ($null -ne $sc -and $sc -isnot [bool]) { $why.Add('defaultSiMayCreate must be true or false') }
|                $d = & $prop 'defaultExpectedWithinDays'; $n = 0; if ($null -ne $d -and (-not [int]::TryParse([string]$d, [ref]$n) -or $n -lt 0 -or $n -gt 3650)) { $why.Add('defaultExpectedWithinDays must be a whole number from 0 to 3650') }
|                $na = & $prop 'notACiResourceTypes'; if ($null -ne $na) { foreach ($t in @($na)) { if ($t -isnot [string]) { $why.Add('notACiResourceTypes must be a list of resource types') ; break } } }
|            } else {
|                $t = ([string](& $prop 'siAssetType')).Trim().ToLowerInvariant()
|                if (('assettype/' + $t) -cne $Key) { $why.Add(("siAssetType must be '{0}' -- the key names the asset type" -f $Key.Substring(10))) }
|                $sc = & $prop 'siMayCreate'; if ($null -ne $sc -and $sc -isnot [bool]) { $why.Add('siMayCreate must be true or false') }
|                $d = & $prop 'expectedWithinDays'; $n = 0; if ($null -ne $d -and (-not [int]::TryParse([string]$d, [ref]$n) -or $n -lt 0 -or $n -gt 3650)) { $why.Add('expectedWithinDays must be a whole number from 0 to 3650') }
|            }
|        }
|        'servicemodel' {
|            if (-not $isObj) { $why.Add('the service model must be a JSON object'); break }
|            foreach ($n in 'services', 'bindings') { $v = & $prop $n; if ($null -ne $v -and -not ($v -is [System.Collections.IEnumerable] -and $v -isnot [string])) { $why.Add(("{0} must be a list" -f $n)) } }
|        }
|        'schemaoverlay' {
|            if (-not $isObj) { $why.Add('a schema overlay must be a JSON object'); break }
|            $f = & $prop 'fields'; if ($null -ne $f -and -not ($f -is [System.Collections.IEnumerable] -and $f -isnot [string])) { $why.Add('fields must be a list') }
|        }
|        'decision' {
|            $y = $null
|            try { $y = ConvertFrom-SIYaml -Yaml $Body.TrimStart([char]0xFEFF) -SourceName ('decisions/' + $Key) } catch { $why.Add('the decisions file is not valid YAML: ' + $_.Exception.Message); break }
|            if ($null -ne $y -and $y -isnot [System.Collections.IDictionary]) { $why.Add('a decisions file must be a YAML mapping') }
|        }
|        'naming' {
|            $s = @($Context.Catalog | Where-Object { $_.name -eq $Key }) | Select-Object -First 1
|            if (-not $s -or $s.type -ne 'text' -or $s.secret -or $Key -notmatch $script:SIProNamingPattern) { $why.Add(("'{0}' is not a naming setting (a text setting that names a table, DCR, DCE or workspace)" -f $Key)); break }
|            if ($o -isnot [string]) { $why.Add('a naming item is one text value'); break }
|            $w = Test-SISettingValue -Setting $s -Value $o
|            if ($w) { $why.Add($w) }
|            elseif ($o -notmatch '^[A-Za-z0-9][A-Za-z0-9_\-\.\{\}]{0,127}$') { $why.Add(("'{0}' is not a valid resource name (letters, digits, _ - . and {{placeholders}})" -f $o)) }
|        }
|        'ruletier' {
|            if (-not $isObj) { $why.Add('a rule tier decision must be a JSON object'); break }
|            if ([string](& $prop 'ruleKey') -cne $Key) { $why.Add(("ruleKey must be '{0}' -- the key names the rule" -f $Key)) }
|            $tv = & $prop 'tier'; $n = 0
|            if ($null -eq $tv -or -not [int]::TryParse([string]$tv, [ref]$n) -or [string]$n -ne ([string]$tv).Trim() -or $n -lt 0 -or $n -gt 3) { $why.Add('tier must be 0, 1, 2 or 3') }
|        }
|        'serverapps' {
|            # the loader's own rule: an entry without a vendor or a name is skipped; a tier it cannot read as 0-3 is refused
|            # here, because the loader casts it ([int]) and would stop the run
|            if (-not $isObj) { $why.Add('the server-application catalog must be a JSON object'); break }
|            $apps = & $prop 'applications'
|            if ($null -eq $apps -or -not ($apps -is [System.Collections.IEnumerable] -and $apps -isnot [string])) { $why.Add('applications must be a list'); break }
|            foreach ($a in @($apps)) {
|                if ($a -isnot [System.Management.Automation.PSCustomObject]) { $why.Add('every application must be a JSON object'); break }
|                if (-not $a.PSObject.Properties['tier']) { continue }
|                $n = 0
|                if (-not [int]::TryParse([string]$a.tier, [ref]$n) -or $n -lt 0 -or $n -gt 3) { $why.Add(("{0} / {1}: tier must be 0, 1, 2 or 3" -f [string]$a.software_vendor, [string]$a.software_name)) }
|            }
|        }
|        'outputscope' {
|            foreach ($w in @(Test-SIOutputScopeBody -Key $Key -Body $o)) { $why.Add($w) }
|        }
|        'datamodel' {
|            foreach ($w in @(Test-SIDataModelProItem -Key $Key -Value $o)) { $why.Add($w) }
|        }
|        'weights' {
|            if (-not $isObj) { $why.Add('a weights item must be a JSON object'); break }
|            if ($Key -eq 'model') {
|                if ($o.PSObject.Properties['weightedRiskFactors']) { $why.Add("weightedRiskFactors belongs in the weights document (cfg.Document weights/solution), not in the model sections") }
|            } else {
|                $rep = $Key.Substring(7)
|                if (@($Context.Reports) -notcontains $rep) { $why.Add(("'{0}' is not a Risk Analysis report" -f $rep)); break }
|                foreach ($w in @(Test-SIProDocument -Kind weights -Key solution -Body $Body -Context $Context)) { $why.Add($w) }
|            }
|        }
|    }
|    $why.ToArray()
|}
|
|# =====================================================================================================================
|#  READING THE ROWS (guarded: a database without the Phase C tables has none of them)
|# =====================================================================================================================
|function Read-SIProTemplates {
|    <# ContentHash (template versioning) is read where the column exists -- through EXEC, because a batch naming a
|       column the table does not have fails to compile even inside an IF. #>
|    param([Parameter(Mandatory)]$Store)
|    $cols = "Kind, ItemKey, [Version] AS TemplateVersion, BodyJson, Format, SortOrder, BodyHash, Source, RetiredAt, CONVERT(varchar(30), CONVERT(bigint, RowVersion)) AS Version"
|    $sql = "IF COL_LENGTH('cfg.Template', 'ContentHash') IS NOT NULL EXEC (N'SELECT $cols, ContentHash FROM cfg.Template') ELSE IF OBJECT_ID('cfg.Template') IS NOT NULL SELECT $cols, CAST(NULL AS char(64)) AS ContentHash FROM cfg.Template"
|    & $Store.Invoke $sql @{} 'reader' | ForEach-Object { $_ }
|}
|function Read-SIProItemOverrides {
|    param([Parameter(Mandatory)]$Store)
|    & $Store.Invoke "IF OBJECT_ID('cfg.ItemOverride') IS NOT NULL SELECT Kind, ItemKey, State, BodyJson, Format, BaseVersion, BaseHash, CONVERT(varchar(30), CONVERT(bigint, RowVersion)) AS Version FROM cfg.ItemOverride" @{} 'reader' | ForEach-Object { $_ }
|}
|function Read-SIProExemptions {
|    param([Parameter(Mandatory)]$Store)
|    # RequestId (#252) only where the column exists -- a database set up before the governed flow has none
|    $cols = 'ExemptionId, Scope, ReportName, ConfigurationId, Cve, AssetKey, Reason, ExpiresAt, CreatedBy, CreatedAt, RevokedAt'
|    & $Store.Invoke "IF COL_LENGTH('cfg.Exemption', 'RequestId') IS NOT NULL EXEC (N'SELECT $cols, RequestId FROM cfg.Exemption') ELSE IF OBJECT_ID('cfg.Exemption') IS NOT NULL SELECT $cols, CAST(NULL AS bigint) AS RequestId FROM cfg.Exemption" @{} 'reader' | ForEach-Object { $_ }
|}
|
|function Get-SIProOrdinalOrder {
|    <# PURE. The positions of -Keys in ordinal order (culture never decides an order here -- it differs between PS 5.1
|       and 7). Sorts an int[] alongside the keys: [Array]::Sort with an object[] of items leaves the items unmoved in
|       PowerShell, an int[] is moved. #>
|    param([AllowEmptyCollection()][string[]]$Keys = @())
|    if ($Keys.Count -eq 0) { return }
|    $k = [string[]]$Keys.Clone(); $idx = [int[]](0..($k.Count - 1))
|    [Array]::Sort($k, $idx, [System.StringComparer]::Ordinal)
|    $idx
|}
|
|function Get-SIProRowValue {
|    param($Row, [string]$Name)
|    if ($null -eq $Row) { return $null }
|    if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($Name)) { return $Row[$Name] } else { return $null } }
|    if ($Row.PSObject.Properties[$Name]) { return $Row.$Name }
|    $null
|}
|
|# =====================================================================================================================
|#  MERGE: template + customer state per item -> the effective items of a run.
|# =====================================================================================================================
|function Merge-SIProItems {
|    <#
|        PURE. -Templates (cfg.Template rows), -Overrides (cfg.ItemOverride rows), -Documents (accepted cfg.Document
|        documents, Pro-1b). Per (kind, key):
|          template only                 -> the template body           (Origin 'template')
|          override State 'inherit'      -> the template body           (an explicit "follow the vendor")
|          override State 'override'     -> the customer's body          (Origin 'override'; 'own' when no template)
|          override State 'disable'      -> left out                     (listed in Disabled)
|          retired template, no override -> left out                     (the release no longer ships it)
|        Templates are checked against their BodyHash; overrides are validated by Test-SIProItem. A cfg.Document rule and
|        an override of the same rule, or an override of a kind cfg.Document owns (exclusions), are refused -- one item,
|        one home. Returns @{ Items; Disabled; Refused; Notes; TemplateVersion; Families }.
|        Items are ordered: per kind, templates by SortOrder then key, then the customer's own items by key (ordinal), so
|        the same rows always materialise the same files.
|        ADDITIVE UPGRADE (adopted from PIM4EntraPS): -Revisions (cfg.TemplateRevision rows -- Read-SIProOverrideBaseRevisions
|        reads just the ones needed). An override behind the shipped content whose new shipped version only ADDS (keys,
|        list entries) gets those additions in its effective body; the customer's own values are never touched
|        (Get-SIProAdditiveMerge). The merged body is validated like any override; one that does not validate, or a change
|        that alters / removes something, stays the customer's body as stored (upgrade available, as before). Nothing is
|        written: the stored override keeps its base, so the conformance view shows "new shipped additions applied".
|        MANDATORY CONTROLS: -Mandatory (default: config\template-mandatory.locked.json of $Context.SIRoot). An item with a
|        control that the customer switched off is applied from its template anyway; a required value the effective body
|        breaks is put back on top (Set-SIProMandatoryValues). Each correction is a note. Pass -Mandatory @() for none.
|    #>
|    param([AllowEmptyCollection()][object[]]$Templates = @(), [AllowEmptyCollection()][object[]]$Overrides = @(),
|          [AllowEmptyCollection()][object[]]$Documents = @(), [Parameter(Mandatory)]$Context,
|          [AllowEmptyCollection()][object[]]$Revisions = @(), [AllowEmptyCollection()][object[]]$Mandatory)
|    if ($null -eq $Mandatory) {
|        $Mandatory = @()
|        $mr = if ($Context -and $Context.PSObject.Properties['SIRoot'] -and $Context.SIRoot) { [string]$Context.SIRoot } else { $script:SIProConfigSIRoot }
|        $Mandatory = @(Get-SIProMandatoryControls -SIRoot $mr)
|    }
|    $revIdx = Get-SIProRevisionIndex -Revisions @($Revisions)
|    $refused = New-Object System.Collections.Generic.List[object]; $notes = New-Object System.Collections.Generic.List[string]
|    $disabled = New-Object System.Collections.Generic.List[string]
|    $tpl = @{}; $versions = @{}
|    # #251: the CMDB ownership map's legacy rows (templates + per-entry overrides), kept for the carry-over below
|    $legacyOwnTpl = New-Object System.Collections.Generic.List[object]; $legacyOwnOvr = New-Object System.Collections.Generic.List[object]
|    foreach ($t in @($Templates | Where-Object { $_ })) {
|        $kind = [string](Get-SIProRowValue $t 'Kind'); $key = [string](Get-SIProRowValue $t 'ItemKey')
|        $body = [string](Get-SIProRowValue $t 'BodyJson'); $fmt = [string](Get-SIProRowValue $t 'Format'); if (-not $fmt) { $fmt = 'json' }
|        $name = '{0}/{1}' -f $kind, $key
|        # #251: a template row of a kind that is configuration now (naming, cmdbownership) is history -- never applied as a
|        # template, never refused. A live ownership row still feeds the map until setup has carried it over.
|        if (Test-SIProFormerTemplateKind $kind) {
|            if ($kind -eq 'cmdbownership' -and $null -eq (Get-SIProRowValue $t 'RetiredAt')) { $legacyOwnTpl.Add($t) }
|            continue
|        }
|        $spec = $script:SIProItemKinds[$kind]
|        if (-not $spec -or -not $spec.Templated) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'template'; Reason = ("'{0}' is not a templated configuration kind" -f $kind) }); continue }
|        if ($key -notmatch $spec.Key) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'template'; Reason = 'not a valid key' }); continue }
|        if ($fmt -ne $spec.Format) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'template'; Reason = ("a {0} item is {1}" -f $kind, $spec.Format) }); continue }
|        $h = [string](Get-SIProRowValue $t 'BodyHash')
|        if ((Get-SIProTextHash $body) -ne $h.Trim()) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'template'; Reason = 'the body does not match its BodyHash -- republish the templates' }); continue }
|        if ($fmt -eq 'json') { try { $null = ConvertFrom-SIProJson $body } catch { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'template'; Reason = 'the body is not valid JSON' }); continue } }
|        $so = 0; [void][int]::TryParse([string](Get-SIProRowValue $t 'SortOrder'), [ref]$so)
|        $v = [string](Get-SIProRowValue $t 'TemplateVersion'); if ($v) { $versions[$v] = $true }
|        $tpl[$name] = [pscustomobject]@{ Kind = $kind; Key = $key; Body = $body; Format = $fmt; SortOrder = $so; Hash = $h.Trim()
|            ContentHash = ([string](Get-SIProRowValue $t 'ContentHash')).Trim()
|            Source = [string](Get-SIProRowValue $t 'Source'); Version = $v; Retired = ($null -ne (Get-SIProRowValue $t 'RetiredAt')) }
|    }
|    $docKeys = @{}; foreach ($d in @($Documents | Where-Object { $_ })) { $docKeys[('{0}/{1}' -f $d.Kind, $d.Key)] = $true }
|    $ovr = @{}
|    foreach ($o in @($Overrides | Where-Object { $_ })) {
|        $kind = [string](Get-SIProRowValue $o 'Kind'); $key = [string](Get-SIProRowValue $o 'ItemKey'); $state = [string](Get-SIProRowValue $o 'State')
|        $body = Get-SIProRowValue $o 'BodyJson'; $fmt = [string](Get-SIProRowValue $o 'Format'); if (-not $fmt) { $fmt = 'json' }
|        $name = '{0}/{1}' -f $kind, $key
|        if ($kind -eq 'exclusions') { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'override'; Reason = 'exclusions are documents (cfg.Document), not item overrides' }); continue }
|        if ($state -notin 'inherit', 'override', 'disable') { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'override'; Reason = ("'{0}' is not a state (inherit, override, disable)" -f $state) }); continue }
|        $spec = $script:SIProItemKinds[$kind]
|        if (-not $spec) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'override'; Reason = ("'{0}' is not a configuration kind" -f $kind) }); continue }
|        if ($key -notmatch $spec.Key) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'override'; Reason = 'not a valid key' }); continue }
|        if ($docKeys.ContainsKey($name) -and $state -ne 'inherit') { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'override'; Reason = 'the same item is also a cfg.Document -- one item, one home' }); continue }
|        # #251: a legacy per-entry ownership row (defaults, assettype/<type>) is carried into the map, not applied by itself
|        if ($kind -eq 'cmdbownership' -and $key -ne 'map') { $legacyOwnOvr.Add($o); continue }
|        if ($state -eq 'override') {
|            # the required values go on top BEFORE the override is validated: a stored override that weakens one (a
|            # built-in factor switched off) keeps the customer's other values with the required value applied, instead of
|            # being refused whole by the item rules
|            if ($fmt -eq 'json' -and @($Mandatory).Count) {
|                $mv0 = Set-SIProMandatoryValues -Controls $Mandatory -Kind $kind -Key $key -Body ([string]$body)
|                if ($mv0.Changed) { $body = [string]$mv0.Body; foreach ($a in @($mv0.Applied)) { $notes.Add($a) } }
|            }
|            $why = @(Test-SIProItem -Kind $kind -Key $key -Body ([string]$body) -Format $fmt -Context $Context)
|            if ($why.Count) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'override'; Reason = ($why -join '; ') }); continue }
|        }
|        $ovr[$name] = [pscustomobject]@{ Kind = $kind; Key = $key; State = $state; Body = [string]$body; Format = $fmt; BaseHash = [string](Get-SIProRowValue $o 'BaseHash') }
|    }
|    $items = New-Object System.Collections.Generic.List[object]
|    foreach ($name in @($tpl.Keys)) {
|        $t = $tpl[$name]; $o = $ovr[$name]
|        if ($o -and $o.State -eq 'disable') {
|            # a mandatory item is never switched off: the template applies, and the run says so
|            if (-not $t.Retired -and @(Get-SIProMandatoryFor -Controls $Mandatory -Kind $t.Kind -Key $t.Key).Count) {
|                $notes.Add(("{0}: switched off, but SecurityInsight requires it -- the shipped item is applied" -f $name))
|                $items.Add([pscustomobject]@{ Kind = $t.Kind; Key = $t.Key; Body = $t.Body; Format = $t.Format; Origin = 'template'; SortOrder = $t.SortOrder; Source = $t.Source; Stale = $false; Mandatory = $true })
|                continue
|            }
|            $disabled.Add($name); continue
|        }
|        if ($o -and $o.State -eq 'override') {
|            # BaseHash is the template's normalised ContentHash (template versioning), or its raw BodyHash for an override
|            # made before content hashes -- either one matching means the template's CONTENT did not move underneath it.
|            $b = ([string]$o.BaseHash).Trim()
|            $stale = $false
|            if ($b -and $b -ne $t.Hash) {
|                $ch = $t.ContentHash
|                if (-not $ch) { try { $ch = Get-SIProContentHash -Body $t.Body -Format $t.Format } catch { $ch = '' } }
|                $stale = ($b -ne $ch)
|            }
|            $effBody = $o.Body; $added = @()
|            if ($stale -and $b) {
|                # additive upgrade: the shipped version the override was made on, by its content hash or raw body hash
|                $base = $revIdx[('{0}#{1}' -f $name, $b)]
|                if ($base) {
|                    $am = Get-SIProAdditiveMerge -Base ([string](Get-SIProRowValue $base 'BodyJson')) -Current $t.Body -Override $o.Body -Format $o.Format
|                    if ($am.Additive) {
|                        $why = @()
|                        if ($am.Changed) { $why = @(Test-SIProItem -Kind $t.Kind -Key $t.Key -Body ([string]$am.Body) -Format $o.Format -Context $Context) }
|                        if ($why.Count -eq 0) {
|                            $effBody = [string]$am.Body; $added = @($am.Added); $stale = $false
|                            if ($added.Count) { $notes.Add(("{0}: overridden -- new shipped additions applied ({1}); your own values are unchanged" -f $name, ($added -join ', '))) }
|                        } else {
|                            $notes.Add(("{0}: the new shipped additions do not fit your version ({1}) -- review the upgrade" -f $name, ($why -join '; ')))
|                        }
|                    }
|                }
|            }
|            if ($stale) { $notes.Add(("{0}: the template changed since it was overridden -- an upgrade is available (see the template conformance view)" -f $name)) }
|            $items.Add([pscustomobject]@{ Kind = $t.Kind; Key = $t.Key; Body = $effBody; Format = $o.Format; Origin = 'override'; SortOrder = $t.SortOrder; Source = $t.Source; Stale = $stale
|                AdditionsApplied = ($added.Count -gt 0); Additions = $added })
|            continue
|        }
|        if ($t.Retired) { continue }
|        $items.Add([pscustomobject]@{ Kind = $t.Kind; Key = $t.Key; Body = $t.Body; Format = $t.Format; Origin = 'template'; SortOrder = $t.SortOrder; Source = $t.Source; Stale = $false })
|    }
|    foreach ($name in @($ovr.Keys)) {
|        if ($tpl.ContainsKey($name)) { continue }
|        $o = $ovr[$name]
|        if ($o.State -ne 'override') {
|            # a naming 'disable' / 'inherit' made against a template that is a setting now: the catalog default applies -- quiet
|            if (-not (Test-SIProFormerTemplateKind $o.Kind)) { $notes.Add(("{0}: '{1}' has no template to apply to -- nothing to do" -f $name, $o.State)) }
|            continue
|        }
|        $items.Add([pscustomobject]@{ Kind = $o.Kind; Key = $o.Key; Body = $o.Body; Format = $o.Format; Origin = 'own'; SortOrder = [int]::MaxValue; Source = ''; Stale = $false })
|    }
|    # #251: the CMDB ownership map. The configuration document cmdbownership/map is the map; until setup has written it, the
|    # map is built from the legacy rows exactly as it was materialised before (templates with the customer's per-entry
|    # overrides over them), so nothing the customer set is lost in between.
|    if (-not $ovr.ContainsKey('cmdbownership/map') -and ($legacyOwnTpl.Count -or @($legacyOwnOvr | Where-Object { [string](Get-SIProRowValue $_ 'State') -eq 'override' }).Count)) {
|        $mapBody = ConvertTo-SIProOwnershipMap -Templates $legacyOwnTpl.ToArray() -Overrides $legacyOwnOvr.ToArray()
|        if ($mapBody) { $items.Add([pscustomobject]@{ Kind = 'cmdbownership'; Key = 'map'; Body = $mapBody; Format = 'json'; Origin = 'own'; SortOrder = [int]::MaxValue; Source = 'carried over from the ownership templates'; Stale = $false }) }
|    }
|    # mandatory controls: the required values ON TOP of every effective JSON body (an override cannot weaken them)
|    if (@($Mandatory).Count) {
|        foreach ($it in $items) {
|            if ($it.Format -ne 'json') { continue }
|            $mv = Set-SIProMandatoryValues -Controls $Mandatory -Kind $it.Kind -Key $it.Key -Body $it.Body
|            if (-not $mv.Changed) { continue }
|            $it.Body = [string]$mv.Body
|            foreach ($a in @($mv.Applied)) { $notes.Add($a) }
|        }
|    }
|    $kindOrder = @{}; $i = 0; foreach ($k in $script:SIProItemKinds.Keys) { $kindOrder[$k] = $i++ }
|    $unsorted = $items.ToArray()
|    $arr = @(foreach ($i in (Get-SIProOrdinalOrder -Keys @($unsorted | ForEach-Object { '{0:D3}|{1:D10}|{2}' -f $kindOrder[$_.Kind], [long]$_.SortOrder, $_.Key }))) { $unsorted[$i] })
|    $families = @{}; foreach ($t in $tpl.Values) { $families[$t.Kind] = $true }
|    # A family whose files are generated whole (catalog, index, ownership map, model, tagging rules) is served from SQL
|    # only once its templates are published -- until then the customer's items for it cannot be applied. Say so.
|    foreach ($k in 'rareport', 'riskindex', 'assettagging', 'servicemodel') {
|        if ($families[$k]) { continue }
|        $n = @($arr | Where-Object { $_.Kind -eq $k -and -not ($k -eq 'assettagging' -and $_.Key -eq 'config') }).Count
|        if ($n) { $notes.Add(("{0} {1} item(s) are NOT applied: no {1} templates are published yet, so this family is still read from the installation -- run setup\Publish-SITemplates.ps1 -Apply" -f $n, $k)) }
|    }
|    $vlist = [string[]]@($versions.Keys); [Array]::Sort($vlist, [System.StringComparer]::Ordinal)
|    $dl = $disabled.ToArray(); [Array]::Sort($dl, [System.StringComparer]::Ordinal)
|    [pscustomobject]@{ Items = $arr; Disabled = $dl; Refused = $refused.ToArray(); Notes = $notes.ToArray()
|        TemplateVersion = ($vlist -join ', '); Families = $families }
|}
|
|# =====================================================================================================================
|#  EXEMPTIONS ("exempt this finding")
|# =====================================================================================================================
|function ConvertTo-SIProUtc {
|    <# PURE. A SQL datetime2 (stored as UTC, read back with Kind Unspecified), a DateTime or an ISO text -> UTC; $null stays $null. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or ($Value -is [string] -and [string]::IsNullOrWhiteSpace($Value)) -or $Value -is [System.DBNull]) { return $null }
|    if ($Value -is [datetime]) {
|        if ($Value.Kind -eq [DateTimeKind]::Local) { return $Value.ToUniversalTime() }
|        return [datetime]::SpecifyKind($Value, [DateTimeKind]::Utc)
|    }
|    [datetime]::Parse([string]$Value, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]'AdjustToUniversal, AssumeUniversal')
|}
|
|function ConvertFrom-SIProExemptionRows {
|    <#
|        PURE. cfg.Exemption rows -> Active (applied), Inactive (expired or revoked -- with why), Refused (malformed; the
|        run stops). -Now is a seam (UTC).
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [Parameter(Mandatory)]$Context, [datetime]$Now = ([datetime]::UtcNow))
|    $active = New-Object System.Collections.Generic.List[object]; $inactive = New-Object System.Collections.Generic.List[object]; $refused = New-Object System.Collections.Generic.List[object]
|    foreach ($r in @($Rows | Where-Object { $_ })) {
|        $id = [string](Get-SIProRowValue $r 'ExemptionId'); $name = 'exemption/' + $id
|        $scope = [string](Get-SIProRowValue $r 'Scope'); $rep = [string](Get-SIProRowValue $r 'ReportName')
|        $cve = [string](Get-SIProRowValue $r 'Cve'); $cfg = [string](Get-SIProRowValue $r 'ConfigurationId'); $asset = [string](Get-SIProRowValue $r 'AssetKey')
|        $why = New-Object System.Collections.Generic.List[string]
|        # The scopes are the management GUI's: finding = one issue on one asset; issue = one issue on every asset;
|        # asset = every issue of one asset. ReportName narrows any of them to one report (empty = every report).
|        if ($scope -notin 'finding', 'issue', 'asset') { $why.Add("Scope must be 'finding', 'issue' or 'asset'") }
|        if ($rep -and @($Context.Reports) -notcontains $rep) { $why.Add(("'{0}' is not a Risk Analysis report" -f $rep)) }
|        if ($scope -eq 'finding' -and (-not $asset -or (-not $cve -and -not $cfg))) { $why.Add('a finding exemption names an asset AND a CVE or configuration id') }
|        if ($scope -eq 'issue' -and ($asset -or (-not $cve -and -not $cfg))) { $why.Add('an issue exemption names a CVE or configuration id and no asset') }
|        if ($scope -eq 'asset' -and (-not $asset -or $cve -or $cfg)) { $why.Add('an asset exemption names an asset and no CVE or configuration id') }
|        if ($cve -and $cve -notmatch '^CVE-\d{4}-\d{4,7}$') { $why.Add(("'{0}' is not a valid CVE id" -f $cve)) }
|        if ($cfg -and $cfg -notmatch '^[A-Za-z0-9._:\-]{1,128}$') { $why.Add(("'{0}' is not a valid configuration id" -f $cfg)) }
|        if ($asset -and $asset -notmatch '^[^"\\\r\n]{1,256}$') { $why.Add('the asset key may not hold quotes, backslashes or line breaks') }
|        if ([string]::IsNullOrWhiteSpace([string](Get-SIProRowValue $r 'Reason'))) { $why.Add('an exemption needs a reason') }
|        if ($why.Count) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'exemption'; Reason = ($why -join '; ') }); continue }
|        $rev = Get-SIProRowValue $r 'RevokedAt'; $exp = ConvertTo-SIProUtc (Get-SIProRowValue $r 'ExpiresAt')
|        $e = [pscustomobject]@{ Id = $id; Scope = $scope; ReportName = $(if ($rep) { $rep } else { $null }); Cve = $(if ($cve) { $cve.ToUpperInvariant() } else { $null })
|            ConfigurationId = $(if ($cfg) { $cfg } else { $null }); AssetKey = $(if ($asset) { $asset } else { $null }); Reason = [string](Get-SIProRowValue $r 'Reason')
|            ExpiresAt = $(if ($exp) { $exp.ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture) } else { $null })
|            RequestId = $(if ([string](Get-SIProRowValue $r 'RequestId')) { [string](Get-SIProRowValue $r 'RequestId') } else { $null }) }
|        if ($null -ne $rev -and [string]$rev -ne '') { $inactive.Add([pscustomobject]@{ Exemption = $e; Why = 'revoked' }); continue }
|        if ($exp -and $exp -le $Now) { $inactive.Add([pscustomobject]@{ Exemption = $e; Why = 'expired' }); continue }
|        $active.Add($e)
|    }
|    $u = $active.ToArray()
|    $a = @(foreach ($i in (Get-SIProOrdinalOrder -Keys @($u | ForEach-Object { '{0:D20}' -f [long]$_.Id }))) { $u[$i] })
|    [pscustomobject]@{ Active = $a; Inactive = $inactive.ToArray(); Refused = $refused.ToArray() }
|}
|
|function Get-SIProExemptionPlan {
|    <#
|        PURE. How active exemptions reach Risk Analysis without changing its queries (#264): EVERY active exemption --
|        finding, issue or asset scope -- goes to RiskAnalysisExemptions.json, and Risk Analysis MARKS the rows it covers
|        (RA-Exemptions.ps1). Nothing becomes a KQL exclusion any more: an exclusion removes the finding from the raw data,
|        and an exempted finding must stay in it (marked) so the views decide what to show and count.
|        (Before #264 an exemption without an asset was merged into the report's exclusion file. The #211 exclusion lists
|        themselves are unchanged: they are the customer's own "never report this" rules, not exemptions.)
|        -QueryOf is accepted for compatibility and no longer used.
|        Returns @{ Exclusions = (always empty); Marked = [...]; AssetScoped = the same list (the earlier name) }.
|    #>
|    param([AllowEmptyCollection()][object[]]$Active = @(), [hashtable]$QueryOf = @{})
|    $marked = @($Active | Where-Object { $null -ne $_ })
|    [pscustomobject]@{ Exclusions = [ordered]@{}; Marked = $marked; AssetScoped = $marked }
|}
|# =====================================================================================================================
|#  MATERIALISE -- the effective configuration into the run-local folder, in the files the engines already read.
|# =====================================================================================================================
|function Join-SIProPath {
|    <# [IO.Path]::Combine over segments that may carry either separator -- the same code runs on Windows and in the Linux container. #>
|    param([Parameter(Mandatory)][string]$Base, [Parameter(ValueFromRemainingArguments)][string[]]$Parts)
|    $p = $Base
|    foreach ($x in $Parts) { foreach ($seg in ($x -split '[\\/]')) { if ($seg) { $p = [System.IO.Path]::Combine($p, $seg) } } }
|    $p
|}
|
|function Write-SIProFile {
|    param([Parameter(Mandatory)][string]$Path, [AllowEmptyString()][string]$Text)
|    $d = [System.IO.Path]::GetDirectoryName($Path)
|    if (-not (Test-Path -LiteralPath $d)) { New-Item -ItemType Directory -Path $d -Force | Out-Null }
|    # WITH a BOM: PowerShell 5.1's Get-Content (the rule loader, the report catalog loader) reads a BOM-less file as ANSI,
|    # and the shipped catalog and rules carry non-ASCII text. Every reader here strips the BOM.
|    [System.IO.File]::WriteAllText($Path, $Text, (New-Object System.Text.UTF8Encoding($true)))
|}
|
|function ConvertTo-SIProCsvField {
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    '"' + ([string]$Value).Replace('"', '""') + '"'
|}
|
|function Get-SIProTemplateIncluded {
|    <# PURE. The report names a report template includes (ReportsIncluded: names, or objects with Name / ReportName). #>
|    param($Template)
|    $inc = $null
|    if ($Template -is [System.Collections.IDictionary]) { if ($Template.Contains('ReportsIncluded')) { $inc = $Template['ReportsIncluded'] } }
|    elseif ($Template.PSObject.Properties['ReportsIncluded']) { $inc = $Template.ReportsIncluded }
|    @(foreach ($i in @($inc | Where-Object { $null -ne $_ })) {
|        if ($i -is [string]) { $i }
|        elseif ($i -is [System.Collections.IDictionary]) { if ($i.Contains('Name')) { [string]$i['Name'] } else { [string]$i['ReportName'] } }
|        elseif ($i.PSObject.Properties['Name']) { [string]$i.Name } else { [string]$i.ReportName }
|    })
|}
|
|function Get-SIProTemplateMembership {
|    <#
|        Report template name -> the report names it includes, for THIS run: -FromItems = the rareport items of the run (the
|        catalog is served from SQL); otherwise the installation's catalog (risk-analysis-detection\RiskAnalysis_Queries_
|        Locked.yaml, then RiskAnalysis_Queries_Custom.yaml -- a custom template of the same name replaces the locked one).
|    #>
|    param([AllowEmptyCollection()][object[]]$Items = @(), [bool]$FromItems, [string]$SIRoot)
|    $map = [ordered]@{}
|    if ($FromItems) {
|        foreach ($it in @($Items | Where-Object { $_.Key -like 'template/*' })) { $map[$it.Key.Substring(9)] = @(Get-SIProTemplateIncluded (ConvertFrom-SIProJson $it.Body)) }
|        return $map
|    }
|    foreach ($f in 'RiskAnalysis_Queries_Locked.yaml', 'RiskAnalysis_Queries_Custom.yaml') {
|        $p = Join-SIProPath $SIRoot 'risk-analysis-detection' $f
|        if (-not (Test-Path -LiteralPath $p)) { continue }
|        $y = ConvertFrom-SIYaml -Path $p -Ordered
|        foreach ($t in @($y['ReportTemplates'] | Where-Object { $null -ne $_ })) { $map[[string]$t['ReportName']] = @(Get-SIProTemplateIncluded $t) }
|    }
|    $map
|}
|
|function Export-SIProConfig {
|    <#
|        Materialise everything a run needs into -RunFolder (never the installation -- a folder inside it is refused):
|          rules\                      the rules overlay (set as SI_EnrichmentDataRoot): the run's existing overlay copied
|                                      first; when rule TEMPLATES exist every effective template rule at its shipped place as
|                                      <id>.locked.yaml, an override beside it as <id>.custom.yaml (it outranks the locked
|                                      one in Get-SIRuleSet), and RulesFromSql = the tree is not read; cfg.Document rules as
|                                      Pro-1b; decision files at the overlay ROOT (where their loaders look).
|          risk-analysis\              (SI_ProRaSettingsPath) exclusion documents merged with exemption-derived lists,
|                                      the weights document (+ the model sections), per-report weights, the report catalog
|                                      (RiskAnalysis_Queries_Locked.yaml -- JSON, which is YAML), the risk index CSV,
|                                      RiskAnalysisExemptions.json.
|          config\                     (SI_ProConfigRoot) cmdb-source-ownership.locked.json, service-model.locked.json,
|                                      asset-tagging.config.json, asset-profiling-schema\<engine>.schema.custom.json,
|                                      server-applications.json (the catalog override, #275 R6);
|                                      output-scope.json (#274: the output scope per destination, templates resolved);
|                                      config\asset-tagging\ (SI_ProAssetTaggingPath) AssetTagging.locked.yaml.
|          data-model\                 (SI_DataModelRoot, #456) every data-model template, put back together from its items
|                                      (templates + overrides + own items), validated -- a file with no rows is copied
|                                      from the installation.
|        Returns what was written and the folders to point the engines at.
|    #>
|    param([AllowEmptyCollection()][object[]]$Items = @(), [AllowEmptyCollection()][object[]]$Documents = @(),
|          [AllowEmptyCollection()][object[]]$Exemptions = @(), [hashtable]$Families = @{},
|          [Parameter(Mandatory)][string]$RunFolder, [Parameter(Mandatory)]$Context, [string]$ExistingOverlay)
|    $sep = [System.IO.Path]::DirectorySeparatorChar
|    $siFull = [System.IO.Path]::GetFullPath([string]$Context.SIRoot).TrimEnd('\', '/') + $sep
|    $runFull = [System.IO.Path]::GetFullPath($RunFolder).TrimEnd('\', '/') + $sep
|    if ($runFull.StartsWith($siFull, [StringComparison]::OrdinalIgnoreCase)) { throw ('the run-local folder {0} is inside the SecurityInsight folder -- documents are never written into the installation' -f $RunFolder) }
|    $out = [ordered]@{ RulesRoot = $null; RaSettingsPath = $null; ConfigRoot = $null; AssetTaggingPath = $null; RulesFromSql = $false
|        Rules = 0; Exclusions = 0; Weights = 0; Reports = 0; RiskIndexRows = 0; Exemptions = 0; ConfigFiles = 0; Decisions = 0; RuleTiers = 0; Naming = @{}
|        DataModelRoot = $null; DataModelItems = 0
|        Notes = (New-Object System.Collections.Generic.List[string]) }
|    $byKind = @{}; foreach ($it in @($Items)) { if (-not $byKind.ContainsKey($it.Kind)) { $byKind[$it.Kind] = New-Object System.Collections.Generic.List[object] }; $byKind[$it.Kind].Add($it) }
|    $kindItems = { param($k) if ($byKind.ContainsKey($k)) { $byKind[$k].ToArray() } else { @() } }
|
|    # ---- rules overlay ------------------------------------------------------------------------------------------------
|    $ruleDocs = @($Documents | Where-Object { $_.Kind -eq 'rule' })
|    $ruleItems = @(& $kindItems 'rule')
|    $decisions = @(& $kindItems 'decision')
|    $tiers = @(& $kindItems 'ruletier')
|    if ($ruleDocs.Count -or $ruleItems.Count -or $decisions.Count -or $tiers.Count -or $Families['rule']) {
|        $ov = Join-SIProPath $RunFolder 'rules'
|        New-Item -ItemType Directory -Path $ov -Force | Out-Null
|        if (-not [string]::IsNullOrWhiteSpace($ExistingOverlay) -and (Test-Path -LiteralPath $ExistingOverlay)) {
|            $src = [System.IO.Path]::GetFullPath($ExistingOverlay).TrimEnd('\', '/')
|            foreach ($f in @(Get-ChildItem -LiteralPath $src -Recurse -File -ErrorAction Stop)) {
|                $to = Join-SIProPath $ov $f.FullName.Substring($src.Length)
|                $d = [System.IO.Path]::GetDirectoryName($to)
|                if (-not (Test-Path -LiteralPath $d)) { New-Item -ItemType Directory -Path $d -Force | Out-Null }
|                [System.IO.File]::Copy($f.FullName, $to, $true)
|            }
|        }
|        # the folder a template rule ships in (relative to its engine folder), so a method filter still finds it
|        $relDirOf = @{}
|        foreach ($it in $ruleItems) {
|            $rel = ''
|            if ($it.Source) {
|                $parts = @($it.Source -split '[\\/]' | Where-Object { $_ })
|                $ei = [Array]::IndexOf([string[]]@($parts | ForEach-Object { $_.ToLowerInvariant() }), $it.Key.Split('/')[0])
|                if ($ei -ge 0 -and $parts.Count - $ei -gt 2) { $rel = ($parts[($ei + 1)..($parts.Count - 2)] -join '/') }
|            }
|            $relDirOf[$it.Key] = $rel
|        }
|        $removeCopied = {
|            param([string]$engineDir, [string]$id)
|            foreach ($f in @(Get-ChildItem -LiteralPath $engineDir -Recurse -File -Filter '*.custom.yaml' -ErrorAction SilentlyContinue)) {
|                $h = Get-SIRuleHeader -Text ([System.IO.File]::ReadAllText($f.FullName))
|                $fid = if ($h.Id) { $h.Id } else { $f.Name -replace '\.custom\.yaml$', '' }
|                if ($fid -eq $id) { Remove-Item -LiteralPath $f.FullName -Force }   # the run's own copy -- the database wins
|            }
|        }
|        foreach ($it in $ruleItems) {
|            $engine, $id = $it.Key -split '/', 2
|            $edir = Join-SIProPath $ov $engine
|            $name = if ($it.Origin -eq 'template') { '{0}.locked.yaml' -f $id } else { '{0}.custom.yaml' -f $id }
|            if ($it.Origin -ne 'template') { & $removeCopied $edir $id }
|            Write-SIProFile -Path (Join-SIProPath $edir $relDirOf[$it.Key] $name) -Text $it.Body.TrimStart([char]0xFEFF)
|            $out.Rules++
|        }
|        foreach ($doc in $ruleDocs) {
|            $engine, $id = $doc.Key -split '/', 2
|            $edir = Join-SIProPath $ov $engine
|            & $removeCopied $edir $id
|            $rel = if ($relDirOf.ContainsKey($doc.Key)) { $relDirOf[$doc.Key] } else { '' }
|            Write-SIProFile -Path (Join-SIProPath $edir $rel ('{0}.custom.yaml' -f $id)) -Text $doc.Body
|            $out.Rules++
|        }
|        # The tier board's whole-rule moves: the rule IN FORCE (a document, else an override / template, else the shipped
|        # file) with every Tier it sets changed, written as the rule's custom copy so it outranks every other source.
|        foreach ($it in $tiers) {
|            $tier = [int](ConvertFrom-SIProJson $it.Body).tier
|            $engine, $id = $it.Key -split '/', 2
|            $src = $null
|            $doc = @($ruleDocs | Where-Object { $_.Key -eq $it.Key }) | Select-Object -First 1
|            if ($doc) { $src = $doc.Body }
|            if (-not $src) { $ri = @($ruleItems | Where-Object { $_.Key -eq $it.Key }) | Select-Object -First 1; if ($ri) { $src = $ri.Body } }
|            if (-not $src -and -not $Families['rule']) {
|                $tree = Join-SIProPath ([string]$Context.SIRoot) 'asset-profiling-enrichment' $engine
|                $hit = @(Get-ChildItem -LiteralPath $tree -Recurse -File -Filter ('{0}.locked.yaml' -f $id) -ErrorAction SilentlyContinue) | Select-Object -First 1
|                if ($hit) {
|                    $src = [System.IO.File]::ReadAllText($hit.FullName)
|                    if (-not $relDirOf.ContainsKey($it.Key)) { $relDirOf[$it.Key] = ($hit.DirectoryName.Substring($tree.Length).TrimStart('\', '/') -replace '\\', '/') }
|                }
|            }
|            if (-not $src) { $out.Notes.Add(("ruletier/{0}: the rule is not in force (removed, or turned off) -- the tier decision is not applied" -f $it.Key)); continue }
|            if ($src -match '(?m)^mode\s*:\s*disable\b') { $out.Notes.Add(("ruletier/{0}: the rule is turned off -- the tier decision is not applied" -f $it.Key)); continue }
|            $rx = '(?m)^(\s+Tier\s*:\s*)[''"]?\d+[''"]?'
|            if (-not [regex]::IsMatch($src, $rx)) { throw ("ruletier/{0}: the rule sets no Tier, so it cannot be moved to tier {1}" -f $it.Key, $tier) }
|            $text = [regex]::Replace($src.TrimStart([char]0xFEFF), $rx, ('${1}' + $tier))
|            $why = @(Test-SIRuleText -Text $text -Id $id -Kinds @($Context.Kinds))
|            if ($why.Count) { throw ("ruletier/{0}: the moved rule does not validate: {1}" -f $it.Key, ($why -join '; ')) }
|            $edir = Join-SIProPath $ov $engine
|            & $removeCopied $edir $id
|            $rel = if ($relDirOf.ContainsKey($it.Key)) { $relDirOf[$it.Key] } else { '' }
|            Write-SIProFile -Path (Join-SIProPath $edir $rel ('{0}.custom.yaml' -f $id)) -Text $text
|            $out.RuleTiers++
|        }        foreach ($it in $decisions) {
|            $file = if ($it.Key -eq 'asset') { 'asset-decisions.custom.yaml' } else { 'correlation-decisions.custom.yaml' }
|            Write-SIProFile -Path (Join-SIProPath $ov $file) -Text $it.Body.TrimStart([char]0xFEFF)
|            $out.Decisions++
|        }
|        $out.RulesRoot = $ov
|        $out.RulesFromSql = [bool]$Families['rule']
|    }
|
|    # ---- Risk Analysis ------------------------------------------------------------------------------------------------
|    $rp = Join-SIProPath $RunFolder 'risk-analysis'
|    $raWritten = $false
|    $ensureRa = { if (-not (Test-Path -LiteralPath $rp)) { New-Item -ItemType Directory -Path $rp -Force | Out-Null } }
|    # the report catalog (only when the family is served from SQL)
|    $rareports = @(& $kindItems 'rareport')
|    $queryOf = @{}
|    if ($Families['rareport'] -or $rareports.Count) {
|        $reports = New-Object System.Collections.Generic.List[string]; $templates = New-Object System.Collections.Generic.List[object]
|        $present = @{}
|        foreach ($it in $rareports) {
|            if ($it.Key -like 'report/*') {
|                $reports.Add($it.Body.Trim()); $present[$it.Key.Substring(7)] = $true
|                try { $queryOf[$it.Key.Substring(7)] = (@((ConvertFrom-SIProJson $it.Body).ReportQuery) -join "`n") } catch { }
|            } else { $templates.Add($it) }
|        }
|        if ($Families['rareport']) {
|            $tplTexts = foreach ($t in $templates) {
|                # a report that is disabled (or retired) leaves every template that includes it
|                $o = ConvertFrom-SIProJson $t.Body
|                $inc = @($o.ReportsIncluded | Where-Object { $null -ne $_ } | Where-Object {
|                    $n = if ($_ -is [string]) { $_ } elseif ($_.PSObject.Properties['Name']) { [string]$_.Name } else { [string]$_.ReportName }
|                    $present.ContainsKey($n) })
|                $o.ReportsIncluded = $inc
|                ConvertTo-SIProJson -Value $o -Level 2
|            }
|            & $ensureRa
|            $catalogText = "{`n  `"Reports`": [`n" + (($reports | ForEach-Object { $_ }) -join ",`n") + "`n  ],`n  `"ReportTemplates`": [`n" + (@($tplTexts) -join ",`n") + "`n  ]`n}`n"
|            $fileName = if ($global:ReportSettingsFileLocked) { [string]$global:ReportSettingsFileLocked } else { $script:SIProRaCatalogFile }
|            Write-SIProFile -Path (Join-SIProPath $rp $fileName) -Text $catalogText
|            $out.Reports = $reports.Count; $raWritten = $true
|        }
|    }
|    if (-not $queryOf.Count) {
|        # the shipped catalog tells which reports carry which exclusion block (global exemptions fan out by it)
|        $lp = Join-SIProPath ([string]$Context.SIRoot) 'risk-analysis-detection' $script:SIProRaCatalogFile
|        if (Test-Path -LiteralPath $lp) {
|            $txt = [System.IO.File]::ReadAllText($lp)
|            foreach ($m in [regex]::Matches($txt, '(?ms)^\s*-\s*ReportName:\s*([A-Za-z0-9_]+)\s*$(.*?)(?=^\s*-\s*ReportName:|\z)')) { $queryOf[$m.Groups[1].Value] = $m.Groups[2].Value }
|        }
|    }
|    # the risk index
|    if ($Families['riskindex']) {
|        $rows = @(& $kindItems 'riskindex')
|        # #559: the run file is keyed by the SI generic fields. A row stored with the 2.2 columns is translated
|        # (riskscore.index.translation.locked.json, RA-RiskIndexSi.ps1) -- its base values unchanged.
|        $raw = @(foreach ($it in $rows) { ConvertFrom-SIProJson $it.Body })
|        $positioned = @($raw | Where-Object { $_ -and $_.PSObject.Properties['Precedence'] -and -not [string]::IsNullOrWhiteSpace([string]$_.Precedence) }).Count
|        $allV22 = ($raw.Count -gt 0) -and (@($raw | Where-Object { -not (Test-SIRiskIndexV22Form @($_)) }).Count -eq 0)
|        $text = $null
|        if ($positioned -eq 0 -and $allV22) {
|            # an index from before the order (v2.2 rows): the v2.2 ladder puts it in first-match order with the same scores
|            # (RA-RiskIndexOrder.ps1), then every row is translated
|            # (a stored item carries a blank Precedence: drop it, or the ladder is skipped and the rows are only sorted)
|            $noPos = @(foreach ($o in $raw) { $c = [ordered]@{}; foreach ($pp in $o.PSObject.Properties) { if ($pp.Name -ne 'Precedence') { $c[$pp.Name] = $pp.Value } }; [pscustomobject]$c })
|            $text = ConvertTo-SIRiskIndexSiCsvText -OrderedRows @(ConvertTo-SIRiskIndexSiRows -Rows $noPos)
|        } else {
|            # First match wins: the rows in Precedence order, renumbered 1..n. A row with no place (an item made before the
|            # index had an order) is checked after every placed row -- said, so it is reviewed in the Risk index editor.
|            if ($positioned -lt $raw.Count) { $out.Notes.Add(("riskindex: {0} row(s) have no place in the order (made before the risk index had one) -- they are checked after the other rows; give them a place on the Risk index page" -f ($raw.Count - $positioned))) }
|            $bodies = @(foreach ($o in $raw) { [pscustomobject](ConvertTo-SIRiskIndexSiRow -Row $o) })
|            $text = ConvertTo-SIRiskIndexSiCsvText -OrderedRows @(ConvertTo-SIRiskIndexSiRows -Rows $bodies)
|        }
|        & $ensureRa
|        Write-SIProFile -Path (Join-SIProPath $rp $script:SIProRiskIndexFile) -Text $text
|        $out.RiskIndexRows = $rows.Count; $raWritten = $true
|    }
|    # exclusions: the documents, merged with what exemptions add
|    $plan = Get-SIProExemptionPlan -Active @($Exemptions) -QueryOf $queryOf
|    # A document no exemption touches is written byte for byte (Pro-1b); one an exemption adds to is re-serialised.
|    $exclDocs = [ordered]@{}
|    foreach ($doc in @($Documents | Where-Object { $_.Kind -eq 'exclusions' })) { $exclDocs[$doc.Key] = $doc.Body }
|    foreach ($rep in @($plan.Exclusions.Keys)) {
|        $o = if ($exclDocs.Contains($rep)) { ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $exclDocs[$rep]) } else { [ordered]@{ '_source' = 'cfg.Exemption (SecurityInsight Pro)' } }
|        foreach ($prop in 'ExcludedCves', 'ExcludedConfigurationIds') {
|            $add = @($plan.Exclusions[$rep][$prop])
|            if (-not $add.Count) { continue }
|            $have = @(); if ($o.Contains($prop)) { $have = @($o[$prop] | Where-Object { $null -ne $_ } | ForEach-Object { [string]$_ }) }
|            $o[$prop] = @($have + @($add | Where-Object { $have -notcontains $_ }))
|        }
|        $exclDocs[$rep] = ConvertTo-SIProJson -Value $o
|        $out.Exemptions += @($plan.Exclusions[$rep]['ExcludedCves']).Count + @($plan.Exclusions[$rep]['ExcludedConfigurationIds']).Count
|    }
|    foreach ($key in @($exclDocs.Keys)) {
|        $pageKey = if ($key -eq 'global') { 'exclusions:global' } else { 'exclusions:' + $key }
|        $target = Resolve-SIJsonTarget -SIRoot ([string]$Context.SIRoot) -Key $pageKey -Reports @($Context.Reports)
|        if (-not $target) { throw ("no settings file for the exclusions of {0}" -f $key) }
|        & $ensureRa
|        Write-SIProFile -Path (Join-SIProPath $rp ([System.IO.Path]::GetFileName($target))) -Text $exclDocs[$key]
|        $out.Exclusions++; $raWritten = $true
|    }
|    if ($plan.Marked.Count) {
|        $file = [ordered]@{
|            '_purpose' = 'SecurityInsight Pro: the approved exemptions (cfg.Exemption). Written by the settings layer for this run; engine\risk-analysis\_shared\RA-Exemptions.ps1 MARKS the rows each one covers (never drops them).'
|            matchAssetColumns   = @('SI_AssetId', 'SI_CorrelationId', 'AssetId', 'AssetName', 'DeviceName', 'DeviceId')
|            matchFindingColumns = @('CveId', 'Cve', 'CVE', 'ConfigurationId')
|            exemptions = @($plan.Marked | ForEach-Object { [ordered]@{ id = $_.Id; scope = $_.Scope; report = $_.ReportName; assetKey = $_.AssetKey; cve = $_.Cve; configurationId = $_.ConfigurationId; expiresAt = $_.ExpiresAt; requestId = $(if ($_.PSObject.Properties['RequestId']) { $_.RequestId } else { $null }); reason = $_.Reason } })
|        }
|        & $ensureRa
|        Write-SIProFile -Path (Join-SIProPath $rp $script:SIProExemptionsFile) -Text (ConvertTo-SIProJson -Value $file)
|        $out.Exemptions += $plan.Marked.Count; $raWritten = $true
|    }
|    # weights: the document (+ the model sections beside it), and per-report files
|    $wdoc = @($Documents | Where-Object { $_.Kind -eq 'weights' }) | Select-Object -First 1
|    $model = @(& $kindItems 'weights' | Where-Object { $_.Key -eq 'model' }) | Select-Object -First 1
|    if ($wdoc -or $model) {
|        $text = $null
|        if ($wdoc -and -not $model) { $text = $wdoc.Body }   # Pro-1b: byte for byte
|        else {
|            $w = [ordered]@{}
|            if ($model) { $m = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $model.Body); foreach ($k in @($m.Keys)) { $w[$k] = $m[$k] } }
|            if ($wdoc) { $d = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $wdoc.Body); foreach ($k in @($d.Keys)) { $w[$k] = $d[$k] } }
|            $text = ConvertTo-SIProJson -Value $w
|        }
|        & $ensureRa
|        Write-SIProFile -Path (Join-SIProPath $rp 'riskscore_weighted.schema.custom.json') -Text $text
|        $out.Weights++; $raWritten = $true
|    }
|    foreach ($it in @(& $kindItems 'weights' | Where-Object { $_.Key -like 'report/*' })) {
|        & $ensureRa
|        Write-SIProFile -Path (Join-SIProPath $rp ('{0}.weighted.custom.json' -f $it.Key.Substring(7))) -Text $it.Body
|        $out.Weights++; $raWritten = $true
|    }
|    if ($raWritten) { $out.RaSettingsPath = $rp }
|
|    # ---- config\ -----------------------------------------------------------------------------------------------------
|    $cr = Join-SIProPath $RunFolder 'config'
|    # #251: the CMDB ownership map is the customer's configuration document (cmdbownership/map) -- the whole map, written
|    # where engine\asset-cmdb\_shared\SI-CmdbOwnership.ps1 looks first (SI_ProConfigRoot). No document = the installation's
|    # shipped map, as on a Community install.
|    $ownMap = @(& $kindItems 'cmdbownership' | Where-Object { $_.Key -eq 'map' }) | Select-Object -First 1
|    if ($ownMap) {
|        $root = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $ownMap.Body)
|        Write-SIProFile -Path (Join-SIProPath $cr 'cmdb-source-ownership.locked.json') -Text (ConvertTo-SIProJson -Value ([ordered]@{ '_source' = 'SecurityInsight Pro settings database (the CMDB ownership configuration), materialised for this run'; cmdbSourceOwnership = $root }))
|        $out.ConfigFiles++; $out.ConfigRoot = $cr
|    }
|    if ($Families['servicemodel']) {
|        $sm = @(& $kindItems 'servicemodel' | Where-Object { $_.Key -eq 'model' }) | Select-Object -First 1
|        $body = if ($sm) { ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $sm.Body) } else { [ordered]@{ services = @(); bindings = @() } }
|        Write-SIProFile -Path (Join-SIProPath $cr 'service-model.locked.json') -Text (ConvertTo-SIProJson -Value ([ordered]@{ '_source' = 'SecurityInsight Pro settings database, materialised for this run'; serviceModel = $body }))
|        $out.ConfigFiles++; $out.ConfigRoot = $cr
|    }
|    $tagCfg = @(& $kindItems 'assettagging' | Where-Object { $_.Key -eq 'config' }) | Select-Object -First 1
|    if ($tagCfg) { Write-SIProFile -Path (Join-SIProPath $cr 'asset-tagging.config.json') -Text $tagCfg.Body; $out.ConfigFiles++; $out.ConfigRoot = $cr }
|    if ($Families['assettagging']) {
|        $tags = @(& $kindItems 'assettagging' | Where-Object { $_.Key -like 'tag/*' })
|        $text = ConvertTo-SIProJson -Value ([ordered]@{ AssetTagging = @($tags | ForEach-Object { ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $_.Body) }) })
|        $tp = Join-SIProPath $cr 'asset-tagging'
|        Write-SIProFile -Path (Join-SIProPath $tp 'AssetTagging.locked.yaml') -Text $text
|        $out.ConfigFiles++; $out.ConfigRoot = $cr; $out.AssetTaggingPath = $tp
|    }
|    foreach ($it in @(& $kindItems 'schemaoverlay')) {
|        $base = if ($it.Key -eq 'publicip') { 'public-ip' } else { $it.Key }
|        Write-SIProFile -Path (Join-SIProPath $cr 'asset-profiling-schema' ('{0}.schema.custom.json' -f $base)) -Text $it.Body
|        $out.ConfigFiles++; $out.ConfigRoot = $cr
|    }
|    # #275 R6: the server-application catalog override, where its loader looks first (SI_ProConfigRoot)
|    $apps = @(& $kindItems 'serverapps' | Where-Object { $_.Key -eq 'catalog' }) | Select-Object -First 1
|    if ($apps) { Write-SIProFile -Path (Join-SIProPath $cr 'server-applications.json') -Text $apps.Body; $out.ConfigFiles++; $out.ConfigRoot = $cr }
|    # #274: the output scope per destination -- ONE file, every named report template resolved to its reports here (the
|    # templates of THIS run: the database's when the catalog is served from SQL, else the installation's catalog), so the
|    # engines and connectors never read the catalog themselves. No item = no file = everything passes, as before.
|    $scopes = @(& $kindItems 'outputscope')
|    if ($scopes.Count) {
|        $membership = Get-SIProTemplateMembership -Items @(& $kindItems 'rareport') -FromItems ([bool]($Families['rareport'] -or @(& $kindItems 'rareport').Count)) -SIRoot ([string]$Context.SIRoot)
|        $dests = [ordered]@{}
|        foreach ($it in $scopes) {
|            $o = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $it.Body)
|            $tpl = @(Get-SIOutputScopeList $o 'templates'); $rep = @(Get-SIOutputScopeList $o 'reports')
|            if (($tpl.Count + $rep.Count) -gt 0) {
|                $set = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::Ordinal)
|                foreach ($r in $rep) { [void]$set.Add([string]$r) }
|                foreach ($t in $tpl) {
|                    if (-not $membership.Contains([string]$t)) { $out.Notes.Add(("outputscope/{0}: the report template '{1}' does not exist in this run -- it lets no report through" -f $it.Key, $t)); continue }
|                    foreach ($r in @($membership[[string]$t])) { [void]$set.Add([string]$r) }
|                }
|                $arr = [string[]]@($set); [Array]::Sort($arr, [System.StringComparer]::Ordinal)
|                $o['resolvedReports'] = @($arr)
|            }
|            $dests[$it.Key] = $o
|        }
|        Write-SIProFile -Path (Join-SIProPath $cr 'output-scope.json') -Text (ConvertTo-SIProJson -Value ([ordered]@{ '_source' = 'SecurityInsight Pro settings database (the output scope per destination), materialised for this run'; destinations = $dests }))
|        $out.ConfigFiles++; $out.ConfigRoot = $cr
|    }
|    # ---- #456: the data model -> <run>\data-model (SI_DataModelRoot): served from the database once its templates exist --
|    $dmItems = @(& $kindItems 'datamodel')
|    if ($Families['datamodel'] -or $dmItems.Count) {
|        $dm = Export-SIDataModelProRoot -Items $dmItems -RunFolder $RunFolder -ShippedRoot (Join-SIProPath ([string]$Context.SIRoot) 'data-model') `
|            -FromJson { param($s) ConvertFrom-SIProJson $s } -ToJson { param($v) ConvertTo-SIProJson -Value $v }
|        $out.DataModelRoot = [string]$dm.Root
|        $out.DataModelItems = $dmItems.Count
|        foreach ($n in @($dm.Notes)) { if ($n) { $out.Notes.Add([string]$n) } }
|        if (@($dm.Copied).Count -and $dmItems.Count) { $out.Notes.Add(('data model: {0} template file(s) are not in the settings database yet and come from the installation: {1}' -f @($dm.Copied).Count, (@($dm.Copied) -join ', '))) }
|    }
|    # ---- naming: values, not files (applied by the layer) ------------------------------------------------------------
|    foreach ($it in @(& $kindItems 'naming')) { $out.Naming[$it.Key] = [pscustomobject]@{ Value = [string](ConvertFrom-SIProJson $it.Body); Origin = $it.Origin } }
|    [pscustomobject]$out
|}
|
|# =====================================================================================================================
|#  WRITERS (transactional, each with its cfg.ChangeLog entry) -- the importer, the GUI and tools use these.
|# =====================================================================================================================
|function Set-SIProItem {
|    <#
|        Write one item's customer state: State override (with -Body), disable, or inherit (= go back to the template:
|        the row is removed). Validated BEFORE any SQL by the same rules the run applies. -BaseVersion / -BaseHash: the
|        template the override was made against. ChangeLog: Name = key, Scope = 'item', Kind.
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Kind, [Parameter(Mandatory)][string]$Key,
|          [Parameter(Mandatory)][ValidateSet('override', 'disable', 'inherit')][string]$State, [AllowEmptyString()][string]$Body,
|          [string]$Format, [string]$BaseVersion, [string]$BaseHash, [Parameter(Mandatory)][string]$ChangedBy, [string]$Reason = '', $Context)
|    $spec = $script:SIProItemKinds[$Kind]
|    if (-not $spec) { throw ("'{0}' is not a configuration kind" -f $Kind) }
|    if ($Key -notmatch $spec.Key) { throw ("'{0}' is not a valid {1} key" -f $Key, $Kind) }
|    # #251: a name is a setting now (Set-SIProSetting), and the ownership map is ONE document (cmdbownership/map)
|    if ($Kind -eq 'naming' -and $State -ne 'inherit') { throw ("{0}: the names of tables, DCRs, DCE and workspace are settings -- set it with Set-SIProSetting (the catalog default applies otherwise)" -f $Key) }
|    if ($Kind -eq 'cmdbownership' -and $Key -ne 'map' -and $State -ne 'inherit') { throw ("cmdbownership/{0}: the CMDB ownership map is one configuration document, cmdbownership/map" -f $Key) }
|    if (-not $Format) { $Format = $spec.Format }
|    $text = $null
|    if ($State -eq 'override') {
|        if (-not $Context) { $Context = Get-SIProConfigContext }
|        $text = ([string]$Body).TrimStart([char]0xFEFF)
|    }
|    # mandatory controls FIRST: an override never switches off or weakens what SecurityInsight requires, and that plain
|    # reason is the one given (the item rules may refuse the same change in their own words, e.g. a built-in factor)
|    $mroot = if ($Context -and $Context.PSObject.Properties['SIRoot'] -and $Context.SIRoot) { [string]$Context.SIRoot } else { $script:SIProConfigSIRoot }
|    $mwhy = @(Test-SIProMandatoryOverride -Controls @(Get-SIProMandatoryControls -SIRoot $mroot) -Kind $Kind -Key $Key -State $State -Body $text)
|    if ($mwhy.Count) { throw ("nothing written: {0}" -f ($mwhy -join '; ')) }
|    if ($State -eq 'override') {
|        $why = @(Test-SIProItem -Kind $Kind -Key $Key -Body $text -Format $Format -Context $Context)
|        if ($why.Count) { throw ("{0}/{1} is not valid: {2}" -f $Kind, $Key, ($why -join '; ')) }
|    }
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @old nvarchar(max) = (SELECT State + COALESCE(':' + BodyJson, '') FROM cfg.ItemOverride WITH (UPDLOCK, HOLDLOCK) WHERE Kind = @Kind AND ItemKey = @Key);
|IF @State = 'inherit'
|    DELETE FROM cfg.ItemOverride WHERE Kind = @Kind AND ItemKey = @Key;
|ELSE IF @old IS NOT NULL
|    UPDATE cfg.ItemOverride SET State = @State, BodyJson = @Body, Format = @Format, BaseVersion = @BaseVersion, BaseHash = @BaseHash, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Kind = @Kind AND ItemKey = @Key;
|ELSE
|    INSERT cfg.ItemOverride (Kind, ItemKey, State, BodyJson, Format, BaseVersion, BaseHash, UpdatedBy) VALUES (@Kind, @Key, @State, @Body, @Format, @BaseVersion, @BaseHash, @By);
|INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (@Key, 'item', @Kind, CASE WHEN @State = 'inherit' THEN 'Reset' ELSE 'Set' END, @old, @State + COALESCE(':' + @Body, ''), @By, @Reason);
|COMMIT;
|'@
|    & $Store.Invoke $sql ([ordered]@{ Kind = $Kind; Key = $Key; State = $State; Body = $text; Format = $Format
|        BaseVersion = $(if ($BaseVersion) { $BaseVersion } else { $null }); BaseHash = $(if ($BaseHash) { $BaseHash } else { $null }); By = $ChangedBy; Reason = $Reason }) 'nonquery'
|}
|
|function New-SIProExemption {
|    <# Record one exemption (validated first by the rules the run applies), with its ChangeLog entry, in one transaction. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][ValidateSet('finding', 'issue', 'asset')][string]$Scope, [string]$ReportName,
|          [string]$ConfigurationId, [string]$Cve, [string]$AssetKey, [Parameter(Mandatory)][string]$Reason, [Nullable[datetime]]$ExpiresAt,
|          [Parameter(Mandatory)][string]$CreatedBy, $Context)
|    if (-not $Context) { $Context = Get-SIProConfigContext }
|    $row = @{ ExemptionId = '0'; Scope = $Scope; ReportName = $ReportName; ConfigurationId = $ConfigurationId; Cve = $Cve; AssetKey = $AssetKey; Reason = $Reason; ExpiresAt = $ExpiresAt; RevokedAt = $null }
|    $c = ConvertFrom-SIProExemptionRows -Rows @($row) -Context $Context -Now ([datetime]::MinValue)
|    if (@($c.Refused).Count) { throw ('the exemption is not valid: ' + $c.Refused[0].Reason) }
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|INSERT cfg.Exemption (Scope, ReportName, ConfigurationId, Cve, AssetKey, Reason, ExpiresAt, CreatedBy) VALUES (@Scope, @Report, @Cfg, @Cve, @Asset, @Reason, @Expires, @By);
|DECLARE @id bigint = SCOPE_IDENTITY();
|INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (CONCAT('exemption/', CONVERT(nvarchar(30), @id)), 'exemption', 'exemption', 'Set', NULL, CONCAT(@Scope, '|', @Report, '|', @Cve, '|', @Cfg, '|', @Asset, '|', CONVERT(varchar(30), @Expires, 126)), @By, @Reason);
|COMMIT;
|'@
|    & $Store.Invoke $sql ([ordered]@{ Scope = $Scope; Report = $(if ($ReportName) { $ReportName } else { $null }); Cfg = $(if ($ConfigurationId) { $ConfigurationId } else { $null })
|        Cve = $(if ($Cve) { $Cve.ToUpperInvariant() } else { $null }); Asset = $(if ($AssetKey) { $AssetKey } else { $null }); Reason = $Reason
|        Expires = (ConvertTo-SIProUtc $ExpiresAt); By = $CreatedBy }) 'nonquery'
|}
|
|function Revoke-SIProExemption {
|    <# Revoke one exemption (it stays, with RevokedAt / RevokedBy), with its ChangeLog entry, in one transaction. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][long]$ExemptionId, [Parameter(Mandatory)][string]$RevokedBy, [string]$Reason = '')
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|UPDATE cfg.Exemption SET RevokedAt = SYSUTCDATETIME(), RevokedBy = @By WHERE ExemptionId = @Id AND RevokedAt IS NULL;
|IF @@ROWCOUNT = 1
|    INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|    VALUES (CONCAT('exemption/', CONVERT(nvarchar(30), @Id)), 'exemption', 'exemption', 'Reset', 'active', 'revoked', @By, @Reason);
|COMMIT;
|'@
|    & $Store.Invoke $sql ([ordered]@{ Id = $ExemptionId; By = $RevokedBy; Reason = $Reason }) 'nonquery'
|}
|
|# =====================================================================================================================
|#  TEMPLATES FROM THE SHIPPED FILES (Publish-SITemplates; the importer diffs against the same rows)
|# =====================================================================================================================
|function Get-SIProShippedVersion {
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $p = Join-SIProPath $SIRoot 'VERSION'
|    if (Test-Path -LiteralPath $p) { return ([System.IO.File]::ReadAllText($p)).Trim() }
|    '0.0.0'
|}
|
|function Get-SITemplateRows {
|    <#
|        The template rows a release ships -- VENDOR-DEVELOPED content only (#251) -- built from its *.locked files:
|          rareport      risk-analysis-detection\RiskAnalysis_Queries_Locked.yaml        report/<name>, template/<name>
|          riskindex     risk-analysis-detection\riskscore.index.locked.csv (shipped)    row/<dimensions>
|          rule          asset-profiling-enrichment\<engine>\**\*.locked.yaml             <engine>/<id> (YAML text)
|          assettagging  asset-profiling-enrichment\endpoint\AssetTagging.locked.yaml     tag/<STEM--SI>
|          servicemodel  config\service-model.locked.json                                 model
|          datamodel     data-model\**\*.locked.json (#456)                                <template>, <template>:<item key>
|        NOT templates: the names of tables / DCRs / DCE / workspace (settings -- the catalog default is the default) and the
|        CMDB ownership map (the customer's configuration, seeded from config\cmdb-source-ownership.locked.json); nor the
|        profile schemas (asset-profiling-schema\*.locked.json) -- they are the engines' data contract (hashes, entity ids),
|        not configuration; a customer's schema OVERLAY is an item (schemaoverlay).
|        -Version (stamped on every row): default the shipped template pack's version (engine\pro-settings\
|        shipped-template-pack.json, 1.0) -- template versions are their own series, not the code version.
|        Every row is validated as the run will validate it; one that does not is returned in Refused, never published.
|        -Families limits what is built (tests).
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$Version, $Context, [string[]]$Families)
|    if (-not $Version) { $Version = (Get-SIProShippedPackInfo -SIRoot $SIRoot).PackVersion }
|    # #416: building the rows takes ~30 s (780 templates, each validated, serialised and hashed) and ONE update ran it three
|    # times (the template gate, the split check, the install) -- the same files give the same rows, so a process keeps the
|    # result for files it has already read (Get-SITemplateRowsCacheKey: every input file's path, size and write time).
|    # Never with a caller's own -Context. Every caller gets its OWN copies of the rows.
|    $cacheKey = $null
|    if (-not $PSBoundParameters.ContainsKey('Context')) {
|        $cacheKey = Get-SITemplateRowsCacheKey -SIRoot $SIRoot -Version $Version -Families $Families
|        $hit = Get-SITemplateRowsCached -Key $cacheKey
|        if ($hit) { return $hit }
|    }
|    if (-not $Context) { $Context = Get-SIProConfigContext -SIRoot $SIRoot }
|    $want = { param($k) (-not $Families) -or ($Families -contains $k) }
|    $rows = New-Object System.Collections.Generic.List[object]; $refused = New-Object System.Collections.Generic.List[object]
|    $add = {
|        param([string]$kind, [string]$key, [string]$body, [string]$fmt, [int]$order, [string]$source)
|        $why = @(Test-SIProItem -Kind $kind -Key $key -Body $body -Format $fmt -Context $Context)
|        if ($why.Count) { $refused.Add([pscustomobject]@{ Name = ('{0}/{1}' -f $kind, $key); Scope = 'template'; Reason = ('{0}: {1}' -f $source, ($why -join '; ')) }); return }
|        $rows.Add([pscustomobject]@{ Kind = $kind; ItemKey = $key; TemplateVersion = $Version; BodyJson = $body; Format = $fmt; SortOrder = $order; BodyHash = (Get-SIProTextHash $body)
|            ContentHash = (Get-SIProContentHash -Body $body -Format $fmt); Source = $source })
|    }
|    if (& $want 'rareport') {
|        $p = Join-SIProPath $SIRoot 'risk-analysis-detection' 'RiskAnalysis_Queries_Locked.yaml'
|        if (Test-Path -LiteralPath $p) {
|            $y = ConvertFrom-SIYaml -Path $p -Ordered
|            $i = 0; foreach ($r in @($y['Reports'])) { & $add 'rareport' ('report/' + [string]$r['ReportName']) (ConvertTo-SIProJson -Value $r -Level 2) 'json' ($i++) 'risk-analysis-detection/RiskAnalysis_Queries_Locked.yaml' }
|            $i = 100000; foreach ($r in @($y['ReportTemplates'])) { & $add 'rareport' ('template/' + [string]$r['ReportName']) (ConvertTo-SIProJson -Value $r -Level 2) 'json' ($i++) 'risk-analysis-detection/RiskAnalysis_Queries_Locked.yaml' }
|        }
|    }
|    if (& $want 'riskindex') {
|        $p = Join-SIProPath $SIRoot 'risk-analysis-detection' 'riskscore.index.locked.csv'
|        if (Test-Path -LiteralPath $p) {
|            $seen = @{}; $i = 0
|            foreach ($r in @(Import-Csv -LiteralPath $p)) {
|                $o = [ordered]@{}; foreach ($c in $script:SIRiskIndexColumns) { $o[$c] = $(if ($r.PSObject.Properties[$c]) { [string]$r.$c } else { '' }) }
|                $key = Get-SIRiskIndexKey -Row $o
|                # the engine's index keeps EVERY row (a repeated row adds to its lists), so a repeat is published as
|                # '<dimensions>#<n>' -- the materialised file is then the shipped file, row for row
|                if ($seen.ContainsKey($key)) { $seen[$key]++; $key = '{0}#{1}' -f $key, $seen[$key] } else { $seen[$key] = 1 }
|                & $add 'riskindex' $key (ConvertTo-SIProJson -Value $o) 'json' ($i++) 'risk-analysis-detection/riskscore.index.locked.csv'
|            }
|        }
|    }
|    if (& $want 'rule') {
|        $tree = Join-SIProPath $SIRoot 'asset-profiling-enrichment'
|        $files = @(Get-ChildItem -LiteralPath $tree -Recurse -File -Filter '*.locked.yaml' -ErrorAction SilentlyContinue)
|        $relU = [string[]]@($files | ForEach-Object { $_.FullName.Substring($tree.Length).TrimStart('\', '/').Replace('\', '/') })
|        $order = Get-SIProOrdinalOrder -Keys $relU
|        $rel = [string[]]@(foreach ($i in $order) { $relU[$i] }); $fa = @(foreach ($i in $order) { $files[$i] })
|        $i = 0
|        for ($n = 0; $n -lt $fa.Count; $n++) {
|            $text = ([System.IO.File]::ReadAllText($fa[$n].FullName)).TrimStart([char]0xFEFF)
|            if ($text -match '(?m)^AssetTagging\s*:') { continue }   # the asset-tagging file shares the folder; it is its own kind
|            $engine = $rel[$n].Split('/')[0].ToLowerInvariant()
|            $h = Get-SIRuleHeader -Text $text
|            $id = if ($h.Id) { $h.Id } else { $fa[$n].Name -replace '\.locked\.yaml$', '' }
|            & $add 'rule' ('{0}/{1}' -f $engine, $id) $text 'yaml' ($i++) ('asset-profiling-enrichment/' + $rel[$n])
|        }
|    }
|    if (& $want 'assettagging') {
|        $p = Join-SIProPath $SIRoot 'asset-profiling-enrichment' 'endpoint' 'AssetTagging.locked.yaml'
|        if (Test-Path -LiteralPath $p) {
|            $y = ConvertFrom-SIYaml -Path $p -Ordered
|            $i = 0
|            foreach ($t in @($y['AssetTagging'] | Where-Object { $null -ne $_ })) {
|                $stem = Get-SIProAssetTagStemKey ([string]$t['AssetTagName'])
|                & $add 'assettagging' ('tag/' + $stem) (ConvertTo-SIProJson -Value $t) 'json' ($i++) 'asset-profiling-enrichment/endpoint/AssetTagging.locked.yaml'
|            }
|        }
|    }
|    # #251: no cmdbownership and no naming rows -- the ownership map and the names are configuration (see the kinds above).
|    if (& $want 'servicemodel') {
|        $p = Join-SIProPath $SIRoot 'config' 'service-model.locked.json'
|        if (Test-Path -LiteralPath $p) {
|            $sm = (ConvertTo-SIOrderedJson (ConvertFrom-SIProJson ([System.IO.File]::ReadAllText($p))))['serviceModel']
|            & $add 'servicemodel' 'model' (ConvertTo-SIProJson -Value $sm) 'json' 0 'config/service-model.locked.json'
|        }
|    }
|    # #456: the data model -- one row per field / mapping / factor / output column, plus each template's header
|    if (& $want 'datamodel') {
|        foreach ($r in (Get-SIDataModelTemplateRows -SIRoot $SIRoot -ToJson { param($v) ConvertTo-SIProJson -Value $v })) {
|            & $add 'datamodel' $r.Key $r.Body 'json' ([int]$r.SortOrder) $r.Source
|        }
|    }
|    $result = [pscustomobject]@{ Version = $Version; Rows = $rows.ToArray(); Refused = $refused.ToArray() }
|    if ($cacheKey) { Set-SITemplateRowsCached -Key $cacheKey -Result $result; return (Get-SITemplateRowsCached -Key $cacheKey) }
|    $result
|}
|
|function Get-SITemplateRowsCacheKey {
|    <#
|        #416: what the shipped template rows are built from, as one string: the root, the version, the families and every
|        input file's relative path + size + last write time (the template sources, the shipped config the validation reads,
|        the code that builds and validates them). A changed, added or removed file = another key.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$Version, [string[]]$Families)
|    $root = [IO.Path]::GetFullPath($SIRoot).TrimEnd('\', '/')
|    $sb = New-Object System.Text.StringBuilder
|    [void]$sb.Append($root).Append('|').Append($Version).Append('|').Append((@($Families) -join ',')).Append("`n")
|    foreach ($d in @(@('risk-analysis-detection', $false), @('asset-profiling-enrichment', $true), @('config', $false), @(([IO.Path]::Combine('engine', 'pro-settings')), $false), @('data-model', $true))) {
|        $dir = [IO.Path]::Combine($root, $d[0])
|        if (-not [IO.Directory]::Exists($dir)) { continue }
|        $opt = if ($d[1]) { [IO.SearchOption]::AllDirectories } else { [IO.SearchOption]::TopDirectoryOnly }
|        $fs = [IO.Directory]::GetFiles($dir, '*', $opt); [Array]::Sort($fs, [StringComparer]::Ordinal)
|        foreach ($f in $fs) { $i = New-Object IO.FileInfo($f); [void]$sb.Append($f.Substring($root.Length)).Append('|').Append($i.Length).Append('|').Append($i.LastWriteTimeUtc.Ticks).Append("`n") }
|    }
|    foreach ($f in @([IO.Path]::Combine($root, 'engine', '_shared', 'SI-Yaml.ps1'), [IO.Path]::Combine($root, 'engine', 'asset-profiling', 'shared', 'RuleEval.ps1'))) {
|        if ([IO.File]::Exists($f)) { $i = New-Object IO.FileInfo($f); [void]$sb.Append($f.Substring($root.Length)).Append('|').Append($i.Length).Append('|').Append($i.LastWriteTimeUtc.Ticks).Append("`n") }
|    }
|    $sb.ToString()
|}
|
|function Get-SITemplateRowsCached {
|    <# #416: the cached rows for -Key, as NEW copies (a caller may change its rows), or $null. The cache lives in the process. #>
|    param([Parameter(Mandatory)][string]$Key)
|    $c = [AppDomain]::CurrentDomain.GetData('SecurityInsight.TemplateRows')
|    if ($null -eq $c -or -not $c.ContainsKey($Key)) { return $null }
|    $r = $c[$Key]
|    [pscustomobject]@{ Version = $r.Version; Rows = @(foreach ($x in $r.Rows) { $x.PSObject.Copy() }); Refused = @(foreach ($x in $r.Refused) { $x.PSObject.Copy() }) }
|}
|
|function Set-SITemplateRowsCached {
|    <# #416: keeps the rows for -Key (the newest few keys only). #>
|    param([Parameter(Mandatory)][string]$Key, [Parameter(Mandatory)]$Result)
|    $c = [AppDomain]::CurrentDomain.GetData('SecurityInsight.TemplateRows')
|    if ($null -eq $c) { $c = [hashtable]::Synchronized(@{}); [AppDomain]::CurrentDomain.SetData('SecurityInsight.TemplateRows', $c) }
|    if ($c.Count -ge 8) { $c.Clear() }
|    $c[$Key] = $Result
|}
|
|# =====================================================================================================================
|#  #250 -- THE SHIPPED TEMPLATES ARE TEMPLATE PACK 1.0 ("Default templates 1.0"), like the old .locked files
|# =====================================================================================================================
|function Get-SIProShippedPackInfo {
|    <#
|        The template pack the templates shipped with this code ARE: engine\pro-settings\shipped-template-pack.json
|        (PackVersion, Name). Template pack versions are their own series starting at 1.0 -- never the code version. A
|        missing or unreadable file reads as 1.0.
|    #>
|    param([string]$SIRoot)
|    if (-not $SIRoot) { $SIRoot = $script:SIProConfigSIRoot }
|    $v = '1.0'; $n = ''; $reviewed = $false
|    $p = Join-SIProPath $SIRoot 'engine' 'pro-settings' 'shipped-template-pack.json'
|    if (Test-Path -LiteralPath $p) {
|        try {
|            $o = ConvertFrom-SIProJson ([System.IO.File]::ReadAllText($p).TrimStart([char]0xFEFF))
|            $pv = ([string]$o.PackVersion).Trim()
|            if ($pv -match '^\d{1,6}(\.\d{1,12}){1,5}$' -and $pv.Length -le 32) { $v = $pv }
|            $n = ([string]$o.Name).Trim()
|            # #405: the split install (fix + default with the code, Microsoft content packs automatic) runs only when the
|            # vendor marked the shipped templates' classification as reviewed; absent or anything but true = false
|            if ($o.PSObject.Properties['ClassificationReviewed'] -and $o.ClassificationReviewed -is [bool]) { $reviewed = [bool]$o.ClassificationReviewed }
|        } catch { }
|    }
|    if (-not $n) { $n = 'Default templates {0}' -f $v }
|    [pscustomobject]@{ PackVersion = $v; Name = $n; ClassificationReviewed = $reviewed }
|}
|
|function Get-SIProDefaultTemplateDecision {
|    <#
|        PURE. What a setup / update run does with the templates SHIPPED with its code (pack -ShippedVersion), on an install
|        that recorded -InstalledPack (cfg.InstallState 'TemplatePack', '' = none) and has -LiveCount templated rows whose
|        fingerprint is -InstalledFingerprint; -ShippedFingerprint = the shipped templates'.
|          install          no templates yet                          -> publish the shipped templates, record the pack
|          adopt            templates, no pack recorded, the SAME content as the shipped ones -> record the pack (as released)
|          adopt-customised templates, no pack recorded, OTHER content   -> record "customised, based on <shipped>"; the
|                           shipped pack is offered (staged) but nothing in force changes without an acceptance
|          current          the shipped pack is installed and in force  -> refresh (version stamps / content hashes only)
|          newer-installed  a newer pack (from the update ring) is installed -> nothing: a pack never goes backwards
|          shipped-differs  the shipped pack's version is installed, but this code ships OTHER content under that version --
|                           never applied: a pack version names exactly one content (the vendor ships changes as a new pack)
|          release          an older pack is installed                 -> publish the shipped pack through the gate
|        Returns @{ Action; Publish (run the publish); Record (adoption: write the pack / status); Status; Reason }.
|    #>
|    param([AllowEmptyString()][string]$InstalledPack, [AllowEmptyString()][string]$InstalledStatus, [int]$LiveCount,
|          [AllowEmptyString()][string]$InstalledFingerprint, [Parameter(Mandatory)][string]$ShippedVersion,
|          [AllowEmptyString()][string]$ShippedFingerprint, [string]$ShippedName)
|    if (-not $ShippedName) { $ShippedName = 'Default templates {0}' -f $ShippedVersion }
|    $mk = { param($a, [bool]$pub, [bool]$rec, $st, $why) [pscustomobject]@{ Action = $a; Publish = $pub; Record = $rec; Status = $st; Reason = $why } }
|    $same = ([string]$InstalledFingerprint -ne '') -and ($InstalledFingerprint -eq $ShippedFingerprint)
|    # A pack recorded BEFORE template packs had their own version series (1.0, 1.1, ...) carries the CODE version
|    # (e.g. '3.0.0') and no pack status -- the new code always records one. It is not a pack: decide by content, like an
|    # install with no pack recorded (live 2026-10-04: '3.0.0' read as newer than 1.0 and blocked the adoption).
|    if ($InstalledPack -and -not $InstalledStatus) {
|        $major = 0
|        if ([int]::TryParse((([string]$InstalledPack).Trim().Split('.')[0]), [ref]$major) -and $major -ge 2) { $InstalledPack = '' }
|    }
|    if (-not $InstalledPack) {
|        if ($LiveCount -le 0) { return (& $mk 'install' $true $false 'as-released' ('no templates yet -- installing {0}' -f $ShippedName)) }
|        if ($same) { return (& $mk 'adopt' $true $true 'as-released' ('the templates in force are {0} -- recorded as installed' -f $ShippedName)) }
|        return (& $mk 'adopt-customised' $false $true 'customised' ('the templates in force differ from {0} -- recorded as customised, based on {1}; your templates are kept, and {0} is offered on the Template releases page' -f $ShippedName, $ShippedVersion))
|    }
|    $cmp = Compare-SIProVersionParts $InstalledPack $ShippedVersion
|    if ($cmp -gt 0) { return (& $mk 'newer-installed' $false $false $InstalledStatus ('template pack {0} is installed, newer than {1} -- nothing to do' -f $InstalledPack, $ShippedName)) }
|    if ($cmp -eq 0) {
|        if ($same -or $LiveCount -le 0) { return (& $mk 'current' $true $false $InstalledStatus ('{0} is installed' -f $ShippedName)) }
|        if ($InstalledStatus -eq 'customised') { return (& $mk 'current' $false $false 'customised' ('{0} is installed, customised -- your templates are kept' -f $ShippedName)) }
|        return (& $mk 'shipped-differs' $false $false $InstalledStatus ('{0} is installed; this release ships other template content under the same version -- it is not applied (template changes arrive as a new pack)' -f $ShippedName))
|    }
|    & $mk 'release' $true $false 'as-released' ('template pack {0} is installed -- {1} is released through the template gate' -f $InstalledPack, $ShippedName)
|}
|
|function Compare-SIProVersionParts {
|    <# PURE. -1 / 0 / 1, numeric per part (64-bit), a missing part counts as 0 -- the same rule as Compare-SIProPackVersion. #>
|    param([AllowEmptyString()][string]$A, [AllowEmptyString()][string]$B)
|    $pa = @(([string]$A).Trim().Split('.') | Where-Object { $_ -ne '' }); $pb = @(([string]$B).Trim().Split('.') | Where-Object { $_ -ne '' })
|    for ($i = 0; $i -lt [Math]::Max($pa.Count, $pb.Count); $i++) {
|        $x = [long]0; $y = [long]0
|        if ($i -lt $pa.Count) { [void][long]::TryParse($pa[$i], [ref]$x) }
|        if ($i -lt $pb.Count) { [void][long]::TryParse($pb[$i], [ref]$y) }
|        if ($x -lt $y) { return -1 }
|        if ($x -gt $y) { return 1 }
|    }
|    0
|}
|
|# =====================================================================================================================
|#  #251 -- NAMING AND CMDB OWNERSHIP BECOME CONFIGURATION (carried over 1:1, nothing lost)
|# =====================================================================================================================
|function Get-SIProShippedOwnershipMap {
|    <# The shipped CMDB ownership map (config\cmdb-source-ownership.locked.json -> its cmdbSourceOwnership object) as JSON
|       text, keys in file order; $null when the file is missing. What setup seeds the configuration document with. #>
|    param([string]$SIRoot)
|    if (-not $SIRoot) { $SIRoot = $script:SIProConfigSIRoot }
|    $p = Join-SIProPath $SIRoot 'config' 'cmdb-source-ownership.locked.json'
|    if (-not (Test-Path -LiteralPath $p)) { return $null }
|    $root = (ConvertTo-SIOrderedJson (ConvertFrom-SIProJson ([System.IO.File]::ReadAllText($p).TrimStart([char]0xFEFF))))['cmdbSourceOwnership']
|    if ($null -eq $root) { return $null }
|    ConvertTo-SIProJson -Value $root
|}
|
|function ConvertTo-SIProOwnershipMap {
|    <#
|        PURE. The CMDB ownership map built from its LEGACY rows -- exactly what the run materialised from them before #251:
|        the live cmdbownership templates ('defaults' + one 'assettype/<type>' each, in SortOrder), every customer override
|        replacing its entry (an override of an entry with no template adds it, after the template entries, by key), a
|        'disable' removing it. -Shipped (the shipped map text) is the base when there are no template rows.
|        Returns the map as JSON text, or $null when there is nothing to build from.
|    #>
|    param([AllowEmptyCollection()][object[]]$Templates = @(), [AllowEmptyCollection()][object[]]$Overrides = @(), [string]$Shipped)
|    $entries = [ordered]@{}; $order = @{}
|    $live = @($Templates | Where-Object { $_ -and [string](Get-SIProRowValue $_ 'Kind') -eq 'cmdbownership' -and $null -eq (Get-SIProRowValue $_ 'RetiredAt') })
|    if ($live.Count) {
|        foreach ($t in $live) {
|            $k = [string](Get-SIProRowValue $t 'ItemKey'); $so = 0; [void][int]::TryParse([string](Get-SIProRowValue $t 'SortOrder'), [ref]$so)
|            $entries[$k] = [string](Get-SIProRowValue $t 'BodyJson'); $order[$k] = '{0:D10}|{1}' -f $so, $k
|        }
|    } elseif ($Shipped) {
|        $root = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $Shipped)
|        $def = [ordered]@{}; foreach ($k in @($root.Keys)) { if ($k -ne 'assetTypes') { $def[$k] = $root[$k] } }
|        $entries['defaults'] = ConvertTo-SIProJson -Value $def; $order['defaults'] = '{0:D10}|defaults' -f 0
|        $i = 1
|        foreach ($e in @($root['assetTypes'] | Where-Object { $null -ne $_ })) {
|            $k = 'assettype/' + ([string]$e['siAssetType']).Trim().ToLowerInvariant()
|            $entries[$k] = ConvertTo-SIProJson -Value $e; $order[$k] = '{0:D10}|{1}' -f ($i++), $k
|        }
|    }
|    foreach ($o in @($Overrides | Where-Object { $_ -and [string](Get-SIProRowValue $_ 'Kind') -eq 'cmdbownership' })) {
|        $k = [string](Get-SIProRowValue $o 'ItemKey'); if ($k -eq 'map') { continue }
|        switch ([string](Get-SIProRowValue $o 'State')) {
|            'override' { $entries[$k] = [string](Get-SIProRowValue $o 'BodyJson'); if (-not $order.ContainsKey($k)) { $order[$k] = '{0:D10}|{1}' -f [int]::MaxValue, $k } }
|            'disable'  { if ($entries.Contains($k)) { $entries.Remove($k) } }
|        }
|    }
|    if ($entries.Count -eq 0) { return $null }
|    $map = [ordered]@{}
|    if ($entries.Contains('defaults')) { $d = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $entries['defaults']); foreach ($k in @($d.Keys)) { if ($k -ne 'assetTypes') { $map[$k] = $d[$k] } } }
|    $keys = [string[]]@($entries.Keys | Where-Object { $_ -like 'assettype/*' })
|    $sorted = @(foreach ($i in (Get-SIProOrdinalOrder -Keys @($keys | ForEach-Object { $order[$_] }))) { $keys[$i] })
|    $map['assetTypes'] = @($sorted | ForEach-Object { ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $entries[$_]) })
|    ConvertTo-SIProJson -Value $map
|}
|
|function Get-SIProConfigurationMigrationPlan {
|    <#
|        PURE. What #251 carries over on an install (setup, the update hook and Import-SIProSettings -CreateSchema run it;
|        it is idempotent -- a second run plans nothing):
|          Settings  every naming OVERRIDE (State 'override') of a catalog naming setting becomes a cfg.Setting row
|                    (Name, Scope 'solution', the same value) -- unless that setting already has a 'solution' row, which
|                    already wins at run start (Kept). A 'disable' / 'inherit' carries nothing: the catalog default applies,
|                    as it did. A name the catalog does not know is NotCarried (its row stays and is still applied).
|          Map       the CMDB ownership configuration document cmdbownership/map when there is none yet: built from the
|                    legacy rows when there are any (every customer override carried over), else the shipped map.
|                    $null when the document exists.
|          Retire    every live cfg.Template row of kind naming / cmdbownership: retired (RetiredAt), never removed.
|        -Templates: cfg.Template rows; -Overrides: cfg.ItemOverride rows; -Settings: cfg.Setting rows; -Catalog: the
|        settings catalog; -ShippedOwnershipMap: Get-SIProShippedOwnershipMap.
|    #>
|    param([AllowEmptyCollection()][object[]]$Templates = @(), [AllowEmptyCollection()][object[]]$Overrides = @(),
|          [AllowEmptyCollection()][object[]]$Settings = @(), [AllowEmptyCollection()][object[]]$Catalog = @(), [string]$ShippedOwnershipMap)
|    $byName = @{}; foreach ($s in @($Catalog | Where-Object { $_ })) { $byName[[string]$s.name] = $s }
|    $have = @{}; foreach ($s in @($Settings | Where-Object { $_ })) { $have[('{0}|{1}' -f (Get-SIProRowValue $s 'Name'), (Get-SIProRowValue $s 'Scope'))] = $s }
|    $set = New-Object System.Collections.Generic.List[object]; $kept = New-Object System.Collections.Generic.List[object]; $not = New-Object System.Collections.Generic.List[object]
|    $ovr = @($Overrides | Where-Object { $_ })
|    $nm = @($ovr | Where-Object { [string](Get-SIProRowValue $_ 'Kind') -eq 'naming' -and [string](Get-SIProRowValue $_ 'State') -eq 'override' })
|    foreach ($i in (Get-SIProOrdinalOrder -Keys @($nm | ForEach-Object { [string](Get-SIProRowValue $_ 'ItemKey') }))) {
|        $o = $nm[$i]; $name = [string](Get-SIProRowValue $o 'ItemKey')
|        $val = $null; try { $val = ConvertFrom-SIProJson ([string](Get-SIProRowValue $o 'BodyJson')) } catch { }
|        $s = $byName[$name]
|        if (-not $s -or $s.secret -or $val -isnot [string] -or (Test-SISettingValue -Setting $s -Value $val)) {
|            $not.Add([pscustomobject]@{ Name = $name; Value = $val; Reason = $(if (-not $s) { 'not in the settings catalog -- the row stays and is still applied' } else { 'the value is not a valid setting value -- the row stays and is still applied' }) }); continue
|        }
|        $cur = $have[('{0}|solution' -f $name)]
|        if ($cur) { $kept.Add([pscustomobject]@{ Name = $name; Value = $val; Setting = [string](Get-SIProRowValue $cur 'ValueJson') }); continue }
|        $set.Add([pscustomobject]@{ Name = $name; Scope = 'solution'; Value = $val; From = ('naming/{0}' -f $name) })
|    }
|    $map = $null
|    if (-not @($ovr | Where-Object { [string](Get-SIProRowValue $_ 'Kind') -eq 'cmdbownership' -and [string](Get-SIProRowValue $_ 'ItemKey') -eq 'map' }).Count) {
|        $legacyT = @($Templates | Where-Object { $_ -and [string](Get-SIProRowValue $_ 'Kind') -eq 'cmdbownership' -and $null -eq (Get-SIProRowValue $_ 'RetiredAt') })
|        $legacyO = @($ovr | Where-Object { [string](Get-SIProRowValue $_ 'Kind') -eq 'cmdbownership' })
|        if ($legacyT.Count -or @($legacyO | Where-Object { [string](Get-SIProRowValue $_ 'State') -ne 'inherit' }).Count) {
|            $body = ConvertTo-SIProOwnershipMap -Templates $legacyT -Overrides $legacyO -Shipped $ShippedOwnershipMap
|            if ($body) { $map = [pscustomobject]@{ Body = $body; From = ('carried over: {0} template entr(ies), {1} of your change(s)' -f $legacyT.Count, @($legacyO | Where-Object { [string](Get-SIProRowValue $_ 'State') -ne 'inherit' }).Count) } }
|        } elseif ($ShippedOwnershipMap) {
|            $map = [pscustomobject]@{ Body = $ShippedOwnershipMap; From = 'the shipped default (config\cmdb-source-ownership.locked.json)' }
|        }
|    }
|    $retire = @($Templates | Where-Object { $_ -and (Test-SIProFormerTemplateKind ([string](Get-SIProRowValue $_ 'Kind'))) -and $null -eq (Get-SIProRowValue $_ 'RetiredAt') } |
|        ForEach-Object { [pscustomobject]@{ Kind = [string](Get-SIProRowValue $_ 'Kind'); ItemKey = [string](Get-SIProRowValue $_ 'ItemKey') } })
|    [pscustomobject]@{ Settings = $set.ToArray(); Kept = $kept.ToArray(); NotCarried = $not.ToArray(); Map = $map; Retire = @($retire)
|        Empty = ($set.Count -eq 0 -and $null -eq $map -and @($retire).Count -eq 0) }
|}
|
|function Invoke-SIProConfigurationMigration {
|    <#
|        Apply Get-SIProConfigurationMigrationPlan to the database: the setting rows (Set-SIProSetting, each with its
|        cfg.ChangeLog row), the ownership document (Set-SIProItem cmdbownership/map), and the retirement of the former
|        template rows (RetiredAt + a cfg.ChangeLog row each; one transaction). The actor is the session. A carried-over map
|        the run would refuse is NOT written (reported) -- the run keeps building it from the legacy rows, so nothing changes.
|        Returns the plan plus Written = @{ Settings; Map; Retired } and Refused.
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$SIRoot, [object[]]$Catalog, $Context)
|    if (-not $Catalog) { $Catalog = @(Get-SISettingsCatalog -SIRoot $SIRoot) }
|    $tpl = @(Read-SIProTemplates -Store $Store); $ovr = @(Read-SIProItemOverrides -Store $Store); $set = @(Read-SIProSettings -Store $Store)
|    $plan = Get-SIProConfigurationMigrationPlan -Templates $tpl -Overrides $ovr -Settings $set -Catalog $Catalog -ShippedOwnershipMap (Get-SIProShippedOwnershipMap -SIRoot $SIRoot)
|    $by = '{0} (carried over: templates hold only vendor content)' -f (Get-SIProSessionActor)
|    $written = [ordered]@{ Settings = 0; Map = $false; Retired = 0 }; $refused = New-Object System.Collections.Generic.List[string]
|    foreach ($s in @($plan.Settings)) {
|        Set-SIProSetting -Store $Store -Catalog $Catalog -Name $s.Name -Scope $s.Scope -Action Set -Value $s.Value -ChangedBy $by -Reason ('carried over 1:1 from {0} (a name is a setting now)' -f $s.From)
|        $written.Settings++
|    }
|    if ($plan.Map) {
|        $why = @(Test-SIProOwnershipMap -Value $plan.Map.Body)
|        if ($why.Count) { $refused.Add(('the CMDB ownership map was not written ({0}) -- it is still built from your earlier entries at run start' -f ($why -join '; '))) }
|        else {
|            if (-not $Context) { $Context = Get-SIProConfigContext -SIRoot $SIRoot -Catalog $Catalog }
|            Set-SIProItem -Store $Store -Kind cmdbownership -Key map -State override -Body $plan.Map.Body -ChangedBy $by -Reason ('the CMDB ownership map is your configuration now -- {0}' -f $plan.Map.From) -Context $Context
|            $written.Map = $true
|        }
|    }
|    # the ownership rows are retired only once the map document holds what they said
|    $retire = @($plan.Retire | Where-Object { $_.Kind -ne 'cmdbownership' -or -not $refused.Count })
|    if ($retire.Count) {
|        $sb = New-Object System.Text.StringBuilder; $p = [ordered]@{ By = $by }
|        [void]$sb.AppendLine('SET XACT_ABORT ON;'); [void]$sb.AppendLine('BEGIN TRAN;')
|        $i = 0
|        foreach ($r in $retire) {
|            $p["k$i"] = $r.Kind; $p["i$i"] = $r.ItemKey
|            [void]$sb.AppendLine(("UPDATE cfg.Template SET RetiredAt = SYSUTCDATETIME() WHERE Kind = @k{0} AND ItemKey = @i{0} AND RetiredAt IS NULL;" -f $i))
|            [void]$sb.AppendLine(("INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason) VALUES (@i{0}, 'template', @k{0}, 'Reset', 'published', 'retired', @By, 'not a template any more -- it is configuration (kept as history)');" -f $i))
|            $i++
|        }
|        [void]$sb.AppendLine('COMMIT;')
|        & $Store.Invoke $sb.ToString() $p 'nonquery'
|        $written.Retired = $i
|    }
|    $plan | Add-Member -NotePropertyName Written -NotePropertyValue ([pscustomobject]$written) -PassThru | Add-Member -NotePropertyName Refused -NotePropertyValue $refused.ToArray() -PassThru
|}
|
|function Get-SITemplatePublishPlan {
|    <#
|        PURE. What publishing -Rows over the database's current templates (-Existing) would do, per item:
|          insert   new item;   update   body (hash) or version changed;   same   nothing to do;
|          retire   in the database, not shipped any more (RetiredAt is set -- the row is never removed);
|          revive   retired before, shipped again.
|        Customer overrides are not read or touched: a version bump keeps every override.
|        -RefreshMissingContentHash: an existing row without a ContentHash (published before template versioning) is
|        updated even when nothing else changed, so every row carries one.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [AllowEmptyCollection()][object[]]$Existing = @(), [string[]]$Families,
|          [switch]$RefreshMissingContentHash)
|    $have = @{}; foreach ($e in @($Existing | Where-Object { $_ })) { $have[('{0}/{1}' -f (Get-SIProRowValue $e 'Kind'), (Get-SIProRowValue $e 'ItemKey'))] = $e }
|    $ship = @{}
|    $plan = New-Object System.Collections.Generic.List[object]
|    foreach ($r in @($Rows)) {
|        $name = '{0}/{1}' -f $r.Kind, $r.ItemKey; $ship[$name] = $true
|        $e = $have[$name]
|        $action = if (-not $e) { 'insert' }
|                  elseif ($null -ne (Get-SIProRowValue $e 'RetiredAt')) { 'revive' }
|                  elseif ([string](Get-SIProRowValue $e 'BodyHash') -ne $r.BodyHash -or [string](Get-SIProRowValue $e 'TemplateVersion') -ne $r.TemplateVersion -or [string](Get-SIProRowValue $e 'Source') -ne $r.Source -or [string](Get-SIProRowValue $e 'SortOrder') -ne [string]$r.SortOrder) { 'update' }
|                  elseif ($RefreshMissingContentHash -and -not ([string](Get-SIProRowValue $e 'ContentHash')).Trim()) { 'update' }
|                  else { 'same' }
|        $plan.Add([pscustomobject]@{ Action = $action; Kind = $r.Kind; ItemKey = $r.ItemKey; Row = $r })
|    }
|    $kinds = if ($Families) { $Families } else { @($Rows | ForEach-Object { $_.Kind } | Select-Object -Unique) }
|    foreach ($name in @($have.Keys)) {
|        $e = $have[$name]
|        if ($ship.ContainsKey($name) -or $null -ne (Get-SIProRowValue $e 'RetiredAt')) { continue }
|        if ($kinds -notcontains [string](Get-SIProRowValue $e 'Kind')) { continue }
|        $plan.Add([pscustomobject]@{ Action = 'retire'; Kind = [string](Get-SIProRowValue $e 'Kind'); ItemKey = [string](Get-SIProRowValue $e 'ItemKey'); Row = $null })
|    }
|    $u = $plan.ToArray()
|    @(foreach ($i in (Get-SIProOrdinalOrder -Keys @($u | ForEach-Object { '{0}|{1}' -f $_.Kind, $_.ItemKey }))) { $u[$i] })
|}
|
|function Get-SIProStoreTransaction {
|    <#
|        The store's ONE-CONNECTION TRANSACTION: { param([scriptblock]$Body) } -- the body gets an invoke (sql, params, mode)
|        bound to one open connection and one transaction, committed when it returns, rolled back on any error. The settings
|        store has it (New-SIProSettingsStore: Transaction); a store that names its Server / Database / GetToken (the container
|        updater's) gets one built here, and so does one with an OpenConnection { } (returns an OPEN SqlConnection -- the
|        real-SQL tests). $null for a store with none of these (a test's fake): the caller then writes as before.
|    #>
|    param([Parameter(Mandatory)]$Store)
|    if ($Store.PSObject.Properties['Transaction'] -and $Store.Transaction -is [scriptblock]) { return $Store.Transaction }
|    $open = $null
|    if ($Store.PSObject.Properties['OpenConnection'] -and $Store.OpenConnection -is [scriptblock]) { $open = $Store.OpenConnection }
|    elseif ($Store.PSObject.Properties['GetToken'] -and $Store.GetToken -is [scriptblock] -and $Store.PSObject.Properties['Server'] -and "$($Store.Server)".Trim() -and $Store.PSObject.Properties['Database'] -and "$($Store.Database)".Trim()) {
|        $cs = 'Server=tcp:{0},1433;Database={1};Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;' -f $Store.Server, $Store.Database
|        $gt = $Store.GetToken
|        $open = { $c = New-Object System.Data.SqlClient.SqlConnection($cs); $c.AccessToken = [string](& $gt); $c.Open(); $c }.GetNewClosure()
|    }
|    if ($open) {
|        return {
|            param([scriptblock]$Body)
|            $cn = & $open
|            $tx = $null
|            try {
|                $tx = $cn.BeginTransaction()
|                $txInvoke = {
|                    param([string]$tsql, $tp, [string]$tmode)
|                    $tc = $cn.CreateCommand(); $tc.Transaction = $tx; $tc.CommandText = $tsql; $tc.CommandTimeout = 0
|                    if ($tp) { foreach ($k in $tp.Keys) { [void]$tc.Parameters.AddWithValue('@' + $k, $(if ($null -eq $tp[$k]) { [System.DBNull]::Value } else { $tp[$k] })) } }
|                    if ($tmode -eq 'reader') { $rd = $tc.ExecuteReader(); $out = New-Object System.Collections.Generic.List[object]; while ($rd.Read()) { $h = @{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $h[$rd.GetName($i)] = $(if ($rd.IsDBNull($i)) { $null } else { $rd.GetValue($i) }) }; $out.Add($h) }; $rd.Close(); return , $out.ToArray() }
|                    if ($tmode -eq 'scalar') { return $tc.ExecuteScalar() }
|                    [void]$tc.ExecuteNonQuery()
|                }.GetNewClosure()
|                $r = & $Body $txInvoke
|                $tx.Commit(); $tx = $null
|                $r
|            } catch {
|                if ($tx) { try { $tx.Rollback() } catch { } }
|                throw
|            } finally { $cn.Dispose() }
|        }.GetNewClosure()
|    }
|    $null
|}
|
|function Invoke-SITemplatePublish {
|    <#
|        Apply a publish plan: insert / update / revive / retire, each with a cfg.ChangeLog entry (Scope 'template', the
|        version and content hash -- not the body, which can be large), in transactions of up to -BatchSize items. Every
|        written row carries its normalised ContentHash, and each content is kept once in cfg.TemplateRevision. Never
|        writes cfg.ItemOverride (it reads it only to leave an overridden or switched-off item out of the "upgraded"
|        change-log entry). Needs the template-versioning schema (Publish-SITemplates checks it first).
|        ATOMIC (ring 1 2026-10-10: a run that read the store while the first data-model publish was half-way saw part of the
|        field catalog and stopped): every batch goes through the store's ONE-CONNECTION TRANSACTION (Get-SIProStoreTransaction)
|        -- a reader sees the whole old set or the whole new one, never a mix (with READ COMMITTED SNAPSHOT, Azure SQL's default,
|        the old set until the commit; without it the read waits for the commit). The batches stay (a command's parameters are
|        limited), inside the one transaction. A store without one (a test's fake) gets the batches as before.
|        -AfterBatch { param($BatchNo, $Invoke) }: test seam, called after each batch inside the transaction.
|    #>
|    param([Parameter(Mandatory)]$Store, [AllowEmptyCollection()][object[]]$Plan = @(), [Parameter(Mandatory)][string]$ChangedBy, [int]$BatchSize = 100, [scriptblock]$AfterBatch)
|    $work = @($Plan | Where-Object { $_.Action -ne 'same' })
|    if (-not $work.Count) { return 0 }
|    $txn = Get-SIProStoreTransaction -Store $Store
|    $write = {
|    param($Send)
|    $batchNo = 0
|    for ($s = 0; $s -lt $work.Count; $s += $BatchSize) {
|        $chunk = @($work[$s..([Math]::Min($s + $BatchSize, $work.Count) - 1)])
|        $sb = New-Object System.Text.StringBuilder
|        [void]$sb.AppendLine('SET XACT_ABORT ON;'); [void]$sb.AppendLine('BEGIN TRAN;')
|        $p = [ordered]@{ By = $ChangedBy }
|        for ($i = 0; $i -lt $chunk.Count; $i++) {
|            $c = $chunk[$i]; $p["k$i"] = $c.Kind; $p["i$i"] = $c.ItemKey
|            if ($c.Action -eq 'retire') {
|                [void]$sb.AppendLine(("UPDATE cfg.Template SET RetiredAt = SYSUTCDATETIME() WHERE Kind = @k{0} AND ItemKey = @i{0} AND RetiredAt IS NULL;" -f $i))
|                [void]$sb.AppendLine(("INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason) VALUES (@i{0}, 'template', @k{0}, 'Reset', 'published', 'retired', @By, 'no longer shipped');" -f $i))
|                continue
|            }
|            $r = $c.Row
|            $ch = [string](Get-SIProRowValue $r 'ContentHash'); if (-not $ch.Trim()) { $ch = Get-SIProContentHash -Body $r.BodyJson -Format $r.Format }
|            $p["v$i"] = $r.TemplateVersion; $p["b$i"] = $r.BodyJson; $p["f$i"] = $r.Format; $p["o$i"] = [int]$r.SortOrder; $p["h$i"] = $r.BodyHash; $p["s$i"] = $r.Source; $p["c$i"] = $ch.Trim()
|            # #529 (3): the content in force before this write -- an item that FOLLOWS the template (no override, or inherit)
|            # and changes content gets an "upgraded" entry below, naming the version it went from and to
|            [void]$sb.AppendLine(("DECLARE @pv{0} nvarchar(32) = NULL, @pc{0} char(64) = NULL, @pr{0} bit = 0; SELECT @pv{0} = [Version], @pc{0} = ContentHash, @pr{0} = CASE WHEN RetiredAt IS NULL THEN 0 ELSE 1 END FROM cfg.Template WHERE Kind = @k{0} AND ItemKey = @i{0};" -f $i))
|            [void]$sb.AppendLine(("IF EXISTS (SELECT 1 FROM cfg.Template WHERE Kind = @k{0} AND ItemKey = @i{0})" -f $i))
|            [void]$sb.AppendLine(("    UPDATE cfg.Template SET [Version] = @v{0}, BodyJson = @b{0}, Format = @f{0}, SortOrder = @o{0}, BodyHash = @h{0}, ContentHash = @c{0}, Source = @s{0}, PublishedAt = SYSUTCDATETIME(), RetiredAt = NULL WHERE Kind = @k{0} AND ItemKey = @i{0};" -f $i))
|            [void]$sb.AppendLine('ELSE')
|            [void]$sb.AppendLine(("    INSERT cfg.Template (Kind, ItemKey, [Version], BodyJson, Format, SortOrder, BodyHash, ContentHash, Source) VALUES (@k{0}, @i{0}, @v{0}, @b{0}, @f{0}, @o{0}, @h{0}, @c{0}, @s{0});" -f $i))
|            # every content a template ever had is kept once (by ContentHash), so "what changed since you overrode it"
|            # can be shown against the body the override was made on
|            [void]$sb.AppendLine(("IF NOT EXISTS (SELECT 1 FROM cfg.TemplateRevision WHERE Kind = @k{0} AND ItemKey = @i{0} AND ContentHash = @c{0}) INSERT cfg.TemplateRevision (Kind, ItemKey, ContentHash, [Version], BodyJson, Format) VALUES (@k{0}, @i{0}, @c{0}, @v{0}, @b{0}, @f{0});" -f $i))
|            [void]$sb.AppendLine(("INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason) VALUES (@i{0}, 'template', @k{0}, 'Set', NULL, CONCAT(@v{0}, ':', @c{0}), @By, '{1}');" -f $i, $c.Action))
|            [void]$sb.AppendLine(("IF @pc{0} IS NOT NULL AND @pr{0} = 0 AND @pc{0} <> @c{0} AND NOT EXISTS (SELECT 1 FROM cfg.ItemOverride WHERE Kind = @k{0} AND ItemKey = @i{0} AND State IN ('override', 'disable')) INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason) VALUES (@i{0}, 'item', @k{0}, 'Set', CONCAT('template ', COALESCE(@pv{0}, '(none)'), ':', @pc{0}), CONCAT('template ', @v{0}, ':', @c{0}), @By, CONCAT('upgraded: follows the new shipped version (', COALESCE(@pv{0}, '(none)'), ' -> ', @v{0}, ')'));" -f $i))
|        }
|        [void]$sb.AppendLine('COMMIT;')
|        & $Send $sb.ToString() $p 'nonquery'
|        $batchNo++
|        if ($AfterBatch) { & $AfterBatch $batchNo $Send }
|    }
|    }
|    if ($txn) { $null = & $txn $write } else { $null = & $write $Store.Invoke }
|    $work.Count
|}
|
|# =====================================================================================================================
|#  IMPORT: an installation's files -> only what DIFFERS from the templates (Community -> Pro)
|# =====================================================================================================================
|function Get-SIProAssetTaggingSources {
|    <#
|        #275 R3. The asset-tagging files a 2.2 run of THIS installation reads, found exactly as the launcher and the engine
|        find them (AssetTagging.Resolve.ps1): SettingsPath, CustomYamlFile, LockedYamlFile and LegacyYamlFile as the
|        configuration layers leave them -- config\SecurityInsight.custom.ps1, then launcher\asset-tagging\
|        LauncherConfig.custom.ps1, then (internal launcher) launcher\asset-tagging\launcher.override.ps1, the last plain
|        top-level assignment winning -- else the launcher's default folder (internal: asset-tagging-rules\ first).
|        -SettingsPath (the importer's -AssetTaggingPath) wins, as the launcher's -SettingsPath switch does.
|        Returns @{ SettingsPath; From; Flavour; Files (Resolve-SIAssetTaggingFiles, or $null when the folder cannot be
|        known or read); Review (not imported, with the reason -- never silent); Info (said, nothing lost) }.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$SettingsPath, [string]$Flavour)
|    $review = New-Object System.Collections.Generic.List[object]; $info = New-Object System.Collections.Generic.List[object]
|    $rel = { param([string]$p) if ($p.StartsWith($SIRoot, [StringComparison]::OrdinalIgnoreCase)) { $p.Substring($SIRoot.Length).TrimStart('\', '/') } else { $p } }
|    if (-not $Flavour) { $Flavour = if ((Split-Path -Leaf (Split-Path -Parent $SIRoot)) -eq 'SOLUTIONS') { 'internal' } else { 'community' } }
|    $layers = @((Join-SIProPath $SIRoot 'config' 'SecurityInsight.custom.ps1'), (Join-SIProPath $SIRoot 'launcher' 'asset-tagging' 'LauncherConfig.custom.ps1'))
|    if ($Flavour -eq 'internal') { $layers += (Join-SIProPath $SIRoot 'launcher' 'asset-tagging' 'launcher.override.ps1') }   # only the internal launcher dot-sources it
|    $names = 'SettingsPath', 'CustomYamlFile', 'LockedYamlFile', 'LegacyYamlFile'
|    $val = @{}; $from = @{}; $byCode = @{}
|    foreach ($l in $layers) {
|        if (-not (Test-Path -LiteralPath $l)) { continue }
|        foreach ($a in @(Get-SIPs1Assignments -Text (Read-SISettingsText -Path $l).Text | Where-Object { $names -contains $_.Name })) {
|            if ($a.TopLevel -and $a.Literal) { $val[$a.Name] = [string]$a.Value; $from[$a.Name] = ('{0} line {1}' -f (& $rel $l), $a.Line); [void]$byCode.Remove($a.Name) }
|            else { $byCode[$a.Name] = [pscustomobject]@{ Path = (& $rel $l); Line = $a.Line } }
|        }
|    }
|    $out = [pscustomobject]@{ SettingsPath = $null; From = ''; Flavour = $Flavour; Files = $null; Review = $review; Info = $info }
|    $tell = { param([string]$name, [string]$path, $line, [string]$reason) $review.Add([pscustomobject]@{ Name = $name; Scope = 'item'; Path = $path; Line = $line; Reason = $reason }) }
|    foreach ($n in @($names | Where-Object { $byCode.ContainsKey($_) -and $_ -ne 'SettingsPath' })) {
|        $c = $byCode[$n]
|        & $tell ('assettagging ' + $n) $c.Path $c.Line ('{0} is set by code at line {1}, so the importer cannot tell which asset-tagging file the run reads -- the default name is used; check that nothing is missing' -f $n, $c.Line)
|    }
|    if (-not $SettingsPath -and $byCode.ContainsKey('SettingsPath')) {
|        $c = $byCode['SettingsPath']
|        & $tell 'assettagging' $c.Path $c.Line ('SettingsPath is set by code at line {0}, so the importer cannot tell which folder the asset-tagging run reads -- no asset-tagging rules are imported; run the importer again with -AssetTaggingPath <that folder>' -f $c.Line)
|        return $out
|    }
|    $configured = if ($val.ContainsKey('SettingsPath')) { $val['SettingsPath'] } else { '' }
|    $sp = Resolve-SIAssetTaggingSettingsPath -Cli $SettingsPath -Configured $configured -SIRoot $SIRoot -Flavour $Flavour
|    $out.SettingsPath = $sp
|    $out.From = if ($SettingsPath) { '-AssetTaggingPath' } elseif ($configured) { $from['SettingsPath'] } else { ('the {0} launcher''s default' -f $Flavour) }
|    if (-not [System.IO.Path]::IsPathRooted($sp)) {
|        & $tell 'assettagging' $sp $null ('the asset-tagging rules folder (SettingsPath, {0}) is a relative path -- it depends on the folder the run starts in; run the importer again with -AssetTaggingPath <the full path>' -f $out.From)
|        return $out
|    }
|    if (-not (Test-Path -LiteralPath $sp -PathType Container)) {
|        # the launcher's own default folder missing = an installation without asset tagging (the 2.2 run stopped): nothing to lose
|        if (-not $SettingsPath -and -not $configured) { $out.Files = $null; return $out }
|        & $tell 'assettagging' $sp $null ('the asset-tagging rules folder (SettingsPath, {0}) does not exist on this machine -- copy it here or run the importer again with -AssetTaggingPath <folder>' -f $out.From)
|        return $out
|    }
|    $launcherDefault = { param([string]$n, [string]$d) if ($val.ContainsKey($n) -and -not [string]::IsNullOrWhiteSpace($val[$n])) { $val[$n] } else { $d } }
|    # the launchers set the locked / custom names when nothing else has (AssetTagging.locked.yaml / .custom.yaml); the
|    # legacy name only ever comes from the configuration or the engine's own default
|    $out.Files = Resolve-SIAssetTaggingFiles -SettingsPath $sp -SIRoot $SIRoot `
|        -LockedYamlFile (& $launcherDefault 'LockedYamlFile' 'AssetTagging.locked.yaml') -CustomYamlFile (& $launcherDefault 'CustomYamlFile' 'AssetTagging.custom.yaml') `
|        -LegacyYamlFile (& $launcherDefault 'LegacyYamlFile' '')
|    $f = $out.Files
|    $shippedDir = Join-SIProPath $SIRoot 'asset-profiling-enrichment' 'endpoint'
|    $isShipped = ([System.IO.Path]::GetFullPath($sp).TrimEnd('\', '/') -ieq [System.IO.Path]::GetFullPath($shippedDir).TrimEnd('\', '/'))
|    if ($f.Mode -eq 'legacy') {
|        $info.Add([pscustomobject]@{ Name = 'assettagging'; Path = (& $rel $f.LegacyPath); Reason = 'the run read ONLY this legacy file (no locked / custom file beside it); its tags are imported -- in Pro the shipped tags it does not restate also run: turn off the ones you do not want' })
|    } elseif ($f.Mode -eq 'locked+custom' -and -not $f.LockedExists -and -not $isShipped) {
|        $info.Add([pscustomobject]@{ Name = 'assettagging'; Path = (& $rel $f.CustomPath); Reason = ('the run read ONLY this file ({0} holds no {1}); its tags are imported -- in Pro the shipped tags also run: turn off the ones you do not want' -f (& $rel $sp), $f.LockedYamlFile) })
|    } elseif ($f.Mode -eq 'none' -and -not $isShipped) {
|        & $tell 'assettagging' (& $rel $sp) $null ('no asset-tagging rules file ({0}, {1} or {2}) is in the folder the run reads (SettingsPath, {3}) -- the 2.2 run stopped here; nothing to import' -f $f.LockedYamlFile, $f.CustomYamlFile, $f.LegacyYamlFile, $out.From)
|    }
|    $cands = @($f.ConfigCandidates)
|    if ($f.ConfigPath) {
|        foreach ($c in @($cands | Where-Object { $_ -ne $f.ConfigPath -and (Test-Path -LiteralPath $_) })) {
|            $info.Add([pscustomobject]@{ Name = 'assettagging/config'; Path = (& $rel $c); Reason = ('not read by the run -- {0} comes first; not imported' -f (& $rel $f.ConfigPath)) })
|        }
|    }
|    $out
|}
|
|function Get-SIProConfigImportPlan {
|    <#
|        Every configuration family an installation keeps in files, as cfg.ItemOverride rows -- ONLY what differs from the
|        templates (-Templates: the rows Get-SITemplateRows builds, or the database's). Per family:
|          rareport      RiskAnalysis_Queries_Custom.yaml (or custom\): a report / template that differs -> override; a
|                        new one -> own
|          riskindex     riskscore.index.custom.csv (the customer's own rows, #398): a row that differs from its template
|                        -> override, a new row -> own, both placed before every shipped row (as the engine reads them);
|                        nothing is disabled; an unchanged copy of an earlier shipped index -> nothing (Info)
|          rule          a custom rule with 'mode: disable' for a shipped rule -> disable (other custom rules stay
|                        cfg.Document, Get-SIProDocumentImportPlan)
|          assettagging  the files the asset-tagging run reads, found as the launcher + engine find them (Get-SIProAssetTaggingSources;
|                        -AssetTaggingPath wins): per tag override / own; the asset-tagging.config.json it reads -> config
|          serverapps    asset-profiling-enrichment\endpoint\server-applications.json -> catalog
|          cmdbownership config\cmdb-source-ownership.custom.json, merged per field over the template (the loader's rule)
|          servicemodel  config\service-model.custom.json (replaces the model wholesale)
|          schemaoverlay asset-profiling-schema\<engine>.schema.custom.json
|          decision      config\ and overlay-root asset-decisions / correlation-decisions .custom.yaml
|          weights       <Report>.weighted.custom.json -> report/<Report>; the riskscore_weighted file's sections other than
|                        weightedRiskFactors -> model (weightedRiskFactors itself is the cfg.Document weights/solution)
|        Not imported, with the reason: a file that does not parse or validate. Returns @{ Rows; Skipped; Same; Files }
|        where Files = the source files and whether everything in them was imported (for -RetireFiles).
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [AllowEmptyCollection()][object[]]$Templates = @(), [string]$OverlayRoot,
|          [string]$AssetTaggingPath, [string]$AssetTaggingFlavour, $Context,
|          # The templates were built from THIS installation's files, not read from the database. Kept for callers: since
|          # #398 the shipped risk index (locked) and the customer's rows (custom) are separate files, so a local baseline
|          # compares like any other.
|          [switch]$LocalTemplates)
|    if (-not $Context) { $Context = Get-SIProConfigContext -SIRoot $SIRoot }
|    $tpl = @{}; foreach ($t in @($Templates)) { $tpl[('{0}/{1}' -f $t.Kind, $t.ItemKey)] = $t }
|    $rows = New-Object System.Collections.Generic.List[object]; $skipped = New-Object System.Collections.Generic.List[object]
|    $same = New-Object System.Collections.Generic.List[string]; $files = [ordered]@{}; $info = New-Object System.Collections.Generic.List[object]
|    $rel = { param([string]$p) if ($p.StartsWith($SIRoot, [StringComparison]::OrdinalIgnoreCase)) { $p.Substring($SIRoot.Length).TrimStart('\', '/') } else { $p } }
|    $file = { param([string]$p, [string]$kind) $k = & $rel $p; if (-not $files.Contains($k)) { $files[$k] = [pscustomobject]@{ Path = $p; Rel = $k; Kind = $kind; Complete = $true; Imported = 0 } }; $files[$k] }
|    # the customer's own reports count as reports for validation
|    $ctx = [pscustomobject]@{ SIRoot = $Context.SIRoot; Reports = @($Context.Reports); Kinds = @($Context.Kinds); Catalog = @($Context.Catalog) }
|    $consider = {
|        param([string]$kind, [string]$key, [string]$body, [string]$fmt, [string]$src)
|        $f = & $file $src $kind
|        $name = '{0}/{1}' -f $kind, $key
|        $t = $tpl[$name]
|        if ($t -and (Test-SIProSameItem -A $body -B ([string]$t.BodyJson) -Format $fmt)) { $same.Add($name); return }
|        $why = @(Test-SIProItem -Kind $kind -Key $key -Body $body -Format $fmt -Context $ctx)
|        if ($why.Count) { $skipped.Add([pscustomobject]@{ Name = $name; Scope = 'item'; Reason = ('{0}: {1}' -f (& $rel $src), ($why -join '; ')) }); $f.Complete = $false; return }
|        $rows.Add([pscustomobject]@{ Kind = $kind; Key = $key; State = 'override'; Body = $body; Format = $fmt
|            BaseVersion = $(if ($t) { [string]$t.TemplateVersion } else { $null }); BaseHash = $(if ($t) { Get-SIProRowContentHash $t } else { $null })
|            Origin = $(if ($t) { 'override' } else { 'own' }); Source = (& $rel $src) })
|        $f.Imported++
|    }
|    $rad = Join-SIProPath $SIRoot 'risk-analysis-detection'
|
|    # ---- Risk Analysis report catalog: the custom YAML ----
|    foreach ($cand in @((Join-SIProPath $rad 'custom' 'RiskAnalysis_Queries_Custom.yaml'), (Join-SIProPath $rad 'RiskAnalysis_Queries_Custom.yaml'))) {
|        if (-not (Test-Path -LiteralPath $cand)) { continue }
|        $y = $null
|        try { $y = ConvertFrom-SIYaml -Path $cand -Ordered } catch { $skipped.Add([pscustomobject]@{ Name = (& $rel $cand); Scope = 'item'; Reason = 'not valid YAML: ' + $_.Exception.Message }); (& $file $cand 'rareport').Complete = $false; continue }
|        if ($null -eq $y) { continue }
|        foreach ($r in @($y['Reports'] | Where-Object { $null -ne $_ })) { $ctx.Reports = @($ctx.Reports + [string]$r['ReportName']) }
|        foreach ($r in @($y['Reports'] | Where-Object { $null -ne $_ })) { & $consider 'rareport' ('report/' + [string]$r['ReportName']) (ConvertTo-SIProJson -Value $r -Level 2) 'json' $cand }
|        foreach ($r in @($y['ReportTemplates'] | Where-Object { $null -ne $_ })) { & $consider 'rareport' ('template/' + [string]$r['ReportName']) (ConvertTo-SIProJson -Value $r -Level 2) 'json' $cand }
|        foreach ($k in @($y.Keys | Where-Object { $_ -notin 'Reports', 'ReportTemplates' })) { $skipped.Add([pscustomobject]@{ Name = ('{0}:{1}' -f (& $rel $cand), $k); Scope = 'item'; Reason = 'only Reports and ReportTemplates are read from the custom catalog' }) }
|        break   # the engine reads the custom\ copy when it exists, else the flat one
|    }
|
|    # ---- the risk index: the customer's OWN rows (#398) ----
|    # riskscore.index.custom.csv is never shipped (the shipped index is riskscore.index.locked.csv, the templates); it
|    # holds only the customer's rows, which the engine reads BEFORE the shipped rows and which never remove one. So the
|    # import mirrors that: a row equal to its template (its place aside) changes nothing; any other row is placed before
|    # every shipped row, in the file's order (a negative Precedence -- the run file renumbers 1..n); nothing is disabled.
|    # A never-edited copy of an earlier version's shipped index is not the customer's and is not imported.
|    $ri = Join-SIProPath $rad 'riskscore.index.custom.csv'
|    $riShipped = $false
|    if ((Test-Path -LiteralPath $ri) -and (Get-Command -Name Test-SIRiskIndexShippedCopy -ErrorAction SilentlyContinue)) { $riShipped = Test-SIRiskIndexShippedCopy -Path $ri }
|    if ($riShipped) {
|        $info.Add([pscustomobject]@{ Name = 'riskindex'; Reason = ('{0} is the unchanged risk index of an earlier version -- nothing of it is imported' -f (& $rel $ri)) })
|    } elseif (Test-Path -LiteralPath $ri) {
|        $count = @{}
|        # A v2.2 index (no Precedence column) is put in precedence order first -- the same scores, first match wins
|        # (RA-RiskIndexOrder.ps1) -- so it is compared with the templates in the form they are published in.
|        # #559: and a file written with the 2.2 columns is translated to the SI keys (the form the templates are published in)
|        $riRows = @(Import-Csv -LiteralPath $ri)
|        $riRows = @(ConvertTo-SIRiskIndexSiRows -Rows $riRows | ForEach-Object { [pscustomobject]$_ })
|        $n = $riRows.Count; $pos = 0
|        foreach ($r in $riRows) {
|            $pos++
|            $o = [ordered]@{}; foreach ($c in $script:SIRiskIndexColumns) { $o[$c] = $(if ((Get-SIRiskIndexCell $r $c) -ne '') { Get-SIRiskIndexCell $r $c } else { '' }) }
|            $key = Get-SIRiskIndexKey -Row $o
|            if ($count.ContainsKey($key)) { $count[$key]++; $key = '{0}#{1}' -f $key, $count[$key] } else { $count[$key] = 1 }   # a repeat, as the templates key it
|            $t = $tpl[('riskindex/{0}' -f $key)]
|            if ($t) {
|                $tb = ConvertFrom-SIProJson ([string]$t.BodyJson)
|                $diff = @($script:SIRiskIndexColumns | Where-Object { $_ -ne 'Precedence' -and [string]$o[$_] -cne [string]$(if ($tb.PSObject.Properties[$_]) { $tb.$_ } else { '' }) })
|                if (-not $diff.Count) { $same.Add(('riskindex/{0}' -f $key)); continue }
|            }
|            $o['Precedence'] = [string]($pos - $n - 1)
|            & $consider 'riskindex' $key (ConvertTo-SIProJson -Value $o) 'json' $ri
|        }
|    }
|
|    # ---- rules: a custom 'mode: disable' of a shipped rule ----
|    foreach ($r in @(Get-SIRuleView -SIRoot $SIRoot -OverlayRoot $OverlayRoot)) {
|        $own = if ($r.overlay) { $r.overlay } elseif ($r.custom) { $r.custom } else { $null }
|        if (-not $own -or -not $r.locked -or $own.mode -ne 'disable') { continue }
|        $path = if ($own.path -like 'overlay:*') { Join-SIProPath $OverlayRoot $own.path.Substring(8) } else { Join-SIProPath $SIRoot $own.path }
|        $key = '{0}/{1}' -f $r.engine, $r.id
|        $t = $tpl['rule/' + $key]
|        $rows.Add([pscustomobject]@{ Kind = 'rule'; Key = $key; State = 'disable'; Body = $null; Format = 'yaml'; BaseVersion = $(if ($t) { [string]$t.TemplateVersion } else { $null }); BaseHash = $(if ($t) { Get-SIProRowContentHash $t } else { $null }); Origin = 'disable'; Source = (& $rel $path) })
|        (& $file $path 'rule').Imported++
|    }
|
|    # ---- asset tagging: EXACTLY the files a run of this installation reads (#275 R3) -- the launchers' and the engine's
|    #      own resolution (AssetTagging.Resolve.ps1); what cannot be known or read is listed, never skipped silently ----
|    $tagSrc = Get-SIProAssetTaggingSources -SIRoot $SIRoot -SettingsPath $AssetTaggingPath -Flavour $AssetTaggingFlavour
|    foreach ($s in $tagSrc.Review) { $skipped.Add($s) }
|    foreach ($s in $tagSrc.Info) { $info.Add($s) }
|    $tf = $tagSrc.Files
|    if ($tf) {
|        $tagFiles = @()
|        if ($tf.Mode -eq 'locked+custom') {
|            # a locked file OUTSIDE the shipped place is the customer's copy -- the run read it, so its tags count (a tag
|            # identical to the template is not stored)
|            $shippedLocked = Join-SIProPath $SIRoot 'asset-profiling-enrichment' 'endpoint' 'AssetTagging.locked.yaml'
|            if ($tf.LockedExists -and ([System.IO.Path]::GetFullPath($tf.LockedPath) -ine [System.IO.Path]::GetFullPath($shippedLocked))) { $tagFiles += $tf.LockedPath }
|            if ($tf.CustomExists) { $tagFiles += $tf.CustomPath }
|        } elseif ($tf.Mode -eq 'legacy') { $tagFiles += $tf.LegacyPath }
|        # merged as the engine merges: per tag stem, the custom file wins over the locked one
|        $merged = [ordered]@{}
|        foreach ($tc in $tagFiles) {
|            $null = & $file $tc 'assettagging'
|            $y = $null
|            try { $y = ConvertFrom-SIYaml -Path $tc -Ordered } catch { $skipped.Add([pscustomobject]@{ Name = (& $rel $tc); Scope = 'item'; Path = (& $rel $tc); Reason = 'not valid YAML: ' + $_.Exception.Message }); (& $file $tc 'assettagging').Complete = $false; continue }
|            if (-not $y) { continue }
|            foreach ($t in @($y['AssetTagging'] | Where-Object { $null -ne $_ })) {
|                $stem = Get-SIProAssetTagStemKey ([string]$t['AssetTagName'])
|                if (-not $stem) { $skipped.Add([pscustomobject]@{ Name = 'assettagging/' + [string]$t['AssetTagName']; Scope = 'item'; Path = (& $rel $tc); Reason = 'the tag name does not follow <stem>--tier<N>--SI / <stem>--excluded--SI' }); (& $file $tc 'assettagging').Complete = $false; continue }
|                $merged[$stem] = [pscustomobject]@{ Tag = $t; Source = $tc }
|            }
|        }
|        foreach ($k in @($merged.Keys)) { & $consider 'assettagging' ('tag/' + $k) (ConvertTo-SIProJson -Value $merged[$k].Tag) 'json' $merged[$k].Source }
|    }
|    # the AutoExclude gates: the config file the run reads (config\ under the solution first, then SettingsPath)
|    $tcfg = if ($tf) { $tf.ConfigPath } else { $p = Join-SIProPath $SIRoot 'config' 'asset-tagging.config.json'; if (Test-Path -LiteralPath $p) { $p } else { $null } }
|    if ($tcfg) { & $consider 'assettagging' 'config' ([System.IO.File]::ReadAllText($tcfg).TrimStart([char]0xFEFF)) 'json' $tcfg }
|
|    # ---- the server-application catalog override (#275 R6): asset-profiling-enrichment\endpoint\server-applications.json,
|    #      which the endpoint profiler merges over the shipped catalog -> serverapps/catalog ----
|    $sa = Join-SIProPath $SIRoot 'asset-profiling-enrichment' 'endpoint' 'server-applications.json'
|    if (Test-Path -LiteralPath $sa) { & $consider 'serverapps' 'catalog' ([System.IO.File]::ReadAllText($sa).TrimStart([char]0xFEFF)) 'json' $sa }
|
|    # ---- CMDB ownership (#251: configuration, ONE document cmdbownership/map): the shipped map with the custom file merged
|    #      over it exactly as the loader merges it (top-level settings replace; an asset type replaces by siAssetType and
|    #      inherits every field it does not restate) -- the whole map, which is the customer's from then on ----
|    $oc = Join-SIProPath $SIRoot 'config' 'cmdb-source-ownership.custom.json'
|    if (Test-Path -LiteralPath $oc) {
|        $c = $null
|        try { $c = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson ([System.IO.File]::ReadAllText($oc))) } catch { $skipped.Add([pscustomobject]@{ Name = (& $rel $oc); Scope = 'item'; Reason = 'not valid JSON' }); (& $file $oc 'cmdbownership').Complete = $false }
|        if ($c -and $c.Contains('cmdbSourceOwnership')) {
|            $croot = $c['cmdbSourceOwnership']
|            $shipped = Get-SIProShippedOwnershipMap -SIRoot $SIRoot
|            $map = if ($shipped) { ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $shipped) } else { [ordered]@{} }
|            foreach ($k in @($croot.Keys | Where-Object { $_ -ne 'assetTypes' -and -not ([string]$_).StartsWith('_') -and $_ -ne 'Comment' })) { if ($null -ne $croot[$k]) { $map[$k] = $croot[$k] } }
|            $types = New-Object System.Collections.Generic.List[object]
|            foreach ($e in @($map['assetTypes'] | Where-Object { $null -ne $_ })) { $types.Add($e) }
|            foreach ($e in @($croot['assetTypes'] | Where-Object { $null -ne $_ })) {
|                $k = ([string]$e['siAssetType']).Trim().ToLowerInvariant()
|                $base = @($types | Where-Object { ([string]$_['siAssetType']).Trim().ToLowerInvariant() -eq $k }) | Select-Object -First 1
|                $m = if ($base) { $base } else { $n = [ordered]@{}; $types.Add($n); $n }
|                foreach ($f in @($e.Keys)) {
|                    # a null siMayCreate / expectedWithinDays says nothing (the loader inherits); a null ownedBy is meaningful
|                    if ($null -eq $e[$f] -and $f -in 'siMayCreate', 'expectedWithinDays', 'ciClass') { continue }
|                    $m[$f] = $e[$f]
|                }
|                $m['siAssetType'] = $k
|            }
|            $map['assetTypes'] = @($types.ToArray())
|            & $consider 'cmdbownership' 'map' (ConvertTo-SIProJson -Value $map) 'json' $oc
|        }
|    }
|    # ---- service model (wholesale) ----
|    $smc = Join-SIProPath $SIRoot 'config' 'service-model.custom.json'
|    if (Test-Path -LiteralPath $smc) {
|        $c = $null
|        try { $c = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson ([System.IO.File]::ReadAllText($smc))) } catch { $skipped.Add([pscustomobject]@{ Name = (& $rel $smc); Scope = 'item'; Reason = 'not valid JSON' }); (& $file $smc 'servicemodel').Complete = $false }
|        if ($c -and $c.Contains('serviceModel')) { & $consider 'servicemodel' 'model' (ConvertTo-SIProJson -Value $c['serviceModel']) 'json' $smc }
|    }
|    # ---- schema overlays ----
|    foreach ($e in 'endpoint', 'identity', 'azure', 'publicip') {
|        $base = if ($e -eq 'publicip') { 'public-ip' } else { $e }
|        $p = Join-SIProPath $SIRoot 'asset-profiling-schema' ('{0}.schema.custom.json' -f $base)
|        if (Test-Path -LiteralPath $p) { & $consider 'schemaoverlay' $e ([System.IO.File]::ReadAllText($p).TrimStart([char]0xFEFF)) 'json' $p }
|    }
|    # ---- decisions: one item per kind; the loaders ADD the tree and the overlay copy, so two files are not merged here ----
|    foreach ($d in @(@{ Key = 'asset'; File = 'asset-decisions.custom.yaml' }, @{ Key = 'correlation'; File = 'correlation-decisions.custom.yaml' })) {
|        $found = @(@((Join-SIProPath $SIRoot 'config' $d.File)) + @($(if ($OverlayRoot) { Join-SIProPath $OverlayRoot $d.File })) | Where-Object { $_ -and (Test-Path -LiteralPath $_) })
|        if ($found.Count -gt 1) {
|            foreach ($f in $found) { $skipped.Add([pscustomobject]@{ Name = 'decision/' + $d.Key; Scope = 'item'; Reason = ('{0}: the installation reads two {1} files and adds them up -- combine them into one and import again' -f (& $rel $f), $d.File) }); (& $file $f 'decision').Complete = $false }
|            continue
|        }
|        if ($found.Count -eq 1) { & $consider 'decision' $d.Key ([System.IO.File]::ReadAllText($found[0]).TrimStart([char]0xFEFF)) 'yaml' $found[0] }
|    }
|    # ---- weights: per-report files, and the model sections of the solution file ----
|    foreach ($f in @(Get-ChildItem -LiteralPath $rad -Filter '*.weighted.custom.json' -File -ErrorAction SilentlyContinue | Sort-Object Name)) {
|        $rep = $f.Name -replace '\.weighted\.custom\.json$', ''
|        $text = [System.IO.File]::ReadAllText($f.FullName).TrimStart([char]0xFEFF)
|        $o = $null; try { $o = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $text) } catch { }
|        if ($o) {
|            $keep = [ordered]@{}; foreach ($k in @($o.Keys)) { if ($k -eq 'weightedRiskFactors' -or $k -eq '$schema' -or ([string]$k).StartsWith('_') -or $k -eq 'Comment') { $keep[$k] = $o[$k] } }
|            $other = @($o.Keys | Where-Object { -not $keep.Contains($_) })
|            if ($other.Count) { $skipped.Add([pscustomobject]@{ Name = 'weights/report/' + $rep + ' (other sections)'; Scope = 'item'; Info = $true; Reason = ('{0}: {1} -- a per-report file is read for weightedRiskFactors only; the other sections are not imported' -f $f.Name, ($other -join ', ')) }) }
|            $text = ConvertTo-SIProJson -Value $keep
|        }
|        & $consider 'weights' ('report/' + $rep) $text 'json' $f.FullName
|    }
|    $wf = Join-SIProPath $rad 'riskscore_weighted.schema.custom.json'
|    if (Test-Path -LiteralPath $wf) {
|        $o = $null; try { $o = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson ([System.IO.File]::ReadAllText($wf))) } catch { }
|        if ($o) {
|            $model = [ordered]@{}; foreach ($k in @($o.Keys)) { if ($k -ne 'weightedRiskFactors' -and $k -ne '$schema' -and -not ([string]$k).StartsWith('_') -and $k -ne 'Comment') { $model[$k] = $o[$k] } }
|            if ($model.Count) { & $consider 'weights' 'model' (ConvertTo-SIProJson -Value $model) 'json' $wf }
|        }
|    }
|    [pscustomobject]@{ Rows = $rows.ToArray(); Skipped = $skipped.ToArray(); Same = $same.ToArray(); Files = @($files.Values); Info = $info.ToArray() }
|}
'@ }
$__siSupportFiles['engine/pro-settings/SI-TemplateVersioning.ps1'] = @{ Sha256 = 'cdc375e3908aab97993a91115673927df57854f2e151ec94a9df6af7f0b4d4dc'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- TEMPLATE VERSIONING (REQUIREMENTS §9.3.3 phase C, "align with PIM4EntraPS").
|
|    What a template SAYS, independent of how it is written, and the gate in front of every path that changes it.
|    Adopted from PIM4EntraPS's policy templates, with the lessons PIM paid for:
|
|      (a) ITEM IDENTITY = A NORMALISED CONTENT HASH (ContentHash). Comments, key order, `_*` keys and description-only
|          fields (description, comment, comments, notes, $schema) do not count, so a documentation edit is not a change.
|          BodyHash (the raw body's SHA-256) stays what it was: the integrity check at run start.
|      (b) An override whose BaseHash is not the current template's ContentHash is "UPGRADE AVAILABLE", shown with WHAT
|          changed (a structured diff of the normalised bodies). Never merged automatically.
|      (c) A FINGERPRINT GATE (the same gate PIM4EntraPS uses, on every update path, so a release never changes the
|          templates in force unseen). Publishing templates compares the template-set fingerprint with the one recorded on the
|          install (cfg.InstallState 'TemplateFingerprint'); a moved fingerprint needs -AcceptTemplateChange, otherwise
|          the run is a plan. The fingerprint is recorded only AFTER a publish is read back and verified.
|      (d) The approver is the identity of the session (Get-SIProSessionActor), never a parameter or a request field.
|      (e) A conformance view per item and per install: UpToDate / Overridden / Disabled / UpgradeAvailable / Own / Retired.
|
|    Everything here except the store readers / writers is pure (rows in, objects out) and tested directly.
|    PS 5.1 safe.
|#>
|
|# Keys that describe an item and never change what it does (compared case-insensitively). `_*` keys are dropped too.
|$script:SIProDocOnlyKeys = @('description', 'comment', 'comments', 'notes', '$schema')
|# The conformance states (the web app's Conformance.States is the same list in the same order).
|$script:SIProConformanceStates = @('UpToDate', 'Overridden', 'Disabled', 'UpgradeAvailable', 'Own', 'Retired')
|# cfg.InstallState names.
|$script:SIProFingerprintName = 'TemplateFingerprint'
|# #251 (operator decision 2026-10-04): kinds that WERE templates and are configuration now. Their cfg.Template rows are
|# retired by setup (never removed -- history) and count nowhere: not in the fingerprint, not in conformance, not in a pack.
|#   naming         the names of tables, DCRs, DCE and workspace are settings (cfg.Setting); the catalog default is the default
|#   cmdbownership  the CMDB ownership map is the customer's configuration (cfg.ItemOverride cmdbownership/map)
|$script:SIProFormerTemplateKinds = @('naming', 'cmdbownership')
|
|function Get-SIProConformanceStates { $script:SIProConformanceStates }
|function Get-SIProFormerTemplateKinds { $script:SIProFormerTemplateKinds }
|function Test-SIProFormerTemplateKind {
|    <# PURE. Is this kind one that was a template and is configuration now (#251)? #>
|    param([AllowEmptyString()][AllowNull()][string]$Kind)
|    $script:SIProFormerTemplateKinds -contains [string]$Kind
|}
|
|# =====================================================================================================================
|#  (a) NORMALISED CONTENT
|# =====================================================================================================================
|function Test-SIProDocOnlyKey {
|    <# PURE. Is this key documentation only? #>
|    param([AllowEmptyString()][string]$Key)
|    if ($Key.StartsWith('_')) { return $true }
|    $script:SIProDocOnlyKeys -contains $Key.ToLowerInvariant()
|}
|
|function ConvertTo-SIProContentValue {
|    <# PURE. A parsed value with every documentation-only key removed, at any depth (objects -> ordered dictionaries). #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [string] -or $Value -is [ValueType]) { return $Value }
|    $pairs = $null
|    if ($Value -is [System.Collections.IDictionary]) { $pairs = @(foreach ($k in $Value.get_Keys()) { , @([string]$k, $Value[$k]) }) }
|    elseif ($Value -is [System.Management.Automation.PSCustomObject]) { $pairs = @(foreach ($p in $Value.PSObject.Properties) { , @($p.Name, $p.Value) }) }
|    if ($null -ne $pairs) {
|        $o = [ordered]@{}
|        foreach ($p in $pairs) { if (-not (Test-SIProDocOnlyKey $p[0])) { $o[$p[0]] = ConvertTo-SIProContentValue $p[1] } }
|        return $o
|    }
|    if ($Value -is [System.Collections.IEnumerable]) {
|        $list = New-Object System.Collections.Generic.List[object]
|        foreach ($v in $Value) { $list.Add((ConvertTo-SIProContentValue $v)) }
|        return , $list.ToArray()
|    }
|    $Value
|}
|
|function ConvertFrom-SIProBody {
|    <# The parsed body (JSON or YAML) -- throws when it does not parse. #>
|    param([AllowEmptyString()][string]$Body, [string]$Format = 'json')
|    $t = ([string]$Body).TrimStart([char]0xFEFF)
|    if ($Format -eq 'yaml') {
|        # SecurityInsight's own YAML reader (no powershell-yaml module); -Ordered keeps key order like before.
|        if (-not (Get-Command -Name ConvertFrom-SIYaml -ErrorAction SilentlyContinue)) {
|            . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-Yaml.ps1'))
|        }
|        return (ConvertFrom-SIYaml -Yaml $t -Ordered)
|    }
|    ConvertFrom-SIProJson $t
|}
|
|function Get-SIProContentText {
|    <#
|        PURE. What an item DOES, as one canonical JSON text: parsed (JSON or YAML -- YAML comments are gone with the
|        parse), documentation-only keys dropped at every depth, object keys in ordinal order, compact. A body that does
|        not parse falls back to its text with line endings and trailing spaces normalised and comment lines removed --
|        so even then a comment edit is not a change.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Body, [string]$Format = 'json')
|    if ($null -eq $Body) { $Body = '' }
|    try { return (ConvertTo-SIProJson -Value (ConvertTo-SIProContentValue (ConvertFrom-SIProBody -Body $Body -Format $Format)) -Canonical) }
|    catch {
|        $t = $Body.TrimStart([char]0xFEFF) -replace "`r`n", "`n" -replace "`r", "`n"
|        return ((($t -split "`n") | ForEach-Object { $_.TrimEnd() } | Where-Object { $_ -notmatch '^\s*(#|//)' -and $_ -ne '' }) -join "`n").Trim()
|    }
|}
|
|function Get-SIProContentHash {
|    <# PURE. SHA-256 (hex) of the normalised content (Get-SIProContentText). #>
|    param([AllowEmptyString()][AllowNull()][string]$Body, [string]$Format = 'json')
|    Get-SIProTextHash (Get-SIProContentText -Body $Body -Format $Format)
|}
|
|function Get-SIProRowContentHash {
|    <# A template row's ContentHash: the stored one, else computed from its body (a row published before the column). #>
|    param($Row)
|    $h = [string](Get-SIProRowValue $Row 'ContentHash')
|    if ($h.Trim()) { return $h.Trim() }
|    $fmt = [string](Get-SIProRowValue $Row 'Format'); if (-not $fmt) { $fmt = 'json' }
|    Get-SIProContentHash -Body ([string](Get-SIProRowValue $Row 'BodyJson')) -Format $fmt
|}
|
|# =====================================================================================================================
|#  (b) WHAT CHANGED -- a structured diff of two normalised bodies
|# =====================================================================================================================
|function Get-SIProContentDiff {
|    <#
|        PURE. The differences between two bodies of one item, after normalisation, as a list of
|        @{ Path; Change = added | removed | changed; Old; New } -- Path like 'detections[0].set.Tier', Old / New as compact
|        JSON. Objects compare by key (ordinal), lists by position. Identical content = an empty list, however the two are
|        written. A body that does not parse is compared as a whole ('(body)').
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Old, [AllowEmptyString()][AllowNull()][string]$New, [string]$Format = 'json')
|    $out = New-Object System.Collections.Generic.List[object]
|    $parse = {
|        param([string]$b)
|        if ([string]::IsNullOrEmpty($b)) { return @{ Ok = $true; Value = $null } }
|        try { @{ Ok = $true; Value = (ConvertTo-SIProContentValue (ConvertFrom-SIProBody -Body $b -Format $Format)) } } catch { @{ Ok = $false; Value = $null } }
|    }
|    $a = & $parse $Old; $b = & $parse $New
|    if (-not $a.Ok -or -not $b.Ok) {
|        $x = Get-SIProContentText -Body $Old -Format $Format; $y = Get-SIProContentText -Body $New -Format $Format
|        if ($x -cne $y) { $out.Add([pscustomobject]@{ Path = '(body)'; Change = 'changed'; Old = $x; New = $y }) }
|        return $out.ToArray()
|    }
|    $json = { param($v) ConvertTo-SIProJson -Value $v -Canonical }
|    $isObj = { param($v) $v -is [System.Collections.IDictionary] }
|    $isList = { param($v) ($null -ne $v) -and ($v -is [System.Collections.IEnumerable]) -and ($v -isnot [string]) -and -not ($v -is [System.Collections.IDictionary]) }
|    $walk = $null
|    $walk = {
|        param([string]$path, $x, $y)
|        if ((& $isObj $x) -and (& $isObj $y)) {
|            $keys = New-Object System.Collections.Generic.List[string]
|            foreach ($k in $x.get_Keys()) { $keys.Add([string]$k) }
|            foreach ($k in $y.get_Keys()) { if (-not $keys.Contains([string]$k)) { $keys.Add([string]$k) } }
|            $ka = $keys.ToArray(); [Array]::Sort($ka, [System.StringComparer]::Ordinal)
|            foreach ($k in $ka) {
|                $p = if ($path) { '{0}.{1}' -f $path, $k } else { $k }
|                if (-not $x.Contains($k)) { $out.Add([pscustomobject]@{ Path = $p; Change = 'added'; Old = $null; New = (& $json $y[$k]) }); continue }
|                if (-not $y.Contains($k)) { $out.Add([pscustomobject]@{ Path = $p; Change = 'removed'; Old = (& $json $x[$k]); New = $null }); continue }
|                & $walk $p $x[$k] $y[$k]
|            }
|            return
|        }
|        if ((& $isList $x) -and (& $isList $y)) {
|            $xa = @($x); $ya = @($y)
|            $n = [Math]::Max($xa.Count, $ya.Count)
|            for ($i = 0; $i -lt $n; $i++) {
|                $p = '{0}[{1}]' -f $path, $i
|                if ($i -ge $xa.Count) { $out.Add([pscustomobject]@{ Path = $p; Change = 'added'; Old = $null; New = (& $json $ya[$i]) }); continue }
|                if ($i -ge $ya.Count) { $out.Add([pscustomobject]@{ Path = $p; Change = 'removed'; Old = (& $json $xa[$i]); New = $null }); continue }
|                & $walk $p $xa[$i] $ya[$i]
|            }
|            return
|        }
|        $jx = & $json $x; $jy = & $json $y
|        if ($jx -cne $jy) { $out.Add([pscustomobject]@{ Path = $(if ($path) { $path } else { '(value)' }); Change = 'changed'; Old = $jx; New = $jy }) }
|    }
|    & $walk '' $a.Value $b.Value
|    $out.ToArray()
|}
|
|# =====================================================================================================================
|#  (b2) ADDITIVE UPGRADE OF AN OVERRIDDEN ITEM (#529, adopted from PIM4EntraPS: "missing blocks / notification rules are
|#       added, existing values never touched")
|# =====================================================================================================================
|function ConvertTo-SIProMutableValue {
|    <# PURE. A parsed value as ordered dictionaries and ArrayLists (every key kept, documentation keys too), so additions can
|       be put into it. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [string] -or $Value -is [ValueType]) { return $Value }
|    $pairs = $null
|    if ($Value -is [System.Collections.IDictionary]) { $pairs = @(foreach ($k in $Value.get_Keys()) { , @([string]$k, $Value[$k]) }) }
|    elseif ($Value -is [System.Management.Automation.PSCustomObject]) { $pairs = @(foreach ($p in $Value.PSObject.Properties) { , @($p.Name, $p.Value) }) }
|    if ($null -ne $pairs) {
|        $o = [ordered]@{}
|        foreach ($p in $pairs) { $o[$p[0]] = ConvertTo-SIProMutableValue $p[1] }
|        return $o
|    }
|    if ($Value -is [System.Collections.IEnumerable]) {
|        $list = New-Object System.Collections.ArrayList
|        foreach ($v in $Value) { [void]$list.Add((ConvertTo-SIProMutableValue $v)) }
|        return , $list
|    }
|    $Value
|}
|
|function Get-SIProAdditiveMerge {
|    <#
|        PURE. Can the new shipped body of an item reach the customer's override WITHOUT touching anything the customer has?
|        -Base     the shipped body the override was made against (cfg.TemplateRevision at the override's BaseHash)
|        -Current  the shipped body now (cfg.Template)
|        -Override the customer's body (cfg.ItemOverride)
|        The vendor's change Base -> Current is compared after normalisation (documentation-only keys do not count). It is
|        ADDITIVE when it only adds: a new key in an object, new entries in a list (Base's entries all still there, in the
|        same order -- new ones may sit anywhere between them). Then every addition is put into the customer's body:
|          * a new key the customer's object does not have        -> added (Added)
|          * a new key the customer already has (their own value) -> theirs is kept, untouched (Kept)
|          * a new list entry the customer's list does not hold   -> appended to their list (Added)
|          * a new list entry the customer's list already holds   -> nothing to do (Kept)
|          * an addition whose place the customer removed (the parent object / list is gone or is another type) -> the
|            upgrade is NOT additive for this override: the customer reviews it (UpgradeAvailable), as before.
|        Anything the vendor CHANGED or REMOVED makes the upgrade not additive -- nothing is merged, the item stays
|        UpgradeAvailable. Only JSON items are merged (a YAML tier rule keeps its own text, comments and all).
|        Returns @{ Additive; Changed (the body differs from the override); Body (the merged JSON, or the override as it
|        was); Added; Kept (paths); Reason (why not additive, '' when it is) }.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Base, [AllowEmptyString()][AllowNull()][string]$Current,
|          [AllowEmptyString()][AllowNull()][string]$Override, [string]$Format = 'json')
|    $no = { param([string]$why) [pscustomobject]@{ Additive = $false; Changed = $false; Body = $Override; Added = @(); Kept = @(); Reason = $why } }
|    if ($Format -ne 'json') { return (& $no 'a YAML item is never merged automatically -- review the new version') }
|    if ([string]::IsNullOrWhiteSpace($Base)) { return (& $no 'the shipped version your change was made on is not known') }
|    try {
|        $bRaw = ConvertFrom-SIProJson $Base; $cRaw = ConvertFrom-SIProJson $Current; $oRaw = ConvertFrom-SIProJson $Override
|    } catch { return (& $no ('a body is not valid JSON: ' + $_.Exception.Message)) }
|    $st = @{ Fail = ''; Added = (New-Object System.Collections.Generic.List[string]); Kept = (New-Object System.Collections.Generic.List[string]) }
|    $canon = { param($v) ConvertTo-SIProJson -Value (ConvertTo-SIProContentValue $v) -Canonical }
|    $isObj = { param($v) $v -is [System.Collections.IDictionary] }
|    $isList = { param($v) ($null -ne $v) -and ($v -is [System.Collections.IEnumerable]) -and ($v -isnot [string]) -and -not ($v -is [System.Collections.IDictionary]) }
|    $b = ConvertTo-SIProContentValue $bRaw
|    $c = ConvertTo-SIProContentValue $cRaw
|    $cm = ConvertTo-SIProMutableValue $cRaw      # what is added: the shipped entry as shipped (its description too)
|    $o = ConvertTo-SIProMutableValue $oRaw
|    $walk = $null
|    $walk = {
|        # x = base (normalised), y = current (normalised), ym = current (mutable, every key), t = the customer's value here
|        # ($null when the customer has nothing here: then nothing below may be ADDED, only compared)
|        param([string]$path, $x, $y, $ym, $t, [bool]$hasT)
|        if ($st.Fail) { return }
|        $show = if ($path) { $path } else { '(item)' }
|        if ((& $isObj $x) -and (& $isObj $y)) {
|            foreach ($k in @($x.get_Keys())) {
|                if (-not $y.Contains($k)) { $st.Fail = ("'{0}' was removed from the shipped version" -f $(if ($path) { "$path.$k" } else { $k })); return }
|            }
|            $tObj = $hasT -and (& $isObj $t)
|            foreach ($k in @($y.get_Keys())) {
|                $p = if ($path) { '{0}.{1}' -f $path, $k } else { [string]$k }
|                $ymk = $ym[$k]
|                if ($x.Contains($k)) {
|                    $tk = $null; $has = $false
|                    if ($tObj -and $t.Contains($k)) { $tk = $t[$k]; $has = $true }
|                    & $walk $p $x[$k] $y[$k] $ymk $tk $has
|                    if ($st.Fail) { return }
|                    continue
|                }
|                # a key the vendor added
|                if (-not $tObj) { $st.Fail = ("the shipped version adds '{0}', but your version has no '{1}' to add it to" -f $p, $show); return }
|                if ($t.Contains($k)) { $st.Kept.Add($p) } else { $t[$k] = $ymk; $st.Added.Add($p) }
|            }
|            return
|        }
|        if ((& $isList $x) -and (& $isList $y)) {
|            $xa = @($x); $ya = @($y); $yma = @($ym)
|            $xc = @($xa | ForEach-Object { & $canon $_ }); $yc = @($ya | ForEach-Object { & $canon $_ })
|            # Base's entries, in order, inside Current: the rest of Current are the vendor's new entries
|            $j = 0; $new = New-Object System.Collections.Generic.List[int]
|            for ($i = 0; $i -lt $ya.Count; $i++) { if ($j -lt $xa.Count -and $yc[$i] -ceq $xc[$j]) { $j++ } else { $new.Add($i) } }
|            if ($j -eq $xa.Count) {
|                if ($new.Count -eq 0) { return }
|                if (-not ($hasT -and (& $isList $t))) { $st.Fail = ("the shipped version adds entries to '{0}', but your version has no list there" -f $show); return }
|                $tc = New-Object System.Collections.Generic.List[string]; foreach ($e in $t) { $tc.Add((& $canon $e)) }
|                foreach ($i in $new) {
|                    $p = '{0}[{1}]' -f $path, $i
|                    if ($tc.Contains($yc[$i])) { $st.Kept.Add($p) } else { [void]$t.Add($yma[$i]); $tc.Add($yc[$i]); $st.Added.Add($p) }
|                }
|                return
|            }
|            # the same entries, changed inside: only additions inside each entry are allowed, and only when the customer's
|            # list still lines up with the shipped one (same length) -- else the entry cannot be found safely
|            if ($xa.Count -ne $ya.Count) { $st.Fail = ("entries of '{0}' were changed or removed in the shipped version" -f $show); return }
|            $tList = $hasT -and (& $isList $t) -and (@($t).Count -eq $xa.Count)
|            for ($i = 0; $i -lt $xa.Count; $i++) {
|                if ($xc[$i] -ceq $yc[$i]) { continue }
|                if (-not $tList) { $st.Fail = ("an entry of '{0}' changed in the shipped version and your list does not line up with it" -f $show); return }
|                & $walk ('{0}[{1}]' -f $path, $i) $xa[$i] $ya[$i] $yma[$i] $t[$i] $true
|                if ($st.Fail) { return }
|            }
|            return
|        }
|        if ((& $canon $x) -cne (& $canon $y)) { $st.Fail = ("'{0}' changed in the shipped version" -f $show) }
|    }
|    & $walk '' $b $c $cm $o $true
|    if ($st.Fail) { return (& $no $st.Fail) }
|    $added = $st.Added.ToArray(); $kept = $st.Kept.ToArray()
|    $body = if ($added.Count) { ConvertTo-SIProJson -Value $o } else { $Override }
|    [pscustomobject]@{ Additive = $true; Changed = ($added.Count -gt 0); Body = $body; Added = $added; Kept = $kept; Reason = '' }
|}
|
|function Get-SIProRevisionIndex {
|    <# PURE. cfg.TemplateRevision rows indexed by '<kind>/<key>#<hash>' -- by their ContentHash AND by the SHA-256 of their
|       body (an override made before content hashes recorded the raw BodyHash as its base). #>
|    param([AllowEmptyCollection()][object[]]$Revisions = @())
|    $rev = @{}
|    foreach ($r in @($Revisions | Where-Object { $_ })) {
|        $n = '{0}/{1}' -f (Get-SIProRowValue $r 'Kind'), (Get-SIProRowValue $r 'ItemKey')
|        $ch = ([string](Get-SIProRowValue $r 'ContentHash')).Trim()
|        if ($ch) { $rev[('{0}#{1}' -f $n, $ch)] = $r }
|        $bh = Get-SIProTextHash ([string](Get-SIProRowValue $r 'BodyJson'))
|        if (-not $rev.ContainsKey(('{0}#{1}' -f $n, $bh))) { $rev[('{0}#{1}' -f $n, $bh)] = $r }
|    }
|    $rev
|}
|
|function Read-SIProOverrideBaseRevisions {
|    <# The cfg.TemplateRevision rows of the items whose override is behind the shipped content -- the bodies an additive
|       upgrade compares (only those, never every revision). Empty without the versioning schema. #>
|    param([Parameter(Mandatory)]$Store)
|    $inner = "SELECT r.Kind, r.ItemKey, r.ContentHash, r.[Version] AS TemplateVersion, r.BodyJson, r.Format FROM cfg.TemplateRevision r JOIN cfg.ItemOverride o ON o.Kind = r.Kind AND o.ItemKey = r.ItemKey JOIN cfg.Template t ON t.Kind = o.Kind AND t.ItemKey = o.ItemKey WHERE o.State = N''override'' AND o.BaseHash IS NOT NULL AND o.BaseHash <> COALESCE(t.ContentHash, N'''') AND o.BaseHash <> t.BodyHash"
|    $sql = "IF OBJECT_ID('cfg.TemplateRevision') IS NOT NULL AND OBJECT_ID('cfg.ItemOverride') IS NOT NULL AND COL_LENGTH('cfg.Template', 'ContentHash') IS NOT NULL EXEC (N'$inner')"
|    & $Store.Invoke $sql @{} 'reader' | ForEach-Object { $_ }
|}
|
|# =====================================================================================================================
|#  (c) THE TEMPLATE-SET FINGERPRINT AND THE GATE
|# =====================================================================================================================
|function Get-SIProTemplateSetFingerprint {
|    <#
|        PURE. ONE hash for the whole set of templates in force: SHA-256 over '<kind>/<key>=<ContentHash>' of every live
|        (not retired) row, ordinal order, newline-joined. '' for an empty set. Only CONTENT counts: a comment, a version
|        stamp, a sort order or a source path does not move it.
|        #251: rows of a former template kind (naming, cmdbownership) do not count -- they are configuration now. -AllKinds
|        counts them as the fingerprint did before (to recognise a fingerprint recorded under the old definition).
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [switch]$AllKinds)
|    $lines = New-Object System.Collections.Generic.List[string]
|    foreach ($r in @($Rows | Where-Object { $_ })) {
|        if ($null -ne (Get-SIProRowValue $r 'RetiredAt')) { continue }
|        if (-not $AllKinds -and (Test-SIProFormerTemplateKind ([string](Get-SIProRowValue $r 'Kind')))) { continue }
|        $lines.Add(('{0}/{1}={2}' -f (Get-SIProRowValue $r 'Kind'), (Get-SIProRowValue $r 'ItemKey'), (Get-SIProRowContentHash $r)))
|    }
|    if ($lines.Count -eq 0) { return '' }
|    $a = $lines.ToArray(); [Array]::Sort($a, [System.StringComparer]::Ordinal)
|    Get-SIProTextHash ($a -join "`n")
|}
|
|function Get-SIProPlannedTemplateSet {
|    <#
|        PURE. The live template set AFTER a publish plan is applied to -Existing: existing rows the plan does not touch,
|        plus every inserted / updated / revived / unchanged row, minus the retired ones. What the fingerprint gate
|        compares with the recorded fingerprint, and what the verification after the write must read back.
|    #>
|    param([AllowEmptyCollection()][object[]]$Existing = @(), [AllowEmptyCollection()][object[]]$Plan = @())
|    $set = [ordered]@{}
|    foreach ($e in @($Existing | Where-Object { $_ })) {
|        if ($null -ne (Get-SIProRowValue $e 'RetiredAt')) { continue }
|        $set[('{0}/{1}' -f (Get-SIProRowValue $e 'Kind'), (Get-SIProRowValue $e 'ItemKey'))] = $e
|    }
|    foreach ($p in @($Plan | Where-Object { $_ })) {
|        $name = '{0}/{1}' -f $p.Kind, $p.ItemKey
|        if ($p.Action -eq 'retire') { if ($set.Contains($name)) { $set.Remove($name) }; continue }
|        if ($p.Row) { $set[$name] = $p.Row }
|    }
|    @($set.Values)
|}
|
|function Get-SIProTemplateChanges {
|    <#
|        PURE. The items whose CONTENT a publish plan changes (what the operator accepts with -AcceptTemplateChange):
|        new, retired, revived, and updated with a different ContentHash. A body edit that only touched comments or
|        descriptions is not listed.
|    #>
|    param([AllowEmptyCollection()][object[]]$Existing = @(), [AllowEmptyCollection()][object[]]$Plan = @())
|    $have = @{}; foreach ($e in @($Existing | Where-Object { $_ })) { $have[('{0}/{1}' -f (Get-SIProRowValue $e 'Kind'), (Get-SIProRowValue $e 'ItemKey'))] = $e }
|    foreach ($p in @($Plan | Where-Object { $_ })) {
|        $name = '{0}/{1}' -f $p.Kind, $p.ItemKey
|        switch ($p.Action) {
|            'insert' { [pscustomobject]@{ Name = $name; Change = 'new'; Kind = $p.Kind; ItemKey = $p.ItemKey } }
|            'retire' { [pscustomobject]@{ Name = $name; Change = 'retired'; Kind = $p.Kind; ItemKey = $p.ItemKey } }
|            'revive' { [pscustomobject]@{ Name = $name; Change = 'revived'; Kind = $p.Kind; ItemKey = $p.ItemKey } }
|            'update' {
|                $e = $have[$name]
|                if (-not $e -or (Get-SIProRowContentHash $e) -ne (Get-SIProRowContentHash $p.Row)) { [pscustomobject]@{ Name = $name; Change = 'changed'; Kind = $p.Kind; ItemKey = $p.ItemKey } }
|            }
|        }
|    }
|}
|
|function Get-SIProTemplateUpgrades {
|    <#
|        PURE. #529 (3) -- the items a publish plan UPGRADES in place: a live template whose content changes, and which the
|        customer follows (no override row, or 'inherit'). One @{ Name; Kind; ItemKey; FromVersion; ToVersion; FromHash;
|        ToHash } each. Invoke-SITemplatePublish writes the same rule as SQL (an "upgraded" cfg.ChangeLog row per item, Scope
|        'item', in the publish transaction); this is what a plan prints and what the tests hold the writer to.
|        An overridden or switched-off item is not listed: it does not follow the template (conformance says what it does).
|    #>
|    param([AllowEmptyCollection()][object[]]$Existing = @(), [AllowEmptyCollection()][object[]]$Plan = @(), [AllowEmptyCollection()][object[]]$Overrides = @())
|    $have = @{}; foreach ($e in @($Existing | Where-Object { $_ })) { $have[('{0}/{1}' -f (Get-SIProRowValue $e 'Kind'), (Get-SIProRowValue $e 'ItemKey'))] = $e }
|    $own = @{}; foreach ($o in @($Overrides | Where-Object { $_ })) { if ([string](Get-SIProRowValue $o 'State') -in 'override', 'disable') { $own[('{0}/{1}' -f (Get-SIProRowValue $o 'Kind'), (Get-SIProRowValue $o 'ItemKey'))] = $true } }
|    foreach ($p in @($Plan | Where-Object { $_ -and $_.Action -eq 'update' -and $_.Row })) {
|        $name = '{0}/{1}' -f $p.Kind, $p.ItemKey
|        $e = $have[$name]
|        if (-not $e -or $null -ne (Get-SIProRowValue $e 'RetiredAt') -or $own.ContainsKey($name)) { continue }
|        $from = ([string](Get-SIProRowValue $e 'ContentHash')).Trim()
|        if (-not $from) { continue }   # published before content hashes: nothing to compare (the writer skips it too)
|        $to = Get-SIProRowContentHash $p.Row
|        if ($from -eq $to) { continue }
|        [pscustomobject]@{ Name = $name; Kind = $p.Kind; ItemKey = $p.ItemKey
|            FromVersion = [string](Get-SIProRowValue $e 'TemplateVersion'); ToVersion = [string](Get-SIProRowValue $p.Row 'TemplateVersion'); FromHash = $from; ToHash = $to }
|    }
|}
|
|function Get-SIProTemplateGateDecision {
|    <#
|        PURE. May a publish whose result is -Expected go ahead on an install that recorded -Recorded?
|          Initial   nothing recorded and no templates yet -- the first publish of an install; allowed.
|          Same      the content in force does not change; allowed (a comment-only refresh writes without acceptance).
|          Moved     the content changes: allowed only with -Accept, and when -AcceptFingerprint is given only for
|                    exactly that fingerprint (an acceptance names WHAT it accepts -- never a standing blank cheque).
|        -Current: the fingerprint of the templates in the database now; it stands in for -Recorded on an install that
|        published before the fingerprint was recorded.
|    #>
|    param([AllowEmptyString()][string]$Recorded, [AllowEmptyString()][string]$Current, [AllowEmptyString()][string]$Expected,
|          [switch]$Accept, [AllowEmptyString()][string]$AcceptFingerprint)
|    $base = if ($Recorded) { $Recorded } else { $Current }
|    $short = { param($f) if ($f) { $f.Substring(0, [Math]::Min(12, $f.Length)) } else { '(none)' } }
|    if (-not $base) {
|        return [pscustomobject]@{ Allowed = $true; Moved = $false; Initial = $true; Baseline = ''; Expected = $Expected
|            Reason = ('first publish on this install -- the template fingerprint {0} becomes the baseline' -f (& $short $Expected)) }
|    }
|    if ($base -eq $Expected) {
|        return [pscustomobject]@{ Allowed = $true; Moved = $false; Initial = $false; Baseline = $base; Expected = $Expected
|            Reason = ('the templates in force do not change (fingerprint {0})' -f (& $short $Expected)) }
|    }
|    $note = if ($Recorded) { 'recorded' } else { 'in the database (nothing recorded yet)' }
|    if (-not $Accept) {
|        return [pscustomobject]@{ Allowed = $false; Moved = $true; Initial = $false; Baseline = $base; Expected = $Expected
|            Reason = ('the templates in force would change: fingerprint {0} {1} -> {2}. Nothing is written without -AcceptTemplateChange.' -f (& $short $base), $note, (& $short $Expected)) }
|    }
|    if ($AcceptFingerprint -and $AcceptFingerprint.Length -ge 12 -and $Expected.StartsWith($AcceptFingerprint, [StringComparison]::OrdinalIgnoreCase)) {
|        return [pscustomobject]@{ Allowed = $true; Moved = $true; Initial = $false; Baseline = $base; Expected = $Expected
|            Reason = ('template change accepted for fingerprint {0}' -f (& $short $Expected)) }
|    }
|    if ($AcceptFingerprint) {
|        return [pscustomobject]@{ Allowed = $false; Moved = $true; Initial = $false; Baseline = $base; Expected = $Expected
|            Reason = ('the acceptance names fingerprint {0}, but this publish would put {1} in force -- review the new plan and accept that one' -f (& $short $AcceptFingerprint), (& $short $Expected)) }
|    }
|    [pscustomobject]@{ Allowed = $true; Moved = $true; Initial = $false; Baseline = $base; Expected = $Expected
|        Reason = ('template change accepted: fingerprint {0} -> {1}' -f (& $short $base), (& $short $Expected)) }
|}
|
|# =====================================================================================================================
|#  (d) THE ACTOR IS THE SESSION
|# =====================================================================================================================
|function Get-SIProSessionActor {
|    <#
|        The identity this process runs as -- what cfg.ChangeLog records for a publish, an acceptance or an
|        acknowledgement. Never taken from a parameter, a file or a request: the record names who really acted. In a container: the managed identity (its client id when the platform says) or the
|        engine application; on Windows: the signed-in Windows account; elsewhere: the operating-system user.
|    #>
|    if ($global:SI_UseManagedIdentity) {
|        $cid = [Environment]::GetEnvironmentVariable('AZURE_CLIENT_ID')
|        if ($cid) { return ('managed identity {0}' -f $cid) }
|        return 'managed identity'
|    }
|    try {
|        if ([System.Environment]::OSVersion.Platform -eq [System.PlatformID]::Win32NT) {
|            $w = [System.Security.Principal.WindowsIdentity]::GetCurrent()
|            if ($w -and $w.Name) { return $w.Name }
|        }
|    } catch { }
|    [System.Environment]::UserName
|}
|
|# =====================================================================================================================
|#  (e) CONFORMANCE -- per item and per install
|# =====================================================================================================================
|function Get-SIProConformanceState {
|    <#
|        PURE. One item's state:
|          Own               the customer's item -- no template (or a retired template the customer still overrides)
|          Retired           the template is retired and the customer does not override it (the item is not applied)
|          Disabled          the customer switched the template item off
|          UpToDate          no override (or 'inherit') -- the template as published
|          Overridden        the customer's own body, made against the CURRENT template content
|          UpgradeAvailable  the customer's own body, made against an OLDER template content (or before the vendor
|                            shipped one) -- review what changed, then take the template or keep yours
|        BaseHash may be the ContentHash (from now on) or the raw BodyHash (overrides made before content hashes).
|    #>
|    param([bool]$HasTemplate, [bool]$Retired, [AllowEmptyString()][string]$State, [AllowEmptyString()][string]$BaseHash,
|          [AllowEmptyString()][string]$ContentHash, [AllowEmptyString()][string]$BodyHash)
|    if (-not $HasTemplate) { return 'Own' }
|    if ($Retired) { if ($State -eq 'override') { return 'Own' } else { return 'Retired' } }
|    if ($State -eq 'disable') { return 'Disabled' }
|    if ($State -ne 'override') { return 'UpToDate' }
|    $b = ([string]$BaseHash).Trim()
|    if ($b -and ($b -eq ([string]$ContentHash).Trim() -or $b -eq ([string]$BodyHash).Trim())) { return 'Overridden' }
|    'UpgradeAvailable'
|}
|
|function Get-SIProConformance {
|    <#
|        PURE. The conformance view. -Templates (cfg.Template rows), -Overrides (cfg.ItemOverride rows), -Revisions
|        (cfg.TemplateRevision rows: the template body each BaseHash was made against), -Recorded (the install's recorded
|        fingerprint). Returns @{ Items; Summary }:
|          Items    one per item: Kind, ItemKey, State, TemplateVersion, BaseVersion, ContentHash, BaseHash, and for
|                   UpgradeAvailable: TemplateChanges (base template -> current template) and YourChanges (current
|                   template -> your body), each a Get-SIProContentDiff list; BaseKnown says whether the base body was
|                   found (an override made before revisions were kept has none -- then only YourChanges is shown).
|          Summary  the per-install view: Counts per state (every state present, 0 when none), Total, UpgradeAvailable,
|                   Conformant (no upgrade waiting), Fingerprint (of the templates in force) and Recorded.
|    #>
|    param([AllowEmptyCollection()][object[]]$Templates = @(), [AllowEmptyCollection()][object[]]$Overrides = @(),
|          [AllowEmptyCollection()][object[]]$Revisions = @(), [AllowEmptyString()][string]$Recorded, [switch]$NoDiff)
|    # #251: naming and CMDB ownership are configuration, not templates -- they are not part of the conformance view.
|    $Templates = @($Templates | Where-Object { $_ -and -not (Test-SIProFormerTemplateKind ([string](Get-SIProRowValue $_ 'Kind'))) })
|    $Overrides = @($Overrides | Where-Object { $_ -and -not (Test-SIProFormerTemplateKind ([string](Get-SIProRowValue $_ 'Kind'))) })
|    $tpl = @{}; foreach ($t in @($Templates | Where-Object { $_ })) { $tpl[('{0}/{1}' -f (Get-SIProRowValue $t 'Kind'), (Get-SIProRowValue $t 'ItemKey'))] = $t }
|    $ovr = @{}; foreach ($o in @($Overrides | Where-Object { $_ })) { $ovr[('{0}/{1}' -f (Get-SIProRowValue $o 'Kind'), (Get-SIProRowValue $o 'ItemKey'))] = $o }
|    # #529: by ContentHash and by the raw body hash (an override made before content hashes recorded the BodyHash)
|    $rev = Get-SIProRevisionIndex -Revisions @($Revisions)
|    $names = New-Object System.Collections.Generic.List[string]
|    foreach ($k in $tpl.Keys) { $names.Add($k) }
|    foreach ($k in $ovr.Keys) { if (-not $tpl.ContainsKey($k)) { $names.Add($k) } }
|    $na = $names.ToArray(); [Array]::Sort($na, [System.StringComparer]::Ordinal)
|    $counts = [ordered]@{}; foreach ($s in $script:SIProConformanceStates) { $counts[$s] = 0 }
|    $items = foreach ($name in $na) {
|        $t = $tpl[$name]; $o = $ovr[$name]
|        $row = if ($t) { $t } else { $o }
|        $kind = [string](Get-SIProRowValue $row 'Kind'); $key = [string](Get-SIProRowValue $row 'ItemKey')
|        $fmt = [string](Get-SIProRowValue $row 'Format'); if (-not $fmt) { $fmt = 'json' }
|        $ch = if ($t) { Get-SIProRowContentHash $t } else { '' }
|        $bh = if ($t) { ([string](Get-SIProRowValue $t 'BodyHash')).Trim() } else { '' }
|        $st = if ($o) { [string](Get-SIProRowValue $o 'State') } else { '' }
|        $base = if ($o) { ([string](Get-SIProRowValue $o 'BaseHash')).Trim() } else { '' }
|        $state = Get-SIProConformanceState -HasTemplate ([bool]$t) -Retired ([bool]($t -and $null -ne (Get-SIProRowValue $t 'RetiredAt'))) -State $st -BaseHash $base -ContentHash $ch -BodyHash $bh
|        # #529 (1): an override behind a shipped version that only ADDS is merged at run start (Merge-SIProItems) -- it reads
|        # "Overridden -- new shipped additions applied", not "upgrade available". Anything changed or removed stays as before.
|        $addApplied = $false; $additions = @(); $notAdditive = ''
|        $b = if ($state -eq 'UpgradeAvailable' -and $base) { $rev[('{0}#{1}' -f $name, $base)] } else { $null }
|        if ($state -eq 'UpgradeAvailable') {
|            if ($b) {
|                $am = Get-SIProAdditiveMerge -Base ([string](Get-SIProRowValue $b 'BodyJson')) -Current ([string](Get-SIProRowValue $t 'BodyJson')) -Override ([string](Get-SIProRowValue $o 'BodyJson')) -Format $fmt
|                if ($am.Additive) { $state = 'Overridden'; $addApplied = $true; $additions = @($am.Added) } else { $notAdditive = $am.Reason }
|            } else { $notAdditive = 'the shipped version your change was made on is not known' }
|        }
|        $counts[$state]++
|        $tc = @(); $yc = @(); $known = $false
|        if ($state -eq 'UpgradeAvailable' -and -not $NoDiff) {
|            $cur = [string](Get-SIProRowValue $t 'BodyJson')
|            if ($b) { $known = $true; $tc = @(Get-SIProContentDiff -Old ([string](Get-SIProRowValue $b 'BodyJson')) -New $cur -Format $fmt) }
|            $yc = @(Get-SIProContentDiff -Old $cur -New ([string](Get-SIProRowValue $o 'BodyJson')) -Format $fmt)
|        }
|        [pscustomobject]@{ Kind = $kind; ItemKey = $key; Name = $name; State = $state; Format = $fmt
|            TemplateVersion = $(if ($t) { [string](Get-SIProRowValue $t 'TemplateVersion') } else { '' })
|            BaseVersion = $(if ($o) { [string](Get-SIProRowValue $o 'BaseVersion') } else { '' })
|            ContentHash = $ch; BaseHash = $base; BaseKnown = $known; TemplateChanges = $tc; YourChanges = $yc
|            AdditionsApplied = $addApplied; Additions = $additions; NotAdditiveReason = $notAdditive
|            StateText = $(if ($addApplied) { 'Overridden -- new shipped additions applied' } else { $state }) }
|    }
|    $items = @($items)
|    $fp = Get-SIProTemplateSetFingerprint -Rows @($Templates)
|    [pscustomobject]@{ Items = $items
|        Summary = [pscustomobject]@{ Counts = [pscustomobject]$counts; Total = $items.Count; UpgradeAvailable = $counts['UpgradeAvailable']
|            Conformant = ($counts['UpgradeAvailable'] -eq 0); Fingerprint = $fp; Recorded = [string]$Recorded
|            FingerprintMatches = (-not $Recorded -or $Recorded -eq $fp) } }
|}
|
|# =====================================================================================================================
|#  STORE: readers and writers (guarded -- a database without the versioning schema answers "not ready")
|# =====================================================================================================================
|function Test-SIProVersioningSchema {
|    <# What the template-versioning schema still lacks (empty = ready): the ContentHash column, cfg.TemplateRevision,
|       cfg.InstallState. #>
|    param([Parameter(Mandatory)]$Store)
|    $sql = "SELECT CASE WHEN COL_LENGTH('cfg.Template', 'ContentHash') IS NULL THEN 0 ELSE 1 END AS HasContentHash, CASE WHEN OBJECT_ID('cfg.TemplateRevision') IS NULL THEN 0 ELSE 1 END AS HasRevision, CASE WHEN OBJECT_ID('cfg.InstallState') IS NULL THEN 0 ELSE 1 END AS HasInstallState"
|    $r = @(& $Store.Invoke $sql @{} 'reader' | ForEach-Object { $_ }) | Select-Object -First 1
|    $missing = New-Object System.Collections.Generic.List[string]
|    if (-not $r -or [int](Get-SIProRowValue $r 'HasContentHash') -ne 1) { $missing.Add('cfg.Template.ContentHash') }
|    if (-not $r -or [int](Get-SIProRowValue $r 'HasRevision') -ne 1) { $missing.Add('cfg.TemplateRevision') }
|    if (-not $r -or [int](Get-SIProRowValue $r 'HasInstallState') -ne 1) { $missing.Add('cfg.InstallState') }
|    $missing.ToArray()
|}
|
|function Read-SIProInstallState {
|    <# One cfg.InstallState row (@{ Value; Version; UpdatedAt; UpdatedBy }), or $null (no row, or no table). #>
|    param([Parameter(Mandatory)]$Store, [string]$Name = $script:SIProFingerprintName)
|    $rows = @(& $Store.Invoke "IF OBJECT_ID('cfg.InstallState') IS NOT NULL SELECT Name, Value, [Version], UpdatedAt, UpdatedBy FROM cfg.InstallState WHERE Name = @Name" @{ Name = $Name } 'reader' | ForEach-Object { $_ })
|    if ($rows.Count) { return $rows[0] }
|    $null
|}
|
|function Read-SIProTemplateRevisions {
|    <# cfg.TemplateRevision rows (empty without the table). #>
|    param([Parameter(Mandatory)]$Store)
|    & $Store.Invoke "IF OBJECT_ID('cfg.TemplateRevision') IS NOT NULL SELECT Kind, ItemKey, ContentHash, [Version] AS TemplateVersion, BodyJson, Format FROM cfg.TemplateRevision" @{} 'reader' | ForEach-Object { $_ }
|}
|
|function Set-SIProTemplateFingerprint {
|    <#
|        Record the template-set fingerprint on the install, with its cfg.ChangeLog row, in one transaction. Called ONLY
|        after a publish was read back and verified (Publish-SITemplates). The actor is the session (Get-SIProSessionActor).
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][AllowEmptyString()][string]$Fingerprint, [string]$Version, [string]$Reason = '')
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @old nvarchar(400) = (SELECT Value FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @Name);
|IF @old IS NULL AND NOT EXISTS (SELECT 1 FROM cfg.InstallState WHERE Name = @Name)
|    INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@Name, @Value, @Version, @By);
|ELSE
|    UPDATE cfg.InstallState SET Value = @Value, [Version] = @Version, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @Name;
|INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (@Name, 'install', 'install', 'Set', @old, CONCAT(@Version, ':', @Value), @By, @Reason);
|COMMIT;
|'@
|    & $Store.Invoke $sql ([ordered]@{ Name = $script:SIProFingerprintName; Value = $Fingerprint; Version = $(if ($Version) { $Version } else { $null }); By = (Get-SIProSessionActor); Reason = $Reason }) 'nonquery'
|}
|
|function Get-SIProStoreConformance {
|    <# The conformance view read from the database (templates, overrides, revisions, the recorded fingerprint). #>
|    param([Parameter(Mandatory)]$Store, [switch]$NoDiff)
|    $rec = Read-SIProInstallState -Store $Store
|    Get-SIProConformance -Templates @(Read-SIProTemplates -Store $Store) -Overrides @(Read-SIProItemOverrides -Store $Store) `
|        -Revisions @(Read-SIProTemplateRevisions -Store $Store) -Recorded $(if ($rec) { [string](Get-SIProRowValue $rec 'Value') } else { '' }) -NoDiff:$NoDiff
|}
|
|function Approve-SIProTemplateUpgrade {
|    <#
|        Resolve "upgrade available" for one item -- the PowerShell twin of the web page's two buttons:
|          -Action Take   take the new template: the override goes back to inherit (the row is removed), as Set-SIProItem
|          -Action Keep   keep mine and acknowledge: the override's BaseHash / BaseVersion move to the CURRENT template,
|                         so it reads Overridden again; the body is not touched
|        Each with its cfg.ChangeLog row in one transaction. The actor is the SESSION (Get-SIProSessionActor) -- there is
|        deliberately no -ChangedBy. -ExpectedContentHash: the template content the decision was made on; when the
|        template moved since, nothing is written.
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Kind, [Parameter(Mandatory)][string]$Key,
|          [Parameter(Mandatory)][ValidateSet('Take', 'Keep')][string]$Action, [string]$Reason = '', [string]$ExpectedContentHash)
|    $spec = $script:SIProItemKinds[$Kind]
|    if (-not $spec -or -not $spec.Templated) { throw ("'{0}' is not a templated configuration kind" -f $Kind) }
|    if ($Key -notmatch $spec.Key) { throw ("'{0}' is not a valid {1} key" -f $Key, $Kind) }
|    $by = Get-SIProSessionActor
|    if ($Action -eq 'Take') {
|        Set-SIProItem -Store $Store -Kind $Kind -Key $Key -State inherit -ChangedBy $by -Reason $(if ($Reason) { $Reason } else { 'took the new template' })
|        return [pscustomobject]@{ Kind = $Kind; Key = $Key; Action = 'Take'; Outcome = 'Saved'; By = $by }
|    }
|    $missing = @(Test-SIProVersioningSchema -Store $Store)
|    if ($missing.Count) { throw ('nothing written: the Pro database lacks {0} -- run setup\Publish-SITemplates.ps1 -Apply -CreateSchema first' -f ($missing -join ', ')) }
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @state nvarchar(16), @oldHash char(64), @newHash char(64), @newVersion nvarchar(32);
|SELECT @state = State, @oldHash = BaseHash FROM cfg.ItemOverride WITH (UPDLOCK, HOLDLOCK) WHERE Kind = @Kind AND ItemKey = @Key;
|SELECT @newHash = ContentHash, @newVersion = [Version] FROM cfg.Template WHERE Kind = @Kind AND ItemKey = @Key AND RetiredAt IS NULL;
|IF @state IS NULL OR @state <> 'override' BEGIN ROLLBACK; SELECT 'NotOverridden' AS Outcome; RETURN; END;
|IF @newHash IS NULL BEGIN ROLLBACK; SELECT 'NoTemplate' AS Outcome; RETURN; END;
|IF @Expected IS NOT NULL AND @newHash <> @Expected BEGIN ROLLBACK; SELECT 'Stale' AS Outcome; RETURN; END;
|UPDATE cfg.ItemOverride SET BaseHash = @newHash, BaseVersion = @newVersion, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Kind = @Kind AND ItemKey = @Key;
|INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (@Key, 'item', @Kind, 'Set', CONCAT('base:', COALESCE(@oldHash, '(none)')), CONCAT('base:', @newHash, ' (', @newVersion, ')'), @By, @Reason);
|COMMIT;
|SELECT 'Saved' AS Outcome;
|'@
|    $rows = @(& $Store.Invoke $sql ([ordered]@{ Kind = $Kind; Key = $Key; Expected = $(if ($ExpectedContentHash) { $ExpectedContentHash } else { $null }); By = $by
|        Reason = $(if ($Reason) { $Reason } else { 'kept my version; acknowledged the new template' }) }) 'reader' | ForEach-Object { $_ })
|    $outcome = if ($rows.Count) { [string](Get-SIProRowValue $rows[0] 'Outcome') } else { '' }
|    [pscustomobject]@{ Kind = $Kind; Key = $Key; Action = 'Keep'; Outcome = $outcome; By = $by }
|}
'@ }
$__siSupportFiles['engine/pro-settings/SI-TemplateMandatory.ps1'] = @{ Sha256 = '3ca199d35b830963959c2b1a5c92d4da682508f0099933eb233b9a371907a069'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- MANDATORY CONTROLS ON TOP OF TEMPLATES (adopted from PIM4EntraPS: engine-enforced defaults applied
|    on top of every policy template, whatever the customer's copy says).
|
|    Some parts of a shipped template item are REQUIRED by SecurityInsight's own code -- a risk factor the scoring needs, a
|    collection scope without which an engine has nothing to read. A customer may override the item, but never switch such a
|    part off or weaken it:
|      * the web app's validators (MandatoryControls.cs) and Set-SIProItem refuse such an override with a plain reason;
|      * the run (Merge-SIProItems) applies the mandatory value ON TOP of whatever is stored -- an override written before the
|        control existed, or by a path that skipped the validator, cannot switch it off either. Each correction is a note.
|
|    The set is data, config\template-mandatory.locked.json (linked next to the web app as catalog\template-mandatory.locked.json),
|    and it is a CODE contract: an entry exists only because code in this release depends on it (the entry names that code).
|    One control:
|      Kind, ItemKey   the template item ('<kind>/<key>' as in cfg.Template)
|      Rule            present  -- the item may not be switched off (State 'disable'); the shipped item applies
|                      equals   -- the value at Path must be Value
|                      atLeast  -- the number at Path must be >= Value
|                      above    -- the number at Path must be > Value; the run applies Default when it is not
|                      contains -- the list at Path must hold every entry of Value (a list)
|      Path            dot-separated object keys inside the JSON body ('' for 'present')
|      Value           the required value (the bound, for atLeast / above)
|      Default         (above only) the value the run applies when the customer's is not above the bound
|      Reason          one plain sentence a person reads when an override is refused
|    A switched-off item counts as every part of it switched off: an item with ANY control can not be disabled.
|
|    PURE except Get-SIProMandatoryControls (reads one shipped file). PowerShell 5.1 safe.
|#>
|
|$script:SIProMandatoryRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|$script:SIProMandatoryRules = @('present', 'equals', 'atLeast', 'above', 'contains')
|$script:SIProMandatoryCache = @{}
|
|function Get-SIProMandatoryRules { $script:SIProMandatoryRules }
|
|function ConvertFrom-SIProMandatoryCatalog {
|    <# PURE. The catalog text -> its controls. Throws on a malformed catalog (it ships with the code: a test reads it). #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text)
|    if ([string]::IsNullOrWhiteSpace($Text)) { return @() }
|    $doc = ConvertFrom-Json -InputObject $Text
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($c in @($doc.Controls)) {
|        if ($null -eq $c) { continue }
|        $rule = [string]$c.Rule
|        if ($script:SIProMandatoryRules -cnotcontains $rule) { throw ("template-mandatory: '{0}' is not a rule ({1})" -f $rule, ($script:SIProMandatoryRules -join ', ')) }
|        $kind = [string]$c.Kind; $key = [string]$c.ItemKey
|        if (-not $kind -or -not $key) { throw 'template-mandatory: every control names its Kind and ItemKey' }
|        $path = if ($c.PSObject.Properties['Path']) { [string]$c.Path } else { '' }
|        if ($rule -ne 'present' -and -not $path) { throw ("template-mandatory: {0}/{1} -- rule '{2}' needs a Path" -f $kind, $key, $rule) }
|        $val = if ($c.PSObject.Properties['Value']) { $c.Value } else { $null }
|        $num = { param($x) $d = 0.0; ($null -ne $x) -and ($x -isnot [bool]) -and [double]::TryParse([string]::Format([System.Globalization.CultureInfo]::InvariantCulture, '{0}', $x), [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d) }
|        if ($rule -in 'atLeast', 'above' -and -not (& $num $val)) { throw ("template-mandatory: {0}/{1} -- {2} needs a number" -f $kind, $key, $rule) }
|        $def = if ($c.PSObject.Properties['Default']) { $c.Default } else { $null }
|        if ($rule -eq 'above' -and -not ((& $num $def) -and [double]$def -gt [double]$val)) { throw ("template-mandatory: {0}/{1} -- above needs a Default greater than its Value" -f $kind, $key) }
|        if ($rule -eq 'contains' -and -not ($val -is [System.Collections.IEnumerable] -and $val -isnot [string])) { throw ("template-mandatory: {0}/{1} -- contains needs a list" -f $kind, $key) }
|        $out.Add([pscustomobject]@{ Id = [string]$c.Id; Kind = $kind; ItemKey = $key; Rule = $rule; Path = $path; Value = $val; Default = $def; Reason = [string]$c.Reason; Code = [string]$c.Code })
|    }
|    # one by one: callers collect with @(...), and a `, $array` return read through @() nests (one element: the array)
|    foreach ($o in $out) { $o }
|}
|
|function Get-SIProMandatoryControls {
|    <# The shipped controls (config\template-mandatory.locked.json), read once per path. No file = no controls. #>
|    param([string]$SIRoot = $script:SIProMandatoryRoot)
|    $p = [System.IO.Path]::Combine($SIRoot, 'config', 'template-mandatory.locked.json')
|    if (-not $script:SIProMandatoryCache.ContainsKey($p)) {
|        $c = @()
|        if (Test-Path -LiteralPath $p) { $c = @(ConvertFrom-SIProMandatoryCatalog -Text ([System.IO.File]::ReadAllText($p))) }
|        $script:SIProMandatoryCache[$p] = $c
|    }
|    # one by one (callers collect with @(...)); no file = nothing
|    foreach ($o in $script:SIProMandatoryCache[$p]) { $o }
|}
|
|function Get-SIProMandatoryFor {
|    <# PURE. The controls of one item. #>
|    param([AllowEmptyCollection()][object[]]$Controls = @(), [AllowEmptyString()][string]$Kind, [AllowEmptyString()][string]$Key)
|    @($Controls | Where-Object { $_ -and $_.Kind -ceq $Kind -and $_.ItemKey -ceq $Key })
|}
|
|function Get-SIProMandatoryPathValue {
|    <# PURE. @{ Found; Value } at a dot path of a parsed body (PSCustomObject or dictionary). #>
|    param($Value, [string]$Path)
|    $cur = $Value
|    foreach ($seg in ($Path -split '\.')) {
|        if ($cur -is [System.Collections.IDictionary]) { if (-not $cur.Contains($seg)) { return @{ Found = $false; Value = $null } }; $cur = $cur[$seg]; continue }
|        if ($cur -is [System.Management.Automation.PSCustomObject] -and $cur.PSObject.Properties[$seg]) { $cur = $cur.$seg; continue }
|        return @{ Found = $false; Value = $null }
|    }
|    @{ Found = $true; Value = $cur }
|}
|
|function Test-SIProMandatoryValue {
|    <# PURE. Does a value satisfy one control? (present is about the item's State, not a value: always $true here) #>
|    param([Parameter(Mandatory)]$Control, [bool]$Found, $Value)
|    switch ($Control.Rule) {
|        'present' { return $true }
|        'equals' {
|            if (-not $Found) { return $false }
|            return ((ConvertTo-SIProJson -Value $Value -Canonical) -ceq (ConvertTo-SIProJson -Value $Control.Value -Canonical))
|        }
|        'atLeast' {
|            if (-not $Found -or $null -eq $Value -or $Value -is [bool] -or $Value -is [string]) { return $false }
|            $d = 0.0
|            if (-not [double]::TryParse([string]::Format([System.Globalization.CultureInfo]::InvariantCulture, '{0}', $Value), [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $false }
|            return ($d -ge [double]$Control.Value)
|        }
|        'above' {
|            if (-not $Found -or $null -eq $Value -or $Value -is [bool] -or $Value -is [string]) { return $false }
|            $d = 0.0
|            if (-not [double]::TryParse([string]::Format([System.Globalization.CultureInfo]::InvariantCulture, '{0}', $Value), [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $false }
|            return ($d -gt [double]$Control.Value)
|        }
|        'contains' {
|            if (-not $Found -or $null -eq $Value -or $Value -is [string] -or -not ($Value -is [System.Collections.IEnumerable])) { return $false }
|            $have = @(foreach ($v in $Value) { ConvertTo-SIProJson -Value $v -Canonical })
|            foreach ($need in @($Control.Value)) { if ($have -cnotcontains (ConvertTo-SIProJson -Value $need -Canonical)) { return $false } }
|            return $true
|        }
|    }
|    $false
|}
|
|function Get-SIProMandatoryText {
|    <# PURE. The plain sentence for one control a customer's change breaks. #>
|    param([Parameter(Mandatory)]$Control, [switch]$WhatOnly)
|    $v = ConvertTo-SIProJson -Value $Control.Value -Canonical
|    $what = switch ($Control.Rule) {
|        'present' { 'it cannot be switched off' }
|        'equals' { "'{0}' must stay {1}" -f $Control.Path, $v }
|        'atLeast' { "'{0}' must be at least {1}" -f $Control.Path, $v }
|        'above' { "'{0}' must be more than {1}" -f $Control.Path, $v }
|        'contains' { "'{0}' must keep {1}" -f $Control.Path, $v }
|    }
|    if ($WhatOnly) { return $what }
|    $r = if ($Control.Reason) { ' -- ' + $Control.Reason } else { '' }
|    ('{0}/{1} is required by SecurityInsight: {2}{3}' -f $Control.Kind, $Control.ItemKey, $what, $r)
|}
|
|function Test-SIProMandatoryOverride {
|    <#
|        PURE. The reasons a customer's state of an item is refused because it switches a mandatory part off or weakens it
|        (empty = accepted). -State 'disable' on an item with any control is refused; 'override' is checked per control
|        against the body; 'inherit' is always accepted (the shipped item meets every control).
|    #>
|    param([AllowEmptyCollection()][object[]]$Controls = @(), [AllowEmptyString()][string]$Kind, [AllowEmptyString()][string]$Key,
|          [AllowEmptyString()][string]$State, [AllowEmptyString()][AllowNull()][string]$Body)
|    $mine = @(Get-SIProMandatoryFor -Controls $Controls -Kind $Kind -Key $Key)
|    if ($mine.Count -eq 0 -or $State -eq 'inherit') { return @() }
|    if ($State -eq 'disable') {
|        $why = New-Object System.Collections.Generic.List[string]
|        foreach ($c in $mine) { $why.Add(('{0}/{1} is required by SecurityInsight and cannot be switched off{2}' -f $Kind, $Key, $(if ($c.Reason) { ' -- ' + $c.Reason } else { '' }))) }
|        return @($why | Select-Object -Unique)
|    }
|    $o = $null
|    try { $o = ConvertFrom-SIProJson ([string]$Body).TrimStart([char]0xFEFF) } catch { return @() }   # an unreadable body is the item validator's to refuse
|    @(foreach ($c in $mine) {
|        if ($c.Rule -eq 'present') { continue }
|        $pv = Get-SIProMandatoryPathValue -Value $o -Path $c.Path
|        if (-not (Test-SIProMandatoryValue -Control $c -Found $pv.Found -Value $pv.Value)) { Get-SIProMandatoryText -Control $c }
|    })
|}
|
|function Set-SIProMandatoryValues {
|    <#
|        PURE. The run's side: the mandatory values put ON TOP of an effective JSON body. Returns @{ Body; Changed; Applied
|        (one plain line per correction) }. A body that is not JSON (or not an object) is returned as it is.
|    #>
|    param([AllowEmptyCollection()][object[]]$Controls = @(), [AllowEmptyString()][string]$Kind, [AllowEmptyString()][string]$Key,
|          [AllowEmptyString()][AllowNull()][string]$Body)
|    $mine = @(Get-SIProMandatoryFor -Controls $Controls -Kind $Kind -Key $Key | Where-Object { $_.Rule -ne 'present' })
|    $same = [pscustomobject]@{ Body = $Body; Changed = $false; Applied = @() }
|    if ($mine.Count -eq 0) { return $same }
|    $o = $null
|    try { $o = ConvertTo-SIProMutableValue (ConvertFrom-SIProJson ([string]$Body).TrimStart([char]0xFEFF)) } catch { return $same }
|    if ($o -isnot [System.Collections.IDictionary]) { return $same }
|    $applied = New-Object System.Collections.Generic.List[string]
|    foreach ($c in $mine) {
|        $pv = Get-SIProMandatoryPathValue -Value $o -Path $c.Path
|        if (Test-SIProMandatoryValue -Control $c -Found $pv.Found -Value $pv.Value) { continue }
|        # walk / create the path; the last key receives the value
|        $segs = @($c.Path -split '\.'); $cur = $o; $ok = $true
|        for ($i = 0; $i -lt $segs.Count - 1; $i++) {
|            $s = $segs[$i]
|            if (-not $cur.Contains($s) -or $cur[$s] -isnot [System.Collections.IDictionary]) {
|                if ($cur.Contains($s) -and $null -ne $cur[$s]) { $ok = $false; break }   # another type sits there: never guessed over
|                $cur[$s] = [ordered]@{}
|            }
|            $cur = $cur[$s]
|        }
|        if (-not $ok) { continue }
|        $last = $segs[$segs.Count - 1]
|        if ($c.Rule -eq 'contains') {
|            $list = if ($cur.Contains($last) -and $cur[$last] -is [System.Collections.IList]) { $cur[$last] } else { New-Object System.Collections.ArrayList }
|            $have = @(foreach ($v in $list) { ConvertTo-SIProJson -Value $v -Canonical })
|            foreach ($need in @($c.Value)) { if ($have -cnotcontains (ConvertTo-SIProJson -Value $need -Canonical)) { [void]$list.Add((ConvertTo-SIProMutableValue $need)) } }
|            $cur[$last] = $list
|        } elseif ($c.Rule -eq 'above') {
|            $cur[$last] = $c.Default
|        } else {
|            $cur[$last] = ConvertTo-SIProMutableValue $c.Value
|        }
|        $applied.Add(('{0}/{1}: {2} -- the required value is applied' -f $Kind, $Key, (Get-SIProMandatoryText -Control $c -WhatOnly)))
|    }
|    if ($applied.Count -eq 0) { return $same }
|    [pscustomobject]@{ Body = (ConvertTo-SIProJson -Value $o); Changed = $true; Applied = $applied.ToArray() }
|}
'@ }
$__siSupportFiles['config/template-mandatory.locked.json'] = @{ Sha256 = '4cb824456f53731553392f7c383a9d5d02909a752567db51b12cf4b3eb76af73'; Text = @'
|{
|  "_doc": "SecurityInsight Pro -- MANDATORY CONTROLS on top of templates. The parts of shipped template items that SecurityInsight's own code requires: a customer override can never switch them off or weaken them. The web app refuses such an override (MandatoryControls, pro-management) and Set-SIProItem refuses it; the run applies the required value on top of whatever is stored (Merge-SIProItems, engine\\pro-settings\\SI-TemplateMandatory.ps1). Rules: present (the item cannot be switched off), equals, atLeast, above (with Default -- what the run applies), contains. A control exists ONLY because code in this release depends on it -- 'Code' names that code. This is a code contract, not policy: add an entry together with the code that needs it, remove it together with that code.",
|  "Schema": 1,
|  "Controls": [
|    { "Id": "rf-internet-exposed-present", "Kind": "datamodel", "ItemKey": "risk-factors:internet_exposed", "Rule": "present",
|      "Reason": "the shipped Risk Analysis reports read this factor to score internet-exposed assets",
|      "Code": "risk-analysis-detection\\RiskAnalysis_Queries_Locked.yaml: set_has_element(si_rf_p, \"internet_exposed\") (4 reports)" },
|    { "Id": "rf-internet-exposed-state", "Kind": "datamodel", "ItemKey": "risk-factors:internet_exposed", "Rule": "equals", "Path": "state", "Value": "enabled",
|      "Reason": "only an enabled factor (#559 state) reaches the reports that score on it -- the shipped factor is built-in, so it is never disabled",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: si_rf_p = make_set_if(... stage in (\"production\", \"\") and impact > 0) -- the CI build evaluates enabled factors only and stamps them production (SI-CiEnrich.ps1)" },
|    { "Id": "rf-internet-exposed-axis", "Kind": "datamodel", "ItemKey": "risk-factors:internet_exposed", "Rule": "equals", "Path": "axis", "Value": "probability",
|      "Reason": "the reports read it on the probability side of the score",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: si_rf_p takes axis == \"probability\"" },
|    { "Id": "rf-internet-exposed-impact", "Kind": "datamodel", "ItemKey": "risk-factors:internet_exposed", "Rule": "above", "Path": "impact", "Value": 0, "Default": 4,
|      "Reason": "a factor with no impact is left out of the scoring the reports read",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: todouble(impact) > 0" },
|
|    { "Id": "rf-old-password-present", "Kind": "datamodel", "ItemKey": "risk-factors:old_password", "Rule": "present",
|      "Reason": "the shipped Risk Analysis reports read this factor to score accounts with an old password",
|      "Code": "risk-analysis-detection\\RiskAnalysis_Queries_Locked.yaml: set_has_element(si_rf_p, \"old_password\") (2 reports)" },
|    { "Id": "rf-old-password-state", "Kind": "datamodel", "ItemKey": "risk-factors:old_password", "Rule": "equals", "Path": "state", "Value": "enabled",
|      "Reason": "only an enabled factor (#559 state) reaches the reports that score on it -- the shipped factor is built-in, so it is never disabled",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: si_rf_p = make_set_if(... stage in (\"production\", \"\") and impact > 0) -- the CI build evaluates enabled factors only and stamps them production (SI-CiEnrich.ps1)" },
|    { "Id": "rf-old-password-axis", "Kind": "datamodel", "ItemKey": "risk-factors:old_password", "Rule": "equals", "Path": "axis", "Value": "probability",
|      "Reason": "the reports read it on the probability side of the score",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: si_rf_p takes axis == \"probability\"" },
|    { "Id": "rf-old-password-impact", "Kind": "datamodel", "ItemKey": "risk-factors:old_password", "Rule": "above", "Path": "impact", "Value": 0, "Default": 3,
|      "Reason": "a factor with no impact is left out of the scoring the reports read",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: todouble(impact) > 0" },
|
|    { "Id": "rf-production-environment-present", "Kind": "datamodel", "ItemKey": "risk-factors:production_environment", "Rule": "present",
|      "Reason": "the shipped Risk Analysis reports read this factor to weigh production assets",
|      "Code": "risk-analysis-detection\\RiskAnalysis_Queries_Locked.yaml: set_has_element(si_rf_c, \"production_environment\")" },
|    { "Id": "rf-production-environment-state", "Kind": "datamodel", "ItemKey": "risk-factors:production_environment", "Rule": "equals", "Path": "state", "Value": "enabled",
|      "Reason": "only an enabled factor (#559 state) reaches the reports that score on it -- the shipped factor is built-in, so it is never disabled",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: si_rf_c = make_set_if(... stage in (\"production\", \"\") and impact > 0) -- the CI build evaluates enabled factors only and stamps them production (SI-CiEnrich.ps1)" },
|    { "Id": "rf-production-environment-axis", "Kind": "datamodel", "ItemKey": "risk-factors:production_environment", "Rule": "equals", "Path": "axis", "Value": "consequence",
|      "Reason": "the reports read it on the consequence side of the score",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: si_rf_c takes axis == \"consequence\"" },
|    { "Id": "rf-production-environment-impact", "Kind": "datamodel", "ItemKey": "risk-factors:production_environment", "Rule": "above", "Path": "impact", "Value": 0, "Default": 3,
|      "Reason": "a factor with no impact is left out of the scoring the reports read",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: todouble(impact) > 0" }
|  ]
|}
'@ }
$__siSupportFiles['engine/asset-tagging/AssetTagging.Resolve.ps1'] = @{ Sha256 = 'a62f0efa93220a2c964803bb46c9f7b9dd788ebbc9f8626b1e9a145ff4270f80'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT -- WHERE THE ASSET-TAGGING ENGINE FINDS ITS RULES AND ITS CONFIG (one resolution, three readers).
|
|    The launchers (launcher\asset-tagging\launcher.*.ps1), the engine (engine\asset-tagging\AssetTagging.ps1) and the Pro
|    importer (setup\Import-SIProSettings.ps1, #275 R3) all call THESE functions, so the importer looks exactly where a run
|    looks -- a customisation kept anywhere the engine reads is found, and nothing the engine would not read is imported.
|    The rules are the ones 2.2 shipped, moved here unchanged (2.2.460: launcher.internal-vm.ps1 "SettingsPath resolution",
|    AssetTagging.ps1 "LockedYamlFile / CustomYamlFile / LegacyYamlFile" and "asset-tagging.config.json").
|
|    PURE apart from Test-Path. PowerShell 5.1: no ?. / ??.
|#>
|
|function Resolve-SIAssetTaggingSettingsPath {
|    <#
|        The rules folder (SettingsPath): the -SettingsPath switch (-Cli), else the configured $global:SettingsPath, else the
|        launcher's default --
|          internal launcher:  <SI>\asset-tagging-rules\ when it exists, then <SI>\asset-profiling-enrichment\endpoint\, else
|                              asset-tagging-rules\ (the engine then stops with the clear "No YAML found" error);
|          community launcher: <SI>\asset-profiling-enrichment\endpoint\.
|    #>
|    param([string]$Cli, [string]$Configured, [Parameter(Mandatory)][string]$SIRoot, [ValidateSet('internal', 'community')][string]$Flavour = 'internal')
|    if ($Cli) { return $Cli }
|    if (-not [string]::IsNullOrWhiteSpace($Configured)) { return $Configured }
|    $defaultRules = Join-Path $SIRoot 'asset-tagging-rules'
|    $defaultEnrich = Join-Path $SIRoot 'asset-profiling-enrichment\endpoint'
|    if ($Flavour -eq 'community') { return $defaultEnrich }
|    if (Test-Path -LiteralPath $defaultRules) { return $defaultRules }
|    if (Test-Path -LiteralPath $defaultEnrich) { return $defaultEnrich }
|    $defaultRules
|}
|
|function Resolve-SIAssetTaggingFiles {
|    <#
|        The files a run reads from -SettingsPath. The YAML names: the configured ones, else the engine's own defaults
|        (a launcher always sets AssetTagging.locked.yaml / AssetTagging.custom.yaml). Pro: when the settings layer
|        materialised the rules (-ProAssetTaggingPath holds AssetTagging.locked.yaml) they are the WHOLE rule set.
|        Returns: RulesDir, LockedYamlFile, CustomYamlFile, LegacyYamlFile, LockedPath / CustomPath / LegacyPath and
|        whether each exists, FromPro, PreRenamed (the pre-2.2.392 locked name was used), Mode ('locked+custom' |
|        'legacy' | 'none'), ConfigCandidates (in the order they are tried) and ConfigPath (the one read, or $null).
|    #>
|    param([Parameter(Mandatory)][string]$SettingsPath, [Parameter(Mandatory)][string]$SIRoot,
|          [string]$LockedYamlFile, [string]$CustomYamlFile, [string]$LegacyYamlFile,
|          [string]$ProAssetTaggingPath, [string]$ProConfigRoot)
|    if ([string]::IsNullOrWhiteSpace($LockedYamlFile)) { $LockedYamlFile = 'SecurityInsight_CriticalAssetTagging_Locked.yaml' }
|    if ([string]::IsNullOrWhiteSpace($CustomYamlFile)) { $CustomYamlFile = 'SecurityInsight_CriticalAssetTagging_Custom.yaml' }
|    if ([string]::IsNullOrWhiteSpace($LegacyYamlFile)) { $LegacyYamlFile = 'CriticalAssetTagging.yaml' }
|    $configuredLocked = $LockedYamlFile
|    $fromPro = $false
|    $taggingRulesDir = $SettingsPath
|    if (-not [string]::IsNullOrWhiteSpace($ProAssetTaggingPath) -and (Test-Path -LiteralPath (Join-Path $ProAssetTaggingPath 'AssetTagging.locked.yaml'))) {
|        $taggingRulesDir = $ProAssetTaggingPath
|        $LockedYamlFile  = 'AssetTagging.locked.yaml'
|        $CustomYamlFile  = 'AssetTagging.custom.yaml'
|        $fromPro = $true
|    }
|    $lockedPath = Join-Path $taggingRulesDir $LockedYamlFile
|    $customPath = Join-Path $taggingRulesDir $CustomYamlFile
|    $legacyPath = Join-Path $taggingRulesDir $LegacyYamlFile
|    $lockedExists = Test-Path -LiteralPath $lockedPath
|    $customExists = Test-Path -LiteralPath $customPath
|    $legacyExists = Test-Path -LiteralPath $legacyPath
|    # v2.2.393 back-compat: 'AssetTagging.AutoExclude.locked.yaml' (the name before the v2.2.392 rename), in SettingsPath.
|    $preRenamed = $false
|    if (-not $lockedExists) {
|        $preRenamedLocked = Join-Path $SettingsPath 'AssetTagging.AutoExclude.locked.yaml'
|        if (Test-Path -LiteralPath $preRenamedLocked) {
|            $lockedPath = $preRenamedLocked
|            $LockedYamlFile = 'AssetTagging.AutoExclude.locked.yaml'
|            $lockedExists = $true
|            $preRenamed = $true
|        }
|    }
|    $mode = if ($lockedExists -or $customExists) { 'locked+custom' } elseif ($legacyExists) { 'legacy' } else { 'none' }
|    # asset-tagging.config.json: Pro's materialised copy first, then config\ under the solution root, then SettingsPath.
|    $candidateConfigPaths = @(
|        $(if (-not [string]::IsNullOrWhiteSpace($ProConfigRoot)) { Join-Path $ProConfigRoot 'asset-tagging.config.json' }),
|        (Join-Path $SIRoot 'config\asset-tagging.config.json'),
|        (Join-Path $SettingsPath 'asset-tagging.config.json')
|    ) | Where-Object { $_ }
|    $taggingConfigPath = $null
|    foreach ($cand in @($candidateConfigPaths)) {
|        if (Test-Path -LiteralPath $cand) { $taggingConfigPath = $cand; break }
|    }
|    [pscustomobject]@{
|        RulesDir = $taggingRulesDir; FromPro = $fromPro; PreRenamed = $preRenamed; ConfiguredLockedYamlFile = $configuredLocked
|        LockedYamlFile = $LockedYamlFile; CustomYamlFile = $CustomYamlFile; LegacyYamlFile = $LegacyYamlFile
|        LockedPath = $lockedPath; CustomPath = $customPath; LegacyPath = $legacyPath
|        LockedExists = $lockedExists; CustomExists = $customExists; LegacyExists = $legacyExists
|        Mode = $mode; ConfigCandidates = @($candidateConfigPaths); ConfigPath = $taggingConfigPath
|    }
|}
|
|# =====================================================================================================================
|#  THE RUN MODE of the Community server launcher (launcher\asset-tagging\launcher.community-vm.ps1)
|#  Operator decision 2026-10-07: asset tagging is REPORT ONLY by default -- as the Pro container job already is. Writing
|#  is asked for explicitly: -Apply on the run, or $global:SI_AssetTagging_Apply = $true in the configuration.
|# =====================================================================================================================
|function ConvertTo-SIAssetTaggingBool {
|    <# PURE. $true / 'true' / '1' / 'yes' / 'on' / '$true' -> $true; anything else (null, empty, false, 0 ...) -> $false. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $false }
|    if ($Value -is [bool]) { return $Value }
|    if ($Value -is [System.Management.Automation.SwitchParameter]) { return $Value.IsPresent }
|    return ("$Value".Trim().Trim('$').ToLowerInvariant() -in @('true', '1', 'yes', 'on'))
|}
|
|function Resolve-SIAssetTaggingRunMode {
|    <#
|        PURE. Does this Community asset-tagging run WRITE tags? First match wins:
|          1. -WhatIfMode given on this run             -> report only   (Source 'switch-whatif'; it also wins over -Apply)
|          2. -Apply given on this run                  -> write         (Source 'switch-apply')
|          3. WhatIfMode true in the configuration      -> report only   (Source 'config-whatif'; what it always meant here)
|          4. SI_AssetTagging_Apply true in the config  -> write         (Source 'setting')
|          5. nothing asked for                         -> report only   (Source 'default')
|        A WhatIfMode = $false in the configuration is NOT a request to write (it was the old default, copied into many
|        configurations); only -Apply or SI_AssetTagging_Apply writes.
|        ABOVE ALL (#643, owner 2026-10-13: "tagging must be disabled by default. customer must enable it in settings"): a run
|        WRITES only when the customer setting "Asset tagging" (SI_AssetTagging_Enabled, -EnabledSetting) is on. Off (the
|        shipped default) = report only whatever -Apply / SI_AssetTagging_Apply say (Source 'tagging-off').
|        Returns @{ Apply; WhatIfMode; Source }.
|    #>
|    param([bool]$ApplySwitch = $false, [bool]$WhatIfSwitch = $false, [AllowNull()]$ApplySetting, [AllowNull()]$ConfigWhatIf, [AllowNull()]$EnabledSetting)
|    $r = { param($apply, $src) [pscustomobject]@{ Apply = [bool]$apply; WhatIfMode = -not [bool]$apply; Source = $src } }
|    if ($WhatIfSwitch) { return (& $r $false 'switch-whatif') }
|    $on = ConvertTo-SIAssetTaggingBool $EnabledSetting
|    if ($ApplySwitch)  { if (-not $on) { return (& $r $false 'tagging-off') }; return (& $r $true 'switch-apply') }
|    if (ConvertTo-SIAssetTaggingBool $ConfigWhatIf) { return (& $r $false 'config-whatif') }
|    if (ConvertTo-SIAssetTaggingBool $ApplySetting) { if (-not $on) { return (& $r $false 'tagging-off') }; return (& $r $true 'setting') }
|    & $r $false 'default'
|}
|
|function Get-SIAssetTaggingRunModeLine {
|    <# PURE. The one line every run prints about its mode. #>
|    param([Parameter(Mandatory)]$Mode)
|    if ($Mode.Apply) {
|        $why = if ($Mode.Source -eq 'switch-apply') { 'the -Apply switch' } else { '$global:SI_AssetTagging_Apply = $true' }
|        return ('WRITES ON -- this run sets tags in Defender, Azure and Entra ({0}).' -f $why)
|    }
|    switch ($Mode.Source) {
|        'switch-whatif' { return 'REPORT ONLY -- nothing is changed (-WhatIfMode). Every tag the rules would set is logged.' }
|        'config-whatif' { return 'REPORT ONLY -- nothing is changed (WhatIfMode = $true in your configuration). Every tag the rules would set is logged.' }
|        'tagging-off'   { return 'REPORT ONLY -- asset tagging is OFF (the setting "Asset tagging", SI_AssetTagging_Enabled, is not on): nothing is changed. To use it: set $global:SI_AssetTagging_Enabled = $true, then -Apply or $global:SI_AssetTagging_Apply = $true to write.' }
|        default         { return 'REPORT ONLY -- nothing is changed; every tag the rules would set is logged. To write the tags: run with -Apply, or set $global:SI_AssetTagging_Apply = $true in config\SecurityInsight.custom.ps1.' }
|    }
|}
|
|function Get-SIAssetTaggingReportOnlyNoticeLines {
|    <# PURE. The one-time notice when the DEFAULT made a run report only. -RanBefore: this install ran asset tagging
|       before (it wrote tags then, unless it was started with -WhatIfMode). #>
|    param([bool]$RanBefore = $false)
|    if ($RanBefore) {
|        return @(
|            'Asset tagging is now REPORT ONLY by default. Earlier versions wrote tags whenever the script ran without -WhatIfMode; from this version a run writes only when you ask for it.',
|            ' - This run changed nothing. It logged every tag the rules would set (console, run log and SI_AssetTagActivity_CL).',
|            ' - To write tags again on every run: set $global:SI_AssetTagging_Apply = $true in config\SecurityInsight.custom.ps1. For one run: add -Apply.',
|            ' - This notice is shown once.'
|        )
|    }
|    @(
|        'Asset tagging is REPORT ONLY by default: it logs every tag the rules would set and changes nothing.',
|        ' - To write tags: set $global:SI_AssetTagging_Apply = $true in config\SecurityInsight.custom.ps1, or add -Apply to one run. Its identity also needs the write grants (setup\Grant-SIIdentity.ps1 -Tagging).',
|        ' - This notice is shown once.'
|    )
|}
|
|function Test-SIAssetTaggingRanBefore {
|    <# Did this install run asset tagging before this run? Its run logs (asset-tagging_*.log in -LogDir) older than
|       -Before, other than -ExcludePath (this run's own log). Never throws. #>
|    param([string]$LogDir, [datetime]$Before = [datetime]::Now, [string]$ExcludePath)
|    try {
|        if (-not $LogDir -or -not (Test-Path -LiteralPath $LogDir)) { return $false }
|        $old = @(Get-ChildItem -LiteralPath $LogDir -Filter 'asset-tagging_*.log' -File -ErrorAction SilentlyContinue |
|                 Where-Object { $_.LastWriteTime -lt $Before -and (-not $ExcludePath -or $_.FullName -ne $ExcludePath) })
|        return ($old.Count -gt 0)
|    } catch { return $false }
|}
|
|function Invoke-SIAssetTaggingReportOnlyNotice {
|    <#
|        Shows the report-only notice ONCE per install (notice id 'asset-tagging-report-only' in the install state the
|        first-run layer keeps, engine\_shared\SI-FirstRun.ps1: logs\state\install-state.json). Only when the DEFAULT made
|        this run report only -- a run that asked for report only, or for writing, is not told. -Store: as
|        Read-SIInstallState (file | memory). -RanBefore: { } -> bool, evaluated only when the notice is due.
|        Returns @{ Shown; RanBefore; Lines }. Never throws; an unreadable state shows nothing (never on every run).
|    #>
|    param([Parameter(Mandatory)]$Mode, [Parameter(Mandatory)][hashtable]$Store, [scriptblock]$RanBefore)
|    $res = [pscustomobject]@{ Shown = $false; RanBefore = $false; Lines = @() }
|    try {
|        if ($Mode.Apply -or $Mode.Source -ne 'default') { return $res }
|        if (-not (Get-Command -Name Read-SIInstallState -ErrorAction SilentlyContinue)) { return $res }
|        $id = 'asset-tagging-report-only'
|        $read = Read-SIInstallState -Store $Store
|        if (-not $read.Ok) { return $res }
|        $state = $read.State
|        if ($state -and -not (Test-SINoticeDue -State $state -Id $id)) { return $res }
|        $before = $false
|        if ($RanBefore) { try { $before = [bool](& $RanBefore) } catch { $before = $false } }
|        if (-not $state) {
|            $ev = if ($before) { @('earlier-asset-tagging-runs') } else { @() }
|            $state = New-SIInstallState -Origin $(if ($before) { 'upgraded' } else { 'fresh' }) -Evidence $ev -Version ''
|        }
|        $lines = @(Get-SIAssetTaggingReportOnlyNoticeLines -RanBefore $before)
|        Write-SINoticeLines -Lines $lines
|        Add-SINoticeShown -State $state -Id $id
|        $null = Save-SIInstallState -Store $Store -State $state
|        $res.Shown = $true; $res.RanBefore = $before; $res.Lines = $lines
|    } catch { Write-Verbose ('asset-tagging notice skipped: {0}' -f $_.Exception.Message) }
|    $res
|}
'@ }
$__siSupportFiles['engine/risk-analysis/_shared/RA-RiskIndexOrder.ps1'] = @{ Sha256 = 'c4fb7558d9a4d6d815d3dbaa084b0e59a36c843a67e33da8e4cb1cfa7221d22e'; Text = @'
|#######################################################################################################
|#  SecurityInsight - Risk Analysis engine
|#  The risk index: FIRST MATCH WINS, in row order (operator decision 2026-10-04).
|#
|#  WHAT A ROW MEANS
|#    Matchers  SecurityDomain, Category, SubCategory, ConfigurationId   -- blank = any
|#              SecuritySeverity      (consulted for the CONSEQUENCE score only)
|#              CriticalityTierLevel  (consulted for the PROBABILITY score only)
|#    Scores    RiskConsequenceScore_SecuritySeverity, RiskProbablityScore_CriticialityTierLevel
|#              -- a blank score means "this row does not set that score": the search goes on.
|#    Order     Precedence (1 = checked first). A file without the Precedence column is a v2.2 index.
|#
|#  HOW A FINDING IS SCORED
|#    Consequence base = the score of the FIRST row, top-down, that has a consequence score and whose
|#    filled matchers among Domain/Category/SubCategory/ConfigurationId/SecuritySeverity all equal the
|#    finding's values (case-insensitive). The probability base is found the same way with
|#    CriticalityTierLevel in place of SecuritySeverity. No row -> 0. The two lookups are independent,
|#    exactly as they were in v2.2. The scoring contract is unchanged:
|#      RiskScoreTotal = (consBase + rfCons) x (probBase + rfProb)
|#
|#  WHY THE TWO LOOKUPS STAY INDEPENDENT
|#    v2.2 never took both scores from one row: the consequence came from the best row for the
|#    finding's SEVERITY and the probability from the best row for its TIER. Making one row supply both
|#    would need a row for every severity x tier x matcher combination to give the same scores
|#    (measured on the shipped index: thousands of rows), so it is not done.
|#
|#  v2.2 -> v3 (ConvertTo-SIRiskIndexFirstMatch)
|#    v2.2 did NOT use the order of the file. It walked a FIXED ladder of column patterns, most specific
|#    first (domain-qualified before not; severity/tier-qualified before configuration-only), and per
|#    pattern took the first row in the file that had every pattern column filled -- IGNORING that row's
|#    other columns. Converting a v2.2 file writes one row per (pattern, value) the ladder could ever
|#    pick, in ladder order, so first-match over the converted rows returns exactly the v2.2 score for
|#    every finding (proved in tests/pester/SIv3-RiskIndexOrder.Tests.ps1 over every matcher
|#    combination). The C# preview (SI.Management.Core RiskIndexScoring) mirrors this file 1:1.
|#
|#  PowerShell 5.1 compatible. Pure functions; no I/O.
|#######################################################################################################
|
|$script:SIRiskIndexMatchColumns = @('SecurityDomain', 'Category', 'SubCategory', 'ConfigurationId')
|$script:SIRiskIndexOutColumns   = @('SecurityDomain', 'Category', 'SubCategory', 'ConfigurationId', 'SecuritySeverity',
|    'RiskConsequenceScore_SecuritySeverity', 'CriticalityTierLevel', 'RiskProbablityScore_CriticialityTierLevel', 'Comments', 'Precedence')
|
|function Get-SIRiskIndexLadder {
|    <# PURE. The v2.2 pattern ladder (RA-ExcelReport.ps1 New-RiskIndex before v3), most specific first.
|       D C S I = SecurityDomain Category SubCategory ConfigurationId; V = SecuritySeverity (consequence) or
|       CriticalityTierLevel (probability). #>
|    @(
|        @('D','C','S','I','V'), @('D','C','S','V'), @('D','C','V'), @('D','V'),
|        @('D','C','S','I'),     @('D','C','S'),     @('D','C'),     @('D'),
|        @('C','S','I','V'),     @('C','S','V'),     @('C','V'),     @('V'),
|        @('C','S','I'),         @('C','S'),         @('C')
|    )
|}
|
|function Get-SIRiskIndexCell {
|    param($Row, [string]$Name)
|    if ($null -eq $Row) { return '' }
|    if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($Name)) { return [string]$Row[$Name] } else { return '' } }
|    $p = $Row.PSObject.Properties[$Name]
|    if ($null -eq $p -or $null -eq $p.Value) { return '' }
|    [string]$p.Value
|}
|
|function ConvertTo-SIRiskIndexNumber {
|    <# PURE. A score the way the engine always parsed it: invariant, anything else -> 0. #>
|    param([string]$Text)
|    $n = 0.0
|    [void][double]::TryParse([string]$Text, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n)
|    $n
|}
|
|function Get-SIRiskIndexLogicalColumn {
|    param([string]$Letter, [string]$Kind)
|    switch ($Letter) {
|        'D' { 'SecurityDomain' } 'C' { 'Category' } 'S' { 'SubCategory' } 'I' { 'ConfigurationId' }
|        'V' { if ($Kind -eq 'Consequence') { 'SecuritySeverity' } else { 'CriticalityTierLevel' } }
|    }
|}
|
|function Get-SIRiskIndexScoreColumn {
|    param([string]$Kind)
|    if ($Kind -eq 'Consequence') { 'RiskConsequenceScore_SecuritySeverity' } else { 'RiskProbablityScore_CriticialityTierLevel' }
|}
|
|function Get-SIRiskIndexLadderScore {
|    <#
|        PURE. The v2.2 rule, kept as the REFERENCE the conversion is proved against (and for the impact
|        measurement). -Rows in file order; -Finding a hashtable with SecurityDomain, Category, SubCategory,
|        ConfigurationId, SecuritySeverity, CriticalityTierLevel. Returns the base score (0 when nothing matches).
|    #>
|    param([object[]]$Rows, [hashtable]$Finding, [ValidateSet('Consequence','Probability')][string]$Kind, [hashtable]$Index)
|    if (-not $Index) { $Index = New-SIRiskIndexLadderIndex -Rows $Rows }
|    $maps = $Index[$Kind]
|    $hasDomain = -not [string]::IsNullOrWhiteSpace([string]$Finding['SecurityDomain'])
|    $ladder = Get-SIRiskIndexLadder
|    for ($g = 0; $g -lt $ladder.Count; $g++) {
|        $pat = $ladder[$g]
|        if ($g -lt 8 -and -not $hasDomain) { continue }
|        $fk = New-Object System.Collections.Generic.List[string]; $ok = $true
|        foreach ($l in $pat) { $v = [string]$Finding[(Get-SIRiskIndexLogicalColumn $l $Kind)]; if ([string]::IsNullOrWhiteSpace($v)) { $ok = $false; break }; $fk.Add($v) }
|        if (-not $ok) { continue }
|        $fkey = ($fk.ToArray() -join '|').ToLowerInvariant()
|        if ($maps[$g].ContainsKey($fkey)) { return $maps[$g][$fkey] }
|    }
|    0.0
|}
|
|function New-SIRiskIndexLadderIndex {
|    <# PURE. The v2.2 lookup maps (per kind, per ladder pattern: key -> score of the FIRST row in the file with that key). #>
|    param([object[]]$Rows)
|    $ladder = Get-SIRiskIndexLadder
|    $res = @{}
|    foreach ($kind in 'Consequence', 'Probability') {
|        $scoreCol = Get-SIRiskIndexScoreColumn $kind
|        $maps = @()
|        foreach ($pat in $ladder) {
|            $map = @{}
|            foreach ($r in @($Rows)) {
|                $rk = New-Object System.Collections.Generic.List[string]; $rok = $true
|                foreach ($l in $pat) { $v = Get-SIRiskIndexCell $r (Get-SIRiskIndexLogicalColumn $l $kind); if ([string]::IsNullOrWhiteSpace($v)) { $rok = $false; break }; $rk.Add($v) }
|                if (-not $rok) { continue }
|                $k = ($rk.ToArray() -join '|').ToLowerInvariant()
|                if (-not $map.ContainsKey($k)) { $map[$k] = (ConvertTo-SIRiskIndexNumber (Get-SIRiskIndexCell $r $scoreCol)) }
|            }
|            $maps += , $map
|        }
|        $res[$kind] = $maps
|    }
|    $res
|}
|
|function ConvertTo-SIRiskIndexFirstMatch {
|    <#
|        PURE. A v2.2 index (rows in file order) -> the same index as first-match rows, in precedence order, with
|        Precedence 1..n. First-match over the result scores every finding exactly as the v2.2 ladder scored the
|        input. Rows are [ordered] dictionaries with the ten columns of $script:SIRiskIndexOutColumns.
|        One row per (ladder pattern, value) the v2.2 ladder could pick. A severity row carries only the
|        consequence score and a tier row only the probability score; a pattern without severity / tier writes its
|        consequence and probability entry (same domain/category/subcategory/configuration) as one row.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows)
|    $rows = @($Rows | Where-Object { $null -ne $_ })
|    $ladder = Get-SIRiskIndexLadder
|    $groups = New-Object System.Collections.Generic.List[object]   # per pattern: ordered groups of (cons list, prob list)
|    for ($g = 0; $g -lt $ladder.Count; $g++) {
|        $pat = $ladder[$g]
|        $byKey = @{}; $order = New-Object System.Collections.Generic.List[string]
|        foreach ($kind in 'Consequence', 'Probability') {
|            $seen = @{}
|            $scoreCol = Get-SIRiskIndexScoreColumn $kind
|            foreach ($r in $rows) {
|                $vals = New-Object System.Collections.Generic.List[string]; $ok = $true
|                foreach ($l in $pat) { $v = Get-SIRiskIndexCell $r (Get-SIRiskIndexLogicalColumn $l $kind); if ([string]::IsNullOrWhiteSpace($v)) { $ok = $false; break }; $vals.Add($v) }
|                if (-not $ok) { continue }
|                $key = ($vals.ToArray() -join '|').ToLowerInvariant()
|                if ($seen.ContainsKey($key)) { continue }
|                $seen[$key] = $true
|                # the group: the pattern's columns without V
|                $gk = New-Object System.Collections.Generic.List[string]
|                for ($i = 0; $i -lt $pat.Count; $i++) { if ($pat[$i] -ne 'V') { $gk.Add($vals[$i]) } }
|                $gkey = ($gk.ToArray() -join '|').ToLowerInvariant()
|                if (-not $byKey.ContainsKey($gkey)) { $byKey[$gkey] = @{ Cons = (New-Object System.Collections.Generic.List[object]); Prob = (New-Object System.Collections.Generic.List[object]) }; $order.Add($gkey) }
|                $raw = (Get-SIRiskIndexCell $r $scoreCol).Trim()
|                $d = 0.0
|                $score = if ($raw -ne '' -and [double]::TryParse($raw, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { $raw } else { '0' }
|                # the row's note travels only to a row that matches what the row itself matched (not to the wider
|                # patterns v2.2 also filed it under)
|                $wider = $false
|                foreach ($l in 'D', 'C', 'S', 'I', 'V') { if ($pat -notcontains $l -and -not [string]::IsNullOrWhiteSpace((Get-SIRiskIndexCell $r (Get-SIRiskIndexLogicalColumn $l $kind)))) { $wider = $true } }
|                $entry = @{ Vals = $vals.ToArray(); Score = $score; Comment = $(if ($wider) { '' } else { Get-SIRiskIndexCell $r 'Comments' }) }
|                if ($kind -eq 'Consequence') { $byKey[$gkey].Cons.Add($entry) } else { $byKey[$gkey].Prob.Add($entry) }
|            }
|        }
|        $groups.Add(@{ Pattern = $pat; ByKey = $byKey; Order = $order })
|    }
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($grp in $groups) {
|        $pat = $grp.Pattern
|        foreach ($gkey in $grp.Order) {
|            $c = $grp.ByKey[$gkey].Cons; $p = $grp.ByKey[$gkey].Prob
|            # A pattern WITH a severity / tier column: one row per score (a severity row sets the consequence, a tier
|            # row the probability -- so no row reads as "severity AND tier"). Without one: at most one entry of each
|            # kind, written as one row with both scores.
|            $pairs = New-Object System.Collections.Generic.List[object]
|            if ($pat -contains 'V') {
|                foreach ($e in $c) { $pairs.Add(@($e, $null)) }
|                foreach ($e in $p) { $pairs.Add(@($null, $e)) }
|            } else {
|                $pairs.Add(@($(if ($c.Count) { $c[0] } else { $null }), $(if ($p.Count) { $p[0] } else { $null })))
|            }
|            foreach ($pair in $pairs) {
|                $o = [ordered]@{}; foreach ($col in $script:SIRiskIndexOutColumns) { $o[$col] = '' }
|                $ce = $pair[0]
|                $pe = $pair[1]
|                $src = if ($ce) { $ce } else { $pe }
|                for ($j = 0; $j -lt $pat.Count; $j++) {
|                    $l = $pat[$j]
|                    if ($l -eq 'V') {
|                        if ($ce) { $o['SecuritySeverity'] = $ce.Vals[$j] }
|                        if ($pe) { $o['CriticalityTierLevel'] = $pe.Vals[$j] }
|                    } else { $o[(Get-SIRiskIndexLogicalColumn $l 'Consequence')] = $src.Vals[$j] }
|                }
|                if ($ce) { $o['RiskConsequenceScore_SecuritySeverity'] = $ce.Score }
|                if ($pe) { $o['RiskProbablityScore_CriticialityTierLevel'] = $pe.Score }
|                $o['Comments'] = $(if ($ce -and $ce.Comment) { $ce.Comment } elseif ($pe) { $pe.Comment } else { '' })
|                $out.Add($o)
|            }
|        }
|    }
|    $k = 0; foreach ($o in $out) { $k++; $o['Precedence'] = [string]$k }
|    # the rows, one by one, to the pipeline (callers collect them with @())
|    $out.ToArray()
|}
|
|function Test-SIRiskIndexFirstMatchForm {
|    <# PURE. $true when the rows carry the Precedence column (a v3 first-match index), $false for a v2.2 index. #>
|    param([AllowEmptyCollection()][object[]]$Rows)
|    $first = @($Rows | Where-Object { $null -ne $_ } | Select-Object -First 1)
|    if (-not $first.Count) { return $false }
|    $r = $first[0]
|    if ($r -is [System.Collections.IDictionary]) { return [bool]$r.Contains('Precedence') }
|    [bool]$r.PSObject.Properties['Precedence']
|}
|
|function Get-SIRiskIndexOrderedRows {
|    <#
|        PURE. The rows of an index in the order first-match walks them. A v3 index: stable sort by Precedence
|        (a number; a row without one goes after the numbered rows, in file order). A v2.2 index: converted.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows)
|    $rows = @($Rows | Where-Object { $null -ne $_ })
|    if (-not (Test-SIRiskIndexFirstMatchForm $rows)) { return @(ConvertTo-SIRiskIndexFirstMatch -Rows $rows) }
|    if ($rows.Count -eq 0) { return }
|    $keys = New-Object 'System.Collections.Generic.List[double]'
|    for ($i = 0; $i -lt $rows.Count; $i++) {
|        $t = (Get-SIRiskIndexCell $rows[$i] 'Precedence').Trim(); $d = 0.0
|        if ($t -ne '' -and [double]::TryParse($t, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { $keys.Add($d) } else { $keys.Add([double]::MaxValue) }
|    }
|    $idx = [int[]](0..($rows.Count - 1))
|    # stable: sort by (precedence, original position); the rows go to the pipeline one by one (callers use @())
|    $sorted = @($idx | Sort-Object -Property @{ Expression = { $keys[$_] } }, @{ Expression = { $_ } })
|    foreach ($i in $sorted) { $rows[$i] }
|}
|
|function New-SIRiskIndexRules {
|    <#
|        PURE. Ordered rows -> the two rule lists first-match walks: @{ Consequence = rules; Probability = rules }.
|        A rule: @{ M = string[5] (D, C, S, I, V lowercased; $null = any); Score = double; Position = 1-based row }.
|        A row without a score for a kind is not a rule of that kind.
|    #>
|    param([AllowEmptyCollection()][object[]]$OrderedRows)
|    $res = @{}
|    foreach ($kind in 'Consequence', 'Probability') {
|        $scoreCol = Get-SIRiskIndexScoreColumn $kind
|        $list = New-Object System.Collections.Generic.List[object]
|        $pos = 0
|        foreach ($r in @($OrderedRows)) {
|            $pos++
|            $s = Get-SIRiskIndexCell $r $scoreCol
|            if ([string]::IsNullOrWhiteSpace($s)) { continue }
|            $m = New-Object 'object[]' 5
|            $i = 0
|            foreach ($l in 'D', 'C', 'S', 'I', 'V') {
|                $v = Get-SIRiskIndexCell $r (Get-SIRiskIndexLogicalColumn $l $kind)
|                $m[$i] = $(if ([string]::IsNullOrWhiteSpace($v)) { $null } else { $v.ToLowerInvariant() })
|                $i++
|            }
|            $list.Add(@{ M = $m; Score = (ConvertTo-SIRiskIndexNumber $s); Position = $pos })
|        }
|        $res[$kind] = $list.ToArray()
|    }
|    $res
|}
|
|function Find-SIRiskIndexRule {
|    <#
|        PURE. The first rule whose filled matchers all equal the finding's values. -Values: string[5] in D C S I V
|        order (the finding's; blank = the finding has no value, which a filled matcher never matches).
|        Returns the rule, or $null.
|    #>
|    param([object[]]$Rules, [string[]]$Values)
|    $lv = New-Object 'object[]' 5
|    for ($i = 0; $i -lt 5; $i++) { $lv[$i] = $(if ([string]::IsNullOrWhiteSpace($Values[$i])) { $null } else { $Values[$i].ToLowerInvariant() }) }
|    foreach ($rule in $Rules) {
|        $m = $rule.M; $fit = $true
|        for ($i = 0; $i -lt 5; $i++) {
|            if ($null -ne $m[$i] -and $m[$i] -cne $lv[$i]) { $fit = $false; break }
|        }
|        if ($fit) { return $rule }
|    }
|    $null
|}
|
|function Get-SIRiskIndexFirstMatchScore {
|    <# PURE. The base score of one finding under first-match (0 when no rule matches). For tests and tools. #>
|    param([hashtable]$Rules, [hashtable]$Finding, [ValidateSet('Consequence','Probability')][string]$Kind)
|    $vals = @(foreach ($l in 'D', 'C', 'S', 'I', 'V') { [string]$Finding[(Get-SIRiskIndexLogicalColumn $l $Kind)] })
|    $r = Find-SIRiskIndexRule -Rules $Rules[$Kind] -Values $vals
|    if ($null -eq $r) { 0.0 } else { [double]$r.Score }
|}
|
|function ConvertTo-SIRiskIndexCsvText {
|    <# PURE. Ordered rows -> the CSV text the engine reads (v3: with Precedence, renumbered 1..n in this order). #>
|    param([AllowEmptyCollection()][object[]]$OrderedRows)
|    $q = { param([string]$s) if ($s -match '[",\r\n]' -or $s -ne $s.Trim()) { '"' + $s.Replace('"', '""') + '"' } else { $s } }
|    $lines = New-Object System.Collections.Generic.List[string]
|    $lines.Add(($script:SIRiskIndexOutColumns -join ','))
|    $k = 0
|    foreach ($r in @($OrderedRows)) {
|        $k++
|        $lines.Add((@(foreach ($c in $script:SIRiskIndexOutColumns) { if ($c -eq 'Precedence') { [string]$k } else { & $q (Get-SIRiskIndexCell $r $c) } }) -join ','))
|    }
|    ($lines.ToArray() -join "`r`n") + "`r`n"
|}
'@ }
$__siSupportFiles['engine/risk-analysis/_shared/RA-RiskIndexSi.ps1'] = @{ Sha256 = 'e9f3b48744992ac92d2c1506ac468adc716b8a74ebeb5bd8c67c056580c28b8c'; Text = @'
|#######################################################################################################
|#  SecurityInsight - Risk Analysis engine
|#  THE RISK INDEX, RE-KEYED TO THE SI GENERIC FIELDS (REQUIREMENTS #559, owner 2026-10-10: "base values come from the
|#  risk index. that is the magic ... risk index base values must be adjusted to the si names ... if mde has not
|#  responded in 7 days on a server, it is critical - but on a client for a user being on vacation it is not same
|#  criticality").
|#
|#  WHAT A ROW MEANS (riskscore.index.locked.csv, and the customer's riskscore.index.custom.csv)
|#    Matchers  si_finding_type, si_category, si_subcategory, si_component, si_finding_key, asset_class  -- blank = any
|#              si_severity  (consulted for the VULNERABILITY base only)
|#              si_tier      (consulted for the ASSET base only)
|#    Scores    AssetBase (the asset side's base: by finding x asset class x tier)
|#              VulnerabilityBase (the vulnerability side's base: by finding type / category / subcategory / severity)
|#              -- a blank score means "this row does not set that score": the search goes on.
|#    Order     Precedence (1 = checked first); rows without one after the numbered rows, in file order.
|#
|#  HOW A FINDING IS SCORED -- unchanged from 3.0 (RA-RiskIndexOrder.ps1): FIRST MATCH WINS, per base, top down. A filled
|#  matcher must equal the finding's value (case-insensitive); a blank finding value never fits a filled matcher. ONE
|#  extension: asset_class 'device' is the FAMILY of device_server / device_client, so a 'device' row fits both (the v2.2
|#  'Endpoint' rows translate to it), while a device_server row fits only servers. No row -> 0.
|#      asset side         = AssetBase + SUM(enabled asset factors' impacts)          no cap
|#      vulnerability side = VulnerabilityBase + SUM(enabled finding factors' impacts)  no cap
|#      risk score         = asset side x vulnerability side                         (RA-RiskScore.ps1)
|#
|#  v2.2 KEYS ARE TRANSLATED, NEVER LOST (riskscore.index.translation.locked.json, shipped as data). A file with the v2.2
|#  columns (SecurityDomain, Category, SubCategory, ConfigurationId, SecuritySeverity, CriticalityTierLevel and the two
|#  score columns) is first put in first-match form when it has no Precedence column (ConvertTo-SIRiskIndexFirstMatch --
|#  the v2.2 ladder, proved in SIv3-RiskIndexOrder.Tests.ps1), then translated row for row, in order, so every v2.2 base
|#  value is carried over and first-match over the translated rows scores a translated finding exactly as v2.2 did
|#  (tests/pester/SIv3-RiskIndexSi.Tests.ps1). The shipped index IS that translation of the 3.0 index (99 rows), plus the
|#  owner's server / client rows in front.
|#
|#  PowerShell 7 (v3); written 5.1-safe. Pure functions except Get-SIRiskIndexTranslation (reads the shipped table once).
|#######################################################################################################
|
|$script:SIRiskIndexSiColumns = @('si_finding_type', 'si_category', 'si_subcategory', 'si_component', 'si_finding_key', 'asset_class',
|    'si_severity', 'VulnerabilityBase', 'si_tier', 'AssetBase', 'Comments', 'Precedence')
|$script:SIRiskIndexSiMatchers = @('si_finding_type', 'si_category', 'si_subcategory', 'si_component', 'si_finding_key', 'asset_class')
|$script:SIRiskIndexV22Columns = @('SecurityDomain', 'Category', 'SubCategory', 'ConfigurationId', 'SecuritySeverity',
|    'RiskConsequenceScore_SecuritySeverity', 'CriticalityTierLevel', 'RiskProbablityScore_CriticialityTierLevel')
|$script:SIRiskIndexTranslationPath = [System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))), 'risk-analysis-detection', 'riskscore.index.translation.locked.json')
|
|# the shipped table, used when the file cannot be read (a stripped package): the same values, so a v2.2 file still scores
|$script:SIRiskIndexTranslationDefault = @{
|    columns = [ordered]@{ SecurityDomain = 'asset_class'; Category = 'si_category'; SubCategory = 'si_subcategory'; ConfigurationId = 'si_finding_key'
|        SecuritySeverity = 'si_severity'; RiskConsequenceScore_SecuritySeverity = 'VulnerabilityBase'; CriticalityTierLevel = 'si_tier'
|        RiskProbablityScore_CriticialityTierLevel = 'AssetBase'; Comments = 'Comments'; Precedence = 'Precedence' }
|    values = @{
|        asset_class = @{ 'endpoint' = 'device'; 'identity' = 'identity'; 'azure' = 'cloud_resource'; 'publicip' = 'public_ip' }
|        si_severity = @{ 'very high' = 'critical'; 'critical' = 'critical'; 'high' = 'high'; 'medium-high' = 'medium_high'; 'medium' = 'medium'; 'moderate' = 'medium'; 'low' = 'low'; 'informational' = 'info'; 'info' = 'info' }
|        si_tier = @{ 'critical - tier 0' = '0'; 'high - tier 1' = '1'; 'medium - tier 2' = '2'; 'low - tier 3' = '3' }
|    }
|}
|
|function Get-SIRiskIndexTranslation {
|    <# The v2.2 -> SI translation table: @{ columns = ordered v2.2 -> SI; values = SI column -> @{ lower-case v2.2 value -> SI value } }.
|       Read once per process from riskscore.index.translation.locked.json; the built-in copy when it cannot be read. #>
|    param([string]$Path = $script:SIRiskIndexTranslationPath)
|    if ($script:SIRiskIndexTranslationCache -and -not $PSBoundParameters.ContainsKey('Path')) { return $script:SIRiskIndexTranslationCache }
|    $t = $script:SIRiskIndexTranslationDefault
|    try {
|        if ($Path -and (Test-Path -LiteralPath $Path)) {
|            $j = [System.IO.File]::ReadAllText($Path) | ConvertFrom-Json
|            $cols = [ordered]@{}; foreach ($p in $j.columns.PSObject.Properties) { $cols[$p.Name] = [string]$p.Value }
|            $vals = @{}
|            foreach ($p in $j.values.PSObject.Properties) { $m = @{}; foreach ($q in $p.Value.PSObject.Properties) { $m[$q.Name.ToLowerInvariant()] = [string]$q.Value }; $vals[$p.Name] = $m }
|            $t = @{ columns = $cols; values = $vals }
|        }
|    } catch { $t = $script:SIRiskIndexTranslationDefault }
|    if (-not $PSBoundParameters.ContainsKey('Path')) { $script:SIRiskIndexTranslationCache = $t }
|    return $t
|}
|
|function Get-SIRiskIndexCellSi {
|    param($Row, [string]$Name)
|    if ($null -eq $Row) { return '' }
|    if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($Name) -and $null -ne $Row[$Name]) { return [string]$Row[$Name] } else { return '' } }
|    $p = $Row.PSObject.Properties[$Name]
|    if ($null -eq $p -or $null -eq $p.Value) { return '' }
|    [string]$p.Value
|}
|
|function Get-SIRiskIndexRowColumns {
|    param($Row)
|    if ($null -eq $Row) { return @() }
|    if ($Row -is [System.Collections.IDictionary]) { return @($Row.Keys | ForEach-Object { [string]$_ }) }
|    return @($Row.PSObject.Properties.Name)
|}
|
|function Test-SIRiskIndexV22Form {
|    <# PURE. $true when the rows are written with the v2.2 columns (they carry a v2.2 score column and no SI score column). #>
|    param([AllowEmptyCollection()][object[]]$Rows)
|    $first = @($Rows | Where-Object { $null -ne $_ } | Select-Object -First 1)
|    if (-not $first.Count) { return $false }
|    $cols = Get-SIRiskIndexRowColumns $first[0]
|    if ($cols -contains 'AssetBase' -or $cols -contains 'VulnerabilityBase') { return $false }
|    return ($cols -contains 'RiskConsequenceScore_SecuritySeverity' -or $cols -contains 'RiskProbablityScore_CriticialityTierLevel' -or $cols -contains 'CriticalityTierLevel')
|}
|
|function ConvertTo-SIRiskIndexSiValue {
|    <# PURE. One v2.2 value -> its SI value for an SI column (the table's value map; an unlisted value is kept as written). #>
|    param([string]$Column, [AllowNull()][AllowEmptyString()][string]$Value, [hashtable]$Translation)
|    if (-not $Translation) { $Translation = Get-SIRiskIndexTranslation }
|    $v = ([string]$Value).Trim()
|    if ($v -eq '') { return '' }
|    if ($Translation.values -and $Translation.values.ContainsKey($Column)) {
|        $m = $Translation.values[$Column]
|        $k = $v.ToLowerInvariant()
|        if ($m.ContainsKey($k)) { return [string]$m[$k] }
|    }
|    return $v
|}
|
|function ConvertTo-SIRiskIndexSiRow {
|    <# PURE. ONE row -> an SI-keyed [ordered] row: a 2.2-keyed row translated column by column (its Precedence kept), an
|       SI row copied. For one row at a time (a Pro item); a whole 2.2 file without Precedence goes through
|       ConvertTo-SIRiskIndexSiRows (the ladder needs every row). #>
|    param([Parameter(Mandatory)]$Row, [hashtable]$Translation)
|    if (-not $Translation) { $Translation = Get-SIRiskIndexTranslation }
|    $o = [ordered]@{}; foreach ($c in $script:SIRiskIndexSiColumns) { $o[$c] = '' }
|    if (Test-SIRiskIndexV22Form @($Row)) {
|        foreach ($src in $Translation.columns.Keys) {
|            $dst = [string]$Translation.columns[$src]
|            if ($o.Contains($dst)) { $o[$dst] = ConvertTo-SIRiskIndexSiValue -Column $dst -Value (Get-SIRiskIndexCellSi $Row $src) -Translation $Translation }
|        }
|    } else {
|        foreach ($c in $script:SIRiskIndexSiColumns) { $o[$c] = Get-SIRiskIndexCellSi $Row $c }
|    }
|    return $o
|}
|
|function ConvertTo-SIRiskIndexSiRows {
|    <#
|        PURE. Index rows -> SI-keyed rows ([ordered] dictionaries with $script:SIRiskIndexSiColumns), in first-match order.
|          * SI rows (AssetBase / VulnerabilityBase columns): kept, ordered by Precedence (stable)
|          * v2.2 rows: a file without Precedence is converted by the v2.2 ladder first (ConvertTo-SIRiskIndexFirstMatch),
|            then every row is translated column by column (riskscore.index.translation.locked.json), keeping its order
|        Precedence is renumbered 1..n in the returned order.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows, [hashtable]$Translation)
|    $rows = @($Rows | Where-Object { $null -ne $_ })
|    if ($rows.Count -eq 0) { return }
|    if (-not $Translation) { $Translation = Get-SIRiskIndexTranslation }
|    $out = [System.Collections.Generic.List[object]]::new()
|    if (Test-SIRiskIndexV22Form $rows) {
|        $ordered = @()
|        if (Get-Command -Name Get-SIRiskIndexOrderedRows -ErrorAction SilentlyContinue) { $ordered = @(Get-SIRiskIndexOrderedRows -Rows $rows) } else { $ordered = $rows }
|        foreach ($r in $ordered) {
|            $o = [ordered]@{}; foreach ($c in $script:SIRiskIndexSiColumns) { $o[$c] = '' }
|            foreach ($src in $Translation.columns.Keys) {
|                $dst = [string]$Translation.columns[$src]
|                if (-not $o.Contains($dst)) { continue }
|                $o[$dst] = ConvertTo-SIRiskIndexSiValue -Column $dst -Value (Get-SIRiskIndexCellSi $r $src) -Translation $Translation
|            }
|            $out.Add($o)
|        }
|    } else {
|        $keys = New-Object 'System.Collections.Generic.List[double]'
|        for ($i = 0; $i -lt $rows.Count; $i++) {
|            $t = (Get-SIRiskIndexCellSi $rows[$i] 'Precedence').Trim(); $d = 0.0
|            if ($t -ne '' -and [double]::TryParse($t, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { $keys.Add($d) } else { $keys.Add([double]::MaxValue) }
|        }
|        $idx = [int[]](0..($rows.Count - 1))
|        foreach ($i in @($idx | Sort-Object -Property @{ Expression = { $keys[$_] } }, @{ Expression = { $_ } })) {
|            $o = [ordered]@{}; foreach ($c in $script:SIRiskIndexSiColumns) { $o[$c] = (Get-SIRiskIndexCellSi $rows[$i] $c) }
|            $out.Add($o)
|        }
|    }
|    $k = 0; foreach ($o in $out) { $k++; $o['Precedence'] = [string]$k }
|    $out.ToArray()
|}
|
|function New-SIRiskIndexSiRules {
|    <#
|        PURE. SI rows in first-match order -> @{ Asset = rules; Vulnerability = rules }. A rule: @{ M = string[7] (the six
|        matchers + tier / severity, lower-case; $null = any); Score = double; Position = 1-based row }. A row without a
|        score for a kind is not a rule of that kind.
|    #>
|    param([AllowEmptyCollection()][object[]]$OrderedRows)
|    $res = @{}
|    foreach ($kind in 'Asset', 'Vulnerability') {
|        $scoreCol = 'AssetBase'; $vCol = 'si_tier'
|        if ($kind -eq 'Vulnerability') { $scoreCol = 'VulnerabilityBase'; $vCol = 'si_severity' }
|        $list = [System.Collections.Generic.List[object]]::new()
|        $pos = 0
|        foreach ($r in @($OrderedRows)) {
|            $pos++
|            $s = Get-SIRiskIndexCellSi $r $scoreCol
|            if ([string]::IsNullOrWhiteSpace($s)) { continue }
|            $m = New-Object 'object[]' 7
|            for ($i = 0; $i -lt 6; $i++) { $v = (Get-SIRiskIndexCellSi $r $script:SIRiskIndexSiMatchers[$i]).Trim(); $m[$i] = $(if ($v -eq '') { $null } else { $v.ToLowerInvariant() }) }
|            $vv = (Get-SIRiskIndexCellSi $r $vCol).Trim(); $m[6] = $(if ($vv -eq '') { $null } else { $vv.ToLowerInvariant() })
|            $n = 0.0
|            [void][double]::TryParse($s.Trim(), [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n)
|            $list.Add(@{ M = $m; Score = $n; Position = $pos })
|        }
|        $res[$kind] = $list.ToArray()
|    }
|    $res
|}
|
|function Find-SIRiskIndexSiRule {
|    <#
|        PURE. The first rule whose filled matchers all fit the finding's values. -Values: string[7] in the order
|        si_finding_type, si_category, si_subcategory, si_component, si_finding_key, asset_class, tier-or-severity.
|        asset_class: a matcher fits the same class or the class's family ('device' fits device_server / device_client).
|    #>
|    param([object[]]$Rules, [string[]]$Values)
|    $lv = New-Object 'object[]' 7
|    for ($i = 0; $i -lt 7; $i++) { $lv[$i] = $(if ([string]::IsNullOrWhiteSpace($Values[$i])) { $null } else { ([string]$Values[$i]).Trim().ToLowerInvariant() }) }
|    $fam = $null; if ($lv[5]) { $u = ([string]$lv[5]).IndexOf('_'); if ($u -gt 0 -and ([string]$lv[5]).StartsWith('device_')) { $fam = ([string]$lv[5]).Substring(0, $u) } }
|    foreach ($rule in $Rules) {
|        $m = $rule.M; $fit = $true
|        for ($i = 0; $i -lt 7; $i++) {
|            if ($null -eq $m[$i]) { continue }
|            if ($m[$i] -ceq $lv[$i]) { continue }
|            if ($i -eq 5 -and $null -ne $fam -and $m[$i] -ceq $fam) { continue }
|            $fit = $false; break
|        }
|        if ($fit) { return $rule }
|    }
|    $null
|}
|
|function New-SIRiskIndexSi {
|    <#
|        PURE. The SI-keyed risk index Calculate-RiskScore looks its two bases up in. -Rows the shipped index, -OverlayRows the
|        customer's own rows (walked FIRST, #398). Either may be SI-keyed or v2.2-keyed (translated). Returns the index object.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [AllowEmptyCollection()][object[]]$OverlayRows = @(), [hashtable]$Translation)
|    $Rows = @($Rows | Where-Object { $null -ne $_ }); $OverlayRows = @($OverlayRows | Where-Object { $null -ne $_ })
|    $srcForm = $(if (Test-SIRiskIndexV22Form $Rows) { $(if (@(Get-SIRiskIndexRowColumns $Rows[0]) -contains 'Precedence') { 'v3-v2.2keys' } else { 'v2.2' }) } else { 'si' })
|    $ovForm = ''
|    if ($OverlayRows.Count) { $ovForm = $(if (Test-SIRiskIndexV22Form $OverlayRows) { $(if (@(Get-SIRiskIndexRowColumns $OverlayRows[0]) -contains 'Precedence') { 'v3-v2.2keys' } else { 'v2.2' }) } else { 'si' }) }
|    $ov = @(); if ($OverlayRows.Count) { $ov = @(ConvertTo-SIRiskIndexSiRows -Rows $OverlayRows -Translation $Translation) }
|    $sh = @(); if ($Rows.Count) { $sh = @(ConvertTo-SIRiskIndexSiRows -Rows $Rows -Translation $Translation) }
|    $ordered = @($ov) + @($sh)
|    $rules = New-SIRiskIndexSiRules -OrderedRows $ordered
|    [pscustomobject]@{
|        Form                 = 'si'
|        Mode                 = 'first-match'
|        OrderedRows          = $ordered
|        OrderedRowCount      = $ordered.Count
|        OverlayRowCount      = $ov.Count
|        SourceForm           = $srcForm
|        OverlayForm          = $ovForm
|        Asset_Rules          = $rules['Asset']
|        Vulnerability_Rules  = $rules['Vulnerability']
|        # the column a row's security domain is read from when it has no asset class (kept for the callers' defaults)
|        SecurityDomainColumn = 'SecurityDomain'
|        Memo                 = ([System.Collections.Generic.Dictionary[string,object]]::new([System.StringComparer]::Ordinal))
|    }
|}
|
|function Get-SIRiskIndexAssetClass {
|    <#
|        PURE. The asset class the index keys on: device_server / device_client (a device with a known category or OS),
|        device (a device neither says), identity, cloud_resource, public_ip; '' when the class is unknown.
|    #>
|    param([string]$Class, [string]$DeviceCategory, [string]$OsPlatform, [string]$OsName)
|    $c = ([string]$Class).Trim().ToLowerInvariant()
|    switch ($c) {
|        'device' {
|            $cat = ([string]$DeviceCategory).Trim().ToLowerInvariant()
|            $os = (([string]$OsPlatform) + ' ' + ([string]$OsName)).Trim().ToLowerInvariant()
|            if ($cat -eq 'server' -or $os -match 'server') { return 'device_server' }
|            if ($cat -in 'endpoint', 'workstation', 'desktop', 'laptop', 'mobile', 'client') { return 'device_client' }
|            if ($os -match '^(windows ?(7|8|10|11|xp|vista))|macos|mac os|ios|ipados|android') { return 'device_client' }
|            return 'device'
|        }
|        { $_ -in 'identity', 'cloud_resource', 'public_ip' } { return $c }
|        default { return '' }
|    }
|}
|
|function Get-SIRiskIndexFindingValues {
|    <#
|        PURE. One finding row -> @{ Asset = string[7]; Vulnerability = string[7] } (the values the two lookups compare).
|          si_finding_type  the row's si_finding_type, else 'cve' for a CVE key, else blank
|          si_category      si_category, else the report's Category column (-CategoryInputName)
|          si_subcategory   si_subcategory, else Subcategory / SubCategory (-SubCategoryInputName)
|          si_component     si_component (#561), else blank
|          si_finding_key   si_finding_key, else ConfigurationId (-ConfigurationIdInputName)
|          asset_class      si_asset_class (the CI context), else the row's si_class split by its OS columns, else the
|                           report's security domain translated (Endpoint -> device ...)
|          tier             CriticalityTier (0..3), else the tier label translated, else si_tier
|          severity         the severity label translated (keeps v2.2's Medium-High band), else si_severity
|    #>
|    param([Parameter(Mandatory)]$Row, [string]$CategoryInputName = 'Category', [string]$SubCategoryInputName = 'Subcategory',
|          [string]$ConfigurationIdInputName = 'ConfigurationId', [string]$SecuritySeverityInputName = 'SecuritySeverity',
|          [string]$CriticalityTierLevelInputName = 'CriticalityTierLevel', [string]$DomainValue = '', [hashtable]$Translation)
|    if (-not $Translation) { $Translation = Get-SIRiskIndexTranslation }
|    $g = { param($n) if (-not $n) { return '' }; $p = $Row.PSObject.Properties[$n]; if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($n) -and $null -ne $Row[$n]) { return ([string]$Row[$n]).Trim() } else { return '' } }; if ($p -and $null -ne $p.Value) { return ([string]$p.Value).Trim() }; return '' }
|    $first = { param([string[]]$names) foreach ($n in $names) { $v = & $g $n; if ($v -ne '') { return $v } }; return '' }
|    $key = & $first @('si_finding_key', $ConfigurationIdInputName, 'ConfigurationId')
|    $ftype = & $g 'si_finding_type'
|    if ($ftype -eq '' -and $key -match '^(?i)CVE-\d{4}-\d+$') { $ftype = 'cve' }
|    $cat = & $first @('si_category', $CategoryInputName, 'Category')
|    $sub = & $first @('si_subcategory', $SubCategoryInputName, 'Subcategory', 'SubCategory')
|    $comp = & $g 'si_component'
|    $ac = & $g 'si_asset_class'
|    if ($ac -eq '') {
|        $cls = & $g 'si_class'
|        if ($cls -ne '') { $ac = Get-SIRiskIndexAssetClass -Class $cls -DeviceCategory (& $first @('si_device_category', 'DeviceCategory')) -OsPlatform (& $first @('si_os_platform', 'OSPlatform', 'OsPlatform', 'MDE_OSPlatform')) -OsName (& $first @('si_os_name')) }
|    }
|    if ($ac -eq '') {
|        $dom = $DomainValue; if (-not $dom) { $dom = & $first @('SecurityDomain', 'si_security_domain') }
|        $ac = ConvertTo-SIRiskIndexSiValue -Column 'asset_class' -Value $dom -Translation $Translation
|        if ($ac -eq 'device') {
|            $os = & $first @('si_os_platform', 'OSPlatform', 'OsPlatform', 'MDE_OSPlatform')
|            if ($os -ne '') { $ac = Get-SIRiskIndexAssetClass -Class 'device' -OsPlatform $os -DeviceCategory (& $first @('si_device_category', 'DeviceCategory')) }
|        }
|    }
|    $tier = ''
|    $tn = & $g 'CriticalityTier'
|    $d = 0.0
|    if ($tn -ne '' -and [double]::TryParse($tn, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { $tier = [string][int][Math]::Floor($d) }
|    if ($tier -eq '') { $tl = & $first @($CriticalityTierLevelInputName, 'CriticalityTierLevel'); if ($tl -ne '') { $tier = ConvertTo-SIRiskIndexSiValue -Column 'si_tier' -Value $tl -Translation $Translation } }
|    if ($tier -eq '') { $tier = & $g 'si_tier' }
|    $sev = ''
|    $sl = & $first @($SecuritySeverityInputName, 'SecuritySeverity')
|    if ($sl -ne '') { $sev = ConvertTo-SIRiskIndexSiValue -Column 'si_severity' -Value $sl -Translation $Translation }
|    if ($sev -eq '') { $sev = (& $g 'si_severity').ToLowerInvariant() }
|    $base = @($ftype, $cat, $sub, $comp, $key, $ac)
|    return @{ Asset = [string[]](@($base) + @($tier)); Vulnerability = [string[]](@($base) + @($sev)) }
|}
|
|function Get-SIRiskIndexSiScore {
|    <# PURE (memoised on the index). The base of one kind ('Asset' | 'Vulnerability') for the finding values: @{ Score; Position }
|       (Position 0 = no row fits -> 0). #>
|    param([Parameter(Mandatory)]$Index, [Parameter(Mandatory)][ValidateSet('Asset', 'Vulnerability')][string]$Kind, [Parameter(Mandatory)][AllowEmptyString()][AllowEmptyCollection()][string[]]$Values)
|    # the memo key: a loop, not a pipeline (this runs twice per finding row)
|    $mkParts = [System.Collections.Generic.List[string]]::new([int]($Values.Count))
|    foreach ($v in $Values) { $mkParts.Add(([string]$v).Trim().ToLowerInvariant()) }
|    $mk = $Kind + [char]31 + ($mkParts -join [char]31)
|    $hit = $null
|    if ($Index.Memo -and $Index.Memo.TryGetValue($mk, [ref]$hit)) { return $hit }
|    $rules = $Index.Asset_Rules; if ($Kind -eq 'Vulnerability') { $rules = $Index.Vulnerability_Rules }
|    $rule = Find-SIRiskIndexSiRule -Rules @($rules) -Values $Values
|    $res = $(if ($null -eq $rule) { @{ Score = 0.0; Position = 0 } } else { @{ Score = [double]$rule.Score; Position = [int]$rule.Position } })
|    if ($Index.Memo) { $Index.Memo[$mk] = $res }
|    $res
|}
|
|function ConvertTo-SIRiskIndexSiCsvText {
|    <# PURE. SI rows in first-match order -> the CSV text the engine reads (SI columns, Precedence renumbered 1..n). #>
|    param([AllowEmptyCollection()][object[]]$OrderedRows)
|    $q = { param([string]$s) if ($s -match '[",\r\n]' -or $s -ne $s.Trim()) { '"' + $s.Replace('"', '""') + '"' } else { $s } }
|    $lines = [System.Collections.Generic.List[string]]::new()
|    $lines.Add(($script:SIRiskIndexSiColumns -join ','))
|    $k = 0
|    foreach ($r in @($OrderedRows)) {
|        $k++
|        $lines.Add((@(foreach ($c in $script:SIRiskIndexSiColumns) { if ($c -eq 'Precedence') { [string]$k } else { & $q (Get-SIRiskIndexCellSi $r $c) } }) -join ','))
|    }
|    ($lines.ToArray() -join "`r`n") + "`r`n"
|}
'@ }
$__siSupportFiles['risk-analysis-detection/riskscore.index.translation.locked.json'] = @{ Sha256 = 'e8b96eae2683b4da448a4cfe3f4e138e0c7fa718ce65309e738493eef7ab53a3'; Text = @'
|{
|  "$comment": "SecurityInsight risk index: the v2.2 key -> SI key translation (REQUIREMENTS #559, owner 2026-10-10: \"risk index base values must be adjusted to the si names\"). The shipped index (riskscore.index.locked.csv) is keyed by the SI generic fields; an index or a customer's own rows still written with the v2.2 columns (riskscore.index.custom.csv of 2.2 / 3.0, the Pro run file of an older web app) are translated with this table on load, row for row, in their order -- every v2.2 base value is carried over (engine/risk-analysis/_shared/RA-RiskIndexSi.ps1, ConvertTo-SIRiskIndexSiRows; proved by tests/pester/SIv3-RiskIndexSi.Tests.ps1). columns: v2.2 column -> SI column. values: per SI column, v2.2 value -> SI value (case-insensitive); a value not listed is kept as written. si_finding_type and si_component did not exist in v2.2: a translated row leaves them blank (= any). asset_class 'device' is the family of device_server and device_client: a 'device' matcher fits both. Severity keeps v2.2's Medium-High band as medium_high so its own base value survives (SI's finding severity folds it into medium). AssetBase = the asset side's base (v2.2 RiskProbablityScore_CriticialityTierLevel, keyed by tier); VulnerabilityBase = the vulnerability side's base (v2.2 RiskConsequenceScore_SecuritySeverity, keyed by severity).",
|  "kind": "risk-index-translation",
|  "version": "1.0.0",
|  "siColumns": ["si_finding_type", "si_category", "si_subcategory", "si_component", "si_finding_key", "asset_class", "si_severity", "VulnerabilityBase", "si_tier", "AssetBase", "Comments", "Precedence"],
|  "columns": {
|    "SecurityDomain": "asset_class",
|    "Category": "si_category",
|    "SubCategory": "si_subcategory",
|    "ConfigurationId": "si_finding_key",
|    "SecuritySeverity": "si_severity",
|    "RiskConsequenceScore_SecuritySeverity": "VulnerabilityBase",
|    "CriticalityTierLevel": "si_tier",
|    "RiskProbablityScore_CriticialityTierLevel": "AssetBase",
|    "Comments": "Comments",
|    "Precedence": "Precedence"
|  },
|  "values": {
|    "asset_class": {
|      "Endpoint": "device",
|      "Identity": "identity",
|      "Azure": "cloud_resource",
|      "PublicIP": "public_ip"
|    },
|    "si_severity": {
|      "Very High": "critical",
|      "Critical": "critical",
|      "High": "high",
|      "Medium-High": "medium_high",
|      "Medium": "medium",
|      "Moderate": "medium",
|      "Low": "low",
|      "Informational": "info",
|      "Info": "info"
|    },
|    "si_tier": {
|      "Critical - tier 0": "0",
|      "High - tier 1": "1",
|      "Medium - tier 2": "2",
|      "Low - tier 3": "3"
|    }
|  },
|  "assetClasses": ["device_server", "device_client", "device", "identity", "cloud_resource", "public_ip"],
|  "riskFactorsV1": {
|    "$comment": "The risk-factor catalog BEFORE model v2 (1.0.0): per factor id its shipped name, impact, stage and axis. A Pro override (cfg.ItemOverride risk-factors:<id>) made against it is converged to model v2 on the next template publish / update (SI-ProOverrideMigration.ps1): a value equal to this 1.0.0 default takes the new shipped value, a value the customer changed is kept; stage becomes state; retired factors (removed) are listed with what replaced them.",
|    "factors": {"internet_exposed":{"name":"Internet exposed","impact":1,"stage":"production","axis":"probability"},"unsupported_os":{"name":"Unsupported operating system","impact":1,"stage":"production","axis":"probability"},"compromised_recently":{"name":"Involved in a recent incident","impact":1,"stage":"production","axis":"probability"},"high_machine_risk":{"name":"High machine risk","impact":1,"stage":"production","axis":"probability"},"antivirus_disabled":{"name":"Antivirus disabled","impact":1,"stage":"production","axis":"probability"},"antivirus_out_of_date":{"name":"Antivirus out of date","impact":1,"stage":"production","axis":"probability"},"not_onboarded":{"name":"Not onboarded to Defender for Endpoint","impact":1,"stage":"production","axis":"probability"},"unmanaged":{"name":"Unmanaged device","impact":1,"stage":"production","axis":"probability"},"excluded_from_defender":{"name":"Excluded from Defender","impact":1,"stage":"production","axis":"probability"},"no_mfa":{"name":"No MFA registered","impact":1,"stage":"production","axis":"probability"},"no_owner":{"name":"Service principal without owner","impact":1,"stage":"production","axis":"probability"},"stale_sign_in":{"name":"No sign-in for 90 days","impact":1,"stage":"production","axis":"probability"},"very_stale_sign_in":{"name":"No sign-in for a year","impact":1,"stage":"production","axis":"probability"},"never_signed_in":{"name":"Never signed in","impact":1,"stage":"production","axis":"probability"},"old_account":{"name":"Account older than 90 days","impact":1,"stage":"production","axis":"probability"},"old_password":{"name":"Password not changed for a year","impact":1,"stage":"production","axis":"probability"},"publisher_not_verified":{"name":"Publisher not verified","impact":1,"stage":"production","axis":"probability"},"multitenant_app":{"name":"Multi-tenant application","impact":1,"stage":"production","axis":"probability"},"permanent_privileged_role":{"name":"Permanent privileged role","impact":1,"stage":"production","axis":"probability"},"expiring_credentials":{"name":"Credentials expire within 30 days","impact":1,"stage":"production","axis":"probability"},"has_secret":{"name":"Client secret in use","impact":1,"stage":"production","axis":"probability"},"expired_credentials":{"name":"Expired credentials","impact":1,"stage":"production","axis":"probability"},"identity_high_blast_radius":{"name":"High blast radius (Defender for Identity)","impact":1,"stage":"production","axis":"probability"},"identity_at_risk":{"name":"Identity at risk (Defender for Identity)","impact":1,"stage":"production","axis":"probability"},"break_glass":{"name":"Emergency-access account","impact":1,"stage":"production","axis":"probability"},"leaked_credentials":{"name":"Leaked credentials","impact":1,"stage":"testing","axis":"probability"},"high_risk_port_open":{"name":"Administrative port open to the internet","impact":1,"stage":"production","axis":"probability"},"high_cvss_public_ip":{"name":"CVSS 9 or higher","impact":1,"stage":"production","axis":"probability"},"ms_criticality_high":{"name":"High Microsoft criticality","impact":1,"stage":"production","axis":"consequence"},"production_environment":{"name":"Production environment","impact":1,"stage":"production","axis":"consequence"},"restricted_data":{"name":"Restricted data","impact":1,"stage":"production","axis":"consequence"},"confidential_data":{"name":"Confidential data","impact":1,"stage":"production","axis":"consequence"},"exploit_available":{"name":"Exploit available","impact":1,"stage":"production","axis":"probability"},"remote_code_execution":{"name":"Remote code execution","impact":1,"stage":"production","axis":"consequence"},"report_scoped":{"name":"Factors computed inside one report","impact":1,"stage":"production","axis":"probability"}},
|    "removed": { "very_stale_sign_in": "stale_sign_in", "break_glass": "classification:break_glass_patterns" }
|  }
|}
'@ }
$__siSupportFiles['engine/pro-settings/SI-ProOverrideMigration.ps1'] = @{ Sha256 = 'ad657db2a03088c59f46d51f3ac497d931d3d7adf7ac13f54f5f350312b01794'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- THE CUSTOMER'S OVERRIDES FOLLOW THE RISK FACTOR MODEL V2 (CONVERGE-DEFAULTS).
|
|    The risk index was re-keyed from the 2.2 columns to the SI generic fields, and the risk-factor catalog moved to model
|    v2 (shortName / group / class / impact 1-5 / state instead of stage). A Pro install keeps the customer's changes as
|    cfg.ItemOverride rows keyed by the OLD shape. Left alone they would become orphans: a risk index override under a
|    2.2 key matches no template any more (and would come back as an "own" row in the wrong column set), a factor override
|    still says `stage` and lacks the v2 fields, and an override of a removed factor (break_glass) would come back as a
|    factor of its own. On the next template publish / update (setup\Publish-SITemplates.ps1 with the shipped templates,
|    what setup and the updater run) every such row is translated through the SHIPPED translation table
|    (risk-analysis-detection\riskscore.index.translation.locked.json) -- the customer's values are kept:
|
|      riskindex  'row/<6 x 2.2 dims>[#n]' -> 'row/<8 x SI dims>[#n]' (si_finding_type | si_category | si_subcategory |
|                 si_component | si_finding_key | asset_class | si_severity | si_tier); its body translated column by column
|                 (its base values and its place unchanged); a 'disable' moves with its key. When the new key already has
|                 an override (the customer redid it), the new one is kept and the old row removed -- said.
|      datamodel  'risk-factors:<id>' with a pre-v2 body: stage -> state (not_used / testing = disabled; a built-in factor
|                 is never disabled -- it stays enabled and that is said); the v2 fields it lacks come from the shipped
|                 factor; a value EQUAL to the 1.0.0 default (riskFactorsV1 in the table: impact 1, the old name) takes the
|                 new shipped value, a value the customer changed is kept (impact held to 1..5). A 'disable' of a built-in
|                 factor is removed (it cannot be switched off). An override of a REMOVED factor (very_stale_sign_in,
|                 break_glass) is removed and said what replaced it.
|    Every write goes through Set-SIProItem (validated, ChangeLog), the old key's removal too ('inherit'); an item that does
|    not validate after translation is left as it was and reported -- nothing is half-migrated. Running it again changes
|    nothing (an already-migrated row is not touched).
|
|    PURE except Invoke-SIProOverrideMigration. PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|function Get-SIProOverrideTranslation {
|    <# The shipped translation table (the whole JSON document), from -SIRoot. #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $p = [System.IO.Path]::Combine($SIRoot, 'risk-analysis-detection', 'riskscore.index.translation.locked.json')
|    return ([System.IO.File]::ReadAllText($p) | ConvertFrom-Json)
|}
|
|function ConvertTo-SIProRiskIndexSiKey {
|    <# PURE. An old 2.2 risk index item key ('row/<SecurityDomain>|<Category>|<SubCategory>|<ConfigurationId>|<Severity>|<Tier>'
|       with an optional '#n') -> the SI key; $null when the key is not a 2.2 key (8 dimensions already, or not a row key). #>
|    param([Parameter(Mandatory)][string]$Key, [Parameter(Mandatory)][hashtable]$Translation)
|    if ($Key -notmatch '^row/') { return $null }
|    $suffix = ''; $body = $Key.Substring(4)
|    $m = [regex]::Match($body, '#\d+$'); if ($m.Success) { $suffix = $m.Value; $body = $body.Substring(0, $m.Index) }
|    $d = $body.Split('|')
|    if ($d.Count -ne 6) { return $null }
|    $v = { param($c, $x) ConvertTo-SIRiskIndexSiValue -Column $c -Value $x -Translation $Translation }
|    $si = @('', (& $v 'si_category' $d[1]), (& $v 'si_subcategory' $d[2]), '', (& $v 'si_finding_key' $d[3]), (& $v 'asset_class' $d[0]), (& $v 'si_severity' $d[4]), (& $v 'si_tier' $d[5]))
|    return ('row/' + (($si | ForEach-Object { ([string]$_).Trim() }) -join '|') + $suffix)
|}
|
|function ConvertTo-SIProPascalName {
|    <# PURE. An id -> a PascalCase short name (old_thing_2 -> OldThing2), for a customer's own factor that has none. #>
|    param([string]$Id)
|    $s = (@(([string]$Id) -split '[^A-Za-z0-9]+' | Where-Object { $_ } | ForEach-Object { $_.Substring(0, 1).ToUpperInvariant() + $_.Substring(1) }) -join '')
|    if ($s -notmatch '^[A-Z]') { $s = 'F' + $s }
|    if ($s.Length -gt 24) { $s = $s.Substring(0, 24) }
|    if ($s.Length -lt 2) { $s = $s + 'X' }
|    return $s
|}
|
|function ConvertTo-SIProFactorV2Body {
|    <#
|        PURE. One pre-v2 factor override body -> its model v2 body (CONVERGE-DEFAULTS, see the header). -Shipped: the shipped
|        v2 factor of that id ($null for the customer's own factor); -V1: the 1.0.0 default of that id ($null when it was not
|        shipped). Returns @{ Body (ordered); Notes }.
|    #>
|    param([Parameter(Mandatory)]$Override, $Shipped, $V1)
|    $notes = New-Object System.Collections.Generic.List[string]
|    $o = [ordered]@{}
|    foreach ($p in $Override.PSObject.Properties) { $o[$p.Name] = $p.Value }
|    $id = [string]$o['id']
|    $builtin = ($null -ne $Shipped -and [string]$Shipped.class -ne 'optional')
|    # stage -> state
|    if (-not $o.Contains('state')) {
|        $st = 'enabled'
|        if ($o.Contains('stage') -and [string]$o['stage'] -in 'not_used', 'testing') { $st = 'disabled' }
|        if ($st -eq 'disabled' -and $builtin) { $st = 'enabled'; $notes.Add(("{0} was switched off ({1}); it is built-in now and stays enabled -- lower its impact instead" -f $id, [string]$o['stage'])) }
|        $o['state'] = $st
|    }
|    if ($o.Contains('stage')) { $o.Remove('stage') }
|    # the v2 fields it lacks: the shipped factor's (a customer's own factor: derived, optional)
|    $fill = @('shortName', 'group', 'class', 'appliesTo', 'axis', 'evaluatedBy', 'providers', 'combine', 'legacyTokens', 'description', 'findingKinds', 'criteria', 'ciColumn')
|    foreach ($k in $fill) {
|        if ($o.Contains($k)) { continue }
|        if ($Shipped -and $Shipped.PSObject.Properties[$k]) { $o[$k] = $Shipped.$k }
|    }
|    if (-not $o.Contains('shortName')) { $o['shortName'] = ConvertTo-SIProPascalName $id }
|    if (-not $o.Contains('class')) { $o['class'] = 'optional' }
|    if (-not $o.Contains('group')) { $o['group'] = $(if ([string]$o['appliesTo'] -eq 'finding') { 'Severity' } else { 'Exposure' }) }
|    # a value equal to the 1.0.0 default takes the new shipped value; the customer's own value is kept
|    $imp = $null; if ($o.Contains('impact')) { $imp = ConvertTo-SINumberOrNull $o['impact'] }
|    $v1Imp = $null; if ($V1) { $v1Imp = ConvertTo-SINumberOrNull $V1.impact }
|    if ($Shipped -and ($null -eq $imp -or ($null -ne $v1Imp -and $imp -eq $v1Imp))) { $o['impact'] = [int]$Shipped.impact }
|    elseif ($null -eq $imp) { $o['impact'] = 1 }
|    else {
|        $n = [int][Math]::Round($imp); if ($n -lt 1) { $n = 1 }; if ($n -gt 5) { $n = 5 }
|        if ($n -ne $imp) { $notes.Add(("{0}: impact {1} held to {2} (1..5)" -f $id, $imp, $n)) }
|        $o['impact'] = $n
|    }
|    if ($Shipped -and $V1 -and [string]$o['name'] -ceq [string]$V1.name) { $o['name'] = [string]$Shipped.name }
|    if (-not ([string]$o['name']).Trim()) { if ($Shipped) { $o['name'] = [string]$Shipped.name } else { $o['name'] = $id } }
|    return @{ Body = $o; Notes = $notes.ToArray() }
|}
|
|function Test-SIProFactorBodyIsV2 {
|    <# PURE. $true when a factor body already carries the v2 shape (state, shortName, group, class; no stage). #>
|    param($Body)
|    if ($null -eq $Body) { return $true }
|    foreach ($k in 'state', 'shortName', 'group', 'class') { if (-not $Body.PSObject.Properties[$k]) { return $false } }
|    return (-not $Body.PSObject.Properties['stage'])
|}
|
|function Get-SIProOverrideMigrationPlan {
|    <#
|    .SYNOPSIS  PURE. The overrides that need the v2 shape -> the actions: @{ Kind; OldKey; NewKey; State; Body (text or $null);
|               Format; BaseHash; BaseVersion; Action = move | rewrite | remove; Reason }. Rows already in the v2 shape give none.
|    .PARAMETER Overrides       cfg.ItemOverride rows (Kind, ItemKey, State, BodyJson, Format, BaseVersion, BaseHash)
|    .PARAMETER Translation     the shipped translation table (Get-SIProOverrideTranslation)
|    .PARAMETER ShippedFactors  the shipped v2 factors (data-model\risk-factors.locked.json .factors)
|    .PARAMETER TemplateHashes  '<kind>/<key>' -> the shipped template's content hash (the new BaseHash of a moved row)
|    #>
|    param([AllowEmptyCollection()][object[]]$Overrides = @(), [Parameter(Mandatory)]$Translation, [AllowEmptyCollection()][object[]]$ShippedFactors = @(),
|          [hashtable]$TemplateHashes = @{})
|    $tr = @{ columns = [ordered]@{}; values = @{} }
|    foreach ($p in $Translation.columns.PSObject.Properties) { $tr.columns[$p.Name] = [string]$p.Value }
|    foreach ($p in $Translation.values.PSObject.Properties) { $m = @{}; foreach ($q in $p.Value.PSObject.Properties) { $m[$q.Name.ToLowerInvariant()] = [string]$q.Value }; $tr.values[$p.Name] = $m }
|    $v1 = @{}; $removed = @{}
|    if ($Translation.PSObject.Properties['riskFactorsV1']) {
|        foreach ($p in $Translation.riskFactorsV1.factors.PSObject.Properties) { $v1[$p.Name] = $p.Value }
|        foreach ($p in $Translation.riskFactorsV1.removed.PSObject.Properties) { $removed[$p.Name] = [string]$p.Value }
|    }
|    $shipped = @{}; foreach ($f in $ShippedFactors) { if ($f -and $f.id) { $shipped[[string]$f.id] = $f } }
|    $have = @{}; foreach ($o in $Overrides) { $have[('{0}/{1}' -f (Get-SIProRowValue $o 'Kind'), (Get-SIProRowValue $o 'ItemKey'))] = $true }
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($o in $Overrides) {
|        $kind = [string](Get-SIProRowValue $o 'Kind'); $key = [string](Get-SIProRowValue $o 'ItemKey'); $state = [string](Get-SIProRowValue $o 'State')
|        $bodyText = [string](Get-SIProRowValue $o 'BodyJson'); $fmt = [string](Get-SIProRowValue $o 'Format'); if (-not $fmt) { $fmt = 'json' }
|        $bv = [string](Get-SIProRowValue $o 'BaseVersion'); $bh = [string](Get-SIProRowValue $o 'BaseHash')
|        if ($kind -eq 'riskindex') {
|            $nk = ConvertTo-SIProRiskIndexSiKey -Key $key -Translation $tr
|            $body = $null; $isOld = $false
|            if ($bodyText) { try { $body = $bodyText | ConvertFrom-Json } catch { $body = $null }; if ($body) { $isOld = Test-SIRiskIndexV22Form @($body) } }
|            if (-not $nk -and -not $isOld) { continue }
|            if (-not $nk) { $nk = $key }
|            $newBody = $null
|            if ($state -eq 'override' -and $body) {
|                $si = ConvertTo-SIRiskIndexSiRow -Row $body -Translation $tr
|                # an item keeps its place: Precedence travels as it was stored
|                if ($body.PSObject.Properties['Precedence']) { $si['Precedence'] = [string]$body.Precedence }
|                $newBody = ConvertTo-Json -InputObject ([pscustomobject]$si) -Compress
|                # the key is made of the translated body's dimensions (a repeat keeps its '#n')
|                $sfx = ''; $mm = [regex]::Match($key, '#\d+$'); if ($mm.Success) { $sfx = $mm.Value }
|                $nk = 'row/' + ((@('si_finding_type', 'si_category', 'si_subcategory', 'si_component', 'si_finding_key', 'asset_class', 'si_severity', 'si_tier') | ForEach-Object { ([string]$si[$_]).Trim() }) -join '|') + $sfx
|            }
|            if ($nk -ne $key -and $have.ContainsKey('riskindex/' + $nk)) {
|                $out.Add([pscustomobject]@{ Kind = $kind; OldKey = $key; NewKey = $nk; State = 'inherit'; Body = $null; Format = $fmt; BaseHash = $null; BaseVersion = $null; Action = 'remove'
|                        Reason = ("the risk index row {0} is already overridden under its new key {1} -- that one is kept, the old row removed" -f $key, $nk) })
|                continue
|            }
|            $nh = $bh; if ($TemplateHashes.ContainsKey('riskindex/' + $nk)) { $nh = [string]$TemplateHashes['riskindex/' + $nk] }
|            $out.Add([pscustomobject]@{ Kind = $kind; OldKey = $key; NewKey = $nk; State = $state; Body = $newBody; Format = $fmt; BaseHash = $nh; BaseVersion = $bv
|                    Action = $(if ($nk -eq $key) { 'rewrite' } else { 'move' }); Reason = ("risk index row keyed by the SI fields (was {0})" -f $key) })
|            continue
|        }
|        if ($kind -ne 'datamodel' -or $key -notmatch '^risk-factors:(.+)$') { continue }
|        $id = $Matches[1]
|        if ($removed.ContainsKey($id)) {
|            $out.Add([pscustomobject]@{ Kind = $kind; OldKey = $key; NewKey = $key; State = 'inherit'; Body = $null; Format = $fmt; BaseHash = $null; BaseVersion = $null; Action = 'remove'
|                    Reason = ("risk factor {0} no longer exists (replaced by {1}) -- your override of it is removed" -f $id, $removed[$id]) })
|            continue
|        }
|        $sf = $null; if ($shipped.ContainsKey($id)) { $sf = $shipped[$id] }
|        if ($state -eq 'disable') {
|            if ($sf -and [string]$sf.class -ne 'optional') {
|                $out.Add([pscustomobject]@{ Kind = $kind; OldKey = $key; NewKey = $key; State = 'inherit'; Body = $null; Format = $fmt; BaseHash = $null; BaseVersion = $null; Action = 'remove'
|                        Reason = ("risk factor {0} is built-in and cannot be switched off -- your 'disable' is removed (lower its impact instead)" -f $id) })
|            }
|            continue
|        }
|        if ($state -ne 'override' -or -not $bodyText) { continue }
|        $body = $null; try { $body = $bodyText | ConvertFrom-Json } catch { continue }
|        if (Test-SIProFactorBodyIsV2 $body) { continue }
|        $vv = $null; if ($v1.ContainsKey($id)) { $vv = $v1[$id] }
|        $c = ConvertTo-SIProFactorV2Body -Override $body -Shipped $sf -V1 $vv
|        $nh = $bh; if ($TemplateHashes.ContainsKey('datamodel/' + $key)) { $nh = [string]$TemplateHashes['datamodel/' + $key] }
|        $why = 'risk factor override in the model v2 shape (your values kept)'
|        if (@($c.Notes).Count) { $why = $why + ' -- ' + (@($c.Notes) -join '; ') }
|        $out.Add([pscustomobject]@{ Kind = $kind; OldKey = $key; NewKey = $key; State = 'override'; Body = (ConvertTo-Json -InputObject ([pscustomobject]$c.Body) -Compress -Depth 30); Format = $fmt
|                BaseHash = $nh; BaseVersion = $bv; Action = 'rewrite'; Reason = $why })
|    }
|    return $out.ToArray()
|}
|
|function Resolve-SIProRunOverrides {
|    <#
|    .SYNOPSIS  RUN START: the stored cfg.ItemOverride rows with every row from the PREVIOUS model translated IN MEMORY for this
|               run (the same plan the update applies -- Get-SIProOverrideMigrationPlan). Nothing is written: the update's
|               Invoke-SIProOverrideMigration stores it. A row the plan removes (a removed factor, a 'disable' of a built-in
|               factor, an old risk index row the customer already redid) is left out; a moved / rewritten row takes its new
|               key / body. Returns @{ Overrides; Notes (one per item) }. NEVER THROWS: without the translation table the rows
|               come back as stored (each then validated as usual -- one that does not validate is left out by the caller).
|    #>
|    param([AllowEmptyCollection()][object[]]$Overrides = @(), [Parameter(Mandatory)][string]$SIRoot, $Translation, [AllowEmptyCollection()][object[]]$ShippedFactors)
|    $rows = @($Overrides | Where-Object { $_ })
|    $notes = New-Object System.Collections.Generic.List[string]
|    if (-not $rows.Count) { return [pscustomobject]@{ Overrides = @(); Notes = @() } }
|    try {
|        if (-not $Translation) { $Translation = Get-SIProOverrideTranslation -SIRoot $SIRoot }
|        if ($null -eq $ShippedFactors) { $ShippedFactors = @(([System.IO.File]::ReadAllText([System.IO.Path]::Combine($SIRoot, 'data-model', 'risk-factors.locked.json')) | ConvertFrom-Json).factors) }
|        $plan = @(Get-SIProOverrideMigrationPlan -Overrides $rows -Translation $Translation -ShippedFactors @($ShippedFactors))
|    } catch {
|        return [pscustomobject]@{ Overrides = $rows; Notes = @(("your overrides from the previous model could not be translated for this run ({0}) -- they are read as stored" -f $_.Exception.Message)) }
|    }
|    if (-not $plan.Count) { return [pscustomobject]@{ Overrides = $rows; Notes = @() } }
|    $byOld = @{}; foreach ($a in $plan) { $byOld[('{0}/{1}' -f $a.Kind, $a.OldKey)] = $a }
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($o in $rows) {
|        $k = '{0}/{1}' -f (Get-SIProRowValue $o 'Kind'), (Get-SIProRowValue $o 'ItemKey')
|        if (-not $byOld.ContainsKey($k)) { $out.Add($o); continue }
|        $a = $byOld[$k]
|        if ($a.Action -eq 'remove') { $notes.Add(("{0}: {1} (for this run; the next update stores it)" -f $k, $a.Reason)); continue }
|        $out.Add([pscustomobject]@{ Kind = $a.Kind; ItemKey = $a.NewKey; State = $a.State
|                BodyJson = $(if ($null -ne $a.Body) { [string]$a.Body } else { Get-SIProRowValue $o 'BodyJson' }); Format = $a.Format
|                BaseVersion = $a.BaseVersion; BaseHash = $a.BaseHash })
|        $notes.Add(("{0}: {1} -- translated for this run (the next update stores it)" -f $k, $a.Reason))
|    }
|    return [pscustomobject]@{ Overrides = $out.ToArray(); Notes = $notes.ToArray() }
|}
|
|function Invoke-SIProOverrideMigration {
|    <#
|    .SYNOPSIS  Applies Get-SIProOverrideMigrationPlan to the install's cfg.ItemOverride rows (see the header). Returns
|               @{ Applied = actions written; Refused = @{ Action; Reason } (left as they were); Plan }. -WhatIf: plan only.
|    #>
|    [CmdletBinding(SupportsShouldProcess)]
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$SIRoot, [AllowEmptyCollection()][object[]]$Templates = @(), [string]$ChangedBy = 'SecurityInsight update')
|    $ov = @(Read-SIProItemOverrides -Store $Store)
|    $tr = Get-SIProOverrideTranslation -SIRoot $SIRoot
|    $sf = @(([System.IO.File]::ReadAllText([System.IO.Path]::Combine($SIRoot, 'data-model', 'risk-factors.locked.json')) | ConvertFrom-Json).factors)
|    $hashes = @{}
|    foreach ($t in $Templates) { $k = '{0}/{1}' -f (Get-SIProRowValue $t 'Kind'), (Get-SIProRowValue $t 'ItemKey'); if (-not $hashes.ContainsKey($k)) { try { $hashes[$k] = Get-SIProRowContentHash $t } catch { } } }
|    $plan = @(Get-SIProOverrideMigrationPlan -Overrides $ov -Translation $tr -ShippedFactors $sf -TemplateHashes $hashes)
|    $applied = New-Object System.Collections.Generic.List[object]; $refused = New-Object System.Collections.Generic.List[object]
|    if ($plan.Count -eq 0 -or $WhatIfPreference) { return [pscustomobject]@{ Applied = @(); Refused = @(); Plan = $plan } }
|    $ctx = Get-SIProConfigContext -SIRoot $SIRoot
|    foreach ($a in $plan) {
|        try {
|            if ($a.Action -eq 'remove') {
|                Set-SIProItem -Store $Store -Kind $a.Kind -Key $a.OldKey -State inherit -ChangedBy $ChangedBy -Reason $a.Reason -Context $ctx
|            } else {
|                # the new row first (validated -- a refusal leaves the old row as it was), then the old key goes
|                Set-SIProItem -Store $Store -Kind $a.Kind -Key $a.NewKey -State $a.State -Body $a.Body -Format $a.Format -BaseVersion $a.BaseVersion -BaseHash $a.BaseHash -ChangedBy $ChangedBy -Reason $a.Reason -Context $ctx
|                if ($a.NewKey -ne $a.OldKey) { Set-SIProItem -Store $Store -Kind $a.Kind -Key $a.OldKey -State inherit -ChangedBy $ChangedBy -Reason ('moved to ' + $a.NewKey) -Context $ctx }
|            }
|            $applied.Add($a)
|        } catch { $refused.Add([pscustomobject]@{ Action = $a; Reason = $_.Exception.Message }) }
|    }
|    return [pscustomobject]@{ Applied = $applied.ToArray(); Refused = $refused.ToArray(); Plan = $plan }
|}
'@ }
$__siSupportFiles['data-model/risk-factors.locked.json'] = @{ Sha256 = '86f989c3f2b9377d0ed88d464fac90feb90637e73f4c4d7a63c2f69ef7886554'; Text = @'
|{
|  "$comment": "SecurityInsight risk-factor catalog -- risk factor model v2 (REQUIREMENTS #559, owner 2026-10-10: \"everything is a risk factor\", \"each of the risk factors will be linked to an risk score impact value (1-5)\", \"Sum, no cap\"). Template kind: risk-factor. Each factor is defined ONCE over SI fields (never provider fields) and carries: shortName = the name reports, Excel, PDF and mails show (PascalCase, precise wording, no editable number in it); name = its description in the GUI; appliesTo = asset (evaluated on the CI; adds to the ASSET side of the score) or finding (evaluated on the de-duplicated finding; adds to the VULNERABILITY side), never both; group = Exposure, Device health, Identity, Privilege, Apps, Importance, Exploitability, Impact, Severity or Lifecycle; class = builtin (always on: the engine refuses to switch it off, the web app too) or optional (the customer may switch it off); impact = 1..5 (very low .. very high), what the factor ADDS to its side of the score; state = enabled | disabled (a builtin factor is never disabled). THE SCORE: asset side = the risk index base (by finding x asset class x tier) + the SUM of the enabled asset factors' impacts; vulnerability side = the risk index base (by finding type / category / subcategory / severity) + the SUM of the enabled finding factors' impacts; no cap; risk score = asset side x vulnerability side (engine/risk-analysis/_shared/RA-RiskScore.ps1). axis = the report column the factor's short name is listed in (probability = RiskFactor_Probability_Detailed, consequence = RiskFactor_Consequence_Detailed) -- kept for the reports' CI blocks (si_rf_p / si_rf_c); the score side is appliesTo, never axis. Tier is never a factor (the risk index carries it); break glass is a classification (data-model list break_glass_patterns), not a factor. legacyTokens = the RF_* names / engine tokens this factor replaces, so the reports' tokens map to it and one factor counts once. evaluatedBy: catalog (this file decides) or report (computed inside one report's query). description = what the factor means to a person; combine = how its conditions join (any / all); providers = the provider fields that PROVE it, per provider, read from the field mappings (data-model/mappings) -- generated by Update-SIRiskFactorProviders (engine/data-model/SI-RiskFactorCatalog.ps1) and proven equal to the mappings by a test, never hand-edited; ciColumn = the factor gets its own SI_CI_CL column si_rf_<id>. A factor whose SI field is not mapped yet stays UNKNOWN (never a finding, #546). Customer overrides: risk-factors.custom.json (Pro: cfg.ItemOverride), per factor id -- impact, state (optional factors only) and the criteria (wizards).",
|  "kind": "risk-factor",
|  "version": "2.0.0",
|  "groups": ["Exposure", "Device health", "Identity", "Privilege", "Apps", "Importance", "Exploitability", "Impact", "Severity", "Lifecycle"],
|  "conditionOps": ["eq", "ne", "in", "not_in", "is_true", "is_false", "is_empty", "not_empty", "gt", "gte", "lt", "lte", "like", "contains", "contains_any", "matches", "older_than_days", "newer_than_days", "in_ranges", "in_list"],
|  "factors": [
|    { "id": "internet_exposed", "shortName": "InternetExposed", "name": "The asset can be reached from the internet", "appliesTo": "asset", "group": "Exposure", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"azure":[{"siField":"si_internet_exposed","sources":["derived.isPubliclyExposed"],"recordTypes":["azure_resource"]}],"eg":[{"siField":"si_internet_exposed","sources":["node.NodeProperties.rawData.exposedToInternet.type","node.NodeProperties.rawData.hasInternetExposureSignal"],"recordTypes":["device","azure_resource","public_ip"]}],"mdc":[{"siField":"si_internet_exposed","sources":["exposure.internetExposed"],"recordTypes":["azure_resource"]}],"mde":[{"siField":"si_ip_addresses","sources":["machine.ipAddresses[*].ipAddress","machine.lastIpAddress"],"recordTypes":["device"]},{"siField":"si_internet_exposed","sources":["deviceInfo.IsInternetFacing"],"recordTypes":["device"]}],"servicenow":[{"siField":"si_ip_addresses","sources":["ci.ip_address"],"recordTypes":["cmdb_ci"]}],"shodan":[{"siField":"si_internet_exposed","sources":["host.ports"],"recordTypes":["public_ip"]}],"network":[{"siField":"si_ip_addresses","list":"internet_exposed_ranges","setting":"SI_InternetExposedRanges"}]},
|      "description": "The asset can be reached from the internet: any provider says so (Defender for Endpoint internet-facing, Exposure Graph exposure, the Azure public-exposure derivation, Shodan open ports), or one of its addresses is in the customer's exposed network ranges (DMZ, online landing zones).", "combine": "any", "ciColumn": true,
|      "legacyTokens": ["RF_P_InternetExposed", "RF_P_Internet", "InternetExposureSignal", "InternetFacingDevice"],
|      "when": {"any":[{"field":"si_internet_exposed","op":"is_true"},{"field":"si_ip_addresses","op":"in_ranges","value":"internet_exposed_ranges"}]} },
|    { "id": "high_risk_port_open", "shortName": "PortOpenInternet", "name": "An administrative or database port is open to the internet", "appliesTo": "asset", "group": "Exposure", "class": "builtin", "impact": 5, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"shodan":[{"siField":"si_open_ports","sources":["host.ports[*]"],"recordTypes":["public_ip"]}]},
|      "description": "An administrative or database port is open to the internet (Shodan).", "combine": "all",
|      "legacyTokens": ["RF_P_HighRiskPort", "AdminPort"],
|      "when": {"all":[{"field":"si_open_ports","op":"contains_any","value":"high_risk_ports"}]} },
|    { "id": "compromised_recently", "shortName": "RecentIncident", "name": "The asset was involved in a recent incident", "appliesTo": "asset", "group": "Exposure", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_is_compromised_recently","sources":["node.NodeProperties.rawData.isCompromisedRecently"],"recordTypes":["device","user","service_principal","azure_resource"]}]},
|      "description": "The asset was involved in a recent incident (Exposure Graph).", "combine": "all",
|      "legacyTokens": ["IsCompromisedRecently"],
|      "when": {"all":[{"field":"si_is_compromised_recently","op":"is_true"}]} },
|    { "id": "unsupported_os", "shortName": "UnsupportedOS", "name": "The operating system is out of vendor security support", "appliesTo": "asset", "group": "Device health", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"ad":[{"siField":"si_os_name","sources":["computer.operatingSystem"],"recordTypes":["device"]},{"siField":"si_os_platform","sources":["computer.operatingSystem"],"recordTypes":["device"]},{"siField":"si_os_version","sources":["computer.operatingSystemVersion"],"recordTypes":["device"]}],"azure":[{"siField":"si_os_platform","sources":["resource.properties.storageProfile.osDisk.osType"],"recordTypes":["azure_resource"]}],"eg":[{"siField":"si_os_name","sources":["node.NodeProperties.rawData.osPlatform","node.NodeProperties.rawData.osDistribution"],"recordTypes":["device"]},{"siField":"si_os_platform","sources":["node.NodeProperties.rawData.osPlatform"],"recordTypes":["device"]},{"siField":"si_os_version","sources":["node.NodeProperties.rawData.osVersion"],"recordTypes":["device"]}],"entra":[{"siField":"si_os_name","sources":["device.operatingSystem"],"recordTypes":["device"]},{"siField":"si_os_platform","sources":["device.operatingSystem"],"recordTypes":["device"]},{"siField":"si_os_version","sources":["device.operatingSystemVersion"],"recordTypes":["device"]}],"intune":[{"siField":"si_os_name","sources":["device.operatingSystem"],"recordTypes":["device"]},{"siField":"si_os_platform","sources":["device.operatingSystem"],"recordTypes":["device"]},{"siField":"si_os_version","sources":["device.osVersion"],"recordTypes":["device"]}],"mde":[{"siField":"si_os_name","sources":["machine.osPlatform","deviceInfo.OSPlatform"],"recordTypes":["device"]},{"siField":"si_os_platform","sources":["machine.osPlatform","deviceInfo.OSPlatform"],"recordTypes":["device"]},{"siField":"si_os_version","sources":["machine.osVersion","machine.version","deviceInfo.OSVersion"],"recordTypes":["device"]}]},
|      "criteria": {"kind": "list", "list": "unsupported_os", "field": "si_os_name", "detailField": "si_os_version", "source": "collected"},
|      "description": "The operating system is out of vendor security support (the unsupported_os list, matched on the OS name every device provider reports).", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_LegacyEoS", "LegacyEndOfSupport"],
|      "when": {"all":[{"field":"si_os_version","op":"in_list","value":"unsupported_os"}]} },
|    { "id": "not_onboarded", "shortName": "NotOnboarded", "name": "The device is seen but not onboarded to Defender for Endpoint", "appliesTo": "asset", "group": "Device health", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_onboarding_status","sources":["node.NodeProperties.rawData.onboardingStatus"],"recordTypes":["device"]}],"mde":[{"siField":"si_onboarding_status","sources":["machine.onboardingStatus","deviceInfo.OnboardingStatus"],"recordTypes":["device"]}]},
|      "description": "The device is seen but not onboarded to Defender for Endpoint.", "combine": "all",
|      "legacyTokens": ["Unonboarded"],
|      "when": {"all":[{"field":"si_onboarding_status","op":"not_empty"},{"field":"si_onboarding_status","op":"ne","value":"onboarded"}]} },
|    { "id": "antivirus_disabled", "shortName": "AVDisabled", "name": "Microsoft Defender Antivirus is disabled", "appliesTo": "asset", "group": "Device health", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"mde":[{"siField":"si_av_status","sources":["deviceInfo.DefenderAvStatus","machine.defenderAvStatus"],"recordTypes":["device"]}]},
|      "description": "Microsoft Defender Antivirus is disabled.", "combine": "all",
|      "legacyTokens": ["DefenderAvDisabled"],
|      "when": {"all":[{"field":"si_av_status","op":"eq","value":"disabled"}]} },
|    { "id": "antivirus_out_of_date", "shortName": "AVOutOfDate", "name": "Microsoft Defender Antivirus signatures are out of date", "appliesTo": "asset", "group": "Device health", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"mde":[{"siField":"si_av_status","sources":["deviceInfo.DefenderAvStatus","machine.defenderAvStatus"],"recordTypes":["device"]}]},
|      "description": "Microsoft Defender Antivirus signatures are out of date.", "combine": "all",
|      "legacyTokens": ["DefenderAvOutOfDate"],
|      "when": {"all":[{"field":"si_av_status","op":"eq","value":"out_of_date"}]} },
|    { "id": "excluded_from_defender", "shortName": "DefenderExcluded", "name": "The device is excluded in Defender", "appliesTo": "asset", "group": "Device health", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"mde":[{"siField":"si_is_excluded","sources":["machine.isExcluded","deviceInfo.IsExcluded"],"recordTypes":["device"]}]},
|      "description": "The device is excluded in Defender.", "combine": "all",
|      "legacyTokens": ["Excluded"],
|      "when": {"all":[{"field":"si_is_excluded","op":"is_true"}]} },
|    { "id": "high_machine_risk", "shortName": "HighMachineRisk", "name": "Defender for Endpoint rates the machine's risk high", "appliesTo": "asset", "group": "Device health", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_machine_risk","sources":["node.NodeProperties.rawData.machineRiskState"],"recordTypes":["device"]}],"mde":[{"siField":"si_machine_risk","sources":["machine.riskScore"],"recordTypes":["device"]}]},
|      "description": "Defender for Endpoint rates the machine's risk high.", "combine": "all",
|      "legacyTokens": ["HighMachineRisk", "RF_P_HighRiskDevice", "DeviceHighRiskScore"],
|      "when": {"all":[{"field":"si_machine_risk","op":"eq","value":"high"}]} },
|    { "id": "unmanaged", "shortName": "Unmanaged", "name": "No management agent manages the device", "appliesTo": "asset", "group": "Device health", "class": "optional", "impact": 2, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"intune":[{"siField":"si_managed_by","sources":["device.managementAgent"],"recordTypes":["device"]}],"mde":[{"siField":"si_managed_by","sources":["machine.managedBy","deviceInfo.DeviceManagementType"],"recordTypes":["device"]}]},
|      "description": "No management agent manages the device.", "combine": "all",
|      "legacyTokens": ["Unmanaged"],
|      "when": {"all":[{"field":"si_managed_by","op":"eq","value":"unmanaged"}]} },
|    { "id": "no_mfa", "shortName": "NoMFA", "name": "A user or guest with no MFA method registered", "appliesTo": "asset", "group": "Identity", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_mfa_registered","sources":["node.NodeProperties.rawData.isMfaRegistered"],"recordTypes":["user"]}],"entra":[{"siField":"si_mfa_registered","sources":["registration.isMfaRegistered"],"recordTypes":["user"]}]},
|      "description": "A user or guest with no MFA method registered (Entra registration details, else the Exposure Graph identity node). A registration that could not be read is unknown, never \"no MFA\".", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_NoMFA", "NoMfaIsRegistered"],
|      "when": {"all":[{"field":"si_identity_type","op":"in","value":["user","guest"]},{"field":"si_mfa_registered","op":"is_false"}]} },
|    { "id": "old_password", "shortName": "OldPassword", "name": "The password of a user or guest has not been changed for a long time", "appliesTo": "asset", "group": "Identity", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"ad":[{"siField":"si_password_last_changed","sources":["user.pwdLastSet"],"recordTypes":["user"]}],"eg":[{"siField":"si_password_last_changed","sources":["node.NodeProperties.rawData"],"recordTypes":["user"]}],"entra":[{"siField":"si_password_last_changed","sources":["user.lastPasswordChangeDateTime"],"recordTypes":["user"]},{"siField":"si_password_last_changed","sources":["profile.LastPasswordChangeDateTime"],"recordTypes":["user"]}]},
|      "criteria": {"kind": "threshold", "field": "si_password_last_changed", "op": "older_than_days", "min": 30, "max": 3650, "unit": "days", "source": "enum"},
|      "description": "The password of a user or guest has not been changed for a year: si_password_last_changed by the field authority of the identity's origin (a synchronised account: Active Directory pwdLastSet, never Entra; a cloud-only one: Entra). A password age that was never read, or that the authoritative provider did not report, is unknown -- never old.", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_OldPassword", "PasswordOver365Days", "PasswordOver730Days"],
|      "when": {"all":[{"field":"si_identity_type","op":"in","value":["user","guest"]},{"field":"si_password_last_changed","op":"older_than_days","value":365}]} },
|    { "id": "leaked_credentials", "shortName": "LeakedCreds", "name": "Credentials of the identity were found leaked", "appliesTo": "asset", "group": "Identity", "class": "builtin", "impact": 5, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_has_leaked_credentials","sources":["node.NodeProperties.rawData.hasLeakedCredentials","node.NodeProperties.rawData.hasAdLeakedCredentials"],"recordTypes":["user"]}]},
|      "$note": "new in 3.1 -- enters as testing (counts 0) until promoted",
|      "description": "Credentials of the identity were found leaked (Exposure Graph).", "combine": "all",
|      "legacyTokens": [],
|      "when": {"all":[{"field":"si_has_leaked_credentials","op":"is_true"}]} },
|    { "id": "identity_at_risk", "shortName": "IdentityAtRisk", "name": "Defender for Identity rates the identity at risk", "appliesTo": "asset", "group": "Identity", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"mdi":[{"siField":"si_mdi_risk_state","sources":["identity.riskState","identity.RiskStatus","identity.RiskLevel"],"recordTypes":["user"]}]},
|      "description": "Defender for Identity rates the identity at risk.", "combine": "all",
|      "legacyTokens": ["RF_P_AtRisk", "RF_P_HighRisk", "MDI_AtRisk"],
|      "when": {"all":[{"field":"si_mdi_risk_state","op":"in","value":["at_risk","high"]}]} },
|    { "id": "identity_high_blast_radius", "shortName": "HighBlastRadius", "name": "Defender for Identity rates the identity's blast radius high", "appliesTo": "asset", "group": "Importance", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"mdi":[{"siField":"si_mdi_blast_radius","sources":["identity.BlastRadius","identity.blastRadius"],"recordTypes":["user"]}]},
|      "description": "Defender for Identity rates the identity's blast radius high.", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_HighBlastRadius"],
|      "when": {"all":[{"field":"si_mdi_blast_radius","op":"eq","value":"high"}]} },
|    { "id": "stale_sign_in", "shortName": "EnabledNoSignInStale", "name": "An enabled identity with no sign-in for a long time (days editable)", "appliesTo": "asset", "group": "Lifecycle", "class": "optional", "impact": 2, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"ad":[{"siField":"si_account_enabled","sources":["computer.userAccountControl","user.userAccountControl"],"recordTypes":["device","user"]},{"siField":"si_last_sign_in","sources":["user.lastLogonTimestamp"],"recordTypes":["user"]}],"eg":[{"siField":"si_account_enabled","sources":["node.NodeProperties.rawData.accountEnabled","node.NodeProperties.rawData.isEnabled"],"recordTypes":["user","service_principal"]}],"entra":[{"siField":"si_account_enabled","sources":["user.accountEnabled"],"recordTypes":["user"]},{"siField":"si_last_sign_in","sources":["user.signInActivity.lastSuccessfulSignInDateTime","user.signInActivity.lastSignInDateTime","user.signInActivity.lastNonInteractiveSignInDateTime"],"recordTypes":["user"]},{"siField":"si_account_enabled","sources":["sp.accountEnabled"],"recordTypes":["service_principal"]},{"siField":"si_last_sign_in","sources":["signIn.lastSignInActivity.lastSignInDateTime"],"recordTypes":["service_principal"]},{"siField":"si_account_enabled","sources":["device.accountEnabled"],"recordTypes":["device"]},{"siField":"si_last_sign_in","sources":["profile.LastSignInDateTime"],"recordTypes":["user","service_principal"]}],"mdi":[{"siField":"si_account_enabled","sources":["identity.IsAccountEnabled"],"recordTypes":["user"]},{"siField":"si_last_sign_in","sources":["identity.lastSeenActivity"],"recordTypes":["user"]}]},
|      "criteria": {"kind": "threshold", "field": "si_last_sign_in", "op": "older_than_days", "min": 7, "max": 3650, "unit": "days", "source": "enum"},
|      "$note": "today the reports use 90 or 180 days; one definition now (90)",
|      "description": "An ENABLED identity with no sign-in for 90 days (editable) -- identities only: a device or resource has no sign-in. The newest sign-in the providers authoritative for the identity's origin report (a synchronised account: Active Directory / Defender for Identity, with Entra; a cloud-only one: Entra). One stale factor: the days are the criteria (the former \"no sign-in for a year\" is this factor with more days). No sign-in recorded is NeverSignedIn; a sign-in or an enabled state the CI cannot decide is unknown, never stale.", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_Stale", "RF_P_StaleLogin", "StaleLastLogin", "StaleLastSignIn", "RF_P_VeryStale", "StaleOver365Days", "NoSignInStale", "NoSignInVeryStale"],
|      "when": {"all":[{"field":"si_identity_type","op":"in","value":["user","guest","service_principal"]},{"field":"si_account_enabled","op":"is_true"},{"field":"si_last_sign_in","op":"older_than_days","value":90}]} },
|    { "id": "never_signed_in", "shortName": "NeverSignedIn", "name": "An identity that has never signed in", "appliesTo": "asset", "group": "Lifecycle", "class": "optional", "impact": 2, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"ad":[{"siField":"si_last_sign_in","sources":["user.lastLogonTimestamp"],"recordTypes":["user"]}],"entra":[{"siField":"si_last_sign_in","sources":["user.signInActivity.lastSuccessfulSignInDateTime","user.signInActivity.lastSignInDateTime","user.signInActivity.lastNonInteractiveSignInDateTime"],"recordTypes":["user"]},{"siField":"si_last_sign_in","sources":["signIn.lastSignInActivity.lastSignInDateTime"],"recordTypes":["service_principal"]},{"siField":"si_last_sign_in","sources":["profile.LastSignInDateTime"],"recordTypes":["user","service_principal"]}],"mdi":[{"siField":"si_last_sign_in","sources":["identity.lastSeenActivity"],"recordTypes":["user"]}]},
|      "description": "An identity that has never signed in: the provider that decides the sign-in for the identity's origin is linked and reports none (a synchronised account: Active Directory; a cloud-only one: Entra). Without that provider the sign-in is unknown, never 'never signed in'.", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_NeverLoggedIn", "NeverAuthenticated"],
|      "when": {"all":[{"field":"si_identity_type","op":"in","value":["user","guest","service_principal"]},{"field":"si_last_sign_in","op":"is_empty"}]} },
|    { "id": "old_account", "shortName": "OldAccount", "name": "An identity created long ago (days editable)", "appliesTo": "asset", "group": "Lifecycle", "class": "optional", "impact": 1, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"ad":[{"siField":"si_created","sources":["computer.whenCreated","user.whenCreated"],"recordTypes":["device","user"]}],"azure":[{"siField":"si_created","sources":["resource.properties.timeCreated","resource.properties.creationTime","resource.systemData.createdAt"],"recordTypes":["azure_resource"]}],"entra":[{"siField":"si_created","sources":["user.createdDateTime"],"recordTypes":["user"]},{"siField":"si_created","sources":["device.registrationDateTime","device.createdDateTime"],"recordTypes":["device"]},{"siField":"si_created","sources":["profile.CreatedDateTime","sp.createdDateTime"],"recordTypes":["service_principal"]}]},
|      "criteria": {"kind": "threshold", "field": "si_created", "op": "older_than_days", "min": 1, "max": 3650, "unit": "days", "source": "enum"},
|      "description": "An identity (user, guest or service principal) created more than 90 days ago -- identities only: a device or resource is not an account.", "combine": "all",
|      "legacyTokens": ["RF_P_VeryOld", "AccountOver90DaysOld"],
|      "when": {"all":[{"field":"si_identity_type","op":"in","value":["user","guest","service_principal"]},{"field":"si_created","op":"older_than_days","value":90}]} },
|    { "id": "permanent_privileged_role", "shortName": "PermanentAdmin", "name": "A Tier 0 / Tier 1 role held permanently, not just-in-time", "appliesTo": "asset", "group": "Privilege", "class": "optional", "impact": 2, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"entra":[{"siField":"si_privilege_tier_permanent","sources":["profile.EntraRolesPermanentVerdict_Tier"],"recordTypes":["user","service_principal"]}]},
|      "description": "A Tier 0 / Tier 1 role held permanently (not just-in-time).", "combine": "all",
|      "legacyTokens": ["RF_P_Permanent", "RF_P_AlsoPermanent", "AlsoPermanentAssignment", "PermanentAssignment", "PermanentRole", "PermanentRoleAssignment"],
|      "when": {"all":[{"field":"si_privilege_tier_permanent","op":"lte","value":1}]} },
|    { "id": "has_secret", "shortName": "ClientSecret", "name": "The service principal authenticates with a client secret", "appliesTo": "asset", "group": "Apps", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"entra":[{"siField":"si_has_client_secret","sources":["sp.passwordCredentials[*].keyId","app.passwordCredentials[*].keyId"],"recordTypes":["service_principal"]}]},
|      "description": "The service principal authenticates with a client secret (a password), not only a certificate or a managed identity: a secret leaks more easily.", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_HasSecret", "HasClientSecret"],
|      "when": {"all":[{"field":"si_has_client_secret","op":"is_true"}]} },
|    { "id": "no_owner", "shortName": "NoOwner", "name": "A service principal or application without an owner", "appliesTo": "asset", "group": "Apps", "class": "optional", "impact": 2, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"entra":[{"siField":"si_is_orphan_sp","sources":["derived.ownerCount"],"recordTypes":["service_principal"]},{"siField":"si_is_orphan_sp","sources":["profile.IsOrphanSPN"],"recordTypes":["service_principal"]}]},
|      "description": "A service principal / application with no owner: nobody answers for its credentials and permissions.", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_NoOwner"],
|      "when": {"all":[{"field":"si_is_orphan_sp","op":"is_true"}]} },
|    { "id": "expired_credentials", "shortName": "CredsExpired", "name": "The service principal holds an expired secret or certificate", "appliesTo": "asset", "group": "Apps", "class": "optional", "impact": 2, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"entra":[{"siField":"si_credential_expiry_days","sources":["derived.credentialExpiryDays"],"recordTypes":["service_principal"]},{"siField":"si_credential_expiry_days","sources":["profile.CredentialExpiryDays"],"recordTypes":["service_principal"]}]},
|      "description": "The service principal holds an expired secret or certificate.", "combine": "all",
|      "legacyTokens": ["RF_P_HasExpired", "RF_P_AlreadyExpired", "ExpiredCredential"],
|      "when": {"all":[{"field":"si_credential_expiry_days","op":"lt","value":0}]} },
|    { "id": "expiring_credentials", "shortName": "CredsExpiring", "name": "The service principal has a secret or certificate that expires soon", "appliesTo": "asset", "group": "Apps", "class": "optional", "impact": 1, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"entra":[{"siField":"si_credential_expiry_days","sources":["derived.credentialExpiryDays"],"recordTypes":["service_principal"]},{"siField":"si_credential_expiry_days","sources":["profile.CredentialExpiryDays"],"recordTypes":["service_principal"]}]},
|      "description": "The service principal has a secret or certificate that expires within 30 days (the reports' \"HasSecret\").", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_ExpiresVerySoon", "ExpiresWithin7Days"],
|      "when": {"all":[{"field":"si_credential_expiry_days","op":"gte","value":0},{"field":"si_credential_expiry_days","op":"lte","value":30}]} },
|    { "id": "publisher_not_verified", "shortName": "PublisherUnverified", "name": "The application's publisher is not verified", "appliesTo": "asset", "group": "Apps", "class": "optional", "impact": 1, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"entra":[{"siField":"si_publisher_verified","sources":["sp.verifiedPublisher.verifiedPublisherId"],"recordTypes":["service_principal"]}]},
|      "description": "The application's publisher is not verified.", "combine": "all",
|      "legacyTokens": ["RF_P_NotVerified"],
|      "when": {"all":[{"field":"si_publisher_verified","op":"is_false"}]} },
|    { "id": "multitenant_app", "shortName": "MultiTenantApp", "name": "The application accepts sign-ins from other tenants", "appliesTo": "asset", "group": "Apps", "class": "optional", "impact": 1, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"entra":[{"siField":"si_is_multitenant_app","sources":["app.signInAudience","sp.signInAudience"],"recordTypes":["service_principal"]}]},
|      "description": "The application accepts sign-ins from other tenants.", "combine": "all",
|      "legacyTokens": ["RF_P_MultiTenant"],
|      "when": {"all":[{"field":"si_is_multitenant_app","op":"is_true"}]} },
|    { "id": "production_environment", "shortName": "Production", "name": "The asset is in a production environment", "appliesTo": "asset", "group": "Importance", "class": "builtin", "impact": 3, "state": "enabled", "axis": "consequence", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_is_production","sources":["node.NodeProperties.rawData.isProductionEnvironment"],"recordTypes":["device","azure_resource"]}]},
|      "description": "The asset is in a production environment.", "combine": "all",
|      "legacyTokens": ["IsProductionEnvironment"],
|      "when": {"all":[{"field":"si_is_production","op":"is_true"}]} },
|    { "id": "restricted_data", "shortName": "RestrictedData", "name": "The owning CMDB service holds restricted data", "appliesTo": "asset", "group": "Importance", "class": "builtin", "impact": 4, "state": "enabled", "axis": "consequence", "evaluatedBy": "catalog",
|      "providers": {"cmdb":[{"siField":"si_cmdb_data_sensitivity","sources":["ci.DataSensitivity"],"recordTypes":["cmdb_ci"]}],"servicenow":[{"siField":"si_cmdb_data_sensitivity","sources":["ci.u_data_sensitivity","ci.data_classification"],"recordTypes":["cmdb_ci"]}]},
|      "description": "The owning CMDB service holds restricted data.", "combine": "all",
|      "legacyTokens": ["RestrictedDataAccess"],
|      "when": {"all":[{"field":"si_cmdb_data_sensitivity","op":"in","value":["restricted"]}]} },
|    { "id": "confidential_data", "shortName": "ConfidentialData", "name": "The owning CMDB service holds confidential data", "appliesTo": "asset", "group": "Importance", "class": "builtin", "impact": 3, "state": "enabled", "axis": "consequence", "evaluatedBy": "catalog",
|      "providers": {"cmdb":[{"siField":"si_cmdb_data_sensitivity","sources":["ci.DataSensitivity"],"recordTypes":["cmdb_ci"]}],"servicenow":[{"siField":"si_cmdb_data_sensitivity","sources":["ci.u_data_sensitivity","ci.data_classification"],"recordTypes":["cmdb_ci"]}]},
|      "description": "The owning CMDB service holds confidential data.", "combine": "all",
|      "legacyTokens": ["ConfidentialDataAccess"],
|      "when": {"all":[{"field":"si_cmdb_data_sensitivity","op":"in","value":["confidential"]}]} },
|    { "id": "ms_criticality_high", "shortName": "HighMsCriticality", "name": "Microsoft rates the asset's criticality high or very high", "appliesTo": "asset", "group": "Importance", "class": "builtin", "impact": 3, "state": "enabled", "axis": "consequence", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_ms_criticality","sources":["node.NodeProperties.rawData.criticalityLevel.criticalityLevel","node.NodeProperties.rawData.criticalityLevel"],"recordTypes":["device","user","service_principal","azure_resource"]}]},
|      "description": "Microsoft (Exposure Management) rates the asset's criticality high or very high.", "combine": "all",
|      "legacyTokens": ["MsCriticalityHigh"],
|      "when": {"all":[{"field":"si_ms_criticality","op":"in","value":["high","very_high"]}]} },
|    { "id": "exploit_available", "shortName": "ExploitAvailable", "name": "A public exploit exists for the vulnerability", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Exploitability", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_has_exploit","sources":["node.NodeProperties.rawData.hasExploit"],"recordTypes":["finding"]}],"mde":[{"siField":"si_has_exploit","sources":["kb.IsExploitAvailable"],"recordTypes":["vulnerability"]}],"computed":[{"siField":"si_has_exploit","sources":["A public exploit exists."]}]},
|      "description": "A public exploit exists for the vulnerability (si_has_exploit). A verified exploit, an exploit kit and a zero-day are their own factors (KnownExploited, ExploitKit, ZeroDay) and add their own impact.", "combine": "all",
|      "legacyTokens": ["RF_P_ExploitSignals"],
|      "when": {"all":[{"field":"si_has_exploit","op":"is_true"}]} },
|    { "id": "known_exploited", "shortName": "KnownExploited", "name": "The vulnerability is actively exploited (the exploit is verified)", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Exploitability", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_exploit_verified","sources":["node.NodeProperties.rawData.isExploitVerified"],"recordTypes":["finding"]}],"shodan":[{"siField":"si_exploit_verified","sources":["vuln.verified"],"recordTypes":["vulnerability"]}],"computed":[{"siField":"si_exploit_verified","sources":["The exploit is verified."]}]},
|      "description": "The vulnerability is actively exploited: the provider verified the exploit (si_exploit_verified). Unknown when the source does not carry it.", "combine": "all",
|      "legacyTokens": ["IsExploitVerified", "ExploitVerified"],
|      "when": {"all":[{"field":"si_exploit_verified","op":"is_true"}]} },
|    { "id": "exploit_kit", "shortName": "ExploitKit", "name": "The exploit is in an exploit kit", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Exploitability", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_in_exploit_kit","sources":["node.NodeProperties.rawData.isInExploitKit"],"recordTypes":["finding"]}],"computed":[{"siField":"si_in_exploit_kit","sources":["The exploit is in an exploit kit."]}]},
|      "description": "The exploit is part of an exploit kit (si_in_exploit_kit): attackers without skills can use it.", "combine": "all",
|      "legacyTokens": ["RF_P_InKit", "InExploitKit"],
|      "when": {"all":[{"field":"si_in_exploit_kit","op":"is_true"}]} },
|    { "id": "network_no_user_action", "shortName": "NetworkNoUserAction", "name": "Exploitable over the network with no user action (CVSS AV:N and UI:N)", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Exploitability", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_cvss_vector","sources":["node.NodeProperties.rawData.cvssVector","node.NodeProperties.rawData.cvssV3Vector"],"recordTypes":["finding"]}],"mde":[{"siField":"si_cvss_vector","sources":["kb.CvssVector"],"recordTypes":["vulnerability"]}],"computed":[{"siField":"si_cvss_vector","sources":["The CVSS vector string, when a source gives one."]}]},
|      "description": "The CVSS vector says the vulnerability is exploitable over the network (AV:N) with no user interaction (UI:N) -- si_cvss_vector. Unknown when no vector is known.", "combine": "all",
|      "legacyTokens": [],
|      "when": {"all":[{"field":"si_cvss_vector","op":"matches","value":"(?i)(^|/)AV:N(/|$)"},{"field":"si_cvss_vector","op":"matches","value":"(?i)(^|/)UI:N(/|$)"}]} },
|    { "id": "zero_day", "shortName": "ZeroDay", "name": "A zero-day: no fix is available yet", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Exploitability", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_zero_day","sources":["node.NodeProperties.rawData.isZeroDay"],"recordTypes":["finding"]}],"mdc":[{"siField":"si_fix_available","sources":["assessment.properties.metadata.remediationDescription"],"recordTypes":["assessment"]}],"mde":[{"siField":"si_fix_available","sources":["vuln.RecommendedSecurityUpdate","vuln.RecommendedSecurityUpdateId"],"recordTypes":["vulnerability"]},{"siField":"si_fix_available","sources":["kb.RemediationOptions"],"recordTypes":["configuration"]}],"computed":[{"siField":"si_zero_day","sources":["Zero-day."]},{"siField":"si_fix_available","sources":["A fix exists (the source names a security update or a remediation)."]}]},
|      "description": "A zero-day: the provider marks it as one (si_zero_day), or no fix is available yet (si_fix_available false). Unknown when neither is known.", "combine": "any",
|      "legacyTokens": ["IsZeroDay"],
|      "when": {"any":[{"field":"si_zero_day","op":"is_true"},{"field":"si_fix_available","op":"is_false"}]} },
|    { "id": "remote_code_execution", "shortName": "RCE", "name": "The finding allows remote code execution", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Impact", "class": "builtin", "impact": 4, "state": "enabled", "axis": "consequence", "evaluatedBy": "catalog",
|      "providers": {"computed":[{"siField":"si_remote_code_execution","sources":["The finding allows remote code execution."]}]},
|      "description": "The finding allows remote code execution.", "combine": "all",
|      "legacyTokens": ["RF_C_RemoteCodeExec", "RemoteCodeExecutionRisk"],
|      "when": {"all":[{"field":"si_remote_code_execution","op":"is_true"}]} },
|    { "id": "high_cvss_public_ip", "shortName": "CVSS9Plus", "name": "The vulnerability scores CVSS 9 or higher", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Severity", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_cvss","sources":["node.NodeProperties.rawData.cvssScore"],"recordTypes":["finding"]}],"mde":[{"siField":"si_cvss","sources":["kb.CvssScore"],"recordTypes":["vulnerability"]}],"shodan":[{"siField":"si_cvss","sources":["vuln.cvss"],"recordTypes":["vulnerability"]}],"computed":[{"siField":"si_cvss","sources":["CVSS score."]}]},
|      "description": "The vulnerability scores CVSS 9 or higher, on any asset -- a fact about the finding, not the asset. (The id keeps its historic name: the factor once applied to public IPs only.)", "combine": "all",
|      "legacyTokens": ["RF_P_HighCvss", "CVSS9plus"],
|      "when": {"all":[{"field":"si_cvss","op":"gte","value":9.0}]} },
|    { "id": "overdue", "shortName": "Overdue", "name": "The finding is past its SLA due date", "appliesTo": "finding", "findingKinds": ["vulnerability", "recommendation"], "group": "Lifecycle", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"servicenow":[{"siField":"si_due_date","sources":["item.due_date.value","item.due_date"],"recordTypes":["vulnerable_item"]}],"computed":[{"siField":"si_due_date","sources":["When the finding is due: the ticket's due date (ServiceNow) or the SLA SI derives; unknown otherwise."]}]},
|      "description": "The finding is past its SLA due date (si_due_date). Unknown when no due date is known.", "combine": "all",
|      "legacyTokens": [],
|      "when": {"all":[{"field":"si_due_date","op":"older_than_days","value":0}]} },
|    { "id": "old_vuln", "shortName": "OldVuln", "name": "Published long ago and still open (days editable)", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Lifecycle", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_published","sources":["node.NodeProperties.rawData.publishedDate"],"recordTypes":["finding"]}],"mde":[{"siField":"si_published","sources":["kb.PublishedDate"],"recordTypes":["vulnerability"]}],"computed":[{"siField":"si_published","sources":["When the vulnerability was published (Defender vulnerability management PublishedDate)."]}]},
|      "criteria": {"kind": "threshold", "field": "si_published", "op": "older_than_days", "min": 30, "max": 3650, "unit": "days", "source": "enum"},
|      "description": "The vulnerability was published long ago (180 days by default, editable) and is still open (si_published). Unknown when the publish date is not known.", "combine": "all",
|      "legacyTokens": [],
|      "when": {"all":[{"field":"si_published","op":"older_than_days","value":180}]} },
|    { "id": "report_scoped", "shortName": "ReportFactor", "name": "A factor computed inside one report (its own question)", "appliesTo": "finding", "group": "Impact", "class": "optional", "impact": 1, "state": "enabled", "axis": "probability", "evaluatedBy": "report",
|      "$note": "still defined in the report's own query: they describe the finding's context (sign-in patterns, role writes, rank in the estate), not the asset. Listed so every factor is known; each moves into the catalog when a report needs it on another report too.",
|      "description": "Factors still computed inside one report's own query (sign-in patterns, role writes, rank in the estate): the report's own question, listed so every factor is known. Each is its own factor with this impact; a token keeps the side of the score its report column puts it on (RiskFactor_Probability_Detailed = asset side, RiskFactor_Consequence_Detailed = vulnerability side). Each moves into the catalog when a report needs it on another report too.", "combine": "all",
|      "legacyTokens": ["RF_P_RiskFactorsCount", "RF_P_Frequent", "RF_P_Top5Pct", "RF_P_RecentUse", "RF_P_RecentlyDisabled", "RF_P_NonTrusted", "RF_P_NeverTested", "RF_P_NeverChanged", "RF_P_HasRoleWrite", "RF_P_HasRoles", "RF_P_HasDirWrite", "RF_P_HasDirectoryWrite", "RF_P_AlsoHasDirectoryWrite", "RF_P_AlreadySignedIn", "RF_P_Verified", "RF_P_MultipleSignins", "RF_P_MultipleIPs", "RF_P_MultiCountry", "RF_P_DeviceTier2Plus", "RF_P_ExcessiveCount", "RF_P_HasCVEs", "IsExchangeOnlineMailbox"],
|      "when": { "all": [] } }
|  ]
|}
'@ }
$__siSupportFiles['engine/risk-analysis/_shared/RA-RiskIndexFiles.ps1'] = @{ Sha256 = '8af4e737c44102681ac1f31e6183549def441334d2199dd2dd69352e44990b9d'; Text = @'
|#######################################################################################################
|#  SecurityInsight - Risk Analysis engine
|#  WHICH RISK INDEX FILES A RUN READS -- the locked + custom model (#398).
|#
|#    risk-analysis-detection\riskscore.index.locked.csv         SHIPPED. Replaced by every update.
|#    risk-analysis-detection\riskscore.index.custom.csv         YOURS. Never shipped, never replaced. Optional.
|#    risk-analysis-detection\riskscore.index.custom.sample.csv  SHIPPED. A starting point for your own rows.
|#
|#  Your rows (custom) are checked FIRST, then the shipped rows -- first match wins (RA-RiskIndexOrder.ps1). A row of
|#  yours therefore wins over a shipped row it fits the same findings as; a finding none of your rows fits is scored
|#  by the shipped index. Your file may be a few rows or a whole index; with a Precedence column the rows are walked
|#  in that order, without one (a 2.2 index) they are converted exactly as 2.2 scored them.
|#
|#  🔴 WHY (v3 upgrade test, 2026-10-05). Until 3.0 the shipped index itself was called riskscore.index.custom.csv,
|#  so which index an upgraded install scored with depended on HOW it was upgraded: the signed update never touches
|#  *.custom.* (it kept 2.2's 59 rows), a git pull brought 3.0's 99 rows, the internal sync overwrote the file --
|#  customer edits included. Now the shipped index has a locked name, and the custom name is only ever yours.
|#
|#  🔑 THE MIGRATION (every run, so every upgrade path gets it -- signed update, git pull, sync, container image).
|#  A riskscore.index.custom.csv that is BYTE-FOR-BYTE a file SecurityInsight shipped (line endings and a UTF-8 BOM
|#  aside) was never edited: it is removed and the locked file takes over. Anything else is your edit: it is kept, read
|#  as your rows over the shipped ones, and the run log says so once. The shipped versions are listed below by SHA-256
|#  (tests/pester/SIv3-RiskIndexFiles.Tests.ps1 proves the list against the files in git history).
|#
|#  PowerShell 5.1 compatible. No Set-StrictMode here (it leaks into the caller's scope).
|#######################################################################################################
|
|$script:SIRiskIndexLockedName = 'riskscore.index.locked.csv'
|$script:SIRiskIndexCustomName = 'riskscore.index.custom.csv'
|
|# SHA-256 of every riskscore.index.custom.csv SecurityInsight ever shipped, after Get-SIRiskIndexFileHash's
|# normalisation: 2.2.0 - 2.2.461 (59 rows) and the 3.0 pre-release index (99 rows, Precedence) that internal ring-1
|# installs received before it moved to the locked name.
|$script:SIRiskIndexShippedCustomHashes = @(
|    'a840970d76adff3343a04087ac289358c68e093c9b5d406cd324edbb4e6c636e',   # 2.2.0 - 2.2.461 (git blob e2fb10baf)
|    '45eb7ab5518f5ce9ebc4a1128b1c85a1e8ee7c2828349f819b20a6e092a931cb',   # 3.0 pre-release   (git blob ef1e50146)
|    # #559: the 3.0 locked index with the 2.2 columns (99 rows, Precedence) -- a copy of it under the custom name is not an
|    # edit either (the shipped index is now keyed by the SI fields; this copy would only re-add the translated rows)
|    'eadac5f370c27fc7066a1e0576729308c13fd64447da098ad6ea644b5b9fb483'    # 3.0 locked, 2.2 keys (git blob 702f53316)
|)
|
|function Get-SIRiskIndexFileHash {
|    <# PURE (reads one file). SHA-256 (lower-case hex) of the file's text with a UTF-8 BOM removed and CRLF -> LF, so a
|       git checkout with autocrlf and a zip download of the same release hash the same. $null when it cannot be read. #>
|    param([Parameter(Mandatory)][string]$Path)
|    try {
|        $b = [System.IO.File]::ReadAllBytes($Path)
|        $start = 0
|        if ($b.Length -ge 3 -and $b[0] -eq 0xEF -and $b[1] -eq 0xBB -and $b[2] -eq 0xBF) { $start = 3 }
|        $text = [System.Text.Encoding]::UTF8.GetString($b, $start, $b.Length - $start).Replace("`r`n", "`n")
|        $sha = [System.Security.Cryptography.SHA256]::Create()
|        try { $h = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($text)) } finally { $sha.Dispose() }
|        return (-join ($h | ForEach-Object { $_.ToString('x2') }))
|    } catch { return $null }
|}
|
|function Test-SIRiskIndexShippedCopy {
|    <# PURE (reads one file). $true when -Path is byte-for-byte (see Get-SIRiskIndexFileHash) a shipped risk index. #>
|    param([Parameter(Mandatory)][string]$Path, [string[]]$KnownHashes = $script:SIRiskIndexShippedCustomHashes)
|    $h = Get-SIRiskIndexFileHash -Path $Path
|    if (-not $h) { return $false }
|    return (@($KnownHashes) -contains $h)
|}
|
|function Resolve-SIRiskIndexFiles {
|    <#
|        Decides which risk index files this run reads, and migrates a never-edited copy of a shipped index away.
|          -Folder         the folder holding the index files (risk-analysis-detection)
|          -NoticeMarker   a file whose presence means "the run log already said the custom file is used as your rows"
|                          (VM: under logs\state). Empty = say it on every run (a container has no local state).
|          -NoRemove       never delete (tests, a read-only tree): an unedited shipped copy is then only ignored
|        Returns @{ LockedPath; CustomPath ($null = none read); Action = none | removed-unedited | ignored-unedited |
|        overlay; Lines (what to tell the run log) }. Never throws for the custom file; a missing locked file is the
|        caller's error.
|    #>
|    param([Parameter(Mandatory)][string]$Folder, [string]$NoticeMarker, [switch]$NoRemove,
|          [string[]]$KnownHashes = $script:SIRiskIndexShippedCustomHashes)
|    $locked = Join-Path $Folder $script:SIRiskIndexLockedName
|    $custom = Join-Path $Folder $script:SIRiskIndexCustomName
|    $res = [pscustomobject]@{ LockedPath = $locked; CustomPath = $null; Action = 'none'; Lines = @() }
|    if (-not (Test-Path -LiteralPath $custom -PathType Leaf)) { return $res }
|
|    if (Test-SIRiskIndexShippedCopy -Path $custom -KnownHashes $KnownHashes) {
|        $removed = $false
|        if (-not $NoRemove) { try { Remove-Item -LiteralPath $custom -Force -ErrorAction Stop; $removed = $true } catch { $removed = $false } }
|        if ($removed) {
|            $res.Action = 'removed-unedited'
|            $res.Lines = @(('Risk index: {0} was the unchanged risk index of an earlier version, so it was removed. The shipped index ({1}) is used, and updates keep it current.' -f $script:SIRiskIndexCustomName, $script:SIRiskIndexLockedName))
|        } else {
|            $res.Action = 'ignored-unedited'
|            $res.Lines = @(('Risk index: {0} is the unchanged risk index of an earlier version, so it is not used. The shipped index ({1}) is used; delete {0} to stop this line.' -f $script:SIRiskIndexCustomName, $script:SIRiskIndexLockedName))
|        }
|        return $res
|    }
|
|    $res.CustomPath = $custom
|    $res.Action = 'overlay'
|    $say = $true
|    if ($NoticeMarker) { try { $say = -not (Test-Path -LiteralPath $NoticeMarker) } catch { $say = $true } }
|    if ($say) {
|        $res.Lines = @(
|            ('Risk index: your own {0} is kept and read FIRST, before the shipped index ({1}): where one of your rows fits a finding it sets the score, and every other finding is scored by the shipped index, which updates keep current.' -f $script:SIRiskIndexCustomName, $script:SIRiskIndexLockedName),
|            ('If you edited it only to change a few rows, keep just those rows in it; if you did not mean to change scoring, delete it. This is said once.')
|        )
|        if ($NoticeMarker) {
|            try {
|                $null = [System.IO.Directory]::CreateDirectory((Split-Path -Parent $NoticeMarker))
|                [System.IO.File]::WriteAllText($NoticeMarker, ('{0:o}' -f [datetime]::UtcNow))
|            } catch { }
|        }
|    }
|    $res
|}
'@ }
$__siSupportFiles['engine/pro-settings/SI-DataModelTemplateRows.ps1'] = @{ Sha256 = '5fa24f0f578d3c5e5a87e75a8d6fc7888578807abb8fd86fc1e11923fc5ef3be'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- THE DATA-MODEL TEMPLATES IN SQL (REQUIREMENTS #456, V3-DATA-MODEL 2.4.5).
|
|    The data model (data-model/*.locked.json: the field catalog, the provider MAPPINGS, value maps, lists, trust, risk
|    factors, criticality mapping, collection scope, coverage checks, output maps) travels through the same template channel
|    as every other vendor template: one cfg.Template row per ITEM, kind 'datamodel', so a customer overrides, disables or
|    adds ONE mapping / field / factor (cfg.ItemOverride) and an update keeps it -- the conformance view flags
|    UpgradeAvailable when the shipped item changed underneath an override, never merges it (SI-TemplateVersioning.ps1).
|
|    ITEM KEYS ('datamodel' kind, max 128 characters):
|      <template>               the template's HEADER: the document without its item array (kind, version, objects ...);
|                               for a template without items (value-maps, criticality-mapping) the whole document
|      <template>:<item key>    one item -- the key the file-based merge uses (Get-SIDataModelItemKey: a mapping's
|                               'field|recordTypes|resourceTypes', a repeat '#<n>', a field's name, a factor's id ...).
|                               A key that would pass 128 characters keeps its first part and ends '~<12 hex of SHA-256>'.
|      <template> = field-catalog | value-maps | risk-factors | lists | trust | criticality-mapping | collection-scope |
|                   coverage-checks | relations | dimensions | classification | finding-texts | mappings/<provider> | outputs/<id>
|
|    RUN START (Export-SIDataModelProRoot): the effective items (template, override or own; disabled ones are left out)
|    are put back together per template, in the shipped order (SortOrder) with the customer's own items after, and written
|    as <run>\data-model\<template>.locked.json -- the folder the record writer, the CI build and the outputs read
|    ($global:SI_DataModelRoot). The whole model is validated (Test-SIDataModel) before a run may use it.
|
|    Classification (#405): 'fix' -- installed with the code on every install and every update (CONVERGE-DEFAULTS:
|    existing installs receive the rows on their next update), never held; a customer's override is never changed.
|
|    PURE except the file writer. PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Get-SIDataModelItemKey -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-DataModelTemplates.ps1'))
|}
|
|$script:SIDataModelProKeyMax = 128
|$script:SIDataModelProKeyPattern = '^[a-z][a-z0-9\-]{0,40}(/[a-z0-9][a-z0-9_\-]{0,60})?(:[^\r\n]{1,126})?$'
|$script:SIDataModelProTopNames = @('field-catalog', 'value-maps', 'risk-factors', 'lists', 'trust', 'criticality-mapping', 'collection-scope', 'coverage-checks', 'recommendation-equivalence', 'report-scope', 'relations', 'recommendation-exclusions', 'dimensions', 'classification', 'finding-texts', 'severity-model')
|
|function Get-SIDataModelProKeyPattern { $script:SIDataModelProKeyPattern }
|
|function Get-SIDataModelProTemplateKind {
|    <# PURE. The data-model kind a template name holds (what decides its item key). #>
|    param([Parameter(Mandatory)][string]$Name)
|    if ($Name -like 'mappings/*') { return 'field-mapping' }
|    if ($Name -like 'outputs/*') { return 'output-map' }
|    # #462: a CI rule pack (data-model/rules/<Pack>.locked.yaml) -- its header (stage, on / off, priority, source) + one row per rule
|    if ($Name -like 'rules/*') { return 'ci-rule-pack' }
|    if ($Name -eq 'recommendation-equivalence') { return 'recommendation-equivalence' }
|    if ($Name -eq 'recommendation-exclusions') { return 'recommendation-exclusion' }
|    # #561 / #562 the classification dimensions and rows (one generic classification mechanism)
|    if ($Name -eq 'dimensions') { return 'dimension' }
|    if ($Name -eq 'classification') { return 'classification' }
|    # #560 the finding texts of SI's own reports (one item per report)
|    if ($Name -eq 'finding-texts') { return 'finding-text' }
|    # #690 (15) the severity model (one item per report)
|    if ($Name -eq 'severity-model') { return 'severity-model' }
|    switch ($Name) {
|        'field-catalog' { 'field-catalog' } 'value-maps' { 'value-map' } 'risk-factors' { 'risk-factor' } 'lists' { 'list' }
|        'trust' { 'trust' } 'criticality-mapping' { 'criticality-mapping' } 'collection-scope' { 'collection-scope' }
|        'coverage-checks' { 'coverage-check' } 'report-scope' { 'report-scope' } 'relations' { 'relation' } default { '' }
|    }
|}
|
|function Get-SIDataModelProItemKey {
|    <# PURE. '<template>:<item key>', shortened with a hash suffix when it would pass 128 characters. #>
|    param([Parameter(Mandatory)][string]$Name, [AllowEmptyString()][string]$ItemKey)
|    if (-not $ItemKey) { return $Name }
|    $full = '{0}:{1}' -f $Name, $ItemKey
|    if ($full.Length -le $script:SIDataModelProKeyMax) { return $full }
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $h = (-join ($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($ItemKey)) | ForEach-Object { $_.ToString('x2') })).Substring(0, 12) } finally { $sha.Dispose() }
|    $keep = $script:SIDataModelProKeyMax - $Name.Length - 1 - 13
|    return ('{0}:{1}~{2}' -f $Name, $ItemKey.Substring(0, $keep), $h)
|}
|
|function Split-SIDataModelProKey {
|    <# PURE. @{ Name; ItemKey (as stored, '' for a header) }. #>
|    param([Parameter(Mandatory)][string]$Key)
|    $i = $Key.IndexOf(':')
|    if ($i -lt 0) { return @{ Name = $Key; ItemKey = '' } }
|    return @{ Name = $Key.Substring(0, $i); ItemKey = $Key.Substring($i + 1) }
|}
|
|function Get-SIDataModelProTemplateNames {
|    <# The data-model templates a release ships, in a fixed order: the top-level files, then mappings/*, then outputs/*. #>
|    param([Parameter(Mandatory)][string]$DataModelRoot)
|    $names = New-Object System.Collections.Generic.List[string]
|    foreach ($n in $script:SIDataModelProTopNames) { if (Test-Path -LiteralPath (Join-Path $DataModelRoot ($n + '.locked.json'))) { $names.Add($n) } }
|    foreach ($sub in 'mappings', 'outputs') {
|        $dir = Join-Path $DataModelRoot $sub
|        if (-not (Test-Path -LiteralPath $dir)) { continue }
|        $fs = [string[]]@(Get-ChildItem -LiteralPath $dir -Filter '*.locked.json' | ForEach-Object { $_.Name })
|        [Array]::Sort($fs, [StringComparer]::Ordinal)
|        foreach ($f in $fs) { $names.Add(('{0}/{1}' -f $sub, $f.Replace('.locked.json', ''))) }
|    }
|    return $names.ToArray()   # unrolled: foreach and @() both read it as the list of names
|}
|
|function Get-SIDataModelProItems {
|    <#
|    .SYNOPSIS  PURE. One parsed template document -> its rows: the header and one per item, keyed as the file-based merge
|               keys them (a repeated mapping key gets '#<n>', as Merge-SIDataModelItems does).
|    .OUTPUTS   [ @{ Key; ItemKey; Value; SortOrder } ]
|    #>
|    param([Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)]$Document)
|    $kind = [string]$Document.kind
|    if (-not $kind) { $kind = Get-SIDataModelProTemplateKind $Name }
|    $arr = Get-SIDataModelItemArrayName $kind
|    $out = New-Object System.Collections.Generic.List[object]
|    $header = [ordered]@{}
|    # the item array stays in the header as null, so the document is put back with its properties in the shipped order
|    foreach ($p in $Document.PSObject.Properties) { if ($arr -and $p.Name -eq $arr) { $header[$p.Name] = $null } else { $header[$p.Name] = $p.Value } }
|    $out.Add([pscustomobject]@{ Key = $Name; ItemKey = ''; Value = [pscustomobject]$header; SortOrder = 0 })
|    if ($arr) {
|        $occ = @{}; $i = 0
|        foreach ($it in @($Document.$arr)) {
|            if ($null -eq $it) { continue }
|            $i++
|            $base = Get-SIDataModelItemKey $kind $it
|            $k = $base
|            if ($kind -eq 'field-mapping') {
|                $n = 1; if ($occ.ContainsKey($base)) { $n = [int]$occ[$base] + 1 }
|                $occ[$base] = $n
|                if ($n -gt 1) { $k = '{0}#{1}' -f $base, $n }
|            }
|            $out.Add([pscustomobject]@{ Key = (Get-SIDataModelProItemKey -Name $Name -ItemKey $k); ItemKey = $k; Value = $it; SortOrder = $i })
|        }
|    }
|    # the rows one by one (never ', $array'): @(Get-SIDataModelProItems ...) is then the rows, not ONE item holding them all
|    foreach ($r in $out) { $r }
|}
|
|function Get-SIDataModelTemplateRows {
|    <#
|    .SYNOPSIS  The 'datamodel' template rows a release ships, from its data-model folder: @{ Key; Body; SortOrder; Source }.
|               Bodies are written by -ToJson (the template store's canonical writer, ConvertTo-SIProJson).
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][scriptblock]$ToJson)
|    $dm = Join-Path $SIRoot 'data-model'
|    $rows = New-Object System.Collections.Generic.List[object]
|    if (-not (Test-Path -LiteralPath $dm)) { return }
|    $base = 0
|    foreach ($n in (Get-SIDataModelProTemplateNames -DataModelRoot $dm)) {
|        $path = Join-Path $dm ($n + '.locked.json')
|        $doc = [IO.File]::ReadAllText($path).TrimStart([char]0xFEFF) | ConvertFrom-Json
|        foreach ($r in (Get-SIDataModelProItems -Name $n -Document $doc)) {
|            # one SortOrder series over every template, so the store's order is the shipped order
|            $rows.Add([pscustomobject]@{ Key = $r.Key; Body = (& $ToJson $r.Value); SortOrder = ($base + [int]$r.SortOrder); Source = ('data-model/{0}.locked.json' -f $n) })
|        }
|        $base += 100000
|    }
|    # #462: the CI rule packs (YAML) -- one template per pack, 'rules/<lower-case pack>', its header + one row per rule
|    foreach ($p in @(Get-SIRulePackTemplateDocuments -DataModelRoot $dm)) {
|        foreach ($r in (Get-SIDataModelProItems -Name $p.Name -Document $p.Document)) {
|            $rows.Add([pscustomobject]@{ Key = $r.Key; Body = (& $ToJson $r.Value); SortOrder = ($base + [int]$r.SortOrder); Source = $p.Source })
|        }
|        $base += 100000
|    }
|    # one by one (never ', $array'): @(Get-SIDataModelTemplateRows ...) is then the rows, not ONE item holding them all
|    foreach ($x in $rows) { $x }
|}
|
|function Get-SIRulePackTemplateDocuments {
|    <#
|    .SYNOPSIS  The shipped CI rule packs (data-model/rules/*.locked.yaml) as data-model documents: kind 'ci-rule-pack', the
|               pack's header (pack, name, description, stage, priority, source) and its rules. A pack that does not parse
|               is skipped with a warning (the release's rule lint refuses it before it ships).
|    .OUTPUTS   [ @{ Name ('rules/<pack>'); Document; Source } ]
|    #>
|    param([Parameter(Mandatory)][string]$DataModelRoot)
|    $dir = Join-Path $DataModelRoot 'rules'
|    $out = New-Object System.Collections.Generic.List[object]
|    if (-not (Test-Path -LiteralPath $dir)) { return }
|    if (-not (Get-Command -Name Get-SIRulePackKey -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-CiRules.ps1')) }
|    if (-not (Get-Command -Name ConvertFrom-SIYaml -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-Yaml.ps1')) }
|    $fs = [string[]]@(Get-ChildItem -LiteralPath $dir -File -Filter '*.locked.yaml' | ForEach-Object { $_.Name })
|    [Array]::Sort($fs, [StringComparer]::Ordinal)
|    foreach ($f in $fs) {
|        $pack = $f -replace '\.locked\.yaml$', ''
|        try {
|            $y = ConvertFrom-SIYaml -Yaml ([IO.File]::ReadAllText((Join-Path $dir $f))) -SourceName $f
|            $doc = [ordered]@{ kind = 'ci-rule-pack'; pack = $pack }
|            foreach ($k in 'name', 'description', 'stage', 'priority', 'enabled', 'source') { $v = Get-SIItemValue $y $k; if ($null -ne $v -and [string]$v -ne '') { $doc[$k] = $v } }
|            if (-not $doc.Contains('source')) { $doc['source'] = 'shipped' }
|            # Get-SIValueList returns ONE list (', $out'): @() around it would make the rules a single item holding every rule
|            $doc['rules'] = (Get-SIValueList (Get-SIItemValue $y 'rules')).ToArray()
|            # one JSON shape (the YAML reader's dictionaries -> objects), as every other data-model document
|            $obj = ConvertTo-Json -InputObject $doc -Depth 30 | ConvertFrom-Json
|            $out.Add([pscustomobject]@{ Name = (Get-SIRulePackKey -Pack $pack); Document = $obj; Source = ('data-model/rules/{0}' -f $f) })
|        } catch { Write-Warning ("rule pack {0} could not be published -- {1}" -f $f, $_.Exception.Message) }
|    }
|    # one by one: @(Get-SIRulePackTemplateDocuments ...) -- as the rows above read it -- is then the packs, not ONE item holding them
|    foreach ($x in $out) { $x }
|}
|
|function Test-SIDataModelProItem {
|    <#
|    .SYNOPSIS  PURE. The reasons a 'datamodel' item is not accepted (empty = accepted). -Value: the parsed body.
|               A header must carry the template's kind; an item's body must give back the key it is stored under (the key
|               names the item, as for every other kind), so an override can never land on another item.
|    #>
|    param([Parameter(Mandatory)][string]$Key, $Value)
|    $why = New-Object System.Collections.Generic.List[string]
|    if ($Key.Length -gt $script:SIDataModelProKeyMax -or $Key -notmatch $script:SIDataModelProKeyPattern) { $why.Add(("'{0}' is not a data-model key ('<template>' or '<template>:<item key>')" -f $Key)); return $why.ToArray() }
|    if ($Value -isnot [System.Management.Automation.PSCustomObject]) { $why.Add('a data-model item must be a JSON object'); return $why.ToArray() }
|    $s = Split-SIDataModelProKey $Key
|    $kind = Get-SIDataModelProTemplateKind $s.Name
|    if (-not $kind) { $why.Add(("'{0}' is not a data-model template" -f $s.Name)); return $why.ToArray() }
|    if (-not $s.ItemKey) {
|        if ($Value.PSObject.Properties['kind'] -and [string]$Value.kind -ne $kind) { $why.Add(("the {0} header must have kind '{1}'" -f $s.Name, $kind)) }
|        return $why.ToArray()
|    }
|    if (-not (Get-SIDataModelItemArrayName $kind)) { $why.Add(("{0} has no items -- it is one document ('{0}')" -f $s.Name)); return $why.ToArray() }
|    $own = Get-SIDataModelItemKey $kind $Value
|    if (-not $own) { $why.Add('the item has no key (field / name / id / target / type)'); return $why.ToArray() }
|    $expect = Get-SIDataModelProItemKey -Name $s.Name -ItemKey $own
|    $ok = ($Key -ceq $expect)
|    if (-not $ok -and $kind -eq 'field-mapping') {
|        # a repeated mapping key ('#<n>'; inside the hashed part when the key was shortened)
|        for ($n = 2; $n -le 64 -and -not $ok; $n++) { $ok = ($Key -ceq (Get-SIDataModelProItemKey -Name $s.Name -ItemKey ('{0}#{1}' -f $own, $n))) }
|    }
|    if (-not $ok) { $why.Add(("the key must be '{0}' -- it is made of the item's own key" -f $expect)) }
|    # #527 (5)-(7): a risk factor keeps one scope, no tier, SI fields only -- a customer's override too (SI-RiskFactorCatalog.ps1)
|    if ($kind -eq 'risk-factor' -and (Get-Command -Name Test-SIRiskFactorItem -ErrorAction SilentlyContinue)) { foreach ($x in (Test-SIRiskFactorItem -Factor $Value)) { $why.Add([string]$x) } }
|    # #462: a rule of a CI rule pack must convert (SI fields only, a known stage / class / operation, sets something)
|    if ($kind -eq 'ci-rule-pack') {
|        if (-not (Get-Command -Name ConvertTo-SICiNativeRule -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-CiRules.ps1')) }
|        try { $null = ConvertTo-SICiNativeRule -Item $Value -Pack $s.Name } catch { $why.Add([string]$_.Exception.Message) }
|    }
|    # #464: one equivalence group (SI-RecommendationEquivalence.ps1)
|    # #546: one default exclusion rule (SI-RecommendationExclusions.ps1)
|    if ($kind -eq 'recommendation-exclusion') {
|        if (-not (Get-Command -Name Test-SIRecommendationExclusionRule -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-RecommendationExclusions.ps1')) }
|        foreach ($x in (Test-SIRecommendationExclusionRule -Rule $Value)) { $why.Add([string]$x) }
|    }
|    # #561 / #562: one dimension / one classification row (SI-Classification.ps1); a row is checked on its shape here, against
|    # the dimensions in force when the run's whole model is validated (Test-SIDataModel)
|    if ($kind -eq 'finding-text') {
|        if (-not (Get-Command -Name Test-SIFindingTextItem -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-FindingTexts.ps1')) }
|        foreach ($x in (Test-SIFindingTextItem -Item $Value)) { $why.Add([string]$x) }
|    }
|    # #690 (15): one report of the severity model -- its order ends with owner_defined, its own severity is one of the five
|    if ($kind -eq 'severity-model') { foreach ($x in (Test-SISeverityModelReportItem -Item $Value)) { $why.Add([string]$x) } }
|    if ($kind -in 'dimension', 'classification') {
|        if (-not (Get-Command -Name Test-SIClassificationRule -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-Classification.ps1')) }
|        if ($kind -eq 'dimension') { foreach ($x in (Test-SIDimensionItem -Dimension $Value)) { $why.Add([string]$x) } }
|        else { foreach ($x in (Test-SIClassificationRule -Rule $Value)) { $why.Add([string]$x) } }
|    }
|    if ($kind -eq 'recommendation-equivalence') {
|        if (-not (Get-Command -Name Test-SIRecommendationEquivalenceGroup -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-RecommendationEquivalence.ps1')) }
|        foreach ($x in (Test-SIRecommendationEquivalenceGroup -Group $Value)) { $why.Add([string]$x) }
|    }
|    return $why.ToArray()
|}
|
|function ConvertTo-SIDataModelProDocuments {
|    <#
|    .SYNOPSIS  PURE. The run's effective 'datamodel' items -> one document per template, the items in store order
|               (SortOrder; the customer's own items after the shipped ones, by key).
|    .OUTPUTS   ordered hashtable  template name -> document (pscustomobject)
|    #>
|    param([AllowEmptyCollection()][object[]]$Items = @(), [Parameter(Mandatory)][scriptblock]$FromJson)
|    $byName = [ordered]@{}
|    foreach ($it in @($Items)) {
|        if ($null -eq $it) { continue }
|        $s = Split-SIDataModelProKey ([string]$it.Key)
|        if (-not $byName.Contains($s.Name)) { $byName[$s.Name] = @{ Header = $null; Items = (New-Object System.Collections.Generic.List[object]) } }
|        $v = & $FromJson ([string]$it.Body)
|        if (-not $s.ItemKey) { $byName[$s.Name].Header = $v }
|        else { $byName[$s.Name].Items.Add([pscustomobject]@{ Order = [long]$it.SortOrder; Key = [string]$s.ItemKey; Value = $v }) }
|    }
|    $docs = [ordered]@{}
|    foreach ($n in $byName.Keys) {
|        $e = $byName[$n]
|        if ($null -eq $e.Header) { throw ("data-model template '{0}': items without its header -- republish the templates" -f $n) }
|        $kind = [string]$e.Header.kind
|        if (-not $kind) { $kind = Get-SIDataModelProTemplateKind $n }
|        $arr = Get-SIDataModelItemArrayName $kind
|        $doc = [ordered]@{}
|        foreach ($p in $e.Header.PSObject.Properties) { $doc[$p.Name] = $p.Value }
|        if ($arr) {
|            $its = $e.Items.ToArray()
|            $keys = [string[]]@($its | ForEach-Object { '{0:D20}|{1}' -f $_.Order, $_.Key })
|            $idx = [int[]]@(0..([Math]::Max(0, $its.Count - 1)))
|            if ($its.Count -gt 0) { [Array]::Sort($keys, $idx, [StringComparer]::Ordinal) }
|            $doc[$arr] = @(if ($its.Count -gt 0) { foreach ($i in $idx) { $its[$i].Value } })
|        }
|        $docs[$n] = [pscustomobject]$doc
|    }
|    return $docs
|}
|
|function Export-SIDataModelProRoot {
|    <#
|    .SYNOPSIS  Writes the run's data model to <RunFolder>\data-model\<template>.locked.json and validates it.
|               Templates the database does not hold (none published yet for that file) are copied from -ShippedRoot, so
|               the folder is always a whole model. A model that does not validate NEVER stops the run: the templates a
|               problem names go back to the shipped copy, and if that is not enough the whole shipped model is used -- said
|               in Notes. Throws only when the SHIPPED model itself does not validate (a product defect).
|    .OUTPUTS   @{ Root; Templates (written from the database); Copied (from the installation); Fallback (shipped for this run); Notes }
|    #>
|    param([AllowEmptyCollection()][object[]]$Items = @(), [Parameter(Mandatory)][string]$RunFolder, [Parameter(Mandatory)][string]$ShippedRoot,
|          [Parameter(Mandatory)][scriptblock]$FromJson, [Parameter(Mandatory)][scriptblock]$ToJson)
|    $root = [IO.Path]::Combine($RunFolder, 'data-model')
|    foreach ($d in @($root, [IO.Path]::Combine($root, 'mappings'), [IO.Path]::Combine($root, 'outputs'), [IO.Path]::Combine($root, 'rules'))) { if (-not (Test-Path -LiteralPath $d)) { New-Item -ItemType Directory -Path $d -Force | Out-Null } }
|    $docs = ConvertTo-SIDataModelProDocuments -Items @($Items) -FromJson $FromJson
|    $utf8 = New-Object System.Text.UTF8Encoding($false)
|    foreach ($n in $docs.Keys) { [IO.File]::WriteAllText([IO.Path]::Combine($root, ($n.Replace('/', [IO.Path]::DirectorySeparatorChar) + '.locked.json')), (& $ToJson $docs[$n]), $utf8) }
|    $copied = New-Object System.Collections.Generic.List[string]
|    foreach ($n in (Get-SIDataModelProTemplateNames -DataModelRoot $ShippedRoot)) {
|        if ($docs.Contains($n)) { continue }
|        $rel = $n.Replace('/', [IO.Path]::DirectorySeparatorChar) + '.locked.json'
|        [IO.File]::Copy([IO.Path]::Combine($ShippedRoot, $rel), [IO.Path]::Combine($root, $rel), $true)
|        $copied.Add($n)
|    }
|    $check = { @(Test-SIDataModel -Model (Get-SIDataModel -Root $root) | ForEach-Object { $_ } | Where-Object { $_ }) }
|    $short = { param($p) (@($p | Select-Object -First 5) -join '; ') + $(if (@($p).Count -gt 5) { (' (+{0} more)' -f (@($p).Count - 5)) } else { '' }) }
|    $problems = & $check
|    $notes = New-Object System.Collections.Generic.List[string]; $fallback = New-Object System.Collections.Generic.List[string]
|    $shippedNames = @(Get-SIDataModelProTemplateNames -DataModelRoot $ShippedRoot)
|    # A SETTINGS PROBLEM NEVER STOPS THE RUN (owner, ring 1 2026-10-10: a run that read the settings database while the
|    # template publish was half-way -- the field catalog partly written, its mappings not yet -- stopped the whole pipeline
|    # with "unknown field" x471). Step 1: every template from the database a problem names goes back to the shipped copy
|    # for this run. Step 2: still not valid -> this run uses the whole shipped data model. Each is said, per template.
|    if ($problems.Count) {
|        $named = New-Object System.Collections.Generic.List[string]
|        foreach ($p in $problems) {
|            $m = [regex]::Match([string]$p, '^([a-z][a-z0-9\-]*(?:/[a-z0-9][a-z0-9\-]*)?):')
|            if ($m.Success -and $docs.Contains($m.Groups[1].Value) -and -not $named.Contains($m.Groups[1].Value)) { $named.Add($m.Groups[1].Value) }
|        }
|        foreach ($n in $named) {
|            if ($shippedNames -notcontains $n) { continue }
|            $rel = $n.Replace('/', [IO.Path]::DirectorySeparatorChar) + '.locked.json'
|            [IO.File]::Copy([IO.Path]::Combine($ShippedRoot, $rel), [IO.Path]::Combine($root, $rel), $true)
|            $fallback.Add($n)
|        }
|        $first = $problems
|        if ($fallback.Count) { $problems = & $check }
|        if ($problems.Count) {
|            foreach ($n in $shippedNames) {
|                $rel = $n.Replace('/', [IO.Path]::DirectorySeparatorChar) + '.locked.json'
|                [IO.File]::Copy([IO.Path]::Combine($ShippedRoot, $rel), [IO.Path]::Combine($root, $rel), $true)
|            }
|            foreach ($n in @($docs.Keys)) { if ($shippedNames -notcontains $n) { Remove-Item -LiteralPath ([IO.Path]::Combine($root, ($n.Replace('/', [IO.Path]::DirectorySeparatorChar) + '.locked.json'))) -Force -ErrorAction SilentlyContinue } }
|            $notes.Add(('the data model in the settings database does not validate ({0}) -- this run uses the data model shipped with this release; your data-model changes apply again once it validates (a template publish that was still running finishes; otherwise review the data model on the web app)' -f (& $short $first)))
|            $fallback.Clear(); foreach ($n in $shippedNames) { $fallback.Add($n) }
|            $problems = & $check
|            # the shipped model itself does not validate: a product defect, not a setting -- nothing else to fall back to
|            if ($problems.Count) { throw ('the data model shipped with this release does not validate -- ' + (& $short $problems)) }
|        } else {
|            $notes.Add(('the data model in the settings database does not validate ({0}) -- this run uses the shipped {1} for: {2}' -f (& $short $first), $(if ($fallback.Count -eq 1) { 'template' } else { 'templates' }), ($fallback -join ', ')))
|        }
|    }
|    return @{ Root = $root; Templates = @($docs.Keys); Copied = $copied.ToArray(); Fallback = $fallback.ToArray(); Notes = $notes.ToArray() }
|}
'@ }
$__siSupportFiles['engine/data-model/SI-DataModelTemplates.ps1'] = @{ Sha256 = 'ae4134274adaaf78943a67bb11bdd170c9ebc7272d72f7f8e153e55cb0e72714'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight data-model templates: load, merge customer overrides PER ITEM, flag conflicts, and validate.
|    V3-DATA-MODEL part 2 (2.4.5). Folder: <solution>\data-model\
|
|      <name>.locked.json    shipped by Invardia, updated automatically (never edit)
|      <name>.custom.json    the customer's overrides: the SAME shape, holding only the items that differ
|                            (Community: on disk, never shipped, never overwritten; Pro: materialised from the settings
|                            database into an overlay folder the same way)
|
|    MERGE RULES -- the same for every template kind; only the item key differs (Get-SIDataModelItemKey):
|      * a custom item with the same key REPLACES the shipped item (override); "remove": true drops it (disabled)
|      * a custom item with a new key is ADDED (the customer's own)
|      * a custom item may carry "baseHash" = the hash of the shipped item it was written against. When the shipped
|        item has changed since, the item's state is UpgradeAvailable: the override still wins, and the change is
|        flagged for review -- never merged silently (same states as the Pro template store:
|        UpToDate | Overridden | Disabled | UpgradeAvailable | Own)
|      * value maps merge one level deeper (per key inside a map); the trust list keeps the shipped ORDER and a custom
|        entry changes trust by id (silence = inherit), and may move with "after": <id>
|
|    PowerShell 5.1: no ?. / ??, no ternary, no Set-StrictMode.
|#>
|
|. (Join-Path $PSScriptRoot 'SI-Conditions.ps1')
|. (Join-Path $PSScriptRoot 'SI-FieldMapper.ps1')
|. (Join-Path $PSScriptRoot 'SI-RiskFactorCatalog.ps1')
|# #561 / #562 the one classification mechanism (asset type / subtype, dimensions)
|. (Join-Path $PSScriptRoot 'SI-Classification.ps1')
|# #560 the generic SI finding fields of SI's own reports, as data
|. (Join-Path $PSScriptRoot 'SI-FindingTexts.ps1')
|# the Azure CI scope and the child resources that roll up into their parent (collection-scope rollUpInto, validated below)
|. (Join-Path $PSScriptRoot 'SI-AzureChildren.ps1')
|
|function Get-SIDataModelRoot {
|    param([string]$Root)
|    if ($Root) { return $Root }
|    # #456 Pro: the run's data model from the settings database (templates + the customer's overrides), materialised by
|    # the settings layer (Export-SIDataModelProRoot) -- the shipped folder is then not read
|    if ($global:SI_DataModelRoot -and (Test-Path -LiteralPath ([string]$global:SI_DataModelRoot))) { return [string]$global:SI_DataModelRoot }
|    return (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'data-model')
|}
|
|function Get-SIDataModelItemHash {
|    <# SHA-256 of an item's compact JSON -- what a custom item's baseHash refers to. #>
|    param($Item)
|    $json = $Item | ConvertTo-Json -Compress -Depth 30
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { return ([BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($json))) -replace '-', '').ToLowerInvariant() }
|    finally { $sha.Dispose() }
|}
|
|function Get-SIDataModelItemKey {
|    <# The key that identifies one item of a template kind (what a custom override matches on). #>
|    param([string]$Kind, $Item)
|    switch ($Kind) {
|        'field-catalog' { return [string]$Item.name }
|        'field-mapping' {
|            $rt = @($Item.recordTypes) -join ','
|            $res = @(Get-SIItemValue $Item 'resourceTypes') -join ','
|            return ('{0}|{1}|{2}' -f $Item.field, $rt, $res)
|        }
|        'output-map' { return [string]$Item.target }
|        'collection-scope' { return [string]$Item.type }
|        default { return [string]$Item.id }
|    }
|}
|
|function Get-SIDataModelItemArrayName {
|    <# Which array of a template holds its items. #>
|    param([string]$Kind)
|    switch ($Kind) {
|        'field-catalog' { 'fields' } 'field-mapping' { 'mappings' } 'risk-factor' { 'factors' } 'list' { 'lists' }
|        'output-map' { 'columns' } 'trust' { 'order' } 'coverage-check' { 'checks' } 'collection-scope' { 'azureResourceTypes' }
|        # #462 a CI rule pack (one rule per id); #464 the recommendation equivalence (one group per id)
|        'ci-rule-pack' { 'rules' } 'recommendation-equivalence' { 'groups' } 'report-scope' { 'reports' }
|        'relation' { 'relations' }
|        # #546 the default exclusion rules for known false positives of a provider's recommendation
|        'recommendation-exclusion' { 'rules' }
|        # #561 / #562 the classification dimensions (one per id: its values) and the classification rows (one per id)
|        'dimension' { 'dimensions' } 'classification' { 'rules' }
|        # #560 the finding texts of SI's own reports (one item per report)
|        'finding-text' { 'reports' }
|        # #690 (15) the severity model: one item per report (its ordered metric kinds + its own severity)
|        'severity-model' { 'reports' }
|        default { $null }
|    }
|}
|
|function Merge-SIDataModelItems {
|    <# Merges one item array: shipped + custom -> merged list + per-item state. #>
|    param([string]$Kind, $Locked, $Custom)
|    $states = New-Object System.Collections.Generic.List[object]
|    # A field mapping may hold SEVERAL items for one field and record type (eg: four si_device_roles|device items, each
|    # a different flag, unioned by the mapper). They used to share one key, so only the last survived the merge. Each
|    # repeat now gets its own key -- the first keeps the plain key (existing overrides still match it), the n-th is
|    # '<key>#<n>' -- and a custom file's n-th item with that key overrides the shipped n-th. The mapper then merges the
|    # items by the field's own rule (union for a list field, first-wins for a single value). Other kinds keep one item
|    # per key: a repeat there is a template error the validator reports.
|    $occ = @{}
|    $keyOf = {
|        param($item, $counts)
|        $base = Get-SIDataModelItemKey $Kind $item
|        if ($Kind -ne 'field-mapping') { return $base }
|        $n = 1; if ($counts.ContainsKey($base)) { $n = [int]$counts[$base] + 1 }
|        $counts[$base] = $n
|        if ($n -eq 1) { return $base }
|        return ('{0}#{1}' -f $base, $n)
|    }
|    $byKey = [ordered]@{}
|    foreach ($it in @($Locked)) { if ($null -ne $it) { $byKey[(& $keyOf $it $occ)] = $it } }
|    $result = [ordered]@{}
|    foreach ($k in $byKey.Keys) { $result[$k] = $byKey[$k] }
|    $customKeys = @{}
|    $occC = @{}
|    foreach ($c in @($Custom)) {
|        if ($null -eq $c) { continue }
|        $k = & $keyOf $c $occC
|        $customKeys[$k] = $true
|        $remove = (ConvertTo-SIBoolOrNull (Get-SIItemValue $c 'remove')) -eq $true
|        if ($byKey.Contains($k)) {
|            $lockedHash = Get-SIDataModelItemHash $byKey[$k]
|            $base = [string](Get-SIItemValue $c 'baseHash')
|            $state = 'Overridden'
|            if ($remove) { $state = 'Disabled' }
|            if ($base -and $base -ne $lockedHash) { $state = 'UpgradeAvailable' }
|            $states.Add([pscustomobject]@{ Key = $k; State = $state; LockedHash = $lockedHash; BaseHash = $base })
|            if ($remove) { $result.Remove($k) } else { $result[$k] = $c }
|        } else {
|            if (-not $remove) { $result[$k] = $c; $states.Add([pscustomobject]@{ Key = $k; State = 'Own'; LockedHash = $null; BaseHash = $null }) }
|        }
|    }
|    foreach ($k in $byKey.Keys) { if (-not $customKeys.ContainsKey($k)) { $states.Add([pscustomobject]@{ Key = $k; State = 'UpToDate'; LockedHash = $null; BaseHash = $null }) } }
|    return @{ Items = @($result.Values); States = $states.ToArray() }
|}
|
|function Merge-SITrustOrder {
|    <# The trust list: shipped order; a custom entry changes fields by id; "after": <id> moves it; a new id is appended (or placed after). #>
|    param($Locked, $Custom)
|    $list = New-Object System.Collections.Generic.List[object]
|    foreach ($e in @($Locked)) { $list.Add(($e | ConvertTo-Json -Depth 10 | ConvertFrom-Json)) }
|    foreach ($c in @($Custom)) {
|        $id = [string]$c.id
|        $idx = -1
|        for ($i = 0; $i -lt $list.Count; $i++) { if ([string]$list[$i].id -eq $id) { $idx = $i; break } }
|        $entry = $null
|        if ($idx -ge 0) {
|            $entry = $list[$idx]
|            foreach ($p in $c.PSObject.Properties) { if ($p.Name -notin 'id', 'after') { $entry | Add-Member -NotePropertyName $p.Name -NotePropertyValue $p.Value -Force } }
|            $list.RemoveAt($idx)
|        } else { $entry = $c }
|        $after = [string](Get-SIItemValue $c 'after')
|        $at = $idx
|        if ($after) { for ($i = 0; $i -lt $list.Count; $i++) { if ([string]$list[$i].id -eq $after) { $at = $i + 1; break } } }
|        if ($at -lt 0 -or $at -gt $list.Count) { $at = $list.Count }
|        $list.Insert($at, $entry)
|    }
|    return , $list.ToArray()
|}
|
|function Read-SIJsonFile {
|    param([string]$Path)
|    if (-not (Test-Path -LiteralPath $Path)) { return $null }
|    $text = [System.IO.File]::ReadAllText($Path)
|    if ([string]::IsNullOrWhiteSpace($text)) { return $null }
|    try { return ($text | ConvertFrom-Json) } catch { throw "data-model template ${Path}: not valid JSON -- $($_.Exception.Message)" }
|}
|
|function Get-SIDataModelTemplate {
|    <#
|    .SYNOPSIS  One template (shipped + customer overrides), merged.
|    .PARAMETER Name         the file name without .locked.json, e.g. 'field-catalog', 'mappings/mde', 'outputs/servicenow-ci'
|    .PARAMETER OverlayRoot  where the customer's *.custom.json live (default: next to the shipped file)
|    .OUTPUTS   @{ Document; States; Kind; Name }
|    #>
|    param([Parameter(Mandatory)][string]$Name, [string]$Root, [string]$OverlayRoot)
|    $Root = Get-SIDataModelRoot $Root
|    $lockedPath = Join-Path $Root ($Name + '.locked.json')
|    $locked = Read-SIJsonFile $lockedPath
|    if ($null -eq $locked) { throw "data-model template '$Name' not found ($lockedPath)" }
|    $customRoot = $Root; if ($OverlayRoot) { $customRoot = $OverlayRoot }
|    $custom = Read-SIJsonFile (Join-Path $customRoot ($Name + '.custom.json'))
|    $kind = [string]$locked.kind
|    $doc = $locked | ConvertTo-Json -Depth 30 | ConvertFrom-Json      # a copy: callers may change it
|    $states = @()
|    if ($null -ne $custom) {
|        if ($custom.kind -and [string]$custom.kind -ne $kind) { throw "data-model override '$Name': kind '$($custom.kind)' does not match '$kind'" }
|        $arr = Get-SIDataModelItemArrayName $kind
|        if ($kind -eq 'trust') {
|            $doc.order = Merge-SITrustOrder -Locked $locked.order -Custom $custom.order
|        } elseif ($kind -eq 'value-map') {
|            foreach ($mp in $custom.maps.PSObject.Properties) {
|                $target = $doc.maps.PSObject.Properties[$mp.Name]
|                if ($null -eq $target) { $doc.maps | Add-Member -NotePropertyName $mp.Name -NotePropertyValue $mp.Value; continue }
|                foreach ($kv in $mp.Value.PSObject.Properties) { $target.Value | Add-Member -NotePropertyName $kv.Name -NotePropertyValue $kv.Value -Force }
|            }
|        } elseif ($kind -eq 'criticality-mapping') {
|            foreach ($sect in 'criticality', 'dataSensitivity') {
|                $cs = Get-SIItemValue $custom $sect
|                if ($null -eq $cs) { continue }
|                foreach ($prov in $cs.PSObject.Properties) {
|                    if ($prov.Name.StartsWith('$')) { continue }
|                    $doc.$sect | Add-Member -NotePropertyName $prov.Name -NotePropertyValue $prov.Value -Force   # a provider's vocabulary is replaced as a whole
|                }
|            }
|            foreach ($p in 'defaultFactor', 'combine', 'cap') { $v = Get-SIItemValue $custom $p; if ($null -ne $v) { $doc.$p = $v } }
|        } elseif ($arr) {
|            $m = Merge-SIDataModelItems -Kind $kind -Locked $locked.$arr -Custom $custom.$arr
|            $doc.$arr = $m.Items
|            $states = $m.States
|            if ($kind -eq 'collection-scope' -and $custom.providers) {
|                foreach ($pp in $custom.providers.PSObject.Properties) { $doc.providers | Add-Member -NotePropertyName $pp.Name -NotePropertyValue $pp.Value -Force }
|            }
|        }
|    }
|    return @{ Document = $doc; States = $states; Kind = $kind; Name = $Name }
|}
|
|function Get-SIDataModel {
|    <#
|    .SYNOPSIS  Every data-model template, merged, in one object the pipeline steps share.
|    #>
|    param([string]$Root, [string]$OverlayRoot)
|    $Root = Get-SIDataModelRoot $Root
|    $model = [ordered]@{ Root = $Root; Mappings = [ordered]@{}; Outputs = [ordered]@{}; States = [ordered]@{} }
|    foreach ($n in 'field-catalog', 'value-maps', 'risk-factors', 'lists', 'trust', 'criticality-mapping', 'collection-scope', 'coverage-checks', 'report-scope') {
|        # #541: report-scope is Risk Analysis's -- optional, so a run folder materialised before the template was published
|        # (Pro, the first run after the update) still loads; Risk Analysis then reads the shipped copy (RA-ScopePreamble.ps1)
|        if ($n -eq 'report-scope' -and -not (Test-Path -LiteralPath (Join-Path $Root ($n + '.locked.json')))) { continue }
|        $t = Get-SIDataModelTemplate -Name $n -Root $Root -OverlayRoot $OverlayRoot
|        $model[$n] = $t.Document
|        $model.States[$n] = $t.States
|    }
|    # the relations between CIs (#493, the asset graph): a template like the others; a data-model folder without it (a test
|    # root, a model materialised before it existed) has no relations, never an error
|    if (Test-Path -LiteralPath (Join-Path $Root 'relations.locked.json')) {
|        $t = Get-SIDataModelTemplate -Name 'relations' -Root $Root -OverlayRoot $OverlayRoot
|        $model['relations'] = $t.Document
|        $model.States['relations'] = $t.States
|    } else {
|        $model['relations'] = [pscustomobject]@{ kind = 'relation'; version = '0'; relations = @() }
|    }
|    # #561 / #562 the classification dimensions and rows: optional -- a data-model folder without them (a test root, a model
|    # materialised before they were published) classifies nothing, never an error
|    foreach ($n in 'dimensions', 'classification', 'finding-texts', 'severity-model') {
|        if (-not (Test-Path -LiteralPath (Join-Path $Root ($n + '.locked.json')))) { continue }
|        $t = Get-SIDataModelTemplate -Name $n -Root $Root -OverlayRoot $OverlayRoot
|        $model[$n] = $t.Document
|        $model.States[$n] = $t.States
|    }
|    foreach ($f in (Get-ChildItem -LiteralPath (Join-Path $Root 'mappings') -Filter '*.locked.json' | Sort-Object Name)) {
|        $n = 'mappings/' + $f.Name.Replace('.locked.json', '')
|        $t = Get-SIDataModelTemplate -Name $n -Root $Root -OverlayRoot $OverlayRoot
|        $model.Mappings[[string]$t.Document.provider] = $t.Document
|        $model.States[$n] = $t.States
|    }
|    foreach ($f in (Get-ChildItem -LiteralPath (Join-Path $Root 'outputs') -Filter '*.locked.json' | Sort-Object Name)) {
|        $n = 'outputs/' + $f.Name.Replace('.locked.json', '')
|        $t = Get-SIDataModelTemplate -Name $n -Root $Root -OverlayRoot $OverlayRoot
|        $model.Outputs[[string]$t.Document.id] = $t.Document
|        $model.States[$n] = $t.States
|    }
|    return $model
|}
|
|function Get-SIDataModelStatusLine {
|    <#
|    .SYNOPSIS  PURE. One plain line about the customer's data-model overrides (Community *.custom.json): how many items are
|               overridden / own / disabled, and which templates hold an override whose shipped item changed since it was
|               written (UpgradeAvailable -- review it; it is never merged). '' when nothing is overridden.
|    #>
|    param([Parameter(Mandatory)]$Model)
|    $c = @{ Overridden = 0; Own = 0; Disabled = 0; UpgradeAvailable = 0 }
|    $up = New-Object System.Collections.Generic.List[string]
|    foreach ($n in @($Model.States.Keys)) {
|        foreach ($s in @($Model.States[$n])) {
|            if ($null -eq $s -or -not $c.ContainsKey([string]$s.State)) { continue }
|            $c[[string]$s.State]++
|            if ($s.State -eq 'UpgradeAvailable') { $up.Add(('{0}:{1}' -f $n, $s.Key)) }
|        }
|    }
|    if (($c.Overridden + $c.Own + $c.Disabled + $c.UpgradeAvailable) -eq 0) { return '' }
|    $line = 'data model: your overrides are in force -- {0} overridden, {1} own, {2} removed' -f ($c.Overridden + $c.UpgradeAvailable), $c.Own, $c.Disabled
|    if ($up.Count) { $line += ('; {0} of them were written against an older shipped item (UpgradeAvailable -- compare and keep yours or take ours): {1}' -f $up.Count, (@($up | Select-Object -First 5) -join ', ')) }
|    return $line
|}
|
|function Get-SIDataModelListContext {
|    <# The condition context's Lists hashtable from the merged lists template. #>
|    param($Model)
|    $lists = @{}
|    foreach ($l in @($Model['lists'].lists)) { $lists[[string]$l.id] = $l }
|    return $lists
|}
|
|function Get-SIOutputMapOps { return , @('enum', 'first', 'join', 'join_ids', 'render', 'format_date', 'round', 'mask', 'domain_part', 'finding_key', 'if_class', 'lower', 'upper') }
|
|function Test-SIDataModel {
|    <#
|    .SYNOPSIS  Validates every template against every other. Returns a list of problems ("<template>: <problem>"); empty = valid.
|               What it proves: every field a mapping, factor, rule, check or output names exists in the catalog at the right
|               level and class; every operation is in its closed set; every value map and list a template names exists.
|    #>
|    param($Model)
|    $p = New-Object System.Collections.Generic.List[string]
|    $cat = $Model['field-catalog']
|    $validClasses = @($cat.classes) + 'finding'
|    $validTypes = 'string', 'bool', 'int', 'real', 'datetime', 'dynamic'
|    $validLevels = @($cat.levels.PSObject.Properties.Name)
|    $validPolicies = @($cat.policies.PSObject.Properties.Name)
|    $providers = @($cat.providers) + @($cat.authorityTokens.PSObject.Properties.Name)
|    $fields = @{}
|    foreach ($f in @($cat.fields)) {
|        $n = [string]$f.name
|        if ($fields.ContainsKey($n)) { $p.Add("field-catalog: '$n' is defined twice") }
|        $fields[$n] = $f
|        if ($n -cnotmatch '^[a-z][a-z0-9_]*$') { $p.Add("field-catalog: '$n' is not lower snake_case") }
|        if ($n -notmatch '^(si_|properties_)' -and -not ($providers -contains ($n.Split('_')[0])) -and $n -notmatch '^cmdb_record_id$') { $p.Add("field-catalog: '$n' has no owner prefix (si_ or a provider)") }
|        if ($validTypes -notcontains [string]$f.type) { $p.Add("field-catalog: '$n' has type '$($f.type)'") }
|        if ($validLevels -notcontains [string]$f.level) { $p.Add("field-catalog: '$n' has level '$($f.level)'") }
|        foreach ($c in @($f.classes)) { if ($validClasses -notcontains [string]$c) { $p.Add("field-catalog: '$n' has class '$c'") } }
|        if ($validPolicies -notcontains [string]$f.resolution.policy) { $p.Add("field-catalog: '$n' has policy '$($f.resolution.policy)'") }
|        foreach ($a in @($f.resolution.authority)) { if ($a -and $providers -notcontains [string]$a) { $p.Add("field-catalog: '$n' authority names unknown provider '$a'") } }
|        # #546 field authority by identity origin: resolution.byOrigin.<synced|cloud> = { policy, authority, decidedBy }
|        $bo = $null; if ($f.resolution) { $bo = Get-SIItemValue $f.resolution 'byOrigin' }
|        if ($null -ne $bo) {
|            foreach ($op in @($bo.PSObject.Properties)) {
|                if ($op.Name -notin 'synced', 'cloud') { $p.Add("field-catalog: '$n' byOrigin names unknown origin '$($op.Name)' (synced or cloud)"); continue }
|                $r = $op.Value
|                $rp = [string](Get-SIItemValue $r 'policy')
|                if ($rp -and ($validPolicies -notcontains $rp -or $rp -eq 'computed')) { $p.Add("field-catalog: '$n' byOrigin.$($op.Name) has policy '$rp'") }
|                $ra = @(@(Get-SIItemValue $r 'authority') | Where-Object { $_ })
|                if ($ra.Count -eq 0) { $p.Add("field-catalog: '$n' byOrigin.$($op.Name) names no authority provider") }
|                foreach ($a in $ra + @(@(Get-SIItemValue $r 'decidedBy') | Where-Object { $_ })) { if ($providers -notcontains [string]$a) { $p.Add("field-catalog: '$n' byOrigin.$($op.Name) names unknown provider '$a'") } }
|                foreach ($a in @(@(Get-SIItemValue $r 'decidedBy') | Where-Object { $_ })) { if ($ra -notcontains $a) { $p.Add("field-catalog: '$n' byOrigin.$($op.Name) decidedBy '$a' is not one of its authority providers") } }
|            }
|        }
|        if (@('strong', 'weak', 'none') -notcontains [string]$f.join) { $p.Add("field-catalog: '$n' has join '$($f.join)'") }
|    }
|
|    $vmaps = $Model['value-maps'].maps
|    $mapOps = Get-SIFieldMapperOps
|    foreach ($prov in $Model.Mappings.Keys) {
|        $m = $Model.Mappings[$prov]
|        if ($providers -notcontains $prov) { $p.Add("mappings/${prov}: provider is not in the catalog's provider list") }
|        $objs = @{}
|        foreach ($o in @($m.objects)) {
|            $objs[[string]$o.recordType] = [string]$o.class
|            if (-not $o.key) { $p.Add("mappings/${prov}: object '$($o.recordType)' has no key") }
|            if (-not $o.timestamp) { $p.Add("mappings/${prov}: object '$($o.recordType)' has no timestamp") }
|        }
|        foreach ($i in @($m.mappings)) {
|            $f = $fields[[string]$i.field]
|            if (-not $f) { $p.Add("mappings/${prov}: unknown field '$($i.field)'"); continue }
|            # #560 a FINDING record type (object class 'finding': a provider's vulnerability / recommendation) maps the generic SI
|            # finding fields -- a finding field, or a CI field that is also carried on a finding (its catalog 'finding' block);
|            # any other record type maps record fields only, as before
|            $rtsI = @(@($i.recordTypes) | Where-Object { $objs.ContainsKey([string]$_) })
|            $onFinding = ($rtsI.Count -gt 0 -and @($rtsI | Where-Object { $objs[[string]$_] -ne 'finding' }).Count -eq 0)
|            $alsoFinding = ($null -ne (Get-SIItemValue $f 'finding'))
|            if ($onFinding) {
|                if ([string]$f.level -ne 'finding' -and -not $alsoFinding) { $p.Add("mappings/${prov}: '$($i.field)' is not a finding field (a finding record type maps finding fields)") }
|            } elseif ([string]$f.level -in 'ci', 'finding') { $p.Add("mappings/${prov}: '$($i.field)' is a $($f.level) field and cannot be mapped") }
|            if (@(@($i.recordTypes) | Where-Object { $objs.ContainsKey([string]$_) -and $objs[[string]$_] -eq 'finding' }).Count -gt 0 -and -not $onFinding) { $p.Add("mappings/${prov}: '$($i.field)' mixes a finding record type with an asset record type") }
|            foreach ($rt in @($i.recordTypes)) {
|                if (-not $objs.ContainsKey([string]$rt)) { $p.Add("mappings/${prov}: '$($i.field)' names record type '$rt' with no object"); continue }
|                $cls = $objs[[string]$rt]
|                if ($cls -eq 'finding') { continue }
|                if ($cls -ne '*' -and @($f.classes) -notcontains $cls) { $p.Add("mappings/${prov}: '$($i.field)' is not a $cls field") }
|            }
|            if (@($i.sources).Count -eq 0) { $p.Add("mappings/${prov}: '$($i.field)' has no source") }
|            foreach ($step in @($i.normalize)) {
|                if (-not $step) { continue }
|                $op = ([string]$step).Split(':')[0]
|                if ($mapOps -notcontains $op) { $p.Add("mappings/${prov}: '$($i.field)' uses unknown operation '$op'") }
|                if ($op -eq 'enum') { $id = ([string]$step).Substring(5); if ($null -eq $vmaps.PSObject.Properties[$id]) { $p.Add("mappings/${prov}: '$($i.field)' names unknown value map '$id'") } }
|            }
|            if ($i.combine -and @('first', 'max', 'min', 'any_true', 'union') -notcontains [string]$i.combine) { $p.Add("mappings/${prov}: '$($i.field)' has combine '$($i.combine)'") }
|            # #455: an authority field says which provider wins -- a provider that fills it must have its place in that
|            # order (a CMDB provider's place is the cmdb_owner token), or its value only ever wins by accident
|            if ([string]$f.resolution.policy -eq 'authority') {
|                $auth = @($f.resolution.authority)
|                $placed = ($auth -contains $prov) -or ($prov -in 'cmdb', 'servicenow' -and $auth -contains 'cmdb_owner')
|                if (-not $placed) { $p.Add("mappings/${prov}: fills '$($i.field)' but '$prov' has no place in the field's authority order") }
|            }
|        }
|    }
|
|    $lists = @{}
|    foreach ($l in @($Model['lists'].lists)) {
|        if ($lists.ContainsKey([string]$l.id)) { $p.Add("lists: '$($l.id)' is defined twice") }
|        $lists[[string]$l.id] = $l
|        if (@('conditions', 'values', 'ranges') -notcontains [string]$l.type) { $p.Add("lists: '$($l.id)' has type '$($l.type)'") }
|        if ([string]$l.type -eq 'ranges') { foreach ($r in @($l.values)) { if ($r -and -not (Test-SIIpInCidr ([string]$r).Split('/')[0] ([string]$r))) { $p.Add("lists: '$($l.id)' range '$r' is not a CIDR") } } }
|    }
|    $condOps = Get-SIConditionOps
|    $checkCondition = {
|        param([string]$Where, $Cond)
|        if ($null -eq $Cond) { return }
|        foreach ($g in 'all', 'any') {
|            if ($Cond.PSObject.Properties[$g]) { foreach ($c in @($Cond.$g)) { & $checkCondition $Where $c }; return }
|        }
|        $fn = [string]$Cond.field
|        if (-not $fields.ContainsKey($fn) -and $fn -notmatch '^properties\.') { $p.Add("${Where}: condition reads unknown field '$fn'") }
|        if ($condOps -notcontains [string]$Cond.op) { $p.Add("${Where}: unknown condition operation '$($Cond.op)'") }
|        if ([string]$Cond.op -in 'in_list', 'in_ranges' -and -not $lists.ContainsKey([string]$Cond.value)) { $p.Add("${Where}: names unknown list '$($Cond.value)'") }
|        if ([string]$Cond.op -eq 'contains_any' -and $Cond.value -is [string] -and -not $lists.ContainsKey([string]$Cond.value)) { $p.Add("${Where}: names unknown list '$($Cond.value)'") }
|        if ([string]$Cond.op -eq 'matches') { try { [void][regex]::new([string]$Cond.value) } catch { $p.Add("${Where}: invalid pattern '$($Cond.value)'") } }
|    }
|    foreach ($l in $lists.Values) { if ([string]$l.type -eq 'conditions') { foreach ($e in @($l.entries)) { & $checkCondition "lists/$($l.id)/$($e.name)" $e.when } } }
|
|    $factorIds = @{}; $tokens = @{}; $shortNames = @{}
|    foreach ($fc in @($Model['risk-factors'].factors)) {
|        $id = [string]$fc.id
|        if ($factorIds.ContainsKey($id)) { $p.Add("risk-factors: '$id' is defined twice") }
|        $factorIds[$id] = $fc
|        if (@('asset', 'finding') -notcontains [string]$fc.appliesTo) { $p.Add("risk-factors: '$id' appliesTo '$($fc.appliesTo)'") }
|        if (@('probability', 'consequence') -notcontains [string]$fc.axis) { $p.Add("risk-factors: '$id' axis '$($fc.axis)'") }
|        # #559 risk factor model v2: state replaces stage (shortName / group / class / impact 1-5 / a builtin is never
|        # disabled are checked per item by Test-SIRiskFactorItem, below, so a customer override is held to them too)
|        if (@('enabled', 'disabled') -notcontains [string](Get-SIItemValue $fc 'state')) { $p.Add("risk-factors: '$id' state '$(Get-SIItemValue $fc 'state')' (enabled | disabled)") }
|        if (@('catalog', 'report') -notcontains [string]$fc.evaluatedBy) { $p.Add("risk-factors: '$id' evaluatedBy '$($fc.evaluatedBy)'") }
|        if ($null -eq (ConvertTo-SINumberOrNull $fc.impact)) { $p.Add("risk-factors: '$id' impact is not a number") }
|        $sn = ([string](Get-SIItemValue $fc 'shortName')).ToLowerInvariant()
|        if ($sn) { if ($shortNames.ContainsKey($sn)) { $p.Add("risk-factors: short name '$(Get-SIItemValue $fc 'shortName')' is used by '$($shortNames[$sn])' and '$id'") } else { $shortNames[$sn] = $id } }
|        foreach ($t in @($fc.legacyTokens)) { if ($t) { if ($tokens.ContainsKey([string]$t)) { $p.Add("risk-factors: legacy token '$t' is claimed by '$($tokens[[string]$t])' and '$id'") }; $tokens[[string]$t] = $id } }
|        if ([string]$fc.evaluatedBy -eq 'catalog') {
|            & $checkCondition "risk-factors/$id" $fc.when
|            foreach ($fn in (Get-SIConditionFields $fc.when)) {
|                $fd = $fields[$fn]
|                if ($fd -and [string]$fc.appliesTo -eq 'asset' -and [string]$fd.level -eq 'finding') { $p.Add("risk-factors/${id}: an asset factor reads finding field '$fn'") }
|            }
|        }
|    }
|
|    # the Azure CI scope: every Azure type is an ARM type, and a child type's rollUpInto names its parent types, 'path' or
|    # dot paths to find the parent, and a catalog field to be listed in (SI-AzureChildren.ps1)
|    if ($null -ne $Model['collection-scope']) {
|        foreach ($x in @(Test-SIAzureCiScopeItems -Document $Model['collection-scope'] -Fields $fields)) { $p.Add("collection-scope: $x") }
|    }
|
|    foreach ($ck in @($Model['coverage-checks'].checks)) {
|        if (@('tenant', 'subscription', 'ci') -notcontains [string]$ck.scope) { $p.Add("coverage-checks: '$($ck.id)' scope '$($ck.scope)'") }
|        if ([string]$ck.scope -eq 'ci') { & $checkCondition "coverage-checks/$($ck.id)" $ck.fail }
|        if ($ck.riskFactor -and -not $factorIds.ContainsKey([string]$ck.riskFactor)) { $p.Add("coverage-checks: '$($ck.id)' names unknown risk factor '$($ck.riskFactor)'") }
|    }
|
|    $outOps = Get-SIOutputMapOps
|    foreach ($oid in $Model.Outputs.Keys) {
|        $o = $Model.Outputs[$oid]
|        if (@('ci', 'ci_finding', 'finding_summary', 'record') -notcontains [string]$o.grain) { $p.Add("outputs/${oid}: grain '$($o.grain)'") }
|        $targets = @{}
|        $names = @{}
|        foreach ($c in @($o.columns)) {
|            if ($targets.ContainsKey([string]$c.target)) { $p.Add("outputs/${oid}: column '$($c.target)' appears twice") }
|            $targets[[string]$c.target] = 1
|            # the name the output gives the column: 'as' (a customer's rename) or the target -- one line, unique per output
|            $as = [string](Get-SIItemValue $c 'as')
|            $name = [string]$c.target
|            if (-not [string]::IsNullOrWhiteSpace($as)) {
|                $name = $as.Trim()
|                if ($name.Length -gt 128 -or $name -match '[\r\n\t]') { $p.Add("outputs/${oid}: column '$($c.target)' has a name ('as') that is not one line of at most 128 characters") }
|            }
|            if ($names.ContainsKey($name.ToLowerInvariant())) { $p.Add("outputs/${oid}: two columns are named '$name'") }
|            $names[$name.ToLowerInvariant()] = 1
|            $from = [string]$c.from
|            if (-not ($from.StartsWith('$') -or $from -match '^(finding|summary|record)\.' -or $fields.ContainsKey($from))) { $p.Add("outputs/${oid}: column '$($c.target)' reads unknown field '$from'") }
|            if ($c.op) {
|                $op = ([string]$c.op).Split(':')[0]
|                if ($outOps -notcontains $op) { $p.Add("outputs/${oid}: column '$($c.target)' uses unknown operation '$op'") }
|                if ($op -eq 'enum') { $id = ([string]$c.op).Substring(5); if ($null -eq $vmaps.PSObject.Properties[$id]) { $p.Add("outputs/${oid}: column '$($c.target)' names unknown value map '$id'") } }
|            }
|        }
|    }
|
|    $seen = @{}
|    foreach ($t in @($Model['trust'].order)) { if ($seen.ContainsKey([string]$t.id)) { $p.Add("trust: '$($t.id)' appears twice") }; $seen[[string]$t.id] = 1 }
|
|    foreach ($sect in 'criticality', 'dataSensitivity') {
|        foreach ($prov in $Model['criticality-mapping'].$sect.PSObject.Properties) {
|            if ($prov.Name.StartsWith('$')) { continue }
|            if (@('cmdb', 'servicenow') -notcontains $prov.Name) { $p.Add("criticality-mapping: $sect names unknown CMDB provider '$($prov.Name)'") }
|            foreach ($e in @($prov.Value)) {
|                if ($null -eq (ConvertTo-SINumberOrNull $e.factor)) { $p.Add("criticality-mapping: $sect/$($prov.Name) '$($e.value)' has no numeric factor") }
|                if ($sect -eq 'criticality' -and @('critical', 'high', 'medium', 'low') -notcontains [string]$e.level) { $p.Add("criticality-mapping: $($prov.Name) '$($e.value)' has level '$($e.level)'") }
|            }
|        }
|    }
|    # #527 (5)-(7): one scope per factor, no tier, SI fields only (SI-RiskFactorCatalog.ps1) -- a customer override is held to them too
|    # (Test-SIRiskFactorRules includes #559 Test-SIRiskFactorModelV2: shortName, group, class, impact 1-5, a built-in factor
|    #  is never disabled -- the engine-side twin of the web app's check)
|    foreach ($x in (Test-SIRiskFactorRules -Model $Model)) { $p.Add($x) }
|    # #559 break_glass_patterns: a values list of glob patterns, never wildcards only (the web app's rule too)
|    foreach ($x in (Test-SIBreakGlassPatterns -Model $Model)) { $p.Add($x) }
|    # the break-glass extension attribute the customer defines: attribute=value entries (engine/data-model/SI-BreakGlass.ps1)
|    if (-not (Get-Command -Name Test-SIBreakGlassAttributeList -ErrorAction SilentlyContinue)) { $bgFile = Join-Path $PSScriptRoot 'SI-BreakGlass.ps1'; if (Test-Path -LiteralPath $bgFile) { . $bgFile } }
|    if (Get-Command -Name Test-SIBreakGlassAttributeList -ErrorAction SilentlyContinue) { foreach ($x in (Test-SIBreakGlassAttributeList -Model $Model)) { $p.Add($x) } }
|    # the risk rating bands are data (owner decision pending): three whole numbers, highest first
|    foreach ($x in (Test-SIRiskRatingBands -Model $Model)) { $p.Add($x) }
|
|    # #493 the relations between CIs: every relation reads a catalog field valid on its classes, names a known target kind,
|    # an identifier type for 'id', a node type for 'node'; a reversed relation must point at CI ids
|    $relSeen = @{}
|    foreach ($r in @(Get-SIItemValue $Model['relations'] 'relations')) {
|        if ($null -eq $r) { continue }
|        $rid = [string]$r.id
|        if (-not $rid -or $rid -cnotmatch '^[a-z][a-z0-9_]{0,47}$') { $p.Add("relations: '$rid' is not a lower snake_case id of at most 48 characters"); continue }
|        if ($relSeen.ContainsKey($rid)) { $p.Add("relations: '$rid' is defined twice") }
|        $relSeen[$rid] = 1
|        if ([string]$r.kind -cnotmatch '^[a-z][a-z0-9_]{0,47}$') { $p.Add("relations/${rid}: kind '$($r.kind)' is not a lower snake_case word of at most 48 characters") }
|        $fd = $fields[[string]$r.field]
|        if (-not $fd) { $p.Add("relations/${rid}: reads unknown field '$($r.field)'") }
|        elseif ([string]$fd.level -eq 'finding') { $p.Add("relations/${rid}: '$($r.field)' is a finding field") }
|        foreach ($c in @($r.from)) {
|            if (@($cat.classes) -notcontains [string]$c) { $p.Add("relations/${rid}: from names unknown class '$c'") }
|            elseif ($fd -and @($fd.classes) -notcontains [string]$c) { $p.Add("relations/${rid}: '$($r.field)' is not a $c field") }
|        }
|        if (@($r.from).Count -eq 0) { $p.Add("relations/${rid}: names no 'from' class") }
|        switch ([string]$r.target) {
|            'ci' { }
|            'id' { if (-not ([string]$r.idType)) { $p.Add("relations/${rid}: target 'id' needs an idType") } }
|            'node' { if (-not ([string]$r.nodeType)) { $p.Add("relations/${rid}: target 'node' needs a nodeType") } }
|            default { $p.Add("relations/${rid}: target '$($r.target)' (ci | id | node)") }
|        }
|        if ((Get-SIItemValue $r 'reverse') -eq $true -and [string]$r.target -ne 'ci') { $p.Add("relations/${rid}: only a relation to CI ids can be reversed") }
|        $q = [string](Get-SIItemValue $r 'qualifyWith'); if ($q -and -not $fields.ContainsKey($q)) { $p.Add("relations/${rid}: qualifyWith names unknown field '$q'") }
|        if (@('exact', 'strong', 'weak') -notcontains [string]$r.confidence) { $p.Add("relations/${rid}: confidence '$($r.confidence)' (exact | strong | weak)") }
|        $st = [string](Get-SIItemValue $r 'stage'); if ($st -and @('production', 'testing', 'not_used') -notcontains $st) { $p.Add("relations/${rid}: stage '$st'") }
|    }
|    # #561 / #562 the classification dimensions and rows: valid, and every field they read or write is in the catalog
|    if ($null -ne $Model['dimensions'] -or $null -ne $Model['classification']) {
|        foreach ($x in (Test-SIClassifications -Dimensions $Model['dimensions'] -Classification $Model['classification'] -Fields $fields)) { $p.Add([string]$x) }
|    }
|    # #560 the finding texts of SI's own reports: every field they fill is a finding field of the catalog
|    if ($null -ne $Model['finding-texts']) {
|        $ff = [string[]]@($fields.Keys | Where-Object { [string]$fields[$_].level -eq 'finding' -or $null -ne (Get-SIItemValue $fields[$_] 'finding') })
|        foreach ($x in (Test-SIFindingTexts -Document $Model['finding-texts'] -FindingFields $ff)) { $p.Add([string]$x) }
|    }
|    # #690 (15) the severity model: five SI values, every report ends with its own severity
|    if ($null -ne $Model['severity-model']) {
|        foreach ($x in (Test-SISeverityModel -Model $Model['severity-model'])) { $p.Add([string]$x) }
|    }
|    # one problem per output item: @(Test-SIDataModel ...) and a pipeline filter see each problem, never one array
|    return $p.ToArray()
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE SEVERITY MODEL (#690 (15), data-model/severity-model.locked.json)
|#  Owner 2026-10-15: "all security findings must have severity" / "it comes from different metrics, often impact score or
|#  directly from the source" / "unknown is not supported in any report" / "field must be normalized". Every report declares
|#  an ORDERED list of metric kinds; the first kind whose metric a row carries decides; owner_defined is always last, so a
|#  row always ends with exactly one of the five SI values. The reports' queries do not read the model yet (the generated
|#  severity block is the next step) -- these functions are the model's one reader and its validation.
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SISeverityScale { <# The five SI severities -- the only values a report's SecuritySeverity may hold. #> @('Very High', 'High', 'Medium-High', 'Medium', 'Low') }
|
|function Get-SISeverityModel {
|    <# The severity model of the run (the data model + its overrides), else the shipped file next to this file's data model. #>
|    param($Model, [string]$Root)
|    if ($Model -and $null -ne $Model['severity-model']) { return $Model['severity-model'] }
|    $r = Get-SIDataModelRoot $Root
|    $f = Join-Path $r 'severity-model.locked.json'
|    if (-not (Test-Path -LiteralPath $f)) { return $null }
|    return (Get-SIDataModelTemplate -Name 'severity-model' -Root $r).Document
|}
|
|function Test-SISeverityModel {
|    <# PURE. The problems of a severity model (none = valid): the scale is exactly the five SI values, every kind maps
|       only into it, every report's order names known kinds and ends with owner_defined, and its own severity is one of
|       the five. #>
|    param([Parameter(Mandatory)]$Model)
|    $p = New-Object System.Collections.Generic.List[string]
|    $scale = @(Get-SIItemValue $Model 'scale' | ForEach-Object { [string]$_ })
|    if (($scale -join '|') -cne ((Get-SISeverityScale) -join '|')) { $p.Add("severity-model: the scale must be exactly $((Get-SISeverityScale) -join ', ')") }
|    $kinds = @{}
|    foreach ($m in @(Get-SIItemValue $Model 'models')) {
|        $id = [string](Get-SIItemValue $m 'id'); $ty = [string](Get-SIItemValue $m 'type')
|        if (-not $id) { $p.Add('severity-model: a model has no id'); continue }
|        if ($kinds.ContainsKey($id)) { $p.Add("severity-model: '$id' is defined twice") }
|        $kinds[$id] = $m
|        if (@('map', 'bands', 'fixed') -cnotcontains $ty) { $p.Add("severity-model/${id}: type '$ty' (map | bands | fixed)") }
|        if ($ty -eq 'map') {
|            $map = Get-SIItemValue $m 'map'
|            if ($null -eq $map) { $p.Add("severity-model/${id}: a map model has a 'map'") }
|            else { foreach ($e in $map.PSObject.Properties) { if ((Get-SISeverityScale) -cnotcontains [string]$e.Value) { $p.Add("severity-model/${id}: '$($e.Name)' maps to '$($e.Value)', not an SI severity") } } }
|        }
|        if ($ty -eq 'bands') {
|            $prev = [double]::MaxValue
|            $bands = @(Get-SIItemValue $m 'bands')
|            if ($bands.Count -eq 0) { $p.Add("severity-model/${id}: a bands model has 'bands'") }
|            foreach ($b in $bands) {
|                $min = ConvertTo-SINumberOrNull (Get-SIItemValue $b 'min')
|                if ($null -eq $min) { $p.Add("severity-model/${id}: a band has no numeric min"); continue }
|                if ($min -ge $prev) { $p.Add("severity-model/${id}: bands are highest first") }
|                $prev = $min
|                if ((Get-SISeverityScale) -cnotcontains [string](Get-SIItemValue $b 'severity')) { $p.Add("severity-model/${id}: band $min maps to '$(Get-SIItemValue $b 'severity')', not an SI severity") }
|            }
|        }
|    }
|    if (-not $kinds.ContainsKey('owner_defined')) { $p.Add("severity-model: the owner_defined kind is missing") }
|    $seen = @{}
|    foreach ($r in @(Get-SIItemValue $Model 'reports')) {
|        $rid = [string](Get-SIItemValue $r 'id')
|        if (-not $rid) { $p.Add('severity-model: a report has no id'); continue }
|        if ($seen.ContainsKey($rid)) { $p.Add("severity-model: report '$rid' is listed twice") }
|        $seen[$rid] = $true
|        $order = @(Get-SIItemValue $r 'order' | ForEach-Object { [string]$_ })
|        if ($order.Count -eq 0 -or $order[$order.Count - 1] -cne 'owner_defined') { $p.Add("severity-model/${rid}: the order ends with owner_defined (every row gets a severity)") }
|        foreach ($k in $order) { if (-not $kinds.ContainsKey($k)) { $p.Add("severity-model/${rid}: unknown kind '$k'") } }
|        if ((Get-SISeverityScale) -cnotcontains [string](Get-SIItemValue $r 'ownerDefined')) { $p.Add("severity-model/${rid}: ownerDefined '$(Get-SIItemValue $r 'ownerDefined')' is not an SI severity") }
|    }
|    return $p.ToArray()
|}
|
|function Test-SISeverityModelReportItem {
|    <# PURE. One report item of the severity model on its own (a Pro override): the problems, none = accepted. The kinds
|       it names are checked against the model when the run's whole model is validated (Test-SIDataModel). #>
|    param([Parameter(Mandatory)]$Item)
|    $p = New-Object System.Collections.Generic.List[string]
|    $rid = [string](Get-SIItemValue $Item 'id')
|    $order = @(Get-SIItemValue $Item 'order' | ForEach-Object { [string]$_ })
|    if ($order.Count -eq 0 -or $order[$order.Count - 1] -cne 'owner_defined') { $p.Add("severity-model/${rid}: the order ends with owner_defined (every row gets a severity)") }
|    if ((Get-SISeverityScale) -cnotcontains [string](Get-SIItemValue $Item 'ownerDefined')) { $p.Add("severity-model/${rid}: ownerDefined must be one of $((Get-SISeverityScale) -join ', ')") }
|    return $p.ToArray()
|}
|
|function Resolve-SISeverity {
|    <#
|        PURE. One row's severity: the report's kinds in order, the first whose metric -Metrics carries (a hashtable kind ->
|        value: a word for a map kind, a number for a bands kind) decides; owner_defined (the report's ownerDefined) last.
|        A report the model does not list returns $null -- never a guessed value (SIv3-SeverityModel keeps every shipped
|        report listed). Always one of the five SI values or $null; never 'Unknown'.
|    #>
|    param([Parameter(Mandatory)]$Model, [Parameter(Mandatory)][string]$ReportName, [hashtable]$Metrics = @{})
|    $rep = @(@(Get-SIItemValue $Model 'reports') | Where-Object { [string](Get-SIItemValue $_ 'id') -eq $ReportName }) | Select-Object -First 1
|    if ($null -eq $rep) { return $null }
|    $kinds = @{}; foreach ($m in @(Get-SIItemValue $Model 'models')) { $kinds[[string](Get-SIItemValue $m 'id')] = $m }
|    foreach ($k in @(Get-SIItemValue $rep 'order' | ForEach-Object { [string]$_ })) {
|        if ($k -eq 'owner_defined') { return [string](Get-SIItemValue $rep 'ownerDefined') }
|        $m = $kinds[$k]; if ($null -eq $m -or -not $Metrics.ContainsKey($k)) { continue }
|        $v = $Metrics[$k]; if ($null -eq $v -or ([string]$v).Trim() -eq '') { continue }
|        switch ([string](Get-SIItemValue $m 'type')) {
|            'map' {
|                $map = Get-SIItemValue $m 'map'; $key = ([string]$v).Trim().ToLowerInvariant()
|                $hit = $null; foreach ($e in $map.PSObject.Properties) { if ($e.Name.ToLowerInvariant() -eq $key) { $hit = [string]$e.Value; break } }
|                if ($hit) { return $hit }
|            }
|            'bands' {
|                $n = ConvertTo-SINumberOrNull $v
|                if ($null -eq $n) { break }
|                foreach ($b in @(Get-SIItemValue $m 'bands')) { if ($n -ge [double](ConvertTo-SINumberOrNull (Get-SIItemValue $b 'min'))) { return [string](Get-SIItemValue $b 'severity') } }
|            }
|        }
|    }
|    return [string](Get-SIItemValue $rep 'ownerDefined')
|}
'@ }
$__siSupportFiles['engine/data-model/SI-FieldMapper.ps1'] = @{ Sha256 = '7cbad047b4bd072006357b8336ea5133ae19e4cef1e73a743cf1539435398a80'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight field mapper -- turns one provider object into one SI RECORD, using the provider's field mapping
|    (data-model/mappings/<provider>.json), the shared value maps and the field catalog. V3-DATA-MODEL part 2, P1.
|
|    A mapping item:  { field, recordTypes[], sources[], normalize[], combine?, resourceTypes? }
|      sources    dot paths into the provider object, case-insensitive; "[*]" walks an array. Tried in order.
|      normalize  a chain from the CLOSED operation set below, applied to every value a source produced.
|      combine    first (default: the first source with a value) | max | min | any_true | union (all sources).
|      resourceTypes  the item applies only to records of these Azure resource types.
|    For one field, the first applicable mapping item that yields a value wins (more specific items come first).
|
|    THE OPERATION SET IS CLOSED (a template or a customer override cannot run code):
|      lower upper trim split:<sep> first require_contains:<text> ip mac cidr enum:<value-map> bool not equals:<value>
|      present int number count datetime_utc filetime_utc parse_json to_list tags:<source> select:<key>=<value>:<take>
|      base64_guid regex_extract:<pattern> host_from_url uac_enabled uac_flag:<n> dn_cn if_true:<value>
|    An unknown operation throws.
|
|    A source field that is missing is NOT an error: the SI field stays empty and the field is reported in .Missing, so
|    the collector can count "mapped field missing" per (provider, field) -- the signal Invardia's provider scan uses.
|
|    PowerShell 5.1: no ?. / ??, no ternary, no Set-StrictMode.
|#>
|
|. (Join-Path $PSScriptRoot 'SI-Conditions.ps1')
|
|function Get-SIFieldMapperOps {
|    return , @('lower', 'upper', 'trim', 'split', 'first', 'require_contains', 'ip', 'mac', 'cidr', 'enum', 'bool', 'not', 'equals',
|        'present', 'int', 'number', 'count', 'datetime_utc', 'filetime_utc', 'parse_json', 'to_list', 'tags', 'select',
|        'base64_guid', 'regex_extract', 'host_from_url', 'uac_enabled', 'uac_flag', 'dn_cn', 'if_true')
|}
|
|function Get-SIMapItemWhenAbsent {
|    <#
|        PURE. A mapping item's `whenAbsent` -- the value the field gets when the record carries the source OBJECT but none of
|        the item's paths has a value (si_publisher_verified: an SP without verifiedPublisher.verifiedPublisherId is NOT
|        verified, so false). Returns @{ Has; Value }.
|        Opt-in per item on purpose, not a change to `present`: present feeds si_fix_available too, and the zero-day factor
|        fires on si_fix_available false -- a generic "absent = false" would have marked every CVE without a named security
|        update (all third-party software) a zero-day.
|    #>
|    param($MapItem)
|    if ($null -eq $MapItem) { return @{ Has = $false; Value = $null } }
|    if ($MapItem -is [System.Collections.IDictionary]) {
|        if ($MapItem.Contains('whenAbsent')) { return @{ Has = $true; Value = $MapItem['whenAbsent'] } }
|        return @{ Has = $false; Value = $null }
|    }
|    $p = $MapItem.PSObject.Properties['whenAbsent']
|    if ($null -ne $p -and $null -ne $p.Value) { return @{ Has = $true; Value = $p.Value } }
|    return @{ Has = $false; Value = $null }
|}
|
|function Test-SISourceRootPresent {
|    <#
|        PURE. Is the OBJECT a source path starts in there (sp in "sp.verifiedPublisher.verifiedPublisherId")? Only then is a
|        missing rest of the path a real "absent" (whenAbsent applies). A one-segment path, or an object without that root,
|        says nothing: a record that never carried the object must not be told the value is absent.
|    #>
|    param($Object, [string]$Path)
|    if ($null -eq $Object -or [string]::IsNullOrEmpty($Path)) { return $false }
|    $i = $Path.IndexOf('.')
|    if ($i -le 0) { return $false }
|    $root = $Path.Substring(0, $i) -replace '\[\*\]$', ''
|    if ($Object -is [System.Collections.IDictionary]) {
|        foreach ($k in $Object.Keys) { if ([string]::Equals([string]$k, $root, [StringComparison]::OrdinalIgnoreCase)) { return ($null -ne $Object[$k]) } }
|        return $false
|    }
|    $p = $Object.PSObject.Properties[$root]
|    return ($null -ne $p -and $null -ne $p.Value)
|}
|
|function Resolve-SISourcePath {
|    <#
|    .SYNOPSIS  Every value at a dot path in an object (case-insensitive). "a.b[*].c" walks the array b. Returns a list.
|               Without [*] an array value is returned as ONE value (so count / select / tags can see the whole array).
|               A JSON string met on the way (e.g. an advanced-hunting dynamic column) is parsed and walked into.
|    #>
|    param($Object, [Parameter(Mandatory)][string]$Path)
|    $current = [System.Collections.Generic.List[object]]::new()
|    $current.Add($Object)
|    foreach ($segRaw in $Path.Split('.')) {
|        $walk = $segRaw.EndsWith('[*]')
|        $seg = $segRaw
|        if ($walk) { $seg = $segRaw.Substring(0, $segRaw.Length - 3) }
|        $next = [System.Collections.Generic.List[object]]::new()
|        foreach ($o in $current) {
|            if ($null -eq $o) { continue }
|            $node = $o
|            if ($node -is [string]) {
|                $t = $node.Trim()
|                if ($t.StartsWith('{') -or $t.StartsWith('[')) { try { $node = $t | ConvertFrom-Json } catch { continue } } else { continue }
|            }
|            # Get-SIItemValue, inline (the innermost call of every mapped field of every record -- #475)
|            $v = $null
|            if ([string]::IsNullOrEmpty($seg)) { continue }
|            if ($node -is [System.Collections.IDictionary]) {
|                if ($node.Contains($seg)) { $v = $node[$seg] }
|                else { foreach ($k in $node.Keys) { if ([string]::Equals([string]$k, $seg, [StringComparison]::OrdinalIgnoreCase)) { $v = $node[$k]; break } } }
|            } else {
|                $pp0 = $node.PSObject.Properties[$seg]
|                if ($pp0) { $v = $pp0.Value }
|            }
|            if ($null -eq $v) { continue }
|            if ($walk) {
|                if ($v -is [string]) {
|                    $t = $v.Trim()
|                    if ($t.StartsWith('[')) { try { $v = $t | ConvertFrom-Json } catch { } }
|                }
|                if ($v -is [System.Collections.IDictionary]) {
|                    # [*] over an object keyed by name (Shodan's vulns: { "CVE-...": {...} }) walks its values
|                    foreach ($x in $v.Values) { if ($null -ne $x) { $next.Add($x) } }
|                } elseif ($v -is [System.Collections.IEnumerable] -and -not ($v -is [string])) {
|                    foreach ($x in $v) { if ($null -ne $x) { $next.Add($x) } }
|                } elseif ($v -is [System.Management.Automation.PSCustomObject]) {
|                    foreach ($pp in $v.PSObject.Properties) { if ($null -ne $pp.Value) { $next.Add($pp.Value) } }
|                } else { $next.Add($v) }
|            } else { $next.Add($v) }
|        }
|        $current = $next
|    }
|    return , $current
|}
|
|function Get-SIValueMapResult {
|    <# Looks a value up in a value map: { "$match": exact|prefix|contains, "<key>": <value>, ..., "$default": ... }. #>
|    param($Map, $Value)
|    $mode = [string](Get-SIItemValue $Map '$match'); if (-not $mode) { $mode = 'exact' }
|    $s = ([string]$Value).Trim()
|    $keys = @()
|    if ($Map -is [System.Collections.IDictionary]) { $keys = @($Map.Keys) } else { $keys = @($Map.PSObject.Properties.Name) }
|    # longest key first, so "WindowsServer" wins over "Windows" in prefix / contains mode
|    foreach ($k in ($keys | Where-Object { -not ([string]$_).StartsWith('$') } | Sort-Object { ([string]$_).Length } -Descending)) {
|        $ks = [string]$k
|        $hit = $false
|        switch ($mode) {
|            'prefix' { $hit = $s.StartsWith($ks, [StringComparison]::OrdinalIgnoreCase) }
|            'contains' { $hit = ($s.IndexOf($ks, [StringComparison]::OrdinalIgnoreCase) -ge 0) }
|            default { $hit = [string]::Equals($s, $ks, [StringComparison]::OrdinalIgnoreCase) }
|        }
|        if ($hit) { return , @{ Found = $true; Value = (Get-SIItemValue $Map $ks) } }
|    }
|    $hasDefault = ($Map -is [System.Collections.IDictionary] -and $Map.Contains('$default')) -or ($Map.PSObject.Properties['$default'])
|    if ($hasDefault) {
|        $d = Get-SIItemValue $Map '$default'
|        if ([string]$d -eq '$self_lower') { return , @{ Found = $true; Value = $s.ToLowerInvariant() } }
|        return , @{ Found = $true; Value = $d }
|    }
|    return , @{ Found = $false; Value = $null }
|}
|
|function Invoke-SINormalizeOp {
|    <# One operation over a list of values -> a new list. #>
|    param([System.Collections.Generic.List[object]]$Values, [string]$Op, [string]$Arg, $ValueMaps)
|    $out = [System.Collections.Generic.List[object]]::new()
|    switch ($Op) {
|        'lower' { foreach ($v in $Values) { $out.Add(([string]$v).ToLowerInvariant()) } }
|        'upper' { foreach ($v in $Values) { $out.Add(([string]$v).ToUpperInvariant()) } }
|        'trim' { foreach ($v in $Values) { if ($v -is [string]) { $t = $v.Trim(); if ($t) { $out.Add($t) } } else { $out.Add($v) } } }
|        'split' { foreach ($v in $Values) { foreach ($p in ([string]$v).Split([string[]]@($Arg), [StringSplitOptions]::None)) { $out.Add($p) } } }
|        'first' { if ($Values.Count -gt 0) { $out.Add($Values[0]) } }
|        'require_contains' { foreach ($v in $Values) { if (([string]$v).Contains($Arg)) { $out.Add($v) } } }
|        'ip' {
|            foreach ($v in $Values) {
|                $a = $null
|                if ([System.Net.IPAddress]::TryParse(([string]$v).Trim(), [ref]$a)) { $out.Add($a.ToString().ToLowerInvariant()) }
|            }
|        }
|        'mac' {
|            foreach ($v in $Values) {
|                $hex = ([string]$v -replace '[^0-9A-Fa-f]', '').ToLowerInvariant()
|                if ($hex.Length -eq 12 -and $hex -ne '000000000000' -and $hex -ne 'ffffffffffff') {
|                    $out.Add((($hex -split '(..)' | Where-Object { $_ }) -join ':'))
|                }
|            }
|        }
|        'cidr' {
|            foreach ($v in $Values) {
|                $s = ([string]$v).Trim(); $parts = $s.Split('/')
|                $a = $null
|                if ([System.Net.IPAddress]::TryParse($parts[0], [ref]$a)) { $out.Add($s.ToLowerInvariant()) }
|                elseif ($s -in '*', 'Internet', 'Any') { $out.Add('0.0.0.0/0') }
|            }
|        }
|        'enum' {
|            $map = Get-SIItemValue $ValueMaps $Arg
|            if ($null -eq $map) { throw "normalize enum:${Arg}: no such value map" }
|            foreach ($v in $Values) {
|                $r = Get-SIValueMapResult -Map $map -Value $v
|                if ($r.Found -and $null -ne $r.Value) { $out.Add($r.Value) }
|            }
|        }
|        'bool' { foreach ($v in $Values) { $b = ConvertTo-SIBoolOrNull $v; if ($null -ne $b) { $out.Add($b) } } }
|        'not' { foreach ($v in $Values) { $b = ConvertTo-SIBoolOrNull $v; if ($null -ne $b) { $out.Add((-not $b)) } } }
|        'equals' { foreach ($v in $Values) { $out.Add((Test-SIScalarEqual $v $Arg)) } }
|        'present' { $out.Add(($Values.Count -gt 0 -and -not (Test-SIValueEmpty $Values[0]))) }
|        'int' { foreach ($v in $Values) { $n = ConvertTo-SINumberOrNull $v; if ($null -ne $n) { $out.Add([long][Math]::Truncate($n)) } } }
|        'number' { foreach ($v in $Values) { $n = ConvertTo-SINumberOrNull $v; if ($null -ne $n) { $out.Add([double]$n) } } }
|        'count' {
|            if ($Values.Count -eq 1 -and $Values[0] -is [System.Collections.IEnumerable] -and -not ($Values[0] -is [string])) {
|                $c = 0; foreach ($x in $Values[0]) { $c++ }; $out.Add([long]$c)
|            } else { $out.Add([long]$Values.Count) }
|        }
|        'datetime_utc' { foreach ($v in $Values) { $t = ConvertTo-SIUtcOrNull $v; if ($null -ne $t -and $t.Year -gt 1601) { $out.Add($t) } } }
|        'filetime_utc' {
|            foreach ($v in $Values) {
|                $n = ConvertTo-SINumberOrNull $v
|                if ($null -ne $n -and $n -gt 0 -and $n -lt 2650467743999999999) { $out.Add([datetime]::FromFileTimeUtc([long]$n)) }
|            }
|        }
|        'parse_json' {
|            # #690 (35) a text that is not JSON is the value itself: the identity profile writes a ONE-item list as the bare
|            # item ("Global Administrator", not ["Global Administrator"]) -- dropping it lost every identity with exactly one
|            # role, permission or group (internal 2026-10-15: 3 of 6 Global Administrators, 17 of 22 standing roles). A text
|            # that parses is taken parsed, as before; only a text that looks like JSON ([ { ") and does not parse is dropped.
|            foreach ($v in $Values) {
|                if ($v -is [string]) {
|                    $t = $v.Trim()
|                    if (-not $t) { continue }
|                    $parsed = $null; $ok = $false
|                    try { $parsed = ($t | ConvertFrom-Json); $ok = $true } catch { $ok = $false }
|                    if ($ok) { if ($null -ne $parsed) { $out.Add($parsed) } }
|                    elseif (-not ($t.StartsWith('[') -or $t.StartsWith('{') -or $t.StartsWith('"'))) { $out.Add($t) }
|                } else { $out.Add($v) }
|            }
|        }
|        'to_list' { foreach ($v in $Values) { $out.Add($v) } }
|        'tags' {
|            foreach ($v in $Values) {
|                $node = $v
|                if ($node -is [string] -and $node.Trim().StartsWith('{')) { try { $node = $node | ConvertFrom-Json } catch { } }
|                if ($node -is [string]) {
|                    $kv = $node.Split([char[]]@('=', ':'), 2)
|                    if ($kv.Count -eq 2) { $out.Add([ordered]@{ source = $Arg; name = $kv[0].Trim(); value = $kv[1].Trim() }) }
|                    elseif ($node.Trim()) { $out.Add([ordered]@{ source = $Arg; name = $node.Trim(); value = '' }) }
|                } elseif ($node -is [System.Collections.IDictionary]) {
|                    foreach ($k in $node.Keys) { if (-not (Test-SIValueEmpty $node[$k])) { $out.Add([ordered]@{ source = $Arg; name = [string]$k; value = [string]$node[$k] }) } }
|                } elseif ($null -ne $node) {
|                    foreach ($p in $node.PSObject.Properties) { if (-not (Test-SIValueEmpty $p.Value)) { $out.Add([ordered]@{ source = $Arg; name = $p.Name; value = [string]$p.Value }) } }
|                }
|            }
|        }
|        'select' {
|            # select:<key>=<value>:<take>  -- e.g. select:type=AadDeviceId:id over an EntityIds array
|            # <value> may name alternatives a|b: the values of the FIRST alternative come first (then 'first' picks it)
|            $m = [regex]::Match($Arg, '^(?<k>[^=]+)=(?<v>[^:]+):(?<t>.+)$')
|            if (-not $m.Success) { throw "normalize select:${Arg}: expected <key>=<value>:<take>" }
|            # 🔴 Exposure Graph's EntityIds is an array of JSON TEXT, one string per id
|            # (["{\"type\":\"DeviceInventoryId\",\"id\":\"...\"}"]): an element that is JSON text is read as its object. It was
|            # not, so no Exposure Graph device or resource record carried its Defender device id or resource id, the CI build
|            # never joined it with its Defender / Azure record, and the two groups collided on one CI id -- ring 1 2026-10-10:
|            # 211 of 218 device CIs without their Defender link, every CVE finding without its CI (tier, factors).
|            $toObj = { param($x) if ($x -is [string]) { $t = $x.Trim(); if ($t.StartsWith('[') -or $t.StartsWith('{')) { try { return ($t | ConvertFrom-Json) } catch { return $null } }; return $null }; $x }
|            $alts = @($m.Groups['v'].Value -split '\|' | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|            $elems = New-Object System.Collections.Generic.List[object]
|            foreach ($v in $Values) {
|                # an array, or ONE object (select:<key>=<value>:<take> as a condition on an object, e.g. Exposure Graph rawData)
|                $arr = & $toObj $v
|                if ($null -eq $arr) { continue }
|                foreach ($e in (Get-SIValueList $arr)) { $o = & $toObj $e; if ($null -ne $o) { $elems.Add($o) } }
|            }
|            foreach ($alt in $alts) {
|                foreach ($e in $elems) {
|                    if (Test-SIScalarEqual (Get-SIItemValue $e $m.Groups['k'].Value) $alt) {
|                        $x = Get-SIItemValue $e $m.Groups['t'].Value
|                        if (-not (Test-SIValueEmpty $x)) { $out.Add($x) }
|                    }
|                }
|            }
|        }
|        'base64_guid' {
|            foreach ($v in $Values) {
|                try { $b = [Convert]::FromBase64String([string]$v); if ($b.Length -eq 16) { $out.Add((New-Object Guid (, $b)).ToString()) } } catch { }
|            }
|        }
|        'regex_extract' {
|            $rx = New-Object System.Text.RegularExpressions.Regex($Arg, [System.Text.RegularExpressions.RegexOptions]::IgnoreCase, ([TimeSpan]::FromMilliseconds(200)))
|            foreach ($v in $Values) {
|                $mm = $rx.Match([string]$v)
|                if ($mm.Success) { if ($mm.Groups.Count -gt 1) { $out.Add($mm.Groups[1].Value) } else { $out.Add($mm.Value) } }
|            }
|        }
|        'host_from_url' {
|            foreach ($v in $Values) {
|                $s = [string]$v; $u = $null
|                if ($s -match '^[a-z]+://' -and [Uri]::TryCreate($s, [UriKind]::Absolute, [ref]$u)) { $out.Add($u.Host.ToLowerInvariant()) } else { $out.Add($s.TrimEnd('/')) }
|            }
|        }
|        'if_true' { foreach ($v in $Values) { if ((ConvertTo-SIBoolOrNull $v) -eq $true) { $out.Add($Arg) } } }
|        'uac_enabled' { foreach ($v in $Values) { $n = ConvertTo-SINumberOrNull $v; if ($null -ne $n) { $out.Add((([long]$n -band 2) -eq 0)) } } }
|        # #546 one userAccountControl flag set (true) or clear (false), e.g. uac_flag:65536 = DONT_EXPIRE_PASSWORD; no value = nothing
|        'uac_flag' {
|            $bit = [long]0
|            if (-not [long]::TryParse([string]$Arg, [ref]$bit) -or $bit -le 0) { throw "uac_flag needs a positive flag value, got '$Arg'" }
|            foreach ($v in $Values) { $n = ConvertTo-SINumberOrNull $v; if ($null -ne $n) { $out.Add((([long]$n -band $bit) -ne 0)) } }
|        }
|        'dn_cn' { foreach ($v in $Values) { $mm = [regex]::Match([string]$v, '^CN=(?<cn>(\\,|[^,])+)', 'IgnoreCase'); if ($mm.Success) { $out.Add(($mm.Groups['cn'].Value -replace '\\,', ',')) } } }
|        default { throw "unknown normalize operation '$Op'" }
|    }
|    return , $out
|}
|
|function Invoke-SINormalize {
|    <# A normalisation chain ("op" or "op:arg" strings, split on the FIRST colon) over a list of values. #>
|    param([System.Collections.Generic.List[object]]$Values, [string[]]$Chain, $ValueMaps)
|    $cur = $Values
|    foreach ($step in @($Chain)) {
|        if ([string]::IsNullOrWhiteSpace($step)) { continue }
|        $i = $step.IndexOf(':')
|        $op = $step; $arg = ''
|        if ($i -ge 0) { $op = $step.Substring(0, $i); $arg = $step.Substring($i + 1) }
|        $cur = Invoke-SINormalizeOp -Values $cur -Op $op -Arg $arg -ValueMaps $ValueMaps
|        if ($cur.Count -eq 0 -and $op -ne 'present') { break }
|    }
|    return , $cur
|}
|
|function ConvertTo-SIFieldValue {
|    <# The final value of a field from the values its mapping produced, by the catalog type. #>
|    param([System.Collections.Generic.List[object]]$Values, [string]$Type)
|    if ($null -eq $Values -or $Values.Count -eq 0) { return $null }
|    switch ($Type) {
|        'dynamic' {
|            # de-duplicate scalars, keep objects as they are
|            $seen = [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
|            $list = [System.Collections.Generic.List[object]]::new()
|            foreach ($v in $Values) {
|                if ($v -is [string] -or $v -is [ValueType]) { if ($seen.Add([string]$v)) { $list.Add($v) } }
|                elseif ($v -is [System.Collections.IDictionary]) {
|                    $k = (($v.Keys | Sort-Object | ForEach-Object { "$_=$($v[$_])" }) -join '|')
|                    if ($seen.Add($k)) { $list.Add($v) }
|                } elseif ($v -is [System.Collections.IEnumerable]) { foreach ($x in $v) { $list.Add($x) } }
|                else { $list.Add($v) }
|            }
|            return , $list.ToArray()
|        }
|        'bool' { return (ConvertTo-SIBoolOrNull $Values[0]) }
|        'int' { $n = ConvertTo-SINumberOrNull $Values[0]; if ($null -eq $n) { return $null }; return [long][Math]::Truncate($n) }
|        'real' { return (ConvertTo-SINumberOrNull $Values[0]) }
|        'datetime' { return (ConvertTo-SIUtcOrNull $Values[0]) }
|        default { $v = $Values[0]; if ($null -eq $v) { return $null }; return [string]$v }
|    }
|}
|
|function Get-SIMappingValues {
|    <# The normalised values of ONE mapping item for an object, honouring "combine". #>
|    param($MapItem, $Object, $ValueMaps)
|    $combine = [string](Get-SIItemValue $MapItem 'combine'); if (-not $combine) { $combine = 'first' }
|    $chain = @(Get-SIItemValue $MapItem 'normalize')
|    $all = [System.Collections.Generic.List[object]]::new()
|    $wa = Get-SIMapItemWhenAbsent $MapItem
|    $absent = $false
|    foreach ($src in @(Get-SIItemValue $MapItem 'sources')) {
|        $raw = Resolve-SISourcePath -Object $Object -Path ([string]$src)
|        if ($raw.Count -eq 0) {
|            if ($wa.Has -and (Test-SISourceRootPresent -Object $Object -Path ([string]$src))) { $absent = $true }
|            continue
|        }
|        $vals = Invoke-SINormalize -Values $raw -Chain $chain -ValueMaps $ValueMaps
|        $vals = @($vals | Where-Object { -not (Test-SIValueEmpty $_) -or $_ -is [bool] })
|        if ($vals.Count -eq 0) { continue }
|        if ($combine -eq 'first') { $l = [System.Collections.Generic.List[object]]::new(); foreach ($v in $vals) { $l.Add($v) }; return , $l }
|        foreach ($v in $vals) { $all.Add($v) }
|    }
|    if ($all.Count -eq 0 -and $absent) {
|        # the object is there, no path had a value: the item's whenAbsent (Get-SIMapItemWhenAbsent)
|        $all.Add($wa.Value)
|        if ($combine -eq 'first') { return , $all }
|    }
|    $res = [System.Collections.Generic.List[object]]::new()
|    if ($all.Count -eq 0) { return , $res }
|    switch ($combine) {
|        'max' {
|            $best = $null
|            foreach ($v in $all) {
|                if ($null -eq $best) { $best = $v; continue }
|                $a = $v; $b = $best
|                if ($v -is [datetime] -or $best -is [datetime]) { if ((ConvertTo-SIUtcOrNull $a) -gt (ConvertTo-SIUtcOrNull $b)) { $best = $v } }
|                elseif ((ConvertTo-SINumberOrNull $a) -gt (ConvertTo-SINumberOrNull $b)) { $best = $v }
|            }
|            $res.Add($best)
|        }
|        'min' {
|            $best = $null
|            foreach ($v in $all) {
|                if ($null -eq $best) { $best = $v; continue }
|                if ($v -is [datetime] -or $best -is [datetime]) { if ((ConvertTo-SIUtcOrNull $v) -lt (ConvertTo-SIUtcOrNull $best)) { $best = $v } }
|                elseif ((ConvertTo-SINumberOrNull $v) -lt (ConvertTo-SINumberOrNull $best)) { $best = $v }
|            }
|            $res.Add($best)
|        }
|        'any_true' {
|            $sawFalse = $false
|            foreach ($v in $all) { $b = ConvertTo-SIBoolOrNull $v; if ($b -eq $true) { $res.Add($true); return , $res }; if ($b -eq $false) { $sawFalse = $true } }
|            if ($sawFalse) { $res.Add($false) }
|        }
|        'union' { foreach ($v in $all) { $res.Add($v) } }
|        default { throw "unknown combine '$combine'" }
|    }
|    return , $res
|}
|
|function ConvertTo-SIRecord {
|    <#
|    .SYNOPSIS  One provider object -> one SI record (ordered dictionary of SI fields) + the fields whose sources were missing.
|    .OUTPUTS   @{ Record = [ordered]; Missing = [string[]] }
|    #>
|    param(
|        [Parameter(Mandatory)]$Object,
|        [Parameter(Mandatory)]$Mapping,        # one parsed mappings/<provider>.json (merged with overrides)
|        [Parameter(Mandatory)][string]$RecordType,
|        [Parameter(Mandatory)]$Catalog,        # parsed field catalog (merged)
|        [Parameter(Mandatory)]$ValueMaps,      # the "maps" object of value-maps.json (merged)
|        [string]$ResourceType,
|        [datetime]$CollectionTime = [datetime]::UtcNow,
|        [string]$RunId
|    )
|    $plan = Get-SIMapperPlan -Mapping $Mapping -RecordType $RecordType -ResourceType $ResourceType -Catalog $Catalog
|    $provider = $plan.Provider
|
|    $rec = [ordered]@{}
|    $keyVals = Resolve-SISourcePath -Object $Object -Path $plan.KeyPath
|    $nativeKey = $null; if ($keyVals.Count -gt 0) { $nativeKey = ([string]$keyVals[0]).ToLowerInvariant() }
|    $rec['si_provider'] = $provider
|    $rec['si_record_type'] = $RecordType
|    $rec['si_class'] = $plan.Class
|    $rec['si_record_key'] = if ($nativeKey) { "${provider}:$nativeKey" } else { $null }
|    $rec['si_collection_time'] = $CollectionTime.ToUniversalTime()
|    if ($RunId) { $rec['si_run_id'] = $RunId }
|    $tsPath = $plan.TsPath
|    $ts = $null
|    if ($tsPath -and $tsPath -ne '$collection_time') {
|        $tv = Resolve-SISourcePath -Object $Object -Path $tsPath
|        if ($tv.Count -gt 0) {
|            $tn = Invoke-SINormalize -Values $tv -Chain @('datetime_utc') -ValueMaps $ValueMaps
|            if ($tn.Count -eq 0 -and $provider -eq 'ad') { $tn = Invoke-SINormalize -Values $tv -Chain @('filetime_utc') -ValueMaps $ValueMaps }
|            if ($tn.Count -gt 0) { $ts = $tn[0] }
|        }
|    }
|    if ($null -eq $ts) { $ts = $CollectionTime.ToUniversalTime() }
|    $rec['si_source_last_seen'] = $ts
|
|    $done = [System.Collections.Generic.HashSet[string]]::new()
|    foreach ($it in $plan.Items) {
|        $field = $it.Field
|        if ($done.Contains($field)) { continue }
|        # the values of this item (Get-SIMappingValues, compiled: the item's settings were read once, no pipeline)
|        $vals = $null
|        $all = $null
|        $absent = $false
|        foreach ($src in $it.Sources) {
|            # Resolve-SISourcePath, inline for a path without [*]: at most ONE value; a JSON string met on the way (or a
|            # [*] path) takes the full resolver, which handles both
|            $raw = $null
|            if ($src.Simple) {
|                $node = $Object; $hit = $true
|                foreach ($seg in $src.Segs) {
|                    if ($null -eq $node) { $hit = $false; break }
|                    if ($node -is [string]) { $raw = Resolve-SISourcePath -Object $Object -Path $src.Path; break }
|                    $nx = $null
|                    if ([string]::IsNullOrEmpty($seg)) { $hit = $false; break }
|                    if ($node -is [System.Collections.IDictionary]) {
|                        if ($node.Contains($seg)) { $nx = $node[$seg] }
|                        else { foreach ($k in $node.Keys) { if ([string]::Equals([string]$k, $seg, [StringComparison]::OrdinalIgnoreCase)) { $nx = $node[$k]; break } } }
|                    } else {
|                        $pp1 = $node.PSObject.Properties[$seg]
|                        if ($pp1) { $nx = $pp1.Value }
|                    }
|                    if ($null -eq $nx) { $hit = $false; break }
|                    $node = $nx
|                }
|                if ($null -eq $raw) {
|                    $raw = [System.Collections.Generic.List[object]]::new()
|                    if ($hit) { $raw.Add($node) }
|                }
|            } else { $raw = Resolve-SISourcePath -Object $Object -Path $src.Path }
|            if ($raw.Count -eq 0) {
|                if ($it.WhenAbsent.Has -and (Test-SISourceRootPresent -Object $Object -Path $src.Path)) { $absent = $true }
|                continue
|            }
|            # Invoke-SINormalize, inline: lower / trim / upper here, every other operation by Invoke-SINormalizeOp
|            $nv = $raw
|            foreach ($st in $it.Steps) {
|                switch ($st.Op) {
|                    'lower' { $n2 = [System.Collections.Generic.List[object]]::new(); foreach ($y in $nv) { $n2.Add(([string]$y).ToLowerInvariant()) }; $nv = $n2 }
|                    'upper' { $n2 = [System.Collections.Generic.List[object]]::new(); foreach ($y in $nv) { $n2.Add(([string]$y).ToUpperInvariant()) }; $nv = $n2 }
|                    'trim' { $n2 = [System.Collections.Generic.List[object]]::new(); foreach ($y in $nv) { if ($y -is [string]) { $ty = $y.Trim(); if ($ty) { $n2.Add($ty) } } else { $n2.Add($y) } }; $nv = $n2 }
|                    default { $nv = Invoke-SINormalizeOp -Values $nv -Op $st.Op -Arg $st.Arg -ValueMaps $ValueMaps }
|                }
|                if ($nv.Count -eq 0 -and $st.Op -ne 'present') { break }
|            }
|            # Test-SIValueEmpty, inline (a bool is always kept)
|            $kept = [System.Collections.Generic.List[object]]::new()
|            foreach ($x in $nv) {
|                $empty = $false
|                if ($null -eq $x) { $empty = $true }
|                elseif ($x -is [string]) { $empty = [string]::IsNullOrWhiteSpace($x) }
|                elseif ($x -is [System.Collections.IDictionary]) { $empty = ($x.Count -eq 0) }
|                elseif ($x -is [System.Collections.IEnumerable]) { $empty = $true; foreach ($z in $x) { $empty = $false; break } }
|                if (-not $empty -or $x -is [bool]) { $kept.Add($x) }
|            }
|            if ($kept.Count -eq 0) { continue }
|            if ($it.Combine -eq 'first') { $vals = $kept; break }
|            if ($null -eq $all) { $all = [System.Collections.Generic.List[object]]::new() }
|            foreach ($x in $kept) { $all.Add($x) }
|        }
|        if ($absent -and $null -eq $vals -and ($null -eq $all -or $all.Count -eq 0)) {
|            # the object is there, no path had a value: the item's whenAbsent (Get-SIMapItemWhenAbsent)
|            $all = [System.Collections.Generic.List[object]]::new(); $all.Add($it.WhenAbsent.Value)
|            if ($it.Combine -eq 'first') { $vals = $all }
|        }
|        if ($null -eq $vals -and $it.Combine -ne 'first') { $vals = Get-SIMapperCombined -Values $all -Combine $it.Combine }
|        if ($null -eq $vals -or $vals.Count -eq 0) { continue }
|        # ConvertTo-SIFieldValue; its default branch (every type but dynamic / bool / int / real / datetime) inline
|        if ($it.PlainType) { $v = $vals[0]; if ($null -ne $v) { $v = [string]$v } }
|        else { $v = ConvertTo-SIFieldValue -Values $vals -Type $it.Type }
|        if ($null -eq $v) { continue }
|        if ($it.Union) {
|            # a union field ADDS up over every applicable item (several Exposure Graph flags -> one si_device_roles)
|            if ($rec.Contains($field)) {
|                $acc = [System.Collections.Generic.List[object]]::new()
|                foreach ($x in @($rec[$field])) { $acc.Add($x) }
|                foreach ($x in @($v)) { if (-not ($acc -contains $x)) { $acc.Add($x) } }
|                $rec[$field] = $acc.ToArray()
|            } else { $rec[$field] = $v }
|            continue
|        }
|        $rec[$field] = $v
|        [void]$done.Add($field)
|    }
|    $missing = [System.Collections.Generic.List[string]]::new()
|    foreach ($it in $plan.Items) {
|        $field = $it.Field
|        if ($done.Contains($field) -or $rec.Contains($field) -or $missing.Contains($field)) { continue }
|        $missing.Add($field)
|    }
|    return @{ Record = $rec; Missing = $missing.ToArray() }
|}
|
|function Get-SIMapperCombined {
|    <# The "combine" of a mapping item over every source's values (max / min / any_true / union) -- as Get-SIMappingValues. #>
|    param([System.Collections.Generic.List[object]]$Values, [string]$Combine)
|    $res = [System.Collections.Generic.List[object]]::new()
|    if ($null -eq $Values -or $Values.Count -eq 0) { return , $res }
|    switch ($Combine) {
|        'max' {
|            $best = $null
|            foreach ($v in $Values) {
|                if ($null -eq $best) { $best = $v; continue }
|                $a = $v; $b = $best
|                if ($v -is [datetime] -or $best -is [datetime]) { if ((ConvertTo-SIUtcOrNull $a) -gt (ConvertTo-SIUtcOrNull $b)) { $best = $v } }
|                elseif ((ConvertTo-SINumberOrNull $a) -gt (ConvertTo-SINumberOrNull $b)) { $best = $v }
|            }
|            $res.Add($best)
|        }
|        'min' {
|            $best = $null
|            foreach ($v in $Values) {
|                if ($null -eq $best) { $best = $v; continue }
|                if ($v -is [datetime] -or $best -is [datetime]) { if ((ConvertTo-SIUtcOrNull $v) -lt (ConvertTo-SIUtcOrNull $best)) { $best = $v } }
|                elseif ((ConvertTo-SINumberOrNull $v) -lt (ConvertTo-SINumberOrNull $best)) { $best = $v }
|            }
|            $res.Add($best)
|        }
|        'any_true' {
|            $sawFalse = $false
|            foreach ($v in $Values) { $b = ConvertTo-SIBoolOrNull $v; if ($b -eq $true) { $res.Add($true); return , $res }; if ($b -eq $false) { $sawFalse = $true } }
|            if ($sawFalse) { $res.Add($false) }
|        }
|        'union' { foreach ($v in $Values) { $res.Add($v) } }
|        default { throw "unknown combine '$Combine'" }
|    }
|    return , $res
|}
|
|$script:SIMapperPlans = @{}
|
|function Get-SIMapperPlan {
|    <#
|        The mapping of ONE (provider mapping, record type, resource type), read ONCE (#475): the object definition, the field
|        types from the catalog and the applicable mapping items in their order, each with its sources, normalisation chain,
|        combine and type. Every record of that kind reuses it -- before, every record re-read the whole catalog and walked
|        every mapping item twice through the generic accessors (measured: ~90% of the time of publishing a run's records).
|        Cached by the mapping and catalog OBJECTS (reference), so a changed or different mapping is never mistaken for one
|        already read.
|    #>
|    param([Parameter(Mandatory)]$Mapping, [Parameter(Mandatory)][string]$RecordType, [string]$ResourceType, [Parameter(Mandatory)]$Catalog)
|    $rt = ''; if ($ResourceType) { $rt = $ResourceType.ToLowerInvariant() }
|    $key = '{0}|{1}|{2}|{3}' -f [System.Runtime.CompilerServices.RuntimeHelpers]::GetHashCode($Mapping), [System.Runtime.CompilerServices.RuntimeHelpers]::GetHashCode($Catalog), $RecordType, $rt
|    $p = $script:SIMapperPlans[$key]
|    if ($p -and [object]::ReferenceEquals($p.Mapping, $Mapping) -and [object]::ReferenceEquals($p.Catalog, $Catalog)) { return $p }
|
|    $provider = [string](Get-SIItemValue $Mapping 'provider')
|    $objDef = $null
|    foreach ($o in @(Get-SIItemValue $Mapping 'objects')) { if ([string](Get-SIItemValue $o 'recordType') -eq $RecordType) { $objDef = $o; break } }
|    if ($null -eq $objDef) { throw "mapping '$provider' has no object for record type '$RecordType'" }
|    $types = @{}
|    foreach ($f in @(Get-SIItemValue $Catalog 'fields')) { $types[[string]$f.name] = [string]$f.type }
|    $items = [System.Collections.Generic.List[object]]::new()
|    foreach ($item in @(Get-SIItemValue $Mapping 'mappings')) {
|        if (@($item.recordTypes) -notcontains $RecordType) { continue }
|        $rts = @(Get-SIItemValue $item 'resourceTypes')
|        if ($rts.Count -gt 0 -and $rts[0]) { if (-not $rt -or $rts -notcontains $rt) { continue } }
|        $field = [string]$item.field
|        $combine = [string](Get-SIItemValue $item 'combine'); if (-not $combine) { $combine = 'first' }
|        $type = $types[$field]; if (-not $type) { $type = 'string' }
|        # the normalisation chain as steps (Invoke-SINormalize's parsing: blank steps skipped, "op:arg" split on the FIRST colon)
|        $steps = [System.Collections.Generic.List[object]]::new()
|        foreach ($c in @(Get-SIItemValue $item 'normalize')) {
|            $cs = [string]$c
|            if ([string]::IsNullOrWhiteSpace($cs)) { continue }
|            $ci = $cs.IndexOf(':'); $op = $cs; $arg = ''
|            if ($ci -ge 0) { $op = $cs.Substring(0, $ci); $arg = $cs.Substring($ci + 1) }
|            $steps.Add([pscustomobject]@{ Op = $op; Arg = $arg })
|        }
|        # each source path split once; "Simple" = no [*] (walked inline; a [*] path goes through Resolve-SISourcePath)
|        $srcs = [System.Collections.Generic.List[object]]::new()
|        foreach ($s in @(Get-SIItemValue $item 'sources')) {
|            $sp = [string]$s
|            $srcs.Add([pscustomobject]@{ Path = $sp; Segs = $sp.Split('.'); Simple = ($sp -ne '' -and $sp.IndexOf('[*]') -lt 0) })
|        }
|        $items.Add([pscustomobject]@{ Field = $field; Combine = $combine; Type = $type; Union = ($combine -eq 'union' -and $type -eq 'dynamic')
|                PlainType = ($type -notin @('dynamic', 'bool', 'int', 'real', 'datetime'))
|                WhenAbsent = (Get-SIMapItemWhenAbsent $item)
|                Steps = $steps.ToArray(); Sources = $srcs.ToArray() })
|    }
|    $p = [pscustomobject]@{ Mapping = $Mapping; Catalog = $Catalog; Provider = $provider; Class = [string](Get-SIItemValue $objDef 'class')
|        KeyPath = [string](Get-SIItemValue $objDef 'key'); TsPath = [string](Get-SIItemValue $objDef 'timestamp'); Items = $items.ToArray() }
|    if ($script:SIMapperPlans.Count -ge 500) { $script:SIMapperPlans.Clear() }
|    $script:SIMapperPlans[$key] = $p
|    $p
|}
'@ }
$__siSupportFiles['engine/data-model/SI-RiskFactorCatalog.ps1'] = @{ Sha256 = 'fd6d8e25c6aa48f14e796263e7f477f12a41a43287833431cd213a62eb2ebc49'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight RISK-FACTOR CATALOG -- factor groups with their provider links (#458, V3-DATA-MODEL 2.7).
|
|    One catalog of risk factors (data-model/risk-factors.locked.json). Every factor is defined ONCE over SI fields; what
|    this file adds is the link back to the providers that can PROVE it:
|
|      proof fields   the SI fields the factor's condition reads, minus the scoping fields (si_identity_type, si_class: they
|                     say WHICH assets the factor is about, not whether it holds), plus the fields a conditions-list it uses
|                     reads (unsupported_os reads si_os_name through its list)
|      providers      per provider (mde, eg, entra, azure, mdi, ad, intune, shodan, ...) the provider fields that fill each
|                     proof field -- read from the provider's field mapping (data-model/mappings), so a factor never names a
|                     provider field of its own and a provider rename is fixed once, in the mapping
|      network        an in_ranges condition is proven by a NETWORK RANGE list (internet_exposed_ranges: DMZ, online landing
|                     zones) -- customer data: Community lists.custom.json, Pro / either edition the setting
|                     SI_InternetExposedRanges (Merge-SIRiskFactorRanges)
|      computed       a field SecurityInsight computes on the CI (si_tier from the enrichment rules, the CMDB criticality level,
|                     privilege tiers, finding signals), named with what computes it (the field catalog's description)
|
|    The catalog STORES each factor's providers block (what a person and the Pro pages read); Test-SIRiskFactorProviders
|    proves the stored block equals what the mappings say, so the copy can never drift (SIv3-RiskFactorCatalog.Tests).
|    Update-SIRiskFactorProviders rewrites it after a mapping change.
|
|    PURE except Update-SIRiskFactorProviders (writes the catalog file). PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Get-SIConditionFields -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|
|$script:SIRiskFactorScopingFields = @('si_identity_type', 'si_class')
|
|function Get-SIRiskFactorConditionLeaves {
|    <# PURE. Every leaf condition (field / op / value) of a condition group. #>
|    param($Condition)
|    $out = New-Object System.Collections.Generic.List[object]
|    if ($null -eq $Condition) { return , $out }
|    # kept per condition object (2026-10-16: asked again for every factor of every CI); a copy is handed out
|    $cache = $script:SIRiskFactorLeavesCache
|    if ($null -eq $cache) { $cache = New-Object 'System.Runtime.CompilerServices.ConditionalWeakTable[object,object]'; $script:SIRiskFactorLeavesCache = $cache }
|    $hit = $null
|    if ($Condition -isnot [string] -and $Condition -isnot [ValueType] -and $cache.TryGetValue($Condition, [ref]$hit)) { foreach ($l in $hit) { $out.Add($l) }; return , $out }
|    $done = $false
|    foreach ($k in 'all', 'any') {
|        $hasK = ($Condition -is [System.Collections.IDictionary] -and $Condition.Contains($k)) -or ($Condition.PSObject.Properties[$k])
|        if ($hasK) { foreach ($c in (Get-SIValueList (Get-SIItemValue $Condition $k))) { foreach ($l in (Get-SIRiskFactorConditionLeaves $c)) { $out.Add($l) } }; $done = $true; break }
|    }
|    if (-not $done -and (Get-SIItemValue $Condition 'field')) { $out.Add($Condition) }
|    if ($Condition -isnot [string] -and $Condition -isnot [ValueType]) { try { $cache.Add($Condition, $out.ToArray()) } catch { } }
|    return , $out
|}
|
|function Get-SIRiskFactorProofFields {
|    <# PURE. The SI fields that prove a factor (see the header), in condition order, unique. #>
|    param([Parameter(Mandatory)]$Factor, [hashtable]$Lists = @{})
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($leaf in (Get-SIRiskFactorConditionLeaves $Factor.when)) {
|        $f = [string](Get-SIItemValue $leaf 'field'); $op = [string](Get-SIItemValue $leaf 'op'); $v = Get-SIItemValue $leaf 'value'
|        $fields = @($f)
|        if ($op -eq 'in_list' -and $v -is [string] -and $Lists.ContainsKey($v) -and [string](Get-SIItemValue $Lists[$v] 'type') -eq 'conditions') {
|            $fields = @()
|            foreach ($e in (Get-SIValueList (Get-SIItemValue $Lists[$v] 'entries'))) { foreach ($x in (Get-SIConditionFields (Get-SIItemValue $e 'when'))) { $fields += $x } }
|        }
|        foreach ($x in $fields) { if ($x -and $script:SIRiskFactorScopingFields -notcontains $x -and -not $out.Contains($x)) { $out.Add($x) } }
|    }
|    return , $out
|}
|
|function Get-SIRiskFactorProviderLinks {
|    <#
|    .SYNOPSIS  PURE. A factor's provider links from the data model: [ordered]@{ <provider> = @( @{ siField; sources; recordTypes } ) }
|               plus 'network' (in_ranges lists) and 'rules' (si_tier). Providers in name order, items in mapping order.
|    #>
|    param([Parameter(Mandatory)]$Factor, [Parameter(Mandatory)]$Model)
|    $lists = @{}; foreach ($l in @($Model['lists'].lists)) { if ($l) { $lists[[string]$l.id] = $l } }
|    $proof = Get-SIRiskFactorProofFields -Factor $Factor -Lists $lists
|    $out = [ordered]@{}
|    foreach ($prov in @($Model.Mappings.Keys | Sort-Object)) {
|        $items = New-Object System.Collections.Generic.List[object]
|        foreach ($m in @($Model.Mappings[$prov].mappings)) {
|            if ($null -eq $m -or -not $proof.Contains([string]$m.field)) { continue }
|            $items.Add([ordered]@{ siField = [string]$m.field; sources = @(@($m.sources) | ForEach-Object { [string]$_ }); recordTypes = @(@($m.recordTypes) | ForEach-Object { [string]$_ }) })
|        }
|        if ($items.Count -gt 0) { $out[[string]$prov] = $items.ToArray() }
|    }
|    $net = New-Object System.Collections.Generic.List[object]
|    foreach ($leaf in (Get-SIRiskFactorConditionLeaves $Factor.when)) {
|        if ([string](Get-SIItemValue $leaf 'op') -eq 'in_ranges') { $net.Add([ordered]@{ siField = [string]$leaf.field; list = [string]$leaf.value; setting = 'SI_InternetExposedRanges' }) }
|    }
|    if ($net.Count -gt 0) { $out['network'] = $net.ToArray() }
|    # fields SecurityInsight computes on the CI itself (tier from the rules, CMDB criticality level, privilege tiers,
|    # finding signals): named with what computes them, from the field catalog
|    $comp = New-Object System.Collections.Generic.List[object]
|    foreach ($pf in $proof) {
|        $fd = @($Model['field-catalog'].fields | Where-Object { $_ -and [string]$_.name -eq $pf })[0]
|        if ($fd -and [string]$fd.resolution.policy -eq 'computed') { $comp.Add([ordered]@{ siField = $pf; sources = @([string]$fd.description) }) }
|    }
|    if ($comp.Count -gt 0) { $out['computed'] = $comp.ToArray() }
|    return $out
|}
|
|function Test-SIRiskFactorProviders {
|    <#
|    .SYNOPSIS  PURE. Problems where a catalog factor's stored providers block differs from its derived provider links
|               (empty = in step). Only catalog-evaluated factors are checked; a factor without a providers block is a problem.
|    #>
|    param([Parameter(Mandatory)]$Model)
|    $p = New-Object System.Collections.Generic.List[string]
|    foreach ($f in @($Model['risk-factors'].factors)) {
|        if ($null -eq $f -or [string]$f.evaluatedBy -ne 'catalog') { continue }
|        $want = (Get-SIRiskFactorProviderLinks -Factor $f -Model $Model | ConvertTo-Json -Compress -Depth 8)
|        $haveObj = Get-SIItemValue $f 'providers'
|        if ($null -eq $haveObj) { $p.Add("risk-factors/$($f.id): no providers block"); continue }
|        $have = ($haveObj | ConvertTo-Json -Compress -Depth 8)
|        if ($have -ne $want) { $p.Add("risk-factors/$($f.id): the providers block is not what the mappings say -- run Update-SIRiskFactorProviders") }
|        $comb = [string](Get-SIItemValue $f 'combine')
|        $top = 'all'; if (($f.when -is [System.Collections.IDictionary] -and $f.when.Contains('any')) -or $f.when.PSObject.Properties['any']) { $top = 'any' }
|        if ($comb -ne $top) { $p.Add("risk-factors/$($f.id): combine '$comb' but its condition is '$top'") }
|        if (-not [string](Get-SIItemValue $f 'description')) { $p.Add("risk-factors/$($f.id): no description") }
|    }
|    return , $p
|}
|
|function Get-SIRiskFactorCiColumns {
|    <# PURE. The factors that get their own SI_CI_CL column (si_rf_<id>): catalog asset factors marked ciColumn. #>
|    param([Parameter(Mandatory)]$Factors)
|    # a loop, not a pipeline: it runs for every CI of the build
|    @(foreach ($f in @($Factors.factors)) { if ($f -and [string]$f.appliesTo -eq 'asset' -and [string]$f.evaluatedBy -eq 'catalog' -and (ConvertTo-SIBoolOrNull (Get-SIItemValue $f 'ciColumn')) -eq $true) { [string]$f.id } })
|}
|
|function Merge-SIRiskFactorRanges {
|    <#
|    .SYNOPSIS  PURE. The condition context's lists with the customer's network ranges added: SI_InternetExposedRanges (a Pro
|               database setting; Community may set it in its custom file, or fill lists.custom.json) is appended to the
|               internet_exposed_ranges list. A value that is not an IPv4 / IPv6 CIDR or address is left out.
|    #>
|    param([hashtable]$Lists = @{}, $Setting = $global:SI_InternetExposedRanges)
|    $extra = New-Object System.Collections.Generic.List[string]
|    foreach ($v in @($Setting)) {
|        foreach ($s in ([string]$v -split '[,;\s]+')) {
|            $t = $s.Trim(); if (-not $t) { continue }
|            $ip = $t; $bits = $null; $i = $t.IndexOf('/'); if ($i -gt 0) { $ip = $t.Substring(0, $i); $bits = $t.Substring($i + 1) }
|            $a = $null
|            if (-not [System.Net.IPAddress]::TryParse($ip, [ref]$a)) { continue }
|            if ($null -ne $bits) { $n = 0; if (-not [int]::TryParse($bits, [ref]$n) -or $n -lt 0 -or $n -gt 128) { continue } }
|            if (-not $extra.Contains($t)) { $extra.Add($t) }
|        }
|    }
|    if ($extra.Count -eq 0) { return $Lists }
|    $out = @{}; foreach ($k in $Lists.Keys) { $out[$k] = $Lists[$k] }
|    $vals = New-Object System.Collections.Generic.List[object]
|    if ($out.ContainsKey('internet_exposed_ranges')) { foreach ($x in (Get-SIValueList (Get-SIItemValue $out['internet_exposed_ranges'] 'values'))) { $vals.Add($x) } }
|    foreach ($x in $extra) { if (-not $vals.Contains($x)) { $vals.Add($x) } }
|    $out['internet_exposed_ranges'] = [pscustomobject]@{ id = 'internet_exposed_ranges'; type = 'ranges'; values = $vals.ToArray() }
|    return $out
|}
|
|function Update-SIRiskFactorProviders {
|    <#
|    .SYNOPSIS  Rewrites every catalog factor's providers block from the mappings (vendor tool, after a mapping change).
|               Each factor stays on its own lines; only the "providers" line is replaced or inserted.
|    #>
|    param([string]$Root)
|    . (Join-Path $PSScriptRoot 'SI-DataModelTemplates.ps1')
|    $Root = Get-SIDataModelRoot $Root
|    $model = Get-SIDataModel -Root $Root
|    $path = Join-Path $Root 'risk-factors.locked.json'
|    $text = [System.IO.File]::ReadAllText($path)
|    $nl = "`n"; if ($text.Contains("`r`n")) { $nl = "`r`n" }
|    foreach ($f in @($model['risk-factors'].factors)) {
|        if ([string]$f.evaluatedBy -ne 'catalog') { continue }
|        $json = (Get-SIRiskFactorProviderLinks -Factor $f -Model $model | ConvertTo-Json -Compress -Depth 8)
|        $line = '      "providers": ' + $json + ','
|        $idRx = '(?m)^(\s*\{ "id": "' + [regex]::Escape([string]$f.id) + '",[^\r\n]*\r?\n)'
|        $m = [regex]::Match($text, $idRx)
|        if (-not $m.Success) { throw "factor $($f.id): its first line was not found" }
|        $after = $text.Substring($m.Index + $m.Length)
|        $pm = [regex]::Match($after, '^      "providers": [^\r\n]*\r?\n')
|        if ($pm.Success) { $text = $text.Substring(0, $m.Index + $m.Length) + $line + $nl + $after.Substring($pm.Length) }
|        else { $text = $text.Substring(0, $m.Index + $m.Length) + $line + $nl + $after }
|    }
|    [System.IO.File]::WriteAllText($path, $text, (New-Object System.Text.UTF8Encoding($false)))
|}
|
|function Add-SICiRiskFactorEvidence {
|    <#
|    .SYNOPSIS  PURE. #464 -- the catalog's factors PER CI, with their evidence, after Invoke-SICiRiskFactors evaluated them:
|                 * every si_risk_factors entry gets 'evidence' (one item per provider that proves it: provider, SI field,
|                   the provider fields of its mapping, the record, stale) and 'by' (those providers)
|                 * de-duplicated across providers: ONE entry per factor, however many providers prove it
|                 * si_rf_<id> = true / false for every factor the catalog marks ciColumn, si_rf_count = the factors that
|                   count (production, impact > 0) -- the SI_CI_CL columns Risk Analysis can read without parsing JSON
|               Evidence comes from si_field_sources (the CI build's source of truth per field); for a risk boolean resolved
|               any-true it lists EVERY provider that said true (si_field_sources.<field>.providers). A computed field (si_tier)
|               names what computed it; an address in a network range names the range list.
|    #>
|    param([Parameter(Mandatory)]$Ci, [Parameter(Mandatory)]$Factors, [hashtable]$Lists = @{},
|          # read once for a set of CIs (New-SICiRiskFactorPlan): the factors by id and the factor columns; else read here
|          [hashtable]$ById, [AllowNull()][AllowEmptyCollection()][string[]]$CiColumns)
|    $byId = $ById
|    if ($null -eq $byId) { $byId = @{}; foreach ($f in @($Factors.factors)) { if ($f) { $byId[[string]$f.id] = $f } } }
|    $src = Get-SIItemValue $Ci 'si_field_sources'
|    $count = 0
|    $present = @{}
|    foreach ($e in @($Ci['si_risk_factors'])) {
|        if ($null -eq $e) { continue }
|        $id = [string](Get-SIItemValue $e 'id')
|        $f = $byId[$id]
|        $ev = New-Object System.Collections.Generic.List[object]
|        if ($f) {
|            $provBlock = Get-SIItemValue $f 'providers'
|            # an ANY factor: only the fields whose own condition holds are its evidence (an address outside every range
|            # proves nothing); fields read through a conditions list always count
|            $isAny = (($f.when -is [System.Collections.IDictionary] -and $f.when.Contains('any')) -or $f.when.PSObject.Properties['any'])
|            $holds = @{}; $leafFields = @{}
|            foreach ($leaf in (Get-SIRiskFactorConditionLeaves $f.when)) {
|                $lf = [string]$leaf.field; $leafFields[$lf] = $true
|                if ([string](Get-SIItemValue $leaf 'op') -eq 'in_list') { continue }
|                $ok = $false; try { $ok = Test-SICondition -Condition $leaf -Item $Ci -Context @{ Lists = $Lists } } catch { $ok = $false }
|                if ($ok) { $holds[$lf] = $true }
|            }
|            foreach ($field in (Get-SIRiskFactorProofFields -Factor $f -Lists $Lists)) {
|                if ($isAny -and $leafFields.ContainsKey($field) -and -not $holds.ContainsKey($field)) { continue }
|                $s = Get-SIItemValue $src $field
|                $val = Get-SIItemValue $Ci $field
|                if ($null -eq $s -and (Test-SIValueEmpty $val) -and -not ($val -is [bool])) { continue }
|                $provs = @()
|                if ($s) { $provs = (Get-SIValueList (Get-SIItemValue $s 'providers')).ToArray(); if ($provs.Count -eq 0 -and (Get-SIItemValue $s 'provider')) { $provs = @(([string](Get-SIItemValue $s 'provider')) -split ',' | Where-Object { $_ }) } }
|                if ($provs.Count -eq 0) {
|                    $why = ''; if ($field -eq 'si_tier') { $why = [string](Get-SIItemValue $Ci 'si_tier_reason') }
|                    $ev.Add([ordered]@{ provider = 'computed'; field = $field; reason = $why }); continue
|                }
|                foreach ($pv in $provs) {
|                    $pfs = @()
|                    if ($provBlock) { foreach ($it in (Get-SIValueList (Get-SIItemValue $provBlock ([string]$pv)))) { if ([string](Get-SIItemValue $it 'siField') -eq $field) { $pfs += (Get-SIValueList (Get-SIItemValue $it 'sources')).ToArray() } } }
|                    $rec = $null; if ($s -and [string](Get-SIItemValue $s 'provider') -eq [string]$pv) { $rec = Get-SIItemValue $s 'record' }
|                    # no observed_at: it moves every build and would make every CI "changed" (the build sends only changed CIs)
|                    $ev.Add([ordered]@{ provider = [string]$pv; field = $field; providerFields = @($pfs | Select-Object -Unique); record = $rec; stale = $(if ($s) { [bool](Get-SIItemValue $s 'stale') } else { $false }) })
|                }
|            }
|            foreach ($leaf in (Get-SIRiskFactorConditionLeaves $f.when)) {
|                if ([string](Get-SIItemValue $leaf 'op') -ne 'in_ranges') { continue }
|                $one = [ordered]@{ field = [string]$leaf.field; op = 'in_ranges'; value = $leaf.value }
|                $hit = $false; try { $hit = Test-SICondition -Condition $one -Item $Ci -Context @{ Lists = $Lists } } catch { $hit = $false }
|                if ($hit) { $ev.Add([ordered]@{ provider = 'network'; field = [string]$leaf.field; list = [string]$leaf.value }) }
|            }
|        }
|        if ($e -is [System.Collections.IDictionary]) { $e['evidence'] = $ev.ToArray(); $e['by'] = @($ev | ForEach-Object { $_.provider } | Select-Object -Unique) }
|        else { $e | Add-Member -NotePropertyName evidence -NotePropertyValue $ev.ToArray() -Force; $e | Add-Member -NotePropertyName by -NotePropertyValue @($ev | ForEach-Object { $_.provider } | Select-Object -Unique) -Force }
|        $imp = ConvertTo-SINumberOrNull (Get-SIItemValue $e 'impact')
|        if ($null -ne $imp -and $imp -gt 0) { $count++; $present[$id] = $true }
|    }
|    # #546 a factor the CI could not decide (si_rf_unknown) is NULL in its column -- unknown, never false, never true
|    $unk = @(foreach ($x in @(Get-SIItemValue $Ci 'si_rf_unknown')) { if ($x) { [string]$x } })
|    if ($null -eq $CiColumns) { $CiColumns = @(Get-SIRiskFactorCiColumns -Factors $Factors) }
|    foreach ($cid in $CiColumns) {
|        if ($unk -contains $cid -and -not $present.ContainsKey($cid)) { $Ci['si_rf_' + $cid] = $null } else { $Ci['si_rf_' + $cid] = [bool]$present.ContainsKey($cid) }
|    }
|    $Ci['si_rf_count'] = $count
|    return $Ci
|}
|function Add-SICiUnknownFactorCounts {
|    <# PURE. #546 -- adds each CI's undecided factors (si_rf_unknown) to -Counts (factor id -> CIs). Returns -Counts. #>
|    param([Parameter(Mandatory)][hashtable]$Counts, [AllowEmptyCollection()][object[]]$Cis = @())
|    foreach ($c in $Cis) {
|        if ($null -eq $c) { continue }
|        foreach ($id in @(Get-SIItemValue $c 'si_rf_unknown')) { if ($id) { $k = [string]$id; if ($Counts.ContainsKey($k)) { $Counts[$k]++ } else { $Counts[$k] = 1 } } }
|    }
|    return $Counts
|}
|
|function Format-SICiUnknownFactorLine {
|    <# PURE. #546 -- one plain run-log line: the factors the CIs could not decide (not counted as findings). '' when none. #>
|    param([hashtable]$Counts = @{})
|    if ($null -eq $Counts -or $Counts.Count -eq 0) { return '' }
|    $parts = @($Counts.Keys | Sort-Object | ForEach-Object { '{0} {1}' -f $_, $Counts[$_] })
|    return ('CIs: risk factors that could not be decided -- the value is unknown, so they are NOT findings (CIs per factor): {0}' -f ($parts -join ', '))
|}
|
|function Test-SIRiskFactorRules {
|    <#
|    .SYNOPSIS  PURE. #527 (5)-(7): the rules every risk factor (shipped or a customer's) must keep. Returns problems; empty = valid.
|                 * exactly ONE scope: appliesTo is 'asset' (the asset's exposure, hygiene, importance) or 'finding' (extra
|                   about the recommendation / vulnerability) -- never none, never both
|                 * NO TIER: a condition never reads si_tier (tier is its own dimension: the risk index's asset base, #559)
|                 * SI FIELDS ONLY: every field a condition reads (and every field of a conditions-list it uses) is an SI field
|                   (si_*), and no value is a raw provider path (node.NodeProperties.rawData..., identity.BlastRadius,
|                   ci.u_data_sensitivity) -- a renamed or new source field is a MAPPING change, never a factor change
|    #>
|    param([Parameter(Mandatory)]$Model)
|    $p = New-Object System.Collections.Generic.List[string]
|    $lists = @{}; foreach ($l in @($Model['lists'].lists)) { if ($l) { $lists[[string]$l.id] = $l } }
|    foreach ($f in @($Model['risk-factors'].factors)) { foreach ($x in (Test-SIRiskFactorItem -Factor $f -Lists $lists)) { $p.Add($x) } }
|    return , $p
|}
|
|# ================================================================================================================
|# #559 RISK FACTOR MODEL V2 -- every factor: shortName, name (description), appliesTo, group, class, impact 1-5, state
|# ================================================================================================================
|$script:SIRiskFactorGroups = @('Exposure', 'Device health', 'Identity', 'Privilege', 'Apps', 'Importance', 'Exploitability', 'Impact', 'Severity', 'Lifecycle')
|
|function Get-SIRiskFactorClass {
|    <# PURE. 'builtin' or 'optional'. A factor WITHOUT a class is treated as builtin -- the contract the web app is built
|       against (it reads a class-less factor as built-in), so the engine and the GUI never disagree; every shipped factor
|       carries its class explicitly, and a customer's own factor should say 'optional' to be switchable. #>
|    param($Factor)
|    if ([string](Get-SIItemValue $Factor 'class') -eq 'optional') { return 'optional' }
|    return 'builtin'
|}
|
|function Get-SIRiskFactorState {
|    <#
|    .SYNOPSIS  PURE. #559 the factor's state as the engine applies it: 'enabled' or 'disabled'.
|                 * a BUILT-IN factor is always enabled -- a stored 'disabled' is refused by the validation and the web app,
|                   and ignored here (the run-start check says so, Resolve-SIRiskFactorBuiltinState)
|                 * state 'disabled' -> disabled; no state: the pre-v2 stage decides (not_used / testing -> disabled, so an
|                   old customer override that switched a factor off stays off), else enabled
|    #>
|    param($Factor)
|    if ($null -eq $Factor) { return 'disabled' }
|    if ((Get-SIRiskFactorClass $Factor) -eq 'builtin') { return 'enabled' }
|    $st = ([string](Get-SIItemValue $Factor 'state')).Trim().ToLowerInvariant()
|    if ($st -eq 'disabled') { return 'disabled' }
|    if ($st -eq 'enabled') { return 'enabled' }
|    $stage = ([string](Get-SIItemValue $Factor 'stage')).Trim().ToLowerInvariant()
|    if ($stage -in 'not_used', 'testing') { return 'disabled' }
|    return 'enabled'
|}
|
|function Test-SIRiskFactorEnabled { param($Factor) return ((Get-SIRiskFactorState $Factor) -eq 'enabled') }
|
|function Get-SIRiskFactorSide {
|    <# PURE. #559 the side of the score a factor adds to: 'asset' (appliesTo asset) or 'vulnerability' (appliesTo finding). #>
|    param($Factor)
|    if ([string](Get-SIItemValue $Factor 'appliesTo') -eq 'finding') { return 'vulnerability' }
|    return 'asset'
|}
|
|function Get-SIRiskFactorImpact {
|    <# PURE. #559 what an ENABLED factor adds to its side: its impact, 1..5 (a value outside is held to the range; not a
|       number = 1). A disabled factor adds 0. #>
|    param($Factor)
|    if (-not (Test-SIRiskFactorEnabled $Factor)) { return 0 }
|    $n = ConvertTo-SINumberOrNull (Get-SIItemValue $Factor 'impact')
|    if ($null -eq $n) { return 1 }
|    if ($n -lt 1) { return 1 }
|    if ($n -gt 5) { return 5 }
|    return [int][Math]::Round($n)
|}
|
|function Get-SIRiskFactorShortName {
|    <# PURE. The name reports show: shortName, else the description (name), else the id. #>
|    param($Factor)
|    $s = ([string](Get-SIItemValue $Factor 'shortName')).Trim(); if ($s) { return $s }
|    $n = ([string](Get-SIItemValue $Factor 'name')).Trim(); if ($n) { return $n }
|    return [string](Get-SIItemValue $Factor 'id')
|}
|
|function Resolve-SIRiskFactorBuiltinState {
|    <#
|    .SYNOPSIS  PURE. #558 / #559 the run-start check: a built-in factor is never switched off. Returns @{ Factors (the
|               factors, a built-in one with state 'enabled' whatever was stored); Lines (one plain run-log line per built-in
|               factor a customer override tried to disable -- empty when none) }.
|    #>
|    param([AllowEmptyCollection()][object[]]$Factors = @())
|    $lines = New-Object System.Collections.Generic.List[string]
|    foreach ($f in $Factors) {
|        if ($null -eq $f -or (Get-SIRiskFactorClass $f) -ne 'builtin') { continue }
|        $st = ([string](Get-SIItemValue $f 'state')).Trim().ToLowerInvariant()
|        $stage = ([string](Get-SIItemValue $f 'stage')).Trim().ToLowerInvariant()
|        if ($st -eq 'disabled' -or ($st -eq '' -and $stage -in 'not_used', 'testing')) {
|            $lines.Add(("Risk factor {0} ({1}) is built-in and cannot be switched off -- it stays enabled. Lower its impact instead." -f (Get-SIRiskFactorShortName $f), [string]$f.id))
|            if ($f -is [System.Collections.IDictionary]) { $f['state'] = 'enabled' } else { $f | Add-Member -NotePropertyName state -NotePropertyValue 'enabled' -Force }
|        }
|    }
|    return @{ Factors = $Factors; Lines = $lines.ToArray() }
|}
|
|function Get-SIRiskFactorLegend {
|    <#
|    .SYNOPSIS  PURE. #558 / #559 the "Risk factors" legend every Excel export (a sheet) and every PDF (an appendix) carries:
|               one row per factor -- ShortName, Description, AppliesTo ("Asset" / "Vulnerability"), Impact, Class, Group,
|               State, Id -- asset factors first, then vulnerability factors, each by group then short name. Disabled factors
|               are listed (State says so, Impact 0) unless -EnabledOnly.
|    #>
|    param([AllowEmptyCollection()][object[]]$Factors = @(), [switch]$EnabledOnly)
|    $rows = New-Object System.Collections.Generic.List[object]
|    foreach ($f in $Factors) {
|        if ($null -eq $f -or -not (Get-SIItemValue $f 'id')) { continue }
|        $en = Test-SIRiskFactorEnabled $f
|        if ($EnabledOnly -and -not $en) { continue }
|        $side = Get-SIRiskFactorSide $f
|        $desc = ([string](Get-SIItemValue $f 'name')).Trim(); if (-not $desc) { $desc = ([string](Get-SIItemValue $f 'description')).Trim() }
|        $rows.Add([pscustomobject][ordered]@{
|                ShortName   = (Get-SIRiskFactorShortName $f)
|                Description = $desc
|                AppliesTo   = $(if ($side -eq 'vulnerability') { 'Vulnerability' } else { 'Asset' })
|                Impact      = (Get-SIRiskFactorImpact $f)
|                Class       = $(if ((Get-SIRiskFactorClass $f) -eq 'builtin') { 'Built-in' } else { 'Optional' })
|                Group       = [string](Get-SIItemValue $f 'group')
|                State       = $(if ($en) { 'Enabled' } else { 'Disabled' })
|                Id          = [string](Get-SIItemValue $f 'id')
|            })
|    }
|    $gIdx = @{}; for ($i = 0; $i -lt $script:SIRiskFactorGroups.Count; $i++) { $gIdx[$script:SIRiskFactorGroups[$i]] = $i }
|    $sorted = @($rows | Sort-Object -Property @{ Expression = { if ($_.AppliesTo -eq 'Asset') { 0 } else { 1 } } }, @{ Expression = { if ($gIdx.ContainsKey($_.Group)) { $gIdx[$_.Group] } else { 99 } } }, ShortName)
|    return , $sorted
|}
|
|function Test-SIRiskFactorModelV2 {
|    <#
|    .SYNOPSIS  PURE. #559 the v2 fields of ONE factor. Returns problems; empty = valid.
|                 shortName  PascalCase letters and digits, at most 24 characters, no editable number: a factor whose criteria
|                            carry a threshold (days, a count) has no digit in its short name (EnabledNoSignInStale, not
|                            NoSignIn90d); a fixed fact may (CVSS9Plus)
|                 name       the description the GUI shows (not empty)
|                 group      one of the ten groups
|                 class      builtin | optional (a customer's own factor may leave it out: optional)
|                 impact     a whole number 1..5
|                 state      enabled | disabled; a builtin factor is never disabled
|    #>
|    param($Factor)
|    $p = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Factor) { return $p.ToArray() }
|    $id = [string](Get-SIItemValue $Factor 'id')
|    $sn = [string](Get-SIItemValue $Factor 'shortName')
|    if ($sn -cnotmatch '^[A-Z][A-Za-z0-9]{1,23}$') { $p.Add("risk-factors/${id}: shortName '$sn' must be PascalCase letters / digits, 2..24 characters (e.g. InternetExposed)") }
|    else {
|        $cr = Get-SIItemValue $Factor 'criteria'
|        if ($cr -and @('threshold', 'range') -contains [string](Get-SIItemValue $cr 'kind') -and $sn -match '\d') { $p.Add("risk-factors/${id}: shortName '$sn' carries a number but the factor's number is editable (criteria) -- name what it means, not the number") }
|    }
|    if (-not ([string](Get-SIItemValue $Factor 'name')).Trim()) { $p.Add("risk-factors/${id}: no name (the description the GUI shows)") }
|    $g = [string](Get-SIItemValue $Factor 'group')
|    if ($script:SIRiskFactorGroups -cnotcontains $g) { $p.Add("risk-factors/${id}: group '$g' ($($script:SIRiskFactorGroups -join ', '))") }
|    $cl = Get-SIItemValue $Factor 'class'
|    if ($null -ne $cl -and @('builtin', 'optional') -cnotcontains [string]$cl) { $p.Add("risk-factors/${id}: class '$cl' (builtin | optional)") }
|    $imp = ConvertTo-SINumberOrNull (Get-SIItemValue $Factor 'impact')
|    if ($null -eq $imp -or $imp -lt 1 -or $imp -gt 5 -or $imp -ne [Math]::Floor($imp)) { $p.Add("risk-factors/${id}: impact '$(Get-SIItemValue $Factor 'impact')' must be a whole number 1..5 (very low .. very high)") }
|    $st = [string](Get-SIItemValue $Factor 'state')
|    if ($st -and @('enabled', 'disabled') -cnotcontains $st) { $p.Add("risk-factors/${id}: state '$st' (enabled | disabled)") }
|    if ((Get-SIRiskFactorClass $Factor) -eq 'builtin' -and $st -eq 'disabled') { $p.Add("risk-factors/${id}: a built-in factor cannot be disabled -- lower its impact instead (a factor without a class is built-in)") }
|    return $p.ToArray()
|}
|
|# ================================================================================================================
|# #559 break glass naming patterns -- the data-model list break_glass_patterns (type values): glob patterns (* ?) over
|# letters, digits, space and . _ @ -; a pattern of wildcards only is refused (it would make everyone break-glass).
|# The web app validates the same rule (the contract both sides are built against).
|# ================================================================================================================
|function Test-SIBreakGlassPattern {
|    <# PURE. Problems with ONE break-glass glob pattern; empty = valid. #>
|    param([AllowNull()][AllowEmptyString()][string]$Pattern)
|    $p = New-Object System.Collections.Generic.List[string]
|    $s = [string]$Pattern
|    if ($s -cnotmatch '^[A-Za-z0-9 ._@*?-]{1,128}$') { $p.Add("lists/break_glass_patterns: '$s' -- a pattern is letters, digits, space, . _ @ - and the wildcards * ?, at most 128 characters") }
|    elseif ($s -match '^[\s*?]+$') { $p.Add("lists/break_glass_patterns: '$s' is wildcards only -- it would make every identity break-glass") }
|    return $p.ToArray()
|}
|
|function Test-SIRiskRatingBands {
|    <# PURE. The risk_rating_bands list of a model: type values, exactly three whole numbers > 0, strictly descending
|       (Critical, High, Moderate thresholds). Empty = valid (no list: the engine's built-in 50 / 30 / 15). #>
|    param([Parameter(Mandatory)]$Model)
|    $p = New-Object System.Collections.Generic.List[string]
|    $l = @(@($Model['lists'].lists) | Where-Object { $_ -and [string]$_.id -eq 'risk_rating_bands' })
|    if ($l.Count -eq 0) { return $p.ToArray() }
|    if ([string]$l[0].type -ne 'values') { $p.Add("lists/risk_rating_bands: type '$($l[0].type)' -- it is a values list of three numbers") }
|    $v = @(@(Get-SIItemValue $l[0] 'values') | ForEach-Object { ConvertTo-SINumberOrNull $_ })
|    $ok = ($v.Count -eq 3) -and (@($v | Where-Object { $null -eq $_ -or $_ -le 0 -or $_ -ne [Math]::Floor($_) }).Count -eq 0)
|    if ($ok) { $ok = ($v[0] -gt $v[1]) -and ($v[1] -gt $v[2]) }
|    if (-not $ok) { $p.Add("lists/risk_rating_bands: the values must be three whole numbers above 0, highest first (Critical, High, Moderate) -- has: $(ConvertTo-Json -InputObject @(Get-SIItemValue $l[0] 'values') -Compress)") }
|    return $p.ToArray()
|}
|
|function Test-SIBreakGlassPatterns {
|    <# PURE. The break_glass_patterns list of a model: type values, every value a valid pattern. Empty = valid (no list too). #>
|    param([Parameter(Mandatory)]$Model)
|    $p = New-Object System.Collections.Generic.List[string]
|    $l = @(@($Model['lists'].lists) | Where-Object { $_ -and [string]$_.id -eq 'break_glass_patterns' })
|    if ($l.Count -eq 0) { return $p.ToArray() }
|    if ([string]$l[0].type -ne 'values') { $p.Add("lists/break_glass_patterns: type '$($l[0].type)' -- it is a values list of glob patterns") }
|    foreach ($v in @(Get-SIItemValue $l[0] 'values')) { foreach ($x in (Test-SIBreakGlassPattern -Pattern ([string]$v))) { $p.Add($x) } }
|    return $p.ToArray()
|}
|
|function Test-SIRiskFactorItem {
|    <# PURE. Test-SIRiskFactorRules for ONE factor (a Pro cfg.ItemOverride 'risk-factors:<id>' is checked with it on write). #>
|    param($Factor, [hashtable]$Lists = @{})
|    $p = New-Object System.Collections.Generic.List[string]
|    $rawRx = '^(?i)(node|identity|ci|machine|deviceInfo|resource|derived|user|sp|app|registration|signIn|computer|device|host|exposure|roles|azureRoles|record|properties|rawData)(\[\*\])?(\.[A-Za-z0-9_$@-]+(\[\*\])?)+$'
|    $lists = $Lists
|    foreach ($f in @($Factor)) {
|        if ($null -eq $f) { continue }
|        $id = [string]$f.id
|        $scope = Get-SIItemValue $f 'appliesTo'
|        if ($null -eq $scope -or ($scope -is [System.Collections.IEnumerable] -and $scope -isnot [string]) -or @('asset', 'finding') -notcontains [string]$scope) {
|            $p.Add("risk-factors/${id}: must have exactly one scope -- appliesTo 'asset' or 'finding' (has: $(ConvertTo-Json -InputObject $scope -Compress))")
|        }
|        foreach ($x in (Test-SIRiskFactorModelV2 -Factor $f)) { $p.Add($x) }
|        foreach ($x in (Test-SIRiskFactorCriteria -Factor $f -Lists $lists)) { $p.Add($x) }
|        if ([string]$f.evaluatedBy -eq 'report') { continue }
|        foreach ($leaf in (Get-SIRiskFactorConditionLeaves $f.when)) {
|            $fields = @([string]$leaf.field)
|            $op = [string](Get-SIItemValue $leaf 'op'); $v = Get-SIItemValue $leaf 'value'
|            if ($op -eq 'in_list' -and $v -is [string] -and $lists.ContainsKey($v)) { foreach ($e in (Get-SIValueList (Get-SIItemValue $lists[$v] 'entries'))) { foreach ($x in (Get-SIConditionFields (Get-SIItemValue $e 'when'))) { $fields += [string]$x } } }
|            foreach ($fn in $fields) {
|                if ($fn -eq 'si_tier') { $p.Add("risk-factors/${id}: reads si_tier -- a risk factor never restates tier (tier counts once: the risk index's asset base)") }
|                elseif ($fn -notmatch '^si_[a-z0-9_]+$') { $p.Add("risk-factors/${id}: reads '$fn' -- a factor reads SI fields (si_*) only; a source field belongs in its provider mapping") }
|            }
|            foreach ($x in (Get-SIValueList $v)) { if ($x -is [string] -and $x -match $rawRx) { $p.Add("risk-factors/${id}: value '$x' is a raw source path -- it belongs in a provider mapping") } }
|        }
|    }
|    return , $p
|}
|
|function Test-SIRiskFactorCriteria {
|    <#
|    .SYNOPSIS  PURE. A factor's criteria block -- the part a customer changes through the web app's wizard, never as free
|               text (#541 (7)). Returns problems; empty = valid (also for a factor without criteria).
|                 criteria: { kind: list | threshold | range, field: si_*, source: collected | enum | lifecycle, ... }
|                   list       list = the id of a lists.locked.json list the factor's condition reads (in_list / in_ranges /
|                              contains_any); optional detailField (si_*) the wizard narrows an entry with
|                   threshold  op + min / max (numbers, min <= max): the factor's condition has a leaf on field with that op
|                              whose value is a number inside [min, max]
|                   range      min / max (numbers, min <= max) on field
|    #>
|    param($Factor, [hashtable]$Lists = @{})
|    $p = New-Object System.Collections.Generic.List[string]
|    $cr = Get-SIItemValue $Factor 'criteria'
|    if ($null -eq $cr) { return , $p }
|    $id = [string]$Factor.id
|    $kind = [string](Get-SIItemValue $cr 'kind'); $field = [string](Get-SIItemValue $cr 'field'); $src = [string](Get-SIItemValue $cr 'source')
|    if (@('list', 'threshold', 'range') -notcontains $kind) { $p.Add("risk-factors/${id}: criteria kind '$kind' (list, threshold or range)") }
|    if ($field -notmatch '^si_[a-z0-9_]+$' -or $field -eq 'si_tier') { $p.Add("risk-factors/${id}: criteria field '$field' must be an SI field (si_*), never si_tier") }
|    if (@('collected', 'enum', 'lifecycle') -notcontains $src) { $p.Add("risk-factors/${id}: criteria source '$src' (collected, enum or lifecycle)") }
|    $leaves = (Get-SIRiskFactorConditionLeaves $Factor.when).ToArray()
|    switch ($kind) {
|        'list' {
|            $lid = [string](Get-SIItemValue $cr 'list')
|            if (-not $lid -or ($Lists.Count -gt 0 -and -not $Lists.ContainsKey($lid))) { $p.Add("risk-factors/${id}: criteria list '$lid' is not a list") }
|            if (-not @($leaves | Where-Object { [string]$_.value -eq $lid -and @('in_list', 'in_ranges', 'contains_any') -contains [string]$_.op }).Count) { $p.Add("risk-factors/${id}: its condition does not read the criteria list '$lid'") }
|            $df = [string](Get-SIItemValue $cr 'detailField')
|            if ($df -and ($df -notmatch '^si_[a-z0-9_]+$' -or $df -eq 'si_tier')) { $p.Add("risk-factors/${id}: criteria detailField '$df' must be an SI field") }
|        }
|        { $_ -in 'threshold', 'range' } {
|            $min = ConvertTo-SINumberOrNull (Get-SIItemValue $cr 'min'); $max = ConvertTo-SINumberOrNull (Get-SIItemValue $cr 'max')
|            if ($null -eq $min -or $null -eq $max -or $min -gt $max) { $p.Add("risk-factors/${id}: criteria min / max must be numbers, min <= max") }
|            elseif ($kind -eq 'threshold') {
|                $op = [string](Get-SIItemValue $cr 'op')
|                $leaf = @($leaves | Where-Object { [string]$_.field -eq $field -and [string]$_.op -eq $op })
|                if ($leaf.Count -eq 0) { $p.Add("risk-factors/${id}: its condition has no '$field $op' leaf for the criteria") }
|                foreach ($l in $leaf) {
|                    $v = ConvertTo-SINumberOrNull $l.value
|                    if ($null -eq $v -or $v -lt $min -or $v -gt $max) { $p.Add("risk-factors/${id}: '$field $op $($l.value)' is outside the criteria range $min..$max") }
|                }
|            }
|        }
|    }
|    return , $p
|}
'@ }
$__siSupportFiles['engine/data-model/SI-Classification.ps1'] = @{ Sha256 = '64a9f79c67a8972bc419a5b1416c3e16aec7770f40a51b9900b8f41f5c9be169'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- ONE GENERIC CLASSIFICATION MECHANISM (REQUIREMENTS #561 dimensions, #562 asset type / subtype).
|
|    Every classification SI assigns from what the sources say -- the asset type, the asset subtype, the component of a
|    finding and the components of an asset, and every dimension that comes later -- is the SAME thing: rows of
|        source + field + match (equals | in | prefix | pattern) -> target SI field = set, with a priority
|    evaluated with the SAME condition engine the risk factors use (SI-Conditions.ps1, tri-state Test-SIConditionTri: a
|    field the CI could not decide is unknown and never matches). No code per dimension, no code per source.
|
|    TEMPLATES (the contract the web app's classification wizard is built against)
|      data-model/dimensions.locked.json      kind 'dimension', items 'dimensions', Pro key 'dimensions:<id>':
|                                             { id, name, values[] } -- ONLY the closed list of values
|      data-model/classification.locked.json  kind 'classification', items 'rules', Pro key 'classification:<row id>':
|                                             { id,
|                                               source    the provider whose naming the row normalises (documentation),
|                                               field     an SI field (si_*) or a source path (a dot path into the item),
|                                               match     equals | in      -> values  (a list)
|                                                         prefix | pattern -> pattern (a glob: * ? [..]; a list = any of them;
|                                                                             prefix = the glob followed by *),
|                                               target    the SI field the row sets (si_component, si_asset_type, ...),
|                                               set       the value (one of the target dimension's values),
|                                               priority  an integer 0..10000 (higher wins),
|                                               state     enabled | disabled,
|                                               when      OPTIONAL extra condition (the condition language, SI fields only)
|                                                         that must ALSO hold -- e.g. "a server" AND "SQL Server installed",
|                                               verify    true = the source spelling is still to be confirmed on live rows,
|                                               note }
|                                             HEADER 'targets' (Pro key 'classification'): per target field -- dimension,
|                                             appliesTo asset | finding, multi (an asset carries every matching value),
|                                             fallback (no row matches; '$keep' = the value the sources gave, then
|                                             fallbackEmpty), keepSourceIn. Evaluated in the header's order.
|    CUSTOMER  Pro: one cfg.ItemOverride per row / dimension -- override, disable or add. Community: classification.custom.json
|              / dimensions.custom.json, only the items that differ. Both through the data-model merge (Get-SIDataModelTemplate).
|              The web app's validators: Test-SIClassificationRule / Test-SIDimensionItem, and the C# mirror
|              SI.Management.Web/Changes/ClassificationItemValidator.cs (same closed sets, Get-SIClassificationShape).
|
|    EVALUATION
|      asset    the CI build (Invoke-SICiClassification, after enrichment): the asset targets in header order, each value
|               written before the next target is evaluated (so a component row may read si_asset_subtype).
|               single  the highest-priority enabled row whose condition is TRUE (file order breaks a tie)
|               multi   every matching row's value, in the dimension's value order
|               none    the target's fallback -- never blank
|      finding  Risk Analysis, per row (Set-SIRaRowDimensions): the row's own finding fields (title, category, affected
|               product / vendor / CPE, the Azure resource type of the asset it is on) -> one value per finding target. An
|               OS vulnerability on a SQL Server VM stays OS -- the VM carries both OS and SQL, the finding the one that
|               matches it. The finding targets in header order, each value written before the next is evaluated -- the
|               ServiceNow sub-CI (si_servicenow_subci, #772) reads the component it follows.
|
|    PURE except Get-SIClassificationIndex (reads the templates). PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Test-SIConditionTri -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|# #772 the release dates of Microsoft's updates per KB (the patch cycle reads them; loaded once per run by Risk Analysis)
|if (-not (Get-Command -Name Get-SIKbReleaseDate -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-KbReleaseDates.ps1') }
|
|function Get-SIClassificationMatchOps { return , @('equals', 'in', 'prefix', 'pattern') }
|
|function Get-SIClassificationShape {
|    <#
|    .SYNOPSIS  PURE. The shape the validators enforce, as data -- the contract the C# mirror and the web app's wizard read.
|    #>
|    [ordered]@{
|        dimension      = [ordered]@{ template = 'dimensions'; kind = 'dimension'; key = 'id'; idPattern = '^[a-z][a-z0-9_]{0,47}$'; valueMaxLength = 64 }
|        classification = [ordered]@{ template = 'classification'; kind = 'classification'; key = 'id'; idPattern = '^[a-z0-9][a-z0-9_\-\.]{0,99}$'
|                                     matchOps = (Get-SIClassificationMatchOps); valuesFor = @('equals', 'in'); patternFor = @('prefix', 'pattern')
|                                     states = @('enabled', 'disabled'); priorityMin = 0; priorityMax = 10000
|                                     fieldPattern = '^(si_[a-z0-9_]+|[A-Za-z_][A-Za-z0-9_]*(\[\*\])?(\.[A-Za-z0-9_$@-]+(\[\*\])?)*)$'
|                                     targetPattern = '^si_[a-z0-9_]+$'; sourcePattern = '^[a-z][a-z0-9_]{0,31}$' }
|    }
|}
|
|function Get-SIClassificationSqlAzureTypes {
|    <# The Azure resource types SI treats as SQL (documentation + tests; the shipped rows list them themselves). #>
|    return , @('microsoft.sql/servers', 'microsoft.sql/servers/databases', 'microsoft.sql/managedinstances', 'microsoft.sql/managedinstances/databases',
|        'microsoft.sqlvirtualmachine/sqlvirtualmachines', 'microsoft.dbforpostgresql/servers', 'microsoft.dbforpostgresql/flexibleservers',
|        'microsoft.dbformysql/servers', 'microsoft.dbformysql/flexibleservers', 'microsoft.dbformariadb/servers')
|}
|
|function Test-SIClassificationSiField { param([string]$Name) return ($Name -cmatch '^si_[a-z0-9_]+$') }
|
|function ConvertTo-SIClassificationCondition {
|    <#
|    .SYNOPSIS  PURE. A row's match -> a condition of the shared language (field = '$value' when the row reads a source path:
|               the evaluator resolves the path first). equals / in -> in (values); prefix -> like '<pattern>*'; pattern ->
|               like '<pattern>' (globs, case-insensitive). An extra 'when' is ANDed.
|    #>
|    param($Rule)
|    $field = [string](Get-SIItemValue $Rule 'field')
|    $leafField = $field; if (-not (Test-SIClassificationSiField $field)) { $leafField = '$value' }
|    $op = [string](Get-SIItemValue $Rule 'match')
|    $leaf = $null
|    switch ($op) {
|        { $_ -in 'equals', 'in' } { $leaf = @{ field = $leafField; op = 'in'; value = (Get-SIValueList (Get-SIItemValue $Rule 'values')).ToArray() } }
|        'prefix' { $leaf = @{ field = $leafField; op = 'like'; value = @(foreach ($x in (Get-SIValueList (Get-SIItemValue $Rule 'pattern'))) { $s = [string]$x; if ($s.EndsWith('*')) { $s } else { $s + '*' } }) } }
|        'pattern' { $leaf = @{ field = $leafField; op = 'like'; value = @(foreach ($x in (Get-SIValueList (Get-SIItemValue $Rule 'pattern'))) { [string]$x }) } }
|        default { throw ("classification row '{0}': unknown match '{1}'" -f [string](Get-SIItemValue $Rule 'id'), $op) }
|    }
|    $when = Get-SIItemValue $Rule 'when'
|    if ($null -ne $when) { return @{ all = @($leaf, $when) } }
|    return $leaf
|}
|
|function Resolve-SIClassificationPath {
|    <# PURE. Every value at a dot path in an item ("a.b[*].c"), case-insensitive -- a source-path row's field. #>
|    param($Item, [string]$Path)
|    $cur = [System.Collections.Generic.List[object]]::new(); $cur.Add($Item)
|    foreach ($segRaw in $Path.Split('.')) {
|        $walk = $segRaw.EndsWith('[*]'); $seg = $segRaw; if ($walk) { $seg = $segRaw.Substring(0, $segRaw.Length - 3) }
|        $next = [System.Collections.Generic.List[object]]::new()
|        foreach ($o in $cur) {
|            $v = Get-SIItemValue $o $seg
|            if ($null -eq $v) { continue }
|            if ($walk -or ($v -is [System.Collections.IEnumerable] -and $v -isnot [string] -and $v -isnot [System.Collections.IDictionary])) { foreach ($x in $v) { $next.Add($x) } } else { $next.Add($v) }
|        }
|        $cur = $next
|        if ($cur.Count -eq 0) { break }
|    }
|    , $cur.ToArray()
|}
|
|function Test-SIDimensionItem {
|    <# PURE. The reasons one dimension is not accepted (empty = accepted). The web app calls it on a 'dimensions:<id>' override. #>
|    param($Dimension)
|    $why = [System.Collections.Generic.List[string]]::new()
|    if ($null -eq $Dimension) { $why.Add('a dimension is empty'); return $why.ToArray() }
|    $id = [string](Get-SIItemValue $Dimension 'id')
|    if ($id -cnotmatch '^[a-z][a-z0-9_]{0,47}$') { $why.Add(("dimension id '{0}': a lower snake_case word of at most 48 characters" -f $id)) }
|    $values = @(@(Get-SIItemValue $Dimension 'values') | Where-Object { $null -ne $_ -and ([string]$_).Trim() } | ForEach-Object { [string]$_ })
|    if ($values.Count -eq 0) { $why.Add(("dimension '{0}': values names at least one value" -f $id)) }
|    $seen = @{}
|    foreach ($v in $values) {
|        if ($v.Length -gt 64 -or $v -match '[\r\n\t;]') { $why.Add(("dimension '{0}': value '{1}' must be one line of at most 64 characters without ';'" -f $id, $v)) }
|        if ($seen.ContainsKey($v.ToLowerInvariant())) { $why.Add(("dimension '{0}': value '{1}' is listed twice" -f $id, $v)) }
|        $seen[$v.ToLowerInvariant()] = 1
|    }
|    # #772 an optional default: the fallback of the dimension's finding / single-value targets -- one of its own values
|    $def = Get-SIItemValue $Dimension 'default'
|    if ($null -ne $def -and ([string]$def).Trim() -and -not $seen.ContainsKey(([string]$def).Trim().ToLowerInvariant())) {
|        $why.Add(("dimension '{0}': default '{1}' is not one of its values" -f $id, [string]$def))
|    }
|    $why.ToArray()
|}
|
|function Get-SIClassificationFallback {
|    <#
|    .SYNOPSIS  PURE. #772 the fallback a target uses: the dimension's own 'default' (one of its values) when it names one and
|               the target is not '$keep', else the target's fallback. So a customer who renames or removes the fallback
|               bucket (the ServiceNow sub-CI: Other) names the new one in the same dimension item -- never blank.
|    #>
|    param($Target, $Dimension)
|    $fb = [string](Get-SIItemValue $Target 'fallback')
|    if ($fb -eq '$keep' -or $null -eq $Dimension) { return $fb }
|    $def = ([string](Get-SIItemValue $Dimension 'default')).Trim()
|    if (-not $def) { return $fb }
|    foreach ($v in @(Get-SIItemValue $Dimension 'values')) { if ($null -ne $v -and ([string]$v).Trim() -ieq $def) { return ([string]$v).Trim() } }
|    $fb
|}
|
|function Test-SIClassificationTarget {
|    <# PURE. One target of the classification header (where a dimension's values are written, and the fallback). #>
|    param($Target, [hashtable]$Dimensions)
|    $why = [System.Collections.Generic.List[string]]::new()
|    $f = [string](Get-SIItemValue $Target 'field')
|    if ($f -cnotmatch '^si_[a-z0-9_]+$') { $why.Add(("target '{0}': must be an SI field (si_*)" -f $f)) }
|    $dimId = [string](Get-SIItemValue $Target 'dimension')
|    $vals = @()
|    $dimDoc = $null
|    if ($null -ne $Dimensions) {
|        if (-not $Dimensions.ContainsKey($dimId)) { $why.Add(("target '{0}': dimension '{1}' is not defined (dimensions.locked.json)" -f $f, $dimId)) }
|        else { $dimDoc = $Dimensions[$dimId]; $vals = @(@(Get-SIItemValue $dimDoc 'values') | ForEach-Object { ([string]$_).ToLowerInvariant() }) }
|    }
|    $scope = [string](Get-SIItemValue $Target 'appliesTo')
|    if ($scope -notin 'asset', 'finding') { $why.Add(("target '{0}': appliesTo '{1}' (asset or finding)" -f $f, $scope)) }
|    $multi = (ConvertTo-SIBoolOrNull (Get-SIItemValue $Target 'multi')) -eq $true
|    if ($multi -and $scope -eq 'finding') { $why.Add(("target '{0}': a finding carries ONE value per dimension (multi is for assets)" -f $f)) }
|    # #772 the dimension's default (when it names one of its values) is the fallback
|    $fb = Get-SIClassificationFallback -Target $Target -Dimension $dimDoc
|    if (-not $fb) { $why.Add(("target '{0}': a fallback is required -- a classification is never blank" -f $f)) }
|    elseif ($fb -eq '$keep') {
|        if ($scope -ne 'asset' -or $multi) { $why.Add(("target '{0}': '`$keep' is for a single-value asset target" -f $f)) }
|        $fe = [string](Get-SIItemValue $Target 'fallbackEmpty')
|        if (-not $fe -or ($vals.Count -and $vals -notcontains $fe.ToLowerInvariant())) { $why.Add(("target '{0}': '`$keep' needs a fallbackEmpty that is one of the dimension's values" -f $f)) }
|    } elseif ($vals.Count -and $vals -notcontains $fb.ToLowerInvariant()) { $why.Add(("target '{0}': fallback '{1}' is not a value of dimension '{2}'" -f $f, $fb, $dimId)) }
|    $k = [string](Get-SIItemValue $Target 'keepSourceIn')
|    if ($k -and $k -cnotmatch '^si_[a-z0-9_]+$') { $why.Add(("target '{0}': keepSourceIn '{1}' must be an SI field" -f $f, $k)) }
|    $why.ToArray()
|}
|
|function Test-SIClassificationRule {
|    <#
|    .SYNOPSIS  PURE. The reasons one classification row is not accepted (empty = accepted). -Targets: target field -> header
|               target; -Dimensions: id -> dimension (both from the merged templates); without them the row is checked on its
|               own shape only. The web app calls it on a 'classification:<id>' override; the C# mirror checks the same shape.
|    #>
|    param($Rule, [hashtable]$Targets, [hashtable]$Dimensions)
|    $why = [System.Collections.Generic.List[string]]::new()
|    if ($null -eq $Rule) { $why.Add('a classification row is empty'); return $why.ToArray() }
|    $shape = (Get-SIClassificationShape).classification
|    $id = [string](Get-SIItemValue $Rule 'id')
|    if ($id -notmatch $shape.idPattern) { $why.Add(("row id '{0}': lower-case letters, digits, - _ . (at most 100)" -f $id)) }
|    $field = [string](Get-SIItemValue $Rule 'field')
|    if ($field -cnotmatch $shape.fieldPattern) { $why.Add(("row '{0}': field '{1}' must be an SI field (si_*) or a source path (a.b[*].c)" -f $id, $field)) }
|    $op = [string](Get-SIItemValue $Rule 'match')
|    if ((Get-SIClassificationMatchOps) -notcontains $op) { $why.Add(("row '{0}': match '{1}' (equals | in | prefix | pattern)" -f $id, $op)) }
|    $values = @(@(Get-SIItemValue $Rule 'values') | Where-Object { $null -ne $_ -and ([string]$_) -ne '' })
|    $pattern = @(@(Get-SIItemValue $Rule 'pattern') | Where-Object { $null -ne $_ -and ([string]$_).Trim() })
|    if ($op -in 'equals', 'in') {
|        if ($values.Count -eq 0) { $why.Add(("row '{0}': match '{1}' needs values (a list)" -f $id, $op)) }
|        if ($op -eq 'equals' -and $values.Count -gt 1) { $why.Add(("row '{0}': equals takes one value -- use in for several" -f $id)) }
|        if ($pattern.Count) { $why.Add(("row '{0}': match '{1}' reads values, not pattern" -f $id, $op)) }
|    }
|    if ($op -in 'prefix', 'pattern') {
|        if ($pattern.Count -eq 0) { $why.Add(("row '{0}': match '{1}' needs a pattern (a glob)" -f $id, $op)) }
|        if ($values.Count) { $why.Add(("row '{0}': match '{1}' reads pattern, not values" -f $id, $op)) }
|        foreach ($p in $pattern) { try { $null = New-Object System.Management.Automation.WildcardPattern([string]$p) } catch { $why.Add(("row '{0}': invalid glob '{1}'" -f $id, $p)) } }
|    }
|    $target = [string](Get-SIItemValue $Rule 'target')
|    $set = [string](Get-SIItemValue $Rule 'set')
|    if ($target -cnotmatch $shape.targetPattern) { $why.Add(("row '{0}': target '{1}' must be an SI field (si_*)" -f $id, $target)) }
|    if (-not $set.Trim()) { $why.Add(("row '{0}': set (the value) is required" -f $id)) }
|    if ($null -ne $Targets) {
|        if (-not $Targets.ContainsKey($target)) { $why.Add(("row '{0}': target '{1}' is not a classification target (the template's targets)" -f $id, $target)) }
|        elseif ($null -ne $Dimensions) {
|            $dimId = [string](Get-SIItemValue $Targets[$target] 'dimension')
|            if ($Dimensions.ContainsKey($dimId)) {
|                $vals = @(@(Get-SIItemValue $Dimensions[$dimId] 'values') | ForEach-Object { ([string]$_).ToLowerInvariant() })
|                if ($set -and $vals -notcontains $set.ToLowerInvariant()) { $why.Add(("row '{0}': '{1}' is not a value of dimension '{2}'" -f $id, $set, $dimId)) }
|            }
|        }
|    }
|    $prio = Get-SIItemValue $Rule 'priority'
|    $pn = ConvertTo-SINumberOrNull $prio
|    if ($null -eq $pn -or $pn -lt $shape.priorityMin -or $pn -gt $shape.priorityMax -or [Math]::Floor($pn) -ne $pn) { $why.Add(("row '{0}': priority must be an integer 0..10000 (higher wins)" -f $id)) }
|    $st = [string](Get-SIItemValue $Rule 'state')
|    if ($st -and $st -notin 'enabled', 'disabled') { $why.Add(("row '{0}': state '{1}' (enabled | disabled)" -f $id, $st)) }
|    $src = [string](Get-SIItemValue $Rule 'source')
|    if ($src -and $src -cnotmatch $shape.sourcePattern) { $why.Add(("row '{0}': source '{1}' is not a provider name" -f $id, $src)) }
|    $when = Get-SIItemValue $Rule 'when'
|    if ($null -ne $when) {
|        $ops = Get-SIConditionOps
|        foreach ($leafField in (Get-SIConditionFields $when)) { if (-not (Test-SIClassificationSiField $leafField)) { $why.Add(("row '{0}': when reads '{1}' -- an extra condition reads SI fields (si_*) only" -f $id, $leafField)) } }
|        $stack = New-Object System.Collections.Generic.Stack[object]; $stack.Push($when)
|        while ($stack.Count -gt 0) {
|            $c = $stack.Pop()
|            $isGroup = $false
|            foreach ($k in 'all', 'any') {
|                $has = ($c -is [System.Collections.IDictionary] -and $c.Contains($k)) -or ($null -ne $c -and $null -ne $c.PSObject.Properties[$k])
|                if ($has) { $isGroup = $true; foreach ($x in (Get-SIValueList (Get-SIItemValue $c $k))) { $stack.Push($x) } }
|            }
|            if (-not $isGroup) {
|                $o = [string](Get-SIItemValue $c 'op')
|                if ($o -eq 'in_list') { $why.Add(("row '{0}': in_list is not available to a classification row -- list the values (in)" -f $id)) }
|                elseif ($ops -notcontains $o) { $why.Add(("row '{0}': unknown condition operation '{1}'" -f $id, $o)) }
|                if ($o -eq 'matches') { foreach ($p in (Get-SIValueList (Get-SIItemValue $c 'value'))) { try { [void][regex]::new([string]$p) } catch { $why.Add(("row '{0}': invalid pattern '{1}'" -f $id, $p)) } } }
|            }
|        }
|    }
|    $why.ToArray()
|}
|
|function Get-SIClassificationTargets {
|    <# PURE. The classification header's targets: field -> target (ordered, header order). #>
|    param($Classification)
|    $t = [ordered]@{}
|    foreach ($x in @(Get-SIItemValue $Classification 'targets')) { if ($null -ne $x) { $t[[string](Get-SIItemValue $x 'field')] = $x } }
|    $t
|}
|
|function Test-SIClassifications {
|    <#
|    .SYNOPSIS  PURE. Both templates together: every dimension, target and row valid, every id once, every SI field a row reads
|               or a target writes is in the field catalog (-Fields: name -> catalog entry; optional) at the right level.
|    #>
|    param($Dimensions, $Classification, [hashtable]$Fields)
|    $p = [System.Collections.Generic.List[string]]::new()
|    $dims = @{}
|    foreach ($d in @(Get-SIItemValue $Dimensions 'dimensions')) {
|        if ($null -eq $d) { continue }
|        foreach ($x in (Test-SIDimensionItem -Dimension $d)) { $p.Add('dimensions: ' + $x) }
|        $did = [string](Get-SIItemValue $d 'id')
|        if ($dims.ContainsKey($did)) { $p.Add(("dimensions: '{0}' is defined twice" -f $did)) }
|        $dims[$did] = $d
|    }
|    $targets = @{}
|    foreach ($t in @(Get-SIItemValue $Classification 'targets')) {
|        if ($null -eq $t) { continue }
|        foreach ($x in (Test-SIClassificationTarget -Target $t -Dimensions $dims)) { $p.Add('classification: ' + $x) }
|        $tf = [string](Get-SIItemValue $t 'field')
|        if ($targets.ContainsKey($tf)) { $p.Add(("classification: target '{0}' is defined twice" -f $tf)) }
|        $targets[$tf] = $t
|        if ($null -ne $Fields) {
|            foreach ($fn in @($tf, [string](Get-SIItemValue $t 'keepSourceIn'))) {
|                if (-not $fn) { continue }
|                if (-not $Fields.ContainsKey($fn)) { $p.Add(("classification: target '{0}' writes '{1}', which is not in the field catalog" -f $tf, $fn)); continue }
|                $lvl = [string]$Fields[$fn].level
|                $scope = [string](Get-SIItemValue $t 'appliesTo')
|                if ($scope -eq 'asset' -and $lvl -eq 'finding') { $p.Add(("classification: asset target '{0}' writes finding field '{1}'" -f $tf, $fn)) }
|                if ($scope -eq 'finding' -and $lvl -ne 'finding') { $p.Add(("classification: finding target '{0}' writes '{1}', which is not a finding field" -f $tf, $fn)) }
|            }
|        }
|    }
|    $ids = @{}
|    foreach ($r in @(Get-SIItemValue $Classification 'rules')) {
|        if ($null -eq $r) { continue }
|        $rid = [string](Get-SIItemValue $r 'id')
|        foreach ($x in (Test-SIClassificationRule -Rule $r -Targets $targets -Dimensions $dims)) { $p.Add('classification: ' + $x) }
|        if ($ids.ContainsKey($rid)) { $p.Add(("classification: row '{0}' is defined twice" -f $rid)) }
|        $ids[$rid] = 1
|        if ($null -ne $Fields) {
|            $scope = ''; $tg = $targets[[string](Get-SIItemValue $r 'target')]; if ($tg) { $scope = [string](Get-SIItemValue $tg 'appliesTo') }
|            $read = [System.Collections.Generic.List[string]]::new()
|            $f = [string](Get-SIItemValue $r 'field'); if (Test-SIClassificationSiField $f) { $read.Add($f) }
|            $w = Get-SIItemValue $r 'when'; if ($null -ne $w) { foreach ($x in (Get-SIConditionFields $w)) { $read.Add([string]$x) } }
|            foreach ($fn in $read) {
|                if (-not $Fields.ContainsKey($fn)) { $p.Add(("classification/{0}: reads '{1}', which is not in the field catalog" -f $rid, $fn)); continue }
|                if ($scope -eq 'asset' -and [string]$Fields[$fn].level -eq 'finding') { $p.Add(("classification/{0}: an asset row reads finding field '{1}'" -f $rid, $fn)) }
|            }
|        }
|    }
|    $p.ToArray()
|}
|
|function New-SIClassificationIndex {
|    <#
|    .SYNOPSIS  PURE. The merged templates -> what the evaluators walk: the targets in header order, each with its dimension's
|               values and its rows (enabled and valid only), highest priority first (file order breaks a tie), each row's
|               condition compiled once.
|    #>
|    param($Dimensions, $Classification)
|    $dims = @{}
|    foreach ($d in @(Get-SIItemValue $Dimensions 'dimensions')) { if ($null -ne $d -and @(Test-SIDimensionItem -Dimension $d).Count -eq 0) { $dims[[string]$d.id] = $d } }
|    $targets = [System.Collections.Generic.List[object]]::new()
|    $byField = @{}
|    foreach ($t in @(Get-SIItemValue $Classification 'targets')) {
|        if ($null -eq $t -or @(Test-SIClassificationTarget -Target $t -Dimensions $dims).Count -gt 0) { continue }
|        $d = $dims[[string]$t.dimension]
|        $e = [pscustomobject]@{ Field = [string]$t.field; Dimension = [string]$t.dimension; AppliesTo = [string]$t.appliesTo
|                                Multi = ((ConvertTo-SIBoolOrNull (Get-SIItemValue $t 'multi')) -eq $true); Fallback = (Get-SIClassificationFallback -Target $t -Dimension $d)
|                                FallbackEmpty = [string](Get-SIItemValue $t 'fallbackEmpty'); KeepSourceIn = [string](Get-SIItemValue $t 'keepSourceIn')
|                                Values = @(@($d.values) | ForEach-Object { [string]$_ }); Rules = ([System.Collections.Generic.List[object]]::new()) }
|        $targets.Add($e); $byField[$e.Field] = $e
|    }
|    $tgDocs = @{}; foreach ($t in @(Get-SIItemValue $Classification 'targets')) { if ($t) { $tgDocs[[string]$t.field] = $t } }
|    $n = 0
|    foreach ($r in @(Get-SIItemValue $Classification 'rules')) {
|        if ($null -eq $r) { continue }
|        $n++
|        if ([string](Get-SIItemValue $r 'state') -eq 'disabled') { continue }
|        if (@(Test-SIClassificationRule -Rule $r -Targets $tgDocs -Dimensions $dims).Count -gt 0) { continue }
|        $e = $byField[[string]$r.target]; if ($null -eq $e) { continue }
|        $f = [string]$r.field
|        $cond = ConvertTo-SIClassificationCondition -Rule $r
|        # the SI field the row's own match reads (none for a source-path row): Get-SIClassificationValue decides the row false
|        # without evaluating it when the CI does not carry that field
|        $lf = ''; if (Test-SIClassificationSiField $f) { $lf = $f }
|        $e.Rules.Add([pscustomobject]@{ Id = [string]$r.id; Value = [string]$r.set; Priority = [double](ConvertTo-SINumberOrNull $r.priority); Order = $n
|                                        SourcePath = $(if (Test-SIClassificationSiField $f) { '' } else { $f }); Condition = $cond; LeafField = $lf })
|    }
|    foreach ($e in $targets) {
|        $sorted = @($e.Rules.ToArray() | Sort-Object -Property @{ Expression = { $_.Priority }; Descending = $true }, @{ Expression = { $_.Order }; Descending = $false })
|        $e.Rules.Clear(); foreach ($x in $sorted) { $e.Rules.Add($x) }
|    }
|    # .ToArray(), never @() around a List[object] held in an object: pwsh 7 throws "Argument types do not match"
|    $hasPath = (@($targets.ToArray() | ForEach-Object { $_.Rules.ToArray() } | Where-Object { $_.SourcePath }).Count -gt 0)
|    [pscustomobject]@{ Targets = $targets.ToArray(); HasSourcePath = $hasPath; Cache = @{} }
|}
|
|function Get-SIClassificationValue {
|    <#
|    .SYNOPSIS  PURE. One target over one item: @{ Values (the value, or for multi every value); Rules (the deciding row ids);
|               Unknown (rows whose condition could not be decided) }. Values is empty when no row matched -- the caller
|               applies the fallback.
|    #>
|    param([Parameter(Mandatory)]$Target, $Item, [hashtable]$Context, [string[]]$UnknownFields = @())
|    $vals = [System.Collections.Generic.List[string]]::new()
|    $ids = [System.Collections.Generic.List[string]]::new()
|    $unknown = [System.Collections.Generic.List[string]]::new()
|    foreach ($r in $Target.Rules) {
|        if ($Target.Multi -and $vals.Contains($r.Value)) { continue }
|        $subject = $Item
|        if ($r.SourcePath) {
|            # a source-path row: the path's values become '$value' of a view that also carries the item's SI fields (for 'when')
|            $view = @{}
|            if ($Item -is [System.Collections.IDictionary]) { foreach ($k in @($Item.Keys)) { $view[[string]$k] = $Item[$k] } }
|            elseif ($null -ne $Item) { foreach ($pp in $Item.PSObject.Properties) { $view[$pp.Name] = $pp.Value } }
|            $view['$value'] = @(Resolve-SIClassificationPath -Item $Item -Path $r.SourcePath)
|            $subject = $view
|        }
|        # A ROW WHOSE FIELD THE CI DOES NOT CARRY IS FALSE (2026-10-16, the CI build of a large install: most rows read an Azure
|        # resource type, which an identity or a device never has). The row's match is 'in' or 'like' on that field and comes
|        # FIRST in its condition (ConvertTo-SIClassificationCondition), so an empty field -- no value, or a list without one --
|        # makes the whole row false, exactly as evaluating it would; a field the CI cannot decide (UnknownFields) is evaluated.
|        if ($r.PSObject.Properties['LeafField'] -and $r.LeafField -and -not $r.SourcePath) {
|            $lv = Get-SIItemValue $subject $r.LeafField
|            if ($null -eq $lv -or (Get-SIValueList $lv).Count -eq 0) {
|                $unk = $false; foreach ($u in $UnknownFields) { if ($u -and [string]::Equals([string]$u, [string]$r.LeafField, [StringComparison]::OrdinalIgnoreCase)) { $unk = $true; break } }
|                if (-not $unk) { continue }
|            }
|        }
|        $hit = $false
|        try { $hit = Test-SIConditionTri -Condition $r.Condition -Item $subject -Context $Context -UnknownFields $UnknownFields } catch { $hit = $false }
|        if ($null -eq $hit) { $unknown.Add($r.Id); continue }
|        if ($hit -ne $true) { continue }
|        $vals.Add($r.Value); $ids.Add($r.Id)
|        if (-not $Target.Multi) { break }
|    }
|    if ($Target.Multi -and $vals.Count -gt 1) {
|        # the dimension's own value order, so the same asset always reads the same way
|        $ordered = @($Target.Values | Where-Object { $vals -contains $_ })
|        $vals.Clear(); foreach ($v in $ordered) { $vals.Add($v) }
|    }
|    @{ Values = $vals.ToArray(); Rules = $ids.ToArray(); Unknown = $unknown.ToArray() }
|}
|
|function Set-SICiSqlIaasLinks {
|    <#
|    .SYNOPSIS  PURE. #561 / #562: a VM registered with the SQL IaaS extension has a microsoft.sqlvirtualmachine/sqlvirtualmachines
|               resource whose virtualMachineResourceId (si_sql_vm_resource_id) names the VM. The VM's CI (si_link_azure or a
|               linked Azure id) gets si_sql_iaas = true. Only within the CIs given (one build batch); a VM whose SQL resource is
|               in another batch is decided by its software inventory instead. Returns the number of VMs marked.
|    #>
|    param([AllowEmptyCollection()][object[]]$Cis = @())
|    $vmIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
|    foreach ($c in $Cis) { foreach ($v in (Get-SIValueList (Get-SIItemValue $c 'si_sql_vm_resource_id'))) { if ($v) { [void]$vmIds.Add(([string]$v).Trim()) } } }
|    if ($vmIds.Count -eq 0) { return 0 }
|    $n = 0
|    foreach ($c in $Cis) {
|        $ids = [System.Collections.Generic.List[string]]::new()
|        $la = [string](Get-SIItemValue $c 'si_link_azure'); if ($la) { $ids.Add($la) }
|        foreach ($lo in (Get-SIValueList (Get-SIItemValue $c 'si_linked_objects'))) { $lid = [string](Get-SIItemValue $lo 'id'); if ($lid -like '/subscriptions/*') { $ids.Add($lid) } }
|        foreach ($i in $ids) {
|            if ($vmIds.Contains($i.Trim())) {
|                if ($c -is [System.Collections.IDictionary]) { $c['si_sql_iaas'] = $true } else { $c | Add-Member -NotePropertyName si_sql_iaas -NotePropertyValue $true -Force }
|                $n++; break
|            }
|        }
|    }
|    $n
|}
|
|function Invoke-SIAssetClassification {
|    <#
|    .SYNOPSIS  PURE. Every asset target on ONE CI (an ordered dictionary): writes the target field (and keepSourceIn), and
|               si_classified_by (target field -> the row ids that decided, or 'fallback').
|    #>
|    param([Parameter(Mandatory)]$Ci, [Parameter(Mandatory)]$Index, [hashtable]$Context)
|    $unknownFields = @(foreach ($x in @(Get-SIItemValue $Ci 'si_unknown_fields')) { if ($x) { [string]$x } })
|    $by = [ordered]@{}
|    foreach ($t in @($Index.Targets)) {
|        if ($t.AppliesTo -ne 'asset') { continue }
|        $src = Get-SIItemValue $Ci $t.Field
|        if ($t.KeepSourceIn) {
|            # the value the sources gave, kept once: a CI classified before (an incremental build) keeps its source value
|            $prev = Get-SIItemValue $Ci $t.KeepSourceIn
|            if (-not (Test-SIValueEmpty $prev)) { $src = $prev } else { $Ci[$t.KeepSourceIn] = $src }
|        }
|        $r = Get-SIClassificationValue -Target $t -Item $Ci -Context $Context -UnknownFields $unknownFields
|        $vals = @($r.Values); $decided = @($r.Rules)
|        if ($vals.Count -eq 0) {
|            if ($t.Fallback -eq '$keep') {
|                $sv = @((Get-SIValueList $src).ToArray() | Where-Object { -not (Test-SIValueEmpty $_) })
|                if ($sv.Count) { $vals = @([string]$sv[0]) } else { $vals = @($t.FallbackEmpty) }
|            } else { $vals = @($t.Fallback) }
|            $decided = @('fallback')
|        }
|        if ($t.Multi) { $Ci[$t.Field] = [string[]]$vals } else { $Ci[$t.Field] = [string]$vals[0] }
|        $by[$t.Field] = $decided
|    }
|    $Ci['si_classified_by'] = $by
|    $Ci
|}
|
|function Invoke-SICiClassification {
|    <#
|    .SYNOPSIS  The CI build step: SQL IaaS links over the set, then every CI classified. Never throws (a classification that
|               cannot run leaves the CIs as the sources gave them, with a warning). Returns the number of CIs classified.
|    #>
|    param([AllowEmptyCollection()][object[]]$Cis = @(), [Parameter(Mandatory)]$Model, [hashtable]$Context)
|    try {
|        $dimDoc = $Model['dimensions']; $clsDoc = $Model['classification']
|        if ($null -eq $dimDoc -or $null -eq $clsDoc) { return 0 }
|        $idx = New-SIClassificationIndex -Dimensions $dimDoc -Classification $clsDoc
|        if (@($idx.Targets).Count -eq 0) { return 0 }
|        $null = Set-SICiSqlIaasLinks -Cis @($Cis)
|        $n = 0
|        foreach ($ci in $Cis) { if ($null -eq $ci) { continue }; $null = Invoke-SIAssetClassification -Ci $ci -Index $idx -Context $Context; $n++ }
|        return $n
|    } catch {
|        Write-Warning ('classification (asset type / subtype / components) not applied -- {0}' -f $_.Exception.Message)
|        return 0
|    }
|}
|
|function ConvertFrom-SIAzureResourceIdType {
|    <# PURE. '/subscriptions/../providers/Microsoft.Sql/servers/s1/databases/d1' -> 'microsoft.sql/servers/databases'; '' when it is not one. #>
|    param([AllowNull()][AllowEmptyString()][string]$Id)
|    if (-not $Id) { return '' }
|    $i = $Id.ToLowerInvariant().LastIndexOf('/providers/')
|    if ($i -lt 0) { return '' }
|    $segs = @($Id.Substring($i + 11).Split('/') | Where-Object { $_ -ne '' })
|    if ($segs.Count -lt 3) { return '' }
|    $t = $segs[0] + '/' + $segs[1]
|    for ($k = 3; $k -lt $segs.Count; $k += 2) { $t += '/' + $segs[$k] }
|    $t.ToLowerInvariant()
|}
|
|function ConvertTo-SIFindingClassificationItem {
|    <#
|    .SYNOPSIS  PURE. A Risk Analysis row (any report) -> the SI finding fields a classification row reads:
|               si_title (ConfigurationName), si_category, si_subcategory, si_security_domain, si_finding_key (ConfigurationId),
|               si_report_name (AssetDetectedInReportName / ReportName, #772),
|               si_affected_product / _vendor / _version / _cpe (the row's own si_* columns or SI_Affected*; ';'-joined lists
|               become lists) and si_azure_resource_type (AssetType when it is an Azure type, else parsed from
|               AzureResourceId / ResourceId / AssetId). The row's own columns stay readable by a source-path row. A field the
|               row does not carry is absent -- unknown, never guessed.
|    #>
|    param([Parameter(Mandatory)]$Row, [switch]$WithRow)
|    # PERFORMANCE (Risk Analysis calls this once per finding row): Get-SIItemValue's own rule -- the exact key first, else the
|    # first key equal ignoring case (in key order) -- with the case-insensitive view of a dictionary's keys built ONCE per
|    # row instead of a walk over every key for each name the row does not carry
|    $ciKeys = $null; $isDict = $false
|    if ($Row -is [System.Collections.IDictionary]) {
|        $isDict = $true
|        # a dictionary whose own lookup already ignores case (PowerShell's @{} and [ordered]@{}, probed on a key that has
|        # letters) needs no second view: the walk could find nothing its lookup missed
|        $insens = $false
|        if ($Row -is [hashtable] -or $Row -is [System.Collections.Specialized.OrderedDictionary]) {
|            foreach ($k in $Row.Keys) { $ks = [string]$k; $ku = $ks.ToUpperInvariant(); $kl = $ks.ToLowerInvariant(); if ($ku -cne $kl) { $insens = ($Row.Contains($ku) -and $Row.Contains($kl)); break } }
|        }
|        if (-not $insens) {
|            $ciKeys = [System.Collections.Generic.Dictionary[string,object]]::new([System.StringComparer]::OrdinalIgnoreCase)
|            foreach ($k in $Row.Keys) { $ks = [string]$k; if (-not $ciKeys.ContainsKey($ks)) { $ciKeys[$ks] = $k } }
|        }
|    }
|    # every name this reads, read ONCE, inline (no script block call per name): its value as trimmed text, or $null when
|    # absent / null / blank -- what the per-name reader returned
|    $tv = @{}
|    foreach ($n in $script:SIFindingItemReadNames) {
|        $v = $null
|        if ($isDict) {
|            if ($Row.Contains($n)) { $v = $Row[$n] }
|            elseif ($null -ne $ciKeys) { $ok = $null; if ($ciKeys.TryGetValue($n, [ref]$ok)) { $v = $Row[$ok] } }
|        } else { $v = Get-SIItemValue $Row $n }
|        $t = $null
|        if ($null -ne $v) { $s = [string]$v; if ($s.Trim()) { $t = $s.Trim() } }
|        $tv[$n] = $t
|    }
|    $o = @{}
|    # the row's own columns only when a source-path row reads them (a copy per row costs on 80,000-row reports)
|    if ($WithRow) {
|        if ($Row -is [System.Collections.IDictionary]) { foreach ($k in @($Row.Keys)) { $o[[string]$k] = $Row[$k] } }
|        else { foreach ($pp in $Row.PSObject.Properties) { $o[$pp.Name] = $pp.Value } }
|    }
|    foreach ($p in $script:SIFindingItemPairs) {
|        foreach ($src in $p[1]) {
|            $v = $tv[$src]
|            if ($null -eq $v) { continue }
|            if ($p[0] -like 'si_affected_*' -and $v.Contains(';')) { $o[$p[0]] = @($v.Split(';') | ForEach-Object { $_.Trim() } | Where-Object { $_ }) } else { $o[$p[0]] = $v }
|            break
|        }
|    }
|    $rt = $tv['si_azure_resource_type']
|    if (-not $rt) { $at = $tv['AssetType']; if ($at -and $at -match '^(?i)microsoft\.[a-z0-9]+/[a-z0-9/]+$') { $rt = $at.ToLowerInvariant() } }
|    if (-not $rt) {
|        foreach ($n in 'AzureResourceId', 'ResourceId', 'AssetId', 'AssetName') {
|            $idv = $tv[$n]
|            # ConvertFrom-SIAzureResourceIdType returns '' for an empty id and for one without '/providers/' (its own first
|            # two tests, made here so the call is skipped for the ids that are no Azure resource id)
|            if (-not $idv -or $idv.ToLowerInvariant().LastIndexOf('/providers/') -lt 0) { continue }
|            $t = ConvertFrom-SIAzureResourceIdType $idv; if ($t) { $rt = $t; break }
|        }
|    }
|    if ($rt) { $o['si_azure_resource_type'] = $rt }
|    $o
|}
|$script:SIFindingItemPairs = @(
|    @('si_title', @('si_title', 'ConfigurationName')), @('si_category', @('si_category', 'Category')), @('si_subcategory', @('si_subcategory', 'Subcategory')),
|    @('si_security_domain', @('si_security_domain', 'SecurityDomain')), @('si_finding_key', @('si_finding_key', 'ConfigurationId')),
|    @('si_affected_product', @('si_affected_product', 'SI_AffectedProduct')), @('si_affected_vendor', @('si_affected_vendor', 'SI_AffectedVendor')),
|    @('si_affected_version', @('si_affected_version', 'SI_AffectedVersion')), @('si_affected_cpe', @('si_affected_cpe', 'SI_AffectedCpe')),
|    # #772 the report that found it (a ServiceNow sub-CI rule may route by report)
|    @('si_report_name', @('si_report_name', 'AssetDetectedInReportName', 'ReportName')))
|$script:SIFindingItemReadNames = @(@($script:SIFindingItemPairs | ForEach-Object { $_[1] }) + @('si_azure_resource_type', 'AssetType', 'AzureResourceId', 'ResourceId', 'AssetId', 'AssetName'))
|
|function Get-SIFindingDimensionValues {
|    <#
|    .SYNOPSIS  PURE. Every finding target over one finding item -> ordered @{ <target field> = value } plus '_rules'
|               (target field -> the deciding row id or 'fallback'). One value per target, never blank.
|    #>
|    param([Parameter(Mandatory)]$Item, [Parameter(Mandatory)]$Index, [hashtable]$Context)
|    $out = [ordered]@{}
|    $rules = [ordered]@{}
|    foreach ($t in @($Index.Targets)) {
|        if ($t.AppliesTo -ne 'finding') { continue }
|        $r = Get-SIClassificationValue -Target $t -Item $Item -Context $Context
|        if (@($r.Values).Count) { $out[$t.Field] = [string]$r.Values[0]; $rules[$t.Field] = [string]$r.Rules[0] }
|        else { $out[$t.Field] = $t.Fallback; $rules[$t.Field] = 'fallback' }
|        # #772 each value is written before the next target is evaluated (as the asset targets are), so a later finding target
|        # reads an earlier one -- the ServiceNow sub-CI reads the finding's component
|        if ($Item -is [System.Collections.IDictionary]) { $Item[$t.Field] = $out[$t.Field] }
|    }
|    $out['_rules'] = $rules
|    $out
|}
|
|$script:SIClassificationIndexCache = $null
|
|# =====================================================================================================================
|# #772 THE PATCH CYCLE (owner 2026-10-19: "we need a filter option, where we filter between 'being fixed during monthly
|# lifecycle' vs. 'catch-up older than 1 month'"). si_patch_cycle is a finding target of the classification like every
|# other dimension -- its values and which facts give which value are DATA (data-model/classification.locked.json, rows
|# patch-cycle-*; the customer's overrides as for any row). What is CODE is the two facts the rows read, worked out once here
|# for both editions:
|#   si_patch_fix   'none' when the source says no fix exists (si_fix_available false, or a fix text such as "No fix")
|#   si_patch_age   'within' | 'over' -- the fix's RELEASE date (the month a "<Month> <Year> Security Updates" / "2026-10
|#                  Cumulative Update" text names -> that month's Patch Tuesday, the 2nd Tuesday; an explicit date wins,
|#                  e.g. an out-of-band update), else the finding's age since it was first detected, against
|#                  SI_PatchCycle_CatchUpDays (default 30; exactly the threshold is still within) at the collection time.
|# Nothing known -> neither fact -> the target's fallback (Unknown).
|# =====================================================================================================================
|
|function Get-SIPatchCycleCatchUpDays {
|    <# The catch-up threshold in days: SI_PatchCycle_CatchUpDays (a whole number of at least 1), else 30. #>
|    $v = $global:SI_PatchCycle_CatchUpDays
|    $n = 0
|    if ($null -ne $v -and [int]::TryParse(([string]$v).Trim(), [ref]$n) -and $n -ge 1) { return $n }
|    30
|}
|
|function Get-SIPatchTuesday {
|    <# PURE. The second Tuesday of a month (UTC midnight) -- Microsoft's monthly security release. #>
|    param([Parameter(Mandatory)][int]$Year, [Parameter(Mandatory)][int]$Month)
|    $first = [datetime]::new($Year, $Month, 1, 0, 0, 0, [System.DateTimeKind]::Utc)
|    $off = (([int][System.DayOfWeek]::Tuesday) - ([int]$first.DayOfWeek) + 7) % 7
|    $first.AddDays($off + 7)
|}
|
|$script:SIPatchMonths = @{ jan = 1; feb = 2; mar = 3; apr = 4; may = 5; jun = 6; jul = 7; aug = 8; sep = 9; oct = 10; nov = 11; dec = 12 }
|
|function ConvertFrom-SIFixReleaseDate {
|    <#
|    .SYNOPSIS  PURE. The release date a fix text names, or $null: an explicit date (2026-10-21, an out-of-band update) as it
|               is; a month -- "October 2026 Security Updates", "Oct 2026 (Hotpatch)", "2026-10 Cumulative Update for
|               Windows 11 (KB5127648)", "2026-10 Out-of-band update" -- as that month's Patch Tuesday. Several updates
|               (';'-joined): the newest one. A KB number alone names no date.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    if ([string]::IsNullOrWhiteSpace($Text)) { return $null }
|    $best = $null
|    foreach ($part in $Text.Split(';')) {
|        $p = $part.Trim(); if (-not $p) { continue }
|        $d = $null
|        $m = [regex]::Match($p, '(?<!\d)(20\d{2})-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])(?!\d)')
|        if ($m.Success) {
|            try { $d = [datetime]::new([int]$m.Groups[1].Value, [int]$m.Groups[2].Value, [int]$m.Groups[3].Value, 0, 0, 0, [System.DateTimeKind]::Utc) } catch { $d = $null }
|        }
|        if ($null -eq $d) {
|            $m = [regex]::Match($p, '(?i)\b(jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)[a-z]*\.?\s*,?\s*(20\d{2})\b')
|            if ($m.Success) { $d = Get-SIPatchTuesday -Year ([int]$m.Groups[2].Value) -Month $script:SIPatchMonths[$m.Groups[1].Value.ToLowerInvariant()] }
|        }
|        if ($null -eq $d) {
|            $m = [regex]::Match($p, '(?<!\d)(20\d{2})-(0[1-9]|1[0-2])(?![\d-])')
|            if ($m.Success) { $d = Get-SIPatchTuesday -Year ([int]$m.Groups[1].Value) -Month ([int]$m.Groups[2].Value) }
|        }
|        if ($null -ne $d -and ($null -eq $best -or $d -gt $best)) { $best = $d }
|    }
|    $best
|}
|
|function ConvertTo-SIPatchDate {
|    <# PURE. A date value of a row (a datetime, or ISO / invariant text) as UTC, or $null. #>
|    param($Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [datetime]) { $d = [datetime]$Value; if ($d.Kind -eq [System.DateTimeKind]::Unspecified) { $d = [datetime]::SpecifyKind($d, [System.DateTimeKind]::Utc) }; return $d.ToUniversalTime() }
|    $s = ([string]$Value).Trim(); if (-not $s) { return $null }
|    $o = [datetime]::MinValue
|    if ([datetime]::TryParse($s, [System.Globalization.CultureInfo]::InvariantCulture, ([System.Globalization.DateTimeStyles]::AdjustToUniversal -bor [System.Globalization.DateTimeStyles]::AssumeUniversal), [ref]$o)) { return [datetime]::SpecifyKind($o, [System.DateTimeKind]::Utc) }
|    $null
|}
|
|$script:SIPatchFixTextNames = @('si_fix_recommended_update', 'RecommendedSecurityUpdate', 'SI_FixReference', 'si_fix_reference')
|$script:SIPatchFixDateNames = @('si_fix_release_date', 'FixReleaseDate', 'si_fix_published')
|# #906: si_source_first_seen is the field Risk Analysis writes (RA-SourceFirstSeen.ps1, Defender's software vulnerabilities
|# export) -- without it here every browser / third-party CVE (no dated update) had no age and fell to Unknown
|$script:SIPatchFirstNames = @('si_first_detected', 'si_source_first_seen', 'si_source_first_detected', 'FirstDetected', 'FirstSeenTimestamp', 'FirstSeen', 'si_first_seen')
|$script:SIPatchUpdateNames = @('si_fix_recommended_update', 'RecommendedSecurityUpdate', 'si_fix_recommended_update_id', 'RecommendedSecurityUpdateId')
|$script:SIPatchNowNames = @('si_collection_time', 'CollectionTime')
|
|function Get-SIPatchCycleFacts {
|    <#
|    .SYNOPSIS  PURE. The two facts the patch-cycle rows read, from one finding row: @{ si_patch_fix = 'none' | ''; si_patch_age =
|               'within' | 'over' | ''; Basis = 'fix release' | 'first detected' | ''; ReleaseDate; AgeDays }.
|               -Now: the collection time (default: the row's, else now); -CatchUpDays: the threshold (default the setting).
|    #>
|    param([Parameter(Mandatory)]$Row, $Now, [int]$CatchUpDays = 0)
|    $g = { param([string]$n) if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($n)) { $Row[$n] } else { $null } } elseif ($null -ne $Row.PSObject.Properties[$n]) { $Row.$n } else { $null } }
|    if ($CatchUpDays -lt 1) { $CatchUpDays = Get-SIPatchCycleCatchUpDays }
|    $out = @{ si_patch_fix = ''; si_patch_age = ''; Basis = ''; ReleaseDate = $null; AgeDays = $null }
|    $fixText = ''
|    foreach ($n in $script:SIPatchFixTextNames) { $v = & $g $n; if ($null -ne $v -and ([string]$v).Trim()) { $fixText = ([string]$v).Trim(); break } }
|    $avail = ConvertTo-SIBoolOrNull (& $g 'si_fix_available')
|    if ($avail -eq $false -or $fixText -match '^(?i)(no (known )?(fix|patch|security update|update|remediation)( available)?|none|not available|n/?a)\.?$') {
|        $out.si_patch_fix = 'none'; return $out
|    }
|    $at = $null
|    foreach ($n in $script:SIPatchNowNames) { $at = ConvertTo-SIPatchDate (& $g $n); if ($null -ne $at) { break } }
|    if ($null -ne $Now) { $at = ConvertTo-SIPatchDate $Now }
|    if ($null -eq $at) { $at = [datetime]::UtcNow }
|    $rel = $null
|    foreach ($n in $script:SIPatchFixDateNames) { $rel = ConvertTo-SIPatchDate (& $g $n); if ($null -ne $rel) { break } }
|    $basis = 'fix release'
|    # #772 (owner: "read the fix release date"): a Microsoft update's own release date by its KB (the Security Update Guide,
|    # Get-SIKbReleaseDate -- Defender names the KB, never its date), before the month the update's name says
|    if ($null -eq $rel) {
|        $kbs = [System.Collections.Generic.List[string]]::new()
|        foreach ($n in 'si_fix_recommended_update_id', 'RecommendedSecurityUpdateId') { $v = & $g $n; if ($null -ne $v) { foreach ($x in (Get-SIKbKeysFromText ([string]$v))) { $kbs.Add($x) } } }
|        if ($fixText) { foreach ($x in (Get-SIKbKeysFromText $fixText)) { $kbs.Add($x) } }
|        if ($kbs.Count) { $rel = Get-SIKbReleaseDate -Kbs $kbs.ToArray(); if ($null -ne $rel) { $basis = 'kb release' } }
|    }
|    if ($null -eq $rel -and $fixText) { $rel = ConvertFrom-SIFixReleaseDate $fixText }
|    if ($null -eq $rel) {
|        $basis = 'first detected'
|        foreach ($n in $script:SIPatchFirstNames) { $rel = ConvertTo-SIPatchDate (& $g $n); if ($null -ne $rel) { break } }
|    }
|    if ($null -eq $rel) {
|        # #906: no dated update and no first-seen. A finding that names NO recommended update (no update name, no update id --
|        # a generic fix text such as "Update the affected software ..." is no update) has no single update: group 3, the same
|        # rule as the SQL twin and SI-PatchCycle.ps1 (no update = nofix). Unknown stays only for an update whose month
|        # cannot be read (a KB number alone, an update name without a month).
|        $hasUpd = $false
|        foreach ($n in $script:SIPatchUpdateNames) { $v = & $g $n; if ($null -ne $v -and -not ($v -is [System.DBNull]) -and ([string]$v).Trim()) { $hasUpd = $true; break } }
|        if (-not $hasUpd) { $out.si_patch_fix = 'none' }
|        return $out
|    }
|    $age = ($at - $rel).TotalDays
|    $out.Basis = $basis; $out.ReleaseDate = $rel; $out.AgeDays = [Math]::Floor($age)
|    # exactly the threshold is still in the cycle: catch-up is OLDER than it
|    $out.si_patch_age = $(if ($age -gt $CatchUpDays) { 'over' } else { 'within' })
|    $out
|}
|
|function Add-SIPatchCycleFacts {
|    <# The patch cycle's facts onto a finding classification item (only the ones that are known). The collection time is the
|       run's (RA_CollectionTime) when Risk Analysis set it. Never throws. #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Item, [Parameter(Mandatory)]$Row)
|    try {
|        $now = $null; if ($null -ne $global:RA_CollectionTime) { $now = $global:RA_CollectionTime }
|        $f = Get-SIPatchCycleFacts -Row $Row -Now $now
|        foreach ($k in 'si_patch_fix', 'si_patch_age') { if ($f[$k]) { $Item[$k] = $f[$k] } }
|        if ($Row -is [System.Collections.IDictionary]) {
|            # the fix's release date when the Security Update Guide gave it (si_fix_release_date), and the CVE's published date
|            # as its own field (si_cve_published: exposure age -- the patch cycle never reads it)
|            if ($f.Basis -eq 'kb release' -and -not $Row.Contains('si_fix_release_date')) { $Row['si_fix_release_date'] = ([datetime]$f.ReleaseDate).ToString('yyyy-MM-dd') }
|            if (-not $Row.Contains('si_cve_published')) {
|                foreach ($pn in 'si_published', 'PublishedDate', 'CVEPublishedDate', 'si_published_date') {
|                    $pv = $null; if ($Row.Contains($pn)) { $pv = ConvertTo-SIPatchDate $Row[$pn] }
|                    if ($null -ne $pv) { $Row['si_cve_published'] = $pv.ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture); break }
|                }
|            }
|        }
|    } catch { }
|    $Item
|}
|
|function Set-SIRaRowOsFamily {
|    <#
|    .SYNOPSIS  #772. A finding carries its asset's OS family (si_os_family, set on the row by the CI context). A row without
|               one -- no CI was found for its asset -- is classified from its OWN OS fields (si_os_platform / OSPlatform,
|               si_os_name / OSName / OsVersion..., DeviceCategory) with the SAME rows as the CIs (the asset target
|               si_os_family); nothing known = the fallback (Unknown). No OS family target in the model = the row is left as
|               it is. Never throws.
|    #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Row, $Index)
|    try {
|        if ($Row.Contains('si_os_family') -and -not (Test-SIValueEmpty $Row['si_os_family'])) { return $Row }
|        if ($null -eq $Index) { return $Row }
|        $t = $null
|        foreach ($x in @($Index.Targets)) { if ($x.Field -eq 'si_os_family') { $t = $x; break } }
|        if ($null -eq $t) { return $Row }
|        $item = @{}
|        foreach ($p in $script:SIOsFamilyRowPairs) {
|            foreach ($src in $p[1]) {
|                $v = $null; if ($Row.Contains($src)) { $v = $Row[$src] }
|                if ($null -ne $v -and ([string]$v).Trim()) { $item[$p[0]] = ([string]$v).Trim(); break }
|            }
|        }
|        $ck = 'osf' + [char]31 + [string]$item['si_os_platform'] + [char]31 + [string]$item['si_os_name'] + [char]31 + [string]$item['si_device_category']
|        $val = $null
|        if ($null -ne $Index.Cache -and $Index.Cache.ContainsKey($ck)) { $val = [string]$Index.Cache[$ck] }
|        else {
|            $r = Get-SIClassificationValue -Target $t -Item $item
|            $val = $t.Fallback; if (@($r.Values).Count) { $val = [string]$r.Values[0] }
|            if ($null -ne $Index.Cache) { $Index.Cache[$ck] = $val }
|        }
|        if ($val) { $Row['si_os_family'] = $val }
|    } catch { }
|    $Row
|}
|$script:SIOsFamilyRowPairs = @(
|    @('si_os_platform', @('si_os_platform', 'OSPlatform', 'OsPlatform', 'DeviceOsPlatform')),
|    @('si_os_name', @('si_os_name', 'OSName', 'OsName', 'OperatingSystem', 'OSVersion', 'OsVersion')),
|    @('si_device_category', @('si_device_category', 'DeviceCategory')))
|
|function Get-SIClassificationIndex {
|    <#
|    .SYNOPSIS  The merged templates (shipped + the customer's) as an index, read once per process; $null when there are none
|               or they cannot be read (nothing is classified -- never fails). -Refresh re-reads.
|    #>
|    param([string]$Root, [string]$OverlayRoot = $global:SI_DataModelOverlayRoot, [switch]$Refresh)
|    if ($script:SIClassificationIndexCache -and -not $Refresh -and -not $Root) { return $script:SIClassificationIndexCache }
|    try {
|        if (-not (Get-Command -Name Get-SIDataModelTemplate -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-DataModelTemplates.ps1') }
|        $r = Get-SIDataModelRoot $Root
|        if (-not (Test-Path -LiteralPath (Join-Path $r 'classification.locked.json'))) {
|            # Pro: a data model exported before these templates were published -- the shipped templates (no override yet)
|            $r = Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'data-model'
|            if (-not (Test-Path -LiteralPath (Join-Path $r 'classification.locked.json'))) { return $null }
|        }
|        $d = (Get-SIDataModelTemplate -Name 'dimensions' -Root $r -OverlayRoot $OverlayRoot).Document
|        $c = (Get-SIDataModelTemplate -Name 'classification' -Root $r -OverlayRoot $OverlayRoot).Document
|        foreach ($p in (Test-SIClassifications -Dimensions $d -Classification $c)) { Write-Warning ('classification: {0} -- not applied' -f $p) }
|        $idx = New-SIClassificationIndex -Dimensions $d -Classification $c
|        if (-not $Root) { $script:SIClassificationIndexCache = $idx }
|        return $idx
|    } catch {
|        Write-Warning ('classification could not be read -- {0}. Findings get the fallback values.' -f $_.Exception.Message)
|        return $null
|    }
|}
|
|function Set-SIRaRowDimensions {
|    <#
|    .SYNOPSIS  Risk Analysis, per output row (RA-RiskScore.ps1): the row's finding targets (si_component, ...) from the
|               classification rows. -Index: a prepared index (tests); default the cached one. A row the rows cannot classify
|               gets each target's fallback; no index at all = the row is left as it is. Never throws.
|    #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Row, $Index)
|    try {
|        if ($null -eq $Index) { $Index = Get-SIClassificationIndex }
|        if ($null -eq $Index) { return $Row }
|        $item = ConvertTo-SIFindingClassificationItem -Row $Row -WithRow:([bool]$Index.HasSourcePath)
|        # #772 the patch cycle's two facts (the rows patch-cycle-* read them): the fix's release / the finding's age
|        $null = Add-SIPatchCycleFacts -Item $item -Row $Row
|        # the same finding fields classify the same way: one evaluation per distinct combination (a report's rows repeat them)
|        $vals = $null; $ck = $null
|        if (-not $Index.HasSourcePath -and $null -ne $Index.Cache) {
|            # PERFORMANCE: the cache key is the values of the fields the finding rows' conditions READ (worked out once per
|            # index), not of every field of the item -- a value no condition reads (the affected version, the finding key)
|            # cannot change the result, and keying on it made almost every row of a CVE report a miss. Built in a loop.
|            $kfp = $Index.PSObject.Properties['SIKeyFields']
|            if (-not $kfp) {
|                $kfSet = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
|                foreach ($kt in @($Index.Targets)) {
|                    if ($null -eq $kt -or $kt.AppliesTo -ne 'finding') { continue }
|                    foreach ($kr in $kt.Rules) { foreach ($kfn in (Get-SIConditionFields $kr.Condition)) { [void]$kfSet.Add([string]$kfn) } }
|                }
|                $kfArr = [string[]]@($kfSet)
|                [System.Array]::Sort($kfArr, [System.StringComparer]::Ordinal)
|                Add-Member -InputObject $Index -NotePropertyName 'SIKeyFields' -NotePropertyValue $kfArr -Force
|                $kfp = $Index.PSObject.Properties['SIKeyFields']
|            }
|            $ckParts = [System.Collections.Generic.List[string]]::new()
|            $ckParts.Add('k2')
|            foreach ($ckn in $kfp.Value) {
|                $ckv = $item[$ckn]
|                $ckText = '~'
|                if ($null -ne $ckv) {
|                    if ($ckv -is [string] -or $ckv -is [System.Collections.IDictionary] -or -not ($ckv -is [System.Collections.IEnumerable])) { $ckText = 's' + [string]$ckv }
|                    else { $ckl = [System.Collections.Generic.List[object]]::new(); foreach ($x in $ckv) { if ($null -ne $x) { $ckl.Add($x) } }; $ckText = 'l' + $ckl.Count + ':' + ($ckl -join [char]30) }
|                }
|                $ckParts.Add(('{0}={1}' -f $ckn, $ckText))
|            }
|            $ck = $ckParts -join [char]31
|            if ($Index.Cache.ContainsKey($ck)) { $vals = $Index.Cache[$ck] }
|        }
|        if ($null -eq $vals) {
|            $vals = Get-SIFindingDimensionValues -Item $item -Index $Index
|            if ($null -ne $ck) { if ($Index.Cache.Count -ge 20000) { $Index.Cache.Clear() }; $Index.Cache[$ck] = $vals }
|        }
|        foreach ($k in @($vals.Keys)) { if ($k -ne '_rules') { $Row[$k] = $vals[$k] } }
|        # #772 the OS family: the asset's (the CI context set it); a row no CI was found for, from its own OS fields
|        $null = Set-SIRaRowOsFamily -Row $Row -Index $Index
|        foreach ($k in 'si_affected_product', 'si_affected_vendor', 'si_affected_version', 'si_affected_cpe') {
|            if ($item.ContainsKey($k) -and -not $Row.Contains($k)) { $Row[$k] = ((Get-SIValueList $item[$k]) -join ';') }
|        }
|    } catch { }
|    $Row
|}
'@ }
$__siSupportFiles['engine/data-model/SI-KbReleaseDates.ps1'] = @{ Sha256 = '96d3a82483422993083693d3a69c16d3f1bc9edeab5ee91ca8c6cf0719123fc0'; Text = @'
|#Requires -Version 5.1
|<#
|    #772 THE RELEASE DATE OF A MICROSOFT UPDATE, PER KB -- for the patch cycle (owner 2026-10-19: "yes, read the fix release
|    date from defender").
|
|    WHY HERE AND NOT FROM DEFENDER. None of the Defender vulnerability sources SI reads names when a FIX was released:
|      DeviceTvmSoftwareVulnerabilities     RecommendedSecurityUpdate (a name) + RecommendedSecurityUpdateId (the KB) -- no date
|      DeviceTvmSoftwareVulnerabilitiesKB   PublishedDate / LastModifiedTime are the CVE's (si_published), not the fix's
|      GET /api/vulnerabilities             publishedOn / updatedOn / firstDetected -- the CVE's
|      GET /api/recommendations             recommendedVersion, remediationType, status -- no date
|      GET machines/{id}/getmissingkbs      id (KB), name, osBuild, url, machineMissedOn, cveAddressed -- no date (SI does not call it)
|      Exposure Graph                       the CVE / device nodes -- no fix date
|    Microsoft's public Security Update Guide does: the CVRF v3.0 API (https://api.msrc.microsoft.com/cvrf/v3.0, public, no
|    sign-in) lists one document per release (2026-Oct, and an out-of-band release as its own document) with its release
|    date, and every document names the KB of each vendor fix (Remediations, Type 2 = Vendor Fix, Description = the KB
|    number). A KB's release date = the release date of the earliest document that names it (a remediation's own Date wins
|    when it carries one).
|
|    ONCE PER RUN, CACHED IN THE INSTALL, NEVER PER FINDING: Pro keeps the dates in sidata.KbReleaseDate (one row per KB + a
|    state row), Community in a file (SettingsPath\OUTPUT\msrc-kb-release-dates.json). A cache read within the last day is
|    used as it is; else the update list is read once, and only the documents of the last 24 months that are new or revised since the cache are read. An update older than that window keeps the name rule (its
|    month's Patch Tuesday) -- it is catch-up either way.
|
|    OFF / NO NETWORK: SI_PatchCycle_MsrcDates (default on) off = no call at all; a call that fails (no network, a private
|    network that does not allow api.msrc.microsoft.com, a proxy) is said in ONE line and the patch cycle uses what the cache
|    holds and, for the rest, the update names' Patch Tuesday. REST only (Invoke-RestMethod), no module. PowerShell 5.1.
|#>
|
|$script:SIMsrcBase = 'https://api.msrc.microsoft.com/cvrf/v3.0'
|$script:SIKbReleaseDates = $null
|
|function Test-SIMsrcDatesOn {
|    <# PURE over the setting. SI_PatchCycle_MsrcDates: on unless off / false / 0 / no. #>
|    param($Setting = $global:SI_PatchCycle_MsrcDates)
|    if ($null -eq $Setting -or -not ([string]$Setting).Trim()) { return $true }
|    ([string]$Setting).Trim().ToLowerInvariant() -notin 'off', 'false', '0', 'no', '$false'
|}
|
|function Get-SIMsrcMonths {
|    <# PURE. How many months back the release documents are read: 24 -- an update older than that is catch-up whichever
|       date it has, and its name's Patch Tuesday says so. #>
|    24
|}
|
|function ConvertTo-SIKbKey {
|    <# PURE. 'KB5127648' / '5127648' / 'kb 5127648' -> 'KB5127648'; '' when it is not a KB number. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    if ([string]::IsNullOrWhiteSpace($Value)) { return '' }
|    $m = [regex]::Match($Value.Trim(), '^(?i)(?:KB\s*)?(\d{6,8})$')
|    if ($m.Success) { return 'KB' + $m.Groups[1].Value }
|    ''
|}
|
|function Get-SIKbKeysFromText {
|    <# PURE. Every KB number a text names ("... (KB5127648)", "KB5127648;KB5127649"), in order, once each. #>
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    $out = [System.Collections.Generic.List[string]]::new()
|    if ([string]::IsNullOrWhiteSpace($Text)) { return , $out.ToArray() }
|    foreach ($m in [regex]::Matches($Text, '(?i)\bKB\s*(\d{6,8})\b')) { $k = 'KB' + $m.Groups[1].Value; if (-not $out.Contains($k)) { $out.Add($k) } }
|    foreach ($p in $Text.Split(';')) { $k = ConvertTo-SIKbKey $p; if ($k -and -not $out.Contains($k)) { $out.Add($k) } }
|    , $out.ToArray()
|}
|
|function ConvertTo-SIMsrcDate {
|    <# PURE. A CVRF date (ISO text or a parsed datetime) as a UTC date, or $null. #>
|    param($Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [datetime]) { return ([datetime]$Value).ToUniversalTime().Date }
|    $o = [datetime]::MinValue
|    if ([datetime]::TryParse(([string]$Value), [System.Globalization.CultureInfo]::InvariantCulture, ([System.Globalization.DateTimeStyles]::AdjustToUniversal -bor [System.Globalization.DateTimeStyles]::AssumeUniversal), [ref]$o)) { return [datetime]::SpecifyKind($o.Date, [System.DateTimeKind]::Utc) }
|    $null
|}
|
|function ConvertTo-SIMsrcStamp {
|    <# PURE. A document's revision time as one invariant text (ISO, UTC) -- the same whether JSON gave text or a parsed date. #>
|    param($Value)
|    $d = ConvertTo-SIMsrcDateTime $Value
|    if ($null -eq $d) { return [string]$Value }
|    $d.ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture)
|}
|
|function ConvertFrom-SIMsrcUpdateList {
|    <# PURE. The /updates answer -> the release documents: Id, Release (InitialReleaseDate), Current (CurrentReleaseDate), Url. #>
|    param($Answer)
|    $list = [System.Collections.Generic.List[object]]::new()
|    foreach ($u in @($Answer.value)) {
|        if ($null -eq $u -or -not $u.ID) { continue }
|        $list.Add([pscustomobject]@{ Id = [string]$u.ID; Release = (ConvertTo-SIMsrcDate $u.InitialReleaseDate); Current = (ConvertTo-SIMsrcStamp $u.CurrentReleaseDate)
|                                     Url = (Get-SIMsrcDocumentUrl -Id ([string]$u.ID) -CvrfUrl $u.CvrfUrl) })
|    }
|    , $list.ToArray()
|}
|
|function Get-SIMsrcDocumentUrl {
|    <# PURE. The address of one release document: the answer's own CvrfUrl when it is a whole https address with a host,
|       else built from the API's base and the document id. A link that is relative ('/cvrf/v3.0/cvrf/2026-Oct', 'cvrf/...'),
|       empty, padded with blanks or without a host ('https:///cvrf/...') made "Invalid URI: The hostname could not be parsed"
|       and stopped the whole read. #>
|    param([string]$Id, $CvrfUrl)
|    $raw = ([string]$CvrfUrl).Trim()
|    $u = $null
|    if ($raw -and [uri]::TryCreate($raw, [UriKind]::Absolute, [ref]$u) -and $u.Scheme -in 'https', 'http' -and $u.Host) { return $u.AbsoluteUri }
|    $base = [uri]($script:SIMsrcBase.TrimEnd('/') + '/')
|    if ($raw -and -not ($raw -match '^[a-z][a-z0-9+.-]*:')) {
|        # a relative link: against the API's host when it starts with '/', else under the API's base
|        $rel = $null
|        if ([uri]::TryCreate($base, $raw, [ref]$rel) -and $rel.Host) { return $rel.AbsoluteUri }
|    }
|    '{0}/cvrf/{1}' -f $script:SIMsrcBase.TrimEnd('/'), [uri]::EscapeDataString(([string]$Id).Trim())
|}
|
|function ConvertFrom-SIMsrcDocument {
|    <# PURE. One CVRF document -> KB -> its release date (the remediation's own Date, else the document's release date). #>
|    param($Document, $Release)
|    $out = @{}
|    $docDate = $Release
|    if ($null -eq $docDate -and $Document.DocumentTracking) { $docDate = ConvertTo-SIMsrcDate $Document.DocumentTracking.InitialReleaseDate }
|    foreach ($v in @($Document.Vulnerability)) {
|        foreach ($r in @($v.Remediations)) {
|            if ($null -eq $r) { continue }
|            # Type 2 = Vendor Fix (a KB); a mitigation / workaround names none
|            if ($null -ne $r.Type -and [string]$r.Type -notin '2', 'Vendor Fix') { continue }
|            $kb = ''
|            if ($r.Description) { $kb = ConvertTo-SIKbKey ([string]$(if ($r.Description.Value) { $r.Description.Value } else { $r.Description })) }
|            if (-not $kb) { continue }
|            $d = $null
|            foreach ($n in 'Date', 'ReleaseDate') { if ($r.PSObject.Properties[$n] -and $r.$n) { $d = ConvertTo-SIMsrcDate $r.$n; if ($d) { break } } }
|            if ($null -eq $d) { $d = $docDate }
|            if ($null -eq $d) { continue }
|            if (-not $out.ContainsKey($kb) -or $d -lt $out[$kb]) { $out[$kb] = $d }
|        }
|    }
|    $out
|}
|
|function Merge-SIKbReleaseDates {
|    <# PURE. KB dates into the cache's map: the EARLIER date of a KB wins (its first release). #>
|    param([hashtable]$Into, [hashtable]$From)
|    foreach ($k in @($From.Keys)) { $d = $From[$k]; if ($null -eq $d) { continue }; if (-not $Into.ContainsKey($k) -or $d -lt $Into[$k]) { $Into[$k] = $d } }
|    $Into
|}
|
|function New-SIKbDateFileStore {
|    <# The Community cache: one JSON file { fetchedAt, documents: { id: currentReleaseDate }, kbs: { KB: 'yyyy-MM-dd' } }. -Path '' = memory only. #>
|    param([string]$Path)
|    $s = [pscustomobject]@{ Kind = 'file'; Path = $Path }
|    $s | Add-Member -MemberType ScriptMethod -Name Load -Value {
|        $c = @{ FetchedAt = $null; Documents = @{}; Kbs = @{} }
|        if (-not $this.Path -or -not (Test-Path -LiteralPath $this.Path)) { return $c }
|        try {
|            $j = Get-Content -Raw -LiteralPath $this.Path | ConvertFrom-Json
|            $c.FetchedAt = ConvertTo-SIMsrcDateTime $j.fetchedAt
|            if ($j.documents) { foreach ($p in $j.documents.PSObject.Properties) { $c.Documents[$p.Name] = ConvertTo-SIMsrcStamp $p.Value } }
|            if ($j.kbs) { foreach ($p in $j.kbs.PSObject.Properties) { $d = ConvertTo-SIMsrcDate $p.Value; if ($d) { $c.Kbs[$p.Name] = $d } } }
|        } catch { }
|        $c
|    }
|    $s | Add-Member -MemberType ScriptMethod -Name Save -Value {
|        param($c)
|        if (-not $this.Path) { return }
|        $kbs = [ordered]@{}; foreach ($k in @($c.Kbs.Keys | Sort-Object)) { $kbs[$k] = ([datetime]$c.Kbs[$k]).ToString('yyyy-MM-dd') }
|        $doc = [ordered]@{ fetchedAt = ([datetime]$c.FetchedAt).ToUniversalTime().ToString('o'); documents = $c.Documents; kbs = $kbs }
|        $dir = Split-Path -Parent $this.Path
|        if ($dir -and -not (Test-Path -LiteralPath $dir)) { $null = New-Item -ItemType Directory -Path $dir -Force }
|        [IO.File]::WriteAllText($this.Path, ($doc | ConvertTo-Json -Depth 4 -Compress), (New-Object Text.UTF8Encoding($false)))
|    }
|    $s
|}
|
|function ConvertTo-SIMsrcDateTime {
|    <# PURE. A date-time (ISO text or a datetime) as UTC, or $null. #>
|    param($Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [datetime]) { return ([datetime]$Value).ToUniversalTime() }
|    $o = [datetime]::MinValue
|    if ([datetime]::TryParse(([string]$Value), [System.Globalization.CultureInfo]::InvariantCulture, ([System.Globalization.DateTimeStyles]::AdjustToUniversal -bor [System.Globalization.DateTimeStyles]::AssumeUniversal), [ref]$o)) { return [datetime]::SpecifyKind($o, [System.DateTimeKind]::Utc) }
|    $null
|}
|
|function Get-SIKbDateSqlReadSql {
|    <# Pro: the cached dates (sidata.KbReleaseDate; the state row Kb = '$state' carries the fetch time and the documents read). #>
|    "IF OBJECT_ID('sidata.KbReleaseDate') IS NULL BEGIN SELECT CAST(NULL AS NVARCHAR(16)) AS Kb, CAST(NULL AS DATE) AS ReleaseDate, CAST(NULL AS NVARCHAR(MAX)) AS Detail, CAST(NULL AS DATETIME2(0)) AS UpdatedAt WHERE 1 = 0; RETURN; END
|SELECT Kb, ReleaseDate, Detail, UpdatedAt FROM sidata.KbReleaseDate;"
|}
|
|function Get-SIKbDateSqlWriteSql {
|    <# Pro: the whole cache in ONE statement (@j = [{Kb, ReleaseDate, Detail}]); a KB keeps its earliest date. #>
|    @'
|IF OBJECT_ID('sidata.KbReleaseDate') IS NULL BEGIN SELECT 0; RETURN; END
|SET XACT_ABORT ON;
|BEGIN TRAN;
|MERGE sidata.KbReleaseDate AS t
|USING (SELECT Kb, TRY_CONVERT(date, ReleaseDate) AS ReleaseDate, Detail FROM OPENJSON(@j) WITH (Kb nvarchar(16), ReleaseDate nvarchar(10), Detail nvarchar(max) '$.Detail')) AS s
|ON t.Kb = s.Kb
|WHEN MATCHED THEN UPDATE SET ReleaseDate = CASE WHEN s.Kb = N'$state' OR t.ReleaseDate IS NULL OR s.ReleaseDate < t.ReleaseDate THEN s.ReleaseDate ELSE t.ReleaseDate END,
|                             Detail = s.Detail, UpdatedAt = SYSUTCDATETIME()
|WHEN NOT MATCHED THEN INSERT (Kb, ReleaseDate, Detail, UpdatedAt) VALUES (s.Kb, s.ReleaseDate, s.Detail, SYSUTCDATETIME());
|COMMIT;
|SELECT @@ROWCOUNT;
|'@
|}
|
|function New-SIKbDateSqlStore {
|    <# The Pro cache in sidata.KbReleaseDate, through the run's SQL invoke (& $Invoke $sql $params 'reader' | 'scalar'). #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke)
|    $s = [pscustomobject]@{ Kind = 'sql'; Invoke = $Invoke }
|    $s | Add-Member -MemberType ScriptMethod -Name Load -Value {
|        $c = @{ FetchedAt = $null; Documents = @{}; Kbs = @{} }
|        foreach ($r in @(& $this.Invoke (Get-SIKbDateSqlReadSql) @{} 'reader')) {
|            if ($null -eq $r) { continue }
|            $kb = [string]$r.Kb
|            if ($kb -eq '$state') {
|                $c.FetchedAt = ConvertTo-SIMsrcDateTime ([string]$r.UpdatedAt)
|                try { $j = ([string]$r.Detail) | ConvertFrom-Json; foreach ($p in $j.PSObject.Properties) { $c.Documents[$p.Name] = ConvertTo-SIMsrcStamp $p.Value } } catch { }
|                continue
|            }
|            $d = ConvertTo-SIMsrcDate $r.ReleaseDate; if ($kb -and $d) { $c.Kbs[$kb] = $d }
|        }
|        $c
|    }
|    $s | Add-Member -MemberType ScriptMethod -Name Save -Value {
|        param($c)
|        $rows = [System.Collections.Generic.List[object]]::new()
|        foreach ($k in @($c.Kbs.Keys)) { $rows.Add([ordered]@{ Kb = [string]$k; ReleaseDate = ([datetime]$c.Kbs[$k]).ToString('yyyy-MM-dd'); Detail = $null }) }
|        $rows.Add([ordered]@{ Kb = '$state'; ReleaseDate = ([datetime]$c.FetchedAt).ToString('yyyy-MM-dd'); Detail = ($c.Documents | ConvertTo-Json -Compress -Depth 3) })
|        $null = & $this.Invoke (Get-SIKbDateSqlWriteSql) @{ j = (ConvertTo-Json -InputObject $rows.ToArray() -Compress -Depth 3) } 'scalar'
|    }
|    $s
|}
|
|function Invoke-SIMsrcGet {
|    <# One GET of the public MSRC API as JSON (REST only; 30 s; no sign-in). #>
|    param([Parameter(Mandatory)][string]$Url)
|    Invoke-RestMethod -Method Get -Uri $Url -Headers @{ Accept = 'application/json' } -TimeoutSec 30 -ErrorAction Stop
|}
|
|function Initialize-SIKbReleaseDates {
|    <#
|    .SYNOPSIS  Once per run: the KB release dates into memory (Get-SIKbReleaseDate reads them), from the install's cache and,
|               when the cache is older than a day, the MSRC API (only the documents that are new or revised). Never throws:
|               a refused / failed call is said in ONE line and the cache (and the name rule) is used. Returns the number of KBs.
|               -Fetch: the GET (tests pass a fake); -Now: the clock (tests).
|    #>
|    param($Store, [scriptblock]$Fetch, $Now, [scriptblock]$Log)
|    if ($null -eq $Log) { $Log = { param($l, $m) } }
|    if ($null -eq $Fetch) { $Fetch = { param($u) Invoke-SIMsrcGet -Url $u } }
|    $at = $(if ($null -ne $Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow })
|    $cache = @{ FetchedAt = $null; Documents = @{}; Kbs = @{} }
|    if ($null -ne $Store) { try { $cache = $Store.Load() } catch { & $Log 'INFO' ('the cached Microsoft update release dates could not be read ({0}) -- they are read again' -f $_.Exception.Message) } }
|    $script:SIKbReleaseDates = $cache.Kbs
|    if (-not (Test-SIMsrcDatesOn)) {
|        & $Log 'INFO' 'patch cycle: the Microsoft update release dates are not read (SI_PatchCycle_MsrcDates is off) -- the update names'' Patch Tuesday is used'
|        return $cache.Kbs.Count
|    }
|    if ($null -ne $cache.FetchedAt -and ($at - [datetime]$cache.FetchedAt).TotalHours -lt 24 -and $cache.Kbs.Count -gt 0) { return $cache.Kbs.Count }
|    try {
|        $docs = ConvertFrom-SIMsrcUpdateList (& $Fetch ($script:SIMsrcBase + '/updates'))
|        $from = $at.AddMonths(-(Get-SIMsrcMonths))
|        $read = 0; $notRead = 0
|        foreach ($d in $docs) {
|            if ($null -ne $d.Release -and $d.Release -lt $from) { continue }
|            if ($cache.Documents.ContainsKey($d.Id) -and [string]$cache.Documents[$d.Id] -eq [string]$d.Current) { continue }
|            # ONE DOCUMENT FAILS ALONE: a document that cannot be read (a bad address, a time-out) is said once (its address
|            # in the verbose log) and NOT marked read, so it is asked again next run; every other document is kept and saved
|            try {
|                $kbs = ConvertFrom-SIMsrcDocument -Document (& $Fetch $d.Url) -Release $d.Release
|            } catch {
|                $notRead++
|                Write-Verbose ('patch cycle: the release document {0} ({1}) could not be read -- {2}' -f $d.Id, $d.Url, $_.Exception.Message)
|                continue
|            }
|            $null = Merge-SIKbReleaseDates -Into $cache.Kbs -From $kbs
|            $cache.Documents[$d.Id] = [string]$d.Current
|            $read++
|        }
|        if ($notRead -gt 0) { & $Log 'INFO' ('patch cycle: {0} of the Security Update Guide''s release documents could not be read this run -- the others are kept, and those are read again next run' -f $notRead) }
|        # a document not read makes the cache a day old, so the next run asks for it (and only it) again
|        $cache.FetchedAt = $(if ($notRead -gt 0) { $at.AddHours(-24) } else { $at })
|        if ($null -ne $Store) { try { $Store.Save($cache) } catch { & $Log 'INFO' ('the Microsoft update release dates could not be kept ({0}) -- they are read again next run' -f $_.Exception.Message) } }
|        $script:SIKbReleaseDates = $cache.Kbs
|        if ($read -gt 0) { & $Log 'INFO' ('patch cycle: the release dates of {0} Microsoft update(s) known ({1} release document(s) read from the Security Update Guide)' -f $cache.Kbs.Count, $read) }
|    } catch {
|        & $Log 'INFO' ('patch cycle: the Microsoft update release dates could not be read from api.msrc.microsoft.com ({0}) -- {1} cached date(s) and, for the rest, the update names'' Patch Tuesday are used' -f $_.Exception.Message, $cache.Kbs.Count)
|    }
|    $cache.Kbs.Count
|}
|
|function Get-SIKbReleaseDate {
|    <# PURE over the loaded dates. The newest release date of the KBs given (a fix that needs several is released when the last is), or $null. #>
|    param([string[]]$Kbs, [hashtable]$Dates = $script:SIKbReleaseDates)
|    if ($null -eq $Dates -or $Dates.Count -eq 0) { return $null }
|    $best = $null
|    foreach ($k in $Kbs) { if ($k -and $Dates.ContainsKey($k)) { $d = $Dates[$k]; if ($null -eq $best -or $d -gt $best) { $best = $d } } }
|    $best
|}
'@ }
$__siSupportFiles['engine/data-model/SI-FindingTexts.ps1'] = @{ Sha256 = 'd966ca27bd000b653b47a7477dbf4f70fcf4c7c39d49209b1b8370c3283f2eca'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE GENERIC SI FINDING FIELDS OF SI'S OWN REPORTS, AS DATA (REQUIREMENTS #560).
|
|    TEMPLATE  data-model/finding-texts.locked.json (kind 'finding-text', items 'reports', key = the report name):
|                reports[]   { id (ReportName), securityDomain, source report | provider,
|                              si_description / si_remediation / si_remediation_type / si_reference_url /
|                              si_compliance_tags / si_mitre_tactics / si_mitre_techniques ... (any SI finding field) }
|                rowColumns  SI finding field -> the Risk Analysis row columns that fill it (first non-empty)
|                inference   mitre / compliance: keyword rows (first match) + the security domain's default -- what a row
|                            gets when neither its source nor its report says (the rows the engine held in code before)
|    CUSTOMER  Pro: one cfg.ItemOverride per report ('finding-texts:<report>'); Community: finding-texts.custom.json.
|
|    WHO FILLS WHAT (one rule, every finding):
|      1. the row's own columns (the source's text: Defender's description, remediation, KB tags / MITRE ...) -- rowColumns
|      2. the report's item (SI's own text: what the finding is, how to fix it, its compliance and MITRE references)
|      3. MITRE / compliance only: the inference rows over SecurityDomain + Subcategory + ConfigurationName, then the
|         security domain's default
|      4. nothing says: the field is absent -- unknown, never guessed.
|
|    PURE except Get-SIFindingTextCatalog (reads the template). PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Get-SIItemValue -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|
|$script:SIFindingTextCache = $null
|
|function Test-SIFindingTextItem {
|    <# PURE. The reasons one report item is not accepted (empty = accepted). -FindingFields: the catalog's finding field names (optional). #>
|    param($Item, [string[]]$FindingFields)
|    $why = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Item) { $why.Add('a finding-text item is empty'); return $why.ToArray() }
|    $id = [string](Get-SIItemValue $Item 'id')
|    if ($id -notmatch '^[A-Za-z0-9][A-Za-z0-9_\-\.]{0,199}$') { $why.Add(("finding-texts: '{0}' is not a report name" -f $id)) }
|    $src = [string](Get-SIItemValue $Item 'source')
|    if ($src -and $src -notin 'report', 'provider') { $why.Add(("finding-texts/{0}: source '{1}' (report | provider)" -f $id, $src)) }
|    $rt = [string](Get-SIItemValue $Item 'si_remediation_type')
|    if ($rt -and $rt -notin 'patch', 'configuration', 'upgrade', 'policy', 'manual') { $why.Add(("finding-texts/{0}: si_remediation_type '{1}' (patch | configuration | upgrade | policy | manual)" -f $id, $rt)) }
|    $props = @(); if ($Item -is [System.Collections.IDictionary]) { $props = @($Item.Keys) } else { $props = @($Item.PSObject.Properties.Name) }
|    foreach ($p in $props) {
|        if ($p -in 'id', 'securityDomain', 'source', 'note', 'remove', 'baseHash') { continue }
|        if ($p -cnotmatch '^si_[a-z0-9_]+$') { $why.Add(("finding-texts/{0}: '{1}' is not an SI field" -f $id, $p)); continue }
|        if ($FindingFields -and $FindingFields -notcontains $p) { $why.Add(("finding-texts/{0}: '{1}' is not a finding field of the catalog" -f $id, $p)) }
|    }
|    foreach ($p in 'si_mitre_tactics') { foreach ($v in (Get-SIValueList (Get-SIItemValue $Item $p))) { if ($v -and [string]$v -notmatch '^TA\d{4}$') { $why.Add(("finding-texts/{0}: tactic '{1}' is not TA####" -f $id, $v)) } } }
|    foreach ($p in 'si_mitre_techniques') { foreach ($v in (Get-SIValueList (Get-SIItemValue $Item $p))) { if ($v -and [string]$v -notmatch '^T\d{4}(\.\d{3})?$') { $why.Add(("finding-texts/{0}: technique '{1}' is not T####" -f $id, $v)) } } }
|    $why.ToArray()
|}
|
|function Test-SIFindingTexts {
|    <# PURE. The whole template: every report item valid and once, every inference row's pattern compiles, every rowColumns field an SI field. #>
|    param($Document, [string[]]$FindingFields)
|    $p = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Document) { return $p.ToArray() }
|    $ids = @{}
|    foreach ($r in @(Get-SIItemValue $Document 'reports')) {
|        if ($null -eq $r) { continue }
|        foreach ($x in (Test-SIFindingTextItem -Item $r -FindingFields $FindingFields)) { $p.Add([string]$x) }
|        $id = [string](Get-SIItemValue $r 'id'); if ($ids.ContainsKey($id)) { $p.Add(("finding-texts: report '{0}' is listed twice" -f $id)) }; $ids[$id] = 1
|    }
|    $inf = Get-SIItemValue $Document 'inference'
|    foreach ($k in 'mitre', 'compliance') {
|        foreach ($r in @(Get-SIItemValue $inf $k)) {
|            if ($null -eq $r) { continue }
|            try { [void][regex]::new([string](Get-SIItemValue $r 'match')) } catch { $p.Add(("finding-texts: inference {0}/{1} has an invalid pattern" -f $k, [string](Get-SIItemValue $r 'id'))) }
|        }
|    }
|    $rc = Get-SIItemValue $Document 'rowColumns'
|    if ($null -ne $rc) { foreach ($pp in $rc.PSObject.Properties) { if ($pp.Name -cnotmatch '^si_[a-z0-9_]+$' -or ($FindingFields -and $FindingFields -notcontains $pp.Name)) { $p.Add(("finding-texts: rowColumns '{0}' is not a finding field" -f $pp.Name)) } } }
|    $p.ToArray()
|}
|
|function ConvertTo-SIFindingTextCatalog {
|    <# PURE. The merged template -> @{ Reports (name -> item, case-insensitive); RowColumns; Mitre; MitreDomains; Compliance; ComplianceDomains }. #>
|    param($Document)
|    $rep = New-Object System.Collections.Hashtable ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($r in @(Get-SIItemValue $Document 'reports')) { if ($null -ne $r -and @(Test-SIFindingTextItem -Item $r).Count -eq 0) { $rep[[string]$r.id] = $r } }
|    $inf = Get-SIItemValue $Document 'inference'
|    @{ Reports = $rep; RowColumns = (Get-SIItemValue $Document 'rowColumns')
|       Mitre = @(Get-SIItemValue $inf 'mitre'); MitreDomains = (Get-SIItemValue $inf 'mitreDomains')
|       Compliance = @(Get-SIItemValue $inf 'compliance'); ComplianceDomains = (Get-SIItemValue $inf 'complianceDomains') }
|}
|
|function Get-SIFindingTextCatalog {
|    <# The merged template, read once per process; $null when it cannot be read (nothing is filled -- never fails). #>
|    param([string]$Root, [string]$OverlayRoot = $global:SI_DataModelOverlayRoot, [switch]$Refresh)
|    if ($script:SIFindingTextCache -and -not $Refresh -and -not $Root) { return $script:SIFindingTextCache }
|    try {
|        if (-not (Get-Command -Name Get-SIDataModelTemplate -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-DataModelTemplates.ps1') }
|        $r = Get-SIDataModelRoot $Root
|        if (-not (Test-Path -LiteralPath (Join-Path $r 'finding-texts.locked.json'))) {
|            $r = Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'data-model'
|            if (-not (Test-Path -LiteralPath (Join-Path $r 'finding-texts.locked.json'))) { return $null }
|        }
|        $doc = (Get-SIDataModelTemplate -Name 'finding-texts' -Root $r -OverlayRoot $OverlayRoot).Document
|        foreach ($p in (Test-SIFindingTexts -Document $doc)) { Write-Warning ('finding texts: {0}' -f $p) }
|        $cat = ConvertTo-SIFindingTextCatalog -Document $doc
|        if (-not $Root) { $script:SIFindingTextCache = $cat }
|        return $cat
|    } catch {
|        Write-Warning ('finding texts could not be read -- {0}. The generic finding fields keep what the rows say.' -f $_.Exception.Message)
|        return $null
|    }
|}
|
|function Resolve-SIFindingTextInference {
|    <#
|    .SYNOPSIS  PURE. MITRE or compliance references for a row nothing else describes: the first inference row whose pattern
|               matches -Blob (case-insensitive), else the security domain's default, else nothing.
|    .OUTPUTS   @{ Tactics; Techniques } (mitre) or @{ Tags } (compliance), each a ';'-joined string ('' = none)
|    #>
|    param([Parameter(Mandatory)]$Catalog, [ValidateSet('mitre', 'compliance')][string]$Kind, [AllowEmptyString()][string]$Blob = '', [AllowEmptyString()][string]$Domain = '')
|    $rows = $Catalog.Mitre; $doms = $Catalog.MitreDomains
|    if ($Kind -eq 'compliance') { $rows = $Catalog.Compliance; $doms = $Catalog.ComplianceDomains }
|    $hit = $null
|    foreach ($r in @($rows)) {
|        if ($null -eq $r) { continue }
|        $pat = [string](Get-SIItemValue $r 'match'); if (-not $pat) { continue }
|        $ok = $false; try { $ok = [regex]::IsMatch($Blob, $pat, [System.Text.RegularExpressions.RegexOptions]::IgnoreCase, [TimeSpan]::FromMilliseconds(200)) } catch { $ok = $false }
|        if ($ok) { $hit = $r; break }
|    }
|    if ($null -eq $hit -and $Domain -and $null -ne $doms) { $hit = Get-SIItemValue $doms $Domain }
|    $j = { param($o, $n) (((Get-SIValueList (Get-SIItemValue $o $n)).ToArray() | Where-Object { $_ }) -join ';') }
|    if ($Kind -eq 'mitre') { return @{ Tactics = $(if ($hit) { & $j $hit 'si_mitre_tactics' } else { '' }); Techniques = $(if ($hit) { & $j $hit 'si_mitre_techniques' } else { '' }) } }
|    @{ Tags = $(if ($hit) { & $j $hit 'si_compliance_tags' } else { '' }) }
|}
|
|function Get-SIFindingTextReport {
|    <# PURE. The report's item of the catalog, or $null. #>
|    param($Catalog, [AllowEmptyString()][string]$ReportName)
|    if ($null -eq $Catalog -or -not $ReportName) { return $null }
|    if ($Catalog.Reports.ContainsKey($ReportName)) { return $Catalog.Reports[$ReportName] }
|    $null
|}
|
|function ConvertTo-SIFindingTextFields {
|    <#
|    .SYNOPSIS  PURE. The generic SI finding fields of one Risk Analysis row: the row's own columns (rowColumns, first
|               non-empty), then the report's item for what the row left empty. Lists (compliance, MITRE, affected
|               software, fix references) become lists; a field nothing fills is absent.
|    .OUTPUTS   ordered hashtable si_* -> value
|    #>
|    param([Parameter(Mandatory)]$Row, $Catalog, [AllowEmptyString()][string]$ReportName = '')
|    $out = [ordered]@{}
|    if ($null -eq $Catalog) { return $out }
|    $lists = @('si_compliance_tags', 'si_mitre_tactics', 'si_mitre_techniques', 'si_affected_product', 'si_affected_vendor', 'si_affected_version', 'si_fix_reference')
|    $norm = {
|        param([string]$f, $v)
|        if ($null -eq $v) { return $null }
|        if ($lists -contains $f) {
|            $xs = @(foreach ($x in (Get-SIValueList $v)) { foreach ($y in ([string]$x).Split(';')) { $t = $y.Trim(); if ($t) { $t } } })
|            if ($xs.Count -eq 0) { return $null }
|            return , ([string[]]@($xs | Select-Object -Unique))
|        }
|        $s = ([string]$v).Trim(); if (-not $s) { return $null }
|        $s
|    }
|    $rc = $Catalog.RowColumns
|    if ($null -ne $rc) {
|        foreach ($pp in $rc.PSObject.Properties) {
|            # Get-SIValueList returns its list whole: @() around it would make the column list ONE item ("A B C")
|            foreach ($col in (Get-SIValueList $pp.Value)) {
|                $v = & $norm $pp.Name (Get-SIItemValue $Row ([string]$col))
|                if ($null -ne $v) { $out[$pp.Name] = $v; break }
|            }
|        }
|    }
|    $rep = Get-SIFindingTextReport -Catalog $Catalog -ReportName $ReportName
|    if ($null -ne $rep) {
|        foreach ($pp in $rep.PSObject.Properties) {
|            if ($pp.Name -cnotmatch '^si_[a-z0-9_]+$' -or $out.Contains($pp.Name)) { continue }
|            $v = & $norm $pp.Name $pp.Value
|            if ($null -ne $v) { $out[$pp.Name] = $v }
|        }
|    }
|    $out
|}
'@ }
$__siSupportFiles['engine/data-model/SI-AzureChildren.ps1'] = @{ Sha256 = '67f850d5cbed4c161da98720f747b985bba2f39d544711c7495997d3fca19abc'; Text = @'
|#Requires -Version 5.1
|<#
|    AZURE CHILD RESOURCES ROLL UP INTO THEIR PARENT, AND ONLY THE LISTED TYPES BECOME CIs (owner 2026-10-11: "extensions
|    suddenly show as risk from azure ... we had defined some classes that we excluded. chk v2.2 code").
|
|    The list is data-model/collection-scope azureResourceTypes (customer-extendable like every data-model list:
|    collection-scope.custom.json, or the Pro data-model settings 'collection-scope:<type>'):
|      * a listed type WITHOUT rollUpInto is a CI type: its resources are recorded and become CIs
|      * a listed type WITH rollUpInto is a CHILD (v2.2 asset-profiling-schema SCHEMA subResourceRollupRules): never a record
|        of its own -- it becomes a PART of its parent's record ('child|<child id>'), listed on the parent CI in
|        rollUpInto.field (si_vm_extensions, si_disks, ...) and si_child_resources, and its id is a linked object of the parent
|        CI (sidata.CiLink, SI_CI_CL si_linked_objects) -- so a finding on the child's id lands on the parent CI
|          rollUpInto.parentBy     'path' (the ARM id one level up) or dot paths into the ARM object (managedBy,
|                                  properties.virtualMachine.id, properties.ipConfiguration.id), tried in order; the id
|                                  found is walked up until its type is one of parentTypes
|          rollUpInto.keepOwnCi    the type stays a CI of its own and is ALSO listed on its parent (a public IP)
|          rollUpInto.shape        what the parent lists of each child: { <name>: <dot path into the ARM object> }
|      * a nested type that is NOT listed (microsoft.web/sites/slots) is a child of its path parent when that parent is
|        listed; any other type is NOT recorded
|    A CI that a type no longer recorded had (a VM extension, a data collection rule) is never deleted: its records age, it is
|    not seen, and the CI build retires it once nothing has recorded it within the lookback.
|
|    PURE except the cached scope loader (Get-SIAzureCiScope). PowerShell 5.1 safe: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Get-SIItemValue -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|
|$script:SIAzureTypePattern = '(microsoft\.[a-z0-9]+/[a-z0-9/]+)'
|
|function ConvertTo-SIArmTypeName {
|    <# PURE. A resource type or an Exposure Graph node label ('microsoft.web/sites_webapp') -> the lower-case ARM type; ''. #>
|    param([AllowNull()][AllowEmptyString()][string]$Type)
|    if ([string]::IsNullOrWhiteSpace($Type)) { return '' }
|    $m = [regex]::Match($Type.Trim().ToLowerInvariant(), $script:SIAzureTypePattern)
|    if ($m.Success) { return $m.Groups[1].Value.TrimEnd('/') }
|    return ''
|}
|
|function Get-SIArmIdInfo {
|    <#
|        PURE. An ARM resource id -> @{ Id; Type; Name; Parent } (lower case), or $null when it is not a resource id.
|        Type is read after the LAST '/providers/' (an extension resource is typed by its own provider); Parent is the id one
|        level up in the same provider ('' for a top-level resource).
|          .../providers/Microsoft.Compute/virtualMachines/vm1/extensions/MDE.Windows
|            -> Type microsoft.compute/virtualmachines/extensions, Name mde.windows, Parent .../virtualmachines/vm1
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Id)
|    $s = ([string]$Id).Trim().TrimEnd('/').ToLowerInvariant()
|    if (-not $s.StartsWith('/subscriptions/')) { return $null }
|    $i = $s.LastIndexOf('/providers/')
|    if ($i -lt 0) { return $null }
|    $head = $s.Substring(0, $i)
|    $segs = $s.Substring($i + 11).Split('/')
|    if ($segs.Count -lt 3 -or (($segs.Count - 1) % 2) -ne 0) { return $null }
|    foreach ($x in $segs) { if (-not $x) { return $null } }
|    $types = New-Object System.Collections.Generic.List[string]
|    for ($k = 1; $k -lt $segs.Count; $k += 2) { $types.Add($segs[$k]) }
|    $parent = ''
|    if ($segs.Count -gt 3) { $parent = $head + '/providers/' + ($segs[0..($segs.Count - 3)] -join '/') }
|    return @{ Id = $s; Type = ($segs[0] + '/' + ($types.ToArray() -join '/')); Name = $segs[$segs.Count - 1]; Parent = $parent }
|}
|
|function Get-SIAzureObjectValues {
|    <# PURE. Every value at a dot path in an object ('a.b[*].c' walks the array b; JSON text met on the way is parsed). #>
|    param($Object, [string]$Path)
|    $cur = New-Object System.Collections.Generic.List[object]
|    if ($null -eq $Object -or -not $Path) { return , $cur }
|    $cur.Add($Object)
|    foreach ($segRaw in $Path.Split('.')) {
|        $walk = $segRaw.EndsWith('[*]'); $seg = $segRaw; if ($walk) { $seg = $segRaw.Substring(0, $segRaw.Length - 3) }
|        $next = New-Object System.Collections.Generic.List[object]
|        foreach ($o in $cur) {
|            $node = $o
|            if ($node -is [string]) { $t = $node.Trim(); if ($t.StartsWith('{') -or $t.StartsWith('[')) { try { $node = $t | ConvertFrom-Json } catch { continue } } else { continue } }
|            $v = $null
|            if ($node -is [System.Collections.IDictionary]) { foreach ($k in $node.Keys) { if ([string]::Equals([string]$k, $seg, [StringComparison]::OrdinalIgnoreCase)) { $v = $node[$k]; break } } }
|            elseif ($null -ne $node) { $pp = $node.PSObject.Properties[$seg]; if ($pp) { $v = $pp.Value } }
|            if ($null -eq $v) { continue }
|            if ($v -is [string] -and $walk) { $t = $v.Trim(); if ($t.StartsWith('[')) { try { $v = $t | ConvertFrom-Json } catch { } } }
|            if ($walk -and $v -is [System.Collections.IEnumerable] -and -not ($v -is [string]) -and -not ($v -is [System.Collections.IDictionary])) { foreach ($x in $v) { if ($null -ne $x) { $next.Add($x) } } }
|            else { $next.Add($v) }
|        }
|        $cur = $next
|    }
|    return , $cur
|}
|
|function ConvertTo-SIAzureCiScope {
|    <#
|        PURE. The collection-scope document -> @{ Top (the CI types); Rules (child type -> @{ Type; ParentTypes; ParentBy;
|        Field; Shape; KeepOwnCi }) }. A keepOwnCi type is in Top AND has a rule.
|    #>
|    param($Document)
|    $top = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $rules = @{}
|    foreach ($it in @(Get-SIItemValue $Document 'azureResourceTypes')) {
|        if ($null -eq $it) { continue }
|        $t = ConvertTo-SIArmTypeName ([string](Get-SIItemValue $it 'type'))
|        if (-not $t) { continue }
|        $r = Get-SIItemValue $it 'rollUpInto'
|        if ($null -eq $r) { [void]$top.Add($t); continue }
|        $keep = (ConvertTo-SIBoolOrNull (Get-SIItemValue $r 'keepOwnCi')) -eq $true
|        $by = @(@(Get-SIItemValue $r 'parentBy') | Where-Object { $_ } | ForEach-Object { [string]$_ })
|        if ($by.Count -eq 0) { $by = @('path') }
|        $shape = [ordered]@{}
|        $sh = Get-SIItemValue $r 'shape'
|        if ($null -ne $sh) {
|            if ($sh -is [System.Collections.IDictionary]) { foreach ($k in $sh.Keys) { $shape[[string]$k] = [string]$sh[$k] } }
|            else { foreach ($pp in $sh.PSObject.Properties) { if (-not $pp.Name.StartsWith('$')) { $shape[$pp.Name] = [string]$pp.Value } } }
|        }
|        $rules[$t] = @{
|            Type = $t; KeepOwnCi = $keep; ParentBy = $by; Field = [string](Get-SIItemValue $r 'field'); Shape = $shape
|            ParentTypes = @(@(Get-SIItemValue $r 'parentTypes') | ForEach-Object { ConvertTo-SIArmTypeName ([string]$_) } | Where-Object { $_ })
|        }
|        if ($keep) { [void]$top.Add($t) }
|    }
|    return @{ Top = $top; Rules = $rules }
|}
|
|function Test-SIAzureCiScopeItems {
|    <# PURE. The problems of a collection-scope document's rollUpInto items (Test-SIDataModel): '<type>: <problem>'. #>
|    param($Document, [hashtable]$Fields = @{})
|    foreach ($it in @(Get-SIItemValue $Document 'azureResourceTypes')) {
|        if ($null -eq $it) { continue }
|        $t = [string](Get-SIItemValue $it 'type')
|        if (-not (ConvertTo-SIArmTypeName $t)) { "'$t' is not an Azure resource type (microsoft.<namespace>/<type>)"; continue }
|        $r = Get-SIItemValue $it 'rollUpInto'
|        if ($null -eq $r) { continue }
|        $pt = @(@(Get-SIItemValue $r 'parentTypes') | Where-Object { $_ })
|        if ($pt.Count -eq 0) { "'$t' rollUpInto names no parentTypes" }
|        foreach ($b in @(Get-SIItemValue $r 'parentBy')) { if ($b -and [string]$b -ne 'path' -and [string]$b -notmatch '^[A-Za-z][A-Za-z0-9_]*(\[\*\])?(\.[A-Za-z][A-Za-z0-9_]*(\[\*\])?)*$') { "'$t' rollUpInto parentBy '$b' is neither 'path' nor a dot path" } }
|        $f = [string](Get-SIItemValue $r 'field')
|        if ($f -and $Fields.Count -gt 0 -and -not $Fields.ContainsKey($f)) { "'$t' rollUpInto field '$f' is not in the field catalog" }
|    }
|}
|
|function Set-SIAzureCiScope {
|    <# The scope this process uses (tests; a caller that already holds the model). $null = load it again on the next use. #>
|    param($Scope)
|    $script:SIAzureCiScope = $Scope
|    $script:SIAzureCiScopeLoaded = ($null -ne $Scope)
|}
|
|function Get-SIAzureCiScope {
|    <#
|        The Azure CI scope of this install, read ONCE per process: the merged collection-scope template (shipped + the
|        customer's overrides). Cannot be read: said once, and every Azure type is recorded as before ($null) -- never fewer
|        records because a file could not be read.
|    #>
|    if ($script:SIAzureCiScopeLoaded) { return $script:SIAzureCiScope }
|    $script:SIAzureCiScopeLoaded = $true
|    $script:SIAzureCiScope = $null
|    try {
|        if (-not (Get-Command -Name Get-SIDataModelTemplate -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-DataModelTemplates.ps1') }
|        $t = Get-SIDataModelTemplate -Name 'collection-scope' -OverlayRoot $global:SI_DataModelOverlayRoot
|        $script:SIAzureCiScope = ConvertTo-SIAzureCiScope -Document $t.Document
|    } catch {
|        Write-Warning ('Azure resources: the list of Azure resource types that become CIs could not be read ({0}) -- every Azure resource is recorded this run.' -f $_.Exception.Message)
|    }
|    return $script:SIAzureCiScope
|}
|
|function Resolve-SIAzureParentAncestor {
|    <# PURE. An ARM id walked up its path until its type is one of -ParentTypes -> that id (lower), else ''. #>
|    param([AllowNull()][AllowEmptyString()][string]$Id, [string[]]$ParentTypes = @())
|    $info = Get-SIArmIdInfo $Id
|    for ($i = 0; $i -lt 8 -and $null -ne $info; $i++) {
|        if ($ParentTypes.Count -eq 0 -or $ParentTypes -contains $info.Type) { return $info.Id }
|        if (-not $info.Parent) { break }
|        $info = Get-SIArmIdInfo $info.Parent
|    }
|    return ''
|}
|
|function Get-SIAzureChildParentId {
|    <# PURE. The parent of a child resource by its rule (parentBy in order), else the capture's known parent of it, else ''. #>
|    # -KnownParents: a hashtable or the producer's on-disk child map (SecurityInsight.DiskTextLookup, #727) -- both answer
|    # ContainsKey and [key]
|    param($Info, $Object, [Parameter(Mandatory)]$Rule, $KnownParents)
|    foreach ($by in @($Rule.ParentBy)) {
|        $cand = ''
|        if ([string]$by -eq 'path') { if ($Info) { $cand = [string]$Info.Parent } }
|        else { foreach ($v in (Get-SIAzureObjectValues -Object $Object -Path ([string]$by))) { if ($v -is [string] -and $v.Trim()) { $cand = $v.Trim(); break } } }
|        if (-not $cand) { continue }
|        $p = Resolve-SIAzureParentAncestor -Id $cand -ParentTypes @($Rule.ParentTypes)
|        if ($p) { return $p }
|    }
|    if ($KnownParents -and $Info -and $KnownParents.ContainsKey([string]$Info.Id)) { return [string]$KnownParents[[string]$Info.Id] }
|    return ''
|}
|
|function Resolve-SIAzurePlacement {
|    <#
|    .SYNOPSIS  PURE. Where an Azure object goes in the data model.
|    .OUTPUTS   @{ Action = record | child | drop; Id; Type; ParentId (child); Rule (child / keepOwnCi); AlsoChildOf (a keepOwnCi
|               type: the parent it is also listed on, '' when none); Reason (drop) }
|               No scope ($null): every object is a record, as before.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Id, [AllowNull()][AllowEmptyString()][string]$Type = '', $Object, $Scope, $KnownParents)
|    $info = Get-SIArmIdInfo $Id
|    $t = ConvertTo-SIArmTypeName $Type
|    if (-not $t -and $info) { $t = $info.Type }
|    $res = @{ Action = 'record'; Id = ([string]$Id).Trim().ToLowerInvariant(); Type = $t; ParentId = ''; Rule = $null; AlsoChildOf = ''; Reason = '' }
|    if ($null -eq $Scope -or -not $t) { return $res }
|    $rule = $Scope.Rules[$t]
|    if ($null -ne $rule) {
|        $p = Get-SIAzureChildParentId -Info $info -Object $Object -Rule $rule -KnownParents $KnownParents
|        $res.Rule = $rule
|        if ($rule.KeepOwnCi) { $res.AlsoChildOf = $p; return $res }
|        if (-not $p) { $res.Action = 'drop'; $res.Reason = 'a child resource whose parent is not known'; return $res }
|        $res.Action = 'child'; $res.ParentId = $p
|        return $res
|    }
|    if ($Scope.Top.Contains($t)) { return $res }
|    if ($info -and $info.Parent) {
|        $pi = Get-SIArmIdInfo $info.Parent
|        if ($pi -and ($Scope.Top.Contains($pi.Type) -or $Scope.Rules.ContainsKey($pi.Type))) { $res.Action = 'child'; $res.ParentId = $pi.Id; return $res }
|    }
|    $res.Action = 'drop'; $res.Reason = 'not a CI type (collection-scope azureResourceTypes)'
|    return $res
|}
|
|function New-SIAzureChildSummary {
|    <#
|        PURE. What the parent keeps of one child: { id; type; name; field (the parent's list it belongs to, '' = only
|        si_child_resources); shape (the rule's shape values read from the ARM object) }.
|    #>
|    param([Parameter(Mandatory)][string]$Id, [string]$Type = '', $Object, $Rule)
|    $info = Get-SIArmIdInfo $Id
|    $t = ConvertTo-SIArmTypeName $Type; if (-not $t -and $info) { $t = $info.Type }
|    $name = ''
|    foreach ($v in (Get-SIAzureObjectValues -Object $Object -Path 'name')) { if ($v -is [string] -and $v.Trim()) { $name = $v.Trim(); break } }
|    if (-not $name -and $info) { $name = $info.Name }
|    $o = [ordered]@{ id = $Id.Trim().ToLowerInvariant(); type = $t; name = $name }
|    $field = ''; if ($null -ne $Rule -and $Rule.Field) { $field = [string]$Rule.Field }
|    $o['field'] = $field
|    $shape = [ordered]@{}
|    if ($null -ne $Rule -and $null -ne $Rule.Shape) {
|        foreach ($k in @($Rule.Shape.Keys)) {
|            $path = [string]$Rule.Shape[$k]
|            if ($k -eq 'name') { $shape['name'] = $name; continue }
|            # assigned first: the call hands back ONE list (', $list'), which a pipeline would pass on as one item
|            $raw = Get-SIAzureObjectValues -Object $Object -Path $path
|            $vals = @($raw | Where-Object { $null -ne $_ -and -not ($_ -is [string] -and -not $_.Trim()) })
|            if ($vals.Count -eq 1) { $shape[$k] = $vals[0] } elseif ($vals.Count -gt 1) { $shape[$k] = $vals }
|        }
|    }
|    if ($shape.Count -eq 0) { $shape['name'] = $name }
|    $o['shape'] = [pscustomobject]$shape
|    return [pscustomobject]$o
|}
|
|function Get-SIAzureEgArmId {
|    <# PURE. The Azure resource id an Exposure Graph node names (EntityIds: { type AzureResourceId; id }), lower case; ''. #>
|    param($Node)
|    $e = Get-SIItemValue $Node 'EntityIds'
|    if ($e -is [string]) { $s = $e.Trim(); if ($s.StartsWith('[') -or $s.StartsWith('{')) { try { $e = $s | ConvertFrom-Json } catch { $e = $null } } }
|    foreach ($x in @($e)) {
|        if ($null -eq $x) { continue }
|        if ([string](Get-SIItemValue $x 'type') -eq 'AzureResourceId') { $id = ([string](Get-SIItemValue $x 'id')).Trim(); if ($id) { return $id.ToLowerInvariant() } }
|    }
|    return ''
|}
|
|function Get-SIAzurePipVia {
|    <# PURE. What a public IP address's ARM object says it is attached through: properties.ipConfiguration.id, else a NAT
|       gateway (properties.natGateway.id) -- lower case; '' when it is not attached. Properties kept as JSON text are parsed. #>
|    param($Resource)
|    if ($null -eq $Resource) { return '' }
|    $props = Get-SIItemValue $Resource 'properties'
|    if ($props -is [string]) { try { $props = $props | ConvertFrom-Json } catch { $props = $null } }
|    $via = ([string](Get-SIItemValue (Get-SIItemValue $props 'ipConfiguration') 'id')).Trim().ToLowerInvariant()
|    if (-not $via) { $via = ([string](Get-SIItemValue (Get-SIItemValue $props 'natGateway') 'id')).Trim().ToLowerInvariant() }
|    return $via
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|#  The capture state: the children as parts of their parent's record
|# ---------------------------------------------------------------------------------------------------------------------
|$script:SIRecordOwnlessParts = @('parentTags', 'parentTagScopes', 'egQueryRules', 'si_scope', 'diag')
|
|function Test-SIRecordChildOnly {
|    <# PURE. A captured record that holds child parts and no provider object of its own (its parent was not captured here). #>
|    param($Record)
|    if ($null -eq $Record -or $null -eq $Record.Parts) { return $false }
|    $child = $false
|    foreach ($k in @($Record.Parts.Keys)) {
|        $s = [string]$k
|        if ($s.StartsWith('child|')) { $child = $true; continue }
|        if ($script:SIRecordOwnlessParts -contains $s) { continue }
|        return $false
|    }
|    return $child
|}
|
|function Get-SIRecordChildState {
|    <# The capture state's child bookkeeping (created on first use): ChildOf (child id -> parent id), Dropped (reason -> count). #>
|    param($State)
|    if ($null -eq $State) { return $null }
|    if (-not $State.PSObject.Properties['ChildOf']) { $State | Add-Member -NotePropertyName 'ChildOf' -NotePropertyValue (@{}) -Force }
|    if (-not $State.PSObject.Properties['Dropped']) { $State | Add-Member -NotePropertyName 'Dropped' -NotePropertyValue (@{}) -Force }
|    return $State
|}
|
|function Resolve-SIRecordChildren {
|    <#
|        PURE over the capture state. A record made only of child parts whose OWN id is a child of another captured record (a
|        public IP's link on a network interface, which is itself the virtual machine's child) hands its child parts to that
|        record and is removed. Run before the records are published or handed over. Returns how many records were folded.
|    #>
|    param($State = $global:SIRecordCaptureState)
|    if ($null -eq $State -or $null -eq $State.Records) { return 0 }
|    $total = 0
|    for ($round = 0; $round -lt 4; $round++) {
|        $parentOf = @{}
|        foreach ($e in $State.Records.GetEnumerator()) {
|            foreach ($k in @($e.Value.Parts.Keys)) { $s = [string]$k; if ($s.StartsWith('child|')) { $parentOf[$s.Substring(6)] = [string]$e.Key } }
|        }
|        $moved = 0
|        foreach ($id in @($State.Records.Keys)) {
|            $rec = $State.Records[$id]
|            if ([string]$rec.Provider -ne 'azure' -or -not (Test-SIRecordChildOnly $rec)) { continue }
|            $target = [string]$parentOf[[string]$rec.Key]
|            if (-not $target -or $target -eq $id -or -not $State.Records.ContainsKey($target)) { continue }
|            $tr = $State.Records[$target]
|            foreach ($k in @($rec.Parts.Keys)) { $s = [string]$k; if ($s.StartsWith('child|') -and -not $tr.Parts.Contains($s)) { $tr.Parts[$s] = $rec.Parts[$k] } }
|            foreach ($en in @($rec.Engines)) { if ($en) { [void]$tr.Engines.Add([string]$en) } }
|            [void]$State.Records.Remove($id)
|            $moved++
|        }
|        $total += $moved
|        if ($moved -eq 0) { break }
|    }
|    return $total
|}
|
|function Get-SIRecordChildParentMap {
|    <# The child id -> parent id map of this process's capture (the Defender recommendations roll a disk / NIC up with it). #>
|    param($State = $global:SIRecordCaptureState)
|    $m = @{}
|    if ($null -eq $State -or -not $State.PSObject.Properties['ChildOf'] -or $null -eq $State.ChildOf) { return $m }    foreach ($k in @($State.ChildOf.Keys)) { $m[[string]$k] = [string]$State.ChildOf[$k] }
|    return $m
|}
'@ }
$__siSupportFiles['engine/data-model/SI-BreakGlass.ps1'] = @{ Sha256 = '74b4a39635a987c9c02a4658063d792f42abc036bb720ba3f326e640f276d826'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight BREAK GLASS -- a CLASSIFICATION, not a risk factor (REQUIREMENTS #559, owner 2026-10-10: "break glass
|    is not a factor: an SI classification (feeds tier and its own reports), detected from the platform (CA exclusions, the
|    emergency-access group) plus naming patterns SI and the customer set in a wizard").
|
|    An identity CI (users and guests) is break-glass when ANY of these holds:
|      provider    its provider already says so (si_is_break_glass true: the identity profiler's value on the Entra record)
|      naming      a pattern of the data-model list break_glass_patterns (type values: glob patterns, * and ?, over letters,
|                  digits, space and . _ @ -; never wildcards only -- Test-SIBreakGlassPattern) matches its sign-in name
|                  (si_upn), its display name (si_display_name)
|      group       ... or the name of one of its groups (si_group_memberships): a member of an emergency-access group
|      attribute   it carries the EXTENSION ATTRIBUTE and VALUE the customer defines (owner 2026-10-11: "extension attr tag
|                  value i define") -- the data-model list break_glass_attribute, entries "attribute=value"; NOTHING is
|                  shipped. The collector reads the attribute with the user and says which entry matched
|                  (si_break_glass_attribute)
|      ca_excluded_from_all
|                  it holds a PERMANENT TIER 0 role (si_privilege_tier_permanent = 0) and is excluded from ALL the enabled Conditional Access policies that would apply to it (owner: "or
|                  excluded all policies": si_ca_excluded_from_all true). Being excluded from ONE policy is NOT break-glass
|                  any more -- si_ca_excluded_policies still lists every policy that excludes the account, as context.
|    The customer overrides the lists (Community lists.custom.json; Pro the list's override -- the patterns in a wizard; the
|    web app holds a pattern to the same rule). The CI build calls Set-SICiBreakGlass BEFORE the enrichment rules
|    (SI-CiEnrich.ps1), so the tier rules and the break-glass reports read si_is_break_glass exactly as they read the old
|    factor's field. si_break_glass_reason says in plain words WHICH rule matched. Nothing here touches si_risk_factors or a
|    score.
|
|    #546 UNKNOWN IS NEVER A FINDING: a field the CI build could not decide (si_unknown_fields) is not read. A provider's
|    true is never cleared; a provider's false stays false unless a signal matches.
|
|    PURE. PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Get-SIItemValue -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|
|$script:SIBreakGlassListId = 'break_glass_patterns'
|$script:SIBreakGlassAttributeListId = 'break_glass_attribute'
|
|function Get-SIBreakGlassPatterns {
|    <# PURE. The valid glob patterns of the break_glass_patterns list in -Lists (a pattern of wildcards only, or with a
|       character outside the contract, is skipped -- the validation reports it). #>
|    param([hashtable]$Lists = @{})
|    $out = New-Object System.Collections.Generic.List[string]
|    if (-not $Lists -or -not $Lists.ContainsKey($script:SIBreakGlassListId)) { return , $out.ToArray() }
|    foreach ($v in (Get-SIValueList (Get-SIItemValue $Lists[$script:SIBreakGlassListId] 'values'))) {
|        $s = ([string]$v).Trim()
|        if ($s -cmatch '^[A-Za-z0-9 ._@*?-]{1,128}$' -and $s -notmatch '^[\s*?]+$') { $out.Add($s) }
|    }
|    return , $out.ToArray()
|}
|
|function ConvertTo-SIBreakGlassAttributeRule {
|    <#
|        PURE. One entry of the break_glass_attribute list -- "attribute=value" -- as @{ Attribute; Value; Kind; Text }, or
|        $null when it is not a valid entry.
|          attribute   extensionAttribute1 .. extensionAttribute15 (the user's on-premises extension attributes), or the
|                      name of a directory extension (extension_<application id without dashes>_<name>)
|          value       the text the attribute must hold, compared whole and without regard to case; never empty (an empty
|                      value would make every account break-glass)
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Entry)
|    $s = [string]$Entry
|    $i = $s.IndexOf('=')
|    if ($i -lt 1) { return $null }
|    $a = $s.Substring(0, $i).Trim(); $v = $s.Substring($i + 1).Trim()
|    if (-not $v -or $v.Length -gt 256) { return $null }
|    $kind = ''
|    if ($a -match '^(?i)extensionAttribute(?<n>1[0-5]|[1-9])$') { $kind = 'extensionAttribute'; $a = 'extensionAttribute' + $Matches['n'] }
|    elseif ($a -cmatch '^extension_[0-9a-fA-F]{32}_[A-Za-z0-9_]{1,128}$') { $kind = 'directoryExtension' }
|    else { return $null }
|    return @{ Attribute = $a; Value = $v; Kind = $kind; Text = ('{0}={1}' -f $a, $v) }
|}
|
|function Test-SIBreakGlassAttributeEntry {
|    <# PURE. Problems with ONE entry of the break_glass_attribute list; empty = valid. #>
|    param([AllowNull()][AllowEmptyString()][string]$Entry)
|    $p = New-Object System.Collections.Generic.List[string]
|    if ($null -eq (ConvertTo-SIBreakGlassAttributeRule -Entry $Entry)) {
|        $p.Add("lists/break_glass_attribute: '$Entry' -- an entry is attribute=value, the attribute extensionAttribute1 to extensionAttribute15 or a directory extension name (extension_<application id>_<name>), the value not empty and at most 256 characters")
|    }
|    return $p.ToArray()
|}
|
|function Test-SIBreakGlassAttributeList {
|    <# PURE. The break_glass_attribute list of a model: type values, every value a valid entry. Empty = valid (no list too). #>
|    param([Parameter(Mandatory)]$Model)
|    $p = New-Object System.Collections.Generic.List[string]
|    $l = @(@($Model['lists'].lists) | Where-Object { $_ -and [string]$_.id -eq $script:SIBreakGlassAttributeListId })
|    if ($l.Count -eq 0) { return $p.ToArray() }
|    if ([string]$l[0].type -ne 'values') { $p.Add("lists/break_glass_attribute: type '$($l[0].type)' -- it is a values list of attribute=value entries") }
|    foreach ($v in @(Get-SIItemValue $l[0] 'values')) {
|        if ($null -eq $v) { continue }
|        foreach ($x in (Test-SIBreakGlassAttributeEntry -Entry ([string]$v))) { $p.Add($x) }
|    }
|    return $p.ToArray()
|}
|
|function Get-SIBreakGlassAttributeRules {
|    <# PURE. The valid entries of the break_glass_attribute list in -Lists (an invalid entry is skipped -- the validation
|       reports it). Nothing shipped: empty until the customer defines one.
|       The rules are written to the output ONE BY ONE, never as one wrapped array: every caller reads them as
|       @(Get-SIBreakGlassAttributeRules ...) or in a foreach, and a wrapped array inside @( ) is ONE element -- an empty
|       list then counts as one rule, and two rules as one that matches nobody. #>
|    param([hashtable]$Lists = @{})
|    $out = New-Object System.Collections.Generic.List[object]
|    if (-not $Lists -or -not $Lists.ContainsKey($script:SIBreakGlassAttributeListId)) { return }
|    foreach ($v in (Get-SIValueList (Get-SIItemValue $Lists[$script:SIBreakGlassAttributeListId] 'values'))) {
|        $r = ConvertTo-SIBreakGlassAttributeRule -Entry ([string]$v)
|        if ($null -ne $r) { $out.Add($r) }
|    }
|    return $out.ToArray()
|}
|
|function Get-SIBreakGlassAttributeSelect {
|    <# PURE. The properties the user read must ask Microsoft Graph for so the rules can be decided:
|       onPremisesExtensionAttributes when a rule names an extensionAttributeN, and each directory extension by its name.
|       Empty when there is no rule -- the user read is then exactly as before. Written to the output one by one, as the
|       rules are: read it as @(Get-SIBreakGlassAttributeSelect ...). #>
|    param([AllowEmptyCollection()][object[]]$Rules = @())
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($r in @($Rules)) {
|        if ($null -eq $r) { continue }
|        $n = 'onPremisesExtensionAttributes'; if ([string]$r.Kind -eq 'directoryExtension') { $n = [string]$r.Attribute }
|        if (-not $out.Contains($n)) { $out.Add($n) }
|    }
|    return $out.ToArray()
|}
|
|function Get-SIBreakGlassAttributeMatch {
|    <#
|        PURE. The first rule the user object (as Microsoft Graph returned it) satisfies: { attribute; value; match } --
|        match is "attribute=value" as the rule reads -- or $null. An attribute the read did not return is not a match
|        (unknown is never break-glass).
|    #>
|    param($User, [AllowEmptyCollection()][object[]]$Rules = @())
|    if ($null -eq $User) { return $null }
|    $get = {
|        param($o, $n)
|        if ($null -eq $o) { return $null }
|        if ($o -is [System.Collections.IDictionary]) { foreach ($k in @($o.Keys)) { if ([string]$k -ieq $n) { return $o[$k] } }; return $null }
|        $p = $o.PSObject.Properties[$n]; if ($p) { return $p.Value }
|        return $null
|    }
|    foreach ($r in @($Rules)) {
|        if ($null -eq $r) { continue }
|        $have = $null
|        if ([string]$r.Kind -eq 'directoryExtension') { $have = & $get $User ([string]$r.Attribute) }
|        else { $have = & $get (& $get $User 'onPremisesExtensionAttributes') ([string]$r.Attribute) }
|        if ($null -eq $have) { continue }
|        foreach ($h in @($have)) {
|            if ($null -ne $h -and ([string]$h).Trim() -ieq [string]$r.Value) { return [ordered]@{ attribute = [string]$r.Attribute; value = ([string]$h).Trim(); match = [string]$r.Text } }
|        }
|    }
|    return $null
|}
|
|function Test-SIBreakGlassName {
|    <# PURE. $true when -Text matches any glob pattern (case-insensitive, the whole text). #>
|    param([AllowNull()][AllowEmptyString()][string]$Text, [string[]]$Patterns = @())
|    if ([string]::IsNullOrWhiteSpace($Text)) { return $false }
|    # a pattern is built once and kept (2026-10-16: it was built again for every group of every identity of the CI build)
|    $cache = $script:SIBreakGlassWildcardCache
|    if ($null -eq $cache -or $cache.Count -gt 5000) { $cache = New-Object 'System.Collections.Generic.Dictionary[string,object]' ([StringComparer]::Ordinal); $script:SIBreakGlassWildcardCache = $cache }
|    $t = $Text.Trim()
|    foreach ($p in $Patterns) {
|        $wc = $null
|        if (-not $cache.TryGetValue([string]$p, [ref]$wc)) { $wc = New-Object System.Management.Automation.WildcardPattern($p, [System.Management.Automation.WildcardOptions]::IgnoreCase); $cache[[string]$p] = $wc }
|        if ($wc.IsMatch($t)) { return $true }
|    }
|    return $false
|}
|
|function Get-SIBreakGlassReasonText {
|    <# PURE. The reasons (Get-SIBreakGlassClassification) in plain words: WHICH rule made the account break-glass. #>
|    param([AllowEmptyCollection()][string[]]$Reasons = @(), $Ci)
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($code in @($Reasons)) {
|        $c = [string]$code
|        if ($c -eq 'provider') { $out.Add('the identity collection marks it as an emergency-access account') }
|        elseif ($c -eq 'naming:si_upn') { $out.Add('its sign-in name matches a break-glass naming pattern') }
|        elseif ($c -eq 'naming:si_display_name') { $out.Add('its display name matches a break-glass naming pattern') }
|        elseif ($c -eq 'group') { $out.Add('it is a member of a group whose name matches a break-glass naming pattern') }
|        elseif ($c -eq 'attribute') {
|            $a = ''; if ($null -ne $Ci) { $a = [string](Get-SIItemValue $Ci 'si_break_glass_attribute') }
|            if ($a) { $out.Add(('it carries the extension attribute and value you defined ({0})' -f $a)) } else { $out.Add('it carries the extension attribute and value you defined') }
|        }
|        elseif ($c -eq 'ca_excluded_from_all') {
|            $n = 0; if ($null -ne $Ci) { $n = @((Get-SIValueList (Get-SIItemValue $Ci 'si_ca_excluded_policies')).ToArray() | Where-Object { $_ }).Count }
|            if ($n -gt 0) { $out.Add(('it holds a permanent Tier 0 role and is excluded from all {0} enabled Conditional Access policies that would apply to it' -f $n)) }
|            else { $out.Add('it holds a permanent Tier 0 role and is excluded from all the enabled Conditional Access policies that would apply to it') }
|        }
|        elseif ($c) { $out.Add($c) }
|    }
|    if ($out.Count -eq 0) { return '' }
|    return ('Break-glass because ' + ($out.ToArray() -join '; ') + '.')
|}
|
|function Get-SIBreakGlassClassification {
|    <#
|    .SYNOPSIS  PURE. One CI -> @{ IsBreakGlass = $true | $false | $null (not an identity user / guest, or nothing known);
|               Reasons = provider / naming:<field> / group / attribute / ca_excluded_from_all }.
|    #>
|    param([Parameter(Mandatory)]$Ci, [hashtable]$Context = @{})
|    $reasons = New-Object System.Collections.Generic.List[string]
|    $cls = [string](Get-SIItemValue $Ci 'si_class')
|    if ($cls -and $cls -ne 'identity') { return @{ IsBreakGlass = $null; Reasons = @() } }
|    $type = [string](Get-SIItemValue $Ci 'si_identity_type')
|    if ($type -and @('user', 'guest') -notcontains $type) { return @{ IsBreakGlass = $null; Reasons = @() } }
|    $unknown = @{}; foreach ($u in @(Get-SIItemValue $Ci 'si_unknown_fields')) { if ($u) { $unknown[[string]$u] = $true } }
|    $prov = ConvertTo-SIBoolOrNull (Get-SIItemValue $Ci 'si_is_break_glass')
|    if ($prov -eq $true) { $reasons.Add('provider') }
|    $lists = @{}; if ($Context -and $Context.Lists) { $lists = $Context.Lists }
|    $pats = Get-SIBreakGlassPatterns -Lists $lists
|    if ($pats.Count -gt 0) {
|        foreach ($fn in 'si_upn', 'si_display_name') {
|            if ($unknown.ContainsKey($fn)) { continue }
|            if (Test-SIBreakGlassName -Text ([string](Get-SIItemValue $Ci $fn)) -Patterns $pats) { $reasons.Add('naming:' + $fn) }
|        }
|        if (-not $unknown.ContainsKey('si_group_memberships')) {
|            foreach ($g in (Get-SIValueList (Get-SIItemValue $Ci 'si_group_memberships'))) {
|                $names = @()
|                if ($g -is [string]) { $names = @($g) } else { $names = @((Get-SIItemValue $g 'displayName'), (Get-SIItemValue $g 'name')) }
|                $hit = $false
|                foreach ($n in $names) { if (Test-SIBreakGlassName -Text ([string]$n) -Patterns $pats) { $hit = $true } }
|                if ($hit) { $reasons.Add('group'); break }
|            }
|        }
|    }
|    # (a) the extension attribute and value the customer defines: the collector matched it on the user it read
|    # (si_break_glass_attribute = "attribute=value"); it counts only while that entry is still in the list
|    if (-not $unknown.ContainsKey('si_break_glass_attribute')) {
|        $have = ([string](Get-SIItemValue $Ci 'si_break_glass_attribute')).Trim()
|        if ($have) {
|            foreach ($rule in (Get-SIBreakGlassAttributeRules -Lists $lists)) { if ([string]$rule.Text -ieq $have) { $reasons.Add('attribute'); break } }
|        }
|    }
|    # (b) a PERMANENT TIER 0 account that is excluded from ALL the enabled Conditional Access policies that would apply to it --
|    # one policy is not enough, and an ordinary account in a broad exclusion group is not break-glass (the rule has always
|    # been about the accounts that hold the tenant: si_privilege_tier_permanent = 0)
|    if (-not $unknown.ContainsKey('si_ca_excluded_from_all') -and -not $unknown.ContainsKey('si_privilege_tier_permanent')) {
|        $pt = ConvertTo-SINumberOrNull (Get-SIItemValue $Ci 'si_privilege_tier_permanent')
|        if ((ConvertTo-SIBoolOrNull (Get-SIItemValue $Ci 'si_ca_excluded_from_all')) -eq $true -and $null -ne $pt -and $pt -eq 0) { $reasons.Add('ca_excluded_from_all') }
|    }
|    if ($reasons.Count -gt 0) { return @{ IsBreakGlass = $true; Reasons = $reasons.ToArray() } }
|    return @{ IsBreakGlass = $prov; Reasons = @() }
|}
|
|function Set-SICiBreakGlass {
|    <#
|    .SYNOPSIS  PURE. Sets si_is_break_glass (true when classified; a provider's value is kept otherwise),
|               si_break_glass_reasons (the rules that matched) and si_break_glass_reason (the same in plain words) on one
|               identity CI. Returns the CI. Never touches the risk factors.
|    #>
|    param([Parameter(Mandatory)]$Ci, [hashtable]$Context = @{})
|    $r = Get-SIBreakGlassClassification -Ci $Ci -Context $Context
|    if ($r.IsBreakGlass -eq $true) {
|        $Ci['si_is_break_glass'] = $true
|        $Ci['si_break_glass_reasons'] = @($r.Reasons)
|        $Ci['si_break_glass_reason'] = Get-SIBreakGlassReasonText -Reasons @($r.Reasons) -Ci $Ci
|    } elseif ($Ci -is [System.Collections.IDictionary]) {
|        foreach ($n in 'si_break_glass_reasons', 'si_break_glass_reason') { if ($Ci.Contains($n)) { $Ci.Remove($n) } }
|    }
|    return $Ci
|}
'@ }
$__siSupportFiles['engine/data-model/SI-CiRules.ps1'] = @{ Sha256 = 'f0d5c87f876676a7b29506fcd5b55b5d0ca18f8229675c66feb54cc5dc035651'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight CI RULES -- the generic enrichment rule model run ON THE CI (#462, V3-DATA-MODEL 2.8 / 2.19.2).
|
|      NATIVE RULES   rule packs in the design's own shape, over SI FIELDS only (a rule never names a provider):
|                       data-model/rules/<Pack>.locked.yaml                (shipped)
|                       data-model/rules/<Pack>.custom.yaml                (the customer's, beside it)
|                       <SI_DataModelOverlayRoot>/rules/<Pack>.custom.yaml (the operator overlay -- wins)
|                     (data-model/, not asset-profiling-enrichment/: those folders hold the AssetProfileBy* rule files that the
|                     profilers, the Pro template packs and the rule lint read in their own shape)
|                     rules:
|                       - id: domain-controllers
|                         stage: production            # production | testing | not_used
|                         priority: 100                # a single-value field: the highest-priority deciding rule wins
|                         applies_to: [ device ]       # device | identity | cloud_resource | public_ip
|                         mechanism: eg.graph_field    # the trust-list entry the evidence belongs to (default name.pattern)
|                         when:
|                           any:
|                             - si_device_roles: { contains: domain_controller }
|                             - si_installed_software: { like: "*active directory domain services*" }
|                         set: { si_tier: 0, si_purpose: Domain controller, si_tags: [ AD-Tier0 ] }
|                     A condition is `<si field>: { <op>: <value> }` (ops: Get-SIConditionOps, the closed set) or
|                     `<si field>: <value>` (eq). The override grain is ONE RULE: a custom rule with a shipped id
|                     replaces it; `stage: not_used` turns it off. The result is the same CI-rule shape the converted
|                     AssetProfileBy* rules have (ConvertTo-SICiRules), evaluated by the same Invoke-SICiRules.
|      ASSET TAGGING  the tagging engine's auto-exclusion tags (AssetTagging.locked.yaml: KQL against Defender) expressed
|                     as a native pack (data-model/rules/AssetTagging.locked.yaml) over si_onboarding_status / si_asset_name, so the CI
|                     carries the same tag the engine writes; its per-rule switches (config/asset-tagging.config.json
|                     AutoExcludeRules.*) and the device-name patterns are honoured (Get-SIAssetTaggingCiRules).
|      OVERRIDES      a manual CI override (Admin, with a reason and an optional expiry; precedence 1 in 2.8) --
|                     sidata.CiOverride in the install database (both editions have one, #477). Applied after the rules:
|                     si_tier -> si_tier_set_by = override. Every override in force is listed on the CI (si_overrides).
|
|    PURE except Get-SICiNativeRules / Get-SIAssetTaggingCiRules (read rule files) and Read-SICiOverrides (one SQL read).
|    PowerShell 5.1: no ?. / ??, no ternary, no Set-StrictMode.
|#>
|
|if (-not (Get-Command -Name Test-SICondition -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|
|function ConvertTo-SICiNativeCondition {
|    <#
|        PURE. A design-shape condition -> the closed condition language ({ field; op; value } / { any } / { all }).
|          { any: [ ... ] } / { all: [ ... ] }      groups (nested)
|          { si_x: { op: value } }                 one leaf per op key (several keys = all of them)
|          { si_x: value }                         eq
|        Throws on an operation outside Get-SIConditionOps or a field that is not an SI field (si_ / properties.).
|    #>
|    param([Parameter(Mandatory)]$When, [string]$RuleId = '')
|    $ops = Get-SIConditionOps
|    $keys = @()
|    if ($When -is [System.Collections.IDictionary]) { $keys = @($When.Keys | ForEach-Object { [string]$_ }) } else { $keys = @($When.PSObject.Properties | ForEach-Object { $_.Name }) }
|    foreach ($g in 'any', 'all') {
|        if ($keys -contains $g) {
|            $items = @(foreach ($c in (Get-SIValueList (Get-SIItemValue $When $g))) { if ($null -ne $c) { ConvertTo-SICiNativeCondition -When $c -RuleId $RuleId } })
|            $o = [ordered]@{}; $o[$g] = $items; return $o
|        }
|    }
|    $leaves = New-Object System.Collections.Generic.List[object]
|    foreach ($f in $keys) {
|        if ($f -cnotmatch '^(si_[a-z0-9_]+|properties\..+)$') { throw ("rule '{0}': '{1}' is not an SI field -- a rule reads SI fields only, never a provider column" -f $RuleId, $f) }
|        $spec = Get-SIItemValue $When $f
|        $isMap = ($spec -is [System.Collections.IDictionary]) -or ($spec -is [System.Management.Automation.PSCustomObject])
|        if (-not $isMap) {
|            # a list is "one of these" (in), a single value is eq
|            if ($spec -is [System.Collections.IEnumerable] -and -not ($spec -is [string])) { $leaves.Add([ordered]@{ field = $f; op = 'in'; value = @($spec) }) }
|            else { $leaves.Add([ordered]@{ field = $f; op = 'eq'; value = $spec }) }
|            continue
|        }
|        $sk = @(); if ($spec -is [System.Collections.IDictionary]) { $sk = @($spec.Keys | ForEach-Object { [string]$_ }) } else { $sk = @($spec.PSObject.Properties | ForEach-Object { $_.Name }) }
|        foreach ($op in $sk) {
|            if ($ops -notcontains $op) { throw ("rule '{0}': '{1}' uses '{2}', which is not a condition operation ({3})" -f $RuleId, $f, $op, ($ops -join ', ')) }
|            $leaves.Add([ordered]@{ field = $f; op = $op; value = (Get-SIItemValue $spec $op) })
|        }
|    }
|    if ($leaves.Count -eq 1) { return $leaves[0] }
|    return [ordered]@{ all = $leaves.ToArray() }
|}
|
|function ConvertTo-SICiNativeRule {
|    <#
|        PURE. One native rule item -> a CI rule (the shape ConvertTo-SICiRules gives, so Invoke-SICiRules evaluates both).
|        -Pack: the pack (file) it came from; -Order: its place in the rule order.
|    #>
|    param([Parameter(Mandatory)]$Item, [string]$Pack = '', [int]$Order = 0, [string]$File = '', [int]$DefaultPriority = 100)
|    $id = [string](Get-SIItemValue $Item 'id')
|    if (-not $id) { throw ("a rule in pack '{0}' has no id" -f $Pack) }
|    $stage = ([string](Get-SIItemValue $Item 'stage')).Trim().ToLowerInvariant(); if (-not $stage) { $stage = 'production' }
|    if ($stage -notin 'production', 'testing', 'not_used') { throw ("rule '{0}': stage '{1}' (production | testing | not_used)" -f $id, $stage) }
|    # a rule without its own priority takes its pack's (Get-SIRulePackHeader; 100 when the pack names none)
|    $prio = $DefaultPriority; $pv = Get-SIItemValue $Item 'priority'; if ($null -ne $pv -and [string]$pv -match '^-?\d+$') { $prio = [int]$pv }
|    $classes = @((Get-SIValueList (Get-SIItemValue $Item 'applies_to')).ToArray() | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() } | Where-Object { $_ })
|    foreach ($c in $classes) { if ($c -notin 'device', 'identity', 'cloud_resource', 'public_ip') { throw ("rule '{0}': applies_to '{1}' (device | identity | cloud_resource | public_ip)" -f $id, $c) } }
|    if ($classes.Count -eq 0) { $classes = @('device', 'identity', 'cloud_resource', 'public_ip') }
|    $whenRaw = Get-SIItemValue $Item 'when'
|    if ($null -eq $whenRaw) { throw ("rule '{0}' has no when" -f $id) }
|    $when = ConvertTo-SICiNativeCondition -When $whenRaw -RuleId $id
|    if (-not ($when.Contains('any') -or $when.Contains('all'))) { $when = [ordered]@{ all = @($when) } }
|    $set = [ordered]@{}
|    $rawSet = Get-SIItemValue $Item 'set'
|    if ($null -ne $rawSet) {
|        $sk = @(); if ($rawSet -is [System.Collections.IDictionary]) { $sk = @($rawSet.Keys | ForEach-Object { [string]$_ }) } else { $sk = @($rawSet.PSObject.Properties | ForEach-Object { $_.Name }) }
|        foreach ($k in $sk) {
|            if ($k -cnotmatch '^si_[a-z0-9_]+$') { throw ("rule '{0}': set '{1}' is not an SI field" -f $id, $k) }
|            $v = Get-SIItemValue $rawSet $k
|            if ($k -eq 'si_tags') { $set[$k] = @((Get-SIValueList $v).ToArray() | ForEach-Object { [string]$_ }); continue }
|            if ($k -eq 'si_tier') { $t = 0; if (-not [int]::TryParse([string]$v, [ref]$t) -or $t -lt 0 -or $t -gt 3) { throw ("rule '{0}': si_tier '{1}' (0-3)" -f $id, $v) }; $set[$k] = $t; continue }
|            $set[$k] = $v
|        }
|    }
|    if ($set.Count -eq 0) { throw ("rule '{0}' sets nothing" -f $id) }
|    $mech = [string](Get-SIItemValue $Item 'mechanism'); if (-not $mech) { $mech = 'name.pattern' }
|    $os = @((Get-SIValueList (Get-SIItemValue $Item 'os_scope')).ToArray() | ForEach-Object { ([string]$_).ToLowerInvariant() } | Where-Object { $_ })
|    $ex = @((Get-SIValueList (Get-SIItemValue $Item 'exclude')).ToArray() | ForEach-Object { [string]$_ } | Where-Object { $_ })
|    $name = [string](Get-SIItemValue $Item 'name'); if (-not $name) { $name = $id }
|    [pscustomobject][ordered]@{
|        id = $id; family = 'ci'; file = $File; name = $name; stage = $stage; priority = $prio; pack = $Pack; order = $Order; classes = $classes; osScope = $os
|        fallback = $false; mechanism = $mech; when = $when; set = $set; exclude = $ex; native = $true
|    }
|}
|
|function Merge-SICiNativeRuleItems {
|    <#
|        PURE. Rule items of one pack, shipped then custom (then overlay): the override grain is ONE RULE -- a later item with
|        the same id replaces the earlier one in its place; a new id is added at the end.
|    #>
|    param([AllowEmptyCollection()][object[]]$Layers = @())
|    $order = New-Object System.Collections.Generic.List[string]
|    $by = @{}
|    foreach ($layer in $Layers) {
|        foreach ($it in @($layer)) {
|            if ($null -eq $it) { continue }
|            $id = [string](Get-SIItemValue $it 'id'); if (-not $id) { continue }
|            if (-not $by.ContainsKey($id)) { $order.Add($id) }
|            $by[$id] = $it
|        }
|    }
|    foreach ($id in $order) { $by[$id] }
|}
|
|# ---------------------------------------------------------------------------------------------------
|# Rule PACKS (#462 GUI): one pack = one rule file. Besides its rules a pack carries a header -- its stage, whether it is
|# on, its default priority and where it came from -- so a whole pack is turned on or off, or promoted from testing to
|# live, in one decision:
|#   name / description   what the pack is for (shown on the Rule packs page)
|#   stage                production (live) | testing: a testing pack's rules only PROPOSE (si_rule_proposals)
|#   enabled              false = every rule of the pack is not_used
|#   priority             the priority of a rule that names none (default 100)
|#   source               shipped (SecurityInsight) | invardia (delivered through the template channel) | customer
|# An Invardia pack is NOT auto-imported: it arrives switched off and, once an Admin stages it, as testing -- it decides
|# only when an Admin promotes it to live (Pro: a cfg.ItemOverride on its header, 'rules/<pack>'; Community: the same keys
|# at the top of <Pack>.custom.yaml).
|# ---------------------------------------------------------------------------------------------------
|
|function Get-SIRulePackKey {
|    <# PURE. The data-model template name of a pack ('rules/<lower-case pack>'): what the Pro rows and overrides key on. #>
|    param([Parameter(Mandatory)][string]$Pack)
|    $k = ($Pack.ToLowerInvariant() -replace '[^a-z0-9_\-]', '')
|    if (-not $k) { throw ("rule pack '{0}' has no usable name" -f $Pack) }
|    if ($k.Length -gt 60) { $k = $k.Substring(0, 60) }
|    'rules/' + $k
|}
|
|function Get-SIRulePackHeader {
|    <#
|        PURE. A pack's header from its document layers (shipped, then custom / overlay / the Pro override: a later layer's
|        key wins). Returns @{ pack; name; description; stage; enabled; priority; source }. An Invardia pack defaults to
|        switched off and testing (never auto-imported).
|    #>
|    param([Parameter(Mandatory)][string]$Pack, [AllowEmptyCollection()][object[]]$Layers = @())
|    $h = [ordered]@{ pack = $Pack; name = $Pack; description = ''; stage = ''; enabled = $null; priority = 100; source = 'shipped' }
|    foreach ($l in @($Layers)) {
|        if ($null -eq $l) { continue }
|        foreach ($k in 'name', 'description', 'source') { $v = Get-SIItemValue $l $k; if ($null -ne $v -and [string]$v -ne '') { $h[$k] = [string]$v } }
|        $st = Get-SIItemValue $l 'stage'; if ($null -ne $st -and [string]$st -ne '') { $h.stage = ([string]$st).Trim().ToLowerInvariant() }
|        $en = Get-SIItemValue $l 'enabled'; if ($null -ne $en -and [string]$en -ne '') { $h.enabled = ((ConvertTo-SIBoolOrNull $en) -eq $true) }
|        $pr = Get-SIItemValue $l 'priority'; if ($null -ne $pr -and [string]$pr -match '^-?\d+$') { $h.priority = [int]$pr }
|    }
|    $h.source = ([string]$h.source).Trim().ToLowerInvariant(); if ($h.source -notin 'shipped', 'invardia', 'customer') { $h.source = 'shipped' }
|    if ($h.stage -eq 'live') { $h.stage = 'production' }
|    if (-not $h.stage) { if ($h.source -eq 'invardia') { $h.stage = 'testing' } else { $h.stage = 'production' } }
|    if ($h.stage -notin 'production', 'testing') { $h.stage = 'testing' }   # an unknown stage never decides
|    if ($null -eq $h.enabled) { $h.enabled = ($h.source -ne 'invardia') }
|    $h
|}
|
|function Set-SIRulePackState {
|    <#
|        PURE. A pack's header applied to its converted rules: switched off -> every rule not_used; a testing pack -> its
|        production rules become testing (they propose, never decide). A rule's own not_used / testing stays.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rules = @(), [Parameter(Mandatory)]$Header)
|    foreach ($r in @($Rules)) {
|        if ($null -eq $r) { continue }
|        if (-not $Header.enabled) { $r.stage = 'not_used' }
|        elseif ($Header.stage -eq 'testing' -and $r.stage -eq 'production') { $r.stage = 'testing' }
|        $r
|    }
|}
|
|function Get-SICiNativeRules {
|    <#
|        The native rule packs -> CI rules. -Root: the solution root (default: two folders up); -OverlayRoot: the operator
|        overlay (default $global:SI_DataModelOverlayRoot); -ProRoot: Pro's run data model exported from the settings
|        database (default $global:SI_DataModelRoot) -- a pack it holds (rules/<pack>.locked.json: the published pack with
|        the customer's overrides) replaces the file layers of that pack. A pack that does not parse, or a rule that is not
|        valid, is SKIPPED with a warning naming it -- the other rules still run. Every pack's header (stage, on / off,
|        priority) is applied to its rules (Set-SIRulePackState).
|        Returns @{ Rules; Problems; Packs (pack -> header) }.
|    #>
|    param([string]$Root, [string]$OverlayRoot = $global:SI_DataModelOverlayRoot, [int]$StartOrder = 100000, [string]$ProRoot = $global:SI_DataModelRoot)
|    if (-not (Get-Command -Name ConvertFrom-SIYaml -ErrorAction SilentlyContinue)) { . (Join-Path (Split-Path -Parent $PSScriptRoot) '_shared\SI-Yaml.ps1') }
|    if (-not $Root) { $Root = Split-Path -Parent (Split-Path -Parent $PSScriptRoot) }
|    $dirs = @([System.IO.Path]::Combine($Root, 'data-model', 'rules'))
|    $packs = [ordered]@{}
|    $heads = @{}
|    $problems = New-Object System.Collections.Generic.List[string]
|    $read = {
|        param([string]$Path, [string]$Pack)
|        try {
|            $y = ConvertFrom-SIYaml -Yaml ([System.IO.File]::ReadAllText($Path)) -SourceName $Path
|            if (-not $heads.ContainsKey($Pack)) { $heads[$Pack] = New-Object System.Collections.Generic.List[object] }
|            $heads[$Pack].Add($y)
|            return @(Get-SIValueList (Get-SIItemValue $y 'rules'))
|        }
|        catch { $problems.Add(('{0}: does not parse -- {1}' -f [System.IO.Path]::GetFileName($Path), $_.Exception.Message)); return @() }
|    }
|    foreach ($d in $dirs) {
|        if (-not (Test-Path -LiteralPath $d)) { continue }
|        foreach ($f in @(Get-ChildItem -LiteralPath $d -File -Filter '*.locked.yaml' | Sort-Object Name)) { $p = $f.Name -replace '\.locked\.yaml$', ''; $packs[$p] = @(, (& $read $f.FullName $p)) }
|        foreach ($f in @(Get-ChildItem -LiteralPath $d -File -Filter '*.custom.yaml' | Sort-Object Name)) { $p = $f.Name -replace '\.custom\.yaml$', ''; if (-not $packs.Contains($p)) { $packs[$p] = @() }; $packs[$p] = @($packs[$p]) + @(, (& $read $f.FullName $p)) }
|    }
|    if ($OverlayRoot) {
|        $od = [System.IO.Path]::Combine($OverlayRoot, 'rules')
|        if (Test-Path -LiteralPath $od) {
|            foreach ($f in @(Get-ChildItem -LiteralPath $od -File -Filter '*.custom.yaml' | Sort-Object Name)) { $p = $f.Name -replace '\.custom\.yaml$', ''; if (-not $packs.Contains($p)) { $packs[$p] = @() }; $packs[$p] = @($packs[$p]) + @(, (& $read $f.FullName $p)) }
|        }
|    }
|    # Pro: a pack the settings database holds (published + overridden in SQL, no custom files) replaces its file layers
|    if ($ProRoot) {
|        $pd = [System.IO.Path]::Combine($ProRoot, 'rules')
|        if (Test-Path -LiteralPath $pd) {
|            foreach ($f in @(Get-ChildItem -LiteralPath $pd -File -Filter '*.locked.json' | Sort-Object Name)) {
|                try {
|                    $doc = [System.IO.File]::ReadAllText($f.FullName).TrimStart([char]0xFEFF) | ConvertFrom-Json
|                    $p = [string](Get-SIItemValue $doc 'pack'); if (-not $p) { $p = $f.Name -replace '\.locked\.json$', '' }
|                    foreach ($k in @($packs.Keys)) { if ([string]$k -ieq $p) { $packs.Remove($k) } }
|                    foreach ($k in @($heads.Keys)) { if ([string]$k -ieq $p) { $heads.Remove($k) } }
|                    # one layer = the rules (Get-SIValueList returns ONE list: @() around it made the layer a single item)
|                    $packs[$p] = @(, (Get-SIValueList (Get-SIItemValue $doc 'rules')).ToArray())
|                    $heads[$p] = New-Object System.Collections.Generic.List[object]; $heads[$p].Add($doc)
|                } catch { $problems.Add(('{0}: does not parse -- {1}' -f $f.Name, $_.Exception.Message)) }
|            }
|        }
|    }
|    $rules = New-Object System.Collections.Generic.List[object]
|    $packHeads = [ordered]@{}
|    $order = $StartOrder
|    foreach ($p in $packs.Keys) {
|        $hl = @(); if ($heads.ContainsKey($p)) { $hl = $heads[$p].ToArray() }
|        $head = Get-SIRulePackHeader -Pack $p -Layers $hl
|        $packHeads[$p] = $head
|        $conv = New-Object System.Collections.Generic.List[object]
|        foreach ($it in @(Merge-SICiNativeRuleItems -Layers @($packs[$p]))) {
|            $order++
|            try { $conv.Add((ConvertTo-SICiNativeRule -Item $it -Pack $p -Order $order -File ("data-model/rules/{0}" -f $p) -DefaultPriority ([int]$head.priority))) }
|            catch { $problems.Add(('{0}: {1}' -f $p, $_.Exception.Message)) }
|        }
|        foreach ($r in @(Set-SIRulePackState -Rules $conv.ToArray() -Header $head)) { $rules.Add($r) }
|    }
|    foreach ($x in $problems) { Write-Warning ("CI rules: {0} -- skipped; the other rules run." -f $x) }
|    @{ Rules = $rules.ToArray(); Problems = $problems.ToArray(); Packs = $packHeads }
|}
|
|function Get-SIAssetTaggingCiRules {
|    <#
|        The tagging engine's switches and device-name patterns applied to the AssetTagging pack's CI rules (#462):
|          * a rule with `config_flag: AutoExcludeRules.<X>` is used ONLY when the tagging config sets that flag true -- no
|            config file, no flag, or anything but true = not_used. Every one of these rules writes an EXCLUSION tag
|            (<bucket>--Excluded--SI), and every report drops a CI that carries one, so an exclusion is the customer's choice,
|            never a default. The same rule as the tagging engine (AssetTagging.ps1 Test-TaggingConfigFlag: missing = false)
|            and the shipped sample (every switch false). #643: this used to read "no file = on" -- from the 10-12 CI build on,
|            every device CI whose onboarding status read "can be onboarded" (774 of 1,890 at a large install, 704 of them
|            onboarded in Defender) carried Auto-CanBeOnboarded--Excluded--SI and left every report, although nobody had chosen it;
|          * the name-pattern rule (`config_patterns: DeviceNamePatterns`) gets its condition from the config's
|            StartsWith / Contains / MatchesRegex lists (any of them); with no pattern configured it stays not_used --
|            on a CI a rule that matches every device would tag every device.
|          * ABOVE ALL OF IT: the customer setting "Asset tagging" (SI_AssetTagging_Enabled, owner 2026-10-13: "tagging must be
|            disabled by default. customer must enable it in settings"). Not a real true = EVERY rule of the pack is not_used,
|            whatever the switches say, and each carries strip_tags = $true: the CI build then also takes the tags these
|            rules name off the CI when a provider brings them back (a tag an earlier tagging run wrote to Defender) -- off
|            means no report treats a device as excluded because of a tagging rule. A customer's own tags are untouched.
|        -Rules: the CI rules (Get-SICiNativeRules); -Config: the parsed asset-tagging.config.json (or $null); -Enabled: the
|        setting SI_AssetTagging_Enabled. Returns the rules.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rules = @(), $Config, [hashtable]$RawItems = @{}, [AllowNull()]$Enabled = $global:SI_AssetTagging_Enabled)
|    $taggingOn = Test-SIAssetTaggingEnabled -Value $Enabled
|    foreach ($r in $Rules) {
|        if ($null -eq $r -or [string]$r.pack -ne 'AssetTagging') { $r; continue }
|        if (-not $taggingOn) {
|            $r.stage = 'not_used'
|            if ($r.PSObject.Properties['strip_tags']) { $r.strip_tags = $true } else { Add-Member -InputObject $r -NotePropertyName 'strip_tags' -NotePropertyValue $true }
|            $r; continue
|        }
|        $raw = $RawItems[[string]$r.id]
|        $flag = [string](Get-SIItemValue $raw 'config_flag')
|        if ($flag) {
|            $on = $false
|            if ($null -ne $Config) {
|                $v = $Config
|                foreach ($part in $flag.Split('.')) { $v = Get-SIItemValue $v $part }
|                $on = ($null -ne $v -and (ConvertTo-SIBoolOrNull $v) -eq $true)
|            }
|            if (-not $on) { $r.stage = 'not_used' }
|        }
|        if ([string](Get-SIItemValue $raw 'config_patterns') -eq 'DeviceNamePatterns') {
|            $np = Get-SIItemValue $Config 'DeviceNamePatterns'
|            $leaves = New-Object System.Collections.Generic.List[object]
|            foreach ($s in (Get-SIValueList (Get-SIItemValue $np 'StartsWith'))) { if ($s) { $leaves.Add([ordered]@{ field = 'si_asset_name'; op = 'like'; value = ([string]$s + '*') }) } }
|            foreach ($s in (Get-SIValueList (Get-SIItemValue $np 'Contains'))) { if ($s) { $leaves.Add([ordered]@{ field = 'si_asset_name'; op = 'like'; value = ('*' + [string]$s + '*') }) } }
|            foreach ($s in (Get-SIValueList (Get-SIItemValue $np 'MatchesRegex'))) { if ($s) { $leaves.Add([ordered]@{ field = 'si_asset_name'; op = 'matches'; value = [string]$s }) } }
|            if ($leaves.Count -eq 0) { $r.stage = 'not_used' } else { $r.when = [ordered]@{ any = $leaves.ToArray() } }
|        }
|        $r
|    }
|}
|
|function Test-SIAssetTaggingEnabled {
|    <# PURE. The customer setting "Asset tagging" (SI_AssetTagging_Enabled): ONLY a real true turns it on -- $true, 'true',
|       '$true' or 1. Missing, empty, false or anything else = off (the shipped default, #643). #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $false }
|    if ($Value -is [bool]) { return $Value }
|    return ("$Value".Trim().Trim('$').ToLowerInvariant() -in @('true', '1'))
|}
|
|function Get-SITaggingRuleTagNames {
|    <# PURE. The tags the asset-tagging rules that are switched off by the setting name (strip_tags) -- what the CI build
|       takes off a CI while asset tagging is off. A HashSet, case-insensitive. #>
|    param([AllowEmptyCollection()][object[]]$Rules = @())
|    $names = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($r in $Rules) {
|        if ($null -eq $r -or -not $r.PSObject.Properties['strip_tags'] -or -not [bool]$r.strip_tags) { continue }
|        $set = $r.set
|        if ($null -ne $set -and $set.Contains('si_tags')) { foreach ($t in @($set['si_tags'])) { if ($t) { [void]$names.Add([string]$t) } } }
|    }
|    , $names
|}
|
|function Read-SIAssetTaggingConfig {
|    <# The tagging engine's config (config/asset-tagging.config.json), or $null when there is none / it does not parse. #>
|    param([string]$Root)
|    if (-not $Root) { $Root = Split-Path -Parent (Split-Path -Parent $PSScriptRoot) }
|    $p = [System.IO.Path]::Combine($Root, 'config', 'asset-tagging.config.json')
|    if ($global:SI_ProConfigRoot) { $pp = [System.IO.Path]::Combine([string]$global:SI_ProConfigRoot, 'asset-tagging.config.json'); if (Test-Path -LiteralPath $pp) { $p = $pp } }
|    if (-not (Test-Path -LiteralPath $p)) { return $null }
|    try { return ([System.IO.File]::ReadAllText($p) | ConvertFrom-Json) } catch { Write-Warning ("CI rules: {0} does not parse -- the tagging switches are the defaults." -f $p); return $null }
|}
|
|function Get-SICiAllNativeRules {
|    <# Every native CI rule, with the tagging switches applied. Returns @{ Rules; Problems }. #>
|    param([string]$Root, [string]$OverlayRoot = $global:SI_DataModelOverlayRoot)
|    $n = Get-SICiNativeRules -Root $Root -OverlayRoot $OverlayRoot
|    $raw = @{}
|    if (-not $Root) { $Root = Split-Path -Parent (Split-Path -Parent $PSScriptRoot) }
|    $atFile = [System.IO.Path]::Combine($Root, 'data-model', 'rules', 'AssetTagging.locked.yaml')
|    if (Test-Path -LiteralPath $atFile) {
|        try { foreach ($it in (Get-SIValueList (Get-SIItemValue (ConvertFrom-SIYaml -Yaml ([System.IO.File]::ReadAllText($atFile)) -SourceName $atFile) 'rules'))) { $raw[[string](Get-SIItemValue $it 'id')] = $it } } catch { }
|    }
|    $rules = @(Get-SIAssetTaggingCiRules -Rules @($n.Rules) -Config (Read-SIAssetTaggingConfig -Root $Root) -RawItems $raw)
|    @{ Rules = $rules; Problems = @($n.Problems); Packs = $n.Packs }
|}
|
|# ---------------------------------------------------------------------------------------------------
|# The operator's tier tag (the profile's tenant_si_manual_tag contributor) on the CI
|# ---------------------------------------------------------------------------------------------------
|
|$script:SICiDefaultTierTagPattern = '(?i)tier[_-]?(?<tier>[0-3])(--SI)?'
|
|function ConvertTo-SICiTagTierRules {
|    <#
|        PURE. The operator's tier tag (e.g. EmployeeWorkstations--tier2--SI) as CI rules: one rule per tier 0..3, each matching
|        si_tags with the schema's tagPattern narrowed to that tier (its named group `tier` replaced by the digit). The profile
|        has done this since 2.3.6 (Get-SITierFromAssetTags); without it on the CI a device tagged tier 2 got the default
|        tier 3 and fell out of the tier-filtered reports.
|        Owner: "tags must continue to be used, just low prio" -- so every rule is ASSERTED (Invoke-SICiRules: it decides only
|        when no observed rule claims a tier, and always beats the default rule) and its mechanism, operator.tier_tag, is last
|        in the trust list. Several tier tags on one device: MIN, as everywhere else.
|        Devices only (the endpoint schema declares the contributor). A pattern without a `tier` group, or one that is not a
|        valid regex, gives no rules and a warning -- never a rule that matches every device.
|    #>
|    param([AllowNull()][string]$TagPattern, [int]$StartOrder = 900000)
|    if ([string]::IsNullOrWhiteSpace($TagPattern)) { $TagPattern = $script:SICiDefaultTierTagPattern }
|    try { $null = New-Object System.Text.RegularExpressions.Regex($TagPattern) }
|    catch { Write-Warning ("CI rules: the tier tag pattern '{0}' is not a valid regex ({1}) -- tier tags are not used." -f $TagPattern, $_.Exception.Message); return @() }
|    $group = New-Object System.Text.RegularExpressions.Regex('\(\?(?:<tier>|''tier'')(?:\\.|\[(?:\\.|[^\]\\])*\]|[^()\\])*\)')
|    if (-not $group.IsMatch($TagPattern)) { Write-Warning ("CI rules: the tier tag pattern '{0}' has no (?<tier>...) group -- tier tags are not used." -f $TagPattern); return @() }
|    $order = $StartOrder
|    foreach ($t in 0..3) {
|        $order++
|        $pat = $group.Replace($TagPattern, ('(?<tier>{0})' -f $t), 1)
|        [pscustomobject][ordered]@{
|            id = ('operator-tier-tag/tier{0}' -f $t); family = 'ci'; file = 'asset-profiling-schema/endpoint.schema (tenant_si_manual_tag)'
|            name = ('Operator tier tag: tier {0}' -f $t); stage = 'production'; priority = 1; pack = 'OperatorTierTag'; order = $order
|            classes = @('device'); osScope = @(); fallback = $false; mechanism = 'operator.tier_tag'
|            when = [ordered]@{ any = @([ordered]@{ field = 'si_tags'; op = 'matches'; value = $pat }) }
|            set = [ordered]@{ si_tier = $t }; exclude = @(); native = $true; asserted = $true
|        }
|    }
|}
|
|function Get-SICiTagTierRules {
|    <# The tier tag rules with the tagPattern of the merged endpoint schema (locked + custom + Pro overlay); the shipped default when it cannot be read. #>
|    $pattern = $null
|    try {
|        if (-not (Get-Command -Name Get-SISchemaWithCustomMerge -ErrorAction SilentlyContinue)) {
|            . (Join-Path (Split-Path -Parent $PSScriptRoot) 'asset-profiling\shared\Get-SISchemaWithCustomMerge.ps1')
|        }
|        $schema = Get-SISchemaWithCustomMerge -Engine endpoint
|        foreach ($c in @(Get-SIItemValue (Get-SIItemValue $schema 'aggregator') 'contributors')) {
|            if ($null -ne $c -and [string](Get-SIItemValue $c 'id') -eq 'tenant_si_manual_tag') { $pattern = [string](Get-SIItemValue $c 'tagPattern'); break }
|        }
|    } catch { Write-Warning ("CI rules: the endpoint schema could not be read for the tier tag pattern ({0}) -- the shipped pattern is used." -f $_.Exception.Message) }
|    @(ConvertTo-SICiTagTierRules -TagPattern $pattern)
|}
|
|# ---------------------------------------------------------------------------------------------------
|# #690 (48) The identity's tier = the tier of the HIGHEST privilege it holds today (owner 2026-10-15: "identity follows the
|# highest perm a user has today"), as SI tier rules over the privilege tier catalog
|# ---------------------------------------------------------------------------------------------------
|
|function ConvertTo-SICiPrivilegeTierRules {
|    <#
|        PURE. The privilege tier catalog (privilege-tier-catalog.locked.json; -Custom = the tenant's .custom.json, which moves
|        or adds an entry by its key) -> CI tier rules for identities, one per privilege kind and tier 0..2:
|          entra-role-tier<t>      a permanent or eligible Entra role of tier t (the profiler's catalog verdict on the record,
|                                  si_privilege_tier_permanent / _eligible, or the role's name in si_entra_roles_permanent /
|                                  _eligible -- custom roles included)
|          azure-rbac-tier<t>      an Azure RBAC assignment whose effective tier (role tier at its scope) is t
|                                  (si_azure_role_assignments, EffectiveTier)
|          app-permission-tier<t>  an application permission of tier t (si_app_permissions)
|          ad-group-tier<t>        a critical AD group of tier t (si_ad_critical_groups)
|        Every rule is an observed claim (mechanism privilege_catalog, never a fallback, never asserted); the CI's tier is the
|        MIN of every claim, so the account takes the tier of its highest privilege. Tier 3 has no rule: holding only Tier 3
|        privileges is what the default tier already says. Nothing is hard-coded: the names come from the catalog.
|    #>
|    param([Parameter(Mandatory)]$Catalog, $Custom, [int]$StartOrder = 800000)
|    $sect = {
|        param($Doc, [string]$Name)
|        if ($null -eq $Doc) { return @() }
|        $v = Get-SIItemValue $Doc $Name
|        if ($null -eq $v) { return @() }
|        @((Get-SIValueList $v).ToArray())
|    }
|    # key -> tier, the catalog first, then the tenant's file (a custom entry moves its key to its own tier)
|    $byKind = @{ entra = @{}; app = @{}; ad = @{} }
|    $collect = {
|        param($Doc)
|        foreach ($t in 0..3) {
|            foreach ($s in @('EntraID_BuiltInRoles_Tier{0}' -f $t), @('EntraID_CustomRoles_Tier{0}' -f $t)) {
|                foreach ($e in (& $sect $Doc $s)) { $k = [string](Get-SIItemValue $e 'DisplayName'); if ($k) { $byKind.entra[$k.ToLowerInvariant()] = @($k, $t) } }
|            }
|            foreach ($e in (& $sect $Doc ('EntraID_APIPermissions_Tier{0}' -f $t))) {
|                if ([string](Get-SIItemValue $e 'PermissionType') -ne 'Application') { continue }
|                $k = [string](Get-SIItemValue $e 'Value'); if ($k) { $byKind.app[$k.ToLowerInvariant()] = @($k, $t) }
|            }
|            foreach ($s in @('AD_BuiltInPermissionGroups_Tier{0}' -f $t), @('AD_CustomGroups_Tier{0}' -f $t)) {
|                foreach ($e in (& $sect $Doc $s)) { $k = [string](Get-SIItemValue $e 'Name'); if ($k) { $byKind.ad[$k.ToLowerInvariant()] = @($k, $t) } }
|            }
|        }
|    }
|    & $collect $Catalog
|    if ($null -ne $Custom) { & $collect $Custom }
|    $namesOf = { param([hashtable]$Map, [int]$Tier) @($Map.Values | Where-Object { $_[1] -eq $Tier } | ForEach-Object { [string]$_[0] } | Sort-Object -Unique) }
|    $rule = {
|        param([string]$Id, [string]$Name, [int]$Tier, $When)
|        $script:__siPtOrder++
|        [pscustomobject][ordered]@{
|            id = ('identity-privilege/{0}' -f $Id); family = 'ci'; file = 'privilege-tier-catalog/privilege-tier-catalog.locked.json'
|            name = $Name; stage = 'production'; priority = 100; pack = 'IdentityPrivilegeTier'; order = ($StartOrder + $script:__siPtOrder)
|            classes = @('identity'); osScope = @(); fallback = $false; mechanism = 'privilege_catalog'
|            when = $When; set = [ordered]@{ si_tier = $Tier }; exclude = @(); native = $true; asserted = $false
|        }
|    }
|    $script:__siPtOrder = 0
|    foreach ($t in 0..2) {
|        $roles = @(& $namesOf $byKind.entra $t)
|        $any = New-Object System.Collections.Generic.List[object]
|        $any.Add([ordered]@{ field = 'si_privilege_tier_permanent'; op = 'eq'; value = $t })
|        $any.Add([ordered]@{ field = 'si_privilege_tier_eligible'; op = 'eq'; value = $t })
|        if ($roles.Count) {
|            $any.Add([ordered]@{ field = 'si_entra_roles_permanent'; op = 'in'; value = $roles })
|            $any.Add([ordered]@{ field = 'si_entra_roles_eligible'; op = 'in'; value = $roles })
|        }
|        & $rule ('entra-role-tier{0}' -f $t) ('Holds a Tier {0} Entra role (permanent or eligible)' -f $t) $t ([ordered]@{ any = $any.ToArray() })
|        & $rule ('azure-rbac-tier{0}' -f $t) ('Holds a Tier {0} Azure RBAC role at its scope' -f $t) $t ([ordered]@{ any = @([ordered]@{ field = 'si_azure_role_assignments'; op = 'matches'; value = ('(EffectiveTier=|"EffectiveTier"\s*:\s*){0}(?![0-9])' -f $t) }) })
|        $perms = @(& $namesOf $byKind.app $t)
|        if ($perms.Count) { & $rule ('app-permission-tier{0}' -f $t) ('Holds a Tier {0} application permission' -f $t) $t ([ordered]@{ any = @([ordered]@{ field = 'si_app_permissions'; op = 'in'; value = $perms }) }) }
|        $groups = @(& $namesOf $byKind.ad $t)
|        if ($groups.Count) { & $rule ('ad-group-tier{0}' -f $t) ('Member of a Tier {0} AD group' -f $t) $t ([ordered]@{ any = @([ordered]@{ field = 'si_ad_critical_groups'; op = 'in'; value = $groups }) }) }
|    }
|}
|
|function Get-SICiPrivilegeTierRules {
|    <# The identity privilege tier rules from the shipped privilege tier catalog and the tenant's custom file beside it; none (and a warning) when the catalog cannot be read. #>
|    param([string]$Root)
|    if (-not $Root) { $Root = Split-Path -Parent (Split-Path -Parent $PSScriptRoot) }
|    $dir = [System.IO.Path]::Combine($Root, 'privilege-tier-catalog')
|    try {
|        $cat = [System.IO.File]::ReadAllText([System.IO.Path]::Combine($dir, 'privilege-tier-catalog.locked.json')).TrimStart([char]0xFEFF) | ConvertFrom-Json
|        $cus = $null
|        $cp = [System.IO.Path]::Combine($dir, 'privilege-tier-catalog.custom.json')
|        if (Test-Path -LiteralPath $cp) {
|            try { $cus = [System.IO.File]::ReadAllText($cp).TrimStart([char]0xFEFF) | ConvertFrom-Json } catch { Write-Warning ("CI rules: the tenant's privilege tier catalog could not be read ({0}) -- the shipped catalog is used." -f $_.Exception.Message) }
|        }
|        return @(ConvertTo-SICiPrivilegeTierRules -Catalog $cat -Custom $cus)
|    } catch {
|        Write-Warning ("CI rules: the privilege tier catalog could not be read ({0}) -- identities get no privilege tier this run." -f $_.Exception.Message)
|        return @()
|    }
|}
|
|# ---------------------------------------------------------------------------------------------------
|# Manual CI overrides (precedence 1)
|# ---------------------------------------------------------------------------------------------------
|
|function Get-SICiOverrideReadSql {
|    <# Every override in force (not expired). A database without the table answers no rows (it is created by the updater). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.CiOverride') IS NULL
|    SELECT CAST(NULL AS NVARCHAR(64)) AS CiId, CAST(NULL AS NVARCHAR(64)) AS Field, CAST(NULL AS NVARCHAR(400)) AS Value, CAST(NULL AS NVARCHAR(1000)) AS Reason,
|           CAST(NULL AS NVARCHAR(256)) AS SetBy, CAST(NULL AS DATETIME2(0)) AS SetAt, CAST(NULL AS DATETIME2(0)) AS ExpiresAt WHERE 1 = 0;
|ELSE
|    EXEC sp_executesql N'SELECT CiId, Field, Value, Reason, SetBy, SetAt, ExpiresAt FROM sidata.CiOverride WHERE (ExpiresAt IS NULL OR ExpiresAt > SYSUTCDATETIME()) AND ISNULL(Removed, 0) = 0';
|'@
|}
|
|function ConvertTo-SICiOverrideIndex {
|    <#
|        PURE. Override rows -> CiId (case-insensitive) -> [ { field; value; reason; set_by; set_at; expires_at } ]. Expired rows
|        (ExpiresAt <= -Now) and rows for a field that may not be overridden are left out. Overridable: si_tier, si_purpose,
|        si_category, si_department, si_cmdb_* (CMDB fields), si_lifecycle is NOT (it is evidence, never a decision).
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [datetime]$Now = [datetime]::UtcNow)
|    $idx = New-Object System.Collections.Hashtable ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($r in $Rows) {
|        if ($null -eq $r) { continue }
|        $ci = [string](Get-SIItemValue $r 'CiId'); $f = ([string](Get-SIItemValue $r 'Field')).Trim().ToLowerInvariant()
|        if (-not $ci -or -not $f) { continue }
|        if ($f -notmatch '^(si_tier|si_purpose|si_category|si_department|si_cmdb_[a-z_]+)$') { continue }
|        $exp = ConvertTo-SIUtcOrNull (Get-SIItemValue $r 'ExpiresAt')
|        if ($exp -and $exp -le $Now) { continue }
|        if (-not $idx.ContainsKey($ci)) { $idx[$ci] = New-Object System.Collections.Generic.List[object] }
|        $idx[$ci].Add([ordered]@{ field = $f; value = (Get-SIItemValue $r 'Value'); reason = [string](Get-SIItemValue $r 'Reason'); set_by = [string](Get-SIItemValue $r 'SetBy')
|                set_at = (ConvertTo-SIUtcOrNull (Get-SIItemValue $r 'SetAt')); expires_at = $exp })
|    }
|    # plain arrays (a caller's @() around a generic list throws "Argument types do not match")
|    foreach ($k in @($idx.Keys)) { $idx[$k] = $idx[$k].ToArray() }
|    $idx
|}
|
|function Set-SICiOverrides {
|    <#
|        PURE. The manual overrides of one CI applied OVER the rules' result (precedence 1, V3-DATA-MODEL 2.8): the field takes
|        the override's value; si_tier sets si_tier_set_by = override and si_tier_reason = the override's reason; the claim the
|        rules would have chosen stays in si_tier_claims (marked not winning). Every override in force -> si_overrides.
|    #>
|    param([Parameter(Mandatory)]$Ci, [hashtable]$Index)
|    if ($null -eq $Index) { return $Ci }
|    $id = [string]$Ci['si_ci_id']
|    if (-not $id -or -not $Index.ContainsKey($id)) { return $Ci }
|    $applied = New-Object System.Collections.Generic.List[object]
|    foreach ($o in $Index[$id]) {
|        $f = [string]$o.field
|        if ($f -eq 'si_tier') {
|            $t = 0
|            if (-not [int]::TryParse([string]$o.value, [ref]$t) -or $t -lt 0 -or $t -gt 3) { continue }
|            $was = $Ci['si_tier']
|            $Ci['si_tier'] = $t
|            $Ci['si_tier_set_by'] = 'override'
|            $Ci['si_tier_reason'] = ('manual override by {0}: {1}' -f $(if ($o.set_by) { $o.set_by } else { 'an administrator' }), $o.reason)
|            foreach ($c in @($Ci['si_tier_claims'])) { if ($c -and $c['winner']) { $c['winner'] = $false } }
|            $applied.Add([ordered]@{ field = $f; value = $t; rules_value = $was; reason = $o.reason; set_by = $o.set_by; set_at = $o.set_at; expires_at = $o.expires_at })
|            continue
|        }
|        $was = $Ci[$f]
|        $Ci[$f] = $o.value
|        $applied.Add([ordered]@{ field = $f; value = $o.value; rules_value = $was; reason = $o.reason; set_by = $o.set_by; set_at = $o.set_at; expires_at = $o.expires_at })
|    }
|    if ($applied.Count -gt 0) { $Ci['si_overrides'] = $applied.ToArray() }
|    # #579 the explanation names the override (who, reason, expiry) and what the rules would have chosen
|    if (@($applied | Where-Object { $_.field -eq 'si_tier' }).Count -gt 0 -and (Get-Command -Name Get-SICiTierExplanation -ErrorAction SilentlyContinue)) { $Ci['si_tier_explanation'] = Get-SICiTierExplanation -Ci $Ci }
|    return $Ci
|}
'@ }
$__siSupportFiles['engine/asset-profiling/shared/Get-SISchemaWithCustomMerge.ps1'] = @{ Sha256 = 'f5afebb232c70fadc4d5f133af68f008781c932545b0279f0bcc5a8797667a1e'; Text = @'
|#Requires -Version 5.1
|<#
|    Get-SISchemaWithCustomMerge.ps1
|
|    Loads profiles/<engine>.schema.json (locked) and merges it with the
|    optional profiles-custom/<engine>.schema.custom.json (customer
|    overlay). Used by every row builder + tier computer so the engine reads
|    the SAME merged schema regardless of source.
|
|    Merge semantics (mirrors the locked+custom pattern already used for
|    posture rules + privilege-tier-classifier catalog + endpoint-tiering catalog):
|
|      fields[*]                        -- same `name`     => REPLACES locked
|                                         -- new `name`      => APPENDS
|      aggregator.contributors[*]       -- same `id`       => REPLACES locked
|                                         -- new `id`        => APPENDS
|      rawPayload.sources.<src>.includePaths[*]
|                                       -- UNION (de-duped, locked first)
|      rawPayload.sources.<new-src>     -- new source bucket entirely => ADD
|      hashes / entityIds / aiEligibility / engine-meta
|                                       -- UNCHANGED (cannot be overridden;
|                                          these are engine invariants)
|
|    Cached per engine on first call. To force a reload (rare -- e.g., during
|    development), call: $script:_SISchemaMergeCache.Remove('<engine>')
|
|    Customer drops their override at:
|        v2.2/asset-profiling-schema/<engine>.schema.custom.json
|
|    See profiles-custom/<engine>.schema.custom.sample.json for a working
|    template per engine.
|#>
|
|if (-not (Get-Variable -Name _SISchemaMergeCache -Scope Script -ErrorAction SilentlyContinue)) {
|    $script:_SISchemaMergeCache = @{}
|}
|
|function Get-SISchemaWithCustomMerge {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)]
|        [ValidateSet('identity','endpoint','azure','publicip')]
|        [string]$Engine,
|
|        [switch]$NoCache    # force re-read + re-merge (development helper)
|    )
|
|    if (-not $NoCache -and $script:_SISchemaMergeCache.ContainsKey($Engine)) {
|        return $script:_SISchemaMergeCache[$Engine]
|    }
|
|    # Resolve solution paths from this script's location.
|    # $PSScriptRoot = v2.2/engine/asset-profiling/shared -> three parents = v2.2 root.
|    $siRoot    = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))
|    # publicip schema file is named 'public-ip.schema.json' (hyphen) for
|    # readability; engine token stays 'publicip' everywhere else.
|    $fileBase   = if ($Engine -eq 'publicip') { 'public-ip' } else { $Engine }
|    $lockedPath = Join-Path $siRoot ('asset-profiling-schema\{0}.schema.locked.json' -f $fileBase)
|    $customPath = Join-Path $siRoot ('asset-profiling-schema\{0}.schema.custom.json' -f $fileBase)
|    # SecurityInsight Pro (Phase C): a schema overlay materialised from the settings database wins over the installation's.
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_ProConfigRoot)) {
|        $proCustom = [IO.Path]::Combine([string]$global:SI_ProConfigRoot, 'asset-profiling-schema', ('{0}.schema.custom.json' -f $fileBase))
|        if (Test-Path -LiteralPath $proCustom) { $customPath = $proCustom }
|    }
|
|    if (-not (Test-Path $lockedPath)) {
|        throw ('Locked schema not found at {0}' -f $lockedPath)
|    }
|
|    $locked = Get-Content $lockedPath -Raw -Encoding UTF8 | ConvertFrom-Json
|
|    # Locked-only path -- no custom overlay present
|    if (-not (Test-Path $customPath)) {
|        $script:_SISchemaMergeCache[$Engine] = $locked
|        return $locked
|    }
|
|    $custom = $null
|    try {
|        $custom = Get-Content $customPath -Raw -Encoding UTF8 | ConvertFrom-Json
|    } catch {
|        Write-Warning ("Custom schema overlay parse failed for engine '{0}'; using locked-only. Path: {1}. Error: {2}" -f $Engine, $customPath, $_.Exception.Message)
|        $script:_SISchemaMergeCache[$Engine] = $locked
|        return $locked
|    }
|    if (-not $custom) {
|        $script:_SISchemaMergeCache[$Engine] = $locked
|        return $locked
|    }
|
|    # ---- 1. Merge fields[] -----------------------------------------------
|    $fieldsAdded    = 0
|    $fieldsReplaced = 0
|    if ($custom.PSObject.Properties['fields'] -and $custom.fields) {
|        $merged = New-Object System.Collections.ArrayList
|        foreach ($f in $locked.fields) { [void]$merged.Add($f) }
|        $existingByName = @{}
|        for ($i = 0; $i -lt $merged.Count; $i++) {
|            if ($merged[$i].PSObject.Properties['name']) { $existingByName[[string]$merged[$i].name] = $i }
|        }
|        foreach ($cf in $custom.fields) {
|            if (-not $cf.PSObject.Properties['name']) { continue }
|            $cn = [string]$cf.name
|            if ($existingByName.ContainsKey($cn)) {
|                $merged[$existingByName[$cn]] = $cf
|                $fieldsReplaced++
|            } else {
|                [void]$merged.Add($cf)
|                $existingByName[$cn] = $merged.Count - 1
|                $fieldsAdded++
|            }
|        }
|        $locked.fields = $merged.ToArray()
|    }
|
|    # ---- 2. Merge aggregator.contributors[] ------------------------------
|    $contribAdded    = 0
|    $contribReplaced = 0
|    if ($custom.PSObject.Properties['aggregator'] -and $custom.aggregator -and
|        $custom.aggregator.PSObject.Properties['contributors'] -and $custom.aggregator.contributors) {
|        if (-not $locked.aggregator) {
|            # No locked aggregator at all; lift the custom one verbatim
|            $locked | Add-Member -NotePropertyName aggregator -NotePropertyValue $custom.aggregator -Force
|        } else {
|            $merged = New-Object System.Collections.ArrayList
|            foreach ($c in $locked.aggregator.contributors) { [void]$merged.Add($c) }
|            $existingById = @{}
|            for ($i = 0; $i -lt $merged.Count; $i++) {
|                if ($merged[$i].PSObject.Properties['id']) { $existingById[[string]$merged[$i].id] = $i }
|            }
|            foreach ($cc in $custom.aggregator.contributors) {
|                if (-not $cc.PSObject.Properties['id']) { continue }
|                $cid = [string]$cc.id
|                if ($existingById.ContainsKey($cid)) {
|                    $merged[$existingById[$cid]] = $cc
|                    $contribReplaced++
|                } else {
|                    [void]$merged.Add($cc)
|                    $existingById[$cid] = $merged.Count - 1
|                    $contribAdded++
|                }
|            }
|            $locked.aggregator.contributors = $merged.ToArray()
|        }
|    }
|
|    # ---- 3. Merge rawPayload.sources.<src>.includePaths[] (UNION) --------
|    $pathsAdded   = 0
|    $sourcesAdded = 0
|    if ($custom.PSObject.Properties['rawPayload'] -and $custom.rawPayload -and
|        $custom.rawPayload.PSObject.Properties['sources'] -and $custom.rawPayload.sources) {
|        foreach ($srcProp in $custom.rawPayload.sources.PSObject.Properties) {
|            $srcName = $srcProp.Name
|            $cs      = $srcProp.Value
|            $ls      = $null
|            if ($locked.rawPayload -and $locked.rawPayload.sources -and
|                $locked.rawPayload.sources.PSObject.Properties[$srcName]) {
|                $ls = $locked.rawPayload.sources.$srcName
|            }
|            if (-not $ls) {
|                # Entirely new source bucket
|                $locked.rawPayload.sources | Add-Member -NotePropertyName $srcName -NotePropertyValue $cs -Force
|                $sourcesAdded++
|                continue
|            }
|            if ($cs.PSObject.Properties['includePaths'] -and $cs.includePaths) {
|                $existing  = if ($ls.PSObject.Properties['includePaths'] -and $ls.includePaths) { @($ls.includePaths) } else { @() }
|                $additions = @($cs.includePaths) | Where-Object { $_ -notin $existing }
|                if ($additions.Count -gt 0) {
|                    $ls.includePaths = @($existing + $additions)
|                    $pathsAdded += $additions.Count
|                }
|            }
|        }
|    }
|
|    # ---- Diagnostic summary (only when something actually changed) -------
|    if ($fieldsAdded + $fieldsReplaced + $contribAdded + $contribReplaced + $pathsAdded + $sourcesAdded -gt 0) {
|        Write-SIInfo ('   [schema] {0} custom overlay merged: fields +{1}/replaced {2}, contributors +{3}/replaced {4}, includePaths +{5}, new source buckets +{6}' -f `
|            $Engine, $fieldsAdded, $fieldsReplaced, $contribAdded, $contribReplaced, $pathsAdded, $sourcesAdded)
|    }
|
|    $script:_SISchemaMergeCache[$Engine] = $locked
|    return $locked
|}
'@ }
$__siSupportFiles['data-model/rules/AssetTagging.locked.yaml'] = @{ Sha256 = 'ae7bda074da9db8f63c7b477b8219c44c619280a352591ad56251533b3cedb40'; Text = @'
|# SecurityInsight -- the AssetTagging rule pack on the CI (#462, V3-DATA-MODEL 2.8).
|# The asset-tagging engine (asset-profiling-enrichment/endpoint/AssetTagging.locked.yaml) decides its auto-exclusion
|# tags with KQL against Defender and WRITES them to Defender. This pack states the same decisions over SI FIELDS, so the
|# CI carries the tag the engine writes (si_tags, source rule) -- one rule model, no provider names.
|# The engine's switches apply here too: config_flag names its AutoExcludeRules.* switch (config/asset-tagging.config.json)
|# and the rule runs ONLY when that switch is true -- no file, no switch or false = the rule is not used (#643: every tag
|# here is an EXCLUSION, which every report honours, so it is the customer's choice and never a default -- the same rule as
|# the tagging engine and the shipped sample). config_patterns takes the condition from its DeviceNamePatterns
|# (StartsWith / Contains / MatchesRegex).
|# Customer changes: data-model/rules/AssetTagging.custom.yaml (or the data-model overlay's rules/ folder), one rule per id.
|# The pack header (name, stage, priority, source) is what the Rule packs page shows; a custom file may set stage /
|# enabled for the whole pack (Pro: Configuration > Rule packs, through Review & commit).
|name: Asset tagging
|description: Tags the devices Defender cannot onboard, has too little information about or does not support, and the devices whose name matches an exclusion pattern.
|stage: production
|priority: 100
|source: shipped
|rules:
|  - id: asset-tagging/can-be-onboarded
|    name: Defender can onboard this device, it is not onboarded
|    stage: production
|    priority: 100
|    applies_to: [device]
|    mechanism: mde.detection
|    config_flag: AutoExcludeRules.ExcludeCanBeOnboarded
|    when:
|      any:
|        - si_onboarding_status:
|            eq: can_be_onboarded
|    set:
|      si_tags: [Auto-CanBeOnboarded--Excluded--SI]
|  - id: asset-tagging/insufficient-info
|    name: Defender has insufficient information about this device
|    stage: production
|    priority: 100
|    applies_to: [device]
|    mechanism: mde.detection
|    config_flag: AutoExcludeRules.ExcludeInsufficientInfo
|    when:
|      any:
|        - si_onboarding_status:
|            eq: insufficient_info
|    set:
|      si_tags: [Auto-InsufficientInfo--Excluded--SI]
|  - id: asset-tagging/unsupported
|    name: Defender does not support this device
|    stage: production
|    priority: 100
|    applies_to: [device]
|    mechanism: mde.detection
|    config_flag: AutoExcludeRules.ExcludeUnsupported
|    when:
|      any:
|        - si_onboarding_status:
|            eq: unsupported
|    set:
|      si_tags: [Auto-Unsupported--Excluded--SI]
|  - id: asset-tagging/name-pattern
|    name: The device name matches an exclusion pattern
|    stage: production
|    priority: 100
|    applies_to: [device]
|    mechanism: name.pattern
|    config_flag: AutoExcludeRules.ExcludeByDeviceNamePattern
|    config_patterns: DeviceNamePatterns
|    when:
|      any:
|        - si_asset_name:
|            is_empty: true
|    set:
|      si_tags: [Auto-NamePattern--Excluded--SI]
'@ }
$__siSupportFiles['privilege-tier-catalog/privilege-tier-catalog.locked.json'] = @{ Sha256 = '9350070a214aca2618d93fb10c8e7fc3e8701149e663355d21a4ec05fadc3499'; Text = @'
|{
|    "Metadata":  {
|                     "GeneratedAt":  "2026-05-03 00:08:22",
|                     "GeneratedBy":  "SecurityInsight-PrivilegeTierClassifier.ps1 v2.0",
|                     "TenantId":  "<redacted -- audit #21>",
|                     "TieringModel":  "Attacker-centric (0=immediate compromise, 3=low blast radius)",
|                     "AICallsUsed":  4
|                 },
|    "AD_BuiltInPermissionGroups_Tier0":  [
|                                             {
|                                                 "Name":  "Administrators",
|                                                 "Tier":  0,
|                                                 "Reason":  "Full control over the domain and ability to assign roles or reset credentials, enabling immediate full environment compromise."
|                                             },
|                                             {
|                                                 "Name":  "Domain Admins",
|                                                 "Tier":  0,
|                                                 "Reason":  "Full domain control enabling immediate full environment compromise."
|                                             },
|                                             {
|                                                 "Name":  "Domain Controllers",
|                                                 "Tier":  0,
|                                                 "Reason":  "Membership grants control over domain controllers enabling full domain compromise."
|                                             },
|                                             {
|                                                 "Name":  "Schema Admins",
|                                                 "Tier":  0,
|                                                 "Reason":  "Can modify AD schema, enabling full domain compromise and identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Enterprise Admins",
|                                                 "Tier":  0,
|                                                 "Reason":  "Highest privilege group with full forest-wide control enabling immediate full environment compromise."
|                                             },
|                                             {
|                                                 "Name":  "Group Policy Creator Owners",
|                                                 "Tier":  0,
|                                                 "Reason":  "Can create and modify GPOs affecting tier 0 objects, enabling full domain compromise."
|                                             },
|                                             {
|                                                 "Name":  "Cert Publishers",
|                                                 "Tier":  0,
|                                                 "Reason":  "Can publish certificates to AD, enabling issuance of certificates for domain controllers and full compromise."
|                                             },
|                                             {
|                                                 "Name":  "Enterprise Domain Controllers",
|                                                 "Tier":  0,
|                                                 "Reason":  "Group for all domain controllers with full control enabling immediate full environment compromise."
|                                             },
|                                             {
|                                                 "Name":  "SYSTEM",
|                                                 "Tier":  0,
|                                                 "Reason":  "Highest privilege account on Windows systems; full control over domain controllers and identity plane."
|                                             }
|                                         ],
|    "AD_BuiltInPermissionGroups_Tier1":  [
|                                             {
|                                                 "Name":  "Print Operators",
|                                                 "Tier":  1,
|                                                 "Reason":  "Can manage printers and potentially escalate privileges via print spooler vulnerabilities or local admin rights on servers."
|                                             },
|                                             {
|                                                 "Name":  "Backup Operators",
|                                                 "Tier":  1,
|                                                 "Reason":  "Can back up and restore files including sensitive data and potentially escalate privileges via backup restoration or SeBackupPrivilege."
|                                             },
|                                             {
|                                                 "Name":  "Server Operators",
|                                                 "Tier":  1,
|                                                 "Reason":  "Can manage servers including starting/stopping services and creating users, enabling privilege escalation to domain admin in some cases."
|                                             },
|                                             {
|                                                 "Name":  "Account Operators",
|                                                 "Tier":  1,
|                                                 "Reason":  "Can create, modify, and delete user accounts except admins, enabling privilege escalation to domain admin."
|                                             },
|                                             {
|                                                 "Name":  "Key Admins",
|                                                 "Tier":  1,
|                                                 "Reason":  "Can manage cryptographic keys impacting identity plane security and enabling privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Enterprise Key Admins",
|                                                 "Tier":  1,
|                                                 "Reason":  "Can manage enterprise cryptographic keys enabling privilege escalation and identity plane control."
|                                             }
|                                         ],
|    "AD_BuiltInPermissionGroups_Tier2":  [
|                                             {
|                                                 "Name":  "Hyper-V Administrators",
|                                                 "Tier":  2,
|                                                 "Reason":  "Can manage Hyper-V hosts and VMs, enabling potential data or workload impact but no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Storage Replica Administrators",
|                                                 "Tier":  2,
|                                                 "Reason":  "Can manage storage replication, impacting workloads but no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "DnsAdmins",
|                                                 "Tier":  2,
|                                                 "Reason":  "Can manage DNS, enabling potential code execution on DCs but requires additional steps for full compromise."
|                                             }
|                                         ],
|    "AD_BuiltInPermissionGroups_Tier3":  [
|                                             {
|                                                 "Name":  "Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Default group for standard users with no direct path to identity plane control or tenant takeover."
|                                             },
|                                             {
|                                                 "Name":  "Guests",
|                                                 "Tier":  3,
|                                                 "Reason":  "Limited access group for guest accounts with no escalation path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Replicator",
|                                                 "Tier":  3,
|                                                 "Reason":  "Used for file replication with no direct identity plane control or privilege escalation path."
|                                             },
|                                             {
|                                                 "Name":  "Remote Desktop Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Allows remote desktop access but no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Network Configuration Operators",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can manage network configuration but no direct path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Performance Monitor Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can monitor performance counters but no identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Performance Log Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can manage performance logs but no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Distributed COM Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can launch DCOM applications but no direct path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "IIS_IUSRS",
|                                                 "Tier":  3,
|                                                 "Reason":  "Group for IIS worker process identity with no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Cryptographic Operators",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can perform cryptographic operations but no direct path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Event Log Readers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Read access to event logs only; no identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Certificate Service DCOM Access",
|                                                 "Tier":  3,
|                                                 "Reason":  "Allows access to certificate services DCOM interface but no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "RDS Remote Access Servers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Role for Remote Desktop Services with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "RDS Endpoint Servers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Role for Remote Desktop Services with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "RDS Management Servers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Role for Remote Desktop Services with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Access Control Assistance Operators",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can remotely query authorization attributes but no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Remote Management Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can perform remote management tasks but no direct path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Pre-Windows 2000 Compatible Access",
|                                                 "Tier":  3,
|                                                 "Reason":  "Legacy group for backward compatibility with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Incoming Forest Trust Builders",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can create incoming forest trusts but no direct identity plane control or credential access."
|                                             },
|                                             {
|                                                 "Name":  "Windows Authorization Access Group",
|                                                 "Tier":  3,
|                                                 "Reason":  "Allows reading of authorization attributes but no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Terminal Server License Servers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Manages TS licensing with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Domain Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Default group for all domain users with no direct path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Domain Guests",
|                                                 "Tier":  3,
|                                                 "Reason":  "Default group for guest accounts with no escalation path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Domain Computers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Group for domain-joined computers with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Read-only Domain Controllers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Read-only access to DCs with no write or identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Enterprise Read-only Domain Controllers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Read-only access to enterprise DCs with no write or identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Cloneable Domain Controllers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Allows cloning of DCs but no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Protected Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Security group to protect users from credential theft, no privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "DnsUpdateProxy",
|                                                 "Tier":  3,
|                                                 "Reason":  "Allows DNS updates with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "RAS and IAS Servers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Role for remote access servers with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Allowed RODC Password Replication Group",
|                                                 "Tier":  3,
|                                                 "Reason":  "Controls which passwords can be cached on RODCs, no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Denied RODC Password Replication Group",
|                                                 "Tier":  3,
|                                                 "Reason":  "Controls which passwords cannot be cached on RODCs, no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Everyone",
|                                                 "Tier":  3,
|                                                 "Reason":  "Includes all users and guests with no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Authenticated Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Default group including all authenticated users; no direct identity plane control or privilege escalation path."
|                                             },
|                                             {
|                                                 "Name":  "Creator Owner",
|                                                 "Tier":  3,
|                                                 "Reason":  "Special identity representing the creator of an object; no direct path to tenant or domain takeover."
|                                             },
|                                             {
|                                                 "Name":  "Network",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents network logon type; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Interactive",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents interactive logon type; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Service",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents service logon type; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Dialup",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents dial-up logon type; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Anonymous Logon",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents anonymous logon; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Batch",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents batch logon type; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Proxy",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents proxy logon type; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "SELF",
|                                                 "Tier":  3,
|                                                 "Reason":  "Special identity representing the object itself; no direct path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Creator Group",
|                                                 "Tier":  3,
|                                                 "Reason":  "Special identity representing the creator\u0027s primary group; no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Local Service",
|                                                 "Tier":  3,
|                                                 "Reason":  "Built-in service account with limited privileges; no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Network Service",
|                                                 "Tier":  3,
|                                                 "Reason":  "Built-in service account with limited privileges; no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Remote Interactive Logon",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents remote interactive logon type; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "This Organization",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents all users in the organization; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Other Organization",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents users outside the organization; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "IUSR",
|                                                 "Tier":  3,
|                                                 "Reason":  "Built-in account for anonymous IIS access; no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Terminal Server User",
|                                                 "Tier":  3,
|                                                 "Reason":  "Group for terminal server users; no direct identity plane control or privilege escalation."
|                                             }
|                                         ],
|    "EntraID_BuiltInRoles_Tier0":  [
|                                       {
|                                           "Id":  "62e90394-69f5-4237-9190-012177145e10",
|                                           "DisplayName":  "Global Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  0,
|                                           "Reason":  "Direct full tenant control including role assignments and identity plane permissions enabling immediate full environment compromise.",
|                                           "Permissions":  [
|                                                               "microsoft.agentRegistry/allEntities/allProperties/allTasks",
|                                                               "microsoft.azure.advancedThreatProtection/allEntities/allTasks",
|                                                               "microsoft.azure.informationProtection/allEntities/allTasks",
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.backup/allEntities/allProperties/allTasks",
|                                                               "microsoft.cloudPC/allEntities/allProperties/allTasks",
|                                                               "microsoft.commerce.billing/allEntities/allProperties/allTasks",
|                                                               "microsoft.commerce.billing/purchases/standard/read",
|                                                               "microsoft.commerce.tenantRelationships/customerDelegatedAdminPrivileges/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions/allProperties/allTasks",
|                                                               "microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks",
|                                                               "microsoft.directory/administrativeUnits/allProperties/allTasks",
|                                                               "microsoft.directory/appConsent/appConsentRequests/allProperties/read",
|                                                               "microsoft.directory/applications/allProperties/allTasks",
|                                                               "microsoft.directory/applications/disablement/update",
|                                                               "microsoft.directory/applications/synchronization/standard/read",
|                                                               "microsoft.directory/applicationTemplates/instantiate",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/authorizationPolicy/allProperties/allTasks",
|                                                               "microsoft.directory/backup/preview/cancel",
|                                                               "microsoft.directory/backup/preview/create",
|                                                               "microsoft.directory/backup/recovery/cancel",
|                                                               "microsoft.directory/backup/recovery/create",
|                                                               "microsoft.directory/backup/standard/read",
|                                                               "microsoft.directory/bitlockerKeys/key/read",
|                                                               "microsoft.directory/bulkJobs/basic/update",
|                                                               "microsoft.directory/bulkJobs/create",
|                                                               "microsoft.directory/bulkJobs/standard/read",
|                                                               "microsoft.directory/cloudAppSecurity/allProperties/allTasks",
|                                                               "microsoft.directory/conditionalAccessPolicies/allProperties/allTasks",
|                                                               "microsoft.directory/connectorGroups/allProperties/read",
|                                                               "microsoft.directory/connectorGroups/allProperties/update",
|                                                               "microsoft.directory/connectorGroups/create",
|                                                               "microsoft.directory/connectorGroups/delete",
|                                                               "microsoft.directory/connectors/allProperties/read",
|                                                               "microsoft.directory/connectors/create",
|                                                               "microsoft.directory/contacts/allProperties/allTasks",
|                                                               "microsoft.directory/contracts/allProperties/allTasks",
|                                                               "microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/b2bCollaboration/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/b2bDirectConnect/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/tenantRestrictions/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/b2bCollaboration/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/b2bDirectConnect/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/create",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/delete",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/create",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/resetToDefaultSettings",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/resetToDefaultSettings",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/standard/read",
|                                                               "microsoft.directory/customAuthenticationExtensions/allProperties/allTasks",
|                                                               "microsoft.directory/deletedItems/delete",
|                                                               "microsoft.directory/deletedItems/restore",
|                                                               "microsoft.directory/deviceLocalCredentials/password/read",
|                                                               "microsoft.directory/deviceManagementPolicies/basic/update",
|                                                               "microsoft.directory/deviceManagementPolicies/standard/read",
|                                                               "microsoft.directory/deviceRegistrationPolicy/basic/update",
|                                                               "microsoft.directory/deviceRegistrationPolicy/standard/read",
|                                                               "microsoft.directory/devices/allProperties/allTasks",
|                                                               "microsoft.directory/devices/permissions/update",
|                                                               "microsoft.directory/deviceTemplates/owners/read",
|                                                               "microsoft.directory/deviceTemplates/owners/update",
|                                                               "microsoft.directory/directoryRoles/allProperties/allTasks",
|                                                               "microsoft.directory/directoryRoleTemplates/allProperties/allTasks",
|                                                               "microsoft.directory/domains/allProperties/allTasks",
|                                                               "microsoft.directory/domains/federationConfiguration/basic/update",
|                                                               "microsoft.directory/domains/federationConfiguration/create",
|                                                               "microsoft.directory/domains/federationConfiguration/delete",
|                                                               "microsoft.directory/domains/federationConfiguration/standard/read",
|                                                               "microsoft.directory/entitlementManagement/allProperties/allTasks",
|                                                               "microsoft.directory/externalUserProfiles/basic/update",
|                                                               "microsoft.directory/externalUserProfiles/delete",
|                                                               "microsoft.directory/externalUserProfiles/standard/read",
|                                                               "microsoft.directory/groups/allProperties/allTasks",
|                                                               "microsoft.directory/groupsAssignableToRoles/allProperties/update",
|                                                               "microsoft.directory/groupsAssignableToRoles/assignLicense",
|                                                               "microsoft.directory/groupsAssignableToRoles/create",
|                                                               "microsoft.directory/groupsAssignableToRoles/delete",
|                                                               "microsoft.directory/groupsAssignableToRoles/reprocessLicenseAssignment",
|                                                               "microsoft.directory/groupsAssignableToRoles/restore",
|                                                               "microsoft.directory/groupSettings/allProperties/allTasks",
|                                                               "microsoft.directory/groupSettingTemplates/allProperties/allTasks",
|                                                               "microsoft.directory/hybridAuthenticationPolicy/allProperties/allTasks",
|                                                               "microsoft.directory/identityProtection/allProperties/allTasks",
|                                                               "microsoft.directory/lifecycleWorkflows/workflows/allProperties/allTasks",
|                                                               "microsoft.directory/loginOrganizationBranding/allProperties/allTasks",
|                                                               "microsoft.directory/multiTenantOrganization/basic/update",
|                                                               "microsoft.directory/multiTenantOrganization/create",
|                                                               "microsoft.directory/multiTenantOrganization/joinRequest/organizationDetails/update",
|                                                               "microsoft.directory/multiTenantOrganization/joinRequest/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/create",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/delete",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/organizationDetails/update",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/standard/read",
|                                                               "microsoft.directory/namedLocations/basic/update",
|                                                               "microsoft.directory/namedLocations/create",
|                                                               "microsoft.directory/namedLocations/delete",
|                                                               "microsoft.directory/namedLocations/standard/read",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks",
|                                                               "microsoft.directory/onPremisesSynchronization/basic/update",
|                                                               "microsoft.directory/onPremisesSynchronization/standard/read",
|                                                               "microsoft.directory/organization/allProperties/allTasks",
|                                                               "microsoft.directory/passwordHashSync/allProperties/allTasks",
|                                                               "microsoft.directory/pendingExternalUserProfiles/basic/update",
|                                                               "microsoft.directory/pendingExternalUserProfiles/create",
|                                                               "microsoft.directory/pendingExternalUserProfiles/delete",
|                                                               "microsoft.directory/pendingExternalUserProfiles/standard/read",
|                                                               "microsoft.directory/permissionGrantPolicies/basic/update",
|                                                               "microsoft.directory/permissionGrantPolicies/create",
|                                                               "microsoft.directory/permissionGrantPolicies/delete",
|                                                               "microsoft.directory/permissionGrantPolicies/standard/read",
|                                                               "microsoft.directory/policies/allProperties/allTasks",
|                                                               "microsoft.directory/privilegedIdentityManagement/allProperties/read",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/update",
|                                                               "microsoft.directory/roleAssignments/allProperties/allTasks",
|                                                               "microsoft.directory/roleDefinitions/allProperties/allTasks",
|                                                               "microsoft.directory/scopedRoleMemberships/allProperties/allTasks",
|                                                               "microsoft.directory/serviceAction/activateService",
|                                                               "microsoft.directory/serviceAction/disableDirectoryFeature",
|                                                               "microsoft.directory/serviceAction/enableDirectoryFeature",
|                                                               "microsoft.directory/serviceAction/getAvailableExtentionProperties",
|                                                               "microsoft.directory/servicePrincipalCreationPolicies/basic/update",
|                                                               "microsoft.directory/servicePrincipalCreationPolicies/create",
|                                                               "microsoft.directory/servicePrincipalCreationPolicies/delete",
|                                                               "microsoft.directory/servicePrincipalCreationPolicies/standard/read",
|                                                               "microsoft.directory/servicePrincipals/allProperties/allTasks",
|                                                               "microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-company-admin",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization/standard/read",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.directory/subscribedSkus/allProperties/allTasks",
|                                                               "microsoft.directory/tenantManagement/tenants/create",
|                                                               "microsoft.directory/users/allProperties/allTasks",
|                                                               "microsoft.directory/users/authenticationMethods/basic/update",
|                                                               "microsoft.directory/users/authenticationMethods/create",
|                                                               "microsoft.directory/users/authenticationMethods/delete",
|                                                               "microsoft.directory/users/authenticationMethods/standard/read",
|                                                               "microsoft.directory/users/convertExternalToInternalMemberUser",
|                                                               "microsoft.directory/verifiableCredentials/configuration/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/allProperties/update",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/update",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/cards/revoke",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/create",
|                                                               "microsoft.directory/verifiableCredentials/configuration/create",
|                                                               "microsoft.directory/verifiableCredentials/configuration/delete",
|                                                               "microsoft.dynamics365/allEntities/allTasks",
|                                                               "microsoft.edge/allEntities/allProperties/allTasks",
|                                                               "microsoft.flow/allEntities/allTasks",
|                                                               "microsoft.graph.dataConnect/allEntities/allProperties/allTasks",
|                                                               "microsoft.hardware.support/shippingAddress/allProperties/allTasks",
|                                                               "microsoft.hardware.support/shippingStatus/allProperties/read",
|                                                               "microsoft.hardware.support/warrantyClaims/allProperties/allTasks",
|                                                               "microsoft.healthPlatform/allEntities/allProperties/allTasks",
|                                                               "microsoft.insights/allEntities/allProperties/allTasks",
|                                                               "microsoft.intune/allEntities/allTasks",
|                                                               "microsoft.microsoft365.organizationalData/allEntities/allProperties/allTasks",
|                                                               "microsoft.networkAccess/allEntities/allProperties/allTasks",
|                                                               "microsoft.networkAccess/trafficLogs/standard/read",
|                                                               "microsoft.office365.complianceManager/allEntities/allTasks",
|                                                               "microsoft.office365.copilot/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.desktopAnalytics/allEntities/allTasks",
|                                                               "microsoft.office365.exchange/allEntities/basic/allTasks",
|                                                               "microsoft.office365.fileStorageContainers/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.knowledge/contentUnderstanding/allProperties/allTasks",
|                                                               "microsoft.office365.knowledge/contentUnderstanding/analytics/allProperties/read",
|                                                               "microsoft.office365.knowledge/knowledgeNetwork/allProperties/allTasks",
|                                                               "microsoft.office365.knowledge/knowledgeNetwork/topicVisibility/allProperties/allTasks",
|                                                               "microsoft.office365.knowledge/learningSources/allProperties/allTasks",
|                                                               "microsoft.office365.lockbox/allEntities/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.messageCenter/securityMessages/read",
|                                                               "microsoft.office365.migrations/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.organizationalMessages/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.protectionCenter/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.search/content/manage",
|                                                               "microsoft.office365.securityComplianceCenter/allEntities/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.sharePointAdvancedManagement/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.sharePoint/allEntities/allTasks",
|                                                               "microsoft.office365.skypeForBusiness/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.userCommunication/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.office365.yammer/allEntities/allProperties/allTasks",
|                                                               "microsoft.peopleAdmin/organization/allProperties/read",
|                                                               "microsoft.peopleAdmin/organization/allProperties/update",
|                                                               "microsoft.people/users/photo/read",
|                                                               "microsoft.people/users/photo/update",
|                                                               "microsoft.permissionsManagement/allEntities/allProperties/allTasks",
|                                                               "microsoft.powerApps/allEntities/allTasks",
|                                                               "microsoft.powerApps.powerBI/allEntities/allTasks",
|                                                               "microsoft.teams/allEntities/allProperties/allTasks",
|                                                               "microsoft.virtualVisits/allEntities/allProperties/allTasks",
|                                                               "microsoft.viva.glint/allEntities/allProperties/allTasks",
|                                                               "microsoft.viva.goals/allEntities/allProperties/allTasks",
|                                                               "microsoft.viva.pulse/allEntities/allProperties/allTasks",
|                                                               "microsoft.windows.defenderAdvancedThreatProtection/allEntities/allTasks",
|                                                               "microsoft.windows.updatesDeployments/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "d29b2b05-8046-44ba-8758-1e26182fcf32",
|                                           "DisplayName":  "Directory Synchronization Accounts",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  0,
|                                           "Reason":  "Has synchronization permissions that can be used to replicate credentials and control identity plane.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/onPremisesSynchronization/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e8611ab8-c189-46e8-94e1-60213ab1f814",
|                                           "DisplayName":  "Privileged Role Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  0,
|                                           "Reason":  "Can assign privileged roles including Global Administrator, enabling immediate full tenant compromise.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/accessReviews/definitions.applications/allProperties/read",
|                                                               "microsoft.directory/accessReviews/definitions.directoryRoles/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions.groups/allProperties/read",
|                                                               "microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/allProperties/update",
|                                                               "microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/create",
|                                                               "microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/delete",
|                                                               "microsoft.directory/administrativeUnits/allProperties/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/allProperties/allTasks",
|                                                               "microsoft.directory/directoryRoles/allProperties/allTasks",
|                                                               "microsoft.directory/groupsAssignableToRoles/allProperties/update",
|                                                               "microsoft.directory/groupsAssignableToRoles/assignLicense",
|                                                               "microsoft.directory/groupsAssignableToRoles/create",
|                                                               "microsoft.directory/groupsAssignableToRoles/delete",
|                                                               "microsoft.directory/groupsAssignableToRoles/reprocessLicenseAssignment",
|                                                               "microsoft.directory/groupsAssignableToRoles/restore",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks",
|                                                               "microsoft.directory/permissionGrantPolicies/allProperties/read",
|                                                               "microsoft.directory/permissionGrantPolicies/allProperties/update",
|                                                               "microsoft.directory/permissionGrantPolicies/create",
|                                                               "microsoft.directory/permissionGrantPolicies/delete",
|                                                               "microsoft.directory/privilegedIdentityManagement/allProperties/allTasks",
|                                                               "microsoft.directory/roleAssignments/allProperties/allTasks",
|                                                               "microsoft.directory/roleDefinitions/allProperties/allTasks",
|                                                               "microsoft.directory/scopedRoleMemberships/allProperties/allTasks",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-company-admin",
|                                                               "microsoft.directory/servicePrincipals/permissions/update",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "7be44c8a-adaf-4e2a-84d6-ab2649e08a13",
|                                           "DisplayName":  "Privileged Authentication Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  0,
|                                           "Reason":  "Can manage authentication methods for privileged accounts, enabling immediate full tenant compromise.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/deletedItems.users/restore",
|                                                               "microsoft.directory/users/authenticationMethods/basic/update",
|                                                               "microsoft.directory/users/authenticationMethods/create",
|                                                               "microsoft.directory/users/authenticationMethods/delete",
|                                                               "microsoft.directory/users/authenticationMethods/standard/read",
|                                                               "microsoft.directory/users/authorizationInfo/update",
|                                                               "microsoft.directory/users/basic/update",
|                                                               "microsoft.directory/users/delete",
|                                                               "microsoft.directory/users/disable",
|                                                               "microsoft.directory/users/enable",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/manager/update",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.directory/users/restore",
|                                                               "microsoft.directory/users/userPrincipalName/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2",
|                                           "DisplayName":  "Hybrid Identity Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  0,
|                                           "Reason":  "Can manage applications and authentication settings, enabling direct elevation to Global Administrator and full tenant compromise.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/applications/appRoles/update",
|                                                               "microsoft.directory/applications/audience/update",
|                                                               "microsoft.directory/applications/authentication/update",
|                                                               "microsoft.directory/applications/basic/update",
|                                                               "microsoft.directory/applications/create",
|                                                               "microsoft.directory/applications/delete",
|                                                               "microsoft.directory/applications/disablement/update",
|                                                               "microsoft.directory/applications/notes/update",
|                                                               "microsoft.directory/applications/owners/update",
|                                                               "microsoft.directory/applications/permissions/update",
|                                                               "microsoft.directory/applications/policies/update",
|                                                               "microsoft.directory/applications/synchronization/standard/read",
|                                                               "microsoft.directory/applications/tag/update",
|                                                               "microsoft.directory/applicationTemplates/instantiate",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/cloudProvisioning/allProperties/allTasks",
|                                                               "microsoft.directory/deletedItems.applications/delete",
|                                                               "microsoft.directory/deletedItems.applications/restore",
|                                                               "microsoft.directory/domains/allProperties/read",
|                                                               "microsoft.directory/domains/federationConfiguration/basic/update",
|                                                               "microsoft.directory/domains/federationConfiguration/create",
|                                                               "microsoft.directory/domains/federationConfiguration/delete",
|                                                               "microsoft.directory/domains/federationConfiguration/standard/read",
|                                                               "microsoft.directory/domains/federation/update",
|                                                               "microsoft.directory/hybridAuthenticationPolicy/allProperties/allTasks",
|                                                               "microsoft.directory/onPremisesSynchronization/basic/update",
|                                                               "microsoft.directory/onPremisesSynchronization/standard/read",
|                                                               "microsoft.directory/organization/dirSync/update",
|                                                               "microsoft.directory/passwordHashSync/allProperties/allTasks",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/servicePrincipals/audience/update",
|                                                               "microsoft.directory/servicePrincipals/authentication/update",
|                                                               "microsoft.directory/servicePrincipals/basic/update",
|                                                               "microsoft.directory/servicePrincipals/create",
|                                                               "microsoft.directory/servicePrincipals/delete",
|                                                               "microsoft.directory/servicePrincipals/disable",
|                                                               "microsoft.directory/servicePrincipals/enable",
|                                                               "microsoft.directory/servicePrincipals/notes/update",
|                                                               "microsoft.directory/servicePrincipals/owners/update",
|                                                               "microsoft.directory/servicePrincipals/permissions/update",
|                                                               "microsoft.directory/servicePrincipals/policies/update",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationCredentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationJobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationSchema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization/standard/read",
|                                                               "microsoft.directory/servicePrincipals/tag/update",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.directory/users/authorizationInfo/update",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       }
|                                   ],
|    "EntraID_BuiltInRoles_Tier1":  [
|                                       {
|                                           "Id":  "729827e3-9c14-49f7-bb1b-9608f156bbb8",
|                                           "DisplayName":  "Helpdesk Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can reset passwords and invalidate refresh tokens for users including admins, enabling a reliable path to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/bitlockerKeys/key/read",
|                                                               "microsoft.directory/deviceLocalCredentials/standard/read",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "b0f54661-2d74-4c50-afa3-1ec803f12efe",
|                                           "DisplayName":  "Billing Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can update organization info and billing settings, which can be leveraged in some escalation paths to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.commerce.billing/allEntities/allProperties/allTasks",
|                                                               "microsoft.directory/organization/basic/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "4ba39ca4-527c-499a-b93d-d9b492c50246",
|                                           "DisplayName":  "Partner Tier1 Support",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can update application credentials and authentication settings, enabling escalation to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/applications/appRoles/update",
|                                                               "microsoft.directory/applications/audience/update",
|                                                               "microsoft.directory/applications/authentication/update",
|                                                               "microsoft.directory/applications/basic/update",
|                                                               "microsoft.directory/applications/credentials/update",
|                                                               "microsoft.directory/applications/notes/update",
|                                                               "microsoft.directory/applications/owners/update",
|                                                               "microsoft.directory/applications/permissions/update",
|                                                               "microsoft.directory/applications/policies/update",
|                                                               "microsoft.directory/applications/tag/update",
|                                                               "microsoft.directory/contacts/basic/update",
|                                                               "microsoft.directory/contacts/create",
|                                                               "microsoft.directory/contacts/delete",
|                                                               "microsoft.directory/deletedItems.groups/restore",
|                                                               "microsoft.directory/deletedItems.users/restore",
|                                                               "microsoft.directory/groups/create",
|                                                               "microsoft.directory/groups/delete",
|                                                               "microsoft.directory/groups/members/update",
|                                                               "microsoft.directory/groups/owners/update",
|                                                               "microsoft.directory/groups/restore",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/users/assignLicense",
|                                                               "microsoft.directory/users/basic/update",
|                                                               "microsoft.directory/users/create",
|                                                               "microsoft.directory/users/delete",
|                                                               "microsoft.directory/users/disable",
|                                                               "microsoft.directory/users/enable",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/manager/update",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.directory/users/photo/update",
|                                                               "microsoft.directory/users/restore",
|                                                               "microsoft.directory/users/userPrincipalName/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8",
|                                           "DisplayName":  "Partner Tier2 Support",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Similar to Tier1 Support with permissions to modify app credentials and authentication, enabling escalation.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/applications/appRoles/update",
|                                                               "microsoft.directory/applications/audience/update",
|                                                               "microsoft.directory/applications/authentication/update",
|                                                               "microsoft.directory/applications/basic/update",
|                                                               "microsoft.directory/applications/credentials/update",
|                                                               "microsoft.directory/applications/notes/update",
|                                                               "microsoft.directory/applications/owners/update",
|                                                               "microsoft.directory/applications/permissions/update",
|                                                               "microsoft.directory/applications/policies/update",
|                                                               "microsoft.directory/applications/tag/update",
|                                                               "microsoft.directory/contacts/basic/update",
|                                                               "microsoft.directory/contacts/create",
|                                                               "microsoft.directory/contacts/delete",
|                                                               "microsoft.directory/deletedItems.groups/restore",
|                                                               "microsoft.directory/deletedItems.users/restore",
|                                                               "microsoft.directory/domains/allProperties/allTasks",
|                                                               "microsoft.directory/groups/create",
|                                                               "microsoft.directory/groups/delete",
|                                                               "microsoft.directory/groups/members/update",
|                                                               "microsoft.directory/groups/owners/update",
|                                                               "microsoft.directory/groups/restore",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks",
|                                                               "microsoft.directory/organization/basic/update",
|                                                               "microsoft.directory/roleAssignments/allProperties/allTasks",
|                                                               "microsoft.directory/roleDefinitions/allProperties/allTasks",
|                                                               "microsoft.directory/scopedRoleMemberships/allProperties/allTasks",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/subscribedSkus/standard/read",
|                                                               "microsoft.directory/users/assignLicense",
|                                                               "microsoft.directory/users/basic/update",
|                                                               "microsoft.directory/users/create",
|                                                               "microsoft.directory/users/delete",
|                                                               "microsoft.directory/users/disable",
|                                                               "microsoft.directory/users/enable",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/manager/update",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.directory/users/photo/update",
|                                                               "microsoft.directory/users/restore",
|                                                               "microsoft.directory/users/userPrincipalName/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "29232cdf-9323-42fd-ade2-1d097af3e4de",
|                                           "DisplayName":  "Exchange Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage Exchange settings and mailboxes, enabling password resets and MFA bypass via mailbox access in some scenarios.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.backup/exchangeProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/exchangeRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/userMailboxes/allProperties/allTasks",
|                                                               "microsoft.backup/userMailboxProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/userMailboxRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.directory/contacts/allProperties/read",
|                                                               "microsoft.directory/contacts/memberOf/read",
|                                                               "microsoft.directory/contacts/standard/read",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/groups.unified/basic/update",
|                                                               "microsoft.directory/groups.unified/create",
|                                                               "microsoft.directory/groups.unified/delete",
|                                                               "microsoft.directory/groups.unified/members/update",
|                                                               "microsoft.directory/groups.unified/owners/update",
|                                                               "microsoft.directory/groups.unified/restore",
|                                                               "microsoft.directory/onPremisesSynchronization/standard/read",
|                                                               "microsoft.office365.exchange/allEntities/basic/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
|                                           "DisplayName":  "Application Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage application policies and consent, enabling escalation to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks",
|                                                               "microsoft.directory/appConsent/appConsentRequests/allProperties/read",
|                                                               "microsoft.directory/applicationPolicies/basic/update",
|                                                               "microsoft.directory/applicationPolicies/create",
|                                                               "microsoft.directory/applicationPolicies/delete",
|                                                               "microsoft.directory/applicationPolicies/owners/read",
|                                                               "microsoft.directory/applicationPolicies/owners/update",
|                                                               "microsoft.directory/applicationPolicies/policyAppliedTo/read",
|                                                               "microsoft.directory/applicationPolicies/standard/read",
|                                                               "microsoft.directory/applications/applicationProxyAuthentication/update",
|                                                               "microsoft.directory/applications/applicationProxy/read",
|                                                               "microsoft.directory/applications/applicationProxySslCertificate/update",
|                                                               "microsoft.directory/applications/applicationProxy/update",
|                                                               "microsoft.directory/applications/applicationProxyUrlSettings/update",
|                                                               "microsoft.directory/applications/appRoles/update",
|                                                               "microsoft.directory/applications/audience/update",
|                                                               "microsoft.directory/applications/authentication/update",
|                                                               "microsoft.directory/applications/basic/update",
|                                                               "microsoft.directory/applications/create",
|                                                               "microsoft.directory/applications/credentials/update",
|                                                               "microsoft.directory/applications/delete",
|                                                               "microsoft.directory/applications/disablement/update",
|                                                               "microsoft.directory/applications/extensionProperties/update",
|                                                               "microsoft.directory/applications/notes/update",
|                                                               "microsoft.directory/applications/owners/update",
|                                                               "microsoft.directory/applications/permissions/update",
|                                                               "microsoft.directory/applications/policies/update",
|                                                               "microsoft.directory/applications/synchronization/standard/read",
|                                                               "microsoft.directory/applications/tag/update",
|                                                               "microsoft.directory/applications/verification/update",
|                                                               "microsoft.directory/applicationTemplates/instantiate",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/connectorGroups/allProperties/read",
|                                                               "microsoft.directory/connectorGroups/allProperties/update",
|                                                               "microsoft.directory/connectorGroups/create",
|                                                               "microsoft.directory/connectorGroups/delete",
|                                                               "microsoft.directory/connectors/allProperties/read",
|                                                               "microsoft.directory/connectors/create",
|                                                               "microsoft.directory/customAuthenticationExtensions/allProperties/allTasks",
|                                                               "microsoft.directory/deletedItems.applications/delete",
|                                                               "microsoft.directory/deletedItems.applications/restore",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/servicePrincipals/audience/update",
|                                                               "microsoft.directory/servicePrincipals/authentication/update",
|                                                               "microsoft.directory/servicePrincipals/basic/update",
|                                                               "microsoft.directory/servicePrincipals/create",
|                                                               "microsoft.directory/servicePrincipals/credentials/update",
|                                                               "microsoft.directory/servicePrincipals/delete",
|                                                               "microsoft.directory/servicePrincipals/disable",
|                                                               "microsoft.directory/servicePrincipals/enable",
|                                                               "microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials",
|                                                               "microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials",
|                                                               "microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-application-admin",
|                                                               "microsoft.directory/servicePrincipals/notes/update",
|                                                               "microsoft.directory/servicePrincipals/owners/update",
|                                                               "microsoft.directory/servicePrincipals/permissions/update",
|                                                               "microsoft.directory/servicePrincipals/policies/update",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationCredentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationJobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationSchema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization/standard/read",
|                                                               "microsoft.directory/servicePrincipals/tag/update",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "194ae4cb-b126-40b2-bd5b-6091b380977d",
|                                           "DisplayName":  "Security Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can update application policies and security settings, enabling escalation to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.agentRegistry/allEntities/allProperties/read",
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/applications/policies/update",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/bitlockerKeys/key/read",
|                                                               "microsoft.directory/bulkJobs/standard/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/basic/update",
|                                                               "microsoft.directory/conditionalAccessPolicies/create",
|                                                               "microsoft.directory/conditionalAccessPolicies/delete",
|                                                               "microsoft.directory/conditionalAccessPolicies/owners/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/owners/update",
|                                                               "microsoft.directory/conditionalAccessPolicies/policyAppliedTo/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/standard/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/tenantDefault/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/b2bCollaboration/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/b2bDirectConnect/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/tenantRestrictions/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/b2bCollaboration/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/b2bDirectConnect/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/create",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/delete",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/create",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/resetToDefaultSettings",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/resetToDefaultSettings",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/standard/read",
|                                                               "microsoft.directory/deviceLocalCredentials/standard/read",
|                                                               "microsoft.directory/domains/federationConfiguration/basic/update",
|                                                               "microsoft.directory/domains/federationConfiguration/create",
|                                                               "microsoft.directory/domains/federationConfiguration/delete",
|                                                               "microsoft.directory/domains/federationConfiguration/standard/read",
|                                                               "microsoft.directory/domains/federation/update",
|                                                               "microsoft.directory/entitlementManagement/allProperties/read",
|                                                               "microsoft.directory/identityProtection/allProperties/read",
|                                                               "microsoft.directory/identityProtection/allProperties/update",
|                                                               "microsoft.directory/multiTenantOrganization/basic/update",
|                                                               "microsoft.directory/multiTenantOrganization/create",
|                                                               "microsoft.directory/multiTenantOrganization/joinRequest/organizationDetails/update",
|                                                               "microsoft.directory/multiTenantOrganization/joinRequest/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/create",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/delete",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/organizationDetails/update",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/standard/read",
|                                                               "microsoft.directory/namedLocations/basic/update",
|                                                               "microsoft.directory/namedLocations/create",
|                                                               "microsoft.directory/namedLocations/delete",
|                                                               "microsoft.directory/namedLocations/standard/read",
|                                                               "microsoft.directory/policies/basic/update",
|                                                               "microsoft.directory/policies/create",
|                                                               "microsoft.directory/policies/delete",
|                                                               "microsoft.directory/policies/owners/update",
|                                                               "microsoft.directory/policies/tenantDefault/update",
|                                                               "microsoft.directory/privilegedIdentityManagement/allProperties/read",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/update",
|                                                               "microsoft.directory/servicePrincipals/policies/update",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.networkAccess/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.protectionCenter/allEntities/basic/update",
|                                                               "microsoft.office365.protectionCenter/allEntities/standard/read",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/payload/allProperties/allTasks",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/reports/allProperties/read",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/simulation/allProperties/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "158c047a-c907-4556-b7ef-446551a6b5f7",
|                                           "DisplayName":  "Cloud Application Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage application policies and consent, enabling escalation to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks",
|                                                               "microsoft.directory/appConsent/appConsentRequests/allProperties/read",
|                                                               "microsoft.directory/applicationPolicies/basic/update",
|                                                               "microsoft.directory/applicationPolicies/create",
|                                                               "microsoft.directory/applicationPolicies/delete",
|                                                               "microsoft.directory/applicationPolicies/owners/read",
|                                                               "microsoft.directory/applicationPolicies/owners/update",
|                                                               "microsoft.directory/applicationPolicies/policyAppliedTo/read",
|                                                               "microsoft.directory/applicationPolicies/standard/read",
|                                                               "microsoft.directory/applications/appRoles/update",
|                                                               "microsoft.directory/applications/audience/update",
|                                                               "microsoft.directory/applications/authentication/update",
|                                                               "microsoft.directory/applications/basic/update",
|                                                               "microsoft.directory/applications/create",
|                                                               "microsoft.directory/applications/credentials/update",
|                                                               "microsoft.directory/applications/delete",
|                                                               "microsoft.directory/applications/disablement/update",
|                                                               "microsoft.directory/applications/extensionProperties/update",
|                                                               "microsoft.directory/applications/notes/update",
|                                                               "microsoft.directory/applications/owners/update",
|                                                               "microsoft.directory/applications/permissions/update",
|                                                               "microsoft.directory/applications/policies/update",
|                                                               "microsoft.directory/applications/synchronization/standard/read",
|                                                               "microsoft.directory/applications/tag/update",
|                                                               "microsoft.directory/applications/verification/update",
|                                                               "microsoft.directory/applicationTemplates/instantiate",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/deletedItems.applications/delete",
|                                                               "microsoft.directory/deletedItems.applications/restore",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/servicePrincipals/audience/update",
|                                                               "microsoft.directory/servicePrincipals/authentication/update",
|                                                               "microsoft.directory/servicePrincipals/basic/update",
|                                                               "microsoft.directory/servicePrincipals/create",
|                                                               "microsoft.directory/servicePrincipals/credentials/update",
|                                                               "microsoft.directory/servicePrincipals/delete",
|                                                               "microsoft.directory/servicePrincipals/disable",
|                                                               "microsoft.directory/servicePrincipals/enable",
|                                                               "microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials",
|                                                               "microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials",
|                                                               "microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-application-admin",
|                                                               "microsoft.directory/servicePrincipals/notes/update",
|                                                               "microsoft.directory/servicePrincipals/owners/update",
|                                                               "microsoft.directory/servicePrincipals/permissions/update",
|                                                               "microsoft.directory/servicePrincipals/policies/update",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationCredentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationJobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationSchema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization/standard/read",
|                                                               "microsoft.directory/servicePrincipals/tag/update",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9",
|                                           "DisplayName":  "Conditional Access Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can modify conditional access policies, enabling bypass of MFA and escalation to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/conditionalAccessPolicies/basic/update",
|                                                               "microsoft.directory/conditionalAccessPolicies/create",
|                                                               "microsoft.directory/conditionalAccessPolicies/delete",
|                                                               "microsoft.directory/conditionalAccessPolicies/owners/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/owners/update",
|                                                               "microsoft.directory/conditionalAccessPolicies/policyAppliedTo/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/standard/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/tenantDefault/update",
|                                                               "microsoft.directory/namedLocations/basic/update",
|                                                               "microsoft.directory/namedLocations/create",
|                                                               "microsoft.directory/namedLocations/delete",
|                                                               "microsoft.directory/namedLocations/standard/read",
|                                                               "microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "c4e39bd9-1100-46d3-8c65-fb160da0071f",
|                                           "DisplayName":  "Authentication Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage authentication methods and reset credentials, enabling escalation to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/deletedItems.users/restore",
|                                                               "microsoft.directory/users/authenticationMethods/basic/update",
|                                                               "microsoft.directory/users/authenticationMethods/create",
|                                                               "microsoft.directory/users/authenticationMethods/delete",
|                                                               "microsoft.directory/users/authenticationMethods/standard/restrictedRead",
|                                                               "microsoft.directory/users/basic/update",
|                                                               "microsoft.directory/users/delete",
|                                                               "microsoft.directory/users/disable",
|                                                               "microsoft.directory/users/enable",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/manager/update",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.directory/users/restore",
|                                                               "microsoft.directory/users/userPrincipalName/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "6e591065-9bad-43ed-90f3-e9424366d2f0",
|                                           "DisplayName":  "External ID User Flow Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage B2C user flows, enabling modification of authentication policies and escalation.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/b2cUserFlow/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "0f971eea-41eb-4569-a71e-57bb8a3eff1e",
|                                           "DisplayName":  "External ID User Flow Attribute Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage B2C user attributes, enabling modification of authentication policies and escalation.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/b2cUserAttribute/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "aaf43236-0c0d-4d5f-883a-6955382ac081",
|                                           "DisplayName":  "B2C IEF Keyset Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage B2C trust framework keysets, enabling modification of authentication policies and potential elevation to tenant-wide control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/b2cTrustFrameworkKeySet/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "3edaf663-341e-4475-9f94-5c398ef6c070",
|                                           "DisplayName":  "B2C IEF Policy Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage B2C trust framework policies, allowing changes to authentication flows that can lead to tenant compromise.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/b2cTrustFrameworkPolicy/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "be2f45a1-457d-42af-a067-6ec1fa63bc45",
|                                           "DisplayName":  "External Identity Provider Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can modify federation settings and identity providers, enabling manipulation of authentication and potential tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/domains/federation/update",
|                                                               "microsoft.directory/identityProviders/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "966707d0-3269-4727-9be2-8c3a10f19b9d",
|                                           "DisplayName":  "Password Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can reset user passwords, enabling potential credential takeover and escalation to privileged roles.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "0526716b-113d-4c15-b2c8-68e3c22b9f80",
|                                           "DisplayName":  "Authentication Policy Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can modify authentication policies and user credential policies, enabling bypass or reset of MFA and credential protections.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/organization/strongAuthentication/allTasks",
|                                                               "microsoft.directory/userCredentialPolicies/basic/update",
|                                                               "microsoft.directory/userCredentialPolicies/create",
|                                                               "microsoft.directory/userCredentialPolicies/delete",
|                                                               "microsoft.directory/userCredentialPolicies/owners/read",
|                                                               "microsoft.directory/userCredentialPolicies/owners/update",
|                                                               "microsoft.directory/userCredentialPolicies/policyAppliedTo/read",
|                                                               "microsoft.directory/userCredentialPolicies/standard/read",
|                                                               "microsoft.directory/userCredentialPolicies/tenantDefault/update",
|                                                               "microsoft.directory/verifiableCredentials/configuration/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/allProperties/update",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/update",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/cards/revoke",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/create",
|                                                               "microsoft.directory/verifiableCredentials/configuration/create",
|                                                               "microsoft.directory/verifiableCredentials/configuration/delete"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "8329153b-31d0-4727-b945-745eb3bc5f31",
|                                           "DisplayName":  "Domain Name Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage domain properties and federation, enabling manipulation of authentication and potential tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/domains/allProperties/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "45d8d3c5-c802-45c6-b32a-1d70b5e1e86e",
|                                           "DisplayName":  "Identity Governance Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Manages access reviews and entitlement management, enabling role assignment and potential elevation to privileged roles.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/accessReviews/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions.applications/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions.entitlementManagement/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions.groups/allProperties/read",
|                                                               "microsoft.directory/accessReviews/definitions.groups/allProperties/update",
|                                                               "microsoft.directory/accessReviews/definitions.groups/create",
|                                                               "microsoft.directory/accessReviews/definitions.groups/delete",
|                                                               "microsoft.directory/entitlementManagement/allProperties/allTasks",
|                                                               "microsoft.directory/groups/members/update",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "11451d60-acb2-45eb-a7d6-43d0f0125c13",
|                                           "DisplayName":  "Windows 365 Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage cloud PC devices and policies, enabling potential escalation paths to privileged roles.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.cloudPC/allEntities/allProperties/allTasks",
|                                                               "microsoft.directory/deletedItems.devices/delete",
|                                                               "microsoft.directory/deletedItems.devices/restore",
|                                                               "microsoft.directory/deviceManagementPolicies/standard/read",
|                                                               "microsoft.directory/deviceRegistrationPolicy/standard/read",
|                                                               "microsoft.directory/devices/basic/update",
|                                                               "microsoft.directory/devices/create",
|                                                               "microsoft.directory/devices/delete",
|                                                               "microsoft.directory/devices/disable",
|                                                               "microsoft.directory/devices/enable",
|                                                               "microsoft.directory/devices/extensionAttributeSet1/update",
|                                                               "microsoft.directory/devices/extensionAttributeSet2/update",
|                                                               "microsoft.directory/devices/extensionAttributeSet3/update",
|                                                               "microsoft.directory/devices/registeredOwners/update",
|                                                               "microsoft.directory/devices/registeredUsers/update",
|                                                               "microsoft.directory/groups.security/assignedLabels/update",
|                                                               "microsoft.directory/groups.security/basic/update",
|                                                               "microsoft.directory/groups.security/classification/update",
|                                                               "microsoft.directory/groups.security/create",
|                                                               "microsoft.directory/groups.security/delete",
|                                                               "microsoft.directory/groups.security/dynamicMembershipRule/update",
|                                                               "microsoft.directory/groups.security/members/update",
|                                                               "microsoft.directory/groups.security/owners/update",
|                                                               "microsoft.directory/groups.security/visibility/update",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "25a516ed-2fa0-40ea-a2d0-12923a21473a",
|                                           "DisplayName":  "Authentication Extensibility Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage custom authentication extensions, enabling modification of authentication flows and potential tenant compromise.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/customAuthenticationExtensions/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "112ca1a2-15ad-4102-995e-45b0bc479a6a",
|                                           "DisplayName":  "Tenant Creator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can create new tenants, which may enable attacker to establish footholds or pivot but no direct control over existing tenant identity plane.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/tenantManagement/tenants/create"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "af78dc32-cf4d-46f9-ba4e-4428526346b5",
|                                           "DisplayName":  "Permissions Management Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Full control over permissions management, enabling assignment of privileged roles and potential tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.permissionsManagement/allEntities/allProperties/allTasks"
|                                                           ]
|                                       }
|                                   ],
|    "EntraID_BuiltInRoles_Tier2":  [
|                                       {
|                                           "Id":  "fe930be7-5e62-47db-91af-98c3a49a38b1",
|                                           "DisplayName":  "User Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can manage user accounts but no direct or reliable path to assign Global Administrator or control identity plane.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions.applications/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions.directoryRoles/allProperties/read",
|                                                               "microsoft.directory/accessReviews/definitions.entitlementManagement/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions.groups/allProperties/read",
|                                                               "microsoft.directory/accessReviews/definitions.groups/allProperties/update",
|                                                               "microsoft.directory/accessReviews/definitions.groups/create",
|                                                               "microsoft.directory/accessReviews/definitions.groups/delete",
|                                                               "microsoft.directory/contacts/basic/update",
|                                                               "microsoft.directory/contacts/create",
|                                                               "microsoft.directory/contacts/delete",
|                                                               "microsoft.directory/deletedItems.groups/restore",
|                                                               "microsoft.directory/deletedItems.users/restore",
|                                                               "microsoft.directory/entitlementManagement/allProperties/allTasks",
|                                                               "microsoft.directory/groups/assignLicense",
|                                                               "microsoft.directory/groups/basic/update",
|                                                               "microsoft.directory/groups/classification/update",
|                                                               "microsoft.directory/groups/create",
|                                                               "microsoft.directory/groups/delete",
|                                                               "microsoft.directory/groups/dynamicMembershipRule/update",
|                                                               "microsoft.directory/groups/groupType/update",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups/members/update",
|                                                               "microsoft.directory/groups/onPremWriteBack/update",
|                                                               "microsoft.directory/groups/owners/update",
|                                                               "microsoft.directory/groups/reprocessLicenseAssignment",
|                                                               "microsoft.directory/groups/restore",
|                                                               "microsoft.directory/groups/settings/update",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/groups/visibility/update",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks",
|                                                               "microsoft.directory/onPremisesSynchronization/standard/read",
|                                                               "microsoft.directory/policies/standard/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/users/assignLicense",
|                                                               "microsoft.directory/users/basic/update",
|                                                               "microsoft.directory/users/convertExternalToInternalMemberUser",
|                                                               "microsoft.directory/users/create",
|                                                               "microsoft.directory/users/delete",
|                                                               "microsoft.directory/users/disable",
|                                                               "microsoft.directory/users/enable",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/inviteGuest",
|                                                               "microsoft.directory/users/lifeCycleInfo/read",
|                                                               "microsoft.directory/users/manager/update",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.directory/users/photo/update",
|                                                               "microsoft.directory/users/reprocessLicenseAssignment",
|                                                               "microsoft.directory/users/restore",
|                                                               "microsoft.directory/users/sponsors/update",
|                                                               "microsoft.directory/users/usageLocation/update",
|                                                               "microsoft.directory/users/userPrincipalName/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9360feb5-f418-4baa-8175-e2a00bac4301",
|                                           "DisplayName":  "Directory Writers",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can modify groups and applications but no direct path to assign Global Administrator or control identity plane.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/applications/extensionProperties/update",
|                                                               "microsoft.directory/contacts/create",
|                                                               "microsoft.directory/groups/assignedLabels/update",
|                                                               "microsoft.directory/groups/assignLicense",
|                                                               "microsoft.directory/groups/basic/update",
|                                                               "microsoft.directory/groups/classification/update",
|                                                               "microsoft.directory/groups/create",
|                                                               "microsoft.directory/groups/dynamicMembershipRule/update",
|                                                               "microsoft.directory/groupSettings/basic/update",
|                                                               "microsoft.directory/groupSettings/create",
|                                                               "microsoft.directory/groupSettings/delete",
|                                                               "microsoft.directory/groups/groupType/update",
|                                                               "microsoft.directory/groups/members/update",
|                                                               "microsoft.directory/groups/onPremWriteBack/update",
|                                                               "microsoft.directory/groups/owners/update",
|                                                               "microsoft.directory/groups/reprocessLicenseAssignment",
|                                                               "microsoft.directory/groups/settings/update",
|                                                               "microsoft.directory/groups/visibility/update",
|                                                               "microsoft.directory/oAuth2PermissionGrants/basic/update",
|                                                               "microsoft.directory/oAuth2PermissionGrants/create",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationCredentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationJobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationSchema/manage",
|                                                               "microsoft.directory/users/assignLicense",
|                                                               "microsoft.directory/users/basic/update",
|                                                               "microsoft.directory/users/create",
|                                                               "microsoft.directory/users/disable",
|                                                               "microsoft.directory/users/enable",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/inviteGuest",
|                                                               "microsoft.directory/users/manager/update",
|                                                               "microsoft.directory/users/photo/update",
|                                                               "microsoft.directory/users/reprocessLicenseAssignment",
|                                                               "microsoft.directory/users/sponsors/update",
|                                                               "microsoft.directory/users/userPrincipalName/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "f28a1f50-f6e7-4571-818b-6a12f2af6b6c",
|                                           "DisplayName":  "SharePoint Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can manage SharePoint and OneDrive data but no direct identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.backup/oneDriveForBusinessProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/oneDriveForBusinessRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/sites/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/userDrives/allProperties/allTasks",
|                                                               "microsoft.backup/sharePointProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/sharePointRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/siteProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/siteRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.backup/userDriveProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/userDriveRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/groups.unified/basic/update",
|                                                               "microsoft.directory/groups.unified/create",
|                                                               "microsoft.directory/groups.unified/delete",
|                                                               "microsoft.directory/groups.unified/members/update",
|                                                               "microsoft.directory/groups.unified/owners/update",
|                                                               "microsoft.directory/groups.unified/restore",
|                                                               "microsoft.office365.migrations/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.sharePoint/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "75941009-915a-4869-abe7-691bff18279e",
|                                           "DisplayName":  "Skype for Business Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages Skype for Business settings with no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.skypeForBusiness/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "17315797-102d-40b4-93e0-432062caca18",
|                                           "DisplayName":  "Compliance Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can manage compliance data and policies but no direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/entitlementManagement/allProperties/read",
|                                                               "microsoft.office365.complianceManager/allEntities/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "2b499bcd-da44-4968-8aec-78e1674fa64d",
|                                           "DisplayName":  "Device Managers",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can update device attributes but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/devices/basic/update",
|                                                               "microsoft.directory/devices/extensionAttributeSet1/update",
|                                                               "microsoft.directory/devices/extensionAttributeSet2/update",
|                                                               "microsoft.directory/devices/extensionAttributeSet3/update",
|                                                               "microsoft.directory/devices/memberOf/read",
|                                                               "microsoft.directory/devices/registeredOwners/read",
|                                                               "microsoft.directory/devices/registeredOwners/update",
|                                                               "microsoft.directory/devices/registeredUsers/read",
|                                                               "microsoft.directory/devices/registeredUsers/update",
|                                                               "microsoft.directory/devices/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "cf1c38e5-3621-4004-a7cb-879624dced7c",
|                                           "DisplayName":  "Application Developer",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can create applications and service principals but no direct role assignment or identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/applications/createAsOwner",
|                                                               "microsoft.directory/oAuth2PermissionGrants/createAsOwner",
|                                                               "microsoft.directory/servicePrincipals/createAsOwner"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "3a2c62db-5318-420d-8d74-23affee5d9d5",
|                                           "DisplayName":  "Intune Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages devices and policies but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.cloudPC/allEntities/allProperties/allTasks",
|                                                               "microsoft.directory/bitlockerKeys/key/read",
|                                                               "microsoft.directory/contacts/basic/update",
|                                                               "microsoft.directory/contacts/create",
|                                                               "microsoft.directory/contacts/delete",
|                                                               "microsoft.directory/deletedItems.devices/delete",
|                                                               "microsoft.directory/deletedItems.devices/restore",
|                                                               "microsoft.directory/deviceLocalCredentials/password/read",
|                                                               "microsoft.directory/deviceManagementPolicies/standard/read",
|                                                               "microsoft.directory/deviceRegistrationPolicy/standard/read",
|                                                               "microsoft.directory/devices/basic/update",
|                                                               "microsoft.directory/devices/create",
|                                                               "microsoft.directory/devices/delete",
|                                                               "microsoft.directory/devices/disable",
|                                                               "microsoft.directory/devices/enable",
|                                                               "microsoft.directory/devices/extensionAttributeSet1/update",
|                                                               "microsoft.directory/devices/extensionAttributeSet2/update",
|                                                               "microsoft.directory/devices/extensionAttributeSet3/update",
|                                                               "microsoft.directory/devices/registeredOwners/update",
|                                                               "microsoft.directory/devices/registeredUsers/update",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups.security/assignedLabels/update",
|                                                               "microsoft.directory/groups.security/basic/update",
|                                                               "microsoft.directory/groups.security/classification/update",
|                                                               "microsoft.directory/groups.security/create",
|                                                               "microsoft.directory/groups.security/delete",
|                                                               "microsoft.directory/groups.security/dynamicMembershipRule/update",
|                                                               "microsoft.directory/groups.security/members/update",
|                                                               "microsoft.directory/groups.security/owners/update",
|                                                               "microsoft.directory/groups.security/visibility/update",
|                                                               "microsoft.directory/users/basic/update",
|                                                               "microsoft.directory/users/manager/update",
|                                                               "microsoft.directory/users/photo/update",
|                                                               "microsoft.intune/allEntities/allTasks",
|                                                               "microsoft.office365.organizationalMessages/allEntities/allProperties/read",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "44367163-eba1-44c3-98af-f5787879f96a",
|                                           "DisplayName":  "Dynamics 365 Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages Dynamics 365 services but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.dynamics365/allEntities/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "a9ea8996-122f-4c74-9520-8edcd192826c",
|                                           "DisplayName":  "Fabric Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages PowerApps and related services but no direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.powerApps.powerBI/allEntities/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "7495fdc4-34c4-4d15-a289-98788ce399fd",
|                                           "DisplayName":  "Azure Information Protection Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages information protection policies but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.informationProtection/allEntities/allTasks",
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "38a96431-2bdf-4b4c-8b6e-5d3d8abac1a4",
|                                           "DisplayName":  "Desktop Analytics Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages desktop analytics data with no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.desktopAnalytics/allEntities/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "4d6ac14f-3453-41d0-bef9-a3e0c569773a",
|                                           "DisplayName":  "License Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can assign licenses but no direct path to role assignment or identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/groups/assignLicense",
|                                                               "microsoft.directory/groups/reprocessLicenseAssignment",
|                                                               "microsoft.directory/users/assignLicense",
|                                                               "microsoft.directory/users/reprocessLicenseAssignment",
|                                                               "microsoft.directory/users/usageLocation/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "7698a772-787b-4ac8-901f-60d6b08affd2",
|                                           "DisplayName":  "Cloud Device Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages devices and policies but no direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/bitlockerKeys/key/read",
|                                                               "microsoft.directory/deletedItems.devices/delete",
|                                                               "microsoft.directory/deletedItems.devices/restore",
|                                                               "microsoft.directory/deviceLocalCredentials/password/read",
|                                                               "microsoft.directory/deviceManagementPolicies/basic/update",
|                                                               "microsoft.directory/deviceManagementPolicies/standard/read",
|                                                               "microsoft.directory/deviceRegistrationPolicy/basic/update",
|                                                               "microsoft.directory/deviceRegistrationPolicy/standard/read",
|                                                               "microsoft.directory/devices/delete",
|                                                               "microsoft.directory/devices/disable",
|                                                               "microsoft.directory/devices/enable",
|                                                               "microsoft.directory/devices/permissions/update",
|                                                               "microsoft.directory/deviceTemplates/owners/read",
|                                                               "microsoft.directory/deviceTemplates/owners/update",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "baf37b3a-610e-45da-9e62-d9d1e5e8914b",
|                                           "DisplayName":  "Teams Communications Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages Teams and Skype settings but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.skypeForBusiness/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/callQuality/allProperties/read",
|                                                               "microsoft.teams/meetings/allProperties/allTasks",
|                                                               "microsoft.teams/voice/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "69091246-20e8-4a56-aa4d-066075b2a7a8",
|                                           "DisplayName":  "Teams Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can manage Teams policies but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/create",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/standard/read",
|                                                               "microsoft.directory/externalUserProfiles/basic/update",
|                                                               "microsoft.directory/externalUserProfiles/delete",
|                                                               "microsoft.directory/externalUserProfiles/standard/read",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/groups.unified/basic/update",
|                                                               "microsoft.directory/groups.unified/create",
|                                                               "microsoft.directory/groups.unified/delete",
|                                                               "microsoft.directory/groups.unified/members/update",
|                                                               "microsoft.directory/groups.unified/owners/update",
|                                                               "microsoft.directory/groups.unified/restore",
|                                                               "microsoft.directory/pendingExternalUserProfiles/basic/update",
|                                                               "microsoft.directory/pendingExternalUserProfiles/create",
|                                                               "microsoft.directory/pendingExternalUserProfiles/delete",
|                                                               "microsoft.directory/pendingExternalUserProfiles/standard/read",
|                                                               "microsoft.directory/permissionGrantPolicies/standard/read",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.skypeForBusiness/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "eb1f4a8d-243a-41f0-9fbd-c7cdf6c5ef7c",
|                                           "DisplayName":  "Insights Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages insights and monitoring data but no direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.insights/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "fdd7a751-b60b-444a-984c-02652fe8fa1c",
|                                           "DisplayName":  "Groups Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can manage groups including deletion and restoration but no direct role assignment or credential reset capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/bulkJobs.groups/basic/update",
|                                                               "microsoft.directory/bulkJobs.groups/create",
|                                                               "microsoft.directory/bulkJobs.groups/standard/read",
|                                                               "microsoft.directory/deletedItems.groups/delete",
|                                                               "microsoft.directory/deletedItems.groups/restore",
|                                                               "microsoft.directory/groups/assignedLabels/update",
|                                                               "microsoft.directory/groups/assignLicense",
|                                                               "microsoft.directory/groups/basic/update",
|                                                               "microsoft.directory/groups/classification/update",
|                                                               "microsoft.directory/groups/create",
|                                                               "microsoft.directory/groups/delete",
|                                                               "microsoft.directory/groups/dynamicMembershipRule/update",
|                                                               "microsoft.directory/groups/groupType/update",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups/members/update",
|                                                               "microsoft.directory/groups/onPremWriteBack/update",
|                                                               "microsoft.directory/groups/owners/update",
|                                                               "microsoft.directory/groups/reprocessLicenseAssignment",
|                                                               "microsoft.directory/groups/restore",
|                                                               "microsoft.directory/groups/settings/update",
|                                                               "microsoft.directory/groups/visibility/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "31392ffb-586c-42d1-9346-e59415a2cc4e",
|                                           "DisplayName":  "Exchange Recipient Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can manage Exchange recipients and migrations but no direct identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.exchange/migration/allProperties/allTasks",
|                                                               "microsoft.office365.exchange/recipients/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "59d46f88-662b-457b-bceb-5c3809e5908f",
|                                           "DisplayName":  "Lifecycle Workflows Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages lifecycle workflows and reads authentication info but lacks direct role assignment or credential reset capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/lifecycleWorkflows/workflows/allProperties/allTasks",
|                                                               "microsoft.directory/organization/strongAuthentication/read",
|                                                               "microsoft.directory/users/lifeCycleInfo/read"
|                                                           ]
|                                       }
|                                   ],
|    "EntraID_BuiltInRoles_Tier3":  [
|                                       {
|                                           "Id":  "10dae51f-b6af-4016-8d66-8c2a99b929b3",
|                                           "DisplayName":  "Guest User",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only limited permissions with no path to identity plane control or tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/applications/owners/limitedRead",
|                                                               "microsoft.directory/applications/policies/limitedRead",
|                                                               "microsoft.directory/applications/standard/limitedRead",
|                                                               "microsoft.directory/directoryRoleTemplates/allProperties/read",
|                                                               "microsoft.directory/domains/standard/read",
|                                                               "microsoft.directory/groups/appRoleAssignments/limitedRead",
|                                                               "microsoft.directory/groups/memberOf/limitedRead",
|                                                               "microsoft.directory/groups/members/limitedRead",
|                                                               "microsoft.directory/groups/owners/limitedRead",
|                                                               "microsoft.directory/groups/settings/limitedRead",
|                                                               "microsoft.directory/groups/standard/limitedRead",
|                                                               "microsoft.directory/multiTenantOrganization/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/standard/read",
|                                                               "microsoft.directory/organization/basicProfile/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignments/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/memberOf/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/oAuth2PermissionGrants/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/ownedObjects/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/owners/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/policies/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/standard/limitedRead",
|                                                               "microsoft.directory/users/guestBasicProfile/limitedRead",
|                                                               "microsoft.directory/users/inviteGuest",
|                                                               "microsoft.directory/users/appRoleAssignments/read",
|                                                               "microsoft.directory/users/authenticationMethods/basic/update",
|                                                               "microsoft.directory/users/authenticationMethods/create",
|                                                               "microsoft.directory/users/authenticationMethods/delete",
|                                                               "microsoft.directory/users/authenticationMethods/standard/read",
|                                                               "microsoft.directory/users/authenticationMethods/standard/restrictedRead",
|                                                               "microsoft.directory/users/deviceForResourceAccount/read",
|                                                               "microsoft.directory/users/directReports/read",
|                                                               "microsoft.directory/users/eligibleMemberOf/read",
|                                                               "microsoft.directory/users/invitedBy/read",
|                                                               "microsoft.directory/users/licenseDetails/read",
|                                                               "microsoft.directory/users/manager/read",
|                                                               "microsoft.directory/users/memberOf/read",
|                                                               "microsoft.directory/users/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/users/ownedDevices/read",
|                                                               "microsoft.directory/users/ownedObjects/read",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.directory/users/pendingMemberOf/read",
|                                                               "microsoft.directory/users/photo/read",
|                                                               "microsoft.directory/users/registeredDevices/read",
|                                                               "microsoft.directory/users/scopedRoleMemberOf/read",
|                                                               "microsoft.directory/users/sponsorOf/read",
|                                                               "microsoft.directory/users/sponsors/read",
|                                                               "microsoft.directory/users/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "2af84b1e-32c8-42b7-82bc-daa82404023b",
|                                           "DisplayName":  "Restricted Guest User",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Limited read permissions without any ability to modify identity or role assignments.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/applications/owners/limitedRead",
|                                                               "microsoft.directory/applications/policies/limitedRead",
|                                                               "microsoft.directory/applications/standard/limitedRead",
|                                                               "microsoft.directory/directoryRoleTemplates/allProperties/read",
|                                                               "microsoft.directory/domains/standard/read",
|                                                               "microsoft.directory/organization/basicProfile/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignments/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/memberOf/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/oAuth2PermissionGrants/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/ownedObjects/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/owners/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/policies/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/standard/limitedRead",
|                                                               "microsoft.directory/users/appRoleAssignments/read",
|                                                               "microsoft.directory/users/authenticationMethods/basic/update",
|                                                               "microsoft.directory/users/authenticationMethods/create",
|                                                               "microsoft.directory/users/authenticationMethods/delete",
|                                                               "microsoft.directory/users/authenticationMethods/standard/read",
|                                                               "microsoft.directory/users/authenticationMethods/standard/restrictedRead",
|                                                               "microsoft.directory/users/deviceForResourceAccount/read",
|                                                               "microsoft.directory/users/directReports/read",
|                                                               "microsoft.directory/users/eligibleMemberOf/read",
|                                                               "microsoft.directory/users/invitedBy/read",
|                                                               "microsoft.directory/users/licenseDetails/read",
|                                                               "microsoft.directory/users/manager/read",
|                                                               "microsoft.directory/users/memberOf/read",
|                                                               "microsoft.directory/users/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/users/ownedDevices/read",
|                                                               "microsoft.directory/users/ownedObjects/read",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.directory/users/pendingMemberOf/read",
|                                                               "microsoft.directory/users/photo/read",
|                                                               "microsoft.directory/users/registeredDevices/read",
|                                                               "microsoft.directory/users/scopedRoleMemberOf/read",
|                                                               "microsoft.directory/users/sponsorOf/read",
|                                                               "microsoft.directory/users/sponsors/read",
|                                                               "microsoft.directory/users/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "95e79109-95c0-4d8e-aee3-d01accf2d47b",
|                                           "DisplayName":  "Guest Inviter",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can invite guests but lacks permissions to escalate privileges or control identity plane.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/users/appRoleAssignments/read",
|                                                               "microsoft.directory/users/deviceForResourceAccount/read",
|                                                               "microsoft.directory/users/directReports/read",
|                                                               "microsoft.directory/users/invitedBy/read",
|                                                               "microsoft.directory/users/inviteGuest",
|                                                               "microsoft.directory/users/licenseDetails/read",
|                                                               "microsoft.directory/users/manager/read",
|                                                               "microsoft.directory/users/memberOf/read",
|                                                               "microsoft.directory/users/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/users/ownedDevices/read",
|                                                               "microsoft.directory/users/ownedObjects/read",
|                                                               "microsoft.directory/users/photo/read",
|                                                               "microsoft.directory/users/registeredDevices/read",
|                                                               "microsoft.directory/users/scopedRoleMemberOf/read",
|                                                               "microsoft.directory/users/sponsorOf/read",
|                                                               "microsoft.directory/users/sponsors/read",
|                                                               "microsoft.directory/users/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "f023fd81-a637-4b56-95fd-791ac0226033",
|                                           "DisplayName":  "Service Support Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Primarily read access to service health and support tickets with no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "a0b1b346-4d3e-4e8b-98f8-753987be4970",
|                                           "DisplayName":  "User",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Basic user permissions with no ability to modify roles or identity plane objects.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/administrativeUnits/members/read",
|                                                               "microsoft.directory/administrativeUnits/standard/read",
|                                                               "microsoft.directory/applicationPolicies/createAsOwner",
|                                                               "microsoft.directory/applicationPolicies/standard/read",
|                                                               "microsoft.directory/applications/createAsOwner",
|                                                               "microsoft.directory/applications/owners/read",
|                                                               "microsoft.directory/applications/policies/read",
|                                                               "microsoft.directory/applications/standard/read",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/contacts/memberOf/read",
|                                                               "microsoft.directory/contacts/standard/read",
|                                                               "microsoft.directory/contracts/standard/read",
|                                                               "microsoft.directory/devices/memberOf/read",
|                                                               "microsoft.directory/devices/registeredOwners/read",
|                                                               "microsoft.directory/devices/registeredUsers/read",
|                                                               "microsoft.directory/devices/standard/read",
|                                                               "microsoft.directory/directoryRoles/eligibleMembers/read",
|                                                               "microsoft.directory/directoryRoles/members/read",
|                                                               "microsoft.directory/directoryRoles/standard/read",
|                                                               "microsoft.directory/directoryRoleTemplates/allProperties/read",
|                                                               "microsoft.directory/domains/standard/read",
|                                                               "microsoft.directory/groups/appRoleAssignments/read",
|                                                               "microsoft.directory/groups/createAsOwner",
|                                                               "microsoft.directory/groups/memberOf/read",
|                                                               "microsoft.directory/groups/members/read",
|                                                               "microsoft.directory/groups/owners/read",
|                                                               "microsoft.directory/groups/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/standard/read",
|                                                               "microsoft.directory/oAuth2PermissionGrants/standard/read",
|                                                               "microsoft.directory/organization/standard/read",
|                                                               "microsoft.directory/policies/owners/read",
|                                                               "microsoft.directory/policies/policyAppliedTo/read",
|                                                               "microsoft.directory/policies/standard/read",
|                                                               "microsoft.directory/roleAssignments/standard/read",
|                                                               "microsoft.directory/roleDefinitions/standard/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignments/read",
|                                                               "microsoft.directory/servicePrincipals/authentication/read",
|                                                               "microsoft.directory/servicePrincipals/createAsOwner",
|                                                               "microsoft.directory/servicePrincipals/memberOf/read",
|                                                               "microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/servicePrincipals/ownedObjects/read",
|                                                               "microsoft.directory/servicePrincipals/owners/read",
|                                                               "microsoft.directory/servicePrincipals/policies/read",
|                                                               "microsoft.directory/servicePrincipals/standard/read",
|                                                               "microsoft.directory/subscribedSkus/standard/read",
|                                                               "microsoft.directory/tenantManagement/tenants/create",
|                                                               "microsoft.directory/users/activateServicePlan",
|                                                               "microsoft.directory/users/appRoleAssignments/read",
|                                                               "microsoft.directory/users/deviceForResourceAccount/read",
|                                                               "microsoft.directory/users/directReports/read",
|                                                               "microsoft.directory/users/inviteGuest",
|                                                               "microsoft.directory/users/licenseDetails/read",
|                                                               "microsoft.directory/users/manager/read",
|                                                               "microsoft.directory/users/memberOf/read",
|                                                               "microsoft.directory/users/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/users/ownedDevices/read",
|                                                               "microsoft.directory/users/ownedObjects/read",
|                                                               "microsoft.directory/users/photo/read",
|                                                               "microsoft.directory/users/registeredDevices/read",
|                                                               "microsoft.directory/users/scopedRoleMemberOf/read",
|                                                               "microsoft.directory/users/sponsorOf/read",
|                                                               "microsoft.directory/users/sponsors/read",
|                                                               "microsoft.directory/users/standard/read",
|                                                               "microsoft.directory/applications/appRoles/update",
|                                                               "microsoft.directory/applications/audience/update",
|                                                               "microsoft.directory/applications/authentication/update",
|                                                               "microsoft.directory/applications/basic/update",
|                                                               "microsoft.directory/applications/credentials/update",
|                                                               "microsoft.directory/applications/delete",
|                                                               "microsoft.directory/applications/disablement/update",
|                                                               "microsoft.directory/applications/extensionProperties/update",
|                                                               "microsoft.directory/applications/notes/update",
|                                                               "microsoft.directory/applications/owners/update",
|                                                               "microsoft.directory/applications/permissions/update",
|                                                               "microsoft.directory/applications/policies/update",
|                                                               "microsoft.directory/applications/tag/update",
|                                                               "microsoft.directory/applications/verification/update",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/deletedItems.applications/delete",
|                                                               "microsoft.directory/deletedItems.applications/restore",
|                                                               "microsoft.directory/deletedItems.groups/restore",
|                                                               "microsoft.directory/devices/disable",
|                                                               "microsoft.directory/groupsAssignableToRoles/allProperties/update",
|                                                               "microsoft.directory/groupsAssignableToRoles/assignLicense",
|                                                               "microsoft.directory/groupsAssignableToRoles/delete",
|                                                               "microsoft.directory/groupsAssignableToRoles/reprocessLicenseAssignment",
|                                                               "microsoft.directory/groupsAssignableToRoles/restore",
|                                                               "microsoft.directory/groups/assignedLabels/update",
|                                                               "microsoft.directory/groups/basic/update",
|                                                               "microsoft.directory/groups/classification/update",
|                                                               "microsoft.directory/groups/delete",
|                                                               "microsoft.directory/groups/groupType/update",
|                                                               "microsoft.directory/groups/members/update",
|                                                               "microsoft.directory/groups/owners/update",
|                                                               "microsoft.directory/groups/restore",
|                                                               "microsoft.directory/groups/settings/update",
|                                                               "microsoft.directory/groups/visibility/update",
|                                                               "microsoft.directory/policies/basic/update",
|                                                               "microsoft.directory/policies/delete",
|                                                               "microsoft.directory/policies/owners/update",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/servicePrincipals/audience/update",
|                                                               "microsoft.directory/servicePrincipals/authentication/update",
|                                                               "microsoft.directory/servicePrincipals/basic/update",
|                                                               "microsoft.directory/servicePrincipals/credentials/update",
|                                                               "microsoft.directory/servicePrincipals/delete",
|                                                               "microsoft.directory/servicePrincipals/disable",
|                                                               "microsoft.directory/servicePrincipals/enable",
|                                                               "microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials",
|                                                               "microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials",
|                                                               "microsoft.directory/servicePrincipals/notes/update",
|                                                               "microsoft.directory/servicePrincipals/owners/update",
|                                                               "microsoft.directory/servicePrincipals/permissions/update",
|                                                               "microsoft.directory/servicePrincipals/policies/update",
|                                                               "microsoft.directory/servicePrincipals/tag/update",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.directory/userInfos/address/read",
|                                                               "microsoft.directory/userInfos/email/read",
|                                                               "microsoft.directory/userInfos/openId/read",
|                                                               "microsoft.directory/userInfos/phone/read",
|                                                               "microsoft.directory/userInfos/profile/read",
|                                                               "microsoft.directory/users/authenticationMethods/basic/update",
|                                                               "microsoft.directory/users/authenticationMethods/create",
|                                                               "microsoft.directory/users/authenticationMethods/delete",
|                                                               "microsoft.directory/users/authenticationMethods/standard/read",
|                                                               "microsoft.directory/users/authenticationMethods/standard/restrictedRead",
|                                                               "microsoft.directory/users/basicProfile/update",
|                                                               "microsoft.directory/users/changePassword",
|                                                               "microsoft.directory/users/identities/update",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/mobile/update",
|                                                               "microsoft.directory/users/searchableDeviceKey/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "88d8e3e3-8f55-4a1e-953a-9b9898b8876b",
|                                           "DisplayName":  "Directory Readers",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only directory access without ability to modify roles or identity plane.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/administrativeUnits/members/read",
|                                                               "microsoft.directory/administrativeUnits/standard/read",
|                                                               "microsoft.directory/applicationPolicies/standard/read",
|                                                               "microsoft.directory/applications/owners/read",
|                                                               "microsoft.directory/applications/policies/read",
|                                                               "microsoft.directory/applications/standard/read",
|                                                               "microsoft.directory/contacts/memberOf/read",
|                                                               "microsoft.directory/contacts/standard/read",
|                                                               "microsoft.directory/contracts/standard/read",
|                                                               "microsoft.directory/devices/memberOf/read",
|                                                               "microsoft.directory/devices/registeredOwners/read",
|                                                               "microsoft.directory/devices/registeredUsers/read",
|                                                               "microsoft.directory/devices/standard/read",
|                                                               "microsoft.directory/directoryRoles/eligibleMembers/read",
|                                                               "microsoft.directory/directoryRoles/members/read",
|                                                               "microsoft.directory/directoryRoles/standard/read",
|                                                               "microsoft.directory/domains/standard/read",
|                                                               "microsoft.directory/groups/appRoleAssignments/read",
|                                                               "microsoft.directory/groupSettings/standard/read",
|                                                               "microsoft.directory/groupSettingTemplates/standard/read",
|                                                               "microsoft.directory/groups/memberOf/read",
|                                                               "microsoft.directory/groups/members/read",
|                                                               "microsoft.directory/groups/owners/read",
|                                                               "microsoft.directory/groups/settings/read",
|                                                               "microsoft.directory/groups/standard/read",
|                                                               "microsoft.directory/oAuth2PermissionGrants/standard/read",
|                                                               "microsoft.directory/organization/standard/read",
|                                                               "microsoft.directory/organization/trustedCAsForPasswordlessAuth/read",
|                                                               "microsoft.directory/roleAssignments/standard/read",
|                                                               "microsoft.directory/roleDefinitions/standard/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignments/read",
|                                                               "microsoft.directory/servicePrincipals/memberOf/read",
|                                                               "microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/servicePrincipals/ownedObjects/read",
|                                                               "microsoft.directory/servicePrincipals/owners/read",
|                                                               "microsoft.directory/servicePrincipals/policies/read",
|                                                               "microsoft.directory/servicePrincipals/standard/read",
|                                                               "microsoft.directory/subscribedSkus/standard/read",
|                                                               "microsoft.directory/users/appRoleAssignments/read",
|                                                               "microsoft.directory/users/deviceForResourceAccount/read",
|                                                               "microsoft.directory/users/directReports/read",
|                                                               "microsoft.directory/users/invitedBy/read",
|                                                               "microsoft.directory/users/licenseDetails/read",
|                                                               "microsoft.directory/users/manager/read",
|                                                               "microsoft.directory/users/memberOf/read",
|                                                               "microsoft.directory/users/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/users/ownedDevices/read",
|                                                               "microsoft.directory/users/ownedObjects/read",
|                                                               "microsoft.directory/users/photo/read",
|                                                               "microsoft.directory/users/registeredDevices/read",
|                                                               "microsoft.directory/users/scopedRoleMemberOf/read",
|                                                               "microsoft.directory/users/sponsorOf/read",
|                                                               "microsoft.directory/users/sponsors/read",
|                                                               "microsoft.directory/users/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "d405c6df-0af8-4e3b-95e4-4d06e542189e",
|                                           "DisplayName":  "Device Users",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions and no path to identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9f06204d-73c1-4d4c-880a-6edb90606fd8",
|                                           "DisplayName":  "Azure AD Joined Device Local Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only group settings access with no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/groupSettings/standard/read",
|                                                               "microsoft.directory/groupSettingTemplates/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9c094953-4995-41c8-84c8-3ebb9b32c93f",
|                                           "DisplayName":  "Device Join",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions and no path to identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "c34f683f-4d5a-4403-affd-6615e00e3a7f",
|                                           "DisplayName":  "Workplace Device Join",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions and no path to identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "5d6b6bb7-de71-4623-b4af-96380a352509",
|                                           "DisplayName":  "Security Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to security logs and policies without ability to modify or escalate.",
|                                           "Permissions":  [
|                                                               "microsoft.agentRegistry/allEntities/allProperties/read",
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions/allProperties/read",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/bitlockerKeys/key/read",
|                                                               "microsoft.directory/bulkJobs/standard/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/owners/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/policyAppliedTo/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read",
|                                                               "microsoft.directory/deviceLocalCredentials/standard/read",
|                                                               "microsoft.directory/domains/federationConfiguration/standard/read",
|                                                               "microsoft.directory/entitlementManagement/allProperties/read",
|                                                               "microsoft.directory/identityProtection/allProperties/read",
|                                                               "microsoft.directory/multiTenantOrganization/joinRequest/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/standard/read",
|                                                               "microsoft.directory/namedLocations/standard/read",
|                                                               "microsoft.directory/policies/owners/read",
|                                                               "microsoft.directory/policies/policyAppliedTo/read",
|                                                               "microsoft.directory/policies/standard/read",
|                                                               "microsoft.directory/privilegedIdentityManagement/allProperties/read",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.networkAccess/allEntities/allProperties/read",
|                                                               "microsoft.office365.protectionCenter/allEntities/standard/read",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/payload/allProperties/read",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/reports/allProperties/read",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/simulation/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "5c4f9dcd-47dc-4cf7-8c9a-9e4207cbfc91",
|                                           "DisplayName":  "Customer LockBox Access Approver",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can approve LockBox requests but no identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.lockbox/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "4a5d8f65-41da-4de4-8968-e035b65339cf",
|                                           "DisplayName":  "Reports Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to reports with no ability to modify identity or roles.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "790c1fb9-7f7d-4f88-86a1-ef1f95c05c1b",
|                                           "DisplayName":  "Message Center Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to message center with no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "f70938a0-fc10-4177-9e90-2178f8765737",
|                                           "DisplayName":  "Teams Communications Support Engineer",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to Teams call quality and support data with no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.skypeForBusiness/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/callQuality/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "fcf91098-03e3-41a9-b5ba-6f0ec8188a12",
|                                           "DisplayName":  "Teams Communications Support Specialist",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to Teams call quality data with no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.skypeForBusiness/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/callQuality/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "ac16e43d-7b2d-40e0-ac05-243ff356ab5b",
|                                           "DisplayName":  "Message Center Privacy Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to message center security messages with no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.messageCenter/securityMessages/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e6d1a23a-da11-4be4-9570-befc86d067a7",
|                                           "DisplayName":  "Compliance Data Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Primarily manages compliance and support data with no direct path to identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.informationProtection/allEntities/allTasks",
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/cloudAppSecurity/allProperties/allTasks",
|                                                               "microsoft.office365.complianceManager/allEntities/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "5f2222b1-57c3-48ba-8ad5-d4759f1fde6f",
|                                           "DisplayName":  "Security Operator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Has read access to security logs and some security features but lacks permissions to modify identity or role assignments.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.advancedThreatProtection/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/bulkJobs/standard/read",
|                                                               "microsoft.directory/cloudAppSecurity/allProperties/allTasks",
|                                                               "microsoft.directory/identityProtection/allProperties/allTasks",
|                                                               "microsoft.directory/privilegedIdentityManagement/allProperties/read",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.intune/allEntities/read",
|                                                               "microsoft.office365.securityComplianceCenter/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.windows.defenderAdvancedThreatProtection/allEntities/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "74ef975b-6605-40af-a5d2-b9539d836353",
|                                           "DisplayName":  "Kaizala Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Limited to service health and support ticket access with no identity plane control capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "f2ef992c-3afb-46b9-b7cf-a126ee74c451",
|                                           "DisplayName":  "Global Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access across tenant data without ability to modify roles or credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.agentRegistry/allEntities/allProperties/read",
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.backup/allEntities/allProperties/read",
|                                                               "microsoft.cloudPC/allEntities/allProperties/read",
|                                                               "microsoft.commerce.billing/allEntities/allProperties/read",
|                                                               "microsoft.commerce.billing/purchases/standard/read",
|                                                               "microsoft.directory/accessReviews/allProperties/read",
|                                                               "microsoft.directory/accessReviews/definitions/allProperties/read",
|                                                               "microsoft.directory/adminConsentRequestPolicy/allProperties/read",
|                                                               "microsoft.directory/administrativeUnits/allProperties/read",
|                                                               "microsoft.directory/appConsent/appConsentRequests/allProperties/read",
|                                                               "microsoft.directory/applications/allProperties/read",
|                                                               "microsoft.directory/applications/synchronization/standard/read",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/bitlockerKeys/key/read",
|                                                               "microsoft.directory/bulkJobs/standard/read",
|                                                               "microsoft.directory/cloudAppSecurity/allProperties/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/allProperties/read",
|                                                               "microsoft.directory/connectorGroups/allProperties/read",
|                                                               "microsoft.directory/connectors/allProperties/read",
|                                                               "microsoft.directory/contacts/allProperties/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/standard/read",
|                                                               "microsoft.directory/customAuthenticationExtensions/allProperties/read",
|                                                               "microsoft.directory/deviceLocalCredentials/standard/read",
|                                                               "microsoft.directory/deviceManagementPolicies/standard/read",
|                                                               "microsoft.directory/deviceRegistrationPolicy/standard/read",
|                                                               "microsoft.directory/devices/allProperties/read",
|                                                               "microsoft.directory/directoryRoles/allProperties/read",
|                                                               "microsoft.directory/directoryRoleTemplates/allProperties/read",
|                                                               "microsoft.directory/domains/allProperties/read",
|                                                               "microsoft.directory/domains/federationConfiguration/standard/read",
|                                                               "microsoft.directory/entitlementManagement/allProperties/read",
|                                                               "microsoft.directory/externalUserProfiles/standard/read",
|                                                               "microsoft.directory/groups/allProperties/read",
|                                                               "microsoft.directory/groupSettings/allProperties/read",
|                                                               "microsoft.directory/groupSettingTemplates/allProperties/read",
|                                                               "microsoft.directory/identityProtection/allProperties/read",
|                                                               "microsoft.directory/lifecycleWorkflows/workflows/allProperties/read",
|                                                               "microsoft.directory/loginOrganizationBranding/allProperties/read",
|                                                               "microsoft.directory/multiTenantOrganization/joinRequest/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/standard/read",
|                                                               "microsoft.directory/namedLocations/standard/read",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/read",
|                                                               "microsoft.directory/onPremisesSynchronization/standard/read",
|                                                               "microsoft.directory/organization/allProperties/read",
|                                                               "microsoft.directory/pendingExternalUserProfiles/standard/read",
|                                                               "microsoft.directory/permissionGrantPolicies/standard/read",
|                                                               "microsoft.directory/policies/allProperties/read",
|                                                               "microsoft.directory/privilegedIdentityManagement/allProperties/read",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/roleAssignments/allProperties/read",
|                                                               "microsoft.directory/roleDefinitions/allProperties/read",
|                                                               "microsoft.directory/scopedRoleMemberships/allProperties/read",
|                                                               "microsoft.directory/serviceAction/getAvailableExtentionProperties",
|                                                               "microsoft.directory/servicePrincipalCreationPolicies/standard/read",
|                                                               "microsoft.directory/servicePrincipals/allProperties/read",
|                                                               "microsoft.directory/servicePrincipals/synchronization/standard/read",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.directory/subscribedSkus/allProperties/read",
|                                                               "microsoft.directory/users/allProperties/read",
|                                                               "microsoft.directory/users/authenticationMethods/standard/restrictedRead",
|                                                               "microsoft.directory/verifiableCredentials/configuration/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read",
|                                                               "microsoft.edge/allEntities/allProperties/read",
|                                                               "microsoft.graph.dataConnect/allEntities/allProperties/read",
|                                                               "microsoft.hardware.support/shippingAddress/allProperties/read",
|                                                               "microsoft.hardware.support/shippingStatus/allProperties/read",
|                                                               "microsoft.hardware.support/warrantyClaims/allProperties/read",
|                                                               "microsoft.healthPlatform/allEntities/allProperties/read",
|                                                               "microsoft.insights/allEntities/allProperties/read",
|                                                               "microsoft.microsoft365.organizationalData/allEntities/allProperties/read",
|                                                               "microsoft.networkAccess/allEntities/allProperties/read",
|                                                               "microsoft.office365.copilot/allEntities/allProperties/read",
|                                                               "microsoft.office365.fileStorageContainers/allEntities/allProperties/read",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.messageCenter/securityMessages/read",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.organizationalMessages/allEntities/allProperties/read",
|                                                               "microsoft.office365.protectionCenter/allEntities/allProperties/read",
|                                                               "microsoft.office365.securityComplianceCenter/allEntities/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.office365.yammer/allEntities/allProperties/read",
|                                                               "microsoft.permissionsManagement/allEntities/allProperties/read",
|                                                               "microsoft.teams/allEntities/allProperties/read",
|                                                               "microsoft.virtualVisits/allEntities/allProperties/read",
|                                                               "microsoft.viva.glint/allEntities/allProperties/read",
|                                                               "microsoft.viva.goals/allEntities/allProperties/read",
|                                                               "microsoft.viva.pulse/allEntities/allProperties/read",
|                                                               "microsoft.windows.updatesDeployments/allEntities/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "0964bb5e-9bdb-4d7b-ac29-58e794862a40",
|                                           "DisplayName":  "Search Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages search content and messages but lacks permissions to affect identity or role assignments.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.search/content/manage",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "8835291a-918c-4fd7-a9ce-faa49f0cf7d9",
|                                           "DisplayName":  "Search Editor",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can manage search content but no access to identity plane or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.search/content/manage",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "644ef478-e28f-4e28-b9dc-3fdde9aa0b1f",
|                                           "DisplayName":  "Printer Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages printer resources without access to identity or role management.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.print/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e8cef6f1-e4bd-4ea8-bc07-4b8d950f4477",
|                                           "DisplayName":  "Printer Technician",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Limited to read and update printer properties; no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.print/connectors/allProperties/read",
|                                                               "microsoft.azure.print/printers/allProperties/read",
|                                                               "microsoft.azure.print/printers/basic/update",
|                                                               "microsoft.azure.print/printers/register",
|                                                               "microsoft.azure.print/printers/unregister"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "11648597-926c-4cf3-9c36-bcebb0ba8dcc",
|                                           "DisplayName":  "Power Platform Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages Power Platform resources without direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.dynamics365/allEntities/allTasks",
|                                                               "microsoft.flow/allEntities/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.powerApps/allEntities/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e3973bdf-4987-49ae-837a-ba8e231c7286",
|                                           "DisplayName":  "Azure DevOps Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full control over Azure DevOps but no direct path to tenant-wide identity or role control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.devOps/allEntities/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "2b745bdf-0803-4d80-aa65-822c4493daac",
|                                           "DisplayName":  "Office Apps Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages Office 365 service health and user communication without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.userCommunication/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "d37c8bed-0711-4417-ba38-b4abe66ce4c2",
|                                           "DisplayName":  "Network Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages network locations and performance data without identity or role assignment capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.network/locations/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "31e939ad-9672-4796-9c2e-873181342d2d",
|                                           "DisplayName":  "Insights Business Leader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can update reports and read insights but no identity plane or role assignment permissions.",
|                                           "Permissions":  [
|                                                               "microsoft.insights/programs/allProperties/update",
|                                                               "microsoft.insights/reports/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "3d762c5a-1b6c-493f-843e-55a3b42923d4",
|                                           "DisplayName":  "Teams Devices Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to Teams devices; no identity or role management.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/devices/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "c430b396-e693-46cc-96f3-db01bf8bb62a",
|                                           "DisplayName":  "Attack Simulation Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages attack simulation payloads and reports but lacks identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.protectionCenter/attackSimulator/payload/allProperties/allTasks",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/reports/allProperties/read",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/simulation/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9c6df0f2-1e7c-4dc3-b195-66dfbd24aa8f",
|                                           "DisplayName":  "Attack Payload Author",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can create attack payloads but no permissions to modify roles or credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.protectionCenter/attackSimulator/payload/allProperties/allTasks",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/reports/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "75934031-6c7e-415a-99d7-48dbd49e875e",
|                                           "DisplayName":  "Usage Summary Reports Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to usage reports without identity or role management.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.usageReports/allEntities/standard/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "b5a8dcf3-09d5-43a9-a639-8e29ef291470",
|                                           "DisplayName":  "Knowledge Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages knowledge content and security groups but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/groups.security/basic/update",
|                                                               "microsoft.directory/groups.security/create",
|                                                               "microsoft.directory/groups.security/createAsOwner",
|                                                               "microsoft.directory/groups.security/delete",
|                                                               "microsoft.directory/groups.security/members/update",
|                                                               "microsoft.directory/groups.security/owners/update",
|                                                               "microsoft.office365.knowledge/contentUnderstanding/allProperties/allTasks",
|                                                               "microsoft.office365.knowledge/knowledgeNetwork/allProperties/allTasks",
|                                                               "microsoft.office365.knowledge/learningSources/allProperties/allTasks",
|                                                               "microsoft.office365.protectionCenter/sensitivityLabels/allProperties/read",
|                                                               "microsoft.office365.sharePoint/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "744ec460-397e-42ad-a462-8b3f9747a02c",
|                                           "DisplayName":  "Knowledge Manager",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages knowledge content visibility and groups without identity or role assignment capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/groups.security/basic/update",
|                                                               "microsoft.directory/groups.security/create",
|                                                               "microsoft.directory/groups.security/createAsOwner",
|                                                               "microsoft.directory/groups.security/delete",
|                                                               "microsoft.directory/groups.security/members/update",
|                                                               "microsoft.directory/groups.security/owners/update",
|                                                               "microsoft.office365.knowledge/contentUnderstanding/analytics/allProperties/read",
|                                                               "microsoft.office365.knowledge/knowledgeNetwork/topicVisibility/allProperties/allTasks",
|                                                               "microsoft.office365.sharePoint/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "d2562ede-74db-457e-a7b6-544e236ebb61",
|                                           "DisplayName":  "AI Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages AI agent users but lacks permissions to modify roles or credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/agentUsers/assignLicense",
|                                                               "microsoft.directory/agentUsers/basic/update",
|                                                               "microsoft.directory/agentUsers/create",
|                                                               "microsoft.directory/agentUsers/delete",
|                                                               "microsoft.directory/agentUsers/disable",
|                                                               "microsoft.directory/agentUsers/enable",
|                                                               "microsoft.directory/agentUsers/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/agentUsers/lifeCycleInfo/read",
|                                                               "microsoft.directory/agentUsers/lifeCycleInfo/update",
|                                                               "microsoft.directory/agentUsers/manager/update",
|                                                               "microsoft.directory/agentUsers/photo/update",
|                                                               "microsoft.directory/agentUsers/reprocessLicenseAssignment",
|                                                               "microsoft.directory/agentUsers/restore",
|                                                               "microsoft.directory/agentUsers/revokeSignInSessions",
|                                                               "microsoft.directory/agentUsers/sponsors/update",
|                                                               "microsoft.directory/agentUsers/usageLocation/update",
|                                                               "microsoft.directory/agentUsers/userPrincipalName/update",
|                                                               "microsoft.directory/entitlementManagement/allProperties/read",
|                                                               "microsoft.directory/subscribedSkus/standard/read",
|                                                               "microsoft.directory/users/allProperties/read",
|                                                               "microsoft.office365.copilot/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.search/content/manage",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "1fe13547-53f6-408d-ac04-7f8eed167b38",
|                                           "DisplayName":  "AI Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to AI and application policies without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/administrativeUnits/members/read",
|                                                               "microsoft.directory/administrativeUnits/standard/read",
|                                                               "microsoft.directory/agentUsers/lifeCycleInfo/read",
|                                                               "microsoft.directory/applicationPolicies/standard/read",
|                                                               "microsoft.directory/applications/owners/read",
|                                                               "microsoft.directory/applications/policies/read",
|                                                               "microsoft.directory/applications/standard/read",
|                                                               "microsoft.directory/contacts/memberOf/read",
|                                                               "microsoft.directory/contacts/standard/read",
|                                                               "microsoft.directory/contracts/standard/read",
|                                                               "microsoft.directory/domains/standard/read",
|                                                               "microsoft.directory/entitlementManagement/allProperties/read",
|                                                               "microsoft.directory/groups/appRoleAssignments/read",
|                                                               "microsoft.directory/groupSettings/standard/read",
|                                                               "microsoft.directory/groupSettingTemplates/standard/read",
|                                                               "microsoft.directory/groups/memberOf/read",
|                                                               "microsoft.directory/groups/members/read",
|                                                               "microsoft.directory/groups/owners/read",
|                                                               "microsoft.directory/groups/settings/read",
|                                                               "microsoft.directory/groups/standard/read",
|                                                               "microsoft.directory/oAuth2PermissionGrants/standard/read",
|                                                               "microsoft.directory/organization/standard/read",
|                                                               "microsoft.directory/organization/trustedCAsForPasswordlessAuth/read",
|                                                               "microsoft.directory/roleAssignments/standard/read",
|                                                               "microsoft.directory/roleDefinitions/standard/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignments/read",
|                                                               "microsoft.directory/servicePrincipals/memberOf/read",
|                                                               "microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/servicePrincipals/ownedObjects/read",
|                                                               "microsoft.directory/servicePrincipals/owners/read",
|                                                               "microsoft.directory/servicePrincipals/policies/read",
|                                                               "microsoft.directory/servicePrincipals/standard/read",
|                                                               "microsoft.directory/subscribedSkus/standard/read",
|                                                               "microsoft.directory/users/allProperties/read",
|                                                               "microsoft.office365.copilot/allEntities/allProperties/read",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "8424c6f0-a189-499e-bbd0-26c1753c96d4",
|                                           "DisplayName":  "Attribute Definition Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages custom security attribute definitions without direct identity or role assignment capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/attributeSets/allProperties/allTasks",
|                                                               "microsoft.directory/customSecurityAttributeDefinitions/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d",
|                                           "DisplayName":  "Attribute Assignment Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can update custom security attributes but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/attributeSets/allProperties/read",
|                                                               "microsoft.directory/azureManagedIdentities/customSecurityAttributes/read",
|                                                               "microsoft.directory/azureManagedIdentities/customSecurityAttributes/update",
|                                                               "microsoft.directory/customSecurityAttributeDefinitions/allProperties/read",
|                                                               "microsoft.directory/devices/customSecurityAttributes/read",
|                                                               "microsoft.directory/devices/customSecurityAttributes/update",
|                                                               "microsoft.directory/servicePrincipals/customSecurityAttributes/read",
|                                                               "microsoft.directory/servicePrincipals/customSecurityAttributes/update",
|                                                               "microsoft.directory/users/customSecurityAttributes/read",
|                                                               "microsoft.directory/users/customSecurityAttributes/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "1d336d2c-4ae8-42ef-9711-b3604ce3fc2c",
|                                           "DisplayName":  "Attribute Definition Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to attribute definitions without identity or role management.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/attributeSets/allProperties/read",
|                                                               "microsoft.directory/customSecurityAttributeDefinitions/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "ffd52fa5-98dc-465c-991d-fc073eb59f8f",
|                                           "DisplayName":  "Attribute Assignment Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to custom security attributes without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/attributeSets/allProperties/read",
|                                                               "microsoft.directory/azureManagedIdentities/customSecurityAttributes/read",
|                                                               "microsoft.directory/customSecurityAttributeDefinitions/allProperties/read",
|                                                               "microsoft.directory/devices/customSecurityAttributes/read",
|                                                               "microsoft.directory/servicePrincipals/customSecurityAttributes/read",
|                                                               "microsoft.directory/users/customSecurityAttributes/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "892c5842-a9a6-463a-8041-72aa08ca3cf6",
|                                           "DisplayName":  "Cloud App Security Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages Cloud App Security settings but lacks direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/cloudAppSecurity/allProperties/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "32696413-001a-46ae-978c-ce0f6b3620d2",
|                                           "DisplayName":  "Windows Update Deployment Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages Windows update deployments without identity or role assignment capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.windows.updatesDeployments/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "3f1acade-1e04-4fbc-9b69-f0302cd84aef",
|                                           "DisplayName":  "Edge Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages Edge browser settings and support tickets without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.edge/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "810a2642-a034-447f-a5e8-41beaa378541",
|                                           "DisplayName":  "Yammer Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages Yammer groups and memberships without direct identity or role assignment capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/groups.unified/basic/update",
|                                                               "microsoft.directory/groups.unified/create",
|                                                               "microsoft.directory/groups.unified/delete",
|                                                               "microsoft.directory/groups.unified/members/update",
|                                                               "microsoft.directory/groups.unified/owners/update",
|                                                               "microsoft.directory/groups.unified/restore",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.office365.yammer/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e300d9e7-4a2b-4295-9eff-f1c78b36cc98",
|                                           "DisplayName":  "Virtual Visits Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages virtual visits features without identity or role assignment permissions.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.virtualVisits/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "25df335f-86eb-4119-b717-0ff02de207e9",
|                                           "DisplayName":  "Insights Analyst",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can run insights queries and read support tickets but lacks identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.insights/queries/allProperties/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "1501b917-7653-4ff9-a4b5-203eaf33784f",
|                                           "DisplayName":  "Microsoft Hardware Warranty Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages hardware warranty and support data without identity or role management.",
|                                           "Permissions":  [
|                                                               "microsoft.hardware.support/shippingAddress/allProperties/allTasks",
|                                                               "microsoft.hardware.support/shippingStatus/allProperties/read",
|                                                               "microsoft.hardware.support/warrantyClaims/allProperties/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "281fe777-fb20-4fbb-b7a3-ccebce5b0d96",
|                                           "DisplayName":  "Microsoft Hardware Warranty Specialist",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Limited to read and create warranty claims without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.hardware.support/shippingAddress/allProperties/read",
|                                                               "microsoft.hardware.support/warrantyClaims/createAsOwner",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.hardware.support/shippingStatus/allProperties/read",
|                                                               "microsoft.hardware.support/warrantyClaims/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "92b086b3-e367-4ef2-b869-1de128fb986e",
|                                           "DisplayName":  "Viva Goals Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages Viva Goals features without identity or role assignment permissions.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.viva.goals/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "27460883-1df1-4691-b032-3b79643e5e63",
|                                           "DisplayName":  "User Experience Success Manager",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to billing, messages, and reports without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.commerce.billing/purchases/standard/read",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.organizationalMessages/allEntities/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/standard/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "507f53e4-4e52-4077-abd3-d2e1558b6ea2",
|                                           "DisplayName":  "Organizational Messages Writer",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Permissions allow reading and writing organizational messages and usage reports but do not enable identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.organizationalMessages/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/standard/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "ac434307-12b9-4fa1-a708-88bf58caabc1",
|                                           "DisplayName":  "Global Secure Access Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Primarily read access to application policies and audit logs with no direct ability to modify roles or credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/applicationPolicies/standard/read",
|                                                               "microsoft.directory/applications/applicationProxy/read",
|                                                               "microsoft.directory/applications/owners/read",
|                                                               "microsoft.directory/applications/policies/read",
|                                                               "microsoft.directory/applications/standard/read",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/standard/read",
|                                                               "microsoft.directory/connectorGroups/allProperties/read",
|                                                               "microsoft.directory/connectors/allProperties/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/standard/read",
|                                                               "microsoft.directory/namedLocations/standard/read",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.networkAccess/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "87761b17-1ed2-4af3-9acd-92a150038160",
|                                           "DisplayName":  "Viva Pulse Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read and write access to service health and usage reports without identity plane control capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.viva.pulse/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "dd13091a-6207-4fc0-82ba-3641e056ab95",
|                                           "DisplayName":  "Extended Directory User Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can update and delete external user profiles but lacks permissions to assign roles or reset credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/externalUserProfiles/basic/update",
|                                                               "microsoft.directory/externalUserProfiles/delete",
|                                                               "microsoft.directory/externalUserProfiles/standard/read",
|                                                               "microsoft.directory/pendingExternalUserProfiles/basic/update",
|                                                               "microsoft.directory/pendingExternalUserProfiles/create",
|                                                               "microsoft.directory/pendingExternalUserProfiles/delete",
|                                                               "microsoft.directory/pendingExternalUserProfiles/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "5b784334-f94b-471a-a387-e7219fc49ca2",
|                                           "DisplayName":  "Attribute Log Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read and write access to custom security attribute logs without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.customSecurityAttributeDiagnosticSettings/allEntities/allProperties/allTasks",
|                                                               "microsoft.directory/customSecurityAttributeAuditLogs/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9c99539d-8186-4804-835f-fd51ef9e2dcd",
|                                           "DisplayName":  "Attribute Log Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to custom security attribute audit logs with no privilege escalation path.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/customSecurityAttributeAuditLogs/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "1076ac91-f3d9-41a7-a339-dcdf5f480acc",
|                                           "DisplayName":  "Teams Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to Teams and web portal data without identity or role management capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/allEntities/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "aa38014f-0993-46e9-9b45-30501a20909d",
|                                           "DisplayName":  "Teams Telephony Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Access to service health and telephony settings but no direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.skypeForBusiness/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/callQuality/allProperties/read",
|                                                               "microsoft.teams/voice/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "963797fb-eb3b-4cde-8ce3-5878b3f32a3f",
|                                           "DisplayName":  "Dynamics 365 Business Central Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read and write access to Dynamics 365 and related services without ability to modify identity or roles.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/domains/standard/read",
|                                                               "microsoft.directory/organization/standard/read",
|                                                               "microsoft.directory/subscribedSkus/standard/read",
|                                                               "microsoft.directory/users/standard/read",
|                                                               "microsoft.dynamics365.businessCentral/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "8c8b803f-96e1-4129-9349-20738d9f9652",
|                                           "DisplayName":  "Microsoft 365 Migration Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full access to migration tasks but no permissions to modify roles or credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.migrations/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "1a7d78b6-429f-476b-b8eb-35fb715fffd4",
|                                           "DisplayName":  "SharePoint Embedded Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full control over file storage containers and reports but no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.fileStorageContainers/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "92ed04bf-c94a-4b82-9729-b799a7a4c178",
|                                           "DisplayName":  "Organizational Branding Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can modify branding settings but lacks permissions to affect identity or role assignments.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/loginOrganizationBranding/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e48398e2-f4bb-4074-8f31-4586725e205b",
|                                           "DisplayName":  "Organizational Messages Approver",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can read and update organizational messages but no path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.organizationalMessages/allEntities/allProperties/read",
|                                                               "microsoft.office365.organizationalMessages/allEntities/allProperties/update",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "ee67aa9c-e510-4759-b906-227085a7fd4d",
|                                           "DisplayName":  "Microsoft Graph Data Connect Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full access to data connect and message center but no direct role or credential management.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.graph.dataConnect/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "1707125e-0aa2-4d4d-8655-a7c786c76a25",
|                                           "DisplayName":  "Microsoft 365 Backup Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full backup and restore permissions without identity plane or role assignment capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.backup/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "a92aed5d-d78a-4d16-b381-09adb37eb3b0",
|                                           "DisplayName":  "On Premises Directory Sync Account",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to on-premises synchronization settings without ability to modify roles or credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/onPremisesSynchronization/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "422218e4-db15-4ef9-bbe0-8afb41546d79",
|                                           "DisplayName":  "Attribute Provisioning Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to custom security attribute schema with no privilege escalation path.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/servicePrincipals/synchronization.customSecurityAttributes/schema/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "ecb2c6bf-0ab6-418e-bd87-7986f8d63bbe",
|                                           "DisplayName":  "Attribute Provisioning Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can update custom security attribute schema but no direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/servicePrincipals/synchronization.customSecurityAttributes/schema/read",
|                                                               "microsoft.directory/servicePrincipals/synchronization.customSecurityAttributes/schema/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "843318fb-79a6-4168-9e6f-aa9a07481cc4",
|                                           "DisplayName":  "Global Secure Access Log Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to network traffic logs without identity or role management capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.networkAccess/trafficLogs/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9d70768a-0cbc-4b4c-aea3-2e124b2477f4",
|                                           "DisplayName":  "Organizational Data Source Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full access to organizational data sources and service health but no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.microsoft365.organizationalData/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "024906de-61e5-49c8-8572-40335f1e0e10",
|                                           "DisplayName":  "People Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can update user photos and organization properties but cannot assign roles or reset credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.peopleAdmin/organization/allProperties/read",
|                                                               "microsoft.peopleAdmin/organization/allProperties/update",
|                                                               "microsoft.people/users/photo/read",
|                                                               "microsoft.people/users/photo/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "2ea5ce4c-b2d8-4668-bd81-3680bd2d227a",
|                                           "DisplayName":  "IoT Device Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manage device authentication configurations without identity plane or role assignment permissions.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/certificateBasedDeviceAuthConfigurations/create",
|                                                               "microsoft.directory/certificateBasedDeviceAuthConfigurations/credentials/update",
|                                                               "microsoft.directory/certificateBasedDeviceAuthConfigurations/delete",
|                                                               "microsoft.directory/certificateBasedDeviceAuthConfigurations/standard/read",
|                                                               "microsoft.directory/deviceTemplates/create",
|                                                               "microsoft.directory/deviceTemplates/createDeviceFromTemplate",
|                                                               "microsoft.directory/deviceTemplates/delete",
|                                                               "microsoft.directory/deviceTemplates/deviceInstances/read",
|                                                               "microsoft.directory/deviceTemplates/owners/read",
|                                                               "microsoft.directory/deviceTemplates/owners/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "0ec3f692-38d6-4d14-9e69-0377ca7797ad",
|                                           "DisplayName":  "Viva Glint Tenant Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Access to service health and usage reports without identity or role management capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.viva.glint/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "78b0ccd1-afc2-4f92-9116-b41aedd09592",
|                                           "DisplayName":  "Places Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full control over places data but no path to identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.places/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9d3e04ba-3ee4-4d1b-a3a7-9aef423a09be",
|                                           "DisplayName":  "SharePoint Backup Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full backup and restore permissions for SharePoint without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.backup/oneDriveForBusinessProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/oneDriveForBusinessRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/sites/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/userDrives/allProperties/allTasks",
|                                                               "microsoft.backup/sharePointProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/sharePointRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/siteProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/siteRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.backup/userDriveProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/userDriveRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "49eb8f75-97e9-4e37-9b2b-6c3ebfcffa31",
|                                           "DisplayName":  "Exchange Backup Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full backup and restore permissions for Exchange without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.backup/exchangeProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/exchangeRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/userMailboxes/allProperties/allTasks",
|                                                               "microsoft.backup/userMailboxProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/userMailboxRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e93e3737-fa85-474a-aee4-7d3fb86510f3",
|                                           "DisplayName":  "Dragon Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Access to health platform and service health without identity or role management capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.healthPlatform/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "99009c4a-3b3f-4957-82a9-9d35e12db77e",
|                                           "DisplayName":  "SharePoint Advanced Management Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full backup and restore permissions for SharePoint without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.backup/oneDriveForBusinessProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/oneDriveForBusinessRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/sites/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/userDrives/allProperties/allTasks",
|                                                               "microsoft.backup/sharePointProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/sharePointRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/siteProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/siteRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.backup/userDriveProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/userDriveRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/groups.unified/basic/update",
|                                                               "microsoft.directory/groups.unified/create",
|                                                               "microsoft.directory/groups.unified/delete",
|                                                               "microsoft.directory/groups.unified/members/update",
|                                                               "microsoft.directory/groups.unified/owners/update",
|                                                               "microsoft.directory/groups.unified/restore",
|                                                               "microsoft.office365.migrations/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.sharePointAdvancedManagement/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.sharePoint/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "2fe872fb-daa8-4afc-8f6c-53c4565cfef4",
|                                           "DisplayName":  "Teams External Collaboration Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manage external access policies but no direct ability to assign roles or reset credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/policies/externalAccessPolicy/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "adb2368d-a9be-41b5-8667-d96778e081b0",
|                                           "DisplayName":  "Agent ID Developer",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to service principals without privilege escalation path.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/servicePrincipals/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "0b00bede-4072-4d22-b441-e7df02a1ef63",
|                                           "DisplayName":  "Authentication Extensibility Password Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manage custom authentication extension settings without direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/onPasswordSubmitCustomAuthenticationExtension/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "6b942400-691f-4bf0-9d12-d8a254a2baf5",
|                                           "DisplayName":  "Agent Registry Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full control over agent registry but no identity or role assignment capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.agentRegistry/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "db506228-d27e-4b7d-95e5-295956d6615f",
|                                           "DisplayName":  "Agent ID Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manage agent users but no permissions to assign privileged roles or reset credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/agentUsers/assignLicense",
|                                                               "microsoft.directory/agentUsers/basic/update",
|                                                               "microsoft.directory/agentUsers/create",
|                                                               "microsoft.directory/agentUsers/delete",
|                                                               "microsoft.directory/agentUsers/disable",
|                                                               "microsoft.directory/agentUsers/enable",
|                                                               "microsoft.directory/agentUsers/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/agentUsers/lifeCycleInfo/read",
|                                                               "microsoft.directory/agentUsers/lifeCycleInfo/update",
|                                                               "microsoft.directory/agentUsers/manager/update",
|                                                               "microsoft.directory/agentUsers/photo/update",
|                                                               "microsoft.directory/agentUsers/reprocessLicenseAssignment",
|                                                               "microsoft.directory/agentUsers/restore",
|                                                               "microsoft.directory/agentUsers/revokeSignInSessions",
|                                                               "microsoft.directory/agentUsers/sponsors/update",
|                                                               "microsoft.directory/agentUsers/usageLocation/update",
|                                                               "microsoft.directory/agentUsers/userPrincipalName/update",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/externalUserProfiles/standard/read",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups.unified/createAsOwner",
|                                                               "microsoft.directory/organization/standard/read",
|                                                               "microsoft.directory/policies/standard/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e07494ad-1654-4dd2-922e-6f81a71bf00f",
|                                           "DisplayName":  "Purview Workload Content Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions; presumed read-only content access without identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "02d5655b-c1cf-4e5f-98da-5fb919085bf6",
|                                           "DisplayName":  "Purview Workload Content Writer",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions; presumed content write access without identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "3f04f91a-4ad7-4bd3-bcfa-49882ea1a88a",
|                                           "DisplayName":  "Purview Workload Content Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions; presumed content admin without identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "fc8ad4e2-40e4-4724-8317-bcda7503ecbf",
|                                           "DisplayName":  "Customer Delegated Admin Relationship Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manage delegated admin privileges but no direct ability to assign global admin roles or reset credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.commerce.tenantRelationships/customerDelegatedAdminPrivileges/allProperties/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "f42252d9-5400-4d7b-b9ef-cc582dbb8577",
|                                           "DisplayName":  "Entra Backup Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read and create backup previews without identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/backup/preview/cancel",
|                                                               "microsoft.directory/backup/preview/create",
|                                                               "microsoft.directory/backup/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "b6a27b2b-f905-4b2e-81b5-0d90e0ef1fdb",
|                                           "DisplayName":  "Entra Backup Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manage backup and recovery but no direct identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/backup/preview/cancel",
|                                                               "microsoft.directory/backup/preview/create",
|                                                               "microsoft.directory/backup/recovery/cancel",
|                                                               "microsoft.directory/backup/recovery/create",
|                                                               "microsoft.directory/backup/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "1981f584-96e9-4a6f-95b0-f522373f8fae",
|                                           "DisplayName":  "Tenant Governance Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manage cross-tenant access policies but no direct ability to assign privileged roles or reset credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/crossTenantAccessPolicy/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/create",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/delete",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e0a4caa6-fe82-443f-b92f-d87341d17b2e",
|                                           "DisplayName":  "Tenant Governance Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions; presumed read-only without identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "b8e31d83-1534-480f-9b10-0338ded51b7e",
|                                           "DisplayName":  "Tenant Governance Relationship Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions; presumed limited scope without identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "124577f8-48ed-456a-839f-13b419002e33",
|                                           "DisplayName":  "Tenant Governance Relationship Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions; presumed read-only without identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       }
|                                   ],
|    "EntraID_CustomRoles_Tier0":  [
|
|                                  ],
|    "EntraID_CustomRoles_Tier1":  [
|
|                                  ],
|    "EntraID_CustomRoles_Tier2":  [
|
|                                  ],
|    "EntraID_CustomRoles_Tier3":  [
|                                      {
|                                          "Id":  "5fae9c61-3aef-49d2-b441-ae8471522219",
|                                          "DisplayName":  "Users_Read_All_As_Scoped_Role_Delegation_on_SP",
|                                          "IsBuiltIn":  false,
|                                          "Tier":  3,
|                                          "Reason":  "Read-only access to users without ability to assign roles or reset credentials.",
|                                          "Permissions":  [
|                                                              "microsoft.directory/users/standard/read"
|                                                          ]
|                                      }
|                                  ],
|    "EntraID_APIPermissions_Tier0":  [
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AppRoleAssignment.ReadWrite.All",
|                                             "DisplayName":  "Manage app permission grants and app role assignments",
|                                             "Description":  "Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.",
|                                             "Tier":  0,
|                                             "Reason":  "Manage permission grants and app assignments for any app without signed-in user; direct role assignment control enabling full tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.ReadWrite.AuthenticationMethod",
|                                             "DisplayName":  "Read and write all authentication method policies ",
|                                             "Description":  "Allows the app to read and write all authentication method policies for the tenant, without a signed-in user. ",
|                                             "Tier":  0,
|                                             "Reason":  "Write access to authentication method policies allows resetting MFA and credential controls, enabling immediate full tenant compromise."
|                                         }
|                                     ],
|    "EntraID_APIPermissions_Tier1":  [
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "APIConnectors.ReadWrite.All",
|                                             "DisplayName":  "Read and write API connectors for authentication flows",
|                                             "Description":  "Allows the app to read, create and manage the API connectors used in user authentication flows, on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Manage API connectors in authentication flows, enabling modification of authentication which can lead to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AppCatalog.ReadWrite.All",
|                                             "DisplayName":  "Read and write to all app catalogs",
|                                             "Description":  "Allows the app to create, read, update, and delete apps in the app catalogs without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Create, update, delete apps in app catalog without signed-in user; can modify app registrations enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AppCertTrustConfiguration.ReadWrite.All",
|                                             "DisplayName":  "Read and write the trusted certificate authority configuration for applications",
|                                             "Description":  "Allows the app to create, read, update and delete the trusted certificate authority configuration which can be used to restrict application certificates based on their issuing authority, on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Modify trusted certificate authority configuration; can impact app authentication and enable privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Application.ReadUpdate.All",
|                                             "DisplayName":  "Read and update all apps",
|                                             "Description":  "Allows the app to read and update all apps in your organization, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Read and update all apps without signed-in user; enables modification of app registrations leading to privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Application.ReadWrite.All",
|                                             "DisplayName":  "Read and write all applications",
|                                             "Description":  "Allows the app to create, read, update and delete applications and service principals on behalf of the signed-in user. Does not allow management of consent grants.",
|                                             "Tier":  1,
|                                             "Reason":  "Create, read, update, delete applications and service principals on behalf of user; enables role assignment and privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Application.ReadWrite.OwnedBy",
|                                             "DisplayName":  "Manage apps that this app creates or owns",
|                                             "Description":  "Allows the app to create other applications, and fully manage those applications (read, update, update application secrets and delete), without a signed-in user.  It cannot update any apps that it is not an owner of.",
|                                             "Tier":  1,
|                                             "Reason":  "Manage owned applications including secrets; can escalate privileges via owned app registrations."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuthenticationContext.ReadWrite.All",
|                                             "DisplayName":  "Read and write all authentication context information",
|                                             "Description":  "Allows the app to read and update all authentication context information in your organization on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Allows updating authentication context information, which can be leveraged to modify authentication policies and potentially bypass MFA, enabling a reliable path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DelegatedAdminRelationship.ReadWrite.All",
|                                             "DisplayName":  "Manage Delegated Admin relationships with customers",
|                                             "Description":  "Allows the app to manage (create-update-terminate) Delegated Admin relationships with customers and role assignments to security groups for active Delegated Admin relationships without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Can manage delegated admin relationships and role assignments, enabling a reliable path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DelegatedPermissionGrant.ReadWrite.All",
|                                             "DisplayName":  "Manage all delegated permission grants",
|                                             "Description":  "Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), on behalf of the signed in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Can manage delegated permission grants, enabling assignment of high privilege roles and tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceManagementRBAC.ReadWrite.All",
|                                             "DisplayName":  "Read and write Microsoft Intune RBAC settings",
|                                             "Description":  "Allows the app to read and write the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to Intune RBAC settings enables privilege escalation to assign roles, enabling near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementServiceConfig.ReadWrite.All",
|                                             "DisplayName":  "Read and write Microsoft Intune configuration",
|                                             "Description":  "Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to Intune service configuration including enrollment and third party connections enables privilege escalation and identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Domain.ReadWrite.All",
|                                             "DisplayName":  "Read and write domains",
|                                             "Description":  "Allows the app to read and write all domain properties without a signed in user.  Also allows the app to add,  verify and remove domains.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to domain properties including add, verify, and remove domains enables near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Domain-InternalFederation.ReadWrite.All",
|                                             "DisplayName":  "Create, read, update and delete internal federation configuration for a domain.",
|                                             "Description":  "Allows the app to create, read, update and delete internal federation configuration for a domain.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to internal federation configuration enables manipulation of trust relationships, enabling near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EventListener.ReadWrite.All",
|                                             "DisplayName":  "Read and write all authentication event listeners",
|                                             "Description":  "Allows the app to read or write your organization\u0027s authentication event listeners without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Application read/write access to authentication event listeners allows modification of authentication policies, enabling reliable escalation to full tenant compromise."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Exchange.Manage",
|                                             "DisplayName":  "Manage Exchange configuration",
|                                             "Description":  "Allows the app to manage the organization\u0027s Exchange environment, such as mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles to the app user.",
|                                             "Tier":  1,
|                                             "Reason":  "Delegated management of Exchange environment with admin role assignments enables reliable escalation to tenant-wide identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Exchange.ManageAsApp",
|                                             "DisplayName":  "Manage Exchange As Application",
|                                             "Description":  "Allows the app to manage the organization\u0027s Exchange environment without any user interaction. This includes mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles directly to the app.",
|                                             "Tier":  1,
|                                             "Reason":  "Application management of Exchange environment with admin role assignments enables reliable tenant-wide identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Exchange.ManageAsAppV2",
|                                             "DisplayName":  "Manage Exchange as application v2",
|                                             "Description":  "Allows the app to manage a limited set of Exchange Online configuration objects without user interaction, for specific scenarios supported by the adminapi/v2.0 endpoint. To enable management actions an admin must also assign the appropriate Exchange RBAC roles directly to the app.",
|                                             "Tier":  1,
|                                             "Reason":  "Application management of limited Exchange configuration with admin role assignments enables reliable escalation to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Exchange.ManageV2",
|                                             "DisplayName":  "Manage Exchange configuration v2",
|                                             "Description":  "Allows the app to manage a limited set of Exchange Online configuration objects via the adminapi/v2.0 endpoint. This permission is intended for specific scenarios and requires appropriate Exchange RBAC role assignments.",
|                                             "Tier":  1,
|                                             "Reason":  "Delegated management of limited Exchange configuration with admin role assignments enables reliable escalation to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IdentityProvider.ReadWrite.All",
|                                             "DisplayName":  "Read and write identity providers",
|                                             "Description":  "Allows the app to read and write your organization’s identity (authentication) providers’ properties on behalf of the user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to identity providers allows modification of authentication infrastructure, enabling reliable escalation to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OnPremDirectorySynchronization.ReadWrite.All",
|                                             "DisplayName":  "Read and write all on-premises directory synchronization information",
|                                             "Description":  "Allows the app to read and write all on-premises directory synchronization information for the organization, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Read and write access to on-prem directory sync info enables modification of sync objects, enabling near-direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OnPremisesPublishingProfiles.ReadWrite.All",
|                                             "DisplayName":  "Manage on-premises published resources",
|                                             "Description":  "Allows the app to create, view, update and delete on-premises published resources, on-premises agents and agent groups, as part of a hybrid identity configuration, without a signed in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Full control over on-prem publishing profiles and agents enables manipulation of hybrid identity configuration, enabling reliable escalation to tenant compromise."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Organization.ReadWrite.All",
|                                             "DisplayName":  "Read and write organization information",
|                                             "Description":  "Allows the app to read and write the organization and related resources, without a signed-in user. Related resources include things like subscribed skus and tenant branding information.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to organization info without user enables modification of tenant-wide settings, enabling near-direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OrgSettings-AppsAndServices.ReadWrite.All",
|                                             "DisplayName":  "Read and write organization-wide apps and services settings",
|                                             "Description":  "Allows the app to read and write organization-wide apps and services settings, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Read and write access to org-wide apps and services settings without user enables modification of tenant settings, enabling near-direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.ReadWrite.AccessReview",
|                                             "DisplayName":  "Read and write your organization\u0027s directory access review default policy",
|                                             "Description":  "Allows the app to read and write your organization\u0027s directory access review default policy without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to directory access review policies enables modification of access reviews, a reliable pivot to elevate permissions."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.ApplicationConfiguration",
|                                             "DisplayName":  "Read and write your organization\u0027s application configuration policies",
|                                             "Description":  "Allows the app to read and write your organization\u0027s application configuration policies on behalf of the signed-in user.  This includes policies such as activityBasedTimeoutPolicy, claimsMappingPolicy, homeRealmDiscoveryPolicy,  tokenIssuancePolicy and tokenLifetimePolicy.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to application configuration policies allows modification of token issuance and claims policies, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.ReadWrite.AuthenticationFlows",
|                                             "DisplayName":  "Read and write authentication flow policies",
|                                             "Description":  "Allows the app to read and write all authentication flow policies for the tenant, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to authentication flow policies enables modification of authentication processes, a direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.Authorization",
|                                             "DisplayName":  "Read and write your organization\u0027s authorization policy",
|                                             "Description":  "Allows the app to read and write your organization\u0027s authorization policy on behalf of the signed-in user.  For example, authorization policies can control some of the permissions that the out-of-the-box user role has by default.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to authorization policies allows modifying user role permissions, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.ReadWrite.B2BManagementPolicy",
|                                             "DisplayName":  "Read and write your organization\u0027s B2BManagement policies",
|                                             "Description":  "Allows the app to read and write all your organization\u0027s B2BManagement policies without a signed in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to B2B management policies enables control over external collaboration, a reliable pivot to elevate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.ConditionalAccess",
|                                             "DisplayName":  "Read and write your organization\u0027s conditional access policies",
|                                             "Description":  "Allows the app to read and write your organization\u0027s conditional access policies on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to conditional access policies allows disabling or modifying security controls, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.ReadWrite.ConsentRequest",
|                                             "DisplayName":  "Read and write your organization\u0027s consent request policy",
|                                             "Description":  "Allows the app to read and write your organization\u0027s consent requests policy without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to consent request policies enables manipulation of app permissions, a reliable path to privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.CrossTenantAccess",
|                                             "DisplayName":  "Read and write your organization\u0027s cross tenant access policies",
|                                             "Description":  "Allows the app to read and write your organization\u0027s cross-tenant access policies and configuration for automatic user consent settings to suppress consent prompts for users of the other tenant on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to cross-tenant access policies enables modifying trust relationships, a reliable pivot to elevate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.CrossTenantCapability",
|                                             "DisplayName":  "Read and write your organization\u0027s M365 cross tenant access capabilities",
|                                             "Description":  "Allows the app to read and write your organization\u0027s M365 cross tenant access capabilities on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to cross-tenant capabilities allows modifying M365 cross-tenant access, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.DeviceConfiguration",
|                                             "DisplayName":  "Read and write your organization\u0027s device configuration policies",
|                                             "Description":  "Allows the app to read and write your organization\u0027s device configuration policies on behalf of the signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to device configuration policies allows modifying device registration and controls, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.ExternalIdentities",
|                                             "DisplayName":  "Read and write your organization\u0027s external identities policy",
|                                             "Description":  "Allows the application to read and update the organization\u0027s external identities policy on behalf of the signed-in user.  For example, external identities policy controls if users invited to access resources in your organization via B2B collaboration or B2B direct connect are allowed to self-service leave.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to external identities policy allows modifying B2B collaboration settings, a reliable pivot to elevate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.FedTokenValidation",
|                                             "DisplayName":  "Read and write your organization\u0027s federated token validation policy",
|                                             "Description":  "Allows the application to read and update the organization\u0027s federated token validation policy on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to federated token validation policies allows modifying token validation, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.IdentityProtection",
|                                             "DisplayName":  "Read and write your organization’s identity protection policy ",
|                                             "Description":  "Allows the app to read and write your organization’s identity protection policy on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to identity protection policies allows modifying security controls, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.PermissionGrant",
|                                             "DisplayName":  "Manage consent and permission grant policies",
|                                             "Description":  "Allows the app to manage policies related to consent and permission grants for applications, on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to consent and permission grant policies allows managing app permissions, a reliable path to privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.SecurityDefaults",
|                                             "DisplayName":  "Read and write your organization\u0027s security defaults policy",
|                                             "Description":  "Allows the app to read and write your organization\u0027s security defaults policy on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to security defaults policy allows disabling baseline protections, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.TrustFramework",
|                                             "DisplayName":  "Read and write your organization\u0027s trust framework policies",
|                                             "Description":  "Allows the app to read and write your organization\u0027s trust framework policies on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to trust framework policies allows modifying authentication and identity flows, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedAccess.ReadWrite.AzureAD",
|                                             "DisplayName":  "Read and write privileged access to Azure AD roles",
|                                             "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles in your organization, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Manage time-based assignment and just-in-time elevation of Azure AD roles without user; enables role assignment escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedAccess.ReadWrite.AzureADGroup",
|                                             "DisplayName":  "Read and write privileged access to Azure AD groups",
|                                             "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups in your organization, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Manage time-based assignment and elevation of Azure AD groups without user; enables role assignment escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup",
|                                             "DisplayName":  "Read, create, and delete assignment schedules for access to Azure AD groups",
|                                             "Description":  "Allows the app to read, create, and delete time-based assignment schedules for access to Azure AD groups, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Create and delete time-based assignment schedules for Azure AD groups without user; enables role assignment escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup",
|                                             "DisplayName":  "Read, create, and delete eligibility schedules for access to Azure AD groups",
|                                             "Description":  "Allows the app to read, create, and delete time-based eligibility schedules for access to Azure AD groups, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Manage eligibility schedules for Azure AD groups without user; enables role assignment escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PublicKeyInfrastructure.ReadWrite.All",
|                                             "DisplayName":  "Read and write all certificate based authentication configurations",
|                                             "Description":  "Allows the application to read and write certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Read and write certificate-based authentication configuration without user; can modify authentication infrastructure enabling escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleAssignmentSchedule.ReadWrite.Directory",
|                                             "DisplayName":  "Read, update, and delete all active role assignments for your company\u0027s directory",
|                                             "Description":  "Allows the app to read and manage the active role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user. This includes managing active directory role membership, and reading directory role templates, directory roles and active memberships.",
|                                             "Tier":  1,
|                                             "Reason":  "Manage active RBAC assignments including directory role membership; enables reliable privilege escalation to tenant-wide roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleAssignmentSchedule.Remove.Directory",
|                                             "DisplayName":  "Delete all active role assignments of your company\u0027s directory",
|                                             "Description":  "Delete all active privileged role-based access control (RBAC) assignments of your company\u0027s directory, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Delete active privileged RBAC assignments; enables manipulation of role assignments leading to tenant compromise."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleEligibilitySchedule.ReadWrite.Directory",
|                                             "DisplayName":  "Read, update, and delete  all eligible role assignments for your company\u0027s directory",
|                                             "Description":  "Allows the app to read and manage the eligible role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user. This includes managing eligible directory role membership, and reading directory role templates, directory roles and eligible memberships.",
|                                             "Tier":  1,
|                                             "Reason":  "Manage eligible RBAC assignments including directory role membership; enables reliable privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleEligibilitySchedule.Remove.Directory",
|                                             "DisplayName":  "Delete all eligible role assignments for your company\u0027s directory",
|                                             "Description":  "Allows the app to delete the eligible role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Delete eligible RBAC assignments; enables manipulation of role eligibility leading to privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleGroupMember.tenant.write",
|                                             "DisplayName":  "RoleGroupMember.tenant.write",
|                                             "Description":  "This allows to change RoleGroupMember to the tenant",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to role group membership; allows adding self or others to privileged roles for tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagement.ReadWrite.Directory",
|                                             "DisplayName":  "Read and write directory RBAC settings",
|                                             "Description":  "Allows the app to read and manage the role-based access control (RBAC) settings for your company\u0027s directory, on behalf of the signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.",
|                                             "Tier":  1,
|                                             "Reason":  "Delegated permission to manage directory RBAC roles and memberships enables role assignment and potential elevation to Global Admin."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagementPolicy.ReadWrite.AzureADGroup",
|                                             "DisplayName":  "Read, update, and delete all policies in PIM for Groups",
|                                             "Description":  "Allows the app to read, update, and delete policies in Privileged Identity Management for Groups, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Application permission to modify PIM policies for groups can enable elevation or assignment of privileged roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagementPolicy.ReadWrite.Directory",
|                                             "DisplayName":  "Read, update, and delete all policies for privileged role assignments of your company\u0027s directory",
|                                             "Description":  "Allows the app to read, update, and delete policies for privileged role-based access control (RBAC) assignments of your company\u0027s directory, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Application permission to modify privileged RBAC assignment policies enables role assignment and elevation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagementPolicy.ReadWrite.EntraAppRole",
|                                             "DisplayName":  "Manage all policies in PIM for App Roles",
|                                             "Description":  "Allows the app to manage policies in Privileged Identity Management for App Roles, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Application permission to manage PIM policies for app roles enables role assignment and potential privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ServicePrincipalEndpoint.ReadWrite.All",
|                                             "DisplayName":  "Read and update service principal endpoints",
|                                             "Description":  "Allows the app to update service principal endpoints",
|                                             "Tier":  1,
|                                             "Reason":  "Update service principal endpoints without signed-in user; can modify app registrations enabling role assignment escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SharePointTenantSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and change SharePoint and OneDrive tenant settings",
|                                             "Description":  "Allows the application to read and change the tenant-level settings of SharePoint and OneDrive, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Read and modify tenant-level SharePoint and OneDrive settings without signed-in user; can impact security settings enabling escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SignInIdentifier.ReadWrite.All",
|                                             "DisplayName":  "Read and write all sign-in identifiers",
|                                             "Description":  "Allows the app to read and write your organization\u0027s sign-in identifiers, on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Read and write organization\u0027s sign-in identifiers on behalf of user; can modify authentication identifiers enabling escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SpiffeTrustDomain.ReadWrite.All",
|                                             "DisplayName":  "Read and write SPIFFE trust domains and child resources",
|                                             "Description":  "Allows the app to read and write your organization\u0027s SPIFFE trust domains and child resources without a signed in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Read and write SPIFFE trust domains without signed-in user; can modify trust relationships enabling escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Synchronization.ReadWrite.All",
|                                             "DisplayName":  "Read and write all Azure AD synchronization data.",
|                                             "Description":  "Allows the application to configure the Azure AD synchronization service, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Configuring Azure AD sync service enables modification of identity synchronization, enabling reliable privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User-PasswordProfile.ReadWrite.All",
|                                             "DisplayName":  "Read and write password profiles and reset user passwords",
|                                             "Description":  "Allows the app to read and write password profiles and reset passwords for all users, on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Allows reading and resetting passwords for all users; direct path to tenant takeover via credential reset."
|                                         }
|                                     ],
|    "EntraID_APIPermissions_Tier2":  [
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AccessReview.ReadWrite.All",
|                                             "DisplayName":  "Manage all access reviews that user can access",
|                                             "Description":  "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings that the signed-in user has access to in the organization.",
|                                             "Tier":  2,
|                                             "Reason":  "Can modify access reviews which may impact access governance but no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AccessReview.ReadWrite.Membership",
|                                             "DisplayName":  "Manage access reviews for group and app memberships",
|                                             "Description":  "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization for group and app memberships, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Application-level access to modify group and app membership reviews; potential for data impact but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AdministrativeUnit.ReadWrite.All",
|                                             "DisplayName":  "Read and write all administrative units",
|                                             "Description":  "Allows the app to create, read, update, and delete administrative units and manage administrative unit membership without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Can create and modify administrative units and memberships; no direct identity plane control but potential for governance impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentity.Create.All",
|                                             "DisplayName":  "Create agent identities without an agent blueprint parent",
|                                             "Description":  "Allows the app to create agent identities, even if the app is not the parent agent identity blueprint.",
|                                             "Tier":  2,
|                                             "Reason":  "Can create agent identities without signed-in user; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentity.CreateAsManager",
|                                             "DisplayName":  "Create agent identities linked to itself.",
|                                             "Description":  "Allows the app to create linked agent identities without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Create linked agent identities without signed-in user; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentity.DeleteRestore.All",
|                                             "DisplayName":  "Delete and restore agent identities",
|                                             "Description":  "Allows the client to delete and restore agent identities.",
|                                             "Tier":  2,
|                                             "Reason":  "Delete and restore agent identities; potential impact on identity management but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentity.EnableDisable.All",
|                                             "DisplayName":  "Enable or disable agent identities",
|                                             "Description":  "Allows the client to enable or disable agent identities.",
|                                             "Tier":  2,
|                                             "Reason":  "Enable or disable agent identities; potential impact on identity management but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentity.ReadWrite.All",
|                                             "DisplayName":  "Read and write all agent identities",
|                                             "Description":  "Allows the client to read, update, and delete agent identities on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read, update, and delete agent identities on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentityBlueprint.AddRemoveCreds.All",
|                                             "DisplayName":  "Update agent identity blueprint credentials",
|                                             "Description":  "Allows updating agent identity blueprint credentials on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Update agent identity blueprint credentials; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentityBlueprint.Create",
|                                             "DisplayName":  "Create agent identity blueprints.",
|                                             "Description":  "Allows creating new agent identity blueprints without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Create new agent identity blueprints; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentityBlueprint.DeleteRestore.All",
|                                             "DisplayName":  "Delete and restore agent identity blueprints.",
|                                             "Description":  "Allows deleting or restoring agent identity blueprints without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Delete or restore agent identity blueprints; potential impact on identity management but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentityBlueprint.ReadWrite.All",
|                                             "DisplayName":  "Read and write all agent identity blueprints.",
|                                             "Description":  "Allows the app to read, update, and delete agent identity blueprints without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read, update, and delete agent identity blueprints; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentityBlueprint.UpdateAuthProperties.All",
|                                             "DisplayName":  "Update agent identity blueprint authorization and authentication properties",
|                                             "Description":  "Allows updating agent identity blueprint authorization and authentication properties without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Update authorization and authentication properties of blueprints; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentityBlueprintPrincipal.Create",
|                                             "DisplayName":  "Create agent identity blueprint service principals.",
|                                             "Description":  "Allows creating new agent identity blueprint principals with a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Create new blueprint principals; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentityBlueprintPrincipal.DeleteRestore.All",
|                                             "DisplayName":  "Delete and restore agent identity blueprints.",
|                                             "Description":  "Allows deleting or restoring agent identity blueprints with a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Delete or restore blueprint principals; potential impact on identity management but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentityBlueprintPrincipal.EnableDisable.All",
|                                             "DisplayName":  "Enable or disable agent identity blueprint principals.",
|                                             "Description":  "Allows enabling or disabling agent identity blueprint principals with a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Enable or disable blueprint principals; potential impact on identity management but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentityBlueprintPrincipal.ReadWrite.All",
|                                             "DisplayName":  "Read and write all agent identity blueprint principals.",
|                                             "Description":  "Allows the app to read, update, and delete agent identity blueprint principals without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read, update, and delete blueprint principals; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdUser.ReadWrite.All",
|                                             "DisplayName":  "Read and write all agent ID users\u0027 full profiles",
|                                             "Description":  "Allows the app to read and update agent ID user profiles and read basic company properties without a signed in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read and update agent ID user profiles; no direct identity plane control but potential for data manipulation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdUser.ReadWrite.IdentityParentedBy",
|                                             "DisplayName":  "Read and write all agent ID users\u0027 full profiles",
|                                             "Description":  "Allows the app to read and write the full set of profile properties, reports, and managers of agent ID users in your organization, and read basic company properties, on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read and write full profile properties of agent ID users; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentInstance.ReadWrite.All",
|                                             "DisplayName":  "Read and write all agent instances in Agent Registry",
|                                             "Description":  "Allows the app to create, read, update, and delete all agent instances in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Create, read, update, and delete agent instances; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentInstance.ReadWrite.ManagedBy",
|                                             "DisplayName":  "Read and write managed-by agent instances in Agent Registry",
|                                             "Description":  "Allows the app to create, read, update, and delete agent instances that designate the calling app as their manager in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Manage agent instances designated to calling app; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentRegistration.ReadWrite.All",
|                                             "DisplayName":  "Read and write all agent registrations",
|                                             "Description":  "Allows the app to read and write agent registration information without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read and write agent registration information; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Agreement.ReadWrite.All",
|                                             "DisplayName":  "Read and write all terms of use agreements",
|                                             "Description":  "Allows the app to read and write terms of use agreements on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read and write terms of use agreements; no direct identity plane control but can modify governance documents."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BitlockerKey.Read.All",
|                                             "DisplayName":  "Read all BitLocker keys",
|                                             "Description":  "Allows an app to read BitLocker keys for all devices, without a signed-in user. Allows read of the recovery key.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to BitLocker recovery keys enables significant data exposure but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CallTranscripts.Read.All",
|                                             "DisplayName":  "Read all call transcripts",
|                                             "Description":  "Allows the app to read call transcripts for all calls without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to call transcripts across tenant enables data exfiltration but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Chat.Read.All",
|                                             "DisplayName":  "Read all chat messages",
|                                             "Description":  "Allows the app to read all 1-to-1 or group chat messages in Microsoft Teams.",
|                                             "Tier":  2,
|                                             "Reason":  "Read all chat messages without signed-in user; enables mass data exfiltration but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Chat.Read.WhereInstalled",
|                                             "DisplayName":  "Read all chat messages for chats where the associated Teams application is installed.",
|                                             "Description":  "Allows the app to read all one-to-one or group chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read chat messages where app installed without signed-in user; data exfiltration risk only."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChatMessage.Read.All",
|                                             "DisplayName":  "Read all chat messages",
|                                             "Description":  "Allows the app to read all one-to-one and group chats messages in Microsoft Teams, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read all chat messages without signed-in user; enables mass data exfiltration but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Device.ReadWrite.All",
|                                             "DisplayName":  "Read and write devices",
|                                             "Description":  "Allows the app to read and write all device properties without a signed in user.  Does not allow device creation, device deletion or update of device alternative security identifiers.",
|                                             "Tier":  2,
|                                             "Reason":  "Can modify all device properties without user context; may enable indirect privilege escalation but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceLocalCredential.Read.All",
|                                             "DisplayName":  "Read device local credential passwords",
|                                             "Description":  "Allows the app to read device local credential properties including passwords, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read device local credentials including passwords; enables credential theft but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementApps.ReadWrite.All",
|                                             "DisplayName":  "Read and write Microsoft Intune apps",
|                                             "Description":  "Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to Intune app configurations may enable policy manipulation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceManagementCloudCA.ReadWrite.All",
|                                             "DisplayName":  "Read and write Microsoft Cloud PKI objects",
|                                             "Description":  "Allows the app to read and write certification authority information on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to certification authority info could impact device trust but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementConfiguration.ReadWrite.All",
|                                             "DisplayName":  "Read and write Microsoft Intune device configuration and policies",
|                                             "Description":  "Allows the app to read and write properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to Intune device configuration and compliance policies; potential policy manipulation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceManagementManagedDevices.PrivilegedOperations.All",
|                                             "DisplayName":  "Perform user-impacting remote actions on Microsoft Intune devices",
|                                             "Description":  "Allows the app to perform remote high impact actions such as wiping the device or resetting the passcode on devices managed by Microsoft Intune.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows remote wipe and passcode reset on managed devices; impactful but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementManagedDevices.ReadWrite.All",
|                                             "DisplayName":  "Read and write Microsoft Intune devices",
|                                             "Description":  "Allows the app to read and write the properties of devices managed by Microsoft Intune, without a signed-in user. Does not allow high impact operations such as remote wipe and password reset on the device’s owner",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to managed device properties without high impact operations; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceManagementScripts.ReadWrite.All",
|                                             "DisplayName":  "Read and write Microsoft Intune Scripts",
|                                             "Description":  "Allows the app to read and write Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts on behalf of the signed in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to device management scripts could enable policy manipulation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceTemplate.Create",
|                                             "DisplayName":  "Create device template",
|                                             "Description":  "Allows the app to create device templates. The app is marked as owner of the created device template. As a member of owners, the app will be allowed to manage devices created from the template.",
|                                             "Tier":  2,
|                                             "Reason":  "Ability to create device templates and manage devices from them; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceTemplate.ReadWrite.All",
|                                             "DisplayName":  "Read and write all device templates",
|                                             "Description":  "Allows the app to create, read, update and delete the device template, on behalf of the signed in user. It also allows the app to add or remove owners on any device template.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to device templates including owner management; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DevX.ReadWrite.All",
|                                             "DisplayName":  "Create and Manage Developer Experience functionality",
|                                             "Description":  "Allows the app to make API calls to register and manage 3rd party Service Fabric workloads, on your behalf.",
|                                             "Tier":  2,
|                                             "Reason":  "Manage 3rd party Service Fabric workloads; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Directory.ReadWrite.All",
|                                             "DisplayName":  "Read and write directory data",
|                                             "Description":  "Allows the app to read and write data in your organization\u0027s directory, such as users, and groups.  It does not allow the app to delete users or groups, or reset user passwords.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to directory data excluding user deletion or password reset; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DirectoryRecommendations.ReadWrite.All",
|                                             "DisplayName":  "Read and update Azure AD recommendations",
|                                             "Description":  "Allows the app to read and update Azure AD recommendations, on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to Azure AD recommendations; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DynamicRiskPreventionTag.Tenant.Write",
|                                             "DisplayName":  "DynamicRiskPreventionTag.Tenant.Write",
|                                             "Description":  "DynamicRiskPreventionTag.Tenant.Write",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to risk prevention tags; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "eDiscovery.ReadWrite.All",
|                                             "DisplayName":  "Read and write all eDiscovery objects",
|                                             "Description":  "Allows the app to read and write eDiscovery objects such as cases, custodians, review sets and other related objects without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to eDiscovery objects; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduAdministration.ReadWrite",
|                                             "DisplayName":  "Manage education app settings",
|                                             "Description":  "Manage the state and settings of all Microsoft education apps on behalf of the user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to education app state and settings; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduAdministration.ReadWrite.All",
|                                             "DisplayName":  "Manage education app settings",
|                                             "Description":  "Manage the state and settings of all Microsoft education apps.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to all education app state and settings; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduAssignments.ReadWrite",
|                                             "DisplayName":  "Read and write users\u0027 class assignments and their grades",
|                                             "Description":  "Allows the app to read and write assignments and their grades on behalf of the user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to assignments and grades; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduAssignments.ReadWrite.All",
|                                             "DisplayName":  "Create, read, update and delete all class assignments with grades",
|                                             "Description":  "Allows the app to create, read, update and delete all class assignments with grades for all users without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to all class assignments and grades; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduAssignments.ReadWriteBasic",
|                                             "DisplayName":  "Read and write users\u0027 class assignments without grades",
|                                             "Description":  "Allows the app to read and write assignments without grades on behalf of the user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to assignments without grades; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduAssignments.ReadWriteBasic.All",
|                                             "DisplayName":  "Create, read, update and delete all class assignments without grades",
|                                             "Description":  "Allows the app to create, read, update and delete all class assignments without grades for all users without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to all class assignments without grades; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduCurricula.ReadWrite",
|                                             "DisplayName":  "Read and write the user\u0027s class modules and resources",
|                                             "Description":  "Allows the app to read and write user\u0027s modules and resources on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to user modules and resources; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduCurricula.ReadWrite.All",
|                                             "DisplayName":  "Read and write all class modules and resources",
|                                             "Description":  "Allows the app to read and write all modules and resources, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to all modules and resources; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "full_access_as_app",
|                                             "DisplayName":  "Use Exchange Web Services with full access to all mailboxes",
|                                             "Description":  "Allows the app to have full access via Exchange Web Services to all mailboxes without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Full mailbox access via Exchange Web Services without signed-in user; enables mass data exfiltration but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IdentityProvider.Read.All",
|                                             "DisplayName":  "Read identity providers",
|                                             "Description":  "Allows the app to read your organization’s identity (authentication) providers’ properties on behalf of the user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to identity providers reveals authentication configuration but no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IMAP.AccessAsApp",
|                                             "DisplayName":  "IMAP.AccessAsApp",
|                                             "Description":  "Allow application to access user’s mailbox via IMAP protocol",
|                                             "Tier":  2,
|                                             "Reason":  "Full mailbox access via IMAP enables data exfiltration but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Mail.Read",
|                                             "DisplayName":  "Read mail in all mailboxes",
|                                             "Description":  "Allows the app to read mail in all mailboxes without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to all mailboxes without a signed-in user enables mass data exfiltration but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.Read.All",
|                                             "DisplayName":  "Read user and shared mail ",
|                                             "Description":  "Allows the app to read mail a user can access, including their own and shared mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows reading mail across users for data exfiltration but no direct identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.Read.Shared",
|                                             "DisplayName":  "Read user and shared mail",
|                                             "Description":  "Allows the app to read mail a user can access, including their own and shared mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows reading shared mail for data exfiltration but no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Mail.ReadBasic.All",
|                                             "DisplayName":  "Read basic mail in all mailboxes",
|                                             "Description":  "Allows the app to read basic mail properties in all mailboxes without a signed-in user. Includes all properties except body, previewBody, attachments and any extended properties.",
|                                             "Tier":  2,
|                                             "Reason":  "Read basic mail properties across all mailboxes for data exfiltration but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Mail.ReadWrite",
|                                             "DisplayName":  "Read and write mail in all mailboxes",
|                                             "Description":  "Allows the app to create, read, update, and delete mail in all mailboxes without a signed-in user. Does not include permission to send mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Create, read, update, delete mail in all mailboxes for data manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.ReadWrite.All",
|                                             "DisplayName":  "Read and write user and shared mail ",
|                                             "Description":  "Allows the app to create, read, update, and delete mail a user has permission to access, including their own and shared mail. Does not include permission to send mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Delegated mail write access across user mailboxes for data manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.ReadWrite.Shared",
|                                             "DisplayName":  "Read and write user and shared mail",
|                                             "Description":  "Allows the app to create, read, update, and delete mail a user has permission to access, including their own and shared mail. Does not include permission to send mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Delegated mail write access on shared mailboxes for data manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail-Advanced.ReadWrite",
|                                             "DisplayName":  "Read and write the user\u0027s mail, including modifying existing non-draft mails",
|                                             "Description":  "Allows the app to create, read, update, and delete email, including contents of non-draft emails in user mailboxes, on behalf of the signed-in user. Does not include permission to send mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Delegated full mail read/write excluding send; data plane impact only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Mail-Advanced.ReadWrite.All",
|                                             "DisplayName":  "Read and write mail in all mailboxes, including modifying existing non-draft mails",
|                                             "Description":  "Allows the app to create, read, update, and delete all email, including contents of non-draft emails in user mailboxes, without a signed-in user. Does not include permission to send mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Application full mail read/write excluding send; enables data manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail-Advanced.ReadWrite.Shared",
|                                             "DisplayName":  "Read and write all mail the user can access, including modifying existing non-draft mails",
|                                             "Description":  "Allows the app to create, read, update, and delete mail including contents of non-draft emails for all mails a user has permission to access, on behalf of the signed-in user. This includes their own and shared mail. Does not include permission to send mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Delegated full mail read/write on accessible mailboxes; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Mailbox.Migration",
|                                             "DisplayName":  "Move mailboxes between organizations",
|                                             "Description":  "Application permission grants permission to move mailboxes between Office365 organizations",
|                                             "Tier":  2,
|                                             "Reason":  "Allows moving mailboxes between tenants; significant data impact but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxFolder.Read.All",
|                                             "DisplayName":  "Read all the users\u0027 mailbox folders",
|                                             "Description":  "Allows the app to read all the users\u0027 mailbox folders, without signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read mailbox folders across users for data exfiltration; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxFolder.ReadWrite.All",
|                                             "DisplayName":  "Read and write all the users\u0027 mailbox folders",
|                                             "Description":  "Allows the app to read and write all the users\u0027 mailbox folders, without signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write mailbox folders across users; data plane impact only."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxItem.Export.All",
|                                             "DisplayName":  "Export all the users\u0027 mailbox items",
|                                             "Description":  "Allows the app to export all the users\u0027 mailbox items, without signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Export mailbox items across users; data exfiltration risk but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxItem.ImportExport.All",
|                                             "DisplayName":  "Allows the app to perform backup and restore for all mailbox items",
|                                             "Description":  "Allows the app to backup, restore, and modify all mailbox items without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Backup/restore mailbox items across users; data plane impact only."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxItem.Read.All",
|                                             "DisplayName":  "Read all the users\u0027 mailbox items",
|                                             "Description":  "Allows the app to read all the users\u0027 mailbox items, without signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read mailbox items across users; data exfiltration risk but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OnPremDirectorySynchronization.Read.All",
|                                             "DisplayName":  "Read all on-premises directory synchronization information",
|                                             "Description":  "Allows the app to read all on-premises directory synchronization information for the organization, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to on-prem directory sync info; may aid reconnaissance but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedAccess.ReadWrite.AzureResources",
|                                             "DisplayName":  "Read and write privileged access to Azure resources",
|                                             "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation of Azure resources (like your subscriptions, resource groups, storage, compute) in your organization, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Manage time-based elevation of Azure resources without user; no direct identity plane control but high impact on resources."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagement.ReadWrite.CloudPC",
|                                             "DisplayName":  "Read and write Cloud PC RBAC settings",
|                                             "Description":  "Allows the app to read and manage the Cloud PC role-based access control (RBAC) settings, on behalf of the signed-in user. This includes reading and managing Cloud PC role definitions and role assignments.",
|                                             "Tier":  2,
|                                             "Reason":  "Manage Cloud PC RBAC roles and assignments but limited to Cloud PC scope; no direct tenant-wide identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SharePointCrossTenantMigration.Manage.All",
|                                             "DisplayName":  "Read, write and manage Cross-Tenant migration settings and tasks",
|                                             "Description":  "Read, write and manage Cross-Tenant migration settings and tasks, without a signed-in user",
|                                             "Tier":  2,
|                                             "Reason":  "Manage cross-tenant migration settings without signed-in user; significant data impact but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Sites.Archive.All",
|                                             "DisplayName":  "Archive/reactivate Site Collections without a signed in user.",
|                                             "Description":  "Allow the application to archive/reactivate site collections without a signed in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Archive/reactivate site collections without signed-in user; significant impact on workloads but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Sites.Create.All",
|                                             "DisplayName":  "Create Site Collections, on behalf of the signed-in user",
|                                             "Description":  "Allow the application to create site collections on behalf of the signed in user. Upon creation the application will be granted Sites.Selected(delegated) + FullControl to the newly created site.",
|                                             "Tier":  2,
|                                             "Reason":  "Create site collections on behalf of user with delegated full control on new site; no direct tenant-wide identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Sites.FullControl.All",
|                                             "DisplayName":  "Have full control of all site collections",
|                                             "Description":  "Allows the app to have full control of all site collections without a signed in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Full control of all site collections without signed-in user; significant data and workload impact but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Sites.Manage.All",
|                                             "DisplayName":  "Create, edit, and delete items and lists in all site collections",
|                                             "Description":  "Allows the app to create or delete document libraries and lists in all site collections without a signed in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Create or delete document libraries and lists in all site collections without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Sites.ReadWrite.All",
|                                             "DisplayName":  "Read and write items in all site collections",
|                                             "Description":  "Allows the app to create, read, update, and delete documents and list items in all site collections without a signed in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Create, read, update, delete documents and list items in all site collections without signed-in user; data and workload impact only."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SitesMetadataAdmin.ReadWrite.All",
|                                             "DisplayName":  "Read and write access to site collection metadata on the SharePoint admin site",
|                                             "Description":  "Allows the app to read and write site collection metadata without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read and write site collection metadata without signed-in user; potential workload impact but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Synchronization.Read.All",
|                                             "DisplayName":  "Read all Azure AD synchronization data.",
|                                             "Description":  "Allows the application to read Azure AD synchronization information, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to Azure AD sync info can reveal configuration but does not allow direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SynchronizationData-User.Upload",
|                                             "DisplayName":  "Upload user data to the identity synchronization service",
|                                             "Description":  "Allows the app to upload bulk user data to the identity synchronization service, on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Uploading bulk user data to sync service can impact data but does not directly enable identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SynchronizationData-User.Upload.OwnedBy",
|                                             "DisplayName":  "Upload user data to the identity sync service for apps that this application creates or owns",
|                                             "Description":  "Allows the application to upload bulk user data to the identity synchronization service for apps that this application creates or owns, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Uploading bulk user data for owned apps is scoped and does not enable direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamMember.ReadWrite.All",
|                                             "DisplayName":  "Add and remove members from all teams",
|                                             "Description":  "Add and remove members from all teams, without a signed-in user. Also allows changing a team member\u0027s role, for example from owner to non-owner.",
|                                             "Tier":  2,
|                                             "Reason":  "Modifying team membership and roles can impact collaboration but does not enable direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentForChat.All",
|                                             "DisplayName":  "Manage installation and permission grants of Teams apps for all chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Gives the ability to manage permission grants for accessing those specific chats\u0027 data.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in any chat, enabling data manipulation but no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentForTeam",
|                                             "DisplayName":  "Manage installed Teams apps in teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Gives the ability to manage permission grants for accessing those specific teams\u0027 data.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in accessible teams, enabling data manipulation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentForTeam.All",
|                                             "DisplayName":  "Manage installation and permission grants of Teams apps for all teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Gives the ability to manage permission grants for accessing those specific teams\u0027 data.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in any team, enabling data manipulation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentForUser",
|                                             "DisplayName":  "Manage installation and permission grants of Teams apps in users\u0027 personal scope",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in user accounts, on behalf of the signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in user accounts on behalf of signed-in user, enabling data manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentForUser.All",
|                                             "DisplayName":  "Manage installation and permission grants of Teams apps in a user account",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any user account, without a signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in any user account, enabling data manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteForChat",
|                                             "DisplayName":  "Manage installed Teams apps in chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in chats the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in chats accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteForChat.All",
|                                             "DisplayName":  "Manage Teams apps for all chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in any chat without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteForTeam",
|                                             "DisplayName":  "Manage installed Teams apps in teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in teams accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteForTeam.All",
|                                             "DisplayName":  "Manage Teams apps for all teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in any team without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteForUser",
|                                             "DisplayName":  "Manage user\u0027s installed Teams apps",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps installed for the signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps installed for signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteForUser.All",
|                                             "DisplayName":  "Manage Teams apps for all users",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps for any user, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps for any user without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelectedForChat",
|                                             "DisplayName":  "Manage selected Teams apps installed in chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in chats the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing selected Teams apps in chats accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelectedForChat.All",
|                                             "DisplayName":  "Manage selected installed Teams apps in all chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing selected Teams apps in any chat without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelectedForTeam",
|                                             "DisplayName":  "Manage selected Teams apps installed in teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing selected Teams apps in teams accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelectedForTeam.All",
|                                             "DisplayName":  "Manage selected installed Teams apps in all teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any team, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing selected Teams apps in any team without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelectedForUser",
|                                             "DisplayName":  "Manage selected Teams apps installed for a user",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps installed for the signed in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing selected Teams apps for signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelectedForUser.All",
|                                             "DisplayName":  "Manage selected Teams apps installed for all users",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps for any user, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing selected Teams apps for any user without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamSettings.Read.All",
|                                             "DisplayName":  "Read all teams\u0027 settings",
|                                             "Description":  "Read all team\u0027s settings, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows reading all team settings without signed-in user; no identity plane control but potential data exposure."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and change all teams\u0027 settings",
|                                             "Description":  "Read and change all teams\u0027 settings, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows reading and changing all team settings without signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsPolicyUserAssign.ReadWrite.All",
|                                             "DisplayName":  "Read and Write Teams policy user assignment and unassigment for all policy types.",
|                                             "Description":  "Allow the app to read or write/update the policy assignment and unassigment for Teams users for all policy type categories.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams user policy assignments; no direct identity plane control but can affect user experience."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsResourceAccount.Read.All",
|                                             "DisplayName":  "Read Teams resource accounts",
|                                             "Description":  "Allows the app to read your tenant\u0027s resource accounts without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows reading tenant resource accounts without signed-in user; data exposure only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Teamwork.Migrate.All",
|                                             "DisplayName":  "Create chat and channel messages with anyone\u0027s identity and with any timestamp",
|                                             "Description":  "Allows the app to create chat and channel messages, without a signed in user. The app specifies which user appears as the sender, and can backdate the message to appear as if it was sent long ago. The messages can be sent to any chat or channel in the organization.",
|                                             "Tier":  2,
|                                             "Reason":  "Can create chat and channel messages as any user, enabling impersonation and social engineering but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkAppSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and write Teams app settings",
|                                             "Description":  "Allows the app to read and write the Teams app settings without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to Teams app settings without signed-in user; potential to manipulate app behavior but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkDevice.ReadWrite.All",
|                                             "DisplayName":  "Read and write Teams devices",
|                                             "Description":  "Allow the app to read and write the management data for Teams devices, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to Teams device management data; may enable device manipulation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkSection.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 sections",
|                                             "Description":  "Allows the app to read and write all users\u0027 sections (folders) for organizing chats and channels in Teams, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to all users\u0027 Teams sections without signed-in user; potential for broad content manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkTag.ReadWrite.All",
|                                             "DisplayName":  "Read and write tags in Teams",
|                                             "Description":  "Allows the app to read and write tags in Teams without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to Teams tags without signed-in user; potential for broad content manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TrustFrameworkKeySet.ReadWrite.All",
|                                             "DisplayName":  "Read and write trust framework key sets",
|                                             "Description":  "Allows the app to read and write trust framework key set properties on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to trust framework key sets on behalf of signed-in user; potential to modify authentication policies but requires user context and no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User.DeleteRestore.All",
|                                             "DisplayName":  "Delete and restore users",
|                                             "Description":  "Allows the app to delete and restore all users, on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Can delete and restore all users on behalf of signed-in user; impactful but no direct role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User.EnableDisableAccount.All",
|                                             "DisplayName":  "Enable and disable user accounts",
|                                             "Description":  "Allows the app to enable and disable users\u0027 accounts, on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Can enable/disable user accounts on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User.Export.All",
|                                             "DisplayName":  "Export user\u0027s data",
|                                             "Description":  "Allows the app to export data (e.g. customer content or system-generated logs), associated with any user in your company, when the app is used by a privileged user (e.g. a Company Administrator).",
|                                             "Tier":  2,
|                                             "Reason":  "Allows data export for any user by privileged user; data exfiltration risk but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User.ManageIdentities.All",
|                                             "DisplayName":  "Manage  user identities",
|                                             "Description":  "Allows the app to read, update and delete identities that are associated with a user\u0027s account that the signed-in user has access to. This controls the identities users can sign-in with.",
|                                             "Tier":  2,
|                                             "Reason":  "Can manage user-associated identities on behalf of signed-in user; no direct role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User.ReadWrite.All",
|                                             "DisplayName":  "Read and write user profiles",
|                                             "Description":  "Allows the app to read and update user profiles and to read basic site info on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read and update user profiles on behalf of signed-in user; no direct role assignment but broad write access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User.ReadWrite.CrossCloud",
|                                             "DisplayName":  "Read and write profiles of users that originate from an external cloud.",
|                                             "Description":  "Allows the app to read and update external cloud user profiles without a signed in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read and update external cloud user profiles without signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User.RevokeSessions.All",
|                                             "DisplayName":  "Revoke all sign in sessions for a user",
|                                             "Description":  "Allow the app to revoke all sign in sessions for a user, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Can revoke all sign-in sessions for users; impacts sessions but no role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthenticationMethod.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 authentication methods.",
|                                             "Description":  " Allows the app to read and write authentication methods of all users in your organization that the signed-in user has access to.                       Authentication methods include things like a user’s phone numbers and Authenticator app settings. This                      does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write authentication methods of all users accessible to signed-in user; potential to modify MFA but requires user context and no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-Email.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 email methods",
|                                             "Description":  "Allows the application to read and write email methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write email authentication methods of all users; potential to modify MFA but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-External.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 external methods.",
|                                             "Description":  "Allows the app to read and write external authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write external authentication methods of all users accessible to signed-in user; potential MFA modification but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-HardwareOATH.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 HardwareOATH authentication methods",
|                                             "Description":  "Allows the application to read and write HardwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write HardwareOATH methods of all users; potential MFA modification but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-MicrosoftAuthApp.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 Microsoft Authentication methods.",
|                                             "Description":  "Allows the app to read and write Microsoft Authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write Microsoft Authenticator methods of all users accessible to signed-in user; potential MFA modification but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Passkey.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 passkey methods.",
|                                             "Description":  "Allows the app to read and write passkey authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write passkey authentication methods of all users accessible to signed-in user; potential MFA modification but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Password.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 password methods.",
|                                             "Description":  "Allows the app to read and write password authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write password authentication methods of all users accessible to signed-in user; potential MFA modification but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-Phone.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 phone methods",
|                                             "Description":  "Allows the application to read and write phone methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows read/write of phone auth methods for all users; no secret info or direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-PlatformCred.Read.All",
|                                             "DisplayName":  "Read all users\u0027 platform credentials methods",
|                                             "Description":  "Allows the app to read platform credentials methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to platform credentials of all users accessible to signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-PlatformCred.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 platform credentials methods.",
|                                             "Description":  "Allows the app to read and write platform credentials methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to platform credentials of all users accessible to signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-QR.Read.All",
|                                             "DisplayName":  "Read all users\u0027 QR methods",
|                                             "Description":  "Allows the app to read QR authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to QR auth methods of all users; no secret info or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-QR.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 QR methods.",
|                                             "Description":  "Allows the app to read and write QR authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to QR auth methods of all users accessible to signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-SoftwareOATH.Read.All",
|                                             "DisplayName":  "Read all users\u0027 SoftwareOATH methods",
|                                             "Description":  "Allows the app to read SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to SoftwareOATH methods of all users; no secret info or direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-SoftwareOATH.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 SoftwareOATH methods",
|                                             "Description":  "Allows the application to read and write SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to SoftwareOATH methods of all users; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-TAP.Read.All",
|                                             "DisplayName":  "Read all users\u0027 Temporary Access Pass methods",
|                                             "Description":  "Allows the app to read Temporary Access Pass authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to Temporary Access Pass methods of all users; no secret info or direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-TAP.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 Temporary Access Pass methods.",
|                                             "Description":  "Allows the app to read and write Temporary Access Pass authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to Temporary Access Pass methods of all users accessible to signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-WindowsHello.Read.All",
|                                             "DisplayName":  "Read all users\u0027 Windows Hello methods",
|                                             "Description":  "Allows the app to read Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to Windows Hello methods of all users; no secret info or direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-WindowsHello.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 Windows Hello authentication methods",
|                                             "Description":  "Allows the application to read and write Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to Windows Hello methods of all users; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User-ConvertToInternal.ReadWrite.All",
|                                             "DisplayName":  "Convert an external user to internal member user",
|                                             "Description":  "Allow the app to convert an external user to an internal member user, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows converting external users to internal members; impacts user types but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User-OnPremisesSyncBehavior.ReadWrite.All",
|                                             "DisplayName":  "Read and update the on-premises sync behavior of users",
|                                             "Description":  "Allows the app to read and update the on-premises sync behavior of users on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Modify on-premises sync behavior for users; potential impact on sync but no direct identity plane control."
|                                         }
|                                     ],
|    "EntraID_APIPermissions_Tier3":  [
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AccessReview.Read.All",
|                                             "DisplayName":  "Read all access reviews that user can access",
|                                             "Description":  "Allows the app to read access reviews, reviewers, decisions and settings that the signed-in user has access to in the organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to access reviews limited to signed-in user\u0027s scope; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Acronym.Read.All",
|                                             "DisplayName":  "Read all acronyms",
|                                             "Description":  "Allows an app to read all acronyms without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to acronyms; no identity or security impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "activitydata.tenant.read",
|                                             "DisplayName":  "activitydata.tenant.read",
|                                             "Description":  "activitydata.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to tenant activity data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Management APIs",
|                                             "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ActivityFeed.Read",
|                                             "DisplayName":  "Read activity data for your organization",
|                                             "Description":  "Allows the application to read activity data for your organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to organizational activity data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Management APIs",
|                                             "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ActivityFeed.ReadDlp",
|                                             "DisplayName":  "Read DLP policy events including detected sensitive data",
|                                             "Description":  "Allows the application to read DLP policy events, including detected sensitive data, for your organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to DLP events; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AdministrativeUnit.Read.All",
|                                             "DisplayName":  "Read administrative units",
|                                             "Description":  "Allows the app to read administrative units and administrative unit membership on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to administrative units scoped to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentCard.ReadWrite.ManagedBy",
|                                             "DisplayName":  "Read and write managed-by agent cards in Agent Registry",
|                                             "Description":  "Allows the app to read and update agent cards that designate the calling app as their manager and manage their skills in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage agent cards and skills; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentCardManifest.Read.All",
|                                             "DisplayName":  "Read all agent card manifests in Agent Registry",
|                                             "Description":  "Allows the app to read all agent card manifests in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to agent card manifests; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentCardManifest.ReadWrite.All",
|                                             "DisplayName":  "Read and write agent card manifests in Agent Registry",
|                                             "Description":  "Allows the app to read and write agent card manifests in your organization\u0027s Agent Registry on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write agent card manifests on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentCardManifest.ReadWrite.ManagedBy",
|                                             "DisplayName":  "Read and write managed-by agent card manifests in Agent Registry",
|                                             "Description":  "Allows the app to read and write agent card manifests that name it as manager in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage agent card manifests as manager; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentCollection.Read.All",
|                                             "DisplayName":  "Read all collections in Agent Registry",
|                                             "Description":  "Allows the app to read all collections and their membership in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to collections and memberships; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentCollection.Read.Global",
|                                             "DisplayName":  "Read global collection in Agent Registry",
|                                             "Description":  "Allows the app to read global collection and its membership in your organization\u0027s Agent Registry on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to global collections; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentCollection.Read.Quarantined",
|                                             "DisplayName":  "Read quarantined collection in Agent Registry",
|                                             "Description":  "Allows the app to read quarantined collection and its membership in your organization\u0027s Agent Registry on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to quarantined collections; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentCollection.ReadWrite.All",
|                                             "DisplayName":  "Read and write all collections in Agent Registry",
|                                             "Description":  "Allows the app to create, read, update, and delete all collections and manage their membership in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage all collections and memberships; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentCollection.ReadWrite.Global",
|                                             "DisplayName":  "Read and write global collection in Agent Registry",
|                                             "Description":  "Allows the app to read and update global collection and manage its membership in your organization\u0027s Agent Registry on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage global collections on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentCollection.ReadWrite.ManagedBy",
|                                             "DisplayName":  "Read and write managed-by collections in Agent Registry",
|                                             "Description":  "Allows the app to create, read, update, and delete collections that designate the calling app as their manager and manage their membership in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage collections designated to calling app; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentCollection.ReadWrite.Quarantined",
|                                             "DisplayName":  "Read and write quarantined collection in Agent Registry",
|                                             "Description":  "Allows the app to read and update quarantined collection and manage its membership in your organization\u0027s Agent Registry on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage quarantined collections; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentity.Read.All",
|                                             "DisplayName":  "Read all agent identities",
|                                             "Description":  "Allows the app to read all agent identities without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to all agent identities; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentityBlueprint.Read.All",
|                                             "DisplayName":  "Read all agent identity blueprints",
|                                             "Description":  "Allows the client to read all agent identity blueprints.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to agent identity blueprints; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentityBlueprint.UpdateBranding.All",
|                                             "DisplayName":  "Update agent identity blueprint branding",
|                                             "Description":  "Allows updating agent identity blueprint branding on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Update branding on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentityBlueprintPrincipal.Read.All",
|                                             "DisplayName":  "Read agent identity blueprint principals.",
|                                             "Description":  "Allows reading agent identity blueprint principals without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to blueprint principals; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentInstance.Read.All",
|                                             "DisplayName":  "Read agent instances in Agent Registry",
|                                             "Description":  "Allows the app to read agent instances and their related collections in your organization\u0027s Agent Registry on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to agent instances; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentRegistration.Read.All",
|                                             "DisplayName":  "Read all agent registrations",
|                                             "Description":  "Allows the app to read agent registration information without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to agent registration information; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AggConsumptionBillingReport.Read.All",
|                                             "DisplayName":  "AggConsumptionBillingReport.Read.All",
|                                             "Description":  "AggConsumptionBillingReport.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to billing reports; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Agreement.Read.All",
|                                             "DisplayName":  "Read all terms of use agreements",
|                                             "Description":  "Allows the app to read terms of use agreements on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to terms of use agreements; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgreementAcceptance.Read",
|                                             "DisplayName":  "Read user terms of use acceptance statuses",
|                                             "Description":  "Allows the app to read terms of use acceptance statuses on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to terms of use acceptance statuses; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgreementAcceptance.Read.All",
|                                             "DisplayName":  "Read all terms of use acceptance statuses",
|                                             "Description":  "Allows the app to read terms of use acceptance statuses, without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to terms of use acceptance statuses without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AiEnterpriseInteraction.Read",
|                                             "DisplayName":  "Read user AI enterprise interactions.",
|                                             "Description":  "Allows the app to read user AI enterprise interactions, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user AI interactions on behalf of signed-in user; no identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AiEnterpriseInteraction.Read.All",
|                                             "DisplayName":  "Read all AI enterprise interactions.",
|                                             "Description":  "Allows the app to read all AI enterprise interactions.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all AI enterprise interactions; data plane only with no path to identity or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AirAdminAction.tenant.read",
|                                             "DisplayName":  "AirAdminAction.tenant.read",
|                                             "Description":  "This allows the app to read AirAdminAction alerts",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to AirAdminAction alerts; no ability to modify identity or role assignments."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AirAdminAction.tenant.write",
|                                             "DisplayName":  "AirAdminAction.tenant.write",
|                                             "Description":  "This allows apps to write the AirAdminAction alerts",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to AirAdminAction alerts; does not enable identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "alert.read",
|                                             "DisplayName":  "alert.read",
|                                             "Description":  "This allows user to read Office 365 alerts.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to Office 365 alerts; no path to identity plane or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Alert.Read.All",
|                                             "DisplayName":  "Alert.Read.All",
|                                             "Description":  "Alert.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to all Office 365 alerts; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "alert.tenant.read",
|                                             "DisplayName":  "alert.tenant.read",
|                                             "Description":  "This allows to read tenant Office 365 alerts.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to tenant Office 365 alerts; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "alert.tenant.write",
|                                             "DisplayName":  "alert.tenant.write",
|                                             "Description":  "This allows to change any Office 365 alerts belong to the tenant.",
|                                             "Tier":  3,
|                                             "Reason":  "Application write access to tenant Office 365 alerts; no direct or near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "alert.write",
|                                             "DisplayName":  "alert.write",
|                                             "Description":  "This allows user to change Office 365 alerts.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated write access to Office 365 alerts; no path to role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AllSites.FullControl",
|                                             "DisplayName":  "Have full control of all site collections",
|                                             "Description":  "Allows the app to have full control of all site collections on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Full control of SharePoint sites on behalf of signed-in user; no identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AllSites.Manage",
|                                             "DisplayName":  "Read and write items and lists in all site collections",
|                                             "Description":  "Allows the app to read, create, update, and delete document libraries and lists in all site collections on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage document libraries and lists on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AllSites.Read",
|                                             "DisplayName":  "Read items in all site collections",
|                                             "Description":  "Allows the app to read documents and list items in all site collections on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to SharePoint documents and lists; data plane only with no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AllSites.Write",
|                                             "DisplayName":  "Read and write items in all site collections",
|                                             "Description":  "Allows the app to create, read, update, and delete documents and list items in all site collections on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to SharePoint documents and lists; no path to identity or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Analytics.Read",
|                                             "DisplayName":  "Read user activity statistics",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s activity statistics, such as how much time the user has spent on emails, in meetings, or in chat sessions.",
|                                             "Tier":  3,
|                                             "Reason":  "Read user activity statistics; no identity plane or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Skype for Business Online",
|                                             "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Anonymous",
|                                             "DisplayName":  "Guest user join services (preview)",
|                                             "Description":  "Allows the app create an on-demand Skype meeting and join guest users into Skype for Business services",
|                                             "Tier":  3,
|                                             "Reason":  "Allows creation of Skype meetings and guest joins; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "APIConnectors.Read.All",
|                                             "DisplayName":  "Read API connectors for authentication flows",
|                                             "Description":  "Allows the app to read the API connectors used in user authentication flows, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read API connectors in authentication flows on behalf of user; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "App.Read.All",
|                                             "DisplayName":  "View all Power BI apps",
|                                             "Description":  "The app can view all Power BI apps the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Power BI apps user can access; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AppCatalog.Read.All",
|                                             "DisplayName":  "Read all app catalogs",
|                                             "Description":  "Allows the app to read apps in the app catalogs without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to app catalogs without signed-in user; no write or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AppCatalog.Submit",
|                                             "DisplayName":  "Submit application packages to the catalog and cancel pending submissions",
|                                             "Description":  "Allows the app to submit application packages to the catalog and cancel submissions that are pending review on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Submit application packages on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AppCertTrustConfiguration.Read.All",
|                                             "DisplayName":  "Read the trusted certificate authority configuration for applications",
|                                             "Description":  "Allows the app to read the trusted certificate authority configuration which can be used to restrict application certificates based on their issuing authority, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read trusted certificate authority configuration; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Application.Read.All",
|                                             "DisplayName":  "Read applications",
|                                             "Description":  "Allows the app to read applications and service principals on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read applications and service principals on behalf of user; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Application-RemoteDesktopConfig.ReadWrite.All",
|                                             "DisplayName":  "Read and write the remote desktop security configuration for all apps",
|                                             "Description":  "Allows the app to read and write the remote desktop security configuration for all apps in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write remote desktop config for apps; no direct identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ApprovalSolution.Read",
|                                             "DisplayName":  "Read approvals",
|                                             "Description":  "Allows the app to read approvals on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read approvals on behalf of signed-in user; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ApprovalSolution.Read.All",
|                                             "DisplayName":  "Read all approvals",
|                                             "Description":  "Allows the app to read all approvals and approval item subscriptions, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read all approvals without signed-in user; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ApprovalSolution.ReadWrite",
|                                             "DisplayName":  "Read, create, and respond to approvals",
|                                             "Description":  "Allows the app to provision, read, create, and respond to approvals on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Provision and respond to approvals on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ApprovalSolution.ReadWrite.All",
|                                             "DisplayName":  "Read all approvals and manage approval subscriptions",
|                                             "Description":  "Allows the app to read all approvals and create, update, or remove approval item subscriptions, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage approvals and subscriptions without signed-in user; no direct role assignment or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ApprovalSolutionResponse.ReadWrite",
|                                             "DisplayName":  "Read and respond to approvals assigned to the current user",
|                                             "Description":  "Allows the app to read and respond to approvals on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and respond to approvals on behalf of signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AtpStandardPolicy.Tenant.Read",
|                                             "DisplayName":  "AtpStandardPolicy.Tenant.Read",
|                                             "Description":  "AtpStandardPolicy.Tenant.Read",
|                                             "Tier":  3,
|                                             "Reason":  "Read ATP standard policy; no write or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AtpStandardPolicy.Tenant.Write",
|                                             "DisplayName":  "AtpStandardPolicy.Tenant.Write",
|                                             "Description":  "AtpStandardPolicy.Tenant.Write",
|                                             "Tier":  3,
|                                             "Reason":  "Write ATP standard policy; no direct identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AttackSimulation.Read.All",
|                                             "DisplayName":  "Read attack simulation data of an organization",
|                                             "Description":  "Allows the app to read attack simulation and training data for an organization for the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read attack simulation data on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AttackSimulation.ReadWrite.All",
|                                             "DisplayName":  "Read, create, and update attack simulation data of an organization",
|                                             "Description":  "Allows the app to read, create, and update attack simulation and training data for an organization for the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read, create, update attack simulation data on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AttackSimulationData.tenant.read",
|                                             "DisplayName":  "AttackSimulationData.tenant.read",
|                                             "Description":  "AttackSimulationData.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read attack simulation data for tenant; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuditActivity.Read",
|                                             "DisplayName":  "Read activity audit log from the audit store.",
|                                             "Description":  "Read activity audit log from the audit store.",
|                                             "Tier":  3,
|                                             "Reason":  "Read audit logs on behalf of signed-in user; no write or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AuditActivity.Write",
|                                             "DisplayName":  "Upload activity audit logs to the audit store.",
|                                             "Description":  "Allows the application to upload bulk activity audit logs to the audit store.",
|                                             "Tier":  3,
|                                             "Reason":  "Upload audit logs; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuditLog.Read.All",
|                                             "DisplayName":  "Read audit log data",
|                                             "Description":  "Allows the app to read and query your audit log activities, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and query audit logs on behalf of signed-in user; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuditLogsQuery.Read.All",
|                                             "DisplayName":  "Read audit logs data from all services",
|                                             "Description":  "Allows the app to read and query audit logs from all services, on behalf of a signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read and query audit logs from all services on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AuditLogsQuery-CRM.Read.All",
|                                             "DisplayName":  "Read audit logs data from Dynamics CRM workload",
|                                             "Description":  "Allows the app to read and query audit logs from Dynamics CRM workload, without a signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read audit logs from Dynamics CRM without signed-in user; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AuditLogsQuery-Endpoint.Read.All",
|                                             "DisplayName":  "Read audit logs data from Endpoint Data Loss Prevention workload",
|                                             "Description":  "Allows the app to read and query audit logs from Endpoint Data Loss Prevention workload, without a signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read audit logs from Endpoint DLP without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuditLogsQuery-Entra.Read.All",
|                                             "DisplayName":  "Read audit logs data from Entra (Azure AD) workload",
|                                             "Description":  "Allows the app to read and query audit logs from Entra (Azure AD) workload, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read audit logs from Entra (Azure AD) on behalf of signed-in user; read-only with no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuditLogsQuery-Exchange.Read.All",
|                                             "DisplayName":  "Read audit logs data from Exchange workload",
|                                             "Description":  "Allows the app to read and query audit logs from Exchange workload, on behalf of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read audit logs from Exchange on behalf of signed-in user; no write or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuditLogsQuery-OneDrive.Read.All",
|                                             "DisplayName":  "Read audit logs data from OneDrive workload",
|                                             "Description":  "Allows the app to read and query audit logs from OneDrive workload, on behalf of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read audit logs from OneDrive on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuditLogsQuery-SharePoint.Read.All",
|                                             "DisplayName":  "Read audit logs data from SharePoint workload",
|                                             "Description":  "Allows the app to read and query audit logs from SharePoint workload, on behalf of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read audit logs from SharePoint on behalf of signed-in user; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AuditProvisioningData.Tenant.Read",
|                                             "DisplayName":  "AuditProvisioningData.Tenant.Read",
|                                             "Description":  "AuditProvisioningData.Tenant.Read",
|                                             "Tier":  3,
|                                             "Reason":  "Read provisioning data for tenant; no write or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuthenticationContext.Read.All",
|                                             "DisplayName":  "Read all authentication context information",
|                                             "Description":  "Allows the app to read all authentication context information in your organization on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to authentication context information; no ability to modify roles or credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AzureActivityData.Read.All",
|                                             "DisplayName":  "AzureActivityData.Read.All",
|                                             "Description":  "AzureActivityData.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Azure activity data; no identity plane control or credential modification."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BackupRestore-Configuration.Read.All",
|                                             "DisplayName":  "Read all backup configuration policies",
|                                             "Description":  "Allows the app to read all backup configurations, and lists of Microsoft 365 service resources to be backed-up, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to backup configurations; no path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BackupRestore-Configuration.ReadWrite.All",
|                                             "DisplayName":  "Read and edit backup configuration policies",
|                                             "Description":  "Allows the app to read and update the backup configuration, and list of Microsoft 365 service resources to be backed-up, on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to backup configurations but no direct or near-direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BackupRestore-Control.Read.All",
|                                             "DisplayName":  "Read the status of the M365 backup service",
|                                             "Description":  "Allows the app to read the status of M365 backup service (enable/disable), without signed in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to backup service status; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BackupRestore-Control.ReadWrite.All",
|                                             "DisplayName":  "Update or read the status of the M365 backup service",
|                                             "Description":  "Allows the app to update or read the status of M365 backup service (enable/disable), on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to backup service status; no direct identity plane control or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BackupRestore-Monitor.Read.All",
|                                             "DisplayName":  "Read all monitoring, quota and billing information for the tenant",
|                                             "Description":  "Allows the app to monitor all backup and restore jobs, view quota usage and billing details, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only monitoring of backup jobs and billing; no identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BackupRestore-Restore.Read.All",
|                                             "DisplayName":  "Read all restore sessions",
|                                             "Description":  "Allows the app to read all restore sessions, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to restore sessions; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BackupRestore-Restore.ReadWrite.All",
|                                             "DisplayName":  "Read restore all sessions and start restore sessions from backups",
|                                             "Description":  "Allows the app to search all backup snapshots for Microsoft 365 resources, and restore Microsoft 365 resources from a backed-up snapshot, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to restore backups but no direct path to identity or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BackupRestore-Search.Read.All",
|                                             "DisplayName":  "Search for metadata properties in backup snapshots",
|                                             "Description":  "Allows the app to search the backup snapshots for Microsoft 365 resources, on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only search of backup snapshots; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BillingConfiguration.ReadWrite.All",
|                                             "DisplayName":  "Read and write application billing configuration",
|                                             "Description":  "Allows the app to read and write the billing configuration on all applications on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to billing configuration; no direct or near-direct path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BitlockerKey.ReadBasic.All",
|                                             "DisplayName":  "Read all BitLocker keys basic information",
|                                             "Description":  "Allows an app to read basic BitLocker key properties for all devices, without a signed-in user. Does not allow read of the recovery key.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to basic BitLocker key properties without recovery keys; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Bookings.Manage.All",
|                                             "DisplayName":  "Manage bookings information",
|                                             "Description":  "Allows an app to read, write and manage bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage bookings data only; no path to identity or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Bookings.Read.All",
|                                             "DisplayName":  "Read bookings information",
|                                             "Description":  "Allows an app to read bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to bookings data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Bookings.ReadWrite.All",
|                                             "DisplayName":  "Read and write bookings information",
|                                             "Description":  "Allows an app to read and write bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user. Does not allow create, delete and publish of booking businesses.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to bookings data without role or credential control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BookingsAppointment.ReadWrite.All",
|                                             "DisplayName":  "Read and write booking appointments",
|                                             "Description":  "Allows an app to read and write bookings appointments and customers, and additionally allows read businesses information, services, and staff on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to bookings appointments; no identity or role management capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Bookmark.Read.All",
|                                             "DisplayName":  "Read all bookmarks that the user can access",
|                                             "Description":  "Allows an app to read all bookmarks that the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to bookmarks; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BrowserSiteLists.Read.All",
|                                             "DisplayName":  "Read all browser site lists for your organization",
|                                             "Description":  "Allows an app to read all browser site lists configured for your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to browser site lists; no identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BrowserSiteLists.ReadWrite.All",
|                                             "DisplayName":  "Read and write all browser site lists for your organization",
|                                             "Description":  "Allows an app to read and write all browser site lists configured for your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to browser site lists; no direct or near-direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BusinessScenarioConfig.Read.All",
|                                             "DisplayName":  "Read business scenario configurations",
|                                             "Description":  "Allows the app to read the configurations of your organization\u0027s business scenarios, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to business scenario configurations; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BusinessScenarioConfig.Read.OwnedBy",
|                                             "DisplayName":  "Read all business scenario configurations this app creates or owns",
|                                             "Description":  "Allows the app to read the configurations of business scenarios it owns, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to owned business scenarios; no identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BusinessScenarioConfig.ReadWrite.All",
|                                             "DisplayName":  "Read and write business scenario configurations",
|                                             "Description":  "Allows the app to read and write the configurations of your organization\u0027s business scenarios, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to business scenario configurations; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BusinessScenarioConfig.ReadWrite.OwnedBy",
|                                             "DisplayName":  "Read and write business scenario configurations this app creates or owns",
|                                             "Description":  "Allows the app to create new business scenarios and fully manage the configurations of scenarios it owns, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage owned business scenarios; no path to role assignment or credential control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BusinessScenarioData.Read.OwnedBy",
|                                             "DisplayName":  "Read all data for business scenarios this app creates or owns",
|                                             "Description":  "Allows the app to read all data associated with the business scenarios it owns. Data access will be attributed to the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to owned business scenario data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BusinessScenarioData.ReadWrite.OwnedBy",
|                                             "DisplayName":  "Read and write data for all business scenarios this app creates or owns",
|                                             "Description":  "Allows the app to fully manage the data associated with the business scenarios it owns, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Full management of owned business scenario data; no direct identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Calendars.Read",
|                                             "DisplayName":  "Read user calendars",
|                                             "Description":  "Allows the app to read events in user calendars.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to user calendar events; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Calendars.Read.All",
|                                             "DisplayName":  "Read user and shared calendars ",
|                                             "Description":  "Allows the app to read events in all calendars that the user can access, including delegate and shared calendars.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to all accessible calendars; no path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Calendars.Read.Shared",
|                                             "DisplayName":  "Read user and shared calendars",
|                                             "Description":  "Allows the app to read events in all calendars that the user can access, including delegate and shared calendars.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to shared calendars; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Calendars.ReadBasic",
|                                             "DisplayName":  "Read basic details of user calendars",
|                                             "Description":  "Allows the app to read events in user calendars, except for properties such as body, attachments, and extensions.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to basic calendar event properties; no identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Calendars.ReadBasic.All",
|                                             "DisplayName":  "Read basic details of calendars in all mailboxes ",
|                                             "Description":  "Allows the app to read events of all calendars, except for properties such as body, attachments, and extensions, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to basic calendar events across all calendars; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Calendars.ReadWrite",
|                                             "DisplayName":  "Read and write calendars in all mailboxes",
|                                             "Description":  "Allows the app to create, read, update, and delete events of all calendars without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to calendar events without identity or role management capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Calendars.ReadWrite.All",
|                                             "DisplayName":  "Read and write user and shared calendars ",
|                                             "Description":  "Allows the app to create, read, update and delete events in all calendars in the organization user has permissions to access. This includes delegate and shared calendars.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated write access to all calendars user can access; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Calendars.ReadWrite.Shared",
|                                             "DisplayName":  "Read and write user and shared calendars",
|                                             "Description":  "Allows the app to create, read, update and delete events in all calendars in the organization user has permissions to access. This includes delegate and shared calendars.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated write access to shared calendars; no path to role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CallAiInsights.Read.All",
|                                             "DisplayName":  "Read all AI Insights for calls. ",
|                                             "Description":  "Allows the app to read all AI Insights for calls, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to call AI insights; no identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CallDelegation.Read",
|                                             "DisplayName":  "Read delegation settings",
|                                             "Description":  "Allows the app to read delegation settings of you",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to own call delegation settings; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CallDelegation.Read.All",
|                                             "DisplayName":  "Read delegation settings",
|                                             "Description":  "Allows the app to read delegation settings of you",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to call delegation settings; no identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CallDelegation.ReadWrite",
|                                             "DisplayName":  "Read and write delegation settings",
|                                             "Description":  "Allows the app to read and write delegation settings of you",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to own call delegation settings only; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CallDelegation.ReadWrite.All",
|                                             "DisplayName":  "Read and write delegation settings",
|                                             "Description":  "Allows the app to read and write delegation settings of you",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to call delegation settings; no direct or near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CallEvents.Read",
|                                             "DisplayName":  "Read call event data",
|                                             "Description":  "Allows the app to read call event information for an organization for the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to call event info for signed-in user; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CallEvents.Read.All",
|                                             "DisplayName":  "Read all call events",
|                                             "Description":  "Allows the app to read call event information for all users in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to call events for all users; no role assignment or credential reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CallEvents-Emergency.Read.All",
|                                             "DisplayName":  "Read all emergency call events",
|                                             "Description":  "Allows the app to read emergency call event information for all users in your organization without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to emergency call events; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CallRecordings.Read.All",
|                                             "DisplayName":  "Read all recordings of calls. ",
|                                             "Description":  "Allows the app to read all recordings of calls, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to call recordings; no path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CallRecord-PstnCalls.Read.All",
|                                             "DisplayName":  "Read PSTN and direct routing call log data",
|                                             "Description":  "Allows the app to read all PSTN and direct routing call log data without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to PSTN call logs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CallRecords.Read.All",
|                                             "DisplayName":  "Read all call records",
|                                             "Description":  "Allows the app to read call records for all calls and online meetings without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to call records and meetings; no role or credential control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Calls.AccessMedia.All",
|                                             "DisplayName":  "Access media streams in a call as an app",
|                                             "Description":  "Allows the app to get direct access to media streams in a call, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Access to media streams in calls; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Calls.Initiate.All",
|                                             "DisplayName":  "Initiate outgoing 1 to 1 calls from the app",
|                                             "Description":  "Allows the app to place outbound calls to a single user and transfer calls to users in your organization’s directory, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to place calls and transfer calls; no path to tenant takeover or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Calls.InitiateGroupCall.All",
|                                             "DisplayName":  "Initiate outgoing group calls from the app",
|                                             "Description":  "Allows the app to place outbound calls to multiple users and add participants to meetings in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to place group calls and add participants; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Calls.JoinGroupCall.All",
|                                             "DisplayName":  "Join group calls and meetings as an app",
|                                             "Description":  "Allows the app to join group calls and scheduled meetings in your organization, without a signed-in user.  The app will be joined with the privileges of a directory user to meetings in your organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to join group calls as a user; no direct or near-direct path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Calls.JoinGroupCallAsGuest.All",
|                                             "DisplayName":  "Join group calls and meetings as a guest",
|                                             "Description":  "Allows the app to anonymously join group calls and scheduled meetings in your organization, without a signed-in user.  The app will be joined as a guest to meetings in your organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows anonymous joining of group calls as guest; no identity plane control or tenant takeover path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Capacity.Read.All",
|                                             "DisplayName":  "View all capacities",
|                                             "Description":  "The app can view all Power BI Premium and Power BI Embedded capacities that the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Power BI capacities scoped to signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Capacity.ReadWrite.All",
|                                             "DisplayName":  "Read and write all capacities",
|                                             "Description":  "The app can view and edit all Power BI Premium and Power BI Embedded capacities that the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to Power BI capacities scoped to signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Catalog.Read.All",
|                                             "DisplayName":  "Read catalog",
|                                             "Description":  "Allows reading catalog on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to catalog on user\u0027s behalf; no identity plane control or privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CatalogMirroring.Read.All",
|                                             "DisplayName":  "Read Iceberg and Delta table catalog metadata from the provider",
|                                             "Description":  "Allows reading Iceberg and Delta table catalog metadata from the external provider on the users behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to external catalog metadata on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChangeManagement.Read.All",
|                                             "DisplayName":  "Read Change Management items",
|                                             "Description":  "Allows to read all Change Management items.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to change management items; no ability to modify identity or role assignments."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Channel.Create",
|                                             "DisplayName":  "Create channels",
|                                             "Description":  "Create channels in any team, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to create Teams channels without signed-in user; no path to tenant takeover or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Channel.Delete.All",
|                                             "DisplayName":  "Delete channels",
|                                             "Description":  "Delete channels in any team, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to delete Teams channels; no direct or near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Channel.ReadBasic.All",
|                                             "DisplayName":  "Read the names and descriptions of channels",
|                                             "Description":  "Read channel names and channel descriptions, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic channel info on behalf of user; no identity plane or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChannelMember.Read.All",
|                                             "DisplayName":  "Read the members of all channels",
|                                             "Description":  "Read the members of all channels, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read members of all channels without signed-in user; no path to role assignment or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChannelMember.ReadWrite.All",
|                                             "DisplayName":  "Add and remove members from all channels",
|                                             "Description":  "Add and remove members from all channels, without a signed-in user. Also allows changing a member\u0027s role, for example from owner to non-owner.",
|                                             "Tier":  3,
|                                             "Reason":  "Add/remove channel members and change roles; no documented path to tenant takeover or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChannelMessage.Edit",
|                                             "DisplayName":  "Edit user\u0027s channel messages",
|                                             "Description":  "Allows an app to edit channel messages in Microsoft Teams, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Edit channel messages on behalf of user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChannelMessage.Read.All",
|                                             "DisplayName":  "Read user channel messages",
|                                             "Description":  "Allows an app to read a channel\u0027s messages in Microsoft Teams, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read channel messages on behalf of user; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChannelMessage.ReadWrite",
|                                             "DisplayName":  "Read and write user channel messages",
|                                             "Description":  "Allows the app to read and write channel messages, on behalf of the signed-in user. This doesn\u0027t allow the app to edit the policyViolation of a channel message.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write channel messages on behalf of user; no path to role assignment or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChannelMessage.Send",
|                                             "DisplayName":  "Send channel messages",
|                                             "Description":  "Allows an app to send channel messages in Microsoft Teams, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Send channel messages on behalf of user; no identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChannelMessage.UpdatePolicyViolation.All",
|                                             "DisplayName":  "Flag channel messages for violating policy",
|                                             "Description":  "Allows the app to update Microsoft Teams channel messages by patching a set of Data Loss Prevention (DLP) policy violation properties to handle the output of DLP processing.",
|                                             "Tier":  3,
|                                             "Reason":  "Update DLP policy violation properties on Teams messages; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChannelSettings.Read.All",
|                                             "DisplayName":  "Read the names, descriptions, and settings of channels",
|                                             "Description":  "Read all channel names, channel descriptions, and channel settings, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read channel settings on behalf of user; no path to identity plane or tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChannelSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and write the names, descriptions, and settings of channels",
|                                             "Description":  "Read and write the names, descriptions, and settings of all channels, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write channel settings on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Chat.Create",
|                                             "DisplayName":  "Create chats",
|                                             "Description":  "Allows the app to create chats on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Create chats on behalf of user; no path to identity plane control or tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Chat.ManageDeletion.All",
|                                             "DisplayName":  "Delete and recover deleted chats",
|                                             "Description":  "Allows the app to delete and recover deleted chats, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delete and recover chats on behalf of user; no identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Chat.Read",
|                                             "DisplayName":  "Read user chat messages",
|                                             "Description":  "Allows an app to read 1 on 1 or group chats threads, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read chat threads on behalf of user; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Chat.ReadBasic",
|                                             "DisplayName":  "Read names and members of user chat threads",
|                                             "Description":  "Allows an app to read the members and descriptions of one-to-one and group chat threads, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read chat members and descriptions on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Chat.ReadBasic.All",
|                                             "DisplayName":  "Read names and members of all chat threads",
|                                             "Description":  "Read names and members of all one-to-one and group chats in Microsoft Teams, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read chat names and members without signed-in user; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Chat.ReadBasic.WhereInstalled",
|                                             "DisplayName":  "Read names and members of all chat threads where the associated Teams application is installed.",
|                                             "Description":  "Allows the app to read names and members of all one-to-one and group chats in Microsoft Teams where the associated Teams application is installed, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read chat names and members where app installed; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Chat.ReadWrite",
|                                             "DisplayName":  "Read and write user chat messages",
|                                             "Description":  "Allows an app to read and write 1 on 1 or group chats threads, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write chats on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Chat.ReadWrite.All",
|                                             "DisplayName":  "Read and write all chat messages",
|                                             "Description":  "Allows an app to read and write all one-to-one and group chats in Microsoft Teams, without a signed-in user. Does not allow sending messages.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write all chats without signed-in user; does not allow sending messages or role changes."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Chat.ReadWrite.WhereInstalled",
|                                             "DisplayName":  "Read and write all chat messages for chats where the associated Teams application is installed.",
|                                             "Description":  "Allows the app to read and write all chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write chat messages where app installed; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Chat.UpdatePolicyViolation.All",
|                                             "DisplayName":  "Flag chat messages for violating policy",
|                                             "Description":  "Allows the app to update Microsoft Teams 1-to-1 or group chat messages by patching a set of Data Loss Prevention (DLP) policy violation properties to handle the output of DLP processing.",
|                                             "Tier":  3,
|                                             "Reason":  "Update DLP policy violation properties on chat messages; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChatMember.Read",
|                                             "DisplayName":  "Read the members of chats",
|                                             "Description":  "Read the members of chats, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read chat members on behalf of user; no path to role assignment or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChatMember.Read.All",
|                                             "DisplayName":  "Read the members of all chats",
|                                             "Description":  "Read the members of all chats, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read members of all chats without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChatMember.Read.WhereInstalled",
|                                             "DisplayName":  "Read the members of all chats where the associated Teams application is installed.",
|                                             "Description":  "Allows the app to read the members of all chats where the associated Teams application is installed, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read chat members where app installed; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChatMember.ReadWrite",
|                                             "DisplayName":  "Add and remove members from chats",
|                                             "Description":  "Add and remove members from chats, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Add and remove chat members on behalf of user; no documented path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChatMember.ReadWrite.All",
|                                             "DisplayName":  "Add and remove members from all chats",
|                                             "Description":  "Add and remove members from all chats, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Add and remove members from all chats without signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChatMember.ReadWrite.WhereInstalled",
|                                             "DisplayName":  "Add and remove members from all chats where the associated Teams application is installed.",
|                                             "Description":  "Allows the app to add and remove members from all chats where the associated Teams application is installed, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Add and remove chat members where app installed; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChatMessage.Read",
|                                             "DisplayName":  "Read user chat messages",
|                                             "Description":  "Allows an app to read one-to-one and group chat messages, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read chat messages on behalf of user; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChatMessage.Send",
|                                             "DisplayName":  "Send user chat messages",
|                                             "Description":  "Allows an app to send one-to-one and group chat messages in Microsoft Teams, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Send chat messages on behalf of user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CloudApp-Discovery.Read.All",
|                                             "DisplayName":  "Read discovered cloud applications data",
|                                             "Description":  "Allows the app to read details of discovered cloud apps in the organization, on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read discovered cloud app details on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CloudPC.Read.All",
|                                             "DisplayName":  "Read Cloud PCs",
|                                             "Description":  "Allows the app to read the properties of Cloud PCs, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read properties of Cloud PCs without signed-in user; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CloudPC.ReadWrite.All",
|                                             "DisplayName":  "Read and write Cloud PCs",
|                                             "Description":  "Allows the app to read and write the properties of Cloud PCs on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write Cloud PC properties on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Code.AccessAzureDataExplorer.All",
|                                             "DisplayName":  "Access Azure Data Explorer",
|                                             "Description":  "Allow the application to access Azure Data Explorer on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Access Azure Data Explorer on behalf of user; no identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Code.AccessAzureDataLake.All",
|                                             "DisplayName":  "Have full access to the Azure Data Lake service",
|                                             "Description":  "Allow the application full access to the Azure Data Lake service on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Full access to Azure Data Lake on behalf of user; data plane access only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Code.AccessAzureKeyvault.All",
|                                             "DisplayName":  "Have full access to the Azure Key Vault service",
|                                             "Description":  "Allow the application full access to the Azure Key Vault service on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Full access to Azure Key Vault on behalf of user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Code.AccessFabric.All",
|                                             "DisplayName":  "Allow API calls to access all Fabric resources on behalf of signed-in user",
|                                             "Description":  "Allows the app to make API calls to access all Fabric resources, on behalf of signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Access all Fabric resources on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Code.AccessSQL.All",
|                                             "DisplayName":  "Access Azure SQL database and data warehouse",
|                                             "Description":  "This is for Azure SQL database and data warehouse access",
|                                             "Tier":  3,
|                                             "Reason":  "Access Azure SQL database and data warehouse on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Code.AccessStorage.All",
|                                             "DisplayName":  "Access Azure Storage",
|                                             "Description":  "Allow the application to access Azure Storage on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Access Azure Storage on behalf of user; data plane access only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Community.Read.All",
|                                             "DisplayName":  "Read all Viva Engage communities",
|                                             "Description":  "Allows the app to list Viva Engage communities, and to read their properties without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Viva Engage communities without signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Community.ReadWrite.All",
|                                             "DisplayName":  "Read and write all Viva Engage communities",
|                                             "Description":  "Allows the app to create Viva Engage communities, read all community properties, update community properties, and delete communities without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows management of Viva Engage communities but does not provide identity plane control or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "compliancestatus.tenant.read",
|                                             "DisplayName":  "compliancestatus.tenant.read",
|                                             "Description":  "compliancestatus.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to compliance status data with no path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ConfigurationMonitoring.Read.All",
|                                             "DisplayName":  "Read all Configuration Monitoring entities",
|                                             "Description":  "Allows the app to read all Configuration Monitoring entities, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to configuration monitoring data without identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ConfigurationMonitoring.ReadWrite.All",
|                                             "DisplayName":  "Read and write all Configuration Monitoring entities",
|                                             "Description":  "Allows the app to read and write all Configuration Monitoring entities, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to configuration monitoring data but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Connection.Read.All",
|                                             "DisplayName":  "Make API calls that require read permissions on all Fabric connections",
|                                             "Description":  "Allows the app to make API calls that require read permissions on all Fabric connections, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to Power BI Fabric connections with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Connection.ReadWrite.All",
|                                             "DisplayName":  "Make API calls that require read and write permissions on all Fabric connections",
|                                             "Description":  "Allows the app to make API calls that require read and write permissions on all Fabric connections, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read/write access to Power BI Fabric connections but no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Connection.Reshare.All",
|                                             "DisplayName":  "Connection.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but likely limited to reshare actions without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ConsentRequest.Create",
|                                             "DisplayName":  "Create consent requests",
|                                             "Description":  "Allows the app to read create consent requests on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated creation of consent requests without ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ConsentRequest.Read",
|                                             "DisplayName":  "Read consent requests created by the user",
|                                             "Description":  "Allows the app to read consent requests and approvals created by the signed-in user, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to consent requests created by the user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ConsentRequest.Read.All",
|                                             "DisplayName":  "Read all consent requests",
|                                             "Description":  "Allows the app to read consent requests and approvals without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to consent requests but no ability to modify or assign roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ConsentRequest.ReadApprove.All",
|                                             "DisplayName":  "Read and approve consent requests",
|                                             "Description":  "Allows the app to read and approve consent requests on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read and approve consent requests but no direct role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ConsentRequest.ReadWrite.All",
|                                             "DisplayName":  "Read and write all consent requests",
|                                             "Description":  "Allows the app to read app consent requests and approvals, and deny or approve those requests without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read/write access to consent requests but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Contacts.Read",
|                                             "DisplayName":  "Read user contacts ",
|                                             "Description":  "Allows the app to read user contacts.  ",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user contacts only; no path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Contacts.Read.All",
|                                             "DisplayName":  "Read user and shared contacts ",
|                                             "Description":  "Allows the app to read contacts a user has permissions to access, including their own and shared contacts.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to contacts across users but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Contacts.Read.Shared",
|                                             "DisplayName":  "Read user and shared contacts ",
|                                             "Description":  "Allows the app to read contacts a user has permissions to access, including their own and shared contacts.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to shared contacts only; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Contacts.ReadWrite",
|                                             "DisplayName":  "Have full access to user contacts ",
|                                             "Description":  "Allows the app to create, read, update, and delete user contacts.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated write access to user contacts only; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Contacts.ReadWrite.All",
|                                             "DisplayName":  "Read and write user and shared  contacts ",
|                                             "Description":  "Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated write access to contacts but no identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Contacts.ReadWrite.Shared",
|                                             "DisplayName":  "Read and write user and shared  contacts ",
|                                             "Description":  "Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated write access to shared contacts only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Contacts-OnPremisesSyncBehavior.ReadWrite.All",
|                                             "DisplayName":  "Read and update the on-premises sync behavior of contacts",
|                                             "Description":  "Allows the app to read and update the on-premises sync behavior of contacts a user has permissions to, including their own and shared contacts.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify on-premises sync behavior of contacts but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Content.Create",
|                                             "DisplayName":  "Create content",
|                                             "Description":  "App can automatically create content and datasets for a user.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to create content and datasets but no path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Rights Management Services",
|                                             "AppId":  "00000012-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Content.DelegatedReader",
|                                             "DisplayName":  "Read protected content on behalf of a user",
|                                             "Description":  "Read protected content on behalf of a user",
|                                             "Tier":  3,
|                                             "Reason":  "Read protected content on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Rights Management Services",
|                                             "AppId":  "00000012-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Content.DelegatedWriter",
|                                             "DisplayName":  "Create protected content on behalf of a user",
|                                             "Description":  "Create protected content on behalf of a user",
|                                             "Tier":  3,
|                                             "Reason":  "Create protected content on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Content.Process.All",
|                                             "DisplayName":  "Process content for data security, governance and compliance",
|                                             "Description":  "Allows the app to process and evaluate content for data security, governance and compliance outcomes at tenant scope.",
|                                             "Tier":  3,
|                                             "Reason":  "Process and evaluate content for compliance but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Content.Process.User",
|                                             "DisplayName":  "Process content for data security, governance and compliance",
|                                             "Description":  "Allows the app to process and evaluate content for data security, governance and compliance outcomes for a user.",
|                                             "Tier":  3,
|                                             "Reason":  "Process content for a user only; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Rights Management Services",
|                                             "AppId":  "00000012-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Content.SuperUser",
|                                             "DisplayName":  "Read all protected content for this tenant",
|                                             "Description":  "Read all protected content for this tenant",
|                                             "Tier":  3,
|                                             "Reason":  "Read all protected content but no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Rights Management Services",
|                                             "AppId":  "00000012-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Content.Writer",
|                                             "DisplayName":  "Create protected content",
|                                             "Description":  "Create protected content",
|                                             "Tier":  3,
|                                             "Reason":  "Create protected content only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ContentActivity.Read",
|                                             "DisplayName":  "Read contents activity audit log from the audit store.",
|                                             "Description":  "Read contents activity audit log from the audit store.",
|                                             "Tier":  3,
|                                             "Reason":  "Read content activity audit logs; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ContentActivity.Write",
|                                             "DisplayName":  "Upload content activity audit logs to the audit store.",
|                                             "Description":  "Allows the application to upload bulk contents activity audit logs to the audit store.",
|                                             "Tier":  3,
|                                             "Reason":  "Write content activity audit logs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Contracts.Read.All",
|                                             "DisplayName":  "Read contracts",
|                                             "Description":  "Allows the app to read available properties on contracts, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read contract properties only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Skype for Business Online",
|                                             "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Conversations.AudioVideo",
|                                             "DisplayName":  "Send/Receive Audio and Video (preview)",
|                                             "Description":  "Allows the app to send and receive audio and video; and manage audio/video service scenarios",
|                                             "Tier":  3,
|                                             "Reason":  "Manage audio/video service scenarios; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Skype for Business Online",
|                                             "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Conversations.Chat",
|                                             "DisplayName":  "Send/Receive Instant Messages (preview)",
|                                             "Description":  "Allows the app to send and receive instant messages; and manage instant messaging service scenarios",
|                                             "Tier":  3,
|                                             "Reason":  "Manage instant messaging scenarios; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Skype for Business Online",
|                                             "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Conversations.PSTN",
|                                             "DisplayName":  "Send/Receive PSTN (preview)",
|                                             "Description":  "Allows the app to send and receive voice calls; and manage PSTN service scenarios",
|                                             "Tier":  3,
|                                             "Reason":  "Manage PSTN voice calls; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopilotConversation.Delete",
|                                             "DisplayName":  "Delete Microsoft 365 Copilot conversations",
|                                             "Description":  "Allows the app to delete Microsoft 365 Copilot conversations on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delete Copilot conversations on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CopilotPackages.Read.All",
|                                             "DisplayName":  "Read all packages information",
|                                             "Description":  "Allows the app to read packages information without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read package information only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopilotPackages.ReadWrite.All",
|                                             "DisplayName":  "Read and update all packages information",
|                                             "Description":  "Allows the user to read and update the packages information",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update package info; no path to role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopilotPolicySettings.Read",
|                                             "DisplayName":  "Read Copilot policy settings",
|                                             "Description":  "Allows the app to read Copilot policy settings for the organization, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Copilot policy settings on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CopilotPolicySettings.ReadWrite",
|                                             "DisplayName":  "Read and write Copilot policy settings",
|                                             "Description":  "Allows the app to read and write Copilot policy settings for the organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write Copilot policy settings but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopilotSettings-LimitedMode.Read",
|                                             "DisplayName":  "Read organization-wide copilot limited mode setting",
|                                             "Description":  "Allows the app to read organization-wide copilot limited mode setting on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read limited mode setting on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopilotSettings-LimitedMode.ReadWrite",
|                                             "DisplayName":  "Read and write organization-wide copilot limited mode setting",
|                                             "Description":  "Allows the app to read and write organization-wide copilot limited mode setting on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write limited mode setting on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopyJob.Execute.All",
|                                             "DisplayName":  "Execute copy jobs",
|                                             "Description":  "Allows executing copy jobs on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute copy jobs on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopyJob.Read.All",
|                                             "DisplayName":  "Read copy jobs",
|                                             "Description":  "Allows reading copy jobs on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read copy jobs on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopyJob.ReadWrite.All",
|                                             "DisplayName":  "Read and write copy jobs",
|                                             "Description":  "Allows modifying copy jobs on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify copy jobs on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopyJob.Reshare.All",
|                                             "DisplayName":  "CopyJob.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but likely limited to reshare actions without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CrossTenantInformation.ReadBasic.All",
|                                             "DisplayName":  "Read cross-tenant basic information",
|                                             "Description":  "Allows the application to obtain basic tenant information about another target tenant within the Azure AD ecosystem on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic tenant info about other tenants; no identity plane control in current tenant."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CrossTenantUserProfileSharing.Read",
|                                             "DisplayName":  "Read shared cross-tenant user profile and export data",
|                                             "Description":  "Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read user profile info and export external user data on behalf of user; no role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CrossTenantUserProfileSharing.Read.All",
|                                             "DisplayName":  "Read all shared cross-tenant user profiles and export their data",
|                                             "Description":  "Allows the application to list and query any shared user profile information associated with the current tenant without a signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read shared user profile info and export external user data without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CrossTenantUserProfileSharing.ReadWrite",
|                                             "DisplayName":  "Read shared cross-tenant user profile and export or delete data",
|                                             "Description":  "Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read, export, and remove external user data on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CrossTenantUserProfileSharing.ReadWrite.All",
|                                             "DisplayName":  "Read all shared cross-tenant user profiles and export or delete their data",
|                                             "Description":  "Allows the application to list and query any shared user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read, export, and remove external user data for any user on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomAuthenticationExtension.Read.All",
|                                             "DisplayName":  "Read your organization\u0027s custom authentication extensions",
|                                             "Description":  "Allows the app to read your organization\u0027s custom authentication extensions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read custom authentication extensions on behalf of user; no ability to modify roles or credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CustomAuthenticationExtension.ReadWrite.All",
|                                             "DisplayName":  "Read and write all custom authentication extensions",
|                                             "Description":  "Allows the app to read or write your organization\u0027s custom authentication extensions without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write custom authentication extensions but no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CustomAuthenticationExtension.Receive.Payload",
|                                             "DisplayName":  "Receive custom authentication extension HTTP requests",
|                                             "Description":  "Allows custom authentication extensions associated with the app to receive HTTP requests triggered by an authentication event. The request can include information about a user, client and resource service principals, and other information about the authentication.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows receiving authentication event payloads but does not enable role assignment or credential modification."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CustomDetection.Read.All",
|                                             "DisplayName":  "Read all custom detection rules",
|                                             "Description":  "Allows the app to read custom detection rules without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to custom detection rules without ability to modify identity or roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CustomDetection.ReadWrite.All",
|                                             "DisplayName":  "Read and write all custom detection rules",
|                                             "Description":  "Allows the app to read and write custom detection rules without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Can modify custom detection rules but no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomSecAttributeAssignment.Read.All",
|                                             "DisplayName":  "Read custom security attribute assignments",
|                                             "Description":  "Allows the app to read custom security attribute assignments for all principals in the tenant on behalf of a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to security attribute assignments only; no identity plane modification."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CustomSecAttributeAssignment.ReadWrite.All",
|                                             "DisplayName":  "Read and write custom security attribute assignments",
|                                             "Description":  "Allows the app to read and write custom security attribute assignments for all principals in the tenant without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to security attribute assignments but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomSecAttributeAuditLogs.Read.All",
|                                             "DisplayName":  "Read custom security attribute audit logs",
|                                             "Description":  "Allows the app to read audit logs for events that contain information about custom security attributes, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to audit logs related to custom security attributes; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomSecAttributeDefinition.Read.All",
|                                             "DisplayName":  "Read custom security attribute definitions",
|                                             "Description":  "Allows the app to read custom security attribute definitions for the tenant on behalf of a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to security attribute definitions; no ability to modify roles or credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomSecAttributeDefinition.ReadWrite.All",
|                                             "DisplayName":  "Read and write custom security attribute definitions",
|                                             "Description":  "Allows the app to read and write custom security attribute definitions for the tenant on behalf of a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Can modify security attribute definitions but no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomSecAttributeProvisioning.Read.All",
|                                             "DisplayName":  "Read the provisioning configuration of all active custom security attributes",
|                                             "Description":  "Allows the app to read the provisioning configuration of all active custom security attributes on behalf of a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to provisioning configuration; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomSecAttributeProvisioning.ReadWrite.All",
|                                             "DisplayName":  "Read and edit the provisioning configuration of all active custom security attributes",
|                                             "Description":  "Allows the app to read and edit the provisioning configuration of all active custom security attributes on behalf of a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Can modify provisioning configuration but no direct identity plane escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CustomTag.Tenant.Read",
|                                             "DisplayName":  "CustomTag.Tenant.Read",
|                                             "Description":  "CustomTag.Tenant.Read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to custom tags; no path to identity or role modification."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CustomTag.Tenant.Write",
|                                             "DisplayName":  "CustomTag.Tenant.Write",
|                                             "Description":  "CustomTag.Tenant.Write",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to custom tags but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomTags.Read.All",
|                                             "DisplayName":  "Read all custom tags data",
|                                             "Description":  "Read custom tags data on behalf of the signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to custom tags on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomTags.ReadWrite.All",
|                                             "DisplayName":  "Read and write custom tags data",
|                                             "Description":  "Read and write custom tags data on behalf of the signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to custom tags on behalf of user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dashboard.Execute.All",
|                                             "DisplayName":  "Dashboard.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Execute permissions on dashboards on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dashboard.Read.All",
|                                             "DisplayName":  "Read dashboards",
|                                             "Description":  "Allows reading dashboards on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to dashboards on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dashboard.ReadWrite.All",
|                                             "DisplayName":  "Read and write dashboards",
|                                             "Description":  "Allows modifying dashboards on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify dashboards on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dashboard.Reshare.All",
|                                             "DisplayName":  "Dashboard.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare dashboards on behalf of user; no path to role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataAgent.Execute.All",
|                                             "DisplayName":  "Execute data agents",
|                                             "Description":  "Allows executing data agents on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute data agents on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataAgent.Read.All",
|                                             "DisplayName":  "Read data agents",
|                                             "Description":  "Allows reading data agents on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read data agents on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataAgent.ReadWrite.All",
|                                             "DisplayName":  "Read and write data agents",
|                                             "Description":  "Allows modifying data agents on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify data agents on behalf of user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataAgent.Reshare.All",
|                                             "DisplayName":  "DataAgent.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare data agents on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DatabricksCatalog.Read.All",
|                                             "DisplayName":  "Read Databricks workspaces catalog metadata.",
|                                             "Description":  "Allows reading Databricks workspaces catalog metadata on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Databricks workspace metadata on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dataflow.Execute.All",
|                                             "DisplayName":  "Execute dataflows",
|                                             "Description":  "Allows executing dataflows on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute dataflows on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dataflow.Read.All",
|                                             "DisplayName":  "Read dataflows",
|                                             "Description":  "Allows reading dataflows on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read dataflows on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dataflow.ReadWrite.All",
|                                             "DisplayName":  "Read and write dataflows",
|                                             "Description":  "Allows modifying dataflows on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify dataflows on behalf of user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dataflow.Reshare.All",
|                                             "DisplayName":  "Dataflow.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare dataflows on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DataInsightsSubscription.tenant.read",
|                                             "DisplayName":  "DataInsightsSubscription.tenant.read",
|                                             "Description":  "DataInsightsSubscription.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to data insights subscription; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DataInsightsSubscription.tenant.write",
|                                             "DisplayName":  "DataInsightsSubscription.tenant.write",
|                                             "Description":  "DataInsightsSubscription.tenant.write",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to data insights subscription; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DataInsightsUsersData.tenant.read",
|                                             "DisplayName":  "DataInsightsUsersData.tenant.read",
|                                             "Description":  "DataInsightsUsersData.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to user data insights; no path to role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Datamart.Execute.All",
|                                             "DisplayName":  "Datamart.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Execute datamarts on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Datamart.Read.All",
|                                             "DisplayName":  "Read datamarts",
|                                             "Description":  "Allows reading datamarts on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read datamarts on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Datamart.ReadWrite.All",
|                                             "DisplayName":  "Read and write datamarts",
|                                             "Description":  "Allows modifying datamarts on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify datamarts on behalf of user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Datamart.Reshare.All",
|                                             "DisplayName":  "Datamart.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare datamarts on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataPipeline.Execute.All",
|                                             "DisplayName":  "Make API calls that require execute permissions all data pipelines",
|                                             "Description":  "Allows the app to make API calls that require execute permissions on all data pipelines, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute data pipelines on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataPipeline.Read.All",
|                                             "DisplayName":  "Make API calls that require read permissions on all data pipelines",
|                                             "Description":  "Allows the app to make API calls that require read permissions on all data pipelines, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read data pipelines on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataPipeline.ReadWrite.All",
|                                             "DisplayName":  "Make API calls that require read and write permissions on all data pipelines",
|                                             "Description":  "Allows the app to make API calls that require read and write permissions on all data pipelines, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify data pipelines on behalf of user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataPipeline.Reshare.All",
|                                             "DisplayName":  "DataPipeline.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare data pipelines on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dataset.Read.All",
|                                             "DisplayName":  "View all datasets",
|                                             "Description":  "The app can view all datasets for the signed in user and any datasets that the user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read datasets accessible to user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dataset.ReadWrite.All",
|                                             "DisplayName":  "Read and write all datasets",
|                                             "Description":  "The app can view and write to all datasets for the signed in user and any datasets that the user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify datasets accessible to user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DelegatedAdminRelationship.Read.All",
|                                             "DisplayName":  "Read Delegated Admin relationships with customers",
|                                             "Description":  "Allows the app to read details of delegated admin relationships with customers like access details (that includes roles) and the duration as well as specific role assignments to security groups without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read delegated admin relationships but no ability to modify roles or credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DelegatedPermissionGrant.Read.All",
|                                             "DisplayName":  "Read all delegated permission grants",
|                                             "Description":  "Allows the app to read all delegated permission grants, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read delegated permission grants only; no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Device.Command",
|                                             "DisplayName":  "Communicate with user devices",
|                                             "Description":  "Allows the app to launch another app or communicate with another app on a user\u0027s device on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows app communication on user\u0027s device but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Device.CreateFromOwnedTemplate",
|                                             "DisplayName":  "Create devices based on owned device templates",
|                                             "Description":  "Allows the app to create device objects based on device templates owned by the signed-in user, on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Create devices from templates owned by user; no path to role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Device.Read",
|                                             "DisplayName":  "Read user devices",
|                                             "Description":  "Allows the app to read a user\u0027s list of devices on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read user\u0027s devices only; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Device.Read.All",
|                                             "DisplayName":  "Read all devices",
|                                             "Description":  "Allows the app to read your organization\u0027s devices\u0027 configuration information on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read all devices\u0027 configuration on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceLocalCredential.ReadBasic.All",
|                                             "DisplayName":  "Read device local credential properties",
|                                             "Description":  "Allows the app to read device local credential properties excluding passwords, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to device local credential properties excluding passwords; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementApps.Read.All",
|                                             "DisplayName":  "Read Microsoft Intune apps",
|                                             "Description":  "Allows the app to read the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Intune app properties and policies; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementCloudCA.Read.All",
|                                             "DisplayName":  "Read Microsoft Cloud PKI objects",
|                                             "Description":  "Allows the app to read certification authority information without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to certification authority info; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceManagementConfiguration.Read.All",
|                                             "DisplayName":  "Read Microsoft Intune Device Configuration and Policies",
|                                             "Description":  "Allows the app to read properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Intune device configuration and compliance policies; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceManagementManagedDevices.Read.All",
|                                             "DisplayName":  "Read Microsoft Intune devices",
|                                             "Description":  "Allows the app to read the properties of devices managed by Microsoft Intune.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to managed device properties; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementRBAC.Read.All",
|                                             "DisplayName":  "Read Microsoft Intune RBAC settings",
|                                             "Description":  "Allows the app to read the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Intune RBAC settings; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceManagementScripts.Read.All",
|                                             "DisplayName":  "Read Microsoft Intune Scripts",
|                                             "Description":  "Allows the app to read Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Intune device management scripts; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementServiceConfig.Read.All",
|                                             "DisplayName":  "Read Microsoft Intune configuration",
|                                             "Description":  "Allows the app to read Microsoft Intune service properties including device enrollment and third party service connection configuration, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Intune service properties; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceTemplate.Read.All",
|                                             "DisplayName":  "Read all device templates",
|                                             "Description":  "Allows the app to read all device templates, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to device templates; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Directory.AccessAsUser.All",
|                                             "DisplayName":  "Access directory as the signed in user",
|                                             "Description":  "Allows the app to have the same access to information in the directory as the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated access matching signed-in user rights; no direct identity plane control without admin privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Directory.Read.All",
|                                             "DisplayName":  "Read directory data",
|                                             "Description":  "Allows the app to read data in your organization\u0027s directory, such as users, groups and apps.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only directory access; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DirectoryRecommendations.Read.All",
|                                             "DisplayName":  "Read all Azure AD recommendations",
|                                             "Description":  "Allows the app to read all Azure AD recommendations, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Azure AD recommendations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Domain.Read.All",
|                                             "DisplayName":  "Read domains.",
|                                             "Description":  "Allows the app to read all domain properties on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to domain properties; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Domain-InternalFederation.Read.All",
|                                             "DisplayName":  "Read internal federation configuration for a domain.",
|                                             "Description":  "Allows the app to read internal federation configuration for a domain.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to internal federation configuration; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DynamicRiskPreventionTag.Tenant.Read",
|                                             "DisplayName":  "DynamicRiskPreventionTag.Tenant.Read",
|                                             "Description":  "DynamicRiskPreventionTag.Tenant.Read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to risk prevention tags; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EAS.AccessAsUser.All",
|                                             "DisplayName":  "Access mailboxes via Exchange ActiveSync",
|                                             "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via Exchange ActiveSync.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated mailbox access via Exchange ActiveSync; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "eDiscovery.Read.All",
|                                             "DisplayName":  "Read all eDiscovery objects",
|                                             "Description":  "Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to eDiscovery objects; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduAdministration.Read",
|                                             "DisplayName":  "Read education app settings",
|                                             "Description":  "Read the state and settings of all Microsoft education apps on behalf of the user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to education app state and settings; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduAdministration.Read.All",
|                                             "DisplayName":  "Read Education app settings",
|                                             "Description":  "Read the state and settings of all Microsoft education apps.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to all education app state and settings; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduAssignments.Read",
|                                             "DisplayName":  "Read users\u0027 class assignments and their grades",
|                                             "Description":  "Allows the app to read assignments and their grades on behalf of the user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to assignments and grades; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduAssignments.Read.All",
|                                             "DisplayName":  "Read all class assignments with grades",
|                                             "Description":  "Allows the app to read all class assignments with grades for all users without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to all class assignments and grades; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduAssignments.ReadBasic",
|                                             "DisplayName":  "Read users\u0027 class assignments without grades",
|                                             "Description":  "Allows the app to read assignments without grades on behalf of the user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to assignments without grades; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduAssignments.ReadBasic.All",
|                                             "DisplayName":  "Read all class assignments without grades",
|                                             "Description":  "Allows the app to read all class assignments without grades for all users without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to all class assignments without grades; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduCurricula.Read",
|                                             "DisplayName":  "Read the user\u0027s class modules and resources",
|                                             "Description":  "Allows the app to read the user\u0027s modules and resources on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to user modules and resources; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduCurricula.Read.All",
|                                             "DisplayName":  "Read all class modules and resources",
|                                             "Description":  "Allows the app to read all modules and resources, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to all modules and resources; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduReports-Reading.Read.All",
|                                             "DisplayName":  "Read all tenant reading assignments submissions data",
|                                             "Description":  "Allows the app to read all tenant users reading assignments submissions data without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to education data without identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduReports-Reading.ReadAnonymous.All",
|                                             "DisplayName":  "Read all tenant reading assignments submissions data",
|                                             "Description":  "Allows the app to read all tenant users reading assignments submissions data (excludes student-identifying information) without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to anonymized education data; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduReports-Reflect.Read.All",
|                                             "DisplayName":  "Read all tenant reflect check-ins submissions data",
|                                             "Description":  "Allows the app to read all tenant users reflect check-ins submissions data without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to reflect check-ins data without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduReports-Reflect.ReadAnonymous.All",
|                                             "DisplayName":  "Read all tenant reflect check-ins submissions data",
|                                             "Description":  "Allows the app to read all tenant users reflect check-ins submissions data (excludes responder-identifying information) without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to anonymized reflect check-ins data; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduRoster.Read",
|                                             "DisplayName":  "Read users\u0027 view of the roster",
|                                             "Description":  "Allows the app to read the structure of schools and classes in an organization\u0027s roster and education-specific information about users to be read on behalf of the user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to education roster data on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduRoster.Read.All",
|                                             "DisplayName":  "Read the organization\u0027s roster",
|                                             "Description":  "Allows the app to read the structure of schools and classes in the organization\u0027s roster and education-specific information about all users to be read.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to education roster data; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduRoster.ReadBasic",
|                                             "DisplayName":  "Read a limited subset of users\u0027 view of the roster",
|                                             "Description":  "Allows the app to read a limited subset of the properties from the structure of schools and classes in an organization\u0027s roster and a limited subset of properties about users to be read on behalf of the user. Includes name, status, education role, email address and photo.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to limited education roster properties; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduRoster.ReadBasic.All",
|                                             "DisplayName":  "Read a limited subset of the organization\u0027s roster",
|                                             "Description":  "Allows the app to read a limited subset of properties from both the structure of schools and classes in the organization\u0027s roster and education-specific information about all users. Includes name, status, role, email address and photo.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to limited education roster properties; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduRoster.ReadWrite",
|                                             "DisplayName":  "Read and write users\u0027 view of the roster",
|                                             "Description":  "Allows the app to read and write the structure of schools and classes in an organization\u0027s roster and education-specific information about users to be read and written on behalf of the user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read/write access to education roster on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduRoster.ReadWrite.All",
|                                             "DisplayName":  "Read and write the organization\u0027s roster",
|                                             "Description":  "Allows the app to read and write the structure of schools and classes in the organization\u0027s roster and education-specific information about all users to be read and written.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read/write access to education roster data; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "email",
|                                             "DisplayName":  "View users\u0027 email address",
|                                             "Description":  "Allows the app to read your users\u0027 primary email address",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to user\u0027s primary email address only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EngagementConversation.Migration.All",
|                                             "DisplayName":  "Read and write all Viva Engage conversations",
|                                             "Description":  "Allows the app to create Viva Engage conversations without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application create access to Viva Engage conversations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EngagementConversation.Read.All",
|                                             "DisplayName":  "Read all Viva Engage conversations",
|                                             "Description":  "Allows the app to list Viva Engage conversations, and to read their properties without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to Viva Engage conversations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EngagementConversation.ReadWrite.All",
|                                             "DisplayName":  "Read and write all Viva Engage conversations",
|                                             "Description":  "Allows the app to create Viva Engage conversations, read all conversation properties, update conversation properties, and delete conversations without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application full control of Viva Engage conversations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EngagementExport.Read.All",
|                                             "DisplayName":  "Export Viva Engage data",
|                                             "Description":  "Allows the app to export Viva Engage data for compliance, GDPR, and admin scenarios without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application export access to Viva Engage data; data exfiltration risk only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EngagementMeetingConversation.Read.All",
|                                             "DisplayName":  "Read all Viva Engage Teams QA conversations",
|                                             "Description":  "Allows the app to list Viva Engage Teams QA conversations, and to read their properties without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to Viva Engage Teams QA conversations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EngagementRole.Read",
|                                             "DisplayName":  "Read a user\u0027s Viva Engage roles ",
|                                             "Description":  "Allows the app to list a user\u0027s Viva Engage roles, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to user\u0027s Viva Engage roles; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EngagementRole.Read.All",
|                                             "DisplayName":  "Read all Viva Engage roles and role memberships",
|                                             "Description":  "Allows the app to list all Viva Engage roles and role memberships on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to all Viva Engage roles; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EngagementRole.ReadWrite.All",
|                                             "DisplayName":  "Modify Viva Engage role membership",
|                                             "Description":  "Allows the app to assign Viva Engage role to a user, and remove a Viva Engage role from a user behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated role assignment/removal for Viva Engage roles; no identity plane control or tenant takeover path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EnterpriseResource.Read",
|                                             "DisplayName":  "Read user project enterprise resources",
|                                             "Description":  "Allows the app to read the current user\u0027s enterprise resources.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to user\u0027s enterprise resources; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EnterpriseResource.Write",
|                                             "DisplayName":  "Read and write user project enterprise resources",
|                                             "Description":  "Allows the app to read, create, update, and delete the current user’s enterprise resources.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated write access to user\u0027s enterprise resources; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EntitlementManagement.Read.All",
|                                             "DisplayName":  "Read all entitlement management resources",
|                                             "Description":  "Allows the app to read access packages and related entitlement management resources on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to access packages; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EntitlementManagement.ReadWrite.All",
|                                             "DisplayName":  "Read and write entitlement management resources",
|                                             "Description":  "Allows the app to request access to and management of access packages and related entitlement management resources on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated manage access packages on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EntitlementMgmt-SubjectAccess.ReadWrite",
|                                             "DisplayName":  "Read and write entitlement management resources related to self-service operations",
|                                             "Description":  "Allows the app to manage self-service entitlement management resources on behalf of the signed-in user.  This includes operations such as requesting access and approving access of others.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated self-service entitlement management; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EntraBackup.Read.All",
|                                             "DisplayName":  "Read Preview jobs and snapshots",
|                                             "Description":  "Allows the app to list the all the snapshots, jobs and enumerate the changes of a specific preview job, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to backup snapshots and jobs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EntraBackup.ReadWrite.Preview",
|                                             "DisplayName":  "Create a preview job, read preview job and snapshots",
|                                             "Description":  "Allows the app to  list the all the snapshots, create a preview job and enumerate the changes of a specific preview job, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated create and read preview backup jobs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EntraBackup.ReadWrite.Recovery",
|                                             "DisplayName":  "Create preview and recovery job, read recovery job and snapshots",
|                                             "Description":  "Allows the app to  list the all the snapshots, create a recovery job and enumerate the changes of a specific recovery job, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated create and read recovery backup jobs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Environment.Execute.All",
|                                             "DisplayName":  "Environment.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated execute permission in Power BI; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Environment.Read.All",
|                                             "DisplayName":  "Read environment items",
|                                             "Description":  "Allows reading environment items on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to Power BI environment items; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Environment.ReadWrite.All",
|                                             "DisplayName":  "Read and write environment items",
|                                             "Description":  "Allows modifying environment items on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated modify access to Power BI environment items; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Environment.Reshare.All",
|                                             "DisplayName":  "Environment.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated reshare permission in Power BI; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EopDataInsights.AccessAsApp",
|                                             "DisplayName":  "EopDataInsights.AccessAsApp",
|                                             "Description":  "EopDataInsights.AccessAsApp",
|                                             "Tier":  3,
|                                             "Reason":  "Application access to data insights; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventhouse.Execute.All",
|                                             "DisplayName":  "Eventhouse.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated execute permission in Power BI; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventhouse.Read.All",
|                                             "DisplayName":  "Read eventhouses",
|                                             "Description":  "Allows reading eventhouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to eventhouses; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventhouse.ReadWrite.All",
|                                             "DisplayName":  "Read and write eventhouses",
|                                             "Description":  "Allows modifying eventhouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated modify access to eventhouses; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventhouse.Reshare.All",
|                                             "DisplayName":  "Eventhouse.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated reshare permission in Power BI; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EventListener.Read.All",
|                                             "DisplayName":  "Read your organization\u0027s authentication event listeners",
|                                             "Description":  "Allows the app to read your organization\u0027s authentication event listeners on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to authentication event listeners; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventstream.Execute.All",
|                                             "DisplayName":  "Eventstream.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated execute permission in Power BI; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventstream.Read.All",
|                                             "DisplayName":  "Read eventstreams",
|                                             "Description":  "Allows reading eventstreams on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to eventstreams; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventstream.ReadWrite.All",
|                                             "DisplayName":  "Read and write eventstreams",
|                                             "Description":  "Allows modifying eventstreams on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated modify access to eventstreams; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventstream.Reshare.All",
|                                             "DisplayName":  "Eventstream.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated reshare permission in Power BI; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EWS.AccessAsUser.All",
|                                             "DisplayName":  "Access mailboxes as the signed-in user via Exchange Web Services",
|                                             "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via Exchange Web Services.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated mailbox access as signed-in user; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ExchangeMessageTrace.Read.All",
|                                             "DisplayName":  "Search the email message trace",
|                                             "Description":  "Allows the app to search the email message trace on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to email message trace; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ExternalConnection.Read.All",
|                                             "DisplayName":  "Read all external connections",
|                                             "Description":  "Allows the app to read all external connections without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to external connections; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ExternalConnection.ReadWrite.All",
|                                             "DisplayName":  "Read and write all external connections",
|                                             "Description":  "Allows the app to read and write all external connections without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read/write access to external connections; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ExternalConnection.ReadWrite.OwnedBy",
|                                             "DisplayName":  "Read and write external connections",
|                                             "Description":  "Allows the app to read and write settings of external connections on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read and write settings of connections that it is authorized to.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows read/write of external connection settings limited to authorized connections; no direct identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ExternalDataShare.Accept.All",
|                                             "DisplayName":  "Allows the app to accept the external data share invitation",
|                                             "Description":  "Allows the app to accept the external data share invitation on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows accepting external data share invitations on behalf of user; no path to identity plane or tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ExternalItem.Read.All",
|                                             "DisplayName":  "Read items in external datasets",
|                                             "Description":  "Allow the app to read external datasets and content, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to external datasets on behalf of user; no identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ExternalItem.ReadWrite.All",
|                                             "DisplayName":  "Read and write all external items",
|                                             "Description":  "Allows the app to read and write all external items on behalf of a signed-in user. The signed-in user must be an administrator.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to external items on behalf of admin user but no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ExternalItem.ReadWrite.OwnedBy",
|                                             "DisplayName":  "Read and write external items",
|                                             "Description":  "Allows the app to read and write external items without a signed-in user. The app can only read external items of the connection that it is authorized to.",
|                                             "Tier":  3,
|                                             "Reason":  "App-only read/write access limited to authorized external items; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ExternalUserProfile.Read.All",
|                                             "DisplayName":  "Read external user profiles",
|                                             "Description":  "Allows the app to read available properties of external user profiles, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to external user profiles on behalf of user; no path to identity plane or tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ExternalUserProfile.ReadWrite.All",
|                                             "DisplayName":  "Read and write external user profiles",
|                                             "Description":  "Allows the app to read and write available properties of external user profiles, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to external user profiles on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Fabric.Embed",
|                                             "DisplayName":  "Embed Fabric items, retrieve user identifiers and restricted metadata",
|                                             "Description":  "Allows retrieving item definitions, user identifiers, and other restricted metadata required for embedding Fabric items on the user’s behalf. To embed, the app must also be granted the appropriate contextual scope(s), such as Item.Read.All, Notebook.Read.All, or Workspace.Read.All.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows embedding Fabric items on behalf of user; no identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Fabric.Extend",
|                                             "DisplayName":  "Extend Fabric with new item types",
|                                             "Description":  "Allows the app to extend Fabric with new item types and have restricted access to Fabric items, user identifiers and other metadata, on behalf of the signed-in user. Protecting exports with sensitivity labels, enforcement of regional boundaries and some other Fabric capabilities are not available to partner items.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows extending Fabric with new item types on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Fabric.Extend.IframeSandbox",
|                                             "DisplayName":  "Run partner Fabric items in iframes with relaxed sandbox protection.",
|                                             "Description":  "Allow partner Fabric items managed by this app to run in iframes with the relaxed sandbox enabling additional operations.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows partner Fabric items to run in relaxed sandbox iframes; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Family.Read",
|                                             "DisplayName":  "Read your family info",
|                                             "Description":  "Allows the app to read your family information, members and their basic profile.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to family info and profiles; no path to identity plane or tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "FileIngestion.Ingest",
|                                             "DisplayName":  "Ingest SharePoint and OneDrive content to make it available in the search index",
|                                             "Description":  "Allows the app to ingest SharePoint and OneDrive content to make it available in the search index, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows ingestion of SharePoint and OneDrive content for search indexing; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "FileIngestionHybridOnboarding.Manage",
|                                             "DisplayName":  "Manage onboarding for a Hybrid Cloud tenant",
|                                             "Description":  "Allows the app to manage onboarding for a Hybrid Cloud tenant, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage onboarding for Hybrid Cloud tenant without signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Files.Read",
|                                             "DisplayName":  "Read user files",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s files.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s files only; no identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Files.Read.All",
|                                             "DisplayName":  "Read all files that user can access",
|                                             "Description":  "Allows the app to read all files the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all files user can access; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Files.Read.Selected",
|                                             "DisplayName":  "Read files that the user selects (preview)",
|                                             "Description":  "(Preview) Allows the app to read files that the user selects. The app has access for several hours after the user selects a file.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user-selected files only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Files.ReadWrite",
|                                             "DisplayName":  "Have full access to user files",
|                                             "Description":  "Allows the app to read, create, update and delete the signed-in user\u0027s files.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to signed-in user\u0027s files only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Files.ReadWrite.All",
|                                             "DisplayName":  "Read and write files in all site collections",
|                                             "Description":  "Allows the app to read, create, update and delete all files in all site collections without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "App-only read/write access to all files in all site collections; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Files.ReadWrite.AppFolder",
|                                             "DisplayName":  "Have full access to the application\u0027s folder (preview)",
|                                             "Description":  "(Preview) Allows the app to read, create, update and delete files in the application\u0027s folder.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access limited to app\u0027s folder; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Files.ReadWrite.Selected",
|                                             "DisplayName":  "Read and write files that the user selects (preview)",
|                                             "Description":  "(Preview) Allows the app to read and write files that the user selects. The app has access for several hours after the user selects a file.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to user-selected files only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Files.SelectedOperations.Selected",
|                                             "DisplayName":  "Access selected Files, on behalf of the signed-in user",
|                                             "Description":  "Allow the application to access files explicitly permissioned to the application on behalf of the signed in user.  The specific files and the permissions granted will be configured in SharePoint Online or OneDrive.",
|                                             "Tier":  3,
|                                             "Reason":  "Access limited to explicitly permissioned files; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "FileStorageContainer.Manage.All",
|                                             "DisplayName":  "Manage all file storage containers",
|                                             "Description":  "Allows the application to utilize the file storage container administration capabilities on behalf of an administrator user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows file storage container administration on behalf of admin user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "FileStorageContainer.Selected",
|                                             "DisplayName":  "Access selected file storage containers",
|                                             "Description":  "Allows the application to utilize the file storage container platform to manage containers, without a signed-in user. The specific file storage containers and the permissions granted to them will be configured in Microsoft 365 by the developer of each container type.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage file storage containers without signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "FileStorageContainerType.Manage.All",
|                                             "DisplayName":  "Manage file storage container types on behalf of the signed in user",
|                                             "Description":  "Allows the application to manage file storage container types on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage file storage container types on behalf of SharePoint Embedded or Global Admin; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "FileStorageContainerTypeReg.Manage.All",
|                                             "DisplayName":  "Manage file storage container type registrations on behalf of the signed in user",
|                                             "Description":  "Allows the application to manage file storage container type registrations on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage file storage container type registrations on behalf of SharePoint Embedded or Global Admin; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "FileStorageContainerTypeReg.Selected",
|                                             "DisplayName":  "Access selected file storage container type registrations.",
|                                             "Description":  "Allows the application to manage selected file storage container type registrations on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage selected file storage container type registrations on behalf of SharePoint Embedded or Global Admin; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Financials.ReadWrite.All",
|                                             "DisplayName":  "Read and write financials data",
|                                             "Description":  "Allows the app to read and write financials data on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write financial data on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Gateway.Read.All",
|                                             "DisplayName":  "View all gateways",
|                                             "Description":  "The app can view all gateways that the signed in user is an admin of.",
|                                             "Tier":  3,
|                                             "Reason":  "View gateways where user is admin; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Gateway.ReadWrite.All",
|                                             "DisplayName":  "Read and write all gateways",
|                                             "Description":  "The app can view and edit all gateways that the signed in user is an admin of.",
|                                             "Tier":  3,
|                                             "Reason":  "View and edit gateways where user is admin; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Goals-Export.Read.All",
|                                             "DisplayName":  "Read all goals and export jobs that a user can access",
|                                             "Description":  "Allows the app to read all goals and export jobs that the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Read goals and export jobs user can access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Goals-Export.ReadWrite.All",
|                                             "DisplayName":  "Have full access to all goals and export jobs a user can access",
|                                             "Description":  "Allows the app to read goals, create and read export jobs that the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and create export jobs user can access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphInstance.Execute.All",
|                                             "DisplayName":  "Execute graph instances",
|                                             "Description":  "Allows executing graph instances on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute graph instances on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphInstance.Read.All",
|                                             "DisplayName":  "Read graph instances",
|                                             "Description":  "Allows reading graph instances on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read graph instances on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphInstance.ReadWrite.All",
|                                             "DisplayName":  "Read and write graph instances",
|                                             "Description":  "Allows modifying graph instances on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify graph instances on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphInstance.Reshare.All",
|                                             "DisplayName":  "GraphInstance.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but likely limited to resharing graph instances; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphQL.Execute.All",
|                                             "DisplayName":  "Make API calls that executes requests on all API for GraphQL items",
|                                             "Description":  "Allows the app to make API calls that executes requests on all API for GraphQL items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute GraphQL API calls on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphQLApi.Execute.All",
|                                             "DisplayName":  "Execute GraphQLApis",
|                                             "Description":  "Allows executing GraphQLApis on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute GraphQL APIs on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphQLApi.Read.All",
|                                             "DisplayName":  "Read GraphQLApis",
|                                             "Description":  "Allows reading GraphQLApis on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read GraphQL APIs on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphQLApi.ReadWrite.All",
|                                             "DisplayName":  "Read and write GraphQLApis",
|                                             "Description":  "Allows modifying GraphQLApis on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify GraphQL APIs on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphQLApi.Reshare.All",
|                                             "DisplayName":  "GraphQLApi.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but likely limited to resharing GraphQL APIs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Group.Create",
|                                             "DisplayName":  "Create groups",
|                                             "Description":  "Allows the app to create groups without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows app to create groups without signed-in user; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Group.Read.All",
|                                             "DisplayName":  "Read all groups",
|                                             "Description":  "Allows the app to list groups, and to read their properties and all group memberships on behalf of the signed-in user.  Also allows the app to read calendar, conversations, files, and other group content for all groups the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Read groups and memberships user can access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Group.ReadWrite.All",
|                                             "DisplayName":  "Read and write all groups",
|                                             "Description":  "Allows the app to create groups and read all group properties and memberships on behalf of the signed-in user.  Additionally allows group owners to manage their groups and allows group members to update group content.",
|                                             "Tier":  3,
|                                             "Reason":  "Create and manage groups on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Group-Conversation.Read.All",
|                                             "DisplayName":  "Read group conversations",
|                                             "Description":  "Allows the app to read group conversations that the signed-in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read group conversations user can access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Group-Conversation.ReadWrite.All",
|                                             "DisplayName":  "Read and write group conversations",
|                                             "Description":  "Allows the app to read and write group conversations that the signed-in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write group conversations user can access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GroupMember.Read.All",
|                                             "DisplayName":  "Read group memberships",
|                                             "Description":  "Allows the app to list groups, read basic group properties and read membership of all groups the signed-in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read group memberships user can access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "GroupMember.ReadWrite.All",
|                                             "DisplayName":  "Read and write all group memberships",
|                                             "Description":  "Allows the app to list groups, read basic properties, read and update the membership of the groups this app has access to without a signed-in user. Group properties and owners cannot be updated and groups cannot be deleted.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update group memberships app has access to; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Group-NestingSupport.ReadWrite.All",
|                                             "DisplayName":  "Read and write groups\u0027 disableNesting property",
|                                             "Description":  "Allows the app to read and write groups\u0027 disableNesting property without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write groups\u0027 disableNesting property; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Group-OnPremisesSyncBehavior.ReadWrite.All",
|                                             "DisplayName":  "Read and update the on-premises sync behavior of groups",
|                                             "Description":  "Allows the app to read and update the on-premises sync behavior of groups on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update on-premises sync behavior of groups; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GroupSettings.Read.All",
|                                             "DisplayName":  "Read all group settings that user can access",
|                                             "Description":  "Allows the app to read a list of tenant-level or group-specific group settings objects, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to group settings only; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GroupSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and write all group settings that user can access",
|                                             "Description":  "Allows the app to create, read, update, and delete on the list of tenant-level or group-specific group settings objects that you have access to in the organization, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to group settings only; no direct or near-direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "HealthMonitoringAlert.Read.All",
|                                             "DisplayName":  "Read all scenario health monitoring alerts",
|                                             "Description":  "Allows the app to read all scenario health monitoring alerts",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to health monitoring alerts; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "HealthMonitoringAlert.ReadWrite.All",
|                                             "DisplayName":  "Read and write all scenario monitoring alerts",
|                                             "Description":  "Allows the app to read and write all scenario monitoring alerts, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to health monitoring alerts; no direct identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "HealthMonitoringAlertConfig.Read.All",
|                                             "DisplayName":  "Read all scenario health monitoring alert configurations",
|                                             "Description":  "Allows the app to read all scenario health monitoring alert configurations",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to health monitoring alert configurations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "HealthMonitoringAlertConfig.ReadWrite.All",
|                                             "DisplayName":  "Read and write all scenario monitoring alert configurations.",
|                                             "Description":  "Allows the app to read and write all scenario monitoring alert configurations, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to alert configurations; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IdentityRiskEvent.Read.All",
|                                             "DisplayName":  "Read all identity risk event information",
|                                             "Description":  "Allows the app to read the identity risk event information for your organization without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to identity risk events; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IdentityRiskEvent.ReadWrite.All",
|                                             "DisplayName":  "Read and write all risk detection information",
|                                             "Description":  "Allows the app to read and update identity risk detection information for your organization without a signed-in user. Update operations include confirming risk event detections. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to risk event info but cannot assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IdentityRiskyAgent.Read.All",
|                                             "DisplayName":  "Read all risky agents information",
|                                             "Description":  "Allows the app to read the risky agents information in your organization without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to risky agents; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IdentityRiskyAgent.ReadWrite.All",
|                                             "DisplayName":  "Read and write risky agents information",
|                                             "Description":  "Allows the app to read and update identity risky agents information for all agents in your organization on behalf of the signed-in user. Update operations include dismissing risky agents.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to risky agents but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IdentityRiskyServicePrincipal.Read.All",
|                                             "DisplayName":  "Read all identity risky service principal information",
|                                             "Description":  "Allows the app to read all identity risky service principal information for your organization, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to risky service principals; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IdentityRiskyServicePrincipal.ReadWrite.All",
|                                             "DisplayName":  "Read and write all identity risky service principal information",
|                                             "Description":  "Allows the app to read and update identity risky service principal for your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to risky service principals but no direct role assignment or credential reset rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IdentityRiskyUser.Read.All",
|                                             "DisplayName":  "Read identity risky user information",
|                                             "Description":  "Allows the app to read identity risky user information for all users in your organization on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to risky user info; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IdentityRiskyUser.ReadWrite.All",
|                                             "DisplayName":  "Read and write all risky user information",
|                                             "Description":  "Allows the app to read and update identity risky user information for your organization without a signed-in user.  Update operations include dismissing risky users.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to risky user info but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IdentityUserFlow.Read.All",
|                                             "DisplayName":  "Read all identity user flows",
|                                             "Description":  "Allows the app to read your organization\u0027s user flows, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to user flows; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IdentityUserFlow.ReadWrite.All",
|                                             "DisplayName":  "Read and write all identity user flows",
|                                             "Description":  "Allows the app to read or write your organization\u0027s user flows, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to user flows but no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IMAP.AccessAsUser.All",
|                                             "DisplayName":  "Read and write access to mailboxes via IMAP.",
|                                             "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via IMAP protocol.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated IMAP access scoped to signed-in user; no tenant-wide impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IndustryData.ReadBasic.All",
|                                             "DisplayName":  "View basic service and resource information",
|                                             "Description":  "Allows the app to read basic service and resource information without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to basic service/resource info; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-DataConnector.Read.All",
|                                             "DisplayName":  "View data connector definitions",
|                                             "Description":  "Allows the app to read data connectors on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to data connectors; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-DataConnector.ReadWrite.All",
|                                             "DisplayName":  "Manage data connector definitions",
|                                             "Description":  "Allows the app to read and write data connectors on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to data connectors but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IndustryData-DataConnector.Upload",
|                                             "DisplayName":  "Upload files to a data connector",
|                                             "Description":  "Allows the app to upload data files to a data connector without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Upload access to data connectors; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-InboundFlow.Read.All",
|                                             "DisplayName":  "View inbound flow definitions",
|                                             "Description":  "Allows the app to read inbound data flows on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to inbound data flows; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-InboundFlow.ReadWrite.All",
|                                             "DisplayName":  "Manage inbound flow definitions",
|                                             "Description":  "Allows the app to read and write inbound data flows on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to inbound data flows; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-OutboundFlow.Read.All",
|                                             "DisplayName":  "View outbound flow definitions",
|                                             "Description":  "Allows the app to read outbound data flows on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to outbound data flows; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-OutboundFlow.ReadWrite.All",
|                                             "DisplayName":  "Manage outbound flow definitions",
|                                             "Description":  "Allows the app to read and write outbound data flows on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to outbound data flows; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-ReferenceDefinition.Read.All",
|                                             "DisplayName":  "View reference definitions",
|                                             "Description":  "Allows the app to read reference definitions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to reference definitions; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-ReferenceDefinition.ReadWrite.All",
|                                             "DisplayName":  "Manage reference definitions",
|                                             "Description":  "Allows the app to read and write reference definitions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to reference definitions; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IndustryData-Run.Read.All",
|                                             "DisplayName":  "View current and previous runs",
|                                             "Description":  "Allows the app to read current and previous IndustryData runs without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to IndustryData runs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-Run.Start",
|                                             "DisplayName":  "View and start runs",
|                                             "Description":  "Allows the app to view and start IndustryData runs on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to start IndustryData runs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IndustryData-SourceSystem.Read.All",
|                                             "DisplayName":  "View source system definitions",
|                                             "Description":  "Allows the app to read source system definitions without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to source system definitions; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-SourceSystem.ReadWrite.All",
|                                             "DisplayName":  "Manage source system definitions",
|                                             "Description":  "Allows the app to read and write source system definitions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to source system definitions; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-TimePeriod.Read.All",
|                                             "DisplayName":  "Read time period definitions",
|                                             "Description":  "Allows the app to read time period definitions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to time period definitions; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IndustryData-TimePeriod.ReadWrite.All",
|                                             "DisplayName":  "Manage time period definitions",
|                                             "Description":  "Allows the app to read and write time period definitions without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to time period definitions; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "InformationProtectionConfig.Read",
|                                             "DisplayName":  "Read configurations for protecting organizational data applicable to the user",
|                                             "Description":  "Allows the app to read the configurations applicable to the signed-in user for protecting organizational data, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to data protection configurations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "InformationProtectionConfig.Read.All",
|                                             "DisplayName":  "Read all configurations for protecting organizational data applicable to users",
|                                             "Description":  "Allows the app to read all configurations applicable to users for protecting organizational data, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to all data protection configurations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "InformationProtectionContent.Sign.All",
|                                             "DisplayName":  "Sign digests for data",
|                                             "Description":  "Allows an app to sign digests for data without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to sign data digests; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "InformationProtectionContent.Write.All",
|                                             "DisplayName":  "Create protected content",
|                                             "Description":  "Allows the app to create protected content without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to create protected content; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "InformationProtectionPolicy.Read",
|                                             "DisplayName":  "Read user sensitivity labels and label policies.",
|                                             "Description":  "Allows an app to read information protection sensitivity labels and label policy settings, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to sensitivity labels and policies; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "InformationProtectionPolicy.Read.All",
|                                             "DisplayName":  "Read all published labels and label policies for an organization.",
|                                             "Description":  "Allows an app to read published sensitivity labels and label policy settings for the entire organization or a specific user, without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to published sensitivity labels and policies; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "InsiderRiskData.Read.All",
|                                             "DisplayName":  "InsiderRiskData.Read.All",
|                                             "Description":  "InsiderRiskData.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to insider risk data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Insights-UserMetric.Read.All",
|                                             "DisplayName":  "Read user metrics insights",
|                                             "Description":  "Allows an app to read user metrics insights, such as daily and monthly active users, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to user metrics; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Item.Audit.All",
|                                             "DisplayName":  "Make API calls that require audit permissions on all items",
|                                             "Description":  "Allows the app to make API calls that require audit permissions on all items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Audit permissions on items; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Item.Execute.All",
|                                             "DisplayName":  "Make API calls that require execute permissions on all Fabric items",
|                                             "Description":  "Allows the app to make API calls that require execute permissions on all Fabric items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute permissions on items; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Item.ExternalDataShare.All",
|                                             "DisplayName":  "Allows the app to create and manage external data shares for all Fabric items",
|                                             "Description":  "Allows the app to create and manage external data shares for all Fabric items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage external data shares; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Item.Read.All",
|                                             "DisplayName":  "Make API calls that require read permissions on all Fabric items",
|                                             "Description":  "Allows the app to make API calls that require read permissions on all Fabric items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read permissions on items; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Item.ReadWrite.All",
|                                             "DisplayName":  "Make API calls that require read and write permissions on all Fabric items",
|                                             "Description":  "Allows the app to make API calls that require read and write permissions on all Fabric items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write permissions on items; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Item.Reshare.All",
|                                             "DisplayName":  "Make API calls that require reshare permissions on all Fabric items",
|                                             "Description":  "Allows the app to make API calls that require reshare permissions on all Fabric items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare permissions on items; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ItemMetadata.Read.All",
|                                             "DisplayName":  "Make API calls that can read item metadata for all Fabric items",
|                                             "Description":  "Allows the app to make API calls that can read the item metadata of all Fabric items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to item metadata on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ItemMetadata.ReadWrite.All",
|                                             "DisplayName":  "Make API calls that can read and write item metadata for all Fabric items",
|                                             "Description":  "Allows the app to make API calls that can read and write the item metadata of all Fabric items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to item metadata on behalf of the signed-in user; no direct identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDashboard.Execute.All",
|                                             "DisplayName":  "KQLDashboard.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Execute permission on dashboards on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDashboard.Read.All",
|                                             "DisplayName":  "Read KQL dashboards",
|                                             "Description":  "Allows reading KQL dashboards on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to dashboards on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDashboard.ReadWrite.All",
|                                             "DisplayName":  "Read and write KQL dashboards",
|                                             "Description":  "Allows modifying KQL dashboards on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify dashboards on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDashboard.Reshare.All",
|                                             "DisplayName":  "KQLDashboard.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare permission on dashboards on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDatabase.Execute.All",
|                                             "DisplayName":  "Execute KQL databases",
|                                             "Description":  "Allows executing KQL databases on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute permission on databases on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDatabase.ExternalDataShare.All",
|                                             "DisplayName":  "Allows the app to create and manage external data shares for all KQL databases",
|                                             "Description":  "Allows the app to create and manage external data shares for all KQL databases, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage external data shares on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDatabase.Read.All",
|                                             "DisplayName":  "Read KQL databases",
|                                             "Description":  "Allows reading KQL databases on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to databases on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDatabase.ReadWrite.All",
|                                             "DisplayName":  "Read and write KQL databases",
|                                             "Description":  "Allows modifying KQL databases on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify databases on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDatabase.Reshare.All",
|                                             "DisplayName":  "KQLDatabase.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare permission on databases on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDataConnection.Execute.All",
|                                             "DisplayName":  "KQLDataConnection.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Execute permission on data connections on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDataConnection.Read.All",
|                                             "DisplayName":  "Make API calls that require read permissions on all KQL data connections",
|                                             "Description":  "Allows the app to make API calls that require read permissions on all KQL data connections, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to data connections on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDataConnection.ReadWrite.All",
|                                             "DisplayName":  "Make API calls that require read and write permissions on and write all KQL data connections",
|                                             "Description":  "Allows the app to make API calls that require read and write permissions on all KQL data connections, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify data connections on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDataConnection.Reshare.All",
|                                             "DisplayName":  "KQLDataConnection.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare permission on data connections on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLQueryset.Execute.All",
|                                             "DisplayName":  "KQLQueryset.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Execute permission on querysets on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLQueryset.Read.All",
|                                             "DisplayName":  "Read KQL querysets",
|                                             "Description":  "Allows reading KQL querysets on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to querysets on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLQueryset.ReadWrite.All",
|                                             "DisplayName":  "Read and write KQL querysets",
|                                             "Description":  "Allows modifying KQL querysets on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify querysets on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLQueryset.Reshare.All",
|                                             "DisplayName":  "KQLQueryset.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare permission on querysets on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LabelAnalyticsActivityData.Read.All",
|                                             "DisplayName":  "LabelAnalyticsActivityData.Read.All",
|                                             "Description":  "LabelAnalyticsActivityData.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to label analytics activity data; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Lakehouse.Execute.All",
|                                             "DisplayName":  "Execute lakehouses",
|                                             "Description":  "Allows executing lakehouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute permission on lakehouses on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Lakehouse.ExternalDataShare.All",
|                                             "DisplayName":  "Allows the app to create and manage external data shares for all lakehouses",
|                                             "Description":  "Allows the app to create and manage external data shares for all lakehouses, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage external data shares on lakehouses on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Lakehouse.Read.All",
|                                             "DisplayName":  "Read lakehouses",
|                                             "Description":  "Allows reading lakehouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to lakehouses on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Lakehouse.ReadWrite.All",
|                                             "DisplayName":  "Read and write lakehouses",
|                                             "Description":  "Allows modifying lakehouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify lakehouses on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Lakehouse.Reshare.All",
|                                             "DisplayName":  "Lakehouse.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare permission on lakehouses on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LearningAssignedCourse.Read",
|                                             "DisplayName":  "Read user\u0027s assignments",
|                                             "Description":  "Allows the app to read data for the learner\u0027s assignments in the organization\u0027s directory, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to learner\u0027s assignments on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LearningAssignedCourse.Read.All",
|                                             "DisplayName":  "Read all assignments",
|                                             "Description":  "Allows the app to read data for all assignments in the organization\u0027s directory, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all assignments without a signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LearningAssignedCourse.ReadWrite.All",
|                                             "DisplayName":  "Read and write all assignments",
|                                             "Description":  "Allows the app to create, update, read and delete all assignments in the organization\u0027s directory, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage all assignments without a signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LearningContent.Read.All",
|                                             "DisplayName":  "Read learning content",
|                                             "Description":  "Allows the app to read learning content in the organization\u0027s directory, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to learning content on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LearningContent.ReadWrite.All",
|                                             "DisplayName":  "Manage all learning content",
|                                             "Description":  "Allows the app to manage all learning content in the organization\u0027s directory, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage learning content without a signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LearningProvider.Read",
|                                             "DisplayName":  "Read learning provider",
|                                             "Description":  "Allows the app to read data for the learning provider in the organization\u0027s directory, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to learning provider data on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LearningProvider.ReadWrite",
|                                             "DisplayName":  "Manage learning provider",
|                                             "Description":  "Allows the app to create, update, read, and delete data for the learning provider in the organization\u0027s directory, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage learning provider data on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LearningSelfInitiatedCourse.Read",
|                                             "DisplayName":  "Read user\u0027s self-initiated courses",
|                                             "Description":  "Allows the app to read data for the learner\u0027s self-initiated courses in the organization\u0027s directory, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to learner\u0027s self-initiated courses on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LearningSelfInitiatedCourse.Read.All",
|                                             "DisplayName":  "Read all self-initiated courses",
|                                             "Description":  "Allows the app to read data for all self-initiated courses in the organization\u0027s directory, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all self-initiated courses without a signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LearningSelfInitiatedCourse.ReadWrite.All",
|                                             "DisplayName":  "Read and write all self-initiated courses",
|                                             "Description":  "Allows the app to create, update, read and delete all self-initiated courses in the organization\u0027s directory, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage all self-initiated courses without a signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LicenseAssignment.Read.All",
|                                             "DisplayName":  "Read all license assignments.",
|                                             "Description":  "Allows an app to read license assignments for users and groups, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read license assignments on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LicenseAssignment.ReadWrite.All",
|                                             "DisplayName":  "Manage all license assignments",
|                                             "Description":  "Allows an app to manage license assignments for users and groups, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage license assignments on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LifecycleWorkflows.Read.All",
|                                             "DisplayName":  "Read all lifecycle workflows resources",
|                                             "Description":  "Allows the app to list and read all workflows, tasks and related lifecycle workflows resources on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read lifecycle workflows on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LifecycleWorkflows.ReadWrite.All",
|                                             "DisplayName":  "Read and write all lifecycle workflows resources",
|                                             "Description":  "Allows the app to create, update, list, read and delete all workflows, tasks and related lifecycle workflows resources on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage lifecycle workflows on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LifecycleWorkflows-CustomExt.Read.All",
|                                             "DisplayName":  "Read all Lifecycle workflows custom task extensions",
|                                             "Description":  "Allows the app to read all Lifecycle workflows custom task extensions on behalf of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read lifecycle workflows custom task extensions on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LifecycleWorkflows-CustomExt.ReadWrite.All",
|                                             "DisplayName":  "Read and write all Lifecycle workflows custom task extensions",
|                                             "Description":  "Allows the app to create, update, list, read and delete all Lifecycle workflows custom task extensions on behalf of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage lifecycle workflows custom task extensions on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LifecycleWorkflows-Reports.Read.All",
|                                             "DisplayName":  "Read all Lifecycle workflows reports",
|                                             "Description":  "Allows the app to read all Lifecycle workflows reports without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read lifecycle workflows reports without a signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LifecycleWorkflows-Workflow.Activate",
|                                             "DisplayName":  "Run workflows on-demand in Lifecycle workflows",
|                                             "Description":  "Allows the app to run workflows on-demand on behalf of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Run workflows on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LifecycleWorkflows-Workflow.Read.All",
|                                             "DisplayName":  "Read all workflows in Lifecycle workflows",
|                                             "Description":  "Allows the app to list and read all workflows and tasks on behalf of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read workflows and tasks on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LifecycleWorkflows-Workflow.ReadBasic.All",
|                                             "DisplayName":  "List all workflows in Lifecycle workflows",
|                                             "Description":  "Allows the app to list all workflows without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "List workflows without a signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LifecycleWorkflows-Workflow.ReadWrite.All",
|                                             "DisplayName":  "Read and write all workflows in Lifecycle workflows",
|                                             "Description":  "Allows the app to create, update, list, read and delete all workflows and tasks in lifecycle workflows without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage workflows and tasks without a signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ListItems.SelectedOperations.Selected",
|                                             "DisplayName":  "Access selected ListItems, on behalf of the signed-in user",
|                                             "Description":  "Allow the application to access a subset of listitems on behalf of the signed in user.  The specific listitems and the permissions granted will be configured in SharePoint Online.",
|                                             "Tier":  3,
|                                             "Reason":  "Access to a subset of list items on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Lists.SelectedOperations.Selected",
|                                             "DisplayName":  "Access selected Lists, on behalf of the signed-in user",
|                                             "Description":  "Allow the application to access a subset of lists on behalf of the signed in user.  The specific lists and the permissions granted will be configured in SharePoint Online.",
|                                             "Tier":  3,
|                                             "Reason":  "Access to a subset of lists on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "M365ContentExplorer.Read.All",
|                                             "DisplayName":  "M365ContentExplorer.Read.All",
|                                             "Description":  "M365ContentExplorer.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to M365 content explorer data without a signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.ReadBasic",
|                                             "DisplayName":  "Read user basic mail",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s mailbox except body, previewBody, attachments and any extended properties.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access limited to signed-in user\u0027s mailbox excluding sensitive parts; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.ReadBasic.Shared",
|                                             "DisplayName":  "Read user and shared basic mail",
|                                             "Description":  "Allows the app to read mail the signed-in user can access, including their own and shared mail, except for body, bodyPreview, uniqueBody, attachments, extensions, and any extended properties.",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic mail properties for signed-in user and shared mail; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.Send",
|                                             "DisplayName":  "Send mail as a user",
|                                             "Description":  "Allows the app to send mail as users in the organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Send mail as user only; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.Send.All",
|                                             "DisplayName":  "Send mail on behalf of others",
|                                             "Description":  "Allows the app to send mail as the signed-in user, including sending on-behalf of others.",
|                                             "Tier":  3,
|                                             "Reason":  "Send mail as signed-in user including on-behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.Send.Shared",
|                                             "DisplayName":  "Send mail on behalf of others",
|                                             "Description":  "Allows the app to send mail as the signed-in user, including sending on-behalf of others.",
|                                             "Tier":  3,
|                                             "Reason":  "Send mail as signed-in user on shared mail; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxConfigItem.Read",
|                                             "DisplayName":  "Read all users\u0027 UserConfiguration objects",
|                                             "Description":  "Allows the app to read all users\u0027 UserConfiguration objects.",
|                                             "Tier":  3,
|                                             "Reason":  "Read user configuration objects only; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxConfigItem.ReadWrite",
|                                             "DisplayName":  "Read and write all users\u0027 UserConfiguration objects",
|                                             "Description":  "Allows the app to create, read, update and delete all users\u0027 UserConfiguration objects.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify user configuration objects only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MailboxFolder.Read",
|                                             "DisplayName":  "Read a user\u0027s mailbox folders",
|                                             "Description":  "Allows the app to read the user\u0027s mailbox folders, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read mailbox folders for signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MailboxFolder.ReadWrite",
|                                             "DisplayName":  "Read and write a user\u0027s mailbox folders",
|                                             "Description":  "Allows the app to read and write the user\u0027s mailbox folders, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write mailbox folders for signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MailboxItem.Export",
|                                             "DisplayName":  "Export a user\u0027s mailbox items",
|                                             "Description":  "Allows the app to export the user\u0027s mailbox items, on behalf of the the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Export mailbox items for signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MailboxItem.ImportExport",
|                                             "DisplayName":  "Allows the app to perform backup and restore of mailbox items",
|                                             "Description":  "Allows the app to backup, restore, and modify mailbox items on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Backup/restore mailbox items for signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MailboxItem.Read",
|                                             "DisplayName":  "Read a user\u0027s mailbox items",
|                                             "Description":  "Allows the app to read the user\u0027s mailbox items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read mailbox items for signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxSettings.Read",
|                                             "DisplayName":  "Read all user mailbox settings",
|                                             "Description":  "Allows the app to read user\u0027s mailbox settings without a signed-in user. Does not include permission to send mail.",
|                                             "Tier":  3,
|                                             "Reason":  "Read mailbox settings only; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MailboxSettings.ReadWrite",
|                                             "DisplayName":  "Read and write user mailbox settings",
|                                             "Description":  "Allows the app to create, read, update, and delete user\u0027s mailbox settings. Does not include permission to send mail.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify mailbox settings for signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailTips.ReadBasic.All",
|                                             "DisplayName":  "Read mail tips for all users",
|                                             "Description":  "Allows the app to read mail tips for all users in the organization without a signed-in user. Mail tips include automatic replies, mailbox status, custom tips, and delivery information.",
|                                             "Tier":  3,
|                                             "Reason":  "Read mail tips for all users; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MailTips.ReadBasic.Shared",
|                                             "DisplayName":  "Read mail tips for mailboxes you can access",
|                                             "Description":  "Allows the app to read mail tips on behalf of the signed-in user for mailboxes they have access to. Mail tips include automatic replies, mailbox status, custom tips, and delivery information.",
|                                             "Tier":  3,
|                                             "Reason":  "Read mail tips for accessible mailboxes; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ManagedTenants.Read.All",
|                                             "DisplayName":  "Read all managed tenant information",
|                                             "Description":  "Allows the app to read all managed tenant information on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read managed tenant info on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ManagedTenants.ReadWrite.All",
|                                             "DisplayName":  "Read and write all managed tenant information",
|                                             "Description":  "Allows the app to read and write all managed tenant information on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write managed tenant info on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Dataverse",
|                                             "AppId":  "00000007-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "mcp.tools",
|                                             "DisplayName":  "Access Dataverse MCP tools as organization users",
|                                             "Description":  "Allows the application to access Dataverse MCP tools as organization users",
|                                             "Tier":  3,
|                                             "Reason":  "Access Dataverse MCP tools as org users; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Skype for Business Online",
|                                             "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Meetings.JoinManage",
|                                             "DisplayName":  "Join and Manage Skype Meetings (preview)",
|                                             "Description":  "Allows the app to join and manage Skype meetings",
|                                             "Tier":  3,
|                                             "Reason":  "Join and manage Skype meetings; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Skype for Business Online",
|                                             "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Meetings.ScheduleOnDemand",
|                                             "DisplayName":  "Create on-demand Skype meetings (preview)",
|                                             "Description":  "Allows the app to create on-demand Skype meetings (short term expiry)",
|                                             "Tier":  3,
|                                             "Reason":  "Create on-demand Skype meetings; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Member.Read.Hidden",
|                                             "DisplayName":  "Read all hidden memberships",
|                                             "Description":  "Allows the app to read the memberships of hidden groups and administrative units without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read memberships of hidden groups and admin units; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "messageeventsummary.tenant.read",
|                                             "DisplayName":  "messageeventsummary.tenant.read",
|                                             "Description":  "This scope allows Apps to read tenant\u0027s MessageEventSummary data",
|                                             "Tier":  3,
|                                             "Reason":  "Read tenant message event summary data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MessageTrace.Read.All",
|                                             "DisplayName":  "MessageTrace.Read.All",
|                                             "Description":  "MessageTrace.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read message trace data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MessageTraceDetail.tenant.read",
|                                             "DisplayName":  "MessageTraceDetail.tenant.read",
|                                             "Description":  "MessageTraceDetail.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read detailed message trace data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MetricSet.Execute.All",
|                                             "DisplayName":  "MetricSet.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Execute metric sets on userâs behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MetricSet.Read.All",
|                                             "DisplayName":  "Read metric sets",
|                                             "Description":  "Allows reading metric sets on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read metric sets on userâs behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MetricSet.ReadWrite.All",
|                                             "DisplayName":  "Read and write metric sets",
|                                             "Description":  "Allows modifying metric sets on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify metric sets on userâs behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MetricSet.Reshare.All",
|                                             "DisplayName":  "MetricSet.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare metric sets on userâs behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Intune",
|                                             "AppId":  "0000000a-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MicrosoftTunnelGatewayEnrollment",
|                                             "DisplayName":  "MicrosoftTunnelGatewayEnrollment",
|                                             "Description":  "Allows Intune Admins to enroll a Microsoft Tunnel Gateway Agent",
|                                             "Tier":  3,
|                                             "Reason":  "Enroll Microsoft Tunnel Gateway Agent; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Migration.Read.All",
|                                             "DisplayName":  "Read access to migration data on the SharePoint admin site",
|                                             "Description":  "Allows the app to read migration data via the SharePoint admin site without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read migration data via SharePoint admin site; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Migration.ReadWrite.All",
|                                             "DisplayName":  "Can view and edit migration data from the admin site",
|                                             "Description":  "Allows the app to read and write migration data using the SharePoint admin site, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write migration data via SharePoint admin site; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredAzureDatabricksCatalog.Execute.All",
|                                             "DisplayName":  "Execute mirrored azure databricks catalogs",
|                                             "Description":  "Allows executing mirrored azure databricks catalogs on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute mirrored Azure Databricks catalogs on userâs behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredAzureDatabricksCatalog.Read.All",
|                                             "DisplayName":  "Read mirrored azure databricks catalogs",
|                                             "Description":  "Allows reading mirrored azure databricks catalogs on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read mirrored Azure Databricks catalogs on userâs behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredAzureDatabricksCatalog.ReadWrite.All",
|                                             "DisplayName":  "Read and write mirrored azure databricks catalogs",
|                                             "Description":  "Allows modifying mirrored azure databricks catalogs on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify mirrored Azure Databricks catalogs on userâs behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredAzureDatabricksCatalog.Reshare.All",
|                                             "DisplayName":  "MirroredAzureDatabricksCatalog.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing mirrored Databricks catalogs does not provide identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredDatabase.Execute.All",
|                                             "DisplayName":  "MirroredDatabase.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Executing mirrored databases on behalf of user is data plane access without identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredDatabase.ExternalDataShare.All",
|                                             "DisplayName":  "Allows the app to create and manage external data shares for all mirrored Databases",
|                                             "Description":  "Allows the app to create and manage external data shares for all mirrored Databases, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing external data shares is data manipulation without direct identity or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredDatabase.Read.All",
|                                             "DisplayName":  "Read mirrored databases",
|                                             "Description":  "Allows reading mirrored databases on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to mirrored databases is data exfiltration only, no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredDatabase.ReadWrite.All",
|                                             "DisplayName":  "Read and write mirrored databases",
|                                             "Description":  "Allows modifying mirrored databases on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to mirrored databases affects data but not identity or role assignments."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredDatabase.Reshare.All",
|                                             "DisplayName":  "MirroredDatabase.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing mirrored databases is data sharing without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLExperiment.Execute.All",
|                                             "DisplayName":  "Execute ML experiments",
|                                             "Description":  "Allows executing ML experiments on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Executing ML experiments is workload execution without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLExperiment.Read.All",
|                                             "DisplayName":  "Read ML experiments",
|                                             "Description":  "Allows reading ML experiments on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to ML experiments is data access only, no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLExperiment.ReadWrite.All",
|                                             "DisplayName":  "Read and write ML experiments",
|                                             "Description":  "Allows modifying ML experiments on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify ML experiments is data manipulation without identity or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLExperiment.Reshare.All",
|                                             "DisplayName":  "MLExperiment.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing ML experiments is data sharing without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLModel.Execute.All",
|                                             "DisplayName":  "Execute ML models",
|                                             "Description":  "Allows executing ML models on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Executing ML models is workload execution without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLModel.Read.All",
|                                             "DisplayName":  "Read ML models",
|                                             "Description":  "Allows reading ML models on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to ML models is data access only, no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLModel.ReadWrite.All",
|                                             "DisplayName":  "Read and write ML models",
|                                             "Description":  "Allows modifying ML models on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify ML models is data manipulation without identity or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLModel.Reshare.All",
|                                             "DisplayName":  "Reshare ML models",
|                                             "Description":  "Allows resharing ML models on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing ML models is data sharing without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MountedDataFactory.Execute.All",
|                                             "DisplayName":  "MountedDataFactory.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Executing data factories is workload execution without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MountedDataFactory.Read.All",
|                                             "DisplayName":  "Read Azure Data Factories",
|                                             "Description":  "Allows reading Azure Data Factories on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to data factories is data access only, no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MountedDataFactory.ReadWrite.All",
|                                             "DisplayName":  "Read and write Azure Data Factories",
|                                             "Description":  "Allows modifying Azure Data Factories on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to data factories affects data but not identity or role assignments."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MountedDataFactory.Reshare.All",
|                                             "DisplayName":  "MountedDataFactory.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing data factories is data sharing without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MtpAction.tenant.read",
|                                             "DisplayName":  "MtpAction.tenant.read",
|                                             "Description":  "This allows apps to read the MtpAction",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to MtpAction is data plane only, no identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MtpAction.tenant.write",
|                                             "DisplayName":  "MtpAction.tenant.write",
|                                             "Description":  "This allows apps to write the MtpAction",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to MtpAction is data manipulation without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MtpMailboxRuleAction.tenant.read",
|                                             "DisplayName":  "MtpMailboxRuleAction.tenant.read",
|                                             "Description":  "MtpMailboxRuleAction.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to mailbox rule actions is data plane only, no identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MtpMailboxRuleAction.tenant.write",
|                                             "DisplayName":  "MtpMailboxRuleAction.tenant.write",
|                                             "Description":  "MtpMailboxRuleAction.tenant.write",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to mailbox rule actions is data manipulation without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "mtproleinfo.read",
|                                             "DisplayName":  "mtproleinfo.read",
|                                             "Description":  "This allows user to read MtpRoleInfo",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to MtpRoleInfo is data plane only, no identity or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "mtpstatus.tenant.read",
|                                             "DisplayName":  "mtpstatus.tenant.read",
|                                             "Description":  "Allow o365 applications to read MTP Status",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to MTP status is data plane only, no identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MultiTenantOrganization.Read.All",
|                                             "DisplayName":  "Read multi-tenant organization details and tenants",
|                                             "Description":  "Allows the app to read multi-tenant organization details and tenants on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to multi-tenant organization details is data access only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MultiTenantOrganization.ReadBasic.All",
|                                             "DisplayName":  "Read multi-tenant organization basic details and active tenants",
|                                             "Description":  "Allows the app to read multi-tenant organization basic details and active tenants, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic multi-tenant organization details is data access only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MultiTenantOrganization.ReadWrite.All",
|                                             "DisplayName":  "Read and write multi-tenant organization details and tenants",
|                                             "Description":  "Allows the app to read and write multi-tenant organization details and tenants on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to multi-tenant organization details is data manipulation without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MutualTlsOauthConfiguration.Read.All",
|                                             "DisplayName":  "Read all configurations used for mutual-TLS client authentication.",
|                                             "Description":  "Allows the app to read configuration used for OAuth 2.0 mutual-TLS client authentication, without a signed-in user. This includes reading trusted certificate authorities.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to mutual-TLS OAuth configuration is data access only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MutualTlsOauthConfiguration.ReadWrite.All",
|                                             "DisplayName":  "Read and write all configurations used for mutual-TLS client authentication.",
|                                             "Description":  "Allows the app to read and update configuration used for OAuth 2.0 mutual-TLS client authentication, on behalf of the signed-in user. This includes adding and updating trusted certificate authorities.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to mutual-TLS OAuth configuration is data manipulation without direct identity or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MyFiles.Read",
|                                             "DisplayName":  "Read user files",
|                                             "Description":  "Allows the app to read the current user\u0027s files.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user\u0027s files is data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MyFiles.Write",
|                                             "DisplayName":  "Read and write user files",
|                                             "Description":  "Allows the app to read, create, update, and delete the current user\u0027s files.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to user\u0027s files is data manipulation without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "NetworkAccess.Read.All",
|                                             "DisplayName":  "Read all network access information",
|                                             "Description":  "Allows the app to read all network access information and configuration settings without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to network access info is data plane only, no identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "NetworkAccess.ReadWrite.All",
|                                             "DisplayName":  "Read and write all network access information",
|                                             "Description":  "Allows the app to read and write all network access information and configuration settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to network access info is data manipulation without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "NetworkAccessBranch.Read.All",
|                                             "DisplayName":  "Read properties of branches for network access",
|                                             "Description":  "Allows the app to read your organization\u0027s branches for network access on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to network access branches is data plane only, no identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "NetworkAccessBranch.ReadWrite.All",
|                                             "DisplayName":  "Read and write properties of all branches for network access",
|                                             "Description":  "Allows the app to read and write your organization\u0027s network access branches, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to network access branches is data manipulation without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "NetworkAccessPolicy.Read.All",
|                                             "DisplayName":  "Read all security and routing policies for network access",
|                                             "Description":  "Allows the app to read your organization\u0027s network access policies, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to network access policies is data plane only, no identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "NetworkAccessPolicy.ReadWrite.All",
|                                             "DisplayName":  "Read and write all security and routing policies for network access",
|                                             "Description":  "Allows the app to read and write your organization\u0027s network access policies, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to network access policies is data manipulation without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "NetworkAccess-Reports.Read.All",
|                                             "DisplayName":  "Read all network access reports",
|                                             "Description":  "Allows the app to read all network access reports on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to network access reports is data plane only, no identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notebook.Execute.All",
|                                             "DisplayName":  "Execute notebooks",
|                                             "Description":  "Allows executing notebooks on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute access to notebooks is workload execution without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notebook.Read.All",
|                                             "DisplayName":  "Read notebooks",
|                                             "Description":  "Allows reading notebooks on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to notebooks is data access only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notebook.ReadWrite.All",
|                                             "DisplayName":  "Read and write notebooks",
|                                             "Description":  "Allows modifying notebooks on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to notebooks is data manipulation without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notebook.Reshare.All",
|                                             "DisplayName":  "Notebook.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing notebooks is data sharing without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notes.Create",
|                                             "DisplayName":  "Create user OneNote notebooks",
|                                             "Description":  "Allows the app to read the titles of OneNote notebooks and sections and to create new pages, notebooks, and sections on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Create access to notes is data creation without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notes.Read",
|                                             "DisplayName":  "Read user notes",
|                                             "Description":  "Allows the app to read user notes",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user notes is data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Notes.Read.All",
|                                             "DisplayName":  "Read all OneNote notebooks",
|                                             "Description":  "Allows the app to read all the OneNote notebooks in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all OneNote notebooks is data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notes.ReadWrite",
|                                             "DisplayName":  "Read and write user OneNote notebooks",
|                                             "Description":  "Allows the app to read, share, and modify OneNote notebooks on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to OneNote notebooks is data manipulation without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Notes.ReadWrite.All",
|                                             "DisplayName":  "Read and write all OneNote notebooks",
|                                             "Description":  "Allows the app to read all the OneNote notebooks in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to all OneNote notebooks is data manipulation without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notes.ReadWrite.CreatedByApp",
|                                             "DisplayName":  "Limited notebook access (deprecated)",
|                                             "Description":  "This is deprecated!  Do not use! This permission no longer has any effect. You can safely consent to it. No additional privileges will be granted to the app.",
|                                             "Tier":  3,
|                                             "Reason":  "Deprecated permission with no effect; no identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notifications.ReadWrite.CreatedByApp",
|                                             "DisplayName":  "Deliver and manage user notifications for this app",
|                                             "Description":  "Allows the app to deliver its notifications on behalf of signed-in users. Also allows the app to read, update, and delete the user\u0027s notification items for this app.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage app notifications only; no path to identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OcrBillingConfiguration-Internal.Write.All",
|                                             "DisplayName":  "OcrBillingConfiguration-Internal.Write.All",
|                                             "Description":  "OcrBillingConfiguration-Internal.Write.All",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to billing configuration is data manipulation without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "offline_access",
|                                             "DisplayName":  "Maintain access to data you have given it access to",
|                                             "Description":  "Allows the app to see and update the data you gave it access to, even when users are not currently using the app. This does not give the app any additional permissions.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows app to maintain access tokens but does not grant additional permissions or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OneCyberRelocationData.tenant.read",
|                                             "DisplayName":  "OneCyberRelocationData.tenant.read",
|                                             "Description":  "This allows apps to read the OneCyberRelocationData",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to specific tenant data without identity plane control or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OneCyberRelocationData.tenant.write",
|                                             "DisplayName":  "OneCyberRelocationData.tenant.write",
|                                             "Description":  "This allows apps to write the OneCyberRelocationData",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to specific tenant data without ability to escalate privileges or control identity plane."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OneLake.Read.All",
|                                             "DisplayName":  "Make API calls that read OneLake metadata",
|                                             "Description":  "Allows the app to make API calls that read OneLake metadata on your behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to OneLake metadata on behalf of user; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OneLake.ReadWrite.All",
|                                             "DisplayName":  "Make API calls that read and write OneLake metadata",
|                                             "Description":  "Allows the app to make API calls that read and write OneLake metadata, on your behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to OneLake metadata on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OnlineMeetingAiInsight.Read.All",
|                                             "DisplayName":  "Read all AI Insights for online meetings.",
|                                             "Description":  "Allows the app to read all AI Insights for online meetings, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to AI insights for meetings on behalf of user; no identity plane or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OnlineMeetingAiInsight.Read.Chat",
|                                             "DisplayName":  "Read all AI Insights for online meetings where the Teams application is installed.",
|                                             "Description":  "Allows the teams-app to read all aiInsights for online meetings where the Teams-app is installed, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to AI insights for meetings where app is installed; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OnlineMeetingArtifact.Read.All",
|                                             "DisplayName":  "Read user\u0027s online meeting artifacts",
|                                             "Description":  "Allows the app to read online meeting artifacts on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to online meeting artifacts on behalf of user; no path to tenant compromise."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OnlineMeetingRecording.Read.All",
|                                             "DisplayName":  "Read all recordings of online meetings.",
|                                             "Description":  "Allows the app to read all recordings of all online meetings, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to meeting recordings without user context; no identity plane or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OnlineMeetings.Read",
|                                             "DisplayName":  "Read user\u0027s online meetings",
|                                             "Description":  "Allows the app to read online meeting details on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to online meeting details on behalf of user; no privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OnlineMeetings.Read.All",
|                                             "DisplayName":  "Read online meeting details",
|                                             "Description":  "Allows the app to read online meeting details in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to online meetings organization-wide without user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OnlineMeetings.ReadWrite",
|                                             "DisplayName":  "Read and create user\u0027s online meetings",
|                                             "Description":  "Allows the app to read and create online meetings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and create meetings on behalf of user; no direct or near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OnlineMeetings.ReadWrite.All",
|                                             "DisplayName":  "Read and create online meetings",
|                                             "Description":  "Allows the app to read and create online meetings as an application in your organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and create meetings organization-wide; no direct path to role assignment or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OnlineMeetingTranscript.Read.All",
|                                             "DisplayName":  "Read all transcripts of online meetings.",
|                                             "Description":  "Allows the app to read all transcripts of online meetings, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read transcripts on behalf of user; no identity plane or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "openid",
|                                             "DisplayName":  "Sign users in",
|                                             "Description":  "Allows users to sign in to the app with their work or school accounts and allows the app to see basic user profile information.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows sign-in and basic profile read; no privilege escalation or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OPX.MyDay",
|                                             "DisplayName":  "OPX.MyDay",
|                                             "Description":  "This allows the application to host MyDay Owa powered experience",
|                                             "Tier":  3,
|                                             "Reason":  "Allows hosting of MyDay experience; no identity plane or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OPX.MyDay.All",
|                                             "DisplayName":  "OPX.MyDay.All",
|                                             "Description":  "This allows application to host MyDay Owa powered experience for both user and shared mailbox and calendar",
|                                             "Tier":  3,
|                                             "Reason":  "Allows hosting MyDay for user and shared mailboxes; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OPX.MyDay.Shared",
|                                             "DisplayName":  "OPX.MyDay.Shared",
|                                             "Description":  "This allows application to host MyDay Owa powered experience for shared mailbox and calendar",
|                                             "Tier":  3,
|                                             "Reason":  "Allows hosting MyDay for shared mailboxes; no privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Organization.Read.All",
|                                             "DisplayName":  "Read organization information",
|                                             "Description":  "Allows the app to read the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed skus and tenant branding information.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to organization info on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OrganizationalBranding.Read.All",
|                                             "DisplayName":  "Read organizational branding information",
|                                             "Description":  "Allows the app to read the organizational branding information, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to branding info; no identity plane or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrganizationalBranding.ReadWrite.All",
|                                             "DisplayName":  "Read and write organizational branding information",
|                                             "Description":  "Allows the app to read and write the organizational branding information, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write branding info on behalf of user; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgApp.Read.All",
|                                             "DisplayName":  "Read org apps",
|                                             "Description":  "Allows reading org apps on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to org apps on behalf of user; no privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgApp.ReadWrite.All",
|                                             "DisplayName":  "Read and write org apps",
|                                             "Description":  "Allows modifying org apps on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify org apps on behalf of user; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgApp.Reshare.All",
|                                             "DisplayName":  "OrgApp.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but likely related to reshare; no identity plane control indicated."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OrgContact.Read.All",
|                                             "DisplayName":  "Read organizational contacts",
|                                             "Description":  "Allows the app to read all organizational contacts without a signed-in user.  These contacts are managed by the organization and are different from a user\u0027s personal contacts.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to organizational contacts without user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgSettings-AppsAndServices.Read.All",
|                                             "DisplayName":  "Read organization-wide apps and services settings",
|                                             "Description":  "Allows the app to read organization-wide apps and services settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to org-wide apps and services settings on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgSettings-DynamicsVoice.Read.All",
|                                             "DisplayName":  "Read organization-wide Dynamics customer voice settings",
|                                             "Description":  "Allows the app to read organization-wide Dynamics customer voice settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Dynamics customer voice settings on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgSettings-DynamicsVoice.ReadWrite.All",
|                                             "DisplayName":  "Read and write organization-wide Dynamics customer voice settings",
|                                             "Description":  "Allows the app to read and write organization-wide Dynamics customer voice settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write Dynamics customer voice settings on behalf of user; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OrgSettings-Forms.Read.All",
|                                             "DisplayName":  "Read organization-wide Microsoft Forms settings",
|                                             "Description":  "Allows the app to read organization-wide Microsoft Forms settings, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Microsoft Forms settings without user; no privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OrgSettings-Forms.ReadWrite.All",
|                                             "DisplayName":  "Read and write organization-wide Microsoft Forms settings",
|                                             "Description":  "Allows the app to read and write organization-wide Microsoft Forms settings, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write Forms settings without user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OrgSettings-Microsoft365Install.Read.All",
|                                             "DisplayName":  "Read organization-wide Microsoft 365 apps installation settings",
|                                             "Description":  "Allows the app to read organization-wide Microsoft 365 apps installation settings, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Microsoft 365 install settings without user; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OrgSettings-Microsoft365Install.ReadWrite.All",
|                                             "DisplayName":  "Read and write organization-wide Microsoft 365 apps installation settings",
|                                             "Description":  "Allows the app to read and write organization-wide Microsoft 365 apps installation settings, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write Microsoft 365 install settings without user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgSettings-Todo.Read.All",
|                                             "DisplayName":  "Read organization-wide Microsoft To Do settings",
|                                             "Description":  "Allows the app to read organization-wide Microsoft To Do settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Microsoft To Do settings on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgSettings-Todo.ReadWrite.All",
|                                             "DisplayName":  "Read and write organization-wide Microsoft To Do settings",
|                                             "Description":  "Allows the app to read and write organization-wide Microsoft To Do settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write To Do settings on behalf of user; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PaginatedReport.Execute.All",
|                                             "DisplayName":  "PaginatedReport.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but likely execution of reports on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PaginatedReport.Read.All",
|                                             "DisplayName":  "Read paginated reports",
|                                             "Description":  "Allows reading paginated reports on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to paginated reports on behalf of user; no privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PaginatedReport.ReadWrite.All",
|                                             "DisplayName":  "Read and write paginated reports",
|                                             "Description":  "Allows modifying paginated reports on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify paginated reports on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PaginatedReport.Reshare.All",
|                                             "DisplayName":  "PaginatedReport.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but likely reshare of reports; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PartnerBilling.Read.All",
|                                             "DisplayName":  "Read all billing data for your company\u0027s tenant",
|                                             "Description":  "Allows the app to read all of billing data from Microsoft for your company\u0027s tenant, without a signed-in user. This includes reading billed and unbilled azure usage and invoice reconciliation data.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to billing data without user; data exfiltration risk but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PartnerSecurity.Read.All",
|                                             "DisplayName":  "Read security alerts of customer with CSP relationship",
|                                             "Description":  "Allows the app to read security alerts of customer with CSP relationship on behalf of the partner signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read security alerts on behalf of partner user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PartnerSecurity.ReadWrite.All",
|                                             "DisplayName":  "Read security alerts and update status of security alerts of customer with CSP relationship",
|                                             "Description":  "Allows the app to read security alerts and update status of alerts of customer with CSP relationship, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update security alerts without user; no identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PendingExternalUserProfile.Read.All",
|                                             "DisplayName":  "Read pending external user profiles",
|                                             "Description":  "Allows the app to read available properties of pending external user profiles, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to pending external user profiles on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PendingExternalUserProfile.ReadWrite.All",
|                                             "DisplayName":  "Read and write all pending external user profiles",
|                                             "Description":  "Allows the app to read and write available properties of pending external user profiles, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write pending external user profiles without user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "People.Read",
|                                             "DisplayName":  "Read users\u0027 relevant people lists (preview)",
|                                             "Description":  "Allows the app to read a ranked list of relevant people of the signed-in user. The list includes local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype).",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to relevant people on behalf of user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "People.Read.All",
|                                             "DisplayName":  "Read all users\u0027 relevant people lists",
|                                             "Description":  "Allows the app to read a scored list of relevant people of the signed-in user or other users in the signed-in user\u0027s organization. The list can include local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype).",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to relevant people organization-wide on behalf of user; no privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "People.ReadWrite",
|                                             "DisplayName":  "Read and write users\u0027 relevant people lists (preview)",
|                                             "Description":  "Allows the app to create, read and write to the ranked list of relevant people of the signed-in user. The list includes local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype).",
|                                             "Tier":  3,
|                                             "Reason":  "Allows write access to the signed-in user\u0027s people list only; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PeopleSettings.Read.All",
|                                             "DisplayName":  "Read all tenant-wide people settings",
|                                             "Description":  "Allows the application to read tenant-wide people settings without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to tenant-wide people settings; no ability to modify identity or role assignments."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PeopleSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and write all tenant-wide people settings",
|                                             "Description":  "Allows the application to read and write tenant-wide people settings without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to tenant-wide people settings without identity plane control or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Pipeline.Deploy",
|                                             "DisplayName":  "Deploy in all pipelines",
|                                             "Description":  "The app can deploy content in all pipelines and pipeline stages in deployment pipelines, which the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to deploy content in pipelines scoped to user access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Pipeline.Read.All",
|                                             "DisplayName":  "View all pipelines",
|                                             "Description":  "The app can view all deployment pipelines that the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to deployment pipelines scoped to user access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Pipeline.ReadWrite.All",
|                                             "DisplayName":  "Read and write all pipelines",
|                                             "Description":  "The app can view and edit all deployment pipelines that the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to deployment pipelines scoped to user access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Place.Read.All",
|                                             "DisplayName":  "Read all company places",
|                                             "Description":  "Allows the app to read company places (conference rooms and room lists) for calendar events and other applications, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to company places without identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Place.ReadWrite.All",
|                                             "DisplayName":  "Read and write organization places",
|                                             "Description":  "Allows the app to manage organization places (conference rooms and room lists) for calendar events and other applications, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to organization places on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PlaceDevice.Read.All",
|                                             "DisplayName":  "Read all workplace devices",
|                                             "Description":  "Allows the app to read all workplace devices, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to workplace devices without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PlaceDevice.ReadWrite.All",
|                                             "DisplayName":  "Read and write all workplace devices",
|                                             "Description":  "Allows the app to read and write all workplace devices, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to workplace devices on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PlaceDeviceTelemetry.ReadWrite.All",
|                                             "DisplayName":  "Read and write telemetry for all workplace devices.",
|                                             "Description":  "Allows the app to read and write telemetry for all workplace devices, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write telemetry for workplace devices without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.Read.All",
|                                             "DisplayName":  "Read your organization\u0027s policies",
|                                             "Description":  "Allows the app to read your organization\u0027s policies on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to organization policies on behalf of signed-in user; no write or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.Read.AuthenticationMethod",
|                                             "DisplayName":  "Read authentication method policies",
|                                             "Description":  "Allows the app to read the authentication method policies, on behalf of the signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to authentication method policies; no write or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.Read.B2BManagementPolicy",
|                                             "DisplayName":  "Read your organization\u0027s B2BManagement policies",
|                                             "Description":  "Allows the app to read your organization\u0027s B2BManagement policies on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to B2B management policies; no write or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.Read.ConditionalAccess",
|                                             "DisplayName":  "Read your organization\u0027s conditional access policies",
|                                             "Description":  "Allows the app to read your organization\u0027s conditional access policies on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to conditional access policies; no write or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.Read.DeviceConfiguration",
|                                             "DisplayName":  "Read your organization\u0027s device configuration policies",
|                                             "Description":  "Allows the application to read your organization\u0027s device configuration policies without a signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to device configuration policies without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.Read.IdentityProtection",
|                                             "DisplayName":  "Read your organization’s identity protection policy",
|                                             "Description":  "Allows the app to read your organization’s identity protection policy on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to identity protection policies; no write or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.Read.PermissionGrant",
|                                             "DisplayName":  "Read consent and permission grant policies",
|                                             "Description":  "Allows the app to read policies related to consent and permission grants for applications, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to consent and permission grant policies; no write or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.ReadWrite.FeatureRollout",
|                                             "DisplayName":  "Read and write feature rollout policies",
|                                             "Description":  "Allows the app to read and write feature rollout policies without a signed-in user. Includes abilities to assign and remove users and groups to rollout of a specific feature.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to feature rollout policies does not provide identity plane control or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.MobilityManagement",
|                                             "DisplayName":  "Read and write your organization\u0027s mobility management policies",
|                                             "Description":  "Allows the app to read and write your organization\u0027s mobility management policies on behalf of the signed-in user.  For example, a mobility management policy can set the enrollment scope for a given mobility management application.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to mobility management policies affects device enrollment but does not enable identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PolicyStatusSummary-Internal.Write.All",
|                                             "DisplayName":  "PolicyStatusSummary-Internal.Write.All",
|                                             "Description":  "PolicyStatusSummary-Internal.Write.All",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to internal policy status summaries does not provide identity plane control or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "POP.AccessAsApp",
|                                             "DisplayName":  "POP.AccessAsApp",
|                                             "Description":  "Allow application to access user’s mailbox via POP protocol",
|                                             "Tier":  3,
|                                             "Reason":  "Access to mailboxes via POP protocol enables data exfiltration but no identity plane control or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "POP.AccessAsUser.All",
|                                             "DisplayName":  "Read and write access to mailboxes via POP.",
|                                             "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via POP protocol.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated POP access to mailboxes enables data exfiltration but no identity plane control or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Presence.Read",
|                                             "DisplayName":  "Read user\u0027s presence information",
|                                             "Description":  "Allows the app to read presence information on behalf of the signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to presence information on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Presence.Read.All",
|                                             "DisplayName":  "Read presence information for all users",
|                                             "Description":  "Allows the app to read presence information of all users in the directory without a signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to presence information of all users; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Presence.ReadWrite",
|                                             "DisplayName":  "Read and write a user\u0027s presence information",
|                                             "Description":  "Allows the app to read the presence information and write activity and availability on behalf of the signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to presence information on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Presence.ReadWrite.All",
|                                             "DisplayName":  "Read and write presence information for all users",
|                                             "Description":  "Allows the app to read all presence information and write activity and availability of all users in the directory without a signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, time zone and location.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to presence information of all users; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrincipalDetails.ReadBasic.All",
|                                             "DisplayName":  "Read Entra ID identities basic properties",
|                                             "Description":  "Allows the app to read basic properties of Entra ID identities in your organization that are known to Microsoft Fabric, on behalf of the signed-in user. This includes display names and email addresses of users, service principals and security groups.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to basic properties of identities; no write or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintConnector.Read.All",
|                                             "DisplayName":  "Read print connectors",
|                                             "Description":  "Allows the application to read print connectors on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to print connectors; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintConnector.ReadWrite.All",
|                                             "DisplayName":  "Read and write print connectors",
|                                             "Description":  "Allows the application to read and write print connectors on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to print connectors; no identity plane control or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Printer.Create",
|                                             "DisplayName":  "Register printers  ",
|                                             "Description":  "Allows the application to create (register) printers on behalf of the signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to create printers on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Printer.FullControl.All",
|                                             "DisplayName":  "Register, read, update, and unregister printers",
|                                             "Description":  "Allows the application to create (register), read, update, and delete (unregister) printers on behalf of the signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Full control over printers on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Printer.Read.All",
|                                             "DisplayName":  "Read printers",
|                                             "Description":  "Allows the application to read printers without a signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to printers without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Printer.ReadWrite.All",
|                                             "DisplayName":  "Read and update printers",
|                                             "Description":  "Allows the application to read and update printers without a signed-in user. Does not allow creating (registering) or deleting (unregistering) printers.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows read and update of printers only; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrinterShare.Read.All",
|                                             "DisplayName":  "Read printer shares",
|                                             "Description":  "Allows the application to read printer shares on behalf of the signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to printer shares on behalf of user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrinterShare.ReadBasic.All",
|                                             "DisplayName":  "Read basic information about printer shares",
|                                             "Description":  "Allows the application to read basic information about printer shares on behalf of the signed-in user. Does not allow reading access control information.",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic printer share info only; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrinterShare.ReadWrite.All",
|                                             "DisplayName":  "Read and write printer shares",
|                                             "Description":  "Allows the application to read and update printer shares on behalf of the signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update printer shares on behalf of user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintJob.Create",
|                                             "DisplayName":  "Create print jobs",
|                                             "Description":  "Allows the application to create print jobs on behalf of the signed-in user and upload document content to print jobs that the signed-in user created.",
|                                             "Tier":  3,
|                                             "Reason":  "Create print jobs on behalf of user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrintJob.Manage.All",
|                                             "DisplayName":  "Perform advanced operations on print jobs",
|                                             "Description":  "Allows the application to perform advanced operations like redirecting a print job to another printer without a signed-in user. Also allows the application to read and update the metadata of print jobs.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage print jobs without user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintJob.Read",
|                                             "DisplayName":  "Read user\u0027s print jobs",
|                                             "Description":  "Allows the application to read the metadata and document content of print jobs that the signed-in user created.",
|                                             "Tier":  3,
|                                             "Reason":  "Read print jobs created by user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrintJob.Read.All",
|                                             "DisplayName":  "Read print jobs",
|                                             "Description":  "Allows the application to read the metadata and document content of print jobs without a signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read print jobs without user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintJob.ReadBasic",
|                                             "DisplayName":  "Read basic information of user\u0027s print jobs",
|                                             "Description":  "Allows the application to read the metadata of print jobs that the signed-in user created. Does not allow access to print job document content.",
|                                             "Tier":  3,
|                                             "Reason":  "Read metadata of print jobs created by user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrintJob.ReadBasic.All",
|                                             "DisplayName":  "Read basic information for print jobs",
|                                             "Description":  "Allows the application to read the metadata of print jobs without a signed-in user. Does not allow access to print job document content.",
|                                             "Tier":  3,
|                                             "Reason":  "Read metadata of print jobs without user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintJob.ReadWrite",
|                                             "DisplayName":  "Read and write user\u0027s print jobs",
|                                             "Description":  "Allows the application to read and update the metadata and document content of print jobs that the signed-in user created.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update print jobs created by user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrintJob.ReadWrite.All",
|                                             "DisplayName":  "Read and write print jobs",
|                                             "Description":  "Allows the application to read and update the metadata and document content of print jobs without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update print jobs without user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintJob.ReadWriteBasic",
|                                             "DisplayName":  "Read and write basic information of user\u0027s print jobs",
|                                             "Description":  "Allows the application to read and update the metadata of print jobs that the signed-in user created. Does not allow access to print job document content.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update metadata of print jobs created by user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintJob.ReadWriteBasic.All",
|                                             "DisplayName":  "Read and write basic information of print jobs",
|                                             "Description":  "Allows the application to read and update the metadata of print jobs on behalf of the signed-in user. Does not allow access to print job document content.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update metadata of print jobs without user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintSettings.Read.All",
|                                             "DisplayName":  "Read tenant-wide print settings",
|                                             "Description":  "Allows the application to read tenant-wide print settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read tenant-wide print settings on behalf of user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and write tenant-wide print settings",
|                                             "Description":  "Allows the application to read and write tenant-wide print settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write tenant-wide print settings on behalf of user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrintTaskDefinition.ReadWrite.All",
|                                             "DisplayName":  "Read, write and update print task definitions",
|                                             "Description":  "Allows the application to read and update print task definitions without a signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update print task definitions without user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAccess.Read.AzureAD",
|                                             "DisplayName":  "Read privileged access to Azure AD",
|                                             "Description":  "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read time-based assignment and elevation info on behalf of user; no direct role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAccess.Read.AzureADGroup",
|                                             "DisplayName":  "Read privileged access to Azure AD groups",
|                                             "Description":  "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read time-based assignment and elevation of Azure AD groups on behalf of user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedAccess.Read.AzureResources",
|                                             "DisplayName":  "Read privileged access to Azure resources",
|                                             "Description":  "Allows the app to read time-based assignment and just-in-time elevation of user privileges to audit Azure resources in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read time-based elevation of Azure resources without user; no identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAccess-CustomExt.Read.All",
|                                             "DisplayName":  "Read Privileged Access (PIM) custom extensions",
|                                             "Description":  "Allows the app to read Privileged Access (PIM) custom extensions for your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read privileged access custom extensions without user; no direct role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAccess-CustomExt.ReadWrite.All",
|                                             "DisplayName":  "Read and write Privileged Access (PIM) custom extensions",
|                                             "Description":  "Allows the app to read and write Privileged Access (PIM) custom extensions for your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write privileged access custom extensions without user; no direct role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAssignmentSchedule.Read.AzureADGroup",
|                                             "DisplayName":  "Read assignment schedules for access to Azure AD groups",
|                                             "Description":  "Allows the app to read time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read time-based assignment schedules for Azure AD groups on behalf of user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAssignmentSchedule.Read.EntraAppRole",
|                                             "DisplayName":  "Read assignment schedules for app permission grants and app role assignments",
|                                             "Description":  "Allows the app to read time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read time-based assignment schedules for app permissions on behalf of user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAssignmentSchedule.ReadWrite.EntraAppRole",
|                                             "DisplayName":  "Read, create, and delete assignment schedules for app permission grants and app role assignments",
|                                             "Description":  "Allows the app to read, create, and delete time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage time-based assignment schedules for app permissions on behalf of user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAssignmentSchedule.Remove.AzureADGroup",
|                                             "DisplayName":  "Delete assignment schedules for access to Azure AD groups",
|                                             "Description":  "Allows the app to delete time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delete time-based assignment schedules for Azure AD groups on behalf of user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedEligibilitySchedule.Read.AzureADGroup",
|                                             "DisplayName":  "Read eligibility schedules for access to Azure AD groups",
|                                             "Description":  "Allows the app to read time-based eligibility schedules for access to Azure AD groups, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read eligibility schedules for Azure AD groups without user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedEligibilitySchedule.Read.EntraAppRole",
|                                             "DisplayName":  "Read eligibility schedules for app permission grants and app role assignments",
|                                             "Description":  "Allows the app to read time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read eligibility schedules for app permissions without user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedEligibilitySchedule.ReadWrite.EntraAppRole",
|                                             "DisplayName":  "Read, create, and delete eligibility schedules for app permission grants and app role assignments",
|                                             "Description":  "Allows the app to read, create, and delete time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage eligibility schedules for app permissions without user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedEligibilitySchedule.Remove.AzureADGroup",
|                                             "DisplayName":  "Delete eligibility schedules for access to Azure AD groups",
|                                             "Description":  "Allows the app to delete time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delete eligibility schedules for Azure AD groups on behalf of user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "profile",
|                                             "DisplayName":  "View users\u0027 basic profile",
|                                             "Description":  "Allows the app to see your users\u0027 basic profile (e.g., name, picture, user name, email address)",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic user profile info only; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ProfilePhoto.Read.All",
|                                             "DisplayName":  "Read profile photo of a user or group",
|                                             "Description":  "Allows the app to read all profile photos of users and groups, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read all profile photos on behalf of user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ProfilePhoto.ReadWrite.All",
|                                             "DisplayName":  "Read and write profile photo of a user or group",
|                                             "Description":  "Allows the app to read and write all profile photos of users and groups, without a signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write profile photos without user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ProgramControl.Read.All",
|                                             "DisplayName":  "Read all programs",
|                                             "Description":  "Allows the app to read programs and program controls in the organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read programs and controls without user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ProgramControl.ReadWrite.All",
|                                             "DisplayName":  "Manage all programs that user can access",
|                                             "Description":  "Allows the app to read, update, delete and perform actions on programs and program controls that the signed-in user has access to in the organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage programs and controls on behalf of user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Project.Read",
|                                             "DisplayName":  "Read user projects",
|                                             "Description":  "Allows the app to read the current user\u0027s projects.",
|                                             "Tier":  3,
|                                             "Reason":  "Read current user\u0027s projects only; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Project.Write",
|                                             "DisplayName":  "Read and write user projects",
|                                             "Description":  "Allows the app to read, create, update, and delete the current users’ projects.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage current user\u0027s projects only; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ProjectWebApp.FullControl",
|                                             "DisplayName":  "Have full control of all ProjectWebApp site collections",
|                                             "Description":  "Allows the app to have full control of all ProjectWebApp site collections the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Full control of ProjectWebApp site collections for user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ProjectWebAppReporting.Read",
|                                             "DisplayName":  "Read ProjectWebApp OData reporting data",
|                                             "Description":  "Allows the app to read all OData reporting data from all ProjectWebApp site collections for the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read reporting data for ProjectWebApp site collections for user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ProtectionScopes.Compute.All",
|                                             "DisplayName":  "Compute Purview policies at tenant scope",
|                                             "Description":  "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for all users across tenant.",
|                                             "Tier":  3,
|                                             "Reason":  "Identify Purview data protection scopes tenant-wide; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ProtectionScopes.Compute.User",
|                                             "DisplayName":  "Compute Purview policies for an individual user",
|                                             "Description":  "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for an individual user.",
|                                             "Tier":  3,
|                                             "Reason":  "Identify Purview data protection scopes for individual user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ProvisioningLog.Read.All",
|                                             "DisplayName":  "Read provisioning log data",
|                                             "Description":  "Allows the app to read and query your provisioning log activities, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read provisioning log activities on behalf of user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PublicKeyInfrastructure.Read.All",
|                                             "DisplayName":  "Read all certificate based authentication configurations",
|                                             "Description":  "Allows the application to read  certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read certificate-based authentication configuration without user; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Purview.DataAccess.All",
|                                             "DisplayName":  "Purview.DataAccess.All",
|                                             "Description":  "Purview.DataAccess.All",
|                                             "Tier":  3,
|                                             "Reason":  "Access Purview data; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "QnA.Read.All",
|                                             "DisplayName":  "Read all Question and Answers ",
|                                             "Description":  "Allows an app to read all question and answers, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to question and answers data; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "QuarantinedMessage.Read.All",
|                                             "DisplayName":  "QuarantinedMessage.Read.All",
|                                             "Description":  "QuarantinedMessage.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to quarantined messages only; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RbacAccessCheck.read",
|                                             "DisplayName":  "RbacAccessCheck.read",
|                                             "Description":  "This Allows User to read the Rbac Roles",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to RBAC roles; no ability to modify roles or escalate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RbacTenantStatus.Read",
|                                             "DisplayName":  "RbacTenantStatus.Read",
|                                             "Description":  "RbacTenantStatus.Read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to tenant RBAC status; no privilege escalation or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RbacTenantStatus.Write",
|                                             "DisplayName":  "RbacTenantStatus.Write",
|                                             "Description":  "RbacTenantStatus.Write",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to tenant RBAC status without direct role assignment or credential control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RealTimeActivityFeed.Read.All",
|                                             "DisplayName":  "Access real-time enriched data in a meeting as an app",
|                                             "Description":  "Allows the app to get direct access to real-time enriched data in a meeting, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to real-time meeting data; no identity plane or role assignment impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Recipient.tenant.read",
|                                             "DisplayName":  "Recipient.tenant.read",
|                                             "Description":  "Recipient.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to recipient data; no path to identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Recipient.tenant.write",
|                                             "DisplayName":  "Recipient.tenant.write",
|                                             "Description":  "Recipient.tenant.write",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to recipient data without ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RecipientBatch.tenant.write",
|                                             "DisplayName":  "RecipientBatch.tenant.write",
|                                             "Description":  "RecipientBatch.tenant.write",
|                                             "Tier":  3,
|                                             "Reason":  "Batch write access to recipient data; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RecordsManagement.Read.All",
|                                             "DisplayName":  "Read Records Management configuration, labels and policies",
|                                             "Description":  "Allows the application to read any data from Records Management, such as configuration, labels, and policies without the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to records management data; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RecordsManagement.ReadWrite.All",
|                                             "DisplayName":  "Read and write Records Management configuration, labels and policies",
|                                             "Description":  "Allow the application to create, update and delete any data from Records Management, such as configuration, labels, and policies without the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to records management data without ability to assign roles or control identity plane."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "reducedrecipient.read.all",
|                                             "DisplayName":  "reducedrecipient.read.all",
|                                             "Description":  "this allows to read reducedrecipient",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to reduced recipient data only; no identity plane or role assignment impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Reflex.Execute.All",
|                                             "DisplayName":  "Reflex.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to execute Reflex actions on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Reflex.Read.All",
|                                             "DisplayName":  "Read Reflexes",
|                                             "Description":  "Allows reading Reflexes on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Reflex data on user\u0027s behalf; no privilege escalation or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Reflex.ReadWrite.All",
|                                             "DisplayName":  "Read and write Reflexes",
|                                             "Description":  "Allows modifying Reflexes on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify Reflex data on user\u0027s behalf; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Reflex.Reshare.All",
|                                             "DisplayName":  "Reflex.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare Reflex data on user\u0027s behalf; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Relocation.ReadWrite.All",
|                                             "DisplayName":  "Relocation.ReadWrite.All",
|                                             "Description":  "Relocation.ReadWrite.All",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to relocation data; no direct identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RemediationEmailResult.Read.All",
|                                             "DisplayName":  "RemediationEmailResult.Read.All",
|                                             "Description":  "RemediationEmailResult.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to remediation email results; no identity plane or role assignment impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RemediationEmailResult.ReadWrite.All",
|                                             "DisplayName":  "RemediationEmailResult.ReadWrite.All",
|                                             "Description":  "RemediationEmailResult.ReadWrite.All",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to remediation email results; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Report.Execute.All",
|                                             "DisplayName":  "Report.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to execute reports on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Report.Read.All",
|                                             "DisplayName":  "Read reports",
|                                             "Description":  "Allows reading reports on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to reports on user\u0027s behalf; no privilege escalation or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Report.ReadWrite.All",
|                                             "DisplayName":  "Read and write reports",
|                                             "Description":  "Allows modifying reports on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify reports on user\u0027s behalf; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Report.Reshare.All",
|                                             "DisplayName":  "Report.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare reports on user\u0027s behalf; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ReportingWebService.Read",
|                                             "DisplayName":  "ReportingWebService.Read",
|                                             "Description":  "Download reports via the Office 365 reporting web service",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Office 365 reports; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ReportingWebService.Read.All",
|                                             "DisplayName":  "ReportingWebService.Read.All",
|                                             "Description":  "Download all reports via the Office 365 reporting web service",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to all reports; no direct identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Reports.Read.All",
|                                             "DisplayName":  "Read all usage reports",
|                                             "Description":  "Allows an app to read all service usage reports without a signed-in user.  Services that provide usage reports include Office 365 and Azure Active Directory.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to service usage reports; no path to identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ReportSettings.Read.All",
|                                             "DisplayName":  "Read admin report settings",
|                                             "Description":  "Allows the app to read admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to admin report settings on user\u0027s behalf; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ReportSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and write admin report settings",
|                                             "Description":  "Allows the app to read and update admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify admin report settings on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ResourceSpecificPermissionGrant.ReadForChat",
|                                             "DisplayName":  "Read resource specific permissions granted on a chat",
|                                             "Description":  "Allows the app to read the resource specific permissions granted on the chat, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read resource-specific permissions for chat on user\u0027s behalf; no role assignment or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ResourceSpecificPermissionGrant.ReadForChat.All",
|                                             "DisplayName":  "Read resource specific permissions granted on a chat",
|                                             "Description":  "Allows the app to read the resource specific permissions granted on the chat without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to chat permissions; no direct identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ResourceSpecificPermissionGrant.ReadForTeam",
|                                             "DisplayName":  "Read resource specific permissions granted on a team",
|                                             "Description":  "Allows the app to read the resource specific permissions granted on the team, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read resource-specific permissions for team on user\u0027s behalf; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ResourceSpecificPermissionGrant.ReadForTeam.All",
|                                             "DisplayName":  "Read resource specific permissions granted on a team",
|                                             "Description":  "Allows the app to read the resource specific permissions granted on the team without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to team permissions; no direct identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ResourceSpecificPermissionGrant.ReadForUser",
|                                             "DisplayName":  "Read resource specific permissions granted on a user account",
|                                             "Description":  "Allows the app to read the resource specific permissions granted on a user account, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read resource-specific permissions for user on user\u0027s behalf; no role assignment or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ResourceSpecificPermissionGrant.ReadForUser.All",
|                                             "DisplayName":  "Read all resource specific permissions granted on user accounts",
|                                             "Description":  "Allows the app to read all resource specific permissions granted on user accounts, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to user permissions; no direct identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RetailDataManager.Execute.All",
|                                             "DisplayName":  "RetailDataManager.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated execute permission on retail data manager; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RetailDataManager.Read.All",
|                                             "DisplayName":  "Read retail data manager items",
|                                             "Description":  "Allows reading retail data manager items on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to retail data manager items on user\u0027s behalf; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RetailDataManager.ReadWrite.All",
|                                             "DisplayName":  "Read and write retail data manager items",
|                                             "Description":  "Allows modifying retail data manager items on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify retail data manager items on user\u0027s behalf; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RetailDataManager.Reshare.All",
|                                             "DisplayName":  "RetailDataManager.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare retail data manager items on user\u0027s behalf; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RiskPreventionProviders.Read.All",
|                                             "DisplayName":  "Read all identity risk prevention providers",
|                                             "Description":  "Allows the app to read your organization\u0027s risk prevention providers, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to organization\u0027s risk prevention providers; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RiskPreventionProviders.ReadWrite.All",
|                                             "DisplayName":  "Read and write all identity risk prevention providers",
|                                             "Description":  "Allows the app to read and write your organization\u0027s risk prevention providers, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to risk prevention providers; no direct identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleAssignmentSchedule.Read.Directory",
|                                             "DisplayName":  "Read all active role assignments and role schedules for your company\u0027s directory",
|                                             "Description":  "Allows the app to read the active role-based access control (RBAC) assignments and schedules for your company\u0027s directory, without a signed-in user. This includes reading directory role templates, and directory roles.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to active RBAC assignments and schedules; no ability to modify or escalate roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleEligibilitySchedule.Read.Directory",
|                                             "DisplayName":  "Read all eligible role assignments for your company\u0027s directory",
|                                             "Description":  "Allows the app to read the eligible role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user. This includes reading directory role templates, and directory roles.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to eligible RBAC assignments; no ability to modify or escalate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagement.Read.All",
|                                             "DisplayName":  "Read role management data for all RBAC providers",
|                                             "Description":  "Allows the app to read the role-based access control (RBAC) settings for all RBAC providers, on behalf of the signed-in user.  This includes reading role definitions and role assignments.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to RBAC settings; no ability to modify roles or escalate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagement.Read.CloudPC",
|                                             "DisplayName":  "Read Cloud PC RBAC settings",
|                                             "Description":  "Allows the app to read the Cloud PC role-based access control (RBAC) settings, on behalf of the signed-in user.  This includes reading Cloud PC role definitions and role assignments.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Cloud PC RBAC settings; no privilege escalation or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagement.Read.Defender",
|                                             "DisplayName":  "Read M365 Defender RBAC configuration",
|                                             "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, on behalf of the signed-in user. This includes reading M365 Defender role definitions and role assignments.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Defender RBAC settings; no ability to modify roles or escalate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagement.Read.Directory",
|                                             "DisplayName":  "Read all directory RBAC settings",
|                                             "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, without a signed-in user.  This includes reading directory role templates, directory roles and memberships.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to directory RBAC settings without ability to modify roles or assignments; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagement.Read.Exchange",
|                                             "DisplayName":  "Read Exchange Online RBAC configuration",
|                                             "Description":  "Allows the app to read the role-based access control (RBAC) settings for your organization\u0027s Exchange Online service, on behalf of the signed-in user. This includes reading Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only delegated access to Exchange RBAC settings; no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagement.ReadWrite.Defender",
|                                             "DisplayName":  "Read M365 Defender RBAC configuration",
|                                             "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write Defender RBAC settings only; does not impact directory or identity plane roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagement.ReadWrite.Exchange",
|                                             "DisplayName":  "Read and write Exchange Online RBAC configuration",
|                                             "Description":  "Allows the app to read and manage the role-based access control (RBAC) settings for your organization\u0027s Exchange Online service, without a signed-in user. This includes reading, creating, updating, and deleting Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.",
|                                             "Tier":  3,
|                                             "Reason":  "Application permission to manage Exchange RBAC roles but no direct ability to assign directory roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagementAlert.Read.Directory",
|                                             "DisplayName":  "Read all alert data for your company\u0027s directory",
|                                             "Description":  "Allows the app to read the role-based access control (RBAC) alerts for your company\u0027s directory, on behalf of the signed-in user. This includes reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to RBAC alerts; no ability to modify roles or escalate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagementAlert.ReadWrite.Directory",
|                                             "DisplayName":  "Read all alert data, configure alerts, and take actions on all alerts for your company\u0027s directory",
|                                             "Description":  "Allows the app to read and manage all role-based access control (RBAC) alerts for your company\u0027s directory, without a signed-in user. This includes managing alert settings, initiating alert scans, dismissing alerts, remediating alert incidents, and reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage RBAC alerts but no direct ability to assign roles or reset credentials; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagementPolicy.Read.AzureADGroup",
|                                             "DisplayName":  "Read all policies in PIM for Groups",
|                                             "Description":  "Allows the app to read policies in Privileged Identity Management for Groups, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to PIM policies for groups; no ability to modify or assign roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagementPolicy.Read.Directory",
|                                             "DisplayName":  "Read all policies for privileged role assignments of your company\u0027s directory",
|                                             "Description":  "Allows the app to read policies for privileged role-based access control (RBAC) assignments of your company\u0027s directory, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to privileged RBAC assignment policies; no write or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagementPolicy.Read.EntraAppRole",
|                                             "DisplayName":  "Read all policies in PIM for App Roles",
|                                             "Description":  "Allows the app to read policies in Privileged Identity Management for App Roles, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to PIM policies for app roles; no ability to modify or assign roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Schedule.Read.All",
|                                             "DisplayName":  "Read all schedule items",
|                                             "Description":  "Allows the app to read all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Teams/Shifts schedules; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Schedule.ReadWrite.All",
|                                             "DisplayName":  "Read and write all schedule items",
|                                             "Description":  "Allows the app to manage all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage Teams/Shifts schedules but no path to identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SchedulePermissions.ReadWrite.All",
|                                             "DisplayName":  "Read/Write schedule permissions for a role",
|                                             "Description":  "Allows the app to read/write schedule permissions for a specific role in Shifts application without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage schedule permissions in Shifts app only; no ability to assign directory roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Schedule-WorkingTime.ReadWrite.All",
|                                             "DisplayName":  "Trigger working time policies and read the working time status",
|                                             "Description":  "Allows the app to trigger the working time policies and read the working time status for other users in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage working time policies for users; no direct identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Scorecard.Execute.All",
|                                             "DisplayName":  "Scorecard.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to execute scorecard actions; no identity plane or role assignment impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Scorecard.Read.All",
|                                             "DisplayName":  "Make API calls that require read permissions on all scorecards",
|                                             "Description":  "Allows the app to make API calls that require read permissions on all scorecards, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only delegated access to all scorecards; no role assignment or credential reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Scorecard.ReadWrite.All",
|                                             "DisplayName":  "Scorecard.ReadWrite (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to read/write scorecards; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Scorecard.Reshare.All",
|                                             "DisplayName":  "Scorecard.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to reshare scorecards; no role assignment or identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SearchConfiguration.Read.All",
|                                             "DisplayName":  "Read your organization\u0027s search configuration",
|                                             "Description":  "Allows the app to read search configurations, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to search configurations; no ability to modify roles or authentication policies."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SearchConfiguration.ReadWrite.All",
|                                             "DisplayName":  "Read and write your organization\u0027s search configuration",
|                                             "Description":  "Allows the app to read and write search configuration, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to read/write search configurations; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityActions.Read.All",
|                                             "DisplayName":  "Read your organization\u0027s security actions",
|                                             "Description":  "Allows the app to read security actions, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to security actions; no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityActions.ReadWrite.All",
|                                             "DisplayName":  "Read and update your organization\u0027s security actions",
|                                             "Description":  "Allows the app to read or update security actions, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to update security actions; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityAlert.Read.All",
|                                             "DisplayName":  "Read all security alerts",
|                                             "Description":  "Allows the app to read all security alerts, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to security alerts; no role assignment or credential reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityAlert.ReadWrite.All",
|                                             "DisplayName":  "Read and write to all security alerts",
|                                             "Description":  "Allows the app to read and write to all security alerts, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to read/write security alerts; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityAnalyzedMessage.Read.All",
|                                             "DisplayName":  "Read metadata and detection details for emails in your organization",
|                                             "Description":  "Read email metadata and security detection details on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read email metadata and security details; no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityAnalyzedMessage.ReadWrite.All",
|                                             "DisplayName":  "Read metadata, detection details, and execute remediation actions on emails in your organization",
|                                             "Description":  "Read email metadata, security detection details, and execute remediation actions like deleting an email, on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write email metadata and execute remediation like deleting emails; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityCopilotWorkspaces.Read.All",
|                                             "DisplayName":  "Read all Security Copilot resources for the signed-in user",
|                                             "Description":  "Allows the app to read all Security Copilot signed-in user\u0027s resources on behalf of the signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Security Copilot user resources; no role assignment or credential reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityCopilotWorkspaces.ReadWrite.All",
|                                             "DisplayName":  "Read and write individually owned Security Copilot resources of the signed-in user",
|                                             "Description":  "Allows the app to read and write Security Copilot resources owned by the signed-in user on their behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to Security Copilot user resources; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityEvents.Read.All",
|                                             "DisplayName":  "Read your organization’s security events",
|                                             "Description":  "Allows the app to read your organization’s security events on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to security events; no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityEvents.ReadWrite.All",
|                                             "DisplayName":  "Read and update your organization’s security events",
|                                             "Description":  "Allows the app to read your organization’s security events without a signed-in user. Also allows the app to update editable properties in security events.",
|                                             "Tier":  3,
|                                             "Reason":  "Application permission to read and update security events; no direct role assignment or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityIdentitiesAccount.Read.All",
|                                             "DisplayName":  "Read all identity security available identity accounts",
|                                             "Description":  "Allows the app to read all the identity security available identity accounts without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to identity security accounts; no ability to modify roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityIdentitiesActions.ReadWrite.All",
|                                             "DisplayName":  "Read and perform all identity security available actions",
|                                             "Description":  "Allows the app to read and write identity security available actions without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to identity security actions; no direct path to role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityIdentitiesAutoConfig.Read.All",
|                                             "DisplayName":  "Read sensors window auditing configuration",
|                                             "Description":  "Allows the app to read sensors window auditing configuration without a signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to sensor auditing configuration; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityIdentitiesAutoConfig.ReadWrite.All",
|                                             "DisplayName":  "Read and write sensors window auditing configuration",
|                                             "Description":  "Allows the app to read and write the sensors window auditing configuration of the signed in user",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read/write access to sensor auditing config for signed-in user only; no tenant-wide identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityIdentitiesHealth.Read.All",
|                                             "DisplayName":  "Read identity security health issues",
|                                             "Description":  "Allows the app to read all the identity security health issues of signed user",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to identity security health issues for signed-in user; no role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityIdentitiesHealth.ReadWrite.All",
|                                             "DisplayName":  "Read and write identity security health issues",
|                                             "Description":  "Allows the app to read and write identity security health issues on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read/write access to identity security health issues for signed-in user only; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityIdentitiesMigration.Read.All",
|                                             "DisplayName":  "Read all identity security sensor migration",
|                                             "Description":  "Allows the app to read all the identity security sensor migration information without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to identity security sensor migration info; no role assignment or credential reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityIdentitiesMigration.ReadWrite.All",
|                                             "DisplayName":  "Read and write identity security sensor migration",
|                                             "Description":  "Allows the app to read and write identity security sensor migration on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read/write access to identity security sensor migration for signed-in user only; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityIdentitiesSensors.Read.All",
|                                             "DisplayName":  "Read identity security sensors",
|                                             "Description":  "Allows the app to read all the identity security sensors of signed user",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to identity security sensors for signed-in user; no role assignment or credential reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityIdentitiesSensors.ReadWrite.All",
|                                             "DisplayName":  "Read and write identity security sensors",
|                                             "Description":  "Allows the app to read and write identity security sensors on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read/write access to identity security sensors for signed-in user only; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityIdentitiesUserActions.Read.All",
|                                             "DisplayName":  "Read all identity security available user actions",
|                                             "Description":  "Allows the app to read all the identity security available user actions without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to identity security user actions; no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityIdentitiesUserActions.ReadWrite.All",
|                                             "DisplayName":  "Read and perform all identity security available user actions",
|                                             "Description":  "Allows the app to read and write identity security available user actions without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to identity security user actions; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityIncident.Read.All",
|                                             "DisplayName":  "Read all security incidents",
|                                             "Description":  "Allows the app to read all security incidents, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to security incidents; no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityIncident.ReadWrite.All",
|                                             "DisplayName":  "Read and write to incidents",
|                                             "Description":  "Allows the app to read and write security incidents, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read/write access to security incidents; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SemanticModel.Execute.All",
|                                             "DisplayName":  "SemanticModel.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to execute semantic model actions; no role assignment or credential reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SemanticModel.ExternalDataShare.All",
|                                             "DisplayName":  "Allows the app to create and manage external data shares for all semantic models",
|                                             "Description":  "Allows the app to create and manage external data shares for all semantic models, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to create/manage external data shares; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SemanticModel.Read.All",
|                                             "DisplayName":  "Read semantic models",
|                                             "Description":  "Allows reading semantic models on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to semantic models on behalf of the user; no direct identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SemanticModel.ReadWrite.All",
|                                             "DisplayName":  "Read and write semantic models",
|                                             "Description":  "Allows modifying semantic models on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify semantic models on behalf of the user; no path to tenant takeover or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SemanticModel.Reshare.All",
|                                             "DisplayName":  "SemanticModel.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare permission on semantic models; no direct or near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SensitivityLabel.Evaluate",
|                                             "DisplayName":  "Evaluate sensitivity labels",
|                                             "Description":  "Allow the app to determine if there is any sensitivity label to be applied automatically to the content or recommended to the user for manual application, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Evaluate sensitivity labels without signed-in user; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SensitivityLabel.Evaluate.All",
|                                             "DisplayName":  "Evaluate labels tenant scope.",
|                                             "Description":  "Allows the app to evaluate all sensitivity label.",
|                                             "Tier":  3,
|                                             "Reason":  "Evaluate all sensitivity labels on behalf of user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SensitivityLabel.Read",
|                                             "DisplayName":  "Get labels application scope.",
|                                             "Description":  "Allows the app to get sensitivity labels.",
|                                             "Tier":  3,
|                                             "Reason":  "Read sensitivity labels without signed-in user; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SensitivityLabels.Read.All",
|                                             "DisplayName":  "Get labels app scope.",
|                                             "Description":  "Allows the app to get sensitivity labels.",
|                                             "Tier":  3,
|                                             "Reason":  "Read sensitivity labels on behalf of user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SentimentSurvey.Export.All",
|                                             "DisplayName":  "Export all Sentiment Survey",
|                                             "Description":  "Allows the app to export all Sentiment Survey, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Export sentiment survey data on behalf of user; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ServiceActivity-Exchange.Read.All",
|                                             "DisplayName":  "Read all Exchange service activity",
|                                             "Description":  "Allows the app to read all Exchange service activity, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Exchange service activity without signed-in user; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ServiceActivity-Microsoft365Web.Read.All",
|                                             "DisplayName":  "Read all Microsoft 365 Web service activity",
|                                             "Description":  "Allows the app to read all Microsoft 365 Web service activity, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Microsoft 365 Web service activity without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ServiceActivity-OneDrive.Read.All",
|                                             "DisplayName":  "Read all One Drive service activity",
|                                             "Description":  "Allows the app to read all One Drive service activity, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read OneDrive service activity without signed-in user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ServiceActivity-Teams.Read.All",
|                                             "DisplayName":  "Read all Teams service activity",
|                                             "Description":  "Allows the app to read all Teams service activity, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Teams service activity on behalf of user; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Management APIs",
|                                             "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ServiceHealth.Read",
|                                             "DisplayName":  "Read service health information for your organization",
|                                             "Description":  "Allows the application to read service health information for your organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Read service health information without signed-in user; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ServiceHealth.Read.All",
|                                             "DisplayName":  "Read service health",
|                                             "Description":  "Allows the app to read your tenant\u0027s service health information on behalf of the signed-in user. Health information may include service issues or service health overviews.",
|                                             "Tier":  3,
|                                             "Reason":  "Read tenant service health on behalf of user; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ServiceMessage.Read.All",
|                                             "DisplayName":  "Read service messages",
|                                             "Description":  "Allows the app to read your tenant\u0027s service announcement messages, without a signed-in user. Messages may include information about new or changed features.",
|                                             "Tier":  3,
|                                             "Reason":  "Read tenant service announcement messages without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ServiceMessageViewpoint.Write",
|                                             "DisplayName":  "Update user status on service announcement messages",
|                                             "Description":  "Allows the app to update service announcement messages\u0027 user status on behalf of the signed-in user. The message status can be marked as read, archive, or favorite.",
|                                             "Tier":  3,
|                                             "Reason":  "Update service announcement message status on behalf of user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ServicePrincipalEndpoint.Read.All",
|                                             "DisplayName":  "Read service principal endpoints",
|                                             "Description":  "Allows the app to read service principal endpoints",
|                                             "Tier":  3,
|                                             "Reason":  "Read service principal endpoints without signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SharePointCrossTenantMigration.Read.All",
|                                             "DisplayName":  "Read Cross-Tenant migration settings and tasks",
|                                             "Description":  "Read Cross-Tenant migration settings and tasks, on behalf of the signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read cross-tenant migration settings on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SharePointTenantSettings.Read.All",
|                                             "DisplayName":  "Read SharePoint and OneDrive tenant settings",
|                                             "Description":  "Allows the application to read the tenant-level settings in SharePoint and OneDrive on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read tenant-level SharePoint and OneDrive settings on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ShortNotes.Read",
|                                             "DisplayName":  "Read short notes of the signed-in user",
|                                             "Description":  "Allows the app to read all the short notes a sign-in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read short notes on behalf of user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ShortNotes.Read.All",
|                                             "DisplayName":  "Read all users\u0027 short notes",
|                                             "Description":  "Allows the app to read all the short notes without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read all short notes without signed-in user; data access only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ShortNotes.ReadWrite",
|                                             "DisplayName":  "Read, create, edit, and delete short notes of the signed-in user",
|                                             "Description":  "Allows the app to read, create, edit, and delete short notes of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and modify short notes on behalf of user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ShortNotes.ReadWrite.All",
|                                             "DisplayName":  "Read, create, edit, and delete all users\u0027 short notes",
|                                             "Description":  "Allows the app to read, create, edit, and delete all the short notes without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and modify all short notes without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SignInIdentifier.Read.All",
|                                             "DisplayName":  "Read SignInIdentifiers",
|                                             "Description":  "Allows the app to read your organization\u0027s sign-in identifiers, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read organization\u0027s sign-in identifiers on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Sites.Read.All",
|                                             "DisplayName":  "Read items in all site collections ",
|                                             "Description":  "Allows the app to read documents and list items in all site collections without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read documents and list items in all site collections without signed-in user; data access only."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Sites.Search.All",
|                                             "DisplayName":  "Run search queries as a user",
|                                             "Description":  "Allows the app to run search queries and to read basic site info on behalf of the current signed-in user. Search results are based on the user\u0027s permissions instead of the app\u0027s permissions.",
|                                             "Tier":  3,
|                                             "Reason":  "Run search queries and read basic site info on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Sites.Selected",
|                                             "DisplayName":  "Access selected site collections",
|                                             "Description":  "Allow the application to access a subset of site collections without a signed in user. The specific site collections and the permissions granted will be configured in SharePoint Online.",
|                                             "Tier":  3,
|                                             "Reason":  "Access subset of site collections without signed-in user; scoped access with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SitesMetadataAdmin.Read.All",
|                                             "DisplayName":  "Read access to site collection metadata on the SharePoint admin site",
|                                             "Description":  "Allows the app to read site collection metadata without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read site collection metadata without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SMTP.Send",
|                                             "DisplayName":  "Send emails from mailboxes using SMTP AUTH.",
|                                             "Description":  "Allows the app to be able to send emails from the user’s mailbox using the SMTP AUTH client submission protocol.",
|                                             "Tier":  3,
|                                             "Reason":  "Send emails from user\u0027s mailbox using SMTP AUTH; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SMTP.SendAsApp",
|                                             "DisplayName":  "Application access for sending emails via SMTP AUTH",
|                                             "Description":  "Allows the app to have send access to all mailboxes",
|                                             "Tier":  3,
|                                             "Reason":  "Send access to all mailboxes; data exfiltration risk but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SparkJobDefinition.Execute.All",
|                                             "DisplayName":  "Execute spark job definitions",
|                                             "Description":  "Allows executing spark job definitions on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute spark job definitions on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SparkJobDefinition.Read.All",
|                                             "DisplayName":  "Read spark job definitions",
|                                             "Description":  "Allows reading spark job definitions on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read spark job definitions on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SparkJobDefinition.ReadWrite.All",
|                                             "DisplayName":  "Read and write spark job definitions",
|                                             "Description":  "Allows modifying spark job definitions on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify spark job definitions on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SparkJobDefinition.Reshare.All",
|                                             "DisplayName":  "SparkJobDefinition.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare spark job definitions on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SpiffeTrustDomain.Read.All",
|                                             "DisplayName":  "Read SPIFFE trust domains and child resources",
|                                             "Description":  "Allows the app to read your organization\u0027s SPIFFE trust domains and child resources on behalf of the user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read organization\u0027s SPIFFE trust domains on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLDatabase.Execute.All",
|                                             "DisplayName":  "SQLDatabase.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Execute SQL database commands on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLDatabase.ExternalDataShare.All",
|                                             "DisplayName":  "Allows the app to create and manage external data shares for all SQL Databases",
|                                             "Description":  "Allows the app to create and manage external data shares for all SQL Databases, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Create and manage external data shares for SQL databases on behalf of user; data impact only."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLDatabase.Read.All",
|                                             "DisplayName":  "Read SQL databases",
|                                             "Description":  "Allows reading SQL databases on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read SQL databases on behalf of user; data access only."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLDatabase.ReadWrite.All",
|                                             "DisplayName":  "Read and write SQL databases",
|                                             "Description":  "Allows modifying SQL databases on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify SQL databases on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLDatabase.Reshare.All",
|                                             "DisplayName":  "SQLDatabase.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing SQL database access does not provide identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLEndpoint.Execute.All",
|                                             "DisplayName":  "SQLEndpoint.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Executing SQL endpoints does not enable role assignment or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLEndpoint.Read.All",
|                                             "DisplayName":  "Read SQL endpoints",
|                                             "Description":  "Allows reading SQL endpoints on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to SQL endpoints is data plane only with no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLEndpoint.ReadWrite.All",
|                                             "DisplayName":  "Read and write SQL endpoints",
|                                             "Description":  "Allows modifying SQL endpoints on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modifying SQL endpoints does not allow identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLEndpoint.Reshare.All",
|                                             "DisplayName":  "SQLEndpoint.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing SQL endpoint access does not enable tenant takeover or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "StorageAccount.Read.All",
|                                             "DisplayName":  "View all storage accounts",
|                                             "Description":  "The app can view all storage accounts registered with Power BI that the signed in user is an admin of.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to storage accounts is data exfiltration risk only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "StorageAccount.ReadWrite.All",
|                                             "DisplayName":  "Read and write all storage accounts",
|                                             "Description":  "The app can view and edit all storage accounts registered with Power BI that the signed in user is an admin of.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to storage accounts does not provide direct or near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Storyline.ReadWrite.All",
|                                             "DisplayName":  "Read and write all Viva Engage storylines",
|                                             "Description":  "Allows the app to modify Viva Engage storylines, read all storylines properties, update storyline properties, and delete storyline properties without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Modifying Viva Engage storylines is content manipulation without identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SubjectRightsRequest.Read.All",
|                                             "DisplayName":  "Read all subject rights requests",
|                                             "Description":  "Allows the app to read subject rights requests without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to subject rights requests is data plane only with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SubjectRightsRequest.ReadWrite.All",
|                                             "DisplayName":  "Read and write all subject rights requests",
|                                             "Description":  "Allows the app to read and write subject rights requests without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to subject rights requests does not enable role assignment or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Subscription.Read.All",
|                                             "DisplayName":  "Read all webhook subscriptions ",
|                                             "Description":  "Allows the app to read all webhook subscriptions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading webhook subscriptions is data plane only with no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Tasks.Read",
|                                             "DisplayName":  "Read user tasks",
|                                             "Description":  "Allows the app to read user tasks",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user tasks is data plane only with no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Tasks.Read.All",
|                                             "DisplayName":  "Read all users’ tasks and tasklist",
|                                             "Description":  "Allows the app to read all users’ tasks and task lists in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all users\u0027 tasks is data exfiltration risk only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Tasks.Read.Shared",
|                                             "DisplayName":  "Read all tasks a user has access to",
|                                             "Description":  "Allows the app to read all tasks a user has access to",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to shared tasks is data plane only with no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Tasks.ReadWrite",
|                                             "DisplayName":  "Create, read, update and delete user tasks ",
|                                             "Description":  "Allows the app to create, read, update and delete user tasks ",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to user tasks does not enable role assignment or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Tasks.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users’ tasks and tasklists",
|                                             "Description":  "Allows the app to create, read, update and delete all users’ tasks and task lists in your organization, without a signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to all users\u0027 tasks is data plane only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Tasks.ReadWrite.Shared",
|                                             "DisplayName":  "Create, read, update and delete all tasks a user has access to",
|                                             "Description":  "Allows the app to create, read, update and delete all tasks a user has access to",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to shared tasks does not enable identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TaskStatus.Submit",
|                                             "DisplayName":  "Submit project task status updates",
|                                             "Description":  "Allows the app to submit project task status updates the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Submitting project task status updates is content modification without identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Team.Create",
|                                             "DisplayName":  "Create teams",
|                                             "Description":  "Allows the app to create teams without a signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Creating teams does not provide direct or near-direct control over identity or role assignments."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Team.ReadBasic.All",
|                                             "DisplayName":  "Get a list of all teams",
|                                             "Description":  "Get a list of all teams, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading basic team info is data plane only with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamMember.Read.All",
|                                             "DisplayName":  "Read the members of teams",
|                                             "Description":  "Read the members of teams, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading team members is data plane only without privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamMember.ReadWriteNonOwnerRole.All",
|                                             "DisplayName":  "Add and remove members with non-owner role for all teams",
|                                             "Description":  "Add and remove members from all teams, without a signed-in user. Does not allow adding or removing a member with the owner role. Additionally, does not allow the app to elevate an existing member to the owner role.",
|                                             "Tier":  3,
|                                             "Reason":  "Modifying non-owner roles in teams does not allow elevation to owner or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsActivity.Read",
|                                             "DisplayName":  "Read user\u0027s teamwork activity feed",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s teamwork activity feed.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading user\u0027s teamwork activity feed is data plane only with no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsActivity.Read.All",
|                                             "DisplayName":  "Read all users\u0027 teamwork activity feed",
|                                             "Description":  "Allows the app to read all users\u0027 teamwork activity feed, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading all users\u0027 teamwork activity feeds is data exfiltration risk only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsActivity.Send",
|                                             "DisplayName":  "Send a teamwork activity to any user",
|                                             "Description":  "Allows the app to create new notifications in users\u0027 teamwork activity feeds without a signed in user. These notifications may not be discoverable or be held or governed by compliance policies.",
|                                             "Tier":  3,
|                                             "Reason":  "Sending notifications in teamwork feeds is content creation without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ManageSelectedForChat",
|                                             "DisplayName":  "Manage installation and permission grants of selected Teams apps in chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in chats the signed-in user can access. Gives the ability to manage permission grants for accessing those specific chats\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing Teams apps in chats user can access does not enable identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ManageSelectedForChat.All",
|                                             "DisplayName":  "Manage installation and permission grants of selected Teams apps in all chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any chat, without a signed-in user. Gives the ability to manage permission grants for accessing those specific chats\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing Teams apps in any chat is scoped to app management without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ManageSelectedForTeam",
|                                             "DisplayName":  "Manage installation and permission grants of selected Teams apps in teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Gives the ability to manage permission grants for accessing those specific teams\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing Teams apps in teams user can access does not enable role assignment or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ManageSelectedForTeam.All",
|                                             "DisplayName":  "Manage installation and permission grants of selected Teams apps in all teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any team, without a signed-in user. Gives the ability to manage permission grants for accessing those specific teams\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing Teams apps in any team is app management only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ManageSelectedForUser",
|                                             "DisplayName":  "Manage installation and permission grants of selected Teams apps in users\u0027 personal scope",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall seleected Teams apps in user accounts, on behalf of the signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing Teams apps in user accounts user can access is scoped and does not enable identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ManageSelectedForUser.All",
|                                             "DisplayName":  "Manage installation and permission grants of selected Teams apps for all user accounts",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any user account, without a signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing Teams apps in any user account is app management only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.Read.All",
|                                             "DisplayName":  "Read installed Teams apps for all installation scopes",
|                                             "Description":  "Allows the app to read the Teams apps that are installed in any scope, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading installed Teams apps is data plane only with no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadForChat",
|                                             "DisplayName":  "Read installed Teams apps in chats",
|                                             "Description":  "Allows the app to read the Teams apps that are installed in chats the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading Teams apps in chats user can access is data plane only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadForChat.All",
|                                             "DisplayName":  "Read installed Teams apps for all chats",
|                                             "Description":  "Allows the app to read the Teams apps that are installed in any chat, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading Teams apps in any chat is data plane only with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadForTeam",
|                                             "DisplayName":  "Read installed Teams apps in teams",
|                                             "Description":  "Allows the app to read the Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading Teams apps in teams user can access is data plane only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadForTeam.All",
|                                             "DisplayName":  "Read installed Teams apps for all teams",
|                                             "Description":  "Allows the app to read the Teams apps that are installed in any team, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading Teams apps in any team is data plane only with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadForUser",
|                                             "DisplayName":  "Read user\u0027s installed Teams apps",
|                                             "Description":  "Allows the app to read the Teams apps that are installed for the signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading Teams apps installed for signed-in user is data plane only with no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadForUser.All",
|                                             "DisplayName":  "Read installed Teams apps for all users",
|                                             "Description":  "Allows the app to read the Teams apps that are installed for any user, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading Teams apps installed for any user is data plane only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadSelectedForChat",
|                                             "DisplayName":  "Read selected installed Teams apps in chats",
|                                             "Description":  "Allows the app to read the selected Teams apps that are installed in chats the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading selected Teams apps in chats user can access is data plane only with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadSelectedForChat.All",
|                                             "DisplayName":  "Read selected installed Teams apps in all chats",
|                                             "Description":  "Allows the app to read the selected Teams apps that are installed in any chat, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading selected Teams apps in any chat is data plane only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadSelectedForTeam",
|                                             "DisplayName":  "Read selected installed Teams apps in teams",
|                                             "Description":  "Allows the app to read the selected Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading selected Teams apps in teams user can access is data plane only with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadSelectedForTeam.All",
|                                             "DisplayName":  "Read selected installed Teams apps in all teams",
|                                             "Description":  "Allows the app to read the selected Teams apps that are installed in any team, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading selected Teams apps in any team is data plane only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadSelectedForUser",
|                                             "DisplayName":  "Read user\u0027s selected installed Teams apps",
|                                             "Description":  "Allows the app to read the selected Teams apps that are installed for the signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading selected Teams apps installed for signed-in user is data plane only with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadSelectedForUser.All",
|                                             "DisplayName":  "Read selected installed Teams apps for all users",
|                                             "Description":  "Allows an app to read, install, upgrade, and uninstall selected apps to any user, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading, installing, upgrading, and uninstalling selected apps for any user is app management only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentForChat",
|                                             "DisplayName":  "Manage installed Teams apps in chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in chats the signed-in user can access. Gives the ability to manage permission grants for accessing those specific chats\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing Teams apps in chats user can access with consent management does not enable identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForChat",
|                                             "DisplayName":  "Allow the Teams app to manage itself and its permission grants in chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in chats the signed-in user can access, and manage its permission grants for accessing those specific chats\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage itself in chats accessible to signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForChat.All",
|                                             "DisplayName":  "Allow the Teams app to manage itself and its permission grants for all chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any chat, without a signed-in user, and manage its permission grants for accessing those specific chats\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage itself in any chat without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForTeam",
|                                             "DisplayName":  "Allow the Teams app to manage itself and its permission grants in teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in teams the signed-in user can access, and manage its permission grants for accessing those specific teams\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage itself in teams accessible to signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForTeam.All",
|                                             "DisplayName":  "Allow the Teams app to manage itself and its permission grants for all teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any team, without a signed-in user, and manage its permission grants for accessing those specific teams\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage itself in any team without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForUser",
|                                             "DisplayName":  "Allow the Teams app to manage itself and its permission grants in user accounts",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in user accounts, and manage its permission grants for accessing those specific users\u0027 data, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage itself in user accounts on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForUser.All",
|                                             "DisplayName":  "Allow the Teams app to manage itself and its permission grants in all user accounts",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any user account, without a signed-in user, and manage its permission grants for accessing those specific users\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage itself in any user account without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelfForChat",
|                                             "DisplayName":  "Allow the Teams app to manage itself in chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in chats the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in chats accessible to signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelfForChat.All",
|                                             "DisplayName":  "Allow the Teams app to manage itself for all chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any chat, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in any chat without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelfForTeam",
|                                             "DisplayName":  "Allow the app to manage itself in teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself to teams the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in teams accessible to signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelfForTeam.All",
|                                             "DisplayName":  "Allow the Teams app to manage itself for all teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in any team, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in any team without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelfForUser",
|                                             "DisplayName":  "Allow the Teams app to manage itself for a user",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs for signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelfForUser.All",
|                                             "DisplayName":  "Allow the app to manage itself for all users",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself to any user, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs for any user without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsTab.Create",
|                                             "DisplayName":  "Create tabs in Microsoft Teams.",
|                                             "Description":  "Allows the app to create tabs in any team in Microsoft Teams, without a signed-in user. This does not grant the ability to read, modify or delete tabs after they are created, or give access to the content inside the tabs.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows creating tabs in any team without signed-in user; no access to content or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.Read.All",
|                                             "DisplayName":  "Read tabs in Microsoft Teams.",
|                                             "Description":  "Read the names and settings of tabs inside any team in Microsoft Teams, on behalf of the signed-in user. This does not give access to the content inside the tabs.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows reading tab names and settings on behalf of signed-in user; no identity plane control or content access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.ReadWrite.All",
|                                             "DisplayName":  "Read and write tabs in Microsoft Teams.",
|                                             "Description":  "Read and write tabs in any team in Microsoft Teams, on behalf of the signed-in user. This does not give access to the content inside the tabs.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows reading and writing tabs on behalf of signed-in user; no identity plane control or content access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.ReadWriteForChat",
|                                             "DisplayName":  "Allow the Teams app to manage all tabs in chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs in chats the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows managing tabs in chats accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsTab.ReadWriteForChat.All",
|                                             "DisplayName":  "Allow the Teams app to manage all tabs for all chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs for any chat, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows managing tabs in any chat without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.ReadWriteForTeam",
|                                             "DisplayName":  "Allow the Teams app to manage all tabs in teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs to teams the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows managing tabs in teams accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsTab.ReadWriteForTeam.All",
|                                             "DisplayName":  "Allow the Teams app to manage all tabs for all teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs in any team, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows managing tabs in any team without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.ReadWriteForUser",
|                                             "DisplayName":  "Allow the Teams app to manage all tabs for a user",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs for the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows managing tabs for signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsTab.ReadWriteForUser.All",
|                                             "DisplayName":  "Allow the app to manage all tabs for all users",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs for any user, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows managing tabs for any user without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.ReadWriteSelfForChat",
|                                             "DisplayName":  "Allow the Teams app to manage only its own tabs in chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs in chats the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in chats accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsTab.ReadWriteSelfForChat.All",
|                                             "DisplayName":  "Allow the Teams app to manage only its own tabs for all chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for any chat, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in any chat without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.ReadWriteSelfForTeam",
|                                             "DisplayName":  "Allow the Teams app to manage only its own tabs in teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs to teams the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in teams accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsTab.ReadWriteSelfForTeam.All",
|                                             "DisplayName":  "Allow the Teams app to manage only its own tabs for all teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs in any team, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in any team without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.ReadWriteSelfForUser",
|                                             "DisplayName":  "Allow the Teams app to manage only its own tabs for a user",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs for signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsTab.ReadWriteSelfForUser.All",
|                                             "DisplayName":  "Allow the Teams app to manage only its own tabs for all users",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for any user, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs for any user without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTelephoneNumber.Read.All",
|                                             "DisplayName":  "Read Tenant-Acquired Telephone Number Details",
|                                             "Description":  "Allows the app to read your tenant\u0027s acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows reading tenant telephone number details on behalf of signed-in admin; no identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTelephoneNumber.ReadWrite.All",
|                                             "DisplayName":  "Read and Modify Tenant-Acquired Telephone Number Details",
|                                             "Description":  "Allows the app to read and modify your tenant\u0027s acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows reading and modifying tenant telephone number details on behalf of signed-in admin; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsUserConfiguration.Read.All",
|                                             "DisplayName":  "Read Teams user configurations",
|                                             "Description":  "Allows the app to read your tenant\u0027s user configurations, without a signed-in user. User configuration may include attributes related to user, such as telephone number, assigned policies, etc.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user configurations only; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamTemplates.Read",
|                                             "DisplayName":  "Read available Teams templates",
|                                             "Description":  "Allows the app to read the available Teams templates, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Teams templates scoped to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamTemplates.Read.All",
|                                             "DisplayName":  "Read all available Teams Templates",
|                                             "Description":  "Allows the app to read all available Teams Templates, without a signed-user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all Teams templates without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Teamwork.Read.All",
|                                             "DisplayName":  "Read organizational teamwork settings",
|                                             "Description":  "Allows the app to read all teamwork settings of the organization without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to teamwork settings without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkAppSettings.Read.All",
|                                             "DisplayName":  "Read Teams app settings",
|                                             "Description":  "Allows the app to read the Teams app settings without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Teams app settings without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkDevice.Read.All",
|                                             "DisplayName":  "Read Teams devices",
|                                             "Description":  "Allow the app to read the management data for Teams devices, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Teams device management data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamworkSection.Read",
|                                             "DisplayName":  "Read your sections",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s sections (folders) for organizing chats and channels in Teams.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s Teams sections; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkSection.Read.All",
|                                             "DisplayName":  "Read all users\u0027 sections",
|                                             "Description":  "Allows the app to read all users\u0027 sections (folders) for organizing chats and channels in Teams, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all users\u0027 Teams sections without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamworkSection.ReadWrite",
|                                             "DisplayName":  "Read and write your sections",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s sections (folders) for organizing chats and channels in Teams.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to signed-in user\u0027s Teams sections; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamworkTag.Read",
|                                             "DisplayName":  "Read tags in Teams",
|                                             "Description":  "Allows the app to read tags in Teams, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Teams tags on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkTag.Read.All",
|                                             "DisplayName":  "Read tags in Teams",
|                                             "Description":  "Allows the app to read tags in Teams without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Teams tags without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamworkTag.ReadWrite",
|                                             "DisplayName":  "Read and write tags in Teams",
|                                             "Description":  "Allows the app to read and write tags in Teams, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to Teams tags on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkTargetedMessage.Read.All",
|                                             "DisplayName":  "Read all targeted messages of group chat or channel",
|                                             "Description":  "Allows the app to read all group chat or channel targeted messages in Microsoft Teams.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to targeted Teams messages without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamworkTargetedMessage.ReadWrite",
|                                             "DisplayName":  "Update targeted messages belonging to the user",
|                                             "Description":  "Allows the user to update group chat or channel targeted messages in Microsoft Teams.",
|                                             "Tier":  3,
|                                             "Reason":  "Update access to targeted Teams messages on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamworkUserInteraction.Read.All",
|                                             "DisplayName":  "Read all of the possible Teams interactions between the user and other users",
|                                             "Description":  "Allows the app to read all of the possible Teams interactions between the signed-in user and other users",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Teams interactions for signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Tenant.Read.All",
|                                             "DisplayName":  "View all content in tenant",
|                                             "Description":  "The app can view all content in the tenant without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all tenant content without signed-in user; data plane only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Tenant.ReadWrite.All",
|                                             "DisplayName":  "Read and write all content in tenant",
|                                             "Description":  "The app can create, edit, view, and delete all content in the tenant if the signed in user is in the Global administrator or Power BI service administrator role.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to tenant content only if signed-in user is Global or Power BI admin; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TenantGovernance-Invitation.Read.All",
|                                             "DisplayName":  "Read Tenant Governance invitations",
|                                             "Description":  "Allows the application to list and read all Tenant Governance invitations without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Tenant Governance invitations without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-Invitation.ReadWrite.All",
|                                             "DisplayName":  "Read and write Tenant Governance invitations",
|                                             "Description":  "Allows the application to list, read, create, and delete Tenant Governance invitations on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to Tenant Governance invitations on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-PolicyTemplate.Read.All",
|                                             "DisplayName":  "Read Tenant Governance policy templates",
|                                             "Description":  "Allows the application to list and read all Tenant Governance policy templates on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Tenant Governance policy templates on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-PolicyTemplate.ReadWrite.All",
|                                             "DisplayName":  "Read and write Tenant Governance policy templates",
|                                             "Description":  "Allows the application to list, read, create, update, and delete Tenant Governance policy templates on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to Tenant Governance policy templates on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TenantGovernance-RelatedTenant.Read.All",
|                                             "DisplayName":  "Read related tenants",
|                                             "Description":  "Allows the application to list and read related tenants information without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to related tenants info without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-RelatedTenant.ReadWrite.All",
|                                             "DisplayName":  "Read and write related tenants",
|                                             "Description":  "Allows the application to list, read, and refresh related tenants information on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to related tenants info on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-Relationship.Read.All",
|                                             "DisplayName":  "Read Tenant Governance relationships",
|                                             "Description":  "Allows the application to list and read all Tenant Governance relationships on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Tenant Governance relationships on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-Relationship.ReadWrite.All",
|                                             "DisplayName":  "Read and write Tenant Governance relationships",
|                                             "Description":  "Allows the application to list, read, and update Tenant Governance relationships on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to Tenant Governance relationships on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TenantGovernance-Request.Read.All",
|                                             "DisplayName":  "Read Tenant Governance requests",
|                                             "Description":  "Allows the application to list and read all Tenant Governance requests without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Tenant Governance requests without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-Request.ReadWrite.All",
|                                             "DisplayName":  "Read and write Tenant Governance requests",
|                                             "Description":  "Allows the application to list, read, create, and update Tenant Governance requests on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to Tenant Governance requests on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-Setting.Read.All",
|                                             "DisplayName":  "Read Tenant Governance settings",
|                                             "Description":  "Allows the application to read Tenant Governance settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Tenant Governance settings on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-Setting.ReadWrite.All",
|                                             "DisplayName":  "Read and write Tenant Governance settings",
|                                             "Description":  "Allows the application to read Tenant Governance settings and update them on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to Tenant Governance settings on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantLicenseStatus.Read.All",
|                                             "DisplayName":  "TenantLicenseStatus.Read.All",
|                                             "Description":  "TenantLicenseStatus.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to tenant license status on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantReports.Read.All",
|                                             "DisplayName":  "Can view tenant reports from the admin site",
|                                             "Description":  "Allows the app to read tenant reports via the SharePoint admin site, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to tenant reports on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TenantReports.ReadWrite.All",
|                                             "DisplayName":  "Read and write access to tenant report data on the SharePoint admin site",
|                                             "Description":  "Allows the app to read and write tenant reports via the SharePoint admin site without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to tenant reports without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TermStore.Read.All",
|                                             "DisplayName":  "Read all term store data",
|                                             "Description":  "Allows the app to read all term store data, without a signed-in user. This includes all sets, groups and terms in the term store.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to term store data without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TermStore.ReadWrite.All",
|                                             "DisplayName":  "Read and write managed metadata",
|                                             "Description":  "Allows the app to read, create, update, and delete managed metadata and to read basic site info on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to managed metadata on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ThreatAssessment.Read.All",
|                                             "DisplayName":  "Read threat assessment requests",
|                                             "Description":  "Allows an app to read your organization\u0027s threat assessment requests, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to threat assessment requests without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatAssessment.ReadWrite.All",
|                                             "DisplayName":  "Read and write threat assessment requests",
|                                             "Description":  "Allows an app to read your organization\u0027s threat assessment requests on behalf of the signed-in user. Also allows the app to create new requests to assess threats received by your organization on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to threat assessment requests on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatHunting.Read.All",
|                                             "DisplayName":  "Run hunting queries",
|                                             "Description":  "Allows the app to run hunting queries, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Run hunting queries on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatIndicators.Read.All",
|                                             "DisplayName":  "Read all threat indicators",
|                                             "Description":  "Allows the app to read all the indicators for your organization, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to threat indicators on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ThreatIndicators.ReadWrite.OwnedBy",
|                                             "DisplayName":  "Manage threat indicators this app creates or owns",
|                                             "Description":  "Allows the app to create threat indicators, and fully manage those threat indicators (read, update and delete), without a signed-in user.  It cannot update any threat indicators it does not own.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage owned threat indicators without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatIntelligence.Read.All",
|                                             "DisplayName":  "Read all threat intelligence information",
|                                             "Description":  "Allows the app to read threat intelligence information, such as indicators, observations, and articles, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read threat intelligence info on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatSubmission.Read",
|                                             "DisplayName":  "Read threat submissions",
|                                             "Description":  "Allows the app to read the threat submissions and threat submission policies owned by the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read threat submissions owned by signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ThreatSubmission.Read.All",
|                                             "DisplayName":  "Read all of the organization\u0027s threat submissions",
|                                             "Description":  "Allows the app to read your organization\u0027s threat submissions and to view threat submission policies without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read all threat submissions without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatSubmission.ReadWrite",
|                                             "DisplayName":  "Read and write threat submissions",
|                                             "Description":  "Allows the app to read the threat submissions and threat submission policies owned by the signed-in user. Also allows the app to create new threat submissions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write threat submissions owned by signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatSubmission.ReadWrite.All",
|                                             "DisplayName":  "Read and write all threat submissions",
|                                             "Description":  "Allows the app to read your organization\u0027s threat submissions and threat submission policies on behalf of the signed-in user. Also allows the app to create new threat submissions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write all threat submissions on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatSubmissionPolicy.ReadWrite.All",
|                                             "DisplayName":  "Read and write all threat submission policies",
|                                             "Description":  "Allows the app to read your organization\u0027s threat submission policies on behalf of the signed-in user. Also allows the app to create new threat submission policies on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write threat submission policies on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TiRemediation.Read.All",
|                                             "DisplayName":  "TiRemediation.Read.All",
|                                             "Description":  "TiRemediation.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to TiRemediation data; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TiRemediation.ReadWrite.All",
|                                             "DisplayName":  "TiRemediation.ReadWrite.All",
|                                             "Description":  "TiRemediation.ReadWrite.All",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to TiRemediation data only; does not enable identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Topic.Read.All",
|                                             "DisplayName":  "Read topic items",
|                                             "Description":  "Allows the app to read topics data on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to topics data on behalf of signed-in user; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TrustFrameworkKeySet.Read.All",
|                                             "DisplayName":  "Read trust framework key sets",
|                                             "Description":  "Allows the app to read trust framework key set properties without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to trust framework key sets; no ability to modify or escalate."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UnifiedGroupMember.Read.AsGuest",
|                                             "DisplayName":  "Read unified group memberships as guest",
|                                             "Description":  "Allows the app to read basic unified group properties, memberships and owners of the group the signed-in guest is a member of.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to unified group membership as guest; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User.Invite.All",
|                                             "DisplayName":  "Invite guest users to the organization",
|                                             "Description":  "Allows the app to invite guest users to the organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Can invite guest users without signed-in user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User.Read",
|                                             "DisplayName":  "Sign in and read user profile",
|                                             "Description":  "Allows users to sign-in to the app, and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users.",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic profile of signed-in user only; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User.Read.All",
|                                             "DisplayName":  "Read all users\u0027 full profiles",
|                                             "Description":  "Allows the app to read user profiles without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read user profiles without signed-in user; no write or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User.ReadBasic.All",
|                                             "DisplayName":  "Read all users\u0027 basic profiles",
|                                             "Description":  "Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo.",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic profile properties on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User.ReadWrite",
|                                             "DisplayName":  "Read and write user profiles",
|                                             "Description":  "Allows the app to create, read, and write a set of the current user\u0027s profile properties in your company or school. Includes display name, photo, and email address.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own profile properties only; no tenant-wide impact or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Rights Management Services",
|                                             "AppId":  "00000012-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "user_impersonation",
|                                             "DisplayName":  "Create and access protected content for users",
|                                             "Description":  "Allow the application to use Azure Rights Management",
|                                             "Tier":  3,
|                                             "Reason":  "Allows use of Azure Rights Management; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserActivity.ReadWrite.CreatedByApp",
|                                             "DisplayName":  "Read and write app activity to users\u0027 activity feed",
|                                             "Description":  "Allows the app to read and report the signed-in user\u0027s activity in the app.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write signed-in user activity in app; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthenticationMethod.Read",
|                                             "DisplayName":  "Read user authentication methods.",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s authentication methods, including phone numbers and Authenticator app settings. This does not allow the app to see secret information like the signed-in user\u0027s passwords, or to sign-in  or otherwise use the signed-in user\u0027s authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own authentication methods without secrets; no credential reset or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthenticationMethod.Read.All",
|                                             "DisplayName":  "Read all users\u0027 authentication methods",
|                                             "Description":  "Allows the app to read authentication methods of all users in your organization that the signed-in user has access to. Authentication methods include things like a user’s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read authentication methods of all users accessible to signed-in user; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthenticationMethod.ReadWrite",
|                                             "DisplayName":  "Read and write user authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s authentication methods, including phone numbers and Authenticator app settings.                       This does not allow the app to see secret information like the signed-in user\u0027s passwords, or                      to sign-in or otherwise use the signed-in user\u0027s authentication methods.  ",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own authentication methods without secrets; no role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Email.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s email authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s email authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own email authentication methods without secrets; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-Email.Read.All",
|                                             "DisplayName":  "Read all users\u0027 email methods",
|                                             "Description":  "Allows the app to read email methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read email authentication methods of all users; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Email.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s email authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s email authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own email authentication methods; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-External.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s external authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s external authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own external authentication methods; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-External.Read.All",
|                                             "DisplayName":  "Read all users\u0027 external authentication methods",
|                                             "Description":  "Allows the app to read external authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read external authentication methods of all users; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-External.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s external authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s external authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own external authentication methods; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-HardwareOATH.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s HardwareOATH authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s HardwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own HardwareOATH methods; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-HardwareOATH.Read.All",
|                                             "DisplayName":  "Read all users\u0027 HardwareOATH authentication methods",
|                                             "Description":  "Allows the app to read HardwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read HardwareOATH methods of all users; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-HardwareOATH.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s HardwareOATH authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s HardwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own HardwareOATH methods; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-MicrosoftAuthApp.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s Microsoft Authenticator authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s Microsoft Authenticator authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own Microsoft Authenticator methods; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-MicrosoftAuthApp.Read.All",
|                                             "DisplayName":  "Read all users\u0027 Microsoft authentication methods",
|                                             "Description":  "Allows the app to read Microsoft authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Microsoft Authenticator methods of all users accessible to signed-in user; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-MicrosoftAuthApp.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s Microsoft Authenticator authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s Microsoft Authenticator authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own Microsoft Authenticator methods; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Passkey.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s passkey authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s passkey authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own passkey authentication methods; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Passkey.Read.All",
|                                             "DisplayName":  "Read all users\u0027 passkey authentication methods",
|                                             "Description":  "Allows the app to read passkey authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read passkey authentication methods of all users accessible to signed-in user; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Passkey.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s passkey authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s passkey authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own passkey authentication methods; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Password.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s password authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s password authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own password authentication methods without secrets; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Password.Read.All",
|                                             "DisplayName":  "Read all users\u0027 password authentication methods",
|                                             "Description":  "Allows the app to read password authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read password authentication methods of all users accessible to signed-in user; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Password.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s password authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s password authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own password authentication methods; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Phone.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s phone authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s phone authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own phone authentication methods; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Phone.Read.All",
|                                             "DisplayName":  "Read all users\u0027 phone authentication methods",
|                                             "Description":  "Allows the app to read phone authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read phone authentication methods of all users accessible to signed-in user; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Phone.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s phone authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s phone authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows read/write of signed-in user\u0027s phone auth methods only; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-PlatformCred.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s platform credential authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s platform credential authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s platform credentials only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-PlatformCred.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s platform credential authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s platform credential authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to signed-in user\u0027s platform credentials only; no tenant-wide impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-QR.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s QR authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s QR authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s QR auth methods only; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-QR.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s QR authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s QR authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to signed-in user\u0027s QR auth methods only; no tenant-wide impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-SoftwareOATH.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s SoftwareOATH authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s SoftwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s SoftwareOATH methods only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-SoftwareOATH.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s SoftwareOATH authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s SoftwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to signed-in user\u0027s SoftwareOATH methods only; no tenant-wide impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-TAP.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s Temporary Access Pass authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s Temporary Access Pass authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s Temporary Access Pass methods only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-TAP.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s Temporary Access Pass authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s Temporary Access Pass authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to signed-in user\u0027s Temporary Access Pass methods only; no tenant-wide impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-WindowsHello.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s Windows Hello methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s Windows Hello authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s Windows Hello methods only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-WindowsHello.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s Windows Hello authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s Windows Hello authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to signed-in user\u0027s Windows Hello methods only; no tenant-wide impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserCloudClipboard.Read",
|                                             "DisplayName":  "Read cloud clipboard items",
|                                             "Description":  "Allows the app to read cloud clipboard data on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s cloud clipboard data only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserDataFunction.Execute.All",
|                                             "DisplayName":  "Execute user data function items",
|                                             "Description":  "Allows executing user data function items on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute user data functions on behalf of signed-in user; no tenant-wide identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserDataFunction.Read.All",
|                                             "DisplayName":  "Read user data function items",
|                                             "Description":  "Allows reading user data function items on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read user data functions on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserDataFunction.ReadWrite.All",
|                                             "DisplayName":  "Read and write user data function items",
|                                             "Description":  "Allows modifying user data function items on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify user data functions on behalf of signed-in user; no tenant-wide identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User-LifeCycleInfo.Read.All",
|                                             "DisplayName":  "Read all users\u0027 lifecycle information",
|                                             "Description":  "Allows the app to read the lifecycle information like employeeLeaveDateTime of users in your organization, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read lifecycle info on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User-LifeCycleInfo.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 lifecycle information",
|                                             "Description":  "Allows the app to read and write the lifecycle information like employeeLeaveDateTime of users in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write lifecycle info without signed-in user; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User-Mail.ReadWrite.All",
|                                             "DisplayName":  "Read and write secondary mail addresses for users",
|                                             "Description":  "Allows the app to read and write secondary mail addresses for all users, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write secondary mail addresses for all users; data plane only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserNotification.ReadWrite.CreatedByApp",
|                                             "DisplayName":  "Deliver and manage user\u0027s notifications",
|                                             "Description":  "Allows the app to send, read, update and delete user’s notifications.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage user\u0027s notifications; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User-Phone.ReadWrite.All",
|                                             "DisplayName":  "Read and write all user mobile phone and business phones",
|                                             "Description":  "Allows the app to read and write the mobile phone and business phones for all users, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write phone numbers for all users; no direct identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UsersAggregateByAttackSimulation.tenant.read",
|                                             "DisplayName":  "UsersAggregateByAttackSimulation.tenant.read",
|                                             "Description":  "UsersAggregateByAttackSimulation.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to attack simulation data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserShiftPreferences.Read.All",
|                                             "DisplayName":  "Read all user shift preferences",
|                                             "Description":  "Allows the app to read all users\u0027 shift schedule preferences without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read all users\u0027 shift preferences; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserShiftPreferences.ReadWrite.All",
|                                             "DisplayName":  "Read and write all user shift preferences",
|                                             "Description":  "Allows the app to manage all users\u0027 shift schedule preferences without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage all users\u0027 shift preferences; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserState.ReadWrite.All",
|                                             "DisplayName":  "Read and write user settings and state",
|                                             "Description":  "The app can view and edit any user settings and the user-specific state associated with  content the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "View and edit user settings for accessible content; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserTeamwork.Read",
|                                             "DisplayName":  "Read user teamwork settings",
|                                             "Description":  "Allows the app to read the teamwork settings of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read teamwork settings of signed-in user only; no tenant-wide impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserTeamwork.Read.All",
|                                             "DisplayName":  "Read all user teamwork settings",
|                                             "Description":  "Allows the app to read all user teamwork settings without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read teamwork settings for all users; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserTimelineActivity.Write.CreatedByApp",
|                                             "DisplayName":  "Write app activity to users\u0027 timeline",
|                                             "Description":  "Allows the app to report the signed-in user\u0027s app activity information to Microsoft Timeline.",
|                                             "Tier":  3,
|                                             "Reason":  "Report signed-in user\u0027s app activity; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserWindowsSettings.Read.All",
|                                             "DisplayName":  "Read windows settings for all devices",
|                                             "Description":  "Allows the app to read a user\u0027s windows settings which are stored in cloud and their values on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read users\u0027 Windows settings on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserWindowsSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and write windows settings for all devices",
|                                             "Description":  "Allows the app to read and write a user\u0027s windows settings which are stored in cloud and their values on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write users\u0027 Windows settings on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VariableLibrary.Execute.All",
|                                             "DisplayName":  "Execute variable libraries",
|                                             "Description":  "Allows executing variable libraries on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute variable libraries on behalf of signed-in user; no tenant-wide identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VariableLibrary.Read.All",
|                                             "DisplayName":  "Read variable libraries",
|                                             "Description":  "Allows reading variable libraries on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read variable libraries on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VariableLibrary.ReadWrite.All",
|                                             "DisplayName":  "Read and write variable libraries",
|                                             "Description":  "Allows modifying variable libraries on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify variable libraries on behalf of signed-in user; no tenant-wide identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VariableLibrary.Reshare.All",
|                                             "DisplayName":  "VariableLibrary.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description; assumed low impact with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VerifiedId-Profile.Read.All",
|                                             "DisplayName":  "Read Verified Id profiles",
|                                             "Description":  "This role can read Verified Id profiles in a tenant.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Verified ID profiles; no direct identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VerifiedId-Profile.ReadWrite.All",
|                                             "DisplayName":  "Read and write Verified Id profiles",
|                                             "Description":  "This role can read and write Verified Id profiles in a tenant.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write Verified ID profiles; no direct identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VirtualAppointment.Read",
|                                             "DisplayName":  "Read a user\u0027s virtual appointments",
|                                             "Description":  "Allows an application to read virtual appointments for the signed-in user. Only an organizer or participant user can read their virtual appointments.  ",
|                                             "Tier":  3,
|                                             "Reason":  "Read virtual appointments for signed-in user only; no tenant-wide identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "VirtualAppointment.Read.All",
|                                             "DisplayName":  "Read all virtual appointments for users, as authorized by online meetings application access policy",
|                                             "Description":  "Allows the application to read virtual appointments for all users, without a signed-in user. The app must also be authorized to access an individual user’s data by the online meetings application access policy.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to virtual appointments for all users; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VirtualAppointment.ReadWrite",
|                                             "DisplayName":  "Read and write a user\u0027s virtual appointments  ",
|                                             "Description":  "Allows an application to read and write virtual appointments for the signed-in user. Only an organizer or participant user can read and write their virtual appointments. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access limited to signed-in user\u0027s virtual appointments; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "VirtualAppointment.ReadWrite.All",
|                                             "DisplayName":  "Read-write all virtual appointments for users, as authorized by online meetings app access policy",
|                                             "Description":  "Allows the application to read and write virtual appointments for all users, without a signed-in user. The app must also be authorized to access an individual user’s data by the online meetings application access policy.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to virtual appointments for all users; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "VirtualAppointmentNotification.Send",
|                                             "DisplayName":  "Send notification regarding virtual appointments as any user",
|                                             "Description":  "Allows the application to send notification regarding virtual appointments as any user, without a signed-in user. The app must also be authorized to access an individual user\u0027s data by the online meetings application access policy.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to send notifications as any user; no role assignment or credential reset capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VirtualEvent.Read",
|                                             "DisplayName":  "Read your virtual events",
|                                             "Description":  "Allows the app to read virtual events created by you",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user\u0027s own virtual events only; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "VirtualEvent.Read.All",
|                                             "DisplayName":  "Read all users\u0027 virtual events",
|                                             "Description":  "Allows the app to read all virtual events without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all virtual events without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VirtualEvent.ReadWrite",
|                                             "DisplayName":  "Read and write your virtual events",
|                                             "Description":  "Allows the app to read and write virtual events for you",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to user\u0027s own virtual events; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "VirtualEventRegistration-Anon.ReadWrite.All",
|                                             "DisplayName":  "Read and write anonymous users\u0027 virtual event registrations",
|                                             "Description":  "Allows the app to read and write anonymous users\u0027 virtual event registrations, without a signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to anonymous virtual event registrations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Warehouse.Execute.All",
|                                             "DisplayName":  "Execute warehouses",
|                                             "Description":  "Allows executing warehouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute warehouses on user\u0027s behalf; no direct identity plane or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Warehouse.ExternalDataShare.All",
|                                             "DisplayName":  "Allows the app to create and manage external data shares for all warehouses",
|                                             "Description":  "Allows the app to create and manage external data shares for all warehouses, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage external data shares on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Warehouse.Read.All",
|                                             "DisplayName":  "Read warehouses",
|                                             "Description":  "Allows reading warehouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to warehouses on user\u0027s behalf; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Warehouse.ReadWrite.All",
|                                             "DisplayName":  "Read and write warehouses",
|                                             "Description":  "Allows modifying warehouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify warehouses on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Warehouse.Reshare.All",
|                                             "DisplayName":  "Warehouse.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but delegated warehouse reshare likely data plane only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Warehouse.Restore.All",
|                                             "DisplayName":  "Make API calls that require restore permissions on all Warehouses",
|                                             "Description":  "Allows the app to make API calls that require restore permissions on all Warehouses, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Restore permissions on warehouses on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "WarehouseSnapshot.Execute.All",
|                                             "DisplayName":  "WarehouseSnapshot.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but delegated execute likely data plane only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "WarehouseSnapshot.Read.All",
|                                             "DisplayName":  "Read warehouse snapshots",
|                                             "Description":  "Allows reading warehouse snapshots on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read warehouse snapshots on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "WarehouseSnapshot.ReadWrite.All",
|                                             "DisplayName":  "Read and write warehouse snapshots",
|                                             "Description":  "Allows modifying warehouse snapshots on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify warehouse snapshots on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "WarehouseSnapshot.Reshare.All",
|                                             "DisplayName":  "WarehouseSnapshot.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but delegated reshare likely data plane only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "WindowsUpdates.Read.All",
|                                             "DisplayName":  "Read all Windows update deployment settings",
|                                             "Description":  "Allows the app to read all Windows update deployment settings for the organization without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Windows update deployment settings; no role assignment or credential reset capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "WindowsUpdates.ReadWrite.All",
|                                             "DisplayName":  "Read and write all Windows update deployment settings",
|                                             "Description":  "Allows the app to read and write all Windows update deployment settings for the organization on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write Windows update deployment settings; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "WorkforceIntegration.Read.All",
|                                             "DisplayName":  "Read workforce integrations",
|                                             "Description":  "Allows the app to read workforce integrations, to synchronize data from Microsoft Teams Shifts, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read workforce integrations on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "WorkforceIntegration.ReadWrite.All",
|                                             "DisplayName":  "Read and write workforce integrations",
|                                             "Description":  "Allows the app to manage workforce integrations, to synchronize data from Microsoft Teams Shifts, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage workforce integrations on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Workspace.GitCommit.All",
|                                             "DisplayName":  "Make API calls that commit workspace content and setting to remote git repository.",
|                                             "Description":  "Allows the app to make API calls that commit workspace content and setting to remote git repository, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Commit workspace content to git on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Workspace.GitUpdate.All",
|                                             "DisplayName":  "Make API calls that update workspace content and setting from remote git repository.",
|                                             "Description":  "Allows the app to make API calls that update workspace content and setting from remote git repository, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Update workspace content from git on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Workspace.Read.All",
|                                             "DisplayName":  "View all workspaces",
|                                             "Description":  "The app can view all workspaces that the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "View all workspaces user has access to; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Workspace.ReadWrite.All",
|                                             "DisplayName":  "Read and write all workspaces",
|                                             "Description":  "The app can view and edit all workspaces that the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "View and edit all workspaces user has access to; no identity plane control."
|                                         }
|                                     ],
|    "EntraID_APIPermissions_Catalog":  [
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d07a8cc0-3d51-4b77-b3b0-32704d1f69fa",
|                                               "Value":  "AccessReview.Read.All",
|                                               "DisplayName":  "Read all access reviews",
|                                               "Description":  "Allows the app to read access reviews, reviewers, decisions and settings in the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ef5f7d5c-338f-44b0-86c3-351f46c8bb5f",
|                                               "Value":  "AccessReview.ReadWrite.All",
|                                               "DisplayName":  "Manage all access reviews",
|                                               "Description":  "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "18228521-a591-40f1-b215-5fad4488c117",
|                                               "Value":  "AccessReview.ReadWrite.Membership",
|                                               "DisplayName":  "Manage access reviews for group and app memberships",
|                                               "Description":  "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization for group and app memberships, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8c0aed2c-0c61-433d-b63c-6370ddc73248",
|                                               "Value":  "Acronym.Read.All",
|                                               "DisplayName":  "Read all acronyms",
|                                               "Description":  "Allows an app to read all acronyms without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "134fd756-38ce-4afd-ba33-e9623dbe66c2",
|                                               "Value":  "AdministrativeUnit.Read.All",
|                                               "DisplayName":  "Read all administrative units",
|                                               "Description":  "Allows the app to read administrative units and administrative unit membership without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5eb59dd3-1da2-4329-8733-9dabdc435916",
|                                               "Value":  "AdministrativeUnit.ReadWrite.All",
|                                               "DisplayName":  "Read and write all administrative units",
|                                               "Description":  "Allows the app to create, read, update, and delete administrative units and manage administrative unit membership without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9c4a07db-e0c1-4fb0-8e85-dfd8ae3b8201",
|                                               "Value":  "AgentCard.ReadWrite.ManagedBy",
|                                               "DisplayName":  "Read and write managed-by agent cards in Agent Registry",
|                                               "Description":  "Allows the app to read and update agent cards that designate the calling app as their manager and manage their skills in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3ee18438-e6e5-4858-8f1c-d7b723b45213",
|                                               "Value":  "AgentCardManifest.Read.All",
|                                               "DisplayName":  "Read all agent card manifests in Agent Registry",
|                                               "Description":  "Allows the app to read all agent card manifests in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "228b1a03-f7ca-4348-b50d-e8a547ab61af",
|                                               "Value":  "AgentCardManifest.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent card manifests in Agent Registry",
|                                               "Description":  "Allows the app to read and write to all agent card manifests in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "77f6034c-52f5-4526-9fa1-d55a67e72cc4",
|                                               "Value":  "AgentCardManifest.ReadWrite.ManagedBy",
|                                               "DisplayName":  "Read and write managed-by agent card manifests in Agent Registry",
|                                               "Description":  "Allows the app to read and write agent card manifests that name it as manager in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e65ee1da-d1d5-467b-bdd0-3e9bb94e6e0c",
|                                               "Value":  "AgentCollection.Read.All",
|                                               "DisplayName":  "Read all collections in Agent Registry",
|                                               "Description":  "Allows the app to read all collections and their membership in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "feb31d7d-a227-4487-898c-e014840d07b3",
|                                               "Value":  "AgentCollection.ReadWrite.All",
|                                               "DisplayName":  "Read and write all collections in Agent Registry",
|                                               "Description":  "Allows the app to create, read, update, and delete all collections and manage their membership in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2e0fb698-9996-479f-926b-ce63f4397829",
|                                               "Value":  "AgentCollection.ReadWrite.ManagedBy",
|                                               "DisplayName":  "Read and write managed-by collections in Agent Registry",
|                                               "Description":  "Allows the app to create, read, update, and delete collections that designate the calling app as their manager and manage their membership in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ad25cc1d-84d8-47df-a08e-b34c2e800819",
|                                               "Value":  "AgentIdentity.Create.All",
|                                               "DisplayName":  "Create agent identities without an agent blueprint parent",
|                                               "Description":  "Allows the app to create agent identities, even if the app is not the parent agent identity blueprint."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4c390976-b2b7-42e0-9187-c6be3bead001",
|                                               "Value":  "AgentIdentity.CreateAsManager",
|                                               "DisplayName":  "Create agent identities linked to itself.",
|                                               "Description":  "Allows the app to create linked agent identities without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5b016f9b-18eb-41d4-869a-66931914d1c8",
|                                               "Value":  "AgentIdentity.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore agent identities",
|                                               "Description":  "Allows the app to delete and restore agent identities without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "69ee0943-4fa4-4ec8-8e52-d12e4ea661a3",
|                                               "Value":  "AgentIdentity.EnableDisable.All",
|                                               "DisplayName":  "Enable or disable agent identities",
|                                               "Description":  "Allows the app to enable or disable agent identities without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b2b8f011-2898-4234-9092-5059f6c1ebfa",
|                                               "Value":  "AgentIdentity.Read.All",
|                                               "DisplayName":  "Read all agent identities",
|                                               "Description":  "Allows the app to read all agent identities without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dcf7150a-88d4-4fe6-9be1-c2744c455397",
|                                               "Value":  "AgentIdentity.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent identities",
|                                               "Description":  "Allows the app read, update, and delete agent identities without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0510736e-bdfb-4b37-9a1f-89b4a074763a",
|                                               "Value":  "AgentIdentityBlueprint.AddRemoveCreds.All",
|                                               "DisplayName":  "Update agent identity blueprint credentials",
|                                               "Description":  "Allows updating agent identity blueprint credentials without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ea4b2453-ad2d-4d94-9155-10d5d9493ce9",
|                                               "Value":  "AgentIdentityBlueprint.Create",
|                                               "DisplayName":  "Create agent identity blueprints.",
|                                               "Description":  "Allows creating new agent identity blueprints without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3f80b699-6405-4e36-a4df-4f19950ff91e",
|                                               "Value":  "AgentIdentityBlueprint.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore agent identity blueprints.",
|                                               "Description":  "Allows deleting or restoring agent identity blueprints without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7547a7d1-36fa-4479-9c31-559a600eaa4f",
|                                               "Value":  "AgentIdentityBlueprint.Read.All",
|                                               "DisplayName":  "Read all agent identity blueprints",
|                                               "Description":  "Allows the app to read all agent identity blueprints without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7fddd33b-d884-4ec0-8696-72cff90ff825",
|                                               "Value":  "AgentIdentityBlueprint.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent identity blueprints.",
|                                               "Description":  "Allows the app to read, update, and delete agent identity blueprints without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "19202363-278e-49c2-bf00-391e2ba00881",
|                                               "Value":  "AgentIdentityBlueprint.UpdateAuthProperties.All",
|                                               "DisplayName":  "Update agent identity blueprint authorization and authentication properties",
|                                               "Description":  "Allows updating agent identity blueprint authorization and authentication properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "76232daa-a1e4-4544-b664-495a006513bf",
|                                               "Value":  "AgentIdentityBlueprint.UpdateBranding.All",
|                                               "DisplayName":  "Update agent identity blueprint branding",
|                                               "Description":  "Allows updating agent identity blueprint branding without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8959696d-d07e-4916-9b1e-3ba9ce459161",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.Create",
|                                               "DisplayName":  "Create agent identity blueprint service principals.",
|                                               "Description":  "Allows creating new agent identity blueprint principals without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f86a2dd8-9298-4675-bd78-f5a3572da2d7",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore agent identity blueprints.",
|                                               "Description":  "Allows deleting or restoring agent identity blueprints without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a0bdd23d-8b19-4682-b428-574d96527c6f",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.EnableDisable.All",
|                                               "DisplayName":  "Enable or disable agent identity blueprint principals.",
|                                               "Description":  "Allows enabling or disabling agent identity blueprint principals without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9361dea9-4524-493d-941d-f1b65aaf6c7c",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.Read.All",
|                                               "DisplayName":  "Read agent identity blueprint principals.",
|                                               "Description":  "Allows reading agent identity blueprint principals without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3bc933bc-8b4d-4cb6-ac49-b73774299250",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent identity blueprint principals.",
|                                               "Description":  "Allows the app to read, update, and delete agent identity blueprint principals without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b782c9ad-6f2b-4894-a21b-72bf22417f0a",
|                                               "Value":  "AgentIdUser.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent ID users\u0027 full profiles",
|                                               "Description":  "Allows the app to read and update agent ID user profiles and read basic company properties without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4aa6e624-eee0-40ab-bdd8-f9639038a614",
|                                               "Value":  "AgentIdUser.ReadWrite.IdentityParentedBy",
|                                               "DisplayName":  "Read and write all agent ID users\u0027 full profiles",
|                                               "Description":  "Allows the app to read and update ID agent user profiles and read basic company properties without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "799a4732-85b8-4c67-b048-75f0e88a232b",
|                                               "Value":  "AgentInstance.Read.All",
|                                               "DisplayName":  "Read all agent instances in Agent Registry",
|                                               "Description":  "Allows the app to read all agent instances and their related collections in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "07abdd95-78dc-4353-bd32-09f880ea43d0",
|                                               "Value":  "AgentInstance.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent instances in Agent Registry",
|                                               "Description":  "Allows the app to create, read, update, and delete all agent instances in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "782ab1bf-24f1-4c27-8bbc-2006d42792a6",
|                                               "Value":  "AgentInstance.ReadWrite.ManagedBy",
|                                               "DisplayName":  "Read and write managed-by agent instances in Agent Registry",
|                                               "Description":  "Allows the app to create, read, update, and delete agent instances that designate the calling app as their manager in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d3acceb6-4673-47c0-aeac-582f2c7cf72c",
|                                               "Value":  "AgentRegistration.Read.All",
|                                               "DisplayName":  "Read all agent registrations",
|                                               "Description":  "Allows the app to read agent registration information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "39fb8c64-7bd3-4107-8515-14d6e55ddda4",
|                                               "Value":  "AgentRegistration.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent registrations",
|                                               "Description":  "Allows the app to read and write agent registration information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2f3e6f8c-093b-4c57-a58b-ba5ce494a169",
|                                               "Value":  "Agreement.Read.All",
|                                               "DisplayName":  "Read all terms of use agreements",
|                                               "Description":  "Allows the app to read terms of use agreements, without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c9090d00-6101-42f0-a729-c41074260d47",
|                                               "Value":  "Agreement.ReadWrite.All",
|                                               "DisplayName":  "Read and write all terms of use agreements",
|                                               "Description":  "Allows the app to read and write terms of use agreements, without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d8e4ec18-f6c0-4620-8122-c8b1f2bf400e",
|                                               "Value":  "AgreementAcceptance.Read.All",
|                                               "DisplayName":  "Read all terms of use acceptance statuses",
|                                               "Description":  "Allows the app to read terms of use acceptance statuses, without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "839c90ab-5771-41ee-aef8-a562e8487c1e",
|                                               "Value":  "AiEnterpriseInteraction.Read.All",
|                                               "DisplayName":  "Read all AI enterprise interactions.",
|                                               "Description":  "Allows the app to read all AI enterprise interactions."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b86848a7-d5b1-41eb-a9b4-54a4e6306e97",
|                                               "Value":  "APIConnectors.Read.All",
|                                               "DisplayName":  "Read API connectors for authentication flows",
|                                               "Description":  "Allows the app to read the API connectors used in user authentication flows, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1dfe531a-24a6-4f1b-80f4-7a0dc5a0a171",
|                                               "Value":  "APIConnectors.ReadWrite.All",
|                                               "DisplayName":  "Read and write API connectors for authentication flows",
|                                               "Description":  "Allows the app to read, create and manage the API connectors used in user authentication flows, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e12dae10-5a57-4817-b79d-dfbec5348930",
|                                               "Value":  "AppCatalog.Read.All",
|                                               "DisplayName":  "Read all app catalogs",
|                                               "Description":  "Allows the app to read apps in the app catalogs without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dc149144-f292-421e-b185-5953f2e98d7f",
|                                               "Value":  "AppCatalog.ReadWrite.All",
|                                               "DisplayName":  "Read and write to all app catalogs",
|                                               "Description":  "Allows the app to create, read, update, and delete apps in the app catalogs without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3be0012a-cc4e-426b-895b-f9c836bf6381",
|                                               "Value":  "Application-RemoteDesktopConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write the remote desktop security configuration for all apps",
|                                               "Description":  "Allows the app to read and write the remote desktop security configuration for all apps in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9a5d68dd-52b0-4cc2-bd40-abcf44ac3a30",
|                                               "Value":  "Application.Read.All",
|                                               "DisplayName":  "Read all applications",
|                                               "Description":  "Allows the app to read all applications and service principals without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fc023787-fd04-4e44-9bc7-d454f00c0f0a",
|                                               "Value":  "Application.ReadUpdate.All",
|                                               "DisplayName":  "Read and update all apps",
|                                               "Description":  "Allows the app to read and update all apps in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9",
|                                               "Value":  "Application.ReadWrite.All",
|                                               "DisplayName":  "Read and write all applications",
|                                               "Description":  "Allows the app to create, read, update and delete applications and service principals without a signed-in user.  Does not allow management of consent grants."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "18a4783c-866b-4cc7-a460-3d5e5662c884",
|                                               "Value":  "Application.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Manage apps that this app creates or owns",
|                                               "Description":  "Allows the app to create other applications, and fully manage those applications (read, update, update application secrets and delete), without a signed-in user.  It cannot update any apps that it is not an owner of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "06b708a9-e830-4db3-a914-8e69da51d44f",
|                                               "Value":  "AppRoleAssignment.ReadWrite.All",
|                                               "DisplayName":  "Manage app permission grants and app role assignments",
|                                               "Description":  "Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9f265de7-8d5e-4e9a-a805-5e8bbc49656f",
|                                               "Value":  "ApprovalSolution.Read.All",
|                                               "DisplayName":  "Read all approvals",
|                                               "Description":  "Allows the app to read all approvals and approval item subscriptions, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "45583558-1113-4d06-8969-e79a28edc9ad",
|                                               "Value":  "ApprovalSolution.ReadWrite.All",
|                                               "DisplayName":  "Read all approvals and manage approval subscriptions",
|                                               "Description":  "Allows the app to read all approvals and create, update, or remove approval item subscriptions, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "93283d0a-6322-4fa8-966b-8c121624760d",
|                                               "Value":  "AttackSimulation.Read.All",
|                                               "DisplayName":  "Read attack simulation data of an organization",
|                                               "Description":  "Allows the app to read attack simulation and training data for an organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e125258e-8c8a-42a8-8f55-ab502afa52f3",
|                                               "Value":  "AttackSimulation.ReadWrite.All",
|                                               "DisplayName":  "Read, create, and update all attack simulation data of an organization",
|                                               "Description":  "Allows the app to read, create, and update attack simulation and training data for an organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "99bc85fb-e857-4220-9f8c-3a1c83148d2e",
|                                               "Value":  "AuditActivity.Read",
|                                               "DisplayName":  "Read activity audit log from the audit store.",
|                                               "Description":  "Read activity audit log from the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f6318678-2713-4bb6-b123-233e7336c1bd",
|                                               "Value":  "AuditActivity.Write",
|                                               "DisplayName":  "Upload activity audit logs to the audit store.",
|                                               "Description":  "Allows the application to upload bulk activity audit logs to the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b0afded3-3588-46d8-8b3d-9842eff778da",
|                                               "Value":  "AuditLog.Read.All",
|                                               "DisplayName":  "Read all audit log data",
|                                               "Description":  "Allows the app to read and query your audit log activities, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "20e6f8e4-ffac-4cf7-82f7-70ddb7564318",
|                                               "Value":  "AuditLogsQuery-CRM.Read.All",
|                                               "DisplayName":  "Read audit logs data from Dynamics CRM workload",
|                                               "Description":  "Allows the app to read and query audit logs from Dynamics CRM workload, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0bc85aed-7b0b-437a-bac8-3b29a1b84c99",
|                                               "Value":  "AuditLogsQuery-Endpoint.Read.All",
|                                               "DisplayName":  "Read audit logs data from Endpoint Data Loss Prevention workload",
|                                               "Description":  "Allows the app to read and query audit logs from Endpoint Data Loss Prevention workload, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7276d950-48fc-4269-8348-f22f2bb296d0",
|                                               "Value":  "AuditLogsQuery-Entra.Read.All",
|                                               "DisplayName":  "Read audit logs data from Entra (Azure AD) workload",
|                                               "Description":  "Allows the app to read and query audit logs from Entra (Azure AD) workload, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6b0d2622-d34e-4470-935b-b96550e5ca8d",
|                                               "Value":  "AuditLogsQuery-Exchange.Read.All",
|                                               "DisplayName":  "Read audit logs data from Exchange workload",
|                                               "Description":  "Allows the app to read and query audit logs from Exchange workload, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8a169a81-841c-45fd-ad43-96aede8801a0",
|                                               "Value":  "AuditLogsQuery-OneDrive.Read.All",
|                                               "DisplayName":  "Read audit logs data from OneDrive workload",
|                                               "Description":  "Allows the app to read and query audit logs from OneDrive workload, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "91c64a47-a524-4fce-9bf3-3d569a344ecf",
|                                               "Value":  "AuditLogsQuery-SharePoint.Read.All",
|                                               "DisplayName":  "Read audit logs data from SharePoint workload",
|                                               "Description":  "Allows the app to read and query audit logs from SharePoint workload, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5e1e9171-754d-478c-812c-f1755a9a4c2d",
|                                               "Value":  "AuditLogsQuery.Read.All",
|                                               "DisplayName":  "Read audit logs data from all services",
|                                               "Description":  "Allows the app to read and query audit logs from all services."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "381f742f-e1f8-4309-b4ab-e3d91ae4c5c1",
|                                               "Value":  "AuthenticationContext.Read.All",
|                                               "DisplayName":  "Read all authentication context information",
|                                               "Description":  "Allows the app to read the authentication context information in your organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a88eef72-fed0-4bf7-a2a9-f19df33f8b83",
|                                               "Value":  "AuthenticationContext.ReadWrite.All",
|                                               "DisplayName":  "Read and write all authentication context information",
|                                               "Description":  "Allows the app to read and update the authentication context information in your organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5fbb5982-3230-4882-93c0-2167523ce0c2",
|                                               "Value":  "BackupRestore-Configuration.Read.All",
|                                               "DisplayName":  "Read all backup configuration policies",
|                                               "Description":  "Allows the app to read all backup configurations, and lists of Microsoft 365 service resources to be backed-up, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "18133149-5489-40ac-80f0-4b6fa85f6cdc",
|                                               "Value":  "BackupRestore-Configuration.ReadWrite.All",
|                                               "DisplayName":  "Read and edit all backup configuration policies",
|                                               "Description":  "Allows the app to read and update the backup configuration, and list of Microsoft 365 service resources to be backed-up, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6fe20a79-0e15-45a1-b019-834c125993a0",
|                                               "Value":  "BackupRestore-Control.Read.All",
|                                               "DisplayName":  "Read the status of the M365 backup service",
|                                               "Description":  "Allows the app to read the status of M365 backup service (enable/disable), without signed in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fb240865-88f8-4a1d-923f-98dbc7920860",
|                                               "Value":  "BackupRestore-Control.ReadWrite.All",
|                                               "DisplayName":  "Update or read the status of the M365 backup service",
|                                               "Description":  "Allows the app to update or read the status of M365 backup service (enable/disable), without signed in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ecae8511-f2d7-4be4-bdbf-91f244d45986",
|                                               "Value":  "BackupRestore-Monitor.Read.All",
|                                               "DisplayName":  "Read all monitoring, quota and billing information for the tenant",
|                                               "Description":  "Allows the app to monitor all backup and restore jobs, view quota usage and billing details, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "87853aa5-0372-4710-b34b-cef27bb7156e",
|                                               "Value":  "BackupRestore-Restore.Read.All",
|                                               "DisplayName":  "Read all restore sessions",
|                                               "Description":  "Allows the app to read all restore sessions, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bebd0841-a3d8-4313-a51d-731112c8ee41",
|                                               "Value":  "BackupRestore-Restore.ReadWrite.All",
|                                               "DisplayName":  "Read restore all sessions and start restore sessions from backups",
|                                               "Description":  "Allows the app to search all backup snapshots for Microsoft 365 resources, and restore Microsoft 365 resources from a backed-up snapshot, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f6135c51-c766-4be1-9638-ed90c2ed2443",
|                                               "Value":  "BackupRestore-Search.Read.All",
|                                               "DisplayName":  "Search for metadata properties in all backup snapshots",
|                                               "Description":  "Allows the app to search all backup snapshots for Microsoft 365 resources, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9e8be751-7eee-4c09-bcfd-d64f6b087fd8",
|                                               "Value":  "BillingConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write application billing configuration",
|                                               "Description":  "Allows the app to read and write the billing configuration on all applications without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "57f1cf28-c0c4-4ec3-9a30-19a2eaaf2f6e",
|                                               "Value":  "BitlockerKey.Read.All",
|                                               "DisplayName":  "Read all BitLocker keys",
|                                               "Description":  "Allows an app to read BitLocker keys for all devices, without a signed-in user. Allows read of the recovery key."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f690d423-6b29-4d04-98c6-694c42282419",
|                                               "Value":  "BitlockerKey.ReadBasic.All",
|                                               "DisplayName":  "Read all BitLocker keys basic information",
|                                               "Description":  "Allows an app to read basic BitLocker key properties for all devices, without a signed-in user. Does not allow read of the recovery key."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6b22000a-1228-42ec-88db-b8c00399aecb",
|                                               "Value":  "Bookings.Manage.All",
|                                               "DisplayName":  "Manage bookings information",
|                                               "Description":  "Allows an app to read, write and manage bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6e98f277-b046-4193-a4f2-6bf6a78cd491",
|                                               "Value":  "Bookings.Read.All",
|                                               "DisplayName":  "Read all Bookings related resources.",
|                                               "Description":  "Allows an app to read Bookings appointments, businesses, customers, services, and staff without a signed-in user.  "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0c4b2d20-7919-468d-8668-c54b09d4dee8",
|                                               "Value":  "Bookings.ReadWrite.All",
|                                               "DisplayName":  "Read and write bookings information",
|                                               "Description":  "Allows an app to read and write bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user. Does not allow create, delete and publish of booking businesses."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9769393e-5a9f-4302-9e3d-7e018ecb64a7",
|                                               "Value":  "BookingsAppointment.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Bookings related resources.",
|                                               "Description":  "Allows an app to read and write Bookings appointments and customers, and additionally allows reading businesses, services, and staff without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "be95e614-8ef3-49eb-8464-1c9503433b86",
|                                               "Value":  "Bookmark.Read.All",
|                                               "DisplayName":  "Read all bookmarks",
|                                               "Description":  "Allows an app to read all bookmarks without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c5ee1f21-fc7f-4937-9af0-c91648ff9597",
|                                               "Value":  "BrowserSiteLists.Read.All",
|                                               "DisplayName":  "Read all browser site lists for your organization",
|                                               "Description":  "Allows an app to read all browser site lists configured for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8349ca94-3061-44d5-9bfb-33774ea5e4f9",
|                                               "Value":  "BrowserSiteLists.ReadWrite.All",
|                                               "DisplayName":  "Read and write all browser site lists for your organization",
|                                               "Description":  "Allows an app to read and write all browser site lists configured for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "acc0fc4d-2cd6-4194-8700-1768d8423d86",
|                                               "Value":  "BusinessScenarioConfig.Read.OwnedBy",
|                                               "DisplayName":  "Read all business scenario configurations this app creates or owns",
|                                               "Description":  "Allows the app to read the configurations of business scenarios it owns, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bbea195a-4c47-4a4f-bff2-cba399e11698",
|                                               "Value":  "BusinessScenarioConfig.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write all business scenario configurations this app creates or owns",
|                                               "Description":  "Allows the app to create new business scenarios and fully manage the configurations of scenarios it owns, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6c0257fd-cffe-415b-8239-2d0d70fdaa9c",
|                                               "Value":  "BusinessScenarioData.Read.OwnedBy",
|                                               "DisplayName":  "Read data for all business scenarios this app creates or owns",
|                                               "Description":  "Allows the app to read the data associated with the business scenarios it owns, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f2d21f22-5d80-499e-91cc-0a8a4ce16f54",
|                                               "Value":  "BusinessScenarioData.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write data for all business scenarios this app creates or owns",
|                                               "Description":  "Allows the app to fully manage the data associated with the business scenarios it owns, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "798ee544-9d2d-430c-a058-570e29e34338",
|                                               "Value":  "Calendars.Read",
|                                               "DisplayName":  "Read calendars in all mailboxes",
|                                               "Description":  "Allows the app to read events of all calendars without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8ba4a692-bc31-4128-9094-475872af8a53",
|                                               "Value":  "Calendars.ReadBasic.All",
|                                               "DisplayName":  "Read basic details of calendars in all mailboxes ",
|                                               "Description":  "Allows the app to read events of all calendars, except for properties such as body, attachments, and extensions, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ef54d2bf-783f-4e0f-bca1-3210c0444d99",
|                                               "Value":  "Calendars.ReadWrite",
|                                               "DisplayName":  "Read and write calendars in all mailboxes",
|                                               "Description":  "Allows the app to create, read, update, and delete events of all calendars without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "792b782b-7822-4b92-8103-77e44f2f706c",
|                                               "Value":  "CallAiInsights.Read.All",
|                                               "DisplayName":  "Read all AI Insights for calls.",
|                                               "Description":  "Allows the app to read all AI Insights for all calls, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5aa33e77-b893-495e-bdc5-4bf6f27d42a0",
|                                               "Value":  "CallDelegation.Read.All",
|                                               "DisplayName":  "Read delegation settings",
|                                               "Description":  "Allows the app to read delegation settings of you"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8d06abce-e69b-4122-ba60-4f901bb1db2f",
|                                               "Value":  "CallDelegation.ReadWrite.All",
|                                               "DisplayName":  "Read and write delegation settings",
|                                               "Description":  "Allows the app to read and write delegation settings of you"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f0a35f91-2aa6-4a99-9d5a-5b6bcb66204e",
|                                               "Value":  "CallEvents-Emergency.Read.All",
|                                               "DisplayName":  "Read all emergency call events",
|                                               "Description":  "Allows the app to read emergency call event information for all users in your organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1abb026f-7572-49f6-9ddd-ad61cbba181e",
|                                               "Value":  "CallEvents.Read.All",
|                                               "DisplayName":  "Read all call events",
|                                               "Description":  "Allows the app to read call event information for all users in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a2611786-80b3-417e-adaa-707d4261a5f0",
|                                               "Value":  "CallRecord-PstnCalls.Read.All",
|                                               "DisplayName":  "Read PSTN and direct routing call log data",
|                                               "Description":  "Allows the app to read all PSTN and direct routing call log data without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ce8fb1f1-5e1f-44a0-b102-4ec28454d0dc",
|                                               "Value":  "CallRecordings.Read.All",
|                                               "DisplayName":  "Read all call recordings",
|                                               "Description":  "Allows the app to read call recordings for all calls without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "45bbb07e-7321-4fd7-a8f6-3ff27e6a81c8",
|                                               "Value":  "CallRecords.Read.All",
|                                               "DisplayName":  "Read all call records",
|                                               "Description":  "Allows the app to read call records for all calls and online meetings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a7a681dc-756e-4909-b988-f160edc6655f",
|                                               "Value":  "Calls.AccessMedia.All",
|                                               "DisplayName":  "Access media streams in a call as an app",
|                                               "Description":  "Allows the app to get direct access to media streams in a call, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "284383ee-7f6e-4e40-a2a8-e85dcb029101",
|                                               "Value":  "Calls.Initiate.All",
|                                               "DisplayName":  "Initiate outgoing 1 to 1 calls from the app",
|                                               "Description":  "Allows the app to place outbound calls to a single user and transfer calls to users in your organization’s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4c277553-8a09-487b-8023-29ee378d8324",
|                                               "Value":  "Calls.InitiateGroupCall.All",
|                                               "DisplayName":  "Initiate outgoing group calls from the app",
|                                               "Description":  "Allows the app to place outbound calls to multiple users and add participants to meetings in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f6b49018-60ab-4f81-83bd-22caeabfed2d",
|                                               "Value":  "Calls.JoinGroupCall.All",
|                                               "DisplayName":  "Join group calls and meetings as an app",
|                                               "Description":  "Allows the app to join group calls and scheduled meetings in your organization, without a signed-in user.  The app will be joined with the privileges of a directory user to meetings in your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fd7ccf6b-3d28-418b-9701-cd10f5cd2fd4",
|                                               "Value":  "Calls.JoinGroupCallAsGuest.All",
|                                               "DisplayName":  "Join group calls and meetings as a guest",
|                                               "Description":  "Allows the app to anonymously join group calls and scheduled meetings in your organization, without a signed-in user.  The app will be joined as a guest to meetings in your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4cd61b6d-8692-40bf-9d90-7f38db5e5fce",
|                                               "Value":  "CallTranscripts.Read.All",
|                                               "DisplayName":  "Read all call transcripts",
|                                               "Description":  "Allows the app to read call transcripts for all calls without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "418dae40-2b65-4819-900c-519a04e4d278",
|                                               "Value":  "ChangeManagement.Read.All",
|                                               "DisplayName":  "Read Change Management items",
|                                               "Description":  "Allows to read all Change Management items."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f3a65bd4-b703-46df-8f7e-0174fea562aa",
|                                               "Value":  "Channel.Create",
|                                               "DisplayName":  "Create channels",
|                                               "Description":  "Create channels in any team, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6a118a39-1227-45d4-af0c-ea7b40d210bc",
|                                               "Value":  "Channel.Delete.All",
|                                               "DisplayName":  "Delete channels",
|                                               "Description":  "Delete channels in any team, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "59a6b24b-4225-4393-8165-ebaec5f55d7a",
|                                               "Value":  "Channel.ReadBasic.All",
|                                               "DisplayName":  "Read the names and descriptions  of all channels",
|                                               "Description":  "Read all channel names and channel descriptions, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3b55498e-47ec-484f-8136-9013221c06a9",
|                                               "Value":  "ChannelMember.Read.All",
|                                               "DisplayName":  "Read the members of all channels",
|                                               "Description":  "Read the members of all channels, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "35930dcf-aceb-4bd1-b99a-8ffed403c974",
|                                               "Value":  "ChannelMember.ReadWrite.All",
|                                               "DisplayName":  "Add and remove members from all channels",
|                                               "Description":  "Add and remove members from all channels, without a signed-in user. Also allows changing a member\u0027s role, for example from owner to non-owner."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7b2449af-6ccd-4f4d-9f78-e550c193f0d1",
|                                               "Value":  "ChannelMessage.Read.All",
|                                               "DisplayName":  "Read all channel messages",
|                                               "Description":  "Allows the app to read all channel messages in Microsoft Teams"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4d02b0cc-d90b-441f-8d82-4fb55c34d6bb",
|                                               "Value":  "ChannelMessage.UpdatePolicyViolation.All",
|                                               "DisplayName":  "Flag channel messages for violating policy",
|                                               "Description":  "Allows the app to update Microsoft Teams channel messages by patching a set of Data Loss Prevention (DLP) policy violation properties to handle the output of DLP processing."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c97b873f-f59f-49aa-8a0e-52b32d762124",
|                                               "Value":  "ChannelSettings.Read.All",
|                                               "DisplayName":  "Read the names, descriptions, and settings of all channels",
|                                               "Description":  "Read all channel names, channel descriptions, and channel settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "243cded2-bd16-4fd6-a953-ff8177894c3d",
|                                               "Value":  "ChannelSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write the names, descriptions, and settings of all channels",
|                                               "Description":  "Read and write the names, descriptions, and settings of all channels, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d9c48af6-9ad9-47ad-82c3-63757137b9af",
|                                               "Value":  "Chat.Create",
|                                               "DisplayName":  "Create chats",
|                                               "Description":  "Allows the app to create chats without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9c7abde0-eacd-4319-bf9e-35994b1a1717",
|                                               "Value":  "Chat.ManageDeletion.All",
|                                               "DisplayName":  "Delete and recover deleted chats",
|                                               "Description":  "Allows the app to delete and recover deleted chats, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6b7d71aa-70aa-4810-a8d9-5d9fb2830017",
|                                               "Value":  "Chat.Read.All",
|                                               "DisplayName":  "Read all chat messages",
|                                               "Description":  "Allows the app to read all 1-to-1 or group chat messages in Microsoft Teams."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1c1b4c8e-3cc7-4c58-8470-9b92c9d5848b",
|                                               "Value":  "Chat.Read.WhereInstalled",
|                                               "DisplayName":  "Read all chat messages for chats where the associated Teams application is installed.",
|                                               "Description":  "Allows the app to read all one-to-one or group chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b2e060da-3baf-4687-9611-f4ebc0f0cbde",
|                                               "Value":  "Chat.ReadBasic.All",
|                                               "DisplayName":  "Read names and members of all chat threads",
|                                               "Description":  "Read names and members of all one-to-one and group chats in Microsoft Teams, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "818ba5bd-5b3e-4fe0-bbe6-aa4686669073",
|                                               "Value":  "Chat.ReadBasic.WhereInstalled",
|                                               "DisplayName":  "Read names and members of all chat threads where the associated Teams application is installed.",
|                                               "Description":  "Allows the app to read names and members of all one-to-one and group chats in Microsoft Teams where the associated Teams application is installed, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "294ce7c9-31ba-490a-ad7d-97a7d075e4ed",
|                                               "Value":  "Chat.ReadWrite.All",
|                                               "DisplayName":  "Read and write all chat messages",
|                                               "Description":  "Allows an app to read and write all chat messages in Microsoft Teams, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ad73ce80-f3cd-40ce-b325-df12c33df713",
|                                               "Value":  "Chat.ReadWrite.WhereInstalled",
|                                               "DisplayName":  "Read and write all chat messages for chats where the associated Teams application is installed.",
|                                               "Description":  "Allows the app to read and write all chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7e847308-e030-4183-9899-5235d7270f58",
|                                               "Value":  "Chat.UpdatePolicyViolation.All",
|                                               "DisplayName":  "Flag chat messages for violating policy",
|                                               "Description":  "Allows the app to update Microsoft Teams 1-to-1 or group chat messages by patching a set of Data Loss Prevention (DLP) policy violation properties to handle the output of DLP processing."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a3410be2-8e48-4f32-8454-c29a7465209d",
|                                               "Value":  "ChatMember.Read.All",
|                                               "DisplayName":  "Read the members of all chats",
|                                               "Description":  "Read the members of all chats, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "93e7c9e4-54c5-4a41-b796-f2a5adaacda7",
|                                               "Value":  "ChatMember.Read.WhereInstalled",
|                                               "DisplayName":  "Read the members of all chats where the associated Teams application is installed.",
|                                               "Description":  "Allows the app to read the members of all chats where the associated Teams application is installed, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "57257249-34ce-4810-a8a2-a03adf0c5693",
|                                               "Value":  "ChatMember.ReadWrite.All",
|                                               "DisplayName":  "Add and remove members from all chats",
|                                               "Description":  "Add and remove members from all chats, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e32c2cd9-0124-4e44-88fc-772cd98afbdb",
|                                               "Value":  "ChatMember.ReadWrite.WhereInstalled",
|                                               "DisplayName":  "Add and remove members from all chats where the associated Teams application is installed.",
|                                               "Description":  "Allows the app to add and remove members from all chats where the associated Teams application is installed, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b9bb2381-47a4-46cd-aafb-00cb12f68504",
|                                               "Value":  "ChatMessage.Read.All",
|                                               "DisplayName":  "Read all chat messages",
|                                               "Description":  "Allows the app to read all one-to-one and group chats messages in Microsoft Teams, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "64a59178-dad3-4673-89db-84fdcd622fec",
|                                               "Value":  "CloudApp-Discovery.Read.All",
|                                               "DisplayName":  "Read all discovered cloud applications data",
|                                               "Description":  "Allows the app to read all details of discovered cloud apps in the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a9e09520-8ed4-4cde-838e-4fdea192c227",
|                                               "Value":  "CloudPC.Read.All",
|                                               "DisplayName":  "Read Cloud PCs",
|                                               "Description":  "Allows the app to read the properties of Cloud PCs, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3b4349e1-8cf5-45a3-95b7-69d1751d3e6a",
|                                               "Value":  "CloudPC.ReadWrite.All",
|                                               "DisplayName":  "Read and write Cloud PCs",
|                                               "Description":  "Allows the app to read and write the properties of Cloud PCs, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "407f0cce-3212-441f-9f55-3bc91342cf86",
|                                               "Value":  "Community.Read.All",
|                                               "DisplayName":  "Read all Viva Engage communities",
|                                               "Description":  "Allows the app to list Viva Engage communities, and to read their properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "35d59e32-eab5-4553-9345-abb62b4c703c",
|                                               "Value":  "Community.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Viva Engage communities",
|                                               "Description":  "Allows the app to create Viva Engage communities, read all community properties, update community properties, and delete communities without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "aca929ec-9830-44dc-bda1-85cf938aaa95",
|                                               "Value":  "ConfigurationMonitoring.Read.All",
|                                               "DisplayName":  "Read all Configuration Monitoring entities",
|                                               "Description":  "Allows the app to read all Configuration Monitoring entities, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cfa85bfb-2ee8-4e13-8e7f-489e57a015a1",
|                                               "Value":  "ConfigurationMonitoring.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Configuration Monitoring entities",
|                                               "Description":  "Allows the app to read and write all Configuration Monitoring entities, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1260ad83-98fb-4785-abbb-d6cc1806fd41",
|                                               "Value":  "ConsentRequest.Read.All",
|                                               "DisplayName":  "Read all consent requests",
|                                               "Description":  "Allows the app to read consent requests and approvals without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9f1b81a7-0223-4428-bfa4-0bcb5535f27d",
|                                               "Value":  "ConsentRequest.ReadWrite.All",
|                                               "DisplayName":  "Read and write all consent requests",
|                                               "Description":  "Allows the app to read app consent requests and approvals, and deny or approve those requests without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c8948c23-e66b-42db-83fd-770b71ab78d2",
|                                               "Value":  "Contacts-OnPremisesSyncBehavior.ReadWrite.All",
|                                               "DisplayName":  "Read and update the on-premises sync behavior of contacts",
|                                               "Description":  "Allows the app to update the on-premises sync behavior of all contacts in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "089fe4d0-434a-44c5-8827-41ba8a0b17f5",
|                                               "Value":  "Contacts.Read",
|                                               "DisplayName":  "Read contacts in all mailboxes",
|                                               "Description":  "Allows the app to read all contacts in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6918b873-d17a-4dc1-b314-35f528134491",
|                                               "Value":  "Contacts.ReadWrite",
|                                               "DisplayName":  "Read and write contacts in all mailboxes",
|                                               "Description":  "Allows the app to create, read, update, and delete all contacts in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5ad511bf-571c-4ef6-8c3c-85b94b85df98",
|                                               "Value":  "Content.Process.All",
|                                               "DisplayName":  "Process content for data security, governance and compliance",
|                                               "Description":  "Allows the app to process and evaluate content for data security, governance and compliance outcomes at tenant scope."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "24ceb246-ad29-4680-90b4-3e91ffad15eb",
|                                               "Value":  "Content.Process.User",
|                                               "DisplayName":  "Process content for data security, governance and compliance",
|                                               "Description":  "Allows the app to process and evaluate content for data security, governance and compliance outcomes for a user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "368425e7-6954-4f5a-9d92-90b75bd580c9",
|                                               "Value":  "ContentActivity.Read",
|                                               "DisplayName":  "Read contents activity audit log from the audit store.",
|                                               "Description":  "Read contents activity audit log from the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2932e07a-3c29-44e4-bb36-6d0fc176387f",
|                                               "Value":  "ContentActivity.Write",
|                                               "DisplayName":  "Upload content activity audit logs to the audit store.",
|                                               "Description":  "Allows the application to upload bulk contents activity audit logs to the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f9af4646-98b0-4e9d-a53e-40d4f6452fc4",
|                                               "Value":  "Contracts.Read.All",
|                                               "DisplayName":  "Read contracts",
|                                               "Description":  "Allows the app to read available properties on contracts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "72f0655d-6228-4ddc-8e1b-164973b9213b",
|                                               "Value":  "CopilotPackages.Read.All",
|                                               "DisplayName":  "Read all packages information",
|                                               "Description":  "Allows the app to read packages information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ed31732f-9495-47ed-ba3b-4ed0948c1c64",
|                                               "Value":  "CopilotPackages.ReadWrite.All",
|                                               "DisplayName":  "Read and update all packages information",
|                                               "Description":  "Allows the app to read and update packages information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "556d5e2e-1081-4452-8147-26c3a1b06f58",
|                                               "Value":  "CopilotPolicySettings.Read",
|                                               "DisplayName":  "Read Copilot policy settings",
|                                               "Description":  "Allows the app to read Copilot policy settings for the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cc147c17-b8e8-4d3f-9f94-aa9e279a079a",
|                                               "Value":  "CopilotPolicySettings.ReadWrite",
|                                               "DisplayName":  "Read and write Copilot policy settings",
|                                               "Description":  "Allows the app to read and write Copilot policy settings for the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cac88765-0581-4025-9725-5ebc13f729ee",
|                                               "Value":  "CrossTenantInformation.ReadBasic.All",
|                                               "DisplayName":  "Read cross-tenant basic information",
|                                               "Description":  "Allows the application to obtain basic tenant information about another target tenant within the Azure AD ecosystem without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8b919d44-6192-4f3d-8a3b-f86f8069ae3c",
|                                               "Value":  "CrossTenantUserProfileSharing.Read.All",
|                                               "DisplayName":  "Read all shared cross-tenant user profiles and export their data",
|                                               "Description":  "Allows the application to list and query any shared user profile information associated with the current tenant without a signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "306785c5-c09b-4ba0-a4ee-023f3da165cb",
|                                               "Value":  "CrossTenantUserProfileSharing.ReadWrite.All",
|                                               "DisplayName":  "Read all shared cross-tenant user profiles and export or delete their data",
|                                               "Description":  "Allows the application to list and query any shared user profile information associated with the current tenant without a signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "88bb2658-5d9e-454f-aacd-a3933e079526",
|                                               "Value":  "CustomAuthenticationExtension.Read.All",
|                                               "DisplayName":  "Read all custom authentication extensions",
|                                               "Description":  "Allows the app to read your organization\u0027s custom authentication extensions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c2667967-7050-4e7e-b059-4cbbb3811d03",
|                                               "Value":  "CustomAuthenticationExtension.ReadWrite.All",
|                                               "DisplayName":  "Read and write all custom authentication extensions",
|                                               "Description":  "Allows the app to read or write your organization\u0027s custom authentication extensions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "214e810f-fda8-4fd7-a475-29461495eb00",
|                                               "Value":  "CustomAuthenticationExtension.Receive.Payload",
|                                               "DisplayName":  "Receive custom authentication extension HTTP requests",
|                                               "Description":  "Allows custom authentication extensions associated with the app to receive HTTP requests triggered by an authentication event. The request can include information about a user, client and resource service principals, and other information about the authentication."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "673a007a-9e0f-4c97-b066-3c0164486909",
|                                               "Value":  "CustomDetection.Read.All",
|                                               "DisplayName":  "Read all custom detection rules",
|                                               "Description":  "Allows the app to read custom detection rules without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e0fd9c8d-a12e-4cc9-9827-20c8c3cd6fb8",
|                                               "Value":  "CustomDetection.ReadWrite.All",
|                                               "DisplayName":  "Read and write all custom detection rules",
|                                               "Description":  "Allows the app to read and write custom detection rules without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3b37c5a4-1226-493d-bec3-5d6c6b866f3f",
|                                               "Value":  "CustomSecAttributeAssignment.Read.All",
|                                               "DisplayName":  "Read custom security attribute assignments",
|                                               "Description":  "Allows the app to read custom security attribute assignments for all principals in the tenant without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "de89b5e4-5b8f-48eb-8925-29c2b33bd8bd",
|                                               "Value":  "CustomSecAttributeAssignment.ReadWrite.All",
|                                               "DisplayName":  "Read and write custom security attribute assignments",
|                                               "Description":  "Allows the app to read and write custom security attribute assignments for all principals in the tenant without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2a4f026d-e829-4e84-bdbf-d981a2703059",
|                                               "Value":  "CustomSecAttributeAuditLogs.Read.All",
|                                               "DisplayName":  "Read all custom security attribute audit logs",
|                                               "Description":  "Allows the app to read all audit logs for events that contain information about custom security attributes, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b185aa14-d8d2-42c1-a685-0f5596613624",
|                                               "Value":  "CustomSecAttributeDefinition.Read.All",
|                                               "DisplayName":  "Read custom security attribute definitions",
|                                               "Description":  "Allows the app to read custom security attribute definitions for the tenant without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "12338004-21f4-4896-bf5e-b75dfaf1016d",
|                                               "Value":  "CustomSecAttributeDefinition.ReadWrite.All",
|                                               "DisplayName":  "Read and write custom security attribute definitions",
|                                               "Description":  "Allows the app to read and write custom security attribute definitions for the tenant without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9fd1f8bf-a443-4df6-bc2a-5d00c5ec7828",
|                                               "Value":  "CustomSecAttributeProvisioning.Read.All",
|                                               "DisplayName":  "Read the provisioning configuration of all active custom security attributes",
|                                               "Description":  "Allows the app to read the provisioning configuration of all active custom security attributes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1db69e9c-8d0a-498d-a5df-11fd0b68ceab",
|                                               "Value":  "CustomSecAttributeProvisioning.ReadWrite.All",
|                                               "DisplayName":  "Read and edit the provisioning configuration of all active custom security attributes",
|                                               "Description":  "Allows the app to read and edit the provisioning configuration of all active custom security attributes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ab8a5872-7c88-47a6-8141-7becce939190",
|                                               "Value":  "CustomTags.Read.All",
|                                               "DisplayName":  "Read all custom tags data",
|                                               "Description":  "Read custom tags data, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2f503208-e509-4e39-974c-8cc16e5785c9",
|                                               "Value":  "CustomTags.ReadWrite.All",
|                                               "DisplayName":  "Read and write custom tags data",
|                                               "Description":  "Read and write custom tags data, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f6e9e124-4586-492f-adc0-c6f96e4823fd",
|                                               "Value":  "DelegatedAdminRelationship.Read.All",
|                                               "DisplayName":  "Read Delegated Admin relationships with customers",
|                                               "Description":  "Allows the app to read details of delegated admin relationships with customers like access details (that includes roles) and the duration as well as specific role assignments to security groups without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cc13eba4-8cd8-44c6-b4d4-f93237adce58",
|                                               "Value":  "DelegatedAdminRelationship.ReadWrite.All",
|                                               "DisplayName":  "Manage Delegated Admin relationships with customers",
|                                               "Description":  "Allows the app to manage (create-update-terminate) Delegated Admin relationships with customers and role assignments to security groups for active Delegated Admin relationships without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "81b4724a-58aa-41c1-8a55-84ef97466587",
|                                               "Value":  "DelegatedPermissionGrant.Read.All",
|                                               "DisplayName":  "Read all delegated permission grants",
|                                               "Description":  "Allows the app to read all delegated permission grants, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8e8e4742-1d95-4f68-9d56-6ee75648c72a",
|                                               "Value":  "DelegatedPermissionGrant.ReadWrite.All",
|                                               "DisplayName":  "Manage all delegated permission grants",
|                                               "Description":  "Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7438b122-aefc-4978-80ed-43db9fcc7715",
|                                               "Value":  "Device.Read.All",
|                                               "DisplayName":  "Read all devices",
|                                               "Description":  "Allows the app to read your organization\u0027s devices\u0027 configuration information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1138cb37-bd11-4084-a2b7-9f71582aeddb",
|                                               "Value":  "Device.ReadWrite.All",
|                                               "DisplayName":  "Read and write devices",
|                                               "Description":  "Allows the app to read and write all device properties without a signed in user.  Does not allow device creation, device deletion or update of device alternative security identifiers."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "884b599e-4d48-43a5-ba94-15c414d00588",
|                                               "Value":  "DeviceLocalCredential.Read.All",
|                                               "DisplayName":  "Read device local credential passwords",
|                                               "Description":  "Allows the app to read device local credential properties including passwords, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "db51be59-e728-414b-b800-e0f010df1a79",
|                                               "Value":  "DeviceLocalCredential.ReadBasic.All",
|                                               "DisplayName":  "Read device local credential properties",
|                                               "Description":  "Allows the app to read device local credential properties excluding passwords, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7a6ee1e7-141e-4cec-ae74-d9db155731ff",
|                                               "Value":  "DeviceManagementApps.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune apps",
|                                               "Description":  "Allows the app to read the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "78145de6-330d-4800-a6ce-494ff2d33d07",
|                                               "Value":  "DeviceManagementApps.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune apps",
|                                               "Description":  "Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "315b6e8c-d92a-4691-919d-00ce76d1344a",
|                                               "Value":  "DeviceManagementCloudCA.Read.All",
|                                               "DisplayName":  "Read Microsoft Cloud PKI objects",
|                                               "Description":  "Allows the app to read certification authority information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f15eb2ba-ef8a-4f70-991d-da5d045154e2",
|                                               "Value":  "DeviceManagementCloudCA.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Cloud PKI objects",
|                                               "Description":  "Allows the app to read and write certification authority information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dc377aa6-52d8-4e23-b271-2a7ae04cedf3",
|                                               "Value":  "DeviceManagementConfiguration.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune device configuration and policies",
|                                               "Description":  "Allows the app to read properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9241abd9-d0e6-425a-bd4f-47ba86e767a4",
|                                               "Value":  "DeviceManagementConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune device configuration and policies",
|                                               "Description":  "Allows the app to read and write properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5b07b0dd-2377-4e44-a38d-703f09a0dc3c",
|                                               "Value":  "DeviceManagementManagedDevices.PrivilegedOperations.All",
|                                               "DisplayName":  "Perform user-impacting remote actions on Microsoft Intune devices",
|                                               "Description":  "Allows the app to perform remote high impact actions such as wiping the device or resetting the passcode on devices managed by Microsoft Intune, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2f51be20-0bb4-4fed-bf7b-db946066c75e",
|                                               "Value":  "DeviceManagementManagedDevices.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune devices",
|                                               "Description":  "Allows the app to read the properties of devices managed by Microsoft Intune, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "243333ab-4d21-40cb-a475-36241daa0842",
|                                               "Value":  "DeviceManagementManagedDevices.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune devices",
|                                               "Description":  "Allows the app to read and write the properties of devices managed by Microsoft Intune, without a signed-in user. Does not allow high impact operations such as remote wipe and password reset on the device’s owner"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "58ca0d9a-1575-47e1-a3cb-007ef2e4583b",
|                                               "Value":  "DeviceManagementRBAC.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune RBAC settings",
|                                               "Description":  "Allows the app to read the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e330c4f0-4170-414e-a55a-2f022ec2b57b",
|                                               "Value":  "DeviceManagementRBAC.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune RBAC settings",
|                                               "Description":  "Allows the app to read and write the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c7a5be92-2b3d-4540-8a67-c96dcaae8b43",
|                                               "Value":  "DeviceManagementScripts.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune Scripts",
|                                               "Description":  "Allows the app to read Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9255e99d-faf5-445e-bbf7-cb71482737c4",
|                                               "Value":  "DeviceManagementScripts.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune Scripts",
|                                               "Description":  "Allows the app to read and write Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "06a5fe6d-c49d-46a7-b082-56b1b14103c7",
|                                               "Value":  "DeviceManagementServiceConfig.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune configuration",
|                                               "Description":  "Allows the app to read Microsoft Intune service properties including device enrollment and third party service connection configuration, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5ac13192-7ace-4fcf-b828-1a26f28068ee",
|                                               "Value":  "DeviceManagementServiceConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune configuration",
|                                               "Description":  "Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "abf6441f-0772-4932-96e7-0191478dd73a",
|                                               "Value":  "DeviceTemplate.Create",
|                                               "DisplayName":  "Create device template",
|                                               "Description":  "Allows the app to create device templates. The app is marked as owner of the created device template. As a member of owners, the app will be allowed to manage devices created from the template."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dd9febb5-0c6d-419f-b256-3afe12c6adeb",
|                                               "Value":  "DeviceTemplate.Read.All",
|                                               "DisplayName":  "Read all device templates",
|                                               "Description":  "Allows the app to read all device templates, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9fadb66e-6421-4744-aede-4ab6fb98a884",
|                                               "Value":  "DeviceTemplate.ReadWrite.All",
|                                               "DisplayName":  "Read and write all device templates",
|                                               "Description":  "Allows the app to create, read, update and delete any device template, without a signed-in user. It also allows the app to add or remove owners on any device template."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7ab1d382-f21e-4acd-a863-ba3e13f7da61",
|                                               "Value":  "Directory.Read.All",
|                                               "DisplayName":  "Read directory data",
|                                               "Description":  "Allows the app to read data in your organization\u0027s directory, such as users, groups and apps, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "19dbc75e-c2e2-444c-a770-ec69d8559fc7",
|                                               "Value":  "Directory.ReadWrite.All",
|                                               "DisplayName":  "Read and write directory data",
|                                               "Description":  "Allows the app to read and write data in your organization\u0027s directory, such as users, and groups, without a signed-in user.  Does not allow user or group deletion."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ae73097b-cb2a-4447-b064-5d80f6093921",
|                                               "Value":  "DirectoryRecommendations.Read.All",
|                                               "DisplayName":  "Read all Azure AD recommendations",
|                                               "Description":  "Allows the app to read all Azure AD recommendations, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0e9eea12-4f01-45f6-9b8d-3ea4c8144158",
|                                               "Value":  "DirectoryRecommendations.ReadWrite.All",
|                                               "DisplayName":  "Read and update all Azure AD recommendations",
|                                               "Description":  "Allows the app to read and update all Azure AD recommendations, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c0e5a7b0-e8b7-40a7-b8e0-8249e6ea81d5",
|                                               "Value":  "Domain-InternalFederation.Read.All",
|                                               "DisplayName":  "Read internal federation configuration for a domain.",
|                                               "Description":  "Allows the app to read internal federation configuration for a domain."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "64d40371-8d58-4270-bc8a-b4a66de36b9a",
|                                               "Value":  "Domain-InternalFederation.ReadWrite.All",
|                                               "DisplayName":  "Create, read, update and delete internal federation configuration for a domain.",
|                                               "Description":  "Allows the app to create, read, update and delete internal federation configuration for a domain."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dbb9058a-0e50-45d7-ae91-66909b5d4664",
|                                               "Value":  "Domain.Read.All",
|                                               "DisplayName":  "Read domains",
|                                               "Description":  "Allows the app to read all domain properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7e05723c-0bb0-42da-be95-ae9f08a6e53c",
|                                               "Value":  "Domain.ReadWrite.All",
|                                               "DisplayName":  "Read and write domains",
|                                               "Description":  "Allows the app to read and write all domain properties without a signed in user.  Also allows the app to add,  verify and remove domains."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "50180013-6191-4d1e-a373-e590ff4e66af",
|                                               "Value":  "eDiscovery.Read.All",
|                                               "DisplayName":  "Read all eDiscovery objects",
|                                               "Description":  "Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b2620db1-3bf7-4c5b-9cb9-576d29eac736",
|                                               "Value":  "eDiscovery.ReadWrite.All",
|                                               "DisplayName":  "Read and write all eDiscovery objects",
|                                               "Description":  "Allows the app to read and write eDiscovery objects such as cases, custodians, review sets and other related objects without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7c9db06a-ec2d-4e7b-a592-5a1e30992566",
|                                               "Value":  "EduAdministration.Read.All",
|                                               "DisplayName":  "Read Education app settings",
|                                               "Description":  "Read the state and settings of all Microsoft education apps."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9bc431c3-b8bc-4a8d-a219-40f10f92eff6",
|                                               "Value":  "EduAdministration.ReadWrite.All",
|                                               "DisplayName":  "Manage education app settings",
|                                               "Description":  "Manage the state and settings of all Microsoft education apps."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4c37e1b6-35a1-43bf-926a-6f30f2cdf585",
|                                               "Value":  "EduAssignments.Read.All",
|                                               "DisplayName":  "Read all class assignments with grades",
|                                               "Description":  "Allows the app to read all class assignments with grades for all users without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6e0a958b-b7fc-4348-b7c4-a6ab9fd3dd0e",
|                                               "Value":  "EduAssignments.ReadBasic.All",
|                                               "DisplayName":  "Read all class assignments without grades",
|                                               "Description":  "Allows the app to read all class assignments without grades for all users without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0d22204b-6cad-4dd0-8362-3e3f2ae699d9",
|                                               "Value":  "EduAssignments.ReadWrite.All",
|                                               "DisplayName":  "Create, read, update and delete all class assignments with grades",
|                                               "Description":  "Allows the app to create, read, update and delete all class assignments with grades for all users without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f431cc63-a2de-48c4-8054-a34bc093af84",
|                                               "Value":  "EduAssignments.ReadWriteBasic.All",
|                                               "DisplayName":  "Create, read, update and delete all class assignments without grades",
|                                               "Description":  "Allows the app to create, read, update and delete all class assignments without grades for all users without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6cdb464c-3a03-40f8-900b-4cb7ea1da9c0",
|                                               "Value":  "EduCurricula.Read.All",
|                                               "DisplayName":  "Read all class modules and resources",
|                                               "Description":  "Allows the app to read all modules and resources, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6a0c2318-d59d-4c7d-bf2e-5f3902dc2593",
|                                               "Value":  "EduCurricula.ReadWrite.All",
|                                               "DisplayName":  "Read and write all class modules and resources",
|                                               "Description":  "Allows the app to read and write all modules and resources, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ad248c30-1919-40c8-b3d2-304481894e88",
|                                               "Value":  "EduReports-Reading.Read.All",
|                                               "DisplayName":  "Read all tenant reading assignments submissions data",
|                                               "Description":  "Allows the app to read all tenant users reading assignments submissions data without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "040330d7-be7e-4130-b349-a6eb3a56e2f8",
|                                               "Value":  "EduReports-Reading.ReadAnonymous.All",
|                                               "DisplayName":  "Read all tenant reading assignments submissions data",
|                                               "Description":  "Allows the app to read all tenant users reading assignments submissions data (excludes student-identifying information) without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c5debf73-bdc8-473d-bf07-f4074ad05f71",
|                                               "Value":  "EduReports-Reflect.Read.All",
|                                               "DisplayName":  "Read all tenant reflect check-ins submissions data",
|                                               "Description":  "Allows the app to read all tenant users reflect check-ins submissions data without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f5d05dba-7ef0-46fc-b62c-a7282555f428",
|                                               "Value":  "EduReports-Reflect.ReadAnonymous.All",
|                                               "DisplayName":  "Read all tenant reflect check-ins submissions data",
|                                               "Description":  "Allows the app to read all tenant users reflect check-ins submissions data (excludes responder-identifying information) without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e0ac9e1b-cb65-4fc5-87c5-1a8bc181f648",
|                                               "Value":  "EduRoster.Read.All",
|                                               "DisplayName":  "Read the organization\u0027s roster",
|                                               "Description":  "Allows the app to read the structure of schools and classes in the organization\u0027s roster and education-specific information about all users to be read."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0d412a8c-a06c-439f-b3ec-8abcf54d2f96",
|                                               "Value":  "EduRoster.ReadBasic.All",
|                                               "DisplayName":  "Read a limited subset of the organization\u0027s roster",
|                                               "Description":  "Allows the app to read a limited subset of properties from both the structure of schools and classes in the organization\u0027s roster and education-specific information about all users. Includes name, status, role, email address and photo."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d1808e82-ce13-47af-ae0d-f9b254e6d58a",
|                                               "Value":  "EduRoster.ReadWrite.All",
|                                               "DisplayName":  "Read and write the organization\u0027s roster",
|                                               "Description":  "Allows the app to read and write the structure of schools and classes in the organization\u0027s roster and education-specific information about all users to be read and written."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e1d2136d-eaaf-427a-a7db-f97dbe847c27",
|                                               "Value":  "EngagementConversation.Migration.All",
|                                               "DisplayName":  "Read and write all Viva Engage conversations",
|                                               "Description":  "Allows the app to create Viva Engage conversations without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2c495153-cd0e-41b4-9980-3bcecf1ca22f",
|                                               "Value":  "EngagementConversation.Read.All",
|                                               "DisplayName":  "Read all Viva Engage conversations",
|                                               "Description":  "Allows the app to list Viva Engage conversations, and to read their properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bfbd4840-fba0-43a7-93a9-465b687e47d0",
|                                               "Value":  "EngagementConversation.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Viva Engage conversations",
|                                               "Description":  "Allows the app to create Viva Engage conversations, read all conversation properties, update conversation properties, and delete conversations without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "eda8c187-a7d5-42cb-b2e1-c9142f63899f",
|                                               "Value":  "EngagementExport.Read.All",
|                                               "DisplayName":  "Export Viva Engage data",
|                                               "Description":  "Allows the app to export Viva Engage data for compliance, GDPR, and admin scenarios without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d746beae-b46e-446e-924a-5b805a5c4467",
|                                               "Value":  "EngagementMeetingConversation.Read.All",
|                                               "DisplayName":  "Read all Viva Engage Teams QA conversations",
|                                               "Description":  "Allows the app to list Viva Engage Teams QA conversations, and to read their properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "30614864-4114-45ef-bdd9-0dd7894a1cc4",
|                                               "Value":  "EngagementRole.Read.All",
|                                               "DisplayName":  "Read all Viva Engage roles and role memberships",
|                                               "Description":  "Allows the app to list all Viva Engage roles and role memberships without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3ede5358-7366-4da8-a2f7-472bf9c7cc34",
|                                               "Value":  "EngagementRole.ReadWrite.All",
|                                               "DisplayName":  "Modify Viva Engage role membership",
|                                               "Description":  "Allows the app to assign Viva Engage role to a user, and remove a Viva Engage role from a user without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c74fd47d-ed3c-45c3-9a9e-b8676de685d2",
|                                               "Value":  "EntitlementManagement.Read.All",
|                                               "DisplayName":  "Read all entitlement management resources",
|                                               "Description":  "Allows the app to read access packages and related entitlement management resources without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9acd699f-1e81-4958-b001-93b1d2506e19",
|                                               "Value":  "EntitlementManagement.ReadWrite.All",
|                                               "DisplayName":  "Read and write all entitlement management resources",
|                                               "Description":  "Allows the app to read and write access packages and related entitlement management resources without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "56eda3c5-3834-4815-bd41-6f8fa1295247",
|                                               "Value":  "EntraBackup.Read.All",
|                                               "DisplayName":  "Read Preview jobs and snapshots",
|                                               "Description":  "Allows the app to list the all the snapshots, jobs and enumerate the changes of a specific preview job, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b7f6385c-6ce6-4639-a480-e23c42ed9784",
|                                               "Value":  "EventListener.Read.All",
|                                               "DisplayName":  "Read all authentication event listeners",
|                                               "Description":  "Allows the app to read your organization\u0027s authentication event listeners without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0edf5e9e-4ce8-468a-8432-d08631d18c43",
|                                               "Value":  "EventListener.ReadWrite.All",
|                                               "DisplayName":  "Read and write all authentication event listeners",
|                                               "Description":  "Allows the app to read or write your organization\u0027s authentication event listeners without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "89b20d8a-76e2-4057-867b-9961f800b9a4",
|                                               "Value":  "ExchangeMessageTrace.Read.All",
|                                               "DisplayName":  "Search the email message trace",
|                                               "Description":  "Allows the app to search the email message trace, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1914711b-a1cb-4793-b019-c2ce0ed21b8c",
|                                               "Value":  "ExternalConnection.Read.All",
|                                               "DisplayName":  "Read all external connections",
|                                               "Description":  "Allows the app to read all external connections without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "34c37bc0-2b40-4d5e-85e1-2365cd256d79",
|                                               "Value":  "ExternalConnection.ReadWrite.All",
|                                               "DisplayName":  "Read and write all external connections",
|                                               "Description":  "Allows the app to read and write all external connections without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f431331c-49a6-499f-be1c-62af19c34a9d",
|                                               "Value":  "ExternalConnection.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write external connections",
|                                               "Description":  "Allows the app to read and write external connections without a signed-in user. The app can only read and write external connections that it is authorized to, or it can create new external connections."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7a7cffad-37d2-4f48-afa4-c6ab129adcc2",
|                                               "Value":  "ExternalItem.Read.All",
|                                               "DisplayName":  "Read all external items",
|                                               "Description":  "Allows the app to read all external items without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "38c3d6ee-69ee-422f-b954-e17819665354",
|                                               "Value":  "ExternalItem.ReadWrite.All",
|                                               "DisplayName":  "Read and write items in external datasets",
|                                               "Description":  "Allow the app to read or write items in all external datasets that the app is authorized to access"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8116ae0f-55c2-452d-9944-d18420f5b2c8",
|                                               "Value":  "ExternalItem.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write external items",
|                                               "Description":  "Allows the app to read and write external items without a signed-in user. The app can only read external items of the connection that it is authorized to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1987d7a0-d602-4262-ab90-cfdd43b37545",
|                                               "Value":  "ExternalUserProfile.Read.All",
|                                               "DisplayName":  "Read all external user profiles",
|                                               "Description":  "Allows the app to read available properties of external user profiles, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "761327c9-d819-4c08-9a5f-874cd2826608",
|                                               "Value":  "ExternalUserProfile.ReadWrite.All",
|                                               "DisplayName":  "Read and write all external user profiles",
|                                               "Description":  "Allows the app to read and write available properties of external user profiles, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "65891b00-2fd9-4e33-be27-04a53132e3df",
|                                               "Value":  "FileIngestion.Ingest",
|                                               "DisplayName":  "Ingest SharePoint and OneDrive content to make it available in the search index",
|                                               "Description":  "Allows the app to ingest SharePoint and OneDrive content to make it available in the search index, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "766c601b-c009-4438-8290-c8b05fa00c4b",
|                                               "Value":  "FileIngestionHybridOnboarding.Manage",
|                                               "DisplayName":  "Manage onboarding for a Hybrid Cloud tenant",
|                                               "Description":  "Allows the app to manage onboarding for a Hybrid Cloud tenant, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "01d4889c-1287-42c6-ac1f-5d1e02578ef6",
|                                               "Value":  "Files.Read.All",
|                                               "DisplayName":  "Read files in all site collections",
|                                               "Description":  "Allows the app to read all files in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "75359482-378d-4052-8f01-80520e7db3cd",
|                                               "Value":  "Files.ReadWrite.All",
|                                               "DisplayName":  "Read and write files in all site collections",
|                                               "Description":  "Allows the app to read, create, update and delete all files in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b47b160b-1054-4efd-9ca0-e2f614696086",
|                                               "Value":  "Files.ReadWrite.AppFolder",
|                                               "DisplayName":  "Have full access to the application\u0027s folder without a signed in user.",
|                                               "Description":  "Allows the app to read, create, update and delete files in the application\u0027s folder without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bd61925e-3bf4-4d62-bc0b-06b06c96d95c",
|                                               "Value":  "Files.SelectedOperations.Selected",
|                                               "DisplayName":  "Access selected Files without a signed in user.",
|                                               "Description":  "Allow the application to access a subset of files without a signed in user.  The specific files and the permissions granted will be configured in SharePoint Online or OneDrive."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "40dc41bc-0f7e-42ff-89bd-d9516947e474",
|                                               "Value":  "FileStorageContainer.Selected",
|                                               "DisplayName":  "Access selected file storage containers",
|                                               "Description":  "Allows the application to utilize the file storage container platform to manage containers, without a signed-in user. The specific file storage containers and the permissions granted to them will be configured in Microsoft 365 by the developer of each container type."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2dcc6599-bd30-442b-8f11-90f88ad441dc",
|                                               "Value":  "FileStorageContainerTypeReg.Selected",
|                                               "DisplayName":  "Access selected file storage container type registrations",
|                                               "Description":  "Allows the application to manage file storage container type registrations without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4f0a8235-6f6f-4ec7-9500-34b452a4a0c3",
|                                               "Value":  "Group-Conversation.Read.All",
|                                               "DisplayName":  "Read all group conversations",
|                                               "Description":  "Allows the app to read conversations of the groups this app has access to without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6679c91b-820a-4900-ab47-e97b197a89c4",
|                                               "Value":  "Group-Conversation.ReadWrite.All",
|                                               "DisplayName":  "Read and write all group conversations",
|                                               "Description":  "Allows the app to read and write conversations of the groups this app has access to without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2d53948b-d2c5-4008-9c4e-6361bf192555",
|                                               "Value":  "Group-NestingSupport.ReadWrite.All",
|                                               "DisplayName":  "Read and write groups\u0027 disableNesting property",
|                                               "Description":  "Allows the app to read and write groups\u0027 disableNesting property without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2d9bd318-b883-40be-9df7-63ec4fcdc424",
|                                               "Value":  "Group-OnPremisesSyncBehavior.ReadWrite.All",
|                                               "DisplayName":  "Read and update the on-premises sync behavior of groups",
|                                               "Description":  "Allows the app to update the on-premises sync behavior of all groups without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bf7b1a76-6e77-406b-b258-bf5c7720e98f",
|                                               "Value":  "Group.Create",
|                                               "DisplayName":  "Create groups",
|                                               "Description":  "Allows the app to create groups without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5b567255-7703-4780-807c-7be8301ae99b",
|                                               "Value":  "Group.Read.All",
|                                               "DisplayName":  "Read all groups",
|                                               "Description":  "Allows the app to read group properties and memberships, and read conversations for all groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "62a82d76-70ea-41e2-9197-370581804d09",
|                                               "Value":  "Group.ReadWrite.All",
|                                               "DisplayName":  "Read and write all groups",
|                                               "Description":  "Allows the app to create groups, read all group properties and memberships, update group properties and memberships, and delete groups. Also allows the app to read and write conversations. All of these operations can be performed by the app without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "98830695-27a2-44f7-8c18-0c3ebc9698f6",
|                                               "Value":  "GroupMember.Read.All",
|                                               "DisplayName":  "Read all group memberships",
|                                               "Description":  "Allows the app to read memberships and basic group properties for all groups without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dbaae8cf-10b5-4b86-a4a1-f871c94c6695",
|                                               "Value":  "GroupMember.ReadWrite.All",
|                                               "DisplayName":  "Read and write all group memberships",
|                                               "Description":  "Allows the app to list groups, read basic properties, read and update the membership of the groups this app has access to without a signed-in user. Group properties and owners cannot be updated and groups cannot be deleted."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f3c4f514-c65a-43f5-bfce-1735872258dd",
|                                               "Value":  "GroupSettings.Read.All",
|                                               "DisplayName":  "Read all group settings",
|                                               "Description":  "Allows the app to read a list of tenant-level or group-specific group settings objects, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "546168c3-1183-4281-9491-fafb24dea37e",
|                                               "Value":  "GroupSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write all group settings",
|                                               "Description":  "Allows the app to create, read, update, and delete on the list of tenant-level or group-specific group settings objects, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5183ed5d-b7f8-4e9a-915e-dafb46b9cb62",
|                                               "Value":  "HealthMonitoringAlert.Read.All",
|                                               "DisplayName":  "Read all scenario health monitoring alert",
|                                               "Description":  "Allows the app to read all scenario health monitoring alerts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ac29eb50-f2f9-4518-a117-4bef18e84c7d",
|                                               "Value":  "HealthMonitoringAlert.ReadWrite.All",
|                                               "DisplayName":  "Read and write all scenario monitoring alerts",
|                                               "Description":  "Allows the app to read and write all scenario monitoring alerts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bb424d73-e898-4c97-9d42-688c32810003",
|                                               "Value":  "HealthMonitoringAlertConfig.Read.All",
|                                               "DisplayName":  "Read all scenario health monitoring alert configurations",
|                                               "Description":  "Allows the app to read all scenario health monitoring alert configurations, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "432e76f0-8af6-4315-a853-66ab9538f480",
|                                               "Value":  "HealthMonitoringAlertConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write all scenario monitoring alerts",
|                                               "Description":  "Allows the app to read and write all scenario monitoring alerts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e321f0bb-e7f7-481e-bb28-e3b0b32d4bd0",
|                                               "Value":  "IdentityProvider.Read.All",
|                                               "DisplayName":  "Read identity providers",
|                                               "Description":  "Allows the app to read your organization’s identity (authentication) providers’ properties without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "90db2b9a-d928-4d33-a4dd-8442ae3d41e4",
|                                               "Value":  "IdentityProvider.ReadWrite.All",
|                                               "DisplayName":  "Read and write identity providers",
|                                               "Description":  "Allows the app to read and write your organization’s identity (authentication) providers’ properties without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6e472fd1-ad78-48da-a0f0-97ab2c6b769e",
|                                               "Value":  "IdentityRiskEvent.Read.All",
|                                               "DisplayName":  "Read all identity risk event information",
|                                               "Description":  "Allows the app to read the identity risk event information for your organization without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "db06fb33-1953-4b7b-a2ac-f1e2c854f7ae",
|                                               "Value":  "IdentityRiskEvent.ReadWrite.All",
|                                               "DisplayName":  "Read and write all risk detection information",
|                                               "Description":  "Allows the app to read and update identity risk detection information for your organization without a signed-in user. Update operations include confirming risk event detections. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4aadfb66-d49a-414a-a883-d8c240b6fa33",
|                                               "Value":  "IdentityRiskyAgent.Read.All",
|                                               "DisplayName":  "Read all risky agents information",
|                                               "Description":  "Allows the app to read the risky agents information in your organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dca4e4fd-a7cf-4e6f-86d1-d1ec094d766e",
|                                               "Value":  "IdentityRiskyAgent.ReadWrite.All",
|                                               "DisplayName":  "Read and write risky agents information",
|                                               "Description":  "Allows the app to read and update risky agents information in your organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "607c7344-0eed-41e5-823a-9695ebe1b7b0",
|                                               "Value":  "IdentityRiskyServicePrincipal.Read.All",
|                                               "DisplayName":  "Read all identity risky service principal information",
|                                               "Description":  "Allows the app to read all risky service principal information for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cb8d6980-6bcb-4507-afec-ed6de3a2d798",
|                                               "Value":  "IdentityRiskyServicePrincipal.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity risky service principal information",
|                                               "Description":  "Allows the app to read and update identity risky service principal for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dc5007c0-2d7d-4c42-879c-2dab87571379",
|                                               "Value":  "IdentityRiskyUser.Read.All",
|                                               "DisplayName":  "Read all identity risky user information",
|                                               "Description":  "Allows the app to read the identity risky user information for your organization without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "656f6061-f9fe-4807-9708-6a2e0934df76",
|                                               "Value":  "IdentityRiskyUser.ReadWrite.All",
|                                               "DisplayName":  "Read and write all risky user information",
|                                               "Description":  "Allows the app to read and update identity risky user information for your organization without a signed-in user.  Update operations include dismissing risky users."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1b0c317f-dd31-4305-9932-259a8b6e8099",
|                                               "Value":  "IdentityUserFlow.Read.All",
|                                               "DisplayName":  "Read all identity user flows",
|                                               "Description":  "Allows the app to read your organization\u0027s user flows, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "65319a09-a2be-469d-8782-f6b07debf789",
|                                               "Value":  "IdentityUserFlow.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity user flows",
|                                               "Description":  "Allows the app to read or write your organization\u0027s user flows, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7ab52c2f-a2ee-4d98-9ebc-725e3934aae2",
|                                               "Value":  "IndustryData-DataConnector.Read.All",
|                                               "DisplayName":  "View data connector definitions",
|                                               "Description":  "Allows the app to read data connectors without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "eda0971c-482e-4345-b28f-69c309cb8a34",
|                                               "Value":  "IndustryData-DataConnector.ReadWrite.All",
|                                               "DisplayName":  "Manage data connector definitions",
|                                               "Description":  "Allows the app to read and write data connectors without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9334c44b-a7c6-4350-8036-6bf8e02b4c1f",
|                                               "Value":  "IndustryData-DataConnector.Upload",
|                                               "DisplayName":  "Upload files to a data connector",
|                                               "Description":  "Allows the app to upload data files to a data connector without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "305f6ba2-049a-4b1b-88bb-fe7e08758a00",
|                                               "Value":  "IndustryData-InboundFlow.Read.All",
|                                               "DisplayName":  "View inbound flow definitions",
|                                               "Description":  "Allows the app to read inbound data flows without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e688c61f-d4c6-4d64-a197-3bcf6ba1d6ad",
|                                               "Value":  "IndustryData-InboundFlow.ReadWrite.All",
|                                               "DisplayName":  "Manage inbound flow definitions",
|                                               "Description":  "Allows the app to read and write inbound data flows without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "61d0354c-5d88-483c-b974-a37ec3395a2c",
|                                               "Value":  "IndustryData-OutboundFlow.Read.All",
|                                               "DisplayName":  "View outbound flow definitions",
|                                               "Description":  "Allows the app to read outbound data flows without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "24a65b4a-e501-47e2-8849-d679517887f0",
|                                               "Value":  "IndustryData-OutboundFlow.ReadWrite.All",
|                                               "DisplayName":  "Manage outbound flow definitions",
|                                               "Description":  "Allows the app to read and write outbound data flows without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6ee891c3-74a4-4148-8463-0c834375dfaf",
|                                               "Value":  "IndustryData-ReferenceDefinition.Read.All",
|                                               "DisplayName":  "View reference definitions",
|                                               "Description":  "Allows the app to read reference definitions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bda16293-63d3-45b7-b16b-833841d27d56",
|                                               "Value":  "IndustryData-ReferenceDefinition.ReadWrite.All",
|                                               "DisplayName":  "Manage reference definitions",
|                                               "Description":  "Allows the app to read and write reference definitions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f6f5d10b-3024-4d1d-b674-aae4df4a1a73",
|                                               "Value":  "IndustryData-Run.Read.All",
|                                               "DisplayName":  "View current and previous runs",
|                                               "Description":  "Allows the app to read current and previous IndustryData runs without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7e429772-5b5e-47c0-8fd6-7279294c8033",
|                                               "Value":  "IndustryData-Run.Start",
|                                               "DisplayName":  "View and start runs",
|                                               "Description":  "Allows the app to view and start IndustryData runs without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bc167a60-39fe-4865-8b44-78400fc6ed03",
|                                               "Value":  "IndustryData-SourceSystem.Read.All",
|                                               "DisplayName":  "View source system definitions",
|                                               "Description":  "Allows the app to read source system definitions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7d866958-e06e-4dd6-91c6-a086b3f5cfeb",
|                                               "Value":  "IndustryData-SourceSystem.ReadWrite.All",
|                                               "DisplayName":  "Manage source system definitions",
|                                               "Description":  "Allows the app to read and write source system definitions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7c55c952-b095-4c23-a522-022bce4cc1e3",
|                                               "Value":  "IndustryData-TimePeriod.Read.All",
|                                               "DisplayName":  "Read time period definitions",
|                                               "Description":  "Allows the app to read time period definitions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7afa7744-a782-4a32-b8c2-e3db637e8de7",
|                                               "Value":  "IndustryData-TimePeriod.ReadWrite.All",
|                                               "DisplayName":  "Manage time period definitions",
|                                               "Description":  "Allows the app to read and write time period definitions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4f5ac95f-62fd-472c-b60f-125d24ca0bc5",
|                                               "Value":  "IndustryData.ReadBasic.All",
|                                               "DisplayName":  "View basic service and resource information",
|                                               "Description":  "Allows the app to read basic service and resource information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "14f49b9f-4bf2-4d24-b80e-b27ec58409bd",
|                                               "Value":  "InformationProtectionConfig.Read.All",
|                                               "DisplayName":  "Read all configurations for protecting organizational data applicable to users",
|                                               "Description":  "Allows the app to read all configurations applicable to users for protecting organizational data, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cbe6c7e4-09aa-4b8d-b3c3-2dbb59af4b54",
|                                               "Value":  "InformationProtectionContent.Sign.All",
|                                               "DisplayName":  "Sign digests for data",
|                                               "Description":  "Allows an app to sign digests for data without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "287bd98c-e865-4e8c-bade-1a85523195b9",
|                                               "Value":  "InformationProtectionContent.Write.All",
|                                               "DisplayName":  "Create protected content",
|                                               "Description":  "Allows the app to create protected content without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "19da66cb-0fb0-4390-b071-ebc76a349482",
|                                               "Value":  "InformationProtectionPolicy.Read.All",
|                                               "DisplayName":  "Read all published labels and label policies for an organization.",
|                                               "Description":  "Allows an app to read published sensitivity labels and label policy settings for the entire organization or a specific user, without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "34cbd96c-d824-4755-90d3-1008ef47efc1",
|                                               "Value":  "Insights-UserMetric.Read.All",
|                                               "DisplayName":  "Read all user metrics insights",
|                                               "Description":  "Allows an app to read all user metrics insights, such as daily and monthly active users, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "535e6066-2894-49ef-ab33-e2c6d064bb81",
|                                               "Value":  "LearningAssignedCourse.Read.All",
|                                               "DisplayName":  "Read all assignments",
|                                               "Description":  "Allows the app to read data for all assignments in the organization\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "236c1cbd-1187-427f-b0f5-b1852454973b",
|                                               "Value":  "LearningAssignedCourse.ReadWrite.All",
|                                               "DisplayName":  "Read and write all assignments",
|                                               "Description":  "Allows the app to create, update, read and delete all assignments in the organization\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8740813e-d8aa-4204-860e-2a0f8f84dbc8",
|                                               "Value":  "LearningContent.Read.All",
|                                               "DisplayName":  "Read all learning content",
|                                               "Description":  "Allows the app to read all learning content in the organization\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "444d6fcb-b738-41e5-b103-ac4f2a2628a3",
|                                               "Value":  "LearningContent.ReadWrite.All",
|                                               "DisplayName":  "Manage all learning content",
|                                               "Description":  "Allows the app to manage all learning content in the organization\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "467524fc-ed22-4356-a910-af61191e3503",
|                                               "Value":  "LearningSelfInitiatedCourse.Read.All",
|                                               "DisplayName":  "Read all self-initiated courses",
|                                               "Description":  "Allows the app to read data for all self-initiated courses in the organization\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7654ed61-8965-4025-846a-0856ec02b5b0",
|                                               "Value":  "LearningSelfInitiatedCourse.ReadWrite.All",
|                                               "DisplayName":  "Read and write all self-initiated courses",
|                                               "Description":  "Allows the app to create, update, read and delete all self-initiated courses in the organization\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e2f98668-2877-4f38-a2f4-8202e0717aa1",
|                                               "Value":  "LicenseAssignment.Read.All",
|                                               "DisplayName":  "Read all license assignments.",
|                                               "Description":  "Allows an app to read license assignments for users and groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5facf0c1-8979-4e95-abcf-ff3d079771c0",
|                                               "Value":  "LicenseAssignment.ReadWrite.All",
|                                               "DisplayName":  "Manage all license assignments",
|                                               "Description":  "Allows an app to manage license assignments for users and groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2cb19e7d-9012-40bf-9a22-69fc776af8b0",
|                                               "Value":  "LifecycleWorkflows-CustomExt.Read.All",
|                                               "DisplayName":  "Read all Lifecycle workflows custom task extensionss",
|                                               "Description":  "Allows the app to read all Lifecycle workflows custom task extensions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3351c766-bacc-4d93-94fa-f2c8b1986ee7",
|                                               "Value":  "LifecycleWorkflows-CustomExt.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Lifecycle workflows custom task extensions",
|                                               "Description":  "Allows the app to create, update, list, read and delete all Lifecycle workflows custom task extensions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fe615156-48b5-4c83-b613-e6e31a43c446",
|                                               "Value":  "LifecycleWorkflows-Reports.Read.All",
|                                               "DisplayName":  "Read all Lifecycle workflows reports",
|                                               "Description":  "Allows the app to read all Lifecycle workflows reports without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3a87a643-13d2-47aa-8d6a-b0a8377cb03b",
|                                               "Value":  "LifecycleWorkflows-Workflow.Activate",
|                                               "DisplayName":  "Run workflows on-demand in Lifecycle workflows",
|                                               "Description":  "Allows the app run workflows on-demand without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "03b0ad3e-fc2b-4ef1-b0ff-252e865cb608",
|                                               "Value":  "LifecycleWorkflows-Workflow.Read.All",
|                                               "DisplayName":  "Read all workflows in Lifecycle workflows",
|                                               "Description":  "Allows the app to list and read all workflows and tasks without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "021ea6db-c06b-45c6-8c9c-c1cd9a37a483",
|                                               "Value":  "LifecycleWorkflows-Workflow.ReadBasic.All",
|                                               "DisplayName":  "List all workflows in Lifecycle workflows",
|                                               "Description":  "Allows the app to list all workflows without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "94c88098-1d9d-4c42-a356-4d5a95312554",
|                                               "Value":  "LifecycleWorkflows-Workflow.ReadWrite.All",
|                                               "DisplayName":  "Read and write all workflows in Lifecycle workflows",
|                                               "Description":  "Allows the app to create, update, list, read and delete all workflows and tasks in lifecycle workflows without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7c67316a-232a-4b84-be22-cea2c0906404",
|                                               "Value":  "LifecycleWorkflows.Read.All",
|                                               "DisplayName":  "Read all lifecycle workflows resources",
|                                               "Description":  "Allows the app to list and read all workflows, tasks and related lifecycle workflows resources without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5c505cf4-8424-4b8e-aa14-ee06e3bb23e3",
|                                               "Value":  "LifecycleWorkflows.ReadWrite.All",
|                                               "DisplayName":  "Read and write all lifecycle workflows resources",
|                                               "Description":  "Allows the app to create, update, list, read and delete all workflows, tasks and related lifecycle workflows resources without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "de4e4161-a10a-4dfd-809c-e328d89aefeb",
|                                               "Value":  "ListItems.SelectedOperations.Selected",
|                                               "DisplayName":  "Access selected ListItems without a signed in user.",
|                                               "Description":  "Allow the application to access a subset of listitems without a signed in user.  The specific listitems and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "23c5a9bd-d900-4ecf-be26-a0689755d9e5",
|                                               "Value":  "Lists.SelectedOperations.Selected",
|                                               "DisplayName":  "Access selected Lists without a signed in user.",
|                                               "Description":  "Allow the application to access a subset of lists without a signed in user.  The specific lists and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e118f1da-5c1c-46cf-bff6-8858d786f46f",
|                                               "Value":  "Mail-Advanced.ReadWrite.All",
|                                               "DisplayName":  "Read and write mail in all mailboxes, including modifying existing non-draft mails",
|                                               "Description":  "Allows the app to create, read, update, and delete all email, including contents of non-draft emails in user mailboxes, without a signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "810c84a8-4a9e-49e6-bf7d-12d183f40d01",
|                                               "Value":  "Mail.Read",
|                                               "DisplayName":  "Read mail in all mailboxes",
|                                               "Description":  "Allows the app to read mail in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6be147d2-ea4f-4b5a-a3fa-3eab6f3c140a",
|                                               "Value":  "Mail.ReadBasic",
|                                               "DisplayName":  "Read basic mail in all mailboxes",
|                                               "Description":  "Allows the app to read basic mail properties in all mailboxes without a signed-in user. Includes all properties except body, previewBody, attachments and any extended properties."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "693c5e45-0940-467d-9b8a-1022fb9d42ef",
|                                               "Value":  "Mail.ReadBasic.All",
|                                               "DisplayName":  "Read basic mail in all mailboxes",
|                                               "Description":  "Allows the app to read basic mail properties in all mailboxes without a signed-in user. Includes all properties except body, previewBody, attachments and any extended properties."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e2a3a72e-5f79-4c64-b1b1-878b674786c9",
|                                               "Value":  "Mail.ReadWrite",
|                                               "DisplayName":  "Read and write mail in all mailboxes",
|                                               "Description":  "Allows the app to create, read, update, and delete mail in all mailboxes without a signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b633e1c5-b582-4048-a93e-9f11b44c7e96",
|                                               "Value":  "Mail.Send",
|                                               "DisplayName":  "Send mail as any user",
|                                               "Description":  "Allows the app to send mail as any user without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "27d9d776-f4d2-426d-80ad-5f22f2b01b0a",
|                                               "Value":  "MailboxConfigItem.Read",
|                                               "DisplayName":  "Read all users\u0027 UserConfiguration objects",
|                                               "Description":  "Allows the app to read all users\u0027 UserConfiguration objects."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "aa6d92d4-b25a-4640-aefe-3e3231e5e736",
|                                               "Value":  "MailboxConfigItem.ReadWrite",
|                                               "DisplayName":  "Read and write all users\u0027 UserConfiguration objects",
|                                               "Description":  "Allows the app to create, read, update and delete all users\u0027 UserConfiguration objects."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "99280d24-a782-4793-93cc-0888549957f6",
|                                               "Value":  "MailboxFolder.Read.All",
|                                               "DisplayName":  "Read all the users\u0027 mailbox folders",
|                                               "Description":  "Allows the app to read all the users\u0027 mailbox folders, without signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fef87b92-8391-4589-9da7-eb93dab7dc8a",
|                                               "Value":  "MailboxFolder.ReadWrite.All",
|                                               "DisplayName":  "Read and write all the users\u0027 mailbox folders",
|                                               "Description":  "Allows the app to read and write all the users\u0027 mailbox folders, without signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "937550e9-33a3-494b-88ae-d9cd394b1fbb",
|                                               "Value":  "MailboxItem.Export.All",
|                                               "DisplayName":  "Export all the users\u0027 mailbox items",
|                                               "Description":  "Allows the app to export all the users\u0027 mailbox items, without signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "76577085-e73d-4f1d-b26a-85fb33892327",
|                                               "Value":  "MailboxItem.ImportExport.All",
|                                               "DisplayName":  "Allows the app to perform backup and restore for all mailbox items",
|                                               "Description":  "Allows the app to backup, restore, and modify all mailbox items without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7d9f353d-a7bd-4fbb-822a-26d5dd39a3ce",
|                                               "Value":  "MailboxItem.Read.All",
|                                               "DisplayName":  "Read all the users\u0027 mailbox items",
|                                               "Description":  "Allows the app to read all the users\u0027 mailbox items, without signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "40f97065-369a-49f4-947c-6a255697ae91",
|                                               "Value":  "MailboxSettings.Read",
|                                               "DisplayName":  "Read all user mailbox settings",
|                                               "Description":  "Allows the app to read user\u0027s mailbox settings without a signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6931bccd-447a-43d1-b442-00a195474933",
|                                               "Value":  "MailboxSettings.ReadWrite",
|                                               "DisplayName":  "Read and write all user mailbox settings",
|                                               "Description":  "Allows the app to create, read, update, and delete user\u0027s mailbox settings without a signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a2c9652d-4d7f-4e4e-9d75-ac32fdc6f413",
|                                               "Value":  "MailTips.ReadBasic.All",
|                                               "DisplayName":  "Read mail tips for all users",
|                                               "Description":  "Allows the app to read mail tips for all users in the organization without a signed-in user. Mail tips include automatic replies, mailbox status, custom tips, and delivery information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "658aa5d8-239f-45c4-aa12-864f4fc7e490",
|                                               "Value":  "Member.Read.Hidden",
|                                               "DisplayName":  "Read all hidden memberships",
|                                               "Description":  "Allows the app to read the memberships of hidden groups and administrative units without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4f994bc0-31bb-44bb-b480-7a7c1be8c02e",
|                                               "Value":  "MultiTenantOrganization.Read.All",
|                                               "DisplayName":  "Read all multi-tenant organization details and tenants",
|                                               "Description":  "Allows the app to read all multi-tenant organization details and tenants, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f9c2b2a7-3895-4b2e-80f6-c924b456e50b",
|                                               "Value":  "MultiTenantOrganization.ReadBasic.All",
|                                               "DisplayName":  "Read multi-tenant organization basic details and active tenants",
|                                               "Description":  "Allows the app to read multi-tenant organization basic details and active tenants, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "920def01-ca61-4d2d-b3df-105b46046a70",
|                                               "Value":  "MultiTenantOrganization.ReadWrite.All",
|                                               "DisplayName":  "Read and write all multi-tenant organization details and tenants",
|                                               "Description":  "Allows the app to read and write all multi-tenant organization details and tenants, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6daaff82-2880-496d-9d80-57e8e31195e2",
|                                               "Value":  "MutualTlsOauthConfiguration.Read.All",
|                                               "DisplayName":  "Read all configurations used for mutual-TLS client authentication.",
|                                               "Description":  "Allows the app to read configuration used for OAuth 2.0 mutual-TLS client authentication, without a signed-in user. This includes reading trusted certificate authorities."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "78bbf8cf-07d8-45ba-b0eb-1a7b48efbcf1",
|                                               "Value":  "MutualTlsOauthConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write all configurations used for mutual-TLS client authentication.",
|                                               "Description":  "Allows the app to read and update configuration used for OAuth 2.0 mutual-TLS client authentication, without a signed-in user. This includes reading and updating trusted certificate authorities."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "40049381-3cc1-42af-94ec-5ce755db4b0d",
|                                               "Value":  "NetworkAccess-Reports.Read.All",
|                                               "DisplayName":  "Read all network access reports",
|                                               "Description":  "Allows the app to read all network access reports without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e30060de-caa5-4331-99d3-6ac6c966a9a4",
|                                               "Value":  "NetworkAccess.Read.All",
|                                               "DisplayName":  "Read all network access information",
|                                               "Description":  "Allows the app to read all network access information and configuration settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b10642fc-a6cf-4c46-87f9-e1f96c2a18aa",
|                                               "Value":  "NetworkAccess.ReadWrite.All",
|                                               "DisplayName":  "Read and write all network access information",
|                                               "Description":  "Allows the app to read and write all network access information and configuration settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "39ae4a24-1ef0-49e8-9d63-2a66f5c39edd",
|                                               "Value":  "NetworkAccessBranch.Read.All",
|                                               "DisplayName":  "Read properties of all branches for network access",
|                                               "Description":  "Allows the app to read your organization\u0027s network access branches, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8137102d-ec16-4191-aaf8-7aeda8026183",
|                                               "Value":  "NetworkAccessBranch.ReadWrite.All",
|                                               "DisplayName":  "Read and write properties of all branches for network access",
|                                               "Description":  "Allows the app to read and write your organization\u0027s network access branches, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8a3d36bf-cb46-4bcc-bec9-8d92829dab84",
|                                               "Value":  "NetworkAccessPolicy.Read.All",
|                                               "DisplayName":  "Read all security and routing policies for network access",
|                                               "Description":  "Allows the app to read your organization\u0027s network access policies, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f0c341be-8348-4989-8e43-660324294538",
|                                               "Value":  "NetworkAccessPolicy.ReadWrite.All",
|                                               "DisplayName":  "Read and write all security and routing policies for network access",
|                                               "Description":  "Allows the app to read and write your organization\u0027s network access policies, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3aeca27b-ee3a-4c2b-8ded-80376e2134a4",
|                                               "Value":  "Notes.Read.All",
|                                               "DisplayName":  "Read all OneNote notebooks",
|                                               "Description":  "Allows the app to read all the OneNote notebooks in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0c458cef-11f3-48c2-a568-c66751c238c0",
|                                               "Value":  "Notes.ReadWrite.All",
|                                               "DisplayName":  "Read and write all OneNote notebooks",
|                                               "Description":  "Allows the app to read all the OneNote notebooks in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c0cf7895-985f-42d4-a693-b618f36674ad",
|                                               "Value":  "OnlineMeetingAiInsight.Read.All",
|                                               "DisplayName":  "Read all AI Insights for online meetings.",
|                                               "Description":  "Allows the app to read all AI Insights for all online meetings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "01892c31-3b66-4bcf-b5f5-bf0a03d5ed9f",
|                                               "Value":  "OnlineMeetingAiInsight.Read.Chat",
|                                               "DisplayName":  "Read all AI Insights for online meetings where the Teams application is installed.",
|                                               "Description":  "Allows the teams-app to read all aiInsights for online meetings where the Teams-app is installed, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "df01ed3b-eb61-4eca-9965-6b3d789751b2",
|                                               "Value":  "OnlineMeetingArtifact.Read.All",
|                                               "DisplayName":  "Read online meeting artifacts",
|                                               "Description":  "Allows the app to read online meeting artifacts in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a4a08342-c95d-476b-b943-97e100569c8d",
|                                               "Value":  "OnlineMeetingRecording.Read.All",
|                                               "DisplayName":  "Read all recordings of online meetings.",
|                                               "Description":  "Allows the app to read all recordings of all online meetings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c1684f21-1984-47fa-9d61-2dc8c296bb70",
|                                               "Value":  "OnlineMeetings.Read.All",
|                                               "DisplayName":  "Read online meeting details",
|                                               "Description":  "Allows the app to read online meeting details in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b8bb2037-6e08-44ac-a4ea-4674e010e2a4",
|                                               "Value":  "OnlineMeetings.ReadWrite.All",
|                                               "DisplayName":  "Read and create online meetings",
|                                               "Description":  "Allows the app to read and create online meetings as an application in your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a4a80d8d-d283-4bd8-8504-555ec3870630",
|                                               "Value":  "OnlineMeetingTranscript.Read.All",
|                                               "DisplayName":  "Read all transcripts of online meetings.",
|                                               "Description":  "Allows the app to read all transcripts of all online meetings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bb70e231-92dc-4729-aff5-697b3f04be95",
|                                               "Value":  "OnPremDirectorySynchronization.Read.All",
|                                               "DisplayName":  "Read all on-premises directory synchronization information",
|                                               "Description":  "Allows the app to read all on-premises directory synchronization information for the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c22a92cc-79bf-4bb1-8b6c-e0a05d3d80ce",
|                                               "Value":  "OnPremDirectorySynchronization.ReadWrite.All",
|                                               "DisplayName":  "Read and write all on-premises directory synchronization information",
|                                               "Description":  "Allows the app to read and write all on-premises directory synchronization information for the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0b57845e-aa49-4e6f-8109-ce654fffa618",
|                                               "Value":  "OnPremisesPublishingProfiles.ReadWrite.All",
|                                               "DisplayName":  "Manage on-premises published resources",
|                                               "Description":  "Allows the app to create, view, update and delete on-premises published resources, on-premises agents and agent groups, as part of a hybrid identity configuration, without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "498476ce-e0fe-48b0-b801-37ba7e2685c6",
|                                               "Value":  "Organization.Read.All",
|                                               "DisplayName":  "Read organization information",
|                                               "Description":  "Allows the app to read the organization and related resources, without a signed-in user. Related resources include things like subscribed skus and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "292d869f-3427-49a8-9dab-8c70152b74e9",
|                                               "Value":  "Organization.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization information",
|                                               "Description":  "Allows the app to read and write the organization and related resources, without a signed-in user. Related resources include things like subscribed skus and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "eb76ac34-0d62-4454-b97c-185e4250dc20",
|                                               "Value":  "OrganizationalBranding.Read.All",
|                                               "DisplayName":  "Read organizational branding information",
|                                               "Description":  "Allows the app to read the organizational branding information, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d2ebfbc1-a5f8-424b-83a6-56ab5927a73c",
|                                               "Value":  "OrganizationalBranding.ReadWrite.All",
|                                               "DisplayName":  "Read and write organizational branding information",
|                                               "Description":  "Allows the app to read and write the organizational branding information, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e1a88a34-94c4-4418-be12-c87b00e26bea",
|                                               "Value":  "OrgContact.Read.All",
|                                               "DisplayName":  "Read organizational contacts",
|                                               "Description":  "Allows the app to read all organizational contacts without a signed-in user.  These contacts are managed by the organization and are different from a user\u0027s personal contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "56c84fa9-ea1f-4a15-90f2-90ef41ece2c9",
|                                               "Value":  "OrgSettings-AppsAndServices.Read.All",
|                                               "DisplayName":  "Read organization-wide apps and services settings",
|                                               "Description":  "Allows the app to read organization-wide apps and services settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4a8e4191-c1c8-45f8-b801-f9a1a5ee6ad3",
|                                               "Value":  "OrgSettings-AppsAndServices.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide apps and services settings",
|                                               "Description":  "Allows the app to read and write organization-wide apps and services settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c18ae2dc-d9f3-4495-a93f-18980a0e159f",
|                                               "Value":  "OrgSettings-DynamicsVoice.Read.All",
|                                               "DisplayName":  "Read organization-wide Dynamics customer voice settings",
|                                               "Description":  "Allows the app to read organization-wide Dynamics customer voice settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c3f1cc32-8bbd-4ab6-bd33-f270e0d9e041",
|                                               "Value":  "OrgSettings-DynamicsVoice.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Dynamics customer voice settings",
|                                               "Description":  "Allows the app to read and write organization-wide Dynamics customer voice settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "434d7c66-07c6-4b1f-ab21-417cf2cdaaca",
|                                               "Value":  "OrgSettings-Forms.Read.All",
|                                               "DisplayName":  "Read organization-wide Microsoft Forms settings",
|                                               "Description":  "Allows the app to read organization-wide Microsoft Forms settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2cb92fee-97a3-4034-8702-24a6f5d0d1e9",
|                                               "Value":  "OrgSettings-Forms.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Microsoft Forms settings",
|                                               "Description":  "Allows the app to read and write organization-wide Microsoft Forms settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6cdf1fb1-b46f-424f-9493-07247caa22e2",
|                                               "Value":  "OrgSettings-Microsoft365Install.Read.All",
|                                               "DisplayName":  "Read organization-wide Microsoft 365 apps installation settings",
|                                               "Description":  "Allows the app to read organization-wide Microsoft 365 apps installation settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "83f7232f-763c-47b2-a097-e35d2cbe1da5",
|                                               "Value":  "OrgSettings-Microsoft365Install.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Microsoft 365 apps installation settings",
|                                               "Description":  "Allows the app to read and write organization-wide Microsoft 365 apps installation settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e4d9cd09-d858-4363-9410-abb96737f0cf",
|                                               "Value":  "OrgSettings-Todo.Read.All",
|                                               "DisplayName":  "Read organization-wide Microsoft To Do settings",
|                                               "Description":  "Allows the app to read organization-wide Microsoft To Do settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5febc9da-e0d0-4576-bd13-ae70b2179a39",
|                                               "Value":  "OrgSettings-Todo.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Microsoft To Do settings",
|                                               "Description":  "Allows the app to read and write organization-wide Microsoft To Do settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7c3e1994-38ff-4412-a99b-9369f6bb7706",
|                                               "Value":  "PartnerBilling.Read.All",
|                                               "DisplayName":  "Read all billing data for your company\u0027s tenant",
|                                               "Description":  "Allows the app to read all of billing data from Microsoft for your company\u0027s tenant, without a signed-in user. This includes reading billed and unbilled azure usage and invoice reconciliation data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "21ffa320-2e7f-47d3-a466-7ff04d2dd68d",
|                                               "Value":  "PartnerSecurity.Read.All",
|                                               "DisplayName":  "Read security alerts of customer with CSP relationship",
|                                               "Description":  "Allows the app to read security alerts of customer with CSP relationship, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "04a2c935-5b4b-474a-be42-11f53111f271",
|                                               "Value":  "PartnerSecurity.ReadWrite.All",
|                                               "DisplayName":  "Read security alerts and update status of security alerts of customer with CSP relationship",
|                                               "Description":  "Allows the app to read security alerts and update status of alerts of customer with CSP relationship, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bdfb26d9-bb36-49be-9b4c-b8cbf4b05808",
|                                               "Value":  "PendingExternalUserProfile.Read.All",
|                                               "DisplayName":  "Read all pending external user profiles",
|                                               "Description":  "Allows the app to read available properties of pending external user profiles, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8363c2b8-6ff7-420b-9966-c5884c2d48bc",
|                                               "Value":  "PendingExternalUserProfile.ReadWrite.All",
|                                               "DisplayName":  "Read and write all pending external user profiles",
|                                               "Description":  "Allows the app to read and write available properties of pending external user profiles, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b528084d-ad10-4598-8b93-929746b4d7d6",
|                                               "Value":  "People.Read.All",
|                                               "DisplayName":  "Read all users\u0027 relevant people lists",
|                                               "Description":  "Allows the app to read any user\u0027s scored list of relevant people, without a signed-in user. The list can include local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype)."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ef02f2e7-e22d-4c77-8614-8f765683b86e",
|                                               "Value":  "PeopleSettings.Read.All",
|                                               "DisplayName":  "Read all tenant-wide people settings",
|                                               "Description":  "Allows the application to read tenant-wide people settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b6890674-9dd5-4e42-bb15-5af07f541ae1",
|                                               "Value":  "PeopleSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write all tenant-wide people settings",
|                                               "Description":  "Allows the application to read and write tenant-wide people settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "913b9306-0ce1-42b8-9137-6a7df690a760",
|                                               "Value":  "Place.Read.All",
|                                               "DisplayName":  "Read all company places",
|                                               "Description":  "Allows the app to read company places (conference rooms and room lists) for calendar events and other applications, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f1f5e9aa-ad18-4b97-883e-6aa7e95b7a5f",
|                                               "Value":  "Place.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization places",
|                                               "Description":  "Allows the app to manage organization places (conference rooms and room lists) for calendar events and other applications, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8b724a84-ceac-4fd9-897e-e31ba8f2d7a3",
|                                               "Value":  "PlaceDevice.Read.All",
|                                               "DisplayName":  "Read all workplace devices",
|                                               "Description":  "Allows the app to read all workplace devices, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2d510721-5c4e-43cd-bfdb-ac0f8819fb92",
|                                               "Value":  "PlaceDevice.ReadWrite.All",
|                                               "DisplayName":  "Read and write all workplace devices",
|                                               "Description":  "Allows the app to read and write all workplace devices, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "27fc435f-44e2-4b30-bf3c-e0ce74aed618",
|                                               "Value":  "PlaceDeviceTelemetry.ReadWrite.All",
|                                               "DisplayName":  "Read and write telemetry for all workplace devices.",
|                                               "Description":  "Allows the app to read and write telemetry for all workplace devices, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "246dd0d5-5bd0-4def-940b-0421030a5b68",
|                                               "Value":  "Policy.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s policies",
|                                               "Description":  "Allows the app to read all your organization\u0027s policies without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8e3bc81b-d2f3-4b7b-838c-32c88218d2f0",
|                                               "Value":  "Policy.Read.AuthenticationMethod",
|                                               "DisplayName":  "Read authentication method policies",
|                                               "Description":  "Allows the app to read all authentication method policies for the tenant, without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "227900ff-df89-40f8-90e2-8157cf6995d5",
|                                               "Value":  "Policy.Read.B2BManagementPolicy",
|                                               "DisplayName":  "Read your organization\u0027s B2BManagement policies",
|                                               "Description":  "Allows the app to read all your organization\u0027s B2BManagement policies without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "37730810-e9ba-4e46-b07e-8ca78d182097",
|                                               "Value":  "Policy.Read.ConditionalAccess",
|                                               "DisplayName":  "Read your organization\u0027s conditional access policies",
|                                               "Description":  "Allows the app to read your organization\u0027s conditional access policies, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bdba4817-6ba1-4a7c-8a01-be9bc7c242dd",
|                                               "Value":  "Policy.Read.DeviceConfiguration",
|                                               "DisplayName":  "Read your organization\u0027s device configuration policies",
|                                               "Description":  "Allows the application to read your organization\u0027s device configuration policies without a signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b21b72f6-4e6a-4533-9112-47eea9f97b28",
|                                               "Value":  "Policy.Read.IdentityProtection",
|                                               "DisplayName":  "Read your organization’s identity protection policy",
|                                               "Description":  "Allows the app to read your organization’s identity protection policy without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9e640839-a198-48fb-8b9a-013fd6f6cbcd",
|                                               "Value":  "Policy.Read.PermissionGrant",
|                                               "DisplayName":  "Read consent and permission grant policies",
|                                               "Description":  "Allows the app to read policies related to consent and permission grants for applications, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "77c863fd-06c0-47ce-a7eb-49773e89d319",
|                                               "Value":  "Policy.ReadWrite.AccessReview",
|                                               "DisplayName":  "Read and write your organization\u0027s directory access review default policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s directory access review default policy without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "be74164b-cff1-491c-8741-e671cb536e13",
|                                               "Value":  "Policy.ReadWrite.ApplicationConfiguration",
|                                               "DisplayName":  "Read and write your organization\u0027s application configuration policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s application configuration policies, without a signed-in user.  This includes policies such as activityBasedTimeoutPolicy, claimsMappingPolicy, homeRealmDiscoveryPolicy, tokenIssuancePolicy  and tokenLifetimePolicy."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "25f85f3c-f66c-4205-8cd5-de92dd7f0cec",
|                                               "Value":  "Policy.ReadWrite.AuthenticationFlows",
|                                               "DisplayName":  "Read and write authentication flow policies",
|                                               "Description":  "Allows the app to read and write all authentication flow policies for the tenant, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "29c18626-4985-4dcd-85c0-193eef327366",
|                                               "Value":  "Policy.ReadWrite.AuthenticationMethod",
|                                               "DisplayName":  "Read and write all authentication method policies ",
|                                               "Description":  "Allows the app to read and write all authentication method policies for the tenant, without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fb221be6-99f2-473f-bd32-01c6a0e9ca3b",
|                                               "Value":  "Policy.ReadWrite.Authorization",
|                                               "DisplayName":  "Read and write your organization\u0027s authorization policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s authorization policy without a signed in user. For example, authorization policies can control some of the permissions that the out-of-the-box user role has by default."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "886bd2d9-5b8b-4b49-adea-ca75fb50d9ef",
|                                               "Value":  "Policy.ReadWrite.B2BManagementPolicy",
|                                               "DisplayName":  "Read and write your organization\u0027s B2BManagement policies",
|                                               "Description":  "Allows the app to read and write all your organization\u0027s B2BManagement policies without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "01c0a623-fc9b-48e9-b794-0756f8e8f067",
|                                               "Value":  "Policy.ReadWrite.ConditionalAccess",
|                                               "DisplayName":  "Read and write your organization\u0027s conditional access policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s conditional access policies, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "999f8c63-0a38-4f1b-91fd-ed1947bdd1a9",
|                                               "Value":  "Policy.ReadWrite.ConsentRequest",
|                                               "DisplayName":  "Read and write your organization\u0027s consent request policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s consent requests policy without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "338163d7-f101-4c92-94ba-ca46fe52447c",
|                                               "Value":  "Policy.ReadWrite.CrossTenantAccess",
|                                               "DisplayName":  "Read and write your organization\u0027s cross tenant access policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s cross-tenant access policies and configuration for automatic user consent settings to suppress consent prompts for users of the other tenant on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a6325ae7-2b73-4dbd-abed-fbeacfbf8696",
|                                               "Value":  "Policy.ReadWrite.CrossTenantCapability",
|                                               "DisplayName":  "Read and write your organization\u0027s M365 cross tenant access capabilities",
|                                               "Description":  "Allows the app to read and write your organization\u0027s M365 cross tenant access capabilities without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "230fb2d5-aa21-49c1-bfa7-ae1be179d867",
|                                               "Value":  "Policy.ReadWrite.DeviceConfiguration",
|                                               "DisplayName":  "Read and write your organization\u0027s device configuration policies",
|                                               "Description":  "Allows the application to read and write your organization\u0027s device configuration policies without a signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "03cc4f92-788e-4ede-b93f-199424d144a5",
|                                               "Value":  "Policy.ReadWrite.ExternalIdentities",
|                                               "DisplayName":  "Read and write your organization\u0027s external identities policy",
|                                               "Description":  "Allows the application to read and update the organization\u0027s external identities policy without a signed-in user.  For example, external identities policy controls if users invited to access resources in your organization via B2B collaboration or B2B direct connect are allowed to self-service leave."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2044e4f1-e56c-435b-925c-44cd8f6ba89a",
|                                               "Value":  "Policy.ReadWrite.FeatureRollout",
|                                               "DisplayName":  "Read and write feature rollout policies",
|                                               "Description":  "Allows the app to read and write feature rollout policies without a signed-in user. Includes abilities to assign and remove users and groups to rollout of a specific feature."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "90bbca0b-227c-4cdc-8083-1c6cfb95bac6",
|                                               "Value":  "Policy.ReadWrite.FedTokenValidation",
|                                               "DisplayName":  "Read and write your organization\u0027s federated token validation policy",
|                                               "Description":  "Allows the application to read and update the organization\u0027s federated token validation policy without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2dcf8603-09eb-4078-b1ec-d30a1a76b873",
|                                               "Value":  "Policy.ReadWrite.IdentityProtection",
|                                               "DisplayName":  "Read and write your organization’s identity protection policy ",
|                                               "Description":  "Allows the app to read and write your organization’s identity protection policy without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a402ca1c-2696-4531-972d-6e5ee4aa11ea",
|                                               "Value":  "Policy.ReadWrite.PermissionGrant",
|                                               "DisplayName":  "Manage consent and permission grant policies",
|                                               "Description":  "Allows the app to manage policies related to consent and permission grants for applications, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1c6e93a6-28e2-4cbb-9f64-1a46a821124d",
|                                               "Value":  "Policy.ReadWrite.SecurityDefaults",
|                                               "DisplayName":  "Read and write your organization\u0027s security defaults policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s security defaults policy, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "79a677f7-b79d-40d0-a36a-3e6f8688dd7a",
|                                               "Value":  "Policy.ReadWrite.TrustFramework",
|                                               "DisplayName":  "Read and write your organization\u0027s trust framework policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s trust framework policies without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a70e0c2d-e793-494c-94c4-118fa0a67f42",
|                                               "Value":  "Presence.Read.All",
|                                               "DisplayName":  "Read presence information for all users",
|                                               "Description":  "Allows the app to read presence information of all users in the directory without a signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "83cded22-8297-4ff6-a7fa-e97e9545a259",
|                                               "Value":  "Presence.ReadWrite.All",
|                                               "DisplayName":  "Read and write presence information for all users",
|                                               "Description":  "Allows the app to read all presence information and write activity and availability of all users in the directory without a signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, time zone and location."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9709bb33-4549-49d4-8ed9-a8f65e45bb0f",
|                                               "Value":  "Printer.Read.All",
|                                               "DisplayName":  "Read printers",
|                                               "Description":  "Allows the application to read printers without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f5b3f73d-6247-44df-a74c-866173fddab0",
|                                               "Value":  "Printer.ReadWrite.All",
|                                               "DisplayName":  "Read and update printers",
|                                               "Description":  "Allows the application to read and update printers without a signed-in user. Does not allow creating (registering) or deleting (unregistering) printers."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "58a52f47-9e36-4b17-9ebe-ce4ef7f3e6c8",
|                                               "Value":  "PrintJob.Manage.All",
|                                               "DisplayName":  "Perform advanced operations on print jobs",
|                                               "Description":  "Allows the application to perform advanced operations like redirecting a print job to another printer without a signed-in user. Also allows the application to read and update the metadata of print jobs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ac6f956c-edea-44e4-bd06-64b1b4b9aec9",
|                                               "Value":  "PrintJob.Read.All",
|                                               "DisplayName":  "Read print jobs",
|                                               "Description":  "Allows the application to read the metadata and document content of print jobs without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fbf67eee-e074-4ef7-b965-ab5ce1c1f689",
|                                               "Value":  "PrintJob.ReadBasic.All",
|                                               "DisplayName":  "Read basic information for print jobs",
|                                               "Description":  "Allows the application to read the metadata of print jobs without a signed-in user. Does not allow access to print job document content."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5114b07b-2898-4de7-a541-53b0004e2e13",
|                                               "Value":  "PrintJob.ReadWrite.All",
|                                               "DisplayName":  "Read and write print jobs",
|                                               "Description":  "Allows the application to read and update the metadata and document content of print jobs without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "57878358-37f4-4d3a-8c20-4816e0d457b1",
|                                               "Value":  "PrintJob.ReadWriteBasic.All",
|                                               "DisplayName":  "Read and write basic information for print jobs",
|                                               "Description":  "Allows the application to read and update the metadata of print jobs without a signed-in user. Does not allow access to print job document content."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b5991872-94cf-4652-9765-29535087c6d8",
|                                               "Value":  "PrintSettings.Read.All",
|                                               "DisplayName":  "Read tenant-wide print settings",
|                                               "Description":  "Allows the application to read tenant-wide print settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "456b71a7-0ee0-4588-9842-c123fcc8f664",
|                                               "Value":  "PrintTaskDefinition.ReadWrite.All",
|                                               "DisplayName":  "Read, write and update print task definitions",
|                                               "Description":  "Allows the application to read and update print task definitions without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e7ebe2d9-6e26-487a-8286-191d623a6904",
|                                               "Value":  "PrivilegedAccess-CustomExt.Read.All",
|                                               "DisplayName":  "Read Privileged Access (PIM) custom extensions",
|                                               "Description":  "Allows the app to read Privileged Access (PIM) custom extensions for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "124325f3-0c46-4c57-a050-d6d1a82510f6",
|                                               "Value":  "PrivilegedAccess-CustomExt.ReadWrite.All",
|                                               "DisplayName":  "Read and write Privileged Access (PIM) custom extensions",
|                                               "Description":  "Allows the app to read and write Privileged Access (PIM) custom extensions for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4cdc2547-9148-4295-8d11-be0db1391d6b",
|                                               "Value":  "PrivilegedAccess.Read.AzureAD",
|                                               "DisplayName":  "Read privileged access to Azure AD roles",
|                                               "Description":  "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "01e37dc9-c035-40bd-b438-b2879c4870a6",
|                                               "Value":  "PrivilegedAccess.Read.AzureADGroup",
|                                               "DisplayName":  "Read privileged access to Azure AD groups",
|                                               "Description":  "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5df6fe86-1be0-44eb-b916-7bd443a71236",
|                                               "Value":  "PrivilegedAccess.Read.AzureResources",
|                                               "DisplayName":  "Read privileged access to Azure resources",
|                                               "Description":  "Allows the app to read time-based assignment and just-in-time elevation of user privileges to audit Azure resources in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "854d9ab1-6657-4ec8-be45-823027bcd009",
|                                               "Value":  "PrivilegedAccess.ReadWrite.AzureAD",
|                                               "DisplayName":  "Read and write privileged access to Azure AD roles",
|                                               "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2f6817f8-7b12-4f0f-bc18-eeaf60705a9e",
|                                               "Value":  "PrivilegedAccess.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read and write privileged access to Azure AD groups",
|                                               "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6f9d5abc-2db6-400b-a267-7de22a40fb87",
|                                               "Value":  "PrivilegedAccess.ReadWrite.AzureResources",
|                                               "DisplayName":  "Read and write privileged access to Azure resources",
|                                               "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation of Azure resources (like your subscriptions, resource groups, storage, compute) in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cd4161cb-f098-48f8-a884-1eda9a42434c",
|                                               "Value":  "PrivilegedAssignmentSchedule.Read.AzureADGroup",
|                                               "DisplayName":  "Read assignment schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read time-based assignment schedules for access to Azure AD groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3a728f2e-df1d-4294-9899-86f601fae70a",
|                                               "Value":  "PrivilegedAssignmentSchedule.Read.EntraAppRole",
|                                               "DisplayName":  "Read assignment schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "41202f2c-f7ab-45be-b001-85c9728b9d69",
|                                               "Value":  "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read, create, and delete assignment schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read, create, and delete time-based assignment schedules for access to Azure AD groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "81adad77-a25a-489d-ac43-321115620139",
|                                               "Value":  "PrivilegedAssignmentSchedule.ReadWrite.EntraAppRole",
|                                               "DisplayName":  "Read, create, and delete assignment schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read, create, and delete time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "55d1104b-3821-413d-b3ca-e2393d333cd3",
|                                               "Value":  "PrivilegedAssignmentSchedule.Remove.AzureADGroup",
|                                               "DisplayName":  "Delete assignment schedules for access to Azure AD groups",
|                                               "Description":  "Delete time-based assignment schedules for access to Azure AD groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "edb419d6-7edc-42a3-9345-509bfdf5d87c",
|                                               "Value":  "PrivilegedEligibilitySchedule.Read.AzureADGroup",
|                                               "DisplayName":  "Read eligibility schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read time-based eligibility schedules for access to Azure AD groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d2ab45a0-ed46-4f7f-806a-0f1146144d5a",
|                                               "Value":  "PrivilegedEligibilitySchedule.Read.EntraAppRole",
|                                               "DisplayName":  "Read eligibility schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "618b6020-bca8-4de6-99f6-ef445fa4d857",
|                                               "Value":  "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read, create, and delete eligibility schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read, create, and delete time-based eligibility schedules for access to Azure AD groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7f4c39f1-1aa7-44b7-ab05-38df2609c37a",
|                                               "Value":  "PrivilegedEligibilitySchedule.ReadWrite.EntraAppRole",
|                                               "DisplayName":  "Read, create, and delete eligibility schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read, create, and delete time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "55745561-7572-4314-a737-a2c2a1b0dd2e",
|                                               "Value":  "PrivilegedEligibilitySchedule.Remove.AzureADGroup",
|                                               "DisplayName":  "Delete eligibility schedules for access to Azure AD groups",
|                                               "Description":  "Delete time-based eligibility schedules for access to Azure AD groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e24d31aa-e1ab-4c80-85fe-23018690335d",
|                                               "Value":  "ProfilePhoto.Read.All",
|                                               "DisplayName":  "Read profile photo of a user or group",
|                                               "Description":  "Allows the app to read all profile photos of users and groups, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "27baa7f6-5dfb-4ba8-b1d3-1e812c143013",
|                                               "Value":  "ProfilePhoto.ReadWrite.All",
|                                               "DisplayName":  "Read and write profile photo of a user or group",
|                                               "Description":  "Allows the app to read and write all profile photos of users and groups, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "eedb7fdd-7539-4345-a38b-4839e4a84cbd",
|                                               "Value":  "ProgramControl.Read.All",
|                                               "DisplayName":  "Read all programs",
|                                               "Description":  "Allows the app to read programs and program controls in the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "60a901ed-09f7-4aa5-a16e-7dd3d6f9de36",
|                                               "Value":  "ProgramControl.ReadWrite.All",
|                                               "DisplayName":  "Manage all programs",
|                                               "Description":  "Allows the app to read, update, delete and perform actions on programs and program controls in the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e5a76501-dbb0-492c-ab55-5d09e8837263",
|                                               "Value":  "ProtectionScopes.Compute.All",
|                                               "DisplayName":  "Compute Purview policies at tenant scope",
|                                               "Description":  "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for all users across tenant."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fe696d63-5e1f-4515-8232-cccc316903c6",
|                                               "Value":  "ProtectionScopes.Compute.User",
|                                               "DisplayName":  "Compute Purview policies for an individual user",
|                                               "Description":  "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for an individual user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "091937d3-3e38-47a1-8649-b2f99d3035f1",
|                                               "Value":  "ProvisioningLog.Read.All",
|                                               "DisplayName":  "Read all provisioning log data",
|                                               "Description":  "Allows the app to read and query your provisioning log activities, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "214fda0c-514a-4650-b037-b562b1a66124",
|                                               "Value":  "PublicKeyInfrastructure.Read.All",
|                                               "DisplayName":  "Read all certificate based authentication configurations",
|                                               "Description":  "Allows the application to read  certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a2b63618-5350-462d-b1b3-ba6eb3684e26",
|                                               "Value":  "PublicKeyInfrastructure.ReadWrite.All",
|                                               "DisplayName":  "Read and write all certificate based authentication configurations",
|                                               "Description":  "Allows the application to read and write certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ee49e170-1dd1-4030-b44c-61ad6e98f743",
|                                               "Value":  "QnA.Read.All",
|                                               "DisplayName":  "Read all Question and Answers ",
|                                               "Description":  "Allows an app to read all question and answers, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "abafe00f-ea87-4c63-b8a8-0e7bb0a88144",
|                                               "Value":  "RealTimeActivityFeed.Read.All",
|                                               "DisplayName":  "Access real-time enriched data in a meeting as an app",
|                                               "Description":  "Allows the app to get direct access to real-time enriched data in a meeting, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ac3a2b8e-03a3-4da9-9ce0-cbe28bf1accd",
|                                               "Value":  "RecordsManagement.Read.All",
|                                               "DisplayName":  "Read Records Management configuration, labels and policies",
|                                               "Description":  "Allows the application to read any data from Records Management, such as configuration, labels, and policies without the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "eb158f57-df43-4751-8b21-b8932adb3d34",
|                                               "Value":  "RecordsManagement.ReadWrite.All",
|                                               "DisplayName":  "Read and write Records Management configuration, labels and policies",
|                                               "Description":  "Allow the application to create, update and delete any data from Records Management, such as configuration, labels, and policies without the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "230c1aed-a721-4c5d-9cb4-a90514e508ef",
|                                               "Value":  "Reports.Read.All",
|                                               "DisplayName":  "Read all usage reports",
|                                               "Description":  "Allows an app to read all service usage reports without a signed-in user.  Services that provide usage reports include Office 365 and Azure Active Directory."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ee353f83-55ef-4b78-82da-555bfa2b4b95",
|                                               "Value":  "ReportSettings.Read.All",
|                                               "DisplayName":  "Read all admin report settings",
|                                               "Description":  "Allows the app to read all admin report settings, such as whether to display concealed information in reports, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2a60023f-3219-47ad-baa4-40e17cd02a1d",
|                                               "Value":  "ReportSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write all admin report settings",
|                                               "Description":  "Allows the app to read and update all admin report settings, such as whether to display concealed information in reports, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2ff643d8-43e4-4a9b-88c1-86cb4a4b4c2f",
|                                               "Value":  "ResourceSpecificPermissionGrant.ReadForChat.All",
|                                               "DisplayName":  "Read resource specific permissions granted on a chat",
|                                               "Description":  "Allows the app to read the resource specific permissions granted on the chat without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ad4600ae-d900-42cb-a9a2-2415d05593d0",
|                                               "Value":  "ResourceSpecificPermissionGrant.ReadForTeam.All",
|                                               "DisplayName":  "Read resource specific permissions granted on a team",
|                                               "Description":  "Allows the app to read the resource specific permissions granted on the team without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "acfca4d5-f49f-40ed-9648-84068b474c73",
|                                               "Value":  "ResourceSpecificPermissionGrant.ReadForUser.All",
|                                               "DisplayName":  "Read all resource specific permissions granted on user accounts",
|                                               "Description":  "Allows the app to read all resource specific permissions granted on user accounts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2a6baefd-edea-4ff6-b24e-bebcaa27a50d",
|                                               "Value":  "RiskPreventionProviders.Read.All",
|                                               "DisplayName":  "Read all identity risk prevention providers",
|                                               "Description":  "Allows the app to read your organization\u0027s risk prevention providers, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7fc7225d-eb37-4c39-90f3-a33a57cf1081",
|                                               "Value":  "RiskPreventionProviders.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity risk prevention providers",
|                                               "Description":  "Allows the app to read and write your organization\u0027s risk prevention providers, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d5fe8ce8-684c-4c83-a52c-46e882ce4be1",
|                                               "Value":  "RoleAssignmentSchedule.Read.Directory",
|                                               "DisplayName":  "Read all active role assignments and role schedules for your company\u0027s directory",
|                                               "Description":  "Allows the app to read the active role-based access control (RBAC) assignments and schedules for your company\u0027s directory, without a signed-in user. This includes reading directory role templates, and directory roles."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dd199f4a-f148-40a4-a2ec-f0069cc799ec",
|                                               "Value":  "RoleAssignmentSchedule.ReadWrite.Directory",
|                                               "DisplayName":  "Read, update, and delete all policies for privileged role assignments of your company\u0027s directory",
|                                               "Description":  "Allows the app to read, update, and delete policies for privileged role-based access control (RBAC) assignments of your company\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d3495511-98b7-4df3-b317-4e35c19f6129",
|                                               "Value":  "RoleAssignmentSchedule.Remove.Directory",
|                                               "DisplayName":  "Delete all active role assignments of your company\u0027s directory",
|                                               "Description":  "Delete all active privileged role-based access control (RBAC) assignments of your company\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ff278e11-4a33-4d0c-83d2-d01dc58929a5",
|                                               "Value":  "RoleEligibilitySchedule.Read.Directory",
|                                               "DisplayName":  "Read all eligible role assignments and role schedules for your company\u0027s directory",
|                                               "Description":  "Allows the app to read the eligible role-based access control (RBAC) assignments and schedules for your company\u0027s directory, without a signed-in user. This includes reading directory role templates, and directory roles."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fee28b28-e1f3-4841-818e-2704dc62245f",
|                                               "Value":  "RoleEligibilitySchedule.ReadWrite.Directory",
|                                               "DisplayName":  "Read, update, and delete all eligible role assignments and schedules for your company\u0027s directory",
|                                               "Description":  "Allows the app to read and manage the eligible role-based access control (RBAC) assignments and schedules for your company\u0027s directory, without a signed-in user. This includes managing eligible directory role membership, and reading directory role templates, directory roles and eligible memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "79c7e69c-0d9f-4eff-97a8-49170a5a08ba",
|                                               "Value":  "RoleEligibilitySchedule.Remove.Directory",
|                                               "DisplayName":  "Delete all eligible role assignments of your company\u0027s directory",
|                                               "Description":  "Delete all eligible privileged role-based access control (RBAC) assignments of your company\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c7fbd983-d9aa-4fa7-84b8-17382c103bc4",
|                                               "Value":  "RoleManagement.Read.All",
|                                               "DisplayName":  "Read role management data for all RBAC providers",
|                                               "Description":  "Allows the app to read role-based access control (RBAC) settings for all RBAC providers without a signed-in user. This includes reading role definitions and role assignments."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "031a549a-bb80-49b6-8032-2068448c6a3c",
|                                               "Value":  "RoleManagement.Read.CloudPC",
|                                               "DisplayName":  "Read Cloud PC RBAC settings",
|                                               "Description":  "Allows the app to read the Cloud PC role-based access control (RBAC) settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4d6e30d1-e64e-4ae7-bf9d-c706cc928cef",
|                                               "Value":  "RoleManagement.Read.Defender",
|                                               "DisplayName":  "Read M365 Defender RBAC configuration",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "483bed4a-2ad3-4361-a73b-c83ccdbdc53c",
|                                               "Value":  "RoleManagement.Read.Directory",
|                                               "DisplayName":  "Read all directory RBAC settings",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, without a signed-in user.  This includes reading directory role templates, directory roles and memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c769435f-f061-4d0b-8ff1-3d39870e5f85",
|                                               "Value":  "RoleManagement.Read.Exchange",
|                                               "DisplayName":  "Read Exchange Online RBAC configuration",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) configuration for your organization\u0027s Exchange Online service, without a signed-in user. This includes reading Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "274d0592-d1b6-44bd-af1d-26d259bcb43a",
|                                               "Value":  "RoleManagement.ReadWrite.CloudPC",
|                                               "DisplayName":  "Read and write all Cloud PC RBAC settings",
|                                               "Description":  "Allows the app to read and manage the Cloud PC role-based access control (RBAC) settings, without a signed-in user. This includes reading and managing Cloud PC role definitions and memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8b7e8c0a-7e9d-4049-97ec-04b5e1bcaf05",
|                                               "Value":  "RoleManagement.ReadWrite.Defender",
|                                               "DisplayName":  "Read M365 Defender RBAC configuration",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8",
|                                               "Value":  "RoleManagement.ReadWrite.Directory",
|                                               "DisplayName":  "Read and write all directory RBAC settings",
|                                               "Description":  "Allows the app to read and manage the role-based access control (RBAC) settings for your company\u0027s directory, without a signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "025d3225-3f02-4882-b4c0-cd5b541a4e80",
|                                               "Value":  "RoleManagement.ReadWrite.Exchange",
|                                               "DisplayName":  "Read and write Exchange Online RBAC configuration",
|                                               "Description":  "Allows the app to read and manage the role-based access control (RBAC) settings for your organization\u0027s Exchange Online service, without a signed-in user. This includes reading, creating, updating, and deleting Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ef31918f-2d50-4755-8943-b8638c0a077e",
|                                               "Value":  "RoleManagementAlert.Read.Directory",
|                                               "DisplayName":  "Read all alert data for your company\u0027s directory",
|                                               "Description":  "Allows the app to read all role-based access control (RBAC) alerts for your company\u0027s directory, without a signed-in user. This includes reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "11059518-d6a6-4851-98ed-509268489c4a",
|                                               "Value":  "RoleManagementAlert.ReadWrite.Directory",
|                                               "DisplayName":  "Read all alert data, configure alerts, and take actions on all alerts for your company\u0027s directory",
|                                               "Description":  "Allows the app to read and manage all role-based access control (RBAC) alerts for your company\u0027s directory, without a signed-in user. This includes managing alert settings, initiating alert scans, dismissing alerts, remediating alert incidents, and reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "69e67828-780e-47fd-b28c-7b27d14864e6",
|                                               "Value":  "RoleManagementPolicy.Read.AzureADGroup",
|                                               "DisplayName":  "Read all policies in PIM for Groups",
|                                               "Description":  "Allows the app to read policies in Privileged Identity Management for Groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fdc4c997-9942-4479-bfcb-75a36d1138df",
|                                               "Value":  "RoleManagementPolicy.Read.Directory",
|                                               "DisplayName":  "Read all policies for privileged role assignments of your company\u0027s directory",
|                                               "Description":  "Allows the app to read policies for privileged role-based access control (RBAC) assignments of your company\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3d201a4e-90f1-420d-bd4f-3beec28a46b9",
|                                               "Value":  "RoleManagementPolicy.Read.EntraAppRole",
|                                               "DisplayName":  "Read all policies in PIM for App Roles",
|                                               "Description":  "Allows the app to read policies in Privileged Identity Management for App Roles, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b38dcc4d-a239-4ed6-aa84-6c65b284f97c",
|                                               "Value":  "RoleManagementPolicy.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read, update, and delete all policies in PIM for Groups",
|                                               "Description":  "Allows the app to read, update, and delete policies in Privileged Identity Management for Groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "31e08e0a-d3f7-4ca2-ac39-7343fb83e8ad",
|                                               "Value":  "RoleManagementPolicy.ReadWrite.Directory",
|                                               "DisplayName":  "Read, update, and delete all policies for privileged role assignments of your company\u0027s directory",
|                                               "Description":  "Allows the app to read, update, and delete policies for privileged role-based access control (RBAC) assignments of your company\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ec563bdb-80dc-47c0-81d3-bff47cc6ac06",
|                                               "Value":  "RoleManagementPolicy.ReadWrite.EntraAppRole",
|                                               "DisplayName":  "Manage all policies in PIM for App Roles",
|                                               "Description":  "Allows the app to manage policies in Privileged Identity Management for App Roles, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0b21c159-dbf4-4dbb-a6f6-490e412c716e",
|                                               "Value":  "Schedule-WorkingTime.ReadWrite.All",
|                                               "DisplayName":  "Trigger working time policies and read the working time status",
|                                               "Description":  "Allows the app to trigger the working time policies and read the working time status for other users in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7b2ebf90-d836-437f-b90d-7b62722c4456",
|                                               "Value":  "Schedule.Read.All",
|                                               "DisplayName":  "Read all schedule items",
|                                               "Description":  "Allows the app to read all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b7760610-0545-4e8a-9ec3-cce9e63db01c",
|                                               "Value":  "Schedule.ReadWrite.All",
|                                               "DisplayName":  "Read and write all schedule items",
|                                               "Description":  "Allows the app to manage all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7239b71d-b402-4150-b13d-78ecfe8df441",
|                                               "Value":  "SchedulePermissions.ReadWrite.All",
|                                               "DisplayName":  "Read/Write schedule permissions for a role",
|                                               "Description":  "Allows the app to read/write schedule permissions for a specific role in Shifts application without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ada977a5-b8b1-493b-9a91-66c206d76ecf",
|                                               "Value":  "SearchConfiguration.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s search configuration",
|                                               "Description":  "Allows the app to read search configurations, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0e778b85-fefa-466d-9eec-750569d92122",
|                                               "Value":  "SearchConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write your organization\u0027s search configuration",
|                                               "Description":  "Allows the app to read and write search configurations, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5e0edab9-c148-49d0-b423-ac253e121825",
|                                               "Value":  "SecurityActions.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s security actions",
|                                               "Description":  "Allows the app to read security actions, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f2bf083f-0179-402a-bedb-b2784de8a49b",
|                                               "Value":  "SecurityActions.ReadWrite.All",
|                                               "DisplayName":  "Read and update your organization\u0027s security actions",
|                                               "Description":  "Allows the app to read or update security actions, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "472e4a4d-bb4a-4026-98d1-0b0d74cb74a5",
|                                               "Value":  "SecurityAlert.Read.All",
|                                               "DisplayName":  "Read all security alerts",
|                                               "Description":  "Allows the app to read all security alerts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ed4fca05-be46-441f-9803-1873825f8fdb",
|                                               "Value":  "SecurityAlert.ReadWrite.All",
|                                               "DisplayName":  "Read and write to all security alerts",
|                                               "Description":  "Allows the app to read and write to all security alerts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b48f7ac2-044d-4281-b02f-75db744d6f5f",
|                                               "Value":  "SecurityAnalyzedMessage.Read.All",
|                                               "DisplayName":  "Read metadata and detection details for all emails in your organization",
|                                               "Description":  "Read email metadata and security detection details, without a signed-in user.  "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "04c55753-2244-4c25-87fc-704ab82a4f69",
|                                               "Value":  "SecurityAnalyzedMessage.ReadWrite.All",
|                                               "DisplayName":  "Read metadata, detection details, and execute remediation actions on all emails in your organization",
|                                               "Description":  "Read email metadata and security detection details, and execute remediation actions like deleting an email, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bf394140-e372-4bf9-a898-299cfc7564e5",
|                                               "Value":  "SecurityEvents.Read.All",
|                                               "DisplayName":  "Read your organization’s security events",
|                                               "Description":  "Allows the app to read your organization’s security events without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d903a879-88e0-4c09-b0c9-82f6a1333f84",
|                                               "Value":  "SecurityEvents.ReadWrite.All",
|                                               "DisplayName":  "Read and update your organization’s security events",
|                                               "Description":  "Allows the app to read your organization’s security events without a signed-in user. Also allows the app to update editable properties in security events."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c5bc96f5-b4a1-4cfc-8189-d5f0d772278f",
|                                               "Value":  "SecurityIdentitiesAccount.Read.All",
|                                               "DisplayName":  "Read all identity security available identity accounts",
|                                               "Description":  "Allows the app to read all the identity security available identity accounts without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "af2bf46f-7bf1-4be3-8bad-e17e279e8462",
|                                               "Value":  "SecurityIdentitiesActions.ReadWrite.All",
|                                               "DisplayName":  "Read and perform all identity security available actions",
|                                               "Description":  "Allows the app to read and write identity security available actions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "58971758-9844-4fe4-9fba-7e4ce7a659bf",
|                                               "Value":  "SecurityIdentitiesAutoConfig.Read.All",
|                                               "DisplayName":  "Read sensors window auditing configuration",
|                                               "Description":  "Allows the app to read sensors window auditing configuration without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4f1f0deb-08d1-4ffb-8cca-21dfc362b7c0",
|                                               "Value":  "SecurityIdentitiesAutoConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write sensors window auditing configuration",
|                                               "Description":  "Allows the app to read and write sensors window auditing configuration without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f8dcd971-5d83-4e1e-aa95-ef44611ad351",
|                                               "Value":  "SecurityIdentitiesHealth.Read.All",
|                                               "DisplayName":  "Read all identity security health issues",
|                                               "Description":  "Allows the app to read all the identity security health issues without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ab03ddd5-7ae4-4f2e-8af8-86654f7e0a27",
|                                               "Value":  "SecurityIdentitiesHealth.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity security health issues",
|                                               "Description":  "Allows the app to read and write identity security health issues without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b018cc1c-c680-4e91-bb6e-462ee243fdb5",
|                                               "Value":  "SecurityIdentitiesMigration.Read.All",
|                                               "DisplayName":  "Read all identity security sensor migration",
|                                               "Description":  "Allows the app to read all the identity security sensor migration information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "afd28a5a-707f-4edf-85c2-c446291e63da",
|                                               "Value":  "SecurityIdentitiesMigration.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity security sensor migration",
|                                               "Description":  "Allows the app to read and write identity security sensor migration without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5f0ffea2-f474-4cf2-9834-61cda2bcea5c",
|                                               "Value":  "SecurityIdentitiesSensors.Read.All",
|                                               "DisplayName":  "Read all identity security sensors",
|                                               "Description":  "Allows the app to read all the identity security sensors without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d4dcee6d-0774-412a-b06c-aeabbd99e816",
|                                               "Value":  "SecurityIdentitiesSensors.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity security sensors",
|                                               "Description":  "Allows the app to read and write identity security sensors without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3e5d0bee-973f-4736-a123-4e1ab146f3a8",
|                                               "Value":  "SecurityIdentitiesUserActions.Read.All",
|                                               "DisplayName":  "Read all identity security available user actions",
|                                               "Description":  "Allows the app to read all the identity security available user actions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b4146a3a-dd4f-4af4-8d91-7cc0eef3d041",
|                                               "Value":  "SecurityIdentitiesUserActions.ReadWrite.All",
|                                               "DisplayName":  "Read and perform all identity security available user actions",
|                                               "Description":  "Allows the app to read and write identity security available user actions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "45cc0394-e837-488b-a098-1918f48d186c",
|                                               "Value":  "SecurityIncident.Read.All",
|                                               "DisplayName":  "Read all security incidents",
|                                               "Description":  "Allows the app to read all security incidents, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "34bf0e97-1971-4929-b999-9e2442d941d7",
|                                               "Value":  "SecurityIncident.ReadWrite.All",
|                                               "DisplayName":  "Read and write to all security incidents",
|                                               "Description":  "Allows the app to read and write to all security incidents, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "57f0b71b-a759-45a0-9a0f-cc099fbd9a44",
|                                               "Value":  "SensitivityLabel.Evaluate",
|                                               "DisplayName":  "Evaluate sensitivity labels",
|                                               "Description":  "Allow the app to determine if there is any sensitivity label to be applied automatically to the content or recommended to the user for manual application, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "986fa56a-6680-4aac-af09-4d1765376739",
|                                               "Value":  "SensitivityLabel.Evaluate.All",
|                                               "DisplayName":  "Evaluate labels tenant scope.",
|                                               "Description":  "Allows the app to evaluate all sensitivity label."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3b8e7aad-f6e3-4299-83f8-6fc6a5777f0b",
|                                               "Value":  "SensitivityLabel.Read",
|                                               "DisplayName":  "Get labels application scope.",
|                                               "Description":  "Allows the app to get sensitivity labels."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e46a01e9-b2cf-4d89-8424-bcdc6dd445ab",
|                                               "Value":  "SensitivityLabels.Read.All",
|                                               "DisplayName":  "Get labels tenant scope.",
|                                               "Description":  "Allows the app to get sensitivity labels."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "84fa35c1-f997-4c1c-894c-bb52108cfbbf",
|                                               "Value":  "SentimentSurvey.Export.All",
|                                               "DisplayName":  "Export all Sentiment Survey",
|                                               "Description":  "Allows the app to read all Sentiment Survey, without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2b655018-450a-4845-81e7-d603b1ebffdb",
|                                               "Value":  "ServiceActivity-Exchange.Read.All",
|                                               "DisplayName":  "Read all Exchange service activity",
|                                               "Description":  "Allows the app to read all Exchange service activity, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c766cb16-acc4-4663-ba09-6eedef5876c5",
|                                               "Value":  "ServiceActivity-Microsoft365Web.Read.All",
|                                               "DisplayName":  "Read all Microsoft 365 Web service activity",
|                                               "Description":  "Allows the app to read all Microsoft 365 Web service activity, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "57b4f899-b8c5-47c7-bdd3-c410c55602b7",
|                                               "Value":  "ServiceActivity-OneDrive.Read.All",
|                                               "DisplayName":  "Read all One Drive service activity",
|                                               "Description":  "Allows the app to read all One Drive service activity, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4dfee10b-fa4a-41b5-b34d-ccf54cc0c394",
|                                               "Value":  "ServiceActivity-Teams.Read.All",
|                                               "DisplayName":  "Read all Teams service activity",
|                                               "Description":  "Allows the app to read all Teams service activity, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "79c261e0-fe76-4144-aad5-bdc68fbe4037",
|                                               "Value":  "ServiceHealth.Read.All",
|                                               "DisplayName":  "Read service health",
|                                               "Description":  "Allows the app to read your tenant\u0027s service health information, without a signed-in user. Health information may include service issues or service health overviews."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1b620472-6534-4fe6-9df2-4680e8aa28ec",
|                                               "Value":  "ServiceMessage.Read.All",
|                                               "DisplayName":  "Read service messages",
|                                               "Description":  "Allows the app to read your tenant\u0027s service announcement messages, without a signed-in user. Messages may include information about new or changed features."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5256681e-b7f6-40c0-8447-2d9db68797a0",
|                                               "Value":  "ServicePrincipalEndpoint.Read.All",
|                                               "DisplayName":  "Read service principal endpoints",
|                                               "Description":  "Allows the app to read service principal endpoints"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "89c8469c-83ad-45f7-8ff2-6e3d4285709e",
|                                               "Value":  "ServicePrincipalEndpoint.ReadWrite.All",
|                                               "DisplayName":  "Read and update service principal endpoints",
|                                               "Description":  "Allows the app to update service principal endpoints"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a0521574-fcd8-4742-b29c-f796df57ea70",
|                                               "Value":  "SharePointCrossTenantMigration.Manage.All",
|                                               "DisplayName":  "Read, write and manage SharePoint Cross-Tenant migration settings and tasks",
|                                               "Description":  "Allows the app to read, write and manage your tenant\u0027s SharePoint Cross-Tenant migration settings and tasks, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f5fa52a5-b9ab-4dc3-885e-9e5b4a67068e",
|                                               "Value":  "SharePointCrossTenantMigration.Read.All",
|                                               "DisplayName":  "Read SharePoint Cross-Tenant migration settings and tasks",
|                                               "Description":  "Allows the app to read your tenant\u0027s SharePoint Cross-Tenant migration settings and tasks, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "83d4163d-a2d8-4d3b-9695-4ae3ca98f888",
|                                               "Value":  "SharePointTenantSettings.Read.All",
|                                               "DisplayName":  "Read SharePoint and OneDrive tenant settings",
|                                               "Description":  "Allows the application to read the tenant-level settings of SharePoint and OneDrive, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "19b94e34-907c-4f43-bde9-38b1909ed408",
|                                               "Value":  "SharePointTenantSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and change SharePoint and OneDrive tenant settings",
|                                               "Description":  "Allows the application to read and change the tenant-level settings of SharePoint and OneDrive, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0c7d31ec-31ca-4f58-b6ec-9950b6b0de69",
|                                               "Value":  "ShortNotes.Read.All",
|                                               "DisplayName":  "Read all users\u0027 short notes",
|                                               "Description":  "Allows the app to read all the short notes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "842c284c-763d-4a97-838d-79787d129bab",
|                                               "Value":  "ShortNotes.ReadWrite.All",
|                                               "DisplayName":  "Read, create, edit, and delete all users\u0027 short notes",
|                                               "Description":  "Allows the app to read, create, edit, and delete all the short notes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "28e1fe78-598f-4df4-b55e-18bf34218925",
|                                               "Value":  "SignInIdentifier.Read.All",
|                                               "DisplayName":  "Read all sign-in identifiers",
|                                               "Description":  "Allows the app to read your organization\u0027s sign-in identifiers, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7fc588a2-ea2d-4d1f-bcf7-33c324b149b8",
|                                               "Value":  "SignInIdentifier.ReadWrite.All",
|                                               "DisplayName":  "Read and write all sign-in identifiers",
|                                               "Description":  "Allows the app to read and write your organization\u0027s sign-in identifiers, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e3530185-4080-478c-a4ab-39322704df58",
|                                               "Value":  "Sites.Archive.All",
|                                               "DisplayName":  "Archive/reactivate Site Collections without a signed in user.",
|                                               "Description":  "Allow the application to archive/reactivate site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "80819dd8-2b3b-4551-a1ad-2700fc44f533",
|                                               "Value":  "Sites.Create.All",
|                                               "DisplayName":  "Create Site Collections without a signed in user.",
|                                               "Description":  "Allow the application to create site collections without a signed in user. Upon creation the application will be granted Sites.Selected(application) + FullControl to the newly created site."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a82116e5-55eb-4c41-a434-62fe8a61c773",
|                                               "Value":  "Sites.FullControl.All",
|                                               "DisplayName":  "Have full control of all site collections",
|                                               "Description":  "Allows the app to have full control of all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0c0bf378-bf22-4481-8f81-9e89a9b4960a",
|                                               "Value":  "Sites.Manage.All",
|                                               "DisplayName":  "Create, edit, and delete items and lists in all site collections",
|                                               "Description":  "Allows the app to create or delete document libraries and lists in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "332a536c-c7ef-4017-ab91-336970924f0d",
|                                               "Value":  "Sites.Read.All",
|                                               "DisplayName":  "Read items in all site collections ",
|                                               "Description":  "Allows the app to read documents and list items in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9492366f-7969-46a4-8d15-ed1a20078fff",
|                                               "Value":  "Sites.ReadWrite.All",
|                                               "DisplayName":  "Read and write items in all site collections",
|                                               "Description":  "Allows the app to create, read, update, and delete documents and list items in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "883ea226-0bf2-4a8f-9f9d-92c9162a727d",
|                                               "Value":  "Sites.Selected",
|                                               "DisplayName":  "Access selected site collections",
|                                               "Description":  "Allow the application to access a subset of site collections without a signed in user.  The specific site collections and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dcdfc277-41fd-4d68-ad0c-c3057235bd8e",
|                                               "Value":  "SpiffeTrustDomain.Read.All",
|                                               "DisplayName":  "Read SPIFFE trust domains and child resources",
|                                               "Description":  "Allows the app to read your organization\u0027s SPIFFE trust domains and child resources without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "17b78cfd-eeff-447d-8bab-2795af00055a",
|                                               "Value":  "SpiffeTrustDomain.ReadWrite.All",
|                                               "DisplayName":  "Read and write SPIFFE trust domains and child resources",
|                                               "Description":  "Allows the app to read and write your organization\u0027s SPIFFE trust domains and child resources without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6eff534b-699e-44d9-af61-a4182f0ec37e",
|                                               "Value":  "Storyline.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Viva Engage storylines",
|                                               "Description":  "Allows the app to modify Viva Engage storylines, read all storylines properties, update storyline properties, and delete storyline properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ee1460f0-368b-4153-870a-4e1ca7e72c42",
|                                               "Value":  "SubjectRightsRequest.Read.All",
|                                               "DisplayName":  "Read all subject rights requests",
|                                               "Description":  "Allows the app to read subject rights requests without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8387eaa4-1a3c-41f5-b261-f888138e6041",
|                                               "Value":  "SubjectRightsRequest.ReadWrite.All",
|                                               "DisplayName":  "Read and write all subject rights requests",
|                                               "Description":  "Allows the app to read and write subject rights requests without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5ba43d2f-fa88-4db2-bd1c-a67c5f0fb1ce",
|                                               "Value":  "Synchronization.Read.All",
|                                               "DisplayName":  "Read all Azure AD synchronization data.",
|                                               "Description":  "Allows the application to read Azure AD synchronization information, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9b50c33d-700f-43b1-b2eb-87e89b703581",
|                                               "Value":  "Synchronization.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Azure AD synchronization data.",
|                                               "Description":  "Allows the application to configure the Azure AD synchronization service, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "db31e92a-b9ea-4d87-bf6a-75a37a9ca35a",
|                                               "Value":  "SynchronizationData-User.Upload",
|                                               "DisplayName":  "Upload user data to the identity synchronization service",
|                                               "Description":  "Allows the application to upload bulk user data to the identity synchronization service, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "25c32ff3-849a-494b-b94f-20a8ac4e6774",
|                                               "Value":  "SynchronizationData-User.Upload.OwnedBy",
|                                               "DisplayName":  "Upload user data to the identity sync service for apps that this application creates or owns",
|                                               "Description":  "Allows the application to upload bulk user data to the identity synchronization service for apps that this application creates or owns, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f10e1f91-74ed-437f-a6fd-d6ae88e26c1f",
|                                               "Value":  "Tasks.Read.All",
|                                               "DisplayName":  "Read all users’ tasks and tasklist",
|                                               "Description":  "Allows the app to read all users’ tasks and task lists in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "44e666d1-d276-445b-a5fc-8815eeb81d55",
|                                               "Value":  "Tasks.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users’ tasks and tasklists",
|                                               "Description":  "Allows the app to create, read, update and delete all users’ tasks and task lists in your organization, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "23fc2474-f741-46ce-8465-674744c5c361",
|                                               "Value":  "Team.Create",
|                                               "DisplayName":  "Create teams",
|                                               "Description":  "Allows the app to create teams without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2280dda6-0bfd-44ee-a2f4-cb867cfc4c1e",
|                                               "Value":  "Team.ReadBasic.All",
|                                               "DisplayName":  "Get a list of all teams",
|                                               "Description":  "Get a list of all teams, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "660b7406-55f1-41ca-a0ed-0b035e182f3e",
|                                               "Value":  "TeamMember.Read.All",
|                                               "DisplayName":  "Read the members of all teams",
|                                               "Description":  "Read the members of all teams, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0121dc95-1b9f-4aed-8bac-58c5ac466691",
|                                               "Value":  "TeamMember.ReadWrite.All",
|                                               "DisplayName":  "Add and remove members from all teams",
|                                               "Description":  "Add and remove members from all teams, without a signed-in user. Also allows changing a team member\u0027s role, for example from owner to non-owner."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4437522e-9a86-4a41-a7da-e380edd4a97d",
|                                               "Value":  "TeamMember.ReadWriteNonOwnerRole.All",
|                                               "DisplayName":  "Add and remove members with non-owner role for all teams",
|                                               "Description":  "Add and remove members from all teams, without a signed-in user. Does not allow adding or removing a member with the owner role. Additionally, does not allow the app to elevate an existing member to the owner role."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "70dec828-f620-4914-aa83-a29117306807",
|                                               "Value":  "TeamsActivity.Read.All",
|                                               "DisplayName":  "Read all users\u0027 teamwork activity feed",
|                                               "Description":  "Allows the app to read all users\u0027 teamwork activity feed, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a267235f-af13-44dc-8385-c1dc93023186",
|                                               "Value":  "TeamsActivity.Send",
|                                               "DisplayName":  "Send a teamwork activity to any user",
|                                               "Description":  "Allows the app to create new notifications in users\u0027 teamwork activity feeds without a signed in user. These notifications may not be discoverable or be held or governed by compliance policies."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "22b74aab-d9e4-46f7-9424-f24b42307227",
|                                               "Value":  "TeamsAppInstallation.ManageSelectedForChat.All",
|                                               "DisplayName":  "Manage installation and permission grants of selected Teams apps in all chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any chat, without a signed-in user. Gives the ability to manage permission grants for accessing those specific chats\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b448d252-1f26-4227-b6ff-21ab510975a2",
|                                               "Value":  "TeamsAppInstallation.ManageSelectedForTeam.All",
|                                               "DisplayName":  "Manage installation and permission grants of selected Teams apps in all teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any team, without a signed-in user. Gives the ability to manage permission grants for accessing those specific teams\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e97a9235-5b3c-43c4-b37d-6786a173fae4",
|                                               "Value":  "TeamsAppInstallation.ManageSelectedForUser.All",
|                                               "DisplayName":  "Manage installation and permission grants of selected Teams apps for all user accounts",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any user account, without a signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0fdf35a5-82f8-41ff-9ded-0b761cc73512",
|                                               "Value":  "TeamsAppInstallation.Read.All",
|                                               "DisplayName":  "Read installed Teams apps for all installation scopes",
|                                               "Description":  "Allows the app to read the Teams apps that are installed in any scope, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cc7e7635-2586-41d6-adaa-a8d3bcad5ee5",
|                                               "Value":  "TeamsAppInstallation.ReadForChat.All",
|                                               "DisplayName":  "Read installed Teams apps for all chats",
|                                               "Description":  "Allows the app to read the Teams apps that are installed in any chat, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1f615aea-6bf9-4b05-84bd-46388e138537",
|                                               "Value":  "TeamsAppInstallation.ReadForTeam.All",
|                                               "DisplayName":  "Read installed Teams apps for all teams",
|                                               "Description":  "Allows the app to read the Teams apps that are installed in any team, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9ce09611-f4f7-4abd-a629-a05450422a97",
|                                               "Value":  "TeamsAppInstallation.ReadForUser.All",
|                                               "DisplayName":  "Read installed Teams apps for all users",
|                                               "Description":  "Allows the app to read the Teams apps that are installed for any user, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "53d40ddb-9b27-4c97-b800-985be6041990",
|                                               "Value":  "TeamsAppInstallation.ReadSelectedForChat.All",
|                                               "DisplayName":  "Read selected installed Teams apps in all chats",
|                                               "Description":  "Allows the app to read the selected Teams apps that are installed in any chat, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "93c6a289-70fd-489e-a053-6cf8f7d772f6",
|                                               "Value":  "TeamsAppInstallation.ReadSelectedForTeam.All",
|                                               "DisplayName":  "Read selected installed Teams apps in all teams",
|                                               "Description":  "Allows the app to read the selected Teams apps that are installed in any team, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "44fb0e7c-1f9a-47f1-bb9e-7f92d48ed288",
|                                               "Value":  "TeamsAppInstallation.ReadSelectedForUser.All",
|                                               "DisplayName":  "Read selected installed Teams apps for all users",
|                                               "Description":  "Allows an app to read, install, upgrade, and uninstall selected apps to any user, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6e74eff9-4a21-45d6-bc03-3a20f61f8281",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentForChat.All",
|                                               "DisplayName":  "Manage installation and permission grants of Teams apps for all chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Gives the ability to manage permission grants for accessing those specific chats\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b0c13be0-8e20-4bc5-8c55-963c23a39ce9",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentForTeam.All",
|                                               "DisplayName":  "Manage installation and permission grants of Teams apps for all teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Gives the ability to manage permission grants for accessing those specific teams\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "32ca478f-f89e-41d0-aaf8-101deb7da510",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentForUser.All",
|                                               "DisplayName":  "Manage installation and permission grants of Teams apps in a user account",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any user account, without a signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ba1ba90b-2d8f-487e-9f16-80728d85bb5c",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForChat.All",
|                                               "DisplayName":  "Allow the Teams app to manage itself and its permission grants for all chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any chat, without a signed-in user, and manage its permission grants for accessing those specific chats\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1e4be56c-312e-42b8-a2c9-009600d732c0",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForTeam.All",
|                                               "DisplayName":  "Allow the Teams app to manage itself and its permission grants for all teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any team, without a signed-in user, and manage its permission grants for accessing those specific teams\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a87076cf-6abd-4e56-8559-4dbdf41bef96",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForUser.All",
|                                               "DisplayName":  "Allow the Teams app to manage itself and its permission grants in all user accounts",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any user account, without a signed-in user, and manage its permission grants for accessing those specific users\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9e19bae1-2623-4c4f-ab6e-2664615ff9a0",
|                                               "Value":  "TeamsAppInstallation.ReadWriteForChat.All",
|                                               "DisplayName":  "Manage Teams apps for all chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5dad17ba-f6cc-4954-a5a2-a0dcc95154f0",
|                                               "Value":  "TeamsAppInstallation.ReadWriteForTeam.All",
|                                               "DisplayName":  "Manage Teams apps for all teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "74ef0291-ca83-4d02-8c7e-d2391e6a444f",
|                                               "Value":  "TeamsAppInstallation.ReadWriteForUser.All",
|                                               "DisplayName":  "Manage Teams apps for all users",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps for any user, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "25bbeaad-04be-4207-83ed-a263aae76ddf",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelectedForChat.All",
|                                               "DisplayName":  "Manage selected installed Teams apps in all chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7b5823ae-d0f2-424d-b90c-d843ffada7d9",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelectedForTeam.All",
|                                               "DisplayName":  "Manage selected installed Teams apps in all teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any team, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "650a76ec-4118-4b25-9d3a-1f98048a5ee0",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelectedForUser.All",
|                                               "DisplayName":  "Manage selected Teams apps installed for all users",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps for any user, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "73a45059-f39c-4baf-9182-4954ac0e55cf",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelfForChat.All",
|                                               "DisplayName":  "Allow the Teams app to manage itself for all chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any chat, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9f67436c-5415-4e7f-8ac1-3014a7132630",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelfForTeam.All",
|                                               "DisplayName":  "Allow the Teams app to manage itself for all teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in any team, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "908de74d-f8b2-4d6b-a9ed-2a17b3b78179",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelfForUser.All",
|                                               "DisplayName":  "Allow the app to manage itself for all users",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself to any user, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "242607bd-1d2c-432c-82eb-bdb27baa23ab",
|                                               "Value":  "TeamSettings.Read.All",
|                                               "DisplayName":  "Read all teams\u0027 settings",
|                                               "Description":  "Read all team\u0027s settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bdd80a03-d9bc-451d-b7c4-ce7c63fe3c8f",
|                                               "Value":  "TeamSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and change all teams\u0027 settings",
|                                               "Description":  "Read and change all teams\u0027 settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1801e8f4-cf09-4c4e-a1b5-036dfcca6c90",
|                                               "Value":  "TeamsPolicyUserAssign.ReadWrite.All",
|                                               "DisplayName":  "Read and Write Teams policy user assignment and unassigment for all policy types.",
|                                               "Description":  "Allow the app to read or write/update the policy assignment and unassigment for Teams users for all policy type categories."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b55aa226-33a1-4396-bcf4-edce5e7a31c1",
|                                               "Value":  "TeamsResourceAccount.Read.All",
|                                               "DisplayName":  "Read Teams resource accounts",
|                                               "Description":  "Allows the app to read your tenant\u0027s resource accounts without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "49981c42-fd7b-4530-be03-e77b21aed25e",
|                                               "Value":  "TeamsTab.Create",
|                                               "DisplayName":  "Create tabs in Microsoft Teams.",
|                                               "Description":  "Allows the app to create tabs in any team in Microsoft Teams, without a signed-in user. This does not grant the ability to read, modify or delete tabs after they are created, or give access to the content inside the tabs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "46890524-499a-4bb2-ad64-1476b4f3e1cf",
|                                               "Value":  "TeamsTab.Read.All",
|                                               "DisplayName":  "Read tabs in Microsoft Teams.",
|                                               "Description":  "Read the names and settings of tabs inside any team in Microsoft Teams, without a signed-in user. This does not give access to the content inside the tabs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a96d855f-016b-47d7-b51c-1218a98d791c",
|                                               "Value":  "TeamsTab.ReadWrite.All",
|                                               "DisplayName":  "Read and write tabs in Microsoft Teams.",
|                                               "Description":  "Read and write tabs in any team in Microsoft Teams, without a signed-in user. This does not give access to the content inside the tabs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fd9ce730-a250-40dc-bd44-8dc8d20f39ea",
|                                               "Value":  "TeamsTab.ReadWriteForChat.All",
|                                               "DisplayName":  "Allow the Teams app to manage all tabs for all chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs for any chat, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6163d4f4-fbf8-43da-a7b4-060fe85ed148",
|                                               "Value":  "TeamsTab.ReadWriteForTeam.All",
|                                               "DisplayName":  "Allow the Teams app to manage all tabs for all teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs in any team, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "425b4b59-d5af-45c8-832f-bb0b7402348a",
|                                               "Value":  "TeamsTab.ReadWriteForUser.All",
|                                               "DisplayName":  "Allow the app to manage all tabs for all users",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs for any user, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9f62e4a2-a2d6-4350-b28b-d244728c4f86",
|                                               "Value":  "TeamsTab.ReadWriteSelfForChat.All",
|                                               "DisplayName":  "Allow the Teams app to manage only its own tabs for all chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for any chat, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "91c32b81-0ef0-453f-a5c7-4ce2e562f449",
|                                               "Value":  "TeamsTab.ReadWriteSelfForTeam.All",
|                                               "DisplayName":  "Allow the Teams app to manage only its own tabs for all teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs in any team, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3c42dec6-49e8-4a0a-b469-36cff0d9da93",
|                                               "Value":  "TeamsTab.ReadWriteSelfForUser.All",
|                                               "DisplayName":  "Allow the Teams app to manage only its own tabs for all users",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for any user, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "39b17d18-680c-41f4-b9c2-5f30629e7cb6",
|                                               "Value":  "TeamsTelephoneNumber.Read.All",
|                                               "DisplayName":  "Read Tenant-Acquired Telephone Number Details",
|                                               "Description":  "Allows the app to read your tenant\u0027s acquired telephone number details, without a signed-in user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0a42382f-155c-4eb1-9bdc-21548ccaa387",
|                                               "Value":  "TeamsTelephoneNumber.ReadWrite.All",
|                                               "DisplayName":  "Read and Modify Tenant-Acquired Telephone Number Details",
|                                               "Description":  "Allows the app to read your tenant\u0027s acquired telephone number details, without a signed-in user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a91eadaf-2c3c-4362-908b-fb172d208fc6",
|                                               "Value":  "TeamsUserConfiguration.Read.All",
|                                               "DisplayName":  "Read Teams user configurations",
|                                               "Description":  "Allows the app to read your tenant\u0027s user configurations, without a signed-in user. User configuration may include attributes related to user, such as telephone number, assigned policies, etc."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6323133e-1f6e-46d4-9372-ac33a0870636",
|                                               "Value":  "TeamTemplates.Read.All",
|                                               "DisplayName":  "Read all available Teams Templates",
|                                               "Description":  "Allows the app to read all available Teams Templates, without a signed-user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dfb0dd15-61de-45b2-be36-d6a69fba3c79",
|                                               "Value":  "Teamwork.Migrate.All",
|                                               "DisplayName":  "Create chat and channel messages with anyone\u0027s identity and with any timestamp",
|                                               "Description":  "Allows the app to create chat and channel messages, without a signed in user. The app specifies which user appears as the sender, and can backdate the message to appear as if it was sent long ago. The messages can be sent to any chat or channel in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "75bcfbce-a647-4fba-ad51-b63d73b210f4",
|                                               "Value":  "Teamwork.Read.All",
|                                               "DisplayName":  "Read organizational teamwork settings",
|                                               "Description":  "Allows the app to read all teamwork settings of the organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "475ebe88-f071-4bd7-af2b-642952bd4986",
|                                               "Value":  "TeamworkAppSettings.Read.All",
|                                               "DisplayName":  "Read Teams app settings",
|                                               "Description":  "Allows the app to read the Teams app settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ab5b445e-8f10-45f4-9c79-dd3f8062cc4e",
|                                               "Value":  "TeamworkAppSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write Teams app settings",
|                                               "Description":  "Allows the app to read and write the Teams app settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0591bafd-7c1c-4c30-a2a5-2b9aacb1dfe8",
|                                               "Value":  "TeamworkDevice.Read.All",
|                                               "DisplayName":  "Read Teams devices",
|                                               "Description":  "Allow the app to read the management data for Teams devices, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "79c02f5b-bd4f-4713-bc2c-a8a4a66e127b",
|                                               "Value":  "TeamworkDevice.ReadWrite.All",
|                                               "DisplayName":  "Read and write Teams devices",
|                                               "Description":  "Allow the app to read and write the management data for Teams devices, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e9e1b87a-726e-4628-8fab-d1fc58d4d9ad",
|                                               "Value":  "TeamworkSection.Read.All",
|                                               "DisplayName":  "Read all users\u0027 sections",
|                                               "Description":  "Allows the app to read all users\u0027 sections (folders) for organizing chats and channels in Teams, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fd99f9da-42d6-4d00-8a41-4161bea42309",
|                                               "Value":  "TeamworkSection.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 sections",
|                                               "Description":  "Allows the app to read and write all users\u0027 sections (folders) for organizing chats and channels in Teams, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b74fd6c4-4bde-488e-9695-eeb100e4907f",
|                                               "Value":  "TeamworkTag.Read.All",
|                                               "DisplayName":  "Read tags in Teams",
|                                               "Description":  "Allows the app to read tags in Teams without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a3371ca5-911d-46d6-901c-42c8c7a937d8",
|                                               "Value":  "TeamworkTag.ReadWrite.All",
|                                               "DisplayName":  "Read and write tags in Teams",
|                                               "Description":  "Allows the app to read and write tags in Teams without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b0cfd829-be18-4b31-bb0e-ec1df8197ba3",
|                                               "Value":  "TeamworkTargetedMessage.Read.All",
|                                               "DisplayName":  "Read all targeted messages of group chat or channel",
|                                               "Description":  "Allows the app to read all group chat or channel targeted messages in Microsoft Teams."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3f4f98e9-6faf-4e5f-814b-ed2ed8a4ec9e",
|                                               "Value":  "TenantGovernance-Invitation.Read.All",
|                                               "DisplayName":  "Read Tenant Governance invitations",
|                                               "Description":  "Allows the application to list and read all Tenant Governance invitations without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "eb9465d8-e7c0-4301-8e51-927f34ee3134",
|                                               "Value":  "TenantGovernance-PolicyTemplate.Read.All",
|                                               "DisplayName":  "Read Tenant Governance policy templates",
|                                               "Description":  "Allows the application to list and read all Tenant Governance policy templates without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7ced9a83-8e7c-46df-b3e0-6b45a6ecedcd",
|                                               "Value":  "TenantGovernance-RelatedTenant.Read.All",
|                                               "DisplayName":  "Read related tenants",
|                                               "Description":  "Allows the application to list and read related tenants information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "41c250d0-8793-44e1-a130-5fdbd5bccd0a",
|                                               "Value":  "TenantGovernance-Relationship.Read.All",
|                                               "DisplayName":  "Read Tenant Governance relationships",
|                                               "Description":  "Allows the application to list and read all Tenant Governance relationships without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "294294d5-2b81-4cf1-837c-28fc22bc3290",
|                                               "Value":  "TenantGovernance-Request.Read.All",
|                                               "DisplayName":  "Read Tenant Governance requests",
|                                               "Description":  "Allows the application to list and read all Tenant Governance requests without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e2d1cac5-0317-4ae3-aca9-59737eb75317",
|                                               "Value":  "TenantGovernance-Setting.Read.All",
|                                               "DisplayName":  "Read Tenant Governance settings",
|                                               "Description":  "Allows the application to read Tenant Governance settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ea047cc2-df29-4f3e-83a3-205de61501ca",
|                                               "Value":  "TermStore.Read.All",
|                                               "DisplayName":  "Read all term store data",
|                                               "Description":  "Allows the app to read all term store data, without a signed-in user. This includes all sets, groups and terms in the term store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f12eb8d6-28e3-46e6-b2c0-b7e4dc69fc95",
|                                               "Value":  "TermStore.ReadWrite.All",
|                                               "DisplayName":  "Read and write all term store data",
|                                               "Description":  "Allows the app to read, edit or write all term store data, without a signed-in user. This includes all sets, groups and terms in the term store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f8f035bb-2cce-47fb-8bf5-7baf3ecbee48",
|                                               "Value":  "ThreatAssessment.Read.All",
|                                               "DisplayName":  "Read threat assessment requests",
|                                               "Description":  "Allows an app to read your organization\u0027s threat assessment requests, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dd98c7f5-2d42-42d3-a0e4-633161547251",
|                                               "Value":  "ThreatHunting.Read.All",
|                                               "DisplayName":  "Run hunting queries",
|                                               "Description":  "Allows the app to run hunting queries, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "197ee4e9-b993-4066-898f-d6aecc55125b",
|                                               "Value":  "ThreatIndicators.Read.All",
|                                               "DisplayName":  "Read all threat indicators",
|                                               "Description":  "Allows the app to read all the indicators for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "21792b6c-c986-4ffc-85de-df9da54b52fa",
|                                               "Value":  "ThreatIndicators.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Manage threat indicators this app creates or owns",
|                                               "Description":  "Allows the app to create threat indicators, and fully manage those threat indicators (read, update and delete), without a signed-in user.  It cannot update any threat indicators it does not own."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e0b77adb-e790-44a3-b0a0-257d06303687",
|                                               "Value":  "ThreatIntelligence.Read.All",
|                                               "DisplayName":  "Read all Threat Intelligence Information",
|                                               "Description":  "Allows the app to read threat intelligence information, such as indicators, observations, and and articles, without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "86632667-cd15-4845-ad89-48a88e8412e1",
|                                               "Value":  "ThreatSubmission.Read.All",
|                                               "DisplayName":  "Read all of the organization\u0027s threat submissions",
|                                               "Description":  "Allows the app to read your organization\u0027s threat submissions and to view threat submission policies without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d72bdbf4-a59b-405c-8b04-5995895819ac",
|                                               "Value":  "ThreatSubmission.ReadWrite.All",
|                                               "DisplayName":  "Read and write all of the organization\u0027s threat submissions",
|                                               "Description":  "Allows the app to read your organization\u0027s threat submissions and threat submission policies without a signed-in user. Also allows the app to create new threat submissions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "926a6798-b100-4a20-a22f-a4918f13951d",
|                                               "Value":  "ThreatSubmissionPolicy.ReadWrite.All",
|                                               "DisplayName":  "Read and write all of the organization\u0027s threat submission policies",
|                                               "Description":  "Allows the app to read your organization\u0027s threat submission policies without a signed-in user. Also allows the app to create new threat submission policies without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fff194f1-7dce-4428-8301-1badb5518201",
|                                               "Value":  "TrustFrameworkKeySet.Read.All",
|                                               "DisplayName":  "Read trust framework key sets",
|                                               "Description":  "Allows the app to read trust framework key set properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4a771c9a-1cf2-4609-b88e-3d3e02d539cd",
|                                               "Value":  "TrustFrameworkKeySet.ReadWrite.All",
|                                               "DisplayName":  "Read and write trust framework key sets",
|                                               "Description":  "Allows the app to read and write trust framework key set properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9d952b72-f741-4b40-9185-8c53076c2339",
|                                               "Value":  "User-ConvertToInternal.ReadWrite.All",
|                                               "DisplayName":  "Convert an external user to internal member user",
|                                               "Description":  "Allow the app to convert an external user to an internal member user, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8556a004-db57-4d7a-8b82-97a13428e96f",
|                                               "Value":  "User-LifeCycleInfo.Read.All",
|                                               "DisplayName":  "Read all users\u0027 lifecycle information",
|                                               "Description":  "Allows the app to read the lifecycle information like employeeLeaveDateTime of users in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "925f1248-0f97-47b9-8ec8-538c54e01325",
|                                               "Value":  "User-LifeCycleInfo.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 lifecycle information",
|                                               "Description":  "Allows the app to read and write the lifecycle information like employeeLeaveDateTime of users in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "280d0935-0796-47d1-8d26-273470a3f17a",
|                                               "Value":  "User-Mail.ReadWrite.All",
|                                               "DisplayName":  "Read and write all secondary mail addresses for users",
|                                               "Description":  "Allows the app to read and write secondary mail addresses for all users, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a94a502d-0281-4d15-8cd2-682ac9362c4c",
|                                               "Value":  "User-OnPremisesSyncBehavior.ReadWrite.All",
|                                               "DisplayName":  "Read and update the on-premises sync behavior of users",
|                                               "Description":  "Allows the app to update the on-premises sync behavior of all users without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cc117bb9-00cf-4eb8-b580-ea2a878fe8f7",
|                                               "Value":  "User-PasswordProfile.ReadWrite.All",
|                                               "DisplayName":  "Read and write all password profiles and reset user passwords",
|                                               "Description":  "Allows the app to read and write password profiles and reset passwords for all users, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "86ceff06-c822-49ff-989a-d912845ffe69",
|                                               "Value":  "User-Phone.ReadWrite.All",
|                                               "DisplayName":  "Read and write all user mobile phone and business phones",
|                                               "Description":  "Allows the app to read and write the mobile phone and business phones for all users, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "eccc023d-eccf-4e7b-9683-8813ab36cecc",
|                                               "Value":  "User.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore all users",
|                                               "Description":  "Allows the app to delete and restore all users, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3011c876-62b7-4ada-afa2-506cbbecc68c",
|                                               "Value":  "User.EnableDisableAccount.All",
|                                               "DisplayName":  "Enable and disable user accounts",
|                                               "Description":  "Allows the app to enable and disable users\u0027 accounts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "405a51b5-8d8d-430b-9842-8be4b0e9f324",
|                                               "Value":  "User.Export.All",
|                                               "DisplayName":  "Export user\u0027s data",
|                                               "Description":  "Allows the app to export data (e.g. customer content or system-generated logs), associated with any user in your company, when the app is used by a privileged user (e.g. a Company Administrator)."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "09850681-111b-4a89-9bed-3f2cae46d706",
|                                               "Value":  "User.Invite.All",
|                                               "DisplayName":  "Invite guest users to the organization",
|                                               "Description":  "Allows the app to invite guest users to the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c529cfca-c91b-489c-af2b-d92990b66ce6",
|                                               "Value":  "User.ManageIdentities.All",
|                                               "DisplayName":  "Manage all users\u0027 identities",
|                                               "Description":  "Allows the app to read, update and delete identities that are associated with a user\u0027s account, without a signed in user. This controls the identities users can sign-in with."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "df021288-bdef-4463-88db-98f22de89214",
|                                               "Value":  "User.Read.All",
|                                               "DisplayName":  "Read all users\u0027 full profiles",
|                                               "Description":  "Allows the app to read user profiles without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "97235f07-e226-4f63-ace3-39588e11d3a1",
|                                               "Value":  "User.ReadBasic.All",
|                                               "DisplayName":  "Read all users\u0027 basic profiles",
|                                               "Description":  "Allows the app to read a basic set of profile properties of other users in your organization without a signed-in user. Includes display name, first and last name, email address, open extensions, and photo."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "741f803b-c850-494e-b5df-cde7c675a1ca",
|                                               "Value":  "User.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 full profiles",
|                                               "Description":  "Allows the app to read and update user profiles without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5652f862-b626-407b-a3e6-248aeb95763c",
|                                               "Value":  "User.ReadWrite.CrossCloud",
|                                               "DisplayName":  "Read and write profiles of users that originate from an external cloud.",
|                                               "Description":  "Allows the app to read and update external cloud user profiles without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "77f3a031-c388-4f99-b373-dc68676a979e",
|                                               "Value":  "User.RevokeSessions.All",
|                                               "DisplayName":  "Revoke all sign in sessions for a user",
|                                               "Description":  "Allow the app to revoke all sign in sessions for a user, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "38d9df27-64da-44fd-b7c5-a6fbac20248f",
|                                               "Value":  "UserAuthenticationMethod.Read.All",
|                                               "DisplayName":  "Read all users\u0027 authentication methods",
|                                               "Description":  "Allows the app to read authentication methods of all users in your organization, without a signed-in user. Authentication methods include things like a user’s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "50483e42-d915-4231-9639-7fdb7fd190e5",
|                                               "Value":  "UserAuthenticationMethod.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 authentication methods ",
|                                               "Description":  "Allows the application to read and write authentication methods of all users in your organization, without a signed-in user.                       Authentication methods include things like a user’s phone numbers and Authenticator app settings. This                      does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a1e58be0-1095-422b-b067-73434bd7d40f",
|                                               "Value":  "UserAuthMethod-Email.Read.All",
|                                               "DisplayName":  "Read all users\u0027 email methods",
|                                               "Description":  "Allows the app to read email methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e8ecb853-1435-4a49-95ba-ec5b31b11672",
|                                               "Value":  "UserAuthMethod-Email.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 email methods",
|                                               "Description":  "Allows the application to read and write email methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d2c4289f-9f95-40da-ad43-eeb1506f0db7",
|                                               "Value":  "UserAuthMethod-External.Read.All",
|                                               "DisplayName":  "Read all users\u0027 external authentication methods",
|                                               "Description":  "Allows the app to read external authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c7a22c2e-5b01-4129-8159-6c8be2c78f16",
|                                               "Value":  "UserAuthMethod-External.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 external authentication methods",
|                                               "Description":  "Allows the application to read and write external authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7b544555-7811-49ff-8223-a56be870e33a",
|                                               "Value":  "UserAuthMethod-HardwareOATH.Read.All",
|                                               "DisplayName":  "Read all users\u0027 HardwareOATH authentication methods",
|                                               "Description":  "Allows the app to read HardwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7e9ebcc1-90aa-4471-8051-e68d6b4e9c89",
|                                               "Value":  "UserAuthMethod-HardwareOATH.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 HardwareOATH authentication methods",
|                                               "Description":  "Allows the application to read and write HardwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a9c5f16e-e5ca-4e33-89ad-903fcfc01c23",
|                                               "Value":  "UserAuthMethod-MicrosoftAuthApp.Read.All",
|                                               "DisplayName":  "Read all users\u0027 Microsoft authentication methods",
|                                               "Description":  "Allows the app to read Microsoft authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c833c349-a1ab-4b6d-94a2-fa9a8674420c",
|                                               "Value":  "UserAuthMethod-MicrosoftAuthApp.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 Microsoft Authentication methods",
|                                               "Description":  "Allows the application to read and write Microsoft Authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "72e00c1d-3e3d-43bb-a0b9-c435611bb1d2",
|                                               "Value":  "UserAuthMethod-Passkey.Read.All",
|                                               "DisplayName":  "Read all users\u0027 passkey authentication methods",
|                                               "Description":  "Allows the app to read passkey authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0400e371-7db1-4338-a269-96069eb65227",
|                                               "Value":  "UserAuthMethod-Passkey.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 passkey authentication methods",
|                                               "Description":  "Allows the application to read and write passkey authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8d2c17ff-b93d-40d5-9def-d843680509cb",
|                                               "Value":  "UserAuthMethod-Password.Read.All",
|                                               "DisplayName":  "Read all users\u0027 password authentication methods",
|                                               "Description":  "Allows the app to read password authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f6d38dfd-ec08-4995-8f07-23e929df0936",
|                                               "Value":  "UserAuthMethod-Password.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 password authentication methods",
|                                               "Description":  "Allows the application to read and write password authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f529a223-ea70-43ec-b268-5012de2fbaa2",
|                                               "Value":  "UserAuthMethod-Phone.Read.All",
|                                               "DisplayName":  "Read all users\u0027 phone authentication methods",
|                                               "Description":  "Allows the app to read phone authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6e85d483-7092-4375-babe-0a94a8213a58",
|                                               "Value":  "UserAuthMethod-Phone.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 phone methods",
|                                               "Description":  "Allows the application to read and write phone methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "07c0b1e4-15bd-442f-834b-30f8291388d1",
|                                               "Value":  "UserAuthMethod-PlatformCred.Read.All",
|                                               "DisplayName":  "Read all users\u0027 platform credentials methods",
|                                               "Description":  "Allows the app to read platform credentials methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1a87acf4-a9ca-4576-a974-452ea265d5f6",
|                                               "Value":  "UserAuthMethod-PlatformCred.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 platform credentials methods",
|                                               "Description":  "Allows the application to read and write platform credentials methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9a45bc50-cddd-4ebe-bd9c-4f2eacf646ae",
|                                               "Value":  "UserAuthMethod-QR.Read.All",
|                                               "DisplayName":  "Read all users\u0027 QR methods",
|                                               "Description":  "Allows the app to read QR authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4869299f-18c3-40c8-98f2-222657e67db1",
|                                               "Value":  "UserAuthMethod-QR.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 QR methods",
|                                               "Description":  "Allows the application to read and write QR authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a6b423df-a0c8-411d-a809-a4a5985d2939",
|                                               "Value":  "UserAuthMethod-SoftwareOATH.Read.All",
|                                               "DisplayName":  "Read all users\u0027 SoftwareOATH methods",
|                                               "Description":  "Allows the app to read SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "787442d4-3c6e-4e99-aa95-8ccca20a48ff",
|                                               "Value":  "UserAuthMethod-SoftwareOATH.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 SoftwareOATH methods",
|                                               "Description":  "Allows the application to read and write SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bf82209c-b22b-4747-ac88-a68be99032cf",
|                                               "Value":  "UserAuthMethod-TAP.Read.All",
|                                               "DisplayName":  "Read all users\u0027 Temporary Access Pass methods",
|                                               "Description":  "Allows the app to read Temporary Access Pass authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "627169a8-8c15-451c-861a-5b80e383de5c",
|                                               "Value":  "UserAuthMethod-TAP.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 Temporary Access Pass methods",
|                                               "Description":  "Allows the application to read and write Temporary Access Pass authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9b8dd4c7-8cca-4ef5-a34a-9c2c75fcc934",
|                                               "Value":  "UserAuthMethod-WindowsHello.Read.All",
|                                               "DisplayName":  "Read all users\u0027 Windows Hello methods",
|                                               "Description":  "Allows the app to read Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f14eee8a-713e-45aa-8223-2ab74632db1a",
|                                               "Value":  "UserAuthMethod-WindowsHello.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 Windows Hello authentication methods",
|                                               "Description":  "Allows the application to read and write Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4e774092-a092-48d1-90bd-baad67c7eb47",
|                                               "Value":  "UserNotification.ReadWrite.CreatedByApp",
|                                               "DisplayName":  "Deliver and manage all user\u0027s notifications",
|                                               "Description":  "Allows the app to send, read, update and delete user’s notifications, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "de023814-96df-4f53-9376-1e2891ef5a18",
|                                               "Value":  "UserShiftPreferences.Read.All",
|                                               "DisplayName":  "Read all user shift preferences",
|                                               "Description":  "Allows the app to read all users\u0027 shift schedule preferences without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d1eec298-80f3-49b0-9efb-d90e224798ac",
|                                               "Value":  "UserShiftPreferences.ReadWrite.All",
|                                               "DisplayName":  "Read and write all user shift preferences",
|                                               "Description":  "Allows the app to manage all users\u0027 shift schedule preferences without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fbcd7ef1-df0d-4e05-bb28-93424a89c6df",
|                                               "Value":  "UserTeamwork.Read.All",
|                                               "DisplayName":  "Read all user teamwork settings",
|                                               "Description":  "Allows the app to read all user teamwork settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e227c591-dd64-4a8a-a033-816167f7c938",
|                                               "Value":  "VerifiedId-Profile.Read.All",
|                                               "DisplayName":  "Read Verified Id profiles",
|                                               "Description":  "This role can read Verified Id profiles in a tenant."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d4f67ec2-59b5-4bdc-b4af-d78f6f9c1954",
|                                               "Value":  "VirtualAppointment.Read.All",
|                                               "DisplayName":  "Read all virtual appointments for users, as authorized by online meetings application access policy",
|                                               "Description":  "Allows the application to read virtual appointments for all users, without a signed-in user. The app must also be authorized to access an individual user’s data by the online meetings application access policy."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bf46a256-f47d-448f-ab78-f226fff08d40",
|                                               "Value":  "VirtualAppointment.ReadWrite.All",
|                                               "DisplayName":  "Read-write all virtual appointments for users, as authorized by online meetings app access policy",
|                                               "Description":  "Allows the application to read and write virtual appointments for all users, without a signed-in user. The app must also be authorized to access an individual user’s data by the online meetings application access policy."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "97e45b36-1250-48e4-bd70-2df6dab7e94a",
|                                               "Value":  "VirtualAppointmentNotification.Send",
|                                               "DisplayName":  "Send notification regarding virtual appointments as any user",
|                                               "Description":  "Allows the application to send notification regarding virtual appointments as any user, without a signed-in user. The app must also be authorized to access an individual user\u0027s data by the online meetings application access policy."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1dccb351-c4e4-4e09-a8d1-7a9ecbf027cc",
|                                               "Value":  "VirtualEvent.Read.All",
|                                               "DisplayName":  "Read all users\u0027 virtual events",
|                                               "Description":  "Allows the app to read all virtual events without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "23211fc1-f9d1-4e8e-8e9e-08a5d0a109bb",
|                                               "Value":  "VirtualEventRegistration-Anon.ReadWrite.All",
|                                               "DisplayName":  "Read and write anonymous users\u0027 virtual event registrations",
|                                               "Description":  "Allows the app to read and write anonymous users\u0027 virtual event registrations, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "50a8bf5f-b06a-4ac7-881f-3ca0c4be7550",
|                                               "Value":  "WindowsUpdates.Read.All",
|                                               "DisplayName":  "Read all Windows update deployment settings",
|                                               "Description":  "Allows the app to read all Windows update deployment settings for the organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7dd1be58-6e76-4401-bf8d-31d1e8180d5b",
|                                               "Value":  "WindowsUpdates.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Windows update deployment settings",
|                                               "Description":  "Allows the app to read and write all Windows update deployment settings for the organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f10b94b9-37d1-4c88-8b7e-bf75a1152d39",
|                                               "Value":  "WorkforceIntegration.Read.All",
|                                               "DisplayName":  "Read workforce integrations",
|                                               "Description":  "Allows the app to read workforce integrations without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "202bf709-e8e6-478e-bcfd-5d63c50b68e3",
|                                               "Value":  "WorkforceIntegration.ReadWrite.All",
|                                               "DisplayName":  "Read and write workforce integrations",
|                                               "Description":  "Allows the app to manage workforce integrations to synchronize data from Microsoft Teams Shifts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ebfcd32b-babb-40f4-a14b-42706e83bd28",
|                                               "Value":  "AccessReview.Read.All",
|                                               "DisplayName":  "Read all access reviews that user can access",
|                                               "Description":  "Allows the app to read access reviews, reviewers, decisions and settings that the signed-in user has access to in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e4aa47b9-9a69-4109-82ed-36ec70d85ff1",
|                                               "Value":  "AccessReview.ReadWrite.All",
|                                               "DisplayName":  "Manage all access reviews that user can access",
|                                               "Description":  "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings that the signed-in user has access to in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5af8c3f5-baca-439a-97b0-ea58a435e269",
|                                               "Value":  "AccessReview.ReadWrite.Membership",
|                                               "DisplayName":  "Manage access reviews for group and app memberships",
|                                               "Description":  "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings for group and app memberships that the signed-in user has access to in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9084c10f-a2d6-4713-8732-348def50fe02",
|                                               "Value":  "Acronym.Read.All",
|                                               "DisplayName":  "Read all acronyms that the user can access",
|                                               "Description":  "Allows an app to read all acronyms that the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3361d15d-be43-4de6-b441-3c746d05163d",
|                                               "Value":  "AdministrativeUnit.Read.All",
|                                               "DisplayName":  "Read administrative units",
|                                               "Description":  "Allows the app to read administrative units and administrative unit membership on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7b8a2d34-6b3f-4542-a343-54651608ad81",
|                                               "Value":  "AdministrativeUnit.ReadWrite.All",
|                                               "DisplayName":  "Read and write administrative units",
|                                               "Description":  "Allows the app to create, read, update, and delete administrative units and manage administrative unit membership on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ada96a26-9579-4c29-a578-c3482a765716",
|                                               "Value":  "AgentCardManifest.Read.All",
|                                               "DisplayName":  "Read agent card manifests in Agent Registry",
|                                               "Description":  "Allows the app to read agent card manifests in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "80151b1a-1c31-4846-ae0d-c79939ee13d1",
|                                               "Value":  "AgentCardManifest.ReadWrite.All",
|                                               "DisplayName":  "Read and write agent card manifests in Agent Registry",
|                                               "Description":  "Allows the app to read and write agent card manifests in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fa50be38-fdff-469c-96dc-ef5fce3c64bf",
|                                               "Value":  "AgentCollection.Read.All",
|                                               "DisplayName":  "Read collections in Agent Registry",
|                                               "Description":  "Allows the app to read collections and their membership in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b14924c8-87f1-438a-81f2-dc370ba2f45d",
|                                               "Value":  "AgentCollection.Read.Global",
|                                               "DisplayName":  "Read global collection in Agent Registry",
|                                               "Description":  "Allows the app to read global collection and its membership in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "43acfda3-daf3-4aa4-955d-b051d0024e82",
|                                               "Value":  "AgentCollection.Read.Quarantined",
|                                               "DisplayName":  "Read quarantined collection in Agent Registry",
|                                               "Description":  "Allows the app to read quarantined collection and its membership in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6d8a7002-a05e-4b95-a768-0e6f0badc6c8",
|                                               "Value":  "AgentCollection.ReadWrite.All",
|                                               "DisplayName":  "Read and write collections in Agent Registry",
|                                               "Description":  "Allows the app to create, read, update, and delete collections and manage their membership in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c001dd65-8a6b-4349-ab0c-4e8a410d28d2",
|                                               "Value":  "AgentCollection.ReadWrite.Global",
|                                               "DisplayName":  "Read and write global collection in Agent Registry",
|                                               "Description":  "Allows the app to read and update global collection and manage its membership in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ae331cc9-9f51-484b-a90b-124f2e4a6398",
|                                               "Value":  "AgentCollection.ReadWrite.Quarantined",
|                                               "DisplayName":  "Read and write quarantined collection in Agent Registry",
|                                               "Description":  "Allows the app to read and update quarantined collection and manage its membership in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c8ee41e5-35e7-4fe9-8ecb-93493adcac5b",
|                                               "Value":  "AgentIdentity.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore agent identities",
|                                               "Description":  "Allows the client to delete and restore agent identities."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a501206a-e364-4a3f-be6e-765806d0e323",
|                                               "Value":  "AgentIdentity.EnableDisable.All",
|                                               "DisplayName":  "Enable or disable agent identities",
|                                               "Description":  "Allows the client to enable or disable agent identities."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5e850691-d86a-4b24-bfa6-8a52fb37a0c1",
|                                               "Value":  "AgentIdentity.Read.All",
|                                               "DisplayName":  "Read all agent identities",
|                                               "Description":  "Allows the client to read all agent identities."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4a4facd5-0ee1-49b7-a5b2-fdcc2491685e",
|                                               "Value":  "AgentIdentity.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent identities",
|                                               "Description":  "Allows the client to read, update, and delete agent identities on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "75b5feb2-bfe7-423f-907d-cc505186f246",
|                                               "Value":  "AgentIdentityBlueprint.AddRemoveCreds.All",
|                                               "DisplayName":  "Update agent identity blueprint credentials",
|                                               "Description":  "Allows updating agent identity blueprint credentials on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8fc15edd-ba24-494e-9bf6-d38e1b7ba8fd",
|                                               "Value":  "AgentIdentityBlueprint.Create",
|                                               "DisplayName":  "Create agent identity blueprints.",
|                                               "Description":  "Allows creating new agent identity blueprints with a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f12ba1f6-afb7-4685-9a30-21e8c3f551d8",
|                                               "Value":  "AgentIdentityBlueprint.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore agent identity blueprints.",
|                                               "Description":  "Allows deleting or restoring agent identity blueprints with a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "26512dc8-1364-4e9f-867c-6d8b22a9e162",
|                                               "Value":  "AgentIdentityBlueprint.Read.All",
|                                               "DisplayName":  "Read all agent identity blueprints",
|                                               "Description":  "Allows the client to read all agent identity blueprints."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4fd490fc-1467-48eb-8a4c-421597ab0402",
|                                               "Value":  "AgentIdentityBlueprint.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent identity blueprints.",
|                                               "Description":  "Allows the app to read, update, and delete agent identity blueprints on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6f677aa9-25af-49a5-8a1d-628dc7f0d009",
|                                               "Value":  "AgentIdentityBlueprint.UpdateAuthProperties.All",
|                                               "DisplayName":  "Update agent identity blueprint authorization and authentication properties",
|                                               "Description":  "Allows updating agent identity blueprint authorization and authentication properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "60960e31-67cb-4d25-9d36-4922109923a2",
|                                               "Value":  "AgentIdentityBlueprint.UpdateBranding.All",
|                                               "DisplayName":  "Update agent identity blueprint branding",
|                                               "Description":  "Allows updating agent identity blueprint branding on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "00dcd896-6b23-42ce-b5de-c58493c05e22",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.Create",
|                                               "DisplayName":  "Create agent identity blueprint service principals.",
|                                               "Description":  "Allows creating new agent identity blueprint principals with a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2c70023e-a482-4af2-9ff1-51ded53e6bad",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore agent identity blueprints.",
|                                               "Description":  "Allows deleting or restoring agent identity blueprints with a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e7475e0a-9f02-43e2-a250-5c2ea74ccd0e",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.EnableDisable.All",
|                                               "DisplayName":  "Enable or disable agent identity blueprint principals.",
|                                               "Description":  "Allows enabling or disabling agent identity blueprint principals with a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "88c856a2-de61-4632-b2d4-ac503cbc8dd2",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.Read.All",
|                                               "DisplayName":  "Read agent identity blueprints principals.",
|                                               "Description":  "Allows reading agent identity blueprint principals with a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bf2cad6a-9082-438a-9a63-95fa2687af65",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent identity blueprint principals.",
|                                               "Description":  "Allows the app to read, update, and delete agent identity blueprint principals on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ad57fb88-4658-4fd6-ab7d-e43184b08e4e",
|                                               "Value":  "AgentIdUser.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent ID users\u0027 full profiles",
|                                               "Description":  "Allows the app to read and write the full set of profile properties, reports, and managers of agent ID users in your organization, and read basic company properties, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "52a417d9-0b3c-4466-9a3b-66960de73d74",
|                                               "Value":  "AgentIdUser.ReadWrite.IdentityParentedBy",
|                                               "DisplayName":  "Read and write all agent ID users\u0027 full profiles",
|                                               "Description":  "Allows the app to read and write the full set of profile properties, reports, and managers of agent ID users in your organization, and read basic company properties, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4c3c738a-2df0-4877-bf4a-f796950ff34c",
|                                               "Value":  "AgentInstance.Read.All",
|                                               "DisplayName":  "Read agent instances in Agent Registry",
|                                               "Description":  "Allows the app to read agent instances and their related collections in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fc79e324-da24-497a-b5ec-e7de08320375",
|                                               "Value":  "AgentInstance.ReadWrite.All",
|                                               "DisplayName":  "Read and write agent instances in Agent Registry",
|                                               "Description":  "Allows the app to create, read, update, and delete agent instances in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ef96ce0b-b2ea-4ae4-a783-108212d8ecee",
|                                               "Value":  "AgentRegistration.Read.All",
|                                               "DisplayName":  "Read all agent registrations",
|                                               "Description":  "Allows the user to read all agent registration information"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "20f263bf-7d50-4e66-912c-16b4b4194fd4",
|                                               "Value":  "AgentRegistration.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent registrations",
|                                               "Description":  "Allows the user to read and write all agent registration information"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "af2819c9-df71-4dd3-ade7-4d7c9dc653b7",
|                                               "Value":  "Agreement.Read.All",
|                                               "DisplayName":  "Read all terms of use agreements",
|                                               "Description":  "Allows the app to read terms of use agreements on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ef4b5d93-3104-4664-9053-a5c49ab44218",
|                                               "Value":  "Agreement.ReadWrite.All",
|                                               "DisplayName":  "Read and write all terms of use agreements",
|                                               "Description":  "Allows the app to read and write terms of use agreements on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0b7643bb-5336-476f-80b5-18fbfbc91806",
|                                               "Value":  "AgreementAcceptance.Read",
|                                               "DisplayName":  "Read user terms of use acceptance statuses",
|                                               "Description":  "Allows the app to read terms of use acceptance statuses on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a66a5341-e66e-4897-9d52-c2df58c2bfb9",
|                                               "Value":  "AgreementAcceptance.Read.All",
|                                               "DisplayName":  "Read terms of use acceptance statuses that user can access",
|                                               "Description":  "Allows the app to read terms of use acceptance statuses on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "859cceb9-2ec2-4e48-bcd7-b8490b5248a5",
|                                               "Value":  "AiEnterpriseInteraction.Read",
|                                               "DisplayName":  "Read user AI enterprise interactions.",
|                                               "Description":  "Allows the app to read user AI enterprise interactions, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e03cf23f-8056-446a-8994-7d93dfc8b50e",
|                                               "Value":  "Analytics.Read",
|                                               "DisplayName":  "Read user activity statistics",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s activity statistics, such as how much time the user has spent on emails, in meetings, or in chat sessions."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1b6ff35f-31df-4332-8571-d31ea5a4893f",
|                                               "Value":  "APIConnectors.Read.All",
|                                               "DisplayName":  "Read API connectors for authentication flows",
|                                               "Description":  "Allows the app to read the API connectors used in user authentication flows, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c67b52c5-7c69-48b6-9d48-7b3af3ded914",
|                                               "Value":  "APIConnectors.ReadWrite.All",
|                                               "DisplayName":  "Read and write API connectors for authentication flows",
|                                               "Description":  "Allows the app to read, create and manage the API connectors used in user authentication flows, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "88e58d74-d3df-44f3-ad47-e89edf4472e4",
|                                               "Value":  "AppCatalog.Read.All",
|                                               "DisplayName":  "Read all app catalogs",
|                                               "Description":  "Allows the app to read the apps in the app catalogs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1ca167d5-1655-44a1-8adf-1414072e1ef9",
|                                               "Value":  "AppCatalog.ReadWrite.All",
|                                               "DisplayName":  "Read and write to all app catalogs",
|                                               "Description":  "Allows the app to create, read, update, and delete apps in the app catalogs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3db89e36-7fa6-4012-b281-85f3d9d9fd2e",
|                                               "Value":  "AppCatalog.Submit",
|                                               "DisplayName":  "Submit application packages to the catalog and cancel pending submissions",
|                                               "Description":  "Allows the app to submit application packages to the catalog and cancel submissions that are pending review on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "af281d3a-030d-4122-886e-146fb30a0413",
|                                               "Value":  "AppCertTrustConfiguration.Read.All",
|                                               "DisplayName":  "Read the trusted certificate authority configuration for applications",
|                                               "Description":  "Allows the app to read the trusted certificate authority configuration which can be used to restrict application certificates based on their issuing authority, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4bae2ed4-473e-4841-a493-9829cfd51d48",
|                                               "Value":  "AppCertTrustConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write the trusted certificate authority configuration for applications",
|                                               "Description":  "Allows the app to create, read, update and delete the trusted certificate authority configuration which can be used to restrict application certificates based on their issuing authority, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ffa91d43-2ad8-45cc-b592-09caddeb24bb",
|                                               "Value":  "Application-RemoteDesktopConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write the remote desktop security configuration for apps",
|                                               "Description":  "Allows the app to read and write other apps\u0027 remote desktop security configuration, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c79f8feb-a9db-4090-85f9-90d820caa0eb",
|                                               "Value":  "Application.Read.All",
|                                               "DisplayName":  "Read applications",
|                                               "Description":  "Allows the app to read applications and service principals on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0586a906-4d89-4de8-b3c8-1aacdcc0c679",
|                                               "Value":  "Application.ReadUpdate.All",
|                                               "DisplayName":  "Read and update all apps",
|                                               "Description":  "Allows the app to read and update all apps in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bdfbf15f-ee85-4955-8675-146e8e5296b5",
|                                               "Value":  "Application.ReadWrite.All",
|                                               "DisplayName":  "Read and write all applications",
|                                               "Description":  "Allows the app to create, read, update and delete applications and service principals on behalf of the signed-in user. Does not allow management of consent grants."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "84bccea3-f856-4a8a-967b-dbe0a3d53a64",
|                                               "Value":  "AppRoleAssignment.ReadWrite.All",
|                                               "DisplayName":  "Manage app permission grants and app role assignments",
|                                               "Description":  "Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b0df437d-d341-4df0-aa3e-89ca81a1207f",
|                                               "Value":  "ApprovalSolution.Read",
|                                               "DisplayName":  "Read approvals",
|                                               "Description":  "Allows the app to read approvals on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6768d3af-4562-48ff-82d2-c5e19eb21b9c",
|                                               "Value":  "ApprovalSolution.ReadWrite",
|                                               "DisplayName":  "Read, create, and respond to approvals",
|                                               "Description":  "Allows the app to provision, read, create, and respond to approvals on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "89d944f2-2011-44ad-830c-aa9bf5ef2319",
|                                               "Value":  "ApprovalSolutionResponse.ReadWrite",
|                                               "DisplayName":  "Read and respond to approvals assigned to the current user",
|                                               "Description":  "Allows the app to read and respond to approvals on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "104a7a4b-ca76-4677-b7e7-2f4bc482f381",
|                                               "Value":  "AttackSimulation.Read.All",
|                                               "DisplayName":  "Read attack simulation data of an organization",
|                                               "Description":  "Allows the app to read attack simulation and training data for an organization for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "27608d7c-2c66-4cad-a657-951d575f5a60",
|                                               "Value":  "AttackSimulation.ReadWrite.All",
|                                               "DisplayName":  "Read, create, and update attack simulation data of an organization",
|                                               "Description":  "Allows the app to read, create, and update attack simulation and training data for an organization for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "16786f81-40d2-4116-bb26-d1a753bf0b20",
|                                               "Value":  "AuditActivity.Read",
|                                               "DisplayName":  "Read activity audit log from the audit store.",
|                                               "Description":  "Read activity audit log from the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a78fd341-0672-4792-a8ae-a5925b2546eb",
|                                               "Value":  "AuditActivity.Write",
|                                               "DisplayName":  "Upload activity audit logs to the audit store.",
|                                               "Description":  "Allows the application to upload bulk activity audit logs to the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e4c9e354-4dc5-45b8-9e7c-e1393b0b1a20",
|                                               "Value":  "AuditLog.Read.All",
|                                               "DisplayName":  "Read audit log data",
|                                               "Description":  "Allows the app to read and query your audit log activities, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ba78b16f-1e01-41b6-89ca-73e0a32b304c",
|                                               "Value":  "AuditLogsQuery-CRM.Read.All",
|                                               "DisplayName":  "Read audit logs data from Dynamics CRM workload",
|                                               "Description":  "Allows the app to read and query audit logs from Dynamics CRM workload, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ee3409fe-617f-43cf-bd1e-fc8b38049e69",
|                                               "Value":  "AuditLogsQuery-Endpoint.Read.All",
|                                               "DisplayName":  "Read audit logs data from Endpoint Data Loss Prevention workload",
|                                               "Description":  "Allows the app to read and query audit logs from Endpoint Data Loss Prevention workload, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5ff2f415-e0f1-4d11-bfd0-6d87c0f667fd",
|                                               "Value":  "AuditLogsQuery-Entra.Read.All",
|                                               "DisplayName":  "Read audit logs data from Entra (Azure AD) workload",
|                                               "Description":  "Allows the app to read and query audit logs from Entra (Azure AD) workload, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6c8c71d2-c7e1-45b0-ac6d-1d2724fba6ae",
|                                               "Value":  "AuditLogsQuery-Exchange.Read.All",
|                                               "DisplayName":  "Read audit logs data from Exchange workload",
|                                               "Description":  "Allows the app to read and query audit logs from Exchange workload, on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4a72c235-a50d-4870-b598-fd88fd1fa074",
|                                               "Value":  "AuditLogsQuery-OneDrive.Read.All",
|                                               "DisplayName":  "Read audit logs data from OneDrive workload",
|                                               "Description":  "Allows the app to read and query audit logs from OneDrive workload, on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "30630b65-ed12-4a81-9130-e3a964109fae",
|                                               "Value":  "AuditLogsQuery-SharePoint.Read.All",
|                                               "DisplayName":  "Read audit logs data from SharePoint workload",
|                                               "Description":  "Allows the app to read and query audit logs from SharePoint workload, on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1d9e7ac3-0eca-442c-82f9-e92625af6e6d",
|                                               "Value":  "AuditLogsQuery.Read.All",
|                                               "DisplayName":  "Read audit logs data from all services",
|                                               "Description":  "Allows the app to read and query audit logs from all services, on behalf of a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "57b030f1-8c35-469c-b0d9-e4a077debe70",
|                                               "Value":  "AuthenticationContext.Read.All",
|                                               "DisplayName":  "Read all authentication context information",
|                                               "Description":  "Allows the app to read all authentication context information in your organization on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ba6d575a-1344-4516-b777-1404f5593057",
|                                               "Value":  "AuthenticationContext.ReadWrite.All",
|                                               "DisplayName":  "Read and write all authentication context information",
|                                               "Description":  "Allows the app to read and update all authentication context information in your organization on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "444ed4b6-0554-4dc6-8e9c-3f9a34ee3ff6",
|                                               "Value":  "BackupRestore-Configuration.Read.All",
|                                               "DisplayName":  "Read backup configuration policies",
|                                               "Description":  "Allows the app to read the backup configuration, and list of Microsoft 365 service resources to be backed-up, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a0244d16-171c-4496-8ffb-7b9b6954d339",
|                                               "Value":  "BackupRestore-Configuration.ReadWrite.All",
|                                               "DisplayName":  "Read and edit backup configuration policies",
|                                               "Description":  "Allows the app to read and update the backup configuration, and list of Microsoft 365 service resources to be backed-up, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "af598c63-4292-4437-b925-e996354d3854",
|                                               "Value":  "BackupRestore-Control.Read.All",
|                                               "DisplayName":  "Read the status of the M365 backup service",
|                                               "Description":  "Allows the app to read the status of M365 backup service (enable/disable), on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "96d46335-d92d-41b8-bc9f-273a692381ea",
|                                               "Value":  "BackupRestore-Control.ReadWrite.All",
|                                               "DisplayName":  "Update or read the status of the M365 backup service",
|                                               "Description":  "Allows the app to update or read the status of M365 backup service (enable/disable), on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b4e98de1-4600-4e90-b5e1-7c1dfef04e5c",
|                                               "Value":  "BackupRestore-Monitor.Read.All",
|                                               "DisplayName":  "Read monitoring, quota and billing information for the tenant",
|                                               "Description":  "Allows the app to monitor backup and restore jobs, view quota usage and billing details, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "94b36f78-434f-4904-8c08-421d9a9c1dc2",
|                                               "Value":  "BackupRestore-Restore.Read.All",
|                                               "DisplayName":  "Read restore sessions",
|                                               "Description":  "Allows the app to read restore sessions, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9f89e109-94b9-4c9b-b4fc-98cdaa54f574",
|                                               "Value":  "BackupRestore-Restore.ReadWrite.All",
|                                               "DisplayName":  "Read restore sessions and start restore sessions from backups",
|                                               "Description":  "Allows the app to search the backup snapshots for Microsoft 365 resources, and restore Microsoft 365 resources from a backed-up snapshot, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2b24830f-f435-446f-ab5a-b1e70d9a2eb5",
|                                               "Value":  "BackupRestore-Search.Read.All",
|                                               "DisplayName":  "Search for metadata properties in backup snapshots",
|                                               "Description":  "Allows the app to search the backup snapshots for Microsoft 365 resources, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2bf6d319-dfca-4c22-9879-f88dcfaee6be",
|                                               "Value":  "BillingConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write application billing configuration",
|                                               "Description":  "Allows the app to read and write the billing configuration on all applications on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b27a61ec-b99c-4d6a-b126-c4375d08ae30",
|                                               "Value":  "BitlockerKey.Read.All",
|                                               "DisplayName":  "Read BitLocker keys",
|                                               "Description":  "Allows the app to read BitLocker keys on behalf of the signed-in user, for their owned devices. Allows read of the recovery key."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5a107bfc-4f00-4e1a-b67e-66451267bc68",
|                                               "Value":  "BitlockerKey.ReadBasic.All",
|                                               "DisplayName":  "Read BitLocker keys basic information",
|                                               "Description":  "Allows the app to read basic BitLocker key properties on behalf of the signed-in user, for their owned devices. Does not allow read of the recovery key itself."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7f36b48e-542f-4d3b-9bcb-8406f0ab9fdb",
|                                               "Value":  "Bookings.Manage.All",
|                                               "DisplayName":  "Manage bookings information",
|                                               "Description":  "Allows an app to read, write and manage bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "33b1df99-4b29-4548-9339-7a7b83eaeebc",
|                                               "Value":  "Bookings.Read.All",
|                                               "DisplayName":  "Read bookings information",
|                                               "Description":  "Allows an app to read bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "948eb538-f19d-4ec5-9ccc-f059e1ea4c72",
|                                               "Value":  "Bookings.ReadWrite.All",
|                                               "DisplayName":  "Read and write bookings information",
|                                               "Description":  "Allows an app to read and write bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user. Does not allow create, delete and publish of booking businesses."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "02a5a114-36a6-46ff-a102-954d89d9ab02",
|                                               "Value":  "BookingsAppointment.ReadWrite.All",
|                                               "DisplayName":  "Read and write booking appointments",
|                                               "Description":  "Allows an app to read and write bookings appointments and customers, and additionally allows read businesses information, services, and staff on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "98b17b35-f3b1-4849-a85f-9f13733002f0",
|                                               "Value":  "Bookmark.Read.All",
|                                               "DisplayName":  "Read all bookmarks that the user can access",
|                                               "Description":  "Allows an app to read all bookmarks that the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fb9be2b7-a7fc-4182-aec1-eda4597c43d5",
|                                               "Value":  "BrowserSiteLists.Read.All",
|                                               "DisplayName":  "Read browser site lists for your organization",
|                                               "Description":  "Allows an app to read the browser site lists configured for your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "83b34c85-95bf-497b-a04e-b58eca9d49d0",
|                                               "Value":  "BrowserSiteLists.ReadWrite.All",
|                                               "DisplayName":  "Read and write browser site lists for your organization",
|                                               "Description":  "Allows an app to read and write the browser site lists configured for your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d16480b2-e469-4118-846b-d3d177327bee",
|                                               "Value":  "BusinessScenarioConfig.Read.All",
|                                               "DisplayName":  "Read business scenario configurations",
|                                               "Description":  "Allows the app to read the configurations of your organization\u0027s business scenarios, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c47e7b6e-d6f1-4be9-9ffd-1e00f3e32892",
|                                               "Value":  "BusinessScenarioConfig.Read.OwnedBy",
|                                               "DisplayName":  "Read business scenario configurations this app creates or owns",
|                                               "Description":  "Allows the app to read the configurations of business scenarios it owns, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "755e785b-b658-446f-bb22-5a46abd029ea",
|                                               "Value":  "BusinessScenarioConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write business scenario configurations",
|                                               "Description":  "Allows the app to read and write the configurations of your organization\u0027s business scenarios, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b3b7fcff-b4d4-4230-bf6f-90bd91285395",
|                                               "Value":  "BusinessScenarioConfig.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write business scenario configurations this app creates or owns",
|                                               "Description":  "Allows the app to create new business scenarios and fully manage the configurations of scenarios it owns, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "25b265c4-5d34-4e44-952d-b567f6d3b96d",
|                                               "Value":  "BusinessScenarioData.Read.OwnedBy",
|                                               "DisplayName":  "Read all data for business scenarios this app creates or owns",
|                                               "Description":  "Allows the app to read all data associated with the business scenarios it owns. Data access will be attributed to the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "19932d57-2952-4c60-8634-3655c79fc527",
|                                               "Value":  "BusinessScenarioData.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write all data for business scenarios this app creates or owns",
|                                               "Description":  "Allows the app to fully manage all data associated with the business scenarios it owns. Data access and changes will be attributed to the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "465a38f9-76ea-45b9-9f34-9e8b0d4b0b42",
|                                               "Value":  "Calendars.Read",
|                                               "DisplayName":  "Read user calendars ",
|                                               "Description":  "Allows the app to read events in user calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2b9c4092-424d-4249-948d-b43879977640",
|                                               "Value":  "Calendars.Read.Shared",
|                                               "DisplayName":  "Read user and shared calendars",
|                                               "Description":  "Allows the app to read events in all calendars that the user can access, including delegate and shared calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "662d75ba-a364-42ad-adee-f5f880ea4878",
|                                               "Value":  "Calendars.ReadBasic",
|                                               "DisplayName":  "Read basic details of user calendars",
|                                               "Description":  "Allows the app to read events in user calendars, except for properties such as body, attachments, and extensions."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1ec239c2-d7c9-4623-a91a-a9775856bb36",
|                                               "Value":  "Calendars.ReadWrite",
|                                               "DisplayName":  "Have full access to user calendars ",
|                                               "Description":  "Allows the app to create, read, update, and delete events in user calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "12466101-c9b8-439a-8589-dd09ee67e8e9",
|                                               "Value":  "Calendars.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write user and shared calendars",
|                                               "Description":  "Allows the app to create, read, update and delete events in all calendars in the organization user has permissions to access. This includes delegate and shared calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e24bdaf9-83f8-468b-a144-c681ccb6caf4",
|                                               "Value":  "CallAiInsights.Read.All",
|                                               "DisplayName":  "Read all AI Insights for calls. ",
|                                               "Description":  "Allows the app to read all AI Insights for calls, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "305b375b-00fe-48bf-81bc-e8d78954c1b6",
|                                               "Value":  "CallDelegation.Read",
|                                               "DisplayName":  "Read delegation settings",
|                                               "Description":  "Allows the app to read delegation settings of you"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "599abf67-f72b-4b5f-98a3-cb38fe646118",
|                                               "Value":  "CallDelegation.ReadWrite",
|                                               "DisplayName":  "Read and write delegation settings",
|                                               "Description":  "Allows the app to read and write delegation settings of you"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "43431c03-960e-400f-87c6-8f910321dca3",
|                                               "Value":  "CallEvents.Read",
|                                               "DisplayName":  "Read call event data",
|                                               "Description":  "Allows the app to read call event information for an organization for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "63d31bd6-bcf5-40ca-8283-ba4130a66405",
|                                               "Value":  "CallRecordings.Read.All",
|                                               "DisplayName":  "Read all recordings of calls. ",
|                                               "Description":  "Allows the app to read all recordings of calls, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fbace248-5d8e-441c-85ca-cc19221a69a2",
|                                               "Value":  "CallTranscripts.Read.All",
|                                               "DisplayName":  "Read all transcripts of calls. ",
|                                               "Description":  "Allows the app to read all transcripts of calls, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4628dff5-c33e-4fde-b17a-b64e7acb1bed",
|                                               "Value":  "ChangeManagement.Read.All",
|                                               "DisplayName":  "Read Change Management items",
|                                               "Description":  "Allows to read all Change Management items."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "101147cf-4178-4455-9d58-02b5c164e759",
|                                               "Value":  "Channel.Create",
|                                               "DisplayName":  "Create channels",
|                                               "Description":  "Create channels in any team, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cc83893a-e232-4723-b5af-bd0b01bcfe65",
|                                               "Value":  "Channel.Delete.All",
|                                               "DisplayName":  "Delete channels",
|                                               "Description":  "Delete channels in any team, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9d8982ae-4365-4f57-95e9-d6032a4c0b87",
|                                               "Value":  "Channel.ReadBasic.All",
|                                               "DisplayName":  "Read the names and descriptions of channels",
|                                               "Description":  "Read channel names and channel descriptions, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2eadaff8-0bce-4198-a6b9-2cfc35a30075",
|                                               "Value":  "ChannelMember.Read.All",
|                                               "DisplayName":  "Read the members of channels",
|                                               "Description":  "Read the members of channels, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0c3e411a-ce45-4cd1-8f30-f99a3efa7b11",
|                                               "Value":  "ChannelMember.ReadWrite.All",
|                                               "DisplayName":  "Add and remove members from channels",
|                                               "Description":  "Add and remove members from channels, on behalf of the signed-in user. Also allows changing a member\u0027s role, for example from owner to non-owner."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2b61aa8a-6d36-4b2f-ac7b-f29867937c53",
|                                               "Value":  "ChannelMessage.Edit",
|                                               "DisplayName":  "Edit user\u0027s channel messages",
|                                               "Description":  "Allows an app to edit channel messages in Microsoft Teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "767156cb-16ae-4d10-8f8b-41b657c8c8c8",
|                                               "Value":  "ChannelMessage.Read.All",
|                                               "DisplayName":  "Read user channel messages",
|                                               "Description":  "Allows an app to read a channel\u0027s messages in Microsoft Teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5922d31f-46c8-4404-9eaf-2117e390a8a4",
|                                               "Value":  "ChannelMessage.ReadWrite",
|                                               "DisplayName":  "Read and write user channel messages",
|                                               "Description":  "Allows the app to read and write channel messages, on behalf of the signed-in user. This doesn\u0027t allow the app to edit the policyViolation of a channel message."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ebf0f66e-9fb1-49e4-a278-222f76911cf4",
|                                               "Value":  "ChannelMessage.Send",
|                                               "DisplayName":  "Send channel messages",
|                                               "Description":  "Allows an app to send channel messages in Microsoft Teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "233e0cf1-dd62-48bc-b65b-b38fe87fcf8e",
|                                               "Value":  "ChannelSettings.Read.All",
|                                               "DisplayName":  "Read the names, descriptions, and settings of channels",
|                                               "Description":  "Read all channel names, channel descriptions, and channel settings, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d649fb7c-72b4-4eec-b2b4-b15acf79e378",
|                                               "Value":  "ChannelSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write the names, descriptions, and settings of channels",
|                                               "Description":  "Read and write the names, descriptions, and settings of all channels, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "38826093-1258-4dea-98f0-00003be2b8d0",
|                                               "Value":  "Chat.Create",
|                                               "DisplayName":  "Create chats",
|                                               "Description":  "Allows the app to create chats on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bb64e6fc-6b6d-4752-aea0-dd922dbba588",
|                                               "Value":  "Chat.ManageDeletion.All",
|                                               "DisplayName":  "Delete and recover deleted chats",
|                                               "Description":  "Allows the app to delete and recover deleted chats, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f501c180-9344-439a-bca0-6cbf209fd270",
|                                               "Value":  "Chat.Read",
|                                               "DisplayName":  "Read user chat messages",
|                                               "Description":  "Allows an app to read 1 on 1 or group chats threads, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9547fcb5-d03f-419d-9948-5928bbf71b0f",
|                                               "Value":  "Chat.ReadBasic",
|                                               "DisplayName":  "Read names and members of user chat threads",
|                                               "Description":  "Allows an app to read the members and descriptions of one-to-one and group chat threads, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9ff7295e-131b-4d94-90e1-69fde507ac11",
|                                               "Value":  "Chat.ReadWrite",
|                                               "DisplayName":  "Read and write user chat messages",
|                                               "Description":  "Allows an app to read and write 1 on 1 or group chats threads, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7e9a077b-3711-42b9-b7cb-5fa5f3f7fea7",
|                                               "Value":  "Chat.ReadWrite.All",
|                                               "DisplayName":  "Read and write all chat messages",
|                                               "Description":  "Allows an app to read and write all one-to-one and group chats in Microsoft Teams, without a signed-in user. Does not allow sending messages."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c5a9e2b1-faf6-41d4-8875-d381aa549b24",
|                                               "Value":  "ChatMember.Read",
|                                               "DisplayName":  "Read the members of chats",
|                                               "Description":  "Read the members of chats, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dea13482-7ea6-488f-8b98-eb5bbecf033d",
|                                               "Value":  "ChatMember.ReadWrite",
|                                               "DisplayName":  "Add and remove members from chats",
|                                               "Description":  "Add and remove members from chats, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cdcdac3a-fd45-410d-83ef-554db620e5c7",
|                                               "Value":  "ChatMessage.Read",
|                                               "DisplayName":  "Read user chat messages",
|                                               "Description":  "Allows an app to read one-to-one and group chat messages, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "116b7235-7cc6-461e-b163-8e55691d839e",
|                                               "Value":  "ChatMessage.Send",
|                                               "DisplayName":  "Send user chat messages",
|                                               "Description":  "Allows an app to send one-to-one and group chat messages in Microsoft Teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ad46d60e-1027-4b75-af88-7c14ccf43a19",
|                                               "Value":  "CloudApp-Discovery.Read.All",
|                                               "DisplayName":  "Read discovered cloud applications data",
|                                               "Description":  "Allows the app to read details of discovered cloud apps in the organization, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5252ec4e-fd40-4d92-8c68-89dd1d3c6110",
|                                               "Value":  "CloudPC.Read.All",
|                                               "DisplayName":  "Read Cloud PCs",
|                                               "Description":  "Allows the app to read the properties of Cloud PCs on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9d77138f-f0e2-47ba-ab33-cd246c8b79d1",
|                                               "Value":  "CloudPC.ReadWrite.All",
|                                               "DisplayName":  "Read and write Cloud PCs",
|                                               "Description":  "Allows the app to read and write the properties of Cloud PCs on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "12ae2e92-14b5-47b2-babb-4e890bbedc0a",
|                                               "Value":  "Community.Read.All",
|                                               "DisplayName":  "Read all Viva Engage communities",
|                                               "Description":  "Allows the app to list Viva Engage communities, and to read their properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9e69467d-e0e2-402b-a926-3d796990197f",
|                                               "Value":  "Community.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Viva Engage communities",
|                                               "Description":  "Allows the app to create Viva Engage communities and read all community properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c645bb69-adc4-4242-b620-02e635f03bf6",
|                                               "Value":  "ConfigurationMonitoring.Read.All",
|                                               "DisplayName":  "Read all Configuration Monitoring entities",
|                                               "Description":  "Allows the app to read all Configuration Monitoring entities on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "54505ce9-e719-41f7-a7cc-dbe114e1d811",
|                                               "Value":  "ConfigurationMonitoring.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Configuration Monitoring entities",
|                                               "Description":  "Allows the app to read and write all Configuration Monitoring entities on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f2143d35-9b4b-480d-951c-d083e69eeb2c",
|                                               "Value":  "ConsentRequest.Create",
|                                               "DisplayName":  "Create consent requests",
|                                               "Description":  "Allows the app to read create consent requests on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5942b2f6-5a7b-40af-aa37-4b6ea5447506",
|                                               "Value":  "ConsentRequest.Read",
|                                               "DisplayName":  "Read consent requests created by the user",
|                                               "Description":  "Allows the app to read consent requests and approvals created by the signed-in user, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f3bfad56-966e-4590-a536-82ecf548ac1e",
|                                               "Value":  "ConsentRequest.Read.All",
|                                               "DisplayName":  "Read consent requests",
|                                               "Description":  "Allows the app to read consent requests and approvals on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e694a3a1-7878-46d8-8c29-3d195f6589f4",
|                                               "Value":  "ConsentRequest.ReadApprove.All",
|                                               "DisplayName":  "Read and approve consent requests",
|                                               "Description":  "Allows the app to read and approve consent requests on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "497d9dfa-3bd1-481a-baab-90895e54568c",
|                                               "Value":  "ConsentRequest.ReadWrite.All",
|                                               "DisplayName":  "Read and write consent requests",
|                                               "Description":  "Allows the app to read app consent requests and approvals, and deny or approve those requests on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1e4c6c41-0803-4f52-85ef-0a5d63ad8670",
|                                               "Value":  "Contacts-OnPremisesSyncBehavior.ReadWrite.All",
|                                               "DisplayName":  "Read and update the on-premises sync behavior of contacts",
|                                               "Description":  "Allows the app to read and update the on-premises sync behavior of contacts a user has permissions to, including their own and shared contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ff74d97f-43af-4b68-9f2a-b77ee6968c5d",
|                                               "Value":  "Contacts.Read",
|                                               "DisplayName":  "Read user contacts ",
|                                               "Description":  "Allows the app to read user contacts.  "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "242b9d9e-ed24-4d09-9a52-f43769beb9d4",
|                                               "Value":  "Contacts.Read.Shared",
|                                               "DisplayName":  "Read user and shared contacts",
|                                               "Description":  "Allows the app to read contacts a user has permissions to access, including their own and shared contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d56682ec-c09e-4743-aaf4-1a3aac4caa21",
|                                               "Value":  "Contacts.ReadWrite",
|                                               "DisplayName":  "Have full access to user contacts ",
|                                               "Description":  "Allows the app to create, read, update, and delete user contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "afb6c84b-06be-49af-80bb-8f3f77004eab",
|                                               "Value":  "Contacts.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write user and shared contacts",
|                                               "Description":  "Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7e2467d1-f874-46bb-828e-24cb06b29d3f",
|                                               "Value":  "Content.Process.All",
|                                               "DisplayName":  "Process content for data security, governance and compliance",
|                                               "Description":  "Allows the app to process and evaluate content for data security, governance and compliance outcomes at tenant scope."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1d787a13-f750-4ad6-875a-fcbd2725596b",
|                                               "Value":  "Content.Process.User",
|                                               "DisplayName":  "Process content for data security, governance and compliance",
|                                               "Description":  "Allows the app to process and evaluate content for data security, governance and compliance outcomes for a user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "62c55b2f-a2b1-4312-8385-be57afd901b4",
|                                               "Value":  "ContentActivity.Read",
|                                               "DisplayName":  "Read contents activity audit log from the audit store.",
|                                               "Description":  "Read contents activity audit log from the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "948caae6-152a-48cd-a746-4844af30e8e9",
|                                               "Value":  "ContentActivity.Write",
|                                               "DisplayName":  "Upload contents activity audit logs to the audit store.",
|                                               "Description":  "Allows the application to upload bulk contents activity audit logs to the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9df4d5b0-7921-4437-9ea8-adf0c9e276dc",
|                                               "Value":  "Contracts.Read.All",
|                                               "DisplayName":  "Read contracts",
|                                               "Description":  "Allows the app to read available properties of contracts, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ed510a02-ac32-45f9-93e6-04864f7f7e47",
|                                               "Value":  "CopilotConversation.Delete",
|                                               "DisplayName":  "Delete Microsoft 365 Copilot conversations",
|                                               "Description":  "Allows the app to delete Microsoft 365 Copilot conversations on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a2dcfcb9-cbe8-4d42-812d-952e55cf7f3f",
|                                               "Value":  "CopilotPackages.Read.All",
|                                               "DisplayName":  "Read all packages information",
|                                               "Description":  "Allows the user to read the packages information"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e9c5fd18-ac15-43dd-9f5c-6f9611dd5604",
|                                               "Value":  "CopilotPackages.ReadWrite.All",
|                                               "DisplayName":  "Read and update all packages information",
|                                               "Description":  "Allows the user to read and update the packages information"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b7281c63-cd4d-40c3-b721-73aa8ee7c3a8",
|                                               "Value":  "CopilotPolicySettings.Read",
|                                               "DisplayName":  "Read Copilot policy settings",
|                                               "Description":  "Allows the app to read Copilot policy settings for the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e2edbde8-4448-4e49-8ebb-d53ba72df0f3",
|                                               "Value":  "CopilotPolicySettings.ReadWrite",
|                                               "DisplayName":  "Read and write Copilot policy settings",
|                                               "Description":  "Allows the app to read and write Copilot policy settings for the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "aeb2982d-632d-4155-b533-18756ab6fdd8",
|                                               "Value":  "CopilotSettings-LimitedMode.Read",
|                                               "DisplayName":  "Read organization-wide copilot limited mode setting",
|                                               "Description":  "Allows the app to read organization-wide copilot limited mode setting on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4704e5b2-0ada-4aa0-b18c-00ad7525bc06",
|                                               "Value":  "CopilotSettings-LimitedMode.ReadWrite",
|                                               "DisplayName":  "Read and write organization-wide copilot limited mode setting",
|                                               "Description":  "Allows the app to read and write organization-wide copilot limited mode setting on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "81594d25-e88e-49cf-ac8c-fecbff49f994",
|                                               "Value":  "CrossTenantInformation.ReadBasic.All",
|                                               "DisplayName":  "Read cross-tenant basic information",
|                                               "Description":  "Allows the application to obtain basic tenant information about another target tenant within the Azure AD ecosystem on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cb1ba48f-d22b-4325-a07f-74135a62ee41",
|                                               "Value":  "CrossTenantUserProfileSharing.Read",
|                                               "DisplayName":  "Read shared cross-tenant user profile and export data",
|                                               "Description":  "Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "759dcd16-3c90-463c-937e-abf89f991c18",
|                                               "Value":  "CrossTenantUserProfileSharing.Read.All",
|                                               "DisplayName":  "Read all shared cross-tenant user profiles and export their data",
|                                               "Description":  "Allows the application to list and query any shared user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eed0129d-dc60-4f30-8641-daf337a39ffd",
|                                               "Value":  "CrossTenantUserProfileSharing.ReadWrite",
|                                               "DisplayName":  "Read shared cross-tenant user profile and export or delete data",
|                                               "Description":  "Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "64dfa325-cbf8-48e3-938d-51224a0cac01",
|                                               "Value":  "CrossTenantUserProfileSharing.ReadWrite.All",
|                                               "DisplayName":  "Read all shared cross-tenant user profiles and export or delete their data",
|                                               "Description":  "Allows the application to list and query any shared user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b2052569-c98c-4f36-a5fb-43e5c111e6d0",
|                                               "Value":  "CustomAuthenticationExtension.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s custom authentication extensions",
|                                               "Description":  "Allows the app to read your organization\u0027s custom authentication extensions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8dfcf82f-15d0-43b3-bc78-a958a13a5792",
|                                               "Value":  "CustomAuthenticationExtension.ReadWrite.All",
|                                               "DisplayName":  "Read and write your organization\u0027s custom authentication extensions",
|                                               "Description":  "Allows the app to read or write your organization\u0027s custom authentication extensions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b13ff42e-f321-4d7d-a462-141c46a1b832",
|                                               "Value":  "CustomDetection.Read.All",
|                                               "DisplayName":  "Read custom detection rules",
|                                               "Description":  "Allows the app to read custom detection rules on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c34088fb-0649-4714-af0b-bcbfec155897",
|                                               "Value":  "CustomDetection.ReadWrite.All",
|                                               "DisplayName":  "Read and write custom detection rules",
|                                               "Description":  "Allows the app to read and write custom detection rules on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b46ffa80-fe3d-4822-9a1a-c200932d54d0",
|                                               "Value":  "CustomSecAttributeAssignment.Read.All",
|                                               "DisplayName":  "Read custom security attribute assignments",
|                                               "Description":  "Allows the app to read custom security attribute assignments for all principals in the tenant on behalf of a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ca46335e-8453-47cd-a001-8459884efeae",
|                                               "Value":  "CustomSecAttributeAssignment.ReadWrite.All",
|                                               "DisplayName":  "Read and write custom security attribute assignments",
|                                               "Description":  "Allows the app to read and write custom security attribute assignments for all principals in the tenant on behalf of a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1fcdeaab-b519-44dd-bffc-ed1fd15a24e0",
|                                               "Value":  "CustomSecAttributeAuditLogs.Read.All",
|                                               "DisplayName":  "Read custom security attribute audit logs",
|                                               "Description":  "Allows the app to read audit logs for events that contain information about custom security attributes, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ce026878-a0ff-4745-a728-d4fedd086c07",
|                                               "Value":  "CustomSecAttributeDefinition.Read.All",
|                                               "DisplayName":  "Read custom security attribute definitions",
|                                               "Description":  "Allows the app to read custom security attribute definitions for the tenant on behalf of a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8b0160d4-5743-482b-bb27-efc0a485ca4a",
|                                               "Value":  "CustomSecAttributeDefinition.ReadWrite.All",
|                                               "DisplayName":  "Read and write custom security attribute definitions",
|                                               "Description":  "Allows the app to read and write custom security attribute definitions for the tenant on behalf of a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9ddd870d-077c-49e7-b3e3-6b3012a8a880",
|                                               "Value":  "CustomSecAttributeProvisioning.Read.All",
|                                               "DisplayName":  "Read the provisioning configuration of all active custom security attributes",
|                                               "Description":  "Allows the app to read the provisioning configuration of all active custom security attributes on behalf of a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1140d9e4-6776-433e-a9e4-b9831adbb2e0",
|                                               "Value":  "CustomSecAttributeProvisioning.ReadWrite.All",
|                                               "DisplayName":  "Read and edit the provisioning configuration of all active custom security attributes",
|                                               "Description":  "Allows the app to read and edit the provisioning configuration of all active custom security attributes on behalf of a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "de6ea87d-10bd-467c-8682-d525a0c61b89",
|                                               "Value":  "CustomTags.Read.All",
|                                               "DisplayName":  "Read all custom tags data",
|                                               "Description":  "Read custom tags data on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2f1bbe0a-f34b-4efb-9edb-8db8dcb50eca",
|                                               "Value":  "CustomTags.ReadWrite.All",
|                                               "DisplayName":  "Read and write custom tags data",
|                                               "Description":  "Read and write custom tags data on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0c0064ea-477b-4130-82a5-4c2cc4ff68aa",
|                                               "Value":  "DelegatedAdminRelationship.Read.All",
|                                               "DisplayName":  "Read Delegated Admin relationships with customers",
|                                               "Description":  "Allows the app to read details of delegated admin relationships with customers like access details (that includes roles) and the duration as well as specific role assignments to security groups on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "885f682f-a990-4bad-a642-36736a74b0c7",
|                                               "Value":  "DelegatedAdminRelationship.ReadWrite.All",
|                                               "DisplayName":  "Manage Delegated Admin relationships with customers",
|                                               "Description":  "Allows the app to manage (create-update-terminate) Delegated Admin relationships with customers as well as role assignments to security groups for active Delegated Admin relationships on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a197cdc4-a8e8-4d49-9d35-4ca7c83887b4",
|                                               "Value":  "DelegatedPermissionGrant.Read.All",
|                                               "DisplayName":  "Read delegated permission grants",
|                                               "Description":  "Allows the app to read delegated permission grants, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "41ce6ca6-6826-4807-84f1-1c82854f7ee5",
|                                               "Value":  "DelegatedPermissionGrant.ReadWrite.All",
|                                               "DisplayName":  "Manage all delegated permission grants",
|                                               "Description":  "Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bac3b9c2-b516-4ef4-bd3b-c2ef73d8d804",
|                                               "Value":  "Device.Command",
|                                               "DisplayName":  "Communicate with user devices",
|                                               "Description":  "Allows the app to launch another app or communicate with another app on a user\u0027s device on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "edc92e89-a987-48a9-911a-a7b1967dd7b1",
|                                               "Value":  "Device.CreateFromOwnedTemplate",
|                                               "DisplayName":  "Create devices based on owned device templates",
|                                               "Description":  "Allows the app to create device objects based on device templates owned by the signed-in user, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "11d4cd79-5ba5-460f-803f-e22c8ab85ccd",
|                                               "Value":  "Device.Read",
|                                               "DisplayName":  "Read user devices",
|                                               "Description":  "Allows the app to read a user\u0027s list of devices on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "951183d1-1a61-466f-a6d1-1fde911bfd95",
|                                               "Value":  "Device.Read.All",
|                                               "DisplayName":  "Read all devices",
|                                               "Description":  "Allows the app to read your organization\u0027s devices\u0027 configuration information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "280b3b69-0437-44b1-bc20-3b2fca1ee3e9",
|                                               "Value":  "DeviceLocalCredential.Read.All",
|                                               "DisplayName":  "Read device local credential passwords",
|                                               "Description":  "Allows the app to read device local credential properties including passwords, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9917900e-410b-4d15-846e-42a357488545",
|                                               "Value":  "DeviceLocalCredential.ReadBasic.All",
|                                               "DisplayName":  "Read device local credential properties",
|                                               "Description":  "Allows the app to read device local credential properties excluding passwords, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4edf5f54-4666-44af-9de9-0144fb4b6e8c",
|                                               "Value":  "DeviceManagementApps.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune apps",
|                                               "Description":  "Allows the app to read the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7b3f05d5-f68c-4b8d-8c59-a2ecd12f24af",
|                                               "Value":  "DeviceManagementApps.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune apps",
|                                               "Description":  "Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ac5c8443-d999-471f-9247-ce92cf5c5560",
|                                               "Value":  "DeviceManagementCloudCA.Read.All",
|                                               "DisplayName":  "Read Microsoft Cloud PKI objects",
|                                               "Description":  "Allows the app to read certification authority information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "93028c58-65aa-48db-a706-1fe4ada325ec",
|                                               "Value":  "DeviceManagementCloudCA.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Cloud PKI objects",
|                                               "Description":  "Allows the app to read and write certification authority information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f1493658-876a-4c87-8fa7-edb559b3476a",
|                                               "Value":  "DeviceManagementConfiguration.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune Device Configuration and Policies",
|                                               "Description":  "Allows the app to read properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0883f392-0a7a-443d-8c76-16a6d39c7b63",
|                                               "Value":  "DeviceManagementConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune Device Configuration and Policies",
|                                               "Description":  "Allows the app to read and write properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3404d2bf-2b13-457e-a330-c24615765193",
|                                               "Value":  "DeviceManagementManagedDevices.PrivilegedOperations.All",
|                                               "DisplayName":  "Perform user-impacting remote actions on Microsoft Intune devices",
|                                               "Description":  "Allows the app to perform remote high impact actions such as wiping the device or resetting the passcode on devices managed by Microsoft Intune."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "314874da-47d6-4978-88dc-cf0d37f0bb82",
|                                               "Value":  "DeviceManagementManagedDevices.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune devices",
|                                               "Description":  "Allows the app to read the properties of devices managed by Microsoft Intune."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "44642bfe-8385-4adc-8fc6-fe3cb2c375c3",
|                                               "Value":  "DeviceManagementManagedDevices.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune devices",
|                                               "Description":  "Allows the app to read and write the properties of devices managed by Microsoft Intune. Does not allow high impact operations such as remote wipe and password reset on the device’s owner."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "49f0cc30-024c-4dfd-ab3e-82e137ee5431",
|                                               "Value":  "DeviceManagementRBAC.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune RBAC settings",
|                                               "Description":  "Allows the app to read the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0c5e8a55-87a6-4556-93ab-adc52c4d862d",
|                                               "Value":  "DeviceManagementRBAC.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune RBAC settings",
|                                               "Description":  "Allows the app to read and write the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d32381d8-ee89-4220-9c83-b672aa68d404",
|                                               "Value":  "DeviceManagementScripts.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune Scripts",
|                                               "Description":  "Allows the app to read Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8b9d79d0-ad75-4566-8619-f7500ecfcebe",
|                                               "Value":  "DeviceManagementScripts.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune Scripts",
|                                               "Description":  "Allows the app to read and write Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8696daa5-bce5-4b2e-83f9-51b6defc4e1e",
|                                               "Value":  "DeviceManagementServiceConfig.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune configuration",
|                                               "Description":  "Allows the app to read Microsoft Intune service properties including device enrollment and third party service connection configuration."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "662ed50a-ac44-4eef-ad86-62eed9be2a29",
|                                               "Value":  "DeviceManagementServiceConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune configuration",
|                                               "Description":  "Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0b1717ff-3e42-4a73-8c29-e6b2e1093960",
|                                               "Value":  "DeviceTemplate.Create",
|                                               "DisplayName":  "Create device templates",
|                                               "Description":  "Allows the app to create device templates on behalf of the signed in user. The user is marked as owners of the created device template. As a member of owners, the user will be allowed to manage devices created from the template."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2bcae0b0-aa93-48e4-a9e4-855482dffdcd",
|                                               "Value":  "DeviceTemplate.Read.All",
|                                               "DisplayName":  "Read all device templates",
|                                               "Description":  "Allows the app to read all device templates, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2d372e98-f1ae-406c-a157-2ea83f6f5e4a",
|                                               "Value":  "DeviceTemplate.ReadWrite.All",
|                                               "DisplayName":  "Read and write all device templates",
|                                               "Description":  "Allows the app to create, read, update and delete the device template, on behalf of the signed in user. It also allows the app to add or remove owners on any device template."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0e263e50-5827-48a4-b97c-d940288653c7",
|                                               "Value":  "Directory.AccessAsUser.All",
|                                               "DisplayName":  "Access directory as the signed in user",
|                                               "Description":  "Allows the app to have the same access to information in the directory as the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "06da0dbc-49e2-44d2-8312-53f166ab848a",
|                                               "Value":  "Directory.Read.All",
|                                               "DisplayName":  "Read directory data",
|                                               "Description":  "Allows the app to read data in your organization\u0027s directory, such as users, groups and apps."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c5366453-9fb0-48a5-a156-24f0c49a4b84",
|                                               "Value":  "Directory.ReadWrite.All",
|                                               "DisplayName":  "Read and write directory data",
|                                               "Description":  "Allows the app to read and write data in your organization\u0027s directory, such as users, and groups.  It does not allow the app to delete users or groups, or reset user passwords."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "34d3bd24-f6a6-468c-b67c-0c365c1d6410",
|                                               "Value":  "DirectoryRecommendations.Read.All",
|                                               "DisplayName":  "Read Azure AD recommendations",
|                                               "Description":  "Allows the app to read Azure AD recommendations, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f37235e8-90a0-4189-93e2-e55b53867ccd",
|                                               "Value":  "DirectoryRecommendations.ReadWrite.All",
|                                               "DisplayName":  "Read and update Azure AD recommendations",
|                                               "Description":  "Allows the app to read and update Azure AD recommendations, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "33203a2a-a761-40f0-8a7c-a7e74a9f8ac6",
|                                               "Value":  "Domain-InternalFederation.Read.All",
|                                               "DisplayName":  "Read internal federation configuration for a domain.",
|                                               "Description":  "Allows the app to read internal federation configuration for a domain."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "857bd3ea-490e-4284-88a7-a7de1893b6ee",
|                                               "Value":  "Domain-InternalFederation.ReadWrite.All",
|                                               "DisplayName":  "Create, read, update and delete internal federation configuration for a domain.",
|                                               "Description":  "Allows the app to create, read, update and delete internal federation configuration for a domain."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2f9ee017-59c1-4f1d-9472-bd5529a7b311",
|                                               "Value":  "Domain.Read.All",
|                                               "DisplayName":  "Read domains.",
|                                               "Description":  "Allows the app to read all domain properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0b5d694c-a244-4bde-86e6-eb5cd07730fe",
|                                               "Value":  "Domain.ReadWrite.All",
|                                               "DisplayName":  "Read and write domains",
|                                               "Description":  "Allows the app to read and write all domain properties on behalf of the signed-in user. Also allows the app to add, verify and remove domains."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ff91d191-45a0-43fd-b837-bd682c4a0b0f",
|                                               "Value":  "EAS.AccessAsUser.All",
|                                               "DisplayName":  "Access mailboxes via Exchange ActiveSync",
|                                               "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via Exchange ActiveSync."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "99201db3-7652-4d5a-809a-bdb94f85fe3c",
|                                               "Value":  "eDiscovery.Read.All",
|                                               "DisplayName":  "Read all eDiscovery objects",
|                                               "Description":  "Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "acb8f680-0834-4146-b69e-4ab1b39745ad",
|                                               "Value":  "eDiscovery.ReadWrite.All",
|                                               "DisplayName":  "Read and write all eDiscovery objects",
|                                               "Description":  "Allows the app to read and write eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8523895c-6081-45bf-8a5d-f062a2f12c9f",
|                                               "Value":  "EduAdministration.Read",
|                                               "DisplayName":  "Read education app settings",
|                                               "Description":  "Read the state and settings of all Microsoft education apps on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "63589852-04e3-46b4-bae9-15d5b1050748",
|                                               "Value":  "EduAdministration.ReadWrite",
|                                               "DisplayName":  "Manage education app settings",
|                                               "Description":  "Manage the state and settings of all Microsoft education apps on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "091460c9-9c4a-49b2-81ef-1f3d852acce2",
|                                               "Value":  "EduAssignments.Read",
|                                               "DisplayName":  "Read users\u0027 class assignments and their grades",
|                                               "Description":  "Allows the app to read assignments and their grades on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c0b0103b-c053-4b2e-9973-9f3a544ec9b8",
|                                               "Value":  "EduAssignments.ReadBasic",
|                                               "DisplayName":  "Read users\u0027 class assignments without grades",
|                                               "Description":  "Allows the app to read assignments without grades on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2f233e90-164b-4501-8bce-31af2559a2d3",
|                                               "Value":  "EduAssignments.ReadWrite",
|                                               "DisplayName":  "Read and write users\u0027 class assignments and their grades",
|                                               "Description":  "Allows the app to read and write assignments and their grades on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2ef770a1-622a-47c4-93ee-28d6adbed3a0",
|                                               "Value":  "EduAssignments.ReadWriteBasic",
|                                               "DisplayName":  "Read and write users\u0027 class assignments without grades",
|                                               "Description":  "Allows the app to read and write assignments without grades on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "484859e8-b9e2-4e92-b910-84db35dadd29",
|                                               "Value":  "EduCurricula.Read",
|                                               "DisplayName":  "Read the user\u0027s class modules and resources",
|                                               "Description":  "Allows the app to read the user\u0027s modules and resources on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4793c53b-df34-44fd-8d26-d15c517732f5",
|                                               "Value":  "EduCurricula.ReadWrite",
|                                               "DisplayName":  "Read and write the user\u0027s class modules and resources",
|                                               "Description":  "Allows the app to read and write user\u0027s modules and resources on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a4389601-22d9-4096-ac18-36a927199112",
|                                               "Value":  "EduRoster.Read",
|                                               "DisplayName":  "Read users\u0027 view of the roster",
|                                               "Description":  "Allows the app to read the structure of schools and classes in an organization\u0027s roster and education-specific information about users to be read on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5d186531-d1bf-4f07-8cea-7c42119e1bd9",
|                                               "Value":  "EduRoster.ReadBasic",
|                                               "DisplayName":  "Read a limited subset of users\u0027 view of the roster",
|                                               "Description":  "Allows the app to read a limited subset of the properties from the structure of schools and classes in an organization\u0027s roster and a limited subset of properties about users to be read on behalf of the user. Includes name, status, education role, email address and photo."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "359e19a6-e3fa-4d7f-bcab-d28ec592b51e",
|                                               "Value":  "EduRoster.ReadWrite",
|                                               "DisplayName":  "Read and write users\u0027 view of the roster",
|                                               "Description":  "Allows the app to read and write the structure of schools and classes in an organization\u0027s roster and education-specific information about users to be read and written on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "64a6cdd6-aab1-4aaf-94b8-3cc8405e90d0",
|                                               "Value":  "email",
|                                               "DisplayName":  "View users\u0027 email address",
|                                               "Description":  "Allows the app to read your users\u0027 primary email address"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c55541d9-2cdd-4fad-8ead-0c08fae5b0c8",
|                                               "Value":  "EngagementConversation.Read.All",
|                                               "DisplayName":  "Read all Viva Engage conversations",
|                                               "Description":  "Allows the app to read Viva Engage conversations, and to read their properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ebbfd079-1634-4640-8618-68b19ebbed1d",
|                                               "Value":  "EngagementConversation.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Viva Engage conversations",
|                                               "Description":  "Allows the app to create Viva Engage conversations and read all conversation properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "58c5819e-29bd-4400-ad52-82cd82a63fbd",
|                                               "Value":  "EngagementMeetingConversation.Read.All",
|                                               "DisplayName":  "Read all Viva Engage Teams QA conversations",
|                                               "Description":  "Allows the app to read Viva Engage Teams QA conversations, and to read their properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9f1da0fc-345c-4dfb-bab5-5215a073a417",
|                                               "Value":  "EngagementRole.Read",
|                                               "DisplayName":  "Read a user\u0027s Viva Engage roles ",
|                                               "Description":  "Allows the app to list a user\u0027s Viva Engage roles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3cad91a5-8413-4c4a-acfe-dfeb83d1366d",
|                                               "Value":  "EngagementRole.Read.All",
|                                               "DisplayName":  "Read all Viva Engage roles and role memberships",
|                                               "Description":  "Allows the app to list all Viva Engage roles and role memberships on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4905982d-6459-4ccd-949c-949fefc0a8f2",
|                                               "Value":  "EngagementRole.ReadWrite.All",
|                                               "DisplayName":  "Modify Viva Engage role membership",
|                                               "Description":  "Allows the app to assign Viva Engage role to a user, and remove a Viva Engage role from a user behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5449aa12-1393-4ea2-a7c7-d0e06c1a56b2",
|                                               "Value":  "EntitlementManagement.Read.All",
|                                               "DisplayName":  "Read all entitlement management resources",
|                                               "Description":  "Allows the app to read access packages and related entitlement management resources on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ae7a573d-81d7-432b-ad44-4ed5c9d89038",
|                                               "Value":  "EntitlementManagement.ReadWrite.All",
|                                               "DisplayName":  "Read and write entitlement management resources",
|                                               "Description":  "Allows the app to request access to and management of access packages and related entitlement management resources on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e9fdcbbb-8807-410f-b9ec-8d5468c7c2ac",
|                                               "Value":  "EntitlementMgmt-SubjectAccess.ReadWrite",
|                                               "DisplayName":  "Read and write entitlement management resources related to self-service operations",
|                                               "Description":  "Allows the app to manage self-service entitlement management resources on behalf of the signed-in user.  This includes operations such as requesting access and approving access of others."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a6ea9dd7-4dd9-4484-a80a-ac9ad981dcf1",
|                                               "Value":  "EntraBackup.Read.All",
|                                               "DisplayName":  "Read Preview jobs and snapshots",
|                                               "Description":  "Allows the app to list the all the snapshots, jobs and enumerate the changes of a specific preview job, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cef123a8-c18c-4eba-852e-d90cfbf67c91",
|                                               "Value":  "EntraBackup.ReadWrite.Preview",
|                                               "DisplayName":  "Create a preview job, read preview job and snapshots",
|                                               "Description":  "Allows the app to  list the all the snapshots, create a preview job and enumerate the changes of a specific preview job, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8269c6ff-41d7-4172-a783-b2ce38322e42",
|                                               "Value":  "EntraBackup.ReadWrite.Recovery",
|                                               "DisplayName":  "Create preview and recovery job, read recovery job and snapshots",
|                                               "Description":  "Allows the app to  list the all the snapshots, create a recovery job and enumerate the changes of a specific recovery job, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f7dd3bed-5eec-48da-bc73-1c0ef50bc9a1",
|                                               "Value":  "EventListener.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s authentication event listeners",
|                                               "Description":  "Allows the app to read your organization\u0027s authentication event listeners on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d11625a6-fe21-4fc6-8d3d-063eba5525ad",
|                                               "Value":  "EventListener.ReadWrite.All",
|                                               "DisplayName":  "Read and write your organization\u0027s authentication event listeners",
|                                               "Description":  "Allows the app to read or write your organization\u0027s authentication event listeners on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9769c687-087d-48ac-9cb3-c37dde652038",
|                                               "Value":  "EWS.AccessAsUser.All",
|                                               "DisplayName":  "Access mailboxes as the signed-in user via Exchange Web Services",
|                                               "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via Exchange Web Services."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b2e7d27e-14e7-41ad-bb15-a88ceb9c3e90",
|                                               "Value":  "ExchangeMessageTrace.Read.All",
|                                               "DisplayName":  "Search the email message trace",
|                                               "Description":  "Allows the app to search the email message trace on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a38267a5-26b6-4d76-9493-935b7599116b",
|                                               "Value":  "ExternalConnection.Read.All",
|                                               "DisplayName":  "Read all external connections",
|                                               "Description":  "Allows the app to read all external connections on behalf of a signed-in user. The signed-in user must be an administrator."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bbbbd9b3-3566-4931-ac37-2b2180d9e334",
|                                               "Value":  "ExternalConnection.ReadWrite.All",
|                                               "DisplayName":  "Read and write all external connections",
|                                               "Description":  "Allows the app to read and write all external connections on behalf of a signed-in user. The signed-in user must be an administrator."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4082ad95-c812-4f02-be92-780c4c4f1830",
|                                               "Value":  "ExternalConnection.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write external connections",
|                                               "Description":  "Allows the app to read and write settings of external connections on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read and write settings of connections that it is authorized to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "922f9392-b1b7-483c-a4be-0089be7704fb",
|                                               "Value":  "ExternalItem.Read.All",
|                                               "DisplayName":  "Read items in external datasets",
|                                               "Description":  "Allow the app to read external datasets and content, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b02c54f8-eb48-4c50-a9f0-a149e5a2012f",
|                                               "Value":  "ExternalItem.ReadWrite.All",
|                                               "DisplayName":  "Read and write all external items",
|                                               "Description":  "Allows the app to read and write all external items on behalf of a signed-in user. The signed-in user must be an administrator."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4367b9d7-cee7-4995-853c-a0bdfe95c1f9",
|                                               "Value":  "ExternalItem.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write external items",
|                                               "Description":  "Allows the app to read and write external items on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read external items of the connection that it is authorized to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "47167bec-55a7-4caf-9ecc-8d4566e3cfb1",
|                                               "Value":  "ExternalUserProfile.Read.All",
|                                               "DisplayName":  "Read external user profiles",
|                                               "Description":  "Allows the app to read available properties of external user profiles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c6068dc7-a791-46a4-a811-b8228e6649ab",
|                                               "Value":  "ExternalUserProfile.ReadWrite.All",
|                                               "DisplayName":  "Read and write external user profiles",
|                                               "Description":  "Allows the app to read and write available properties of external user profiles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3a1e4806-a744-4c70-80fc-223bf8582c46",
|                                               "Value":  "Family.Read",
|                                               "DisplayName":  "Read your family info",
|                                               "Description":  "Allows the app to read your family information, members and their basic profile."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "10465720-29dd-4523-a11a-6a75c743c9d9",
|                                               "Value":  "Files.Read",
|                                               "DisplayName":  "Read user files",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s files."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "df85f4d6-205c-4ac5-a5ea-6bf408dba283",
|                                               "Value":  "Files.Read.All",
|                                               "DisplayName":  "Read all files that user can access",
|                                               "Description":  "Allows the app to read all files the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5447fe39-cb82-4c1a-b977-520e67e724eb",
|                                               "Value":  "Files.Read.Selected",
|                                               "DisplayName":  "Read files that the user selects (preview)",
|                                               "Description":  "(Preview) Allows the app to read files that the user selects. The app has access for several hours after the user selects a file."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5c28f0bf-8a70-41f1-8ab2-9032436ddb65",
|                                               "Value":  "Files.ReadWrite",
|                                               "DisplayName":  "Have full access to user files",
|                                               "Description":  "Allows the app to read, create, update and delete the signed-in user\u0027s files."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "863451e7-0667-486c-a5d6-d135439485f0",
|                                               "Value":  "Files.ReadWrite.All",
|                                               "DisplayName":  "Have full access to all files user can access",
|                                               "Description":  "Allows the app to read, create, update and delete all files the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8019c312-3263-48e6-825e-2b833497195b",
|                                               "Value":  "Files.ReadWrite.AppFolder",
|                                               "DisplayName":  "Have full access to the application\u0027s folder (preview)",
|                                               "Description":  "(Preview) Allows the app to read, create, update and delete files in the application\u0027s folder."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "17dde5bd-8c17-420f-a486-969730c1b827",
|                                               "Value":  "Files.ReadWrite.Selected",
|                                               "DisplayName":  "Read and write files that the user selects (preview)",
|                                               "Description":  "(Preview) Allows the app to read and write files that the user selects. The app has access for several hours after the user selects a file."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ef2779dc-ef1b-4211-8310-8a0ac2450081",
|                                               "Value":  "Files.SelectedOperations.Selected",
|                                               "DisplayName":  "Access selected Files, on behalf of the signed-in user",
|                                               "Description":  "Allow the application to access files explicitly permissioned to the application on behalf of the signed in user.  The specific files and the permissions granted will be configured in SharePoint Online or OneDrive."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "527b6d64-cdf5-4b8b-b336-4aa0b8ca2ce5",
|                                               "Value":  "FileStorageContainer.Manage.All",
|                                               "DisplayName":  "Manage all file storage containers",
|                                               "Description":  "Allows the application to utilize the file storage container administration capabilities on behalf of an administrator user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "085ca537-6565-41c2-aca7-db852babc212",
|                                               "Value":  "FileStorageContainer.Selected",
|                                               "DisplayName":  "Access selected file storage containers",
|                                               "Description":  "Allows the application to utilize the file storage container platform to manage containers on behalf of the signed in user. The specific file storage containers and the permissions granted to them will be configured in Microsoft 365 by the developer of each container type."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8e6ec84c-5fcd-4cc7-ac8a-2296efc0ed9b",
|                                               "Value":  "FileStorageContainerType.Manage.All",
|                                               "DisplayName":  "Manage file storage container types on behalf of the signed in user",
|                                               "Description":  "Allows the application to manage file storage container types on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c319a7df-930e-44c0-a43b-7e5e9c7f4f24",
|                                               "Value":  "FileStorageContainerTypeReg.Manage.All",
|                                               "DisplayName":  "Manage file storage container type registrations on behalf of the signed in user",
|                                               "Description":  "Allows the application to manage file storage container type registrations on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d1e4f63a-1569-475c-b9b2-bdc140405e38",
|                                               "Value":  "FileStorageContainerTypeReg.Selected",
|                                               "DisplayName":  "Access selected file storage container type registrations.",
|                                               "Description":  "Allows the application to manage selected file storage container type registrations on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f534bf13-55d4-45a9-8f3c-c92fe64d6131",
|                                               "Value":  "Financials.ReadWrite.All",
|                                               "DisplayName":  "Read and write financials data",
|                                               "Description":  "Allows the app to read and write financials data on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "092211d9-ca1a-427b-813e-b79c7653fe71",
|                                               "Value":  "Goals-Export.Read.All",
|                                               "DisplayName":  "Read all goals and export jobs that a user can access",
|                                               "Description":  "Allows the app to read all goals and export jobs that the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2edeb9fd-4228-480c-a26d-2ed52011cf3d",
|                                               "Value":  "Goals-Export.ReadWrite.All",
|                                               "DisplayName":  "Have full access to all goals and export jobs a user can access",
|                                               "Description":  "Allows the app to read goals, create and read export jobs that the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c92fbbc2-50e0-4842-93ef-385c3293ea3d",
|                                               "Value":  "Group-Conversation.Read.All",
|                                               "DisplayName":  "Read group conversations",
|                                               "Description":  "Allows the app to read group conversations that the signed-in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "302bcbb5-855a-4e49-ae20-94a331b0281e",
|                                               "Value":  "Group-Conversation.ReadWrite.All",
|                                               "DisplayName":  "Read and write group conversations",
|                                               "Description":  "Allows the app to read and write group conversations that the signed-in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "afc507db-8793-4d2f-999d-6e34cff02b7c",
|                                               "Value":  "Group-NestingSupport.ReadWrite.All",
|                                               "DisplayName":  "Read and write groups\u0027 disableNesting property",
|                                               "Description":  "Allows the app to read and write groups\u0027 disableNesting property on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "37e00479-5776-4659-aecf-4841ec5d590a",
|                                               "Value":  "Group-OnPremisesSyncBehavior.ReadWrite.All",
|                                               "DisplayName":  "Read and update the on-premises sync behavior of groups",
|                                               "Description":  "Allows the app to read and update the on-premises sync behavior of groups on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5f8c59db-677d-491f-a6b8-5f174b11ec1d",
|                                               "Value":  "Group.Read.All",
|                                               "DisplayName":  "Read all groups",
|                                               "Description":  "Allows the app to list groups, and to read their properties and all group memberships on behalf of the signed-in user.  Also allows the app to read calendar, conversations, files, and other group content for all groups the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4e46008b-f24c-477d-8fff-7bb4ec7aafe0",
|                                               "Value":  "Group.ReadWrite.All",
|                                               "DisplayName":  "Read and write all groups",
|                                               "Description":  "Allows the app to create groups and read all group properties and memberships on behalf of the signed-in user.  Additionally allows group owners to manage their groups and allows group members to update group content."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bc024368-1153-4739-b217-4326f2e966d0",
|                                               "Value":  "GroupMember.Read.All",
|                                               "DisplayName":  "Read group memberships",
|                                               "Description":  "Allows the app to list groups, read basic group properties and read membership of all groups the signed-in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f81125ac-d3b7-4573-a3b2-7099cc39df9e",
|                                               "Value":  "GroupMember.ReadWrite.All",
|                                               "DisplayName":  "Read and write group memberships",
|                                               "Description":  "Allows the app to list groups, read basic properties, read and update the membership of the groups the signed-in user has access to. Group properties and owners cannot be updated and groups cannot be deleted."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2eb2bc92-94ef-4c6b-b4ab-2a09bc975e0e",
|                                               "Value":  "GroupSettings.Read.All",
|                                               "DisplayName":  "Read all group settings that user can access",
|                                               "Description":  "Allows the app to read a list of tenant-level or group-specific group settings objects, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c1691a6d-99e2-4cfa-b4b5-9e4d67dc0f36",
|                                               "Value":  "GroupSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write all group settings that user can access",
|                                               "Description":  "Allows the app to create, read, update, and delete on the list of tenant-level or group-specific group settings objects that you have access to in the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "74b4ff32-4917-4536-a66d-38a4861e6220",
|                                               "Value":  "HealthMonitoringAlert.Read.All",
|                                               "DisplayName":  "Read all scenario health monitoring alerts",
|                                               "Description":  "Allows the app to read all scenario health monitoring alerts"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b7c60f27-2195-4d5f-96a7-6b98bdfd9664",
|                                               "Value":  "HealthMonitoringAlert.ReadWrite.All",
|                                               "DisplayName":  "Read and write all scenario monitoring alerts",
|                                               "Description":  "Allows the app to read and write all scenario monitoring alerts, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fb873030-8626-47e6-96ff-8a5bff3b725f",
|                                               "Value":  "HealthMonitoringAlertConfig.Read.All",
|                                               "DisplayName":  "Read all scenario health monitoring alert configurations",
|                                               "Description":  "Allows the app to read all scenario health monitoring alert configurations"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b3e5ebc6-1c23-4337-8286-3f27165addb4",
|                                               "Value":  "HealthMonitoringAlertConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write all scenario monitoring alert configurations.",
|                                               "Description":  "Allows the app to read and write all scenario monitoring alert configurations, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "43781733-b5a7-4d1b-98f4-e8edff23e1a9",
|                                               "Value":  "IdentityProvider.Read.All",
|                                               "DisplayName":  "Read identity providers",
|                                               "Description":  "Allows the app to read your organization’s identity (authentication) providers’ properties on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f13ce604-1677-429f-90bd-8a10b9f01325",
|                                               "Value":  "IdentityProvider.ReadWrite.All",
|                                               "DisplayName":  "Read and write identity providers",
|                                               "Description":  "Allows the app to read and write your organization’s identity (authentication) providers’ properties on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8f6a01e7-0391-4ee5-aa22-a3af122cef27",
|                                               "Value":  "IdentityRiskEvent.Read.All",
|                                               "DisplayName":  "Read identity risk event information",
|                                               "Description":  "Allows the app to read identity risk event information for all users in your organization on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9e4862a5-b68f-479e-848a-4e07e25c9916",
|                                               "Value":  "IdentityRiskEvent.ReadWrite.All",
|                                               "DisplayName":  "Read and write risk event information",
|                                               "Description":  "Allows the app to read and update identity risk event information for all users in your organization on behalf of the signed-in user. Update operations include confirming risk event detections. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3215c57f-3faa-4295-95c2-6f14a5bc6124",
|                                               "Value":  "IdentityRiskyAgent.Read.All",
|                                               "DisplayName":  "Read risky agents information",
|                                               "Description":  "Allows the app to read risky agents information in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d343bdeb-db6a-4e06-97da-9dafc2d61c60",
|                                               "Value":  "IdentityRiskyAgent.ReadWrite.All",
|                                               "DisplayName":  "Read and write risky agents information",
|                                               "Description":  "Allows the app to read and update identity risky agents information for all agents in your organization on behalf of the signed-in user. Update operations include dismissing risky agents."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ea5c4ab0-5a73-4f35-8272-5d5337884e5d",
|                                               "Value":  "IdentityRiskyServicePrincipal.Read.All",
|                                               "DisplayName":  "Read all identity risky service principal information",
|                                               "Description":  "Allows the app to read all identity risky service principal information for your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bb6f654c-d7fd-4ae3-85c3-fc380934f515",
|                                               "Value":  "IdentityRiskyServicePrincipal.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity risky service principal information",
|                                               "Description":  "Allows the app to read and update identity risky service principal information for all service principals in your organization, on behalf of the signed-in user. Update operations include dismissing risky service principals."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d04bb851-cb7c-4146-97c7-ca3e71baf56c",
|                                               "Value":  "IdentityRiskyUser.Read.All",
|                                               "DisplayName":  "Read identity risky user information",
|                                               "Description":  "Allows the app to read identity risky user information for all users in your organization on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e0a7cdbb-08b0-4697-8264-0069786e9674",
|                                               "Value":  "IdentityRiskyUser.ReadWrite.All",
|                                               "DisplayName":  "Read and write risky user information",
|                                               "Description":  "Allows the app to read and update identity risky user information for all users in your organization on behalf of the signed-in user. Update operations include dismissing risky users."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2903d63d-4611-4d43-99ce-a33f3f52e343",
|                                               "Value":  "IdentityUserFlow.Read.All",
|                                               "DisplayName":  "Read all identity user flows",
|                                               "Description":  "Allows the app to read your organization\u0027s user flows, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "281892cc-4dbf-4e3a-b6cc-b21029bb4e82",
|                                               "Value":  "IdentityUserFlow.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity user flows",
|                                               "Description":  "Allows the app to read or write your organization\u0027s user flows, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "652390e4-393a-48de-9484-05f9b1212954",
|                                               "Value":  "IMAP.AccessAsUser.All",
|                                               "DisplayName":  "Read and write access to mailboxes via IMAP.",
|                                               "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via IMAP protocol."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d19c0de5-7ecb-4aba-b090-da35ebcd5425",
|                                               "Value":  "IndustryData-DataConnector.Read.All",
|                                               "DisplayName":  "View data connector definitions",
|                                               "Description":  "Allows the app to read data connectors on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5ce933ac-3997-4280-aed0-cc072e5c062a",
|                                               "Value":  "IndustryData-DataConnector.ReadWrite.All",
|                                               "DisplayName":  "Manage data connector definitions",
|                                               "Description":  "Allows the app to read and write data connectors on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fc47391d-ab2c-410f-9059-5600f7af660d",
|                                               "Value":  "IndustryData-DataConnector.Upload",
|                                               "DisplayName":  "Upload files to a data connector",
|                                               "Description":  "Allows the app to upload data files to a data connector on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cb0774da-a605-42af-959c-32f438fb38f4",
|                                               "Value":  "IndustryData-InboundFlow.Read.All",
|                                               "DisplayName":  "View inbound flow definitions",
|                                               "Description":  "Allows the app to read inbound data flows on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "97044676-2cec-40ee-bd70-38df444c9e70",
|                                               "Value":  "IndustryData-InboundFlow.ReadWrite.All",
|                                               "DisplayName":  "Manage inbound flow definitions",
|                                               "Description":  "Allows the app to read and write inbound data flows on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4741a003-8952-4be4-9217-33a0ac327122",
|                                               "Value":  "IndustryData-OutboundFlow.Read.All",
|                                               "DisplayName":  "View outbound flow definitions",
|                                               "Description":  "Allows the app to read outbound data flows on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "aeb68e0b-e562-4a1f-b6dd-3484ad0cbb4b",
|                                               "Value":  "IndustryData-OutboundFlow.ReadWrite.All",
|                                               "DisplayName":  "Manage outbound flow definitions",
|                                               "Description":  "Allows the app to read and write outbound data flows on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a3f96ffe-cb84-40a8-ac85-582d7ef97c2a",
|                                               "Value":  "IndustryData-ReferenceDefinition.Read.All",
|                                               "DisplayName":  "View reference definitions",
|                                               "Description":  "Allows the app to read reference definitions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a757d430-be6d-430f-af57-28aabe79d247",
|                                               "Value":  "IndustryData-ReferenceDefinition.ReadWrite.All",
|                                               "DisplayName":  "Manage reference definitions",
|                                               "Description":  "Allows the app to read and write reference definitions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "92685235-50c4-4702-b2c8-36043db6fa79",
|                                               "Value":  "IndustryData-Run.Read.All",
|                                               "DisplayName":  "View current and previous runs",
|                                               "Description":  "Allows the app to read current and previous IndustryData runs on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f03a6d0e-0989-460f-80b2-e57c8561763e",
|                                               "Value":  "IndustryData-Run.Start",
|                                               "DisplayName":  "View and start runs",
|                                               "Description":  "Allows the app to view and start IndustryData runs on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "49b7016c-89ae-41e7-bd6f-b7170c5490bf",
|                                               "Value":  "IndustryData-SourceSystem.Read.All",
|                                               "DisplayName":  "View source system definitions",
|                                               "Description":  "Allows the app to read source system definitions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9599f005-05d6-4ea7-b1b1-4929768af5d0",
|                                               "Value":  "IndustryData-SourceSystem.ReadWrite.All",
|                                               "DisplayName":  "Manage source system definitions",
|                                               "Description":  "Allows the app to read and write source system definitions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c9d51f28-8ccd-42b2-a836-fd8fe9ebf2ae",
|                                               "Value":  "IndustryData-TimePeriod.Read.All",
|                                               "DisplayName":  "Read time period definitions",
|                                               "Description":  "Allows the app to read time period definitions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b6d56528-3032-4f9d-830f-5a24a25e6661",
|                                               "Value":  "IndustryData-TimePeriod.ReadWrite.All",
|                                               "DisplayName":  "Manage time period definitions",
|                                               "Description":  "Allows the app to read and write time period definitions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "60382b96-1f5e-46ea-a544-0407e489e588",
|                                               "Value":  "IndustryData.ReadBasic.All",
|                                               "DisplayName":  "Read basic Industry Data service and resource definitions",
|                                               "Description":  "Allows the app to read basic Industry Data service and resource information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "12f4bffb-b598-413c-984b-db99728f8b54",
|                                               "Value":  "InformationProtectionConfig.Read",
|                                               "DisplayName":  "Read configurations for protecting organizational data applicable to the user",
|                                               "Description":  "Allows the app to read the configurations applicable to the signed-in user for protecting organizational data, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4ad84827-5578-4e18-ad7a-86530b12f884",
|                                               "Value":  "InformationProtectionPolicy.Read",
|                                               "DisplayName":  "Read user sensitivity labels and label policies.",
|                                               "Description":  "Allows an app to read information protection sensitivity labels and label policy settings, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7d249730-51a3-4180-8ec1-214f144f1bff",
|                                               "Value":  "Insights-UserMetric.Read.All",
|                                               "DisplayName":  "Read user metrics insights",
|                                               "Description":  "Allows an app to read user metrics insights, such as daily and monthly active users, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ac08cdae-e845-41db-adf9-5899a0ec9ef6",
|                                               "Value":  "LearningAssignedCourse.Read",
|                                               "DisplayName":  "Read user\u0027s assignments",
|                                               "Description":  "Allows the app to read data for the learner\u0027s assignments in the organization\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ea4c1fd9-6a9f-4432-8e5d-86e06cc0da77",
|                                               "Value":  "LearningContent.Read.All",
|                                               "DisplayName":  "Read learning content",
|                                               "Description":  "Allows the app to read learning content in the organization\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "53cec1c4-a65f-4981-9dc1-ad75dbf1c077",
|                                               "Value":  "LearningContent.ReadWrite.All",
|                                               "DisplayName":  "Manage learning content",
|                                               "Description":  "Allows the app to manage learning content in the organization\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dd8ce36f-9245-45ea-a99e-8ac398c22861",
|                                               "Value":  "LearningProvider.Read",
|                                               "DisplayName":  "Read learning provider",
|                                               "Description":  "Allows the app to read data for the learning provider in the organization\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "40c2eb57-abaf-49f5-9331-e90fd01f7130",
|                                               "Value":  "LearningProvider.ReadWrite",
|                                               "DisplayName":  "Manage learning provider",
|                                               "Description":  "Allows the app to create, update, read, and delete data for the learning provider in the organization\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f6403ef7-4a96-47be-a190-69ba274c3f11",
|                                               "Value":  "LearningSelfInitiatedCourse.Read",
|                                               "DisplayName":  "Read user\u0027s self-initiated courses",
|                                               "Description":  "Allows the app to read data for the learner\u0027s self-initiated courses in the organization\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f395577a-0960-456b-979f-7228de0c5996",
|                                               "Value":  "LicenseAssignment.Read.All",
|                                               "DisplayName":  "Read all license assignments.",
|                                               "Description":  "Allows an app to read license assignments for users and groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f55016cc-149c-447e-8f21-7cf3ec1d6350",
|                                               "Value":  "LicenseAssignment.ReadWrite.All",
|                                               "DisplayName":  "Manage all license assignments",
|                                               "Description":  "Allows an app to manage license assignments for users and groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2973a298-1d69-4f87-8d30-7025f0ec19d7",
|                                               "Value":  "LifecycleWorkflows-CustomExt.Read.All",
|                                               "DisplayName":  "Read all Lifecycle workflows custom task extensions",
|                                               "Description":  "Allows the app to read all Lifecycle workflows custom task extensions on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ef6bafb1-3019-4a22-a332-103aff92225f",
|                                               "Value":  "LifecycleWorkflows-CustomExt.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Lifecycle workflows custom task extensions",
|                                               "Description":  "Allows the app to create, update, list, read and delete all Lifecycle workflows custom task extensions on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4d3d7f81-163f-426a-8432-5638d2e82083",
|                                               "Value":  "LifecycleWorkflows-Reports.Read.All",
|                                               "DisplayName":  "Read all Lifecycle workflows reports",
|                                               "Description":  "Allows the app to read all Lifecycle workflows reports on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "df1c25b3-072c-45cd-8403-c63441e4cca1",
|                                               "Value":  "LifecycleWorkflows-Workflow.Activate",
|                                               "DisplayName":  "Run workflows on-demand in Lifecycle workflows",
|                                               "Description":  "Allows the app to run workflows on-demand on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7fabe5bd-2e47-4e61-b924-327117024e18",
|                                               "Value":  "LifecycleWorkflows-Workflow.Read.All",
|                                               "DisplayName":  "Read all workflows in Lifecycle workflows",
|                                               "Description":  "Allows the app to list and read all workflows and tasks on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "789c445d-433c-4575-a1fc-367a58a1bd4a",
|                                               "Value":  "LifecycleWorkflows-Workflow.ReadBasic.All",
|                                               "DisplayName":  "List all workflows in Lifecycle workflows",
|                                               "Description":  "Allows the app to list all workflows on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "29e49f0c-a053-4cc5-a4b1-7da0c8c1e643",
|                                               "Value":  "LifecycleWorkflows-Workflow.ReadWrite.All",
|                                               "DisplayName":  "Read and write all workflows in Lifecycle workflows",
|                                               "Description":  "Allows the app to create, update, list, read and delete all workflows and tasks in lifecycle workflows on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9bcb9916-765a-42af-bf77-02282e26b01a",
|                                               "Value":  "LifecycleWorkflows.Read.All",
|                                               "DisplayName":  "Read all lifecycle workflows resources",
|                                               "Description":  "Allows the app to list and read all workflows, tasks and related lifecycle workflows resources on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "84b9d731-7db8-4454-8c90-fd9e95350179",
|                                               "Value":  "LifecycleWorkflows.ReadWrite.All",
|                                               "DisplayName":  "Read and write all lifecycle workflows resources",
|                                               "Description":  "Allows the app to create, update, list, read and delete all workflows, tasks and related lifecycle workflows resources on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d6d361b3-211a-4191-9fa7-15f72de4aac4",
|                                               "Value":  "ListItems.SelectedOperations.Selected",
|                                               "DisplayName":  "Access selected ListItems, on behalf of the signed-in user",
|                                               "Description":  "Allow the application to access a subset of listitems on behalf of the signed in user.  The specific listitems and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "033b51ee-d6fa-4add-b627-ee680c7212b5",
|                                               "Value":  "Lists.SelectedOperations.Selected",
|                                               "DisplayName":  "Access selected Lists, on behalf of the signed-in user",
|                                               "Description":  "Allow the application to access a subset of lists on behalf of the signed in user.  The specific lists and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f3af82f6-18e0-4a41-8dc8-a03c11854a8d",
|                                               "Value":  "Mail-Advanced.ReadWrite",
|                                               "DisplayName":  "Read and write the user\u0027s mail, including modifying existing non-draft mails",
|                                               "Description":  "Allows the app to create, read, update, and delete email, including contents of non-draft emails in user mailboxes, on behalf of the signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bebf0bb6-2ff3-4295-a17d-f3561da294fb",
|                                               "Value":  "Mail-Advanced.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write all mail the user can access, including modifying existing non-draft mails",
|                                               "Description":  "Allows the app to create, read, update, and delete mail including contents of non-draft emails for all mails a user has permission to access, on behalf of the signed-in user. This includes their own and shared mail. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "570282fd-fa5c-430d-a7fd-fc8dc98a9dca",
|                                               "Value":  "Mail.Read",
|                                               "DisplayName":  "Read user mail ",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s mailbox."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7b9103a5-4610-446b-9670-80643382c1fa",
|                                               "Value":  "Mail.Read.Shared",
|                                               "DisplayName":  "Read user and shared mail",
|                                               "Description":  "Allows the app to read mail a user can access, including their own and shared mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a4b8392a-d8d1-4954-a029-8e668a39a170",
|                                               "Value":  "Mail.ReadBasic",
|                                               "DisplayName":  "Read user basic mail",
|                                               "Description":  "Allows the app to read email in the signed-in user\u0027s mailbox except body, previewBody, attachments and any extended properties."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b11fa0e7-fdb7-4dc9-b1f1-59facd463480",
|                                               "Value":  "Mail.ReadBasic.Shared",
|                                               "DisplayName":  "Read user and shared basic mail",
|                                               "Description":  "Allows the app to read mail the signed-in user can access, including their own and shared mail, except for body, bodyPreview, uniqueBody, attachments, extensions, and any extended properties."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "024d486e-b451-40bb-833d-3e66d98c5c73",
|                                               "Value":  "Mail.ReadWrite",
|                                               "DisplayName":  "Read and write access to user mail ",
|                                               "Description":  "Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5df07973-7d5d-46ed-9847-1271055cbd51",
|                                               "Value":  "Mail.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write user and shared mail",
|                                               "Description":  "Allows the app to create, read, update, and delete mail a user has permission to access, including their own and shared mail. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e383f46e-2787-4529-855e-0e479a3ffac0",
|                                               "Value":  "Mail.Send",
|                                               "DisplayName":  "Send mail as a user ",
|                                               "Description":  "Allows the app to send mail as users in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a367ab51-6b49-43bf-a716-a1fb06d2a174",
|                                               "Value":  "Mail.Send.Shared",
|                                               "DisplayName":  "Send mail on behalf of others",
|                                               "Description":  "Allows the app to send mail as the signed-in user, including sending on-behalf of others."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dce2e6fc-0f4b-40da-94e2-14b4477f3d92",
|                                               "Value":  "MailboxConfigItem.Read",
|                                               "DisplayName":  "Read user\u0027s UserConfiguration objects",
|                                               "Description":  "Allows the app to read user\u0027s UserConfiguration objects, on behalf of the the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7d461784-7715-4b09-9f90-91a6d8722652",
|                                               "Value":  "MailboxConfigItem.ReadWrite",
|                                               "DisplayName":  "Read and write user\u0027s UserConfiguration objects",
|                                               "Description":  "Allows the app to create, read, update and delete user\u0027s UserConfiguration objects, on behalf of the the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "52dc2051-4958-4636-8f2a-281d39c6981c",
|                                               "Value":  "MailboxFolder.Read",
|                                               "DisplayName":  "Read a user\u0027s mailbox folders",
|                                               "Description":  "Allows the app to read the user\u0027s mailbox folders, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "077fde41-7e0b-4c5b-bcd1-e9d743a30c80",
|                                               "Value":  "MailboxFolder.ReadWrite",
|                                               "DisplayName":  "Read and write a user\u0027s mailbox folders",
|                                               "Description":  "Allows the app to read and write the user\u0027s mailbox folders, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "58d3e7fa-3ce9-4a0c-9baa-0971f64709d9",
|                                               "Value":  "MailboxItem.Export",
|                                               "DisplayName":  "Export a user\u0027s mailbox items",
|                                               "Description":  "Allows the app to export the user\u0027s mailbox items, on behalf of the the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "df96e8a0-f4e1-4ecf-8d83-a429f822cbd6",
|                                               "Value":  "MailboxItem.ImportExport",
|                                               "DisplayName":  "Allows the app to perform backup and restore of mailbox items",
|                                               "Description":  "Allows the app to backup, restore, and modify mailbox items on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "82305458-296d-4edd-8b0b-74dd74c34526",
|                                               "Value":  "MailboxItem.Read",
|                                               "DisplayName":  "Read a user\u0027s mailbox items",
|                                               "Description":  "Allows the app to read the user\u0027s mailbox items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "87f447af-9fa4-4c32-9dfa-4a57a73d18ce",
|                                               "Value":  "MailboxSettings.Read",
|                                               "DisplayName":  "Read user mailbox settings",
|                                               "Description":  "Allows the app to the read user\u0027s mailbox settings. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "818c620a-27a9-40bd-a6a5-d96f7d610b4b",
|                                               "Value":  "MailboxSettings.ReadWrite",
|                                               "DisplayName":  "Read and write user mailbox settings",
|                                               "Description":  "Allows the app to create, read, update, and delete user\u0027s mailbox settings. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4776cae1-54bd-4dfd-823c-e5861ed49a98",
|                                               "Value":  "MailTips.ReadBasic.Shared",
|                                               "DisplayName":  "Read mail tips for mailboxes you can access",
|                                               "Description":  "Allows the app to read mail tips on behalf of the signed-in user for mailboxes they have access to. Mail tips include automatic replies, mailbox status, custom tips, and delivery information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dc34164e-6c4a-41a0-be89-3ae2fbad7cd3",
|                                               "Value":  "ManagedTenants.Read.All",
|                                               "DisplayName":  "Read all managed tenant information",
|                                               "Description":  "Allows the app to read all managed tenant information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b31fa710-c9b3-4d9e-8f5e-8036eecddab9",
|                                               "Value":  "ManagedTenants.ReadWrite.All",
|                                               "DisplayName":  "Read and write all managed tenant information",
|                                               "Description":  "Allows the app to read and write all managed tenant information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f6a3db3e-f7e8-4ed2-a414-557c8c9830be",
|                                               "Value":  "Member.Read.Hidden",
|                                               "DisplayName":  "Read hidden memberships",
|                                               "Description":  "Allows the app to read the memberships of hidden groups and administrative units on behalf of the signed-in user, for those hidden groups and administrative units that the signed-in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "526aa72a-5878-49fe-bf4e-357973af9b06",
|                                               "Value":  "MultiTenantOrganization.Read.All",
|                                               "DisplayName":  "Read multi-tenant organization details and tenants",
|                                               "Description":  "Allows the app to read multi-tenant organization details and tenants on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "225db56b-15b2-4daa-acb3-0eec2bbe4849",
|                                               "Value":  "MultiTenantOrganization.ReadBasic.All",
|                                               "DisplayName":  "Read multi-tenant organization basic details and active tenants",
|                                               "Description":  "Allows the app to read multi-tenant organization basic details and active tenants on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "77af1528-84f3-4023-8d90-d219cd433108",
|                                               "Value":  "MultiTenantOrganization.ReadWrite.All",
|                                               "DisplayName":  "Read and write multi-tenant organization details and tenants",
|                                               "Description":  "Allows the app to read and write multi-tenant organization details and tenants on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "51ae584e-e736-4718-897b-10af70f8e3cc",
|                                               "Value":  "MutualTlsOauthConfiguration.Read.All",
|                                               "DisplayName":  "Read all configurations used for mutual-TLS client authentication.",
|                                               "Description":  "Allows the app to read configuration used for OAuth 2.0 mutual-TLS client authentication, on behalf of the signed-in user. This includes reading trusted certificate authorities."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a51115bc-f64f-498f-bcee-00dcd28f4a03",
|                                               "Value":  "MutualTlsOauthConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write all configurations used for mutual-TLS client authentication.",
|                                               "Description":  "Allows the app to read and update configuration used for OAuth 2.0 mutual-TLS client authentication, on behalf of the signed-in user. This includes adding and updating trusted certificate authorities."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b0c61509-cfc3-42bd-9bd4-66d81785fee4",
|                                               "Value":  "NetworkAccess-Reports.Read.All",
|                                               "DisplayName":  "Read all network access reports",
|                                               "Description":  "Allows the app to read all network access reports on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2f7013e0-ab4e-447f-a5e1-5d419950692d",
|                                               "Value":  "NetworkAccess.Read.All",
|                                               "DisplayName":  "Read all network access information",
|                                               "Description":  "Allows the app to read all network access information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ae2df9c5-f18d-4ec4-a51b-bdeb807f177b",
|                                               "Value":  "NetworkAccess.ReadWrite.All",
|                                               "DisplayName":  "Read and write all network access information",
|                                               "Description":  "Allows the app to read and write all network access information and configuration settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4051c7fc-b429-4804-8d80-8f1f8c24a6f7",
|                                               "Value":  "NetworkAccessBranch.Read.All",
|                                               "DisplayName":  "Read properties of branches for network access",
|                                               "Description":  "Allows the app to read your organization\u0027s branches for network access on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b8a36cc2-b810-461a-baa4-a7281e50bd5c",
|                                               "Value":  "NetworkAccessBranch.ReadWrite.All",
|                                               "DisplayName":  "Read and write properties of branches for network access",
|                                               "Description":  "Allows the app to read and write your organization\u0027s branches for network access on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ba22922b-752c-446f-89d7-a2d92398fceb",
|                                               "Value":  "NetworkAccessPolicy.Read.All",
|                                               "DisplayName":  "Read security and routing policies for network access",
|                                               "Description":  "Allows the app to read your organization\u0027s security and routing network access policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b1fbad0f-ef6e-42ed-8676-bca7fa3e7291",
|                                               "Value":  "NetworkAccessPolicy.ReadWrite.All",
|                                               "DisplayName":  "Read and write security and routing policies for network access",
|                                               "Description":  "Allows the app to read and write your organization\u0027s security and routing network access policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9d822255-d64d-4b7a-afdb-833b9a97ed02",
|                                               "Value":  "Notes.Create",
|                                               "DisplayName":  "Create user OneNote notebooks",
|                                               "Description":  "Allows the app to read the titles of OneNote notebooks and sections and to create new pages, notebooks, and sections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "371361e4-b9e2-4a3f-8315-2a301a3b0a3d",
|                                               "Value":  "Notes.Read",
|                                               "DisplayName":  "Read user OneNote notebooks",
|                                               "Description":  "Allows the app to read OneNote notebooks on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dfabfca6-ee36-4db2-8208-7a28381419b3",
|                                               "Value":  "Notes.Read.All",
|                                               "DisplayName":  "Read all OneNote notebooks that user can access",
|                                               "Description":  "Allows the app to read OneNote notebooks that the signed-in user has access to in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "615e26af-c38a-4150-ae3e-c3b0d4cb1d6a",
|                                               "Value":  "Notes.ReadWrite",
|                                               "DisplayName":  "Read and write user OneNote notebooks",
|                                               "Description":  "Allows the app to read, share, and modify OneNote notebooks on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "64ac0503-b4fa-45d9-b544-71a463f05da0",
|                                               "Value":  "Notes.ReadWrite.All",
|                                               "DisplayName":  "Read and write all OneNote notebooks that user can access",
|                                               "Description":  "Allows the app to read, share, and modify OneNote notebooks that the signed-in user has access to in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ed68249d-017c-4df5-9113-e684c7f8760b",
|                                               "Value":  "Notes.ReadWrite.CreatedByApp",
|                                               "DisplayName":  "Limited notebook access (deprecated)",
|                                               "Description":  "This is deprecated!  Do not use! This permission no longer has any effect. You can safely consent to it. No additional privileges will be granted to the app."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "89497502-6e42-46a2-8cb2-427fd3df970a",
|                                               "Value":  "Notifications.ReadWrite.CreatedByApp",
|                                               "DisplayName":  "Deliver and manage user notifications for this app",
|                                               "Description":  "Allows the app to deliver its notifications on behalf of signed-in users. Also allows the app to read, update, and delete the user\u0027s notification items for this app."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7427e0e9-2fba-42fe-b0c0-848c9e6a8182",
|                                               "Value":  "offline_access",
|                                               "DisplayName":  "Maintain access to data you have given it access to",
|                                               "Description":  "Allows the app to see and update the data you gave it access to, even when users are not currently using the app. This does not give the app any additional permissions."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "166741d6-eeb8-46fe-91f4-817d2af7bc88",
|                                               "Value":  "OnlineMeetingAiInsight.Read.All",
|                                               "DisplayName":  "Read all AI Insights for online meetings.",
|                                               "Description":  "Allows the app to read all AI Insights for online meetings, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "110e5abb-a10c-4b59-8b55-9b4daa4ef743",
|                                               "Value":  "OnlineMeetingArtifact.Read.All",
|                                               "DisplayName":  "Read user\u0027s online meeting artifacts",
|                                               "Description":  "Allows the app to read online meeting artifacts on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "190c2bb6-1fdd-4fec-9aa2-7d571b5e1fe3",
|                                               "Value":  "OnlineMeetingRecording.Read.All",
|                                               "DisplayName":  "Read all recordings of online meetings.",
|                                               "Description":  "Allows the app to read all recordings of online meetings, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9be106e1-f4e3-4df5-bdff-e4bc531cbe43",
|                                               "Value":  "OnlineMeetings.Read",
|                                               "DisplayName":  "Read user\u0027s online meetings",
|                                               "Description":  "Allows the app to read online meeting details on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a65f2972-a4f8-4f5e-afd7-69ccb046d5dc",
|                                               "Value":  "OnlineMeetings.ReadWrite",
|                                               "DisplayName":  "Read and create user\u0027s online meetings",
|                                               "Description":  "Allows the app to read and create online meetings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "30b87d18-ebb1-45db-97f8-82ccb1f0190c",
|                                               "Value":  "OnlineMeetingTranscript.Read.All",
|                                               "DisplayName":  "Read all transcripts of online meetings.",
|                                               "Description":  "Allows the app to read all transcripts of online meetings, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f6609722-4100-44eb-b747-e6ca0536989d",
|                                               "Value":  "OnPremDirectorySynchronization.Read.All",
|                                               "DisplayName":  "Read all on-premises directory synchronization information",
|                                               "Description":  "Allows the app to read all on-premises directory synchronization information for the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c2d95988-7604-4ba1-aaed-38a5f82a51c7",
|                                               "Value":  "OnPremDirectorySynchronization.ReadWrite.All",
|                                               "DisplayName":  "Read and write all on-premises directory synchronization information",
|                                               "Description":  "Allows the app to read and write all on-premises directory synchronization information for the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8c4d5184-71c2-4bf8-bb9d-bc3378c9ad42",
|                                               "Value":  "OnPremisesPublishingProfiles.ReadWrite.All",
|                                               "DisplayName":  "Manage on-premises published resources",
|                                               "Description":  "Allows the app to manage hybrid identity service configuration by creating, viewing, updating and deleting on-premises published resources, on-premises agents and agent groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "37f7f235-527c-4136-accd-4a02d197296e",
|                                               "Value":  "openid",
|                                               "DisplayName":  "Sign users in",
|                                               "Description":  "Allows users to sign in to the app with their work or school accounts and allows the app to see basic user profile information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4908d5b9-3fb2-4b1e-9336-1888b7937185",
|                                               "Value":  "Organization.Read.All",
|                                               "DisplayName":  "Read organization information",
|                                               "Description":  "Allows the app to read the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed skus and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "46ca0847-7e6b-426e-9775-ea810a948356",
|                                               "Value":  "Organization.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization information",
|                                               "Description":  "Allows the app to read and write the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed skus and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9082f138-6f02-4f3a-9f4d-5f3c2ce5c688",
|                                               "Value":  "OrganizationalBranding.Read.All",
|                                               "DisplayName":  "Read organizational branding information",
|                                               "Description":  "Allows the app to read the organizational branding information, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "15ce63de-b141-4c9a-a9a5-241bf27c6aaf",
|                                               "Value":  "OrganizationalBranding.ReadWrite.All",
|                                               "DisplayName":  "Read and write organizational branding information",
|                                               "Description":  "Allows the app to read and write the organizational branding information, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "08432d1b-5911-483c-86df-7980af5cdee0",
|                                               "Value":  "OrgContact.Read.All",
|                                               "DisplayName":  "Read organizational contacts",
|                                               "Description":  "Allows the app to read all organizational contacts on behalf of the signed-in user.  These contacts are managed by the organization and are different from a user\u0027s personal contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1e9b7a7e-4d64-44ff-acf5-2e9651c1519f",
|                                               "Value":  "OrgSettings-AppsAndServices.Read.All",
|                                               "DisplayName":  "Read organization-wide apps and services settings",
|                                               "Description":  "Allows the app to read organization-wide apps and services settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c167b0e7-47c0-48e8-9eee-9892f58018fa",
|                                               "Value":  "OrgSettings-AppsAndServices.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide apps and services settings",
|                                               "Description":  "Allows the app to read and write organization-wide apps and services settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9862d930-5aec-4a98-8d4f-7277a8db9bcb",
|                                               "Value":  "OrgSettings-DynamicsVoice.Read.All",
|                                               "DisplayName":  "Read organization-wide Dynamics customer voice settings",
|                                               "Description":  "Allows the app to read organization-wide Dynamics customer voice settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4cea26fb-6967-4234-82c4-c044414743f8",
|                                               "Value":  "OrgSettings-DynamicsVoice.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Dynamics customer voice settings",
|                                               "Description":  "Allows the app to read and write organization-wide Dynamics customer voice settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "210051a0-1ffc-435c-ae76-02d226d05752",
|                                               "Value":  "OrgSettings-Forms.Read.All",
|                                               "DisplayName":  "Read organization-wide Microsoft Forms settings",
|                                               "Description":  "Allows the app to read organization-wide Microsoft Forms settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "346c19ff-3fb2-4e81-87a0-bac9e33990c1",
|                                               "Value":  "OrgSettings-Forms.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Microsoft Forms settings",
|                                               "Description":  "Allows the app to read and write organization-wide Microsoft Forms settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8cbdb9f6-9c2e-451a-814d-ec606e5d0212",
|                                               "Value":  "OrgSettings-Microsoft365Install.Read.All",
|                                               "DisplayName":  "Read organization-wide Microsoft 365 apps installation settings",
|                                               "Description":  "Allows the app to read organization-wide Microsoft 365 apps installation settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1ff35e91-19eb-42d8-aa2d-cc9891127ae5",
|                                               "Value":  "OrgSettings-Microsoft365Install.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Microsoft 365 apps installation settings",
|                                               "Description":  "Allows the app to read and write organization-wide Microsoft 365 apps installation settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7ff96f41-f022-45ba-acd8-ef3f03063d6b",
|                                               "Value":  "OrgSettings-Todo.Read.All",
|                                               "DisplayName":  "Read organization-wide Microsoft To Do settings",
|                                               "Description":  "Allows the app to read organization-wide Microsoft To Do settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "087502c2-5263-433e-abe3-8f77231a0627",
|                                               "Value":  "OrgSettings-Todo.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Microsoft To Do settings",
|                                               "Description":  "Allows the app to read and write organization-wide Microsoft To Do settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8804798e-5934-4e30-8ce3-ef88257cecd4",
|                                               "Value":  "PartnerBilling.Read.All",
|                                               "DisplayName":  "Read all billing data for your company\u0027s tenant",
|                                               "Description":  "Allows the app to read all of billing data from Microsoft for your company\u0027s tenant, on behalf of the signed-in user. This includes reading billed and unbilled Usage and Invoice reconciliation data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5567b981-0bf1-4796-9038-0648b46e116d",
|                                               "Value":  "PartnerSecurity.Read.All",
|                                               "DisplayName":  "Read security alerts of customer with CSP relationship",
|                                               "Description":  "Allows the app to read security alerts of customer with CSP relationship on behalf of the partner signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0cd2c1f6-94a1-4075-ab8c-0b1aff2e1ad5",
|                                               "Value":  "PartnerSecurity.ReadWrite.All",
|                                               "DisplayName":  "Read security alerts and update status of security alerts of customer with CSP relationship",
|                                               "Description":  "Allows the app to read security alerts and update status of alerts of customer with CSP relationship on behalf of the partner signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d88fd3fb-53d3-4c1c-8c39-787fcac2ed7a",
|                                               "Value":  "PendingExternalUserProfile.Read.All",
|                                               "DisplayName":  "Read pending external user profiles",
|                                               "Description":  "Allows the app to read available properties of pending external user profiles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "93a1fb28-c908-4826-904e-0c74ad352b73",
|                                               "Value":  "PendingExternalUserProfile.ReadWrite.All",
|                                               "DisplayName":  "Read and write pending external user profiles",
|                                               "Description":  "Allows the app to read and write available properties of pending external user profiles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ba47897c-39ec-4d83-8086-ee8256fa737d",
|                                               "Value":  "People.Read",
|                                               "DisplayName":  "Read users\u0027 relevant people lists",
|                                               "Description":  "Allows the app to read a ranked list of relevant people of the signed-in user. The list includes local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype)."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b89f9189-71a5-4e70-b041-9887f0bc7e4a",
|                                               "Value":  "People.Read.All",
|                                               "DisplayName":  "Read all users\u0027 relevant people lists",
|                                               "Description":  "Allows the app to read a scored list of relevant people of the signed-in user or other users in the signed-in user\u0027s organization. The list can include local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype)."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ec762c5f-388b-4b16-8693-ac1efbc611bc",
|                                               "Value":  "PeopleSettings.Read.All",
|                                               "DisplayName":  "Read tenant-wide people settings",
|                                               "Description":  "Allows the application to read tenant-wide people settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e67e6727-c080-415e-b521-e3f35d5248e9",
|                                               "Value":  "PeopleSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write tenant-wide people settings",
|                                               "Description":  "Allows the application to read and write tenant-wide people settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cb8f45a0-5c2e-4ea1-b803-84b870a7d7ec",
|                                               "Value":  "Place.Read.All",
|                                               "DisplayName":  "Read all company places",
|                                               "Description":  "Allows the app to read your company\u0027s places (conference rooms and room lists) for calendar events and other applications, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4c06a06a-098a-4063-868e-5dfee3827264",
|                                               "Value":  "Place.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization places",
|                                               "Description":  "Allows the app to manage organization places (conference rooms and room lists) for calendar events and other applications, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4c7f93d2-6b0b-4e05-91aa-87842f0a2142",
|                                               "Value":  "PlaceDevice.Read.All",
|                                               "DisplayName":  "Read all workplace devices",
|                                               "Description":  "Allows the app to read all workplace devices, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eafd6a71-e95a-4f8a-bb6e-fb84ab7fbd9e",
|                                               "Value":  "PlaceDevice.ReadWrite.All",
|                                               "DisplayName":  "Read and write all workplace devices",
|                                               "Description":  "Allows the app to read and write all workplace devices, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "572fea84-0151-49b2-9301-11cb16974376",
|                                               "Value":  "Policy.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s policies",
|                                               "Description":  "Allows the app to read your organization\u0027s policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a6ff13ac-1851-4993-8ca9-a671d70de2d5",
|                                               "Value":  "Policy.Read.AuthenticationMethod",
|                                               "DisplayName":  "Read authentication method policies",
|                                               "Description":  "Allows the app to read the authentication method policies, on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4b293250-121d-4cb4-acc7-5280438c18a6",
|                                               "Value":  "Policy.Read.B2BManagementPolicy",
|                                               "DisplayName":  "Read your organization\u0027s B2BManagement policies",
|                                               "Description":  "Allows the app to read your organization\u0027s B2BManagement policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "633e0fce-8c58-4cfb-9495-12bbd5a24f7c",
|                                               "Value":  "Policy.Read.ConditionalAccess",
|                                               "DisplayName":  "Read your organization\u0027s conditional access policies",
|                                               "Description":  "Allows the app to read your organization\u0027s conditional access policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3616a4b0-6746-49c4-a678-4c237599074d",
|                                               "Value":  "Policy.Read.DeviceConfiguration",
|                                               "DisplayName":  "Read your organization\u0027s device configuration policies",
|                                               "Description":  "Allows the app to read your organization\u0027s device configuration policies on behalf of the signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d146432f-b803-4ed4-8d42-ba74193a6ede",
|                                               "Value":  "Policy.Read.IdentityProtection",
|                                               "DisplayName":  "Read your organization’s identity protection policy",
|                                               "Description":  "Allows the app to read your organization’s identity protection policy on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "414de6ea-2d92-462f-b120-6e2a809a6d01",
|                                               "Value":  "Policy.Read.PermissionGrant",
|                                               "DisplayName":  "Read consent and permission grant policies",
|                                               "Description":  "Allows the app to read policies related to consent and permission grants for applications, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4f5bc9c8-ea54-4772-973a-9ca119cb0409",
|                                               "Value":  "Policy.ReadWrite.AccessReview",
|                                               "DisplayName":  "Read and write your organization\u0027s directory access review default policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s directory access review default policy on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b27add92-efb2-4f16-84f5-8108ba77985c",
|                                               "Value":  "Policy.ReadWrite.ApplicationConfiguration",
|                                               "DisplayName":  "Read and write your organization\u0027s application configuration policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s application configuration policies on behalf of the signed-in user.  This includes policies such as activityBasedTimeoutPolicy, claimsMappingPolicy, homeRealmDiscoveryPolicy,  tokenIssuancePolicy and tokenLifetimePolicy."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "edb72de9-4252-4d03-a925-451deef99db7",
|                                               "Value":  "Policy.ReadWrite.AuthenticationFlows",
|                                               "DisplayName":  "Read and write authentication flow policies",
|                                               "Description":  "Allows the app to read and write the authentication flow policies, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7e823077-d88e-468f-a337-e18f1f0e6c7c",
|                                               "Value":  "Policy.ReadWrite.AuthenticationMethod",
|                                               "DisplayName":  "Read and write authentication method policies",
|                                               "Description":  "Allows the app to read and write the authentication method policies, on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "edd3c878-b384-41fd-95ad-e7407dd775be",
|                                               "Value":  "Policy.ReadWrite.Authorization",
|                                               "DisplayName":  "Read and write your organization\u0027s authorization policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s authorization policy on behalf of the signed-in user.  For example, authorization policies can control some of the permissions that the out-of-the-box user role has by default."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "723c4a0c-85b0-4a02-bb2a-c9eb07959de9",
|                                               "Value":  "Policy.ReadWrite.B2BManagementPolicy",
|                                               "DisplayName":  "Read and write your organization\u0027s B2BManagement policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s B2BManagement policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ad902697-1014-4ef5-81ef-2b4301988e8c",
|                                               "Value":  "Policy.ReadWrite.ConditionalAccess",
|                                               "DisplayName":  "Read and write your organization\u0027s conditional access policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s conditional access policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4d135e65-66b8-41a8-9f8b-081452c91774",
|                                               "Value":  "Policy.ReadWrite.ConsentRequest",
|                                               "DisplayName":  "Read and write consent request policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s consent requests policy on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "014b43d0-6ed4-4fc6-84dc-4b6f7bae7d85",
|                                               "Value":  "Policy.ReadWrite.CrossTenantAccess",
|                                               "DisplayName":  "Read and write your organization\u0027s cross tenant access policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s cross-tenant access policies and configuration for automatic user consent settings to suppress consent prompts for users of the other tenant on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9ef7463f-1d39-406f-89ea-3483a4645e1c",
|                                               "Value":  "Policy.ReadWrite.CrossTenantCapability",
|                                               "DisplayName":  "Read and write your organization\u0027s M365 cross tenant access capabilities",
|                                               "Description":  "Allows the app to read and write your organization\u0027s M365 cross tenant access capabilities on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "40b534c3-9552-4550-901b-23879c90bcf9",
|                                               "Value":  "Policy.ReadWrite.DeviceConfiguration",
|                                               "DisplayName":  "Read and write your organization\u0027s device configuration policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s device configuration policies on behalf of the signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b5219784-1215-45b5-b3f1-88fe1081f9c0",
|                                               "Value":  "Policy.ReadWrite.ExternalIdentities",
|                                               "DisplayName":  "Read and write your organization\u0027s external identities policy",
|                                               "Description":  "Allows the application to read and update the organization\u0027s external identities policy on behalf of the signed-in user.  For example, external identities policy controls if users invited to access resources in your organization via B2B collaboration or B2B direct connect are allowed to self-service leave."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "92a38652-f13b-4875-bc77-6e1dbb63e1b2",
|                                               "Value":  "Policy.ReadWrite.FeatureRollout",
|                                               "DisplayName":  "Read and write your organization\u0027s feature rollout policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s feature rollout policies on behalf of the signed-in user. Includes abilities to assign and remove users and groups to rollout of a specific feature."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "be1be369-4540-4ac9-8928-79de99f70d8f",
|                                               "Value":  "Policy.ReadWrite.FedTokenValidation",
|                                               "DisplayName":  "Read and write your organization\u0027s federated token validation policy",
|                                               "Description":  "Allows the application to read and update the organization\u0027s federated token validation policy on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7256e131-3efb-4323-9854-cf41c6021770",
|                                               "Value":  "Policy.ReadWrite.IdentityProtection",
|                                               "DisplayName":  "Read and write your organization’s identity protection policy ",
|                                               "Description":  "Allows the app to read and write your organization’s identity protection policy on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a8ead177-1889-4546-9387-f25e658e2a79",
|                                               "Value":  "Policy.ReadWrite.MobilityManagement",
|                                               "DisplayName":  "Read and write your organization\u0027s mobility management policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s mobility management policies on behalf of the signed-in user.  For example, a mobility management policy can set the enrollment scope for a given mobility management application."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2672f8bb-fd5e-42e0-85e1-ec764dd2614e",
|                                               "Value":  "Policy.ReadWrite.PermissionGrant",
|                                               "DisplayName":  "Manage consent and permission grant policies",
|                                               "Description":  "Allows the app to manage policies related to consent and permission grants for applications, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0b2a744c-2abf-4f1e-ad7e-17a087e2be99",
|                                               "Value":  "Policy.ReadWrite.SecurityDefaults",
|                                               "DisplayName":  "Read and write your organization\u0027s security defaults policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s security defaults policy on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cefba324-1a70-4a6e-9c1d-fd670b7ae392",
|                                               "Value":  "Policy.ReadWrite.TrustFramework",
|                                               "DisplayName":  "Read and write your organization\u0027s trust framework policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s trust framework policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d7b7f2d9-0f45-4ea1-9d42-e50810c06991",
|                                               "Value":  "POP.AccessAsUser.All",
|                                               "DisplayName":  "Read and write access to mailboxes via POP.",
|                                               "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via POP protocol."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "76bc735e-aecd-4a1d-8b4c-2b915deabb79",
|                                               "Value":  "Presence.Read",
|                                               "DisplayName":  "Read user\u0027s presence information",
|                                               "Description":  "Allows the app to read presence information on behalf of the signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9c7a330d-35b3-4aa1-963d-cb2b9f927841",
|                                               "Value":  "Presence.Read.All",
|                                               "DisplayName":  "Read presence information of all users in your organization",
|                                               "Description":  "Allows the app to read presence information of all users in the directory on behalf of the signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8d3c54a7-cf58-4773-bf81-c0cd6ad522bb",
|                                               "Value":  "Presence.ReadWrite",
|                                               "DisplayName":  "Read and write a user\u0027s presence information",
|                                               "Description":  "Allows the app to read the presence information and write activity and availability on behalf of the signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d69c2d6d-4f72-4f99-a6b9-663e32f8cf68",
|                                               "Value":  "PrintConnector.Read.All",
|                                               "DisplayName":  "Read print connectors",
|                                               "Description":  "Allows the application to read print connectors on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "79ef9967-7d59-4213-9c64-4b10687637d8",
|                                               "Value":  "PrintConnector.ReadWrite.All",
|                                               "DisplayName":  "Read and write print connectors",
|                                               "Description":  "Allows the application to read and write print connectors on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "90c30bed-6fd1-4279-bf39-714069619721",
|                                               "Value":  "Printer.Create",
|                                               "DisplayName":  "Register printers  ",
|                                               "Description":  "Allows the application to create (register) printers on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "93dae4bd-43a1-4a23-9a1a-92957e1d9121",
|                                               "Value":  "Printer.FullControl.All",
|                                               "DisplayName":  "Register, read, update, and unregister printers",
|                                               "Description":  "Allows the application to create (register), read, update, and delete (unregister) printers on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3a736c8a-018e-460a-b60c-863b2683e8bf",
|                                               "Value":  "Printer.Read.All",
|                                               "DisplayName":  "Read printers",
|                                               "Description":  "Allows the application to read printers on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "89f66824-725f-4b8f-928e-e1c5258dc565",
|                                               "Value":  "Printer.ReadWrite.All",
|                                               "DisplayName":  "Read and update printers",
|                                               "Description":  "Allows the application to read and update printers on behalf of the signed-in user. Does not allow creating (registering) or deleting (unregistering) printers."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ed11134d-2f3f-440d-a2e1-411efada2502",
|                                               "Value":  "PrinterShare.Read.All",
|                                               "DisplayName":  "Read printer shares",
|                                               "Description":  "Allows the application to read printer shares on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5fa075e9-b951-4165-947b-c63396ff0a37",
|                                               "Value":  "PrinterShare.ReadBasic.All",
|                                               "DisplayName":  "Read basic information about printer shares",
|                                               "Description":  "Allows the application to read basic information about printer shares on behalf of the signed-in user. Does not allow reading access control information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "06ceea37-85e2-40d7-bec3-91337a46038f",
|                                               "Value":  "PrinterShare.ReadWrite.All",
|                                               "DisplayName":  "Read and write printer shares",
|                                               "Description":  "Allows the application to read and update printer shares on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "21f0d9c0-9f13-48b3-94e0-b6b231c7d320",
|                                               "Value":  "PrintJob.Create",
|                                               "DisplayName":  "Create print jobs",
|                                               "Description":  "Allows the application to create print jobs on behalf of the signed-in user and upload document content to print jobs that the signed-in user created."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "248f5528-65c0-4c88-8326-876c7236df5e",
|                                               "Value":  "PrintJob.Read",
|                                               "DisplayName":  "Read user\u0027s print jobs",
|                                               "Description":  "Allows the application to read the metadata and document content of print jobs that the signed-in user created."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "afdd6933-a0d8-40f7-bd1a-b5d778e8624b",
|                                               "Value":  "PrintJob.Read.All",
|                                               "DisplayName":  "Read print jobs",
|                                               "Description":  "Allows the application to read the metadata and document content of print jobs on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6a71a747-280f-4670-9ca0-a9cbf882b274",
|                                               "Value":  "PrintJob.ReadBasic",
|                                               "DisplayName":  "Read basic information of user\u0027s print jobs",
|                                               "Description":  "Allows the application to read the metadata of print jobs that the signed-in user created. Does not allow access to print job document content."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "04ce8d60-72ce-4867-85cf-6d82f36922f3",
|                                               "Value":  "PrintJob.ReadBasic.All",
|                                               "DisplayName":  "Read basic information of print jobs",
|                                               "Description":  "Allows the application to read the metadata of print jobs on behalf of the signed-in user. Does not allow access to print job document content."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b81dd597-8abb-4b3f-a07a-820b0316ed04",
|                                               "Value":  "PrintJob.ReadWrite",
|                                               "DisplayName":  "Read and write user\u0027s print jobs",
|                                               "Description":  "Allows the application to read and update the metadata and document content of print jobs that the signed-in user created."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "036b9544-e8c5-46ef-900a-0646cc42b271",
|                                               "Value":  "PrintJob.ReadWrite.All",
|                                               "DisplayName":  "Read and write print jobs",
|                                               "Description":  "Allows the application to read and update the metadata and document content of print jobs on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6f2d22f2-1cb6-412c-a17c-3336817eaa82",
|                                               "Value":  "PrintJob.ReadWriteBasic",
|                                               "DisplayName":  "Read and write basic information of user\u0027s print jobs",
|                                               "Description":  "Allows the application to read and update the metadata of print jobs that the signed-in user created. Does not allow access to print job document content."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3a0db2f6-0d2a-4c19-971b-49109b19ad3d",
|                                               "Value":  "PrintJob.ReadWriteBasic.All",
|                                               "DisplayName":  "Read and write basic information of print jobs",
|                                               "Description":  "Allows the application to read and update the metadata of print jobs on behalf of the signed-in user. Does not allow access to print job document content."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "490f32fd-d90f-4dd7-a601-ff6cdc1a3f6c",
|                                               "Value":  "PrintSettings.Read.All",
|                                               "DisplayName":  "Read tenant-wide print settings",
|                                               "Description":  "Allows the application to read tenant-wide print settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9ccc526a-c51c-4e5c-a1fd-74726ef50b8f",
|                                               "Value":  "PrintSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write tenant-wide print settings",
|                                               "Description":  "Allows the application to read and write tenant-wide print settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bc04fe80-7e6a-4154-8b8f-d1e3465613bf",
|                                               "Value":  "PrivilegedAccess-CustomExt.Read.All",
|                                               "DisplayName":  "Read Privileged Access (PIM) custom extensions",
|                                               "Description":  "Allows the app to read Privileged Access (PIM) custom extensions for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "157efa76-20fd-4db4-876e-90c049322467",
|                                               "Value":  "PrivilegedAccess-CustomExt.ReadWrite.All",
|                                               "DisplayName":  "Read and write Privileged Access (PIM) custom extensions",
|                                               "Description":  "Allows the app to read and write Privileged Access (PIM) custom extensions for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b3a539c9-59cb-4ad5-825a-041ddbdc2bdb",
|                                               "Value":  "PrivilegedAccess.Read.AzureAD",
|                                               "DisplayName":  "Read privileged access to Azure AD",
|                                               "Description":  "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d329c81c-20ad-4772-abf9-3f6fdb7e5988",
|                                               "Value":  "PrivilegedAccess.Read.AzureADGroup",
|                                               "DisplayName":  "Read privileged access to Azure AD groups",
|                                               "Description":  "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1d89d70c-dcac-4248-b214-903c457af83a",
|                                               "Value":  "PrivilegedAccess.Read.AzureResources",
|                                               "DisplayName":  "Read privileged access to Azure resources",
|                                               "Description":  "Allows the app to read time-based assignment and just-in-time elevation of Azure resources (like your subscriptions, resource groups, storage, compute) on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3c3c74f5-cdaa-4a97-b7e0-4e788bfcfb37",
|                                               "Value":  "PrivilegedAccess.ReadWrite.AzureAD",
|                                               "DisplayName":  "Read and write privileged access to Azure AD",
|                                               "Description":  "Allows the app to request and manage just in time elevation (including scheduled elevation) of users to Azure AD built-in administrative roles, on behalf of signed-in users."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "32531c59-1f32-461f-b8df-6f8a3b89f73b",
|                                               "Value":  "PrivilegedAccess.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read and write privileged access to Azure AD groups",
|                                               "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a84a9652-ffd3-496e-a991-22ba5529156a",
|                                               "Value":  "PrivilegedAccess.ReadWrite.AzureResources",
|                                               "DisplayName":  "Read and write privileged access to Azure resources",
|                                               "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation of user privileges to manage Azure resources (like subscriptions, resource groups, storage, compute) on behalf of the signed-in users."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "02a32cc4-7ab5-4b58-879a-0586e0f7c495",
|                                               "Value":  "PrivilegedAssignmentSchedule.Read.AzureADGroup",
|                                               "DisplayName":  "Read assignment schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d5767d44-e1c1-4fc7-8fb1-7daa58df022a",
|                                               "Value":  "PrivilegedAssignmentSchedule.Read.EntraAppRole",
|                                               "DisplayName":  "Read assignment schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "06dbc45d-6708-4ef0-a797-f797ee68bf4b",
|                                               "Value":  "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read, create, and delete assignment schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read, create, and delete time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e07122a7-d275-4a27-a2f5-eb62349edae0",
|                                               "Value":  "PrivilegedAssignmentSchedule.ReadWrite.EntraAppRole",
|                                               "DisplayName":  "Read, create, and delete assignment schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read, create, and delete time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ca5fe595-68ff-4dfd-907d-4509501a0e49",
|                                               "Value":  "PrivilegedAssignmentSchedule.Remove.AzureADGroup",
|                                               "DisplayName":  "Delete assignment schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to delete time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8f44f93d-ecef-46ae-a9bf-338508d44d6b",
|                                               "Value":  "PrivilegedEligibilitySchedule.Read.AzureADGroup",
|                                               "DisplayName":  "Read eligibility schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9b9eb231-5483-4f3c-89e9-9d5048dafe9d",
|                                               "Value":  "PrivilegedEligibilitySchedule.Read.EntraAppRole",
|                                               "DisplayName":  "Read eligibility schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ba974594-d163-484e-ba39-c330d5897667",
|                                               "Value":  "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read, create, and delete eligibility schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read, create, and delete time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f7ff1cb0-e255-4bb3-b24a-6708c60c5418",
|                                               "Value":  "PrivilegedEligibilitySchedule.ReadWrite.EntraAppRole",
|                                               "DisplayName":  "Read, create, and delete eligibility schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read, create, and delete time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c5ea9ab4-9b41-4c09-a400-53e652fb5096",
|                                               "Value":  "PrivilegedEligibilitySchedule.Remove.AzureADGroup",
|                                               "DisplayName":  "Delete eligibility schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to delete time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "14dad69e-099b-42c9-810b-d002981feec1",
|                                               "Value":  "profile",
|                                               "DisplayName":  "View users\u0027 basic profile",
|                                               "Description":  "Allows the app to see your users\u0027 basic profile (e.g., name, picture, user name, email address)"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "469cd065-729e-4dee-b1fa-d92e0fab6310",
|                                               "Value":  "ProfilePhoto.Read.All",
|                                               "DisplayName":  "Read profile photo of a user or group",
|                                               "Description":  "Allows the app to read all profile photos of users and groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f5b24df7-511e-48bb-ae88-643f023b55e1",
|                                               "Value":  "ProfilePhoto.ReadWrite.All",
|                                               "DisplayName":  "Read and write profile photo of a user or group",
|                                               "Description":  "Allows the app to read and write all profile photos of users and groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c492a2e1-2f8f-4caa-b076-99bbf6e40fe4",
|                                               "Value":  "ProgramControl.Read.All",
|                                               "DisplayName":  "Read all programs that user can access",
|                                               "Description":  "Allows the app to read programs and program controls that the signed-in user has access to in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "50fd364f-9d93-4ae1-b170-300e87cccf84",
|                                               "Value":  "ProgramControl.ReadWrite.All",
|                                               "DisplayName":  "Manage all programs that user can access",
|                                               "Description":  "Allows the app to read, update, delete and perform actions on programs and program controls that the signed-in user has access to in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "98f5a27a-539a-48bc-a597-f78e9e1e76bf",
|                                               "Value":  "ProtectionScopes.Compute.All",
|                                               "DisplayName":  "Compute Purview policies at tenant scope",
|                                               "Description":  "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for all users across tenant."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4fc04d16-a9fc-4c5e-8da4-79b6c33638a4",
|                                               "Value":  "ProtectionScopes.Compute.User",
|                                               "DisplayName":  "Compute Purview policies for an individual user",
|                                               "Description":  "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for an individual user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "95aec97b-cf27-4a8d-a67d-42f60b5b38ef",
|                                               "Value":  "ProvisioningLog.Read.All",
|                                               "DisplayName":  "Read provisioning log data",
|                                               "Description":  "Allows the app to read and query your provisioning log activities, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "04a4b2a2-3f26-4fc8-87ee-9c46e68db175",
|                                               "Value":  "PublicKeyInfrastructure.Read.All",
|                                               "DisplayName":  "Read certificate based authentication configurations",
|                                               "Description":  "Allows the application to read certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3591b7f3-dba8-4bad-b667-7a64bd4f2b83",
|                                               "Value":  "PublicKeyInfrastructure.ReadWrite.All",
|                                               "DisplayName":  "Read and write certificate based authentication configurations",
|                                               "Description":  "Allows the application to read  and write certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f73fa04f-b9a5-4df9-8843-993ce928925e",
|                                               "Value":  "QnA.Read.All",
|                                               "DisplayName":  "Read all Questions and Answers that the user can access.",
|                                               "Description":  "Allows an app to read all question and answer sets that the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "db5d5bae-0c9e-444e-9390-8a5fea98c253",
|                                               "Value":  "RealTimeActivityFeed.Read.All",
|                                               "DisplayName":  "Access real-time enriched data in a meeting",
|                                               "Description":  "Allows the app to get direct access to real-time enriched data in a meeting, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "07f995eb-fc67-4522-ad66-2b8ca8ea3efd",
|                                               "Value":  "RecordsManagement.Read.All",
|                                               "DisplayName":  "Read Records Management configuration, labels, and policies",
|                                               "Description":  "Allows the application to read any data from Records Management, such as configuration, labels, and policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f2833d75-a4e6-40ab-86d4-6dfe73c97605",
|                                               "Value":  "RecordsManagement.ReadWrite.All",
|                                               "DisplayName":  "Read and write Records Management configuration, labels, and policies",
|                                               "Description":  "Allow the application to create, update and delete any data from Records Management, such as configuration, labels, and policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "02e97553-ed7b-43d0-ab3c-f8bace0d040c",
|                                               "Value":  "Reports.Read.All",
|                                               "DisplayName":  "Read all usage reports",
|                                               "Description":  "Allows an app to read all service usage reports on behalf of the signed-in user.  Services that provide usage reports include Office 365 and Azure Active Directory."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "84fac5f4-33a9-4100-aa38-a20c6d29e5e7",
|                                               "Value":  "ReportSettings.Read.All",
|                                               "DisplayName":  "Read admin report settings",
|                                               "Description":  "Allows the app to read admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b955410e-7715-4a88-a940-dfd551018df3",
|                                               "Value":  "ReportSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write admin report settings",
|                                               "Description":  "Allows the app to read and update admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cb530fca-534b-4e72-aa74-bca7e8bbd06f",
|                                               "Value":  "ResourceSpecificPermissionGrant.ReadForChat",
|                                               "DisplayName":  "Read resource specific permissions granted on a chat",
|                                               "Description":  "Allows the app to read the resource specific permissions granted on the chat, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eafad40c-bf7a-415a-b7f8-acdf5706b58f",
|                                               "Value":  "ResourceSpecificPermissionGrant.ReadForTeam",
|                                               "DisplayName":  "Read resource specific permissions granted on a team",
|                                               "Description":  "Allows the app to read the resource specific permissions granted on the team, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f1d91a8f-88e7-4774-8401-b668d5bca0c5",
|                                               "Value":  "ResourceSpecificPermissionGrant.ReadForUser",
|                                               "DisplayName":  "Read resource specific permissions granted on a user account",
|                                               "Description":  "Allows the app to read the resource specific permissions granted on a user account, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e197c06f-ae7b-4398-b0a2-89f76ebca159",
|                                               "Value":  "RiskPreventionProviders.Read.All",
|                                               "DisplayName":  "Read all identity risk prevention providers",
|                                               "Description":  "Allows the app to read your organization\u0027s risk prevention providers, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2a7babba-9623-4109-bc9c-79728cf3bb4f",
|                                               "Value":  "RiskPreventionProviders.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity risk prevention providers",
|                                               "Description":  "Allows the app to read and write your organization\u0027s risk prevention providers, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "344a729c-0285-42c6-9014-f12b9b8d6129",
|                                               "Value":  "RoleAssignmentSchedule.Read.Directory",
|                                               "DisplayName":  "Read all active role assignments for your company\u0027s directory",
|                                               "Description":  "Allows the app to read the active role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user. This includes reading directory role templates, and directory roles."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8c026be3-8e26-4774-9372-8d5d6f21daff",
|                                               "Value":  "RoleAssignmentSchedule.ReadWrite.Directory",
|                                               "DisplayName":  "Read, update, and delete all active role assignments for your company\u0027s directory",
|                                               "Description":  "Allows the app to read and manage the active role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user. This includes managing active directory role membership, and reading directory role templates, directory roles and active memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f71cd05c-3fdb-4568-aef2-e1cf62ee20d4",
|                                               "Value":  "RoleAssignmentSchedule.Remove.Directory",
|                                               "DisplayName":  "Delete all active role assignments for your company\u0027s directory",
|                                               "Description":  "Allows the app to delete the active role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eb0788c2-6d4e-4658-8c9e-c0fb8053f03d",
|                                               "Value":  "RoleEligibilitySchedule.Read.Directory",
|                                               "DisplayName":  "Read all eligible role assignments for your company\u0027s directory",
|                                               "Description":  "Allows the app to read the eligible role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user. This includes reading directory role templates, and directory roles."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "62ade113-f8e0-4bf9-a6ba-5acb31db32fd",
|                                               "Value":  "RoleEligibilitySchedule.ReadWrite.Directory",
|                                               "DisplayName":  "Read, update, and delete  all eligible role assignments for your company\u0027s directory",
|                                               "Description":  "Allows the app to read and manage the eligible role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user. This includes managing eligible directory role membership, and reading directory role templates, directory roles and eligible memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "58ac4fa2-b484-4d6e-ba97-beee2a574220",
|                                               "Value":  "RoleEligibilitySchedule.Remove.Directory",
|                                               "DisplayName":  "Delete all eligible role assignments for your company\u0027s directory",
|                                               "Description":  "Allows the app to delete the eligible role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "48fec646-b2ba-4019-8681-8eb31435aded",
|                                               "Value":  "RoleManagement.Read.All",
|                                               "DisplayName":  "Read role management data for all RBAC providers",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for all RBAC providers, on behalf of the signed-in user.  This includes reading role definitions and role assignments."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9619b88a-8a25-48a7-9571-d23be0337a79",
|                                               "Value":  "RoleManagement.Read.CloudPC",
|                                               "DisplayName":  "Read Cloud PC RBAC settings",
|                                               "Description":  "Allows the app to read the Cloud PC role-based access control (RBAC) settings, on behalf of the signed-in user.  This includes reading Cloud PC role definitions and role assignments."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dd689728-6eb8-4deb-bd38-2924a935f3de",
|                                               "Value":  "RoleManagement.Read.Defender",
|                                               "DisplayName":  "Read M365 Defender RBAC configuration",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, on behalf of the signed-in user. This includes reading M365 Defender role definitions and role assignments."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "741c54c3-0c1e-44a1-818b-3f97ab4e8c83",
|                                               "Value":  "RoleManagement.Read.Directory",
|                                               "DisplayName":  "Read directory RBAC settings",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, on behalf of the signed-in user.  This includes reading directory role templates, directory roles and memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3bc15058-7858-4141-b24f-ae43b4e80b52",
|                                               "Value":  "RoleManagement.Read.Exchange",
|                                               "DisplayName":  "Read Exchange Online RBAC configuration",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for your organization\u0027s Exchange Online service, on behalf of the signed-in user. This includes reading Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "501d06f8-07b8-4f18-b5c6-c191a4af7a82",
|                                               "Value":  "RoleManagement.ReadWrite.CloudPC",
|                                               "DisplayName":  "Read and write Cloud PC RBAC settings",
|                                               "Description":  "Allows the app to read and manage the Cloud PC role-based access control (RBAC) settings, on behalf of the signed-in user. This includes reading and managing Cloud PC role definitions and role assignments."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d8914f8f-9f64-4bd1-b4d3-f5a701ed8457",
|                                               "Value":  "RoleManagement.ReadWrite.Defender",
|                                               "DisplayName":  "Read M365 Defender RBAC configuration",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, on behalf of the signed-in user. This includes reading M365 Defender role definitions and role assignments."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d01b97e9-cbc0-49fe-810a-750afd5527a3",
|                                               "Value":  "RoleManagement.ReadWrite.Directory",
|                                               "DisplayName":  "Read and write directory RBAC settings",
|                                               "Description":  "Allows the app to read and manage the role-based access control (RBAC) settings for your company\u0027s directory, on behalf of the signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c1499fe0-52b1-4b22-bed2-7a244e0e879f",
|                                               "Value":  "RoleManagement.ReadWrite.Exchange",
|                                               "DisplayName":  "Read and write Exchange Online RBAC configuration",
|                                               "Description":  "Allows the app to read and manage the role-based access control (RBAC) settings for your organization\u0027s Exchange Online service, on behalf of the signed-in user. This includes reading, creating, updating, and deleting Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cce71173-f76d-446e-97ff-efb2d82e11b1",
|                                               "Value":  "RoleManagementAlert.Read.Directory",
|                                               "DisplayName":  "Read all alert data for your company\u0027s directory",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) alerts for your company\u0027s directory, on behalf of the signed-in user. This includes reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "435644c6-a5b1-40bf-8f52-fe8e5b53e19c",
|                                               "Value":  "RoleManagementAlert.ReadWrite.Directory",
|                                               "DisplayName":  "Read all alert data, configure alerts, and take actions on all alerts for your company\u0027s directory",
|                                               "Description":  "Allows the app to read and manage the role-based access control (RBAC) alerts for your company\u0027s directory, on behalf of the signed-in user. This includes managing alert settings, initiating alert scans, dismissing alerts, remediating alert incidents, and reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7e26fdff-9cb1-4e56-bede-211fe0e420e8",
|                                               "Value":  "RoleManagementPolicy.Read.AzureADGroup",
|                                               "DisplayName":  "Read all policies in PIM for Groups",
|                                               "Description":  "Allows the app to read policies in Privileged Identity Management for Groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3de2cdbe-0ff5-47d5-bdee-7f45b4749ead",
|                                               "Value":  "RoleManagementPolicy.Read.Directory",
|                                               "DisplayName":  "Read all policies for privileged role assignments of your company\u0027s directory",
|                                               "Description":  "Allows the app to read policies for privileged role-based access control (RBAC) assignments of your company\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8b3ffd3b-178e-4aae-be39-ba87585eddb2",
|                                               "Value":  "RoleManagementPolicy.Read.EntraAppRole",
|                                               "DisplayName":  "Read all policies in PIM for App Roles",
|                                               "Description":  "Allows the app to read policies in Privileged Identity Management for App Roles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0da165c7-3f15-4236-b733-c0b0f6abe41d",
|                                               "Value":  "RoleManagementPolicy.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read, update, and delete all policies in PIM for Groups",
|                                               "Description":  "Allows the app to read, update, and delete policies in Privileged Identity Management for Groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1ff1be21-34eb-448c-9ac9-ce1f506b2a68",
|                                               "Value":  "RoleManagementPolicy.ReadWrite.Directory",
|                                               "DisplayName":  "Read, update, and delete all policies for privileged role assignments of your company\u0027s directory",
|                                               "Description":  "Allows the app to read, update, and delete policies for privileged role-based access control (RBAC) assignments of your company\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "652ec839-e4ac-4eb5-b545-ecc90eeceb2d",
|                                               "Value":  "RoleManagementPolicy.ReadWrite.EntraAppRole",
|                                               "DisplayName":  "Manage all policies in PIM for App Roles",
|                                               "Description":  "Allows the app to manage policies in Privileged Identity Management for App Roles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fccf6dd8-5706-49fa-811f-69e2e1b585d0",
|                                               "Value":  "Schedule.Read.All",
|                                               "DisplayName":  "Read user schedule items",
|                                               "Description":  "Allows the app to read schedule, schedule groups, shifts and associated entities in the Teams or Shifts application on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "63f27281-c9d9-4f29-94dd-6942f7f1feb0",
|                                               "Value":  "Schedule.ReadWrite.All",
|                                               "DisplayName":  "Read and write user schedule items",
|                                               "Description":  "Allows the app to manage schedule, schedule groups, shifts and associated entities in the Teams or Shifts application on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "07919803-6073-4cd8-bc55-28077db0ee10",
|                                               "Value":  "SchedulePermissions.ReadWrite.All",
|                                               "DisplayName":  "Read/Write schedule permissions for a role.",
|                                               "Description":  "Allows the app to read/write schedule permissions for a specific role in Shifts application on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7d307522-aa38-4cd0-bd60-90c6f0ac50bd",
|                                               "Value":  "SearchConfiguration.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s search configuration",
|                                               "Description":  "Allows the app to read search configuration, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b1a7d408-cab0-47d2-a2a5-a74a3733600d",
|                                               "Value":  "SearchConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write your organization\u0027s search configuration",
|                                               "Description":  "Allows the app to read and write search configuration, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1638cddf-07a4-4de2-8645-69c96cacad73",
|                                               "Value":  "SecurityActions.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s security actions",
|                                               "Description":  "Allows the app to read security actions, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dc38509c-b87d-4da0-bd92-6bec988bac4a",
|                                               "Value":  "SecurityActions.ReadWrite.All",
|                                               "DisplayName":  "Read and update your organization\u0027s security actions",
|                                               "Description":  "Allows the app to read or update security actions, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bc257fb8-46b4-4b15-8713-01e91bfbe4ea",
|                                               "Value":  "SecurityAlert.Read.All",
|                                               "DisplayName":  "Read all security alerts",
|                                               "Description":  "Allows the app to read all security alerts, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "471f2a7f-2a42-4d45-a2bf-594d0838070d",
|                                               "Value":  "SecurityAlert.ReadWrite.All",
|                                               "DisplayName":  "Read and write to all security alerts",
|                                               "Description":  "Allows the app to read and write to all security alerts, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "53e6783e-b127-4a35-ab3a-6a52d80a9077",
|                                               "Value":  "SecurityAnalyzedMessage.Read.All",
|                                               "DisplayName":  "Read metadata and detection details for emails in your organization",
|                                               "Description":  "Read email metadata and security detection details on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "48eb8c83-6e58-46e7-a6d3-8805822f5940",
|                                               "Value":  "SecurityAnalyzedMessage.ReadWrite.All",
|                                               "DisplayName":  "Read metadata, detection details, and execute remediation actions on emails in your organization",
|                                               "Description":  "Read email metadata, security detection details, and execute remediation actions like deleting an email, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "84499c31-ac2e-44d3-a0cf-a6c386d4dfe8",
|                                               "Value":  "SecurityCopilotWorkspaces.Read.All",
|                                               "DisplayName":  "Read all Security Copilot resources for the signed-in user",
|                                               "Description":  "Allows the app to read all Security Copilot signed-in user\u0027s resources on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "206291b0-2167-47a7-a640-6cdc1df710ba",
|                                               "Value":  "SecurityCopilotWorkspaces.ReadWrite.All",
|                                               "DisplayName":  "Read and write individually owned Security Copilot resources of the signed-in user",
|                                               "Description":  "Allows the app to read and write Security Copilot resources owned by the signed-in user on their behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "64733abd-851e-478a-bffb-e47a14b18235",
|                                               "Value":  "SecurityEvents.Read.All",
|                                               "DisplayName":  "Read your organization’s security events",
|                                               "Description":  "Allows the app to read your organization’s security events on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6aedf524-7e1c-45a7-bd76-ded8cab8d0fc",
|                                               "Value":  "SecurityEvents.ReadWrite.All",
|                                               "DisplayName":  "Read and update your organization’s security events",
|                                               "Description":  "Allows the app to read your organization’s security events on behalf of the signed-in user. Also allows the app to update editable properties in security events on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3e9ed69a-a48e-473c-8b97-413016703a37",
|                                               "Value":  "SecurityIdentitiesAccount.Read.All",
|                                               "DisplayName":  "Read identity security available identity accounts",
|                                               "Description":  "Allows the app to read all the identity security available identity accounts"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "818229ce-20e4-47bd-92f4-bc94dbb37a56",
|                                               "Value":  "SecurityIdentitiesActions.ReadWrite.All",
|                                               "DisplayName":  "Read and perform identity security available actions",
|                                               "Description":  "Allows the app to read and write identity security available actions on behalf of the signed-in identity."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8ff90903-1ecb-4f3a-b8b2-42120374ecd6",
|                                               "Value":  "SecurityIdentitiesAutoConfig.Read.All",
|                                               "DisplayName":  "Read sensors window auditing configuration",
|                                               "Description":  "Allows the app to read the sensors window auditing configuration of the signed in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b810fdb4-8733-43bd-9b37-fddb7215c69f",
|                                               "Value":  "SecurityIdentitiesAutoConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write sensors window auditing configuration",
|                                               "Description":  "Allows the app to read and write the sensors window auditing configuration of the signed in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a0d0da43-a6df-4416-b63d-99c79991aae8",
|                                               "Value":  "SecurityIdentitiesHealth.Read.All",
|                                               "DisplayName":  "Read identity security health issues",
|                                               "Description":  "Allows the app to read all the identity security health issues of signed user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "53e51eec-2d9b-4990-97f3-c9aa5d5652c3",
|                                               "Value":  "SecurityIdentitiesHealth.ReadWrite.All",
|                                               "DisplayName":  "Read and write identity security health issues",
|                                               "Description":  "Allows the app to read and write identity security health issues on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "63595162-fcc0-4127-8b1e-bfe90b23a10e",
|                                               "Value":  "SecurityIdentitiesMigration.Read.All",
|                                               "DisplayName":  "Read identity security sensor migration",
|                                               "Description":  "Allows the app to read all the identity security sensor migration information of signed user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "741a6ef0-37e6-4b0a-9178-133d94fbc46e",
|                                               "Value":  "SecurityIdentitiesMigration.ReadWrite.All",
|                                               "DisplayName":  "Read and write identity security sensor migration",
|                                               "Description":  "Allows the app to read and write identity security sensor migration on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2c221239-7c5c-4b30-9355-d84663bfcd96",
|                                               "Value":  "SecurityIdentitiesSensors.Read.All",
|                                               "DisplayName":  "Read identity security sensors",
|                                               "Description":  "Allows the app to read all the identity security sensors of signed user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "087c3ad9-c2ca-4b82-9885-d5e25ce9e183",
|                                               "Value":  "SecurityIdentitiesSensors.ReadWrite.All",
|                                               "DisplayName":  "Read and write identity security sensors",
|                                               "Description":  "Allows the app to read and write identity security sensors on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c7d0a939-da1c-4aca-80fa-d0a6cd924801",
|                                               "Value":  "SecurityIdentitiesUserActions.Read.All",
|                                               "DisplayName":  "Read identity security available user actions",
|                                               "Description":  "Allows the app to read all the identity security available user actions of signed user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bf230e97-1957-4df6-b3f6-57f9029eacdf",
|                                               "Value":  "SecurityIdentitiesUserActions.ReadWrite.All",
|                                               "DisplayName":  "Read and perform identity security available user actions",
|                                               "Description":  "Allows the app to read and write identity security available user actions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b9abcc4f-94fc-4457-9141-d20ce80ec952",
|                                               "Value":  "SecurityIncident.Read.All",
|                                               "DisplayName":  "Read incidents",
|                                               "Description":  "Allows the app to read security incidents, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "128ca929-1a19-45e6-a3b8-435ec44a36ba",
|                                               "Value":  "SecurityIncident.ReadWrite.All",
|                                               "DisplayName":  "Read and write to incidents",
|                                               "Description":  "Allows the app to read and write security incidents, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a4633e44-d355-4474-99df-8c2de6b0e39e",
|                                               "Value":  "SensitivityLabel.Evaluate",
|                                               "DisplayName":  "Evaluate sensitivity labels",
|                                               "Description":  "Allow the app to determine if there is any sensitivity label to be applied automatically to the content or recommended to the user for manual application, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a42e3c42-b31e-4919-b699-696dca5dc9e7",
|                                               "Value":  "SensitivityLabel.Evaluate.All",
|                                               "DisplayName":  "Evaluate labels tenant scope.",
|                                               "Description":  "Allows the app to evaluate all sensitivity label."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1aeb73ce-68d7-49b7-913a-eedc80844551",
|                                               "Value":  "SensitivityLabel.Read",
|                                               "DisplayName":  "Get labels user scope.",
|                                               "Description":  "Allows the app to get sensitivity labels."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8b377c27-ea19-4863-a948-8a8588c8f2c3",
|                                               "Value":  "SensitivityLabels.Read.All",
|                                               "DisplayName":  "Get labels app scope.",
|                                               "Description":  "Allows the app to get sensitivity labels."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "df9fd94d-51ff-443d-8f31-ae4dc1b5b8d8",
|                                               "Value":  "SentimentSurvey.Export.All",
|                                               "DisplayName":  "Export all Sentiment Survey",
|                                               "Description":  "Allows the app to export all Sentiment Survey, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1fe7aa48-9373-4a47-8df3-168335e0f4c9",
|                                               "Value":  "ServiceActivity-Exchange.Read.All",
|                                               "DisplayName":  "Read all Exchange service activity",
|                                               "Description":  "Allows the app to read all Exchange service activity, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d74c75b1-d5a9-479d-902d-92f8f99182c1",
|                                               "Value":  "ServiceActivity-Microsoft365Web.Read.All",
|                                               "DisplayName":  "Read all Microsoft 365 Web service activity",
|                                               "Description":  "Allows the app to read all Microsoft 365 Web service activity, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "347e3c16-30f3-4ac7-9b52-fc3c053de9c9",
|                                               "Value":  "ServiceActivity-OneDrive.Read.All",
|                                               "DisplayName":  "Read all One Drive service activity",
|                                               "Description":  "Allows the app to read all One Drive service activity, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "404d76f0-e10e-460a-92be-ef19600c54d1",
|                                               "Value":  "ServiceActivity-Teams.Read.All",
|                                               "DisplayName":  "Read all Teams service activity",
|                                               "Description":  "Allows the app to read all Teams service activity, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "55896846-df78-47a7-aa94-8d3d4442ca7f",
|                                               "Value":  "ServiceHealth.Read.All",
|                                               "DisplayName":  "Read service health",
|                                               "Description":  "Allows the app to read your tenant\u0027s service health information on behalf of the signed-in user. Health information may include service issues or service health overviews."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eda39fa6-f8cf-4c3c-a909-432c683e4c9b",
|                                               "Value":  "ServiceMessage.Read.All",
|                                               "DisplayName":  "Read service announcement messages",
|                                               "Description":  "Allows the app to read your tenant\u0027s service announcement messages on behalf of the signed-in user. Messages may include information about new or changed features."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "636e1b0b-1cc2-4b1c-9aa9-4eeed9b9761b",
|                                               "Value":  "ServiceMessageViewpoint.Write",
|                                               "DisplayName":  "Update user status on service announcement messages",
|                                               "Description":  "Allows the app to update service announcement messages\u0027 user status on behalf of the signed-in user. The message status can be marked as read, archive, or favorite."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9f9ce928-e038-4e3b-8faf-7b59049a8ddc",
|                                               "Value":  "ServicePrincipalEndpoint.Read.All",
|                                               "DisplayName":  "Read service principal endpoints",
|                                               "Description":  "Allows the app to read service principal endpoints"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7297d82c-9546-4aed-91df-3d4f0a9b3ff0",
|                                               "Value":  "ServicePrincipalEndpoint.ReadWrite.All",
|                                               "DisplayName":  "Read and update service principal endpoints",
|                                               "Description":  "Allows the app to update service principal endpoints"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c608c170-08b5-466b-a8fe-0b4074b01613",
|                                               "Value":  "SharePointCrossTenantMigration.Manage.All",
|                                               "DisplayName":  "Read, write and manage SharePoint Cross-Tenant migration settings and tasks",
|                                               "Description":  "Allows the app to read, write and manage your tenant\u0027s SharePoint Cross-Tenant migration settings and tasks, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "00dcb678-f9af-4e73-acb1-4f1657364629",
|                                               "Value":  "SharePointCrossTenantMigration.Read.All",
|                                               "DisplayName":  "Read SharePoint Cross-Tenant migration settings and tasks",
|                                               "Description":  "Allows the app to read your tenant\u0027s SharePoint Cross-Tenant migration settings and tasks, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2ef70e10-5bfd-4ede-a5f6-67720500b258",
|                                               "Value":  "SharePointTenantSettings.Read.All",
|                                               "DisplayName":  "Read SharePoint and OneDrive tenant settings",
|                                               "Description":  "Allows the application to read the tenant-level settings in SharePoint and OneDrive on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "aa07f155-3612-49b8-a147-6c590df35536",
|                                               "Value":  "SharePointTenantSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and change SharePoint and OneDrive tenant settings",
|                                               "Description":  "Allows the application to read and change the tenant-level settings of SharePoint and OneDrive on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "50f66e47-eb56-45b7-aaa2-75057d9afe08",
|                                               "Value":  "ShortNotes.Read",
|                                               "DisplayName":  "Read short notes of the signed-in user",
|                                               "Description":  "Allows the app to read all the short notes a sign-in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "328438b7-4c01-4c07-a840-e625a749bb89",
|                                               "Value":  "ShortNotes.ReadWrite",
|                                               "DisplayName":  "Read, create, edit, and delete short notes of the signed-in user",
|                                               "Description":  "Allows the app to read, create, edit, and delete short notes of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "458e1edc-1e75-438c-8c7b-c32115c9d373",
|                                               "Value":  "SignInIdentifier.Read.All",
|                                               "DisplayName":  "Read SignInIdentifiers",
|                                               "Description":  "Allows the app to read your organization\u0027s sign-in identifiers, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b4673c3c-7b5a-4012-9826-7c7e3c8db6af",
|                                               "Value":  "SignInIdentifier.ReadWrite.All",
|                                               "DisplayName":  "Read and write all sign-in identifiers",
|                                               "Description":  "Allows the app to read and write your organization\u0027s sign-in identifiers, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0e2e68e1-3f32-4e10-9281-f749e097fcbe",
|                                               "Value":  "Sites.Create.All",
|                                               "DisplayName":  "Create Site Collections, on behalf of the signed-in user",
|                                               "Description":  "Allow the application to create site collections on behalf of the signed in user. Upon creation the application will be granted Sites.Selected(delegated) + FullControl to the newly created site."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5a54b8b3-347c-476d-8f8e-42d5c7424d29",
|                                               "Value":  "Sites.FullControl.All",
|                                               "DisplayName":  "Have full control of all site collections",
|                                               "Description":  "Allows the application to have full control of all site collections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "65e50fdc-43b7-4915-933e-e8138f11f40a",
|                                               "Value":  "Sites.Manage.All",
|                                               "DisplayName":  "Create, edit, and delete items and lists in all site collections",
|                                               "Description":  "Allows the application to create or delete document libraries and lists in all site collections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "205e70e5-aba6-4c52-a976-6d2d46c48043",
|                                               "Value":  "Sites.Read.All",
|                                               "DisplayName":  "Read items in all site collections",
|                                               "Description":  "Allows the application to read documents and list  items in all site collections on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "89fe6a52-be36-487e-b7d8-d061c450a026",
|                                               "Value":  "Sites.ReadWrite.All",
|                                               "DisplayName":  "Edit or delete items in all site collections",
|                                               "Description":  "Allows the application to edit or delete documents and list items in all site collections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f89c84ef-20d0-4b54-87e9-02e856d66d53",
|                                               "Value":  "Sites.Selected",
|                                               "DisplayName":  "Access selected Sites, on behalf of the signed-in user",
|                                               "Description":  "Allow the application to access a subset of site collections on behalf of the signed-in user.  The specific site collections and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "258f6531-6087-4cc4-bb90-092c5fb3ed3f",
|                                               "Value":  "SMTP.Send",
|                                               "DisplayName":  "Send emails from mailboxes using SMTP AUTH.",
|                                               "Description":  "Allows the app to be able to send emails from the user’s mailbox using the SMTP AUTH client submission protocol."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9b4aa4b1-aaf3-41b7-b743-698b27e77ff6",
|                                               "Value":  "SpiffeTrustDomain.Read.All",
|                                               "DisplayName":  "Read SPIFFE trust domains and child resources",
|                                               "Description":  "Allows the app to read your organization\u0027s SPIFFE trust domains and child resources on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8ba47079-8c47-4bfe-b2ce-13f28ef37247",
|                                               "Value":  "SpiffeTrustDomain.ReadWrite.All",
|                                               "DisplayName":  "Read and write SPIFFE trust domains and child resources",
|                                               "Description":  "Allows the app to read and write your organization\u0027s SPIFFE trust domains and child resources on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fd1d61cb-4e4b-4d15-a6d2-161348681d84",
|                                               "Value":  "Storyline.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Viva Engage storylines",
|                                               "Description":  "Allows the app to modify the Viva Engage storyline and read all storyline properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9c3af74c-fd0f-4db4-b17a-71939e2a9d77",
|                                               "Value":  "SubjectRightsRequest.Read.All",
|                                               "DisplayName":  "Read subject rights requests",
|                                               "Description":  "Allows the app to read subject rights requests on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2b8fcc74-bce1-4ae3-a0e8-60c53739299d",
|                                               "Value":  "SubjectRightsRequest.ReadWrite.All",
|                                               "DisplayName":  "Read and write subject rights requests",
|                                               "Description":  "Allows the app to read and write subject rights requests on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5f88184c-80bb-4d52-9ff2-757288b2e9b7",
|                                               "Value":  "Subscription.Read.All",
|                                               "DisplayName":  "Read all webhook subscriptions ",
|                                               "Description":  "Allows the app to read all webhook subscriptions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7aa02aeb-824f-4fbe-a3f7-611f751f5b55",
|                                               "Value":  "Synchronization.Read.All",
|                                               "DisplayName":  "Read all Azure AD synchronization data",
|                                               "Description":  "Allows the app to read Azure AD synchronization information, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7bb27fa3-ea8f-4d67-a916-87715b6188bd",
|                                               "Value":  "Synchronization.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Azure AD synchronization data",
|                                               "Description":  "Allows the app to configure the Azure AD synchronization service, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1a2e7420-4e92-4d2b-94cb-fb2952e9ddf7",
|                                               "Value":  "SynchronizationData-User.Upload",
|                                               "DisplayName":  "Upload user data to the identity synchronization service",
|                                               "Description":  "Allows the app to upload bulk user data to the identity synchronization service, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f45671fb-e0fe-4b4b-be20-3d3ce43f1bcb",
|                                               "Value":  "Tasks.Read",
|                                               "DisplayName":  "Read user\u0027s tasks and task lists",
|                                               "Description":  "Allows the app to read the signed-in user’s tasks and task lists, including any shared with the user. Doesn\u0027t include permission to create, delete, or update anything."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "88d21fd4-8e5a-4c32-b5e2-4a1c95f34f72",
|                                               "Value":  "Tasks.Read.Shared",
|                                               "DisplayName":  "Read user and shared tasks",
|                                               "Description":  "Allows the app to read tasks a user has permissions to access, including their own and shared tasks."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2219042f-cab5-40cc-b0d2-16b1540b4c5f",
|                                               "Value":  "Tasks.ReadWrite",
|                                               "DisplayName":  "Create, read, update, and delete user’s tasks and task lists",
|                                               "Description":  "Allows the app to create, read, update, and delete the signed-in user\u0027s tasks and task lists, including any shared with the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c5ddf11b-c114-4886-8558-8a4e557cd52b",
|                                               "Value":  "Tasks.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write user and shared tasks",
|                                               "Description":  "Allows the app to create, read, update, and delete tasks a user has permissions to, including their own and shared tasks."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7825d5d6-6049-4ce7-bdf6-3b8d53f4bcd0",
|                                               "Value":  "Team.Create",
|                                               "DisplayName":  "Create teams",
|                                               "Description":  "Allows the app to create teams on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "485be79e-c497-4b35-9400-0e3fa7f2a5d4",
|                                               "Value":  "Team.ReadBasic.All",
|                                               "DisplayName":  "Read the names and descriptions of teams",
|                                               "Description":  "Read the names and  descriptions of teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2497278c-d82d-46a2-b1ce-39d4cdde5570",
|                                               "Value":  "TeamMember.Read.All",
|                                               "DisplayName":  "Read the members of teams",
|                                               "Description":  "Read the members of teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4a06efd2-f825-4e34-813e-82a57b03d1ee",
|                                               "Value":  "TeamMember.ReadWrite.All",
|                                               "DisplayName":  "Add and remove members from teams",
|                                               "Description":  "Add and remove members from teams, on behalf of the signed-in user. Also allows changing a member\u0027s role, for example from owner to non-owner."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2104a4db-3a2f-4ea0-9dba-143d457dc666",
|                                               "Value":  "TeamMember.ReadWriteNonOwnerRole.All",
|                                               "DisplayName":  "Add and remove members with non-owner role for all teams",
|                                               "Description":  "Add and remove members from all teams, on behalf of the signed-in user. Does not allow adding or removing a member with the owner role. Additionally, does not allow the app to elevate an existing member to the owner role."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0e755559-83fb-4b44-91d0-4cc721b9323e",
|                                               "Value":  "TeamsActivity.Read",
|                                               "DisplayName":  "Read user\u0027s teamwork activity feed",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s teamwork activity feed."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7ab1d787-bae7-4d5d-8db6-37ea32df9186",
|                                               "Value":  "TeamsActivity.Send",
|                                               "DisplayName":  "Send a teamwork activity as the user",
|                                               "Description":  "Allows the app to create new notifications in users\u0027 teamwork activity feeds on behalf of the signed in user. These notifications may not be discoverable or be held or governed by compliance policies."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d1ba22c6-3f02-4c91-addb-bc3399bcca88",
|                                               "Value":  "TeamsAppInstallation.ManageSelectedForChat",
|                                               "DisplayName":  "Manage installation and permission grants of selected Teams apps in chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in chats the signed-in user can access. Gives the ability to manage permission grants for accessing those specific chats\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c67b2d7e-6b80-4218-938a-05e73058e42d",
|                                               "Value":  "TeamsAppInstallation.ManageSelectedForTeam",
|                                               "DisplayName":  "Manage installation and permission grants of selected Teams apps in teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Gives the ability to manage permission grants for accessing those specific teams\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "830c2bd9-c335-4caf-bf83-c07fa8a23ef1",
|                                               "Value":  "TeamsAppInstallation.ManageSelectedForUser",
|                                               "DisplayName":  "Manage installation and permission grants of selected Teams apps in users\u0027 personal scope",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall seleected Teams apps in user accounts, on behalf of the signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bf3fbf03-f35f-4e93-963e-47e4d874c37a",
|                                               "Value":  "TeamsAppInstallation.ReadForChat",
|                                               "DisplayName":  "Read installed Teams apps in chats",
|                                               "Description":  "Allows the app to read the Teams apps that are installed in chats the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5248dcb1-f83b-4ec3-9f4d-a4428a961a72",
|                                               "Value":  "TeamsAppInstallation.ReadForTeam",
|                                               "DisplayName":  "Read installed Teams apps in teams",
|                                               "Description":  "Allows the app to read the Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c395395c-ff9a-4dba-bc1f-8372ba9dca84",
|                                               "Value":  "TeamsAppInstallation.ReadForUser",
|                                               "DisplayName":  "Read user\u0027s installed Teams apps",
|                                               "Description":  "Allows the app to read the Teams apps that are installed for the signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0f3420c2-c6ec-46de-ab72-fd51267087d5",
|                                               "Value":  "TeamsAppInstallation.ReadSelectedForChat",
|                                               "DisplayName":  "Read selected installed Teams apps in chats",
|                                               "Description":  "Allows the app to read the selected Teams apps that are installed in chats the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b55df1c0-db20-435b-aef2-afe6ed487e16",
|                                               "Value":  "TeamsAppInstallation.ReadSelectedForTeam",
|                                               "DisplayName":  "Read selected installed Teams apps in teams",
|                                               "Description":  "Allows the app to read the selected Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fe2e4e1d-101f-4fb2-9cb1-9d6659db45d4",
|                                               "Value":  "TeamsAppInstallation.ReadSelectedForUser",
|                                               "DisplayName":  "Read user\u0027s selected installed Teams apps",
|                                               "Description":  "Allows the app to read the selected Teams apps that are installed for the signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e1408a66-8f82-451b-a2f3-3c3e38f7413f",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentForChat",
|                                               "DisplayName":  "Manage installed Teams apps in chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in chats the signed-in user can access. Gives the ability to manage permission grants for accessing those specific chats\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "946349d5-2a9d-4535-abc0-7beeacaedd1d",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentForTeam",
|                                               "DisplayName":  "Manage installed Teams apps in teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Gives the ability to manage permission grants for accessing those specific teams\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2da62c49-dfbd-40df-ba16-fef3529d391c",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentForUser",
|                                               "DisplayName":  "Manage installation and permission grants of Teams apps in users\u0027 personal scope",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in user accounts, on behalf of the signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a0e0e18b-8fb2-458f-8130-da2d7cab9c75",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForChat",
|                                               "DisplayName":  "Allow the Teams app to manage itself and its permission grants in chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in chats the signed-in user can access, and manage its permission grants for accessing those specific chats\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4a6bbf29-a0e1-4a4d-a7d1-cef17f772975",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForTeam",
|                                               "DisplayName":  "Allow the Teams app to manage itself and its permission grants in teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in teams the signed-in user can access, and manage its permission grants for accessing those specific teams\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7a349935-c54d-44ab-ab66-1b460d315be7",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForUser",
|                                               "DisplayName":  "Allow the Teams app to manage itself and its permission grants in user accounts",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in user accounts, and manage its permission grants for accessing those specific users\u0027 data, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "aa85bf13-d771-4d5d-a9e6-bca04ce44edf",
|                                               "Value":  "TeamsAppInstallation.ReadWriteForChat",
|                                               "DisplayName":  "Manage installed Teams apps in chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in chats the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2e25a044-2580-450d-8859-42eeb6e996c0",
|                                               "Value":  "TeamsAppInstallation.ReadWriteForTeam",
|                                               "DisplayName":  "Manage installed Teams apps in teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "093f8818-d05f-49b8-95bc-9d2a73e9a43c",
|                                               "Value":  "TeamsAppInstallation.ReadWriteForUser",
|                                               "DisplayName":  "Manage user\u0027s installed Teams apps",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps installed for the signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "690aa3b6-4b71-41c2-a990-77a8c4768d2b",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelectedForChat",
|                                               "DisplayName":  "Manage selected Teams apps installed in chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in chats the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9131c833-9a49-4c54-b38f-615ecfc4fc69",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelectedForTeam",
|                                               "DisplayName":  "Manage selected Teams apps installed in teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ea819e27-c92a-4118-b83b-4540b125d744",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelectedForUser",
|                                               "DisplayName":  "Manage selected Teams apps installed for a user",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps installed for the signed in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0ce33576-30e8-43b7-99e5-62f8569a4002",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelfForChat",
|                                               "DisplayName":  "Allow the Teams app to manage itself in chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in chats the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0f4595f7-64b1-4e13-81bc-11a249df07a9",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelfForTeam",
|                                               "DisplayName":  "Allow the app to manage itself in teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself to teams the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "207e0cb1-3ce7-4922-b991-5a760c346ebc",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelfForUser",
|                                               "DisplayName":  "Allow the Teams app to manage itself for a user",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "48638b3c-ad68-4383-8ac4-e6880ee6ca57",
|                                               "Value":  "TeamSettings.Read.All",
|                                               "DisplayName":  "Read teams\u0027 settings",
|                                               "Description":  "Read all teams\u0027 settings, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "39d65650-9d3e-4223-80db-a335590d027e",
|                                               "Value":  "TeamSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and change teams\u0027 settings",
|                                               "Description":  "Read and change all teams\u0027 settings, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6997c35c-a586-440c-8a0b-4ffe5d118dc0",
|                                               "Value":  "TeamsPolicyUserAssign.ReadWrite.All",
|                                               "DisplayName":  "Read and Write Teams policy user assignment and unassigment for all policy types.",
|                                               "Description":  "Allow the app to read or write/update the policy assignment and unassigment for Teams users for all policy type categories."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ea2cbd09-253c-4f69-a0e6-07383c5f07cc",
|                                               "Value":  "TeamsResourceAccount.Read.All",
|                                               "DisplayName":  "Read Teams resource accounts",
|                                               "Description":  "Allows the app to read your tenant\u0027s resource accounts on behalf of the signed-in admin user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a9ff19c2-f369-4a95-9a25-ba9d460efc8e",
|                                               "Value":  "TeamsTab.Create",
|                                               "DisplayName":  "Create tabs in Microsoft Teams.",
|                                               "Description":  "Allows the app to create tabs in any team in Microsoft Teams, on behalf of the signed-in user. This does not grant the ability to read, modify or delete tabs after they are created, or give access to the content inside the tabs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "59dacb05-e88d-4c13-a684-59f1afc8cc98",
|                                               "Value":  "TeamsTab.Read.All",
|                                               "DisplayName":  "Read tabs in Microsoft Teams.",
|                                               "Description":  "Read the names and settings of tabs inside any team in Microsoft Teams, on behalf of the signed-in user. This does not give access to the content inside the tabs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b98bfd41-87c6-45cc-b104-e2de4f0dafb9",
|                                               "Value":  "TeamsTab.ReadWrite.All",
|                                               "DisplayName":  "Read and write tabs in Microsoft Teams.",
|                                               "Description":  "Read and write tabs in any team in Microsoft Teams, on behalf of the signed-in user. This does not give access to the content inside the tabs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ee928332-e9c2-4747-b4a0-f8c164b68de6",
|                                               "Value":  "TeamsTab.ReadWriteForChat",
|                                               "DisplayName":  "Allow the Teams app to manage all tabs in chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs in chats the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c975dd04-a06e-4fbb-9704-62daad77bb49",
|                                               "Value":  "TeamsTab.ReadWriteForTeam",
|                                               "DisplayName":  "Allow the Teams app to manage all tabs in teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs to teams the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c37c9b61-7762-4bff-a156-afc0005847a0",
|                                               "Value":  "TeamsTab.ReadWriteForUser",
|                                               "DisplayName":  "Allow the Teams app to manage all tabs for a user",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0c219d04-3abf-47f7-912d-5cca239e90e6",
|                                               "Value":  "TeamsTab.ReadWriteSelfForChat",
|                                               "DisplayName":  "Allow the Teams app to manage only its own tabs in chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs in chats the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f266662f-120a-4314-b26a-99b08617c7ef",
|                                               "Value":  "TeamsTab.ReadWriteSelfForTeam",
|                                               "DisplayName":  "Allow the Teams app to manage only its own tabs in teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs to teams the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "395dfec1-a0b9-465f-a783-8250a430cb8c",
|                                               "Value":  "TeamsTab.ReadWriteSelfForUser",
|                                               "DisplayName":  "Allow the Teams app to manage only its own tabs for a user",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1bc6eab1-058d-4557-b011-d4c41cec88b7",
|                                               "Value":  "TeamsTelephoneNumber.Read.All",
|                                               "DisplayName":  "Read Tenant-Acquired Telephone Number Details",
|                                               "Description":  "Allows the app to read your tenant\u0027s acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "424b07a8-1209-4d17-9fe4-9018a93a1024",
|                                               "Value":  "TeamsTelephoneNumber.ReadWrite.All",
|                                               "DisplayName":  "Read and Modify Tenant-Acquired Telephone Number Details",
|                                               "Description":  "Allows the app to read and modify your tenant\u0027s acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5c469ce4-dab5-4afd-b9de-14f1ba4004a7",
|                                               "Value":  "TeamsUserConfiguration.Read.All",
|                                               "DisplayName":  "Read Teams user configurations",
|                                               "Description":  "Allows the app to read your tenant\u0027s user configurations on behalf of the signed-in admin user. User configuration may include attributes related to user, such as telephone number, assigned policies, etc."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cd87405c-5792-4f15-92f7-debc0db6d1d6",
|                                               "Value":  "TeamTemplates.Read",
|                                               "DisplayName":  "Read available Teams templates",
|                                               "Description":  "Allows the app to read the available Teams templates, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "594f4bb6-c083-4cf9-8aa8-213823bdf351",
|                                               "Value":  "Teamwork.Read.All",
|                                               "DisplayName":  "Read organizational teamwork settings",
|                                               "Description":  "Allows the app to read the teamwork settings of the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "44e060c4-bbdc-4256-a0b9-dcc0396db368",
|                                               "Value":  "TeamworkAppSettings.Read.All",
|                                               "DisplayName":  "Read Teams app settings",
|                                               "Description":  "Allows the app to read the Teams app settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "87c556f0-2bd9-4eed-bd74-5dd8af6eaf7e",
|                                               "Value":  "TeamworkAppSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write Teams app settings",
|                                               "Description":  "Allows the app to read and write the Teams app settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b659488b-9d28-4208-b2be-1c6652b3c970",
|                                               "Value":  "TeamworkDevice.Read.All",
|                                               "DisplayName":  "Read Teams devices",
|                                               "Description":  "Allow the app to read the management data for Teams devices on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ddd97ecb-5c31-43db-a235-0ee20e635c40",
|                                               "Value":  "TeamworkDevice.ReadWrite.All",
|                                               "DisplayName":  "Read and write Teams devices",
|                                               "Description":  "Allow the app to read and write the management data for Teams devices on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "87a3258d-8c34-49e2-ab91-9b8bdbd79177",
|                                               "Value":  "TeamworkSection.Read",
|                                               "DisplayName":  "Read your sections",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s sections (folders) for organizing chats and channels in Teams."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "70dbe5e8-39b9-40f3-8c65-3ec7b00ad804",
|                                               "Value":  "TeamworkSection.ReadWrite",
|                                               "DisplayName":  "Read and write your sections",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s sections (folders) for organizing chats and channels in Teams."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "57587d0b-8399-45be-b207-8050cec54575",
|                                               "Value":  "TeamworkTag.Read",
|                                               "DisplayName":  "Read tags in Teams",
|                                               "Description":  "Allows the app to read tags in Teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "539dabd7-b5b6-4117-b164-d60cd15a8671",
|                                               "Value":  "TeamworkTag.ReadWrite",
|                                               "DisplayName":  "Read and write tags in Teams",
|                                               "Description":  "Allows the app to read and write tags in Teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "162354de-2885-4e5a-94fb-2f03019a65a8",
|                                               "Value":  "TeamworkTargetedMessage.ReadWrite",
|                                               "DisplayName":  "Update targeted messages belonging to the user",
|                                               "Description":  "Allows the user to update group chat or channel targeted messages in Microsoft Teams."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b4d26916-07e0-4daf-9096-9f6d9174aa96",
|                                               "Value":  "TeamworkUserInteraction.Read.All",
|                                               "DisplayName":  "Read all of the possible Teams interactions between the user and other users",
|                                               "Description":  "Allows the app to read all of the possible Teams interactions between the signed-in user and other users"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fda068e8-0524-485e-8d7f-b5bc29b0dae9",
|                                               "Value":  "TenantGovernance-Invitation.Read.All",
|                                               "DisplayName":  "Read Tenant Governance invitations",
|                                               "Description":  "Allows the application to list and read all Tenant Governance invitations on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "42b91635-3803-4af2-a2d5-e91127f9c488",
|                                               "Value":  "TenantGovernance-Invitation.ReadWrite.All",
|                                               "DisplayName":  "Read and write Tenant Governance invitations",
|                                               "Description":  "Allows the application to list, read, create, and delete Tenant Governance invitations on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ad222a15-813d-46b8-8f8d-1976a69a74f3",
|                                               "Value":  "TenantGovernance-PolicyTemplate.Read.All",
|                                               "DisplayName":  "Read Tenant Governance policy templates",
|                                               "Description":  "Allows the application to list and read all Tenant Governance policy templates on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7cd0bd21-45fe-4c8e-a549-3c95bd27d185",
|                                               "Value":  "TenantGovernance-PolicyTemplate.ReadWrite.All",
|                                               "DisplayName":  "Read and write Tenant Governance policy templates",
|                                               "Description":  "Allows the application to list, read, create, update, and delete Tenant Governance policy templates on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9caaca93-f090-4b9a-b4bb-17de251354d4",
|                                               "Value":  "TenantGovernance-RelatedTenant.Read.All",
|                                               "DisplayName":  "Read related tenants",
|                                               "Description":  "Allows the application to list and read related tenants information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e61db2de-de55-461e-942d-52a028ed1076",
|                                               "Value":  "TenantGovernance-RelatedTenant.ReadWrite.All",
|                                               "DisplayName":  "Read and write related tenants",
|                                               "Description":  "Allows the application to list, read, and refresh related tenants information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0b1c2458-4845-477b-a704-3cce8b06bf28",
|                                               "Value":  "TenantGovernance-Relationship.Read.All",
|                                               "DisplayName":  "Read Tenant Governance relationships",
|                                               "Description":  "Allows the application to list and read all Tenant Governance relationships on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3fbcd6a3-a9a5-4d69-8a78-acc7d7195180",
|                                               "Value":  "TenantGovernance-Relationship.ReadWrite.All",
|                                               "DisplayName":  "Read and write Tenant Governance relationships",
|                                               "Description":  "Allows the application to list, read, and update Tenant Governance relationships on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a924b9f1-7af0-4982-aecf-b6e0e10b2830",
|                                               "Value":  "TenantGovernance-Request.Read.All",
|                                               "DisplayName":  "Read Tenant Governance requests",
|                                               "Description":  "Allows the application to list and read all Tenant Governance requests on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3c7a434e-4e5d-413f-be82-b77ea4ba5a4d",
|                                               "Value":  "TenantGovernance-Request.ReadWrite.All",
|                                               "DisplayName":  "Read and write Tenant Governance requests",
|                                               "Description":  "Allows the application to list, read, create, and update Tenant Governance requests on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4ad3e05f-2467-49d9-baa2-8e4de7bcee9b",
|                                               "Value":  "TenantGovernance-Setting.Read.All",
|                                               "DisplayName":  "Read Tenant Governance settings",
|                                               "Description":  "Allows the application to read Tenant Governance settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "135f3533-12fc-4608-97ac-5c5cea64baf0",
|                                               "Value":  "TenantGovernance-Setting.ReadWrite.All",
|                                               "DisplayName":  "Read and write Tenant Governance settings",
|                                               "Description":  "Allows the application to read Tenant Governance settings and update them on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "297f747b-0005-475b-8fef-c890f5152b38",
|                                               "Value":  "TermStore.Read.All",
|                                               "DisplayName":  "Read term store data",
|                                               "Description":  "Allows the app to read the term store data that the signed-in user has access to. This includes all sets, groups and terms in the term store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6c37c71d-f50f-4bff-8fd3-8a41da390140",
|                                               "Value":  "TermStore.ReadWrite.All",
|                                               "DisplayName":  "Read and write term store data",
|                                               "Description":  "Allows the app to read or modify data that the signed-in user has access to. This includes all sets, groups and terms in the term store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cac97e40-6730-457d-ad8d-4852fddab7ad",
|                                               "Value":  "ThreatAssessment.ReadWrite.All",
|                                               "DisplayName":  "Read and write threat assessment requests",
|                                               "Description":  "Allows an app to read your organization\u0027s threat assessment requests on behalf of the signed-in user. Also allows the app to create new requests to assess threats received by your organization on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b152eca8-ea73-4a48-8c98-1a6742673d99",
|                                               "Value":  "ThreatHunting.Read.All",
|                                               "DisplayName":  "Run hunting queries",
|                                               "Description":  "Allows the app to run hunting queries, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9cc427b4-2004-41c5-aa22-757b755e9796",
|                                               "Value":  "ThreatIndicators.Read.All",
|                                               "DisplayName":  "Read all threat indicators",
|                                               "Description":  "Allows the app to read all the indicators for your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "91e7d36d-022a-490f-a748-f8e011357b42",
|                                               "Value":  "ThreatIndicators.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Manage threat indicators this app creates or owns",
|                                               "Description":  "Allows the app to create threat indicators, and fully manage those threat indicators (read, update and delete), on behalf of the signed-in user.  It cannot update any threat indicators it does not own."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f266d9c0-ccb9-4fb8-a228-01ac0d8d6627",
|                                               "Value":  "ThreatIntelligence.Read.All",
|                                               "DisplayName":  "Read all threat intelligence information",
|                                               "Description":  "Allows the app to read threat intelligence information, such as indicators, observations, and articles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fd5353c6-26dd-449f-a565-c4e16b9fce78",
|                                               "Value":  "ThreatSubmission.Read",
|                                               "DisplayName":  "Read threat submissions",
|                                               "Description":  "Allows the app to read the threat submissions and threat submission policies owned by the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7083913a-4966-44b6-9886-c5822a5fd910",
|                                               "Value":  "ThreatSubmission.Read.All",
|                                               "DisplayName":  "Read all threat submissions",
|                                               "Description":  "Allows the app to read your organization\u0027s threat submissions and threat submission policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "68a3156e-46c9-443c-b85c-921397f082b5",
|                                               "Value":  "ThreatSubmission.ReadWrite",
|                                               "DisplayName":  "Read and write threat submissions",
|                                               "Description":  "Allows the app to read the threat submissions and threat submission policies owned by the signed-in user. Also allows the app to create new threat submissions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8458e264-4eb9-4922-abe9-768d58f13c7f",
|                                               "Value":  "ThreatSubmission.ReadWrite.All",
|                                               "DisplayName":  "Read and write all threat submissions",
|                                               "Description":  "Allows the app to read your organization\u0027s threat submissions and threat submission policies on behalf of the signed-in user. Also allows the app to create new threat submissions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "059e5840-5353-4c68-b1da-666a033fc5e8",
|                                               "Value":  "ThreatSubmissionPolicy.ReadWrite.All",
|                                               "DisplayName":  "Read and write all threat submission policies",
|                                               "Description":  "Allows the app to read your organization\u0027s threat submission policies on behalf of the signed-in user. Also allows the app to create new threat submission policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "79c4c76f-409a-4f98-884d-e2c09291ec26",
|                                               "Value":  "Topic.Read.All",
|                                               "DisplayName":  "Read topic items",
|                                               "Description":  "Allows the app to read topics data on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7ad34336-f5b1-44ce-8682-31d7dfcd9ab9",
|                                               "Value":  "TrustFrameworkKeySet.Read.All",
|                                               "DisplayName":  "Read trust framework key sets",
|                                               "Description":  "Allows the app to read trust framework key set properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "39244520-1e7d-4b4a-aee0-57c65826e427",
|                                               "Value":  "TrustFrameworkKeySet.ReadWrite.All",
|                                               "DisplayName":  "Read and write trust framework key sets",
|                                               "Description":  "Allows the app to read and write trust framework key set properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "73e75199-7c3e-41bb-9357-167164dbb415",
|                                               "Value":  "UnifiedGroupMember.Read.AsGuest",
|                                               "DisplayName":  "Read unified group memberships as guest",
|                                               "Description":  "Allows the app to read basic unified group properties, memberships and owners of the group the signed-in guest is a member of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "550e695c-7511-40f4-ac79-e8fb9c82552d",
|                                               "Value":  "User-ConvertToInternal.ReadWrite.All",
|                                               "DisplayName":  "Convert an external user to internal memeber user",
|                                               "Description":  "Allow the app to convert an external user to an internal member user, on behalf of signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ed8d2a04-0374-41f1-aefe-da8ac87ccc87",
|                                               "Value":  "User-LifeCycleInfo.Read.All",
|                                               "DisplayName":  "Read all users\u0027 lifecycle information",
|                                               "Description":  "Allows the app to read the lifecycle information like employeeLeaveDateTime of users in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7ee7473e-bd4b-4c9f-987c-bd58481f5fa2",
|                                               "Value":  "User-LifeCycleInfo.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 lifecycle information",
|                                               "Description":  "Allows the app to read and write the lifecycle information like employeeLeaveDateTime of users in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6166886a-9576-433b-8544-658177bdef1d",
|                                               "Value":  "User-Mail.ReadWrite.All",
|                                               "DisplayName":  "Read and write secondary mail addresses for users",
|                                               "Description":  "Allows the app to read and write secondary mail addresses for all users, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7ff9afdd-0cdb-439d-a61c-fea3e9339e89",
|                                               "Value":  "User-OnPremisesSyncBehavior.ReadWrite.All",
|                                               "DisplayName":  "Read and update the on-premises sync behavior of users",
|                                               "Description":  "Allows the app to read and update the on-premises sync behavior of users on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "56760768-b641-451f-8906-e1b8ab31bca7",
|                                               "Value":  "User-PasswordProfile.ReadWrite.All",
|                                               "DisplayName":  "Read and write password profiles and reset user passwords",
|                                               "Description":  "Allows the app to read and write password profiles and reset passwords for all users, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e29d5979-5b06-4a7f-ae24-6a9348d2e1ff",
|                                               "Value":  "User-Phone.ReadWrite.All",
|                                               "DisplayName":  "Read and write user mobile phone and business phones",
|                                               "Description":  "Allows the app to read and write the mobile phone and business phones for all users, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4bb440cd-2cf2-4f90-8004-aa2acd2537c5",
|                                               "Value":  "User.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore users",
|                                               "Description":  "Allows the app to delete and restore all users, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f92e74e7-2563-467f-9dd0-902688cb5863",
|                                               "Value":  "User.EnableDisableAccount.All",
|                                               "DisplayName":  "Enable and disable user accounts",
|                                               "Description":  "Allows the app to enable and disable users\u0027 accounts, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "405a51b5-8d8d-430b-9842-8be4b0e9f324",
|                                               "Value":  "User.Export.All",
|                                               "DisplayName":  "Export user\u0027s data",
|                                               "Description":  "Allows the app to export data (e.g. customer content or system-generated logs), associated with any user in your company, when the app is used by a privileged user (e.g. a Company Administrator)."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "63dd7cd9-b489-4adf-a28c-ac38b9a0f962",
|                                               "Value":  "User.Invite.All",
|                                               "DisplayName":  "Invite guest users to the organization",
|                                               "Description":  "Allows the app to invite guest users to the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "637d7bec-b31e-4deb-acc9-24275642a2c9",
|                                               "Value":  "User.ManageIdentities.All",
|                                               "DisplayName":  "Manage  user identities",
|                                               "Description":  "Allows the app to read, update and delete identities that are associated with a user\u0027s account that the signed-in user has access to. This controls the identities users can sign-in with."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
|                                               "Value":  "User.Read",
|                                               "DisplayName":  "Sign in and read user profile",
|                                               "Description":  "Allows users to sign-in to the app, and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a154be20-db9c-4678-8ab7-66f6cc099a59",
|                                               "Value":  "User.Read.All",
|                                               "DisplayName":  "Read all users\u0027 full profiles",
|                                               "Description":  "Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b340eb25-3456-403f-be2f-af7a0d370277",
|                                               "Value":  "User.ReadBasic.All",
|                                               "DisplayName":  "Read all users\u0027 basic profiles",
|                                               "Description":  "Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b4e74841-8e56-480b-be8b-910348b18b4c",
|                                               "Value":  "User.ReadWrite",
|                                               "DisplayName":  "Read and write access to user profile",
|                                               "Description":  "Allows the app to read your profile. It also allows the app to update your profile information on your behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "204e0828-b5ca-4ad8-b9f3-f32a958e7cc4",
|                                               "Value":  "User.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 full profiles",
|                                               "Description":  "Allows the app to read and write the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fc30e98b-8810-4501-81f5-c20a3196387b",
|                                               "Value":  "User.RevokeSessions.All",
|                                               "DisplayName":  "Revoke all sign in sessions for a user",
|                                               "Description":  "Allow the app to revoke all sign in sessions for a user, on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "47607519-5fb1-47d9-99c7-da4b48f369b1",
|                                               "Value":  "UserActivity.ReadWrite.CreatedByApp",
|                                               "DisplayName":  "Read and write app activity to users\u0027 activity feed",
|                                               "Description":  "Allows the app to read and report the signed-in user\u0027s activity in the app."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1f6b61c5-2f65-4135-9c9f-31c0f8d32b52",
|                                               "Value":  "UserAuthenticationMethod.Read",
|                                               "DisplayName":  "Read user authentication methods.",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s authentication methods, including phone numbers and Authenticator app settings. This does not allow the app to see secret information like the signed-in user\u0027s passwords, or to sign-in  or otherwise use the signed-in user\u0027s authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "aec28ec7-4d02-4e8c-b864-50163aea77eb",
|                                               "Value":  "UserAuthenticationMethod.Read.All",
|                                               "DisplayName":  "Read all users\u0027 authentication methods",
|                                               "Description":  "Allows the app to read authentication methods of all users in your organization that the signed-in user has access to. Authentication methods include things like a user’s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "48971fc1-70d7-4245-af77-0beb29b53ee2",
|                                               "Value":  "UserAuthenticationMethod.ReadWrite",
|                                               "DisplayName":  "Read and write user authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s authentication methods, including phone numbers and Authenticator app settings.                       This does not allow the app to see secret information like the signed-in user\u0027s passwords, or                      to sign-in or otherwise use the signed-in user\u0027s authentication methods.  "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b7887744-6746-4312-813d-72daeaee7e2d",
|                                               "Value":  "UserAuthenticationMethod.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 authentication methods.",
|                                               "Description":  " Allows the app to read and write authentication methods of all users in your organization that the signed-in user has access to.                       Authentication methods include things like a user’s phone numbers and Authenticator app settings. This                      does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "12b23cea-90c1-4873-9094-f45c5f290f86",
|                                               "Value":  "UserAuthMethod-Email.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s email authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s email authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "76caaf3a-ebdb-40a3-9299-4196e636f290",
|                                               "Value":  "UserAuthMethod-Email.Read.All",
|                                               "DisplayName":  "Read all users\u0027 email methods",
|                                               "Description":  "Allows the app to read email methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "696aa421-62dc-4c99-be16-015b23444089",
|                                               "Value":  "UserAuthMethod-Email.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s email authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s email authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "074f680f-c89e-45be-880e-5d0642860a1c",
|                                               "Value":  "UserAuthMethod-Email.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 email methods.",
|                                               "Description":  "Allows the app to read and write email methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d1739827-146b-4f7f-b52c-1c509253aa57",
|                                               "Value":  "UserAuthMethod-External.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s external authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s external authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cbca9646-4c34-4cea-8e54-9a7088018820",
|                                               "Value":  "UserAuthMethod-External.Read.All",
|                                               "DisplayName":  "Read all users\u0027 external authentication methods",
|                                               "Description":  "Allows the app to read external authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "28c2e8f9-828a-4691-a090-f2f0b7fc07b3",
|                                               "Value":  "UserAuthMethod-External.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s external authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s external authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9d91805d-0f53-43e3-a0f3-303ad4f3056f",
|                                               "Value":  "UserAuthMethod-External.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 external methods.",
|                                               "Description":  "Allows the app to read and write external authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ccd2eb40-8874-44e6-8f96-335908b3cfdb",
|                                               "Value":  "UserAuthMethod-HardwareOATH.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s HardwareOATH authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s HardwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "acd68c26-c283-4bf4-8b5c-200fc179bdd5",
|                                               "Value":  "UserAuthMethod-HardwareOATH.Read.All",
|                                               "DisplayName":  "Read all users\u0027 HardwareOATH authentication methods",
|                                               "Description":  "Allows the app to read HardwareOATH authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "147ca97b-6686-4849-b37e-09d9b5ad45fc",
|                                               "Value":  "UserAuthMethod-HardwareOATH.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s HardwareOATH authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s HardwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "480643f2-a162-43c5-a670-dc1494fc911b",
|                                               "Value":  "UserAuthMethod-HardwareOATH.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 HardwareOATH methods.",
|                                               "Description":  "Allows the app to read and write HardwareOATH authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f14a567b-3280-4124-95a0-eca86006967e",
|                                               "Value":  "UserAuthMethod-MicrosoftAuthApp.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s Microsoft Authenticator authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s Microsoft Authenticator authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7b627679-e2fd-4bfd-990e-989e2914d4e6",
|                                               "Value":  "UserAuthMethod-MicrosoftAuthApp.Read.All",
|                                               "DisplayName":  "Read all users\u0027 Microsoft authentication methods",
|                                               "Description":  "Allows the app to read Microsoft authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9f7dfa0c-eb40-42be-8d45-8af4a9219c6f",
|                                               "Value":  "UserAuthMethod-MicrosoftAuthApp.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s Microsoft Authenticator authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s Microsoft Authenticator authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1b7322b2-5cb3-4f13-928f-d7ca97c5fba9",
|                                               "Value":  "UserAuthMethod-MicrosoftAuthApp.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 Microsoft Authentication methods.",
|                                               "Description":  "Allows the app to read and write Microsoft Authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "828fcbda-0d26-431d-8bfb-83f217224621",
|                                               "Value":  "UserAuthMethod-Passkey.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s passkey authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s passkey authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "14195339-1fe4-48a7-a0d3-a39eb9fd8958",
|                                               "Value":  "UserAuthMethod-Passkey.Read.All",
|                                               "DisplayName":  "Read all users\u0027 passkey authentication methods",
|                                               "Description":  "Allows the app to read passkey authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b2de7db9-10f7-4800-b04c-b5b91e4891d6",
|                                               "Value":  "UserAuthMethod-Passkey.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s passkey authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s passkey authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "64930478-d0ea-4671-ad72-fe0d9821df09",
|                                               "Value":  "UserAuthMethod-Passkey.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 passkey methods.",
|                                               "Description":  "Allows the app to read and write passkey authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7f0f82c3-de19-4ddc-810d-a2206d7637fd",
|                                               "Value":  "UserAuthMethod-Password.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s password authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s password authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4f69a4e2-2aa0-43a7-ad6b-98b4cda1f23f",
|                                               "Value":  "UserAuthMethod-Password.Read.All",
|                                               "DisplayName":  "Read all users\u0027 password authentication methods",
|                                               "Description":  "Allows the app to read password authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "60cce20d-d41e-4594-b391-84bbf8cc31f3",
|                                               "Value":  "UserAuthMethod-Password.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s password authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s password authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7f5b683d-df96-4690-a88d-6e336ed6dc7c",
|                                               "Value":  "UserAuthMethod-Password.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 password methods.",
|                                               "Description":  "Allows the app to read and write password authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "43dab3b9-e8b4-424d-8e13-6a2ad2a625fa",
|                                               "Value":  "UserAuthMethod-Phone.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s phone authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s phone authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "20cf4ae1-09b9-4d29-a6f8-43e1820ce60c",
|                                               "Value":  "UserAuthMethod-Phone.Read.All",
|                                               "DisplayName":  "Read all users\u0027 phone authentication methods",
|                                               "Description":  "Allows the app to read phone authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6c4aad61-f76b-46ad-a22c-57d4d3d962af",
|                                               "Value":  "UserAuthMethod-Phone.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s phone authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s phone authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "48c99302-9a24-4f27-a8a7-acef4debba14",
|                                               "Value":  "UserAuthMethod-Phone.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 phone methods.",
|                                               "Description":  "Allows the app to read and write Phone methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9c694582-e8f2-40e2-8353-fb43e2e0f12a",
|                                               "Value":  "UserAuthMethod-PlatformCred.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s platform credential authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s platform credential authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5936156c-f89b-4850-997d-026c4e6ce529",
|                                               "Value":  "UserAuthMethod-PlatformCred.Read.All",
|                                               "DisplayName":  "Read all users\u0027 platform credentials methods",
|                                               "Description":  "Allows the app to read platform credentials methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "70327f81-b953-43c9-92d3-131c74e4beb8",
|                                               "Value":  "UserAuthMethod-PlatformCred.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s platform credential authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s platform credential authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cb11bf8c-dde1-4504-b6a5-31e1562b0749",
|                                               "Value":  "UserAuthMethod-PlatformCred.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 platform credentials methods.",
|                                               "Description":  "Allows the app to read and write platform credentials methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d6893c31-9187-405c-8dfc-f700c8fc161a",
|                                               "Value":  "UserAuthMethod-QR.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s QR authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s QR authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e4900dfb-ad17-410d-8ddb-7aebd8a6af1a",
|                                               "Value":  "UserAuthMethod-QR.Read.All",
|                                               "DisplayName":  "Read all users\u0027 QR methods",
|                                               "Description":  "Allows the app to read QR authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "651210da-18ce-4e42-b7db-302ff88e9326",
|                                               "Value":  "UserAuthMethod-QR.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s QR authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s QR authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "db39086a-da7d-4cbd-9ac0-6816f9a80c95",
|                                               "Value":  "UserAuthMethod-QR.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 QR methods.",
|                                               "Description":  "Allows the app to read and write QR authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "247f2733-6e3d-46ff-a904-f5fd58eb0d97",
|                                               "Value":  "UserAuthMethod-SoftwareOATH.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s SoftwareOATH authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s SoftwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3e366fa0-3097-4eb6-8294-3028f77eea6f",
|                                               "Value":  "UserAuthMethod-SoftwareOATH.Read.All",
|                                               "DisplayName":  "Read all users\u0027 SoftwareOATH methods",
|                                               "Description":  "Allows the app to read SoftwareOATH authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "16721eb3-4493-4ae1-9542-264d9ffe3ce9",
|                                               "Value":  "UserAuthMethod-SoftwareOATH.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s SoftwareOATH authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s SoftwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5b34c8b5-2396-4b35-b284-83fb6a3e73ce",
|                                               "Value":  "UserAuthMethod-SoftwareOATH.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 SoftwareOATH methods.",
|                                               "Description":  "Allows the app to read and write SoftwareOATH authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "84ded88f-26ba-49d6-b776-efec398de692",
|                                               "Value":  "UserAuthMethod-TAP.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s Temporary Access Pass authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s Temporary Access Pass authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6976c635-c9c2-41e6-a21d-e6913a155273",
|                                               "Value":  "UserAuthMethod-TAP.Read.All",
|                                               "DisplayName":  "Read all users\u0027 Temporary Access Pass methods",
|                                               "Description":  "Allows the app to read Temporary Access Pass authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2424436d-902f-4651-a1c7-b3b93147c960",
|                                               "Value":  "UserAuthMethod-TAP.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s Temporary Access Pass authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s Temporary Access Pass authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "05de4a66-e51a-4312-842a-30c8094698d2",
|                                               "Value":  "UserAuthMethod-TAP.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 Temporary Access Pass methods.",
|                                               "Description":  "Allows the app to read and write Temporary Access Pass authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "efe2b5aa-3a8e-486c-b0be-cc4d185c1b40",
|                                               "Value":  "UserAuthMethod-WindowsHello.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s Windows Hello methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s Windows Hello authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ff37d46d-b88a-4e0c-85ee-7e26c37b18eb",
|                                               "Value":  "UserAuthMethod-WindowsHello.Read.All",
|                                               "DisplayName":  "Read all users\u0027 Windows Hello methods",
|                                               "Description":  "Allows the app to read Windows Hello authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f11e1db9-d419-4a24-b677-792723ffd727",
|                                               "Value":  "UserAuthMethod-WindowsHello.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s Windows Hello authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s Windows Hello authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "13eae17d-aaa4-47b8-aaee-0eb33c6e2450",
|                                               "Value":  "UserAuthMethod-WindowsHello.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 Windows Hello methods.",
|                                               "Description":  "Allows the app to read and write Windows Hello authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "61e8a09a-087f-4e36-8c8c-1c77c5228017",
|                                               "Value":  "UserCloudClipboard.Read",
|                                               "DisplayName":  "Read cloud clipboard items",
|                                               "Description":  "Allows the app to read cloud clipboard data on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "26e2f3e8-b2a1-47fc-9620-89bb5b042024",
|                                               "Value":  "UserNotification.ReadWrite.CreatedByApp",
|                                               "DisplayName":  "Deliver and manage user\u0027s notifications",
|                                               "Description":  "Allows the app to send, read, update and delete user’s notifications."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "834bcc1c-762f-41b0-bb91-1cdc323ee4bf",
|                                               "Value":  "UserTeamwork.Read",
|                                               "DisplayName":  "Read user teamwork settings",
|                                               "Description":  "Allows the app to read the teamwork settings of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "367492fc-594d-4972-a9b5-0d58c622c91c",
|                                               "Value":  "UserTimelineActivity.Write.CreatedByApp",
|                                               "DisplayName":  "Write app activity to users\u0027 timeline",
|                                               "Description":  "Allows the app to report the signed-in user\u0027s app activity information to Microsoft Timeline."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "77e07bab-1b34-40a5-bb6c-4b197b3f6027",
|                                               "Value":  "UserWindowsSettings.Read.All",
|                                               "DisplayName":  "Read windows settings for all devices",
|                                               "Description":  "Allows the app to read a user\u0027s windows settings which are stored in cloud and their values on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dcb1026d-b7e1-4d31-9f61-6724d5140bf9",
|                                               "Value":  "UserWindowsSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write windows settings for all devices",
|                                               "Description":  "Allows the app to read and write a user\u0027s windows settings which are stored in cloud and their values on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "604b2056-41ed-4c56-aad5-1241d4ef7333",
|                                               "Value":  "VerifiedId-Profile.Read.All",
|                                               "DisplayName":  "Read Verified Id profiles",
|                                               "Description":  "This role can read Verified Id profiles in a tenant."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e4a9cb5e-4767-48f8-9029-decf26a54456",
|                                               "Value":  "VerifiedId-Profile.ReadWrite.All",
|                                               "DisplayName":  "Read and write Verified Id profiles",
|                                               "Description":  "This role can read and write Verified Id profiles in a tenant."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "27470298-d3b8-4b9c-aad4-6334312a3eac",
|                                               "Value":  "VirtualAppointment.Read",
|                                               "DisplayName":  "Read a user\u0027s virtual appointments",
|                                               "Description":  "Allows an application to read virtual appointments for the signed-in user. Only an organizer or participant user can read their virtual appointments.  "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2ccc2926-a528-4b17-b8bb-860eed29d64c",
|                                               "Value":  "VirtualAppointment.ReadWrite",
|                                               "DisplayName":  "Read and write a user\u0027s virtual appointments  ",
|                                               "Description":  "Allows an application to read and write virtual appointments for the signed-in user. Only an organizer or participant user can read and write their virtual appointments. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "20d02fff-a0ef-49e7-a46e-019d4a6523b7",
|                                               "Value":  "VirtualAppointmentNotification.Send",
|                                               "DisplayName":  "Send notification regarding virtual appointments for the signed-in user",
|                                               "Description":  "Allows an application to send notifications for virtual appointments for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6b616635-ae58-433a-a918-8c45e4f304dc",
|                                               "Value":  "VirtualEvent.Read",
|                                               "DisplayName":  "Read your virtual events",
|                                               "Description":  "Allows the app to read virtual events created by you"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d38d189c-e29b-4344-8b3b-829bfa81380b",
|                                               "Value":  "VirtualEvent.ReadWrite",
|                                               "DisplayName":  "Read and write your virtual events",
|                                               "Description":  "Allows the app to read and write virtual events for you"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e09fef2d-bf5e-4439-affa-7c48d23bb1c2",
|                                               "Value":  "WindowsUpdates.Read.All",
|                                               "DisplayName":  "Read all Windows update deployment settings",
|                                               "Description":  "Allows the app to read all Windows update deployment settings for the organization on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "11776c0c-6138-4db3-a668-ee621bea2555",
|                                               "Value":  "WindowsUpdates.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Windows update deployment settings",
|                                               "Description":  "Allows the app to read and write all Windows update deployment settings for the organization on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f1ccd5a7-6383-466a-8db8-1a656f7d06fa",
|                                               "Value":  "WorkforceIntegration.Read.All",
|                                               "DisplayName":  "Read workforce integrations",
|                                               "Description":  "Allows the app to read workforce integrations, to synchronize data from Microsoft Teams Shifts, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "08c4b377-0d23-4a8b-be2a-23c1c1d88545",
|                                               "Value":  "WorkforceIntegration.ReadWrite.All",
|                                               "DisplayName":  "Read and write workforce integrations",
|                                               "Description":  "Allows the app to manage workforce integrations, to synchronize data from Microsoft Teams Shifts, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ea3d980d-ebc7-4be4-8298-a167e5b8797c",
|                                               "Value":  "Exchange.ManageAsAppV2",
|                                               "DisplayName":  "Manage Exchange as application v2",
|                                               "Description":  "Allows the app to manage a limited set of Exchange Online configuration objects without user interaction, for specific scenarios supported by the adminapi/v2.0 endpoint. To enable management actions an admin must also assign the appropriate Exchange RBAC roles directly to the app."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dc50a0fb-09a3-484d-be87-e023b12c6440",
|                                               "Value":  "Exchange.ManageAsApp",
|                                               "DisplayName":  "Manage Exchange As Application",
|                                               "Description":  "Allows the app to manage the organization\u0027s Exchange environment without any user interaction. This includes mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles directly to the app."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4830e04b-48ac-4de5-bbd9-8aceb58e506b",
|                                               "Value":  "Place.Read.All",
|                                               "DisplayName":  "Read all company places",
|                                               "Description":  "Allows the app to read company places (conference rooms and room lists) for calendar events and other applications, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2dfdc6dc-2fa7-4a2c-a922-dbd4f85d17be",
|                                               "Value":  "Calendars.Read.All",
|                                               "DisplayName":  "Read calendars in all mailboxes",
|                                               "Description":  "Allows the app to read events of all R without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ef54d2bf-783f-4e0f-bca1-3210c0444d99",
|                                               "Value":  "Calendars.ReadWrite.All",
|                                               "DisplayName":  "Read and write calendars in all mailboxes",
|                                               "Description":  "Allows the app to create, read, update, and delete events of all calendars without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2c6a42ca-0d4d-49ad-bc0e-21222c449a65",
|                                               "Value":  "Tasks.ReadWrite",
|                                               "DisplayName":  "Read and write tasks in all mailboxes",
|                                               "Description":  "Allows the app to create, read, update, and delete tasks in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c1b0de0a-1de9-455d-919f-eca451053141",
|                                               "Value":  "Tasks.Read",
|                                               "DisplayName":  "Read user tasks in all mailboxes",
|                                               "Description":  "Allows the app to read user tasks in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f9156939-25cd-4ba8-abfe-7fabcf003749",
|                                               "Value":  "MailboxSettings.ReadWrite",
|                                               "DisplayName":  "Read and write all user mailbox settings",
|                                               "Description":  "Allows the app to create, read, update, and delete user\u0027s mailbox settings without a signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6918b873-d17a-4dc1-b314-35f528134491",
|                                               "Value":  "Contacts.ReadWrite",
|                                               "DisplayName":  "Read and write contacts in all mailboxes",
|                                               "Description":  "Allows the app to create, read, update, and delete all contacts in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e2a3a72e-5f79-4c64-b1b1-878b674786c9",
|                                               "Value":  "Mail.ReadWrite",
|                                               "DisplayName":  "Read and write mail in all mailboxes",
|                                               "Description":  "Allows the app to create, read, update, and delete mail in all mailboxes without a signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "810c84a8-4a9e-49e6-bf7d-12d183f40d01",
|                                               "Value":  "Mail.Read",
|                                               "DisplayName":  "Read mail in all mailboxes",
|                                               "Description":  "Allows the app to read mail in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "089fe4d0-434a-44c5-8827-41ba8a0b17f5",
|                                               "Value":  "Contacts.Read",
|                                               "DisplayName":  "Read contacts in all mailboxes",
|                                               "Description":  "Allows the app to read all contacts in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "798ee544-9d2d-430c-a058-570e29e34338",
|                                               "Value":  "Calendars.Read",
|                                               "DisplayName":  "Read calendars in all mailboxes",
|                                               "Description":  "Allows the app to read events of all calendars without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b633e1c5-b582-4048-a93e-9f11b44c7e96",
|                                               "Value":  "Mail.Send",
|                                               "DisplayName":  "Send mail as any user",
|                                               "Description":  "Allows the app to send mail as any user without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dc890d15-9560-4a4c-9b7f-a736ec74ec40",
|                                               "Value":  "full_access_as_app",
|                                               "DisplayName":  "Use Exchange Web Services with full access to all mailboxes",
|                                               "Description":  "Allows the app to have full access via Exchange Web Services to all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d45fa9f8-36e5-4cd2-b601-b063c7cf9ac2",
|                                               "Value":  "MailboxSettings.Read",
|                                               "DisplayName":  "Read all user mailbox settings",
|                                               "Description":  "Allows the app to read user\u0027s mailbox settings without a signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "77e65b5a-ceae-48b3-9490-50a86a038a48",
|                                               "Value":  "User.ReadBasic.All",
|                                               "DisplayName":  "Read all users\u0027 basic profiles",
|                                               "Description":  "Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bf24470f-10c1-436d-8d53-7b997eb473be",
|                                               "Value":  "User.Read.All",
|                                               "DisplayName":  "Read all users\u0027 full profiles",
|                                               "Description":  "Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f7264778-fba9-422d-8e9e-2675a2c4b513",
|                                               "Value":  "Mailbox.Migration",
|                                               "DisplayName":  "Move mailboxes between organizations",
|                                               "Description":  "Application permission grants permission to move mailboxes between Office365 organizations"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "15f260d6-f874-4366-8672-6b3658c5a09b",
|                                               "Value":  "Organization.Read.All",
|                                               "DisplayName":  "Organization.Read.All",
|                                               "Description":  "Allows the app to read the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed SKUs and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5e5addcd-3e8d-4e90-baf5-964efab2b20a",
|                                               "Value":  "IMAP.AccessAsApp",
|                                               "DisplayName":  "IMAP.AccessAsApp",
|                                               "Description":  "Allow application to access user’s mailbox via IMAP protocol"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cb842b43-da6e-4506-86fe-bb12199c656d",
|                                               "Value":  "POP.AccessAsApp",
|                                               "DisplayName":  "POP.AccessAsApp",
|                                               "Description":  "Allow application to access user’s mailbox via POP protocol"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c976971c-a54d-4835-a240-2479e3dac74a",
|                                               "Value":  "Organization.ReadWrite.All",
|                                               "DisplayName":  "Organization.ReadWrite.All",
|                                               "Description":  "Allows the app to read and write the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed SKUs and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b4d5a5c7-c085-487f-b922-ef0d6ebde6b1",
|                                               "Value":  "ReportingWebService.Read.All",
|                                               "DisplayName":  "ReportingWebService.Read.All",
|                                               "Description":  "Download all reports via the Office 365 reporting web service"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7146a1f0-8703-45b3-9eae-527a64c00995",
|                                               "Value":  "SMTP.SendAsApp",
|                                               "DisplayName":  "Application access for sending emails via SMTP AUTH",
|                                               "Description":  "Allows the app to have send access to all mailboxes"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "789ef6b5-4ecc-4f61-b6b3-66ef3109173c",
|                                               "Value":  "PeopleSettings.Read.All",
|                                               "DisplayName":  "Read all tenant-wide people settings",
|                                               "Description":  "Allows the application to read tenant-wide people settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "98ed40ef-611a-4479-bd35-eaa7863e946a",
|                                               "Value":  "PeopleSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write all tenant-wide people settings",
|                                               "Description":  "Allows the application to read and write tenant-wide people settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "44d6b5f2-d42b-4fa7-b999-1c5fcab98e4d",
|                                               "Value":  "Exchange.ManageV2",
|                                               "DisplayName":  "Manage Exchange configuration v2",
|                                               "Description":  "Allows the app to manage a limited set of Exchange Online configuration objects via the adminapi/v2.0 endpoint. This permission is intended for specific scenarios and requires appropriate Exchange RBAC role assignments."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d056cee4-aed2-4aa4-b2a9-292fe18b06d2",
|                                               "Value":  "OPX.MyDay.All",
|                                               "DisplayName":  "OPX.MyDay.All",
|                                               "Description":  "This allows application to host MyDay Owa powered experience for both user and shared mailbox and calendar"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "405782ba-4062-4ea3-bd33-f7c731841e3b",
|                                               "Value":  "OPX.MyDay.Shared",
|                                               "DisplayName":  "OPX.MyDay.Shared",
|                                               "Description":  "This allows application to host MyDay Owa powered experience for shared mailbox and calendar"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8cac6046-ce43-4348-855c-efd9d956b7bf",
|                                               "Value":  "OPX.MyDay",
|                                               "DisplayName":  "OPX.MyDay",
|                                               "Description":  "This allows the application to host MyDay Owa powered experience"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "43ed0a33-2264-4716-b3bd-c5d8e248eebf",
|                                               "Value":  "Place.Read.All",
|                                               "DisplayName":  "Read all company places",
|                                               "Description":  "Allows the app to read your company\u0027s places (conference rooms and room lists) for calendar events and other applications, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "266d2589-20b5-4f91-9a03-89247d1be8da",
|                                               "Value":  "EAS.AccessAsUser.All",
|                                               "DisplayName":  "Access mailboxes via Exchange ActiveSync",
|                                               "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via Exchange ActiveSync."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ad13ac2e-ad46-4dc0-b7da-249c94395a6d",
|                                               "Value":  "Mail.Read.All",
|                                               "DisplayName":  "Read user and shared mail ",
|                                               "Description":  "Allows the app to read mail a user can access, including their own and shared mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "140e747e-90d3-4de0-8618-85a0cc7a1129",
|                                               "Value":  "Mail.ReadWrite.All",
|                                               "DisplayName":  "Read and write user and shared mail ",
|                                               "Description":  "Allows the app to create, read, update, and delete mail a user has permission to access, including their own and shared mail. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e843bc88-e493-446d-a73c-0ded7ff1913f",
|                                               "Value":  "Mail.Send.All",
|                                               "DisplayName":  "Send mail on behalf of others",
|                                               "Description":  "Allows the app to send mail as the signed-in user, including sending on-behalf of others."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "da710fc9-1e83-407b-8c5c-09d225031769",
|                                               "Value":  "Calendars.Read.All",
|                                               "DisplayName":  "Read user and shared calendars ",
|                                               "Description":  "Allows the app to read events in all calendars that the user can access, including delegate and shared calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bbd1ca91-75e0-4814-ad94-9c5dbbae3415",
|                                               "Value":  "Calendars.ReadWrite.All",
|                                               "DisplayName":  "Read and write user and shared calendars ",
|                                               "Description":  "Allows the app to create, read, update and delete events in all calendars in the organization user has permissions to access. This includes delegate and shared calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d660a04c-7b62-4b4c-bea3-89226df00142",
|                                               "Value":  "Contacts.Read.All",
|                                               "DisplayName":  "Read user and shared contacts ",
|                                               "Description":  "Allows the app to read contacts a user has permissions to access, including their own and shared contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "44882612-f346-430a-b938-4f00ee1c77a7",
|                                               "Value":  "Contacts.ReadWrite.All",
|                                               "DisplayName":  "Read and write user and shared  contacts ",
|                                               "Description":  "Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2e83d72d-8895-4b66-9eea-abb43449ab8b",
|                                               "Value":  "MailboxSettings.ReadWrite",
|                                               "DisplayName":  "Read and write user mailbox settings",
|                                               "Description":  "Allows the app to create, read, update, and delete user\u0027s mailbox settings. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6b49b74d-642f-4417-a6b4-820576845707",
|                                               "Value":  "Tasks.ReadWrite",
|                                               "DisplayName":  "Create, read, update and delete user tasks ",
|                                               "Description":  "Allows the app to create, read, update and delete user tasks "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8af8046f-5694-470f-91e4-d47ad05eda18",
|                                               "Value":  "Tasks.Read",
|                                               "DisplayName":  "Read user tasks",
|                                               "Description":  "Allows the app to read user tasks"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ab4f2b77-0b06-4fc1-a9de-02113fc2ab7c",
|                                               "Value":  "Exchange.Manage",
|                                               "DisplayName":  "Manage Exchange configuration",
|                                               "Description":  "Allows the app to manage the organization\u0027s Exchange environment, such as mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles to the app user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a88daf86-d44d-4077-8258-54131dd44e5d",
|                                               "Value":  "People.ReadWrite",
|                                               "DisplayName":  "Read and write users\u0027 relevant people lists (preview)",
|                                               "Description":  "Allows the app to create, read and write to the ranked list of relevant people of the signed-in user. The list includes local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype)."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9478ac54-3753-4543-b95a-4fad24978902",
|                                               "Value":  "People.Read",
|                                               "DisplayName":  "Read users\u0027 relevant people lists (preview)",
|                                               "Description":  "Allows the app to read a ranked list of relevant people of the signed-in user. The list includes local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype)."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6222dbab-a24c-4210-9d91-2f47cf565614",
|                                               "Value":  "User.ReadBasic.All",
|                                               "DisplayName":  "Read all users\u0027 basic profiles",
|                                               "Description":  "Allows the app to read a basic set of profile properties of users in your company or school on behalf of the signed-in user. Includes display name, photo, and email address."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f9408c03-bd3d-48c4-8bee-17a72d20bd9c",
|                                               "Value":  "User.ReadWrite",
|                                               "DisplayName":  "Read and write user profiles",
|                                               "Description":  "Allows the app to create, read, and write a set of the current user\u0027s profile properties in your company or school. Includes display name, photo, and email address."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6223a6d3-53ef-4f8f-982a-895b39483c61",
|                                               "Value":  "User.Read",
|                                               "DisplayName":  "Read user profiles",
|                                               "Description":  "Allows the app to read a set of the current user\u0027s profile properties in your company or school. Includes display name, photo, and email address."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "27235839-268c-4d68-a668-351401ff623a",
|                                               "Value":  "Group.ReadWrite.All",
|                                               "DisplayName":  "Read and write all groups (preview)",
|                                               "Description":  "Allows the app to read group properties. Additionally allows the app to update group properties for groups the signed-in user owns. Also allows the app to read and write group calendar and conversations on public groups and groups the signed-in user is a member of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b5c79e22-9bf2-42d7-b60d-1b95c11ebc66",
|                                               "Value":  "Group.Read.All",
|                                               "DisplayName":  "Read all groups (preview)",
|                                               "Description":  "Allows the app to read group properties on behalf of the signed-in user, and read group calendar and conversations on public groups and groups the signed in user is a member of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "32253599-e142-4cf0-810d-4827eedd1cfa",
|                                               "Value":  "Contacts.ReadWrite",
|                                               "DisplayName":  "Read and write user contacts",
|                                               "Description":  "Allows the app to create, read, update, and delete user contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "181aac24-028a-486e-a649-b3742c74ec71",
|                                               "Value":  "Contacts.Read",
|                                               "DisplayName":  "Read user contacts",
|                                               "Description":  "Allows the app to read user contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "765f423e-b55d-412e-97e3-13a800c3a537",
|                                               "Value":  "Calendars.ReadWrite",
|                                               "DisplayName":  "Read and write user calendars",
|                                               "Description":  "Allows the app to create, read, update, and delete events in user calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5b9be81f-2977-4d27-8faf-bb43af8fc705",
|                                               "Value":  "Calendars.Read",
|                                               "DisplayName":  "Read user calendars",
|                                               "Description":  "Allows the app to read events in user calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5eb43c10-865a-4259-960a-83946678f8dd",
|                                               "Value":  "Mail.Send",
|                                               "DisplayName":  "Send mail as a user",
|                                               "Description":  "Allows the app to send mail as users in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "75767999-c7a8-481e-a6b4-19458e0b30a5",
|                                               "Value":  "Mail.ReadWrite",
|                                               "DisplayName":  "Read and write user mail",
|                                               "Description":  "Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "185758ba-798d-4b72-9e54-429a413a2510",
|                                               "Value":  "Mail.Read",
|                                               "DisplayName":  "Read user mail",
|                                               "Description":  "Allows the app to read email in user mailboxes."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2915e980-bca5-4194-9a3f-71c4ccdbd77b",
|                                               "Value":  "Tasks.ReadWrite.Shared",
|                                               "DisplayName":  "Create, read, update and delete all tasks a user has access to",
|                                               "Description":  "Allows the app to create, read, update and delete all tasks a user has access to"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3d5e9942-27d3-4e96-80b1-696c7a3369c1",
|                                               "Value":  "Tasks.Read.Shared",
|                                               "DisplayName":  "Read all tasks a user has access to",
|                                               "Description":  "Allows the app to read all tasks a user has access to"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d6aa6fa9-3360-416a-b8db-021249d58e86",
|                                               "Value":  "Contacts.Read.Shared",
|                                               "DisplayName":  "Read user and shared contacts ",
|                                               "Description":  "Allows the app to read contacts a user has permissions to access, including their own and shared contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c54cba4f-60fe-4332-b0de-b5990fd1999e",
|                                               "Value":  "Contacts.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write user and shared  contacts ",
|                                               "Description":  "Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1d894596-c906-42b1-8422-9360440c1c0c",
|                                               "Value":  "Mail.Read.Shared",
|                                               "DisplayName":  "Read user and shared mail ",
|                                               "Description":  "Allows the app to read mail a user can access, including their own and shared mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b09ec548-3f99-4d0a-859c-c9b7ff53b7a9",
|                                               "Value":  "Mail.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write user and shared mail ",
|                                               "Description":  "Allows the app to create, read, update, and delete mail a user has permission to access, including their own and shared mail. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "16572339-6149-452b-b084-280b01354687",
|                                               "Value":  "Mail.Send.Shared",
|                                               "DisplayName":  "Send mail on behalf of others",
|                                               "Description":  "Allows the app to send mail as the signed-in user, including sending on-behalf of others."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4585ecca-5b47-432f-ac70-e1391e4951ed",
|                                               "Value":  "Calendars.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write user and shared calendars",
|                                               "Description":  "Allows the app to create, read, update and delete events in all calendars in the organization user has permissions to access. This includes delegate and shared calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c21d8660-9de1-4404-85b6-59695921bd8d",
|                                               "Value":  "Calendars.Read.Shared",
|                                               "DisplayName":  "Read user and shared calendars ",
|                                               "Description":  "Allows the app to read events in all calendars that the user can access, including delegate and shared calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d36ad51d-15a2-458d-9b3a-16dbe4c51c30",
|                                               "Value":  "MailboxSettings.Read",
|                                               "DisplayName":  "Read user mailbox settings ",
|                                               "Description":  "Allows the app to read user\u0027s mailbox settings. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9b005f11-86f0-45f7-8c27-4fff5d849916",
|                                               "Value":  "User.ReadBasic.All",
|                                               "DisplayName":  "Read all users\u0027 basic profiles",
|                                               "Description":  "Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eb665d05-7f76-4d1b-b176-1cfc814e668d",
|                                               "Value":  "User.Read.All",
|                                               "DisplayName":  "Read all users\u0027 full profiles",
|                                               "Description":  "Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3b5f3d61-589b-4a3c-a359-5dd4b5ee5bd5",
|                                               "Value":  "EWS.AccessAsUser.All",
|                                               "DisplayName":  "Access mailboxes as the signed-in user via Exchange Web Services",
|                                               "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via Exchange Web Services."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1b69a6c3-108d-42d0-a3ec-fafcd610e80b",
|                                               "Value":  "Notes.ReadWrite",
|                                               "DisplayName":  "Create, read, update and delete user notes",
|                                               "Description":  "Allows the app to create, read, update and delete user notes"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "505d82a7-24f3-4632-bffc-4d21625b31de",
|                                               "Value":  "Notes.Read",
|                                               "DisplayName":  "Read user notes",
|                                               "Description":  "Allows the app to read user notes"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dab085de-3e14-432f-a47f-84b6457059c4",
|                                               "Value":  "Mail.ReadBasic",
|                                               "DisplayName":  "Read user basic mail",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s mailbox except body, previewBody, attachments and any extended properties."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1d490c92-d2ca-4a30-b52e-6edf5f279f4d",
|                                               "Value":  "Organization.Read.All",
|                                               "DisplayName":  "Organization.Read.All",
|                                               "Description":  "Allows the app to read the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed SKUs and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "17f07f5d-fb80-4278-ba37-70ae04d476a3",
|                                               "Value":  "Organization.ReadWrite.All",
|                                               "DisplayName":  "Organization.ReadWrite.All",
|                                               "Description":  "Allows the app to read and write the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed SKUs and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bbbcc29c-7bd7-48f0-8c8b-ef5f9865b626",
|                                               "Value":  "ReportingWebService.Read",
|                                               "DisplayName":  "ReportingWebService.Read",
|                                               "Description":  "Download reports via the Office 365 reporting web service"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5430838e-68e7-4b12-b353-06478ace39c3",
|                                               "Value":  "PeopleSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write tenant-wide people settings",
|                                               "Description":  "Allows the application to read and write tenant-wide people settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e1eeeffa-b5a5-4b80-ae8f-ccb93d4b75eb",
|                                               "Value":  "PeopleSettings.Read.All",
|                                               "DisplayName":  "Read tenant-wide people settings",
|                                               "Description":  "Allows the application to read tenant-wide people settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "806d1b36-e37b-4f02-9c9e-a1269982b2aa",
|                                               "Value":  "SharePointCrossTenantMigration.Manage.All",
|                                               "DisplayName":  "Read, write and manage Cross-Tenant migration settings and tasks",
|                                               "Description":  "Read, write and manage Cross-Tenant migration settings and tasks, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8cfb5122-1118-41e2-b9f2-8ab21a06c030",
|                                               "Value":  "SharePointCrossTenantMigration.Read.All",
|                                               "DisplayName":  "Read Cross-Tenant migration settings and tasks",
|                                               "Description":  "Read Cross-Tenant migration settings and tasks, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dfe5a59c-77fe-436b-9a47-375a284cf302",
|                                               "Value":  "Migration.ReadWrite.All",
|                                               "DisplayName":  "Read and write access to migration data on the SharePoint admin site",
|                                               "Description":  "Allows the app to read and write migration data via the SharePoint admin site without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b7155856-e8b7-4ba1-bf43-8c9912353676",
|                                               "Value":  "Migration.Read.All",
|                                               "DisplayName":  "Read access to migration data on the SharePoint admin site",
|                                               "Description":  "Allows the app to read migration data via the SharePoint admin site without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e512dd2e-d13a-4816-9202-d3ef0357c7b1",
|                                               "Value":  "TenantReports.ReadWrite.All",
|                                               "DisplayName":  "Read and write access to tenant report data on the SharePoint admin site",
|                                               "Description":  "Allows the app to read and write tenant reports via the SharePoint admin site without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3cc23ca2-bb9d-42cd-9802-f792b98bac3b",
|                                               "Value":  "TenantReports.Read.All",
|                                               "DisplayName":  "Read access to tenant report data on the SharePoint admin site",
|                                               "Description":  "Allows the app to read tenant reports via the SharePoint admin site without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6d004c19-cc42-41ea-8888-cce2fc5bd2c5",
|                                               "Value":  "SitesMetadataAdmin.ReadWrite.All",
|                                               "DisplayName":  "Read and write access to site collection metadata on the SharePoint admin site",
|                                               "Description":  "Allows the app to read and write site collection metadata without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1ee80186-f376-4677-b0be-fbad73a4a9ea",
|                                               "Value":  "SitesMetadataAdmin.Read.All",
|                                               "DisplayName":  "Read access to site collection metadata on the SharePoint admin site",
|                                               "Description":  "Allows the app to read site collection metadata without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fbcd29d2-fcca-4405-aded-518d457caae4",
|                                               "Value":  "Sites.ReadWrite.All",
|                                               "DisplayName":  "Read and write items in all site collections",
|                                               "Description":  "Allows the app to create, read, update, and delete documents and list items in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d13f72ca-a275-4b96-b789-48ebcc4da984",
|                                               "Value":  "Sites.Read.All",
|                                               "DisplayName":  "Read items in all site collections",
|                                               "Description":  "Allows the app to read documents and list items in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "678536fe-1083-478a-9c59-b99265e6b0d3",
|                                               "Value":  "Sites.FullControl.All",
|                                               "DisplayName":  "Have full control of all site collections",
|                                               "Description":  "Allows the app to have full control of all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9bff6588-13f2-4c48-bbf2-ddab62256b36",
|                                               "Value":  "Sites.Manage.All",
|                                               "DisplayName":  "Read and write items and lists in all site collections",
|                                               "Description":  "Allows the app to read, create, update, and delete document libraries and lists in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2a8d57a5-4090-4a41-bf1c-3c621d2ccad3",
|                                               "Value":  "TermStore.Read.All",
|                                               "DisplayName":  "Read managed metadata",
|                                               "Description":  "Allows the app to read enterprise managed metadata and to read basic site info without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c8e3537c-ec53-43b9-bed3-b2bd3617ae97",
|                                               "Value":  "TermStore.ReadWrite.All",
|                                               "DisplayName":  "Read and write managed metadata",
|                                               "Description":  "Allows the app to write enterprise managed metadata and to read basic site info without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "741f803b-c850-494e-b5df-cde7c675a1ca",
|                                               "Value":  "User.ReadWrite.All",
|                                               "DisplayName":  "Read and write user profiles",
|                                               "Description":  "Allows the app to read and update user profiles and to read basic site info without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "df021288-bdef-4463-88db-98f22de89214",
|                                               "Value":  "User.Read.All",
|                                               "DisplayName":  "Read user profiles",
|                                               "Description":  "Allows the app to read user profiles without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "20d37865-089c-4dee-8c41-6967602d4ac8",
|                                               "Value":  "Sites.Selected",
|                                               "DisplayName":  "Access selected site collections",
|                                               "Description":  "Allow the application to access a subset of site collections without a signed in user. The specific site collections and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ee5c91f0-be0b-463e-85c9-57f0514c3d29",
|                                               "Value":  "SitesMetadataAdmin.Read.All",
|                                               "DisplayName":  "Can view site collection metadata from the admin site",
|                                               "Description":  "Allows the app to read site collection metadata using the SharePoint admin site, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9aaa3660-6678-4cb8-b4b5-be92b6f4fbf0",
|                                               "Value":  "SitesMetadataAdmin.ReadWrite.All",
|                                               "DisplayName":  "Can view and edit site collection metadata from the admin site",
|                                               "Description":  "Allows the app to read and write site collection metadata using the SharePoint admin site, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "97533022-c395-42ce-bcf7-7d554ac912fc",
|                                               "Value":  "TenantReports.Read.All",
|                                               "DisplayName":  "Can view tenant reports from the admin site",
|                                               "Description":  "Allows the app to read tenant reports via the SharePoint admin site, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fb471c34-3a48-412f-969b-e2b9bc071042",
|                                               "Value":  "TenantReports.ReadWrite.All",
|                                               "DisplayName":  "Can view and edit tenant reports from the admin site",
|                                               "Description":  "Allows the app to read and write tenant reports via the SharePoint admin site, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f569098d-1005-4cc6-a812-3bdccdcfbb98",
|                                               "Value":  "Migration.Read.All",
|                                               "DisplayName":  "Can view migration data from the admin site",
|                                               "Description":  "Allows the app to read migration data using the SharePoint admin site, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1a50df37-8278-4139-9af3-3b60d57dd007",
|                                               "Value":  "Migration.ReadWrite.All",
|                                               "DisplayName":  "Can view and edit migration data from the admin site",
|                                               "Description":  "Allows the app to read and write migration data using the SharePoint admin site, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9ac4404a-0323-446d-b334-b4ae4d18b38a",
|                                               "Value":  "Sites.Selected",
|                                               "DisplayName":  "Access selected site collections",
|                                               "Description":  "Allows the app to access a subset of site collections with a signed-in user. The specific site collections and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2cfdc887-d7b4-4798-9b33-3d98d6b95dd2",
|                                               "Value":  "MyFiles.Write",
|                                               "DisplayName":  "Read and write user files",
|                                               "Description":  "Allows the app to read, create, update, and delete the current user\u0027s files."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dd2c8d78-58e1-46d7-82dd-34d411282686",
|                                               "Value":  "MyFiles.Read",
|                                               "DisplayName":  "Read user files",
|                                               "Description":  "Allows the app to read the current user\u0027s files."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "56680e0d-d2a3-4ae1-80d8-3c4f2100e3d0",
|                                               "Value":  "AllSites.FullControl",
|                                               "DisplayName":  "Have full control of all site collections",
|                                               "Description":  "Allows the app to have full control of all site collections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b3f70a70-8a4b-4f95-9573-d71c496a53f4",
|                                               "Value":  "AllSites.Manage",
|                                               "DisplayName":  "Read and write items and lists in all site collections",
|                                               "Description":  "Allows the app to read, create, update, and delete document libraries and lists in all site collections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "640ddd16-e5b7-4d71-9690-3f4022699ee7",
|                                               "Value":  "AllSites.Write",
|                                               "DisplayName":  "Read and write items in all site collections",
|                                               "Description":  "Allows the app to create, read, update, and delete documents and list items in all site collections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4e0d77b0-96ba-4398-af14-3baa780278f4",
|                                               "Value":  "AllSites.Read",
|                                               "DisplayName":  "Read items in all site collections",
|                                               "Description":  "Allows the app to read documents and list items in all site collections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1002502a-9a71-4426-8551-69ab83452fab",
|                                               "Value":  "Sites.Search.All",
|                                               "DisplayName":  "Run search queries as a user",
|                                               "Description":  "Allows the app to run search queries and to read basic site info on behalf of the current signed-in user. Search results are based on the user\u0027s permissions instead of the app\u0027s permissions."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "59a198b5-0420-45a8-ae59-6da1cb640505",
|                                               "Value":  "TermStore.ReadWrite.All",
|                                               "DisplayName":  "Read and write managed metadata",
|                                               "Description":  "Allows the app to read, create, update, and delete managed metadata and to read basic site info on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a468ea40-458c-4cc2-80c4-51781af71e41",
|                                               "Value":  "TermStore.Read.All",
|                                               "DisplayName":  "Read managed metadata",
|                                               "Description":  "Allows the app to read managed metadata and to read basic site info on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5b625b3d-65b6-4fb0-85d9-8a5aa26bdf36",
|                                               "Value":  "SharePointCrossTenantMigration.Manage.All",
|                                               "DisplayName":  "Read, write and manage Cross-Tenant migration settings and tasks",
|                                               "Description":  "Read, write and manage Cross-Tenant migration settings and tasks, on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8d11884e-6820-4673-a5d6-64d2a68b311e",
|                                               "Value":  "SharePointCrossTenantMigration.Read.All",
|                                               "DisplayName":  "Read Cross-Tenant migration settings and tasks",
|                                               "Description":  "Read Cross-Tenant migration settings and tasks, on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a4c14cd7-8bd6-4337-8e87-78623dfc023b",
|                                               "Value":  "ProjectWebAppReporting.Read",
|                                               "DisplayName":  "Read ProjectWebApp OData reporting data",
|                                               "Description":  "Allows the app to read all OData reporting data from all ProjectWebApp site collections for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c4258712-0efb-41f1-b6bc-be58e4e32f3f",
|                                               "Value":  "TaskStatus.Submit",
|                                               "DisplayName":  "Submit project task status updates",
|                                               "Description":  "Allows the app to submit project task status updates the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2511a087-5795-4cae-9123-d5b7d6ec4844",
|                                               "Value":  "EnterpriseResource.Write",
|                                               "DisplayName":  "Read and write user project enterprise resources",
|                                               "Description":  "Allows the app to read, create, update, and delete the current user’s enterprise resources."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b8341dab-4143-49da-8eb9-3d8c073f9e77",
|                                               "Value":  "EnterpriseResource.Read",
|                                               "DisplayName":  "Read user project enterprise resources",
|                                               "Description":  "Allows the app to read the current user\u0027s enterprise resources."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d75a7b17-f04e-40d9-8e35-79b949bdb891",
|                                               "Value":  "Project.Write",
|                                               "DisplayName":  "Read and write user projects",
|                                               "Description":  "Allows the app to read, create, update, and delete the current users’ projects."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2beb830c-70d1-4f5b-a983-79cbdb0c6c6a",
|                                               "Value":  "Project.Read",
|                                               "DisplayName":  "Read user projects",
|                                               "Description":  "Allows the app to read the current user\u0027s projects."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e7e732bd-932b-45c4-8ce5-40d60a7daad9",
|                                               "Value":  "ProjectWebApp.FullControl",
|                                               "DisplayName":  "Have full control of all ProjectWebApp site collections",
|                                               "Description":  "Allows the app to have full control of all ProjectWebApp site collections the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "82866913-39a9-4be7-8091-f4fa781088ae",
|                                               "Value":  "User.ReadWrite.All",
|                                               "DisplayName":  "Read and write user profiles",
|                                               "Description":  "Allows the app to read and update user profiles and to read basic site info on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0cea5a30-f6f8-42b5-87a0-84cc26822e02",
|                                               "Value":  "User.Read.All",
|                                               "DisplayName":  "Read user profiles",
|                                               "Description":  "Allows the app to read user profiles and to read basic site info on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Skype for Business Online",
|                                               "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b783bde8-ffc2-4f0c-96ce-6e2900b7aa4e",
|                                               "Value":  "Anonymous",
|                                               "DisplayName":  "Guest user join services (preview)",
|                                               "Description":  "Allows the app create an on-demand Skype meeting and join guest users into Skype for Business services"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Skype for Business Online",
|                                               "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e821ef97-a9f6-4c9e-bb6a-29fa0d8f6101",
|                                               "Value":  "Meetings.JoinManage",
|                                               "DisplayName":  "Join and Manage Skype Meetings (preview)",
|                                               "Description":  "Allows the app to join and manage Skype meetings"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Skype for Business Online",
|                                               "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f7a521bb-ae17-42df-8096-97ebcc8b4edb",
|                                               "Value":  "Conversations.Chat",
|                                               "DisplayName":  "Send/Receive Instant Messages (preview)",
|                                               "Description":  "Allows the app to send and receive instant messages; and manage instant messaging service scenarios"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Skype for Business Online",
|                                               "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "30a91c70-863f-4a08-b01c-6c1d78685414",
|                                               "Value":  "Conversations.PSTN",
|                                               "DisplayName":  "Send/Receive PSTN (preview)",
|                                               "Description":  "Allows the app to send and receive voice calls; and manage PSTN service scenarios"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Skype for Business Online",
|                                               "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "05a4e3e8-cfa6-4934-bb91-b6fc4ce6f340",
|                                               "Value":  "Conversations.AudioVideo",
|                                               "DisplayName":  "Send/Receive Audio and Video (preview)",
|                                               "Description":  "Allows the app to send and receive audio and video; and manage audio/video service scenarios"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Skype for Business Online",
|                                               "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "189125ec-ea35-4135-b00a-e51472464beb",
|                                               "Value":  "Meetings.ScheduleOnDemand",
|                                               "DisplayName":  "Create on-demand Skype meetings (preview)",
|                                               "Description":  "Allows the app to create on-demand Skype meetings (short term expiry)"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Dataverse",
|                                               "AppId":  "00000007-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a4c5bee6-25ff-4bb5-b926-b7eb8062ae7a",
|                                               "Value":  "mcp.tools",
|                                               "DisplayName":  "Access Dataverse MCP tools as organization users",
|                                               "Description":  "Allows the application to access Dataverse MCP tools as organization users"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Dataverse",
|                                               "AppId":  "00000007-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "78ce3f0f-a1ce-49c2-8cde-64b5c0896db4",
|                                               "Value":  "user_impersonation",
|                                               "DisplayName":  "Access Common Data Service as organization users",
|                                               "Description":  "Allows the application to access Common Data Service acting as users in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Azure Resource Manager",
|                                               "AppId":  "797f4846-ba00-4fd7-ba43-dac1f8f63013",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "41094075-9dad-400e-a0bd-54e686782033",
|                                               "Value":  "user_impersonation",
|                                               "DisplayName":  "Access Azure Resource Manager as organization users",
|                                               "Description":  "Allows the application to access Azure Resource Manager acting as users in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Intune",
|                                               "AppId":  "0000000a-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e323f13a-1fcc-49cc-883f-c6da13ae0542",
|                                               "Value":  "MicrosoftTunnelGatewayEnrollment",
|                                               "DisplayName":  "MicrosoftTunnelGatewayEnrollment",
|                                               "Description":  "Allows Intune Admins to enroll a Microsoft Tunnel Gateway Agent"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "654b31ae-d941-4e22-8798-7add8fdf049f",
|                                               "Value":  "Tenant.Read.All",
|                                               "DisplayName":  "View all content in tenant",
|                                               "Description":  "The app can view all content in the tenant without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "28379fa9-8596-4fd9-869e-cb60a93b5d84",
|                                               "Value":  "Tenant.ReadWrite.All",
|                                               "DisplayName":  "Read and write all content in tenant",
|                                               "Description":  "The app can create, edit, view, and delete all content in the tenant without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "debb9ba3-fb14-491a-884c-b4406ac079f5",
|                                               "Value":  "CatalogMirroring.Read.All",
|                                               "DisplayName":  "Read Iceberg and Delta table catalog metadata from the provider",
|                                               "Description":  "Allows reading Iceberg and Delta table catalog metadata from the external provider on the users behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "04994edc-428b-482b-af95-ee1575dde39b",
|                                               "Value":  "Fabric.Embed",
|                                               "DisplayName":  "Embed Fabric items, retrieve user identifiers and restricted metadata",
|                                               "Description":  "Allows retrieving item definitions, user identifiers, and other restricted metadata required for embedding Fabric items on the user’s behalf. To embed, the app must also be granted the appropriate contextual scope(s), such as Item.Read.All, Notebook.Read.All, or Workspace.Read.All."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c595891f-110c-4524-abce-fa7b97bc7c65",
|                                               "Value":  "Catalog.Read.All",
|                                               "DisplayName":  "Read catalog",
|                                               "Description":  "Allows reading catalog on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6213ab68-aad6-4ec9-836a-306b14f6fee6",
|                                               "Value":  "Item.Audit.All",
|                                               "DisplayName":  "Make API calls that require audit permissions on all items",
|                                               "Description":  "Allows the app to make API calls that require audit permissions on all items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6cadaf62-a218-4d72-a641-0f85c813ece3",
|                                               "Value":  "DatabricksCatalog.Read.All",
|                                               "DisplayName":  "Read Databricks workspaces catalog metadata.",
|                                               "Description":  "Allows reading Databricks workspaces catalog metadata on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1318ed2f-75ad-4748-b33a-d49044214bdb",
|                                               "Value":  "Eventhouse.Reshare.All",
|                                               "DisplayName":  "Eventhouse.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0a5f551e-003b-482b-b5fb-7124a9510ba1",
|                                               "Value":  "Eventhouse.Execute.All",
|                                               "DisplayName":  "Eventhouse.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b13393d0-9253-4ca8-be5a-be145f337ea3",
|                                               "Value":  "Eventhouse.ReadWrite.All",
|                                               "DisplayName":  "Read and write eventhouses",
|                                               "Description":  "Allows modifying eventhouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cd1718e4-3e09-4381-a6e1-183e245f8613",
|                                               "Value":  "Eventhouse.Read.All",
|                                               "DisplayName":  "Read eventhouses",
|                                               "Description":  "Allows reading eventhouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d95f0afe-0ace-431b-9741-b29d7a02e19b",
|                                               "Value":  "RetailDataManager.Reshare.All",
|                                               "DisplayName":  "RetailDataManager.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5793b2af-bc3b-4f1d-bbb1-9a3e359dd8e1",
|                                               "Value":  "RetailDataManager.Execute.All",
|                                               "DisplayName":  "RetailDataManager.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e87305de-874c-4fb9-a7c1-fff664dc5d6e",
|                                               "Value":  "RetailDataManager.ReadWrite.All",
|                                               "DisplayName":  "Read and write retail data manager items",
|                                               "Description":  "Allows modifying retail data manager items on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1ddcbaa9-c4cf-4684-9048-e04a12739a8c",
|                                               "Value":  "RetailDataManager.Read.All",
|                                               "DisplayName":  "Read retail data manager items",
|                                               "Description":  "Allows reading retail data manager items on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bcd38192-b0a2-4c40-bc0e-5728ec6ee69d",
|                                               "Value":  "Dashboard.Execute.All",
|                                               "DisplayName":  "Dashboard.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e5c15c39-f5e8-45b2-b858-edba09abc583",
|                                               "Value":  "SQLEndpoint.ReadWrite.All",
|                                               "DisplayName":  "Read and write SQL endpoints",
|                                               "Description":  "Allows modifying SQL endpoints on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9afd59c7-4e4d-4a5d-b2aa-2777debb5cd9",
|                                               "Value":  "DataPipeline.Reshare.All",
|                                               "DisplayName":  "DataPipeline.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d7629fc2-75c0-412f-9c11-052513f055ae",
|                                               "Value":  "Warehouse.Reshare.All",
|                                               "DisplayName":  "Warehouse.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "15a808d7-2065-4357-8b76-47f701df3575",
|                                               "Value":  "SQLEndpoint.Reshare.All",
|                                               "DisplayName":  "SQLEndpoint.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "868c9b47-9e35-4c69-bac3-042213ef72a3",
|                                               "Value":  "SemanticModel.Reshare.All",
|                                               "DisplayName":  "SemanticModel.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "62816fca-afaa-44af-abd6-9e8f604d8dbb",
|                                               "Value":  "Scorecard.Reshare.All",
|                                               "DisplayName":  "Scorecard.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b510092a-d399-45f3-b1d5-4e2d34c87997",
|                                               "Value":  "PaginatedReport.Reshare.All",
|                                               "DisplayName":  "PaginatedReport.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "49dd4a50-f26f-4cc8-b895-227eb620861d",
|                                               "Value":  "SparkJobDefinition.Reshare.All",
|                                               "DisplayName":  "SparkJobDefinition.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "54f4913d-63d6-4256-a270-f16a6222e625",
|                                               "Value":  "Report.Reshare.All",
|                                               "DisplayName":  "Report.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9ff20ed3-e70b-486e-9686-006be349a5d6",
|                                               "Value":  "Notebook.Reshare.All",
|                                               "DisplayName":  "Notebook.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5a93e9d0-4312-4fad-bbb5-44c74a75083a",
|                                               "Value":  "MLModel.Reshare.All",
|                                               "DisplayName":  "Reshare ML models",
|                                               "Description":  "Allows resharing ML models on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2d3aa07c-d364-4ce0-acbc-b7e151ee161d",
|                                               "Value":  "KQLQueryset.Reshare.All",
|                                               "DisplayName":  "KQLQueryset.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7504609f-c495-4c64-8542-686125a5a36f",
|                                               "Value":  "Report.ReadWrite.All",
|                                               "DisplayName":  "Read and write reports",
|                                               "Description":  "Allows modifying reports on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4ae1bf56-f562-4747-b7bc-2fa0874ed46f",
|                                               "Value":  "Report.Read.All",
|                                               "DisplayName":  "Read reports",
|                                               "Description":  "Allows reading reports on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b271f05e-8329-4b97-baa4-91cf15b99cf1",
|                                               "Value":  "Dashboard.ReadWrite.All",
|                                               "DisplayName":  "Read and write dashboards",
|                                               "Description":  "Allows modifying dashboards on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ddd37690-e119-40c5-a821-3746ea6125c4",
|                                               "Value":  "Dataflow.ReadWrite.All",
|                                               "DisplayName":  "Read and write dataflows",
|                                               "Description":  "Allows modifying dataflows on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f9759906-80a4-4f4a-b010-24b832bc6a30",
|                                               "Value":  "Dataflow.Read.All",
|                                               "DisplayName":  "Read dataflows",
|                                               "Description":  "Allows reading dataflows on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0a25ca24-b130-4a32-affd-29d640b63f14",
|                                               "Value":  "Notebook.Read.All",
|                                               "DisplayName":  "Read notebooks",
|                                               "Description":  "Allows reading notebooks on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "13060bfd-9305-4ec6-8388-8916580f4fa9",
|                                               "Value":  "Lakehouse.Read.All",
|                                               "DisplayName":  "Read lakehouses",
|                                               "Description":  "Allows reading lakehouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eee83281-2212-467d-b9e3-2aadfb170f33",
|                                               "Value":  "Lakehouse.ReadWrite.All",
|                                               "DisplayName":  "Read and write lakehouses",
|                                               "Description":  "Allows modifying lakehouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ec20a3e3-8c0b-4d75-8d1b-a9ffdbbe2519",
|                                               "Value":  "SparkJobDefinition.ReadWrite.All",
|                                               "DisplayName":  "Read and write spark job definitions",
|                                               "Description":  "Allows modifying spark job definitions on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "179809f0-8b05-4f65-bdd0-920fb4945c33",
|                                               "Value":  "MLExperiment.Read.All",
|                                               "DisplayName":  "Read ML experiments",
|                                               "Description":  "Allows reading ML experiments on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e4f65fe4-b466-4254-89ea-2fcdc8d8ac49",
|                                               "Value":  "MLExperiment.ReadWrite.All",
|                                               "DisplayName":  "Read and write ML experiments",
|                                               "Description":  "Allows modifying ML experiments on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5d9a285a-0847-4aa7-a9db-4991dedc2b53",
|                                               "Value":  "MLModel.Read.All",
|                                               "DisplayName":  "Read ML models",
|                                               "Description":  "Allows reading ML models on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2cb667b2-c449-4f2d-a1ad-e0ffa27b5d75",
|                                               "Value":  "MLModel.ReadWrite.All",
|                                               "DisplayName":  "Read and write ML models",
|                                               "Description":  "Allows modifying ML models on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b02aa3b5-6fb3-48b8-803a-57bdef45d20c",
|                                               "Value":  "Notebook.ReadWrite.All",
|                                               "DisplayName":  "Read and write notebooks",
|                                               "Description":  "Allows modifying notebooks on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8191607d-cbe5-49c6-b480-1aae71f3dce6",
|                                               "Value":  "KQLDataConnection.Reshare.All",
|                                               "DisplayName":  "KQLDataConnection.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "83a35b59-6a34-40f4-ac4e-5bf5a6ff9a5d",
|                                               "Value":  "KQLDatabase.Reshare.All",
|                                               "DisplayName":  "KQLDatabase.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ff4d87c4-a161-49a8-a886-fe14bf6a2203",
|                                               "Value":  "Eventstream.Reshare.All",
|                                               "DisplayName":  "Eventstream.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "44abf802-73c1-42f4-a26f-915b4c27fa8f",
|                                               "Value":  "Datamart.Reshare.All",
|                                               "DisplayName":  "Datamart.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "27296d33-1a83-44d6-9665-63f4902781f9",
|                                               "Value":  "MLExperiment.Reshare.All",
|                                               "DisplayName":  "MLExperiment.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "881e9f00-4e9c-4798-bc50-832fea2cdbe6",
|                                               "Value":  "Lakehouse.Reshare.All",
|                                               "DisplayName":  "Lakehouse.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ad056abd-4839-4bb1-ba68-ffcf8194a869",
|                                               "Value":  "Dataflow.Reshare.All",
|                                               "DisplayName":  "Dataflow.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c67b16d3-b5b8-4c87-8ca0-a8e00c6d6ff3",
|                                               "Value":  "Dashboard.Reshare.All",
|                                               "DisplayName":  "Dashboard.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d17eaf78-91ce-4314-9101-868b933996fb",
|                                               "Value":  "Warehouse.Execute.All",
|                                               "DisplayName":  "Execute warehouses",
|                                               "Description":  "Allows executing warehouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "aa70d616-e57e-4a5a-84cd-07de4250dd2e",
|                                               "Value":  "SQLEndpoint.Execute.All",
|                                               "DisplayName":  "SQLEndpoint.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "42b94671-298c-48a0-a55d-077e48186883",
|                                               "Value":  "SemanticModel.Execute.All",
|                                               "DisplayName":  "SemanticModel.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dc75a12a-fef2-436d-8311-fed5b7e3a9d0",
|                                               "Value":  "Scorecard.Execute.All",
|                                               "DisplayName":  "Scorecard.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4aaafe5b-1b27-4403-88f2-e3ebbb8bccc5",
|                                               "Value":  "PaginatedReport.Execute.All",
|                                               "DisplayName":  "PaginatedReport.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b0a64161-0e6a-4f7c-aa14-a1f9413136f3",
|                                               "Value":  "Report.Execute.All",
|                                               "DisplayName":  "Report.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b84b0d8d-9870-4b2b-92d2-9bfa7f940db3",
|                                               "Value":  "KQLQueryset.Execute.All",
|                                               "DisplayName":  "KQLQueryset.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6872ffe8-d8d4-46f9-9a32-5537dad08dd2",
|                                               "Value":  "KQLDataConnection.Execute.All",
|                                               "DisplayName":  "KQLDataConnection.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "21b4da43-510a-43ac-afd4-580e1e2c09c8",
|                                               "Value":  "KQLDatabase.Execute.All",
|                                               "DisplayName":  "Execute KQL databases",
|                                               "Description":  "Allows executing KQL databases on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "110e2f5f-6226-4c3f-8d02-4b30b33e5fd1",
|                                               "Value":  "Eventstream.Execute.All",
|                                               "DisplayName":  "Eventstream.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "17cddc84-5ff7-4b6a-a017-632384c5e063",
|                                               "Value":  "Datamart.Execute.All",
|                                               "DisplayName":  "Datamart.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6b03f425-0a8e-4c54-ba35-df73806f1396",
|                                               "Value":  "MLModel.Execute.All",
|                                               "DisplayName":  "Execute ML models",
|                                               "Description":  "Allows executing ML models on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3101f5b2-b314-4bbd-a1f6-8a05f94f33ea",
|                                               "Value":  "MLExperiment.Execute.All",
|                                               "DisplayName":  "Execute ML experiments",
|                                               "Description":  "Allows executing ML experiments on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "529939f7-18e3-4be4-ba92-b01894a4fadf",
|                                               "Value":  "Dataflow.Execute.All",
|                                               "DisplayName":  "Execute dataflows",
|                                               "Description":  "Allows executing dataflows on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b13a1be2-e407-47b5-8429-12f4ad4f9fcd",
|                                               "Value":  "Scorecard.ReadWrite.All",
|                                               "DisplayName":  "Scorecard.ReadWrite (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e93694df-fa72-4011-aad8-f3648588c762",
|                                               "Value":  "PaginatedReport.Read.All",
|                                               "DisplayName":  "Read paginated reports",
|                                               "Description":  "Allows reading paginated reports on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8826b95a-bc76-4025-97f1-8c89c3d5f210",
|                                               "Value":  "KQLQueryset.Read.All",
|                                               "DisplayName":  "Read KQL querysets",
|                                               "Description":  "Allows reading KQL querysets on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "24367f1a-a6d6-410d-b438-378ed19cb875",
|                                               "Value":  "KQLDatabase.Read.All",
|                                               "DisplayName":  "Read KQL databases",
|                                               "Description":  "Allows reading KQL databases on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5ce2a0b7-2512-440d-bf05-d5db590cc4c7",
|                                               "Value":  "Eventstream.Read.All",
|                                               "DisplayName":  "Read eventstreams",
|                                               "Description":  "Allows reading eventstreams on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3492d2fc-251d-4a2b-8be4-97f06fd6d0d4",
|                                               "Value":  "SparkJobDefinition.Execute.All",
|                                               "DisplayName":  "Execute spark job definitions",
|                                               "Description":  "Allows executing spark job definitions on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3e801746-e22a-4fcb-a3f5-315ace8e165a",
|                                               "Value":  "Notebook.Execute.All",
|                                               "DisplayName":  "Execute notebooks",
|                                               "Description":  "Allows executing notebooks on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "565b3968-767c-4100-8771-a827146f38ce",
|                                               "Value":  "Lakehouse.Execute.All",
|                                               "DisplayName":  "Execute lakehouses",
|                                               "Description":  "Allows executing lakehouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6f4dd5b6-1369-4aef-a71b-8a734a9e0a20",
|                                               "Value":  "Warehouse.Read.All",
|                                               "DisplayName":  "Read warehouses",
|                                               "Description":  "Allows reading warehouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d2090f0b-c876-45ea-b6fa-785e7ef84788",
|                                               "Value":  "SemanticModel.Read.All",
|                                               "DisplayName":  "Read semantic models",
|                                               "Description":  "Allows reading semantic models on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "91f75836-b68c-4fff-84db-4372412a2c82",
|                                               "Value":  "Datamart.Read.All",
|                                               "DisplayName":  "Read datamarts",
|                                               "Description":  "Allows reading datamarts on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "88ba374a-d581-4944-b7c7-1181754eba74",
|                                               "Value":  "KQLQueryset.ReadWrite.All",
|                                               "DisplayName":  "Read and write KQL querysets",
|                                               "Description":  "Allows modifying KQL querysets on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dbc7f8f6-3822-41e6-aebd-5a79e2ddc72a",
|                                               "Value":  "SQLEndpoint.Read.All",
|                                               "DisplayName":  "Read SQL endpoints",
|                                               "Description":  "Allows reading SQL endpoints on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "726667b1-01a6-4be4-b04c-e95eae4023a8",
|                                               "Value":  "KQLDatabase.ReadWrite.All",
|                                               "DisplayName":  "Read and write KQL databases",
|                                               "Description":  "Allows modifying KQL databases on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bd305576-f504-4e9a-81d4-d16c7eb5334b",
|                                               "Value":  "Eventstream.ReadWrite.All",
|                                               "DisplayName":  "Read and write eventstreams",
|                                               "Description":  "Allows modifying eventstreams on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a405c0f7-5d2f-4e19-8db7-7323bae0b3c3",
|                                               "Value":  "PaginatedReport.ReadWrite.All",
|                                               "DisplayName":  "Read and write paginated reports",
|                                               "Description":  "Allows modifying paginated reports on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "35735863-502b-4a11-8f65-b0bbe7ec8e95",
|                                               "Value":  "Warehouse.ReadWrite.All",
|                                               "DisplayName":  "Read and write warehouses",
|                                               "Description":  "Allows modifying warehouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9e7c970c-1dc5-482d-b2a1-2a4fed211921",
|                                               "Value":  "SemanticModel.ReadWrite.All",
|                                               "DisplayName":  "Read and write semantic models",
|                                               "Description":  "Allows modifying semantic models on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6098cd04-d625-4e1c-91d6-f7888f645256",
|                                               "Value":  "Datamart.ReadWrite.All",
|                                               "DisplayName":  "Read and write datamarts",
|                                               "Description":  "Allows modifying datamarts on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2448370f-f988-42cd-909c-6528efd67c1a",
|                                               "Value":  "Dashboard.Read.All",
|                                               "DisplayName":  "Read dashboards",
|                                               "Description":  "Allows reading dashboards on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "346e63ff-7cb8-4d86-9f6b-c9212f86a719",
|                                               "Value":  "Connection.Reshare.All",
|                                               "DisplayName":  "Connection.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "80a4f621-10a7-45e5-a961-79e9b81831d0",
|                                               "Value":  "Environment.Read.All",
|                                               "DisplayName":  "Read environment items",
|                                               "Description":  "Allows reading environment items on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "995d4201-6a2d-45c6-bad2-9f2aba89298d",
|                                               "Value":  "Environment.ReadWrite.All",
|                                               "DisplayName":  "Read and write environment items",
|                                               "Description":  "Allows modifying environment items on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "72e814f5-a6b9-4316-b2ca-d07f426c178c",
|                                               "Value":  "Environment.Reshare.All",
|                                               "DisplayName":  "Environment.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7a638d43-6e2d-4bf0-bffd-477785a2c721",
|                                               "Value":  "Environment.Execute.All",
|                                               "DisplayName":  "Environment.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1cc6e528-a407-4de1-883e-e36b91e09379",
|                                               "Value":  "SQLDatabase.Read.All",
|                                               "DisplayName":  "Read SQL databases",
|                                               "Description":  "Allows reading SQL databases on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e4a4166c-b39f-4956-96ee-52ae6f1242e8",
|                                               "Value":  "SQLDatabase.ReadWrite.All",
|                                               "DisplayName":  "Read and write SQL databases",
|                                               "Description":  "Allows modifying SQL databases on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f87561dd-6f31-48ab-bcca-d3cec4564562",
|                                               "Value":  "SQLDatabase.Execute.All",
|                                               "DisplayName":  "SQLDatabase.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7cbb226f-a463-4f7e-b085-d11f68dac9ee",
|                                               "Value":  "SQLDatabase.Reshare.All",
|                                               "DisplayName":  "SQLDatabase.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "64f9ad72-16e9-49c9-b691-1cb7545560c3",
|                                               "Value":  "UserDataFunction.Read.All",
|                                               "DisplayName":  "Read user data function items",
|                                               "Description":  "Allows reading user data function items on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9a69fd02-6f0f-4945-bd56-33a4a01f887d",
|                                               "Value":  "UserDataFunction.ReadWrite.All",
|                                               "DisplayName":  "Read and write user data function items",
|                                               "Description":  "Allows modifying user data function items on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2a34e79d-bc8c-40b7-8053-22549c4f8a8d",
|                                               "Value":  "UserDataFunction.Execute.All",
|                                               "DisplayName":  "Execute user data function items",
|                                               "Description":  "Allows executing user data function items on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "beaf3087-05af-4060-a0a5-29779c902004",
|                                               "Value":  "SparkJobDefinition.Read.All",
|                                               "DisplayName":  "Read spark job definitions",
|                                               "Description":  "Allows reading spark job definitions on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "781c41ac-e316-4a17-b470-cafd75f5c010",
|                                               "Value":  "Reflex.Read.All",
|                                               "DisplayName":  "Read Reflexes",
|                                               "Description":  "Allows reading Reflexes on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "99cac2a4-5c59-45dc-83bd-5303fda5d49d",
|                                               "Value":  "Reflex.ReadWrite.All",
|                                               "DisplayName":  "Read and write Reflexes",
|                                               "Description":  "Allows modifying Reflexes on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "10051e25-9077-418c-a076-32a2d35132a2",
|                                               "Value":  "MirroredDatabase.Read.All",
|                                               "DisplayName":  "Read mirrored databases",
|                                               "Description":  "Allows reading mirrored databases on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2eb0ab4e-195e-45ec-9eb3-3b9842bea4f4",
|                                               "Value":  "MirroredDatabase.ReadWrite.All",
|                                               "DisplayName":  "Read and write mirrored databases",
|                                               "Description":  "Allows modifying mirrored databases on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "67d4aa3f-531f-4db2-a382-7db42788fd35",
|                                               "Value":  "MirroredDatabase.Execute.All",
|                                               "DisplayName":  "MirroredDatabase.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c18991d0-0a42-4567-983a-1993bc79f327",
|                                               "Value":  "MirroredDatabase.Reshare.All",
|                                               "DisplayName":  "MirroredDatabase.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ea662897-fca3-4698-84f4-6acc2fb3a7ea",
|                                               "Value":  "VariableLibrary.Read.All",
|                                               "DisplayName":  "Read variable libraries",
|                                               "Description":  "Allows reading variable libraries on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "43e2cb94-fe45-449d-aa4d-b1f473b98c53",
|                                               "Value":  "VariableLibrary.ReadWrite.All",
|                                               "DisplayName":  "Read and write variable libraries",
|                                               "Description":  "Allows modifying variable libraries on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2c1729df-8c12-449b-ae71-2e4acea26919",
|                                               "Value":  "VariableLibrary.Execute.All",
|                                               "DisplayName":  "Execute variable libraries",
|                                               "Description":  "Allows executing variable libraries on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "79649b78-0856-46fa-902e-b634299dbc3c",
|                                               "Value":  "VariableLibrary.Reshare.All",
|                                               "DisplayName":  "VariableLibrary.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dc55c1dd-468c-4d7f-877a-9414f4c79c61",
|                                               "Value":  "GraphInstance.Read.All",
|                                               "DisplayName":  "Read graph instances",
|                                               "Description":  "Allows reading graph instances on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6523f613-2a20-4d18-8b05-4d1bce5b7b07",
|                                               "Value":  "GraphInstance.ReadWrite.All",
|                                               "DisplayName":  "Read and write graph instances",
|                                               "Description":  "Allows modifying graph instances on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d7fd01f6-c485-406a-ad50-27ea1c711589",
|                                               "Value":  "GraphInstance.Execute.All",
|                                               "DisplayName":  "Execute graph instances",
|                                               "Description":  "Allows executing graph instances on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ce5cc3da-13ac-4c07-9b8d-f5c5811d91d0",
|                                               "Value":  "GraphInstance.Reshare.All",
|                                               "DisplayName":  "GraphInstance.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "deae611f-920b-422f-805e-f635080c4cfb",
|                                               "Value":  "GraphQLApi.Read.All",
|                                               "DisplayName":  "Read GraphQLApis",
|                                               "Description":  "Allows reading GraphQLApis on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "73d01b13-cb5e-466e-8752-a50feccb317e",
|                                               "Value":  "GraphQLApi.ReadWrite.All",
|                                               "DisplayName":  "Read and write GraphQLApis",
|                                               "Description":  "Allows modifying GraphQLApis on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "88cf9f59-aa53-4386-ae14-3c8263713766",
|                                               "Value":  "GraphQLApi.Reshare.All",
|                                               "DisplayName":  "GraphQLApi.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cece14a0-0fa7-4de3-b458-69bd0cfea634",
|                                               "Value":  "GraphQLApi.Execute.All",
|                                               "DisplayName":  "Execute GraphQLApis",
|                                               "Description":  "Allows executing GraphQLApis on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f4611230-1dcf-4466-92d9-59a35c81737a",
|                                               "Value":  "MetricSet.Read.All",
|                                               "DisplayName":  "Read metric sets",
|                                               "Description":  "Allows reading metric sets on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "68386d9d-5570-4b99-9211-ab8abd584145",
|                                               "Value":  "MetricSet.ReadWrite.All",
|                                               "DisplayName":  "Read and write metric sets",
|                                               "Description":  "Allows modifying metric sets on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c79ca1a6-cca1-4ef3-98e3-6abf01eb242f",
|                                               "Value":  "MetricSet.Execute.All",
|                                               "DisplayName":  "MetricSet.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f2fe8057-777e-4536-a069-90f4a2f922bf",
|                                               "Value":  "MetricSet.Reshare.All",
|                                               "DisplayName":  "MetricSet.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f19ea7d7-2f31-4c6d-9845-d5480c5d1798",
|                                               "Value":  "KQLDashboard.Read.All",
|                                               "DisplayName":  "Read KQL dashboards",
|                                               "Description":  "Allows reading KQL dashboards on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3a857d04-01aa-421a-aa42-e40b4264b6f7",
|                                               "Value":  "KQLDashboard.ReadWrite.All",
|                                               "DisplayName":  "Read and write KQL dashboards",
|                                               "Description":  "Allows modifying KQL dashboards on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6132db85-22d5-486c-b094-56eb8f746628",
|                                               "Value":  "KQLDashboard.Execute.All",
|                                               "DisplayName":  "KQLDashboard.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ed4d5569-4170-4f10-b174-16f9d1b31cec",
|                                               "Value":  "KQLDashboard.Reshare.All",
|                                               "DisplayName":  "KQLDashboard.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fe27a477-ed49-4762-9157-5a22eec929a7",
|                                               "Value":  "WarehouseSnapshot.Read.All",
|                                               "DisplayName":  "Read warehouse snapshots",
|                                               "Description":  "Allows reading warehouse snapshots on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "00a826b4-8fc8-4273-b68f-5947f7d13795",
|                                               "Value":  "WarehouseSnapshot.ReadWrite.All",
|                                               "DisplayName":  "Read and write warehouse snapshots",
|                                               "Description":  "Allows modifying warehouse snapshots on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f132046a-f99f-4e2f-af2c-bcc6690050a5",
|                                               "Value":  "WarehouseSnapshot.Execute.All",
|                                               "DisplayName":  "WarehouseSnapshot.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7e23ffe1-cea7-435d-94ce-4a7b4e8b38a0",
|                                               "Value":  "WarehouseSnapshot.Reshare.All",
|                                               "DisplayName":  "WarehouseSnapshot.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "784ff746-e33b-4449-ba4e-081158296c6c",
|                                               "Value":  "Reflex.Execute.All",
|                                               "DisplayName":  "Reflex.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "004969fb-6ad0-4ca6-aa15-246f2bc7ba3c",
|                                               "Value":  "Reflex.Reshare.All",
|                                               "DisplayName":  "Reflex.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fa6c6162-62d9-4f38-b83e-52a4a0382d00",
|                                               "Value":  "CopyJob.Read.All",
|                                               "DisplayName":  "Read copy jobs",
|                                               "Description":  "Allows reading copy jobs on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "615e36fa-c072-424a-a1f6-c098849fade9",
|                                               "Value":  "CopyJob.ReadWrite.All",
|                                               "DisplayName":  "Read and write copy jobs",
|                                               "Description":  "Allows modifying copy jobs on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "840d81d1-e227-45e2-982c-e76ce6908b43",
|                                               "Value":  "CopyJob.Reshare.All",
|                                               "DisplayName":  "CopyJob.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5de94f0e-625f-423b-a7e3-aa181fa938c7",
|                                               "Value":  "CopyJob.Execute.All",
|                                               "DisplayName":  "Execute copy jobs",
|                                               "Description":  "Allows executing copy jobs on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7aaf3c81-a937-4309-a1bc-812e1102a837",
|                                               "Value":  "MountedDataFactory.Read.All",
|                                               "DisplayName":  "Read Azure Data Factories",
|                                               "Description":  "Allows reading Azure Data Factories on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "63ec6016-8d37-4b46-bee2-39ad0ded84d6",
|                                               "Value":  "MountedDataFactory.ReadWrite.All",
|                                               "DisplayName":  "Read and write Azure Data Factories",
|                                               "Description":  "Allows modifying Azure Data Factories on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "aeae5f51-8e10-4970-97f6-8bc2664df3a1",
|                                               "Value":  "MountedDataFactory.Execute.All",
|                                               "DisplayName":  "MountedDataFactory.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "da46e639-2366-4e0a-a190-3fb3aac31e45",
|                                               "Value":  "MountedDataFactory.Reshare.All",
|                                               "DisplayName":  "MountedDataFactory.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0107b32c-22a6-4354-ad71-828b6d03598a",
|                                               "Value":  "MirroredAzureDatabricksCatalog.Read.All",
|                                               "DisplayName":  "Read mirrored azure databricks catalogs",
|                                               "Description":  "Allows reading mirrored azure databricks catalogs on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c5431154-27d8-4db7-96d0-8a201ad5d027",
|                                               "Value":  "MirroredAzureDatabricksCatalog.ReadWrite.All",
|                                               "DisplayName":  "Read and write mirrored azure databricks catalogs",
|                                               "Description":  "Allows modifying mirrored azure databricks catalogs on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e618543a-fb4e-4e95-a8f0-7af6549af7a9",
|                                               "Value":  "MirroredAzureDatabricksCatalog.Execute.All",
|                                               "DisplayName":  "Execute mirrored azure databricks catalogs",
|                                               "Description":  "Allows executing mirrored azure databricks catalogs on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ee9fd26c-e612-44ef-8985-a0c7a1b06ab1",
|                                               "Value":  "MirroredAzureDatabricksCatalog.Reshare.All",
|                                               "DisplayName":  "MirroredAzureDatabricksCatalog.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "40fa91d5-73ef-412c-a8c8-c8658670d0eb",
|                                               "Value":  "DataAgent.Read.All",
|                                               "DisplayName":  "Read data agents",
|                                               "Description":  "Allows reading data agents on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c23fda5c-561f-4890-ad72-5f57bb7496fd",
|                                               "Value":  "DataAgent.ReadWrite.All",
|                                               "DisplayName":  "Read and write data agents",
|                                               "Description":  "Allows modifying data agents on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c6756612-6853-4145-a661-90c1d045b2dc",
|                                               "Value":  "DataAgent.Execute.All",
|                                               "DisplayName":  "Execute data agents",
|                                               "Description":  "Allows executing data agents on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "82b1d51c-42df-4ba9-9aee-bbba1e3f2ab7",
|                                               "Value":  "DataAgent.Reshare.All",
|                                               "DisplayName":  "DataAgent.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d27d5544-b17d-471f-9a02-ef09d6720508",
|                                               "Value":  "OrgApp.Read.All",
|                                               "DisplayName":  "Read org apps",
|                                               "Description":  "Allows reading org apps on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "38536678-0d9f-4f82-88e5-a13a78d1d209",
|                                               "Value":  "OrgApp.ReadWrite.All",
|                                               "DisplayName":  "Read and write org apps",
|                                               "Description":  "Allows modifying org apps on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "02d9fa8b-e936-407b-a8f2-9b8fa5bda3bc",
|                                               "Value":  "OrgApp.Reshare.All",
|                                               "DisplayName":  "OrgApp.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0a7d02f8-6c5f-4f1f-91e0-0650efd2436b",
|                                               "Value":  "Fabric.Extend.IframeSandbox",
|                                               "DisplayName":  "Run partner Fabric items in iframes with relaxed sandbox protection.",
|                                               "Description":  "Allow partner Fabric items managed by this app to run in iframes with the relaxed sandbox enabling additional operations."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7da32ee4-ec68-43a4-b13a-b5385ad9770e",
|                                               "Value":  "Warehouse.Restore.All",
|                                               "DisplayName":  "Make API calls that require restore permissions on all Warehouses",
|                                               "Description":  "Allows the app to make API calls that require restore permissions on all Warehouses, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f4e8a89a-fa13-4aac-abd3-925cfe74dc66",
|                                               "Value":  "ExternalDataShare.Accept.All",
|                                               "DisplayName":  "Allows the app to accept the external data share invitation",
|                                               "Description":  "Allows the app to accept the external data share invitation on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1d1f591a-f469-48d6-8995-a532552ae72c",
|                                               "Value":  "Lakehouse.ExternalDataShare.All",
|                                               "DisplayName":  "Allows the app to create and manage external data shares for all lakehouses",
|                                               "Description":  "Allows the app to create and manage external data shares for all lakehouses, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b102c99e-b723-4ac3-beb8-8813448ccfa7",
|                                               "Value":  "Warehouse.ExternalDataShare.All",
|                                               "DisplayName":  "Allows the app to create and manage external data shares for all warehouses",
|                                               "Description":  "Allows the app to create and manage external data shares for all warehouses, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5cf1e703-06da-4688-8f2a-29e77c25489a",
|                                               "Value":  "SemanticModel.ExternalDataShare.All",
|                                               "DisplayName":  "Allows the app to create and manage external data shares for all semantic models",
|                                               "Description":  "Allows the app to create and manage external data shares for all semantic models, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3a1af33d-ccfa-4264-998b-348c8c299db1",
|                                               "Value":  "KQLDatabase.ExternalDataShare.All",
|                                               "DisplayName":  "Allows the app to create and manage external data shares for all KQL databases",
|                                               "Description":  "Allows the app to create and manage external data shares for all KQL databases, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bae3e5e0-a78a-4b0f-b3a0-0dc52f365b9d",
|                                               "Value":  "Item.ExternalDataShare.All",
|                                               "DisplayName":  "Allows the app to create and manage external data shares for all Fabric items",
|                                               "Description":  "Allows the app to create and manage external data shares for all Fabric items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eb433b13-ec6d-487b-8411-b5fadda75072",
|                                               "Value":  "MirroredDatabase.ExternalDataShare.All",
|                                               "DisplayName":  "Allows the app to create and manage external data shares for all mirrored Databases",
|                                               "Description":  "Allows the app to create and manage external data shares for all mirrored Databases, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e90f72dc-f418-4844-82db-ea22d405cfc1",
|                                               "Value":  "SQLDatabase.ExternalDataShare.All",
|                                               "DisplayName":  "Allows the app to create and manage external data shares for all SQL Databases",
|                                               "Description":  "Allows the app to create and manage external data shares for all SQL Databases, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a1999a26-9603-41b3-abf3-45698c57f620",
|                                               "Value":  "Code.AccessSQL.All",
|                                               "DisplayName":  "Access Azure SQL database and data warehouse",
|                                               "Description":  "This is for Azure SQL database and data warehouse access"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c289c338-860d-4abf-8312-2455f47f8f33",
|                                               "Value":  "ItemMetadata.ReadWrite.All",
|                                               "DisplayName":  "Make API calls that can read and write item metadata for all Fabric items",
|                                               "Description":  "Allows the app to make API calls that can read and write the item metadata of all Fabric items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "94a31d2b-0d95-46b5-9dcd-1bf123c80327",
|                                               "Value":  "ItemMetadata.Read.All",
|                                               "DisplayName":  "Make API calls that can read item metadata for all Fabric items",
|                                               "Description":  "Allows the app to make API calls that can read the item metadata of all Fabric items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a66db2ff-fea7-40f3-8b63-2a35d6c5f753",
|                                               "Value":  "Code.AccessFabric.All",
|                                               "DisplayName":  "Allow API calls to access all Fabric resources on behalf of signed-in user",
|                                               "Description":  "Allows the app to make API calls to access all Fabric resources, on behalf of signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2049d009-d5d1-4947-85ab-8b727def2427",
|                                               "Value":  "Code.AccessAzureKeyvault.All",
|                                               "DisplayName":  "Have full access to the Azure Key Vault service",
|                                               "Description":  "Allow the application full access to the Azure Key Vault service on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c655ab60-056e-4dd8-8cd0-6b5398bf6002",
|                                               "Value":  "Code.AccessAzureDataLake.All",
|                                               "DisplayName":  "Have full access to the Azure Data Lake service",
|                                               "Description":  "Allow the application full access to the Azure Data Lake service on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eaf7943f-ddfe-4442-96af-9419cf9522f3",
|                                               "Value":  "Code.AccessAzureDataExplorer.All",
|                                               "DisplayName":  "Access Azure Data Explorer",
|                                               "Description":  "Allow the application to access Azure Data Explorer on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3f981b02-4cb2-4226-b4d2-c378f291573c",
|                                               "Value":  "Code.AccessStorage.All",
|                                               "DisplayName":  "Access Azure Storage",
|                                               "Description":  "Allow the application to access Azure Storage on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fc011432-d782-46d3-8143-f0328911e0a3",
|                                               "Value":  "GraphQL.Execute.All",
|                                               "DisplayName":  "Make API calls that executes requests on all API for GraphQL items",
|                                               "Description":  "Allows the app to make API calls that executes requests on all API for GraphQL items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7ba630b9-8110-4e27-8d17-81e5f2218787",
|                                               "Value":  "Fabric.Extend",
|                                               "DisplayName":  "Extend Fabric with new item types",
|                                               "Description":  "Allows the app to extend Fabric with new item types and have restricted access to Fabric items, user identifiers and other metadata, on behalf of the signed-in user. Protecting exports with sensitivity labels, enforcement of regional boundaries and some other Fabric capabilities are not available to partner items."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8eb59948-47ce-4224-8cb1-f2a1ddb35822",
|                                               "Value":  "PrincipalDetails.ReadBasic.All",
|                                               "DisplayName":  "Read Entra ID identities basic properties",
|                                               "Description":  "Allows the app to read basic properties of Entra ID identities in your organization that are known to Microsoft Fabric, on behalf of the signed-in user. This includes display names and email addresses of users, service principals and security groups."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3be8fe94-2189-4d8b-89c6-dd35c5cea6ef",
|                                               "Value":  "Connection.ReadWrite.All",
|                                               "DisplayName":  "Make API calls that require read and write permissions on all Fabric connections",
|                                               "Description":  "Allows the app to make API calls that require read and write permissions on all Fabric connections, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9ff18859-b8d5-4a89-9912-448b84dfb097",
|                                               "Value":  "Connection.Read.All",
|                                               "DisplayName":  "Make API calls that require read permissions on all Fabric connections",
|                                               "Description":  "Allows the app to make API calls that require read permissions on all Fabric connections, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b43e1ada-25ee-416f-bd5c-512976ddc74b",
|                                               "Value":  "UserState.ReadWrite.All",
|                                               "DisplayName":  "Read and write user settings and state",
|                                               "Description":  "The app can view and edit any user settings and the user-specific state associated with  content the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "76e2ebd5-0dfb-4a5b-93c7-ed89e0362834",
|                                               "Value":  "Capacity.Read.All",
|                                               "DisplayName":  "View all capacities",
|                                               "Description":  "The app can view all Power BI Premium and Power BI Embedded capacities that the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4eabc3d1-b762-40ff-9da5-0e18fdf11230",
|                                               "Value":  "Capacity.ReadWrite.All",
|                                               "DisplayName":  "Read and write all capacities",
|                                               "Description":  "The app can view and edit all Power BI Premium and Power BI Embedded capacities that the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b2f1b2fa-f35c-407c-979c-a858a808ba85",
|                                               "Value":  "Workspace.Read.All",
|                                               "DisplayName":  "View all workspaces",
|                                               "Description":  "The app can view all workspaces that the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "445002fb-a6f2-4dc1-a81e-4254a111cd29",
|                                               "Value":  "Workspace.ReadWrite.All",
|                                               "DisplayName":  "Read and write all workspaces",
|                                               "Description":  "The app can view and edit all workspaces that the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d2e42f6b-2baf-4ff4-83ef-51e66321516e",
|                                               "Value":  "Gateway.Read.All",
|                                               "DisplayName":  "View all gateways",
|                                               "Description":  "The app can view all gateways that the signed in user is an admin of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ddb3ca45-a192-477d-acb2-46bf9dc586de",
|                                               "Value":  "Gateway.ReadWrite.All",
|                                               "DisplayName":  "Read and write all gateways",
|                                               "Description":  "The app can view and edit all gateways that the signed in user is an admin of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d594897b-76e7-4b2b-984b-b4adff35e109",
|                                               "Value":  "Tenant.ReadWrite.All",
|                                               "DisplayName":  "Read and write all content in tenant",
|                                               "Description":  "The app can create, edit, view, and delete all content in the tenant if the signed in user is in the Global administrator or Power BI service administrator role."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f3076109-ca66-412a-be10-d4ee1be95d47",
|                                               "Value":  "Content.Create",
|                                               "DisplayName":  "Create content",
|                                               "Description":  "App can automatically create content and datasets for a user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "322b68b2-0804-416e-86a5-d772c567b6e6",
|                                               "Value":  "Dataset.ReadWrite.All",
|                                               "DisplayName":  "Read and write all datasets",
|                                               "Description":  "The app can view and write to all datasets for the signed in user and any datasets that the user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7f33e027-4039-419b-938e-2f8ca153e68e",
|                                               "Value":  "Dataset.Read.All",
|                                               "DisplayName":  "View all datasets",
|                                               "Description":  "The app can view all datasets for the signed in user and any datasets that the user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "01944dba-21df-426f-bb8c-796488be96ad",
|                                               "Value":  "Tenant.Read.All",
|                                               "DisplayName":  "View all content in tenant",
|                                               "Description":  "The app can view all content in the tenant if the signed in user is in the Global administrator or Power BI service administrator role."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8b01a991-5a5a-47f8-91a2-84d6bfd72c02",
|                                               "Value":  "App.Read.All",
|                                               "DisplayName":  "View all Power BI apps",
|                                               "Description":  "The app can view all Power BI apps the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "27789c5b-aca8-4cb6-94b8-bcc8964dd8ad",
|                                               "Value":  "StorageAccount.ReadWrite.All",
|                                               "DisplayName":  "Read and write all storage accounts",
|                                               "Description":  "The app can view and edit all storage accounts registered with Power BI that the signed in user is an admin of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e677843f-76d8-44d3-bcdb-ec40dea919e7",
|                                               "Value":  "StorageAccount.Read.All",
|                                               "DisplayName":  "View all storage accounts",
|                                               "Description":  "The app can view all storage accounts registered with Power BI that the signed in user is an admin of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dbe6434c-63f0-42bb-be8e-122ec1bad4d2",
|                                               "Value":  "Pipeline.Read.All",
|                                               "DisplayName":  "View all pipelines",
|                                               "Description":  "The app can view all deployment pipelines that the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "199f155b-cccd-4be4-bbe6-ca9a867b24b4",
|                                               "Value":  "Pipeline.ReadWrite.All",
|                                               "DisplayName":  "Read and write all pipelines",
|                                               "Description":  "The app can view and edit all deployment pipelines that the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "652d7d02-6ff0-4cf7-9516-cf77d33a3ae4",
|                                               "Value":  "Pipeline.Deploy",
|                                               "DisplayName":  "Deploy in all pipelines",
|                                               "Description":  "The app can deploy content in all pipelines and pipeline stages in deployment pipelines, which the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7a27a256-301d-4359-b77b-c2b759d2e362",
|                                               "Value":  "Item.ReadWrite.All",
|                                               "DisplayName":  "Make API calls that require read and write permissions on all Fabric items",
|                                               "Description":  "Allows the app to make API calls that require read and write permissions on all Fabric items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d2bc95fc-440e-4b0e-bafd-97182de7aef5",
|                                               "Value":  "Item.Read.All",
|                                               "DisplayName":  "Make API calls that require read permissions on all Fabric items",
|                                               "Description":  "Allows the app to make API calls that require read permissions on all Fabric items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "caf40b1a-f10e-4da1-86e4-5fda17eb2b07",
|                                               "Value":  "Item.Execute.All",
|                                               "DisplayName":  "Make API calls that require execute permissions on all Fabric items",
|                                               "Description":  "Allows the app to make API calls that require execute permissions on all Fabric items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "753e9303-2fd9-496e-aa7c-cf84a133f42a",
|                                               "Value":  "KQLDataConnection.ReadWrite.All",
|                                               "DisplayName":  "Make API calls that require read and write permissions on and write all KQL data connections",
|                                               "Description":  "Allows the app to make API calls that require read and write permissions on all KQL data connections, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e0c0aef0-3eab-49ca-9662-50cc7bd13bfb",
|                                               "Value":  "DataPipeline.ReadWrite.All",
|                                               "DisplayName":  "Make API calls that require read and write permissions on all data pipelines",
|                                               "Description":  "Allows the app to make API calls that require read and write permissions on all data pipelines, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7e010a28-f5fa-4e63-b03d-2dc25cba9d2e",
|                                               "Value":  "DataPipeline.Execute.All",
|                                               "DisplayName":  "Make API calls that require execute permissions all data pipelines",
|                                               "Description":  "Allows the app to make API calls that require execute permissions on all data pipelines, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "59b5791b-482f-4b95-8498-fe078f6bd6fa",
|                                               "Value":  "KQLDataConnection.Read.All",
|                                               "DisplayName":  "Make API calls that require read permissions on all KQL data connections",
|                                               "Description":  "Allows the app to make API calls that require read permissions on all KQL data connections, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a61cf2d1-8b81-4518-b2bb-a24e0831c17a",
|                                               "Value":  "DataPipeline.Read.All",
|                                               "DisplayName":  "Make API calls that require read permissions on all data pipelines",
|                                               "Description":  "Allows the app to make API calls that require read permissions on all data pipelines, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a74298d9-12f6-45f5-808d-7907af21179c",
|                                               "Value":  "Scorecard.Read.All",
|                                               "DisplayName":  "Make API calls that require read permissions on all scorecards",
|                                               "Description":  "Allows the app to make API calls that require read permissions on all scorecards, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "02e8d710-956c-4760-b996-2e83935c2cf5",
|                                               "Value":  "Item.Reshare.All",
|                                               "DisplayName":  "Make API calls that require reshare permissions on all Fabric items",
|                                               "Description":  "Allows the app to make API calls that require reshare permissions on all Fabric items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b23bb8c4-af74-49b0-91dd-79ffb83cddb9",
|                                               "Value":  "DevX.ReadWrite.All",
|                                               "DisplayName":  "Create and Manage Developer Experience functionality",
|                                               "Description":  "Allows the app to make API calls to register and manage 3rd party Service Fabric workloads, on your behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a55d4405-a37a-4d41-ad6e-745665a3bbcb",
|                                               "Value":  "Workspace.GitCommit.All",
|                                               "DisplayName":  "Make API calls that commit workspace content and setting to remote git repository.",
|                                               "Description":  "Allows the app to make API calls that commit workspace content and setting to remote git repository, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5809ab1d-9154-49e7-a105-d82760eac8cf",
|                                               "Value":  "Workspace.GitUpdate.All",
|                                               "DisplayName":  "Make API calls that update workspace content and setting from remote git repository.",
|                                               "Description":  "Allows the app to make API calls that update workspace content and setting from remote git repository, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "547211ef-7223-404f-8519-fee52fda6402",
|                                               "Value":  "OneLake.Read.All",
|                                               "DisplayName":  "Make API calls that read OneLake metadata",
|                                               "Description":  "Allows the app to make API calls that read OneLake metadata on your behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ada1b44b-4474-40ed-b32c-e3543dccec0e",
|                                               "Value":  "OneLake.ReadWrite.All",
|                                               "DisplayName":  "Make API calls that read and write OneLake metadata",
|                                               "Description":  "Allows the app to make API calls that read and write OneLake metadata, on your behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Management APIs",
|                                               "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e2cea78f-e743-4d8f-a16a-75b629a038ae",
|                                               "Value":  "ServiceHealth.Read",
|                                               "DisplayName":  "Read service health information for your organization",
|                                               "Description":  "Allows the application to read service health information for your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Management APIs",
|                                               "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                               "PermissionType":  "Application",
|                                               "Id":  "594c1fb6-4f81-4475-ae41-0c394909246c",
|                                               "Value":  "ActivityFeed.Read",
|                                               "DisplayName":  "Read activity data for your organization",
|                                               "Description":  "Allows the application to read activity data for your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Management APIs",
|                                               "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4807a72c-ad38-4250-94c9-4eabfe26cd55",
|                                               "Value":  "ActivityFeed.ReadDlp",
|                                               "DisplayName":  "Read DLP policy events including detected sensitive data",
|                                               "Description":  "Allows the application to read DLP policy events, including detected sensitive data, for your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Management APIs",
|                                               "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e2cea78f-e743-4d8f-a16a-75b629a038ae",
|                                               "Value":  "ServiceHealth.Read",
|                                               "DisplayName":  "Read service health information for your organization",
|                                               "Description":  "Allows the application to read service health information for your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Management APIs",
|                                               "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "594c1fb6-4f81-4475-ae41-0c394909246c",
|                                               "Value":  "ActivityFeed.Read",
|                                               "DisplayName":  "Read activity data for your organization",
|                                               "Description":  "Allows the application to read activity data for your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Management APIs",
|                                               "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4807a72c-ad38-4250-94c9-4eabfe26cd55",
|                                               "Value":  "ActivityFeed.ReadDlp",
|                                               "DisplayName":  "Read DLP policy events including detected sensitive data",
|                                               "Description":  "Allows the application to read DLP policy events, including detected sensitive data, for your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Rights Management Services",
|                                               "AppId":  "00000012-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e23bd57d-bfd5-4906-867f-89fb5ed8cd43",
|                                               "Value":  "Application.Read.All",
|                                               "DisplayName":  "Read all service configuration and log data for the Azure Information Protection service.",
|                                               "Description":  "Allows the application to get or read all service configuration and log data"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Rights Management Services",
|                                               "AppId":  "00000012-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "006e763d-a822-41fc-8df5-8d3d7fe20022",
|                                               "Value":  "Content.Writer",
|                                               "DisplayName":  "Create protected content",
|                                               "Description":  "Create protected content"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Rights Management Services",
|                                               "AppId":  "00000012-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7347eb49-7a1a-43c5-8eac-a5cd1d1c7cf0",
|                                               "Value":  "Content.SuperUser",
|                                               "DisplayName":  "Read all protected content for this tenant",
|                                               "Description":  "Read all protected content for this tenant"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Rights Management Services",
|                                               "AppId":  "00000012-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7f740376-647b-4ad7-9ff7-292af252707a",
|                                               "Value":  "Content.DelegatedReader",
|                                               "DisplayName":  "Read protected content on behalf of a user",
|                                               "Description":  "Read protected content on behalf of a user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Rights Management Services",
|                                               "AppId":  "00000012-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d13f921c-7f21-4c08-bade-db9d048bd0da",
|                                               "Value":  "Content.DelegatedWriter",
|                                               "DisplayName":  "Create protected content on behalf of a user",
|                                               "Description":  "Create protected content on behalf of a user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Rights Management Services",
|                                               "AppId":  "00000012-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c9c9a04d-3b66-4ca8-a00c-fca953e2afd3",
|                                               "Value":  "user_impersonation",
|                                               "DisplayName":  "Create and access protected content for users",
|                                               "Description":  "Allow the application to use Azure Rights Management"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cfbd1345-3cf0-408c-8c99-1491bde7ce52",
|                                               "Value":  "EopDataInsights.AccessAsApp",
|                                               "DisplayName":  "EopDataInsights.AccessAsApp",
|                                               "Description":  "EopDataInsights.AccessAsApp"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "26872368-3756-4995-a1d0-73cfa9d8f83a",
|                                               "Value":  "M365ContentExplorer.Read.All",
|                                               "DisplayName":  "M365ContentExplorer.Read.All",
|                                               "Description":  "M365ContentExplorer.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "06ab0d31-7112-476e-a479-66394bec63d6",
|                                               "Value":  "MessageTrace.Read.All",
|                                               "DisplayName":  "MessageTrace.Read.All",
|                                               "Description":  "MessageTrace.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3e4e080e-55db-4fa9-8d68-0d9199d4c792",
|                                               "Value":  "QuarantinedMessage.Read.All",
|                                               "DisplayName":  "QuarantinedMessage.Read.All",
|                                               "Description":  "QuarantinedMessage.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cc02f7ae-3d9b-42c9-bc91-3424d92c5547",
|                                               "Value":  "AirAdminAction.tenant.read",
|                                               "DisplayName":  "AirAdminAction.tenant.read",
|                                               "Description":  "This allows the app to read AirAdminAction alerts"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "43f2aa58-36d7-421e-8628-fbe9b129bf76",
|                                               "Value":  "AirAdminAction.tenant.write",
|                                               "DisplayName":  "AirAdminAction.tenant.write",
|                                               "Description":  "This allows apps to write the AirAdminAction alerts"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "27787a44-0423-4f0d-a417-1276c93397fb",
|                                               "Value":  "TenantLicenseStatus.Read.All",
|                                               "DisplayName":  "TenantLicenseStatus.Read.All",
|                                               "Description":  "TenantLicenseStatus.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "092afc53-fa1b-44c3-9fdf-46fcd25a5d99",
|                                               "Value":  "Relocation.ReadWrite.All",
|                                               "DisplayName":  "Relocation.ReadWrite.All",
|                                               "Description":  "Relocation.ReadWrite.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "926c05c5-5941-491b-973a-509c2a4a2542",
|                                               "Value":  "AzureActivityData.Read.All",
|                                               "DisplayName":  "AzureActivityData.Read.All",
|                                               "Description":  "AzureActivityData.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a585dd3a-70b6-4ff4-a1b9-093b4214e7e4",
|                                               "Value":  "OcrBillingConfiguration-Internal.Write.All",
|                                               "DisplayName":  "OcrBillingConfiguration-Internal.Write.All",
|                                               "Description":  "OcrBillingConfiguration-Internal.Write.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9760b448-d4d4-478b-bebc-0ebe62c935c9",
|                                               "Value":  "AuditProvisioningData.Tenant.Read",
|                                               "DisplayName":  "AuditProvisioningData.Tenant.Read",
|                                               "Description":  "AuditProvisioningData.Tenant.Read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "67a4e76f-5125-4b64-bcd6-b42a60d47dbe",
|                                               "Value":  "Purview.DataAccess.All",
|                                               "DisplayName":  "Purview.DataAccess.All",
|                                               "Description":  "Purview.DataAccess.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "43e3dfa5-222e-4a48-8253-d36086c5558c",
|                                               "Value":  "Alert.Read.All",
|                                               "DisplayName":  "Alert.Read.All",
|                                               "Description":  "Alert.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5f124282-d2c3-47dd-87ff-106ba9aa079b",
|                                               "Value":  "MtpMailboxRuleAction.tenant.write",
|                                               "DisplayName":  "MtpMailboxRuleAction.tenant.write",
|                                               "Description":  "MtpMailboxRuleAction.tenant.write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ca69fdfa-5ba6-4c33-9eac-013653c2c3af",
|                                               "Value":  "MtpMailboxRuleAction.tenant.read",
|                                               "DisplayName":  "MtpMailboxRuleAction.tenant.read",
|                                               "Description":  "MtpMailboxRuleAction.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "182f95e9-8c6f-4c32-8de2-e1abc1fe6ea4",
|                                               "Value":  "DataInsightsSubscription.tenant.write",
|                                               "DisplayName":  "DataInsightsSubscription.tenant.write",
|                                               "Description":  "DataInsightsSubscription.tenant.write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bfeb98e9-5067-42b0-a7df-9022b927a10e",
|                                               "Value":  "DataInsightsSubscription.tenant.read",
|                                               "DisplayName":  "DataInsightsSubscription.tenant.read",
|                                               "Description":  "DataInsightsSubscription.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "59c90462-e42e-4698-8a51-196ebd407166",
|                                               "Value":  "compliancestatus.tenant.read",
|                                               "DisplayName":  "compliancestatus.tenant.read",
|                                               "Description":  "compliancestatus.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "39de55cd-e81d-4d2a-880d-3872c4fb992d",
|                                               "Value":  "RecipientBatch.tenant.write",
|                                               "DisplayName":  "RecipientBatch.tenant.write",
|                                               "Description":  "RecipientBatch.tenant.write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0eabd45c-e771-460d-a601-2d534e78a1be",
|                                               "Value":  "DataInsightsUsersData.tenant.read",
|                                               "DisplayName":  "DataInsightsUsersData.tenant.read",
|                                               "Description":  "DataInsightsUsersData.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e0ff780c-d4f4-4ef4-b0ad-b19863ca72a2",
|                                               "Value":  "UsersAggregateByAttackSimulation.tenant.read",
|                                               "DisplayName":  "UsersAggregateByAttackSimulation.tenant.read",
|                                               "Description":  "UsersAggregateByAttackSimulation.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "81eac90b-5b5b-422f-8d2a-9bc2055c5453",
|                                               "Value":  "Recipient.tenant.read",
|                                               "DisplayName":  "Recipient.tenant.read",
|                                               "Description":  "Recipient.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7b67f132-5c43-45cb-8cc3-e78fd80d0776",
|                                               "Value":  "Recipient.tenant.write",
|                                               "DisplayName":  "Recipient.tenant.write",
|                                               "Description":  "Recipient.tenant.write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "06c43929-37aa-4707-ae05-68d6d967953e",
|                                               "Value":  "AttackSimulationData.tenant.read",
|                                               "DisplayName":  "AttackSimulationData.tenant.read",
|                                               "Description":  "AttackSimulationData.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "38b568f3-92e4-4c17-92b7-a49c28904247",
|                                               "Value":  "TiRemediation.ReadWrite.All",
|                                               "DisplayName":  "TiRemediation.ReadWrite.All",
|                                               "Description":  "TiRemediation.ReadWrite.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5c6799ba-41c0-49cc-9f2d-7486a52d52a0",
|                                               "Value":  "TiRemediation.Read.All",
|                                               "DisplayName":  "TiRemediation.Read.All",
|                                               "Description":  "TiRemediation.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dac43cb8-9b13-43b1-bc17-e7eb8fe26717",
|                                               "Value":  "RemediationEmailResult.ReadWrite.All",
|                                               "DisplayName":  "RemediationEmailResult.ReadWrite.All",
|                                               "Description":  "RemediationEmailResult.ReadWrite.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cae0e51f-af85-4f35-870d-9f024147648d",
|                                               "Value":  "RemediationEmailResult.Read.All",
|                                               "DisplayName":  "RemediationEmailResult.Read.All",
|                                               "Description":  "RemediationEmailResult.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ba4ca83c-e834-4e66-bfe1-df738f63b557",
|                                               "Value":  "activitydata.tenant.read",
|                                               "DisplayName":  "activitydata.tenant.read",
|                                               "Description":  "activitydata.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "57fee0bb-e97d-4e5c-a663-2b0c7ce0db37",
|                                               "Value":  "InsiderRiskData.Read.All",
|                                               "DisplayName":  "InsiderRiskData.Read.All",
|                                               "Description":  "InsiderRiskData.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f9d2daf6-8028-48d1-b4c1-b963f7ae7a73",
|                                               "Value":  "AggConsumptionBillingReport.Read.All",
|                                               "DisplayName":  "AggConsumptionBillingReport.Read.All",
|                                               "Description":  "AggConsumptionBillingReport.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "15188c9e-7879-4e83-9d63-c728da8feb0d",
|                                               "Value":  "DynamicRiskPreventionTag.Tenant.Write",
|                                               "DisplayName":  "DynamicRiskPreventionTag.Tenant.Write",
|                                               "Description":  "DynamicRiskPreventionTag.Tenant.Write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f63db487-96bf-49af-8a79-faa86287aee6",
|                                               "Value":  "DynamicRiskPreventionTag.Tenant.Read",
|                                               "DisplayName":  "DynamicRiskPreventionTag.Tenant.Read",
|                                               "Description":  "DynamicRiskPreventionTag.Tenant.Read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "944c8d5a-fdcd-4aac-af4d-3366942700d5",
|                                               "Value":  "ThreatSubmission.ReadWrite.All",
|                                               "DisplayName":  "ThreatSubmission.ReadWrite.All",
|                                               "Description":  "ThreatSubmission.ReadWrite.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e0ba9b2a-a247-4d95-bca6-43211b61057f",
|                                               "Value":  "CustomTag.Tenant.Read",
|                                               "DisplayName":  "CustomTag.Tenant.Read",
|                                               "Description":  "CustomTag.Tenant.Read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "92b5621e-0e43-46c9-b830-bc26b325a150",
|                                               "Value":  "CustomTag.Tenant.Write",
|                                               "DisplayName":  "CustomTag.Tenant.Write",
|                                               "Description":  "CustomTag.Tenant.Write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "85e837d7-9e4b-4bb2-9535-08bb51aa974a",
|                                               "Value":  "MessageTraceDetail.tenant.read",
|                                               "DisplayName":  "MessageTraceDetail.tenant.read",
|                                               "Description":  "MessageTraceDetail.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "03f3ead7-60e6-4522-847b-8a67bb9c50df",
|                                               "Value":  "OneCyberRelocationData.tenant.write",
|                                               "DisplayName":  "OneCyberRelocationData.tenant.write",
|                                               "Description":  "This allows apps to write the OneCyberRelocationData"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9b31c028-bb6a-4d1a-8295-4514d184c061",
|                                               "Value":  "OneCyberRelocationData.tenant.read",
|                                               "DisplayName":  "OneCyberRelocationData.tenant.read",
|                                               "Description":  "This allows apps to read the OneCyberRelocationData"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "86e9643d-f798-40d2-98bb-293a7daaa2d7",
|                                               "Value":  "MtpAction.tenant.read",
|                                               "DisplayName":  "MtpAction.tenant.read",
|                                               "Description":  "This allows apps to read the MtpAction"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e6e79fef-f4ee-4f93-aec3-3f0001087066",
|                                               "Value":  "MtpAction.tenant.write",
|                                               "DisplayName":  "MtpAction.tenant.write",
|                                               "Description":  "This allows apps to write the MtpAction"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "723c28f9-60b9-4cd4-8b04-6d344a3c4d84",
|                                               "Value":  "alert.tenant.write",
|                                               "DisplayName":  "alert.tenant.write",
|                                               "Description":  "This allows to change any Office 365 alerts belong to the tenant."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d91202fb-0f5f-4245-8148-dfe12af913e6",
|                                               "Value":  "alert.tenant.read",
|                                               "DisplayName":  "alert.tenant.read",
|                                               "Description":  "This allows to read tenant Office 365 alerts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "74450f94-a5b1-4243-a991-9a688375883f",
|                                               "Value":  "mtpstatus.tenant.read",
|                                               "DisplayName":  "mtpstatus.tenant.read",
|                                               "Description":  "Allow o365 applications to read MTP Status"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "51aa070e-cc8b-45a9-8530-3fc96b0aa701",
|                                               "Value":  "messageeventsummary.tenant.read",
|                                               "DisplayName":  "messageeventsummary.tenant.read",
|                                               "Description":  "This scope allows Apps to read tenant\u0027s MessageEventSummary data"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "24c052b7-e297-4369-b344-e4b62baa3fca",
|                                               "Value":  "reducedrecipient.read.all",
|                                               "DisplayName":  "reducedrecipient.read.all",
|                                               "Description":  "this allows to read reducedrecipient"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "abe60d99-0a67-4250-afc0-290614d84b41",
|                                               "Value":  "RoleGroupMember.tenant.write",
|                                               "DisplayName":  "RoleGroupMember.tenant.write",
|                                               "Description":  "This allows to change RoleGroupMember to the tenant"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6c68db0a-4608-48d3-b0bf-4d0917b88bef",
|                                               "Value":  "PolicyStatusSummary-Internal.Write.All",
|                                               "DisplayName":  "PolicyStatusSummary-Internal.Write.All",
|                                               "Description":  "PolicyStatusSummary-Internal.Write.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b80e6cec-e423-411f-8c98-7fe5a25ca7cf",
|                                               "Value":  "M365ContentExplorer.Read.All",
|                                               "DisplayName":  "M365ContentExplorer.Read.All",
|                                               "Description":  "This allows user to read M365ContentExplorer"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "739f66f6-655e-48e4-b5bd-2bbeb6077954",
|                                               "Value":  "Purview.DataAccess.All",
|                                               "DisplayName":  "Purview.DataAccess.All",
|                                               "Description":  "Purview.DataAccess.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "384a8502-84c5-41d9-a875-7834b77c8005",
|                                               "Value":  "RbacAccessCheck.read",
|                                               "DisplayName":  "RbacAccessCheck.read",
|                                               "Description":  "This Allows User to read the Rbac Roles"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6f44fc23-ea08-4666-8329-85597e11bdcd",
|                                               "Value":  "mtproleinfo.read",
|                                               "DisplayName":  "mtproleinfo.read",
|                                               "Description":  "This allows user to read MtpRoleInfo"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6b300195-82d7-4a39-a7bc-0510371998cc",
|                                               "Value":  "alert.read",
|                                               "DisplayName":  "alert.read",
|                                               "Description":  "This allows user to read Office 365 alerts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bcc2bc0d-d08c-412a-b24d-f6f78d714bdc",
|                                               "Value":  "alert.write",
|                                               "DisplayName":  "alert.write",
|                                               "Description":  "This allows user to change Office 365 alerts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "edfd2d1c-b4b5-4b83-b5e8-c38594e49c26",
|                                               "Value":  "RbacTenantStatus.Read",
|                                               "DisplayName":  "RbacTenantStatus.Read",
|                                               "Description":  "RbacTenantStatus.Read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4e26c42d-fab0-4daa-9ea6-d860a28aa7d0",
|                                               "Value":  "RbacTenantStatus.Write",
|                                               "DisplayName":  "RbacTenantStatus.Write",
|                                               "Description":  "RbacTenantStatus.Write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "06ab0d31-7112-476e-a479-66394bec63d6",
|                                               "Value":  "MessageTrace.Read.All",
|                                               "DisplayName":  "MessageTrace.Read.All",
|                                               "Description":  "MessageTrace.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3e4e080e-55db-4fa9-8d68-0d9199d4c792",
|                                               "Value":  "QuarantinedMessage.Read.All",
|                                               "DisplayName":  "QuarantinedMessage.Read.All",
|                                               "Description":  "QuarantinedMessage.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cc02f7ae-3d9b-42c9-bc91-3424d92c5547",
|                                               "Value":  "AirAdminAction.tenant.read",
|                                               "DisplayName":  "AirAdminAction.tenant.read",
|                                               "Description":  "This allows the app to read AirAdminAction alerts"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "43f2aa58-36d7-421e-8628-fbe9b129bf76",
|                                               "Value":  "AirAdminAction.tenant.write",
|                                               "DisplayName":  "AirAdminAction.tenant.write",
|                                               "Description":  "This allows apps to write the AirAdminAction alerts"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "27787a44-0423-4f0d-a417-1276c93397fb",
|                                               "Value":  "TenantLicenseStatus.Read.All",
|                                               "DisplayName":  "TenantLicenseStatus.Read.All",
|                                               "Description":  "TenantLicenseStatus.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b87cb2cc-0570-4e76-9606-3528d5fb44e7",
|                                               "Value":  "AtpStandardPolicy.Tenant.Read",
|                                               "DisplayName":  "AtpStandardPolicy.Tenant.Read",
|                                               "Description":  "AtpStandardPolicy.Tenant.Read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9945d5be-d9cb-45d0-b347-3f827c0d374d",
|                                               "Value":  "AtpStandardPolicy.Tenant.Write",
|                                               "DisplayName":  "AtpStandardPolicy.Tenant.Write",
|                                               "Description":  "AtpStandardPolicy.Tenant.Write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2da9421b-01d5-43ec-9c8e-b1bfa4a8b2bb",
|                                               "Value":  "LabelAnalyticsActivityData.Read.All",
|                                               "DisplayName":  "LabelAnalyticsActivityData.Read.All",
|                                               "Description":  "LabelAnalyticsActivityData.Read.All"
|                                           }
|                                       ],
|    "Azure_BuiltInRoles_Tier0":  [
|                                     {
|                                         "Id":  "8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
|                                         "Name":  "Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  0,
|                                         "Reason":  "Full access including ability to assign roles in Azure RBAC, enabling immediate full tenant compromise.",
|                                         "Actions":  [
|                                                         "*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9",
|                                         "Name":  "User Access Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  0,
|                                         "Reason":  "Can manage user access to Azure resources including role assignments, enabling direct identity plane control.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.Authorization/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f58310d9-a9f6-439a-9e8d-f62e7b41a168",
|                                         "Name":  "Role Based Access Control Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  0,
|                                         "Reason":  "Can assign and delete role assignments, enabling immediate full control over Azure RBAC and tenant identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "*/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     }
|                                 ],
|    "Azure_BuiltInRoles_Tier1":  [
|                                     {
|                                         "Id":  "a7ffa36f-339b-4b5c-8bdf-e2c188b2c0eb",
|                                         "Name":  "Azure Kubernetes Service RBAC Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Access to secrets and ability to run pods as any ServiceAccount enables privilege escalation to cluster admin.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/managedClusters/apps/daemonsets/*",
|                                                             "Microsoft.ContainerService/managedClusters/apps/deployments/*",
|                                                             "Microsoft.ContainerService/managedClusters/apps/replicasets/*",
|                                                             "Microsoft.ContainerService/managedClusters/apps/statefulsets/*",
|                                                             "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/*",
|                                                             "Microsoft.ContainerService/managedClusters/batch/cronjobs/*",
|                                                             "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/read",
|                                                             "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/write",
|                                                             "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/delete",
|                                                             "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
|                                                             "Microsoft.ContainerService/managedClusters/batch/jobs/*",
|                                                             "Microsoft.ContainerService/managedClusters/configmaps/*",
|                                                             "Microsoft.ContainerService/managedClusters/endpoints/*",
|                                                             "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/managedClusters/events/*",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/daemonsets/*",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/deployments/*",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/ingresses/*",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/*",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/replicasets/*",
|                                                             "Microsoft.ContainerService/managedClusters/limitranges/read",
|                                                             "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
|                                                             "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
|                                                             "Microsoft.ContainerService/managedClusters/namespaces/read",
|                                                             "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/*",
|                                                             "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/*",
|                                                             "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/*",
|                                                             "Microsoft.ContainerService/managedClusters/pods/*",
|                                                             "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/*",
|                                                             "Microsoft.ContainerService/managedClusters/replicationcontrollers/*",
|                                                             "Microsoft.ContainerService/managedClusters/resourcequotas/read",
|                                                             "Microsoft.ContainerService/managedClusters/secrets/*",
|                                                             "Microsoft.ContainerService/managedClusters/serviceaccounts/*",
|                                                             "Microsoft.ContainerService/managedClusters/services/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fb1c8493-542b-48eb-b624-b4c8fea62acd",
|                                         "Name":  "Security Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can manage security policies and alerts, enabling reliable escalation to identity plane control via policy manipulation.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/policyAssignments/*",
|                                                         "Microsoft.Authorization/policyDefinitions/*",
|                                                         "Microsoft.Authorization/policyExemptions/*",
|                                                         "Microsoft.Authorization/policySetDefinitions/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.operationalInsights/workspaces/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Security/*",
|                                                         "Microsoft.IoTSecurity/*",
|                                                         "Microsoft.IoTFirmwareDefense/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8b54135c-b56d-4d72-a534-26097cfdc8d8",
|                                         "Name":  "Key Vault Data Access Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can manage role assignments for Key Vault roles, enabling a reliable path to elevate privileges and control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.KeyVault/vaults/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "66f75aeb-eabe-4b70-9f1e-c350c4c9ad04",
|                                         "Name":  "Virtual Machine Data Access Administrator (preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can manage role assignments for VM Administrator and User Login roles, enabling a reliable privilege escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Compute/virtualMachines/*/read",
|                                                         "Microsoft.HybridCompute/machines/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0f641de8-0b88-4198-bdef-bd8b45ceba96",
|                                         "Name":  "Defender for Storage Scanner Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Includes roleAssignments write/delete permissions allowing potential role assignment escalation.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Security/defenderforstoragesettings/read",
|                                                         "Microsoft.Security/defenderforstoragesettings/write",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Security/datascanners/read",
|                                                         "Microsoft.Security/datascanners/write",
|                                                         "Microsoft.Security/dataScanners/delete",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.EventGrid/topics/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/write",
|                                                         "Microsoft.EventGrid/eventSubscriptions/delete",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ef318e2a-8334-4a05-9e4a-295a196c6a6e",
|                                         "Name":  "Azure Red Hat OpenShift Federated Credential",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can create, update, and delete federated credentials on managed identities, enabling trust relationships that can be leveraged to escalate to tenant-wide access.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/read",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7e559ce2-48d7-4b27-9128-fa1b247f1308",
|                                         "Name":  "Managed Identity Federated Identity Credential Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can create, update, and delete federated identity credentials on managed identities, enabling privilege escalation via identity plane manipulation.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/read",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "eadc314b-1a2d-4efa-be10-5d325db5065e",
|                                         "Name":  "Azure AI Project Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can create and delete role assignments limited to Cognitive Service User role, enabling a reliable pivot to elevate privileges.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.CognitiveServices/accounts/*/read",
|                                                         "Microsoft.CognitiveServices/accounts/projects/*",
|                                                         "Microsoft.CognitiveServices/locations/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e47c6f54-e4a2-4754-9501-8e0985b135e1",
|                                         "Name":  "Azure AI Account Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Full access to manage AI projects and accounts including role assignments, enabling privilege escalation.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.CognitiveServices/*",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/providers/features/register/action",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/diagnosticSettings/*",
|                                                         "Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Insights/metricdefinitions/read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4c6569b6-f23e-4295-9b90-bd4cc4ff3292",
|                                         "Name":  "DevCenter Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can manage DevCenter resources and role assignments for DevCenter roles, enabling privilege escalation.",
|                                         "Actions":  [
|                                                         "Microsoft.DevCenter/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7b7c71ed-33fa-4ed2-a91a-e56d5da260b5",
|                                         "Name":  "Azure IoT Operations Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can write role assignments and manage deployments, enabling a reliable path to privilege escalation.",
|                                         "Actions":  [
|                                                         "Microsoft.IoTOperations/*",
|                                                         "Microsoft.DeviceRegistry/register/action",
|                                                         "Microsoft.DeviceRegistry/schemaRegistries/read",
|                                                         "Microsoft.DeviceRegistry/schemaRegistries/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Edge/sites/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0a7c2fa1-6f28-41a4-86b8-e74937c63222",
|                                         "Name":  "Tenant Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can create and manage Entra ID tenants, including write permissions to directories and tenants, enabling near-direct path to tenant takeover.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureActiveDirectory/directories/write",
|                                                         "Microsoft.AzureActiveDirectory/directories/read",
|                                                         "Microsoft.AzureActiveDirectory/entraTenants/write",
|                                                         "Microsoft.AzureActiveDirectory/entraTenants/read",
|                                                         "Microsoft.AzureActiveDirectory/entraTenants/delete",
|                                                         "Microsoft.AzureActiveDirectory/register/action",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5a2ec2f1-2375-4950-9906-59ec1d979249",
|                                         "Name":  "Azure Resilience Management Drills Assets Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Has Microsoft.Authorization/roleAssignments/write allowing role assignment management, enabling a reliable path to elevate privileges.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/delete",
|                                                         "Microsoft.Automation/automationAccounts/read",
|                                                         "Microsoft.Automation/automationAccounts/write",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/delete",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/write",
|                                                         "Microsoft.Chaos/experiments/delete",
|                                                         "Microsoft.Chaos/experiments/read",
|                                                         "Microsoft.Chaos/experiments/write",
|                                                         "Microsoft.Chaos/locations/operationResults/read",
|                                                         "Microsoft.Chaos/locations/operationStatuses/read",
|                                                         "Microsoft.Chaos/workspaces/delete",
|                                                         "Microsoft.Chaos/workspaces/read",
|                                                         "Microsoft.Chaos/workspaces/write",
|                                                         "Microsoft.Chaos/workspaces/refreshRecommendations/action",
|                                                         "Microsoft.Chaos/workspaces/discoveredResources/read",
|                                                         "Microsoft.Chaos/workspaces/scenarios/delete",
|                                                         "Microsoft.Chaos/workspaces/scenarios/read",
|                                                         "Microsoft.Chaos/workspaces/scenarios/write",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/delete",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/read",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/write",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/cancel/action",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/execute/action",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/validate/action",
|                                                         "Microsoft.Chaos/workspaces/scenarios/runs/read",
|                                                         "Microsoft.Insights/dataCollectionEndpoints/read",
|                                                         "Microsoft.Insights/dataCollectionEndpoints/write",
|                                                         "Microsoft.Insights/dataCollectionRules/read",
|                                                         "Microsoft.Insights/dataCollectionRules/write",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/tables/read",
|                                                         "Microsoft.OperationalInsights/workspaces/tables/write",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e4c7f620-39b8-4688-bba2-70dd82ef367b",
|                                         "Name":  "Azure Resilience Management Drills Target Resource Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Includes Microsoft.Authorization/roleAssignments/write enabling role assignment management, a direct path to privilege escalation.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Chaos/locations/targetTypes/capabilityTypes/read",
|                                                         "Microsoft.Chaos/locations/targetTypes/read",
|                                                         "Microsoft.Chaos/targets/capabilities/delete",
|                                                         "Microsoft.Chaos/targets/capabilities/read",
|                                                         "Microsoft.Chaos/targets/capabilities/write",
|                                                         "Microsoft.Chaos/targets/delete",
|                                                         "Microsoft.Chaos/targets/read",
|                                                         "Microsoft.Chaos/targets/write",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/read ",
|                                                         "Microsoft.Sql/managedInstances/read",
|                                                         "Microsoft.Web/serverfarms/read",
|                                                         "Microsoft.Web/sites/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     }
|                                 ],
|    "Azure_BuiltInRoles_Tier2":  [
|                                     {
|                                         "Id":  "b24988ac-6180-42a0-ab88-20f7382dd24c",
|                                         "Name":  "Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full resource management but cannot assign roles or modify identity plane objects; no direct path to tenant takeover.",
|                                         "Actions":  [
|                                                         "*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Authorization/*/Delete",
|                                                            "Microsoft.Authorization/*/Write",
|                                                            "Microsoft.Authorization/elevateAccess/Action",
|                                                            "Microsoft.Blueprint/blueprintAssignments/write",
|                                                            "Microsoft.Blueprint/blueprintAssignments/delete",
|                                                            "Microsoft.Compute/galleries/share/action",
|                                                            "Microsoft.Purview/consents/write",
|                                                            "Microsoft.Purview/consents/delete",
|                                                            "Microsoft.Resources/deploymentStacks/manageDenySetting/action",
|                                                            "Microsoft.Subscription/cancel/action",
|                                                            "Microsoft.Subscription/enable/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8d8d5a11-05d3-4bda-a417-a08778121c7c",
|                                         "Name":  "HDInsight Domain Services Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can modify domain services related to HDInsight but no direct identity plane control or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AAD/*/read",
|                                                         "Microsoft.AAD/domainServices/*/read",
|                                                         "Microsoft.AAD/domainServices/oucontainer/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f25e0fa2-a7c8-4377-a976-54943a77a395",
|                                         "Name":  "Key Vault Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can manage key vaults but not access secrets or modify identity plane controls directly.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.KeyVault/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.KeyVault/locations/deletedVaults/purge/action",
|                                                            "Microsoft.KeyVault/hsmPools/*",
|                                                            "Microsoft.KeyVault/managedHsms/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "92aaf0da-9dab-42b6-94a3-d43ce8d16293",
|                                         "Name":  "Log Analytics Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can modify monitoring settings and add VM extensions but no direct identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.ClassicCompute/virtualMachines/extensions/*",
|                                                         "Microsoft.ClassicStorage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Compute/virtualMachines/extensions/*",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/diagnosticSettings/*",
|                                                         "Microsoft.OperationalInsights/*",
|                                                         "Microsoft.OperationsManagement/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f1a07417-d97a-45cb-824c-7a7467783830",
|                                         "Name":  "Managed Identity Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can assign user-assigned managed identities but lacks permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/*/read",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e40ec5ca-96e0-45a2-b4ff-59039f2c2b59",
|                                         "Name":  "Managed Identity Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full CRUD on managed identities but no direct ability to assign roles or modify authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/read",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/write",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/delete",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/revokeTokens/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d58bcaf-24a5-4b20-bdb6-eed9f69fbe4c",
|                                         "Name":  "Management Group Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can modify management groups but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Management/managementGroups/delete",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Management/managementGroups/subscriptions/delete",
|                                                         "Microsoft.Management/managementGroups/subscriptions/write",
|                                                         "Microsoft.Management/managementGroups/write",
|                                                         "Microsoft.Management/managementGroups/subscriptions/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c12c1c16-33a1-487b-954d-41c89c60f349",
|                                         "Name":  "Reader and Data Access",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Access to storage account keys enables data exfiltration but no direct identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Storage/storageAccounts/ListAccountSas/action",
|                                                         "Microsoft.Storage/storageAccounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "36243c78-bf99-498c-9df9-86d9f8d28608",
|                                         "Name":  "Resource Policy Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can create and modify resource policies but lacks direct permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.Authorization/policyassignments/*",
|                                                         "Microsoft.Authorization/policydefinitions/*",
|                                                         "Microsoft.Authorization/policyexemptions/*",
|                                                         "Microsoft.Authorization/policyenrollments/*",
|                                                         "Microsoft.Authorization/policysetdefinitions/*",
|                                                         "Microsoft.PolicyInsights/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "17d1049b-9a84-46fb-8f53-869881c3d3ab",
|                                         "Name":  "Storage Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can manage storage accounts including access to keys, enabling data exfiltration but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/diagnosticSettings/*",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "81a9662b-bebf-436f-a333-f67b29880f12",
|                                         "Name":  "Storage Account Key Operator Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can list and regenerate storage account keys, enabling data exfiltration but no direct identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                         "Microsoft.Storage/storageAccounts/regeneratekey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
|                                         "Name":  "Storage Blob Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to blob containers and data enabling data exfiltration but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b7e6dc6d-f1e8-4753-8033-0f276bb0955b",
|                                         "Name":  "Storage Blob Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to blob containers and data including POSIX ACL assignment but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/*",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
|                                         "Name":  "Storage Blob Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read access to blob containers and data enabling data exfiltration but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "974c5e8b-45b9-4653-ba55-5f855dd0fb88",
|                                         "Name":  "Storage Queue Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read, write, and delete access to storage queues enabling data exfiltration but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/queueServices/queues/delete",
|                                                         "Microsoft.Storage/storageAccounts/queueServices/queues/read",
|                                                         "Microsoft.Storage/storageAccounts/queueServices/queues/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/delete",
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/read",
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/write",
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/process/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8a0f0c08-91a1-4084-bc3d-661d67233fed",
|                                         "Name":  "Storage Queue Data Message Processor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can peek, receive, and delete queue messages enabling data exfiltration but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/read",
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/process/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c6a89b2d-59bc-44d0-9896-0f6e12d7b80a",
|                                         "Name":  "Storage Queue Data Message Sender",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can send queue messages but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/add/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "19e7f393-937e-4f77-808e-94535e297925",
|                                         "Name":  "Storage Queue Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read access to storage queues and messages enabling data exfiltration but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/queueServices/queues/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "090c5cfd-751d-490a-894a-3ce6f1109419",
|                                         "Name":  "Azure Service Bus Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to Service Bus data plane enables data exfiltration but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ServiceBus/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ServiceBus/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f526a384-b230-433a-b45c-95f59c4a2dec",
|                                         "Name":  "Azure Event Hubs Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to Event Hubs data plane enables data exfiltration but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.EventHub/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventHub/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a638d3c7-ab3a-418d-83e6-5f17a39d4fde",
|                                         "Name":  "Azure Event Hubs Data Receiver",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Receive access to Event Hubs data plane enables data exfiltration but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.EventHub/*/eventhubs/consumergroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventHub/*/receive/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2b629674-e913-4c01-ae53-ef4638d8f975",
|                                         "Name":  "Azure Event Hubs Data Sender",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Send access to Event Hubs data plane enables data manipulation but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.EventHub/*/eventhubs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventHub/*/send/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4f6d3b9b-027b-4f4c-9142-0e5a2a2247e0",
|                                         "Name":  "Azure Service Bus Data Receiver",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Receive access to Service Bus data plane enables data exfiltration but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ServiceBus/*/queues/read",
|                                                         "Microsoft.ServiceBus/*/topics/read",
|                                                         "Microsoft.ServiceBus/*/topics/subscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ServiceBus/*/receive/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "69a216fc-b8fb-44d8-bc22-1f3c2cd27a39",
|                                         "Name":  "Azure Service Bus Data Sender",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Send access to Service Bus data plane enables data manipulation but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ServiceBus/*/queues/read",
|                                                         "Microsoft.ServiceBus/*/topics/read",
|                                                         "Microsoft.ServiceBus/*/topics/subscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ServiceBus/*/send/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "aba4ae5f-2193-4029-9191-0cb91df5e314",
|                                         "Name":  "Storage File Data SMB Share Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read access to file shares enables data exfiltration but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb",
|                                         "Name":  "Storage File Data SMB Share Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read/write/delete access to file shares enables data manipulation but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "db58b8e5-c6ad-4a2a-8342-4190687cbf4a",
|                                         "Name":  "Storage Blob Delegator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can generate user delegation keys for SAS tokens enabling data access but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a7264617-510b-434b-a828-9731dc254ea7",
|                                         "Name":  "Storage File Data SMB Share Elevated Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access including NTFS permissions on file shares enables data manipulation but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5ae67dd6-50cb-40e7-96ff-dc2bfa4b606b",
|                                         "Name":  "App Configuration Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to App Configuration data enables data manipulation but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppConfiguration/configurationStores/*/read",
|                                                             "Microsoft.AppConfiguration/configurationStores/*/write",
|                                                             "Microsoft.AppConfiguration/configurationStores/*/delete",
|                                                             "Microsoft.AppConfiguration/configurationStores/*/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "516239f1-63e1-4d78-a4de-a74fb236a071",
|                                         "Name":  "App Configuration Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read access to App Configuration data enables data exfiltration but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppConfiguration/configurationStores/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d57506d4-4c8d-48b1-8587-93c323f6a5a3",
|                                         "Name":  "Azure Digital Twins Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read-only access to Digital Twins data plane; no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DigitalTwins/digitaltwins/read",
|                                                             "Microsoft.DigitalTwins/digitaltwins/relationships/read",
|                                                             "Microsoft.DigitalTwins/eventroutes/read",
|                                                             "Microsoft.DigitalTwins/jobs/import/read",
|                                                             "Microsoft.DigitalTwins/jobs/imports/read",
|                                                             "Microsoft.DigitalTwins/jobs/deletions/read",
|                                                             "Microsoft.DigitalTwins/models/read",
|                                                             "Microsoft.DigitalTwins/query/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bcd981a7-7f74-457b-83e1-cceb9e632ffe",
|                                         "Name":  "Azure Digital Twins Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to Digital Twins data plane; no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DigitalTwins/digitaltwins/*",
|                                                             "Microsoft.DigitalTwins/digitaltwins/commands/*",
|                                                             "Microsoft.DigitalTwins/digitaltwins/relationships/*",
|                                                             "Microsoft.DigitalTwins/eventroutes/*",
|                                                             "Microsoft.DigitalTwins/jobs/*",
|                                                             "Microsoft.DigitalTwins/models/*",
|                                                             "Microsoft.DigitalTwins/query/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5a1fc7df-4bf1-4951-a576-89034ee01acd",
|                                         "Name":  "FHIR Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to FHIR data enables significant data exfiltration but no direct identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/*",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3db33094-8700-4567-8da5-1501d4e7e843",
|                                         "Name":  "FHIR Data Exporter",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read and export FHIR data allows mass data exfiltration but no path to identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/export/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/export/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4c8d0bbc-75d3-4935-991f-5f3c56d81508",
|                                         "Name":  "FHIR Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read-only access to FHIR data enables data exfiltration but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3f88fce4-5892-4214-ae73-ba5294559913",
|                                         "Name":  "FHIR Data Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read and write access to FHIR data allows data manipulation but no direct identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/write",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/delete",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/export/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/resourceValidate/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/reindex/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/convertData/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/editProfileDefinitions/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/import/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/write",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/delete",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/export/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/resourceValidate/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/reindex/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/convertData/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/editProfileDefinitions/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/import/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4dd61c23-6743-42fe-a388-d8bdd41cb745",
|                                         "Name":  "Object Understanding Account Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Ingestion capabilities for Azure Object Understanding allow data manipulation but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/ObjectUnderstandingAccounts/ingest/action",
|                                                             "Microsoft.MixedReality/ObjectUnderstandingAccounts/ingest/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8f5e0ce6-4f7b-4dcf-bddf-e6f48634a204",
|                                         "Name":  "Azure Maps Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read, write, and delete access to map data enables data manipulation but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Maps/accounts/*/read",
|                                                             "Microsoft.Maps/accounts/*/write",
|                                                             "Microsoft.Maps/accounts/*/delete",
|                                                             "Microsoft.Maps/accounts/*/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c1ff6cc2-c111-46fe-8896-e0ef812ad9f3",
|                                         "Name":  "Cognitive Services Custom Vision Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full project access allows data and model manipulation but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5c4089e1-6d96-4d2f-b296-c1bc7137275f",
|                                         "Name":  "Cognitive Services Custom Vision Deployment",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Publish and export models but no ability to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/iterations/publish/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/iterations/export/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/quicktest/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/classify/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/detect/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "88424f51-ebe7-446f-bc41-7fa16989e96c",
|                                         "Name":  "Cognitive Services Custom Vision Labeler",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Modify training images and tags but no identity plane control or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/query/action",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/images/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/tags/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/images/suggested/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/tagsandregions/suggestions/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0a5ae4ab-0d65-4eeb-be61-29fc9b54394b",
|                                         "Name":  "Cognitive Services Custom Vision Trainer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Train and publish models but no ability to escalate to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "00482a5a-887f-4fb3-b363-3b7fe8e74483",
|                                         "Name":  "Key Vault Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full data plane control over key vault contents but cannot manage role assignments or permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.KeyVault/checkNameAvailability/read",
|                                                         "Microsoft.KeyVault/deletedVaults/read",
|                                                         "Microsoft.KeyVault/locations/*/read",
|                                                         "Microsoft.KeyVault/vaults/*/read",
|                                                         "Microsoft.KeyVault/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "12338af0-0e69-4776-bea7-57ae8d297424",
|                                         "Name":  "Key Vault Crypto User",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Perform cryptographic operations but no ability to escalate privileges or modify roles.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/keys/read",
|                                                             "Microsoft.KeyVault/vaults/keys/update/action",
|                                                             "Microsoft.KeyVault/vaults/keys/backup/action",
|                                                             "Microsoft.KeyVault/vaults/keys/encrypt/action",
|                                                             "Microsoft.KeyVault/vaults/keys/decrypt/action",
|                                                             "Microsoft.KeyVault/vaults/keys/wrap/action",
|                                                             "Microsoft.KeyVault/vaults/keys/unwrap/action",
|                                                             "Microsoft.KeyVault/vaults/keys/sign/action",
|                                                             "Microsoft.KeyVault/vaults/keys/verify/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b86a8fe4-44ce-4948-aee5-eccb2c155cd7",
|                                         "Name":  "Key Vault Secrets Officer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage secrets but cannot manage permissions or role assignments, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.KeyVault/checkNameAvailability/read",
|                                                         "Microsoft.KeyVault/deletedVaults/read",
|                                                         "Microsoft.KeyVault/locations/*/read",
|                                                         "Microsoft.KeyVault/vaults/*/read",
|                                                         "Microsoft.KeyVault/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/secrets/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4633458b-17de-408a-b874-0445c86b69e6",
|                                         "Name":  "Key Vault Secrets User",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read secret contents enables data exfiltration but no direct identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/secrets/getSecret/action",
|                                                             "Microsoft.KeyVault/vaults/secrets/readMetadata/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a4417e6f-fecd-4de8-b567-7b0420556985",
|                                         "Name":  "Key Vault Certificates Officer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage certificates but no permission to modify roles or escalate privileges.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.KeyVault/checkNameAvailability/read",
|                                                         "Microsoft.KeyVault/deletedVaults/read",
|                                                         "Microsoft.KeyVault/locations/*/read",
|                                                         "Microsoft.KeyVault/vaults/*/read",
|                                                         "Microsoft.KeyVault/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/certificatecas/*",
|                                                             "Microsoft.KeyVault/vaults/certificates/*",
|                                                             "Microsoft.KeyVault/vaults/certificatecontacts/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e147488a-f6f5-4113-8e2d-b22465e65bf6",
|                                         "Name":  "Key Vault Crypto Service Encryption User",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Perform wrap/unwrap operations but no ability to escalate privileges or modify roles.",
|                                         "Actions":  [
|                                                         "Microsoft.EventGrid/eventSubscriptions/write",
|                                                         "Microsoft.EventGrid/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/keys/read",
|                                                             "Microsoft.KeyVault/vaults/keys/wrap/action",
|                                                             "Microsoft.KeyVault/vaults/keys/unwrap/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "63f0a09d-1495-4db4-a681-037d84835eb4",
|                                         "Name":  "Azure Arc Kubernetes Viewer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "View cluster resources except secrets, no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/deployments/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/replicasets/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/batch/jobs/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/configmaps/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/endpoints/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/events/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/deployments/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/limitranges/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/namespaces/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/pods/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/serviceaccounts/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/services/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5b999177-9696-4545-85c7-50de3797e5a1",
|                                         "Name":  "Azure Arc Kubernetes Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Update cluster resources except roles and bindings, no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/configmaps/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/endpoints/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/events/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/limitranges/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/namespaces/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/pods/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/secrets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/services/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8393591c-06b9-48a2-a542-1bd6b377f6a2",
|                                         "Name":  "Azure Arc Kubernetes Cluster Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage all cluster resources but no direct identity plane control or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Kubernetes/connectedClusters/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dffb1e0c-446f-4dde-a09f-99eb5cc68b96",
|                                         "Name":  "Azure Arc Kubernetes Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage cluster resources except quotas and namespaces, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write",
|                                                             "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/configmaps/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/endpoints/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/events/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/limitranges/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/namespaces/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/pods/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/secrets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/services/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b",
|                                         "Name":  "Azure Kubernetes Service RBAC Cluster Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage all cluster resources but no direct identity plane control or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/managedClusters/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3498e952-d568-435e-9b2c-8d77e338d7f7",
|                                         "Name":  "Azure Kubernetes Service RBAC Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage cluster resources except quotas and namespaces, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/managedClusters/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7f6c6a51-bcf8-42ba-9220-52d62157d7db",
|                                         "Name":  "Azure Kubernetes Service RBAC Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read-only access to most namespace objects, no access to roles or secrets, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/managedClusters/apps/daemonsets/read",
|                                                             "Microsoft.ContainerService/managedClusters/apps/deployments/read",
|                                                             "Microsoft.ContainerService/managedClusters/apps/replicasets/read",
|                                                             "Microsoft.ContainerService/managedClusters/apps/statefulsets/read",
|                                                             "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/read",
|                                                             "Microsoft.ContainerService/managedClusters/batch/cronjobs/read",
|                                                             "Microsoft.ContainerService/managedClusters/batch/jobs/read",
|                                                             "Microsoft.ContainerService/managedClusters/configmaps/read",
|                                                             "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
|                                                             "Microsoft.ContainerService/managedClusters/endpoints/read",
|                                                             "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/managedClusters/events/read",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/daemonsets/read",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/deployments/read",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/ingresses/read",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/read",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/replicasets/read",
|                                                             "Microsoft.ContainerService/managedClusters/limitranges/read",
|                                                             "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
|                                                             "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
|                                                             "Microsoft.ContainerService/managedClusters/namespaces/read",
|                                                             "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/read",
|                                                             "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/read",
|                                                             "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/read",
|                                                             "Microsoft.ContainerService/managedClusters/pods/read",
|                                                             "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/read",
|                                                             "Microsoft.ContainerService/managedClusters/replicationcontrollers/read",
|                                                             "Microsoft.ContainerService/managedClusters/resourcequotas/read",
|                                                             "Microsoft.ContainerService/managedClusters/serviceaccounts/read",
|                                                             "Microsoft.ContainerService/managedClusters/services/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fd53cd77-2268-407a-8f46-7e7863d0f521",
|                                         "Name":  "SignalR REST API Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to SignalR REST APIs allows data manipulation but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SignalRService/SignalR/auth/clientToken/action",
|                                                             "Microsoft.SignalRService/SignalR/hub/*",
|                                                             "Microsoft.SignalRService/SignalR/group/*",
|                                                             "Microsoft.SignalRService/SignalR/clientConnection/*",
|                                                             "Microsoft.SignalRService/SignalR/user/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "daa9e50b-21df-454c-94a6-a8050adab352",
|                                         "Name":  "Collaborative Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage data packages in collaborative environment but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.IndustryDataLifecycle/custodianCollaboratives/*/read",
|                                                         "Microsoft.IndustryDataLifecycle/memberCollaboratives/*/read",
|                                                         "Microsoft.IndustryDataLifecycle/locations/dataPackages/*",
|                                                         "Microsoft.IndustryDataLifecycle/custodianCollaboratives/receivedDataPackages/*",
|                                                         "Microsoft.IndustryDataLifecycle/custodianCollaboratives/rejectDataPackage/action",
|                                                         "Microsoft.IndustryDataLifecycle/memberCollaboratives/sharedDataPackages/*",
|                                                         "Microsoft.IndustryDataLifecycle/custodianCollaboratives/dataModels/*",
|                                                         "Microsoft.IndustryDataLifecycle/custodianCollaboratives/auditLogs/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "02ca0879-e8e4-47a5-a61e-5c618b76e64a",
|                                         "Name":  "Device Update Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management access to device update operations but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.DeviceUpdate/accounts/read",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/read",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/write",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/delete",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/read",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/write",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0378884a-3af5-44ab-8323-f5b22f9f3c98",
|                                         "Name":  "Device Update Content Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to content operations but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.DeviceUpdate/accounts/read",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/read",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/write",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cb43c632-a144-4ec5-977c-e80c4affc34a",
|                                         "Name":  "Cognitive Services Metrics Advisor Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to metrics project including system configuration but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/MetricsAdvisor/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5dffeca3-4936-4216-b2bc-10343a5abb25",
|                                         "Name":  "Schema Registry Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read, write, and delete schema registry groups and schemas but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.EventHub/namespaces/schemagroups/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventHub/namespaces/schemas/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8508508a-4469-4e45-963b-2518ee0bb728",
|                                         "Name":  "AgFood Platform Service Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Contribute access to AgFood Platform Service but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/*/action",
|                                                             "Microsoft.AgFoodPlatform/*/read",
|                                                             "Microsoft.AgFoodPlatform/*/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f8da80de-1ff9-4747-ad80-a19b7f6079e3",
|                                         "Name":  "AgFood Platform Service Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Admin access to AgFood Platform Service but no identity plane control or role assignment.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "18500a29-7fe2-46b2-a342-b16a415e101d",
|                                         "Name":  "Managed HSM contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage managed HSM pools but no access to keys or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.KeyVault/managedHSMs/*",
|                                                         "Microsoft.KeyVault/deletedManagedHsms/read",
|                                                         "Microsoft.KeyVault/locations/deletedManagedHsms/read",
|                                                         "Microsoft.KeyVault/locations/deletedManagedHsms/purge/action",
|                                                         "Microsoft.KeyVault/locations/managedHsmOperationResults/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7e4f1700-ea5a-4f59-8f37-079cfe29dce3",
|                                         "Name":  "SignalR Service Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to SignalR Service REST APIs but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SignalRService/SignalR/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "635dd51f-9968-44d3-b7fb-6d9a6bd613ae",
|                                         "Name":  "AzureML Metrics Writer (preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Write metrics to AzureML workspace but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/metrics/*/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1",
|                                         "Name":  "Storage Account Backup Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Perform backup and restore on storage account but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/locks/read",
|                                                         "Microsoft.Authorization/locks/write",
|                                                         "Microsoft.Authorization/locks/delete",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/operations/read",
|                                                         "Microsoft.Storage/storageAccounts/objectReplicationPolicies/delete",
|                                                         "Microsoft.Storage/storageAccounts/objectReplicationPolicies/read",
|                                                         "Microsoft.Storage/storageAccounts/objectReplicationPolicies/write",
|                                                         "Microsoft.Storage/storageAccounts/objectReplicationPolicies/restorePointMarkers/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/restoreBlobRanges/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6188b7c9-7d01-4f99-a59f-c88b630326c0",
|                                         "Name":  "Experimentation Metric Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Create and write metrics but no identity plane control or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/metricwrite/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/metricwrite/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "00c29273-979b-4161-815c-10b084fb9324",
|                                         "Name":  "Backup Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can manage backup services but lacks direct identity plane control; potential for data impact.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/backup/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationsStatus/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/provisionInstantItemRecovery/action",
|                                                         "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/accessToken/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/restore/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/revokeInstantItemRecovery/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/refreshContainers/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupJobs/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupJobsExport/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupOperationResults/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectableItems/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectedItems/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectionContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read",
|                                                         "Microsoft.RecoveryServices/Vaults/certificates/write",
|                                                         "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                         "Microsoft.RecoveryServices/Vaults/extendedInformation/write",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*",
|                                                         "Microsoft.RecoveryServices/Vaults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/write",
|                                                         "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupstorageconfig/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupValidateOperation/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupTriggerValidateOperation/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupValidateOperationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupValidateOperationsStatuses/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupOperations/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/operations/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/write",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/inquire/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupEngines/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/write",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectableContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/items/read",
|                                                         "Microsoft.RecoveryServices/locations/backupStatus/action",
|                                                         "Microsoft.RecoveryServices/locations/backupPreValidateProtection/action",
|                                                         "Microsoft.RecoveryServices/locations/backupValidateFeatures/action",
|                                                         "Microsoft.RecoveryServices/locations/backupAadProperties/read",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrJobs/action",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrJob/action",
|                                                         "Microsoft.RecoveryServices/locations/backupCrossRegionRestore/action",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrOperationResults/read",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrOperationsStatus/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/write",
|                                                         "Microsoft.RecoveryServices/operations/read",
|                                                         "Microsoft.RecoveryServices/locations/operationStatus/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/write",
|                                                         "Microsoft.DataProtection/backupVaults/deletedBackupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/backupVaults/operationResults/read",
|                                                         "Microsoft.DataProtection/backupVaults/operationStatus/read",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/locations/operationStatus/read",
|                                                         "Microsoft.DataProtection/locations/operationResults/read",
|                                                         "Microsoft.DataProtection/operations/read",
|                                                         "Microsoft.DataProtection/backupVaults/validateForBackup/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/backup/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/validateRestore/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/restore/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/crossRegionRestore/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/validateCrossRegionRestore/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action",
|                                                         "Microsoft.DataProtection/locations/checkFeatureSupport/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/delete",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/unlockDelete/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/write",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/write",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/delete",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/unlockDelete/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/validateForModifyBackup/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "14b46e9e-c2b7-41b4-b07b-48a6ebf60603",
|                                         "Name":  "Key Vault Crypto Officer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can perform cryptographic operations on keys but cannot manage permissions; no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.KeyVault/checkNameAvailability/read",
|                                                         "Microsoft.KeyVault/deletedVaults/read",
|                                                         "Microsoft.KeyVault/locations/*/read",
|                                                         "Microsoft.KeyVault/vaults/*/read",
|                                                         "Microsoft.KeyVault/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/keys/*",
|                                                             "Microsoft.KeyVault/vaults/keyrotationpolicies/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "76cc9ee4-d5d3-4a45-a930-26add3d73475",
|                                         "Name":  "Access Review Operator Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can delete role assignments related to access reviews; enables limited identity plane impact but not direct takeover.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.Management/getEntities/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2ccf8795-8983-4912-8036-1c45212c95e8",
|                                         "Name":  "ToolchainOrchestrator Admin Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Grants full management of Toolchain orchestrator resources but does not include identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ToolchainOrchestrator/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0847e196-2fd2-4c2f-a48c-fca6fd030f44",
|                                         "Name":  "HDInsight Cluster Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full control over HDInsight clusters but no direct identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/APPLICATIONS/DELETE",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/APPLICATIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/APPLICATIONS/WRITE",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/AZUREASYNCOPERATIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/CONFIGURATIONS/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/CONFIGURATIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/DELETE",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/EXECUTESCRIPTACTIONS/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/EXTENSIONS/DELETE",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/EXTENSIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/EXTENSIONS/WRITE",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/GETGATEWAYSETTINGS/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/LISTHOSTS/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/OPERATIONRESULTS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/PRIVATEENDPOINTCONNECTIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/PRIVATELINKRESOURCES/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/RESOLVEPRIVATELINKSERVICEID/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/RESTARTHOSTS/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/ROLES/AUTOSCALE/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/ROLES/RESIZE/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTACTIONS/DELETE",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTACTIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTEXECUTIONHISTORY/PROMOTE/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTEXECUTIONHISTORY/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/UPDATEGATEWAYSETTINGS/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/WRITE",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/AVAILABLECLUSTERVERSIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/AZUREASYNCOPERATIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/BILLINGSPECS/READ",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/CAPABILITIES/READ",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/CHECKNAMEAVAILABILITY/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/OPERATIONRESULTS/READ",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/OPERATIONSTATUSES/READ",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/OPERATIONSTATUSES/WRITE",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/USAGES/READ",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/VALIDATECREATEREQUEST/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/OPERATIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/REGISTER/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/RESOURCETYPES/READ",
|                                                         "MICROSOFT.HDINSIGHT/UNREGISTER/ACTION",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d977122-f97e-4b4d-a52f-6b43003ddb4d",
|                                         "Name":  "Azure Container Instances Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of container groups but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerInstance/containerGroups/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8ad4d0ee-9bfb-49e8-93fc-01abb8db6240",
|                                         "Name":  "Transparency Logs Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Transparency Log resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Sovereign/transparencyLogs/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "136d308c-0937-4a49-9bd7-edfb42adbffc",
|                                         "Name":  "Disk Encryption Set Operator for Managed Disks",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can manage disk encryption sets but lacks identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/diskEncryptionSets/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9295f069-25d0-4f44-bb6a-3da70d11aa00",
|                                         "Name":  "Azure Edge Hardware Center Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to edge order administration but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.EdgeOrder/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b78c5d69-af96-48a3-bf8d-a8b4d589de94",
|                                         "Name":  "Azure AI Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full control over Azure AI resources but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.CognitiveServices/*",
|                                                         "Microsoft.ContainerRegistry/registries/*",
|                                                         "Microsoft.DocumentDb/databaseAccounts/*",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/providers/features/register/action",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/components/*",
|                                                         "Microsoft.Insights/diagnosticSettings/*",
|                                                         "Microsoft.Insights/generateLiveToken/read",
|                                                         "Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Insights/metricAlerts/*",
|                                                         "Microsoft.Insights/metricdefinitions/read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/scheduledqueryrules/*",
|                                                         "Microsoft.Insights/topology/read",
|                                                         "Microsoft.Insights/transactions/read",
|                                                         "Microsoft.Insights/webtests/*",
|                                                         "Microsoft.KeyVault/*",
|                                                         "Microsoft.MachineLearningServices/workspaces/*",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Storage/storageAccounts/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Search/searchServices/write",
|                                                         "Microsoft.Search/searchServices/read",
|                                                         "Microsoft.Search/searchServices/delete",
|                                                         "Microsoft.Search/searchServices/indexes/*",
|                                                         "Microsoft.Search/searchServices/listAdminKeys/action",
|                                                         "Microsoft.Search/searchServices/privateEndpointConnections/*",
|                                                         "Microsoft.DataFactory/factories/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "358470bc-b998-42bd-ab17-a7e34c199c0f",
|                                         "Name":  "Container Apps Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Container Apps but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/containerApps/*/read",
|                                                         "Microsoft.App/containerApps/*/write",
|                                                         "Microsoft.App/containerApps/*/delete",
|                                                         "Microsoft.App/containerApps/*/action",
|                                                         "Microsoft.App/managedEnvironments/read",
|                                                         "Microsoft.App/managedEnvironments/*/read",
|                                                         "Microsoft.App/managedEnvironments/join/action",
|                                                         "Microsoft.App/managedEnvironments/checknameavailability/action",
|                                                         "Microsoft.App/connectedEnvironments/read",
|                                                         "Microsoft.App/connectedEnvironments/*/read",
|                                                         "Microsoft.App/connectedEnvironments/join/action",
|                                                         "Microsoft.App/connectedEnvironments/checknameavailability/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f7669afb-68b2-44b4-9c5f-6d2a47fddda0",
|                                         "Name":  "Container Apps SessionPools Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Container Apps SessionPools but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/sessionPools/*/read",
|                                                         "Microsoft.App/sessionPools/*/write",
|                                                         "Microsoft.App/sessionPools/*/delete",
|                                                         "Microsoft.App/sessionPools/*/action",
|                                                         "microsoft.App/managedEnvironments/read",
|                                                         "Microsoft.App/managedEnvironments/*/read",
|                                                         "Microsoft.App/managedEnvironments/join/action",
|                                                         "Microsoft.App/managedEnvironments/checknameavailability/action",
|                                                         "microsoft.App/connectedEnvironments/read",
|                                                         "Microsoft.App/connectedEnvironments/*/read",
|                                                         "Microsoft.App/connectedEnvironments/join/action",
|                                                         "Microsoft.App/connectedEnvironments/checknameavailability/action",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.App/sessionPools/fetchMcpServerCredentials/action",
|                                                            "Microsoft.App/sessionPools/rotateMcpServerCredentials/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "57cc5028-e6a7-4284-868d-0611c5923f8d",
|                                         "Name":  "Container Apps ManagedEnvironments Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Container Apps ManagedEnvironments but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/managedEnvironments/*/read",
|                                                         "Microsoft.App/managedEnvironments/*/write",
|                                                         "Microsoft.App/managedEnvironments/*/delete",
|                                                         "Microsoft.App/managedEnvironments/*/action",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4e3d2b60-56ae-4dc6-a233-09c8e5a82e68",
|                                         "Name":  "Container Apps Jobs Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Container Apps jobs but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "microsoft.app/jobs/read",
|                                                         "Microsoft.App/jobs/*/read",
|                                                         "Microsoft.App/jobs/*/action",
|                                                         "Microsoft.App/jobs/write",
|                                                         "Microsoft.App/jobs/delete",
|                                                         "Microsoft.app/managedenvironments/read",
|                                                         "Microsoft.App/managedenvironments/*/read",
|                                                         "Microsoft.App/managedenvironments/join/action",
|                                                         "Microsoft.App/managedenvironments/checknameavailability/action",
|                                                         "Microsoft.app/connectedEnvironments/read",
|                                                         "Microsoft.App/connectedEnvironments/*/read",
|                                                         "Microsoft.App/connectedEnvironments/join/action",
|                                                         "Microsoft.App/connectedEnvironments/checknameavailability/action",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1a5682fc-4f12-4b25-927e-e8cfed0c539e",
|                                         "Name":  "KubernetesRuntime Load Balancer Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage load balancers in Kubernetes clusters but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.KubernetesRuntime/loadBalancers/read",
|                                                         "Microsoft.KubernetesRuntime/loadBalancers/write",
|                                                         "Microsoft.KubernetesRuntime/loadBalancers/delete",
|                                                         "Microsoft.KubernetesRuntime/bgpPeers/read",
|                                                         "Microsoft.KubernetesRuntime/bgpPeers/write",
|                                                         "Microsoft.KubernetesRuntime/bgpPeers/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.KubernetesRuntime/locations/operationStatuses/write",
|                                                         "Microsoft.KubernetesRuntime/services/write",
|                                                         "Microsoft.KubernetesRuntime/services/delete",
|                                                         "Microsoft.KubernetesRuntime/bfdProfiles/write",
|                                                         "Microsoft.KubernetesRuntime/bfdProfiles/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d715fb95-a0f0-4f1c-8be6-5ad2d2767f67",
|                                         "Name":  "AVS Orchestrator Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manages AVS private cloud resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/operationStatuses/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Network/virtualHubs/delete",
|                                                         "Microsoft.Network/publicIPAddresses/delete",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/delete",
|                                                         "Microsoft.Network/virtualNetworks/subnets/delete",
|                                                         "Microsoft.Network/networkIntentPolicies/read",
|                                                         "Microsoft.Network/networkIntentPolicies/delete",
|                                                         "Microsoft.Network/networkIntentPolicies/write",
|                                                         "Microsoft.Network/networkSecurityGroups/delete",
|                                                         "Microsoft.Network/networkSecurityGroups/write",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/write",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/delete",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/delete",
|                                                         "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action",
|                                                         "Microsoft.Network/virtualHubs/write",
|                                                         "Microsoft.Network/publicIPAddresses/write",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/virtualHubs/ipConfigurations/write",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                         "Microsoft.Network/virtualHubs/ipConfigurations/read",
|                                                         "Microsoft.Network/virtualHubs/bgpConnections/write",
|                                                         "Microsoft.Network/virtualHubs/bgpConnections/read",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
|                                                         "Microsoft.Network/virtualNetworks/peer/action",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Network/locations/operationResults/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/routeTables/read",
|                                                         "Microsoft.Network/routeTables/write",
|                                                         "Microsoft.Network/routeTables/delete",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/routeTables/routes/read",
|                                                         "Microsoft.Network/routeTables/routes/write",
|                                                         "Microsoft.Network/routeTables/routes/delete",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "db7003cd-07a9-490c-bfa5-23e40314f8d7",
|                                         "Name":  "Service Connector Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can manage Service Connector resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ServiceLinker/linkers/read",
|                                                         "Microsoft.ServiceLinker/linkers/delete",
|                                                         "Microsoft.ServiceLinker/linkers/write",
|                                                         "Microsoft.ServiceLinker/linkers/listConfigurations/action",
|                                                         "Microsoft.ServiceLinker/linkers/validateLinker/action",
|                                                         "Microsoft.ServiceLinker/dryruns/delete",
|                                                         "Microsoft.ServiceLinker/dryruns/write",
|                                                         "Microsoft.ServiceLinker/linkers/generateConfigurations/action",
|                                                         "Microsoft.ServiceLinker/locations/connectors/delete",
|                                                         "Microsoft.ServiceLinker/locations/connectors/generateConfigurations/action",
|                                                         "Microsoft.ServiceLinker/locations/connectors/validate/action",
|                                                         "Microsoft.ServiceLinker/locations/connectors/write",
|                                                         "Microsoft.ServiceLinker/locations/dryruns/delete",
|                                                         "Microsoft.ServiceLinker/locations/dryruns/write",
|                                                         "Microsoft.ServiceLinker/locations/operationStatuses/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a68e7c17-0ab2-4c09-9a58-125dae29748c",
|                                         "Name":  "Key Vault Purge Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can permanently delete soft-deleted vaults but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.KeyVault/deletedVaults/read",
|                                                         "Microsoft.KeyVault/locations/deletedVaults/read",
|                                                         "Microsoft.KeyVault/locations/deletedVaults/purge/action",
|                                                         "Microsoft.KeyVault/locations/operationResults/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b9a307c4-5aa3-4b52-ba60-2b17c136cd7b",
|                                         "Name":  "Container Apps Jobs Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can read, start, and stop Container Apps jobs but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "microsoft.app/jobs/read",
|                                                         "Microsoft.App/jobs/*/read",
|                                                         "Microsoft.App/jobs/*/action",
|                                                         "Microsoft.app/managedenvironments/read",
|                                                         "Microsoft.App/managedenvironments/*/read",
|                                                         "Microsoft.App/managedenvironments/join/action",
|                                                         "Microsoft.App/managedenvironments/checknameavailability/action",
|                                                         "Microsoft.app/connectedEnvironments/read",
|                                                         "Microsoft.App/connectedEnvironments/*/read",
|                                                         "Microsoft.App/connectedEnvironments/join/action",
|                                                         "Microsoft.App/connectedEnvironments/checknameavailability/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/jobs/logstream/action",
|                                                             "Microsoft.App/jobs/exec/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "77be276d-fb44-4f3b-beb5-9bf03c4cd2d3",
|                                         "Name":  "Operator Nexus Owner (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to Operator Nexus Network Cloud resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.NetworkCloud/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4e9d0bd4-5aab-4f91-92df-9def33fe287c",
|                                         "Name":  "CloudTest Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of CloudTest resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CloudTest/*/read",
|                                                         "Microsoft.CloudTest/hostedpools/write",
|                                                         "Microsoft.CloudTest/hostedpools/delete",
|                                                         "Microsoft.CloudTest/images/write",
|                                                         "Microsoft.CloudTest/images/delete",
|                                                         "Microsoft.CloudTest/images/cancel/action",
|                                                         "Microsoft.CloudTest/images/refresh/action",
|                                                         "Microsoft.CloudTest/pools/write",
|                                                         "Microsoft.CloudTest/pools/delete",
|                                                         "Microsoft.CloudTest/accounts/write",
|                                                         "Microsoft.CloudTest/accounts/delete",
|                                                         "Microsoft.CloudTest/buildcaches/write",
|                                                         "Microsoft.CloudTest/buildcaches/delete",
|                                                         "Microsoft.CloudTest/pools/leases/action",
|                                                         "Microsoft.CloudTest/pools/leases/complete/action",
|                                                         "Microsoft.CloudTest/pools/leases/extend/action",
|                                                         "Microsoft.CloudTest/hostedpools/leases/action",
|                                                         "Microsoft.CloudTest/hostedpools/leases/complete/action",
|                                                         "Microsoft.CloudTest/hostedpools/leases/extend/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8d6517c1-e434-405c-9f3f-e0ae65085d76",
|                                         "Name":  "Azure Automanage Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Automanage resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Automanage/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9fc6112f-f48e-4e27-8b09-72a5c94e4ae9",
|                                         "Name":  "Azure Bot Service Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Bot Service resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.BotService/listAuthServiceProviders/action",
|                                                         "Microsoft.BotService/listauthserviceproviders/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.BotService/botServices/read",
|                                                         "Microsoft.BotService/botServices/write",
|                                                         "Microsoft.BotService/botServices/delete",
|                                                         "Microsoft.BotService/botServices/channels/write",
|                                                         "Microsoft.BotService/botServices/channels/read",
|                                                         "Microsoft.BotService/botServices/channels/listchannelwithkeys/action",
|                                                         "Microsoft.BotService/botServices/channels/delete",
|                                                         "Microsoft.BotService/botServices/channels/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.BotService/botServices/connections/read",
|                                                         "Microsoft.BotService/botServices/connections/write",
|                                                         "Microsoft.BotService/botServices/connections/delete",
|                                                         "Microsoft.BotService/botServices/connections/listwithsecrets/write",
|                                                         "Microsoft.BotService/botServices/connections/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.BotService/botServices/createemailsigninurl/action",
|                                                         "Microsoft.BotService/botServices/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.BotService/botServices/joinPerimeter/action",
|                                                         "Microsoft.BotService/botServices/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.BotService/checknameavailability/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.BotService/hostsettings/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.BotService/botServices/privateEndpointConnectionProxies/write",
|                                                         "Microsoft.BotService/botServices/privateEndpointConnectionProxies/delete",
|                                                         "Microsoft.BotService/botServices/privateEndpointConnectionProxies/validate/action",
|                                                         "Microsoft.BotService/botServices/privateEndpointConnections/write",
|                                                         "Microsoft.BotService/botServices/privateEndpointConnections/delete",
|                                                         "Microsoft.BotService/listqnamakerendpointkeys/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.BotService/botServices/networkSecurityPerimeterConfigurations/reconcile/action",
|                                                         "Microsoft.BotService/botServices/networkSecurityPerimeterAssociationProxies/write",
|                                                         "Microsoft.BotService/botServices/networkSecurityPerimeterAssociationProxies/delete",
|                                                         "Microsoft.BotService/locations/notifyNetworkSecurityPerimeterUpdatesAvailable/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.BotService/botServices/channels/regeneratekeys/action",
|                                                         "Microsoft.BotService/botServices/Connections/listWithSecrets/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fe86443c-f201-4fc4-9d2a-ac61149fbda0",
|                                         "Name":  "App Configuration Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of App Configuration resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppConfiguration/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.AppConfiguration/locations/deletedConfigurationStores/purge/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "83f80186-3729-438c-ad2d-39e94d718838",
|                                         "Name":  "Service Fabric Managed Cluster Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage Service Fabric managed clusters but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ServiceFabric/managedclusters/*",
|                                                         "Microsoft.ServiceFabric/operations/read",
|                                                         "Microsoft.ServiceFabric/locations/clusterVersions/read",
|                                                         "Microsoft.ServiceFabric/locations/environments/clusterVersions/read",
|                                                         "Microsoft.ServiceFabric/locations/operationresults/read",
|                                                         "Microsoft.ServiceFabric/locations/operations/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a35466a1-cfd6-450a-b35e-683fcdf30363",
|                                         "Name":  "Azure Batch Service Orchestration Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manages Azure Batch compute resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Security/assessments/read",
|                                                         "Microsoft.AzureFleet/fleets/write",
|                                                         "Microsoft.AzureFleet/fleets/read",
|                                                         "Microsoft.AzureFleet/fleets/delete",
|                                                         "Microsoft.Compute/locations/DiskOperations/read",
|                                                         "Microsoft.Compute/locations/operations/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/approveRollingUpgrade/action",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/deallocate/action",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/delete",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/delete/action",
|                                                         "Microsoft.Compute/VirtualMachineScaleSets/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/reimage/action",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/reimageall/action",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/restart/action",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/start/action",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/write",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/extensions/read",
|                                                         "microsoft.Compute/virtualMachineScaleSets/networkInterfaces/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualmachines/restart/action",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/dataCollectionRuleAssociations/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Insights/diagnosticSettings/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
|                                                         "Microsoft.Network/networkWatchers/read",
|                                                         "Microsoft.Network/virtualNetworks/delete",
|                                                         "Microsoft.Network/virtualNetworks/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8c87871d-6201-42da-abb1-1c0c985ff71c",
|                                         "Name":  "Microsoft PowerBI Tenant Operations Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manages PowerBI tenant operations but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.PowerBI/tenants/workspaces/read",
|                                                         "Microsoft.PowerBI/tenants/workspaces/delete",
|                                                         "Microsoft.PowerBI/tenants/read",
|                                                         "Microsoft.PowerBI/tenants/delete",
|                                                         "Microsoft.PowerBI/tenants/write",
|                                                         "Microsoft.PowerBI/tenants/workspaces/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b6efc156-f0da-4e90-a50a-8c000140b017",
|                                         "Name":  "Service Fabric Cluster Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage Service Fabric clusters but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ServiceFabric/clusters/*",
|                                                         "Microsoft.ServiceFabric/operations/read",
|                                                         "Microsoft.ServiceFabric/locations/clusterVersions/read",
|                                                         "Microsoft.ServiceFabric/locations/environments/clusterVersions/read",
|                                                         "Microsoft.ServiceFabric/locations/operationresults/read",
|                                                         "Microsoft.ServiceFabric/locations/operations/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6e0c8711-85a0-4490-8365-8ec13c4560b4",
|                                         "Name":  "Stream Analytics Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Contributor access to Stream Analytics resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.StreamAnalytics/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "21bffb94-04c0-4ed0-b676-68bb926e832b",
|                                         "Name":  "Microsoft.Windows365.CloudPcDelegatedMsis Writer User",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Write operations on CloudPcDelegatedMsis resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Windows365/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bf2b6809-e9a5-4aea-a6e1-40a9dc8c43a7",
|                                         "Name":  "Landing Zone Account Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage Landing Zone Accounts and configurations but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Sovereign/landingZoneAccounts/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0b6ca2e8-2cdc-4bd6-b896-aa3d8c21fc35",
|                                         "Name":  "Defender Sensitive Data Discovery",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can read and write security and storage settings, enabling data plane impact but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Security/defenderforstoragesettings/read",
|                                                         "Microsoft.Security/defenderforstoragesettings/write",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Security/securityOperators/read",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "29fe4964-1e60-436b-bd3a-77fd4c178b3c",
|                                         "Name":  "Azure Batch Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of batch resources but no permissions to assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Batch/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Batch/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6aaa78f1-f7de-44ca-8722-c64a23943cae",
|                                         "Name":  "Azure Batch Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage batch pools and jobs but no ability to modify accounts or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Batch/batchAccounts/read",
|                                                         "Microsoft.Batch/batchAccounts/applications/*",
|                                                         "Microsoft.Batch/batchAccounts/certificates/*",
|                                                         "Microsoft.Batch/batchAccounts/certificateOperationResults/*",
|                                                         "Microsoft.Batch/batchAccounts/pools/*",
|                                                         "Microsoft.Batch/batchAccounts/poolOperationResults/*",
|                                                         "Microsoft.Batch/locations/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Batch/batchAccounts/jobSchedules/*",
|                                                             "Microsoft.Batch/batchAccounts/jobs/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1dc4cd5a-de51-4ee4-bc8e-b40e9c17e320",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read/write access to cluster resources but no direct role assignment or identity plane permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/apiextensions.k8s.io/customresourcedefinitions/read",
|                                                             "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/apps/daemonsets/write",
|                                                             "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/apps/deployments/write",
|                                                             "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                             "Microsoft.ContainerService/fleets/apps/statefulsets/write",
|                                                             "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                             "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/write",
|                                                             "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                             "Microsoft.ContainerService/fleets/batch/cronjobs/write",
|                                                             "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                             "Microsoft.ContainerService/fleets/batch/jobs/write",
|                                                             "Microsoft.ContainerService/fleets/configmaps/read",
|                                                             "Microsoft.ContainerService/fleets/configmaps/write",
|                                                             "Microsoft.ContainerService/fleets/endpoints/read",
|                                                             "Microsoft.ContainerService/fleets/endpoints/write",
|                                                             "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/fleets/events/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/daemonsets/write",
|                                                             "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/deployments/write",
|                                                             "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/ingresses/write",
|                                                             "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/networkpolicies/write",
|                                                             "Microsoft.ContainerService/fleets/limitranges/read",
|                                                             "Microsoft.ContainerService/fleets/namespaces/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/write",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/write",
|                                                             "Microsoft.ContainerService/fleets/nodes/read",
|                                                             "Microsoft.ContainerService/fleets/nodes/write",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumes/read",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumes/write",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumeclaims/write",
|                                                             "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                             "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/write",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/write",
|                                                             "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                             "Microsoft.ContainerService/fleets/secrets/read",
|                                                             "Microsoft.ContainerService/fleets/secrets/write",
|                                                             "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                             "Microsoft.ContainerService/fleets/serviceaccounts/write",
|                                                             "Microsoft.ContainerService/fleets/services/read",
|                                                             "Microsoft.ContainerService/fleets/services/write",
|                                                             "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/memberclusters/read",
|                                                             "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/memberclusters/write",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceplacements/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceplacements/write",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcebindings/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcesnapshots/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterschedulingpolicysnapshots/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverrides/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverrides/write",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverridesnapshots/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7c2e40b7-25eb-482a-82cb-78ba06cb46d5",
|                                         "Name":  "Chaos Studio Experiment Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can create and manage experiments but lacks permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Chaos/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6f4fe6fc-f04f-4d97-8528-8bc18c848dca",
|                                         "Name":  "Container Apps ConnectedEnvironments Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of connected environments but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/connectedEnvironments/*",
|                                                         "Microsoft.App/connectedEnvironments/*/read",
|                                                         "Microsoft.App/connectedEnvironments/*/write",
|                                                         "Microsoft.App/connectedEnvironments/*/delete",
|                                                         "Microsoft.App/connectedEnvironments/*/action",
|                                                         "Microsoft.App/connectedEnvironments/daprComponents/listSecrets/action",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ff478a4e-8633-416e-91bc-ec33ce7c9516",
|                                         "Name":  "Azure Messaging Connectors Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to messaging connectors but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.MessagingConnectors/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MessagingConnectors/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3bc748fc-213d-45c1-8d91-9da5725539b9",
|                                         "Name":  "Container Registry Contributor and Data Access Configuration Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage container registries and data access configurations but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerRegistry/registries/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/read",
|                                                         "Microsoft.ContainerRegistry/registries/write",
|                                                         "Microsoft.ContainerRegistry/registries/delete",
|                                                         "Microsoft.ContainerRegistry/registries/listCredentials/action",
|                                                         "Microsoft.ContainerRegistry/registries/regenerateCredential/action",
|                                                         "Microsoft.ContainerRegistry/registries/generateCredentials/action",
|                                                         "Microsoft.ContainerRegistry/registries/replications/read",
|                                                         "Microsoft.ContainerRegistry/registries/replications/write",
|                                                         "Microsoft.ContainerRegistry/registries/replications/delete",
|                                                         "Microsoft.ContainerRegistry/registries/replications/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/write",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/delete",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/tokens/read",
|                                                         "Microsoft.ContainerRegistry/registries/tokens/write",
|                                                         "Microsoft.ContainerRegistry/registries/tokens/delete",
|                                                         "Microsoft.ContainerRegistry/registries/tokens/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/scopeMaps/read",
|                                                         "Microsoft.ContainerRegistry/registries/scopeMaps/write",
|                                                         "Microsoft.ContainerRegistry/registries/scopeMaps/delete",
|                                                         "Microsoft.ContainerRegistry/registries/scopeMaps/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ContainerRegistry/registries/connectedRegistries/read",
|                                                         "Microsoft.ContainerRegistry/registries/connectedRegistries/write",
|                                                         "Microsoft.ContainerRegistry/registries/connectedRegistries/delete",
|                                                         "Microsoft.ContainerRegistry/registries/connectedRegistries/deactivate/action",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/read",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/write",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/delete",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/action",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/ping/action",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/listEvents/action",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/operationStatuses/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.ContainerRegistry/locations/operationResults/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/privateEndpoints/privateLinkServiceProxies/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bf94e731-3a51-4a7c-8c54-a1ab9971dfc1",
|                                         "Name":  "Container Registry Transfer Pipeline Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage transfer pipelines but no permissions to assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/exportPipelines/read",
|                                                         "Microsoft.ContainerRegistry/registries/exportPipelines/write",
|                                                         "Microsoft.ContainerRegistry/registries/exportPipelines/delete",
|                                                         "Microsoft.ContainerRegistry/registries/importPipelines/read",
|                                                         "Microsoft.ContainerRegistry/registries/importPipelines/write",
|                                                         "Microsoft.ContainerRegistry/registries/importPipelines/delete",
|                                                         "Microsoft.ContainerRegistry/registries/pipelineRuns/read",
|                                                         "Microsoft.ContainerRegistry/registries/pipelineRuns/write",
|                                                         "Microsoft.ContainerRegistry/registries/pipelineRuns/delete",
|                                                         "Microsoft.ContainerRegistry/registries/pipelineRuns/operationStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "97dfb3ce-e936-462c-9425-9cdb67e66d45",
|                                         "Name":  "Desktop Virtualization App Attach Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage app attach resources but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.DesktopVirtualization/appattachpackages/read",
|                                                         "Microsoft.DesktopVirtualization/appattachpackages/write",
|                                                         "Microsoft.DesktopVirtualization/appattachpackages/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8ea85a25-eb16-4e29-ab4d-6f2a26c711a2",
|                                         "Name":  "App Service Environment Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage App Service Environments but no permissions to modify identity plane or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Web/hostingEnvironments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ada52afe-776a-4b4d-a8f2-55670d3d8178",
|                                         "Name":  "Kubernetes Agent Subscription Level Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Subscription level permissions for Defender for Cloud containers plan; no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedkeys/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c1410b24-3e69-4857-8f86-4d0a2e603250",
|                                         "Name":  "Quantum Workspace Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage quantum workspace data but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Quantum/Workspaces/read",
|                                                         "Microsoft.Quantum/locations/offerings/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Quantum/Workspaces/jobs/read",
|                                                             "Microsoft.Quantum/Workspaces/jobs/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "09976791-48a7-449e-bb21-39d1a415f350",
|                                         "Name":  "Communication and Email Service Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of communication services but no direct identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Communication/CheckNameAvailability/action",
|                                                         "Microsoft.Communication/Locations/OperationStatuses/read",
|                                                         "Microsoft.Communication/Locations/OperationStatuses/write",
|                                                         "Microsoft.Communication/Operations/read",
|                                                         "Microsoft.Communication/CommunicationServices/read",
|                                                         "Microsoft.Communication/CommunicationServices/write",
|                                                         "Microsoft.Communication/CommunicationServices/delete",
|                                                         "Microsoft.Communication/CommunicationServices/ListKeys/action",
|                                                         "Microsoft.Communication/CommunicationServices/RegenerateKey/action",
|                                                         "Microsoft.Communication/CommunicationServices/LinkNotificationHub/action",
|                                                         "Microsoft.Communication/CommunicationServices/EventGridFilters/read",
|                                                         "Microsoft.Communication/CommunicationServices/EventGridFilters/write",
|                                                         "Microsoft.Communication/CommunicationServices/EventGridFilters/delete",
|                                                         "Microsoft.Communication/EmailServices/read",
|                                                         "Microsoft.Communication/EmailServices/write",
|                                                         "Microsoft.Communication/EmailServices/delete",
|                                                         "Microsoft.Communication/EmailServices/Domains/read",
|                                                         "Microsoft.Communication/EmailServices/Domains/write",
|                                                         "Microsoft.Communication/EmailServices/Domains/delete",
|                                                         "Microsoft.Communication/EmailServices/Domains/SenderUsernames/read",
|                                                         "Microsoft.Communication/EmailServices/Domains/SenderUsernames/write",
|                                                         "Microsoft.Communication/EmailServices/Domains/SenderUsernames/delete",
|                                                         "Microsoft.Communication/EmailServices/Domains/SuppressionLists/read",
|                                                         "Microsoft.Communication/EmailServices/Domains/SuppressionLists/write",
|                                                         "Microsoft.Communication/EmailServices/Domains/SuppressionLists/delete",
|                                                         "Microsoft.Communication/EmailServices/Domains/SuppressionLists/SuppressionListAddresses/read",
|                                                         "Microsoft.Communication/EmailServices/Domains/SuppressionLists/SuppressionListAddresses/write",
|                                                         "Microsoft.Communication/EmailServices/Domains/SuppressionLists/SuppressionListAddresses/delete",
|                                                         "Microsoft.Communication/EmailServices/Domains/InitiateVerification/action",
|                                                         "Microsoft.Communication/EmailServices/Domains/CancelVerification/action",
|                                                         "Microsoft.Communication/EmailServices/Domains/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "59c05558-2358-462d-ba19-afbd7118936d",
|                                         "Name":  "Oracle.Database Autonomous Database Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of autonomous database resources; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Oracle.Database/autonomousDatabases/*/read",
|                                                         "Oracle.Database/autonomousDatabases/*/write",
|                                                         "Oracle.Database/autonomousDatabases/*/delete",
|                                                         "Oracle.Database/autonomousDatabases/*/action",
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Locations/*/write",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/action",
|                                                         "Oracle.Database/resourceAnchors/*",
|                                                         "Oracle.Database/networkAnchors/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/locations/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fb382eab-e894-4461-af04-94435c366c3f",
|                                         "Name":  "Container Registry Tasks Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage container registry tasks with potential data plane impact but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/agentpools/read",
|                                                         "Microsoft.ContainerRegistry/registries/agentpools/write",
|                                                         "Microsoft.ContainerRegistry/registries/agentpools/delete",
|                                                         "Microsoft.ContainerRegistry/registries/agentpools/listQueueStatus/action",
|                                                         "Microsoft.ContainerRegistry/registries/agentpools/operationResults/status/read",
|                                                         "Microsoft.ContainerRegistry/registries/agentpools/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/tasks/read",
|                                                         "Microsoft.ContainerRegistry/registries/tasks/write",
|                                                         "Microsoft.ContainerRegistry/registries/tasks/delete",
|                                                         "Microsoft.ContainerRegistry/registries/tasks/listDetails/action",
|                                                         "Microsoft.ContainerRegistry/registries/scheduleRun/action",
|                                                         "Microsoft.ContainerRegistry/registries/listBuildSourceUploadUrl/action",
|                                                         "Microsoft.ContainerRegistry/registries/runs/read",
|                                                         "Microsoft.ContainerRegistry/registries/runs/write",
|                                                         "Microsoft.ContainerRegistry/registries/runs/listLogSasUrl/action",
|                                                         "Microsoft.ContainerRegistry/registries/runs/cancel/action",
|                                                         "Microsoft.ContainerRegistry/registries/taskruns/read",
|                                                         "Microsoft.ContainerRegistry/registries/taskruns/write",
|                                                         "Microsoft.ContainerRegistry/registries/taskruns/delete",
|                                                         "Microsoft.ContainerRegistry/registries/taskruns/listDetails/action",
|                                                         "Microsoft.ContainerRegistry/registries/taskruns/operationStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerRegistry/registries/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "afc680e2-a938-412d-b213-9a49efa7fb83",
|                                         "Name":  "Azure Backup Snapshot Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage backup snapshots but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/restorePointCollections/read",
|                                                         "Microsoft.Compute/restorePointCollections/write",
|                                                         "Microsoft.Compute/restorePointCollections/restorePoints/write",
|                                                         "Microsoft.Compute/restorePointCollections/restorePoints/read",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "49fc33c1-886f-4b21-a00e-1d9993234734",
|                                         "Name":  "AVS on Fleet VIS Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Critical for AVS private cloud operation; manages network and peering but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/write",
|                                                         "Microsoft.Network/virtualNetworks/peer/action",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/networkIntentPolicies/join/action",
|                                                         "Microsoft.Network/ddosProtectionPlans/join/action",
|                                                         "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action",
|                                                         "Microsoft.BareMetal/peeringSettings/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1a6f9009-515c-4455-b170-143e4c9ce229",
|                                         "Name":  "Azure Stack HCI Edge Machine Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage Azure Stack HCI Edge Machines and related resources; no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/EdgeMachines/*",
|                                                         "Microsoft.AzureStackHCI/locations/ValidateOwnershipVouchers/action",
|                                                         "Microsoft.Edge/Sites/read",
|                                                         "Microsoft.Edge/Sites/write",
|                                                         "Microsoft.Edge/configurationReferences/read",
|                                                         "Microsoft.Edge/configurationReferences/write",
|                                                         "Microsoft.Edge/Configurations/*/read",
|                                                         "Microsoft.Edge/Configurations/*/write",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "53747cdd-e97c-477a-948c-b587d0e514b2",
|                                         "Name":  "Online Experimentation Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to experimentation data but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.OnlineExperimentation/workspaces/read",
|                                                             "Microsoft.OnlineExperimentation/workspaces/write",
|                                                             "Microsoft.OnlineExperimentation/workspaces/delete",
|                                                             "Microsoft.OnlineExperimentation/workspaces/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "59a618e3-3c9a-406e-9f03-1a20dd1c55f1",
|                                         "Name":  "Chaos Studio Target Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage chaos studio targets and capabilities but cannot create or run experiments or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Chaos/targets/write",
|                                                         "Microsoft.Chaos/targets/delete",
|                                                         "Microsoft.Chaos/targets/read",
|                                                         "Microsoft.Chaos/targets/capabilities/write",
|                                                         "Microsoft.Chaos/targets/capabilities/delete",
|                                                         "Microsoft.Chaos/targets/capabilities/read",
|                                                         "Microsoft.Chaos/locations/targetTypes/read",
|                                                         "Microsoft.Chaos/locations/targetTypes/capabilityTypes/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a8d01690-9418-4783-8ca2-9f0f1791783d",
|                                         "Name":  "Auto Actions Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage auto actions resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ComputeSchedule/locations/OperationStatuses/write",
|                                                         "Microsoft.ComputeSchedule/autoActions/write",
|                                                         "Microsoft.ComputeSchedule/autoActions/delete",
|                                                         "Microsoft.ComputeSchedule/autoActions/attachResources/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/cancelNextOccurrence/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/detachResources/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/disable/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/enable/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/listResources/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/patchResources/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/triggerManualOccurrence/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/occurrences/cancel/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/occurrences/delay/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/occurrences/listResources/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a227fb39-f479-404b-96fd-0176f5d88ab4",
|                                         "Name":  "Azure Device Onboarding Discovery Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage device onboarding discovery services; no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DeviceOnboarding/discoveryServices/*",
|                                                         "Microsoft.DeviceOnboarding/locations/operationStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fc6e3395-6a8c-4527-bb4c-d0abd41e8e74",
|                                         "Name":  "SSH PublicKeys Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can create and delete SSH public keys but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/sshpublickeys/read",
|                                                         "Microsoft.Compute/sshpublickeys/write",
|                                                         "Microsoft.Compute/sshpublickeys/delete",
|                                                         "Microsoft.Compute/sshpublickeys/generatekeypair/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1b7f3653-4324-473a-9165-bc55e4d04ba8",
|                                         "Name":  "Azure Kubernetes Service Agent Pool Manager Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage AKS agent pools but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/read",
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/write",
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/delete",
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/upgradeNodeImageVersion/action",
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/abort/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "96ebd254-ecc7-4590-aff5-e9af3ff5f3b3",
|                                         "Name":  "Dedicated Host Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage dedicated hosts but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/hostGroups/read",
|                                                         "Microsoft.Compute/hostGroups/write",
|                                                         "Microsoft.Compute/hostGroups/delete",
|                                                         "Microsoft.Compute/hostGroups/hosts/read",
|                                                         "Microsoft.Compute/hostGroups/hosts/write",
|                                                         "Microsoft.Compute/hostGroups/hosts/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2bed379c-9fba-455b-99e4-6b911073bcf2",
|                                         "Name":  "Compute Fleet Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage compute fleet resources but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureFleet/fleets/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "92b92042-07d9-4307-87f7-36a593fc5850",
|                                         "Name":  "Azure File Sync Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Azure File Sync resources including role assignments but no direct identity plane control over tenant roles.",
|                                         "Actions":  [
|                                                         "Microsoft.StorageSync/register/action",
|                                                         "Microsoft.StorageSync/unregister/action",
|                                                         "Microsoft.StorageSync/locations/*",
|                                                         "Microsoft.StorageSync/deployments/preflight/action",
|                                                         "Microsoft.StorageSync/storageSyncServices/*",
|                                                         "Microsoft.StorageSync/operations/read",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Insights/AlertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "88366f10-ed47-4cc0-9fab-c8a06148393e",
|                                         "Name":  "Azure Red Hat OpenShift Hosted Control Planes Cluster API Provider",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage OpenShift cluster nodes and disks but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Compute/availabilitySets/delete",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/availabilitySets/write",
|                                                         "Microsoft.Compute/virtualMachines/delete",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "50346970-0998-40f2-b47d-f3b8809840f8",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Writer for Member Clusters",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can access secrets and run pods as any service account in namespace, enabling potential privilege escalation but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/members/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/fleets/members/apps/daemonsets/*",
|                                                             "Microsoft.ContainerService/fleets/members/apps/deployments/*",
|                                                             "Microsoft.ContainerService/fleets/members/apps/replicasets/*",
|                                                             "Microsoft.ContainerService/fleets/members/apps/statefulsets/*",
|                                                             "Microsoft.ContainerService/fleets/members/autoscaling/horizontalpodautoscalers/*",
|                                                             "Microsoft.ContainerService/fleets/members/batch/cronjobs/*",
|                                                             "Microsoft.ContainerService/fleets/members/coordination.k8s.io/leases/read",
|                                                             "Microsoft.ContainerService/fleets/members/coordination.k8s.io/leases/write",
|                                                             "Microsoft.ContainerService/fleets/members/coordination.k8s.io/leases/delete",
|                                                             "Microsoft.ContainerService/fleets/members/discovery.k8s.io/endpointslices/read",
|                                                             "Microsoft.ContainerService/fleets/members/batch/jobs/*",
|                                                             "Microsoft.ContainerService/fleets/members/configmaps/*",
|                                                             "Microsoft.ContainerService/fleets/members/endpoints/*",
|                                                             "Microsoft.ContainerService/fleets/members/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/fleets/members/events/*",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/daemonsets/*",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/deployments/*",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/ingresses/*",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/networkpolicies/*",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/replicasets/*",
|                                                             "Microsoft.ContainerService/fleets/members/limitranges/read",
|                                                             "Microsoft.ContainerService/fleets/members/metrics.k8s.io/pods/read",
|                                                             "Microsoft.ContainerService/fleets/members/metrics.k8s.io/nodes/read",
|                                                             "Microsoft.ContainerService/fleets/members/namespaces/read",
|                                                             "Microsoft.ContainerService/fleets/members/networking.k8s.io/ingresses/*",
|                                                             "Microsoft.ContainerService/fleets/members/networking.k8s.io/networkpolicies/*",
|                                                             "Microsoft.ContainerService/fleets/members/persistentvolumeclaims/*",
|                                                             "Microsoft.ContainerService/fleets/members/pods/*",
|                                                             "Microsoft.ContainerService/fleets/members/policy/poddisruptionbudgets/*",
|                                                             "Microsoft.ContainerService/fleets/members/replicationcontrollers/*",
|                                                             "Microsoft.ContainerService/fleets/members/resourcequotas/read",
|                                                             "Microsoft.ContainerService/fleets/members/secrets/*",
|                                                             "Microsoft.ContainerService/fleets/members/serviceaccounts/*",
|                                                             "Microsoft.ContainerService/fleets/members/services/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "79a36d98-eb96-4a76-ae1d-481dc98d2c23",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Admin for Member Clusters",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manages all resources in member clusters but lacks direct permissions to assign Azure AD roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/members/*"
|                                                         ]
|                                     }
|                                 ],
|    "Azure_BuiltInRoles_Tier3":  [
|                                     {
|                                         "Id":  "8311e382-0749-4cb8-b61a-304f252e45ec",
|                                         "Name":  "AcrPush",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions limited to container registry push and pull; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/pull/read",
|                                                         "Microsoft.ContainerRegistry/registries/push/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "312a565d-c81f-4fd8-895a-4e21e48d571c",
|                                         "Name":  "API Management Service Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage API services but lacks permissions to assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7f951dda-4ed3-4680-a7ca-43fe172d538d",
|                                         "Name":  "AcrPull",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only pull access to container registry; no path to tenant takeover.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/pull/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6cef56e8-d556-48e5-a04f-b8e64114680f",
|                                         "Name":  "AcrImageSigner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permission to sign content in container registry; no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/sign/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/trustedCollections/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c2f4ef07-c644-48eb-af81-4b1b4947fb11",
|                                         "Name":  "AcrDelete",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can delete container registry artifacts; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/artifacts/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cdda3590-29a3-44f6-95f2-9f980659eb04",
|                                         "Name":  "AcrQuarantineReader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to quarantine data only; no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/quarantine/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c8d4ff99-41c3-41a8-9f60-21dfdad59608",
|                                         "Name":  "AcrQuarantineWriter",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to quarantine data; no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/quarantine/read",
|                                                         "Microsoft.ContainerRegistry/registries/quarantine/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read",
|                                                             "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e022efe7-f5ba-4159-bbe4-b44f577e9b61",
|                                         "Name":  "API Management Service Operator Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage service but not APIs or role assignments; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/*/read",
|                                                         "Microsoft.ApiManagement/service/backup/action",
|                                                         "Microsoft.ApiManagement/service/delete",
|                                                         "Microsoft.ApiManagement/service/managedeployments/action",
|                                                         "Microsoft.ApiManagement/service/read",
|                                                         "Microsoft.ApiManagement/service/restore/action",
|                                                         "Microsoft.ApiManagement/service/updatecertificate/action",
|                                                         "Microsoft.ApiManagement/service/updatehostname/action",
|                                                         "Microsoft.ApiManagement/service/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.ApiManagement/service/users/keys/read"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "71522526-b88f-4d52-b57f-d31fc3546d0d",
|                                         "Name":  "API Management Service Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to API management service; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/*/read",
|                                                         "Microsoft.ApiManagement/service/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.ApiManagement/service/users/keys/read"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ae349356-3a1b-4a5e-921d-050484c6347e",
|                                         "Name":  "Application Insights Component Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Application Insights components; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/generateLiveToken/read",
|                                                         "Microsoft.Insights/metricAlerts/*",
|                                                         "Microsoft.Insights/components/*",
|                                                         "Microsoft.Insights/scheduledqueryrules/*",
|                                                         "Microsoft.Insights/topology/read",
|                                                         "Microsoft.Insights/transactions/read",
|                                                         "Microsoft.Insights/webtests/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "08954f03-6346-4c2e-81c0-ec3a5cfae23b",
|                                         "Name":  "Application Insights Snapshot Debugger",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and debug Application Insights snapshots; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/components/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/snapshots/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fd1bd22b-8476-40bc-a0bc-69b95687b9f3",
|                                         "Name":  "Attestation Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to attestation providers; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Attestation/attestationProviders/attestation/read",
|                                                         "Microsoft.Attestation/attestationProviders/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4fe576fe-1146-4730-92eb-48519fa6bf9f",
|                                         "Name":  "Automation Job Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage automation jobs; no permissions to assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/read",
|                                                         "Microsoft.Automation/automationAccounts/jobs/read",
|                                                         "Microsoft.Automation/automationAccounts/jobs/resume/action",
|                                                         "Microsoft.Automation/automationAccounts/jobs/stop/action",
|                                                         "Microsoft.Automation/automationAccounts/jobs/streams/read",
|                                                         "Microsoft.Automation/automationAccounts/jobs/suspend/action",
|                                                         "Microsoft.Automation/automationAccounts/jobs/write",
|                                                         "Microsoft.Automation/automationAccounts/jobs/output/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5fb5aef8-1081-4b8e-bb16-9d5d0385bab5",
|                                         "Name":  "Automation Runbook Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read runbook properties and create jobs; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d3881f73-407a-4167-8283-e981cbba0404",
|                                         "Name":  "Automation Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Start, stop, suspend automation jobs; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/read",
|                                                         "Microsoft.Automation/automationAccounts/jobs/read",
|                                                         "Microsoft.Automation/automationAccounts/jobs/resume/action",
|                                                         "Microsoft.Automation/automationAccounts/jobs/stop/action",
|                                                         "Microsoft.Automation/automationAccounts/jobs/streams/read",
|                                                         "Microsoft.Automation/automationAccounts/jobs/suspend/action",
|                                                         "Microsoft.Automation/automationAccounts/jobs/write",
|                                                         "Microsoft.Automation/automationAccounts/jobSchedules/read",
|                                                         "Microsoft.Automation/automationAccounts/jobSchedules/write",
|                                                         "Microsoft.Automation/automationAccounts/linkedWorkspace/read",
|                                                         "Microsoft.Automation/automationAccounts/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.Automation/automationAccounts/schedules/read",
|                                                         "Microsoft.Automation/automationAccounts/schedules/write",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Automation/automationAccounts/jobs/output/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4f8fab4f-1852-4a58-a46a-8eaf358af14a",
|                                         "Name":  "Avere Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Avere vFXT cluster; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Compute/*/read",
|                                                         "Microsoft.Compute/availabilitySets/*",
|                                                         "Microsoft.Compute/proximityPlacementGroups/*",
|                                                         "Microsoft.Compute/virtualMachines/*",
|                                                         "Microsoft.Compute/disks/*",
|                                                         "Microsoft.Network/*/read",
|                                                         "Microsoft.Network/networkInterfaces/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/*/read",
|                                                         "Microsoft.Storage/storageAccounts/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/resources/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c025889f-8102-4ebf-b32c-fc0c6f0c6bd9",
|                                         "Name":  "Avere Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage cluster network interfaces and VMs; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8",
|                                         "Name":  "Azure Kubernetes Service Cluster Admin Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "List cluster admin credentials and run commands; no Azure AD role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action",
|                                                         "Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action",
|                                                         "Microsoft.ContainerService/managedClusters/read",
|                                                         "Microsoft.ContainerService/managedClusters/runcommand/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4abbcc35-e782-43d8-92c5-2d3f1bd2253f",
|                                         "Name":  "Azure Kubernetes Service Cluster User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "List cluster user credentials; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
|                                                         "Microsoft.ContainerService/managedClusters/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "423170ca-a8f6-4b0f-8487-9e4eb8f49bfa",
|                                         "Name":  "Azure Maps Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Azure Maps data; no identity plane or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Maps/accounts/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6f12a6df-dd06-4f3e-bcb1-ce8be600526a",
|                                         "Name":  "Azure Stack Registration Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Azure Stack registrations; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStack/edgeSubscriptions/read",
|                                                         "Microsoft.AzureStack/registrations/products/*/action",
|                                                         "Microsoft.AzureStack/registrations/products/read",
|                                                         "Microsoft.AzureStack/registrations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5e467623-bb1f-42f4-a55d-6e525e11384b",
|                                         "Name":  "Backup Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage backups but cannot assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.RecoveryServices/locations/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/refreshContainers/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupJobs/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupJobsExport/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupOperationResults/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectableItems/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectedItems/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectionContainers/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupSecurityPIN/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read",
|                                                         "Microsoft.RecoveryServices/Vaults/certificates/*",
|                                                         "Microsoft.RecoveryServices/Vaults/extendedInformation/*",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*",
|                                                         "Microsoft.RecoveryServices/Vaults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/*",
|                                                         "Microsoft.RecoveryServices/Vaults/usages/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupstorageconfig/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupconfig/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupValidateOperation/action",
|                                                         "Microsoft.RecoveryServices/Vaults/write",
|                                                         "Microsoft.RecoveryServices/Vaults/backupOperations/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupEngines/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectableContainers/read",
|                                                         "Microsoft.RecoveryServices/vaults/operationStatus/read",
|                                                         "Microsoft.RecoveryServices/vaults/operationResults/read",
|                                                         "Microsoft.RecoveryServices/locations/backupStatus/action",
|                                                         "Microsoft.RecoveryServices/locations/backupPreValidateProtection/action",
|                                                         "Microsoft.RecoveryServices/locations/backupValidateFeatures/action",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/write",
|                                                         "Microsoft.RecoveryServices/operations/read",
|                                                         "Microsoft.RecoveryServices/locations/operationStatus/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.DataProtection/locations/getBackupStatus/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/write",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/delete",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/deletedBackupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/deletedBackupInstances/undelete/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/backup/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/validateRestore/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/restore/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/crossRegionRestore/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/validateCrossRegionRestore/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/write",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/delete",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read",
|                                                         "Microsoft.DataProtection/backupVaults/write",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/backupVaults/operationResults/read",
|                                                         "Microsoft.DataProtection/backupVaults/operationStatus/read",
|                                                         "Microsoft.DataProtection/locations/checkNameAvailability/action",
|                                                         "Microsoft.DataProtection/locations/checkFeatureSupport/action",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/locations/operationStatus/read",
|                                                         "Microsoft.DataProtection/locations/operationResults/read",
|                                                         "Microsoft.DataProtection/backupVaults/validateForBackup/action",
|                                                         "Microsoft.DataProtection/operations/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/delete",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/unlockDelete/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/write",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/write",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/delete",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/unlockDelete/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/validateForModifyBackup/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/SuspendBackups/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/resumeProtection/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fa23ad8b-c56e-40d8-ac0c-ce449e1d2c64",
|                                         "Name":  "Billing Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to billing data; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Billing/*/read",
|                                                         "Microsoft.Commerce/*/read",
|                                                         "Microsoft.Consumption/*/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.CostManagement/*/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a795c7a0-d4a2-40c1-ae25-d81f01202912",
|                                         "Name":  "Backup Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to backup services; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/operationsStatus/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationsStatus/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupJobs/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupJobs/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupJobsExport/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupOperationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectedItems/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectionContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read",
|                                                         "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                         "Microsoft.RecoveryServices/Vaults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupstorageconfig/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupconfig/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupOperations/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/operations/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupEngines/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/items/read",
|                                                         "Microsoft.RecoveryServices/locations/backupStatus/action",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/write",
|                                                         "Microsoft.RecoveryServices/operations/read",
|                                                         "Microsoft.RecoveryServices/locations/operationStatus/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read",
|                                                         "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                         "Microsoft.RecoveryServices/locations/backupValidateFeatures/action",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrJobs/action",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrJob/action",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrOperationResults/read",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrOperationsStatus/read",
|                                                         "Microsoft.DataProtection/locations/getBackupStatus/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/deletedBackupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/backupVaults/operationResults/read",
|                                                         "Microsoft.DataProtection/backupVaults/operationStatus/read",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/locations/operationStatus/read",
|                                                         "Microsoft.DataProtection/locations/operationResults/read",
|                                                         "Microsoft.DataProtection/operations/read",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action",
|                                                         "Microsoft.DataProtection/locations/checkFeatureSupport/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "31a002a1-acaf-453e-8a5b-297c9ca1ea24",
|                                         "Name":  "Blockchain Member Node Access (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to blockchain member nodes; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Blockchain/blockchainMembers/transactionNodes/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Blockchain/blockchainMembers/transactionNodes/connect/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5e3c6656-6cfa-4708-81fe-0de47ac73342",
|                                         "Name":  "BizTalk Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage BizTalk services but no access to identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.BizTalkServices/BizTalk/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "426e0c7f-0c7e-4658-b36f-ff54d6c29b45",
|                                         "Name":  "CDN Endpoint Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage CDN endpoints but cannot assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cdn/edgenodes/read",
|                                                         "Microsoft.Cdn/operationresults/*",
|                                                         "Microsoft.Cdn/profiles/endpoints/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ec156ff8-a8d1-4d15-830c-5b80698ca432",
|                                         "Name":  "CDN Profile Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage CDN profiles and endpoints but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cdn/edgenodes/read",
|                                                         "Microsoft.Cdn/operationresults/*",
|                                                         "Microsoft.Cdn/profiles/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8f96442b-4075-438f-813d-ad51ab4019af",
|                                         "Name":  "CDN Profile Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to CDN profiles and endpoints; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cdn/edgenodes/read",
|                                                         "Microsoft.Cdn/operationresults/*",
|                                                         "Microsoft.Cdn/profiles/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Cdn/profiles/afdendpoints/validateCustomDomain/action",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Cdn/profiles/CheckResourceUsage/action",
|                                                         "Microsoft.Cdn/profiles/endpoints/CheckResourceUsage/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b34d265f-36f7-4a0d-a4d4-e158ca92e90f",
|                                         "Name":  "Classic Network Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage classic networks but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ClassicNetwork/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "86e8f5dc-a6e9-4c67-9d15-de283e8eac25",
|                                         "Name":  "Classic Storage Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage classic storage accounts but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ClassicStorage/storageAccounts/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "985d6b00-f706-48f5-a6fe-d0ca12fb668d",
|                                         "Name":  "Classic Storage Account Key Operator Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "List and regenerate keys on classic storage accounts; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.ClassicStorage/storageAccounts/listkeys/action",
|                                                         "Microsoft.ClassicStorage/storageAccounts/regeneratekey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9106cda0-8a86-4e81-b686-29a22c54effe",
|                                         "Name":  "ClearDB MySQL DB Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage ClearDB MySQL databases but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "successbricks.cleardb/databases/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d73bb868-a0df-4d4d-bd69-98a00b01fccb",
|                                         "Name":  "Classic Virtual Machine Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage classic VMs but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ClassicCompute/domainNames/*",
|                                                         "Microsoft.ClassicCompute/virtualMachines/*",
|                                                         "Microsoft.ClassicNetwork/networkSecurityGroups/join/action",
|                                                         "Microsoft.ClassicNetwork/reservedIps/link/action",
|                                                         "Microsoft.ClassicNetwork/reservedIps/read",
|                                                         "Microsoft.ClassicNetwork/virtualNetworks/join/action",
|                                                         "Microsoft.ClassicNetwork/virtualNetworks/read",
|                                                         "Microsoft.ClassicStorage/storageAccounts/disks/read",
|                                                         "Microsoft.ClassicStorage/storageAccounts/images/read",
|                                                         "Microsoft.ClassicStorage/storageAccounts/listKeys/action",
|                                                         "Microsoft.ClassicStorage/storageAccounts/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a97b65f3-24c7-4388-baec-2e87135dc908",
|                                         "Name":  "Cognitive Services User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and list keys of Cognitive Services; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Insights/diagnosticSettings/read",
|                                                         "Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Insights/metricdefinitions/read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b59867f0-fa02-499b-be73-45a86b5b3e1c",
|                                         "Name":  "Cognitive Services Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Cognitive Services data; no identity plane or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68",
|                                         "Name":  "Cognitive Services Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Cognitive Services including keys; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.CognitiveServices/*",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/providers/features/register/action",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/diagnosticSettings/*",
|                                                         "Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Insights/metricdefinitions/read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.CognitiveServices/raiPolicy/write",
|                                                            "Microsoft.CognitiveServices/raiPolicy/delete",
|                                                            "Microsoft.CognitiveServices/raiExternalSafetyProviders/write",
|                                                            "Microsoft.CognitiveServices/raiExternalSafetyProviders/delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "db7b14f2-5adf-42da-9f96-f2ee17bab5cb",
|                                         "Name":  "CosmosBackupOperator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Submit restore requests for Cosmos DB; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDB/databaseAccounts/backup/action",
|                                                         "Microsoft.DocumentDB/databaseAccounts/restore/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fbdf93bf-df7d-467e-a4d2-9458aa1360c8",
|                                         "Name":  "Cosmos DB Account Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Cosmos DB accounts; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.DocumentDB/*/read",
|                                                         "Microsoft.DocumentDB/databaseAccounts/readonlykeys/action",
|                                                         "Microsoft.Insights/MetricDefinitions/read",
|                                                         "Microsoft.Insights/Metrics/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "434105ed-43f6-45c7-a02f-909b2ba83430",
|                                         "Name":  "Cost Management Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage cost configurations; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Consumption/*",
|                                                         "Microsoft.CostManagement/*",
|                                                         "Microsoft.Billing/billingPeriods/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Advisor/configurations/read",
|                                                         "Microsoft.Advisor/recommendations/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Billing/billingProperty/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "72fafb9e-0641-4937-9268-a91bfd8191a3",
|                                         "Name":  "Cost Management Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to cost data; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Consumption/*/read",
|                                                         "Microsoft.CostManagement/*/read",
|                                                         "Microsoft.Billing/billingPeriods/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Advisor/configurations/read",
|                                                         "Microsoft.Advisor/recommendations/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Billing/billingProperty/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "add466c9-e687-43fc-8d98-dfcf8d720be5",
|                                         "Name":  "Data Box Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Data Box service except access control; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Databox/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "028f4ed7-e2a9-465e-a8f4-9c0ffdfdc027",
|                                         "Name":  "Data Box Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Data Box service; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Databox/*/read",
|                                                         "Microsoft.Databox/jobs/listsecrets/action",
|                                                         "Microsoft.Databox/jobs/listcredentials/action",
|                                                         "Microsoft.Databox/locations/availableSkus/action",
|                                                         "Microsoft.Databox/locations/validateInputs/action",
|                                                         "Microsoft.Databox/locations/regionConfiguration/action",
|                                                         "Microsoft.Databox/locations/validateAddress/action",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "673868aa-7521-48a0-acc6-0f60742d39f5",
|                                         "Name":  "Data Factory Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage data factories but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.DataFactory/dataFactories/*",
|                                                         "Microsoft.DataFactory/factories/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.EventGrid/eventSubscriptions/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "150f5e0c-0603-4f03-8c7f-cf70034c4e90",
|                                         "Name":  "Data Purger",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can purge analytics data; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/components/*/read",
|                                                         "Microsoft.Insights/components/purge/action",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/purge/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "47b7735b-770e-4598-a7da-8b91488b4c88",
|                                         "Name":  "Data Lake Analytics Developer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Submit and manage jobs; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.BigAnalytics/accounts/*",
|                                                         "Microsoft.DataLakeAnalytics/accounts/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.BigAnalytics/accounts/Delete",
|                                                            "Microsoft.BigAnalytics/accounts/TakeOwnership/action",
|                                                            "Microsoft.BigAnalytics/accounts/Write",
|                                                            "Microsoft.DataLakeAnalytics/accounts/Delete",
|                                                            "Microsoft.DataLakeAnalytics/accounts/TakeOwnership/action",
|                                                            "Microsoft.DataLakeAnalytics/accounts/Write",
|                                                            "Microsoft.DataLakeAnalytics/accounts/dataLakeStoreAccounts/Write",
|                                                            "Microsoft.DataLakeAnalytics/accounts/dataLakeStoreAccounts/Delete",
|                                                            "Microsoft.DataLakeAnalytics/accounts/storageAccounts/Write",
|                                                            "Microsoft.DataLakeAnalytics/accounts/storageAccounts/Delete",
|                                                            "Microsoft.DataLakeAnalytics/accounts/firewallRules/Write",
|                                                            "Microsoft.DataLakeAnalytics/accounts/firewallRules/Delete",
|                                                            "Microsoft.DataLakeAnalytics/accounts/computePolicies/Write",
|                                                            "Microsoft.DataLakeAnalytics/accounts/computePolicies/Delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "76283e04-6283-4c54-8f91-bcf1374a3c64",
|                                         "Name":  "DevTest Labs User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage own VMs in DevTest Labs; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/virtualMachines/*/read",
|                                                         "Microsoft.Compute/virtualMachines/deallocate/action",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/restart/action",
|                                                         "Microsoft.Compute/virtualMachines/start/action",
|                                                         "Microsoft.DevTestLab/*/read",
|                                                         "Microsoft.DevTestLab/labs/claimAnyVm/action",
|                                                         "Microsoft.DevTestLab/labs/createEnvironment/action",
|                                                         "Microsoft.DevTestLab/labs/ensureCurrentUserProfile/action",
|                                                         "Microsoft.DevTestLab/labs/formulas/delete",
|                                                         "Microsoft.DevTestLab/labs/formulas/read",
|                                                         "Microsoft.DevTestLab/labs/formulas/write",
|                                                         "Microsoft.DevTestLab/labs/policySets/evaluatePolicies/action",
|                                                         "Microsoft.DevTestLab/labs/virtualMachines/claim/action",
|                                                         "Microsoft.DevTestLab/labs/virtualmachines/listApplicableSchedules/action",
|                                                         "Microsoft.DevTestLab/labs/virtualMachines/getRdpFileContents/action",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                         "Microsoft.Network/networkInterfaces/*/read",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/publicIPAddresses/*/read",
|                                                         "Microsoft.Network/publicIPAddresses/join/action",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Compute/virtualMachines/vmSizes/read"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5bd9cd88-fe45-4216-938b-f97437e15450",
|                                         "Name":  "DocumentDB Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage DocumentDB accounts but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.DocumentDb/databaseAccounts/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "befefa01-2a29-4197-83a8-272ff33ce314",
|                                         "Name":  "DNS Zone Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage DNS zones and records but cannot assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/dnsZones/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "428e0ff0-5e57-4d9c-a221-2c70d0e0a443",
|                                         "Name":  "EventGrid EventSubscription Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages EventGrid subscriptions but has no direct or near-direct path to identity plane control or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/*",
|                                                         "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2414bbcf-6497-4faf-8c65-045460748405",
|                                         "Name":  "EventGrid EventSubscription Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to EventGrid subscriptions with no ability to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b60367af-1334-4454-b71e-769d9a4f83d9",
|                                         "Name":  "Graph Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Enterprise Graph data but does not have permissions to modify roles or authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/conflation/read",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/conflation/write",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/sourceschema/read",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/sourceschema/write",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/knowledge/read",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/knowledge/write",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/intentclassification/read",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/intentclassification/write",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/ingestion/read",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/ingestion/write",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/ontology/read",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/ontology/write",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/delete",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "03a6d094-3444-4b3d-88af-7477090a9e5e",
|                                         "Name":  "Intelligent Systems Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Intelligent Systems accounts but cannot access or modify identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.IntelligentSystems/accounts/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ee361c5d-f7b5-4119-b4b6-892157c8f64c",
|                                         "Name":  "Knowledge Consumer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Enterprise Graph knowledge with no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/knowledge/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b97fb8bc-a8b2-4522-a38b-dd33c7e65ead",
|                                         "Name":  "Lab Creator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create labs but lacks permissions to modify identity plane or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.LabServices/labAccounts/*/read",
|                                                         "Microsoft.LabServices/labAccounts/createLab/action",
|                                                         "Microsoft.LabServices/labAccounts/getPricingAndAvailability/action",
|                                                         "Microsoft.LabServices/labAccounts/getRestrictionsAndUsage/action",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.LabServices/labPlans/images/read",
|                                                         "Microsoft.LabServices/labPlans/read",
|                                                         "Microsoft.LabServices/labPlans/saveImage/action",
|                                                         "Microsoft.LabServices/labs/read",
|                                                         "Microsoft.LabServices/labs/schedules/read",
|                                                         "Microsoft.LabServices/labs/users/read",
|                                                         "Microsoft.LabServices/labs/virtualMachines/read",
|                                                         "Microsoft.LabServices/locations/usages/read",
|                                                         "Microsoft.LabServices/skus/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.LabServices/labPlans/createLab/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "73c42c96-874c-492b-b04d-ab87d138a893",
|                                         "Name":  "Log Analytics Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to monitoring data without ability to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/search/action",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.OperationalInsights/workspaces/sharedKeys/read"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "515c2055-d9d4-4321-b1b9-bd0c9a0f79fe",
|                                         "Name":  "Logic App Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and enable/disable logic apps but no permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*/read",
|                                                         "Microsoft.Insights/metricAlerts/*/read",
|                                                         "Microsoft.Insights/diagnosticSettings/*/read",
|                                                         "Microsoft.Insights/metricDefinitions/*/read",
|                                                         "Microsoft.Logic/*/read",
|                                                         "Microsoft.Logic/workflows/disable/action",
|                                                         "Microsoft.Logic/workflows/enable/action",
|                                                         "Microsoft.Logic/workflows/validate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/connectionGateways/*/read",
|                                                         "Microsoft.Web/connections/*/read",
|                                                         "Microsoft.Web/customApis/*/read",
|                                                         "Microsoft.Web/serverFarms/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "87a39d53-fc1b-424a-814c-f7e04687dc9e",
|                                         "Name":  "Logic App Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages logic apps but cannot access identity plane or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ClassicStorage/storageAccounts/listKeys/action",
|                                                         "Microsoft.ClassicStorage/storageAccounts/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/metricAlerts/*",
|                                                         "Microsoft.Insights/diagnosticSettings/*",
|                                                         "Microsoft.Insights/logdefinitions/*",
|                                                         "Microsoft.Insights/metricDefinitions/*",
|                                                         "Microsoft.Logic/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/connectionGateways/*",
|                                                         "Microsoft.Web/connections/*",
|                                                         "Microsoft.Web/customApis/*",
|                                                         "Microsoft.Web/serverFarms/join/action",
|                                                         "Microsoft.Web/serverFarms/read",
|                                                         "Microsoft.Web/sites/functions/listSecrets/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c7393b34-138c-406f-901b-d8cf2b17e6ae",
|                                         "Name":  "Managed Application Operator Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can perform actions on managed applications but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.Solutions/applications/read",
|                                                         "Microsoft.Solutions/*/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b9331d33-8a36-4f8c-b097-4f54124fdb44",
|                                         "Name":  "Managed Application Publisher Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Limited to reading managed application resources and requesting JIT access; no direct identity plane control.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Solutions/jitRequests/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ac63b705-f282-497d-ac71-919bf39d939d",
|                                         "Name":  "Management Group Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to management groups without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Management/managementGroups/subscriptions/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "43d0d8ad-25c7-4714-9337-8ba259a9fe05",
|                                         "Name":  "Monitoring Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to monitoring data with no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/search/action",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4d97b98b-1d4f-4787-a291-c67834d212e7",
|                                         "Name":  "Network Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages network resources but cannot assign roles or modify identity plane controls.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d28c62d-5b37-4476-8438-e587778df237",
|                                         "Name":  "New Relic APM Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages New Relic APM accounts but no access to identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "NewRelic.APM/accounts/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "acdd72a7-3385-48ef-bd42-f606fba81ae7",
|                                         "Name":  "Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to resources without any ability to modify identity plane or assign roles.",
|                                         "Actions":  [
|                                                         "*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e0f68234-74aa-48ed-b826-c38b57376e17",
|                                         "Name":  "Redis Cache Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Redis caches but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cache/register/action",
|                                                         "Microsoft.Cache/redis/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "188a0f2f-5c9e-469b-ae67-2aa5ce574b94",
|                                         "Name":  "Scheduler Job Collections Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages scheduler job collections but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Scheduler/jobcollections/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7ca78c08-252a-4471-8644-bb5ff32d4ba0",
|                                         "Name":  "Search Service Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages search services but cannot assign roles or modify identity plane controls.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Search/searchServices/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e3d13bf0-dd5a-482e-ba6b-9b8433878d10",
|                                         "Name":  "Security Manager (Legacy)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Legacy role with read and write on compute and network but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ClassicCompute/*/read",
|                                                         "Microsoft.ClassicCompute/virtualMachines/*/write",
|                                                         "Microsoft.ClassicNetwork/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Security/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "39bc4728-0917-49c7-9d2c-d95423bc2eb4",
|                                         "Name":  "Security Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to security data without ability to modify identity plane or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.operationalInsights/workspaces/*/read",
|                                                         "Microsoft.Resources/deployments/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Security/*/read",
|                                                         "Microsoft.IoTSecurity/*/read",
|                                                         "Microsoft.Support/*/read",
|                                                         "Microsoft.Security/iotDefenderSettings/packageDownloads/action",
|                                                         "Microsoft.Security/iotDefenderSettings/downloadManagerActivation/action",
|                                                         "Microsoft.Security/iotSensors/downloadResetPassword/action",
|                                                         "Microsoft.IoTSecurity/defenderSettings/packageDownloads/action",
|                                                         "Microsoft.IoTSecurity/defenderSettings/downloadManagerActivation/action",
|                                                         "Microsoft.Management/managementGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8bbe83f1-e2a6-4df7-8cb4-4e04d4e5c827",
|                                         "Name":  "Spatial Anchors Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages spatial anchors but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/create/action",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/discovery/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/properties/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/query/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/submitdiag/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6670b86e-a3f7-4917-ac9b-5d6ab1be4567",
|                                         "Name":  "Site Recovery Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Site Recovery except vault creation and role assignment; no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                         "Microsoft.RecoveryServices/locations/allocateStamp/action",
|                                                         "Microsoft.RecoveryServices/Vaults/certificates/write",
|                                                         "Microsoft.RecoveryServices/Vaults/extendedInformation/*",
|                                                         "Microsoft.RecoveryServices/Vaults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/refreshContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/*",
|                                                         "Microsoft.RecoveryServices/vaults/replicationAlertSettings/*",
|                                                         "Microsoft.RecoveryServices/vaults/replicationEvents/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/*",
|                                                         "Microsoft.RecoveryServices/vaults/replicationJobs/*",
|                                                         "Microsoft.RecoveryServices/vaults/replicationPolicies/*",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/*",
|                                                         "Microsoft.RecoveryServices/vaults/replicationVaultSettings/*",
|                                                         "Microsoft.RecoveryServices/Vaults/storageConfig/*",
|                                                         "Microsoft.RecoveryServices/Vaults/tokenInfo/read",
|                                                         "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                         "Microsoft.RecoveryServices/Vaults/vaultTokens/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/*",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationOperationStatus/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "494ae006-db33-4328-bf46-533a6560a3ca",
|                                         "Name":  "Site Recovery Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can perform failover/failback but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                         "Microsoft.RecoveryServices/locations/allocateStamp/action",
|                                                         "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                         "Microsoft.RecoveryServices/Vaults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/refreshContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationAlertSettings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationEvents/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/checkConsistency/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/reassociateGateway/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/renewcertificate/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/replicationNetworkMappings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/applyRecoveryPoint/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/failoverCommit/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/plannedFailover/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/recoveryPoints/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/repairReplication/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/reProtect/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/switchprotection/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/testFailover/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/testFailoverCleanup/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/unplannedFailover/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/updateMobilityService/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectionContainerMappings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/refreshProvider/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/replicationStorageClassificationMappings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationvCenters/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationJobs/*",
|                                                         "Microsoft.RecoveryServices/vaults/replicationPolicies/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/failoverCommit/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/plannedFailover/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/reProtect/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/testFailover/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/testFailoverCleanup/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/unplannedFailover/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationVaultSettings/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/*",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read",
|                                                         "Microsoft.RecoveryServices/Vaults/storageConfig/read",
|                                                         "Microsoft.RecoveryServices/Vaults/tokenInfo/read",
|                                                         "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                         "Microsoft.RecoveryServices/Vaults/vaultTokens/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d51204f-eb77-4b1c-b86a-2ec626c49413",
|                                         "Name":  "Spatial Anchors Account Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to spatial anchors with no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/discovery/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/properties/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/query/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/submitdiag/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dbaa88c4-0c30-4179-9fb3-46319faa6149",
|                                         "Name":  "Site Recovery Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Site Recovery status without ability to modify identity plane or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                         "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read",
|                                                         "Microsoft.RecoveryServices/Vaults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/refreshContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationAlertSettings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationEvents/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/replicationNetworkMappings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/recoveryPoints/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectionContainerMappings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/replicationStorageClassificationMappings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationvCenters/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationJobs/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationPolicies/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationVaultSettings/read",
|                                                         "Microsoft.RecoveryServices/Vaults/storageConfig/read",
|                                                         "Microsoft.RecoveryServices/Vaults/tokenInfo/read",
|                                                         "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                         "Microsoft.RecoveryServices/Vaults/vaultTokens/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "70bbe301-9835-447d-afdd-19eb3167307c",
|                                         "Name":  "Spatial Anchors Account Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages spatial anchors including deletion but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/create/action",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/delete",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/discovery/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/properties/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/query/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/submitdiag/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4939a1f6-9ae0-4e48-a1e0-f2cbe897382d",
|                                         "Name":  "SQL Managed Instance Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages SQL Managed Instances and network config but cannot assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/*",
|                                                         "Microsoft.Network/routeTables/*",
|                                                         "Microsoft.Sql/locations/*/read",
|                                                         "Microsoft.Sql/locations/instanceFailoverGroups/*",
|                                                         "Microsoft.Sql/managedInstances/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Network/virtualNetworks/subnets/*",
|                                                         "Microsoft.Network/virtualNetworks/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/metricDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Sql/managedInstances/azureADOnlyAuthentications/delete",
|                                                            "Microsoft.Sql/managedInstances/azureADOnlyAuthentications/write"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9b7fa17d-e63e-47b0-bb0a-15c516ac86ec",
|                                         "Name":  "SQL DB Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages SQL databases but no access to security policies or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Sql/locations/*/read",
|                                                         "Microsoft.Sql/servers/databases/*",
|                                                         "Microsoft.Sql/servers/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/metricDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Sql/servers/databases/ledgerDigestUploads/write",
|                                                            "Microsoft.Sql/servers/databases/ledgerDigestUploads/disable/action",
|                                                            "Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*",
|                                                            "Microsoft.Sql/managedInstances/databases/sensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*",
|                                                            "Microsoft.Sql/managedInstances/securityAlertPolicies/*",
|                                                            "Microsoft.Sql/managedInstances/vulnerabilityAssessments/*",
|                                                            "Microsoft.Sql/servers/databases/auditingSettings/*",
|                                                            "Microsoft.Sql/servers/databases/auditRecords/read",
|                                                            "Microsoft.Sql/servers/databases/currentSensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/dataMaskingPolicies/*",
|                                                            "Microsoft.Sql/servers/databases/extendedAuditingSettings/*",
|                                                            "Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/securityAlertPolicies/*",
|                                                            "Microsoft.Sql/servers/databases/securityMetrics/*",
|                                                            "Microsoft.Sql/servers/databases/sensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/vulnerabilityAssessments/*",
|                                                            "Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*",
|                                                            "Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*",
|                                                            "Microsoft.Sql/servers/vulnerabilityAssessments/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "056cd41c-7e88-42e1-933e-88ba6a50c9c3",
|                                         "Name":  "SQL Security Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages security policies of SQL servers/databases but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Sql/locations/administratorAzureAsyncOperation/read",
|                                                         "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*",
|                                                         "Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*",
|                                                         "Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                         "Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*",
|                                                         "Microsoft.Sql/managedInstances/databases/sensitivityLabels/*",
|                                                         "Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*",
|                                                         "Microsoft.Sql/servers/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/servers/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/managedInstances/securityAlertPolicies/*",
|                                                         "Microsoft.Sql/managedInstances/databases/transparentDataEncryption/*",
|                                                         "Microsoft.Sql/managedInstances/vulnerabilityAssessments/*",
|                                                         "Microsoft.Sql/managedInstances/serverConfigurationOptions/read",
|                                                         "Microsoft.Sql/managedInstances/serverConfigurationOptions/write",
|                                                         "Microsoft.Sql/locations/serverConfigurationOptionAzureAsyncOperation/read",
|                                                         "Microsoft.Sql/servers/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/servers/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/servers/auditingSettings/*",
|                                                         "Microsoft.Sql/servers/extendedAuditingSettings/*",
|                                                         "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/servers/databases/auditingSettings/*",
|                                                         "Microsoft.Sql/servers/databases/auditRecords/read",
|                                                         "Microsoft.Sql/servers/databases/currentSensitivityLabels/*",
|                                                         "Microsoft.Sql/servers/databases/dataMaskingPolicies/*",
|                                                         "Microsoft.Sql/servers/databases/extendedAuditingSettings/read",
|                                                         "Microsoft.Sql/servers/databases/read",
|                                                         "Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*",
|                                                         "Microsoft.Sql/servers/databases/schemas/read",
|                                                         "Microsoft.Sql/servers/databases/schemas/tables/columns/read",
|                                                         "Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                         "Microsoft.Sql/servers/databases/schemas/tables/read",
|                                                         "Microsoft.Sql/servers/databases/securityAlertPolicies/*",
|                                                         "Microsoft.Sql/servers/databases/securityMetrics/*",
|                                                         "Microsoft.Sql/servers/databases/sensitivityLabels/*",
|                                                         "Microsoft.Sql/servers/databases/transparentDataEncryption/*",
|                                                         "Microsoft.Sql/servers/databases/sqlvulnerabilityAssessments/*",
|                                                         "Microsoft.Sql/servers/databases/vulnerabilityAssessments/*",
|                                                         "Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*",
|                                                         "Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*",
|                                                         "Microsoft.Sql/servers/devOpsAuditingSettings/*",
|                                                         "Microsoft.Sql/servers/firewallRules/*",
|                                                         "Microsoft.Sql/servers/read",
|                                                         "Microsoft.Sql/servers/securityAlertPolicies/*",
|                                                         "Microsoft.Sql/servers/sqlvulnerabilityAssessments/*",
|                                                         "Microsoft.Sql/servers/vulnerabilityAssessments/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Sql/servers/azureADOnlyAuthentications/*",
|                                                         "Microsoft.Sql/managedInstances/read",
|                                                         "Microsoft.Sql/managedInstances/azureADOnlyAuthentications/*",
|                                                         "Microsoft.Security/sqlVulnerabilityAssessments/*",
|                                                         "Microsoft.Sql/managedInstances/administrators/read",
|                                                         "Microsoft.Sql/servers/administrators/read",
|                                                         "Microsoft.Sql/servers/databases/ledgerDigestUploads/*",
|                                                         "Microsoft.Sql/locations/ledgerDigestUploadsAzureAsyncOperation/read",
|                                                         "Microsoft.Sql/locations/ledgerDigestUploadsOperationResults/read",
|                                                         "Microsoft.Sql/servers/externalPolicyBasedAuthorizations/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437",
|                                         "Name":  "SQL Server Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages SQL servers and databases but no access to security policies or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Sql/locations/*/read",
|                                                         "Microsoft.Sql/servers/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/metricDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*",
|                                                            "Microsoft.Sql/managedInstances/databases/sensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*",
|                                                            "Microsoft.Sql/managedInstances/securityAlertPolicies/*",
|                                                            "Microsoft.Sql/managedInstances/vulnerabilityAssessments/*",
|                                                            "Microsoft.Sql/servers/auditingSettings/*",
|                                                            "Microsoft.Sql/servers/databases/auditingSettings/*",
|                                                            "Microsoft.Sql/servers/databases/auditRecords/read",
|                                                            "Microsoft.Sql/servers/databases/currentSensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/dataMaskingPolicies/*",
|                                                            "Microsoft.Sql/servers/databases/extendedAuditingSettings/*",
|                                                            "Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/securityAlertPolicies/*",
|                                                            "Microsoft.Sql/servers/databases/securityMetrics/*",
|                                                            "Microsoft.Sql/servers/databases/sensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/vulnerabilityAssessments/*",
|                                                            "Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*",
|                                                            "Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*",
|                                                            "Microsoft.Sql/servers/devOpsAuditingSettings/*",
|                                                            "Microsoft.Sql/servers/extendedAuditingSettings/*",
|                                                            "Microsoft.Sql/servers/securityAlertPolicies/*",
|                                                            "Microsoft.Sql/servers/vulnerabilityAssessments/*",
|                                                            "Microsoft.Sql/servers/azureADOnlyAuthentications/delete",
|                                                            "Microsoft.Sql/servers/azureADOnlyAuthentications/write",
|                                                            "Microsoft.Sql/servers/externalPolicyBasedAuthorizations/delete",
|                                                            "Microsoft.Sql/servers/externalPolicyBasedAuthorizations/write"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cfd33db0-3dd1-45e3-aa9d-cdbdf3b6f24e",
|                                         "Name":  "Support Request Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and manage support requests but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a4b10055-b0c7-44c2-b00f-c7b5b3550cf7",
|                                         "Name":  "Traffic Manager Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Traffic Manager profiles but cannot control access or assign roles; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/trafficManagerProfiles/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9980e02c-c2be-4d73-94e8-173b1dc7cf3c",
|                                         "Name":  "Virtual Machine Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages virtual machines but cannot control access or assign roles; no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Compute/availabilitySets/*",
|                                                         "Microsoft.Compute/locations/*",
|                                                         "Microsoft.Compute/virtualMachines/*",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/*",
|                                                         "Microsoft.Compute/cloudServices/*",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/hostgroups/write",
|                                                         "Microsoft.Compute/hostgroups/hosts/write",
|                                                         "Microsoft.DevTestLab/schedules/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/applicationGateways/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/inboundNatPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                         "Microsoft.Network/loadBalancers/probes/join/action",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/locations/*",
|                                                         "Microsoft.Network/networkInterfaces/*",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/publicIPAddresses/join/action",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.RecoveryServices/locations/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/write",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/*/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/write",
|                                                         "Microsoft.RecoveryServices/Vaults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                         "Microsoft.RecoveryServices/Vaults/write",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.SerialConsole/serialPorts/connect/action",
|                                                         "Microsoft.SqlVirtualMachine/*",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b",
|                                         "Name":  "Web Plan Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages web plans but cannot control access or assign roles; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/serverFarms/*",
|                                                         "Microsoft.Web/hostingEnvironments/Join/Action",
|                                                         "Microsoft.Insights/autoscalesettings/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "de139f84-1756-47ae-9be6-808fbbe84772",
|                                         "Name":  "Website Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages websites but cannot control access or assign roles; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/components/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/certificates/*",
|                                                         "Microsoft.Web/listSitesAssignedToHostName/read",
|                                                         "Microsoft.Web/register/action",
|                                                         "Microsoft.Web/serverFarms/join/action",
|                                                         "Microsoft.Web/serverFarms/read",
|                                                         "Microsoft.Web/sites/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bbf86eb8-f7b4-4cce-96e4-18cddf81d86e",
|                                         "Name":  "Attestation Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage attestation providers but no direct or near-direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Attestation/attestationProviders/attestation/read",
|                                                         "Microsoft.Attestation/attestationProviders/attestation/write",
|                                                         "Microsoft.Attestation/attestationProviders/attestation/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "61ed4efc-fab3-44fd-b111-e24485cc132a",
|                                         "Name":  "HDInsight Cluster Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can modify HDInsight cluster configurations but no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.HDInsight/*/read",
|                                                         "Microsoft.HDInsight/clusters/getGatewaySettings/action",
|                                                         "Microsoft.HDInsight/clusters/updateGatewaySettings/action",
|                                                         "Microsoft.HDInsight/clusters/configurations/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "230815da-be43-4aae-9cb4-875f7bd000aa",
|                                         "Name":  "Cosmos DB Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Cosmos DB accounts without access to keys or connection strings; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDb/databaseAccounts/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.DocumentDB/databaseAccounts/copyJobs/*",
|                                                            "Microsoft.DocumentDB/databaseAccounts/dataTransferJobs/*",
|                                                            "Microsoft.DocumentDB/databaseAccounts/readonlyKeys/*",
|                                                            "Microsoft.DocumentDB/databaseAccounts/regenerateKey/*",
|                                                            "Microsoft.DocumentDB/databaseAccounts/listKeys/*",
|                                                            "Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/*",
|                                                            "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/write",
|                                                            "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/delete",
|                                                            "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/write",
|                                                            "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/delete",
|                                                            "Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/write",
|                                                            "Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/delete",
|                                                            "Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/write",
|                                                            "Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "48b40c6e-82e0-4eb3-90d5-19e40f49b624",
|                                         "Name":  "Hybrid Server Resource Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Hybrid servers but no direct identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/machines/*",
|                                                         "Microsoft.HybridCompute/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d1e5ee4-7c68-4a71-ac8b-0739630a3dfb",
|                                         "Name":  "Hybrid Server Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can onboard Hybrid servers but no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b12aa53e-6015-4669-85d0-8515ebb3ae7f",
|                                         "Name":  "Private DNS Zone Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages private DNS zones but cannot modify virtual networks or assign roles; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Network/privateDnsZones/*",
|                                                         "Microsoft.Network/privateDnsOperationResults/*",
|                                                         "Microsoft.Network/privateDnsOperationStatuses/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1d18fff3-a72a-46b5-b4a9-0b38a3cd7e63",
|                                         "Name":  "Desktop Virtualization User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows use of applications only; no identity plane control or role assignment capability.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DesktopVirtualization/applicationGroups/useApplications/action",
|                                                             "Microsoft.DesktopVirtualization/appAttachPackages/useApplications/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "41077137-e803-4205-871c-5a86e6a753b4",
|                                         "Name":  "Blueprint Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage blueprint definitions but cannot assign them; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Blueprint/blueprints/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "437d2ced-4a38-4302-8479-ed2bcb43d090",
|                                         "Name":  "Blueprint Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can assign blueprints only with managed identity; no direct identity plane control or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Blueprint/blueprintAssignments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ab8e14d6-4a74-4a29-9ba8-549422addade",
|                                         "Name":  "Microsoft Sentinel Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Sentinel resources but no direct identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.SecurityInsights/*",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/querypacks/*/read",
|                                                         "Microsoft.Insights/workbooks/*",
|                                                         "Microsoft.Insights/myworkbooks/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                            "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3e150937-b8fe-4cfb-8069-0eaf05ecd056",
|                                         "Name":  "Microsoft Sentinel Responder",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can respond to incidents but no direct identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.SecurityInsights/*/read",
|                                                         "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                         "Microsoft.SecurityInsights/automationRules/*",
|                                                         "Microsoft.SecurityInsights/cases/*",
|                                                         "Microsoft.SecurityInsights/incidents/*",
|                                                         "Microsoft.SecurityInsights/entities/runPlaybook/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/bulkTag/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/replaceTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/systems/undoAction/action",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/querypacks/*/read",
|                                                         "Microsoft.Insights/workbooks/read",
|                                                         "Microsoft.Insights/myworkbooks/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.SecurityInsights/cases/*/Delete",
|                                                            "Microsoft.SecurityInsights/incidents/*/Delete",
|                                                            "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                            "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8d289c81-5878-46d4-8554-54e1e3d8b5cb",
|                                         "Name":  "Microsoft Sentinel Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Sentinel data; no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.SecurityInsights/*/read",
|                                                         "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/LinkedServices/read",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                         "Microsoft.OperationalInsights/querypacks/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.Insights/workbooks/read",
|                                                         "Microsoft.Insights/myworkbooks/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/templateSpecs/*/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                            "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "66bb4e9e-b016-4a94-8249-4c0511c2be84",
|                                         "Name":  "Policy Insights Data Writer (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can write to policy events but cannot modify role assignments or authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/policyassignments/read",
|                                                         "Microsoft.Authorization/policydefinitions/read",
|                                                         "Microsoft.Authorization/policyexemptions/read",
|                                                         "Microsoft.Authorization/policysetdefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.PolicyInsights/checkDataPolicyCompliance/action",
|                                                             "Microsoft.PolicyInsights/policyEvents/logDataEvents/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "04165923-9d83-45d5-8227-78b77b0a687e",
|                                         "Name":  "SignalR AccessKey Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to SignalR keys only; no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.SignalRService/*/read",
|                                                         "Microsoft.SignalRService/SignalR/listkeys/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8cf5e20a-e4b2-4e9d-b3a1-5ceb692c2761",
|                                         "Name":  "SignalR/Web PubSub Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages SignalR resources but no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.SignalRService/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b64e21ea-ac4e-4cdf-9dc9-5b892992bee7",
|                                         "Name":  "Azure Connected Machine Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can onboard machines but no direct identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/settings/read",
|                                                         "Microsoft.HybridCompute/settings/write",
|                                                         "Microsoft.HybridCompute/gateways/read",
|                                                         "Microsoft.HybridCompute/privateLinkScopes/read",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                         "Microsoft.Insights/dataCollectionRuleAssociations/write",
|                                                         "Microsoft.Insights/dataCollectionRuleAssociations/delete",
|                                                         "Microsoft.Insights/dataCollectionRuleAssociations/read",
|                                                         "Microsoft.HybridCompute/machines/addExtensions/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "91c1777a-f3dc-4fae-b103-61d183457e46",
|                                         "Name":  "Managed Services Registration assignment Delete Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can delete registration assignments but no direct identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedServices/registrationAssignments/read",
|                                                         "Microsoft.ManagedServices/registrationAssignments/delete",
|                                                         "Microsoft.ManagedServices/operationStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "34e09817-6cbe-4d01-b1a2-e0eac5743d41",
|                                         "Name":  "Kubernetes Cluster - Azure Arc Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create connectedClusters resource but no direct identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Kubernetes/connectedClusters/Write",
|                                                         "Microsoft.Kubernetes/connectedClusters/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7f646f1b-fa08-80eb-a22b-edd6ce5c915c",
|                                         "Name":  "Experimentation Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to resource groups and experiment workspaces only; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/write",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/delete",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/experiment/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/emergencystop/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/read",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/write",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "466ccd10-b268-4a11-b098-b4849f024126",
|                                         "Name":  "Cognitive Services QnA Maker Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and test KB only; no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/download/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/generateanswer/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/alterations/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/endpointkeys/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/endpointsettings/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/download/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/generateanswer/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/alterations/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointkeys/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointsettings/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/download/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/generateanswer/action",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/alterations/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointkeys/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointsettings/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f4cc2bf9-21be-47a1-bdf1-5c5804381025",
|                                         "Name":  "Cognitive Services QnA Maker Editor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and edit KB but cannot publish or delete; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/download/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/create/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/generateanswer/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/train/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/alterations/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/alterations/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/endpointkeys/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/endpointkeys/refreshkeys/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/endpointsettings/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/endpointsettings/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/operations/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/download/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/create/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/generateanswer/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/train/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/alterations/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/alterations/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointkeys/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointkeys/refreshkeys/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointsettings/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointsettings/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/operations/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/download/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/create/write",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/write",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/generateanswer/action",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/train/action",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/alterations/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/alterations/write",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointkeys/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointkeys/refreshkeys/action",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointsettings/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointsettings/write",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/operations/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7f646f1b-fa08-80eb-a33b-edd6ce5c915c",
|                                         "Name":  "Experimentation Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to resource groups and experiment workspaces only; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/admin/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/write",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/delete",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/experimentadmin/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/experiment/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/emergencystop/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/read",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/write",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/delete",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/admin/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/metricwrite/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/metricwrite/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3df8b902-2a6f-47c7-8cc5-360e9b272a7e",
|                                         "Name":  "Remote Rendering Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages rendering sessions and diagnostics but no identity plane control or role assignment capability.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/convert/action",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/convert/read",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/convert/delete",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/read",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/action",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/delete",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/render/read",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/diagnostic/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d39065c4-c120-43c9-ab0a-63eed9795f0a",
|                                         "Name":  "Remote Rendering Client",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages rendering sessions and diagnostics but no identity plane control or role assignment capability.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/read",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/action",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/delete",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/render/read",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/diagnostic/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "641177b8-a67a-45b9-a033-47bc880bb21e",
|                                         "Name":  "Managed Application Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create managed application resources but no role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.Solutions/applications/*",
|                                                         "Microsoft.Solutions/register/action",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/*",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "612c2aa1-cb24-443b-ac28-3ab7272de6f5",
|                                         "Name":  "Security Assessment Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can push security assessments but cannot modify roles or authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.Security/assessments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4a9ae827-6dc8-4573-8ac7-8239d42aa03f",
|                                         "Name":  "Tag Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages tags only without access to underlying resources or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
|                                                         "Microsoft.Resources/subscriptions/resources/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Resources/tags/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c7aa55d3-1abb-444a-a5ca-5e51e485d6ec",
|                                         "Name":  "Integration Service Environment Developer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and update workflows but no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Logic/integrationServiceEnvironments/read",
|                                                         "Microsoft.Logic/integrationServiceEnvironments/*/join/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a41e2c5b-bd99-4a07-88f4-9bf657a760b8",
|                                         "Name":  "Integration Service Environment Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages integration service environments but no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Logic/integrationServiceEnvironments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8",
|                                         "Name":  "Azure Kubernetes Service Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage AKS clusters but no direct identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ContainerService/locations/*",
|                                                         "Microsoft.ContainerService/managedClusters/*",
|                                                         "Microsoft.ContainerService/managedclustersnapshots/*",
|                                                         "Microsoft.ContainerService/snapshots/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/deploymentSafeguards/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "350f8d15-c687-4448-8ae1-157740a3936d",
|                                         "Name":  "Hierarchy Settings Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can edit and delete management group settings but no role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Management/managementGroups/settings/write",
|                                                         "Microsoft.Management/managementGroups/settings/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "49632ef5-d9ac-41f4-b8e7-bbe587fa74a1",
|                                         "Name":  "Experimentation Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to experimentation workspaces with no identity plane impact or escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Experimentation/experimentWorkspaces/read",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "93586559-c37d-4a6b-ba08-b9f0940c2d73",
|                                         "Name":  "Cognitive Services Custom Vision Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only project access with no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/query/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "21090545-7ca7-4776-b22c-e363652d74d2",
|                                         "Name":  "Key Vault Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read metadata only, no access to sensitive values or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.KeyVault/checkNameAvailability/read",
|                                                         "Microsoft.KeyVault/deletedVaults/read",
|                                                         "Microsoft.KeyVault/locations/*/read",
|                                                         "Microsoft.KeyVault/vaults/*/read",
|                                                         "Microsoft.KeyVault/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/*/read",
|                                                             "Microsoft.KeyVault/vaults/secrets/readMetadata/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "82200a5b-e217-47a5-b665-6d8765ee745b",
|                                         "Name":  "Services Hub Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Services Hub connectors only, no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.ServicesHub/connectors/write",
|                                                         "Microsoft.ServicesHub/connectors/read",
|                                                         "Microsoft.ServicesHub/connectors/delete",
|                                                         "Microsoft.ServicesHub/connectors/checkAssessmentEntitlement/action",
|                                                         "Microsoft.ServicesHub/connectors/*",
|                                                         "Microsoft.ServicesHub/*",
|                                                         "Microsoft.ServicesHub/supportOfferingEntitlement/read",
|                                                         "Microsoft.ServicesHub/workspaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d18777c0-1514-4662-8490-608db7d334b6",
|                                         "Name":  "Object Understanding Account Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to ingestion jobs with no identity plane impact.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/ObjectUnderstandingAccounts/ingest/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e9dba6fb-3d52-4cf0-bce3-f06ce71b9e0f",
|                                         "Name":  "Device Update Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to device update management and content, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.DeviceUpdate/accounts/read",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/read",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d1ee9a80-8b14-47f0-bdc2-f4a351625a7b",
|                                         "Name":  "Device Update Content Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to content operations, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.DeviceUpdate/accounts/read",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3b20f47b-3825-43cb-8114-4bd2201156a8",
|                                         "Name":  "Cognitive Services Metrics Advisor User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to metrics project only, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/MetricsAdvisor/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2c56ea50-c6b3-40a6-83c0-9d98858bc7d2",
|                                         "Name":  "Schema Registry Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to schema registry groups and schemas, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.EventHub/namespaces/schemagroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventHub/namespaces/schemas/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7ec7ccdc-f61e-41fe-9aaf-980df0a44eba",
|                                         "Name":  "AgFood Platform Service Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to AgFood Platform Service, no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/*/list/action",
|                                                             "Microsoft.AgFoodPlatform/*/read",
|                                                             "Microsoft.AgFoodPlatform/*/search/action",
|                                                             "Microsoft.AgFoodPlatform/*/download/action",
|                                                             "Microsoft.AgFoodPlatform/*/overlap/action",
|                                                             "Microsoft.AgFoodPlatform/*/checkConsent/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0b555d9b-b4a7-4f43-b330-627f0e5be8f0",
|                                         "Name":  "Security Detonation Chamber Submitter",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allowed to create submissions only, no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/delete",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/write",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/files/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/accesskeyview/read",
|                                                             "Microsoft.SecurityDetonation/chambers/platforms/metadata/read",
|                                                             "Microsoft.SecurityDetonation/chambers/workflows/metadata/read",
|                                                             "Microsoft.SecurityDetonation/chambers/toolsets/metadata/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ddde6b66-c0df-4114-a159-3618637b3035",
|                                         "Name":  "SignalR REST API Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to SignalR REST APIs, no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SignalRService/SignalR/group/read",
|                                                             "Microsoft.SignalRService/SignalR/clientConnection/read",
|                                                             "Microsoft.SignalRService/SignalR/user/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f7b75c60-3036-4b75-91c3-6b41c27c1689",
|                                         "Name":  "Reservation Purchaser",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can purchase reservations but no identity plane control or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Capacity/catalogs/read",
|                                                         "Microsoft.Capacity/register/action",
|                                                         "Microsoft.Compute/register/action",
|                                                         "Microsoft.Consumption/register/action",
|                                                         "Microsoft.Consumption/reservationRecommendationDetails/read",
|                                                         "Microsoft.Consumption/reservationRecommendations/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.SQL/register/action",
|                                                         "Microsoft.Support/supporttickets/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9ef4ef9c-a049-46b0-82ab-dd8ac094c889",
|                                         "Name":  "Project Babylon Data Curator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and modify catalog data objects only; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ProjectBabylon/accounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ProjectBabylon/accounts/data/read",
|                                                             "Microsoft.ProjectBabylon/accounts/data/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c8d896ba-346d-4f50-bc1d-7d1c84130446",
|                                         "Name":  "Project Babylon Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to catalog data objects; no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ProjectBabylon/accounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ProjectBabylon/accounts/data/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "05b7651b-dc44-475e-b74d-df3db49fae0f",
|                                         "Name":  "Project Babylon Data Source Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage data sources and scans without identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ProjectBabylon/accounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ProjectBabylon/accounts/scan/read",
|                                                             "Microsoft.ProjectBabylon/accounts/scan/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ca6382a4-1721-4bcf-a114-ff0c70227b6b",
|                                         "Name":  "Application Group Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage application groups and related resources without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/applicationgroups/*",
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                         "Microsoft.DesktopVirtualization/workspaces/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "49a72310-ab8d-41df-bbb0-79b649203868",
|                                         "Name":  "Desktop Virtualization Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to desktop virtualization resources; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "082f0a83-3be5-4ba1-904c-961cca79b387",
|                                         "Name":  "Desktop Virtualization Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to desktop virtualization resources without identity or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "21efdde3-836f-432b-bf3d-3e8e734d4b2b",
|                                         "Name":  "Desktop Virtualization Workspace Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage desktop virtualization workspace resources without identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/workspaces/*",
|                                                         "Microsoft.DesktopVirtualization/applicationgroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ea4bfff8-7fb4-485a-aadd-d4129a0ffaa6",
|                                         "Name":  "Desktop Virtualization User Session Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage user sessions but no permissions to escalate to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2ad6aaab-ead9-4eaa-8ac5-da422f562408",
|                                         "Name":  "Desktop Virtualization Session Host Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage session hosts without identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ceadfde2-b300-400a-ab7b-6143895aa822",
|                                         "Name":  "Desktop Virtualization Host Pool Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to host pools; no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/hostpools/*/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e307426c-f9b6-4e81-87de-d99efb3c32bc",
|                                         "Name":  "Desktop Virtualization Host Pool Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to host pools without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/hostpools/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "aebf23d0-b568-4e86-b8f9-fe83a2c6ab55",
|                                         "Name":  "Desktop Virtualization Application Group Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to application groups; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/applicationgroups/*/read",
|                                                         "Microsoft.DesktopVirtualization/applicationgroups/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "86240b0e-9422-4c43-887b-b61143f32ba8",
|                                         "Name":  "Desktop Virtualization Application Group Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to application groups without identity or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/applicationgroups/*",
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0fa44ee9-7a7d-466b-9bb2-2bf446b1204d",
|                                         "Name":  "Desktop Virtualization Workspace Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to desktop virtualization workspace; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/workspaces/read",
|                                                         "Microsoft.DesktopVirtualization/applicationgroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3e5e47e6-65f7-47ef-90b5-e5dd4d455f24",
|                                         "Name":  "Disk Backup Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to disks and backup actions; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b50d9833-a0cb-478e-945f-707fcc997c13",
|                                         "Name":  "Disk Restore Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Write access to disks for restore operations; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action",
|                                                         "Microsoft.Compute/disks/endGetAccess/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7efff54f-a5b4-42b5-a1c5-5411624893ce",
|                                         "Name":  "Disk Snapshot Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage disk snapshots without identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Compute/snapshots/delete",
|                                                         "Microsoft.Compute/snapshots/write",
|                                                         "Microsoft.Compute/snapshots/read",
|                                                         "Microsoft.Compute/snapshots/beginGetAccess/action",
|                                                         "Microsoft.Compute/snapshots/endGetAccess/action",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action",
|                                                         "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5548b2cf-c94c-4228-90ba-30851930a12f",
|                                         "Name":  "Microsoft.Kubernetes connected cluster role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Kubernetes connected clusters without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Kubernetes/connectedClusters/read",
|                                                         "Microsoft.Kubernetes/connectedClusters/write",
|                                                         "Microsoft.Kubernetes/connectedClusters/delete",
|                                                         "Microsoft.Kubernetes/registeredSubscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a37b566d-3efa-4beb-a2f2-698963fa42ce",
|                                         "Name":  "Security Detonation Chamber Submission Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage submissions without identity or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/delete",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/write",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/files/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/accesskeyview/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/adminview/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/analystview/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/publicview/read",
|                                                             "Microsoft.SecurityDetonation/chambers/platforms/metadata/read",
|                                                             "Microsoft.SecurityDetonation/chambers/workflows/metadata/read",
|                                                             "Microsoft.SecurityDetonation/chambers/toolsets/metadata/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "352470b3-6a9c-4686-b503-35deb827e500",
|                                         "Name":  "Security Detonation Chamber Publisher",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Publish and modify platforms without identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SecurityDetonation/chambers/platforms/read",
|                                                             "Microsoft.SecurityDetonation/chambers/platforms/write",
|                                                             "Microsoft.SecurityDetonation/chambers/platforms/delete",
|                                                             "Microsoft.SecurityDetonation/chambers/platforms/metadata/read",
|                                                             "Microsoft.SecurityDetonation/chambers/workflows/read",
|                                                             "Microsoft.SecurityDetonation/chambers/workflows/write",
|                                                             "Microsoft.SecurityDetonation/chambers/workflows/delete",
|                                                             "Microsoft.SecurityDetonation/chambers/workflows/metadata/read",
|                                                             "Microsoft.SecurityDetonation/chambers/toolsets/read",
|                                                             "Microsoft.SecurityDetonation/chambers/toolsets/write",
|                                                             "Microsoft.SecurityDetonation/chambers/toolsets/delete",
|                                                             "Microsoft.SecurityDetonation/chambers/toolsets/metadata/read",
|                                                             "Microsoft.SecurityDetonation/chambers/publishRequests/read",
|                                                             "Microsoft.SecurityDetonation/chambers/publishRequests/cancel/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7a6f0e70-c033-4fb1-828c-08514e5f4102",
|                                         "Name":  "Collaborative Runtime Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage runtime resources without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.IndustryDataLifecycle/derivedModels/*",
|                                                         "Microsoft.IndustryDataLifecycle/pipelineSets/*",
|                                                         "Microsoft.IndustryDataLifecycle/modelMappings/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5432c526-bc82-444a-b7ba-57c5b0b5b34f",
|                                         "Name":  "CosmosRestoreOperator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Perform restore actions on Cosmos DB without identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDB/locations/restorableDatabaseAccounts/restore/action",
|                                                         "Microsoft.DocumentDB/locations/restorableDatabaseAccounts/*/read",
|                                                         "Microsoft.DocumentDB/locations/restorableDatabaseAccounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a1705bd2-3a8f-45a5-8683-466fcfd5cc24",
|                                         "Name":  "FHIR Data Converter",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Convert data formats without identity or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/convertData/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/convertData/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0e5f05e5-9ab9-446b-b98d-1e2157c94125",
|                                         "Name":  "Quota Request Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and create quota requests without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Capacity/resourceProviders/locations/serviceLimits/read",
|                                                         "Microsoft.Capacity/resourceProviders/locations/serviceLimits/write",
|                                                         "Microsoft.Capacity/resourceProviders/locations/serviceLimitsRequests/read",
|                                                         "Microsoft.Capacity/register/action",
|                                                         "Microsoft.Quota/usages/read",
|                                                         "Microsoft.Quota/quotas/read",
|                                                         "Microsoft.Quota/quotas/write",
|                                                         "Microsoft.Quota/quotaRequests/read",
|                                                         "Microsoft.Quota/register/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1e241071-0855-49ea-94dc-649edcd759de",
|                                         "Name":  "EventGrid Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage EventGrid operations without identity or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "28241645-39f8-410b-ad48-87863e2951d5",
|                                         "Name":  "Security Detonation Chamber Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to submission info; no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/files/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4a167cdf-cb95-4554-9203-2347fe489bd9",
|                                         "Name":  "Object Anchors Account Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read ingestion jobs without identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/ObjectAnchorsAccounts/ingest/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ca0835dd-bacc-42dd-8ed2-ed5e7230d15b",
|                                         "Name":  "Object Anchors Account Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Ingestion capabilities only; no identity or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/ObjectAnchorsAccounts/ingest/action",
|                                                             "Microsoft.MixedReality/ObjectAnchorsAccounts/ingest/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d17ce0a2-0697-43bc-aac5-9113337ab61c",
|                                         "Name":  "WorkloadBuilder Migration Agent Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write migration agents without identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.WorkloadBuilder/migrationAgents/Read",
|                                                         "Microsoft.WorkloadBuilder/migrationAgents/Write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b5537268-8956-4941-a8f0-646150406f0c",
|                                         "Name":  "Azure Spring Cloud Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Azure Spring Cloud data; no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0e75ca1e-0464-4b4d-8b93-68208a576181",
|                                         "Name":  "Cognitive Services Speech Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage speech projects without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVoice/*",
|                                                             "Microsoft.CognitiveServices/accounts/AudioContentCreation/*",
|                                                             "Microsoft.CognitiveServices/accounts/TTSPlayer/*",
|                                                             "Microsoft.CognitiveServices/accounts/VideoTranslation/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomAvatar/*",
|                                                             "Microsoft.CognitiveServices/accounts/BatchAvatar/*",
|                                                             "Microsoft.CognitiveServices/accounts/BatchTextToSpeech/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9894cab4-e18a-44aa-828b-cb588cd6f2d7",
|                                         "Name":  "Cognitive Services Face Recognizer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Perform inferencing operations only; no identity or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/Face/detect/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/verify/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/identify/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/group/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/findsimilars/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/detectliveness/multimodal/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/detectliveness/singlemodal/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/detectlivenesswithverify/singlemodal/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/*/sessions/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/*/sessions/delete",
|                                                             "Microsoft.CognitiveServices/accounts/Face/*/sessions/read",
|                                                             "Microsoft.CognitiveServices/accounts/Face/*/sessions/audit/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1ec5b3c1-b17e-4e25-8312-2acb3c3c5abf",
|                                         "Name":  "Stream Analytics Query Tester",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Perform query testing without creating jobs or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.StreamAnalytics/locations/TestQuery/action",
|                                                         "Microsoft.StreamAnalytics/locations/OperationResults/read",
|                                                         "Microsoft.StreamAnalytics/locations/SampleInput/action",
|                                                         "Microsoft.StreamAnalytics/locations/CompileQuery/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a2138dac-4907-4679-a376-736901ed8ad8",
|                                         "Name":  "AnyBuild Builder",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Basic user role for build execution; no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AnyBuild/clusters/build/write",
|                                                             "Microsoft.AnyBuild/clusters/build/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b447c946-2db7-41ec-983d-d8bf3b1c77e3",
|                                         "Name":  "IoT Hub Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to IoT Hub data plane; no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Devices/IotHubs/*/read",
|                                                             "Microsoft.Devices/IotHubs/fileUpload/notifications/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "494bdba2-168f-4f31-a0a1-191d2f7c028c",
|                                         "Name":  "IoT Hub Twin Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to device twins without identity or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Devices/IotHubs/twins/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4ea46cd5-c1b2-4a8e-910b-273211f9ce47",
|                                         "Name":  "IoT Hub Registry Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to device registry without identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Devices/IotHubs/devices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4fc6c259-987e-4a07-842e-c321cc9d413f",
|                                         "Name":  "IoT Hub Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full data plane access without identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Devices/IotHubs/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "15e0f5a1-3450-4248-8e25-e2afe88a9e85",
|                                         "Name":  "Test Base Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "View and download test packages; no identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.TestBase/testBaseAccounts/packages/testResults/getDownloadUrl/action",
|                                                         "Microsoft.TestBase/testBaseAccounts/packages/testResults/getVideoDownloadUrl/action",
|                                                         "Microsoft.TestBase/testBaseAccounts/packages/getDownloadUrl/action",
|                                                         "Microsoft.TestBase/*/read",
|                                                         "Microsoft.TestBase/testBaseAccounts/customerEvents/write",
|                                                         "Microsoft.TestBase/testBaseAccounts/customerEvents/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1407120a-92aa-4202-b7e9-c0e197c71c8f",
|                                         "Name":  "Search Index Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to search index data; no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Search/searchServices/indexes/documents/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8ebe5a00-799e-43f5-93ac-243d3dce84a7",
|                                         "Name":  "Search Index Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to search index data without identity or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Search/searchServices/indexes/documents/*",
|                                                             "Microsoft.Search/searchServices/indexes/contentSecurity/elevatedOperations/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "76199698-9eea-4c19-bc75-cec21354c6b6",
|                                         "Name":  "Storage Table Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to storage tables; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/tableServices/tables/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/tableServices/tables/entities/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3",
|                                         "Name":  "Storage Table Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read, write, delete storage tables without identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/tableServices/tables/read",
|                                                         "Microsoft.Storage/storageAccounts/tableServices/tables/write",
|                                                         "Microsoft.Storage/storageAccounts/tableServices/tables/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/tableServices/tables/entities/read",
|                                                             "Microsoft.Storage/storageAccounts/tableServices/tables/entities/write",
|                                                             "Microsoft.Storage/storageAccounts/tableServices/tables/entities/delete",
|                                                             "Microsoft.Storage/storageAccounts/tableServices/tables/entities/add/action",
|                                                             "Microsoft.Storage/storageAccounts/tableServices/tables/entities/update/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e89c7a3c-2f64-4fa1-a847-3e4c9ba4283a",
|                                         "Name":  "DICOM Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and search DICOM data; no identity or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/workspaces/dicomservices/resources/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "58a3b984-7adf-4c20-983a-32417c86fbc8",
|                                         "Name":  "DICOM Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to DICOM data without identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/workspaces/dicomservices/resources/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d5a91429-5739-47e2-a06b-3470a27159e7",
|                                         "Name":  "EventGrid Data Sender",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Send access to EventGrid events; no identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/topics/read",
|                                                         "Microsoft.EventGrid/domains/read",
|                                                         "Microsoft.EventGrid/partnerNamespaces/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.EventGrid/namespaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventGrid/events/send/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "60fc6e62-5479-42d4-8bf4-67625fcc2840",
|                                         "Name":  "Disk Pool Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage disks in disk pool without identity or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f6c7c914-8db3-469d-8ca1-694a8f32e121",
|                                         "Name":  "AzureML Data Scientist",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage ML workspace resources except compute and workspace settings; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/*/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/*/action",
|                                                         "Microsoft.MachineLearningServices/workspaces/*/delete",
|                                                         "Microsoft.MachineLearningServices/workspaces/*/write"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.MachineLearningServices/workspaces/delete",
|                                                            "Microsoft.MachineLearningServices/workspaces/write",
|                                                            "Microsoft.MachineLearningServices/workspaces/computes/*/write",
|                                                            "Microsoft.MachineLearningServices/workspaces/computes/*/delete",
|                                                            "Microsoft.MachineLearningServices/workspaces/computes/listKeys/action",
|                                                            "Microsoft.MachineLearningServices/workspaces/listKeys/action",
|                                                            "Microsoft.MachineLearningServices/workspaces/hubs/write",
|                                                            "Microsoft.MachineLearningServices/workspaces/hubs/delete",
|                                                            "Microsoft.MachineLearningServices/workspaces/featurestores/write",
|                                                            "Microsoft.MachineLearningServices/workspaces/featurestores/delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "22926164-76b3-42b3-bc55-97df8dab3e41",
|                                         "Name":  "Grafana Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Grafana server settings and access; no Azure identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Dashboard/grafana/ActAsGrafanaAdmin/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e8113dce-c529-4d33-91fa-e9b972617508",
|                                         "Name":  "Azure Connected SQL Server Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to Azure Arc SQL Server instances; no identity or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureArcData/sqlServerInstances/read",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "26baccc8-eea7-41f1-98f4-1762cc7f685d",
|                                         "Name":  "Azure Relay Sender",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Send access to Azure Relay resources does not provide any identity plane control or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Relay/*/wcfRelays/read",
|                                                         "Microsoft.Relay/*/hybridConnections/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Relay/*/send/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2787bf04-f1f5-4bfe-8383-c8a24483ee38",
|                                         "Name":  "Azure Relay Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Azure Relay resources is limited to data plane and resource management, no direct identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Relay/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Relay/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "26e0b698-aa6d-4085-9386-aadae190014d",
|                                         "Name":  "Azure Relay Listener",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Listen access to Azure Relay resources is read-only and does not enable identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Relay/*/wcfRelays/read",
|                                                         "Microsoft.Relay/*/hybridConnections/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Relay/*/listen/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "60921a7e-fef1-4a43-9b16-a26c52ad4769",
|                                         "Name":  "Grafana Viewer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "View-only access to dashboards and data sources with no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Dashboard/grafana/ActAsGrafanaViewer/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a79a5197-3a5c-4973-a920-486035ffd60f",
|                                         "Name":  "Grafana Editor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and edit dashboards but lacks permissions to affect identity or role assignments.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Dashboard/grafana/ActAsGrafanaEditor/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f353d9bd-d4a6-484e-a77a-8050b599b867",
|                                         "Name":  "Automation Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages automation resources but lacks permissions to assign roles or modify identity plane settings.",
|                                         "Actions":  [
|                                                         "Microsoft.Automation/automationAccounts/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/ActionGroups/*",
|                                                         "Microsoft.Insights/ActivityLogAlerts/*",
|                                                         "Microsoft.Insights/MetricAlerts/*",
|                                                         "Microsoft.Insights/ScheduledQueryRules/*",
|                                                         "Microsoft.Insights/diagnosticSettings/*",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "85cb6faf-e071-4c9b-8136-154b5a04f717",
|                                         "Name":  "Kubernetes Extension Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage Kubernetes extensions but no permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.KubernetesConfiguration/register/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "10745317-c249-44a1-a5ce-3a4353c0bbd8",
|                                         "Name":  "Device Provisioning Service Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to device provisioning data with no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Devices/provisioningServices/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dfce44e4-17b7-4bd1-a6d1-04996ec95633",
|                                         "Name":  "Device Provisioning Service Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full data-plane operations on device provisioning service but no identity or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Devices/provisioningServices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2837e146-70d7-4cfd-ad55-7efa6464f958",
|                                         "Name":  "Artifact Signing Certificate Profile Signer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can sign files but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.CodeSigning/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CodeSigning/certificateProfiles/Sign/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cff1b556-2399-4e7e-856d-a8f754be7b65",
|                                         "Name":  "Azure Spring Cloud Service Registry Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to service registry with no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/eurekaService/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f5880b48-c26d-48be-b172-7927bfa1c8f1",
|                                         "Name":  "Azure Spring Cloud Service Registry Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write/delete access to service registry but no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/eurekaService/read",
|                                                             "Microsoft.AppPlatform/Spring/eurekaService/write",
|                                                             "Microsoft.AppPlatform/Spring/eurekaService/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d04c6db6-4947-4782-9e91-30a88feb7be7",
|                                         "Name":  "Azure Spring Cloud Config Server Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to config server with no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/configService/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a06f5c24-21a7-4e1a-aa2b-f19eb6684f5b",
|                                         "Name":  "Azure Spring Cloud Config Server Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write/delete access to config server but no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/configService/read",
|                                                             "Microsoft.AppPlatform/Spring/configService/write",
|                                                             "Microsoft.AppPlatform/Spring/configService/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6ae96244-5829-4925-a7d3-5975537d91dd",
|                                         "Name":  "Azure VM Managed identities restore Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only authorization permissions without ability to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6be48352-4f82-47c9-ad5e-0acacefdb005",
|                                         "Name":  "Azure Maps Search and Render Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Limited data API access with no identity or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Maps/accounts/services/render/read",
|                                                             "Microsoft.Maps/accounts/services/search/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dba33070-676a-4fb0-87fa-064dc56ff7fb",
|                                         "Name":  "Azure Maps Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Resource management permissions without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Maps/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b748a06d-6150-4f8a-aaa9-ce3940cd96cb",
|                                         "Name":  "Azure Arc VMware VM Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full VM actions but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ConnectedVMwarevSphere/virtualmachines/*",
|                                                         "Microsoft.ConnectedVMwarevSphere/virtualmachineinstances/*",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                         "Microsoft.HybridCompute/machines/installPatches/action",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                         "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/write",
|                                                         "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                         "Microsoft.HybridCompute/licenses/read",
|                                                         "Microsoft.HybridCompute/licenses/write",
|                                                         "Microsoft.HybridCompute/licenses/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ce551c02-7c42-47e0-9deb-e3b6fc3a9a83",
|                                         "Name":  "Azure Arc VMware Private Cloud User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions to deploy VMs but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ConnectedVMwarevSphere/virtualnetworks/join/action",
|                                                         "Microsoft.ConnectedVMwarevSphere/virtualnetworks/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/virtualmachinetemplates/clone/action",
|                                                         "Microsoft.ConnectedVMwarevSphere/virtualmachinetemplates/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/resourcepools/deploy/action",
|                                                         "Microsoft.ConnectedVMwarevSphere/resourcepools/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/hosts/deploy/action",
|                                                         "Microsoft.ConnectedVMwarevSphere/hosts/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/clusters/deploy/action",
|                                                         "Microsoft.ConnectedVMwarevSphere/clusters/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/datastores/allocateSpace/action",
|                                                         "Microsoft.ConnectedVMwarevSphere/datastores/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ddc140ed-e463-4246-9145-7c664192013f",
|                                         "Name":  "Azure Arc VMware Administrator role ",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full VMwarevSphere actions but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ConnectedVMwarevSphere/*",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                         "Microsoft.HybridCompute/machines/installPatches/action",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                         "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/write",
|                                                         "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                         "Microsoft.HybridCompute/licenses/read",
|                                                         "Microsoft.HybridCompute/licenses/write",
|                                                         "Microsoft.HybridCompute/licenses/delete",
|                                                         "Microsoft.ExtendedLocation/customLocations/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f72c8140-2111-481c-87ff-72b910f6e3f8",
|                                         "Name":  "Cognitive Services LUIS Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to LUIS functions but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/LUIS/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7628b7b8-a8b2-4cdc-b46f-e9b35248918e",
|                                         "Name":  "Cognitive Services Language Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and test functions only, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/LanguageAuthoring/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/projects/export/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/Language/*/projects/export/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/query-text/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/query-dataverse/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/analyze-text/jobs/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/analyze-text/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/analyze-text/jobscancel/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/analyze-conversations/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/analyze-conversations/jobscancel/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/analyze-conversations/jobs/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/query-knowledgebases/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/generate/action",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f2310ca1-dc64-4889-bb49-c8e0fa3d47a8",
|                                         "Name":  "Cognitive Services Language Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write functions without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/LanguageAuthoring/*",
|                                                             "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/*",
|                                                             "Microsoft.CognitiveServices/accounts/Language/*",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f07febfe-79bc-46b1-8b37-790e26e6e498",
|                                         "Name":  "Cognitive Services Language Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full Language portal access but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/LanguageAuthoring/*",
|                                                             "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/*",
|                                                             "Microsoft.CognitiveServices/accounts/Language/*",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "18e81cdc-4e98-4e29-a639-e7d10c5a6226",
|                                         "Name":  "Cognitive Services LUIS Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and test functions only, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/LUIS/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/LUIS/apps/testdatasets/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6322a993-d5c9-4bed-b113-e49bbea25b27",
|                                         "Name":  "Cognitive Services LUIS Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write functions without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/LUIS/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a9a19cc5-31f4-447c-901f-56c0bb18fcaf",
|                                         "Name":  "PlayFab Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to PlayFab resources with no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.PlayFab/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "749a398d-560b-491b-bb21-08924219302e",
|                                         "Name":  "Load Test Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage load tests but lacks permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.LoadTestService/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.LoadTestService/PlaywrightWorkspaces/*",
|                                                            "Microsoft.LoadTestService/locations/PlaywrightQuotas/*"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.LoadTestService/loadtests/*",
|                                                             "Microsoft.LoadTestService/testProfiles/*",
|                                                             "Microsoft.LoadTestService/testProfileRuns/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "45bb0b16-2f0c-4e78-afaa-a07599b003f6",
|                                         "Name":  "Load Test Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full load test resource control but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.LoadTestService/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.LoadTestService/PlaywrightWorkspaces/*",
|                                                            "Microsoft.LoadTestService/locations/PlaywrightQuotas/*"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.LoadTestService/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0c8b84dc-067c-4039-9615-fa1a4b77c726",
|                                         "Name":  "PlayFab Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor access to PlayFab resources without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.PlayFab/*/read",
|                                                         "Microsoft.PlayFab/*/write",
|                                                         "Microsoft.PlayFab/*/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3ae3fb29-0000-4ccd-bf80-542e7b26e081",
|                                         "Name":  "Load Test Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to load test resources with no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.LoadTestService/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.LoadTestService/PlaywrightWorkspaces/*",
|                                                            "Microsoft.LoadTestService/locations/PlaywrightQuotas/*"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.LoadTestService/loadtests/readTest/action",
|                                                             "Microsoft.LoadTestService/testProfiles/read",
|                                                             "Microsoft.LoadTestService/testProfileRuns/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b2de6794-95db-4659-8781-7e080d3f2b9d",
|                                         "Name":  "Cognitive Services Immersive Reader User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to create sessions and call APIs without identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/ImmersiveReader/getcontentmodelforreader/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f69b8690-cc87-41d6-b77a-a4bc3c0a966f",
|                                         "Name":  "Lab Services Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage lab services but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.LabServices/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.LabServices/labPlans/createLab/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2a5c394f-5eb7-4d4f-9c8e-e8eae39faebc",
|                                         "Name":  "Lab Services Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to lab services with no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.LabServices/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ce40b423-cede-4313-a93f-9b28290b72e1",
|                                         "Name":  "Lab Assistant",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only and invite actions without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.LabServices/labPlans/images/read",
|                                                         "Microsoft.LabServices/labPlans/read",
|                                                         "Microsoft.LabServices/labs/read",
|                                                         "Microsoft.LabServices/labs/schedules/read",
|                                                         "Microsoft.LabServices/labs/users/read",
|                                                         "Microsoft.LabServices/labs/users/invite/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/read",
|                                                         "Microsoft.LabServices/labs/virtualMachines/start/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/stop/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/reimage/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/redeploy/action",
|                                                         "Microsoft.LabServices/locations/usages/read",
|                                                         "Microsoft.LabServices/skus/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a36e6959-b6be-4b12-8e9f-ef4b474d304d",
|                                         "Name":  "Lab Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can publish and save images but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.LabServices/labPlans/images/read",
|                                                         "Microsoft.LabServices/labPlans/read",
|                                                         "Microsoft.LabServices/labPlans/saveImage/action",
|                                                         "Microsoft.LabServices/labs/publish/action",
|                                                         "Microsoft.LabServices/labs/read",
|                                                         "Microsoft.LabServices/labs/schedules/read",
|                                                         "Microsoft.LabServices/labs/schedules/write",
|                                                         "Microsoft.LabServices/labs/schedules/delete",
|                                                         "Microsoft.LabServices/labs/users/read",
|                                                         "Microsoft.LabServices/labs/users/write",
|                                                         "Microsoft.LabServices/labs/users/delete",
|                                                         "Microsoft.LabServices/labs/users/invite/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/read",
|                                                         "Microsoft.LabServices/labs/virtualMachines/start/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/stop/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/reimage/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/redeploy/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/resetPassword/action",
|                                                         "Microsoft.LabServices/locations/usages/read",
|                                                         "Microsoft.LabServices/skus/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5daaa2af-1fe8-407c-9122-bba179798270",
|                                         "Name":  "Lab Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Write and delete lab resources but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.LabServices/labPlans/images/read",
|                                                         "Microsoft.LabServices/labPlans/read",
|                                                         "Microsoft.LabServices/labPlans/saveImage/action",
|                                                         "Microsoft.LabServices/labs/read",
|                                                         "Microsoft.LabServices/labs/write",
|                                                         "Microsoft.LabServices/labs/delete",
|                                                         "Microsoft.LabServices/labs/publish/action",
|                                                         "Microsoft.LabServices/labs/syncGroup/action",
|                                                         "Microsoft.LabServices/labs/schedules/read",
|                                                         "Microsoft.LabServices/labs/schedules/write",
|                                                         "Microsoft.LabServices/labs/schedules/delete",
|                                                         "Microsoft.LabServices/labs/users/read",
|                                                         "Microsoft.LabServices/labs/users/write",
|                                                         "Microsoft.LabServices/labs/users/delete",
|                                                         "Microsoft.LabServices/labs/users/invite/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/read",
|                                                         "Microsoft.LabServices/labs/virtualMachines/start/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/stop/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/reimage/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/redeploy/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/resetPassword/action",
|                                                         "Microsoft.LabServices/locations/usages/read",
|                                                         "Microsoft.LabServices/skus/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.LabServices/labPlans/createLab/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "12cf5a90-567b-43ae-8102-96cf46c7d9b4",
|                                         "Name":  "Web PubSub Service Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Web PubSub APIs but no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SignalRService/WebPubSub/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bfb1c7d2-fb1a-466b-b2ba-aee63b92deaf",
|                                         "Name":  "Web PubSub Service Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Web PubSub APIs with no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SignalRService/WebPubSub/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "420fcaa2-552c-430f-98ca-3264be4806c7",
|                                         "Name":  "SignalR App Server",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "App server access with AAD auth options but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SignalRService/SignalR/auth/accessKey/action",
|                                                             "Microsoft.SignalRService/SignalR/serverConnection/write",
|                                                             "Microsoft.SignalRService/SignalR/clientConnection/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fb879df8-f326-4884-b1cf-06f3ad86be52",
|                                         "Name":  "Virtual Machine User Login",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can view and login as regular user but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Compute/virtualMachines/*/read",
|                                                         "Microsoft.HybridCompute/machines/*/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Compute/virtualMachines/login/action",
|                                                             "Microsoft.HybridCompute/machines/login/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1c0163c0-47e6-4577-8991-ea5c82e286e4",
|                                         "Name":  "Virtual Machine Administrator Login",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can login as administrator but lacks permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Compute/virtualMachines/*/read",
|                                                         "Microsoft.HybridCompute/machines/*/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Compute/virtualMachines/login/action",
|                                                             "Microsoft.Compute/virtualMachines/loginAsAdmin/action",
|                                                             "Microsoft.HybridCompute/machines/login/action",
|                                                             "Microsoft.HybridCompute/machines/loginAsAdmin/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cd570a14-e51a-42ad-bac8-bafd67325302",
|                                         "Name":  "Azure Connected Machine Resource Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage connected machines but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/machines/*",
|                                                         "Microsoft.HybridCompute/machines/extensions/*",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/*",
|                                                         "Microsoft.HybridCompute/machines/runCommands/*",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/settings/*",
|                                                         "Microsoft.HybridCompute/gateways/*",
|                                                         "Microsoft.HybridCompute/privateLinkScopes/*",
|                                                         "Microsoft.HybridCompute/licenses/*",
|                                                         "Microsoft.HybridCompute/locations/*",
|                                                         "Microsoft.HybridCompute/*/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e8ddcd69-c73f-4f9f-9844-4100522f16ad",
|                                         "Name":  "Workbook Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can save workbooks but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/workbooks/write",
|                                                         "Microsoft.Insights/workbooks/delete",
|                                                         "Microsoft.Insights/workbooks/read",
|                                                         "Microsoft.Insights/workbooks/revisions/read",
|                                                         "Microsoft.Insights/workbooktemplates/write",
|                                                         "Microsoft.Insights/workbooktemplates/delete",
|                                                         "Microsoft.Insights/workbooktemplates/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b279062a-9be3-42a0-92ae-8b3cf002ec4d",
|                                         "Name":  "Workbook Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to workbooks with no identity plane control.",
|                                         "Actions":  [
|                                                         "microsoft.insights/workbooks/read",
|                                                         "microsoft.insights/workbooks/revisions/read",
|                                                         "microsoft.insights/workbooktemplates/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "749f88d5-cbae-40b8-bcfc-e573ddc772fa",
|                                         "Name":  "Monitoring Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and update monitoring settings but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.AlertsManagement/alerts/*",
|                                                         "Microsoft.AlertsManagement/alertsSummary/*",
|                                                         "Microsoft.AlertsManagement/issues/*",
|                                                         "Microsoft.Insights/actiongroups/*",
|                                                         "Microsoft.Insights/activityLogAlerts/*",
|                                                         "Microsoft.Insights/AlertRules/*",
|                                                         "Microsoft.Insights/components/*",
|                                                         "Microsoft.Insights/createNotifications/*",
|                                                         "Microsoft.Insights/dataCollectionEndpoints/*",
|                                                         "Microsoft.Insights/dataCollectionRules/*",
|                                                         "Microsoft.Insights/dataCollectionRuleAssociations/*",
|                                                         "Microsoft.Insights/DiagnosticSettings/*",
|                                                         "Microsoft.Insights/eventtypes/*",
|                                                         "Microsoft.Insights/LogDefinitions/*",
|                                                         "Microsoft.Insights/metricalerts/*",
|                                                         "Microsoft.Insights/MetricDefinitions/*",
|                                                         "Microsoft.Insights/Metrics/*",
|                                                         "Microsoft.Insights/notificationStatus/*",
|                                                         "Microsoft.Insights/Register/Action",
|                                                         "Microsoft.Insights/scheduledqueryrules/*",
|                                                         "Microsoft.Insights/webtests/*",
|                                                         "Microsoft.Insights/workbooks/*",
|                                                         "Microsoft.Insights/workbooktemplates/*",
|                                                         "Microsoft.Insights/privateLinkScopes/*",
|                                                         "Microsoft.Insights/privateLinkScopeOperationStatuses/*",
|                                                         "Microsoft.Monitor/accounts/*",
|                                                         "Microsoft.Monitor/settings/*",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.OperationalInsights/workspaces/intelligencepacks/*",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                         "Microsoft.OperationalInsights/workspaces/search/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/read",
|                                                         "Microsoft.OperationalInsights/workspaces/storageinsightconfigs/*",
|                                                         "Microsoft.OperationalInsights/locations/workspaces/failover/action",
|                                                         "Microsoft.OperationalInsights/workspaces/failback/action",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.AlertsManagement/smartDetectorAlertRules/*",
|                                                         "Microsoft.AlertsManagement/actionRules/*",
|                                                         "Microsoft.AlertsManagement/smartGroups/*",
|                                                         "Microsoft.AlertsManagement/migrateFromSmartDetection/*",
|                                                         "Microsoft.AlertsManagement/investigations/*",
|                                                         "Microsoft.AlertsManagement/prometheusRuleGroups/*",
|                                                         "Microsoft.Monitor/investigations/*",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3913510d-42f4-4e42-8a64-420c390055eb",
|                                         "Name":  "Monitoring Metrics Publisher",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can publish metrics but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/Register/Action",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Insights/Metrics/Write",
|                                                             "Microsoft.Insights/Telemetry/Write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8a3c2885-9b38-4fd2-9d99-91af537c1347",
|                                         "Name":  "Purview role 1 (Deprecated)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Purview accounts with no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Purview/accounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Purview/accounts/data/read",
|                                                             "Microsoft.Purview/accounts/data/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "200bba9e-f0c8-430f-892b-6f0794863803",
|                                         "Name":  "Purview role 2 (Deprecated)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Purview accounts; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Purview/accounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Purview/accounts/scan/read",
|                                                             "Microsoft.Purview/accounts/scan/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ff100721-1b9d-43d8-af52-42b69c1272db",
|                                         "Name":  "Purview role 3 (Deprecated)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Purview accounts; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Purview/accounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Purview/accounts/data/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b8b15564-4fa6-4a59-ab12-03e1d9594795",
|                                         "Name":  "Autonomous Development Platform Data Contributor (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to platform data and resource groups; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.AutonomousDevelopmentPlatform/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/discoveries/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/uploads/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/measurements/states/new/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/measurementCollections/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/accounts/measurementCollections/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/workspaces/read",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/workspaces/discoveries/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/workspaces/uploads/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurements/states/new/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurements/classifications/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurements/dataStreams/classifications/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurementCollections/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "27f8b550-c507-4db9-86f2-f4b8e816d59d",
|                                         "Name":  "Autonomous Development Platform Data Owner (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to platform data but no identity or role assignment permissions; no direct path to tenant takeover.",
|                                         "Actions":  [
|                                                         "Microsoft.AutonomousDevelopmentPlatform/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AutonomousDevelopmentPlatform/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d63b75f7-47ea-4f27-92ac-e0d173aaf093",
|                                         "Name":  "Autonomous Development Platform Data Reader (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to platform data; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AutonomousDevelopmentPlatform/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AutonomousDevelopmentPlatform/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "49e2f5d2-7741-4835-8efa-19e1fe35e47f",
|                                         "Name":  "Device Update Deployments Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to device update management operations; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.DeviceUpdate/accounts/read",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/read",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e4237640-0e3d-4a46-8fda-70bc94856432",
|                                         "Name":  "Device Update Deployments Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to device update management but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.DeviceUpdate/accounts/read",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/read",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/write",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/delete",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "67d33e57-3129-45e6-bb0b-7cc522f762fa",
|                                         "Name":  "Azure Arc VMware Private Clouds Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions to provision resources for vCenter onboarding; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ConnectedVMwarevSphere/vcenters/Write",
|                                                         "Microsoft.ConnectedVMwarevSphere/vcenters/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/vcenters/Delete",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/Write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/Read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/Delete",
|                                                         "Microsoft.KubernetesConfiguration/operations/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/Write",
|                                                         "Microsoft.ExtendedLocation/customLocations/Delete",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ResourceConnector/appliances/Read",
|                                                         "Microsoft.ResourceConnector/appliances/Write",
|                                                         "Microsoft.ResourceConnector/appliances/Delete",
|                                                         "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                         "Microsoft.BackupSolutions/vmwareapplications/write",
|                                                         "Microsoft.BackupSolutions/vmwareapplications/delete",
|                                                         "Microsoft.BackupSolutions/vmwareapplications/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f4c81013-99ee-4d62-a7ee-b3f1f648599a",
|                                         "Name":  "Microsoft Sentinel Automation Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to workflows and triggers; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Logic/workflows/triggers/read",
|                                                         "Microsoft.Logic/workflows/triggers/listCallbackUrl/action",
|                                                         "Microsoft.Logic/workflows/runs/read",
|                                                         "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/triggers/read",
|                                                         "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/triggers/listCallbackUrl/action",
|                                                         "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/runs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "871e35f6-b5c1-49cc-a043-bde969a0f2cd",
|                                         "Name":  "CDN Endpoint Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to CDN endpoints; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cdn/edgenodes/read",
|                                                         "Microsoft.Cdn/operationresults/*",
|                                                         "Microsoft.Cdn/profiles/endpoints/*/read",
|                                                         "Microsoft.Cdn/profiles/afdendpoints/validateCustomDomain/action",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f2dc8367-1007-4938-bd23-fe263f013447",
|                                         "Name":  "Cognitive Services Speech User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to speech services and role definitions; no write or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/read",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/write",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/delete",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/action",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*/frontend/action",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/text-dependent/*/action",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/text-independent/*/action",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/voiceagent/realtime/*",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/voicelive/realtime/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVoice/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVoice/evaluations/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVoice/longaudiosynthesis/*",
|                                                             "Microsoft.CognitiveServices/accounts/AudioContentCreation/*",
|                                                             "Microsoft.CognitiveServices/accounts/TTSPlayer/*",
|                                                             "Microsoft.CognitiveServices/accounts/VideoTranslation/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomAvatar/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/BatchAvatar/*",
|                                                             "Microsoft.CognitiveServices/accounts/BatchTextToSpeech/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a6333a3e-0164-44c3-b281-7a577aff287f",
|                                         "Name":  "Windows Admin Center Administrator Login",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage OS of resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/machines/*/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/*",
|                                                         "Microsoft.HybridCompute/machines/upgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
|                                                         "Microsoft.Network/networkWatchers/securityGroupView/action",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/write",
|                                                         "Microsoft.HybridConnectivity/endpoints/write",
|                                                         "Microsoft.HybridConnectivity/endpoints/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/write",
|                                                         "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/listManagedProxyDetails/action",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/patchAssessmentResults/latest/read",
|                                                         "Microsoft.Compute/virtualMachines/patchAssessmentResults/latest/softwarePatches/read",
|                                                         "Microsoft.Compute/virtualMachines/patchInstallationResults/read",
|                                                         "Microsoft.Compute/virtualMachines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                         "Microsoft.Compute/virtualMachines/runCommands/read",
|                                                         "Microsoft.Compute/virtualMachines/vmSizes/read",
|                                                         "Microsoft.Compute/locations/publishers/artifacttypes/types/read",
|                                                         "Microsoft.Compute/locations/publishers/artifacttypes/types/versions/read",
|                                                         "Microsoft.Compute/diskAccesses/read",
|                                                         "Microsoft.Compute/galleries/images/read",
|                                                         "Microsoft.Compute/images/read",
|                                                         "Microsoft.AzureStackHCI/Clusters/Read",
|                                                         "Microsoft.AzureStackHCI/Clusters/ArcSettings/Read",
|                                                         "Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Read",
|                                                         "Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Write",
|                                                         "Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Delete",
|                                                         "Microsoft.AzureStackHCI/Operations/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/VirtualMachines/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/VirtualMachines/Extensions/Write",
|                                                         "Microsoft.ConnectedVMwarevSphere/VirtualMachines/Extensions/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HybridCompute/machines/WACLoginAsAdmin/action",
|                                                             "Microsoft.Compute/virtualMachines/WACloginAsAdmin/action",
|                                                             "Microsoft.AzureStackHCI/Clusters/WACloginAsAdmin/Action",
|                                                             "Microsoft.ConnectedVMwarevSphere/virtualmachines/WACloginAsAdmin/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "18ed5180-3e48-46fd-8541-4ea054d57064",
|                                         "Name":  "Azure Kubernetes Service Policy Add-on Deployment",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Deploy policy add-on and modify network resources; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/publicIPPrefixes/join/action",
|                                                         "Microsoft.Network/publicIPAddresses/join/action",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Compute/proximityPlacementGroups/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "088ab73d-1256-47ae-bea9-9de8e7131f31",
|                                         "Name":  "Guest Configuration Resource Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write guest configuration assignments; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/write",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/*/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "361898ef-9ed1-48c2-849c-a832951106bb",
|                                         "Name":  "Domain Services Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Azure AD Domain Services and related configurations; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Insights/Logs/Read",
|                                                         "Microsoft.Insights/Metrics/read",
|                                                         "Microsoft.Insights/DiagnosticSettings/read",
|                                                         "Microsoft.Insights/DiagnosticSettingsCategories/Read",
|                                                         "Microsoft.AAD/domainServices/*/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                         "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                         "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/azureFirewalls/read",
|                                                         "Microsoft.Network/ddosProtectionPlans/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/*/read",
|                                                         "Microsoft.Network/natGateways/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                         "Microsoft.Network/routeTables/read",
|                                                         "Microsoft.Network/routeTables/routes/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "eeaeda52-9324-47f6-8069-5d5bade478b2",
|                                         "Name":  "Domain Services Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Azure AD Domain Services resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Insights/Logs/Read",
|                                                         "Microsoft.Insights/Metrics/Read",
|                                                         "Microsoft.Insights/DiagnosticSettings/*",
|                                                         "Microsoft.Insights/DiagnosticSettingsCategories/Read",
|                                                         "Microsoft.AAD/register/action",
|                                                         "Microsoft.AAD/unregister/action",
|                                                         "Microsoft.AAD/domainServices/*",
|                                                         "Microsoft.Network/register/action",
|                                                         "Microsoft.Network/unregister/action",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/write",
|                                                         "Microsoft.Network/virtualNetworks/delete",
|                                                         "Microsoft.Network/virtualNetworks/peer/action",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/delete",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
|                                                         "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                         "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/azureFirewalls/read",
|                                                         "Microsoft.Network/ddosProtectionPlans/read",
|                                                         "Microsoft.Network/ddosProtectionPlans/join/action",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/delete",
|                                                         "Microsoft.Network/loadBalancers/*/read",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/write",
|                                                         "Microsoft.Network/networkSecurityGroups/delete",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/write",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/delete",
|                                                         "Microsoft.Network/routeTables/read",
|                                                         "Microsoft.Network/routeTables/write",
|                                                         "Microsoft.Network/routeTables/delete",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/routeTables/routes/read",
|                                                         "Microsoft.Network/routeTables/routes/write",
|                                                         "Microsoft.Network/routeTables/routes/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d",
|                                         "Name":  "DNS Resolver Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage DNS resolver resources; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/dnsResolvers/read",
|                                                         "Microsoft.Network/dnsResolvers/write",
|                                                         "Microsoft.Network/dnsResolvers/delete",
|                                                         "Microsoft.Network/dnsResolvers/join/action",
|                                                         "Microsoft.Network/dnsResolvers/inboundEndpoints/read",
|                                                         "Microsoft.Network/dnsResolvers/inboundEndpoints/write",
|                                                         "Microsoft.Network/dnsResolvers/inboundEndpoints/delete",
|                                                         "Microsoft.Network/dnsResolvers/inboundEndpoints/join/action",
|                                                         "Microsoft.Network/dnsResolvers/outboundEndpoints/read",
|                                                         "Microsoft.Network/dnsResolvers/outboundEndpoints/write",
|                                                         "Microsoft.Network/dnsResolvers/outboundEndpoints/delete",
|                                                         "Microsoft.Network/dnsResolvers/outboundEndpoints/join/action",
|                                                         "Microsoft.Network/dnsForwardingRulesets/read",
|                                                         "Microsoft.Network/dnsForwardingRulesets/write",
|                                                         "Microsoft.Network/dnsForwardingRulesets/delete",
|                                                         "Microsoft.Network/dnsForwardingRulesets/join/action",
|                                                         "Microsoft.Network/dnsForwardingRulesets/forwardingRules/read",
|                                                         "Microsoft.Network/dnsForwardingRulesets/forwardingRules/write",
|                                                         "Microsoft.Network/dnsForwardingRulesets/forwardingRules/delete",
|                                                         "Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks/read",
|                                                         "Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks/write",
|                                                         "Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks/delete",
|                                                         "Microsoft.Network/locations/dnsResolverOperationResults/read",
|                                                         "Microsoft.Network/locations/dnsResolverOperationStatuses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/virtualNetworks/joinLoadBalancer/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinLoadBalancer/action",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "00493d72-78f6-4148-b6c5-d3ce8e4799dd",
|                                         "Name":  "Azure Arc Enabled Kubernetes Cluster User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "List cluster user credentials and read resources; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "959f8984-c045-4866-89c7-12bf9737be2e",
|                                         "Name":  "Data Operator for Managed Disks",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Upload and read data on managed disks; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Compute/disks/download/action",
|                                                             "Microsoft.Compute/disks/upload/action",
|                                                             "Microsoft.Compute/snapshots/download/action",
|                                                             "Microsoft.Compute/snapshots/upload/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6b77f0a0-0d89-41cc-acd1-579c22c17a67",
|                                         "Name":  "AgFood Platform Sensor Partner Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contribute access to sensor entities; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/sensorPartnerScope/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1ef6a3be-d0ac-425d-8c01-acb62866290b",
|                                         "Name":  "Compute Gallery Sharing Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can share compute galleries but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/galleries/share/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cd08ab90-6b14-449c-ad9a-8f8e549482c6",
|                                         "Name":  "Scheduled Patching Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage maintenance configurations; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Maintenance/maintenanceConfigurations/read",
|                                                         "Microsoft.Maintenance/maintenanceConfigurations/write",
|                                                         "Microsoft.Maintenance/maintenanceConfigurations/delete",
|                                                         "Microsoft.Maintenance/configurationAssignments/read",
|                                                         "Microsoft.Maintenance/configurationAssignments/write",
|                                                         "Microsoft.Maintenance/configurationAssignments/delete",
|                                                         "Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/read",
|                                                         "Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/write",
|                                                         "Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/delete",
|                                                         "Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/read",
|                                                         "Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/write",
|                                                         "Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/delete",
|                                                         "Microsoft.Maintenance/applyUpdates/read",
|                                                         "Microsoft.Maintenance/updates/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "45d50f46-0b78-4001-a660-4198cbe8cd05",
|                                         "Name":  "DevCenter Dev Box User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage dev boxes with read access to projects; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DevCenter/projects/read",
|                                                         "Microsoft.DevCenter/projects/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userStop/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userStart/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userGetRemoteConnection/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userRead/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userWrite/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userDelete/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userUpcomingActionRead/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userUpcomingActionManage/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userActionRead/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userActionManage/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userCustomize/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "331c37c6-af14-46d9-b9f4-e1909e1b95a0",
|                                         "Name":  "DevCenter Project Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage project resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.DevCenter/projects/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.DevCenter/projects/write",
|                                                            "Microsoft.DevCenter/projects/delete"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminStart/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminStop/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminRead/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminWrite/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminDelete/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminAlign/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminActionRead/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminActionManage/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userStop/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userStart/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userGetRemoteConnection/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userRead/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userWrite/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userDelete/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userActionRead/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userActionManage/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userCustomize/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminRead/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/userWrite/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminWrite/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/userDelete/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminDelete/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminAction/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminActionRead/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminActionManage/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminOutputsRead/action",
|                                                             "Microsoft.DevCenter/projects/pools/align/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "602da2ba-a5c2-41da-b01d-5360126ab525",
|                                         "Name":  "Virtual Machine Local User Login",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Login as local user on VMs; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/machines/*/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c0781e91-8102-4553-8951-97c6d4243cda",
|                                         "Name":  "Azure Arc ScVmm Private Cloud User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Use ScVmm resources to deploy VMs; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "microsoft.scvmm/virtualnetworks/join/action",
|                                                         "microsoft.scvmm/virtualnetworks/Read",
|                                                         "microsoft.scvmm/virtualmachinetemplates/clone/action",
|                                                         "microsoft.scvmm/virtualmachinetemplates/Read",
|                                                         "microsoft.scvmm/clouds/deploy/action",
|                                                         "microsoft.scvmm/clouds/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/enabledresourcetypes/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e582369a-e17b-42a5-b10c-874c387c530b",
|                                         "Name":  "Azure Arc ScVmm VM Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Perform VM actions in ScVmm; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "microsoft.scvmm/virtualmachines/*",
|                                                         "microsoft.scvmm/virtualMachineInstances/*",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                         "Microsoft.HybridCompute/machines/installPatches/action",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                         "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/write",
|                                                         "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                         "Microsoft.HybridCompute/licenses/read",
|                                                         "Microsoft.HybridCompute/licenses/write",
|                                                         "Microsoft.HybridCompute/licenses/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6aac74c4-6311-40d2-bbdd-7d01e7c6e3a9",
|                                         "Name":  "Azure Arc ScVmm Private Clouds Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Provision resources for ScVmm onboarding; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "microsoft.scvmm/vmmservers/Read",
|                                                         "microsoft.scvmm/vmmservers/Write",
|                                                         "microsoft.scvmm/vmmservers/Delete",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a92dfd61-77f9-4aec-a531-19858b406c87",
|                                         "Name":  "Azure Arc ScVmm Administrator role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Perform all ScVmm actions but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ScVmm/*",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                         "Microsoft.HybridCompute/machines/installPatches/action",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                         "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/write",
|                                                         "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                         "Microsoft.HybridCompute/licenses/read",
|                                                         "Microsoft.HybridCompute/licenses/write",
|                                                         "Microsoft.HybridCompute/licenses/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fd036e6b-1266-47a0-b0bb-a05d04831731",
|                                         "Name":  "HDInsight on AKS Cluster Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage HDInsight clusters and run jobs; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/write",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/delete",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/resize/action",
|                                                         "Microsoft.HDInsight/clusterpools/clusters/instanceviews/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/jobs/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/runjob/action",
|                                                         "Microsoft.HDInsight/clusterpools/clusters/serviceconfigs/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/availableupgrades/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/upgrade/action",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/rollback/action",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/upgradehistories/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/libraries/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/managelibraries/action",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/*/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/logs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7656b436-37d4-490a-a4ab-d39f838f0042",
|                                         "Name":  "HDInsight on AKS Cluster Pool Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage cluster pools and clusters; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/write",
|                                                         "Microsoft.HDInsight/clusterPools/delete",
|                                                         "Microsoft.HDInsight/clusterPools/read",
|                                                         "Microsoft.HDInsight/clusterPools/write",
|                                                         "Microsoft.HDInsight/clusterpools/availableupgrades/read",
|                                                         "Microsoft.HDInsight/clusterpools/upgrade/action",
|                                                         "Microsoft.HDInsight/clusterPools/upgradehistories/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/*/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/logs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4465e953-8ced-4406-a58e-0f6e3f3b530b",
|                                         "Name":  "FHIR Data Importer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and import FHIR data; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/import/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bcf28286-af25-4c81-bb6f-351fcab5dbe9",
|                                         "Name":  "HDInsight on AKS Cluster Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and manage cluster operations; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.HDInsight/clusterPools/read",
|                                                         "Microsoft.Hdinsight/clusterpools/clusters/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/resize/action",
|                                                         "Microsoft.HDInsight/clusterpools/clusters/instanceviews/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/jobs/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/runjob/action",
|                                                         "Microsoft.HDInsight/clusterpools/clusters/serviceconfigs/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/availableupgrades/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/upgradehistories/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/libraries/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/managelibraries/action",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/logs/read",
|                                                         "Microsoft.Insights/diagnosticSettings/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c031e6a8-4391-4de0-8d69-4706a7ed3729",
|                                         "Name":  "API Management Developer Portal Content Editor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Edit developer portal content; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/portalRevisions/read",
|                                                         "Microsoft.ApiManagement/service/portalRevisions/write",
|                                                         "Microsoft.ApiManagement/service/contentTypes/read",
|                                                         "Microsoft.ApiManagement/service/contentTypes/delete",
|                                                         "Microsoft.ApiManagement/service/contentTypes/write",
|                                                         "Microsoft.ApiManagement/service/contentTypes/contentItems/read",
|                                                         "Microsoft.ApiManagement/service/contentTypes/contentItems/write",
|                                                         "Microsoft.ApiManagement/service/contentTypes/contentItems/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d24ecba3-c1f4-40fa-a7bb-4588a071e8fd",
|                                         "Name":  "Defender Agentless VM Scan",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access VM disks for security analysis; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/instanceView/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "80dcbedb-47ef-405d-95bd-188a1b4ac406",
|                                         "Name":  "Elastic SAN Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Elastic SAN resources; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ElasticSan/elasticSans/*",
|                                                         "Microsoft.ElasticSan/locations/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "af6a70f8-3c9f-4105-acf1-d719e9fca4ca",
|                                         "Name":  "Elastic SAN Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Elastic SAN control path; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ElasticSan/elasticSans/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "489581de-a3bd-480d-9518-53dea7416b33",
|                                         "Name":  "Desktop Virtualization Power On Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Start virtual machines; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/virtualMachines/start/action",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/read",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/start/action",
|                                                         "Microsoft.AzureStackHCI/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a959dbd1-f747-45e3-8ba6-dd80f235f97c",
|                                         "Name":  "Desktop Virtualization Virtual Machine Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage virtual machines in desktop virtualization; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/write",
|                                                         "Microsoft.DesktopVirtualization/hostpools/retrieveRegistrationToken/action",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/write",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/delete",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/disconnect/action",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/sendMessage/action",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionHostConfigurations/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/doNotUseInternalAPI/action",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/retryprovisioning/action",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/availabilitySets/write",
|                                                         "Microsoft.Compute/availabilitySets/vmSizes/read",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/galleries/read",
|                                                         "Microsoft.Compute/galleries/images/read",
|                                                         "Microsoft.Compute/galleries/images/versions/read",
|                                                         "Microsoft.Compute/images/read",
|                                                         "Microsoft.Compute/locations/usages/read",
|                                                         "Microsoft.Compute/locations/vmSizes/read",
|                                                         "Microsoft.Compute/operations/read",
|                                                         "Microsoft.Compute/skus/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachines/delete",
|                                                         "Microsoft.Compute/virtualMachines/start/action",
|                                                         "Microsoft.Compute/virtualMachines/powerOff/action",
|                                                         "Microsoft.Compute/virtualMachines/restart/action",
|                                                         "Microsoft.Compute/virtualMachines/deallocate/action",
|                                                         "Microsoft.Compute/virtualMachines/runCommand/action",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/write",
|                                                         "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                         "Microsoft.Compute/virtualMachines/runCommands/read",
|                                                         "Microsoft.Compute/virtualMachines/runCommands/write",
|                                                         "Microsoft.Compute/virtualMachines/vmSizes/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/usages/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Marketplace/offerTypes/publishers/offers/plans/agreements/read",
|                                                         "Microsoft.KeyVault/vaults/deploy/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.DesktopVirtualization/scalingPlans/read",
|                                                         "Microsoft.DesktopVirtualization/scalingPlans/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "40c5ff49-9181-41f8-ae61-143b0e78555e",
|                                         "Name":  "Desktop Virtualization Power On Off Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Start and stop virtual machines; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureStackHCI/operations/read",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/read",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/restart/action",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/start/action",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/stop/action",
|                                                         "Microsoft.Compute/virtualMachines/deallocate/action",
|                                                         "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                         "Microsoft.Compute/virtualMachines/powerOff/action",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/restart/action",
|                                                         "Microsoft.Compute/virtualMachines/start/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesCancelOperations/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteDeallocate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteHibernate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteStart/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationErrors/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationStatus/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitDeallocate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitHibernate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitStart/action",
|                                                         "Microsoft.ComputeSchedule/register/action",
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/delete",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/sendMessage/action",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/write",
|                                                         "Microsoft.DesktopVirtualization/hostpools/write",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/eventtypes/values/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a8281131-f312-4f34-8d98-ae12be9f0d23",
|                                         "Name":  "Elastic SAN Volume Group Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to volume group resources; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/*",
|                                                         "Microsoft.ElasticSan/locations/asyncoperations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4339b7cf-9826-4e41-b4ed-c7f4505dac08",
|                                         "Name":  "Artifact Signing Identity Verifier",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage identity verification requests; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CodeSigning/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CodeSigning/IdentityVerification/Read",
|                                                             "Microsoft.CodeSigning/IdentityVerification/Write",
|                                                             "Microsoft.CodeSigning/IdentityVerification/Delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a2c4a527-7dc0-4ee3-897b-403ade70fafb",
|                                         "Name":  "Video Indexer Restricted Viewer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to video insights; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.VideoIndexer/*/read",
|                                                         "Microsoft.VideoIndexer/accounts/*/action"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.VideoIndexer/*/write",
|                                                            "Microsoft.VideoIndexer/*/delete",
|                                                            "Microsoft.VideoIndexer/accounts/generateAccessToken/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b0d8363b-8ddd-447d-831f-62ca05bff136",
|                                         "Name":  "Monitoring Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to monitoring data; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Monitor/accounts/data/metrics/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "30b27cfc-9c84-438e-b0ce-70e35255df80",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Kubernetes resources; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                             "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                             "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                             "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                             "Microsoft.ContainerService/fleets/configmaps/read",
|                                                             "Microsoft.ContainerService/fleets/endpoints/read",
|                                                             "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/fleets/events/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/limitranges/read",
|                                                             "Microsoft.ContainerService/fleets/namespaces/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                             "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                             "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                             "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                             "Microsoft.ContainerService/fleets/services/read",
|                                                             "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/internalmemberclusters/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverridesnapshots/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/works/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "18ab4d3d-a1bf-4477-8ad9-8359bc988f69",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write access to Kubernetes resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "434fb43a-c01c-447e-9f67-c3ad923cfaba",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write access to Kubernetes namespace resources; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/fleets/apps/daemonsets/*",
|                                                             "Microsoft.ContainerService/fleets/apps/deployments/*",
|                                                             "Microsoft.ContainerService/fleets/apps/statefulsets/*",
|                                                             "Microsoft.ContainerService/fleets/authorization.k8s.io/localsubjectaccessreviews/write",
|                                                             "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*",
|                                                             "Microsoft.ContainerService/fleets/batch/cronjobs/*",
|                                                             "Microsoft.ContainerService/fleets/batch/jobs/*",
|                                                             "Microsoft.ContainerService/fleets/configmaps/*",
|                                                             "Microsoft.ContainerService/fleets/endpoints/*",
|                                                             "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/fleets/events/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/daemonsets/*",
|                                                             "Microsoft.ContainerService/fleets/extensions/deployments/*",
|                                                             "Microsoft.ContainerService/fleets/extensions/ingresses/*",
|                                                             "Microsoft.ContainerService/fleets/extensions/networkpolicies/*",
|                                                             "Microsoft.ContainerService/fleets/limitranges/read",
|                                                             "Microsoft.ContainerService/fleets/namespaces/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumeclaims/*",
|                                                             "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*",
|                                                             "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/rolebindings/*",
|                                                             "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/roles/*",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/*",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/*",
|                                                             "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                             "Microsoft.ContainerService/fleets/secrets/*",
|                                                             "Microsoft.ContainerService/fleets/serviceaccounts/*",
|                                                             "Microsoft.ContainerService/fleets/services/*",
|                                                             "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/internalmemberclusters/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/*",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverridesnapshots/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/works/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5af6afb3-c06c-4fa4-8848-71a8aee05683",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write access to Kubernetes namespace resources including Secrets; no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/apps/daemonsets/write",
|                                                             "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/apps/deployments/write",
|                                                             "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                             "Microsoft.ContainerService/fleets/apps/statefulsets/write",
|                                                             "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                             "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/write",
|                                                             "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                             "Microsoft.ContainerService/fleets/batch/cronjobs/write",
|                                                             "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                             "Microsoft.ContainerService/fleets/batch/jobs/write",
|                                                             "Microsoft.ContainerService/fleets/configmaps/read",
|                                                             "Microsoft.ContainerService/fleets/configmaps/write",
|                                                             "Microsoft.ContainerService/fleets/endpoints/read",
|                                                             "Microsoft.ContainerService/fleets/endpoints/write",
|                                                             "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/fleets/events/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/daemonsets/write",
|                                                             "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/deployments/write",
|                                                             "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/ingresses/write",
|                                                             "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/networkpolicies/write",
|                                                             "Microsoft.ContainerService/fleets/limitranges/read",
|                                                             "Microsoft.ContainerService/fleets/namespaces/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/write",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/write",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumeclaims/write",
|                                                             "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                             "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/write",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/write",
|                                                             "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                             "Microsoft.ContainerService/fleets/secrets/read",
|                                                             "Microsoft.ContainerService/fleets/secrets/write",
|                                                             "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                             "Microsoft.ContainerService/fleets/serviceaccounts/write",
|                                                             "Microsoft.ContainerService/fleets/services/read",
|                                                             "Microsoft.ContainerService/fleets/services/write",
|                                                             "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/internalmemberclusters/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/write",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverridesnapshots/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/works/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "63bb64ad-9799-4770-b5c3-24ed299a07bf",
|                                         "Name":  "Azure Kubernetes Fleet Manager Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows management of Azure Kubernetes Fleet resources but does not provide identity plane control or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/fleets/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.ContainerService/fleetMemberships/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ba79058c-0414-4a34-9e42-c3399d80cd5a",
|                                         "Name":  "Kubernetes Namespace User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows reading namespaces and retrieving kubeconfig but no direct or near-direct path to tenant takeover.",
|                                         "Actions":  [
|                                                         "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                         "Microsoft.KubernetesConfiguration/namespaces/listUserCredential/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c6decf44-fd0a-444c-a844-d653c394e7ab",
|                                         "Name":  "Data Labeling - Labeler",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can label data but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/experiments/runs/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/labeling/projects/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/labeling/projects/summary/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/labeling/labels/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/labeling/labels/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "392ae280-861d-42bd-9ea5-08ee6d83b80e",
|                                         "Name":  "Template Spec Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to template specs with no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/templateSpecs/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1c9b6475-caf0-4164-b5a1-2142a7116f4b",
|                                         "Name":  "Template Spec Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to template specs but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/templateSpecs/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "51d6186e-6489-4900-b93f-92e23144cca5",
|                                         "Name":  "Microsoft Sentinel Playbook Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and trigger workflows but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Logic/workflows/read",
|                                                         "Microsoft.Logic/workflows/triggers/listCallbackUrl/action",
|                                                         "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/triggers/listCallbackUrl/action",
|                                                         "Microsoft.Web/sites/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "18e40d4e-8d2e-438d-97e1-9528336e149c",
|                                         "Name":  "Deployment Environments User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage environment resources but lacks permissions to modify roles or identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.DevCenter/projects/read",
|                                                         "Microsoft.DevCenter/projects/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.DevCenter/projects/pools/read",
|                                                            "Microsoft.DevCenter/projects/pools/schedules/read"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DevCenter/projects/users/environments/userRead/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/userWrite/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/userDelete/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/userActionManage/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/userOutputsRead/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "80558df3-64f9-4c0f-b32d-e5094b036b0b",
|                                         "Name":  "Azure Spring Apps Connect Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/apps/deployments/connect/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a99b0159-1064-4c22-a57b-c9b3caa1c054",
|                                         "Name":  "Azure Spring Apps Remote Debugging Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/apps/deployments/remotedebugging/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1823dd4f-9b8c-4ab6-ab4e-7397a3684615",
|                                         "Name":  "AzureML Registry User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage ML registry assets but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/registries/read",
|                                                         "Microsoft.MachineLearningServices/registries/assets/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e503ece1-11d0-4e8e-8e2c-7a6c3bf38815",
|                                         "Name":  "AzureML Compute Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage compute resources but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/computes/*",
|                                                         "Microsoft.MachineLearningServices/workspaces/notebooks/vm/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "05352d14-a920-4328-a0de-4cbe7430e26b",
|                                         "Name":  "Azure Center for SAP solutions reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to SAP solution resources without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Advisor/configurations/read",
|                                                         "Microsoft.Advisor/recommendations/read",
|                                                         "Microsoft.Workloads/sapvirtualInstances/*/read",
|                                                         "Microsoft.Workloads/Locations/*/read",
|                                                         "Microsoft.Workloads/Operations/read",
|                                                         "Microsoft.Workloads/Locations/OperationStatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/virtualMachines/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                         "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                         "Microsoft.Network/networkInterfaces/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                         "Microsoft.Network/loadBalancers/frontendIPConfigurations/read",
|                                                         "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                         "Microsoft.Network/loadBalancers/inboundNatRules/read",
|                                                         "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Network/loadBalancers/networkInterfaces/read",
|                                                         "Microsoft.Network/loadBalancers/outboundRules/read",
|                                                         "Microsoft.Network/loadBalancers/virtualMachines/read",
|                                                         "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/privateEndpoints/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/disks/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "aabbc5dd-1af0-458b-a942-81af88f9c138",
|                                         "Name":  "Azure Center for SAP solutions service role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can deploy and manage SAP systems but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/write",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/write",
|                                                         "Microsoft.Network/loadBalancers/frontendIPConfigurations/read",
|                                                         "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                         "Microsoft.Network/loadBalancers/inboundNatRules/read",
|                                                         "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Network/loadBalancers/networkInterfaces/read",
|                                                         "Microsoft.Network/loadBalancers/outboundRules/read",
|                                                         "Microsoft.Network/loadBalancers/virtualMachines/read",
|                                                         "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                         "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/checkIpAddressAvailability/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/virtualMachines/read",
|                                                         "Microsoft.Network/virtualNetworks/virtualMachines/read",
|                                                         "Microsoft.Network/networkInterfaces/ipconfigurations/join/action",
|                                                         "Microsoft.Network/privateEndpoints/read",
|                                                         "Microsoft.Network/privateEndpoints/write",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinLoadBalancer/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/write",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/write",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/availabilitySets/write",
|                                                         "Microsoft.Compute/skus/read",
|                                                         "Microsoft.Compute/sshPublicKeys/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/write",
|                                                         "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7b0c7e81-271f-4c71-90bf-e30bdfdbc2f7",
|                                         "Name":  "Azure Center for SAP solutions administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to SAP solutions but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Advisor/configurations/read",
|                                                         "Microsoft.Advisor/recommendations/read",
|                                                         "Microsoft.Workloads/sapvirtualInstances/*/read",
|                                                         "Microsoft.Workloads/sapVirtualInstances/*/write",
|                                                         "Microsoft.Workloads/sapVirtualInstances/*/delete",
|                                                         "Microsoft.Workloads/Locations/*/action",
|                                                         "Microsoft.Workloads/Locations/*/read",
|                                                         "Microsoft.Workloads/sapVirtualInstances/*/start/action",
|                                                         "Microsoft.Workloads/sapVirtualInstances/*/stop/action",
|                                                         "Microsoft.Workloads/connectors/*/read",
|                                                         "Microsoft.Workloads/connectors/*/write",
|                                                         "Microsoft.Workloads/connectors/*/delete",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/virtualMachines/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                         "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                         "Microsoft.Network/networkInterfaces/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                         "Microsoft.Network/loadBalancers/frontendIPConfigurations/read",
|                                                         "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                         "Microsoft.Network/loadBalancers/inboundNatRules/read",
|                                                         "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Network/loadBalancers/networkInterfaces/read",
|                                                         "Microsoft.Network/loadBalancers/outboundRules/read",
|                                                         "Microsoft.Network/loadBalancers/virtualMachines/read",
|                                                         "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/privateEndpoints/read",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/sshPublicKeys/read",
|                                                         "Microsoft.Compute/sshPublicKeys/write",
|                                                         "Microsoft.Compute/sshPublicKeys/*/generateKeyPair/action",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                         "Microsoft.Compute/disks/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fbc52c3f-28ad-4303-a892-8a056630b8f1",
|                                         "Name":  "AppGw for Containers Configuration Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can configure Application Gateway for Containers but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ServiceNetworking/trafficControllers/read",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/write",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/delete",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/frontends/read",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/frontends/write",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/frontends/delete",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/associations/read",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/associations/write",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/associations/delete",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/*/read",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/*/write",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/*/delete",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ServiceNetworking/trafficControllers/serviceRoutingConfigurations/read",
|                                                             "Microsoft.ServiceNetworking/trafficControllers/serviceRoutingConfigurations/write",
|                                                             "Microsoft.ServiceNetworking/trafficControllers/serviceRoutingConfigurations/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4ba50f17-9666-485c-a643-ff00808643f0",
|                                         "Name":  "FHIR SMART User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/readById/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/search/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/smart/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/readById/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/search/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/smart/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a001fd3d-188f-4b5d-821b-7da978bf7442",
|                                         "Name":  "Cognitive Services OpenAI Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage OpenAI deployments but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.CognitiveServices/accounts/deployments/write",
|                                                         "Microsoft.CognitiveServices/accounts/deployments/delete",
|                                                         "Microsoft.CognitiveServices/accounts/raiPolicies/read",
|                                                         "Microsoft.CognitiveServices/accounts/raiPolicies/write",
|                                                         "Microsoft.CognitiveServices/accounts/raiPolicies/delete",
|                                                         "Microsoft.CognitiveServices/accounts/commitmentplans/read",
|                                                         "Microsoft.CognitiveServices/accounts/commitmentplans/write",
|                                                         "Microsoft.CognitiveServices/accounts/commitmentplans/delete",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd",
|                                         "Name":  "Cognitive Services OpenAI User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access and inference capabilities without role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/engines/completions/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/engines/search/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/engines/generate/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/deployments/audio/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/deployments/search/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/deployments/completions/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/deployments/chat/completions/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/deployments/realtime/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/deployments/extensions/chat/completions/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/deployments/embeddings/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/images/generations/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/video/generations/*/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/video/generations/*/delete",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/assistants/*",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/responses/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "36e80216-a7e8-4f42-a7e1-f12c98cbaf8a",
|                                         "Name":  "Azure impact Reporter role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Write access to impact data but no permissions to modify roles or identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Impact/WorkloadImpacts/*",
|                                                         "Microsoft.Impact/ImpactCategories/read",
|                                                         "Microsoft.Impact/TopologyImpacts/*",
|                                                         "Microsoft.Impact/getUploadToken/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "68ff5d27-c7f5-4fa9-a21c-785d0df7bd9e",
|                                         "Name":  "Impact Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to impact data with no identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Impact/WorkloadImpacts/read",
|                                                         "Microsoft.Impact/ImpactCategories/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ad2dd5fb-cd4b-4fd4-a9b6-4fed3630980b",
|                                         "Name":  "ContainerApp Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to container app resources without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.App/containerApps/*/read",
|                                                         "Microsoft.App/containerApps/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1afdec4b-e479-420e-99e7-f82237c7c5e6",
|                                         "Name":  "Azure Kubernetes Service Cluster Monitoring User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list monitoring credentials but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action",
|                                                         "Microsoft.ContainerService/managedClusters/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f5819b54-e033-4d82-ac66-4fec3cbf3f4c",
|                                         "Name":  "Azure Connected Machine Resource Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage hybrid compute machines but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/*/read",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/write",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/*/read",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridConnectivity/endpoints/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/write",
|                                                         "Microsoft.HybridConnectivity/endpoints/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.EdgeMarketplace/locations/operationStatuses/read",
|                                                         "Microsoft.EdgeMarketPlace/offers/getAccessToken/action",
|                                                         "Microsoft.EdgeMarketPlace/offers/generateAccessToken/action",
|                                                         "Microsoft.EdgeMarketplace/publishers/read",
|                                                         "Microsoft.EdgeMarketplace/offers/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/read",
|                                                         "Microsoft.Attestation/attestationProviders/write",
|                                                         "Microsoft.Attestation/attestationProviders/read",
|                                                         "Microsoft.Attestation/attestationProviders/delete",
|                                                         "Microsoft.Attestation/attestationProviders/attestation/read",
|                                                         "Microsoft.Attestation/attestationProviders/attestation/write",
|                                                         "Microsoft.Attestation/attestationProviders/attestation/delete",
|                                                         "Microsoft.HybridCompute/settings/read",
|                                                         "Microsoft.HybridCompute/settings/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "189207d4-bb67-4208-a635-b06afe8b2c57",
|                                         "Name":  "SqlDb Migration Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage SQL DB migration but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Sql/servers/read",
|                                                         "Microsoft.Sql/servers/write",
|                                                         "Microsoft.Sql/servers/databases/read",
|                                                         "Microsoft.Sql/servers/databases/write",
|                                                         "Microsoft.Sql/servers/databases/delete",
|                                                         "Microsoft.DataMigration/locations/operationResults/read",
|                                                         "Microsoft.DataMigration/locations/operationStatuses/read",
|                                                         "Microsoft.DataMigration/locations/sqlMigrationServiceOperationResults/read",
|                                                         "Microsoft.DataMigration/databaseMigrations/write",
|                                                         "Microsoft.DataMigration/databaseMigrations/read",
|                                                         "Microsoft.DataMigration/databaseMigrations/delete",
|                                                         "Microsoft.DataMigration/databaseMigrations/cancel/action",
|                                                         "Microsoft.DataMigration/databaseMigrations/cutover/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/write",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/delete",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listAuthKeys/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/regenerateAuthKeys/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/deleteNode/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listMonitoringData/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listMigrations/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/MonitoringData/read",
|                                                         "Microsoft.DataMigration/register/action",
|                                                         "Microsoft.DataMigration/operations/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/validateIR/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c4bc862a-3b64-4a35-a021-a380c159b042",
|                                         "Name":  "Bayer Ag Powered Services GDU Solution",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ef29765d-0d37-4119-a4f8-f9f9902c9588",
|                                         "Name":  "Bayer Ag Powered Services Imagery Solution",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/farms/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0105a6b0-4bb9-43d2-982a-12806f9faddb",
|                                         "Name":  "Azure Center for SAP solutions Service role for management",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6d949e1d-41e2-46e3-8920-c6e4f31a8310",
|                                         "Name":  "Azure Center for SAP solutions Management role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d5a2ae44-610b-4500-93be-660a0c5f5ca6",
|                                         "Name":  "Defender Kubernetes API Access",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Grants Defender access to AKS but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write",
|                                                         "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read",
|                                                         "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete",
|                                                         "Microsoft.ContainerService/managedClusters/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/providers/features/register/action",
|                                                         "Microsoft.Security/pricings/securityoperators/read",
|                                                         "Microsoft.Security/securityOperators/read",
|                                                         "Microsoft.Authorization/policyAssignments/read",
|                                                         "Microsoft.Authorization/policySetDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f0310ce6-e953-4cf8-b892-fb1c87eaf7f6",
|                                         "Name":  "Azure Usage Billing Data Sender",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.UsageBilling/accounts/inputs/send/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "96062cf7-95ca-4f89-9b9d-2a2aa47356af",
|                                         "Name":  "Defender Registry Access",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Grants Defender access to container registry for security assessment without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/pull/read",
|                                                         "Microsoft.ContainerRegistry/registries/push/write",
|                                                         "Microsoft.ContainerRegistry/registries/artifacts/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/write",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/write",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/delete",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1d335eef-eee1-47fe-a9e0-53214eba8872",
|                                         "Name":  "SqlMI Migration Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage SQL Managed Instance migration but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Sql/managedInstances/read",
|                                                         "Microsoft.Sql/managedInstances/write",
|                                                         "Microsoft.Sql/managedInstances/databases/read",
|                                                         "Microsoft.Sql/managedInstances/databases/write",
|                                                         "Microsoft.Sql/managedInstances/databases/delete",
|                                                         "Microsoft.Sql/managedInstances/metrics/read",
|                                                         "Microsoft.DataMigration/locations/operationResults/read",
|                                                         "Microsoft.DataMigration/locations/operationStatuses/read",
|                                                         "Microsoft.DataMigration/locations/sqlMigrationServiceOperationResults/read",
|                                                         "Microsoft.DataMigration/databaseMigrations/write",
|                                                         "Microsoft.DataMigration/databaseMigrations/read",
|                                                         "Microsoft.DataMigration/databaseMigrations/delete",
|                                                         "Microsoft.DataMigration/databaseMigrations/cancel/action",
|                                                         "Microsoft.DataMigration/databaseMigrations/cutover/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/write",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/delete",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listAuthKeys/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/regenerateAuthKeys/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/deleteNode/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listMonitoringData/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listMigrations/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/MonitoringData/read",
|                                                         "Microsoft.DataMigration/register/action",
|                                                         "Microsoft.DataMigration/operations/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/validateIR/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ae8036db-e102-405b-a1b9-bae082ea436d",
|                                         "Name":  "SqlVM Migration Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage SQL VM migration but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.DataMigration/locations/operationResults/read",
|                                                         "Microsoft.DataMigration/locations/operationStatuses/read",
|                                                         "Microsoft.DataMigration/locations/sqlMigrationServiceOperationResults/read",
|                                                         "Microsoft.DataMigration/databaseMigrations/write",
|                                                         "Microsoft.DataMigration/databaseMigrations/read",
|                                                         "Microsoft.DataMigration/databaseMigrations/delete",
|                                                         "Microsoft.DataMigration/databaseMigrations/cancel/action",
|                                                         "Microsoft.DataMigration/databaseMigrations/cutover/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/write",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/delete",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listAuthKeys/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/regenerateAuthKeys/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/deleteNode/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listMonitoringData/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listMigrations/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/MonitoringData/read",
|                                                         "Microsoft.DataMigration/register/action",
|                                                         "Microsoft.DataMigration/operations/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.SqlVirtualMachine/sqlVirtualMachines/read",
|                                                         "Microsoft.SqlVirtualMachine/sqlVirtualMachines/write",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/validateIR/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a9b99099-ead7-47db-8fcf-072597a61dfa",
|                                         "Name":  "Bayer Ag Powered Services CWUM Solution",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/farms/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0ab34830-df19-4f8c-b84e-aa85b8afa6e8",
|                                         "Name":  "Azure Front Door Domain Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage Front Door domains but cannot assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Cdn/operationresults/profileresults/customdomainresults/read",
|                                                         "Microsoft.Cdn/profiles/customdomains/read",
|                                                         "Microsoft.Cdn/profiles/customdomains/write",
|                                                         "Microsoft.Cdn/profiles/customdomains/delete",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3f2eb865-5811-4578-b90a-6fc6fa0df8e5",
|                                         "Name":  "Azure Front Door Secret Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage Front Door secrets but cannot assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Cdn/operationresults/profileresults/secretresults/read",
|                                                         "Microsoft.Cdn/profiles/secrets/read",
|                                                         "Microsoft.Cdn/profiles/secrets/write",
|                                                         "Microsoft.Cdn/profiles/secrets/delete",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0f99d363-226e-4dca-9920-b807cf8e1a5f",
|                                         "Name":  "Azure Front Door Domain Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Front Door domains without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Cdn/operationresults/profileresults/customdomainresults/read",
|                                                         "Microsoft.Cdn/profiles/customdomains/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0db238c4-885e-4c4f-a933-aa2cef684fca",
|                                         "Name":  "Azure Front Door Secret Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Front Door secrets without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Cdn/operationresults/profileresults/secretresults/read",
|                                                         "Microsoft.Cdn/profiles/secrets/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d18ad5f3-1baf-4119-b49b-d944edb1f9d0",
|                                         "Name":  "MySQL Backup And Export Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage MySQL backup and export but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.DBforMySQL/flexibleServers/validateBackup/action",
|                                                         "Microsoft.DBforMySQL/flexibleServers/backupAndExport/action",
|                                                         "Microsoft.DBforMySQL/locations/operationResults/read",
|                                                         "Microsoft.DBforMySQL/locations/azureAsyncOperation/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a8835c7d-b5cb-47fa-b6f0-65ea10ce07a2",
|                                         "Name":  "LocalNGFirewallAdministrator role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage NGFirewalls but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "PaloAltoNetworks.Cloudngfw/firewalls/*",
|                                                         "PaloAltoNetworks.Cloudngfw/localRulestacks/read",
|                                                         "PaloAltoNetworks.Cloudngfw/globalRulestacks/read",
|                                                         "PaloAltoNetworks.Cloudngfw/Locations/operationStatuses/read",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/read",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/publicIPAddresses/write",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/publicIPAddresses/join/action",
|                                                         "Microsoft.Network/networkVirtualAppliances/read",
|                                                         "Microsoft.Network/networkVirtualAppliances/write",
|                                                         "Microsoft.Network/networkVirtualAppliances/delete",
|                                                         "Microsoft.Network/virtualHubs/read",
|                                                         "Microsoft.Network/virtualWans/read",
|                                                         "Microsoft.Network/virtualWans/virtualHubs/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "PaloAltoNetworks.Cloudngfw/localRulestacks/fqdnlists/read",
|                                                         "PaloAltoNetworks.Cloudngfw/localRulestacks/localRules/read",
|                                                         "PaloAltoNetworks.Cloudngfw/localRulestacks/listFirewalls/action",
|                                                         "PaloAltoNetworks.Cloudngfw/createProductSerialNumber/action",
|                                                         "PaloAltoNetworks.Cloudngfw/listCloudManagerTenants/action",
|                                                         "PaloAltoNetworks.Cloudngfw/listProductSerialNumberStatus/action",
|                                                         "PaloAltoNetworks.Cloudngfw/listSupportInfo/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bda0d508-adf1-4af0-9c28-88919fc3ae06",
|                                         "Name":  "Azure Stack HCI Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Azure Stack HCI cluster but no direct or near-direct path to tenant-wide identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/register/action",
|                                                         "Microsoft.AzureStackHCI/Unregister/Action",
|                                                         "Microsoft.AzureStackHCI/clusters/*",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/Read",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/Write",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Write",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/Delete",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Delete",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/join/action",
|                                                         "Microsoft.HybridCompute/register/action",
|                                                         "Microsoft.GuestConfiguration/register/action",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                         "Microsoft.HybridConnectivity/register/action",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.AzureStackHCI/*",
|                                                         "Microsoft.AzureStackHCI/EdgeMachines/*",
|                                                         "Microsoft.AzureStackHCI/DevicePools/*",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                         "Microsoft.HybridCompute/machines/installPatches/action",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                         "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/write",
|                                                         "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                         "Microsoft.HybridCompute/licenses/read",
|                                                         "Microsoft.HybridCompute/licenses/write",
|                                                         "Microsoft.HybridCompute/licenses/delete",
|                                                         "Microsoft.ResourceConnector/register/action",
|                                                         "Microsoft.ResourceConnector/appliances/read",
|                                                         "Microsoft.ResourceConnector/appliances/write",
|                                                         "Microsoft.ResourceConnector/appliances/delete",
|                                                         "Microsoft.ResourceConnector/locations/operationresults/read",
|                                                         "Microsoft.ResourceConnector/locations/operationsstatus/read",
|                                                         "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                         "Microsoft.ResourceConnector/appliances/listKeys/action",
|                                                         "Microsoft.ResourceConnector/operations/read",
|                                                         "Microsoft.ExtendedLocation/register/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/write",
|                                                         "Microsoft.ExtendedLocation/customLocations/delete",
|                                                         "Microsoft.EdgeMarketplace/offers/read",
|                                                         "Microsoft.EdgeMarketplace/publishers/read",
|                                                         "Microsoft.Kubernetes/register/action",
|                                                         "Microsoft.KubernetesConfiguration/register/action",
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                         "Microsoft.KubernetesConfiguration/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Write",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                         "Microsoft.HybridContainerService/register/action",
|                                                         "Microsoft.HybridCompute/settings/write",
|                                                         "Microsoft.HybridCompute/settings/read",
|                                                         "Microsoft.HybridCompute/gateways/read",
|                                                         "Microsoft.HybridCompute/gateways/write",
|                                                         "Microsoft.HybridCompute/gateways/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bfc3b73d-c6ff-45eb-9a5f-40298295bf20",
|                                         "Name":  "LocalRulestacksAdministrator role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage local rulestacks but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "PaloAltoNetworks.Cloudngfw/localRulestacks/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*",
|                                                         "PaloAltoNetworks.Cloudngfw/firewalls/read",
|                                                         "PaloAltoNetworks.Cloudngfw/createProductSerialNumber/action",
|                                                         "PaloAltoNetworks.Cloudngfw/listProductSerialNumberStatus/action",
|                                                         "PaloAltoNetworks.Cloudngfw/listSupportInfo/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7392c568-9289-4bde-aaaa-b7131215889d",
|                                         "Name":  "Azure Extension for SQL Server Deployment",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can deploy Azure Extension for SQL Server but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d6470a16-71bd-43ab-86b3-6f3a73f4e787",
|                                         "Name":  "Azure Maps Data Read and Batch Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Maps/accounts/services/*/read",
|                                                             "Microsoft.Maps/accounts/services/batch/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ef1c2c96-4a77-49e8-b9a4-6179fe1d2fd2",
|                                         "Name":  "API Management Workspace Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to API Management workspace entities without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/workspaces/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/diagnosticSettings/*/read",
|                                                         "Microsoft.insights/logs/read",
|                                                         "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "73c2c328-d004-4c5e-938c-35c6f5679a1f",
|                                         "Name":  "API Management Workspace API Product Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to API publishing entities but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/workspaces/*/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/products/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/subscriptions/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/groups/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/tags/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/notifications/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/diagnosticSettings/*/read",
|                                                         "Microsoft.insights/logs/read",
|                                                         "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "56328988-075d-4c6a-8766-d93edd6725b6",
|                                         "Name":  "API Management Workspace API Developer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to API editing entities but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/workspaces/*/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/apis/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/apiVersionSets/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/policies/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/schemas/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/products/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/policyFragments/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/namedValues/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/tags/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/backends/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/certificates/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/diagnostics/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/loggers/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/diagnosticSettings/*/read",
|                                                         "Microsoft.insights/logs/read",
|                                                         "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d59a3e9c-6d52-4a5a-aeed-6bf3cf0e31da",
|                                         "Name":  "API Management Service Workspace API Product Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to API Management service entities but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/users/read",
|                                                         "Microsoft.ApiManagement/service/tags/read",
|                                                         "Microsoft.ApiManagement/service/tags/apiLinks/*",
|                                                         "Microsoft.ApiManagement/service/tags/operationLinks/*",
|                                                         "Microsoft.ApiManagement/service/tags/productLinks/*",
|                                                         "Microsoft.ApiManagement/service/products/read",
|                                                         "Microsoft.ApiManagement/service/products/apiLinks/*",
|                                                         "Microsoft.ApiManagement/service/groups/read",
|                                                         "Microsoft.ApiManagement/service/groups/users/*",
|                                                         "Microsoft.ApiManagement/service/read",
|                                                         "Microsoft.ApiManagement/service/authorizationServers/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9565a273-41b9-4368-97d2-aeb0c976a9b3",
|                                         "Name":  "API Management Service Workspace API Developer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to API Management service tags and products but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/tags/read",
|                                                         "Microsoft.ApiManagement/service/tags/apiLinks/*",
|                                                         "Microsoft.ApiManagement/service/tags/operationLinks/*",
|                                                         "Microsoft.ApiManagement/service/tags/productLinks/*",
|                                                         "Microsoft.ApiManagement/service/products/read",
|                                                         "Microsoft.ApiManagement/service/products/apiLinks/*",
|                                                         "Microsoft.ApiManagement/service/read",
|                                                         "Microsoft.ApiManagement/service/authorizationServers/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0c34c906-8d99-4cb7-8bb7-33f5b0a1a799",
|                                         "Name":  "API Management Workspace Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage workspace resources but lacks permissions to assign roles or modify identity plane controls.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/workspaces/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/diagnosticSettings/*/read",
|                                                         "Microsoft.insights/logs/read",
|                                                         "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b8eda974-7b85-4f76-af95-65846b26df6d",
|                                         "Name":  "Storage File Data Privileged Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to storage file shares only; no path to identity or role assignment.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "69566ab7-960f-475b-8e7c-b3118f30c6bd",
|                                         "Name":  "Storage File Data Privileged Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Write and modify NTFS permissions on storage files but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7eabc9a4-85f7-4f71-b8ab-75daaccc1033",
|                                         "Name":  "Windows 365 Network User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and join virtual networks but cannot assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/usages/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1f135831-5bbe-4924-9016-264044c00788",
|                                         "Name":  "Windows 365 Network Interface Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can provision network resources but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Network/locations/operationResults/read",
|                                                         "Microsoft.Network/locations/usages/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action",
|                                                         "Microsoft.Network/networkInterfaces/effectiveRouteTable/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3d55a8f6-4133-418d-8051-facdb1735758",
|                                         "Name":  "Windows365SubscriptionReader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to subscriptions and resources; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0f37683f-2463-46b6-9ce7-9b788b988ba2",
|                                         "Name":  "App Compliance Automation Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages compliance automation tool and storage but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppComplianceAutomation/*",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                         "Microsoft.Storage/storageAccounts/fileservices/write",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.PolicyInsights/policyStates/queryResults/action",
|                                                         "Microsoft.PolicyInsights/policyStates/triggerEvaluation/action",
|                                                         "Microsoft.Resources/resources/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
|                                                         "Microsoft.Resources/subscriptions/resources/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/tags/read",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Security/automations/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Security/automations/delete",
|                                                         "Microsoft.Security/automations/write",
|                                                         "Microsoft.Security/register/action",
|                                                         "Microsoft.Security/unregister/action",
|                                                         "*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ffc6bbe0-e443-4c3b-bf54-26581bb2f78e",
|                                         "Name":  "App Compliance Automation Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to compliance automation tool; no identity plane control.",
|                                         "Actions":  [
|                                                         "*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8b9dfcab-4b77-4632-a6df-94bd07820648",
|                                         "Name":  "Azure Sphere Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to Azure Sphere resources without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureSphere/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/DiagnosticSettings/*",
|                                                         "Microsoft.Insights/DiagnosticSettingsCategories/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e9b8712a-cbcf-4ea7-b0f7-e71b803401e6",
|                                         "Name":  "SaaS Hub Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages SaaS Hub resources but cannot assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.SaaSHub/cloudservices/read",
|                                                         "Microsoft.SaaSHub/cloudservices/write",
|                                                         "Microsoft.SaaSHub/cloudservices/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c8ae6279-5a0b-4cb2-b3f0-d4d62845742c",
|                                         "Name":  "Azure Sphere Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Azure Sphere resources; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureSphere/*/read",
|                                                         "Microsoft.AzureSphere/catalogs/countDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/listDeviceGroups/action",
|                                                         "Microsoft.AzureSphere/catalogs/listDeviceInsights/action",
|                                                         "Microsoft.AzureSphere/catalogs/listDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/listDeployments/action",
|                                                         "Microsoft.AzureSphere/catalogs/products/countDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/products/deviceGroups/countDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/certificates/retrieveCertChain/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/DiagnosticSettings/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6d994134-994b-4a59-9974-f479f0b227fb",
|                                         "Name":  "Azure Sphere Publisher",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can upload images and read Azure Sphere resources but lacks identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureSphere/*/read",
|                                                         "Microsoft.AzureSphere/catalogs/countDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/listDeviceGroups/action",
|                                                         "Microsoft.AzureSphere/catalogs/listDeviceInsights/action",
|                                                         "Microsoft.AzureSphere/catalogs/listDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/products/countDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/products/deviceGroups/countDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/certificates/retrieveProofOfPossessionNonce/action",
|                                                         "Microsoft.AzureSphere/catalogs/certificates/retrieveCertChain/action",
|                                                         "Microsoft.AzureSphere/catalogs/images/write",
|                                                         "Microsoft.AzureSphere/catalogs/uploadImage/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/DiagnosticSettings/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "be1a1ac2-09d3-4261-9e57-a73a6e227f53",
|                                         "Name":  "Procurement Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages procurement of products and services without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.SaaSHub/cloudservices/read",
|                                                         "Microsoft.SaaSHub/cloudservices/write",
|                                                         "Microsoft.SaaSHub/cloudservices/delete",
|                                                         "Microsoft.SaaSHub/register/action",
|                                                         "Microsoft.SaaS/resources/read",
|                                                         "Microsoft.SaaS/resources/write",
|                                                         "Microsoft.SaaS/resources/delete",
|                                                         "Microsoft.SaaS/register/action",
|                                                         "Microsoft.ProfessionalService/resources/read",
|                                                         "Microsoft.ProfessionalService/resources/write",
|                                                         "Microsoft.ProfessionalService/resources/delete",
|                                                         "Microsoft.ProfessionalService/register/action",
|                                                         "Microsoft.BillingBenefits/register/action",
|                                                         "Microsoft.BillingBenefits/maccs/read",
|                                                         "Microsoft.BillingBenefits/maccs/write",
|                                                         "Microsoft.BillingBenefits/maccs/delete",
|                                                         "Microsoft.BillingBenefits/maccs/cancel/action",
|                                                         "Microsoft.BillingBenefits/maccs/chargeShortfall/action",
|                                                         "Microsoft.BillingBenefits/maccs/writeOff/action",
|                                                         "Microsoft.BillingBenefits/maccs/contributors/read",
|                                                         "Microsoft.BillingBenefits/credits/read",
|                                                         "Microsoft.BillingBenefits/credits/write",
|                                                         "Microsoft.BillingBenefits/credits/cancel/action",
|                                                         "Microsoft.BillingBenefits/credits/sources/read",
|                                                         "Microsoft.BillingBenefits/credits/sources/write",
|                                                         "Microsoft.BillingBenefits/credits/sources/delete",
|                                                         "Microsoft.BillingBenefits/discounts/read",
|                                                         "Microsoft.BillingBenefits/discounts/write",
|                                                         "Microsoft.BillingBenefits/discounts/delete",
|                                                         "Microsoft.BillingBenefits/discounts/cancel/action",
|                                                         "Microsoft.BillingBenefits/conditionalCredits/read",
|                                                         "Microsoft.BillingBenefits/conditionalCredits/write",
|                                                         "Microsoft.BillingBenefits/conditionalCredits/delete",
|                                                         "Microsoft.BillingBenefits/conditionalCredits/cancel/action",
|                                                         "Microsoft.BillingBenefits/conditionalCredits/contributors/read",
|                                                         "Microsoft.EnterpriseSupport/enterpriseSupports/read",
|                                                         "Microsoft.EnterpriseSupport/enterpriseSupports/write",
|                                                         "Microsoft.EnterpriseSupport/enterpriseSupports/delete",
|                                                         "Microsoft.EnterpriseSupport/register/action",
|                                                         "Microsoft.SoftwarePlan/register/action",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/read",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/write",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/delete",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/cancel/action",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/listKeys/action",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/refreshFulfillment/action",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/productKeys/read",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/productKeys/showFullKey/action",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/productDownloadOptions/read",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/productDownloadOptions/generateDownloadLinks/action",
|                                                         "Microsoft.SoftwarePlan/validateSoftwareSubscriptionCreate/action",
|                                                         "Microsoft.SoftwarePlan/softwareLicenses/read",
|                                                         "Microsoft.SoftwarePlan/softwareLicenses/write",
|                                                         "Microsoft.SoftwarePlan/softwareLicenses/productKeys/read",
|                                                         "Microsoft.SoftwarePlan/softwareLicenses/productKeys/showFullKey/action",
|                                                         "Microsoft.SoftwarePlan/softwareLicenses/productDownloadOptions/read",
|                                                         "Microsoft.SoftwarePlan/softwareLicenses/productDownloadOptions/generateDownloadLinks/action",
|                                                         "Microsoft.SoftwarePlan/validateSoftwareLicenseCreate/action",
|                                                         "Microsoft.Hardware/register/action",
|                                                         "Microsoft.Hardware/orderPreview/action",
|                                                         "Microsoft.Hardware/orders/read",
|                                                         "Microsoft.Hardware/orders/write",
|                                                         "Microsoft.Hardware/orders/delete",
|                                                         "Microsoft.Hardware/returnPreview/action",
|                                                         "Microsoft.Hardware/returns/read",
|                                                         "Microsoft.Hardware/returns/write",
|                                                         "Microsoft.Hardware/returns/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ea01e6af-a1c1-4350-9563-ad00f8c72ec5",
|                                         "Name":  "Azure Machine Learning Workspace Connection Secrets Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list workspace connection secrets but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/connections/listsecrets/action",
|                                                         "Microsoft.MachineLearningServices/workspaces/metadata/secrets/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "79b01272-bf9f-4f4c-9517-5506269cf524",
|                                         "Name":  "Cognitive Search Serverless Data Reader (Deprecated)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Deprecated role with no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveSearch/indexes/schema/read",
|                                                             "Microsoft.CognitiveSearch/indexes/documents/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7ac06ca7-21ca-47e3-a67b-cbd6e6223baf",
|                                         "Name":  "Cognitive Search Serverless Data Contributor (Deprecated)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Deprecated role with no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveSearch/indexes/schema/*",
|                                                             "Microsoft.CognitiveSearch/indexes/documents/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5e28a61e-8040-49db-b175-bb5b88af6239",
|                                         "Name":  "Community Owner Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages community resources but lacks identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/register/action",
|                                                         "Microsoft.Mission/unregister/action",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/communities/read",
|                                                         "Microsoft.Mission/communities/write",
|                                                         "Microsoft.Mission/communities/delete",
|                                                         "Microsoft.Mission/communities/setMaintenanceMode/action",
|                                                         "Microsoft.Mission/communities/communityendpoints/connect/action",
|                                                         "Microsoft.Mission/communities/dedicatedHubs/connect/action",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/write",
|                                                         "Microsoft.Mission/virtualEnclaves/delete",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/write",
|                                                         "Microsoft.Mission/communities/communityEndpoints/delete",
|                                                         "Microsoft.Mission/communities/transitHubs/read",
|                                                         "Microsoft.Mission/communities/transitHubs/write",
|                                                         "Microsoft.Mission/communities/transitHubs/delete",
|                                                         "Microsoft.Mission/communities/dedicatedHubs/read",
|                                                         "Microsoft.Mission/communities/dedicatedHubs/write",
|                                                         "Microsoft.Mission/communities/dedicatedHubs/delete",
|                                                         "Microsoft.Mission/enclaveConnections/read",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                         "Microsoft.Mission/approvals/read",
|                                                         "Microsoft.Mission/approvals/write",
|                                                         "Microsoft.Mission/approvals/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9c1607d1-791d-4c68-885d-c7b7aaff7c8a",
|                                         "Name":  "Firmware Analysis Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can upload and configure firmware but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.IoTFirmwareDefense/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1e7ca9b1-60d1-4db8-a914-f2ca1ff27c40",
|                                         "Name":  "Defender for Storage Data Scanner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to storage blobs and files for scanning; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "df2711a6-406d-41cf-b366-b0250bff9ad1",
|                                         "Name":  "Compute Diagnostics Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions to execute diagnostics only; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action",
|                                                         "Microsoft.Compute/virtualmachinescalesets/disks/beginGetAccess/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fa6cecf6-5db3-4c43-8470-c540bcb4eafa",
|                                         "Name":  "Elastic SAN Network Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage SAN private endpoints and read SAN resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ElasticSan/elasticSans/*/read",
|                                                         "Microsoft.ElasticSan/elasticSans/PrivateEndpointConnectionsApproval/action",
|                                                         "Microsoft.ElasticSan/elasticSans/privateEndpointConnections/write",
|                                                         "Microsoft.ElasticSan/elasticSans/privateEndpointConnections/delete",
|                                                         "Microsoft.ElasticSan/locations/asyncoperations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bba48692-92b0-4667-a9ad-c31c7b334ac2",
|                                         "Name":  "Cognitive Services Usages Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Minimal read access to usage data; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/locations/usages/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c088a766-074b-43ba-90d4-1fb21feae531",
|                                         "Name":  "PostgreSQL Flexible Server Long Term Retention Backup Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Backup-related permissions without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackup/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackupAccess/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackupOperations/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackupPreCheck/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrPreBackup/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrRestoreFinalize/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrRestoreInitialize/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrRestorePreCheck/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/startLtrBackup/action",
|                                                         "Microsoft.DBforPostgreSQL/locations/azureAsyncOperation/read",
|                                                         "Microsoft.DBforPostgreSQL/locations/operationResults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a02f7c31-354d-4106-865a-deedf37fa038",
|                                         "Name":  "Search Parameter Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can update search parameters but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/reindex/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/write",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/searchparameter/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4accf36b-2c05-432f-91c8-5c532dff4c73",
|                                         "Name":  "Logic Apps Standard Reader (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to logic app resources; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "523776ba-4eb2-4600-a3c8-f2dc93da4bdb",
|                                         "Name":  "Logic Apps Standard Developer (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and edit workflows but cannot assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/*/read",
|                                                         "Microsoft.Web/connections/*",
|                                                         "Microsoft.Web/customApis/*",
|                                                         "Microsoft.Web/sites/config/list/Action",
|                                                         "microsoft.web/sites/config/Write",
|                                                         "microsoft.web/sites/config/web/appsettings/delete",
|                                                         "microsoft.web/sites/config/web/appsettings/write",
|                                                         "microsoft.web/sites/deployWorkflowArtifacts/action",
|                                                         "microsoft.web/sites/hostruntime/*",
|                                                         "microsoft.web/sites/listworkflowsconnections/action",
|                                                         "Microsoft.Web/sites/publish/Action",
|                                                         "microsoft.web/sites/slots/config/appsettings/write",
|                                                         "Microsoft.Web/sites/slots/config/list/Action",
|                                                         "microsoft.web/sites/slots/config/web/appsettings/delete",
|                                                         "microsoft.web/sites/slots/deployWorkflowArtifacts/action",
|                                                         "microsoft.web/sites/slots/listworkflowsconnections/action",
|                                                         "Microsoft.Web/sites/slots/publish/Action",
|                                                         "microsoft.web/sites/workflows/*",
|                                                         "microsoft.web/sites/workflowsconfiguration/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ad710c24-b039-4e85-a019-deb4a06e8570",
|                                         "Name":  "Logic Apps Standard Contributor (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage logic app workflows but no role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/*/read",
|                                                         "Microsoft.Web/certificates/*",
|                                                         "Microsoft.Web/connectionGateways/*",
|                                                         "Microsoft.Web/connections/*",
|                                                         "Microsoft.Web/customApis/*",
|                                                         "Microsoft.Web/serverFarms/*",
|                                                         "Microsoft.Web/sites/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b70c96e9-66fe-4c09-b6e7-c98e69c98555",
|                                         "Name":  "Logic Apps Standard Operator (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can enable/disable logic apps and create connections but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/*/read",
|                                                         "Microsoft.Web/sites/applySlotConfig/Action",
|                                                         "microsoft.web/sites/hostruntime/*",
|                                                         "Microsoft.Web/sites/restart/Action",
|                                                         "Microsoft.Web/sites/slots/restart/Action",
|                                                         "Microsoft.Web/sites/slots/slotsswap/Action",
|                                                         "Microsoft.Web/sites/slots/start/Action",
|                                                         "Microsoft.Web/sites/slots/stop/Action",
|                                                         "Microsoft.Web/sites/slotsdiffs/Action",
|                                                         "Microsoft.Web/sites/slotsswap/Action",
|                                                         "Microsoft.Web/sites/start/Action",
|                                                         "Microsoft.Web/sites/stop/Action",
|                                                         "Microsoft.Web/sites/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7b3e853f-ad5d-4fb5-a7b8-56a3581c7037",
|                                         "Name":  "IPAM Pool User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and modify IPAM pools but lacks identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/networkManagers/ipamPools/*/read",
|                                                         "Microsoft.Network/networkManagers/ipamPools/*/action",
|                                                         "Microsoft.Network/networkManagers/ipamPools/*/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e9c9ed2b-2a99-4071-b2ff-5b113ebf73a1",
|                                         "Name":  "SpatialMapsAccounts Account Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages data in account but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/spatialMapsAccounts/read",
|                                                             "Microsoft.MixedReality/spatialMapsAccounts/delete",
|                                                             "Microsoft.MixedReality/spatialMapsAccounts/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0b962ed2-6d56-471c-bd5f-3477d83a7ba4",
|                                         "Name":  "Azure Resource Notifications System Topics Subscriber",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create system topics and event subscriptions but no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToResources/action",
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToHealthResources/action",
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToMaintenanceResources/action",
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToComputeResources/action",
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToComputeScheduleResources/action",
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToContainerServiceEventResources/action",
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToImpactReportingResources/action",
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToAksResources/action",
|                                                         "Microsoft.EventGrid/eventSubscriptions/write",
|                                                         "Microsoft.EventGrid/systemTopics/eventSubscriptions/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1c4770c0-34f7-4110-a1ea-a5855cc7a939",
|                                         "Name":  "Elastic SAN Snapshot Exporter",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and export snapshots but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ElasticSan/elasticSans/*/read",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/snapshots/write",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/snapshots/delete",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/snapshots/beginGetAccess/action",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/preBackup/action",
|                                                         "Microsoft.ElasticSan/locations/*",
|                                                         "Microsoft.Compute/locations/*",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/snapshots/read",
|                                                         "Microsoft.Compute/snapshots/write",
|                                                         "Microsoft.Compute/snapshots/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "90e8b822-3e73-47b5-868a-787dc80c008f",
|                                         "Name":  "Elastic SAN Volume Importer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can import volumes but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/*/read",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/write",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/delete",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/preRestore/action",
|                                                         "Microsoft.ElasticSan/locations/*",
|                                                         "Microsoft.Compute/locations/*",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action",
|                                                         "Microsoft.Compute/disks/endGetAccess/action",
|                                                         "Microsoft.Compute/snapshots/read",
|                                                         "Microsoft.Compute/snapshots/beginGetAccess/action",
|                                                         "Microsoft.Compute/snapshots/endGetAccess/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "49435da6-99fe-48a5-a235-fc668b9dc04a",
|                                         "Name":  "Community Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can access and modify community resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/register/action",
|                                                         "Microsoft.Mission/unregister/action",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/communities/read",
|                                                         "Microsoft.Mission/communities/write",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/write",
|                                                         "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                         "Microsoft.Mission/virtualEnclaves/endpoints/write",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/write",
|                                                         "Microsoft.Mission/communities/transitHubs/read",
|                                                         "Microsoft.Mission/communities/transitHubs/write",
|                                                         "Microsoft.Mission/enclaveConnections/read",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                         "Microsoft.Mission/approvals/read",
|                                                         "Microsoft.Mission/approvals/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4b0f2fd7-60b4-4eca-896f-4435034f8bf5",
|                                         "Name":  "EventGrid TopicSpaces Subscriber",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can subscribe to messages but no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventGrid/topicSpaces/subscribe/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a12b0b94-b317-4dcd-84a8-502ce99884c6",
|                                         "Name":  "EventGrid TopicSpaces Publisher",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can publish messages but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventGrid/topicSpaces/publish/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d1a38570-4b05-4d70-b8e4-1100bcf76d12",
|                                         "Name":  "Data Boundary Tenant Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages data boundaries but lacks direct identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/dataBoundaries/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8a90fa6b-6997-4a07-8a95-30633a7c97b9",
|                                         "Name":  "DeID Batch Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages DeID batch jobs but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthDataAIServices/DeidServices/Batch/write",
|                                                             "Microsoft.HealthDataAIServices/DeidServices/Batch/delete",
|                                                             "Microsoft.HealthDataAIServices/DeidServices/Batch/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b73a14ee-91f5-41b7-bd81-920e12466be9",
|                                         "Name":  "DeID Batch Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to DeID batch jobs; no identity plane or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthDataAIServices/DeidServices/Batch/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bb6577c4-ea0a-40b2-8962-ea18cb8ecd4e",
|                                         "Name":  "DeID Realtime Data User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can execute requests against DeID realtime endpoint but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthDataAIServices/DeidServices/Realtime/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fa0d39e6-28e5-40cf-8521-1eb320653a4c",
|                                         "Name":  "Carbon Optimization Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to carbon optimization data; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Carbon/carbonEmissionReports/action",
|                                                         "Microsoft.Carbon/carbonEmissionReports/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "38863829-c2a4-4f8d-b1d2-2e325973ebc7",
|                                         "Name":  "Landing Zone Management Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can review and modify landing zone configurations but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Sovereign/landingZoneConfigurations/*",
|                                                         "Microsoft.Sovereign/landingZoneRegistrations/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8fe6e843-6d9e-417b-9073-106b048f50bb",
|                                         "Name":  "Landing Zone Management Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to landing zone configurations; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Sovereign/landingZoneConfigurations/read",
|                                                         "Microsoft.Sovereign/landingZoneRegistrations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "865ae368-6a45-4bd1-8fbf-0d5151f56fc1",
|                                         "Name":  "Azure Stack HCI Device Management Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Azure Stack HCI devices but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/Clusters/*",
|                                                         "Microsoft.AzureStackHCI/EdgeDevices/*",
|                                                         "Microsoft.AzureStackHCI/DevicePools/*/read",
|                                                         "Microsoft.AzureStackHCI/EdgeMachines/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.HybridContainerService/register/action",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                         "Microsoft.HybridContainerService/skus/read",
|                                                         "Microsoft.HybridContainerService/skus/write",
|                                                         "Microsoft.Authorization/roleassignments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Write",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                         "Microsoft.AzureStackHCI/LogicalNetworks/Read",
|                                                         "Microsoft.AzureStackHCI/LogicalNetworks/Write",
|                                                         "Microsoft.AzureStackHCI/Register/Action",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                         "Microsoft.KubernetesConfiguration/operations/read",
|                                                         "Microsoft.ResourceConnector/appliances/read",
|                                                         "Microsoft.ResourceConnector/appliances/write",
|                                                         "Microsoft.ResourceConnector/appliances/delete",
|                                                         "Microsoft.ResourceConnector/locations/operationresults/read",
|                                                         "Microsoft.ResourceConnector/locations/operationsstatus/read",
|                                                         "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                         "Microsoft.ResourceConnector/appliances/listKeys/action",
|                                                         "Microsoft.ResourceConnector/appliances/upgradeGraphs/read",
|                                                         "Microsoft.ResourceConnector/telemetryconfig/read",
|                                                         "Microsoft.ResourceConnector/operations/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/write",
|                                                         "Microsoft.ExtendedLocation/customLocations/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4dae6930-7baf-46f5-909e-0383bc931c46",
|                                         "Name":  "Azure Customer Lockbox Approver for Subscription",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can approve support requests but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.CustomerLockbox/requests/UpdateApproval/action",
|                                                         "Microsoft.CustomerLockbox/requests/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/eventtypes/values/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7b1f81f9-4196-4058-8aae-762e593270df",
|                                         "Name":  "Azure Resource Bridge Deployment Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages resource bridge deployments but no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleassignments/read",
|                                                         "Microsoft.AzureStackHCI/Register/Action",
|                                                         "Microsoft.ResourceConnector/register/action",
|                                                         "Microsoft.ResourceConnector/appliances/read",
|                                                         "Microsoft.ResourceConnector/appliances/write",
|                                                         "Microsoft.ResourceConnector/appliances/delete",
|                                                         "Microsoft.ResourceConnector/locations/operationresults/read",
|                                                         "Microsoft.ResourceConnector/locations/operationsstatus/read",
|                                                         "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                         "Microsoft.ResourceConnector/appliances/listKeys/action",
|                                                         "Microsoft.ResourceConnector/appliances/upgradeGraphs/read",
|                                                         "Microsoft.ResourceConnector/telemetryconfig/read",
|                                                         "Microsoft.ResourceConnector/operations/read",
|                                                         "Microsoft.ExtendedLocation/register/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/write",
|                                                         "Microsoft.ExtendedLocation/customLocations/delete",
|                                                         "Microsoft.HybridConnectivity/register/action",
|                                                         "Microsoft.Kubernetes/register/action",
|                                                         "Microsoft.KubernetesConfiguration/register/action",
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                         "Microsoft.KubernetesConfiguration/operations/read",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                         "Microsoft.HybridContainerService/register/action",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                         "Microsoft.HybridContainerService/skus/read",
|                                                         "Microsoft.HybridContainerService/skus/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Write",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "874d1c73-6003-4e60-a13a-cb31ea190a85",
|                                         "Name":  "Azure Stack HCI VM Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can perform VM actions but lacks identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/VirtualMachines/*",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/*",
|                                                         "Microsoft.AzureStackHCI/NetworkInterfaces/*",
|                                                         "Microsoft.AzureStackHCI/VirtualHardDisks/*",
|                                                         "Microsoft.AzureStackHCI/VirtualNetworks/Read",
|                                                         "Microsoft.AzureStackHCI/VirtualNetworks/join/action",
|                                                         "Microsoft.AzureStackHCI/LogicalNetworks/Read",
|                                                         "Microsoft.AzureStackHCI/LogicalNetworks/join/action",
|                                                         "Microsoft.AzureStackHCI/GalleryImages/Read",
|                                                         "Microsoft.AzureStackHCI/GalleryImages/deploy/action",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/deploy/action",
|                                                         "Microsoft.AzureStackHCI/MarketplaceGalleryImages/Read",
|                                                         "Microsoft.AzureStackHCI/MarketPlaceGalleryImages/deploy/action",
|                                                         "Microsoft.AzureStackHCI/Clusters/Read",
|                                                         "Microsoft.AzureStackHCI/Clusters/ArcSettings/Read",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/Read",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                         "Microsoft.HybridCompute/machines/installPatches/action",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                         "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/write",
|                                                         "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                         "Microsoft.HybridCompute/licenses/read",
|                                                         "Microsoft.HybridCompute/licenses/write",
|                                                         "Microsoft.HybridCompute/licenses/delete",
|                                                         "Microsoft.ExtendedLocation/customLocations/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4b3fe76c-f777-4d24-a2d7-b027b0f7b273",
|                                         "Name":  "Azure Stack HCI VM Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to VMs; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/VirtualMachines/Read",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/Read",
|                                                         "Microsoft.AzureStackHCI/VirtualMachines/Extensions/Read",
|                                                         "Microsoft.AzureStackHCI/VirtualNetworks/Read",
|                                                         "Microsoft.AzureStackHCI/LogicalNetworks/Read",
|                                                         "Microsoft.AzureStackHCI/NetworkInterfaces/Read",
|                                                         "Microsoft.AzureStackHCI/VirtualHardDisks/Read",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                         "Microsoft.AzureStackHCI/GalleryImages/Read",
|                                                         "Microsoft.AzureStackHCI/MarketplaceGalleryImages/Read",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/Read",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read",
|                                                         "Microsoft.HybridCompute/licenses/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/privateLinkScopes/networkSecurityPerimeterConfigurations/read",
|                                                         "Microsoft.HybridCompute/privateLinkScopes/privateEndpointConnections/read",
|                                                         "Microsoft.HybridCompute/privateLinkScopes/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "64702f94-c441-49e6-a78b-ef80e0188fee",
|                                         "Name":  "Azure AI Developer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage Azure AI resources but lacks permissions to assign roles or modify identity plane controls.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/*/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/*/action",
|                                                         "Microsoft.MachineLearningServices/workspaces/*/delete",
|                                                         "Microsoft.MachineLearningServices/workspaces/*/write",
|                                                         "Microsoft.MachineLearningServices/locations/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.MachineLearningServices/workspaces/delete",
|                                                            "Microsoft.MachineLearningServices/workspaces/write",
|                                                            "Microsoft.MachineLearningServices/workspaces/listKeys/action",
|                                                            "Microsoft.MachineLearningServices/workspaces/hubs/write",
|                                                            "Microsoft.MachineLearningServices/workspaces/hubs/delete",
|                                                            "Microsoft.MachineLearningServices/workspaces/featurestores/write",
|                                                            "Microsoft.MachineLearningServices/workspaces/featurestores/delete",
|                                                            "Microsoft.MachineLearningServices/workspaces/evaluations/results/labels/read",
|                                                            "Microsoft.MachineLearningServices/workspaces/evaluations/results/reasonings/read",
|                                                            "Microsoft.MachineLearningServices/workspaces/simulations/results/images/read"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/*",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*",
|                                                             "Microsoft.CognitiveServices/accounts/ContentSafety/*",
|                                                             "Microsoft.CognitiveServices/accounts/MaaS/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "eb960402-bf75-4cc3-8d68-35b34f960f72",
|                                         "Name":  "Deployment Environments Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to environment resources with no ability to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.DevCenter/projects/read",
|                                                         "Microsoft.DevCenter/projects/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.DevCenter/projects/pools/read",
|                                                            "Microsoft.DevCenter/projects/pools/schedules/read"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DevCenter/projects/users/environments/adminRead/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminActionRead/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminOutputsRead/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1d8c3fe3-8864-474b-8749-01e3783e8157",
|                                         "Name":  "EventGrid Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can send and receive event grid events but cannot modify identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.EventGrid/topics/read",
|                                                         "Microsoft.EventGrid/domains/read",
|                                                         "Microsoft.EventGrid/partnerNamespaces/read",
|                                                         "Microsoft.EventGrid/namespaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventGrid/events/send/action",
|                                                             "Microsoft.EventGrid/events/receive/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "78cbd9e7-9798-4e2e-9b5a-547d9ebb31fb",
|                                         "Name":  "EventGrid Data Receiver",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Receive-only access to event grid events with no path to identity or role control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.EventGrid/namespaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventGrid/events/receive/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3afb7f49-54cb-416e-8c09-6dc049efa503",
|                                         "Name":  "Azure AI Inference Deployment Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create resource deployments but lacks permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Insights/AutoscaleSettings/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "65a14201-8f6c-4c28-bec4-12619c5a9aaa",
|                                         "Name":  "Connected Cluster Managed Identity CheckAccess Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to checkAccess API with no ability to escalate privileges or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c64499e0-74c3-47ad-921c-13865957895c",
|                                         "Name":  "Advisor Reviews Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to advisor reviews and recommendations without identity or role modification rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Advisor/resiliencyReviews/read",
|                                                         "Microsoft.Advisor/triageRecommendations/read",
|                                                         "Microsoft.Advisor/triageResources/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8aac15f0-d885-4138-8afa-bfb5872f7d13",
|                                         "Name":  "Advisor Reviews Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can triage recommendations but cannot assign roles or modify identity plane controls.",
|                                         "Actions":  [
|                                                         "Microsoft.Advisor/resiliencyReviews/read",
|                                                         "Microsoft.Advisor/triageRecommendations/read",
|                                                         "Microsoft.Advisor/triageRecommendations/approve/action",
|                                                         "Microsoft.Advisor/triageRecommendations/reject/action",
|                                                         "Microsoft.Advisor/triageRecommendations/reset/action",
|                                                         "Microsoft.Advisor/triageResources/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a8d4b70f-0fb9-4f72-b267-b87b2f990aec",
|                                         "Name":  "AgFood Platform Dataset Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access limited to dataset APIs with no identity or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/datasets/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/datasetRecords/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "662802e2-50f6-46b0-aed2-e834bacc6d12",
|                                         "Name":  "Azure Front Door Profile Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Azure Front Door profiles with no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cdn/edgenodes/read",
|                                                         "Microsoft.Cdn/operationresults/*",
|                                                         "Microsoft.Cdn/profiles/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Cdn/operationresults/profileresults/afdendpointresults/CheckCustomDomainDNSMappingStatus/action",
|                                                         "Microsoft.Cdn/profiles/queryloganalyticsmetrics/action",
|                                                         "Microsoft.Cdn/profiles/queryloganalyticsrankings/action",
|                                                         "Microsoft.Cdn/profiles/querywafloganalyticsmetrics/action",
|                                                         "Microsoft.Cdn/profiles/querywafloganalyticsrankings/action",
|                                                         "Microsoft.Cdn/profiles/afdendpoints/CheckCustomDomainDNSMappingStatus/action",
|                                                         "Microsoft.Cdn/profiles/Usages/action",
|                                                         "Microsoft.Cdn/profiles/afdendpoints/Usages/action",
|                                                         "Microsoft.Cdn/profiles/origingroups/Usages/action",
|                                                         "Microsoft.Cdn/profiles/rulesets/Usages/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "86fede04-b259-4277-8c3e-e26b9865abd8",
|                                         "Name":  "Enclave Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to enclave resources without ability to modify roles or identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/communities/read",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/read",
|                                                         "Microsoft.Mission/communities/transitHubs/read",
|                                                         "Microsoft.Mission/enclaveConnections/read",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                         "Microsoft.Mission/approvals/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b5092dac-c796-4349-8681-1a322a31c3f9",
|                                         "Name":  "Azure Kubernetes Service Hybrid Cluster Admin Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list cluster admin credentials but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/listAdminKubeconfig/action",
|                                                         "Microsoft.Kubernetes/connectedClusters/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fc3f91a1-40bf-4439-8c46-45edbd83563a",
|                                         "Name":  "Azure Kubernetes Service Hybrid Cluster User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list user cluster credentials but lacks role assignment or identity plane modification rights.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/listUserKubeconfig/action",
|                                                         "Microsoft.Kubernetes/connectedClusters/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e7037d40-443a-4434-a3fb-8cd202011e1d",
|                                         "Name":  "Azure Kubernetes Service Hybrid Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read/write hybrid clusters but no direct path to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridContainerService/Locations/operationStatuses/read",
|                                                         "Microsoft.HybridContainerService/Operations/read",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/delete",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/write",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/delete",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/write",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/delete",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/upgradeProfiles/read",
|                                                         "Microsoft.HybridContainerService/skus/read",
|                                                         "Microsoft.HybridContainerService/skus/write",
|                                                         "Microsoft.HybridContainerService/skus/delete",
|                                                         "Microsoft.HybridContainerService/virtualNetworks/read",
|                                                         "Microsoft.HybridContainerService/virtualNetworks/write",
|                                                         "Microsoft.HybridContainerService/virtualNetworks/delete",
|                                                         "Microsoft.Kubernetes/connectedClusters/Read",
|                                                         "Microsoft.Kubernetes/connectedClusters/Write",
|                                                         "Microsoft.Kubernetes/connectedClusters/Delete",
|                                                         "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3d5f3eff-eb94-473d-91e3-7aac74d6c0bb",
|                                         "Name":  "Enclave Owner Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage enclave resources but lacks permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/write",
|                                                         "Microsoft.Mission/virtualEnclaves/delete",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/delete",
|                                                         "Microsoft.Mission/communities/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/read",
|                                                         "Microsoft.Mission/communities/transitHubs/read",
|                                                         "Microsoft.Mission/enclaveConnections/read",
|                                                         "Microsoft.Mission/enclaveConnections/write",
|                                                         "Microsoft.Mission/enclaveConnections/delete",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/write",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/delete",
|                                                         "Microsoft.Mission/approvals/read",
|                                                         "Microsoft.Mission/approvals/write",
|                                                         "Microsoft.Mission/approvals/delete",
|                                                         "Microsoft.Mission/virtualEnclaves/setWorkloadRoleAssignments/action",
|                                                         "Microsoft.Mission/virtualEnclaves/setEnclaveRoleAssignments/action",
|                                                         "Microsoft.Mission/virtualenclaves/setMaintenanceMode/action",
|                                                         "Microsoft.Mission/virtualEnclaves/setSubnetConfiguration/action",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/connect/action",
|                                                         "Microsoft.Mission/enclaveConnections/setSourceCidr/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e6aadb6b-e64f-41c0-9392-d2bba3bc3ebc",
|                                         "Name":  "Community Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to community resources without role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/communities/read",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/read",
|                                                         "Microsoft.Mission/communities/transitHubs/read",
|                                                         "Microsoft.Mission/enclaveConnections/read",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                         "Microsoft.Mission/approvals/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "19feefae-eacc-4106-81fd-ac34c0671f14",
|                                         "Name":  "Enclave Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can contribute to enclave resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/register/action",
|                                                         "Microsoft.Mission/unregister/action",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/communities/read",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/write",
|                                                         "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                         "Microsoft.Mission/virtualEnclaves/endpoints/write",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/read",
|                                                         "Microsoft.Mission/communities/transitHubs/read",
|                                                         "Microsoft.Mission/enclaveConnections/read",
|                                                         "Microsoft.Mission/enclaveConnections/write",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/write",
|                                                         "Microsoft.Mission/approvals/read",
|                                                         "Microsoft.Mission/approvals/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "44f0a1a8-6fea-4b35-980a-8ff50c487c97",
|                                         "Name":  "Operator Nexus Key Vault Writer Service Role (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Key Vault vaults with no role assignment or identity plane permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.KeyVault/vaults/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/secrets/setSecret/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a316ed6d-1efe-48ac-ac08-f7995a9c26fb",
|                                         "Name":  "Storage Account Encryption Scope Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage encryption scopes but lacks permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/encryptionScopes/read",
|                                                         "Microsoft.Storage/storageAccounts/encryptionScopes/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "08bbd89e-9f13-488c-ac41-acfcb10c90ab",
|                                         "Name":  "Key Vault Crypto Service Release User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Key release permissions limited to key vault data plane; no identity or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/keys/release/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0cd9749a-3aaf-4ae5-8803-bd217705bf3b",
|                                         "Name":  "Kubernetes Runtime Storage Class Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage Kubernetes storage classes but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.KubernetesRuntime/storageClasses/read",
|                                                         "Microsoft.KubernetesRuntime/storageClasses/write",
|                                                         "Microsoft.KubernetesRuntime/storageClasses/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "609c0c20-e0a0-4a71-b99f-e7e755ac493d",
|                                         "Name":  "Azure Programmable Connectivity Gateway User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to gateway dataplane APIs without role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "db79e9a7-68ee-4b58-9aeb-b90e7c24fcba",
|                                         "Name":  "Key Vault Certificate User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to certificates with no ability to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/certificates/read",
|                                                             "Microsoft.KeyVault/vaults/secrets/getSecret/action",
|                                                             "Microsoft.KeyVault/vaults/secrets/readMetadata/action",
|                                                             "Microsoft.KeyVault/vaults/keys/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4301dc2a-25a9-44b0-ae63-3636cf7f2bd2",
|                                         "Name":  "Azure Spring Apps Spring Cloud Gateway Log Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to logs with no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.AppPlatform/Spring/read",
|                                                         "Microsoft.AppPlatform/Spring/gateways/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/SpringCloudGateway/logstream/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "52fd16bd-6ed5-46af-9c40-29cbd7952a29",
|                                         "Name":  "Azure Spring Apps Managed Components Log Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to managed components logs without role assignment or identity plane rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/managedComponents/logstream/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6593e776-2a30-40f9-8a32-4fe28b77655d",
|                                         "Name":  "Azure Spring Apps Application Configuration Service Log Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to application configuration logs with no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppPlatform/Spring/read",
|                                                         "Microsoft.AppPlatform/Spring/configurationServices/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/ApplicationConfigurationService/logstream/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "207bcc4b-86a6-4487-9141-d6c1f4c238aa",
|                                         "Name":  "Azure Edge On-Site Deployment Engineer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to order items read-only with no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.EdgeOrder/orderItems/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c7244dfb-f447-457d-b2ba-3999044d1706",
|                                         "Name":  "Azure API Center Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to API Center data with no role assignment or identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ApiCenter/services/*/read",
|                                                             "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/exportSpecification/action",
|                                                             "Microsoft.ApiCenter/services/workspaces/search/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dfb2f09d-25f8-4558-8986-497084006d7a",
|                                         "Name":  "Azure impact-insight reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to impact insight data without permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Impact/WorkloadImpacts/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8bb6f106-b146-4ee6-a3f9-b9c5a96e0ae5",
|                                         "Name":  "Defender Kubernetes Agent Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can provision Kubernetes defender agent but lacks role assignment or identity plane modification rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.Kubernetes/connectedClusters/Write",
|                                                         "Microsoft.Kubernetes/connectedClusters/read",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                         "Microsoft.Kubernetes/register/action",
|                                                         "Microsoft.KubernetesConfiguration/register/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5b7237c5-45e1-49d6-bc18-a1f62f400748",
|                                         "Name":  "Azure Red Hat OpenShift Disk Storage Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage storage drivers and snapshots but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/read",
|                                                         "Microsoft.Compute/snapshots/write",
|                                                         "Microsoft.Compute/snapshots/read",
|                                                         "Microsoft.Compute/snapshots/delete",
|                                                         "Microsoft.Compute/locations/operations/read",
|                                                         "Microsoft.Compute/locations/DiskOperations/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4436bae4-7702-4c84-919b-c4069ff25ee2",
|                                         "Name":  "Azure Red Hat OpenShift Service Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage network and monitoring features without role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                         "Microsoft.Network/networkIntentPolicies/join/action",
|                                                         "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Storage/storageAccounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0d7aedc0-15fd-4a67-a412-efad370c947e",
|                                         "Name":  "Azure Red Hat OpenShift File Storage Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage file storage and keys but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/delete",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/delete",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/write",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/privateEndpoints/write",
|                                                         "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action",
|                                                         "Microsoft.Network/networkIntentPolicies/join/action",
|                                                         "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Network/privateDnsOperationStatuses/read",
|                                                         "Microsoft.Network/privateDnsZones/read",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                         "Microsoft.Network/privateDnsZones/write",
|                                                         "Microsoft.Network/privateDnsZones/join/action",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                         "Microsoft.Network/privateEndpoints/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8b32b316-c2f5-4ddf-b05b-83dacd2d08b5",
|                                         "Name":  "Azure Red Hat OpenShift Image Registry Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage image registry storage and containers without role assignment or identity plane rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/delete",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Resources/tags/write",
|                                                         "Microsoft.Network/privateEndpoints/write",
|                                                         "Microsoft.Network/privateEndpoints/read",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                         "Microsoft.Network/privateDnsZones/read",
|                                                         "Microsoft.Network/privateDnsZones/write",
|                                                         "Microsoft.Network/privateDnsZones/join/action",
|                                                         "Microsoft.Network/privateDnsZones/A/write",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/join/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "be7a6435-15ae-4171-8f30-4a343eff9e8f",
|                                         "Name":  "Azure Red Hat OpenShift Network Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage networking components with no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                         "Microsoft.Compute/virtualMachines/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a1f96423-95ce-4224-ab27-4e3dc72facd4",
|                                         "Name":  "Azure Red Hat OpenShift Cloud Controller Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage cloud controller components without role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/write",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/write",
|                                                         "Microsoft.Network/publicIPAddresses/join/action",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/publicIPAddresses/write",
|                                                         "Microsoft.Network/publicIPAddresses/delete",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/publicIPPrefixes/join/action",
|                                                         "Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/privatelinkservices/write",
|                                                         "Microsoft.Network/privatelinkservices/read",
|                                                         "Microsoft.Network/privatelinkservices/delete",
|                                                         "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                         "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/networkIntentPolicies/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0358943c-7e01-48ba-8889-02cc51d78637",
|                                         "Name":  "Azure Red Hat OpenShift Machine API Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage machine lifecycle but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/availabilitySets/delete",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/availabilitySets/write",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/galleries/images/versions/read",
|                                                         "Microsoft.Compute/skus/read",
|                                                         "Microsoft.Compute/virtualMachines/delete",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/capacityReservationGroups/deploy/action",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
|                                                         "Microsoft.Network/applicationSecurityGroups/read",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/write",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/write",
|                                                         "Microsoft.Network/publicIPAddresses/delete",
|                                                         "Microsoft.Network/publicIPAddresses/join/action",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/publicIPAddresses/write",
|                                                         "Microsoft.Network/routeTables/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action",
|                                                         "Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action",
|                                                         "Microsoft.Network/loadBalancers/inboundNATRules/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0336e1d3-7a87-462b-b6db-342b63f7802c",
|                                         "Name":  "Azure Red Hat OpenShift Cluster Ingress Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage OpenShift router configuration without role assignment or identity plane rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/dnsZones/A/delete",
|                                                         "Microsoft.Network/dnsZones/A/write",
|                                                         "Microsoft.Network/privateDnsZones/A/delete",
|                                                         "Microsoft.Network/privateDnsZones/A/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5a382001-fe36-41ff-bba4-8bf06bd54da9",
|                                         "Name":  "Azure Sphere Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Azure Sphere resources and RBAC configuration but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureSphere/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/DiagnosticSettings/*",
|                                                         "Microsoft.Insights/DiagnosticSettingsCategories/Read",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e2217c0e-04bb-4724-9580-91cf9871bc01",
|                                         "Name":  "GroupQuota Request Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and read quota requests but lacks permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "MICROSOFT.QUOTA/QUOTAS/WRITE",
|                                                         "MICROSOFT.QUOTA/QUOTAS/READ",
|                                                         "MICROSOFT.QUOTA/USAGES/READ",
|                                                         "MICROSOFT.QUOTA/QUOTAREQUESTS/READ",
|                                                         "MICROSOFT.QUOTA/REGISTER/ACTION",
|                                                         "Microsoft.Quota/GROUPQUOTAS/*/READ",
|                                                         "Microsoft.Quota/GROUPQUOTAS/*/WRITE",
|                                                         "Microsoft.Quota/GROUPQUOTAS/*/DELETE"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d0f495dc-44ef-4140-aeb0-b89110e6a7c1",
|                                         "Name":  "GroupQuota Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to quota requests with no role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "MICROSOFT.QUOTA/QUOTAS/READ",
|                                                         "MICROSOFT.QUOTA/USAGES/READ",
|                                                         "MICROSOFT.QUOTA/QUOTAREQUESTS/READ",
|                                                         "MICROSOFT.QUOTA/REGISTER/ACTION",
|                                                         "Microsoft.Quota/GROUPQUOTAS/READ",
|                                                         "Microsoft.Quota/GROUPQUOTAS/subscriptions/READ",
|                                                         "Microsoft.Quota/GROUPQUOTAS/groupQuotaLimits/READ",
|                                                         "Microsoft.Quota/GROUPQUOTAS/quotaAllocations/READ"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "539283cd-c185-4a9a-9503-d35217a1db7b",
|                                         "Name":  "Bayer Ag Powered Services Smart Boundary Solution User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access limited to Smart Boundary Solution with no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8480c0f0-4509-4229-9339-7c10018cb8c4",
|                                         "Name":  "Defender CSPM Storage Scanner Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can enable and configure Defender CSPM features but lacks role assignment or identity plane modification rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Security/datascanners/read",
|                                                         "Microsoft.Security/datascanners/write",
|                                                         "Microsoft.Security/dataScanners/delete",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6b534d80-e337-47c4-864f-140f5c7f593d",
|                                         "Name":  "Advisor Recommendations Contributor (Assessments and Reviews)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage advisor recommendations lifecycle without permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Advisor/recommendations/read",
|                                                         "Microsoft.Advisor/recommendations/write",
|                                                         "Microsoft.Advisor/recommendations/available/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c9c97b9c-105d-4bb5-a2a7-7d15666c2484",
|                                         "Name":  "GeoCatalog Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of GeoCatalogs but no ability to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Orbital/operations/read",
|                                                         "Microsoft.Orbital/geoCatalogs/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b7b8f583-43d0-40ae-b147-6b46f53661c1",
|                                         "Name":  "GeoCatalog Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to GeoCatalogs with no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Orbital/operations/read",
|                                                         "Microsoft.Orbital/geoCatalogs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "eb5a76d5-50e7-4c33-a449-070e7c9c4cf2",
|                                         "Name":  "Healthcare Agent Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to bot resources without permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthBot/healthBots/ResourceData/Read",
|                                                             "Microsoft.HealthBot/healthBots/Metadata/Read",
|                                                             "Microsoft.HealthBot/healthBots/CopilotStudioSolution/RestoreBuiltinTemplate/Read",
|                                                             "Microsoft.HealthBot/healthBots/Feedback/Read",
|                                                             "Microsoft.HealthBot/healthBots/Users/Read",
|                                                             "Microsoft.HealthBot/healthBots/AuditTrails/Read",
|                                                             "Microsoft.HealthBot/healthBots/AnalyticReport/Read",
|                                                             "Microsoft.HealthBot/healthBots/ExposedSkill/Read",
|                                                             "Microsoft.HealthBot/healthBots/RegisteredSkills/Read",
|                                                             "Microsoft.HealthBot/healthBots/Configuration/Read",
|                                                             "Microsoft.HealthBot/healthBots/Localization/Read",
|                                                             "Microsoft.HealthBot/healthBots/AuthenticationProviders/Read",
|                                                             "Microsoft.HealthBot/healthBots/DataConnections/Read",
|                                                             "Microsoft.HealthBot/healthBots/OpenAPIPlugins/Read",
|                                                             "Microsoft.HealthBot/healthBots/Scenarios/*/Read",
|                                                             "Microsoft.HealthBot/healthBots/LanguageModels/Read",
|                                                             "Microsoft.HealthBot/healthBots/Resources/Files/Read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "af854a69-80ce-4ff7-8447-f1118a2e0ca8",
|                                         "Name":  "Healthcare Agent Editor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Edit bot resources except keys and secrets; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthBot/healthBots/ResourceData/Read",
|                                                             "Microsoft.HealthBot/healthBots/Metadata/Read",
|                                                             "Microsoft.HealthBot/healthBots/CopilotStudioSolution/*",
|                                                             "Microsoft.HealthBot/healthBots/Feedback/Read",
|                                                             "Microsoft.HealthBot/healthBots/Users/Read",
|                                                             "Microsoft.HealthBot/healthBots/AuditTrails/Read",
|                                                             "Microsoft.HealthBot/healthBots/AnalyticReport/Read",
|                                                             "Microsoft.HealthBot/healthBots/ExposedSkill/Read",
|                                                             "Microsoft.HealthBot/healthBots/RegisteredSkills/Read",
|                                                             "Microsoft.HealthBot/healthBots/Configuration/*",
|                                                             "Microsoft.HealthBot/healthBots/Localization/*",
|                                                             "Microsoft.HealthBot/healthBots/AuthenticationProviders/*",
|                                                             "Microsoft.HealthBot/healthBots/Channels/*",
|                                                             "Microsoft.HealthBot/healthBots/DataConnections/*",
|                                                             "Microsoft.HealthBot/healthBots/OpenAPIPlugins/*",
|                                                             "Microsoft.HealthBot/healthBots/Scenarios/*",
|                                                             "Microsoft.HealthBot/healthBots/LanguageModels/*",
|                                                             "Microsoft.HealthBot/healthBots/Resources/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f1082fec-a70f-419f-9230-885d2550fb38",
|                                         "Name":  "Healthcare Agent Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to bot resources including keys and secrets but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthBot/healthBots/ResourceData/Read",
|                                                             "Microsoft.HealthBot/healthBots/Metadata/Read",
|                                                             "Microsoft.HealthBot/healthBots/CopilotStudioSolution/*",
|                                                             "Microsoft.HealthBot/healthBots/Feedback/Read",
|                                                             "Microsoft.HealthBot/healthBots/Users/Read",
|                                                             "Microsoft.HealthBot/healthBots/AuditTrails/Read",
|                                                             "Microsoft.HealthBot/healthBots/AnalyticReport/Read",
|                                                             "Microsoft.HealthBot/healthBots/ExposedSkill/Read",
|                                                             "Microsoft.HealthBot/healthBots/RegisteredSkills/Read",
|                                                             "Microsoft.HealthBot/healthBots/Configuration/*",
|                                                             "Microsoft.HealthBot/healthBots/Localization/*",
|                                                             "Microsoft.HealthBot/healthBots/AuthenticationProviders/*",
|                                                             "Microsoft.HealthBot/healthBots/Channels/*",
|                                                             "Microsoft.HealthBot/healthBots/DataConnections/*",
|                                                             "Microsoft.HealthBot/healthBots/OpenAPIPlugins/*",
|                                                             "Microsoft.HealthBot/healthBots/Scenarios/*",
|                                                             "Microsoft.HealthBot/healthBots/LanguageModels/*",
|                                                             "Microsoft.HealthBot/healthBots/Resources/*",
|                                                             "Microsoft.HealthBot/healthBots/Admin/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c20923c5-b089-47a5-bf67-fd89569c4ad9",
|                                         "Name":  "Azure Programmable Connectivity Gateway Dataplane User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and limited write access to resource health and deployments; no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ProgrammableConnectivity/Gateways/NetworkAPIAccess"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b556d68e-0be0-4f35-a333-ad7ee1ce17ea",
|                                         "Name":  "Azure AI Enterprise Network Connection Approver",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can approve private endpoint connections but lacks permissions to escalate to identity plane or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/privateEndpointConnections/read",
|                                                         "Microsoft.ApiManagement/service/privateEndpointConnections/write",
|                                                         "Microsoft.ApiManagement/service/privateLinkResources/read",
|                                                         "Microsoft.ApiManagement/service/read",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/write",
|                                                         "Microsoft.Cache/redis/read",
|                                                         "Microsoft.Cache/redis/privateEndpointConnections/read",
|                                                         "Microsoft.Cache/redis/privateEndpointConnections/write",
|                                                         "Microsoft.Cache/redis/privateLinkResources/read",
|                                                         "Microsoft.Cache/redis/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Cache/redisEnterprise/read",
|                                                         "Microsoft.Cache/redisEnterprise/privateEndpointConnections/read",
|                                                         "Microsoft.Cache/redisEnterprise/privateEndpointConnections/write",
|                                                         "Microsoft.Cache/redisEnterprise/privateLinkResources/read",
|                                                         "Microsoft.Cache/redisEnterprise/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.CognitiveServices/accounts/read",
|                                                         "Microsoft.CognitiveServices/accounts/privateEndpointConnections/read",
|                                                         "Microsoft.CognitiveServices/accounts/privateEndpointConnections/write",
|                                                         "Microsoft.CognitiveServices/accounts/privateLinkResources/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/write",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/privateLinkResources/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/read",
|                                                         "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/read",
|                                                         "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/write",
|                                                         "Microsoft.DBforPostgreSQL/serverGroupsv2/privateLinkResources/read",
|                                                         "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/read",
|                                                         "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/write",
|                                                         "Microsoft.DBforMySQL/flexibleServers/privateLinkResources/read",
|                                                         "Microsoft.DBforMySQL/flexibleServers/read",
|                                                         "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/operationResults/read",
|                                                         "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/read",
|                                                         "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write",
|                                                         "Microsoft.DocumentDB/databaseAccounts/privateLinkResources/read",
|                                                         "Microsoft.DocumentDB/databaseAccounts/read",
|                                                         "Microsoft.KeyVault/vaults/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.KeyVault/vaults/privateEndpointConnections/read",
|                                                         "Microsoft.KeyVault/vaults/privateEndpointConnections/write",
|                                                         "Microsoft.KeyVault/vaults/privateLinkResources/read",
|                                                         "Microsoft.KeyVault/vaults/read",
|                                                         "Microsoft.MachineLearningServices/registries/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.MachineLearningServices/registries/privateEndpointConnections/read",
|                                                         "Microsoft.MachineLearningServices/registries/privateEndpointConnections/write",
|                                                         "Microsoft.MachineLearningServices/registries/privateLinkResources/read",
|                                                         "Microsoft.MachineLearningServices/registries/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/write",
|                                                         "Microsoft.MachineLearningServices/workspaces/privateLinkResources/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/read",
|                                                         "Microsoft.Storage/storageAccounts/privateEndpointConnections/read",
|                                                         "Microsoft.Storage/storageAccounts/privateEndpointConnections/write",
|                                                         "Microsoft.Storage/storageAccounts/privateLinkResources/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Sql/servers/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Sql/servers/privateEndpointConnections/read",
|                                                         "Microsoft.Sql/servers/privateEndpointConnections/write",
|                                                         "Microsoft.Sql/servers/privateLinkResources/read",
|                                                         "Microsoft.Sql/servers/read",
|                                                         "Microsoft.EventHub/namespaces/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.EventHub/namespaces/privateEndpointConnections/read",
|                                                         "Microsoft.EventHub/namespaces/privateEndpointConnections/write",
|                                                         "Microsoft.EventHub/namespaces/privateLinkResources/read",
|                                                         "Microsoft.EventHub/namespaces/read",
|                                                         "Microsoft.Search/searchServices/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Search/searchServices/privateEndpointConnections/read",
|                                                         "Microsoft.Search/searchServices/privateEndpointConnections/write",
|                                                         "Microsoft.Search/searchServices/sharedPrivateLinkResources/read",
|                                                         "Microsoft.Search/searchServices/read",
|                                                         "Microsoft.Insights/privatelinkscopes/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/read",
|                                                         "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/write",
|                                                         "Microsoft.Insights/privatelinkscopes/privateLinkResources/read",
|                                                         "Microsoft.Insights/privatelinkscopes/read",
|                                                         "Microsoft.Network/privateLinkServices/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Network/privateLinkServices/privateEndpointConnections/read",
|                                                         "Microsoft.Network/privateLinkServices/privateEndpointConnections/write",
|                                                         "Microsoft.Network/privateLinkServices/read",
|                                                         "Microsoft.Network/applicationGateways/privateEndpointConnections/read",
|                                                         "Microsoft.Network/applicationGateways/privateEndpointConnections/write",
|                                                         "Microsoft.Network/applicationGateways/privateLinkResources/read",
|                                                         "Microsoft.Network/applicationGateways/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "08d4c71a-cc63-4ce4-a9c8-5dd251b4d619",
|                                         "Name":  "Azure Container Storage Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages container storage network and virtual network settings but no direct identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ElasticSan/elasticSans/*",
|                                                         "Microsoft.ElasticSan/locations/asyncoperations/read",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/virtualNetworks/write",
|                                                         "Microsoft.Network/virtualNetworks/delete",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/write",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                         "Microsoft.Resources/subscriptions/providers/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "95dd08a6-00bd-4661-84bf-f6726f83a4d0",
|                                         "Name":  "Azure Container Storage Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage container storage extensions and read authorizations but no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "95de85bd-744d-4664-9dde-11430bc34793",
|                                         "Name":  "Azure Container Storage Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to container storage resources but no permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.ElasticSan/elasticSans/*",
|                                                         "Microsoft.ElasticSan/locations/*",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/*",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/*",
|                                                         "Microsoft.ElasticSan/locations/asyncoperations/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d3f1697-4507-4d08-bb4a-477695db5f82",
|                                         "Name":  "Azure Kubernetes Service Arc Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write access to hybrid Kubernetes clusters without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridContainerService/Locations/operationStatuses/read",
|                                                         "Microsoft.HybridContainerService/Locations/operationStatuses/write",
|                                                         "Microsoft.HybridContainerService/Operations/read",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/delete",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/write",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/delete",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/write",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/delete",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/upgradeProfiles/read",
|                                                         "Microsoft.HybridContainerService/skus/read",
|                                                         "Microsoft.HybridContainerService/skus/write",
|                                                         "Microsoft.HybridContainerService/skus/delete",
|                                                         "Microsoft.HybridContainerService/virtualNetworks/read",
|                                                         "Microsoft.HybridContainerService/virtualNetworks/write",
|                                                         "Microsoft.HybridContainerService/virtualNetworks/delete",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/read",
|                                                         "Microsoft.Kubernetes/connectedClusters/Read",
|                                                         "Microsoft.Kubernetes/connectedClusters/Write",
|                                                         "Microsoft.Kubernetes/connectedClusters/Delete",
|                                                         "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action",
|                                                         "Microsoft.AzureStackHCI/clusters/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/hybridIdentityMetadata/delete",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/hybridIdentityMetadata/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "233ca253-b031-42ff-9fba-87ef12d6b55f",
|                                         "Name":  "Azure Kubernetes Service Arc Cluster User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list cluster user credentials but no permissions to escalate or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/listUserKubeconfig/action",
|                                                         "Microsoft.Kubernetes/connectedClusters/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b29efa5f-7782-4dc3-9537-4d5bc70a5e9f",
|                                         "Name":  "Azure Kubernetes Service Arc Cluster Admin Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list cluster admin credentials but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/listAdminKubeconfig/action",
|                                                         "Microsoft.Kubernetes/connectedClusters/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c2a970b4-16a7-4a51-8c84-8a8ea6ee0bb8",
|                                         "Name":  "Backup MUA Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create/delete ResourceGuards but no direct identity plane control or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.DataProtection/*/read",
|                                                         "Microsoft.DataProtection/*/resourceGuards/write",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/write",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/delete",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/read",
|                                                         "Microsoft.DataProtection/locations/operationResults/read",
|                                                         "Microsoft.DataProtection/locations/operationStatus/read",
|                                                         "Microsoft.DataProtection/locations/getBackupStatus/action",
|                                                         "Microsoft.DataProtection/locations/checkFeatureSupport/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/operationStatus/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/write",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/delete",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/unlockDelete/action",
|                                                         "Microsoft.DataProtection/subscriptions/providers/resourceGuards/read",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/{operationName}/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f54b6d04-23c6-443e-b462-9c16ab7b4a52",
|                                         "Name":  "Backup MUA Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can perform critical backup operations but no path to identity plane or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.DataProtection/*/action",
|                                                         "Microsoft.DataProtection/*/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3d24a3a0-c154-4f6f-a5ed-adc8e01ddb74",
|                                         "Name":  "Savings plan Purchaser",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can purchase savings plans but no permissions to modify roles or identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Capacity/register/action",
|                                                         "Microsoft.Capacity/catalogs/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.BillingBenefits/savingsPlanOrders/write",
|                                                         "Microsoft.BIllingBenefits/register/action",
|                                                         "Microsoft.Support/supporttickets/write",
|                                                         "Microsoft.Billing/billingProperty/read",
|                                                         "Microsoft.CostManagement/benefitRecommendations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "399c3b2b-64c2-4ff1-af34-571db925b068",
|                                         "Name":  "CrossConnectionManager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to ExpressRoute CrossConnections but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ClassicNetwork/expressRouteCrossConnections/*",
|                                                         "Microsoft.Network/expressRouteCrossConnections/*",
|                                                         "Microsoft.Features/providers/features/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Network/expressRouteCrossConnections/delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b6ee44de-fe58-4ddc-b5c2-ab174eb23f05",
|                                         "Name":  "CrossConnectionReader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to ExpressRoute CrossConnections; no identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ClassicNetwork/expressRouteCrossConnections/*/read",
|                                                         "Microsoft.Network/expressRouteCrossConnections/*/read",
|                                                         "Microsoft.Features/providers/features/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5e93ba01-8f92-4c7a-b12a-801e3df23824",
|                                         "Name":  "Defender Containers Sensor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to Kubernetes clusters and alert rules; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.ContainerService/managedClusters/read",
|                                                         "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete",
|                                                         "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read",
|                                                         "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write",
|                                                         "Microsoft.ContainerService/managedClusters/write",
|                                                         "Microsoft.Security/pricings/securityoperators/read",
|                                                         "Microsoft.Security/securityOperators/read",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedkeys/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ede9aaa3-4627-494e-be13-4aa7c256148d",
|                                         "Name":  "Azure API Center Compliance Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage API compliance but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiCenter/services/*/read",
|                                                         "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/updateAnalysisState/action",
|                                                         "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/exportSpecification/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6cba8790-29c5-48e5-bab1-c7541b01cb04",
|                                         "Name":  "Azure API Center Service Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to API Center service; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiCenter/services/*/read",
|                                                         "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/exportSpecification/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dd24193f-ef65-44e5-8a7e-6fa6e03f7713",
|                                         "Name":  "Azure API Center Service Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage API Center service but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiCenter/services/*",
|                                                         "Microsoft.ApiCenter/deletedServices/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/updateAnalysisState/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b5b192c1-773c-4543-bfb0-6c59254b74a9",
|                                         "Name":  "Bayer Ag Powered Services Historical Weather Data Solution User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No permissions specified; assumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/farms/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4caf51ec-f9f5-413f-8a94-b9f5fddba66b",
|                                         "Name":  "Oracle Subscriptions Manager Built-in Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Oracle subscription resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/write",
|                                                         "Oracle.Database/oracleSubscriptions/*/delete",
|                                                         "Oracle.Database/oracleSubscriptions/*/action",
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Locations/*/write",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4562aac9-b209-4bd7-a144-6d7f3bb516f4",
|                                         "Name":  "Oracle.Database Owner Built-in Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of Oracle database resources without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Oracle.Database/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Compute/sshPublicKeys/read",
|                                                         "Microsoft.Compute/sshPublicKeys/write",
|                                                         "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d623d097-b882-4e1e-a26f-ac60e31065a1",
|                                         "Name":  "Oracle.Database Reader Built-in Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Oracle database resources; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/cloudExadataInfrastructures/*/read",
|                                                         "Oracle.Database/cloudVmClusters/*/read",
|                                                         "Oracle.Database/cloudVmClusters/listPrivateIpAddresses/action",
|                                                         "Oracle.Database/oracleSubscriptions/listCloudAccountDetails/action",
|                                                         "Oracle.Database/exascaleDbStorageVaults/read",
|                                                         "Oracle.Database/exadbVmClusters/*/read",
|                                                         "Oracle.Database/resourceAnchors/read",
|                                                         "Oracle.Database/networkAnchors/read",
|                                                         "Oracle.Database/autonomousDatabases/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/locations/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e9ce8739-6fa2-4123-a0a2-0ef41a67806f",
|                                         "Name":  "Oracle.Database VmCluster Administrator Built-in Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of VmCluster resources but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Oracle.Database/cloudVmClusters/*/read",
|                                                         "Oracle.Database/cloudVmClusters/*/write",
|                                                         "Oracle.Database/cloudVmClusters/*/delete",
|                                                         "Oracle.Database/cloudExadataInfrastructures/write",
|                                                         "Oracle.Database/cloudExadataInfrastructures/*/read",
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Locations/*/write",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/resourceAnchors/*",
|                                                         "Oracle.Database/networkAnchors/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Compute/sshPublicKeys/read",
|                                                         "Microsoft.Compute/sshPublicKeys/write",
|                                                         "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4cfdd23b-aece-4fd1-b614-ad3a06c53453",
|                                         "Name":  "Oracle.Database Exadata Infrastructure Administrator Built-in Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of Exadata infrastructure resources without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Oracle.Database/cloudExadataInfrastructures/*/read",
|                                                         "Oracle.Database/cloudExadataInfrastructures/*/write",
|                                                         "Oracle.Database/cloudExadataInfrastructures/*/delete",
|                                                         "Oracle.Database/cloudVmClusters/*/read",
|                                                         "Oracle.Database/cloudVmClusters/*/write",
|                                                         "Oracle.Database/cloudVmClusters/*/delete",
|                                                         "Oracle.Database/cloudVmClusters/*/action",
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Locations/*/write",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/oracleSubscriptions/listCloudAccountDetails/action",
|                                                         "Oracle.Database/resourceAnchors/*",
|                                                         "Oracle.Database/networkAnchors/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Compute/sshPublicKeys/read",
|                                                         "Microsoft.Compute/sshPublicKeys/write",
|                                                         "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "25211fc6-dc78-40b6-b205-e4ac934fd9fd",
|                                         "Name":  "Azure Spring Apps Application Configuration Service Config File Pattern Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to configuration files only; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.AppPlatform/Spring/read",
|                                                         "Microsoft.AppPlatform/Spring/configurationServices/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/ApplicationConfigurationService/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f27b7598-bc64-41f7-8a44-855ff16326c2",
|                                         "Name":  "Azure Messaging Catalog Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to messaging catalog resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.MessagingCatalog/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MessagingCatalog/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d9c6a55-fc0e-4e21-ae6f-f7b095497342",
|                                         "Name":  "Azure Hybrid Database Administrator - Read Only Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to hybrid database services; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureArcData/*/read",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/getTelemetry/action",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/getDetailView/action",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c18f9900-27b8-47c7-a8f0-5b3b3d4c2bc2",
|                                         "Name":  "Microsoft Sentinel Business Applications Agent Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and update business application agents but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/read",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/write",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/systems/read",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/systems/write",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/systems/listActions/action",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/systems/reportActionStatus/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0fb8eba5-a2bb-4abe-b1c1-49dfad359bb0",
|                                         "Name":  "Azure ContainerApps Session Executor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and execute sessions but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/sessionPools/*/read",
|                                                         "Microsoft.App/sessionPools/sessions/generatesessions/action",
|                                                         "Microsoft.App/sessionPools/fetchMcpServerCredentials/action",
|                                                         "Microsoft.App/sessionPools/rotateMcpServerCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/sessionPools/*/read",
|                                                             "Microsoft.App/sessionPools/interpreters/execute/action",
|                                                             "Microsoft.App/sessionPools/interpreters/read",
|                                                             "Microsoft.App/sessionPools/executions/*",
|                                                             "Microsoft.App/sessionPools/files/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "83ee7727-862c-4213-8ed8-2ce6c5d69a40",
|                                         "Name":  "Microsoft.Edge Winfields federated subscription read access role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to federated subscriptions; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "39138f76-04e6-41f0-ba6b-c411b59081a9",
|                                         "Name":  "Bayer Ag Powered Services Crop Id Solution User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No permissions specified; assumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b67fe603-310e-4889-b9ee-8257d09d353d",
|                                         "Name":  "Scheduled Events Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can acknowledge scheduled events and read VM info but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Maintenance/scheduledevents/acknowledge/action",
|                                                         "Microsoft.Compute/VirtualMachines/read",
|                                                         "Microsoft.Compute/VirtualMachineScaleSets/read",
|                                                         "Microsoft.Compute/AvailabilitySets/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e82342c9-ac7f-422b-af64-e426d2e12b2d",
|                                         "Name":  "Compute Recommendations Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can generate placement scores but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/locations/placementScores/generate/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b459aa1d-e3c8-436f-ae21-c0531140f43e",
|                                         "Name":  "Azure Spring Apps Job Log Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to job logs only; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppPlatform/Spring/read",
|                                                         "Microsoft.AppPlatform/Spring/jobs/read",
|                                                         "Microsoft.AppPlatform/Spring/jobs/executions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/jobs/executions/logstream/action",
|                                                             "Microsoft.AppPlatform/Spring/jobs/executions/listInstances/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "91422e52-bb88-4415-bb4a-90f5b71f6dcb",
|                                         "Name":  "Azure Spring Apps Job Execution Instance List Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list job execution instances but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/jobs/executions/listInstances/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a5eb8433-97a5-4a06-80b2-a877e1622c31",
|                                         "Name":  "Nexus Network Fabric Service Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-write access to network fabric service but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedNetworkFabric/*/read",
|                                                         "Microsoft.ManagedNetworkFabric/*/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "05fdd44c-adc6-4aff-981c-61041f0c929a",
|                                         "Name":  "Nexus Network Fabric Service Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to network fabric service; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedNetworkFabric/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationStatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "adb29209-aa1d-457b-a786-c913953d2891",
|                                         "Name":  "Azure Deployment Stack Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage deployment stacks including deny assignments but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deploymentStacks/*",
|                                                         "Microsoft.Resources/deploymentStacksWhatIfResults/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bf7f8882-3383-422a-806a-6526c631a88a",
|                                         "Name":  "Azure Deployment Stack Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage deployment stacks without deny assignment creation; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deploymentStacks/write",
|                                                         "Microsoft.Resources/deploymentStacks/read",
|                                                         "Microsoft.Resources/deploymentStacks/validate/action",
|                                                         "Microsoft.Resources/deploymentStacks/exportTemplate/action",
|                                                         "Microsoft.Resources/deploymentStacksWhatIfResults/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "74252426-c508-480e-9345-4607bbebead4",
|                                         "Name":  "Azure Spring Apps Spring Cloud Config Server Log Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to config server logs only; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppPlatform/Spring/read",
|                                                         "Microsoft.AppPlatform/Spring/configServers/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/configService/logstream/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bfdb9389-c9a5-478a-bb2f-ba9ca092c3c7",
|                                         "Name":  "Container Registry Repository Catalog Lister",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list container registry repositories but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/catalog/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2efddaa5-3f1f-4df3-97df-af3f13818f4c",
|                                         "Name":  "Container Registry Repository Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read, write, and delete access to container registry repositories but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/write",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/write",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/delete",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b93aa761-3e63-49ed-ac28-beffa264f7ac",
|                                         "Name":  "Container Registry Repository Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to container registry repositories only; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2a1e307c-b015-4ebd-883e-5b7698a07328",
|                                         "Name":  "Container Registry Repository Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to container registry repositories but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/write",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "78e4b983-1a0b-472e-8b7d-8d770f7c5890",
|                                         "Name":  "DeID Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to DeID data but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthDataAIServices/DeidServices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "28bf596f-4eb7-45ce-b5bc-6cf482fec137",
|                                         "Name":  "Locks Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage resource locks but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/locks/read",
|                                                         "Microsoft.Authorization/locks/write",
|                                                         "Microsoft.Authorization/locks/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b1e6a0dd-ea0f-4108-8925-7047693f2cfe",
|                                         "Name":  "CloudTest Leased VM Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can view leased VM credentials but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.CloudTest/pools/leases/action",
|                                                         "Microsoft.CloudTest/pools/leases/complete/action",
|                                                         "Microsoft.CloudTest/pools/leases/extend/action",
|                                                         "Microsoft.CloudTest/hostedpools/leases/action",
|                                                         "Microsoft.CloudTest/hostedpools/leases/complete/action",
|                                                         "Microsoft.CloudTest/hostedpools/leases/extend/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "39fcb0de-8844-4706-b050-c28ddbe3ff83",
|                                         "Name":  "Standby Container Group Pool Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage standby container group pool resources but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ContainerInstance/containerGroupProfiles/read",
|                                                         "Microsoft.ContainerInstance/containerGroupProfiles/revisions/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.StandbyPool/Locations/OperationStatuses/read",
|                                                         "Microsoft.StandbyPool/Operations/read",
|                                                         "Microsoft.StandbyPool/standbyContainerGroupPools/delete",
|                                                         "Microsoft.StandbyPool/standbyContainerGroupPools/read",
|                                                         "Microsoft.StandbyPool/standbyContainerGroupPools/runtimeViews/read",
|                                                         "Microsoft.StandbyPool/standbyContainerGroupPools/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "85a2d0d9-2eba-4c9c-b355-11c2cc0788ab",
|                                         "Name":  "Compute Gallery Artifacts Publisher",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Publish gallery artifacts but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/galleries/*",
|                                                         "Microsoft.Compute/locations/capsOperations/read",
|                                                         "Microsoft.Compute/locations/communityGalleries/*",
|                                                         "Microsoft.Compute/locations/sharedGalleries/*",
|                                                         "Microsoft.Compute/images/*",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Compute/galleries/share/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c5826735-177b-4a0d-a9a3-d0e4b4bda107",
|                                         "Name":  "ToolchainOrchestrator Viewer Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to toolchain orchestrator resources; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ToolchainOrchestrator/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a3ab03bc-5350-42ff-b0d5-00207672db55",
|                                         "Name":  "ProviderHub Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows management of ProviderHub resources but explicitly does not allow role assignments or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ProviderHub/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4d8c6f2e-3fd6-4d40-826e-93e3dc4c3fc1",
|                                         "Name":  "ProviderHub Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to ProviderHub resources with no ability to modify or escalate privileges.",
|                                         "Actions":  [
|                                                         "Microsoft.ProviderHub/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c99c945f-8bd1-4fb1-a903-01460aae6068",
|                                         "Name":  "Azure Stack HCI Connected InfraVMs",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Azure Stack HCI VMs but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/*/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dfce8971-25e3-42e3-ba33-6055438e3080",
|                                         "Name":  "VM Restore Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and delete VM restore resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action",
|                                                         "Microsoft.Compute/disks/endGetAccess/action",
|                                                         "Microsoft.Compute/locations/diskOperations/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachines/delete",
|                                                         "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/write",
|                                                         "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/locations/operationResults/read",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Network/locations/usages/read",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                         "Microsoft.Network/publicIPAddresses/delete",
|                                                         "Microsoft.Network/publicIPAddresses/join/action",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/publicIPAddresses/write",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/checkNameAvailability/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4aa368ec-fba9-4e93-81ed-396b3d461cc5",
|                                         "Name":  "Operator Nexus Compute Contributor Role (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to authorization and diagnostic settings without role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/classicAdministrators/operationstatuses/read",
|                                                         "Microsoft.Authorization/classicAdministrators/read",
|                                                         "Microsoft.Authorization/denyAssignments/read",
|                                                         "Microsoft.Authorization/diagnosticSettings/read",
|                                                         "Microsoft.Authorization/diagnosticSettingsCategories/read",
|                                                         "Microsoft.Authorization/locks/read",
|                                                         "Microsoft.Authorization/operations/read",
|                                                         "Microsoft.Authorization/permissions/read",
|                                                         "Microsoft.Authorization/policyAssignments/read",
|                                                         "Microsoft.Authorization/policyAssignments/privateLinkAssociations/read",
|                                                         "Microsoft.Authorization/policyAssignments/resourceManagementPrivateLinks/read",
|                                                         "Microsoft.Authorization/policyAssignments/resourceManagementPrivateLinks/privateEndpointConnectionProxies/read",
|                                                         "Microsoft.Authorization/policyAssignments/resourceManagementPrivateLinks/privateEndpointConnections/read",
|                                                         "Microsoft.Authorization/policyDefinitions/read",
|                                                         "Microsoft.Authorization/policyExemptions/read",
|                                                         "Microsoft.Authorization/policySetDefinitions/read",
|                                                         "Microsoft.Authorization/providerOperations/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleAssignmentScheduleInstances/read",
|                                                         "Microsoft.Authorization/roleAssignmentScheduleRequests/read",
|                                                         "Microsoft.Authorization/roleAssignmentSchedules/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read",
|                                                         "Microsoft.Authorization/roleEligibilityScheduleInstances/read",
|                                                         "Microsoft.Authorization/roleEligibilityScheduleRequests/read",
|                                                         "Microsoft.Authorization/roleEligibilitySchedules/read",
|                                                         "Microsoft.Authorization/roleManagementPolicies/read",
|                                                         "Microsoft.Authorization/roleManagementPolicyAssignments/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.Insights/alertRules/activated/action",
|                                                         "Microsoft.Insights/alertRules/delete",
|                                                         "Microsoft.Insights/alertRules/incidents/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Insights/alertRules/resolved/action",
|                                                         "Microsoft.Insights/alertRules/throttled/action",
|                                                         "Microsoft.Insights/alertRules/write",
|                                                         "Microsoft.Kubernetes/connectedClusters/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.ManagedNetworkFabric/networkFabricControllers/join/action",
|                                                         "Microsoft.ManagedNetworkFabric/networkFabrics/join/action",
|                                                         "Microsoft.ManagedNetworkFabric/networkRacks/join/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/cordon/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/delete",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/powerOff/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/read",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/reimage/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/replace/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/restart/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/runDataExtracts/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/runReadCommands/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/start/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/uncordon/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/write",
|                                                         "Microsoft.NetworkCloud/clusterManagers/delete",
|                                                         "Microsoft.NetworkCloud/clusterManagers/read",
|                                                         "Microsoft.NetworkCloud/clusterManagers/write",
|                                                         "Microsoft.NetworkCloud/clusters/bareMetalMachineKeySets/read",
|                                                         "Microsoft.NetworkCloud/clusters/bmcKeySets/read",
|                                                         "Microsoft.NetworkCloud/clusters/continueUpdateVersion/action",
|                                                         "Microsoft.NetworkCloud/clusters/delete",
|                                                         "Microsoft.NetworkCloud/clusters/deploy/action",
|                                                         "Microsoft.NetworkCloud/clusters/metricsConfigurations/delete",
|                                                         "Microsoft.NetworkCloud/clusters/metricsConfigurations/read",
|                                                         "Microsoft.NetworkCloud/clusters/metricsConfigurations/write",
|                                                         "Microsoft.NetworkCloud/clusters/read",
|                                                         "Microsoft.NetworkCloud/clusters/scanRuntime/action",
|                                                         "Microsoft.NetworkCloud/clusters/updateVersion/action",
|                                                         "Microsoft.NetworkCloud/clusters/write",
|                                                         "Microsoft.NetworkCloud/locations/operationStatuses/read",
|                                                         "Microsoft.NetworkCloud/operations/read",
|                                                         "Microsoft.NetworkCloud/rackSkus/read",
|                                                         "Microsoft.NetworkCloud/racks/delete",
|                                                         "Microsoft.NetworkCloud/racks/join/action",
|                                                         "Microsoft.NetworkCloud/racks/read",
|                                                         "Microsoft.NetworkCloud/racks/write",
|                                                         "Microsoft.NetworkCloud/register/action",
|                                                         "Microsoft.NetworkCloud/registeredSubscriptions/read",
|                                                         "Microsoft.NetworkCloud/storageAppliances/read",
|                                                         "Microsoft.NetworkCloud/unregister/action",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6cdbb904-5ff3-429d-8169-7d7818b91bd8",
|                                         "Name":  "Connector Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to connectors and related resources with no privilege escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.Impact/Connectors/Read",
|                                                         "Microsoft.Impact/WorkloadImpacts/Read",
|                                                         "Microsoft.Impact/WorkloadImpacts/Insights/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "41e04612-9dac-4699-a02b-c82ff2cc3fb5",
|                                         "Name":  "Grafana Limited Viewer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "View-only access to Grafana home page with no privilege escalation capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Dashboard/grafana/ActAsGrafanaLimitedViewer/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1af232de-e806-426f-8ca1-c36142449755",
|                                         "Name":  "Bayer Ag Powered Services Field Imagery Solution Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed limited to data plane with no identity or role assignment access.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/scenes/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cf7c76d2-98a3-4358-a134-615aa78bf44d",
|                                         "Name":  "Compute Gallery Image Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to gallery images with no privilege escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/galleries/images/read",
|                                                         "Microsoft.Compute/galleries/images/versions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "edd66693-d32a-450b-997d-0158c03976b0",
|                                         "Name":  "Container Apps Jobs Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Container Apps jobs with no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "microsoft.app/jobs/read",
|                                                         "Microsoft.App/jobs/*/read",
|                                                         "Microsoft.App/managedenvironments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f3bd1b5c-91fa-40e7-afe7-0c11d331232c",
|                                         "Name":  "Container Apps Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and exec access to Container Apps without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/containerApps/*/read",
|                                                         "Microsoft.App/containerApps/*/action",
|                                                         "Microsoft.App/managedEnvironments/read",
|                                                         "Microsoft.App/managedEnvironments/*/read",
|                                                         "Microsoft.App/managedEnvironments/join/action",
|                                                         "Microsoft.App/managedEnvironments/checknameavailability/action",
|                                                         "Microsoft.App/connectedEnvironments/read",
|                                                         "Microsoft.App/connectedEnvironments/*/read",
|                                                         "Microsoft.App/connectedEnvironments/join/action",
|                                                         "Microsoft.App/connectedEnvironments/checknameavailability/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/containerApps/logstream/action",
|                                                             "Microsoft.App/containerApps/exec/action",
|                                                             "Microsoft.App/containerApps/debug/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "af61e8fc-2633-4b95-bed3-421ad6826515",
|                                         "Name":  "Container Apps SessionPools Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Container Apps session pools with no privilege escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/sessionPools/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1b32c00b-7eff-4c22-93e6-93d11d72d2d8",
|                                         "Name":  "Container Apps ManagedEnvironments Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Container Apps ManagedEnvironments with no privilege escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/managedEnvironments/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0ad04412-c4d5-4796-b79c-f76d14c8d402",
|                                         "Name":  "Durable Task Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed data access only with no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DurableTask/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2a740172-0fc2-4039-972c-b31864cd47d6",
|                                         "Name":  "Azure Device Update Agent",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed limited to device update operations without identity plane access.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DeviceUpdate/updateAccounts/agents/requestUpdate/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2142ea27-02ad-4094-bfea-2dbac6d24934",
|                                         "Name":  "Enclave Approver Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and approve enclave requests but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/communities/read",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/read",
|                                                         "Microsoft.Mission/communities/transitHubs/read",
|                                                         "Microsoft.Mission/enclaveConnections/read",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                         "Microsoft.Mission/approvals/read",
|                                                         "Microsoft.Mission/approvals/write",
|                                                         "Microsoft.Mission/enclaveConnections/approvalCallback/action",
|                                                         "Microsoft.Mission/virtualEnclaves/approvalCallback/action",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/approvalCallback/action",
|                                                         "Microsoft.Mission/communities/communityEndpoints/approvalCallback/action",
|                                                         "Microsoft.Mission/approvals/initiatorCallback/action",
|                                                         "Microsoft.Mission/communities/setMaintenanceMode/action",
|                                                         "Microsoft.Mission/communities/communityendpoints/connect/action",
|                                                         "Microsoft.Mission/virtualEnclaves/setWorkloadRoleAssignments/action",
|                                                         "Microsoft.Mission/virtualEnclaves/setEnclaveRoleAssignments/action",
|                                                         "Microsoft.Mission/virtualEnclaves/setSubnetConfiguration/action",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/connect/action",
|                                                         "Microsoft.Mission/enclaveConnections/setSourceCidr/action",
|                                                         "Microsoft.Mission/virtualenclaves/setMaintenanceMode/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b5b0c71d-aca9-4081-aee2-9b1bb335fc1a",
|                                         "Name":  "Cognitive Services Face Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Face APIs but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/Face/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "175b81b9-6e0d-490a-85e4-0d422273c10c",
|                                         "Name":  "App Configuration Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to App Configuration management plane without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppConfiguration/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "577a9874-89fd-4f24-9dbd-b5034d0ad23a",
|                                         "Name":  "Container Registry Data Importer and Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can import and read container registry data but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/importImage/action",
|                                                         "Microsoft.ContainerRegistry/registries/read",
|                                                         "Microsoft.ContainerRegistry/registries/pull/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                             "Microsoft.ContainerRegistry/registries/catalog/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1dfc38e8-6ce7-447f-807c-029c65262c5f",
|                                         "Name":  "Stream Analytics Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Stream Analytics resources with no privilege escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.StreamAnalytics/streamingjobs/Read",
|                                                         "Microsoft.StreamAnalytics/streamingjobs/*/Read",
|                                                         "Microsoft.StreamAnalytics/clusters/Read",
|                                                         "Microsoft.StreamAnalytics/clusters/*/Read",
|                                                         "Microsoft.StreamAnalytics/clusters/ListStreamingJobs/action",
|                                                         "Microsoft.StreamAnalytics/locations/*/Read",
|                                                         "Microsoft.StreamAnalytics/operations/Read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "80d0d6b0-f522-40a4-8886-a5a11720c375",
|                                         "Name":  "Durable Task Worker",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed limited to worker operations without identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DurableTask/schedulers/taskhubs/orchestrations/execute/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "78eacb5e-e318-4560-85a9-e6a724ca60c9",
|                                         "Name":  "Portal Dashboard Writer Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can write portal dashboards but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Portal/dashboards/read",
|                                                         "Microsoft.Portal/dashboards/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2718b1f7-eb07-424e-8868-0137541392a1",
|                                         "Name":  "Landing Zone Account Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to landing zone accounts and policies; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Sovereign/landingZoneAccounts/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "11076f67-66f6-4be0-8f6b-f0609fd05cc9",
|                                         "Name":  "Azure Batch Account Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to batch account resources; no permissions to modify roles or credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Batch/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Batch/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "48e5e92e-a480-4e71-aa9c-2778f4c13781",
|                                         "Name":  "Azure Batch Job Submitter",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can submit and manage jobs but lacks permissions to escalate privileges or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Batch/batchAccounts/applications/read",
|                                                         "Microsoft.Batch/batchAccounts/applications/versions/read",
|                                                         "Microsoft.Batch/batchAccounts/pools/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Batch/batchAccounts/jobSchedules/*",
|                                                             "Microsoft.Batch/batchAccounts/jobs/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5c2d7e57-b7c2-4d8a-be4f-82afa42c6e95",
|                                         "Name":  "Azure Managed Grafana Workspace Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Grafana resources without access to workspaces or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Dashboard/grafana/write",
|                                                         "Microsoft.Dashboard/grafana/delete",
|                                                         "Microsoft.Dashboard/grafana/PrivateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Dashboard/grafana/managedPrivateEndpoints/action",
|                                                         "Microsoft.Dashboard/locations/operationStatuses/write",
|                                                         "Microsoft.Dashboard/grafana/privateEndpointConnectionProxies/validate/action",
|                                                         "Microsoft.Dashboard/grafana/privateEndpointConnectionProxies/write",
|                                                         "Microsoft.Dashboard/grafana/privateEndpointConnectionProxies/delete",
|                                                         "Microsoft.Dashboard/grafana/privateEndpointConnections/write",
|                                                         "Microsoft.Dashboard/grafana/privateEndpointConnections/delete",
|                                                         "Microsoft.Dashboard/grafana/managedPrivateEndpoints/write",
|                                                         "Microsoft.Dashboard/grafana/managedPrivateEndpoints/delete",
|                                                         "Microsoft.Dashboard/grafana/integrationFabrics/write",
|                                                         "Microsoft.Dashboard/grafana/integrationFabrics/delete",
|                                                         "Microsoft.Dashboard/grafana/grafanaDefinitions/read",
|                                                         "Microsoft.Dashboard/grafana/grafanaDefinitions/write",
|                                                         "Microsoft.Dashboard/grafana/grafanaDefinitions/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d5adeb5b-107f-4aca-99ea-4e3f4fc008d5",
|                                         "Name":  "Container Apps ConnectedEnvironments Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to connected environments; no role assignment or credential modification.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.App/connectedEnvironments/read",
|                                                         "Microsoft.App/connectedEnvironments/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "19c28022-e58e-450d-a464-0b2a53034789",
|                                         "Name":  "Cognitive Services Data Contributor (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Data plane API access only; no control plane or identity plane permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bd80684d-2f5f-4130-892a-0955546282de",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Kubernetes cluster-scoped resources; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/apiextensions.k8s.io/customresourcedefinitions/read",
|                                                             "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                             "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                             "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                             "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                             "Microsoft.ContainerService/fleets/configmaps/read",
|                                                             "Microsoft.ContainerService/fleets/endpoints/read",
|                                                             "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/fleets/events/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/limitranges/read",
|                                                             "Microsoft.ContainerService/fleets/namespaces/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/nodes/read",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumes/read",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                             "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                             "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                             "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                             "Microsoft.ContainerService/fleets/services/read",
|                                                             "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/memberclusters/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceplacements/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcebindings/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcesnapshots/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterschedulingpolicysnapshots/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverrides/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverridesnapshots/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1a40e87e-6645-48e0-b27a-0b115d849a20",
|                                         "Name":  "Chaos Studio Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can run and view experiments but cannot create or manage identity plane relevant resources.",
|                                         "Actions":  [
|                                                         "Microsoft.Chaos/*/read",
|                                                         "Microsoft.Chaos/experiments/start/action",
|                                                         "Microsoft.Chaos/experiments/cancel/action",
|                                                         "Microsoft.Chaos/experiments/executions/getExecutionDetails/action",
|                                                         "Microsoft.Chaos/locations/operationResults/read",
|                                                         "Microsoft.Chaos/locations/operationStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "29e2da8a-229c-4157-8ae8-cc72fc506b74",
|                                         "Name":  "Chaos Studio Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to chaos studio resources; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Chaos/*/read",
|                                                         "Microsoft.Chaos/experiments/executions/getExecutionDetails/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "566f0da3-e2a5-4393-9089-763f8bab8fb6",
|                                         "Name":  "Health Safeguards Data User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Data processing permissions only; no identity plane or role assignment access.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalAnchoring/Process/Action",
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalCodesValidation/Process/Action",
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalConflictDetection/Process/Action",
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalEvidenceVerification/Process/Action",
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalProvenance/Process/Action",
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalSemanticValidation/Process/Action",
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/DetectHallucinationsAndOmissions/Process/Action",
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/HealthAdaptedFiltering/Process/Action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "69b07be0-09bf-439a-b9a6-e73de851bd59",
|                                         "Name":  "Container Registry Configuration Reader and Data Access Configuration Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to registry configurations and data access settings; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/read",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/listCredentials/action",
|                                                         "Microsoft.ContainerRegistry/registries/tokens/read",
|                                                         "Microsoft.ContainerRegistry/registries/tokens/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/scopeMaps/read",
|                                                         "Microsoft.ContainerRegistry/registries/scopeMaps/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/read",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/action",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/listEvents/action",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/replications/read",
|                                                         "Microsoft.ContainerRegistry/registries/replications/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/connectedRegistries/read",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e9701b4d-e6e7-4657-91cd-360a0881d224",
|                                         "Name":  "HybridCompute Machine ListAccessDetails Action In-Built Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permission to list access details only; no role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/machines/listAccessDetails/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "11102f94-c441-49e6-a78b-ef80e0188abc",
|                                         "Name":  "Azure AI Safety Evaluator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can perform actions on workspace evaluations and simulations; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/evaluations/*",
|                                                         "Microsoft.MachineLearningServices/workspaces/simulations/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "53e48117-a530-4075-bcbe-d91913e3bdb8",
|                                         "Name":  "Edge Management Copilot User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to Edge Management Copilot actions only; no role assignment or identity plane permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.EdgeManagement/locations/chat/action",
|                                                         "Microsoft.EdgeManagement/troubleshoot/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d6a5505f-6ebb-45a4-896e-ac8274cfc0ac",
|                                         "Name":  "Durable Task Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Durable Task Scheduler data; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DurableTask/schedulers/taskhubs/orchestrations/read",
|                                                             "Microsoft.DurableTask/schedulers/taskhubs/orchestrations/metadata/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1363e94d-546f-4fe9-8434-b0eefb292d59",
|                                         "Name":  "Online Experimentation Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to experimentation data; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.OnlineExperimentation/workspaces/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "31ef6312-5b0c-4ce9-8c5d-587a91344fe7",
|                                         "Name":  "SSH PublicKeys Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to SSH public keys; no permissions to write or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/sshpublickeys/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "68ac31b4-936a-4046-a6d2-ba6f8a757bf6",
|                                         "Name":  "Defender Serverless Scanner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to serverless resource data plane only; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "microsoft.web/sites/publish/action",
|                                                         "Microsoft.Web/sites/sitecontainers/read",
|                                                         "microsoft.web/sites/slots/publish/action",
|                                                         "microsoft.web/sites/config/list/action",
|                                                         "microsoft.web/sites/slots/config/list/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1df7cd83-1d3f-41df-95b0-53b30d963369",
|                                         "Name":  "Azure API Center Credential Access Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to API Center credentials only; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ApiCenter/services/workspaces/apis/versions/securityRequirements/read",
|                                                             "Microsoft.ApiCenter/services/workspaces/apis/versions/securityRequirements/getCredentials/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "754c1a27-40dc-4708-8ad4-2bffdeee09e8",
|                                         "Name":  "Azure File Sync Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Azure File Sync service; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.StorageSync/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a00ed373-f085-4b75-a950-53eacdc52ac0",
|                                         "Name":  "Oracle.Database Exascale Storage Vault Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Exascale Storage Vaults but lacks permissions to modify identity or role assignments, no direct path to tenant takeover.",
|                                         "Actions":  [
|                                                         "Oracle.Database/exascaleDbStorageVaults/read",
|                                                         "Oracle.Database/exascaleDbStorageVaults/write",
|                                                         "Oracle.Database/exascaleDbStorageVaults/delete",
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Locations/*/write",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/resourceAnchors/*",
|                                                         "Oracle.Database/networkAnchors/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "58b80de8-4b34-424c-9e47-23faf0f7cfe2",
|                                         "Name":  "Online Experimentation Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Online Experimentation resources with no identity plane control or privilege escalation capability.",
|                                         "Actions":  [
|                                                         "Microsoft.OnlineExperimentation/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2c7a01fe-5518-4a42-93c2-658e45441691",
|                                         "Name":  "Online Experimentation Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of Online Experimentation resources but no permissions to assign roles or modify authentication, no direct tenant takeover path.",
|                                         "Actions":  [
|                                                         "Microsoft.OnlineExperimentation/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "61eb6405-5f4a-440b-ad03-fe06c5c85e44",
|                                         "Name":  "Flux Configurations Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage Flux Configurations but lacks permissions to assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.KubernetesConfiguration/fluxConfigurations/write",
|                                                         "Microsoft.KubernetesConfiguration/fluxConfigurations/read",
|                                                         "Microsoft.KubernetesConfiguration/fluxConfigurations/delete",
|                                                         "Microsoft.KubernetesConfiguration/fluxConfigurations/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f094fb07-0703-4400-ad6a-e16dd8000e14",
|                                         "Name":  "Container Registry Credential Set Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages credential sets in Container Registry but does not grant access to identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/credentialSets/read",
|                                                         "Microsoft.ContainerRegistry/registries/credentialSets/write",
|                                                         "Microsoft.ContainerRegistry/registries/credentialSets/delete",
|                                                         "Microsoft.ContainerRegistry/registries/credentialSets/operationStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c357b964-0002-4b64-a50d-7a28f02edc52",
|                                         "Name":  "Container Registry Cache Rule Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Cache Rules with no ability to escalate privileges or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/cacheRules/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "29093635-9924-4f2c-913b-650a12949526",
|                                         "Name":  "Container Registry Credential Set Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Credential Sets without permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/credentialSets/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0869d06d-e3d1-4472-8764-1bb71b2bdaf7",
|                                         "Name":  "Oracle.Database Exascale VmCluster Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of VmClusters but no permissions to assign roles or modify authentication policies.",
|                                         "Actions":  [
|                                                         "Oracle.Database/exascaleDbStorageVaults/read",
|                                                         "Oracle.Database/exadbVmClusters/*/read",
|                                                         "Oracle.Database/exadbVmClusters/*/write",
|                                                         "Oracle.Database/exadbVmClusters/*/delete",
|                                                         "Oracle.Database/exadbVmClusters/*/action",
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Locations/*/write",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/resourceAnchors/*",
|                                                         "Oracle.Database/networkAnchors/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Compute/sshPublicKeys/read",
|                                                         "Microsoft.Compute/sshPublicKeys/write",
|                                                         "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8d7ecc5c-f27b-43cf-883f-46409d445502",
|                                         "Name":  "Issue Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and update issue data but lacks permissions to modify roles or authentication settings.",
|                                         "Actions":  [
|                                                         "Microsoft.AlertsManagement/Issues/*",
|                                                         "microsoft.monitor/accounts/issues/*",
|                                                         "Microsoft.AlertsManagement/alerts/*",
|                                                         "Microsoft.Insights/components/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "df87f177-bb12-4db1-9793-a413691eff94",
|                                         "Name":  "Container Registry Cache Rule Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Cache Rules but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/cacheRules/read",
|                                                         "Microsoft.ContainerRegistry/registries/cacheRules/write",
|                                                         "Microsoft.ContainerRegistry/registries/cacheRules/delete",
|                                                         "Microsoft.ContainerRegistry/registries/cacheRules/operationStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2593f4c7-8bf4-4fff-9804-2ee069b41902",
|                                         "Name":  "Power Platform Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Power Platform Account resources but no permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.PowerPlatform/accounts/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "babe7770-cdbc-4f46-9bd7-b90b34842946",
|                                         "Name":  "Power Platform Enterprise Policy Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Power Platform Enterprise Policies without access to identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.PowerPlatform/enterprisePolicies/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "33cdeeac-0940-4f85-9317-7e2432c17289",
|                                         "Name":  "Usage Billing Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor access to billing accounts without permissions to modify roles or authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.UsageBilling/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "db9875ba-bd2b-4e98-934d-0daa549a07f0",
|                                         "Name":  "Workload Orchestration Solution External Validator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and update external validation status but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Edge/targets/read",
|                                                         "Microsoft.Edge/solutionTemplates/read",
|                                                         "Microsoft.Edge/solutionTemplates/versions/read",
|                                                         "Microsoft.Edge/targets/solutions/versions/read",
|                                                         "Microsoft.Edge/targets/updateExternalValidationStatus/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0618ae3d-2930-4bb7-aa00-718db34ee9f9",
|                                         "Name":  "Azure Monitor Dashboards with Grafana Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages dashboards but lacks permissions to assign roles or modify authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.Dashboard/dashboards/read",
|                                                         "Microsoft.Dashboard/dashboards/write",
|                                                         "Microsoft.Dashboard/dashboards/delete",
|                                                         "Microsoft.Dashboard/dashboards/dashboardDefinitions/read",
|                                                         "Microsoft.Dashboard/dashboards/dashboardDefinitions/write",
|                                                         "Microsoft.Dashboard/dashboards/dashboardDefinitions/delete",
|                                                         "Microsoft.Dashboard/locations/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5c227a58-cff3-4b51-9fa3-51bdafb6ca55",
|                                         "Name":  "Secrets Store Extension Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages secretsync and secretproviderclass objects but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.SecretSyncController/register/action",
|                                                         "Microsoft.SecretSyncController/unregister/action",
|                                                         "Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/read",
|                                                         "Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/write",
|                                                         "Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/delete",
|                                                         "Microsoft.SecretSyncController/locations/operationStatuses/read",
|                                                         "Microsoft.SecretSyncController/locations/operationStatuses/write",
|                                                         "Microsoft.SecretSyncController/operations/read",
|                                                         "Microsoft.SecretSyncController/secretSyncs/read",
|                                                         "Microsoft.SecretSyncController/secretSyncs/write",
|                                                         "Microsoft.SecretSyncController/secretSyncs/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "53ca6127-db72-4b80-b1b0-d745d6d5456d",
|                                         "Name":  "Azure AI User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to AI projects and accounts with no ability to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Insights/diagnosticSettings/read",
|                                                         "Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Insights/metricdefinitions/read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c0ff367d-66d8-445e-917c-583feb0ef0d4",
|                                         "Name":  "Azure Red Hat OpenShift Hosted Control Planes Service Managed Identity",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Has network resource read and join permissions but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/routeTables/read",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/natGateways/read",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/write",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/write",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/virtualNetworks/joinLoadBalancer/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fc0c873f-45e9-4d0d-a7d1-585aab30c6ed",
|                                         "Name":  "Azure Red Hat OpenShift Hosted Control Planes Control Plane Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to necessary resources for OpenShift cluster control plane with no privilege escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "de2b316d-7a2c-4143-b4cd-c148f6a355a1",
|                                         "Name":  "Azure Kubernetes Fleet Manager Hub Agent Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages traffic manager profiles and endpoints but lacks identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/trafficManagerProfiles/read",
|                                                         "Microsoft.Network/trafficManagerProfiles/write",
|                                                         "Microsoft.Network/trafficManagerProfiles/delete",
|                                                         "Microsoft.Network/trafficManagerProfiles/azureEndpoints/read",
|                                                         "Microsoft.Network/trafficManagerProfiles/azureEndpoints/write",
|                                                         "Microsoft.Network/trafficManagerProfiles/azureEndpoints/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "63304235-eaf4-4c15-8e93-46c483611231",
|                                         "Name":  "Workload Orchestration IT Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages event grid filters but no permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.Edge/contexts/eventGridFilters/delete",
|                                                         "Microsoft.Edge/contexts/eventGridFilters/read",
|                                                         "Microsoft.Edge/contexts/eventGridFilters/write",
|                                                         "Microsoft.Edge/contexts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f6e92014-8af2-414d-9948-9b1abf559285",
|                                         "Name":  "Arc Gateway Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Arc Gateway resources without permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/settings/write",
|                                                         "Microsoft.HybridCompute/settings/read",
|                                                         "Microsoft.HybridCompute/gateways/read",
|                                                         "Microsoft.HybridCompute/gateways/write",
|                                                         "Microsoft.HybridCompute/gateways/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8e253927-1f29-4d89-baa2-c3a549eff423",
|                                         "Name":  "Azure Kubernetes Service Machine Manager Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages cluster machines but lacks permissions to assign roles or modify authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/deleteMachines/action",
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/machines/read",
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/machines/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5f569efd-4da5-4123-99cd-d42fbb2a836e",
|                                         "Name":  "Microsoft.AzureStackHCI EdgeMachine Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to EdgeMachines and jobs with no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/EdgeMachines/Read/*",
|                                                         "Microsoft.AzureStackHCI/EdgeMachines/Jobs/Read/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "adc3c795-c41e-4a89-a478-0b321783324c",
|                                         "Name":  "Microsoft.AzureStackHCI Device Pool Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages device pools but no permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/DevicePools/read",
|                                                         "Microsoft.AzureStackHCI/DevicePools/ClaimDevices/action",
|                                                         "Microsoft.AzureStackHCI/DevicePools/ReleaseDevices/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "47be4a87-7950-4631-9daf-b664a405f074",
|                                         "Name":  "Monitoring Policy Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and update monitoring data and alert policies but lacks identity plane control or role assignment permissions.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.AlertsManagement/alerts/*",
|                                                         "Microsoft.AlertsManagement/alertsSummary/*",
|                                                         "Microsoft.AlertsManagement/issues/*",
|                                                         "Microsoft.Insights/actiongroups/*",
|                                                         "Microsoft.Insights/activityLogAlerts/*",
|                                                         "Microsoft.Insights/AlertRules/*",
|                                                         "Microsoft.Insights/components/*",
|                                                         "Microsoft.Insights/createNotifications/*",
|                                                         "Microsoft.Insights/dataCollectionEndpoints/*",
|                                                         "Microsoft.Insights/dataCollectionRules/*",
|                                                         "Microsoft.Insights/dataCollectionRuleAssociations/*",
|                                                         "Microsoft.Insights/DiagnosticSettings/*",
|                                                         "Microsoft.Insights/eventtypes/*",
|                                                         "Microsoft.Insights/LogDefinitions/*",
|                                                         "Microsoft.Insights/metricalerts/*",
|                                                         "Microsoft.Insights/MetricDefinitions/*",
|                                                         "Microsoft.Insights/Metrics/*",
|                                                         "Microsoft.Insights/notificationStatus/*",
|                                                         "Microsoft.Insights/Register/Action",
|                                                         "Microsoft.Insights/scheduledqueryrules/*",
|                                                         "Microsoft.Insights/webtests/*",
|                                                         "Microsoft.Insights/workbooks/*",
|                                                         "Microsoft.Insights/workbooktemplates/*",
|                                                         "Microsoft.Insights/privateLinkScopes/*",
|                                                         "Microsoft.Insights/privateLinkScopeOperationStatuses/*",
|                                                         "Microsoft.Monitor/accounts/*",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.OperationalInsights/workspaces/intelligencepacks/*",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                         "Microsoft.OperationalInsights/workspaces/search/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/read",
|                                                         "Microsoft.OperationalInsights/workspaces/storageinsightconfigs/*",
|                                                         "Microsoft.OperationalInsights/locations/workspaces/failover/action",
|                                                         "Microsoft.OperationalInsights/workspaces/failback/action",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.AlertsManagement/smartDetectorAlertRules/*",
|                                                         "Microsoft.AlertsManagement/actionRules/*",
|                                                         "Microsoft.AlertsManagement/smartGroups/*",
|                                                         "Microsoft.AlertsManagement/migrateFromSmartDetection/*",
|                                                         "Microsoft.AlertsManagement/investigations/*",
|                                                         "Microsoft.AlertsManagement/prometheusRuleGroups/*",
|                                                         "Microsoft.Monitor/investigations/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.PolicyInsights/remediations/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "765a04e0-5de8-4bb2-9bf6-b2a30bc03e91",
|                                         "Name":  "Storage File Delegator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can generate user delegation keys for storage files but no path to identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/fileServices/generateUserDelegationKey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "965033a5-c8eb-4f35-b82f-fef460a3606d",
|                                         "Name":  "Storage Table Delegator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can generate user delegation keys for storage tables but no permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/tableServices/generateUserDelegationKey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7ee386e9-84f0-448e-80a6-f185f6533131",
|                                         "Name":  "Storage Queue Delegator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can generate user delegation keys for storage queues but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/queueServices/generateUserDelegationKey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6fbca9a8-3561-41fd-8b20-6576043c1076",
|                                         "Name":  "Scheduled Actions Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can perform scheduled actions on VMs but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesCancelOperations/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteDeallocate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteHibernate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteStart/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteCreate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteDelete/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationErrors/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationStatus/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitDeallocate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitHibernate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitStart/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/write",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/delete",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/attachResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/cancelNextOccurrence/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/detachResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/disable/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/enable/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/listResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/patchResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/triggerManualOccurrence/action",
|                                                         "Microsoft.ComputeSchedule/register/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b6d9c0f6-d69f-472b-91b4-7a6838c6d1cb",
|                                         "Name":  "Microsoft.AzureStackHCI Device Pool Machine Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages endpoints and machines but no permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridConnectivity/endpoints/write",
|                                                         "Microsoft.HybridConnectivity/endpoints/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/delete",
|                                                         "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/write",
|                                                         "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/delete",
|                                                         "Microsoft.HybridConnectivity/endpoints/listCredentials/action",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8b9beb50-e28c-4879-8472-24c9d328085f",
|                                         "Name":  "AI Model Scanner Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to AI models and registries with no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/models/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/models/versions/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/datastores/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/metadata/artifacts/read",
|                                                         "Microsoft.MachineLearningServices/registries/read",
|                                                         "Microsoft.MachineLearningServices/registries/assets/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c9f76ca8-b262-4b10-8ed2-09cf0948aa35",
|                                         "Name":  "Azure Kubernetes Service Namespace User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to AKS namespaces without permissions to assign roles or escalate privileges.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/managedClusters/managedNamespaces/read",
|                                                         "Microsoft.ContainerService/managedClusters/managedNamespaces/listCredential/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "289d8817-ee69-43f1-a0af-43a45505b488",
|                                         "Name":  "Azure Kubernetes Service Namespace Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage AKS namespaces but lacks permissions to assign roles or modify authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/managedClusters/managedNamespaces/*",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "76153a9e-0edb-49bc-8e01-93c47e6b5180",
|                                         "Name":  "DevOps Infrastructure Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages DevOps infrastructure pools but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.DevOpsInfrastructure/register/action",
|                                                         "Microsoft.DevOpsInfrastructure/unregister/action",
|                                                         "Microsoft.DevOpsInfrastructure/*/read",
|                                                         "Microsoft.DevOpsInfrastructure/Locations/OperationStatuses/write",
|                                                         "Microsoft.DevOpsInfrastructure/pools/write",
|                                                         "Microsoft.DevOpsInfrastructure/pools/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "32c34659-0f83-4a4c-80f2-63a244f8ae0b",
|                                         "Name":  "Service Health Billing Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to billing information in service health events with no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ResourceHealth/events/action",
|                                                         "Microsoft.ResourceHealth/AvailabilityStatuses/read",
|                                                         "Microsoft.ResourceHealth/AvailabilityStatuses/current/read",
|                                                         "Microsoft.ResourceHealth/Operations/read",
|                                                         "Microsoft.ResourceHealth/emergingissues/read",
|                                                         "Microsoft.ResourceHealth/events/read",
|                                                         "Microsoft.ResourceHealth/events/fetchBillingCommunicationDetails/action",
|                                                         "Microsoft.ResourceHealth/events/impactedResources/read",
|                                                         "Microsoft.ResourceHealth/metadata/read",
|                                                         "Microsoft.ResourceHealth/potentialoutages/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.ResourceHealth/events/fetchEventDetails/action",
|                                                            "Microsoft.ResourceHealth/events/listSecurityAdvisoryImpactedResources/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1a928ab0-1fee-43cf-9266-f9d8c22a8ddb",
|                                         "Name":  "Service Health Security Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to security information in service health events without permissions to assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.ResourceHealth/events/action",
|                                                         "Microsoft.ResourceHealth/AvailabilityStatuses/read",
|                                                         "Microsoft.ResourceHealth/AvailabilityStatuses/current/read",
|                                                         "Microsoft.ResourceHealth/Operations/read",
|                                                         "Microsoft.ResourceHealth/emergingissues/read",
|                                                         "Microsoft.ResourceHealth/events/read",
|                                                         "Microsoft.ResourceHealth/events/fetchEventDetails/action",
|                                                         "Microsoft.ResourceHealth/events/listSecurityAdvisoryImpactedResources/action",
|                                                         "Microsoft.ResourceHealth/events/impactedResources/read",
|                                                         "Microsoft.ResourceHealth/metadata/read",
|                                                         "Microsoft.ResourceHealth/potentialoutages/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.ResourceHealth/events/fetchBillingCommunicationDetails/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "12b8206a-0216-4469-908d-a3e2025fe085",
|                                         "Name":  "Azure Stack Edge Operations Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Azure Stack Edge operations but lacks permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/bandwidthSchedules/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/bandwidthSchedules/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/deviceCapacityCheck/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/downloadUpdates/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/generateCertificate/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/getExtendedInformation/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/installUpdates/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/orders/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/orders/listDCAccessCode/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/orders/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/publishers/offers/skus/versions/generatesastoken/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/addons/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/addons/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/migrate/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/monitoringConfig/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/monitoringConfig/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/scanForUpdates/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/securitySettings/update/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/shares/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/shares/refresh/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/shares/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccountCredentials/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccountCredentials/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/containers/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/containers/refresh/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/containers/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/triggers/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/triggers/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/triggerSupportPackage/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/updateExtendedInformation/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/uploadCertificate/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/users/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/users/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2016c9ed-c18d-4120-93d7-178e583efe92",
|                                         "Name":  "Grounding with Bing User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Enables approved apps to connect to Bing with no permissions affecting identity or role assignments.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Bing/accounts/useGrounding/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "69a41f41-6dce-4ea7-8a34-8e095ddba55c",
|                                         "Name":  "Azure Advisor Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages advisor suppressions and configurations but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Advisor/suppressions/write",
|                                                         "Microsoft.Advisor/suppressions/delete",
|                                                         "Microsoft.Advisor/recommendations/suppressions/write",
|                                                         "Microsoft.Advisor/recommendations/suppressions/delete",
|                                                         "Microsoft.Advisor/assessments/write",
|                                                         "Microsoft.Advisor/configurations/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "548d7e7c-65ee-412b-ae37-2dbb419d4207",
|                                         "Name":  "Experimentation Resource Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of experimentation resources without permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.Experimentation/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "804db8d3-32c7-4ad4-a975-3f6f90d5f5f5",
|                                         "Name":  "FHIR Data Bulk Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Performs bulk operations but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/write",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/delete",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/export/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/reindex/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/import/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/hardDelete/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/bulkOperator/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/write",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/delete",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/export/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/reindex/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/import/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/hardDelete/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/bulkOperator/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3bb7c424-af4e-436b-bfcc-8779c8934c31",
|                                         "Name":  "Microsoft Discovery Platform Reader (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Discovery platform resources with no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Discovery/*/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Discovery/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7a2b6e6c-472e-4b39-8878-a26eb63d75c6",
|                                         "Name":  "Microsoft Discovery Platform Administrator (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of Discovery platform resources but no permissions to assign roles or modify authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.Discovery/locations/operationStatuses/read",
|                                                         "Microsoft.Discovery/checkNameAvailability/action",
|                                                         "Microsoft.Discovery/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Discovery/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "01288891-85ee-45a7-b367-9db3b752fc65",
|                                         "Name":  "Microsoft Discovery Platform Contributor (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can operate on most Discovery platform resources but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Discovery/locations/operationStatuses/read",
|                                                         "Microsoft.Discovery/operations/read",
|                                                         "Microsoft.Discovery/workspaces/read",
|                                                         "Microsoft.Discovery/supercomputers/read",
|                                                         "Microsoft.Discovery/storages/read",
|                                                         "Microsoft.Discovery/agents/*",
|                                                         "Microsoft.Discovery/bookshelves/read",
|                                                         "Microsoft.Discovery/dataContainers/*",
|                                                         "Microsoft.Discovery/dataContainers/dataAssets/*",
|                                                         "Microsoft.Discovery/storageContainers/*",
|                                                         "Microsoft.Discovery/storageContainers/storageAssets/*",
|                                                         "Microsoft.Discovery/models/*",
|                                                         "Microsoft.Discovery/supercomputers/nodePools/read",
|                                                         "Microsoft.Discovery/tools/*",
|                                                         "Microsoft.Discovery/workflows/*",
|                                                         "Microsoft.Discovery/workspaces/chatModelDeployments/read",
|                                                         "Microsoft.Discovery/workspaces/projects/read",
|                                                         "Microsoft.Discovery/operations/read",
|                                                         "Microsoft.Insights/AlertRules/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Discovery/workspaces/write",
|                                                            "Microsoft.Discovery/workspaces/delete",
|                                                            "Microsoft.Discovery/supercomputers/write",
|                                                            "Microsoft.Discovery/supercomputers/delete",
|                                                            "Microsoft.Discovery/storages/write",
|                                                            "Microsoft.Discovery/storages/delete",
|                                                            "Microsoft.Discovery/bookshelves/write",
|                                                            "Microsoft.Discovery/bookshelves/delete",
|                                                            "Microsoft.Discovery/supercomputers/nodePools/write",
|                                                            "Microsoft.Discovery/supercomputers/nodePools/delete",
|                                                            "Microsoft.Discovery/workspaces/chatModelDeployments/write",
|                                                            "Microsoft.Discovery/workspaces/chatModelDeployments/delete",
|                                                            "Microsoft.Discovery/workspaces/projects/write",
|                                                            "Microsoft.Discovery/workspaces/projects/delete"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Discovery/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5bc02df6-6cd5-43fe-ad3d-4c93cf56cc16",
|                                         "Name":  "Azure IoT Operations Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages IoT operations and resources but no permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.IoTOperations/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.DeviceRegistry/Assets/*",
|                                                         "Microsoft.DeviceRegistry/AssetEndpointProfiles/*",
|                                                         "Microsoft.DeviceRegistry/Namespaces/Assets/*",
|                                                         "Microsoft.DeviceRegistry/Namespaces/Devices/*",
|                                                         "Microsoft.DeviceRegistry/Namespaces/DiscoveredAssets/*",
|                                                         "Microsoft.DeviceRegistry/Namespaces/DiscoveredDevices/*",
|                                                         "Microsoft.DeviceRegistry/SchemaRegistries/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Edge/sites/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c459b115-f629-486b-b359-35feb5568b83",
|                                         "Name":  "Connector Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can write connectors and read basic resources but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Impact/Connectors/Write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1abf4029-2200-4343-800c-e4c4c01eddbd",
|                                         "Name":  "Virtual Enclave Owner Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages virtual enclave resources but has no direct or near-direct control over identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/write",
|                                                         "Microsoft.Mission/virtualEnclaves/delete",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/delete",
|                                                         "Microsoft.Mission/communities/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "61aed14c-6c9a-4ed5-aa44-49fc5e96a167",
|                                         "Name":  "NginxPlus Contributor service role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Provides control plane operations for NginxPlus but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "NGINX.NGINXPLUS/register/action",
|                                                         "NGINX.NGINXPLUS/unregister/action",
|                                                         "NGINX.NGINXPLUS/locations/read",
|                                                         "NGINX.NGINXPLUS/locations/operationStatuses/read",
|                                                         "NGINX.NGINXPLUS/locations/operationStatuses/write",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/Read",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/Write",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/Delete",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/apiKeys/Read",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/apiKeys/Write",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/apiKeys/Delete",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/certificates/Read",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/certificates/Write",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/certificates/Delete",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/configurations/Read",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/configurations/Write",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/configurations/Delete",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/wafPolicies/Read",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/wafPolicies/Write",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/wafPolicies/Delete",
|                                                         "NGINX.NGINXPLUS/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "35ffec73-9cb8-4593-8718-40d5bc4b7f6f",
|                                         "Name":  "CosmosDB Fleet Operator Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages CosmosDB Fleets but does not have permissions to affect identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDB/fleets/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "29f61507-bdfb-4987-b629-20033be2d6c3",
|                                         "Name":  "Healthcare Apis contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to healthcare API resources but no path to identity plane or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.HealthcareApis/services/*",
|                                                         "Microsoft.HealthcareApis/workspaces/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "81b67e46-ef5b-4404-bddd-090985bb4a28",
|                                         "Name":  "Liftr Datadog Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Control plane access to Datadog resources without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Datadog/register/action",
|                                                         "Microsoft.Datadog/unregister/action",
|                                                         "Microsoft.Datadog/agreements/read",
|                                                         "Microsoft.Datadog/agreements/write",
|                                                         "Microsoft.Datadog/locations/read",
|                                                         "Microsoft.Datadog/locations/operationStatuses/read",
|                                                         "Microsoft.Datadog/locations/operationStatuses/write",
|                                                         "Microsoft.Datadog/monitors/read",
|                                                         "Microsoft.Datadog/monitors/write",
|                                                         "Microsoft.Datadog/monitors/delete",
|                                                         "Microsoft.Datadog/monitors/listApiKeys/action",
|                                                         "Microsoft.Datadog/monitors/getDefaultKey/action",
|                                                         "Microsoft.Datadog/monitors/setDefaultKey/action",
|                                                         "Microsoft.Datadog/monitors/refreshSetPasswordLink/action",
|                                                         "Microsoft.Datadog/monitors/listLinkedResources/action",
|                                                         "Microsoft.Datadog/monitors/listHosts/read",
|                                                         "Microsoft.Datadog/monitors/listLinkedResources/read",
|                                                         "Microsoft.Datadog/monitors/listMonitoredResources/read",
|                                                         "Microsoft.Datadog/monitors/monitoredSubscriptions/read",
|                                                         "Microsoft.Datadog/monitors/monitoredSubscriptions/write",
|                                                         "Microsoft.Datadog/monitors/singleSignOnConfigurations/write",
|                                                         "Microsoft.Datadog/monitors/singleSignOnConfigurations/read",
|                                                         "Microsoft.Datadog/monitors/tagRules/read",
|                                                         "Microsoft.Datadog/monitors/tagRules/write",
|                                                         "Microsoft.Datadog/registeredSubscriptions/read",
|                                                         "Microsoft.Datadog/subscriptionStatuses/read",
|                                                         "Microsoft.Datadog/operations/read",
|                                                         "Microsoft.Datadog/monitors/getDefaultApplicationKey/action",
|                                                         "Microsoft.Datadog/monitors/manageSreAgentConnectors/action",
|                                                         "Microsoft.Datadog/monitors/latestLinkedSaaS/action",
|                                                         "Microsoft.Datadog/monitors/linkSaaS/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d68eeb8d-afae-4932-a331-203b7957e509",
|                                         "Name":  "Liftr Elastic Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Elastic control plane operations only; no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Elastic/getOrganizationApiKey/action",
|                                                         "Microsoft.Elastic/checkNameAvailability/action",
|                                                         "Microsoft.Elastic/register/action",
|                                                         "Microsoft.Elastic/locations/read",
|                                                         "Microsoft.Elastic/locations/operationStatuses/read",
|                                                         "Microsoft.Elastic/locations/operationStatuses/write",
|                                                         "Microsoft.Elastic/monitors/read",
|                                                         "Microsoft.Elastic/monitors/write",
|                                                         "Microsoft.Elastic/monitors/delete",
|                                                         "Microsoft.Elastic/monitors/listMonitoredResources/action",
|                                                         "Microsoft.Elastic/monitors/listVMHost/action",
|                                                         "Microsoft.Elastic/monitors/createOrUpdateExternalUser/action",
|                                                         "Microsoft.Elastic/monitors/listAllTrafficFilters/action",
|                                                         "Microsoft.Elastic/monitors/listAssociatedTrafficFilters/action",
|                                                         "Microsoft.Elastic/monitors/createAndAssociateIPFilter/action",
|                                                         "Microsoft.Elastic/monitors/createAndAssociatePLFilter/action",
|                                                         "Microsoft.Elastic/monitors/associateTrafficFilter/action",
|                                                         "Microsoft.Elastic/monitors/detachAndDeleteTrafficFilter/action",
|                                                         "Microsoft.Elastic/monitors/detachTrafficFilter/action",
|                                                         "Microsoft.Elastic/monitors/deleteTrafficFilter/action",
|                                                         "Microsoft.Elastic/monitors/listUpgradableVersions/action",
|                                                         "Microsoft.Elastic/monitors/getBillingInfo/action",
|                                                         "Microsoft.Elastic/monitors/listConnectedPartnerResources/action",
|                                                         "Microsoft.Elastic/monitors/upgrade/action",
|                                                         "Microsoft.Elastic/monitors/vmIngestionDetails/action",
|                                                         "Microsoft.Elastic/monitors/vmCollectionUpdate/action",
|                                                         "Microsoft.Elastic/monitors/listDeploymentInfo/action",
|                                                         "Microsoft.Elastic/monitors/resubscribe/action",
|                                                         "Microsoft.Elastic/monitors/monitoredSubscriptions/read",
|                                                         "Microsoft.Elastic/monitors/monitoredSubscriptions/write",
|                                                         "Microsoft.Elastic/monitors/openAIIntegrations/read",
|                                                         "Microsoft.Elastic/monitors/openAIIntegrations/write",
|                                                         "Microsoft.Elastic/monitors/openAIIntegrations/getStatus/action",
|                                                         "Microsoft.Elastic/monitors/tagRules/read",
|                                                         "Microsoft.Elastic/monitors/tagRules/write",
|                                                         "Microsoft.Elastic/registeredSubscriptions/read",
|                                                         "Microsoft.Elastic/elasticVersions/read",
|                                                         "Microsoft.Elastic/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "225efd4d-4ca0-42a1-ae53-5f233ba23c73",
|                                         "Name":  "Liftr Elastic Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of Elastic resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Elastic/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a60da355-bdec-443f-8d42-a03f0422f04d",
|                                         "Name":  "Liftr Newrelic Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Newrelic control plane access without identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "NewRelic.Observability/register/action",
|                                                         "NewRelic.Observability/unregister/action",
|                                                         "NewRelic.Observability/accounts/read",
|                                                         "NewRelic.Observability/plans/read",
|                                                         "NewRelic.Observability/organizations/read",
|                                                         "NewRelic.Observability/locations/read",
|                                                         "NewRelic.Observability/locations/operationStatuses/read",
|                                                         "NewRelic.Observability/locations/operationStatuses/write",
|                                                         "NewRelic.Observability/monitors/read",
|                                                         "NewRelic.Observability/monitors/write",
|                                                         "NewRelic.Observability/monitors/delete",
|                                                         "NewRelic.Observability/monitors/monitoredResources/action",
|                                                         "NewRelic.Observability/monitors/vmHostPayloads/action",
|                                                         "NewRelic.Observability/monitors/listAppServices/action",
|                                                         "NewRelic.Observability/monitors/listHosts/action",
|                                                         "NewRelic.Observability/monitors/refreshIngestionKey/action",
|                                                         "NewRelic.Observability/monitors/getMetricRules/action",
|                                                         "NewRelic.Observability/monitors/getMetricStatus/action",
|                                                         "NewRelic.Observability/monitors/switchBilling/action",
|                                                         "NewRelic.Observability/monitors/latestLinkedSaaS/action",
|                                                         "NewRelic.Observability/monitors/linkSaaS/action",
|                                                         "NewRelic.Observability/monitors/resubscribe/action",
|                                                         "NewRelic.Observability/monitors/getBillingInfo/action",
|                                                         "NewRelic.Observability/monitors/listConnectedPartnerResources/action",
|                                                         "NewRelic.Observability/monitors/listLinkedResources/action",
|                                                         "NewRelic.Observability/monitors/monitoredSubscriptions/read",
|                                                         "NewRelic.Observability/monitors/monitoredSubscriptions/write",
|                                                         "NewRelic.Observability/monitors/tagRules/read",
|                                                         "NewRelic.Observability/monitors/tagRules/write",
|                                                         "NewRelic.Observability/registeredSubscriptions/read",
|                                                         "NewRelic.Observability/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "285ce6d6-fa11-43bd-94ef-42a9b3740bfd",
|                                         "Name":  "Policy Enrollments Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and modify policy enrollments but lacks permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/policyenrollments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.PolicyInsights/*",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fa96a588-3fac-4adb-bfb2-f8404ece07e0",
|                                         "Name":  "Liftr Dynatrace Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Dynatrace control plane operations only; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Dynatrace.Observability/checkNameAvailability/action",
|                                                         "Dynatrace.Observability/register/action",
|                                                         "Dynatrace.Observability/unregister/action",
|                                                         "Dynatrace.Observability/getMarketplaceSaaSResourceDetails/action",
|                                                         "Dynatrace.Observability/locations/read",
|                                                         "Dynatrace.Observability/locations/operationStatuses/read",
|                                                         "Dynatrace.Observability/locations/operationStatuses/write",
|                                                         "Dynatrace.Observability/monitors/read",
|                                                         "Dynatrace.Observability/monitors/write",
|                                                         "Dynatrace.Observability/monitors/delete",
|                                                         "Dynatrace.Observability/monitors/listMonitoredResources/action",
|                                                         "Dynatrace.Observability/monitors/getVMHostPayload/action",
|                                                         "Dynatrace.Observability/monitors/listHosts/action",
|                                                         "Dynatrace.Observability/monitors/listAppServices/action",
|                                                         "Dynatrace.Observability/monitors/getSSODetails/action",
|                                                         "Dynatrace.Observability/monitors/listLinkableEnvironments/action",
|                                                         "Dynatrace.Observability/monitors/getMetricStatus/action",
|                                                         "Dynatrace.Observability/monitors/manageAgentInstallation/action",
|                                                         "Dynatrace.Observability/monitors/monitoredSubscriptions/read",
|                                                         "Dynatrace.Observability/monitors/monitoredSubscriptions/write",
|                                                         "Dynatrace.Observability/monitors/singleSignOnConfigurations/write",
|                                                         "Dynatrace.Observability/monitors/singleSignOnConfigurations/read",
|                                                         "Dynatrace.Observability/monitors/tagRules/read",
|                                                         "Dynatrace.Observability/monitors/tagRules/write",
|                                                         "Dynatrace.Observability/registeredSubscriptions/read",
|                                                         "Dynatrace.Observability/operations/read",
|                                                         "Dynatrace.Observability/monitors/manageSreAgentConnectors/action",
|                                                         "Dynatrace.Observability/monitors/latestLinkedSaaS/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "79732128-7761-4733-aebf-35590da9f29b",
|                                         "Name":  "Microsoft.OffAzureSpringBoot Service Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to service APIs but no direct or near-direct identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.OffAzureSpringBoot/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "46c70067-0f50-457f-8137-2449c90de518",
|                                         "Name":  "Nexus Network Fabric Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Owner access to network fabric resources without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedNetworkFabric/*/read",
|                                                         "Microsoft.ManagedNetworkFabric/*/write",
|                                                         "Microsoft.ManagedNetworkFabric/*/action",
|                                                         "Microsoft.ManagedNetworkFabric/*/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "374a1cc6-96cb-4946-8d8b-a41054c8ae97",
|                                         "Name":  "Nexus Identity Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Owner access to nexus identity resources but no direct control over tenant-wide role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.NexusIdentity/*/read",
|                                                         "Microsoft.NexusIdentity/*/write",
|                                                         "Microsoft.NexusIdentity/*/action",
|                                                         "Microsoft.NexusIdentity/*/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b3eb788f-5426-48bd-821d-561701ede368",
|                                         "Name":  "Conversation Session User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows messaging via API only; no permissions to modify identity or roles.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthBot/healthBots/ConversationSession/Action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "eded264d-1796-4e25-8500-a78427f8a316",
|                                         "Name":  "Azure Data Transfer Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of data transfer resources but no identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureDataTransfer/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bf41e52e-617f-4981-8b7a-47431bd4e011",
|                                         "Name":  "CosmosDB Fleet Analytics Storage Data Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can write telemetry data to storage but no permissions to affect identity or roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3f99eaab-6f59-4877-adf5-1cacd22e20b0",
|                                         "Name":  "Video Indexer Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages video indexer accounts and tokens but lacks identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.VideoIndexer/checknameavailability/action",
|                                                         "Microsoft.VideoIndexer/accounts/generateAccessToken/action",
|                                                         "Microsoft.VideoIndexer/accounts/generateRestrictedViewerAccessToken/action",
|                                                         "Microsoft.VideoIndexer/accounts/generateExtensionAccessToken/action",
|                                                         "Microsoft.VideoIndexer/accounts/generateExtensionRestrictedViewerAccessToken/action",
|                                                         "Microsoft.VideoIndexer/accounts/read",
|                                                         "Microsoft.VideoIndexer/accounts/write",
|                                                         "Microsoft.VideoIndexer/accounts/delete",
|                                                         "Microsoft.VideoIndexer/accounts/PrivateEndpointConnectionsApproval/action",
|                                                         "Microsoft.VideoIndexer/accounts/privateEndpointConnections/read",
|                                                         "Microsoft.VideoIndexer/accounts/privateEndpointConnections/write",
|                                                         "Microsoft.VideoIndexer/accounts/privateEndpointConnections/delete",
|                                                         "Microsoft.VideoIndexer/accounts/privateLinkResources/read",
|                                                         "Microsoft.VideoIndexer/locations/operationstatuses/read",
|                                                         "Microsoft.VideoIndexer/locations/operationstatuses/write",
|                                                         "Microsoft.VideoIndexer/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f4eb044f-76b9-47af-92f9-1d95c4c14ab5",
|                                         "Name":  "Azure Business Continuity DUPI Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to deleted protected items; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleDefinitions/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.AzureBusinessContinuity/deletedUnifiedProtectedItems/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "59f98be6-0817-488b-831e-36a353c8000b",
|                                         "Name":  "Sites Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to sites resources without ability to modify identity or roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Edge/sites/read",
|                                                         "Microsoft.Edge/configurations/read",
|                                                         "Microsoft.Edge/configurations/networkConfigurations/read",
|                                                         "Microsoft.Edge/configurations/securityConfigurations/read",
|                                                         "Microsoft.Edge/configurations/timeServerConfigurations/read",
|                                                         "Microsoft.Edge/configurations/connectivityConfigurations/read",
|                                                         "Microsoft.Edge/configurations/provisioningConfigurations/read",
|                                                         "Microsoft.Edge/configurations/arcGatewayConfigurations/read",
|                                                         "Microsoft.Edge/configurationReferences/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1cd7e4da-2789-457f-adbe-3e9e84037a93",
|                                         "Name":  "Sites Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of sites resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Edge/sites/read",
|                                                         "Microsoft.Edge/sites/write",
|                                                         "Microsoft.Edge/sites/delete",
|                                                         "Microsoft.Edge/configurations/read",
|                                                         "Microsoft.Edge/configurations/write",
|                                                         "Microsoft.Edge/configurations/delete",
|                                                         "Microsoft.Edge/configurations/networkConfigurations/read",
|                                                         "Microsoft.Edge/configurations/networkConfigurations/write",
|                                                         "Microsoft.Edge/configurations/networkConfigurations/delete",
|                                                         "Microsoft.Edge/configurations/securityConfigurations/read",
|                                                         "Microsoft.Edge/configurations/securityConfigurations/write",
|                                                         "Microsoft.Edge/configurations/securityConfigurations/delete",
|                                                         "Microsoft.Edge/configurations/timeServerConfigurations/read",
|                                                         "Microsoft.Edge/configurations/timeServerConfigurations/write",
|                                                         "Microsoft.Edge/configurations/timeServerConfigurations/delete",
|                                                         "Microsoft.Edge/configurations/connectivityConfigurations/read",
|                                                         "Microsoft.Edge/configurations/connectivityConfigurations/write",
|                                                         "Microsoft.Edge/configurations/connectivityConfigurations/delete",
|                                                         "Microsoft.Edge/configurations/provisioningConfigurations/read",
|                                                         "Microsoft.Edge/configurations/provisioningConfigurations/write",
|                                                         "Microsoft.Edge/configurations/provisioningConfigurations/delete",
|                                                         "Microsoft.Edge/configurations/arcGatewayConfigurations/read",
|                                                         "Microsoft.Edge/configurations/arcGatewayConfigurations/write",
|                                                         "Microsoft.Edge/configurations/arcGatewayConfigurations/delete",
|                                                         "Microsoft.Edge/configurationReferences/read",
|                                                         "Microsoft.Edge/configurationReferences/write",
|                                                         "Microsoft.Edge/configurationReferences/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "85546f1f-f28b-4cb3-b852-73e422a96897",
|                                         "Name":  "Liftr PureStorage Owner role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to PureStorage operations without identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "PureStorage.Block/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d683b71b-2b91-4fc1-a43e-b53b3d85bed9",
|                                         "Name":  "Liftr Dell Owner role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Dell storage operations but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Dell.Storage/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6d6f52ba-a7de-4c56-a58f-522154514fba",
|                                         "Name":  "SupportPlan Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to support plan resources without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.EnterpriseSupport/services/delete",
|                                                         "Microsoft.EnterpriseSupport/services/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4037dd68-1cc7-4a64-8765-3a79963a9940",
|                                         "Name":  "Azure Spring Apps Service Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Azure Spring Apps APIs but no direct identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppPlatform/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "25cabde7-1a6c-4350-8877-cb6fe59f1399",
|                                         "Name":  "Azure AI Enterprise Networking Outbound Rules Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage networking outbound rules but lacks identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/managedNetworks/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/managedNetworks/write",
|                                                         "Microsoft.MachineLearningServices/workspaces/managedNetworks/outboundRules/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/managedNetworks/outboundRules/write",
|                                                         "Microsoft.MachineLearningServices/workspaces/managedNetworks/outboundRules/delete",
|                                                         "Microsoft.MachineLearningServices/workspaces/managedNetworks/batchOutboundRules/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3b5a0aa9-eccd-48dc-9011-f2fd03b5e5f9",
|                                         "Name":  "Azure Business Continuity UPI Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to unified protected items; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleDefinitions/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.AzureBusinessContinuity/unifiedProtectedItems/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dd799a69-ffc8-4aa8-9701-b51f686857d9",
|                                         "Name":  "Pinecone.VectorDb Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to Pinecone VectorDb resources without identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Pinecone.VectorDb/checkNameAvailability/action",
|                                                         "Pinecone.VectorDb/register/action",
|                                                         "Pinecone.VectorDb/unregister/action",
|                                                         "Pinecone.VectorDb/locations/operationStatuses/read",
|                                                         "Pinecone.VectorDb/locations/operationStatuses/write",
|                                                         "Pinecone.VectorDb/operations/read",
|                                                         "Pinecone.VectorDb/organizations/read",
|                                                         "Pinecone.VectorDb/organizations/write",
|                                                         "Pinecone.VectorDb/organizations/delete",
|                                                         "Pinecone.VectorDb/registeredSubscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "246fffca-69ee-4945-bbf1-2a867dce4fda",
|                                         "Name":  "Microsoft.WeightsAndBiases Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to WeightsAndBiases resources but no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.WeightsAndBiases/checkNameAvailability/action",
|                                                         "Microsoft.WeightsAndBiases/register/action",
|                                                         "Microsoft.WeightsAndBiases/unregister/action",
|                                                         "Microsoft.WeightsAndBiases/instances/read",
|                                                         "Microsoft.WeightsAndBiases/instances/write",
|                                                         "Microsoft.WeightsAndBiases/instances/delete",
|                                                         "Microsoft.WeightsAndBiases/locations/operationStatuses/read",
|                                                         "Microsoft.WeightsAndBiases/locations/operationStatuses/write",
|                                                         "Microsoft.WeightsAndBiases/operations/read",
|                                                         "Microsoft.WeightsAndBiases/registeredSubscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "44a00263-b2a0-45d5-a618-5d8d11709349",
|                                         "Name":  "LambdaTest.HyperExecute Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to HyperExecute resources without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "LambdaTest.HyperExecute/checkNameAvailability/action",
|                                                         "LambdaTest.HyperExecute/register/action",
|                                                         "LambdaTest.HyperExecute/unregister/action",
|                                                         "LambdaTest.HyperExecute/locations/operationStatuses/read",
|                                                         "LambdaTest.HyperExecute/locations/operationStatuses/write",
|                                                         "LambdaTest.HyperExecute/operations/read",
|                                                         "LambdaTest.HyperExecute/organizations/read",
|                                                         "LambdaTest.HyperExecute/organizations/write",
|                                                         "LambdaTest.HyperExecute/organizations/delete",
|                                                         "LambdaTest.HyperExecute/registeredSubscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dca88c6f-5090-44cd-a0ff-a88f337b12a5",
|                                         "Name":  "ArizeAi.ObservabilityEval Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to ObservabilityEval resources but no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "ArizeAi.ObservabilityEval/checkNameAvailability/action",
|                                                         "ArizeAi.ObservabilityEval/register/action",
|                                                         "ArizeAi.ObservabilityEval/unregister/action",
|                                                         "ArizeAi.ObservabilityEval/locations/operationStatuses/read",
|                                                         "ArizeAi.ObservabilityEval/locations/operationStatuses/write",
|                                                         "ArizeAi.ObservabilityEval/operations/read",
|                                                         "ArizeAi.ObservabilityEval/organizations/read",
|                                                         "ArizeAi.ObservabilityEval/organizations/write",
|                                                         "ArizeAi.ObservabilityEval/organizations/delete",
|                                                         "ArizeAi.ObservabilityEval/registeredSubscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "376d0802-aca8-4c2d-83a5-c88630f396fe",
|                                         "Name":  "Recurring Scheduled Actions Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage scheduled actions but lacks permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ComputeSchedule/scheduledActions/write",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/delete",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/attachResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/cancelNextOccurrence/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/detachResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/disable/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/enable/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/listResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/patchResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/triggerManualOccurrence/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/occurrences/cancel/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/occurrences/delay/action",
|                                                         "Microsoft.ComputeSchedule/register/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ff09793b-be48-49f6-ad96-70d32039c0b9",
|                                         "Name":  "Azure Resilience Management Drills Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Operator role for resilience drills without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/action",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/write",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                         "Microsoft.Insights/alertRules/",
|                                                         "Microsoft.Monitor/accounts/read",
|                                                         "Microsoft.Monitor/slis/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e131102b-11a5-4ff4-8508-ed922132b74c",
|                                         "Name":  "Azure Resilience Management Drills Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to resilience drills but no direct or near-direct identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/action",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/delete",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/write",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c914561b-1575-4601-af9c-a1356bf59818",
|                                         "Name":  "Azure Resilience Management Drills Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Administrator of resilience drills but lacks permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/action",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/delete",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/write",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d2e8fe82-9212-490f-af3e-34bb52d87d3d",
|                                         "Name":  "Azure Resilience Management Drills Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to resilience drills; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/",
|                                                         "Microsoft.Resources/deployments/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/drillResources/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/drillRuns/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/drillRuns/drillRunChildJobs/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/drillRuns/drillRunResources/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f24a559b-c2fc-4409-b96e-9af4b0c28ad6",
|                                         "Name":  "Edge Order Partner Inventory Manager Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages inventory metadata and links but no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.EdgeOrderPartner/locations/productFamilies/inventories/manageLink/action",
|                                                         "Microsoft.EdgeOrderPartner/locations/productFamilies/inventories/manageInventoryMetadata/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c5c82243-e78e-43f9-8428-793bba85b28e",
|                                         "Name":  "Defender For Container Registries Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access for Defender to container registries; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/pull/read",
|                                                         "Microsoft.ContainerRegistry/registries/metadata/read",
|                                                         "Microsoft.ContainerRegistry/registries/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                             "Microsoft.ContainerRegistry/registries/catalog/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fdb3df26-8dd6-49ff-9a74-e95dbfadcad3",
|                                         "Name":  "Change Safety Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages change safety resources but lacks identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ChangeSafety/changeStates/read",
|                                                         "Microsoft.ChangeSafety/changeStates/write",
|                                                         "Microsoft.ChangeSafety/changeStates/delete",
|                                                         "Microsoft.ChangeSafety/changeRecords/read",
|                                                         "Microsoft.ChangeSafety/changeRecords/write",
|                                                         "Microsoft.ChangeSafety/changeRecords/delete",
|                                                         "Microsoft.ChangeSafety/changeStates/stageProgressions/read",
|                                                         "Microsoft.ChangeSafety/changeStates/stageProgressions/write",
|                                                         "Microsoft.ChangeSafety/changeStates/stageProgressions/delete",
|                                                         "Microsoft.ChangeSafety/changeRecords/stageProgressions/read",
|                                                         "Microsoft.ChangeSafety/changeRecords/stageProgressions/write",
|                                                         "Microsoft.ChangeSafety/changeRecords/stageProgressions/delete",
|                                                         "Microsoft.ChangeSafety/locations/operationstatuses/read",
|                                                         "Microsoft.ChangeSafety/locations/operationstatuses/write",
|                                                         "Microsoft.ChangeSafety/safeRollouts/read",
|                                                         "Microsoft.ChangeSafety/safeRollouts/write",
|                                                         "Microsoft.ChangeSafety/safeRollouts/delete",
|                                                         "Microsoft.ChangeSafety/safeRollouts/steps/read",
|                                                         "Microsoft.ChangeSafety/stageMaps/read",
|                                                         "Microsoft.ChangeSafety/stageMaps/write",
|                                                         "Microsoft.ChangeSafety/stageMaps/delete",
|                                                         "Microsoft.ChangeSafety/validations/read",
|                                                         "Microsoft.ChangeSafety/validations/write",
|                                                         "Microsoft.ChangeSafety/validations/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d0a94e7a-d791-4571-b2e0-8bdd8f867544",
|                                         "Name":  "Clinical Coder Data User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows processing of health data only; no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthBot/healthBots/AIActions/ClinicalCoder/Process/Action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "40ead2a5-466e-4039-8a80-325542d9d2dd",
|                                         "Name":  "Defender Unified RBAC Data Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Managed role for Defender RBAC data; no direct identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.operationalinsights/workspaces/read",
|                                                         "Microsoft.operationalinsights/workspaces/write",
|                                                         "Microsoft.operationalinsights/workspaces/query/read",
|                                                         "Microsoft.operationalinsights/workspaces/tables/write",
|                                                         "Microsoft.operationalinsights/workspaces/tables/delete",
|                                                         "Microsoft.operationalinsights/workspaces/sharedkeys/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "478d20ba-a53e-4946-b33c-8078a92f2d0a",
|                                         "Name":  "Azure Local Disconnected Operations Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages disconnected operations but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Edge/disconnectedOperations/*/read",
|                                                         "Microsoft.Edge/disconnectedOperations/*/write",
|                                                         "Microsoft.Edge/disconnectedOperations/*/delete",
|                                                         "Microsoft.Edge/winfields/*/read",
|                                                         "Microsoft.Edge/winfields/*/write",
|                                                         "Microsoft.Edge/winfields/*/delete",
|                                                         "Microsoft.Edge/winfields/*/action",
|                                                         "Microsoft.Edge/disconnectedOperations/*/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cbb820e9-e561-45bb-84c2-ef45d0a13f7d",
|                                         "Name":  "Workload Orchestration Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages workload orchestration resources without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Edge/contexts/*",
|                                                         "Microsoft.Edge/configTemplates/*",
|                                                         "Microsoft.Edge/solutionTemplates/*",
|                                                         "Microsoft.Edge/configurations/*",
|                                                         "Microsoft.Edge/configurationreferences/*",
|                                                         "Microsoft.Edge/schemas/*",
|                                                         "Microsoft.Edge/schemaReferences/*",
|                                                         "Microsoft.Edge/targets/*",
|                                                         "Microsoft.Edge/jobs/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2a94a2fd-3c4f-45d1-847d-6585ba88af94",
|                                         "Name":  "Firmware Analysis Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to firmware images; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.IoTFirmwareDefense/*/read",
|                                                         "Microsoft.IoTFirmwareDefense/workspaces/firmwares/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.IoTFirmwareDefense/firmwareGroups/*",
|                                                            "Microsoft.IoTFirmwareDefense/workspaces/firmwares/write",
|                                                            "Microsoft.IoTFirmwareDefense/workspaces/firmwares/delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "04f6c337-ffae-414c-b00f-3e80c9ab8a2c",
|                                         "Name":  "Garnet Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full data access to Garnet resource but no identity or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1694e55a-2496-4d07-b005-7259aa3fcbe8",
|                                         "Name":  "Garnet Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to Garnet keys only; no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/append/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/bzmpop/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/bzpopmax/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/bzpopmin/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/decr/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/decrby/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/del/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/exists/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/expire/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/get/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/getdel/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/getex/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/getrange/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/getset/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hdel/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hexists/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hexpire/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hexpireat/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hexpiretime/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hgetall/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hincrby/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hincrbyfloat/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/histogram/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hkeys/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hlen/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hmget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hmset/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hpersist/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hpexpire/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hpexpireat/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hpexpiretime/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hpttl/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hrandfield/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hscan/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hset/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hsetnx/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hstrlen/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/httl/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hvals/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/incr/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/incrby/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/incrbyfloat/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/lcs/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/mget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/mset/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/msetnx/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/psetex/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/readonly/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/readwrite/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sadd/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/scard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sdiff/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sdiffstore/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/set/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/setex/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/setnx/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/setrange/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sinter/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sintercard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sinterstore/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sismember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/smembers/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/smismember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/smove/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/spop/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/srandmember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/srem/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sscan/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/strlen/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/substr/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sunion/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sunionstore/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/unlink/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zadd/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zcard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zcount/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zdiff/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zdiffstore/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zincrby/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zinter/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zintercard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zinterstore/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zlexcount/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zmpop/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zmscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zpopmax/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zpopmin/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrandmember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrange/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrangebylex/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrangebyscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrangestore/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrank/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrem/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zremrangebylex/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zremrangebyrank/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zremrangebyscore/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrange/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebylex/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebyscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrank/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zscan/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zunion/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zunionstore/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d9cd91b9-dada-4fa9-9406-454c4659c137",
|                                         "Name":  "Garnet Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Garnet keys; no identity or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/exists/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/get/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/getex/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/getrange/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hexists/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hexpiretime/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hgetall/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/histogram/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hkeys/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hlen/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hmget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hpexpiretime/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hpttl/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hrandfield/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hscan/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hstrlen/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/httl/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hvals/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/lcs/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/mget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/readonly/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/scard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sdiff/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sinter/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sintercard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sismember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/smembers/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/smismember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/srandmember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sscan/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/strlen/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/substr/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sunion/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zcard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zcount/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zdiff/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zinter/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zintercard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zlexcount/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zmscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrandmember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrange/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrangebylex/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrangebyscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrank/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrange/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebylex/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebyscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrank/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zscan/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zunion/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7021ea36-e168-4bc0-af53-88de51d20665",
|                                         "Name":  "Garnet Script Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can execute and manage scripts on Garnet resource but no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/scripteval/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/scriptevalsha/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/scriptexists/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/scriptflush/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/scriptload/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/slots/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1fd5d8bf-9037-4ede-89bf-680f798e2765",
|                                         "Name":  "Defender Unified RBAC Authorization Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Managed role for Defender RBAC authorization; no direct identity or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "78b7345a-1e1b-483a-ac62-62228c6ea89d",
|                                         "Name":  "Defender Unified RBAC Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Defender RBAC data; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.SecurityInsights/*/read",
|                                                         "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/LinkedServices/read",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                         "Microsoft.OperationalInsights/querypacks/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.Insights/workbooks/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                            "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.OperationalInsights/workspaces/tables/data/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "625a1cea-653b-4a19-bd3a-df1d66ab6637",
|                                         "Name":  "Defender Unified RBAC Contributor and Responder",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Provides read and limited write access to Defender resources but no identity plane control or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.OperationalInsights/querypacks/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.SecurityInsights/*",
|                                                         "Microsoft.SecurityInsights/*/read",
|                                                         "Microsoft.SecurityInsights/automationRules/*",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/systems/undoAction/action",
|                                                         "Microsoft.SecurityInsights/cases/*",
|                                                         "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                         "Microsoft.SecurityInsights/entities/runPlaybook/action",
|                                                         "Microsoft.SecurityInsights/incidents/*",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/bulkTag/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/replaceTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                         "Microsoft.Insights/workbooks/*",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.SecurityInsights/cases/*/Delete",
|                                                            "Microsoft.SecurityInsights/incidents/*/Delete",
|                                                            "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                            "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ca62263b-07d5-4b48-b437-088803f5c2ff",
|                                         "Name":  "Defender Unified RBAC Authorization Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Defender RBAC authorization data without any write or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1bacae94-6c0f-4d2d-8dfa-408d5a28e6ec",
|                                         "Name":  "Defender Unified RBAC Responder",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and respond to security insights but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.SecurityInsights/*/read",
|                                                         "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                         "Microsoft.SecurityInsights/automationRules/*",
|                                                         "Microsoft.SecurityInsights/cases/*",
|                                                         "Microsoft.SecurityInsights/incidents/*",
|                                                         "Microsoft.SecurityInsights/entities/runPlaybook/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/bulkTag/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/replaceTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/systems/undoAction/action",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/querypacks/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/workbooks/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.SecurityInsights/cases/*/Delete",
|                                                            "Microsoft.SecurityInsights/incidents/*/Delete",
|                                                            "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                            "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "679dc20a-52e8-4ac0-a23c-3b557dfb1e24",
|                                         "Name":  "Azure Monitor Pipeline Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages monitoring pipeline resources without permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Monitor/pipelineGroups/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2d50f159-7b96-4f1e-8fc7-fee6957ab7cc",
|                                         "Name":  "Azure Monitor Pipeline Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to monitoring pipeline resources with no identity plane impact.",
|                                         "Actions":  [
|                                                         "Microsoft.Monitor/pipelineGroups/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fd8ea4d5-6509-4db0-bada-356ab233b4fa",
|                                         "Name":  "Azure Migrate Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Azure Migrate projects but does not have permissions to assign high privilege roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/locations/read",
|                                                         "Microsoft.Resources/checkResourceName/action",
|                                                         "Microsoft.Resources/deploymentScripts/write",
|                                                         "Microsoft.Resources/deploymentScripts/read",
|                                                         "Microsoft.Resources/links/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/locks/write",
|                                                         "Microsoft.Authorization/locks/delete",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Migrate/*",
|                                                         "Microsoft.ApplicationMigration/*",
|                                                         "Microsoft.OffAzure/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.MySQLDiscovery/*",
|                                                         "Microsoft.DependencyMap/*",
|                                                         "Microsoft.KeyVault/vaults/*",
|                                                         "Microsoft.KeyVault/checkNameAvailability/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/register/action",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/privateEndpoints/read",
|                                                         "Microsoft.Network/privateEndpoints/write",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                         "Microsoft.Network/privateDnsZones/write",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                         "Microsoft.Network/privateDnsZones/join/action",
|                                                         "Microsoft.Network/privateDnsZones/A/write",
|                                                         "Microsoft.Network/register/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/*",
|                                                         "Microsoft.GuestConfiguration/register/action",
|                                                         "Microsoft.Compute/register/action",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/availabilitySets/vmSizes/read",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Compute/skus/read",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachines/delete",
|                                                         "Microsoft.HybridConnectivity/register/action",
|                                                         "Microsoft.RecoveryServices/vaults/*",
|                                                         "Microsoft.RecoveryServices/register/action",
|                                                         "Microsoft.RecoveryServices/operations/read",
|                                                         "Microsoft.DataReplication/*/read",
|                                                         "Microsoft.DataReplication/register/action",
|                                                         "Microsoft.DataReplication/replicationVaults/write",
|                                                         "Microsoft.KeyVault/register/action",
|                                                         "Microsoft.AzureArcData/register/action",
|                                                         "Microsoft.Resources/links/read",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7859c0b0-0bb9-4994-bd12-cd529af7d646",
|                                         "Name":  "Azure Migrate Decide and Plan Expert",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Restricted to planning operations with no identity plane control or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/locations/read",
|                                                         "Microsoft.Resources/checkResourceName/action",
|                                                         "Microsoft.Resources/deploymentScripts/write",
|                                                         "Microsoft.Resources/deploymentScripts/read",
|                                                         "Microsoft.Resources/links/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/locks/write",
|                                                         "Microsoft.Authorization/locks/delete",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Migrate/*",
|                                                         "Microsoft.ApplicationMigration/*",
|                                                         "Microsoft.OffAzure/*",
|                                                         "Microsoft.MySQLDiscovery/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.DependencyMap/*",
|                                                         "Microsoft.KeyVault/vaults/*",
|                                                         "Microsoft.KeyVault/checkNameAvailability/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/register/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/privateEndpoints/read",
|                                                         "Microsoft.Network/privateEndpoints/write",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                         "Microsoft.Network/privateDnsZones/write",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                         "Microsoft.Network/privateDnsZones/join/action",
|                                                         "Microsoft.Network/privateDnsZones/A/write",
|                                                         "Microsoft.Network/register/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/*/read",
|                                                         "Microsoft.Storage/storageAccounts/*/write",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.GuestConfiguration/register/action",
|                                                         "Microsoft.HybridConnectivity/register/action",
|                                                         "Microsoft.DataReplication/*/read",
|                                                         "Microsoft.DataReplication/register/action",
|                                                         "Microsoft.DataReplication/replicationVaults/write",
|                                                         "Microsoft.RecoveryServices/vaults/*",
|                                                         "Microsoft.RecoveryServices/register/action",
|                                                         "Microsoft.KeyVault/register/action",
|                                                         "Microsoft.AzureArcData/register/action",
|                                                         "Microsoft.Resources/links/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ba480ccd-6499-4709-b581-8f38bb215c63",
|                                         "Name":  "Azure Migrate Service Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to Azure Migrate service data without permissions to modify roles or credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.ApplicationMigration/*/read",
|                                                         "Microsoft.Migrate/*/read",
|                                                         "Microsoft.OffAzure/*/read",
|                                                         "Microsoft.MySQLDiscovery/*/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationMigrationItems/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1cfa4eac-9a23-481c-a793-bfb6958e836b",
|                                         "Name":  "Azure Migrate Execute Expert",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Performs migration operations but lacks permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/locations/read",
|                                                         "Microsoft.Resources/checkResourceName/action",
|                                                         "Microsoft.Resources/deploymentScripts/write",
|                                                         "Microsoft.Resources/deploymentScripts/read",
|                                                         "Microsoft.Resources/links/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/locks/write",
|                                                         "Microsoft.Authorization/locks/delete",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Migrate/*/read",
|                                                         "Microsoft.ApplicationMigration/*/read",
|                                                         "Microsoft.OffAzure/*/read",
|                                                         "Microsoft.MySQLDiscovery/*/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Storage/storageAccounts/*/read",
|                                                         "Microsoft.Storage/storageAccounts/*/write",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Compute/register/action",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/availabilitySets/vmSizes/read",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Compute/skus/read",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachines/delete",
|                                                         "Microsoft.RecoveryServices/vaults/*",
|                                                         "Microsoft.RecoveryServices/register/action",
|                                                         "Microsoft.RecoveryServices/operations/read",
|                                                         "Microsoft.Resources/links/read",
|                                                         "Microsoft.DependencyMap/*/read",
|                                                         "Microsoft.DependencyMap/maps/*/action",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.OffAzure/hypervSites/machines/inventoryinsights/pendingupdates/*",
|                                                            "Microsoft.OffAzure/hypervSites/machines/inventoryinsights/vulnerabilities/*",
|                                                            "Microsoft.OffAzure/serverSites/machines/inventoryinsights/pendingupdates/*",
|                                                            "Microsoft.OffAzure/serverSites/machines/inventoryinsights/vulnerabilities/*",
|                                                            "Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/vulnerabilities/*",
|                                                            "Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/pendingupdates/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "98c206fe-ea1b-4578-93f8-83a99a5628fc",
|                                         "Name":  "Aws Connector contributor role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages AWS connector resources without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AwsConnector/accessAnalyzerAnalyzers/delete",
|                                                         "Microsoft.AwsConnector/accessAnalyzerAnalyzers/write",
|                                                         "Microsoft.AwsConnector/acmCertificateSummaries/delete",
|                                                         "Microsoft.AwsConnector/acmCertificateSummaries/write",
|                                                         "Microsoft.AwsConnector/apiGatewayRestApis/delete",
|                                                         "Microsoft.AwsConnector/apiGatewayRestApis/write",
|                                                         "Microsoft.AwsConnector/apiGatewayStages/delete",
|                                                         "Microsoft.AwsConnector/apiGatewayStages/write",
|                                                         "Microsoft.AwsConnector/applicationAutoScalingScalableTargets/delete",
|                                                         "Microsoft.AwsConnector/applicationAutoScalingScalableTargets/write",
|                                                         "Microsoft.AwsConnector/appSyncGraphqlApis/delete",
|                                                         "Microsoft.AwsConnector/appSyncGraphqlApis/write",
|                                                         "Microsoft.AwsConnector/autoScalingAutoScalingGroups/delete",
|                                                         "Microsoft.AwsConnector/autoScalingAutoScalingGroups/write",
|                                                         "Microsoft.AwsConnector/bedrockAgentAliases/delete",
|                                                         "Microsoft.AwsConnector/bedrockAgentAliases/write",
|                                                         "Microsoft.AwsConnector/bedrockAgents/delete",
|                                                         "Microsoft.AwsConnector/bedrockAgents/write",
|                                                         "Microsoft.AwsConnector/bedrockApplicationInferenceProfiles/delete",
|                                                         "Microsoft.AwsConnector/bedrockApplicationInferenceProfiles/write",
|                                                         "Microsoft.AwsConnector/bedrockBlueprints/delete",
|                                                         "Microsoft.AwsConnector/bedrockBlueprints/write",
|                                                         "Microsoft.AwsConnector/bedrockDataAutomationProjects/delete",
|                                                         "Microsoft.AwsConnector/bedrockDataAutomationProjects/write",
|                                                         "Microsoft.AwsConnector/bedrockDataSources/delete",
|                                                         "Microsoft.AwsConnector/bedrockDataSources/write",
|                                                         "Microsoft.AwsConnector/bedrockFlowAliases/delete",
|                                                         "Microsoft.AwsConnector/bedrockFlowAliases/write",
|                                                         "Microsoft.AwsConnector/bedrockGuardrails/delete",
|                                                         "Microsoft.AwsConnector/bedrockGuardrails/write",
|                                                         "Microsoft.AwsConnector/bedrockKnowledgeBases/delete",
|                                                         "Microsoft.AwsConnector/bedrockKnowledgeBases/write",
|                                                         "Microsoft.AwsConnector/bedrockPrompts/delete",
|                                                         "Microsoft.AwsConnector/bedrockPrompts/write",
|                                                         "Microsoft.AwsConnector/cloudFormationStacks/delete",
|                                                         "Microsoft.AwsConnector/cloudFormationStacks/write",
|                                                         "Microsoft.AwsConnector/cloudFormationStackSets/delete",
|                                                         "Microsoft.AwsConnector/cloudFormationStackSets/write",
|                                                         "Microsoft.AwsConnector/cloudFrontDistributions/delete",
|                                                         "Microsoft.AwsConnector/cloudFrontDistributions/write",
|                                                         "Microsoft.AwsConnector/cloudTrailTrails/delete",
|                                                         "Microsoft.AwsConnector/cloudTrailTrails/write",
|                                                         "Microsoft.AwsConnector/cloudWatchAlarms/delete",
|                                                         "Microsoft.AwsConnector/cloudWatchAlarms/write",
|                                                         "Microsoft.AwsConnector/codeBuildProjects/delete",
|                                                         "Microsoft.AwsConnector/codeBuildProjects/write",
|                                                         "Microsoft.AwsConnector/codeBuildSourceCredentialsInfos/delete",
|                                                         "Microsoft.AwsConnector/codeBuildSourceCredentialsInfos/write",
|                                                         "Microsoft.AwsConnector/configServiceConfigurationRecorders/delete",
|                                                         "Microsoft.AwsConnector/configServiceConfigurationRecorders/write",
|                                                         "Microsoft.AwsConnector/configServiceConfigurationRecorderStatuses/delete",
|                                                         "Microsoft.AwsConnector/configServiceConfigurationRecorderStatuses/write",
|                                                         "Microsoft.AwsConnector/configServiceDeliveryChannels/delete",
|                                                         "Microsoft.AwsConnector/configServiceDeliveryChannels/write",
|                                                         "Microsoft.AwsConnector/databaseMigrationServiceReplicationInstances/delete",
|                                                         "Microsoft.AwsConnector/databaseMigrationServiceReplicationInstances/write",
|                                                         "Microsoft.AwsConnector/daxClusters/delete",
|                                                         "Microsoft.AwsConnector/daxClusters/write",
|                                                         "Microsoft.AwsConnector/dynamoDBContinuousBackupsDescriptions/delete",
|                                                         "Microsoft.AwsConnector/dynamoDBContinuousBackupsDescriptions/write",
|                                                         "Microsoft.AwsConnector/dynamoDBTables/delete",
|                                                         "Microsoft.AwsConnector/dynamoDBTables/write",
|                                                         "Microsoft.AwsConnector/ec2AccountAttributes/delete",
|                                                         "Microsoft.AwsConnector/ec2AccountAttributes/write",
|                                                         "Microsoft.AwsConnector/ec2Addresses/delete",
|                                                         "Microsoft.AwsConnector/ec2Addresses/write",
|                                                         "Microsoft.AwsConnector/ec2FlowLogs/delete",
|                                                         "Microsoft.AwsConnector/ec2FlowLogs/write",
|                                                         "Microsoft.AwsConnector/ec2Images/delete",
|                                                         "Microsoft.AwsConnector/ec2Images/write",
|                                                         "Microsoft.AwsConnector/ec2Instances/delete",
|                                                         "Microsoft.AwsConnector/ec2Instances/start/action",
|                                                         "Microsoft.AwsConnector/ec2Instances/stop/action",
|                                                         "Microsoft.AwsConnector/ec2Instances/write",
|                                                         "Microsoft.AwsConnector/ec2InstanceStatuses/delete",
|                                                         "Microsoft.AwsConnector/ec2InstanceStatuses/write",
|                                                         "Microsoft.AwsConnector/ec2Ipams/delete",
|                                                         "Microsoft.AwsConnector/ec2Ipams/write",
|                                                         "Microsoft.AwsConnector/ec2KeyPairs/delete",
|                                                         "Microsoft.AwsConnector/ec2KeyPairs/write",
|                                                         "Microsoft.AwsConnector/ec2NetworkAcls/delete",
|                                                         "Microsoft.AwsConnector/ec2NetworkAcls/write",
|                                                         "Microsoft.AwsConnector/ec2NetworkInterfaces/delete",
|                                                         "Microsoft.AwsConnector/ec2NetworkInterfaces/write",
|                                                         "Microsoft.AwsConnector/ec2RouteTables/delete",
|                                                         "Microsoft.AwsConnector/ec2RouteTables/write",
|                                                         "Microsoft.AwsConnector/ec2SecurityGroups/delete",
|                                                         "Microsoft.AwsConnector/ec2SecurityGroups/write",
|                                                         "Microsoft.AwsConnector/ec2Snapshots/delete",
|                                                         "Microsoft.AwsConnector/ec2Snapshots/write",
|                                                         "Microsoft.AwsConnector/ec2Subnets/delete",
|                                                         "Microsoft.AwsConnector/ec2Subnets/write",
|                                                         "Microsoft.AwsConnector/ec2Volumes/delete",
|                                                         "Microsoft.AwsConnector/ec2Volumes/write",
|                                                         "Microsoft.AwsConnector/ec2VPCEndpoints/delete",
|                                                         "Microsoft.AwsConnector/ec2VPCEndpoints/write",
|                                                         "Microsoft.AwsConnector/ec2VPCPeeringConnections/delete",
|                                                         "Microsoft.AwsConnector/ec2VPCPeeringConnections/write",
|                                                         "Microsoft.AwsConnector/ec2Vpcs/delete",
|                                                         "Microsoft.AwsConnector/ec2Vpcs/write",
|                                                         "Microsoft.AwsConnector/ecrImageDetails/delete",
|                                                         "Microsoft.AwsConnector/ecrImageDetails/write",
|                                                         "Microsoft.AwsConnector/ecrRepositories/delete",
|                                                         "Microsoft.AwsConnector/ecrRepositories/write",
|                                                         "Microsoft.AwsConnector/ecsClusters/delete",
|                                                         "Microsoft.AwsConnector/ecsClusters/write",
|                                                         "Microsoft.AwsConnector/ecsServices/delete",
|                                                         "Microsoft.AwsConnector/ecsServices/write",
|                                                         "Microsoft.AwsConnector/ecsTaskDefinitions/delete",
|                                                         "Microsoft.AwsConnector/ecsTaskDefinitions/write",
|                                                         "Microsoft.AwsConnector/efsFileSystems/delete",
|                                                         "Microsoft.AwsConnector/efsFileSystems/write",
|                                                         "Microsoft.AwsConnector/efsMountTargets/delete",
|                                                         "Microsoft.AwsConnector/efsMountTargets/write",
|                                                         "Microsoft.AwsConnector/eksClusters/delete",
|                                                         "Microsoft.AwsConnector/eksClusters/write",
|                                                         "Microsoft.AwsConnector/eksNodegroups/delete",
|                                                         "Microsoft.AwsConnector/eksNodegroups/write",
|                                                         "Microsoft.AwsConnector/elasticBeanstalkApplications/delete",
|                                                         "Microsoft.AwsConnector/elasticBeanstalkApplications/write",
|                                                         "Microsoft.AwsConnector/elasticBeanstalkConfigurationTemplates/delete",
|                                                         "Microsoft.AwsConnector/elasticBeanstalkConfigurationTemplates/write",
|                                                         "Microsoft.AwsConnector/elasticBeanstalkEnvironments/delete",
|                                                         "Microsoft.AwsConnector/elasticBeanstalkEnvironments/write",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2Listeners/delete",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2Listeners/write",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2LoadBalancers/delete",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2LoadBalancers/write",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2TargetGroups/delete",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2TargetGroups/write",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2TargetHealthDescriptions/delete",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2TargetHealthDescriptions/write",
|                                                         "Microsoft.AwsConnector/elasticsearchDomains/delete",
|                                                         "Microsoft.AwsConnector/elasticsearchDomains/write",
|                                                         "Microsoft.AwsConnector/emrClusters/delete",
|                                                         "Microsoft.AwsConnector/emrClusters/write",
|                                                         "Microsoft.AwsConnector/guardDutyDetectors/delete",
|                                                         "Microsoft.AwsConnector/guardDutyDetectors/write",
|                                                         "Microsoft.AwsConnector/iamAccessKeyLastUseds/delete",
|                                                         "Microsoft.AwsConnector/iamAccessKeyLastUseds/write",
|                                                         "Microsoft.AwsConnector/iamAccessKeyMetadata/delete",
|                                                         "Microsoft.AwsConnector/iamAccessKeyMetadata/write",
|                                                         "Microsoft.AwsConnector/iamGroups/delete",
|                                                         "Microsoft.AwsConnector/iamGroups/write",
|                                                         "Microsoft.AwsConnector/iamInstanceProfiles/delete",
|                                                         "Microsoft.AwsConnector/iamInstanceProfiles/write",
|                                                         "Microsoft.AwsConnector/iamManagedPolicies/delete",
|                                                         "Microsoft.AwsConnector/iamManagedPolicies/write",
|                                                         "Microsoft.AwsConnector/iamMFADevices/delete",
|                                                         "Microsoft.AwsConnector/iamMFADevices/write",
|                                                         "Microsoft.AwsConnector/iamPasswordPolicies/delete",
|                                                         "Microsoft.AwsConnector/iamPasswordPolicies/write",
|                                                         "Microsoft.AwsConnector/iamPolicyVersions/delete",
|                                                         "Microsoft.AwsConnector/iamPolicyVersions/write",
|                                                         "Microsoft.AwsConnector/iamRoles/delete",
|                                                         "Microsoft.AwsConnector/iamRoles/write",
|                                                         "Microsoft.AwsConnector/iamServerCertificates/delete",
|                                                         "Microsoft.AwsConnector/iamServerCertificates/write",
|                                                         "Microsoft.AwsConnector/iamUserPolicies/delete",
|                                                         "Microsoft.AwsConnector/iamUserPolicies/write",
|                                                         "Microsoft.AwsConnector/iamVirtualMFADevices/delete",
|                                                         "Microsoft.AwsConnector/iamVirtualMFADevices/write",
|                                                         "Microsoft.AwsConnector/kmsAliases/delete",
|                                                         "Microsoft.AwsConnector/kmsAliases/write",
|                                                         "Microsoft.AwsConnector/kmsKeys/delete",
|                                                         "Microsoft.AwsConnector/kmsKeys/write",
|                                                         "Microsoft.AwsConnector/lambdaFunctionCodeLocations/delete",
|                                                         "Microsoft.AwsConnector/lambdaFunctionCodeLocations/write",
|                                                         "Microsoft.AwsConnector/lambdaFunctionConfigurations/delete",
|                                                         "Microsoft.AwsConnector/lambdaFunctionConfigurations/write",
|                                                         "Microsoft.AwsConnector/lambdaFunctions/delete",
|                                                         "Microsoft.AwsConnector/lambdaFunctions/write",
|                                                         "Microsoft.AwsConnector/licenseManagerLicenses/delete",
|                                                         "Microsoft.AwsConnector/licenseManagerLicenses/write",
|                                                         "Microsoft.AwsConnector/lightsailBuckets/delete",
|                                                         "Microsoft.AwsConnector/lightsailBuckets/write",
|                                                         "Microsoft.AwsConnector/lightsailInstances/delete",
|                                                         "Microsoft.AwsConnector/lightsailInstances/write",
|                                                         "Microsoft.AwsConnector/Locations/OperationStatuses/write",
|                                                         "Microsoft.AwsConnector/logsLogGroups/delete",
|                                                         "Microsoft.AwsConnector/logsLogGroups/write",
|                                                         "Microsoft.AwsConnector/logsLogStreams/delete",
|                                                         "Microsoft.AwsConnector/logsLogStreams/write",
|                                                         "Microsoft.AwsConnector/logsMetricFilters/delete",
|                                                         "Microsoft.AwsConnector/logsMetricFilters/write",
|                                                         "Microsoft.AwsConnector/logsSubscriptionFilters/delete",
|                                                         "Microsoft.AwsConnector/logsSubscriptionFilters/write",
|                                                         "Microsoft.AwsConnector/macie2JobSummaries/delete",
|                                                         "Microsoft.AwsConnector/macie2JobSummaries/write",
|                                                         "Microsoft.AwsConnector/macieAllowLists/delete",
|                                                         "Microsoft.AwsConnector/macieAllowLists/write",
|                                                         "Microsoft.AwsConnector/networkFirewallFirewallPolicies/delete",
|                                                         "Microsoft.AwsConnector/networkFirewallFirewallPolicies/write",
|                                                         "Microsoft.AwsConnector/networkFirewallFirewalls/delete",
|                                                         "Microsoft.AwsConnector/networkFirewallFirewalls/write",
|                                                         "Microsoft.AwsConnector/networkFirewallRuleGroups/delete",
|                                                         "Microsoft.AwsConnector/networkFirewallRuleGroups/write",
|                                                         "Microsoft.AwsConnector/openSearchDomainStatuses/delete",
|                                                         "Microsoft.AwsConnector/openSearchDomainStatuses/write",
|                                                         "Microsoft.AwsConnector/openSearchServiceDomains/delete",
|                                                         "Microsoft.AwsConnector/openSearchServiceDomains/write",
|                                                         "Microsoft.AwsConnector/organizationsAccounts/delete",
|                                                         "Microsoft.AwsConnector/organizationsAccounts/write",
|                                                         "Microsoft.AwsConnector/organizationsOrganizations/delete",
|                                                         "Microsoft.AwsConnector/organizationsOrganizations/write",
|                                                         "Microsoft.AwsConnector/rdsDBClusters/delete",
|                                                         "Microsoft.AwsConnector/rdsDBClusters/write",
|                                                         "Microsoft.AwsConnector/rdsDBInstances/delete",
|                                                         "Microsoft.AwsConnector/rdsDBInstances/write",
|                                                         "Microsoft.AwsConnector/rdsDBSnapshotAttributesResults/delete",
|                                                         "Microsoft.AwsConnector/rdsDBSnapshotAttributesResults/write",
|                                                         "Microsoft.AwsConnector/rdsDBSnapshots/delete",
|                                                         "Microsoft.AwsConnector/rdsDBSnapshots/write",
|                                                         "Microsoft.AwsConnector/rdsEventSubscriptions/delete",
|                                                         "Microsoft.AwsConnector/rdsEventSubscriptions/write",
|                                                         "Microsoft.AwsConnector/rdsExportTasks/delete",
|                                                         "Microsoft.AwsConnector/rdsExportTasks/write",
|                                                         "Microsoft.AwsConnector/redshiftClusterParameterGroups/delete",
|                                                         "Microsoft.AwsConnector/redshiftClusterParameterGroups/write",
|                                                         "Microsoft.AwsConnector/redshiftClusters/delete",
|                                                         "Microsoft.AwsConnector/redshiftClusters/write",
|                                                         "Microsoft.AwsConnector/route53DomainsDomainSummaries/delete",
|                                                         "Microsoft.AwsConnector/route53DomainsDomainSummaries/write",
|                                                         "Microsoft.AwsConnector/route53HostedZones/delete",
|                                                         "Microsoft.AwsConnector/route53HostedZones/write",
|                                                         "Microsoft.AwsConnector/route53ResourceRecordSets/delete",
|                                                         "Microsoft.AwsConnector/route53ResourceRecordSets/write",
|                                                         "Microsoft.AwsConnector/s3AccessControlPolicies/delete",
|                                                         "Microsoft.AwsConnector/s3AccessControlPolicies/write",
|                                                         "Microsoft.AwsConnector/s3AccessPoints/delete",
|                                                         "Microsoft.AwsConnector/s3AccessPoints/write",
|                                                         "Microsoft.AwsConnector/s3BucketPolicies/delete",
|                                                         "Microsoft.AwsConnector/s3BucketPolicies/write",
|                                                         "Microsoft.AwsConnector/s3Buckets/delete",
|                                                         "Microsoft.AwsConnector/s3Buckets/write",
|                                                         "Microsoft.AwsConnector/s3ControlMultiRegionAccessPointPolicyDocuments/delete",
|                                                         "Microsoft.AwsConnector/s3ControlMultiRegionAccessPointPolicyDocuments/write",
|                                                         "Microsoft.AwsConnector/sageMakerApps/delete",
|                                                         "Microsoft.AwsConnector/sageMakerApps/write",
|                                                         "Microsoft.AwsConnector/sageMakerDevices/delete",
|                                                         "Microsoft.AwsConnector/sageMakerDevices/write",
|                                                         "Microsoft.AwsConnector/sageMakerImages/delete",
|                                                         "Microsoft.AwsConnector/sageMakerImages/write",
|                                                         "Microsoft.AwsConnector/sageMakerNotebookInstanceSummaries/delete",
|                                                         "Microsoft.AwsConnector/sageMakerNotebookInstanceSummaries/write",
|                                                         "Microsoft.AwsConnector/secretsManagerResourcePolicies/delete",
|                                                         "Microsoft.AwsConnector/secretsManagerResourcePolicies/write",
|                                                         "Microsoft.AwsConnector/secretsManagerSecrets/delete",
|                                                         "Microsoft.AwsConnector/secretsManagerSecrets/write",
|                                                         "Microsoft.AwsConnector/snsSubscriptions/delete",
|                                                         "Microsoft.AwsConnector/snsSubscriptions/write",
|                                                         "Microsoft.AwsConnector/snsTopics/delete",
|                                                         "Microsoft.AwsConnector/snsTopics/write",
|                                                         "Microsoft.AwsConnector/sqsQueues/delete",
|                                                         "Microsoft.AwsConnector/sqsQueues/write",
|                                                         "Microsoft.AwsConnector/ssmInstanceInformations/delete",
|                                                         "Microsoft.AwsConnector/ssmInstanceInformations/write",
|                                                         "Microsoft.AwsConnector/ssmParameters/delete",
|                                                         "Microsoft.AwsConnector/ssmParameters/write",
|                                                         "Microsoft.AwsConnector/ssmResourceComplianceSummaryItems/delete",
|                                                         "Microsoft.AwsConnector/ssmResourceComplianceSummaryItems/write",
|                                                         "Microsoft.AwsConnector/wafv2IPSets/delete",
|                                                         "Microsoft.AwsConnector/wafv2IPSets/write",
|                                                         "Microsoft.AwsConnector/wafv2LoggingConfigurations/delete",
|                                                         "Microsoft.AwsConnector/wafv2LoggingConfigurations/write",
|                                                         "Microsoft.AwsConnector/wafv2WebACLAssociations/delete",
|                                                         "Microsoft.AwsConnector/wafv2WebACLAssociations/write",
|                                                         "Microsoft.AwsConnector/wafWebACLSummaries/delete",
|                                                         "Microsoft.AwsConnector/wafWebACLSummaries/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a4b156ac-253f-4a1a-9851-96d62b71b047",
|                                         "Name":  "SRE Agent Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to SRE Agent data with no ability to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/agents/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/agents/threads/read",
|                                                             "Microsoft.App/agents/graph/read",
|                                                             "Microsoft.App/agents/memory/read",
|                                                             "Microsoft.App/agents/incidentManagement/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f0f57965-de58-41bc-ba76-2aaab4d09f30",
|                                         "Name":  "Hybrid Connectivity contributor role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages hybrid connectivity resources but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridConnectivity/endpoints/listIngressGatewayCredentials/action",
|                                                         "Microsoft.HybridConnectivity/Locations/OperationStatuses/write",
|                                                         "Microsoft.HybridConnectivity/publicCloudConnectors/delete",
|                                                         "Microsoft.HybridConnectivity/publicCloudConnectors/read",
|                                                         "Microsoft.HybridConnectivity/publicCloudConnectors/testPermissions/action",
|                                                         "Microsoft.HybridConnectivity/publicCloudConnectors/write",
|                                                         "Microsoft.HybridConnectivity/solutionConfigurations/delete",
|                                                         "Microsoft.HybridConnectivity/solutionConfigurations/read",
|                                                         "Microsoft.HybridConnectivity/solutionConfigurations/syncNow/action",
|                                                         "Microsoft.HybridConnectivity/solutionConfigurations/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a235d3ee-5935-4cfb-8cc5-a3303ad5995e",
|                                         "Name":  "Storage File Data SMB MI Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Admin access to files/directories for managed identities but no identity plane or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/takeOwnership/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/runAsBuiltInFileAdministrator/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b256d512-9a3a-4a96-9366-9f54f900e58b",
|                                         "Name":  "Common Edge Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages edge connectivity and updates without permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Edge/connectivityStatuses/delete",
|                                                         "Microsoft.Edge/connectivityStatuses/write",
|                                                         "Microsoft.Edge/locations/operationStatuses/write",
|                                                         "Microsoft.Edge/updates/delete",
|                                                         "Microsoft.Edge/updates/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "53b2724d-1e51-44fa-b586-bcace0c82609",
|                                         "Name":  "Firmware Analysis User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can upload and analyze firmware images but has no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.IoTFirmwareDefense/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.IoTFirmwareDefense/firmwareGroups/*",
|                                                            "Microsoft.IoTFirmwareDefense/register/action",
|                                                            "Microsoft.IoTFirmwareDefense/unregister/action",
|                                                            "Microsoft.IoTFirmwareDefense/workspaces/write",
|                                                            "Microsoft.IoTFirmwareDefense/workspaces/delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e79298df-d852-4c6d-84f9-5d13249d1e55",
|                                         "Name":  "SRE Agent Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full control of SRE Agent but no permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/agents/read",
|                                                         "Microsoft.App/agents/*/read",
|                                                         "Microsoft.App/agents/write",
|                                                         "Microsoft.App/agents/*/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/agents/*/read",
|                                                             "Microsoft.App/agents/*/write",
|                                                             "Microsoft.App/agents/*/delete",
|                                                             "Microsoft.App/agents/threads/approve/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2d84a65a-63b2-4343-bbb6-31105d857bc1",
|                                         "Name":  "SRE Agent Standard User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Limited interaction with SRE Agent without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/agents/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/agents/threads/read",
|                                                             "Microsoft.App/agents/graph/read",
|                                                             "Microsoft.App/agents/memory/read",
|                                                             "Microsoft.App/agents/incidentManagement/read",
|                                                             "Microsoft.App/agents/threads/write",
|                                                             "Microsoft.App/agents/graph/write",
|                                                             "Microsoft.App/agents/memory/write",
|                                                             "Microsoft.App/agents/scheduledtasks/read",
|                                                             "Microsoft.App/agents/scheduledtasks/write",
|                                                             "Microsoft.App/agents/scheduledtasks/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "850c5848-fc51-4a9a-8823-f220370626e3",
|                                         "Name":  "Azure Kubernetes Fleet Manager Hub Cluster User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to Kubernetes fleet and config files but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action",
|                                                         "Microsoft.ContainerService/fleets/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3b03c2da-16b3-4a49-8834-0f8130efdd3b",
|                                         "Name":  "Log Analytics Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can query logs but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.OperationalInsights/workspaces/tables/data/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "89f7a3ec-e9d0-40eb-9b96-c016a5c2a53f",
|                                         "Name":  "Dynamics 365 Customer Insights Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages diagnostic logging for Customer Insights without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.D365CustomerInsights/instances/write",
|                                                         "Microsoft.D365CustomerInsights/instances/providers/Microsoft.Insights/diagnosticSettings/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "77789c21-1643-48a2-8f27-47f858540b51",
|                                         "Name":  "Storage Actions Task Assignment Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Creates task assignments on storage accounts but cannot assign high privilege roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/reports/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/storageTaskAssignments/read",
|                                                         "Microsoft.Storage/storageAccounts/storageTaskAssignments/write",
|                                                         "Microsoft.Storage/storageAccounts/storageTaskAssignments/delete",
|                                                         "Microsoft.Storage/storageAccounts/storageTaskAssignments/reports/read",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4bad4d9e-2a13-4888-94bb-c8432f6f3040",
|                                         "Name":  "Storage Actions Blob Data Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Performs blob operations without permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/runAsSuperUser/action",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/immutableStorage/runAsSuperUser/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "55077723-1b30-4603-a70b-68de134cfa20",
|                                         "Name":  "Azure Native Dynatrace Agent Management Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Dynatrace Agent on compute resources without identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bd8acdb0-202c-4493-a7fe-ef98eefbfbc4",
|                                         "Name":  "Storage Actions Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages storage actions but lacks permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.StorageActions/storageTasks/read",
|                                                         "Microsoft.StorageActions/storageTasks/write",
|                                                         "Microsoft.StorageActions/storageTasks/delete",
|                                                         "Microsoft.StorageActions/storageTasks/storageTaskAssignments/read",
|                                                         "Microsoft.StorageActions/storageTasks/reports/read",
|                                                         "Microsoft.StorageActions/locations/previewActions/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "34013b0a-565b-43aa-8755-1b7c286f6cf7",
|                                         "Name":  "Essential Machine Management Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages machine management resources without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Insights/dataCollectionRules/read",
|                                                         "Microsoft.Insights/dataCollectionRules/write",
|                                                         "Microsoft.Monitor/accounts/write",
|                                                         "Microsoft.Monitor/accounts/read",
|                                                         "Microsoft.ManagedOps/managedOps/read",
|                                                         "Microsoft.ManagedOps/managedOps/write",
|                                                         "Microsoft.ManagedOps/managedOps/delete",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.OperationsManagement/solutions/write",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedkeys/read",
|                                                         "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/metricAlerts/write",
|                                                         "Microsoft.Insights/metricAlerts/read",
|                                                         "Microsoft.Security/pricings/write",
|                                                         "Microsoft.Security/pricings/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "56e95fdc-3337-468d-b964-30d07f2a2018",
|                                         "Name":  "Garnet PubSub Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to Garnet channels but no identity plane or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/channels/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/numsub/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/numpat/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/psubscribe/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/publish/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/punsubscribe/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/subscribe/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/unsubscribe/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "da9adf61-39cd-41d5-87a0-30b21f7270d8",
|                                         "Name":  "Garnet PubSub Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Garnet channels without identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/channels/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/psubscribe/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/punsubscribe/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/subscribe/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/unsubscribe/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bbf004e3-0e4b-4f86-ae4f-1f8fb47b357b",
|                                         "Name":  "Storage File Data SMB Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Admin access to storage files over SMB but no permissions to modify identity or role assignments.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/takeOwnership/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "68899692-f960-4247-af28-82f55b357997",
|                                         "Name":  "Supercomputer Infrastructure Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages supercomputer infrastructure resources without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.SupercomputerInfrastructure/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "13d06eae-ec82-4345-bcd6-c38625ddffbc",
|                                         "Name":  "Healthcare Agent Contributer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages healthcare agent resources without permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.HealthBot/healthBots/Read",
|                                                         "Microsoft.HealthBot/healthBots/Write",
|                                                         "Microsoft.HealthBot/healthBots/Delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4c7fd853-7345-4453-babd-e9481e9b460b",
|                                         "Name":  "Azure Resilience Management Recovery Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages recovery plans but lacks permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                         "Microsoft.Insights/alertRules/",
|                                                         "Microsoft.Management/ServiceGroups/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/write",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "481d9636-d9f0-468b-b93d-6056318e6f36",
|                                         "Name":  "Azure Resilience Management Recovery Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Administrator of recovery service without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                         "Microsoft.Insights/alertRules/",
|                                                         "Microsoft.Management/ServiceGroups/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/write",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8210e6a3-4e4c-4e1a-bd83-ef8bac788a45",
|                                         "Name":  "Azure Resilience Management Recovery Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to recovery plans and related resources without identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                         "Microsoft.Insights/alertRules/",
|                                                         "Microsoft.Management/ServiceGroups/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/read",
|                                                         "Microsoft.Resources/deployments/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "517781b0-5ad4-4418-94d5-f2421834b586",
|                                         "Name":  "Azure Resilience Management Recovery Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Operator role with action permissions on recovery plans but no role assignment or credential reset capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                         "Microsoft.Insights/alertRules/",
|                                                         "Microsoft.Management/ServiceGroups/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a5c3590a-3a1a-4cd4-9648-ea0a32b15137",
|                                         "Name":  "Azure Device Registry Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to IoT devices but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "microsoft.deviceregistry/namespaces/read",
|                                                         "microsoft.deviceregistry/namespaces/devices/*",
|                                                         "microsoft.deviceregistry/namespaces/discovereddevices/*",
|                                                         "microsoft.deviceregistry/namespaces/credentials/read",
|                                                         "microsoft.deviceregistry/namespaces/credentials/policies/read",
|                                                         "microsoft.devices/iothubs/certificates/*",
|                                                         "microsoft.devices/iothubs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "microsoft.deviceregistry/namespaces/credentials/policies/issueCertificate/action",
|                                                             "microsoft.devices/iothubs/devices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "09267e11-2e06-40b5-8fe4-68cea20794c9",
|                                         "Name":  "Azure Device Registry Credentials Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages credentials and policies for device registry without identity plane control.",
|                                         "Actions":  [
|                                                         "microsoft.deviceregistry/namespaces/credentials/*",
|                                                         "microsoft.deviceregistry/namespaces/credentials/policies/*",
|                                                         "microsoft.deviceregistry/namespaces/devices/revoke/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d5dddae-e124-4753-972d-aae60b37deb4",
|                                         "Name":  "Migrate Arc Discovery Reader - Preview",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Azure Arc resources without permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/read",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/databases/read",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/read",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/getTelemetry/action",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/getDetailView/action",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "547f7f0a-69c0-4807-bd9e-0321dfb66a84",
|                                         "Name":  "Azure Device Registry Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to device registry namespace and certificate provisioning without identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DeviceRegistry/namespaces/read",
|                                                         "Microsoft.DeviceRegistry/namespaces/write",
|                                                         "Microsoft.DeviceRegistry/namespaces/delete",
|                                                         "Microsoft.DeviceRegistry/namespaces/credentials/*",
|                                                         "Microsoft.DeviceRegistry/namespaces/credentials/policies/*",
|                                                         "Microsoft.Devices/iothubs/*",
|                                                         "Microsoft.Devices/provisioningServices/*",
|                                                         "microsoft.deviceregistry/namespaces/devices/revoke/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Devices/provisioningServices/enrollments/*",
|                                                             "Microsoft.Devices/provisioningServices/enrollmentGroups/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9d3ef640-3c86-4e0a-8907-8d361559c012",
|                                         "Name":  "Hybrid Network Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Owner access to hybrid network resources but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridNetwork/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a2b7cc47-30ec-462f-a2f4-9ac6e1c266af",
|                                         "Name":  "Azure Resilience Management Goals Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages resiliency goals and assignments but lacks permissions to assign high privilege roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Management/ServiceGroups/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/read",
|                                                         "Microsoft.AzureResilienceManagement/goalTemplates/delete",
|                                                         "Microsoft.AzureResilienceManagement/goalTemplates/read",
|                                                         "Microsoft.AzureResilienceManagement/goalTemplates/write",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/delete",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/read",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/write",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/goalResources/read",
|                                                         "Microsoft.AzureResilienceManagement/locations/operationStatuses/read",
|                                                         "Microsoft.AzureResilienceManagement/operations/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3910633d-19d0-4d31-b5e6-4f3101b137b9",
|                                         "Name":  "Azure Resilience Management Goals Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can view and modify resiliency goals but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Management/ServiceGroups/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/read",
|                                                         "Microsoft.AzureResilienceManagement/goalTemplates/delete",
|                                                         "Microsoft.AzureResilienceManagement/goalTemplates/read",
|                                                         "Microsoft.AzureResilienceManagement/goalTemplates/write",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/delete",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/read",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/write",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/goalResources/read",
|                                                         "Microsoft.AzureResilienceManagement/locations/operationStatuses/read",
|                                                         "Microsoft.AzureResilienceManagement/operations/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "39ea2c4e-798a-4469-b81d-65dc7c54cbdb",
|                                         "Name":  "Azure Resilience Management Goals Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to resiliency goals without permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureResilienceManagement/goalTemplates/read",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/read",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/goalResources/read",
|                                                         "Microsoft.AzureResilienceManagement/locations/operationStatuses/read",
|                                                         "Microsoft.AzureResilienceManagement/operations/read",
|                                                         "Microsoft.Management/ServiceGroups/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "852e55ca-96ce-48b0-abca-2cd74d9042ca",
|                                         "Name":  "Azure Kubernetes Application Network Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Kubernetes application network resources without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppLink/AppLinks/read",
|                                                         "Microsoft.AppLink/AppLinks/write",
|                                                         "Microsoft.AppLink/AppLinks/delete",
|                                                         "Microsoft.AppLink/AppLinks/AppLinkMembers/read",
|                                                         "Microsoft.AppLink/AppLinks/AppLinkMembers/write",
|                                                         "Microsoft.AppLink/AppLinks/AppLinkMembers/delete",
|                                                         "Microsoft.AppLink/locations/operationStatuses/read",
|                                                         "Microsoft.AppLink/Locations/OperationStatuses/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "463ad26c-fcce-4469-9c7f-5653d8acbab5",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Reader for Member Clusters",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Kubernetes namespace objects without ability to view or modify roles or role bindings.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/members/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/fleets/members/apps/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/members/apps/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/members/apps/replicasets/read",
|                                                             "Microsoft.ContainerService/fleets/members/apps/statefulsets/read",
|                                                             "Microsoft.ContainerService/fleets/members/autoscaling/horizontalpodautoscalers/read",
|                                                             "Microsoft.ContainerService/fleets/members/batch/cronjobs/read",
|                                                             "Microsoft.ContainerService/fleets/members/batch/jobs/read",
|                                                             "Microsoft.ContainerService/fleets/members/configmaps/read",
|                                                             "Microsoft.ContainerService/fleets/members/discovery.k8s.io/endpointslices/read",
|                                                             "Microsoft.ContainerService/fleets/members/endpoints/read",
|                                                             "Microsoft.ContainerService/fleets/members/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/fleets/members/events/read",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/replicasets/read",
|                                                             "Microsoft.ContainerService/fleets/members/limitranges/read",
|                                                             "Microsoft.ContainerService/fleets/members/metrics.k8s.io/pods/read",
|                                                             "Microsoft.ContainerService/fleets/members/metrics.k8s.io/nodes/read",
|                                                             "Microsoft.ContainerService/fleets/members/namespaces/read",
|                                                             "Microsoft.ContainerService/fleets/members/networking.k8s.io/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/members/networking.k8s.io/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/members/persistentvolumeclaims/read",
|                                                             "Microsoft.ContainerService/fleets/members/pods/read",
|                                                             "Microsoft.ContainerService/fleets/members/policy/poddisruptionbudgets/read",
|                                                             "Microsoft.ContainerService/fleets/members/replicationcontrollers/read",
|                                                             "Microsoft.ContainerService/fleets/members/resourcequotas/read",
|                                                             "Microsoft.ContainerService/fleets/members/serviceaccounts/read",
|                                                             "Microsoft.ContainerService/fleets/members/services/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d1f699ed-700a-4c77-a22f-29890ac7b115",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Admin for Member Clusters",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Admin access to most namespace objects but no permissions to modify roles or role bindings.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/members/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5eaf7b81-a48f-45ed-b6b4-c64bfe86d523",
|                                         "Name":  "Relationship Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to relationship types without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Relationships/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b54df9c1-53dc-45cc-a86d-7a83cced2ed0",
|                                         "Name":  "Relationship Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read, write, and delete access to relationship types but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Relationships/*/read",
|                                                         "Microsoft.Relationships/*/write",
|                                                         "Microsoft.Relationships/*/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "05b1aaf9-00c9-477b-b0e8-2da660b78c51",
|                                         "Name":  "Service Group Member Relationship Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows read/write/delete of service group member relationships but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Relationships/serviceGroupMember/read",
|                                                         "Microsoft.Relationships/serviceGroupMember/write",
|                                                         "Microsoft.Relationships/serviceGroupMember/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "eb64ab4c-23eb-4f63-a9c2-27da365f04e7",
|                                         "Name":  "SRE Agent Author",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows read access to authorization and alert rules and adding features to SRE Agent but no direct identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/agents/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/agents/threads/read",
|                                                             "Microsoft.App/agents/incidentManagement/read",
|                                                             "Microsoft.App/agents/incidentManagement/write",
|                                                             "Microsoft.App/agents/incidentManagement/delete",
|                                                             "Microsoft.App/agents/extendedAgents/read",
|                                                             "Microsoft.App/agents/extendedAgents/write",
|                                                             "Microsoft.App/agents/extendedAgents/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5052f0f9-7e27-4570-bc13-9ee1cf442526",
|                                         "Name":  "Microsoft Confluent Contributor role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Confluent organizations and resources but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Confluent/agreements/write",
|                                                         "Microsoft.Confluent/locations/OperationStatuses/write",
|                                                         "Microsoft.Confluent/organizations/access/createInvitation/action",
|                                                         "Microsoft.Confluent/organizations/access/deleteRoleBinding/delete",
|                                                         "Microsoft.Confluent/organizations/access/listClusters/action",
|                                                         "Microsoft.Confluent/organizations/access/listEnvironments/action",
|                                                         "Microsoft.Confluent/organizations/access/listInvitations/action",
|                                                         "Microsoft.Confluent/organizations/access/listRoleBindings/action",
|                                                         "Microsoft.Confluent/organizations/access/listServiceAccounts/action",
|                                                         "Microsoft.Confluent/organizations/access/listUsers/action",
|                                                         "Microsoft.Confluent/organizations/apiKeys/delete",
|                                                         "Microsoft.Confluent/organizations/delete",
|                                                         "Microsoft.Confluent/organizations/environments/clusters/connectors/delete",
|                                                         "Microsoft.Confluent/organizations/environments/clusters/connectors/write",
|                                                         "Microsoft.Confluent/organizations/environments/clusters/createAPIKey/action",
|                                                         "Microsoft.Confluent/organizations/environments/clusters/delete",
|                                                         "Microsoft.Confluent/organizations/environments/clusters/topics/delete",
|                                                         "Microsoft.Confluent/organizations/environments/clusters/topics/write",
|                                                         "Microsoft.Confluent/organizations/environments/clusters/write",
|                                                         "Microsoft.Confluent/organizations/environments/delete",
|                                                         "Microsoft.Confluent/organizations/environments/write",
|                                                         "Microsoft.Confluent/organizations/listRegions/action",
|                                                         "Microsoft.Confluent/organizations/write",
|                                                         "Microsoft.Confluent/validations/orgvalidate/action",
|                                                         "Microsoft.Confluent/validations/orgvalidateV2/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2e481b5d-5af3-463b-8b01-f9c948aaf0c5",
|                                         "Name":  "Informatica DataManagement Contributor role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Informatica DataManagement organizations and resources without access to identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Informatica.DataManagement/locations/operationStatuses/write",
|                                                         "Informatica.DataManagement/organizations/delete",
|                                                         "Informatica.DataManagement/organizations/getServerlessMetadata/action",
|                                                         "Informatica.DataManagement/organizations/serverlessRuntimes/delete",
|                                                         "Informatica.DataManagement/organizations/serverlessRuntimes/write",
|                                                         "Informatica.DataManagement/organizations/singleSignOnConfigurations/delete",
|                                                         "Informatica.DataManagement/organizations/singleSignOnConfigurations/write",
|                                                         "Informatica.DataManagement/organizations/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "512ef07a-840c-48d2-9be4-9a30a75a5c70",
|                                         "Name":  "Defender Cloud Secrets Posture",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to keys and connection strings for Defender posture but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDB/databaseAccounts/listKeys/action",
|                                                         "Microsoft.documentdb/mongoClusters/read",
|                                                         "Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action",
|                                                         "Microsoft.CognitiveServices/accounts/listKeys/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "344b740c-5e7c-4d32-89b2-ee3b51cb89bc",
|                                         "Name":  "Azure Resilience Management Drills Assets Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No role assignment write permission; manages automation accounts and chaos experiments but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/delete",
|                                                         "Microsoft.Automation/automationAccounts/read",
|                                                         "Microsoft.Automation/automationAccounts/write",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/delete",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/write",
|                                                         "Microsoft.Chaos/experiments/delete",
|                                                         "Microsoft.Chaos/experiments/read",
|                                                         "Microsoft.Chaos/experiments/write",
|                                                         "Microsoft.Chaos/workspaces/delete",
|                                                         "Microsoft.Chaos/workspaces/read",
|                                                         "Microsoft.Chaos/workspaces/write",
|                                                         "Microsoft.Chaos/workspaces/refreshRecommendations/action",
|                                                         "Microsoft.Chaos/workspaces/discoveredResources/read",
|                                                         "Microsoft.Chaos/workspaces/scenarios/delete",
|                                                         "Microsoft.Chaos/workspaces/scenarios/read",
|                                                         "Microsoft.Chaos/workspaces/scenarios/write",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/delete",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/read",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/write",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/cancel/action",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/execute/action",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/validate/action",
|                                                         "Microsoft.Chaos/workspaces/scenarios/runs/read",
|                                                         "Microsoft.Chaos/locations/operationResults/read",
|                                                         "Microsoft.Chaos/locations/operationStatuses/read",
|                                                         "Microsoft.Insights/dataCollectionEndpoints/read",
|                                                         "Microsoft.Insights/dataCollectionEndpoints/write",
|                                                         "Microsoft.Insights/dataCollectionRules/read",
|                                                         "Microsoft.Insights/dataCollectionRules/write",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/tables/read",
|                                                         "Microsoft.OperationalInsights/workspaces/tables/write",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "82c6a823-ae9c-4b90-b5c5-bff581c45896",
|                                         "Name":  "Azure Resilience Management Drills Target Resource Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No role assignment write permission; manages chaos targets but no direct identity or role assignment control.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Chaos/locations/targetTypes/capabilityTypes/read",
|                                                         "Microsoft.Chaos/locations/targetTypes/read",
|                                                         "Microsoft.Chaos/targets/capabilities/delete",
|                                                         "Microsoft.Chaos/targets/capabilities/read",
|                                                         "Microsoft.Chaos/targets/capabilities/write",
|                                                         "Microsoft.Chaos/targets/delete",
|                                                         "Microsoft.Chaos/targets/read",
|                                                         "Microsoft.Chaos/targets/write",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/read ",
|                                                         "Microsoft.Sql/managedInstances/read",
|                                                         "Microsoft.Web/serverfarms/read",
|                                                         "Microsoft.Web/sites/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dc0882cc-bc27-4d21-9ea2-f821aaa10fb1",
|                                         "Name":  "ARN Service Event Grid Subscriber Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows event subscription management but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.EventGrid/EventSubscriptions/write",
|                                                         "Microsoft.EventGrid/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a51d5f27-deba-47d1-9ccd-8589014b2e28",
|                                         "Name":  "Gcp Connector contributor role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages GCP connector resources without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.GcpConnector/bigQueryDatasets/delete",
|                                                         "Microsoft.GcpConnector/bigQueryDatasets/write",
|                                                         "Microsoft.GcpConnector/cloudFunctions/delete",
|                                                         "Microsoft.GcpConnector/cloudFunctions/write",
|                                                         "Microsoft.GcpConnector/computeInstances/delete",
|                                                         "Microsoft.GcpConnector/computeInstances/write",
|                                                         "Microsoft.GcpConnector/containerClusters/delete",
|                                                         "Microsoft.GcpConnector/containerClusters/write",
|                                                         "Microsoft.GcpConnector/Locations/OperationStatuses/write",
|                                                         "Microsoft.GcpConnector/sqlAdminInstances/delete",
|                                                         "Microsoft.GcpConnector/sqlAdminInstances/write",
|                                                         "Microsoft.GcpConnector/storageBuckets/delete",
|                                                         "Microsoft.GcpConnector/storageBuckets/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "46023a6a-0702-4cbf-956c-d8c3ac27bc2b",
|                                         "Name":  "Defender CSPM",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed read-only or limited permissions without identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/aiservices/agents/read",
|                                                             "Microsoft.CognitiveServices/accounts/aiservices/assets/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d9bac3f-34b2-432f-bde5-78aa8e73ce6b",
|                                         "Name":  "Storage File Data SMB Take Ownership",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows file/directory ownership assumption but no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/takeOwnership/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "35c49d44-ccc1-4b18-8267-cfb3bacdd396",
|                                         "Name":  "Storage DataShare Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages storage data shares with read and write permissions but no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/listServiceSas/action",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/locations/DataManagementRPOperationStatuses/read",
|                                                         "Microsoft.Storage/locations/DataManagementRPOperationStatuses/write",
|                                                         "Microsoft.Storage/storageAccounts/dataShares/read",
|                                                         "Microsoft.Storage/storageAccounts/dataShares/delete",
|                                                         "Microsoft.Storage/storageAccounts/dataShares/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9d819e60-1b9f-4871-b492-4e6cdee0b50a",
|                                         "Name":  "Storage Connector Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages storage connectors with read and write permissions but no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/listServiceSas/action",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                         "Microsoft.Storage/locations/DataManagementRPOperationStatuses/read",
|                                                         "Microsoft.Storage/locations/DataManagementRPOperationStatuses/write",
|                                                         "Microsoft.Storage/storageAccounts/connectors/read",
|                                                         "Microsoft.Storage/storageAccounts/connectors/delete",
|                                                         "Microsoft.Storage/storageAccounts/connectors/write",
|                                                         "Microsoft.Storage/storageAccounts/connectors/testExistingConnection/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "14f26b53-9d80-4924-8141-f664426a48f6",
|                                         "Name":  "Cognitive Services Security Integration Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Cognitive Services safety providers but lacks identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "45265627-32f7-4da4-9ab0-b1cb0e9ec70b",
|                                         "Name":  "Playwright Workspace Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full control over Playwright Workspace resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Loadtestservice/playwrightworkspaces/*",
|                                                         "Microsoft.Loadtestservice/locations/playwrightquotas/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "19d36063-d00b-4ea5-a1ac-a7c4926a0b78",
|                                         "Name":  "Playwright Workspace Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Playwright Workspace resources with no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Loadtestservice/playwrightworkspaces/*/read",
|                                                         "Microsoft.Loadtestservice/locations/playwrightquotas/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "78cf819f-0969-4ebe-8759-015c6efcd5bf",
|                                         "Name":  "Playwright Workspace Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage tokens and execute tests but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Loadtestservice/playwrightworkspaces/*/read",
|                                                         "Microsoft.Loadtestservice/locations/playwrightquotas/*",
|                                                         "Microsoft.Loadtestservice/playwrightworkspaces/AccessTokens/*",
|                                                         "Microsoft.Loadtestservice/playwrightworkspaces/TestRuns/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6f91a4f9-10ee-4b95-b8cd-96ee73c5968d",
|                                         "Name":  "Defender API Security",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to API management diagnostics but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Security/pricings/read",
|                                                         "Microsoft.Security/apiCollections/read",
|                                                         "Microsoft.ApiManagement/service/read",
|                                                         "Microsoft.ApiManagement/service/apis/read",
|                                                         "Microsoft.ApiManagement/service/apis/operations/read",
|                                                         "Microsoft.ApiManagement/service/apiVersionSets/read",
|                                                         "Microsoft.ApiManagement/service/apis/diagnostics/read",
|                                                         "Microsoft.ApiManagement/service/apis/diagnostics/write",
|                                                         "Microsoft.ApiManagement/service/apis/diagnostics/delete",
|                                                         "Microsoft.ApiManagement/service/apis/policies/read",
|                                                         "Microsoft.ApiManagement/service/backends/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/apis/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/apis/operations/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/apiVersionSets/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/apis/diagnostics/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/apis/diagnostics/write",
|                                                         "Microsoft.ApiManagement/service/workspaces/apis/diagnostics/delete",
|                                                         "Microsoft.ApiManagement/service/workspaces/apis/policies/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/backends/read",
|                                                         "Microsoft.ApiManagement/gateways/configConnections/read",
|                                                         "Microsoft.ApiManagement/service/workspaceLinks/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7d0c0268-1199-449b-a52e-75c20879f46b",
|                                         "Name":  "Defender Settings Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and write Defender settings but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "microsoft.security/pricings/read",
|                                                         "microsoft.security/pricings/write",
|                                                         "microsoft.security/pricings/securityoperators/read",
|                                                         "microsoft.security/securityoperators/read",
|                                                         "microsoft.security/register/action",
|                                                         "microsoft.security/settings/read",
|                                                         "microsoft.security/settings/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d56b031f-8d90-4376-9231-b5c94fce88ef",
|                                         "Name":  "Defender Unified RBAC Scoped Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to security insights and logs without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.SecurityInsights/*/read",
|                                                         "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/LinkedServices/read",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                         "Microsoft.OperationalInsights/querypacks/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.Insights/workbooks/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/templateSpecs/*/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                            "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*",
|                                                            "Microsoft.SecurityInsights/alertRules/read"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.OperationalInsights/workspaces/tables/data/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a954a0e0-f57f-4606-8421-fd7bd4e54b0f",
|                                         "Name":  "Azure Device Onboarding Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages device onboarding resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DeviceOnboarding/onboardingServices/read",
|                                                         "Microsoft.DeviceOnboarding/onboardingServices/write",
|                                                         "Microsoft.DeviceOnboarding/onboardingServices/delete",
|                                                         "Microsoft.DeviceOnboarding/onboardingServices/policies/read",
|                                                         "Microsoft.DeviceOnboarding/onboardingServices/policies/write",
|                                                         "Microsoft.DeviceOnboarding/onboardingServices/policies/delete",
|                                                         "Microsoft.DeviceOnboarding/deviceStates/read",
|                                                         "Microsoft.DeviceOnboarding/deviceStates/write",
|                                                         "Microsoft.DeviceOnboarding/deviceStates/delete",
|                                                         "Microsoft.DeviceOnboarding/deviceStates/prepareForOnboarding/action",
|                                                         "Microsoft.DeviceOnboarding/locations/operationStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "980cf6f7-edec-4fd1-8e9e-28f70b1d5258",
|                                         "Name":  "Compute Limit Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages compute limits and alert rules but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ComputeLimit/locations/guestSubscriptions/read",
|                                                         "Microsoft.ComputeLimit/locations/guestSubscriptions/write",
|                                                         "Microsoft.ComputeLimit/locations/guestSubscriptions/delete",
|                                                         "Microsoft.ComputeLimit/locations/sharedLimits/read",
|                                                         "Microsoft.ComputeLimit/locations/sharedLimits/write",
|                                                         "Microsoft.ComputeLimit/locations/sharedLimits/delete",
|                                                         "Microsoft.ComputeLimit/register/action",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "045b6ee5-0c68-42c4-9be0-7389794309f5",
|                                         "Name":  "MongoDB Atlas Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to MongoDB Atlas control plane operations without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "MongoDB.Atlas/checkNameAvailability/action",
|                                                         "MongoDB.Atlas/register/action",
|                                                         "MongoDB.Atlas/unregister/action",
|                                                         "MongoDB.Atlas/operations/read",
|                                                         "MongoDB.Atlas/locations/operationStatuses/read",
|                                                         "MongoDB.Atlas/locations/operationStatuses/write",
|                                                         "MongoDB.Atlas/registeredSubscriptions/read",
|                                                         "MongoDB.Atlas/organizations/read",
|                                                         "MongoDB.Atlas/organizations/write",
|                                                         "MongoDB.Atlas/organizations/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ee99642a-225b-4fe8-a771-9d9036053e87",
|                                         "Name":  "Arc Container Storage Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Arc Container Storage resources but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ArcContainerStorage/edgeStorageConfigurations/read",
|                                                         "Microsoft.ArcContainerStorage/edgeStorageConfigurations/write",
|                                                         "Microsoft.ArcContainerStorage/edgeStorageConfigurations/delete",
|                                                         "Microsoft.ArcContainerStorage/edgeVolumes/read",
|                                                         "Microsoft.ArcContainerStorage/edgeVolumes/write",
|                                                         "Microsoft.ArcContainerStorage/edgeVolumes/delete",
|                                                         "Microsoft.ArcContainerStorage/edgeVolumes/ingestSubvolumes/read",
|                                                         "Microsoft.ArcContainerStorage/edgeVolumes/ingestSubvolumes/write",
|                                                         "Microsoft.ArcContainerStorage/edgeVolumes/ingestSubvolumes/delete",
|                                                         "Microsoft.ArcContainerStorage/locations/operationStatuses/read",
|                                                         "Microsoft.ArcContainerStorage/locations/operationStatuses/write"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.ArcContainerStorage/register/action",
|                                                            "Microsoft.ArcContainerStorage/unregister/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c883944f-8b7b-4483-af10-35834be79c4a",
|                                         "Name":  "Azure AI Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of AI projects and accounts but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AlertsManagement/actionRules/*",
|                                                         "Microsoft.AlertsManagement/alerts/*",
|                                                         "Microsoft.AlertsManagement/issues/*",
|                                                         "Microsoft.AlertsManagement/prometheusRuleGroups/*",
|                                                         "Microsoft.AlertsManagement/smartDetectorAlertRules/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.CognitiveServices/*",
|                                                         "Microsoft.Insights/activityLogAlerts/*",
|                                                         "Microsoft.Insights/metricalerts/*",
|                                                         "Microsoft.Insights/scheduledqueryrules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "42f3c60f-e7b1-46d7-ba56-6de681664342",
|                                         "Name":  "Azure Red Hat OpenShift First Party Network",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Grants network permissions for ARO service principals but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/routeTables/read",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                         "Microsoft.Network/networkIntentPolicies/join/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8da79822-b118-42bc-83c9-789fdbdcd77b",
|                                         "Name":  "Elastic SAN Volume Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to Elastic SAN volumes but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/write",
|                                                         "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/data/read",
|                                                             "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/data/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "92318126-08be-45d0-a1b2-532e6c7d52ce",
|                                         "Name":  "Microsoft Approvals Workflow Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages approval workflows but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Approvals/approvalSettings/read",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/read",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/write",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/delete",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/read",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/write",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/syncPolicyStatus/action",
|                                                         "Microsoft.Approvals/approvalWorkflowAssignments/read",
|                                                         "Microsoft.Approvals/approvalWorkflowAssignments/write",
|                                                         "Microsoft.Approvals/approvalWorkflowAssignments/delete",
|                                                         "Microsoft.Approvals/invokeAndFetchApprovalRequest/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "98d40527-c073-4096-943a-dd593105ca9c",
|                                         "Name":  "Microsoft Approvals Service Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Approvals service-level operations without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Approvals/approvalSettings/read",
|                                                         "Microsoft.Approvals/approvalSettings/write",
|                                                         "Microsoft.Approvals/approvalSettings/delete",
|                                                         "Microsoft.Approvals/approvalSettings/initialize/action",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/read",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/read",
|                                                         "Microsoft.Approvals/approvalWorkflowAssignments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0343f3e8-01ac-4bb8-8f93-78b1d31ba64b",
|                                         "Name":  "Microsoft Approvals Request User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can request approval workflows but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Approvals/invokeAndFetchApprovalRequest/action",
|                                                         "Microsoft.Approvals/approvalSettings/read",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/read",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/read",
|                                                         "Microsoft.Approvals/approvalWorkflowAssignments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a6a9a135-9048-45df-b559-a90bb025e92f",
|                                         "Name":  "Astronomer Astro Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to Astronomer Astro control plane operations without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Astronomer.Astro/register/action",
|                                                         "Astronomer.Astro/unregister/action",
|                                                         "Astronomer.Astro/operations/read",
|                                                         "Astronomer.Astro/organizations/read",
|                                                         "Astronomer.Astro/organizations/write",
|                                                         "Astronomer.Astro/organizations/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0e2ecf2a-0574-4b08-89e2-be133aa6303f",
|                                         "Name":  "Defender Databricks Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions for Defender on Databricks but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Databricks/workspaces/read",
|                                                         "Microsoft.Databricks/workspaces/assignWorkspaceAdmin/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4b2b8358-764b-4884-85c6-f4b7946d95ad",
|                                         "Name":  "EdgeMarketPlace role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages EdgeMarketplace operation statuses but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.EdgeMarketplace/locations/operationStatuses/write",
|                                                         "Microsoft.EdgeMarketplace/locations/operationStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9a0e5da3-6c70-4a35-b13a-715cd5a7919a",
|                                         "Name":  "Azure Stack Hub registration role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Azure Stack registrations without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStack/registrations/customerSubscriptions/delete",
|                                                         "Microsoft.AzureStack/registrations/customerSubscriptions/write",
|                                                         "Microsoft.AzureStack/registrations/delete",
|                                                         "Microsoft.AzureStack/registrations/enableRemoteManagement/action",
|                                                         "Microsoft.AzureStack/registrations/getActivationKey/action",
|                                                         "Microsoft.AzureStack/registrations/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "17e4de9d-139f-4531-b521-20804c310cf8",
|                                         "Name":  "Azure Stack Hub Linked Subscriptions role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages linked subscriptions in Azure Stack without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStack/linkedSubscriptions/delete",
|                                                         "Microsoft.AzureStack/linkedSubscriptions/linkedProviders/action",
|                                                         "Microsoft.AzureStack/linkedSubscriptions/linkedResourceGroups/action",
|                                                         "Microsoft.AzureStack/linkedSubscriptions/operations/action",
|                                                         "Microsoft.AzureStack/linkedSubscriptions/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d2acaa63-2a62-4c01-998a-cdbe7a00d709",
|                                         "Name":  "Defender Azure Cosmos DB",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write advanced threat protection settings but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDB/databaseAccounts/read",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "99626c15-0799-47ad-96ab-f298031f69d6",
|                                         "Name":  "Defender Open Source Relational Databases",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write advanced threat protection settings for databases but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DBforMySQL/flexibleServers/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.DBforMySQL/flexibleServers/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.DBforMySQL/flexibleServers/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/advancedThreatProtectionSettings/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d9468a2b-1820-47e1-a40e-d2b7fba1879a",
|                                         "Name":  "Defender SQL Servers On Machines",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage VM extensions and read VM info but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/write",
|                                                         "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a366d631-94bf-46bf-b4af-b38f28c80774",
|                                         "Name":  "Defender for Storage Threat Protection",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Defender for Storage settings but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Security/defenderForStorageSettings/read",
|                                                         "Microsoft.Security/defenderForStorageSettings/write",
|                                                         "Microsoft.Storage/storageAccounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e1663658-d5f7-4383-9afb-af9fdc9c5eae",
|                                         "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Reader for Member Clusters",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Kubernetes custom resources without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/members/customresources/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "673366d4-9664-4020-b03b-b0093366bff9",
|                                         "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Writer for Member Clusters",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Write access to Kubernetes custom resources but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/members/customresources/write",
|                                                             "Microsoft.ContainerService/fleets/members/customresources/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f82fbe13-0f98-4809-af81-b82c343db82f",
|                                         "Name":  "Device Update Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Device Update accounts and instances but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.DeviceUpdate/accounts/read",
|                                                         "Microsoft.DeviceUpdate/accounts/write",
|                                                         "Microsoft.DeviceUpdate/accounts/delete",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/read",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/write",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/delete",
|                                                         "Microsoft.DeviceUpdate/accounts/privateEndpointConnections/read",
|                                                         "Microsoft.DeviceUpdate/accounts/privateEndpointConnections/write",
|                                                         "Microsoft.DeviceUpdate/accounts/privateEndpointConnections/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "20cf746c-c765-402a-885e-c389c64478ce",
|                                         "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Kubernetes custom resources on fleets without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/customresources/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ff8eb232-5069-437e-94e5-31112ef30539",
|                                         "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Write access to Kubernetes custom resources on fleets but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/customresources/write",
|                                                             "Microsoft.ContainerService/fleets/customresources/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "78b19ac9-582c-44d8-9e11-733ae424ad83",
|                                         "Name":  "Defender Servers P1",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write VM extensions and machine info but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ef3729d8-2861-401e-95ae-c7d4845a6097",
|                                         "Name":  "Genome Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Genome control plane operations only; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Genome/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1dc24dd8-b00e-4344-837c-58b193cd23c7",
|                                         "Name":  "Defender Servers P2",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write network and VM info but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/write",
|                                                         "Microsoft.Network/azureFirewalls/read",
|                                                         "Microsoft.Network/azureFirewalls/write",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/routeTables/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "585db2ed-219e-4821-a06a-c6c14b602afa",
|                                         "Name":  "Healthcare Interop Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages healthcare interop provider resources but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.HealthcareInterop/ddmsConnectors/delete",
|                                                         "Microsoft.HealthcareInterop/ddmsConnectors/write",
|                                                         "Microsoft.HealthcareInterop/ddmsFhirEventBatchChannels/delete",
|                                                         "Microsoft.HealthcareInterop/ddmsFhirEventBatchChannels/write",
|                                                         "Microsoft.HealthcareInterop/ddmsFhirFlatFileBatchChannels/delete",
|                                                         "Microsoft.HealthcareInterop/ddmsFhirFlatFileBatchChannels/write",
|                                                         "Microsoft.HealthcareInterop/dicomConnectors/delete",
|                                                         "Microsoft.HealthcareInterop/dicomConnectors/write",
|                                                         "Microsoft.HealthcareInterop/dicomDirectChannels/delete",
|                                                         "Microsoft.HealthcareInterop/dicomDirectChannels/write",
|                                                         "Microsoft.HealthcareInterop/dicomEdgeConnectors/delete",
|                                                         "Microsoft.HealthcareInterop/dicomEdgeConnectors/write",
|                                                         "Microsoft.HealthcareInterop/fhirQueryEventBatchChannels/delete",
|                                                         "Microsoft.HealthcareInterop/fhirQueryEventBatchChannels/write",
|                                                         "Microsoft.HealthcareInterop/fhirQueryFlatFileBatchChannels/delete",
|                                                         "Microsoft.HealthcareInterop/fhirQueryFlatFileBatchChannels/write",
|                                                         "Microsoft.HealthcareInterop/hl7Connectors/delete",
|                                                         "Microsoft.HealthcareInterop/hl7Connectors/write",
|                                                         "Microsoft.HealthcareInterop/hl7EdgeConnectors/delete",
|                                                         "Microsoft.HealthcareInterop/hl7EdgeConnectors/write",
|                                                         "Microsoft.HealthcareInterop/hubs/delete",
|                                                         "Microsoft.HealthcareInterop/hubs/write",
|                                                         "Microsoft.HealthcareInterop/locations/operationStatuses/write",
|                                                         "Microsoft.HealthcareInterop/oneLakeConnectors/delete",
|                                                         "Microsoft.HealthcareInterop/oneLakeConnectors/write",
|                                                         "Microsoft.HealthcareInterop/storageAccountConnectors/delete",
|                                                         "Microsoft.HealthcareInterop/storageAccountConnectors/write",
|                                                         "Microsoft.HealthcareInterop/locations/operationStatuses/read",
|                                                         "Microsoft.HealthcareInterop/operations/read",
|                                                         "Microsoft.HealthcareInterop/hl7Connectors/read",
|                                                         "Microsoft.HealthcareInterop/oneLakeConnectors/read",
|                                                         "Microsoft.HealthcareInterop/storageAccountConnectors/read",
|                                                         "Microsoft.HealthcareInterop/fhirQueryFlatFileBatchChannels/read",
|                                                         "Microsoft.HealthcareInterop/fhirQueryEventBatchChannels/read",
|                                                         "Microsoft.HealthcareInterop/hl7EdgeConnectors/read",
|                                                         "Microsoft.HealthcareInterop/hubs/read",
|                                                         "Microsoft.HealthcareInterop/dicomEdgeConnectors/read",
|                                                         "Microsoft.HealthcareInterop/dicomConnectors/read",
|                                                         "Microsoft.HealthcareInterop/dicomDirectChannels/read",
|                                                         "Microsoft.HealthcareInterop/ddmsFhirEventBatchChannels/read",
|                                                         "Microsoft.HealthcareInterop/ddmsConnectors/read",
|                                                         "Microsoft.HealthcareInterop/ddmsFhirFlatFileBatchChannels/read",
|                                                         "Microsoft.HealthcareInterop/register/action",
|                                                         "Microsoft.HealthcareInterop/unregister/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fc896ebc-f9a8-484d-a5ff-bd6a8c36289f",
|                                         "Name":  "Cosmos DB Long Term Retention Backup Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows backup operations on Cosmos DB but does not provide identity plane control or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDB/databaseAccounts/validateForLongTermProtection/action",
|                                                         "Microsoft.DocumentDB/databaseAccounts/enableLongTermProtection/action",
|                                                         "Microsoft.DocumentDB/databaseAccounts/disableLongTermProtection/action",
|                                                         "Microsoft.DocumentDB/databaseAccounts/preBackup/action",
|                                                         "Microsoft.DocumentDB/databaseAccounts/backup/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "955d0cb2-de4e-43ed-819a-14220e079ba7",
|                                         "Name":  "Cosmos DB Long Term Retention Restore Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows restore operations on Cosmos DB but no permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDB/databaseAccounts/preRestore/action",
|                                                         "Microsoft.DocumentDB/databaseAccounts/restore/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "78739afa-3ece-4d6b-90ba-762fdccd7438",
|                                         "Name":  "Azure Edge On-Site Deployment Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to edge device provisioning data; no path to identity plane or tenant takeover.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/EdgeMachines/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6fe711ec-654d-4ef7-8e32-eb7de3d94774",
|                                         "Name":  "Defender AI",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write permissions limited to Defender for AI settings; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/accounts/read",
|                                                         "Microsoft.CognitiveServices/accounts/defenderForAISettings/read",
|                                                         "Microsoft.CognitiveServices/accounts/defenderForAISettings/write",
|                                                         "Microsoft.CognitiveServices/accounts/defenderForAISettings/delete",
|                                                         "Microsoft.CognitiveServices/raiPolicy/read",
|                                                         "Microsoft.CognitiveServices/raiPolicy/write",
|                                                         "Microsoft.Search/searchServices/knowledgeBases/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "12675fd7-7f59-493f-9201-f7944860a2f1",
|                                         "Name":  "Azure Device Registry Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full control over device registry but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.DeviceRegistry/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cd50fd1f-0421-46f2-8cce-afc587dbcc77",
|                                         "Name":  "Defender Storage Malware Data Scanner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Data plane read permissions for storage scanning; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                             "Microsoft.EventGrid/events/send/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d622af9a-030e-4f32-8267-419abfd54702",
|                                         "Name":  "Pro Active Coding Data User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No permissions granted; limited to data processing with no identity or role control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthBot/healthBots/AIActions/ProActiveCoding/Process/Action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "eef9d654-743f-4e2c-ad0f-9ed243177663",
|                                         "Name":  "Defender Azure SQL Databases",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write permissions on security alert policies but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Sql/managedInstances/read",
|                                                         "Microsoft.Sql/managedInstances/securityAlertPolicies/read",
|                                                         "Microsoft.Sql/managedInstances/securityAlertPolicies/write",
|                                                         "Microsoft.Sql/servers/read",
|                                                         "Microsoft.Sql/servers/securityAlertPolicies/read",
|                                                         "Microsoft.Sql/servers/securityAlertPolicies/write",
|                                                         "Microsoft.Sql/servers/sqlVulnerabilityAssessments/read",
|                                                         "Microsoft.Sql/servers/sqlVulnerabilityAssessments/write",
|                                                         "Microsoft.Synapse/workspaces/read",
|                                                         "Microsoft.Synapse/workspaces/securityAlertPolicies/read",
|                                                         "Microsoft.Synapse/workspaces/securityAlertPolicies/write",
|                                                         "Microsoft.Sql/servers/vulnerabilityAssessments/read",
|                                                         "Microsoft.Synapse/workspaces/vulnerabilityAssessments/read",
|                                                         "Microsoft.Sql/managedInstances/vulnerabilityAssessments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "971cce9f-2680-4357-9678-c947847a9425",
|                                         "Name":  "Defender Storage Malware Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions for Defender storage malware scanning and management; no role assignment or credential reset rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Security/defenderforstoragesettings/read",
|                                                         "Microsoft.Security/defenderforstoragesettings/write",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Security/securityOperators/read",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.EventGrid/topics/read",
|                                                         "Microsoft.EventGrid/register/action",
|                                                         "Microsoft.EventGrid/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/write",
|                                                         "Microsoft.EventGrid/eventSubscriptions/delete",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c6c9b2d8-9a5e-4122-85e1-81612a046ab2",
|                                         "Name":  "Defender Storage Automated Malware Remediation",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions limited to blob service remediation actions; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4f1e6fca-3fde-4291-961e-642def6d5e1d",
|                                         "Name":  "Confidential Ledger Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to ledger transactions; no ability to modify identity or roles.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ConfidentialLedger/ledgers/transactions/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f1641a58-a144-402b-baf9-39d1a4c10119",
|                                         "Name":  "Confidential Ledger Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to ledger data but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ConfidentialLedger/ledgers/transactions/read",
|                                                             "Microsoft.ConfidentialLedger/ledgers/transactions/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8ec773c5-7ce6-4b78-91d1-182f8faa536d",
|                                         "Name":  "Microsoft Discovery Bookshelf Index Data Reader - Preview",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Query access to knowledge bases only; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Discovery/bookshelf/knowledgeBaseVersions/query/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "63342533-d951-495d-a3c3-a459aa02362b",
|                                         "Name":  "Oracle Database DbSystems Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of DbSystems resources but no permissions to modify Azure AD roles or credentials.",
|                                         "Actions":  [
|                                                         "Oracle.Database/dbSystems/*/read",
|                                                         "Oracle.Database/dbSystems/*/write",
|                                                         "Oracle.Database/dbSystems/*/delete",
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Locations/*/write",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/resourceAnchors/*",
|                                                         "Oracle.Database/networkAnchors/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Compute/sshPublicKeys/read",
|                                                         "Microsoft.Compute/sshPublicKeys/write",
|                                                         "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f287ba2f-f923-4464-a5bd-721c3951d32d",
|                                         "Name":  "Azure Managed Redis Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Redis resources; no ability to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cache/locations/operationsStatus/read",
|                                                         "Microsoft.Cache/operations/read",
|                                                         "Microsoft.Cache/redisEnterprise/read",
|                                                         "Microsoft.Cache/redisEnterprise/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3015e5ed-6856-4ab3-b2f0-b8492aa30ca6",
|                                         "Name":  "Azure Managed Redis Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Redis resources but no permissions to access data or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cache/locations/operationsStatus/read",
|                                                         "Microsoft.Cache/locations/checknameavailability/action",
|                                                         "Microsoft.Cache/operations/read",
|                                                         "Microsoft.Cache/redisEnterprise/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c24cf47c-5077-412d-a19c-45202126392c",
|                                         "Name":  "Dev Compute SandboxGroup Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Ownership of sandbox data only; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/sandboxGroups/*/read",
|                                                             "Microsoft.App/sandboxGroups/*/write",
|                                                             "Microsoft.App/sandboxGroups/*/delete",
|                                                             "Microsoft.App/sandboxGroups/*/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4417a88f-3e58-4cf2-a4e9-112cf414254c",
|                                         "Name":  "Services Hub User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write/delete operations on Services Hub connectors but no identity or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.ServicesHub/connectors/read",
|                                                         "Microsoft.ServicesHub/connectors/*",
|                                                         "Microsoft.ServicesHub/*",
|                                                         "Microsoft.ServicesHub/workspaces/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.ServicesHub/connectors/write",
|                                                            "Microsoft.ServicesHub/connectors/delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0e91b552-ae32-49ea-9898-317af306aa4b",
|                                         "Name":  "Genome EndUser",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Genome data plane only; no permissions affecting identity or roles.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Genome/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "64375caa-ac3e-48b3-9492-da4d60aba7bb",
|                                         "Name":  "Diagnostics Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions to collect VM diagnostic info; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/virtualMachines/DiagnosticRunCommands/write",
|                                                         "Microsoft.Compute/virtualMachines/DiagnosticRunCommands/read",
|                                                         "Microsoft.Compute/virtualMachines/DiagnosticRunCommands/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b66c1f7c-c685-40d6-b8b8-64b8230febf4",
|                                         "Name":  "Azure Resilience Management Usage Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage usage plans and enrollments; no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b130f7de-5374-4e3d-ada8-bae6e49114b9",
|                                         "Name":  "Azure Resilience Management Usage Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to usage plans; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5ca51376-e049-4302-abcc-64c588049c59",
|                                         "Name":  "Azure Resilience Management Usage Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor rights on usage plans but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     }
|                                 ],
|    "Azure_CustomRoles_Tier0":  [
|
|                                ],
|    "Azure_CustomRoles_Tier1":  [
|
|                                ],
|    "Azure_CustomRoles_Tier2":  [
|
|                                ],
|    "Azure_CustomRoles_Tier3":  [
|
|                                ],
|    "Azure_Roles_Catalog":  [
|                                {
|                                    "Id":  "8311e382-0749-4cb8-b61a-304f252e45ec",
|                                    "Name":  "AcrPush",
|                                    "Description":  "acr push",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/pull/read",
|                                                    "Microsoft.ContainerRegistry/registries/push/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "312a565d-c81f-4fd8-895a-4e21e48d571c",
|                                    "Name":  "API Management Service Contributor",
|                                    "Description":  "Can manage service and the APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7f951dda-4ed3-4680-a7ca-43fe172d538d",
|                                    "Name":  "AcrPull",
|                                    "Description":  "acr pull",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/pull/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6cef56e8-d556-48e5-a04f-b8e64114680f",
|                                    "Name":  "AcrImageSigner",
|                                    "Description":  "Planned DEPRECATION on March 31, 2028. Grant the signing permission for content trust. As content trust is being deprecated and will be completely removed on March 31, 2028, this role will also be removed. Refer to https://aka.ms/acr/dctdeprecation for details and transition guidance.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/sign/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/trustedCollections/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c2f4ef07-c644-48eb-af81-4b1b4947fb11",
|                                    "Name":  "AcrDelete",
|                                    "Description":  "acr delete",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/artifacts/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cdda3590-29a3-44f6-95f2-9f980659eb04",
|                                    "Name":  "AcrQuarantineReader",
|                                    "Description":  "acr quarantine data reader",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/quarantine/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c8d4ff99-41c3-41a8-9f60-21dfdad59608",
|                                    "Name":  "AcrQuarantineWriter",
|                                    "Description":  "acr quarantine data writer",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/quarantine/read",
|                                                    "Microsoft.ContainerRegistry/registries/quarantine/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read",
|                                                        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e022efe7-f5ba-4159-bbe4-b44f577e9b61",
|                                    "Name":  "API Management Service Operator Role",
|                                    "Description":  "Can manage service but not the APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/*/read",
|                                                    "Microsoft.ApiManagement/service/backup/action",
|                                                    "Microsoft.ApiManagement/service/delete",
|                                                    "Microsoft.ApiManagement/service/managedeployments/action",
|                                                    "Microsoft.ApiManagement/service/read",
|                                                    "Microsoft.ApiManagement/service/restore/action",
|                                                    "Microsoft.ApiManagement/service/updatecertificate/action",
|                                                    "Microsoft.ApiManagement/service/updatehostname/action",
|                                                    "Microsoft.ApiManagement/service/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.ApiManagement/service/users/keys/read"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "71522526-b88f-4d52-b57f-d31fc3546d0d",
|                                    "Name":  "API Management Service Reader Role",
|                                    "Description":  "Read-only access to service and APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/*/read",
|                                                    "Microsoft.ApiManagement/service/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.ApiManagement/service/users/keys/read"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ae349356-3a1b-4a5e-921d-050484c6347e",
|                                    "Name":  "Application Insights Component Contributor",
|                                    "Description":  "Can manage Application Insights components",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/generateLiveToken/read",
|                                                    "Microsoft.Insights/metricAlerts/*",
|                                                    "Microsoft.Insights/components/*",
|                                                    "Microsoft.Insights/scheduledqueryrules/*",
|                                                    "Microsoft.Insights/topology/read",
|                                                    "Microsoft.Insights/transactions/read",
|                                                    "Microsoft.Insights/webtests/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "08954f03-6346-4c2e-81c0-ec3a5cfae23b",
|                                    "Name":  "Application Insights Snapshot Debugger",
|                                    "Description":  "Gives user permission to use Application Insights Snapshot Debugger features",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/components/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/snapshots/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fd1bd22b-8476-40bc-a0bc-69b95687b9f3",
|                                    "Name":  "Attestation Reader",
|                                    "Description":  "Can read the attestation provider properties",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Attestation/attestationProviders/attestation/read",
|                                                    "Microsoft.Attestation/attestationProviders/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4fe576fe-1146-4730-92eb-48519fa6bf9f",
|                                    "Name":  "Automation Job Operator",
|                                    "Description":  "Create and Manage Jobs using Automation Runbooks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/read",
|                                                    "Microsoft.Automation/automationAccounts/jobs/read",
|                                                    "Microsoft.Automation/automationAccounts/jobs/resume/action",
|                                                    "Microsoft.Automation/automationAccounts/jobs/stop/action",
|                                                    "Microsoft.Automation/automationAccounts/jobs/streams/read",
|                                                    "Microsoft.Automation/automationAccounts/jobs/suspend/action",
|                                                    "Microsoft.Automation/automationAccounts/jobs/write",
|                                                    "Microsoft.Automation/automationAccounts/jobs/output/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5fb5aef8-1081-4b8e-bb16-9d5d0385bab5",
|                                    "Name":  "Automation Runbook Operator",
|                                    "Description":  "Read Runbook properties - to be able to create Jobs of the runbook.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d3881f73-407a-4167-8283-e981cbba0404",
|                                    "Name":  "Automation Operator",
|                                    "Description":  "Automation Operators are able to start, stop, suspend, and resume jobs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/read",
|                                                    "Microsoft.Automation/automationAccounts/jobs/read",
|                                                    "Microsoft.Automation/automationAccounts/jobs/resume/action",
|                                                    "Microsoft.Automation/automationAccounts/jobs/stop/action",
|                                                    "Microsoft.Automation/automationAccounts/jobs/streams/read",
|                                                    "Microsoft.Automation/automationAccounts/jobs/suspend/action",
|                                                    "Microsoft.Automation/automationAccounts/jobs/write",
|                                                    "Microsoft.Automation/automationAccounts/jobSchedules/read",
|                                                    "Microsoft.Automation/automationAccounts/jobSchedules/write",
|                                                    "Microsoft.Automation/automationAccounts/linkedWorkspace/read",
|                                                    "Microsoft.Automation/automationAccounts/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.Automation/automationAccounts/schedules/read",
|                                                    "Microsoft.Automation/automationAccounts/schedules/write",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Automation/automationAccounts/jobs/output/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4f8fab4f-1852-4a58-a46a-8eaf358af14a",
|                                    "Name":  "Avere Contributor",
|                                    "Description":  "Can create and manage an Avere vFXT cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Compute/*/read",
|                                                    "Microsoft.Compute/availabilitySets/*",
|                                                    "Microsoft.Compute/proximityPlacementGroups/*",
|                                                    "Microsoft.Compute/virtualMachines/*",
|                                                    "Microsoft.Compute/disks/*",
|                                                    "Microsoft.Network/*/read",
|                                                    "Microsoft.Network/networkInterfaces/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/*/read",
|                                                    "Microsoft.Storage/storageAccounts/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/resources/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c025889f-8102-4ebf-b32c-fc0c6f0c6bd9",
|                                    "Name":  "Avere Operator",
|                                    "Description":  "Used by the Avere vFXT cluster to manage the cluster",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8",
|                                    "Name":  "Azure Kubernetes Service Cluster Admin Role",
|                                    "Description":  "List cluster admin credential action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action",
|                                                    "Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action",
|                                                    "Microsoft.ContainerService/managedClusters/read",
|                                                    "Microsoft.ContainerService/managedClusters/runcommand/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4abbcc35-e782-43d8-92c5-2d3f1bd2253f",
|                                    "Name":  "Azure Kubernetes Service Cluster User Role",
|                                    "Description":  "List cluster user credential action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
|                                                    "Microsoft.ContainerService/managedClusters/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "423170ca-a8f6-4b0f-8487-9e4eb8f49bfa",
|                                    "Name":  "Azure Maps Data Reader",
|                                    "Description":  "Grants access to read map related data from an Azure maps account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Maps/accounts/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6f12a6df-dd06-4f3e-bcb1-ce8be600526a",
|                                    "Name":  "Azure Stack Registration Owner",
|                                    "Description":  "Lets you manage Azure Stack registrations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStack/edgeSubscriptions/read",
|                                                    "Microsoft.AzureStack/registrations/products/*/action",
|                                                    "Microsoft.AzureStack/registrations/products/read",
|                                                    "Microsoft.AzureStack/registrations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5e467623-bb1f-42f4-a55d-6e525e11384b",
|                                    "Name":  "Backup Contributor",
|                                    "Description":  "Lets you manage backups, but can\u0027t delete vaults and give access to others",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.RecoveryServices/locations/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/refreshContainers/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupJobs/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupJobsExport/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupOperationResults/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectableItems/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectedItems/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectionContainers/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupSecurityPIN/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read",
|                                                    "Microsoft.RecoveryServices/Vaults/certificates/*",
|                                                    "Microsoft.RecoveryServices/Vaults/extendedInformation/*",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*",
|                                                    "Microsoft.RecoveryServices/Vaults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/*",
|                                                    "Microsoft.RecoveryServices/Vaults/usages/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupstorageconfig/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupconfig/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupValidateOperation/action",
|                                                    "Microsoft.RecoveryServices/Vaults/write",
|                                                    "Microsoft.RecoveryServices/Vaults/backupOperations/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupEngines/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectableContainers/read",
|                                                    "Microsoft.RecoveryServices/vaults/operationStatus/read",
|                                                    "Microsoft.RecoveryServices/vaults/operationResults/read",
|                                                    "Microsoft.RecoveryServices/locations/backupStatus/action",
|                                                    "Microsoft.RecoveryServices/locations/backupPreValidateProtection/action",
|                                                    "Microsoft.RecoveryServices/locations/backupValidateFeatures/action",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/write",
|                                                    "Microsoft.RecoveryServices/operations/read",
|                                                    "Microsoft.RecoveryServices/locations/operationStatus/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.DataProtection/locations/getBackupStatus/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/write",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/delete",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/deletedBackupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/deletedBackupInstances/undelete/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/backup/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/validateRestore/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/restore/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/crossRegionRestore/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/validateCrossRegionRestore/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/write",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/delete",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read",
|                                                    "Microsoft.DataProtection/backupVaults/write",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/backupVaults/operationResults/read",
|                                                    "Microsoft.DataProtection/backupVaults/operationStatus/read",
|                                                    "Microsoft.DataProtection/locations/checkNameAvailability/action",
|                                                    "Microsoft.DataProtection/locations/checkFeatureSupport/action",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/locations/operationStatus/read",
|                                                    "Microsoft.DataProtection/locations/operationResults/read",
|                                                    "Microsoft.DataProtection/backupVaults/validateForBackup/action",
|                                                    "Microsoft.DataProtection/operations/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/delete",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/unlockDelete/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/write",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/write",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/delete",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/unlockDelete/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/validateForModifyBackup/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/SuspendBackups/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/resumeProtection/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fa23ad8b-c56e-40d8-ac0c-ce449e1d2c64",
|                                    "Name":  "Billing Reader",
|                                    "Description":  "Allows read access to billing data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Billing/*/read",
|                                                    "Microsoft.Commerce/*/read",
|                                                    "Microsoft.Consumption/*/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.CostManagement/*/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a795c7a0-d4a2-40c1-ae25-d81f01202912",
|                                    "Name":  "Backup Reader",
|                                    "Description":  "Can view backup services, but can\u0027t make changes",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/operationsStatus/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationsStatus/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupJobs/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupJobs/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupJobsExport/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupOperationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectedItems/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectionContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read",
|                                                    "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                    "Microsoft.RecoveryServices/Vaults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupstorageconfig/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupconfig/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupOperations/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/operations/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupEngines/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/items/read",
|                                                    "Microsoft.RecoveryServices/locations/backupStatus/action",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/write",
|                                                    "Microsoft.RecoveryServices/operations/read",
|                                                    "Microsoft.RecoveryServices/locations/operationStatus/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read",
|                                                    "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                    "Microsoft.RecoveryServices/locations/backupValidateFeatures/action",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrJobs/action",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrJob/action",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrOperationResults/read",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrOperationsStatus/read",
|                                                    "Microsoft.DataProtection/locations/getBackupStatus/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/deletedBackupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/backupVaults/operationResults/read",
|                                                    "Microsoft.DataProtection/backupVaults/operationStatus/read",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/locations/operationStatus/read",
|                                                    "Microsoft.DataProtection/locations/operationResults/read",
|                                                    "Microsoft.DataProtection/operations/read",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action",
|                                                    "Microsoft.DataProtection/locations/checkFeatureSupport/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "31a002a1-acaf-453e-8a5b-297c9ca1ea24",
|                                    "Name":  "Blockchain Member Node Access (Preview)",
|                                    "Description":  "Allows for access to Blockchain Member nodes",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Blockchain/blockchainMembers/transactionNodes/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Blockchain/blockchainMembers/transactionNodes/connect/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5e3c6656-6cfa-4708-81fe-0de47ac73342",
|                                    "Name":  "BizTalk Contributor",
|                                    "Description":  "Lets you manage BizTalk services, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.BizTalkServices/BizTalk/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "426e0c7f-0c7e-4658-b36f-ff54d6c29b45",
|                                    "Name":  "CDN Endpoint Contributor",
|                                    "Description":  "Can manage CDN endpoints, but can\u0027t grant access to other users.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cdn/edgenodes/read",
|                                                    "Microsoft.Cdn/operationresults/*",
|                                                    "Microsoft.Cdn/profiles/endpoints/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ec156ff8-a8d1-4d15-830c-5b80698ca432",
|                                    "Name":  "CDN Profile Contributor",
|                                    "Description":  "Can manage CDN and Azure Front Door standard and premium profiles and their endpoints, but can\u0027t grant access to other users.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cdn/edgenodes/read",
|                                                    "Microsoft.Cdn/operationresults/*",
|                                                    "Microsoft.Cdn/profiles/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8f96442b-4075-438f-813d-ad51ab4019af",
|                                    "Name":  "CDN Profile Reader",
|                                    "Description":  "Can view CDN profiles and their endpoints, but can\u0027t make changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cdn/edgenodes/read",
|                                                    "Microsoft.Cdn/operationresults/*",
|                                                    "Microsoft.Cdn/profiles/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Cdn/profiles/afdendpoints/validateCustomDomain/action",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Cdn/profiles/CheckResourceUsage/action",
|                                                    "Microsoft.Cdn/profiles/endpoints/CheckResourceUsage/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b34d265f-36f7-4a0d-a4d4-e158ca92e90f",
|                                    "Name":  "Classic Network Contributor",
|                                    "Description":  "Lets you manage classic networks, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ClassicNetwork/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "86e8f5dc-a6e9-4c67-9d15-de283e8eac25",
|                                    "Name":  "Classic Storage Account Contributor",
|                                    "Description":  "Lets you manage classic storage accounts, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ClassicStorage/storageAccounts/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "985d6b00-f706-48f5-a6fe-d0ca12fb668d",
|                                    "Name":  "Classic Storage Account Key Operator Service Role",
|                                    "Description":  "Classic Storage Account Key Operators are allowed to list and regenerate keys on Classic Storage Accounts",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ClassicStorage/storageAccounts/listkeys/action",
|                                                    "Microsoft.ClassicStorage/storageAccounts/regeneratekey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9106cda0-8a86-4e81-b686-29a22c54effe",
|                                    "Name":  "ClearDB MySQL DB Contributor",
|                                    "Description":  "Lets you manage ClearDB MySQL databases, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "successbricks.cleardb/databases/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d73bb868-a0df-4d4d-bd69-98a00b01fccb",
|                                    "Name":  "Classic Virtual Machine Contributor",
|                                    "Description":  "Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they’re connected to.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ClassicCompute/domainNames/*",
|                                                    "Microsoft.ClassicCompute/virtualMachines/*",
|                                                    "Microsoft.ClassicNetwork/networkSecurityGroups/join/action",
|                                                    "Microsoft.ClassicNetwork/reservedIps/link/action",
|                                                    "Microsoft.ClassicNetwork/reservedIps/read",
|                                                    "Microsoft.ClassicNetwork/virtualNetworks/join/action",
|                                                    "Microsoft.ClassicNetwork/virtualNetworks/read",
|                                                    "Microsoft.ClassicStorage/storageAccounts/disks/read",
|                                                    "Microsoft.ClassicStorage/storageAccounts/images/read",
|                                                    "Microsoft.ClassicStorage/storageAccounts/listKeys/action",
|                                                    "Microsoft.ClassicStorage/storageAccounts/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a97b65f3-24c7-4388-baec-2e87135dc908",
|                                    "Name":  "Cognitive Services User",
|                                    "Description":  "Lets you read and list keys of Cognitive Services.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Insights/diagnosticSettings/read",
|                                                    "Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Insights/metricdefinitions/read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b59867f0-fa02-499b-be73-45a86b5b3e1c",
|                                    "Name":  "Cognitive Services Data Reader",
|                                    "Description":  "Lets you read Cognitive Services data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68",
|                                    "Name":  "Cognitive Services Contributor",
|                                    "Description":  "Lets you create, read, update, delete and manage keys of Cognitive Services.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.CognitiveServices/*",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/providers/features/register/action",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/diagnosticSettings/*",
|                                                    "Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Insights/metricdefinitions/read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.CognitiveServices/raiPolicy/write",
|                                                       "Microsoft.CognitiveServices/raiPolicy/delete",
|                                                       "Microsoft.CognitiveServices/raiExternalSafetyProviders/write",
|                                                       "Microsoft.CognitiveServices/raiExternalSafetyProviders/delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "db7b14f2-5adf-42da-9f96-f2ee17bab5cb",
|                                    "Name":  "CosmosBackupOperator",
|                                    "Description":  "Can submit restore request for a Cosmos DB database or a container for an account",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDB/databaseAccounts/backup/action",
|                                                    "Microsoft.DocumentDB/databaseAccounts/restore/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b24988ac-6180-42a0-ab88-20f7382dd24c",
|                                    "Name":  "Contributor",
|                                    "Description":  "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Authorization/*/Delete",
|                                                       "Microsoft.Authorization/*/Write",
|                                                       "Microsoft.Authorization/elevateAccess/Action",
|                                                       "Microsoft.Blueprint/blueprintAssignments/write",
|                                                       "Microsoft.Blueprint/blueprintAssignments/delete",
|                                                       "Microsoft.Compute/galleries/share/action",
|                                                       "Microsoft.Purview/consents/write",
|                                                       "Microsoft.Purview/consents/delete",
|                                                       "Microsoft.Resources/deploymentStacks/manageDenySetting/action",
|                                                       "Microsoft.Subscription/cancel/action",
|                                                       "Microsoft.Subscription/enable/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fbdf93bf-df7d-467e-a4d2-9458aa1360c8",
|                                    "Name":  "Cosmos DB Account Reader Role",
|                                    "Description":  "Can read Azure Cosmos DB Accounts data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.DocumentDB/*/read",
|                                                    "Microsoft.DocumentDB/databaseAccounts/readonlykeys/action",
|                                                    "Microsoft.Insights/MetricDefinitions/read",
|                                                    "Microsoft.Insights/Metrics/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "434105ed-43f6-45c7-a02f-909b2ba83430",
|                                    "Name":  "Cost Management Contributor",
|                                    "Description":  "Can view costs and manage cost configuration (e.g. budgets, exports)",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Consumption/*",
|                                                    "Microsoft.CostManagement/*",
|                                                    "Microsoft.Billing/billingPeriods/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Advisor/configurations/read",
|                                                    "Microsoft.Advisor/recommendations/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Billing/billingProperty/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "72fafb9e-0641-4937-9268-a91bfd8191a3",
|                                    "Name":  "Cost Management Reader",
|                                    "Description":  "Can view cost data and configuration (e.g. budgets, exports)",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Consumption/*/read",
|                                                    "Microsoft.CostManagement/*/read",
|                                                    "Microsoft.Billing/billingPeriods/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Advisor/configurations/read",
|                                                    "Microsoft.Advisor/recommendations/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Billing/billingProperty/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "add466c9-e687-43fc-8d98-dfcf8d720be5",
|                                    "Name":  "Data Box Contributor",
|                                    "Description":  "Lets you manage everything under Data Box Service except giving access to others.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Databox/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "028f4ed7-e2a9-465e-a8f4-9c0ffdfdc027",
|                                    "Name":  "Data Box Reader",
|                                    "Description":  "Lets you manage Data Box Service except creating order or editing order details and giving access to others.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Databox/*/read",
|                                                    "Microsoft.Databox/jobs/listsecrets/action",
|                                                    "Microsoft.Databox/jobs/listcredentials/action",
|                                                    "Microsoft.Databox/locations/availableSkus/action",
|                                                    "Microsoft.Databox/locations/validateInputs/action",
|                                                    "Microsoft.Databox/locations/regionConfiguration/action",
|                                                    "Microsoft.Databox/locations/validateAddress/action",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "673868aa-7521-48a0-acc6-0f60742d39f5",
|                                    "Name":  "Data Factory Contributor",
|                                    "Description":  "Create and manage data factories, as well as child resources within them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.DataFactory/dataFactories/*",
|                                                    "Microsoft.DataFactory/factories/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.EventGrid/eventSubscriptions/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "150f5e0c-0603-4f03-8c7f-cf70034c4e90",
|                                    "Name":  "Data Purger",
|                                    "Description":  "Can purge analytics data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/components/*/read",
|                                                    "Microsoft.Insights/components/purge/action",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/purge/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "47b7735b-770e-4598-a7da-8b91488b4c88",
|                                    "Name":  "Data Lake Analytics Developer",
|                                    "Description":  "Lets you submit, monitor, and manage your own jobs but not create or delete Data Lake Analytics accounts.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.BigAnalytics/accounts/*",
|                                                    "Microsoft.DataLakeAnalytics/accounts/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.BigAnalytics/accounts/Delete",
|                                                       "Microsoft.BigAnalytics/accounts/TakeOwnership/action",
|                                                       "Microsoft.BigAnalytics/accounts/Write",
|                                                       "Microsoft.DataLakeAnalytics/accounts/Delete",
|                                                       "Microsoft.DataLakeAnalytics/accounts/TakeOwnership/action",
|                                                       "Microsoft.DataLakeAnalytics/accounts/Write",
|                                                       "Microsoft.DataLakeAnalytics/accounts/dataLakeStoreAccounts/Write",
|                                                       "Microsoft.DataLakeAnalytics/accounts/dataLakeStoreAccounts/Delete",
|                                                       "Microsoft.DataLakeAnalytics/accounts/storageAccounts/Write",
|                                                       "Microsoft.DataLakeAnalytics/accounts/storageAccounts/Delete",
|                                                       "Microsoft.DataLakeAnalytics/accounts/firewallRules/Write",
|                                                       "Microsoft.DataLakeAnalytics/accounts/firewallRules/Delete",
|                                                       "Microsoft.DataLakeAnalytics/accounts/computePolicies/Write",
|                                                       "Microsoft.DataLakeAnalytics/accounts/computePolicies/Delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "76283e04-6283-4c54-8f91-bcf1374a3c64",
|                                    "Name":  "DevTest Labs User",
|                                    "Description":  "Lets you connect, start, restart, and shutdown your virtual machines in your Azure DevTest Labs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/virtualMachines/*/read",
|                                                    "Microsoft.Compute/virtualMachines/deallocate/action",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/restart/action",
|                                                    "Microsoft.Compute/virtualMachines/start/action",
|                                                    "Microsoft.DevTestLab/*/read",
|                                                    "Microsoft.DevTestLab/labs/claimAnyVm/action",
|                                                    "Microsoft.DevTestLab/labs/createEnvironment/action",
|                                                    "Microsoft.DevTestLab/labs/ensureCurrentUserProfile/action",
|                                                    "Microsoft.DevTestLab/labs/formulas/delete",
|                                                    "Microsoft.DevTestLab/labs/formulas/read",
|                                                    "Microsoft.DevTestLab/labs/formulas/write",
|                                                    "Microsoft.DevTestLab/labs/policySets/evaluatePolicies/action",
|                                                    "Microsoft.DevTestLab/labs/virtualMachines/claim/action",
|                                                    "Microsoft.DevTestLab/labs/virtualmachines/listApplicableSchedules/action",
|                                                    "Microsoft.DevTestLab/labs/virtualMachines/getRdpFileContents/action",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                    "Microsoft.Network/networkInterfaces/*/read",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/publicIPAddresses/*/read",
|                                                    "Microsoft.Network/publicIPAddresses/join/action",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Compute/virtualMachines/vmSizes/read"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5bd9cd88-fe45-4216-938b-f97437e15450",
|                                    "Name":  "DocumentDB Account Contributor",
|                                    "Description":  "Lets you manage DocumentDB accounts, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.DocumentDb/databaseAccounts/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "befefa01-2a29-4197-83a8-272ff33ce314",
|                                    "Name":  "DNS Zone Contributor",
|                                    "Description":  "Lets you manage DNS zones and record sets in Azure DNS, but does not let you control who has access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/dnsZones/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "428e0ff0-5e57-4d9c-a221-2c70d0e0a443",
|                                    "Name":  "EventGrid EventSubscription Contributor",
|                                    "Description":  "Lets you manage EventGrid event subscription operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/*",
|                                                    "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2414bbcf-6497-4faf-8c65-045460748405",
|                                    "Name":  "EventGrid EventSubscription Reader",
|                                    "Description":  "Lets you read EventGrid event subscriptions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b60367af-1334-4454-b71e-769d9a4f83d9",
|                                    "Name":  "Graph Owner",
|                                    "Description":  "Create and manage all aspects of the Enterprise Graph - Ontology, Schema mapping, Conflation and Conversational AI and Ingestions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/conflation/read",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/conflation/write",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/sourceschema/read",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/sourceschema/write",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/knowledge/read",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/knowledge/write",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/intentclassification/read",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/intentclassification/write",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/ingestion/read",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/ingestion/write",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/ontology/read",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/ontology/write",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/delete",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8d8d5a11-05d3-4bda-a417-a08778121c7c",
|                                    "Name":  "HDInsight Domain Services Contributor",
|                                    "Description":  "Can Read, Create, Modify and Delete Domain Services related operations needed for HDInsight Enterprise Security Package",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AAD/*/read",
|                                                    "Microsoft.AAD/domainServices/*/read",
|                                                    "Microsoft.AAD/domainServices/oucontainer/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "03a6d094-3444-4b3d-88af-7477090a9e5e",
|                                    "Name":  "Intelligent Systems Account Contributor",
|                                    "Description":  "Lets you manage Intelligent Systems accounts, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.IntelligentSystems/accounts/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f25e0fa2-a7c8-4377-a976-54943a77a395",
|                                    "Name":  "Key Vault Contributor",
|                                    "Description":  "Lets you manage key vaults, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.KeyVault/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.KeyVault/locations/deletedVaults/purge/action",
|                                                       "Microsoft.KeyVault/hsmPools/*",
|                                                       "Microsoft.KeyVault/managedHsms/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ee361c5d-f7b5-4119-b4b6-892157c8f64c",
|                                    "Name":  "Knowledge Consumer",
|                                    "Description":  "Knowledge Read permission to consume Enterprise Graph Knowledge using entity search and graph query",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/knowledge/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b97fb8bc-a8b2-4522-a38b-dd33c7e65ead",
|                                    "Name":  "Lab Creator",
|                                    "Description":  "Lets you create new labs under your Azure Lab Accounts.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.LabServices/labAccounts/*/read",
|                                                    "Microsoft.LabServices/labAccounts/createLab/action",
|                                                    "Microsoft.LabServices/labAccounts/getPricingAndAvailability/action",
|                                                    "Microsoft.LabServices/labAccounts/getRestrictionsAndUsage/action",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.LabServices/labPlans/images/read",
|                                                    "Microsoft.LabServices/labPlans/read",
|                                                    "Microsoft.LabServices/labPlans/saveImage/action",
|                                                    "Microsoft.LabServices/labs/read",
|                                                    "Microsoft.LabServices/labs/schedules/read",
|                                                    "Microsoft.LabServices/labs/users/read",
|                                                    "Microsoft.LabServices/labs/virtualMachines/read",
|                                                    "Microsoft.LabServices/locations/usages/read",
|                                                    "Microsoft.LabServices/skus/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.LabServices/labPlans/createLab/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "73c42c96-874c-492b-b04d-ab87d138a893",
|                                    "Name":  "Log Analytics Reader",
|                                    "Description":  "Log Analytics Reader can view and search all monitoring data as well as and view monitoring settings, including viewing the configuration of Azure diagnostics on all Azure resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/search/action",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.OperationalInsights/workspaces/sharedKeys/read"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "92aaf0da-9dab-42b6-94a3-d43ce8d16293",
|                                    "Name":  "Log Analytics Contributor",
|                                    "Description":  "Log Analytics Contributor can read all monitoring data and edit monitoring settings. Editing monitoring settings includes adding the VM extension to VMs; reading storage account keys to be able to configure collection of logs from Azure Storage; adding solutions; and configuring Azure diagnostics on all Azure resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.ClassicCompute/virtualMachines/extensions/*",
|                                                    "Microsoft.ClassicStorage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Compute/virtualMachines/extensions/*",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/diagnosticSettings/*",
|                                                    "Microsoft.OperationalInsights/*",
|                                                    "Microsoft.OperationsManagement/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "515c2055-d9d4-4321-b1b9-bd0c9a0f79fe",
|                                    "Name":  "Logic App Operator",
|                                    "Description":  "Lets you read, enable and disable logic app.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*/read",
|                                                    "Microsoft.Insights/metricAlerts/*/read",
|                                                    "Microsoft.Insights/diagnosticSettings/*/read",
|                                                    "Microsoft.Insights/metricDefinitions/*/read",
|                                                    "Microsoft.Logic/*/read",
|                                                    "Microsoft.Logic/workflows/disable/action",
|                                                    "Microsoft.Logic/workflows/enable/action",
|                                                    "Microsoft.Logic/workflows/validate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/connectionGateways/*/read",
|                                                    "Microsoft.Web/connections/*/read",
|                                                    "Microsoft.Web/customApis/*/read",
|                                                    "Microsoft.Web/serverFarms/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "87a39d53-fc1b-424a-814c-f7e04687dc9e",
|                                    "Name":  "Logic App Contributor",
|                                    "Description":  "Lets you manage logic app, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ClassicStorage/storageAccounts/listKeys/action",
|                                                    "Microsoft.ClassicStorage/storageAccounts/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/metricAlerts/*",
|                                                    "Microsoft.Insights/diagnosticSettings/*",
|                                                    "Microsoft.Insights/logdefinitions/*",
|                                                    "Microsoft.Insights/metricDefinitions/*",
|                                                    "Microsoft.Logic/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/connectionGateways/*",
|                                                    "Microsoft.Web/connections/*",
|                                                    "Microsoft.Web/customApis/*",
|                                                    "Microsoft.Web/serverFarms/join/action",
|                                                    "Microsoft.Web/serverFarms/read",
|                                                    "Microsoft.Web/sites/functions/listSecrets/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c7393b34-138c-406f-901b-d8cf2b17e6ae",
|                                    "Name":  "Managed Application Operator Role",
|                                    "Description":  "Lets you read and perform actions on Managed Application resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.Solutions/applications/read",
|                                                    "Microsoft.Solutions/*/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b9331d33-8a36-4f8c-b097-4f54124fdb44",
|                                    "Name":  "Managed Application Publisher Operator",
|                                    "Description":  "Allows the publisher to read resources in the managed resource group for Managed Application and request JIT access for additional operations. This role is only used by the Managed Application service to provide access to publishers.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Solutions/jitRequests/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f1a07417-d97a-45cb-824c-7a7467783830",
|                                    "Name":  "Managed Identity Operator",
|                                    "Description":  "Read and Assign User Assigned Identity",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/*/read",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e40ec5ca-96e0-45a2-b4ff-59039f2c2b59",
|                                    "Name":  "Managed Identity Contributor",
|                                    "Description":  "Create, Read, Update, and Delete User Assigned Identity",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/read",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/write",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/delete",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/revokeTokens/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d58bcaf-24a5-4b20-bdb6-eed9f69fbe4c",
|                                    "Name":  "Management Group Contributor",
|                                    "Description":  "Management Group Contributor Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Management/managementGroups/delete",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Management/managementGroups/subscriptions/delete",
|                                                    "Microsoft.Management/managementGroups/subscriptions/write",
|                                                    "Microsoft.Management/managementGroups/write",
|                                                    "Microsoft.Management/managementGroups/subscriptions/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ac63b705-f282-497d-ac71-919bf39d939d",
|                                    "Name":  "Management Group Reader",
|                                    "Description":  "Management Group Reader Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Management/managementGroups/subscriptions/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "43d0d8ad-25c7-4714-9337-8ba259a9fe05",
|                                    "Name":  "Monitoring Reader",
|                                    "Description":  "Can read all monitoring data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/search/action",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4d97b98b-1d4f-4787-a291-c67834d212e7",
|                                    "Name":  "Network Contributor",
|                                    "Description":  "Lets you manage networks, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d28c62d-5b37-4476-8438-e587778df237",
|                                    "Name":  "New Relic APM Account Contributor",
|                                    "Description":  "Lets you manage New Relic Application Performance Management accounts and applications, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "NewRelic.APM/accounts/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
|                                    "Name":  "Owner",
|                                    "Description":  "Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "acdd72a7-3385-48ef-bd42-f606fba81ae7",
|                                    "Name":  "Reader",
|                                    "Description":  "View all resources, but does not allow you to make any changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e0f68234-74aa-48ed-b826-c38b57376e17",
|                                    "Name":  "Redis Cache Contributor",
|                                    "Description":  "Lets you manage Redis caches, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cache/register/action",
|                                                    "Microsoft.Cache/redis/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c12c1c16-33a1-487b-954d-41c89c60f349",
|                                    "Name":  "Reader and Data Access",
|                                    "Description":  "Lets you view everything but will not let you delete or create a storage account or contained resource. It will also allow read/write access to all data contained in a storage account via access to storage account keys.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Storage/storageAccounts/ListAccountSas/action",
|                                                    "Microsoft.Storage/storageAccounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "36243c78-bf99-498c-9df9-86d9f8d28608",
|                                    "Name":  "Resource Policy Contributor",
|                                    "Description":  "Users with rights to create/modify resource policy, create support ticket and read resources/hierarchy.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.Authorization/policyassignments/*",
|                                                    "Microsoft.Authorization/policydefinitions/*",
|                                                    "Microsoft.Authorization/policyexemptions/*",
|                                                    "Microsoft.Authorization/policyenrollments/*",
|                                                    "Microsoft.Authorization/policysetdefinitions/*",
|                                                    "Microsoft.PolicyInsights/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "188a0f2f-5c9e-469b-ae67-2aa5ce574b94",
|                                    "Name":  "Scheduler Job Collections Contributor",
|                                    "Description":  "Lets you manage Scheduler job collections, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Scheduler/jobcollections/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7ca78c08-252a-4471-8644-bb5ff32d4ba0",
|                                    "Name":  "Search Service Contributor",
|                                    "Description":  "Lets you manage Search services, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Search/searchServices/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e3d13bf0-dd5a-482e-ba6b-9b8433878d10",
|                                    "Name":  "Security Manager (Legacy)",
|                                    "Description":  "This is a legacy role. Please use Security Administrator instead",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ClassicCompute/*/read",
|                                                    "Microsoft.ClassicCompute/virtualMachines/*/write",
|                                                    "Microsoft.ClassicNetwork/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Security/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "39bc4728-0917-49c7-9d2c-d95423bc2eb4",
|                                    "Name":  "Security Reader",
|                                    "Description":  "Security Reader Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.operationalInsights/workspaces/*/read",
|                                                    "Microsoft.Resources/deployments/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Security/*/read",
|                                                    "Microsoft.IoTSecurity/*/read",
|                                                    "Microsoft.Support/*/read",
|                                                    "Microsoft.Security/iotDefenderSettings/packageDownloads/action",
|                                                    "Microsoft.Security/iotDefenderSettings/downloadManagerActivation/action",
|                                                    "Microsoft.Security/iotSensors/downloadResetPassword/action",
|                                                    "Microsoft.IoTSecurity/defenderSettings/packageDownloads/action",
|                                                    "Microsoft.IoTSecurity/defenderSettings/downloadManagerActivation/action",
|                                                    "Microsoft.Management/managementGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8bbe83f1-e2a6-4df7-8cb4-4e04d4e5c827",
|                                    "Name":  "Spatial Anchors Account Contributor",
|                                    "Description":  "Lets you manage spatial anchors in your account, but not delete them",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/create/action",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/discovery/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/properties/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/query/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/submitdiag/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6670b86e-a3f7-4917-ac9b-5d6ab1be4567",
|                                    "Name":  "Site Recovery Contributor",
|                                    "Description":  "Lets you manage Site Recovery service except vault creation and role assignment",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                    "Microsoft.RecoveryServices/locations/allocateStamp/action",
|                                                    "Microsoft.RecoveryServices/Vaults/certificates/write",
|                                                    "Microsoft.RecoveryServices/Vaults/extendedInformation/*",
|                                                    "Microsoft.RecoveryServices/Vaults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/refreshContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/*",
|                                                    "Microsoft.RecoveryServices/vaults/replicationAlertSettings/*",
|                                                    "Microsoft.RecoveryServices/vaults/replicationEvents/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/*",
|                                                    "Microsoft.RecoveryServices/vaults/replicationJobs/*",
|                                                    "Microsoft.RecoveryServices/vaults/replicationPolicies/*",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/*",
|                                                    "Microsoft.RecoveryServices/vaults/replicationVaultSettings/*",
|                                                    "Microsoft.RecoveryServices/Vaults/storageConfig/*",
|                                                    "Microsoft.RecoveryServices/Vaults/tokenInfo/read",
|                                                    "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                    "Microsoft.RecoveryServices/Vaults/vaultTokens/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/*",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationOperationStatus/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "494ae006-db33-4328-bf46-533a6560a3ca",
|                                    "Name":  "Site Recovery Operator",
|                                    "Description":  "Lets you failover and failback but not perform other Site Recovery management operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                    "Microsoft.RecoveryServices/locations/allocateStamp/action",
|                                                    "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                    "Microsoft.RecoveryServices/Vaults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/refreshContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationAlertSettings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationEvents/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/checkConsistency/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/reassociateGateway/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/renewcertificate/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/replicationNetworkMappings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/applyRecoveryPoint/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/failoverCommit/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/plannedFailover/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/recoveryPoints/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/repairReplication/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/reProtect/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/switchprotection/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/testFailover/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/testFailoverCleanup/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/unplannedFailover/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/updateMobilityService/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectionContainerMappings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/refreshProvider/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/replicationStorageClassificationMappings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationvCenters/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationJobs/*",
|                                                    "Microsoft.RecoveryServices/vaults/replicationPolicies/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/failoverCommit/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/plannedFailover/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/reProtect/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/testFailover/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/testFailoverCleanup/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/unplannedFailover/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationVaultSettings/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/*",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read",
|                                                    "Microsoft.RecoveryServices/Vaults/storageConfig/read",
|                                                    "Microsoft.RecoveryServices/Vaults/tokenInfo/read",
|                                                    "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                    "Microsoft.RecoveryServices/Vaults/vaultTokens/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d51204f-eb77-4b1c-b86a-2ec626c49413",
|                                    "Name":  "Spatial Anchors Account Reader",
|                                    "Description":  "Lets you locate and read properties of spatial anchors in your account",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/discovery/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/properties/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/query/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/submitdiag/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dbaa88c4-0c30-4179-9fb3-46319faa6149",
|                                    "Name":  "Site Recovery Reader",
|                                    "Description":  "Lets you view Site Recovery status but not perform other management operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                    "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read",
|                                                    "Microsoft.RecoveryServices/Vaults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/refreshContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationAlertSettings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationEvents/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/replicationNetworkMappings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/recoveryPoints/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectionContainerMappings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/replicationStorageClassificationMappings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationvCenters/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationJobs/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationPolicies/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationVaultSettings/read",
|                                                    "Microsoft.RecoveryServices/Vaults/storageConfig/read",
|                                                    "Microsoft.RecoveryServices/Vaults/tokenInfo/read",
|                                                    "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                    "Microsoft.RecoveryServices/Vaults/vaultTokens/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "70bbe301-9835-447d-afdd-19eb3167307c",
|                                    "Name":  "Spatial Anchors Account Owner",
|                                    "Description":  "Lets you manage spatial anchors in your account, including deleting them",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/create/action",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/delete",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/discovery/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/properties/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/query/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/submitdiag/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4939a1f6-9ae0-4e48-a1e0-f2cbe897382d",
|                                    "Name":  "SQL Managed Instance Contributor",
|                                    "Description":  "Lets you manage SQL Managed Instances and required network configuration, but can’t give access to others.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/*",
|                                                    "Microsoft.Network/routeTables/*",
|                                                    "Microsoft.Sql/locations/*/read",
|                                                    "Microsoft.Sql/locations/instanceFailoverGroups/*",
|                                                    "Microsoft.Sql/managedInstances/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Network/virtualNetworks/subnets/*",
|                                                    "Microsoft.Network/virtualNetworks/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/metricDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Sql/managedInstances/azureADOnlyAuthentications/delete",
|                                                       "Microsoft.Sql/managedInstances/azureADOnlyAuthentications/write"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9b7fa17d-e63e-47b0-bb0a-15c516ac86ec",
|                                    "Name":  "SQL DB Contributor",
|                                    "Description":  "Lets you manage SQL databases, but not access to them. Also, you can\u0027t manage their security-related policies or their parent SQL servers.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Sql/locations/*/read",
|                                                    "Microsoft.Sql/servers/databases/*",
|                                                    "Microsoft.Sql/servers/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/metricDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Sql/servers/databases/ledgerDigestUploads/write",
|                                                       "Microsoft.Sql/servers/databases/ledgerDigestUploads/disable/action",
|                                                       "Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*",
|                                                       "Microsoft.Sql/managedInstances/databases/sensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*",
|                                                       "Microsoft.Sql/managedInstances/securityAlertPolicies/*",
|                                                       "Microsoft.Sql/managedInstances/vulnerabilityAssessments/*",
|                                                       "Microsoft.Sql/servers/databases/auditingSettings/*",
|                                                       "Microsoft.Sql/servers/databases/auditRecords/read",
|                                                       "Microsoft.Sql/servers/databases/currentSensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/dataMaskingPolicies/*",
|                                                       "Microsoft.Sql/servers/databases/extendedAuditingSettings/*",
|                                                       "Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/securityAlertPolicies/*",
|                                                       "Microsoft.Sql/servers/databases/securityMetrics/*",
|                                                       "Microsoft.Sql/servers/databases/sensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/vulnerabilityAssessments/*",
|                                                       "Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*",
|                                                       "Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*",
|                                                       "Microsoft.Sql/servers/vulnerabilityAssessments/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "056cd41c-7e88-42e1-933e-88ba6a50c9c3",
|                                    "Name":  "SQL Security Manager",
|                                    "Description":  "Lets you manage the security-related policies of SQL servers and databases, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Sql/locations/administratorAzureAsyncOperation/read",
|                                                    "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*",
|                                                    "Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*",
|                                                    "Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                    "Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*",
|                                                    "Microsoft.Sql/managedInstances/databases/sensitivityLabels/*",
|                                                    "Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*",
|                                                    "Microsoft.Sql/servers/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/servers/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/managedInstances/securityAlertPolicies/*",
|                                                    "Microsoft.Sql/managedInstances/databases/transparentDataEncryption/*",
|                                                    "Microsoft.Sql/managedInstances/vulnerabilityAssessments/*",
|                                                    "Microsoft.Sql/managedInstances/serverConfigurationOptions/read",
|                                                    "Microsoft.Sql/managedInstances/serverConfigurationOptions/write",
|                                                    "Microsoft.Sql/locations/serverConfigurationOptionAzureAsyncOperation/read",
|                                                    "Microsoft.Sql/servers/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/servers/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/servers/auditingSettings/*",
|                                                    "Microsoft.Sql/servers/extendedAuditingSettings/*",
|                                                    "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/servers/databases/auditingSettings/*",
|                                                    "Microsoft.Sql/servers/databases/auditRecords/read",
|                                                    "Microsoft.Sql/servers/databases/currentSensitivityLabels/*",
|                                                    "Microsoft.Sql/servers/databases/dataMaskingPolicies/*",
|                                                    "Microsoft.Sql/servers/databases/extendedAuditingSettings/read",
|                                                    "Microsoft.Sql/servers/databases/read",
|                                                    "Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*",
|                                                    "Microsoft.Sql/servers/databases/schemas/read",
|                                                    "Microsoft.Sql/servers/databases/schemas/tables/columns/read",
|                                                    "Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                    "Microsoft.Sql/servers/databases/schemas/tables/read",
|                                                    "Microsoft.Sql/servers/databases/securityAlertPolicies/*",
|                                                    "Microsoft.Sql/servers/databases/securityMetrics/*",
|                                                    "Microsoft.Sql/servers/databases/sensitivityLabels/*",
|                                                    "Microsoft.Sql/servers/databases/transparentDataEncryption/*",
|                                                    "Microsoft.Sql/servers/databases/sqlvulnerabilityAssessments/*",
|                                                    "Microsoft.Sql/servers/databases/vulnerabilityAssessments/*",
|                                                    "Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*",
|                                                    "Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*",
|                                                    "Microsoft.Sql/servers/devOpsAuditingSettings/*",
|                                                    "Microsoft.Sql/servers/firewallRules/*",
|                                                    "Microsoft.Sql/servers/read",
|                                                    "Microsoft.Sql/servers/securityAlertPolicies/*",
|                                                    "Microsoft.Sql/servers/sqlvulnerabilityAssessments/*",
|                                                    "Microsoft.Sql/servers/vulnerabilityAssessments/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Sql/servers/azureADOnlyAuthentications/*",
|                                                    "Microsoft.Sql/managedInstances/read",
|                                                    "Microsoft.Sql/managedInstances/azureADOnlyAuthentications/*",
|                                                    "Microsoft.Security/sqlVulnerabilityAssessments/*",
|                                                    "Microsoft.Sql/managedInstances/administrators/read",
|                                                    "Microsoft.Sql/servers/administrators/read",
|                                                    "Microsoft.Sql/servers/databases/ledgerDigestUploads/*",
|                                                    "Microsoft.Sql/locations/ledgerDigestUploadsAzureAsyncOperation/read",
|                                                    "Microsoft.Sql/locations/ledgerDigestUploadsOperationResults/read",
|                                                    "Microsoft.Sql/servers/externalPolicyBasedAuthorizations/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "17d1049b-9a84-46fb-8f53-869881c3d3ab",
|                                    "Name":  "Storage Account Contributor",
|                                    "Description":  "Lets you manage storage accounts, including accessing storage account keys which provide full access to storage account data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/diagnosticSettings/*",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437",
|                                    "Name":  "SQL Server Contributor",
|                                    "Description":  "Lets you manage SQL servers and databases, but not access to them, and not their security -related policies.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Sql/locations/*/read",
|                                                    "Microsoft.Sql/servers/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/metricDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*",
|                                                       "Microsoft.Sql/managedInstances/databases/sensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*",
|                                                       "Microsoft.Sql/managedInstances/securityAlertPolicies/*",
|                                                       "Microsoft.Sql/managedInstances/vulnerabilityAssessments/*",
|                                                       "Microsoft.Sql/servers/auditingSettings/*",
|                                                       "Microsoft.Sql/servers/databases/auditingSettings/*",
|                                                       "Microsoft.Sql/servers/databases/auditRecords/read",
|                                                       "Microsoft.Sql/servers/databases/currentSensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/dataMaskingPolicies/*",
|                                                       "Microsoft.Sql/servers/databases/extendedAuditingSettings/*",
|                                                       "Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/securityAlertPolicies/*",
|                                                       "Microsoft.Sql/servers/databases/securityMetrics/*",
|                                                       "Microsoft.Sql/servers/databases/sensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/vulnerabilityAssessments/*",
|                                                       "Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*",
|                                                       "Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*",
|                                                       "Microsoft.Sql/servers/devOpsAuditingSettings/*",
|                                                       "Microsoft.Sql/servers/extendedAuditingSettings/*",
|                                                       "Microsoft.Sql/servers/securityAlertPolicies/*",
|                                                       "Microsoft.Sql/servers/vulnerabilityAssessments/*",
|                                                       "Microsoft.Sql/servers/azureADOnlyAuthentications/delete",
|                                                       "Microsoft.Sql/servers/azureADOnlyAuthentications/write",
|                                                       "Microsoft.Sql/servers/externalPolicyBasedAuthorizations/delete",
|                                                       "Microsoft.Sql/servers/externalPolicyBasedAuthorizations/write"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "81a9662b-bebf-436f-a333-f67b29880f12",
|                                    "Name":  "Storage Account Key Operator Service Role",
|                                    "Description":  "Storage Account Key Operators are allowed to list and regenerate keys on Storage Accounts",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                    "Microsoft.Storage/storageAccounts/regeneratekey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
|                                    "Name":  "Storage Blob Data Contributor",
|                                    "Description":  "Allows for read, write and delete access to Azure Storage blob containers and data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b7e6dc6d-f1e8-4753-8033-0f276bb0955b",
|                                    "Name":  "Storage Blob Data Owner",
|                                    "Description":  "Allows for full access to Azure Storage blob containers and data, including assigning POSIX access control.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/*",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
|                                    "Name":  "Storage Blob Data Reader",
|                                    "Description":  "Allows for read access to Azure Storage blob containers and data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "974c5e8b-45b9-4653-ba55-5f855dd0fb88",
|                                    "Name":  "Storage Queue Data Contributor",
|                                    "Description":  "Allows for read, write, and delete access to Azure Storage queues and queue messages",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/queueServices/queues/delete",
|                                                    "Microsoft.Storage/storageAccounts/queueServices/queues/read",
|                                                    "Microsoft.Storage/storageAccounts/queueServices/queues/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/delete",
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/read",
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/write",
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/process/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8a0f0c08-91a1-4084-bc3d-661d67233fed",
|                                    "Name":  "Storage Queue Data Message Processor",
|                                    "Description":  "Allows for peek, receive, and delete access to Azure Storage queue messages",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/read",
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/process/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c6a89b2d-59bc-44d0-9896-0f6e12d7b80a",
|                                    "Name":  "Storage Queue Data Message Sender",
|                                    "Description":  "Allows for sending of Azure Storage queue messages",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/add/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "19e7f393-937e-4f77-808e-94535e297925",
|                                    "Name":  "Storage Queue Data Reader",
|                                    "Description":  "Allows for read access to Azure Storage queues and queue messages",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/queueServices/queues/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cfd33db0-3dd1-45e3-aa9d-cdbdf3b6f24e",
|                                    "Name":  "Support Request Contributor",
|                                    "Description":  "Lets you create and manage Support requests",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a4b10055-b0c7-44c2-b00f-c7b5b3550cf7",
|                                    "Name":  "Traffic Manager Contributor",
|                                    "Description":  "Lets you manage Traffic Manager profiles, but does not let you control who has access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/trafficManagerProfiles/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9",
|                                    "Name":  "User Access Administrator",
|                                    "Description":  "Lets you manage user access to Azure resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.Authorization/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9980e02c-c2be-4d73-94e8-173b1dc7cf3c",
|                                    "Name":  "Virtual Machine Contributor",
|                                    "Description":  "Lets you manage virtual machines, but not access to them, and not the virtual network or storage account they\u0027re connected to.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Compute/availabilitySets/*",
|                                                    "Microsoft.Compute/locations/*",
|                                                    "Microsoft.Compute/virtualMachines/*",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/*",
|                                                    "Microsoft.Compute/cloudServices/*",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/hostgroups/write",
|                                                    "Microsoft.Compute/hostgroups/hosts/write",
|                                                    "Microsoft.DevTestLab/schedules/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/applicationGateways/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/inboundNatPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                    "Microsoft.Network/loadBalancers/probes/join/action",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/locations/*",
|                                                    "Microsoft.Network/networkInterfaces/*",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/publicIPAddresses/join/action",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.RecoveryServices/locations/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/write",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/*/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/write",
|                                                    "Microsoft.RecoveryServices/Vaults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                    "Microsoft.RecoveryServices/Vaults/write",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.SerialConsole/serialPorts/connect/action",
|                                                    "Microsoft.SqlVirtualMachine/*",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b",
|                                    "Name":  "Web Plan Contributor",
|                                    "Description":  "Lets you manage the web plans for websites, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/serverFarms/*",
|                                                    "Microsoft.Web/hostingEnvironments/Join/Action",
|                                                    "Microsoft.Insights/autoscalesettings/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "de139f84-1756-47ae-9be6-808fbbe84772",
|                                    "Name":  "Website Contributor",
|                                    "Description":  "Lets you manage websites (not web plans), but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/components/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/certificates/*",
|                                                    "Microsoft.Web/listSitesAssignedToHostName/read",
|                                                    "Microsoft.Web/register/action",
|                                                    "Microsoft.Web/serverFarms/join/action",
|                                                    "Microsoft.Web/serverFarms/read",
|                                                    "Microsoft.Web/sites/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "090c5cfd-751d-490a-894a-3ce6f1109419",
|                                    "Name":  "Azure Service Bus Data Owner",
|                                    "Description":  "Allows for full access to Azure Service Bus resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ServiceBus/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ServiceBus/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f526a384-b230-433a-b45c-95f59c4a2dec",
|                                    "Name":  "Azure Event Hubs Data Owner",
|                                    "Description":  "Allows for full access to Azure Event Hubs resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EventHub/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventHub/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bbf86eb8-f7b4-4cce-96e4-18cddf81d86e",
|                                    "Name":  "Attestation Contributor",
|                                    "Description":  "Can read write or delete the attestation provider instance",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Attestation/attestationProviders/attestation/read",
|                                                    "Microsoft.Attestation/attestationProviders/attestation/write",
|                                                    "Microsoft.Attestation/attestationProviders/attestation/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "61ed4efc-fab3-44fd-b111-e24485cc132a",
|                                    "Name":  "HDInsight Cluster Operator",
|                                    "Description":  "Lets you read and modify HDInsight cluster configurations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HDInsight/*/read",
|                                                    "Microsoft.HDInsight/clusters/getGatewaySettings/action",
|                                                    "Microsoft.HDInsight/clusters/updateGatewaySettings/action",
|                                                    "Microsoft.HDInsight/clusters/configurations/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "230815da-be43-4aae-9cb4-875f7bd000aa",
|                                    "Name":  "Cosmos DB Operator",
|                                    "Description":  "Lets you manage Azure Cosmos DB accounts, but not access data in them. Prevents access to account keys and connection strings.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDb/databaseAccounts/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.DocumentDB/databaseAccounts/copyJobs/*",
|                                                       "Microsoft.DocumentDB/databaseAccounts/dataTransferJobs/*",
|                                                       "Microsoft.DocumentDB/databaseAccounts/readonlyKeys/*",
|                                                       "Microsoft.DocumentDB/databaseAccounts/regenerateKey/*",
|                                                       "Microsoft.DocumentDB/databaseAccounts/listKeys/*",
|                                                       "Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/*",
|                                                       "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/write",
|                                                       "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/delete",
|                                                       "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/write",
|                                                       "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/delete",
|                                                       "Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/write",
|                                                       "Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/delete",
|                                                       "Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/write",
|                                                       "Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "48b40c6e-82e0-4eb3-90d5-19e40f49b624",
|                                    "Name":  "Hybrid Server Resource Administrator",
|                                    "Description":  "Can read, write, delete, and re-onboard Hybrid servers to the Hybrid Resource Provider.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/machines/*",
|                                                    "Microsoft.HybridCompute/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d1e5ee4-7c68-4a71-ac8b-0739630a3dfb",
|                                    "Name":  "Hybrid Server Onboarding",
|                                    "Description":  "Can onboard new Hybrid servers to the Hybrid Resource Provider.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a638d3c7-ab3a-418d-83e6-5f17a39d4fde",
|                                    "Name":  "Azure Event Hubs Data Receiver",
|                                    "Description":  "Allows receive access to Azure Event Hubs resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EventHub/*/eventhubs/consumergroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventHub/*/receive/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2b629674-e913-4c01-ae53-ef4638d8f975",
|                                    "Name":  "Azure Event Hubs Data Sender",
|                                    "Description":  "Allows send access to Azure Event Hubs resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EventHub/*/eventhubs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventHub/*/send/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4f6d3b9b-027b-4f4c-9142-0e5a2a2247e0",
|                                    "Name":  "Azure Service Bus Data Receiver",
|                                    "Description":  "Allows for receive access to Azure Service Bus resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ServiceBus/*/queues/read",
|                                                    "Microsoft.ServiceBus/*/topics/read",
|                                                    "Microsoft.ServiceBus/*/topics/subscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ServiceBus/*/receive/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "69a216fc-b8fb-44d8-bc22-1f3c2cd27a39",
|                                    "Name":  "Azure Service Bus Data Sender",
|                                    "Description":  "Allows for send access to Azure Service Bus resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ServiceBus/*/queues/read",
|                                                    "Microsoft.ServiceBus/*/topics/read",
|                                                    "Microsoft.ServiceBus/*/topics/subscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ServiceBus/*/send/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "aba4ae5f-2193-4029-9191-0cb91df5e314",
|                                    "Name":  "Storage File Data SMB Share Reader",
|                                    "Description":  "Allows for read access to Azure File Share over SMB",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb",
|                                    "Name":  "Storage File Data SMB Share Contributor",
|                                    "Description":  "Allows for read, write, and delete access in Azure Storage file shares over SMB",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b12aa53e-6015-4669-85d0-8515ebb3ae7f",
|                                    "Name":  "Private DNS Zone Contributor",
|                                    "Description":  "Lets you manage private DNS zone resources, but not the virtual networks they are linked to.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Network/privateDnsZones/*",
|                                                    "Microsoft.Network/privateDnsOperationResults/*",
|                                                    "Microsoft.Network/privateDnsOperationStatuses/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "db58b8e5-c6ad-4a2a-8342-4190687cbf4a",
|                                    "Name":  "Storage Blob Delegator",
|                                    "Description":  "Allows for generation of a user delegation key which can be used to sign SAS tokens",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1d18fff3-a72a-46b5-b4a9-0b38a3cd7e63",
|                                    "Name":  "Desktop Virtualization User",
|                                    "Description":  "Allows user to use the applications in an application group.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DesktopVirtualization/applicationGroups/useApplications/action",
|                                                        "Microsoft.DesktopVirtualization/appAttachPackages/useApplications/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a7264617-510b-434b-a828-9731dc254ea7",
|                                    "Name":  "Storage File Data SMB Share Elevated Contributor",
|                                    "Description":  "Allows for read, write, delete and modify NTFS permission access in Azure Storage file shares over SMB",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "41077137-e803-4205-871c-5a86e6a753b4",
|                                    "Name":  "Blueprint Contributor",
|                                    "Description":  "Can manage blueprint definitions, but not assign them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Blueprint/blueprints/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "437d2ced-4a38-4302-8479-ed2bcb43d090",
|                                    "Name":  "Blueprint Operator",
|                                    "Description":  "Can assign existing published blueprints, but cannot create new blueprints. NOTE: this only works if the assignment is done with a user-assigned managed identity.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Blueprint/blueprintAssignments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ab8e14d6-4a74-4a29-9ba8-549422addade",
|                                    "Name":  "Microsoft Sentinel Contributor",
|                                    "Description":  "Microsoft Sentinel Contributor",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SecurityInsights/*",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/querypacks/*/read",
|                                                    "Microsoft.Insights/workbooks/*",
|                                                    "Microsoft.Insights/myworkbooks/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                       "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3e150937-b8fe-4cfb-8069-0eaf05ecd056",
|                                    "Name":  "Microsoft Sentinel Responder",
|                                    "Description":  "Microsoft Sentinel Responder",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SecurityInsights/*/read",
|                                                    "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                    "Microsoft.SecurityInsights/automationRules/*",
|                                                    "Microsoft.SecurityInsights/cases/*",
|                                                    "Microsoft.SecurityInsights/incidents/*",
|                                                    "Microsoft.SecurityInsights/entities/runPlaybook/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/bulkTag/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/replaceTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/systems/undoAction/action",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/querypacks/*/read",
|                                                    "Microsoft.Insights/workbooks/read",
|                                                    "Microsoft.Insights/myworkbooks/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.SecurityInsights/cases/*/Delete",
|                                                       "Microsoft.SecurityInsights/incidents/*/Delete",
|                                                       "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                       "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8d289c81-5878-46d4-8554-54e1e3d8b5cb",
|                                    "Name":  "Microsoft Sentinel Reader",
|                                    "Description":  "Microsoft Sentinel Reader",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SecurityInsights/*/read",
|                                                    "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/LinkedServices/read",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                    "Microsoft.OperationalInsights/querypacks/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.Insights/workbooks/read",
|                                                    "Microsoft.Insights/myworkbooks/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/templateSpecs/*/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                       "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "66bb4e9e-b016-4a94-8249-4c0511c2be84",
|                                    "Name":  "Policy Insights Data Writer (Preview)",
|                                    "Description":  "Allows read access to resource policies and write access to resource component policy events.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/policyassignments/read",
|                                                    "Microsoft.Authorization/policydefinitions/read",
|                                                    "Microsoft.Authorization/policyexemptions/read",
|                                                    "Microsoft.Authorization/policysetdefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.PolicyInsights/checkDataPolicyCompliance/action",
|                                                        "Microsoft.PolicyInsights/policyEvents/logDataEvents/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "04165923-9d83-45d5-8227-78b77b0a687e",
|                                    "Name":  "SignalR AccessKey Reader",
|                                    "Description":  "Read SignalR Service Access Keys",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SignalRService/*/read",
|                                                    "Microsoft.SignalRService/SignalR/listkeys/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8cf5e20a-e4b2-4e9d-b3a1-5ceb692c2761",
|                                    "Name":  "SignalR/Web PubSub Contributor",
|                                    "Description":  "Create, Read, Update, and Delete SignalR service resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SignalRService/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b64e21ea-ac4e-4cdf-9dc9-5b892992bee7",
|                                    "Name":  "Azure Connected Machine Onboarding",
|                                    "Description":  "Can onboard Azure Connected Machines.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/settings/read",
|                                                    "Microsoft.HybridCompute/settings/write",
|                                                    "Microsoft.HybridCompute/gateways/read",
|                                                    "Microsoft.HybridCompute/privateLinkScopes/read",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                    "Microsoft.Insights/dataCollectionRuleAssociations/write",
|                                                    "Microsoft.Insights/dataCollectionRuleAssociations/delete",
|                                                    "Microsoft.Insights/dataCollectionRuleAssociations/read",
|                                                    "Microsoft.HybridCompute/machines/addExtensions/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "91c1777a-f3dc-4fae-b103-61d183457e46",
|                                    "Name":  "Managed Services Registration assignment Delete Role",
|                                    "Description":  "Managed Services Registration Assignment Delete Role allows the managing tenant users to delete the registration assignment assigned to their tenant.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedServices/registrationAssignments/read",
|                                                    "Microsoft.ManagedServices/registrationAssignments/delete",
|                                                    "Microsoft.ManagedServices/operationStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5ae67dd6-50cb-40e7-96ff-dc2bfa4b606b",
|                                    "Name":  "App Configuration Data Owner",
|                                    "Description":  "Allows full access to App Configuration data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppConfiguration/configurationStores/*/read",
|                                                        "Microsoft.AppConfiguration/configurationStores/*/write",
|                                                        "Microsoft.AppConfiguration/configurationStores/*/delete",
|                                                        "Microsoft.AppConfiguration/configurationStores/*/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "516239f1-63e1-4d78-a4de-a74fb236a071",
|                                    "Name":  "App Configuration Data Reader",
|                                    "Description":  "Allows read access to App Configuration data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppConfiguration/configurationStores/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "34e09817-6cbe-4d01-b1a2-e0eac5743d41",
|                                    "Name":  "Kubernetes Cluster - Azure Arc Onboarding",
|                                    "Description":  "Role definition to authorize any user/service to create connectedClusters resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Kubernetes/connectedClusters/Write",
|                                                    "Microsoft.Kubernetes/connectedClusters/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7f646f1b-fa08-80eb-a22b-edd6ce5c915c",
|                                    "Name":  "Experimentation Contributor",
|                                    "Description":  "Experimentation Contributor",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/write",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/delete",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/experiment/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/emergencystop/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/read",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/write",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "466ccd10-b268-4a11-b098-b4849f024126",
|                                    "Name":  "Cognitive Services QnA Maker Reader",
|                                    "Description":  "Let’s you read and test a KB only.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/download/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/generateanswer/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/alterations/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/endpointkeys/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/endpointsettings/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/download/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/generateanswer/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/alterations/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointkeys/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointsettings/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/download/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/generateanswer/action",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/alterations/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointkeys/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointsettings/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f4cc2bf9-21be-47a1-bdf1-5c5804381025",
|                                    "Name":  "Cognitive Services QnA Maker Editor",
|                                    "Description":  "Let’s you create, edit, import and export a KB. You cannot publish or delete a KB.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/download/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/create/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/generateanswer/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/train/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/alterations/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/alterations/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/endpointkeys/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/endpointkeys/refreshkeys/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/endpointsettings/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/endpointsettings/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/operations/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/download/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/create/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/generateanswer/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/train/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/alterations/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/alterations/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointkeys/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointkeys/refreshkeys/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointsettings/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointsettings/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/operations/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/download/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/create/write",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/write",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/generateanswer/action",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/train/action",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/alterations/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/alterations/write",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointkeys/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointkeys/refreshkeys/action",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointsettings/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointsettings/write",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/operations/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7f646f1b-fa08-80eb-a33b-edd6ce5c915c",
|                                    "Name":  "Experimentation Administrator",
|                                    "Description":  "Experimentation Administrator",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/admin/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/write",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/delete",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/experimentadmin/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/experiment/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/emergencystop/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/read",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/write",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/delete",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/admin/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/metricwrite/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/metricwrite/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3df8b902-2a6f-47c7-8cc5-360e9b272a7e",
|                                    "Name":  "Remote Rendering Administrator",
|                                    "Description":  "Provides user with conversion, manage session, rendering and diagnostics capabilities for Azure Remote Rendering",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/convert/action",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/convert/read",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/convert/delete",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/read",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/action",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/delete",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/render/read",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/diagnostic/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d39065c4-c120-43c9-ab0a-63eed9795f0a",
|                                    "Name":  "Remote Rendering Client",
|                                    "Description":  "Provides user with manage session, rendering and diagnostics capabilities for Azure Remote Rendering.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/read",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/action",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/delete",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/render/read",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/diagnostic/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "641177b8-a67a-45b9-a033-47bc880bb21e",
|                                    "Name":  "Managed Application Contributor Role",
|                                    "Description":  "Allows for creating managed application resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.Solutions/applications/*",
|                                                    "Microsoft.Solutions/register/action",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/*",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "612c2aa1-cb24-443b-ac28-3ab7272de6f5",
|                                    "Name":  "Security Assessment Contributor",
|                                    "Description":  "Lets you push assessments to Security Center",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Security/assessments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4a9ae827-6dc8-4573-8ac7-8239d42aa03f",
|                                    "Name":  "Tag Contributor",
|                                    "Description":  "Lets you manage tags on entities, without providing access to the entities themselves.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
|                                                    "Microsoft.Resources/subscriptions/resources/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Resources/tags/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c7aa55d3-1abb-444a-a5ca-5e51e485d6ec",
|                                    "Name":  "Integration Service Environment Developer",
|                                    "Description":  "Allows developers to create and update workflows, integration accounts and API connections in integration service environments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Logic/integrationServiceEnvironments/read",
|                                                    "Microsoft.Logic/integrationServiceEnvironments/*/join/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a41e2c5b-bd99-4a07-88f4-9bf657a760b8",
|                                    "Name":  "Integration Service Environment Contributor",
|                                    "Description":  "Lets you manage integration service environments, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Logic/integrationServiceEnvironments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8",
|                                    "Name":  "Azure Kubernetes Service Contributor Role",
|                                    "Description":  "Grants access to read and write Azure Kubernetes Service clusters",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ContainerService/locations/*",
|                                                    "Microsoft.ContainerService/managedClusters/*",
|                                                    "Microsoft.ContainerService/managedclustersnapshots/*",
|                                                    "Microsoft.ContainerService/snapshots/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/deploymentSafeguards/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d57506d4-4c8d-48b1-8587-93c323f6a5a3",
|                                    "Name":  "Azure Digital Twins Data Reader",
|                                    "Description":  "Read-only role for Digital Twins data-plane properties",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DigitalTwins/digitaltwins/read",
|                                                        "Microsoft.DigitalTwins/digitaltwins/relationships/read",
|                                                        "Microsoft.DigitalTwins/eventroutes/read",
|                                                        "Microsoft.DigitalTwins/jobs/import/read",
|                                                        "Microsoft.DigitalTwins/jobs/imports/read",
|                                                        "Microsoft.DigitalTwins/jobs/deletions/read",
|                                                        "Microsoft.DigitalTwins/models/read",
|                                                        "Microsoft.DigitalTwins/query/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bcd981a7-7f74-457b-83e1-cceb9e632ffe",
|                                    "Name":  "Azure Digital Twins Data Owner",
|                                    "Description":  "Full access role for Digital Twins data-plane",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DigitalTwins/digitaltwins/*",
|                                                        "Microsoft.DigitalTwins/digitaltwins/commands/*",
|                                                        "Microsoft.DigitalTwins/digitaltwins/relationships/*",
|                                                        "Microsoft.DigitalTwins/eventroutes/*",
|                                                        "Microsoft.DigitalTwins/jobs/*",
|                                                        "Microsoft.DigitalTwins/models/*",
|                                                        "Microsoft.DigitalTwins/query/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "350f8d15-c687-4448-8ae1-157740a3936d",
|                                    "Name":  "Hierarchy Settings Administrator",
|                                    "Description":  "Allows users to edit and delete Hierarchy Settings",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Management/managementGroups/settings/write",
|                                                    "Microsoft.Management/managementGroups/settings/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5a1fc7df-4bf1-4951-a576-89034ee01acd",
|                                    "Name":  "FHIR Data Contributor",
|                                    "Description":  "Role allows user or principal full access to FHIR Data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/*",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3db33094-8700-4567-8da5-1501d4e7e843",
|                                    "Name":  "FHIR Data Exporter",
|                                    "Description":  "Role allows user or principal to read and export FHIR Data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/export/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/export/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4c8d0bbc-75d3-4935-991f-5f3c56d81508",
|                                    "Name":  "FHIR Data Reader",
|                                    "Description":  "Role allows user or principal to read FHIR Data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3f88fce4-5892-4214-ae73-ba5294559913",
|                                    "Name":  "FHIR Data Writer",
|                                    "Description":  "Role allows user or principal to read and write FHIR Data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/write",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/delete",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/export/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/resourceValidate/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/reindex/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/convertData/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/editProfileDefinitions/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/import/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/write",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/delete",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/export/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/resourceValidate/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/reindex/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/convertData/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/editProfileDefinitions/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/import/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "49632ef5-d9ac-41f4-b8e7-bbe587fa74a1",
|                                    "Name":  "Experimentation Reader",
|                                    "Description":  "Experimentation Reader",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Experimentation/experimentWorkspaces/read",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4dd61c23-6743-42fe-a388-d8bdd41cb745",
|                                    "Name":  "Object Understanding Account Owner",
|                                    "Description":  "Provides user with ingestion capabilities for Azure Object Understanding.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/ObjectUnderstandingAccounts/ingest/action",
|                                                        "Microsoft.MixedReality/ObjectUnderstandingAccounts/ingest/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8f5e0ce6-4f7b-4dcf-bddf-e6f48634a204",
|                                    "Name":  "Azure Maps Data Contributor",
|                                    "Description":  "Grants access to read, write, and delete access to map related data from an Azure maps account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Maps/accounts/*/read",
|                                                        "Microsoft.Maps/accounts/*/write",
|                                                        "Microsoft.Maps/accounts/*/delete",
|                                                        "Microsoft.Maps/accounts/*/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c1ff6cc2-c111-46fe-8896-e0ef812ad9f3",
|                                    "Name":  "Cognitive Services Custom Vision Contributor",
|                                    "Description":  "Full access to the project, including the ability to view, create, edit, or delete projects.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5c4089e1-6d96-4d2f-b296-c1bc7137275f",
|                                    "Name":  "Cognitive Services Custom Vision Deployment",
|                                    "Description":  "Publish, unpublish or export models. Deployment can view the project but can’t update.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/iterations/publish/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/iterations/export/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/quicktest/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/classify/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/detect/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "88424f51-ebe7-446f-bc41-7fa16989e96c",
|                                    "Name":  "Cognitive Services Custom Vision Labeler",
|                                    "Description":  "View, edit training images and create, add, remove, or delete the image tags. Labelers can view the project but can’t update anything other than training images and tags.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/query/action",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/images/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/tags/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/images/suggested/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/tagsandregions/suggestions/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "93586559-c37d-4a6b-ba08-b9f0940c2d73",
|                                    "Name":  "Cognitive Services Custom Vision Reader",
|                                    "Description":  "Read-only actions in the project. Readers can’t create or update the project.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/query/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0a5ae4ab-0d65-4eeb-be61-29fc9b54394b",
|                                    "Name":  "Cognitive Services Custom Vision Trainer",
|                                    "Description":  "View, edit projects and train the models, including the ability to publish, unpublish, export the models. Trainers can’t create or delete the project.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "00482a5a-887f-4fb3-b363-3b7fe8e74483",
|                                    "Name":  "Key Vault Administrator",
|                                    "Description":  "Perform all data plane operations on a key vault and all objects in it, including certificates, keys, and secrets. Cannot manage key vault resources or manage role assignments. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.KeyVault/checkNameAvailability/read",
|                                                    "Microsoft.KeyVault/deletedVaults/read",
|                                                    "Microsoft.KeyVault/locations/*/read",
|                                                    "Microsoft.KeyVault/vaults/*/read",
|                                                    "Microsoft.KeyVault/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "12338af0-0e69-4776-bea7-57ae8d297424",
|                                    "Name":  "Key Vault Crypto User",
|                                    "Description":  "Perform cryptographic operations using keys. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/keys/read",
|                                                        "Microsoft.KeyVault/vaults/keys/update/action",
|                                                        "Microsoft.KeyVault/vaults/keys/backup/action",
|                                                        "Microsoft.KeyVault/vaults/keys/encrypt/action",
|                                                        "Microsoft.KeyVault/vaults/keys/decrypt/action",
|                                                        "Microsoft.KeyVault/vaults/keys/wrap/action",
|                                                        "Microsoft.KeyVault/vaults/keys/unwrap/action",
|                                                        "Microsoft.KeyVault/vaults/keys/sign/action",
|                                                        "Microsoft.KeyVault/vaults/keys/verify/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b86a8fe4-44ce-4948-aee5-eccb2c155cd7",
|                                    "Name":  "Key Vault Secrets Officer",
|                                    "Description":  "Perform any action on the secrets of a key vault, except manage permissions. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.KeyVault/checkNameAvailability/read",
|                                                    "Microsoft.KeyVault/deletedVaults/read",
|                                                    "Microsoft.KeyVault/locations/*/read",
|                                                    "Microsoft.KeyVault/vaults/*/read",
|                                                    "Microsoft.KeyVault/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/secrets/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4633458b-17de-408a-b874-0445c86b69e6",
|                                    "Name":  "Key Vault Secrets User",
|                                    "Description":  "Read secret contents. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/secrets/getSecret/action",
|                                                        "Microsoft.KeyVault/vaults/secrets/readMetadata/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a4417e6f-fecd-4de8-b567-7b0420556985",
|                                    "Name":  "Key Vault Certificates Officer",
|                                    "Description":  "Perform any action on the certificates of a key vault, except manage permissions. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.KeyVault/checkNameAvailability/read",
|                                                    "Microsoft.KeyVault/deletedVaults/read",
|                                                    "Microsoft.KeyVault/locations/*/read",
|                                                    "Microsoft.KeyVault/vaults/*/read",
|                                                    "Microsoft.KeyVault/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/certificatecas/*",
|                                                        "Microsoft.KeyVault/vaults/certificates/*",
|                                                        "Microsoft.KeyVault/vaults/certificatecontacts/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "21090545-7ca7-4776-b22c-e363652d74d2",
|                                    "Name":  "Key Vault Reader",
|                                    "Description":  "Read metadata of key vaults and its certificates, keys, and secrets. Cannot read sensitive values such as secret contents or key material. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.KeyVault/checkNameAvailability/read",
|                                                    "Microsoft.KeyVault/deletedVaults/read",
|                                                    "Microsoft.KeyVault/locations/*/read",
|                                                    "Microsoft.KeyVault/vaults/*/read",
|                                                    "Microsoft.KeyVault/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/*/read",
|                                                        "Microsoft.KeyVault/vaults/secrets/readMetadata/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e147488a-f6f5-4113-8e2d-b22465e65bf6",
|                                    "Name":  "Key Vault Crypto Service Encryption User",
|                                    "Description":  "Read metadata of keys and perform wrap/unwrap operations. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EventGrid/eventSubscriptions/write",
|                                                    "Microsoft.EventGrid/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/keys/read",
|                                                        "Microsoft.KeyVault/vaults/keys/wrap/action",
|                                                        "Microsoft.KeyVault/vaults/keys/unwrap/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "63f0a09d-1495-4db4-a681-037d84835eb4",
|                                    "Name":  "Azure Arc Kubernetes Viewer",
|                                    "Description":  "Lets you view all resources in cluster/namespace, except secrets.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/deployments/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/batch/jobs/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/configmaps/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/endpoints/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/events/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/pods/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/services/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5b999177-9696-4545-85c7-50de3797e5a1",
|                                    "Name":  "Azure Arc Kubernetes Writer",
|                                    "Description":  "Lets you update everything in cluster/namespace, except (cluster)roles and (cluster)role bindings.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/configmaps/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/endpoints/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/events/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/pods/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/secrets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/services/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8393591c-06b9-48a2-a542-1bd6b377f6a2",
|                                    "Name":  "Azure Arc Kubernetes Cluster Admin",
|                                    "Description":  "Lets you manage all resources in the cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Kubernetes/connectedClusters/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dffb1e0c-446f-4dde-a09f-99eb5cc68b96",
|                                    "Name":  "Azure Arc Kubernetes Admin",
|                                    "Description":  "Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write",
|                                                        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/configmaps/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/endpoints/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/events/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/pods/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/secrets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/services/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b",
|                                    "Name":  "Azure Kubernetes Service RBAC Cluster Admin",
|                                    "Description":  "Lets you manage all resources in the cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/managedClusters/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3498e952-d568-435e-9b2c-8d77e338d7f7",
|                                    "Name":  "Azure Kubernetes Service RBAC Admin",
|                                    "Description":  "Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/managedClusters/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7f6c6a51-bcf8-42ba-9220-52d62157d7db",
|                                    "Name":  "Azure Kubernetes Service RBAC Reader",
|                                    "Description":  "Allows read-only access to see most objects in a namespace. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation). Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/managedClusters/apps/daemonsets/read",
|                                                        "Microsoft.ContainerService/managedClusters/apps/deployments/read",
|                                                        "Microsoft.ContainerService/managedClusters/apps/replicasets/read",
|                                                        "Microsoft.ContainerService/managedClusters/apps/statefulsets/read",
|                                                        "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/read",
|                                                        "Microsoft.ContainerService/managedClusters/batch/cronjobs/read",
|                                                        "Microsoft.ContainerService/managedClusters/batch/jobs/read",
|                                                        "Microsoft.ContainerService/managedClusters/configmaps/read",
|                                                        "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
|                                                        "Microsoft.ContainerService/managedClusters/endpoints/read",
|                                                        "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/managedClusters/events/read",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/daemonsets/read",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/deployments/read",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/ingresses/read",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/read",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/replicasets/read",
|                                                        "Microsoft.ContainerService/managedClusters/limitranges/read",
|                                                        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
|                                                        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
|                                                        "Microsoft.ContainerService/managedClusters/namespaces/read",
|                                                        "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/read",
|                                                        "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/read",
|                                                        "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/read",
|                                                        "Microsoft.ContainerService/managedClusters/pods/read",
|                                                        "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/read",
|                                                        "Microsoft.ContainerService/managedClusters/replicationcontrollers/read",
|                                                        "Microsoft.ContainerService/managedClusters/resourcequotas/read",
|                                                        "Microsoft.ContainerService/managedClusters/serviceaccounts/read",
|                                                        "Microsoft.ContainerService/managedClusters/services/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a7ffa36f-339b-4b5c-8bdf-e2c188b2c0eb",
|                                    "Name":  "Azure Kubernetes Service RBAC Writer",
|                                    "Description":  "Allows read/write access to most objects in a namespace.This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets and running Pods as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace. Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/managedClusters/apps/daemonsets/*",
|                                                        "Microsoft.ContainerService/managedClusters/apps/deployments/*",
|                                                        "Microsoft.ContainerService/managedClusters/apps/replicasets/*",
|                                                        "Microsoft.ContainerService/managedClusters/apps/statefulsets/*",
|                                                        "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/*",
|                                                        "Microsoft.ContainerService/managedClusters/batch/cronjobs/*",
|                                                        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/read",
|                                                        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/write",
|                                                        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/delete",
|                                                        "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
|                                                        "Microsoft.ContainerService/managedClusters/batch/jobs/*",
|                                                        "Microsoft.ContainerService/managedClusters/configmaps/*",
|                                                        "Microsoft.ContainerService/managedClusters/endpoints/*",
|                                                        "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/managedClusters/events/*",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/daemonsets/*",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/deployments/*",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/ingresses/*",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/*",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/replicasets/*",
|                                                        "Microsoft.ContainerService/managedClusters/limitranges/read",
|                                                        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
|                                                        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
|                                                        "Microsoft.ContainerService/managedClusters/namespaces/read",
|                                                        "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/*",
|                                                        "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/*",
|                                                        "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/*",
|                                                        "Microsoft.ContainerService/managedClusters/pods/*",
|                                                        "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/*",
|                                                        "Microsoft.ContainerService/managedClusters/replicationcontrollers/*",
|                                                        "Microsoft.ContainerService/managedClusters/resourcequotas/read",
|                                                        "Microsoft.ContainerService/managedClusters/secrets/*",
|                                                        "Microsoft.ContainerService/managedClusters/serviceaccounts/*",
|                                                        "Microsoft.ContainerService/managedClusters/services/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "82200a5b-e217-47a5-b665-6d8765ee745b",
|                                    "Name":  "Services Hub Operator",
|                                    "Description":  "Services Hub Operator allows you to perform all read, write, and deletion operations related to Services Hub Connectors.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.ServicesHub/connectors/write",
|                                                    "Microsoft.ServicesHub/connectors/read",
|                                                    "Microsoft.ServicesHub/connectors/delete",
|                                                    "Microsoft.ServicesHub/connectors/checkAssessmentEntitlement/action",
|                                                    "Microsoft.ServicesHub/connectors/*",
|                                                    "Microsoft.ServicesHub/*",
|                                                    "Microsoft.ServicesHub/supportOfferingEntitlement/read",
|                                                    "Microsoft.ServicesHub/workspaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d18777c0-1514-4662-8490-608db7d334b6",
|                                    "Name":  "Object Understanding Account Reader",
|                                    "Description":  "Lets you read ingestion jobs for an object understanding account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/ObjectUnderstandingAccounts/ingest/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fd53cd77-2268-407a-8f46-7e7863d0f521",
|                                    "Name":  "SignalR REST API Owner",
|                                    "Description":  "Full access to Azure SignalR Service REST APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SignalRService/SignalR/auth/clientToken/action",
|                                                        "Microsoft.SignalRService/SignalR/hub/*",
|                                                        "Microsoft.SignalRService/SignalR/group/*",
|                                                        "Microsoft.SignalRService/SignalR/clientConnection/*",
|                                                        "Microsoft.SignalRService/SignalR/user/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "daa9e50b-21df-454c-94a6-a8050adab352",
|                                    "Name":  "Collaborative Data Contributor",
|                                    "Description":  "Can manage data packages of a collaborative.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.IndustryDataLifecycle/custodianCollaboratives/*/read",
|                                                    "Microsoft.IndustryDataLifecycle/memberCollaboratives/*/read",
|                                                    "Microsoft.IndustryDataLifecycle/locations/dataPackages/*",
|                                                    "Microsoft.IndustryDataLifecycle/custodianCollaboratives/receivedDataPackages/*",
|                                                    "Microsoft.IndustryDataLifecycle/custodianCollaboratives/rejectDataPackage/action",
|                                                    "Microsoft.IndustryDataLifecycle/memberCollaboratives/sharedDataPackages/*",
|                                                    "Microsoft.IndustryDataLifecycle/custodianCollaboratives/dataModels/*",
|                                                    "Microsoft.IndustryDataLifecycle/custodianCollaboratives/auditLogs/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e9dba6fb-3d52-4cf0-bce3-f06ce71b9e0f",
|                                    "Name":  "Device Update Reader",
|                                    "Description":  "Gives you read access to management and content operations, but does not allow making changes",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.DeviceUpdate/accounts/read",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/read",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "02ca0879-e8e4-47a5-a61e-5c618b76e64a",
|                                    "Name":  "Device Update Administrator",
|                                    "Description":  "Gives you full access to management and content operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.DeviceUpdate/accounts/read",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/read",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/write",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/delete",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/read",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/write",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0378884a-3af5-44ab-8323-f5b22f9f3c98",
|                                    "Name":  "Device Update Content Administrator",
|                                    "Description":  "Gives you full access to content operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.DeviceUpdate/accounts/read",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/read",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/write",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d1ee9a80-8b14-47f0-bdc2-f4a351625a7b",
|                                    "Name":  "Device Update Content Reader",
|                                    "Description":  "Gives you read access to content operations, but does not allow making changes",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.DeviceUpdate/accounts/read",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cb43c632-a144-4ec5-977c-e80c4affc34a",
|                                    "Name":  "Cognitive Services Metrics Advisor Administrator",
|                                    "Description":  "Full access to the project, including the system level configuration.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/MetricsAdvisor/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3b20f47b-3825-43cb-8114-4bd2201156a8",
|                                    "Name":  "Cognitive Services Metrics Advisor User",
|                                    "Description":  "Access to the project.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/MetricsAdvisor/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2c56ea50-c6b3-40a6-83c0-9d98858bc7d2",
|                                    "Name":  "Schema Registry Reader",
|                                    "Description":  "Read and list Schema Registry groups and schemas.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EventHub/namespaces/schemagroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventHub/namespaces/schemas/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5dffeca3-4936-4216-b2bc-10343a5abb25",
|                                    "Name":  "Schema Registry Contributor",
|                                    "Description":  "Read, write, and delete Schema Registry groups and schemas.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EventHub/namespaces/schemagroups/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventHub/namespaces/schemas/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7ec7ccdc-f61e-41fe-9aaf-980df0a44eba",
|                                    "Name":  "AgFood Platform Service Reader",
|                                    "Description":  "Provides read access to AgFood Platform Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/*/list/action",
|                                                        "Microsoft.AgFoodPlatform/*/read",
|                                                        "Microsoft.AgFoodPlatform/*/search/action",
|                                                        "Microsoft.AgFoodPlatform/*/download/action",
|                                                        "Microsoft.AgFoodPlatform/*/overlap/action",
|                                                        "Microsoft.AgFoodPlatform/*/checkConsent/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8508508a-4469-4e45-963b-2518ee0bb728",
|                                    "Name":  "AgFood Platform Service Contributor",
|                                    "Description":  "Provides contribute access to AgFood Platform Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/*/action",
|                                                        "Microsoft.AgFoodPlatform/*/read",
|                                                        "Microsoft.AgFoodPlatform/*/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f8da80de-1ff9-4747-ad80-a19b7f6079e3",
|                                    "Name":  "AgFood Platform Service Admin",
|                                    "Description":  "Provides admin access to AgFood Platform Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "18500a29-7fe2-46b2-a342-b16a415e101d",
|                                    "Name":  "Managed HSM contributor",
|                                    "Description":  "Lets you manage managed HSM pools, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.KeyVault/managedHSMs/*",
|                                                    "Microsoft.KeyVault/deletedManagedHsms/read",
|                                                    "Microsoft.KeyVault/locations/deletedManagedHsms/read",
|                                                    "Microsoft.KeyVault/locations/deletedManagedHsms/purge/action",
|                                                    "Microsoft.KeyVault/locations/managedHsmOperationResults/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0b555d9b-b4a7-4f43-b330-627f0e5be8f0",
|                                    "Name":  "Security Detonation Chamber Submitter",
|                                    "Description":  "Allowed to create submissions to Security Detonation Chamber",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/delete",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/write",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/files/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/accesskeyview/read",
|                                                        "Microsoft.SecurityDetonation/chambers/platforms/metadata/read",
|                                                        "Microsoft.SecurityDetonation/chambers/workflows/metadata/read",
|                                                        "Microsoft.SecurityDetonation/chambers/toolsets/metadata/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ddde6b66-c0df-4114-a159-3618637b3035",
|                                    "Name":  "SignalR REST API Reader",
|                                    "Description":  "Read-only access to Azure SignalR Service REST APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SignalRService/SignalR/group/read",
|                                                        "Microsoft.SignalRService/SignalR/clientConnection/read",
|                                                        "Microsoft.SignalRService/SignalR/user/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7e4f1700-ea5a-4f59-8f37-079cfe29dce3",
|                                    "Name":  "SignalR Service Owner",
|                                    "Description":  "Full access to Azure SignalR Service REST APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SignalRService/SignalR/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f7b75c60-3036-4b75-91c3-6b41c27c1689",
|                                    "Name":  "Reservation Purchaser",
|                                    "Description":  "Lets you purchase reservations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Capacity/catalogs/read",
|                                                    "Microsoft.Capacity/register/action",
|                                                    "Microsoft.Compute/register/action",
|                                                    "Microsoft.Consumption/register/action",
|                                                    "Microsoft.Consumption/reservationRecommendationDetails/read",
|                                                    "Microsoft.Consumption/reservationRecommendations/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.SQL/register/action",
|                                                    "Microsoft.Support/supporttickets/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "635dd51f-9968-44d3-b7fb-6d9a6bd613ae",
|                                    "Name":  "AzureML Metrics Writer (preview)",
|                                    "Description":  "Lets you write metrics to AzureML workspace",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/metrics/*/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1",
|                                    "Name":  "Storage Account Backup Contributor",
|                                    "Description":  "Lets you perform backup and restore operations using Azure Backup on the storage account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/locks/read",
|                                                    "Microsoft.Authorization/locks/write",
|                                                    "Microsoft.Authorization/locks/delete",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/operations/read",
|                                                    "Microsoft.Storage/storageAccounts/objectReplicationPolicies/delete",
|                                                    "Microsoft.Storage/storageAccounts/objectReplicationPolicies/read",
|                                                    "Microsoft.Storage/storageAccounts/objectReplicationPolicies/write",
|                                                    "Microsoft.Storage/storageAccounts/objectReplicationPolicies/restorePointMarkers/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/restoreBlobRanges/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6188b7c9-7d01-4f99-a59f-c88b630326c0",
|                                    "Name":  "Experimentation Metric Contributor",
|                                    "Description":  "Allows for creation, writes and reads to the metric set via the metrics service APIs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/metricwrite/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/metricwrite/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9ef4ef9c-a049-46b0-82ab-dd8ac094c889",
|                                    "Name":  "Project Babylon Data Curator",
|                                    "Description":  "The Microsoft.ProjectBabylon data curator can create, read, modify and delete catalog data objects and establish relationships between objects. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ProjectBabylon/accounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ProjectBabylon/accounts/data/read",
|                                                        "Microsoft.ProjectBabylon/accounts/data/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c8d896ba-346d-4f50-bc1d-7d1c84130446",
|                                    "Name":  "Project Babylon Data Reader",
|                                    "Description":  "The Microsoft.ProjectBabylon data reader can read catalog data objects. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ProjectBabylon/accounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ProjectBabylon/accounts/data/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "05b7651b-dc44-475e-b74d-df3db49fae0f",
|                                    "Name":  "Project Babylon Data Source Administrator",
|                                    "Description":  "The Microsoft.ProjectBabylon data source administrator can manage data sources and data scans. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ProjectBabylon/accounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ProjectBabylon/accounts/scan/read",
|                                                        "Microsoft.ProjectBabylon/accounts/scan/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ca6382a4-1721-4bcf-a114-ff0c70227b6b",
|                                    "Name":  "Application Group Contributor",
|                                    "Description":  "Contributor of the Application Group.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/applicationgroups/*",
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                    "Microsoft.DesktopVirtualization/workspaces/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "49a72310-ab8d-41df-bbb0-79b649203868",
|                                    "Name":  "Desktop Virtualization Reader",
|                                    "Description":  "Reader of Desktop Virtualization.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "082f0a83-3be5-4ba1-904c-961cca79b387",
|                                    "Name":  "Desktop Virtualization Contributor",
|                                    "Description":  "Contributor of Desktop Virtualization.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "21efdde3-836f-432b-bf3d-3e8e734d4b2b",
|                                    "Name":  "Desktop Virtualization Workspace Contributor",
|                                    "Description":  "Contributor of the Desktop Virtualization Workspace.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/workspaces/*",
|                                                    "Microsoft.DesktopVirtualization/applicationgroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ea4bfff8-7fb4-485a-aadd-d4129a0ffaa6",
|                                    "Name":  "Desktop Virtualization User Session Operator",
|                                    "Description":  "Operator of the Desktop Virtualization User Session.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2ad6aaab-ead9-4eaa-8ac5-da422f562408",
|                                    "Name":  "Desktop Virtualization Session Host Operator",
|                                    "Description":  "Operator of the Desktop Virtualization Session Host.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ceadfde2-b300-400a-ab7b-6143895aa822",
|                                    "Name":  "Desktop Virtualization Host Pool Reader",
|                                    "Description":  "Reader of the Desktop Virtualization Host Pool.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/hostpools/*/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e307426c-f9b6-4e81-87de-d99efb3c32bc",
|                                    "Name":  "Desktop Virtualization Host Pool Contributor",
|                                    "Description":  "Contributor of the Desktop Virtualization Host Pool.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/hostpools/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "aebf23d0-b568-4e86-b8f9-fe83a2c6ab55",
|                                    "Name":  "Desktop Virtualization Application Group Reader",
|                                    "Description":  "Reader of the Desktop Virtualization Application Group.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/applicationgroups/*/read",
|                                                    "Microsoft.DesktopVirtualization/applicationgroups/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "86240b0e-9422-4c43-887b-b61143f32ba8",
|                                    "Name":  "Desktop Virtualization Application Group Contributor",
|                                    "Description":  "Contributor of the Desktop Virtualization Application Group.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/applicationgroups/*",
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0fa44ee9-7a7d-466b-9bb2-2bf446b1204d",
|                                    "Name":  "Desktop Virtualization Workspace Reader",
|                                    "Description":  "Reader of the Desktop Virtualization Workspace.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/workspaces/read",
|                                                    "Microsoft.DesktopVirtualization/applicationgroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3e5e47e6-65f7-47ef-90b5-e5dd4d455f24",
|                                    "Name":  "Disk Backup Reader",
|                                    "Description":  "Provides permission to backup vault to perform disk backup.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b50d9833-a0cb-478e-945f-707fcc997c13",
|                                    "Name":  "Disk Restore Operator",
|                                    "Description":  "Provides permission to backup vault to perform disk restore.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action",
|                                                    "Microsoft.Compute/disks/endGetAccess/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7efff54f-a5b4-42b5-a1c5-5411624893ce",
|                                    "Name":  "Disk Snapshot Contributor",
|                                    "Description":  "Provides permission to backup vault to manage disk snapshots.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Compute/snapshots/delete",
|                                                    "Microsoft.Compute/snapshots/write",
|                                                    "Microsoft.Compute/snapshots/read",
|                                                    "Microsoft.Compute/snapshots/beginGetAccess/action",
|                                                    "Microsoft.Compute/snapshots/endGetAccess/action",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action",
|                                                    "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5548b2cf-c94c-4228-90ba-30851930a12f",
|                                    "Name":  "Microsoft.Kubernetes connected cluster role",
|                                    "Description":  "Microsoft.Kubernetes connected cluster role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Kubernetes/connectedClusters/read",
|                                                    "Microsoft.Kubernetes/connectedClusters/write",
|                                                    "Microsoft.Kubernetes/connectedClusters/delete",
|                                                    "Microsoft.Kubernetes/registeredSubscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a37b566d-3efa-4beb-a2f2-698963fa42ce",
|                                    "Name":  "Security Detonation Chamber Submission Manager",
|                                    "Description":  "Allowed to create and manage submissions to Security Detonation Chamber",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/delete",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/write",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/files/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/accesskeyview/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/adminview/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/analystview/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/publicview/read",
|                                                        "Microsoft.SecurityDetonation/chambers/platforms/metadata/read",
|                                                        "Microsoft.SecurityDetonation/chambers/workflows/metadata/read",
|                                                        "Microsoft.SecurityDetonation/chambers/toolsets/metadata/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "352470b3-6a9c-4686-b503-35deb827e500",
|                                    "Name":  "Security Detonation Chamber Publisher",
|                                    "Description":  "Allowed to publish and modify platforms, workflows and toolsets to Security Detonation Chamber",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SecurityDetonation/chambers/platforms/read",
|                                                        "Microsoft.SecurityDetonation/chambers/platforms/write",
|                                                        "Microsoft.SecurityDetonation/chambers/platforms/delete",
|                                                        "Microsoft.SecurityDetonation/chambers/platforms/metadata/read",
|                                                        "Microsoft.SecurityDetonation/chambers/workflows/read",
|                                                        "Microsoft.SecurityDetonation/chambers/workflows/write",
|                                                        "Microsoft.SecurityDetonation/chambers/workflows/delete",
|                                                        "Microsoft.SecurityDetonation/chambers/workflows/metadata/read",
|                                                        "Microsoft.SecurityDetonation/chambers/toolsets/read",
|                                                        "Microsoft.SecurityDetonation/chambers/toolsets/write",
|                                                        "Microsoft.SecurityDetonation/chambers/toolsets/delete",
|                                                        "Microsoft.SecurityDetonation/chambers/toolsets/metadata/read",
|                                                        "Microsoft.SecurityDetonation/chambers/publishRequests/read",
|                                                        "Microsoft.SecurityDetonation/chambers/publishRequests/cancel/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7a6f0e70-c033-4fb1-828c-08514e5f4102",
|                                    "Name":  "Collaborative Runtime Operator",
|                                    "Description":  "Can manage resources created by AICS at runtime",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.IndustryDataLifecycle/derivedModels/*",
|                                                    "Microsoft.IndustryDataLifecycle/pipelineSets/*",
|                                                    "Microsoft.IndustryDataLifecycle/modelMappings/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5432c526-bc82-444a-b7ba-57c5b0b5b34f",
|                                    "Name":  "CosmosRestoreOperator",
|                                    "Description":  "Can perform restore action for Cosmos DB database account with continuous backup mode",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDB/locations/restorableDatabaseAccounts/restore/action",
|                                                    "Microsoft.DocumentDB/locations/restorableDatabaseAccounts/*/read",
|                                                    "Microsoft.DocumentDB/locations/restorableDatabaseAccounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a1705bd2-3a8f-45a5-8683-466fcfd5cc24",
|                                    "Name":  "FHIR Data Converter",
|                                    "Description":  "Role allows user or principal to convert data from legacy format to FHIR",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/convertData/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/convertData/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0e5f05e5-9ab9-446b-b98d-1e2157c94125",
|                                    "Name":  "Quota Request Operator",
|                                    "Description":  "Read and create quota requests, get quota request status, and create support tickets.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Capacity/resourceProviders/locations/serviceLimits/read",
|                                                    "Microsoft.Capacity/resourceProviders/locations/serviceLimits/write",
|                                                    "Microsoft.Capacity/resourceProviders/locations/serviceLimitsRequests/read",
|                                                    "Microsoft.Capacity/register/action",
|                                                    "Microsoft.Quota/usages/read",
|                                                    "Microsoft.Quota/quotas/read",
|                                                    "Microsoft.Quota/quotas/write",
|                                                    "Microsoft.Quota/quotaRequests/read",
|                                                    "Microsoft.Quota/register/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1e241071-0855-49ea-94dc-649edcd759de",
|                                    "Name":  "EventGrid Contributor",
|                                    "Description":  "Lets you manage EventGrid operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "28241645-39f8-410b-ad48-87863e2951d5",
|                                    "Name":  "Security Detonation Chamber Reader",
|                                    "Description":  "Allowed to query submission info and files from Security Detonation Chamber",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/files/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4a167cdf-cb95-4554-9203-2347fe489bd9",
|                                    "Name":  "Object Anchors Account Reader",
|                                    "Description":  "Lets you read ingestion jobs for an object anchors account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/ObjectAnchorsAccounts/ingest/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ca0835dd-bacc-42dd-8ed2-ed5e7230d15b",
|                                    "Name":  "Object Anchors Account Owner",
|                                    "Description":  "Provides user with ingestion capabilities for an object anchors account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/ObjectAnchorsAccounts/ingest/action",
|                                                        "Microsoft.MixedReality/ObjectAnchorsAccounts/ingest/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d17ce0a2-0697-43bc-aac5-9113337ab61c",
|                                    "Name":  "WorkloadBuilder Migration Agent Role",
|                                    "Description":  "WorkloadBuilder Migration Agent Role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.WorkloadBuilder/migrationAgents/Read",
|                                                    "Microsoft.WorkloadBuilder/migrationAgents/Write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b5537268-8956-4941-a8f0-646150406f0c",
|                                    "Name":  "Azure Spring Cloud Data Reader",
|                                    "Description":  "Allow read access to Azure Spring Cloud Data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0e75ca1e-0464-4b4d-8b93-68208a576181",
|                                    "Name":  "Cognitive Services Speech Contributor",
|                                    "Description":  "Full access to Speech projects, including read, write and delete all entities, for real-time speech recognition and batch transcription tasks, real-time speech synthesis and long audio tasks, custom speech and custom voice.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVoice/*",
|                                                        "Microsoft.CognitiveServices/accounts/AudioContentCreation/*",
|                                                        "Microsoft.CognitiveServices/accounts/TTSPlayer/*",
|                                                        "Microsoft.CognitiveServices/accounts/VideoTranslation/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomAvatar/*",
|                                                        "Microsoft.CognitiveServices/accounts/BatchAvatar/*",
|                                                        "Microsoft.CognitiveServices/accounts/BatchTextToSpeech/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9894cab4-e18a-44aa-828b-cb588cd6f2d7",
|                                    "Name":  "Cognitive Services Face Recognizer",
|                                    "Description":  "Lets you perform detect, verify, identify, group, and find similar operations on Face API. This role does not allow create or delete operations, which makes it well suited for endpoints that only need inferencing capabilities, following \u0027least privilege\u0027 best practices.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/Face/detect/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/verify/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/identify/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/group/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/findsimilars/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/detectliveness/multimodal/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/detectliveness/singlemodal/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/detectlivenesswithverify/singlemodal/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/*/sessions/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/*/sessions/delete",
|                                                        "Microsoft.CognitiveServices/accounts/Face/*/sessions/read",
|                                                        "Microsoft.CognitiveServices/accounts/Face/*/sessions/audit/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1ec5b3c1-b17e-4e25-8312-2acb3c3c5abf",
|                                    "Name":  "Stream Analytics Query Tester",
|                                    "Description":  "Lets you perform query testing without creating a stream analytics job first",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.StreamAnalytics/locations/TestQuery/action",
|                                                    "Microsoft.StreamAnalytics/locations/OperationResults/read",
|                                                    "Microsoft.StreamAnalytics/locations/SampleInput/action",
|                                                    "Microsoft.StreamAnalytics/locations/CompileQuery/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a2138dac-4907-4679-a376-736901ed8ad8",
|                                    "Name":  "AnyBuild Builder",
|                                    "Description":  "Basic user role for AnyBuild. This role allows listing of agent information and execution of remote build capabilities.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AnyBuild/clusters/build/write",
|                                                        "Microsoft.AnyBuild/clusters/build/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b447c946-2db7-41ec-983d-d8bf3b1c77e3",
|                                    "Name":  "IoT Hub Data Reader",
|                                    "Description":  "Allows for full read access to IoT Hub data-plane properties",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Devices/IotHubs/*/read",
|                                                        "Microsoft.Devices/IotHubs/fileUpload/notifications/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "494bdba2-168f-4f31-a0a1-191d2f7c028c",
|                                    "Name":  "IoT Hub Twin Contributor",
|                                    "Description":  "Allows for read and write access to all IoT Hub device and module twins.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Devices/IotHubs/twins/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4ea46cd5-c1b2-4a8e-910b-273211f9ce47",
|                                    "Name":  "IoT Hub Registry Contributor",
|                                    "Description":  "Allows for full access to IoT Hub device registry.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Devices/IotHubs/devices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4fc6c259-987e-4a07-842e-c321cc9d413f",
|                                    "Name":  "IoT Hub Data Contributor",
|                                    "Description":  "Allows for full access to IoT Hub data plane operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Devices/IotHubs/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "15e0f5a1-3450-4248-8e25-e2afe88a9e85",
|                                    "Name":  "Test Base Reader",
|                                    "Description":  "Let you view and download packages and test results.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.TestBase/testBaseAccounts/packages/testResults/getDownloadUrl/action",
|                                                    "Microsoft.TestBase/testBaseAccounts/packages/testResults/getVideoDownloadUrl/action",
|                                                    "Microsoft.TestBase/testBaseAccounts/packages/getDownloadUrl/action",
|                                                    "Microsoft.TestBase/*/read",
|                                                    "Microsoft.TestBase/testBaseAccounts/customerEvents/write",
|                                                    "Microsoft.TestBase/testBaseAccounts/customerEvents/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1407120a-92aa-4202-b7e9-c0e197c71c8f",
|                                    "Name":  "Search Index Data Reader",
|                                    "Description":  "Grants read access to Azure Cognitive Search index data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Search/searchServices/indexes/documents/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8ebe5a00-799e-43f5-93ac-243d3dce84a7",
|                                    "Name":  "Search Index Data Contributor",
|                                    "Description":  "Grants full access to Azure Cognitive Search index data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Search/searchServices/indexes/documents/*",
|                                                        "Microsoft.Search/searchServices/indexes/contentSecurity/elevatedOperations/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "76199698-9eea-4c19-bc75-cec21354c6b6",
|                                    "Name":  "Storage Table Data Reader",
|                                    "Description":  "Allows for read access to Azure Storage tables and entities",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/tableServices/tables/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/tableServices/tables/entities/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3",
|                                    "Name":  "Storage Table Data Contributor",
|                                    "Description":  "Allows for read, write and delete access to Azure Storage tables and entities",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/tableServices/tables/read",
|                                                    "Microsoft.Storage/storageAccounts/tableServices/tables/write",
|                                                    "Microsoft.Storage/storageAccounts/tableServices/tables/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/tableServices/tables/entities/read",
|                                                        "Microsoft.Storage/storageAccounts/tableServices/tables/entities/write",
|                                                        "Microsoft.Storage/storageAccounts/tableServices/tables/entities/delete",
|                                                        "Microsoft.Storage/storageAccounts/tableServices/tables/entities/add/action",
|                                                        "Microsoft.Storage/storageAccounts/tableServices/tables/entities/update/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e89c7a3c-2f64-4fa1-a847-3e4c9ba4283a",
|                                    "Name":  "DICOM Data Reader",
|                                    "Description":  "Read and search DICOM data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/workspaces/dicomservices/resources/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "58a3b984-7adf-4c20-983a-32417c86fbc8",
|                                    "Name":  "DICOM Data Owner",
|                                    "Description":  "Full access to DICOM data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/workspaces/dicomservices/resources/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d5a91429-5739-47e2-a06b-3470a27159e7",
|                                    "Name":  "EventGrid Data Sender",
|                                    "Description":  "Allows send access to event grid events.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/topics/read",
|                                                    "Microsoft.EventGrid/domains/read",
|                                                    "Microsoft.EventGrid/partnerNamespaces/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.EventGrid/namespaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventGrid/events/send/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "60fc6e62-5479-42d4-8bf4-67625fcc2840",
|                                    "Name":  "Disk Pool Operator",
|                                    "Description":  "Used by the StoragePool Resource Provider to manage Disks added to a Disk Pool.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f6c7c914-8db3-469d-8ca1-694a8f32e121",
|                                    "Name":  "AzureML Data Scientist",
|                                    "Description":  "Can perform all actions within an Azure Machine Learning workspace, except for creating or deleting compute resources and modifying the workspace itself.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/*/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/*/action",
|                                                    "Microsoft.MachineLearningServices/workspaces/*/delete",
|                                                    "Microsoft.MachineLearningServices/workspaces/*/write"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.MachineLearningServices/workspaces/delete",
|                                                       "Microsoft.MachineLearningServices/workspaces/write",
|                                                       "Microsoft.MachineLearningServices/workspaces/computes/*/write",
|                                                       "Microsoft.MachineLearningServices/workspaces/computes/*/delete",
|                                                       "Microsoft.MachineLearningServices/workspaces/computes/listKeys/action",
|                                                       "Microsoft.MachineLearningServices/workspaces/listKeys/action",
|                                                       "Microsoft.MachineLearningServices/workspaces/hubs/write",
|                                                       "Microsoft.MachineLearningServices/workspaces/hubs/delete",
|                                                       "Microsoft.MachineLearningServices/workspaces/featurestores/write",
|                                                       "Microsoft.MachineLearningServices/workspaces/featurestores/delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "22926164-76b3-42b3-bc55-97df8dab3e41",
|                                    "Name":  "Grafana Admin",
|                                    "Description":  "Manage server-wide settings and manage access to resources such as organizations, users, and licenses.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Dashboard/grafana/ActAsGrafanaAdmin/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e8113dce-c529-4d33-91fa-e9b972617508",
|                                    "Name":  "Azure Connected SQL Server Onboarding",
|                                    "Description":  "Microsoft.AzureArcData service role to access the resources of Microsoft.AzureArcData stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureArcData/sqlServerInstances/read",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "26baccc8-eea7-41f1-98f4-1762cc7f685d",
|                                    "Name":  "Azure Relay Sender",
|                                    "Description":  "Allows for send access to Azure Relay resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Relay/*/wcfRelays/read",
|                                                    "Microsoft.Relay/*/hybridConnections/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Relay/*/send/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2787bf04-f1f5-4bfe-8383-c8a24483ee38",
|                                    "Name":  "Azure Relay Owner",
|                                    "Description":  "Allows for full access to Azure Relay resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Relay/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Relay/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "26e0b698-aa6d-4085-9386-aadae190014d",
|                                    "Name":  "Azure Relay Listener",
|                                    "Description":  "Allows for listen access to Azure Relay resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Relay/*/wcfRelays/read",
|                                                    "Microsoft.Relay/*/hybridConnections/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Relay/*/listen/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "60921a7e-fef1-4a43-9b16-a26c52ad4769",
|                                    "Name":  "Grafana Viewer",
|                                    "Description":  "View dashboards, playlists, and query data sources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Dashboard/grafana/ActAsGrafanaViewer/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a79a5197-3a5c-4973-a920-486035ffd60f",
|                                    "Name":  "Grafana Editor",
|                                    "Description":  "Create, edit, delete, or view dashboards; create, edit, or delete folders; and edit or view playlists.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Dashboard/grafana/ActAsGrafanaEditor/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f353d9bd-d4a6-484e-a77a-8050b599b867",
|                                    "Name":  "Automation Contributor",
|                                    "Description":  "Manage azure automation resources and other resources using azure automation.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Automation/automationAccounts/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/ActionGroups/*",
|                                                    "Microsoft.Insights/ActivityLogAlerts/*",
|                                                    "Microsoft.Insights/MetricAlerts/*",
|                                                    "Microsoft.Insights/ScheduledQueryRules/*",
|                                                    "Microsoft.Insights/diagnosticSettings/*",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "85cb6faf-e071-4c9b-8136-154b5a04f717",
|                                    "Name":  "Kubernetes Extension Contributor",
|                                    "Description":  "Can create, update, get, list and delete Kubernetes Extensions, and get extension async operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.KubernetesConfiguration/register/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "10745317-c249-44a1-a5ce-3a4353c0bbd8",
|                                    "Name":  "Device Provisioning Service Data Reader",
|                                    "Description":  "Allows for full read access to Device Provisioning Service data-plane properties.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Devices/provisioningServices/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dfce44e4-17b7-4bd1-a6d1-04996ec95633",
|                                    "Name":  "Device Provisioning Service Data Contributor",
|                                    "Description":  "Allows for full access to Device Provisioning Service data-plane operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Devices/provisioningServices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2837e146-70d7-4cfd-ad55-7efa6464f958",
|                                    "Name":  "Artifact Signing Certificate Profile Signer",
|                                    "Description":  "Sign files with a certificate profile.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CodeSigning/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CodeSigning/certificateProfiles/Sign/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cff1b556-2399-4e7e-856d-a8f754be7b65",
|                                    "Name":  "Azure Spring Cloud Service Registry Reader",
|                                    "Description":  "Allow read access to Azure Spring Cloud Service Registry",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/eurekaService/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f5880b48-c26d-48be-b172-7927bfa1c8f1",
|                                    "Name":  "Azure Spring Cloud Service Registry Contributor",
|                                    "Description":  "Allow read, write and delete access to Azure Spring Cloud Service Registry",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/eurekaService/read",
|                                                        "Microsoft.AppPlatform/Spring/eurekaService/write",
|                                                        "Microsoft.AppPlatform/Spring/eurekaService/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d04c6db6-4947-4782-9e91-30a88feb7be7",
|                                    "Name":  "Azure Spring Cloud Config Server Reader",
|                                    "Description":  "Allow read access to Azure Spring Cloud Config Server",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/configService/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a06f5c24-21a7-4e1a-aa2b-f19eb6684f5b",
|                                    "Name":  "Azure Spring Cloud Config Server Contributor",
|                                    "Description":  "Allow read, write and delete access to Azure Spring Cloud Config Server",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/configService/read",
|                                                        "Microsoft.AppPlatform/Spring/configService/write",
|                                                        "Microsoft.AppPlatform/Spring/configService/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6ae96244-5829-4925-a7d3-5975537d91dd",
|                                    "Name":  "Azure VM Managed identities restore Contributor",
|                                    "Description":  "Azure VM Managed identities restore Contributors are allowed to perform Azure VM Restores with managed identities both user and system",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6be48352-4f82-47c9-ad5e-0acacefdb005",
|                                    "Name":  "Azure Maps Search and Render Data Reader",
|                                    "Description":  "Grants access to very limited set of data APIs for common visual web SDK scenarios. Specifically, render and search data APIs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Maps/accounts/services/render/read",
|                                                        "Microsoft.Maps/accounts/services/search/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dba33070-676a-4fb0-87fa-064dc56ff7fb",
|                                    "Name":  "Azure Maps Contributor",
|                                    "Description":  "Grants access all Azure Maps resource management.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Maps/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b748a06d-6150-4f8a-aaa9-ce3940cd96cb",
|                                    "Name":  "Azure Arc VMware VM Contributor",
|                                    "Description":  "Arc VMware VM Contributor has permissions to perform all VM actions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ConnectedVMwarevSphere/virtualmachines/*",
|                                                    "Microsoft.ConnectedVMwarevSphere/virtualmachineinstances/*",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                    "Microsoft.HybridCompute/machines/installPatches/action",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                    "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/write",
|                                                    "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                    "Microsoft.HybridCompute/licenses/read",
|                                                    "Microsoft.HybridCompute/licenses/write",
|                                                    "Microsoft.HybridCompute/licenses/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ce551c02-7c42-47e0-9deb-e3b6fc3a9a83",
|                                    "Name":  "Azure Arc VMware Private Cloud User",
|                                    "Description":  "Azure Arc VMware Private Cloud User has permissions to use the VMware cloud resources to deploy VMs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ConnectedVMwarevSphere/virtualnetworks/join/action",
|                                                    "Microsoft.ConnectedVMwarevSphere/virtualnetworks/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/virtualmachinetemplates/clone/action",
|                                                    "Microsoft.ConnectedVMwarevSphere/virtualmachinetemplates/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/resourcepools/deploy/action",
|                                                    "Microsoft.ConnectedVMwarevSphere/resourcepools/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/hosts/deploy/action",
|                                                    "Microsoft.ConnectedVMwarevSphere/hosts/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/clusters/deploy/action",
|                                                    "Microsoft.ConnectedVMwarevSphere/clusters/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/datastores/allocateSpace/action",
|                                                    "Microsoft.ConnectedVMwarevSphere/datastores/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ddc140ed-e463-4246-9145-7c664192013f",
|                                    "Name":  "Azure Arc VMware Administrator role ",
|                                    "Description":  "Arc VMware VM Contributor has permissions to perform all connected VMwarevSphere actions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ConnectedVMwarevSphere/*",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                    "Microsoft.HybridCompute/machines/installPatches/action",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                    "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/write",
|                                                    "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                    "Microsoft.HybridCompute/licenses/read",
|                                                    "Microsoft.HybridCompute/licenses/write",
|                                                    "Microsoft.HybridCompute/licenses/delete",
|                                                    "Microsoft.ExtendedLocation/customLocations/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f72c8140-2111-481c-87ff-72b910f6e3f8",
|                                    "Name":  "Cognitive Services LUIS Owner",
|                                    "Description":  " Has access to all Read, Test, Write, Deploy and Delete functions under LUIS",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/LUIS/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7628b7b8-a8b2-4cdc-b46f-e9b35248918e",
|                                    "Name":  "Cognitive Services Language Reader",
|                                    "Description":  "Has access to Read and Test functions under Language portal",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/LanguageAuthoring/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/projects/export/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/Language/*/projects/export/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/query-text/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/query-dataverse/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/analyze-text/jobs/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/analyze-text/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/analyze-text/jobscancel/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/analyze-conversations/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/analyze-conversations/jobscancel/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/analyze-conversations/jobs/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/query-knowledgebases/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/generate/action",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f2310ca1-dc64-4889-bb49-c8e0fa3d47a8",
|                                    "Name":  "Cognitive Services Language Writer",
|                                    "Description":  " Has access to all Read, Test, and Write functions under Language Portal",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/LanguageAuthoring/*",
|                                                        "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/*",
|                                                        "Microsoft.CognitiveServices/accounts/Language/*",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f07febfe-79bc-46b1-8b37-790e26e6e498",
|                                    "Name":  "Cognitive Services Language Owner",
|                                    "Description":  "Has access to all Read, Test, Write, Deploy and Delete functions under Language portal",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/LanguageAuthoring/*",
|                                                        "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/*",
|                                                        "Microsoft.CognitiveServices/accounts/Language/*",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "18e81cdc-4e98-4e29-a639-e7d10c5a6226",
|                                    "Name":  "Cognitive Services LUIS Reader",
|                                    "Description":  "Has access to Read and Test functions under LUIS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/LUIS/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/LUIS/apps/testdatasets/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6322a993-d5c9-4bed-b113-e49bbea25b27",
|                                    "Name":  "Cognitive Services LUIS Writer",
|                                    "Description":  "Has access to all Read, Test, and Write functions under LUIS",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/LUIS/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a9a19cc5-31f4-447c-901f-56c0bb18fcaf",
|                                    "Name":  "PlayFab Reader",
|                                    "Description":  "Provides read access to PlayFab resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.PlayFab/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "749a398d-560b-491b-bb21-08924219302e",
|                                    "Name":  "Load Test Contributor",
|                                    "Description":  "View, create, update, delete and execute load tests. View and list load test resources but can not make any changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.LoadTestService/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.LoadTestService/PlaywrightWorkspaces/*",
|                                                       "Microsoft.LoadTestService/locations/PlaywrightQuotas/*"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.LoadTestService/loadtests/*",
|                                                        "Microsoft.LoadTestService/testProfiles/*",
|                                                        "Microsoft.LoadTestService/testProfileRuns/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "45bb0b16-2f0c-4e78-afaa-a07599b003f6",
|                                    "Name":  "Load Test Owner",
|                                    "Description":  "Execute all operations on load test resources and load tests",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.LoadTestService/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.LoadTestService/PlaywrightWorkspaces/*",
|                                                       "Microsoft.LoadTestService/locations/PlaywrightQuotas/*"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.LoadTestService/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0c8b84dc-067c-4039-9615-fa1a4b77c726",
|                                    "Name":  "PlayFab Contributor",
|                                    "Description":  "Provides contributor access to PlayFab resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.PlayFab/*/read",
|                                                    "Microsoft.PlayFab/*/write",
|                                                    "Microsoft.PlayFab/*/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3ae3fb29-0000-4ccd-bf80-542e7b26e081",
|                                    "Name":  "Load Test Reader",
|                                    "Description":  "View and list all load tests and load test resources but can not make any changes",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.LoadTestService/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.LoadTestService/PlaywrightWorkspaces/*",
|                                                       "Microsoft.LoadTestService/locations/PlaywrightQuotas/*"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.LoadTestService/loadtests/readTest/action",
|                                                        "Microsoft.LoadTestService/testProfiles/read",
|                                                        "Microsoft.LoadTestService/testProfileRuns/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b2de6794-95db-4659-8781-7e080d3f2b9d",
|                                    "Name":  "Cognitive Services Immersive Reader User",
|                                    "Description":  "Provides access to create Immersive Reader sessions and call APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/ImmersiveReader/getcontentmodelforreader/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f69b8690-cc87-41d6-b77a-a4bc3c0a966f",
|                                    "Name":  "Lab Services Contributor",
|                                    "Description":  "The lab services contributor role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.LabServices/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.LabServices/labPlans/createLab/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2a5c394f-5eb7-4d4f-9c8e-e8eae39faebc",
|                                    "Name":  "Lab Services Reader",
|                                    "Description":  "The lab services reader role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.LabServices/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ce40b423-cede-4313-a93f-9b28290b72e1",
|                                    "Name":  "Lab Assistant",
|                                    "Description":  "The lab assistant role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.LabServices/labPlans/images/read",
|                                                    "Microsoft.LabServices/labPlans/read",
|                                                    "Microsoft.LabServices/labs/read",
|                                                    "Microsoft.LabServices/labs/schedules/read",
|                                                    "Microsoft.LabServices/labs/users/read",
|                                                    "Microsoft.LabServices/labs/users/invite/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/read",
|                                                    "Microsoft.LabServices/labs/virtualMachines/start/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/stop/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/reimage/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/redeploy/action",
|                                                    "Microsoft.LabServices/locations/usages/read",
|                                                    "Microsoft.LabServices/skus/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a36e6959-b6be-4b12-8e9f-ef4b474d304d",
|                                    "Name":  "Lab Operator",
|                                    "Description":  "The lab operator role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.LabServices/labPlans/images/read",
|                                                    "Microsoft.LabServices/labPlans/read",
|                                                    "Microsoft.LabServices/labPlans/saveImage/action",
|                                                    "Microsoft.LabServices/labs/publish/action",
|                                                    "Microsoft.LabServices/labs/read",
|                                                    "Microsoft.LabServices/labs/schedules/read",
|                                                    "Microsoft.LabServices/labs/schedules/write",
|                                                    "Microsoft.LabServices/labs/schedules/delete",
|                                                    "Microsoft.LabServices/labs/users/read",
|                                                    "Microsoft.LabServices/labs/users/write",
|                                                    "Microsoft.LabServices/labs/users/delete",
|                                                    "Microsoft.LabServices/labs/users/invite/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/read",
|                                                    "Microsoft.LabServices/labs/virtualMachines/start/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/stop/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/reimage/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/redeploy/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/resetPassword/action",
|                                                    "Microsoft.LabServices/locations/usages/read",
|                                                    "Microsoft.LabServices/skus/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5daaa2af-1fe8-407c-9122-bba179798270",
|                                    "Name":  "Lab Contributor",
|                                    "Description":  "The lab contributor role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.LabServices/labPlans/images/read",
|                                                    "Microsoft.LabServices/labPlans/read",
|                                                    "Microsoft.LabServices/labPlans/saveImage/action",
|                                                    "Microsoft.LabServices/labs/read",
|                                                    "Microsoft.LabServices/labs/write",
|                                                    "Microsoft.LabServices/labs/delete",
|                                                    "Microsoft.LabServices/labs/publish/action",
|                                                    "Microsoft.LabServices/labs/syncGroup/action",
|                                                    "Microsoft.LabServices/labs/schedules/read",
|                                                    "Microsoft.LabServices/labs/schedules/write",
|                                                    "Microsoft.LabServices/labs/schedules/delete",
|                                                    "Microsoft.LabServices/labs/users/read",
|                                                    "Microsoft.LabServices/labs/users/write",
|                                                    "Microsoft.LabServices/labs/users/delete",
|                                                    "Microsoft.LabServices/labs/users/invite/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/read",
|                                                    "Microsoft.LabServices/labs/virtualMachines/start/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/stop/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/reimage/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/redeploy/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/resetPassword/action",
|                                                    "Microsoft.LabServices/locations/usages/read",
|                                                    "Microsoft.LabServices/skus/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.LabServices/labPlans/createLab/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fb1c8493-542b-48eb-b624-b4c8fea62acd",
|                                    "Name":  "Security Admin",
|                                    "Description":  "Security Admin Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/policyAssignments/*",
|                                                    "Microsoft.Authorization/policyDefinitions/*",
|                                                    "Microsoft.Authorization/policyExemptions/*",
|                                                    "Microsoft.Authorization/policySetDefinitions/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.operationalInsights/workspaces/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Security/*",
|                                                    "Microsoft.IoTSecurity/*",
|                                                    "Microsoft.IoTFirmwareDefense/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "12cf5a90-567b-43ae-8102-96cf46c7d9b4",
|                                    "Name":  "Web PubSub Service Owner",
|                                    "Description":  "Full access to Azure Web PubSub Service REST APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SignalRService/WebPubSub/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bfb1c7d2-fb1a-466b-b2ba-aee63b92deaf",
|                                    "Name":  "Web PubSub Service Reader",
|                                    "Description":  "Read-only access to Azure Web PubSub Service REST APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SignalRService/WebPubSub/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "420fcaa2-552c-430f-98ca-3264be4806c7",
|                                    "Name":  "SignalR App Server",
|                                    "Description":  "Lets your app server access SignalR Service with AAD auth options.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SignalRService/SignalR/auth/accessKey/action",
|                                                        "Microsoft.SignalRService/SignalR/serverConnection/write",
|                                                        "Microsoft.SignalRService/SignalR/clientConnection/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fb879df8-f326-4884-b1cf-06f3ad86be52",
|                                    "Name":  "Virtual Machine User Login",
|                                    "Description":  "View Virtual Machines in the portal and login as a regular user.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Compute/virtualMachines/*/read",
|                                                    "Microsoft.HybridCompute/machines/*/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Compute/virtualMachines/login/action",
|                                                        "Microsoft.HybridCompute/machines/login/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1c0163c0-47e6-4577-8991-ea5c82e286e4",
|                                    "Name":  "Virtual Machine Administrator Login",
|                                    "Description":  "View Virtual Machines in the portal and login as administrator",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Compute/virtualMachines/*/read",
|                                                    "Microsoft.HybridCompute/machines/*/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Compute/virtualMachines/login/action",
|                                                        "Microsoft.Compute/virtualMachines/loginAsAdmin/action",
|                                                        "Microsoft.HybridCompute/machines/login/action",
|                                                        "Microsoft.HybridCompute/machines/loginAsAdmin/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cd570a14-e51a-42ad-bac8-bafd67325302",
|                                    "Name":  "Azure Connected Machine Resource Administrator",
|                                    "Description":  "Can read, write, delete and re-onboard Azure Connected Machines.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/machines/*",
|                                                    "Microsoft.HybridCompute/machines/extensions/*",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/*",
|                                                    "Microsoft.HybridCompute/machines/runCommands/*",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/settings/*",
|                                                    "Microsoft.HybridCompute/gateways/*",
|                                                    "Microsoft.HybridCompute/privateLinkScopes/*",
|                                                    "Microsoft.HybridCompute/licenses/*",
|                                                    "Microsoft.HybridCompute/locations/*",
|                                                    "Microsoft.HybridCompute/*/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "00c29273-979b-4161-815c-10b084fb9324",
|                                    "Name":  "Backup Operator",
|                                    "Description":  "Lets you manage backup services, except removal of backup, vault creation and giving access to others",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/backup/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationsStatus/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/provisionInstantItemRecovery/action",
|                                                    "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/accessToken/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/restore/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/revokeInstantItemRecovery/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/refreshContainers/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupJobs/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupJobsExport/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupOperationResults/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectableItems/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectedItems/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectionContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read",
|                                                    "Microsoft.RecoveryServices/Vaults/certificates/write",
|                                                    "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                    "Microsoft.RecoveryServices/Vaults/extendedInformation/write",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*",
|                                                    "Microsoft.RecoveryServices/Vaults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/write",
|                                                    "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupstorageconfig/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupValidateOperation/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupTriggerValidateOperation/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupValidateOperationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupValidateOperationsStatuses/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupOperations/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/operations/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/write",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/inquire/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupEngines/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/write",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectableContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/items/read",
|                                                    "Microsoft.RecoveryServices/locations/backupStatus/action",
|                                                    "Microsoft.RecoveryServices/locations/backupPreValidateProtection/action",
|                                                    "Microsoft.RecoveryServices/locations/backupValidateFeatures/action",
|                                                    "Microsoft.RecoveryServices/locations/backupAadProperties/read",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrJobs/action",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrJob/action",
|                                                    "Microsoft.RecoveryServices/locations/backupCrossRegionRestore/action",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrOperationResults/read",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrOperationsStatus/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/write",
|                                                    "Microsoft.RecoveryServices/operations/read",
|                                                    "Microsoft.RecoveryServices/locations/operationStatus/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/write",
|                                                    "Microsoft.DataProtection/backupVaults/deletedBackupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/backupVaults/operationResults/read",
|                                                    "Microsoft.DataProtection/backupVaults/operationStatus/read",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/locations/operationStatus/read",
|                                                    "Microsoft.DataProtection/locations/operationResults/read",
|                                                    "Microsoft.DataProtection/operations/read",
|                                                    "Microsoft.DataProtection/backupVaults/validateForBackup/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/backup/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/validateRestore/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/restore/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/crossRegionRestore/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/validateCrossRegionRestore/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action",
|                                                    "Microsoft.DataProtection/locations/checkFeatureSupport/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/delete",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/unlockDelete/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/write",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/write",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/delete",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/unlockDelete/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/validateForModifyBackup/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e8ddcd69-c73f-4f9f-9844-4100522f16ad",
|                                    "Name":  "Workbook Contributor",
|                                    "Description":  "Can save shared workbooks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/workbooks/write",
|                                                    "Microsoft.Insights/workbooks/delete",
|                                                    "Microsoft.Insights/workbooks/read",
|                                                    "Microsoft.Insights/workbooks/revisions/read",
|                                                    "Microsoft.Insights/workbooktemplates/write",
|                                                    "Microsoft.Insights/workbooktemplates/delete",
|                                                    "Microsoft.Insights/workbooktemplates/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b279062a-9be3-42a0-92ae-8b3cf002ec4d",
|                                    "Name":  "Workbook Reader",
|                                    "Description":  "Can read workbooks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.insights/workbooks/read",
|                                                    "microsoft.insights/workbooks/revisions/read",
|                                                    "microsoft.insights/workbooktemplates/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "749f88d5-cbae-40b8-bcfc-e573ddc772fa",
|                                    "Name":  "Monitoring Contributor",
|                                    "Description":  "Can read all monitoring data and update monitoring settings.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.AlertsManagement/alerts/*",
|                                                    "Microsoft.AlertsManagement/alertsSummary/*",
|                                                    "Microsoft.AlertsManagement/issues/*",
|                                                    "Microsoft.Insights/actiongroups/*",
|                                                    "Microsoft.Insights/activityLogAlerts/*",
|                                                    "Microsoft.Insights/AlertRules/*",
|                                                    "Microsoft.Insights/components/*",
|                                                    "Microsoft.Insights/createNotifications/*",
|                                                    "Microsoft.Insights/dataCollectionEndpoints/*",
|                                                    "Microsoft.Insights/dataCollectionRules/*",
|                                                    "Microsoft.Insights/dataCollectionRuleAssociations/*",
|                                                    "Microsoft.Insights/DiagnosticSettings/*",
|                                                    "Microsoft.Insights/eventtypes/*",
|                                                    "Microsoft.Insights/LogDefinitions/*",
|                                                    "Microsoft.Insights/metricalerts/*",
|                                                    "Microsoft.Insights/MetricDefinitions/*",
|                                                    "Microsoft.Insights/Metrics/*",
|                                                    "Microsoft.Insights/notificationStatus/*",
|                                                    "Microsoft.Insights/Register/Action",
|                                                    "Microsoft.Insights/scheduledqueryrules/*",
|                                                    "Microsoft.Insights/webtests/*",
|                                                    "Microsoft.Insights/workbooks/*",
|                                                    "Microsoft.Insights/workbooktemplates/*",
|                                                    "Microsoft.Insights/privateLinkScopes/*",
|                                                    "Microsoft.Insights/privateLinkScopeOperationStatuses/*",
|                                                    "Microsoft.Monitor/accounts/*",
|                                                    "Microsoft.Monitor/settings/*",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.OperationalInsights/workspaces/intelligencepacks/*",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                    "Microsoft.OperationalInsights/workspaces/search/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/read",
|                                                    "Microsoft.OperationalInsights/workspaces/storageinsightconfigs/*",
|                                                    "Microsoft.OperationalInsights/locations/workspaces/failover/action",
|                                                    "Microsoft.OperationalInsights/workspaces/failback/action",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.AlertsManagement/smartDetectorAlertRules/*",
|                                                    "Microsoft.AlertsManagement/actionRules/*",
|                                                    "Microsoft.AlertsManagement/smartGroups/*",
|                                                    "Microsoft.AlertsManagement/migrateFromSmartDetection/*",
|                                                    "Microsoft.AlertsManagement/investigations/*",
|                                                    "Microsoft.AlertsManagement/prometheusRuleGroups/*",
|                                                    "Microsoft.Monitor/investigations/*",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3913510d-42f4-4e42-8a64-420c390055eb",
|                                    "Name":  "Monitoring Metrics Publisher",
|                                    "Description":  "Enables publishing metrics against Azure resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/Register/Action",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Insights/Metrics/Write",
|                                                        "Microsoft.Insights/Telemetry/Write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8a3c2885-9b38-4fd2-9d99-91af537c1347",
|                                    "Name":  "Purview role 1 (Deprecated)",
|                                    "Description":  "Deprecated role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Purview/accounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Purview/accounts/data/read",
|                                                        "Microsoft.Purview/accounts/data/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "200bba9e-f0c8-430f-892b-6f0794863803",
|                                    "Name":  "Purview role 2 (Deprecated)",
|                                    "Description":  "Deprecated role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Purview/accounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Purview/accounts/scan/read",
|                                                        "Microsoft.Purview/accounts/scan/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ff100721-1b9d-43d8-af52-42b69c1272db",
|                                    "Name":  "Purview role 3 (Deprecated)",
|                                    "Description":  "Deprecated role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Purview/accounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Purview/accounts/data/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b8b15564-4fa6-4a59-ab12-03e1d9594795",
|                                    "Name":  "Autonomous Development Platform Data Contributor (Preview)",
|                                    "Description":  "Grants permissions to upload and manage new Autonomous Development Platform measurements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AutonomousDevelopmentPlatform/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/discoveries/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/uploads/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/measurements/states/new/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/measurementCollections/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/accounts/measurementCollections/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/workspaces/read",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/workspaces/discoveries/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/workspaces/uploads/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurements/states/new/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurements/classifications/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurements/dataStreams/classifications/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurementCollections/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "27f8b550-c507-4db9-86f2-f4b8e816d59d",
|                                    "Name":  "Autonomous Development Platform Data Owner (Preview)",
|                                    "Description":  "Grants full access to Autonomous Development Platform data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AutonomousDevelopmentPlatform/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AutonomousDevelopmentPlatform/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d63b75f7-47ea-4f27-92ac-e0d173aaf093",
|                                    "Name":  "Autonomous Development Platform Data Reader (Preview)",
|                                    "Description":  "Grants read access to Autonomous Development Platform data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AutonomousDevelopmentPlatform/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AutonomousDevelopmentPlatform/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "14b46e9e-c2b7-41b4-b07b-48a6ebf60603",
|                                    "Name":  "Key Vault Crypto Officer",
|                                    "Description":  "Perform any action on the keys of a key vault, except manage permissions. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.KeyVault/checkNameAvailability/read",
|                                                    "Microsoft.KeyVault/deletedVaults/read",
|                                                    "Microsoft.KeyVault/locations/*/read",
|                                                    "Microsoft.KeyVault/vaults/*/read",
|                                                    "Microsoft.KeyVault/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/keys/*",
|                                                        "Microsoft.KeyVault/vaults/keyrotationpolicies/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "49e2f5d2-7741-4835-8efa-19e1fe35e47f",
|                                    "Name":  "Device Update Deployments Reader",
|                                    "Description":  "Gives you read access to management operations, but does not allow making changes",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.DeviceUpdate/accounts/read",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/read",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e4237640-0e3d-4a46-8fda-70bc94856432",
|                                    "Name":  "Device Update Deployments Administrator",
|                                    "Description":  "Gives you full access to management operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.DeviceUpdate/accounts/read",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/read",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/write",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/delete",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "67d33e57-3129-45e6-bb0b-7cc522f762fa",
|                                    "Name":  "Azure Arc VMware Private Clouds Onboarding",
|                                    "Description":  "Azure Arc VMware Private Clouds Onboarding role has permissions to provision all the required resources for onboard and deboard vCenter instances to Azure.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ConnectedVMwarevSphere/vcenters/Write",
|                                                    "Microsoft.ConnectedVMwarevSphere/vcenters/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/vcenters/Delete",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/Write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/Read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/Delete",
|                                                    "Microsoft.KubernetesConfiguration/operations/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/Write",
|                                                    "Microsoft.ExtendedLocation/customLocations/Delete",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ResourceConnector/appliances/Read",
|                                                    "Microsoft.ResourceConnector/appliances/Write",
|                                                    "Microsoft.ResourceConnector/appliances/Delete",
|                                                    "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                    "Microsoft.BackupSolutions/vmwareapplications/write",
|                                                    "Microsoft.BackupSolutions/vmwareapplications/delete",
|                                                    "Microsoft.BackupSolutions/vmwareapplications/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f4c81013-99ee-4d62-a7ee-b3f1f648599a",
|                                    "Name":  "Microsoft Sentinel Automation Contributor",
|                                    "Description":  "Microsoft Sentinel Automation Contributor",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Logic/workflows/triggers/read",
|                                                    "Microsoft.Logic/workflows/triggers/listCallbackUrl/action",
|                                                    "Microsoft.Logic/workflows/runs/read",
|                                                    "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/triggers/read",
|                                                    "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/triggers/listCallbackUrl/action",
|                                                    "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/runs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "871e35f6-b5c1-49cc-a043-bde969a0f2cd",
|                                    "Name":  "CDN Endpoint Reader",
|                                    "Description":  "Can view CDN endpoints, but can\u0027t make changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cdn/edgenodes/read",
|                                                    "Microsoft.Cdn/operationresults/*",
|                                                    "Microsoft.Cdn/profiles/endpoints/*/read",
|                                                    "Microsoft.Cdn/profiles/afdendpoints/validateCustomDomain/action",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f2dc8367-1007-4938-bd23-fe263f013447",
|                                    "Name":  "Cognitive Services Speech User",
|                                    "Description":  "Access to the real-time speech recognition and batch transcription APIs, real-time speech synthesis and long audio APIs, as well as to read the data/test/model/endpoint for custom models, but can’t create, delete or modify the data/test/model/endpoint for custom models.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/read",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/write",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/delete",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/action",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*/frontend/action",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/text-dependent/*/action",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/text-independent/*/action",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/voiceagent/realtime/*",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/voicelive/realtime/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVoice/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVoice/evaluations/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVoice/longaudiosynthesis/*",
|                                                        "Microsoft.CognitiveServices/accounts/AudioContentCreation/*",
|                                                        "Microsoft.CognitiveServices/accounts/TTSPlayer/*",
|                                                        "Microsoft.CognitiveServices/accounts/VideoTranslation/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomAvatar/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/BatchAvatar/*",
|                                                        "Microsoft.CognitiveServices/accounts/BatchTextToSpeech/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a6333a3e-0164-44c3-b281-7a577aff287f",
|                                    "Name":  "Windows Admin Center Administrator Login",
|                                    "Description":  "Let\u0027s you manage the OS of your resource via Windows Admin Center as an administrator.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/machines/*/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/*",
|                                                    "Microsoft.HybridCompute/machines/upgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
|                                                    "Microsoft.Network/networkWatchers/securityGroupView/action",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/write",
|                                                    "Microsoft.HybridConnectivity/endpoints/write",
|                                                    "Microsoft.HybridConnectivity/endpoints/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/write",
|                                                    "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/listManagedProxyDetails/action",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/patchAssessmentResults/latest/read",
|                                                    "Microsoft.Compute/virtualMachines/patchAssessmentResults/latest/softwarePatches/read",
|                                                    "Microsoft.Compute/virtualMachines/patchInstallationResults/read",
|                                                    "Microsoft.Compute/virtualMachines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                    "Microsoft.Compute/virtualMachines/runCommands/read",
|                                                    "Microsoft.Compute/virtualMachines/vmSizes/read",
|                                                    "Microsoft.Compute/locations/publishers/artifacttypes/types/read",
|                                                    "Microsoft.Compute/locations/publishers/artifacttypes/types/versions/read",
|                                                    "Microsoft.Compute/diskAccesses/read",
|                                                    "Microsoft.Compute/galleries/images/read",
|                                                    "Microsoft.Compute/images/read",
|                                                    "Microsoft.AzureStackHCI/Clusters/Read",
|                                                    "Microsoft.AzureStackHCI/Clusters/ArcSettings/Read",
|                                                    "Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Read",
|                                                    "Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Write",
|                                                    "Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Delete",
|                                                    "Microsoft.AzureStackHCI/Operations/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/VirtualMachines/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/VirtualMachines/Extensions/Write",
|                                                    "Microsoft.ConnectedVMwarevSphere/VirtualMachines/Extensions/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HybridCompute/machines/WACLoginAsAdmin/action",
|                                                        "Microsoft.Compute/virtualMachines/WACloginAsAdmin/action",
|                                                        "Microsoft.AzureStackHCI/Clusters/WACloginAsAdmin/Action",
|                                                        "Microsoft.ConnectedVMwarevSphere/virtualmachines/WACloginAsAdmin/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "18ed5180-3e48-46fd-8541-4ea054d57064",
|                                    "Name":  "Azure Kubernetes Service Policy Add-on Deployment",
|                                    "Description":  "Deploy the Azure Policy add-on on Azure Kubernetes Service clusters",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/publicIPPrefixes/join/action",
|                                                    "Microsoft.Network/publicIPAddresses/join/action",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Compute/proximityPlacementGroups/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "088ab73d-1256-47ae-bea9-9de8e7131f31",
|                                    "Name":  "Guest Configuration Resource Contributor",
|                                    "Description":  "Lets you read, write Guest Configuration Resource.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/write",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/*/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "361898ef-9ed1-48c2-849c-a832951106bb",
|                                    "Name":  "Domain Services Reader",
|                                    "Description":  "Can view Azure AD Domain Services and related network configurations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Insights/Logs/Read",
|                                                    "Microsoft.Insights/Metrics/read",
|                                                    "Microsoft.Insights/DiagnosticSettings/read",
|                                                    "Microsoft.Insights/DiagnosticSettingsCategories/Read",
|                                                    "Microsoft.AAD/domainServices/*/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                    "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                    "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/azureFirewalls/read",
|                                                    "Microsoft.Network/ddosProtectionPlans/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/*/read",
|                                                    "Microsoft.Network/natGateways/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                    "Microsoft.Network/routeTables/read",
|                                                    "Microsoft.Network/routeTables/routes/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "eeaeda52-9324-47f6-8069-5d5bade478b2",
|                                    "Name":  "Domain Services Contributor",
|                                    "Description":  "Can manage Azure AD Domain Services and related network configurations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Insights/Logs/Read",
|                                                    "Microsoft.Insights/Metrics/Read",
|                                                    "Microsoft.Insights/DiagnosticSettings/*",
|                                                    "Microsoft.Insights/DiagnosticSettingsCategories/Read",
|                                                    "Microsoft.AAD/register/action",
|                                                    "Microsoft.AAD/unregister/action",
|                                                    "Microsoft.AAD/domainServices/*",
|                                                    "Microsoft.Network/register/action",
|                                                    "Microsoft.Network/unregister/action",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/write",
|                                                    "Microsoft.Network/virtualNetworks/delete",
|                                                    "Microsoft.Network/virtualNetworks/peer/action",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/delete",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
|                                                    "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                    "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/azureFirewalls/read",
|                                                    "Microsoft.Network/ddosProtectionPlans/read",
|                                                    "Microsoft.Network/ddosProtectionPlans/join/action",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/delete",
|                                                    "Microsoft.Network/loadBalancers/*/read",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/write",
|                                                    "Microsoft.Network/networkSecurityGroups/delete",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/write",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/delete",
|                                                    "Microsoft.Network/routeTables/read",
|                                                    "Microsoft.Network/routeTables/write",
|                                                    "Microsoft.Network/routeTables/delete",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/routeTables/routes/read",
|                                                    "Microsoft.Network/routeTables/routes/write",
|                                                    "Microsoft.Network/routeTables/routes/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d",
|                                    "Name":  "DNS Resolver Contributor",
|                                    "Description":  "Lets you manage DNS resolver resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/dnsResolvers/read",
|                                                    "Microsoft.Network/dnsResolvers/write",
|                                                    "Microsoft.Network/dnsResolvers/delete",
|                                                    "Microsoft.Network/dnsResolvers/join/action",
|                                                    "Microsoft.Network/dnsResolvers/inboundEndpoints/read",
|                                                    "Microsoft.Network/dnsResolvers/inboundEndpoints/write",
|                                                    "Microsoft.Network/dnsResolvers/inboundEndpoints/delete",
|                                                    "Microsoft.Network/dnsResolvers/inboundEndpoints/join/action",
|                                                    "Microsoft.Network/dnsResolvers/outboundEndpoints/read",
|                                                    "Microsoft.Network/dnsResolvers/outboundEndpoints/write",
|                                                    "Microsoft.Network/dnsResolvers/outboundEndpoints/delete",
|                                                    "Microsoft.Network/dnsResolvers/outboundEndpoints/join/action",
|                                                    "Microsoft.Network/dnsForwardingRulesets/read",
|                                                    "Microsoft.Network/dnsForwardingRulesets/write",
|                                                    "Microsoft.Network/dnsForwardingRulesets/delete",
|                                                    "Microsoft.Network/dnsForwardingRulesets/join/action",
|                                                    "Microsoft.Network/dnsForwardingRulesets/forwardingRules/read",
|                                                    "Microsoft.Network/dnsForwardingRulesets/forwardingRules/write",
|                                                    "Microsoft.Network/dnsForwardingRulesets/forwardingRules/delete",
|                                                    "Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks/read",
|                                                    "Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks/write",
|                                                    "Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks/delete",
|                                                    "Microsoft.Network/locations/dnsResolverOperationResults/read",
|                                                    "Microsoft.Network/locations/dnsResolverOperationStatuses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/virtualNetworks/joinLoadBalancer/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinLoadBalancer/action",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "00493d72-78f6-4148-b6c5-d3ce8e4799dd",
|                                    "Name":  "Azure Arc Enabled Kubernetes Cluster User Role",
|                                    "Description":  "List cluster user credentials action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "959f8984-c045-4866-89c7-12bf9737be2e",
|                                    "Name":  "Data Operator for Managed Disks",
|                                    "Description":  "Provides permissions to upload data to empty managed disks, read, or export data of managed disks (not attached to running VMs) and snapshots using SAS URIs and Azure AD authentication.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Compute/disks/download/action",
|                                                        "Microsoft.Compute/disks/upload/action",
|                                                        "Microsoft.Compute/snapshots/download/action",
|                                                        "Microsoft.Compute/snapshots/upload/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6b77f0a0-0d89-41cc-acd1-579c22c17a67",
|                                    "Name":  "AgFood Platform Sensor Partner Contributor",
|                                    "Description":  "Provides contribute access to manage sensor related entities in AgFood Platform Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/sensorPartnerScope/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1ef6a3be-d0ac-425d-8c01-acb62866290b",
|                                    "Name":  "Compute Gallery Sharing Admin",
|                                    "Description":  "This role allows user to share gallery to another subscription/tenant or share it to the public.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/galleries/share/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cd08ab90-6b14-449c-ad9a-8f8e549482c6",
|                                    "Name":  "Scheduled Patching Contributor",
|                                    "Description":  "Provides access to manage maintenance configurations with maintenance scope InGuestPatch and corresponding configuration assignments",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Maintenance/maintenanceConfigurations/read",
|                                                    "Microsoft.Maintenance/maintenanceConfigurations/write",
|                                                    "Microsoft.Maintenance/maintenanceConfigurations/delete",
|                                                    "Microsoft.Maintenance/configurationAssignments/read",
|                                                    "Microsoft.Maintenance/configurationAssignments/write",
|                                                    "Microsoft.Maintenance/configurationAssignments/delete",
|                                                    "Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/read",
|                                                    "Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/write",
|                                                    "Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/delete",
|                                                    "Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/read",
|                                                    "Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/write",
|                                                    "Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/delete",
|                                                    "Microsoft.Maintenance/applyUpdates/read",
|                                                    "Microsoft.Maintenance/updates/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "45d50f46-0b78-4001-a660-4198cbe8cd05",
|                                    "Name":  "DevCenter Dev Box User",
|                                    "Description":  "Provides access to create and manage dev boxes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DevCenter/projects/read",
|                                                    "Microsoft.DevCenter/projects/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userStop/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userStart/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userGetRemoteConnection/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userRead/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userWrite/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userDelete/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userUpcomingActionRead/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userUpcomingActionManage/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userActionRead/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userActionManage/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userCustomize/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "331c37c6-af14-46d9-b9f4-e1909e1b95a0",
|                                    "Name":  "DevCenter Project Admin",
|                                    "Description":  "Provides access to manage project resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DevCenter/projects/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.DevCenter/projects/write",
|                                                       "Microsoft.DevCenter/projects/delete"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminStart/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminStop/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminRead/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminWrite/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminDelete/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminAlign/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminActionRead/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminActionManage/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userStop/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userStart/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userGetRemoteConnection/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userRead/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userWrite/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userDelete/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userActionRead/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userActionManage/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userCustomize/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminRead/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/userWrite/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminWrite/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/userDelete/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminDelete/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminAction/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminActionRead/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminActionManage/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminOutputsRead/action",
|                                                        "Microsoft.DevCenter/projects/pools/align/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "602da2ba-a5c2-41da-b01d-5360126ab525",
|                                    "Name":  "Virtual Machine Local User Login",
|                                    "Description":  "View Virtual Machines in the portal and login as a local user configured on the arc server",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/machines/*/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c0781e91-8102-4553-8951-97c6d4243cda",
|                                    "Name":  "Azure Arc ScVmm Private Cloud User",
|                                    "Description":  "Azure Arc ScVmm Private Cloud User has permissions to use the ScVmm resources to deploy VMs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "microsoft.scvmm/virtualnetworks/join/action",
|                                                    "microsoft.scvmm/virtualnetworks/Read",
|                                                    "microsoft.scvmm/virtualmachinetemplates/clone/action",
|                                                    "microsoft.scvmm/virtualmachinetemplates/Read",
|                                                    "microsoft.scvmm/clouds/deploy/action",
|                                                    "microsoft.scvmm/clouds/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/enabledresourcetypes/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e582369a-e17b-42a5-b10c-874c387c530b",
|                                    "Name":  "Azure Arc ScVmm VM Contributor",
|                                    "Description":  "Arc ScVmm VM Contributor has permissions to perform all VM actions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.scvmm/virtualmachines/*",
|                                                    "microsoft.scvmm/virtualMachineInstances/*",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                    "Microsoft.HybridCompute/machines/installPatches/action",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                    "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/write",
|                                                    "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                    "Microsoft.HybridCompute/licenses/read",
|                                                    "Microsoft.HybridCompute/licenses/write",
|                                                    "Microsoft.HybridCompute/licenses/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6aac74c4-6311-40d2-bbdd-7d01e7c6e3a9",
|                                    "Name":  "Azure Arc ScVmm Private Clouds Onboarding",
|                                    "Description":  "Azure Arc ScVmm Private Clouds Onboarding role has permissions to provision all the required resources for onboard and deboard vmm server instances to Azure.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.scvmm/vmmservers/Read",
|                                                    "microsoft.scvmm/vmmservers/Write",
|                                                    "microsoft.scvmm/vmmservers/Delete",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a92dfd61-77f9-4aec-a531-19858b406c87",
|                                    "Name":  "Azure Arc ScVmm Administrator role",
|                                    "Description":  "Arc ScVmm VM Administrator has permissions to perform all ScVmm actions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ScVmm/*",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                    "Microsoft.HybridCompute/machines/installPatches/action",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                    "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/write",
|                                                    "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                    "Microsoft.HybridCompute/licenses/read",
|                                                    "Microsoft.HybridCompute/licenses/write",
|                                                    "Microsoft.HybridCompute/licenses/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fd036e6b-1266-47a0-b0bb-a05d04831731",
|                                    "Name":  "HDInsight on AKS Cluster Admin",
|                                    "Description":  "Grants a user/group the ability to create, delete and manage clusters within a given cluster pool. Cluster Admin can also run workloads, monitor, and manage all user activity on these clusters.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/write",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/delete",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/resize/action",
|                                                    "Microsoft.HDInsight/clusterpools/clusters/instanceviews/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/jobs/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/runjob/action",
|                                                    "Microsoft.HDInsight/clusterpools/clusters/serviceconfigs/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/availableupgrades/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/upgrade/action",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/rollback/action",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/upgradehistories/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/libraries/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/managelibraries/action",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/*/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/logs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7656b436-37d4-490a-a4ab-d39f838f0042",
|                                    "Name":  "HDInsight on AKS Cluster Pool Admin",
|                                    "Description":  "Can read, create, modify and delete HDInsight on AKS cluster pools and create clusters",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/write",
|                                                    "Microsoft.HDInsight/clusterPools/delete",
|                                                    "Microsoft.HDInsight/clusterPools/read",
|                                                    "Microsoft.HDInsight/clusterPools/write",
|                                                    "Microsoft.HDInsight/clusterpools/availableupgrades/read",
|                                                    "Microsoft.HDInsight/clusterpools/upgrade/action",
|                                                    "Microsoft.HDInsight/clusterPools/upgradehistories/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/*/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/logs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4465e953-8ced-4406-a58e-0f6e3f3b530b",
|                                    "Name":  "FHIR Data Importer",
|                                    "Description":  "Role allows user or principal to read and import FHIR Data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/import/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bcf28286-af25-4c81-bb6f-351fcab5dbe9",
|                                    "Name":  "HDInsight on AKS Cluster Operator",
|                                    "Description":  "Grants a user/group the ability to read cluster configurations, resize clusters and run jobs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HDInsight/clusterPools/read",
|                                                    "Microsoft.Hdinsight/clusterpools/clusters/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/resize/action",
|                                                    "Microsoft.HDInsight/clusterpools/clusters/instanceviews/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/jobs/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/runjob/action",
|                                                    "Microsoft.HDInsight/clusterpools/clusters/serviceconfigs/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/availableupgrades/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/upgradehistories/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/libraries/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/managelibraries/action",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/logs/read",
|                                                    "Microsoft.Insights/diagnosticSettings/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c031e6a8-4391-4de0-8d69-4706a7ed3729",
|                                    "Name":  "API Management Developer Portal Content Editor",
|                                    "Description":  "Can customize the developer portal, edit its content, and publish it.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/portalRevisions/read",
|                                                    "Microsoft.ApiManagement/service/portalRevisions/write",
|                                                    "Microsoft.ApiManagement/service/contentTypes/read",
|                                                    "Microsoft.ApiManagement/service/contentTypes/delete",
|                                                    "Microsoft.ApiManagement/service/contentTypes/write",
|                                                    "Microsoft.ApiManagement/service/contentTypes/contentItems/read",
|                                                    "Microsoft.ApiManagement/service/contentTypes/contentItems/write",
|                                                    "Microsoft.ApiManagement/service/contentTypes/contentItems/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d24ecba3-c1f4-40fa-a7bb-4588a071e8fd",
|                                    "Name":  "Defender Agentless VM Scan",
|                                    "Description":  "Role that provides access to disk snapshot for security analysis.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/instanceView/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "80dcbedb-47ef-405d-95bd-188a1b4ac406",
|                                    "Name":  "Elastic SAN Owner",
|                                    "Description":  "Allows for full access to all resources under Azure Elastic SAN including changing network security policies to unblock data path access",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ElasticSan/elasticSans/*",
|                                                    "Microsoft.ElasticSan/locations/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "af6a70f8-3c9f-4105-acf1-d719e9fca4ca",
|                                    "Name":  "Elastic SAN Reader",
|                                    "Description":  "Allows for control path read access to Azure Elastic SAN",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ElasticSan/elasticSans/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "489581de-a3bd-480d-9518-53dea7416b33",
|                                    "Name":  "Desktop Virtualization Power On Contributor",
|                                    "Description":  "Provide permission to the Azure Virtual Desktop Resource Provider to start virtual machines.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/virtualMachines/start/action",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/read",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/start/action",
|                                                    "Microsoft.AzureStackHCI/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a959dbd1-f747-45e3-8ba6-dd80f235f97c",
|                                    "Name":  "Desktop Virtualization Virtual Machine Contributor",
|                                    "Description":  "This role is in preview and subject to change. Provide permission to the Azure Virtual Desktop Resource Provider to create, delete, update, start, and stop virtual machines.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/write",
|                                                    "Microsoft.DesktopVirtualization/hostpools/retrieveRegistrationToken/action",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/write",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/delete",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/disconnect/action",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/sendMessage/action",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionHostConfigurations/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/doNotUseInternalAPI/action",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/retryprovisioning/action",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/availabilitySets/write",
|                                                    "Microsoft.Compute/availabilitySets/vmSizes/read",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/galleries/read",
|                                                    "Microsoft.Compute/galleries/images/read",
|                                                    "Microsoft.Compute/galleries/images/versions/read",
|                                                    "Microsoft.Compute/images/read",
|                                                    "Microsoft.Compute/locations/usages/read",
|                                                    "Microsoft.Compute/locations/vmSizes/read",
|                                                    "Microsoft.Compute/operations/read",
|                                                    "Microsoft.Compute/skus/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachines/delete",
|                                                    "Microsoft.Compute/virtualMachines/start/action",
|                                                    "Microsoft.Compute/virtualMachines/powerOff/action",
|                                                    "Microsoft.Compute/virtualMachines/restart/action",
|                                                    "Microsoft.Compute/virtualMachines/deallocate/action",
|                                                    "Microsoft.Compute/virtualMachines/runCommand/action",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/write",
|                                                    "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                    "Microsoft.Compute/virtualMachines/runCommands/read",
|                                                    "Microsoft.Compute/virtualMachines/runCommands/write",
|                                                    "Microsoft.Compute/virtualMachines/vmSizes/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/usages/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Marketplace/offerTypes/publishers/offers/plans/agreements/read",
|                                                    "Microsoft.KeyVault/vaults/deploy/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.DesktopVirtualization/scalingPlans/read",
|                                                    "Microsoft.DesktopVirtualization/scalingPlans/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "40c5ff49-9181-41f8-ae61-143b0e78555e",
|                                    "Name":  "Desktop Virtualization Power On Off Contributor",
|                                    "Description":  "Provide permission to the Azure Virtual Desktop Resource Provider to start and stop virtual machines.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureStackHCI/operations/read",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/read",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/restart/action",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/start/action",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/stop/action",
|                                                    "Microsoft.Compute/virtualMachines/deallocate/action",
|                                                    "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                    "Microsoft.Compute/virtualMachines/powerOff/action",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/restart/action",
|                                                    "Microsoft.Compute/virtualMachines/start/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesCancelOperations/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteDeallocate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteHibernate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteStart/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationErrors/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationStatus/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitDeallocate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitHibernate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitStart/action",
|                                                    "Microsoft.ComputeSchedule/register/action",
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/delete",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/sendMessage/action",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/write",
|                                                    "Microsoft.DesktopVirtualization/hostpools/write",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/eventtypes/values/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "76cc9ee4-d5d3-4a45-a930-26add3d73475",
|                                    "Name":  "Access Review Operator Service Role",
|                                    "Description":  "Lets you grant Access Review System app permissions to discover and revoke access as needed by the access review process.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.Management/getEntities/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a8281131-f312-4f34-8d98-ae12be9f0d23",
|                                    "Name":  "Elastic SAN Volume Group Owner",
|                                    "Description":  "Allows for full access to a volume group in Azure Elastic SAN including changing network security policies to unblock data path access",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/*",
|                                                    "Microsoft.ElasticSan/locations/asyncoperations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4339b7cf-9826-4e41-b4ed-c7f4505dac08",
|                                    "Name":  "Artifact Signing Identity Verifier",
|                                    "Description":  "Manage identity or business verification requests.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CodeSigning/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CodeSigning/IdentityVerification/Read",
|                                                        "Microsoft.CodeSigning/IdentityVerification/Write",
|                                                        "Microsoft.CodeSigning/IdentityVerification/Delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a2c4a527-7dc0-4ee3-897b-403ade70fafb",
|                                    "Name":  "Video Indexer Restricted Viewer",
|                                    "Description":  "Has access to view and search through all video\u0027s insights and transcription in the Video Indexer portal. No access to model customization, embedding of widget, downloading videos, or sharing the account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.VideoIndexer/*/read",
|                                                    "Microsoft.VideoIndexer/accounts/*/action"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.VideoIndexer/*/write",
|                                                       "Microsoft.VideoIndexer/*/delete",
|                                                       "Microsoft.VideoIndexer/accounts/generateAccessToken/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b0d8363b-8ddd-447d-831f-62ca05bff136",
|                                    "Name":  "Monitoring Data Reader",
|                                    "Description":  "Can access the data in an Azure Monitor Workspace.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Monitor/accounts/data/metrics/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "30b27cfc-9c84-438e-b0ce-70e35255df80",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Reader",
|                                    "Description":  "Grants read-only access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation).  Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                        "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                        "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                        "Microsoft.ContainerService/fleets/configmaps/read",
|                                                        "Microsoft.ContainerService/fleets/endpoints/read",
|                                                        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/fleets/events/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/limitranges/read",
|                                                        "Microsoft.ContainerService/fleets/namespaces/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                        "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                        "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                        "Microsoft.ContainerService/fleets/services/read",
|                                                        "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/internalmemberclusters/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverridesnapshots/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/works/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "18ab4d3d-a1bf-4477-8ad9-8359bc988f69",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Admin",
|                                    "Description":  "Grants read/write access to all Kubernetes resources in the fleet-managed hub cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "434fb43a-c01c-447e-9f67-c3ad923cfaba",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Admin",
|                                    "Description":  "Grants read/write access to Kubernetes resources within a namespace in the fleet-managed hub cluster - provides write permissions on most objects within a a namespace, with the exception of ResourceQuota object and the namespace object itself. Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/fleets/apps/daemonsets/*",
|                                                        "Microsoft.ContainerService/fleets/apps/deployments/*",
|                                                        "Microsoft.ContainerService/fleets/apps/statefulsets/*",
|                                                        "Microsoft.ContainerService/fleets/authorization.k8s.io/localsubjectaccessreviews/write",
|                                                        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*",
|                                                        "Microsoft.ContainerService/fleets/batch/cronjobs/*",
|                                                        "Microsoft.ContainerService/fleets/batch/jobs/*",
|                                                        "Microsoft.ContainerService/fleets/configmaps/*",
|                                                        "Microsoft.ContainerService/fleets/endpoints/*",
|                                                        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/fleets/events/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/daemonsets/*",
|                                                        "Microsoft.ContainerService/fleets/extensions/deployments/*",
|                                                        "Microsoft.ContainerService/fleets/extensions/ingresses/*",
|                                                        "Microsoft.ContainerService/fleets/extensions/networkpolicies/*",
|                                                        "Microsoft.ContainerService/fleets/limitranges/read",
|                                                        "Microsoft.ContainerService/fleets/namespaces/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumeclaims/*",
|                                                        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*",
|                                                        "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/rolebindings/*",
|                                                        "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/roles/*",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
|                                                        "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                        "Microsoft.ContainerService/fleets/secrets/*",
|                                                        "Microsoft.ContainerService/fleets/serviceaccounts/*",
|                                                        "Microsoft.ContainerService/fleets/services/*",
|                                                        "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/internalmemberclusters/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/*",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverridesnapshots/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/works/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5af6afb3-c06c-4fa4-8848-71a8aee05683",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Writer",
|                                    "Description":  "Grants read/write access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace.  Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/apps/daemonsets/write",
|                                                        "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/apps/deployments/write",
|                                                        "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                        "Microsoft.ContainerService/fleets/apps/statefulsets/write",
|                                                        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/write",
|                                                        "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                        "Microsoft.ContainerService/fleets/batch/cronjobs/write",
|                                                        "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                        "Microsoft.ContainerService/fleets/batch/jobs/write",
|                                                        "Microsoft.ContainerService/fleets/configmaps/read",
|                                                        "Microsoft.ContainerService/fleets/configmaps/write",
|                                                        "Microsoft.ContainerService/fleets/endpoints/read",
|                                                        "Microsoft.ContainerService/fleets/endpoints/write",
|                                                        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/fleets/events/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/daemonsets/write",
|                                                        "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/deployments/write",
|                                                        "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/ingresses/write",
|                                                        "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/networkpolicies/write",
|                                                        "Microsoft.ContainerService/fleets/limitranges/read",
|                                                        "Microsoft.ContainerService/fleets/namespaces/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/write",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/write",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumeclaims/write",
|                                                        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/write",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/write",
|                                                        "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                        "Microsoft.ContainerService/fleets/secrets/read",
|                                                        "Microsoft.ContainerService/fleets/secrets/write",
|                                                        "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                        "Microsoft.ContainerService/fleets/serviceaccounts/write",
|                                                        "Microsoft.ContainerService/fleets/services/read",
|                                                        "Microsoft.ContainerService/fleets/services/write",
|                                                        "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/internalmemberclusters/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/write",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverridesnapshots/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/works/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "63bb64ad-9799-4770-b5c3-24ed299a07bf",
|                                    "Name":  "Azure Kubernetes Fleet Manager Contributor Role",
|                                    "Description":  "Grants read/write access to Azure resources provided by Azure Kubernetes Fleet Manager, including fleets, fleet members, fleet update strategies, fleet update runs, etc.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/fleets/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.ContainerService/fleetMemberships/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ba79058c-0414-4a34-9e42-c3399d80cd5a",
|                                    "Name":  "Kubernetes Namespace User",
|                                    "Description":  "Allows a user to read namespace resources and retrieve kubeconfig for the cluster",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                    "Microsoft.KubernetesConfiguration/namespaces/listUserCredential/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c6decf44-fd0a-444c-a844-d653c394e7ab",
|                                    "Name":  "Data Labeling - Labeler",
|                                    "Description":  "Can label data in Labeling.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/experiments/runs/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/labeling/projects/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/labeling/projects/summary/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/labeling/labels/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/labeling/labels/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f58310d9-a9f6-439a-9e8d-f62e7b41a168",
|                                    "Name":  "Role Based Access Control Administrator",
|                                    "Description":  "Manage access to Azure resources by assigning roles using Azure RBAC. This role does not allow you to manage access using other ways, such as Azure Policy.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "*/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "392ae280-861d-42bd-9ea5-08ee6d83b80e",
|                                    "Name":  "Template Spec Reader",
|                                    "Description":  "Allows read access to Template Specs at the assigned scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/templateSpecs/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1c9b6475-caf0-4164-b5a1-2142a7116f4b",
|                                    "Name":  "Template Spec Contributor",
|                                    "Description":  "Allows full access to Template Spec operations at the assigned scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/templateSpecs/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "51d6186e-6489-4900-b93f-92e23144cca5",
|                                    "Name":  "Microsoft Sentinel Playbook Operator",
|                                    "Description":  "Microsoft Sentinel Playbook Operator",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Logic/workflows/read",
|                                                    "Microsoft.Logic/workflows/triggers/listCallbackUrl/action",
|                                                    "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/triggers/listCallbackUrl/action",
|                                                    "Microsoft.Web/sites/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "18e40d4e-8d2e-438d-97e1-9528336e149c",
|                                    "Name":  "Deployment Environments User",
|                                    "Description":  "Provides access to manage environment resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DevCenter/projects/read",
|                                                    "Microsoft.DevCenter/projects/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.DevCenter/projects/pools/read",
|                                                       "Microsoft.DevCenter/projects/pools/schedules/read"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DevCenter/projects/users/environments/userRead/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/userWrite/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/userDelete/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/userActionManage/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/userOutputsRead/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "80558df3-64f9-4c0f-b32d-e5094b036b0b",
|                                    "Name":  "Azure Spring Apps Connect Role",
|                                    "Description":  "Azure Spring Apps Connect Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/apps/deployments/connect/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a99b0159-1064-4c22-a57b-c9b3caa1c054",
|                                    "Name":  "Azure Spring Apps Remote Debugging Role",
|                                    "Description":  "Azure Spring Apps Remote Debugging Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/apps/deployments/remotedebugging/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1823dd4f-9b8c-4ab6-ab4e-7397a3684615",
|                                    "Name":  "AzureML Registry User",
|                                    "Description":  "Can perform all actions on Machine Learning Services Registry assets as well as get Registry resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/registries/read",
|                                                    "Microsoft.MachineLearningServices/registries/assets/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e503ece1-11d0-4e8e-8e2c-7a6c3bf38815",
|                                    "Name":  "AzureML Compute Operator",
|                                    "Description":  "Can access and perform CRUD operations on Machine Learning Services managed compute resources (including Notebook VMs).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/computes/*",
|                                                    "Microsoft.MachineLearningServices/workspaces/notebooks/vm/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "05352d14-a920-4328-a0de-4cbe7430e26b",
|                                    "Name":  "Azure Center for SAP solutions reader",
|                                    "Description":  "This role provides read access to all capabilities of Azure Center for SAP solutions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Advisor/configurations/read",
|                                                    "Microsoft.Advisor/recommendations/read",
|                                                    "Microsoft.Workloads/sapvirtualInstances/*/read",
|                                                    "Microsoft.Workloads/Locations/*/read",
|                                                    "Microsoft.Workloads/Operations/read",
|                                                    "Microsoft.Workloads/Locations/OperationStatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/virtualMachines/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                    "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                    "Microsoft.Network/networkInterfaces/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                    "Microsoft.Network/loadBalancers/frontendIPConfigurations/read",
|                                                    "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                    "Microsoft.Network/loadBalancers/inboundNatRules/read",
|                                                    "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Network/loadBalancers/networkInterfaces/read",
|                                                    "Microsoft.Network/loadBalancers/outboundRules/read",
|                                                    "Microsoft.Network/loadBalancers/virtualMachines/read",
|                                                    "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/privateEndpoints/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/disks/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "aabbc5dd-1af0-458b-a942-81af88f9c138",
|                                    "Name":  "Azure Center for SAP solutions service role",
|                                    "Description":  "Azure Center for SAP solutions service role - This role is intended to be used for providing the permissions to user assigned managed identity. Azure Center for SAP solutions will use this identity to deploy and manage SAP systems.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/write",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/write",
|                                                    "Microsoft.Network/loadBalancers/frontendIPConfigurations/read",
|                                                    "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                    "Microsoft.Network/loadBalancers/inboundNatRules/read",
|                                                    "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Network/loadBalancers/networkInterfaces/read",
|                                                    "Microsoft.Network/loadBalancers/outboundRules/read",
|                                                    "Microsoft.Network/loadBalancers/virtualMachines/read",
|                                                    "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                    "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/checkIpAddressAvailability/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/virtualMachines/read",
|                                                    "Microsoft.Network/virtualNetworks/virtualMachines/read",
|                                                    "Microsoft.Network/networkInterfaces/ipconfigurations/join/action",
|                                                    "Microsoft.Network/privateEndpoints/read",
|                                                    "Microsoft.Network/privateEndpoints/write",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinLoadBalancer/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/write",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/write",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/availabilitySets/write",
|                                                    "Microsoft.Compute/skus/read",
|                                                    "Microsoft.Compute/sshPublicKeys/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/write",
|                                                    "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7b0c7e81-271f-4c71-90bf-e30bdfdbc2f7",
|                                    "Name":  "Azure Center for SAP solutions administrator",
|                                    "Description":  "This role provides read and write access to all capabilities of Azure Center for SAP solutions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Advisor/configurations/read",
|                                                    "Microsoft.Advisor/recommendations/read",
|                                                    "Microsoft.Workloads/sapvirtualInstances/*/read",
|                                                    "Microsoft.Workloads/sapVirtualInstances/*/write",
|                                                    "Microsoft.Workloads/sapVirtualInstances/*/delete",
|                                                    "Microsoft.Workloads/Locations/*/action",
|                                                    "Microsoft.Workloads/Locations/*/read",
|                                                    "Microsoft.Workloads/sapVirtualInstances/*/start/action",
|                                                    "Microsoft.Workloads/sapVirtualInstances/*/stop/action",
|                                                    "Microsoft.Workloads/connectors/*/read",
|                                                    "Microsoft.Workloads/connectors/*/write",
|                                                    "Microsoft.Workloads/connectors/*/delete",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/virtualMachines/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                    "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                    "Microsoft.Network/networkInterfaces/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                    "Microsoft.Network/loadBalancers/frontendIPConfigurations/read",
|                                                    "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                    "Microsoft.Network/loadBalancers/inboundNatRules/read",
|                                                    "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Network/loadBalancers/networkInterfaces/read",
|                                                    "Microsoft.Network/loadBalancers/outboundRules/read",
|                                                    "Microsoft.Network/loadBalancers/virtualMachines/read",
|                                                    "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/privateEndpoints/read",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/sshPublicKeys/read",
|                                                    "Microsoft.Compute/sshPublicKeys/write",
|                                                    "Microsoft.Compute/sshPublicKeys/*/generateKeyPair/action",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                    "Microsoft.Compute/disks/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fbc52c3f-28ad-4303-a892-8a056630b8f1",
|                                    "Name":  "AppGw for Containers Configuration Manager",
|                                    "Description":  "Allows access and configuration updates to Application Gateway for Containers resource.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ServiceNetworking/trafficControllers/read",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/write",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/delete",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/frontends/read",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/frontends/write",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/frontends/delete",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/associations/read",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/associations/write",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/associations/delete",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/*/read",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/*/write",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/*/delete",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ServiceNetworking/trafficControllers/serviceRoutingConfigurations/read",
|                                                        "Microsoft.ServiceNetworking/trafficControllers/serviceRoutingConfigurations/write",
|                                                        "Microsoft.ServiceNetworking/trafficControllers/serviceRoutingConfigurations/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4ba50f17-9666-485c-a643-ff00808643f0",
|                                    "Name":  "FHIR SMART User",
|                                    "Description":  "Role allows user to access FHIR Service according to SMART on FHIR specification",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/readById/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/search/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/smart/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/readById/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/search/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/smart/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a001fd3d-188f-4b5d-821b-7da978bf7442",
|                                    "Name":  "Cognitive Services OpenAI Contributor",
|                                    "Description":  "Full access including the ability to fine-tune, deploy and generate text",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.CognitiveServices/accounts/deployments/write",
|                                                    "Microsoft.CognitiveServices/accounts/deployments/delete",
|                                                    "Microsoft.CognitiveServices/accounts/raiPolicies/read",
|                                                    "Microsoft.CognitiveServices/accounts/raiPolicies/write",
|                                                    "Microsoft.CognitiveServices/accounts/raiPolicies/delete",
|                                                    "Microsoft.CognitiveServices/accounts/commitmentplans/read",
|                                                    "Microsoft.CognitiveServices/accounts/commitmentplans/write",
|                                                    "Microsoft.CognitiveServices/accounts/commitmentplans/delete",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd",
|                                    "Name":  "Cognitive Services OpenAI User",
|                                    "Description":  "Ability to view files, models, deployments. Readers can\u0027t make any changes They can inference and create images",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/engines/completions/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/engines/search/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/engines/generate/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/deployments/audio/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/deployments/search/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/deployments/completions/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/deployments/chat/completions/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/deployments/realtime/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/deployments/extensions/chat/completions/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/deployments/embeddings/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/images/generations/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/video/generations/*/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/video/generations/*/delete",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/assistants/*",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/responses/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "36e80216-a7e8-4f42-a7e1-f12c98cbaf8a",
|                                    "Name":  "Azure impact Reporter role",
|                                    "Description":  "built-in role for azure impact write access",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Impact/WorkloadImpacts/*",
|                                                    "Microsoft.Impact/ImpactCategories/read",
|                                                    "Microsoft.Impact/TopologyImpacts/*",
|                                                    "Microsoft.Impact/getUploadToken/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "68ff5d27-c7f5-4fa9-a21c-785d0df7bd9e",
|                                    "Name":  "Impact Reader",
|                                    "Description":  "Allows read-only access to reported impacts and impact categories",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Impact/WorkloadImpacts/read",
|                                                    "Microsoft.Impact/ImpactCategories/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ad2dd5fb-cd4b-4fd4-a9b6-4fed3630980b",
|                                    "Name":  "ContainerApp Reader",
|                                    "Description":  "View all containerapp resources, but does not allow you to make any changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.App/containerApps/*/read",
|                                                    "Microsoft.App/containerApps/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1afdec4b-e479-420e-99e7-f82237c7c5e6",
|                                    "Name":  "Azure Kubernetes Service Cluster Monitoring User",
|                                    "Description":  "List cluster monitoring user credential action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action",
|                                                    "Microsoft.ContainerService/managedClusters/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f5819b54-e033-4d82-ac66-4fec3cbf3f4c",
|                                    "Name":  "Azure Connected Machine Resource Manager",
|                                    "Description":  "Custom Role for AzureStackHCI RP to manage hybrid compute machines and hybrid connectivity endpoints in a resource group",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/*/read",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/write",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/*/read",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridConnectivity/endpoints/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/write",
|                                                    "Microsoft.HybridConnectivity/endpoints/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.EdgeMarketplace/locations/operationStatuses/read",
|                                                    "Microsoft.EdgeMarketPlace/offers/getAccessToken/action",
|                                                    "Microsoft.EdgeMarketPlace/offers/generateAccessToken/action",
|                                                    "Microsoft.EdgeMarketplace/publishers/read",
|                                                    "Microsoft.EdgeMarketplace/offers/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/read",
|                                                    "Microsoft.Attestation/attestationProviders/write",
|                                                    "Microsoft.Attestation/attestationProviders/read",
|                                                    "Microsoft.Attestation/attestationProviders/delete",
|                                                    "Microsoft.Attestation/attestationProviders/attestation/read",
|                                                    "Microsoft.Attestation/attestationProviders/attestation/write",
|                                                    "Microsoft.Attestation/attestationProviders/attestation/delete",
|                                                    "Microsoft.HybridCompute/settings/read",
|                                                    "Microsoft.HybridCompute/settings/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "189207d4-bb67-4208-a635-b06afe8b2c57",
|                                    "Name":  "SqlDb Migration Role",
|                                    "Description":  "Role for SqlDb migration",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sql/servers/read",
|                                                    "Microsoft.Sql/servers/write",
|                                                    "Microsoft.Sql/servers/databases/read",
|                                                    "Microsoft.Sql/servers/databases/write",
|                                                    "Microsoft.Sql/servers/databases/delete",
|                                                    "Microsoft.DataMigration/locations/operationResults/read",
|                                                    "Microsoft.DataMigration/locations/operationStatuses/read",
|                                                    "Microsoft.DataMigration/locations/sqlMigrationServiceOperationResults/read",
|                                                    "Microsoft.DataMigration/databaseMigrations/write",
|                                                    "Microsoft.DataMigration/databaseMigrations/read",
|                                                    "Microsoft.DataMigration/databaseMigrations/delete",
|                                                    "Microsoft.DataMigration/databaseMigrations/cancel/action",
|                                                    "Microsoft.DataMigration/databaseMigrations/cutover/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/write",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/delete",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listAuthKeys/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/regenerateAuthKeys/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/deleteNode/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listMonitoringData/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listMigrations/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/MonitoringData/read",
|                                                    "Microsoft.DataMigration/register/action",
|                                                    "Microsoft.DataMigration/operations/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/validateIR/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c4bc862a-3b64-4a35-a021-a380c159b042",
|                                    "Name":  "Bayer Ag Powered Services GDU Solution",
|                                    "Description":  "Provide access to GDU Solution by Bayer Ag Powered Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ef29765d-0d37-4119-a4f8-f9f9902c9588",
|                                    "Name":  "Bayer Ag Powered Services Imagery Solution",
|                                    "Description":  "Provide access to Imagery Solution by Bayer Ag Powered Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/farms/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0105a6b0-4bb9-43d2-982a-12806f9faddb",
|                                    "Name":  "Azure Center for SAP solutions Service role for management",
|                                    "Description":  "This role has permissions that the user assigned managed identity must have to enable registration for the existing systems.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6d949e1d-41e2-46e3-8920-c6e4f31a8310",
|                                    "Name":  "Azure Center for SAP solutions Management role",
|                                    "Description":  "This role has permissions which allow users to register existing systems, view and manage systems.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d5a2ae44-610b-4500-93be-660a0c5f5ca6",
|                                    "Name":  "Defender Kubernetes API Access",
|                                    "Description":  "Grants Microsoft Defender for Cloud access to Azure Kubernetes Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write",
|                                                    "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read",
|                                                    "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete",
|                                                    "Microsoft.ContainerService/managedClusters/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/providers/features/register/action",
|                                                    "Microsoft.Security/pricings/securityoperators/read",
|                                                    "Microsoft.Security/securityOperators/read",
|                                                    "Microsoft.Authorization/policyAssignments/read",
|                                                    "Microsoft.Authorization/policySetDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f0310ce6-e953-4cf8-b892-fb1c87eaf7f6",
|                                    "Name":  "Azure Usage Billing Data Sender",
|                                    "Description":  "Azure Usage Billing shared BuiltIn role to be used for all Customer Account Authentication",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.UsageBilling/accounts/inputs/send/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "96062cf7-95ca-4f89-9b9d-2a2aa47356af",
|                                    "Name":  "Defender Registry Access",
|                                    "Description":  "Grants Microsoft Defender for Cloud access to Azure Container Registry for security assessment of container images",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/pull/read",
|                                                    "Microsoft.ContainerRegistry/registries/push/write",
|                                                    "Microsoft.ContainerRegistry/registries/artifacts/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/write",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/write",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/delete",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1d335eef-eee1-47fe-a9e0-53214eba8872",
|                                    "Name":  "SqlMI Migration Role",
|                                    "Description":  "Role for SqlMI migration",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sql/managedInstances/read",
|                                                    "Microsoft.Sql/managedInstances/write",
|                                                    "Microsoft.Sql/managedInstances/databases/read",
|                                                    "Microsoft.Sql/managedInstances/databases/write",
|                                                    "Microsoft.Sql/managedInstances/databases/delete",
|                                                    "Microsoft.Sql/managedInstances/metrics/read",
|                                                    "Microsoft.DataMigration/locations/operationResults/read",
|                                                    "Microsoft.DataMigration/locations/operationStatuses/read",
|                                                    "Microsoft.DataMigration/locations/sqlMigrationServiceOperationResults/read",
|                                                    "Microsoft.DataMigration/databaseMigrations/write",
|                                                    "Microsoft.DataMigration/databaseMigrations/read",
|                                                    "Microsoft.DataMigration/databaseMigrations/delete",
|                                                    "Microsoft.DataMigration/databaseMigrations/cancel/action",
|                                                    "Microsoft.DataMigration/databaseMigrations/cutover/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/write",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/delete",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listAuthKeys/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/regenerateAuthKeys/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/deleteNode/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listMonitoringData/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listMigrations/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/MonitoringData/read",
|                                                    "Microsoft.DataMigration/register/action",
|                                                    "Microsoft.DataMigration/operations/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/validateIR/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ae8036db-e102-405b-a1b9-bae082ea436d",
|                                    "Name":  "SqlVM Migration Role",
|                                    "Description":  "Role for SqlVM migration",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DataMigration/locations/operationResults/read",
|                                                    "Microsoft.DataMigration/locations/operationStatuses/read",
|                                                    "Microsoft.DataMigration/locations/sqlMigrationServiceOperationResults/read",
|                                                    "Microsoft.DataMigration/databaseMigrations/write",
|                                                    "Microsoft.DataMigration/databaseMigrations/read",
|                                                    "Microsoft.DataMigration/databaseMigrations/delete",
|                                                    "Microsoft.DataMigration/databaseMigrations/cancel/action",
|                                                    "Microsoft.DataMigration/databaseMigrations/cutover/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/write",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/delete",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listAuthKeys/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/regenerateAuthKeys/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/deleteNode/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listMonitoringData/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listMigrations/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/MonitoringData/read",
|                                                    "Microsoft.DataMigration/register/action",
|                                                    "Microsoft.DataMigration/operations/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.SqlVirtualMachine/sqlVirtualMachines/read",
|                                                    "Microsoft.SqlVirtualMachine/sqlVirtualMachines/write",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/validateIR/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a9b99099-ead7-47db-8fcf-072597a61dfa",
|                                    "Name":  "Bayer Ag Powered Services CWUM Solution",
|                                    "Description":  "Provide access to CWUM Solution by Bayer Ag Powered Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/farms/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0ab34830-df19-4f8c-b84e-aa85b8afa6e8",
|                                    "Name":  "Azure Front Door Domain Contributor",
|                                    "Description":  "For internal use within Azure. Can manage Azure Front Door domains, but can\u0027t grant access to other users.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Cdn/operationresults/profileresults/customdomainresults/read",
|                                                    "Microsoft.Cdn/profiles/customdomains/read",
|                                                    "Microsoft.Cdn/profiles/customdomains/write",
|                                                    "Microsoft.Cdn/profiles/customdomains/delete",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3f2eb865-5811-4578-b90a-6fc6fa0df8e5",
|                                    "Name":  "Azure Front Door Secret Contributor",
|                                    "Description":  "For internal use within Azure. Can manage Azure Front Door secrets, but can\u0027t grant access to other users.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Cdn/operationresults/profileresults/secretresults/read",
|                                                    "Microsoft.Cdn/profiles/secrets/read",
|                                                    "Microsoft.Cdn/profiles/secrets/write",
|                                                    "Microsoft.Cdn/profiles/secrets/delete",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0f99d363-226e-4dca-9920-b807cf8e1a5f",
|                                    "Name":  "Azure Front Door Domain Reader",
|                                    "Description":  "For internal use within Azure. Can view Azure Front Door domains, but can\u0027t make changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Cdn/operationresults/profileresults/customdomainresults/read",
|                                                    "Microsoft.Cdn/profiles/customdomains/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0db238c4-885e-4c4f-a933-aa2cef684fca",
|                                    "Name":  "Azure Front Door Secret Reader",
|                                    "Description":  "For internal use within Azure. Can view Azure Front Door secrets, but can\u0027t make changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Cdn/operationresults/profileresults/secretresults/read",
|                                                    "Microsoft.Cdn/profiles/secrets/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d18ad5f3-1baf-4119-b49b-d944edb1f9d0",
|                                    "Name":  "MySQL Backup And Export Operator",
|                                    "Description":  "Grants full access to manage backup and export resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DBforMySQL/flexibleServers/validateBackup/action",
|                                                    "Microsoft.DBforMySQL/flexibleServers/backupAndExport/action",
|                                                    "Microsoft.DBforMySQL/locations/operationResults/read",
|                                                    "Microsoft.DBforMySQL/locations/azureAsyncOperation/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a8835c7d-b5cb-47fa-b6f0-65ea10ce07a2",
|                                    "Name":  "LocalNGFirewallAdministrator role",
|                                    "Description":  "Allows user to create, modify, describe, or delete NGFirewalls.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "PaloAltoNetworks.Cloudngfw/firewalls/*",
|                                                    "PaloAltoNetworks.Cloudngfw/localRulestacks/read",
|                                                    "PaloAltoNetworks.Cloudngfw/globalRulestacks/read",
|                                                    "PaloAltoNetworks.Cloudngfw/Locations/operationStatuses/read",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/read",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/publicIPAddresses/write",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/publicIPAddresses/join/action",
|                                                    "Microsoft.Network/networkVirtualAppliances/read",
|                                                    "Microsoft.Network/networkVirtualAppliances/write",
|                                                    "Microsoft.Network/networkVirtualAppliances/delete",
|                                                    "Microsoft.Network/virtualHubs/read",
|                                                    "Microsoft.Network/virtualWans/read",
|                                                    "Microsoft.Network/virtualWans/virtualHubs/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "PaloAltoNetworks.Cloudngfw/localRulestacks/fqdnlists/read",
|                                                    "PaloAltoNetworks.Cloudngfw/localRulestacks/localRules/read",
|                                                    "PaloAltoNetworks.Cloudngfw/localRulestacks/listFirewalls/action",
|                                                    "PaloAltoNetworks.Cloudngfw/createProductSerialNumber/action",
|                                                    "PaloAltoNetworks.Cloudngfw/listCloudManagerTenants/action",
|                                                    "PaloAltoNetworks.Cloudngfw/listProductSerialNumberStatus/action",
|                                                    "PaloAltoNetworks.Cloudngfw/listSupportInfo/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bda0d508-adf1-4af0-9c28-88919fc3ae06",
|                                    "Name":  "Azure Stack HCI Administrator",
|                                    "Description":  "Grants full access to the cluster and its resources, including the ability to register Azure Stack HCI and assign others as Azure Arc HCI VM Contributor and/or Azure Arc HCI VM Reader",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/register/action",
|                                                    "Microsoft.AzureStackHCI/Unregister/Action",
|                                                    "Microsoft.AzureStackHCI/clusters/*",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/Read",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/Write",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Write",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/Delete",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Delete",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/join/action",
|                                                    "Microsoft.HybridCompute/register/action",
|                                                    "Microsoft.GuestConfiguration/register/action",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                    "Microsoft.HybridConnectivity/register/action",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.AzureStackHCI/*",
|                                                    "Microsoft.AzureStackHCI/EdgeMachines/*",
|                                                    "Microsoft.AzureStackHCI/DevicePools/*",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                    "Microsoft.HybridCompute/machines/installPatches/action",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                    "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/write",
|                                                    "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                    "Microsoft.HybridCompute/licenses/read",
|                                                    "Microsoft.HybridCompute/licenses/write",
|                                                    "Microsoft.HybridCompute/licenses/delete",
|                                                    "Microsoft.ResourceConnector/register/action",
|                                                    "Microsoft.ResourceConnector/appliances/read",
|                                                    "Microsoft.ResourceConnector/appliances/write",
|                                                    "Microsoft.ResourceConnector/appliances/delete",
|                                                    "Microsoft.ResourceConnector/locations/operationresults/read",
|                                                    "Microsoft.ResourceConnector/locations/operationsstatus/read",
|                                                    "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                    "Microsoft.ResourceConnector/appliances/listKeys/action",
|                                                    "Microsoft.ResourceConnector/operations/read",
|                                                    "Microsoft.ExtendedLocation/register/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/write",
|                                                    "Microsoft.ExtendedLocation/customLocations/delete",
|                                                    "Microsoft.EdgeMarketplace/offers/read",
|                                                    "Microsoft.EdgeMarketplace/publishers/read",
|                                                    "Microsoft.Kubernetes/register/action",
|                                                    "Microsoft.KubernetesConfiguration/register/action",
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                    "Microsoft.KubernetesConfiguration/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Write",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                    "Microsoft.HybridContainerService/register/action",
|                                                    "Microsoft.HybridCompute/settings/write",
|                                                    "Microsoft.HybridCompute/settings/read",
|                                                    "Microsoft.HybridCompute/gateways/read",
|                                                    "Microsoft.HybridCompute/gateways/write",
|                                                    "Microsoft.HybridCompute/gateways/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bfc3b73d-c6ff-45eb-9a5f-40298295bf20",
|                                    "Name":  "LocalRulestacksAdministrator role",
|                                    "Description":  "Allows users to create, modify, describe, or delete Rulestacks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "PaloAltoNetworks.Cloudngfw/localRulestacks/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*",
|                                                    "PaloAltoNetworks.Cloudngfw/firewalls/read",
|                                                    "PaloAltoNetworks.Cloudngfw/createProductSerialNumber/action",
|                                                    "PaloAltoNetworks.Cloudngfw/listProductSerialNumberStatus/action",
|                                                    "PaloAltoNetworks.Cloudngfw/listSupportInfo/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7392c568-9289-4bde-aaaa-b7131215889d",
|                                    "Name":  "Azure Extension for SQL Server Deployment",
|                                    "Description":  "Microsoft.AzureArcData service role to enable deployment of Azure Extension for SQL Server",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d6470a16-71bd-43ab-86b3-6f3a73f4e787",
|                                    "Name":  "Azure Maps Data Read and Batch Role",
|                                    "Description":  "This role can be used to assign read and batch actions on Azure Maps.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Maps/accounts/services/*/read",
|                                                        "Microsoft.Maps/accounts/services/batch/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ef1c2c96-4a77-49e8-b9a4-6179fe1d2fd2",
|                                    "Name":  "API Management Workspace Reader",
|                                    "Description":  "Has read-only access to entities in the workspace. This role should be assigned on the workspace scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/workspaces/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/diagnosticSettings/*/read",
|                                                    "Microsoft.insights/logs/read",
|                                                    "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "73c2c328-d004-4c5e-938c-35c6f5679a1f",
|                                    "Name":  "API Management Workspace API Product Manager",
|                                    "Description":  "Has read access to entities in the workspace and read and write access to entities for publishing APIs. This role should be assigned on the workspace scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/workspaces/*/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/products/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/subscriptions/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/groups/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/tags/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/notifications/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/diagnosticSettings/*/read",
|                                                    "Microsoft.insights/logs/read",
|                                                    "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "56328988-075d-4c6a-8766-d93edd6725b6",
|                                    "Name":  "API Management Workspace API Developer",
|                                    "Description":  "Has read access to entities in the workspace and read and write access to entities for editing APIs. This role should be assigned on the workspace scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/workspaces/*/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/apis/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/apiVersionSets/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/policies/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/schemas/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/products/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/policyFragments/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/namedValues/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/tags/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/backends/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/certificates/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/diagnostics/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/loggers/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/diagnosticSettings/*/read",
|                                                    "Microsoft.insights/logs/read",
|                                                    "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d59a3e9c-6d52-4a5a-aeed-6bf3cf0e31da",
|                                    "Name":  "API Management Service Workspace API Product Manager",
|                                    "Description":  "Has the same access as API Management Service Workspace API Developer as well as read access to users and write access to allow assigning users to groups. This role should be assigned on the service scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/users/read",
|                                                    "Microsoft.ApiManagement/service/tags/read",
|                                                    "Microsoft.ApiManagement/service/tags/apiLinks/*",
|                                                    "Microsoft.ApiManagement/service/tags/operationLinks/*",
|                                                    "Microsoft.ApiManagement/service/tags/productLinks/*",
|                                                    "Microsoft.ApiManagement/service/products/read",
|                                                    "Microsoft.ApiManagement/service/products/apiLinks/*",
|                                                    "Microsoft.ApiManagement/service/groups/read",
|                                                    "Microsoft.ApiManagement/service/groups/users/*",
|                                                    "Microsoft.ApiManagement/service/read",
|                                                    "Microsoft.ApiManagement/service/authorizationServers/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9565a273-41b9-4368-97d2-aeb0c976a9b3",
|                                    "Name":  "API Management Service Workspace API Developer",
|                                    "Description":  "Has read access to tags and products and write access to allow: assigning APIs to products, assigning tags to products and APIs. This role should be assigned on the service scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/tags/read",
|                                                    "Microsoft.ApiManagement/service/tags/apiLinks/*",
|                                                    "Microsoft.ApiManagement/service/tags/operationLinks/*",
|                                                    "Microsoft.ApiManagement/service/tags/productLinks/*",
|                                                    "Microsoft.ApiManagement/service/products/read",
|                                                    "Microsoft.ApiManagement/service/products/apiLinks/*",
|                                                    "Microsoft.ApiManagement/service/read",
|                                                    "Microsoft.ApiManagement/service/authorizationServers/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0c34c906-8d99-4cb7-8bb7-33f5b0a1a799",
|                                    "Name":  "API Management Workspace Contributor",
|                                    "Description":  "Can manage the workspace and view, but not modify its members. This role should be assigned on the workspace scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/workspaces/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/diagnosticSettings/*/read",
|                                                    "Microsoft.insights/logs/read",
|                                                    "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b8eda974-7b85-4f76-af95-65846b26df6d",
|                                    "Name":  "Storage File Data Privileged Reader",
|                                    "Description":  "Customer has read access on Azure Storage file shares.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "69566ab7-960f-475b-8e7c-b3118f30c6bd",
|                                    "Name":  "Storage File Data Privileged Contributor",
|                                    "Description":  "Customer has read, write, delete and modify NTFS permission access on Azure Storage file shares.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7eabc9a4-85f7-4f71-b8ab-75daaccc1033",
|                                    "Name":  "Windows 365 Network User",
|                                    "Description":  "This role is used by Windows 365 to read virtual networks and join the designated virtual networks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/usages/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1f135831-5bbe-4924-9016-264044c00788",
|                                    "Name":  "Windows 365 Network Interface Contributor",
|                                    "Description":  "This role is used by Windows 365 to provision required network resources and join Microsoft-hosted VMs to network interfaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Network/locations/operationResults/read",
|                                                    "Microsoft.Network/locations/usages/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action",
|                                                    "Microsoft.Network/networkInterfaces/effectiveRouteTable/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3d55a8f6-4133-418d-8051-facdb1735758",
|                                    "Name":  "Windows365SubscriptionReader",
|                                    "Description":  "Read subscriptions, images, azure firewalls. This role is used in Windows365 scenarios.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0f37683f-2463-46b6-9ce7-9b788b988ba2",
|                                    "Name":  "App Compliance Automation Administrator",
|                                    "Description":  "Allows managing App Compliance Automation tool for Microsoft 365",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppComplianceAutomation/*",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                    "Microsoft.Storage/storageAccounts/fileservices/write",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.PolicyInsights/policyStates/queryResults/action",
|                                                    "Microsoft.PolicyInsights/policyStates/triggerEvaluation/action",
|                                                    "Microsoft.Resources/resources/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
|                                                    "Microsoft.Resources/subscriptions/resources/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/tags/read",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Security/automations/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Security/automations/delete",
|                                                    "Microsoft.Security/automations/write",
|                                                    "Microsoft.Security/register/action",
|                                                    "Microsoft.Security/unregister/action",
|                                                    "*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ffc6bbe0-e443-4c3b-bf54-26581bb2f78e",
|                                    "Name":  "App Compliance Automation Reader",
|                                    "Description":  "Allows read-only access to App Compliance Automation tool for Microsoft 365",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8b9dfcab-4b77-4632-a6df-94bd07820648",
|                                    "Name":  "Azure Sphere Contributor",
|                                    "Description":  "Allows user read and write access to Azure Sphere resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureSphere/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/DiagnosticSettings/*",
|                                                    "Microsoft.Insights/DiagnosticSettingsCategories/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e9b8712a-cbcf-4ea7-b0f7-e71b803401e6",
|                                    "Name":  "SaaS Hub Contributor",
|                                    "Description":  "SaaS Hub contributor can manage SaaS Hub resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.SaaSHub/cloudservices/read",
|                                                    "Microsoft.SaaSHub/cloudservices/write",
|                                                    "Microsoft.SaaSHub/cloudservices/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c8ae6279-5a0b-4cb2-b3f0-d4d62845742c",
|                                    "Name":  "Azure Sphere Reader",
|                                    "Description":  "Allows user to read Azure Sphere resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureSphere/*/read",
|                                                    "Microsoft.AzureSphere/catalogs/countDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/listDeviceGroups/action",
|                                                    "Microsoft.AzureSphere/catalogs/listDeviceInsights/action",
|                                                    "Microsoft.AzureSphere/catalogs/listDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/listDeployments/action",
|                                                    "Microsoft.AzureSphere/catalogs/products/countDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/products/deviceGroups/countDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/certificates/retrieveCertChain/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/DiagnosticSettings/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6d994134-994b-4a59-9974-f479f0b227fb",
|                                    "Name":  "Azure Sphere Publisher",
|                                    "Description":  "Allows user to read and download Azure Sphere resources and upload images.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureSphere/*/read",
|                                                    "Microsoft.AzureSphere/catalogs/countDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/listDeviceGroups/action",
|                                                    "Microsoft.AzureSphere/catalogs/listDeviceInsights/action",
|                                                    "Microsoft.AzureSphere/catalogs/listDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/products/countDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/products/deviceGroups/countDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/certificates/retrieveProofOfPossessionNonce/action",
|                                                    "Microsoft.AzureSphere/catalogs/certificates/retrieveCertChain/action",
|                                                    "Microsoft.AzureSphere/catalogs/images/write",
|                                                    "Microsoft.AzureSphere/catalogs/uploadImage/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/DiagnosticSettings/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "be1a1ac2-09d3-4261-9e57-a73a6e227f53",
|                                    "Name":  "Procurement Contributor",
|                                    "Description":  "Lets you manage the procurement of products and services.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.SaaSHub/cloudservices/read",
|                                                    "Microsoft.SaaSHub/cloudservices/write",
|                                                    "Microsoft.SaaSHub/cloudservices/delete",
|                                                    "Microsoft.SaaSHub/register/action",
|                                                    "Microsoft.SaaS/resources/read",
|                                                    "Microsoft.SaaS/resources/write",
|                                                    "Microsoft.SaaS/resources/delete",
|                                                    "Microsoft.SaaS/register/action",
|                                                    "Microsoft.ProfessionalService/resources/read",
|                                                    "Microsoft.ProfessionalService/resources/write",
|                                                    "Microsoft.ProfessionalService/resources/delete",
|                                                    "Microsoft.ProfessionalService/register/action",
|                                                    "Microsoft.BillingBenefits/register/action",
|                                                    "Microsoft.BillingBenefits/maccs/read",
|                                                    "Microsoft.BillingBenefits/maccs/write",
|                                                    "Microsoft.BillingBenefits/maccs/delete",
|                                                    "Microsoft.BillingBenefits/maccs/cancel/action",
|                                                    "Microsoft.BillingBenefits/maccs/chargeShortfall/action",
|                                                    "Microsoft.BillingBenefits/maccs/writeOff/action",
|                                                    "Microsoft.BillingBenefits/maccs/contributors/read",
|                                                    "Microsoft.BillingBenefits/credits/read",
|                                                    "Microsoft.BillingBenefits/credits/write",
|                                                    "Microsoft.BillingBenefits/credits/cancel/action",
|                                                    "Microsoft.BillingBenefits/credits/sources/read",
|                                                    "Microsoft.BillingBenefits/credits/sources/write",
|                                                    "Microsoft.BillingBenefits/credits/sources/delete",
|                                                    "Microsoft.BillingBenefits/discounts/read",
|                                                    "Microsoft.BillingBenefits/discounts/write",
|                                                    "Microsoft.BillingBenefits/discounts/delete",
|                                                    "Microsoft.BillingBenefits/discounts/cancel/action",
|                                                    "Microsoft.BillingBenefits/conditionalCredits/read",
|                                                    "Microsoft.BillingBenefits/conditionalCredits/write",
|                                                    "Microsoft.BillingBenefits/conditionalCredits/delete",
|                                                    "Microsoft.BillingBenefits/conditionalCredits/cancel/action",
|                                                    "Microsoft.BillingBenefits/conditionalCredits/contributors/read",
|                                                    "Microsoft.EnterpriseSupport/enterpriseSupports/read",
|                                                    "Microsoft.EnterpriseSupport/enterpriseSupports/write",
|                                                    "Microsoft.EnterpriseSupport/enterpriseSupports/delete",
|                                                    "Microsoft.EnterpriseSupport/register/action",
|                                                    "Microsoft.SoftwarePlan/register/action",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/read",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/write",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/delete",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/cancel/action",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/listKeys/action",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/refreshFulfillment/action",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/productKeys/read",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/productKeys/showFullKey/action",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/productDownloadOptions/read",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/productDownloadOptions/generateDownloadLinks/action",
|                                                    "Microsoft.SoftwarePlan/validateSoftwareSubscriptionCreate/action",
|                                                    "Microsoft.SoftwarePlan/softwareLicenses/read",
|                                                    "Microsoft.SoftwarePlan/softwareLicenses/write",
|                                                    "Microsoft.SoftwarePlan/softwareLicenses/productKeys/read",
|                                                    "Microsoft.SoftwarePlan/softwareLicenses/productKeys/showFullKey/action",
|                                                    "Microsoft.SoftwarePlan/softwareLicenses/productDownloadOptions/read",
|                                                    "Microsoft.SoftwarePlan/softwareLicenses/productDownloadOptions/generateDownloadLinks/action",
|                                                    "Microsoft.SoftwarePlan/validateSoftwareLicenseCreate/action",
|                                                    "Microsoft.Hardware/register/action",
|                                                    "Microsoft.Hardware/orderPreview/action",
|                                                    "Microsoft.Hardware/orders/read",
|                                                    "Microsoft.Hardware/orders/write",
|                                                    "Microsoft.Hardware/orders/delete",
|                                                    "Microsoft.Hardware/returnPreview/action",
|                                                    "Microsoft.Hardware/returns/read",
|                                                    "Microsoft.Hardware/returns/write",
|                                                    "Microsoft.Hardware/returns/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ea01e6af-a1c1-4350-9563-ad00f8c72ec5",
|                                    "Name":  "Azure Machine Learning Workspace Connection Secrets Reader",
|                                    "Description":  "Can list workspace connection secrets",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/connections/listsecrets/action",
|                                                    "Microsoft.MachineLearningServices/workspaces/metadata/secrets/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "79b01272-bf9f-4f4c-9517-5506269cf524",
|                                    "Name":  "Cognitive Search Serverless Data Reader (Deprecated)",
|                                    "Description":  "This role has been deprecated",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveSearch/indexes/schema/read",
|                                                        "Microsoft.CognitiveSearch/indexes/documents/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7ac06ca7-21ca-47e3-a67b-cbd6e6223baf",
|                                    "Name":  "Cognitive Search Serverless Data Contributor (Deprecated)",
|                                    "Description":  "This role has been deprecated",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveSearch/indexes/schema/*",
|                                                        "Microsoft.CognitiveSearch/indexes/documents/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5e28a61e-8040-49db-b175-bb5b88af6239",
|                                    "Name":  "Community Owner Role",
|                                    "Description":  "Community Owner Role to access the resources of Microsoft.Mission stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/register/action",
|                                                    "Microsoft.Mission/unregister/action",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/communities/read",
|                                                    "Microsoft.Mission/communities/write",
|                                                    "Microsoft.Mission/communities/delete",
|                                                    "Microsoft.Mission/communities/setMaintenanceMode/action",
|                                                    "Microsoft.Mission/communities/communityendpoints/connect/action",
|                                                    "Microsoft.Mission/communities/dedicatedHubs/connect/action",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/write",
|                                                    "Microsoft.Mission/virtualEnclaves/delete",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/write",
|                                                    "Microsoft.Mission/communities/communityEndpoints/delete",
|                                                    "Microsoft.Mission/communities/transitHubs/read",
|                                                    "Microsoft.Mission/communities/transitHubs/write",
|                                                    "Microsoft.Mission/communities/transitHubs/delete",
|                                                    "Microsoft.Mission/communities/dedicatedHubs/read",
|                                                    "Microsoft.Mission/communities/dedicatedHubs/write",
|                                                    "Microsoft.Mission/communities/dedicatedHubs/delete",
|                                                    "Microsoft.Mission/enclaveConnections/read",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                    "Microsoft.Mission/approvals/read",
|                                                    "Microsoft.Mission/approvals/write",
|                                                    "Microsoft.Mission/approvals/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9c1607d1-791d-4c68-885d-c7b7aaff7c8a",
|                                    "Name":  "Firmware Analysis Admin",
|                                    "Description":  "Administrative user that can upload/view firmwares \u0026 configure firmware workspaces",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.IoTFirmwareDefense/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8b54135c-b56d-4d72-a534-26097cfdc8d8",
|                                    "Name":  "Key Vault Data Access Administrator",
|                                    "Description":  "Manage access to Azure Key Vault by adding or removing role assignments for the Key Vault Administrator, Key Vault Certificates Officer, Key Vault Crypto Officer, Key Vault Crypto Service Encryption User, Key Vault Crypto User, Key Vault Reader, Key Vault Secrets Officer, or Key Vault Secrets User roles. Includes an ABAC condition to constrain role assignments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.KeyVault/vaults/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1e7ca9b1-60d1-4db8-a914-f2ca1ff27c40",
|                                    "Name":  "Defender for Storage Data Scanner",
|                                    "Description":  "Grants access to read blobs and update index tags. This role is used by the data scanner of Defender for Storage.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "df2711a6-406d-41cf-b366-b0250bff9ad1",
|                                    "Name":  "Compute Diagnostics Role",
|                                    "Description":  "Grants permissions to execute diagnostics provided by Compute Diagnostic Service for Compute Resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action",
|                                                    "Microsoft.Compute/virtualmachinescalesets/disks/beginGetAccess/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fa6cecf6-5db3-4c43-8470-c540bcb4eafa",
|                                    "Name":  "Elastic SAN Network Admin",
|                                    "Description":  "Allows access to create Private Endpoints on SAN resources, and to read SAN resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ElasticSan/elasticSans/*/read",
|                                                    "Microsoft.ElasticSan/elasticSans/PrivateEndpointConnectionsApproval/action",
|                                                    "Microsoft.ElasticSan/elasticSans/privateEndpointConnections/write",
|                                                    "Microsoft.ElasticSan/elasticSans/privateEndpointConnections/delete",
|                                                    "Microsoft.ElasticSan/locations/asyncoperations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bba48692-92b0-4667-a9ad-c31c7b334ac2",
|                                    "Name":  "Cognitive Services Usages Reader",
|                                    "Description":  "Minimal permission to view Cognitive Services usages.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/locations/usages/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c088a766-074b-43ba-90d4-1fb21feae531",
|                                    "Name":  "PostgreSQL Flexible Server Long Term Retention Backup Role",
|                                    "Description":  "Role to allow backup vault to access PostgreSQL Flexible Server Resource APIs for Long Term Retention Backup.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackup/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackupAccess/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackupOperations/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackupPreCheck/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrPreBackup/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrRestoreFinalize/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrRestoreInitialize/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrRestorePreCheck/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/startLtrBackup/action",
|                                                    "Microsoft.DBforPostgreSQL/locations/azureAsyncOperation/read",
|                                                    "Microsoft.DBforPostgreSQL/locations/operationResults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a02f7c31-354d-4106-865a-deedf37fa038",
|                                    "Name":  "Search Parameter Manager",
|                                    "Description":  "Role allows user or principal access to $status and $reindex to update search parameters",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/reindex/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/write",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/searchparameter/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "66f75aeb-eabe-4b70-9f1e-c350c4c9ad04",
|                                    "Name":  "Virtual Machine Data Access Administrator (preview)",
|                                    "Description":  "Manage access to Virtual Machines by adding or removing role assignments for the Virtual Machine Administrator Login and Virtual Machine User Login roles. Includes an ABAC condition to constrain role assignments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Compute/virtualMachines/*/read",
|                                                    "Microsoft.HybridCompute/machines/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4accf36b-2c05-432f-91c8-5c532dff4c73",
|                                    "Name":  "Logic Apps Standard Reader (Preview)",
|                                    "Description":  "You have read-only access to all resources in a Standard logic app and workflows, including the workflow runs and their history.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "523776ba-4eb2-4600-a3c8-f2dc93da4bdb",
|                                    "Name":  "Logic Apps Standard Developer (Preview)",
|                                    "Description":  "You can create and edit workflows, connections, and settings for a Standard logic app. You can\u0027t make changes outside the workflow scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/*/read",
|                                                    "Microsoft.Web/connections/*",
|                                                    "Microsoft.Web/customApis/*",
|                                                    "Microsoft.Web/sites/config/list/Action",
|                                                    "microsoft.web/sites/config/Write",
|                                                    "microsoft.web/sites/config/web/appsettings/delete",
|                                                    "microsoft.web/sites/config/web/appsettings/write",
|                                                    "microsoft.web/sites/deployWorkflowArtifacts/action",
|                                                    "microsoft.web/sites/hostruntime/*",
|                                                    "microsoft.web/sites/listworkflowsconnections/action",
|                                                    "Microsoft.Web/sites/publish/Action",
|                                                    "microsoft.web/sites/slots/config/appsettings/write",
|                                                    "Microsoft.Web/sites/slots/config/list/Action",
|                                                    "microsoft.web/sites/slots/config/web/appsettings/delete",
|                                                    "microsoft.web/sites/slots/deployWorkflowArtifacts/action",
|                                                    "microsoft.web/sites/slots/listworkflowsconnections/action",
|                                                    "Microsoft.Web/sites/slots/publish/Action",
|                                                    "microsoft.web/sites/workflows/*",
|                                                    "microsoft.web/sites/workflowsconfiguration/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ad710c24-b039-4e85-a019-deb4a06e8570",
|                                    "Name":  "Logic Apps Standard Contributor (Preview)",
|                                    "Description":  "You can manage all aspects of a Standard logic app and workflows. You can\u0027t change access or ownership.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/*/read",
|                                                    "Microsoft.Web/certificates/*",
|                                                    "Microsoft.Web/connectionGateways/*",
|                                                    "Microsoft.Web/connections/*",
|                                                    "Microsoft.Web/customApis/*",
|                                                    "Microsoft.Web/serverFarms/*",
|                                                    "Microsoft.Web/sites/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b70c96e9-66fe-4c09-b6e7-c98e69c98555",
|                                    "Name":  "Logic Apps Standard Operator (Preview)",
|                                    "Description":  "You can enable and disable the logic app, resubmit workflow runs, as well as create connections. You can\u0027t edit workflows or settings.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/*/read",
|                                                    "Microsoft.Web/sites/applySlotConfig/Action",
|                                                    "microsoft.web/sites/hostruntime/*",
|                                                    "Microsoft.Web/sites/restart/Action",
|                                                    "Microsoft.Web/sites/slots/restart/Action",
|                                                    "Microsoft.Web/sites/slots/slotsswap/Action",
|                                                    "Microsoft.Web/sites/slots/start/Action",
|                                                    "Microsoft.Web/sites/slots/stop/Action",
|                                                    "Microsoft.Web/sites/slotsdiffs/Action",
|                                                    "Microsoft.Web/sites/slotsswap/Action",
|                                                    "Microsoft.Web/sites/start/Action",
|                                                    "Microsoft.Web/sites/stop/Action",
|                                                    "Microsoft.Web/sites/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7b3e853f-ad5d-4fb5-a7b8-56a3581c7037",
|                                    "Name":  "IPAM Pool User",
|                                    "Description":  "Read IPAM Pools and child resources. Create and remove associations. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/networkManagers/ipamPools/*/read",
|                                                    "Microsoft.Network/networkManagers/ipamPools/*/action",
|                                                    "Microsoft.Network/networkManagers/ipamPools/*/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e9c9ed2b-2a99-4071-b2ff-5b113ebf73a1",
|                                    "Name":  "SpatialMapsAccounts Account Owner",
|                                    "Description":  "Lets you manage data in your account, including deleting them",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/spatialMapsAccounts/read",
|                                                        "Microsoft.MixedReality/spatialMapsAccounts/delete",
|                                                        "Microsoft.MixedReality/spatialMapsAccounts/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0b962ed2-6d56-471c-bd5f-3477d83a7ba4",
|                                    "Name":  "Azure Resource Notifications System Topics Subscriber",
|                                    "Description":  "Lets you create system topics and event subscriptions on all system topics exposed currently and in the future by Azure Resource Notifications",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToResources/action",
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToHealthResources/action",
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToMaintenanceResources/action",
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToComputeResources/action",
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToComputeScheduleResources/action",
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToContainerServiceEventResources/action",
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToImpactReportingResources/action",
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToAksResources/action",
|                                                    "Microsoft.EventGrid/eventSubscriptions/write",
|                                                    "Microsoft.EventGrid/systemTopics/eventSubscriptions/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1c4770c0-34f7-4110-a1ea-a5855cc7a939",
|                                    "Name":  "Elastic SAN Snapshot Exporter",
|                                    "Description":  "Allows for creating and exporting Snapshot of Elastic San Volume",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ElasticSan/elasticSans/*/read",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/snapshots/write",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/snapshots/delete",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/snapshots/beginGetAccess/action",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/preBackup/action",
|                                                    "Microsoft.ElasticSan/locations/*",
|                                                    "Microsoft.Compute/locations/*",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/snapshots/read",
|                                                    "Microsoft.Compute/snapshots/write",
|                                                    "Microsoft.Compute/snapshots/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "90e8b822-3e73-47b5-868a-787dc80c008f",
|                                    "Name":  "Elastic SAN Volume Importer",
|                                    "Description":  "Allows for Importing Elastic San Volume",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/*/read",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/write",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/delete",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/preRestore/action",
|                                                    "Microsoft.ElasticSan/locations/*",
|                                                    "Microsoft.Compute/locations/*",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action",
|                                                    "Microsoft.Compute/disks/endGetAccess/action",
|                                                    "Microsoft.Compute/snapshots/read",
|                                                    "Microsoft.Compute/snapshots/beginGetAccess/action",
|                                                    "Microsoft.Compute/snapshots/endGetAccess/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "49435da6-99fe-48a5-a235-fc668b9dc04a",
|                                    "Name":  "Community Contributor Role",
|                                    "Description":  "Community Contributor Role to access the resources of Microsoft.Mission stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/register/action",
|                                                    "Microsoft.Mission/unregister/action",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/communities/read",
|                                                    "Microsoft.Mission/communities/write",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/write",
|                                                    "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                    "Microsoft.Mission/virtualEnclaves/endpoints/write",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/write",
|                                                    "Microsoft.Mission/communities/transitHubs/read",
|                                                    "Microsoft.Mission/communities/transitHubs/write",
|                                                    "Microsoft.Mission/enclaveConnections/read",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                    "Microsoft.Mission/approvals/read",
|                                                    "Microsoft.Mission/approvals/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4b0f2fd7-60b4-4eca-896f-4435034f8bf5",
|                                    "Name":  "EventGrid TopicSpaces Subscriber",
|                                    "Description":  "Lets you subscribe messages on topicspaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventGrid/topicSpaces/subscribe/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a12b0b94-b317-4dcd-84a8-502ce99884c6",
|                                    "Name":  "EventGrid TopicSpaces Publisher",
|                                    "Description":  "Lets you publish messages on topicspaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventGrid/topicSpaces/publish/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d1a38570-4b05-4d70-b8e4-1100bcf76d12",
|                                    "Name":  "Data Boundary Tenant Administrator",
|                                    "Description":  "Allows tenant level administration for data boundaries.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/dataBoundaries/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8a90fa6b-6997-4a07-8a95-30633a7c97b9",
|                                    "Name":  "DeID Batch Data Owner",
|                                    "Description":  "Create and manage DeID batch jobs. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthDataAIServices/DeidServices/Batch/write",
|                                                        "Microsoft.HealthDataAIServices/DeidServices/Batch/delete",
|                                                        "Microsoft.HealthDataAIServices/DeidServices/Batch/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b73a14ee-91f5-41b7-bd81-920e12466be9",
|                                    "Name":  "DeID Batch Data Reader",
|                                    "Description":  "Read DeID batch jobs. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthDataAIServices/DeidServices/Batch/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bb6577c4-ea0a-40b2-8962-ea18cb8ecd4e",
|                                    "Name":  "DeID Realtime Data User",
|                                    "Description":  "Execute requests against DeID realtime endpoint. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthDataAIServices/DeidServices/Realtime/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fa0d39e6-28e5-40cf-8521-1eb320653a4c",
|                                    "Name":  "Carbon Optimization Reader",
|                                    "Description":  "Allow read access to Azure Carbon Optimization data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Carbon/carbonEmissionReports/action",
|                                                    "Microsoft.Carbon/carbonEmissionReports/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "38863829-c2a4-4f8d-b1d2-2e325973ebc7",
|                                    "Name":  "Landing Zone Management Owner",
|                                    "Description":  "Microsoft.Sovereign Landing Zone Management Owner allowing to review and modify Landing Zone Configurations as well as reading and adding Landing Zone Registrations. Also enables read-access to policies and management groups for enabling the full user experience of the Sovereign Services RP in the Azure Portal (as otherwise some elements might not be accessible to end users).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sovereign/landingZoneConfigurations/*",
|                                                    "Microsoft.Sovereign/landingZoneRegistrations/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8fe6e843-6d9e-417b-9073-106b048f50bb",
|                                    "Name":  "Landing Zone Management Reader",
|                                    "Description":  "Microsoft.Sovereign Landing Zone Management Reader allowing to review Landing Zone Configurations and corresponding Registrations without the ability to modify. Also enables read-access to policies and management groups for enabling the full user experience of the Sovereign Services RP in the Azure Portal (as otherwise some elements might not be accessible to end users).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sovereign/landingZoneConfigurations/read",
|                                                    "Microsoft.Sovereign/landingZoneRegistrations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "865ae368-6a45-4bd1-8fbf-0d5151f56fc1",
|                                    "Name":  "Azure Stack HCI Device Management Role",
|                                    "Description":  "Microsoft.AzureStackHCI Device Management Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/Clusters/*",
|                                                    "Microsoft.AzureStackHCI/EdgeDevices/*",
|                                                    "Microsoft.AzureStackHCI/DevicePools/*/read",
|                                                    "Microsoft.AzureStackHCI/EdgeMachines/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.HybridContainerService/register/action",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                    "Microsoft.HybridContainerService/skus/read",
|                                                    "Microsoft.HybridContainerService/skus/write",
|                                                    "Microsoft.Authorization/roleassignments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Write",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                    "Microsoft.AzureStackHCI/LogicalNetworks/Read",
|                                                    "Microsoft.AzureStackHCI/LogicalNetworks/Write",
|                                                    "Microsoft.AzureStackHCI/Register/Action",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                    "Microsoft.KubernetesConfiguration/operations/read",
|                                                    "Microsoft.ResourceConnector/appliances/read",
|                                                    "Microsoft.ResourceConnector/appliances/write",
|                                                    "Microsoft.ResourceConnector/appliances/delete",
|                                                    "Microsoft.ResourceConnector/locations/operationresults/read",
|                                                    "Microsoft.ResourceConnector/locations/operationsstatus/read",
|                                                    "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                    "Microsoft.ResourceConnector/appliances/listKeys/action",
|                                                    "Microsoft.ResourceConnector/appliances/upgradeGraphs/read",
|                                                    "Microsoft.ResourceConnector/telemetryconfig/read",
|                                                    "Microsoft.ResourceConnector/operations/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/write",
|                                                    "Microsoft.ExtendedLocation/customLocations/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4dae6930-7baf-46f5-909e-0383bc931c46",
|                                    "Name":  "Azure Customer Lockbox Approver for Subscription",
|                                    "Description":  "Can approve Microsoft support requests to access specific resources contained within a subscription, or the subscription itself, when Customer Lockbox for Microsoft Azure is enabled on the tenant where the subscription resides.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.CustomerLockbox/requests/UpdateApproval/action",
|                                                    "Microsoft.CustomerLockbox/requests/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/eventtypes/values/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7b1f81f9-4196-4058-8aae-762e593270df",
|                                    "Name":  "Azure Resource Bridge Deployment Role",
|                                    "Description":  "Azure Resource Bridge Deployment Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleassignments/read",
|                                                    "Microsoft.AzureStackHCI/Register/Action",
|                                                    "Microsoft.ResourceConnector/register/action",
|                                                    "Microsoft.ResourceConnector/appliances/read",
|                                                    "Microsoft.ResourceConnector/appliances/write",
|                                                    "Microsoft.ResourceConnector/appliances/delete",
|                                                    "Microsoft.ResourceConnector/locations/operationresults/read",
|                                                    "Microsoft.ResourceConnector/locations/operationsstatus/read",
|                                                    "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                    "Microsoft.ResourceConnector/appliances/listKeys/action",
|                                                    "Microsoft.ResourceConnector/appliances/upgradeGraphs/read",
|                                                    "Microsoft.ResourceConnector/telemetryconfig/read",
|                                                    "Microsoft.ResourceConnector/operations/read",
|                                                    "Microsoft.ExtendedLocation/register/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/write",
|                                                    "Microsoft.ExtendedLocation/customLocations/delete",
|                                                    "Microsoft.HybridConnectivity/register/action",
|                                                    "Microsoft.Kubernetes/register/action",
|                                                    "Microsoft.KubernetesConfiguration/register/action",
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                    "Microsoft.KubernetesConfiguration/operations/read",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                    "Microsoft.HybridContainerService/register/action",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                    "Microsoft.HybridContainerService/skus/read",
|                                                    "Microsoft.HybridContainerService/skus/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Write",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "874d1c73-6003-4e60-a13a-cb31ea190a85",
|                                    "Name":  "Azure Stack HCI VM Contributor",
|                                    "Description":  "Grants permissions to perform all VM actions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/VirtualMachines/*",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/*",
|                                                    "Microsoft.AzureStackHCI/NetworkInterfaces/*",
|                                                    "Microsoft.AzureStackHCI/VirtualHardDisks/*",
|                                                    "Microsoft.AzureStackHCI/VirtualNetworks/Read",
|                                                    "Microsoft.AzureStackHCI/VirtualNetworks/join/action",
|                                                    "Microsoft.AzureStackHCI/LogicalNetworks/Read",
|                                                    "Microsoft.AzureStackHCI/LogicalNetworks/join/action",
|                                                    "Microsoft.AzureStackHCI/GalleryImages/Read",
|                                                    "Microsoft.AzureStackHCI/GalleryImages/deploy/action",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/deploy/action",
|                                                    "Microsoft.AzureStackHCI/MarketplaceGalleryImages/Read",
|                                                    "Microsoft.AzureStackHCI/MarketPlaceGalleryImages/deploy/action",
|                                                    "Microsoft.AzureStackHCI/Clusters/Read",
|                                                    "Microsoft.AzureStackHCI/Clusters/ArcSettings/Read",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/Read",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                    "Microsoft.HybridCompute/machines/installPatches/action",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                    "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/write",
|                                                    "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                    "Microsoft.HybridCompute/licenses/read",
|                                                    "Microsoft.HybridCompute/licenses/write",
|                                                    "Microsoft.HybridCompute/licenses/delete",
|                                                    "Microsoft.ExtendedLocation/customLocations/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4b3fe76c-f777-4d24-a2d7-b027b0f7b273",
|                                    "Name":  "Azure Stack HCI VM Reader",
|                                    "Description":  "Grants permissions to view VMs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/VirtualMachines/Read",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/Read",
|                                                    "Microsoft.AzureStackHCI/VirtualMachines/Extensions/Read",
|                                                    "Microsoft.AzureStackHCI/VirtualNetworks/Read",
|                                                    "Microsoft.AzureStackHCI/LogicalNetworks/Read",
|                                                    "Microsoft.AzureStackHCI/NetworkInterfaces/Read",
|                                                    "Microsoft.AzureStackHCI/VirtualHardDisks/Read",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                    "Microsoft.AzureStackHCI/GalleryImages/Read",
|                                                    "Microsoft.AzureStackHCI/MarketplaceGalleryImages/Read",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/Read",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read",
|                                                    "Microsoft.HybridCompute/licenses/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/privateLinkScopes/networkSecurityPerimeterConfigurations/read",
|                                                    "Microsoft.HybridCompute/privateLinkScopes/privateEndpointConnections/read",
|                                                    "Microsoft.HybridCompute/privateLinkScopes/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "64702f94-c441-49e6-a78b-ef80e0188fee",
|                                    "Name":  "Azure AI Developer",
|                                    "Description":  "Can perform all actions within an Azure AI resource besides managing the resource itself.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/*/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/*/action",
|                                                    "Microsoft.MachineLearningServices/workspaces/*/delete",
|                                                    "Microsoft.MachineLearningServices/workspaces/*/write",
|                                                    "Microsoft.MachineLearningServices/locations/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.MachineLearningServices/workspaces/delete",
|                                                       "Microsoft.MachineLearningServices/workspaces/write",
|                                                       "Microsoft.MachineLearningServices/workspaces/listKeys/action",
|                                                       "Microsoft.MachineLearningServices/workspaces/hubs/write",
|                                                       "Microsoft.MachineLearningServices/workspaces/hubs/delete",
|                                                       "Microsoft.MachineLearningServices/workspaces/featurestores/write",
|                                                       "Microsoft.MachineLearningServices/workspaces/featurestores/delete",
|                                                       "Microsoft.MachineLearningServices/workspaces/evaluations/results/labels/read",
|                                                       "Microsoft.MachineLearningServices/workspaces/evaluations/results/reasonings/read",
|                                                       "Microsoft.MachineLearningServices/workspaces/simulations/results/images/read"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/*",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*",
|                                                        "Microsoft.CognitiveServices/accounts/ContentSafety/*",
|                                                        "Microsoft.CognitiveServices/accounts/MaaS/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "eb960402-bf75-4cc3-8d68-35b34f960f72",
|                                    "Name":  "Deployment Environments Reader",
|                                    "Description":  "Provides read access to environment resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DevCenter/projects/read",
|                                                    "Microsoft.DevCenter/projects/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.DevCenter/projects/pools/read",
|                                                       "Microsoft.DevCenter/projects/pools/schedules/read"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DevCenter/projects/users/environments/adminRead/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminActionRead/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminOutputsRead/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1d8c3fe3-8864-474b-8749-01e3783e8157",
|                                    "Name":  "EventGrid Data Contributor",
|                                    "Description":  "Allows send and receive access to event grid events.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.EventGrid/topics/read",
|                                                    "Microsoft.EventGrid/domains/read",
|                                                    "Microsoft.EventGrid/partnerNamespaces/read",
|                                                    "Microsoft.EventGrid/namespaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventGrid/events/send/action",
|                                                        "Microsoft.EventGrid/events/receive/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "78cbd9e7-9798-4e2e-9b5a-547d9ebb31fb",
|                                    "Name":  "EventGrid Data Receiver",
|                                    "Description":  "Allows receive access to event grid events.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.EventGrid/namespaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventGrid/events/receive/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3afb7f49-54cb-416e-8c09-6dc049efa503",
|                                    "Name":  "Azure AI Inference Deployment Operator",
|                                    "Description":  "Can perform all actions required to create a resource deployment within a resource group.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Insights/AutoscaleSettings/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "65a14201-8f6c-4c28-bec4-12619c5a9aaa",
|                                    "Name":  "Connected Cluster Managed Identity CheckAccess Reader",
|                                    "Description":  "Built-in role that allows a Connected Cluster managed identity to call the checkAccess API",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c64499e0-74c3-47ad-921c-13865957895c",
|                                    "Name":  "Advisor Reviews Reader",
|                                    "Description":  "View reviews for a workload and recommendations linked to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Advisor/resiliencyReviews/read",
|                                                    "Microsoft.Advisor/triageRecommendations/read",
|                                                    "Microsoft.Advisor/triageResources/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8aac15f0-d885-4138-8afa-bfb5872f7d13",
|                                    "Name":  "Advisor Reviews Contributor",
|                                    "Description":  "View reviews for a workload and triage recommendations linked to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Advisor/resiliencyReviews/read",
|                                                    "Microsoft.Advisor/triageRecommendations/read",
|                                                    "Microsoft.Advisor/triageRecommendations/approve/action",
|                                                    "Microsoft.Advisor/triageRecommendations/reject/action",
|                                                    "Microsoft.Advisor/triageRecommendations/reset/action",
|                                                    "Microsoft.Advisor/triageResources/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a8d4b70f-0fb9-4f72-b267-b87b2f990aec",
|                                    "Name":  "AgFood Platform Dataset Admin",
|                                    "Description":  "Provides access to Dataset APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/datasets/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/datasetRecords/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0f641de8-0b88-4198-bdef-bd8b45ceba96",
|                                    "Name":  "Defender for Storage Scanner Operator",
|                                    "Description":  "Lets you enable and configure Microsoft Defender for Storage\u0027s malware scanning and sensitive data discovery features on your storage accounts. Includes an ABAC condition to limit role assignments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Security/defenderforstoragesettings/read",
|                                                    "Microsoft.Security/defenderforstoragesettings/write",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Security/datascanners/read",
|                                                    "Microsoft.Security/datascanners/write",
|                                                    "Microsoft.Security/dataScanners/delete",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.EventGrid/topics/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/write",
|                                                    "Microsoft.EventGrid/eventSubscriptions/delete",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "662802e2-50f6-46b0-aed2-e834bacc6d12",
|                                    "Name":  "Azure Front Door Profile Reader",
|                                    "Description":  "Can view AFD standard and premium profiles and their endpoints, but can\u0027t make changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cdn/edgenodes/read",
|                                                    "Microsoft.Cdn/operationresults/*",
|                                                    "Microsoft.Cdn/profiles/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Cdn/operationresults/profileresults/afdendpointresults/CheckCustomDomainDNSMappingStatus/action",
|                                                    "Microsoft.Cdn/profiles/queryloganalyticsmetrics/action",
|                                                    "Microsoft.Cdn/profiles/queryloganalyticsrankings/action",
|                                                    "Microsoft.Cdn/profiles/querywafloganalyticsmetrics/action",
|                                                    "Microsoft.Cdn/profiles/querywafloganalyticsrankings/action",
|                                                    "Microsoft.Cdn/profiles/afdendpoints/CheckCustomDomainDNSMappingStatus/action",
|                                                    "Microsoft.Cdn/profiles/Usages/action",
|                                                    "Microsoft.Cdn/profiles/afdendpoints/Usages/action",
|                                                    "Microsoft.Cdn/profiles/origingroups/Usages/action",
|                                                    "Microsoft.Cdn/profiles/rulesets/Usages/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "86fede04-b259-4277-8c3e-e26b9865abd8",
|                                    "Name":  "Enclave Reader Role",
|                                    "Description":  "Enclave Reader Role to access the resources of Microsoft.Mission stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/communities/read",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/read",
|                                                    "Microsoft.Mission/communities/transitHubs/read",
|                                                    "Microsoft.Mission/enclaveConnections/read",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                    "Microsoft.Mission/approvals/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b5092dac-c796-4349-8681-1a322a31c3f9",
|                                    "Name":  "Azure Kubernetes Service Hybrid Cluster Admin Role",
|                                    "Description":  "List cluster admin credential action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/listAdminKubeconfig/action",
|                                                    "Microsoft.Kubernetes/connectedClusters/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fc3f91a1-40bf-4439-8c46-45edbd83563a",
|                                    "Name":  "Azure Kubernetes Service Hybrid Cluster User Role",
|                                    "Description":  "List cluster user credential action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/listUserKubeconfig/action",
|                                                    "Microsoft.Kubernetes/connectedClusters/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e7037d40-443a-4434-a3fb-8cd202011e1d",
|                                    "Name":  "Azure Kubernetes Service Hybrid Contributor Role",
|                                    "Description":  "Grants access to read and write Azure Kubernetes Services hybrid clusters",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridContainerService/Locations/operationStatuses/read",
|                                                    "Microsoft.HybridContainerService/Operations/read",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/delete",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/write",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/delete",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/write",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/delete",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/upgradeProfiles/read",
|                                                    "Microsoft.HybridContainerService/skus/read",
|                                                    "Microsoft.HybridContainerService/skus/write",
|                                                    "Microsoft.HybridContainerService/skus/delete",
|                                                    "Microsoft.HybridContainerService/virtualNetworks/read",
|                                                    "Microsoft.HybridContainerService/virtualNetworks/write",
|                                                    "Microsoft.HybridContainerService/virtualNetworks/delete",
|                                                    "Microsoft.Kubernetes/connectedClusters/Read",
|                                                    "Microsoft.Kubernetes/connectedClusters/Write",
|                                                    "Microsoft.Kubernetes/connectedClusters/Delete",
|                                                    "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3d5f3eff-eb94-473d-91e3-7aac74d6c0bb",
|                                    "Name":  "Enclave Owner Role",
|                                    "Description":  "Enclave Owner Role to access the resources of Microsoft.Mission stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/write",
|                                                    "Microsoft.Mission/virtualEnclaves/delete",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/delete",
|                                                    "Microsoft.Mission/communities/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/read",
|                                                    "Microsoft.Mission/communities/transitHubs/read",
|                                                    "Microsoft.Mission/enclaveConnections/read",
|                                                    "Microsoft.Mission/enclaveConnections/write",
|                                                    "Microsoft.Mission/enclaveConnections/delete",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/write",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/delete",
|                                                    "Microsoft.Mission/approvals/read",
|                                                    "Microsoft.Mission/approvals/write",
|                                                    "Microsoft.Mission/approvals/delete",
|                                                    "Microsoft.Mission/virtualEnclaves/setWorkloadRoleAssignments/action",
|                                                    "Microsoft.Mission/virtualEnclaves/setEnclaveRoleAssignments/action",
|                                                    "Microsoft.Mission/virtualenclaves/setMaintenanceMode/action",
|                                                    "Microsoft.Mission/virtualEnclaves/setSubnetConfiguration/action",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/connect/action",
|                                                    "Microsoft.Mission/enclaveConnections/setSourceCidr/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e6aadb6b-e64f-41c0-9392-d2bba3bc3ebc",
|                                    "Name":  "Community Reader Role",
|                                    "Description":  "Community Reader Role to access the resources of Microsoft.Mission stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/communities/read",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/read",
|                                                    "Microsoft.Mission/communities/transitHubs/read",
|                                                    "Microsoft.Mission/enclaveConnections/read",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                    "Microsoft.Mission/approvals/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "19feefae-eacc-4106-81fd-ac34c0671f14",
|                                    "Name":  "Enclave Contributor Role",
|                                    "Description":  "Enclave Contributor Role to access the resources of Microsoft.Mission stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/register/action",
|                                                    "Microsoft.Mission/unregister/action",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/communities/read",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/write",
|                                                    "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                    "Microsoft.Mission/virtualEnclaves/endpoints/write",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/read",
|                                                    "Microsoft.Mission/communities/transitHubs/read",
|                                                    "Microsoft.Mission/enclaveConnections/read",
|                                                    "Microsoft.Mission/enclaveConnections/write",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/write",
|                                                    "Microsoft.Mission/approvals/read",
|                                                    "Microsoft.Mission/approvals/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "44f0a1a8-6fea-4b35-980a-8ff50c487c97",
|                                    "Name":  "Operator Nexus Key Vault Writer Service Role (Preview)",
|                                    "Description":  "(Preview) Provides Azure Operator Nexus services the ability to write to a Key Vault. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.KeyVault/vaults/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/secrets/setSecret/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a316ed6d-1efe-48ac-ac08-f7995a9c26fb",
|                                    "Name":  "Storage Account Encryption Scope Contributor Role",
|                                    "Description":  "Allows management of Encryption Scopes on a Storage Account",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/encryptionScopes/read",
|                                                    "Microsoft.Storage/storageAccounts/encryptionScopes/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "08bbd89e-9f13-488c-ac41-acfcb10c90ab",
|                                    "Name":  "Key Vault Crypto Service Release User",
|                                    "Description":  "Release keys. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/keys/release/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0cd9749a-3aaf-4ae5-8803-bd217705bf3b",
|                                    "Name":  "Kubernetes Runtime Storage Class Contributor Role",
|                                    "Description":  "Read, write, and delete Kubernetes Runtime storage classes in an Arc connected Kubernetes cluster",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.KubernetesRuntime/storageClasses/read",
|                                                    "Microsoft.KubernetesRuntime/storageClasses/write",
|                                                    "Microsoft.KubernetesRuntime/storageClasses/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "609c0c20-e0a0-4a71-b99f-e7e755ac493d",
|                                    "Name":  "Azure Programmable Connectivity Gateway User",
|                                    "Description":  "Allows access to all Gateway dataplane APIs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "db79e9a7-68ee-4b58-9aeb-b90e7c24fcba",
|                                    "Name":  "Key Vault Certificate User",
|                                    "Description":  "Read certificate contents. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/certificates/read",
|                                                        "Microsoft.KeyVault/vaults/secrets/getSecret/action",
|                                                        "Microsoft.KeyVault/vaults/secrets/readMetadata/action",
|                                                        "Microsoft.KeyVault/vaults/keys/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4301dc2a-25a9-44b0-ae63-3636cf7f2bd2",
|                                    "Name":  "Azure Spring Apps Spring Cloud Gateway Log Reader Role",
|                                    "Description":  "Read real-time logs for Spring Cloud Gateway in Azure Spring Apps",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppPlatform/Spring/read",
|                                                    "Microsoft.AppPlatform/Spring/gateways/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/SpringCloudGateway/logstream/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "52fd16bd-6ed5-46af-9c40-29cbd7952a29",
|                                    "Name":  "Azure Spring Apps Managed Components Log Reader Role",
|                                    "Description":  "Read real-time logs for all managed components in Azure Spring Apps",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/managedComponents/logstream/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6593e776-2a30-40f9-8a32-4fe28b77655d",
|                                    "Name":  "Azure Spring Apps Application Configuration Service Log Reader Role",
|                                    "Description":  "Read real-time logs for Application Configuration Service in Azure Spring Apps",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppPlatform/Spring/read",
|                                                    "Microsoft.AppPlatform/Spring/configurationServices/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/ApplicationConfigurationService/logstream/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "207bcc4b-86a6-4487-9141-d6c1f4c238aa",
|                                    "Name":  "Azure Edge On-Site Deployment Engineer",
|                                    "Description":  "Grants you access to take actions as an on-site person to assist in the provisioning of an edge device",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EdgeOrder/orderItems/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c7244dfb-f447-457d-b2ba-3999044d1706",
|                                    "Name":  "Azure API Center Data Reader",
|                                    "Description":  "Allows for access to Azure API Center data plane read operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ApiCenter/services/*/read",
|                                                        "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/exportSpecification/action",
|                                                        "Microsoft.ApiCenter/services/workspaces/search/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dfb2f09d-25f8-4558-8986-497084006d7a",
|                                    "Name":  "Azure impact-insight reader",
|                                    "Description":  "built-in role for azure impact-insight read access",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Impact/WorkloadImpacts/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8bb6f106-b146-4ee6-a3f9-b9c5a96e0ae5",
|                                    "Name":  "Defender Kubernetes Agent Operator",
|                                    "Description":  "Grants Microsoft Defender for Cloud permissions to provision the Kubernetes defender security agent",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.Kubernetes/connectedClusters/Write",
|                                                    "Microsoft.Kubernetes/connectedClusters/read",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                    "Microsoft.Kubernetes/register/action",
|                                                    "Microsoft.KubernetesConfiguration/register/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5b7237c5-45e1-49d6-bc18-a1f62f400748",
|                                    "Name":  "Azure Red Hat OpenShift Disk Storage Operator",
|                                    "Description":  "Install Container Storage Interface (CSI) drivers that enable your cluster to use Azure Disks. Set OpenShift cluster-wide storage defaults to ensure a default storageclass exists for clusters.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/read",
|                                                    "Microsoft.Compute/snapshots/write",
|                                                    "Microsoft.Compute/snapshots/read",
|                                                    "Microsoft.Compute/snapshots/delete",
|                                                    "Microsoft.Compute/locations/operations/read",
|                                                    "Microsoft.Compute/locations/DiskOperations/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4436bae4-7702-4c84-919b-c4069ff25ee2",
|                                    "Name":  "Azure Red Hat OpenShift Service Operator",
|                                    "Description":  "Maintain machine health, network configuration, monitoring, and other features that are specific to an OpenShift cluster\u0027s continued functionality as a managed service.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                    "Microsoft.Network/networkIntentPolicies/join/action",
|                                                    "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Storage/storageAccounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0d7aedc0-15fd-4a67-a412-efad370c947e",
|                                    "Name":  "Azure Red Hat OpenShift File Storage Operator",
|                                    "Description":  "Install Container Storage Interface (CSI) drivers that enable your cluster to use Azure Files. Set OpenShift cluster-wide storage defaults to ensure a default storageclass exists for clusters.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/delete",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/delete",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/write",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/privateEndpoints/write",
|                                                    "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action",
|                                                    "Microsoft.Network/networkIntentPolicies/join/action",
|                                                    "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Network/privateDnsOperationStatuses/read",
|                                                    "Microsoft.Network/privateDnsZones/read",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                    "Microsoft.Network/privateDnsZones/write",
|                                                    "Microsoft.Network/privateDnsZones/join/action",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                    "Microsoft.Network/privateEndpoints/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8b32b316-c2f5-4ddf-b05b-83dacd2d08b5",
|                                    "Name":  "Azure Red Hat OpenShift Image Registry Operator",
|                                    "Description":  "Enables permissions for the operator to manage a singleton instance of the OpenShift image registry. It manages all configuration of the registry, including creating storage.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/delete",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Resources/tags/write",
|                                                    "Microsoft.Network/privateEndpoints/write",
|                                                    "Microsoft.Network/privateEndpoints/read",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                    "Microsoft.Network/privateDnsZones/read",
|                                                    "Microsoft.Network/privateDnsZones/write",
|                                                    "Microsoft.Network/privateDnsZones/join/action",
|                                                    "Microsoft.Network/privateDnsZones/A/write",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/join/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "be7a6435-15ae-4171-8f30-4a343eff9e8f",
|                                    "Name":  "Azure Red Hat OpenShift Network Operator",
|                                    "Description":  "Install and upgrade the networking components on an OpenShift cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                    "Microsoft.Compute/virtualMachines/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a1f96423-95ce-4224-ab27-4e3dc72facd4",
|                                    "Name":  "Azure Red Hat OpenShift Cloud Controller Manager",
|                                    "Description":  "Manage and update the cloud controller manager deployed on top of OpenShift.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/write",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/write",
|                                                    "Microsoft.Network/publicIPAddresses/join/action",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/publicIPAddresses/write",
|                                                    "Microsoft.Network/publicIPAddresses/delete",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/publicIPPrefixes/join/action",
|                                                    "Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/privatelinkservices/write",
|                                                    "Microsoft.Network/privatelinkservices/read",
|                                                    "Microsoft.Network/privatelinkservices/delete",
|                                                    "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                    "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/networkIntentPolicies/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0358943c-7e01-48ba-8889-02cc51d78637",
|                                    "Name":  "Azure Red Hat OpenShift Machine API Operator",
|                                    "Description":  "Manage the lifecycle of specific-purpose custom resource definitions (CRD), controllers, and Azure RBAC objects that extend the Kubernetes API to declares the desired state of machines in a cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/availabilitySets/delete",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/availabilitySets/write",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/galleries/images/versions/read",
|                                                    "Microsoft.Compute/skus/read",
|                                                    "Microsoft.Compute/virtualMachines/delete",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/capacityReservationGroups/deploy/action",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
|                                                    "Microsoft.Network/applicationSecurityGroups/read",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/write",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/write",
|                                                    "Microsoft.Network/publicIPAddresses/delete",
|                                                    "Microsoft.Network/publicIPAddresses/join/action",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/publicIPAddresses/write",
|                                                    "Microsoft.Network/routeTables/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action",
|                                                    "Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action",
|                                                    "Microsoft.Network/loadBalancers/inboundNATRules/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0336e1d3-7a87-462b-b6db-342b63f7802c",
|                                    "Name":  "Azure Red Hat OpenShift Cluster Ingress Operator",
|                                    "Description":  "Manage and configure the OpenShift router.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/dnsZones/A/delete",
|                                                    "Microsoft.Network/dnsZones/A/write",
|                                                    "Microsoft.Network/privateDnsZones/A/delete",
|                                                    "Microsoft.Network/privateDnsZones/A/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5a382001-fe36-41ff-bba4-8bf06bd54da9",
|                                    "Name":  "Azure Sphere Owner",
|                                    "Description":  "Allows user read and write access to Azure Sphere resources and RBAC configuration, includes an ABAC condition to constrain role assignments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureSphere/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/DiagnosticSettings/*",
|                                                    "Microsoft.Insights/DiagnosticSettingsCategories/Read",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e2217c0e-04bb-4724-9580-91cf9871bc01",
|                                    "Name":  "GroupQuota Request Operator",
|                                    "Description":  "Read and create GroupQuota requests, get GroupQuota request status, and get groupQuotaLimits.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "MICROSOFT.QUOTA/QUOTAS/WRITE",
|                                                    "MICROSOFT.QUOTA/QUOTAS/READ",
|                                                    "MICROSOFT.QUOTA/USAGES/READ",
|                                                    "MICROSOFT.QUOTA/QUOTAREQUESTS/READ",
|                                                    "MICROSOFT.QUOTA/REGISTER/ACTION",
|                                                    "Microsoft.Quota/GROUPQUOTAS/*/READ",
|                                                    "Microsoft.Quota/GROUPQUOTAS/*/WRITE",
|                                                    "Microsoft.Quota/GROUPQUOTAS/*/DELETE"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d0f495dc-44ef-4140-aeb0-b89110e6a7c1",
|                                    "Name":  "GroupQuota Reader",
|                                    "Description":  "Read GroupQuota requests, get GroupQuota request status, and get groupQuotaLimits.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "MICROSOFT.QUOTA/QUOTAS/READ",
|                                                    "MICROSOFT.QUOTA/USAGES/READ",
|                                                    "MICROSOFT.QUOTA/QUOTAREQUESTS/READ",
|                                                    "MICROSOFT.QUOTA/REGISTER/ACTION",
|                                                    "Microsoft.Quota/GROUPQUOTAS/READ",
|                                                    "Microsoft.Quota/GROUPQUOTAS/subscriptions/READ",
|                                                    "Microsoft.Quota/GROUPQUOTAS/groupQuotaLimits/READ",
|                                                    "Microsoft.Quota/GROUPQUOTAS/quotaAllocations/READ"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "539283cd-c185-4a9a-9503-d35217a1db7b",
|                                    "Name":  "Bayer Ag Powered Services Smart Boundary Solution User Role",
|                                    "Description":  "Provide access to Smart Boundary Solution by Bayer Ag Powered Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8480c0f0-4509-4229-9339-7c10018cb8c4",
|                                    "Name":  "Defender CSPM Storage Scanner Operator",
|                                    "Description":  "Lets you enable and configure Microsoft Defender CSPM\u0027s sensitive data discovery feature on your storage accounts. Includes an ABAC condition to limit role assignments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Security/datascanners/read",
|                                                    "Microsoft.Security/datascanners/write",
|                                                    "Microsoft.Security/dataScanners/delete",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6b534d80-e337-47c4-864f-140f5c7f593d",
|                                    "Name":  "Advisor Recommendations Contributor (Assessments and Reviews)",
|                                    "Description":  "View assessment recommendations, accepted review recommendations, and manage the recommendations lifecycle (mark recommendations as completed, postponed or dismissed, in progress, or not started).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Advisor/recommendations/read",
|                                                    "Microsoft.Advisor/recommendations/write",
|                                                    "Microsoft.Advisor/recommendations/available/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c9c97b9c-105d-4bb5-a2a7-7d15666c2484",
|                                    "Name":  "GeoCatalog Administrator",
|                                    "Description":  "Grants full access to manage GeoCatalogs, but does not allow you to assign roles in Azure RBAC.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Orbital/operations/read",
|                                                    "Microsoft.Orbital/geoCatalogs/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b7b8f583-43d0-40ae-b147-6b46f53661c1",
|                                    "Name":  "GeoCatalog Reader",
|                                    "Description":  "View GeoCatalogs, but does not allow you to make any changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Orbital/operations/read",
|                                                    "Microsoft.Orbital/geoCatalogs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "eb5a76d5-50e7-4c33-a449-070e7c9c4cf2",
|                                    "Name":  "Healthcare Agent Reader",
|                                    "Description":  "Users with reader access can sign in, have read-only access to the bot resources, scenarios and configuration setting except for the bot instance keys \u0026 secrets (including Authentication, Data Connection and Channels keys) and the end-user inputs (including Feedback, Unrecognized utterances and Conversation logs).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthBot/healthBots/ResourceData/Read",
|                                                        "Microsoft.HealthBot/healthBots/Metadata/Read",
|                                                        "Microsoft.HealthBot/healthBots/CopilotStudioSolution/RestoreBuiltinTemplate/Read",
|                                                        "Microsoft.HealthBot/healthBots/Feedback/Read",
|                                                        "Microsoft.HealthBot/healthBots/Users/Read",
|                                                        "Microsoft.HealthBot/healthBots/AuditTrails/Read",
|                                                        "Microsoft.HealthBot/healthBots/AnalyticReport/Read",
|                                                        "Microsoft.HealthBot/healthBots/ExposedSkill/Read",
|                                                        "Microsoft.HealthBot/healthBots/RegisteredSkills/Read",
|                                                        "Microsoft.HealthBot/healthBots/Configuration/Read",
|                                                        "Microsoft.HealthBot/healthBots/Localization/Read",
|                                                        "Microsoft.HealthBot/healthBots/AuthenticationProviders/Read",
|                                                        "Microsoft.HealthBot/healthBots/DataConnections/Read",
|                                                        "Microsoft.HealthBot/healthBots/OpenAPIPlugins/Read",
|                                                        "Microsoft.HealthBot/healthBots/Scenarios/*/Read",
|                                                        "Microsoft.HealthBot/healthBots/LanguageModels/Read",
|                                                        "Microsoft.HealthBot/healthBots/Resources/Files/Read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "af854a69-80ce-4ff7-8447-f1118a2e0ca8",
|                                    "Name":  "Healthcare Agent Editor",
|                                    "Description":  "Users with editor access can sign in, view and edit all the bot resources, scenarios and configuration setting except for the bot instance keys \u0026 secrets and the end-user inputs (including Feedback, Unrecognized utterances and Conversation logs). A read-only access to the bot skills and channels.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthBot/healthBots/ResourceData/Read",
|                                                        "Microsoft.HealthBot/healthBots/Metadata/Read",
|                                                        "Microsoft.HealthBot/healthBots/CopilotStudioSolution/*",
|                                                        "Microsoft.HealthBot/healthBots/Feedback/Read",
|                                                        "Microsoft.HealthBot/healthBots/Users/Read",
|                                                        "Microsoft.HealthBot/healthBots/AuditTrails/Read",
|                                                        "Microsoft.HealthBot/healthBots/AnalyticReport/Read",
|                                                        "Microsoft.HealthBot/healthBots/ExposedSkill/Read",
|                                                        "Microsoft.HealthBot/healthBots/RegisteredSkills/Read",
|                                                        "Microsoft.HealthBot/healthBots/Configuration/*",
|                                                        "Microsoft.HealthBot/healthBots/Localization/*",
|                                                        "Microsoft.HealthBot/healthBots/AuthenticationProviders/*",
|                                                        "Microsoft.HealthBot/healthBots/Channels/*",
|                                                        "Microsoft.HealthBot/healthBots/DataConnections/*",
|                                                        "Microsoft.HealthBot/healthBots/OpenAPIPlugins/*",
|                                                        "Microsoft.HealthBot/healthBots/Scenarios/*",
|                                                        "Microsoft.HealthBot/healthBots/LanguageModels/*",
|                                                        "Microsoft.HealthBot/healthBots/Resources/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f1082fec-a70f-419f-9230-885d2550fb38",
|                                    "Name":  "Healthcare Agent Admin",
|                                    "Description":  "Users with admin access can sign in, view and edit all of the bot resources, scenarios and configuration setting including the bot instance keys \u0026 secrets.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthBot/healthBots/ResourceData/Read",
|                                                        "Microsoft.HealthBot/healthBots/Metadata/Read",
|                                                        "Microsoft.HealthBot/healthBots/CopilotStudioSolution/*",
|                                                        "Microsoft.HealthBot/healthBots/Feedback/Read",
|                                                        "Microsoft.HealthBot/healthBots/Users/Read",
|                                                        "Microsoft.HealthBot/healthBots/AuditTrails/Read",
|                                                        "Microsoft.HealthBot/healthBots/AnalyticReport/Read",
|                                                        "Microsoft.HealthBot/healthBots/ExposedSkill/Read",
|                                                        "Microsoft.HealthBot/healthBots/RegisteredSkills/Read",
|                                                        "Microsoft.HealthBot/healthBots/Configuration/*",
|                                                        "Microsoft.HealthBot/healthBots/Localization/*",
|                                                        "Microsoft.HealthBot/healthBots/AuthenticationProviders/*",
|                                                        "Microsoft.HealthBot/healthBots/Channels/*",
|                                                        "Microsoft.HealthBot/healthBots/DataConnections/*",
|                                                        "Microsoft.HealthBot/healthBots/OpenAPIPlugins/*",
|                                                        "Microsoft.HealthBot/healthBots/Scenarios/*",
|                                                        "Microsoft.HealthBot/healthBots/LanguageModels/*",
|                                                        "Microsoft.HealthBot/healthBots/Resources/*",
|                                                        "Microsoft.HealthBot/healthBots/Admin/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c20923c5-b089-47a5-bf67-fd89569c4ad9",
|                                    "Name":  "Azure Programmable Connectivity Gateway Dataplane User",
|                                    "Description":  "Allows access to all Gateway dataplane APIs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ProgrammableConnectivity/Gateways/NetworkAPIAccess"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b556d68e-0be0-4f35-a333-ad7ee1ce17ea",
|                                    "Name":  "Azure AI Enterprise Network Connection Approver",
|                                    "Description":  "Can approve private endpoint connections to Azure AI common dependency resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/privateEndpointConnections/read",
|                                                    "Microsoft.ApiManagement/service/privateEndpointConnections/write",
|                                                    "Microsoft.ApiManagement/service/privateLinkResources/read",
|                                                    "Microsoft.ApiManagement/service/read",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/write",
|                                                    "Microsoft.Cache/redis/read",
|                                                    "Microsoft.Cache/redis/privateEndpointConnections/read",
|                                                    "Microsoft.Cache/redis/privateEndpointConnections/write",
|                                                    "Microsoft.Cache/redis/privateLinkResources/read",
|                                                    "Microsoft.Cache/redis/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Cache/redisEnterprise/read",
|                                                    "Microsoft.Cache/redisEnterprise/privateEndpointConnections/read",
|                                                    "Microsoft.Cache/redisEnterprise/privateEndpointConnections/write",
|                                                    "Microsoft.Cache/redisEnterprise/privateLinkResources/read",
|                                                    "Microsoft.Cache/redisEnterprise/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.CognitiveServices/accounts/read",
|                                                    "Microsoft.CognitiveServices/accounts/privateEndpointConnections/read",
|                                                    "Microsoft.CognitiveServices/accounts/privateEndpointConnections/write",
|                                                    "Microsoft.CognitiveServices/accounts/privateLinkResources/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/write",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/privateLinkResources/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/read",
|                                                    "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/read",
|                                                    "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/write",
|                                                    "Microsoft.DBforPostgreSQL/serverGroupsv2/privateLinkResources/read",
|                                                    "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/read",
|                                                    "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/write",
|                                                    "Microsoft.DBforMySQL/flexibleServers/privateLinkResources/read",
|                                                    "Microsoft.DBforMySQL/flexibleServers/read",
|                                                    "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/operationResults/read",
|                                                    "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/read",
|                                                    "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write",
|                                                    "Microsoft.DocumentDB/databaseAccounts/privateLinkResources/read",
|                                                    "Microsoft.DocumentDB/databaseAccounts/read",
|                                                    "Microsoft.KeyVault/vaults/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.KeyVault/vaults/privateEndpointConnections/read",
|                                                    "Microsoft.KeyVault/vaults/privateEndpointConnections/write",
|                                                    "Microsoft.KeyVault/vaults/privateLinkResources/read",
|                                                    "Microsoft.KeyVault/vaults/read",
|                                                    "Microsoft.MachineLearningServices/registries/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.MachineLearningServices/registries/privateEndpointConnections/read",
|                                                    "Microsoft.MachineLearningServices/registries/privateEndpointConnections/write",
|                                                    "Microsoft.MachineLearningServices/registries/privateLinkResources/read",
|                                                    "Microsoft.MachineLearningServices/registries/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/write",
|                                                    "Microsoft.MachineLearningServices/workspaces/privateLinkResources/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/read",
|                                                    "Microsoft.Storage/storageAccounts/privateEndpointConnections/read",
|                                                    "Microsoft.Storage/storageAccounts/privateEndpointConnections/write",
|                                                    "Microsoft.Storage/storageAccounts/privateLinkResources/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Sql/servers/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Sql/servers/privateEndpointConnections/read",
|                                                    "Microsoft.Sql/servers/privateEndpointConnections/write",
|                                                    "Microsoft.Sql/servers/privateLinkResources/read",
|                                                    "Microsoft.Sql/servers/read",
|                                                    "Microsoft.EventHub/namespaces/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.EventHub/namespaces/privateEndpointConnections/read",
|                                                    "Microsoft.EventHub/namespaces/privateEndpointConnections/write",
|                                                    "Microsoft.EventHub/namespaces/privateLinkResources/read",
|                                                    "Microsoft.EventHub/namespaces/read",
|                                                    "Microsoft.Search/searchServices/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Search/searchServices/privateEndpointConnections/read",
|                                                    "Microsoft.Search/searchServices/privateEndpointConnections/write",
|                                                    "Microsoft.Search/searchServices/sharedPrivateLinkResources/read",
|                                                    "Microsoft.Search/searchServices/read",
|                                                    "Microsoft.Insights/privatelinkscopes/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/read",
|                                                    "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/write",
|                                                    "Microsoft.Insights/privatelinkscopes/privateLinkResources/read",
|                                                    "Microsoft.Insights/privatelinkscopes/read",
|                                                    "Microsoft.Network/privateLinkServices/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Network/privateLinkServices/privateEndpointConnections/read",
|                                                    "Microsoft.Network/privateLinkServices/privateEndpointConnections/write",
|                                                    "Microsoft.Network/privateLinkServices/read",
|                                                    "Microsoft.Network/applicationGateways/privateEndpointConnections/read",
|                                                    "Microsoft.Network/applicationGateways/privateEndpointConnections/write",
|                                                    "Microsoft.Network/applicationGateways/privateLinkResources/read",
|                                                    "Microsoft.Network/applicationGateways/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "08d4c71a-cc63-4ce4-a9c8-5dd251b4d619",
|                                    "Name":  "Azure Container Storage Operator",
|                                    "Description":  "Role required by a Managed Identity for Azure Container Storage operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ElasticSan/elasticSans/*",
|                                                    "Microsoft.ElasticSan/locations/asyncoperations/read",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/virtualNetworks/write",
|                                                    "Microsoft.Network/virtualNetworks/delete",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/write",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                    "Microsoft.Resources/subscriptions/providers/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "95dd08a6-00bd-4661-84bf-f6726f83a4d0",
|                                    "Name":  "Azure Container Storage Contributor",
|                                    "Description":  "Lets you install Azure Container Storage and manage its storage resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "95de85bd-744d-4664-9dde-11430bc34793",
|                                    "Name":  "Azure Container Storage Owner",
|                                    "Description":  "Lets you install Azure Container Storage and grants access to its storage resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ElasticSan/elasticSans/*",
|                                                    "Microsoft.ElasticSan/locations/*",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/*",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/*",
|                                                    "Microsoft.ElasticSan/locations/asyncoperations/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d3f1697-4507-4d08-bb4a-477695db5f82",
|                                    "Name":  "Azure Kubernetes Service Arc Contributor Role",
|                                    "Description":  "Grants access to read and write Azure Kubernetes Services hybrid clusters",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridContainerService/Locations/operationStatuses/read",
|                                                    "Microsoft.HybridContainerService/Locations/operationStatuses/write",
|                                                    "Microsoft.HybridContainerService/Operations/read",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/delete",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/write",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/delete",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/write",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/delete",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/upgradeProfiles/read",
|                                                    "Microsoft.HybridContainerService/skus/read",
|                                                    "Microsoft.HybridContainerService/skus/write",
|                                                    "Microsoft.HybridContainerService/skus/delete",
|                                                    "Microsoft.HybridContainerService/virtualNetworks/read",
|                                                    "Microsoft.HybridContainerService/virtualNetworks/write",
|                                                    "Microsoft.HybridContainerService/virtualNetworks/delete",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/read",
|                                                    "Microsoft.Kubernetes/connectedClusters/Read",
|                                                    "Microsoft.Kubernetes/connectedClusters/Write",
|                                                    "Microsoft.Kubernetes/connectedClusters/Delete",
|                                                    "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action",
|                                                    "Microsoft.AzureStackHCI/clusters/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/hybridIdentityMetadata/delete",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/hybridIdentityMetadata/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "233ca253-b031-42ff-9fba-87ef12d6b55f",
|                                    "Name":  "Azure Kubernetes Service Arc Cluster User Role",
|                                    "Description":  "List cluster user credential action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/listUserKubeconfig/action",
|                                                    "Microsoft.Kubernetes/connectedClusters/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b29efa5f-7782-4dc3-9537-4d5bc70a5e9f",
|                                    "Name":  "Azure Kubernetes Service Arc Cluster Admin Role",
|                                    "Description":  "List cluster admin credential action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/listAdminKubeconfig/action",
|                                                    "Microsoft.Kubernetes/connectedClusters/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c2a970b4-16a7-4a51-8c84-8a8ea6ee0bb8",
|                                    "Name":  "Backup MUA Admin",
|                                    "Description":  "Backup MultiUser-Authorization. Can create/delete ResourceGuard ",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DataProtection/*/read",
|                                                    "Microsoft.DataProtection/*/resourceGuards/write",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/write",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/delete",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/read",
|                                                    "Microsoft.DataProtection/locations/operationResults/read",
|                                                    "Microsoft.DataProtection/locations/operationStatus/read",
|                                                    "Microsoft.DataProtection/locations/getBackupStatus/action",
|                                                    "Microsoft.DataProtection/locations/checkFeatureSupport/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/operationStatus/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/write",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/delete",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/unlockDelete/action",
|                                                    "Microsoft.DataProtection/subscriptions/providers/resourceGuards/read",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/{operationName}/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f54b6d04-23c6-443e-b462-9c16ab7b4a52",
|                                    "Name":  "Backup MUA Operator",
|                                    "Description":  "Backup MultiUser-Authorization. Allows user to perform critical operation protected by resourceguard",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DataProtection/*/action",
|                                                    "Microsoft.DataProtection/*/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3d24a3a0-c154-4f6f-a5ed-adc8e01ddb74",
|                                    "Name":  "Savings plan Purchaser",
|                                    "Description":  "Lets you purchase savings plans",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Capacity/register/action",
|                                                    "Microsoft.Capacity/catalogs/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.BillingBenefits/savingsPlanOrders/write",
|                                                    "Microsoft.BIllingBenefits/register/action",
|                                                    "Microsoft.Support/supporttickets/write",
|                                                    "Microsoft.Billing/billingProperty/read",
|                                                    "Microsoft.CostManagement/benefitRecommendations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "399c3b2b-64c2-4ff1-af34-571db925b068",
|                                    "Name":  "CrossConnectionManager",
|                                    "Description":  "Allows for read, write access to ExpressRoute CrossConnections",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ClassicNetwork/expressRouteCrossConnections/*",
|                                                    "Microsoft.Network/expressRouteCrossConnections/*",
|                                                    "Microsoft.Features/providers/features/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Network/expressRouteCrossConnections/delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b6ee44de-fe58-4ddc-b5c2-ab174eb23f05",
|                                    "Name":  "CrossConnectionReader",
|                                    "Description":  "Allows for read access to ExpressRoute CrossConnections",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ClassicNetwork/expressRouteCrossConnections/*/read",
|                                                    "Microsoft.Network/expressRouteCrossConnections/*/read",
|                                                    "Microsoft.Features/providers/features/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5e93ba01-8f92-4c7a-b12a-801e3df23824",
|                                    "Name":  "Defender Containers Sensor",
|                                    "Description":  "Grants Microsoft Defender for Cloud access to Azure Kubernetes Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.ContainerService/managedClusters/read",
|                                                    "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete",
|                                                    "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read",
|                                                    "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write",
|                                                    "Microsoft.ContainerService/managedClusters/write",
|                                                    "Microsoft.Security/pricings/securityoperators/read",
|                                                    "Microsoft.Security/securityOperators/read",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedkeys/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ede9aaa3-4627-494e-be13-4aa7c256148d",
|                                    "Name":  "Azure API Center Compliance Manager",
|                                    "Description":  "Allows managing API compliance in Azure API Center service.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiCenter/services/*/read",
|                                                    "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/updateAnalysisState/action",
|                                                    "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/exportSpecification/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6cba8790-29c5-48e5-bab1-c7541b01cb04",
|                                    "Name":  "Azure API Center Service Reader",
|                                    "Description":  "Allows read-only access to Azure API Center service.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiCenter/services/*/read",
|                                                    "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/exportSpecification/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dd24193f-ef65-44e5-8a7e-6fa6e03f7713",
|                                    "Name":  "Azure API Center Service Contributor",
|                                    "Description":  "Allows managing Azure API Center service.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiCenter/services/*",
|                                                    "Microsoft.ApiCenter/deletedServices/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/updateAnalysisState/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b5b192c1-773c-4543-bfb0-6c59254b74a9",
|                                    "Name":  "Bayer Ag Powered Services Historical Weather Data Solution User Role",
|                                    "Description":  "Provide access to Historical Weather Data Solution by Bayer Ag Powered Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/farms/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4caf51ec-f9f5-413f-8a94-b9f5fddba66b",
|                                    "Name":  "Oracle Subscriptions Manager Built-in Role",
|                                    "Description":  "Grants full access to manage all Oracle Subscriptions resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/write",
|                                                    "Oracle.Database/oracleSubscriptions/*/delete",
|                                                    "Oracle.Database/oracleSubscriptions/*/action",
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Locations/*/write",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4562aac9-b209-4bd7-a144-6d7f3bb516f4",
|                                    "Name":  "Oracle.Database Owner Built-in Role",
|                                    "Description":  "Grants full access to manage all Oracle.Database resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Compute/sshPublicKeys/read",
|                                                    "Microsoft.Compute/sshPublicKeys/write",
|                                                    "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d623d097-b882-4e1e-a26f-ac60e31065a1",
|                                    "Name":  "Oracle.Database Reader Built-in Role",
|                                    "Description":  "Grants read access to all Oracle.Database resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/cloudExadataInfrastructures/*/read",
|                                                    "Oracle.Database/cloudVmClusters/*/read",
|                                                    "Oracle.Database/cloudVmClusters/listPrivateIpAddresses/action",
|                                                    "Oracle.Database/oracleSubscriptions/listCloudAccountDetails/action",
|                                                    "Oracle.Database/exascaleDbStorageVaults/read",
|                                                    "Oracle.Database/exadbVmClusters/*/read",
|                                                    "Oracle.Database/resourceAnchors/read",
|                                                    "Oracle.Database/networkAnchors/read",
|                                                    "Oracle.Database/autonomousDatabases/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/locations/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e9ce8739-6fa2-4123-a0a2-0ef41a67806f",
|                                    "Name":  "Oracle.Database VmCluster Administrator Built-in Role",
|                                    "Description":  "Grants full access to manage all VmCluster resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/cloudVmClusters/*/read",
|                                                    "Oracle.Database/cloudVmClusters/*/write",
|                                                    "Oracle.Database/cloudVmClusters/*/delete",
|                                                    "Oracle.Database/cloudExadataInfrastructures/write",
|                                                    "Oracle.Database/cloudExadataInfrastructures/*/read",
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Locations/*/write",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/resourceAnchors/*",
|                                                    "Oracle.Database/networkAnchors/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Compute/sshPublicKeys/read",
|                                                    "Microsoft.Compute/sshPublicKeys/write",
|                                                    "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4cfdd23b-aece-4fd1-b614-ad3a06c53453",
|                                    "Name":  "Oracle.Database Exadata Infrastructure Administrator Built-in Role",
|                                    "Description":  "Grants full access to manage all Exadata Infrastructure resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/cloudExadataInfrastructures/*/read",
|                                                    "Oracle.Database/cloudExadataInfrastructures/*/write",
|                                                    "Oracle.Database/cloudExadataInfrastructures/*/delete",
|                                                    "Oracle.Database/cloudVmClusters/*/read",
|                                                    "Oracle.Database/cloudVmClusters/*/write",
|                                                    "Oracle.Database/cloudVmClusters/*/delete",
|                                                    "Oracle.Database/cloudVmClusters/*/action",
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Locations/*/write",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/oracleSubscriptions/listCloudAccountDetails/action",
|                                                    "Oracle.Database/resourceAnchors/*",
|                                                    "Oracle.Database/networkAnchors/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Compute/sshPublicKeys/read",
|                                                    "Microsoft.Compute/sshPublicKeys/write",
|                                                    "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "25211fc6-dc78-40b6-b205-e4ac934fd9fd",
|                                    "Name":  "Azure Spring Apps Application Configuration Service Config File Pattern Reader Role",
|                                    "Description":  "Read content of config file pattern for Application Configuration Service in Azure Spring Apps",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppPlatform/Spring/read",
|                                                    "Microsoft.AppPlatform/Spring/configurationServices/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/ApplicationConfigurationService/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f27b7598-bc64-41f7-8a44-855ff16326c2",
|                                    "Name":  "Azure Messaging Catalog Data Owner",
|                                    "Description":  "Allows for full access to Azure Messaging Catalog resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MessagingCatalog/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MessagingCatalog/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d9c6a55-fc0e-4e21-ae6f-f7b095497342",
|                                    "Name":  "Azure Hybrid Database Administrator - Read Only Service Role",
|                                    "Description":  "Read only access to Azure hybrid database services resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureArcData/*/read",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/getTelemetry/action",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/getDetailView/action",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c18f9900-27b8-47c7-a8f0-5b3b3d4c2bc2",
|                                    "Name":  "Microsoft Sentinel Business Applications Agent Operator",
|                                    "Description":  "List and update actions on a business applications system. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/read",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/write",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/systems/read",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/systems/write",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/systems/listActions/action",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/systems/reportActionStatus/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0fb8eba5-a2bb-4abe-b1c1-49dfad359bb0",
|                                    "Name":  "Azure ContainerApps Session Executor",
|                                    "Description":  "Create and execute sessions in a sessionPool",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/sessionPools/*/read",
|                                                    "Microsoft.App/sessionPools/sessions/generatesessions/action",
|                                                    "Microsoft.App/sessionPools/fetchMcpServerCredentials/action",
|                                                    "Microsoft.App/sessionPools/rotateMcpServerCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/sessionPools/*/read",
|                                                        "Microsoft.App/sessionPools/interpreters/execute/action",
|                                                        "Microsoft.App/sessionPools/interpreters/read",
|                                                        "Microsoft.App/sessionPools/executions/*",
|                                                        "Microsoft.App/sessionPools/files/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "83ee7727-862c-4213-8ed8-2ce6c5d69a40",
|                                    "Name":  "Microsoft.Edge Winfields federated subscription read access role",
|                                    "Description":  "Microsoft.Edge Winfields role for read access on federated subscriptions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ef318e2a-8334-4a05-9e4a-295a196c6a6e",
|                                    "Name":  "Azure Red Hat OpenShift Federated Credential",
|                                    "Description":  "Create, update and delete federated credentials on user assigned managed identities in order to build a trust relationship between the managed identity, OpenID Connect (OIDC), and the service account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/read",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "39138f76-04e6-41f0-ba6b-c411b59081a9",
|                                    "Name":  "Bayer Ag Powered Services Crop Id Solution User Role",
|                                    "Description":  "Provide access to Crop Id Solution by Bayer Ag Powered Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b67fe603-310e-4889-b9ee-8257d09d353d",
|                                    "Name":  "Scheduled Events Contributor",
|                                    "Description":  "Provides access to scheduled event actions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Maintenance/scheduledevents/acknowledge/action",
|                                                    "Microsoft.Compute/VirtualMachines/read",
|                                                    "Microsoft.Compute/VirtualMachineScaleSets/read",
|                                                    "Microsoft.Compute/AvailabilitySets/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e82342c9-ac7f-422b-af64-e426d2e12b2d",
|                                    "Name":  "Compute Recommendations Role",
|                                    "Description":  "Grants permissions to call Compute Recommendations APIs provided by Compute Diagnostic Resource Provider service.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/locations/placementScores/generate/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b459aa1d-e3c8-436f-ae21-c0531140f43e",
|                                    "Name":  "Azure Spring Apps Job Log Reader Role",
|                                    "Description":  "Read real-time logs for jobs in Azure Spring Apps",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppPlatform/Spring/read",
|                                                    "Microsoft.AppPlatform/Spring/jobs/read",
|                                                    "Microsoft.AppPlatform/Spring/jobs/executions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/jobs/executions/logstream/action",
|                                                        "Microsoft.AppPlatform/Spring/jobs/executions/listInstances/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "91422e52-bb88-4415-bb4a-90f5b71f6dcb",
|                                    "Name":  "Azure Spring Apps Job Execution Instance List Role",
|                                    "Description":  "List instances for job executions in Azure Spring Apps",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/jobs/executions/listInstances/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a5eb8433-97a5-4a06-80b2-a877e1622c31",
|                                    "Name":  "Nexus Network Fabric Service Writer",
|                                    "Description":  "Read-write access to Nexus Network Fabric Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedNetworkFabric/*/read",
|                                                    "Microsoft.ManagedNetworkFabric/*/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "05fdd44c-adc6-4aff-981c-61041f0c929a",
|                                    "Name":  "Nexus Network Fabric Service Reader",
|                                    "Description":  "Read-only access to Nexus Network Fabric Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedNetworkFabric/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationStatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "adb29209-aa1d-457b-a786-c913953d2891",
|                                    "Name":  "Azure Deployment Stack Owner",
|                                    "Description":  "Allows a user to manage deployment stacks, including those with deny assignments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deploymentStacks/*",
|                                                    "Microsoft.Resources/deploymentStacksWhatIfResults/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bf7f8882-3383-422a-806a-6526c631a88a",
|                                    "Name":  "Azure Deployment Stack Contributor",
|                                    "Description":  "Allows a user to manage deployment stacks, but cannot create or delete deny assignments within the deployment stack.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deploymentStacks/write",
|                                                    "Microsoft.Resources/deploymentStacks/read",
|                                                    "Microsoft.Resources/deploymentStacks/validate/action",
|                                                    "Microsoft.Resources/deploymentStacks/exportTemplate/action",
|                                                    "Microsoft.Resources/deploymentStacksWhatIfResults/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "74252426-c508-480e-9345-4607bbebead4",
|                                    "Name":  "Azure Spring Apps Spring Cloud Config Server Log Reader Role",
|                                    "Description":  "Read real-time logs for Spring Cloud Config Server in Azure Spring Apps",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppPlatform/Spring/read",
|                                                    "Microsoft.AppPlatform/Spring/configServers/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/configService/logstream/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bfdb9389-c9a5-478a-bb2f-ba9ca092c3c7",
|                                    "Name":  "Container Registry Repository Catalog Lister",
|                                    "Description":  "Allows for listing all repositories in an Azure Container Registry.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/catalog/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2efddaa5-3f1f-4df3-97df-af3f13818f4c",
|                                    "Name":  "Container Registry Repository Contributor",
|                                    "Description":  "Allows for read, write, and delete access to Azure Container Registry repositories, but excluding catalog listing.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/write",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/write",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/delete",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b93aa761-3e63-49ed-ac28-beffa264f7ac",
|                                    "Name":  "Container Registry Repository Reader",
|                                    "Description":  "Allows for read access to Azure Container Registry repositories, but excluding catalog listing.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2a1e307c-b015-4ebd-883e-5b7698a07328",
|                                    "Name":  "Container Registry Repository Writer",
|                                    "Description":  "Allows for read and write access to Azure Container Registry repositories, but excluding catalog listing.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/write",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "78e4b983-1a0b-472e-8b7d-8d770f7c5890",
|                                    "Name":  "DeID Data Owner",
|                                    "Description":  "Full access to DeID data. This role is in preview and subject to change",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthDataAIServices/DeidServices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "28bf596f-4eb7-45ce-b5bc-6cf482fec137",
|                                    "Name":  "Locks Contributor",
|                                    "Description":  "Can Manage Locks Operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/locks/read",
|                                                    "Microsoft.Authorization/locks/write",
|                                                    "Microsoft.Authorization/locks/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b1e6a0dd-ea0f-4108-8925-7047693f2cfe",
|                                    "Name":  "CloudTest Leased VM Reader",
|                                    "Description":  "Can view CloudTest leased VM\u0027s credentials",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.CloudTest/pools/leases/action",
|                                                    "Microsoft.CloudTest/pools/leases/complete/action",
|                                                    "Microsoft.CloudTest/pools/leases/extend/action",
|                                                    "Microsoft.CloudTest/hostedpools/leases/action",
|                                                    "Microsoft.CloudTest/hostedpools/leases/complete/action",
|                                                    "Microsoft.CloudTest/hostedpools/leases/extend/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "39fcb0de-8844-4706-b050-c28ddbe3ff83",
|                                    "Name":  "Standby Container Group Pool Contributor",
|                                    "Description":  "Allows users to manage standby container group pool resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ContainerInstance/containerGroupProfiles/read",
|                                                    "Microsoft.ContainerInstance/containerGroupProfiles/revisions/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.StandbyPool/Locations/OperationStatuses/read",
|                                                    "Microsoft.StandbyPool/Operations/read",
|                                                    "Microsoft.StandbyPool/standbyContainerGroupPools/delete",
|                                                    "Microsoft.StandbyPool/standbyContainerGroupPools/read",
|                                                    "Microsoft.StandbyPool/standbyContainerGroupPools/runtimeViews/read",
|                                                    "Microsoft.StandbyPool/standbyContainerGroupPools/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "85a2d0d9-2eba-4c9c-b355-11c2cc0788ab",
|                                    "Name":  "Compute Gallery Artifacts Publisher",
|                                    "Description":  "This is the role for publishing gallery artifacts.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/galleries/*",
|                                                    "Microsoft.Compute/locations/capsOperations/read",
|                                                    "Microsoft.Compute/locations/communityGalleries/*",
|                                                    "Microsoft.Compute/locations/sharedGalleries/*",
|                                                    "Microsoft.Compute/images/*",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Compute/galleries/share/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c5826735-177b-4a0d-a9a3-d0e4b4bda107",
|                                    "Name":  "ToolchainOrchestrator Viewer Role",
|                                    "Description":  "Grant access to view all Toolchain orchestrator resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ToolchainOrchestrator/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2ccf8795-8983-4912-8036-1c45212c95e8",
|                                    "Name":  "ToolchainOrchestrator Admin Role",
|                                    "Description":  "Grant full access to manage all Toolchain orchestrator resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ToolchainOrchestrator/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a3ab03bc-5350-42ff-b0d5-00207672db55",
|                                    "Name":  "ProviderHub Contributor",
|                                    "Description":  "Allows you to create and manage Microsoft.ProviderHub resources through the Resource Provider Platform. Does not allow you to assign roles in Azure RBAC.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ProviderHub/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4d8c6f2e-3fd6-4d40-826e-93e3dc4c3fc1",
|                                    "Name":  "ProviderHub Reader",
|                                    "Description":  "Allows you to view all Microsoft.ProviderHub resources created through the Resource Provider Platform, but does not allow you to make any changes to the resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ProviderHub/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c99c945f-8bd1-4fb1-a903-01460aae6068",
|                                    "Name":  "Azure Stack HCI Connected InfraVMs",
|                                    "Description":  "Role of Arc Integration for Azure Stack HCI Infrastructure Virtual Machines.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/*/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dfce8971-25e3-42e3-ba33-6055438e3080",
|                                    "Name":  "VM Restore Operator",
|                                    "Description":  "Create and Delete resources during VM Restore. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action",
|                                                    "Microsoft.Compute/disks/endGetAccess/action",
|                                                    "Microsoft.Compute/locations/diskOperations/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachines/delete",
|                                                    "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/write",
|                                                    "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/locations/operationResults/read",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Network/locations/usages/read",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                    "Microsoft.Network/publicIPAddresses/delete",
|                                                    "Microsoft.Network/publicIPAddresses/join/action",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/publicIPAddresses/write",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/checkNameAvailability/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0847e196-2fd2-4c2f-a48c-fca6fd030f44",
|                                    "Name":  "HDInsight Cluster Admin",
|                                    "Description":  "Can read, create, modify and delete HDInsight clusters, configuration, extensions, etc.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/APPLICATIONS/DELETE",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/APPLICATIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/APPLICATIONS/WRITE",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/AZUREASYNCOPERATIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/CONFIGURATIONS/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/CONFIGURATIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/DELETE",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/EXECUTESCRIPTACTIONS/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/EXTENSIONS/DELETE",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/EXTENSIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/EXTENSIONS/WRITE",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/GETGATEWAYSETTINGS/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/LISTHOSTS/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/OPERATIONRESULTS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/PRIVATEENDPOINTCONNECTIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/PRIVATELINKRESOURCES/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/RESOLVEPRIVATELINKSERVICEID/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/RESTARTHOSTS/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/ROLES/AUTOSCALE/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/ROLES/RESIZE/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTACTIONS/DELETE",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTACTIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTEXECUTIONHISTORY/PROMOTE/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTEXECUTIONHISTORY/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/UPDATEGATEWAYSETTINGS/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/WRITE",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/AVAILABLECLUSTERVERSIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/AZUREASYNCOPERATIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/BILLINGSPECS/READ",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/CAPABILITIES/READ",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/CHECKNAMEAVAILABILITY/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/OPERATIONRESULTS/READ",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/OPERATIONSTATUSES/READ",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/OPERATIONSTATUSES/WRITE",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/USAGES/READ",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/VALIDATECREATEREQUEST/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/OPERATIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/REGISTER/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/RESOURCETYPES/READ",
|                                                    "MICROSOFT.HDINSIGHT/UNREGISTER/ACTION",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4aa368ec-fba9-4e93-81ed-396b3d461cc5",
|                                    "Name":  "Operator Nexus Compute Contributor Role (Preview)",
|                                    "Description":  "(Preview) Manage and configure Azure Operator Nexus infrastructure resources. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/classicAdministrators/operationstatuses/read",
|                                                    "Microsoft.Authorization/classicAdministrators/read",
|                                                    "Microsoft.Authorization/denyAssignments/read",
|                                                    "Microsoft.Authorization/diagnosticSettings/read",
|                                                    "Microsoft.Authorization/diagnosticSettingsCategories/read",
|                                                    "Microsoft.Authorization/locks/read",
|                                                    "Microsoft.Authorization/operations/read",
|                                                    "Microsoft.Authorization/permissions/read",
|                                                    "Microsoft.Authorization/policyAssignments/read",
|                                                    "Microsoft.Authorization/policyAssignments/privateLinkAssociations/read",
|                                                    "Microsoft.Authorization/policyAssignments/resourceManagementPrivateLinks/read",
|                                                    "Microsoft.Authorization/policyAssignments/resourceManagementPrivateLinks/privateEndpointConnectionProxies/read",
|                                                    "Microsoft.Authorization/policyAssignments/resourceManagementPrivateLinks/privateEndpointConnections/read",
|                                                    "Microsoft.Authorization/policyDefinitions/read",
|                                                    "Microsoft.Authorization/policyExemptions/read",
|                                                    "Microsoft.Authorization/policySetDefinitions/read",
|                                                    "Microsoft.Authorization/providerOperations/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleAssignmentScheduleInstances/read",
|                                                    "Microsoft.Authorization/roleAssignmentScheduleRequests/read",
|                                                    "Microsoft.Authorization/roleAssignmentSchedules/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read",
|                                                    "Microsoft.Authorization/roleEligibilityScheduleInstances/read",
|                                                    "Microsoft.Authorization/roleEligibilityScheduleRequests/read",
|                                                    "Microsoft.Authorization/roleEligibilitySchedules/read",
|                                                    "Microsoft.Authorization/roleManagementPolicies/read",
|                                                    "Microsoft.Authorization/roleManagementPolicyAssignments/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.Insights/alertRules/activated/action",
|                                                    "Microsoft.Insights/alertRules/delete",
|                                                    "Microsoft.Insights/alertRules/incidents/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Insights/alertRules/resolved/action",
|                                                    "Microsoft.Insights/alertRules/throttled/action",
|                                                    "Microsoft.Insights/alertRules/write",
|                                                    "Microsoft.Kubernetes/connectedClusters/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.ManagedNetworkFabric/networkFabricControllers/join/action",
|                                                    "Microsoft.ManagedNetworkFabric/networkFabrics/join/action",
|                                                    "Microsoft.ManagedNetworkFabric/networkRacks/join/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/cordon/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/delete",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/powerOff/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/read",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/reimage/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/replace/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/restart/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/runDataExtracts/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/runReadCommands/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/start/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/uncordon/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/write",
|                                                    "Microsoft.NetworkCloud/clusterManagers/delete",
|                                                    "Microsoft.NetworkCloud/clusterManagers/read",
|                                                    "Microsoft.NetworkCloud/clusterManagers/write",
|                                                    "Microsoft.NetworkCloud/clusters/bareMetalMachineKeySets/read",
|                                                    "Microsoft.NetworkCloud/clusters/bmcKeySets/read",
|                                                    "Microsoft.NetworkCloud/clusters/continueUpdateVersion/action",
|                                                    "Microsoft.NetworkCloud/clusters/delete",
|                                                    "Microsoft.NetworkCloud/clusters/deploy/action",
|                                                    "Microsoft.NetworkCloud/clusters/metricsConfigurations/delete",
|                                                    "Microsoft.NetworkCloud/clusters/metricsConfigurations/read",
|                                                    "Microsoft.NetworkCloud/clusters/metricsConfigurations/write",
|                                                    "Microsoft.NetworkCloud/clusters/read",
|                                                    "Microsoft.NetworkCloud/clusters/scanRuntime/action",
|                                                    "Microsoft.NetworkCloud/clusters/updateVersion/action",
|                                                    "Microsoft.NetworkCloud/clusters/write",
|                                                    "Microsoft.NetworkCloud/locations/operationStatuses/read",
|                                                    "Microsoft.NetworkCloud/operations/read",
|                                                    "Microsoft.NetworkCloud/rackSkus/read",
|                                                    "Microsoft.NetworkCloud/racks/delete",
|                                                    "Microsoft.NetworkCloud/racks/join/action",
|                                                    "Microsoft.NetworkCloud/racks/read",
|                                                    "Microsoft.NetworkCloud/racks/write",
|                                                    "Microsoft.NetworkCloud/register/action",
|                                                    "Microsoft.NetworkCloud/registeredSubscriptions/read",
|                                                    "Microsoft.NetworkCloud/storageAppliances/read",
|                                                    "Microsoft.NetworkCloud/unregister/action",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d977122-f97e-4b4d-a52f-6b43003ddb4d",
|                                    "Name":  "Azure Container Instances Contributor Role",
|                                    "Description":  "Grants read/write access to container groups provided by Azure Container Instances",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerInstance/containerGroups/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6cdbb904-5ff3-429d-8169-7d7818b91bd8",
|                                    "Name":  "Connector Reader",
|                                    "Description":  "Read connectors and their associated resources, such as impacts and insights.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Impact/Connectors/Read",
|                                                    "Microsoft.Impact/WorkloadImpacts/Read",
|                                                    "Microsoft.Impact/WorkloadImpacts/Insights/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8ad4d0ee-9bfb-49e8-93fc-01abb8db6240",
|                                    "Name":  "Transparency Logs Owner",
|                                    "Description":  "Grants full access to manage Transparency Log resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sovereign/transparencyLogs/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "41e04612-9dac-4699-a02b-c82ff2cc3fb5",
|                                    "Name":  "Grafana Limited Viewer",
|                                    "Description":  "View home page.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Dashboard/grafana/ActAsGrafanaLimitedViewer/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "136d308c-0937-4a49-9bd7-edfb42adbffc",
|                                    "Name":  "Disk Encryption Set Operator for Managed Disks",
|                                    "Description":  "Provides permissions to read, write or delete disk encryption sets which are used for encrypting managed disks with customer managed keys",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/diskEncryptionSets/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1af232de-e806-426f-8ca1-c36142449755",
|                                    "Name":  "Bayer Ag Powered Services Field Imagery Solution Service Role",
|                                    "Description":  "Provide access to Field Imagery Solution by Bayer Ag Powered Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/scenes/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9295f069-25d0-4f44-bb6a-3da70d11aa00",
|                                    "Name":  "Azure Edge Hardware Center Administrator",
|                                    "Description":  "Grants you access to take actions as an edge order administrator",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EdgeOrder/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b78c5d69-af96-48a3-bf8d-a8b4d589de94",
|                                    "Name":  "Azure AI Administrator",
|                                    "Description":  "A Built-In Role that has all control plane permissions to work with Azure AI and its dependencies.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.CognitiveServices/*",
|                                                    "Microsoft.ContainerRegistry/registries/*",
|                                                    "Microsoft.DocumentDb/databaseAccounts/*",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/providers/features/register/action",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/components/*",
|                                                    "Microsoft.Insights/diagnosticSettings/*",
|                                                    "Microsoft.Insights/generateLiveToken/read",
|                                                    "Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Insights/metricAlerts/*",
|                                                    "Microsoft.Insights/metricdefinitions/read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/scheduledqueryrules/*",
|                                                    "Microsoft.Insights/topology/read",
|                                                    "Microsoft.Insights/transactions/read",
|                                                    "Microsoft.Insights/webtests/*",
|                                                    "Microsoft.KeyVault/*",
|                                                    "Microsoft.MachineLearningServices/workspaces/*",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Storage/storageAccounts/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Search/searchServices/write",
|                                                    "Microsoft.Search/searchServices/read",
|                                                    "Microsoft.Search/searchServices/delete",
|                                                    "Microsoft.Search/searchServices/indexes/*",
|                                                    "Microsoft.Search/searchServices/listAdminKeys/action",
|                                                    "Microsoft.Search/searchServices/privateEndpointConnections/*",
|                                                    "Microsoft.DataFactory/factories/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cf7c76d2-98a3-4358-a134-615aa78bf44d",
|                                    "Name":  "Compute Gallery Image Reader",
|                                    "Description":  "This is the role for reading gallery images.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/galleries/images/read",
|                                                    "Microsoft.Compute/galleries/images/versions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "edd66693-d32a-450b-997d-0158c03976b0",
|                                    "Name":  "Container Apps Jobs Reader",
|                                    "Description":  "Read access to ContainerApps jobs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.app/jobs/read",
|                                                    "Microsoft.App/jobs/*/read",
|                                                    "Microsoft.App/managedenvironments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "358470bc-b998-42bd-ab17-a7e34c199c0f",
|                                    "Name":  "Container Apps Contributor",
|                                    "Description":  "Full management of Container Apps, including creation, deletion, and updates.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/containerApps/*/read",
|                                                    "Microsoft.App/containerApps/*/write",
|                                                    "Microsoft.App/containerApps/*/delete",
|                                                    "Microsoft.App/containerApps/*/action",
|                                                    "Microsoft.App/managedEnvironments/read",
|                                                    "Microsoft.App/managedEnvironments/*/read",
|                                                    "Microsoft.App/managedEnvironments/join/action",
|                                                    "Microsoft.App/managedEnvironments/checknameavailability/action",
|                                                    "Microsoft.App/connectedEnvironments/read",
|                                                    "Microsoft.App/connectedEnvironments/*/read",
|                                                    "Microsoft.App/connectedEnvironments/join/action",
|                                                    "Microsoft.App/connectedEnvironments/checknameavailability/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f3bd1b5c-91fa-40e7-afe7-0c11d331232c",
|                                    "Name":  "Container Apps Operator",
|                                    "Description":  "Read, logstream and exec into Container Apps.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/containerApps/*/read",
|                                                    "Microsoft.App/containerApps/*/action",
|                                                    "Microsoft.App/managedEnvironments/read",
|                                                    "Microsoft.App/managedEnvironments/*/read",
|                                                    "Microsoft.App/managedEnvironments/join/action",
|                                                    "Microsoft.App/managedEnvironments/checknameavailability/action",
|                                                    "Microsoft.App/connectedEnvironments/read",
|                                                    "Microsoft.App/connectedEnvironments/*/read",
|                                                    "Microsoft.App/connectedEnvironments/join/action",
|                                                    "Microsoft.App/connectedEnvironments/checknameavailability/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/containerApps/logstream/action",
|                                                        "Microsoft.App/containerApps/exec/action",
|                                                        "Microsoft.App/containerApps/debug/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "af61e8fc-2633-4b95-bed3-421ad6826515",
|                                    "Name":  "Container Apps SessionPools Reader",
|                                    "Description":  "Read access to ContainerApps sessionpools.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/sessionPools/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f7669afb-68b2-44b4-9c5f-6d2a47fddda0",
|                                    "Name":  "Container Apps SessionPools Contributor",
|                                    "Description":  "Full management of Container Apps SessionPools, including creation, deletion, and updates.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/sessionPools/*/read",
|                                                    "Microsoft.App/sessionPools/*/write",
|                                                    "Microsoft.App/sessionPools/*/delete",
|                                                    "Microsoft.App/sessionPools/*/action",
|                                                    "microsoft.App/managedEnvironments/read",
|                                                    "Microsoft.App/managedEnvironments/*/read",
|                                                    "Microsoft.App/managedEnvironments/join/action",
|                                                    "Microsoft.App/managedEnvironments/checknameavailability/action",
|                                                    "microsoft.App/connectedEnvironments/read",
|                                                    "Microsoft.App/connectedEnvironments/*/read",
|                                                    "Microsoft.App/connectedEnvironments/join/action",
|                                                    "Microsoft.App/connectedEnvironments/checknameavailability/action",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.App/sessionPools/fetchMcpServerCredentials/action",
|                                                       "Microsoft.App/sessionPools/rotateMcpServerCredentials/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "57cc5028-e6a7-4284-868d-0611c5923f8d",
|                                    "Name":  "Container Apps ManagedEnvironments Contributor",
|                                    "Description":  "Full management of Container Apps ManagedEnvironments, including creation, deletion, and updates.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/managedEnvironments/*/read",
|                                                    "Microsoft.App/managedEnvironments/*/write",
|                                                    "Microsoft.App/managedEnvironments/*/delete",
|                                                    "Microsoft.App/managedEnvironments/*/action",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1b32c00b-7eff-4c22-93e6-93d11d72d2d8",
|                                    "Name":  "Container Apps ManagedEnvironments Reader",
|                                    "Description":  "Read access to ContainerApps managedenvironments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/managedEnvironments/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4e3d2b60-56ae-4dc6-a233-09c8e5a82e68",
|                                    "Name":  "Container Apps Jobs Contributor",
|                                    "Description":  "Full management of Container Apps jobs, including creation, deletion, and updates.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "microsoft.app/jobs/read",
|                                                    "Microsoft.App/jobs/*/read",
|                                                    "Microsoft.App/jobs/*/action",
|                                                    "Microsoft.App/jobs/write",
|                                                    "Microsoft.App/jobs/delete",
|                                                    "Microsoft.app/managedenvironments/read",
|                                                    "Microsoft.App/managedenvironments/*/read",
|                                                    "Microsoft.App/managedenvironments/join/action",
|                                                    "Microsoft.App/managedenvironments/checknameavailability/action",
|                                                    "Microsoft.app/connectedEnvironments/read",
|                                                    "Microsoft.App/connectedEnvironments/*/read",
|                                                    "Microsoft.App/connectedEnvironments/join/action",
|                                                    "Microsoft.App/connectedEnvironments/checknameavailability/action",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0ad04412-c4d5-4796-b79c-f76d14c8d402",
|                                    "Name":  "Durable Task Data Contributor",
|                                    "Description":  "Durable Task role for all data access operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DurableTask/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1a5682fc-4f12-4b25-927e-e8cfed0c539e",
|                                    "Name":  "KubernetesRuntime Load Balancer Contributor Role",
|                                    "Description":  "Read, write, and delete load balancers in an Arc connected Kubernetes cluster",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.KubernetesRuntime/loadBalancers/read",
|                                                    "Microsoft.KubernetesRuntime/loadBalancers/write",
|                                                    "Microsoft.KubernetesRuntime/loadBalancers/delete",
|                                                    "Microsoft.KubernetesRuntime/bgpPeers/read",
|                                                    "Microsoft.KubernetesRuntime/bgpPeers/write",
|                                                    "Microsoft.KubernetesRuntime/bgpPeers/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.KubernetesRuntime/locations/operationStatuses/write",
|                                                    "Microsoft.KubernetesRuntime/services/write",
|                                                    "Microsoft.KubernetesRuntime/services/delete",
|                                                    "Microsoft.KubernetesRuntime/bfdProfiles/write",
|                                                    "Microsoft.KubernetesRuntime/bfdProfiles/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d715fb95-a0f0-4f1c-8be6-5ad2d2767f67",
|                                    "Name":  "AVS Orchestrator Role",
|                                    "Description":  "Do not remove this role from your resource group because it is critical to enable your AVS private cloud to operate. If the role is removed, it will cause your AVS private cloud control plane to no longer operate correctly. The role is used to enable the AVS private cloud control plane to create the supporting resources in the resource group of the private clouds attached virtual network and bind them to the attached virtual network. This role is not intended for use cases outside of assignment to the associated AVS identity in your entra-id tenant.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/operationStatuses/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Network/virtualHubs/delete",
|                                                    "Microsoft.Network/publicIPAddresses/delete",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/delete",
|                                                    "Microsoft.Network/virtualNetworks/subnets/delete",
|                                                    "Microsoft.Network/networkIntentPolicies/read",
|                                                    "Microsoft.Network/networkIntentPolicies/delete",
|                                                    "Microsoft.Network/networkIntentPolicies/write",
|                                                    "Microsoft.Network/networkSecurityGroups/delete",
|                                                    "Microsoft.Network/networkSecurityGroups/write",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/write",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/delete",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/delete",
|                                                    "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action",
|                                                    "Microsoft.Network/virtualHubs/write",
|                                                    "Microsoft.Network/publicIPAddresses/write",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/virtualHubs/ipConfigurations/write",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                    "Microsoft.Network/virtualHubs/ipConfigurations/read",
|                                                    "Microsoft.Network/virtualHubs/bgpConnections/write",
|                                                    "Microsoft.Network/virtualHubs/bgpConnections/read",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
|                                                    "Microsoft.Network/virtualNetworks/peer/action",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Network/locations/operationResults/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/routeTables/read",
|                                                    "Microsoft.Network/routeTables/write",
|                                                    "Microsoft.Network/routeTables/delete",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/routeTables/routes/read",
|                                                    "Microsoft.Network/routeTables/routes/write",
|                                                    "Microsoft.Network/routeTables/routes/delete",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "db7003cd-07a9-490c-bfa5-23e40314f8d7",
|                                    "Name":  "Service Connector Contributor",
|                                    "Description":  "Can Manage Service Connector.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ServiceLinker/linkers/read",
|                                                    "Microsoft.ServiceLinker/linkers/delete",
|                                                    "Microsoft.ServiceLinker/linkers/write",
|                                                    "Microsoft.ServiceLinker/linkers/listConfigurations/action",
|                                                    "Microsoft.ServiceLinker/linkers/validateLinker/action",
|                                                    "Microsoft.ServiceLinker/dryruns/delete",
|                                                    "Microsoft.ServiceLinker/dryruns/write",
|                                                    "Microsoft.ServiceLinker/linkers/generateConfigurations/action",
|                                                    "Microsoft.ServiceLinker/locations/connectors/delete",
|                                                    "Microsoft.ServiceLinker/locations/connectors/generateConfigurations/action",
|                                                    "Microsoft.ServiceLinker/locations/connectors/validate/action",
|                                                    "Microsoft.ServiceLinker/locations/connectors/write",
|                                                    "Microsoft.ServiceLinker/locations/dryruns/delete",
|                                                    "Microsoft.ServiceLinker/locations/dryruns/write",
|                                                    "Microsoft.ServiceLinker/locations/operationStatuses/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2a740172-0fc2-4039-972c-b31864cd47d6",
|                                    "Name":  "Azure Device Update Agent",
|                                    "Description":  "Provide full access to all Azure Device Update agent operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DeviceUpdate/updateAccounts/agents/requestUpdate/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2142ea27-02ad-4094-bfea-2dbac6d24934",
|                                    "Name":  "Enclave Approver Role",
|                                    "Description":  "Read all resources in Azure Virtual Enclaves and Approve approval requests within the Enclave",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/communities/read",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/read",
|                                                    "Microsoft.Mission/communities/transitHubs/read",
|                                                    "Microsoft.Mission/enclaveConnections/read",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                    "Microsoft.Mission/approvals/read",
|                                                    "Microsoft.Mission/approvals/write",
|                                                    "Microsoft.Mission/enclaveConnections/approvalCallback/action",
|                                                    "Microsoft.Mission/virtualEnclaves/approvalCallback/action",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/approvalCallback/action",
|                                                    "Microsoft.Mission/communities/communityEndpoints/approvalCallback/action",
|                                                    "Microsoft.Mission/approvals/initiatorCallback/action",
|                                                    "Microsoft.Mission/communities/setMaintenanceMode/action",
|                                                    "Microsoft.Mission/communities/communityendpoints/connect/action",
|                                                    "Microsoft.Mission/virtualEnclaves/setWorkloadRoleAssignments/action",
|                                                    "Microsoft.Mission/virtualEnclaves/setEnclaveRoleAssignments/action",
|                                                    "Microsoft.Mission/virtualEnclaves/setSubnetConfiguration/action",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/connect/action",
|                                                    "Microsoft.Mission/enclaveConnections/setSourceCidr/action",
|                                                    "Microsoft.Mission/virtualenclaves/setMaintenanceMode/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a68e7c17-0ab2-4c09-9a58-125dae29748c",
|                                    "Name":  "Key Vault Purge Operator",
|                                    "Description":  "Allows permanent deletion of soft-deleted vaults.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.KeyVault/deletedVaults/read",
|                                                    "Microsoft.KeyVault/locations/deletedVaults/read",
|                                                    "Microsoft.KeyVault/locations/deletedVaults/purge/action",
|                                                    "Microsoft.KeyVault/locations/operationResults/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b5b0c71d-aca9-4081-aee2-9b1bb335fc1a",
|                                    "Name":  "Cognitive Services Face Contributor",
|                                    "Description":  "Full access to perform all Face APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/Face/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b9a307c4-5aa3-4b52-ba60-2b17c136cd7b",
|                                    "Name":  "Container Apps Jobs Operator",
|                                    "Description":  "Read, start, and stop Container Apps jobs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "microsoft.app/jobs/read",
|                                                    "Microsoft.App/jobs/*/read",
|                                                    "Microsoft.App/jobs/*/action",
|                                                    "Microsoft.app/managedenvironments/read",
|                                                    "Microsoft.App/managedenvironments/*/read",
|                                                    "Microsoft.App/managedenvironments/join/action",
|                                                    "Microsoft.App/managedenvironments/checknameavailability/action",
|                                                    "Microsoft.app/connectedEnvironments/read",
|                                                    "Microsoft.App/connectedEnvironments/*/read",
|                                                    "Microsoft.App/connectedEnvironments/join/action",
|                                                    "Microsoft.App/connectedEnvironments/checknameavailability/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/jobs/logstream/action",
|                                                        "Microsoft.App/jobs/exec/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "77be276d-fb44-4f3b-beb5-9bf03c4cd2d3",
|                                    "Name":  "Operator Nexus Owner (Preview)",
|                                    "Description":  "(Preview) This role allows full access to Azure Operator Nexus Network Cloud resources. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.NetworkCloud/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4e9d0bd4-5aab-4f91-92df-9def33fe287c",
|                                    "Name":  "CloudTest Contributor Role",
|                                    "Description":  "Read, write, delete and perform actions on CloudTest Accounts, CloudTest Pools, 1ES Hosted Pools, 1ES Build Caches and 1ES Images.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CloudTest/*/read",
|                                                    "Microsoft.CloudTest/hostedpools/write",
|                                                    "Microsoft.CloudTest/hostedpools/delete",
|                                                    "Microsoft.CloudTest/images/write",
|                                                    "Microsoft.CloudTest/images/delete",
|                                                    "Microsoft.CloudTest/images/cancel/action",
|                                                    "Microsoft.CloudTest/images/refresh/action",
|                                                    "Microsoft.CloudTest/pools/write",
|                                                    "Microsoft.CloudTest/pools/delete",
|                                                    "Microsoft.CloudTest/accounts/write",
|                                                    "Microsoft.CloudTest/accounts/delete",
|                                                    "Microsoft.CloudTest/buildcaches/write",
|                                                    "Microsoft.CloudTest/buildcaches/delete",
|                                                    "Microsoft.CloudTest/pools/leases/action",
|                                                    "Microsoft.CloudTest/pools/leases/complete/action",
|                                                    "Microsoft.CloudTest/pools/leases/extend/action",
|                                                    "Microsoft.CloudTest/hostedpools/leases/action",
|                                                    "Microsoft.CloudTest/hostedpools/leases/complete/action",
|                                                    "Microsoft.CloudTest/hostedpools/leases/extend/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8d6517c1-e434-405c-9f3f-e0ae65085d76",
|                                    "Name":  "Azure Automanage Contributor",
|                                    "Description":  "Azure Automanage Contributor",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Automanage/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9fc6112f-f48e-4e27-8b09-72a5c94e4ae9",
|                                    "Name":  "Azure Bot Service Contributor Role",
|                                    "Description":  "To perform actions on the bots by copilot studio platform and extensibility team",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.BotService/listAuthServiceProviders/action",
|                                                    "Microsoft.BotService/listauthserviceproviders/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.BotService/botServices/read",
|                                                    "Microsoft.BotService/botServices/write",
|                                                    "Microsoft.BotService/botServices/delete",
|                                                    "Microsoft.BotService/botServices/channels/write",
|                                                    "Microsoft.BotService/botServices/channels/read",
|                                                    "Microsoft.BotService/botServices/channels/listchannelwithkeys/action",
|                                                    "Microsoft.BotService/botServices/channels/delete",
|                                                    "Microsoft.BotService/botServices/channels/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.BotService/botServices/connections/read",
|                                                    "Microsoft.BotService/botServices/connections/write",
|                                                    "Microsoft.BotService/botServices/connections/delete",
|                                                    "Microsoft.BotService/botServices/connections/listwithsecrets/write",
|                                                    "Microsoft.BotService/botServices/connections/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.BotService/botServices/createemailsigninurl/action",
|                                                    "Microsoft.BotService/botServices/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.BotService/botServices/joinPerimeter/action",
|                                                    "Microsoft.BotService/botServices/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.BotService/checknameavailability/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.BotService/hostsettings/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.BotService/botServices/privateEndpointConnectionProxies/write",
|                                                    "Microsoft.BotService/botServices/privateEndpointConnectionProxies/delete",
|                                                    "Microsoft.BotService/botServices/privateEndpointConnectionProxies/validate/action",
|                                                    "Microsoft.BotService/botServices/privateEndpointConnections/write",
|                                                    "Microsoft.BotService/botServices/privateEndpointConnections/delete",
|                                                    "Microsoft.BotService/listqnamakerendpointkeys/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.BotService/botServices/networkSecurityPerimeterConfigurations/reconcile/action",
|                                                    "Microsoft.BotService/botServices/networkSecurityPerimeterAssociationProxies/write",
|                                                    "Microsoft.BotService/botServices/networkSecurityPerimeterAssociationProxies/delete",
|                                                    "Microsoft.BotService/locations/notifyNetworkSecurityPerimeterUpdatesAvailable/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.BotService/botServices/channels/regeneratekeys/action",
|                                                    "Microsoft.BotService/botServices/Connections/listWithSecrets/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "175b81b9-6e0d-490a-85e4-0d422273c10c",
|                                    "Name":  "App Configuration Reader",
|                                    "Description":  "Grants permission for read operations for App Configuration resources. This role does not grant access to data plane resources such as key-values, snapshots, and feature flags.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppConfiguration/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fe86443c-f201-4fc4-9d2a-ac61149fbda0",
|                                    "Name":  "App Configuration Contributor",
|                                    "Description":  "Grants permission for all management operations, except purge, for App Configuration resources. This role does not grant access to data plane resources such as key-values, snapshots, and feature flags.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppConfiguration/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.AppConfiguration/locations/deletedConfigurationStores/purge/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "83f80186-3729-438c-ad2d-39e94d718838",
|                                    "Name":  "Service Fabric Managed Cluster Contributor",
|                                    "Description":  "Deploy and manage your Service Fabric Managed Cluster resources. Includes managed clusters, node types, application types, application type versions, applications, and services.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ServiceFabric/managedclusters/*",
|                                                    "Microsoft.ServiceFabric/operations/read",
|                                                    "Microsoft.ServiceFabric/locations/clusterVersions/read",
|                                                    "Microsoft.ServiceFabric/locations/environments/clusterVersions/read",
|                                                    "Microsoft.ServiceFabric/locations/operationresults/read",
|                                                    "Microsoft.ServiceFabric/locations/operations/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "577a9874-89fd-4f24-9dbd-b5034d0ad23a",
|                                    "Name":  "Container Registry Data Importer and Data Reader",
|                                    "Description":  "Provides the ability to import images into a registry through the registry import operation. Provides the ability to list repositories, view images and tags, get manifests, and pull images. Does not provide permissions for importing images through configuring registry transfer pipelines such as import and export pipelines. Does not provide permissions for importing through configuring Artifact Cache or Sync rules.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/importImage/action",
|                                                    "Microsoft.ContainerRegistry/registries/read",
|                                                    "Microsoft.ContainerRegistry/registries/pull/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                        "Microsoft.ContainerRegistry/registries/catalog/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a35466a1-cfd6-450a-b35e-683fcdf30363",
|                                    "Name":  "Azure Batch Service Orchestration Role",
|                                    "Description":  "Grants the required permissions to Azure Batch Resource Provider to manage compute and other backing resources in the subscription.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Security/assessments/read",
|                                                    "Microsoft.AzureFleet/fleets/write",
|                                                    "Microsoft.AzureFleet/fleets/read",
|                                                    "Microsoft.AzureFleet/fleets/delete",
|                                                    "Microsoft.Compute/locations/DiskOperations/read",
|                                                    "Microsoft.Compute/locations/operations/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/approveRollingUpgrade/action",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/deallocate/action",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/delete",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/delete/action",
|                                                    "Microsoft.Compute/VirtualMachineScaleSets/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/reimage/action",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/reimageall/action",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/restart/action",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/start/action",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/write",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/extensions/read",
|                                                    "microsoft.Compute/virtualMachineScaleSets/networkInterfaces/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualmachines/restart/action",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/dataCollectionRuleAssociations/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Insights/diagnosticSettings/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
|                                                    "Microsoft.Network/networkWatchers/read",
|                                                    "Microsoft.Network/virtualNetworks/delete",
|                                                    "Microsoft.Network/virtualNetworks/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8c87871d-6201-42da-abb1-1c0c985ff71c",
|                                    "Name":  "Microsoft PowerBI Tenant Operations Role",
|                                    "Description":  "Allows management of tenant operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.PowerBI/tenants/workspaces/read",
|                                                    "Microsoft.PowerBI/tenants/workspaces/delete",
|                                                    "Microsoft.PowerBI/tenants/read",
|                                                    "Microsoft.PowerBI/tenants/delete",
|                                                    "Microsoft.PowerBI/tenants/write",
|                                                    "Microsoft.PowerBI/tenants/workspaces/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b6efc156-f0da-4e90-a50a-8c000140b017",
|                                    "Name":  "Service Fabric Cluster Contributor",
|                                    "Description":  "Manage your Service Fabric Cluster resources. Includes clusters, application types, application type versions, applications, and services. You will need additional permissions to deploy and manage the cluster\u0027s underlying resources such as virtual machine scale sets, storage accounts, networks, etc.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ServiceFabric/clusters/*",
|                                                    "Microsoft.ServiceFabric/operations/read",
|                                                    "Microsoft.ServiceFabric/locations/clusterVersions/read",
|                                                    "Microsoft.ServiceFabric/locations/environments/clusterVersions/read",
|                                                    "Microsoft.ServiceFabric/locations/operationresults/read",
|                                                    "Microsoft.ServiceFabric/locations/operations/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6e0c8711-85a0-4490-8365-8ec13c4560b4",
|                                    "Name":  "Stream Analytics Contributor",
|                                    "Description":  "Contributor access to Clusters and Streaming Jobs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.StreamAnalytics/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1dfc38e8-6ce7-447f-807c-029c65262c5f",
|                                    "Name":  "Stream Analytics Reader",
|                                    "Description":  "Read-only access to Clusters and Streaming Jobs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.StreamAnalytics/streamingjobs/Read",
|                                                    "Microsoft.StreamAnalytics/streamingjobs/*/Read",
|                                                    "Microsoft.StreamAnalytics/clusters/Read",
|                                                    "Microsoft.StreamAnalytics/clusters/*/Read",
|                                                    "Microsoft.StreamAnalytics/clusters/ListStreamingJobs/action",
|                                                    "Microsoft.StreamAnalytics/locations/*/Read",
|                                                    "Microsoft.StreamAnalytics/operations/Read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "80d0d6b0-f522-40a4-8886-a5a11720c375",
|                                    "Name":  "Durable Task Worker",
|                                    "Description":  "Used by worker applications to interact with the Durable Task service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DurableTask/schedulers/taskhubs/orchestrations/execute/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "78eacb5e-e318-4560-85a9-e6a724ca60c9",
|                                    "Name":  "Portal Dashboard Writer Role",
|                                    "Description":  "Can write an Azure Portal Dashboard",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Portal/dashboards/read",
|                                                    "Microsoft.Portal/dashboards/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "21bffb94-04c0-4ed0-b676-68bb926e832b",
|                                    "Name":  "Microsoft.Windows365.CloudPcDelegatedMsis Writer User",
|                                    "Description":  "Built in role to perform Write operations on CloudPcDelegatedMsis resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Windows365/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bf2b6809-e9a5-4aea-a6e1-40a9dc8c43a7",
|                                    "Name":  "Landing Zone Account Owner",
|                                    "Description":  "Microsoft.Sovereign Landing Zone Account Owner allowing to review and modify Landing Zone Account, Landing Zone Configurations, as well as reading and adding Landing Zone Registrations. Also enables read-access to policies and management groups for enabling the full user experience of the Sovereign Services RP in the Azure Portal (as otherwise some elements might not be accessible to end users).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sovereign/landingZoneAccounts/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2718b1f7-eb07-424e-8868-0137541392a1",
|                                    "Name":  "Landing Zone Account Reader",
|                                    "Description":  "Microsoft.Sovereign Landing Zone Account Reader allowing to read Landing Zone Account, Landing Zone Configurations and Landing Zone Registrations. Also enables read-access to policies and management groups for enabling the full user experience of the Sovereign Services RP in the Azure Portal (as otherwise some elements might not be accessible to end users).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sovereign/landingZoneAccounts/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0b6ca2e8-2cdc-4bd6-b896-aa3d8c21fc35",
|                                    "Name":  "Defender Sensitive Data Discovery",
|                                    "Description":  "Grants permissions for Microsoft Defender for Cloud Sensitive Data Discovery plan features",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Security/defenderforstoragesettings/read",
|                                                    "Microsoft.Security/defenderforstoragesettings/write",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Security/securityOperators/read",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "11076f67-66f6-4be0-8f6b-f0609fd05cc9",
|                                    "Name":  "Azure Batch Account Reader",
|                                    "Description":  "Lets you view all resources including pools and jobs in the Batch account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Batch/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Batch/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "29fe4964-1e60-436b-bd3a-77fd4c178b3c",
|                                    "Name":  "Azure Batch Account Contributor",
|                                    "Description":  "Grants full access to manage all Batch resources, including Batch accounts, pools and jobs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Batch/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Batch/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "48e5e92e-a480-4e71-aa9c-2778f4c13781",
|                                    "Name":  "Azure Batch Job Submitter",
|                                    "Description":  "Lets you submit and manage jobs in the Batch account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Batch/batchAccounts/applications/read",
|                                                    "Microsoft.Batch/batchAccounts/applications/versions/read",
|                                                    "Microsoft.Batch/batchAccounts/pools/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Batch/batchAccounts/jobSchedules/*",
|                                                        "Microsoft.Batch/batchAccounts/jobs/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6aaa78f1-f7de-44ca-8722-c64a23943cae",
|                                    "Name":  "Azure Batch Data Contributor",
|                                    "Description":  "Grants permissions to manage Batch pools and jobs but not to modify accounts.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Batch/batchAccounts/read",
|                                                    "Microsoft.Batch/batchAccounts/applications/*",
|                                                    "Microsoft.Batch/batchAccounts/certificates/*",
|                                                    "Microsoft.Batch/batchAccounts/certificateOperationResults/*",
|                                                    "Microsoft.Batch/batchAccounts/pools/*",
|                                                    "Microsoft.Batch/batchAccounts/poolOperationResults/*",
|                                                    "Microsoft.Batch/locations/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Batch/batchAccounts/jobSchedules/*",
|                                                        "Microsoft.Batch/batchAccounts/jobs/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5c2d7e57-b7c2-4d8a-be4f-82afa42c6e95",
|                                    "Name":  "Azure Managed Grafana Workspace Contributor",
|                                    "Description":  "Can manage Azure Managed Grafana resources, without providing access to the workspaces themselves.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Dashboard/grafana/write",
|                                                    "Microsoft.Dashboard/grafana/delete",
|                                                    "Microsoft.Dashboard/grafana/PrivateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Dashboard/grafana/managedPrivateEndpoints/action",
|                                                    "Microsoft.Dashboard/locations/operationStatuses/write",
|                                                    "Microsoft.Dashboard/grafana/privateEndpointConnectionProxies/validate/action",
|                                                    "Microsoft.Dashboard/grafana/privateEndpointConnectionProxies/write",
|                                                    "Microsoft.Dashboard/grafana/privateEndpointConnectionProxies/delete",
|                                                    "Microsoft.Dashboard/grafana/privateEndpointConnections/write",
|                                                    "Microsoft.Dashboard/grafana/privateEndpointConnections/delete",
|                                                    "Microsoft.Dashboard/grafana/managedPrivateEndpoints/write",
|                                                    "Microsoft.Dashboard/grafana/managedPrivateEndpoints/delete",
|                                                    "Microsoft.Dashboard/grafana/integrationFabrics/write",
|                                                    "Microsoft.Dashboard/grafana/integrationFabrics/delete",
|                                                    "Microsoft.Dashboard/grafana/grafanaDefinitions/read",
|                                                    "Microsoft.Dashboard/grafana/grafanaDefinitions/write",
|                                                    "Microsoft.Dashboard/grafana/grafanaDefinitions/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d5adeb5b-107f-4aca-99ea-4e3f4fc008d5",
|                                    "Name":  "Container Apps ConnectedEnvironments Reader",
|                                    "Description":  "Read access to Container Apps ConnectedEnvironments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.App/connectedEnvironments/read",
|                                                    "Microsoft.App/connectedEnvironments/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "19c28022-e58e-450d-a464-0b2a53034789",
|                                    "Name":  "Cognitive Services Data Contributor (Preview)",
|                                    "Description":  "Allows to call data plane APIs, but not any control plane APIs for Microsoft Cognitive Services. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bd80684d-2f5f-4130-892a-0955546282de",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Reader",
|                                    "Description":  "Grants read-only access to most Kubernetes cluster-scoped resources in the fleet-managed hub cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/apiextensions.k8s.io/customresourcedefinitions/read",
|                                                        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                        "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                        "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                        "Microsoft.ContainerService/fleets/configmaps/read",
|                                                        "Microsoft.ContainerService/fleets/endpoints/read",
|                                                        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/fleets/events/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/limitranges/read",
|                                                        "Microsoft.ContainerService/fleets/namespaces/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/nodes/read",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumes/read",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                        "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                        "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                        "Microsoft.ContainerService/fleets/services/read",
|                                                        "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/memberclusters/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceplacements/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcebindings/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcesnapshots/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterschedulingpolicysnapshots/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverrides/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverridesnapshots/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1dc4cd5a-de51-4ee4-bc8e-b40e9c17e320",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Writer",
|                                    "Description":  "Grants read/write access to most Kubernetes cluster-scoped resources in the fleet-managed hub cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/apiextensions.k8s.io/customresourcedefinitions/read",
|                                                        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/apps/daemonsets/write",
|                                                        "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/apps/deployments/write",
|                                                        "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                        "Microsoft.ContainerService/fleets/apps/statefulsets/write",
|                                                        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/write",
|                                                        "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                        "Microsoft.ContainerService/fleets/batch/cronjobs/write",
|                                                        "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                        "Microsoft.ContainerService/fleets/batch/jobs/write",
|                                                        "Microsoft.ContainerService/fleets/configmaps/read",
|                                                        "Microsoft.ContainerService/fleets/configmaps/write",
|                                                        "Microsoft.ContainerService/fleets/endpoints/read",
|                                                        "Microsoft.ContainerService/fleets/endpoints/write",
|                                                        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/fleets/events/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/daemonsets/write",
|                                                        "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/deployments/write",
|                                                        "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/ingresses/write",
|                                                        "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/networkpolicies/write",
|                                                        "Microsoft.ContainerService/fleets/limitranges/read",
|                                                        "Microsoft.ContainerService/fleets/namespaces/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/write",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/write",
|                                                        "Microsoft.ContainerService/fleets/nodes/read",
|                                                        "Microsoft.ContainerService/fleets/nodes/write",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumes/read",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumes/write",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumeclaims/write",
|                                                        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/write",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/write",
|                                                        "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                        "Microsoft.ContainerService/fleets/secrets/read",
|                                                        "Microsoft.ContainerService/fleets/secrets/write",
|                                                        "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                        "Microsoft.ContainerService/fleets/serviceaccounts/write",
|                                                        "Microsoft.ContainerService/fleets/services/read",
|                                                        "Microsoft.ContainerService/fleets/services/write",
|                                                        "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/memberclusters/read",
|                                                        "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/memberclusters/write",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceplacements/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceplacements/write",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcebindings/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcesnapshots/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterschedulingpolicysnapshots/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverrides/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverrides/write",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverridesnapshots/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1a40e87e-6645-48e0-b27a-0b115d849a20",
|                                    "Name":  "Chaos Studio Operator",
|                                    "Description":  "Can run and see details for experiments but cannot create experiments or manage targets and capabilities.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Chaos/*/read",
|                                                    "Microsoft.Chaos/experiments/start/action",
|                                                    "Microsoft.Chaos/experiments/cancel/action",
|                                                    "Microsoft.Chaos/experiments/executions/getExecutionDetails/action",
|                                                    "Microsoft.Chaos/locations/operationResults/read",
|                                                    "Microsoft.Chaos/locations/operationStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "29e2da8a-229c-4157-8ae8-cc72fc506b74",
|                                    "Name":  "Chaos Studio Reader",
|                                    "Description":  "Can view targets, capabilities, experiments, and experiment details.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Chaos/*/read",
|                                                    "Microsoft.Chaos/experiments/executions/getExecutionDetails/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7c2e40b7-25eb-482a-82cb-78ba06cb46d5",
|                                    "Name":  "Chaos Studio Experiment Contributor",
|                                    "Description":  "Can create, run, and see details for experiments, onboard targets, and manage capabilities.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Chaos/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6f4fe6fc-f04f-4d97-8528-8bc18c848dca",
|                                    "Name":  "Container Apps ConnectedEnvironments Contributor",
|                                    "Description":  "Full management of Container Apps ConnectedEnvironments, including creation, deletion, and updates.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/connectedEnvironments/*",
|                                                    "Microsoft.App/connectedEnvironments/*/read",
|                                                    "Microsoft.App/connectedEnvironments/*/write",
|                                                    "Microsoft.App/connectedEnvironments/*/delete",
|                                                    "Microsoft.App/connectedEnvironments/*/action",
|                                                    "Microsoft.App/connectedEnvironments/daprComponents/listSecrets/action",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ff478a4e-8633-416e-91bc-ec33ce7c9516",
|                                    "Name":  "Azure Messaging Connectors Owner",
|                                    "Description":  "Allows for full access to Azure Messaging Connectors resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MessagingConnectors/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MessagingConnectors/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3bc748fc-213d-45c1-8d91-9da5725539b9",
|                                    "Name":  "Container Registry Contributor and Data Access Configuration Administrator",
|                                    "Description":  "Provides permissions to create, list, and update container registries and registry configuration properties. Provides permissions to configure data access such as admin user credentials, scope maps, and tokens, which can be used to read, write or delete repositories and images. Does not provide direct permissions to read, list, or write registry contents including repositories and images. Does not provide permissions to modify data plane content such as imports, Artifact Cache or Sync, and Transfer Pipelines. Does not provide permissions for managing Tasks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerRegistry/registries/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/read",
|                                                    "Microsoft.ContainerRegistry/registries/write",
|                                                    "Microsoft.ContainerRegistry/registries/delete",
|                                                    "Microsoft.ContainerRegistry/registries/listCredentials/action",
|                                                    "Microsoft.ContainerRegistry/registries/regenerateCredential/action",
|                                                    "Microsoft.ContainerRegistry/registries/generateCredentials/action",
|                                                    "Microsoft.ContainerRegistry/registries/replications/read",
|                                                    "Microsoft.ContainerRegistry/registries/replications/write",
|                                                    "Microsoft.ContainerRegistry/registries/replications/delete",
|                                                    "Microsoft.ContainerRegistry/registries/replications/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/write",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/delete",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/tokens/read",
|                                                    "Microsoft.ContainerRegistry/registries/tokens/write",
|                                                    "Microsoft.ContainerRegistry/registries/tokens/delete",
|                                                    "Microsoft.ContainerRegistry/registries/tokens/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/scopeMaps/read",
|                                                    "Microsoft.ContainerRegistry/registries/scopeMaps/write",
|                                                    "Microsoft.ContainerRegistry/registries/scopeMaps/delete",
|                                                    "Microsoft.ContainerRegistry/registries/scopeMaps/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ContainerRegistry/registries/connectedRegistries/read",
|                                                    "Microsoft.ContainerRegistry/registries/connectedRegistries/write",
|                                                    "Microsoft.ContainerRegistry/registries/connectedRegistries/delete",
|                                                    "Microsoft.ContainerRegistry/registries/connectedRegistries/deactivate/action",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/read",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/write",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/delete",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/action",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/ping/action",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/listEvents/action",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/operationStatuses/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.ContainerRegistry/locations/operationResults/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/privateEndpoints/privateLinkServiceProxies/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "566f0da3-e2a5-4393-9089-763f8bab8fb6",
|                                    "Name":  "Health Safeguards Data User",
|                                    "Description":  "Allows processing of health data in all available Health Safeguards",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalAnchoring/Process/Action",
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalCodesValidation/Process/Action",
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalConflictDetection/Process/Action",
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalEvidenceVerification/Process/Action",
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalProvenance/Process/Action",
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalSemanticValidation/Process/Action",
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/DetectHallucinationsAndOmissions/Process/Action",
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/HealthAdaptedFiltering/Process/Action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "69b07be0-09bf-439a-b9a6-e73de851bd59",
|                                    "Name":  "Container Registry Configuration Reader and Data Access Configuration Reader",
|                                    "Description":  "Provides permissions to list container registries and registry configuration properties. Provides permissions to list data access configuration such as admin user credentials, scope maps, and tokens, which can be used to read, write or delete repositories and images. Does not provide direct permissions to read, list, or write registry contents including repositories and images. Does not provide permissions to modify data plane content such as imports, Artifact Cache or Sync, and Transfer Pipelines. Does not provide permissions for managing Tasks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/read",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/listCredentials/action",
|                                                    "Microsoft.ContainerRegistry/registries/tokens/read",
|                                                    "Microsoft.ContainerRegistry/registries/tokens/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/scopeMaps/read",
|                                                    "Microsoft.ContainerRegistry/registries/scopeMaps/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/read",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/action",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/listEvents/action",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/replications/read",
|                                                    "Microsoft.ContainerRegistry/registries/replications/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/connectedRegistries/read",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bf94e731-3a51-4a7c-8c54-a1ab9971dfc1",
|                                    "Name":  "Container Registry Transfer Pipeline Contributor",
|                                    "Description":  "Provides the ability to transfer, import, and export artifacts through configuring registry transfer pipelines that involve intermediary storage accounts and key vaults. Does not provide permissions to push or pull images. Does not provide permissions to create, manage, or list storage accounts or key vaults. Does not provide permissions to perform role assignments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/exportPipelines/read",
|                                                    "Microsoft.ContainerRegistry/registries/exportPipelines/write",
|                                                    "Microsoft.ContainerRegistry/registries/exportPipelines/delete",
|                                                    "Microsoft.ContainerRegistry/registries/importPipelines/read",
|                                                    "Microsoft.ContainerRegistry/registries/importPipelines/write",
|                                                    "Microsoft.ContainerRegistry/registries/importPipelines/delete",
|                                                    "Microsoft.ContainerRegistry/registries/pipelineRuns/read",
|                                                    "Microsoft.ContainerRegistry/registries/pipelineRuns/write",
|                                                    "Microsoft.ContainerRegistry/registries/pipelineRuns/delete",
|                                                    "Microsoft.ContainerRegistry/registries/pipelineRuns/operationStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "97dfb3ce-e936-462c-9425-9cdb67e66d45",
|                                    "Name":  "Desktop Virtualization App Attach Contributor",
|                                    "Description":  "Provide permission to manage app attach resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.DesktopVirtualization/appattachpackages/read",
|                                                    "Microsoft.DesktopVirtualization/appattachpackages/write",
|                                                    "Microsoft.DesktopVirtualization/appattachpackages/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e9701b4d-e6e7-4657-91cd-360a0881d224",
|                                    "Name":  "HybridCompute Machine ListAccessDetails Action In-Built Role",
|                                    "Description":  "In-Built Role definition that grants permissions to execute the listAccessDetails action on HybridCompute Machines",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/machines/listAccessDetails/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8ea85a25-eb16-4e29-ab4d-6f2a26c711a2",
|                                    "Name":  "App Service Environment Contributor",
|                                    "Description":  "Manage App Service Environments but not the App Service Plans or Websites that it hosts.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Web/hostingEnvironments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ada52afe-776a-4b4d-a8f2-55670d3d8178",
|                                    "Name":  "Kubernetes Agent Subscription Level Operator",
|                                    "Description":  "Grants Microsoft Defender for Cloud subscription level permissions needed to activate Containers plan",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedkeys/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c1410b24-3e69-4857-8f86-4d0a2e603250",
|                                    "Name":  "Quantum Workspace Data Contributor",
|                                    "Description":  "Create, read, and modify jobs and other Workspace data. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Quantum/Workspaces/read",
|                                                    "Microsoft.Quantum/locations/offerings/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Quantum/Workspaces/jobs/read",
|                                                        "Microsoft.Quantum/Workspaces/jobs/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "09976791-48a7-449e-bb21-39d1a415f350",
|                                    "Name":  "Communication and Email Service Owner",
|                                    "Description":  "Create, read, modify, and delete Communications and Email Service resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Communication/CheckNameAvailability/action",
|                                                    "Microsoft.Communication/Locations/OperationStatuses/read",
|                                                    "Microsoft.Communication/Locations/OperationStatuses/write",
|                                                    "Microsoft.Communication/Operations/read",
|                                                    "Microsoft.Communication/CommunicationServices/read",
|                                                    "Microsoft.Communication/CommunicationServices/write",
|                                                    "Microsoft.Communication/CommunicationServices/delete",
|                                                    "Microsoft.Communication/CommunicationServices/ListKeys/action",
|                                                    "Microsoft.Communication/CommunicationServices/RegenerateKey/action",
|                                                    "Microsoft.Communication/CommunicationServices/LinkNotificationHub/action",
|                                                    "Microsoft.Communication/CommunicationServices/EventGridFilters/read",
|                                                    "Microsoft.Communication/CommunicationServices/EventGridFilters/write",
|                                                    "Microsoft.Communication/CommunicationServices/EventGridFilters/delete",
|                                                    "Microsoft.Communication/EmailServices/read",
|                                                    "Microsoft.Communication/EmailServices/write",
|                                                    "Microsoft.Communication/EmailServices/delete",
|                                                    "Microsoft.Communication/EmailServices/Domains/read",
|                                                    "Microsoft.Communication/EmailServices/Domains/write",
|                                                    "Microsoft.Communication/EmailServices/Domains/delete",
|                                                    "Microsoft.Communication/EmailServices/Domains/SenderUsernames/read",
|                                                    "Microsoft.Communication/EmailServices/Domains/SenderUsernames/write",
|                                                    "Microsoft.Communication/EmailServices/Domains/SenderUsernames/delete",
|                                                    "Microsoft.Communication/EmailServices/Domains/SuppressionLists/read",
|                                                    "Microsoft.Communication/EmailServices/Domains/SuppressionLists/write",
|                                                    "Microsoft.Communication/EmailServices/Domains/SuppressionLists/delete",
|                                                    "Microsoft.Communication/EmailServices/Domains/SuppressionLists/SuppressionListAddresses/read",
|                                                    "Microsoft.Communication/EmailServices/Domains/SuppressionLists/SuppressionListAddresses/write",
|                                                    "Microsoft.Communication/EmailServices/Domains/SuppressionLists/SuppressionListAddresses/delete",
|                                                    "Microsoft.Communication/EmailServices/Domains/InitiateVerification/action",
|                                                    "Microsoft.Communication/EmailServices/Domains/CancelVerification/action",
|                                                    "Microsoft.Communication/EmailServices/Domains/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "59c05558-2358-462d-ba19-afbd7118936d",
|                                    "Name":  "Oracle.Database Autonomous Database Administrator",
|                                    "Description":  "Grants full access to manage all Autonomous Database resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/autonomousDatabases/*/read",
|                                                    "Oracle.Database/autonomousDatabases/*/write",
|                                                    "Oracle.Database/autonomousDatabases/*/delete",
|                                                    "Oracle.Database/autonomousDatabases/*/action",
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Locations/*/write",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/action",
|                                                    "Oracle.Database/resourceAnchors/*",
|                                                    "Oracle.Database/networkAnchors/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/locations/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "11102f94-c441-49e6-a78b-ef80e0188abc",
|                                    "Name":  "Azure AI Safety Evaluator",
|                                    "Description":  "This role can perform all actions under workspace evaluations and simulations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/evaluations/*",
|                                                    "Microsoft.MachineLearningServices/workspaces/simulations/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fb382eab-e894-4461-af04-94435c366c3f",
|                                    "Name":  "Container Registry Tasks Contributor",
|                                    "Description":  "Provides permissions to configure, read, list, trigger, or cancel Container Registry Tasks, Task Runs, Task Logs, Quick Runs, Quick Builds, and Task Agent Pools. Permissions granted for Tasks management can be used for full registry data plane permissions including reading/writing/deleting container images in registries. Permissions granted for Tasks management can also be used to run customer authored build directives and run scripts to build software artifacts.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/agentpools/read",
|                                                    "Microsoft.ContainerRegistry/registries/agentpools/write",
|                                                    "Microsoft.ContainerRegistry/registries/agentpools/delete",
|                                                    "Microsoft.ContainerRegistry/registries/agentpools/listQueueStatus/action",
|                                                    "Microsoft.ContainerRegistry/registries/agentpools/operationResults/status/read",
|                                                    "Microsoft.ContainerRegistry/registries/agentpools/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/tasks/read",
|                                                    "Microsoft.ContainerRegistry/registries/tasks/write",
|                                                    "Microsoft.ContainerRegistry/registries/tasks/delete",
|                                                    "Microsoft.ContainerRegistry/registries/tasks/listDetails/action",
|                                                    "Microsoft.ContainerRegistry/registries/scheduleRun/action",
|                                                    "Microsoft.ContainerRegistry/registries/listBuildSourceUploadUrl/action",
|                                                    "Microsoft.ContainerRegistry/registries/runs/read",
|                                                    "Microsoft.ContainerRegistry/registries/runs/write",
|                                                    "Microsoft.ContainerRegistry/registries/runs/listLogSasUrl/action",
|                                                    "Microsoft.ContainerRegistry/registries/runs/cancel/action",
|                                                    "Microsoft.ContainerRegistry/registries/taskruns/read",
|                                                    "Microsoft.ContainerRegistry/registries/taskruns/write",
|                                                    "Microsoft.ContainerRegistry/registries/taskruns/delete",
|                                                    "Microsoft.ContainerRegistry/registries/taskruns/listDetails/action",
|                                                    "Microsoft.ContainerRegistry/registries/taskruns/operationStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerRegistry/registries/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "afc680e2-a938-412d-b213-9a49efa7fb83",
|                                    "Name":  "Azure Backup Snapshot Contributor",
|                                    "Description":  "Provide permissions to backup identity to manage RPC snapshots",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/restorePointCollections/read",
|                                                    "Microsoft.Compute/restorePointCollections/write",
|                                                    "Microsoft.Compute/restorePointCollections/restorePoints/write",
|                                                    "Microsoft.Compute/restorePointCollections/restorePoints/read",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "49fc33c1-886f-4b21-a00e-1d9993234734",
|                                    "Name":  "AVS on Fleet VIS Role",
|                                    "Description":  "Do not remove this role from your resource because it is critical to enable your AVS private cloud to operate. If the role is removed, it will cause your AVS private cloud control plane to no longer operate correctly. The role is used to enable the AVS private cloud control plane to inject address prefix changes of the private clouds attached virtual network to SDN and support peering sync feature. This role is not intended for use cases outside of assignment to the associated AVS identity in your entra-id tenant.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/write",
|                                                    "Microsoft.Network/virtualNetworks/peer/action",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/networkIntentPolicies/join/action",
|                                                    "Microsoft.Network/ddosProtectionPlans/join/action",
|                                                    "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action",
|                                                    "Microsoft.BareMetal/peeringSettings/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "53e48117-a530-4075-bcbe-d91913e3bdb8",
|                                    "Name":  "Edge Management Copilot User",
|                                    "Description":  "Enables users access to Edge Management Copilot.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EdgeManagement/locations/chat/action",
|                                                    "Microsoft.EdgeManagement/troubleshoot/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d6a5505f-6ebb-45a4-896e-ac8274cfc0ac",
|                                    "Name":  "Durable Task Data Reader",
|                                    "Description":  "Read all Durable Task Scheduler data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DurableTask/schedulers/taskhubs/orchestrations/read",
|                                                        "Microsoft.DurableTask/schedulers/taskhubs/orchestrations/metadata/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1a6f9009-515c-4455-b170-143e4c9ce229",
|                                    "Name":  "Azure Stack HCI Edge Machine Contributor Role",
|                                    "Description":  "Microsoft.AzureStackHCI Edge Machine Contributor Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/EdgeMachines/*",
|                                                    "Microsoft.AzureStackHCI/locations/ValidateOwnershipVouchers/action",
|                                                    "Microsoft.Edge/Sites/read",
|                                                    "Microsoft.Edge/Sites/write",
|                                                    "Microsoft.Edge/configurationReferences/read",
|                                                    "Microsoft.Edge/configurationReferences/write",
|                                                    "Microsoft.Edge/Configurations/*/read",
|                                                    "Microsoft.Edge/Configurations/*/write",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "53747cdd-e97c-477a-948c-b587d0e514b2",
|                                    "Name":  "Online Experimentation Data Owner",
|                                    "Description":  "Allows full access to Online Experimentation data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.OnlineExperimentation/workspaces/read",
|                                                        "Microsoft.OnlineExperimentation/workspaces/write",
|                                                        "Microsoft.OnlineExperimentation/workspaces/delete",
|                                                        "Microsoft.OnlineExperimentation/workspaces/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1363e94d-546f-4fe9-8434-b0eefb292d59",
|                                    "Name":  "Online Experimentation Data Reader",
|                                    "Description":  "Allows read access to Online Experimentation data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.OnlineExperimentation/workspaces/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "59a618e3-3c9a-406e-9f03-1a20dd1c55f1",
|                                    "Name":  "Chaos Studio Target Contributor",
|                                    "Description":  "Can onboard targets and manage capabilities but cannot create, run, or see details for experiments",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Chaos/targets/write",
|                                                    "Microsoft.Chaos/targets/delete",
|                                                    "Microsoft.Chaos/targets/read",
|                                                    "Microsoft.Chaos/targets/capabilities/write",
|                                                    "Microsoft.Chaos/targets/capabilities/delete",
|                                                    "Microsoft.Chaos/targets/capabilities/read",
|                                                    "Microsoft.Chaos/locations/targetTypes/read",
|                                                    "Microsoft.Chaos/locations/targetTypes/capabilityTypes/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a8d01690-9418-4783-8ca2-9f0f1791783d",
|                                    "Name":  "Auto Actions Contributor",
|                                    "Description":  "Allows users to manage Auto Actions resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ComputeSchedule/locations/OperationStatuses/write",
|                                                    "Microsoft.ComputeSchedule/autoActions/write",
|                                                    "Microsoft.ComputeSchedule/autoActions/delete",
|                                                    "Microsoft.ComputeSchedule/autoActions/attachResources/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/cancelNextOccurrence/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/detachResources/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/disable/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/enable/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/listResources/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/patchResources/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/triggerManualOccurrence/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/occurrences/cancel/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/occurrences/delay/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/occurrences/listResources/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a227fb39-f479-404b-96fd-0176f5d88ab4",
|                                    "Name":  "Azure Device Onboarding Discovery Contributor",
|                                    "Description":  "Can read, write or delete the discovery and it\u0027s child resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DeviceOnboarding/discoveryServices/*",
|                                                    "Microsoft.DeviceOnboarding/locations/operationStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "31ef6312-5b0c-4ce9-8c5d-587a91344fe7",
|                                    "Name":  "SSH PublicKeys Reader Role",
|                                    "Description":  "This is the role created for SSH PublicKeys Reader",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/sshpublickeys/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fc6e3395-6a8c-4527-bb4c-d0abd41e8e74",
|                                    "Name":  "SSH PublicKeys Contributor Role",
|                                    "Description":  "This is the role created for SSH PublicKeys Contributor",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/sshpublickeys/read",
|                                                    "Microsoft.Compute/sshpublickeys/write",
|                                                    "Microsoft.Compute/sshpublickeys/delete",
|                                                    "Microsoft.Compute/sshpublickeys/generatekeypair/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1b7f3653-4324-473a-9165-bc55e4d04ba8",
|                                    "Name":  "Azure Kubernetes Service Agent Pool Manager Role",
|                                    "Description":  "Role for agentpool related actions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/read",
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/write",
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/delete",
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/upgradeNodeImageVersion/action",
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/abort/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "68ac31b4-936a-4046-a6d2-ba6f8a757bf6",
|                                    "Name":  "Defender Serverless Scanner",
|                                    "Description":  "Grants access to Serverless resources and thier connections",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.web/sites/publish/action",
|                                                    "Microsoft.Web/sites/sitecontainers/read",
|                                                    "microsoft.web/sites/slots/publish/action",
|                                                    "microsoft.web/sites/config/list/action",
|                                                    "microsoft.web/sites/slots/config/list/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "96ebd254-ecc7-4590-aff5-e9af3ff5f3b3",
|                                    "Name":  "Dedicated Host Contributor Role",
|                                    "Description":  "This is the role created for DedicatedHosts Contributor",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/hostGroups/read",
|                                                    "Microsoft.Compute/hostGroups/write",
|                                                    "Microsoft.Compute/hostGroups/delete",
|                                                    "Microsoft.Compute/hostGroups/hosts/read",
|                                                    "Microsoft.Compute/hostGroups/hosts/write",
|                                                    "Microsoft.Compute/hostGroups/hosts/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2bed379c-9fba-455b-99e4-6b911073bcf2",
|                                    "Name":  "Compute Fleet Contributor",
|                                    "Description":  "Allows users to manage Compute Fleet resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureFleet/fleets/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1df7cd83-1d3f-41df-95b0-53b30d963369",
|                                    "Name":  "Azure API Center Credential Access Reader",
|                                    "Description":  "Allows for access to Azure API Center data plane get credentials operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ApiCenter/services/workspaces/apis/versions/securityRequirements/read",
|                                                        "Microsoft.ApiCenter/services/workspaces/apis/versions/securityRequirements/getCredentials/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7e559ce2-48d7-4b27-9128-fa1b247f1308",
|                                    "Name":  "Managed Identity Federated Identity Credential Contributor",
|                                    "Description":  "Create, Read, Update, and Delete User Assigned Identity Federated Identity Credentials(FIC)",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/read",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "92b92042-07d9-4307-87f7-36a593fc5850",
|                                    "Name":  "Azure File Sync Administrator",
|                                    "Description":  "Provides full access to manage all Azure File Sync (Storage Sync Service) resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.StorageSync/register/action",
|                                                    "Microsoft.StorageSync/unregister/action",
|                                                    "Microsoft.StorageSync/locations/*",
|                                                    "Microsoft.StorageSync/deployments/preflight/action",
|                                                    "Microsoft.StorageSync/storageSyncServices/*",
|                                                    "Microsoft.StorageSync/operations/read",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Insights/AlertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "754c1a27-40dc-4708-8ad4-2bffdeee09e8",
|                                    "Name":  "Azure File Sync Reader",
|                                    "Description":  "Provides read access to Azure File Sync service (Storage Sync Service).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.StorageSync/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "88366f10-ed47-4cc0-9fab-c8a06148393e",
|                                    "Name":  "Azure Red Hat OpenShift Hosted Control Planes Cluster API Provider",
|                                    "Description":  "Enables permissions to allow cluster API to manage nodes, networks and disks for OpenShift cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Compute/availabilitySets/delete",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/availabilitySets/write",
|                                                    "Microsoft.Compute/virtualMachines/delete",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a00ed373-f085-4b75-a950-53eacdc52ac0",
|                                    "Name":  "Oracle.Database Exascale Storage Vault Administrator",
|                                    "Description":  "Grants full access to manage Exascale Storage Vaults",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/exascaleDbStorageVaults/read",
|                                                    "Oracle.Database/exascaleDbStorageVaults/write",
|                                                    "Oracle.Database/exascaleDbStorageVaults/delete",
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Locations/*/write",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/resourceAnchors/*",
|                                                    "Oracle.Database/networkAnchors/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "58b80de8-4b34-424c-9e47-23faf0f7cfe2",
|                                    "Name":  "Online Experimentation Reader",
|                                    "Description":  "Grants permission for read operations to Online Experimentation resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.OnlineExperimentation/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2c7a01fe-5518-4a42-93c2-658e45441691",
|                                    "Name":  "Online Experimentation Contributor",
|                                    "Description":  "Grants permissions for all management operations to Online Experimentation resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.OnlineExperimentation/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "61eb6405-5f4a-440b-ad03-fe06c5c85e44",
|                                    "Name":  "Flux Configurations Contributor",
|                                    "Description":  "Can create, update, get, list and delete Flux Configurations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.KubernetesConfiguration/fluxConfigurations/write",
|                                                    "Microsoft.KubernetesConfiguration/fluxConfigurations/read",
|                                                    "Microsoft.KubernetesConfiguration/fluxConfigurations/delete",
|                                                    "Microsoft.KubernetesConfiguration/fluxConfigurations/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f094fb07-0703-4400-ad6a-e16dd8000e14",
|                                    "Name":  "Container Registry Credential Set Administrator",
|                                    "Description":  "Create, Read, Update, and Delete Credential Sets in Container Registry. This role doesn\u0027t affect the needed permissions for storing content inside Azure Key Vault. This role also doesn\u0027t grant permissions to manage Cache Rules.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/credentialSets/read",
|                                                    "Microsoft.ContainerRegistry/registries/credentialSets/write",
|                                                    "Microsoft.ContainerRegistry/registries/credentialSets/delete",
|                                                    "Microsoft.ContainerRegistry/registries/credentialSets/operationStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c357b964-0002-4b64-a50d-7a28f02edc52",
|                                    "Name":  "Container Registry Cache Rule Reader",
|                                    "Description":  "Read the configuration of Cache Rules in Container Registry. This permission doesn\u0027t grant permission to read Credential Sets.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/cacheRules/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "29093635-9924-4f2c-913b-650a12949526",
|                                    "Name":  "Container Registry Credential Set Reader",
|                                    "Description":  "Read the configuration of Credential Sets in Container Registry. This permission doesn\u0027t allow permission to see content inside Azure Key vault only the content inside Container Registry. This permission doesn\u0027t grant permission to read Cache Rules.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/credentialSets/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0869d06d-e3d1-4472-8764-1bb71b2bdaf7",
|                                    "Name":  "Oracle.Database Exascale VmCluster Administrator",
|                                    "Description":  "Grants full access to manage Exascale VmClusters",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/exascaleDbStorageVaults/read",
|                                                    "Oracle.Database/exadbVmClusters/*/read",
|                                                    "Oracle.Database/exadbVmClusters/*/write",
|                                                    "Oracle.Database/exadbVmClusters/*/delete",
|                                                    "Oracle.Database/exadbVmClusters/*/action",
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Locations/*/write",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/resourceAnchors/*",
|                                                    "Oracle.Database/networkAnchors/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Compute/sshPublicKeys/read",
|                                                    "Microsoft.Compute/sshPublicKeys/write",
|                                                    "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8d7ecc5c-f27b-43cf-883f-46409d445502",
|                                    "Name":  "Issue Contributor",
|                                    "Description":  "Can read all issues data and update issues settings.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AlertsManagement/Issues/*",
|                                                    "microsoft.monitor/accounts/issues/*",
|                                                    "Microsoft.AlertsManagement/alerts/*",
|                                                    "Microsoft.Insights/components/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "df87f177-bb12-4db1-9793-a413691eff94",
|                                    "Name":  "Container Registry Cache Rule Administrator",
|                                    "Description":  "Create, Read, Update, and Delete Cache Rules in Container Registry. This role doesn\u0027t grant permissions to manage Credential Sets.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/cacheRules/read",
|                                                    "Microsoft.ContainerRegistry/registries/cacheRules/write",
|                                                    "Microsoft.ContainerRegistry/registries/cacheRules/delete",
|                                                    "Microsoft.ContainerRegistry/registries/cacheRules/operationStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2593f4c7-8bf4-4fff-9804-2ee069b41902",
|                                    "Name":  "Power Platform Account Contributor",
|                                    "Description":  "Create, Read, Update, and Delete Power Platform Account resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.PowerPlatform/accounts/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "babe7770-cdbc-4f46-9bd7-b90b34842946",
|                                    "Name":  "Power Platform Enterprise Policy Contributor",
|                                    "Description":  "Create, Read, Update, and Delete Power Platform Enterprise Policy resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.PowerPlatform/enterprisePolicies/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "33cdeeac-0940-4f85-9317-7e2432c17289",
|                                    "Name":  "Usage Billing Contributor",
|                                    "Description":  "Contributor access to Accounts",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.UsageBilling/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "db9875ba-bd2b-4e98-934d-0daa549a07f0",
|                                    "Name":  "Workload Orchestration Solution External Validator",
|                                    "Description":  "Grants you access to fetch targets, solution templates, solutions and update the external validation status",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Edge/targets/read",
|                                                    "Microsoft.Edge/solutionTemplates/read",
|                                                    "Microsoft.Edge/solutionTemplates/versions/read",
|                                                    "Microsoft.Edge/targets/solutions/versions/read",
|                                                    "Microsoft.Edge/targets/updateExternalValidationStatus/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "eadc314b-1a2d-4efa-be10-5d325db5065e",
|                                    "Name":  "Azure AI Project Manager",
|                                    "Description":  "Lets you perform developer actions and management actions on Azure AI Foundry Projects. Allows for making role assignments, but limited to Cognitive Service User role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.CognitiveServices/accounts/*/read",
|                                                    "Microsoft.CognitiveServices/accounts/projects/*",
|                                                    "Microsoft.CognitiveServices/locations/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0618ae3d-2930-4bb7-aa00-718db34ee9f9",
|                                    "Name":  "Azure Monitor Dashboards with Grafana Contributor",
|                                    "Description":  "Can manage dashboards with Grafana.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Dashboard/dashboards/read",
|                                                    "Microsoft.Dashboard/dashboards/write",
|                                                    "Microsoft.Dashboard/dashboards/delete",
|                                                    "Microsoft.Dashboard/dashboards/dashboardDefinitions/read",
|                                                    "Microsoft.Dashboard/dashboards/dashboardDefinitions/write",
|                                                    "Microsoft.Dashboard/dashboards/dashboardDefinitions/delete",
|                                                    "Microsoft.Dashboard/locations/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e47c6f54-e4a2-4754-9501-8e0985b135e1",
|                                    "Name":  "Azure AI Account Owner",
|                                    "Description":  "Grants full access to manage AI projects and accounts. Grants conditional assignment of the Azure AI User role to other user principles.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.CognitiveServices/*",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/providers/features/register/action",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/diagnosticSettings/*",
|                                                    "Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Insights/metricdefinitions/read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5c227a58-cff3-4b51-9fa3-51bdafb6ca55",
|                                    "Name":  "Secrets Store Extension Owner",
|                                    "Description":  "Read, create and modify secretsync and secretproviderclass objects. Register and deregister the provider from the subscription.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SecretSyncController/register/action",
|                                                    "Microsoft.SecretSyncController/unregister/action",
|                                                    "Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/read",
|                                                    "Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/write",
|                                                    "Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/delete",
|                                                    "Microsoft.SecretSyncController/locations/operationStatuses/read",
|                                                    "Microsoft.SecretSyncController/locations/operationStatuses/write",
|                                                    "Microsoft.SecretSyncController/operations/read",
|                                                    "Microsoft.SecretSyncController/secretSyncs/read",
|                                                    "Microsoft.SecretSyncController/secretSyncs/write",
|                                                    "Microsoft.SecretSyncController/secretSyncs/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "53ca6127-db72-4b80-b1b0-d745d6d5456d",
|                                    "Name":  "Azure AI User",
|                                    "Description":  "Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Insights/diagnosticSettings/read",
|                                                    "Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Insights/metricdefinitions/read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c0ff367d-66d8-445e-917c-583feb0ef0d4",
|                                    "Name":  "Azure Red Hat OpenShift Hosted Control Planes Service Managed Identity",
|                                    "Description":  "Azure Red Hat OpenShift Hosted Control Planes Service Managed Identity",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/routeTables/read",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/natGateways/read",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/write",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/write",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/virtualNetworks/joinLoadBalancer/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fc0c873f-45e9-4d0d-a7d1-585aab30c6ed",
|                                    "Name":  "Azure Red Hat OpenShift Hosted Control Planes Control Plane Operator",
|                                    "Description":  "Enables the control plane operator to read resources necessary for OpenShift cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "de2b316d-7a2c-4143-b4cd-c148f6a355a1",
|                                    "Name":  "Azure Kubernetes Fleet Manager Hub Agent Role",
|                                    "Description":  "Grants access to Azure resources needed by Azure Kubernetes Fleet Manager hub agents.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/trafficManagerProfiles/read",
|                                                    "Microsoft.Network/trafficManagerProfiles/write",
|                                                    "Microsoft.Network/trafficManagerProfiles/delete",
|                                                    "Microsoft.Network/trafficManagerProfiles/azureEndpoints/read",
|                                                    "Microsoft.Network/trafficManagerProfiles/azureEndpoints/write",
|                                                    "Microsoft.Network/trafficManagerProfiles/azureEndpoints/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "63304235-eaf4-4c15-8e93-46c483611231",
|                                    "Name":  "Workload Orchestration IT Admin",
|                                    "Description":  "Grants you access to manage the IT Admin operations for Workload Orchestration",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Edge/contexts/eventGridFilters/delete",
|                                                    "Microsoft.Edge/contexts/eventGridFilters/read",
|                                                    "Microsoft.Edge/contexts/eventGridFilters/write",
|                                                    "Microsoft.Edge/contexts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f6e92014-8af2-414d-9948-9b1abf559285",
|                                    "Name":  "Arc Gateway Manager",
|                                    "Description":  "Manage Arc Gateway Resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/settings/write",
|                                                    "Microsoft.HybridCompute/settings/read",
|                                                    "Microsoft.HybridCompute/gateways/read",
|                                                    "Microsoft.HybridCompute/gateways/write",
|                                                    "Microsoft.HybridCompute/gateways/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8e253927-1f29-4d89-baa2-c3a549eff423",
|                                    "Name":  "Azure Kubernetes Service Machine Manager Role",
|                                    "Description":  "Role for machine related actions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/deleteMachines/action",
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/machines/read",
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/machines/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5f569efd-4da5-4123-99cd-d42fbb2a836e",
|                                    "Name":  "Microsoft.AzureStackHCI EdgeMachine Reader",
|                                    "Description":  "Microsoft.AzureStackHCI EdgeMachine Reader",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/EdgeMachines/Read/*",
|                                                    "Microsoft.AzureStackHCI/EdgeMachines/Jobs/Read/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "adc3c795-c41e-4a89-a478-0b321783324c",
|                                    "Name":  "Microsoft.AzureStackHCI Device Pool Manager",
|                                    "Description":  "Microsoft.AzureStackHCI Device Pool Manager ",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/DevicePools/read",
|                                                    "Microsoft.AzureStackHCI/DevicePools/ClaimDevices/action",
|                                                    "Microsoft.AzureStackHCI/DevicePools/ReleaseDevices/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "47be4a87-7950-4631-9daf-b664a405f074",
|                                    "Name":  "Monitoring Policy Contributor",
|                                    "Description":  "Allows read access to all monitoring data, update permissions for monitoring settings and permissions to deploy and remediate Azure Monitor alert policies.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.AlertsManagement/alerts/*",
|                                                    "Microsoft.AlertsManagement/alertsSummary/*",
|                                                    "Microsoft.AlertsManagement/issues/*",
|                                                    "Microsoft.Insights/actiongroups/*",
|                                                    "Microsoft.Insights/activityLogAlerts/*",
|                                                    "Microsoft.Insights/AlertRules/*",
|                                                    "Microsoft.Insights/components/*",
|                                                    "Microsoft.Insights/createNotifications/*",
|                                                    "Microsoft.Insights/dataCollectionEndpoints/*",
|                                                    "Microsoft.Insights/dataCollectionRules/*",
|                                                    "Microsoft.Insights/dataCollectionRuleAssociations/*",
|                                                    "Microsoft.Insights/DiagnosticSettings/*",
|                                                    "Microsoft.Insights/eventtypes/*",
|                                                    "Microsoft.Insights/LogDefinitions/*",
|                                                    "Microsoft.Insights/metricalerts/*",
|                                                    "Microsoft.Insights/MetricDefinitions/*",
|                                                    "Microsoft.Insights/Metrics/*",
|                                                    "Microsoft.Insights/notificationStatus/*",
|                                                    "Microsoft.Insights/Register/Action",
|                                                    "Microsoft.Insights/scheduledqueryrules/*",
|                                                    "Microsoft.Insights/webtests/*",
|                                                    "Microsoft.Insights/workbooks/*",
|                                                    "Microsoft.Insights/workbooktemplates/*",
|                                                    "Microsoft.Insights/privateLinkScopes/*",
|                                                    "Microsoft.Insights/privateLinkScopeOperationStatuses/*",
|                                                    "Microsoft.Monitor/accounts/*",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.OperationalInsights/workspaces/intelligencepacks/*",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                    "Microsoft.OperationalInsights/workspaces/search/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/read",
|                                                    "Microsoft.OperationalInsights/workspaces/storageinsightconfigs/*",
|                                                    "Microsoft.OperationalInsights/locations/workspaces/failover/action",
|                                                    "Microsoft.OperationalInsights/workspaces/failback/action",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.AlertsManagement/smartDetectorAlertRules/*",
|                                                    "Microsoft.AlertsManagement/actionRules/*",
|                                                    "Microsoft.AlertsManagement/smartGroups/*",
|                                                    "Microsoft.AlertsManagement/migrateFromSmartDetection/*",
|                                                    "Microsoft.AlertsManagement/investigations/*",
|                                                    "Microsoft.AlertsManagement/prometheusRuleGroups/*",
|                                                    "Microsoft.Monitor/investigations/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.PolicyInsights/remediations/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "765a04e0-5de8-4bb2-9bf6-b2a30bc03e91",
|                                    "Name":  "Storage File Delegator",
|                                    "Description":  "Allows for generation of a user delegation key, which can then be used to create a shared access signature for a file or Azure file share that is signed with Entra ID credentials.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/fileServices/generateUserDelegationKey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "965033a5-c8eb-4f35-b82f-fef460a3606d",
|                                    "Name":  "Storage Table Delegator",
|                                    "Description":  "Allows for generation of a user delegation key, which can then be used to create a shared access signature for an Azure Storage table that is signed with Entra ID credentials.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/tableServices/generateUserDelegationKey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7ee386e9-84f0-448e-80a6-f185f6533131",
|                                    "Name":  "Storage Queue Delegator",
|                                    "Description":  "Allows for generation of a user delegation key, which can then be used to create a shared access signature for an Azure Storage queue that is signed with Entra ID credentials.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/queueServices/generateUserDelegationKey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6fbca9a8-3561-41fd-8b20-6576043c1076",
|                                    "Name":  "Scheduled Actions Contributor",
|                                    "Description":  "Allows users to use Scheduled Actions offered by Microsoft.ComputeSchedule",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesCancelOperations/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteDeallocate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteHibernate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteStart/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteCreate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteDelete/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationErrors/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationStatus/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitDeallocate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitHibernate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitStart/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/write",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/delete",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/attachResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/cancelNextOccurrence/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/detachResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/disable/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/enable/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/listResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/patchResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/triggerManualOccurrence/action",
|                                                    "Microsoft.ComputeSchedule/register/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b6d9c0f6-d69f-472b-91b4-7a6838c6d1cb",
|                                    "Name":  "Microsoft.AzureStackHCI Device Pool Machine Manager",
|                                    "Description":  "Microsoft.AzureStackHCI Device Pool Machine Manager ",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridConnectivity/endpoints/write",
|                                                    "Microsoft.HybridConnectivity/endpoints/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/delete",
|                                                    "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/write",
|                                                    "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/delete",
|                                                    "Microsoft.HybridConnectivity/endpoints/listCredentials/action",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8b9beb50-e28c-4879-8472-24c9d328085f",
|                                    "Name":  "AI Model Scanner Operator",
|                                    "Description":  "Grants Microsoft Defender for AI access to AI services and resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/models/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/models/versions/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/datastores/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/metadata/artifacts/read",
|                                                    "Microsoft.MachineLearningServices/registries/read",
|                                                    "Microsoft.MachineLearningServices/registries/assets/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c9f76ca8-b262-4b10-8ed2-09cf0948aa35",
|                                    "Name":  "Azure Kubernetes Service Namespace User",
|                                    "Description":  "Allows users to read Azure Kubernetes Service namespace resources. In-cluster namespace access further requires assignment of Azure Kubernetes Service RBAC roles to the namespace resource for an Entra ID enabled cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/managedClusters/managedNamespaces/read",
|                                                    "Microsoft.ContainerService/managedClusters/managedNamespaces/listCredential/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "289d8817-ee69-43f1-a0af-43a45505b488",
|                                    "Name":  "Azure Kubernetes Service Namespace Contributor",
|                                    "Description":  "Allows users to create and manage Azure Kubernetes Service namespace resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/managedClusters/managedNamespaces/*",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "76153a9e-0edb-49bc-8e01-93c47e6b5180",
|                                    "Name":  "DevOps Infrastructure Contributor",
|                                    "Description":  "Read, write, delete and perform actions on Managed DevOps Pools",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DevOpsInfrastructure/register/action",
|                                                    "Microsoft.DevOpsInfrastructure/unregister/action",
|                                                    "Microsoft.DevOpsInfrastructure/*/read",
|                                                    "Microsoft.DevOpsInfrastructure/Locations/OperationStatuses/write",
|                                                    "Microsoft.DevOpsInfrastructure/pools/write",
|                                                    "Microsoft.DevOpsInfrastructure/pools/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4c6569b6-f23e-4295-9b90-bd4cc4ff3292",
|                                    "Name":  "DevCenter Owner",
|                                    "Description":  "Provides access to manage all Microsoft.DevCenter resources, and to manage access to Microsoft.DevCenter resources by adding or removing role assignments for the DevCenter Project Admin and DevCenter Dev Box roles.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DevCenter/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "32c34659-0f83-4a4c-80f2-63a244f8ae0b",
|                                    "Name":  "Service Health Billing Reader",
|                                    "Description":  "Grants permissions to view billing information present in service health events",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ResourceHealth/events/action",
|                                                    "Microsoft.ResourceHealth/AvailabilityStatuses/read",
|                                                    "Microsoft.ResourceHealth/AvailabilityStatuses/current/read",
|                                                    "Microsoft.ResourceHealth/Operations/read",
|                                                    "Microsoft.ResourceHealth/emergingissues/read",
|                                                    "Microsoft.ResourceHealth/events/read",
|                                                    "Microsoft.ResourceHealth/events/fetchBillingCommunicationDetails/action",
|                                                    "Microsoft.ResourceHealth/events/impactedResources/read",
|                                                    "Microsoft.ResourceHealth/metadata/read",
|                                                    "Microsoft.ResourceHealth/potentialoutages/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.ResourceHealth/events/fetchEventDetails/action",
|                                                       "Microsoft.ResourceHealth/events/listSecurityAdvisoryImpactedResources/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1a928ab0-1fee-43cf-9266-f9d8c22a8ddb",
|                                    "Name":  "Service Health Security Reader",
|                                    "Description":  "Grants permissions to view sensitive security information present in service health events",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ResourceHealth/events/action",
|                                                    "Microsoft.ResourceHealth/AvailabilityStatuses/read",
|                                                    "Microsoft.ResourceHealth/AvailabilityStatuses/current/read",
|                                                    "Microsoft.ResourceHealth/Operations/read",
|                                                    "Microsoft.ResourceHealth/emergingissues/read",
|                                                    "Microsoft.ResourceHealth/events/read",
|                                                    "Microsoft.ResourceHealth/events/fetchEventDetails/action",
|                                                    "Microsoft.ResourceHealth/events/listSecurityAdvisoryImpactedResources/action",
|                                                    "Microsoft.ResourceHealth/events/impactedResources/read",
|                                                    "Microsoft.ResourceHealth/metadata/read",
|                                                    "Microsoft.ResourceHealth/potentialoutages/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.ResourceHealth/events/fetchBillingCommunicationDetails/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "12b8206a-0216-4469-908d-a3e2025fe085",
|                                    "Name":  "Azure Stack Edge Operations Role",
|                                    "Description":  "Built in role for managing operations in azure stack edge",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/bandwidthSchedules/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/bandwidthSchedules/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/deviceCapacityCheck/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/downloadUpdates/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/generateCertificate/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/getExtendedInformation/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/installUpdates/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/orders/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/orders/listDCAccessCode/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/orders/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/publishers/offers/skus/versions/generatesastoken/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/addons/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/addons/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/migrate/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/monitoringConfig/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/monitoringConfig/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/scanForUpdates/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/securitySettings/update/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/shares/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/shares/refresh/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/shares/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccountCredentials/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccountCredentials/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/containers/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/containers/refresh/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/containers/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/triggers/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/triggers/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/triggerSupportPackage/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/updateExtendedInformation/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/uploadCertificate/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/users/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/users/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2016c9ed-c18d-4120-93d7-178e583efe92",
|                                    "Name":  "Grounding with Bing User",
|                                    "Description":  "Enable Approved Microsoft Applications to connect to Bing to retrieve and ground responses using real-time data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Bing/accounts/useGrounding/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "69a41f41-6dce-4ea7-8a34-8e095ddba55c",
|                                    "Name":  "Azure Advisor Service Role",
|                                    "Description":  "Grants permission to delete and write access for suppressions, configurations and assmessments",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Advisor/suppressions/write",
|                                                    "Microsoft.Advisor/suppressions/delete",
|                                                    "Microsoft.Advisor/recommendations/suppressions/write",
|                                                    "Microsoft.Advisor/recommendations/suppressions/delete",
|                                                    "Microsoft.Advisor/assessments/write",
|                                                    "Microsoft.Advisor/configurations/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "548d7e7c-65ee-412b-ae37-2dbb419d4207",
|                                    "Name":  "Experimentation Resource Admin",
|                                    "Description":  "Experimentation Resource Admin",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Experimentation/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "804db8d3-32c7-4ad4-a975-3f6f90d5f5f5",
|                                    "Name":  "FHIR Data Bulk Operator",
|                                    "Description":  "Role allows user or principal to perform bulk operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/write",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/delete",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/export/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/reindex/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/import/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/hardDelete/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/bulkOperator/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/write",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/delete",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/export/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/reindex/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/import/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/hardDelete/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/bulkOperator/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3bb7c424-af4e-436b-bfcc-8779c8934c31",
|                                    "Name":  "Microsoft Discovery Platform Reader (Preview)",
|                                    "Description":  "Grants readonly permissions to view Microsoft.Discovery resources. This role in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Discovery/*/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Discovery/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7a2b6e6c-472e-4b39-8878-a26eb63d75c6",
|                                    "Name":  "Microsoft Discovery Platform Administrator (Preview)",
|                                    "Description":  "Grants full access to manage Microsoft.Discovery resources. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Discovery/locations/operationStatuses/read",
|                                                    "Microsoft.Discovery/checkNameAvailability/action",
|                                                    "Microsoft.Discovery/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Discovery/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "01288891-85ee-45a7-b367-9db3b752fc65",
|                                    "Name":  "Microsoft Discovery Platform Contributor (Preview)",
|                                    "Description":  "Grants permissions to view and operate on most Discovery platform resources, including workspaces, supercomputers, storages, agents, bookshelves, data containers, models, tools, workflows, and investigations, as well as perform data plane actions, but does not allow creating, updating, or deleting core resources such as workspaces, supercomputers, storages, bookshelves, node pools, or projects. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Discovery/locations/operationStatuses/read",
|                                                    "Microsoft.Discovery/operations/read",
|                                                    "Microsoft.Discovery/workspaces/read",
|                                                    "Microsoft.Discovery/supercomputers/read",
|                                                    "Microsoft.Discovery/storages/read",
|                                                    "Microsoft.Discovery/agents/*",
|                                                    "Microsoft.Discovery/bookshelves/read",
|                                                    "Microsoft.Discovery/dataContainers/*",
|                                                    "Microsoft.Discovery/dataContainers/dataAssets/*",
|                                                    "Microsoft.Discovery/storageContainers/*",
|                                                    "Microsoft.Discovery/storageContainers/storageAssets/*",
|                                                    "Microsoft.Discovery/models/*",
|                                                    "Microsoft.Discovery/supercomputers/nodePools/read",
|                                                    "Microsoft.Discovery/tools/*",
|                                                    "Microsoft.Discovery/workflows/*",
|                                                    "Microsoft.Discovery/workspaces/chatModelDeployments/read",
|                                                    "Microsoft.Discovery/workspaces/projects/read",
|                                                    "Microsoft.Discovery/operations/read",
|                                                    "Microsoft.Insights/AlertRules/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Discovery/workspaces/write",
|                                                       "Microsoft.Discovery/workspaces/delete",
|                                                       "Microsoft.Discovery/supercomputers/write",
|                                                       "Microsoft.Discovery/supercomputers/delete",
|                                                       "Microsoft.Discovery/storages/write",
|                                                       "Microsoft.Discovery/storages/delete",
|                                                       "Microsoft.Discovery/bookshelves/write",
|                                                       "Microsoft.Discovery/bookshelves/delete",
|                                                       "Microsoft.Discovery/supercomputers/nodePools/write",
|                                                       "Microsoft.Discovery/supercomputers/nodePools/delete",
|                                                       "Microsoft.Discovery/workspaces/chatModelDeployments/write",
|                                                       "Microsoft.Discovery/workspaces/chatModelDeployments/delete",
|                                                       "Microsoft.Discovery/workspaces/projects/write",
|                                                       "Microsoft.Discovery/workspaces/projects/delete"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Discovery/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5bc02df6-6cd5-43fe-ad3d-4c93cf56cc16",
|                                    "Name":  "Azure IoT Operations Administrator",
|                                    "Description":  "View, create, edit and delete AIO resources. Manage all resources, including instance and its downstream resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.IoTOperations/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.DeviceRegistry/Assets/*",
|                                                    "Microsoft.DeviceRegistry/AssetEndpointProfiles/*",
|                                                    "Microsoft.DeviceRegistry/Namespaces/Assets/*",
|                                                    "Microsoft.DeviceRegistry/Namespaces/Devices/*",
|                                                    "Microsoft.DeviceRegistry/Namespaces/DiscoveredAssets/*",
|                                                    "Microsoft.DeviceRegistry/Namespaces/DiscoveredDevices/*",
|                                                    "Microsoft.DeviceRegistry/SchemaRegistries/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Edge/sites/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7b7c71ed-33fa-4ed2-a91a-e56d5da260b5",
|                                    "Name":  "Azure IoT Operations Onboarding",
|                                    "Description":  "User can Azure arc connect and deploy Azure IoT Operations securely.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.IoTOperations/*",
|                                                    "Microsoft.DeviceRegistry/register/action",
|                                                    "Microsoft.DeviceRegistry/schemaRegistries/read",
|                                                    "Microsoft.DeviceRegistry/schemaRegistries/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Edge/sites/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c459b115-f629-486b-b359-35feb5568b83",
|                                    "Name":  "Connector Writer",
|                                    "Description":  "Write connectors and have basic customer permissions like reading authorizations, alert rules and resourceGroups",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Impact/Connectors/Write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1abf4029-2200-4343-800c-e4c4c01eddbd",
|                                    "Name":  "Virtual Enclave Owner Role",
|                                    "Description":  "Virtual Enclave Owner Role to access the resources of Microsoft.Mission stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/write",
|                                                    "Microsoft.Mission/virtualEnclaves/delete",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/delete",
|                                                    "Microsoft.Mission/communities/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "61aed14c-6c9a-4ed5-aa44-49fc5e96a167",
|                                    "Name":  "NginxPlus Contributor service role",
|                                    "Description":  "Provides access to all Nginx.NginxPlus Control Plane operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "NGINX.NGINXPLUS/register/action",
|                                                    "NGINX.NGINXPLUS/unregister/action",
|                                                    "NGINX.NGINXPLUS/locations/read",
|                                                    "NGINX.NGINXPLUS/locations/operationStatuses/read",
|                                                    "NGINX.NGINXPLUS/locations/operationStatuses/write",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/Read",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/Write",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/Delete",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/apiKeys/Read",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/apiKeys/Write",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/apiKeys/Delete",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/certificates/Read",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/certificates/Write",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/certificates/Delete",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/configurations/Read",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/configurations/Write",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/configurations/Delete",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/wafPolicies/Read",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/wafPolicies/Write",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/wafPolicies/Delete",
|                                                    "NGINX.NGINXPLUS/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "35ffec73-9cb8-4593-8718-40d5bc4b7f6f",
|                                    "Name":  "CosmosDB Fleet Operator Role",
|                                    "Description":  "Lets you manage Azure CosmosDB Fleets and related child resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDB/fleets/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "29f61507-bdfb-4987-b629-20033be2d6c3",
|                                    "Name":  "Healthcare Apis contributor",
|                                    "Description":  "Allows all actions on healthcareapis provider resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HealthcareApis/services/*",
|                                                    "Microsoft.HealthcareApis/workspaces/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "81b67e46-ef5b-4404-bddd-090985bb4a28",
|                                    "Name":  "Liftr Datadog Contributor",
|                                    "Description":  "Provides access to Datadog Control Plane Operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Datadog/register/action",
|                                                    "Microsoft.Datadog/unregister/action",
|                                                    "Microsoft.Datadog/agreements/read",
|                                                    "Microsoft.Datadog/agreements/write",
|                                                    "Microsoft.Datadog/locations/read",
|                                                    "Microsoft.Datadog/locations/operationStatuses/read",
|                                                    "Microsoft.Datadog/locations/operationStatuses/write",
|                                                    "Microsoft.Datadog/monitors/read",
|                                                    "Microsoft.Datadog/monitors/write",
|                                                    "Microsoft.Datadog/monitors/delete",
|                                                    "Microsoft.Datadog/monitors/listApiKeys/action",
|                                                    "Microsoft.Datadog/monitors/getDefaultKey/action",
|                                                    "Microsoft.Datadog/monitors/setDefaultKey/action",
|                                                    "Microsoft.Datadog/monitors/refreshSetPasswordLink/action",
|                                                    "Microsoft.Datadog/monitors/listLinkedResources/action",
|                                                    "Microsoft.Datadog/monitors/listHosts/read",
|                                                    "Microsoft.Datadog/monitors/listLinkedResources/read",
|                                                    "Microsoft.Datadog/monitors/listMonitoredResources/read",
|                                                    "Microsoft.Datadog/monitors/monitoredSubscriptions/read",
|                                                    "Microsoft.Datadog/monitors/monitoredSubscriptions/write",
|                                                    "Microsoft.Datadog/monitors/singleSignOnConfigurations/write",
|                                                    "Microsoft.Datadog/monitors/singleSignOnConfigurations/read",
|                                                    "Microsoft.Datadog/monitors/tagRules/read",
|                                                    "Microsoft.Datadog/monitors/tagRules/write",
|                                                    "Microsoft.Datadog/registeredSubscriptions/read",
|                                                    "Microsoft.Datadog/subscriptionStatuses/read",
|                                                    "Microsoft.Datadog/operations/read",
|                                                    "Microsoft.Datadog/monitors/getDefaultApplicationKey/action",
|                                                    "Microsoft.Datadog/monitors/manageSreAgentConnectors/action",
|                                                    "Microsoft.Datadog/monitors/latestLinkedSaaS/action",
|                                                    "Microsoft.Datadog/monitors/linkSaaS/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d68eeb8d-afae-4932-a331-203b7957e509",
|                                    "Name":  "Liftr Elastic Contributor",
|                                    "Description":  "Provides access to Elastic Control Plane Operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Elastic/getOrganizationApiKey/action",
|                                                    "Microsoft.Elastic/checkNameAvailability/action",
|                                                    "Microsoft.Elastic/register/action",
|                                                    "Microsoft.Elastic/locations/read",
|                                                    "Microsoft.Elastic/locations/operationStatuses/read",
|                                                    "Microsoft.Elastic/locations/operationStatuses/write",
|                                                    "Microsoft.Elastic/monitors/read",
|                                                    "Microsoft.Elastic/monitors/write",
|                                                    "Microsoft.Elastic/monitors/delete",
|                                                    "Microsoft.Elastic/monitors/listMonitoredResources/action",
|                                                    "Microsoft.Elastic/monitors/listVMHost/action",
|                                                    "Microsoft.Elastic/monitors/createOrUpdateExternalUser/action",
|                                                    "Microsoft.Elastic/monitors/listAllTrafficFilters/action",
|                                                    "Microsoft.Elastic/monitors/listAssociatedTrafficFilters/action",
|                                                    "Microsoft.Elastic/monitors/createAndAssociateIPFilter/action",
|                                                    "Microsoft.Elastic/monitors/createAndAssociatePLFilter/action",
|                                                    "Microsoft.Elastic/monitors/associateTrafficFilter/action",
|                                                    "Microsoft.Elastic/monitors/detachAndDeleteTrafficFilter/action",
|                                                    "Microsoft.Elastic/monitors/detachTrafficFilter/action",
|                                                    "Microsoft.Elastic/monitors/deleteTrafficFilter/action",
|                                                    "Microsoft.Elastic/monitors/listUpgradableVersions/action",
|                                                    "Microsoft.Elastic/monitors/getBillingInfo/action",
|                                                    "Microsoft.Elastic/monitors/listConnectedPartnerResources/action",
|                                                    "Microsoft.Elastic/monitors/upgrade/action",
|                                                    "Microsoft.Elastic/monitors/vmIngestionDetails/action",
|                                                    "Microsoft.Elastic/monitors/vmCollectionUpdate/action",
|                                                    "Microsoft.Elastic/monitors/listDeploymentInfo/action",
|                                                    "Microsoft.Elastic/monitors/resubscribe/action",
|                                                    "Microsoft.Elastic/monitors/monitoredSubscriptions/read",
|                                                    "Microsoft.Elastic/monitors/monitoredSubscriptions/write",
|                                                    "Microsoft.Elastic/monitors/openAIIntegrations/read",
|                                                    "Microsoft.Elastic/monitors/openAIIntegrations/write",
|                                                    "Microsoft.Elastic/monitors/openAIIntegrations/getStatus/action",
|                                                    "Microsoft.Elastic/monitors/tagRules/read",
|                                                    "Microsoft.Elastic/monitors/tagRules/write",
|                                                    "Microsoft.Elastic/registeredSubscriptions/read",
|                                                    "Microsoft.Elastic/elasticVersions/read",
|                                                    "Microsoft.Elastic/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "225efd4d-4ca0-42a1-ae53-5f233ba23c73",
|                                    "Name":  "Liftr Elastic Owner",
|                                    "Description":  "Grants full access to manage Elastic resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Elastic/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a60da355-bdec-443f-8d42-a03f0422f04d",
|                                    "Name":  "Liftr Newrelic Contributor",
|                                    "Description":  "Provides access to Newrelic Control Plane Operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "NewRelic.Observability/register/action",
|                                                    "NewRelic.Observability/unregister/action",
|                                                    "NewRelic.Observability/accounts/read",
|                                                    "NewRelic.Observability/plans/read",
|                                                    "NewRelic.Observability/organizations/read",
|                                                    "NewRelic.Observability/locations/read",
|                                                    "NewRelic.Observability/locations/operationStatuses/read",
|                                                    "NewRelic.Observability/locations/operationStatuses/write",
|                                                    "NewRelic.Observability/monitors/read",
|                                                    "NewRelic.Observability/monitors/write",
|                                                    "NewRelic.Observability/monitors/delete",
|                                                    "NewRelic.Observability/monitors/monitoredResources/action",
|                                                    "NewRelic.Observability/monitors/vmHostPayloads/action",
|                                                    "NewRelic.Observability/monitors/listAppServices/action",
|                                                    "NewRelic.Observability/monitors/listHosts/action",
|                                                    "NewRelic.Observability/monitors/refreshIngestionKey/action",
|                                                    "NewRelic.Observability/monitors/getMetricRules/action",
|                                                    "NewRelic.Observability/monitors/getMetricStatus/action",
|                                                    "NewRelic.Observability/monitors/switchBilling/action",
|                                                    "NewRelic.Observability/monitors/latestLinkedSaaS/action",
|                                                    "NewRelic.Observability/monitors/linkSaaS/action",
|                                                    "NewRelic.Observability/monitors/resubscribe/action",
|                                                    "NewRelic.Observability/monitors/getBillingInfo/action",
|                                                    "NewRelic.Observability/monitors/listConnectedPartnerResources/action",
|                                                    "NewRelic.Observability/monitors/listLinkedResources/action",
|                                                    "NewRelic.Observability/monitors/monitoredSubscriptions/read",
|                                                    "NewRelic.Observability/monitors/monitoredSubscriptions/write",
|                                                    "NewRelic.Observability/monitors/tagRules/read",
|                                                    "NewRelic.Observability/monitors/tagRules/write",
|                                                    "NewRelic.Observability/registeredSubscriptions/read",
|                                                    "NewRelic.Observability/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "285ce6d6-fa11-43bd-94ef-42a9b3740bfd",
|                                    "Name":  "Policy Enrollments Contributor",
|                                    "Description":  "Allows the creation and modification of policy enrollments",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/policyenrollments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.PolicyInsights/*",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fa96a588-3fac-4adb-bfb2-f8404ece07e0",
|                                    "Name":  "Liftr Dynatrace Contributor",
|                                    "Description":  "Provides access to Dynatrace Control Plane Operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Dynatrace.Observability/checkNameAvailability/action",
|                                                    "Dynatrace.Observability/register/action",
|                                                    "Dynatrace.Observability/unregister/action",
|                                                    "Dynatrace.Observability/getMarketplaceSaaSResourceDetails/action",
|                                                    "Dynatrace.Observability/locations/read",
|                                                    "Dynatrace.Observability/locations/operationStatuses/read",
|                                                    "Dynatrace.Observability/locations/operationStatuses/write",
|                                                    "Dynatrace.Observability/monitors/read",
|                                                    "Dynatrace.Observability/monitors/write",
|                                                    "Dynatrace.Observability/monitors/delete",
|                                                    "Dynatrace.Observability/monitors/listMonitoredResources/action",
|                                                    "Dynatrace.Observability/monitors/getVMHostPayload/action",
|                                                    "Dynatrace.Observability/monitors/listHosts/action",
|                                                    "Dynatrace.Observability/monitors/listAppServices/action",
|                                                    "Dynatrace.Observability/monitors/getSSODetails/action",
|                                                    "Dynatrace.Observability/monitors/listLinkableEnvironments/action",
|                                                    "Dynatrace.Observability/monitors/getMetricStatus/action",
|                                                    "Dynatrace.Observability/monitors/manageAgentInstallation/action",
|                                                    "Dynatrace.Observability/monitors/monitoredSubscriptions/read",
|                                                    "Dynatrace.Observability/monitors/monitoredSubscriptions/write",
|                                                    "Dynatrace.Observability/monitors/singleSignOnConfigurations/write",
|                                                    "Dynatrace.Observability/monitors/singleSignOnConfigurations/read",
|                                                    "Dynatrace.Observability/monitors/tagRules/read",
|                                                    "Dynatrace.Observability/monitors/tagRules/write",
|                                                    "Dynatrace.Observability/registeredSubscriptions/read",
|                                                    "Dynatrace.Observability/operations/read",
|                                                    "Dynatrace.Observability/monitors/manageSreAgentConnectors/action",
|                                                    "Dynatrace.Observability/monitors/latestLinkedSaaS/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "79732128-7761-4733-aebf-35590da9f29b",
|                                    "Name":  "Microsoft.OffAzureSpringBoot Service Owner",
|                                    "Description":  "Full access to Azure Microsoft.OffAzureSpringBoot Service REST APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.OffAzureSpringBoot/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "46c70067-0f50-457f-8137-2449c90de518",
|                                    "Name":  "Nexus Network Fabric Owner",
|                                    "Description":  "Provides owner access to nexus network fabric resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedNetworkFabric/*/read",
|                                                    "Microsoft.ManagedNetworkFabric/*/write",
|                                                    "Microsoft.ManagedNetworkFabric/*/action",
|                                                    "Microsoft.ManagedNetworkFabric/*/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "374a1cc6-96cb-4946-8d8b-a41054c8ae97",
|                                    "Name":  "Nexus Identity Owner",
|                                    "Description":  "Provides owner access to nexusidentity resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.NexusIdentity/*/read",
|                                                    "Microsoft.NexusIdentity/*/write",
|                                                    "Microsoft.NexusIdentity/*/action",
|                                                    "Microsoft.NexusIdentity/*/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b3eb788f-5426-48bd-821d-561701ede368",
|                                    "Name":  "Conversation Session User",
|                                    "Description":  "Allows sending a message to the agent and receive a response, using the conversation session API",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthBot/healthBots/ConversationSession/Action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "eded264d-1796-4e25-8500-a78427f8a316",
|                                    "Name":  "Azure Data Transfer Owner",
|                                    "Description":  "Create, read, modify, and delete pipelines, connections, and flows in Azure Data Transfer. Also perform any appropriate control plane operations for managing Azure Data Transfer resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureDataTransfer/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bf41e52e-617f-4981-8b7a-47431bd4e011",
|                                    "Name":  "CosmosDB Fleet Analytics Storage Data Writer",
|                                    "Description":  "Write telemetry data from the Fleet Analytics Synapse workspace to customer-provided storage accounts or Fabric Lakehouses.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3f99eaab-6f59-4877-adf5-1cacd22e20b0",
|                                    "Name":  "Video Indexer Account Contributor",
|                                    "Description":  "Can manage Video Indexer Account resources and generate access tokens for data plane operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.VideoIndexer/checknameavailability/action",
|                                                    "Microsoft.VideoIndexer/accounts/generateAccessToken/action",
|                                                    "Microsoft.VideoIndexer/accounts/generateRestrictedViewerAccessToken/action",
|                                                    "Microsoft.VideoIndexer/accounts/generateExtensionAccessToken/action",
|                                                    "Microsoft.VideoIndexer/accounts/generateExtensionRestrictedViewerAccessToken/action",
|                                                    "Microsoft.VideoIndexer/accounts/read",
|                                                    "Microsoft.VideoIndexer/accounts/write",
|                                                    "Microsoft.VideoIndexer/accounts/delete",
|                                                    "Microsoft.VideoIndexer/accounts/PrivateEndpointConnectionsApproval/action",
|                                                    "Microsoft.VideoIndexer/accounts/privateEndpointConnections/read",
|                                                    "Microsoft.VideoIndexer/accounts/privateEndpointConnections/write",
|                                                    "Microsoft.VideoIndexer/accounts/privateEndpointConnections/delete",
|                                                    "Microsoft.VideoIndexer/accounts/privateLinkResources/read",
|                                                    "Microsoft.VideoIndexer/locations/operationstatuses/read",
|                                                    "Microsoft.VideoIndexer/locations/operationstatuses/write",
|                                                    "Microsoft.VideoIndexer/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f4eb044f-76b9-47af-92f9-1d95c4c14ab5",
|                                    "Name":  "Azure Business Continuity DUPI Reader",
|                                    "Description":  "Lets you view Deleted Unified Protected items in Azure Business Continuity Center.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleDefinitions/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.AzureBusinessContinuity/deletedUnifiedProtectedItems/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "59f98be6-0817-488b-831e-36a353c8000b",
|                                    "Name":  "Sites Reader",
|                                    "Description":  "View all Sites related resources but does not allow you to make any changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Edge/sites/read",
|                                                    "Microsoft.Edge/configurations/read",
|                                                    "Microsoft.Edge/configurations/networkConfigurations/read",
|                                                    "Microsoft.Edge/configurations/securityConfigurations/read",
|                                                    "Microsoft.Edge/configurations/timeServerConfigurations/read",
|                                                    "Microsoft.Edge/configurations/connectivityConfigurations/read",
|                                                    "Microsoft.Edge/configurations/provisioningConfigurations/read",
|                                                    "Microsoft.Edge/configurations/arcGatewayConfigurations/read",
|                                                    "Microsoft.Edge/configurationReferences/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1cd7e4da-2789-457f-adbe-3e9e84037a93",
|                                    "Name":  "Sites Owner",
|                                    "Description":  "Microsoft Edge Sites Owner role - Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Edge/sites/read",
|                                                    "Microsoft.Edge/sites/write",
|                                                    "Microsoft.Edge/sites/delete",
|                                                    "Microsoft.Edge/configurations/read",
|                                                    "Microsoft.Edge/configurations/write",
|                                                    "Microsoft.Edge/configurations/delete",
|                                                    "Microsoft.Edge/configurations/networkConfigurations/read",
|                                                    "Microsoft.Edge/configurations/networkConfigurations/write",
|                                                    "Microsoft.Edge/configurations/networkConfigurations/delete",
|                                                    "Microsoft.Edge/configurations/securityConfigurations/read",
|                                                    "Microsoft.Edge/configurations/securityConfigurations/write",
|                                                    "Microsoft.Edge/configurations/securityConfigurations/delete",
|                                                    "Microsoft.Edge/configurations/timeServerConfigurations/read",
|                                                    "Microsoft.Edge/configurations/timeServerConfigurations/write",
|                                                    "Microsoft.Edge/configurations/timeServerConfigurations/delete",
|                                                    "Microsoft.Edge/configurations/connectivityConfigurations/read",
|                                                    "Microsoft.Edge/configurations/connectivityConfigurations/write",
|                                                    "Microsoft.Edge/configurations/connectivityConfigurations/delete",
|                                                    "Microsoft.Edge/configurations/provisioningConfigurations/read",
|                                                    "Microsoft.Edge/configurations/provisioningConfigurations/write",
|                                                    "Microsoft.Edge/configurations/provisioningConfigurations/delete",
|                                                    "Microsoft.Edge/configurations/arcGatewayConfigurations/read",
|                                                    "Microsoft.Edge/configurations/arcGatewayConfigurations/write",
|                                                    "Microsoft.Edge/configurations/arcGatewayConfigurations/delete",
|                                                    "Microsoft.Edge/configurationReferences/read",
|                                                    "Microsoft.Edge/configurationReferences/write",
|                                                    "Microsoft.Edge/configurationReferences/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "85546f1f-f28b-4cb3-b852-73e422a96897",
|                                    "Name":  "Liftr PureStorage Owner role",
|                                    "Description":  "Provides access to all PureStorage related operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "PureStorage.Block/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d683b71b-2b91-4fc1-a43e-b53b3d85bed9",
|                                    "Name":  "Liftr Dell Owner role",
|                                    "Description":  "Provides access to all Dell related operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Dell.Storage/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6d6f52ba-a7de-4c56-a58f-522154514fba",
|                                    "Name":  "SupportPlan Contributor",
|                                    "Description":  "Contributor role for Enterprise Support Resource Provider",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.EnterpriseSupport/services/delete",
|                                                    "Microsoft.EnterpriseSupport/services/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4037dd68-1cc7-4a64-8765-3a79963a9940",
|                                    "Name":  "Azure Spring Apps Service Owner",
|                                    "Description":  "Full access to Azure Spring Apps Service REST APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppPlatform/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "25cabde7-1a6c-4350-8877-cb6fe59f1399",
|                                    "Name":  "Azure AI Enterprise Networking Outbound Rules Operator",
|                                    "Description":  "A Built-in role that can authorize users to access and update the managed network settings of a machine learning workspace.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/managedNetworks/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/managedNetworks/write",
|                                                    "Microsoft.MachineLearningServices/workspaces/managedNetworks/outboundRules/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/managedNetworks/outboundRules/write",
|                                                    "Microsoft.MachineLearningServices/workspaces/managedNetworks/outboundRules/delete",
|                                                    "Microsoft.MachineLearningServices/workspaces/managedNetworks/batchOutboundRules/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3b5a0aa9-eccd-48dc-9011-f2fd03b5e5f9",
|                                    "Name":  "Azure Business Continuity UPI Reader",
|                                    "Description":  "Lets you view Unified Protected items in Azure Business Continuity Center.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleDefinitions/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.AzureBusinessContinuity/unifiedProtectedItems/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dd799a69-ffc8-4aa8-9701-b51f686857d9",
|                                    "Name":  "Pinecone.VectorDb Contributor Role",
|                                    "Description":  "Provides access to all Pinecone.VectorDb related operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Pinecone.VectorDb/checkNameAvailability/action",
|                                                    "Pinecone.VectorDb/register/action",
|                                                    "Pinecone.VectorDb/unregister/action",
|                                                    "Pinecone.VectorDb/locations/operationStatuses/read",
|                                                    "Pinecone.VectorDb/locations/operationStatuses/write",
|                                                    "Pinecone.VectorDb/operations/read",
|                                                    "Pinecone.VectorDb/organizations/read",
|                                                    "Pinecone.VectorDb/organizations/write",
|                                                    "Pinecone.VectorDb/organizations/delete",
|                                                    "Pinecone.VectorDb/registeredSubscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "246fffca-69ee-4945-bbf1-2a867dce4fda",
|                                    "Name":  "Microsoft.WeightsAndBiases Contributor Role",
|                                    "Description":  "Provides access to all Microsoft.WeightsAndBiases related operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.WeightsAndBiases/checkNameAvailability/action",
|                                                    "Microsoft.WeightsAndBiases/register/action",
|                                                    "Microsoft.WeightsAndBiases/unregister/action",
|                                                    "Microsoft.WeightsAndBiases/instances/read",
|                                                    "Microsoft.WeightsAndBiases/instances/write",
|                                                    "Microsoft.WeightsAndBiases/instances/delete",
|                                                    "Microsoft.WeightsAndBiases/locations/operationStatuses/read",
|                                                    "Microsoft.WeightsAndBiases/locations/operationStatuses/write",
|                                                    "Microsoft.WeightsAndBiases/operations/read",
|                                                    "Microsoft.WeightsAndBiases/registeredSubscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "44a00263-b2a0-45d5-a618-5d8d11709349",
|                                    "Name":  "LambdaTest.HyperExecute Contributor Role",
|                                    "Description":  "Provides access to all LambdaTest.HyperExecute related operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "LambdaTest.HyperExecute/checkNameAvailability/action",
|                                                    "LambdaTest.HyperExecute/register/action",
|                                                    "LambdaTest.HyperExecute/unregister/action",
|                                                    "LambdaTest.HyperExecute/locations/operationStatuses/read",
|                                                    "LambdaTest.HyperExecute/locations/operationStatuses/write",
|                                                    "LambdaTest.HyperExecute/operations/read",
|                                                    "LambdaTest.HyperExecute/organizations/read",
|                                                    "LambdaTest.HyperExecute/organizations/write",
|                                                    "LambdaTest.HyperExecute/organizations/delete",
|                                                    "LambdaTest.HyperExecute/registeredSubscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dca88c6f-5090-44cd-a0ff-a88f337b12a5",
|                                    "Name":  "ArizeAi.ObservabilityEval Contributor Role",
|                                    "Description":  "Provides access to all ArizeAi.ObservabilityEval related operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "ArizeAi.ObservabilityEval/checkNameAvailability/action",
|                                                    "ArizeAi.ObservabilityEval/register/action",
|                                                    "ArizeAi.ObservabilityEval/unregister/action",
|                                                    "ArizeAi.ObservabilityEval/locations/operationStatuses/read",
|                                                    "ArizeAi.ObservabilityEval/locations/operationStatuses/write",
|                                                    "ArizeAi.ObservabilityEval/operations/read",
|                                                    "ArizeAi.ObservabilityEval/organizations/read",
|                                                    "ArizeAi.ObservabilityEval/organizations/write",
|                                                    "ArizeAi.ObservabilityEval/organizations/delete",
|                                                    "ArizeAi.ObservabilityEval/registeredSubscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "376d0802-aca8-4c2d-83a5-c88630f396fe",
|                                    "Name":  "Recurring Scheduled Actions Contributor",
|                                    "Description":  "Allows users to use Recurring Scheduled Actions offered by Microsoft.ComputeSchedule",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ComputeSchedule/scheduledActions/write",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/delete",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/attachResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/cancelNextOccurrence/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/detachResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/disable/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/enable/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/listResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/patchResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/triggerManualOccurrence/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/occurrences/cancel/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/occurrences/delay/action",
|                                                    "Microsoft.ComputeSchedule/register/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ff09793b-be48-49f6-ad96-70d32039c0b9",
|                                    "Name":  "Azure Resilience Management Drills Operator",
|                                    "Description":  "Operator Role of Azure Resilience Management Drills Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/action",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/write",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                    "Microsoft.Insights/alertRules/",
|                                                    "Microsoft.Monitor/accounts/read",
|                                                    "Microsoft.Monitor/slis/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e131102b-11a5-4ff4-8508-ed922132b74c",
|                                    "Name":  "Azure Resilience Management Drills Contributor",
|                                    "Description":  "Contributor Role of Azure Resilience Management Drills Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/action",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/delete",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/write",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c914561b-1575-4601-af9c-a1356bf59818",
|                                    "Name":  "Azure Resilience Management Drills Administrator",
|                                    "Description":  "Administrator Role of Azure Resilience Management Drills Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/action",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/delete",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/write",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d2e8fe82-9212-490f-af3e-34bb52d87d3d",
|                                    "Name":  "Azure Resilience Management Drills Reader",
|                                    "Description":  "Reader Role of Azure Resilience Management Drills Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/",
|                                                    "Microsoft.Resources/deployments/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/drillResources/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/drillRuns/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/drillRuns/drillRunChildJobs/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/drillRuns/drillRunResources/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f24a559b-c2fc-4409-b96e-9af4b0c28ad6",
|                                    "Name":  "Edge Order Partner Inventory Manager Service Role",
|                                    "Description":  "Manage inventory metadata and inventory links associated with Edge Order Partner scenarios. Enables configuration and control of inventory resources for tracking and fulfillment purposes",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EdgeOrderPartner/locations/productFamilies/inventories/manageLink/action",
|                                                    "Microsoft.EdgeOrderPartner/locations/productFamilies/inventories/manageInventoryMetadata/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c5c82243-e78e-43f9-8428-793bba85b28e",
|                                    "Name":  "Defender For Container Registries Operator",
|                                    "Description":  "Grants Microsoft Defender for Cloud access to Azure Container Registries",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/pull/read",
|                                                    "Microsoft.ContainerRegistry/registries/metadata/read",
|                                                    "Microsoft.ContainerRegistry/registries/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                        "Microsoft.ContainerRegistry/registries/catalog/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fdb3df26-8dd6-49ff-9a74-e95dbfadcad3",
|                                    "Name":  "Change Safety Contributor",
|                                    "Description":  "Grants access to manage all Microsoft.ChangeSafety resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ChangeSafety/changeStates/read",
|                                                    "Microsoft.ChangeSafety/changeStates/write",
|                                                    "Microsoft.ChangeSafety/changeStates/delete",
|                                                    "Microsoft.ChangeSafety/changeRecords/read",
|                                                    "Microsoft.ChangeSafety/changeRecords/write",
|                                                    "Microsoft.ChangeSafety/changeRecords/delete",
|                                                    "Microsoft.ChangeSafety/changeStates/stageProgressions/read",
|                                                    "Microsoft.ChangeSafety/changeStates/stageProgressions/write",
|                                                    "Microsoft.ChangeSafety/changeStates/stageProgressions/delete",
|                                                    "Microsoft.ChangeSafety/changeRecords/stageProgressions/read",
|                                                    "Microsoft.ChangeSafety/changeRecords/stageProgressions/write",
|                                                    "Microsoft.ChangeSafety/changeRecords/stageProgressions/delete",
|                                                    "Microsoft.ChangeSafety/locations/operationstatuses/read",
|                                                    "Microsoft.ChangeSafety/locations/operationstatuses/write",
|                                                    "Microsoft.ChangeSafety/safeRollouts/read",
|                                                    "Microsoft.ChangeSafety/safeRollouts/write",
|                                                    "Microsoft.ChangeSafety/safeRollouts/delete",
|                                                    "Microsoft.ChangeSafety/safeRollouts/steps/read",
|                                                    "Microsoft.ChangeSafety/stageMaps/read",
|                                                    "Microsoft.ChangeSafety/stageMaps/write",
|                                                    "Microsoft.ChangeSafety/stageMaps/delete",
|                                                    "Microsoft.ChangeSafety/validations/read",
|                                                    "Microsoft.ChangeSafety/validations/write",
|                                                    "Microsoft.ChangeSafety/validations/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d0a94e7a-d791-4571-b2e0-8bdd8f867544",
|                                    "Name":  "Clinical Coder Data User",
|                                    "Description":  "Allows processing of health data in Clinical Coder",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthBot/healthBots/AIActions/ClinicalCoder/Process/Action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "40ead2a5-466e-4039-8a80-325542d9d2dd",
|                                    "Name":  "Defender Unified RBAC Data Manager",
|                                    "Description":  "Defender Unified RBAC Data Manager. This role is managed and assigned automatically by the Defender Unified RBAC system. Manual assignment of this role is not recommended, as the Defender Unified RBAC system may modify or remove it at any time based on system requirements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.operationalinsights/workspaces/read",
|                                                    "Microsoft.operationalinsights/workspaces/write",
|                                                    "Microsoft.operationalinsights/workspaces/query/read",
|                                                    "Microsoft.operationalinsights/workspaces/tables/write",
|                                                    "Microsoft.operationalinsights/workspaces/tables/delete",
|                                                    "Microsoft.operationalinsights/workspaces/sharedkeys/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "478d20ba-a53e-4946-b33c-8078a92f2d0a",
|                                    "Name":  "Azure Local Disconnected Operations Role",
|                                    "Description":  "Azure Local Disconnected Operations Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Edge/disconnectedOperations/*/read",
|                                                    "Microsoft.Edge/disconnectedOperations/*/write",
|                                                    "Microsoft.Edge/disconnectedOperations/*/delete",
|                                                    "Microsoft.Edge/winfields/*/read",
|                                                    "Microsoft.Edge/winfields/*/write",
|                                                    "Microsoft.Edge/winfields/*/delete",
|                                                    "Microsoft.Edge/winfields/*/action",
|                                                    "Microsoft.Edge/disconnectedOperations/*/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cbb820e9-e561-45bb-84c2-ef45d0a13f7d",
|                                    "Name":  "Workload Orchestration Administrator",
|                                    "Description":  "Workload Orchestration Administrator Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Edge/contexts/*",
|                                                    "Microsoft.Edge/configTemplates/*",
|                                                    "Microsoft.Edge/solutionTemplates/*",
|                                                    "Microsoft.Edge/configurations/*",
|                                                    "Microsoft.Edge/configurationreferences/*",
|                                                    "Microsoft.Edge/schemas/*",
|                                                    "Microsoft.Edge/schemaReferences/*",
|                                                    "Microsoft.Edge/targets/*",
|                                                    "Microsoft.Edge/jobs/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2a94a2fd-3c4f-45d1-847d-6585ba88af94",
|                                    "Name":  "Firmware Analysis Reader",
|                                    "Description":  "View firmware images but not upload them or perform any workspace configuration",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.IoTFirmwareDefense/*/read",
|                                                    "Microsoft.IoTFirmwareDefense/workspaces/firmwares/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.IoTFirmwareDefense/firmwareGroups/*",
|                                                       "Microsoft.IoTFirmwareDefense/workspaces/firmwares/write",
|                                                       "Microsoft.IoTFirmwareDefense/workspaces/firmwares/delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "04f6c337-ffae-414c-b00f-3e80c9ab8a2c",
|                                    "Name":  "Garnet Data Owner",
|                                    "Description":  "Allows read, write, destructive and scripting actions on the Garnet resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1694e55a-2496-4d07-b005-7259aa3fcbe8",
|                                    "Name":  "Garnet Data Contributor",
|                                    "Description":  "Allows read and write access to all keys within the Garnet resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/append/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/bzmpop/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/bzpopmax/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/bzpopmin/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/decr/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/decrby/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/del/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/exists/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/expire/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/get/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/getdel/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/getex/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/getrange/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/getset/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hdel/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hexists/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hexpire/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hexpireat/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hexpiretime/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hgetall/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hincrby/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hincrbyfloat/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/histogram/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hkeys/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hlen/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hmget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hmset/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hpersist/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hpexpire/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hpexpireat/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hpexpiretime/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hpttl/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hrandfield/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hscan/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hset/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hsetnx/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hstrlen/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/httl/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hvals/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/incr/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/incrby/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/incrbyfloat/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/lcs/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/mget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/mset/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/msetnx/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/psetex/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/readonly/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/readwrite/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sadd/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/scard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sdiff/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sdiffstore/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/set/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/setex/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/setnx/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/setrange/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sinter/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sintercard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sinterstore/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sismember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/smembers/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/smismember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/smove/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/spop/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/srandmember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/srem/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sscan/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/strlen/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/substr/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sunion/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sunionstore/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/unlink/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zadd/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zcard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zcount/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zdiff/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zdiffstore/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zincrby/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zinter/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zintercard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zinterstore/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zlexcount/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zmpop/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zmscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zpopmax/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zpopmin/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrandmember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrange/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrangebylex/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrangebyscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrangestore/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrank/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrem/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zremrangebylex/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zremrangebyrank/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zremrangebyscore/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrange/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebylex/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebyscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrank/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zscan/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zunion/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zunionstore/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d9cd91b9-dada-4fa9-9406-454c4659c137",
|                                    "Name":  "Garnet Data Reader",
|                                    "Description":  "Allows read access to all keys within the Garnet resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/exists/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/get/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/getex/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/getrange/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hexists/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hexpiretime/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hgetall/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/histogram/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hkeys/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hlen/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hmget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hpexpiretime/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hpttl/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hrandfield/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hscan/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hstrlen/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/httl/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hvals/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/lcs/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/mget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/readonly/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/scard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sdiff/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sinter/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sintercard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sismember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/smembers/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/smismember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/srandmember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sscan/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/strlen/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/substr/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sunion/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zcard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zcount/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zdiff/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zinter/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zintercard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zlexcount/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zmscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrandmember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrange/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrangebylex/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrangebyscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrank/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrange/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebylex/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebyscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrank/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zscan/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zunion/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7021ea36-e168-4bc0-af53-88de51d20665",
|                                    "Name":  "Garnet Script Data Contributor",
|                                    "Description":  "Allows execution and management of scripts on the Garnet resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/scripteval/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/scriptevalsha/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/scriptexists/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/scriptflush/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/scriptload/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/slots/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1fd5d8bf-9037-4ede-89bf-680f798e2765",
|                                    "Name":  "Defender Unified RBAC Authorization Manager",
|                                    "Description":  "Defender Unified RBAC Authorization Manager. This role is managed and assigned automatically by the Defender Unified RBAC system. Manual assignment of this role is not recommended, as the Defender Unified RBAC system may modify or remove it at any time based on system requirements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "78b7345a-1e1b-483a-ac62-62228c6ea89d",
|                                    "Name":  "Defender Unified RBAC Reader",
|                                    "Description":  "Defender Unified RBAC Reader. This role is managed and assigned automatically by the Defender Unified RBAC system. Manual assignment of this role is not recommended, as the Defender Unified RBAC system may modify or remove it at any time based on system requirements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SecurityInsights/*/read",
|                                                    "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/LinkedServices/read",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                    "Microsoft.OperationalInsights/querypacks/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.Insights/workbooks/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                       "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.OperationalInsights/workspaces/tables/data/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "625a1cea-653b-4a19-bd3a-df1d66ab6637",
|                                    "Name":  "Defender Unified RBAC Contributor and Responder",
|                                    "Description":  "Defender Unified RBAC Contributor and Responder. This role is managed and assigned automatically by the Defender Unified RBAC system. Manual assignment of this role is not recommended, as the Defender Unified RBAC system may modify or remove it at any time based on system requirements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.OperationalInsights/querypacks/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.SecurityInsights/*",
|                                                    "Microsoft.SecurityInsights/*/read",
|                                                    "Microsoft.SecurityInsights/automationRules/*",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/systems/undoAction/action",
|                                                    "Microsoft.SecurityInsights/cases/*",
|                                                    "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                    "Microsoft.SecurityInsights/entities/runPlaybook/action",
|                                                    "Microsoft.SecurityInsights/incidents/*",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/bulkTag/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/replaceTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                    "Microsoft.Insights/workbooks/*",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.SecurityInsights/cases/*/Delete",
|                                                       "Microsoft.SecurityInsights/incidents/*/Delete",
|                                                       "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                       "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ca62263b-07d5-4b48-b437-088803f5c2ff",
|                                    "Name":  "Defender Unified RBAC Authorization Reader",
|                                    "Description":  "Defender Unified RBAC Authorization Reader. This role is managed and assigned automatically by the Defender Unified RBAC system. Manual assignment of this role is not recommended, as the Defender Unified RBAC system may modify or remove it at any time based on system requirements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1bacae94-6c0f-4d2d-8dfa-408d5a28e6ec",
|                                    "Name":  "Defender Unified RBAC Responder",
|                                    "Description":  "Defender Unified RBAC Responder. This role is managed and assigned automatically by the Defender Unified RBAC system. Manual assignment of this role is not recommended, as the Defender Unified RBAC system may modify or remove it at any time based on system requirements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SecurityInsights/*/read",
|                                                    "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                    "Microsoft.SecurityInsights/automationRules/*",
|                                                    "Microsoft.SecurityInsights/cases/*",
|                                                    "Microsoft.SecurityInsights/incidents/*",
|                                                    "Microsoft.SecurityInsights/entities/runPlaybook/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/bulkTag/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/replaceTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/systems/undoAction/action",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/querypacks/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/workbooks/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.SecurityInsights/cases/*/Delete",
|                                                       "Microsoft.SecurityInsights/incidents/*/Delete",
|                                                       "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                       "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "679dc20a-52e8-4ac0-a23c-3b557dfb1e24",
|                                    "Name":  "Azure Monitor Pipeline Contributor",
|                                    "Description":  "Manage Azure Monitor Pipeline resources, providing full read and write access to pipeline configurations and monitoring features.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Monitor/pipelineGroups/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2d50f159-7b96-4f1e-8fc7-fee6957ab7cc",
|                                    "Name":  "Azure Monitor Pipeline Reader",
|                                    "Description":  "Read Azure Monitor Pipeline resources, including pipeline configurations and monitoring features.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Monitor/pipelineGroups/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fd8ea4d5-6509-4db0-bada-356ab233b4fa",
|                                    "Name":  "Azure Migrate Owner",
|                                    "Description":  "Grants full access to create and manage Azure Migrate projects including appliance-based discovery, creation of business case \u0026 assessment report and execution of migrations; Also grants ability to assign Azure Migrate specific roles in Azure RBAC.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/locations/read",
|                                                    "Microsoft.Resources/checkResourceName/action",
|                                                    "Microsoft.Resources/deploymentScripts/write",
|                                                    "Microsoft.Resources/deploymentScripts/read",
|                                                    "Microsoft.Resources/links/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/locks/write",
|                                                    "Microsoft.Authorization/locks/delete",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Migrate/*",
|                                                    "Microsoft.ApplicationMigration/*",
|                                                    "Microsoft.OffAzure/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.MySQLDiscovery/*",
|                                                    "Microsoft.DependencyMap/*",
|                                                    "Microsoft.KeyVault/vaults/*",
|                                                    "Microsoft.KeyVault/checkNameAvailability/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/register/action",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/privateEndpoints/read",
|                                                    "Microsoft.Network/privateEndpoints/write",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                    "Microsoft.Network/privateDnsZones/write",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                    "Microsoft.Network/privateDnsZones/join/action",
|                                                    "Microsoft.Network/privateDnsZones/A/write",
|                                                    "Microsoft.Network/register/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/*",
|                                                    "Microsoft.GuestConfiguration/register/action",
|                                                    "Microsoft.Compute/register/action",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/availabilitySets/vmSizes/read",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Compute/skus/read",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachines/delete",
|                                                    "Microsoft.HybridConnectivity/register/action",
|                                                    "Microsoft.RecoveryServices/vaults/*",
|                                                    "Microsoft.RecoveryServices/register/action",
|                                                    "Microsoft.RecoveryServices/operations/read",
|                                                    "Microsoft.DataReplication/*/read",
|                                                    "Microsoft.DataReplication/register/action",
|                                                    "Microsoft.DataReplication/replicationVaults/write",
|                                                    "Microsoft.KeyVault/register/action",
|                                                    "Microsoft.AzureArcData/register/action",
|                                                    "Microsoft.Resources/links/read",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7859c0b0-0bb9-4994-bd12-cd529af7d646",
|                                    "Name":  "Azure Migrate Decide and Plan Expert",
|                                    "Description":  "Grants restricted access on Azure Migrate project to only perform planning operations including appliance-based discovery, managing inventory, identifying server dependencies, creation of business case \u0026 assessment reports.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/locations/read",
|                                                    "Microsoft.Resources/checkResourceName/action",
|                                                    "Microsoft.Resources/deploymentScripts/write",
|                                                    "Microsoft.Resources/deploymentScripts/read",
|                                                    "Microsoft.Resources/links/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/locks/write",
|                                                    "Microsoft.Authorization/locks/delete",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Migrate/*",
|                                                    "Microsoft.ApplicationMigration/*",
|                                                    "Microsoft.OffAzure/*",
|                                                    "Microsoft.MySQLDiscovery/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.DependencyMap/*",
|                                                    "Microsoft.KeyVault/vaults/*",
|                                                    "Microsoft.KeyVault/checkNameAvailability/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/register/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/privateEndpoints/read",
|                                                    "Microsoft.Network/privateEndpoints/write",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                    "Microsoft.Network/privateDnsZones/write",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                    "Microsoft.Network/privateDnsZones/join/action",
|                                                    "Microsoft.Network/privateDnsZones/A/write",
|                                                    "Microsoft.Network/register/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/*/read",
|                                                    "Microsoft.Storage/storageAccounts/*/write",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.GuestConfiguration/register/action",
|                                                    "Microsoft.HybridConnectivity/register/action",
|                                                    "Microsoft.DataReplication/*/read",
|                                                    "Microsoft.DataReplication/register/action",
|                                                    "Microsoft.DataReplication/replicationVaults/write",
|                                                    "Microsoft.RecoveryServices/vaults/*",
|                                                    "Microsoft.RecoveryServices/register/action",
|                                                    "Microsoft.KeyVault/register/action",
|                                                    "Microsoft.AzureArcData/register/action",
|                                                    "Microsoft.Resources/links/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ba480ccd-6499-4709-b581-8f38bb215c63",
|                                    "Name":  "Azure Migrate Service Reader",
|                                    "Description":  "Grants required access to the system assigned managed identity of Azure Migrate project resource.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.ApplicationMigration/*/read",
|                                                    "Microsoft.Migrate/*/read",
|                                                    "Microsoft.OffAzure/*/read",
|                                                    "Microsoft.MySQLDiscovery/*/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationMigrationItems/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1cfa4eac-9a23-481c-a793-bfb6958e836b",
|                                    "Name":  "Azure Migrate Execute Expert",
|                                    "Description":  "Grants restricted access on an Azure Migrate project to only perform migration related operations, including replication, execution of test migrations, tracking and monitoring of migration progress, and initiation of agentless and agent-based migrations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/locations/read",
|                                                    "Microsoft.Resources/checkResourceName/action",
|                                                    "Microsoft.Resources/deploymentScripts/write",
|                                                    "Microsoft.Resources/deploymentScripts/read",
|                                                    "Microsoft.Resources/links/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/locks/write",
|                                                    "Microsoft.Authorization/locks/delete",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Migrate/*/read",
|                                                    "Microsoft.ApplicationMigration/*/read",
|                                                    "Microsoft.OffAzure/*/read",
|                                                    "Microsoft.MySQLDiscovery/*/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Storage/storageAccounts/*/read",
|                                                    "Microsoft.Storage/storageAccounts/*/write",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Compute/register/action",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/availabilitySets/vmSizes/read",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Compute/skus/read",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachines/delete",
|                                                    "Microsoft.RecoveryServices/vaults/*",
|                                                    "Microsoft.RecoveryServices/register/action",
|                                                    "Microsoft.RecoveryServices/operations/read",
|                                                    "Microsoft.Resources/links/read",
|                                                    "Microsoft.DependencyMap/*/read",
|                                                    "Microsoft.DependencyMap/maps/*/action",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.OffAzure/hypervSites/machines/inventoryinsights/pendingupdates/*",
|                                                       "Microsoft.OffAzure/hypervSites/machines/inventoryinsights/vulnerabilities/*",
|                                                       "Microsoft.OffAzure/serverSites/machines/inventoryinsights/pendingupdates/*",
|                                                       "Microsoft.OffAzure/serverSites/machines/inventoryinsights/vulnerabilities/*",
|                                                       "Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/vulnerabilities/*",
|                                                       "Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/pendingupdates/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "98c206fe-ea1b-4578-93f8-83a99a5628fc",
|                                    "Name":  "Aws Connector contributor role",
|                                    "Description":  "Microsoft.AwsConnector contributor role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AwsConnector/accessAnalyzerAnalyzers/delete",
|                                                    "Microsoft.AwsConnector/accessAnalyzerAnalyzers/write",
|                                                    "Microsoft.AwsConnector/acmCertificateSummaries/delete",
|                                                    "Microsoft.AwsConnector/acmCertificateSummaries/write",
|                                                    "Microsoft.AwsConnector/apiGatewayRestApis/delete",
|                                                    "Microsoft.AwsConnector/apiGatewayRestApis/write",
|                                                    "Microsoft.AwsConnector/apiGatewayStages/delete",
|                                                    "Microsoft.AwsConnector/apiGatewayStages/write",
|                                                    "Microsoft.AwsConnector/applicationAutoScalingScalableTargets/delete",
|                                                    "Microsoft.AwsConnector/applicationAutoScalingScalableTargets/write",
|                                                    "Microsoft.AwsConnector/appSyncGraphqlApis/delete",
|                                                    "Microsoft.AwsConnector/appSyncGraphqlApis/write",
|                                                    "Microsoft.AwsConnector/autoScalingAutoScalingGroups/delete",
|                                                    "Microsoft.AwsConnector/autoScalingAutoScalingGroups/write",
|                                                    "Microsoft.AwsConnector/bedrockAgentAliases/delete",
|                                                    "Microsoft.AwsConnector/bedrockAgentAliases/write",
|                                                    "Microsoft.AwsConnector/bedrockAgents/delete",
|                                                    "Microsoft.AwsConnector/bedrockAgents/write",
|                                                    "Microsoft.AwsConnector/bedrockApplicationInferenceProfiles/delete",
|                                                    "Microsoft.AwsConnector/bedrockApplicationInferenceProfiles/write",
|                                                    "Microsoft.AwsConnector/bedrockBlueprints/delete",
|                                                    "Microsoft.AwsConnector/bedrockBlueprints/write",
|                                                    "Microsoft.AwsConnector/bedrockDataAutomationProjects/delete",
|                                                    "Microsoft.AwsConnector/bedrockDataAutomationProjects/write",
|                                                    "Microsoft.AwsConnector/bedrockDataSources/delete",
|                                                    "Microsoft.AwsConnector/bedrockDataSources/write",
|                                                    "Microsoft.AwsConnector/bedrockFlowAliases/delete",
|                                                    "Microsoft.AwsConnector/bedrockFlowAliases/write",
|                                                    "Microsoft.AwsConnector/bedrockGuardrails/delete",
|                                                    "Microsoft.AwsConnector/bedrockGuardrails/write",
|                                                    "Microsoft.AwsConnector/bedrockKnowledgeBases/delete",
|                                                    "Microsoft.AwsConnector/bedrockKnowledgeBases/write",
|                                                    "Microsoft.AwsConnector/bedrockPrompts/delete",
|                                                    "Microsoft.AwsConnector/bedrockPrompts/write",
|                                                    "Microsoft.AwsConnector/cloudFormationStacks/delete",
|                                                    "Microsoft.AwsConnector/cloudFormationStacks/write",
|                                                    "Microsoft.AwsConnector/cloudFormationStackSets/delete",
|                                                    "Microsoft.AwsConnector/cloudFormationStackSets/write",
|                                                    "Microsoft.AwsConnector/cloudFrontDistributions/delete",
|                                                    "Microsoft.AwsConnector/cloudFrontDistributions/write",
|                                                    "Microsoft.AwsConnector/cloudTrailTrails/delete",
|                                                    "Microsoft.AwsConnector/cloudTrailTrails/write",
|                                                    "Microsoft.AwsConnector/cloudWatchAlarms/delete",
|                                                    "Microsoft.AwsConnector/cloudWatchAlarms/write",
|                                                    "Microsoft.AwsConnector/codeBuildProjects/delete",
|                                                    "Microsoft.AwsConnector/codeBuildProjects/write",
|                                                    "Microsoft.AwsConnector/codeBuildSourceCredentialsInfos/delete",
|                                                    "Microsoft.AwsConnector/codeBuildSourceCredentialsInfos/write",
|                                                    "Microsoft.AwsConnector/configServiceConfigurationRecorders/delete",
|                                                    "Microsoft.AwsConnector/configServiceConfigurationRecorders/write",
|                                                    "Microsoft.AwsConnector/configServiceConfigurationRecorderStatuses/delete",
|                                                    "Microsoft.AwsConnector/configServiceConfigurationRecorderStatuses/write",
|                                                    "Microsoft.AwsConnector/configServiceDeliveryChannels/delete",
|                                                    "Microsoft.AwsConnector/configServiceDeliveryChannels/write",
|                                                    "Microsoft.AwsConnector/databaseMigrationServiceReplicationInstances/delete",
|                                                    "Microsoft.AwsConnector/databaseMigrationServiceReplicationInstances/write",
|                                                    "Microsoft.AwsConnector/daxClusters/delete",
|                                                    "Microsoft.AwsConnector/daxClusters/write",
|                                                    "Microsoft.AwsConnector/dynamoDBContinuousBackupsDescriptions/delete",
|                                                    "Microsoft.AwsConnector/dynamoDBContinuousBackupsDescriptions/write",
|                                                    "Microsoft.AwsConnector/dynamoDBTables/delete",
|                                                    "Microsoft.AwsConnector/dynamoDBTables/write",
|                                                    "Microsoft.AwsConnector/ec2AccountAttributes/delete",
|                                                    "Microsoft.AwsConnector/ec2AccountAttributes/write",
|                                                    "Microsoft.AwsConnector/ec2Addresses/delete",
|                                                    "Microsoft.AwsConnector/ec2Addresses/write",
|                                                    "Microsoft.AwsConnector/ec2FlowLogs/delete",
|                                                    "Microsoft.AwsConnector/ec2FlowLogs/write",
|                                                    "Microsoft.AwsConnector/ec2Images/delete",
|                                                    "Microsoft.AwsConnector/ec2Images/write",
|                                                    "Microsoft.AwsConnector/ec2Instances/delete",
|                                                    "Microsoft.AwsConnector/ec2Instances/start/action",
|                                                    "Microsoft.AwsConnector/ec2Instances/stop/action",
|                                                    "Microsoft.AwsConnector/ec2Instances/write",
|                                                    "Microsoft.AwsConnector/ec2InstanceStatuses/delete",
|                                                    "Microsoft.AwsConnector/ec2InstanceStatuses/write",
|                                                    "Microsoft.AwsConnector/ec2Ipams/delete",
|                                                    "Microsoft.AwsConnector/ec2Ipams/write",
|                                                    "Microsoft.AwsConnector/ec2KeyPairs/delete",
|                                                    "Microsoft.AwsConnector/ec2KeyPairs/write",
|                                                    "Microsoft.AwsConnector/ec2NetworkAcls/delete",
|                                                    "Microsoft.AwsConnector/ec2NetworkAcls/write",
|                                                    "Microsoft.AwsConnector/ec2NetworkInterfaces/delete",
|                                                    "Microsoft.AwsConnector/ec2NetworkInterfaces/write",
|                                                    "Microsoft.AwsConnector/ec2RouteTables/delete",
|                                                    "Microsoft.AwsConnector/ec2RouteTables/write",
|                                                    "Microsoft.AwsConnector/ec2SecurityGroups/delete",
|                                                    "Microsoft.AwsConnector/ec2SecurityGroups/write",
|                                                    "Microsoft.AwsConnector/ec2Snapshots/delete",
|                                                    "Microsoft.AwsConnector/ec2Snapshots/write",
|                                                    "Microsoft.AwsConnector/ec2Subnets/delete",
|                                                    "Microsoft.AwsConnector/ec2Subnets/write",
|                                                    "Microsoft.AwsConnector/ec2Volumes/delete",
|                                                    "Microsoft.AwsConnector/ec2Volumes/write",
|                                                    "Microsoft.AwsConnector/ec2VPCEndpoints/delete",
|                                                    "Microsoft.AwsConnector/ec2VPCEndpoints/write",
|                                                    "Microsoft.AwsConnector/ec2VPCPeeringConnections/delete",
|                                                    "Microsoft.AwsConnector/ec2VPCPeeringConnections/write",
|                                                    "Microsoft.AwsConnector/ec2Vpcs/delete",
|                                                    "Microsoft.AwsConnector/ec2Vpcs/write",
|                                                    "Microsoft.AwsConnector/ecrImageDetails/delete",
|                                                    "Microsoft.AwsConnector/ecrImageDetails/write",
|                                                    "Microsoft.AwsConnector/ecrRepositories/delete",
|                                                    "Microsoft.AwsConnector/ecrRepositories/write",
|                                                    "Microsoft.AwsConnector/ecsClusters/delete",
|                                                    "Microsoft.AwsConnector/ecsClusters/write",
|                                                    "Microsoft.AwsConnector/ecsServices/delete",
|                                                    "Microsoft.AwsConnector/ecsServices/write",
|                                                    "Microsoft.AwsConnector/ecsTaskDefinitions/delete",
|                                                    "Microsoft.AwsConnector/ecsTaskDefinitions/write",
|                                                    "Microsoft.AwsConnector/efsFileSystems/delete",
|                                                    "Microsoft.AwsConnector/efsFileSystems/write",
|                                                    "Microsoft.AwsConnector/efsMountTargets/delete",
|                                                    "Microsoft.AwsConnector/efsMountTargets/write",
|                                                    "Microsoft.AwsConnector/eksClusters/delete",
|                                                    "Microsoft.AwsConnector/eksClusters/write",
|                                                    "Microsoft.AwsConnector/eksNodegroups/delete",
|                                                    "Microsoft.AwsConnector/eksNodegroups/write",
|                                                    "Microsoft.AwsConnector/elasticBeanstalkApplications/delete",
|                                                    "Microsoft.AwsConnector/elasticBeanstalkApplications/write",
|                                                    "Microsoft.AwsConnector/elasticBeanstalkConfigurationTemplates/delete",
|                                                    "Microsoft.AwsConnector/elasticBeanstalkConfigurationTemplates/write",
|                                                    "Microsoft.AwsConnector/elasticBeanstalkEnvironments/delete",
|                                                    "Microsoft.AwsConnector/elasticBeanstalkEnvironments/write",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2Listeners/delete",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2Listeners/write",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2LoadBalancers/delete",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2LoadBalancers/write",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2TargetGroups/delete",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2TargetGroups/write",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2TargetHealthDescriptions/delete",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2TargetHealthDescriptions/write",
|                                                    "Microsoft.AwsConnector/elasticsearchDomains/delete",
|                                                    "Microsoft.AwsConnector/elasticsearchDomains/write",
|                                                    "Microsoft.AwsConnector/emrClusters/delete",
|                                                    "Microsoft.AwsConnector/emrClusters/write",
|                                                    "Microsoft.AwsConnector/guardDutyDetectors/delete",
|                                                    "Microsoft.AwsConnector/guardDutyDetectors/write",
|                                                    "Microsoft.AwsConnector/iamAccessKeyLastUseds/delete",
|                                                    "Microsoft.AwsConnector/iamAccessKeyLastUseds/write",
|                                                    "Microsoft.AwsConnector/iamAccessKeyMetadata/delete",
|                                                    "Microsoft.AwsConnector/iamAccessKeyMetadata/write",
|                                                    "Microsoft.AwsConnector/iamGroups/delete",
|                                                    "Microsoft.AwsConnector/iamGroups/write",
|                                                    "Microsoft.AwsConnector/iamInstanceProfiles/delete",
|                                                    "Microsoft.AwsConnector/iamInstanceProfiles/write",
|                                                    "Microsoft.AwsConnector/iamManagedPolicies/delete",
|                                                    "Microsoft.AwsConnector/iamManagedPolicies/write",
|                                                    "Microsoft.AwsConnector/iamMFADevices/delete",
|                                                    "Microsoft.AwsConnector/iamMFADevices/write",
|                                                    "Microsoft.AwsConnector/iamPasswordPolicies/delete",
|                                                    "Microsoft.AwsConnector/iamPasswordPolicies/write",
|                                                    "Microsoft.AwsConnector/iamPolicyVersions/delete",
|                                                    "Microsoft.AwsConnector/iamPolicyVersions/write",
|                                                    "Microsoft.AwsConnector/iamRoles/delete",
|                                                    "Microsoft.AwsConnector/iamRoles/write",
|                                                    "Microsoft.AwsConnector/iamServerCertificates/delete",
|                                                    "Microsoft.AwsConnector/iamServerCertificates/write",
|                                                    "Microsoft.AwsConnector/iamUserPolicies/delete",
|                                                    "Microsoft.AwsConnector/iamUserPolicies/write",
|                                                    "Microsoft.AwsConnector/iamVirtualMFADevices/delete",
|                                                    "Microsoft.AwsConnector/iamVirtualMFADevices/write",
|                                                    "Microsoft.AwsConnector/kmsAliases/delete",
|                                                    "Microsoft.AwsConnector/kmsAliases/write",
|                                                    "Microsoft.AwsConnector/kmsKeys/delete",
|                                                    "Microsoft.AwsConnector/kmsKeys/write",
|                                                    "Microsoft.AwsConnector/lambdaFunctionCodeLocations/delete",
|                                                    "Microsoft.AwsConnector/lambdaFunctionCodeLocations/write",
|                                                    "Microsoft.AwsConnector/lambdaFunctionConfigurations/delete",
|                                                    "Microsoft.AwsConnector/lambdaFunctionConfigurations/write",
|                                                    "Microsoft.AwsConnector/lambdaFunctions/delete",
|                                                    "Microsoft.AwsConnector/lambdaFunctions/write",
|                                                    "Microsoft.AwsConnector/licenseManagerLicenses/delete",
|                                                    "Microsoft.AwsConnector/licenseManagerLicenses/write",
|                                                    "Microsoft.AwsConnector/lightsailBuckets/delete",
|                                                    "Microsoft.AwsConnector/lightsailBuckets/write",
|                                                    "Microsoft.AwsConnector/lightsailInstances/delete",
|                                                    "Microsoft.AwsConnector/lightsailInstances/write",
|                                                    "Microsoft.AwsConnector/Locations/OperationStatuses/write",
|                                                    "Microsoft.AwsConnector/logsLogGroups/delete",
|                                                    "Microsoft.AwsConnector/logsLogGroups/write",
|                                                    "Microsoft.AwsConnector/logsLogStreams/delete",
|                                                    "Microsoft.AwsConnector/logsLogStreams/write",
|                                                    "Microsoft.AwsConnector/logsMetricFilters/delete",
|                                                    "Microsoft.AwsConnector/logsMetricFilters/write",
|                                                    "Microsoft.AwsConnector/logsSubscriptionFilters/delete",
|                                                    "Microsoft.AwsConnector/logsSubscriptionFilters/write",
|                                                    "Microsoft.AwsConnector/macie2JobSummaries/delete",
|                                                    "Microsoft.AwsConnector/macie2JobSummaries/write",
|                                                    "Microsoft.AwsConnector/macieAllowLists/delete",
|                                                    "Microsoft.AwsConnector/macieAllowLists/write",
|                                                    "Microsoft.AwsConnector/networkFirewallFirewallPolicies/delete",
|                                                    "Microsoft.AwsConnector/networkFirewallFirewallPolicies/write",
|                                                    "Microsoft.AwsConnector/networkFirewallFirewalls/delete",
|                                                    "Microsoft.AwsConnector/networkFirewallFirewalls/write",
|                                                    "Microsoft.AwsConnector/networkFirewallRuleGroups/delete",
|                                                    "Microsoft.AwsConnector/networkFirewallRuleGroups/write",
|                                                    "Microsoft.AwsConnector/openSearchDomainStatuses/delete",
|                                                    "Microsoft.AwsConnector/openSearchDomainStatuses/write",
|                                                    "Microsoft.AwsConnector/openSearchServiceDomains/delete",
|                                                    "Microsoft.AwsConnector/openSearchServiceDomains/write",
|                                                    "Microsoft.AwsConnector/organizationsAccounts/delete",
|                                                    "Microsoft.AwsConnector/organizationsAccounts/write",
|                                                    "Microsoft.AwsConnector/organizationsOrganizations/delete",
|                                                    "Microsoft.AwsConnector/organizationsOrganizations/write",
|                                                    "Microsoft.AwsConnector/rdsDBClusters/delete",
|                                                    "Microsoft.AwsConnector/rdsDBClusters/write",
|                                                    "Microsoft.AwsConnector/rdsDBInstances/delete",
|                                                    "Microsoft.AwsConnector/rdsDBInstances/write",
|                                                    "Microsoft.AwsConnector/rdsDBSnapshotAttributesResults/delete",
|                                                    "Microsoft.AwsConnector/rdsDBSnapshotAttributesResults/write",
|                                                    "Microsoft.AwsConnector/rdsDBSnapshots/delete",
|                                                    "Microsoft.AwsConnector/rdsDBSnapshots/write",
|                                                    "Microsoft.AwsConnector/rdsEventSubscriptions/delete",
|                                                    "Microsoft.AwsConnector/rdsEventSubscriptions/write",
|                                                    "Microsoft.AwsConnector/rdsExportTasks/delete",
|                                                    "Microsoft.AwsConnector/rdsExportTasks/write",
|                                                    "Microsoft.AwsConnector/redshiftClusterParameterGroups/delete",
|                                                    "Microsoft.AwsConnector/redshiftClusterParameterGroups/write",
|                                                    "Microsoft.AwsConnector/redshiftClusters/delete",
|                                                    "Microsoft.AwsConnector/redshiftClusters/write",
|                                                    "Microsoft.AwsConnector/route53DomainsDomainSummaries/delete",
|                                                    "Microsoft.AwsConnector/route53DomainsDomainSummaries/write",
|                                                    "Microsoft.AwsConnector/route53HostedZones/delete",
|                                                    "Microsoft.AwsConnector/route53HostedZones/write",
|                                                    "Microsoft.AwsConnector/route53ResourceRecordSets/delete",
|                                                    "Microsoft.AwsConnector/route53ResourceRecordSets/write",
|                                                    "Microsoft.AwsConnector/s3AccessControlPolicies/delete",
|                                                    "Microsoft.AwsConnector/s3AccessControlPolicies/write",
|                                                    "Microsoft.AwsConnector/s3AccessPoints/delete",
|                                                    "Microsoft.AwsConnector/s3AccessPoints/write",
|                                                    "Microsoft.AwsConnector/s3BucketPolicies/delete",
|                                                    "Microsoft.AwsConnector/s3BucketPolicies/write",
|                                                    "Microsoft.AwsConnector/s3Buckets/delete",
|                                                    "Microsoft.AwsConnector/s3Buckets/write",
|                                                    "Microsoft.AwsConnector/s3ControlMultiRegionAccessPointPolicyDocuments/delete",
|                                                    "Microsoft.AwsConnector/s3ControlMultiRegionAccessPointPolicyDocuments/write",
|                                                    "Microsoft.AwsConnector/sageMakerApps/delete",
|                                                    "Microsoft.AwsConnector/sageMakerApps/write",
|                                                    "Microsoft.AwsConnector/sageMakerDevices/delete",
|                                                    "Microsoft.AwsConnector/sageMakerDevices/write",
|                                                    "Microsoft.AwsConnector/sageMakerImages/delete",
|                                                    "Microsoft.AwsConnector/sageMakerImages/write",
|                                                    "Microsoft.AwsConnector/sageMakerNotebookInstanceSummaries/delete",
|                                                    "Microsoft.AwsConnector/sageMakerNotebookInstanceSummaries/write",
|                                                    "Microsoft.AwsConnector/secretsManagerResourcePolicies/delete",
|                                                    "Microsoft.AwsConnector/secretsManagerResourcePolicies/write",
|                                                    "Microsoft.AwsConnector/secretsManagerSecrets/delete",
|                                                    "Microsoft.AwsConnector/secretsManagerSecrets/write",
|                                                    "Microsoft.AwsConnector/snsSubscriptions/delete",
|                                                    "Microsoft.AwsConnector/snsSubscriptions/write",
|                                                    "Microsoft.AwsConnector/snsTopics/delete",
|                                                    "Microsoft.AwsConnector/snsTopics/write",
|                                                    "Microsoft.AwsConnector/sqsQueues/delete",
|                                                    "Microsoft.AwsConnector/sqsQueues/write",
|                                                    "Microsoft.AwsConnector/ssmInstanceInformations/delete",
|                                                    "Microsoft.AwsConnector/ssmInstanceInformations/write",
|                                                    "Microsoft.AwsConnector/ssmParameters/delete",
|                                                    "Microsoft.AwsConnector/ssmParameters/write",
|                                                    "Microsoft.AwsConnector/ssmResourceComplianceSummaryItems/delete",
|                                                    "Microsoft.AwsConnector/ssmResourceComplianceSummaryItems/write",
|                                                    "Microsoft.AwsConnector/wafv2IPSets/delete",
|                                                    "Microsoft.AwsConnector/wafv2IPSets/write",
|                                                    "Microsoft.AwsConnector/wafv2LoggingConfigurations/delete",
|                                                    "Microsoft.AwsConnector/wafv2LoggingConfigurations/write",
|                                                    "Microsoft.AwsConnector/wafv2WebACLAssociations/delete",
|                                                    "Microsoft.AwsConnector/wafv2WebACLAssociations/write",
|                                                    "Microsoft.AwsConnector/wafWebACLSummaries/delete",
|                                                    "Microsoft.AwsConnector/wafWebACLSummaries/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a4b156ac-253f-4a1a-9851-96d62b71b047",
|                                    "Name":  "SRE Agent Reader",
|                                    "Description":  "Grants read-only access to all SRE Agent data, including chats, incidents, logs, and configurations. Does not permit interaction with the agent.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/agents/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/agents/threads/read",
|                                                        "Microsoft.App/agents/graph/read",
|                                                        "Microsoft.App/agents/memory/read",
|                                                        "Microsoft.App/agents/incidentManagement/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f0f57965-de58-41bc-ba76-2aaab4d09f30",
|                                    "Name":  "Hybrid Connectivity contributor role",
|                                    "Description":  "Microsoft.HybridConnectivity contributor role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridConnectivity/endpoints/listIngressGatewayCredentials/action",
|                                                    "Microsoft.HybridConnectivity/Locations/OperationStatuses/write",
|                                                    "Microsoft.HybridConnectivity/publicCloudConnectors/delete",
|                                                    "Microsoft.HybridConnectivity/publicCloudConnectors/read",
|                                                    "Microsoft.HybridConnectivity/publicCloudConnectors/testPermissions/action",
|                                                    "Microsoft.HybridConnectivity/publicCloudConnectors/write",
|                                                    "Microsoft.HybridConnectivity/solutionConfigurations/delete",
|                                                    "Microsoft.HybridConnectivity/solutionConfigurations/read",
|                                                    "Microsoft.HybridConnectivity/solutionConfigurations/syncNow/action",
|                                                    "Microsoft.HybridConnectivity/solutionConfigurations/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a235d3ee-5935-4cfb-8cc5-a3303ad5995e",
|                                    "Name":  "Storage File Data SMB MI Admin",
|                                    "Description":  "Allows for admin-level access for managed identities on files/directories in Azure file shares.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/takeOwnership/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/runAsBuiltInFileAdministrator/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b256d512-9a3a-4a96-9366-9f54f900e58b",
|                                    "Name":  "Common Edge Admin",
|                                    "Description":  "Common Edge Admin Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Edge/connectivityStatuses/delete",
|                                                    "Microsoft.Edge/connectivityStatuses/write",
|                                                    "Microsoft.Edge/locations/operationStatuses/write",
|                                                    "Microsoft.Edge/updates/delete",
|                                                    "Microsoft.Edge/updates/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "53b2724d-1e51-44fa-b586-bcace0c82609",
|                                    "Name":  "Firmware Analysis User",
|                                    "Description":  "Upload and analyze firmware images but not perform any workspace configuration",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.IoTFirmwareDefense/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.IoTFirmwareDefense/firmwareGroups/*",
|                                                       "Microsoft.IoTFirmwareDefense/register/action",
|                                                       "Microsoft.IoTFirmwareDefense/unregister/action",
|                                                       "Microsoft.IoTFirmwareDefense/workspaces/write",
|                                                       "Microsoft.IoTFirmwareDefense/workspaces/delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e79298df-d852-4c6d-84f9-5d13249d1e55",
|                                    "Name":  "SRE Agent Administrator",
|                                    "Description":  "Full control of the agent—manage chats, incident response plans, and agent run modes; approve and execute commands.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/agents/read",
|                                                    "Microsoft.App/agents/*/read",
|                                                    "Microsoft.App/agents/write",
|                                                    "Microsoft.App/agents/*/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/agents/*/read",
|                                                        "Microsoft.App/agents/*/write",
|                                                        "Microsoft.App/agents/*/delete",
|                                                        "Microsoft.App/agents/threads/approve/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2d84a65a-63b2-4343-bbb6-31105d857bc1",
|                                    "Name":  "SRE Agent Standard User",
|                                    "Description":  "Grants access to interact with the SRE Agent to triage incidents and run diagnostics.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/agents/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/agents/threads/read",
|                                                        "Microsoft.App/agents/graph/read",
|                                                        "Microsoft.App/agents/memory/read",
|                                                        "Microsoft.App/agents/incidentManagement/read",
|                                                        "Microsoft.App/agents/threads/write",
|                                                        "Microsoft.App/agents/graph/write",
|                                                        "Microsoft.App/agents/memory/write",
|                                                        "Microsoft.App/agents/scheduledtasks/read",
|                                                        "Microsoft.App/agents/scheduledtasks/write",
|                                                        "Microsoft.App/agents/scheduledtasks/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "850c5848-fc51-4a9a-8823-f220370626e3",
|                                    "Name":  "Azure Kubernetes Fleet Manager Hub Cluster User Role",
|                                    "Description":  "Grants read access to Azure Kubernetes Fleet Manager as well as the Kubernetes config file to connect to the fleet-managed hub cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action",
|                                                    "Microsoft.ContainerService/fleets/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3b03c2da-16b3-4a49-8834-0f8130efdd3b",
|                                    "Name":  "Log Analytics Data Reader",
|                                    "Description":  "Log Analytics Data Reader can query and search the logs it is allowed to view over Log Analytics workspaces and tables",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.OperationalInsights/workspaces/tables/data/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "89f7a3ec-e9d0-40eb-9b96-c016a5c2a53f",
|                                    "Name":  "Dynamics 365 Customer Insights Service Role",
|                                    "Description":  "Enables Diagnostic Logging setup for Customer Insights instances.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.D365CustomerInsights/instances/write",
|                                                    "Microsoft.D365CustomerInsights/instances/providers/Microsoft.Insights/diagnosticSettings/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "77789c21-1643-48a2-8f27-47f858540b51",
|                                    "Name":  "Storage Actions Task Assignment Contributor",
|                                    "Description":  "Used by the Storage Actions assigner to create a Task Assignment on their target Storage Account, with RBAC privileges for Managed Identity",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/reports/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/storageTaskAssignments/read",
|                                                    "Microsoft.Storage/storageAccounts/storageTaskAssignments/write",
|                                                    "Microsoft.Storage/storageAccounts/storageTaskAssignments/delete",
|                                                    "Microsoft.Storage/storageAccounts/storageTaskAssignments/reports/read",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4bad4d9e-2a13-4888-94bb-c8432f6f3040",
|                                    "Name":  "Storage Actions Blob Data Operator",
|                                    "Description":  "Used by the Storage Actions - Storage Task to list \u0026 perform operations on the Storage Account blobs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/runAsSuperUser/action",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/immutableStorage/runAsSuperUser/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "55077723-1b30-4603-a70b-68de134cfa20",
|                                    "Name":  "Azure Native Dynatrace Agent Management Role",
|                                    "Description":  "Grants access to manage Dynatrace Agent on compute resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bd8acdb0-202c-4493-a7fe-ef98eefbfbc4",
|                                    "Name":  "Storage Actions Contributor",
|                                    "Description":  "Used by the Storage Actions author to create, read, update, and delete Storage Actions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.StorageActions/storageTasks/read",
|                                                    "Microsoft.StorageActions/storageTasks/write",
|                                                    "Microsoft.StorageActions/storageTasks/delete",
|                                                    "Microsoft.StorageActions/storageTasks/storageTaskAssignments/read",
|                                                    "Microsoft.StorageActions/storageTasks/reports/read",
|                                                    "Microsoft.StorageActions/locations/previewActions/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "34013b0a-565b-43aa-8755-1b7c286f6cf7",
|                                    "Name":  "Essential Machine Management Administrator",
|                                    "Description":  "Can managed Essential Machine Management resources for subscriptions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Insights/dataCollectionRules/read",
|                                                    "Microsoft.Insights/dataCollectionRules/write",
|                                                    "Microsoft.Monitor/accounts/write",
|                                                    "Microsoft.Monitor/accounts/read",
|                                                    "Microsoft.ManagedOps/managedOps/read",
|                                                    "Microsoft.ManagedOps/managedOps/write",
|                                                    "Microsoft.ManagedOps/managedOps/delete",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.OperationsManagement/solutions/write",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedkeys/read",
|                                                    "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/metricAlerts/write",
|                                                    "Microsoft.Insights/metricAlerts/read",
|                                                    "Microsoft.Security/pricings/write",
|                                                    "Microsoft.Security/pricings/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "56e95fdc-3337-468d-b964-30d07f2a2018",
|                                    "Name":  "Garnet PubSub Data Contributor",
|                                    "Description":  "Allows read and write access to all channels within the Garnet resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/channels/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/numsub/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/numpat/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/psubscribe/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/publish/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/punsubscribe/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/subscribe/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/unsubscribe/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "da9adf61-39cd-41d5-87a0-30b21f7270d8",
|                                    "Name":  "Garnet PubSub Data Reader",
|                                    "Description":  "Allows read access to all channels within the Garnet resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/channels/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/psubscribe/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/punsubscribe/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/subscribe/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/unsubscribe/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0a7c2fa1-6f28-41a4-86b8-e74937c63222",
|                                    "Name":  "Tenant Contributor",
|                                    "Description":  "Allows users to create and manage Entra ID Tenants.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureActiveDirectory/directories/write",
|                                                    "Microsoft.AzureActiveDirectory/directories/read",
|                                                    "Microsoft.AzureActiveDirectory/entraTenants/write",
|                                                    "Microsoft.AzureActiveDirectory/entraTenants/read",
|                                                    "Microsoft.AzureActiveDirectory/entraTenants/delete",
|                                                    "Microsoft.AzureActiveDirectory/register/action",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bbf004e3-0e4b-4f86-ae4f-1f8fb47b357b",
|                                    "Name":  "Storage File Data SMB Admin",
|                                    "Description":  "Allows for admin access equivalent to storage account key for end users over SMB.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/takeOwnership/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "68899692-f960-4247-af28-82f55b357997",
|                                    "Name":  "Supercomputer Infrastructure Contributor",
|                                    "Description":  "Lets you manage Supercomputer Infrastructure resources, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.SupercomputerInfrastructure/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "13d06eae-ec82-4345-bcd6-c38625ddffbc",
|                                    "Name":  "Healthcare Agent Contributer",
|                                    "Description":  "Manage Helathcare Agent resources - list, view details, edit and delete resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HealthBot/healthBots/Read",
|                                                    "Microsoft.HealthBot/healthBots/Write",
|                                                    "Microsoft.HealthBot/healthBots/Delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4c7fd853-7345-4453-babd-e9481e9b460b",
|                                    "Name":  "Azure Resilience Management Recovery Contributor",
|                                    "Description":  "Contributor Role of Azure Resilience Management Recovery Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                    "Microsoft.Insights/alertRules/",
|                                                    "Microsoft.Management/ServiceGroups/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/write",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "481d9636-d9f0-468b-b93d-6056318e6f36",
|                                    "Name":  "Azure Resilience Management Recovery Administrator",
|                                    "Description":  "Administrator Role of Azure Resilience Management Recovery Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                    "Microsoft.Insights/alertRules/",
|                                                    "Microsoft.Management/ServiceGroups/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/write",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8210e6a3-4e4c-4e1a-bd83-ef8bac788a45",
|                                    "Name":  "Azure Resilience Management Recovery Reader",
|                                    "Description":  "Reader Role of Azure Resilience Management Recovery Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                    "Microsoft.Insights/alertRules/",
|                                                    "Microsoft.Management/ServiceGroups/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/read",
|                                                    "Microsoft.Resources/deployments/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "517781b0-5ad4-4418-94d5-f2421834b586",
|                                    "Name":  "Azure Resilience Management Recovery Operator",
|                                    "Description":  "Operator Role of Azure Resilience Management Recovery Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                    "Microsoft.Insights/alertRules/",
|                                                    "Microsoft.Management/ServiceGroups/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a5c3590a-3a1a-4cd4-9648-ea0a32b15137",
|                                    "Name":  "Azure Device Registry Contributor",
|                                    "Description":  "Allows for full access to IoT devices within Azure Device Registry Namespace.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.deviceregistry/namespaces/read",
|                                                    "microsoft.deviceregistry/namespaces/devices/*",
|                                                    "microsoft.deviceregistry/namespaces/discovereddevices/*",
|                                                    "microsoft.deviceregistry/namespaces/credentials/read",
|                                                    "microsoft.deviceregistry/namespaces/credentials/policies/read",
|                                                    "microsoft.devices/iothubs/certificates/*",
|                                                    "microsoft.devices/iothubs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "microsoft.deviceregistry/namespaces/credentials/policies/issueCertificate/action",
|                                                        "microsoft.devices/iothubs/devices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "09267e11-2e06-40b5-8fe4-68cea20794c9",
|                                    "Name":  "Azure Device Registry Credentials Contributor",
|                                    "Description":  "Allows for full access to manage credentials and policies within Azure Device Registry Namespace.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.deviceregistry/namespaces/credentials/*",
|                                                    "microsoft.deviceregistry/namespaces/credentials/policies/*",
|                                                    "microsoft.deviceregistry/namespaces/devices/revoke/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d5dddae-e124-4753-972d-aae60b37deb4",
|                                    "Name":  "Migrate Arc Discovery Reader - Preview",
|                                    "Description":  "Read metadata of Azure Arc enabled server resources and metadata, performance and migration suitability of Arc enabled SQL server resources. Users creating Azure Migrate project that uses Arc resource discovery require this role on Arc scope of the project. To enable periodic sync, Azure Migrate project managed identity must be assigned this role. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/read",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/databases/read",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/read",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/getTelemetry/action",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/getDetailView/action",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "547f7f0a-69c0-4807-bd9e-0321dfb66a84",
|                                    "Name":  "Azure Device Registry Onboarding",
|                                    "Description":  "Allows for full access to Azure Device Registry Namespace and X.509 certificate provisioning.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DeviceRegistry/namespaces/read",
|                                                    "Microsoft.DeviceRegistry/namespaces/write",
|                                                    "Microsoft.DeviceRegistry/namespaces/delete",
|                                                    "Microsoft.DeviceRegistry/namespaces/credentials/*",
|                                                    "Microsoft.DeviceRegistry/namespaces/credentials/policies/*",
|                                                    "Microsoft.Devices/iothubs/*",
|                                                    "Microsoft.Devices/provisioningServices/*",
|                                                    "microsoft.deviceregistry/namespaces/devices/revoke/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Devices/provisioningServices/enrollments/*",
|                                                        "Microsoft.Devices/provisioningServices/enrollmentGroups/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9d3ef640-3c86-4e0a-8907-8d361559c012",
|                                    "Name":  "Hybrid Network Owner",
|                                    "Description":  "Provides owner access to Hybrid Network Resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridNetwork/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a2b7cc47-30ec-462f-a2f4-9ac6e1c266af",
|                                    "Name":  "Azure Resilience Management Goals Administrator",
|                                    "Description":  "This role allows users to view, assign and delete resiliency goals for the service group, as well as modify the list of service group members that get evaluated against the goal. This role also allows a user to assign goal related permissions to other users.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Management/ServiceGroups/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/read",
|                                                    "Microsoft.AzureResilienceManagement/goalTemplates/delete",
|                                                    "Microsoft.AzureResilienceManagement/goalTemplates/read",
|                                                    "Microsoft.AzureResilienceManagement/goalTemplates/write",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/delete",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/read",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/write",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/goalResources/read",
|                                                    "Microsoft.AzureResilienceManagement/locations/operationStatuses/read",
|                                                    "Microsoft.AzureResilienceManagement/operations/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3910633d-19d0-4d31-b5e6-4f3101b137b9",
|                                    "Name":  "Azure Resilience Management Goals Contributor",
|                                    "Description":  "This role allows users to view, assign and delete resiliency goals for the service group, as well as modify the list of service group members that get evaluated against the goal.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Management/ServiceGroups/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/read",
|                                                    "Microsoft.AzureResilienceManagement/goalTemplates/delete",
|                                                    "Microsoft.AzureResilienceManagement/goalTemplates/read",
|                                                    "Microsoft.AzureResilienceManagement/goalTemplates/write",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/delete",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/read",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/write",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/goalResources/read",
|                                                    "Microsoft.AzureResilienceManagement/locations/operationStatuses/read",
|                                                    "Microsoft.AzureResilienceManagement/operations/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "39ea2c4e-798a-4469-b81d-65dc7c54cbdb",
|                                    "Name":  "Azure Resilience Management Goals Reader",
|                                    "Description":  "This role allows users to view the resiliency goals for the service group, as well as view the list of service group members that are being evaluated against the goal.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureResilienceManagement/goalTemplates/read",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/read",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/goalResources/read",
|                                                    "Microsoft.AzureResilienceManagement/locations/operationStatuses/read",
|                                                    "Microsoft.AzureResilienceManagement/operations/read",
|                                                    "Microsoft.Management/ServiceGroups/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "852e55ca-96ce-48b0-abca-2cd74d9042ca",
|                                    "Name":  "Azure Kubernetes Application Network Contributor Role",
|                                    "Description":  "Grant read, write and delete access to Azure Kubernetes Application Network",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppLink/AppLinks/read",
|                                                    "Microsoft.AppLink/AppLinks/write",
|                                                    "Microsoft.AppLink/AppLinks/delete",
|                                                    "Microsoft.AppLink/AppLinks/AppLinkMembers/read",
|                                                    "Microsoft.AppLink/AppLinks/AppLinkMembers/write",
|                                                    "Microsoft.AppLink/AppLinks/AppLinkMembers/delete",
|                                                    "Microsoft.AppLink/locations/operationStatuses/read",
|                                                    "Microsoft.AppLink/Locations/OperationStatuses/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "463ad26c-fcce-4469-9c7f-5653d8acbab5",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Reader for Member Clusters",
|                                    "Description":  "Allows read-only access to see most objects in a namespace. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation).  Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/members/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/fleets/members/apps/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/members/apps/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/members/apps/replicasets/read",
|                                                        "Microsoft.ContainerService/fleets/members/apps/statefulsets/read",
|                                                        "Microsoft.ContainerService/fleets/members/autoscaling/horizontalpodautoscalers/read",
|                                                        "Microsoft.ContainerService/fleets/members/batch/cronjobs/read",
|                                                        "Microsoft.ContainerService/fleets/members/batch/jobs/read",
|                                                        "Microsoft.ContainerService/fleets/members/configmaps/read",
|                                                        "Microsoft.ContainerService/fleets/members/discovery.k8s.io/endpointslices/read",
|                                                        "Microsoft.ContainerService/fleets/members/endpoints/read",
|                                                        "Microsoft.ContainerService/fleets/members/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/fleets/members/events/read",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/replicasets/read",
|                                                        "Microsoft.ContainerService/fleets/members/limitranges/read",
|                                                        "Microsoft.ContainerService/fleets/members/metrics.k8s.io/pods/read",
|                                                        "Microsoft.ContainerService/fleets/members/metrics.k8s.io/nodes/read",
|                                                        "Microsoft.ContainerService/fleets/members/namespaces/read",
|                                                        "Microsoft.ContainerService/fleets/members/networking.k8s.io/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/members/networking.k8s.io/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/members/persistentvolumeclaims/read",
|                                                        "Microsoft.ContainerService/fleets/members/pods/read",
|                                                        "Microsoft.ContainerService/fleets/members/policy/poddisruptionbudgets/read",
|                                                        "Microsoft.ContainerService/fleets/members/replicationcontrollers/read",
|                                                        "Microsoft.ContainerService/fleets/members/resourcequotas/read",
|                                                        "Microsoft.ContainerService/fleets/members/serviceaccounts/read",
|                                                        "Microsoft.ContainerService/fleets/members/services/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d1f699ed-700a-4c77-a22f-29890ac7b115",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Admin for Member Clusters",
|                                    "Description":  "This role grants admin access - provides write permissions on most objects within a namespace, with the exception of ResourceQuota object and the namespace object itself. Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/members/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "50346970-0998-40f2-b47d-f3b8809840f8",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Writer for Member Clusters",
|                                    "Description":  "Allows read/write access to most objects in a namespace. This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets and running Pods as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace.  Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/members/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/fleets/members/apps/daemonsets/*",
|                                                        "Microsoft.ContainerService/fleets/members/apps/deployments/*",
|                                                        "Microsoft.ContainerService/fleets/members/apps/replicasets/*",
|                                                        "Microsoft.ContainerService/fleets/members/apps/statefulsets/*",
|                                                        "Microsoft.ContainerService/fleets/members/autoscaling/horizontalpodautoscalers/*",
|                                                        "Microsoft.ContainerService/fleets/members/batch/cronjobs/*",
|                                                        "Microsoft.ContainerService/fleets/members/coordination.k8s.io/leases/read",
|                                                        "Microsoft.ContainerService/fleets/members/coordination.k8s.io/leases/write",
|                                                        "Microsoft.ContainerService/fleets/members/coordination.k8s.io/leases/delete",
|                                                        "Microsoft.ContainerService/fleets/members/discovery.k8s.io/endpointslices/read",
|                                                        "Microsoft.ContainerService/fleets/members/batch/jobs/*",
|                                                        "Microsoft.ContainerService/fleets/members/configmaps/*",
|                                                        "Microsoft.ContainerService/fleets/members/endpoints/*",
|                                                        "Microsoft.ContainerService/fleets/members/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/fleets/members/events/*",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/daemonsets/*",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/deployments/*",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/ingresses/*",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/networkpolicies/*",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/replicasets/*",
|                                                        "Microsoft.ContainerService/fleets/members/limitranges/read",
|                                                        "Microsoft.ContainerService/fleets/members/metrics.k8s.io/pods/read",
|                                                        "Microsoft.ContainerService/fleets/members/metrics.k8s.io/nodes/read",
|                                                        "Microsoft.ContainerService/fleets/members/namespaces/read",
|                                                        "Microsoft.ContainerService/fleets/members/networking.k8s.io/ingresses/*",
|                                                        "Microsoft.ContainerService/fleets/members/networking.k8s.io/networkpolicies/*",
|                                                        "Microsoft.ContainerService/fleets/members/persistentvolumeclaims/*",
|                                                        "Microsoft.ContainerService/fleets/members/pods/*",
|                                                        "Microsoft.ContainerService/fleets/members/policy/poddisruptionbudgets/*",
|                                                        "Microsoft.ContainerService/fleets/members/replicationcontrollers/*",
|                                                        "Microsoft.ContainerService/fleets/members/resourcequotas/read",
|                                                        "Microsoft.ContainerService/fleets/members/secrets/*",
|                                                        "Microsoft.ContainerService/fleets/members/serviceaccounts/*",
|                                                        "Microsoft.ContainerService/fleets/members/services/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "79a36d98-eb96-4a76-ae1d-481dc98d2c23",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Admin for Member Clusters",
|                                    "Description":  "Lets you manage all resources in the member clusters in the fleet.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/members/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5eaf7b81-a48f-45ed-b6b4-c64bfe86d523",
|                                    "Name":  "Relationship Reader",
|                                    "Description":  "Role definition allowing read access to all relationship types",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Relationships/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b54df9c1-53dc-45cc-a86d-7a83cced2ed0",
|                                    "Name":  "Relationship Administrator",
|                                    "Description":  "Role definition allowing read, write and delete access to all relationship types",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Relationships/*/read",
|                                                    "Microsoft.Relationships/*/write",
|                                                    "Microsoft.Relationships/*/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "05b1aaf9-00c9-477b-b0e8-2da660b78c51",
|                                    "Name":  "Service Group Member Relationship Contributor",
|                                    "Description":  "Role definition allowing read, write and delete access to Service Group Member relationship types",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Relationships/serviceGroupMember/read",
|                                                    "Microsoft.Relationships/serviceGroupMember/write",
|                                                    "Microsoft.Relationships/serviceGroupMember/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "eb64ab4c-23eb-4f63-a9c2-27da365f04e7",
|                                    "Name":  "SRE Agent Author",
|                                    "Description":  "Allows users to add custom features to the SRE Agent using incident handlers and extended agents.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/agents/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/agents/threads/read",
|                                                        "Microsoft.App/agents/incidentManagement/read",
|                                                        "Microsoft.App/agents/incidentManagement/write",
|                                                        "Microsoft.App/agents/incidentManagement/delete",
|                                                        "Microsoft.App/agents/extendedAgents/read",
|                                                        "Microsoft.App/agents/extendedAgents/write",
|                                                        "Microsoft.App/agents/extendedAgents/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5052f0f9-7e27-4570-bc13-9ee1cf442526",
|                                    "Name":  "Microsoft Confluent Contributor role",
|                                    "Description":  "Microsoft Confluent Provider role to manage organizations and child resource.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Confluent/agreements/write",
|                                                    "Microsoft.Confluent/locations/OperationStatuses/write",
|                                                    "Microsoft.Confluent/organizations/access/createInvitation/action",
|                                                    "Microsoft.Confluent/organizations/access/deleteRoleBinding/delete",
|                                                    "Microsoft.Confluent/organizations/access/listClusters/action",
|                                                    "Microsoft.Confluent/organizations/access/listEnvironments/action",
|                                                    "Microsoft.Confluent/organizations/access/listInvitations/action",
|                                                    "Microsoft.Confluent/organizations/access/listRoleBindings/action",
|                                                    "Microsoft.Confluent/organizations/access/listServiceAccounts/action",
|                                                    "Microsoft.Confluent/organizations/access/listUsers/action",
|                                                    "Microsoft.Confluent/organizations/apiKeys/delete",
|                                                    "Microsoft.Confluent/organizations/delete",
|                                                    "Microsoft.Confluent/organizations/environments/clusters/connectors/delete",
|                                                    "Microsoft.Confluent/organizations/environments/clusters/connectors/write",
|                                                    "Microsoft.Confluent/organizations/environments/clusters/createAPIKey/action",
|                                                    "Microsoft.Confluent/organizations/environments/clusters/delete",
|                                                    "Microsoft.Confluent/organizations/environments/clusters/topics/delete",
|                                                    "Microsoft.Confluent/organizations/environments/clusters/topics/write",
|                                                    "Microsoft.Confluent/organizations/environments/clusters/write",
|                                                    "Microsoft.Confluent/organizations/environments/delete",
|                                                    "Microsoft.Confluent/organizations/environments/write",
|                                                    "Microsoft.Confluent/organizations/listRegions/action",
|                                                    "Microsoft.Confluent/organizations/write",
|                                                    "Microsoft.Confluent/validations/orgvalidate/action",
|                                                    "Microsoft.Confluent/validations/orgvalidateV2/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2e481b5d-5af3-463b-8b01-f9c948aaf0c5",
|                                    "Name":  "Informatica DataManagement Contributor role",
|                                    "Description":  "Informatica DataManagement Provider role to manage organizations and child resource.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Informatica.DataManagement/locations/operationStatuses/write",
|                                                    "Informatica.DataManagement/organizations/delete",
|                                                    "Informatica.DataManagement/organizations/getServerlessMetadata/action",
|                                                    "Informatica.DataManagement/organizations/serverlessRuntimes/delete",
|                                                    "Informatica.DataManagement/organizations/serverlessRuntimes/write",
|                                                    "Informatica.DataManagement/organizations/singleSignOnConfigurations/delete",
|                                                    "Informatica.DataManagement/organizations/singleSignOnConfigurations/write",
|                                                    "Informatica.DataManagement/organizations/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "512ef07a-840c-48d2-9be4-9a30a75a5c70",
|                                    "Name":  "Defender Cloud Secrets Posture",
|                                    "Description":  "Service role that provides permissions for Microsoft Defender Cloud Secrets Posture",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDB/databaseAccounts/listKeys/action",
|                                                    "Microsoft.documentdb/mongoClusters/read",
|                                                    "Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action",
|                                                    "Microsoft.CognitiveServices/accounts/listKeys/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5a2ec2f1-2375-4950-9906-59ec1d979249",
|                                    "Name":  "Azure Resilience Management Drills Assets Administrator",
|                                    "Description":  "This Role grants permissions on the Chaos Subscription to create, read, and delete Resource Groups, Automation Accounts, and Chaos Experiments, and assigns necessary roles to Drill and Chaos MSIs for executing post actions required by Azure Resilience Management Drills.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/delete",
|                                                    "Microsoft.Automation/automationAccounts/read",
|                                                    "Microsoft.Automation/automationAccounts/write",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/delete",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/write",
|                                                    "Microsoft.Chaos/experiments/delete",
|                                                    "Microsoft.Chaos/experiments/read",
|                                                    "Microsoft.Chaos/experiments/write",
|                                                    "Microsoft.Chaos/locations/operationResults/read",
|                                                    "Microsoft.Chaos/locations/operationStatuses/read",
|                                                    "Microsoft.Chaos/workspaces/delete",
|                                                    "Microsoft.Chaos/workspaces/read",
|                                                    "Microsoft.Chaos/workspaces/write",
|                                                    "Microsoft.Chaos/workspaces/refreshRecommendations/action",
|                                                    "Microsoft.Chaos/workspaces/discoveredResources/read",
|                                                    "Microsoft.Chaos/workspaces/scenarios/delete",
|                                                    "Microsoft.Chaos/workspaces/scenarios/read",
|                                                    "Microsoft.Chaos/workspaces/scenarios/write",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/delete",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/read",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/write",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/cancel/action",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/execute/action",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/validate/action",
|                                                    "Microsoft.Chaos/workspaces/scenarios/runs/read",
|                                                    "Microsoft.Insights/dataCollectionEndpoints/read",
|                                                    "Microsoft.Insights/dataCollectionEndpoints/write",
|                                                    "Microsoft.Insights/dataCollectionRules/read",
|                                                    "Microsoft.Insights/dataCollectionRules/write",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/tables/read",
|                                                    "Microsoft.OperationalInsights/workspaces/tables/write",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "344b740c-5e7c-4d32-89b2-ee3b51cb89bc",
|                                    "Name":  "Azure Resilience Management Drills Assets Contributor",
|                                    "Description":  "This Role grants permissions on the Chaos Subscription to create, read, and delete Resource Groups, Automation Accounts, and Chaos Experiments for managing chaos engineering workflows required by Azure Resilience Management Drills",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/delete",
|                                                    "Microsoft.Automation/automationAccounts/read",
|                                                    "Microsoft.Automation/automationAccounts/write",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/delete",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/write",
|                                                    "Microsoft.Chaos/experiments/delete",
|                                                    "Microsoft.Chaos/experiments/read",
|                                                    "Microsoft.Chaos/experiments/write",
|                                                    "Microsoft.Chaos/workspaces/delete",
|                                                    "Microsoft.Chaos/workspaces/read",
|                                                    "Microsoft.Chaos/workspaces/write",
|                                                    "Microsoft.Chaos/workspaces/refreshRecommendations/action",
|                                                    "Microsoft.Chaos/workspaces/discoveredResources/read",
|                                                    "Microsoft.Chaos/workspaces/scenarios/delete",
|                                                    "Microsoft.Chaos/workspaces/scenarios/read",
|                                                    "Microsoft.Chaos/workspaces/scenarios/write",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/delete",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/read",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/write",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/cancel/action",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/execute/action",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/validate/action",
|                                                    "Microsoft.Chaos/workspaces/scenarios/runs/read",
|                                                    "Microsoft.Chaos/locations/operationResults/read",
|                                                    "Microsoft.Chaos/locations/operationStatuses/read",
|                                                    "Microsoft.Insights/dataCollectionEndpoints/read",
|                                                    "Microsoft.Insights/dataCollectionEndpoints/write",
|                                                    "Microsoft.Insights/dataCollectionRules/read",
|                                                    "Microsoft.Insights/dataCollectionRules/write",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/tables/read",
|                                                    "Microsoft.OperationalInsights/workspaces/tables/write",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e4c7f620-39b8-4688-bba2-70dd82ef367b",
|                                    "Name":  "Azure Resilience Management Drills Target Resource Administrator",
|                                    "Description":  "This role should be assigned at the Service Group Members scope to enable resource read access, manage role assignments, and configure chaos targets and capabilities for fault injection, failover, and other post-fault actions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Chaos/locations/targetTypes/capabilityTypes/read",
|                                                    "Microsoft.Chaos/locations/targetTypes/read",
|                                                    "Microsoft.Chaos/targets/capabilities/delete",
|                                                    "Microsoft.Chaos/targets/capabilities/read",
|                                                    "Microsoft.Chaos/targets/capabilities/write",
|                                                    "Microsoft.Chaos/targets/delete",
|                                                    "Microsoft.Chaos/targets/read",
|                                                    "Microsoft.Chaos/targets/write",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/read ",
|                                                    "Microsoft.Sql/managedInstances/read",
|                                                    "Microsoft.Web/serverfarms/read",
|                                                    "Microsoft.Web/sites/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "82c6a823-ae9c-4b90-b5c5-bff581c45896",
|                                    "Name":  "Azure Resilience Management Drills Target Resource Contributor",
|                                    "Description":  "This role should be assigned at the Service Group Members scope to enable resource read access and configure chaos targets and capabilities for fault injection, failover, and other post-fault actions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Chaos/locations/targetTypes/capabilityTypes/read",
|                                                    "Microsoft.Chaos/locations/targetTypes/read",
|                                                    "Microsoft.Chaos/targets/capabilities/delete",
|                                                    "Microsoft.Chaos/targets/capabilities/read",
|                                                    "Microsoft.Chaos/targets/capabilities/write",
|                                                    "Microsoft.Chaos/targets/delete",
|                                                    "Microsoft.Chaos/targets/read",
|                                                    "Microsoft.Chaos/targets/write",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/read ",
|                                                    "Microsoft.Sql/managedInstances/read",
|                                                    "Microsoft.Web/serverfarms/read",
|                                                    "Microsoft.Web/sites/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dc0882cc-bc27-4d21-9ea2-f821aaa10fb1",
|                                    "Name":  "ARN Service Event Grid Subscriber Role",
|                                    "Description":  "Allows ARN to subscribe to partner event grid topics",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EventGrid/EventSubscriptions/write",
|                                                    "Microsoft.EventGrid/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a51d5f27-deba-47d1-9ccd-8589014b2e28",
|                                    "Name":  "Gcp Connector contributor role",
|                                    "Description":  "Microsoft.GcpConnector contributor role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.GcpConnector/bigQueryDatasets/delete",
|                                                    "Microsoft.GcpConnector/bigQueryDatasets/write",
|                                                    "Microsoft.GcpConnector/cloudFunctions/delete",
|                                                    "Microsoft.GcpConnector/cloudFunctions/write",
|                                                    "Microsoft.GcpConnector/computeInstances/delete",
|                                                    "Microsoft.GcpConnector/computeInstances/write",
|                                                    "Microsoft.GcpConnector/containerClusters/delete",
|                                                    "Microsoft.GcpConnector/containerClusters/write",
|                                                    "Microsoft.GcpConnector/Locations/OperationStatuses/write",
|                                                    "Microsoft.GcpConnector/sqlAdminInstances/delete",
|                                                    "Microsoft.GcpConnector/sqlAdminInstances/write",
|                                                    "Microsoft.GcpConnector/storageBuckets/delete",
|                                                    "Microsoft.GcpConnector/storageBuckets/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "46023a6a-0702-4cbf-956c-d8c3ac27bc2b",
|                                    "Name":  "Defender CSPM",
|                                    "Description":  "Grants permissions for Microsoft Defender for Cloud CSPM base plan features",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/aiservices/agents/read",
|                                                        "Microsoft.CognitiveServices/accounts/aiservices/assets/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d9bac3f-34b2-432f-bde5-78aa8e73ce6b",
|                                    "Name":  "Storage File Data SMB Take Ownership",
|                                    "Description":  "Allows end user to assume ownership of a file/directory",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/takeOwnership/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "35c49d44-ccc1-4b18-8267-cfb3bacdd396",
|                                    "Name":  "Storage DataShare Contributor",
|                                    "Description":  "Allows creating and managing storage dataShares to share data from storage accounts in-place. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/listServiceSas/action",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/locations/DataManagementRPOperationStatuses/read",
|                                                    "Microsoft.Storage/locations/DataManagementRPOperationStatuses/write",
|                                                    "Microsoft.Storage/storageAccounts/dataShares/read",
|                                                    "Microsoft.Storage/storageAccounts/dataShares/delete",
|                                                    "Microsoft.Storage/storageAccounts/dataShares/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9d819e60-1b9f-4871-b492-4e6cdee0b50a",
|                                    "Name":  "Storage Connector Contributor",
|                                    "Description":  "Allows creating and managing storage connectors to access remote data sources in-place in a storage account. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/listServiceSas/action",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                    "Microsoft.Storage/locations/DataManagementRPOperationStatuses/read",
|                                                    "Microsoft.Storage/locations/DataManagementRPOperationStatuses/write",
|                                                    "Microsoft.Storage/storageAccounts/connectors/read",
|                                                    "Microsoft.Storage/storageAccounts/connectors/delete",
|                                                    "Microsoft.Storage/storageAccounts/connectors/write",
|                                                    "Microsoft.Storage/storageAccounts/connectors/testExistingConnection/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "14f26b53-9d80-4924-8141-f664426a48f6",
|                                    "Name":  "Cognitive Services Security Integration Admin",
|                                    "Description":  "Lets you manage safety providers for Cognitive Services.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "45265627-32f7-4da4-9ab0-b1cb0e9ec70b",
|                                    "Name":  "Playwright Workspace Owner",
|                                    "Description":  "Perform all operations on Playwright Workspace resources. Can manage service access tokens and execute Playwright tests.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Loadtestservice/playwrightworkspaces/*",
|                                                    "Microsoft.Loadtestservice/locations/playwrightquotas/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "19d36063-d00b-4ea5-a1ac-a7c4926a0b78",
|                                    "Name":  "Playwright Workspace Reader",
|                                    "Description":  "View and list all Playwright Workspace resources and tests but can not make any changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Loadtestservice/playwrightworkspaces/*/read",
|                                                    "Microsoft.Loadtestservice/locations/playwrightquotas/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "78cf819f-0969-4ebe-8759-015c6efcd5bf",
|                                    "Name":  "Playwright Workspace Contributor",
|                                    "Description":  "View and list Playwright Workspace resources but can not make any changes. Can manage service access tokens and execute Playwright tests.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Loadtestservice/playwrightworkspaces/*/read",
|                                                    "Microsoft.Loadtestservice/locations/playwrightquotas/*",
|                                                    "Microsoft.Loadtestservice/playwrightworkspaces/AccessTokens/*",
|                                                    "Microsoft.Loadtestservice/playwrightworkspaces/TestRuns/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6f91a4f9-10ee-4b95-b8cd-96ee73c5968d",
|                                    "Name":  "Defender API Security",
|                                    "Description":  "Grants Microsoft Defender for Cloud access to computes to provide API security",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Security/pricings/read",
|                                                    "Microsoft.Security/apiCollections/read",
|                                                    "Microsoft.ApiManagement/service/read",
|                                                    "Microsoft.ApiManagement/service/apis/read",
|                                                    "Microsoft.ApiManagement/service/apis/operations/read",
|                                                    "Microsoft.ApiManagement/service/apiVersionSets/read",
|                                                    "Microsoft.ApiManagement/service/apis/diagnostics/read",
|                                                    "Microsoft.ApiManagement/service/apis/diagnostics/write",
|                                                    "Microsoft.ApiManagement/service/apis/diagnostics/delete",
|                                                    "Microsoft.ApiManagement/service/apis/policies/read",
|                                                    "Microsoft.ApiManagement/service/backends/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/apis/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/apis/operations/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/apiVersionSets/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/apis/diagnostics/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/apis/diagnostics/write",
|                                                    "Microsoft.ApiManagement/service/workspaces/apis/diagnostics/delete",
|                                                    "Microsoft.ApiManagement/service/workspaces/apis/policies/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/backends/read",
|                                                    "Microsoft.ApiManagement/gateways/configConnections/read",
|                                                    "Microsoft.ApiManagement/service/workspaceLinks/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7d0c0268-1199-449b-a52e-75c20879f46b",
|                                    "Name":  "Defender Settings Contributor",
|                                    "Description":  "Grants Microsoft Defender for Cloud access to Defender Settings",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.security/pricings/read",
|                                                    "microsoft.security/pricings/write",
|                                                    "microsoft.security/pricings/securityoperators/read",
|                                                    "microsoft.security/securityoperators/read",
|                                                    "microsoft.security/register/action",
|                                                    "microsoft.security/settings/read",
|                                                    "microsoft.security/settings/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d56b031f-8d90-4376-9231-b5c94fce88ef",
|                                    "Name":  "Defender Unified RBAC Scoped Reader",
|                                    "Description":  "Defender Unified RBAC Scoped Reader. This role is managed and assigned automatically by the Defender Unified RBAC system. Manual assignment of this role is not recommended, as the Defender Unified RBAC system may modify or remove it at any time based on system requirements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SecurityInsights/*/read",
|                                                    "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/LinkedServices/read",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                    "Microsoft.OperationalInsights/querypacks/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.Insights/workbooks/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/templateSpecs/*/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                       "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*",
|                                                       "Microsoft.SecurityInsights/alertRules/read"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.OperationalInsights/workspaces/tables/data/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a954a0e0-f57f-4606-8421-fd7bd4e54b0f",
|                                    "Name":  "Azure Device Onboarding Contributor",
|                                    "Description":  "Can read, write, or delete resources for onboarding services, policies, and device states.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DeviceOnboarding/onboardingServices/read",
|                                                    "Microsoft.DeviceOnboarding/onboardingServices/write",
|                                                    "Microsoft.DeviceOnboarding/onboardingServices/delete",
|                                                    "Microsoft.DeviceOnboarding/onboardingServices/policies/read",
|                                                    "Microsoft.DeviceOnboarding/onboardingServices/policies/write",
|                                                    "Microsoft.DeviceOnboarding/onboardingServices/policies/delete",
|                                                    "Microsoft.DeviceOnboarding/deviceStates/read",
|                                                    "Microsoft.DeviceOnboarding/deviceStates/write",
|                                                    "Microsoft.DeviceOnboarding/deviceStates/delete",
|                                                    "Microsoft.DeviceOnboarding/deviceStates/prepareForOnboarding/action",
|                                                    "Microsoft.DeviceOnboarding/locations/operationStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "980cf6f7-edec-4fd1-8e9e-28f70b1d5258",
|                                    "Name":  "Compute Limit Operator",
|                                    "Description":  "Read and manage compute limits using compute limit operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ComputeLimit/locations/guestSubscriptions/read",
|                                                    "Microsoft.ComputeLimit/locations/guestSubscriptions/write",
|                                                    "Microsoft.ComputeLimit/locations/guestSubscriptions/delete",
|                                                    "Microsoft.ComputeLimit/locations/sharedLimits/read",
|                                                    "Microsoft.ComputeLimit/locations/sharedLimits/write",
|                                                    "Microsoft.ComputeLimit/locations/sharedLimits/delete",
|                                                    "Microsoft.ComputeLimit/register/action",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "045b6ee5-0c68-42c4-9be0-7389794309f5",
|                                    "Name":  "MongoDB Atlas Contributor",
|                                    "Description":  "Provides access to MongoDB.Atlas Control Plane Operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "MongoDB.Atlas/checkNameAvailability/action",
|                                                    "MongoDB.Atlas/register/action",
|                                                    "MongoDB.Atlas/unregister/action",
|                                                    "MongoDB.Atlas/operations/read",
|                                                    "MongoDB.Atlas/locations/operationStatuses/read",
|                                                    "MongoDB.Atlas/locations/operationStatuses/write",
|                                                    "MongoDB.Atlas/registeredSubscriptions/read",
|                                                    "MongoDB.Atlas/organizations/read",
|                                                    "MongoDB.Atlas/organizations/write",
|                                                    "MongoDB.Atlas/organizations/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ee99642a-225b-4fe8-a771-9d9036053e87",
|                                    "Name":  "Arc Container Storage Contributor",
|                                    "Description":  "Create, read, modify, and delete Arc Container Storage resources on connected clusters. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ArcContainerStorage/edgeStorageConfigurations/read",
|                                                    "Microsoft.ArcContainerStorage/edgeStorageConfigurations/write",
|                                                    "Microsoft.ArcContainerStorage/edgeStorageConfigurations/delete",
|                                                    "Microsoft.ArcContainerStorage/edgeVolumes/read",
|                                                    "Microsoft.ArcContainerStorage/edgeVolumes/write",
|                                                    "Microsoft.ArcContainerStorage/edgeVolumes/delete",
|                                                    "Microsoft.ArcContainerStorage/edgeVolumes/ingestSubvolumes/read",
|                                                    "Microsoft.ArcContainerStorage/edgeVolumes/ingestSubvolumes/write",
|                                                    "Microsoft.ArcContainerStorage/edgeVolumes/ingestSubvolumes/delete",
|                                                    "Microsoft.ArcContainerStorage/locations/operationStatuses/read",
|                                                    "Microsoft.ArcContainerStorage/locations/operationStatuses/write"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.ArcContainerStorage/register/action",
|                                                       "Microsoft.ArcContainerStorage/unregister/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c883944f-8b7b-4483-af10-35834be79c4a",
|                                    "Name":  "Azure AI Owner",
|                                    "Description":  "Grants full to manage AI project and accounts. Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AlertsManagement/actionRules/*",
|                                                    "Microsoft.AlertsManagement/alerts/*",
|                                                    "Microsoft.AlertsManagement/issues/*",
|                                                    "Microsoft.AlertsManagement/prometheusRuleGroups/*",
|                                                    "Microsoft.AlertsManagement/smartDetectorAlertRules/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.CognitiveServices/*",
|                                                    "Microsoft.Insights/activityLogAlerts/*",
|                                                    "Microsoft.Insights/metricalerts/*",
|                                                    "Microsoft.Insights/scheduledqueryrules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "42f3c60f-e7b1-46d7-ba56-6de681664342",
|                                    "Name":  "Azure Red Hat OpenShift First Party Network",
|                                    "Description":  "Grant ARO Classic First Party Service Principal or managed identity required network permissions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/routeTables/read",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                    "Microsoft.Network/networkIntentPolicies/join/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8da79822-b118-42bc-83c9-789fdbdcd77b",
|                                    "Name":  "Elastic SAN Volume Data Contributor",
|                                    "Description":  "Allows for read and write access to a volume data on Azure Elastic SAN",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/write",
|                                                    "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/data/read",
|                                                        "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/data/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "92318126-08be-45d0-a1b2-532e6c7d52ce",
|                                    "Name":  "Microsoft Approvals Workflow Contributor",
|                                    "Description":  "Performs approval workflow management operations including workflow creation, execution and deletion.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Approvals/approvalSettings/read",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/read",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/write",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/delete",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/read",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/write",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/syncPolicyStatus/action",
|                                                    "Microsoft.Approvals/approvalWorkflowAssignments/read",
|                                                    "Microsoft.Approvals/approvalWorkflowAssignments/write",
|                                                    "Microsoft.Approvals/approvalWorkflowAssignments/delete",
|                                                    "Microsoft.Approvals/invokeAndFetchApprovalRequest/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "98d40527-c073-4096-943a-dd593105ca9c",
|                                    "Name":  "Microsoft Approvals Service Operator",
|                                    "Description":  "Performs Approvals service-level management operations including service onboarding and configuration.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Approvals/approvalSettings/read",
|                                                    "Microsoft.Approvals/approvalSettings/write",
|                                                    "Microsoft.Approvals/approvalSettings/delete",
|                                                    "Microsoft.Approvals/approvalSettings/initialize/action",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/read",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/read",
|                                                    "Microsoft.Approvals/approvalWorkflowAssignments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0343f3e8-01ac-4bb8-8f93-78b1d31ba64b",
|                                    "Name":  "Microsoft Approvals Request User",
|                                    "Description":  "Requests approval workflow execution for resource changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Approvals/invokeAndFetchApprovalRequest/action",
|                                                    "Microsoft.Approvals/approvalSettings/read",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/read",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/read",
|                                                    "Microsoft.Approvals/approvalWorkflowAssignments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a6a9a135-9048-45df-b559-a90bb025e92f",
|                                    "Name":  "Astronomer Astro Contributor",
|                                    "Description":  "Provides access to Astronomer.Astro Control Plane Operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Astronomer.Astro/register/action",
|                                                    "Astronomer.Astro/unregister/action",
|                                                    "Astronomer.Astro/operations/read",
|                                                    "Astronomer.Astro/organizations/read",
|                                                    "Astronomer.Astro/organizations/write",
|                                                    "Astronomer.Astro/organizations/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0e2ecf2a-0574-4b08-89e2-be133aa6303f",
|                                    "Name":  "Defender Databricks Operator",
|                                    "Description":  "Grants permissions for Microsoft Defender for Cloud feature on Databricks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Databricks/workspaces/read",
|                                                    "Microsoft.Databricks/workspaces/assignWorkspaceAdmin/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4b2b8358-764b-4884-85c6-f4b7946d95ad",
|                                    "Name":  "EdgeMarketPlace role",
|                                    "Description":  "Microsoft.EdgeMarketPlace role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EdgeMarketplace/locations/operationStatuses/write",
|                                                    "Microsoft.EdgeMarketplace/locations/operationStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9a0e5da3-6c70-4a35-b13a-715cd5a7919a",
|                                    "Name":  "Azure Stack Hub registration role",
|                                    "Description":  "Microsoft.AzureStack registration role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStack/registrations/customerSubscriptions/delete",
|                                                    "Microsoft.AzureStack/registrations/customerSubscriptions/write",
|                                                    "Microsoft.AzureStack/registrations/delete",
|                                                    "Microsoft.AzureStack/registrations/enableRemoteManagement/action",
|                                                    "Microsoft.AzureStack/registrations/getActivationKey/action",
|                                                    "Microsoft.AzureStack/registrations/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "17e4de9d-139f-4531-b521-20804c310cf8",
|                                    "Name":  "Azure Stack Hub Linked Subscriptions role",
|                                    "Description":  "Microsoft.AzureStack Linked Subscriptions role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStack/linkedSubscriptions/delete",
|                                                    "Microsoft.AzureStack/linkedSubscriptions/linkedProviders/action",
|                                                    "Microsoft.AzureStack/linkedSubscriptions/linkedResourceGroups/action",
|                                                    "Microsoft.AzureStack/linkedSubscriptions/operations/action",
|                                                    "Microsoft.AzureStack/linkedSubscriptions/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d2acaa63-2a62-4c01-998a-cdbe7a00d709",
|                                    "Name":  "Defender Azure Cosmos DB",
|                                    "Description":  "Microsoft Defender for Azure Cosmos DB role. Grant permissions for enablement.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDB/databaseAccounts/read",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "99626c15-0799-47ad-96ab-f298031f69d6",
|                                    "Name":  "Defender Open Source Relational Databases",
|                                    "Description":  "Microsoft Defender for Open Source Relational Databases role. Grant permissions for enablement.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DBforMySQL/flexibleServers/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.DBforMySQL/flexibleServers/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.DBforMySQL/flexibleServers/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/advancedThreatProtectionSettings/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d9468a2b-1820-47e1-a40e-d2b7fba1879a",
|                                    "Name":  "Defender SQL Servers On Machines",
|                                    "Description":  "Microsoft Defender for SQL Servers On Machines role. Grant permissions for enablement.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/write",
|                                                    "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a366d631-94bf-46bf-b4af-b38f28c80774",
|                                    "Name":  "Defender for Storage Threat Protection",
|                                    "Description":  "Microsoft Defender for Storage Threat Protection role - grants the permissions needed to enable/disable Defender for Storage Advanced Threat Protection at resource level.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Security/defenderForStorageSettings/read",
|                                                    "Microsoft.Security/defenderForStorageSettings/write",
|                                                    "Microsoft.Storage/storageAccounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e1663658-d5f7-4383-9afb-af9fdc9c5eae",
|                                    "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Reader for Member Clusters",
|                                    "Description":  "Allows read-only access to view Kubernetes custom resources on Azure Kubernetes Fleet Manager member clusters. This role enables viewing custom resources without the ability to create, modify, or delete them. Applying this role at cluster scope will give read access to custom resources across all namespaces. More information on supported attributes for Attribute-Based Access Control (ABAC) conditions can be found under documentation at aka.ms/aks/abac/custom-resources/docs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/members/customresources/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "673366d4-9664-4020-b03b-b0093366bff9",
|                                    "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Writer for Member Clusters",
|                                    "Description":  "Allows write and delete access to manage Kubernetes custom resources on Azure Kubernetes Fleet Manager member clusters. This role enables creating, modifying, and deleting custom resources. Applying this role at cluster scope will give access to custom resources across all namespaces. More information on supported attributes for Attribute-Based Access Control (ABAC) conditions can be found under documentation at aka.ms/aks/abac/custom-resources/docs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/members/customresources/write",
|                                                        "Microsoft.ContainerService/fleets/members/customresources/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f82fbe13-0f98-4809-af81-b82c343db82f",
|                                    "Name":  "Device Update Contributor",
|                                    "Description":  "Gives you full access to manage Device Update accounts, instances, and private endpoint connections",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.DeviceUpdate/accounts/read",
|                                                    "Microsoft.DeviceUpdate/accounts/write",
|                                                    "Microsoft.DeviceUpdate/accounts/delete",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/read",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/write",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/delete",
|                                                    "Microsoft.DeviceUpdate/accounts/privateEndpointConnections/read",
|                                                    "Microsoft.DeviceUpdate/accounts/privateEndpointConnections/write",
|                                                    "Microsoft.DeviceUpdate/accounts/privateEndpointConnections/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "20cf746c-c765-402a-885e-c389c64478ce",
|                                    "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Reader",
|                                    "Description":  "Allows read-only access to view Kubernetes custom resources on Azure Kubernetes Fleet Manager fleets. This role enables viewing custom resources without the ability to create, modify, or delete them. Applying this role at cluster scope will give read access to custom resources across all namespaces. More information on supported attributes for Attribute-Based Access Control (ABAC) conditions can be found under documentation at aka.ms/aks/abac/custom-resources/docs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/customresources/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ff8eb232-5069-437e-94e5-31112ef30539",
|                                    "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Writer",
|                                    "Description":  "Allows write and delete access to manage Kubernetes custom resources on Azure Kubernetes Fleet Manager fleets. This role enables creating, modifying, and deleting custom resources. Applying this role at cluster scope will give access to custom resources across all namespaces. More information on supported attributes for Attribute-Based Access Control (ABAC) conditions can be found under documentation at aka.ms/aks/abac/custom-resources/docs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/customresources/write",
|                                                        "Microsoft.ContainerService/fleets/customresources/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "78b19ac9-582c-44d8-9e11-733ae424ad83",
|                                    "Name":  "Defender Servers P1",
|                                    "Description":  "Defender Servers P1",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ef3729d8-2861-401e-95ae-c7d4845a6097",
|                                    "Name":  "Genome Admin",
|                                    "Description":  "Full access to Genome control plane operations only",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Genome/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1dc24dd8-b00e-4344-837c-58b193cd23c7",
|                                    "Name":  "Defender Servers P2",
|                                    "Description":  "Defender Servers P2",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/write",
|                                                    "Microsoft.Network/azureFirewalls/read",
|                                                    "Microsoft.Network/azureFirewalls/write",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/routeTables/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "585db2ed-219e-4821-a06a-c6c14b602afa",
|                                    "Name":  "Healthcare Interop Contributor",
|                                    "Description":  "Allows all actions on healthcare interop provider resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HealthcareInterop/ddmsConnectors/delete",
|                                                    "Microsoft.HealthcareInterop/ddmsConnectors/write",
|                                                    "Microsoft.HealthcareInterop/ddmsFhirEventBatchChannels/delete",
|                                                    "Microsoft.HealthcareInterop/ddmsFhirEventBatchChannels/write",
|                                                    "Microsoft.HealthcareInterop/ddmsFhirFlatFileBatchChannels/delete",
|                                                    "Microsoft.HealthcareInterop/ddmsFhirFlatFileBatchChannels/write",
|                                                    "Microsoft.HealthcareInterop/dicomConnectors/delete",
|                                                    "Microsoft.HealthcareInterop/dicomConnectors/write",
|                                                    "Microsoft.HealthcareInterop/dicomDirectChannels/delete",
|                                                    "Microsoft.HealthcareInterop/dicomDirectChannels/write",
|                                                    "Microsoft.HealthcareInterop/dicomEdgeConnectors/delete",
|                                                    "Microsoft.HealthcareInterop/dicomEdgeConnectors/write",
|                                                    "Microsoft.HealthcareInterop/fhirQueryEventBatchChannels/delete",
|                                                    "Microsoft.HealthcareInterop/fhirQueryEventBatchChannels/write",
|                                                    "Microsoft.HealthcareInterop/fhirQueryFlatFileBatchChannels/delete",
|                                                    "Microsoft.HealthcareInterop/fhirQueryFlatFileBatchChannels/write",
|                                                    "Microsoft.HealthcareInterop/hl7Connectors/delete",
|                                                    "Microsoft.HealthcareInterop/hl7Connectors/write",
|                                                    "Microsoft.HealthcareInterop/hl7EdgeConnectors/delete",
|                                                    "Microsoft.HealthcareInterop/hl7EdgeConnectors/write",
|                                                    "Microsoft.HealthcareInterop/hubs/delete",
|                                                    "Microsoft.HealthcareInterop/hubs/write",
|                                                    "Microsoft.HealthcareInterop/locations/operationStatuses/write",
|                                                    "Microsoft.HealthcareInterop/oneLakeConnectors/delete",
|                                                    "Microsoft.HealthcareInterop/oneLakeConnectors/write",
|                                                    "Microsoft.HealthcareInterop/storageAccountConnectors/delete",
|                                                    "Microsoft.HealthcareInterop/storageAccountConnectors/write",
|                                                    "Microsoft.HealthcareInterop/locations/operationStatuses/read",
|                                                    "Microsoft.HealthcareInterop/operations/read",
|                                                    "Microsoft.HealthcareInterop/hl7Connectors/read",
|                                                    "Microsoft.HealthcareInterop/oneLakeConnectors/read",
|                                                    "Microsoft.HealthcareInterop/storageAccountConnectors/read",
|                                                    "Microsoft.HealthcareInterop/fhirQueryFlatFileBatchChannels/read",
|                                                    "Microsoft.HealthcareInterop/fhirQueryEventBatchChannels/read",
|                                                    "Microsoft.HealthcareInterop/hl7EdgeConnectors/read",
|                                                    "Microsoft.HealthcareInterop/hubs/read",
|                                                    "Microsoft.HealthcareInterop/dicomEdgeConnectors/read",
|                                                    "Microsoft.HealthcareInterop/dicomConnectors/read",
|                                                    "Microsoft.HealthcareInterop/dicomDirectChannels/read",
|                                                    "Microsoft.HealthcareInterop/ddmsFhirEventBatchChannels/read",
|                                                    "Microsoft.HealthcareInterop/ddmsConnectors/read",
|                                                    "Microsoft.HealthcareInterop/ddmsFhirFlatFileBatchChannels/read",
|                                                    "Microsoft.HealthcareInterop/register/action",
|                                                    "Microsoft.HealthcareInterop/unregister/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fc896ebc-f9a8-484d-a5ff-bd6a8c36289f",
|                                    "Name":  "Cosmos DB Long Term Retention Backup Role",
|                                    "Description":  "Allows performing long term retention backup operations for Cosmos DB",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDB/databaseAccounts/validateForLongTermProtection/action",
|                                                    "Microsoft.DocumentDB/databaseAccounts/enableLongTermProtection/action",
|                                                    "Microsoft.DocumentDB/databaseAccounts/disableLongTermProtection/action",
|                                                    "Microsoft.DocumentDB/databaseAccounts/preBackup/action",
|                                                    "Microsoft.DocumentDB/databaseAccounts/backup/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "955d0cb2-de4e-43ed-819a-14220e079ba7",
|                                    "Name":  "Cosmos DB Long Term Retention Restore Role",
|                                    "Description":  "Allows performing long term retention restore operations for Cosmos DB",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDB/databaseAccounts/preRestore/action",
|                                                    "Microsoft.DocumentDB/databaseAccounts/restore/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "78739afa-3ece-4d6b-90ba-762fdccd7438",
|                                    "Name":  "Azure Edge On-Site Deployment Manager",
|                                    "Description":  "Grants you access to take actions as an on-site person to assist in the provisioning of an edge device",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/EdgeMachines/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6fe711ec-654d-4ef7-8e32-eb7de3d94774",
|                                    "Name":  "Defender AI",
|                                    "Description":  "Service role that provides permissions for Microsoft Defender for AI",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/accounts/read",
|                                                    "Microsoft.CognitiveServices/accounts/defenderForAISettings/read",
|                                                    "Microsoft.CognitiveServices/accounts/defenderForAISettings/write",
|                                                    "Microsoft.CognitiveServices/accounts/defenderForAISettings/delete",
|                                                    "Microsoft.CognitiveServices/raiPolicy/read",
|                                                    "Microsoft.CognitiveServices/raiPolicy/write",
|                                                    "Microsoft.Search/searchServices/knowledgeBases/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "12675fd7-7f59-493f-9201-f7944860a2f1",
|                                    "Name":  "Azure Device Registry Administrator",
|                                    "Description":  "Azure Device Registry Administrator",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DeviceRegistry/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cd50fd1f-0421-46f2-8cce-afc587dbcc77",
|                                    "Name":  "Defender Storage Malware Data Scanner",
|                                    "Description":  "Grants data plane permissions for Microsoft Defender for Storage scanning operations — blob/file read, index tag updates.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                        "Microsoft.EventGrid/events/send/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d622af9a-030e-4f32-8267-419abfd54702",
|                                    "Name":  "Pro Active Coding Data User",
|                                    "Description":  "Allows processing of health data in Pro Active Coding",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthBot/healthBots/AIActions/ProActiveCoding/Process/Action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "eef9d654-743f-4e2c-ad0f-9ed243177663",
|                                    "Name":  "Defender Azure SQL Databases",
|                                    "Description":  "Microsoft Defender for Azure SQL Databases role. Grant permissions for enablement.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sql/managedInstances/read",
|                                                    "Microsoft.Sql/managedInstances/securityAlertPolicies/read",
|                                                    "Microsoft.Sql/managedInstances/securityAlertPolicies/write",
|                                                    "Microsoft.Sql/servers/read",
|                                                    "Microsoft.Sql/servers/securityAlertPolicies/read",
|                                                    "Microsoft.Sql/servers/securityAlertPolicies/write",
|                                                    "Microsoft.Sql/servers/sqlVulnerabilityAssessments/read",
|                                                    "Microsoft.Sql/servers/sqlVulnerabilityAssessments/write",
|                                                    "Microsoft.Synapse/workspaces/read",
|                                                    "Microsoft.Synapse/workspaces/securityAlertPolicies/read",
|                                                    "Microsoft.Synapse/workspaces/securityAlertPolicies/write",
|                                                    "Microsoft.Sql/servers/vulnerabilityAssessments/read",
|                                                    "Microsoft.Synapse/workspaces/vulnerabilityAssessments/read",
|                                                    "Microsoft.Sql/managedInstances/vulnerabilityAssessments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "971cce9f-2680-4357-9678-c947847a9425",
|                                    "Name":  "Defender Storage Malware Operator",
|                                    "Description":  "Grants permissions for Microsoft Defender for Storage malware scanning operations including blob/file read, index tag updates, EventGrid management, and network bypass.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Security/defenderforstoragesettings/read",
|                                                    "Microsoft.Security/defenderforstoragesettings/write",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Security/securityOperators/read",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.EventGrid/topics/read",
|                                                    "Microsoft.EventGrid/register/action",
|                                                    "Microsoft.EventGrid/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/write",
|                                                    "Microsoft.EventGrid/eventSubscriptions/delete",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c6c9b2d8-9a5e-4122-85e1-81612a046ab2",
|                                    "Name":  "Defender Storage Automated Malware Remediation",
|                                    "Description":  "Grants additional permissions for Microsoft Defender for Storage automated remediation operations including soft-delete management and blob deletion.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4f1e6fca-3fde-4291-961e-642def6d5e1d",
|                                    "Name":  "Confidential Ledger Data Reader",
|                                    "Description":  "Allows read access to Confidential Ledger transactions, including reading entries, receipts, and transaction status.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ConfidentialLedger/ledgers/transactions/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f1641a58-a144-402b-baf9-39d1a4c10119",
|                                    "Name":  "Confidential Ledger Data Contributor",
|                                    "Description":  "Allows read and write access to Confidential Ledger transactions, including reading entries, receipts, and transaction status, and creating new ledger entries.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ConfidentialLedger/ledgers/transactions/read",
|                                                        "Microsoft.ConfidentialLedger/ledgers/transactions/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8ec773c5-7ce6-4b78-91d1-182f8faa536d",
|                                    "Name":  "Microsoft Discovery Bookshelf Index Data Reader - Preview",
|                                    "Description":  "Grants query access to search and retrieve data from Microsoft Discovery Bookshelf knowledge bases. This is the minimum role required to use the retrieve action when linking a knowledge base to an agent. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Discovery/bookshelf/knowledgeBaseVersions/query/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "63342533-d951-495d-a3c3-a459aa02362b",
|                                    "Name":  "Oracle Database DbSystems Administrator",
|                                    "Description":  "Grants full access to manage DbSystems resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/dbSystems/*/read",
|                                                    "Oracle.Database/dbSystems/*/write",
|                                                    "Oracle.Database/dbSystems/*/delete",
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Locations/*/write",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/resourceAnchors/*",
|                                                    "Oracle.Database/networkAnchors/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Compute/sshPublicKeys/read",
|                                                    "Microsoft.Compute/sshPublicKeys/write",
|                                                    "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f287ba2f-f923-4464-a5bd-721c3951d32d",
|                                    "Name":  "Azure Managed Redis Reader",
|                                    "Description":  "Lets you view Azure Managed Redis resources, but not modify them or access keys or access to the data stored in them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cache/locations/operationsStatus/read",
|                                                    "Microsoft.Cache/operations/read",
|                                                    "Microsoft.Cache/redisEnterprise/read",
|                                                    "Microsoft.Cache/redisEnterprise/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3015e5ed-6856-4ab3-b2f0-b8492aa30ca6",
|                                    "Name":  "Azure Managed Redis Contributor",
|                                    "Description":  "Lets you manage Azure Managed Redis resources, but not access the data stored in them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cache/locations/operationsStatus/read",
|                                                    "Microsoft.Cache/locations/checknameavailability/action",
|                                                    "Microsoft.Cache/operations/read",
|                                                    "Microsoft.Cache/redisEnterprise/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c24cf47c-5077-412d-a19c-45202126392c",
|                                    "Name":  "Dev Compute SandboxGroup Data Owner",
|                                    "Description":  "Ownership of all SandboxGroup data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/sandboxGroups/*/read",
|                                                        "Microsoft.App/sandboxGroups/*/write",
|                                                        "Microsoft.App/sandboxGroups/*/delete",
|                                                        "Microsoft.App/sandboxGroups/*/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4417a88f-3e58-4cf2-a4e9-112cf414254c",
|                                    "Name":  "Services Hub User",
|                                    "Description":  "Services Hub User allows you to perform all read, write, and deletion operations related to Services Hub Connectors except create/delete connector and managing law.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.ServicesHub/connectors/read",
|                                                    "Microsoft.ServicesHub/connectors/*",
|                                                    "Microsoft.ServicesHub/*",
|                                                    "Microsoft.ServicesHub/workspaces/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.ServicesHub/connectors/write",
|                                                       "Microsoft.ServicesHub/connectors/delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0e91b552-ae32-49ea-9898-317af306aa4b",
|                                    "Name":  "Genome EndUser",
|                                    "Description":  "Full access to Genome data plane operations only",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Genome/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "64375caa-ac3e-48b3-9492-da4d60aba7bb",
|                                    "Name":  "Diagnostics Operator",
|                                    "Description":  "Role allows users to collect diagnostic information regarding their Virtual Machine",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/virtualMachines/DiagnosticRunCommands/write",
|                                                    "Microsoft.Compute/virtualMachines/DiagnosticRunCommands/read",
|                                                    "Microsoft.Compute/virtualMachines/DiagnosticRunCommands/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b66c1f7c-c685-40d6-b8b8-64b8230febf4",
|                                    "Name":  "Azure Resilience Management Usage Administrator",
|                                    "Description":  "Administrator Role of Azure Resilience Management Usage",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b130f7de-5374-4e3d-ada8-bae6e49114b9",
|                                    "Name":  "Azure Resilience Management Usage Reader",
|                                    "Description":  "Reader Role of Azure Resilience Management Usage",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5ca51376-e049-4302-abcc-64c588049c59",
|                                    "Name":  "Azure Resilience Management Usage Contributor",
|                                    "Description":  "Contributor Role of Azure Resilience Management Usage",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                }
|                            ],
|    "Summary":  {
|                    "AD_Groups":  {
|                                      "Tier0":  9,
|                                      "Tier1":  6,
|                                      "Tier2":  3,
|                                      "Tier3":  51,
|                                      "Untiered":  0,
|                                      "TotalGroups":  69
|                                  },
|                    "EntraRoles":  {
|                                       "Tier0":  5,
|                                       "Tier1":  23,
|                                       "Tier2":  20,
|                                       "Tier3":  96,
|                                       "Untiered":  0,
|                                       "TotalRoles":  144
|                                   },
|                    "APIPermissions":  {
|                                           "Tier0":  2,
|                                           "Tier1":  59,
|                                           "Tier2":  138,
|                                           "Tier3":  1027,
|                                           "Untiered":  0,
|                                           "TotalPermissions":  1226
|                                       },
|                    "AzureRoles":  {
|                                       "Tier0":  3,
|                                       "Tier1":  14,
|                                       "Tier2":  130,
|                                       "Tier3":  726,
|                                       "Untiered":  0,
|                                       "TotalRoles":  873
|                                   }
|                }
|}
'@ }
$__siSupportFiles['engine/data-model/SI-RecommendationExclusions.ps1'] = @{ Sha256 = 'af1e5fbd97fde86610b1cc7cf2a5bc1238944de2e02d5440d0d0dd618af9f05f'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- KNOWN FALSE POSITIVES OF A PROVIDER'S RECOMMENDATION (#546 (5)).
|
|    A Microsoft-sourced recommendation that is wrong in a stated situation (the customer case: a password recommendation
|    for accounts whose password lives in Active Directory) is suppressed by a DEFAULT RULE in the data model, with its
|    reason -- never by disabling the report, never by a hand-made exclusion list.
|
|    TEMPLATE  data-model/recommendation-exclusions.locked.json (kind 'recommendation-exclusion', items 'rules'):
|                { "id": "<rule id>",
|                  "configurationIds": [ "<the Risk Analysis row's ConfigurationId>", ... ],   (one or more, exact, case-insensitive)
|                  "reports": [ "<ReportName>", ... ],                                         (optional; none = every report)
|                  "when": { <condition over the finding's CI, SI fields only> },               (SI-Conditions.ps1 language)
|                  "reason": "<why the recommendation is wrong in that situation>",             (required -- it is logged)
|                  "reference": "<the provider's documentation>",                              (optional)
|                  "stage": "production" | "testing" | "not_used" }                            (default production)
|    CUSTOMER  Pro: one cfg.ItemOverride row per rule ('recommendation-exclusions:<id>' -- override, disable or add);
|              Community: data-model/recommendation-exclusions.custom.json, the same shape, only the rules that differ.
|              Both through the data-model merge (Get-SIDataModelTemplate).
|    APPLIED   Risk Analysis, after each row is tied to its CI (RA-RecommendationExclusions.ps1): a row whose ConfigurationId
|              a production rule names, in a report the rule covers, whose CI meets the rule's condition, is left out and
|              counted per rule (with the reason) in the run log. A row without a known CI is never suppressed: an
|              exclusion that cannot be checked must not hide a finding.
|
|    PURE except Get-SIRecommendationExclusions (reads the template). PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Test-SICondition -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|
|function Test-SIRecommendationExclusionRule {
|    <# PURE. The reasons one rule is not accepted (empty = accepted). #>
|    param($Rule)
|    $why = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Rule) { $why.Add('a rule is empty'); return $why.ToArray() }
|    $id = [string](Get-SIItemValue $Rule 'id')
|    if ($id -notmatch '^[a-z0-9][a-z0-9_\-\.]{0,99}$') { $why.Add(("rule id '{0}': lower-case letters, digits, - _ . (at most 100)" -f $id)) }
|    $ids = @(@(Get-SIItemValue $Rule 'configurationIds') | Where-Object { $_ -and ([string]$_).Trim() })
|    if ($ids.Count -eq 0) { $why.Add(("rule '{0}': configurationIds names at least one recommendation id" -f $id)) }
|    if (-not ([string](Get-SIItemValue $Rule 'reason')).Trim()) { $why.Add(("rule '{0}': a reason is required -- it is what the run log says" -f $id)) }
|    $st = [string](Get-SIItemValue $Rule 'stage')
|    if ($st -and $st -notin 'production', 'testing', 'not_used') { $why.Add(("rule '{0}': stage '{1}' (production | testing | not_used)" -f $id, $st)) }
|    $when = Get-SIItemValue $Rule 'when'
|    if ($null -eq $when) { $why.Add(("rule '{0}': a condition (when) is required -- a rule states the situation it holds in" -f $id)) }
|    else {
|        $ops = Get-SIConditionOps
|        foreach ($leafField in (Get-SIConditionFields $when)) {
|            if ($leafField -notmatch '^si_[a-z0-9_]+$') { $why.Add(("rule '{0}': reads '{1}' -- a rule reads SI fields (si_*) only" -f $id, $leafField)) }
|        }
|        $stack = New-Object System.Collections.Generic.Stack[object]; $stack.Push($when)
|        while ($stack.Count -gt 0) {
|            $c = $stack.Pop()
|            $isGroup = $false
|            foreach ($k in 'all', 'any') {
|                $has = ($c -is [System.Collections.IDictionary] -and $c.Contains($k)) -or ($null -ne $c -and $c.PSObject.Properties[$k])
|                if ($has) { $isGroup = $true; foreach ($x in (Get-SIValueList (Get-SIItemValue $c $k))) { $stack.Push($x) } }
|            }
|            if (-not $isGroup) { $op = [string](Get-SIItemValue $c 'op'); if ($ops -notcontains $op) { $why.Add(("rule '{0}': unknown condition operation '{1}'" -f $id, $op)) } }
|        }
|    }
|    $why.ToArray()
|}
|
|function Test-SIRecommendationExclusions {
|    <# PURE. Every rule valid, every id once. Returns the problems. #>
|    param($Document)
|    $why = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Document) { return $why.ToArray() }
|    $ids = @{}
|    foreach ($r in @(Get-SIItemValue $Document 'rules')) {
|        if ($null -eq $r) { continue }
|        foreach ($x in (Test-SIRecommendationExclusionRule -Rule $r)) { $why.Add([string]$x) }
|        $rid = [string](Get-SIItemValue $r 'id')
|        if ($ids.ContainsKey($rid)) { $why.Add(("recommendation-exclusions: rule '{0}' is defined twice" -f $rid)) }; $ids[$rid] = 1
|    }
|    $why.ToArray()
|}
|
|function ConvertTo-SIRecommendationExclusionIndex {
|    <#
|        PURE. The merged template -> lower-case ConfigurationId -> [ @{ Id; Reports (lower-case, empty = every); When; Reason } ].
|        Only valid production rules (no stage = production).
|    #>
|    param($Document)
|    $idx = New-Object System.Collections.Hashtable ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($r in @(Get-SIItemValue $Document 'rules')) {
|        if ($null -eq $r) { continue }
|        $st = [string](Get-SIItemValue $r 'stage'); if ($st -and $st -ne 'production') { continue }
|        if (@(Test-SIRecommendationExclusionRule -Rule $r).Count -gt 0) { continue }
|        $e = @{ Id = [string](Get-SIItemValue $r 'id'); When = (Get-SIItemValue $r 'when'); Reason = ([string](Get-SIItemValue $r 'reason')).Trim()
|            Reports = @(@(Get-SIItemValue $r 'reports') | Where-Object { $_ } | ForEach-Object { ([string]$_).Trim() }) }
|        foreach ($cid in @(Get-SIItemValue $r 'configurationIds')) {
|            $k = ([string]$cid).Trim(); if (-not $k) { continue }
|            if (-not $idx.ContainsKey($k)) { $idx[$k] = New-Object System.Collections.Generic.List[object] }
|            $idx[$k].Add($e)
|        }
|    }
|    foreach ($k in @($idx.Keys)) { $idx[$k] = $idx[$k].ToArray() }
|    $idx
|}
|
|function Find-SIRecommendationExclusion {
|    <#
|    .SYNOPSIS  PURE. The rule that suppresses one finding, or $null: a production rule naming its ConfigurationId, covering the
|               report, whose condition the finding's CI meets. No CI = never suppressed.
|    #>
|    param([hashtable]$Index, [AllowEmptyString()][string]$ConfigurationId, [AllowEmptyString()][string]$ReportName, $Ci, [hashtable]$Context)
|    if ($null -eq $Index -or $Index.Count -eq 0 -or -not $ConfigurationId -or $null -eq $Ci) { return $null }
|    $k = $ConfigurationId.Trim()
|    if (-not $Index.ContainsKey($k)) { return $null }
|    foreach ($e in @($Index[$k])) {
|        if (@($e.Reports).Count -gt 0 -and -not (@($e.Reports) | Where-Object { [string]::Equals($_, $ReportName, [StringComparison]::OrdinalIgnoreCase) })) { continue }
|        $ok = $false
|        try { $ok = [bool](Test-SICondition -Condition $e.When -Item $Ci -Context $Context) } catch { $ok = $false }
|        if ($ok) { return $e }
|    }
|    return $null
|}
|
|function Get-SIRecommendationExclusions {
|    <#
|        The merged template (shipped + the customer's) as an index; an empty index when there is none or it cannot be read
|        (nothing is suppressed -- never fails).
|    #>
|    param([string]$Root, [string]$OverlayRoot = $global:SI_DataModelOverlayRoot)
|    try {
|        if (-not (Get-Command -Name Get-SIDataModelTemplate -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-DataModelTemplates.ps1') }
|        $r = Get-SIDataModelRoot $Root
|        if (-not (Test-Path -LiteralPath (Join-Path $r 'recommendation-exclusions.locked.json'))) {
|            # Pro: an exported data model from before this template was published -- the shipped template (no override yet)
|            $shipped = Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'data-model'
|            if (-not (Test-Path -LiteralPath (Join-Path $shipped 'recommendation-exclusions.locked.json'))) { return @{} }
|            $r = $shipped
|        }
|        $t = Get-SIDataModelTemplate -Name 'recommendation-exclusions' -Root $r -OverlayRoot $OverlayRoot
|        foreach ($p in (Test-SIRecommendationExclusions -Document $t.Document)) { Write-Warning ("recommendation exclusions: {0} -- that rule is not applied" -f $p) }
|        return (ConvertTo-SIRecommendationExclusionIndex -Document $t.Document)
|    } catch {
|        Write-Warning ("recommendation exclusions could not be read -- {0}. No finding is suppressed by them." -f $_.Exception.Message)
|        return @{}
|    }
|}
'@ }
$__siSupportFiles['engine/data-model/SI-RecommendationEquivalence.ps1'] = @{ Sha256 = '31d3fa9c321121bf40ddbd61f3a77d1bc66e5a7f2d580c4262b6213f99ff3549'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE SAME RECOMMENDATION ACROSS PROVIDERS (#464, V3-DATA-MODEL 2.8.2 phase 2).
|
|    One recommendation reported by several providers (Defender for Endpoint and Defender for Cloud, Exposure Management,
|    ...) is ONE finding on the CI with every provider as evidence -- not one finding per provider.
|
|    TEMPLATE  data-model/recommendation-equivalence.locked.json (kind 'recommendation-equivalence', items 'groups'):
|                { "id": "<group id>", "canonicalId": "<the finding key the group is known by>", "canonicalTitle": "...",
|                  "stage": "production" | "testing" | "not_used",            (default production; only production merges)
|                  "members": [ { "provider": "mde", "id": "scid-..." }, { "provider": "mdc", "title": "..." } ] }
|              A member names the provider's recommendation id (the Risk Analysis row's ConfigurationId) or its exact title
|              (ConfigurationName, compared case-insensitively, spaces collapsed). An id or a title belongs to ONE group.
|              Keep the canonical id = the id the oldest provider already reports: its existing findings keep their key.
|    CUSTOMER  Pro: one cfg.ItemOverride row per group ('recommendation-equivalence:<id>' -- override, disable or add);
|              Community: data-model/recommendation-equivalence.custom.json, the same shape, only the groups that differ.
|              Both through the data-model merge (Get-SIDataModelTemplate), like every other data-model template.
|    APPLIED   Risk Analysis' finding keys (RA-Findings.ps1: the CI's finding key becomes the canonical id, the reports'
|              own keys are kept in si_finding_aliases and every report's key + severity in si_finding_evidence) and the
|              finding lifecycle (SI-DataCiLifecycle.ps1: an existing lifecycle row under an alias key is carried onto the
|              canonical key -- FirstDetected kept, never closed and reopened because the key changed).
|
|    #693 GENERALISED -- link two findings into one, for every finding type. A group has a "match" (default "key"):
|      key   (above) the same recommendation under each provider's id or title -- per row, any CI.
|      link  a MANUAL link an operator made on ONE owner (CI id, or asset:<id>): "owner", two or more "members" (finding
|            keys -- any provider, the same provider or report twice is allowed), "canonicalId" = the member that stays,
|            "linkedBy" + "reason" (+ "linkedAt") recorded. Unlink = stage "not_used" (the record stays: reversible, audited).
|            Per row, like key, so it reaches the database's finding key, the pager and the lifecycle unchanged.
|      fold  a MEANING rule over the generic SI finding fields AFTER mapping and value normalisation (never a provider's
|            raw column): "evidence" and "canonical" = conditions { field: si_*, pattern: <regex, named captures> | equals },
|            "on" = pairs { evidence: <si field or capture name>, canonical: <si field> } compared normalised (lower case,
|            spaces / underscores made one). On one CI, a finding matching "evidence" whose "on" values meet a finding
|            matching "canonical" is NOT a finding of its own: it is evidence on every such canonical finding (its key an
|            alias of the first, so its history carries over), its reports added to their si_detected_by. Applied to the
|            CI's findings (Merge-SIFindingFolds); the report rows themselves are never touched (no row is lost).
|    Only production groups apply; a shipped fold rule starts as "testing" until it is proven on an internal run.
|
|    PURE except Get-SIRecommendationEquivalence (reads the template). PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|function Get-SIEqMatch {
|    <# PURE. A group's match: key (default) | link | fold | the unknown value as given. #>
|    param($Group)
|    $m = ([string](Get-SIEqValue $Group 'match')).Trim().ToLowerInvariant()
|    if (-not $m) { return 'key' }
|    $m
|}
|
|function ConvertTo-SIFindingMatchValue {
|    <# PURE. A value as a link rule compares it: lower case, runs of spaces / underscores made one space, trimmed. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    if (-not $Value) { return '' }
|    (($Value.Trim().ToLowerInvariant()) -replace '[\s_]+', ' ').Trim()
|}
|
|function Test-SIFindingFoldCondition {
|    <# PURE. The reasons one fold condition is not accepted; adds its pattern's named captures to -Captures. #>
|    param($Condition, [string]$Group, [string]$Side, [System.Collections.Generic.List[string]]$Captures)
|    $why = New-Object System.Collections.Generic.List[string]
|    $f = [string](Get-SIEqValue $Condition 'field')
|    if ($f -notmatch '^si_[a-z0-9_]+$') { $why.Add(("group '{0}': a {1} condition's field '{2}' -- a generic SI field (si_...), never a provider column" -f $Group, $Side, $f)) }
|    $pat = Get-SIEqValue $Condition 'pattern'; $eqv = Get-SIEqValue $Condition 'equals'
|    if (($null -eq $pat) -eq ($null -eq $eqv)) { $why.Add(("group '{0}': a {1} condition on '{2}' has exactly one of pattern / equals" -f $Group, $Side, $f)) }
|    if ($null -ne $pat) {
|        try {
|            $rx = New-Object System.Text.RegularExpressions.Regex ([string]$pat), 'IgnoreCase'
|            if ($null -ne $Captures) { foreach ($n in $rx.GetGroupNames()) { if ($n -notmatch '^\d+$' -and -not $Captures.Contains($n)) { $Captures.Add($n) } } }
|        } catch { $why.Add(("group '{0}': the {1} pattern on '{2}' is not a valid regular expression" -f $Group, $Side, $f)) }
|    }
|    $why.ToArray()
|}
|
|function Get-SIRecommendationTitleKey {
|    <# PURE. A title as the equivalence compares it: lower case, spaces collapsed, trimmed. '' for none. #>
|    param([AllowNull()][AllowEmptyString()][string]$Title)
|    if (-not $Title) { return '' }
|    (($Title.Trim().ToLowerInvariant()) -replace '\s+', ' ')
|}
|
|function Get-SIEqValue {
|    <# PURE. A named value of a dictionary / object, or $null (this file stands alone: no other helper needed). #>
|    param($Item, [string]$Name)
|    if ($null -eq $Item) { return $null }
|    if ($Item -is [System.Collections.IDictionary]) { foreach ($k in $Item.Keys) { if ([string]$k -ieq $Name) { return $Item[$k] } }; return $null }
|    $p = $Item.PSObject.Properties[$Name]; if ($p) { return $p.Value }
|    $null
|}
|
|function Test-SIRecommendationEquivalenceGroup {
|    <# PURE. The reasons one group is not accepted (empty = accepted). #>
|    param($Group)
|    $why = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Group) { $why.Add('a group is empty'); return $why.ToArray() }
|    $id = [string](Get-SIEqValue $Group 'id')
|    if ($id -notmatch '^[a-z0-9][a-z0-9_\-\.]{0,99}$') { $why.Add(("group id '{0}': lower-case letters, digits, - _ . (at most 100)" -f $id)) }
|    $st = [string](Get-SIEqValue $Group 'stage')
|    $match = Get-SIEqMatch $Group
|    if ($match -notin 'key', 'link', 'fold') { $why.Add(("group '{0}': match '{1}' (key | link | fold)" -f $id, $match)); return $why.ToArray() }
|    if ($match -eq 'fold') {
|        # #693 a meaning rule: conditions on generic SI fields, joined on SI fields / captures
|        if ($st -and $st -notin 'production', 'testing', 'not_used') { $why.Add(("group '{0}': stage '{1}' (production | testing | not_used)" -f $id, $st)) }
|        $caps = New-Object System.Collections.Generic.List[string]
|        foreach ($side in 'evidence', 'canonical') {
|            $conds = @(Get-SIEqValue $Group $side) | Where-Object { $null -ne $_ }
|            if (@($conds).Count -lt 1) { $why.Add(("group '{0}': at least one {1} condition" -f $id, $side)) }
|            $c2 = $null; if ($side -eq 'evidence') { $c2 = $caps }
|            foreach ($c in @($conds)) { foreach ($x in (Test-SIFindingFoldCondition -Condition $c -Group $id -Side $side -Captures $c2)) { $why.Add([string]$x) } }
|        }
|        $on = @(Get-SIEqValue $Group 'on') | Where-Object { $null -ne $_ }
|        if (@($on).Count -lt 1) { $why.Add(("group '{0}': at least one 'on' pair -- what the two findings share" -f $id)) }
|        foreach ($p in @($on)) {
|            $e = [string](Get-SIEqValue $p 'evidence'); $c = [string](Get-SIEqValue $p 'canonical')
|            if ($e -notmatch '^si_[a-z0-9_]+$' -and -not $caps.Contains($e)) { $why.Add(("group '{0}': on.evidence '{1}' is an SI field or a named capture of an evidence pattern" -f $id, $e)) }
|            if ($c -notmatch '^si_[a-z0-9_]+$') { $why.Add(("group '{0}': on.canonical '{1}' is an SI field" -f $id, $c)) }
|        }
|        return $why.ToArray()
|    }
|    if ($match -eq 'link') {
|        # #693 (3) a manual link on one owner: who and why are recorded; unlink = stage not_used
|        if ($st -and $st -notin 'production', 'testing', 'not_used') { $why.Add(("group '{0}': stage '{1}' (production | testing | not_used)" -f $id, $st)) }
|        $own = ([string](Get-SIEqValue $Group 'owner')).Trim()
|        if (-not $own -or $own.Length -gt 400) { $why.Add(("group '{0}': owner is required -- the CI id (or asset:<id>) the two findings are on" -f $id)) }
|        foreach ($n in 'linkedBy', 'reason') { if (-not ([string](Get-SIEqValue $Group $n)).Trim()) { $why.Add(("group '{0}': {1} is required -- a link records who made it and why" -f $id, $n)) } }
|        $members = @(Get-SIEqValue $Group 'members') | Where-Object { $null -ne $_ }
|        $keys = @($members | ForEach-Object { ([string](Get-SIEqValue $_ 'id')).Trim() })
|        if (@($members).Count -lt 2) { $why.Add(("group '{0}': at least two members -- the findings linked into one" -f $id)) }
|        if (@($keys | Where-Object { -not $_ }).Count -gt 0) { $why.Add(("group '{0}': every member names its finding key (id)" -f $id)) }
|        $cid = ([string](Get-SIEqValue $Group 'canonicalId')).Trim()
|        if (-not $cid -or -not (@($keys | Where-Object { $_ -ieq $cid }).Count)) { $why.Add(("group '{0}': canonicalId is one of the members -- the finding that stays" -f $id)) }
|        return $why.ToArray()
|    }
|    $cid = [string](Get-SIEqValue $Group 'canonicalId')
|    if (-not $cid.Trim() -or $cid.Length -gt 256) { $why.Add(("group '{0}': canonicalId is required (at most 256 characters) -- the finding key the group is known by" -f $id)) }
|    if (-not ([string](Get-SIEqValue $Group 'canonicalTitle')).Trim()) { $why.Add(("group '{0}': canonicalTitle is required" -f $id)) }
|    if ($st -and $st -notin 'production', 'testing', 'not_used') { $why.Add(("group '{0}': stage '{1}' (production | testing | not_used)" -f $id, $st)) }
|    $members = @(Get-SIEqValue $Group 'members') | Where-Object { $null -ne $_ }
|    if (@($members).Count -lt 2) { $why.Add(("group '{0}': at least two members -- one recommendation from two or more providers" -f $id)) }
|    $providers = @{}
|    foreach ($m in @($members)) {
|        $p = [string](Get-SIEqValue $m 'provider'); $mi = [string](Get-SIEqValue $m 'id'); $mt = [string](Get-SIEqValue $m 'title')
|        if ($p -notmatch '^[a-z][a-z0-9_\-]{0,40}$') { $why.Add(("group '{0}': a member's provider '{1}' (lower-case name)" -f $id, $p)) }
|        if (-not $mi.Trim() -and -not $mt.Trim()) { $why.Add(("group '{0}': a member of {1} names neither an id nor a title" -f $id, $p)) }
|        if ($p) { $providers[$p] = 1 }
|    }
|    if (@($members).Count -ge 2 -and $providers.Count -lt 2) { $why.Add(("group '{0}': its members come from one provider -- the same recommendation across providers needs two" -f $id)) }
|    $why.ToArray()
|}
|
|function Test-SIRecommendationEquivalence {
|    <# PURE. Every group valid, every id / title in one group only. Returns the problems. #>
|    param($Document)
|    $why = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Document) { return $why.ToArray() }
|    $ids = @{}; $keys = @{}
|    foreach ($g in @(Get-SIEqValue $Document 'groups')) {
|        if ($null -eq $g) { continue }
|        foreach ($x in (Test-SIRecommendationEquivalenceGroup -Group $g)) { $why.Add([string]$x) }
|        $gid = [string](Get-SIEqValue $g 'id')
|        if ($ids.ContainsKey($gid)) { $why.Add(("recommendation-equivalence: group '{0}' is defined twice" -f $gid)) }; $ids[$gid] = 1
|        $gm = Get-SIEqMatch $g
|        if ($gm -eq 'fold') { continue }
|        if ($gm -eq 'link') {
|            # #693 a finding key on one owner is in one ACTIVE manual link (an unlinked one -- not_used -- is history)
|            if ([string](Get-SIEqValue $g 'stage') -in 'not_used', 'testing') { continue }
|            $own = ([string](Get-SIEqValue $g 'owner')).Trim().ToLowerInvariant()
|            foreach ($m in @(Get-SIEqValue $g 'members')) {
|                $k = 'link:' + $own + '|' + ([string](Get-SIEqValue $m 'id')).Trim().ToLowerInvariant()
|                if ($keys.ContainsKey($k) -and $keys[$k] -ne $gid) { $why.Add(("recommendation-equivalence: {0} is in link '{1}' and in link '{2}' -- a finding is linked once" -f $k, $keys[$k], $gid)) }
|                $keys[$k] = $gid
|            }
|            continue
|        }
|        foreach ($m in @(Get-SIEqValue $g 'members')) {
|            foreach ($k in @(('id:' + ([string](Get-SIEqValue $m 'id')).Trim().ToLowerInvariant()), ('title:' + (Get-SIRecommendationTitleKey ([string](Get-SIEqValue $m 'title')))))) {
|                if ($k -in 'id:', 'title:') { continue }
|                if ($keys.ContainsKey($k) -and $keys[$k] -ne $gid) { $why.Add(("recommendation-equivalence: {0} is in group '{1}' and in group '{2}' -- a recommendation belongs to one group" -f $k, $keys[$k], $gid)) }
|                $keys[$k] = $gid
|            }
|        }
|    }
|    $why.ToArray()
|}
|
|function ConvertTo-SIRecommendationEquivalenceIndex {
|    <#
|        PURE. The template (merged) -> @{ ById; ByTitle } (lower-case id / title key -> @{ Group; CanonicalId; CanonicalTitle }).
|        Only production groups (no stage = production) merge; testing and not_used groups are left out. A group that is not
|        valid is left out (the template check reports it).
|    #>
|    param($Document)
|    $byId = New-Object System.Collections.Hashtable ([StringComparer]::OrdinalIgnoreCase)
|    $byTitle = New-Object System.Collections.Hashtable ([StringComparer]::OrdinalIgnoreCase)
|    $byOwner = New-Object System.Collections.Hashtable ([StringComparer]::OrdinalIgnoreCase)   # #693 manual links: 'owner|key'
|    $folds = New-Object System.Collections.Generic.List[object]                                # #693 meaning rules
|    foreach ($g in @(Get-SIEqValue $Document 'groups')) {
|        if ($null -eq $g) { continue }
|        $st = [string](Get-SIEqValue $g 'stage'); if ($st -and $st -ne 'production') { continue }
|        if (@(Test-SIRecommendationEquivalenceGroup -Group $g).Count -gt 0) { continue }
|        $gm = Get-SIEqMatch $g
|        if ($gm -eq 'fold') {
|            $cv = { param($list) @(foreach ($c in @($list)) { if ($null -eq $c) { continue }
|                        $p = Get-SIEqValue $c 'pattern'
|                        @{ Field = [string](Get-SIEqValue $c 'field')
|                           Regex = $(if ($null -ne $p) { New-Object System.Text.RegularExpressions.Regex ([string]$p), 'IgnoreCase' } else { $null })
|                           EqualsValue = $(if ($null -eq $p) { ConvertTo-SIFindingMatchValue ([string](Get-SIEqValue $c 'equals')) } else { $null }) } }) }
|            $folds.Add(@{ Group = [string](Get-SIEqValue $g 'id'); Evidence = (& $cv (Get-SIEqValue $g 'evidence')); Canonical = (& $cv (Get-SIEqValue $g 'canonical'))
|                          On = @(foreach ($p in @(Get-SIEqValue $g 'on')) { if ($null -ne $p) { @{ Evidence = [string](Get-SIEqValue $p 'evidence'); Canonical = [string](Get-SIEqValue $p 'canonical') } } }) })
|            continue
|        }
|        if ($gm -eq 'link') {
|            $own = ([string](Get-SIEqValue $g 'owner')).Trim()
|            $e = @{ Group = [string](Get-SIEqValue $g 'id'); CanonicalId = ([string](Get-SIEqValue $g 'canonicalId')).Trim(); CanonicalTitle = ([string](Get-SIEqValue $g 'canonicalTitle')).Trim()
|                    Manual = $true; LinkedBy = [string](Get-SIEqValue $g 'linkedBy'); Reason = [string](Get-SIEqValue $g 'reason') }
|            foreach ($m in @(Get-SIEqValue $g 'members')) {
|                $k = $own + '|' + ([string](Get-SIEqValue $m 'id')).Trim()
|                if (-not $byOwner.ContainsKey($k)) { $byOwner[$k] = $e }
|            }
|            continue
|        }
|        $e = @{ Group = [string](Get-SIEqValue $g 'id'); CanonicalId = ([string](Get-SIEqValue $g 'canonicalId')).Trim(); CanonicalTitle = ([string](Get-SIEqValue $g 'canonicalTitle')).Trim() }
|        # the canonical id itself maps onto its group (a provider that already reports it)
|        if (-not $byId.ContainsKey($e.CanonicalId)) { $byId[$e.CanonicalId] = $e }
|        foreach ($m in @(Get-SIEqValue $g 'members')) {
|            $mi = ([string](Get-SIEqValue $m 'id')).Trim(); $mt = Get-SIRecommendationTitleKey ([string](Get-SIEqValue $m 'title'))
|            if ($mi -and -not $byId.ContainsKey($mi)) { $byId[$mi] = $e }
|            if ($mt -and -not $byTitle.ContainsKey($mt)) { $byTitle[$mt] = $e }
|        }
|    }
|    @{ ById = $byId; ByTitle = $byTitle; ByOwner = $byOwner; Folds = $folds.ToArray() }
|}
|
|function Resolve-SIRecommendationKey {
|    <#
|        PURE. A finding key + title -> its group entry (@{ Group; CanonicalId; CanonicalTitle }) or $null. The id wins over
|        the title. #693 -Owner (the CI id or asset:<id>): an operator's manual link on that owner wins over both.
|    #>
|    param($Index, [AllowEmptyString()][string]$Key, [AllowEmptyString()][AllowNull()][string]$Title, [AllowEmptyString()][AllowNull()][string]$Owner = '')
|    if ($null -eq $Index) { return $null }
|    if ($Owner -and $Key -and $Index.ByOwner -and $Index.ByOwner.Count -gt 0) {
|        $ok = $Owner + '|' + $Key.Trim()
|        if ($Index.ByOwner.ContainsKey($ok)) { return $Index.ByOwner[$ok] }
|    }
|    if ($Key -and $Index.ById.ContainsKey($Key.Trim())) { return $Index.ById[$Key.Trim()] }
|    $t = Get-SIRecommendationTitleKey $Title
|    if ($t -and $Index.ByTitle.ContainsKey($t)) { return $Index.ByTitle[$t] }
|    $null
|}
|
|function Get-SIFindingFieldValues {
|    <# PURE. A finding's generic SI field as a list of raw text values (an array field gives each element; '' left out). #>
|    param($Finding, [string]$Field)
|    $v = Get-SIEqValue $Finding $Field
|    if ($null -eq $v) { return @() }
|    $vals = if ($v -is [string]) { @($v) } elseif ($v -is [System.Collections.IEnumerable] -and -not ($v -is [System.Collections.IDictionary])) { @($v) } else { @([string]$v) }
|    @($vals | ForEach-Object { ([string]$_).Trim() } | Where-Object { $_ })
|}
|
|function Test-SIFindingFoldSide {
|    <#
|        PURE. Does a finding meet every condition of one side of a fold rule? Returns $null (no) or a hashtable of the
|        normalised named captures of its patterns (yes; empty when the side captures nothing).
|    #>
|    param($Finding, [object[]]$Conditions)
|    $caps = @{}
|    foreach ($c in @($Conditions)) {
|        $vals = @(Get-SIFindingFieldValues $Finding $c.Field)
|        $hit = $false
|        foreach ($v in $vals) {
|            if ($null -ne $c.Regex) {
|                $m = $c.Regex.Match($v)
|                if ($m.Success) {
|                    $hit = $true
|                    foreach ($n in $c.Regex.GetGroupNames()) { if ($n -notmatch '^\d+$' -and $m.Groups[$n].Success) { $caps[$n] = ConvertTo-SIFindingMatchValue $m.Groups[$n].Value } }
|                    break
|                }
|            } elseif ((ConvertTo-SIFindingMatchValue $v) -eq $c.EqualsValue) { $hit = $true; break }
|        }
|        if (-not $hit) { return $null }
|    }
|    $caps
|}
|
|function Merge-SIFindingFolds {
|    <#
|        PURE. #693 (7) / (8) -- the meaning rules (the index's Folds) over one batch of SI findings (ConvertTo-SIFindingRows'
|        output; every finding of a CI in the same batch). Per owner (si_ci_id, else asset:<si_asset_id>): a finding meeting
|        a rule's evidence side whose 'on' values meet a canonical-side finding (not itself) is folded -- it is no finding of
|        its own; on EVERY canonical it met: si_finding_evidence gains it (report, key, title, severity, rule) after the
|        canonical's own entry, si_detected_by gains its reports; on the FIRST canonical (by key) its key and its aliases are
|        aliases, so its lifecycle row carries over. A finding that received evidence is never folded itself (no chain). The
|        canonical's key, title, severity and exemption stay its own. Returns the findings left, in their order.
|    #>
|    param([AllowEmptyCollection()][object[]]$Findings = @(), [object[]]$Folds = @())
|    if (@($Folds).Count -eq 0 -or @($Findings).Count -lt 2) { return @($Findings) }
|    $byOwner = [ordered]@{}
|    for ($i = 0; $i -lt $Findings.Count; $i++) {
|        $f = $Findings[$i]; if ($null -eq $f) { continue }
|        $o = [string](Get-SIEqValue $f 'si_ci_id'); if (-not $o) { $o = 'asset:' + [string](Get-SIEqValue $f 'si_asset_id') }
|        if (-not $byOwner.Contains($o)) { $byOwner[$o] = New-Object System.Collections.Generic.List[int] }
|        $byOwner[$o].Add($i)
|    }
|    $folded = New-Object 'System.Collections.Generic.HashSet[int]'
|    $target = New-Object 'System.Collections.Generic.HashSet[int]'
|    $ev = { param($x) [ordered]@{ report = [string](Get-SIEqValue $x 'si_report_name'); key = [string](Get-SIEqValue $x 'si_finding_key'); title = [string](Get-SIEqValue $x 'si_title'); severity = [string](Get-SIEqValue $x 'si_severity') } }
|    foreach ($o in $byOwner.Keys) {
|        $ix = $byOwner[$o]; if ($ix.Count -lt 2) { continue }
|        foreach ($rule in @($Folds)) {
|            $canon = @(foreach ($i in $ix) { if ($folded.Contains($i)) { continue }; $c = Test-SIFindingFoldSide -Finding $Findings[$i] -Conditions $rule.Canonical; if ($null -ne $c) { $i } })
|            if ($canon.Count -eq 0) { continue }
|            $canon = @($canon | Sort-Object { [string](Get-SIEqValue $Findings[$_] 'si_finding_key') })
|            foreach ($i in $ix) {
|                if ($folded.Contains($i) -or $target.Contains($i)) { continue }
|                $caps = Test-SIFindingFoldSide -Finding $Findings[$i] -Conditions $rule.Evidence
|                if ($null -eq $caps) { continue }
|                $hits = @(foreach ($t in $canon) {
|                        if ($t -eq $i -or $folded.Contains($t)) { continue }
|                        $ok = $true
|                        foreach ($p in @($rule.On)) {
|                            $left = if ($caps.ContainsKey($p.Evidence)) { @($caps[$p.Evidence]) } else { @(Get-SIFindingFieldValues $Findings[$i] $p.Evidence | ForEach-Object { ConvertTo-SIFindingMatchValue $_ }) }
|                            $right = @(Get-SIFindingFieldValues $Findings[$t] $p.Canonical | ForEach-Object { ConvertTo-SIFindingMatchValue $_ })
|                            if (@($left | Where-Object { $_ -and $_ -in $right }).Count -eq 0) { $ok = $false; break }
|                        }
|                        if ($ok) { $t }
|                    })
|                if ($hits.Count -eq 0) { continue }
|                [void]$folded.Add($i)
|                $e = $Findings[$i]
|                $eEntry = & $ev $e; $eEntry['rule'] = $rule.Group
|                $first = $true
|                foreach ($t in $hits) {
|                    [void]$target.Add($t)
|                    $c = $Findings[$t]
|                    $list = New-Object System.Collections.Generic.List[object]
|                    $cur = @(Get-SIEqValue $c 'si_finding_evidence') | Where-Object { $null -ne $_ }
|                    if (@($cur).Count -eq 0) { $list.Add((& $ev $c)) } else { foreach ($x in $cur) { $list.Add($x) } }
|                    foreach ($x in @(Get-SIEqValue $e 'si_finding_evidence') | Where-Object { $null -ne $_ }) { if ([string](Get-SIEqValue $x 'key') -ne $eEntry.key) { $list.Add($x) } }
|                    $list.Add($eEntry)
|                    $c | Add-Member -NotePropertyName 'si_finding_evidence' -NotePropertyValue $list.ToArray() -Force
|                    $det = New-Object System.Collections.Generic.List[string]
|                    foreach ($d in @(Get-SIFindingFieldValues $c 'si_detected_by') + @(Get-SIFindingFieldValues $e 'si_detected_by')) { if (-not $det.Contains($d)) { $det.Add($d) } }
|                    $c | Add-Member -NotePropertyName 'si_detected_by' -NotePropertyValue $det.ToArray() -Force
|                    if ($first) {
|                        $al = New-Object System.Collections.Generic.List[string]
|                        foreach ($a in @(Get-SIFindingFieldValues $c 'si_finding_aliases') + @($eEntry.key) + @(Get-SIFindingFieldValues $e 'si_finding_aliases')) { if ($a -and $a -ne [string](Get-SIEqValue $c 'si_finding_key') -and -not $al.Contains($a)) { $al.Add($a) } }
|                        $c | Add-Member -NotePropertyName 'si_finding_aliases' -NotePropertyValue $al.ToArray() -Force
|                        $first = $false
|                    }
|                }
|            }
|        }
|    }
|    if ($folded.Count -eq 0) { return @($Findings) }
|    @(for ($i = 0; $i -lt $Findings.Count; $i++) { if (-not $folded.Contains($i)) { $Findings[$i] } })
|}
|
|function Get-SIRecommendationEquivalence {
|    <#
|        The merged template (shipped + the customer's: Pro's exported data model or Community's custom file) as an index;
|        $null when there is none or it cannot be read -- findings are then keyed as the providers report them (never fails).
|    #>
|    param([string]$Root, [string]$OverlayRoot = $global:SI_DataModelOverlayRoot)
|    try {
|        if (-not (Get-Command -Name Get-SIDataModelTemplate -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-DataModelTemplates.ps1') }
|        $r = Get-SIDataModelRoot $Root
|        if (-not (Test-Path -LiteralPath (Join-Path $r 'recommendation-equivalence.locked.json'))) {
|            # Pro: an exported data model from before this template was published -- the shipped template (no override yet)
|            $shipped = Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'data-model'
|            if (-not (Test-Path -LiteralPath (Join-Path $shipped 'recommendation-equivalence.locked.json'))) { return $null }
|            $r = $shipped
|        }
|        $t = Get-SIDataModelTemplate -Name 'recommendation-equivalence' -Root $r -OverlayRoot $OverlayRoot
|        foreach ($p in (Test-SIRecommendationEquivalence -Document $t.Document)) { Write-Warning ("recommendation equivalence: {0} -- that group is not applied" -f $p) }
|        return (ConvertTo-SIRecommendationEquivalenceIndex -Document $t.Document)
|    } catch {
|        Write-Warning ("recommendation equivalence could not be read -- {0}. Findings are keyed as each provider reports them." -f $_.Exception.Message)
|        return $null
|    }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-OutputScope.ps1'] = @{ Sha256 = 'f95b4d71161726e75ba82c3ea849bb3ab2f760d2dc5e6a7842514b9e2ff8a295'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight Pro -- OUTPUT SCOPE PER DESTINATION (#274).
|
|    Risk Analysis decides WHAT is found (each report's own severity / tier scope, the report templates). The output scope
|    decides what each DESTINATION receives of it:
|        excel             Risk Analysis's own read-time view: the workbook, the JSON sibling, the AI summary, the KPIs and
|                          the mail (the rows Select-RAReportRows keeps). Log Analytics always receives every row.
|        vuln-sql          the vulnerability close-loop's SQL connector(s)          (Invoke-SIVulnLoop.ps1, the plan step)
|        vuln-servicenow   the vulnerability close-loop's ServiceNow connector(s)   (Invoke-SIVulnLoop.ps1, the plan step)
|        cmdb-sql          the SQL CMDB connector -- an ASSET scope (tiers, asset kinds)
|        cmdb-servicenow   the ServiceNow CMDB connector (Invoke-SICmdb.ps1) and the ServiceNow CI output of the data-out
|                          connector -- an ASSET scope (tiers, asset kinds) plus, #1055, the CI rules 'include' / 'exclude'
|                          on the CI's asset type, OS family and class (Test-SIOutputScopeCiRules)
|
|    Where it comes from: the Pro settings database (cfg.ItemOverride, kind 'outputscope', one item per destination),
|    materialised by Export-SIProConfig into <run>\config\output-scope.json (SI_ProConfigRoot) with every named report
|    template already resolved to its reports. No file, or no entry for a destination = everything passes (today's
|    behaviour, unchanged).
|
|    THE RULE (one rule, the C# preview counts with the same one -- SI.Management.Core.ProData.OutputScope):
|      - an empty list = any value passes;
|      - a BLANK value on a row passes (as Risk Analysis's own scope filter keeps blanks -- IncludeBlank);
|      - severity compares by its key (case, spaces, '-' and '_' do not count; Critical = Very High, as #246);
|      - tier compares by number (0..3): a number, or a tier label ("High - tier 1");
|      - reports: the row passes when ANY of its report names is in the resolved report list.
|      - FILTERS (owner 2026-10-19, "define filters on one or more filters like risk rating"): 'filters' = { "<SI field>":
|        { "values": [...] } } -- risk rating, class, component, patch cycle, OS family, ServiceNow sub-CI, or any other SI
|        field of the finding (si_*). A row passes a filter when ANY of its values for the field is one of the values (case
|        does not count; OR within a filter); every filter must pass (AND across). A row WITHOUT a value for the field does
|        not pass a filter on it (owner: "we can NOT have a finding without a risk rating" -- such a row is raised as
|        "Classification incomplete", never hidden by a scope). The old lists (severities, tiers, domains) keep today's rule
|        -- a blank passes -- so no scope in force changes.
|
|    🔒 A SCOPE NEVER CLOSES ANYTHING AS FIXED. The CMDB connectors leave a CI that is out of scope exactly as it is. The
|    vulnerability connectors (#279 decision 3, operator 2026-10-04) close an open record whose finding left the scope
|    with the reason 'Out of scope' -- never Remediated, never counted by the close ceiling -- and reopen it when it comes
|    back: narrowing a scope can never read as "remediated" (#217, rule 4).
|
|    The SQL CMDB connector (Invoke-SICmdbSql.ps1) passes Get-SIOutputScope -Destination 'cmdb-sql' to its sync core, which
|    narrows BOTH sides of its plan (Select-SICmdbScopedPlanInput) -- it retires absent CIs, so a scope must never make a CI
|    read as absent. The ServiceNow CMDB connector has no link store yet (it never closes); it filters its asset list.
|
|    NO Set-StrictMode here -- it leaks into the caller's scope.
|#>
|
|$script:SIOutputScopeDestinations = [ordered]@{
|    'excel'           = @{ Asset = $false; Label = 'Excel + mail' }
|    'vuln-sql'        = @{ Asset = $false; Label = 'Vulnerability connector (SQL)' }
|    'vuln-servicenow' = @{ Asset = $false; Label = 'Vulnerability connector (ServiceNow)' }
|    'cmdb-sql'        = @{ Asset = $true;  Label = 'CMDB connector (SQL)' }
|    'cmdb-servicenow' = @{ Asset = $true;  Label = 'CMDB connector (ServiceNow)' }
|}
|$script:SIOutputScopeFile = 'output-scope.json'
|$script:SIOutputScopeSeverityKeys = @('veryhigh', 'high', 'mediumhigh', 'medium', 'low', 'informational')
|$script:SIOutputScopeDomains = @('Endpoint', 'Identity', 'Azure', 'PublicIP')
|# #817 (owner 2026-10-20: "i should see all asset kinds incl. public ip + identity ... dont limit options"): every kind
|# the data holds -- the C# twin is ReportVocabulary.AssetKinds
|$script:SIOutputScopeAssetKinds = @('endpoint', 'identity', 'azure', 'publicip')
|
|# The fields a scope filter offers by name (any other si_* field of the finding is accepted too): the columns a row
|# carries it under (first that has a value -- a Risk Analysis row names the risk rating RiskRating), its values when the
|# list is closed, and the default for a row without a value. The web app's twin: OutputScopeFilter.Fields (C#).
|$script:SIOutputScopeFilterFields = [ordered]@{
|    'si_risk_rating'      = @{ Label = 'Risk rating'; Columns = @('RiskRating', 'si_risk_rating'); Values = @('Critical', 'High', 'Moderate', 'Low') }
|    'si_category'         = @{ Label = 'Category'; Columns = @('si_category', 'Category'); Values = @() }
|    'si_subcategory'      = @{ Label = 'Subcategory'; Columns = @('si_subcategory', 'SubCategory', 'Subcategory'); Values = @() }
|    'si_class'            = @{ Label = 'Class'; Columns = @('si_class', 'AssetClass'); Values = @('device', 'identity', 'cloud_resource', 'public_ip') }
|    'si_component'        = @{ Label = 'Component'; Columns = @('si_component', 'Component'); Values = @('OS', 'SQL', 'Network', 'Hardware', 'Browser', 'Office', 'Application', 'Other') }
|    'si_patch_cycle'      = @{ Label = 'Patch cycle'; Columns = @('si_patch_cycle'); Values = @() }
|    'si_os_family'        = @{ Label = 'OS family'; Columns = @('si_os_family'); Values = @() }
|    'si_servicenow_subci' = @{ Label = 'ServiceNow sub-CI'; Columns = @('si_servicenow_subci'); Values = @() }
|}
|
|# #1055 (owner 2026-11-02: "we should NOT be syncing these assets [mobile phones] into snow"; "we need to be able to filter
|# on this in the snow connectors"): THE CI RULES of the ServiceNow CI output -- 'include' and 'exclude', each a list of
|# entries { "<CI field>": [values], ... }. An entry MATCHES a CI when, for EVERY field it names, the CI's value is one of
|# the entry's values (case does not count); a CI without a value for a field never matches an entry that names it. A CI
|# passes when no include entry is set or it matches ANY include entry, AND it matches NO exclude entry. Only the CI
|# destination of the ServiceNow data-out connector takes them (a vulnerable item whose CI they leave out is out of scope
|# too -- Invoke-SIDataOutContractPage). The web app's twin: CiRules (C#).
|$script:SIOutputScopeCiRuleDestinations = @('cmdb-servicenow')
|$script:SIOutputScopeCiRuleFields = [ordered]@{
|    'si_asset_type' = @{ Label = 'Asset type'; Values = @() }
|    'si_os_family'  = @{ Label = 'OS family'; Values = @() }
|    'si_class'      = @{ Label = 'Class'; Values = @('device', 'identity', 'cloud_resource', 'public_ip') }
|}
|$script:SIOutputScopeCiRuleMax = 25
|
|function Get-SIOutputScopeCiRuleFields { <# PURE. The CI fields a CI rule may name, in order (unrolled: @(Get-SIOutputScopeCiRuleFields) is the list). #> @($script:SIOutputScopeCiRuleFields.Keys) }
|
|function Test-SIOutputScopeCiRuleDestination {
|    <# PURE. Does a destination take CI rules (include / exclude)? #>
|    param([string]$Destination)
|    $script:SIOutputScopeCiRuleDestinations -contains [string]$Destination
|}
|
|function ConvertTo-SIOutputScopeCiRules {
|    <# PURE. An 'include' / 'exclude' list -> one entry per rule: @{ Fields = @( @{ Field; Values (lower) } ) } (a rule naming no value is dropped). #>
|    param($Rules)
|    if ($null -eq $Rules) { return }
|    foreach ($r in @($Rules)) {
|        if ($null -eq $r -or $r -is [string]) { continue }
|        $names = if ($r -is [System.Collections.IDictionary]) { @($r.Keys | ForEach-Object { [string]$_ }) } else { @($r.PSObject.Properties | ForEach-Object { $_.Name }) }
|        $fs = @(foreach ($n in @($names | Sort-Object)) {
|            $vals = @(Get-SIOutputScopeList $r $n | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() } | Where-Object { $_ })
|            if ($vals.Count) { [pscustomobject]@{ Field = $n; Values = $vals } }
|        })
|        if ($fs.Count) { [pscustomobject]@{ Fields = $fs } }
|    }
|}
|
|function Test-SIOutputScopeCiRuleMatch {
|    <# PURE. Does a CI (-Fields: field -> its value(s)) match ONE rule: every field the rule names holds one of its values? #>
|    param($Rule, [hashtable]$Fields)
|    foreach ($f in @($Rule.Fields)) {
|        $have = @()
|        if ($null -ne $Fields -and $Fields.ContainsKey($f.Field)) { $have = @(Get-SIOutputScopeNames $Fields[$f.Field] | ForEach-Object { $_.ToLowerInvariant() }) }
|        if ($have.Count -eq 0) { return $false }
|        $hit = $false
|        foreach ($h in $have) { if ($f.Values -contains $h) { $hit = $true; break } }
|        if (-not $hit) { return $false }
|    }
|    $true
|}
|
|function Test-SIOutputScopeCiRules {
|    <# PURE. Does a CI pass the scope's CI rules: any include rule (when there is one) and no exclude rule? No rules = it passes. #>
|    param($Scope, [hashtable]$Fields)
|    if ($null -eq $Scope) { return $true }
|    if ($Scope.PSObject.Properties['CiInclude'] -and @($Scope.CiInclude).Count) {
|        $in = $false
|        foreach ($r in @($Scope.CiInclude)) { if ($r -and (Test-SIOutputScopeCiRuleMatch -Rule $r -Fields $Fields)) { $in = $true; break } }
|        if (-not $in) { return $false }
|    }
|    if ($Scope.PSObject.Properties['CiExclude']) {
|        foreach ($r in @($Scope.CiExclude)) { if ($r -and (Test-SIOutputScopeCiRuleMatch -Rule $r -Fields $Fields)) { return $false } }
|    }
|    $true
|}
|
|function Get-SIOutputScopeCiRuleText {
|    <# PURE. One rule in words: "asset type Unknown + OS family ios, android". #>
|    param($Rule)
|    (@($Rule.Fields) | ForEach-Object {
|        $lbl = if ($script:SIOutputScopeCiRuleFields.Contains($_.Field)) { $script:SIOutputScopeCiRuleFields[$_.Field].Label.ToLowerInvariant() } else { $_.Field }
|        '{0} {1}' -f $lbl, (@($_.Values) -join ', ')
|    }) -join ' + '
|}
|
|function Test-SIOutputScopeCiRuleBody {
|    <# PURE. The reasons the 'include' / 'exclude' lists of a scope body are not accepted. #>
|    param([string]$Key, $Body)
|    $why = New-Object System.Collections.Generic.List[string]
|    foreach ($side in 'include', 'exclude') {
|        $list = Get-SIOutputScopeValue $Body $side
|        if ($null -eq $list) { continue }
|        if (-not (Test-SIOutputScopeCiRuleDestination -Destination $Key)) { $why.Add(("'{0}' is a CI rule of the ServiceNow CI output only (cmdb-servicenow), not of {1}" -f $side, $Key)); continue }
|        $rules = @($list)
|        if ($list -is [string] -or $list -is [System.Management.Automation.PSCustomObject] -or $list -is [System.Collections.IDictionary]) { $why.Add(("'{0}' must be a list of rules: [ {{ ""si_asset_type"": [""Mobile""] }} ]" -f $side)); continue }
|        if ($rules.Count -gt $script:SIOutputScopeCiRuleMax) { $why.Add(("{0}: at most {1} rules" -f $side, $script:SIOutputScopeCiRuleMax)) }
|        $i = 0
|        foreach ($r in $rules) {
|            $i++
|            if (-not ($r -is [System.Management.Automation.PSCustomObject] -or $r -is [System.Collections.IDictionary])) { $why.Add(("{0} rule {1}: a rule is an object {{ ""<CI field>"": [values] }}" -f $side, $i)); continue }
|            $names = if ($r -is [System.Collections.IDictionary]) { @($r.Keys | ForEach-Object { [string]$_ }) } else { @($r.PSObject.Properties | ForEach-Object { $_.Name }) }
|            if ($names.Count -eq 0) { $why.Add(("{0} rule {1} names no field" -f $side, $i)); continue }
|            foreach ($n in $names) {
|                if (-not $script:SIOutputScopeCiRuleFields.Contains($n)) { $why.Add(("{0} rule {1}: '{2}' is not a CI field a rule may name ({3})" -f $side, $i, $n, (@($script:SIOutputScopeCiRuleFields.Keys) -join ', '))); continue }
|                $raw = Get-SIOutputScopeValue $r $n
|                if ($null -eq $raw -or $raw -is [System.Management.Automation.PSCustomObject] -or $raw -is [System.Collections.IDictionary]) { $why.Add(("{0} rule {1}: '{2}' must be a list of values" -f $side, $i, $n)); continue }
|                $vals = @(Get-SIOutputScopeList $r $n)
|                if ($vals.Count -eq 0) { $why.Add(("{0} rule {1}: '{2}' names no value" -f $side, $i, $n)) }
|                foreach ($x in $vals) {
|                    $s = [string]$x
|                    if ($s.Length -gt 64 -or $s -match '[\r\n\t;]') { $why.Add(("{0} rule {1}: '{2}' is not a value of {3} (one line, at most 64 characters)" -f $side, $i, $s, $n)) }
|                }
|                $known = $script:SIOutputScopeCiRuleFields[$n]
|                if (@($known.Values).Count) {
|                    foreach ($x in $vals) { if (@($known.Values | Where-Object { $_ -ieq [string]$x }).Count -eq 0) { $why.Add(("{0} rule {1}: '{2}' is not a {3} ({4})" -f $side, $i, $x, $known.Label.ToLowerInvariant(), (@($known.Values) -join ', '))) } }
|                }
|            }
|        }
|    }
|    $why.ToArray()
|}
|
|function Get-SIOutputScopeFilterColumns {
|    <# PURE. The row columns a filter field is read from (a named field's list, else the field itself). #>
|    param([Parameter(Mandatory)][string]$Field)
|    if ($script:SIOutputScopeFilterFields.Contains($Field)) { return @($script:SIOutputScopeFilterFields[$Field].Columns) }
|    @($Field)
|}
|
|function Test-SIOutputScopeFilters {
|    <#
|        PURE. Does a row pass every filter of a scope? -Values: field -> the row's value(s) for it (a list, one value, or
|        nothing). OR within a filter, AND across filters; a row without a value does not pass.
|    #>
|    param($Scope, [hashtable]$Values)
|    if ($null -eq $Scope -or -not $Scope.PSObject.Properties['Filters']) { return $true }
|    foreach ($f in @($Scope.Filters)) {
|        if ($null -eq $f) { continue }
|        $have = @()
|        if ($null -ne $Values -and $Values.ContainsKey($f.Field)) { $have = @(Get-SIOutputScopeNames $Values[$f.Field] | ForEach-Object { $_.ToLowerInvariant() }) }
|        if ($have.Count -eq 0) { return $false }
|        $hit = $false
|        foreach ($h in $have) { if ($f.Values -contains $h) { $hit = $true; break } }
|        if (-not $hit) { return $false }
|    }
|    $true
|}
|
|function Get-SIOutputScopeRowFields {
|    <# PURE. A row's values for the scope's filter fields (each from the first of its columns that has a value). #>
|    param($Row, $Scope)
|    $h = @{}
|    if ($null -eq $Scope -or -not $Scope.PSObject.Properties['Filters']) { return $h }
|    foreach ($f in @($Scope.Filters)) {
|        $h[$f.Field] = Get-SIOutputScopeRowValue $Row @(Get-SIOutputScopeFilterColumns -Field $f.Field)
|    }
|    $h
|}
|
|function Get-SIOutputScopeDestinations { $script:SIOutputScopeDestinations }
|
|function ConvertTo-SISeverityKey {
|    <# PURE. A severity's comparison key: lower case without spaces, '-' and '_'; Critical is Very High (#246). #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    if ([string]::IsNullOrWhiteSpace($Value)) { return '' }
|    $k = ($Value.Trim().ToLowerInvariant() -replace '[\s\-_]', '')
|    switch ($k) { 'critical' { 'veryhigh' } 'moderate' { 'medium' } 'info' { 'informational' } 'information' { 'informational' } default { $k } }
|}
|
|function ConvertTo-SIOutputScopeTier {
|    <# PURE. A tier as a number 0..3: a number, or a tier label ("High - tier 1"). $null = blank / unreadable. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    $s = ([string]$Value).Trim()
|    if ($s -eq '') { return $null }
|    $n = 0
|    if ([int]::TryParse($s, [System.Globalization.NumberStyles]::Integer, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n)) { return $n }
|    $m = [regex]::Match($s, '(?i)tier\s*(\d)')
|    if ($m.Success) { return [int]$m.Groups[1].Value }
|    $null
|}
|
|function Get-SIOutputScopeValue {
|    param($Object, [string]$Name)
|    if ($null -eq $Object) { return $null }
|    if ($Object -is [System.Collections.IDictionary]) { if ($Object.Contains($Name)) { return , $Object[$Name] } else { return $null } }
|    $p = $Object.PSObject.Properties[$Name]
|    if ($p) { return , $p.Value }
|    $null
|}
|
|function Get-SIOutputScopeList {
|    param($Object, [string]$Name)
|    $v = Get-SIOutputScopeValue $Object $Name
|    if ($null -eq $v) { return }
|    if ($v -is [string]) { if ($v.Trim()) { return $v.Trim() } else { return } }
|    @(@($v) | Where-Object { $null -ne $_ -and "$_".Trim() -ne '' } | ForEach-Object { if ($_ -is [string]) { $_.Trim() } else { $_ } })
|}
|
|function Test-SIOutputScopeBody {
|    <#
|        PURE. The reasons an output scope item is not accepted (empty = accepted). -Key is the destination. Same rules as
|        the web app's OutputScope.Validate (C#).
|    #>
|    param([string]$Key, $Body)
|    $why = New-Object System.Collections.Generic.List[string]
|    $spec = $script:SIOutputScopeDestinations[$Key]
|    if (-not $spec) { $why.Add(("'{0}' is not a destination ({1})" -f $Key, (@($script:SIOutputScopeDestinations.Keys) -join ', '))); return $why.ToArray() }
|    if ($null -eq $Body -or -not ($Body -is [System.Management.Automation.PSCustomObject] -or $Body -is [System.Collections.IDictionary])) { $why.Add('an output scope must be a JSON object'); return $why.ToArray() }
|    $names = if ($Body -is [System.Collections.IDictionary]) { @($Body.Keys | ForEach-Object { [string]$_ }) } else { @($Body.PSObject.Properties | ForEach-Object { $_.Name }) }
|    $allowed = if ($spec.Asset) { @('tiers', 'assetKinds') } else { @('templates', 'reports', 'severities', 'tiers', 'domains', 'filters') }
|    # #1055 the CI rules: the ServiceNow CI output only
|    if (Test-SIOutputScopeCiRuleDestination -Destination $Key) { $allowed += @('include', 'exclude') }
|    foreach ($n in $names) {
|        if ($allowed -notcontains $n) {
|            if ($n -in 'include', 'exclude') { continue }   # said by Test-SIOutputScopeCiRuleBody, in its own words
|            $why.Add(("'{0}' is not a scope of {1} ({2})" -f $n, $Key, ($allowed -join ', ')))
|        }
|    }
|    foreach ($w in @(Test-SIOutputScopeCiRuleBody -Key $Key -Body $Body)) { $why.Add($w) }
|    foreach ($n in $names) {
|        if ($n -in 'filters', 'include', 'exclude') { continue }
|        $v = Get-SIOutputScopeValue $Body $n
|        if ($null -ne $v -and -not ($v -is [System.Collections.IEnumerable] -and $v -isnot [string])) { $why.Add(("'{0}' must be a list" -f $n)) }
|    }
|    $flt = Get-SIOutputScopeValue $Body 'filters'
|    if ($null -ne $flt) {
|        if (-not ($flt -is [System.Management.Automation.PSCustomObject] -or $flt -is [System.Collections.IDictionary])) { $why.Add("'filters' must be an object: { ""<field>"": { ""values"": [...] } }") }
|        else {
|            $fnames = if ($flt -is [System.Collections.IDictionary]) { @($flt.Keys | ForEach-Object { [string]$_ }) } else { @($flt.PSObject.Properties | ForEach-Object { $_.Name }) }
|            foreach ($fn in $fnames) {
|                if ($fn -notmatch '^si_[a-z0-9_]{1,80}$') { $why.Add(("filters: '{0}' is not an SI field (si_...)" -f $fn)); continue }
|                $fo = Get-SIOutputScopeValue $flt $fn
|                $vals = @(Get-SIOutputScopeList $fo 'values')
|                if ($vals.Count -eq 0) { $why.Add(("filters: '{0}' names no value" -f $fn)) }
|                foreach ($x in $vals) { if (([string]$x).Length -gt 200) { $why.Add(("filters: a value of '{0}' is longer than 200 characters" -f $fn)) } }
|                foreach ($pn in @(if ($fo -is [System.Collections.IDictionary]) { $fo.Keys } else { $fo.PSObject.Properties.Name })) { if ([string]$pn -ne 'values') { $why.Add(("filters: '{0}' takes values only, not '{1}'" -f $fn, $pn)) } }
|                $known = $script:SIOutputScopeFilterFields[$fn]
|                if ($known -and @($known.Values).Count) {
|                    foreach ($x in $vals) { if (@($known.Values | Where-Object { $_ -ieq [string]$x }).Count -eq 0) { $why.Add(("filters: '{0}' is not a {1} ({2})" -f $x, $known.Label.ToLowerInvariant(), (@($known.Values) -join ', '))) } }
|                }
|            }
|        }
|    }
|    if ($why.Count) { return $why.ToArray() }
|    foreach ($t in @(Get-SIOutputScopeList $Body 'tiers')) {
|        $n = ConvertTo-SIOutputScopeTier $t
|        if ($null -eq $n -or $n -lt 0 -or $n -gt 3 -or ("$t" -notmatch '^\s*[0-3]\s*$')) { $why.Add(("tiers: '{0}' is not a tier (0, 1, 2 or 3)" -f $t)) }
|    }
|    foreach ($s in @(Get-SIOutputScopeList $Body 'severities')) {
|        if ($script:SIOutputScopeSeverityKeys -notcontains (ConvertTo-SISeverityKey ([string]$s))) { $why.Add(("severities: '{0}' is not a severity" -f $s)) }
|    }
|    foreach ($d in @(Get-SIOutputScopeList $Body 'domains')) {
|        if (@($script:SIOutputScopeDomains | Where-Object { $_ -ieq [string]$d }).Count -eq 0) { $why.Add(("domains: '{0}' is not a security domain ({1})" -f $d, ($script:SIOutputScopeDomains -join ', '))) }
|    }
|    foreach ($k in @(Get-SIOutputScopeList $Body 'assetKinds')) {
|        if ($script:SIOutputScopeAssetKinds -notcontains ([string]$k).ToLowerInvariant()) { $why.Add(("assetKinds: '{0}' is not an asset kind the CMDB connectors read ({1})" -f $k, ($script:SIOutputScopeAssetKinds -join ', '))) }
|    }
|    foreach ($n in 'templates', 'reports') {
|        foreach ($r in @(Get-SIOutputScopeList $Body $n)) { if ([string]$r -notmatch '^[A-Za-z0-9_]{1,100}$') { $why.Add(("{0}: '{1}' is not a report name" -f $n, $r)) } }
|    }
|    $why.ToArray()
|}
|
|function ConvertTo-SIOutputScope {
|    <#
|        PURE. One destination's scope as the engines use it: @{ Destination; Severities (keys); Tiers (int); Domains (lower);
|        AssetKinds (lower); ReportFilter (bool); Reports (HashSet, ordinal); Unresolved (template names not resolved) }.
|        $null for no body.
|    #>
|    param([string]$Destination, $Body)
|    if ($null -eq $Body) { return $null }
|    $reports = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::Ordinal)
|    $templates = @(Get-SIOutputScopeList $Body 'templates')
|    $named = @(Get-SIOutputScopeList $Body 'reports')
|    $resolvedRaw = Get-SIOutputScopeValue $Body 'resolvedReports'
|    $unresolved = @()
|    if ($null -ne $resolvedRaw) { foreach ($r in @($resolvedRaw)) { if ($r) { [void]$reports.Add([string]$r) } } }
|    else {
|        foreach ($r in $named) { [void]$reports.Add([string]$r) }
|        $unresolved = $templates
|    }
|    [pscustomobject]@{
|        Destination  = $Destination
|        Severities   = @(Get-SIOutputScopeList $Body 'severities' | ForEach-Object { ConvertTo-SISeverityKey ([string]$_) } | Where-Object { $_ })
|        Tiers        = @(Get-SIOutputScopeList $Body 'tiers' | ForEach-Object { ConvertTo-SIOutputScopeTier $_ } | Where-Object { $null -ne $_ })
|        Domains      = @(Get-SIOutputScopeList $Body 'domains' | ForEach-Object { ([string]$_).ToLowerInvariant() })
|        AssetKinds   = @(Get-SIOutputScopeList $Body 'assetKinds' | ForEach-Object { ([string]$_).ToLowerInvariant() })
|        ReportFilter = (($templates.Count + $named.Count) -gt 0)
|        Reports      = $reports
|        Unresolved   = $unresolved
|        Filters      = @(ConvertTo-SIOutputScopeFilterList (Get-SIOutputScopeValue $Body 'filters'))
|        # #1055 the CI rules (the ServiceNow CI output)
|        CiInclude    = @(ConvertTo-SIOutputScopeCiRules (Get-SIOutputScopeValue $Body 'include'))
|        CiExclude    = @(ConvertTo-SIOutputScopeCiRules (Get-SIOutputScopeValue $Body 'exclude'))
|    }
|}
|
|function ConvertTo-SIOutputScopeFilterList {
|    <# PURE. The 'filters' object -> @{ Field; Values (lower) } per field, by name. #>
|    param($Filters)
|    if ($null -eq $Filters) { return }
|    $names = if ($Filters -is [System.Collections.IDictionary]) { @($Filters.Keys | ForEach-Object { [string]$_ }) } else { @($Filters.PSObject.Properties | ForEach-Object { $_.Name }) }
|    foreach ($n in @($names | Sort-Object)) {
|        $fo = Get-SIOutputScopeValue $Filters $n
|        $vals = @(Get-SIOutputScopeList $fo 'values' | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() } | Where-Object { $_ })
|        if ($vals.Count -eq 0) { continue }
|        [pscustomobject]@{ Field = $n; Values = $vals }
|    }
|}
|
|function Get-SIOutputScope {
|    <#
|        The scope of one destination for this run, or $null (everything passes). Reads <SI_ProConfigRoot>\output-scope.json
|        (materialised by the Pro settings layer); -ConfigRoot overrides (tests). A file that cannot be read THROWS: a scope
|        the operator set must never silently become "everything".
|    #>
|    param([Parameter(Mandatory)][string]$Destination, [string]$ConfigRoot)
|    if (-not $script:SIOutputScopeDestinations.Contains($Destination)) { throw ("'{0}' is not an output destination ({1})" -f $Destination, (@($script:SIOutputScopeDestinations.Keys) -join ', ')) }
|    if ([string]::IsNullOrWhiteSpace($ConfigRoot)) { $ConfigRoot = [string]$global:SI_ProConfigRoot }
|    if ([string]::IsNullOrWhiteSpace($ConfigRoot)) { return $null }
|    $p = [System.IO.Path]::Combine($ConfigRoot, $script:SIOutputScopeFile)
|    if (-not (Test-Path -LiteralPath $p)) { return $null }
|    $text = [System.IO.File]::ReadAllText($p).TrimStart([char]0xFEFF)
|    try { $doc = $text | ConvertFrom-Json -ErrorAction Stop } catch { throw ("the output scope file {0} is not valid JSON: {1}" -f $p, $_.Exception.Message) }
|    $dests = Get-SIOutputScopeValue $doc 'destinations'
|    $body = Get-SIOutputScopeValue $dests $Destination
|    if ($null -eq $body) { return $null }
|    ConvertTo-SIOutputScope -Destination $Destination -Body $body
|}
|
|function Get-SIOutputScopeText {
|    <# PURE. One line saying what a scope lets through (for the run log). #>
|    param($Scope)
|    if ($null -eq $Scope) { return 'everything' }
|    $parts = New-Object System.Collections.Generic.List[string]
|    if ($Scope.ReportFilter) { $parts.Add(('{0} report(s)' -f $Scope.Reports.Count)) }
|    if (@($Scope.Severities).Count) { $parts.Add(('severity ' + (@($Scope.Severities) -join ', '))) }
|    if (@($Scope.Tiers).Count) { $parts.Add(('tier ' + (@($Scope.Tiers) -join ', '))) }
|    if (@($Scope.Domains).Count) { $parts.Add(('domain ' + (@($Scope.Domains) -join ', '))) }
|    if (@($Scope.AssetKinds).Count) { $parts.Add(('asset kind ' + (@($Scope.AssetKinds) -join ', '))) }
|    if ($Scope.PSObject.Properties['Filters']) {
|        foreach ($f in @($Scope.Filters)) { if ($f) { $parts.Add(('{0} {1}' -f $f.Field, (@($f.Values) -join ', '))) } }
|    }
|    if ($Scope.PSObject.Properties['CiInclude'] -and @($Scope.CiInclude).Count) { $parts.Add(('only ' + ((@($Scope.CiInclude) | ForEach-Object { Get-SIOutputScopeCiRuleText $_ }) -join ' or '))) }
|    if ($Scope.PSObject.Properties['CiExclude']) { foreach ($r in @($Scope.CiExclude)) { if ($r) { $parts.Add(('leave out ' + (Get-SIOutputScopeCiRuleText $r))) } } }
|    if ($parts.Count -eq 0) { return 'everything' }
|    $parts -join '; '
|}
|
|function Test-SIOutputScopeFinding {
|    <#
|        PURE. Does one finding pass the scope? -Reports: the report name(s) the finding came from. Blank values pass.
|    #>
|    param($Scope, [AllowNull()][AllowEmptyString()][string]$Severity, [AllowNull()]$Tier, [AllowNull()][AllowEmptyString()][string]$Domain, [AllowNull()][string[]]$Reports,
|          [hashtable]$Fields)
|    if ($null -eq $Scope) { return $true }
|    # the filters (risk rating, class, component ...) -- only when the caller hands the row's values over (-Fields); a
|    # caller that checks one dimension (a domain) leaves them to its own call
|    if ($PSBoundParameters.ContainsKey('Fields') -and -not (Test-SIOutputScopeFilters -Scope $Scope -Values $Fields)) { return $false }
|    if (@($Scope.Severities).Count) {
|        $k = ConvertTo-SISeverityKey $Severity
|        if ($k -and @($Scope.Severities) -notcontains $k) { return $false }
|    }
|    if (@($Scope.Tiers).Count) {
|        $t = ConvertTo-SIOutputScopeTier $Tier
|        if ($null -ne $t -and @($Scope.Tiers) -notcontains $t) { return $false }
|    }
|    if (@($Scope.Domains).Count -and -not [string]::IsNullOrWhiteSpace($Domain)) {
|        if (@($Scope.Domains) -notcontains $Domain.Trim().ToLowerInvariant()) { return $false }
|    }
|    if ($Scope.ReportFilter) {
|        $names = @($Reports | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
|        if ($names.Count) {
|            $hit = $false
|            foreach ($n in $names) { if ($Scope.Reports.Contains($n.Trim())) { $hit = $true; break } }
|            if (-not $hit) { return $false }
|        }
|    }
|    $true
|}
|
|function Test-SIOutputScopeAsset {
|    <#
|        PURE. Does one asset pass a CMDB destination's asset scope (tiers, asset kinds)? Blank values pass. -Fields (#1055):
|        the CI's values for the CI rules (si_asset_type, si_os_family, si_class) -- given, the include / exclude rules are
|        applied too (Test-SIOutputScopeCiRules); not given, they are not (a caller without those values).
|    #>
|    param($Scope, [AllowNull()]$Tier, [AllowNull()][AllowEmptyString()][string]$Kind, [hashtable]$Fields)
|    if ($null -eq $Scope) { return $true }
|    if ($PSBoundParameters.ContainsKey('Fields') -and -not (Test-SIOutputScopeCiRules -Scope $Scope -Fields $Fields)) { return $false }
|    if (@($Scope.Tiers).Count) {
|        $t = ConvertTo-SIOutputScopeTier $Tier
|        if ($null -ne $t -and @($Scope.Tiers) -notcontains $t) { return $false }
|    }
|    if (@($Scope.AssetKinds).Count -and -not [string]::IsNullOrWhiteSpace($Kind)) {
|        if (@($Scope.AssetKinds) -notcontains $Kind.Trim().ToLowerInvariant()) { return $false }
|    }
|    $true
|}
|
|function Get-SIOutputScopeRowValue {
|    param($Row, [string[]]$Names)
|    foreach ($n in $Names) {
|        $v = Get-SIOutputScopeValue $Row $n
|        if ($null -ne $v -and "$v".Trim() -ne '') { return $v }
|    }
|    $null
|}
|
|function Select-SIOutputScopeRows {
|    <#
|        PURE. The rows of a Risk Analysis run that pass the scope (Excel + mail). A row's severity is SecuritySeverity, its
|        tier CriticalityTier (else the CriticalityTierLevel label), its domain SecurityDomain, its report
|        AssetDetectedInReportName (else ReportName). Returns @{ Rows; Dropped }. No scope = every row, Dropped 0.
|    #>
|    param([AllowNull()][object[]]$Rows, $Scope)
|    $all = @($Rows | Where-Object { $null -ne $_ })
|    if ($null -eq $Scope) { return [pscustomobject]@{ Rows = $all; Dropped = 0 } }
|    $kept = New-Object System.Collections.Generic.List[object]; $dropped = 0
|    foreach ($r in $all) {
|        $sev = [string](Get-SIOutputScopeRowValue $r @('SecuritySeverity'))
|        $tier = Get-SIOutputScopeRowValue $r @('CriticalityTier', 'CriticalityTierLevel')
|        $dom = [string](Get-SIOutputScopeRowValue $r @('SecurityDomain'))
|        $rep = [string](Get-SIOutputScopeRowValue $r @('AssetDetectedInReportName', 'ReportName'))
|        if (Test-SIOutputScopeFinding -Scope $Scope -Severity $sev -Tier $tier -Domain $dom -Reports @($rep) -Fields (Get-SIOutputScopeRowFields -Row $r -Scope $Scope)) { $kept.Add($r) } else { $dropped++ }
|    }
|    [pscustomobject]@{ Rows = $kept.ToArray(); Dropped = $dropped }
|}
|
|function Get-SIVulnScopeDestination {
|    <# PURE. The output destination of a vulnerability connector kind ('sql' | 'servicenow'); $null for one with none (rest). #>
|    param([string]$Kind)
|    switch (([string]$Kind).ToLowerInvariant()) { 'sql' { 'vuln-sql' } 'servicenow' { 'vuln-servicenow' } default { $null } }
|}
|
|function Get-SIOutputScopeNames {
|    <# PURE. Names from a query column: a list, a KQL dynamic array as JSON text ('["a","b"]' -- how a make_set comes back
|       from the query cmdlets), or one plain value. Blank names are dropped. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return }
|    if ($Value -is [string]) {
|        $t = $Value.Trim()
|        if ($t.StartsWith('[')) {
|            try { $arr = $t | ConvertFrom-Json -ErrorAction Stop } catch { $arr = @($t) }
|            foreach ($x in @($arr)) { if ($null -ne $x -and "$x".Trim() -ne '') { "$x".Trim() } }
|            return
|        }
|        if ($t) { $t }
|        return
|    }
|    foreach ($x in @($Value)) { if ($null -ne $x -and "$x".Trim() -ne '') { "$x".Trim() } }
|}
|
|function Select-SICmdbScopedPlanInput {
|    <#
|        PURE. A CMDB connector's plan inputs narrowed to its asset scope. -Desired / -Actual: CiKey -> CI (each with Kind and
|        Tier). A CI SI sees that is OUT of scope leaves the desired set AND the table's side -- it is neither created, updated
|        nor counted absent / retired: the table keeps it exactly as it is. A CI SI no longer sees is untouched by the scope.
|        Returns @{ Desired; Actual (ordered dictionaries); OutOfScope; LeftAsIs }.
|    #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Desired, [Parameter(Mandatory)][System.Collections.IDictionary]$Actual, $Scope)
|    if ($null -eq $Scope) { return [pscustomobject]@{ Desired = $Desired; Actual = $Actual; OutOfScope = 0; LeftAsIs = 0 } }
|    $d2 = [ordered]@{}; $out = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::Ordinal)
|    foreach ($k in @($Desired.Keys)) {
|        $ci = $Desired[$k]
|        if (Test-SIOutputScopeAsset -Scope $Scope -Tier (Get-SIOutputScopeValue $ci 'Tier') -Kind ([string](Get-SIOutputScopeValue $ci 'Kind'))) { $d2[$k] = $ci } else { [void]$out.Add([string]$k) }
|    }
|    $a2 = [ordered]@{}; $left = 0
|    foreach ($k in @($Actual.Keys)) { if ($out.Contains([string]$k)) { $left++ } else { $a2[$k] = $Actual[$k] } }
|    [pscustomobject]@{ Desired = $d2; Actual = $a2; OutOfScope = $out.Count; LeftAsIs = $left }
|}
|
|function Select-SIVulnScopedPlanInput {
|    <#
|        PURE. A vulnerability connector's plan inputs narrowed to its scope. -SnapshotRows: the desired-set query's rows
|        (AssetId, Cve, Severity, Tier, Domains, Reports). A finding OUT of scope leaves the desired set -- it is never
|        opened -- and its key goes to OutOfScopeKeys: #279 decision 3 (operator, 2026-10-04) closes an open record of it
|        with the reason 'Out of scope' (never as fixed, never counted by the close ceiling; back in scope = reopened).
|        -Actual is returned unchanged. Records SI does not report at all are untouched by the scope.
|        -AssetAlias (#279): @{ '<previous asset id lower>' = '<current SI_AssetId>' }. A target record stored under a
|        previous asset id is judged by the asset's CURRENT id -- OnTarget counts it, and the plan (given the same alias)
|        closes it as out of scope, never as absent or fixed.
|        Returns @{ Desired; Actual; OutOfScope (findings); OutOfScopeKeys (key -> why); OnTarget (target records out of scope) }.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Desired, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Actual,
|          [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$SnapshotRows, $Scope, [hashtable]$AssetAlias)
|    if ($null -eq $Scope) { return [pscustomobject]@{ Desired = @($Desired); Actual = @($Actual); OutOfScope = 0; OutOfScopeKeys = @{}; OnTarget = 0 } }
|    $keyOf = { param($id, $cve) ('{0}|{1}' -f ([string]$id).Trim().ToLowerInvariant(), ([string]$cve).Trim().ToUpperInvariant()) }
|    $out = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::Ordinal)
|    foreach ($r in $SnapshotRows) {
|        if ($null -eq $r) { continue }
|        $reports = @(Get-SIOutputScopeNames (Get-SIOutputScopeValue $r 'Reports'))
|        if (-not $reports.Count) { $reports = @(Get-SIOutputScopeNames (Get-SIOutputScopeValue $r 'ReportName')) }
|        $domains = @(Get-SIOutputScopeNames (Get-SIOutputScopeValue $r 'Domains'))
|        if (-not $domains.Count) { $domains = @(Get-SIOutputScopeNames (Get-SIOutputScopeValue $r 'SecurityDomain')) }
|        $domOk = ($domains.Count -eq 0)
|        foreach ($d in $domains) { if (Test-SIOutputScopeFinding -Scope $Scope -Domain $d) { $domOk = $true; break } }
|        # the filters read the snapshot's F_<field> sets (Get-SIVulnDesiredKql -ScopeFields), else the field's own columns
|        $fv = @{}
|        foreach ($f in @($Scope.Filters)) {
|            if ($null -eq $f) { continue }
|            $set = Get-SIOutputScopeValue $r ('F_' + $f.Field)
|            if ($null -eq $set) { $set = Get-SIOutputScopeRowValue $r @(Get-SIOutputScopeFilterColumns -Field $f.Field) }
|            $fv[$f.Field] = $set
|        }
|        $pass = $domOk -and (Test-SIOutputScopeFinding -Scope $Scope -Severity ([string](Get-SIOutputScopeValue $r 'Severity')) -Tier (Get-SIOutputScopeValue $r 'Tier') -Reports $reports -Fields $fv)
|        if (-not $pass) { [void]$out.Add((& $keyOf (Get-SIOutputScopeValue $r 'AssetId') (Get-SIOutputScopeValue $r 'Cve'))) }
|    }
|    $d2 = @($Desired | Where-Object { $null -ne $_ -and -not $out.Contains((& $keyOf $_.CorrelationId $_.Cve)) })
|    $currentId = {
|        param($id)
|        $k = ([string]$id).Trim().ToLowerInvariant()
|        if ($k -and $null -ne $AssetAlias -and $AssetAlias.ContainsKey($k)) { return [string]$AssetAlias[$k] }
|        $id
|    }
|    $why = ('this connector''s output scope ({0}) leaves the finding out -- closed as out of scope, not as fixed' -f (Get-SIOutputScopeText $Scope))
|    $keys = @{}; foreach ($k in $out) { $keys[$k] = $why }
|    $onTarget = @($Actual | Where-Object { $null -ne $_ -and $out.Contains((& $keyOf (& $currentId $_.CorrelationId) $_.Cve)) }).Count
|    [pscustomobject]@{ Desired = $d2; Actual = @($Actual); OutOfScope = $out.Count; OutOfScopeKeys = $keys; OnTarget = $onTarget }
|}
'@ }
$__siSupportFiles['risk-analysis-detection/riskscore.index.locked.csv'] = @{ Sha256 = 'b62e838dee99866a1ed08e0ff0cb95ab508bca872aa5cde71d67df018b030df3'; Text = @'
|si_finding_type,si_category,si_subcategory,si_component,si_finding_key,asset_class,si_severity,VulnerabilityBase,si_tier,AssetBase,Comments,Precedence
|,,,,scid-2002,device_server,,,,5,"Defender for Endpoint not responding (impaired communications) on a SERVER is critical at any tier (owner 2026-10-10, #559)",1
|,,,,scid-2002,device_client,,,0,4,the same on a Tier 0 client (a privileged workstation) stays high (#559),2
|,,,,scid-2002,device_client,,,,1,"the same on a user client is low: a user on vacation (owner 2026-10-10, #559)",3
|,Security controls,EDR,,scid-2002,device,critical,4,,,Fix Microsoft Defender for Endpoint impaired communications,4
|,Security controls,EDR,,scid-2002,device,,,0,4,Fix Microsoft Defender for Endpoint impaired communications,5
|,Security controls,EDR,,scid-2002,device,,,1,3,Fix Microsoft Defender for Endpoint impaired communications,6
|,Security controls,EDR,,scid-2002,device,,,2,2,Fix Microsoft Defender for Endpoint impaired communications,7
|,Security controls,EDR,,scid-2002,device,,,3,1,Fix Microsoft Defender for Endpoint impaired communications,8
|,Security controls,EDR,,scid-2001,device,critical,3,,,Fix Microsoft Defender for Endpoint sensor data collection (Very High >= High: owner 2026-10-10),9
|,Security controls,EDR,,scid-2001,device,,,0,1,Fix Microsoft Defender for Endpoint sensor data collection,10
|,Security controls,EDR,,scid-2001,device,,,1,1,Fix Microsoft Defender for Endpoint sensor data collection,11
|,Security controls,EDR,,scid-2001,device,,,2,1,Fix Microsoft Defender for Endpoint sensor data collection,12
|,Security controls,EDR,,scid-2001,device,,,3,1,Fix Microsoft Defender for Endpoint sensor data collection,13
|,Security controls,EDR,,scid-2000,device,critical,3,,,Turn on Microsoft Defender for Endpoint sensor (Very High >= High: owner 2026-10-10),14
|,Security controls,EDR,,scid-2000,device,,,0,1,Turn on Microsoft Defender for Endpoint sensor,15
|,Security controls,EDR,,scid-2000,device,,,1,1,Turn on Microsoft Defender for Endpoint sensor,16
|,Security controls,EDR,,scid-2000,device,,,2,1,Turn on Microsoft Defender for Endpoint sensor,17
|,Security controls,EDR,,scid-2000,device,,,3,1,Turn on Microsoft Defender for Endpoint sensor,18
|,Security controls,Antivirus,,scid-2014,device,,,0,4,,19
|,Security controls,Antivirus,,scid-2014,device,,,1,3,,20
|,Security controls,Antivirus,,scid-2014,device,,,2,2,,21
|,Security controls,Antivirus,,scid-2014,device,,,3,1,,22
|,Security controls,EDR,,,device,critical,4,,,,23
|,Security controls,EDR,,,device,,,0,4,,24
|,Security controls,EDR,,,device,,,1,3,,25
|,Security controls,EDR,,,device,,,2,2,,26
|,Security controls,EDR,,,device,,,3,1,,27
|,Security controls,Antivirus,,,device,,,0,4,,28
|,Security controls,Antivirus,,,device,,,1,3,,29
|,Security controls,Antivirus,,,device,,,2,2,,30
|,Security controls,Antivirus,,,device,,,3,1,,31
|,Security controls,,,,device,critical,5,,,,32
|,Security controls,,,,device,,,0,4,,33
|,Security controls,,,,device,,,1,3,,34
|,Security controls,,,,device,,,2,2,,35
|,Security controls,,,,device,,,3,1,,36
|,,,,,device,critical,4,,,,37
|,,,,,device,high,3,,,,38
|,,,,,device,medium_high,2,,,,39
|,,,,,device,medium,1,,,,40
|,,,,,device,low,1,,,,41
|,,,,,device,,,0,4,,42
|,,,,,device,,,1,3,,43
|,,,,,device,,,2,2,,44
|,,,,,device,,,3,1,,45
|,Security controls,Antivirus,,scid-2014,device,,5,,4,,46
|,Security controls,EDR,,scid-2002,device,,4,,4,,47
|,Security controls,EDR,,scid-2001,device,,2,,1,,48
|,Security controls,EDR,,scid-2000,device,,2,,1,,49
|,Security controls,Antivirus,,,device,,5,,4,,50
|,Security controls,EDR,,,device,,4,,4,,51
|,Security controls,,,,device,,5,,4,,52
|,,,,,device,,4,,4,,53
|,Security controls,EDR,,scid-2002,,critical,4,,,,54
|,Security controls,EDR,,scid-2002,,,,0,4,,55
|,Security controls,EDR,,scid-2002,,,,1,3,,56
|,Security controls,EDR,,scid-2002,,,,2,2,,57
|,Security controls,EDR,,scid-2002,,,,3,1,,58
|,Security controls,EDR,,scid-2001,,critical,3,,,Very High >= High: owner 2026-10-10,59
|,Security controls,EDR,,scid-2001,,,,0,1,,60
|,Security controls,EDR,,scid-2001,,,,1,1,,61
|,Security controls,EDR,,scid-2001,,,,2,1,,62
|,Security controls,EDR,,scid-2001,,,,3,1,,63
|,Security controls,EDR,,scid-2000,,critical,3,,,Very High >= High: owner 2026-10-10,64
|,Security controls,EDR,,scid-2000,,,,0,1,,65
|,Security controls,EDR,,scid-2000,,,,1,1,,66
|,Security controls,EDR,,scid-2000,,,,2,1,,67
|,Security controls,EDR,,scid-2000,,,,3,1,,68
|,Security controls,Antivirus,,scid-2014,,,,0,4,,69
|,Security controls,Antivirus,,scid-2014,,,,1,3,,70
|,Security controls,Antivirus,,scid-2014,,,,2,2,,71
|,Security controls,Antivirus,,scid-2014,,,,3,1,,72
|,Security controls,EDR,,,,critical,4,,,,73
|,Security controls,EDR,,,,,,0,4,,74
|,Security controls,EDR,,,,,,1,3,,75
|,Security controls,EDR,,,,,,2,2,,76
|,Security controls,EDR,,,,,,3,1,,77
|,Security controls,Antivirus,,,,,,0,4,,78
|,Security controls,Antivirus,,,,,,1,3,,79
|,Security controls,Antivirus,,,,,,2,2,,80
|,Security controls,Antivirus,,,,,,3,1,,81
|,Security controls,,,,,critical,5,,,,82
|,Security controls,,,,,,,0,4,,83
|,Security controls,,,,,,,1,3,,84
|,Security controls,,,,,,,2,2,,85
|,Security controls,,,,,,,3,1,,86
|,,,,,,critical,4,,,,87
|,,,,,,high,3,,,,88
|,,,,,,medium_high,2,,,,89
|,,,,,,medium,1,,,,90
|,,,,,,low,1,,,,91
|,,,,,,,,0,4,,92
|,,,,,,,,1,3,,93
|,,,,,,,,2,2,,94
|,,,,,,,,3,1,,95
|,Security controls,Antivirus,,scid-2014,,,5,,4,,96
|,Security controls,EDR,,scid-2002,,,4,,4,,97
|,Security controls,EDR,,scid-2001,,,2,,1,,98
|,Security controls,EDR,,scid-2000,,,2,,1,,99
|,Security controls,Antivirus,,,,,5,,4,,100
|,Security controls,EDR,,,,,4,,4,,101
|,Security controls,,,,,,5,,4,,102
'@ }
$__siSupportFiles['asset-profiling-enrichment/endpoint/AssetTagging.locked.yaml'] = @{ Sha256 = '6540592d3ffd2b8e6571ff8b616f13674a74d42065193ab370fdb5deb0e835e8'; Text = @'
|# ============================================================================
|# Auto-Exclude tagging rules driven by config/asset-tagging.config.json
|#
|# FOUR independent rules. Not ANDed. A device matching multiple gets
|# multiple Auto-* tags (downstream '--Excluded--SI' suffix doesn't care
|# which prefix carried it).
|#
|# Sources:
|#   Rules 1-3 (OnboardingStatus): source = DeviceInfo.
|#     DeviceInfo is the authoritative table for OnboardingStatus and
|#     surfaces EVERY device Defender has signal for -- including the
|#     ones that ExposureGraphNodes doesn't node-up (e.g. fully
|#     un-onboarded CanBeOnboarded devices). EG is left-joined ONLY to
|#     pull rawData.deviceManualTags + deviceDynamicTags for the
|#     'already-tagged?' delta filter -- devices not in EG get an empty
|#     AssetTags string and naturally pass the filter (which is fine;
|#     the engine will skip them later if their DeviceId is empty,
|#     i.e. they have no MDE machine record to tag).
|#
|#   Rule 4 (DeviceNamePattern): source = ExposureGraphNodes.
|#     Name-pattern targets ONBOARDED machines (typically endpoints);
|#     EG is the modern source and gives us EntityIds + AssetTags in
|#     one read.
|#
|# Gates: AutoExcludeRules.{ExcludeCanBeOnboarded, ExcludeInsufficientInfo,
|#        ExcludeUnsupported, ExcludeByDeviceNamePattern}.
|#
|# Delta: each rule ends with 'where array_index_of(AssetTagsArray,
|# AssetTagName) == -1', so already-tagged devices don't re-hit MDE on
|# every cron tick.
|#
|# Limitation operators must understand: the MDE machine-tag REST API
|# (POST /api/machines/{id}/tags) requires an MDE-onboarded machine ID
|# (SenseDeviceId / DeviceInfo.DeviceId). Devices that exist in
|# DeviceInfo passively (switches, APs, printers, IoT, mobile, dummy
|# names) typically have empty DeviceId -- those rows are surfaced by
|# rules 1-3 but the engine drops them silently with an aggregate
|# 'Skipped Defender rows Count=N Reason=Missing SenseDeviceId' line.
|# Tagging un-onboarded devices is not technically possible via this
|# API path -- not a bug.
|# ============================================================================
|
|AssetTagging:
|
|  - AssetTagName: Auto-CanBeOnboarded--Excluded--SI
|    Mode: Prod
|    QueryEngine: DefenderGraph
|    EnabledByConfigFlag: AutoExcludeRules.ExcludeCanBeOnboarded
|    Description: |
|      Tags every DeviceInfo row whose OnboardingStatus is 'Can be onboarded'.
|      Source = DeviceInfo (authoritative). Left-join to ExposureGraphNodes
|      provides current AssetTags for the delta filter.
|    Query:
|      - |
|        let TaggedNodes =
|            ExposureGraphNodes
|            | where NodeLabel has "device"
|            | extend rawData = todynamic(NodeProperties).rawData
|            | extend
|                deviceManualTags  = iff(isnull(rawData.deviceManualTags),  dynamic([]), todynamic(rawData.deviceManualTags)),
|                deviceDynamicTags = iff(isnull(rawData.deviceDynamicTags), dynamic([]), todynamic(rawData.deviceDynamicTags))
|            | extend AssetTags = strcat_array(array_concat(deviceManualTags, deviceDynamicTags), ";")
|            | extend entityIds_dyn = todynamic(EntityIds)
|            | mv-apply e=entityIds_dyn on (
|                summarize SenseDeviceId = anyif(tostring(e.id), tostring(e.type) == "SenseDeviceId")
|              )
|            | where isnotempty(SenseDeviceId)
|            | project SenseDeviceId, AssetTags;
|        DeviceInfo
|        | where OnboardingStatus =~ "Can be onboarded"
|        | summarize arg_max(Timestamp, *) by DeviceId
|        | project SenseDeviceId = DeviceId, DeviceName, MachineGroup, OnboardingStatus
|        | extend
|            AssetTagType = "Asset--Excluded--SI",
|            AssetTag     = "Auto-CanBeOnboarded",
|            AssetTagName = strcat("Auto-CanBeOnboarded", "--Excluded--SI")
|        | join kind=leftouter TaggedNodes on SenseDeviceId
|        | extend AssetTags = coalesce(AssetTags, "")
|        | extend AssetTagsArray = iff(isempty(AssetTags), dynamic([]), split(AssetTags, ";"))
|        | where array_index_of(AssetTagsArray, AssetTagName) == -1
|        | project SenseDeviceId, DeviceName, MachineGroup, OnboardingStatus, AssetTags, AssetTagType, AssetTag, AssetTagName
|
|  - AssetTagName: Auto-InsufficientInfo--Excluded--SI
|    Mode: Prod
|    QueryEngine: DefenderGraph
|    EnabledByConfigFlag: AutoExcludeRules.ExcludeInsufficientInfo
|    Description: |
|      Tags every DeviceInfo row whose OnboardingStatus is 'Insufficient info'.
|      Source = DeviceInfo. Left-join to ExposureGraphNodes provides AssetTags
|      for the delta filter.
|    Query:
|      - |
|        let TaggedNodes =
|            ExposureGraphNodes
|            | where NodeLabel has "device"
|            | extend rawData = todynamic(NodeProperties).rawData
|            | extend
|                deviceManualTags  = iff(isnull(rawData.deviceManualTags),  dynamic([]), todynamic(rawData.deviceManualTags)),
|                deviceDynamicTags = iff(isnull(rawData.deviceDynamicTags), dynamic([]), todynamic(rawData.deviceDynamicTags))
|            | extend AssetTags = strcat_array(array_concat(deviceManualTags, deviceDynamicTags), ";")
|            | extend entityIds_dyn = todynamic(EntityIds)
|            | mv-apply e=entityIds_dyn on (
|                summarize SenseDeviceId = anyif(tostring(e.id), tostring(e.type) == "SenseDeviceId")
|              )
|            | where isnotempty(SenseDeviceId)
|            | project SenseDeviceId, AssetTags;
|        DeviceInfo
|        | where OnboardingStatus =~ "Insufficient info"
|        | summarize arg_max(Timestamp, *) by DeviceId
|        | project SenseDeviceId = DeviceId, DeviceName, MachineGroup, OnboardingStatus
|        | extend
|            AssetTagType = "Asset--Excluded--SI",
|            AssetTag     = "Auto-InsufficientInfo",
|            AssetTagName = strcat("Auto-InsufficientInfo", "--Excluded--SI")
|        | join kind=leftouter TaggedNodes on SenseDeviceId
|        | extend AssetTags = coalesce(AssetTags, "")
|        | extend AssetTagsArray = iff(isempty(AssetTags), dynamic([]), split(AssetTags, ";"))
|        | where array_index_of(AssetTagsArray, AssetTagName) == -1
|        | project SenseDeviceId, DeviceName, MachineGroup, OnboardingStatus, AssetTags, AssetTagType, AssetTag, AssetTagName
|
|  - AssetTagName: Auto-Unsupported--Excluded--SI
|    Mode: Prod
|    QueryEngine: DefenderGraph
|    EnabledByConfigFlag: AutoExcludeRules.ExcludeUnsupported
|    Description: |
|      Tags every DeviceInfo row whose OnboardingStatus is 'Unsupported'.
|      Source = DeviceInfo. Left-join to ExposureGraphNodes provides AssetTags
|      for the delta filter.
|    Query:
|      - |
|        let TaggedNodes =
|            ExposureGraphNodes
|            | where NodeLabel has "device"
|            | extend rawData = todynamic(NodeProperties).rawData
|            | extend
|                deviceManualTags  = iff(isnull(rawData.deviceManualTags),  dynamic([]), todynamic(rawData.deviceManualTags)),
|                deviceDynamicTags = iff(isnull(rawData.deviceDynamicTags), dynamic([]), todynamic(rawData.deviceDynamicTags))
|            | extend AssetTags = strcat_array(array_concat(deviceManualTags, deviceDynamicTags), ";")
|            | extend entityIds_dyn = todynamic(EntityIds)
|            | mv-apply e=entityIds_dyn on (
|                summarize SenseDeviceId = anyif(tostring(e.id), tostring(e.type) == "SenseDeviceId")
|              )
|            | where isnotempty(SenseDeviceId)
|            | project SenseDeviceId, AssetTags;
|        DeviceInfo
|        | where OnboardingStatus =~ "Unsupported"
|        | summarize arg_max(Timestamp, *) by DeviceId
|        | project SenseDeviceId = DeviceId, DeviceName, MachineGroup, OnboardingStatus
|        | extend
|            AssetTagType = "Asset--Excluded--SI",
|            AssetTag     = "Auto-Unsupported",
|            AssetTagName = strcat("Auto-Unsupported", "--Excluded--SI")
|        | join kind=leftouter TaggedNodes on SenseDeviceId
|        | extend AssetTags = coalesce(AssetTags, "")
|        | extend AssetTagsArray = iff(isempty(AssetTags), dynamic([]), split(AssetTags, ";"))
|        | where array_index_of(AssetTagsArray, AssetTagName) == -1
|        | project SenseDeviceId, DeviceName, MachineGroup, OnboardingStatus, AssetTags, AssetTagType, AssetTag, AssetTagName
|
|  - AssetTagName: Auto-NamePattern--Excluded--SI
|    Mode: Prod
|    QueryEngine: DefenderGraph
|    ApplyDeviceNamePatterns: true
|    EnabledByConfigFlag: AutoExcludeRules.ExcludeByDeviceNamePattern
|    Description: |
|      Tags every DeviceInfo row whose DeviceName matches any entry in
|      DeviceNamePatterns.{StartsWith, Contains, MatchesRegex}. Source =
|      DeviceInfo so we see EVERY known device (including ones not in
|      ExposureGraphNodes). Left-join to EG provides AssetTags for the
|      delta filter. Independent of OnboardingStatus -- e.g. desktop-*
|      gets tagged whether onboarded, canBeOnboarded, or unsupported.
|    Query:
|      - |
|        let TaggedNodes =
|            ExposureGraphNodes
|            | where NodeLabel has "device"
|            | extend rawData = todynamic(NodeProperties).rawData
|            | extend
|                deviceManualTags  = iff(isnull(rawData.deviceManualTags),  dynamic([]), todynamic(rawData.deviceManualTags)),
|                deviceDynamicTags = iff(isnull(rawData.deviceDynamicTags), dynamic([]), todynamic(rawData.deviceDynamicTags))
|            | extend AssetTags = strcat_array(array_concat(deviceManualTags, deviceDynamicTags), ";")
|            | extend entityIds_dyn = todynamic(EntityIds)
|            | mv-apply e=entityIds_dyn on (
|                summarize SenseDeviceId = anyif(tostring(e.id), tostring(e.type) == "SenseDeviceId")
|              )
|            | where isnotempty(SenseDeviceId)
|            | project SenseDeviceId, AssetTags;
|        DeviceInfo
|        | summarize arg_max(Timestamp, *) by DeviceId
|        | project SenseDeviceId = DeviceId, DeviceName, MachineGroup, OnboardingStatus
|        | extend
|            AssetTagType = "Asset--Excluded--SI",
|            AssetTag     = "Auto-NamePattern",
|            AssetTagName = strcat("Auto-NamePattern", "--Excluded--SI")
|        | join kind=leftouter TaggedNodes on SenseDeviceId
|        | extend AssetTags = coalesce(AssetTags, "")
|        | extend AssetTagsArray = iff(isempty(AssetTags), dynamic([]), split(AssetTags, ";"))
|        | where array_index_of(AssetTagsArray, AssetTagName) == -1
|        | project SenseDeviceId, DeviceName, MachineGroup, OnboardingStatus, AssetTags, AssetTagType, AssetTag, AssetTagName
'@ }
$__siSupportFiles['engine/pro-settings/SI-Audit.ps1'] = @{ Sha256 = 'f8e6e98e22e7341c1972cd70b6d929aa2841a529c159d9e5631a770c306c9501'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- THE AUDIT TRAIL, PowerShell half (#260, framework DOCS\REQUIREMENTS.md AUDIT-1).
|
|    ONE trail per install: cfg.AuditEvent in the Pro database (sql\si-pro-settings.sql). The web app writes its events
|    there (SI.Management.Web Audit\AuditCore.cs); the jobs, setup tools and engines write theirs with Write-SIAuditEvent;
|    every cfg.ChangeLog row is copied in by the table's trigger in the same transaction.
|
|    The CLOSED action list is config\audit-actions.locked.json -- the file the web app reads too; a test compares the two
|    lists. A failed write NEVER fails the step it records (the change already happened): it is warned once per failure,
|    counted (Get-SIAuditHealth) and answered $false. A plan / dry run is written with WhatIf = 1, or not at all.
|
|    Append-only: the database refuses UPDATE / DELETE on the trail to every identity (#289, a DENY in
|    sql\si-pro-settings.sql). The ONE removal is the retention step below (Invoke-SIAuditRetention), run by the data
|    sync job through the procedure cfg.AuditRetentionApply, bounded by SI_Pro_AuditRetentionMonths (not set = kept forever;
|    at least 13 months), and it records itself on the trail.
|#>
|
|$script:SIAuditRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|$script:SIAuditHealth = @{ Written = 0; Failed = 0; LastError = '' }
|$script:SIAuditMinRetentionMonths = 13
|
|function Get-SIAuditActionCatalog {
|    <# PURE (reads one shipped file). The closed list as shipped: actions, change categories / verbs, sources, outcomes. #>
|    param([string]$SIRoot = $script:SIAuditRoot)
|    $p = [System.IO.Path]::Combine($SIRoot, 'config', 'audit-actions.locked.json')
|    ConvertFrom-Json -InputObject ([System.IO.File]::ReadAllText($p))
|}
|
|function Get-SIAuditActionList {
|    <# Every action a row may carry, sorted ordinally: the listed actions + <category>.change.<verb> of the change rows. #>
|    param([string]$SIRoot = $script:SIAuditRoot)
|    $c = Get-SIAuditActionCatalog -SIRoot $SIRoot
|    $all = New-Object System.Collections.Generic.List[string]
|    foreach ($a in @($c.actions)) { $all.Add([string]$a.action) }
|    foreach ($cat in @($c.changeCategories)) { foreach ($v in @($c.changeVerbs)) { $all.Add(('{0}.change.{1}' -f $cat, $v)) } }
|    $arr = [string[]]@($all | Select-Object -Unique)
|    [Array]::Sort($arr, [StringComparer]::Ordinal)
|    $arr
|}
|
|function Test-SIAuditAction {
|    <# $true when the action is on the closed list. #>
|    param([Parameter(Mandatory)][string]$Action, [string]$SIRoot = $script:SIAuditRoot)
|    @(Get-SIAuditActionList -SIRoot $SIRoot) -contains $Action
|}
|
|function Get-SIAuditInsertSql {
|    <# THE PowerShell writer's one statement: an INSERT into cfg.AuditEvent (TsUtc is the store's). Same text as the web app's. #>
|@'
|IF OBJECT_ID(N'cfg.AuditEvent') IS NULL
|    SELECT N'Missing' AS Outcome;
|ELSE
|BEGIN
|    INSERT cfg.AuditEvent (RecordType, Action, Actor, ActorSource, Target, Reason, Outcome, OutcomeText, BeforeJson, AfterJson, CorrelationId, WhatIf, ScopeDomain, ScopeDepartmentId)
|    VALUES (N'event', @Action, @Actor, @ActorSource, @Target, @Reason, @Outcome, @OutcomeText, @BeforeJson, @AfterJson, @CorrelationId, @WhatIf, @ScopeDomain, @ScopeDepartmentId);
|    SELECT N'Saved' AS Outcome;
|END
|'@
|}
|
|function Test-SIAuditSecretName {
|    <# PURE. A field whose value is a secret or a credential -- never written to the trail (the web app's rule). #>
|    param([AllowEmptyString()][string]$Name)
|    if ($Name.StartsWith('__')) { return $true }
|    $Name -match '(?i)(secret|password|passwd|^pwd$|token|^otp|otp$|^pin$|code$|credential|apikey|api_key|signature|cookie|^t$|^sig$)'
|}
|
|function ConvertTo-SIAuditText {
|    <# PURE. Free text with any long opaque run (a token, a key) cut out, at most -Max characters. #>
|    param([AllowNull()][AllowEmptyString()][string]$Text, [int]$Max = 1000)
|    if ($null -eq $Text) { return $null }
|    $t = [regex]::Replace($Text, '(?<![A-Za-z0-9_\-+=])(?=[A-Za-z0-9_\-+=]*[0-9])(?=[A-Za-z0-9_\-+=]*[A-Za-z])[A-Za-z0-9_\-+=]{40,}', '(hidden)')
|    if ($t.Length -gt $Max) { $t = $t.Substring(0, $Max) }
|    $t
|}
|
|function ConvertTo-SIAuditJson {
|    <# PURE. A before / after state as compact JSON with every secret-named field hidden (one level of a hashtable or object). #>
|    param($InputObject)
|    if ($null -eq $InputObject) { return $null }
|    if ($InputObject -is [string]) { return (ConvertTo-Json -InputObject (ConvertTo-SIAuditText -Text $InputObject -Max 4000) -Compress) }
|    $o = [ordered]@{}
|    $isDict = $InputObject -is [System.Collections.IDictionary]
|    $names = if ($isDict) { @($InputObject.get_Keys() | ForEach-Object { [string]$_ }) } else { @($InputObject.PSObject.Properties | ForEach-Object { [string]$_.Name }) }
|    foreach ($k in $names) {
|        $v = if ($isDict) { $InputObject[$k] } else { $InputObject.$k }
|        if (Test-SIAuditSecretName -Name $k) { $o[$k] = '(hidden)' }
|        elseif ($v -is [string]) { $o[$k] = ConvertTo-SIAuditText -Text $v -Max 2000 }
|        else { $o[$k] = $v }
|    }
|    ConvertTo-Json -InputObject $o -Depth 5 -Compress
|}
|
|function Get-SIAuditActor {
|    <#
|        Who a job / setup step runs as: the managed identity (its client id) in a container, else the signed-in Windows
|        account, else the operating-system user -- never a parameter. -Job names the job it ran in.
|    #>
|    param([string]$Job)
|    $id = if (Get-Command -Name Get-SIProSessionActor -ErrorAction SilentlyContinue) { Get-SIProSessionActor }
|          elseif ($global:SI_UseManagedIdentity) { $c = [Environment]::GetEnvironmentVariable('AZURE_CLIENT_ID'); if ($c) { 'managed identity ' + $c } else { 'managed identity' } }
|          else { [System.Environment]::UserName }
|    if ($Job) { '{0} ({1})' -f $Job, $id } else { [string]$id }
|}
|
|function New-SIAuditRecord {
|    <# PURE. The parameters of one event row, validated against the closed lists; refuses a malformed row. #>
|    param(
|        [Parameter(Mandatory)][string]$Action,
|        [Parameter(Mandatory)][string]$Actor,
|        [ValidateSet('web', 'job', 'engine', 'setup', 'api', 'portal')][string]$ActorSource = 'job',
|        [string]$Target, [string]$Reason,
|        [ValidateSet('ok', 'error', 'refused', 'held')][string]$Outcome = 'ok',
|        [string]$OutcomeText, $Before, $After, [string]$CorrelationId,
|        [switch]$WhatIfRun, [string]$ScopeDomain, $ScopeDepartmentId
|    )
|    if ($Action -notmatch '^[a-z][a-z0-9-]*\.[a-z][a-z0-9-]*\.[a-z][a-z0-9-]*$') { throw "audit action '$Action' is not lower-case domain.object.verb" }
|    $cut = { param([string]$s, [int]$n) if ($null -eq $s -or $s.Length -le $n) { $s } else { $s.Substring(0, $n) } }
|    [ordered]@{
|        Action = $Action; Actor = (& $cut $Actor 256); ActorSource = $ActorSource; Target = (& $cut $Target 400); Reason = (& $cut $Reason 400)
|        Outcome = $Outcome; OutcomeText = (ConvertTo-SIAuditText -Text $OutcomeText -Max 1000)
|        BeforeJson = (ConvertTo-SIAuditJson -InputObject $Before); AfterJson = (ConvertTo-SIAuditJson -InputObject $After)
|        CorrelationId = $(if ($CorrelationId) { $CorrelationId } else { $null }); WhatIf = [bool]$WhatIfRun
|        ScopeDomain = (& $cut $ScopeDomain 64); ScopeDepartmentId = $(if ($null -ne $ScopeDepartmentId -and "$ScopeDepartmentId" -match '^\d+$') { [int]$ScopeDepartmentId } else { $null })
|    }
|}
|
|function Write-SIAuditEvent {
|    <#
|        THE PowerShell writer: one 'event' row on the trail. -Store (New-SIProSettingsStore) or -Invoke (the
|        (sql, params, mode) seam of every Pro engine). NEVER throws: a failure is warned, counted and answered $false.
|    #>
|    <#
|        #302 (framework AUDIT-1.1): a row a JOB writes (-ActorSource job / engine) names the PERSON who asked for the
|        change when one did: -Attribution (a record from Get-SIChangeAttribution, looked up by the caller by its target),
|        else the person who started this job execution (Get-SIJobAttribution: SI_AUDIT_CID in the environment, set by the
|        web app). The row then reads Actor = that person, After.appliedBy = the job (-Actor), After.jobRun = -JobRun (else
|        the caller's -CorrelationId, else the execution), After.approvedBy, and CorrelationId = the commit / request id.
|        No person asked: the job stays the actor and After.initiatedBy says so. -NoAttribution: a row that already names
|        the person itself (a release approved on a VM's command line).
|    #>
|    param(
|        $Store, [scriptblock]$Invoke,
|        [Parameter(Mandatory)][string]$Action,
|        [string]$Actor,
|        [string]$ActorSource = 'job',
|        [string]$Target, [string]$Reason,
|        [string]$Outcome = 'ok',
|        [string]$OutcomeText, $Before, $After, [string]$CorrelationId,
|        [switch]$WhatIfRun, [string]$ScopeDomain, $ScopeDepartmentId,
|        $Attribution, [string]$JobRun, [switch]$NoAttribution,
|        [scriptblock]$Log
|    )
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Warning $msg } }
|    if (-not $Invoke -and $Store) { $Invoke = $Store.Invoke }
|    try {
|        if (-not $Invoke) { throw 'no Pro database to write to' }
|        if (-not $Actor) { $Actor = Get-SIAuditActor }
|        if ($ActorSource -in @('job', 'engine') -and -not $NoAttribution) {
|            $attr = $Attribution
|            if ($null -eq $attr) { try { $attr = Get-SIJobAttribution -Invoke $Invoke -Log $Log } catch { $attr = $null } }
|            $res = Resolve-SIAuditAttribution -JobActor $Actor -Attribution $attr -JobRun $JobRun -CorrelationId $CorrelationId -After $After
|            $Actor = $res.Actor; $After = $res.After; $CorrelationId = $res.CorrelationId
|        }
|        try { if (-not (Test-SIAuditAction -Action $Action)) { & $Log 'WARN' ("audit action '{0}' is not on the closed list (config\audit-actions.locked.json) -- written anyway" -f $Action) } } catch { }
|        $p = New-SIAuditRecord -Action $Action -Actor $Actor -ActorSource $ActorSource -Target $Target -Reason $Reason -Outcome $Outcome -OutcomeText $OutcomeText `
|                -Before $Before -After $After -CorrelationId $CorrelationId -WhatIfRun:$WhatIfRun -ScopeDomain $ScopeDomain -ScopeDepartmentId $ScopeDepartmentId
|        $r = & $Invoke (Get-SIAuditInsertSql) $p 'scalar'
|        if ("$r" -eq 'Missing') { throw 'the Pro database has no cfg.AuditEvent yet -- apply sql\si-pro-settings.sql (it only adds)' }
|        if ($null -eq $script:SIAuditHealth) { $script:SIAuditHealth = @{ Written = 0; Failed = 0; LastError = '' } }
|        $script:SIAuditHealth.Written++
|        return $true
|    } catch {
|        # 2026-10-04, live on ring 1: loaded into another scope, the counter was $null and `.Failed++` THREW -- an audit
|        # failure stopped the vulnerability connector. An audit failure never fails the step: initialise here, never throw.
|        $auditErr = [string]$_.Exception.Message
|        if ($null -eq $script:SIAuditHealth) { $script:SIAuditHealth = @{ Written = 0; Failed = 0; LastError = '' } }
|        try { $script:SIAuditHealth.Failed++; $script:SIAuditHealth.LastError = $auditErr } catch { }
|        & $Log 'WARN' ("the audit trail row '{0}' could not be written: {1} -- the step itself is not affected" -f $Action, $auditErr)
|        return $false
|    }
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|# #302 (framework AUDIT-1.1): THE ACTOR OF A CHANGE A JOB CARRIES OUT IS THE PERSON WHO ASKED FOR IT.
|# The web app records, AT COMMIT, who initiated each change it hands to a job (and who approved it) in
|# cfg.ChangeAttribution, under the commit's correlation id and keyed by the changed target. The jobs look it up here.
|# ------------------------------------------------------------------------------------------------------------------
|$script:SIAttributionDays = 30
|$script:SIJobAttribution = $null
|
|function Get-SIChangeAttributionInsertSql {
|    <# The one write of an attribution row (a release approved on a VM's command line; the web app has the same text). #>
|@'
|IF OBJECT_ID(N'cfg.ChangeAttribution') IS NULL
|    SELECT N'Missing' AS Outcome;
|ELSE
|BEGIN
|    INSERT cfg.ChangeAttribution (CorrelationId, TargetKey, Kind, Op, Title, Actor, ApprovedBy, Source)
|    VALUES (@CorrelationId, @TargetKey, @Kind, @Op, @Title, @Actor, @ApprovedBy, @Source);
|    SELECT N'Saved' AS Outcome;
|END
|'@
|}
|
|function Get-SIChangeAttributionSelectSql {
|    <# The newest attribution of a correlation id and / or a target (and kind), within the last @Days days. #>
|@'
|IF OBJECT_ID(N'cfg.ChangeAttribution') IS NOT NULL
|SELECT TOP (1) CorrelationId, TargetKey, Kind, Op, Title, Actor, ApprovedBy, Source, CreatedAt
|FROM cfg.ChangeAttribution
|WHERE (@Cid IS NULL OR CorrelationId = @Cid) AND (@Target IS NULL OR TargetKey = @Target) AND (@Kind IS NULL OR Kind = @Kind)
|  AND CreatedAt >= DATEADD(day, -@Days, SYSUTCDATETIME())
|ORDER BY AttributionId DESC;
|'@
|}
|
|function ConvertTo-SIChangeAttribution {
|    <# PURE. A cfg.ChangeAttribution row (hashtable or object) -> the attribution record the writer applies; $null without an actor. #>
|    param($Row, [string]$Via = 'store')
|    if ($null -eq $Row) { return $null }
|    $g = { param($n) if ($Row -is [System.Collections.IDictionary]) { $Row[$n] } elseif ($Row.PSObject.Properties[$n]) { $Row.$n } else { $null } }
|    $actor = [string](& $g 'Actor')
|    if ([string]::IsNullOrWhiteSpace($actor)) { return $null }
|    $ap = [string](& $g 'ApprovedBy')
|    [pscustomobject]@{
|        Actor = $actor.Trim(); ApprovedBy = $(if ($ap.Trim()) { $ap.Trim() } else { '' }); CorrelationId = [string](& $g 'CorrelationId')
|        TargetKey = [string](& $g 'TargetKey'); Kind = [string](& $g 'Kind'); Op = [string](& $g 'Op'); Title = [string](& $g 'Title'); Via = $Via
|    }
|}
|
|function Save-SIChangeAttribution {
|    <# One attribution row, AT COMMIT. NEVER throws: a failure is warned and answered $false (the change itself happened). #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$CorrelationId, [Parameter(Mandatory)][string]$TargetKey,
|          [Parameter(Mandatory)][string]$Actor, [string]$ApprovedBy, [ValidateSet('change', 'start', 'release', 'flow')][string]$Kind = 'change',
|          [ValidateSet('set', 'remove', 'start', 'approve')][string]$Op = 'set', [string]$Title, [string]$Source = 'job', [scriptblock]$Log)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Warning $msg } }
|    $cut = { param([string]$s, [int]$n) if ($null -eq $s -or $s.Length -le $n) { $s } else { $s.Substring(0, $n) } }
|    try {
|        $p = [ordered]@{ CorrelationId = (& $cut $CorrelationId 64); TargetKey = (& $cut $TargetKey 400); Kind = $Kind; Op = $Op; Title = (& $cut $Title 400)
|                         Actor = (& $cut $Actor 256); ApprovedBy = $(if ($ApprovedBy) { & $cut $ApprovedBy 256 } else { $null }); Source = (& $cut $Source 16) }
|        $r = & $Invoke (Get-SIChangeAttributionInsertSql) $p 'scalar'
|        if ("$r" -eq 'Missing') { throw 'the Pro database has no cfg.ChangeAttribution yet -- apply sql\si-pro-settings.sql (it only adds)' }
|        return $true
|    } catch {
|        & $Log 'WARN' ("who asked for '{0}' could not be recorded: {1} -- the change itself is not affected" -f $TargetKey, $_.Exception.Message)
|        return $false
|    }
|}
|
|function Get-SIChangeAttribution {
|    <#
|        The newest attribution of -CorrelationId and / or -TargetKey (optionally of one -Kind), at most -Days old -- or $null.
|        NEVER throws: an unreadable store attributes nothing (the job stays the actor), warned once.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [string]$CorrelationId, [string]$TargetKey, [string]$Kind, [int]$Days = $script:SIAttributionDays, [scriptblock]$Log)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Warning $msg } }
|    if (-not $CorrelationId -and -not $TargetKey) { return $null }
|    try {
|        $p = [ordered]@{ Cid = $(if ($CorrelationId) { $CorrelationId } else { $null }); Target = $(if ($TargetKey) { $TargetKey } else { $null }); Kind = $(if ($Kind) { $Kind } else { $null }); Days = $Days }
|        $rows = @(& $Invoke (Get-SIChangeAttributionSelectSql) $p 'reader' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })
|        if (-not $rows.Count) { return $null }
|        return (ConvertTo-SIChangeAttribution -Row $rows[0] -Via 'store')
|    } catch {
|        & $Log 'WARN' ("who asked for this change could not be read (the job is recorded as the actor): {0}" -f $_.Exception.Message)
|        return $null
|    }
|}
|
|function Get-SIJobAttribution {
|    <#
|        The person who started THIS job execution, when one did: the web app starts a job for a person with SI_AUDIT_CID
|        (the request's correlation id, recorded in cfg.ChangeAttribution at that moment) and SI_AUDIT_STARTED_BY. The
|        store's row wins; the variable is the fallback when the store cannot be read (Via 'environment'). $null = the
|        job's own run (a schedule). Resolved once per process and execution.
|    #>
|    param([scriptblock]$Invoke, [scriptblock]$Log)
|    $cid = [string]$env:SI_AUDIT_CID; $by = [string]$env:SI_AUDIT_STARTED_BY
|    if (-not $cid.Trim() -and -not $by.Trim()) { return $null }
|    $key = $cid + '|' + $by
|    if ($script:SIJobAttribution -and $script:SIJobAttribution.Key -eq $key) { return $script:SIJobAttribution.Value }
|    $v = $null
|    if ($Invoke -and $cid.Trim()) { $v = Get-SIChangeAttribution -Invoke $Invoke -CorrelationId $cid.Trim() -Log $Log }
|    if (-not $v -and $by.Trim()) {
|        $v = [pscustomobject]@{ Actor = $by.Trim(); ApprovedBy = ''; CorrelationId = $cid.Trim(); TargetKey = ''; Kind = 'start'; Op = 'start'; Title = ''; Via = 'environment' }
|    }
|    $script:SIJobAttribution = @{ Key = $key; Value = $v }
|    $v
|}
|
|function Get-SIAuditJobRun {
|    <# The job execution this process runs in (a container's execution name), else ''. #>
|    $e = [string]$env:CONTAINER_APP_JOB_EXECUTION_NAME
|    if ($e.Trim()) { return $e.Trim() }
|    ''
|}
|
|function Resolve-SIAuditAttribution {
|    <#
|        PURE. The rule of AUDIT-1.1 for one row a job writes. With an attribution: Actor = the person who initiated it,
|        After.appliedBy = the job (-JobActor), After.jobRun = -JobRun (else the caller's -CorrelationId, which was the job's
|        run, else the execution), After.approvedBy when an approval applied, CorrelationId = the commit / request id (the
|        caller's when the attribution has none). Without: the job stays the actor, After.initiatedBy says no person asked,
|        and the run is kept. Returns @{ Actor; After; CorrelationId; Attributed }.
|    #>
|    param([Parameter(Mandatory)][string]$JobActor, $Attribution, [string]$JobRun, [string]$CorrelationId, $After)
|    $a = [ordered]@{}
|    if ($null -ne $After) {
|        if ($After -is [string]) { $a['detail'] = $After }
|        elseif ($After -is [System.Collections.IDictionary]) { foreach ($k in @($After.Keys)) { $a[[string]$k] = $After[$k] } }
|        else { foreach ($pp in @($After.PSObject.Properties)) { $a[$pp.Name] = $pp.Value } }
|    }
|    $run = if ($JobRun) { $JobRun } elseif ($CorrelationId) { $CorrelationId } else { Get-SIAuditJobRun }
|    if ($null -ne $Attribution -and [string]$Attribution.Actor) {
|        $a['appliedBy'] = $JobActor
|        if ($run) { $a['jobRun'] = $run }
|        if ([string]$Attribution.ApprovedBy -and ([string]$Attribution.ApprovedBy).ToLowerInvariant() -ne ([string]$Attribution.Actor).ToLowerInvariant()) { $a['approvedBy'] = [string]$Attribution.ApprovedBy }
|        $cid = if ([string]$Attribution.CorrelationId) { [string]$Attribution.CorrelationId } else { $CorrelationId }
|        return [pscustomobject]@{ Actor = [string]$Attribution.Actor; After = $a; CorrelationId = $cid; Attributed = $true }
|    }
|    if (-not $a.Contains('initiatedBy')) { $a['initiatedBy'] = 'no person -- the job''s own run (a schedule, an expiry, a retention or its own checks)' }
|    if ($run -and -not $a.Contains('jobRun')) { $a['jobRun'] = $run }
|    [pscustomobject]@{ Actor = $JobActor; After = $a; CorrelationId = $CorrelationId; Attributed = $false }
|}
|
|function Get-SIChangeAttributionPendingSql {
|    <#
|        The committed changes (Kind 'change') of the last @Days days that THIS job has not yet recorded as put in force
|        (no settings.change.apply event of the same commit, target and job) -- oldest first, at most @Max.
|    #>
|@'
|IF OBJECT_ID(N'cfg.ChangeAttribution') IS NOT NULL AND OBJECT_ID(N'cfg.AuditEvent') IS NOT NULL
|SELECT TOP (@Max) a.AttributionId, a.CorrelationId, a.TargetKey, a.Kind, a.Op, a.Title, a.Actor, a.ApprovedBy, a.Source, a.CreatedAt
|FROM cfg.ChangeAttribution AS a
|WHERE a.Kind = N'change' AND a.CreatedAt >= DATEADD(day, -@Days, SYSUTCDATETIME())
|  AND NOT EXISTS (SELECT 1 FROM cfg.AuditEvent AS e
|                  WHERE e.CorrelationId = a.CorrelationId AND e.Action = N'settings.change.apply' AND e.RecordType = N'event'
|                    AND e.Target = LEFT(a.TargetKey, 400) AND e.AfterJson LIKE @JobLike ESCAPE N'\')
|ORDER BY a.AttributionId;
|'@
|}
|
|function Invoke-SIChangeAttributionApply {
|    <#
|        Run start (the settings layer of every Pro job): each change a person committed in the web app since this job last
|        ran is now in force for it -- ONE event 'settings.change.apply' per change and job, Actor = the person who initiated
|        it, After.appliedBy = the job, After.jobRun = the run, After.approvedBy, CorrelationId = the commit id (the same id
|        as the web event and its change rows). A removal is attributed the same way (the row is keyed by its target, not
|        read from the live table). NEVER throws; returns the number recorded.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$Job, [string]$JobRun, [int]$Days = $script:SIAttributionDays, [int]$Max = 500, [scriptblock]$Log)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Warning $msg } }
|    $jobKey = ($Job -replace '[^A-Za-z0-9:._ -]', '').Trim()
|    if (-not $jobKey) { return 0 }
|    $like = '%"appliedJob":"' + ($jobKey -replace '\\', '\\' -replace '%', '\%' -replace '_', '\_' -replace '\[', '\[') + '"%'
|    $rows = @()
|    try { $rows = @(& $Invoke (Get-SIChangeAttributionPendingSql) ([ordered]@{ Days = $Days; Max = $Max; JobLike = $like }) 'reader' | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) }
|    catch { & $Log 'WARN' ("the changes committed in the web app could not be read for the audit trail: {0}" -f $_.Exception.Message); return 0 }
|    $n = 0
|    $actor = Get-SIAuditActor -Job $jobKey
|    foreach ($r in $rows) {
|        $attr = ConvertTo-SIChangeAttribution -Row $r -Via 'store'
|        if (-not $attr) { continue }
|        $after = [ordered]@{ appliedJob = $jobKey; op = $attr.Op; change = $attr.Title }
|        $ok = Write-SIAuditEvent -Invoke $Invoke -Action 'settings.change.apply' -Actor $actor -ActorSource 'job' -Target $attr.TargetKey `
|                -OutcomeText $(if ($attr.Op -eq 'remove') { 'removed -- no longer in force from this run' } else { 'in force from this run' }) `
|                -After $after -Attribution $attr -JobRun $JobRun -Log $Log
|        if ($ok) { $n++ }
|    }
|    $n
|}
|
|function Get-SIAuditHealth {
|    <# How many trail rows this process wrote, and how many it could not (with the last reason). #>
|    if ($null -eq $script:SIAuditHealth) { $script:SIAuditHealth = @{ Written = 0; Failed = 0; LastError = '' } }
|    [pscustomobject]@{ Written = [int]$script:SIAuditHealth.Written; Failed = [int]$script:SIAuditHealth.Failed; LastError = [string]$script:SIAuditHealth.LastError }
|}
|
|function Get-SIAuditSessionContextSql {
|    <# The SESSION_CONTEXT the cfg.ChangeLog trigger reads (the web app's SessionContextSql): change rows join the event. #>
|@'
|EXEC sys.sp_set_session_context @key = N'si.audit.cid', @value = @AuditCid;
|EXEC sys.sp_set_session_context @key = N'si.audit.source', @value = @AuditSource;
|'@
|}
|
|function New-SIAuditInvoke {
|    <#
|        Wraps an -Invoke seam so every batch first stamps the audit context: the cfg.ChangeLog rows the step writes carry
|        -CorrelationId and -ActorSource and show under the step's event on the Audit page. Pure wrapper (no I/O itself).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$CorrelationId, [string]$ActorSource = 'job')
|    $inner = $Invoke; $prefix = Get-SIAuditSessionContextSql; $cid = $CorrelationId; $src = $ActorSource
|    {
|        param([string]$sql, $p, [string]$mode)
|        $q = [ordered]@{}
|        if ($p) { foreach ($k in @($p.Keys)) { $q[$k] = $p[$k] } }
|        $q['AuditCid'] = $cid; $q['AuditSource'] = $src
|        & $inner ($prefix + $sql) $q $mode
|    }.GetNewClosure()
|}
|
|function Resolve-SIAuditRetentionMonths {
|    <#
|        PURE. SI_Pro_AuditRetentionMonths -> @{ Months; Problem }. Not set (or empty) = $null: kept forever. A whole number
|        of at least 13 (AUDIT-1.3: at least as long as Invardia's uplink rows); anything else is refused -- the trail is
|        then kept, never cut shorter by a typo.
|    #>
|    param($Value)
|    if ($null -eq $Value -or "$Value".Trim() -eq '') { return [pscustomobject]@{ Months = $null; Problem = '' } }
|    $n = 0
|    if (-not [int]::TryParse("$Value".Trim(), [ref]$n)) { return [pscustomobject]@{ Months = $null; Problem = ("SI_Pro_AuditRetentionMonths = '{0}' is not a whole number -- the audit trail is kept" -f $Value) } }
|    if ($n -lt $script:SIAuditMinRetentionMonths) { return [pscustomobject]@{ Months = $null; Problem = ("SI_Pro_AuditRetentionMonths = {0} is below the minimum of {1} months -- the audit trail is kept" -f $n, $script:SIAuditMinRetentionMonths) } }
|    [pscustomobject]@{ Months = $n; Problem = '' }
|}
|
|function Get-SIAuditRetentionDeleteSql {
|    <#
|        The ONE removal of trail rows (#289): a call of cfg.AuditRetentionApply (sql\si-pro-settings.sql). The database
|        refuses UPDATE / DELETE on the trail to every identity (DENY); only that procedure removes rows, and it decides
|        what may go: at least 13 months, never younger than that before the server's clock, a batch at a time, for the
|        job identity only. A database without the procedure answers -1 and nothing is removed.
|    #>
|    "IF OBJECT_ID(N'cfg.AuditRetentionApply') IS NULL SELECT -1 AS N; ELSE EXEC cfg.AuditRetentionApply @Months = @Months, @Cutoff = @Cutoff, @Batch = @Batch;"
|}
|
|function Get-SIAuditRetentionCountSql { "IF OBJECT_ID(N'cfg.AuditEvent') IS NULL SELECT -1 AS N; ELSE SELECT COUNT_BIG(*) AS N FROM cfg.AuditEvent WHERE TsUtc < @Cutoff;" }
|
|function Invoke-SIAuditRetention {
|    <#
|        The audited retention step (AUDIT-1.3), run by the data sync job: removes trail rows older than
|        SI_Pro_AuditRetentionMonths, in batches, and records ONE event 'audit.retention.apply' with the cutoff and the
|        count (a dry run counts only and records the plan with WhatIf = 1). Not set = nothing removed, nothing recorded.
|        Returns @{ Months; Cutoff; Removed; Problem; DryRun }.
|    #>
|    param(
|        [Parameter(Mandatory)][scriptblock]$Invoke,
|        $Months,
|        [datetime]$Now = [datetime]::UtcNow,
|        [switch]$DryRun,
|        [string]$Actor,
|        [int]$Batch = 5000,
|        [scriptblock]$Log
|    )
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Host ('[{0}] {1}' -f $level, $msg) } }
|    $cfg = Resolve-SIAuditRetentionMonths -Value $Months
|    $res = [ordered]@{ Months = $cfg.Months; Cutoff = $null; Removed = 0; Problem = $cfg.Problem; DryRun = [bool]$DryRun }
|    if ($cfg.Problem) { & $Log 'WARN' ('audit     : ' + $cfg.Problem); return [pscustomobject]$res }
|    if ($null -eq $cfg.Months) { & $Log 'INFO' 'audit     : SI_Pro_AuditRetentionMonths is not set -- the audit trail is kept in full.'; return [pscustomobject]$res }
|    $cutoff = $Now.ToUniversalTime().AddMonths(-[int]$cfg.Months)
|    $res.Cutoff = $cutoff
|    $cutText = $cutoff.ToString('yyyy-MM-ddTHH:mm:ss', [System.Globalization.CultureInfo]::InvariantCulture)
|    if (-not $Actor) { $Actor = Get-SIAuditActor -Job 'data sync' }
|    $n = [long](& $Invoke (Get-SIAuditRetentionCountSql) @{ Cutoff = $cutText } 'scalar')
|    if ($n -lt 0) { & $Log 'INFO' 'audit     : the Pro database has no audit trail yet -- nothing to keep or remove.'; return [pscustomobject]$res }
|    $after = [ordered]@{ months = [int]$cfg.Months; cutoffUtc = $cutText; rows = $n }
|    if ($DryRun) {
|        & $Log 'INFO' ("audit     : {0} trail row(s) older than {1} month(s) would be removed (before {2:yyyy-MM-dd}); nothing is removed." -f $n, $cfg.Months, $cutoff)
|        [void](Write-SIAuditEvent -Invoke $Invoke -Action 'audit.retention.apply' -Actor $Actor -ActorSource 'job' -Target 'cfg.AuditEvent' -Reason 'SI_Pro_AuditRetentionMonths' -WhatIfRun -After $after -Log $Log)
|        return [pscustomobject]$res
|    }
|    $removed = [long]0
|    try {
|        while ($true) {
|            $k = [long](& $Invoke (Get-SIAuditRetentionDeleteSql) @{ Months = [int]$cfg.Months; Cutoff = $cutText; Batch = $Batch } 'scalar')
|            if ($k -lt 0) {
|                $res.Problem = 'the Pro database does not have the audit retention procedure yet -- apply sql\si-pro-settings.sql (it only adds); the audit trail is kept'
|                & $Log 'WARN' ('audit     : ' + $res.Problem)
|                return [pscustomobject]$res
|            }
|            $removed += $k
|            if ($k -lt $Batch) { break }
|        }
|    } catch {
|        $res.Removed = $removed
|        $after.removed = $removed
|        [void](Write-SIAuditEvent -Invoke $Invoke -Action 'audit.retention.apply' -Actor $Actor -ActorSource 'job' -Target 'cfg.AuditEvent' -Reason 'SI_Pro_AuditRetentionMonths' -Outcome 'error' -OutcomeText $_.Exception.Message -After $after -Log $Log)
|        throw
|    }
|    $res.Removed = $removed
|    $after.removed = $removed
|    [void](Write-SIAuditEvent -Invoke $Invoke -Action 'audit.retention.apply' -Actor $Actor -ActorSource 'job' -Target 'cfg.AuditEvent' -Reason 'SI_Pro_AuditRetentionMonths' -After $after -Log $Log)
|    & $Log 'OK' ("audit     : {0} month(s) -- removed {1} trail row(s) from before {2:yyyy-MM-dd} (recorded on the trail)" -f $cfg.Months, $removed, $cutoff)
|    [pscustomobject]$res
|}
'@ }
$__siSupportFiles['config/audit-actions.locked.json'] = @{ Sha256 = '6e82a29f1e11640b90b755cd19d21384802eee0faf132ea41ab32f231edfcf8b'; Text = @'
|{
|  "_": "THE CLOSED LIST of audit actions of SecurityInsight Pro (#260, framework AUDIT-1.1). Read by BOTH writers: the web app (SI.Management.Web Audit/AuditActions.cs, linked into the build) and PowerShell (engine/pro-settings/SI-Audit.ps1, Write-SIAuditEvent). A test compares the two lists, a test checks every [Audit] handler names an action listed here, and a test checks the trigger's category CASE in sql/si-pro-settings.sql against changeCategories. An action is lower-case domain.object.verb. Adding one = one entry here; renaming one breaks the history of the old name -- add, never rename.",
|  "actorSources": [ "web", "job", "engine", "setup", "api", "portal" ],
|  "outcomes": [ "ok", "error", "refused", "held" ],
|  "changeCategories": [ "setting", "document", "item", "template", "licence", "access", "exemption", "domainrole", "cmdb", "connector", "department", "signin", "finding", "governance", "remediation", "responsibility", "job", "magiclink", "other" ],
|  "changeVerbs": [ "set", "reset" ],
|  "actions": [
|    { "action": "access.assignment.save", "source": "web", "what": "a role / scope assignment created or changed (Configuration > Access (roles + scopes))" },
|    { "action": "access.assignment.remove", "source": "web", "what": "a role / scope assignment removed (Configuration > Access (roles + scopes))" },
|    { "action": "audit.trail.export", "source": "web", "what": "the audit trail exported (CSV or Excel) -- the filter and the row count" },
|    { "action": "audit.trail.print", "source": "web", "what": "the audit trail's print view opened (evidence)" },
|    { "action": "audit.retention.apply", "source": "job", "what": "audit rows older than the retention removed by the data sync's retention step" },
|    { "action": "changes.batch.commit", "source": "web", "what": "staged changes committed (Review & commit) -- each change also has its change row" },
|    { "action": "changes.batch.discard", "source": "web", "what": "staged changes discarded (Review & commit)" },
|    { "action": "closeloop.connector.apply", "source": "job", "what": "the vulnerability close-loop applied one connector's plan (opened / reopened / closed / errors)" },
|    { "action": "closeloop.connector.rekey", "source": "job", "what": "the vulnerability close-loop moved one record to its asset's current id, or retired it as a duplicate of the record that keeps the finding (never as fixed)" },
|    { "action": "config.commit.undo", "source": "web", "what": "a commit undone (framework CONFIG-1.2): the inverse of the chosen records committed through Review & commit, journaled with Source undo and the commit it reverses" },
|    { "action": "config.undo.stage", "source": "web", "what": "the inverse of a commit staged for Review & commit (Operations > Commits (undo)); nothing is written until it is committed" },
|    { "action": "config.backup.take", "source": "web", "what": "a configuration backup taken: by the daily backup job or Back up now -- a copy, or 'no change' recorded without a copy" },
|    { "action": "config.backup.prune", "source": "job", "what": "configuration backups older than the retention removed by the backup job (pinned ones and content a kept backup points at stay)" },
|    { "action": "config.backup.pin", "source": "web", "what": "a configuration backup pinned (kept past the retention) or unpinned" },
|    { "action": "config.backup.export", "source": "web", "what": "a configuration backup downloaded as a signed file" },
|    { "action": "config.backup.import", "source": "web", "what": "a configuration backup file imported as a backup (its signature verified, or accepted unverified by an explicit tick)" },
|    { "action": "config.backup.restore", "source": "web", "what": "records restored from a configuration backup (framework CONFIG-1.4): chosen per record, staged, committed through Review & commit with Source restore" },
|    { "action": "config.restore.stage", "source": "web", "what": "records chosen from a backup staged for Review & commit (or sent to a second SuperAdmin); nothing is written until committed" },
|    { "action": "config.approval.request", "source": "web", "what": "a guard release or a restore asked of a second SuperAdmin (framework CONFIG-1.5, setting SIWeb_ConfigSecondPerson)" },
|    { "action": "config.approval.decide", "source": "web", "what": "a second SuperAdmin approved or rejected a guard release or a restore asked by someone else" },
|    { "action": "config.journal.prune", "source": "job", "what": "change journal rows older than SI_Pro_ConfigJournalRetentionDays removed (never shorter than the backup retention)" },
|    { "action": "config.io.export", "source": "web", "what": "the configuration exported to a signed file (framework CONFIG-IO-1): all of it or the chosen sections -- never a secret value" },
|    { "action": "config.io.inspect", "source": "web", "what": "a configuration file uploaded on Export / Import and compared with the configuration now (signature, version and tenant checked); nothing is written" },
|    { "action": "config.io.preview", "source": "web", "what": "the chosen items of an uploaded configuration file previewed (WhatIf): what Apply would stage; nothing is written" },
|    { "action": "config.io.stage", "source": "web", "what": "the chosen items of an uploaded configuration file staged for Review & commit (or sent to a second SuperAdmin), the file kept as a backup" },
|    { "action": "connector.collection.resend", "source": "web", "what": "an earlier collection sent again into a connector by hand (the request, and the job that ran it through the connector's normal path and guards)" },
|    { "action": "connector.run.undo", "source": "web", "what": "the last run of a connector undone where the connector can reverse it (the request, and the job that put the items back)" },
|    { "action": "cmdb.service.add", "source": "web", "what": "a business service added to the SecurityInsight CMDB" },
|    { "action": "cmdb.service.save", "source": "web", "what": "a business service changed" },
|    { "action": "cmdb.service.retire", "source": "web", "what": "a business service retired" },
|    { "action": "cmdb.import.upload", "source": "web", "what": "an external CMDB CSV uploaded as the new snapshot" },
|    { "action": "cmdb.import.migrate", "source": "web", "what": "a v2.2 CMDB.csv migrated into the SecurityInsight CMDB" },
|    { "action": "cmdb.link.stage", "source": "web", "what": "a service-map link change staged" },
|    { "action": "cmdb.source.save", "source": "web", "what": "the authoritative CMDB source changed" },
|    { "action": "cmdb.ci.sync", "source": "job", "what": "the SQL CMDB connector wrote (or, as a plan, would write) the CI table in the Pro database: created / updated / absent / retired CIs, or why the run was refused" },
|    { "action": "cmdb.asset.retire", "source": "job", "what": "an asset SecurityInsight no longer sees was retired after the grace period of its category (#406): its open vulnerabilities close as AssetRetired, its CI is retired, ServiceNow gets u_si_state = retired" },
|    { "action": "cmdb.asset.reactivate", "source": "job", "what": "a retired or no-longer-seen asset was seen again and is active again (#406); its findings reopen" },
|    { "action": "cmdb.asset.retire-early", "source": "web", "what": "an Admin retired an asset SecurityInsight no longer sees before its grace period ended (Assets & services > CMDB > Not seen anymore, #406)" },
|    { "action": "connector.definition.stage", "source": "web", "what": "a connector definition staged" },
|    { "action": "connector.removal.stage", "source": "web", "what": "a connector's removal staged" },
|    { "action": "connector.state.stage", "source": "web", "what": "a connector's enable / disable staged" },
|    { "action": "connector.servicenow.verify", "source": "web", "what": "a ServiceNow check asked for (the connection, the Import Set table, its columns and its column mapping): the mail job runs it with its own identity and records the result; the web app never signs in to ServiceNow" },
|    { "action": "data.export.download", "source": "web", "what": "data exported (CSV / Excel) -- the page, the filter and the row count" },
|    { "action": "data.store.reset", "source": "setup", "what": "a fresh start of the install's data (setup\\Reset-SIData.ps1): every data table emptied in place (the identity ledger only with -IncludeIdentityLedger), the configuration, users and grants kept -- the rows per table, whether the ledger was emptied, whether another system's keys were accepted as lost, the read-back" },
|    { "action": "datamodel.item.stage", "source": "web", "what": "a risk factor or provider mapping of the Pro data model changed, turned off or put back (Configuration > Risk factors), staged" },
|    { "action": "cioverride.set.stage", "source": "web", "what": "a manual override of one CI field (tier, purpose, category, department or a CMDB field) set or changed, with its reason and expiry, staged" },
|    { "action": "cioverride.remove.stage", "source": "web", "what": "the removal (soft) of a manual CI override staged" },
|    { "action": "cisuspect.decide.stage", "source": "web", "what": "a decision about a group of correlation suspects staged -- the same machine (the next CI build merges them) or not the same machine, with its reason" },
|    { "action": "cisuspect.remove.stage", "source": "web", "what": "the removal (soft) of a correlation decision staged -- a \"same machine\" decision is split again by the next CI build" },
|    { "action": "cibuild.cutoff.set", "source": "setup", "what": "the one-time CI cut-off set (setup\\Set-SICiCutoff.ps1, hidden -- not a setting; #1100): the CI build ignores the records collected before it and retires at once the CIs built only from them -- the time, the reason, the CIs counted to retire, the data-out outputs that are on" },
|    { "action": "cibuild.cutoff.clear", "source": "setup", "what": "the one-time CI cut-off taken back (setup\\Set-SICiCutoff.ps1 -Clear; #1100): the row is kept, marked cleared; the CIs it already retired stay retired until a source records them again" },
|    { "action": "support.consent.applied", "source": "job", "what": "the Invardia Support app's consent level the customer set in the Invardia portal, applied by the updater from its own call to Invardia (troubleshoot / setup, or none = the consent removed), read back; with the level before and after" },
|    { "action": "riskanalysis.bucket-reset.stage", "source": "web", "what": "a one-time reset of a Risk Analysis report's bucket count (or of every report) staged on Operations > Risk Analysis query splitting: who, why, which report" },
|    { "action": "riskanalysis.source-accept.stage", "source": "web", "what": "a source that went silent accepted as empty for good for one Risk Analysis report, staged on Run health > Risk Analysis reports: who, why, which report and source" },
|    { "action": "riskanalysis.source-accept-undo.stage", "source": "web", "what": "an acceptance of a report's empty source undone, staged on Run health > Risk Analysis reports: who, why, which acceptance" },
|    { "action": "rulepack.decision.stage", "source": "web", "what": "a CI rule pack turned on or off, staged for testing, promoted to live or put back to testing (Configuration > Rule packs), staged" },
|    { "action": "rulepack.reset.stage", "source": "web", "what": "a CI rule pack put back to its shipped version (the customer's decision removed), staged" },
|    { "action": "datasync.asset.merge", "source": "job", "what": "the data sync merged duplicate assets of one device into the asset that carries its id (each pair, the findings moved)" },
|    { "action": "datasync.reportname.backfill", "source": "job", "what": "the data sync filled the report of stored findings that had none, from each finding's own data" },
|    { "action": "datasync.responsibility.resolve", "source": "job", "what": "the data sync resolved findings to departments with the current responsibility policy" },
|    { "action": "datasync.assetproperties.prune", "source": "job", "what": "the data sync removed full asset metadata older than its retention (SI_AssetProperties_RetentionDays) from the Pro database" },
|    { "action": "datasync.collection.retention", "source": "job", "what": "the data sync removed the finding rows of collections older than the newest complete one and the one before it, and of collections a stopped run left loading (each collection and the rows per table)" },
|    { "action": "datasync.collection.finish", "source": "job", "what": "the data sync completed a collection whose Risk Analysis run stopped after its verdicts were final, before the run marked it (the collection, its reports and rows, whether it was partial)" },
|    { "action": "department.advisor.add", "source": "web", "what": "an external advisor added to a department" },
|    { "action": "department.advisor.revoke", "source": "web", "what": "an external advisor revoked" },
|    { "action": "department.department.create", "source": "web", "what": "a department created" },
|    { "action": "department.department.save", "source": "web", "what": "a department changed" },
|    { "action": "department.department.retire", "source": "web", "what": "a department retired" },
|    { "action": "department.member.add", "source": "web", "what": "a person added to a department" },
|    { "action": "department.member.remove", "source": "web", "what": "a person removed from a department" },
|    { "action": "department.member.set", "source": "web", "what": "a department's people table saved: people added to and removed from their roles" },
|    { "action": "domainrole.member.add", "source": "web", "what": "a security owner added (Configuration > Security owners): a Domain Owner, a Category Owner or a domain approver" },
|    { "action": "domainrole.member.remove", "source": "web", "what": "a security owner removed (Configuration > Security owners): a Domain Owner, a Category Owner or a domain approver" },
|    { "action": "exemption.finding.stage", "source": "web", "what": "an exemption of a finding staged (findings browser / finding page)" },
|    { "action": "exemption.request.submit", "source": "web", "what": "an exemption request submitted" },
|    { "action": "exemption.request.approve", "source": "web", "what": "an exemption request approved" },
|    { "action": "exemption.bulk.refuse", "source": "web", "what": "a request for ALL matching findings refused by the bulk guard (no narrowing filter, or more than SIWeb_Exemption_BulkMax) -- the reason and the request" },
|    { "action": "exemption.request.reject", "source": "web", "what": "an exemption request rejected" },
|    { "action": "exemption.review.record", "source": "web", "what": "exemptions reviewed (kept / ended) by a domain owner" },
|    { "action": "exemption.revoke.stage", "source": "web", "what": "an exemption's revocation staged" },
|    { "action": "finding.comment.add", "source": "web", "what": "a comment / recommendation / approval left on a finding" },
|    { "action": "finding.link.create", "source": "web", "what": "two or more findings of one CI linked into one finding (the finding that stays, who and why; one recommendation-equivalence link item)" },
|    { "action": "finding.link.remove", "source": "web", "what": "an operator's link of findings undone -- the link kept as history, marked not used (who and why)" },
|    { "action": "finding.task.cancel", "source": "web", "what": "a follow-up task on a finding cancelled (Tasks)" },
|    { "action": "finding.task.complete", "source": "web", "what": "a follow-up task on a finding completed (Tasks)" },
|    { "action": "finding.task.create", "source": "web", "what": "follow-up tasks created on one or more findings (Tasks > New, a finding's thread)" },
|    { "action": "finding.task.reopen", "source": "web", "what": "a completed or cancelled follow-up task reopened (Tasks)" },
|    { "action": "finding.action.apply", "source": "web", "what": "a request to the shared action bar (Actions > Apply) that named no known action -- a request that names one is recorded under that action's own name, with the outcome per finding" },
|    { "action": "getstarted.step.save", "source": "web", "what": "a Get Started step saved: its settings (the same rows as Settings), a person or group given a role, a collection started or a test mail queued" },
|    { "action": "getstarted.reminder.send", "source": "job", "what": "the daily Get Started reminder queued for the alert recipients while a required step is open (framework MAIL-2 item 8)" },
|    { "action": "governance.action.apply", "source": "web", "what": "a remediation action or status applied to a finding" },
|    { "action": "governance.status.set", "source": "web", "what": "the governance status of 1..N findings set with a comment (the shared action bar), the outcome per finding" },
|    { "action": "governance.vendor.escalate", "source": "web", "what": "1..N findings escalated to the vendor of their remediation flow (the shared action bar), the outcome per finding" },
|    { "action": "governance.mail.send", "source": "job", "what": "a queued governance (vendor) mail sent" },
|    { "action": "governance.notice.send", "source": "job", "what": "a department's new-findings mail sent" },
|    { "action": "governance.review.send", "source": "job", "what": "a department's monthly technical review sent" },
|    { "action": "governance.remediation.schedule", "source": "job", "what": "findings planned into a maintenance window by an automatic remediation flow" },
|    { "action": "guard.release.approve", "source": "web", "what": "an Admin released, once, the vulnerability closes a close limit held in one connector run (Operations > Guards (safety checks), the guard mail link, or -ReleaseHeldCloses on the command line)" },
|    { "action": "guard.release.apply", "source": "job", "what": "a job applied a released held set: the vulnerability connector's closes (how many closed, how many came back and stayed open), or the data sync loading a released Risk Analysis collection once, marked partial" },
|    { "action": "guard.release.supersede", "source": "job", "what": "a job closed an older held set because a newer run of the same safety check decided again under the current rules (a newer collection is loaded, a run was within the limit, or a newer set is held) -- only current holds are shown" },
|    { "action": "guard.collection.release", "source": "web", "what": "an Admin released, once and with a reason, a Risk Analysis collection the data sync held because its run was not complete: the next data sync loads it, marked partial wherever it is shown (Operations > Guards (safety checks))" },
|    { "action": "guard.event.acknowledge", "source": "web", "what": "an Admin acknowledged a guard event (and later repeats of exactly it): it is hidden by default on Operations > Guards (safety checks); nothing else changes" },
|    { "action": "guard.event.clear", "source": "job", "what": "a guard cleared itself: a later complete run was back at the normal level (typically the first run on a release that fixed the cause) -- which guard, the run and the version; Invardia is told so its ticket closes" },
|    { "action": "guard.event.accept", "source": "setup", "what": "the owner accepted a guard situation at this install (a guard and a version range, or one guard key), through the Invardia Support app or the guard mail's link: who, why, the owner's own words, the version that caused it; its trips acknowledged, its episodes cleared, held sets released once through the release path" },
|    { "action": "guard.event.trip", "source": "job", "what": "a guard held, refused or halted a step to protect data: which guard, the numbers against the limit, what was held, whether the mail and the report to Invardia went out" },
|    { "action": "data-health.override.set", "source": "web", "what": "a SuperAdmin let one data-out channel send while SecurityInsight's data is Unhealthy, with a reason (Configuration > Connectors > Data-health hold); it lasts until the data is Healthy again" },
|    { "action": "data-health.override.clear", "source": "web", "what": "a SuperAdmin took back a data-out channel they had let through while the data is Unhealthy: the channel plans only again (Configuration > Connectors > Data-health hold)" },
|    { "action": "performance.size.request", "source": "web", "what": "an Admin asked for another size of the main database or the web app (Operations > Performance): the customer's setting is saved, the updater applies it (up or down) on its next run" },
|    { "action": "performance.size.apply", "source": "web", "what": "a SuperAdmin started the updater from Operations > Performance so a size asked for is applied now instead of at the next update" },
|    { "action": "guard.strict.end-early", "source": "web", "what": "a SuperAdmin ended, with a reason, the stricter period of the safety checks early (their limits are halved for 24 hours after a release that changed engine code); the normal limits apply again from then on (Operations > Guards (safety checks))" },
|    { "action": "guard.control.save", "source": "web", "what": "a SuperAdmin turned a safety check (or its mail, or every check) on or off, or changed its limit, on Operations > Guards (safety checks): the same settings as Settings > Guards, with the values before and after" },
|    { "action": "job.execution.start", "source": "web", "what": "a container job started now" },
|    { "action": "job.schedule.disable", "source": "web", "what": "a container job disabled" },
|    { "action": "job.schedule.enable", "source": "web", "what": "a container job enabled" },
|    { "action": "job.schedule.change", "source": "web", "what": "a container job's schedule changed" },
|    { "action": "job.flow.start", "source": "web", "what": "Run now on the daily pipeline, one of its stages or one step (queued until nothing else runs), or a re-run from a step (Operations > Jobs, #269, #306)" },
|    { "action": "job.flow.cancel", "source": "web", "what": "a Run now request taken out of the pipeline's queue before it started (Operations > Jobs, #306)" },
|    { "action": "job.flow.change", "source": "web", "what": "the daily pipeline changed: when it runs (time, time zone), a step added / removed / moved / moved to another stage / edited, a stage's failure rule (Operations > Jobs, #269, #306)" },
|    { "action": "job.flow.mode", "source": "web", "what": "the jobs switched between one flow and a timer per job, every job's trigger as previewed (Operations > Jobs, #269)" },
|    { "action": "job.flow.run", "source": "job", "what": "one run of the daily job flow ended: its trigger and each step's outcome (the flow runner, #269)" },
|    { "action": "job.flowrun.cancel", "source": "web", "what": "the RUNNING pipeline run cancelled by a person, with the reason: marked cancelled (never resumed), the lock released, the runner started to stop its job executions (Operations > Jobs, #700)" },
|    { "action": "job.flowrun.stop", "source": "job", "what": "a cancelled pipeline run's job executions stopped and the lock released -- asked from Operations > Jobs, by a support start of the runner, or by the update (a run that started on another version) (#700)" },
|    { "action": "licence.licence.install", "source": "setup", "what": "a licence installed into Key Vault (Set-SILicense)" },
|    { "action": "licence.request.send", "source": "job", "what": "the updater job asked Invardia for this install's licence by itself (none, ending within 30 days, or in its grace period)" },
|    { "action": "licence.request.install", "source": "job", "what": "the updater job installed the licence Invardia approved, after checking it (also mailed)" },
|    { "action": "licence.request.fail", "source": "job", "what": "an automatic licence request did not succeed: rejected, refused as incomplete, not reachable, or the licence sent did not pass the checks (also mailed)" },
|    { "action": "magiclink.link.issue", "source": "web", "what": "a one-page magic link issued (Configuration > Settings > E-mail + links)" },
|    { "action": "mail.test.send", "source": "web", "what": "a test mail queued from Settings > E-mail (sent by the mail job through the one mail transport)" },
|    { "action": "mail.restriction.verify", "source": "web", "what": "the mail job started to check again that Mail.Send is restricted to the shared mailbox (home banner Verify)" },
|    { "action": "mail.sharedmailbox.configure", "source": "web", "what": "the guided mail setup run for a shared mailbox (create, Exchange scope, role assignment, verify, settings, test mail) -- each step and its outcome" },
|    { "action": "mail.smtp.configure", "source": "web", "what": "the guided mail setup saved an SMTP relay (password only as a Key Vault secret name) and queued a test mail" },
|    { "action": "mail.smtp.keep", "source": "web", "what": "the SMTP relay kept by choice (home banner Ignore) or no longer (Settings > E-mail Undo): SI_Mail_SmtpKept written through the settings writer" },
|    { "action": "remediation.flow.add", "source": "web", "what": "a remediation flow added" },
|    { "action": "remediation.flow.retire", "source": "web", "what": "a remediation flow retired" },
|    { "action": "responsibility.rule.add", "source": "web", "what": "a responsibility rule added" },
|    { "action": "responsibility.rule.remove", "source": "web", "what": "a responsibility rule removed" },
|    { "action": "responsibility.override.set", "source": "web", "what": "an asset / recommendation assigned to a department by hand" },
|    { "action": "responsibility.override.revoke", "source": "web", "what": "a hand assignment revoked" },
|    { "action": "responsibility.assignment.bulk", "source": "web", "what": "rows of a department grid assigned to a department in bulk" },
|    { "action": "riskindex.draft.check", "source": "web", "what": "the risk index draft validated and dry-run over current findings (WhatIf; nothing stored)" },
|    { "action": "riskindex.draft.import", "source": "web", "what": "a risk index CSV (v2.2 or v3) imported into the draft (nothing stored until staged)" },
|    { "action": "riskindex.draft.sort", "source": "web", "what": "the risk index draft sorted by specificity (nothing stored until staged)" },
|    { "action": "riskindex.index.stage", "source": "web", "what": "an edited risk index staged for Review & commit (Configuration > Risk index); the commit is changes.batch.commit and its rows item.change.set" },
|    { "action": "report.scope.change", "source": "web", "what": "a Risk Analysis report's severity / tier scope, switch or back-to-vendor staged (Reports & outputs > Report catalog, one report or a bulk selection)" },
|    { "action": "report.template.change", "source": "web", "what": "a report template created, copied, renamed, retired or its reports changed, staged (Reports & outputs > Report templates)" },
|    { "action": "report.custom.create", "source": "web", "what": "a custom report (your own query) staged, with its links into report templates (Reports & outputs > Custom reports)" },
|    { "action": "report.custom.remove", "source": "web", "what": "a custom report's removal staged (and its links out of report templates)" },
|    { "action": "report.summary.save", "source": "web", "what": "a management summary report added or changed: sections, data, recipients, schedule (Reports & outputs > Management summary)" },
|    { "action": "report.summary.remove", "source": "web", "what": "a management summary report removed (nothing more is sent)" },
|    { "action": "report.summary.send", "source": "web", "what": "a management summary queued for its recipients -- sent now by a person, or by its schedule (one per period)" },
|    { "action": "report.presentation.download", "source": "web", "what": "a management presentation (PowerPoint) downloaded -- the run, the run compared with, the sections and the audience" },
|    { "action": "report.custom.test", "source": "web", "what": "a report query tested read-only against the workspace (capped, timed out; WhatIf, nothing stored)" },
|    { "action": "report.environment.export", "source": "web", "what": "the environment report exported as JSON (framework ENV-REPORT-1): names, ids and states only" },
|    { "action": "notify.recipient.save", "source": "web", "what": "a mail recipient's notifications saved or a recipient added (audience, reports and alerts on or off); a recipient who was not a user added as Reader" },
|    { "action": "notify.recipient.remove", "source": "web", "what": "a mail recipient's saved notification choices removed (their role is not changed)" },
|    { "action": "output.scope.change", "source": "web", "what": "the output scope of a destination (Excel + mail, a vulnerability or CMDB connector) staged (Reports & outputs > Output scope)" },
|    { "action": "secret.value.set", "source": "web", "what": "a secret's value set by a SuperAdmin (Set value, #822): the secret's NAME, who and when -- handed to the updater encrypted, never the value" },
|    { "action": "exclusions.document.stage", "source": "web", "what": "Risk Analysis exclusions (global or one report) staged from the Exclusions editor" },
|    { "action": "exclusions.draft.import", "source": "web", "what": "a v2.2 exclusions file read into the Exclusions editor (nothing stored until staged)" },
|    { "action": "weights.document.stage", "source": "web", "what": "weighted risk factors (the solution's or one report's) staged from the Weights editor" },
|    { "action": "rules.draft.check", "source": "web", "what": "a profiling rule draft re-shaped, switched between form and YAML, or checked (WhatIf; nothing stored)" },
|    { "action": "rules.rule.stage", "source": "web", "what": "a profiling rule change (save / turn off / reset / remove) staged for Review & commit; the commit is changes.batch.commit and its row item.change.set" },
|    { "action": "schemaoverlay.draft.check", "source": "web", "what": "a schema overlay draft re-shaped or checked (WhatIf; nothing stored)" },
|    { "action": "schemaoverlay.overlay.stage", "source": "web", "what": "a schema overlay (save / remove) staged for Review & commit; the commit is changes.batch.commit and its row item.change.set" },
|    { "action": "outputmap.column.stage", "source": "web", "what": "an output column change (change / remove / restore / add) staged for Review & commit; the commit is changes.batch.commit and its row item.change.set" },
|    { "action": "tagging.draft.check", "source": "web", "what": "an asset tag draft re-shaped or checked (WhatIf; nothing stored)" },
|    { "action": "tagging.tag.stage", "source": "web", "what": "an asset tag change (save / turn off / reset / remove) staged for Review & commit; the commit is changes.batch.commit and its row item.change.set" },
|    { "action": "tagging.gates.stage", "source": "web", "what": "the asset tagging gates and device-name patterns staged for Review & commit" },
|    { "action": "settings.value.save", "source": "web", "what": "a setting saved (licence request settings included)" },
|    { "action": "update.installkey.claim-again", "source": "web", "what": "an Admin asked the updater to claim the install key from Invardia once more after Invardia reset it (Settings > Updates; offered only while the claim is held)" },
|    { "action": "settings.document.stage", "source": "web", "what": "a structured setting (document) staged" },
|    { "action": "settings.document.stage-reset", "source": "web", "what": "a structured setting's reset staged" },
|    { "action": "settings.import.apply", "source": "setup", "what": "settings imported from the files into the Pro database (Import-SIProSettings)" },
|    { "action": "settings.change.apply", "source": "job", "what": "a job put in force, at its next run, a change a person committed in the web app (a setting, a document, a rule, a tag, a schema overlay, a report, a CMDB link, a connector, an approved exemption request) -- the actor is the person who initiated it, approvedBy the approver, appliedBy the job; a removal is attributed too" },
|    { "action": "signin.link.issue", "source": "web", "what": "a department sign-in link issued to a person" },
|    { "action": "signin.link.revoke", "source": "web", "what": "a department sign-in link revoked" },
|    { "action": "signin.link.request", "source": "portal", "what": "a sign-in link requested from the sign-in page (answered the same whatever the address)" },
|    { "action": "signin.link.redeem", "source": "portal", "what": "a magic link or department sign-in link redeemed -- or refused" },
|    { "action": "signin.code.send", "source": "portal", "what": "the second check: a one-time code mailed" },
|    { "action": "signin.code.verify", "source": "portal", "what": "the second check: a one-time code entered (passed or failed)" },
|    { "action": "signin.session.end", "source": "web", "what": "a sign-out" },
|    { "action": "template.conformance.stage", "source": "web", "what": "take / keep of a template item staged" },
|    { "action": "template.release.stage", "source": "web", "what": "a template pack release staged" },
|    { "action": "template.rollback.stage", "source": "web", "what": "a template roll back staged" },
|    { "action": "template.pack.publish", "source": "setup", "what": "templates published / adopted into the Pro database (Publish-SITemplates)" },
|    { "action": "tier.change.stage", "source": "web", "what": "a tier move / rule override staged (tier board)" },
|    { "action": "verification.decision.save", "source": "web", "what": "a data-collection gap of the verification service ignored or accepted, or its decision reviewed (Operations > Verification (data gaps)): who, why, the reviewer and the review date" },
|    { "action": "verification.decision.revoke", "source": "web", "what": "the decision on a data-collection gap withdrawn (Operations > Verification (data gaps)): the gap is open again" },
|    { "action": "view.pivot.save", "source": "web", "what": "a pivot of the weighted risk page saved as a named view (personal, or shared by an Admin)" },
|    { "action": "view.pivot.remove", "source": "web", "what": "a saved pivot view removed (the owner's own, or a shared one by an Admin)" },
|    { "action": "view.columns.save", "source": "web", "what": "the columns of a grid saved (a person's own, or the tenant default by an Admin)" },
|    { "action": "view.columns.reset", "source": "web", "what": "a grid's saved columns removed (a person's own -- back to the tenant default -- or the tenant default by an Admin)" },
|    { "action": "view.state.save", "source": "web", "what": "a person's last sort / filters / search of a data view remembered (rows of an earlier version only: a person's own sort, filters and widths are no longer recorded -- the trail records layouts)" },
|    { "action": "view.state.clear", "source": "web", "what": "a person's remembered sort / filters of a data view cleared (rows of an earlier version only: no longer recorded)" },
|    { "action": "view.widths.save", "source": "web", "what": "a person's column widths of a data view saved (rows of an earlier version only: no longer recorded)" },
|    { "action": "view.layout.save", "source": "web", "what": "a named layout of a data view saved (a person's own, or for everyone by an Admin): columns, order, sort, filters and widths" },
|    { "action": "view.layout.apply", "source": "web", "what": "a named layout of a data view chosen: it becomes the person's set-up of that view (rows of an earlier version only: choosing a layout is no longer recorded -- saving, renaming, deleting and publishing one are)" },
|    { "action": "view.layout.rename", "source": "web", "what": "a named layout of a data view renamed (a person's own, or a published one by an Admin)" },
|    { "action": "view.layout.delete", "source": "web", "what": "a named layout of a data view deleted (a person's own, or a published one by an Admin)" },
|    { "action": "view.layout.publish", "source": "web", "what": "a named layout of a data view published for everyone by an Admin" },
|    { "action": "view.layout.pin", "source": "web", "what": "a named layout pinned to the menu: in the person's own My views, or for everyone by an Admin (a published layout)" },
|    { "action": "view.layout.unpin", "source": "web", "what": "a named layout taken off the menu: from the person's own My views, or from everyone's menu by an Admin" },
|    { "action": "web.request.refused", "source": "web", "what": "a request refused by the role framework before any handler ran" },
|    { "action": "web.handler.unlisted", "source": "web", "what": "SAFETY NET: a mutating request whose handler names no action (a test keeps this at zero)" }
|  ]
|}
'@ }
$__siSupportFiles['engine/_shared/SI-InstallRing.ps1'] = @{ Sha256 = '172d3c05df58445ebed9db3c754234cdecca4cee934b14486c6ccc5971b64f8f'; Text = @'
|#Requires -Version 5.1
|<#
|.SYNOPSIS
|    SecurityInsight Pro -- THIS INSTALL'S UPDATE RING, recorded once where everyone reads it (#308).
|
|.DESCRIPTION
|    The ring is a property of the INSTALL, known when it is installed -- not something only an updater run discovers.
|    ONE record: the Pro database row cfg.InstallState 'Ring', compact JSON
|
|        { "ring": 1, "channel": "internal", "setBy": "bootstrap", "source": "setting", "setAt": "2026-10-05T10:00:00Z" }
|
|    written by every path that knows the ring:
|      setup\Set-SIInstallRing.ps1   the command an admin (or a build script) runs -- also what the guided install and
|                                    Bootstrap-ContainerAppJob.ps1 call
|      the updater job               whenever it resolves a ring (Invardia's manifest; the release map on the feed path)
|
|    WHICH RING a writer records -- Resolve-SIInstallRing:
|      1. the ring the writer was GIVEN (-Ring on the command line; the ring the updater resolved)   source 'parameter' / 'updater'
|      2. the admin's setting SI_UpdateRing (0-3) in the Pro database, else in the configuration       source 'setting'
|      3. the ring in the install's resource-group name (rg-si-r1-pro-ca = 1; rg-si-prod-... = 3)     source 'resource-group'
|    Source 3 is derived, so it never replaces a row that is already there; 1 and 2 always write.
|
|    The web app's header reads, in order: the updater's state (UpdateState) > this row > the setting.
|
|    Rings are the framework's: 0 dev, 1 internal, 2 design partners / early release, 3 broad.
|    Everything here is PURE except Save-SIInstallRing / Read-SIInstallRing / Read-SIUpdateRingSetting, which go through
|    the store seam ($Store.Invoke(sql, params, mode)) the rest of the Pro code uses. Never writes outside cfg.InstallState.
|    Windows PowerShell 5.1 and PowerShell 7.
|#>
|
|$script:SIInstallRingStateName = 'Ring'
|$script:SIUpdateRingSettingName = 'SI_UpdateRing'
|$script:SIInstallRingSources = @('parameter', 'updater', 'setting', 'resource-group')
|
|function ConvertTo-SIUpdateRing {
|    <#
|        PURE. A ring in any of the forms the product uses -> 0..3, or $null when it is not one.
|        0..3 (number or text), 'r0'..'r3', 'ring 1', and the setup naming's 'prod' (a production install = 3, broad).
|    #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [bool]) { return $null }
|    $t = ("$Value").Trim().ToLowerInvariant()
|    if (-not $t) { return $null }
|    if ($t -eq 'prod') { return 3 }
|    $t = $t -replace '^(ring\s*|r)', ''
|    $n = 0
|    if (-not [int]::TryParse($t, [System.Globalization.NumberStyles]::Integer, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n)) { return $null }
|    if ($n -lt 0 -or $n -gt 3) { return $null }
|    [int]$n
|}
|
|function Get-SIRingFromResourceGroupName {
|    <# PURE. The ring in a resource group named by setup's pattern (rg-si-<r0|r1|r2|prod>-<edition>-<hosting>), else $null. #>
|    param([AllowNull()][AllowEmptyString()][string]$ResourceGroupName)
|    if ("$ResourceGroupName" -cmatch '^rg-si-(r0|r1|r2|prod)-(community|pro)-(ca|vm)(-[a-z0-9][a-z0-9-]*)?$') { return (ConvertTo-SIUpdateRing $Matches[1]) }
|    $null
|}
|
|function Resolve-SIInstallRing {
|    <#
|        PURE. Which ring a writer records, and why. -Ring = the ring the writer was given (a parameter, or the ring the
|        updater resolved; -RingSource says which); -Setting = SI_UpdateRing; -ResourceGroupName = the install's resource
|        group. Returns @{ Ring; Source; Weak; Problems } -- Ring $null = nothing known (write nothing).
|    #>
|    param([AllowNull()]$Ring, [ValidateSet('parameter', 'updater')][string]$RingSource = 'parameter', [AllowNull()]$Setting,
|          [AllowNull()][AllowEmptyString()][string]$ResourceGroupName)
|    $problems = New-Object System.Collections.Generic.List[string]
|    $given = ConvertTo-SIUpdateRing $Ring
|    if ($null -ne $Ring -and "$Ring".Trim() -and $null -eq $given) { $problems.Add(("'{0}' is not an update ring (0, 1, 2 or 3)" -f $Ring)) }
|    $set = ConvertTo-SIUpdateRing $Setting
|    if ($null -ne $Setting -and "$Setting".Trim() -and $null -eq $set) { $problems.Add(("the setting {0} = '{1}' is not an update ring (0, 1, 2 or 3) -- ignored" -f $script:SIUpdateRingSettingName, $Setting)) }
|    if ($null -ne $given) { return [pscustomobject]@{ Ring = $given; Source = $RingSource; Weak = $false; Problems = $problems.ToArray() } }
|    if ($null -ne $set) { return [pscustomobject]@{ Ring = $set; Source = 'setting'; Weak = $false; Problems = $problems.ToArray() } }
|    $rg = Get-SIRingFromResourceGroupName -ResourceGroupName $ResourceGroupName
|    if ($null -ne $rg) { return [pscustomobject]@{ Ring = $rg; Source = 'resource-group'; Weak = $true; Problems = $problems.ToArray() } }
|    [pscustomobject]@{ Ring = $null; Source = ''; Weak = $false; Problems = $problems.ToArray() }
|}
|
|function ConvertTo-SIInstallRingJson {
|    <# PURE. The row's value: compact JSON { ring, channel, setBy, source, setAt } (cfg.InstallState.Value is NVARCHAR(400)). #>
|    param([Parameter(Mandatory)][int]$Ring, [string]$Channel = '', [Parameter(Mandatory)][string]$SetBy, [string]$Source = '',
|          [Parameter(Mandatory)][datetime]$NowUtc)
|    $cut = { param($t, $n) $t = ("$t").Trim(); if ($t.Length -gt $n) { $t.Substring(0, $n) } else { $t } }
|    $o = [ordered]@{
|        ring    = $Ring
|        channel = (& $cut $Channel 40)
|        setBy   = (& $cut $SetBy 80)
|        source  = (& $cut $Source 40)
|        setAt   = $NowUtc.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture)
|    }
|    $o | ConvertTo-Json -Compress
|}
|
|function ConvertFrom-SIInstallRingJson {
|    <# PURE. The row's value -> @{ Ring; Channel; SetBy; Source; SetAt }, or $null when it holds no usable ring. #>
|    param([AllowNull()][AllowEmptyString()][string]$Json)
|    if ([string]::IsNullOrWhiteSpace($Json)) { return $null }
|    try { $o = $Json | ConvertFrom-Json -ErrorAction Stop } catch { return $null }
|    if (-not $o -or -not $o.PSObject.Properties['ring']) { return $null }
|    $r = ConvertTo-SIUpdateRing $o.ring
|    if ($null -eq $r) { return $null }
|    # (PowerShell 7's ConvertFrom-Json turns an ISO time into a [datetime]: written back in the same ISO form)
|    $p = { param($n) if ($o.PSObject.Properties[$n] -and $null -ne $o.$n) { $v = $o.$n; if ($v -is [datetime]) { $v.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture) } else { "$v" } } else { '' } }
|    [pscustomobject]@{ Ring = $r; Channel = (& $p 'channel'); SetBy = (& $p 'setBy'); Source = (& $p 'source'); SetAt = (& $p 'setAt') }
|}
|
|function Get-SIInstallRingSql {
|    <#
|        The upsert. @Weak = 1 (a ring derived from a name) never replaces a row that is already there. Returns one row:
|        Written 1 / 0. Without cfg.InstallState (a database setup has not created yet) nothing is written (Written 0, NoTable 1).
|    #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('cfg.InstallState') IS NULL
|    SELECT CAST(0 AS int) AS Written, CAST(1 AS int) AS NoTable;
|ELSE
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    DECLARE @written int = 0;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @Name)
|    BEGIN
|        IF @Weak = 0
|        BEGIN
|            UPDATE cfg.InstallState SET Value = @Value, [Version] = NULL, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @Name;
|            SET @written = 1;
|        END
|    END
|    ELSE
|    BEGIN
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@Name, @Value, NULL, @By);
|        SET @written = 1;
|    END
|    COMMIT;
|    SELECT @written AS Written, CAST(0 AS int) AS NoTable;
|END
|'@
|}
|
|function Save-SIInstallRing {
|    <#
|        Writes the row. Returns @{ Written; Ring; Reason }. Throws only on a database error (the callers decide whether that
|        stops them -- every caller in the product treats it as a warning).
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][int]$Ring, [string]$Channel = '', [Parameter(Mandatory)][string]$SetBy,
|          [string]$Source = '', [switch]$Weak, [datetime]$NowUtc = [datetime]::UtcNow)
|    if ($Ring -lt 0 -or $Ring -gt 3) { throw ("{0} is not an update ring (0, 1, 2 or 3)" -f $Ring) }
|    $json = ConvertTo-SIInstallRingJson -Ring $Ring -Channel $Channel -SetBy $SetBy -Source $Source -NowUtc $NowUtc
|    $rows = @(& $Store.Invoke (Get-SIInstallRingSql) ([ordered]@{ Name = $script:SIInstallRingStateName; Value = $json; By = $SetBy; Weak = $(if ($Weak) { 1 } else { 0 }) }) 'reader' | ForEach-Object { $_ })
|    $row = $rows | Select-Object -First 1
|    $get = { param($n) if ($row -is [System.Collections.IDictionary]) { $row[$n] } elseif ($row) { $row.$n } else { $null } }
|    if ($row -and [int](& $get 'NoTable') -eq 1) { return [pscustomobject]@{ Written = $false; Ring = $Ring; Reason = 'the Pro database has no cfg.InstallState yet (run setup first) -- nothing recorded' } }
|    if ($row -and [int](& $get 'Written') -eq 1) { return [pscustomobject]@{ Written = $true; Ring = $Ring; Reason = ('ring {0} recorded for this install ({1})' -f $Ring, $(if ($Source) { $Source } else { $SetBy })) } }
|    [pscustomobject]@{ Written = $false; Ring = $Ring; Reason = ('a ring is recorded already -- ring {0} from the resource-group name does not replace it' -f $Ring) }
|}
|
|function Read-SIInstallRing {
|    <# The recorded row (ConvertFrom-SIInstallRingJson), or $null. #>
|    param([Parameter(Mandatory)]$Store)
|    $rows = @(& $Store.Invoke "IF OBJECT_ID('cfg.InstallState') IS NOT NULL SELECT Value FROM cfg.InstallState WHERE Name = @Name" ([ordered]@{ Name = $script:SIInstallRingStateName }) 'reader' | ForEach-Object { $_ })
|    $row = $rows | Select-Object -First 1
|    if (-not $row) { return $null }
|    ConvertFrom-SIInstallRingJson ([string]$(if ($row -is [System.Collections.IDictionary]) { $row['Value'] } else { $row.Value }))
|}
|
|function Read-SIUpdateRingSetting {
|    <# The admin's SI_UpdateRing at solution scope in the Pro database (0..3), or $null (not set, not a ring, or no table). #>
|    param([Parameter(Mandatory)]$Store)
|    $rows = @(& $Store.Invoke "IF OBJECT_ID('cfg.Setting') IS NOT NULL SELECT ValueJson FROM cfg.Setting WHERE Name = @Name AND Scope = N'solution'" ([ordered]@{ Name = $script:SIUpdateRingSettingName }) 'reader' | ForEach-Object { $_ })
|    $row = $rows | Select-Object -First 1
|    if (-not $row) { return $null }
|    $j = [string]$(if ($row -is [System.Collections.IDictionary]) { $row['ValueJson'] } else { $row.ValueJson })
|    if (-not $j) { return $null }
|    try { $v = $j | ConvertFrom-Json -ErrorAction Stop } catch { $v = $j }
|    ConvertTo-SIUpdateRing $v
|}
|
|function Invoke-SIRecordInstallRing {
|    <#
|        The one entry every writer calls: resolve the ring (Resolve-SIInstallRing; the database setting first, else
|        -ConfigSetting = $global:SI_UpdateRing from the configuration), record it, say what happened. NEVER throws:
|        returns @{ Written; Ring; Source; Reason; Problems }.
|    #>
|    param([Parameter(Mandatory)]$Store, [AllowNull()]$Ring, [ValidateSet('parameter', 'updater')][string]$RingSource = 'parameter',
|          [AllowNull()]$ConfigSetting, [AllowNull()][AllowEmptyString()][string]$ResourceGroupName, [string]$Channel = '',
|          [Parameter(Mandatory)][string]$SetBy, [datetime]$NowUtc = [datetime]::UtcNow)
|    $out = [pscustomobject]@{ Written = $false; Ring = $null; Source = ''; Reason = ''; Problems = @() }
|    try {
|        $setting = $null
|        try { $setting = Read-SIUpdateRingSetting -Store $Store } catch { $setting = $null }
|        if ($null -eq $setting) { $setting = $ConfigSetting }
|        $r = Resolve-SIInstallRing -Ring $Ring -RingSource $RingSource -Setting $setting -ResourceGroupName $ResourceGroupName
|        $out.Problems = $r.Problems; $out.Source = $r.Source; $out.Ring = $r.Ring
|        if ($null -eq $r.Ring) {
|            $out.Reason = ("no update ring is known here -- set {0} (0-3) on the Settings page, or run setup\Set-SIInstallRing.ps1 -Ring <0-3>" -f $script:SIUpdateRingSettingName)
|            return $out
|        }
|        $s = Save-SIInstallRing -Store $Store -Ring $r.Ring -Channel $Channel -SetBy $SetBy -Source $r.Source -Weak:([bool]$r.Weak) -NowUtc $NowUtc
|        $out.Written = $s.Written; $out.Reason = $s.Reason
|    } catch {
|        $out.Reason = ('the update ring could not be recorded: {0}' -f $_.Exception.Message)
|    }
|    $out
|}
|
|# The ring a status report carries is resolved in engine\_shared\SI-ReportedRing.ps1 (shipped in both editions);
|# this Pro file only reads the two rows it is resolved from.
|function Read-SIInstallRingFacts {
|    <#
|        The cfg.InstallState rows the reported ring is read from ('UpdateState' and 'Ring') -- plus the install's own links
|        ('Endpoints', framework §8.4, recorded by the updater for the identified heartbeat) -- in ONE query on a store the
|        caller already opened (the Pro settings layer at run start). Returns @{ UpdateState; Ring; Endpoints } (JSON text,
|        '' when absent) -- and InvardiaEnvironment (#710: the environment id Invardia's answer named, for the customer
|        mail's portal link). NEVER THROWS: a failed read leaves all empty -- the ring then falls back to the setting.
|    #>
|    param([Parameter(Mandatory)]$Store)
|    $out = [pscustomobject]@{ UpdateState = ''; Ring = ''; Endpoints = ''; PipelineSchedule = ''; SecretHandover = ''; InvardiaEnvironment = '' }
|    try {
|        $rows = @(& $Store.Invoke "IF OBJECT_ID('cfg.InstallState') IS NOT NULL SELECT Name, Value FROM cfg.InstallState WHERE Name IN (N'UpdateState', N'Ring', N'Endpoints', N'PipelineSchedule', N'SecretHandover', N'InvardiaEnvironment')" @{} 'reader' | ForEach-Object { $_ })
|        foreach ($row in $rows) {
|            if (-not $row) { continue }
|            $get = { param($n) if ($row -is [System.Collections.IDictionary]) { if ($row.Contains($n)) { $row[$n] } else { $null } } elseif ($row.PSObject.Properties[$n]) { $row.$n } else { $null } }
|            $n = [string](& $get 'Name'); $v = & $get 'Value'
|            if ($null -eq $v -or $v -is [System.DBNull]) { continue }
|            if ($n -eq 'UpdateState') { $out.UpdateState = [string]$v } elseif ($n -eq 'PipelineSchedule') { $out.PipelineSchedule = [string]$v } elseif ($n -eq 'SecretHandover') { $out.SecretHandover = [string]$v } elseif ($n -eq 'Endpoints') { $out.Endpoints = [string]$v } elseif ($n -eq 'InvardiaEnvironment') { $out.InvardiaEnvironment = [string]$v } elseif ($n -eq $script:SIInstallRingStateName) { $out.Ring = [string]$v }
|        }
|    } catch { }
|    $out
|}
'@ }
$__siSupportFiles['engine/asset-profiling/shared/Send-SIRunHealthRow.ps1'] = @{ Sha256 = 'a0f0c591fb7c9cc69951e3dca3bafaebc59369551b01ffb83a1f899b86373941'; Text = @'
|#Requires -Version 5.1
|<#
|    Per-shard heartbeat to LA. Emits one row to SI_RunHealth_CL at the
|    Start of every replica run, and a second row at End -- success or
|    failure. The MISSING end-row is itself the signal that a replica
|    OOM'd / got killed before it could finish (KQL: where Phase=='Start'
|    | join kind=leftanti (... where Phase=='End') on RunId, ShardIndex).
|
|    Best-effort: any failure to ship the heartbeat is swallowed (silent),
|    because telemetry must NEVER kill the run it's measuring.
|
|    Schema:
|      RunId, Engine, ShardIndex, ShardCount, Phase=Start|End,
|      AssetCount, PeakWorkingSetMB, DurationSec, ExitReason,
|      ErrorMessage, Computer, CollectionTime
|#>
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../../_shared/SI-AzRest.ps1') }
|
|# SI's log-ingest wrappers (Send-SILogData, Update-SILogTableSchema, Get-SIDceList, ...): plain REST,
|# no PowerShell modules. Loaded once; a caller that already has them keeps its own.
|if (-not (Get-Command -Name Send-SILogData -ErrorAction SilentlyContinue)) {
|    . (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) '_shared/SI-LogIngest.ps1')
|}
|
|# #226 -- the telemetry run report goes out at this same END moment (Send-SITelemetryRunEnd, from the finally below).
|# Loading it must never break the run-health record: a missing or broken file only means no telemetry.
|if (-not (Get-Command -Name Send-SITelemetryRunEnd -ErrorAction SilentlyContinue)) {
|    try { . (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) '_shared/SI-TelemetrySend.ps1') } catch { }
|}
|# #277 -- the guard events (Send-SIGuardEvent): every engine that records its run health can report a tripped guard.
|if (-not (Get-Command -Name Send-SIGuardEvent -ErrorAction SilentlyContinue)) {
|    try { . (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) '_shared/SI-Guard.ps1') } catch { }
|}
|
|# #532 -- THROTTLE-IS-NORMAL (framework §12.18): a run that failed ONLY because Microsoft throttled it (429 / 5xx /
|# timeouts) and wrote nothing ends 'throttled', not 'error'; the one "stuck" alert. Loading it must never break the record.
|if (-not (Get-Command -Name Resolve-SIThrottledExitReason -ErrorAction SilentlyContinue)) {
|    try { . (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) '_shared/SI-Throttle.ps1') } catch { }
|}
|
|function Resolve-SIRunHealthExitReason {
|    <# PURE. The END record's ExitReason (#532): 'error' becomes 'throttled' when every failure the message names is
|       throttling / service-side, and the run wrote nothing:
|         * a COLLECTING engine (it reads Microsoft's services and writes its result in one output stage at the end:
|           the profilers, the tier classifier, schema discovery, the trend) that did not fail in a stage that writes
|           (RunContext.FailedStep) and did not say it wrote part of its result (RunContext.WrotePartial);
|         * any other engine (one that APPLIES changes -- SQL, ServiceNow, Defender, the data sync) ONLY when it says so
|           itself (RunContext.WroteNothing = $true): a partial apply is a real failure, so it is never assumed.
|       Risk Analysis is not in the list: it publishes report by report, and a throttled query already ends its run
|       'success-partial' (a warning, its findings unknown). Every other value is returned as given. #>
|    param([AllowNull()]$RunContext, [AllowEmptyString()][string]$ExitReason, [AllowEmptyString()][string]$ErrorMessage)
|    if (-not (Get-Command -Name Resolve-SIThrottledExitReason -ErrorAction SilentlyContinue)) { return $ExitReason }
|    $step = ''; $partial = $false; $nothing = $false; $engine = ''
|    if ($RunContext) {
|        if ($RunContext.PSObject.Properties['Engine']) { $engine = ([string]$RunContext.Engine).Trim().ToLowerInvariant() }
|        if ($RunContext.PSObject.Properties['FailedStep']) { $step = [string]$RunContext.FailedStep }
|        if ($RunContext.PSObject.Properties['WrotePartial']) { $partial = [bool]$RunContext.WrotePartial }
|        if ($RunContext.PSObject.Properties['WroteNothing']) { $nothing = [bool]$RunContext.WroteNothing }
|    }
|    $collecting = @('endpoint', 'identity', 'azure', 'publicip', 'privilege-tier-classifier', 'schema-discovery', 'asset-trend', 'trend') -contains $engine
|    if (-not $collecting -and -not $nothing) { return $ExitReason }
|    Resolve-SIThrottledExitReason -ExitReason $ExitReason -ErrorMessage $ErrorMessage -FailedStep $step -WrotePartial:$partial
|}
|
|# #276 -- the dry-run lines (Get-SIDryRunNoticeText). Loading it must never break the run-health record either.
|if (-not (Get-Command -Name Get-SIDryRunNoticeText -ErrorAction SilentlyContinue)) {
|    try { . (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) '_shared/SI-FirstRun.ps1') } catch { }
|}
|
|function Get-SIRunHealthDryRunRow {
|    <#
|        PURE. #276: what a DRY RUN's run-health row says. A dry run publishes nothing, but its health row IS written so the
|        run-health views show that the run happened and was a dry run: the End record's ExitReason is 'dry-run' when the
|        run itself went well (success / success-partial / nothing given), and a failure keeps its own reason so a broken
|        dry run is still a failure. The message always starts with 'dry run'.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Start', 'End')][string]$Phase, [AllowEmptyString()][string]$ExitReason, [AllowEmptyString()][string]$ErrorMessage)
|    $x = "$ExitReason".Trim()
|    $reason = $x
|    if ($Phase -eq 'End' -and ($x -eq '' -or $x -in @('success', 'success-partial'))) { $reason = 'dry-run' }
|    $msg = 'dry run -- nothing was published or sent'
|    if ("$ErrorMessage".Trim()) { $msg = $msg + '; ' + "$ErrorMessage".Trim() }
|    [pscustomobject]@{ ExitReason = $reason; ErrorMessage = $msg }
|}
|
|function Test-SIRunHealthDcrReachable {
|    <#
|        Pre-flight: verify the SI_RunHealth DCR's dataCollectionEndpointId
|        matches the DCE the engine is configured to use. Returns:
|
|          $true  -- safe to post (association OK, DCR not yet created,
|                    DCR uses workspace-default ingestion, or pre-flight
|                    inconclusive for any reason).
|          $false -- CONFIRMED mismatch; skip the post to avoid the
|                    PS>TerminatingError(...) transcript markers that the
|                    AzLogDcrIngestPS module's Invoke-WebRequest would
|                    otherwise emit when the Log Ingestion API rejects
|                    the post with "DCE FQDN is not associated with DCR".
|
|        v2.2.382 -- added because the actual post failure is caught
|        engine-side (Send-SIRunHealthRow has try/catch + Write-Verbose),
|        but PowerShell 7's transcript engine writes the terminating-error
|        marker BEFORE the catch handler runs, so it cannot be suppressed
|        from inside Send-SIRunHealthRow. Detecting the mismatch up-front
|        via Az.Accounts/Invoke-AzRestMethod (which never throws on non-2xx)
|        lets us skip the noisy call cleanly. Pre-flight failures
|        (network/auth/anything) return $true so we never suppress
|        telemetry for the wrong reason.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$SubscriptionId,
|        [Parameter(Mandatory)][string]$DcrResourceGroup,
|        [Parameter(Mandatory)][string]$DcrName,
|        [string]$DceResourceGroup,
|        [string]$DceName
|    )
|
|    # Engine config incomplete (no DCE known) -> can't compare. Proceed.
|    if ([string]::IsNullOrWhiteSpace($DceName) -or [string]::IsNullOrWhiteSpace($DceResourceGroup)) { return $true }
|
|    try {
|        $dcrPath = ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Insights/dataCollectionRules/{2}?api-version=2023-03-11' -f `
|                        $SubscriptionId, $DcrResourceGroup, $DcrName)
|        $resp = Invoke-SIAzRestMethod -Path $dcrPath -Method GET -ErrorAction SilentlyContinue 4>$null 2>$null
|        if (-not $resp -or [int]$resp.StatusCode -ne 200) {
|            # DCR not reachable / does not exist yet / RBAC drift -- let the
|            # actual call attempt creation via CheckCreateUpdate-TableDcr-Structure.
|            return $true
|        }
|        $dcrBody = $null
|        try { $dcrBody = $resp.Content | ConvertFrom-Json -ErrorAction Stop } catch { return $true }
|        $boundDceId = [string]$dcrBody.properties.dataCollectionEndpointId
|        if ([string]::IsNullOrWhiteSpace($boundDceId)) {
|            # DCR uses workspace-default ingestion (no explicit DCE) -- post will work.
|            return $true
|        }
|        $expectedDceId = ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Insights/dataCollectionEndpoints/{2}' -f `
|                            $SubscriptionId, $DceResourceGroup, $DceName)
|        if ($boundDceId -ieq $expectedDceId) { return $true }
|
|        # #198 -- SAID ONCE, OUT LOUD. This was Write-Verbose, so a mismatched rule dropped every run-health
|        # record silently: measured 2026-10-01, SI_RunHealth_CL held 0 rows in 30 days, and nothing that reads
|        # it (crash detection, "was the run complete") could work. The post is still skipped -- it would fail --
|        # but the run now says so, once, with the fix.
|        if (-not $global:SI_RunHealthMismatchWarned) {
|            $global:SI_RunHealthMismatchWarned = $true
|            Write-Warning ("Run-health records are not being saved: the data collection rule '{0}' sends to a different data collection endpoint ({1}) than this install uses ({2}). Point `$global:SI_RunHealth_DcrName at a rule on this install's endpoint (a new name is created automatically), or rebind the rule." -f `
|                            $DcrName, $boundDceId, $expectedDceId)
|        }
|        return $false
|    } catch {
|        # Pre-flight itself errored -- don't suppress telemetry on a false negative.
|        Write-Verbose ('Send-SIRunHealthRow: pre-flight error (proceeding anyway) -- {0}' -f $_.Exception.Message)
|        return $true
|    }
|}
|
|function Select-SIRunHealthIngestTarget {
|    <#
|    .SYNOPSIS
|        Narrows $global:AzDceDetails / $global:AzDcrDetails to THIS install's endpoint and rule (subscription +
|        resource group + name) before AzLogDcrIngestPS sees them.
|    .DESCRIPTION
|        #198. AzLogDcrIngestPS resolves the endpoint by NAME ONLY -- the first match in its cache, or in a
|        tenant-wide Resource Graph query when the cache is empty. With several endpoints sharing a name (measured
|        2026-10-01: three called dce-securityinsight in two subscriptions), CheckCreateUpdate-TableDcr-Structure
|        re-bound the run-health rule to the wrong one on every run, and every post after that was refused.
|        Returns $true when the endpoint is pinned AND, when a rule is named, the rule is in the cache too (the
|        caller may create/update/post); $false otherwise -- the caller rebuilds the cache rather than let the
|        module guess. -AllowMissingDcr accepts a pinned endpoint whose rule does not exist YET (first run: the
|        create step makes it).
|        🪤 The cache is SHARED with the engine's other publishers: SI-LogIngest's Select-SIIngestTarget narrows
|        $global:AzDcrDetails to ITS rule. Measured 2026-10-02: after the azure engine's Defender for Cloud publish
|        the run-health rule was gone from the cache, the post ran with an empty immutable id, and every azure run
|        left a Start with no End -- crash detection would call each one a crash.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$SubscriptionId,
|        [Parameter(Mandatory)][string]$DceResourceGroup,
|        [Parameter(Mandatory)][string]$DceName,
|        [string]$DcrResourceGroup,
|        [string]$DcrName,
|        [switch]$AllowMissingDcr
|    )
|    $dce = @($global:AzDceDetails | Where-Object {
|        $_ -and $_.name -eq $DceName -and
|        [string]$_.id -like "/subscriptions/$SubscriptionId/resourceGroups/$DceResourceGroup/*"
|    }) | Select-Object -First 1
|    if (-not $dce) {
|        # One endpoint of that name anywhere is unambiguous -- an endpoint outside the rules' resource group.
|        $same = @($global:AzDceDetails | Where-Object { $_ -and $_.name -eq $DceName })
|        if ($same.Count -ne 1) { return $false }
|        $dce = $same[0]
|    }
|    $global:AzDceDetails = @($dce)
|    if ($DcrName -and $DcrResourceGroup) {
|        $dcr = @($global:AzDcrDetails | Where-Object {
|            $_ -and $_.name -eq $DcrName -and
|            [string]$_.id -like "/subscriptions/$SubscriptionId/resourceGroups/$DcrResourceGroup/*"
|        }) | Select-Object -First 1
|        if ($dcr) { $global:AzDcrDetails = @($dcr) }
|        elseif (-not $AllowMissingDcr) { return $false }
|        else {
|            # #281 -- the rule does not exist HERE yet: a rule of the same name in another resource group or subscription
|            # (another install in the tenant; the module's rule list is tenant-wide) must not stand in for it. The
|            # module's create step looks the rule up by NAME in this cache, so with the foreign one left in, it reports
|            # "rule exists", creates nothing, and every post after it is lost. The other publishers' rules stay.
|            $global:AzDcrDetails = @($global:AzDcrDetails | Where-Object { $_ -and $_.name -ne $DcrName })
|        }
|    }
|    return $true
|}
|
|function Resolve-SIRunHealthSubscriptionId {
|    <#
|        #281. The subscription the run-health rule and endpoint are looked up in. The first that has one:
|        SI_AzSubscriptionId, the subscription in SI_WorkspaceResourceId, the job's SI_WORKSPACE_RESOURCEID,
|        SI_JOBS_SUBSCRIPTIONID / SI_FLOW_SUBSCRIPTIONID, the signed-in Az context. '' when none.
|        The container entry points set SI_AzSubscriptionId (Initialize-SIContainerIngestGlobals); this is the defensive
|        second line for any host or entry that did not -- live 2026-10-05 no container had it, and every profiler run lost
|        its record to "Cannot bind argument to parameter 'SubscriptionId' because it is an empty string".
|    #>
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_AzSubscriptionId)) { return ([string]$global:SI_AzSubscriptionId).Trim() }
|    foreach ($w in @([string]$global:SI_WorkspaceResourceId, [string]$env:SI_WORKSPACE_RESOURCEID)) {
|        if ($w -match '/subscriptions/([^/]+)/') { return $Matches[1] }
|    }
|    foreach ($j in @([string]$env:SI_JOBS_SUBSCRIPTIONID, [string]$env:SI_FLOW_SUBSCRIPTIONID)) {
|        if (-not [string]::IsNullOrWhiteSpace($j)) { return $j.Trim() }
|    }
|    try {
|        if (Get-Command -Name Get-SIAzContext -ErrorAction SilentlyContinue) {
|            $s = [string](Get-SIAzContext -ErrorAction SilentlyContinue).Subscription.Id
|            if ($s) { return $s }
|        }
|    } catch { }
|    return ''
|}
|
|function Get-SIRunHealthDcrFromArm {
|    <#
|        #281. The run-health rule read straight from Azure (by its id: subscription + resource group + name), shaped as the
|        ingest module's rule cache holds it (name, id, location, properties) -- or $null. Used when the rule list does
|        not have it yet: the module's list is Azure Resource Graph, which shows a rule created seconds ago only after a
|        delay, so the first post after the create found nothing and was lost. Never throws.
|    #>
|    param([Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup, [Parameter(Mandatory)][string]$Name)
|    try {
|        $p = ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Insights/dataCollectionRules/{2}?api-version=2023-03-11' -f $SubscriptionId, $ResourceGroup, $Name)
|        $r = Invoke-SIAzRestMethod -Path $p -Method GET -ErrorAction SilentlyContinue 4>$null 2>$null
|        if (-not $r -or [int]$r.StatusCode -ne 200) { return $null }
|        $o = $r.Content | ConvertFrom-Json -ErrorAction Stop
|        if (-not $o -or -not $o.id) { return $null }
|        return $o
|    } catch { return $null }
|}
|
|function ConvertTo-SIRunHealthUtc {
|    <#
|        PURE. A run's CollectionTime as a [datetime] of kind Utc. The callers hand it over in UTC -- Risk Analysis and
|        the tier classifier as an un-zoned 'yyyy-MM-dd HH:mm:ss' string, the profiling engines as a Utc [datetime].
|        A plain [datetime] cast of the string gives kind Unspecified, which the serializer treats as LOCAL time and
|        converts again: measured 2026-10-02 on a UTC+2 host, every risk-analysis record was stamped 2 h early, so
|        no record covered its own snapshot and the vulnerability close-loop (#195) could never close anything.
|    #>
|    param([Parameter(Mandatory)][object]$Value)
|    if ($Value -is [datetime]) {
|        if ($Value.Kind -eq [DateTimeKind]::Local) { return $Value.ToUniversalTime() }
|        return [datetime]::SpecifyKind($Value, [DateTimeKind]::Utc)
|    }
|    $styles = [Globalization.DateTimeStyles]::AssumeUniversal -bor [Globalization.DateTimeStyles]::AdjustToUniversal
|    [datetime]::Parse([string]$Value, [Globalization.CultureInfo]::InvariantCulture, $styles)
|}
|
|function Get-SIRunHealthExecution {
|    <#
|        PURE over -RunContext / -Environment. The Container Apps job EXECUTION this run is (#269): the run context's
|        Execution when it carries one, else CONTAINER_APP_JOB_EXECUTION_NAME (Azure sets it in every job execution),
|        else '' (a VM). The flow runner reads it back from the START record to tell a container that never ran the engine
|        (an Azure platform failure, started again) from an engine that failed (never started again).
|    #>
|    param($RunContext, [System.Collections.IDictionary]$Environment)
|    if ($RunContext -and $RunContext.PSObject.Properties['Execution'] -and "$($RunContext.Execution)") { return [string]$RunContext.Execution }
|    $v = if ($Environment) { $Environment['CONTAINER_APP_JOB_EXECUTION_NAME'] } else { [Environment]::GetEnvironmentVariable('CONTAINER_APP_JOB_EXECUTION_NAME') }
|    if ($v) { [string]$v } else { '' }
|}
|
|function Get-SIRunHealthBuild {
|    <#
|        The build this run is (BUILD.json, stamped at build/package time -- engine\_shared\SI-BuildInfo.ps1): Version is
|        the display version ("3.0.0-rc.12", or the VERSION file when nothing was stamped), Build the short commit ('' when
|        unknown). -SolutionRoot is a test seam. Cached per process; never throws, never asks git.
|    #>
|    param([string]$SolutionRoot)
|    if (-not $SolutionRoot -and $script:SIRunHealthBuild) { return $script:SIRunHealthBuild }
|    $out = [pscustomobject]@{ Version = ''; Build = '' }
|    try {
|        $root = if ($SolutionRoot) { $SolutionRoot } else { Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) }
|        if (-not (Get-Command -Name Read-SIBuildInfo -ErrorAction SilentlyContinue)) {
|            . ([System.IO.Path]::Combine($root, 'engine', '_shared', 'SI-BuildInfo.ps1'))
|        }
|        $b = Read-SIBuildInfo -SolutionRoot $root
|        if ($b.source -ne 'none') { $out.Version = [string]$b.display }
|        $out.Build = [string]$b.shortCommit
|    } catch { }
|    if (-not $SolutionRoot) { $script:SIRunHealthBuild = $out }
|    $out
|}
|
|function Send-SIRunHealthRow {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][object]$RunContext,
|        # #277: 'Guard' = a tripped guard (Send-SIGuardEvent). Every reader of run health filters Phase == 'End'.
|        [Parameter(Mandatory)][ValidateSet('Start','End','Guard')][string]$Phase,
|        [int]$AssetCount = -1,
|        [string]$ExitReason = '',
|        [string]$ErrorMessage = '',
|        # #269: a flow STEP's record -- the flow reports one telemetry run for the whole flow, not one per step
|        [switch]$NoTelemetry
|    )
|
|    # UNCONDITIONAL silence of the AzLogDcrIngestPS / Az SDK VERBOSE
|    # storm for the duration of the heartbeat. Per-call -Verbose:$false isn't
|    # enough -- the module reads $global:VerbosePreference internally. Heartbeat
|    # call traces are never useful, so silence regardless of operator -Verbose.
|    $_savedVerbosePreference = $global:VerbosePreference
|    $global:VerbosePreference = 'SilentlyContinue'
|
|    # #532 THROTTLE-IS-NORMAL: an END that failed only because Microsoft throttled it is 'throttled' -- in the record, in the
|    # telemetry report (Outcome warning, no fix request) and for the stuck check below. Decided before anything is written.
|    if ($Phase -eq 'End') {
|        try {
|            $resolved = Resolve-SIRunHealthExitReason -RunContext $RunContext -ExitReason $ExitReason -ErrorMessage $ErrorMessage
|            if ($resolved -eq 'throttled' -and $ExitReason -ne 'throttled') {
|                $ExitReason = 'throttled'
|                # only a real throttling answer gets here (Get-SITransientKind via Resolve-SIThrottledExitReason): a timeout or an
|                # unreachable service stays 'error' with its own text
|                $why = Get-SIThrottleText
|                $ErrorMessage = '{0} | {1}' -f $why, $ErrorMessage
|                try { Write-Host (' [INFO] {0}' -f $why) -ForegroundColor Yellow } catch { }
|            }
|        } catch { }
|    }
|
|    try {
|        # A dry run (-WhatIfMode, #257) publishes no results -- but it is SAID, loudly, at its start and at its end, and
|        # its health row is written as a dry run so the run-health views show it (#276). Once per process per moment.
|        $rowExit = $ExitReason; $rowMsg = $ErrorMessage
|        if ([bool]$global:WhatIfMode) {
|            $flag = if ($Phase -eq 'Start') { 'SI_DryRunStartSaid' } else { 'SI_DryRunEndSaid' }
|            if (-not (Get-Variable -Name $flag -Scope Global -ValueOnly -ErrorAction SilentlyContinue)) {
|                Set-Variable -Name $flag -Scope Global -Value $true
|                $txt = if (Get-Command -Name Get-SIDryRunNoticeText -ErrorAction SilentlyContinue) { Get-SIDryRunNoticeText -Moment $Phase } else { 'DRY RUN -- nothing was published or sent.' }
|                try { Write-Host $txt -ForegroundColor Yellow -BackgroundColor DarkRed } catch { }
|            }
|            $dry = Get-SIRunHealthDryRunRow -Phase $Phase -ExitReason $ExitReason -ErrorMessage $ErrorMessage
|            $rowExit = $dry.ExitReason; $rowMsg = $dry.ErrorMessage
|        }
|
|        # Engine bootstrap may have failed before LA globals were set; bail silently
|        # if we don't have what we need to ship.
|        if (-not $global:SI_WorkspaceResourceId -or -not $global:SI_DceName -or -not $global:SI_DcrResourceGroup) {
|            # #198 -- said once, not silent: a run that never has these never records its health at all. Only when a
|            # workspace IS configured -- no workspace at all is a deliberate file-only setup, not a fault.
|            if ($global:SI_WorkspaceResourceId -and -not $global:SI_RunHealthFailWarned) {
|                $global:SI_RunHealthFailWarned = $true
|                Write-Warning 'Run-health record not saved: SI_WorkspaceResourceId, SI_DceName or SI_DcrResourceGroup is not set.'
|            }
|            return
|        }
|
|        # #281 -- the subscription, resolved in every host (a container had none: live 2026-10-05, every profiler and flow
|        # run failed here with "Cannot bind argument to parameter 'SubscriptionId' because it is an empty string").
|        # Filled back into SI_AzSubscriptionId so the rest of the run has it too. None at all: said once, not saved.
|        $subId = Resolve-SIRunHealthSubscriptionId
|        if (-not $subId) {
|            if (-not $global:SI_RunHealthFailWarned) {
|                $global:SI_RunHealthFailWarned = $true
|                Write-Warning 'Run-health record not saved: no subscription is known for the Log Analytics workspace (set SI_AzSubscriptionId, or a full SI_WorkspaceResourceId).'
|            }
|            return
|        }
|        if (-not $global:SI_AzSubscriptionId) { $global:SI_AzSubscriptionId = $subId }
|        # The endpoint lives with the rules unless the install says otherwise (an empty value failed the same way).
|        $dceRg = if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_DceResourceGroup)) { [string]$global:SI_DceResourceGroup } else { [string]$global:SI_DcrResourceGroup }
|
|        # Memory: PS 5.1 [System.Diagnostics.Process].WorkingSet64 is current process bytes.
|        # Use PeakWorkingSet64 so a brief peak isn't lost between heartbeat reads.
|        $peakMb = -1
|        try {
|            $proc = [System.Diagnostics.Process]::GetCurrentProcess()
|            $peakMb = [int]([Math]::Round($proc.PeakWorkingSet64 / 1MB))
|        } catch { }
|
|        $duration = if ($RunContext.StartedAt) {
|            [int]([datetime]::UtcNow - $RunContext.StartedAt).TotalSeconds
|        } else { 0 }
|
|        $hostName = $env:COMPUTERNAME
|        if (-not $hostName) { $hostName = [System.Net.Dns]::GetHostName() }
|
|        # v2.2.365 -- cast CollectionTime to [datetime] so AzLogDcrIngestPS derives
|        # the column as DateTime in BOTH the streamDeclarations + transformKql when
|        # auto-creating the DCR. Previously the runtime value was a string, which
|        # caused AzLogDcrIngestPS's schema derivation to pick DateTime for one
|        # side but String for the other -- the resulting DCR spec failed Azure's
|        # InvalidPayload validation ('CollectionTime [produced:String, output:DateTime]')
|        # and the DCR was never created. Engine-side cast forces consistent type.
|        $siBuild = Get-SIRunHealthBuild
|        $row = [pscustomobject]@{
|            CollectionTime    = ConvertTo-SIRunHealthUtc $RunContext.CollectionTime
|            RunId             = [string]$RunContext.RunId
|            Engine            = [string]$RunContext.Engine
|            ShardIndex        = [long]$RunContext.ShardIndex
|            ShardCount        = [long]$RunContext.ShardCount
|            Phase             = $Phase
|            AssetCount        = [long]$AssetCount
|            PeakWorkingSetMB  = [long]$peakMb
|            DurationSec       = [long]$duration
|            ExitReason        = $rowExit
|            ErrorMessage      = $rowMsg
|            Computer          = $hostName
|            # #269: the job execution (a container; '' on a VM) -- a NEW column, added to the table by the schema
|            # update below; readers that do not know it are unaffected (the flow reads it with column_ifexists)
|            Execution         = [string](Get-SIRunHealthExecution -RunContext $RunContext)
|            # the build that wrote this row (BUILD.json): additive columns, like Execution -- readers that do not know them
|            # are unaffected
|            SolutionVersion   = [string]$siBuild.Version
|            Build             = [string]$siBuild.Build
|            # the engine's own permission self-check (engine\_shared\SI-PermissionCheck.ps1), on its END record: the gaps and
|            # what could not be checked, as JSON ('' = no check ran in this process). Additive like the columns above;
|            # Get Started > Permissions reads it.
|            PermissionGaps    = [string]$(if (Get-Command -Name Get-SIRunHealthPermissionGaps -ErrorAction SilentlyContinue) { Get-SIRunHealthPermissionGaps -RunContext $RunContext -Phase $Phase } else { '' })
|        }
|
|        # Auth resolution mirrors Invoke-Output.ps1: MI / SPN+Cert / SPN+Secret.
|        # v2.2.237 -- cert path added (AzLogDcrIngestPS module accepts cert directly).
|        # #281 -- then Risk Analysis' own names (Spn*): its container entry point kept the identity only there, and an
|        # empty app id makes the ingest module skip the create SILENTLY (no rule, no error, every post lost).
|        $spnAppId      = if ($global:SI_SPN_AppId)    { $global:SI_SPN_AppId }    elseif ($global:SI_LogIngest_AppId)    { $global:SI_LogIngest_AppId }    else { $global:SpnClientId }
|        $spnSecret     = if ($global:SI_SPN_Secret)   { $global:SI_SPN_Secret }   elseif ($global:SI_LogIngest_Secret)   { $global:SI_LogIngest_Secret }   else { $global:SpnClientSecret }
|        $spnTenantId   = if ($global:SI_SPN_TenantId) { $global:SI_SPN_TenantId } elseif ($global:SI_LogIngest_TenantId) { $global:SI_LogIngest_TenantId } else { $global:SpnTenantId }
|        $spnObjectId   = if ($global:SI_SPN_ObjectId) { $global:SI_SPN_ObjectId } else { $global:SI_LogIngest_ObjectId }
|        $spnCertThumb  = [string]$global:SI_SPN_CertThumbprint
|        # v2.2.243 -- auto-detect cert store (LocalMachine vs CurrentUser).
|        $spnCertStore  = if ($global:SI_SPN_CertStoreLocation) { [string]$global:SI_SPN_CertStoreLocation }
|                         elseif ($spnCertThumb) {
|                             $_clean = $spnCertThumb -replace '\s',''
|                             if (Get-PSDrive -Name Cert -ErrorAction SilentlyContinue) {
|                                 $_resolved = 'LocalMachine'
|                                 foreach ($_s in 'LocalMachine','CurrentUser') {
|                                     $_c = Get-ChildItem "Cert:\$_s\My" -ErrorAction SilentlyContinue |
|                                           Where-Object { $_.Thumbprint -eq $_clean -and $_.HasPrivateKey } |
|                                           Select-Object -First 1
|                                     if ($_c) { $_resolved = $_s; break }
|                                 }
|                                 $_resolved
|                             } else {
|                                 # #209: no Cert: drive (a Linux container) -- read the X509Store instead.
|                                 if (-not (Get-Command Get-SICertStoreLocation -ErrorAction SilentlyContinue)) {
|                                     . (Join-Path (Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))) 'auth/Find-SICertificate.ps1')
|                                 }
|                                 Get-SICertStoreLocation -Thumbprint $_clean
|                             }
|                         } else { 'LocalMachine' }
|
|        $useMi   = $global:SI_PreferUami -and -not [string]::IsNullOrWhiteSpace($global:SI_UAMI_ClientId)
|        $useCert = -not $useMi -and -not [string]::IsNullOrWhiteSpace($spnCertThumb)
|        $authParams = if ($useMi) {
|            @{ UseManagedIdentity = $true; ManagedIdentityClientId = $global:SI_UAMI_ClientId }
|        } elseif ($useCert) {
|            @{
|                AzAppId                       = $spnAppId
|                AzAppCertificateThumbprint    = $spnCertThumb
|                AzAppCertificateStoreLocation = $spnCertStore
|                TenantId                      = $spnTenantId
|            }
|        } else {
|            @{ AzAppId = $spnAppId; AzAppSecret = $spnSecret; TenantId = $spnTenantId }
|        }
|        # #281 -- an identity the ingest module would refuse WITHOUT saying so (no app id, or neither a certificate nor a
|        # secret) is said once here instead of being found 30 days later as an empty table.
|        if (-not $useMi -and ([string]::IsNullOrWhiteSpace([string]$spnAppId) -or ((-not $useCert) -and [string]::IsNullOrWhiteSpace([string]$spnSecret)))) {
|            if (-not $global:SI_RunHealthFailWarned) {
|                $global:SI_RunHealthFailWarned = $true
|                Write-Warning 'Run-health record not saved: no sign-in identity for Log Analytics (an app id with a certificate or secret, or a managed identity).'
|            }
|            return
|        }
|
|        # Table is workspace-scoped (no cross-sub collision), so the name stays.
|        # DCR is name-looked-up across all subs the SPN sees, so it MUST be
|        # unique when one SPN spans internal + community tenants.
|        $tableName = 'SI_RunHealth'
|        $dcrName   = if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_RunHealth_DcrName)) { [string]$global:SI_RunHealth_DcrName } else { 'dcr-si-run-health' }
|
|        # v2.2.382 -- pre-flight check the DCR/DCE association before calling
|        # AzLogDcrIngestPS. The actual post failure is already caught by the
|        # outer try/catch in this function, but PowerShell 7's transcript
|        # engine writes PS>TerminatingError(...) markers BEFORE the catch
|        # handler runs, so they cannot be suppressed from inside the catch.
|        # Pre-flight via Invoke-AzRestMethod (non-throwing) lets us skip the
|        # noisy call cleanly when we can confirm the DCR is bound to a
|        # different DCE than the engine uses. ANY pre-flight failure (network,
|        # auth, 404, ...) returns $true so telemetry is never suppressed for
|        # the wrong reason.
|        if (-not (Test-SIRunHealthDcrReachable `
|                        -SubscriptionId   $subId `
|                        -DcrResourceGroup $global:SI_DcrResourceGroup `
|                        -DcrName          $dcrName `
|                        -DceResourceGroup $dceRg `
|                        -DceName          $global:SI_DceName)) {
|            return
|        }
|
|        # #198 -- pin the endpoint BEFORE the module touches the rule. The module resolves the endpoint by name
|        # only; unpinned, CheckCreateUpdate re-bound this rule to a same-named endpoint in another subscription.
|        # An empty or foreign cache is rebuilt from this subscription; if the endpoint is still not found, the
|        # module is not allowed to guess -- said once, and the post is skipped.
|        if (-not (Select-SIRunHealthIngestTarget -SubscriptionId $subId `
|                    -DceResourceGroup $dceRg -DceName $global:SI_DceName `
|                    -DcrResourceGroup $global:SI_DcrResourceGroup -DcrName $dcrName)) {
|            try { $global:AzDceDetails = Get-SIDceList @authParams -Verbose:$false 4>$null } catch { }
|            try { $global:AzDcrDetails = Get-SIDcrList @authParams -Verbose:$false 4>$null } catch { }
|            # After a rebuild a rule that does not exist yet is fine -- the create step below makes it.
|            if (-not (Select-SIRunHealthIngestTarget -SubscriptionId $subId `
|                        -DceResourceGroup $dceRg -DceName $global:SI_DceName `
|                        -DcrResourceGroup $global:SI_DcrResourceGroup -DcrName $dcrName -AllowMissingDcr)) {
|                if (-not $global:SI_RunHealthFailWarned) {
|                    $global:SI_RunHealthFailWarned = $true
|                    Write-Warning ("Run-health record not saved: the data collection endpoint '{0}' was not found in resource group '{1}' of subscription '{2}'." -f `
|                                    $global:SI_DceName, $dceRg, $subId)
|                }
|                return
|            }
|        }
|
|        # Provision/update DCR + table from the single-row schema sample. AzLogDcrIngestPS
|        # is idempotent so the per-replica overhead after first-run is just a cache hit.
|        # 4>$null on each call suppresses the AzLogDcrIngestPS / Az SDK VERBOSE storm
|        # (POST/GET URLs + byte counts). Stream-redirect is needed because the Az SDK
|        # writes via Write-Verbose internally and ignores the function-scoped preference
|        # when called in nested module contexts.
|        $null = Update-SILogTableSchema `
|            -AzLogWorkspaceResourceId                   $global:SI_WorkspaceResourceId `
|            @authParams `
|            -DceName                                    $global:SI_DceName `
|            -DcrName                                    $dcrName `
|            -DcrResourceGroup                           $global:SI_DcrResourceGroup `
|            -TableName                                  $tableName `
|            -Data                                       @($row) `
|            -LogIngestServicePricipleObjectId           $spnObjectId `
|            -AzDcrSetLogIngestApiAppPermissionsDcrLevel $false `
|            -AzLogDcrTableCreateFromAnyMachine          $true `
|            -AzLogDcrTableCreateFromReferenceMachine    @() 4>$null
|
|        # Re-sync the DCE/DCR cache so a freshly-created DCR's immutableId is in
|        # $global:AzDcrDetails before Post-* runs its name-only lookup. Without
|        # this, AzLogDcrIngestPS falls back to the DCE's location field as a
|        # bogus immutableId -> 404 'westeurope' from the Log Ingestion API.
|        # Same pattern as Invoke-Output.ps1 (v2.2.65) and Invoke-RiskAnalysis.ps1.
|        try {
|            $ensureFn = Get-Command -Name 'Ensure-SecurityInsightAzDceDcrCache' -ErrorAction SilentlyContinue
|            if ($ensureFn) {
|                & $ensureFn `
|                    @authParams `
|                    -SubscriptionId   $subId `
|                    -DceResourceGroup $dceRg `
|                    -DcrResourceGroup $global:SI_DcrResourceGroup `
|                    -Force 4>$null
|            }
|        } catch { }
|
|        # Collision guard again after the cache refresh: endpoint AND rule pinned to (sub + RG + name) before
|        # Post-* runs its name-only lookups. The refresh helper above lives with Risk Analysis and is absent in the
|        # profiling engines -- so when the rule is still not in the cache, re-read the rules here; a post with no
|        # rule in the cache goes out with an EMPTY immutable id and is lost.
|        if (-not (Select-SIRunHealthIngestTarget -SubscriptionId $subId `
|                    -DceResourceGroup $dceRg -DceName $global:SI_DceName `
|                    -DcrResourceGroup $global:SI_DcrResourceGroup -DcrName $dcrName)) {
|            try { $global:AzDceDetails = Get-SIDceList @authParams -Verbose:$false 4>$null } catch { }
|            try { $global:AzDcrDetails = Get-SIDcrList @authParams -Verbose:$false 4>$null } catch { }
|            $pinned = Select-SIRunHealthIngestTarget -SubscriptionId $subId `
|                        -DceResourceGroup $dceRg -DceName $global:SI_DceName `
|                        -DcrResourceGroup $global:SI_DcrResourceGroup -DcrName $dcrName
|            if (-not $pinned) {
|                # #281 -- the rule list (Azure Resource Graph) shows a rule created seconds ago only after a delay: read
|                # it straight from Azure by its id. The endpoint is already pinned by the call above.
|                $direct = Get-SIRunHealthDcrFromArm -SubscriptionId $subId -ResourceGroup $global:SI_DcrResourceGroup -Name $dcrName
|                if ($direct) {
|                    $global:AzDcrDetails = @($direct)
|                    $pinned = Select-SIRunHealthIngestTarget -SubscriptionId $subId `
|                                -DceResourceGroup $dceRg -DceName $global:SI_DceName `
|                                -DcrResourceGroup $global:SI_DcrResourceGroup -DcrName $dcrName
|                }
|            }
|            if (-not $pinned) {
|                if (-not $global:SI_RunHealthFailWarned) {
|                    $global:SI_RunHealthFailWarned = $true
|                    Write-Warning ("Run-health record not saved: the data collection rule '{0}' was not found in resource group '{1}' of subscription '{2}'." -f `
|                                    $dcrName, $global:SI_DcrResourceGroup, $subId)
|                }
|                return
|            }
|        }
|
|        $data = @($row)
|        $data = Repair-SILogColumnName -Data $data 4>$null
|        $data = Format-SILogRowsToSchema -Data $data 4>$null
|        $null = Send-SILogData `
|            -DceName     $global:SI_DceName `
|            -DcrName     $dcrName `
|            -Data        $data `
|            -TableName   $tableName `
|            @authParams 4>$null
|    }
|    catch {
|        # Telemetry must never kill the run -- and must never fail INVISIBLY (#198). This was Write-Verbose under a
|        # verbose preference this function itself forces off, so no failure here could ever be seen; the table
|        # stayed empty for 30 days. Once per run, as a warning; the run continues.
|        if (-not $global:SI_RunHealthFailWarned) {
|            $global:SI_RunHealthFailWarned = $true
|            Write-Warning ('Run-health record could not be saved: {0}' -f $_.Exception.Message)
|        }
|    }
|    finally {
|        # #226 -- the telemetry `run` report (and the daily heartbeat), at the run-health END moment. Independent of
|        # whether the Log Analytics record above could be saved. Send-SITelemetryRunEnd never throws and gives up after
|        # one short attempt; the extra try is so that even a missing function cannot reach the run.
|        if ($Phase -eq 'End' -and -not $NoTelemetry) {
|            try {
|                if (Get-Command -Name Send-SITelemetryRunEnd -ErrorAction SilentlyContinue) {
|                    $null = Send-SITelemetryRunEnd -RunContext $RunContext -ExitReason $ExitReason -ErrorMessage $ErrorMessage -AssetCount $AssetCount
|                }
|            } catch { }
|        }
|        # CR3 (#657) -- this run's components (collections per source, correlation, Risk Analysis, data out per channel) count
|        # a good daily run, or start their count again after a failed one, while they are Testing after a release. Only the
|        # engine's own END record (never a pipeline step record or a dry run), only with the Pro database the run has open.
|        # Independent of telemetry; never throws.
|        if ($Phase -eq 'End' -and -not [bool]$global:WhatIfMode -and -not ([string]$RunContext.Engine).StartsWith('flow', [System.StringComparison]::OrdinalIgnoreCase)) {
|            try {
|                if (Get-Command -Name Invoke-SIReleaseScopeRunEnd -ErrorAction SilentlyContinue) { $null = Invoke-SIReleaseScopeRunEnd -RunContext $RunContext -ExitReason $ExitReason }
|            } catch { }
|        }
|        # #532 -- the ONE throttling alert: only when this job has not succeeded for a long stretch because of throttling
|        # (SI_Throttle_StuckHours / SI_Throttle_StuckRuns). Once per episode; never throws; never for a flow record (the
|        # engine of the step reports its own) and never for a dry run.
|        if ($Phase -eq 'End' -and $ExitReason -eq 'throttled' -and -not [bool]$global:WhatIfMode -and [int]$RunContext.ShardIndex -eq 0 -and
|            -not ([string]$RunContext.Engine).StartsWith('flow', [System.StringComparison]::OrdinalIgnoreCase)) {
|            try {
|                if (Get-Command -Name Invoke-SIThrottleStuckCheck -ErrorAction SilentlyContinue) {
|                    $null = Invoke-SIThrottleStuckCheck -Engine ([string]$RunContext.Engine).ToLowerInvariant() -RunId ([string]$RunContext.RunId)
|                }
|            } catch { }
|        }
|        # Restore caller's verbose preference even on bail-out / exception.
|        if ($null -ne $_savedVerbosePreference) { $global:VerbosePreference = $_savedVerbosePreference }
|    }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-FirstRun.ps1'] = @{ Sha256 = '3564963bd47275ffd91f657d6ba5ee91914651d07b30b00e095ad267ece583bb'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- the FIRST RUN AFTER AN UPGRADE, and the dry-run lines every run carries.
|
|    Many 2.2 installs receive 3.0 with nobody reading the upgrade notes: 2.2's Update-SecurityInsight.ps1 pulls at once,
|    the 2.2 README scheduled a daily `git pull`, and internal installs are synced from main. So 3.0 must arrive safely by
|    itself. This file is that safety layer, shared by the VM loader (launcher\_lib\Initialize-LauncherConfig.ps1) and the
|    container entry points (container\Start-SIInContainer.ps1, container\Start-RiskAnalysisInContainer.ps1):
|
|      1. DETECTION, once per install: "this install ran an earlier version, and this is its first 3.0 run". A small
|         state file is written on the first 3.0 run (VM: <solution>\logs\state\install-state.json; container: blob
|         'install/install-state.json' in the install's 'sistate' container). With no state yet, the install is
|         UPGRADED when there is evidence of earlier runs -- run logs older than this run, a 2.2 config snapshot (2.2
|         loaded the engine defaults AFTER the customer file), or a setting only 2.2 knew -- and FRESH otherwise. A fresh
|         install gets no upgrade notice. The state then says which one-time notices were shown, so none repeats.
|      2. ONE-TIME NOTICES: what 3.0 changed by itself (upgraded installs), what the status reports to Invardia carry and
|         how to turn them off (every install, once, while they are on), on a Pro install what it now does with Invardia
|         by itself (the automatic licence request and the Pro updates, both on by default) with the off switch for each,
|         and -- per engine, VM only -- the settings from
|         the customer's own configuration that now take effect (2.2 overwrote them with its engine defaults; the list
|         is computed against the 2.2.460 defaults kept in launcher\_lib\v2.2-engine-defaults.locked.json and saved to
|         logs\settings-now-in-effect-<engine>.txt for support).
|      3. DRY RUN is asked for PER RUN only (operator decision: "upgrade must work, no dryrun"). A WhatIfMode that comes
|         from the configuration (custom.ps1, a launcher config, the Pro settings, a container job's settings) is IGNORED
|         for every engine except asset tagging -- where it has always meant "do not change any tag" and is kept -- and
|         every run says so in one line. A dry run is started with the launcher's -WhatIfMode switch, or with SI_WHATIF=1
|         on one container job execution. A dry run says so loudly at its start and at its end (Send-SIRunHealthRow).
|
|    RULE: nothing here may fail or stop a run. Every reader and writer swallows its own errors.
|    Customer-facing text: plain words, no tracking numbers, no internal terms.
|    PS 5.1 and 7.
|#>
|
|# the install-state blob (a container) goes through SI's Azure wrappers: load them where this file is
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-AzRest.ps1') }
|# Pro: what the install now does with Invardia by itself, and its two switches (the one-time 'pro-auto' notice)
|if (-not (Get-Command -Name Get-SIProAutoNoticeLines -ErrorAction SilentlyContinue)) {
|    $siFrProAuto = Join-Path $PSScriptRoot 'SI-ProAutomation.ps1'
|    if (Test-Path -LiteralPath $siFrProAuto) { . $siFrProAuto }
|}
|
|$script:SIFirstRun = @{
|    SolutionRoot   = (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))
|    StateFileName  = 'install-state.json'
|    StateBlob      = 'install/install-state.json'
|    StateContainer = 'sistate'
|    RunLogContainer = 'sistaging'
|    RunLogPrefix   = 'run-logs/'
|    # Settings that only 2.2 read. 3.0 ships none of them, so a configuration that sets one was written for 2.2.
|    Legacy22Settings = @('SendToPowerBI', 'SI_SendToPowerBI', 'TroubleshootingMode', 'SI_UseNewRuleEngine',
|                         'SI_DiscoveryMode_azure', 'SI_SystemPrompt_publicip', 'SI_EnableAI_publicip')
|    Legacy22Prefixes = @('PowerBI_')
|    # The engines where WhatIfMode in the configuration is KEPT: asset tagging changes the customer's own resources,
|    # and "report only" is what 2.2 did with it too.
|    DryRunConfigEngines = @('assettagging', 'asset-tagging')
|    SecretNameRe   = '(?i)Secret|Password|Pwd|ApiKey|Api_Key|AccessKey|Token(?!Lifetime)|ConnectionString|StorageKey|Cert(?:ificate)?Thumbprint'
|}
|
|# =====================================================================================================================
|#  Pure decisions
|# =====================================================================================================================
|function Test-SIFirstRunTruthy {
|    <# PURE. $true / 'true' / '1' / 'yes' / 'on' / '$true' -> $true; anything else (null, empty, false, 0 ...) -> $false. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $false }
|    if ($Value -is [bool]) { return $Value }
|    if ($Value -is [System.Management.Automation.SwitchParameter]) { return $Value.IsPresent }
|    return ("$Value".Trim().Trim('$').ToLowerInvariant() -in @('true', '1', 'yes', 'on'))
|}
|
|function Get-SIFirstRunDecision {
|    <#
|        PURE. -State: the install's state ($null = none yet). -Evidence: the signs of earlier runs found ('' entries ignored).
|        Returns Kind = seen (a 3.0 run already recorded this install) | upgraded (first 3.0 run of an install that ran
|        before) | fresh (first run of a new install), and Origin = upgraded | fresh.
|    #>
|    param([AllowNull()]$State, [AllowNull()][AllowEmptyCollection()][string[]]$Evidence)
|    if ($State -and $State.PSObject.Properties['Origin'] -and "$($State.Origin)" -in @('upgraded', 'fresh')) {
|        return [pscustomobject]@{ Kind = 'seen'; Origin = [string]$State.Origin }
|    }
|    $ev = @($Evidence | Where-Object { "$_".Trim() })
|    if ($ev.Count) { return [pscustomobject]@{ Kind = 'upgraded'; Origin = 'upgraded' } }
|    [pscustomobject]@{ Kind = 'fresh'; Origin = 'fresh' }
|}
|
|function New-SIInstallState {
|    <# PURE. A new install state. #>
|    param([Parameter(Mandatory)][ValidateSet('upgraded', 'fresh')][string]$Origin, [AllowNull()][string[]]$Evidence,
|          [AllowEmptyString()][string]$Version, [datetime]$NowUtc = [datetime]::UtcNow)
|    [pscustomobject]@{
|        Schema = 1; Origin = $Origin; FirstRunUtc = $NowUtc.ToUniversalTime().ToString('o'); FirstVersion = "$Version"
|        Evidence = @($Evidence | Where-Object { "$_".Trim() }); Shown = @()
|    }
|}
|
|function Test-SINoticeDue {
|    <# PURE. Has the one-time notice -Id not been shown on this install yet? #>
|    param([AllowNull()]$State, [Parameter(Mandatory)][string]$Id)
|    if (-not $State -or -not $State.PSObject.Properties['Shown']) { return $true }
|    return -not (@($State.Shown) -contains $Id)
|}
|
|function Add-SINoticeShown {
|    <# Records the notice -Id as shown in -State (in place). #>
|    param([Parameter(Mandatory)]$State, [Parameter(Mandatory)][string]$Id)
|    $shown = @($State.Shown | Where-Object { "$_" })
|    if ($shown -notcontains $Id) { $shown += $Id }
|    if ($State.PSObject.Properties['Shown']) { $State.Shown = $shown } else { $State | Add-Member -NotePropertyName Shown -NotePropertyValue $shown }
|}
|
|function Resolve-SIConfigDryRun {
|    <#
|        PURE. Does a WhatIfMode from the CONFIGURATION make this engine's run a dry run? Only for asset tagging (it keeps
|        what it always meant there: report only, change no tag). For every other engine a dry run is asked for per run
|        (-WhatIfMode on the launcher, SI_WHATIF on one container job execution), and a configuration value is ignored.
|        -SetByConfig: the value came from a configuration layer (not from the caller's own session).
|        Returns Ignored (a true configuration value was set aside) and WhatIfMode (the value to use before any per-run
|        request is applied).
|    #>
|    param([AllowEmptyString()][string]$Engine, [AllowNull()]$ConfigValue, [bool]$SetByConfig = $true)
|    $on = Test-SIFirstRunTruthy $ConfigValue
|    $e = ("$Engine".Trim().ToLowerInvariant() -replace '[\s_]', '')
|    if (-not $on) { return [pscustomobject]@{ Ignored = $false; WhatIfMode = $false } }
|    if (-not $SetByConfig -or $e -in $script:SIFirstRun.DryRunConfigEngines) { return [pscustomobject]@{ Ignored = $false; WhatIfMode = $true } }
|    [pscustomobject]@{ Ignored = $true; WhatIfMode = $false }
|}
|
|function ConvertTo-SISettingDisplay {
|    <# PURE. A setting value as one short, readable line. Secret-looking names are never shown. #>
|    param([string]$Name, [AllowNull()]$Value)
|    if ($Name -match $script:SIFirstRun.SecretNameRe) { return '(hidden)' }
|    if ($null -eq $Value) { return '(not set)' }
|    if ($Value -is [bool]) { return ('$' + $Value.ToString().ToLowerInvariant()) }
|    if ($Value -is [System.Collections.IDictionary]) { return ('@{' + ((@($Value.Keys) | ForEach-Object { "$_" }) -join ', ') + '}') }
|    if ($Value -is [array] -or $Value -is [System.Collections.IList]) {
|        return ('@(' + ((@($Value) | ForEach-Object { "'$_'" }) -join ', ') + ')')
|    }
|    $s = ("$Value" -replace '\r?\n', ' ')
|    if ($Value -is [string] -and -not $s.Trim()) { return '(empty)' }
|    if ($s.Length -gt 120) { $s = $s.Substring(0, 120) + '...' }
|    if ($Value -is [string]) { return "'$s'" }
|    return $s
|}
|
|function ConvertTo-SISettingComparable {
|    <# PURE. The value as text for comparing a 2.2 default with today's value (bool / number / list / text alike). #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return '' }
|    if ($Value -is [bool]) { return $Value.ToString().ToLowerInvariant() }
|    if ($Value -is [System.Collections.IDictionary]) { return '' }
|    if ($Value -is [array] -or $Value -is [System.Collections.IList]) { return ((@($Value) | ForEach-Object { "$_".Trim() }) -join ',') }
|    $s = "$Value".Trim()
|    if ($s -match '^(?i)\$?(true|false)$') { return $Matches[1].ToLowerInvariant() }
|    return $s
|}
|
|function Get-SISettingsNowInEffect {
|    <#
|        PURE. The settings of ONE engine that the customer's solution-wide configuration (config\SecurityInsight.custom.ps1)
|        now makes take effect. In 2.2 the engine's shipped defaults loaded AFTER that file, so every default set without a
|        guard replaced the customer's value; 3.0 loads the defaults first. A setting is listed when:
|          the customer's file sets it, 2.2's defaults for this engine set it too, the engine's own customer file
|          (LauncherConfig.custom.ps1, loaded last in both versions) does not, and today's value differs from the 2.2 one.
|        -V22Defaults: name -> the value 2.2.460's defaults set (unguarded) for this engine.
|        -CustomNames / -EngineCustomNames: the names each customer file assigns.  -Current: name -> today's value.
|        Returns @{ Name; Was; Now } sorted by name.
|    #>
|    param([AllowNull()][System.Collections.IDictionary]$V22Defaults, [AllowNull()][string[]]$CustomNames,
|          [AllowNull()][string[]]$EngineCustomNames, [AllowNull()][System.Collections.IDictionary]$Current)
|    $out = New-Object System.Collections.Generic.List[object]
|    if (-not $V22Defaults -or -not $Current) { return @() }
|    $engineOwn = @($EngineCustomNames | Where-Object { $_ })
|    foreach ($n in @($CustomNames | Where-Object { $_ } | Sort-Object -Unique)) {
|        $key = @($V22Defaults.Keys | Where-Object { "$_" -ieq $n }) | Select-Object -First 1
|        if (-not $key) { continue }
|        if (@($engineOwn | Where-Object { $_ -ieq $n }).Count) { continue }
|        $was = $V22Defaults[$key]
|        $nowKey = @($Current.Keys | Where-Object { "$_" -ieq $n }) | Select-Object -First 1
|        $now = if ($nowKey) { $Current[$nowKey] } else { $null }
|        if ((ConvertTo-SISettingComparable $was) -ceq (ConvertTo-SISettingComparable $now)) { continue }
|        $out.Add([pscustomobject]@{ Name = [string]$key; Was = $was; Now = $now })
|    }
|    return @($out.ToArray())
|}
|
|# =====================================================================================================================
|#  The customer-facing texts (plain words; no tracking numbers, no internal terms)
|# =====================================================================================================================
|function Get-SIConfigDryRunIgnoredText {
|    param([ValidateSet('vm', 'container')][string]$Hosting = 'vm')
|    $how = if ($Hosting -eq 'container') { 'set SI_WHATIF=1 on a single job execution' } else { 'start the run with -WhatIfMode' }
|    "WhatIfMode in your configuration is ignored for scheduled runs -- runs publish as normal; for a dry run, $how."
|}
|
|function Get-SIDryRunNoticeText {
|    param([Parameter(Mandatory)][ValidateSet('Start', 'End')][string]$Moment)
|    if ($Moment -eq 'Start') {
|        return 'DRY RUN -- this run publishes nothing and sends nothing (it was started as a dry run). Run it without -WhatIfMode (or without SI_WHATIF on a container job) to publish.'
|    }
|    'DRY RUN finished -- nothing was published or sent. Run it without -WhatIfMode (or without SI_WHATIF on a container job) to publish.'
|}
|
|function Get-SIUpgradeNoticeLines {
|    <# PURE. The one-time notice on the first 3.0 run of an upgraded install. #>
|    param([ValidateSet('vm', 'container')][string]$Hosting = 'vm', [bool]$WhatIfConfigIgnored = $false)
|    $l = New-Object System.Collections.Generic.List[string]
|    $l.Add('SecurityInsight was updated to 3.0 on this installation. These changes apply by themselves -- nothing needs to be done now:')
|    if ($Hosting -eq 'vm') {
|        $l.Add(' - Your own settings in config\SecurityInsight.custom.ps1 now win over the built-in engine defaults. Each engine lists once, on its first run, which of your settings now take effect (also saved in the logs folder).')
|    }
|    $l.Add(' - SecurityInsight no longer refreshes a Power BI dataset. Results are still written to Log Analytics; read them with the Azure Monitor workbook, your own queries or reports, or the SecurityInsight Pro web app.')
|    if ($WhatIfConfigIgnored) {
|        $how = if ($Hosting -eq 'container') { 'set SI_WHATIF=1 on a single job execution' } else { 'start a run with -WhatIfMode' }
|        $l.Add((' - Your configuration sets WhatIfMode. It no longer stops or limits scheduled runs: they publish as normal. For a dry run, {0}.' -f $how))
|    } else {
|        $l.Add(' - A dry run is now asked for per run (the -WhatIfMode switch); WhatIfMode in a configuration file no longer changes scheduled runs.')
|    }
|    $l.Add(' - The full list is in RELEASENOTES.md, section "Upgrading from 2.2.x". This notice is shown once.')
|    return @($l.ToArray())
|}
|
|function Get-SITelemetryNoticeLines {
|    <# PURE. The one-time notice about the status reports to Invardia (shown while they are on). #>
|    param([ValidateSet('vm', 'container')][string]$Hosting = 'vm')
|    $off = if ($Hosting -eq 'container') { 'set SI_Telemetry_Enabled = $false in config\SecurityInsight.custom.ps1 and run setup again, or set SI_TELEMETRY_ENABLED=false on the jobs' }
|           else { 'set $global:SI_Telemetry_Enabled = $false in config\SecurityInsight.custom.ps1' }
|    @(
|        'SecurityInsight sends short status reports to Invardia, the maker of SecurityInsight: one a day (version, edition, how it is hosted, licence state) and one per engine run (whether it succeeded, how long it took, the kind of error, and counts).',
|        ' - A Community installation reports anonymously, with a random installation id: no tenant, no host name, no error text, and counts only as ranges.',
|        ' - A Pro installation reports with its installation key; error messages are shortened and secrets are removed before they are sent.',
|        (' - To turn the reports off, {0}. This notice is shown once.' -f $off)
|    )
|}
|
|function Get-SISettingsNowInEffectLines {
|    <# PURE. The one-time per-engine list, for the console and the file in logs\. #>
|    param([Parameter(Mandatory)][string]$Engine, [AllowNull()][AllowEmptyCollection()][object[]]$Changes, [string]$FileName)
|    $c = @($Changes | Where-Object { $_ })
|    if (-not $c.Count) { return @(('No setting in your configuration changes the {0} engine''s behaviour with SecurityInsight 3.0.' -f $Engine)) }
|    $l = New-Object System.Collections.Generic.List[string]
|    $l.Add(('These settings from your configuration now take effect for the {0} engine. SecurityInsight 2.2 replaced them with its built-in defaults; 3.0 uses your values:' -f $Engine))
|    foreach ($x in $c) {
|        $l.Add(('   {0}: was {1}, now {2}' -f $x.Name, (ConvertTo-SISettingDisplay -Name $x.Name -Value $x.Was), (ConvertTo-SISettingDisplay -Name $x.Name -Value $x.Now)))
|    }
|    if ($FileName) { $l.Add((' This list is saved in logs\{0} and is shown once. To keep 2.2''s behaviour for a setting, remove it from your configuration.' -f $FileName)) }
|    return @($l.ToArray())
|}
|
|function Write-SINoticeLines {
|    <# Prints notice lines: the first as [NOTICE], the rest indented. Into the console and the run log (transcript). #>
|    param([AllowEmptyCollection()][string[]]$Lines)
|    $first = $true
|    foreach ($line in @($Lines)) {
|        try {
|            if ($first) { Write-Host ('[NOTICE] {0}' -f $line) -ForegroundColor Yellow; $first = $false }
|            else { Write-Host ('         {0}' -f $line) -ForegroundColor Yellow }
|        } catch { }
|    }
|}
|
|# =====================================================================================================================
|#  The retired Power BI refresh -- one line per run while it is still configured (VM loader and containers alike)
|# =====================================================================================================================
|function Write-SIPowerBIRetiredNotice {
|    <#
|        The Power BI dataset refresh (SendToPowerBI, PowerBI_*) was removed in 3.0.0. When a configuration still turns it
|        on -- SendToPowerBI / SI_SendToPowerBI true, or any PowerBI_* setting with a value -- print ONE line saying so and
|        where the results are read now. Nothing set = nothing printed. Returns $true when it printed.
|    #>
|    [CmdletBinding()]
|    param()
|    $on = $false
|    foreach ($n in @('SendToPowerBI', 'SI_SendToPowerBI')) {
|        $v = Get-Variable -Name $n -Scope Global -ValueOnly -ErrorAction SilentlyContinue
|        if ($v -is [bool]) { if ($v) { $on = $true } }
|        elseif ($null -ne $v -and ([string]$v).Trim() -match '^(?i:true|1|yes|on|\$true)$') { $on = $true }
|    }
|    if (-not $on) {
|        foreach ($var in @(Get-Variable -Name 'PowerBI_*' -Scope Global -ErrorAction SilentlyContinue)) {
|            if (-not [string]::IsNullOrWhiteSpace([string]$var.Value)) { $on = $true; break }
|        }
|    }
|    if (-not $on) { return $false }
|    Write-Warning ('The Power BI refresh was retired in SecurityInsight 3.0: SendToPowerBI and the PowerBI_* settings ' +
|        'are no longer used, and no Power BI dataset is refreshed. Your results are still written to Log Analytics -- ' +
|        'read them with the Azure Monitor workbook (preview\AzureWorkbook), with your own queries or a Power BI report ' +
|        'connected to the workspace, or in the SecurityInsight Pro web app. Remove these settings from your ' +
|        'configuration to stop this message.')
|    return $true
|}
|
|# =====================================================================================================================
|#  This install: the state, the evidence, the telemetry switch
|# =====================================================================================================================
|function Get-SIFirstRunVersion {
|    param([string]$SolutionRoot = $script:SIFirstRun.SolutionRoot)
|    try {
|        $f = [System.IO.Path]::Combine($SolutionRoot, 'VERSION')
|        if ([System.IO.File]::Exists($f)) { return ([System.IO.File]::ReadAllText($f)).Trim() }
|    } catch { }
|    ''
|}
|
|function Test-SIFirstRunTelemetryOn {
|    <# Are the status reports on? The telemetry sender's own decision when it is loaded, else the same rule: the setting,
|       then SI_TELEMETRY_ENABLED, else on. #>
|    if (Get-Command -Name Test-SITelemetryEnabled -ErrorAction SilentlyContinue) { try { return [bool](Test-SITelemetryEnabled) } catch { } }
|    foreach ($v in @($global:SI_Telemetry_Enabled, $env:SI_TELEMETRY_ENABLED)) {
|        if ($null -eq $v) { continue }
|        if ($v -is [bool]) { return $v }
|        $s = "$v".Trim().Trim('$').ToLowerInvariant()
|        if (-not $s) { continue }
|        return -not ($s -in @('false', '0', 'off', 'no', 'disabled'))
|    }
|    $true
|}
|
|function Get-SIFirstRunProAuto {
|    <#
|        Pro only: is this a SecurityInsight Pro run (its settings database is configured), and are the automatic licence
|        request and the Pro updates from Invardia on? The run's settings ($global:, the Pro settings layer sets them), then
|        the job's environment, else on. Returns @{ Pro; LicenceOn; UpdatesOn }.
|    #>
|    $pro = [bool]("$($global:SI_ProSqlServer)".Trim() -and "$($global:SI_ProSqlDatabase)".Trim())
|    $lic = $true; $upd = $true
|    if (Get-Command -Name Resolve-SIProAutoSwitch -ErrorAction SilentlyContinue) {
|        try { $lic = (Resolve-SIProAutoSwitch -Name SI_LicenseRequest_Auto -SettingValue $global:SI_LicenseRequest_Auto -EnvValue $env:SI_LICENSE_REQUEST_AUTO).On } catch { }
|        try { $upd = (Resolve-SIProAutoSwitch -Name SI_InvardiaUpdate_Enabled -SettingValue $global:SI_InvardiaUpdate_Enabled -EnvValue $env:SI_INVARDIA_UPDATE_ENABLED).On } catch { }
|    }
|    [pscustomobject]@{ Pro = $pro; LicenceOn = [bool]$lic; UpdatesOn = [bool]$upd }
|}
|
|function ConvertFrom-SIInstallStateJson {
|    param([AllowNull()][AllowEmptyString()][string]$Json)
|    if ([string]::IsNullOrWhiteSpace($Json)) { return $null }
|    $o = $Json | ConvertFrom-Json -ErrorAction Stop
|    if (-not $o.PSObject.Properties['Shown']) { $o | Add-Member -NotePropertyName Shown -NotePropertyValue @() }
|    $o.Shown = @($o.Shown | Where-Object { "$_" })
|    $o
|}
|
|function Read-SIInstallState {
|    <#
|        -Store: @{ Kind = 'file'; Path } | @{ Kind = 'blob'; Account } | @{ Kind = 'memory'; Box = @{} } (tests).
|        Returns @{ Ok; State } -- Ok $false when the store could not be read (the caller then shows nothing and writes
|        nothing, so an unreadable store never repeats a notice on every run). An absent state is Ok with State $null.
|    #>
|    param([Parameter(Mandatory)][hashtable]$Store)
|    try {
|        switch ($Store.Kind) {
|            'file' {
|                if (-not [System.IO.File]::Exists($Store.Path)) { return [pscustomobject]@{ Ok = $true; State = $null } }
|                return [pscustomobject]@{ Ok = $true; State = (ConvertFrom-SIInstallStateJson ([System.IO.File]::ReadAllText($Store.Path))) }
|            }
|            'memory' { return [pscustomobject]@{ Ok = $true; State = (ConvertFrom-SIInstallStateJson ([string]$Store.Box['json'])) } }
|            'blob' {
|                $ctx = Get-SIRunStateContext -AccountName $Store.Account
|                $blob = $null
|                try { $blob = Get-SIAzStorageBlob -Container $script:SIFirstRun.StateContainer -Blob $script:SIFirstRun.StateBlob -Context $ctx -ErrorAction Stop }
|                catch {
|                    if ("$($_.Exception.Message)" -match '(?i)BlobNotFound|ContainerNotFound|does not exist|404|Can not find') { return [pscustomobject]@{ Ok = $true; State = $null } }
|                    throw
|                }
|                if (-not $blob) { return [pscustomobject]@{ Ok = $true; State = $null } }
|                $tmp = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), ('si-state-{0}.json' -f [guid]::NewGuid().ToString('N')))
|                try {
|                    Get-SIAzStorageBlobContent -Container $script:SIFirstRun.StateContainer -Blob $script:SIFirstRun.StateBlob -Destination $tmp -Context $ctx -Force -ErrorAction Stop | Out-Null
|                    return [pscustomobject]@{ Ok = $true; State = (ConvertFrom-SIInstallStateJson ([System.IO.File]::ReadAllText($tmp))) }
|                } finally { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue }
|            }
|            default { return [pscustomobject]@{ Ok = $false; State = $null } }
|        }
|    } catch {
|        Write-Verbose ('install state not read: {0}' -f $_.Exception.Message)
|        return [pscustomobject]@{ Ok = $false; State = $null }
|    }
|}
|
|function Save-SIInstallState {
|    <# Writes the state to -Store. Never throws; $true when written. #>
|    param([Parameter(Mandatory)][hashtable]$Store, [Parameter(Mandatory)]$State)
|    try {
|        $json = $State | ConvertTo-Json -Depth 5
|        switch ($Store.Kind) {
|            'file' {
|                $dir = [System.IO.Path]::GetDirectoryName($Store.Path)
|                $null = [System.IO.Directory]::CreateDirectory($dir)
|                $tmp = $Store.Path + '.' + [guid]::NewGuid().ToString('N') + '.tmp'
|                [System.IO.File]::WriteAllText($tmp, $json, (New-Object System.Text.UTF8Encoding($false)))
|                if ([System.IO.File]::Exists($Store.Path)) { [System.IO.File]::Delete($Store.Path) }
|                [System.IO.File]::Move($tmp, $Store.Path)
|                return $true
|            }
|            'memory' { $Store.Box['json'] = $json; $Store.Box['writes'] = 1 + [int]$Store.Box['writes']; return $true }
|            'blob' {
|                $ctx = Get-SIRunStateContext -AccountName $Store.Account
|                if (-not (Get-SIAzStorageContainer -Name $script:SIFirstRun.StateContainer -Context $ctx -ErrorAction SilentlyContinue)) {
|                    New-SIAzStorageContainer -Name $script:SIFirstRun.StateContainer -Context $ctx -Permission Off -ErrorAction Stop | Out-Null
|                }
|                $tmp = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), ('si-state-{0}.json' -f [guid]::NewGuid().ToString('N')))
|                try {
|                    [System.IO.File]::WriteAllText($tmp, $json, (New-Object System.Text.UTF8Encoding($false)))
|                    Set-SIAzStorageBlobContent -File $tmp -Container $script:SIFirstRun.StateContainer -Blob $script:SIFirstRun.StateBlob -Context $ctx -Force -ErrorAction Stop | Out-Null
|                } finally { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue }
|                return $true
|            }
|        }
|    } catch { Write-Verbose ('install state not saved: {0}' -f $_.Exception.Message) }
|    $false
|}
|
|function Get-SILegacySettingsEvidence {
|    <# PURE. 'v2.2-settings' when any of -Names is a setting only 2.2 read. #>
|    param([AllowNull()][AllowEmptyCollection()][string[]]$Names)
|    foreach ($n in @($Names | Where-Object { $_ })) {
|        if (@($script:SIFirstRun.Legacy22Settings | Where-Object { $_ -ieq $n }).Count) { return 'v2.2-settings' }
|        foreach ($p in $script:SIFirstRun.Legacy22Prefixes) { if ($n -like "$p*") { return 'v2.2-settings' } }
|    }
|    ''
|}
|
|function Get-SIUpgradeEvidenceVm {
|    <#
|        The signs, on a VM, that this install ran before its first 3.0 run. -LogDir: the install's logs folder.
|        -Before: when this run started (its own transcript is newer). -SettingNames: the names the customer files assign.
|        Returns a list of: earlier-run-logs | v2.2-config-snapshot | v2.2-settings. Never throws.
|    #>
|    param([string]$LogDir, [datetime]$Before = [datetime]::Now, [AllowNull()][AllowEmptyCollection()][string[]]$SettingNames)
|    $ev = New-Object System.Collections.Generic.List[string]
|    try {
|        if ($LogDir -and (Test-Path -LiteralPath $LogDir)) {
|            $old = @(Get-ChildItem -LiteralPath $LogDir -Filter '*.log' -File -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -lt $Before })
|            if ($old.Count) { $ev.Add('earlier-run-logs') }
|            # 2.2 loaded the engine defaults AFTER the customer file, and its config snapshot says so in its layer trail.
|            foreach ($f in @($old | Where-Object { $_.Name -like 'config-*.log' } | Sort-Object LastWriteTime -Descending | Select-Object -First 5)) {
|                try {
|                    $head = [System.IO.File]::ReadAllText($f.FullName)
|                    if ($head -match 'Layer 4 - LauncherConfig\.defaults') { $ev.Add('v2.2-config-snapshot'); break }
|                } catch { }
|            }
|        }
|    } catch { }
|    $s = Get-SILegacySettingsEvidence -Names $SettingNames
|    if ($s) { $ev.Add($s) }
|    @($ev.ToArray())
|}
|
|function Get-SIUpgradeEvidenceContainer {
|    <#
|        The signs, for a container install, that it ran before its first 3.0 run: run logs published to the install's
|        storage account before this run started, or a setting only 2.2 read among the job's settings. Never throws.
|    #>
|    param([string]$Account, [datetime]$Before = [datetime]::UtcNow, [AllowNull()][AllowEmptyCollection()][string[]]$SettingNames)
|    $ev = New-Object System.Collections.Generic.List[string]
|    if ($Account) {
|        try {
|            $ctx = Get-SIRunStateContext -AccountName $Account
|            $logs = @(Get-SIAzStorageBlob -Container $script:SIFirstRun.RunLogContainer -Prefix $script:SIFirstRun.RunLogPrefix -Context $ctx -ErrorAction Stop | Where-Object { $_ })
|            $old = @($logs | Where-Object {
|                $lm = $null
|                if ($_.PSObject.Properties['LastModified'] -and $_.LastModified) { try { $lm = ([DateTimeOffset]$_.LastModified).UtcDateTime } catch { try { $lm = ([datetime]$_.LastModified).ToUniversalTime() } catch { } } }
|                (-not $lm) -or ($lm -lt $Before.ToUniversalTime())
|            })
|            if ($old.Count) { $ev.Add('earlier-run-logs') }
|        } catch { Write-Verbose ('earlier run logs not checked: {0}' -f $_.Exception.Message) }
|    }
|    $s = Get-SILegacySettingsEvidence -Names $SettingNames
|    if ($s) { $ev.Add($s) }
|    @($ev.ToArray())
|}
|
|# =====================================================================================================================
|#  The one call per run
|# =====================================================================================================================
|function Invoke-SIFirstRunNotices {
|    <#
|        Decides and shows this run's one-time notices, and records them. Never throws. Returns @{ Kind; Origin; Shown
|        (the ids shown now); Saved; SettingsFile }.
|          -Hosting vm | container          -Engine   the engine (the launcher folder name on a VM)
|          -Store    where the install state lives (see Read-SIInstallState)
|          -Evidence { } -> string[]        evaluated ONLY when there is no state yet
|          -SettingsChanges { } -> @{Name;Was;Now}[]   VM, upgraded installs: this engine's settings now in effect
|          -LogDir   where the settings list file is written (VM)
|          -WhatIfConfigIgnored             this run set aside a WhatIfMode from the configuration
|          -TelemetryOn                     the status reports are on (default: the run's setting)
|          -ProAuto                         @{ Pro; LicenceOn; UpdatesOn } (default: Get-SIFirstRunProAuto) -- a Pro install
|                                           is told once what it now does with Invardia by itself and how to switch it off
|    #>
|    [CmdletBinding()]
|    param([ValidateSet('vm', 'container')][string]$Hosting = 'vm', [string]$Engine = '', [Parameter(Mandatory)][hashtable]$Store,
|          [scriptblock]$Evidence, [scriptblock]$SettingsChanges, [string]$LogDir, [bool]$WhatIfConfigIgnored = $false,
|          $TelemetryOn = $null, $ProAuto = $null, [string]$Version, [datetime]$NowUtc = [datetime]::UtcNow)
|    $res = [pscustomobject]@{ Kind = 'unknown'; Origin = ''; Shown = @(); Saved = $false; SettingsFile = '' }
|    try {
|        $read = Read-SIInstallState -Store $Store
|        if (-not $read.Ok) { return $res }
|        $state = $read.State
|        $dirty = $false
|        $ev = @()
|        if (-not $state) { if ($Evidence) { try { $ev = @(& $Evidence) } catch { $ev = @() } } }
|        $d = Get-SIFirstRunDecision -State $state -Evidence $ev
|        $res.Kind = $d.Kind; $res.Origin = $d.Origin
|        if (-not $state) {
|            if (-not $PSBoundParameters.ContainsKey('Version')) { $Version = Get-SIFirstRunVersion }
|            $state = New-SIInstallState -Origin $d.Origin -Evidence $ev -Version $Version -NowUtc $NowUtc
|            $dirty = $true
|        }
|        $global:SI_InstallOrigin = [string]$state.Origin
|        $shown = New-Object System.Collections.Generic.List[string]
|
|        if ($state.Origin -eq 'upgraded' -and (Test-SINoticeDue -State $state -Id 'upgrade')) {
|            Write-SINoticeLines -Lines (Get-SIUpgradeNoticeLines -Hosting $Hosting -WhatIfConfigIgnored $WhatIfConfigIgnored)
|            Add-SINoticeShown -State $state -Id 'upgrade'; $shown.Add('upgrade'); $dirty = $true
|        }
|        $tOn = if ($null -eq $TelemetryOn) { Test-SIFirstRunTelemetryOn } else { [bool]$TelemetryOn }
|        if ($tOn -and (Test-SINoticeDue -State $state -Id 'telemetry')) {
|            Write-SINoticeLines -Lines (Get-SITelemetryNoticeLines -Hosting $Hosting)
|            Add-SINoticeShown -State $state -Id 'telemetry'; $shown.Add('telemetry'); $dirty = $true
|        }
|        # Pro: the automatic licence request and the Pro updates from Invardia are ON by default -- upgraded installs
|        # included, with no opt-in -- so every Pro install is told once, with the off switch for each.
|        $pa = if ($null -eq $ProAuto) { if (Get-Command -Name Get-SIFirstRunProAuto -ErrorAction SilentlyContinue) { Get-SIFirstRunProAuto } else { $null } } else { $ProAuto }
|        if ($pa -and $pa.Pro -and ($pa.LicenceOn -or $pa.UpdatesOn) -and (Get-Command -Name Get-SIProAutoNoticeLines -ErrorAction SilentlyContinue) -and (Test-SINoticeDue -State $state -Id 'pro-auto')) {
|            Write-SINoticeLines -Lines (Get-SIProAutoNoticeLines -LicenceOn ([bool]$pa.LicenceOn) -UpdatesOn ([bool]$pa.UpdatesOn))
|            Add-SINoticeShown -State $state -Id 'pro-auto'; $shown.Add('pro-auto'); $dirty = $true
|        }
|        $sid = 'settings:' + ("$Engine".Trim().ToLowerInvariant())
|        if ($Hosting -eq 'vm' -and $state.Origin -eq 'upgraded' -and $SettingsChanges -and "$Engine".Trim() -and (Test-SINoticeDue -State $state -Id $sid)) {
|            $changes = @()
|            try { $changes = @(& $SettingsChanges | Where-Object { $_ }) } catch { $changes = @() }
|            $file = ('settings-now-in-effect-{0}.txt' -f ("$Engine".Trim().ToLowerInvariant() -replace '[^a-z0-9_.-]', '-'))
|            $lines = Get-SISettingsNowInEffectLines -Engine $Engine -Changes $changes -FileName $file
|            if ($changes.Count) { Write-SINoticeLines -Lines $lines }
|            if ($LogDir) {
|                try {
|                    $null = [System.IO.Directory]::CreateDirectory($LogDir)
|                    $p = [System.IO.Path]::Combine($LogDir, $file)
|                    $body = @(('SecurityInsight {0} -- first run of the {1} engine after the update, {2:yyyy-MM-dd HH:mm} UTC' -f (Get-SIFirstRunVersion), $Engine, $NowUtc)) + @('') + @($lines)
|                    [System.IO.File]::WriteAllLines($p, [string[]]$body, (New-Object System.Text.UTF8Encoding($false)))
|                    $res.SettingsFile = $p
|                } catch { }
|            }
|            Add-SINoticeShown -State $state -Id $sid; $shown.Add($sid); $dirty = $true
|        }
|        if ($dirty) { $res.Saved = Save-SIInstallState -Store $Store -State $state }
|        $res.Shown = @($shown.ToArray())
|    } catch { Write-Verbose ('first-run notices skipped: {0}' -f $_.Exception.Message) }
|    $res
|}
|
|function Invoke-SIContainerRunSafety {
|    <#
|        The container entry points' ONE call, after the settings and the Pro / customisation layer are in place and the
|        job is signed in: the dry-run decision (a WhatIfMode from the job's settings is set aside unless the engine is
|        asset tagging; SI_WHATIF on this execution asks for a dry run), the retired Power BI line, and the one-time
|        notices (state in the install's storage account). Never throws.
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [string]$StorageAccount, [scriptblock]$GetEnv)
|    if (-not $GetEnv) { $GetEnv = { param($n) [Environment]::GetEnvironmentVariable($n) } }
|    $ignored = $false
|    try {
|        $dr = Resolve-SIConfigDryRun -Engine $Engine -ConfigValue $global:WhatIfMode
|        if ($dr.Ignored) {
|            $ignored = $true
|            $global:SI_WhatIfModeConfigIgnored = $true
|            Write-Warning (Get-SIConfigDryRunIgnoredText -Hosting container)
|        }
|        $global:WhatIfMode = [bool]$dr.WhatIfMode
|        if (Test-SIFirstRunTruthy (& $GetEnv 'SI_WHATIF')) { $global:WhatIfMode = $true }
|    } catch { }
|    try { $null = Write-SIPowerBIRetiredNotice } catch { }
|    $names = @(Get-Variable -Scope Global -ErrorAction SilentlyContinue | ForEach-Object { $_.Name })
|    $before = try { [System.Diagnostics.Process]::GetCurrentProcess().StartTime.ToUniversalTime() } catch { [datetime]::UtcNow }
|    $acct = $StorageAccount
|    if (-not $acct) { return $null }
|    Invoke-SIFirstRunNotices -Hosting container -Engine $Engine -Store @{ Kind = 'blob'; Account = $acct } -WhatIfConfigIgnored $ignored `
|        -Evidence { Get-SIUpgradeEvidenceContainer -Account $acct -Before $before -SettingNames $names }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-ProAutomation.ps1'] = @{ Sha256 = 'bd2f2f28768b73c979d171fe31b6302f7a2aaf9b2ae50c0f019b47598f39ddda'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight Pro -- WHAT IT DOES WITH INVARDIA BY ITSELF, and the two switches that turn it off.
|
|    Owner decision 2026-10-05 (the same treatment as the status reports): a Pro install asks Invardia for its licence by
|    itself and takes its Pro updates from Invardia by itself -- both ON by default, fresh and upgraded installs alike, and
|    both switchable by the customer:
|
|      SI_LicenseRequest_Auto      the updater job asks Invardia for a licence when there is none, it ends within 30 days,
|                                  or it is in its grace period; quiet while the licence is valid.
|                                  Job environment: SI_LICENSE_REQUEST_AUTO.
|      SI_InvardiaUpdate_Enabled   the updater job checks Invardia for this install's ring and applies a release (signed
|                                  manifest, hold on a manual step or a too-old version, restore on failure).
|                                  Job environment: SI_INVARDIA_UPDATE_ENABLED.
|
|    Where a switch comes from, first wins: the Pro settings database (cfg.Setting, scope 'solution' -- the web app's
|    Settings page), then the job's environment, else ON. If the Pro database cannot be READ the step is skipped for this
|    run (a customer's "off" is never overruled by an unreadable database).
|
|    The licence notice: what the updater audits and mails after a licence request (Get-SILicenceRequestNotice). Success
|    (a licence installed) and failure (refused, rejected, invalid, network, error) are audited and mailed; a failure that
|    keeps repeating is mailed again only after 7 days. Nothing is said while the licence is valid or a request is waiting.
|
|    Everything here is PURE except Read-SIProSolutionSettings (one SELECT through the store's seam). Never throws.
|    Customer-facing words only. PS 5.1 and 7.
|#>
|
|$script:SIProAuto = @{
|    Switches = [ordered]@{
|        SI_LicenseRequest_Auto    = @{ Env = 'SI_LICENSE_REQUEST_AUTO';    Label = 'automatic licence request';  OffText = 'automatic licence request is off' }
|        SI_InvardiaUpdate_Enabled = @{ Env = 'SI_INVARDIA_UPDATE_ENABLED'; Label = 'Pro updates from Invardia'; OffText = 'Pro updates from Invardia are off' }
|    }
|    RemailDays   = 7
|    NoticeSecret = 'SI-LicenceRequest-Notice'
|}
|
|function ConvertTo-SIProAutoFlag {
|    <# PURE. $true / 'true' / '1' / 'on' / 'yes' -> $true; $false / 'false' / '0' / 'off' / 'no' / 'disabled' -> $false; anything else -> $null. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [bool]) { return $Value }
|    $s = "$Value".Trim().Trim('$').Trim('"').ToLowerInvariant()
|    if ($s -in @('true', '1', 'on', 'yes', 'enabled')) { return $true }
|    if ($s -in @('false', '0', 'off', 'no', 'disabled')) { return $false }
|    $null
|}
|
|function Get-SIProAutoSwitchNames { @($script:SIProAuto.Switches.Keys) }
|
|function Resolve-SIProAutoSwitch {
|    <#
|        PURE. One switch: -SettingValue (the Pro settings value, or a $global: on a VM), then -EnvValue (the job's
|        environment), else ON. Returns @{ Name; On; Source = setting | environment | default; Text }.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('SI_LicenseRequest_Auto', 'SI_InvardiaUpdate_Enabled')][string]$Name,
|          [AllowNull()]$SettingValue, [AllowNull()][AllowEmptyString()][string]$EnvValue)
|    $def = $script:SIProAuto.Switches[$Name]
|    $on = $true; $src = 'default'
|    $v = ConvertTo-SIProAutoFlag $SettingValue
|    if ($null -ne $v) { $on = $v; $src = 'setting' }
|    else {
|        $e = ConvertTo-SIProAutoFlag $EnvValue
|        if ($null -ne $e) { $on = $e; $src = 'environment' }
|    }
|    $how = switch ($src) { 'setting' { "the setting $Name" } 'environment' { "the job setting $($def.Env)" } default { 'the default' } }
|    $text = if ($on) { '{0} is on ({1})' -f $def.Label, $how } else { '{0} ({1}) -- nothing is asked from Invardia for it' -f $def.OffText, $how }
|    [pscustomobject]@{ Name = $Name; On = [bool]$on; Source = $src; Text = $text }
|}
|
|function Read-SIProSolutionSettings {
|    <#
|        The Pro database's solution-wide settings (cfg.Setting, scope 'solution') through a store's (sql, params, mode)
|        seam. Returns @{ Ok; Values = name -> value (parsed JSON); Secrets = name -> Key Vault secret name; Error }.
|        No database = Ok with nothing in it. Never throws.
|    #>
|    param($Store, [scriptblock]$Invoke)
|    $res = [pscustomobject]@{ Ok = $true; Values = @{}; Secrets = @{}; Error = '' }
|    if (-not $Invoke -and $Store) { $Invoke = $Store.Invoke }
|    if (-not $Invoke) { return $res }
|    try {
|        $sql = "IF OBJECT_ID(N'cfg.Setting') IS NULL SELECT CAST(NULL AS NVARCHAR(128)) AS Name, CAST(NULL AS NVARCHAR(MAX)) AS ValueJson, CAST(NULL AS NVARCHAR(256)) AS KeyVaultSecretName WHERE 1 = 0; ELSE SELECT Name, ValueJson, KeyVaultSecretName FROM cfg.Setting WHERE Scope = N'solution';"
|        foreach ($r in @(& $Invoke $sql @{} 'reader' | ForEach-Object { $_ } | Where-Object { $_ })) {
|            $name = [string]$r['Name']; if (-not $name) { continue }
|            $kv = [string]$r['KeyVaultSecretName']
|            if ($kv) { $res.Secrets[$name] = $kv; continue }
|            $raw = [string]$r['ValueJson']
|            $v = $null; try { $v = $raw | ConvertFrom-Json -ErrorAction Stop } catch { $v = $raw }
|            $res.Values[$name] = $v
|        }
|    } catch { $res.Ok = $false; $res.Error = [string]$_.Exception.Message }
|    $res
|}
|
|function Get-SIProAutoSwitches {
|    <#
|        Both switches for the updater: -Settings (Read-SIProSolutionSettings), -Env (a hashtable, else the process
|        environment). An unreadable database (-Settings.Ok = $false) turns BOTH steps off for this run, saying why.
|        Returns name -> Resolve-SIProAutoSwitch result.
|    #>
|    param($Settings, [hashtable]$Env = @{})
|    $out = [ordered]@{}
|    foreach ($n in (Get-SIProAutoSwitchNames)) {
|        $envName = $script:SIProAuto.Switches[$n].Env
|        $ev = if ($Env.ContainsKey($envName)) { [string]$Env[$envName] } else { [Environment]::GetEnvironmentVariable($envName) }
|        if ($Settings -and -not $Settings.Ok) {
|            $out[$n] = [pscustomobject]@{ Name = $n; On = $false; Source = 'unreadable'
|                                          Text = ('{0}: skipped this run -- the Pro settings database could not be read, so a switch set to off there cannot be seen ({1})' -f $script:SIProAuto.Switches[$n].Label, $Settings.Error) }
|            continue
|        }
|        $sv = if ($Settings -and $Settings.Values.ContainsKey($n)) { $Settings.Values[$n] } else { $null }
|        $out[$n] = Resolve-SIProAutoSwitch -Name $n -SettingValue $sv -EnvValue $ev
|    }
|    $out
|}
|
|# =====================================================================================================================
|#  The licence notice -- what the updater audits and mails after a licence request
|# =====================================================================================================================
|function Get-SILicenceRequestNotice {
|    <#
|        PURE. -Result: the licence request client's result (Action, Message, State). -Contacted: whether this run called
|        Invardia. -Previous: the last mailed notice (@{ key; mailedUtc }) or $null.
|        Returns @{ Kind = quiet | sent | success | failure; Audit (@{ Action; Outcome; Text } or $null); Mail ($true/$false);
|                   Key; Subject; Lines }.
|          none / pending / waiting (nothing new)                    -> quiet: no audit, no mail
|          knocked (a request was sent)                              -> audit licence.request.send, no mail
|          installed                                                 -> audit licence.request.install + mail (success)
|          refused / rejected / invalid / network / error            -> audit licence.request.fail (when Invardia was called
|                                                                       or the request could not even be made) + mail, the
|                                                                       same failure at most once every 7 days
|    #>
|    param([AllowNull()]$Result, [bool]$Contacted = $false, [AllowNull()]$Previous, [datetime]$NowUtc = [datetime]::UtcNow)
|    $q = [pscustomobject]@{ Kind = 'quiet'; Audit = $null; Mail = $false; Key = ''; Subject = ''; Lines = @() }
|    if (-not $Result) { return $q }
|    $a = [string]$Result.Action
|    $msg = [string]$Result.Message
|    $validTo = ''; try { if ($Result.State -and $Result.State.PSObject.Properties['ValidTo']) { $validTo = [string]$Result.State.ValidTo } } catch { }
|    switch ($a) {
|        'knocked' {
|            return [pscustomobject]@{ Kind = 'sent'; Audit = @{ Action = 'licence.request.send'; Outcome = 'ok'; Text = $msg }; Mail = $false; Key = ''; Subject = ''; Lines = @() }
|        }
|        'installed' {
|            $lines = @('SecurityInsight Pro asked Invardia for its licence by itself, and the new licence is installed.',
|                       $(if ($validTo) { ' - It is valid until {0}.' -f $validTo } else { ' - ' + $msg }),
|                       ' - Nothing needs to be done. To stop these automatic requests, set "Automatic licence request" (SI_LicenseRequest_Auto) to off on the Settings page.')
|            return [pscustomobject]@{ Kind = 'success'; Audit = @{ Action = 'licence.request.install'; Outcome = 'ok'; Text = $msg }; Mail = $true
|                                      Key = 'installed|' + $validTo; Subject = 'New Pro licence installed'; Lines = $lines }
|        }
|        { $_ -in @('refused', 'rejected', 'invalid', 'network', 'error') } {
|            # a rejection still waiting out its 7 days, or a request not repeated yet, is not news: no call was made
|            $news = $Contacted -or $a -in @('refused', 'error')
|            if (-not $news) { return $q }
|            $key = 'failure|' + $a
|            $mail = $true
|            if ($Previous -and [string]$Previous.key -eq $key -and $Previous.mailedUtc) {
|                try { if ($NowUtc -lt ([datetime]$Previous.mailedUtc).ToUniversalTime().AddDays($script:SIProAuto.RemailDays)) { $mail = $false } } catch { }
|            }
|            $what = switch ($a) {
|                'rejected' { 'Invardia rejected the licence request.' }
|                'invalid'  { 'Invardia refused the licence request as incomplete.' }
|                'network'  { 'Invardia could not be reached for the licence request.' }
|                'refused'  { 'The licence request could not be made, or the licence Invardia sent did not pass the checks and was not installed.' }
|                default    { 'The licence request did not complete.' }
|            }
|            $lines = @(('SecurityInsight Pro asked Invardia for its licence by itself, and it did not succeed. {0}' -f $what),
|                       (' - Details: {0}' -f $msg),
|                       ' - The current licence (if any) stays in place; the request is tried again on the next nightly run.',
|                       ' - To ask by hand, run Request-SILicense in the setup folder. To stop the automatic requests, set "Automatic licence request" (SI_LicenseRequest_Auto) to off on the Settings page.',
|                       ' - Licences: https://portal.invardia.com/ > Licences. Questions: info@invardia.com.')
|            return [pscustomobject]@{ Kind = 'failure'; Audit = @{ Action = 'licence.request.fail'; Outcome = $(if ($a -eq 'rejected') { 'refused' } else { 'error' }); Text = $msg }
|                                      Mail = $mail; Key = $key; Subject = 'Failed: the automatic Pro licence request did not succeed'; Lines = $lines }
|        }
|    }
|    $q
|}
|
|function ConvertTo-SIProAutoMailHtml {
|    <# PURE. Notice lines -> the HTML body in the one mail layout (MAIL-2 / #573, SI-MailLayout.ps1): the first line is the
|       summary, the " - " lines a list; everything encoded, real paragraphs. #>
|    param([AllowEmptyCollection()][string[]]$Lines, [string]$Title = 'SecurityInsight Pro')
|    if (-not (Get-Command -Name New-SIMailLayout -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-MailLayout.ps1')) }
|    $first = [string]@($Lines)[0]
|    $rest = @(@($Lines) | Select-Object -Skip 1 | Where-Object { "$_".Trim() } | ForEach-Object { '- ' + ($_ -replace '^\s*-\s*', '').Trim() })
|    (New-SIMailLayout -Title $Title -Summary $first -Paragraphs @(($rest -join "`n"))).Html
|}
|
|# =====================================================================================================================
|#  The one-time notice (first run after the update, Pro) -- SI-FirstRun.ps1 shows it
|# =====================================================================================================================
|function Get-SIProAutoNoticeLines {
|    <# PURE. The one-time notice: what a Pro install now does with Invardia by itself, and how to switch each off. #>
|    param([bool]$LicenceOn = $true, [bool]$UpdatesOn = $true)
|    $l = New-Object System.Collections.Generic.List[string]
|    $l.Add('SecurityInsight Pro now works with Invardia by itself. Nothing needs to be done:')
|    if ($LicenceOn) { $l.Add(' - Automatic licence request: every night the updater job asks Invardia for this installation''s licence when there is none, it ends within 30 days or it is in its grace period. The result is recorded in the audit trail and mailed to you. To turn it off, set "Automatic licence request" (SI_LicenseRequest_Auto) to off on the Settings page, or SI_LICENSE_REQUEST_AUTO=false on the updater job.') }
|    if ($UpdatesOn) { $l.Add(' - Pro updates from Invardia: every night the updater job checks Invardia for a release approved for this installation''s ring, verifies its signature and applies it, restoring the previous version if anything fails. To turn it off, set "Pro updates from Invardia" (SI_InvardiaUpdate_Enabled) to off on the Settings page, or SI_INVARDIA_UPDATE_ENABLED=false on the updater job.') }
|    $l.Add(' - This notice is shown once.')
|    @($l.ToArray())
|}
'@ }
$__siSupportFiles['engine/_shared/SI-BuildInfo.ps1'] = @{ Sha256 = 'da60080d618e1477900a01f60c970cf8c68534dfd938a0e622cb0d1822fdc870'; Text = @'
|#Requires -Version 5.1
|<#
|    WHICH BUILD OF SecurityInsight IS THIS (operator 2026-10-05: "change the version in any release, so I can keep
|    track in the GUI what version I am at").
|
|    ONE build identity, computed ONCE when a build/package/image is made, stamped into BUILD.json next to VERSION, and
|    only READ at run time. Nothing here asks git at run time: an install, a container image or a customer package has
|    no .git folder, and the answer must not change between the build and the run.
|
|      version      the product version from VERSION                         3.0.0
|      display      what people see: the version, plus -rc.<n> for a       3.0.0-rc.12   (pre-release build)
|                   build that is not the tagged release                    3.0.0         (release build)
|      rc           n = commits on the branch since VERSION last changed    12 / $null for a release
|                   (git rev-list --first-parent --count <commit that last changed VERSION>..HEAD)
|      commit       the full commit; shortCommit its first 7 characters
|      builtUtc     when the build was made (UTC, ISO 8601)
|      channel/ring where it is going, when the builder knows it (else null)
|
|    A RELEASE build is HEAD carrying the tag SI-<VERSION> (or SecurityInsight-v<VERSION>, the public twin).
|    Anything else is a pre-release and says so.
|
|    Functions:
|      Get-SIBuildInfo     BUILD TIME. From git when the folder is a git work tree, else what BUILD.json says.
|      Read-SIBuildInfo    RUN TIME. BUILD.json; without it the VERSION file with "build unknown"; never git.
|      Write-SIBuildInfo   writes BUILD.json (UTF-8, no BOM).
|      Format-SIBuildLine  "3.0.0-rc.12 (build 0dc9062, 2026-10-05 14:10 UTC)" for banners and logs.
|    PowerShell 5.1 and 7, Windows and Linux.
|#>
|
|function ConvertTo-SIBuildDisplay {
|    <# PURE. 3.0.0 + rc 12 -> 3.0.0-rc.12; rc $null (a release) -> 3.0.0. #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Version, [AllowNull()]$Rc)
|    $v = "$Version".Trim()
|    if (-not $v) { return '' }
|    if ($null -eq $Rc -or "$Rc" -eq '') { return $v }
|    '{0}-rc.{1}' -f $v, ([int]$Rc)
|}
|
|function Get-SIReleasedDisplay {
|    <# PURE. The version a RELEASED package shows: its release label (BUILD.json 'release', stamped by Publish-SIRelease)
|       when that is a released number -- digits and dots, 3 or 4 parts (3.0.31, 3.0.0.123) -- else '' (not a release). #>
|    param([AllowNull()][AllowEmptyString()][string]$Release)
|    $r = "$Release".Trim()
|    if ($r -match '^\d{1,6}(\.\d{1,12}){2,3}$') { return $r }
|    ''
|}
|
|function Read-SIVersionFile {
|    param([Parameter(Mandatory)][string]$SolutionRoot)
|    $f = [System.IO.Path]::Combine($SolutionRoot, 'VERSION')
|    if (-not [System.IO.File]::Exists($f)) { return '' }
|    try { return ([System.IO.File]::ReadAllText($f)).Trim() } catch { return '' }
|}
|
|function New-SIBuildInfoObject {
|    param([string]$Version, $Rc, [string]$Commit, [string]$BuiltUtc, $Channel, $Ring, [string]$Source)
|    $c = "$Commit".Trim()
|    [pscustomobject][ordered]@{
|        version     = "$Version".Trim()
|        display     = (ConvertTo-SIBuildDisplay -Version $Version -Rc $Rc)
|        commit      = $c
|        shortCommit = $(if ($c.Length -ge 7) { $c.Substring(0, 7) } else { $c })
|        builtUtc    = "$BuiltUtc"
|        rc          = $(if ($null -eq $Rc -or "$Rc" -eq '') { $null } else { [int]$Rc })
|        channel     = $(if ("$Channel".Trim()) { "$Channel".Trim() } else { $null })
|        ring        = $(if ($null -ne $Ring -and "$Ring" -ne '') { [int]$Ring } else { $null })
|        source      = $Source
|    }
|}
|
|function Read-SIBuildInfo {
|    <#
|        RUN TIME. What this install / image / package says about its build. Order: <SolutionRoot>/BUILD.json, then the
|        VERSION file (display = the version, no commit: "build unknown"), then '(dev)'. Never throws, never calls git.
|        source = 'BUILD.json' | 'VERSION' | 'none'.
|    #>
|    param([Parameter(Mandatory)][string]$SolutionRoot)
|    $bj = [System.IO.Path]::Combine($SolutionRoot, 'BUILD.json')
|    if ([System.IO.File]::Exists($bj)) {
|        try {
|            $j = [System.IO.File]::ReadAllText($bj) | ConvertFrom-Json
|            if ("$($j.version)".Trim()) {
|                $o = New-SIBuildInfoObject -Version ([string]$j.version) -Rc $j.rc -Commit ([string]$j.commit) -BuiltUtc ([string]$j.builtUtc) `
|                        -Channel $j.channel -Ring $(if ($j.PSObject.Properties['ring']) { $j.ring } else { $null }) -Source 'BUILD.json'
|                # the stamped display wins: it is what the build said, and the reader must not re-derive it differently
|                if ("$($j.display)".Trim()) { $o.display = "$($j.display)".Trim() }
|                # the release stamped by Publish-SIRelease travels on (an image build writes BUILD.json again from this)
|                if ($j.PSObject.Properties['release'] -and "$($j.release)".Trim()) { $o | Add-Member -NotePropertyName 'release' -NotePropertyValue "$($j.release)".Trim() -Force }
|                # framework installer rule 11b (2026-11-04: a released install showed "3.0.29-rc.9"): a package stamped as a
|                # RELEASE shows its released version -- never a release-candidate label (Get-SIReleasedDisplay)
|                $rel = Get-SIReleasedDisplay -Release $(if ($j.PSObject.Properties['release']) { [string]$j.release } else { '' })
|                if ($rel) { $o.display = $rel; $o.rc = $null }
|                return $o
|            }
|        } catch { }
|    }
|    $v = Read-SIVersionFile -SolutionRoot $SolutionRoot
|    if ($v) { return (New-SIBuildInfoObject -Version $v -Rc $null -Commit '' -BuiltUtc '' -Source 'VERSION') }
|    New-SIBuildInfoObject -Version '(dev)' -Rc $null -Commit '' -BuiltUtc '' -Source 'none'
|}
|
|function Invoke-SIBuildGit {
|    param([Parameter(Mandatory)][string]$Root, [Parameter(Mandatory)][string[]]$GitArgs)
|    $global:LASTEXITCODE = 0
|    $out = & git -C $Root @GitArgs 2>$null
|    if ($LASTEXITCODE -ne 0) { return $null }
|    (@($out) -join "`n").Trim()
|}
|
|function Get-SIBuildInfo {
|    <#
|        BUILD TIME. Compute the build identity of <SolutionRoot> (the folder holding VERSION).
|        In a git work tree: commit = HEAD; release when HEAD carries SI-<VERSION> / SecurityInsight-v<VERSION>, else
|        rc = commits since the commit that last changed VERSION. -Ref builds the identity of another ref (a package of a tag). Without git (an install, an extracted package): what
|        BUILD.json says (Read-SIBuildInfo). -NoGit forces the second path (tests). -Now pins the build time (tests).
|    #>
|    param([Parameter(Mandatory)][string]$SolutionRoot, [string]$Channel, $Ring, $Now, [switch]$NoGit, [string]$Ref = 'HEAD')
|    $root = (Resolve-Path -LiteralPath $SolutionRoot).Path
|    $ts = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|    $built = $ts.ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture)
|    $gitOk = $false
|    if (-not $NoGit -and (Get-Command -Name git -ErrorAction SilentlyContinue)) {
|        $gitOk = ((Invoke-SIBuildGit -Root $root -GitArgs @('rev-parse', '--is-inside-work-tree')) -eq 'true')
|    }
|    if (-not $gitOk) {
|        $r = Read-SIBuildInfo -SolutionRoot $root
|        if ($Channel) { $r.channel = $Channel }
|        if ($null -ne $Ring -and "$Ring" -ne '') { $r.ring = [int]$Ring }
|        return $r
|    }
|    $version = if ($Ref -eq 'HEAD') { Read-SIVersionFile -SolutionRoot $root } else { "$(Invoke-SIBuildGit -Root $root -GitArgs @('show', ('{0}:./VERSION' -f $Ref)))".Trim() }
|    if (-not $version) { $version = '(dev)' }
|    $head = Invoke-SIBuildGit -Root $root -GitArgs @('rev-parse', ('{0}^{{commit}}' -f $Ref))
|    $tags = @("$(Invoke-SIBuildGit -Root $root -GitArgs @('tag', '--points-at', $Ref))" -split "`n" | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|    $isRelease = ($tags -contains ('SI-{0}' -f $version)) -or ($tags -contains ('SecurityInsight-v{0}' -f $version))
|    $rc = $null
|    if (-not $isRelease) {
|        $verCommit = Invoke-SIBuildGit -Root $root -GitArgs @('log', '-1', '--format=%H', $Ref, '--', 'VERSION')
|        $count = if ($verCommit) { Invoke-SIBuildGit -Root $root -GitArgs @('rev-list', '--first-parent', '--count', ('{0}..{1}' -f $verCommit, $Ref)) }
|                 else { Invoke-SIBuildGit -Root $root -GitArgs @('rev-list', '--first-parent', '--count', $Ref) }
|        $n = 0
|        if (-not [int]::TryParse("$count", [ref]$n)) { $n = 0 }
|        $rc = $n
|    }
|    New-SIBuildInfoObject -Version $version -Rc $rc -Commit $head -BuiltUtc $built -Channel $Channel -Ring $Ring -Source 'git'
|}
|
|function Initialize-SIBuildInfoFile {
|    <#
|        2026-10-28 (the Community edition): a SecurityInsight folder WITHOUT BUILD.json -- the public copy, a Community release
|        zip from GitHub -- gets one, so the web app image builds (pro-management/Dockerfile copies BUILD.json, AppInfo reads it).
|        Present = left exactly as it is (a Pro release archive is stamped by Publish-SIRelease). Absent = written from what the
|        folder knows without git (Read-SIBuildInfo: its VERSION; no commit -- "build unknown"), -Channel / -Ring when given.
|        The app images' source hash leaves BUILD.json out (SI-FastRoll.ps1), so stamping never changes an image tag.
|        Returns 'present' | 'written'. Throws when the folder has no VERSION (not a release).
|    #>
|    param([Parameter(Mandatory)][string]$SolutionRoot, [string]$Channel, $Ring)
|    $bj = [System.IO.Path]::Combine($SolutionRoot, 'BUILD.json')
|    if ([System.IO.File]::Exists($bj)) { return 'present' }
|    if (-not [System.IO.File]::Exists([System.IO.Path]::Combine($SolutionRoot, 'VERSION'))) { throw ("{0} holds no VERSION -- not a SecurityInsight release" -f $SolutionRoot) }
|    $info = Read-SIBuildInfo -SolutionRoot $SolutionRoot
|    if ($Channel) { $info.channel = $Channel }
|    if ($null -ne $Ring -and "$Ring" -ne '') { $info.ring = [int]$Ring }
|    $null = Write-SIBuildInfo -Info $info -Path $bj
|    'written'
|}
|
|function Write-SIBuildInfo {
|    <# Writes BUILD.json {version, display, commit, shortCommit, builtUtc, rc, channel, ring} (UTF-8, no BOM). #>
|    param([Parameter(Mandatory)]$Info, [Parameter(Mandatory)][string]$Path)
|    $o = [ordered]@{
|        version = [string]$Info.version; display = [string]$Info.display; commit = [string]$Info.commit
|        shortCommit = [string]$Info.shortCommit; builtUtc = [string]$Info.builtUtc; rc = $Info.rc
|        channel = $Info.channel; ring = $Info.ring
|    }
|    # the release this package IS at Invardia (3.0.0.<build number>) -- stamped by Publish-SIRelease; the run compares the
|    # error catalogue's fixedIn with it (#709). Only when known: older readers ignore an extra field.
|    if ($Info.PSObject.Properties['release'] -and "$($Info.release)".Trim()) { $o.release = "$($Info.release)".Trim() }
|    $dir = Split-Path -Parent $Path
|    if ($dir -and -not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Force -Path $dir | Out-Null }
|    [System.IO.File]::WriteAllText($Path, (ConvertTo-Json -InputObject $o -Depth 3), (New-Object System.Text.UTF8Encoding($false)))
|    $Path
|}
|
|function Format-SIBuildLine {
|    <# PURE. "3.0.0-rc.12 (build 0dc9062, 2026-10-05 14:10 UTC, ring 1)"; no commit known -> "3.0.0 (build unknown)". #>
|    param([Parameter(Mandatory)]$Info)
|    $parts = New-Object System.Collections.Generic.List[string]
|    if ("$($Info.shortCommit)".Trim()) { $parts.Add(('build {0}' -f $Info.shortCommit)) } else { $parts.Add('build unknown') }
|    if ("$($Info.builtUtc)".Trim()) {
|        $d = [datetime]::MinValue
|        if ([datetime]::TryParse([string]$Info.builtUtc, [System.Globalization.CultureInfo]::InvariantCulture,
|                [System.Globalization.DateTimeStyles]::AdjustToUniversal -bor [System.Globalization.DateTimeStyles]::AssumeUniversal, [ref]$d)) {
|            $parts.Add(($d.ToString('yyyy-MM-dd HH:mm', [System.Globalization.CultureInfo]::InvariantCulture) + ' UTC'))
|        }
|    }
|    if ($null -ne $Info.ring -and "$($Info.ring)" -ne '') { $parts.Add(('ring {0}' -f $Info.ring)) }
|    if ("$($Info.channel)".Trim()) { $parts.Add(('channel {0}' -f $Info.channel)) }
|    '{0} ({1})' -f $Info.display, ($parts -join ', ')
|}
|
|function New-SIBuildArchiveArgs {
|    <#
|        For a package built with `git archive` of SOLUTIONS/SecurityInsight at -Ref: the git archive options that ADD the
|        build's BUILD.json at <Prefix>SOLUTIONS/SecurityInsight/BUILD.json (an untracked file -- git archive --add-file)
|        and then set the archive's own -Prefix. Use them in place of --prefix=<Prefix>:
|            $b = New-SIBuildArchiveArgs -RepoRoot $repo -Ref $Ref -Prefix 'securityinsight-src-3.0.0/' -WorkDir $OutDir
|            git -C $repo archive --format=zip @($b.Args) -o $zip $Ref -- SOLUTIONS/SecurityInsight
|        Returns @{ Args; Info; File }. Git applies the LAST --prefix before --add-file to that file, and the last one
|        overall to the tree -- which is why the order is fixed here, in one place.
|    #>
|    param([Parameter(Mandatory)][string]$RepoRoot, [string]$Ref = 'HEAD', [Parameter(Mandatory)][string]$Prefix,
|          [Parameter(Mandatory)][string]$WorkDir, [string]$Channel, $Ring,
|          # the release version at Invardia (3.0.0.<build number>), stamped as BUILD.json 'release'
|          [string]$ReleaseVersion)
|    $sol = [System.IO.Path]::Combine($RepoRoot, 'SOLUTIONS', 'SecurityInsight')
|    $info = Get-SIBuildInfo -SolutionRoot $sol -Ref $Ref -Channel $Channel -Ring $Ring
|    if ("$ReleaseVersion".Trim()) {
|        $info | Add-Member -NotePropertyName 'release' -NotePropertyValue "$ReleaseVersion".Trim() -Force
|        # a RELEASE package is the release, whether or not its tag exists yet when it is packed (the tag follows the
|        # pack): it shows the released version -- never "-rc.<n>" (2026-11-04: a released install showed 3.0.29-rc.9).
|        # The archive's VERSION file carries the same number (Publish-SIRelease, Set-SIReleaseArchiveVersion).
|        $rel = Get-SIReleasedDisplay -Release $ReleaseVersion
|        if ($rel) { $info.version = $rel; $info.display = $rel; $info.rc = $null }
|    }
|    $dir =[System.IO.Path]::Combine($WorkDir, ('build-' + [guid]::NewGuid().ToString('N').Substring(0, 8)))
|    $file = Write-SIBuildInfo -Info $info -Path ([System.IO.Path]::Combine($dir, 'BUILD.json'))
|    $p = if ($Prefix.EndsWith('/')) { $Prefix } else { $Prefix + '/' }
|    [pscustomobject]@{
|        Args = @(('--prefix={0}SOLUTIONS/SecurityInsight/' -f $p), ('--add-file={0}' -f $file), ('--prefix={0}' -f $p))
|        Info = $info
|        File = $file
|    }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-V3Snapshot.ps1'] = @{ Sha256 = '456a749f49e34bc1974e187da768131ab95c35a8d09aa59b60455d27159e4988'; Text = @'
|#Requires -Version 5.1
|<#
|    SI v3 -- READING THE CURRENT v3 SNAPSHOT. One place, because the trap is one trap.
|
|    🪤 FINDING #83, AND IT HAS NOW BITTEN THREE TIMES IN THREE DIFFERENT FILES.
|    `arg_max` THEN filter is NOT the same query as filter THEN `arg_max`. Both editions write the
|    profile tables; v2.2 emits no `SI_` columns at all. So `summarize max(CollectionTime)` over the
|    raw table frequently selects a v2.2 snapshot, every v3 column reads empty, and the run reports a
|    smaller estate with no error anywhere. **Measured on the same data: 40 assets vs 238.**
|    It bit the CMDB driver, then the asset-properties engine. A connector built the naive way syncs 40
|    of 238 assets and looks perfectly healthy.
|
|    🔑 WHY THIS FILE EXISTS RATHER THAN A FOURTH COPY OF THE QUERY. The correlation engine, the
|    asset-properties add-on and the CMDB connector all ask the SAME question -- "give me the current
|    v3 snapshot, with the identity columns" -- and each answering it privately is exactly how
|    SI-AssetIdentity.ps1's own header describes the identity mess it was created to end: three files
|    independently answering one question and disagreeing. The clause ORDER is the fact being shared;
|    what each caller projects is its own business.
|
|    🔒 IT ADDS NOTHING TO THE PRODUCTION PATH. This is a new file in engine/_shared/; the profilers and
|    Risk Analysis dot-source SI-AssetIdentity.ps1 and are untouched by it. Nothing here runs unless an
|    engine asks for a snapshot.
|
|    NO Set-StrictMode here -- it leaks into the caller's scope (measured 2026-08-12).
|#>
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot './SI-AzRest.ps1') }
|
|function Get-SIV3SnapshotKql {
|    <#
|        The current v3 snapshot of one profile table, projecting the columns the caller names.
|
|          -TableName  SI_Endpoint_Profile_CL | SI_Identity_Profile_CL | SI_Azure_Profile_CL
|          -Column     extra columns to project, each read through column_ifexists
|          -RowLimit   diagnostics only
|
|        `SI_AssetId` and `SI_AssetName` are always projected -- they are the identity contract, and a
|        caller that did not ask for them still needs them to be able to join anything.
|
|        🔴 THE `where` IS INSIDE THE `let`, SO IT PROVABLY PRECEDES THE `summarize`. Writing it as two
|        statements would work equally well and would be one edit away from being reordered by someone
|        who did not know why. The shape encodes the rule.
|
|        🪤 EVERY COLUMN GOES THROUGH `column_ifexists`. The four profile schemas do NOT carry the same
|        columns -- identity has no AzureResourceId, public-ip has almost none of them -- and a plain
|        `project` against a missing column fails the WHOLE query rather than degrading to "this engine
|        does not know that". A dead run and an empty column are very different failures.
|
|        📌 The v3 test is `isnotempty(SI_AssetId)` -- the thing v2.2 does not emit, so its presence IS
|        a version test.
|        ⚠️ **The ORIGINAL reason given here was "because the four PROFILE tables carry no version
|        stamp", and that is no longer true.** V3-6 added the stamp, and from 2026-08-31 it carries an
|        edition marker (`2.2.460+v3`), so a `SolutionVersion endswith "+v3"` filter is now available
|        here too. `SI_AssetId` is KEPT deliberately: it is the identity contract, it is proven across
|        every v3 engine, and it works on rows written before the marker existed -- which a version
|        filter does not. Two correct tests are fine; a stale justification for one of them is not.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$TableName,
|        [Parameter()][string[]]$Column = @(),
|        [Parameter()][int]$RowLimit = 0,
|        # Lower-case the projected extra columns. Identifier joins are case-insensitive in practice
|        # (an MDE id is hex, an ARM path is case-preserving but case-insensitive), and normalising in
|        # the query beats every caller remembering to.
|        [Parameter()][switch]$LowerCaseColumns
|    )
|
|    $proj = New-Object System.Collections.ArrayList
|    [void]$proj.Add('    SI_AssetId   = tostring(column_ifexists("SI_AssetId", ""))')
|    [void]$proj.Add('    SI_AssetName = tostring(column_ifexists("SI_AssetName", ""))')
|    foreach ($c in @($Column)) {
|        if ([string]::IsNullOrWhiteSpace($c)) { continue }
|        if ($c -eq 'SI_AssetId' -or $c -eq 'SI_AssetName') { continue }
|        if ($LowerCaseColumns) {
|            [void]$proj.Add(('    {0} = tolower(tostring(column_ifexists("{0}", "")))' -f $c))
|        } else {
|            [void]$proj.Add(('    {0} = tostring(column_ifexists("{0}", ""))' -f $c))
|        }
|    }
|
|    $kql = @(
|        ('let v3 = {0} | where isnotempty(tostring(column_ifexists("SI_AssetId", "")));' -f $TableName)
|        'let snap = toscalar(v3 | summarize max(CollectionTime));'
|        'v3'
|        '| where CollectionTime == snap'
|        '| project'
|        ($proj.ToArray() -join ",`n")
|    )
|    if ($RowLimit -gt 0) { $kql += ('| take {0}' -f $RowLimit) }
|    ($kql -join "`n")
|}
|
|function Get-SIV3ObjectMapKql {
|    <#
|        `SI_CorrelationId` and `SI_IdSource` per `SI_AssetId`, from the correlation map.
|
|        📌 This join is the whole of finding #89's first half: `SI_CorrelationId` is on NO profile
|        table. It lives only in `SI_ObjectMap_CL`, keyed on `SI_AssetId`. A connector that expects to
|        find it on the row skips 100% of assets while reporting a clean run -- measured, 144 of 144
|        Skipped, which reads exactly like a healthy conservative connector.
|
|        🔴 `SI_IdSource` IS NOT OPTIONAL. It states whether the id is `ledger` (minted once and stored,
|        durable for the life of the asset) or `derived-provisional` (today's seed, which MOVES when
|        group membership changes). `SI-ObjectLedgerStore.ps1` puts the consequence plainly: *"a
|        connector is already forbidden from creating CIs from those."* Dropping this column is how that
|        rule stops being enforceable.
|
|        Both values are taken in ONE `summarize`. The map emits one row per
|        (correlation id, member, identifier type), so every row for a given `SI_AssetId` carries the
|        same pair -- taking them in two `take_any` calls would permit a combination that never
|        co-occurred on any row.
|    #>
|    [CmdletBinding()]
|    param([Parameter()][int]$RowLimit = 0)
|    $kql = @(
|        'let snap = toscalar(SI_ObjectMap_CL | summarize max(CollectionTime));'
|        'SI_ObjectMap_CL'
|        '| where CollectionTime == snap'
|        '| project SI_AssetId = tostring(column_ifexists("SI_AssetId", "")),'
|        '          SI_CorrelationId = tostring(column_ifexists("SI_CorrelationId", "")),'
|        '          SI_IdSource = tostring(column_ifexists("SI_IdSource", ""))'
|        '| where isnotempty(SI_AssetId) and isnotempty(SI_CorrelationId)'
|        '| summarize SI_CorrelationId = take_any(SI_CorrelationId), SI_IdSource = take_any(SI_IdSource) by SI_AssetId'
|    )
|    if ($RowLimit -gt 0) { $kql += ('| take {0}' -f $RowLimit) }
|    ($kql -join "`n")
|}
|
|# =====================================================================================================================
|#  UPLINK-FIX (customer G 2026-10-07): AN EMPTY CORRELATION MAP ON A FIRST RUN IS "NOT YET", NOT A REFUSAL
|# =====================================================================================================================
|# A new install's first flow: asset correlation writes SI_ObjectMap_CL for the FIRST time, and a brand-new Log Analytics
|# table answers its first rows minutes later. The CMDB connector (16:34Z, 35 s after correlation ended) and the
|# vulnerability close-loop (16:35Z) read it empty and REFUSED with a critical guard: two fix requests and a support
|# ticket for a state that is expected and fixes itself. The rule now:
|#   * the map is empty, it has NEVER had a row, and asset correlation ended within the last hour -> wait for it (poll);
|#   * still empty, never had a row                              -> 'pending': nothing written, a WARNING, no refusal;
|#   * empty, but it HAD rows (or that cannot be told)           -> 'missing': the refusal stays (the guard's real case).
|function Get-SIV3ObjectMapEverKql {
|    <# Has the correlation map EVER had a row (the whole retention)? One row, column n. #>
|    'SI_ObjectMap_CL | take 1 | count | project n = Count'
|}
|
|function Get-SIV3CorrelationRecentKql {
|    <# Did asset correlation (the engine or the flow's step) end well in the last -Minutes? One row, column n. #>
|    param([int]$Minutes = 60)
|    @(
|        ('SI_RunHealth_CL | where TimeGenerated > ago({0}m)' -f $Minutes)
|        "| where Phase == 'End' and ExitReason in ('success', 'success-partial')"
|        # the correlation engine under its job name, its short name, or the flow's step of it
|        "| where Engine endswith 'correlation'"
|        '| count | project n = Count'
|    ) -join "`n"
|}
|
|function Get-SIV3MapLedgerShortfall {
|    <#
|        PURE. #1082 THE FIRST-SYNC LEDGER RULE: per kind in -Kinds, how many of the kind's assets (-Profiles: Kind, SI_AssetId)
|        the correlation map (-Rows: SI_AssetId, SI_CorrelationId, SI_IdSource) carries a LEDGER id for (Resolve-SICiKey's
|        rule: an id only counts when SI_IdSource is 'ledger'). Returns the kinds BELOW -MinShare (default: half) --
|        @{ Kind; Ledger; Total } -- empty when every kind is ready. A kind with no asset is never short.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [AllowEmptyCollection()][object[]]$Profiles = @(), [string[]]$Kinds = @(), [double]$MinShare = 0.5)
|    $ledger = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $aid = ([string]$r.SI_AssetId).Trim(); $cid = ([string]$r.SI_CorrelationId).Trim(); $src = ([string]$r.SI_IdSource).Trim()
|        if ($aid -and $cid -and $src -ieq 'ledger') { [void]$ledger.Add($aid) }
|    }
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($k in @($Kinds | Where-Object { $_ } | ForEach-Object { ([string]$_).ToLowerInvariant() } | Select-Object -Unique)) {
|        $ids = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|        foreach ($p in @($Profiles)) { if ($p -and ([string]$p.Kind).ToLowerInvariant() -eq $k -and ([string]$p.SI_AssetId).Trim()) { [void]$ids.Add(([string]$p.SI_AssetId).Trim()) } }
|        if ($ids.Count -eq 0) { continue }
|        $have = 0; foreach ($i in $ids) { if ($ledger.Contains($i)) { $have++ } }
|        if ($have -lt $MinShare * $ids.Count) { $out.Add([pscustomobject]@{ Kind = $k; Ledger = $have; Total = $ids.Count }) }
|    }
|    , $out.ToArray()
|}
|
|function Resolve-SIV3CorrelationMap {
|    <#
|        The correlation map for a connector, with the first-run rule above. Returns @{ State = ready | pending | missing;
|        Rows; Reason; WaitedSeconds }.
|          -Read   { } -> the map rows (the caller's own read; a table that does not exist yet reads as empty)
|          -Count  { param($Kql, $Table) } -> rows with a column n (a table that does not exist yet reads as empty)
|          -WaitSeconds / -PollSeconds   how long to wait for a map that correlation has just written (default 15 / 1 min)
|          -Sleep  { param($Seconds) } (tests)   -Log { param($Level, $Message) }
|        A count that cannot be read is NOT taken as "never had a row": the safe direction is 'missing' (the refusal).
|        #1082 THE FIRST SYNC WAITS FOR THE LEDGER (found live, read-only, at an install: its first CMDB sync read a map that
|        did not yet carry ledger ids for most Azure assets, keyed 1,388 CIs by their asset id, and run 2 created them all
|        again under the ledger key). -FirstRunKinds: the kinds the caller has never written a CI of; -Profiles (Kind,
|        SI_AssetId): the assets it is about to key. A map that EXISTS but carries a ledger id for fewer than -MinLedgerShare
|        (half) of a first-run kind's assets is NOT ready: waited for like an empty map when correlation has just run, else
|        'pending' (nothing written, a warning; the next run uses the ledger ids). Rule followed: V3-DATA-MODEL 2.3 (4) "No
|        mixed CI key ... An unreachable ledger stops the run at P2 instead of publishing moving keys." Without -FirstRunKinds
|        the rule above is unchanged (the vulnerability close-loop calls it so).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Read, [Parameter(Mandatory)][scriptblock]$Count,
|          [int]$WaitSeconds = 900, [int]$PollSeconds = 60, [scriptblock]$Sleep, [scriptblock]$Log,
|          [AllowEmptyCollection()][object[]]$Profiles = @(), [AllowEmptyCollection()][string[]]$FirstRunKinds = @(), [double]$MinLedgerShare = 0.5)
|    if (-not $Sleep) { $Sleep = { param($s) Start-Sleep -Seconds $s } }
|    if (-not $Log) { $Log = { param($l, $m) } }
|    $n = { param($kql, $table) try { $r = @(& $Count $kql $table | ForEach-Object { $_ } | Where-Object { $_ })[0]; if ($r) { [long]$r.n } else { 0L } } catch { -1L } }
|    $short = { param($r) if (-not @($FirstRunKinds | Where-Object { $_ }).Count) { return , @() }; Get-SIV3MapLedgerShortfall -Rows @($r) -Profiles @($Profiles) -Kinds @($FirstRunKinds) -MinShare $MinLedgerShare }
|    $shortText = {
|        param($s, [int]$waited)
|        $what = (@($s | ForEach-Object { '{0} ({1} of {2} assets)' -f $_.Kind, $_.Ledger, $_.Total })) -join ', '
|        ('the correlation map (SI_ObjectMap_CL) does not carry a ledger id yet for most assets of {0} -- a first sync would key them by their asset id and create them again under the ledger key on the next run{1}; nothing was written, the next run uses the ledger ids' -f $what, $(if ($waited -gt 0) { (' (waited {0} min)' -f [Math]::Ceiling($waited / 60)) } else { '' }))
|    }
|    $rows = @(& $Read | ForEach-Object { $_ } | Where-Object { $_ })
|    if ($rows.Count) {
|        $s = & $short $rows
|        if (-not @($s).Count) { return [pscustomobject]@{ State = 'ready'; Rows = $rows; Reason = ''; WaitedSeconds = 0 } }
|        # #1082: a map without the ledger ids yet -- waited for when correlation has just written it, never keyed by asset id
|        $waited = 0
|        $recent = & $n (Get-SIV3CorrelationRecentKql) 'SI_RunHealth_CL'
|        if ($recent -gt 0 -and $WaitSeconds -gt 0) {
|            & $Log 'INFO' ('the correlation map does not carry ledger ids yet for most assets of {0}, and asset correlation has just written -- waiting up to {1} min for them' -f ((@($s | ForEach-Object { $_.Kind })) -join ', '), [Math]::Ceiling($WaitSeconds / 60))
|            while ($waited -lt $WaitSeconds) {
|                $step = [Math]::Max(1, [Math]::Min($PollSeconds, $WaitSeconds - $waited))
|                & $Sleep $step; $waited += $step
|                $r2 = @(& $Read | ForEach-Object { $_ } | Where-Object { $_ })
|                if (-not $r2.Count) { continue }
|                $s = & $short $r2
|                if (-not @($s).Count) {
|                    & $Log 'OK' ('the correlation map carries the ledger ids after {0} s' -f $waited)
|                    return [pscustomobject]@{ State = 'ready'; Rows = $r2; Reason = ''; WaitedSeconds = $waited }
|                }
|            }
|        }
|        return [pscustomobject]@{ State = 'pending'; Rows = @(); WaitedSeconds = $waited; Reason = (& $shortText $s $waited) }
|    }
|    $ever = & $n (Get-SIV3ObjectMapEverKql) 'SI_ObjectMap_CL'
|    if ($ever -ne 0) {
|        return [pscustomobject]@{ State = 'missing'; Rows = @(); WaitedSeconds = 0
|            Reason = $(if ($ever -lt 0) { 'the correlation map (SI_ObjectMap_CL) is empty, and whether it ever had results could not be read' } else { 'the correlation map (SI_ObjectMap_CL) is empty, although it had results before' }) }
|    }
|    $waited = 0; $lastShort = @()
|    $recent = & $n (Get-SIV3CorrelationRecentKql) 'SI_RunHealth_CL'
|    if ($recent -gt 0 -and $WaitSeconds -gt 0) {
|        & $Log 'INFO' ('the correlation map (SI_ObjectMap_CL) has no rows yet, and asset correlation has just written its first results -- waiting up to {0} min for Log Analytics to answer them' -f [Math]::Ceiling($WaitSeconds / 60))
|        while ($waited -lt $WaitSeconds) {
|            $step = [Math]::Max(1, [Math]::Min($PollSeconds, $WaitSeconds - $waited))
|            & $Sleep $step; $waited += $step
|            $rows = @(& $Read | ForEach-Object { $_ } | Where-Object { $_ })
|            if ($rows.Count) {
|                # #1082: answered, but a first-run kind still lacks its ledger ids -- keep waiting for them
|                $lastShort = & $short $rows
|                if (@($lastShort).Count) { continue }
|                & $Log 'OK' ('the correlation map answered after {0} s ({1} asset(s))' -f $waited, $rows.Count)
|                return [pscustomobject]@{ State = 'ready'; Rows = $rows; Reason = ''; WaitedSeconds = $waited }
|            }
|        }
|    }
|    if ($rows.Count -and @($lastShort).Count) { return [pscustomobject]@{ State = 'pending'; Rows = @(); WaitedSeconds = $waited; Reason = (& $shortText $lastShort $waited) } }
|    [pscustomobject]@{ State = 'pending'; Rows = @(); WaitedSeconds = $waited
|        Reason = $(if ($recent -gt 0) { ('the correlation map (SI_ObjectMap_CL) has no results yet: asset correlation wrote its first ones, and Log Analytics did not answer them within {0} min (a new install) -- nothing was written; the next run uses them' -f [Math]::Ceiling($waited / 60)) }
|                   else { 'the correlation map (SI_ObjectMap_CL) has no results yet (asset correlation has not run on this install) -- nothing was written; the next run after asset correlation uses them' }) }
|}
|
|function Get-SIV3AssetPropertiesKql {
|    <#
|        The current snapshot of `SI_AssetProperties_CL` -- the optional wide payload (3.6b).
|
|        🔒 THE CMDB CONNECTOR MUST TOLERATE THIS TABLE NOT EXISTING. The add-on is opt-in, and
|        scenario 1 does not use it at all. A caller runs this inside its own try/catch and treats a
|        failure as "no wide payloads", never as a failed run -- otherwise enabling a scenario-1
|        connector would require an add-on that scenario 1 has no use for.
|
|        📌 One row per (asset, source system) by design, so a server that is both an MDE machine and an
|        ARM resource contributes two. The caller picks which source's vocabulary to project from,
|        rather than the collector deciding it here by overwriting.
|    #>
|    [CmdletBinding()]
|    param([Parameter()][int]$RowLimit = 0)
|    # #412 ONE PULL PER SOURCE: each profiler (endpoint / identity / azure) publishes its own sources with its OWN
|    # CollectionTime, so the current snapshot is the newest one PER (profiler, source) -- "the table's newest
|    # CollectionTime" would be the last profiler's sources only.
|    $kql = @(
|        'let src = SI_AssetProperties_CL | extend _key = strcat(tostring(column_ifexists("Engine", "")), "|", tostring(column_ifexists("SourceSystem", "")));'
|        'src'
|        '| join kind=inner (src | summarize _snap = max(CollectionTime) by _key) on _key'
|        '| where CollectionTime == _snap'
|        '| project SI_AssetId = tostring(column_ifexists("SI_AssetId", "")),'
|        '          SourceSystem = tostring(column_ifexists("SourceSystem", "")),'
|        '          Properties = tostring(column_ifexists("Properties", "")),'
|        '          PropertiesDropped = tobool(column_ifexists("PropertiesDropped", false))'
|        '| where isnotempty(SI_AssetId)'
|        # 🔴 A row whose payload was replaced by the oversize marker carries NO usable metadata, and
|        # projecting it would fill CI columns from a marker object. Excluded here so no consumer has
|        # to remember -- the asset then simply gets the narrow set, which is the correct outcome.
|        '| where PropertiesDropped != true'
|    )
|    if ($RowLimit -gt 0) { $kql += ('| take {0}' -f $RowLimit) }
|    ($kql -join "`n")
|}
|
|# ---------------------------------------------------------------------------------------------------
|# Workspace ARM id -> the customer (workspace) GUID the query API wants.
|#
|# 🔒 A THIRD NAME FOR THE SAME LOOKUP, AND THAT IS DELIBERATE. asset-correlation and asset-properties
|# each keep a private copy under their own name, because a library that redefines a function another
|# engine already loaded changes that engine's behaviour by being present -- one fact, two spellings is
|# a trap in code as much as in data, and the cure here is distinct names rather than a shared one that
|# silently shadows. New engines use THIS one; the existing two are left alone precisely because they
|# work and sit near production paths.
|# ---------------------------------------------------------------------------------------------------
|$script:_SIV3WsCache = @{}
|
|function Resolve-SIV3WorkspaceId {
|    param([string]$WorkspaceResourceId = [string]$global:SI_WorkspaceResourceId)
|
|    if ($script:_SIV3WsCache.ContainsKey($WorkspaceResourceId)) { return $script:_SIV3WsCache[$WorkspaceResourceId] }
|
|    if ($WorkspaceResourceId -notmatch '/subscriptions/([^/]+)/resourceGroups/([^/]+)/providers/[Mm]icrosoft\.[Oo]perational[Ii]nsights/workspaces/([^/]+)') {
|        throw "SI v3: invalid WorkspaceResourceId -- $WorkspaceResourceId"
|    }
|    $subId = $matches[1]; $rgName = $matches[2]; $wsName = $matches[3]
|
|    # Restore the caller's subscription afterwards. Az context on this machine is shared state, and
|    # leaving it moved is how a later step deploys to the wrong subscription -- which has already
|    # happened here in four tools at once.
|    $curSubId = $null
|    try { $curSubId = (Get-SIAzContext).Subscription.Id } catch { }
|    if ($curSubId -and $curSubId -ne $subId) { $null = Set-SIAzContext -Subscription $subId -ErrorAction Stop }
|    try {
|        $ws = Get-SIAzOperationalInsightsWorkspace -ResourceGroupName $rgName -Name $wsName -ErrorAction Stop
|        $custId = $ws.CustomerId.Guid
|    } finally {
|        if ($curSubId -and $curSubId -ne $subId) {
|            try { $null = Set-SIAzContext -Subscription $curSubId -ErrorAction SilentlyContinue } catch { }
|        }
|    }
|
|    $script:_SIV3WsCache[$WorkspaceResourceId] = $custId
|    $custId
|}
'@ }
$__siSupportFiles['engine/risk-analysis/_shared/RA-ExcludeLists.ps1'] = @{ Sha256 = '64b358ebc091fe57301c5a66ced3687b128e855e6d49f30fc380ecbb36267451'; Text = @'
|#######################################################################################################
|#  SecurityInsight - Risk Analysis engine
|#  Exclusion lists: per-report and global exclude JSON, and placeholder substitution.
|#
|#  How a report learns what NOT to report on - the per-report and global exclude files, and the
|#  substitution that turns EXCLUDED_* placeholders in a locked query into real literals.
|#
|#  AUDIT #16: moved VERBATIM out of Invoke-RiskAnalysis.ps1 on 2026-08-05. Dot-sourced back in at
|#  exactly the position it occupied, so load order is unchanged. Every function body is
|#  byte-identical to before the move - verified with tests/Get-EngineFunctionInventory.ps1,
|#  which compares a SHA-256 of each function's source text before and after.
|#
|#  Do NOT add $PSScriptRoot-dependent code here: in this file it resolves to _shared/, one level
|#  deeper than the engine root the main script derives $siRoot from.
|#######################################################################################################
|
|function Get-SIMisplacedExcludeFiles {
|    <#
|        Exclusion files in <SIRoot>\config\ -- the place the README once documented. NOTHING reads them (not 2.2, not
|        3.0): the engine reads them from its SettingsPath (risk-analysis-detection\). Per file: Path, Name, ShouldBe.
|        Used by the run (one warning per run) and by the Pro importer (listed in its report).
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $cfg = Join-Path $SIRoot 'config'
|    if (-not (Test-Path -LiteralPath $cfg -PathType Container)) { return @() }
|    @(Get-ChildItem -LiteralPath $cfg -File -ErrorAction SilentlyContinue |
|        Where-Object { $_.Name -match '(?i)^[^.]+\.exclude(\.custom)?\.json$' -or $_.Name -ieq 'RiskAnalysisGlobalExclusions.custom.json' } |
|        Sort-Object Name | ForEach-Object {
|            [pscustomobject]@{ Path = $_.FullName; Name = $_.Name; ShouldBe = (Join-Path (Join-Path $SIRoot 'risk-analysis-detection') $_.Name) }
|        })
|}
|
|function Write-SIMisplacedExcludeWarning {
|    # Once per run: an exclusion file in config\ is never read -- say where it belongs. The solution root is the parent of
|    # the Risk Analysis SettingsPath (risk-analysis-detection\) -- no $PSScriptRoot here (see the header).
|    if ($script:_MisplacedExcludeWarned) { return }
|    $script:_MisplacedExcludeWarned = $true
|    if ([string]::IsNullOrWhiteSpace([string]$global:SettingsPath)) { return }
|    try {
|        foreach ($m in @(Get-SIMisplacedExcludeFiles -SIRoot (Split-Path -Parent ([string]$global:SettingsPath)))) {
|            $msg = ("[exclude] {0} is NOT read -- exclusion files in config\ have never been read. Move it to {1} to use it." -f $m.Path, $m.ShouldBe)
|            if (Get-Command -Name Write-Warn2 -ErrorAction SilentlyContinue) { Write-Warn2 $msg } else { Write-Warning $msg }
|        }
|    } catch { }
|}
|
|function Get-ReportExcludeJson {
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ReportName)
|
|    Write-SIMisplacedExcludeWarning
|    if ($null -eq $script:_ReportExcludeJsonCache) { $script:_ReportExcludeJsonCache = @{} }
|    if ($script:_ReportExcludeJsonCache.ContainsKey($ReportName)) {
|        return $script:_ReportExcludeJsonCache[$ReportName]
|    }
|    $result = $null
|    # SecurityInsight Pro (#211): the settings database is the closest layer. Layer 5b materialises its exclusion
|    # documents into a run-local folder (SI_ProRaSettingsPath); a document there wins, a report without one falls
|    # back to the files below exactly as before. Unset (every Community / VM run) = no change.
|    $proFirst = @()
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_ProRaSettingsPath)) {
|        $proFirst = @(Join-Path ([string]$global:SI_ProRaSettingsPath) ('{0}.exclude.custom.json' -f $ReportName))
|    }
|    if (-not [string]::IsNullOrWhiteSpace($global:SettingsPath) -or $proFirst.Count) {
|        # Customer .custom.json wins over repo-shipped .json (matches the
|        # .locked.yaml / .custom.yaml convention used elsewhere in v2.2).
|        $candidates = @($proFirst)
|        if (-not [string]::IsNullOrWhiteSpace($global:SettingsPath)) {
|            $candidates += (Join-Path $global:SettingsPath ('{0}.exclude.custom.json' -f $ReportName))
|            $candidates += (Join-Path $global:SettingsPath ('{0}.exclude.json'        -f $ReportName))
|        }
|        foreach ($path in $candidates) {
|            if (-not (Test-Path -LiteralPath $path)) { continue }
|            try {
|                $result = [pscustomobject]@{
|                    Path = $path
|                    Body = Get-Content -LiteralPath $path -Raw -Encoding UTF8 | ConvertFrom-Json
|                }
|                break
|            } catch {
|                Write-Warn2 ("[exclude] failed to parse {0}: {1}" -f $path, $_.Exception.Message)
|            }
|        }
|    }
|    $script:_ReportExcludeJsonCache[$ReportName] = $result
|    return $result
|}
|
|function Get-GlobalExcludeJson {
|    [CmdletBinding()]
|    param()
|    if ($null -ne $script:_GlobalExcludeJsonCache) {
|        if ($script:_GlobalExcludeJsonCache -is [string] -and $script:_GlobalExcludeJsonCache -eq '__none__') { return $null }
|        return $script:_GlobalExcludeJsonCache
|    }
|    $script:_GlobalExcludeJsonCache = '__none__'
|    # Pro (#211): the database's global exclusions, materialised run-locally, win over the file.
|    $path = $null
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_ProRaSettingsPath)) {
|        $p = Join-Path ([string]$global:SI_ProRaSettingsPath) $script:_GlobalExcludeFileName
|        if (Test-Path -LiteralPath $p) { $path = $p }
|    }
|    if (-not $path) {
|        if ([string]::IsNullOrWhiteSpace($global:SettingsPath)) { return $null }
|        $path = Join-Path $global:SettingsPath $script:_GlobalExcludeFileName
|    }
|    if (-not (Test-Path -LiteralPath $path)) { return $null }
|    try {
|        $obj = [pscustomobject]@{
|            Path = $path
|            Body = Get-Content -LiteralPath $path -Raw -Encoding UTF8 | ConvertFrom-Json
|        }
|        $script:_GlobalExcludeJsonCache = $obj
|        Write-Info ("[exclude] global fallback loaded: {0}" -f $path)
|        return $obj
|    } catch {
|        Write-Warn2 ("[exclude] failed to parse global file {0}: {1}" -f $path, $_.Exception.Message)
|        return $null
|    }
|}
|
|function Get-ExcludedListForReport {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]  $ReportName,
|        [Parameter(Mandatory)][string[]]$PropertyNames,
|        [string]                        $Token = ''
|    )
|    $loaded = Get-ReportExcludeJson -ReportName $ReportName
|    $list   = @()
|    $found  = $false
|    if ($null -ne $loaded) {
|        $body = $loaded.Body
|        # Bare array file: maps to the first property name requested
|        if ($body -is [System.Array]) {
|            $list  = $body
|            $found = $true
|        } else {
|            foreach ($p in $PropertyNames) {
|                if ($body.PSObject.Properties[$p] -and $body.$p) {
|                    $list  = $body.$p
|                    $found = $true
|                    break
|                }
|            }
|        }
|    }
|    # Global fallback ONLY for whitelisted tokens (e.g. ExcludedAssetTags) when
|    # per-report file didn't carry the property.
|    if (-not $found -and -not [string]::IsNullOrWhiteSpace($Token) -and ($script:_GlobalExcludeTokens -contains $Token)) {
|        $g = Get-GlobalExcludeJson
|        if ($null -ne $g) {
|            foreach ($p in $PropertyNames) {
|                if ($g.Body.PSObject.Properties[$p] -and $g.Body.$p) {
|                    $list = $g.Body.$p
|                    break
|                }
|            }
|        }
|    }
|    $clean = @($list | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | ForEach-Object { [string]$_ })
|    return $clean
|}
|
|# Moved VERBATIM out of Invoke-RiskAnalysis.ps1 (2026-10-15): the data health check (engine\data-health) reads a report's CVE minimum age
|# through this one function, never a copy of it.
|function Get-ScalarValueForReport {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]   $ReportName,
|        [Parameter(Mandatory)][string[]] $PropertyNames,
|        [Parameter(Mandatory)]           $Default
|    )
|    $loaded = Get-ReportExcludeJson -ReportName $ReportName
|    if ($null -ne $loaded -and $loaded.Body -isnot [System.Array]) {
|        foreach ($p in $PropertyNames) {
|            if ($loaded.Body.PSObject.Properties[$p] -and $null -ne $loaded.Body.$p) {
|                return $loaded.Body.$p
|            }
|        }
|    }
|    return $Default
|}
|
|function Resolve-ExcludePlaceholders {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$Query,
|        [Parameter(Mandatory)][string]$ReportName
|    )
|    # Block-marker form ONLY (portal-safe). Source query must wrap a default
|    # `let _foo = dynamic([]);` between begin/end line-comment markers, e.g.:
|    #
|    #     //__EXCLUDED_CVES_BEGIN__
|    #     let _excludedCves = dynamic([]);
|    #     //__EXCLUDED_CVES_END__
|    #
|    # Engine replaces the ENTIRE block with a real let binding sourced from
|    # <ReportName>.exclude.custom.json (or .exclude.json fallback). The let
|    # variable name is recovered from the inline default so it doesn't have
|    # to be hardcoded per token. Without engine substitution (raw portal
|    # paste) the inline default applies and the query parses fine.
|
|    foreach ($token in $script:_ExcludeTokenMap.Keys) {
|        $tokenName  = $token.Trim('_')   # 'EXCLUDED_CVES'
|        $beginMark  = ('//__{0}_BEGIN__' -f $tokenName)
|        $endMark    = ('//__{0}_END__'   -f $tokenName)
|
|        $blockRx   = [regex]::Escape($beginMark) + '(?<body>.*?)' + [regex]::Escape($endMark)
|        $bodyMatch = [regex]::Match($Query, $blockRx, [System.Text.RegularExpressions.RegexOptions]::Singleline)
|        if (-not $bodyMatch.Success) { continue }
|
|        $items = @(Get-ExcludedListForReport -ReportName $ReportName -PropertyNames $script:_ExcludeTokenMap[$token] -Token $token)
|        $kqlArray = if ($items.Count -gt 0) {
|            '[' + (($items | ForEach-Object { '"' + ($_ -replace '"','\"') + '"' }) -join ',') + ']'
|        } else {
|            '[]'
|        }
|        $varName = if ($bodyMatch.Groups['body'].Value -match 'let\s+(\w+)\s*=') { $matches[1] } else { '_excludedItems' }
|        $newBlock = ($beginMark + [Environment]::NewLine +
|                     ('let {0} = dynamic({1});' -f $varName, $kqlArray) + [Environment]::NewLine +
|                     $endMark)
|        $Query = $Query.Replace($bodyMatch.Value, $newBlock)
|        Write-Info ("[exclude] {0}: substituted block {1} ({2}) with {3} item(s)" -f $ReportName, $tokenName, $varName, $items.Count)
|    }
|    # #211: an exclusion set for THIS report (the web app's Exclusions page, or its file) that its query has no filter for
|    # changes nothing -- said once per report, never silent.
|    $unused = @(Get-RAUnusedExclusions -Query $Query -ReportName $ReportName)
|    if ($unused.Count) {
|        $msg = ("[exclude] {0}: these exclusions are set for this report but change nothing, because the report does not filter on them: {1}. Remove them from the report's exclusions (Reports > Exclusions in the web app, or {2}), or set them on a report that filters on them." -f
|            $ReportName, (($unused | ForEach-Object { '{0} ({1})' -f $_.Property, $_.Count }) -join ', '), (Split-Path -Leaf ([string](Get-ReportExcludeJson -ReportName $ReportName).Path)))
|        if (Get-Command -Name Write-Warn2 -ErrorAction SilentlyContinue) { Write-Warn2 $msg } else { Write-Warning $msg }
|    }
|    return $Query
|}
|
|function Get-RAUnusedExclusions {
|    <#
|        The lists (and the CVE minimum age) a report's OWN exclusion document sets that its query has no block for -- so
|        they exclude nothing. Per entry: Property, Count (items; the age for CveMinAgeDays). The global asset-tag list is
|        not checked here: it applies to every report that filters on tags, by design.
|    #>
|    param([Parameter(Mandatory)][string]$Query, [Parameter(Mandatory)][string]$ReportName)
|    $loaded = Get-ReportExcludeJson -ReportName $ReportName
|    if ($null -eq $loaded -or $null -eq $loaded.Body -or $loaded.Body -is [System.Array]) { return @() }
|    $body = $loaded.Body
|    $out = New-Object System.Collections.Generic.List[object]
|    # #541: the scope preamble applies every exclusion list to the reports whose scope part declares it
|    # (data-model/report-scope) -- no block in the query any more. Unused = set, but the report's part is off.
|    if (Get-Command -Name Get-RAReportScope -ErrorAction SilentlyContinue) {
|        $spec = Get-RAReportScope -ReportName $ReportName -Template (Get-RAReportScopeTemplate)
|        $parts = [ordered]@{ ExcludedCves = 'cves'; CveMinAgeDays = 'cves'; ExcludedConfigurationIds = 'configurationIds'; ExcludedAssetTags = 'assetTags'; ExcludedAssets = 'excludedAssets'; ExcludedIpRanges = 'ipRanges' }
|        foreach ($p in $parts.Keys) {
|            if (-not $body.PSObject.Properties[$p] -or [bool]$spec.Scope[$parts[$p]]) { continue }
|            $v = $body.$p
|            if ($p -eq 'CveMinAgeDays') { $n = 0.0; if ([double]::TryParse([string]$v, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n) -and $n -gt 0) { $out.Add([pscustomobject]@{ Property = $p; Count = $n }) }; continue }
|            $c = @($v | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) }).Count
|            if ($c -gt 0) { $out.Add([pscustomobject]@{ Property = $p; Count = $c }) }
|        }
|        return $out.ToArray()
|    }
|    $maps = @()
|    if ($script:_ExcludeTokenMap) { foreach ($t in $script:_ExcludeTokenMap.Keys) { $maps += , @($t, @($script:_ExcludeTokenMap[$t]), $false) } }
|    if ($script:_ScalarTokenMap)  { foreach ($t in $script:_ScalarTokenMap.Keys)  { $maps += , @($t, @($script:_ScalarTokenMap[$t].JsonProps), $true) } }
|    foreach ($m in $maps) {
|        $begin = '//__{0}_BEGIN__' -f ([string]$m[0]).Trim('_')
|        if ($Query.IndexOf($begin, [StringComparison]::Ordinal) -ge 0) { continue }
|        foreach ($p in @($m[1])) {
|            if (-not $body.PSObject.Properties[$p]) { continue }
|            $v = $body.$p
|            if ($m[2]) {
|                $n = 0.0
|                if ($null -ne $v -and [double]::TryParse([string]$v, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n) -and $n -gt 0) { $out.Add([pscustomobject]@{ Property = $p; Count = $n }) }
|            } else {
|                $c = @($v | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) }).Count
|                if ($c -gt 0) { $out.Add([pscustomobject]@{ Property = $p; Count = $c }) }
|            }
|            break
|        }
|    }
|    $out.ToArray()
|}
'@ }
$__siSupportFiles['engine/pro-settings/SI-TemplatePacks.ps1'] = @{ Sha256 = 'f2962f2c7554031e5e191e856b54c63b62b91132305fd56f0f33930f2d5742d2'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- TEMPLATE PACKS: template versions released per ring, independently of the code.
|
|    Operator, 2026-10-03: "i need an admin interface to release new templates versions" (both the vendor side and the
|    customer side) -- "typically detection methods".
|
|    A TEMPLATE PACK is every shipped template item exactly as Publish-SITemplates computes it (kind, key, body, format,
|    ContentHash, version), as ONE JSON file si-templates-<packVersion>.json plus a sha256sum line beside it. A pack is
|    FULL (every templated kind) or PARTIAL (selected detection methods / kinds / items). The vendor publishes it to the
|    update feed and approves it per ring; an install's updater stages the pack its ring approves in cfg.TemplatePackStaged,
|    and the customer releases it -- all of it, or only selected detection methods -- through the same fingerprint gate
|    as a release's own templates.
|
|    DETECTION METHODS. The templates are mostly detection methods, so every item belongs to one:
|      rule          <engine>/<method folder or file>   e.g. endpoint/AssetProfileByApplicationServiceDetection
|      rareport      riskanalysis/<SecurityDomain>      e.g. riskanalysis/Endpoint; report templates: riskanalysis/ReportTemplates
|      riskindex     riskanalysis/RiskIndex
|      assettagging  endpoint/AssetTagging
|      servicemodel  config/ServiceModel
|      datamodel     datamodel/<template>              e.g. datamodel/field-catalog, datamodel/mappings-mde (#456)
|    (#251: names and the CMDB ownership map are configuration, never in a pack.)
|    PACK VERSIONS (#250) are their own series: the templates shipped with the code are pack 1.0 ("Default templates 1.0",
|    engine\pro-settings\shipped-template-pack.json); the vendor's later packs are 1.1, 1.2, ... (Get-SIProNextPackVersion).
|    The web app (pro-management, TemplateReleases.cs) computes the SAME method ids, diff and selection fingerprint; a
|    test runs both on the same rows.
|
|    THE SELECTION FINGERPRINT. What a customer accepts is named exactly: SHA-256 over '<kind>/<key>=<ContentHash>' for
|    every pack item of the selected methods and '<kind>/<key>=retired' for every live item of those methods the pack no
|    longer ships -- ordinal order, newline-joined. The publish job is started with it and refuses any other.
|
|    Everything here except the store readers / writers is pure (rows in, objects out). PS 5.1 safe.
|#>
|
|if (-not (Get-Command -Name Get-SIProTextHash -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-ProSettings.ps1'))
|}
|
|$script:SIProPackSchema = 1
|$script:SIProPackNamePattern = '^\d{1,6}(\.\d{1,12}){1,5}$'
|# #251: VENDOR-DEVELOPED content only. naming and cmdbownership are configuration -- a pack can never carry them.
|# #456: datamodel = the data model's items (field catalog, provider mappings, ...; SI-DataModelTemplateRows.ps1)
|$script:SIProTemplatedKinds = @('rareport', 'riskindex', 'rule', 'assettagging', 'servicemodel', 'datamodel')
|$script:SIProPackStateName = 'TemplatePack'
|# 'as-released' (the templates in force are the pack's) | 'customised' (an install adopted with other templates, #250)
|$script:SIProPackStatusName = 'TemplatePackStatus'
|$script:SIProReleaseLogName = 'template-release'
|# #405 (operator decision 2026-10-06): every shipped template is one of three classes -- how a change to it travels.
|#   fix        a fix to our own queries / logic: inside the product release, always installed with the code, never held
|#   default    customer business logic: SecurityInsight ships the default; a customer's edit (an override) is never changed
|#   microsoft  a new Microsoft data surface: a Microsoft content pack between releases, ring by ring, installed automatically
|$script:SIProTemplateClasses = @('fix', 'default', 'microsoft')
|# what is installed, per class (cfg.InstallState): the code release whose fix + default templates are in force; ring 1's
|# direct install; the Microsoft content pack the customer rolled back from (not installed automatically again); the mode
|$script:SIProCodeStateName = 'TemplateCode'
|$script:SIProDirectStateName = 'TemplateDirect'
|$script:SIProDeclinedStateName = 'TemplatePackDeclined'
|$script:SIProModeStateName = 'TemplateMode'
|# the customer's switch (Pro settings catalog, read from SQL only): hold template packs for a manual Install ("Hold template packs")
|$script:SIProHoldSettingName = 'SI_InvardiaUpdate_HoldMicrosoftContent'
|# this code's own SecurityInsight folder (engine\pro-settings -> two up): where its classification document lives
|$script:SIProTemplatePacksSIRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|if (-not $script:SIProClassificationCache) { $script:SIProClassificationCache = @{} }
|
|function Get-SIProTemplatedKinds { $script:SIProTemplatedKinds }
|function Get-SIProTemplateClasses { $script:SIProTemplateClasses }
|
|# =====================================================================================================================
|#  CLASSIFICATION (#405) -- fix | default | microsoft, as data: config\template-classification.locked.json
|# =====================================================================================================================
|function Get-SIProTemplateClassification {
|    <#
|        The classification document of a SecurityInsight folder (-SIRoot; default: this code's own), cached per path:
|        @{ Present; Path; Document }. A missing or unreadable file is Present = $false -- every item then reads 'fix' and
|        the split install is off (Publish-SITemplates needs a present, REVIEWED classification). -Text: a document as text
|        (tests, and the pack builder reading a commit).
|    #>
|    param([string]$SIRoot, [string]$Text)
|    if ($PSBoundParameters.ContainsKey('Text')) {
|        $d = $null; try { $d = ConvertFrom-SIProJson ([string]$Text).TrimStart([char]0xFEFF) } catch { $d = $null }
|        return (New-SIProClassificationObject -Document $d -Path '')
|    }
|    if (-not $SIRoot) { $SIRoot = $script:SIProTemplatePacksSIRoot }
|    $p = [System.IO.Path]::Combine($SIRoot, 'config', 'template-classification.locked.json')
|    if ($script:SIProClassificationCache.ContainsKey($p)) { return $script:SIProClassificationCache[$p] }
|    $doc = $null
|    if (Test-Path -LiteralPath $p) { try { $doc = ConvertFrom-SIProJson ([System.IO.File]::ReadAllText($p).TrimStart([char]0xFEFF)) } catch { $doc = $null } }
|    $c = New-SIProClassificationObject -Document $doc -Path $p
|    $script:SIProClassificationCache[$p] = $c
|    $c
|}
|
|function New-SIProClassificationObject {
|    <# The parsed document with ORDINAL (case-sensitive) lookups -- PowerShell's own property lookup ignores case, the web app's does not. #>
|    param($Document, [string]$Path)
|    $items = New-Object 'System.Collections.Generic.Dictionary[string,object]' ([System.StringComparer]::Ordinal)
|    $kinds = New-Object 'System.Collections.Generic.Dictionary[string,string]' ([System.StringComparer]::Ordinal)
|    $rules = New-Object System.Collections.Generic.List[object]
|    if ($Document) {
|        if ($Document.PSObject.Properties['Items'] -and $Document.Items) { foreach ($pr in $Document.Items.PSObject.Properties) { if (Test-SIProTemplateClassName ([string]$pr.Value.Class)) { $items[$pr.Name] = $pr.Value } } }
|        if ($Document.PSObject.Properties['ByKind'] -and $Document.ByKind) { foreach ($pr in $Document.ByKind.PSObject.Properties) { if (Test-SIProTemplateClassName ([string]$pr.Value)) { $kinds[$pr.Name] = [string]$pr.Value } } }
|        if ($Document.PSObject.Properties['Rules']) {
|            foreach ($r in @($Document.Rules | Where-Object { $_ })) {
|                if (-not (Test-SIProTemplateClassName ([string]$r.Class)) -or -not [string]$r.Pattern) { continue }
|                $rules.Add([pscustomobject]@{ Kind = [string]$r.Kind; Regex = (New-Object System.Text.RegularExpressions.Regex ([string]$r.Pattern), ([System.Text.RegularExpressions.RegexOptions]::CultureInvariant)); Class = [string]$r.Class; Reason = [string]$r.Reason })
|            }
|        }
|    }
|    [pscustomobject]@{ Present = ($null -ne $Document); Path = $Path; Document = $Document; ItemsMap = $items; KindMap = $kinds; RuleList = $rules.ToArray() }
|}
|
|function Test-SIProTemplateClassName { param([AllowEmptyString()][AllowNull()][string]$Class) $script:SIProTemplateClasses -ccontains ([string]$Class) }
|
|function Get-SIProTemplateClass {
|    <#
|        PURE (given -Classification). The class of one template item: the document's Items ('<kind>/<key>', exact), then
|        its Rules in order (Kind equal, Pattern an ordinal, culture-invariant .NET regex on the ItemKey), then ByKind, else
|        'fix' -- the safe side: it ships with the code and is never held. The web app's TemplateClasses.Of is the same
|        rule (a test runs both on every shipped item). -Detailed: @{ Name; Kind; ItemKey; Class; Source = item | rule |
|        kind | fallback; Reason }.
|    #>
|    param([AllowEmptyString()][string]$Kind, [AllowEmptyString()][string]$ItemKey, $Classification, [switch]$Detailed)
|    if ($null -eq $Classification) { $Classification = Get-SIProTemplateClassification }
|    $name = '{0}/{1}' -f $Kind, $ItemKey
|    $cls = ''; $src = ''; $why = ''
|    if ($Classification -and $Classification.Present) {
|        $e = $null
|        if ($Classification.ItemsMap.TryGetValue($name, [ref]$e)) { $cls = [string]$e.Class; $src = 'item'; $why = [string]$e.Reason }
|        if (-not $cls) {
|            foreach ($r in @($Classification.RuleList)) {
|                if ($r.Kind -cne $Kind) { continue }
|                if ($r.Regex.IsMatch([string]$ItemKey)) { $cls = $r.Class; $src = 'rule'; $why = $r.Reason; break }
|            }
|        }
|        $k = $null
|        if (-not $cls -and $Classification.KindMap.TryGetValue([string]$Kind, [ref]$k)) { $cls = $k; $src = 'kind'; $why = ('every {0} item is {1} unless named otherwise' -f $Kind, $cls) }
|    }
|    if (-not $cls) { $cls = 'fix'; $src = 'fallback'; $why = 'not classified -- fix is the safe side (ships with the code, never held)' }
|    if (-not $Detailed) { return $cls }
|    [pscustomobject]@{ Name = $name; Kind = $Kind; ItemKey = $ItemKey; Class = $cls; Source = $src; Reason = $why }
|}
|
|function Get-SIProRowClass {
|    <# A row's class: its own Class field (a pack item carries the class it was built with), else Get-SIProTemplateClass. #>
|    param($Row, $Classification)
|    $c = [string](Get-SIProRowValue $Row 'Class')
|    if (Test-SIProTemplateClassName $c) { return $c }
|    Get-SIProTemplateClass -Kind ([string](Get-SIProRowValue $Row 'Kind')) -ItemKey ([string](Get-SIProRowValue $Row 'ItemKey')) -Classification $Classification
|}
|
|function Get-SIProShippedPackPin {
|    <#
|        What the shipped pack version (engine\pro-settings\shipped-template-pack.json) NAMES, and whether its Fingerprint
|        still pins it (#405, lane-pack14). A pack version is immutable: the same version never names different content.
|        Split install (ClassificationReviewed + a classification present): the pack version names the MICROSOFT CONTENT
|        only -- fix and default templates have no version of their own, they ride the code version and are installed
|        with the code on every install (also one already on this pack), so a change to them never needs a pack bump.
|        Gated (not reviewed): every template change waits for a review under a pack version, so the pin is every shipped
|        template. Scope = microsoft | all; Fingerprint = Get-SIProTemplateSetFingerprint over the rows in scope; Pinned =
|        the file's Fingerprint; Same = they match; Action = exactly what the vendor does when they do not.
|    #>
|    param([string]$SIRoot, [AllowEmptyCollection()][object[]]$Rows, $Classification)
|    $info = Get-SIProShippedPackInfo -SIRoot $SIRoot
|    if ($null -eq $Classification) { $Classification = Get-SIProTemplateClassification -SIRoot $SIRoot }
|    if ($null -eq $Rows) { $Rows = @((Get-SITemplateRows -SIRoot $SIRoot).Rows) }
|    $split = [bool]$info.ClassificationReviewed -and [bool]$Classification.Present
|    $scope = if ($split) { 'microsoft' } else { 'all' }
|    $inScope = if ($split) { @($Rows | Where-Object { $_ -and (Get-SIProRowClass -Row $_ -Classification $Classification) -eq 'microsoft' }) } else { @($Rows | Where-Object { $_ }) }
|    $fp = Get-SIProTemplateSetFingerprint -Rows $inScope
|    $pinned = ''
|    try {
|        $o = ConvertFrom-SIProJson ([System.IO.File]::ReadAllText((Join-SIProPath $SIRoot 'engine' 'pro-settings' 'shipped-template-pack.json')).TrimStart([char]0xFEFF))
|        $pinned = ([string]$o.Fingerprint).Trim()
|    } catch { }
|    $same = $pinned -eq $fp
|    $what = if ($split) { 'the Microsoft content (the {0} microsoft-class templates)' -f $inScope.Count } else { 'the shipped templates (all {0}; the classification is not reviewed, so every change is a pack)' -f $inScope.Count }
|    $action = if ($same) { '' } elseif ($split) {
|        ('{0} changed under Microsoft content {1}: a published Microsoft content pack never changes. Raise PackVersion (the next Microsoft content pack, e.g. {2}) and Name in engine\pro-settings\shipped-template-pack.json, set Fingerprint to {3}, and add a history line to its _doc. Fix and default templates never need this -- they ride the code version.' -f $what, $info.PackVersion, (Get-SIProNextPackVersion -Existing @($info.PackVersion)), $fp)
|    } else {
|        ('{0} changed under pack {1}: an install that already has {1} would never receive the change. Raise PackVersion and Name in engine\pro-settings\shipped-template-pack.json and set Fingerprint to {2}' -f $what, $info.PackVersion, $fp)
|    }
|    [pscustomobject]@{ PackVersion = $info.PackVersion; Scope = $scope; Split = $split; Fingerprint = $fp; Pinned = $pinned; Same = $same; Count = $inScope.Count; Action = $action }
|}
|
|function Get-SIProClassificationSummary {
|    <# PURE. Per class and per kind the item counts of -Rows (the shipped templates), and every item with its decision. #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), $Classification)
|    $items = @(foreach ($r in @($Rows | Where-Object { $_ })) { Get-SIProTemplateClass -Kind ([string](Get-SIProRowValue $r 'Kind')) -ItemKey ([string](Get-SIProRowValue $r 'ItemKey')) -Classification $Classification -Detailed })
|    $byClass = [ordered]@{}; foreach ($c in $script:SIProTemplateClasses) { $byClass[$c] = @($items | Where-Object { $_.Class -eq $c }).Count }
|    $byKind = [ordered]@{}
|    foreach ($k in $script:SIProTemplatedKinds) {
|        $h = [ordered]@{}; foreach ($c in $script:SIProTemplateClasses) { $h[$c] = @($items | Where-Object { $_.Kind -eq $k -and $_.Class -eq $c }).Count }
|        $byKind[$k] = $h
|    }
|    [pscustomobject]@{ Total = $items.Count; ByClass = $byClass; ByKind = $byKind; Items = $items }
|}
|
|function Get-SIProTemplatePackDecision {
|    <#
|        PURE. What the INSTALLED code does with a template pack -- EVERY template pack: Microsoft content and packs that
|        carry more (SecurityInsight's own templates). Owner decision 2026-10-11 ("Automatic"): a template pack installs
|        automatically on update, like a code fix, in every ring; a customer's edit (an override beside the template row) is
|        never written, and Template conformance shows where theirs differs. "Hold" stays the customer's opt-in to approve
|        by hand. -Pack: the pack (PackVersion, Content, MinCodeVersion, CodeVersion); -CodeVersion: the code this install
|        runs; -Hold: the customer's Hold setting; -Declined: the pack the customer rolled back from (cfg.InstallState
|        TemplatePackDeclined); -Installed: the pack in force (cfg.InstallState TemplatePack -- also what ring 1's direct
|        install recorded), '' when none is a real pack; -Direct: ring 1 installs the current templates directly on every
|        deploy -- no longer a reason to hold: a pack the direct install already put in force reads 'installed', a newer one
|        installs like everywhere else; -Split: the install's classification is present and reviewed -- kept for the
|        callers, it no longer changes the outcome (a customer's edit is an override in both modes, never written by either).
|          installed  the pack is the one in force, or older -- nothing to do, nothing to Install
|          wait-code  the pack needs newer code -- never installed by this code, not even by hand. The minimum is the pack's
|                     MinCodeVersion; a pack without one that carries more than Microsoft content needs the code it was
|                     built by (CodeVersion), so its items are never read by engines older than they were written for
|          hold       Hold is on, or the customer rolled back from this pack (or a newer one): staged and shown with
|                     Install, nothing written automatically -- the only outcomes that wait for an Admin
|          install    installed automatically
|        Returns @{ Action; Auto; Installable; Reason }. The web app's TemplatePackState.Of is the same rule (a shared case
|        file, pro-management\tests\fixtures\template-pack-decision-cases.json, runs both).
|    #>
|    param([bool]$Split, $Pack, [AllowEmptyString()][string]$CodeVersion, [bool]$Hold, [AllowEmptyString()][string]$Declined, [bool]$Direct,
|          [AllowEmptyString()][string]$Installed)
|    $get = { param($n) if ($null -eq $Pack) { '' } elseif ($Pack -is [System.Collections.IDictionary]) { [string]$Pack[$n] } elseif ($Pack.PSObject.Properties[$n]) { [string]$Pack.$n } else { '' } }
|    $v = & $get 'PackVersion'; $content = & $get 'Content'; $min = & $get 'MinCodeVersion'
|    if (-not $min -and $content -ne 'microsoft') { $min = & $get 'CodeVersion' }
|    $what = if ($content -eq 'microsoft') { 'Microsoft content {0}' -f $v } else { 'template pack {0}' -f $v }
|    $mk = { param($a, [bool]$auto, [bool]$ok, $why) [pscustomobject]@{ Action = $a; Auto = $auto; Installable = $ok; Reason = $why } }
|    if ($Installed -and (Test-SIProPackVersion $Installed) -and (Compare-SIProPackVersion $v $Installed) -le 0) {
|        return (& $mk 'installed' $false $false ('{0} is in force already{1} -- nothing to install' -f $what, $(if ($v -ne $Installed) { ' (' + $Installed + ' is installed)' } else { '' })))
|    }
|    if ($min -and (Compare-SIProPackVersion $min $CodeVersion) -gt 0) {
|        return (& $mk 'wait-code' $false $false ('{0} needs SecurityInsight {1} or newer; this install runs {2} -- it waits until the code has been updated' -f $what, $min, $(if ($CodeVersion) { $CodeVersion } else { 'an unknown version' })))
|    }
|    if ($Declined -and (Compare-SIProPackVersion $v $Declined) -le 0) {
|        $declWhat = if ($content -eq 'microsoft') { 'Microsoft content {0}' -f $Declined } else { 'template pack {0}' -f $Declined }
|        return (& $mk 'hold' $false $true ('you rolled back from {0} -- {1} is not installed automatically (Install it on Template releases to take it)' -f $declWhat, $v))
|    }
|    if ($Hold) { return (& $mk 'hold' $false $true ('Hold template packs is on -- {0} waits on Template releases until you Install it' -f $what)) }
|    & $mk 'install' $true $true ('{0} is installed automatically (your own changes are kept)' -f $what)
|}
|
|function Test-SIProInstalledPackIsPack {
|    <# PURE. Is a recorded TemplatePack a real pack version? A value recorded before packs had their own series carries the
|       CODE version (major >= 2) and no status -- not a pack (the same rule as Get-SIProDefaultTemplateDecision). #>
|    param([AllowEmptyString()][string]$InstalledPack, [AllowEmptyString()][string]$InstalledStatus)
|    if (-not $InstalledPack -or -not (Test-SIProPackVersion $InstalledPack)) { return $false }
|    if (-not $InstalledStatus) { $major = 0; if ([int]::TryParse(($InstalledPack.Trim().Split('.')[0]), [ref]$major) -and $major -ge 2) { return $false } }
|    $true
|}
|
|# =====================================================================================================================
|#  NAMES AND VERSIONS
|# =====================================================================================================================
|function Test-SIProPackVersion {
|    <# PURE. A pack version: 2 to 6 dot-separated numbers, at most 32 characters (cfg.Template.[Version]). #>
|    param([AllowEmptyString()][AllowNull()][string]$Version)
|    $v = ([string]$Version).Trim()
|    ($v.Length -le 32) -and ($v -match $script:SIProPackNamePattern)
|}
|
|function Compare-SIProPackVersion {
|    <#
|        PURE. -1 / 0 / 1. Numeric per part, as 64-bit numbers ([version] cannot hold a yyyyMMddHHmm part); a missing part
|        counts as 0, so 3.0.0 = 3.0.0.0 < 3.0.0.202610031200.
|    #>
|    param([AllowEmptyString()][string]$A, [AllowEmptyString()][string]$B)
|    $pa = @(([string]$A).Trim().Split('.') | Where-Object { $_ -ne '' }); $pb = @(([string]$B).Trim().Split('.') | Where-Object { $_ -ne '' })
|    $n = [Math]::Max($pa.Count, $pb.Count)
|    for ($i = 0; $i -lt $n; $i++) {
|        $x = [long]0; $y = [long]0
|        if ($i -lt $pa.Count) { [void][long]::TryParse($pa[$i], [ref]$x) }
|        if ($i -lt $pb.Count) { [void][long]::TryParse($pb[$i], [ref]$y) }
|        if ($x -lt $y) { return -1 }
|        if ($x -gt $y) { return 1 }
|    }
|    0
|}
|
|function Get-SIProPackFileName {
|    param([Parameter(Mandatory)][string]$PackVersion)
|    if (-not (Test-SIProPackVersion $PackVersion)) { throw "not a template pack version: '$PackVersion' (2 to 6 numbers, e.g. 3.0.0.202610031200)" }
|    'si-templates-{0}.json' -f $PackVersion.Trim()
|}
|
|function Get-SIProPackVersionFromName {
|    <# PURE. 'si-templates-3.0.0.202610031200.json' -> '3.0.0.202610031200'; '' for any other name. #>
|    param([AllowEmptyString()][string]$Name)
|    $m = [regex]::Match([string]$Name, '^si-templates-(?<v>\d[\d\.]*\d)\.json$')
|    if ($m.Success -and (Test-SIProPackVersion $m.Groups['v'].Value)) { return $m.Groups['v'].Value }
|    ''
|}
|
|function Get-SIProNextPackVersion {
|    <#
|        PURE. The next template pack version (#250): template packs are their OWN series, starting at 1.0 -- never the code
|        version. -Existing: the pack versions already published (the feed's si-templates-*.json, the shipped pack); none =
|        '1.0'. Otherwise the next MINOR after the highest: 1.0 -> 1.1 -> 1.2 ... (1.9 -> 1.10). Versions that are not pack
|        versions are ignored.
|    #>
|    param([AllowEmptyCollection()][string[]]$Existing = @())
|    $top = ''
|    foreach ($v in @($Existing | Where-Object { $_ -and (Test-SIProPackVersion $_) })) { if (-not $top -or (Compare-SIProPackVersion $v $top) -gt 0) { $top = $v.Trim() } }
|    if (-not $top) { return '1.0' }
|    $parts = $top.Split('.')
|    $minor = [long]0; [void][long]::TryParse($parts[1], [ref]$minor)
|    '{0}.{1}' -f $parts[0], ($minor + 1)
|}
|
|function New-SIProPackVersion {
|    <# PURE. <release VERSION>.<yyyyMMddHHmm> of -At (UTC) -- the pack version scheme before #250. Template packs are their
|       own series now (Get-SIProNextPackVersion); kept for packs that were built that way. #>
|    param([Parameter(Mandatory)][string]$CodeVersion, [Parameter(Mandatory)][datetime]$At)
|    $v = '{0}.{1}' -f $CodeVersion.Trim(), $At.ToUniversalTime().ToString('yyyyMMddHHmm', [System.Globalization.CultureInfo]::InvariantCulture)
|    if (-not (Test-SIProPackVersion $v)) { throw "'$v' is not a usable pack version" }
|    $v
|}
|
|function Get-SIProSha256Line {
|    <# PURE. The sha256sum line for a file: '<hex>  <name>' + LF. #>
|    param([Parameter(Mandatory)][string]$Sha256, [Parameter(Mandatory)][string]$FileName)
|    '{0}  {1}' -f $Sha256.Trim().ToLowerInvariant(), $FileName + "`n"
|}
|
|function Read-SIProSha256Line {
|    <# PURE. The hash out of a sha256sum file (first line, '<hex>  <name>' or '<hex> *<name>'); throws on anything else. #>
|    param([AllowEmptyString()][AllowNull()][string]$Text, [string]$FileName)
|    $line = (([string]$Text).TrimStart([char]0xFEFF) -split "`r?`n" | Where-Object { $_.Trim() } | Select-Object -First 1)
|    $m = [regex]::Match([string]$line, '^(?<h>[0-9a-fA-F]{64})\s+\*?(?<n>\S.*)$')
|    if (-not $m.Success) { throw 'the .sha256 file is not in sha256sum format (<64 hex>  <file name>)' }
|    if ($FileName -and $m.Groups['n'].Value.Trim() -ne $FileName) { throw ("the .sha256 file names '{0}', not '{1}'" -f $m.Groups['n'].Value.Trim(), $FileName) }
|    $m.Groups['h'].Value.ToLowerInvariant()
|}
|
|# =====================================================================================================================
|#  DETECTION METHODS
|# =====================================================================================================================
|function Get-SIProTemplateMethod {
|    <#
|        PURE. The detection method an item belongs to: @{ Engine; Method; Id = '<engine>/<method>' }. From the item's kind,
|        key, Source (the shipped file it came from) and, for a Risk Analysis report, its SecurityDomain. The web app's
|        TemplateMethods.Of is the same rule.
|    #>
|    param([AllowEmptyString()][string]$Kind, [AllowEmptyString()][string]$ItemKey, [AllowEmptyString()][AllowNull()][string]$Source,
|          [AllowEmptyString()][AllowNull()][string]$BodyJson)
|    $clean = { param([string]$s) $c = ([regex]::Replace([string]$s, '[^A-Za-z0-9_\-]', '')); if ($c) { $c } else { 'Other' } }
|    $engine = 'config'; $method = 'Other'
|    switch ($Kind) {
|        'rule' {
|            $engine = if ($ItemKey -match '^([a-z]+)/') { $Matches[1] } else { 'shared' }
|            $parts = @(([string]$Source).Replace('\', '/').Split('/') | Where-Object { $_ })
|            # asset-profiling-enrichment/<engine>/<method folder>/... or asset-profiling-enrichment/<engine>/<method>.locked.yaml
|            if ($parts.Count -ge 3) { $method = & $clean ($parts[2] -replace '(?i)\.locked\.yaml$', '' -replace '(?i)\.ya?ml$', '') }
|        }
|        'rareport' {
|            $engine = 'riskanalysis'
|            if ($ItemKey -like 'template/*') { $method = 'ReportTemplates' }
|            else {
|                $dom = ''
|                try { $o = ConvertFrom-SIProJson ([string]$BodyJson); if ($o -and $o.PSObject.Properties['SecurityDomain']) { $dom = [string]$o.SecurityDomain } } catch { }
|                $method = & $clean $dom
|            }
|        }
|        'riskindex'     { $engine = 'riskanalysis'; $method = 'RiskIndex' }
|        'assettagging'  { $engine = 'endpoint'; $method = 'AssetTagging' }
|        'cmdbownership' { $method = 'CmdbOwnership' }
|        'servicemodel'  { $method = 'ServiceModel' }
|        # #456: one method per data-model template file: datamodel/field-catalog, datamodel/mappings-mde, ...
|        'datamodel'     { $engine = 'datamodel'; $n = [string]$ItemKey; $ci = $n.IndexOf(':'); if ($ci -ge 0) { $n = $n.Substring(0, $ci) }; $method = & $clean ($n.Replace('/', '-')) }
|        'naming'        { $method = 'Naming' }
|        default         { $method = & $clean $Kind }
|    }
|    [pscustomobject]@{ Engine = $engine; Method = $method; Id = ('{0}/{1}' -f $engine, $method) }
|}
|
|function Get-SIProRowMethodId {
|    <# A row's method id: the pack's own (Engine/Method fields) when present, else computed. #>
|    param($Row)
|    $e = [string](Get-SIProRowValue $Row 'Engine'); $m = [string](Get-SIProRowValue $Row 'Method')
|    if ($e -and $m) { return ('{0}/{1}' -f $e, $m) }
|    (Get-SIProTemplateMethod -Kind ([string](Get-SIProRowValue $Row 'Kind')) -ItemKey ([string](Get-SIProRowValue $Row 'ItemKey')) `
|        -Source ([string](Get-SIProRowValue $Row 'Source')) -BodyJson ([string](Get-SIProRowValue $Row 'BodyJson'))).Id
|}
|
|function Resolve-SIProMethodSelection {
|    <#
|        PURE. A selection as given ('AssetProfileByIPSubnet', 'endpoint/AssetProfileByIPSubnet', '*') against the method
|        ids that exist -> the matching ids (ordinal). A name that matches nothing throws: a typo must never publish
|        nothing -- or everything.
|    #>
|    param([AllowEmptyCollection()][string[]]$Selection = @(), [AllowEmptyCollection()][string[]]$Known = @())
|    $sel = @($Selection | Where-Object { $_ -and $_.Trim() } | ForEach-Object { $_.Trim() })
|    if ($sel.Count -eq 0 -or $sel -contains '*') { $out = [string[]]@($Known | Select-Object -Unique) }
|    else {
|        $list = New-Object System.Collections.Generic.List[string]
|        foreach ($s in $sel) {
|            $hit = @($Known | Where-Object { $_ -ieq $s -or ($_.Substring($_.IndexOf('/') + 1)) -ieq $s })
|            if ($hit.Count -eq 0) { throw ("'{0}' is not a detection method here (known: {1})" -f $s, ((@($Known) | Select-Object -First 30) -join ', ')) }
|            foreach ($h in $hit) { if (-not $list.Contains($h)) { $list.Add($h) } }
|        }
|        $out = $list.ToArray()
|    }
|    if ($out.Count -gt 1) { [Array]::Sort($out, [System.StringComparer]::Ordinal) }
|    $out
|}
|
|# =====================================================================================================================
|#  THE PACK
|# =====================================================================================================================
|function New-SIProTemplatePack {
|    <#
|        PURE. A pack from template rows (Get-SITemplateRows). -Method / -Kind / -ItemKey make it PARTIAL: only those
|        items, and the pack's Scope says what it covers (an item outside the scope is never retired by it).
|        Items are stamped with -PackVersion and ordered ordinally by kind|key, so the same rows give the same text.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [Parameter(Mandatory)][string]$PackVersion, [Parameter(Mandatory)][string]$CodeVersion,
|          [string]$Commit = '', [string[]]$Method, [string[]]$Kind, [string[]]$ItemKey,
|          # the pack's display name (the shipped one: "Default templates 1.0"); left out of the file when empty
|          [string]$Name,
|          # #405: only items of these classes. -Class microsoft makes a MICROSOFT CONTENT PACK (Content = 'microsoft'): its
|          # scope names exactly its items (older code then never retires anything outside them) and its classes.
|          [ValidateSet('fix', 'default', 'microsoft')][string[]]$Class,
|          # #405: the oldest code that may install the pack (default for a Microsoft content pack: -CodeVersion)
|          [string]$MinCodeVersion,
|          # the classification the items are stamped with (default: this code's own)
|          $Classification)
|    if (-not (Test-SIProPackVersion $PackVersion)) { throw "not a template pack version: '$PackVersion'" }
|    if ($null -eq $Classification) { $Classification = Get-SIProTemplateClassification }
|    $items = New-Object System.Collections.Generic.List[object]
|    foreach ($r in @($Rows | Where-Object { $_ })) {
|        if ($script:SIProTemplatedKinds -notcontains [string]$r.Kind) { throw ("{0}/{1} is not template content -- a template pack carries only vendor-developed content ({2}); a name is a setting and the CMDB ownership map is configuration" -f $r.Kind, $r.ItemKey, ($script:SIProTemplatedKinds -join ', ')) }
|        $m = Get-SIProTemplateMethod -Kind $r.Kind -ItemKey $r.ItemKey -Source $r.Source -BodyJson $r.BodyJson
|        $cls = Get-SIProRowClass -Row $r -Classification $Classification
|        if ($Class -and $Class -notcontains $cls) { continue }
|        $items.Add([pscustomobject]@{ Row = $r; M = $m; Name = ('{0}/{1}' -f $r.Kind, $r.ItemKey); Class = $cls })
|    }
|    $full = -not ($Method -or $Kind -or $ItemKey -or $Class)
|    $methodsSel = @()
|    if ($Method) { $methodsSel = @(Resolve-SIProMethodSelection -Selection $Method -Known @($items | ForEach-Object { $_.M.Id } | Select-Object -Unique)) }
|    if ($Kind) { foreach ($k in $Kind) { if ($script:SIProTemplatedKinds -notcontains $k) { throw "'$k' is not a templated kind ($($script:SIProTemplatedKinds -join ', '))" } } }
|    $keep = @($items | Where-Object {
|        (-not $Kind -or $Kind -contains $_.Row.Kind) -and (-not $Method -or $methodsSel -contains $_.M.Id) -and (-not $ItemKey -or $ItemKey -contains $_.Name -or $ItemKey -contains $_.Row.ItemKey)
|    })
|    if ($ItemKey) {
|        foreach ($k in $ItemKey) { if (-not @($keep | Where-Object { $_.Name -eq $k -or $_.Row.ItemKey -eq $k }).Count) { throw "'$k' is not an item of this release" } }
|    }
|    if ($keep.Count -eq 0) { throw 'the pack would contain no item' }
|    $order = Get-SIProOrdinalOrder -Keys @($keep | ForEach-Object { '{0}|{1}' -f $_.Row.Kind, $_.Row.ItemKey })
|    $outItems = foreach ($i in $order) {
|        $k = $keep[$i]; $r = $k.Row
|        [ordered]@{ Kind = $r.Kind; ItemKey = $r.ItemKey; Engine = $k.M.Engine; Method = $k.M.Method; Class = $k.Class; Format = $r.Format; Version = $PackVersion.Trim()
|            SortOrder = [int]$r.SortOrder; Source = $r.Source; BodyHash = $r.BodyHash; ContentHash = $r.ContentHash; Body = $r.BodyJson }
|    }
|    $outItems = @($outItems)
|    $kinds = [string[]]@($outItems | ForEach-Object { $_.Kind } | Select-Object -Unique); if ($kinds.Count -gt 1) { [Array]::Sort($kinds, [System.StringComparer]::Ordinal) }
|    if ($full) { $kinds = [string[]]$script:SIProTemplatedKinds.Clone(); [Array]::Sort($kinds, [System.StringComparer]::Ordinal) }
|    elseif ($Kind -and -not $Method -and -not $ItemKey -and -not $Class) { $kinds = [string[]]@($Kind | Select-Object -Unique); if ($kinds.Count -gt 1) { [Array]::Sort($kinds, [System.StringComparer]::Ordinal) } }
|    $scopeItems = @()
|    # a class selection names its items too: code from before #405 knows no classes and must never retire anything else
|    if ($ItemKey -or $Class) { $scopeItems = [string[]]@($outItems | ForEach-Object { '{0}/{1}' -f $_.Kind, $_.ItemKey }); if ($scopeItems.Count -gt 1) { [Array]::Sort($scopeItems, [System.StringComparer]::Ordinal) } }
|    $fp = Get-SIProTemplateSetFingerprint -Rows @($outItems | ForEach-Object { [pscustomobject]@{ Kind = $_.Kind; ItemKey = $_.ItemKey; ContentHash = $_.ContentHash } })
|    $pack = [ordered]@{ Schema = $script:SIProPackSchema; Product = 'SecurityInsight'; PackVersion = $PackVersion.Trim() }
|    if ("$Name".Trim()) { $pack['Name'] = "$Name".Trim() }
|    $pack['CodeVersion'] = $CodeVersion.Trim(); $pack['Commit'] = $Commit
|    $classes = @()
|    if ($Class) { $classes = [string[]]@($Class | Select-Object -Unique); if ($classes.Count -gt 1) { [Array]::Sort($classes, [System.StringComparer]::Ordinal) } }
|    if ($classes.Count -eq 1 -and $classes[0] -eq 'microsoft') { $pack['Content'] = 'microsoft' }
|    if ("$MinCodeVersion".Trim()) { $pack['MinCodeVersion'] = "$MinCodeVersion".Trim() } elseif ($pack.Contains('Content')) { $pack['MinCodeVersion'] = $CodeVersion.Trim() }
|    if ($pack.Contains('MinCodeVersion') -and -not (Test-SIProPackVersion $pack['MinCodeVersion'])) { throw ("'{0}' is not a code version" -f $pack['MinCodeVersion']) }
|    $scope = [ordered]@{ Full = [bool]$full; Kinds = @($kinds); Methods = @($methodsSel); Items = @($scopeItems) }
|    if ($classes.Count) { $scope['Classes'] = @($classes) }
|    $pack['Scope'] = $scope
|    $pack['Fingerprint'] = $fp; $pack['ItemCount'] = $outItems.Count; $pack['Items'] = $outItems
|    $pack
|}
|
|function Get-SIProPackItemsDigest {
|    <#
|        PURE. What a pack's ITEMS are, as one SHA-256: every item's kind, key, body hash and content hash, ordered ordinally
|        (the pack's version, code version and name left out -- the same templates rebuilt by a later release give the same
|        digest). -Pack: a parsed pack (its Items); -Rows: template rows (Get-SITemplateRows).
|    #>
|    param($Pack, [object[]]$Rows)
|    $src = if ($null -ne $Pack) { @($Pack.Items) } else { @($Rows) }
|    $lines = [string[]]@($src | Where-Object { $_ } | ForEach-Object { '{0}|{1}|{2}|{3}' -f $_.Kind, $_.ItemKey, ([string]$_.BodyHash).ToLowerInvariant(), ([string]$_.ContentHash).ToLowerInvariant() })
|    if ($lines.Count -gt 1) { [Array]::Sort($lines, [StringComparer]::Ordinal) }
|    Get-SIProTextHash ($lines -join "`n")
|}
|
|function Get-SIProProcessCache {
|    <# #416: a cache that lives as long as the PROCESS (also across `& script` calls), by name. Results of pure work only. #>
|    param([Parameter(Mandatory)][string]$Name)
|    $k = 'SecurityInsight.' + $Name
|    $c = [AppDomain]::CurrentDomain.GetData($k)
|    if ($null -eq $c) { $c = [hashtable]::Synchronized(@{}); [AppDomain]::CurrentDomain.SetData($k, $c) }
|    $c
|}
|
|function Get-SIProPackTextFor {
|    <#
|        #416: New-SIProTemplatePack + ConvertTo-SIProTemplatePackText, kept per process for the same input (every row's
|        kind, key, body hash, content hash, order, source, format and version; the pack's own parameters; the
|        classification). The shipped pack of 780 templates took seconds to build and serialise on every publish.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [Parameter(Mandatory)][string]$PackVersion, [Parameter(Mandatory)][string]$CodeVersion,
|          [string[]]$Kind, [string]$Name, $Classification)
|    $sb = New-Object System.Text.StringBuilder
|    [void]$sb.Append($PackVersion).Append('|').Append($CodeVersion).Append('|').Append((@($Kind) -join ',')).Append('|').Append($Name).Append("`n")
|    [void]$sb.Append($(if ($null -eq $Classification) { '' } else { ConvertTo-Json -InputObject $Classification -Depth 12 -Compress })).Append("`n")
|    foreach ($r in @($Rows | Where-Object { $_ })) {
|        [void]$sb.Append($r.Kind).Append('|').Append($r.ItemKey).Append('|').Append($r.BodyHash).Append('|').Append($r.ContentHash).Append('|').Append($r.SortOrder).Append('|').Append($r.Source).Append('|').Append($r.Format).Append('|').Append($r.TemplateVersion).Append("`n")
|    }
|    $key = Get-SIProTextHash $sb.ToString()
|    $memo = Get-SIProProcessCache -Name 'PackText'
|    if ($memo.ContainsKey($key)) { return [string]$memo[$key] }
|    $a = @{ Rows = $Rows; PackVersion = $PackVersion; CodeVersion = $CodeVersion; Name = $Name; Classification = $Classification }
|    if ($Kind) { $a.Kind = $Kind }
|    $text = ConvertTo-SIProTemplatePackText -Pack (New-SIProTemplatePack @a)
|    if ($memo.Count -ge 8) { $memo.Clear() }
|    $memo[$key] = $text
|    $text
|}
|
|function ConvertTo-SIProTemplatePackText {
|    <# PURE. The pack file's text: indented JSON, LF line ends, ending with LF. Write it as UTF-8 WITHOUT a BOM. #>
|    param([Parameter(Mandatory)]$Pack)
|    (ConvertTo-SIProJson -Value $Pack) + "`n"
|}
|
|function ConvertFrom-SIProTemplatePack {
|    <#
|        A pack file's text -> the pack, checked: its SHA-256 (when -ExpectedSha256 is given), the schema, the version, and
|        every item's integrity (the body matches its BodyHash; the content hash is the one this code computes). Returns
|        @{ Pack; Sha256; Rows; Refused } -- Rows in the cfg.Template row shape. Throws on a pack that cannot be trusted
|        as a whole; an item that does not validate here is in Refused (the caller decides -- Publish refuses to apply).
|        -Context: Get-SIProConfigContext (validation); omitted = integrity only.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text, [string]$ExpectedSha256, $Context)
|    $sha = Get-SIProTextHash $Text
|    if ($ExpectedSha256 -and $sha -ne $ExpectedSha256.Trim().ToLowerInvariant()) {
|        throw ("the pack does not match its SHA-256 (expected {0}, the file is {1}) -- it was changed or damaged in transit" -f $ExpectedSha256.Trim().ToLowerInvariant(), $sha)
|    }
|    try { $p = ConvertFrom-SIProJson $Text } catch { throw ('the pack is not valid JSON: ' + $_.Exception.Message) }
|    if (-not $p -or [int]$p.Schema -ne $script:SIProPackSchema) { throw ('not a SecurityInsight template pack (schema {0})' -f $(if ($p) { $p.Schema } else { '?' })) }
|    if (-not (Test-SIProPackVersion ([string]$p.PackVersion))) { throw ("the pack's version '{0}' is not a pack version" -f $p.PackVersion) }
|    $rows = New-Object System.Collections.Generic.List[object]; $refused = New-Object System.Collections.Generic.List[object]
|    $seen = @{}
|    foreach ($it in @($p.Items)) {
|        $kind = [string]$it.Kind; $key = [string]$it.ItemKey; $name = '{0}/{1}' -f $kind, $key
|        if ($script:SIProTemplatedKinds -notcontains $kind) {
|            if (Test-SIProFormerTemplateKind $kind) { throw ("the pack holds '{0}' -- a template pack can never change a name (a setting) or the CMDB ownership map (your configuration); it is refused" -f $name) }
|            throw ("the pack holds '{0}', which is not a templated kind" -f $name)
|        }
|        if ($seen.ContainsKey($name)) { throw ("the pack holds {0} twice" -f $name) }
|        $seen[$name] = $true
|        $body = [string]$it.Body; $fmt = [string]$it.Format
|        if ((Get-SIProTextHash $body) -ne ([string]$it.BodyHash).Trim()) { throw ("{0}: the body does not match its BodyHash -- the pack is damaged" -f $name) }
|        $ch = Get-SIProContentHash -Body $body -Format $fmt
|        if ($ch -ne ([string]$it.ContentHash).Trim()) { throw ("{0}: the content hash in the pack is not what this code computes ({1})" -f $name, $ch) }
|        if ($Context) {
|            $why = @(Test-SIProItem -Kind $kind -Key $key -Body $body -Format $fmt -Context $Context)
|            if ($why.Count) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'pack'; Reason = ($why -join '; ') }); continue }
|        }
|        $rows.Add([pscustomobject]@{ Kind = $kind; ItemKey = $key; TemplateVersion = [string]$it.Version; BodyJson = $body; Format = $fmt
|            SortOrder = [int]$it.SortOrder; BodyHash = ([string]$it.BodyHash).Trim(); ContentHash = $ch; Source = [string]$it.Source
|            Engine = [string]$it.Engine; Method = [string]$it.Method; Class = $(if (Test-SIProTemplateClassName ([string]$it.Class)) { [string]$it.Class } else { '' }) })
|    }
|    if ($p.PSObject.Properties['MinCodeVersion'] -and [string]$p.MinCodeVersion -and -not (Test-SIProPackVersion ([string]$p.MinCodeVersion))) { throw ("the pack's minimum code version '{0}' is not a version" -f $p.MinCodeVersion) }
|    if ([int]$p.ItemCount -ne @($p.Items).Count) { throw ('the pack says {0} item(s) but holds {1}' -f $p.ItemCount, @($p.Items).Count) }
|    [pscustomobject]@{ Pack = $p; Sha256 = $sha; Rows = $rows.ToArray(); Refused = $refused.ToArray() }
|}
|
|function Get-SIProPackScope {
|    <# PURE. The pack's scope as a plain object (Full; Kinds; Methods; Items), tolerant of a missing Scope. #>
|    param($Pack)
|    $s = if ($Pack -and $Pack.PSObject.Properties['Scope']) { $Pack.Scope } elseif ($Pack -is [System.Collections.IDictionary]) { $Pack['Scope'] } else { $null }
|    $get = { param($n) if ($null -eq $s) { $null } elseif ($s -is [System.Collections.IDictionary]) { $s[$n] } elseif ($s.PSObject.Properties[$n]) { $s.$n } else { $null } }
|    [pscustomobject]@{ Full = [bool](& $get 'Full'); Kinds = @(@(& $get 'Kinds') | Where-Object { $_ }); Methods = @(@(& $get 'Methods') | Where-Object { $_ }); Items = @(@(& $get 'Items') | Where-Object { $_ })
|        Classes = @(@(& $get 'Classes') | Where-Object { $_ }) }
|}
|
|function Get-SIProScopeRowClass {
|    <# A row's class -- computed only when the scope limits classes (#405); '' otherwise. #>
|    param($Scope, $Row)
|    if ($Scope -and $Scope.PSObject.Properties['Classes'] -and @($Scope.Classes | Where-Object { $_ }).Count) { return (Get-SIProRowClass -Row $Row) }
|    ''
|}
|
|function Test-SIProInScope {
|    <# PURE. Is an item (kind, name, method id, class) covered by a scope? Only covered items can be retired by a pack. A scope
|       with Classes (#405: a Microsoft content pack, a roll back of one class) covers only items of those classes. #>
|    param($Scope, [string]$Kind, [string]$Name, [string]$MethodId, [string]$Class)
|    if ($Scope.PSObject.Properties['Classes'] -and @($Scope.Classes | Where-Object { $_ }).Count -and @($Scope.Classes) -notcontains $Class) { return $false }
|    if (@($Scope.Kinds).Count -and @($Scope.Kinds) -notcontains $Kind) { return $false }
|    if (@($Scope.Methods).Count -and @($Scope.Methods) -notcontains $MethodId) { return $false }
|    if (@($Scope.Items).Count -and @($Scope.Items) -notcontains $Name) { return $false }
|    $true
|}
|
|# =====================================================================================================================
|#  THE DIFF, PER DETECTION METHOD, AND THE SELECTION FINGERPRINT
|# =====================================================================================================================
|function Get-SIProTemplatePackDiff {
|    <#
|        PURE. What releasing -Rows (a pack's, or a roll-back's) would do to the templates in force (-Existing: cfg.Template
|        rows), within -Scope. One entry per item: Kind, ItemKey, Name, MethodId, Change = added | changed | retired |
|        unchanged, OldHash, NewHash, and the customer's override on it (-Overrides: cfg.ItemOverride rows) -- Affected
|        when the override is 'override' / 'disable' and the item changes. Methods: per method id the counts (Added,
|        Changed, Retired, Unchanged, Affected), ordinal.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [AllowEmptyCollection()][object[]]$Existing = @(), [Parameter(Mandatory)]$Scope,
|          [AllowEmptyCollection()][object[]]$Overrides = @())
|    $have = @{}; foreach ($e in @($Existing | Where-Object { $_ })) { $have[('{0}/{1}' -f (Get-SIProRowValue $e 'Kind'), (Get-SIProRowValue $e 'ItemKey'))] = $e }
|    $ovr = @{}; foreach ($o in @($Overrides | Where-Object { $_ })) { $ovr[('{0}/{1}' -f (Get-SIProRowValue $o 'Kind'), (Get-SIProRowValue $o 'ItemKey'))] = [string](Get-SIProRowValue $o 'State') }
|    $items = New-Object System.Collections.Generic.List[object]
|    $ship = @{}
|    foreach ($r in @($Rows | Where-Object { $_ })) {
|        $name = '{0}/{1}' -f (Get-SIProRowValue $r 'Kind'), (Get-SIProRowValue $r 'ItemKey'); $ship[$name] = $true
|        $e = $have[$name]
|        $live = $e -and ($null -eq (Get-SIProRowValue $e 'RetiredAt'))
|        $new = Get-SIProRowContentHash $r
|        $old = if ($live) { Get-SIProRowContentHash $e } else { '' }
|        $change = if (-not $live) { 'added' } elseif ($old -ne $new) { 'changed' } else { 'unchanged' }
|        $items.Add([pscustomobject]@{ Kind = [string](Get-SIProRowValue $r 'Kind'); ItemKey = [string](Get-SIProRowValue $r 'ItemKey'); Name = $name
|            MethodId = (Get-SIProRowMethodId $r); Change = $change; OldHash = $old; NewHash = $new; Override = [string]$ovr[$name] })
|    }
|    foreach ($name in @($have.Keys)) {
|        if ($ship.ContainsKey($name)) { continue }
|        $e = $have[$name]
|        if ($null -ne (Get-SIProRowValue $e 'RetiredAt')) { continue }
|        $kind = [string](Get-SIProRowValue $e 'Kind'); $mid = Get-SIProRowMethodId $e
|        if (-not (Test-SIProInScope -Scope $Scope -Kind $kind -Name $name -MethodId $mid -Class (Get-SIProScopeRowClass -Scope $Scope -Row $e))) { continue }
|        $items.Add([pscustomobject]@{ Kind = $kind; ItemKey = [string](Get-SIProRowValue $e 'ItemKey'); Name = $name; MethodId = $mid; Change = 'retired'
|            OldHash = (Get-SIProRowContentHash $e); NewHash = ''; Override = [string]$ovr[$name] })
|    }
|    $all = $items.ToArray()
|    $all = @(foreach ($i in (Get-SIProOrdinalOrder -Keys @($all | ForEach-Object { $_.Name }))) { $all[$i] })
|    foreach ($i in $all) { $i | Add-Member -NotePropertyName Affected -NotePropertyValue ($i.Change -ne 'unchanged' -and $i.Override -in 'override', 'disable') }
|    $mids = [string[]]@($all | ForEach-Object { $_.MethodId } | Select-Object -Unique); if ($mids.Count -gt 1) { [Array]::Sort($mids, [System.StringComparer]::Ordinal) }
|    $methods = foreach ($m in $mids) {
|        $g = @($all | Where-Object { $_.MethodId -eq $m })
|        [pscustomobject]@{ Id = $m; Engine = $m.Substring(0, $m.IndexOf('/')); Method = $m.Substring($m.IndexOf('/') + 1)
|            Added = @($g | Where-Object { $_.Change -eq 'added' }).Count; Changed = @($g | Where-Object { $_.Change -eq 'changed' }).Count
|            Retired = @($g | Where-Object { $_.Change -eq 'retired' }).Count; Unchanged = @($g | Where-Object { $_.Change -eq 'unchanged' }).Count
|            Affected = @($g | Where-Object { $_.Affected }).Count }
|    }
|    [pscustomobject]@{ Items = $all; Methods = @($methods) }
|}
|
|function Get-SIProSelectionFingerprint {
|    <#
|        PURE. The fingerprint of WHAT IS ACCEPTED: over the diff items of the selected method ids ('*' or none = all),
|        '<kind>/<key>=<NewHash>' or '<kind>/<key>=retired', ordinal, newline-joined, SHA-256. '' when nothing is selected.
|    #>
|    param([Parameter(Mandatory)]$Diff, [AllowEmptyCollection()][string[]]$Methods = @())
|    $all = (-not $Methods) -or ($Methods -contains '*')
|    $lines = New-Object System.Collections.Generic.List[string]
|    foreach ($i in @($Diff.Items)) {
|        if (-not $all -and $Methods -notcontains $i.MethodId) { continue }
|        $lines.Add(('{0}={1}' -f $i.Name, $(if ($i.Change -eq 'retired') { 'retired' } else { $i.NewHash })))
|    }
|    if ($lines.Count -eq 0) { return '' }
|    $a = $lines.ToArray(); [Array]::Sort($a, [System.StringComparer]::Ordinal)
|    Get-SIProTextHash ($a -join "`n")
|}
|
|function Get-SIProSelectionPlan {
|    <#
|        PURE. Narrow a publish plan (Get-SITemplatePublishPlan over the selected rows) to the selection: a retire is kept
|        only for an item of a selected method that the scope covers. (The plan retires by kind; a pack retires by method.)
|    #>
|    param([AllowEmptyCollection()][object[]]$Plan = @(), [AllowEmptyCollection()][object[]]$Existing = @(), [Parameter(Mandatory)]$Scope,
|          [AllowEmptyCollection()][string[]]$Methods = @())
|    $all = (-not $Methods) -or ($Methods -contains '*')
|    $have = @{}; foreach ($e in @($Existing | Where-Object { $_ })) { $have[('{0}/{1}' -f (Get-SIProRowValue $e 'Kind'), (Get-SIProRowValue $e 'ItemKey'))] = $e }
|    @(foreach ($p in @($Plan | Where-Object { $_ })) {
|        if ($p.Action -ne 'retire') { $p; continue }
|        $name = '{0}/{1}' -f $p.Kind, $p.ItemKey
|        $mid = Get-SIProRowMethodId $have[$name]
|        if (-not (Test-SIProInScope -Scope $Scope -Kind $p.Kind -Name $name -MethodId $mid -Class (Get-SIProScopeRowClass -Scope $Scope -Row $have[$name]))) { continue }
|        if (-not $all -and $Methods -notcontains $mid) { continue }
|        $p
|    })
|}
|
|# =====================================================================================================================
|#  ROLL BACK -- a previous version's items, from cfg.TemplateRevision
|# =====================================================================================================================
|function Get-SIProRollbackRows {
|    <#
|        PURE. The template rows as they were at pack / release -Version, for the items of -Methods: per item that exists
|        (or existed) in cfg.Template (-Templates), the newest revision (-Revisions) whose Version is not newer than -Version.
|        An item with no such revision did not exist yet -- it is absent here, so the publish retires it. Source and
|        SortOrder are today's (the revision keeps the content, not where it came from).
|        Limitation: an item retired BEFORE -Version whose older revision is not newer than -Version comes back (revisions
|        do not record when an item was retired).
|    #>
|    param([AllowEmptyCollection()][object[]]$Templates = @(), [AllowEmptyCollection()][object[]]$Revisions = @(), [Parameter(Mandatory)][string]$Version,
|          [AllowEmptyCollection()][string[]]$Methods = @(),
|          # #405: only items of these classes (the one-click roll back of Microsoft content: -Class microsoft)
|          [AllowEmptyCollection()][string[]]$Class = @(), $Classification)
|    $all = (-not $Methods) -or ($Methods -contains '*')
|    $Class = @($Class | Where-Object { $_ })
|    if ($Class.Count) { $Templates = @($Templates | Where-Object { $_ -and $Class -contains (Get-SIProRowClass -Row $_ -Classification $Classification) }) }
|    $revs = @{}
|    foreach ($r in @($Revisions | Where-Object { $_ })) {
|        $v = [string](Get-SIProRowValue $r 'TemplateVersion'); if (-not $v) { $v = [string](Get-SIProRowValue $r 'Version') }
|        if ((Compare-SIProPackVersion $v $Version) -gt 0) { continue }
|        $name = '{0}/{1}' -f (Get-SIProRowValue $r 'Kind'), (Get-SIProRowValue $r 'ItemKey')
|        $cur = $revs[$name]
|        if (-not $cur -or (Compare-SIProPackVersion $v $cur.V) -gt 0) { $revs[$name] = @{ V = $v; R = $r } }
|    }
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($t in @($Templates | Where-Object { $_ })) {
|        $kind = [string](Get-SIProRowValue $t 'Kind'); $key = [string](Get-SIProRowValue $t 'ItemKey'); $name = '{0}/{1}' -f $kind, $key
|        if (Test-SIProFormerTemplateKind $kind) { continue }   # #251: never brought back as a template
|        $mid = Get-SIProRowMethodId $t
|        if (-not $all -and $Methods -notcontains $mid) { continue }
|        $hit = $revs[$name]; if (-not $hit) { continue }
|        $body = [string](Get-SIProRowValue $hit.R 'BodyJson'); $fmt = [string](Get-SIProRowValue $hit.R 'Format'); if (-not $fmt) { $fmt = 'json' }
|        $m = Get-SIProTemplateMethod -Kind $kind -ItemKey $key -Source ([string](Get-SIProRowValue $t 'Source')) -BodyJson ([string](Get-SIProRowValue $t 'BodyJson'))
|        $out.Add([pscustomobject]@{ Kind = $kind; ItemKey = $key; TemplateVersion = $hit.V; BodyJson = $body; Format = $fmt
|            SortOrder = [int](Get-SIProRowValue $t 'SortOrder'); BodyHash = (Get-SIProTextHash $body); ContentHash = (Get-SIProContentHash -Body $body -Format $fmt)
|            Source = [string](Get-SIProRowValue $t 'Source'); Engine = $m.Engine; Method = $m.Method })
|    }
|    $out.ToArray()
|}
|
|# =====================================================================================================================
|#  THE VENDOR'S RING CHANNEL FOR TEMPLATES (si-templates-rings.json in the update feed)
|# =====================================================================================================================
|function Get-SIProRingKey {
|    <# PURE. r0 | r1 | r2 | r3 from 'r1', '1' or 1 -- the framework's rings: 0 dev, 1 test (internal), 2 design partners, 3 broad. Rings above 3 read r3 (the broadest approval). '' for none. #>
|    param([AllowNull()][object]$Ring)
|    if ($null -eq $Ring -or "$Ring".Trim() -eq '') { return '' }
|    $t = "$Ring".Trim().ToLowerInvariant().TrimStart('r')
|    $n = 0
|    if (-not [int]::TryParse($t, [ref]$n) -or $n -lt 0) { throw "'$Ring' is not a ring (r0, r1, r2 or r3)" }
|    'r{0}' -f [Math]::Min($n, 3)
|}
|
|function Set-SIProTemplateRingApproval {
|    <#
|        PURE. The templates ring document with -Ring approving -PackVersion (sha -Sha256). Every other ring entry and the
|        history are kept; an entry is appended to History. Promotion order: approving r1 needs the version approved at r0
|        before (now or in the history), r2 needs r1, r3 needs r2 -- unless -SkipRingOrder. Returns the new document (ordered).
|    #>
|    param($Document, [Parameter(Mandatory)][string]$Ring, [Parameter(Mandatory)][string]$PackVersion, [Parameter(Mandatory)][string]$Sha256,
|          [Parameter(Mandatory)][string]$By, [datetime]$At = [datetime]::UtcNow, [switch]$SkipRingOrder)
|    $rk = Get-SIProRingKey $Ring
|    if ($rk -notin 'r0', 'r1', 'r2', 'r3') { throw "'$Ring' is not a ring (r0, r1, r2 or r3)" }
|    $doc = [ordered]@{ Schema = 1; Solution = 'SecurityInsight'; Templates = [ordered]@{}; History = @() }
|    if ($Document) {
|        $src = if ($Document -is [string]) { ConvertFrom-SIProJson $Document } else { $Document }
|        $t = $src.Templates
|        if ($t) { foreach ($p in $t.PSObject.Properties) { $doc.Templates[$p.Name] = $p.Value } }
|        $doc.History = @($src.History | Where-Object { $_ })
|    }
|    if (-not $SkipRingOrder -and $rk -ne 'r0') {
|        $prev = 'r{0}' -f ([int]$rk.Substring(1) - 1)
|        $ok = ($doc.Templates.Contains($prev) -and [string]$doc.Templates[$prev].Version -eq $PackVersion) -or
|              @($doc.History | Where-Object { [string]$_.Ring -eq $prev -and [string]$_.Version -eq $PackVersion }).Count -gt 0
|        if (-not $ok) { throw ("{0} cannot approve {1}: it was never approved at {2} (promote in order r0 -> r1 -> r2 -> r3, or pass -SkipRingOrder)" -f $rk, $PackVersion, $prev) }
|    }
|    $when = $At.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture)
|    $doc.Templates[$rk] = [ordered]@{ Version = $PackVersion; Sha256 = $Sha256.ToLowerInvariant(); ApprovedAt = $when; ApprovedBy = $By }
|    $ordered = [ordered]@{}; foreach ($k in @('r0', 'r1', 'r2', 'r3')) { if ($doc.Templates.Contains($k)) { $ordered[$k] = $doc.Templates[$k] } }
|    $doc.Templates = $ordered
|    $hist = @($doc.History) + @([ordered]@{ Ring = $rk; Version = $PackVersion; Sha256 = $Sha256.ToLowerInvariant(); At = $when; By = $By })
|    if ($hist.Count -gt 200) { $hist = @($hist | Select-Object -Last 200) }
|    $doc.History = $hist
|    $doc
|}
|
|function Get-SIProTemplateRingDecision {
|    <#
|        PURE. For an install: which pack its ring approves, and whether to act. -RingsDocument: the feed's
|        si-templates-rings.json (text or object; $null = the feed has no template channel), -Ring: the install's ring
|        from the ring plan ($null = not ring-managed), -Installed: the pack version recorded on the install.
|        Returns @{ Act; RingKey; Version; Sha256; Reason }.
|    #>
|    param($RingsDocument, [AllowNull()][object]$Ring, [AllowEmptyString()][string]$Installed)
|    if ($null -eq $RingsDocument -or "$RingsDocument" -eq '') { return [pscustomobject]@{ Act = $false; RingKey = ''; Version = ''; Sha256 = ''; Reason = 'the update feed has no template channel' } }
|    $doc = if ($RingsDocument -is [string]) { ConvertFrom-SIProJson $RingsDocument } else { $RingsDocument }
|    $rk = Get-SIProRingKey $Ring
|    if (-not $rk) { return [pscustomobject]@{ Act = $false; RingKey = ''; Version = ''; Sha256 = ''; Reason = 'this install is not on an update ring -- it takes only ring-approved template packs' } }
|    $e = if ($doc.Templates -and $doc.Templates.PSObject.Properties[$rk]) { $doc.Templates.$rk } else { $null }
|    if (-not $e -or -not (Test-SIProPackVersion ([string]$e.Version))) { return [pscustomobject]@{ Act = $false; RingKey = $rk; Version = ''; Sha256 = ''; Reason = "ring $rk approves no template pack" } }
|    $v = [string]$e.Version; $sha = ([string]$e.Sha256).ToLowerInvariant()
|    if ($sha -notmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Act = $false; RingKey = $rk; Version = $v; Sha256 = ''; Reason = "ring $rk names template pack $v without a usable SHA-256 -- ignored" } }
|    if ($Installed -and (Compare-SIProPackVersion $v $Installed) -le 0) { return [pscustomobject]@{ Act = $false; RingKey = $rk; Version = $v; Sha256 = $sha; Reason = "template pack $Installed is installed; ring $rk approves $v -- nothing newer" } }
|    [pscustomobject]@{ Act = $true; RingKey = $rk; Version = $v; Sha256 = $sha; Reason = ("ring {0} approves template pack {1}{2}" -f $rk, $v, $(if ($Installed) { " (installed: $Installed)" } else { '' })) }
|}
|
|function Get-SIProTemplateReleaseList {
|    <#
|        PURE. THE VENDOR CONSOLE CONTRACT (setup\Get-SITemplateReleases.ps1 prints it as JSON). -Packs: parsed packs
|        (ConvertFrom-SIProTemplatePack results, plus .ShaFile = the sha in the .sha256 file, '' when missing),
|        -RingsDocument: the feed's si-templates-rings.json. Per pack, newest first: version, code version, commit, sha
|        (verified against the .sha256 file), full or partial, item count, the previous pack and what changed against it --
|        in total and PER DETECTION METHOD (new / changed / retired rules) -- the rings that approve it now and every ring
|        that ever approved it.
|    #>
|    param([AllowEmptyCollection()][object[]]$Packs = @(), $RingsDocument, [string]$Container = '')
|    $doc = if ($RingsDocument -is [string] -and $RingsDocument) { ConvertFrom-SIProJson $RingsDocument } else { $RingsDocument }
|    # oldest first by numeric version (an insertion sort: a handful of packs, and no culture involved)
|    $list = New-Object System.Collections.Generic.List[object]; foreach ($p in $Packs) { if ($p) { $list.Add($p) } }
|    $arr = $list.ToArray()
|    for ($i = 1; $i -lt $arr.Count; $i++) { $j = $i; while ($j -gt 0 -and (Compare-SIProPackVersion ([string]$arr[$j - 1].Pack.PackVersion) ([string]$arr[$j].Pack.PackVersion)) -gt 0) { $t = $arr[$j - 1]; $arr[$j - 1] = $arr[$j]; $arr[$j] = $t; $j-- } }
|    $rings = [ordered]@{}
|    if ($doc -and $doc.Templates) { foreach ($p in $doc.Templates.PSObject.Properties) { $rings[$p.Name] = [ordered]@{ Version = [string]$p.Value.Version; Sha256 = [string]$p.Value.Sha256; ApprovedAt = [string]$p.Value.ApprovedAt; ApprovedBy = [string]$p.Value.ApprovedBy } } }
|    $hist = if ($doc) { @($doc.History | Where-Object { $_ }) } else { @() }
|    $out = for ($i = $arr.Count - 1; $i -ge 0; $i--) {
|        $p = $arr[$i]; $v = [string]$p.Pack.PackVersion
|        $prev = if ($i -gt 0) { $arr[$i - 1] } else { $null }
|        $scope = Get-SIProPackScope $p.Pack
|        $diff = Get-SIProTemplatePackDiff -Rows @($p.Rows) -Existing $(if ($prev) { @($prev.Rows) } else { @() }) -Scope $scope
|        $changedMethods = @($diff.Methods | Where-Object { $_.Added + $_.Changed + $_.Retired -gt 0 } | ForEach-Object {
|            [ordered]@{ Id = $_.Id; Engine = $_.Engine; Method = $_.Method; New = $_.Added; Changed = $_.Changed; Retired = $_.Retired } })
|        $now = [string[]]@($rings.Keys | Where-Object { $rings[$_].Version -eq $v })
|        $ever = [string[]]@(@($now) + @($hist | Where-Object { [string]$_.Version -eq $v } | ForEach-Object { [string]$_.Ring }) | Where-Object { $_ } | Select-Object -Unique | Sort-Object)
|        [ordered]@{
|            PackVersion = $v; CodeVersion = [string]$p.Pack.CodeVersion; Commit = [string]$p.Pack.Commit; Sha256 = $p.Sha256
|            ShaVerified = ([string]$p.ShaFile -eq $p.Sha256); Full = [bool]$scope.Full; Kinds = @($scope.Kinds); Methods = @($scope.Methods)
|            Items = [int]$p.Pack.ItemCount; Fingerprint = [string]$p.Pack.Fingerprint; Previous = $(if ($prev) { [string]$prev.Pack.PackVersion } else { '' })
|            Changes = [ordered]@{ New = @($diff.Items | Where-Object { $_.Change -eq 'added' }).Count; Changed = @($diff.Items | Where-Object { $_.Change -eq 'changed' }).Count
|                Retired = @($diff.Items | Where-Object { $_.Change -eq 'retired' }).Count; Unchanged = @($diff.Items | Where-Object { $_.Change -eq 'unchanged' }).Count }
|            ChangedMethods = $changedMethods; ApprovedNow = @($now); ApprovedEver = @($ever)
|        }
|    }
|    [ordered]@{ Schema = 1; Container = $Container; Rings = $rings; Packs = @($out) }
|}
|
|# =====================================================================================================================
|#  STORE: the staged packs, the installed pack, the release record (guarded -- a database without the table says so)
|# =====================================================================================================================
|function Test-SIProTemplatePackSchema {
|    <# Does the database have cfg.TemplatePackStaged? #>
|    param([Parameter(Mandatory)]$Store)
|    $r = @(& $Store.Invoke "SELECT CASE WHEN OBJECT_ID('cfg.TemplatePackStaged') IS NULL THEN 0 ELSE 1 END AS HasPackStaged" @{} 'reader' | ForEach-Object { $_ }) | Select-Object -First 1
|    [bool]($r -and [int](Get-SIProRowValue $r 'HasPackStaged') -eq 1)
|}
|
|function Save-SIProTemplatePackStaged {
|    <#
|        Stage an available pack: the pack text exactly as received (its SHA-256 is checked again here), with its version,
|        fingerprint and scope. A version is staged once -- the same version with a DIFFERENT sha is refused (a pack is
|        immutable once published); the same version with the same CONTENT fingerprint is 'Same' (the text staged first is
|        kept). Returns 'Staged' | 'Same' | 'Conflict' | 'Missing'.
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Text, [Parameter(Mandatory)][ValidateSet('feed', 'shipped', 'file')][string]$Origin, [string]$Ring,
|          # a pack from Invardia: the SIGNED manifest it came with, kept with the pack (and added to a pack of the same SHA-256
|          # staged before it was kept) -- the install job verifies it again (Test-SIProStagedPackAnchor)
|          [string]$ManifestB64, [string]$Signature, [string]$KeyId)
|    # #416: the same pack text is checked once per process (a full pack is 2.7 MB of JSON with 780 items whose hashes are
|    # all verified -- seconds each time, and one update stages the shipped pack more than once)
|    $memo = Get-SIProProcessCache -Name 'StagedPackSummary'
|    $textSha = Get-SIProTextHash $Text
|    if ($memo.ContainsKey($textSha)) { $sum = $memo[$textSha] }
|    else {
|        $parsed = ConvertFrom-SIProTemplatePack -Text $Text
|        $sum = [pscustomobject]@{ Sha256 = $parsed.Sha256; Pack = [pscustomobject]@{ PackVersion = [string]$parsed.Pack.PackVersion; CodeVersion = [string]$parsed.Pack.CodeVersion
|                                  Fingerprint = [string]$parsed.Pack.Fingerprint; ItemCount = [int]$parsed.Pack.ItemCount }; Scope = (Get-SIProPackScope $parsed.Pack) }
|        if ($memo.Count -ge 16) { $memo.Clear() }
|        $memo[$textSha] = $sum
|    }
|    $parsed = [pscustomobject]@{ Sha256 = $sum.Sha256 }
|    $p = $sum.Pack; $scope = $sum.Scope
|    $sql = @'
|SET XACT_ABORT ON;
|IF OBJECT_ID('cfg.TemplatePackStaged') IS NULL BEGIN SELECT 'Missing' AS Outcome; RETURN; END;
|BEGIN TRAN;
|DECLARE @have char(64), @haveFp nvarchar(64);
|SELECT @have = Sha256, @haveFp = Fingerprint FROM cfg.TemplatePackStaged WITH (UPDLOCK, HOLDLOCK) WHERE PackVersion = @PackVersion;
|IF @have IS NOT NULL AND @have = @Sha256 BEGIN COMMIT; SELECT 'Same' AS Outcome; RETURN; END;
|-- the same version with the same CONTENT (rebuilt by a later release: only the code version / commit differ) is the same
|-- pack -- the text staged first is kept
|IF @have IS NOT NULL AND @haveFp = @Fingerprint BEGIN COMMIT; SELECT 'Same' AS Outcome; RETURN; END;
|IF @have IS NOT NULL BEGIN ROLLBACK; SELECT 'Conflict' AS Outcome; RETURN; END;
|INSERT cfg.TemplatePackStaged (PackVersion, CodeVersion, Sha256, Fingerprint, Ring, Origin, IsFull, ItemCount, ScopeJson, PackJson, StagedBy)
|VALUES (@PackVersion, @CodeVersion, @Sha256, @Fingerprint, @Ring, @Origin, @IsFull, @ItemCount, @ScopeJson, @PackJson, @By);
|INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (@LogName, 'install', 'pack-staged', 'Set', NULL, CONCAT(@PackVersion, ':', @Sha256), @By, CONCAT('template pack staged from the ', @Origin));
|COMMIT;
|SELECT 'Staged' AS Outcome;
|'@
|    $scopeJson = ConvertTo-SIProJson -Value ([ordered]@{ Full = $scope.Full; Kinds = @($scope.Kinds); Methods = @($scope.Methods); Items = @($scope.Items) }) -Canonical
|    $rows = @(& $Store.Invoke $sql ([ordered]@{ PackVersion = [string]$p.PackVersion; CodeVersion = [string]$p.CodeVersion; Sha256 = $parsed.Sha256
|        Fingerprint = [string]$p.Fingerprint; Ring = $(if ($Ring) { $Ring } else { $null }); Origin = $Origin; IsFull = [bool]$scope.Full
|        ItemCount = [int]$p.ItemCount; ScopeJson = $scopeJson; PackJson = $Text; By = (Get-SIProSessionActor); LogName = $script:SIProReleaseLogName }) 'reader' | ForEach-Object { $_ })
|    $outcome = if ($rows.Count) { [string](Get-SIProRowValue $rows[0] 'Outcome') } else { 'Staged' }
|    if ($ManifestB64 -and $outcome -in @('Staged', 'Same')) {
|        # the columns are added in place (an older schema has none): the statement is compiled only when they exist
|        $msql = @'
|IF COL_LENGTH('cfg.TemplatePackStaged', 'ManifestB64') IS NOT NULL
|    EXEC sp_executesql N'UPDATE cfg.TemplatePackStaged SET ManifestB64 = @M, ManifestSignature = @S, ManifestKeyId = @K WHERE PackVersion = @V AND Sha256 = @Sha AND ManifestB64 IS NULL',
|        N'@M nvarchar(max), @S nvarchar(2048), @K nvarchar(128), @V nvarchar(32), @Sha char(64)', @M = @M, @S = @S, @K = @K, @V = @V, @Sha = @Sha;
|'@
|        try { $null = & $Store.Invoke $msql ([ordered]@{ M = $ManifestB64; S = $Signature; K = $KeyId; V = [string]$p.PackVersion; Sha = $parsed.Sha256 }) 'nonquery' }
|        catch { Write-Warning ("the signed manifest of template pack {0} could not be kept with it: {1}" -f $p.PackVersion, $_.Exception.Message) }
|    }
|    $outcome
|}
|
|function Read-SIProTemplatePackStaged {
|    <# The staged packs (no pack text), or one with its text (-PackVersion). Empty without the table. #>
|    param([Parameter(Mandatory)]$Store, [string]$PackVersion)
|    if ($PackVersion) {
|        # every column: with it the signed manifest a pack from Invardia came with (ManifestB64 / ManifestSignature /
|        # ManifestKeyId, added in place -- an older schema has none)
|        return @(& $Store.Invoke "IF OBJECT_ID('cfg.TemplatePackStaged') IS NOT NULL SELECT * FROM cfg.TemplatePackStaged WHERE PackVersion = @PackVersion" @{ PackVersion = $PackVersion } 'reader' | ForEach-Object { $_ })
|    }
|    @(& $Store.Invoke "IF OBJECT_ID('cfg.TemplatePackStaged') IS NOT NULL SELECT PackVersion, CodeVersion, Sha256, Fingerprint, Ring, Origin, IsFull, ItemCount, StagedAt, StagedBy FROM cfg.TemplatePackStaged" @{} 'reader' | ForEach-Object { $_ })
|}
|
|function Read-SIProStagedPackText {
|    <# One staged pack's text, checked against the SHA-256 it was staged with. Throws when absent or changed. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$PackVersion)
|    $r = @(Read-SIProTemplatePackStaged -Store $Store -PackVersion $PackVersion) | Select-Object -First 1
|    if (-not $r) { throw ("template pack {0} is not staged on this install" -f $PackVersion) }
|    $text = [string](Get-SIProRowValue $r 'PackJson'); $sha = ([string](Get-SIProRowValue $r 'Sha256')).Trim().ToLowerInvariant()
|    if ((Get-SIProTextHash $text) -ne $sha) { throw ("the staged template pack {0} does not match the SHA-256 it was staged with -- it was changed in the database" -f $PackVersion) }
|    [pscustomobject]@{ Text = $text; Sha256 = $sha; Origin = [string](Get-SIProRowValue $r 'Origin'); Ring = [string](Get-SIProRowValue $r 'Ring')
|                       ManifestB64 = [string](Get-SIProRowValue $r 'ManifestB64'); Signature = [string](Get-SIProRowValue $r 'ManifestSignature'); KeyId = [string](Get-SIProRowValue $r 'ManifestKeyId') }
|}
|
|function Test-SIProStagedPackAnchor {
|    <#
|        THE STAGED PACK'S HASH IS ANCHORED OUTSIDE ITS ROW (the install job, setup\Publish-SITemplates.ps1 -FromStaged). The row's
|        own SHA-256 proves only that the row agrees with itself.
|          Origin 'feed'     a pack from Invardia: a SIGNED manifest kept with it must verify against the update-signing keys
|                            EMBEDDED in this release (-TrustedKeys; default engine\_shared\SI-InvardiaUpdateKeys.json) and be
|                            the templates manifest of THIS version with THIS SHA-256.
|          Origin 'shipped'  the templates shipped with this release: the staged items must be the items this release ships
|                            (-ShippedDigest, Get-SIProPackItemsDigest of the release's own build) -- else refused.
|          Origin 'file'     staged by an admin with the file (setup) -- said.
|        A staged row never changes once staged (cfg.TR_TemplatePackStaged_Pinned) and the engine's role may not write the
|        table. PURE given -TrustedKeys / -ShippedDigest. Returns @{ Ok; Reason }.
|    #>
|    param([Parameter(Mandatory)]$Staged, [Parameter(Mandatory)][string]$PackVersion, [string]$SIRoot, [object[]]$TrustedKeys,
|          # the items digest of the pack THIS release ships (Get-SIProPackItemsDigest), for a pack staged as 'shipped'
|          [AllowEmptyString()][string]$ShippedDigest = '')
|    $out = { param($ok, $why) [pscustomobject]@{ Ok = [bool]$ok; Reason = $why } }
|    $origin = [string]$Staged.Origin
|    if ($origin -eq 'shipped') {
|        $mine = ''
|        try { if ($Staged.PSObject.Properties['Text'] -and "$($Staged.Text)".Trim()) { $mine = Get-SIProPackItemsDigest -Pack (ConvertFrom-SIProJson ([string]$Staged.Text)) } } catch { $mine = '' }
|        if (-not $ShippedDigest -or -not $mine -or $mine -ne $ShippedDigest) {
|            return (& $out $false ("template pack {0} is not the pack shipped with this release (its items differ from the release's own)" -f $PackVersion))
|        }
|        return (& $out $true ("template pack {0}: the templates shipped with this release" -f $PackVersion))
|    }
|    if ($origin -ne 'feed') { return (& $out $true ("template pack {0} was staged from a file an admin staged" -f $PackVersion)) }
|    if (-not "$($Staged.ManifestB64)".Trim() -or -not "$($Staged.Signature)".Trim()) {
|        return (& $out $true ("template pack {0} was staged by an earlier SecurityInsight release" -f $PackVersion))
|    }
|    if (-not (Get-Command -Name Test-SIInvardiaManifestSignature -ErrorAction SilentlyContinue)) {
|        $root = if ($SIRoot) { $SIRoot } else { $script:SIProRoot }
|        $verifier = [IO.Path]::Combine($root, 'engine', '_shared', 'SI-InvardiaUpdate.ps1')
|        if (-not (Test-Path -LiteralPath $verifier)) { return (& $out $false 'its signed manifest cannot be verified: this release has no update verifier') }
|        . $verifier
|    }
|    if ($null -eq $TrustedKeys) { $TrustedKeys = @((Get-SIInvardiaTrustedKeys).Keys) }
|    $sig = Test-SIInvardiaManifestSignature -ManifestB64 ([string]$Staged.ManifestB64) -Signature ([string]$Staged.Signature) -KeyId ([string]$Staged.KeyId) -TrustedKeys $TrustedKeys
|    if (-not $sig.Ok) { return (& $out $false ("its signed manifest does not verify: {0}" -f $sig.Reason)) }
|    $m = $sig.Manifest
|    $mv = { param($n) if ($m.PSObject.Properties[$n]) { "$($m.$n)".Trim() } else { '' } }
|    if ((& $mv 'kind') -ne 'templates') { return (& $out $false ("its signed manifest is for '{0}', not a template pack" -f (& $mv 'kind'))) }
|    if ((& $mv 'version') -ne $PackVersion) { return (& $out $false ("its signed manifest names version {0}, not {1}" -f (& $mv 'version'), $PackVersion)) }
|    if ((& $mv 'sha256').ToLowerInvariant() -ne ([string]$Staged.Sha256).Trim().ToLowerInvariant()) { return (& $out $false 'the pack is not the one its signed manifest names (the SHA-256 differs)') }
|    & $out $true ("template pack {0}: the signed manifest from Invardia verifies and names this pack" -f $PackVersion)
|}
|
|function Set-SIProTemplateRelease {
|    <#
|        Record a VERIFIED release (called only after the publish was read back): one cfg.ChangeLog row
|        (Name 'template-release', Kind 'released'), and -- for a release of every method of a pack -- the installed pack
|        (cfg.InstallState 'TemplatePack'). One transaction. The actor is the session; -RequestedBy (the web app user who
|        accepted it) is part of the reason.
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$PackVersion,
|          # #405: 'code' = the fix + default templates of a code release (and its Microsoft content, unless a newer pack is
|          # installed); 'auto' = a Microsoft content pack installed automatically; 'direct' = ring 1's direct install
|          [Parameter(Mandatory)][ValidateSet('release', 'rollback', 'shipped', 'adopted', 'code', 'auto', 'direct')][string]$Mode,
|          [AllowEmptyCollection()][string[]]$Methods = @(), [AllowEmptyString()][string]$SelectionFingerprint, [AllowEmptyString()][string]$Fingerprint,
|          [bool]$Whole, [int]$Changed, [string]$RequestedBy,
|          # #250: what the templates in force are against the pack -- 'as-released' (they are the pack) or 'customised' (an
|          # existing install adopted with other templates). Recorded with a whole pack only (cfg.InstallState 'TemplatePackStatus').
|          [ValidateSet('as-released', 'customised')][string]$Status = 'as-released',
|          # #405: the code release the record belongs to (code / direct), and the classes it covered
|          [string]$CodeVersion, [AllowEmptyCollection()][string[]]$Classes = @())
|    $v = [ordered]@{ Mode = $Mode; Pack = $PackVersion; Methods = $(if ($Whole) { @('*') } else { @($Methods) }); Selection = $SelectionFingerprint; Fingerprint = $Fingerprint; Changed = $Changed; Status = $Status }
|    if ($CodeVersion) { $v['Code'] = $CodeVersion }
|    if (@($Classes | Where-Object { $_ }).Count) { $v['Classes'] = @($Classes | Where-Object { $_ }) }
|    $value = ConvertTo-SIProJson -Value $v -Canonical
|    $what = switch ($Mode) {
|        'code'   { 'templates of SecurityInsight {0} installed with the code (fixes and defaults{1})' -f $CodeVersion, $(if ($Whole) { ', Microsoft content ' + $PackVersion } else { '; the newer Microsoft content in force is kept' }) }
|        'auto'   { '{0} {1} installed automatically' -f $(if (@($Classes) -ccontains 'microsoft' -and @($Classes).Count -eq 1) { 'Microsoft content' } else { 'template pack' }), $PackVersion }
|        'direct' { 'the current templates of SecurityInsight {0} installed directly (ring 1)' -f $CodeVersion }
|        default  { '{0} of template pack {1}{2}' -f $Mode, $PackVersion, $(if ($Whole) { ' (every method)' } else { ' (' + @($Methods).Count + ' method(s))' }) }
|    }
|    $reason = '{0}{1}{2}' -f $what, $(if ($Status -eq 'customised') { ', customised: the templates in force differ from it' } else { '' }), $(if ($RequestedBy) { ', accepted by ' + $RequestedBy } else { '' })
|    if ($reason.Length -gt 400) { $reason = $reason.Substring(0, 400) }
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|IF @Whole = 1
|BEGIN
|    DECLARE @old nvarchar(400) = (SELECT Value FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @StateName);
|    IF NOT EXISTS (SELECT 1 FROM cfg.InstallState WHERE Name = @StateName)
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@StateName, @Pack, @Pack, @By);
|    ELSE
|        UPDATE cfg.InstallState SET Value = @Pack, [Version] = @Pack, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @StateName;
|    IF NOT EXISTS (SELECT 1 FROM cfg.InstallState WHERE Name = @StatusName)
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@StatusName, @Status, @Pack, @By);
|    ELSE
|        UPDATE cfg.InstallState SET Value = @Status, [Version] = @Pack, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @StatusName;
|END;
|INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (@LogName, 'install', 'released', 'Set', NULL, @Value, @By, @Reason);
|COMMIT;
|'@
|    & $Store.Invoke $sql ([ordered]@{ StateName = $script:SIProPackStateName; StatusName = $script:SIProPackStatusName; Status = $Status; Pack = $PackVersion
|        By = (Get-SIProSessionActor); Whole = [bool]$Whole; LogName = $script:SIProReleaseLogName; Value = $value; Reason = $reason }) 'nonquery'
|}
|
|function Read-SIProInstalledPack {
|    <# The installed pack version (cfg.InstallState 'TemplatePack'), '' when none. #>
|    param([Parameter(Mandatory)]$Store)
|    $r = Read-SIProInstallState -Store $Store -Name $script:SIProPackStateName
|    if ($r) { return ([string](Get-SIProRowValue $r 'Value')).Trim() }
|    ''
|}
|
|function Read-SIProInstalledPackStatus {
|    <# 'as-released' | 'customised' (cfg.InstallState 'TemplatePackStatus'); '' when none is recorded. #>
|    param([Parameter(Mandatory)]$Store)
|    $r = Read-SIProInstallState -Store $Store -Name $script:SIProPackStatusName
|    if ($r) { return ([string](Get-SIProRowValue $r 'Value')).Trim() }
|    ''
|}
|
|# =====================================================================================================================
|#  #405 -- WHAT IS INSTALLED PER CLASS, AND THE CUSTOMER'S HOLD SWITCH
|# =====================================================================================================================
|function Read-SIProInstallStateValue {
|    <# One cfg.InstallState value by name, '' when none (or no table). #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Name)
|    $r = Read-SIProInstallState -Store $Store -Name $Name
|    if ($r) { return ([string](Get-SIProRowValue $r 'Value')).Trim() }
|    ''
|}
|
|function Set-SIProInstallStateValue {
|    <# Write one cfg.InstallState row (insert or update) -- what is installed per class (#405). The actor is the session. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][ValidateSet('TemplateCode', 'TemplateDirect', 'TemplatePackDeclined', 'TemplateMode')][string]$Name,
|          [Parameter(Mandatory)][AllowEmptyString()][string]$Value, [string]$Version)
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|IF NOT EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @Name)
|    INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@Name, @Value, @Version, @By);
|ELSE
|    UPDATE cfg.InstallState SET Value = @Value, [Version] = @Version, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @Name;
|COMMIT;
|'@
|    & $Store.Invoke $sql ([ordered]@{ Name = $Name; Value = $Value; Version = $(if ($Version) { $Version } else { $null }); By = (Get-SIProSessionActor); Reason = ('template state ' + $Name) }) 'nonquery'
|}
|
|function Read-SIProHoldMicrosoftContent {
|    <#
|        The customer's "Hold template packs" switch (SI_InvardiaUpdate_HoldMicrosoftContent; the name is kept -- it holds every template pack since 2026-10-11, the Pro settings catalog --
|        read from SQL only, cfg.Setting scope 'solution'). OFF unless it is set to true. A database whose setting cannot be
|        read counts as ON for this run: an automatic install is never made on a guess.
|    #>
|    param([Parameter(Mandatory)]$Store)
|    try {
|        $rows = @(& $Store.Invoke "IF OBJECT_ID(N'cfg.Setting') IS NULL SELECT CAST(NULL AS NVARCHAR(128)) AS Name, CAST(NULL AS NVARCHAR(MAX)) AS ValueJson WHERE 1 = 0; ELSE SELECT Name, ValueJson FROM cfg.Setting WHERE Scope = N'solution' AND Name = @Name;" @{ Name = $script:SIProHoldSettingName } 'reader' | ForEach-Object { $_ })
|    } catch { return $true }
|    foreach ($r in $rows) {
|        if ([string](Get-SIProRowValue $r 'Name') -ne $script:SIProHoldSettingName) { continue }
|        $v = ([string](Get-SIProRowValue $r 'ValueJson')).Trim().Trim('"').ToLowerInvariant()
|        return ($v -in @('true', '1', 'on', 'yes'))
|    }
|    $false
|}
'@ }
$__siSupportFiles['config/template-classification.locked.json'] = @{ Sha256 = 'ab6069c277bee8e95f6ea98988e5252a4705fe206fdac013b39f183b2260ec5b'; Text = @'
|{
|  "_doc": "SecurityInsight Pro -- how every shipped template travels to an install (operator decision 2026-10-06, REQUIREMENTS #405). fix = a fix to our own queries / logic the engines or other reports rely on: arrives inside the product release, always installed, never held. default = customer business logic (tier rules, risk index weights, the service model, asset tagging seeds): SecurityInsight ships the default, a customer's edit (cfg.ItemOverride) is never changed by an update. microsoft = content that exists because Microsoft added a data surface (a table, a recommendation type, an attack-path type): arrives as a Microsoft content pack between releases, ring by ring, installed automatically unless the install holds Microsoft content. Resolution, first match wins: Items (exact '<kind>/<key>'), then Rules (in order, an ordinal .NET regex on the ItemKey of that kind), then ByKind, else 'fix' (the safe side: ships with the code, never held). Engine: Get-SIProTemplateClass (engine\\pro-settings\\SI-TemplatePacks.ps1); web app: TemplateClasses (pro-management, the same rule; a test runs both). The decision behind every entry: docs\\template-classification-3.0.0.md.",
|  "Schema": 1,
|  "Classes": [ "fix", "default", "microsoft" ],
|  "ByKind": {
|    "rareport": "fix",
|    "riskindex": "default",
|    "rule": "default",
|    "assettagging": "default",
|    "servicemodel": "default",
|    "datamodel": "fix"
|  },
|  "Rules": [
|    {
|      "Kind": "rareport",
|      "Pattern": "^report/Attack_Paths_",
|      "Class": "microsoft",
|      "Reason": "one report pair per Microsoft attack-path type (Exposure Management attack paths): the report exists because Microsoft added that attack-path type; new attack-path types arrive the same way"
|    }
|  ],
|  "Items": {
|    "rule/shared/AssetProfileByDefaultTier": {
|      "Class": "fix",
|      "Reason": "the default-tier fallback (#390): the profilers and Risk Analysis rely on it being there (a rule set without it falls back to the shipped file); its Tier values are tunable, and a customer's edit is an override that is never changed"
|    }
|  }
|}
'@ }
$__siSupportFiles['sql/si-pro-settings.sql'] = @{ Sha256 = '9787d37e7e6c6487c3c8be042025b1019eeda916af79c38d1b0aa7f5bbce31cb'; Text = @'
|-- si-pro-settings.sql -- the PRO SETTINGS STORE, SecurityInsight Pro (REQUIREMENTS §9.2, Pro-1).
|--
|-- In Pro every setting lives here instead of in the custom .ps1 files; the launcher reads it at run start as the
|-- closest configuration layer (launcher\_lib\Initialize-LauncherConfig.ps1 -> engine\pro-settings\SI-ProSettings.ps1)
|-- and the run FAILS when it cannot (operator decision 2026-10-02). It lives in the one Pro database beside the `vuln`
|-- schema of the vulnerability close-loop.
|--
|-- A secret's VALUE never enters this database: a secret setting stores only the Key Vault secret NAME.
|-- Every change is appended to cfg.ChangeLog in the same transaction as the change itself.
|--
|-- ADDITIVE AND IDEMPOTENT ONLY: every statement is guarded, so re-running is a no-op, and no destructive verb appears
|-- in this file (a test refuses one).
|
|IF SCHEMA_ID('cfg') IS NULL EXEC ('CREATE SCHEMA cfg');
|
|-- ---------------------------------------------------------------------------------------------
|-- One row per (setting, scope). Scope = 'solution' or 'engine:<engine folder>'; an engine row wins for that engine.
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.Setting') IS NULL
|CREATE TABLE cfg.Setting (
|    Name               NVARCHAR(128)   NOT NULL,
|    Scope              NVARCHAR(64)    NOT NULL,
|    ValueJson          NVARCHAR(MAX)   NULL,     -- the value as JSON (true, 25, "text", ["a","b"]); NULL for a secret
|    KeyVaultSecretName NVARCHAR(256)   NULL,     -- a secret setting: the Key Vault secret holding the value
|    UpdatedAt          DATETIME2(0)    NOT NULL CONSTRAINT DF_Setting_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy          NVARCHAR(256)   NOT NULL,
|    RowVersion         ROWVERSION      NOT NULL,
|    CONSTRAINT PK_Setting PRIMARY KEY (Name, Scope),
|    CONSTRAINT CK_Setting_Scope CHECK (Scope = 'solution' OR Scope LIKE 'engine:%'),
|    CONSTRAINT CK_Setting_OneKind CHECK (ValueJson IS NULL OR KeyVaultSecretName IS NULL)
|);
|
|-- ---------------------------------------------------------------------------------------------
|-- Every change, append-only: who set what, when, from what to what, and why. Nothing updates or removes a row here.
|-- (Pro-1b adds a nullable Kind column below, for document changes.)
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.ChangeLog') IS NULL
|CREATE TABLE cfg.ChangeLog (
|    ChangeId    BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_ChangeLog PRIMARY KEY,
|    Name        NVARCHAR(128)   NOT NULL,
|    Scope       NVARCHAR(64)    NOT NULL,
|    Action      NVARCHAR(16)    NOT NULL,    -- Set | Reset
|    OldValue    NVARCHAR(MAX)   NULL,        -- ValueJson, or 'keyvault:<name>' for a secret reference
|    NewValue    NVARCHAR(MAX)   NULL,
|    ChangedAt   DATETIME2(0)    NOT NULL CONSTRAINT DF_ChangeLog_ChangedAt DEFAULT SYSUTCDATETIME(),
|    ChangedBy   NVARCHAR(256)   NOT NULL,
|    Reason      NVARCHAR(400)   NULL,
|    CONSTRAINT CK_ChangeLog_Action CHECK (Action IN ('Set', 'Reset'))
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ChangeLog_Name' AND object_id = OBJECT_ID('cfg.ChangeLog'))
|CREATE INDEX IX_ChangeLog_Name ON cfg.ChangeLog (Name, Scope, ChangedAt);
|
|-- ---------------------------------------------------------------------------------------------
|-- Pro-1b: structured settings as documents (REQUIREMENTS §9.2 B). One row per (Kind, Key):
|--   exclusions  Key = 'global' or a Risk Analysis report name   Body = the exclusion JSON
|--   weights     Key = 'solution'                                Body = the risk-weights JSON
|--   rule        Key = '<engine>/<rule id>'                      Body = the tier rule YAML
|-- Validated by the Community Settings page's own rules, by the writer AND again at run start.
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.Document') IS NULL
|CREATE TABLE cfg.Document (
|    Kind        NVARCHAR(16)    NOT NULL,
|    [Key]       NVARCHAR(128)   NOT NULL,
|    Body        NVARCHAR(MAX)   NOT NULL,
|    UpdatedAt   DATETIME2(0)    NOT NULL CONSTRAINT DF_Document_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy   NVARCHAR(256)   NOT NULL,
|    [Version]   ROWVERSION      NOT NULL,
|    CONSTRAINT PK_Document PRIMARY KEY (Kind, [Key]),
|    CONSTRAINT CK_Document_Kind CHECK (Kind IN ('exclusions', 'weights', 'rule'))
|);
|
|-- A document change is logged in cfg.ChangeLog like a setting change: Name = the document key, Scope = 'document',
|-- and Kind (added here, nullable -- every earlier row is a setting and keeps NULL).
|IF COL_LENGTH('cfg.ChangeLog', 'Kind') IS NULL
|ALTER TABLE cfg.ChangeLog ADD Kind NVARCHAR(16) NULL;
|
|-- ---------------------------------------------------------------------------------------------
|-- THE WEB APP'S ROLE MAPPING (#253, Configuration > Access (roles + scopes), SuperAdmin only): an Entra user or group (by object id) -> Reader,
|-- Delegated, Admin or SuperAdmin, on top of the Entra app role that gates sign-in (the higher of the two applies).
|-- ScopeJson = a Delegated assignment's scope as (scope type, value) pairs:
|--   {"entries":[{"type":"domain","value":"Identity"},{"type":"tier","value":"2"}]}
|-- Roles and scope types are validated by the web app, NOT by a CHECK, so a new role (the external advisors, #258) or
|-- scope type (a department, #254) needs no schema change -- widening a CHECK would mean dropping it.
|-- One row per identity. Every write is logged in cfg.ChangeLog (Name 'access/<object id>', Scope 'access', Kind 'access').
|-- No rows = everyone has exactly their Entra app role.
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.AccessAssignment') IS NULL
|CREATE TABLE cfg.AccessAssignment (
|    PrincipalId     NVARCHAR(64)    NOT NULL CONSTRAINT PK_AccessAssignment PRIMARY KEY,
|    PrincipalType   NVARCHAR(8)     NOT NULL,
|    DisplayName     NVARCHAR(256)   NOT NULL,
|    Role            NVARCHAR(16)    NOT NULL,
|    ScopeJson       NVARCHAR(MAX)   NULL,
|    UpdatedAt       DATETIME2(0)    NOT NULL CONSTRAINT DF_AccessAssignment_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy       NVARCHAR(256)   NOT NULL,
|    RowVersion      ROWVERSION      NOT NULL,
|    CONSTRAINT CK_AccessAssignment_Type CHECK (PrincipalType IN ('User', 'Group')),
|    CONSTRAINT CK_AccessAssignment_Scope CHECK (ScopeJson IS NULL OR ISJSON(ScopeJson) = 1)
|);
|
|-- #765 (owner 2026-10-19: "SI decides" + "mail forward on accounts like in pim"): a person's own mail address as Entra
|-- gives it (their mail, else their sign-in name -- what a recipient list names them by), and the address SecurityInsight
|-- mail to them goes to instead (NULL = their own). The web app validates the forward before it is written; the one mail
|-- transport (engine\_shared\SI-MailTransport.ps1, Send-SIMail) reads both. Additive: nullable, no default.
|IF COL_LENGTH('cfg.AccessAssignment', 'AccountMail') IS NULL
|ALTER TABLE cfg.AccessAssignment ADD AccountMail NVARCHAR(320) NULL;
|
|IF COL_LENGTH('cfg.AccessAssignment', 'ForwardTo') IS NULL
|ALTER TABLE cfg.AccessAssignment ADD ForwardTo NVARCHAR(320) NULL;
|
|-- #765: the Entra app roles carried over into cfg.AccessAssignment (SI decides the role; an Entra app role is only a
|-- migration source). One row per (identity, app role), written the moment it was carried over: from then on that app role
|-- adds nothing on its own -- removing the person on the Access page removes their access. An app role an administrator
|-- gives LATER (another one) is carried over once more. Written by the web app only; product code never deletes a row.
|IF OBJECT_ID('cfg.AccessCarriedOver') IS NULL
|CREATE TABLE cfg.AccessCarriedOver (
|    PrincipalId     NVARCHAR(64)    NOT NULL,
|    Role            NVARCHAR(16)    NOT NULL,
|    CarriedAt       DATETIME2(0)    NOT NULL CONSTRAINT DF_AccessCarriedOver_CarriedAt DEFAULT SYSUTCDATETIME(),
|    CONSTRAINT PK_AccessCarriedOver PRIMARY KEY (PrincipalId, Role)
|);
|
|-- =============================================================================================
|-- Phase C (REQUIREMENTS §9.3.3 C): ALL CONFIGURATION IN SQL, WITH VENDOR TEMPLATES.
|-- In Pro the shipped *.locked files are replaced by TEMPLATES: the vendor's baseline, one row per ITEM, published by
|-- setup\Publish-SITemplates.ps1 (Version = the release's VERSION). A customer's own state per item lives in
|-- cfg.ItemOverride: no row (or State 'inherit') = the template as published; 'override' = the customer's body; 'disable'
|-- = the item is left out of the run. A new release republishes the templates and never touches cfg.ItemOverride, so
|-- every override survives the version bump; BaseHash records which template body an override was made against.
|--
|-- Kinds (validated by engine\pro-settings\SI-ProConfig.ps1, NOT by a CHECK constraint -- see below):
|--   rareport      report/<ReportName> | template/<ReportName>   one Risk Analysis report or report template (JSON)
|--   riskindex     row/<dimensions>                              one risk index row (JSON)
|--   rule          <engine>/<rule id>                            one tier rule (YAML text, Format 'yaml')
|--   assettagging  tag/<STEM--SI> | config                       one asset-tagging rule | asset-tagging.config.json
|--   cmdbownership defaults | assettype/<siAssetType>            the CMDB ownership map
|--   servicemodel  model                                         the service model (replaced wholesale)
|--   schemaoverlay endpoint | identity | azure | publicip         a profile-schema overlay (customer only)
|--   decision      asset | correlation                           an asset / correlation decisions file (YAML, customer only)
|--   naming        <setting name>                                a table / DCR naming convention (the default the code had)
|--   weights       model | report/<ReportName>                   risk-model sections beside the factors | per-report weights
|-- 🔑 Why a NEW table for the customer state instead of widening cfg.Document: cfg.Document's Kind carries
|-- CHECK (Kind IN ('exclusions','weights','rule')), and widening a CHECK means dropping it -- a destructive verb this file
|-- may never contain. For the same reason the new tables carry NO kind CHECK: the kind list will grow, and the code that
|-- reads the rows refuses an unknown kind at run start (fail closed). cfg.Document keeps its three kinds unchanged and
|-- stays the home of the customer's own exclusions, weights and tier rules.
|-- 🔑 Why BodyJson + Format: a tier rule and a decisions file are YAML whose comments matter to the people who wrote
|-- them; Format says how to read BodyJson ('json' or 'yaml').
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.Template') IS NULL
|CREATE TABLE cfg.Template (
|    TemplateId   BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_Template PRIMARY KEY,
|    Kind         NVARCHAR(32)    NOT NULL,
|    ItemKey      NVARCHAR(128)   NOT NULL,
|    [Version]    NVARCHAR(32)    NOT NULL,   -- the SecurityInsight release that published this body
|    BodyJson     NVARCHAR(MAX)   NOT NULL,
|    Format       NVARCHAR(8)     NOT NULL CONSTRAINT DF_Template_Format DEFAULT 'json',
|    SortOrder    INT             NOT NULL CONSTRAINT DF_Template_SortOrder DEFAULT 0,
|    BodyHash     CHAR(64)        NOT NULL,   -- SHA-256 of BodyJson (UTF-8), checked at run start
|    PublishedAt  DATETIME2(0)    NOT NULL CONSTRAINT DF_Template_PublishedAt DEFAULT SYSUTCDATETIME(),
|    Source       NVARCHAR(400)   NOT NULL,   -- the shipped file it came from (relative path)
|    RetiredAt    DATETIME2(0)    NULL,       -- set when a newer release no longer ships the item (never removed)
|    RowVersion   ROWVERSION      NOT NULL,
|    CONSTRAINT UQ_Template_Item UNIQUE (Kind, ItemKey),
|    CONSTRAINT CK_Template_Format CHECK (Format IN ('json', 'yaml'))
|);
|
|IF OBJECT_ID('cfg.ItemOverride') IS NULL
|CREATE TABLE cfg.ItemOverride (
|    Kind         NVARCHAR(32)    NOT NULL,
|    ItemKey      NVARCHAR(128)   NOT NULL,
|    State        NVARCHAR(16)    NOT NULL,   -- inherit | override | disable
|    BodyJson     NVARCHAR(MAX)   NULL,       -- the customer's body (override only)
|    Format       NVARCHAR(8)     NOT NULL CONSTRAINT DF_ItemOverride_Format DEFAULT 'json',
|    BaseVersion  NVARCHAR(32)    NULL,       -- the template version the override was made against (NULL = own item)
|    BaseHash     CHAR(64)        NULL,       -- that template's BodyHash -> "the template changed since you overrode it"
|    UpdatedAt    DATETIME2(0)    NOT NULL CONSTRAINT DF_ItemOverride_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy    NVARCHAR(256)   NOT NULL,
|    RowVersion   ROWVERSION      NOT NULL,
|    CONSTRAINT PK_ItemOverride PRIMARY KEY (Kind, ItemKey),
|    CONSTRAINT CK_ItemOverride_State CHECK (State IN ('inherit', 'override', 'disable')),
|    CONSTRAINT CK_ItemOverride_Body CHECK (State <> 'override' OR BodyJson IS NOT NULL),
|    CONSTRAINT CK_ItemOverride_Format CHECK (Format IN ('json', 'yaml'))
|);
|
|-- ---------------------------------------------------------------------------------------------
|-- "Exempt this finding" (the management GUI): one row per exemption, never removed -- revoking sets RevokedAt.
|-- An expired or revoked row is not applied. Scope (the GUI's words):
|--   finding  one issue on one asset     AssetKey + (Cve or ConfigurationId)
|--   issue    one issue on every asset   Cve or ConfigurationId, no AssetKey
|--   asset    every issue of one asset   AssetKey, no Cve / ConfigurationId
|-- ReportName narrows any of them to one Risk Analysis report (NULL = every report).
|-- Every write is logged in cfg.ChangeLog (Name 'exemption/<id>', Scope 'exemption', Kind 'exemption').
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.Exemption') IS NULL
|CREATE TABLE cfg.Exemption (
|    ExemptionId     BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_Exemption PRIMARY KEY,
|    Scope           NVARCHAR(16)    NOT NULL,   -- finding | issue | asset
|    ReportName      NVARCHAR(128)   NULL,
|    ConfigurationId NVARCHAR(128)   NULL,
|    Cve             NVARCHAR(32)    NULL,
|    AssetKey        NVARCHAR(256)   NULL,       -- SI_CorrelationId, or SI_AssetId when the asset has no ledger id
|    Reason          NVARCHAR(400)   NOT NULL,
|    ExpiresAt       DATETIME2(0)    NULL,
|    CreatedBy       NVARCHAR(256)   NOT NULL,
|    CreatedAt       DATETIME2(0)    NOT NULL CONSTRAINT DF_Exemption_CreatedAt DEFAULT SYSUTCDATETIME(),
|    RevokedAt       DATETIME2(0)    NULL,
|    RevokedBy       NVARCHAR(256)   NULL,
|    CONSTRAINT CK_Exemption_Scope CHECK (Scope IN ('finding', 'issue', 'asset')),
|    CONSTRAINT CK_Exemption_What CHECK (
|        (Scope = 'finding' AND AssetKey IS NOT NULL AND (Cve IS NOT NULL OR ConfigurationId IS NOT NULL)) OR
|        (Scope = 'issue'   AND AssetKey IS NULL     AND (Cve IS NOT NULL OR ConfigurationId IS NOT NULL)) OR
|        (Scope = 'asset'   AND AssetKey IS NOT NULL AND Cve IS NULL AND ConfigurationId IS NULL))
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_Exemption_Active' AND object_id = OBJECT_ID('cfg.Exemption'))
|CREATE INDEX IX_Exemption_Active ON cfg.Exemption (RevokedAt, ExpiresAt);
|
|-- =============================================================================================
|-- TEMPLATE VERSIONING (phase C, adopted from PIM4EntraPS -- engine\pro-settings\SI-TemplateVersioning.ps1).
|-- ContentHash = SHA-256 of what the item DOES: the body parsed, comments, key order, `_*` keys and description-only
|-- fields left out. A documentation edit leaves it unchanged; BodyHash stays the raw-body integrity check. An override's
|-- BaseHash records the ContentHash it was made against: when the template's ContentHash moves, the item reads
|-- "upgrade available" and is never merged automatically. NULL on rows published before this column; the next publish
|-- fills it (Publish-SITemplates refreshes every row without one).
|-- ---------------------------------------------------------------------------------------------
|IF COL_LENGTH('cfg.Template', 'ContentHash') IS NULL
|ALTER TABLE cfg.Template ADD ContentHash CHAR(64) NULL;
|
|-- Every content a template ever had, once (append-only): what "what changed since you overrode it" is diffed against.
|IF OBJECT_ID('cfg.TemplateRevision') IS NULL
|CREATE TABLE cfg.TemplateRevision (
|    Kind         NVARCHAR(32)    NOT NULL,
|    ItemKey      NVARCHAR(128)   NOT NULL,
|    ContentHash  CHAR(64)        NOT NULL,
|    [Version]    NVARCHAR(32)    NOT NULL,   -- the release that first published this content
|    BodyJson     NVARCHAR(MAX)   NOT NULL,
|    Format       NVARCHAR(8)     NOT NULL CONSTRAINT DF_TemplateRevision_Format DEFAULT 'json',
|    PublishedAt  DATETIME2(0)    NOT NULL CONSTRAINT DF_TemplateRevision_PublishedAt DEFAULT SYSUTCDATETIME(),
|    CONSTRAINT PK_TemplateRevision PRIMARY KEY (Kind, ItemKey, ContentHash),
|    CONSTRAINT CK_TemplateRevision_Format CHECK (Format IN ('json', 'yaml'))
|);
|
|-- State recorded ON THE INSTALL, one row per name. 'TemplateFingerprint' = the template-set fingerprint last published
|-- AND verified (read back) on this install: publishing a set whose fingerprint differs needs -AcceptTemplateChange.
|-- Every write has its cfg.ChangeLog row (Scope 'install').
|IF OBJECT_ID('cfg.InstallState') IS NULL
|CREATE TABLE cfg.InstallState (
|    Name        NVARCHAR(64)    NOT NULL CONSTRAINT PK_InstallState PRIMARY KEY,
|    Value       NVARCHAR(400)   NOT NULL,
|    [Version]   NVARCHAR(32)    NULL,       -- the release the value belongs to
|    UpdatedAt   DATETIME2(0)    NOT NULL CONSTRAINT DF_InstallState_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy   NVARCHAR(256)   NOT NULL
|);
|
|-- INDEXES THAT DID NOT FIT AN UPDATE (#1050, owner 2026-11-01): one row per index the update could not build in its time
|-- (a filtered index cannot pause; its estimate from this database's measured rate was longer than the update had). The
|-- statement is kept here, so the updater builds it later in an idle window (SI_UPDATER_MODE = index-build) without the
|-- release's files. State: waiting | building | built | failed. SinceUtc = the first time it waited (an index that has
|-- waited 7 days is built at the next idle moment, once: ForcedUtc). Written by the updater; read by the pipeline runner's
|-- wake-up (engine\_shared\SI-IndexBuild.ps1) and the status.
|IF OBJECT_ID('cfg.IndexBuild') IS NULL
|CREATE TABLE cfg.IndexBuild (
|    TableName    NVARCHAR(256)   NOT NULL,
|    IndexName    NVARCHAR(128)   NOT NULL,
|    Statement    NVARCHAR(MAX)   NOT NULL,
|    State        NVARCHAR(16)    NOT NULL,
|    Pages        BIGINT          NULL,
|    EstMinutes   INT             NULL,
|    RateSource   NVARCHAR(200)   NULL,
|    Why          NVARCHAR(1000)  NULL,
|    SinceUtc     DATETIME2(0)    NOT NULL,
|    LastStartUtc DATETIME2(0)    NULL,
|    LastEndUtc   DATETIME2(0)    NULL,
|    ForcedUtc    DATETIME2(0)    NULL,
|    UpdatedUtc   DATETIME2(0)    NOT NULL,
|    UpdatedBy    NVARCHAR(256)   NOT NULL,
|    CONSTRAINT PK_IndexBuild PRIMARY KEY (TableName, IndexName)
|);
|
|-- COMPONENTS OF THE INSTALLED CODE (CR3, #657; framework 12.11e item 3): one row per component -- a collection per source,
|-- the correlation, Risk Analysis per report, data out per channel (config\release-scopes.locked.json). The UPDATER writes
|-- the fingerprint of each after it installed a release (engine\_shared\SI-ReleaseControl.ps1, Save-SIReleaseScopeRecords):
|-- a changed one gets ChangedUtc / ChangedVersion and GoodDays 0 = TESTING; the engines count a good daily run at the end of
|-- each run (Update-SIReleaseScopeRun); 3 good days = STABLE. ChangedUtc NULL = never changed since the install recorded it.
|IF OBJECT_ID('cfg.ReleaseScope') IS NULL
|CREATE TABLE cfg.ReleaseScope (
|    Scope           NVARCHAR(200)   NOT NULL CONSTRAINT PK_ReleaseScope PRIMARY KEY,
|    Hash            CHAR(64)        NOT NULL,
|    ChangedUtc      DATETIME2(0)    NULL,
|    ChangedVersion  NVARCHAR(50)    NULL,
|    GoodDays        INT             NOT NULL CONSTRAINT DF_ReleaseScope_GoodDays DEFAULT 0,
|    LastGoodDay     DATE            NULL,
|    UpdatedAt       DATETIME2(0)    NOT NULL CONSTRAINT DF_ReleaseScope_UpdatedAt DEFAULT SYSUTCDATETIME()
|);
|
|-- TEMPLATE PACKS (#235): a template version released per ring, independently of the code. The updater stages here the
|-- pack its update ring approves (Origin 'feed'), the publisher the templates shipped with the installed code ('shipped');
|-- the web app's Template releases page reads it and an Admin releases all of it, or only selected detection methods.
|-- PackJson is the pack file EXACTLY as received -- Sha256 is the SHA-256 of its UTF-8 text, checked again by every reader.
|-- A version is staged once and never changed (a pack is immutable once published). Every stage is logged in
|-- cfg.ChangeLog (Name 'template-release', Kind 'pack-staged'); a verified release adds Kind 'released' and, for a whole
|-- pack, cfg.InstallState 'TemplatePack'.
|IF OBJECT_ID('cfg.TemplatePackStaged') IS NULL
|CREATE TABLE cfg.TemplatePackStaged (
|    PackVersion  NVARCHAR(32)    NOT NULL CONSTRAINT PK_TemplatePackStaged PRIMARY KEY,
|    CodeVersion  NVARCHAR(32)    NOT NULL,   -- the release whose code built the pack
|    Sha256       CHAR(64)        NOT NULL,
|    Fingerprint  NVARCHAR(64)    NOT NULL,   -- the template-set fingerprint of the pack's items
|    Ring         NVARCHAR(8)     NULL,       -- the ring that approved it (feed), NULL otherwise
|    Origin       NVARCHAR(16)    NOT NULL,   -- feed | shipped | file
|    IsFull       BIT             NOT NULL,
|    ItemCount    INT             NOT NULL,
|    ScopeJson    NVARCHAR(MAX)   NULL,       -- what a partial pack covers: kinds, detection methods, items
|    PackJson     NVARCHAR(MAX)   NOT NULL,
|    StagedAt     DATETIME2(0)    NOT NULL CONSTRAINT DF_TemplatePackStaged_StagedAt DEFAULT SYSUTCDATETIME(),
|    StagedBy     NVARCHAR(256)   NOT NULL,
|    CONSTRAINT CK_TemplatePackStaged_Origin CHECK (Origin IN ('feed', 'shipped', 'file')),
|    CONSTRAINT CK_TemplatePackStaged_PackJson CHECK (ISJSON(PackJson) = 1)
|);
|
|-- A pack from Invardia keeps the SIGNED manifest it came with (manifestB64, signature, keyId): the install job checks the
|-- signature against the keys embedded in the release and the pack's SHA-256 against the signed one -- never against a
|-- value stored in this row alone.
|IF COL_LENGTH('cfg.TemplatePackStaged', 'ManifestB64') IS NULL ALTER TABLE cfg.TemplatePackStaged ADD ManifestB64 NVARCHAR(MAX) NULL;
|
|IF COL_LENGTH('cfg.TemplatePackStaged', 'ManifestSignature') IS NULL ALTER TABLE cfg.TemplatePackStaged ADD ManifestSignature NVARCHAR(2048) NULL;
|
|IF COL_LENGTH('cfg.TemplatePackStaged', 'ManifestKeyId') IS NULL ALTER TABLE cfg.TemplatePackStaged ADD ManifestKeyId NVARCHAR(128) NULL;
|
|-- THE PACK'S NAME, CONTENT AND LEAST CODE VERSION AS STORED COLUMNS (ADDED 2026-11-05; owner: "every views must be fast").
|-- The navigation's "held template packs" and the template pages listed the staged packs with JSON_VALUE over PackJson: every
|-- list parsed every staged pack (about 1 GB at a ring-0 install, up to 81 s, every 30 s from any page). Computed once when a
|-- row is written (PERSISTED -- JSON_VALUE is deterministic); no writer changes (every INSERT names its columns).
|IF COL_LENGTH('cfg.TemplatePackStaged', 'PackName') IS NULL ALTER TABLE cfg.TemplatePackStaged ADD PackName AS CONVERT(nvarchar(400), JSON_VALUE(PackJson, '$.Name')) PERSISTED;
|
|IF COL_LENGTH('cfg.TemplatePackStaged', 'PackContent') IS NULL ALTER TABLE cfg.TemplatePackStaged ADD PackContent AS CONVERT(nvarchar(400), JSON_VALUE(PackJson, '$.Content')) PERSISTED;
|
|IF COL_LENGTH('cfg.TemplatePackStaged', 'PackMinCode') IS NULL ALTER TABLE cfg.TemplatePackStaged ADD PackMinCode AS CONVERT(nvarchar(64), JSON_VALUE(PackJson, '$.MinCodeVersion')) PERSISTED;
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_TemplatePackStaged_List' AND object_id = OBJECT_ID('cfg.TemplatePackStaged'))
|CREATE INDEX IX_TemplatePackStaged_List ON cfg.TemplatePackStaged (PackVersion) INCLUDE (CodeVersion, Sha256, Fingerprint, Ring, Origin, IsFull, ItemCount, StagedAt, StagedBy, PackName, PackContent, PackMinCode);
|
|-- Phase E (REQUIREMENTS §9.3.3 E): CONNECTORS DEFINED IN SQL.
|-- One row per connector -- where the vulnerability close-loop sends its results (engine\asset-cmdb\_shared\SI-Connector.ps1).
|--   Kind       sql | servicenow | rest           validated in code, no CHECK: the list will grow (see Phase C's note)
|--   Direction  vulnerability | cmdb
|--   Mode       whatif (plan, log, send nothing) | apply
|--   SettingsJson    non-secret settings (a sql target's server + database, a ServiceNow table, ...)
|--   SecretRefsJson  logical name -> Key Vault secret NAME. A secret's VALUE never enters this database.
|--   MappingJson     a rest connector's auth + operations (listOpen / create / update / close / reopen) -- a new
|--                   third-party system is a mapping, not code
|-- No rows = the SI_VulnSync_* settings run as before. Every write is logged in cfg.ChangeLog
|-- (Name 'connector/<name>', Scope 'connector', Kind 'connector').
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.Connector') IS NULL
|CREATE TABLE cfg.Connector (
|    ConnectorId     INT IDENTITY(1,1) NOT NULL CONSTRAINT PK_Connector PRIMARY KEY,
|    Name            NVARCHAR(64)    NOT NULL,
|    Kind            NVARCHAR(32)    NOT NULL,
|    Direction       NVARCHAR(16)    NOT NULL CONSTRAINT DF_Connector_Direction DEFAULT 'vulnerability',
|    Enabled         BIT             NOT NULL CONSTRAINT DF_Connector_Enabled DEFAULT 0,
|    Mode            NVARCHAR(8)     NOT NULL CONSTRAINT DF_Connector_Mode DEFAULT 'whatif',
|    AllowCreate     BIT             NOT NULL CONSTRAINT DF_Connector_AllowCreate DEFAULT 0,
|    AllowClose      BIT             NOT NULL CONSTRAINT DF_Connector_AllowClose DEFAULT 0,
|    SettingsJson    NVARCHAR(MAX)   NULL,
|    SecretRefsJson  NVARCHAR(MAX)   NULL,
|    MappingJson     NVARCHAR(MAX)   NULL,
|    CreatedAt       DATETIME2(0)    NOT NULL CONSTRAINT DF_Connector_CreatedAt DEFAULT SYSUTCDATETIME(),
|    CreatedBy       NVARCHAR(256)   NOT NULL,
|    UpdatedAt       DATETIME2(0)    NOT NULL CONSTRAINT DF_Connector_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy       NVARCHAR(256)   NOT NULL,
|    RowVersion      ROWVERSION      NOT NULL,
|    CONSTRAINT UQ_Connector_Name UNIQUE (Name),
|    CONSTRAINT CK_Connector_Mode CHECK (Mode IN ('whatif', 'apply')),
|    CONSTRAINT CK_Connector_SettingsJson CHECK (SettingsJson IS NULL OR ISJSON(SettingsJson) = 1),
|    CONSTRAINT CK_Connector_SecretRefsJson CHECK (SecretRefsJson IS NULL OR ISJSON(SecretRefsJson) = 1),
|    CONSTRAINT CK_Connector_MappingJson CHECK (MappingJson IS NULL OR ISJSON(MappingJson) = 1)
|);
|
|-- One row per connector per close-loop run: what it planned, what landed, and how it ended
|-- (success | partial | halted | whatif | failed | refused). Append-only; read by the GUI's Connector status page.
|IF OBJECT_ID('cfg.ConnectorRun') IS NULL
|CREATE TABLE cfg.ConnectorRun (
|    ConnectorRunId  BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_ConnectorRun PRIMARY KEY,
|    ConnectorId     INT             NULL,       -- NULL = the SI_VulnSync_* settings (no connector row)
|    ConnectorName   NVARCHAR(64)    NOT NULL,
|    Kind            NVARCHAR(32)    NOT NULL,
|    RunId           NVARCHAR(64)    NOT NULL,
|    StartedAt       DATETIME2(0)    NOT NULL,
|    EndedAt         DATETIME2(0)    NULL,
|    Mode            NVARCHAR(8)     NOT NULL,
|    AllowCreate     BIT             NOT NULL,
|    AllowClose      BIT             NOT NULL,
|    Outcome         NVARCHAR(16)    NOT NULL,
|    PlanOpen        INT             NOT NULL CONSTRAINT DF_ConnectorRun_PlanOpen DEFAULT 0,
|    PlanReopen      INT             NOT NULL CONSTRAINT DF_ConnectorRun_PlanReopen DEFAULT 0,
|    PlanUpdate      INT             NOT NULL CONSTRAINT DF_ConnectorRun_PlanUpdate DEFAULT 0,
|    PlanClose       INT             NOT NULL CONSTRAINT DF_ConnectorRun_PlanClose DEFAULT 0,
|    Held            INT             NOT NULL CONSTRAINT DF_ConnectorRun_Held DEFAULT 0,
|    Opened          INT             NOT NULL CONSTRAINT DF_ConnectorRun_Opened DEFAULT 0,
|    Reopened        INT             NOT NULL CONSTRAINT DF_ConnectorRun_Reopened DEFAULT 0,
|    Updated         INT             NOT NULL CONSTRAINT DF_ConnectorRun_Updated DEFAULT 0,
|    Closed          INT             NOT NULL CONSTRAINT DF_ConnectorRun_Closed DEFAULT 0,
|    Errors          INT             NOT NULL CONSTRAINT DF_ConnectorRun_Errors DEFAULT 0,
|    NotSent         INT             NOT NULL CONSTRAINT DF_ConnectorRun_NotSent DEFAULT 0,
|    HaltReason      NVARCHAR(400)   NULL,
|    Error           NVARCHAR(2000)  NULL
|);
|
|-- A long step's time per phase (2026-10-25, engine/_shared/SI-StepPhase.ps1): Risk Analysis, the vulnerability close-loop
|-- and the data sync write how long each phase took and how many rows it handled -- the step logs of an install cannot be
|-- read through the Support app, its database can. Measurement only; append-only for the engine. Execution joins cfg.FlowStepRun.
|IF OBJECT_ID('cfg.StepPhaseTime') IS NULL
|CREATE TABLE cfg.StepPhaseTime (
|    StepPhaseTimeId BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_StepPhaseTime PRIMARY KEY,
|    Execution       NVARCHAR(128)   NULL,
|    Job             NVARCHAR(64)    NOT NULL,
|    Phase           NVARCHAR(128)   NOT NULL,
|    Seconds         FLOAT           NOT NULL,
|    [Rows]          BIGINT          NULL,
|    AtUtc           DATETIME2(3)    NOT NULL CONSTRAINT DF_StepPhaseTime_At DEFAULT SYSUTCDATETIME()
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_StepPhaseTime_Execution' AND object_id = OBJECT_ID('cfg.StepPhaseTime'))
|CREATE INDEX IX_StepPhaseTime_Execution ON cfg.StepPhaseTime (Execution, AtUtc);
|
|-- A step's progress (2026-10-29, engine/_shared/SI-StepPhase.ps1 Write-SIStepProgress): ONE row per job execution -- its newest
|-- sign of progress (every batch a long step writes moves LastUtc, at most every 5 minutes; the heartbeat and the pipeline runner
|-- tell a step that moves from one that stands still, a warning only) and, where the engine knows it, what it does now and done /
|-- total (Operations > Jobs shows it on the running step). Measurement only; Execution joins cfg.FlowStepRun.
|IF OBJECT_ID('cfg.StepProgress') IS NULL
|CREATE TABLE cfg.StepProgress (
|    Execution       NVARCHAR(128)   NOT NULL CONSTRAINT PK_StepProgress PRIMARY KEY,
|    Job             NVARCHAR(64)    NOT NULL,
|    Phase           NVARCHAR(200)   NULL,
|    Done            BIGINT          NULL,
|    Total           BIGINT          NULL,
|    LastUtc         DATETIME2(3)    NOT NULL CONSTRAINT DF_StepProgress_Last DEFAULT SYSUTCDATETIME(),
|    Beats           BIGINT          NOT NULL CONSTRAINT DF_StepProgress_Beats DEFAULT 0
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ConnectorRun_Name' AND object_id = OBJECT_ID('cfg.ConnectorRun'))
|CREATE INDEX IX_ConnectorRun_Name ON cfg.ConnectorRun (ConnectorName, StartedAt);
|
|-- A rest connector's CORRELATION KEY: the external id of every item it created <-> the SI finding (asset + CVE).
|-- The connector reads only these rows as "its" items, so it can only update, close or reopen what it created itself --
|-- an item someone else created in the other system is never touched. Rows are never removed: a closed item is what a
|-- reopen is matched against.
|IF OBJECT_ID('cfg.ConnectorItem') IS NULL
|CREATE TABLE cfg.ConnectorItem (
|    ConnectorId     INT             NOT NULL,
|    ExternalId      NVARCHAR(256)   NOT NULL,
|    CorrelationId   NVARCHAR(400)   NOT NULL,
|    Cve             NVARCHAR(100)   NOT NULL,
|    AssetName       NVARCHAR(400)   NULL,
|    Severity        NVARCHAR(30)    NULL,
|    State           NVARCHAR(20)    NOT NULL,
|    FirstSeen       DATETIME2(0)    NOT NULL,
|    LastSeen        DATETIME2(0)    NOT NULL,
|    ClosedAt        DATETIME2(0)    NULL,
|    CloseReason     NVARCHAR(400)   NULL,
|    CreatedRunId    NVARCHAR(64)    NULL,
|    UpdatedAt       DATETIME2(0)    NOT NULL CONSTRAINT DF_ConnectorItem_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    CONSTRAINT PK_ConnectorItem PRIMARY KEY (ConnectorId, ExternalId),
|    CONSTRAINT UQ_ConnectorItem_Finding UNIQUE (ConnectorId, CorrelationId, Cve),
|    CONSTRAINT CK_ConnectorItem_State CHECK (State IN ('Open', 'Closed'))
|);
|
|-- THE WEB APP'S COLLECTION VIEWS (#241): "connector changes" reads the runs and the items changed in the window of one
|-- collection (by time, across every connector). Covering on the time column, so neither reads the whole table.
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ConnectorRun_StartedAt' AND object_id = OBJECT_ID('cfg.ConnectorRun'))
|CREATE INDEX IX_ConnectorRun_StartedAt ON cfg.ConnectorRun (StartedAt) INCLUDE (ConnectorName, Kind, Mode, Outcome, Opened, Reopened, Updated, Closed, Errors);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ConnectorItem_UpdatedAt' AND object_id = OBJECT_ID('cfg.ConnectorItem'))
|CREATE INDEX IX_ConnectorItem_UpdatedAt ON cfg.ConnectorItem (UpdatedAt) INCLUDE (State, Cve, AssetName, Severity, FirstSeen, ClosedAt);
|
|-- #429 (operator 2026-10-07: "where is the logs for the connector changes -- what object, what ci, what field, before and now";
|-- "time"; "we cannot have hidden connectors doing changes without telling customers"): THE CONNECTOR ITEM CHANGE LOG.
|-- One row per item a connector wrote (or failed to write) in one run, for EVERY connector -- the vulnerability connectors,
|-- the SQL CMDB connector, the ServiceNow hand-offs:
|--   ChangedAt    the moment the write for THIS item returned (UTC; shown in the viewer's time zone), not the run's start
|--   Action       opened | reopened | updated | closed | absence counted | created | retired | reactivated | written |
|--                not opened | not updated | not closed | not reopened (a failure: Error says why)
|--   ObjectName / ObjectKey   WHAT: the SecurityInsight asset (name + its CI key / SI id); Finding = the finding key (CVE, ...)
|--   TargetTable / TargetKey  WHERE: the target table and the record's key there (sys_id, SQL key)
|--   Field / ValueBefore / ValueNow   WHICH field, BEFORE and NOW -- ONE ROW PER CHANGED FIELD of the item (an item written
|--                without a field -- a failure, a staged row -- is one row with no field). Only the fields SecurityInsight
|--                sends, values cut to 400 characters: no payload copies. A "still seen" refresh that changes nothing is not
|--                a change and is not logged.
|-- Append-only for the connector jobs; rows older than the configuration-backup retention (SI_Pro_ConfigBackupRetentionDays,
|-- default 90 days -- the change journal's rule, CONFIG-1 #404) are removed by cfg.ConnectorChangeRetentionApply, which each
|-- connector job calls after it has written its rows.
|IF OBJECT_ID('cfg.ConnectorChange') IS NULL
|CREATE TABLE cfg.ConnectorChange (
|    ChangeId        BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_ConnectorChange PRIMARY KEY,
|    ConnectorName   NVARCHAR(64)    NOT NULL,
|    RunId           NVARCHAR(64)    NOT NULL,
|    ChangedAt       DATETIME2(3)    NOT NULL,
|    Action          NVARCHAR(24)    NOT NULL,
|    ObjectName      NVARCHAR(400)   NULL,
|    ObjectKey       NVARCHAR(400)   NULL,
|    Finding         NVARCHAR(256)   NULL,
|    TargetTable     NVARCHAR(200)   NULL,
|    TargetKey       NVARCHAR(256)   NULL,
|    Field           NVARCHAR(128)   NULL,
|    ValueBefore     NVARCHAR(400)   NULL,
|    ValueNow        NVARCHAR(400)   NULL,
|    Reason          NVARCHAR(400)   NULL,
|    Error           NVARCHAR(1000)  NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ConnectorChange_ChangedAt' AND object_id = OBJECT_ID('cfg.ConnectorChange'))
|CREATE INDEX IX_ConnectorChange_ChangedAt ON cfg.ConnectorChange (ChangedAt) INCLUDE (ConnectorName, RunId, Action, ObjectName, ObjectKey, Finding, TargetTable, TargetKey, Field);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ConnectorChange_Run' AND object_id = OBJECT_ID('cfg.ConnectorChange'))
|CREATE INDEX IX_ConnectorChange_Run ON cfg.ConnectorChange (ConnectorName, RunId);
|
|-- #429: a "still seen" refresh is counted apart from an update (Updated = a field SecurityInsight sends really changed).
|IF COL_LENGTH('cfg.ConnectorRun', 'Unchanged') IS NULL
|ALTER TABLE cfg.ConnectorRun ADD Unchanged INT NOT NULL CONSTRAINT DF_ConnectorRun_Unchanged DEFAULT 0;
|
|-- #406 (owner 2026-10-19: "just release auto"): the records a run closed because the CI lifecycle RETIRED their asset (not
|-- seen past its category's grace period, or every source said it is gone) -- closed outside the close limit, counted here.
|IF COL_LENGTH('cfg.ConnectorRun', 'RetiredClosed') IS NULL
|ALTER TABLE cfg.ConnectorRun ADD RetiredClosed INT NOT NULL CONSTRAINT DF_ConnectorRun_RetiredClosed DEFAULT 0;
|
|-- #429: the ONE removal of connector change rows -- older than the configuration-backup retention (default 90 days).
|-- Runs only for a job identity (db_datawriter) or the owner, a batch at a time.
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.ConnectorChangeRetentionApply @Batch INT = 5000
|AS
|BEGIN
|    SET NOCOUNT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_datawriter''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_engine''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1
|        THROW 51425, N''only a connector job may apply the connector change log retention -- nothing was removed'', 1;
|    DECLARE @days INT = (SELECT TOP (1) TRY_CONVERT(INT, JSON_VALUE(N''['' + s.ValueJson + N'']'', ''$[0]'')) FROM cfg.Setting AS s
|                         WHERE s.Name = N''SI_Pro_ConfigBackupRetentionDays'' AND s.Scope = N''solution'' AND s.ValueJson IS NOT NULL AND ISJSON(N''['' + s.ValueJson + N'']'') = 1);
|    IF @days IS NULL OR @days < 1 SET @days = 90;
|    IF @Batch IS NULL OR @Batch < 1 SET @Batch = 5000;
|    DELETE TOP (@Batch) FROM cfg.ConnectorChange WHERE ChangedAt < DATEADD(DAY, -@days, SYSUTCDATETIME());
|    SELECT @@ROWCOUNT AS N;
|END');
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.ConnectorChangeRetentionApply TO public;
|
|-- DATA OUT (ADDED 2026-10-10, V3-DATA-MODEL 2.12): what each data-out connector (config/data-out.locked.json: the CI and
|-- findings workbooks, the ServiceNow Import Set hand-offs) sent last time, one row per output and item -- the BEFORE its
|-- next run compares with, so the item change log (cfg.ConnectorChange) carries each changed column before and now and a
|-- ServiceNow hand-off sends only what is new or changed. RowJson = the row as sent (column -> text, the run's own columns
|-- left out). Written by the data-out step only after its destination accepted everything; a removed item's row is deleted.
|IF OBJECT_ID('cfg.DataOutItem') IS NULL
|CREATE TABLE cfg.DataOutItem (
|    OutputId    NVARCHAR(64)    NOT NULL,
|    ItemKey     NVARCHAR(380)   NOT NULL,   -- a longer key is kept as its first part + a hash (the index key stays under 900 bytes)
|    RowHash     CHAR(64)        NOT NULL,
|    RowJson     NVARCHAR(MAX)   NULL,
|    SentAt      DATETIME2(3)    NOT NULL,
|    RunId       NVARCHAR(64)    NULL,
|    CONSTRAINT PK_DataOutItem PRIMARY KEY (OutputId, ItemKey)
|);
|
|-- #914 THE BATCHES OF THE DATA-OUT CONTRACT (ADDED 2026-10-27): SecurityInsight's own record of every batch it sent to a
|-- ServiceNow output -- the same id the staging status table and every data row carry (u_si_batch_id = '<run id>:<output>',
|-- '...:test' for a test batch). State writing -> complete | failed | held; a batch still 'writing' when the next sync of the
|-- same output starts is ended 'failed' with the reason (never two open batches per output). The counts per action are the
|-- end row's; the Import* columns are the target's own import result, read back at the next sync (FeedbackAt). RequestToken =
|-- the resync / test request the batch carried out (SI_DataOut_ServiceNowRequest). Additive; nothing is ever deleted here
|-- by SecurityInsight except by the retention of the run history.
|IF OBJECT_ID('cfg.DataOutBatch') IS NULL
|CREATE TABLE cfg.DataOutBatch (
|    BatchId          NVARCHAR(160)  NOT NULL CONSTRAINT PK_DataOutBatch PRIMARY KEY,
|    OutputId         NVARCHAR(64)   NOT NULL,
|    Connector        NVARCHAR(100)  NULL,
|    RunId            NVARCHAR(64)   NOT NULL,
|    State            NVARCHAR(16)   NOT NULL,
|    Mode             NVARCHAR(16)   NOT NULL CONSTRAINT DF_DataOutBatch_Mode DEFAULT N'live',
|    ContractVersion  NVARCHAR(16)   NOT NULL,
|    TargetTable      NVARCHAR(80)   NULL,
|    StartedAt        DATETIME2(3)   NOT NULL,
|    FinishedAt       DATETIME2(3)   NULL,
|    PlannedRows      BIGINT         NULL,
|    SentRows         BIGINT         NULL,
|    FailedRows       BIGINT         NULL,
|    NewRows          BIGINT         NULL,
|    UpdateRows       BIGINT         NULL,
|    CloseRows        BIGINT         NULL,
|    ReopenRows       BIGINT         NULL,
|    HeldRows         BIGINT         NULL,
|    OutOfScopeRows   BIGINT         NULL,
|    ImportSetIds     NVARCHAR(MAX)  NULL,
|    Reason           NVARCHAR(1000) NULL,
|    RequestToken     NVARCHAR(100)  NULL,
|    FeedbackAt       DATETIME2(3)   NULL,
|    ImportInserted   BIGINT         NULL,
|    ImportUpdated    BIGINT         NULL,
|    ImportIgnored    BIGINT         NULL,
|    ImportSkipped    BIGINT         NULL,
|    ImportErrors     BIGINT         NULL,
|    ImportPending    BIGINT         NULL,
|    FeedbackNote     NVARCHAR(400)  NULL,
|    CONSTRAINT CK_DataOutBatch_State CHECK (State IN ('writing', 'complete', 'failed', 'held')),
|    CONSTRAINT CK_DataOutBatch_Mode CHECK (Mode IN ('live', 'resync', 'test'))
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_DataOutBatch_Output' AND object_id = OBJECT_ID('cfg.DataOutBatch'))
|CREATE INDEX IX_DataOutBatch_Output ON cfg.DataOutBatch (OutputId, State, StartedAt DESC) INCLUDE (Mode, FinishedAt, FeedbackAt, RequestToken);
|
|-- #1043 THE PROGRESS OF A BATCH WHILE IT IS SENT (ADDED 2026-11-01, engine/data-out/SI-DataOutProgress.ps1): the phase the
|-- output is in (readback | read | build | send | close), the rows planned (an estimate until the end), sent and held, the
|-- pages sent and the time of the last sign of progress. Written batched -- at most once a minute and at each milestone, one
|-- small UPDATE by the batch's key, never retried -- so a SQL reader, the web app and the heartbeat (DataOut) see a long send
|-- as it goes, without the log's lag. Nullable: a batch written before this has none.
|IF COL_LENGTH('cfg.DataOutBatch', 'Phase') IS NULL ALTER TABLE cfg.DataOutBatch ADD Phase NVARCHAR(16) NULL;
|
|IF COL_LENGTH('cfg.DataOutBatch', 'RowsPlanned') IS NULL ALTER TABLE cfg.DataOutBatch ADD RowsPlanned BIGINT NULL;
|
|IF COL_LENGTH('cfg.DataOutBatch', 'RowsSent') IS NULL ALTER TABLE cfg.DataOutBatch ADD RowsSent BIGINT NULL;
|
|IF COL_LENGTH('cfg.DataOutBatch', 'RowsHeld') IS NULL ALTER TABLE cfg.DataOutBatch ADD RowsHeld BIGINT NULL;
|
|IF COL_LENGTH('cfg.DataOutBatch', 'PagesSent') IS NULL ALTER TABLE cfg.DataOutBatch ADD PagesSent BIGINT NULL;
|
|IF COL_LENGTH('cfg.DataOutBatch', 'LastProgressUtc') IS NULL ALTER TABLE cfg.DataOutBatch ADD LastProgressUtc DATETIME2(3) NULL;
|
|-- =============================================================================================
|-- THE CMDB (#256): business services, the assets that belong to them, and which source is authoritative.
|--   cfg.CmdbService       one row per service. Source = the CMDB the row came from:
|--                           SI                   homed in SecurityInsight -- added, edited and retired on the CMDB page
|--                           External-CSV         imported from a CMDB.csv (the v2.2 format), read-only in SecurityInsight
|--                           External-Connector   pulled from ServiceNow through the connector, read-only in SecurityInsight
|--                         ServiceNumber: SI generates SVC-0001, SVC-0002, ... from cfg.CmdbServiceNumber (a sequence, so a
|--                         number is never reused, not even after a retire or a rolled-back insert); an external row keeps
|--                         the source's own id (CMDB.csv cmdbID, ServiceNow number). ExternalId: the id in the source (a
|--                         migrated service: its v2.2 cmdbID). The CMDB.csv columns are columns; any other CSV column is kept
|--                         verbatim in ExtraJson. Department names the owning department (#254). A service is RETIRED,
|--                         never removed: RetiredAt is set and its history stays.
|--   cfg.CmdbServiceAsset  one row per link (service <-> asset). Unlinking sets UnlinkedAt; linking again adds a new row, so
|--                         the history of who linked what, when, stays. AssetKey = sidata.Asset.AssetKey. An asset may
|--                         belong to several services.
|--   cfg.CmdbImport        one row per import (a CSV upload, a scheduled CSV path, a connector pull, the one-time migration):
|--                         what it added, changed, retired, linked, unlinked and rejected.
|-- ONE SOURCE IS AUTHORITATIVE AT A TIME: the setting SIWeb_CmdbSource (scope 'engine:management-web'; SI when unset). Rows
|-- of the other sources stay stored, unused; switching never copies or merges anything. cfg.vCmdbAssetService is the
|-- CMDB's current membership; the data sync plugs it into THE service-membership resolver (Get-SIDataServiceSources,
|-- sidata.ServiceMember per collection) as the authoritative source, so every consumer reads services one way.
|-- Every change has its cfg.ChangeLog row (Scope 'cmdb').
|-- No Source CHECK (the list may grow -- see phase C's note); the writers validate it.
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.CmdbServiceNumber') IS NULL
|CREATE SEQUENCE cfg.CmdbServiceNumber AS INT START WITH 1 INCREMENT BY 1 NO CYCLE;
|
|IF OBJECT_ID('cfg.CmdbService') IS NULL
|CREATE TABLE cfg.CmdbService (
|    ServiceId        INT IDENTITY(1,1) NOT NULL CONSTRAINT PK_CmdbService PRIMARY KEY,
|    Source           NVARCHAR(24)    NOT NULL,
|    ServiceNumber    NVARCHAR(64)    NOT NULL,
|    ExternalId       NVARCHAR(128)   NULL,
|    Name             NVARCHAR(256)   NOT NULL,
|    Description      NVARCHAR(2000)  NULL,
|    Owner            NVARCHAR(256)   NULL,
|    OwnerMail        NVARCHAR(256)   NULL,
|    Criticality      NVARCHAR(32)    NULL,      -- Critical | High | Medium | Low (risk weighting reads these words)
|    DataSensitivity  NVARCHAR(32)    NULL,      -- Restricted | Confidential | Internal | Public
|    Environment      NVARCHAR(64)    NULL,
|    Department       NVARCHAR(128)   NULL,
|    ExtraJson        NVARCHAR(MAX)   NULL,      -- every other CMDB.csv column, verbatim: {"column": "value"}
|    CreatedAt        DATETIME2(0)    NOT NULL CONSTRAINT DF_CmdbService_CreatedAt DEFAULT SYSUTCDATETIME(),
|    CreatedBy        NVARCHAR(256)   NOT NULL,
|    UpdatedAt        DATETIME2(0)    NOT NULL CONSTRAINT DF_CmdbService_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy        NVARCHAR(256)   NOT NULL,
|    RetiredAt        DATETIME2(0)    NULL,
|    RetiredBy        NVARCHAR(256)   NULL,
|    RetireReason     NVARCHAR(400)   NULL,
|    RowVersion       ROWVERSION      NOT NULL,
|    CONSTRAINT UQ_CmdbService_Number UNIQUE (Source, ServiceNumber),
|    CONSTRAINT CK_CmdbService_ExtraJson CHECK (ExtraJson IS NULL OR ISJSON(ExtraJson) = 1)
|);
|
|IF OBJECT_ID('cfg.CmdbServiceAsset') IS NULL
|CREATE TABLE cfg.CmdbServiceAsset (
|    LinkId       BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_CmdbServiceAsset PRIMARY KEY,
|    ServiceId    INT             NOT NULL CONSTRAINT FK_CmdbServiceAsset_Service REFERENCES cfg.CmdbService (ServiceId),
|    AssetKey     NVARCHAR(400)   NOT NULL,
|    AssetName    NVARCHAR(400)   NULL,
|    LinkedAt     DATETIME2(0)    NOT NULL CONSTRAINT DF_CmdbServiceAsset_LinkedAt DEFAULT SYSUTCDATETIME(),
|    LinkedBy     NVARCHAR(256)   NOT NULL,
|    UnlinkedAt   DATETIME2(0)    NULL,
|    UnlinkedBy   NVARCHAR(256)   NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'UX_CmdbServiceAsset_Current' AND object_id = OBJECT_ID('cfg.CmdbServiceAsset'))
|CREATE UNIQUE INDEX UX_CmdbServiceAsset_Current ON cfg.CmdbServiceAsset (ServiceId, AssetKey) WHERE UnlinkedAt IS NULL;
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_CmdbServiceAsset_Asset' AND object_id = OBJECT_ID('cfg.CmdbServiceAsset'))
|CREATE INDEX IX_CmdbServiceAsset_Asset ON cfg.CmdbServiceAsset (AssetKey) INCLUDE (ServiceId) WHERE UnlinkedAt IS NULL;
|
|IF OBJECT_ID('cfg.CmdbImport') IS NULL
|CREATE TABLE cfg.CmdbImport (
|    ImportId           BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_CmdbImport PRIMARY KEY,
|    Source             NVARCHAR(24)    NOT NULL,
|    Kind               NVARCHAR(24)    NOT NULL,   -- migration | csv-upload | csv-path | connector
|    Origin             NVARCHAR(400)   NULL,       -- the file name, the path or the connector
|    Sha256             NVARCHAR(64)    NULL,       -- of the file(s) imported
|    ImportedAt         DATETIME2(0)    NOT NULL CONSTRAINT DF_CmdbImport_ImportedAt DEFAULT SYSUTCDATETIME(),
|    ImportedBy         NVARCHAR(256)   NOT NULL,
|    Outcome            NVARCHAR(24)    NOT NULL,   -- Imported | Refused | AlreadyImported
|    Message            NVARCHAR(400)   NULL,
|    ServicesAdded      INT             NOT NULL CONSTRAINT DF_CmdbImport_ServicesAdded DEFAULT 0,
|    ServicesUpdated    INT             NOT NULL CONSTRAINT DF_CmdbImport_ServicesUpdated DEFAULT 0,
|    ServicesRetired    INT             NOT NULL CONSTRAINT DF_CmdbImport_ServicesRetired DEFAULT 0,
|    ServicesSkipped    INT             NOT NULL CONSTRAINT DF_CmdbImport_ServicesSkipped DEFAULT 0,
|    ServicesUnchanged  INT             NOT NULL CONSTRAINT DF_CmdbImport_ServicesUnchanged DEFAULT 0,
|    LinksAdded         INT             NOT NULL CONSTRAINT DF_CmdbImport_LinksAdded DEFAULT 0,
|    LinksRemoved       INT             NOT NULL CONSTRAINT DF_CmdbImport_LinksRemoved DEFAULT 0,
|    LinksRejected      INT             NOT NULL CONSTRAINT DF_CmdbImport_LinksRejected DEFAULT 0,
|    RejectedJson       NVARCHAR(MAX)   NULL        -- the links that were not imported, and why (at most 500)
|);
|
|-- The authoritative source: the SIWeb_CmdbSource setting, SI when it is not set.
|IF OBJECT_ID('cfg.vCmdbSource') IS NULL
|EXEC ('CREATE VIEW cfg.vCmdbSource AS
|SELECT COALESCE((SELECT TOP (1) CASE WHEN ISJSON(N''['' + s.ValueJson + N'']'') = 1 THEN JSON_VALUE(N''['' + s.ValueJson + N'']'', ''$[0]'') END FROM cfg.Setting AS s
|                 WHERE s.Name = N''SIWeb_CmdbSource'' AND s.Scope = N''engine:management-web''), N''SI'') AS ActiveSource');
|
|-- The services of the authoritative source that are not retired.
|IF OBJECT_ID('cfg.vCmdbService') IS NULL
|EXEC ('CREATE VIEW cfg.vCmdbService AS
|SELECT s.ServiceId, s.Source, s.ServiceNumber, s.ExternalId, s.Name, s.Description, s.Owner, s.OwnerMail, s.Criticality, s.DataSensitivity,
|       s.Environment, s.Department, s.ExtraJson,
|       CASE s.Criticality WHEN N''Critical'' THEN 1 WHEN N''High'' THEN 2 WHEN N''Medium'' THEN 3 WHEN N''Low'' THEN 4 ELSE 9 END AS CriticalityRank
|FROM cfg.CmdbService AS s
|JOIN cfg.vCmdbSource AS a ON a.ActiveSource = s.Source
|WHERE s.RetiredAt IS NULL');
|
|-- The CMDB's current membership: one row per (asset, service) of the authoritative source -- an asset in two services
|-- has two rows. The data sync's 'cmdb' service source reads it (engine\_shared\data-sql\SI-DataSql.ps1).
|IF OBJECT_ID('cfg.vCmdbAssetService') IS NULL
|EXEC ('CREATE VIEW cfg.vCmdbAssetService AS
|SELECT m.AssetKey, s.ServiceId, s.ServiceNumber, s.Name AS ServiceName, s.Criticality, s.CriticalityRank, s.DataSensitivity, s.Environment,
|       s.Owner, s.OwnerMail, s.Department, s.Source, m.LinkedAt
|FROM cfg.CmdbServiceAsset AS m
|JOIN cfg.vCmdbService AS s ON s.ServiceId = m.ServiceId
|WHERE m.UnlinkedAt IS NULL');
|
|-- One import -- the one-time migration of a v2.2 CMDB.csv into the SecurityInsight CMDB, or a snapshot of an external
|-- CMDB (a CSV or the connector) -- in ONE transaction with its cfg.CmdbImport and cfg.ChangeLog rows. @Payload:
|--   {"services":[{"number","externalId","name","description","owner","ownerMail","criticality","dataSensitivity",
|--                 "environment","department","extra":{...}}], "links":[{"number","assetKey","assetName"}], "linksIncluded":true}
|-- A snapshot makes the source's services exactly the file's: new ones added, changed ones updated, missing ones RETIRED
|-- (never removed); with linksIncluded its links too (missing ones unlinked). A migration (@Source 'SI') runs once:
|-- every service gets a new SVC number (its cmdbID kept as ExternalId). A link's asset is matched by AssetKey, then by a
|-- unique identifier, then by a unique asset name; one that does not match is reported, not stored. Both the web app
|-- and the PowerShell import call THIS procedure, so the two cannot import differently. Called by the SecurityInsight
|-- writers only; a later change ships as a new procedure name (this file never alters an object).
|IF OBJECT_ID('cfg.CmdbImportSnapshot') IS NULL
|EXEC (N'CREATE PROCEDURE cfg.CmdbImportSnapshot
|    @Source NVARCHAR(24), @Kind NVARCHAR(24), @Origin NVARCHAR(400), @Sha256 NVARCHAR(64), @Payload NVARCHAR(MAX), @By NVARCHAR(256), @Reason NVARCHAR(400)
|AS
|BEGIN
|    SET NOCOUNT ON;
|    SET XACT_ABORT ON;
|    DECLARE @now DATETIME2(0) = SYSUTCDATETIME(), @outcome NVARCHAR(24) = N''Imported'', @why NVARCHAR(400) = NULL, @importId BIGINT;
|    DECLARE @added INT = 0, @updated INT = 0, @retired INT = 0, @skipped INT = 0, @unchanged INT = 0, @linksAdded INT = 0, @linksRemoved INT = 0, @linksRejected INT = 0, @rejected NVARCHAR(MAX) = NULL;
|    IF @Source NOT IN (N''SI'', N''External-CSV'', N''External-Connector'') SELECT @outcome = N''Refused'', @why = N''unknown CMDB source'';
|    ELSE IF @Kind NOT IN (N''migration'', N''csv-upload'', N''csv-path'', N''connector'') SELECT @outcome = N''Refused'', @why = N''unknown import kind'';
|    ELSE IF ISJSON(@Payload) <> 1 SELECT @outcome = N''Refused'', @why = N''the import is not valid JSON'';
|    ELSE IF @Source = N''SI'' AND @Kind <> N''migration'' SELECT @outcome = N''Refused'', @why = N''the SecurityInsight CMDB is edited on the CMDB page; only the one-time migration of a CMDB.csv imports into it'';
|    ELSE IF @Source <> N''SI'' AND @Kind = N''migration'' SELECT @outcome = N''Refused'', @why = N''a migration imports into the SecurityInsight CMDB only'';
|    ELSE IF @Kind = N''migration'' AND EXISTS (SELECT 1 FROM cfg.InstallState WHERE Name = N''CmdbMigration'') SELECT @outcome = N''AlreadyImported'', @why = (SELECT N''a CMDB.csv was already imported: '' + Value FROM cfg.InstallState WHERE Name = N''CmdbMigration'');
|    IF @outcome <> N''Imported''
|    BEGIN
|        INSERT cfg.CmdbImport (Source, Kind, Origin, Sha256, ImportedBy, Outcome, Message) VALUES (@Source, @Kind, @Origin, @Sha256, @By, @outcome, @why);
|        SELECT @outcome AS Outcome, @why AS Message, CONVERT(BIGINT, SCOPE_IDENTITY()) AS ImportId, 0 AS ServicesAdded, 0 AS ServicesUpdated, 0 AS ServicesRetired, 0 AS ServicesSkipped, 0 AS ServicesUnchanged, 0 AS LinksAdded, 0 AS LinksRemoved, 0 AS LinksRejected, CONVERT(NVARCHAR(MAX), NULL) AS RejectedJson;
|        RETURN;
|    END;
|    DECLARE @svc TABLE (Ord INT NOT NULL, Number NVARCHAR(64) NOT NULL, ExternalId NVARCHAR(128) NULL, Name NVARCHAR(256) NOT NULL, Description NVARCHAR(2000) NULL, Owner NVARCHAR(256) NULL, OwnerMail NVARCHAR(256) NULL, Criticality NVARCHAR(32) NULL, DataSensitivity NVARCHAR(32) NULL, Environment NVARCHAR(64) NULL, Department NVARCHAR(128) NULL, ExtraJson NVARCHAR(MAX) NULL);
|    INSERT @svc (Ord, Number, ExternalId, Name, Description, Owner, OwnerMail, Criticality, DataSensitivity, Environment, Department, ExtraJson)
|    SELECT CONVERT(INT, j.[key]), w.number, NULLIF(w.externalId, N''''), w.name, NULLIF(w.description, N''''), NULLIF(w.owner, N''''), NULLIF(w.ownerMail, N''''), NULLIF(w.criticality, N''''), NULLIF(w.dataSensitivity, N''''), NULLIF(w.environment, N''''), NULLIF(w.department, N''''), CASE WHEN w.extra IS NULL OR w.extra = N''{}'' THEN NULL ELSE w.extra END
|    FROM OPENJSON(@Payload, N''$.services'') AS j
|    CROSS APPLY OPENJSON(j.value) WITH (number NVARCHAR(64) N''$.number'', externalId NVARCHAR(128) N''$.externalId'', name NVARCHAR(256) N''$.name'', description NVARCHAR(2000) N''$.description'', owner NVARCHAR(256) N''$.owner'', ownerMail NVARCHAR(256) N''$.ownerMail'', criticality NVARCHAR(32) N''$.criticality'', dataSensitivity NVARCHAR(32) N''$.dataSensitivity'', environment NVARCHAR(64) N''$.environment'', department NVARCHAR(128) N''$.department'', extra NVARCHAR(MAX) N''$.extra'' AS JSON) AS w
|    WHERE NULLIF(w.number, N'''') IS NOT NULL AND NULLIF(w.name, N'''') IS NOT NULL;
|    IF EXISTS (SELECT Number FROM @svc GROUP BY Number HAVING COUNT(*) > 1)
|    BEGIN
|        SELECT @outcome = N''Refused'', @why = N''a service number appears more than once in the import'';
|        INSERT cfg.CmdbImport (Source, Kind, Origin, Sha256, ImportedBy, Outcome, Message) VALUES (@Source, @Kind, @Origin, @Sha256, @By, @outcome, @why);
|        SELECT @outcome AS Outcome, @why AS Message, CONVERT(BIGINT, SCOPE_IDENTITY()) AS ImportId, 0 AS ServicesAdded, 0 AS ServicesUpdated, 0 AS ServicesRetired, 0 AS ServicesSkipped, 0 AS ServicesUnchanged, 0 AS LinksAdded, 0 AS LinksRemoved, 0 AS LinksRejected, CONVERT(NVARCHAR(MAX), NULL) AS RejectedJson;
|        RETURN;
|    END;
|    DECLARE @linksIncluded BIT = CASE WHEN LOWER(COALESCE(JSON_VALUE(@Payload, N''$.linksIncluded''), N''false'')) = N''true'' THEN 1 ELSE 0 END;
|    DECLARE @lnk TABLE (Number NVARCHAR(64) NULL, AssetKey NVARCHAR(400) NULL, AssetName NVARCHAR(400) NULL, ServiceId INT NULL, ResolvedKey NVARCHAR(400) NULL);
|    INSERT @lnk (Number, AssetKey, AssetName)
|    SELECT NULLIF(w.number, N''''), NULLIF(w.assetKey, N''''), NULLIF(w.assetName, N'''')
|    FROM OPENJSON(@Payload, N''$.links'') WITH (number NVARCHAR(64) N''$.number'', assetKey NVARCHAR(400) N''$.assetKey'', assetName NVARCHAR(400) N''$.assetName'') AS w;
|    BEGIN TRAN;
|    IF @Kind = N''migration''
|    BEGIN
|        DECLARE @todo TABLE (Ord INT NOT NULL PRIMARY KEY);
|        INSERT @todo (Ord) SELECT v.Ord FROM @svc AS v WHERE NOT EXISTS (SELECT 1 FROM cfg.CmdbService AS s WHERE s.Source = N''SI'' AND s.ExternalId = v.Number);
|        SET @skipped = (SELECT COUNT(*) FROM @svc) - (SELECT COUNT(*) FROM @todo);
|        DECLARE @num TABLE (Ord INT NOT NULL PRIMARY KEY, Seq INT NOT NULL);
|        INSERT @num (Ord, Seq) SELECT t.Ord, NEXT VALUE FOR cfg.CmdbServiceNumber OVER (ORDER BY t.Ord) FROM @todo AS t;
|        INSERT cfg.CmdbService (Source, ServiceNumber, ExternalId, Name, Description, Owner, OwnerMail, Criticality, DataSensitivity, Environment, Department, ExtraJson, CreatedBy, UpdatedBy)
|        SELECT N''SI'', N''SVC-'' + CASE WHEN n.Seq < 10000 THEN RIGHT(N''0000'' + CONVERT(NVARCHAR(12), n.Seq), 4) ELSE CONVERT(NVARCHAR(12), n.Seq) END,
|               v.Number, v.Name, v.Description, v.Owner, v.OwnerMail, v.Criticality, v.DataSensitivity, v.Environment, v.Department, v.ExtraJson, @By, @By
|        FROM @svc AS v JOIN @num AS n ON n.Ord = v.Ord;
|        SET @added = @@ROWCOUNT;
|        UPDATE l SET ServiceId = s.ServiceId FROM @lnk AS l JOIN cfg.CmdbService AS s ON s.Source = N''SI'' AND s.ExternalId = l.Number AND s.RetiredAt IS NULL;
|    END
|    ELSE
|    BEGIN
|        UPDATE s SET Name = v.Name, ExternalId = v.ExternalId, Description = v.Description, Owner = v.Owner, OwnerMail = v.OwnerMail, Criticality = v.Criticality, DataSensitivity = v.DataSensitivity,
|                     Environment = v.Environment, Department = v.Department, ExtraJson = v.ExtraJson, RetiredAt = NULL, RetiredBy = NULL, RetireReason = NULL, UpdatedAt = @now, UpdatedBy = @By
|        FROM cfg.CmdbService AS s JOIN @svc AS v ON s.Source = @Source AND s.ServiceNumber = v.Number
|        WHERE s.RetiredAt IS NOT NULL OR EXISTS (SELECT s.Name, s.ExternalId, s.Description, s.Owner, s.OwnerMail, s.Criticality, s.DataSensitivity, s.Environment, s.Department, s.ExtraJson
|                                                 EXCEPT SELECT v.Name, v.ExternalId, v.Description, v.Owner, v.OwnerMail, v.Criticality, v.DataSensitivity, v.Environment, v.Department, v.ExtraJson);
|        SET @updated = @@ROWCOUNT;
|        INSERT cfg.CmdbService (Source, ServiceNumber, ExternalId, Name, Description, Owner, OwnerMail, Criticality, DataSensitivity, Environment, Department, ExtraJson, CreatedBy, UpdatedBy)
|        SELECT @Source, v.Number, v.ExternalId, v.Name, v.Description, v.Owner, v.OwnerMail, v.Criticality, v.DataSensitivity, v.Environment, v.Department, v.ExtraJson, @By, @By
|        FROM @svc AS v WHERE NOT EXISTS (SELECT 1 FROM cfg.CmdbService AS s WHERE s.Source = @Source AND s.ServiceNumber = v.Number);
|        SET @added = @@ROWCOUNT;
|        UPDATE s SET RetiredAt = @now, RetiredBy = @By, RetireReason = N''not in the latest import'', UpdatedAt = @now, UpdatedBy = @By
|        FROM cfg.CmdbService AS s
|        WHERE s.Source = @Source AND s.RetiredAt IS NULL AND NOT EXISTS (SELECT 1 FROM @svc AS v WHERE v.Number = s.ServiceNumber);
|        SET @retired = @@ROWCOUNT;
|        SET @unchanged = (SELECT COUNT(*) FROM @svc) - @added - @updated;
|        UPDATE l SET ServiceId = s.ServiceId FROM @lnk AS l JOIN cfg.CmdbService AS s ON s.Source = @Source AND s.ServiceNumber = l.Number AND s.RetiredAt IS NULL;
|    END;
|    IF SCHEMA_ID(N''sidata'') IS NOT NULL AND OBJECT_ID(N''sidata.Asset'') IS NOT NULL
|    BEGIN
|        UPDATE l SET ResolvedKey = a.AssetKey FROM @lnk AS l JOIN sidata.Asset AS a ON a.AssetKey = l.AssetKey WHERE l.AssetKey IS NOT NULL;
|        UPDATE l SET ResolvedKey = x.AssetKey
|        FROM @lnk AS l
|        CROSS APPLY (SELECT MIN(i.AssetKey) AS AssetKey, COUNT(DISTINCT i.AssetKey) AS N FROM sidata.AssetIdentifier AS i WHERE i.IdentifierValue = LOWER(l.AssetKey)) AS x
|        WHERE l.ResolvedKey IS NULL AND l.AssetKey IS NOT NULL AND x.N = 1;
|        UPDATE l SET ResolvedKey = x.AssetKey
|        FROM @lnk AS l
|        CROSS APPLY (SELECT MIN(a.AssetKey) AS AssetKey, COUNT(*) AS N FROM sidata.Asset AS a WHERE a.AssetName = l.AssetName) AS x
|        WHERE l.ResolvedKey IS NULL AND l.AssetName IS NOT NULL AND x.N = 1;
|    END;
|    SET @linksRejected = (SELECT COUNT(*) FROM @lnk WHERE ServiceId IS NULL OR ResolvedKey IS NULL);
|    SET @rejected = (SELECT TOP (500) l.Number AS number, l.AssetKey AS assetKey, l.AssetName AS assetName,
|                            CASE WHEN l.ServiceId IS NULL THEN N''no such service in this import'' ELSE N''the asset is not known to SecurityInsight (or its name is not unique)'' END AS why
|                     FROM @lnk AS l WHERE l.ServiceId IS NULL OR l.ResolvedKey IS NULL FOR JSON PATH);
|    IF @Kind <> N''migration'' AND @linksIncluded = 1
|    BEGIN
|        UPDATE m SET UnlinkedAt = @now, UnlinkedBy = @By
|        FROM cfg.CmdbServiceAsset AS m JOIN cfg.CmdbService AS s ON s.ServiceId = m.ServiceId
|        WHERE s.Source = @Source AND m.UnlinkedAt IS NULL
|          AND NOT EXISTS (SELECT 1 FROM @lnk AS l WHERE l.ServiceId = m.ServiceId AND l.ResolvedKey = m.AssetKey);
|        SET @linksRemoved = @@ROWCOUNT;
|    END;
|    INSERT cfg.CmdbServiceAsset (ServiceId, AssetKey, AssetName, LinkedBy)
|    SELECT l.ServiceId, l.ResolvedKey, MAX(l.AssetName), @By
|    FROM @lnk AS l
|    WHERE l.ServiceId IS NOT NULL AND l.ResolvedKey IS NOT NULL
|      AND NOT EXISTS (SELECT 1 FROM cfg.CmdbServiceAsset AS m WHERE m.ServiceId = l.ServiceId AND m.AssetKey = l.ResolvedKey AND m.UnlinkedAt IS NULL)
|    GROUP BY l.ServiceId, l.ResolvedKey;
|    SET @linksAdded = @@ROWCOUNT;
|    INSERT cfg.CmdbImport (Source, Kind, Origin, Sha256, ImportedBy, Outcome, Message, ServicesAdded, ServicesUpdated, ServicesRetired, ServicesSkipped, ServicesUnchanged, LinksAdded, LinksRemoved, LinksRejected, RejectedJson)
|    VALUES (@Source, @Kind, @Origin, @Sha256, @By, @outcome, @Reason, @added, @updated, @retired, @skipped, @unchanged, @linksAdded, @linksRemoved, @linksRejected, @rejected);
|    SET @importId = CONVERT(BIGINT, SCOPE_IDENTITY());
|    INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|    VALUES (N''cmdb/import/'' + CONVERT(NVARCHAR(20), @importId), N''cmdb'', N''cmdb-import'', N''Set'', NULL,
|            (SELECT @Source AS source, @Kind AS kind, @Origin AS origin, @added AS servicesAdded, @updated AS servicesUpdated, @retired AS servicesRetired, @skipped AS servicesSkipped,
|                    @linksAdded AS linksAdded, @linksRemoved AS linksRemoved, @linksRejected AS linksRejected FOR JSON PATH, WITHOUT_ARRAY_WRAPPER),
|            @By, @Reason);
|    IF @Kind = N''migration''
|        INSERT cfg.InstallState (Name, Value, UpdatedBy)
|        VALUES (N''CmdbMigration'', LEFT(CONVERT(NVARCHAR(30), @now, 120) + N'': '' + CONVERT(NVARCHAR(12), @added) + N'' service(s), '' + CONVERT(NVARCHAR(12), @linksAdded) + N'' link(s) from '' + COALESCE(@Origin, N''a CMDB.csv''), 400), @By);
|    COMMIT;
|    SELECT @outcome AS Outcome, @why AS Message, @importId AS ImportId, @added AS ServicesAdded, @updated AS ServicesUpdated, @retired AS ServicesRetired, @skipped AS ServicesSkipped, @unchanged AS ServicesUnchanged,
|           @linksAdded AS LinksAdded, @linksRemoved AS LinksRemoved, @linksRejected AS LinksRejected, @rejected AS RejectedJson;
|END');
|
|-- =============================================================================================
|
|-- ASSET RESPONSIBILITY (REQUIREMENTS #254, phase 1): departments own assets and security recommendations.
|-- The data sync resolves every finding to a department (sidata.Finding.DepartmentId + its SOURCE) with this precedence:
|--   1. a RECOMMENDATION override (cfg.ResponsibilityOverride, Scope 'recommendation': one ConfigurationId / CVE, every asset)
|--   2. an ASSET override (Scope 'asset')
|--   3. the policy: its sources in the order the settings name (SI_Pro_Responsibility_Sources, default tags then rules) --
|--      the platform tags named in SI_Pro_Responsibility_TagNames, then the SI definitions in cfg.ResponsibilityRule
|--   4. the default department (SI_Pro_Responsibility_DefaultDepartment), else Unassigned.
|-- A department is never removed (findings already stamped with it keep pointing at it): retiring sets RetiredAt, and a
|-- retired department takes part in no resolution. Every write here is logged in cfg.ChangeLog (Kind 'department' or
|-- 'responsibility'). The tables carry no kind / role CHECK: the lists grow (see the note on cfg.Template above).
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.Department') IS NULL
|CREATE TABLE cfg.Department (
|    DepartmentId           INT IDENTITY(1,1) NOT NULL CONSTRAINT PK_Department PRIMARY KEY,
|    Name                   NVARCHAR(128)   NOT NULL,
|    Mail                   NVARCHAR(256)   NULL,       -- the department's shared mailbox (optional)
|    Description            NVARCHAR(400)   NULL,
|    MatchValues            NVARCHAR(1000)  NULL,       -- ';'-separated tag values that also mean this department (a cost centre number, an owner name)
|    MaintenanceWindowsJson NVARCHAR(MAX)   NULL,       -- captured now; used by the remediation flows of a later phase
|    CreatedAt              DATETIME2(0)    NOT NULL CONSTRAINT DF_Department_CreatedAt DEFAULT SYSUTCDATETIME(),
|    CreatedBy              NVARCHAR(256)   NOT NULL,
|    UpdatedAt              DATETIME2(0)    NOT NULL CONSTRAINT DF_Department_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy              NVARCHAR(256)   NOT NULL,
|    RetiredAt              DATETIME2(0)    NULL,
|    RetiredBy              NVARCHAR(256)   NULL,
|    RowVersion             ROWVERSION      NOT NULL,
|    CONSTRAINT UQ_Department_Name UNIQUE (Name),
|    CONSTRAINT CK_Department_Windows CHECK (MaintenanceWindowsJson IS NULL OR ISJSON(MaintenanceWindowsJson) = 1)
|);
|
|-- The department's PEOPLE, one row per (person, role). Role (validated in code, no CHECK -- the list grows):
|--   technical-owner  fixes things; receives the operational reviews (a later phase)
|--   business-owner   accountable; receives the monthly status report
|--   technical-approver  approves planning a fix into the department's maintenance window (#335)
|--   business-approver   approves accepting a risk raised from the department -- its exemption requests (#335)
|--   (approver           the single approver role before #335 -- READ as business-approver by the web app; the schema
|--                        never rewrites data -- the next save of the department's people table stores it as business-approver)
|--   delegate         works on the department's findings
|--   advisor          an external consultant / company trusted by the owners (reviews and second checks come later)
|-- A person is an Entra user or group (ObjectId) OR, for someone without an Entra object (an external advisor before a
|-- guest account exists), only a mail address. IsExternal marks people from outside the organisation.
|IF OBJECT_ID('cfg.DepartmentMember') IS NULL
|CREATE TABLE cfg.DepartmentMember (
|    MemberId      INT IDENTITY(1,1) NOT NULL CONSTRAINT PK_DepartmentMember PRIMARY KEY,
|    DepartmentId  INT             NOT NULL CONSTRAINT FK_DepartmentMember_Department REFERENCES cfg.Department (DepartmentId),
|    Role          NVARCHAR(24)    NOT NULL,
|    ObjectId      NVARCHAR(64)    NULL,
|    PrincipalType NVARCHAR(8)     NOT NULL,
|    DisplayName   NVARCHAR(256)   NOT NULL,
|    Mail          NVARCHAR(256)   NULL,
|    Company       NVARCHAR(256)   NULL,
|    IsExternal    BIT             NOT NULL CONSTRAINT DF_DepartmentMember_IsExternal DEFAULT 0,
|    AddedAt       DATETIME2(0)    NOT NULL CONSTRAINT DF_DepartmentMember_AddedAt DEFAULT SYSUTCDATETIME(),
|    AddedBy       NVARCHAR(256)   NOT NULL,
|    CONSTRAINT CK_DepartmentMember_Type CHECK (PrincipalType IN ('user', 'group', 'mail')),
|    CONSTRAINT CK_DepartmentMember_Who CHECK (ObjectId IS NOT NULL OR Mail IS NOT NULL)
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'UX_DepartmentMember_Object' AND object_id = OBJECT_ID('cfg.DepartmentMember'))
|CREATE UNIQUE INDEX UX_DepartmentMember_Object ON cfg.DepartmentMember (DepartmentId, Role, ObjectId) WHERE ObjectId IS NOT NULL;
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'UX_DepartmentMember_Mail' AND object_id = OBJECT_ID('cfg.DepartmentMember'))
|CREATE UNIQUE INDEX UX_DepartmentMember_Mail ON cfg.DepartmentMember (DepartmentId, Role, Mail) WHERE ObjectId IS NULL;
|
|-- sign-in: which departments does this object id (a user, or a group in the token) belong to
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_DepartmentMember_ObjectId' AND object_id = OBJECT_ID('cfg.DepartmentMember'))
|CREATE INDEX IX_DepartmentMember_ObjectId ON cfg.DepartmentMember (ObjectId) INCLUDE (DepartmentId, Role);
|
|-- The SI DEFINITIONS of the responsibility policy: first matching rule (lowest SortOrder) wins. Kind (validated in code):
|--   name     the asset name matches Pattern (* and ? wildcards)
|--   kind     the asset kind equals Pattern (endpoint | identity | azure | publicip)
|--   service  the CMDB / business service the profile placed the asset in matches Pattern
|--   group    a group the asset is in matches Pattern (Defender machine group, Azure resource group / subscription)
|--   tag      any platform tag matches Pattern ("Name=Value", or the value alone)
|IF OBJECT_ID('cfg.ResponsibilityRule') IS NULL
|CREATE TABLE cfg.ResponsibilityRule (
|    RuleId        INT IDENTITY(1,1) NOT NULL CONSTRAINT PK_ResponsibilityRule PRIMARY KEY,
|    Kind          NVARCHAR(16)    NOT NULL,
|    Pattern       NVARCHAR(400)   NOT NULL,
|    DepartmentId  INT             NOT NULL CONSTRAINT FK_ResponsibilityRule_Department REFERENCES cfg.Department (DepartmentId),
|    SortOrder     INT             NOT NULL,
|    Enabled       BIT             NOT NULL CONSTRAINT DF_ResponsibilityRule_Enabled DEFAULT 1,
|    Note          NVARCHAR(400)   NULL,
|    CreatedAt     DATETIME2(0)    NOT NULL CONSTRAINT DF_ResponsibilityRule_CreatedAt DEFAULT SYSUTCDATETIME(),
|    CreatedBy     NVARCHAR(256)   NOT NULL,
|    UpdatedAt     DATETIME2(0)    NOT NULL CONSTRAINT DF_ResponsibilityRule_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy     NVARCHAR(256)   NOT NULL
|);
|
|-- OVERRIDES: one row per override, never removed -- revoking stamps RevokedAt (as cfg.Exemption). At most one ACTIVE
|-- override per asset and per recommendation. RecommendationKey = the finding's ConfigurationId (a CVE id on a CVE finding).
|IF OBJECT_ID('cfg.ResponsibilityOverride') IS NULL
|CREATE TABLE cfg.ResponsibilityOverride (
|    OverrideId        BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_ResponsibilityOverride PRIMARY KEY,
|    Scope             NVARCHAR(16)    NOT NULL,
|    AssetKey          NVARCHAR(400)   NULL,
|    RecommendationKey NVARCHAR(256)   NULL,
|    DepartmentId      INT             NOT NULL CONSTRAINT FK_ResponsibilityOverride_Department REFERENCES cfg.Department (DepartmentId),
|    Reason            NVARCHAR(400)   NOT NULL,
|    CreatedAt         DATETIME2(0)    NOT NULL CONSTRAINT DF_ResponsibilityOverride_CreatedAt DEFAULT SYSUTCDATETIME(),
|    CreatedBy         NVARCHAR(256)   NOT NULL,
|    RevokedAt         DATETIME2(0)    NULL,
|    RevokedBy         NVARCHAR(256)   NULL,
|    CONSTRAINT CK_ResponsibilityOverride_What CHECK (
|        (Scope = 'asset' AND AssetKey IS NOT NULL AND RecommendationKey IS NULL) OR
|        (Scope = 'recommendation' AND RecommendationKey IS NOT NULL AND AssetKey IS NULL))
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'UX_ResponsibilityOverride_Active' AND object_id = OBJECT_ID('cfg.ResponsibilityOverride'))
|CREATE UNIQUE INDEX UX_ResponsibilityOverride_Active ON cfg.ResponsibilityOverride (Scope, AssetKey, RecommendationKey) WHERE RevokedAt IS NULL;
|
|-- The business owners' MONTHLY REPORT: one row per department per month it was sent for, so a day the relay failed is
|-- tried again on the next daily run and a month is never sent twice.
|IF OBJECT_ID('cfg.DepartmentReport') IS NULL
|CREATE TABLE cfg.DepartmentReport (
|    DepartmentId  INT             NOT NULL,
|    [Month]       CHAR(7)         NOT NULL,   -- yyyy-MM, the month reported on
|    SentAt        DATETIME2(0)    NOT NULL CONSTRAINT DF_DepartmentReport_SentAt DEFAULT SYSUTCDATETIME(),
|    Recipients    INT             NOT NULL,
|    CONSTRAINT PK_DepartmentReport PRIMARY KEY (DepartmentId, [Month])
|);
|
|-- EXEMPTIONS AS A GOVERNED FLOW (#252): owners and approvers per security domain, request -> approve, review, mail.
|-- 🔑 cfg.Exemption stays THE table the engines read, and only APPROVED exemptions are ever written to it: a request
|-- lives in cfg.ExemptionRequest (+ its items) until an approver decides it, and approval writes the cfg.Exemption rows.
|-- An engine that knows nothing of requests therefore cannot apply one that is still waiting or was rejected.
|-- States: request requested | approved | rejected; an approved exemption is active until it expires (ExpiresAt) or is
|-- ended (RevokedAt -- the existing "revoke"). Every step is logged in cfg.ChangeLog (Scope 'exemption').
|-- ---------------------------------------------------------------------------------------------
|
|-- Who is accountable for, and who decides, the exemptions of a security domain (Endpoint, Identity, Azure, PublicIP, or
|-- any domain the data has; '*' = every domain). One row per person per role; removing someone stamps RemovedAt (a
|-- re-added person clears it). Logged in cfg.ChangeLog (Name 'domain-role/<domain>/<role>', Scope 'domain-role').
|--   owner     accountable: receives the monthly review and the expiry warnings, and reviews (extend / end / keep)
|--   approver  decides requests (approve / reject, with a comment)
|IF OBJECT_ID('cfg.DomainRole') IS NULL
|CREATE TABLE cfg.DomainRole (
|    Domain      NVARCHAR(64)    NOT NULL,
|    Role        NVARCHAR(16)    NOT NULL,
|    Principal   NVARCHAR(256)   NOT NULL,   -- the person's UPN / e-mail address, lower case
|    AddedAt     DATETIME2(0)    NOT NULL CONSTRAINT DF_DomainRole_AddedAt DEFAULT SYSUTCDATETIME(),
|    AddedBy     NVARCHAR(256)   NOT NULL,
|    RemovedAt   DATETIME2(0)    NULL,
|    RemovedBy   NVARCHAR(256)   NULL,
|    CONSTRAINT PK_DomainRole PRIMARY KEY (Domain, Role, Principal),
|    CONSTRAINT CK_DomainRole_Role CHECK (Role IN ('owner', 'approver'))
|);
|
|-- One request: the same reason, end date and approver for 1..N findings of ONE security domain (a bulk request over
|-- several domains is split into one request per domain, so each domain's approvers decide their own part).
|IF OBJECT_ID('cfg.ExemptionRequest') IS NULL
|CREATE TABLE cfg.ExemptionRequest (
|    RequestId       BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_ExemptionRequest PRIMARY KEY,
|    Domain          NVARCHAR(64)    NOT NULL,
|    Reason          NVARCHAR(400)   NOT NULL,
|    ExpiresAt       DATETIME2(0)    NULL,       -- NULL only when open-ended exemptions are allowed (a setting, off by default)
|    Approver        NVARCHAR(256)   NULL,       -- the approver the requester asked (NULL = any approver of the domain)
|    State           NVARCHAR(16)    NOT NULL CONSTRAINT DF_ExemptionRequest_State DEFAULT 'requested',
|    RequestedBy     NVARCHAR(256)   NOT NULL,
|    RequestedAt     DATETIME2(0)    NOT NULL CONSTRAINT DF_ExemptionRequest_RequestedAt DEFAULT SYSUTCDATETIME(),
|    DecidedBy       NVARCHAR(256)   NULL,
|    DecidedAt       DATETIME2(0)    NULL,
|    DecisionComment NVARCHAR(400)   NULL,
|    ItemCount       INT             NOT NULL,
|    Source          NVARCHAR(32)    NULL,       -- where it was asked from: findings | collection | direct
|    CONSTRAINT CK_ExemptionRequest_State CHECK (State IN ('requested', 'approved', 'rejected'))
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ExemptionRequest_State' AND object_id = OBJECT_ID('cfg.ExemptionRequest'))
|CREATE INDEX IX_ExemptionRequest_State ON cfg.ExemptionRequest (State, Domain, RequestedAt);
|
|-- The findings of a request, in the exemption's own words (scope + what). ExemptionId = the cfg.Exemption row the item
|-- became when the request was approved (or the active one that already covered it).
|IF OBJECT_ID('cfg.ExemptionRequestItem') IS NULL
|CREATE TABLE cfg.ExemptionRequestItem (
|    RequestId       BIGINT          NOT NULL,
|    ItemNo          INT             NOT NULL,
|    Scope           NVARCHAR(16)    NOT NULL,
|    ReportName      NVARCHAR(128)   NULL,
|    ConfigurationId NVARCHAR(128)   NULL,
|    Cve             NVARCHAR(32)    NULL,
|    AssetKey        NVARCHAR(256)   NULL,
|    AssetName       NVARCHAR(400)   NULL,
|    Title           NVARCHAR(400)   NULL,
|    ExemptionId     BIGINT          NULL,
|    CONSTRAINT PK_ExemptionRequestItem PRIMARY KEY (RequestId, ItemNo),
|    CONSTRAINT CK_ExemptionRequestItem_Scope CHECK (Scope IN ('finding', 'issue', 'asset')),
|    CONSTRAINT CK_ExemptionRequestItem_What CHECK (
|        (Scope = 'finding' AND AssetKey IS NOT NULL AND (Cve IS NOT NULL OR ConfigurationId IS NOT NULL)) OR
|        (Scope = 'issue'   AND AssetKey IS NULL     AND (Cve IS NOT NULL OR ConfigurationId IS NOT NULL)) OR
|        (Scope = 'asset'   AND AssetKey IS NOT NULL AND Cve IS NULL AND ConfigurationId IS NULL))
|);
|
|-- cfg.Exemption, additive: which request it came from, its security domain, who approved it and when, and the last
|-- review (an owner's extend or keep). NULL on every row made before #252 -- such a row reads "approved by its creator"
|-- and belongs to the '*' (every domain) owners until it has a domain.
|IF COL_LENGTH('cfg.Exemption', 'RequestId') IS NULL
|ALTER TABLE cfg.Exemption ADD RequestId BIGINT NULL;
|
|IF COL_LENGTH('cfg.Exemption', 'Domain') IS NULL
|ALTER TABLE cfg.Exemption ADD Domain NVARCHAR(64) NULL;
|
|IF COL_LENGTH('cfg.Exemption', 'ApprovedBy') IS NULL
|ALTER TABLE cfg.Exemption ADD ApprovedBy NVARCHAR(256) NULL;
|
|IF COL_LENGTH('cfg.Exemption', 'ApprovedAt') IS NULL
|ALTER TABLE cfg.Exemption ADD ApprovedAt DATETIME2(0) NULL;
|
|IF COL_LENGTH('cfg.Exemption', 'ReviewedBy') IS NULL
|ALTER TABLE cfg.Exemption ADD ReviewedBy NVARCHAR(256) NULL;
|
|IF COL_LENGTH('cfg.Exemption', 'ReviewedAt') IS NULL
|ALTER TABLE cfg.Exemption ADD ReviewedAt DATETIME2(0) NULL;
|
|-- SECURITY DOMAIN OWNERS (level 1) AND SECURITY CATEGORY OWNERS (level 2) (#283). Level 1 = cfg.DomainRole above (the
|-- finding's SecurityDomain). Level 2 = the finding's Category inside that domain, exactly as the Risk Analysis reports
|-- carry it (Identity / Authentication, Endpoint / Vulnerabilities, ...). Its own table, because cfg.DomainRole's key
|-- (Domain, Role, Principal) cannot take a category without being dropped and this file only adds. Owners at either
|-- level decide the requests of their scope -- the category's owners when it has any, else the domain's -- and receive
|-- the monthly review of their scope. Role 'owner' (validated by the web app, no CHECK: a list that grows needs no
|-- schema change). Removing someone stamps RemovedAt. Logged in cfg.ChangeLog (Name
|-- 'domain-role/<domain>/<category>/owner', Scope 'domain-role', Kind 'domain-role').
|IF OBJECT_ID('cfg.CategoryRole') IS NULL
|CREATE TABLE cfg.CategoryRole (
|    Domain      NVARCHAR(64)    NOT NULL,
|    Category    NVARCHAR(128)   NOT NULL,
|    Role        NVARCHAR(16)    NOT NULL,
|    Principal   NVARCHAR(256)   NOT NULL,   -- the person's UPN / e-mail address, lower case
|    AddedAt     DATETIME2(0)    NOT NULL CONSTRAINT DF_CategoryRole_AddedAt DEFAULT SYSUTCDATETIME(),
|    AddedBy     NVARCHAR(256)   NOT NULL,
|    RemovedAt   DATETIME2(0)    NULL,
|    RemovedBy   NVARCHAR(256)   NULL,
|    CONSTRAINT PK_CategoryRole PRIMARY KEY (Domain, Category, Role, Principal)
|);
|
|-- A request's Category = the category whose owners decide it (NULL = the domain's owners / approvers decide it); an
|-- item's and an exemption's Category = the finding's own category, so the monthly review of a category owner lists
|-- exactly the exemptions of that category. NULL on every row made before #283.
|IF COL_LENGTH('cfg.ExemptionRequest', 'Category') IS NULL
|ALTER TABLE cfg.ExemptionRequest ADD Category NVARCHAR(128) NULL;
|
|IF COL_LENGTH('cfg.ExemptionRequestItem', 'Category') IS NULL
|ALTER TABLE cfg.ExemptionRequestItem ADD Category NVARCHAR(128) NULL;
|
|IF COL_LENGTH('cfg.Exemption', 'Category') IS NULL
|ALTER TABLE cfg.Exemption ADD Category NVARCHAR(128) NULL;
|
|-- #391: a request made on a DEPARTMENT's own page records that department and who it was routed to, for the audit:
|-- Routing 'department-business-approver' = asked of (and decided by) that department's business approvers;
|-- 'department-no-business-approver' = the department had none, so the domain / category owners decide it. NULL on
|-- every request made anywhere else (and on every row made before #391).
|IF COL_LENGTH('cfg.ExemptionRequest', 'DepartmentId') IS NULL
|ALTER TABLE cfg.ExemptionRequest ADD DepartmentId INT NULL;
|
|IF COL_LENGTH('cfg.ExemptionRequest', 'Routing') IS NULL
|ALTER TABLE cfg.ExemptionRequest ADD Routing NVARCHAR(32) NULL;
|
|-- THE EXEMPTION MAIL OUTBOX. The web app never talks to a mail server: it QUEUES a request mail (to the approvers) and
|-- a decision mail (to the requester) here, and the close-loop mail job sends them through the Risk Analysis SMTP
|-- transports -- the one mail path -- and stamps SentAt. The same job queues and sends the expiry warnings and the
|-- monthly review (Kind expiry | review) and records them here, which is also how it knows what it already sent:
|-- PeriodKey 'yyyy-MM' for a monthly review, ItemsJson [{"id":..,"expiresAt":".."}] for an expiry warning -- per recipient
|-- in ToList (#283: one review and one warning per OWNER, covering every domain and category they own).
|IF OBJECT_ID('cfg.ExemptionMail') IS NULL
|CREATE TABLE cfg.ExemptionMail (
|    MailId      BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_ExemptionMail PRIMARY KEY,
|    Kind        NVARCHAR(16)    NOT NULL,   -- request | decision | expiry | review
|    RequestId   BIGINT          NULL,
|    Domain      NVARCHAR(64)    NULL,
|    PeriodKey   NVARCHAR(16)    NULL,
|    ToList      NVARCHAR(2000)  NOT NULL,   -- addresses separated by ';'
|    Subject     NVARCHAR(400)   NOT NULL,
|    BodyHtml    NVARCHAR(MAX)   NOT NULL,
|    ItemsJson   NVARCHAR(MAX)   NULL,
|    QueuedAt    DATETIME2(0)    NOT NULL CONSTRAINT DF_ExemptionMail_QueuedAt DEFAULT SYSUTCDATETIME(),
|    QueuedBy    NVARCHAR(256)   NOT NULL,
|    SentAt      DATETIME2(0)    NULL,
|    Attempts    INT             NOT NULL CONSTRAINT DF_ExemptionMail_Attempts DEFAULT 0,
|    LastError   NVARCHAR(1000)  NULL,
|    CONSTRAINT CK_ExemptionMail_Kind CHECK (Kind IN ('request', 'decision', 'expiry', 'review')),
|    CONSTRAINT CK_ExemptionMail_ItemsJson CHECK (ItemsJson IS NULL OR ISJSON(ItemsJson) = 1)
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ExemptionMail_Pending' AND object_id = OBJECT_ID('cfg.ExemptionMail'))
|CREATE INDEX IX_ExemptionMail_Pending ON cfg.ExemptionMail (SentAt, Kind, Domain);
|
|-- =============================================================================================
|-- ASSET RESPONSIBILITY, PHASE 2 + 3 (REQUIREMENTS #254): the GOVERNANCE LOG per finding, the technical owners'
|-- notifications and monthly review, and the REMEDIATION FLOWS per department x category / subcategory.
|-- A finding is identified across collections by (AssetKey, RecommendationKey) -- RecommendationKey = the finding's
|-- ConfigurationId, else its CVE id (the key the overrides of phase 1 use). Statuses and flow actions are validated in
|-- code, no CHECK (the lists grow). Nothing here is ever removed: an entry is appended, a flow is retired. Every web write
|-- is ONE transaction with its cfg.ChangeLog row (Kind 'governance' / 'remediation').
|-- SecurityInsight stays READ-ONLY toward Defender / Intune / Entra / ARM: "Auto in the maintenance window" records an
|-- approved, SCHEDULED state here and tells the technical owners -- it never pushes a change to a platform.
|-- ---------------------------------------------------------------------------------------------
|-- The LOG: every comment and every status change, append-only. Status NULL = a comment that does not change the status.
|--   Source      web | flow (a remediation flow applied it) | sync (the mail job, after a data sync)
|--   Status      open | in-progress | planned | fixed-pending-verification | accepted | escalated | not-applicable
|--   FlowId      the remediation flow that produced it (cfg.RemediationFlow), when one did
|--   ScheduledFor the start of the maintenance window an 'Auto' flow scheduled the fix for (UTC)
|--   ExemptionRequestId  'accepted' = the exemption request (#252) it raised; the risk is accepted only once approved
|IF OBJECT_ID('cfg.GovernanceEntry') IS NULL
|CREATE TABLE cfg.GovernanceEntry (
|    EntryId             BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_GovernanceEntry PRIMARY KEY,
|    AssetKey            NVARCHAR(400)   NOT NULL,
|    RecommendationKey   NVARCHAR(256)   NOT NULL,
|    DepartmentId        INT             NULL,       -- the department responsible when it was written (NULL = Unassigned)
|    Status              NVARCHAR(32)    NULL,
|    Comment             NVARCHAR(2000)  NOT NULL,
|    Source              NVARCHAR(16)    NOT NULL,
|    FlowId              INT             NULL,
|    ScheduledFor        DATETIME2(0)    NULL,
|    ExemptionRequestId  BIGINT          NULL,
|    CollectionId        INT             NULL,       -- the collection the finding was seen in when it was written
|    CreatedAt           DATETIME2(0)    NOT NULL CONSTRAINT DF_GovernanceEntry_CreatedAt DEFAULT SYSUTCDATETIME(),
|    CreatedBy           NVARCHAR(256)   NOT NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_GovernanceEntry_Finding' AND object_id = OBJECT_ID('cfg.GovernanceEntry'))
|CREATE INDEX IX_GovernanceEntry_Finding ON cfg.GovernanceEntry (AssetKey, RecommendationKey, CreatedAt);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_GovernanceEntry_Department' AND object_id = OBJECT_ID('cfg.GovernanceEntry'))
|CREATE INDEX IX_GovernanceEntry_Department ON cfg.GovernanceEntry (DepartmentId, CreatedAt) INCLUDE (Status, Source);
|
|-- The CURRENT status of each finding that has one: the newest log entry with a status, kept in the same transaction as
|-- the entry, so the department page reads one row per finding instead of the whole log.
|IF OBJECT_ID('cfg.GovernanceState') IS NULL
|CREATE TABLE cfg.GovernanceState (
|    AssetKey            NVARCHAR(400)   NOT NULL,
|    RecommendationKey   NVARCHAR(256)   NOT NULL,
|    DepartmentId        INT             NULL,
|    Status              NVARCHAR(32)    NOT NULL,
|    ScheduledFor        DATETIME2(0)    NULL,
|    FlowId              INT             NULL,
|    ExemptionRequestId  BIGINT          NULL,
|    LastEntryId         BIGINT          NOT NULL,
|    UpdatedAt           DATETIME2(0)    NOT NULL CONSTRAINT DF_GovernanceState_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy           NVARCHAR(256)   NOT NULL,
|    CONSTRAINT PK_GovernanceState PRIMARY KEY (AssetKey, RecommendationKey)
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_GovernanceState_Department' AND object_id = OBJECT_ID('cfg.GovernanceState'))
|CREATE INDEX IX_GovernanceState_Department ON cfg.GovernanceState (DepartmentId, Status) INCLUDE (ScheduledFor, UpdatedAt);
|
|-- The REMEDIATION FLOWS: what a department does with a category (the security domain) / subcategory (the report) of
|-- findings. NULL department / '*' category / '*' subcategory = every one; the most specific flow wins, then SortOrder.
|--   Action  auto-window     SI schedules the fix for the department's next maintenance window and tells the technical owners
|--           manual          the technical owners implement it by hand
|--           escalate-vendor the finding goes to the vendor contact below for review (a mail, recorded in the log)
|--           accept-risk     the risk is accepted through the exemption flow (#252) -- an approver decides
|--           not-applicable  recorded as not applicable for the department (the finding itself stays visible)
|-- Retired, never removed (log entries point at it).
|IF OBJECT_ID('cfg.RemediationFlow') IS NULL
|CREATE TABLE cfg.RemediationFlow (
|    FlowId          INT IDENTITY(1,1) NOT NULL CONSTRAINT PK_RemediationFlow PRIMARY KEY,
|    DepartmentId    INT             NULL,
|    Category        NVARCHAR(128)   NOT NULL,   -- a security domain (Endpoint, Identity, Azure, PublicIP, ...) or '*'
|    Subcategory     NVARCHAR(256)   NOT NULL,   -- a Risk Analysis report name, or '*'
|    Action          NVARCHAR(24)    NOT NULL,
|    VendorName      NVARCHAR(256)   NULL,
|    VendorMail      NVARCHAR(256)   NULL,
|    Note            NVARCHAR(400)   NULL,
|    SortOrder       INT             NOT NULL,
|    CreatedAt       DATETIME2(0)    NOT NULL CONSTRAINT DF_RemediationFlow_CreatedAt DEFAULT SYSUTCDATETIME(),
|    CreatedBy       NVARCHAR(256)   NOT NULL,
|    UpdatedAt       DATETIME2(0)    NOT NULL CONSTRAINT DF_RemediationFlow_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy       NVARCHAR(256)   NOT NULL,
|    RetiredAt       DATETIME2(0)    NULL,
|    RetiredBy       NVARCHAR(256)   NULL
|);
|
|-- The TECHNICAL OWNERS' notifications: one row per department per collection notified, so a collection is never
|-- announced twice and a day the relay failed is tried again on the next run.
|IF OBJECT_ID('cfg.GovernanceNotice') IS NULL
|CREATE TABLE cfg.GovernanceNotice (
|    DepartmentId    INT             NOT NULL,
|    CollectionId    INT             NOT NULL,
|    SentAt          DATETIME2(0)    NOT NULL CONSTRAINT DF_GovernanceNotice_SentAt DEFAULT SYSUTCDATETIME(),
|    Items           INT             NOT NULL,
|    Recipients      INT             NOT NULL,
|    CONSTRAINT PK_GovernanceNotice PRIMARY KEY (DepartmentId, CollectionId)
|);
|
|-- The TECHNICAL OWNERS' monthly review: one row per department per month sent (as cfg.DepartmentReport is for the
|-- business owners).
|IF OBJECT_ID('cfg.TechnicalReview') IS NULL
|CREATE TABLE cfg.TechnicalReview (
|    DepartmentId    INT             NOT NULL,
|    [Month]         CHAR(7)         NOT NULL,   -- yyyy-MM, the month reviewed
|    SentAt          DATETIME2(0)    NOT NULL CONSTRAINT DF_TechnicalReview_SentAt DEFAULT SYSUTCDATETIME(),
|    Recipients      INT             NOT NULL,
|    CONSTRAINT PK_TechnicalReview PRIMARY KEY (DepartmentId, [Month])
|);
|
|-- The GOVERNANCE MAIL OUTBOX (vendor escalations). The web app never talks to a mail server: an escalation writes its
|-- log entry AND queues its mail here in one transaction; the close-loop mail job sends it through the Risk Analysis SMTP
|-- transports and stamps SentAt (Kind 'vendor').
|IF OBJECT_ID('cfg.GovernanceMail') IS NULL
|CREATE TABLE cfg.GovernanceMail (
|    MailId      BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_GovernanceMail PRIMARY KEY,
|    Kind        NVARCHAR(16)    NOT NULL,
|    EntryId     BIGINT          NULL,       -- the cfg.GovernanceEntry it belongs to
|    ToList      NVARCHAR(2000)  NOT NULL,   -- addresses separated by ';'
|    Subject     NVARCHAR(400)   NOT NULL,
|    BodyHtml    NVARCHAR(MAX)   NOT NULL,
|    QueuedAt    DATETIME2(0)    NOT NULL CONSTRAINT DF_GovernanceMail_QueuedAt DEFAULT SYSUTCDATETIME(),
|    QueuedBy    NVARCHAR(256)   NOT NULL,
|    SentAt      DATETIME2(0)    NULL,
|    Attempts    INT             NOT NULL CONSTRAINT DF_GovernanceMail_Attempts DEFAULT 0,
|    LastError   NVARCHAR(1000)  NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_GovernanceMail_Pending' AND object_id = OBJECT_ID('cfg.GovernanceMail'))
|CREATE INDEX IX_GovernanceMail_Pending ON cfg.GovernanceMail (SentAt, Kind);
|
|-- =============================================================================================
|-- EXTERNAL ADVISORS AND DEPARTMENT SIGN-IN (REQUIREMENTS #258). Operator decisions 2026-10-04:
|--   * advisors -- an outside consultant (a person) or consultancy (a company) -- are linked to a department and act as a
|--     trusted advisor for its owners: they see that department only, and may comment, recommend and approve there;
|--   * a MAGIC LINK (per person, short-lived, single use, revocable, scoped to the department, every step audited) signs
|--     a person in; APPROVE through a magic link needs a SECOND CHECK -- a one-time code mailed to the same mailbox (or an
|--     Entra sign-in instead of the link);
|--   * OAuth for externals = an Entra B2B guest in this tenant (their home tenant's MFA, Conditional Access applies);
|--     department owners may sign in either way with the same rules.
|-- 🔑 Only HASHES of link tokens and one-time codes are stored (SHA-256; a code's hash is salted). The mail that carries a
|-- link or a code goes through its own outbox (cfg.SignInMail), whose sender blanks the mail's body once it is sent.
|-- Every write is one transaction with its cfg.ChangeLog row: Scope 'department', Kind 'department' (advisors, like the
|-- department's people) or 'signin' (links, sessions, codes; Name 'department-signin/<id>').
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.DepartmentAdvisor') IS NULL
|CREATE TABLE cfg.DepartmentAdvisor (
|    AdvisorId     INT IDENTITY(1,1) NOT NULL CONSTRAINT PK_DepartmentAdvisor PRIMARY KEY,
|    DepartmentId  INT             NOT NULL CONSTRAINT FK_DepartmentAdvisor_Department REFERENCES cfg.Department (DepartmentId),
|    Kind          NVARCHAR(8)     NOT NULL,   -- person | company (validated in code; the list may grow)
|    DisplayName   NVARCHAR(256)   NOT NULL,   -- the person, or the company's name
|    Company       NVARCHAR(256)   NULL,
|    Mail          NVARCHAR(256)   NULL,       -- where links and codes go (a company: its advisory mailbox)
|    ObjectId      NVARCHAR(64)    NULL,       -- the B2B guest's object id in this tenant, once invited (optional)
|    IsExternal    BIT             NOT NULL CONSTRAINT DF_DepartmentAdvisor_IsExternal DEFAULT 1,
|    Note          NVARCHAR(400)   NULL,
|    AddedAt       DATETIME2(0)    NOT NULL CONSTRAINT DF_DepartmentAdvisor_AddedAt DEFAULT SYSUTCDATETIME(),
|    AddedBy       NVARCHAR(256)   NOT NULL,
|    RevokedAt     DATETIME2(0)    NULL,       -- revoked, never deleted: comments and sign-ins keep pointing at the row
|    RevokedBy     NVARCHAR(256)   NULL,
|    RevokeReason  NVARCHAR(400)   NULL,
|    CONSTRAINT CK_DepartmentAdvisor_Who CHECK (Mail IS NOT NULL OR ObjectId IS NOT NULL)
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'UX_DepartmentAdvisor_Mail' AND object_id = OBJECT_ID('cfg.DepartmentAdvisor'))
|CREATE UNIQUE INDEX UX_DepartmentAdvisor_Mail ON cfg.DepartmentAdvisor (DepartmentId, Mail) WHERE RevokedAt IS NULL AND Mail IS NOT NULL;
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_DepartmentAdvisor_Who' AND object_id = OBJECT_ID('cfg.DepartmentAdvisor'))
|CREATE INDEX IX_DepartmentAdvisor_Who ON cfg.DepartmentAdvisor (Mail, ObjectId) INCLUDE (DepartmentId, RevokedAt);
|
|-- One row per issued SIGN-IN LINK; the redeemed link IS the session (RedeemedAt .. SessionExpiresAt). PersonKind 'advisor'
|-- -> cfg.DepartmentAdvisor.AdvisorId, 'member' -> cfg.DepartmentMember.MemberId. TokenHash = SHA-256 of the token. Origin:
|-- admin (sent from the department's admin page) | request (asked for by the person, from a mail's link).
|-- OtpConfirmedAt = the session's second check (the one-time code) passed: it may approve from then on.
|IF OBJECT_ID('cfg.DepartmentSignIn') IS NULL
|CREATE TABLE cfg.DepartmentSignIn (
|    SignInId          BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_DepartmentSignIn PRIMARY KEY,
|    DepartmentId      INT             NOT NULL CONSTRAINT FK_DepartmentSignIn_Department REFERENCES cfg.Department (DepartmentId),
|    PersonKind        NVARCHAR(8)     NOT NULL,
|    PersonId          INT             NOT NULL,
|    Mail              NVARCHAR(256)   NOT NULL,
|    TokenHash         BINARY(32)      NOT NULL,
|    Origin            NVARCHAR(16)    NOT NULL,
|    TargetPath        NVARCHAR(400)   NULL,
|    IssuedAt          DATETIME2(0)    NOT NULL,
|    IssuedBy          NVARCHAR(256)   NOT NULL,
|    ExpiresAt         DATETIME2(0)    NOT NULL,
|    RedeemedAt        DATETIME2(0)    NULL,
|    SessionExpiresAt  DATETIME2(0)    NULL,
|    OtpConfirmedAt    DATETIME2(0)    NULL,
|    RevokedAt         DATETIME2(0)    NULL,
|    RevokedBy         NVARCHAR(256)   NULL,
|    CONSTRAINT UQ_DepartmentSignIn_Token UNIQUE (TokenHash)
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_DepartmentSignIn_Person' AND object_id = OBJECT_ID('cfg.DepartmentSignIn'))
|CREATE INDEX IX_DepartmentSignIn_Person ON cfg.DepartmentSignIn (PersonKind, PersonId, IssuedAt) INCLUDE (DepartmentId, RevokedAt);
|
|-- The ONE-TIME CODES of the second check: salted SHA-256 only, 10 minutes, at most 5 tries, used once.
|IF OBJECT_ID('cfg.DepartmentSignInCode') IS NULL
|CREATE TABLE cfg.DepartmentSignInCode (
|    CodeId        BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_DepartmentSignInCode PRIMARY KEY,
|    SignInId      BIGINT          NOT NULL CONSTRAINT FK_DepartmentSignInCode_SignIn REFERENCES cfg.DepartmentSignIn (SignInId),
|    Salt          BINARY(16)      NOT NULL,
|    CodeHash      BINARY(32)      NOT NULL,
|    IssuedAt      DATETIME2(0)    NOT NULL,
|    ExpiresAt     DATETIME2(0)    NOT NULL,
|    Attempts      INT             NOT NULL CONSTRAINT DF_DepartmentSignInCode_Attempts DEFAULT 0,
|    UsedAt        DATETIME2(0)    NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_DepartmentSignInCode_SignIn' AND object_id = OBJECT_ID('cfg.DepartmentSignInCode'))
|CREATE INDEX IX_DepartmentSignInCode_SignIn ON cfg.DepartmentSignInCode (SignInId, IssuedAt);
|
|-- THE SIGN-IN MAIL OUTBOX: the web app queues a link (Kind 'sign-in') or a one-time code ('sign-in-code') here; the
|-- close-loop mail job sends it with the exemption mails, through the same SMTP path, and BLANKS ITS BODY once sent -- so
|-- the secret is in the database only until the mail goes out. Its own table, not cfg.ExemptionMail: that outbox keeps
|-- its bodies (its Kind CHECK is left as it is), and a sign-in mail older than a day is never sent (the link is dead).
|IF OBJECT_ID('cfg.SignInMail') IS NULL
|CREATE TABLE cfg.SignInMail (
|    MailId      BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_SignInMail PRIMARY KEY,
|    Kind        NVARCHAR(16)    NOT NULL,   -- sign-in | sign-in-code (validated in code)
|    ToList      NVARCHAR(2000)  NOT NULL,
|    Subject     NVARCHAR(400)   NOT NULL,
|    BodyHtml    NVARCHAR(MAX)   NOT NULL,
|    QueuedAt    DATETIME2(0)    NOT NULL CONSTRAINT DF_SignInMail_QueuedAt DEFAULT SYSUTCDATETIME(),
|    QueuedBy    NVARCHAR(256)   NOT NULL,
|    SentAt      DATETIME2(0)    NULL,
|    Attempts    INT             NOT NULL CONSTRAINT DF_SignInMail_Attempts DEFAULT 0,
|    LastError   NVARCHAR(1000)  NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_SignInMail_Pending' AND object_id = OBJECT_ID('cfg.SignInMail'))
|CREATE INDEX IX_SignInMail_Pending ON cfg.SignInMail (SentAt, QueuedAt);
|
|-- =============================================================================================
|-- FINDING COMMENTS (#258): the comments, recommendations and approvals that advisors, department people and the
|-- security team leave on ONE finding. FindingKey = '<asset key>|<recommendation key>' (the recommendation key is the
|-- finding's ConfigurationId, or its CVE id) -- stable across collections, so the thread follows the finding from run to
|-- run. Kind (validated in code): comment | recommend | approve. AuthMethod: how the author signed in (oauth | magiclink |
|-- magiclink+otp); SignInId names the sign-in link session when there was one. Never updated, never deleted.
|-- A minimal, self-contained table: the governance log of #254 phase 2 is built in parallel and may absorb it (its rows
|-- carry everything a governance entry needs). Each write has its cfg.ChangeLog row (Scope 'finding', Kind 'finding-comment').
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.FindingComment') IS NULL
|CREATE TABLE cfg.FindingComment (
|    CommentId          BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_FindingComment PRIMARY KEY,
|    FindingKey         NVARCHAR(700)   NOT NULL,
|    AssetKey           NVARCHAR(400)   NOT NULL,
|    RecommendationKey  NVARCHAR(256)   NOT NULL,
|    DepartmentId       INT             NULL,
|    Kind               NVARCHAR(16)    NOT NULL,
|    Body               NVARCHAR(2000)  NOT NULL,
|    Author             NVARCHAR(256)   NOT NULL,
|    AuthorRole         NVARCHAR(24)    NOT NULL,
|    AuthMethod         NVARCHAR(16)    NOT NULL,
|    SignInId           BIGINT          NULL,
|    CreatedAt          DATETIME2(0)    NOT NULL CONSTRAINT DF_FindingComment_CreatedAt DEFAULT SYSUTCDATETIME()
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_FindingComment_Finding' AND object_id = OBJECT_ID('cfg.FindingComment'))
|CREATE INDEX IX_FindingComment_Finding ON cfg.FindingComment (FindingKey, CreatedAt);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_FindingComment_Department' AND object_id = OBJECT_ID('cfg.FindingComment'))
|CREATE INDEX IX_FindingComment_Department ON cfg.FindingComment (DepartmentId, CreatedAt);
|
|-- =============================================================================================
|-- FOLLOW-UP TASKS ON ONE FINDING (#265): "waiting for X to come back", assigned to a person and due on a date, on ONE
|-- vulnerability on ONE asset -- keyed by (AssetKey, RecommendationKey) like the governance log and the finding
|-- comments, so a task follows the finding from collection to collection. Never deleted: a task is completed or
|-- cancelled (and may be reopened); every change is appended to cfg.FindingTaskHistory and has its cfg.ChangeLog row
|-- (Scope 'finding', Kind 'finding-task', Name 'finding-task/<id>') in the same transaction.
|--   AssigneeKind  user | group (an Entra object id) | member (cfg.DepartmentMember.MemberId) | advisor
|--                 (cfg.DepartmentAdvisor.AdvisorId) -- validated in code, no CHECK (the list may grow)
|--   AssigneeKey   '<kind>:<id>' in lower case: what "My tasks" matches against the signed-in person (their object id,
|--                 the groups in their token, the department person a sign-in link stands for)
|--   Status        open | done | cancelled (validated in code)
|--   DueDate       the day it is due (UTC date); RemindAt an optional earlier day for the digest mail
|--   CreatedByKey  the creator's own key ('user:<oid>', 'member:<id>', 'advisor:<id>' or 'name:<upn>'): "Delegated tasks"
|-- When the vulnerability close-loop (vuln.VulnerabilityItem) closes the finding, the task is shown as "finding
|-- resolved -- close the task?" -- it is never closed or removed automatically.
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.FindingTask') IS NULL
|CREATE TABLE cfg.FindingTask (
|    TaskId             BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_FindingTask PRIMARY KEY,
|    AssetKey           NVARCHAR(400)   NOT NULL,
|    RecommendationKey  NVARCHAR(256)   NOT NULL,
|    AssetName          NVARCHAR(400)   NULL,
|    FindingTitle       NVARCHAR(400)   NULL,
|    DepartmentId       INT             NULL,       -- the finding's department when the task was created (NULL = Unassigned)
|    Title              NVARCHAR(200)   NOT NULL,
|    Note               NVARCHAR(2000)  NULL,
|    AssigneeKind       NVARCHAR(16)    NOT NULL,
|    AssigneeId         NVARCHAR(64)    NOT NULL,
|    AssigneeKey        NVARCHAR(96)    NOT NULL,
|    AssigneeName       NVARCHAR(256)   NOT NULL,
|    AssigneeMail       NVARCHAR(256)   NULL,
|    DueDate            DATE            NOT NULL,
|    RemindAt           DATE            NULL,
|    Status             NVARCHAR(16)    NOT NULL,
|    CreatedAt          DATETIME2(0)    NOT NULL CONSTRAINT DF_FindingTask_CreatedAt DEFAULT SYSUTCDATETIME(),
|    CreatedBy          NVARCHAR(256)   NOT NULL,
|    CreatedByKey       NVARCHAR(300)   NOT NULL,
|    CompletedAt        DATETIME2(0)    NULL,
|    CompletedBy        NVARCHAR(256)   NULL,
|    CompletionNote     NVARCHAR(2000)  NULL,
|    UpdatedAt          DATETIME2(0)    NOT NULL CONSTRAINT DF_FindingTask_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy          NVARCHAR(256)   NOT NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_FindingTask_Assignee' AND object_id = OBJECT_ID('cfg.FindingTask'))
|CREATE INDEX IX_FindingTask_Assignee ON cfg.FindingTask (AssigneeKey, Status, DueDate);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_FindingTask_Creator' AND object_id = OBJECT_ID('cfg.FindingTask'))
|CREATE INDEX IX_FindingTask_Creator ON cfg.FindingTask (CreatedByKey, Status, DueDate);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_FindingTask_Finding' AND object_id = OBJECT_ID('cfg.FindingTask'))
|CREATE INDEX IX_FindingTask_Finding ON cfg.FindingTask (AssetKey, RecommendationKey, CreatedAt);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_FindingTask_Due' AND object_id = OBJECT_ID('cfg.FindingTask'))
|CREATE INDEX IX_FindingTask_Due ON cfg.FindingTask (Status, DueDate) INCLUDE (DepartmentId, AssigneeKey);
|
|-- Every change of a task, append-only: created | completed | cancelled | reopened, with the status it left the task in,
|-- the note given, who and when. The finding's thread shows these rows.
|IF OBJECT_ID('cfg.FindingTaskHistory') IS NULL
|CREATE TABLE cfg.FindingTaskHistory (
|    HistoryId   BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_FindingTaskHistory PRIMARY KEY,
|    TaskId      BIGINT          NOT NULL,
|    Action      NVARCHAR(16)    NOT NULL,
|    Status      NVARCHAR(16)    NOT NULL,
|    Note        NVARCHAR(2000)  NULL,
|    ChangedAt   DATETIME2(0)    NOT NULL CONSTRAINT DF_FindingTaskHistory_ChangedAt DEFAULT SYSUTCDATETIME(),
|    ChangedBy   NVARCHAR(256)   NOT NULL,
|    ChangedByKey NVARCHAR(300)  NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_FindingTaskHistory_Task' AND object_id = OBJECT_ID('cfg.FindingTaskHistory'))
|CREATE INDEX IX_FindingTaskHistory_Task ON cfg.FindingTaskHistory (TaskId, ChangedAt);
|
|-- The daily due / overdue digest (SI_Pro_TaskDigest_SendMail, off by default): one row per assignee per day sent,
|-- written only AFTER the mail went out, so a day the relay fails is tried again and nobody gets two.
|IF OBJECT_ID('cfg.FindingTaskDigest') IS NULL
|CREATE TABLE cfg.FindingTaskDigest (
|    AssigneeKey NVARCHAR(96)    NOT NULL,
|    DigestDay   DATE            NOT NULL,
|    SentAt      DATETIME2(0)    NOT NULL CONSTRAINT DF_FindingTaskDigest_SentAt DEFAULT SYSUTCDATETIME(),
|    Items       INT             NOT NULL,
|    CONSTRAINT PK_FindingTaskDigest PRIMARY KEY (AssigneeKey, DigestDay)
|);
|
|-- =============================================================================================
|-- THE AUDIT TRAIL (#260, framework DOCS\REQUIREMENTS.md AUDIT-1): one row per event, append-only, ONE trail per
|-- install. Every surface writes here: the web app (one 'event' row per mutating request -- success, refusal or error --
|-- and per export, sign-in event, print), the jobs / setup / engines (Write-SIAuditEvent, engine\pro-settings\SI-Audit.ps1)
|-- and, through the trigger below, EVERY cfg.ChangeLog row ('change' rows, in the SAME transaction as the change).
|-- 🔑 Why a NEW table and not new columns on cfg.ChangeLog: ChangeLog's Action carries CHECK (Action IN ('Set','Reset'))
|-- and NOT NULL Name / Scope -- a refusal, an export or a sign-in event is none of those, and widening the CHECK means
|-- dropping it (a verb this file never uses). ChangeLog stays exactly what its ~60 writers and its readers (Change
|-- history per setting, the deviation report, the magic-link nonces, the template releases) expect; the trigger copies
|-- each of its rows into this table, so the ONE trail is complete without touching a writer, and a ChangeLog row and its
|-- audit row commit or roll back together.
|--   RecordType  event = what a person / job / setup did (one per request or step); change = a stored value changed
|--               (copied from cfg.ChangeLog); a change and its event share CorrelationId
|--   Action      dotted domain.object.verb from the CLOSED list config\audit-actions.locked.json (change rows:
|--               <category>.change.set | <category>.change.reset, category from the CASE below)
|--   Actor       UPN / object id / job identity / the sign-in link's person -- never a shared process identity
|--   ActorSource web | job | engine | setup | api | portal
|--   Outcome     ok | error | refused | held (+ OutcomeText, secrets removed)
|--   BeforeJson / AfterJson   the state before / after, or the request -- secrets and tokens NEVER included
|--   WhatIf      1 = a plan / dry run, never read as a change
|--   ScopeDomain / ScopeDepartmentId  what the target belongs to -- the Delegated user's view of the trail filters on it
|--   TsUtc       set HERE (SYSUTCDATETIME), never by a writer
|-- Append-only: no product code updates or deletes a row (a test greps for it), and the DATABASE refuses it too (#289,
|-- the DENY below). Rows older than SI_Pro_AuditRetentionMonths (not set = kept forever; at least 13) are removed ONLY
|-- by the data sync's retention step through cfg.AuditRetentionApply, which records itself here. The web app's identity
|-- gets INSERT + SELECT only (role si_audit_writer below).
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.AuditEvent') IS NULL
|CREATE TABLE cfg.AuditEvent (
|    Id                 BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_AuditEvent PRIMARY KEY,
|    TsUtc              DATETIME2(3)    NOT NULL CONSTRAINT DF_AuditEvent_TsUtc DEFAULT SYSUTCDATETIME(),
|    RecordType         NVARCHAR(8)     NOT NULL CONSTRAINT DF_AuditEvent_RecordType DEFAULT N'event',
|    Action             NVARCHAR(64)    NOT NULL,
|    Actor              NVARCHAR(256)   NOT NULL,
|    ActorSource        NVARCHAR(16)    NULL,
|    Target             NVARCHAR(400)   NULL,
|    Reason             NVARCHAR(400)   NULL,
|    Outcome            NVARCHAR(16)    NOT NULL,
|    OutcomeText        NVARCHAR(1000)  NULL,
|    BeforeJson         NVARCHAR(MAX)   NULL,
|    AfterJson          NVARCHAR(MAX)   NULL,
|    CorrelationId      NVARCHAR(64)    NULL,
|    WhatIf             BIT             NOT NULL CONSTRAINT DF_AuditEvent_WhatIf DEFAULT 0,
|    ScopeDomain        NVARCHAR(64)    NULL,
|    ScopeDepartmentId  INT             NULL,
|    ChangeLogId        BIGINT          NULL,
|    CONSTRAINT CK_AuditEvent_RecordType CHECK (RecordType IN (N'event', N'change')),
|    CONSTRAINT CK_AuditEvent_Outcome CHECK (Outcome IN (N'ok', N'error', N'refused', N'held')),
|    CONSTRAINT CK_AuditEvent_ActorSource CHECK (ActorSource IS NULL OR ActorSource IN (N'web', N'job', N'engine', N'setup', N'api', N'portal'))
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_AuditEvent_TsUtc' AND object_id = OBJECT_ID('cfg.AuditEvent'))
|CREATE INDEX IX_AuditEvent_TsUtc ON cfg.AuditEvent (TsUtc);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_AuditEvent_Correlation' AND object_id = OBJECT_ID('cfg.AuditEvent'))
|CREATE INDEX IX_AuditEvent_Correlation ON cfg.AuditEvent (CorrelationId, RecordType);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_AuditEvent_ChangeLog' AND object_id = OBJECT_ID('cfg.AuditEvent'))
|CREATE INDEX IX_AuditEvent_ChangeLog ON cfg.AuditEvent (ChangeLogId);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_AuditEvent_Action' AND object_id = OBJECT_ID('cfg.AuditEvent'))
|CREATE INDEX IX_AuditEvent_Action ON cfg.AuditEvent (Action, TsUtc);
|
|-- Every cfg.ChangeLog row becomes a 'change' row of the trail, in the inserting transaction. The web app and the
|-- PowerShell writers put the request's correlation id, source and scope into SESSION_CONTEXT (si.audit.*) before a
|-- write, so a change row joins the event that caused it. A value that is not on the closed lists is dropped, never
|-- refused -- the trigger must not be able to fail a change. The category CASE is the same text as in the mapping of the
|-- existing rows below (a test compares the two and the category list in config\audit-actions.locked.json).
|IF OBJECT_ID('cfg.TR_ChangeLog_Audit') IS NULL
|EXEC (N'CREATE TRIGGER cfg.TR_ChangeLog_Audit ON cfg.ChangeLog AFTER INSERT AS
|BEGIN
|    SET NOCOUNT ON;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    DECLARE @dom NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.domain'') AS NVARCHAR(64));
|    DECLARE @dep INT = TRY_CONVERT(INT, CAST(SESSION_CONTEXT(N''si.audit.department'') AS NVARCHAR(16)));
|    IF @src NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @src = NULL;
|    INSERT cfg.AuditEvent (RecordType, Action, Actor, ActorSource, Target, Reason, Outcome, BeforeJson, AfterJson, CorrelationId, ScopeDomain, ScopeDepartmentId, ChangeLogId)
|    SELECT N''change'',
|           /*AUDIT-CATEGORY*/ CASE WHEN c.Scope = N''solution'' OR c.Scope LIKE N''engine:%'' THEN N''setting'' WHEN c.Scope = N''install'' AND c.Name = N''LicenceRequest'' THEN N''licence'' WHEN c.Scope = N''install'' THEN N''template'' WHEN c.Scope = N''department'' AND c.Kind = N''signin'' THEN N''signin'' WHEN c.Scope = N''domain-role'' THEN N''domainrole'' WHEN c.Scope = N''magic-link'' THEN N''magiclink'' WHEN c.Scope IN (N''document'', N''item'', N''template'', N''access'', N''exemption'', N''cmdb'', N''connector'', N''department'', N''finding'', N''governance'', N''remediation'', N''responsibility'', N''job'') THEN c.Scope ELSE N''other'' END /*END-AUDIT-CATEGORY*/
|             + N''.change.'' + CASE WHEN c.Action = N''Reset'' THEN N''reset'' ELSE N''set'' END,
|           LEFT(c.ChangedBy, 256), @src, LEFT(c.Name + N'' ('' + c.Scope + N'')'', 400), LEFT(c.Reason, 400), N''ok'',
|           CASE WHEN c.OldValue IS NULL THEN NULL WHEN ISJSON(c.OldValue) = 1 THEN c.OldValue ELSE N''"'' + STRING_ESCAPE(c.OldValue, ''json'') + N''"'' END,
|           CASE WHEN c.NewValue IS NULL THEN NULL WHEN ISJSON(c.NewValue) = 1 THEN c.NewValue ELSE N''"'' + STRING_ESCAPE(c.NewValue, ''json'') + N''"'' END,
|           @cid, @dom,
|           COALESCE(@dep, CASE WHEN c.Scope = N''department'' AND c.Name LIKE N''department/%'' THEN TRY_CONVERT(INT, SUBSTRING(c.Name, 12, 12)) END),
|           c.ChangeId
|    FROM inserted AS c;
|END');
|
|-- The change history written BEFORE the trail existed, mapped in once (idempotent: a row already carried is skipped).
|-- Its time is the change's own; nothing else is invented -- no correlation, no source.
|IF EXISTS (SELECT 1 FROM sys.columns WHERE object_id = OBJECT_ID('cfg.AuditEvent') AND name = 'ChangeLogId')
|INSERT cfg.AuditEvent (TsUtc, RecordType, Action, Actor, Target, Reason, Outcome, BeforeJson, AfterJson, ScopeDepartmentId, ChangeLogId)
|SELECT c.ChangedAt, N'change',
|       /*AUDIT-CATEGORY*/ CASE WHEN c.Scope = N'solution' OR c.Scope LIKE N'engine:%' THEN N'setting' WHEN c.Scope = N'install' AND c.Name = N'LicenceRequest' THEN N'licence' WHEN c.Scope = N'install' THEN N'template' WHEN c.Scope = N'department' AND c.Kind = N'signin' THEN N'signin' WHEN c.Scope = N'domain-role' THEN N'domainrole' WHEN c.Scope = N'magic-link' THEN N'magiclink' WHEN c.Scope IN (N'document', N'item', N'template', N'access', N'exemption', N'cmdb', N'connector', N'department', N'finding', N'governance', N'remediation', N'responsibility', N'job') THEN c.Scope ELSE N'other' END /*END-AUDIT-CATEGORY*/
|         + N'.change.' + CASE WHEN c.Action = N'Reset' THEN N'reset' ELSE N'set' END,
|       LEFT(c.ChangedBy, 256), LEFT(c.Name + N' (' + c.Scope + N')', 400), LEFT(c.Reason, 400), N'ok',
|       CASE WHEN c.OldValue IS NULL THEN NULL WHEN ISJSON(c.OldValue) = 1 THEN c.OldValue ELSE N'"' + STRING_ESCAPE(c.OldValue, 'json') + N'"' END,
|       CASE WHEN c.NewValue IS NULL THEN NULL WHEN ISJSON(c.NewValue) = 1 THEN c.NewValue ELSE N'"' + STRING_ESCAPE(c.NewValue, 'json') + N'"' END,
|       CASE WHEN c.Scope = N'department' AND c.Name LIKE N'department/%' THEN TRY_CONVERT(INT, SUBSTRING(c.Name, 12, 12)) END,
|       c.ChangeId
|FROM cfg.ChangeLog AS c
|WHERE NOT EXISTS (SELECT 1 FROM cfg.AuditEvent AS a WHERE a.ChangeLogId = c.ChangeId);
|
|-- The WRITER's role: INSERT + SELECT on the trail, and NOTHING that changes or removes a row. The web app's identity is
|-- made a member by pro-management\deploy\Deploy-SIManagement.ps1 (its GRANT hint); the data sync's retention step runs
|-- as the job identity (db_datawriter), not as a member of this role.
|IF DATABASE_PRINCIPAL_ID(N'si_audit_writer') IS NULL
|EXEC (N'CREATE ROLE si_audit_writer');
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT INSERT, SELECT ON OBJECT::cfg.AuditEvent TO si_audit_writer;
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT INSERT, SELECT ON OBJECT::cfg.ChangeLog TO si_audit_writer;
|
|-- #289 (framework AUDIT-1.3): APPEND-ONLY IN THE DATABASE ITSELF, not only by convention. Nobody but the database owner
|-- may change or remove a row of the trail (cfg.AuditEvent) or of the change history it is built from (cfg.ChangeLog --
|-- which also holds the used magic-link nonces, so a removed row would make a used link work again; its writers only
|-- INSERT, and the nonce check only reads, with UPDLOCK, which needs no UPDATE right).
|-- 🔑 DENY, not a trigger: SecurityInsight's runtime identities are ordinary users -- the jobs / engines db_datareader +
|-- db_datawriter, the web app db_datareader + named grants + si_audit_writer, the MCP server and support db_datareader;
|-- none is db_ddladmin or owner, so a DENY binds every one of them (a DENY wins over db_datawriter). The DENY is to
|-- PUBLIC, so it also binds an identity added later, by any name, without a per-install step. (PIM uses an INSTEAD OF
|-- trigger because its runtime identities are db_ddladmin and could undo a DENY; SecurityInsight's cannot.)
|-- Honest limit: the database owner (the server's Entra admin group, i.e. setup) is never bound by a DENY.
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|DENY UPDATE, DELETE ON OBJECT::cfg.AuditEvent TO public;
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|DENY UPDATE, DELETE ON OBJECT::cfg.ChangeLog TO public;
|
|-- The ONE removal of trail rows: the data sync's audited retention step calls this procedure. It is owned by the schema's
|-- owner, so its own DELETE passes the DENY (ownership chaining) -- and it decides what may go, not the caller: at least
|-- 13 months (AUDIT-1.3), never a cutoff younger than that many months before the SERVER's clock, at most @Batch rows,
|-- and only for a caller that holds db_datawriter (the job identity) or owns the database. Anything else is refused with
|-- THROW and nothing is removed. Static SQL only: dynamic SQL would break the ownership chain.
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.AuditRetentionApply @Months INT, @Cutoff DATETIME2(3) = NULL, @Batch INT = 5000
|AS
|BEGIN
|    SET NOCOUNT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_datawriter''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_engine''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1
|        THROW 51289, N''only the data sync job may apply the audit trail retention -- nothing was removed'', 1;
|    IF @Months IS NULL OR @Months < 13
|        THROW 51290, N''the audit trail is kept at least 13 months -- nothing was removed'', 1;
|    IF @Batch IS NULL OR @Batch < 1 SET @Batch = 5000;
|    DECLARE @Floor DATETIME2(3) = DATEADD(MONTH, -@Months, SYSUTCDATETIME());
|    IF @Cutoff IS NULL OR @Cutoff > @Floor SET @Cutoff = @Floor;
|    DELETE TOP (@Batch) FROM cfg.AuditEvent WHERE TsUtc < @Cutoff;
|    SELECT @@ROWCOUNT AS N;
|END');
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.AuditRetentionApply TO public;
|
|-- #302 (framework AUDIT-1.1): WHO ASKED FOR A CHANGE THAT A JOB CARRIES OUT. When the web app hands work to a job -- a
|-- staged change committed (settings, documents, rules, tags, schema overlays, reports, CMDB links, connectors, template
|-- conformance), a setting saved, an exemption request approved, a held close set released, a template release, a job or
|-- the flow started now -- it records HERE, AT COMMIT, one row per changed target: the commit's correlation id (the same id
|-- as the web event and its change rows), the stored row's key, the person who initiated it and the approver when an
|-- approval applied. The job's audit writer (Write-SIAuditEvent) looks the row up -- by the correlation id the web app
|-- passed in the job's environment (SI_AUDIT_CID), or by the target key -- and writes Actor = that person, After.appliedBy
|-- = the job, After.jobRun = its run, After.approvedBy, CorrelationId = the commit id. Keyed by the TARGET, not by the live
|-- row, so a removed row is still attributed after it is gone. A change no person asked for (a schedule, an expiry, a
|-- retention, the close-loop's own closes) finds no row and keeps the job as the actor.
|--   Kind   change   = put in force by the jobs' settings layer at their next run (settings.change.apply)
|--          start    = a job execution a person started (its env carries SI_AUDIT_CID)
|--          release  = a held vulnerability close set released (guard.release.apply)
|--          flow     = the job flow's definition changed (the flow runner names who set it)
|-- Append-only like the trail: the web app INSERTs (WebWriteGrants), the jobs INSERT (a release from a VM's command line)
|-- and SELECT; nobody updates or deletes a row (the DENY below; the newest row of a target wins).
|IF OBJECT_ID('cfg.ChangeAttribution') IS NULL
|CREATE TABLE cfg.ChangeAttribution (
|    AttributionId   BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_ChangeAttribution PRIMARY KEY,
|    CorrelationId   NVARCHAR(64)    NOT NULL,
|    TargetKey       NVARCHAR(400)   NOT NULL,
|    Kind            NVARCHAR(16)    NOT NULL CONSTRAINT DF_ChangeAttribution_Kind DEFAULT N'change',
|    Op              NVARCHAR(16)    NOT NULL CONSTRAINT DF_ChangeAttribution_Op DEFAULT N'set',
|    Title           NVARCHAR(400)   NULL,
|    Actor           NVARCHAR(256)   NOT NULL,
|    ApprovedBy      NVARCHAR(256)   NULL,
|    Source          NVARCHAR(16)    NOT NULL CONSTRAINT DF_ChangeAttribution_Source DEFAULT N'web',
|    CreatedAt       DATETIME2(3)    NOT NULL CONSTRAINT DF_ChangeAttribution_CreatedAt DEFAULT SYSUTCDATETIME(),
|    CONSTRAINT CK_ChangeAttribution_Kind CHECK (Kind IN (N'change', N'start', N'release', N'flow')),
|    CONSTRAINT CK_ChangeAttribution_Op CHECK (Op IN (N'set', N'remove', N'start', N'approve'))
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ChangeAttribution_Target' AND object_id = OBJECT_ID('cfg.ChangeAttribution'))
|CREATE INDEX IX_ChangeAttribution_Target ON cfg.ChangeAttribution (TargetKey, CreatedAt DESC);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ChangeAttribution_Correlation' AND object_id = OBJECT_ID('cfg.ChangeAttribution'))
|CREATE INDEX IX_ChangeAttribution_Correlation ON cfg.ChangeAttribution (CorrelationId);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ChangeAttribution_Kind' AND object_id = OBJECT_ID('cfg.ChangeAttribution'))
|CREATE INDEX IX_ChangeAttribution_Kind ON cfg.ChangeAttribution (Kind, CreatedAt);
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|DENY UPDATE, DELETE ON OBJECT::cfg.ChangeAttribution TO public;
|
|-- =====================================================================================================================
|-- #269 THE DAILY JOB FLOW. Additive and guarded (an existing install only gains these tables).
|--   cfg.JobFlow      the ONE flow definition (FlowId 'daily'): Mode flow | schedules and the definition JSON (the shape
|--                    engine\_shared\SI-JobFlow.ps1 and the web app read: startTime, cadence, steps[job, enabled,
|--                    withPrevious, onFailure, timeoutMinutes]). Written by Operations > Jobs (MERGE + a cfg.ChangeLog row,
|--                    Scope 'job', Name 'flow'); read by the flow runner (caj-si-flow).
|--   cfg.FlowRun      one row per flow run, written by the runner: trigger (schedule | catch-up | interval | manual |
|--                    rerun), state, start / end, the heartbeat (a fresh one = a runner is alive: nothing starts twice),
|--                    the time-of-day slot it ran for and the last slot carried forward (SCHED-1.1), a note (a blocked start).
|--   cfg.FlowStepRun  one row per step of a run: state (Waiting | Starting | Running | Success | Failed | TimedOut |
|--                    Interrupted | Skipped | Disabled), the job execution it started, start / end, error class + text,
|--                    how many times it was started and why it was started again (a container that never started).
|-- The runner writes as the jobs' identity (db_datareader + db_datawriter); the web app only READS the runs.
|-- =====================================================================================================================
|IF OBJECT_ID('cfg.JobFlow') IS NULL
|CREATE TABLE cfg.JobFlow (
|    FlowId          NVARCHAR(32)    NOT NULL CONSTRAINT PK_JobFlow PRIMARY KEY,
|    Mode            NVARCHAR(16)    NOT NULL CONSTRAINT DF_JobFlow_Mode DEFAULT N'flow',
|    DefinitionJson  NVARCHAR(MAX)   NOT NULL,
|    UpdatedAt       DATETIME2(0)    NOT NULL CONSTRAINT DF_JobFlow_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy       NVARCHAR(256)   NULL,
|    CONSTRAINT CK_JobFlow_Mode CHECK (Mode IN (N'flow', N'schedules')),
|    CONSTRAINT CK_JobFlow_Json CHECK (ISJSON(DefinitionJson) = 1)
|);
|
|IF OBJECT_ID('cfg.FlowRun') IS NULL
|CREATE TABLE cfg.FlowRun (
|    FlowRunId       NVARCHAR(64)    NOT NULL CONSTRAINT PK_FlowRun PRIMARY KEY,
|    FlowId          NVARCHAR(32)    NOT NULL CONSTRAINT DF_FlowRun_FlowId DEFAULT N'daily',
|    Day             NVARCHAR(10)    NOT NULL,
|    Trg             NVARCHAR(16)    NOT NULL,
|    FromStep        NVARCHAR(64)    NULL,
|    State           NVARCHAR(16)    NOT NULL,
|    StartedUtc      DATETIME2(0)    NOT NULL,
|    EndedUtc        DATETIME2(0)    NULL,
|    HeartbeatUtc    DATETIME2(0)    NULL,
|    StopReason      NVARCHAR(1000)  NULL,
|    SlotUtc         DATETIME2(0)    NULL,
|    LastSlotUtc     DATETIME2(0)    NULL,
|    Note            NVARCHAR(1000)  NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_FlowRun_Started' AND object_id = OBJECT_ID('cfg.FlowRun'))
|CREATE INDEX IX_FlowRun_Started ON cfg.FlowRun (FlowId, StartedUtc DESC);
|
|IF OBJECT_ID('cfg.FlowStepRun') IS NULL
|CREATE TABLE cfg.FlowStepRun (
|    FlowRunId       NVARCHAR(64)    NOT NULL,
|    StepOrder       INT             NOT NULL,
|    GroupNo         INT             NOT NULL,
|    Job             NVARCHAR(64)    NOT NULL,
|    State           NVARCHAR(16)    NOT NULL,
|    Execution       NVARCHAR(128)   NULL,
|    StartedUtc      DATETIME2(0)    NULL,
|    EndedUtc        DATETIME2(0)    NULL,
|    ErrorClass      NVARCHAR(64)    NULL,
|    Error           NVARCHAR(1000)  NULL,
|    CONSTRAINT PK_FlowStepRun PRIMARY KEY (FlowRunId, StepOrder),
|    CONSTRAINT FK_FlowStepRun_Run FOREIGN KEY (FlowRunId) REFERENCES cfg.FlowRun (FlowRunId)
|);
|
|-- How many times the step's job was started, and why it was started again: a container that never started the engine
|-- (an Azure platform problem) is started again by the runner (working rule 4); a failure of the engine never is.
|IF COL_LENGTH('cfg.FlowStepRun', 'Attempts') IS NULL
|ALTER TABLE cfg.FlowStepRun ADD Attempts INT NULL;
|
|IF COL_LENGTH('cfg.FlowStepRun', 'RetryReason') IS NULL
|ALTER TABLE cfg.FlowStepRun ADD RetryReason NVARCHAR(1000) NULL;
|
|-- The steps by state (ADDED 2026-11-05; owner: "every views must be fast"): the runner and the pipeline pages ask for the
|-- running / waiting steps on every wake-up and every page -- SQL's own missing-index list counted 2,467 scans of the table.
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_FlowStepRun_State' AND object_id = OBJECT_ID('cfg.FlowStepRun'))
|CREATE INDEX IX_FlowStepRun_State ON cfg.FlowStepRun (State) INCLUDE (Job, Execution, StartedUtc, EndedUtc);
|
|-- =====================================================================================================================
|-- #306 PIPELINES AND STAGES. Additive and guarded (an existing install only gains columns and tables).
|--   cfg.JobFlow keeps its name: its DefinitionJson is now schema 2 (a pipeline of stages -- collect, correlate, deliver --
|--   each with its steps, the start time AND its time zone); a schema-1 definition is read as a pipeline (migrated in
|--   memory, losslessly) until it is saved again.
|--   cfg.FlowRun   + Scope (pipeline | stage | step | from-step), Target (the stage id / the job), RequestedBy (who asked
|--                   for a Run now), RequestId (the queue request it served): the run names what was run and by whom.
|--   cfg.FlowStepRun + Stage: the stage each step ran in.
|--   cfg.PipelineLock  ONE row (LockId 'install'): the install's run lock. Every run -- scheduled or Run now, pipeline,
|--                   stage or step -- takes it; the holder beats it on every save of its run record, and a lock whose
|--                   heartbeat is older than 15 minutes is taken over (its runner stopped).
|--   cfg.PipelineQueue the requests that wait for the lock, oldest first: Queued -> Running -> Done (Outcome = the run's
|--                   state) or Cancelled (by a person, while still Queued). The same request (scope + target) is kept once
|--                   while it waits (UX_PipelineQueue_Waiting). The web app writes Queued rows and cancels them; the runner
|--                   (caj-si-flow, woken every 5 minutes or started by the web app) takes them.
|-- =====================================================================================================================
|IF COL_LENGTH('cfg.FlowRun', 'Scope') IS NULL
|ALTER TABLE cfg.FlowRun ADD Scope NVARCHAR(16) NULL;
|
|IF COL_LENGTH('cfg.FlowRun', 'Target') IS NULL
|ALTER TABLE cfg.FlowRun ADD Target NVARCHAR(64) NULL;
|
|IF COL_LENGTH('cfg.FlowRun', 'RequestedBy') IS NULL
|ALTER TABLE cfg.FlowRun ADD RequestedBy NVARCHAR(256) NULL;
|
|IF COL_LENGTH('cfg.FlowRun', 'RequestId') IS NULL
|ALTER TABLE cfg.FlowRun ADD RequestId BIGINT NULL;
|
|IF COL_LENGTH('cfg.FlowStepRun', 'Stage') IS NULL
|ALTER TABLE cfg.FlowStepRun ADD Stage NVARCHAR(32) NULL;
|
|IF OBJECT_ID('cfg.PipelineLock') IS NULL
|CREATE TABLE cfg.PipelineLock (
|    LockId          NVARCHAR(32)    NOT NULL CONSTRAINT PK_PipelineLock PRIMARY KEY,
|    Holder          NVARCHAR(128)   NULL,
|    What            NVARCHAR(200)   NULL,
|    FlowRunId       NVARCHAR(64)    NULL,
|    AcquiredUtc     DATETIME2(0)    NULL,
|    HeartbeatUtc    DATETIME2(0)    NULL
|);
|
|IF OBJECT_ID('cfg.PipelineQueue') IS NULL
|CREATE TABLE cfg.PipelineQueue (
|    Id              BIGINT          IDENTITY(1,1) NOT NULL CONSTRAINT PK_PipelineQueue PRIMARY KEY,
|    PipelineId      NVARCHAR(32)    NOT NULL CONSTRAINT DF_PipelineQueue_PipelineId DEFAULT N'daily',
|    Scope           NVARCHAR(16)    NOT NULL,
|    Target          NVARCHAR(64)    NOT NULL CONSTRAINT DF_PipelineQueue_Target DEFAULT N'',
|    Trg             NVARCHAR(16)    NOT NULL,
|    RequestedBy     NVARCHAR(256)   NULL,
|    RequestedUtc    DATETIME2(0)    NOT NULL CONSTRAINT DF_PipelineQueue_RequestedUtc DEFAULT SYSUTCDATETIME(),
|    SlotUtc         DATETIME2(0)    NULL,
|    Note            NVARCHAR(1000)  NULL,
|    State           NVARCHAR(16)    NOT NULL CONSTRAINT DF_PipelineQueue_State DEFAULT N'Queued',
|    FlowRunId       NVARCHAR(64)    NULL,
|    Outcome         NVARCHAR(16)    NULL,
|    StartedUtc      DATETIME2(0)    NULL,
|    EndedUtc        DATETIME2(0)    NULL,
|    CancelledBy     NVARCHAR(256)   NULL,
|    CONSTRAINT CK_PipelineQueue_Scope CHECK (Scope IN (N'pipeline', N'stage', N'step', N'from-step')),
|    CONSTRAINT CK_PipelineQueue_State CHECK (State IN (N'Queued', N'Running', N'Done', N'Cancelled'))
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'UX_PipelineQueue_Waiting' AND object_id = OBJECT_ID('cfg.PipelineQueue'))
|CREATE UNIQUE INDEX UX_PipelineQueue_Waiting ON cfg.PipelineQueue (PipelineId, Scope, Target) WHERE State = N'Queued';
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_PipelineQueue_State' AND object_id = OBJECT_ID('cfg.PipelineQueue'))
|CREATE INDEX IX_PipelineQueue_State ON cfg.PipelineQueue (PipelineId, State, Id);
|
|-- =====================================================================================================================
|-- #700 CANCEL THE RUNNING PIPELINE RUN. Additive and guarded (an existing install gains two nullable columns when the
|-- update applies this schema again -- its database step runs before any roll).
|--   cfg.FlowRun + Version     the SecurityInsight version the run STARTED on (the runner writes it once): the updater cancels
|--                             a run that started on another version, so a run never finishes on the wrong release.
|--               + CancelledBy who cancelled the run (Operations > Jobs, a support start of the runner, the update). A
|--                             cancelled run has State 'Cancelled' (no CHECK on the column) and StopReason "cancelled by
|--                             <who>: <why>"; it is a finished run -- the scheduler never resumes it, and a runner that is
|--                             still alive never saves it back (engine\_shared\SI-JobFlow.ps1 SaveRun).
|-- =====================================================================================================================
|IF COL_LENGTH('cfg.FlowRun', 'Version') IS NULL
|ALTER TABLE cfg.FlowRun ADD Version NVARCHAR(32) NULL;
|
|IF COL_LENGTH('cfg.FlowRun', 'CancelledBy') IS NULL
|ALTER TABLE cfg.FlowRun ADD CancelledBy NVARCHAR(256) NULL;
|
|-- #700 CANCEL FROM THE WEB APP (Operations > Jobs): the web app cancels the RUNNING run only through this procedure -- one
|-- run, never the table. It holds no right on cfg.FlowRun / cfg.PipelineLock / cfg.PipelineQueue for this (the runner keeps
|-- writing its run records itself). One transaction: the run (Cancelled, who, why, the end), its queue request (Done,
|-- Outcome Cancelled) and the lock held for it (released); a run that has ended is left as it is. Outcomes: NotFound,
|-- NotRunning, Cancelled (+ Holder = the runner that held the lock, Running = the steps still starting / running).
|-- Static SQL only (CancelledBy exists: added just above), so the ownership chain covers every table it writes.
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.FlowRunCancelSet @FlowRunId NVARCHAR(64), @By NVARCHAR(256), @Why NVARCHAR(1000)
|AS
|BEGIN
|    SET NOCOUNT ON; SET XACT_ABORT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_audit_writer''), 0) <> 1
|        THROW 51451, N''only the web app may cancel a pipeline run'', 1;
|    IF @By IS NULL OR LTRIM(RTRIM(@By)) = N'''' THROW 51452, N''cancelling a run must name who cancelled it'', 1;
|    BEGIN TRAN;
|    DECLARE @state nvarchar(16) = (SELECT State FROM cfg.FlowRun WITH (UPDLOCK, HOLDLOCK) WHERE FlowRunId = @FlowRunId);
|    IF @state IS NULL BEGIN COMMIT; SELECT N''NotFound'' AS Outcome, CAST(NULL AS nvarchar(128)) AS Holder, 0 AS Running; RETURN; END
|    IF @state IN (N''Succeeded'', N''Failed'', N''Stopped'', N''Cancelled'') BEGIN COMMIT; SELECT N''NotRunning'' AS Outcome, CAST(NULL AS nvarchar(128)) AS Holder, 0 AS Running; RETURN; END
|    UPDATE cfg.FlowRun SET State = N''Cancelled'', StopReason = @Why, EndedUtc = SYSUTCDATETIME(), CancelledBy = LEFT(@By, 256) WHERE FlowRunId = @FlowRunId;
|    DECLARE @holder nvarchar(128) = NULL;
|    SELECT @holder = Holder FROM cfg.PipelineLock WITH (UPDLOCK, HOLDLOCK) WHERE LockId = N''install'' AND FlowRunId = @FlowRunId;
|    UPDATE cfg.PipelineLock SET Holder = NULL, What = NULL, FlowRunId = NULL, HeartbeatUtc = NULL WHERE LockId = N''install'' AND Holder IS NOT NULL AND FlowRunId = @FlowRunId;
|    UPDATE cfg.PipelineQueue SET State = N''Done'', Outcome = N''Cancelled'', EndedUtc = SYSUTCDATETIME() WHERE FlowRunId = @FlowRunId AND State = N''Running'';
|    DECLARE @running int = (SELECT COUNT(*) FROM cfg.FlowStepRun WHERE FlowRunId = @FlowRunId AND State IN (N''Starting'', N''Running''));
|    COMMIT;
|    SELECT N''Cancelled'' AS Outcome, @holder AS Holder, @running AS Running;
|END');
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.FlowRunCancelSet TO public;
|
|-- A RUN THAT HAS ENDED IS FINAL -- for every writer, older code included (live 2026-10-19, ring 2): a pipeline run cancelled
|-- through cfg.FlowRunCancelSet was written back to Running, again and again, by a runner of older code whose container
|-- outlived its stop -- its save set the state without looking (the guard lived only in the newest runner's MERGE). A run
|-- in Succeeded / Failed / Stopped / Cancelled never changes state again: the update is refused (the writer's statement
|-- fails; today's runner never sends one -- its MERGE keeps an ended run as it is).
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_FlowRun_Final ON cfg.FlowRun AFTER UPDATE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF EXISTS (SELECT 1 FROM inserted i JOIN deleted d ON d.FlowRunId = i.FlowRunId
|               WHERE d.State IN (N''Succeeded'', N''Failed'', N''Stopped'', N''Cancelled'') AND i.State <> d.State)
|        THROW 51461, N''cfg.FlowRun: a run that has ended (Succeeded, Failed, Stopped, Cancelled) is final -- its state is never changed again'', 1;
|END');
|
|-- A QUEUED REQUEST IS TAKEN ONLY BY THE RUNNER THAT HOLDS THE INSTALL LOCK (live 2026-10-19, ring 2): the same runner of older
|-- code, its run cancelled and its lock released, went on to the next queued request -- and would have run it, for days, on
|-- the code of a release before. Today's runner names itself in the session (si.pipeline.holder) when it takes a request: a
|-- claim (Queued -> Running) by a runner that is not the lock's holder is refused. A claim that names nobody (a runner of
|-- a release before this one) is refused while the lock is FREE -- its lock was released by a cancel -- and still accepted
|-- while a runner holds the lock (an install mid-update keeps running). A refused runner starts nothing. Every other change
|-- of the queue is left as it is.
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_PipelineQueue_Claim ON cfg.PipelineQueue AFTER UPDATE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF (SELECT COUNT(*) FROM inserted i JOIN deleted d ON d.Id = i.Id WHERE i.State = N''Running'' AND d.State <> N''Running'') = 0 RETURN;
|    DECLARE @me NVARCHAR(128) = NULLIF(CAST(SESSION_CONTEXT(N''si.pipeline.holder'') AS NVARCHAR(128)), N'''');
|    DECLARE @holder NVARCHAR(128) = (SELECT Holder FROM cfg.PipelineLock WHERE LockId = N''install'');
|    IF @holder IS NULL OR (@me IS NOT NULL AND @me <> @holder)
|        THROW 51462, N''cfg.PipelineQueue: a queued request is taken only by the runner that holds the install lock -- this runner does not (its lock was released by a cancel, or taken over); it starts nothing'', 1;
|END');
|
|-- THE UPDATE RING AND THE UPDATE STATE ARE THE UPDATER'S: cfg.InstallState 'Ring', 'UpdateState' and 'CommunityUpdateState'
|-- (the ring an install pulls for, and what was applied -- the Community edition's replay floor) are written by the updater
|-- and setup only. The engine's role (si_engine) writes other rows of the table; a change to these three by a member of
|-- si_engine that is not db_owner is refused (the statement fails, nothing is written) -- an insert, an update, a delete, and
|-- a rename of one of them (the row's old name counts as much as its new one).
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_InstallState_UpdaterRows ON cfg.InstallState AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF (SELECT COUNT(*) FROM (SELECT Name FROM inserted UNION ALL SELECT Name FROM deleted) AS x
|        WHERE x.Name IN (N''Ring'', N''UpdateState'', N''CommunityUpdateState'')) = 0 RETURN;
|    IF ISNULL(IS_ROLEMEMBER(N''si_engine''), 0) = 1 AND ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) = 0
|        THROW 51463, N''cfg.InstallState: the update ring and the update state are written by the updater only'', 1;
|END');
|
|-- A STAGED TEMPLATE PACK NEVER CHANGES ONCE STAGED: its version, origin, SHA-256 and text stay as staged, and the signed
|-- manifest kept with it is only ever ADDED (never changed or taken away). An update that does more is refused, whoever
|-- runs it (the statement fails, nothing is written); a new pack is a new version.
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_TemplatePackStaged_Pinned ON cfg.TemplatePackStaged AFTER UPDATE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF (SELECT COUNT(*) FROM inserted) <> (SELECT COUNT(*) FROM inserted i JOIN deleted d ON d.PackVersion = i.PackVersion)
|       OR EXISTS (SELECT 1 FROM inserted i JOIN deleted d ON d.PackVersion = i.PackVersion
|                  WHERE CONVERT(varbinary(64), i.Origin) <> CONVERT(varbinary(64), d.Origin)
|                     OR CONVERT(varbinary(200), i.Sha256) <> CONVERT(varbinary(200), d.Sha256)
|                     OR CONVERT(varbinary(max), i.PackJson) <> CONVERT(varbinary(max), d.PackJson)
|                     OR (d.ManifestB64 IS NOT NULL AND (i.ManifestB64 IS NULL OR CONVERT(varbinary(max), i.ManifestB64) <> CONVERT(varbinary(max), d.ManifestB64)))
|                     OR (d.ManifestSignature IS NOT NULL AND (i.ManifestSignature IS NULL OR CONVERT(varbinary(max), i.ManifestSignature) <> CONVERT(varbinary(max), d.ManifestSignature))))
|        THROW 51464, N''cfg.TemplatePackStaged: a staged template pack never changes -- a new pack is a new version'', 1;
|END');
|
|-- CR8 (framework 12.11f item 1, SI #659): a change of a job's TRIGGER the web app asks for when it holds start-only rights
|-- on the jobs (Jobs:ChangeMode = request). The web app only INSERTS the request; the pipeline runner (caj-si-flow, its own
|-- identity) applies it on its next wake-up -- the trigger and the tags only, read back -- and records the outcome.
|--   Action  to-manual (off its timer, the cron remembered) | to-schedule (Cron given, or the remembered one)
|--   Outcome applied | failed | refused (not one of the install's jobs / not a valid request) | expired (older than a day)
|IF OBJECT_ID('cfg.JobTriggerRequest') IS NULL
|CREATE TABLE cfg.JobTriggerRequest (
|    RequestId       BIGINT          IDENTITY(1,1) NOT NULL CONSTRAINT PK_JobTriggerRequest PRIMARY KEY,
|    JobName         NVARCHAR(64)    NOT NULL,
|    Action          NVARCHAR(16)    NOT NULL,
|    Cron            NVARCHAR(100)   NULL,
|    RequestedBy     NVARCHAR(256)   NOT NULL,
|    RequestedUtc    DATETIME2(0)    NOT NULL CONSTRAINT DF_JobTriggerRequest_RequestedUtc DEFAULT SYSUTCDATETIME(),
|    AppliedUtc      DATETIME2(0)    NULL,
|    Outcome         NVARCHAR(16)    NULL,
|    Detail          NVARCHAR(1000)  NULL,
|    CONSTRAINT CK_JobTriggerRequest_Action CHECK (Action IN (N'to-manual', N'to-schedule'))
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_JobTriggerRequest_Pending' AND object_id = OBJECT_ID('cfg.JobTriggerRequest'))
|CREATE INDEX IX_JobTriggerRequest_Pending ON cfg.JobTriggerRequest (AppliedUtc, RequestId);
|
|-- #931: a job start's own values without a start override (Azure Container Apps: a start with containers needs
|-- Microsoft.App/jobs/write, which the web app must not hold). The web app writes Action 'start-env' with the values as a
|-- JSON object (EnvJson) and starts the job with no body; the job's entrypoint claims the row (ExecutionName = its own
|-- execution) and sets only the names allowed for that job (engine\_shared\SI-JobStartRequest.ps1). Additive: nullable.
|IF COL_LENGTH('cfg.JobTriggerRequest', 'EnvJson') IS NULL
|ALTER TABLE cfg.JobTriggerRequest ADD EnvJson NVARCHAR(4000) NULL;
|
|IF COL_LENGTH('cfg.JobTriggerRequest', 'ExecutionName') IS NULL
|ALTER TABLE cfg.JobTriggerRequest ADD ExecutionName NVARCHAR(128) NULL;
|
|-- The action list grows without dropping anything (the schema stays additive): the first list is switched off and a
|-- second, wider one added. Nothing is removed and no row is changed.
|IF COL_LENGTH('cfg.JobTriggerRequest', 'Action') IS NOT NULL AND EXISTS (SELECT 1 FROM sys.check_constraints WHERE name = 'CK_JobTriggerRequest_Action'
|           AND parent_object_id = OBJECT_ID('cfg.JobTriggerRequest') AND is_disabled = 0 AND definition NOT LIKE '%start-env%')
|ALTER TABLE cfg.JobTriggerRequest NOCHECK CONSTRAINT CK_JobTriggerRequest_Action;
|
|IF COL_LENGTH('cfg.JobTriggerRequest', 'Action') IS NOT NULL AND (SELECT COUNT(*) FROM sys.check_constraints WHERE name = 'CK_JobTriggerRequest_Actions'
|           AND parent_object_id = OBJECT_ID('cfg.JobTriggerRequest')) = 0
|ALTER TABLE cfg.JobTriggerRequest ADD CONSTRAINT CK_JobTriggerRequest_Actions CHECK (Action IN (N'to-manual', N'to-schedule', N'start-env'));
|
|-- CR8 step 2, OBSERVE ONLY (framework 12.11f item 2, SI #659): every change a person makes in the web app is recorded with
|-- the person's signed Entra token as the web app received it (Token, TokenSource bearer | session | none) and the time it
|-- was captured. The pipeline runner verifies it (signature against Entra's published keys, issuer, audience, issued <=
|-- captured <= expires, the person) and records the verdict -- verified | would-refuse -- then CLEARS the token. Nothing is
|-- refused yet: the engine only says what it would refuse. The web app inserts; the MCP server is denied any read.
|IF OBJECT_ID('cfg.SignedRequest') IS NULL
|CREATE TABLE cfg.SignedRequest (
|    Id              BIGINT          IDENTITY(1,1) NOT NULL CONSTRAINT PK_SignedRequest PRIMARY KEY,
|    CorrelationId   NVARCHAR(64)    NULL,
|    Action          NVARCHAR(128)   NOT NULL,
|    Actor           NVARCHAR(256)   NOT NULL,
|    TokenSource     NVARCHAR(16)    NOT NULL,
|    Token           NVARCHAR(MAX)   NULL,
|    Audience        NVARCHAR(64)    NULL,
|    CapturedUtc     DATETIME2(0)    NOT NULL CONSTRAINT DF_SignedRequest_CapturedUtc DEFAULT SYSUTCDATETIME(),
|    VerifiedUtc     DATETIME2(0)    NULL,
|    Verdict         NVARCHAR(16)    NULL,
|    Detail          NVARCHAR(1000)  NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_SignedRequest_Pending' AND object_id = OBJECT_ID('cfg.SignedRequest'))
|CREATE INDEX IX_SignedRequest_Pending ON cfg.SignedRequest (VerifiedUtc, Id);
|
|-- =============================================================================================
|-- #277: GUARD EVENTS. Every guard that holds, refuses or halts a step to protect data writes one row here
|-- (engine\_shared\SI-Guard.ps1 Send-SIGuardEvent; the web app's own guards through Guards\GuardEvents.cs). The web app's
|-- Operations > Guards (safety checks) view reads it; a row the web app writes waits as MailState / TelemetryState 'pending' until the mail
|-- job sends it (Invoke-SIGuardOutbox). cfg.GuardState keeps each guard's episode for the once-a-day mail
|-- ("still tripping, N times"). Additive, no CHECK: outcomes and states are the catalog's (config\guard-catalog.locked.json).
|-- =============================================================================================
|IF OBJECT_ID('cfg.GuardEvent') IS NULL
|CREATE TABLE cfg.GuardEvent (
|    Id              BIGINT          IDENTITY(1,1) NOT NULL CONSTRAINT PK_GuardEvent PRIMARY KEY,
|    TsUtc           DATETIME2(3)    NOT NULL CONSTRAINT DF_GuardEvent_TsUtc DEFAULT SYSUTCDATETIME(),
|    GuardId         NVARCHAR(80)    NOT NULL,
|    GuardKey        NVARCHAR(500)   NOT NULL,
|    Area            NVARCHAR(40)    NOT NULL,
|    Job             NVARCHAR(40)    NULL,
|    Engine          NVARCHAR(64)    NULL,
|    Source          NVARCHAR(16)    NOT NULL,
|    Outcome         NVARCHAR(16)    NOT NULL,
|    Severity        NVARCHAR(16)    NOT NULL,
|    Protected       NVARCHAR(400)   NULL,
|    Subject         NVARCHAR(400)   NULL,
|    Detail          NVARCHAR(2000)  NULL,
|    MeasuredText    NVARCHAR(1000)  NULL,
|    ValuesJson      NVARCHAR(MAX)   NULL,
|    HeldCount       BIGINT          NOT NULL CONSTRAINT DF_GuardEvent_Held DEFAULT 0,
|    ActionText      NVARCHAR(2000)  NULL,
|    Link            NVARCHAR(400)   NULL,
|    RunId           NVARCHAR(64)    NULL,
|    TripCount       INT             NOT NULL CONSTRAINT DF_GuardEvent_Trips DEFAULT 1,
|    FirstSeenUtc    DATETIME2(0)    NULL,
|    MailState       NVARCHAR(16)    NOT NULL,
|    MailTo          NVARCHAR(1000)  NULL,
|    TelemetryState  NVARCHAR(16)    NOT NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_GuardEvent_Ts' AND object_id = OBJECT_ID('cfg.GuardEvent'))
|CREATE INDEX IX_GuardEvent_Ts ON cfg.GuardEvent (TsUtc DESC);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_GuardEvent_Pending' AND object_id = OBJECT_ID('cfg.GuardEvent'))
|CREATE INDEX IX_GuardEvent_Pending ON cfg.GuardEvent (MailState, TelemetryState) INCLUDE (Id);
|
|IF OBJECT_ID('cfg.GuardState') IS NULL
|CREATE TABLE cfg.GuardState (
|    GuardKey        NVARCHAR(500)   NOT NULL CONSTRAINT PK_GuardState PRIMARY KEY,
|    GuardId         NVARCHAR(80)    NOT NULL,
|    FirstSeenUtc    DATETIME2(0)    NOT NULL,
|    LastSeenUtc     DATETIME2(0)    NOT NULL,
|    TripCount       INT             NOT NULL,
|    LastMailUtc     DATETIME2(0)    NULL
|);
|
|-- ---------------------------------------------------------------------------------------------
|-- THE HELD CLOSE SET OF A HALTED VULNERABILITY CONNECTOR RUN (operator decision 2026-10-04: "we cannot block").
|-- When the close limit halts a run, the closes it held are stored here (one row per connector and run: the finding ids,
|-- and the counts per asset and per CVE). An Admin releases THAT set once -- Operations > Guards (safety checks), the link in the guard
|-- mail, or Invoke-SIVulnLoop.ps1 -ReleaseHeldCloses <runId> on a VM -- and the connector's next run (or the one the
|-- release starts) closes exactly the released findings that are still absent, after re-checking that the results are
|-- complete. A release is never a setting change; it expires after 7 days. held -> released -> applied | expired.
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.GuardRelease') IS NULL
|CREATE TABLE cfg.GuardRelease (
|    ReleaseId       BIGINT          IDENTITY(1,1) NOT NULL CONSTRAINT PK_GuardRelease PRIMARY KEY,
|    GuardId         NVARCHAR(80)    NOT NULL,
|    Connector       NVARCHAR(128)   NOT NULL,
|    ConnectorKind   NVARCHAR(20)    NULL,
|    RunId           NVARCHAR(64)    NOT NULL,
|    HeldUtc         DATETIME2(0)    NOT NULL CONSTRAINT DF_GuardRelease_HeldUtc DEFAULT SYSUTCDATETIME(),
|    ExpiresUtc      DATETIME2(0)    NOT NULL,
|    HeldCount       INT             NOT NULL,
|    SummaryJson     NVARCHAR(MAX)   NULL,
|    ItemsJson       NVARCHAR(MAX)   NOT NULL,
|    State           NVARCHAR(20)    NOT NULL CONSTRAINT DF_GuardRelease_State DEFAULT 'held',
|    ReleasedBy      NVARCHAR(256)   NULL,
|    ReleasedUtc     DATETIME2(0)    NULL,
|    AppliedUtc      DATETIME2(0)    NULL,
|    AppliedRunId    NVARCHAR(64)    NULL,
|    AppliedText     NVARCHAR(1000)  NULL,
|    CONSTRAINT UQ_GuardRelease_Run UNIQUE (Connector, RunId),
|    CONSTRAINT CK_GuardRelease_State CHECK (State IN ('held', 'released', 'applied', 'expired'))
|);
|
|-- ---------------------------------------------------------------------------------------------
|-- ACKNOWLEDGED GUARD EVENTS (operator 2026-10-05: "how can i release these guards"). Every guard event can be
|-- acknowledged once a person has read it (Operations > Guards (safety checks), audited guard.event.acknowledge); acknowledged events are
|-- hidden by default. An acknowledgement also covers later REPEATS of exactly the same event -- the same guard key and the
|-- same detail (DetailHash = SHA2_256 of the detail text) -- so a situation that re-trips on every run until it ages out
|-- (rows without a collection time, say) is acknowledged once. A different detail is a new situation and shows again.
|-- Rows are only added (the web app's role: INSERT); an acknowledgement is never a release and changes nothing else.
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.GuardAck') IS NULL
|CREATE TABLE cfg.GuardAck (
|    AckId           BIGINT          IDENTITY(1,1) NOT NULL CONSTRAINT PK_GuardAck PRIMARY KEY,
|    EventId         BIGINT          NOT NULL,
|    GuardKey        NVARCHAR(500)   NOT NULL,
|    DetailHash      VARBINARY(32)   NOT NULL,
|    AckBy           NVARCHAR(256)   NOT NULL,
|    AckUtc          DATETIME2(0)    NOT NULL CONSTRAINT DF_GuardAck_AckUtc DEFAULT SYSUTCDATETIME(),
|    Note            NVARCHAR(1000)  NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_GuardAck_Key' AND object_id = OBJECT_ID('cfg.GuardAck'))
|CREATE INDEX IX_GuardAck_Key ON cfg.GuardAck (GuardKey, DetailHash) INCLUDE (AckBy, AckUtc);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_GuardAck_Event' AND object_id = OBJECT_ID('cfg.GuardAck'))
|CREATE INDEX IX_GuardAck_Event ON cfg.GuardAck (EventId) INCLUDE (AckBy, AckUtc);
|
|-- =============================================================================================
|-- THE MANAGEMENT SUMMARY REPORT (#291): report definitions (Configuration > Reports & outputs > Management summary)
|-- and their outbox. A definition chooses its sections (kpi, domains, timeline), the report data (Summary | Detailed),
|-- recipients and a weekly / monthly schedule (Day: weekday 1 = Monday .. 7, or day of month 1..28; TimeUtc HH:mm).
|-- LastPeriodKey is the period last sent ('2026-W41' / '2026-10'): the web app's scheduler CLAIMS a period by moving it
|-- (UPDATE ... WHERE LastPeriodKey <> @Key), so a period is sent once, and a run of missed periods is caught up once.
|-- The mail job sends cfg.ReportMail through the one SMTP path with the exemption and sign-in mails.
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.MgmtReport') IS NULL
|CREATE TABLE cfg.MgmtReport (
|    ReportId        BIGINT          IDENTITY(1,1) NOT NULL CONSTRAINT PK_MgmtReport PRIMARY KEY,
|    Name            NVARCHAR(100)   NOT NULL,
|    Grain           NVARCHAR(16)    NOT NULL,
|    Sections        NVARCHAR(100)   NOT NULL,
|    Recipients      NVARCHAR(2000)  NOT NULL,
|    Cadence         NVARCHAR(16)    NOT NULL,
|    [Day]           INT             NOT NULL,
|    TimeUtc         NVARCHAR(5)     NOT NULL,
|    Enabled         BIT             NOT NULL CONSTRAINT DF_MgmtReport_Enabled DEFAULT 1,
|    LastPeriodKey   NVARCHAR(16)    NULL,
|    LastSentAt      DATETIME2(0)    NULL,
|    CreatedAt       DATETIME2(0)    NOT NULL CONSTRAINT DF_MgmtReport_CreatedAt DEFAULT SYSUTCDATETIME(),
|    CreatedBy       NVARCHAR(256)   NOT NULL,
|    UpdatedAt       DATETIME2(0)    NOT NULL CONSTRAINT DF_MgmtReport_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy       NVARCHAR(256)   NOT NULL,
|    RemovedAt       DATETIME2(0)    NULL,
|    CONSTRAINT CK_MgmtReport_Grain CHECK (Grain IN ('Summary', 'Detailed')),
|    CONSTRAINT CK_MgmtReport_Cadence CHECK (Cadence IN ('weekly', 'monthly'))
|);
|
|IF OBJECT_ID('cfg.ReportMail') IS NULL
|CREATE TABLE cfg.ReportMail (
|    MailId      BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_ReportMail PRIMARY KEY,
|    ReportId    BIGINT          NOT NULL,
|    PeriodKey   NVARCHAR(16)    NULL,       -- NULL = sent now by a person
|    ToList      NVARCHAR(2000)  NOT NULL,
|    Subject     NVARCHAR(400)   NOT NULL,
|    BodyHtml    NVARCHAR(MAX)   NOT NULL,
|    QueuedAt    DATETIME2(0)    NOT NULL CONSTRAINT DF_ReportMail_QueuedAt DEFAULT SYSUTCDATETIME(),
|    QueuedBy    NVARCHAR(256)   NOT NULL,
|    SentAt      DATETIME2(0)    NULL,
|    Attempts    INT             NOT NULL CONSTRAINT DF_ReportMail_Attempts DEFAULT 0,
|    LastError   NVARCHAR(1000)  NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ReportMail_Pending' AND object_id = OBJECT_ID('cfg.ReportMail'))
|CREATE INDEX IX_ReportMail_Pending ON cfg.ReportMail (SentAt, QueuedAt);
|
|-- The management presentation (PowerPoint) a management summary mail carries (owner 2026-10-29: the Monthly management pack
|-- is attached to every management summary mail). The web app writes it with the mail (MgmtReports.cs QueueWithAttachmentSql);
|-- the mail job sends it as the mail's attachment (engine\asset-cmdb\_shared\SI-ExemptionMail.ps1). Additive: nullable, no default.
|IF COL_LENGTH('cfg.ReportMail', 'AttachmentName') IS NULL
|ALTER TABLE cfg.ReportMail ADD AttachmentName NVARCHAR(200) NULL;
|
|IF COL_LENGTH('cfg.ReportMail', 'AttachmentBytes') IS NULL
|ALTER TABLE cfg.ReportMail ADD AttachmentBytes VARBINARY(MAX) NULL;
|
|-- THE WEB APP'S SIGN-IN KEY RING (#345): the ASP.NET data-protection keys that encrypt the sign-in cookie and every form's
|-- antiforgery token, shared by every revision and replica of the web app (Auth\SqlKeyRing.cs). On the container's disk a
|-- new revision had new keys, so a deploy signed every open page out and refused its next save. One row per key, written
|-- once by the web app (INSERT only; ASP.NET expires a key, it never changes or removes one). KeyXml is the key as ASP.NET
|-- writes it -- the MCP server's identity is DENIED SELECT on this table (Deploy-SIManagement.ps1).
|IF OBJECT_ID('cfg.WebKeyRing') IS NULL
|CREATE TABLE cfg.WebKeyRing (
|    FriendlyName    NVARCHAR(200)   NOT NULL CONSTRAINT PK_WebKeyRing PRIMARY KEY,
|    KeyXml          NVARCHAR(MAX)   NOT NULL,
|    CreatedAt       DATETIME2(0)    NOT NULL CONSTRAINT DF_WebKeyRing_CreatedAt DEFAULT SYSUTCDATETIME()
|);
|
|-- =============================================================================================
|-- SAVED PIVOT VIEWS (#360): the weighted risk page's pivot builder (Assets & services > Risk scores > Weighted, per service > Pivot) saved
|-- under a name. One row per (Owner, Name) in force; Owner = the signed-in account that saved it. Shared = 1 (set only by
|-- an Admin) lists it for every reader. State = the pivot as URL parameters (pr / pc / pv / pf / pfv.* / psort / pdir):
|-- field and measure KEYS from the page's fixed list, never SQL -- read back through the same whitelist as the URL.
|-- A removal stamps RemovedAt; nothing is deleted.
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.PivotView') IS NULL
|CREATE TABLE cfg.PivotView (
|    ViewId      BIGINT          IDENTITY(1,1) NOT NULL CONSTRAINT PK_PivotView PRIMARY KEY,
|    Name        NVARCHAR(100)   NOT NULL,
|    Owner       NVARCHAR(256)   NOT NULL,
|    Shared      BIT             NOT NULL CONSTRAINT DF_PivotView_Shared DEFAULT 0,
|    State       NVARCHAR(2000)  NOT NULL,
|    CreatedAt   DATETIME2(0)    NOT NULL CONSTRAINT DF_PivotView_CreatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedAt   DATETIME2(0)    NOT NULL CONSTRAINT DF_PivotView_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    RemovedAt   DATETIME2(0)    NULL,
|    RemovedBy   NVARCHAR(256)   NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_PivotView_Owner' AND object_id = OBJECT_ID('cfg.PivotView'))
|CREATE INDEX IX_PivotView_Owner ON cfg.PivotView (Owner, Name) WHERE RemovedAt IS NULL;
|
|-- =============================================================================================
|-- GRID COLUMN LAYOUTS (V3-DATA-MODEL 2.13): which columns a grid shows. Scope 'tenant' (UserKey '') = the default an Admin
|-- sets for everyone; Scope 'user' = one person's own (UserKey = their sign-in name). View = the grid ('cis' = the CIs).
|-- ColumnsJson = a JSON array of column KEYS from the web app's fixed column catalog, never SQL; a key the catalog no
|-- longer knows is dropped when read. "Reset to the tenant default" removes the person's own row.
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.ColumnLayout') IS NULL
|CREATE TABLE cfg.ColumnLayout (
|    Scope       NVARCHAR(16)    NOT NULL,
|    UserKey     NVARCHAR(256)   NOT NULL CONSTRAINT DF_ColumnLayout_UserKey DEFAULT N'',
|    [View]      NVARCHAR(64)    NOT NULL,
|    ColumnsJson NVARCHAR(MAX)   NOT NULL,
|    UpdatedAt   DATETIME2(0)    NOT NULL CONSTRAINT DF_ColumnLayout_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy   NVARCHAR(256)   NULL,
|    CONSTRAINT PK_ColumnLayout PRIMARY KEY (Scope, UserKey, [View]),
|    CONSTRAINT CK_ColumnLayout_Scope CHECK (Scope IN (N'tenant', N'user'))
|);
|
|-- ---------------------------------------------------------------------------------------------
|-- WHAT EACH PERSON FINE-TUNES ON A DATA VIEW, next to their columns (cfg.ColumnLayout). Additive and guarded: an existing
|-- install only gains the two tables; until they exist the web app shows every view as before and says a save is not
|-- possible yet.
|--   cfg.ViewState    one row per person and view: the last sort / filters / search (StateJson = a JSON object of the
|--                    view's own address parameters, {"sort":["Risk"],"f.Tier":["0","1"]}; never SQL, never the page
|--                    number or the selected rows), the column widths (WidthsJson = {"<column key>": pixels}) and the
|--                    named layout in use (LayoutId; a layout that was deleted simply is not in use any more).
|--   cfg.ViewLayout   named layouts of a view ("Patch planning"): the columns in their order, the sort / filters and the
|--                    widths. Scope 'user' = one person's own (UserKey = their sign-in name); Scope 'shared' (UserKey '')
|--                    = published by an Admin for everyone, changed by an Admin only (the web app checks).
|-- Every read is by key: (UserKey, View) and (View, Scope, UserKey).
|-- ---------------------------------------------------------------------------------------------
|IF OBJECT_ID('cfg.ViewState') IS NULL
|CREATE TABLE cfg.ViewState (
|    UserKey     NVARCHAR(256)   NOT NULL,
|    [View]      NVARCHAR(64)    NOT NULL,
|    StateJson   NVARCHAR(MAX)   NULL,
|    WidthsJson  NVARCHAR(MAX)   NULL,
|    LayoutId    INT             NULL,
|    UpdatedAt   DATETIME2(0)    NOT NULL CONSTRAINT DF_ViewState_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    CONSTRAINT PK_ViewState PRIMARY KEY (UserKey, [View])
|);
|
|IF OBJECT_ID('cfg.ViewLayout') IS NULL
|CREATE TABLE cfg.ViewLayout (
|    LayoutId    INT IDENTITY(1,1) NOT NULL CONSTRAINT PK_ViewLayout PRIMARY KEY,
|    Scope       NVARCHAR(16)    NOT NULL,
|    UserKey     NVARCHAR(256)   NOT NULL CONSTRAINT DF_ViewLayout_UserKey DEFAULT N'',
|    [View]      NVARCHAR(64)    NOT NULL,
|    Name        NVARCHAR(80)    NOT NULL,
|    ColumnsJson NVARCHAR(MAX)   NOT NULL,
|    StateJson   NVARCHAR(MAX)   NULL,
|    WidthsJson  NVARCHAR(MAX)   NULL,
|    UpdatedAt   DATETIME2(0)    NOT NULL CONSTRAINT DF_ViewLayout_UpdatedAt DEFAULT SYSUTCDATETIME(),
|    UpdatedBy   NVARCHAR(256)   NULL,
|    CONSTRAINT CK_ViewLayout_Scope CHECK (Scope IN (N'user', N'shared'))
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'UX_ViewLayout_Name' AND object_id = OBJECT_ID('cfg.ViewLayout'))
|CREATE UNIQUE INDEX UX_ViewLayout_Name ON cfg.ViewLayout ([View], Scope, UserKey, Name);
|
|-- owner 2026-10-19 ("pinned views to the menu"): cfg.ViewPin -- a named layout pinned to the menu. Scope 'user' (UserKey =
|-- the person's sign-in name) = in that person's "My views"; Scope 'tenant' (UserKey '') = pinned by an Admin for everyone
|-- (a published layout only -- the web app checks). Path = the page the layout belongs to (its own parameters, never a
|-- sort or filter: those are the layout's). Deleting the layout removes its pins. Additive: an install without it shows no
|-- pinned views and a pin says the table is not there yet.
|IF OBJECT_ID('cfg.ViewPin') IS NULL
|CREATE TABLE cfg.ViewPin (
|    Scope       NVARCHAR(16)    NOT NULL,
|    UserKey     NVARCHAR(256)   NOT NULL CONSTRAINT DF_ViewPin_UserKey DEFAULT N'',
|    LayoutId    INT             NOT NULL,
|    [Path]      NVARCHAR(512)   NOT NULL,
|    PinnedAt    DATETIME2(0)    NOT NULL CONSTRAINT DF_ViewPin_PinnedAt DEFAULT SYSUTCDATETIME(),
|    PinnedBy    NVARCHAR(256)   NULL,
|    CONSTRAINT PK_ViewPin PRIMARY KEY (Scope, UserKey, LayoutId),
|    CONSTRAINT CK_ViewPin_Scope CHECK (Scope IN (N'user', N'tenant'))
|);
|
|-- =====================================================================================================================
|-- #404 (framework CONFIG-1): THE CHANGE JOURNAL, CONFIGURATION BACKUPS, SECOND-PERSON APPROVALS, COLLECTION RESEND /
|-- CONNECTOR UNDO, AND THE GUARD RELEASE OF GUARD-1.6. Additive and guarded (an existing install only gains these).
|--   cfg.ConfigJournal    CONFIG-1.1: one row per changed configuration record per commit -- the full record before and
|--                        after, Add / Modify / Remove, InitiatedBy / ApprovedBy, Source (gui / api / import / restore /
|--                        undo / sync / template), UndoOf, CommitId = the audit trail's CorrelationId (SESSION_CONTEXT
|--                        si.audit.cid). Written ONLY by the journal triggers generated at the end of this file (one per
|--                        table of config\config-entities.locked.json), inside the writing statement's transaction: the
|--                        change and its journal row land together or not at all. Append-only in the database (the DENY
|--                        below, the AUDIT-1.3 model SI already uses); rows go only through cfg.ConfigJournalRetentionApply,
|--                        which refuses a period shorter than the backup retention (an undo must keep its evidence).
|--   cfg.ConfigBackup     CONFIG-1.3: one row per backup (scheduled / manual / import). Content = the configuration set
|--                        in force (cfg.vConfigSnapshot) as JSON, COMPRESSed; SameAsBackupId instead of a copy when nothing
|--                        changed since the newest backup ("no change" is recorded, not copied). Written ONLY through the
|--                        owner-chained procedures below (take, import, pin, prune): every identity is DENIED direct writes.
|--   cfg.ConfigApproval   CONFIG-1.5: a restore or a guard release waiting for a second SuperAdmin, when the setting
|--                        SI_Pro_ConfigSecondPerson asks for one (default off).
|--   cfg.CollectionSend   #404 part 2: a person's request to send an earlier collection into a connector again, or to
|--                        undo the connector's last run; the connector's job carries it out through its normal path and
|--                        guards and records the outcome here.
|-- =====================================================================================================================
|IF OBJECT_ID('cfg.ConfigJournal') IS NULL
|CREATE TABLE cfg.ConfigJournal (
|    JournalId       BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_ConfigJournal PRIMARY KEY,
|    CommitId        NVARCHAR(64)    NOT NULL,
|    CommittedUtc    DATETIME2(3)    NOT NULL CONSTRAINT DF_ConfigJournal_CommittedUtc DEFAULT SYSUTCDATETIME(),
|    Entity          NVARCHAR(32)    NOT NULL,
|    EntityKey       NVARCHAR(900)   NOT NULL,
|    Op              NVARCHAR(8)     NOT NULL,
|    BeforeJson      NVARCHAR(MAX)   NULL,
|    AfterJson       NVARCHAR(MAX)   NULL,
|    InitiatedBy     NVARCHAR(256)   NOT NULL,
|    ApprovedBy      NVARCHAR(256)   NULL,
|    Source          NVARCHAR(16)    NOT NULL,
|    ActorSource     NVARCHAR(16)    NULL,
|    UndoOf          NVARCHAR(64)    NULL,
|    Reason          NVARCHAR(400)   NULL,
|    CONSTRAINT CK_ConfigJournal_Op CHECK (Op IN (N'Add', N'Modify', N'Remove'))
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ConfigJournal_Commit' AND object_id = OBJECT_ID('cfg.ConfigJournal'))
|CREATE INDEX IX_ConfigJournal_Commit ON cfg.ConfigJournal (CommitId);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ConfigJournal_Record' AND object_id = OBJECT_ID('cfg.ConfigJournal'))
|CREATE INDEX IX_ConfigJournal_Record ON cfg.ConfigJournal (Entity, EntityKey, JournalId);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ConfigJournal_Time' AND object_id = OBJECT_ID('cfg.ConfigJournal'))
|CREATE INDEX IX_ConfigJournal_Time ON cfg.ConfigJournal (CommittedUtc) INCLUDE (CommitId, InitiatedBy, Source);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ConfigJournal_Who' AND object_id = OBJECT_ID('cfg.ConfigJournal'))
|CREATE INDEX IX_ConfigJournal_Who ON cfg.ConfigJournal (InitiatedBy, CommittedUtc);
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|DENY UPDATE, DELETE ON OBJECT::cfg.ConfigJournal TO public;
|
|-- The ONE removal of journal rows (the configuration backup job, when SI_Pro_ConfigJournalRetentionDays is set; not set =
|-- kept, the default). Refuses a period shorter than the backup retention it reads itself (SI_Pro_ConfigBackupRetentionDays,
|-- default 90), runs only for the job identity (db_datawriter) or the owner, removes a batch at a time. Owner-chained.
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.ConfigJournalRetentionApply @Days INT, @Batch INT = 5000
|AS
|BEGIN
|    SET NOCOUNT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_datawriter''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_engine''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1
|        THROW 51404, N''only the configuration backup job may apply the change journal retention -- nothing was removed'', 1;
|    DECLARE @backup INT = (SELECT TOP (1) TRY_CONVERT(INT, JSON_VALUE(N''['' + s.ValueJson + N'']'', ''$[0]'')) FROM cfg.Setting AS s
|                           WHERE s.Name = N''SI_Pro_ConfigBackupRetentionDays'' AND s.Scope = N''solution'' AND s.ValueJson IS NOT NULL AND ISJSON(N''['' + s.ValueJson + N'']'') = 1);
|    IF @backup IS NULL OR @backup < 1 SET @backup = 90;
|    IF @Days IS NULL OR @Days < @backup
|        THROW 51405, N''the change journal is kept at least as long as the configuration backups -- nothing was removed'', 1;
|    IF @Batch IS NULL OR @Batch < 1 SET @Batch = 5000;
|    DELETE TOP (@Batch) FROM cfg.ConfigJournal WHERE CommittedUtc < DATEADD(DAY, -@Days, SYSUTCDATETIME());
|    SELECT @@ROWCOUNT AS N;
|END');
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.ConfigJournalRetentionApply TO public;
|
|IF OBJECT_ID('cfg.ConfigBackup') IS NULL
|CREATE TABLE cfg.ConfigBackup (
|    BackupId          BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_ConfigBackup PRIMARY KEY,
|    TakenUtc          DATETIME2(3)    NOT NULL CONSTRAINT DF_ConfigBackup_TakenUtc DEFAULT SYSUTCDATETIME(),
|    TakenBy           NVARCHAR(256)   NOT NULL,
|    TriggerKind       NVARCHAR(16)    NOT NULL,
|    ContentHash       CHAR(64)        NOT NULL,
|    SameAsBackupId    BIGINT          NULL,
|    Content           VARBINARY(MAX)  NULL,
|    EntityCountsJson  NVARCHAR(4000)  NULL,
|    ProductVersion    NVARCHAR(32)    NULL,
|    Note              NVARCHAR(400)   NULL,
|    CommitId          NVARCHAR(64)    NULL,
|    Pinned            BIT             NOT NULL CONSTRAINT DF_ConfigBackup_Pinned DEFAULT 0,
|    PinnedBy          NVARCHAR(256)   NULL,
|    PinnedUtc         DATETIME2(0)    NULL,
|    PinNote           NVARCHAR(400)   NULL,
|    CONSTRAINT CK_ConfigBackup_Content CHECK (Content IS NOT NULL OR SameAsBackupId IS NOT NULL)
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ConfigBackup_Taken' AND object_id = OBJECT_ID('cfg.ConfigBackup'))
|CREATE INDEX IX_ConfigBackup_Taken ON cfg.ConfigBackup (TakenUtc DESC) INCLUDE (Pinned, SameAsBackupId);
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|DENY INSERT, UPDATE, DELETE ON OBJECT::cfg.ConfigBackup TO public;
|
|-- Who may take / import / pin a backup: the jobs (db_datawriter), the web app (its audit writer role) and the owner.
|-- TAKE: the configuration in force (cfg.vConfigSnapshot, generated below) as one JSON array ordered by entity and key,
|-- hashed; the same hash as the newest backup = a "no change" row pointing at the backup that holds the content.
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.ConfigBackupTake @TakenBy NVARCHAR(256), @Trigger NVARCHAR(16), @Note NVARCHAR(400) = NULL, @CommitId NVARCHAR(64) = NULL, @ProductVersion NVARCHAR(32) = NULL
|AS
|BEGIN
|    SET NOCOUNT ON; SET XACT_ABORT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_datawriter''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_engine''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_audit_writer''), 0) <> 1
|        THROW 51406, N''only the configuration backup job or the web app may take a configuration backup'', 1;
|    IF @Trigger IS NULL OR @Trigger NOT IN (N''scheduled'', N''manual'', N''pre-restore'') SET @Trigger = N''manual'';
|    DECLARE @json NVARCHAR(MAX) = (SELECT s.Entity AS e, s.EntityKey AS k, JSON_QUERY(s.RecordJson) AS r FROM cfg.vConfigSnapshot AS s ORDER BY s.Entity, s.EntityKey FOR JSON PATH, INCLUDE_NULL_VALUES);
|    IF @json IS NULL SET @json = N''[]'';
|    DECLARE @hash CHAR(64) = LOWER(CONVERT(CHAR(64), HASHBYTES(''SHA2_256'', CAST(@json AS VARBINARY(MAX))), 2));
|    DECLARE @counts NVARCHAR(4000) = (SELECT s.Entity AS e, COUNT(*) AS n FROM cfg.vConfigSnapshot AS s GROUP BY s.Entity ORDER BY s.Entity FOR JSON PATH);
|    DECLARE @lastHash CHAR(64), @lastContent BIGINT, @id BIGINT;
|    BEGIN TRAN;
|    SELECT TOP (1) @lastHash = b.ContentHash, @lastContent = COALESCE(b.SameAsBackupId, b.BackupId) FROM cfg.ConfigBackup AS b WITH (UPDLOCK, HOLDLOCK) ORDER BY b.BackupId DESC;
|    IF @lastHash = @hash
|        INSERT cfg.ConfigBackup (TakenBy, TriggerKind, ContentHash, SameAsBackupId, Content, EntityCountsJson, ProductVersion, Note, CommitId)
|        VALUES (LEFT(@TakenBy, 256), @Trigger, @hash, @lastContent, NULL, @counts, @ProductVersion, @Note, @CommitId);
|    ELSE
|        INSERT cfg.ConfigBackup (TakenBy, TriggerKind, ContentHash, SameAsBackupId, Content, EntityCountsJson, ProductVersion, Note, CommitId)
|        VALUES (LEFT(@TakenBy, 256), @Trigger, @hash, NULL, COMPRESS(@json), @counts, @ProductVersion, @Note, @CommitId);
|    SET @id = SCOPE_IDENTITY();
|    COMMIT;
|    SELECT @id AS BackupId, @hash AS ContentHash, CASE WHEN @lastHash = @hash THEN 1 ELSE 0 END AS NoChange, @counts AS EntityCountsJson;
|END');
|
|-- IMPORT: a backup file another environment (or this one) exported, after the web app checked its format and signature.
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.ConfigBackupImport @ContentJson NVARCHAR(MAX), @TakenBy NVARCHAR(256), @Note NVARCHAR(400) = NULL, @CommitId NVARCHAR(64) = NULL, @ProductVersion NVARCHAR(32) = NULL
|AS
|BEGIN
|    SET NOCOUNT ON; SET XACT_ABORT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_audit_writer''), 0) <> 1
|        THROW 51407, N''only the web app may import a configuration backup'', 1;
|    IF @ContentJson IS NULL OR ISJSON(@ContentJson) <> 1 OR LEFT(LTRIM(@ContentJson), 1) <> N''[''
|        THROW 51408, N''the backup file does not hold a configuration set -- nothing was imported'', 1;
|    DECLARE @hash CHAR(64) = LOWER(CONVERT(CHAR(64), HASHBYTES(''SHA2_256'', CAST(@ContentJson AS VARBINARY(MAX))), 2));
|    DECLARE @counts NVARCHAR(4000) = (SELECT j.e AS e, COUNT(*) AS n FROM OPENJSON(@ContentJson) WITH (e NVARCHAR(32) ''$.e'') AS j GROUP BY j.e ORDER BY j.e FOR JSON PATH);
|    INSERT cfg.ConfigBackup (TakenBy, TriggerKind, ContentHash, SameAsBackupId, Content, EntityCountsJson, ProductVersion, Note, CommitId)
|    VALUES (LEFT(@TakenBy, 256), N''import'', @hash, NULL, COMPRESS(@ContentJson), @counts, @ProductVersion, @Note, @CommitId);
|    SELECT CAST(SCOPE_IDENTITY() AS BIGINT) AS BackupId, @hash AS ContentHash, @counts AS EntityCountsJson;
|END');
|
|-- PIN / UNPIN: a pinned backup is kept past the retention (e.g. before a large change).
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.ConfigBackupPin @BackupId BIGINT, @Pinned BIT, @By NVARCHAR(256), @Note NVARCHAR(400) = NULL
|AS
|BEGIN
|    SET NOCOUNT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_audit_writer''), 0) <> 1
|        THROW 51409, N''only the web app may pin a configuration backup'', 1;
|    UPDATE cfg.ConfigBackup SET Pinned = @Pinned, PinnedBy = CASE WHEN @Pinned = 1 THEN LEFT(@By, 256) END,
|           PinnedUtc = CASE WHEN @Pinned = 1 THEN SYSUTCDATETIME() END, PinNote = CASE WHEN @Pinned = 1 THEN @Note END
|    WHERE BackupId = @BackupId AND Pinned <> @Pinned;
|    SELECT @@ROWCOUNT AS Changed;
|END');
|
|-- PRUNE: backups older than @Days that are not pinned -- but never a backup whose content a KEPT backup still points at
|-- ("no change" rows hold no copy). Answers the removed rows (the caller records config.backup.prune). Job / owner only.
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.ConfigBackupPrune @Days INT
|AS
|BEGIN
|    SET NOCOUNT ON; SET XACT_ABORT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_datawriter''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_engine''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1
|        THROW 51410, N''only the configuration backup job may prune configuration backups -- nothing was removed'', 1;
|    IF @Days IS NULL OR @Days < 1
|        THROW 51411, N''a configuration backup is kept at least 1 day -- nothing was removed'', 1;
|    DECLARE @cut DATETIME2(3) = DATEADD(DAY, -@Days, SYSUTCDATETIME());
|    DECLARE @gone TABLE (BackupId BIGINT, TakenUtc DATETIME2(3));
|    DELETE b OUTPUT deleted.BackupId, deleted.TakenUtc INTO @gone
|    FROM cfg.ConfigBackup AS b
|    WHERE b.TakenUtc < @cut AND b.Pinned = 0
|      AND NOT EXISTS (SELECT 1 FROM cfg.ConfigBackup AS k WHERE k.SameAsBackupId = b.BackupId AND (k.TakenUtc >= @cut OR k.Pinned = 1));
|    SELECT BackupId, TakenUtc FROM @gone ORDER BY BackupId;
|END');
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.ConfigBackupTake TO public;
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.ConfigBackupImport TO public;
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.ConfigBackupPin TO public;
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.ConfigBackupPrune TO public;
|
|-- INSTALL KEY, CLAIM AGAIN: after Invardia reset this install's key, an Admin on Settings > Updates asks the updater to
|-- claim it ONCE more (a claim answered 409 is held and never repeated by itself). The web app writes only this one row of
|-- cfg.InstallState, only through this procedure (it holds no write right on the table); the updater takes the request
|-- away (reads and deletes it in one statement) BEFORE it claims, so one request is one claim -- never a loop.
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.InstallKeyClaimAgainRequest @RequestedBy NVARCHAR(256)
|AS
|BEGIN
|    SET NOCOUNT ON; SET XACT_ABORT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_audit_writer''), 0) <> 1
|        THROW 51412, N''only the web app may ask for the install key to be claimed again'', 1;
|    IF @RequestedBy IS NULL OR LTRIM(RTRIM(@RequestedBy)) = N'''' THROW 51413, N''the request must name who asked'', 1;
|    BEGIN TRAN;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N''InstallKeyClaimAgain'')
|        UPDATE cfg.InstallState SET Value = N''requested'', [Version] = NULL, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = LEFT(@RequestedBy, 256) WHERE Name = N''InstallKeyClaimAgain'';
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N''InstallKeyClaimAgain'', N''requested'', NULL, LEFT(@RequestedBy, 256));
|    COMMIT;
|    SELECT N''Requested'' AS Outcome, SYSUTCDATETIME() AS RequestedAt;
|END');
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.InstallKeyClaimAgainRequest TO public;
|
|-- THE FIRST SIGN-IN ON EACH WEB APP: the updater removes the old web app after a move to the standard name (ca-si-web) only
|-- once a person signed in on the new one. Each web app records its first request that passed sign-in here, once per
|-- process, in a row of ITS OWN: cfg.InstallState 'WebAppSignedIn:<its container app name>' = {"app":"<name>","at":"<utc>"}
|-- (one row per app name -- the old web app's row never stands in the new one's way, and nothing is ever deleted).
|-- Written ONLY when that app has no row yet (never overwritten). The web app writes only these rows, only through this
|-- procedure (it holds no write right on the table). A container app name is at most 32 characters, so the key fits.
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.WebAppSignedInRecord @App NVARCHAR(64)
|AS
|BEGIN
|    SET NOCOUNT ON; SET XACT_ABORT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_audit_writer''), 0) <> 1
|        THROW 51414, N''only the web app may record its first sign-in'', 1;
|    IF @App IS NULL OR LEN(@App) = 0 OR LEN(@App) > 32 OR @App LIKE N''%[^a-z0-9-]%''
|        THROW 51415, N''the first sign-in must name a container app'', 1;
|    DECLARE @key NVARCHAR(64) = N''WebAppSignedIn:'' + LOWER(@App);
|    BEGIN TRAN;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @key)
|    BEGIN
|        COMMIT;
|        SELECT N''Kept'' AS Outcome;
|        RETURN;
|    END
|    INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy)
|    VALUES (@key, N''{"app":"'' + LOWER(@App) + N''","at":"'' + CONVERT(NVARCHAR(19), SYSUTCDATETIME(), 126) + N''Z"}'', NULL, LEFT(LOWER(@App), 256));
|    COMMIT;
|    SELECT N''Recorded'' AS Outcome;
|END');
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.WebAppSignedInRecord TO public;
|
|-- CR4 (#654) THE STRICTER PERIOD, ENDED EARLY: for 24 hours after a release that changed engine code the safety checks'
|-- limits are halved (cfg.InstallState 'EngineFingerprint', written by the updater). A SuperAdmin may end that period early,
|-- with a reason, on Operations > Guards (safety checks) (audited guard.strict.end-early). The web app writes only this one row of
|-- cfg.InstallState ('GuardStrictEnd': { hash, strictFrom, endedAt, by, role, reason } -- it names the period it ends, so it
|-- never ends a later one), only through this procedure; it holds no write right on the table.
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.GuardStrictEndSet @Value NVARCHAR(400), @By NVARCHAR(256)
|AS
|BEGIN
|    SET NOCOUNT ON; SET XACT_ABORT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_audit_writer''), 0) <> 1
|        THROW 51441, N''only the web app may end the stricter period of the safety checks'', 1;
|    IF @By IS NULL OR LTRIM(RTRIM(@By)) = N'''' THROW 51442, N''ending the stricter period must name who ended it'', 1;
|    IF @Value IS NULL OR ISJSON(@Value) <> 1 OR JSON_VALUE(@Value, ''$.hash'') IS NULL OR JSON_VALUE(@Value, ''$.strictFrom'') IS NULL
|        THROW 51443, N''the end must name the period it ends (hash and strictFrom)'', 1;
|    BEGIN TRAN;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N''GuardStrictEnd'')
|        UPDATE cfg.InstallState SET Value = @Value, [Version] = NULL, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = LEFT(@By, 256) WHERE Name = N''GuardStrictEnd'';
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N''GuardStrictEnd'', @Value, NULL, LEFT(@By, 256));
|    COMMIT;
|    SELECT N''Ended'' AS Outcome, SYSUTCDATETIME() AS EndedAt;
|END');
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.GuardStrictEndSet TO public;
|
|-- MAIL-1, THE EXCHANGE ADMINISTRATOR'S CONFIRMATION: the guided mail setup (Settings > E-mail > Set up mail) records that
|-- an Exchange administrator scoped Mail.Send to the shared mailbox. The web app writes only this one row of
|-- cfg.InstallState, only through this procedure -- it holds no write right on the table, so it can never overwrite the
|-- licence, the ring, the update state or the restriction the mail job PROVED ('MailRestriction').
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.MailRestrictionAttestationSet @Value NVARCHAR(400), @By NVARCHAR(256)
|AS
|BEGIN
|    SET NOCOUNT ON; SET XACT_ABORT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_audit_writer''), 0) <> 1
|        THROW 51414, N''only the web app may record the mail restriction confirmation'', 1;
|    IF @Value IS NULL OR LTRIM(RTRIM(@Value)) = N'''' THROW 51415, N''the confirmation must have a value'', 1;
|    IF @By IS NULL OR LTRIM(RTRIM(@By)) = N'''' THROW 51416, N''the confirmation must name who gave it'', 1;
|    BEGIN TRAN;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N''MailRestrictionAttestation'')
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = LEFT(@By, 256) WHERE Name = N''MailRestrictionAttestation'';
|    ELSE
|        INSERT cfg.InstallState (Name, Value, UpdatedBy) VALUES (N''MailRestrictionAttestation'', @Value, LEFT(@By, 256));
|    COMMIT;
|    SELECT N''Saved'' AS Outcome;
|END');
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.MailRestrictionAttestationSet TO public;
|
|-- #732 ONE METHOD EVERYWHERE: the update moves an install whose jobs run on their own timers to the pipeline, and the stored
|-- pipeline (cfg.JobFlow, FlowId 'daily') must then say 'flow' -- or, when a later step fails, say again what it said. The
|-- engine / updater code sets ONLY the mode, ONLY through this procedure (no write right on the table; the definition and its
|-- journal are the web app's). Runs only for a job identity (db_datawriter / si_engine) or the owner. No stored pipeline =
|-- nothing to set (Updated 0): the default pipeline a new install runs is already 'flow'.
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.JobFlowSetMode @Mode NVARCHAR(16), @By NVARCHAR(256)
|AS
|BEGIN
|    SET NOCOUNT ON; SET XACT_ABORT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_datawriter''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_engine''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1
|        THROW 51480, N''only a job identity may set how the pipeline runs -- nothing was changed'', 1;
|    IF @Mode IS NULL OR @Mode NOT IN (N''flow'', N''schedules'') THROW 51481, N''the pipeline runs as flow or schedules'', 1;
|    IF @By IS NULL OR LTRIM(RTRIM(@By)) = N'''' THROW 51482, N''setting how the pipeline runs must name who set it'', 1;
|    UPDATE cfg.JobFlow SET Mode = @Mode, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = LEFT(@By, 256) WHERE FlowId = N''daily'';
|    SELECT @@ROWCOUNT AS Updated;
|END');
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.JobFlowSetMode TO public;
|
|IF OBJECT_ID('cfg.ConfigApproval') IS NULL
|CREATE TABLE cfg.ConfigApproval (
|    ApprovalId      BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_ConfigApproval PRIMARY KEY,
|    Kind            NVARCHAR(24)    NOT NULL,       -- restore | guard-release
|    Title           NVARCHAR(400)   NOT NULL,
|    PayloadJson     NVARCHAR(MAX)   NOT NULL,
|    Reason          NVARCHAR(1000)  NULL,
|    RequestedBy     NVARCHAR(256)   NOT NULL,
|    RequestedUtc    DATETIME2(0)    NOT NULL CONSTRAINT DF_ConfigApproval_RequestedUtc DEFAULT SYSUTCDATETIME(),
|    ExpiresUtc      DATETIME2(0)    NOT NULL,
|    CorrelationId   NVARCHAR(64)    NULL,
|    State           NVARCHAR(16)    NOT NULL CONSTRAINT DF_ConfigApproval_State DEFAULT N'pending',
|    DecidedBy       NVARCHAR(256)   NULL,
|    DecidedUtc      DATETIME2(0)    NULL,
|    DecisionNote    NVARCHAR(1000)  NULL,
|    OutcomeText     NVARCHAR(2000)  NULL,
|    CONSTRAINT CK_ConfigApproval_Payload CHECK (ISJSON(PayloadJson) = 1)
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ConfigApproval_State' AND object_id = OBJECT_ID('cfg.ConfigApproval'))
|CREATE INDEX IX_ConfigApproval_State ON cfg.ConfigApproval (State, RequestedUtc DESC);
|
|IF OBJECT_ID('cfg.CollectionSend') IS NULL
|CREATE TABLE cfg.CollectionSend (
|    SendId          BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_CollectionSend PRIMARY KEY,
|    Kind            NVARCHAR(16)    NOT NULL,       -- resend | undo
|    Connector       NVARCHAR(64)    NOT NULL,
|    ConnectorKind   NVARCHAR(32)    NULL,
|    CollectionId    INT             NULL,           -- resend: sidata.Collection
|    CollectionTime  DATETIME2(3)    NULL,
|    TargetRunId     NVARCHAR(64)    NULL,           -- undo: the connector run it reverses
|    Reason          NVARCHAR(1000)  NOT NULL,
|    RequestedBy     NVARCHAR(256)   NOT NULL,
|    RequestedUtc    DATETIME2(0)    NOT NULL CONSTRAINT DF_CollectionSend_RequestedUtc DEFAULT SYSUTCDATETIME(),
|    CorrelationId   NVARCHAR(64)    NULL,
|    State           NVARCHAR(16)    NOT NULL CONSTRAINT DF_CollectionSend_State DEFAULT N'requested',
|    RunId           NVARCHAR(64)    NULL,           -- the connector run that carried it out
|    StartedUtc      DATETIME2(0)    NULL,
|    DoneUtc         DATETIME2(0)    NULL,
|    OutcomeText     NVARCHAR(2000)  NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_CollectionSend_Connector' AND object_id = OBJECT_ID('cfg.CollectionSend'))
|CREATE INDEX IX_CollectionSend_Connector ON cfg.CollectionSend (Connector, RequestedUtc DESC);
|
|-- GUARD-1.6: a release is explicit and narrow -- one guard, one scope (the held set of one run), ONE run or until a time
|-- (at most 24 hours), and the exact plan it releases. CurrentPlanHash is the held plan's SHA-256 as it is NOW (guard,
|-- connector, run, count and the held items); a release stores the hash the SuperAdmin saw (PlanHash) and every apply path
|-- checks the two are equal -- a changed plan needs a new release. ReleaseUntilUtc ends the release by itself.
|IF COL_LENGTH('cfg.GuardRelease', 'ReleaseReason') IS NULL
|ALTER TABLE cfg.GuardRelease ADD ReleaseReason NVARCHAR(1000) NULL;
|
|IF COL_LENGTH('cfg.GuardRelease', 'PlanHash') IS NULL
|ALTER TABLE cfg.GuardRelease ADD PlanHash CHAR(64) NULL;
|
|IF COL_LENGTH('cfg.GuardRelease', 'ReleaseUntilUtc') IS NULL
|ALTER TABLE cfg.GuardRelease ADD ReleaseUntilUtc DATETIME2(0) NULL;
|
|IF COL_LENGTH('cfg.GuardRelease', 'ReleaseScope') IS NULL
|ALTER TABLE cfg.GuardRelease ADD ReleaseScope NVARCHAR(16) NULL;
|
|IF COL_LENGTH('cfg.GuardRelease', 'ReleaseCorrelationId') IS NULL
|ALTER TABLE cfg.GuardRelease ADD ReleaseCorrelationId NVARCHAR(64) NULL;
|
|IF COL_LENGTH('cfg.GuardRelease', 'ReleaseApprovedBy') IS NULL
|ALTER TABLE cfg.GuardRelease ADD ReleaseApprovedBy NVARCHAR(256) NULL;
|
|IF COL_LENGTH('cfg.GuardRelease', 'CurrentPlanHash') IS NULL
|ALTER TABLE cfg.GuardRelease ADD CurrentPlanHash AS LOWER(CONVERT(CHAR(64), HASHBYTES('SHA2_256', CAST(CONCAT(GuardId, N'|', Connector, N'|', RunId, N'|', HeldCount, N'|', ItemsJson) AS VARBINARY(MAX))), 2));
|
|-- =============================================================================================
|-- #733 GUARDS HEAL THEMSELVES, SAY WHICH RELEASE THEY TRIPPED ON, AND THE OWNER CAN ACCEPT ONE AT EVERY INSTALL (owner
|-- 2026-10-17; engine\_shared\SI-GuardHeal.ps1). Additive and safe to repeat; the engine writes every new column through a
|-- statement guarded by COL_LENGTH, so an install the update has not reached yet keeps working exactly as before.
|--   cfg.GuardEvent  SiVersion / PreviousVersion / Attribution: the version a trip happened on, the one before it, and the
|--                   plain sentence ("the first run after the update to <v> (from <p>)"). A row with Outcome 'cleared' is a
|--                   clear: "Back to normal in run <id> on version <v>", or the owner's acceptance.
|--   cfg.GuardState  Version / PreviousVersion / FirstRunId / MarkerKind: an episode's version, or a version marker (key
|--                   'ver|<guard key>': the version a check last ran on, the run that was the first on it); ClearedUtc /
|--                   ClearedRunId / ClearedVersion / ClearedHow (passed | released | accepted): the episode is closed.
|--   cfg.GuardAccept the owner's audited acceptance of one guard situation (guard id + version range, or one guard key),
|--                   written ONLY by cfg.GuardAcceptSet (no direct table writes).
|-- =============================================================================================
|IF COL_LENGTH('cfg.GuardEvent', 'SiVersion') IS NULL
|ALTER TABLE cfg.GuardEvent ADD SiVersion NVARCHAR(64) NULL;
|
|IF COL_LENGTH('cfg.GuardEvent', 'PreviousVersion') IS NULL
|ALTER TABLE cfg.GuardEvent ADD PreviousVersion NVARCHAR(64) NULL;
|
|IF COL_LENGTH('cfg.GuardEvent', 'Attribution') IS NULL
|ALTER TABLE cfg.GuardEvent ADD Attribution NVARCHAR(400) NULL;
|
|IF COL_LENGTH('cfg.GuardState', 'Version') IS NULL
|ALTER TABLE cfg.GuardState ADD [Version] NVARCHAR(64) NULL;
|
|IF COL_LENGTH('cfg.GuardState', 'PreviousVersion') IS NULL
|ALTER TABLE cfg.GuardState ADD PreviousVersion NVARCHAR(64) NULL;
|
|IF COL_LENGTH('cfg.GuardState', 'FirstRunId') IS NULL
|ALTER TABLE cfg.GuardState ADD FirstRunId NVARCHAR(64) NULL;
|
|IF COL_LENGTH('cfg.GuardState', 'MarkerKind') IS NULL
|ALTER TABLE cfg.GuardState ADD MarkerKind NVARCHAR(16) NULL;
|
|IF COL_LENGTH('cfg.GuardState', 'ClearedRunId') IS NULL
|ALTER TABLE cfg.GuardState ADD ClearedRunId NVARCHAR(64) NULL;
|
|IF COL_LENGTH('cfg.GuardState', 'ClearedVersion') IS NULL
|ALTER TABLE cfg.GuardState ADD ClearedVersion NVARCHAR(64) NULL;
|
|IF COL_LENGTH('cfg.GuardState', 'ClearedHow') IS NULL
|ALTER TABLE cfg.GuardState ADD ClearedHow NVARCHAR(16) NULL;
|
|-- ClearedUtc last: the engine's guarded statement looks for it, so it appears only once every other column is there
|IF COL_LENGTH('cfg.GuardState', 'ClearedUtc') IS NULL
|ALTER TABLE cfg.GuardState ADD ClearedUtc DATETIME2(0) NULL;
|
|IF OBJECT_ID('cfg.GuardAccept') IS NULL
|CREATE TABLE cfg.GuardAccept (
|    AcceptId        BIGINT          IDENTITY(1,1) NOT NULL CONSTRAINT PK_GuardAccept PRIMARY KEY,
|    GuardId         NVARCHAR(80)    NOT NULL,
|    GuardKey        NVARCHAR(500)   NULL,
|    FromVersion     NVARCHAR(64)    NULL,
|    ToVersion       NVARCHAR(64)    NULL,
|    CausedByVersion NVARCHAR(64)    NULL,
|    Reason          NVARCHAR(1000)  NOT NULL,
|    AcceptedBy      NVARCHAR(256)   NOT NULL,
|    OwnerApproval   NVARCHAR(400)   NULL,
|    Source          NVARCHAR(16)    NOT NULL,
|    CorrelationId   NVARCHAR(64)    NULL,
|    AcceptedUtc     DATETIME2(0)    NOT NULL CONSTRAINT DF_GuardAccept_AcceptedUtc DEFAULT SYSUTCDATETIME(),
|    EventsCovered   INT             NOT NULL CONSTRAINT DF_GuardAccept_Events DEFAULT 0,
|    EpisodesCleared INT             NOT NULL CONSTRAINT DF_GuardAccept_Episodes DEFAULT 0,
|    SetsReleased    INT             NOT NULL CONSTRAINT DF_GuardAccept_Sets DEFAULT 0,
|    RevokedUtc      DATETIME2(0)    NULL,
|    CONSTRAINT CK_GuardAccept_Source CHECK (Source IN (N'support', N'mail', N'web'))
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_GuardAccept_Guard' AND object_id = OBJECT_ID('cfg.GuardAccept'))
|CREATE INDEX IX_GuardAccept_Guard ON cfg.GuardAccept (GuardId) INCLUDE (GuardKey, FromVersion, ToVersion, AcceptedUtc, RevokedUtc);
|
|-- A version as a sortable key: its numeric part ('3.0.0.2138', '3.0.0-rc.12+0dc9062' -> 3.0.0.0), four parts of ten digits.
|-- NULL for no version, or more than four parts. The same rule as SI-GuardHeal.ps1 ConvertTo-SIGuardVersionParts.
|EXEC (N'CREATE OR ALTER FUNCTION cfg.GuardVersionKey (@v NVARCHAR(64)) RETURNS NVARCHAR(64)
|AS
|BEGIN
|    DECLARE @s NVARCHAR(64) = LTRIM(RTRIM(ISNULL(@v, N'''')));
|    DECLARE @i INT = PATINDEX(N''%[^0-9.]%'', @s);
|    IF @i > 0 SET @s = LEFT(@s, @i - 1);
|    WHILE LEN(@s) > 0 AND RIGHT(@s, 1) = N''.'' SET @s = LEFT(@s, LEN(@s) - 1);
|    IF LEN(@s) = 0 OR LEFT(@s, 1) = N''.'' OR CHARINDEX(N''..'', @s) > 0 RETURN NULL;
|    DECLARE @n INT = LEN(@s) - LEN(REPLACE(@s, N''.'', N''''));
|    IF @n > 3 RETURN NULL;
|    WHILE @n < 3 BEGIN SET @s = @s + N''.0''; SET @n = @n + 1; END;
|    RETURN RIGHT(REPLICATE(N''0'', 10) + PARSENAME(@s, 4), 10) + N''.'' + RIGHT(REPLICATE(N''0'', 10) + PARSENAME(@s, 3), 10) + N''.''
|         + RIGHT(REPLICATE(N''0'', 10) + PARSENAME(@s, 2), 10) + N''.'' + RIGHT(REPLICATE(N''0'', 10) + PARSENAME(@s, 1), 10);
|END');
|
|-- THE OWNER'S ACCEPTANCE AT ONE INSTALL (setup\Invoke-SIGuardAcceptEverywhere.ps1 runs it at every install through the
|-- Invardia Support app; Invardia's guard-mail link calls the same path). @PlanOnly = 1 changes nothing and answers what it
|-- WOULD accept. Otherwise, in one transaction: the acceptance row (who, when, why, the owner's own words, the version that
|-- caused it); every OPEN trip of the guard (and key) on a version inside the range acknowledged (cfg.GuardAck); every open
|-- episode cleared (ClearedHow 'accepted', one cfg.GuardEvent row Outcome 'cleared' that the mail job reports to Invardia);
|-- with @ReleaseHeld = 1 every held set of those trips released THROUGH THE RELEASE PATH'S OWN CHECKS (still held, not
|-- expired, bound to the plan as it is now, for one run or 24 hours at most -- the connector re-checks completeness before
|-- it applies anything); and one audit event 'guard.event.accept'. A range without an upper bound covers only what has
|-- tripped so far. Only the owner (db_owner: the Support app through the admin group) or the web app may run it.
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.GuardAcceptSet
|    @GuardId NVARCHAR(80), @GuardKey NVARCHAR(500) = NULL, @FromVersion NVARCHAR(64) = NULL, @ToVersion NVARCHAR(64) = NULL,
|    @CausedByVersion NVARCHAR(64) = NULL, @Reason NVARCHAR(1000) = NULL, @By NVARCHAR(256) = NULL, @OwnerApproval NVARCHAR(400) = NULL,
|    @Source NVARCHAR(16) = N''support'', @CorrelationId NVARCHAR(64) = NULL, @ReleaseHeld BIT = 0, @PlanOnly BIT = 0,
|    @ExpectedPlanHash CHAR(64) = NULL
|AS
|BEGIN
|    SET NOCOUNT ON; SET XACT_ABORT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_audit_writer''), 0) <> 1
|        THROW 51471, N''only the owner (through the Invardia Support app) or the web app may accept a guard'', 1;
|    IF @GuardId IS NULL OR @GuardId NOT LIKE N''_%._%._%'' THROW 51472, N''name the guard to accept (its id, area.object.what)'', 1;
|    SET @GuardKey = NULLIF(LTRIM(RTRIM(@GuardKey)), N'''');
|    SET @FromVersion = NULLIF(LTRIM(RTRIM(@FromVersion)), N''''); SET @ToVersion = NULLIF(LTRIM(RTRIM(@ToVersion)), N'''');
|    DECLARE @fk NVARCHAR(64) = cfg.GuardVersionKey(@FromVersion), @tk NVARCHAR(64) = cfg.GuardVersionKey(@ToVersion);
|    IF (@FromVersion IS NOT NULL AND @fk IS NULL) OR (@ToVersion IS NOT NULL AND @tk IS NULL) THROW 51473, N''a version must read like 3.0.0.2138'', 1;
|    IF @Source NOT IN (N''support'', N''mail'', N''web'') THROW 51474, N''the source must be support, mail or web'', 1;
|    IF @PlanOnly = 0
|    BEGIN
|        IF @Reason IS NULL OR LEN(LTRIM(RTRIM(@Reason))) < 10 THROW 51475, N''say why the guard is accepted (at least 10 characters)'', 1;
|        IF @By IS NULL OR LTRIM(RTRIM(@By)) = N'''' THROW 51476, N''the acceptance must name who accepted it'', 1;
|        IF @Source IN (N''support'', N''mail'') AND (@OwnerApproval IS NULL OR LEN(LTRIM(RTRIM(@OwnerApproval))) < 5)
|            THROW 51477, N''an acceptance for every install needs the owner''''s approval in his own words'', 1;
|    END;
|    DECLARE @ev TABLE (Id BIGINT PRIMARY KEY, GuardKey NVARCHAR(500), DetailHash VARBINARY(32), RunId NVARCHAR(64), SiVersion NVARCHAR(64));
|    INSERT @ev (Id, GuardKey, DetailHash, RunId, SiVersion)
|    SELECT e.Id, e.GuardKey, HASHBYTES(''SHA2_256'', ISNULL(e.Detail, N'''')), e.RunId, e.SiVersion
|    FROM cfg.GuardEvent AS e
|    WHERE e.GuardId = @GuardId AND e.Outcome <> N''cleared'' AND (@GuardKey IS NULL OR e.GuardKey = @GuardKey)
|      AND (@fk IS NULL OR cfg.GuardVersionKey(e.SiVersion) >= @fk) AND (@tk IS NULL OR cfg.GuardVersionKey(e.SiVersion) <= @tk)
|      AND NOT EXISTS (SELECT 1 FROM cfg.GuardAck AS a WHERE a.EventId = e.Id OR (a.GuardKey = e.GuardKey AND a.DetailHash = HASHBYTES(''SHA2_256'', ISNULL(e.Detail, N''''))));
|    DECLARE @ep TABLE (GuardKey NVARCHAR(500) PRIMARY KEY);
|    INSERT @ep (GuardKey)
|    SELECT s.GuardKey FROM cfg.GuardState AS s
|    WHERE s.GuardId = @GuardId AND s.GuardKey NOT LIKE N''ver|%'' AND s.GuardKey NOT LIKE N''cause|%'' AND s.TripCount > 0
|      AND (@GuardKey IS NULL OR s.GuardKey = @GuardKey) AND (s.ClearedUtc IS NULL OR s.ClearedUtc < s.LastSeenUtc)
|      AND (@fk IS NULL OR cfg.GuardVersionKey(s.[Version]) >= @fk) AND (@tk IS NULL OR cfg.GuardVersionKey(s.[Version]) <= @tk);
|    DECLARE @rs TABLE (ReleaseId BIGINT PRIMARY KEY);
|    IF @ReleaseHeld = 1
|        INSERT @rs (ReleaseId)
|        SELECT r.ReleaseId FROM cfg.GuardRelease AS r
|        WHERE r.GuardId = @GuardId AND r.State = N''held'' AND r.ExpiresUtc > SYSUTCDATETIME()
|          AND EXISTS (SELECT 1 FROM @ev AS x WHERE x.RunId = r.RunId);
|    DECLARE @nEv INT = (SELECT COUNT(*) FROM @ev), @nEp INT = (SELECT COUNT(*) FROM @ep), @nRs INT = (SELECT COUNT(*) FROM @rs);
|    -- the plan as the person saw it: the trips, the episodes and each held set with its own plan hash; the accept refuses a
|    -- plan that changed since (like a release: a changed plan needs a new look)
|    DECLARE @plan NVARCHAR(MAX) = CONCAT(N''guard='', @GuardId, N''|key='', @GuardKey, N''|from='', @FromVersion, N''|to='', @ToVersion, N''|release='', @ReleaseHeld,
|        N''|ev='', ISNULL((SELECT CONCAT(x.Id, N'';'') FROM @ev AS x ORDER BY x.Id FOR XML PATH(''''), TYPE).value(''.'', ''nvarchar(max)''), N''''),
|        N''|ep='', ISNULL((SELECT CONCAT(p.GuardKey, N'';'') FROM @ep AS p ORDER BY p.GuardKey FOR XML PATH(''''), TYPE).value(''.'', ''nvarchar(max)''), N''''),
|        N''|rs='', ISNULL((SELECT CONCAT(r.ReleaseId, N'':'', r.CurrentPlanHash, N'';'') FROM @rs AS x JOIN cfg.GuardRelease AS r ON r.ReleaseId = x.ReleaseId ORDER BY r.ReleaseId FOR XML PATH(''''), TYPE).value(''.'', ''nvarchar(max)''), N''''));
|    DECLARE @planHash CHAR(64) = LOWER(CONVERT(CHAR(64), HASHBYTES(''SHA2_256'', CAST(@plan AS VARBINARY(MAX))), 2));
|    DECLARE @keys NVARCHAR(2000) = LEFT(ISNULL(STUFF((SELECT N''; '' + k.GuardKey FROM (SELECT GuardKey FROM @ev UNION SELECT GuardKey FROM @ep) AS k ORDER BY k.GuardKey FOR XML PATH(''''), TYPE).value(''.'', ''nvarchar(max)''), 1, 2, N''''), N''''), 2000);
|    DECLARE @vers NVARCHAR(1000) = LEFT(ISNULL(STUFF((SELECT DISTINCT N''; '' + ISNULL(x.SiVersion, N''(not recorded)'') FROM @ev AS x FOR XML PATH(''''), TYPE).value(''.'', ''nvarchar(max)''), 1, 2, N''''), N''''), 1000);
|    IF @PlanOnly = 1
|    BEGIN
|        SELECT N''Plan'' AS Outcome, CAST(NULL AS BIGINT) AS AcceptId, @nEv AS EventsCovered, @nEp AS EpisodesCleared, @nRs AS SetsReleased, @keys AS GuardKeys, @vers AS Versions, @planHash AS PlanHash;
|        RETURN;
|    END;
|    -- ONCE: the same acceptance (guard, key, range, the owner''s words) made in the last 60 minutes is answered, never made twice
|    DECLARE @prev BIGINT = (SELECT TOP (1) a.AcceptId FROM cfg.GuardAccept AS a
|        WHERE a.GuardId = @GuardId AND ISNULL(a.GuardKey, N'''') = ISNULL(@GuardKey, N'''') AND ISNULL(a.FromVersion, N'''') = ISNULL(@FromVersion, N'''')
|          AND ISNULL(a.ToVersion, N'''') = ISNULL(@ToVersion, N'''') AND ISNULL(a.OwnerApproval, N'''') = ISNULL(LEFT(@OwnerApproval, 400), N'''')
|          AND a.RevokedUtc IS NULL AND a.AcceptedUtc >= DATEADD(MINUTE, -60, SYSUTCDATETIME()) ORDER BY a.AcceptId DESC);
|    IF @prev IS NOT NULL
|    BEGIN
|        SELECT N''Already'' AS Outcome, a.AcceptId, a.EventsCovered, a.EpisodesCleared, a.SetsReleased, @keys AS GuardKeys, @vers AS Versions, @planHash AS PlanHash FROM cfg.GuardAccept AS a WHERE a.AcceptId = @prev;
|        RETURN;
|    END;
|    IF @ReleaseHeld = 1 AND @ExpectedPlanHash IS NULL THROW 51478, N''releasing held sets needs the plan it was shown (@ExpectedPlanHash from @PlanOnly = 1)'', 1;
|    IF @ExpectedPlanHash IS NOT NULL AND LOWER(@ExpectedPlanHash) <> @planHash THROW 51479, N''the plan changed since it was shown -- plan again, look, and accept again'', 1;
|    DECLARE @now DATETIME2(0) = SYSUTCDATETIME(), @aid BIGINT;
|    BEGIN TRAN;
|    INSERT cfg.GuardAccept (GuardId, GuardKey, FromVersion, ToVersion, CausedByVersion, Reason, AcceptedBy, OwnerApproval, Source, CorrelationId, AcceptedUtc)
|    VALUES (@GuardId, @GuardKey, @FromVersion, @ToVersion, NULLIF(LTRIM(RTRIM(@CausedByVersion)), N''''), LEFT(@Reason, 1000), LEFT(@By, 256), LEFT(@OwnerApproval, 400), @Source, @CorrelationId, @now);
|    SET @aid = CAST(SCOPE_IDENTITY() AS BIGINT);
|    INSERT cfg.GuardAck (EventId, GuardKey, DetailHash, AckBy, Note)
|    SELECT x.Id, x.GuardKey, x.DetailHash, LEFT(@By + N'' (accepted)'', 256), LEFT(N''Accepted: '' + @Reason, 1000) FROM @ev AS x;
|    INSERT cfg.GuardEvent (GuardId, GuardKey, Area, Job, Engine, Source, Outcome, Severity, Protected, Subject, Detail, MeasuredText, ValuesJson,
|                           HeldCount, ActionText, Link, RunId, TripCount, FirstSeenUtc, MailState, MailTo, TelemetryState, SiVersion, Attribution)
|    SELECT @GuardId, p.GuardKey, l.Area, l.Job, l.Engine, CASE WHEN @Source = N''web'' THEN N''web'' ELSE N''setup'' END, N''cleared'', N''info'', l.Protected, l.Subject,
|           LEFT(N''Accepted by '' + @By + N'': '' + @Reason, 2000), NULL, NULL, 0, NULL, NULL, @CorrelationId, s.TripCount, s.FirstSeenUtc, N''off'', NULL, N''pending'',
|           l.SiVersion, LEFT(N''Accepted for '' + CASE WHEN @FromVersion IS NULL AND @ToVersion IS NULL THEN N''every version so far'' ELSE N''versions '' + ISNULL(@FromVersion, N''(any)'') + N'' to '' + ISNULL(@ToVersion, N''(any)'') END
|                + ISNULL(N''; caused by '' + NULLIF(LTRIM(RTRIM(@CausedByVersion)), N''''), N''''), 400)
|    FROM @ep AS p
|    JOIN cfg.GuardState AS s ON s.GuardKey = p.GuardKey
|    CROSS APPLY (SELECT TOP (1) e.Area, e.Job, e.Engine, e.Protected, e.Subject, e.SiVersion FROM cfg.GuardEvent AS e WHERE e.GuardKey = p.GuardKey AND e.Outcome <> N''cleared'' ORDER BY e.Id DESC) AS l;
|    UPDATE s SET ClearedUtc = @now, ClearedRunId = @CorrelationId, ClearedVersion = NULL, ClearedHow = N''accepted''
|    FROM cfg.GuardState AS s JOIN @ep AS p ON p.GuardKey = s.GuardKey;
|    UPDATE r SET State = N''released'', ReleasedBy = LEFT(@By, 256), ReleasedUtc = @now, ReleaseReason = LEFT(N''accepted at every install: '' + @Reason, 1000), PlanHash = r.CurrentPlanHash,
|                 ReleaseUntilUtc = CASE WHEN r.ExpiresUtc < DATEADD(HOUR, 24, @now) THEN r.ExpiresUtc ELSE DATEADD(HOUR, 24, @now) END, ReleaseScope = N''run'',
|                 ReleaseCorrelationId = @CorrelationId, ReleaseApprovedBy = LEFT(N''the owner: '' + ISNULL(@OwnerApproval, N''''), 256)
|    FROM cfg.GuardRelease AS r JOIN @rs AS x ON x.ReleaseId = r.ReleaseId
|    WHERE r.State = N''held'' AND r.ExpiresUtc > SYSUTCDATETIME();
|    SET @nRs = @@ROWCOUNT;
|    UPDATE cfg.GuardAccept SET EventsCovered = @nEv, EpisodesCleared = @nEp, SetsReleased = @nRs WHERE AcceptId = @aid;
|    INSERT cfg.AuditEvent (RecordType, Action, Actor, ActorSource, Target, Reason, Outcome, OutcomeText, BeforeJson, AfterJson, CorrelationId, WhatIf)
|    VALUES (N''event'', N''guard.event.accept'', LEFT(@By, 256), CASE WHEN @Source = N''web'' THEN N''web'' ELSE N''setup'' END,
|            LEFT(@GuardId + ISNULL(N'' ('' + @GuardKey + N'')'', N''''), 400), LEFT(@Reason, 400), N''ok'',
|            LEFT(CONCAT(@nEv, N'' trip(s) acknowledged, '', @nEp, N'' episode(s) cleared, '', @nRs, N'' held set(s) released for one run''), 1000), NULL,
|            CONCAT(N''{"guard":"'', STRING_ESCAPE(@GuardId, ''json''), N''","key":'', CASE WHEN @GuardKey IS NULL THEN N''null'' ELSE N''"'' + STRING_ESCAPE(@GuardKey, ''json'') + N''"'' END,
|                   N'',"from":'', CASE WHEN @FromVersion IS NULL THEN N''null'' ELSE N''"'' + STRING_ESCAPE(@FromVersion, ''json'') + N''"'' END,
|                   N'',"to":'', CASE WHEN @ToVersion IS NULL THEN N''null'' ELSE N''"'' + STRING_ESCAPE(@ToVersion, ''json'') + N''"'' END,
|                   N'',"causedBy":'', CASE WHEN NULLIF(LTRIM(RTRIM(@CausedByVersion)), N'''') IS NULL THEN N''null'' ELSE N''"'' + STRING_ESCAPE(LTRIM(RTRIM(@CausedByVersion)), ''json'') + N''"'' END,
|                   N'',"source":"'', @Source, N''","acceptId":'', @aid, N'',"events":'', @nEv, N'',"episodes":'', @nEp, N'',"sets":'', @nRs,
|                   N'',"ownerApproval":"'', STRING_ESCAPE(ISNULL(@OwnerApproval, N''''), ''json''), N''"}''),
|            @CorrelationId, 0);
|    COMMIT;
|    SELECT N''Accepted'' AS Outcome, @aid AS AcceptId, @nEv AS EventsCovered, @nEp AS EpisodesCleared, @nRs AS SetsReleased, @keys AS GuardKeys, @vers AS Versions, @planHash AS PlanHash;
|END');
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.GuardAcceptSet TO public;
|
|-- =============================================================================================
|-- THE VERIFICATION SERVICE (docs\V3-DATA-MODEL.md 2.11): settings and plans SecurityInsight's data depends on that are
|-- NOT enabled in the customer's Microsoft estate (engine\verification\, the checks in config\verification-checks.locked.json).
|-- The engine writes runs, check results and findings; only the web app writes decisions. A finding is keyed
|-- '<checkId>|<scope key>' and is RESOLVED only by a run in which its check ran -- a check that could not read its source
|-- is 'not-checked' and touches no finding.
|IF OBJECT_ID('cfg.VerificationRun') IS NULL
|CREATE TABLE cfg.VerificationRun (
|    RunId          BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_VerificationRun PRIMARY KEY,
|    StartedAt      DATETIME2(0)    NOT NULL CONSTRAINT DF_VerificationRun_StartedAt DEFAULT SYSUTCDATETIME(),
|    FinishedAt     DATETIME2(0)    NULL,
|    Outcome        NVARCHAR(24)    NULL,
|    CatalogVersion NVARCHAR(16)    NULL,
|    SummaryJson    NVARCHAR(MAX)   NULL
|);
|
|IF OBJECT_ID('cfg.VerificationCheckRun') IS NULL
|CREATE TABLE cfg.VerificationCheckRun (
|    RunId          BIGINT          NOT NULL,
|    CheckId        NVARCHAR(64)    NOT NULL,
|    State          NVARCHAR(16)    NOT NULL CONSTRAINT CK_VerificationCheckRun_State CHECK (State IN (N'ok', N'gaps', N'not-checked')),
|    Reason         NVARCHAR(1000)  NULL,
|    Findings       INT             NOT NULL CONSTRAINT DF_VerificationCheckRun_Findings DEFAULT 0,
|    CONSTRAINT PK_VerificationCheckRun PRIMARY KEY (RunId, CheckId)
|);
|
|IF OBJECT_ID('cfg.VerificationFinding') IS NULL
|CREATE TABLE cfg.VerificationFinding (
|    FindingKey     NVARCHAR(450)   NOT NULL CONSTRAINT PK_VerificationFinding PRIMARY KEY,
|    CheckId        NVARCHAR(64)    NOT NULL,
|    ScopeKind      NVARCHAR(16)    NOT NULL,
|    ScopeKey       NVARCHAR(400)   NOT NULL,
|    ScopeName      NVARCHAR(400)   NULL,
|    Severity       NVARCHAR(16)    NOT NULL,
|    Detail         NVARCHAR(2000)  NULL,
|    [Status]       NVARCHAR(16)    NOT NULL CONSTRAINT CK_VerificationFinding_Status CHECK ([Status] IN (N'open', N'resolved')),
|    FirstSeenAt    DATETIME2(0)    NOT NULL CONSTRAINT DF_VerificationFinding_FirstSeenAt DEFAULT SYSUTCDATETIME(),
|    LastSeenAt     DATETIME2(0)    NOT NULL CONSTRAINT DF_VerificationFinding_LastSeenAt DEFAULT SYSUTCDATETIME(),
|    ResolvedAt     DATETIME2(0)    NULL,
|    LastRunId      BIGINT          NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_VerificationFinding_Check' AND object_id = OBJECT_ID('cfg.VerificationFinding'))
|CREATE INDEX IX_VerificationFinding_Check ON cfg.VerificationFinding (CheckId, [Status]);
|
|IF OBJECT_ID('cfg.VerificationFindingEvent') IS NULL
|CREATE TABLE cfg.VerificationFindingEvent (
|    EventId        BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_VerificationFindingEvent PRIMARY KEY,
|    FindingKey     NVARCHAR(450)   NOT NULL,
|    RunId          BIGINT          NOT NULL,
|    [Event]        NVARCHAR(16)    NOT NULL CONSTRAINT CK_VerificationFindingEvent_Event CHECK ([Event] IN (N'opened', N'reopened', N'resolved')),
|    At             DATETIME2(0)    NOT NULL CONSTRAINT DF_VerificationFindingEvent_At DEFAULT SYSUTCDATETIME(),
|    Detail         NVARCHAR(2000)  NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_VerificationFindingEvent_Key' AND object_id = OBJECT_ID('cfg.VerificationFindingEvent'))
|CREATE INDEX IX_VerificationFindingEvent_Key ON cfg.VerificationFindingEvent (FindingKey, At);
|
|-- A decision on a finding: IGNORED (not a gap for this organisation, e.g. no other cloud) or ACCEPTED (a known gap whose
|-- risk is accepted for now), with who, when, why and the reviewer; due for review at ReviewDueAt (180 days). Append-only:
|-- a review or a change is a NEW row that replaces the old one (the old one gets RevokedAt / RevokedBy), so the history of
|-- every decision stays. Why not cfg.Exemption: an exemption hides a FINDING of a report from its scores; this is a gap
|-- in the data itself, keyed by the check, with its own review -- and cfg.Exemption's Scope CHECK has no place for it.
|IF OBJECT_ID('cfg.VerificationDecision') IS NULL
|CREATE TABLE cfg.VerificationDecision (
|    DecisionId     BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_VerificationDecision PRIMARY KEY,
|    FindingKey     NVARCHAR(450)   NOT NULL,
|    CheckId        NVARCHAR(64)    NOT NULL,
|    Decision       NVARCHAR(16)    NOT NULL CONSTRAINT CK_VerificationDecision_Decision CHECK (Decision IN (N'ignored', N'accepted')),
|    Reason         NVARCHAR(2000)  NOT NULL CONSTRAINT CK_VerificationDecision_Reason CHECK (LEN(Reason) >= 3),
|    [Owner]        NVARCHAR(256)   NULL,
|    DecidedBy      NVARCHAR(256)   NOT NULL,
|    DecidedAt      DATETIME2(0)    NOT NULL CONSTRAINT DF_VerificationDecision_DecidedAt DEFAULT SYSUTCDATETIME(),
|    ReviewDueAt    DATETIME2(0)    NOT NULL,
|    ReplacesDecisionId BIGINT      NULL,
|    RevokedAt      DATETIME2(0)    NULL,
|    RevokedBy      NVARCHAR(256)   NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_VerificationDecision_Key' AND object_id = OBJECT_ID('cfg.VerificationDecision'))
|CREATE INDEX IX_VerificationDecision_Key ON cfg.VerificationDecision (FindingKey, RevokedAt);
|
|-- =============================================================================================
|-- THE DATA HEALTH MODEL (CR2, REQUIREMENTS #656 -- SecurityInsight only): every day the engine checks its own data
|-- (engine\data-health\, read-only toward the sources) -- per source a random 10 % of the records looked up in the newest
|-- collection, and a random 10 % of the devices with vulnerability findings re-asked from Defender -- and keeps the
|-- install's state: Healthy | Unhealthy (three anomalous cycles in a row -> Unhealthy, one good cycle -> Healthy).
|-- While Unhealthy every data-out channel plans only; a SuperAdmin may let ONE channel through, with a reason, until the
|-- data is Healthy again (cfg.DataHealthOverride, written by the web app ONLY through cfg.DataHealthOverrideSet; the
|-- engine clears every open override when the data is Healthy again). An install without these tables holds nothing.
|IF OBJECT_ID('cfg.DataHealthCycle') IS NULL
|CREATE TABLE cfg.DataHealthCycle (
|    CycleId              BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_DataHealthCycle PRIMARY KEY,
|    StartedAt            DATETIME2(0)    NOT NULL CONSTRAINT DF_DataHealthCycle_StartedAt DEFAULT SYSUTCDATETIME(),
|    FinishedAt           DATETIME2(0)    NULL,
|    Anomalous            BIT             NULL,
|    Complete             BIT             NULL,
|    [State]              NVARCHAR(16)    NULL,       -- the install's state AFTER this cycle
|    StateChanged         BIT             NULL,
|    ConsecutiveAnomalous INT             NULL,
|    SummaryJson          NVARCHAR(MAX)   NULL
|);
|
|IF OBJECT_ID('cfg.DataHealthResult') IS NULL
|CREATE TABLE cfg.DataHealthResult (
|    CycleId          BIGINT          NOT NULL,
|    Kind             NVARCHAR(16)    NOT NULL CONSTRAINT CK_DataHealthResult_Kind CHECK (Kind IN (N'source', N'report')),
|    Name             NVARCHAR(256)   NOT NULL,       -- the source id, or the Risk Analysis report
|    Label            NVARCHAR(256)   NULL,
|    Sampled          BIGINT          NOT NULL CONSTRAINT DF_DataHealthResult_Sampled DEFAULT 0,
|    Found            BIGINT          NOT NULL CONSTRAINT DF_DataHealthResult_Found DEFAULT 0,     -- a report: matched
|    Missing          BIGINT          NOT NULL CONSTRAINT DF_DataHealthResult_Missing DEFAULT 0,
|    FieldMismatches  BIGINT          NOT NULL CONSTRAINT DF_DataHealthResult_FieldMismatches DEFAULT 0,  -- a report: extra (no longer in Defender)
|    MarginPercent    FLOAT           NULL,
|    MarginMinimum    INT             NULL,
|    Allowed          BIGINT          NULL,
|    Verdict          NVARCHAR(16)    NOT NULL CONSTRAINT CK_DataHealthResult_Verdict CHECK (Verdict IN (N'ok', N'anomalous', N'not-checked', N'not-used')),
|    Reason           NVARCHAR(1000)  NULL,
|    CONSTRAINT PK_DataHealthResult PRIMARY KEY (CycleId, Kind, Name)
|);
|
|-- #747: DRIFT -- the part of Missing + FieldMismatches (a report: missing + extra) explained by a change in the source
|-- AFTER the collection (a CVE fixed or published since, a field the source changed since). Said and stored, never counted
|-- against the margin. A subset of those columns; they keep their meaning.
|IF COL_LENGTH('cfg.DataHealthResult', 'Drift') IS NULL
|ALTER TABLE cfg.DataHealthResult ADD Drift BIGINT NOT NULL CONSTRAINT DF_DataHealthResult_Drift DEFAULT 0;
|
|-- the records of a cycle that did not match: for the install's own Data health page; never sent anywhere
|IF OBJECT_ID('cfg.DataHealthMissing') IS NULL
|CREATE TABLE cfg.DataHealthMissing (
|    MissingId        BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_DataHealthMissing PRIMARY KEY,
|    CycleId          BIGINT          NOT NULL,
|    Kind             NVARCHAR(16)    NOT NULL,
|    Name             NVARCHAR(256)   NOT NULL,
|    RecordKey        NVARCHAR(450)   NULL,
|    RecordName       NVARCHAR(400)   NULL,
|    Problem          NVARCHAR(400)   NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_DataHealthMissing_Cycle' AND object_id = OBJECT_ID('cfg.DataHealthMissing'))
|CREATE INDEX IX_DataHealthMissing_Cycle ON cfg.DataHealthMissing (CycleId, Kind, Name);
|
|IF OBJECT_ID('cfg.DataHealthState') IS NULL
|CREATE TABLE cfg.DataHealthState (
|    Id                   INT             NOT NULL CONSTRAINT PK_DataHealthState PRIMARY KEY CONSTRAINT CK_DataHealthState_One CHECK (Id = 1),
|    [State]              NVARCHAR(16)    NOT NULL CONSTRAINT CK_DataHealthState_State CHECK ([State] IN (N'Healthy', N'Unhealthy')),
|    Since                DATETIME2(0)    NOT NULL,
|    ConsecutiveAnomalous INT             NOT NULL CONSTRAINT DF_DataHealthState_Consecutive DEFAULT 0,
|    LastCycleId          BIGINT          NULL,
|    LastCycleAt          DATETIME2(0)    NULL
|);
|
|IF OBJECT_ID('cfg.DataHealthOverride') IS NULL
|CREATE TABLE cfg.DataHealthOverride (
|    OverrideId       BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_DataHealthOverride PRIMARY KEY,
|    Channel          NVARCHAR(64)    NOT NULL,       -- the data-out channel (a connector name)
|    SetBy            NVARCHAR(256)   NOT NULL,
|    SetByRole        NVARCHAR(32)    NOT NULL CONSTRAINT DF_DataHealthOverride_Role DEFAULT N'SuperAdmin',
|    Reason           NVARCHAR(1000)  NOT NULL CONSTRAINT CK_DataHealthOverride_Reason CHECK (LEN(Reason) >= 10),
|    SinceUtc         DATETIME2(0)    NOT NULL CONSTRAINT DF_DataHealthOverride_Since DEFAULT SYSUTCDATETIME(),
|    ClearedAt        DATETIME2(0)    NULL,
|    ClearedBy        NVARCHAR(256)   NULL,
|    ClearedReason    NVARCHAR(400)   NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_DataHealthOverride_Open' AND object_id = OBJECT_ID('cfg.DataHealthOverride'))
|CREATE INDEX IX_DataHealthOverride_Open ON cfg.DataHealthOverride (ClearedAt, Channel);
|
|-- A SuperAdmin lets ONE data-out channel through while the data is Unhealthy (@Clear = 1: takes the override back). The web
|-- app checks the role; the procedure checks the rest: the data is Unhealthy, a reason of at least 10 characters, one open
|-- override per channel. The web app holds no write right on the table.
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.DataHealthOverrideSet @Channel NVARCHAR(64), @Reason NVARCHAR(1000), @By NVARCHAR(256), @Role NVARCHAR(32) = N''SuperAdmin'', @Clear BIT = 0
|AS
|BEGIN
|    SET NOCOUNT ON; SET XACT_ABORT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_audit_writer''), 0) <> 1
|        THROW 51451, N''only the web app may let a data-out channel through'', 1;
|    IF @By IS NULL OR LTRIM(RTRIM(@By)) = N'''' THROW 51452, N''the override must name who made it'', 1;
|    IF @Channel IS NULL OR LTRIM(RTRIM(@Channel)) = N'''' THROW 51453, N''the override must name the channel'', 1;
|    BEGIN TRAN;
|    IF @Clear = 1
|    BEGIN
|        UPDATE cfg.DataHealthOverride SET ClearedAt = SYSUTCDATETIME(), ClearedBy = LEFT(@By, 256), ClearedReason = LEFT(ISNULL(@Reason, N''taken back''), 400)
|        WHERE ClearedAt IS NULL AND Channel = @Channel;
|        COMMIT;
|        SELECT N''Cleared'' AS Outcome, SYSUTCDATETIME() AS At;
|        RETURN;
|    END
|    IF @Reason IS NULL OR LEN(LTRIM(RTRIM(@Reason))) < 10 THROW 51454, N''the override needs a reason of at least 10 characters'', 1;
|    IF (SELECT COUNT(*) FROM cfg.DataHealthState WITH (UPDLOCK, HOLDLOCK) WHERE Id = 1 AND [State] = N''Unhealthy'') = 0
|        THROW 51455, N''the data is not Unhealthy -- nothing is held, so there is nothing to let through'', 1;
|    IF EXISTS (SELECT 1 FROM cfg.DataHealthOverride WITH (UPDLOCK, HOLDLOCK) WHERE ClearedAt IS NULL AND Channel = @Channel)
|        THROW 51456, N''this channel is already let through'', 1;
|    INSERT cfg.DataHealthOverride (Channel, SetBy, SetByRole, Reason) VALUES (LTRIM(RTRIM(@Channel)), LEFT(@By, 256), LEFT(ISNULL(@Role, N''SuperAdmin''), 32), @Reason);
|    COMMIT;
|    SELECT N''Set'' AS Outcome, SYSUTCDATETIME() AS At;
|END');
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.DataHealthOverrideSet TO public;
|
|-- THE SECRET HAND-OVER: the web app never writes a secret (owner 2026-10-10: "can we commit this to the engine and then
|-- the engine commits it, so the gui keeps read only"). The updater keeps an RSA key in the install's Key Vault (a KEY,
|-- never exportable: it decrypts only inside the vault) and publishes its PUBLIC half here. The web app encrypts a pasted
|-- secret in memory (an AES-256-GCM data key, wrapped with RSA-OAEP-256 by that public key) and leaves ONLY the ciphertext
|-- in cfg.PendingSecret; the updater decrypts the data key in the vault, writes the secret, points the setting at the
|-- secret's NAME and removes the row. A row it cannot store keeps a plain-language reason (FailureText) until it is stored
|-- or replaced. Neither table ever holds a secret in clear text; neither is configuration (never backed up or restored).
|IF OBJECT_ID('cfg.SecretHandoverKey') IS NULL
|CREATE TABLE cfg.SecretHandoverKey (
|    KeyVersion   NVARCHAR(64)    NOT NULL CONSTRAINT PK_SecretHandoverKey PRIMARY KEY,   -- the Key Vault key's version
|    KeyName      NVARCHAR(127)   NOT NULL,
|    PublicJwk    NVARCHAR(4000)  NOT NULL,   -- the PUBLIC half only: {"kty":"RSA","n":"...","e":"..."}
|    IsCurrent    BIT             NOT NULL CONSTRAINT DF_SecretHandoverKey_IsCurrent DEFAULT 1,
|    PublishedAt  DATETIME2(0)    NOT NULL CONSTRAINT DF_SecretHandoverKey_PublishedAt DEFAULT SYSUTCDATETIME(),
|    PublishedBy  NVARCHAR(256)   NOT NULL,
|    CONSTRAINT CK_SecretHandoverKey_Jwk CHECK (ISJSON(PublicJwk) = 1)
|);
|
|IF OBJECT_ID('cfg.PendingSecret') IS NULL
|CREATE TABLE cfg.PendingSecret (
|    PendingId     BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_PendingSecret PRIMARY KEY,
|    SettingName   NVARCHAR(128)   NOT NULL,   -- the setting that will name the secret (e.g. OpenAI_apiKey)
|    SecretName    NVARCHAR(127)   NOT NULL,   -- the Key Vault secret the updater writes
|    KeyVersion    NVARCHAR(64)    NOT NULL,   -- the hand-over key version that wrapped the data key
|    WrappedKey    NVARCHAR(1024)  NOT NULL,   -- base64url: RSA-OAEP-256 of the 32-byte data key
|    Nonce         NVARCHAR(32)    NOT NULL,   -- base64url: the 12-byte AES-GCM nonce
|    Tag           NVARCHAR(32)    NOT NULL,   -- base64url: the 16-byte AES-GCM tag
|    Ciphertext    NVARCHAR(MAX)   NOT NULL,   -- base64url: AES-256-GCM of the secret (UTF-8)
|    CreatedBy     NVARCHAR(256)   NOT NULL,
|    CreatedAt     DATETIME2(0)    NOT NULL CONSTRAINT DF_PendingSecret_CreatedAt DEFAULT SYSUTCDATETIME(),
|    Attempts      INT             NOT NULL CONSTRAINT DF_PendingSecret_Attempts DEFAULT 0,
|    LastAttemptAt DATETIME2(0)    NULL,
|    FailureText   NVARCHAR(400)   NULL        -- why the updater could not store it, in plain words; NULL = waiting
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_PendingSecret_Setting' AND object_id = OBJECT_ID('cfg.PendingSecret'))
|CREATE INDEX IX_PendingSecret_Setting ON cfg.PendingSecret (SettingName, CreatedAt DESC);
|
|-- =============================================================================================
|-- THE SERVICENOW CHECKS (owner 2026-10-20: "verify connection. verify table schema matches + get alerts"). One row per check
|-- of one ServiceNow output (the CI hand-off, the vulnerable items): the connection, the Import Set table, its columns as
|-- ServiceNow describes them (sys_dictionary) and the REST Insert Multiple column mapping -- written by the ENGINE identity
|-- (the output's run before it sends, the daily check in the verification job, and the "Verify" the web app starts on the
|-- mail job: the web app holds no Key Vault right, so it never signs in to ServiceNow itself). The web app reads the newest
|-- row per output and compares the columns with the ones in force. No secret is ever stored here: no key, no user, no password.
|--   Trigger    run | daily | verify
|--   Outcome    ok | warning | failed
|IF OBJECT_ID('cfg.ServiceNowCheck') IS NULL
|CREATE TABLE cfg.ServiceNowCheck (
|    CheckId      BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_ServiceNowCheck PRIMARY KEY,
|    [Output]     NVARCHAR(64)    NOT NULL,
|    Connector    NVARCHAR(64)    NULL,
|    TableName    NVARCHAR(128)   NULL,
|    [Trigger]    NVARCHAR(16)    NOT NULL,
|    RequestedBy  NVARCHAR(256)   NULL,
|    CheckedAt    DATETIME2(0)    NOT NULL CONSTRAINT DF_ServiceNowCheck_CheckedAt DEFAULT SYSUTCDATETIME(),
|    Outcome      NVARCHAR(16)    NOT NULL,
|    Summary      NVARCHAR(1000)  NULL,
|    ResultJson   NVARCHAR(MAX)   NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ServiceNowCheck_Output' AND object_id = OBJECT_ID('cfg.ServiceNowCheck'))
|CREATE INDEX IX_ServiceNowCheck_Output ON cfg.ServiceNowCheck ([Output], CheckId DESC) INCLUDE (CheckedAt, Outcome);
|
|-- =============================================================================================
|-- #757 THE PERFORMANCE PAGE'S SAMPLES (owner 2026-10-18: "add performance and stats in si gui so customer can see it. new
|-- page" / "so they can choose to scale up down"). The web app holds NO Azure right (CR8): the load of the databases and the
|-- web app over the last days, and the sizes the install runs, are read by the half-hourly heartbeat job with the engine
|-- identity (the same Azure Monitor metrics it and the write pacing already read) and kept here, one row per hour per
|-- metric. Operations > Performance reads them; nothing else does.
|--   Kind     database | webapp | job
|--   Name     the database's role (pro, data, identity), the web app's name, a job's name
|--   Metric   the Azure Monitor metric as Azure names it (cpu_percent, log_write_percent, physical_data_read_percent,
|--            dtu_consumption_percent, storage, UsageNanoCores, WorkingSetBytes) -- or a size the install runs:
|--            size.sku (Text = S3 / P1 / GP_Gen5_2; Avg = its DTU or vCores), size.maxBytes, size.cpu, size.memoryGi
|--   Avg/Max  the hour's average and highest value; Text only for size.sku
|-- Kept 30 days (sizes 2 days); written and pruned ONLY through cfg.PerfSampleSave (a job identity or the owner).
|-- =============================================================================================
|IF OBJECT_ID('cfg.PerfSample') IS NULL
|CREATE TABLE cfg.PerfSample (
|    TimeUtc   DATETIME2(0)    NOT NULL,
|    Kind      NVARCHAR(16)    NOT NULL CONSTRAINT CK_PerfSample_Kind CHECK (Kind IN (N'database', N'webapp', N'job')),
|    Name      NVARCHAR(128)   NOT NULL,
|    Metric    NVARCHAR(64)    NOT NULL,
|    [Avg]     FLOAT           NULL,
|    [Max]     FLOAT           NULL,
|    [Text]    NVARCHAR(64)    NULL,
|    CONSTRAINT PK_PerfSample PRIMARY KEY (Kind, Name, Metric, TimeUtc)
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_PerfSample_Time' AND object_id = OBJECT_ID('cfg.PerfSample'))
|CREATE INDEX IX_PerfSample_Time ON cfg.PerfSample (TimeUtc) INCLUDE (Kind, Name, Metric);
|
|-- One call per heartbeat tick that read anything: @Rows = a JSON array of { t, kind, name, metric, avg, max, text }. An hour
|-- already stored is replaced (a re-read hour is the same hour), a new one added; then rows older than 30 days (a size: 2
|-- days) go. Idempotent: the same call twice leaves the same rows. Runs only for a job identity (db_datawriter / si_engine)
|-- or the owner; the web app only reads the table.
|EXEC (N'CREATE OR ALTER PROCEDURE cfg.PerfSampleSave @Rows NVARCHAR(MAX)
|AS
|BEGIN
|    SET NOCOUNT ON; SET XACT_ABORT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_datawriter''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''si_engine''), 0) <> 1 AND ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) <> 1
|        THROW 51490, N''only a job identity may record the performance samples -- nothing was written'', 1;
|    DECLARE @r TABLE (TimeUtc DATETIME2(0) NOT NULL, Kind NVARCHAR(16) NOT NULL, Name NVARCHAR(128) NOT NULL, Metric NVARCHAR(64) NOT NULL,
|                      [Avg] FLOAT NULL, [Max] FLOAT NULL, [Text] NVARCHAR(64) NULL, PRIMARY KEY (Kind, Name, Metric, TimeUtc));
|    IF @Rows IS NOT NULL AND ISJSON(@Rows) = 1
|        INSERT @r (TimeUtc, Kind, Name, Metric, [Avg], [Max], [Text])
|        SELECT x.TimeUtc, x.Kind, x.Name, x.Metric, MAX(x.[Avg]), MAX(x.[Max]), MAX(x.[Text])
|        FROM OPENJSON(@Rows) WITH (TimeUtc DATETIME2(0) ''$.t'', Kind NVARCHAR(16) ''$.kind'', Name NVARCHAR(128) ''$.name'', Metric NVARCHAR(64) ''$.metric'',
|                                   [Avg] FLOAT ''$.avg'', [Max] FLOAT ''$.max'', [Text] NVARCHAR(64) ''$.text'') AS x
|        WHERE x.TimeUtc IS NOT NULL AND x.Kind IN (N''database'', N''webapp'', N''job'') AND LEN(x.Name) > 0 AND LEN(x.Metric) > 0
|        GROUP BY x.TimeUtc, x.Kind, x.Name, x.Metric;
|    BEGIN TRAN;
|    UPDATE p SET p.[Avg] = r.[Avg], p.[Max] = r.[Max], p.[Text] = r.[Text]
|    FROM cfg.PerfSample AS p WITH (UPDLOCK, HOLDLOCK) JOIN @r AS r ON r.Kind = p.Kind AND r.Name = p.Name AND r.Metric = p.Metric AND r.TimeUtc = p.TimeUtc;
|    DECLARE @updated INT = @@ROWCOUNT;
|    INSERT cfg.PerfSample (TimeUtc, Kind, Name, Metric, [Avg], [Max], [Text])
|    SELECT r.TimeUtc, r.Kind, r.Name, r.Metric, r.[Avg], r.[Max], r.[Text] FROM @r AS r
|    WHERE NOT EXISTS (SELECT 1 FROM cfg.PerfSample AS p WHERE p.Kind = r.Kind AND p.Name = r.Name AND p.Metric = r.Metric AND p.TimeUtc = r.TimeUtc);
|    DECLARE @added INT = @@ROWCOUNT;
|    DELETE FROM cfg.PerfSample WHERE TimeUtc < DATEADD(day, -30, SYSUTCDATETIME()) OR (Metric LIKE N''size.%'' AND TimeUtc < DATEADD(day, -2, SYSUTCDATETIME()));
|    DECLARE @pruned INT = @@ROWCOUNT;
|    COMMIT;
|    SELECT @added AS Added, @updated AS Updated, @pruned AS Pruned;
|END');
|
|IF IS_ROLEMEMBER(N'db_owner') = 1 OR IS_ROLEMEMBER(N'db_securityadmin') = 1
|GRANT EXECUTE ON OBJECT::cfg.PerfSampleSave TO public;
|
|-- =============================================================================================
|-- #640 BUCKET SIZING -- THE CORE OF RISK ANALYSIS. How many buckets (slices) each Risk Analysis report's query is split
|-- into lives in the database only (owner 2026-10-13: "config about sizing should of course be in sql only").
|--   cfg.RaBucketState    per report + template + query fingerprint: the last known count and when a run last DECIDED it
|--                        (probed it, raised it, sized it down, or sized it from a measurement). A changed query = a new
|--                        fingerprint = sized again; the run removes the report's other fingerprints.
|--   cfg.RaBucketHistory  one row per report per run: the count it started with and ended with, how it was decided, the
|--                        measured result (rows; the largest bucket's rows and bytes; the largest request), the usual count
|--                        (median of the report's earlier rows) and the jump flag. The run keeps the newest 30 per report.
|--   cfg.RaBucketReset    a ONE-TIME reset an Admin staged on Operations > Risk Analysis query splitting (Review & commit):
|--                        the next run of that template forgets the report's count (NULL = every report), sizes it again
|--                        and records AppliedUtc -- consumed once.
|--   cfg.RaBucketImport   per template: the counts an install learned before this table existed were imported once.
|-- Written by the Risk Analysis jobs (db_datawriter); the web app reads them and inserts reset rows only.
|-- =============================================================================================
|IF OBJECT_ID('cfg.RaBucketState') IS NULL
|CREATE TABLE cfg.RaBucketState (
|    Template        NVARCHAR(128)   NOT NULL,
|    ReportName      NVARCHAR(256)   NOT NULL,
|    Fingerprint     NVARCHAR(64)    NOT NULL,
|    BucketCount     INT             NOT NULL,
|    ConfirmedUtc    DATETIME2(0)    NULL,
|    UpdatedUtc      DATETIME2(0)    NOT NULL CONSTRAINT DF_RaBucketState_UpdatedUtc DEFAULT SYSUTCDATETIME(),
|    CONSTRAINT PK_RaBucketState PRIMARY KEY (Template, ReportName, Fingerprint)
|);
|
|IF OBJECT_ID('cfg.RaBucketHistory') IS NULL
|CREATE TABLE cfg.RaBucketHistory (
|    Id                   BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_RaBucketHistory PRIMARY KEY,
|    Template             NVARCHAR(128)   NOT NULL,
|    ReportName           NVARCHAR(256)   NOT NULL,
|    Fingerprint          NVARCHAR(64)    NULL,
|    RunId                NVARCHAR(64)    NULL,
|    RunUtc               DATETIME2(0)    NOT NULL CONSTRAINT DF_RaBucketHistory_RunUtc DEFAULT SYSUTCDATETIME(),
|    StartCount           INT             NOT NULL,
|    BucketCount          INT             NOT NULL,
|    Decided              NVARCHAR(16)    NOT NULL,
|    ResultRows           BIGINT          NULL,
|    MaxBucketRows        BIGINT          NULL,
|    MaxBucketBytes       BIGINT          NULL,
|    MaxRequestBytes      BIGINT          NULL,
|    RequestRows          BIGINT          NULL,
|    RequestBytesPerRow   INT             NULL,
|    RequestOverheadBytes INT             NULL,
|    UsualCount           INT             NULL,
|    Jump                 BIT             NOT NULL CONSTRAINT DF_RaBucketHistory_Jump DEFAULT 0
|);
|
|-- #833: the slice TIME is measured like the rows and the bytes -- the longest slice of the run (whole seconds) and the
|-- count its slices ran at -- so a report far inside every limit (time included) is sized down to 1, and a changed query
|-- starts from its measured need. NULL on rows written before; the engine reads and writes them only once they exist.
|IF COL_LENGTH('cfg.RaBucketHistory', 'MaxBucketSeconds') IS NULL
|ALTER TABLE cfg.RaBucketHistory ADD MaxBucketSeconds INT NULL;
|
|IF COL_LENGTH('cfg.RaBucketHistory', 'RanCount') IS NULL
|ALTER TABLE cfg.RaBucketHistory ADD RanCount INT NULL;
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_RaBucketHistory_Report' AND object_id = OBJECT_ID('cfg.RaBucketHistory'))
|CREATE INDEX IX_RaBucketHistory_Report ON cfg.RaBucketHistory (Template, ReportName, Id DESC);
|
|IF OBJECT_ID('cfg.RaBucketReset') IS NULL
|CREATE TABLE cfg.RaBucketReset (
|    ResetId         BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_RaBucketReset PRIMARY KEY,
|    Template        NVARCHAR(128)   NOT NULL,
|    ReportName      NVARCHAR(256)   NULL,        -- NULL = every report of the template
|    RequestedUtc    DATETIME2(0)    NOT NULL CONSTRAINT DF_RaBucketReset_RequestedUtc DEFAULT SYSUTCDATETIME(),
|    RequestedBy     NVARCHAR(256)   NOT NULL,
|    Reason          NVARCHAR(400)   NULL,
|    AppliedUtc      DATETIME2(0)    NULL,        -- set by the run that consumed it
|    AppliedRunId    NVARCHAR(64)    NULL
|);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_RaBucketReset_Pending' AND object_id = OBJECT_ID('cfg.RaBucketReset'))
|CREATE INDEX IX_RaBucketReset_Pending ON cfg.RaBucketReset (Template, AppliedUtc);
|
|IF OBJECT_ID('cfg.RaBucketImport') IS NULL
|CREATE TABLE cfg.RaBucketImport (
|    Template        NVARCHAR(128)   NOT NULL CONSTRAINT PK_RaBucketImport PRIMARY KEY,
|    ImportedUtc     DATETIME2(0)    NOT NULL CONSTRAINT DF_RaBucketImport_ImportedUtc DEFAULT SYSUTCDATETIME(),
|    Entries         INT             NOT NULL,
|    Source          NVARCHAR(200)   NULL
|);
|
|-- #902 (5) A SOURCE THAT IS EMPTY FOR GOOD (owner 2026-10-26: "Approve, next release"): an Admin / SuperAdmin accepts, PER
|-- REPORT, that a source table the report reads is empty for good (the feature was turned off). Only for a report held for a
|-- source that went silent -- a SUCCESSFUL count of zero (data-model/hold-kinds.locked.json acceptEmpty), never for a read
|-- that failed. While active, the report is not held for that table: it shows empty and complete, and its findings close as
|-- 'Report changed' (its query fingerprint carries the acceptance), never as fixed. The run clears it (ClearedHow): rows-back
|-- (the table has rows again), not-read (the report no longer reads the table); the Admin: revoked. Every write is one
|-- transaction with its cfg.ChangeLog row (Name 'source-accept/<report>/<table>', Scope 'riskanalysis', Kind 'sourceaccept').
|IF OBJECT_ID('cfg.RaSourceAccept') IS NULL
|CREATE TABLE cfg.RaSourceAccept (
|    AcceptId        BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_RaSourceAccept PRIMARY KEY,
|    ReportName      NVARCHAR(256)   NOT NULL,
|    SourceTable     NVARCHAR(128)   NOT NULL,
|    Reason          NVARCHAR(400)   NOT NULL,
|    AcceptedBy      NVARCHAR(256)   NOT NULL,
|    AcceptedUtc     DATETIME2(0)    NOT NULL CONSTRAINT DF_RaSourceAccept_AcceptedUtc DEFAULT SYSUTCDATETIME(),
|    ClearedUtc      DATETIME2(0)    NULL,
|    ClearedHow      NVARCHAR(16)    NULL,        -- rows-back | not-read | revoked
|    ClearedBy       NVARCHAR(256)   NULL,
|    ClearedRunId    NVARCHAR(64)    NULL
|);
|
|-- one ACTIVE acceptance per report and table
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'UX_RaSourceAccept_Active' AND object_id = OBJECT_ID('cfg.RaSourceAccept'))
|CREATE UNIQUE INDEX UX_RaSourceAccept_Active ON cfg.RaSourceAccept (ReportName, SourceTable) WHERE ClearedUtc IS NULL;
|
|-- THE UPLINK OUTBOX (framework 8.4, agreed with Invardia 2026-11-05): a run report Invardia did NOT take at the end of its
|-- job (no answer, a timeout, a 429, any answer that is not ok) is kept here -- one row per record, the record exactly as it
|-- would have been sent. The heartbeat job (caj-si-heartbeat) sends the rows again after its own heartbeat, oldest first, in
|-- rounds, and deletes a row once Invardia took it. Bounded: at most 7 days and at most 5,000 rows -- beyond that the OLDEST
|-- go and are counted (cfg.InstallState 'UplinkOutbox'). Written by the engine identity (engine\_shared\SI-UplinkOutbox.ps1).
|-- Run state, never configuration. Columns: Job = the record's stable job id; Kind = the record's kind (run; checked in
|-- code); Attempts = POSTs made so far (the job's own send is the first); LastAnswer = the uplink's last answer, redacted.
|IF OBJECT_ID('cfg.UplinkOutbox') IS NULL
|CREATE TABLE cfg.UplinkOutbox (
|    OutboxId        BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_UplinkOutbox PRIMARY KEY,
|    Job             NVARCHAR(64)    NOT NULL,
|    Kind            NVARCHAR(16)    NOT NULL CONSTRAINT DF_UplinkOutbox_Kind DEFAULT N'run',
|    RecordJson      NVARCHAR(MAX)   NOT NULL,
|    CreatedUtc      DATETIME2(3)    NOT NULL CONSTRAINT DF_UplinkOutbox_CreatedUtc DEFAULT SYSUTCDATETIME(),
|    Attempts        INT             NOT NULL CONSTRAINT DF_UplinkOutbox_Attempts DEFAULT 0,
|    LastAttemptUtc  DATETIME2(3)    NULL,
|    LastAnswer      NVARCHAR(400)   NULL
|);
|
|-- the drain reads the oldest first; the bound counts and cuts by age
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_UplinkOutbox_Created' AND object_id = OBJECT_ID('cfg.UplinkOutbox'))
|CREATE INDEX IX_UplinkOutbox_Created ON cfg.UplinkOutbox (CreatedUtc, OutboxId) INCLUDE (Job);
|-- >>> GENERATED SUPPORT GRANT (engine\pro-settings\SI-SupportGrantSql.ps1, Get-SISupportGrantSchemaSql) -- do not edit by hand
|
|IF SCHEMA_ID(N'cfg') IS NULL EXEC (N'CREATE SCHEMA cfg');
|
|-- the customer's consent to the Invardia Support app: ONE row (Id = 1)
|IF OBJECT_ID(N'cfg.SupportConsent') IS NULL
|CREATE TABLE cfg.SupportConsent (
|    Id           TINYINT          NOT NULL CONSTRAINT PK_SupportConsent PRIMARY KEY CONSTRAINT CK_SupportConsent_One CHECK (Id = 1),
|    AppId        UNIQUEIDENTIFIER NOT NULL,
|    [Level]      NVARCHAR(16)     NOT NULL CONSTRAINT CK_SupportConsent_Level CHECK ([Level] IN (N'troubleshoot', N'setup')),
|    Source       NVARCHAR(16)     NOT NULL CONSTRAINT CK_SupportConsent_Source CHECK (Source IN (N'customer', N'derived')),
|    ConsentedBy  NVARCHAR(256)    NOT NULL,
|    ConsentedUtc DATETIME2(0)     NOT NULL CONSTRAINT DF_SupportConsent_ConsentedUtc DEFAULT SYSUTCDATETIME()
|);
|
|-- the journal of every open, close and expiry
|IF OBJECT_ID(N'cfg.SupportGrant') IS NULL
|CREATE TABLE cfg.SupportGrant (
|    EntryId      BIGINT           IDENTITY(1,1) NOT NULL CONSTRAINT PK_SupportGrant PRIMARY KEY,
|    GrantId      UNIQUEIDENTIFIER NOT NULL,
|    Action       NVARCHAR(8)      NOT NULL CONSTRAINT CK_SupportGrant_Action CHECK (Action IN (N'open', N'close', N'expire')),
|    LevelAsked   NVARCHAR(16)     NULL,
|    LevelGranted NVARCHAR(16)     NULL,
|    MaxUntilUtc  DATETIME2(0)     NULL,
|    Reason       NVARCHAR(200)    NULL,
|    Ticket       NVARCHAR(64)     NULL,
|    StartedBy    NVARCHAR(256)    NULL,
|    Outcome      NVARCHAR(16)     NOT NULL,
|    Detail       NVARCHAR(400)    NULL,
|    AtUtc        DATETIME2(0)     NOT NULL CONSTRAINT DF_SupportGrant_AtUtc DEFAULT SYSUTCDATETIME()
|);
|
|-- one row per role a grant holds open, written with the role change in one transaction
|IF OBJECT_ID(N'cfg.SupportJitMarker') IS NULL
|CREATE TABLE cfg.SupportJitMarker (
|    MarkerId     BIGINT           IDENTITY(1,1) NOT NULL CONSTRAINT PK_SupportJitMarker PRIMARY KEY,
|    GrantId      UNIQUEIDENTIFIER NOT NULL,
|    RoleName     SYSNAME          NOT NULL CONSTRAINT CK_SupportJitMarker_Role CHECK (RoleName IN (N'db_owner', N'db_datareader')),
|    Sid          VARBINARY(85)    NOT NULL,
|    PreExisting  BIT              NOT NULL,
|    AddedUtc     DATETIME2(0)     NOT NULL CONSTRAINT DF_SupportJitMarker_AddedUtc DEFAULT SYSUTCDATETIME(),
|    ExpiresUtc   DATETIME2(0)     NOT NULL,
|    ClosedUtc    DATETIME2(0)     NULL,
|    CloseReason  NVARCHAR(16)     NULL
|);
|
|-- the consent is the customer's: written by the database owner (the customer's admin: Grant-SISupportAccess, the guided
|-- install), or ONCE into the empty table by the updater as a DERIVED consent (from the Support app's Key Vault role). Every
|-- other writer is refused -- the engine can never name a principal or raise a level.
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_SupportConsent_Owner ON cfg.SupportConsent AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF ISNULL(IS_ROLEMEMBER(N''db_owner''), 0) = 1 RETURN;
|    IF (NOT EXISTS (SELECT 1 FROM deleted)) AND NOT EXISTS (SELECT 1 FROM inserted WHERE Source <> N''derived'')
|       AND (SELECT COUNT(*) FROM cfg.SupportConsent) = (SELECT COUNT(*) FROM inserted)
|       AND (ISNULL(IS_ROLEMEMBER(N''si_updater''), 0) = 1 OR ISNULL(IS_ROLEMEMBER(N''db_ddladmin''), 0) = 1) RETURN;
|    -- the level the customer set in the Invardia portal, applied by the UPDATER from its own call to Invardia (framework
|    -- SUPPORT ACCESS point 2): it may write a row only as ConsentedBy N''Invardia portal'', or remove the row (level none)
|    IF (ISNULL(IS_ROLEMEMBER(N''si_updater''), 0) = 1 OR ISNULL(IS_ROLEMEMBER(N''db_ddladmin''), 0) = 1)
|       AND NOT EXISTS (SELECT 1 FROM inserted WHERE Source <> N''customer'' OR ConsentedBy <> N''Invardia portal'') RETURN;
|    THROW 51806, N''cfg.SupportConsent: the consent is written by the customer admin (Grant-SISupportAccess) only'', 1;
|END');
|
|-- si-support-grant v1: created once, never altered (that would drop its signature)
|IF OBJECT_ID(N'cfg.SupportGrantOpen') IS NULL EXEC (N'CREATE PROCEDURE cfg.SupportGrantOpen
|    @RequestId nvarchar(64), @Level nvarchar(16), @MaxUntilUtc nvarchar(40), @Reason nvarchar(400), @Ticket nvarchar(128) = NULL, @StartedBy nvarchar(256) = NULL
|AS
|BEGIN
|    -- si-support-grant v1 (SecurityInsight #1021): the Invardia Support app''s just-in-time grant. The principal is ALWAYS the Support app of
|    -- cfg.SupportConsent -- never a parameter; the level is the lower of the asked and the consented one; at most 8 hours.
|    SET NOCOUNT ON; SET XACT_ABORT ON;
|    IF (NOT EXISTS (SELECT 1 FROM sys.crypt_properties AS cp JOIN sys.certificates AS c ON c.thumbprint = cp.thumbprint WHERE cp.major_id = @@PROCID AND c.name LIKE N''si_support_signer%''))
|        THROW 51801, N''the support grant procedure is not signed -- Install-SISupportGrantProcedure has not run on this database'', 1;
|    DECLARE @now datetime2(0) = SYSUTCDATETIME();
|    DECLARE @until datetime2(0) = TRY_CONVERT(datetime2(0), REPLACE(REPLACE(@MaxUntilUtc, N''Z'', N''''), N''+00:00'', N''''), 126);
|    IF @Level IS NULL OR @Level NOT IN (N''troubleshoot'', N''setup'') THROW 51802, N''the level must be troubleshoot or setup'', 1;
|    IF @until IS NULL OR @until <= @now OR @until > DATEADD(MINUTE, 482, @now) THROW 51802, N''maxUntil must be a UTC time in the next 8 hours'', 1;
|    IF LEN(LTRIM(RTRIM(ISNULL(@Reason, N'''')))) = 0 OR LEN(@Reason) > 200 THROW 51802, N''a reason of at most 200 characters is required'', 1;
|    IF TRY_CONVERT(uniqueidentifier, @RequestId) IS NULL THROW 51802, N''the request id must be a GUID'', 1;
|    DECLARE @app uniqueidentifier, @consent nvarchar(16);
|    SELECT @app = AppId, @consent = [Level] FROM cfg.SupportConsent WHERE Id = 1;
|    IF @app IS NULL THROW 51803, N''no consent: the customer has not granted the Invardia Support app access here (Grant-SISupportAccess)'', 1;
|    DECLARE @sid varbinary(85) = CONVERT(varbinary(16), @app);
|    DECLARE @uid int, @user sysname;
|    SELECT TOP (1) @uid = principal_id, @user = name FROM sys.database_principals WHERE sid = @sid AND principal_id > 4 AND type NOT IN (''R'', ''A'', ''C'', ''K'');
|    IF @uid IS NULL THROW 51804, N''the Invardia Support app has no database user here -- Install-SISupportGrantProcedure makes it'', 1;
|    DECLARE @granted nvarchar(16) = CASE WHEN @Level = N''setup'' AND @consent = N''setup'' THEN N''setup'' ELSE N''troubleshoot'' END;
|    DECLARE @role sysname = CASE @granted WHEN N''setup'' THEN N''db_owner'' ELSE N''db_datareader'' END;
|    DECLARE @grant uniqueidentifier = CONVERT(uniqueidentifier, @RequestId), @pre bit, @s nvarchar(400), @lk int;
|    BEGIN TRANSACTION;
|    EXEC @lk = sys.sp_getapplock @Resource = N''si-support-grant'', @LockMode = N''Exclusive'', @LockOwner = N''Transaction'', @LockTimeout = 60000;
|    IF @lk < 0 THROW 51805, N''another support grant holds the lock -- try again'', 1;
|    -- a new open extends what is open
|    UPDATE cfg.SupportJitMarker SET ExpiresUtc = @until WHERE ClosedUtc IS NULL AND ExpiresUtc < @until;
|    IF (NOT EXISTS (SELECT 1 FROM cfg.SupportJitMarker WHERE ClosedUtc IS NULL AND RoleName = @role AND Sid = @sid))
|    BEGIN
|        SET @pre = CASE WHEN EXISTS (SELECT 1 FROM sys.database_role_members AS m WHERE m.member_principal_id = @uid AND m.role_principal_id = DATABASE_PRINCIPAL_ID(@role)) THEN 1 ELSE 0 END;
|        IF @pre = 0 BEGIN SET @s = N''ALTER ROLE '' + QUOTENAME(@role) + N'' ADD MEMBER '' + QUOTENAME(@user) + N'';''; EXEC (@s); END
|        INSERT cfg.SupportJitMarker (GrantId, RoleName, Sid, PreExisting, ExpiresUtc) VALUES (@grant, @role, @sid, @pre, @until);
|    END
|    INSERT cfg.SupportGrant (GrantId, Action, LevelAsked, LevelGranted, MaxUntilUtc, Reason, Ticket, StartedBy, Outcome)
|    VALUES (@grant, N''open'', @Level, @granted, @until, LEFT(@Reason, 200), LEFT(@Ticket, 64), LEFT(@StartedBy, 256), N''granted'');
|    COMMIT TRANSACTION;
|    -- THE READ-BACK, from the catalog (never from the request)
|    SELECT DB_NAME() AS [Database], @granted AS LevelGranted, @role AS RoleName,
|           CONVERT(nvarchar(19), (SELECT MAX(ExpiresUtc) FROM cfg.SupportJitMarker WHERE ClosedUtc IS NULL), 126) + N''Z'' AS UntilUtc,
|           CASE WHEN EXISTS (SELECT 1 FROM sys.database_role_members AS m WHERE m.member_principal_id = @uid AND m.role_principal_id = DATABASE_PRINCIPAL_ID(@role)) THEN 1 ELSE 0 END AS RoleHeld,
|           CASE WHEN EXISTS (SELECT 1 FROM sys.database_role_members AS m WHERE m.member_principal_id = @uid AND m.role_principal_id = DATABASE_PRINCIPAL_ID(N''si_support_read'')) THEN 1 ELSE 0 END AS ReadOnlyHeld;
|END');
|
|-- si-support-grant v1: created once, never altered (that would drop its signature)
|IF OBJECT_ID(N'cfg.SupportGrantClose') IS NULL EXEC (N'CREATE PROCEDURE cfg.SupportGrantClose
|    @RequestId nvarchar(64), @Reason nvarchar(400) = NULL, @StartedBy nvarchar(256) = NULL
|AS
|BEGIN
|    -- si-support-grant v1 (SecurityInsight #1021): removes ONLY what the open grant markers added (PreExisting = 0) -- never a user, never
|    -- the read-only role si_support_read, never another principal, never a membership the Support app had before the grant.
|    SET NOCOUNT ON; SET XACT_ABORT ON;
|    IF (NOT EXISTS (SELECT 1 FROM sys.crypt_properties AS cp JOIN sys.certificates AS c ON c.thumbprint = cp.thumbprint WHERE cp.major_id = @@PROCID AND c.name LIKE N''si_support_signer%''))
|        THROW 51801, N''the support grant procedure is not signed -- Install-SISupportGrantProcedure has not run on this database'', 1;
|    IF TRY_CONVERT(uniqueidentifier, @RequestId) IS NULL THROW 51802, N''the request id must be a GUID'', 1;
|    DECLARE @now datetime2(0) = SYSUTCDATETIME(), @s nvarchar(400), @role sysname, @sid varbinary(85), @user sysname, @n int = 0, @closed int = 0, @lk int;
|    DECLARE @todo TABLE (MarkerId bigint PRIMARY KEY, RoleName sysname, Sid varbinary(85), PreExisting bit);
|    DECLARE @gone TABLE (Sid varbinary(85) PRIMARY KEY);
|    BEGIN TRANSACTION;
|    EXEC @lk = sys.sp_getapplock @Resource = N''si-support-grant'', @LockMode = N''Exclusive'', @LockOwner = N''Transaction'', @LockTimeout = 60000;
|    IF @lk < 0 THROW 51805, N''another support grant holds the lock -- try again'', 1;
|    INSERT @todo (MarkerId, RoleName, Sid, PreExisting) SELECT MarkerId, RoleName, Sid, PreExisting FROM cfg.SupportJitMarker WITH (UPDLOCK) WHERE ClosedUtc IS NULL;
|    SET @closed = @@ROWCOUNT;
|    -- a role is removed only when a closing marker ADDED it and no marker that stays open holds the same role
|    DECLARE c CURSOR LOCAL FAST_FORWARD FOR
|        SELECT DISTINCT t.RoleName, t.Sid FROM @todo AS t
|        WHERE t.PreExisting = 0 AND t.RoleName IN (N''db_owner'', N''db_datareader'')
|          AND NOT EXISTS (SELECT 1 FROM cfg.SupportJitMarker AS k WHERE k.ClosedUtc IS NULL AND k.RoleName = t.RoleName AND k.Sid = t.Sid
|                          AND NOT EXISTS (SELECT 1 FROM @todo AS x WHERE x.MarkerId = k.MarkerId));
|    OPEN c; FETCH NEXT FROM c INTO @role, @sid;
|    WHILE @@FETCH_STATUS = 0
|    BEGIN
|        SET @user = (SELECT TOP (1) name FROM sys.database_principals WHERE sid = @sid AND principal_id > 4 AND type NOT IN (''R'', ''A'', ''C'', ''K''));
|        IF @user IS NOT NULL AND EXISTS (SELECT 1 FROM sys.database_role_members AS m WHERE m.member_principal_id = DATABASE_PRINCIPAL_ID(@user) AND m.role_principal_id = DATABASE_PRINCIPAL_ID(@role))
|        BEGIN
|            SET @s = N''ALTER ROLE '' + QUOTENAME(@role) + N'' DROP MEMBER '' + QUOTENAME(@user) + N'';''; EXEC (@s); SET @n = @n + 1;
|            IF (NOT EXISTS (SELECT 1 FROM @gone WHERE Sid = @sid)) INSERT @gone (Sid) VALUES (@sid);
|        END
|        FETCH NEXT FROM c INTO @role, @sid;
|    END
|    CLOSE c; DEALLOCATE c;
|    UPDATE m SET ClosedUtc = @now, CloseReason = N''closed'' FROM cfg.SupportJitMarker AS m JOIN @todo AS t ON t.MarkerId = m.MarkerId;
|    INSERT cfg.SupportGrant (GrantId, Action, Reason, StartedBy, Outcome, Detail) VALUES (CONVERT(uniqueidentifier, @RequestId), N''close'', LEFT(@Reason, 200), LEFT(@StartedBy, 256), N''revoked'', CONVERT(nvarchar(20), @closed) + N'' open marker(s) closed, '' + CONVERT(nvarchar(20), @n) + N'' role membership(s) removed'');
|    COMMIT TRANSACTION;
|    -- the Support app''s open sessions end with its grant (a role change reaches a session only when it signs in again).
|    -- Best effort: a session that cannot be ended is counted, never a failure.
|    DECLARE @spid int, @ended int = 0, @notEnded int = 0;
|    DECLARE k CURSOR LOCAL FAST_FORWARD FOR
|        SELECT DISTINCT s.session_id FROM sys.dm_exec_sessions AS s JOIN @gone AS g ON s.original_security_id = g.Sid OR s.security_id = g.Sid WHERE s.session_id <> @@SPID;
|    OPEN k; FETCH NEXT FROM k INTO @spid;
|    WHILE @@FETCH_STATUS = 0
|    BEGIN
|        BEGIN TRY SET @s = N''KILL '' + CONVERT(nvarchar(12), @spid) + N'';''; EXEC (@s); SET @ended = @ended + 1; END TRY
|        BEGIN CATCH SET @notEnded = @notEnded + 1; END CATCH
|        FETCH NEXT FROM k INTO @spid;
|    END
|    CLOSE k; DEALLOCATE k;
|    -- THE READ-BACK (4a): what is still open, and whether the Support app still has its read-only access
|    DECLARE @app uniqueidentifier = (SELECT AppId FROM cfg.SupportConsent WHERE Id = 1);
|    DECLARE @asid varbinary(85) = CASE WHEN @app IS NULL THEN (SELECT TOP (1) Sid FROM @todo) ELSE CONVERT(varbinary(16), @app) END;
|    DECLARE @auid int = (SELECT TOP (1) principal_id FROM sys.database_principals WHERE sid = @asid AND principal_id > 4 AND type NOT IN (''R'', ''A'', ''C'', ''K''));
|    SELECT DB_NAME() AS [Database], @closed AS Closed, @n AS RolesRemoved, @ended AS SessionsEnded, @notEnded AS SessionsNotEnded,
|           (SELECT COUNT(*) FROM cfg.SupportJitMarker WHERE ClosedUtc IS NULL) AS StillOpen,
|           CONVERT(nvarchar(19), (SELECT MAX(ExpiresUtc) FROM cfg.SupportJitMarker WHERE ClosedUtc IS NULL), 126) + N''Z'' AS UntilUtc,
|           (SELECT COUNT(*) FROM @todo AS t JOIN sys.database_principals AS u ON u.sid = t.Sid AND u.principal_id > 4
|              JOIN sys.database_role_members AS m ON m.member_principal_id = u.principal_id AND m.role_principal_id = DATABASE_PRINCIPAL_ID(t.RoleName)
|             WHERE t.PreExisting = 0 AND NOT EXISTS (SELECT 1 FROM cfg.SupportJitMarker AS o WHERE o.ClosedUtc IS NULL AND o.RoleName = t.RoleName AND o.Sid = t.Sid)) AS RolesStillHeld,
|           CASE WHEN @auid IS NULL THEN 0 ELSE 1 END AS UserPresent,
|           CASE WHEN EXISTS (SELECT 1 FROM sys.database_role_members AS m WHERE m.member_principal_id = @auid AND m.role_principal_id = DATABASE_PRINCIPAL_ID(N''si_support_read'')) THEN 1 ELSE 0 END AS ReadOnlyHeld;
|END');
|
|-- si-support-grant v1: created once, never altered (that would drop its signature)
|IF OBJECT_ID(N'cfg.SupportGrantSweep') IS NULL EXEC (N'CREATE PROCEDURE cfg.SupportGrantSweep
|    @By nvarchar(64) = NULL
|AS
|BEGIN
|    -- si-support-grant v1 (SecurityInsight #1021): removes ONLY what the open grant markers added (PreExisting = 0) -- never a user, never
|    -- the read-only role si_support_read, never another principal, never a membership the Support app had before the grant.
|    SET NOCOUNT ON; SET XACT_ABORT ON;
|    IF (NOT EXISTS (SELECT 1 FROM sys.crypt_properties AS cp JOIN sys.certificates AS c ON c.thumbprint = cp.thumbprint WHERE cp.major_id = @@PROCID AND c.name LIKE N''si_support_signer%''))
|        THROW 51801, N''the support grant procedure is not signed -- Install-SISupportGrantProcedure has not run on this database'', 1;
|    DECLARE @now datetime2(0) = SYSUTCDATETIME(), @s nvarchar(400), @role sysname, @sid varbinary(85), @user sysname, @n int = 0, @closed int = 0, @lk int;
|    DECLARE @todo TABLE (MarkerId bigint PRIMARY KEY, RoleName sysname, Sid varbinary(85), PreExisting bit);
|    DECLARE @gone TABLE (Sid varbinary(85) PRIMARY KEY);
|    BEGIN TRANSACTION;
|    EXEC @lk = sys.sp_getapplock @Resource = N''si-support-grant'', @LockMode = N''Exclusive'', @LockOwner = N''Transaction'', @LockTimeout = 60000;
|    IF @lk < 0 THROW 51805, N''another support grant holds the lock -- try again'', 1;
|    INSERT @todo (MarkerId, RoleName, Sid, PreExisting) SELECT MarkerId, RoleName, Sid, PreExisting FROM cfg.SupportJitMarker WITH (UPDLOCK) WHERE ClosedUtc IS NULL AND ExpiresUtc <= @now;
|    SET @closed = @@ROWCOUNT;
|    -- a role is removed only when a closing marker ADDED it and no marker that stays open holds the same role
|    DECLARE c CURSOR LOCAL FAST_FORWARD FOR
|        SELECT DISTINCT t.RoleName, t.Sid FROM @todo AS t
|        WHERE t.PreExisting = 0 AND t.RoleName IN (N''db_owner'', N''db_datareader'')
|          AND NOT EXISTS (SELECT 1 FROM cfg.SupportJitMarker AS k WHERE k.ClosedUtc IS NULL AND k.RoleName = t.RoleName AND k.Sid = t.Sid
|                          AND NOT EXISTS (SELECT 1 FROM @todo AS x WHERE x.MarkerId = k.MarkerId));
|    OPEN c; FETCH NEXT FROM c INTO @role, @sid;
|    WHILE @@FETCH_STATUS = 0
|    BEGIN
|        SET @user = (SELECT TOP (1) name FROM sys.database_principals WHERE sid = @sid AND principal_id > 4 AND type NOT IN (''R'', ''A'', ''C'', ''K''));
|        IF @user IS NOT NULL AND EXISTS (SELECT 1 FROM sys.database_role_members AS m WHERE m.member_principal_id = DATABASE_PRINCIPAL_ID(@user) AND m.role_principal_id = DATABASE_PRINCIPAL_ID(@role))
|        BEGIN
|            SET @s = N''ALTER ROLE '' + QUOTENAME(@role) + N'' DROP MEMBER '' + QUOTENAME(@user) + N'';''; EXEC (@s); SET @n = @n + 1;
|            IF (NOT EXISTS (SELECT 1 FROM @gone WHERE Sid = @sid)) INSERT @gone (Sid) VALUES (@sid);
|        END
|        FETCH NEXT FROM c INTO @role, @sid;
|    END
|    CLOSE c; DEALLOCATE c;
|    UPDATE m SET ClosedUtc = @now, CloseReason = N''expired'' FROM cfg.SupportJitMarker AS m JOIN @todo AS t ON t.MarkerId = m.MarkerId;
|    IF @closed > 0 INSERT cfg.SupportGrant (GrantId, Action, Reason, StartedBy, Outcome, Detail) VALUES (NEWID(), N''expire'', N''maxUntil passed'', LEFT(@By, 256), N''revoked'', CONVERT(nvarchar(20), @closed) + N'' open marker(s) expired, '' + CONVERT(nvarchar(20), @n) + N'' role membership(s) removed'');
|    COMMIT TRANSACTION;
|    -- the Support app''s open sessions end with its grant (a role change reaches a session only when it signs in again).
|    -- Best effort: a session that cannot be ended is counted, never a failure.
|    DECLARE @spid int, @ended int = 0, @notEnded int = 0;
|    DECLARE k CURSOR LOCAL FAST_FORWARD FOR
|        SELECT DISTINCT s.session_id FROM sys.dm_exec_sessions AS s JOIN @gone AS g ON s.original_security_id = g.Sid OR s.security_id = g.Sid WHERE s.session_id <> @@SPID;
|    OPEN k; FETCH NEXT FROM k INTO @spid;
|    WHILE @@FETCH_STATUS = 0
|    BEGIN
|        BEGIN TRY SET @s = N''KILL '' + CONVERT(nvarchar(12), @spid) + N'';''; EXEC (@s); SET @ended = @ended + 1; END TRY
|        BEGIN CATCH SET @notEnded = @notEnded + 1; END CATCH
|        FETCH NEXT FROM k INTO @spid;
|    END
|    CLOSE k; DEALLOCATE k;
|    -- THE READ-BACK (4a): what is still open, and whether the Support app still has its read-only access
|    DECLARE @app uniqueidentifier = (SELECT AppId FROM cfg.SupportConsent WHERE Id = 1);
|    DECLARE @asid varbinary(85) = CASE WHEN @app IS NULL THEN (SELECT TOP (1) Sid FROM @todo) ELSE CONVERT(varbinary(16), @app) END;
|    DECLARE @auid int = (SELECT TOP (1) principal_id FROM sys.database_principals WHERE sid = @asid AND principal_id > 4 AND type NOT IN (''R'', ''A'', ''C'', ''K''));
|    SELECT DB_NAME() AS [Database], @closed AS Closed, @n AS RolesRemoved, @ended AS SessionsEnded, @notEnded AS SessionsNotEnded,
|           (SELECT COUNT(*) FROM cfg.SupportJitMarker WHERE ClosedUtc IS NULL) AS StillOpen,
|           CONVERT(nvarchar(19), (SELECT MAX(ExpiresUtc) FROM cfg.SupportJitMarker WHERE ClosedUtc IS NULL), 126) + N''Z'' AS UntilUtc,
|           (SELECT COUNT(*) FROM @todo AS t JOIN sys.database_principals AS u ON u.sid = t.Sid AND u.principal_id > 4
|              JOIN sys.database_role_members AS m ON m.member_principal_id = u.principal_id AND m.role_principal_id = DATABASE_PRINCIPAL_ID(t.RoleName)
|             WHERE t.PreExisting = 0 AND NOT EXISTS (SELECT 1 FROM cfg.SupportJitMarker AS o WHERE o.ClosedUtc IS NULL AND o.RoleName = t.RoleName AND o.Sid = t.Sid)) AS RolesStillHeld,
|           CASE WHEN @auid IS NULL THEN 0 ELSE 1 END AS UserPresent,
|           CASE WHEN EXISTS (SELECT 1 FROM sys.database_role_members AS m WHERE m.member_principal_id = @auid AND m.role_principal_id = DATABASE_PRINCIPAL_ID(N''si_support_read'')) THEN 1 ELSE 0 END AS ReadOnlyHeld;
|END');
|
|-- si-support-grant v1: created once, never altered (that would drop its signature)
|IF OBJECT_ID(N'cfg.SupportGrantStatus') IS NULL EXEC (N'CREATE PROCEDURE cfg.SupportGrantStatus
|AS
|BEGIN
|    -- si-support-grant v1 (SecurityInsight #1021): READ ONLY -- the Support app''s access in this database, for the heartbeat and the job.
|    SET NOCOUNT ON;
|    DECLARE @now datetime2(0) = SYSUTCDATETIME(), @app uniqueidentifier, @consent nvarchar(16), @sid varbinary(85), @uid int;
|    SELECT @app = AppId, @consent = [Level] FROM cfg.SupportConsent WHERE Id = 1;
|    IF @app IS NOT NULL SET @sid = CONVERT(varbinary(16), @app);
|    SELECT TOP (1) @uid = principal_id FROM sys.database_principals WHERE sid = @sid AND principal_id > 4 AND type NOT IN (''R'', ''A'', ''C'', ''K'');
|    SELECT DB_NAME() AS [Database],
|           CASE WHEN EXISTS (SELECT 1 FROM sys.crypt_properties AS cp JOIN sys.certificates AS c ON c.thumbprint = cp.thumbprint WHERE cp.major_id = @@PROCID AND c.name LIKE N''si_support_signer%'') THEN 1 ELSE 0 END AS Signed,
|           @consent AS Consent,
|           CASE WHEN @uid IS NULL THEN 0 ELSE 1 END AS UserPresent,
|           CASE WHEN EXISTS (SELECT 1 FROM sys.database_role_members AS m WHERE m.member_principal_id = @uid AND m.role_principal_id = DATABASE_PRINCIPAL_ID(N''si_support_read'')) THEN 1 ELSE 0 END AS ReadOnlyHeld,
|           (SELECT COUNT(*) FROM cfg.SupportJitMarker WHERE ClosedUtc IS NULL) AS JitOpen,
|           CONVERT(nvarchar(19), (SELECT MAX(ExpiresUtc) FROM cfg.SupportJitMarker WHERE ClosedUtc IS NULL), 126) + N''Z'' AS JitUntilUtc,
|           CASE WHEN EXISTS (SELECT 1 FROM cfg.SupportJitMarker WHERE ClosedUtc IS NULL AND RoleName = N''db_owner'') THEN N''setup''
|                WHEN EXISTS (SELECT 1 FROM cfg.SupportJitMarker WHERE ClosedUtc IS NULL) THEN N''troubleshoot'' ELSE NULL END AS JitLevel,
|           (SELECT COUNT(*) FROM cfg.SupportJitMarker WHERE ClosedUtc IS NULL AND ExpiresUtc <= @now) AS JitOverdue,
|           CASE WHEN @uid IS NOT NULL AND EXISTS (SELECT 1 FROM sys.database_role_members AS m WHERE m.member_principal_id = @uid AND m.role_principal_id = DATABASE_PRINCIPAL_ID(N''db_owner''))
|                 AND NOT EXISTS (SELECT 1 FROM cfg.SupportJitMarker WHERE ClosedUtc IS NULL AND RoleName = N''db_owner'' AND PreExisting = 0) THEN 1 ELSE 0 END AS StandingOwner;
|END');
|
|-- <<< GENERATED SUPPORT GRANT
|
|-- >>> GENERATED CONFIG JOURNAL (engine\pro-settings\Build-SIConfigJournalSql.ps1 from config\config-entities.locked.json) -- do not edit by hand
|
|-- the journal of setting (cfg.Setting)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_Setting_Journal ON cfg.Setting AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''setting'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [Name], [Scope] FROM inserted UNION SELECT [Name], [Scope] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[Name], N''|'', i.[Scope]), 900) AS K, 1 AS L, (SELECT i.[Name] AS [Name], i.[Scope] AS [Scope], i.[ValueJson] AS [ValueJson], i.[KeyVaultSecretName] AS [KeyVaultSecretName], i.[UpdatedAt] AS [UpdatedAt], i.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[Name] AS [Name], i.[Scope] AS [Scope], i.[ValueJson] AS [ValueJson], i.[KeyVaultSecretName] AS [KeyVaultSecretName] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[Name] = x.[Name] AND i.[Scope] = x.[Scope]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[Name], N''|'', d.[Scope]), 900) AS K, 1 AS L, (SELECT d.[Name] AS [Name], d.[Scope] AS [Scope], d.[ValueJson] AS [ValueJson], d.[KeyVaultSecretName] AS [KeyVaultSecretName], d.[UpdatedAt] AS [UpdatedAt], d.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[Name] AS [Name], d.[Scope] AS [Scope], d.[ValueJson] AS [ValueJson], d.[KeyVaultSecretName] AS [KeyVaultSecretName] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[Name] = x.[Name] AND d.[Scope] = x.[Scope]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of document (cfg.Document)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_Document_Journal ON cfg.Document AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''document'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [Kind], [Key] FROM inserted UNION SELECT [Kind], [Key] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[Kind], N''|'', i.[Key]), 900) AS K, 1 AS L, (SELECT i.[Kind] AS [Kind], i.[Key] AS [Key], i.[Body] AS [Body], i.[UpdatedAt] AS [UpdatedAt], i.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[Kind] AS [Kind], i.[Key] AS [Key], i.[Body] AS [Body] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[Kind] = x.[Kind] AND i.[Key] = x.[Key]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[Kind], N''|'', d.[Key]), 900) AS K, 1 AS L, (SELECT d.[Kind] AS [Kind], d.[Key] AS [Key], d.[Body] AS [Body], d.[UpdatedAt] AS [UpdatedAt], d.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[Kind] AS [Kind], d.[Key] AS [Key], d.[Body] AS [Body] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[Kind] = x.[Kind] AND d.[Key] = x.[Key]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of access (cfg.AccessAssignment)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_AccessAssignment_Journal ON cfg.AccessAssignment AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''access'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [PrincipalId] FROM inserted UNION SELECT [PrincipalId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[PrincipalId], N''''), 900) AS K, 1 AS L, (SELECT i.[PrincipalId] AS [PrincipalId], i.[PrincipalType] AS [PrincipalType], i.[DisplayName] AS [DisplayName], i.[Role] AS [Role], i.[ScopeJson] AS [ScopeJson], i.[AccountMail] AS [AccountMail], i.[ForwardTo] AS [ForwardTo], i.[UpdatedAt] AS [UpdatedAt], i.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[PrincipalId] AS [PrincipalId], i.[PrincipalType] AS [PrincipalType], i.[DisplayName] AS [DisplayName], i.[Role] AS [Role], i.[ScopeJson] AS [ScopeJson], i.[AccountMail] AS [AccountMail], i.[ForwardTo] AS [ForwardTo] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[PrincipalId] = x.[PrincipalId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[PrincipalId], N''''), 900) AS K, 1 AS L, (SELECT d.[PrincipalId] AS [PrincipalId], d.[PrincipalType] AS [PrincipalType], d.[DisplayName] AS [DisplayName], d.[Role] AS [Role], d.[ScopeJson] AS [ScopeJson], d.[AccountMail] AS [AccountMail], d.[ForwardTo] AS [ForwardTo], d.[UpdatedAt] AS [UpdatedAt], d.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[PrincipalId] AS [PrincipalId], d.[PrincipalType] AS [PrincipalType], d.[DisplayName] AS [DisplayName], d.[Role] AS [Role], d.[ScopeJson] AS [ScopeJson], d.[AccountMail] AS [AccountMail], d.[ForwardTo] AS [ForwardTo] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[PrincipalId] = x.[PrincipalId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of override (cfg.ItemOverride)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_ItemOverride_Journal ON cfg.ItemOverride AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''override'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [Kind], [ItemKey] FROM inserted UNION SELECT [Kind], [ItemKey] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[Kind], N''|'', i.[ItemKey]), 900) AS K, 1 AS L, (SELECT i.[Kind] AS [Kind], i.[ItemKey] AS [ItemKey], i.[State] AS [State], i.[BodyJson] AS [BodyJson], i.[Format] AS [Format], i.[BaseVersion] AS [BaseVersion], i.[BaseHash] AS [BaseHash], i.[UpdatedAt] AS [UpdatedAt], i.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[Kind] AS [Kind], i.[ItemKey] AS [ItemKey], i.[State] AS [State], i.[BodyJson] AS [BodyJson], i.[Format] AS [Format], i.[BaseVersion] AS [BaseVersion], i.[BaseHash] AS [BaseHash] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[Kind] = x.[Kind] AND i.[ItemKey] = x.[ItemKey]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[Kind], N''|'', d.[ItemKey]), 900) AS K, 1 AS L, (SELECT d.[Kind] AS [Kind], d.[ItemKey] AS [ItemKey], d.[State] AS [State], d.[BodyJson] AS [BodyJson], d.[Format] AS [Format], d.[BaseVersion] AS [BaseVersion], d.[BaseHash] AS [BaseHash], d.[UpdatedAt] AS [UpdatedAt], d.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[Kind] AS [Kind], d.[ItemKey] AS [ItemKey], d.[State] AS [State], d.[BodyJson] AS [BodyJson], d.[Format] AS [Format], d.[BaseVersion] AS [BaseVersion], d.[BaseHash] AS [BaseHash] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[Kind] = x.[Kind] AND d.[ItemKey] = x.[ItemKey]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of exemption (cfg.Exemption)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_Exemption_Journal ON cfg.Exemption AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''exemption'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [ExemptionId] FROM inserted UNION SELECT [ExemptionId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[ExemptionId], N''''), 900) AS K, CASE WHEN i.[RevokedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT i.[ExemptionId] AS [ExemptionId], i.[Scope] AS [Scope], i.[ReportName] AS [ReportName], i.[ConfigurationId] AS [ConfigurationId], i.[Cve] AS [Cve], i.[AssetKey] AS [AssetKey], i.[Reason] AS [Reason], i.[ExpiresAt] AS [ExpiresAt], i.[CreatedBy] AS [CreatedBy], i.[CreatedAt] AS [CreatedAt], i.[RevokedAt] AS [RevokedAt], i.[RevokedBy] AS [RevokedBy], i.[RequestId] AS [RequestId], i.[Domain] AS [Domain], i.[ApprovedBy] AS [ApprovedBy], i.[ApprovedAt] AS [ApprovedAt], i.[ReviewedBy] AS [ReviewedBy], i.[ReviewedAt] AS [ReviewedAt], i.[Category] AS [Category] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[ExemptionId] AS [ExemptionId], i.[Scope] AS [Scope], i.[ReportName] AS [ReportName], i.[ConfigurationId] AS [ConfigurationId], i.[Cve] AS [Cve], i.[AssetKey] AS [AssetKey], i.[Reason] AS [Reason], i.[ExpiresAt] AS [ExpiresAt], i.[CreatedBy] AS [CreatedBy], i.[RevokedAt] AS [RevokedAt], i.[RevokedBy] AS [RevokedBy], i.[RequestId] AS [RequestId], i.[Domain] AS [Domain], i.[ApprovedBy] AS [ApprovedBy], i.[ApprovedAt] AS [ApprovedAt], i.[Category] AS [Category] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[ExemptionId] = x.[ExemptionId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[ExemptionId], N''''), 900) AS K, CASE WHEN d.[RevokedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT d.[ExemptionId] AS [ExemptionId], d.[Scope] AS [Scope], d.[ReportName] AS [ReportName], d.[ConfigurationId] AS [ConfigurationId], d.[Cve] AS [Cve], d.[AssetKey] AS [AssetKey], d.[Reason] AS [Reason], d.[ExpiresAt] AS [ExpiresAt], d.[CreatedBy] AS [CreatedBy], d.[CreatedAt] AS [CreatedAt], d.[RevokedAt] AS [RevokedAt], d.[RevokedBy] AS [RevokedBy], d.[RequestId] AS [RequestId], d.[Domain] AS [Domain], d.[ApprovedBy] AS [ApprovedBy], d.[ApprovedAt] AS [ApprovedAt], d.[ReviewedBy] AS [ReviewedBy], d.[ReviewedAt] AS [ReviewedAt], d.[Category] AS [Category] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[ExemptionId] AS [ExemptionId], d.[Scope] AS [Scope], d.[ReportName] AS [ReportName], d.[ConfigurationId] AS [ConfigurationId], d.[Cve] AS [Cve], d.[AssetKey] AS [AssetKey], d.[Reason] AS [Reason], d.[ExpiresAt] AS [ExpiresAt], d.[CreatedBy] AS [CreatedBy], d.[RevokedAt] AS [RevokedAt], d.[RevokedBy] AS [RevokedBy], d.[RequestId] AS [RequestId], d.[Domain] AS [Domain], d.[ApprovedBy] AS [ApprovedBy], d.[ApprovedAt] AS [ApprovedAt], d.[Category] AS [Category] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[ExemptionId] = x.[ExemptionId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of connector (cfg.Connector)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_Connector_Journal ON cfg.Connector AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''connector'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [ConnectorId] FROM inserted UNION SELECT [ConnectorId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[Name], N''''), 900) AS K, 1 AS L, (SELECT i.[ConnectorId] AS [ConnectorId], i.[Name] AS [Name], i.[Kind] AS [Kind], i.[Direction] AS [Direction], i.[Enabled] AS [Enabled], i.[Mode] AS [Mode], i.[AllowCreate] AS [AllowCreate], i.[AllowClose] AS [AllowClose], i.[SettingsJson] AS [SettingsJson], i.[SecretRefsJson] AS [SecretRefsJson], i.[MappingJson] AS [MappingJson], i.[CreatedAt] AS [CreatedAt], i.[CreatedBy] AS [CreatedBy], i.[UpdatedAt] AS [UpdatedAt], i.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[Name] AS [Name], i.[Kind] AS [Kind], i.[Direction] AS [Direction], i.[Enabled] AS [Enabled], i.[Mode] AS [Mode], i.[AllowCreate] AS [AllowCreate], i.[AllowClose] AS [AllowClose], i.[SettingsJson] AS [SettingsJson], i.[SecretRefsJson] AS [SecretRefsJson], i.[MappingJson] AS [MappingJson] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[ConnectorId] = x.[ConnectorId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[Name], N''''), 900) AS K, 1 AS L, (SELECT d.[ConnectorId] AS [ConnectorId], d.[Name] AS [Name], d.[Kind] AS [Kind], d.[Direction] AS [Direction], d.[Enabled] AS [Enabled], d.[Mode] AS [Mode], d.[AllowCreate] AS [AllowCreate], d.[AllowClose] AS [AllowClose], d.[SettingsJson] AS [SettingsJson], d.[SecretRefsJson] AS [SecretRefsJson], d.[MappingJson] AS [MappingJson], d.[CreatedAt] AS [CreatedAt], d.[CreatedBy] AS [CreatedBy], d.[UpdatedAt] AS [UpdatedAt], d.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[Name] AS [Name], d.[Kind] AS [Kind], d.[Direction] AS [Direction], d.[Enabled] AS [Enabled], d.[Mode] AS [Mode], d.[AllowCreate] AS [AllowCreate], d.[AllowClose] AS [AllowClose], d.[SettingsJson] AS [SettingsJson], d.[SecretRefsJson] AS [SecretRefsJson], d.[MappingJson] AS [MappingJson] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[ConnectorId] = x.[ConnectorId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of department (cfg.Department)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_Department_Journal ON cfg.Department AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''department'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [DepartmentId] FROM inserted UNION SELECT [DepartmentId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[DepartmentId], N''''), 900) AS K, CASE WHEN i.[RetiredAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT i.[DepartmentId] AS [DepartmentId], i.[Name] AS [Name], i.[Mail] AS [Mail], i.[Description] AS [Description], i.[MatchValues] AS [MatchValues], i.[MaintenanceWindowsJson] AS [MaintenanceWindowsJson], i.[CreatedAt] AS [CreatedAt], i.[CreatedBy] AS [CreatedBy], i.[UpdatedAt] AS [UpdatedAt], i.[UpdatedBy] AS [UpdatedBy], i.[RetiredAt] AS [RetiredAt], i.[RetiredBy] AS [RetiredBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[DepartmentId] AS [DepartmentId], i.[Name] AS [Name], i.[Mail] AS [Mail], i.[Description] AS [Description], i.[MatchValues] AS [MatchValues], i.[MaintenanceWindowsJson] AS [MaintenanceWindowsJson], i.[RetiredAt] AS [RetiredAt], i.[RetiredBy] AS [RetiredBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[DepartmentId] = x.[DepartmentId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[DepartmentId], N''''), 900) AS K, CASE WHEN d.[RetiredAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT d.[DepartmentId] AS [DepartmentId], d.[Name] AS [Name], d.[Mail] AS [Mail], d.[Description] AS [Description], d.[MatchValues] AS [MatchValues], d.[MaintenanceWindowsJson] AS [MaintenanceWindowsJson], d.[CreatedAt] AS [CreatedAt], d.[CreatedBy] AS [CreatedBy], d.[UpdatedAt] AS [UpdatedAt], d.[UpdatedBy] AS [UpdatedBy], d.[RetiredAt] AS [RetiredAt], d.[RetiredBy] AS [RetiredBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[DepartmentId] AS [DepartmentId], d.[Name] AS [Name], d.[Mail] AS [Mail], d.[Description] AS [Description], d.[MatchValues] AS [MatchValues], d.[MaintenanceWindowsJson] AS [MaintenanceWindowsJson], d.[RetiredAt] AS [RetiredAt], d.[RetiredBy] AS [RetiredBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[DepartmentId] = x.[DepartmentId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of member (cfg.DepartmentMember)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_DepartmentMember_Journal ON cfg.DepartmentMember AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''member'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [MemberId] FROM inserted UNION SELECT [MemberId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[DepartmentId], N''|'', i.[Role], N''|'', i.[PrincipalType], N''|'', i.[ObjectId], N''|'', i.[Mail]), 900) AS K, 1 AS L, (SELECT i.[MemberId] AS [MemberId], i.[DepartmentId] AS [DepartmentId], i.[Role] AS [Role], i.[ObjectId] AS [ObjectId], i.[PrincipalType] AS [PrincipalType], i.[DisplayName] AS [DisplayName], i.[Mail] AS [Mail], i.[Company] AS [Company], i.[IsExternal] AS [IsExternal], i.[AddedAt] AS [AddedAt], i.[AddedBy] AS [AddedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[DepartmentId] AS [DepartmentId], i.[Role] AS [Role], i.[ObjectId] AS [ObjectId], i.[PrincipalType] AS [PrincipalType], i.[DisplayName] AS [DisplayName], i.[Mail] AS [Mail], i.[Company] AS [Company], i.[IsExternal] AS [IsExternal] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[MemberId] = x.[MemberId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[DepartmentId], N''|'', d.[Role], N''|'', d.[PrincipalType], N''|'', d.[ObjectId], N''|'', d.[Mail]), 900) AS K, 1 AS L, (SELECT d.[MemberId] AS [MemberId], d.[DepartmentId] AS [DepartmentId], d.[Role] AS [Role], d.[ObjectId] AS [ObjectId], d.[PrincipalType] AS [PrincipalType], d.[DisplayName] AS [DisplayName], d.[Mail] AS [Mail], d.[Company] AS [Company], d.[IsExternal] AS [IsExternal], d.[AddedAt] AS [AddedAt], d.[AddedBy] AS [AddedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[DepartmentId] AS [DepartmentId], d.[Role] AS [Role], d.[ObjectId] AS [ObjectId], d.[PrincipalType] AS [PrincipalType], d.[DisplayName] AS [DisplayName], d.[Mail] AS [Mail], d.[Company] AS [Company], d.[IsExternal] AS [IsExternal] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[MemberId] = x.[MemberId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of responsibilityrule (cfg.ResponsibilityRule)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_ResponsibilityRule_Journal ON cfg.ResponsibilityRule AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''responsibilityrule'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [RuleId] FROM inserted UNION SELECT [RuleId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[DepartmentId], N''|'', i.[Kind], N''|'', i.[Pattern]), 900) AS K, 1 AS L, (SELECT i.[RuleId] AS [RuleId], i.[Kind] AS [Kind], i.[Pattern] AS [Pattern], i.[DepartmentId] AS [DepartmentId], i.[SortOrder] AS [SortOrder], i.[Enabled] AS [Enabled], i.[Note] AS [Note], i.[CreatedAt] AS [CreatedAt], i.[CreatedBy] AS [CreatedBy], i.[UpdatedAt] AS [UpdatedAt], i.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[Kind] AS [Kind], i.[Pattern] AS [Pattern], i.[DepartmentId] AS [DepartmentId], i.[SortOrder] AS [SortOrder], i.[Enabled] AS [Enabled], i.[Note] AS [Note] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[RuleId] = x.[RuleId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[DepartmentId], N''|'', d.[Kind], N''|'', d.[Pattern]), 900) AS K, 1 AS L, (SELECT d.[RuleId] AS [RuleId], d.[Kind] AS [Kind], d.[Pattern] AS [Pattern], d.[DepartmentId] AS [DepartmentId], d.[SortOrder] AS [SortOrder], d.[Enabled] AS [Enabled], d.[Note] AS [Note], d.[CreatedAt] AS [CreatedAt], d.[CreatedBy] AS [CreatedBy], d.[UpdatedAt] AS [UpdatedAt], d.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[Kind] AS [Kind], d.[Pattern] AS [Pattern], d.[DepartmentId] AS [DepartmentId], d.[SortOrder] AS [SortOrder], d.[Enabled] AS [Enabled], d.[Note] AS [Note] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[RuleId] = x.[RuleId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of responsibilityoverride (cfg.ResponsibilityOverride)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_ResponsibilityOverride_Journal ON cfg.ResponsibilityOverride AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''responsibilityoverride'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [OverrideId] FROM inserted UNION SELECT [OverrideId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[Scope], N''|'', i.[AssetKey], N''|'', i.[RecommendationKey]), 900) AS K, CASE WHEN i.[RevokedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT i.[OverrideId] AS [OverrideId], i.[Scope] AS [Scope], i.[AssetKey] AS [AssetKey], i.[RecommendationKey] AS [RecommendationKey], i.[DepartmentId] AS [DepartmentId], i.[Reason] AS [Reason], i.[CreatedAt] AS [CreatedAt], i.[CreatedBy] AS [CreatedBy], i.[RevokedAt] AS [RevokedAt], i.[RevokedBy] AS [RevokedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[Scope] AS [Scope], i.[AssetKey] AS [AssetKey], i.[RecommendationKey] AS [RecommendationKey], i.[DepartmentId] AS [DepartmentId], i.[Reason] AS [Reason], i.[RevokedAt] AS [RevokedAt], i.[RevokedBy] AS [RevokedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[OverrideId] = x.[OverrideId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[Scope], N''|'', d.[AssetKey], N''|'', d.[RecommendationKey]), 900) AS K, CASE WHEN d.[RevokedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT d.[OverrideId] AS [OverrideId], d.[Scope] AS [Scope], d.[AssetKey] AS [AssetKey], d.[RecommendationKey] AS [RecommendationKey], d.[DepartmentId] AS [DepartmentId], d.[Reason] AS [Reason], d.[CreatedAt] AS [CreatedAt], d.[CreatedBy] AS [CreatedBy], d.[RevokedAt] AS [RevokedAt], d.[RevokedBy] AS [RevokedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[Scope] AS [Scope], d.[AssetKey] AS [AssetKey], d.[RecommendationKey] AS [RecommendationKey], d.[DepartmentId] AS [DepartmentId], d.[Reason] AS [Reason], d.[RevokedAt] AS [RevokedAt], d.[RevokedBy] AS [RevokedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[OverrideId] = x.[OverrideId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of domainrole (cfg.DomainRole)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_DomainRole_Journal ON cfg.DomainRole AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''domainrole'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [Domain], [Role], [Principal] FROM inserted UNION SELECT [Domain], [Role], [Principal] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[Domain], N''|'', i.[Role], N''|'', i.[Principal]), 900) AS K, CASE WHEN i.[RemovedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT i.[Domain] AS [Domain], i.[Role] AS [Role], i.[Principal] AS [Principal], i.[AddedAt] AS [AddedAt], i.[AddedBy] AS [AddedBy], i.[RemovedAt] AS [RemovedAt], i.[RemovedBy] AS [RemovedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[Domain] AS [Domain], i.[Role] AS [Role], i.[Principal] AS [Principal], i.[RemovedAt] AS [RemovedAt], i.[RemovedBy] AS [RemovedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[Domain] = x.[Domain] AND i.[Role] = x.[Role] AND i.[Principal] = x.[Principal]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[Domain], N''|'', d.[Role], N''|'', d.[Principal]), 900) AS K, CASE WHEN d.[RemovedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT d.[Domain] AS [Domain], d.[Role] AS [Role], d.[Principal] AS [Principal], d.[AddedAt] AS [AddedAt], d.[AddedBy] AS [AddedBy], d.[RemovedAt] AS [RemovedAt], d.[RemovedBy] AS [RemovedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[Domain] AS [Domain], d.[Role] AS [Role], d.[Principal] AS [Principal], d.[RemovedAt] AS [RemovedAt], d.[RemovedBy] AS [RemovedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[Domain] = x.[Domain] AND d.[Role] = x.[Role] AND d.[Principal] = x.[Principal]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of categoryrole (cfg.CategoryRole)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_CategoryRole_Journal ON cfg.CategoryRole AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''categoryrole'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [Domain], [Category], [Role], [Principal] FROM inserted UNION SELECT [Domain], [Category], [Role], [Principal] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[Domain], N''|'', i.[Category], N''|'', i.[Role], N''|'', i.[Principal]), 900) AS K, CASE WHEN i.[RemovedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT i.[Domain] AS [Domain], i.[Category] AS [Category], i.[Role] AS [Role], i.[Principal] AS [Principal], i.[AddedAt] AS [AddedAt], i.[AddedBy] AS [AddedBy], i.[RemovedAt] AS [RemovedAt], i.[RemovedBy] AS [RemovedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[Domain] AS [Domain], i.[Category] AS [Category], i.[Role] AS [Role], i.[Principal] AS [Principal], i.[RemovedAt] AS [RemovedAt], i.[RemovedBy] AS [RemovedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[Domain] = x.[Domain] AND i.[Category] = x.[Category] AND i.[Role] = x.[Role] AND i.[Principal] = x.[Principal]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[Domain], N''|'', d.[Category], N''|'', d.[Role], N''|'', d.[Principal]), 900) AS K, CASE WHEN d.[RemovedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT d.[Domain] AS [Domain], d.[Category] AS [Category], d.[Role] AS [Role], d.[Principal] AS [Principal], d.[AddedAt] AS [AddedAt], d.[AddedBy] AS [AddedBy], d.[RemovedAt] AS [RemovedAt], d.[RemovedBy] AS [RemovedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[Domain] AS [Domain], d.[Category] AS [Category], d.[Role] AS [Role], d.[Principal] AS [Principal], d.[RemovedAt] AS [RemovedAt], d.[RemovedBy] AS [RemovedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[Domain] = x.[Domain] AND d.[Category] = x.[Category] AND d.[Role] = x.[Role] AND d.[Principal] = x.[Principal]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of remediationflow (cfg.RemediationFlow)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_RemediationFlow_Journal ON cfg.RemediationFlow AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''remediationflow'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [FlowId] FROM inserted UNION SELECT [FlowId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[FlowId], N''''), 900) AS K, CASE WHEN i.[RetiredAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT i.[FlowId] AS [FlowId], i.[DepartmentId] AS [DepartmentId], i.[Category] AS [Category], i.[Subcategory] AS [Subcategory], i.[Action] AS [Action], i.[VendorName] AS [VendorName], i.[VendorMail] AS [VendorMail], i.[Note] AS [Note], i.[SortOrder] AS [SortOrder], i.[CreatedAt] AS [CreatedAt], i.[CreatedBy] AS [CreatedBy], i.[UpdatedAt] AS [UpdatedAt], i.[UpdatedBy] AS [UpdatedBy], i.[RetiredAt] AS [RetiredAt], i.[RetiredBy] AS [RetiredBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[FlowId] AS [FlowId], i.[DepartmentId] AS [DepartmentId], i.[Category] AS [Category], i.[Subcategory] AS [Subcategory], i.[Action] AS [Action], i.[VendorName] AS [VendorName], i.[VendorMail] AS [VendorMail], i.[Note] AS [Note], i.[SortOrder] AS [SortOrder], i.[RetiredAt] AS [RetiredAt], i.[RetiredBy] AS [RetiredBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[FlowId] = x.[FlowId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[FlowId], N''''), 900) AS K, CASE WHEN d.[RetiredAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT d.[FlowId] AS [FlowId], d.[DepartmentId] AS [DepartmentId], d.[Category] AS [Category], d.[Subcategory] AS [Subcategory], d.[Action] AS [Action], d.[VendorName] AS [VendorName], d.[VendorMail] AS [VendorMail], d.[Note] AS [Note], d.[SortOrder] AS [SortOrder], d.[CreatedAt] AS [CreatedAt], d.[CreatedBy] AS [CreatedBy], d.[UpdatedAt] AS [UpdatedAt], d.[UpdatedBy] AS [UpdatedBy], d.[RetiredAt] AS [RetiredAt], d.[RetiredBy] AS [RetiredBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[FlowId] AS [FlowId], d.[DepartmentId] AS [DepartmentId], d.[Category] AS [Category], d.[Subcategory] AS [Subcategory], d.[Action] AS [Action], d.[VendorName] AS [VendorName], d.[VendorMail] AS [VendorMail], d.[Note] AS [Note], d.[SortOrder] AS [SortOrder], d.[RetiredAt] AS [RetiredAt], d.[RetiredBy] AS [RetiredBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[FlowId] = x.[FlowId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of advisor (cfg.DepartmentAdvisor)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_DepartmentAdvisor_Journal ON cfg.DepartmentAdvisor AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''advisor'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [AdvisorId] FROM inserted UNION SELECT [AdvisorId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[AdvisorId], N''''), 900) AS K, CASE WHEN i.[RevokedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT i.[AdvisorId] AS [AdvisorId], i.[DepartmentId] AS [DepartmentId], i.[Kind] AS [Kind], i.[DisplayName] AS [DisplayName], i.[Company] AS [Company], i.[Mail] AS [Mail], i.[ObjectId] AS [ObjectId], i.[IsExternal] AS [IsExternal], i.[Note] AS [Note], i.[AddedAt] AS [AddedAt], i.[AddedBy] AS [AddedBy], i.[RevokedAt] AS [RevokedAt], i.[RevokedBy] AS [RevokedBy], i.[RevokeReason] AS [RevokeReason] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[AdvisorId] AS [AdvisorId], i.[DepartmentId] AS [DepartmentId], i.[Kind] AS [Kind], i.[DisplayName] AS [DisplayName], i.[Company] AS [Company], i.[Mail] AS [Mail], i.[ObjectId] AS [ObjectId], i.[IsExternal] AS [IsExternal], i.[Note] AS [Note], i.[RevokedAt] AS [RevokedAt], i.[RevokedBy] AS [RevokedBy], i.[RevokeReason] AS [RevokeReason] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[AdvisorId] = x.[AdvisorId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[AdvisorId], N''''), 900) AS K, CASE WHEN d.[RevokedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT d.[AdvisorId] AS [AdvisorId], d.[DepartmentId] AS [DepartmentId], d.[Kind] AS [Kind], d.[DisplayName] AS [DisplayName], d.[Company] AS [Company], d.[Mail] AS [Mail], d.[ObjectId] AS [ObjectId], d.[IsExternal] AS [IsExternal], d.[Note] AS [Note], d.[AddedAt] AS [AddedAt], d.[AddedBy] AS [AddedBy], d.[RevokedAt] AS [RevokedAt], d.[RevokedBy] AS [RevokedBy], d.[RevokeReason] AS [RevokeReason] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[AdvisorId] AS [AdvisorId], d.[DepartmentId] AS [DepartmentId], d.[Kind] AS [Kind], d.[DisplayName] AS [DisplayName], d.[Company] AS [Company], d.[Mail] AS [Mail], d.[ObjectId] AS [ObjectId], d.[IsExternal] AS [IsExternal], d.[Note] AS [Note], d.[RevokedAt] AS [RevokedAt], d.[RevokedBy] AS [RevokedBy], d.[RevokeReason] AS [RevokeReason] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[AdvisorId] = x.[AdvisorId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of cmdbservice (cfg.CmdbService)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_CmdbService_Journal ON cfg.CmdbService AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''cmdbservice'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [ServiceId] FROM inserted UNION SELECT [ServiceId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[ServiceId], N''''), 900) AS K, CASE WHEN i.[RetiredAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT i.[ServiceId] AS [ServiceId], i.[Source] AS [Source], i.[ServiceNumber] AS [ServiceNumber], i.[ExternalId] AS [ExternalId], i.[Name] AS [Name], i.[Description] AS [Description], i.[Owner] AS [Owner], i.[OwnerMail] AS [OwnerMail], i.[Criticality] AS [Criticality], i.[DataSensitivity] AS [DataSensitivity], i.[Environment] AS [Environment], i.[Department] AS [Department], i.[ExtraJson] AS [ExtraJson], i.[CreatedAt] AS [CreatedAt], i.[CreatedBy] AS [CreatedBy], i.[UpdatedAt] AS [UpdatedAt], i.[UpdatedBy] AS [UpdatedBy], i.[RetiredAt] AS [RetiredAt], i.[RetiredBy] AS [RetiredBy], i.[RetireReason] AS [RetireReason] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[ServiceId] AS [ServiceId], i.[Source] AS [Source], i.[ServiceNumber] AS [ServiceNumber], i.[ExternalId] AS [ExternalId], i.[Name] AS [Name], i.[Description] AS [Description], i.[Owner] AS [Owner], i.[OwnerMail] AS [OwnerMail], i.[Criticality] AS [Criticality], i.[DataSensitivity] AS [DataSensitivity], i.[Environment] AS [Environment], i.[Department] AS [Department], i.[ExtraJson] AS [ExtraJson], i.[RetiredAt] AS [RetiredAt], i.[RetiredBy] AS [RetiredBy], i.[RetireReason] AS [RetireReason] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[ServiceId] = x.[ServiceId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[ServiceId], N''''), 900) AS K, CASE WHEN d.[RetiredAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT d.[ServiceId] AS [ServiceId], d.[Source] AS [Source], d.[ServiceNumber] AS [ServiceNumber], d.[ExternalId] AS [ExternalId], d.[Name] AS [Name], d.[Description] AS [Description], d.[Owner] AS [Owner], d.[OwnerMail] AS [OwnerMail], d.[Criticality] AS [Criticality], d.[DataSensitivity] AS [DataSensitivity], d.[Environment] AS [Environment], d.[Department] AS [Department], d.[ExtraJson] AS [ExtraJson], d.[CreatedAt] AS [CreatedAt], d.[CreatedBy] AS [CreatedBy], d.[UpdatedAt] AS [UpdatedAt], d.[UpdatedBy] AS [UpdatedBy], d.[RetiredAt] AS [RetiredAt], d.[RetiredBy] AS [RetiredBy], d.[RetireReason] AS [RetireReason] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[ServiceId] AS [ServiceId], d.[Source] AS [Source], d.[ServiceNumber] AS [ServiceNumber], d.[ExternalId] AS [ExternalId], d.[Name] AS [Name], d.[Description] AS [Description], d.[Owner] AS [Owner], d.[OwnerMail] AS [OwnerMail], d.[Criticality] AS [Criticality], d.[DataSensitivity] AS [DataSensitivity], d.[Environment] AS [Environment], d.[Department] AS [Department], d.[ExtraJson] AS [ExtraJson], d.[RetiredAt] AS [RetiredAt], d.[RetiredBy] AS [RetiredBy], d.[RetireReason] AS [RetireReason] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[ServiceId] = x.[ServiceId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of cmdblink (cfg.CmdbServiceAsset)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_CmdbServiceAsset_Journal ON cfg.CmdbServiceAsset AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''cmdblink'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [LinkId] FROM inserted UNION SELECT [LinkId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[ServiceId], N''|'', i.[AssetKey]), 900) AS K, CASE WHEN i.[UnlinkedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT i.[LinkId] AS [LinkId], i.[ServiceId] AS [ServiceId], i.[AssetKey] AS [AssetKey], i.[AssetName] AS [AssetName], i.[LinkedAt] AS [LinkedAt], i.[LinkedBy] AS [LinkedBy], i.[UnlinkedAt] AS [UnlinkedAt], i.[UnlinkedBy] AS [UnlinkedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[ServiceId] AS [ServiceId], i.[AssetKey] AS [AssetKey], i.[AssetName] AS [AssetName], i.[UnlinkedAt] AS [UnlinkedAt], i.[UnlinkedBy] AS [UnlinkedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[LinkId] = x.[LinkId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[ServiceId], N''|'', d.[AssetKey]), 900) AS K, CASE WHEN d.[UnlinkedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT d.[LinkId] AS [LinkId], d.[ServiceId] AS [ServiceId], d.[AssetKey] AS [AssetKey], d.[AssetName] AS [AssetName], d.[LinkedAt] AS [LinkedAt], d.[LinkedBy] AS [LinkedBy], d.[UnlinkedAt] AS [UnlinkedAt], d.[UnlinkedBy] AS [UnlinkedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[ServiceId] AS [ServiceId], d.[AssetKey] AS [AssetKey], d.[AssetName] AS [AssetName], d.[UnlinkedAt] AS [UnlinkedAt], d.[UnlinkedBy] AS [UnlinkedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[LinkId] = x.[LinkId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of jobflow (cfg.JobFlow)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_JobFlow_Journal ON cfg.JobFlow AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''jobflow'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [FlowId] FROM inserted UNION SELECT [FlowId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[FlowId], N''''), 900) AS K, 1 AS L, (SELECT i.[FlowId] AS [FlowId], i.[Mode] AS [Mode], i.[DefinitionJson] AS [DefinitionJson], i.[UpdatedAt] AS [UpdatedAt], i.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[FlowId] AS [FlowId], i.[Mode] AS [Mode], i.[DefinitionJson] AS [DefinitionJson] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[FlowId] = x.[FlowId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[FlowId], N''''), 900) AS K, 1 AS L, (SELECT d.[FlowId] AS [FlowId], d.[Mode] AS [Mode], d.[DefinitionJson] AS [DefinitionJson], d.[UpdatedAt] AS [UpdatedAt], d.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[FlowId] AS [FlowId], d.[Mode] AS [Mode], d.[DefinitionJson] AS [DefinitionJson] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[FlowId] = x.[FlowId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of mgmtreport (cfg.MgmtReport)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_MgmtReport_Journal ON cfg.MgmtReport AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''mgmtreport'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [ReportId] FROM inserted UNION SELECT [ReportId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[ReportId], N''''), 900) AS K, CASE WHEN i.[RemovedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT i.[ReportId] AS [ReportId], i.[Name] AS [Name], i.[Grain] AS [Grain], i.[Sections] AS [Sections], i.[Recipients] AS [Recipients], i.[Cadence] AS [Cadence], i.[Day] AS [Day], i.[TimeUtc] AS [TimeUtc], i.[Enabled] AS [Enabled], i.[CreatedAt] AS [CreatedAt], i.[CreatedBy] AS [CreatedBy], i.[UpdatedAt] AS [UpdatedAt], i.[UpdatedBy] AS [UpdatedBy], i.[RemovedAt] AS [RemovedAt] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[ReportId] AS [ReportId], i.[Name] AS [Name], i.[Grain] AS [Grain], i.[Sections] AS [Sections], i.[Recipients] AS [Recipients], i.[Cadence] AS [Cadence], i.[Day] AS [Day], i.[TimeUtc] AS [TimeUtc], i.[Enabled] AS [Enabled], i.[RemovedAt] AS [RemovedAt] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[ReportId] = x.[ReportId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[ReportId], N''''), 900) AS K, CASE WHEN d.[RemovedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT d.[ReportId] AS [ReportId], d.[Name] AS [Name], d.[Grain] AS [Grain], d.[Sections] AS [Sections], d.[Recipients] AS [Recipients], d.[Cadence] AS [Cadence], d.[Day] AS [Day], d.[TimeUtc] AS [TimeUtc], d.[Enabled] AS [Enabled], d.[CreatedAt] AS [CreatedAt], d.[CreatedBy] AS [CreatedBy], d.[UpdatedAt] AS [UpdatedAt], d.[UpdatedBy] AS [UpdatedBy], d.[RemovedAt] AS [RemovedAt] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[ReportId] AS [ReportId], d.[Name] AS [Name], d.[Grain] AS [Grain], d.[Sections] AS [Sections], d.[Recipients] AS [Recipients], d.[Cadence] AS [Cadence], d.[Day] AS [Day], d.[TimeUtc] AS [TimeUtc], d.[Enabled] AS [Enabled], d.[RemovedAt] AS [RemovedAt] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[ReportId] = x.[ReportId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of pivotview (cfg.PivotView)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_PivotView_Journal ON cfg.PivotView AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''pivotview'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [ViewId] FROM inserted UNION SELECT [ViewId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[Owner], N''|'', i.[Name]), 900) AS K, CASE WHEN i.[RemovedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT i.[ViewId] AS [ViewId], i.[Name] AS [Name], i.[Owner] AS [Owner], i.[Shared] AS [Shared], i.[State] AS [State], i.[CreatedAt] AS [CreatedAt], i.[UpdatedAt] AS [UpdatedAt], i.[RemovedAt] AS [RemovedAt], i.[RemovedBy] AS [RemovedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[Name] AS [Name], i.[Owner] AS [Owner], i.[Shared] AS [Shared], i.[State] AS [State], i.[RemovedAt] AS [RemovedAt], i.[RemovedBy] AS [RemovedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[ViewId] = x.[ViewId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[Owner], N''|'', d.[Name]), 900) AS K, CASE WHEN d.[RemovedAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT d.[ViewId] AS [ViewId], d.[Name] AS [Name], d.[Owner] AS [Owner], d.[Shared] AS [Shared], d.[State] AS [State], d.[CreatedAt] AS [CreatedAt], d.[UpdatedAt] AS [UpdatedAt], d.[RemovedAt] AS [RemovedAt], d.[RemovedBy] AS [RemovedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[Name] AS [Name], d.[Owner] AS [Owner], d.[Shared] AS [Shared], d.[State] AS [State], d.[RemovedAt] AS [RemovedAt], d.[RemovedBy] AS [RemovedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[ViewId] = x.[ViewId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of guardack (cfg.GuardAck)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_GuardAck_Journal ON cfg.GuardAck AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''guardack'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [AckId] FROM inserted UNION SELECT [AckId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[AckId], N''''), 900) AS K, 1 AS L, (SELECT i.[AckId] AS [AckId], i.[EventId] AS [EventId], i.[GuardKey] AS [GuardKey], i.[DetailHash] AS [DetailHash], i.[AckBy] AS [AckBy], i.[AckUtc] AS [AckUtc], i.[Note] AS [Note] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[AckId] AS [AckId], i.[EventId] AS [EventId], i.[GuardKey] AS [GuardKey], i.[DetailHash] AS [DetailHash], i.[AckBy] AS [AckBy], i.[Note] AS [Note] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[AckId] = x.[AckId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[AckId], N''''), 900) AS K, 1 AS L, (SELECT d.[AckId] AS [AckId], d.[EventId] AS [EventId], d.[GuardKey] AS [GuardKey], d.[DetailHash] AS [DetailHash], d.[AckBy] AS [AckBy], d.[AckUtc] AS [AckUtc], d.[Note] AS [Note] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[AckId] AS [AckId], d.[EventId] AS [EventId], d.[GuardKey] AS [GuardKey], d.[DetailHash] AS [DetailHash], d.[AckBy] AS [AckBy], d.[Note] AS [Note] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[AckId] = x.[AckId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- the journal of template (cfg.Template)
|EXEC (N'CREATE OR ALTER TRIGGER cfg.TR_Template_Journal ON cfg.Template AFTER INSERT, UPDATE, DELETE AS
|BEGIN
|    SET NOCOUNT ON;
|    IF NOT EXISTS (SELECT 1 FROM inserted) AND NOT EXISTS (SELECT 1 FROM deleted) RETURN;
|    DECLARE @cid NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.audit.cid'') AS NVARCHAR(64));
|    IF @cid IS NULL SET @cid = REPLACE(CONVERT(NVARCHAR(36), NEWID()), N''-'', N'''');
|    DECLARE @asrc NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.audit.source'') AS NVARCHAR(16));
|    IF @asrc NOT IN (N''web'', N''job'', N''engine'', N''setup'', N''api'', N''portal'') SET @asrc = NULL;
|    DECLARE @src NVARCHAR(16) = CAST(SESSION_CONTEXT(N''si.cfg.source'') AS NVARCHAR(16));
|    IF @src IS NULL OR @src NOT IN (N''gui'', N''api'', N''import'', N''restore'', N''undo'', N''sync'', N''template'')
|        SET @src = CASE @asrc WHEN N''web'' THEN N''gui'' WHEN N''portal'' THEN N''gui'' WHEN N''api'' THEN N''api'' WHEN N''setup'' THEN N''import'' ELSE N''sync'' END;
|    SET @src = N''template'';
|    DECLARE @by NVARCHAR(256) = LEFT(COALESCE(CAST(SESSION_CONTEXT(N''si.cfg.initiatedBy'') AS NVARCHAR(256)), CAST(SESSION_CONTEXT(N''si.audit.actor'') AS NVARCHAR(256)), ORIGINAL_LOGIN()), 256);
|    DECLARE @apr NVARCHAR(256) = CAST(SESSION_CONTEXT(N''si.cfg.approvedBy'') AS NVARCHAR(256));
|    DECLARE @undo NVARCHAR(64) = CAST(SESSION_CONTEXT(N''si.cfg.undoOf'') AS NVARCHAR(64));
|    DECLARE @why NVARCHAR(400) = CAST(SESSION_CONTEXT(N''si.cfg.reason'') AS NVARCHAR(400));
|    INSERT cfg.ConfigJournal (CommitId, Entity, EntityKey, Op, BeforeJson, AfterJson, InitiatedBy, ApprovedBy, Source, ActorSource, UndoOf, Reason)
|    SELECT @cid, N''template'', COALESCE(a.K, b.K),
|           CASE WHEN b.J IS NULL THEN N''Add'' WHEN a.J IS NULL THEN N''Remove'' WHEN b.L = 1 AND a.L = 0 THEN N''Remove'' WHEN b.L = 0 AND a.L = 1 THEN N''Add'' ELSE N''Modify'' END,
|           b.J, a.J, @by, @apr, @src, @asrc, @undo, @why
|    FROM (SELECT [TemplateId] FROM inserted UNION SELECT [TemplateId] FROM deleted) AS x
|    OUTER APPLY (SELECT LEFT(CONCAT(i.[Kind], N''|'', i.[ItemKey]), 900) AS K, CASE WHEN i.[RetiredAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT i.[TemplateId] AS [TemplateId], i.[Kind] AS [Kind], i.[ItemKey] AS [ItemKey], i.[Version] AS [Version], i.[BodyJson] AS [BodyJson], i.[Format] AS [Format], i.[SortOrder] AS [SortOrder], i.[BodyHash] AS [BodyHash], i.[ContentHash] AS [ContentHash], i.[PublishedAt] AS [PublishedAt], i.[Source] AS [Source], i.[RetiredAt] AS [RetiredAt] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT i.[Kind] AS [Kind], i.[ItemKey] AS [ItemKey], i.[BodyJson] AS [BodyJson], i.[Format] AS [Format], i.[SortOrder] AS [SortOrder], i.[Source] AS [Source], i.[RetiredAt] AS [RetiredAt] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM inserted AS i WHERE i.[TemplateId] = x.[TemplateId]) AS a
|    OUTER APPLY (SELECT LEFT(CONCAT(d.[Kind], N''|'', d.[ItemKey]), 900) AS K, CASE WHEN d.[RetiredAt] IS NULL THEN 1 ELSE 0 END AS L, (SELECT d.[TemplateId] AS [TemplateId], d.[Kind] AS [Kind], d.[ItemKey] AS [ItemKey], d.[Version] AS [Version], d.[BodyJson] AS [BodyJson], d.[Format] AS [Format], d.[SortOrder] AS [SortOrder], d.[BodyHash] AS [BodyHash], d.[ContentHash] AS [ContentHash], d.[PublishedAt] AS [PublishedAt], d.[Source] AS [Source], d.[RetiredAt] AS [RetiredAt] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS J, (SELECT d.[Kind] AS [Kind], d.[ItemKey] AS [ItemKey], d.[BodyJson] AS [BodyJson], d.[Format] AS [Format], d.[SortOrder] AS [SortOrder], d.[Source] AS [Source], d.[RetiredAt] AS [RetiredAt] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS C FROM deleted AS d WHERE d.[TemplateId] = x.[TemplateId]) AS b
|    WHERE a.J IS NULL OR b.J IS NULL OR a.L <> b.L OR a.C COLLATE Latin1_General_BIN2 <> b.C COLLATE Latin1_General_BIN2;
|END');
|
|-- every record in force of every backup entity: what a configuration backup holds
|EXEC (N'CREATE OR ALTER VIEW cfg.vConfigSnapshot AS
|SELECT N''setting'' AS Entity, LEFT(CONCAT(t.[Name], N''|'', t.[Scope]), 900) AS EntityKey, (SELECT t.[Name] AS [Name], t.[Scope] AS [Scope], t.[ValueJson] AS [ValueJson], t.[KeyVaultSecretName] AS [KeyVaultSecretName], t.[UpdatedAt] AS [UpdatedAt], t.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.Setting AS t
|UNION ALL
|SELECT N''document'' AS Entity, LEFT(CONCAT(t.[Kind], N''|'', t.[Key]), 900) AS EntityKey, (SELECT t.[Kind] AS [Kind], t.[Key] AS [Key], t.[Body] AS [Body], t.[UpdatedAt] AS [UpdatedAt], t.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.Document AS t
|UNION ALL
|SELECT N''access'' AS Entity, LEFT(CONCAT(t.[PrincipalId], N''''), 900) AS EntityKey, (SELECT t.[PrincipalId] AS [PrincipalId], t.[PrincipalType] AS [PrincipalType], t.[DisplayName] AS [DisplayName], t.[Role] AS [Role], t.[ScopeJson] AS [ScopeJson], t.[AccountMail] AS [AccountMail], t.[ForwardTo] AS [ForwardTo], t.[UpdatedAt] AS [UpdatedAt], t.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.AccessAssignment AS t
|UNION ALL
|SELECT N''override'' AS Entity, LEFT(CONCAT(t.[Kind], N''|'', t.[ItemKey]), 900) AS EntityKey, (SELECT t.[Kind] AS [Kind], t.[ItemKey] AS [ItemKey], t.[State] AS [State], t.[BodyJson] AS [BodyJson], t.[Format] AS [Format], t.[BaseVersion] AS [BaseVersion], t.[BaseHash] AS [BaseHash], t.[UpdatedAt] AS [UpdatedAt], t.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.ItemOverride AS t
|UNION ALL
|SELECT N''exemption'' AS Entity, LEFT(CONCAT(t.[ExemptionId], N''''), 900) AS EntityKey, (SELECT t.[ExemptionId] AS [ExemptionId], t.[Scope] AS [Scope], t.[ReportName] AS [ReportName], t.[ConfigurationId] AS [ConfigurationId], t.[Cve] AS [Cve], t.[AssetKey] AS [AssetKey], t.[Reason] AS [Reason], t.[ExpiresAt] AS [ExpiresAt], t.[CreatedBy] AS [CreatedBy], t.[CreatedAt] AS [CreatedAt], t.[RevokedAt] AS [RevokedAt], t.[RevokedBy] AS [RevokedBy], t.[RequestId] AS [RequestId], t.[Domain] AS [Domain], t.[ApprovedBy] AS [ApprovedBy], t.[ApprovedAt] AS [ApprovedAt], t.[ReviewedBy] AS [ReviewedBy], t.[ReviewedAt] AS [ReviewedAt], t.[Category] AS [Category] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.Exemption AS t WHERE t.[RevokedAt] IS NULL
|UNION ALL
|SELECT N''connector'' AS Entity, LEFT(CONCAT(t.[Name], N''''), 900) AS EntityKey, (SELECT t.[ConnectorId] AS [ConnectorId], t.[Name] AS [Name], t.[Kind] AS [Kind], t.[Direction] AS [Direction], t.[Enabled] AS [Enabled], t.[Mode] AS [Mode], t.[AllowCreate] AS [AllowCreate], t.[AllowClose] AS [AllowClose], t.[SettingsJson] AS [SettingsJson], t.[SecretRefsJson] AS [SecretRefsJson], t.[MappingJson] AS [MappingJson], t.[CreatedAt] AS [CreatedAt], t.[CreatedBy] AS [CreatedBy], t.[UpdatedAt] AS [UpdatedAt], t.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.Connector AS t
|UNION ALL
|SELECT N''department'' AS Entity, LEFT(CONCAT(t.[DepartmentId], N''''), 900) AS EntityKey, (SELECT t.[DepartmentId] AS [DepartmentId], t.[Name] AS [Name], t.[Mail] AS [Mail], t.[Description] AS [Description], t.[MatchValues] AS [MatchValues], t.[MaintenanceWindowsJson] AS [MaintenanceWindowsJson], t.[CreatedAt] AS [CreatedAt], t.[CreatedBy] AS [CreatedBy], t.[UpdatedAt] AS [UpdatedAt], t.[UpdatedBy] AS [UpdatedBy], t.[RetiredAt] AS [RetiredAt], t.[RetiredBy] AS [RetiredBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.Department AS t WHERE t.[RetiredAt] IS NULL
|UNION ALL
|SELECT N''member'' AS Entity, LEFT(CONCAT(t.[DepartmentId], N''|'', t.[Role], N''|'', t.[PrincipalType], N''|'', t.[ObjectId], N''|'', t.[Mail]), 900) AS EntityKey, (SELECT t.[MemberId] AS [MemberId], t.[DepartmentId] AS [DepartmentId], t.[Role] AS [Role], t.[ObjectId] AS [ObjectId], t.[PrincipalType] AS [PrincipalType], t.[DisplayName] AS [DisplayName], t.[Mail] AS [Mail], t.[Company] AS [Company], t.[IsExternal] AS [IsExternal], t.[AddedAt] AS [AddedAt], t.[AddedBy] AS [AddedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.DepartmentMember AS t
|UNION ALL
|SELECT N''responsibilityrule'' AS Entity, LEFT(CONCAT(t.[DepartmentId], N''|'', t.[Kind], N''|'', t.[Pattern]), 900) AS EntityKey, (SELECT t.[RuleId] AS [RuleId], t.[Kind] AS [Kind], t.[Pattern] AS [Pattern], t.[DepartmentId] AS [DepartmentId], t.[SortOrder] AS [SortOrder], t.[Enabled] AS [Enabled], t.[Note] AS [Note], t.[CreatedAt] AS [CreatedAt], t.[CreatedBy] AS [CreatedBy], t.[UpdatedAt] AS [UpdatedAt], t.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.ResponsibilityRule AS t
|UNION ALL
|SELECT N''responsibilityoverride'' AS Entity, LEFT(CONCAT(t.[Scope], N''|'', t.[AssetKey], N''|'', t.[RecommendationKey]), 900) AS EntityKey, (SELECT t.[OverrideId] AS [OverrideId], t.[Scope] AS [Scope], t.[AssetKey] AS [AssetKey], t.[RecommendationKey] AS [RecommendationKey], t.[DepartmentId] AS [DepartmentId], t.[Reason] AS [Reason], t.[CreatedAt] AS [CreatedAt], t.[CreatedBy] AS [CreatedBy], t.[RevokedAt] AS [RevokedAt], t.[RevokedBy] AS [RevokedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.ResponsibilityOverride AS t WHERE t.[RevokedAt] IS NULL
|UNION ALL
|SELECT N''domainrole'' AS Entity, LEFT(CONCAT(t.[Domain], N''|'', t.[Role], N''|'', t.[Principal]), 900) AS EntityKey, (SELECT t.[Domain] AS [Domain], t.[Role] AS [Role], t.[Principal] AS [Principal], t.[AddedAt] AS [AddedAt], t.[AddedBy] AS [AddedBy], t.[RemovedAt] AS [RemovedAt], t.[RemovedBy] AS [RemovedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.DomainRole AS t WHERE t.[RemovedAt] IS NULL
|UNION ALL
|SELECT N''categoryrole'' AS Entity, LEFT(CONCAT(t.[Domain], N''|'', t.[Category], N''|'', t.[Role], N''|'', t.[Principal]), 900) AS EntityKey, (SELECT t.[Domain] AS [Domain], t.[Category] AS [Category], t.[Role] AS [Role], t.[Principal] AS [Principal], t.[AddedAt] AS [AddedAt], t.[AddedBy] AS [AddedBy], t.[RemovedAt] AS [RemovedAt], t.[RemovedBy] AS [RemovedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.CategoryRole AS t WHERE t.[RemovedAt] IS NULL
|UNION ALL
|SELECT N''remediationflow'' AS Entity, LEFT(CONCAT(t.[FlowId], N''''), 900) AS EntityKey, (SELECT t.[FlowId] AS [FlowId], t.[DepartmentId] AS [DepartmentId], t.[Category] AS [Category], t.[Subcategory] AS [Subcategory], t.[Action] AS [Action], t.[VendorName] AS [VendorName], t.[VendorMail] AS [VendorMail], t.[Note] AS [Note], t.[SortOrder] AS [SortOrder], t.[CreatedAt] AS [CreatedAt], t.[CreatedBy] AS [CreatedBy], t.[UpdatedAt] AS [UpdatedAt], t.[UpdatedBy] AS [UpdatedBy], t.[RetiredAt] AS [RetiredAt], t.[RetiredBy] AS [RetiredBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.RemediationFlow AS t WHERE t.[RetiredAt] IS NULL
|UNION ALL
|SELECT N''advisor'' AS Entity, LEFT(CONCAT(t.[AdvisorId], N''''), 900) AS EntityKey, (SELECT t.[AdvisorId] AS [AdvisorId], t.[DepartmentId] AS [DepartmentId], t.[Kind] AS [Kind], t.[DisplayName] AS [DisplayName], t.[Company] AS [Company], t.[Mail] AS [Mail], t.[ObjectId] AS [ObjectId], t.[IsExternal] AS [IsExternal], t.[Note] AS [Note], t.[AddedAt] AS [AddedAt], t.[AddedBy] AS [AddedBy], t.[RevokedAt] AS [RevokedAt], t.[RevokedBy] AS [RevokedBy], t.[RevokeReason] AS [RevokeReason] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.DepartmentAdvisor AS t WHERE t.[RevokedAt] IS NULL
|UNION ALL
|SELECT N''cmdbservice'' AS Entity, LEFT(CONCAT(t.[ServiceId], N''''), 900) AS EntityKey, (SELECT t.[ServiceId] AS [ServiceId], t.[Source] AS [Source], t.[ServiceNumber] AS [ServiceNumber], t.[ExternalId] AS [ExternalId], t.[Name] AS [Name], t.[Description] AS [Description], t.[Owner] AS [Owner], t.[OwnerMail] AS [OwnerMail], t.[Criticality] AS [Criticality], t.[DataSensitivity] AS [DataSensitivity], t.[Environment] AS [Environment], t.[Department] AS [Department], t.[ExtraJson] AS [ExtraJson], t.[CreatedAt] AS [CreatedAt], t.[CreatedBy] AS [CreatedBy], t.[UpdatedAt] AS [UpdatedAt], t.[UpdatedBy] AS [UpdatedBy], t.[RetiredAt] AS [RetiredAt], t.[RetiredBy] AS [RetiredBy], t.[RetireReason] AS [RetireReason] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.CmdbService AS t WHERE t.[RetiredAt] IS NULL
|UNION ALL
|SELECT N''cmdblink'' AS Entity, LEFT(CONCAT(t.[ServiceId], N''|'', t.[AssetKey]), 900) AS EntityKey, (SELECT t.[LinkId] AS [LinkId], t.[ServiceId] AS [ServiceId], t.[AssetKey] AS [AssetKey], t.[AssetName] AS [AssetName], t.[LinkedAt] AS [LinkedAt], t.[LinkedBy] AS [LinkedBy], t.[UnlinkedAt] AS [UnlinkedAt], t.[UnlinkedBy] AS [UnlinkedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.CmdbServiceAsset AS t WHERE t.[UnlinkedAt] IS NULL
|UNION ALL
|SELECT N''jobflow'' AS Entity, LEFT(CONCAT(t.[FlowId], N''''), 900) AS EntityKey, (SELECT t.[FlowId] AS [FlowId], t.[Mode] AS [Mode], t.[DefinitionJson] AS [DefinitionJson], t.[UpdatedAt] AS [UpdatedAt], t.[UpdatedBy] AS [UpdatedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.JobFlow AS t
|UNION ALL
|SELECT N''mgmtreport'' AS Entity, LEFT(CONCAT(t.[ReportId], N''''), 900) AS EntityKey, (SELECT t.[ReportId] AS [ReportId], t.[Name] AS [Name], t.[Grain] AS [Grain], t.[Sections] AS [Sections], t.[Recipients] AS [Recipients], t.[Cadence] AS [Cadence], t.[Day] AS [Day], t.[TimeUtc] AS [TimeUtc], t.[Enabled] AS [Enabled], t.[CreatedAt] AS [CreatedAt], t.[CreatedBy] AS [CreatedBy], t.[UpdatedAt] AS [UpdatedAt], t.[UpdatedBy] AS [UpdatedBy], t.[RemovedAt] AS [RemovedAt] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.MgmtReport AS t WHERE t.[RemovedAt] IS NULL
|UNION ALL
|SELECT N''pivotview'' AS Entity, LEFT(CONCAT(t.[Owner], N''|'', t.[Name]), 900) AS EntityKey, (SELECT t.[ViewId] AS [ViewId], t.[Name] AS [Name], t.[Owner] AS [Owner], t.[Shared] AS [Shared], t.[State] AS [State], t.[CreatedAt] AS [CreatedAt], t.[UpdatedAt] AS [UpdatedAt], t.[RemovedAt] AS [RemovedAt], t.[RemovedBy] AS [RemovedBy] FOR JSON PATH, WITHOUT_ARRAY_WRAPPER, INCLUDE_NULL_VALUES) AS RecordJson FROM cfg.PivotView AS t WHERE t.[RemovedAt] IS NULL');
|
|-- <<< GENERATED CONFIG JOURNAL
|
|-- THE CHANGE LOG AND THE COMMIT LIST READ NARROW INDEXES (ADDED 2026-11-05; the view plan guard): the settings history, the
|-- template history and the settings change log take the newest changes (by name or all) off this index and read the before /
|-- after values of those rows only; the configuration journal's commit list groups the commits over the second.
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ChangeLog_NameRecent' AND object_id = OBJECT_ID('cfg.ChangeLog'))
|CREATE INDEX IX_ChangeLog_NameRecent ON cfg.ChangeLog (Name, ChangeId DESC) INCLUDE (ChangedAt);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ConfigJournal_List' AND object_id = OBJECT_ID('cfg.ConfigJournal'))
|CREATE INDEX IX_ConfigJournal_List ON cfg.ConfigJournal (CommitId) INCLUDE (CommittedUtc, InitiatedBy, ApprovedBy, Source, UndoOf, Reason, Entity, EntityKey);
|
|-- THE AUDIT TRAIL AND THE GUARD EVENTS ARE PAGED OVER NARROW INDEXES (ADDED 2026-11-05; the view plan guard): the grids are
|-- chosen, counted and sorted over every column but the documents (before / after, the measured values), which are read for
|-- the page's rows only; the guard events' "cleared since" read seeks the guard's key.
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_AuditEvent_List' AND object_id = OBJECT_ID('cfg.AuditEvent'))
|CREATE INDEX IX_AuditEvent_List ON cfg.AuditEvent (TsUtc) INCLUDE (RecordType, Action, Actor, ActorSource, Target, Reason, Outcome, OutcomeText, WhatIf, CorrelationId, ScopeDomain, ScopeDepartmentId);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_GuardEvent_List' AND object_id = OBJECT_ID('cfg.GuardEvent'))
|CREATE INDEX IX_GuardEvent_List ON cfg.GuardEvent (TsUtc DESC) INCLUDE (GuardId, GuardKey, Area, Job, Source, Outcome, Severity, Protected, Subject, Detail, MeasuredText, HeldCount, ActionText, RunId, TripCount, MailState, TelemetryState, SiVersion, Attribution);
|
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_GuardEvent_Key' AND object_id = OBJECT_ID('cfg.GuardEvent'))
|CREATE INDEX IX_GuardEvent_Key ON cfg.GuardEvent (GuardKey, Id) INCLUDE (Outcome, Detail);
|
|-- The change log newest first over every name (the settings history and change log without a name): the same narrow walk.
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_ChangeLog_Recent' AND object_id = OBJECT_ID('cfg.ChangeLog'))
|CREATE INDEX IX_ChangeLog_Recent ON cfg.ChangeLog (ChangeId DESC) INCLUDE (Name, ChangedAt);
'@ }
$__siSupportFiles['setup/_shared/SI-SqlTier.ps1'] = @{ Sha256 = 'eea33ddc82ce6be1c37d294f5cc61e7f0fcce7552cd9b2f2c8f4703bcf7258af'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE SQL DATABASE SIZE (#507, operator 2026-10-09: "default must be s1 or s2, newer basic. it must be
|    fixed for all prod customers").
|
|    Measured on a customer tenant 2026-10-09 (about 23,000 users, 97,000 records a run): the Basic tier (5 DTU) averaged 14 % DTU with log-write
|    peaks up to 98 % while the records were written, and Basic's 2 GB cap cannot hold a large tenant. So:
|
|      * THE RULE (Get-SISqlDatabaseTier, one function, tested): never Basic. #509 (operator 2026-10-09: "it is very
|        little money"): the Pro database (sqldb-si-pro, and any data database the install is configured with) is
|        Standard S3 (100 DTU) for EVERY install, whatever the tenant's size (S2 until 2026-10-11 -- owner, approved: the CIs page
|        was slow on S2; reliability over cost); the identity ledger (sqldb-si-identity) stays
|        Standard S1 (20 DTU). (Until #509 the Pro database was S1 below 5,000 directory objects.) Max size 250 GB, the
|        Standard tier's default. A size the customer set (SI_Bootstrap_SqlServiceObjective, or the updater job's
|        SI_UPDATER_SQL_SERVICE_OBJECTIVE) wins.
|      * NEW INSTALLS: the guided install creates its databases at that size (SI-GuidedInstallPro.ps1, step pro-sql).
|      * EXISTING INSTALLS: every update (setup\Invoke-SIContainerUpdate.ps1 -Apply, which both the updater job and the VM
|        sync hook run from the release) raises a smaller database to it by ONE ARM PATCH of its sku -- online, no data
|        loss, a short reconnect when Azure switches over (Invoke-SISqlTierUpgrade). The rule NEVER lowers a database, and
|        never touches one the customer put above S3, on Premium, on vCore or in an elastic pool (Get-SISqlTierChange).
|      * A SIZE THE CUSTOMER SET LOWERS TOO (owner 2026-10-18 -- small installs' Pro database is idle about 98 % of the week
|        on S3): SI_Bootstrap_SqlServiceObjective (the Pro database's setting -- the Settings page, or support through
|        setup\Set-SIProSetting.ps1 -- then the config, then SI_UPDATER_SQL_SERVICE_OBJECTIVE) applies in BOTH directions: S2
|        on an S3 database lowers it, by the same one online PATCH. Standard only, and the Pro database never below S1 (no
|        Basic, no S0). Not set: the rule above, raise only. No default changes. The Pro database and a data database ONLY:
|        the identity ledger is S1 everywhere, whatever is set (owner 2026-10-18: "identity database: keep S1 everywhere").
|        One plain line per database goes to the run log; the updater records it in the Pro database (cfg.InstallState
|        'SqlTier').
|      * RIGHTS: the PATCH needs Microsoft.Sql/servers/databases/write on the database. The updater's identity has it
|        through Contributor on the install's resource group (Install-SIUpdaterJob -GrantSpnRoles), where the guided install
|        puts the server. A server elsewhere: the run reads the identity's permissions first and says what is missing
|        ('SQL DB Contributor' on the server) -- it grants nothing itself.
|
|    #521 NO az CLI on the update: every call goes through the REST seam -Rest { param($Method, $Uri, $Body, $Resource,
|    $Headers) } -> @{ Status; Body } (setup/_shared/SI-UpdateRest.ps1): ARM Microsoft.Sql servers / databases list, the
|    permissions read, the sku PATCH; Microsoft Graph $count for the tenant's size. The guided install passes -Rest too:
|    the old az seam (-Az) is gone, there is no az path left. The decisions are tested offline against the REST seam.
|    PowerShell 5.1-compatible (the VM sync hook runs
|    Invoke-SIContainerUpdate.ps1 on Windows PowerShell).
|#>
|
|if (-not (Get-Command -Name Invoke-SIRestJson -ErrorAction SilentlyContinue)) { . ([IO.Path]::Combine($PSScriptRoot, 'SI-UpdateRest.ps1')) }
|
|# The tenant size the collection-job fallback reports (Get-SISqlTierObjectsFromJobs). Since #509 the Pro database is S2 (S3 since 2026-10-11) at
|# any size, so this only feeds the log line.
|$script:SISqlTierLargeTenantObjects = 5000
|# The Standard tier's default (and largest without extra storage) max size: 250 GB.
|$script:SISqlTierStandardMaxBytes = [long]268435456000
|# The ARM api-version of the database read and the PATCH.
|$script:SISqlTierArmApi = '2021-11-01'
|# The DTU ladder (service objective -> DTU). Basic and Standard are the tiers this sizing raises; Premium is the customer's.
|$script:SISqlTierDtu = [ordered]@{
|    'Basic' = 5; 'S0' = 10; 'S1' = 20; 'S2' = 50; 'S3' = 100; 'S4' = 200; 'S6' = 400; 'S7' = 800; 'S9' = 1600; 'S12' = 3000
|    'P1' = 125; 'P2' = 250; 'P4' = 500; 'P6' = 1000; 'P11' = 1750; 'P15' = 4000
|}
|# The database names SecurityInsight creates or is configured with (only these are ever sized on a server).
|$script:SISqlTierKnownDatabases = @('sqldb-si-pro', 'sqldb-si-identity')
|
|function Get-SISqlTierObjectCount {
|    <# PURE. Users + groups + service principals + devices from -Counts (Graph $count); $null when no count is known. #>
|    param([hashtable]$Counts)
|    if (-not $Counts) { return $null }
|    $n = 0L; $any = $false
|    foreach ($k in 'Users', 'Groups', 'ServicePrincipals', 'Devices') {
|        if ($Counts.ContainsKey($k) -and $null -ne $Counts[$k] -and "$($Counts[$k])".Trim() -ne '') { $n += [long]$Counts[$k]; $any = $true }
|    }
|    if ($any) { $n } else { $null }
|}
|
|function Get-SISqlServiceObjectiveSku {
|    <# PURE. A DTU service objective name ('S2', 'basic', 'P1') -> @{ Name; Tier; Capacity }, or $null when it is not one. #>
|    param([AllowEmptyString()][string]$Name)
|    $k = "$Name".Trim()
|    if (-not $k) { return $null }
|    $hit = @($script:SISqlTierDtu.Keys | Where-Object { $_ -ieq $k }) | Select-Object -First 1
|    if (-not $hit) { return $null }
|    $tier = if ($hit -eq 'Basic') { 'Basic' } elseif ($hit -like 'S*') { 'Standard' } else { 'Premium' }
|    [pscustomobject]@{ Name = $hit; Tier = $tier; Capacity = [int]$script:SISqlTierDtu[$hit] }
|}
|
|function Get-SISqlDatabaseTier {
|    <#
|        PURE. THE RULE: the size an SI database should have. Role Data (the Pro database): S3 at any tenant size (#509; S2 until
|        2026-10-11, owner: the CIs page was slow on S2's 50 DTU).
|        -Objects = users + groups + service principals + devices ($null = not known) -- carried on the result for the
|        logs, it no longer decides the size. -Override = a size the customer set (a DTU service objective: Basic, S0-S12,
|        P1-P15); a valid one wins (the Pro database never below S1), anything else is ignored with a note. Returns @{ Name; Tier; Capacity; MaxSizeBytes
|        (0 = the tier's own default); Objects; Source = every-install | customer | ledger; Reason; Note }.
|        -Role Ledger: the identity ledger database (sqldb-si-identity) is S1 whatever the tenant's size -- it holds only the
|        object identifiers (si.ObjectIdentity, written per CI-build batch); the records, the CIs and the findings -- the
|        writes Basic could not take -- are in the Pro database (Role Data). -Override NEVER applies to it (owner 2026-10-18:
|        "identity database: keep S1 everywhere"): SI_Bootstrap_SqlServiceObjective sizes the Pro and data databases only.
|    #>
|    param([AllowNull()]$Objects, [AllowEmptyString()][string]$Override, [ValidateSet('Data', 'Ledger')][string]$Role = 'Data')
|    $note = ''
|    # THE IDENTITY LEDGER IS S1 EVERYWHERE (owner 2026-10-18: "identity database: keep S1 everywhere"): a size the customer set
|    # is for the Pro database (and a data database) only -- never for the ledger, which keeps its own rule.
|    if ($Role -eq 'Ledger') {
|        return [pscustomobject]@{ Name = 'S1'; Tier = 'Standard'; Capacity = 20; MaxSizeBytes = $script:SISqlTierStandardMaxBytes; Objects = $Objects
|            Source = 'ledger'; Reason = 'S1 (the identity ledger: identifiers only, S1 at any tenant size)'; Note = '' }
|    }
|    # THE PRO DATABASE NEVER BELOW S1 (owner 2026-10-18: a size the customer set now LOWERS too -- "S2 on an S3 database lowers
|    # it" -- so the floor matters): a Basic or S0 override of the Pro database becomes S1 + 250 GB, said.
|    $low = Get-SISqlServiceObjectiveSku -Name $Override
|    if ($Role -eq 'Data' -and $low -and $low.Tier -ne 'Premium' -and $low.Capacity -lt 20) {
|        return [pscustomobject]@{ Name = 'S1'; Tier = 'Standard'; Capacity = 20; MaxSizeBytes = $script:SISqlTierStandardMaxBytes; Objects = $Objects
|            Source = 'customer'; Reason = ('S1, the minimum (the size this install set, {0}, is below it)' -f $low.Name)
|            Note = ('the database size {0} that was set is never used for the Pro database -- S1 with 250 GB is its minimum' -f $low.Name) }
|    }
|    # NEVER Basic: S0 is the minimum for every SI database, a size the customer set included (owner 2026-10-09, framework
|    # §12.15: "newer basic. s0 as minimum"). Basic's 2 GB filled ring 1; a Basic override becomes S0 + 250 GB, said.
|    $basic = Get-SISqlServiceObjectiveSku -Name $Override
|    if ($basic -and $basic.Tier -eq 'Basic') {
|        return [pscustomobject]@{ Name = 'S0'; Tier = 'Standard'; Capacity = 10; MaxSizeBytes = $script:SISqlTierStandardMaxBytes; Objects = $Objects
|            Source = 'customer'; Reason = 'S0, the minimum (the size this install set, Basic, is never used)'
|            Note = 'the database size Basic that was set is never used -- S0 with 250 GB is the minimum for every SecurityInsight database' }
|    }
|    if ("$Override".Trim()) {
|        $o = Get-SISqlServiceObjectiveSku -Name $Override
|        if ($o) {
|            $max = if ($o.Tier -eq 'Standard') { $script:SISqlTierStandardMaxBytes } else { 0L }
|            return [pscustomobject]@{ Name = $o.Name; Tier = $o.Tier; Capacity = $o.Capacity; MaxSizeBytes = [long]$max; Objects = $Objects
|                Source = 'customer'; Reason = ('{0}, the size this install set' -f $o.Name); Note = '' }
|        }
|        $note = ("the database size '{0}' that was set is not a DTU size (Basic, S0-S12, P1-P15) -- it is ignored" -f "$Override".Trim())
|    }
|    # #509: S3 (was S2) at ANY tenant size. -Objects is kept on the result (the logs show it) but decides nothing any more.
|    $n = if ($null -eq $Objects -or "$Objects".Trim() -eq '') { $null } else { [long]$Objects }
|    [pscustomobject]@{ Name = 'S3'; Tier = 'Standard'; Capacity = 100; MaxSizeBytes = $script:SISqlTierStandardMaxBytes; Objects = $n
|        Source = 'every-install'; Reason = 'S3 (every SecurityInsight Pro database, at any tenant size)'; Note = $note }
|}
|
|function Get-SISqlTierObjectsFromJobs {
|    <#
|        PURE. A fallback for an updater that cannot read the directory: the collection jobs that setup SIZED for the tenant
|        (Get-SITenantSizedJobResources gives caj-si-identity / caj-si-endpoint 4 GiB or more from
|        5,000 objects; their own default is 2 GiB) say the tenant has at least 5,000 objects. -Jobs in ARM shape (job list).
|        Returns 5000 when one of them carries 4 GiB or more, else $null (not known).
|    #>
|    param([object[]]$Jobs = @())
|    foreach ($j in @($Jobs)) {
|        if (-not $j) { continue }
|        $name = [string]$j.name
|        if ($name -notin @('caj-si-identity', 'caj-si-endpoint')) { continue }
|        $mem = $null
|        try { $mem = [string]$j.properties.template.containers[0].resources.memory } catch { $mem = $null }
|        if (-not $mem) { continue }
|        $gi = 0.0
|        if ([double]::TryParse(($mem -replace '(?i)gi$', ''), [Globalization.NumberStyles]::Float, [Globalization.CultureInfo]::InvariantCulture, [ref]$gi) -and $gi -ge 4) { return [long]$script:SISqlTierLargeTenantObjects }
|    }
|    $null
|}
|
|function Get-SISqlTierChange {
|    <#
|        PURE. What to do with ONE database. -Current: the ARM database (sku.name / sku.tier / sku.capacity,
|        properties.maxSizeBytes / elasticPoolId / currentServiceObjectiveName). -Target: Get-SISqlDatabaseTier's result.
|        Returns @{ Action = raise | lower | keep; Reason; From; Body (the PATCH body as an ordered hashtable, raise / lower) }.
|        The product's rule never lowers. A size the CUSTOMER set (-Target.Source 'customer'; owner 2026-10-18: "S2 on an S3
|        database lowers it") applies both ways: a Standard database above it is lowered to it -- a Standard size of at least
|        S1, never Basic or S0. Never changes: an elastic pool member, vCore / Premium / any tier but Basic and Standard, a
|        database already at the target, or (without a size the customer set) one at or above the target or above S3.
|    #>
|    param([Parameter(Mandatory)]$Current, [Parameter(Mandatory)]$Target)
|    $p = { param($o, $n) if ($o -and $o.PSObject.Properties[$n]) { $o.$n } else { $null } }
|    $sku = & $p $Current 'sku'; $props = & $p $Current 'properties'
|    # A DTU database's sku is { name = 'Standard', tier = 'Standard', capacity = 20 } (Basic: name 'Basic'); its service
|    # objective (S1) is properties.currentServiceObjectiveName. vCore: { name = 'GP_Gen5', tier = 'GeneralPurpose' }.
|    $tier = [string](& $p $sku 'tier'); $cap = & $p $sku 'capacity'; $skuName = [string](& $p $sku 'name')
|    $name = [string](& $p $props 'currentServiceObjectiveName')
|    if (-not (Get-SISqlServiceObjectiveSku -Name $name)) {
|        if (Get-SISqlServiceObjectiveSku -Name $skuName) { $name = $skuName }
|        elseif ($tier -in @('Basic', 'Standard', 'Premium') -and $null -ne $cap -and "$cap".Trim()) {
|            $hit = @($script:SISqlTierDtu.Keys | Where-Object { (Get-SISqlServiceObjectiveSku -Name $_).Tier -eq $tier -and $script:SISqlTierDtu[$_] -eq [int]$cap }) | Select-Object -First 1
|            if ($hit) { $name = $hit } elseif (-not $name) { $name = $skuName }
|        } elseif (-not $name) { $name = $skuName }
|    }
|    $from = if ($name) { $name } else { 'unknown' }
|    $keep = { param($why) [pscustomobject]@{ Action = 'keep'; Reason = $why; From = $from; Body = $null } }
|    if ([string](& $p $props 'elasticPoolId') -or $name -ieq 'ElasticPool') { return (& $keep 'in an elastic pool -- the pool''s size is the customer''s; left as it is') }
|    $cur = Get-SISqlServiceObjectiveSku -Name $name
|    if (-not $cur -or ($tier -and $tier -notin @('Basic', 'Standard', 'Premium'))) { return (& $keep ('{0} ({1}) is a vCore or other size the customer chose; left as it is' -f $from, $(if ($tier) { $tier } else { 'not a DTU tier' }))) }
|    if ($cur.Tier -eq 'Premium') { return (& $keep ('{0} is Premium, sized by the customer; left as it is' -f $cur.Name)) }
|    $curMax = [long]0; $m = & $p $props 'maxSizeBytes'
|    if ($null -ne $m) { [void][long]::TryParse("$m", [ref]$curMax) }
|    # A SIZE THE CUSTOMER SET LOWERS TOO (owner 2026-10-18): a Standard target of at least S1 below the database's size. The
|    # storage limit is kept, unless the smaller size cannot hold it (above the target's own maximum: it becomes that maximum).
|    $src = if ($Target.PSObject.Properties['Source']) { [string]$Target.Source } else { '' }
|    if ($src -eq 'customer' -and [string]$Target.Tier -eq 'Standard' -and [int]$Target.Capacity -ge 20 -and $cur.Capacity -gt [int]$Target.Capacity) {
|        $body = [ordered]@{ sku = [ordered]@{ name = [string]$Target.Name; tier = [string]$Target.Tier } }
|        if ([long]$Target.MaxSizeBytes -gt 0 -and [int]$Target.Capacity -lt 100 -and $curMax -gt [long]$Target.MaxSizeBytes) { $body['properties'] = [ordered]@{ maxSizeBytes = [long]$Target.MaxSizeBytes } }
|        return [pscustomobject]@{ Action = 'lower'; Reason = ('{0} -> {1}: {2}' -f $cur.Name, $Target.Name, $Target.Reason); From = $cur.Name; Body = $body }
|    }
|    if ($cur.Capacity -gt 100 -and $src -ne 'customer') { return (& $keep ('{0} is above S3, sized by the customer; left as it is' -f $cur.Name)) }
|    if ($cur.Capacity -ge [int]$Target.Capacity) {
|        # the size is right, the STORAGE LIMIT is not: a Standard database still at Basic's 2 GB (a raise that kept the old
|        # limit) fills up and every write fails (ring 1 2026-10-09: S2 at 2 GB, "reached its size quota"). The limit
|        # grows alone -- the service objective is untouched, and Standard includes 250 GB at no extra cost.
|        if ($cur.Tier -eq 'Standard' -and [long]$Target.MaxSizeBytes -gt 0 -and $curMax -gt 0 -and $curMax -lt [long]$Target.MaxSizeBytes) {
|            return [pscustomobject]@{ Action = 'raise'; From = $cur.Name
|                Reason = ('{0} keeps its size; its storage limit grows {1:N0} GB -> {2:N0} GB' -f $cur.Name, ($curMax / 1GB), ([long]$Target.MaxSizeBytes / 1GB))
|                Body = [ordered]@{ properties = [ordered]@{ maxSizeBytes = [long]$Target.MaxSizeBytes } } }
|        }
|        return (& $keep ('{0} is already at or above {1}; never lowered' -f $cur.Name, $Target.Name))
|    }
|    # the service objective by name (ARM's own example: { "sku": { "name": "S2", "tier": "Standard" } })
|    $body = [ordered]@{ sku = [ordered]@{ name = [string]$Target.Name; tier = [string]$Target.Tier } }
|    if ([long]$Target.MaxSizeBytes -gt 0 -and $curMax -lt [long]$Target.MaxSizeBytes) { $body['properties'] = [ordered]@{ maxSizeBytes = [long]$Target.MaxSizeBytes } }
|    [pscustomobject]@{ Action = 'raise'; Reason = ('{0} -> {1}: {2}' -f $cur.Name, $Target.Name, $Target.Reason); From = $cur.Name; Body = $body }
|}
|
|function ConvertTo-SISqlTierPatchJson {
|    <# PURE. The PATCH body as compact JSON (the sku, and the max size when it grows). #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Body)
|    $Body | ConvertTo-Json -Compress -Depth 4
|}
|
|function Get-SISqlDatabaseCreateArgs {
|    <# PURE. The `az sql db create` size arguments for a new database at -Target (Get-SISqlDatabaseTier). #>
|    param([Parameter(Mandatory)]$Target)
|    $a = @('--service-objective', [string]$Target.Name)
|    if ([long]$Target.MaxSizeBytes -gt 0) { $a += @('--max-size', ('{0}GB' -f [long]([long]$Target.MaxSizeBytes / 1GB))) }
|    $a
|}
|
|function Test-SISqlTierPermission {
|    <#
|        PURE. Does an ARM permissions list (GET <scope>/providers/Microsoft.Authorization/permissions: value[].actions /
|        notActions) allow Microsoft.Sql/servers/databases/write? $true / $false; $null when the list says nothing usable.
|    #>
|    param([object[]]$Permissions = @())
|    $want = 'Microsoft.Sql/servers/databases/write'
|    $match = { param($pat) $rx = '^' + ([regex]::Escape([string]$pat) -replace '\\\*', '.*') + '$'; $want -match "(?i)$rx" }
|    $allow = $false; $deny = $false; $seen = $false
|    foreach ($perm in @($Permissions)) {
|        if (-not $perm) { continue }
|        $seen = $true
|        foreach ($a in @($perm.actions)) { if ($a -and (& $match $a)) { $allow = $true } }
|        foreach ($n in @($perm.notActions)) { if ($n -and (& $match $n)) { $deny = $true } }
|    }
|    if (-not $seen) { return $null }
|    $allow -and -not $deny
|}
|
|function Get-SISqlTierTenantCounts {
|    <#
|        The tenant's directory counts (Microsoft Graph $count, ConsistencyLevel eventual) -- $null when they cannot be read
|        (an identity without directory read: the updater's managed identity has none). An answer that is not a plain number
|        is not a count. -Rest: the update's REST seam (setup/_shared/SI-UpdateRest.ps1, #521).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [string]$SubscriptionId)
|    $c = @{}
|    foreach ($k in @(@{ N = 'Users'; P = 'users' }, @{ N = 'Groups'; P = 'groups' }, @{ N = 'ServicePrincipals'; P = 'servicePrincipals' }, @{ N = 'Devices'; P = 'devices' })) {
|        $r = & $Rest 'GET' ('https://graph.microsoft.com/v1.0/{0}/$count' -f $k.P) $null 'https://graph.microsoft.com/' @{ ConsistencyLevel = 'eventual'; Accept = 'text/plain' }
|        if (-not $r -or [int]$r.Status -lt 200 -or [int]$r.Status -ge 300) { return $null }
|        $t = "$($r.Body)".Trim().TrimStart([char]0xFEFF)
|        $n = 0L
|        if ($t -notmatch '^\d+$' -or -not [long]::TryParse($t, [ref]$n)) { return $null }
|        $c[$k.N] = $n
|    }
|    $c
|}
|
|function Get-SISqlTierServerFqdn {
|    <# PURE. A SQL server's host name from its ARM shape (properties.fullyQualifiedDomainName) or a flattened one. #>
|    param($Server)
|    if (-not $Server) { return '' }
|    if ($Server.PSObject.Properties['properties'] -and $Server.properties -and $Server.properties.PSObject.Properties['fullyQualifiedDomainName']) { return ([string]$Server.properties.fullyQualifiedDomainName).ToLowerInvariant() }
|    if ($Server.PSObject.Properties['fullyQualifiedDomainName']) { return ([string]$Server.fullyQualifiedDomainName).ToLowerInvariant() }
|    ''
|}
|
|function Invoke-SISqlTierRead {
|    <#
|        One read of the size step. -Kind: ServersInRg | ServersAll | Databases (of -Server) | Permissions (on -Server).
|        Lists come back as items (@() when they cannot be read), Permissions as the parsed answer ($null when unreadable).
|        Over -Rest (ARM; #521 -- there is no az path).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId,
|          [Parameter(Mandatory)][ValidateSet('ServersInRg', 'ServersAll', 'Databases', 'Permissions')][string]$Kind, [string]$ResourceGroup, $Server)
|    $path = switch ($Kind) {
|        'ServersInRg' { '/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Sql/servers' -f $SubscriptionId, $ResourceGroup }
|        'ServersAll'  { '/subscriptions/{0}/providers/Microsoft.Sql/servers' -f $SubscriptionId }
|        'Databases'   { [string]$Server.id + '/databases' }
|        'Permissions' { [string]$Server.id + '/providers/Microsoft.Authorization/permissions' }
|    }
|    if ($Kind -eq 'Permissions') { try { return (Invoke-SIRestJson -Rest $Rest -Uri (Get-SIArmUri -Path $path -ApiVersion '2022-04-01') -What 'the permissions on the SQL server') } catch { return $null } }
|    try { return @(Get-SIRestList -Rest $Rest -Uri (Get-SIArmUri -Path $path -ApiVersion $script:SISqlTierArmApi) -What ('SQL {0}' -f $Kind)) } catch { return @() }
|}
|
|function Invoke-SISqlTierPatch {
|    <# One online ARM PATCH of a database's sku over -Rest: @{ Ok; Text (what Azure said when it refused) }. -WorkDir / -Name:
|       kept for callers, unused (the az path that wrote a body file is gone). #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$Url, [Parameter(Mandatory)][string]$Json,
|          [string]$WorkDir, [string]$Name)
|    $r = & $Rest 'PATCH' $Url $Json 'https://management.azure.com/' @{ 'Content-Type' = 'application/json' }
|    $ok = ($r -and [int]$r.Status -ge 200 -and [int]$r.Status -lt 300)
|    [pscustomobject]@{ Ok = $ok; Text = $(if ($ok) { '' } else { Format-SIRestFailure -Response $r }) }
|}
|
|function Invoke-SISqlTierUpgrade {
|    <#
|        EXISTING INSTALLS: raise this install's SI databases to the rule's size. -Rest: the update's REST seam
|        (setup/_shared/SI-UpdateRest.ps1 -- ARM only, #521); the update and the guided install both pass it. No az path.
|        -ServerFqdns: the SQL servers the install is configured with (SI_ProSqlServer, SI_LedgerSqlServer, ...); the servers
|        in -ResourceGroup are looked at too. -DatabaseNames: the databases the install is configured with; the names SI
|        creates (sqldb-si-pro, sqldb-si-identity) are always included. No other database on a server is ever touched.
|        -Objects / -Override: Get-SISqlDatabaseTier. -WhatIf: plan only.
|        Returns @{ Results = @(@{ Server; Database; Action = raised | lowered | keep | would-raise | would-lower | missing-right | failed; Line });
|        Lines; Target }. NEVER throws: a database that cannot be read or changed is a line, and the update goes on.
|    #>
|    param([scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [string]$ResourceGroup,
|          [string[]]$ServerFqdns = @(), [string[]]$DatabaseNames = @(), [AllowNull()]$Objects, [AllowEmptyString()][string]$Override,
|          # the identity ledger databases (always S1 -- a size the customer set never applies to them; sqldb-si-identity is always one); a name
|          # also in -DatabaseNames (a ledger kept in the Pro database) is sized as data
|          [string[]]$LedgerDatabaseNames = @(),
|          [switch]$WhatIf, [string]$WorkDir)
|    if (-not $Rest) { throw 'Invoke-SISqlTierUpgrade: pass -Rest (the REST seam of setup\_shared\SI-UpdateRest.ps1).' }
|    $target = Get-SISqlDatabaseTier -Objects $Objects -Override $Override
|    $ledgerTarget = Get-SISqlDatabaseTier -Objects $Objects -Override $Override -Role Ledger
|    $dataNames = @(@('sqldb-si-pro') + @($DatabaseNames) | Where-Object { "$_".Trim() } | ForEach-Object { "$_".Trim().ToLowerInvariant() })
|    $ledgerNames = @(@('sqldb-si-identity') + @($LedgerDatabaseNames) | Where-Object { "$_".Trim() } | ForEach-Object { "$_".Trim().ToLowerInvariant() } | Where-Object { $_ -notin $dataNames })
|    $results = New-Object System.Collections.Generic.List[object]
|    $lines = New-Object System.Collections.Generic.List[string]
|    if ($target.Note) { $lines.Add(('SQL database size: {0}' -f $target.Note)) }
|    $add = { param($srv, $db, $act, $line, $want = '') $results.Add([pscustomobject]@{ Server = $srv; Database = $db; Action = $act; Line = $line; Target = $want }); $lines.Add($line) }
|    $read = @{ Rest = $Rest; SubscriptionId = $SubscriptionId }
|
|    # ---- the servers: in the install's resource group, and the configured ones found by their host name ----
|    $servers = New-Object System.Collections.Generic.List[object]
|    $seen = @{}
|    $keepSrv = { param($s) if ($s -and $s.id -and -not $seen.ContainsKey(([string]$s.id).ToLowerInvariant())) { $seen[([string]$s.id).ToLowerInvariant()] = $true; $servers.Add($s) } }
|    if ($ResourceGroup) { foreach ($s in @(Invoke-SISqlTierRead @read -Kind ServersInRg -ResourceGroup $ResourceGroup)) { & $keepSrv $s } }
|    $fqdns = @($ServerFqdns | Where-Object { "$_".Trim() } | ForEach-Object { "$_".Trim().ToLowerInvariant() } | Select-Object -Unique)
|    $missing = @($fqdns | Where-Object { $f = $_; -not @($servers | Where-Object { (Get-SISqlTierServerFqdn $_) -eq $f }).Count })
|    if ($missing.Count) {
|        foreach ($s in @(Invoke-SISqlTierRead @read -Kind ServersAll)) {
|            if ($s -and (Get-SISqlTierServerFqdn $s) -in $missing) { & $keepSrv $s }
|        }
|        foreach ($f in $missing) {
|            if (-not @($servers | Where-Object { (Get-SISqlTierServerFqdn $_) -eq $f }).Count) {
|                & $add $f '' 'failed' ('SQL database size: the server {0} was not found in subscription {1} (or this identity cannot read it) -- its databases were not checked' -f $f, $SubscriptionId)
|            }
|        }
|    }
|    $names = @(@($script:SISqlTierKnownDatabases) + $dataNames + $ledgerNames | Where-Object { "$_".Trim() } | ForEach-Object { "$_".Trim().ToLowerInvariant() } | Select-Object -Unique)
|    if (-not $servers.Count) { if (-not $results.Count) { & $add '' '' 'keep' 'SQL database size: no SQL server for this install was found -- nothing to size' }; return [pscustomobject]@{ Results = $results.ToArray(); Lines = $lines.ToArray(); Target = $target } }
|    if (-not $WorkDir) { $WorkDir = Join-Path ([IO.Path]::GetTempPath()) ('si-sqltier-' + [guid]::NewGuid().ToString('N').Substring(0, 8)) }
|
|    foreach ($srv in $servers) {
|        $srvName = [string]$srv.name; $srvRg = [string]$srv.resourceGroup
|        if (-not $srvRg -and [string]$srv.id -match '/resourceGroups/([^/]+)/') { $srvRg = $Matches[1] }
|        $dbs = @(Invoke-SISqlTierRead @read -Kind Databases -Server $srv)
|        $dbs = @($dbs | Where-Object { $_ -and ([string]$_.name).ToLowerInvariant() -in $names })
|        if (-not $dbs.Count) { continue }
|        # the right to change them: read once per server (a list that says nothing usable = try, and read the answer)
|        $canWrite = $null
|        $perm = Invoke-SISqlTierRead @read -Kind Permissions -Server $srv
|        if ($perm -and $perm.PSObject.Properties['value']) { $canWrite = Test-SISqlTierPermission -Permissions @($perm.value) }
|        foreach ($db in $dbs) {
|            $dbName = [string]$db.name
|            # ARM keeps the size under .properties (the az list flattened it): the decision reads the ARM shape
|            $dp = if ($db.PSObject.Properties['properties'] -and $db.properties) { $db.properties } else { $db }
|            $dv = { param($n) if ($dp.PSObject.Properties[$n]) { $dp.$n } else { $null } }
|            $cur = [pscustomobject]@{
|                sku = $(if ($db.PSObject.Properties['sku'] -and $db.sku) { $db.sku } else { [pscustomobject]@{ name = [string](& $dv 'currentServiceObjectiveName'); tier = [string](& $dv 'edition'); capacity = (& $dv 'capacity') } })
|                properties = [pscustomobject]@{ maxSizeBytes = (& $dv 'maxSizeBytes'); elasticPoolId = [string](& $dv 'elasticPoolId'); currentServiceObjectiveName = [string](& $dv 'currentServiceObjectiveName') }
|            }
|            $want = if ($dbName.ToLowerInvariant() -in $ledgerNames) { $ledgerTarget } else { $target }
|            $ch = Get-SISqlTierChange -Current $cur -Target $want
|            if ($ch.Action -eq 'keep') { & $add $srvName $dbName 'keep' ('SQL database size: {0}/{1} stays {2} -- {3}' -f $srvName, $dbName, $ch.From, $ch.Reason) $want.Name; continue }
|            # a size the customer set may LOWER a database (owner 2026-10-18); the product's rule only raises
|            $vb = if ($ch.Action -eq 'lower') { 'lowered' } else { 'raised' }
|            if ($WhatIf) { & $add $srvName $dbName $(if ($ch.Action -eq 'lower') { 'would-lower' } else { 'would-raise' }) ('SQL database size: {0}/{1} would be {3} {2} (an online change, re-run with -Apply)' -f $srvName, $dbName, $ch.Reason, $vb) $want.Name; continue }
|            if ($canWrite -eq $false) {
|                & $add $srvName $dbName 'missing-right' ('SQL database size: {0}/{1} should be {4} {2}, but this identity may not change it (it lacks Microsoft.Sql/servers/databases/write) -- give it the role ''SQL DB Contributor'' on server {0} (or Contributor on resource group {3}); nothing was changed' -f $srvName, $dbName, $ch.Reason, $srvRg, $vb) $want.Name
|                continue
|            }
|            $id = if ($db.PSObject.Properties['id'] -and $db.id) { [string]$db.id } else { '{0}/databases/{1}' -f [string]$srv.id, $dbName }
|            $url = 'https://management.azure.com{0}?api-version={1}' -f $id, $script:SISqlTierArmApi
|            $r = Invoke-SISqlTierPatch @read -Url $url -Json (ConvertTo-SISqlTierPatchJson -Body $ch.Body) -WorkDir $WorkDir -Name $dbName
|            if ($r.Ok) {
|                & $add $srvName $dbName $vb ('SQL database size: {0}/{1} {3} {2} -- an online change (no data loss; open connections reconnect once when Azure switches over, within minutes)' -f $srvName, $dbName, $ch.Reason, $vb) $want.Name
|            } elseif ("$($r.Text)" -match '(?i)AuthorizationFailed|\b403\b|Forbidden|does not have authorization') {
|                & $add $srvName $dbName 'missing-right' ('SQL database size: {0}/{1} should be {4} {2}, but Azure refused this identity (Microsoft.Sql/servers/databases/write) -- give it the role ''SQL DB Contributor'' on server {0} (or Contributor on resource group {3}); nothing was changed' -f $srvName, $dbName, $ch.Reason, $srvRg, $vb)
|            } else {
|                $why = ("$($r.Text)" -replace '\s+', ' ').Trim(); if ($why.Length -gt 300) { $why = $why.Substring(0, 297) + '...' }
|                & $add $srvName $dbName 'failed' ('SQL database size: {0}/{1} was NOT {4} {2}: {3} -- the next update tries again' -f $srvName, $dbName, $ch.Reason, $why, $vb)
|            }
|        }
|    }
|    Remove-Item -LiteralPath $WorkDir -Recurse -Force -ErrorAction SilentlyContinue
|    if (-not $results.Count) { & $add '' '' 'keep' 'SQL database size: no SecurityInsight database was found on this install''s SQL servers -- nothing to size' }
|    [pscustomobject]@{ Results = $results.ToArray(); Lines = $lines.ToArray(); Target = $target }
|}
|
|function Get-SISqlTierSummaryLine {
|    <# PURE. ONE plain line for the run log / the Pro database (cfg.InstallState 'SqlTier'), at most 400 characters. #>
|    param([Parameter(Mandatory)]$Upgrade)
|    $r = @($Upgrade.Results)
|    $parts = foreach ($x in $r) {
|        if (-not $x.Database) { continue }
|        $to = if ($x.PSObject.Properties['Target'] -and $x.Target) { $x.Target } else { $Upgrade.Target.Name }
|        '{0} {1}' -f $x.Database, $(switch ($x.Action) { 'raised' { 'raised to ' + $to } 'lowered' { 'lowered to ' + $to } 'keep' { 'kept' } 'would-raise' { 'would be raised to ' + $to } 'would-lower' { 'would be lowered to ' + $to } 'missing-right' { 'NOT raised (missing right)' } default { 'NOT raised (failed)' } })
|    }
|    $t = if (@($parts).Count) { 'SQL database size {0}: {1}' -f $Upgrade.Target.Reason, (@($parts) -join ', ') } else { (@($Upgrade.Lines) | Select-Object -First 1) }
|    $t = "$t"; if ($t.Length -gt 400) { $t = $t.Substring(0, 397) + '...' }
|    $t
|}
'@ }
$__siSupportFiles['setup/_shared/SI-JobSizing.ps1'] = @{ Sha256 = '0ed8e85bc9be31bc901538e8b2eab6ca9562b2490cf85c6faa4e34d7e3872753'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE CONTAINER JOB SIZE ON EVERY UPDATE (#509, operator 2026-10-09: "include these guidance rules for
|    si and pim so you automatically adjust during installation. both si and pim are allowed to go to 4 cpu/8 gb if needed",
|    and "it is very little money").
|
|    Setup sizes the collection jobs from the tenant's Microsoft Graph counts ONCE, at install (Bootstrap-ContainerAppJob.ps1
|    -> Get-SITenantSizedJobResources). An install made before that rule, or a tenant that grew, kept its first size. So
|    every update (setup\Invoke-SIContainerUpdate.ps1, step 8 -- the updater job and the VM sync hook both run it) applies
|    the SAME rule to the jobs that exist:
|
|      * WHICH JOBS: identity, endpoint (scheduled, or the KEDA producer + worker), the CI build (asset-correlation) and the
|        Risk Analysis jobs (risk-analysis, risk-analysis-detailed, ra-<name>). Objects: identity = users + groups + service
|        principals; endpoint = devices; the CI build and Risk Analysis = all of them (Get-SITenantSizedJobResources).
|      * THE COUNTS, the first that can be read, and the log says which: (1) Microsoft Graph $count as the updater's
|        identity; (1b) the SAME Graph counts as the identity / endpoint collection read them with ITS directory rights,
|        recorded in the Pro database (cfg.InstallState 'TenantSize', engine\_shared\SI-TenantSizeMark.ps1) -- the updater
|        has no directory read, and needs none for this; (2) the records the last collection wrote, per provider, in the Pro database (sidata.CiRecord: Entra
|        users / groups / service principals, the largest device count of any provider); (3) the asset counts the engines
|        recorded in their run health (SI_RunHealth_CL, the largest run of the last 7 days). Without (1), each half -- the
|        identity objects, the devices -- comes from the first of (2), the Graph counts SETUP read at install (kept on the
|        jobs as si-tenant-* tags) and (3) that has it; a 0 is not known, never none (#720). A COUNT NOT KNOWN -- none
|        readable, or the half a job counts missing -- sizes that job for a large tenant, 4 CPU / 8 GiB (owner 2026-10-16:
|        reliability over cost, "we can always lower it later"), with one plain line; a known count below 5,000 keeps the
|        job's size.
|      * LEARN FROM FAILURES: when a job's LAST execution ended out of memory (Container Apps system log OOMKilled / exit
|        137, an END that says OutOfMemory or carries the out-of-memory class si-col-0501 / si-ra-0303, or a run that
|        started, recorded no end and stopped well before its timeout) or at its replica timeout, the job goes up one band
|        even when the counts do not ask for it: CPU / memory 2 / 4 GiB, then 4 / 8 GiB. One plain line says why. A Failed or
|        Stopped execution counts although ARM gives it no endTime (#720: it never does for a failed run).
|      * THE RUN LIMIT (owner 2026-10-13: "we are not to judge that and it breaks the whole solution"): SecurityInsight
|        chooses no run limit. EVERY engine job (every caj-si-* job but the updater) gets the longest run limit Azure takes
|        -- Get-SIJobRunLimit, 7 days -- at install, and every update raises an existing job to it (Invoke-SIJobFloor, the
|        update's step 8c; this file's sizing applies the same value, so neither ever writes a shorter one). It does not
|        depend on the tenant's size, on how long a run took or on how a run ended. The only thing that watches a step is
|        the pipeline's report of a step with no sign of progress, which reports and lets the step run on.
|      * THE PIPELINE JOB ITSELF (caj-si-flow) waits for every step inside its own execution: it gets 7 days
|        (Get-SIFlowJobReplicaTimeout), by its own rule (Invoke-SIFlowJobRunLimit).
|      * NEVER LOWERS, NEVER ABOVE 4 CPU / 8 GiB (the largest consumption size). A size the customer set wins:
|        SI_Bootstrap_Cpu_<Engine> / _Memory_<Engine> keep the job's CPU and memory, SI_Bootstrap_ReplicaTimeout_<Engine>
|        its run time (as Get-SIContainerJobResources honours it at install: 300 s to 7 days, so it can only be SHORTER
|        than what every job gets -- a customer's own choice, and the update then leaves that job's run limit alone).
|      * THE CHANGE: ONE ARM read-modify-write PATCH per job (#521, no az CLI): the job is read at the PATCH's own
|        api-version, its WHOLE template goes back with the first container's CPU / memory changed (a PATCH of a template
|        fragment would replace the container list), and -- when the run time grows -- its configuration's trigger with the
|        new replicaTimeout; the secrets are never sent back. One line per job changed. A KEDA worker whose timeout grows
|        gets its queue lease with it (SI_QUEUE_LEASE_SECONDS = timeout + 300, as Bootstrap sets it). Never fails the update.
|
|    Every Azure call goes through the REST seam -Rest { param($Method, $Uri, $Body, $Resource, $Headers) } -> @{ Status;
|    Body } (setup/_shared/SI-UpdateRest.ps1) and the Pro database through -SqlRows { param([string]$Sql) -> rows }, so every
|    decision is tested offline. PowerShell 5.1-compatible.
|#>
|
|# the rule itself (Get-SITenantSizedJobResources) and the per-engine setting names (Get-SIEngineSettingSuffix)
|if (-not (Get-Command -Name Get-SITenantSizedJobResources -ErrorAction SilentlyContinue)) {
|    . ([IO.Path]::Combine($PSScriptRoot, '..', '..', 'container', '_shared', 'SI-ContainerConfig.ps1'))
|}
|if (-not (Get-Command -Name Invoke-SIRestJson -ErrorAction SilentlyContinue)) { . ([IO.Path]::Combine($PSScriptRoot, 'SI-UpdateRest.ps1')) }
|# the directory counts the collections record (ConvertFrom-SITenantSizeMark) -- read when it is there, never required
|if (-not (Get-Command -Name ConvertFrom-SITenantSizeMark -ErrorAction SilentlyContinue)) {
|    $__tsMark = [IO.Path]::Combine($PSScriptRoot, '..', '..', 'engine', '_shared', 'SI-TenantSizeMark.ps1')
|    if (Test-Path -LiteralPath $__tsMark) { . $__tsMark }
|}
|# Graph $count (Get-SISqlTierTenantCounts)
|if (-not (Get-Command -Name Get-SISqlTierTenantCounts -ErrorAction SilentlyContinue)) {
|    . ([IO.Path]::Combine($PSScriptRoot, 'SI-SqlTier.ps1'))
|}
|
|# The bands a job moves through (Container Apps consumption pairs). Level 0 = the job kind's own default (below 4 GiB).
|$script:SIJobSizeBands = @{
|    1 = [pscustomobject]@{ Cpu = '2.0'; Memory = '4.0Gi'; Text = '2 CPU / 4 GiB' }
|    2 = [pscustomobject]@{ Cpu = '4.0'; Memory = '8.0Gi'; Text = '4 CPU / 8 GiB' }
|}
|$script:SIJobSizeMaxLevel = 2
|# THE RUN LIMIT is ONE value for every engine job: Get-SIJobRunLimit (container/_shared/SI-ContainerConfig.ps1), the longest
|# run limit Azure takes. Nothing here measures a run or picks a shorter limit. A value Azure refuses is said as a line by
|# the update (Invoke-SIJobSizePatch: 24 hours instead), and the next update asks again.
|$script:SIJobSizeArmApi = '2025-07-01'   # not 2024-03-01: that version drops a queue scale rule's identity when a job is read and written back (#616)
|# the read-modify-write of a job reads and writes in ONE schema (the fast roll's, SI-FastRoll.ps1: live 2026-10-06)
|$script:SIJobSizePatchApi = '2025-07-01'
|
|function Get-SIJobSizingEngine {
|    <#
|        PURE. The engine a job is sized as, from its name, or $null when this sizing does not cover it.
|        caj-si-identity / -identity-producer / -identity-worker -> identity; endpoint likewise; caj-si-asset-correlation;
|        caj-si-risk-analysis, caj-si-risk-analysis-detailed, caj-si-ra-<name>. Returns @{ Engine; Role = job | producer | worker }.
|    #>
|    param([AllowEmptyString()][string]$JobName)
|    $n = "$JobName".Trim().ToLowerInvariant()
|    if (-not $n.StartsWith('caj-si-')) { return $null }
|    $s = $n.Substring(7); $role = 'job'
|    if ($s -match '^(.+)-(producer|worker)$') { $s = $Matches[1]; $role = $Matches[2] }
|    # the jobs that load the whole Risk Analysis result (data sync, vulnerabilities) are sized as Risk Analysis
|    # is: customer H 2026-10-10, ~49,000 Detailed rows ran the data sync out of memory at the 2 GiB default, twice
|    # 'azure' since 2026-10-12: a new customer install ran its Azure worker out of memory at 4 GiB
|    $ok = ($s -in @('identity', 'endpoint', 'azure', 'asset-correlation', 'risk-analysis', 'risk-analysis-detailed', 'asset-datasync', 'asset-vulnerabilities')) -or ($s -match '^ra-[a-z0-9-]+$')
|    if (-not $ok) { return $null }
|    if ($role -ne 'job' -and $s -notin @('identity', 'endpoint', 'azure')) { return $null }
|    [pscustomobject]@{ Engine = $s; Role = $role }
|}
|
|function Get-SIJobSizingStepKeys {
|    <#
|        The jobs that are steps of the pipeline, from the shipped map (config\job-flow.locked.json): every job with a
|        stage that is not marked neverInFlow / ownSchedule (the updater) / retired. -Path: test seam. @() when the map
|        cannot be read (a customer's run limit setting is then looked for under the job's own name only).
|    #>
|    param([string]$Path)
|    if (-not $Path) { $Path = [IO.Path]::Combine($PSScriptRoot, '..', '..', 'config', 'job-flow.locked.json') }
|    try {
|        $raw = [IO.File]::ReadAllText($Path) | ConvertFrom-Json
|        $flag = { param($j, $n) [bool]($j.PSObject.Properties[$n] -and $j.$n) }
|        return @(@($raw.jobs) | Where-Object { $_ -and (& $flag $_ 'stage') -and -not (& $flag $_ 'neverInFlow') -and -not (& $flag $_ 'ownSchedule') -and -not (& $flag $_ 'retired') } |
|                 ForEach-Object { [pscustomobject]@{ Key = ([string]$_.key).ToLowerInvariant(); Engine = ([string]$_.engine).ToLowerInvariant() } })
|    } catch { return @() }
|}
|
|function Get-SIJobRunLimitJob {
|    <#
|        PURE. Is this job a step of the pipeline (the pipeline's self-healing asks), and as what? Every job that is a step of the
|        pipeline (-Steps: Get-SIJobSizingStepKeys), its producer / worker when it collects in parts, and every Risk
|        Analysis report job (ra-<name>). Returns @{ Engine; Role = job | producer | worker; Sized = also sized for CPU and
|        memory (Get-SIJobSizingEngine); Names = the engine names its SI_Bootstrap_ReplicaTimeout_<Engine> setting may be
|        spelt with } or $null (the updater, the pipeline job, a job that is no step).
|    #>
|    param([AllowEmptyString()][string]$JobName, [object[]]$Steps = @())
|    $sized = Get-SIJobSizingEngine -JobName $JobName
|    $n = "$JobName".Trim().ToLowerInvariant()
|    if (-not $n.StartsWith('caj-si-')) { return $null }
|    $s = $n.Substring(7); $role = 'job'
|    if ($s -match '^(.+)-(producer|worker)$') { $s = $Matches[1]; $role = $Matches[2] }
|    $step = @(@($Steps) | Where-Object { $_ -and [string]$_.Key -eq $s }) | Select-Object -First 1
|    if (-not $sized -and -not $step -and $s -notmatch '^ra-[a-z0-9-]+$') { return $null }
|    $names = @($s); if ($step -and $step.Engine -and $step.Engine -ne $s) { $names += [string]$step.Engine }
|    [pscustomobject]@{ Engine = $s; Role = $role; Sized = [bool]$sized; Names = $names }
|}
|
|function Get-SIJobRunLimitReason {
|    <# PURE. The plain words for why a job's run limit was raised (the update's log line). #>
|    'a step gets the longest run limit Azure takes ({0}); SecurityInsight sets no shorter one' -f (Format-SIJobTimeout -Seconds ([int](Get-SIJobRunLimit)))
|}
|
|function Get-SIJobRunLimitSetting {
|    <#
|        PURE. The customer's own run limit setting for a job, when one is set: the NAME of the setting
|        (SI_Bootstrap_ReplicaTimeout_<Engine>, under any of the engine names in -Engines), else ''. A job with one keeps the
|        run limit it has: the update never raises it.
|    #>
|    param([string[]]$Engines = @(), [hashtable]$Globals = @{})
|    foreach ($e in @($Engines | Where-Object { $_ })) {
|        $n = 'SI_Bootstrap_ReplicaTimeout_{0}' -f (Get-SIEngineSettingSuffix -Engine $e)
|        if ($Globals -and $Globals.ContainsKey($n) -and -not [string]::IsNullOrWhiteSpace([string]$Globals[$n])) { return $n }
|    }
|    ''
|}
|
|function ConvertTo-SIJobMemoryGi {
|    <# PURE. '4Gi' / '4.0Gi' / '0.5Gi' -> 4.0 (double); 0 when it is not a size. #>
|    param([AllowNull()]$Memory)
|    $m = 0.0
|    $t = ("$Memory" -replace '(?i)\s*gi$', '').Trim()
|    if ([double]::TryParse($t, [Globalization.NumberStyles]::Float, [Globalization.CultureInfo]::InvariantCulture, [ref]$m)) { return $m }
|    0.0
|}
|
|function Get-SIJobCurrentSize {
|    <# PURE. A job's CPU, memory and replica timeout from its ARM shape (the job list the update read). #>
|    param([Parameter(Mandatory)]$Job)
|    $c = $null; try { $c = @($Job.properties.template.containers)[0] } catch { $c = $null }
|    $cpu = 0.0; $mem = ''
|    if ($c -and $c.resources) {
|        [void][double]::TryParse("$($c.resources.cpu)", [Globalization.NumberStyles]::Float, [Globalization.CultureInfo]::InvariantCulture, [ref]$cpu)
|        $mem = [string]$c.resources.memory
|    }
|    $to = 0; try { [void][int]::TryParse("$($Job.properties.configuration.replicaTimeout)", [ref]$to) } catch { }
|    [pscustomobject]@{ Cpu = $cpu; Memory = $mem; MemoryGi = (ConvertTo-SIJobMemoryGi $mem); ReplicaTimeout = $to }
|}
|
|function Get-SIJobSizeLevel {
|    <# PURE. The band a memory size is in: 0 below 4 GiB, 1 below 8 GiB, 2 at 8 GiB. #>
|    param([double]$MemoryGi)
|    if ($MemoryGi -ge 8) { return 2 }
|    if ($MemoryGi -ge 4) { return 1 }
|    0
|}
|
|function Format-SIJobTimeout {
|    <# PURE. 14400 -> '4 h', 5400 -> '1.5 h', 1800 -> '30 min', 604800 -> '7 days'. #>
|    param([int]$Seconds)
|    if ($Seconds -lt 3600) { return ('{0} min' -f [int]($Seconds / 60)) }
|    if ($Seconds -ge 604800 -and ($Seconds % 86400) -eq 0) { return ('{0} days' -f [int]($Seconds / 86400)) }
|    ('{0} h' -f ([double]$Seconds / 3600).ToString('0.#', [Globalization.CultureInfo]::InvariantCulture))
|}
|
|function ConvertTo-SIJobSizingUtc {
|    <# PURE. A time from ARM / Log Analytics -> UTC [datetime], or $null. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or "$Value".Trim() -eq '') { return $null }
|    if ($Value -is [datetime]) { return $Value.ToUniversalTime() }
|    $d = [datetime]::MinValue
|    if ([datetime]::TryParse("$Value", [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]'AdjustToUniversal, AssumeUniversal', [ref]$d)) { return $d }
|    $null
|}
|
|function Get-SIJobFailureSignal {
|    <#
|        PURE. Did this job's LAST finished execution end out of memory or at its replica timeout?
|        -Executions: the job's executions (ARM: name, properties.status / startTime / endTime). -SystemLogRows: Container Apps
|        system log rows (Job, Exec, Reason, Msg, TimeGenerated) that mention OOMKilled / exit code 137. -RunHealthRows:
|        SI_RunHealth_CL rows (Engine, Phase, ExitReason, ErrorMessage, TimeGenerated).
|        Returns @{ Kind = oom | timeout; Execution; Reason } or $null (succeeded, failed for another reason, or not known).
|    #>
|    param([Parameter(Mandatory)][string]$JobName, [string]$Engine, [int]$ReplicaTimeout,
|          [object[]]$Executions = @(), [object[]]$SystemLogRows = @(), [object[]]$RunHealthRows = @())
|    $p = { param($o, $n) if ($null -eq $o) { return $null }; $pp = $o.PSObject.Properties[$n]; if ($pp) { $pp.Value } else { $null } }
|    # #720 (live 2026-10-16, the large installs): ARM returns a FAILED (or Stopped) execution WITHOUT an endTime -- the
|    # identity producer's out-of-memory run carried status Failed, a startTime and no endTime. Such a run is FINISHED: its
|    # end is the run health's END record of that execution when there is one, else unknown (then its length is unknown:
|    # no timeout is read from it, but every out-of-memory signal still is). Only a run still going is skipped.
|    $finished = @('Succeeded', 'Failed', 'Stopped')
|    $rhEndOf = {
|        param([string]$Exec)
|        $at = $null
|        foreach ($r in @($RunHealthRows)) {
|            if (-not $r -or [string](& $p $r 'Phase') -ne 'End' -or -not ([string](& $p $r 'Execution') -ieq $Exec)) { continue }
|            $t = ConvertTo-SIJobSizingUtc (& $p $r 'TimeGenerated'); if ($t -and (-not $at -or $t -gt $at)) { $at = $t }
|        }
|        $at
|    }
|    $done = foreach ($e in @($Executions)) {
|        if (-not $e) { continue }
|        $props = & $p $e 'properties'; if (-not $props) { $props = $e }
|        $st = [string](& $p $props 'status')
|        $start = ConvertTo-SIJobSizingUtc (& $p $props 'startTime'); $end = ConvertTo-SIJobSizingUtc (& $p $props 'endTime')
|        if (-not $start) { continue }
|        if (-not $end) {
|            if ($finished -notcontains $st) { continue }
|            $end = & $rhEndOf ([string](& $p $e 'name'))
|            $known = $false
|        } else { $known = $true }
|        if ($st -in @('Running', 'Processing', 'Pending', '')) { continue }
|        [pscustomobject]@{ Name = [string](& $p $e 'name'); Status = $st; Start = $start; End = $end; EndKnown = $known }
|    }
|    $last = @($done | Sort-Object Start -Descending) | Select-Object -First 1
|    if (-not $last) { return $null }
|    # the window run-health / system-log rows of this run fall in: to its end (+15 min), or -- no end known -- to the run
|    # limit after its start (7 days when the job's limit is not known)
|    $winEnd = if ($last.End) { $last.End.AddMinutes(15) } else { $last.Start.AddSeconds($(if ($ReplicaTimeout -gt 0) { $ReplicaTimeout } else { 604800 })).AddMinutes(15) }
|    # ... and never past the start of a later execution (one still running has its own START and no END yet)
|    if (-not $last.End) {
|        foreach ($e in @($Executions)) {
|            if (-not $e) { continue }
|            $props = & $p $e 'properties'; if (-not $props) { $props = $e }
|            $s2 = ConvertTo-SIJobSizingUtc (& $p $props 'startTime')
|            if ($s2 -and $s2 -gt $last.Start -and $s2 -lt $winEnd) { $winEnd = $s2 }
|        }
|    }
|    # an out-of-memory end, in the engine's words or by its class (si-col-0501 a collection, si-ra-0303 a Risk Analysis
|    # lookup, the uplink class out-of-memory)
|    $oomRx = '(?i)OutOfMemory|out of memory|out-of-memory|\bOOM|si-col-0501|si-ra-0303'
|    if ($last.Status -eq 'Succeeded') {
|        # A run that ENDED "Succeeded" can still have run out of memory: a collection worker catches the error, records it
|        # and ends cleanly, its part goes back on the queue and the next worker fails the same way (a new customer install
|        # 2026-10-12: the Azure worker, 4 GiB, "System.OutOfMemoryException" in its Enrich step, again every two minutes).
|        # The engine's own record says so -- that is a failure signal too.
|        $normS = { param($s) ("$s".ToLowerInvariant() -replace '[^a-z0-9]', '') }
|        $engS = & $normS $Engine
|        $fromS = $last.Start.AddMinutes(-5); $toS = $winEnd
|        foreach ($r in @($RunHealthRows)) {
|            if (-not $r) { continue }
|            # #711: a row that names this very execution is this job's own, whatever engine name it carries (every Risk
|            # Analysis job -- risk-analysis-detailed, ra-<name> -- records itself as 'risk-analysis')
|            $ownS = [bool]([string](& $p $r 'Execution') -and [string](& $p $r 'Execution') -ieq $last.Name)
|            if (-not $ownS) {
|                if (-not $engS) { continue }
|                $re = & $normS (& $p $r 'Engine')
|                if (-not ($re -eq $engS -or $re.StartsWith($engS))) { continue }
|            }
|            $at = ConvertTo-SIJobSizingUtc (& $p $r 'TimeGenerated')
|            if (-not $at -or $at -lt $fromS -or $at -gt $toS) { continue }
|            if (('{0} {1}' -f (& $p $r 'ExitReason'), (& $p $r 'ErrorMessage')) -match $oomRx) {
|                $whenS = $last.Start.ToString('yyyy-MM-dd HH:mm', [Globalization.CultureInfo]::InvariantCulture) + 'Z'
|                return [pscustomobject]@{ Kind = 'oom'; Execution = $last.Name; Reason = ('its last run ({0}, {1}) ran out of memory (its run health says so), although the run itself ended without an error' -f $last.Name, $whenS) }
|            }
|        }
|        return $null
|    }
|    $dur = if ($last.End) { ($last.End - $last.Start).TotalSeconds } else { -1 }
|    $when = $last.Start.ToString('yyyy-MM-dd HH:mm', [Globalization.CultureInfo]::InvariantCulture) + 'Z'
|    $what = '{0}, {1}' -f $last.Name, $when
|    $from = $last.Start.AddMinutes(-5); $to = $winEnd
|    # 1. the Container Apps system log said so (OOMKilled, exit code 137)
|    foreach ($r in @($SystemLogRows)) {
|        if (-not $r) { continue }
|        $ex = [string](& $p $r 'Exec'); $jn = [string](& $p $r 'Job'); $at = ConvertTo-SIJobSizingUtc (& $p $r 'TimeGenerated')
|        $mine = ($ex -and $ex -ieq $last.Name) -or (-not $ex -and $jn -ieq $JobName -and $at -and $at -ge $from -and $at -le $to)
|        $txt = '{0} {1}' -f (& $p $r 'Reason'), (& $p $r 'Msg')
|        if ($mine -and $txt -match '(?i)OOMKilled|OutOfMemory|exit code ''?137') {
|            return [pscustomobject]@{ Kind = 'oom'; Execution = $last.Name; Reason = ('its last run ({0}) was stopped out of memory (Container Apps: OOMKilled)' -f $what) }
|        }
|    }
|    $norm = { param($s) ("$s".ToLowerInvariant() -replace '[^a-z0-9]', '') }
|    $eng = & $norm $Engine
|    $rh = @(@($RunHealthRows) | Where-Object {
|        $_ -and ((([string](& $p $_ 'Execution')) -and ([string](& $p $_ 'Execution')) -ieq $last.Name) -or
|                 ($eng -and ((& $norm (& $p $_ 'Engine')) -eq $eng -or (& $norm (& $p $_ 'Engine')).StartsWith($eng)))) -and
|        ($at = ConvertTo-SIJobSizingUtc (& $p $_ 'TimeGenerated')) -and $at -ge $from -and $at -le $to })
|    # 2. the engine recorded an out-of-memory end
|    foreach ($r in @($rh | Where-Object { [string](& $p $_ 'Phase') -eq 'End' })) {
|        if (('{0} {1}' -f (& $p $r 'ExitReason'), (& $p $r 'ErrorMessage')) -match $oomRx) {
|            return [pscustomobject]@{ Kind = 'oom'; Execution = $last.Name; Reason = ('its last run ({0}) ended out of memory (its run health says so)' -f $what) }
|        }
|    }
|    # 3. it ran until its replica timeout (only a run whose length is known)
|    if ($ReplicaTimeout -gt 0 -and $dur -ge 0 -and $dur -ge ($ReplicaTimeout - [Math]::Max(120, $ReplicaTimeout * 0.02))) {
|        return [pscustomobject]@{ Kind = 'timeout'; Execution = $last.Name; Reason = ('its last run ({0}) was stopped at its replica timeout after {1}' -f $what, (Format-SIJobTimeout -Seconds $ReplicaTimeout)) }
|    }
|    # 4. it started, recorded no end and was stopped well before its timeout: killed -- for memory
|    $starts = @($rh | Where-Object { [string](& $p $_ 'Phase') -eq 'Start' }).Count
|    $ends = @($rh | Where-Object { [string](& $p $_ 'Phase') -eq 'End' }).Count
|    if ($starts -gt 0 -and $ends -lt $starts) {
|        if ($dur -lt 0) {
|            return [pscustomobject]@{ Kind = 'oom'; Execution = $last.Name; Reason = ('its last run ({0}) failed without recording its end (Azure gives the run no end time either) -- a run killed for memory' -f $what) }
|        }
|        return [pscustomobject]@{ Kind = 'oom'; Execution = $last.Name; Reason = ('its last run ({0}) failed after {1} without recording its end, well before its timeout -- a run killed for memory' -f $what, (Format-SIJobTimeout -Seconds ([int]$dur))) }
|    }
|    $null
|}
|
|function Get-SIJobSizingCountHalves {
|    <# PURE. The halves of the tenant's counts a sized job counts: identity -> Identity; endpoint -> Devices; every other
|       sized job (the Azure collection, the CI build, Risk Analysis, the data jobs) reads every object -> both. #>
|    param([Parameter(Mandatory)][string]$Engine)
|    switch ($Engine.Trim().ToLowerInvariant()) {
|        'identity' { return @('Identity') }
|        'endpoint' { return @('Devices') }
|        default { return @('Identity', 'Devices') }
|    }
|}
|
|function Test-SIJobSizingCountKnown {
|    <#
|        PURE. Is the count this job is sized by KNOWN? -Counts: Users, Groups, ServicePrincipals, Devices ($null = none).
|        The identity half is known when Users > 0 (a tenant has users; a 0 is a collection that wrote none, #720), the
|        device half when Devices > 0. A job is known when every half it counts is (Get-SIJobSizingCountHalves).
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [hashtable]$Counts)
|    if (-not $Counts) { return $false }
|    $n = { param($k) $v = 0L; if ($Counts.ContainsKey($k) -and $null -ne $Counts[$k]) { [void][long]::TryParse("$($Counts[$k])", [ref]$v) }; $v }
|    foreach ($h in @(Get-SIJobSizingCountHalves -Engine $Engine)) {
|        if ($h -eq 'Identity' -and (& $n 'Users') -le 0) { return $false }
|        if ($h -eq 'Devices' -and (& $n 'Devices') -le 0) { return $false }
|    }
|    $true
|}
|
|function Get-SIJobSizingUnknownReason {
|    <# PURE. The plain words for a job sized for a large tenant because its count could not be read. #>
|    'the tenant''s size could not be read -- sized for a large tenant'
|}
|
|function Get-SIJobSizeChange {
|    <#
|        PURE. What to do with ONE job. -Current: Get-SIJobCurrentSize. -Counts: the tenant's counts (Users, Groups,
|        ServicePrincipals, Devices; $null = not known -- a job whose count is not known, Test-SIJobSizingCountKnown, gets
|        4 CPU / 8 GiB) and -CountsFrom (the words for the log). -Failure:
|        Get-SIJobFailureSignal. -Globals: the customer's settings (SI_Bootstrap_Cpu_ / _Memory_<Engine>).
|        -NoResize: a job whose CPU and memory this sizing does not cover (a step of the pipeline that is no sized job).
|        CPU AND MEMORY ONLY. The run limit is never changed here: every engine job has the one value the update's floor
|        step gives it (Invoke-SIJobFloor); ReplicaTimeout in the answer is the job's own, as it is.
|        Returns @{ Action = raise | keep; Cpu; Memory; ReplicaTimeout; Level; Reasons; Notes; Line }. Never lowers; never above
|        4 CPU / 8 GiB; a size the customer set wins.
|    #>
|    param([Parameter(Mandatory)][string]$JobName, [Parameter(Mandatory)][string]$Engine, [Parameter(Mandatory)]$Current,
|          [hashtable]$Counts, [string]$CountsFrom = 'the tenant', $Failure, [hashtable]$Globals = @{}, [switch]$NoResize)
|    $sfx = Get-SIEngineSettingSuffix -Engine $Engine
|    $gv = { param($n) if ($Globals -and $Globals.ContainsKey($n) -and -not [string]::IsNullOrWhiteSpace([string]$Globals[$n])) { "$($Globals[$n])".Trim() } else { $null } }
|    $custRes = @(@(('SI_Bootstrap_Cpu_{0}' -f $sfx), ('SI_Bootstrap_Memory_{0}' -f $sfx)) | Where-Object { & $gv $_ })
|    $curLevel = Get-SIJobSizeLevel -MemoryGi $Current.MemoryGi
|    $curTo = [int]$Current.ReplicaTimeout
|    $wantLevel = $curLevel
|    $reasons = New-Object System.Collections.Generic.List[string]
|    $notes = New-Object System.Collections.Generic.List[string]
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    # 1. the tenant's size (the rule setup applies at install)
|    # A COUNT THAT IS NOT KNOWN sizes the job for a large tenant (owner 2026-10-16: reliability over cost, "we can always
|    # lower it later"; live: customer I's 153,000 users ran every sized job on 2 CPU / 4 GiB, and at two more installs the
|    # identity job alone, because no count could be read). Not known = no counts at all, or the half this job counts
|    # (identity objects / devices; both for a job that reads every object) missing or 0 (Test-SIJobSizingCountKnown).
|    if (-not $NoResize -and -not (Test-SIJobSizingCountKnown -Engine $Engine -Counts $Counts)) {
|        if ($script:SIJobSizeMaxLevel -gt $wantLevel) { $wantLevel = $script:SIJobSizeMaxLevel; $reasons.Add((Get-SIJobSizingUnknownReason)) }
|    } elseif ($Counts -and -not $NoResize) {
|        $sized = Get-SITenantSizedJobResources -Engine $Engine -Counts $Counts
|        if ($sized) {
|            $lvl = Get-SIJobSizeLevel -MemoryGi (ConvertTo-SIJobMemoryGi $sized.Memory)
|            if ($lvl -gt $wantLevel) { $wantLevel = $lvl; $reasons.Add(('{0} objects (from {1})' -f ([long]$sized.Objects).ToString('N0', $inv), $CountsFrom)) }
|        }
|    }
|    # 2. learn from the last run (out of memory, or stopped at its run limit): one band up, even when the counts do not ask for it
|    if ($Failure -and -not $NoResize) {
|        $fl = [Math]::Min($script:SIJobSizeMaxLevel, $curLevel + 1)
|        if ($fl -gt $wantLevel) { $wantLevel = $fl; $reasons.Add([string]$Failure.Reason) }
|        elseif ($fl -gt $curLevel) { $reasons.Add([string]$Failure.Reason) }   # the failure is a reason for the raise too
|        elseif ($curLevel -ge $script:SIJobSizeMaxLevel -and $Failure.Kind -eq 'oom') {
|            $notes.Add(('{0}, but it is already at the largest CPU and memory Container Apps gives a job (4 CPU / 8 GiB) -- it needs the work split (queue scaling), not a bigger job' -f $Failure.Reason))
|        }
|    }
|    # 3. the CPU / memory cap (the platform's largest pair), and a size the customer set wins
|    if ($wantLevel -gt $script:SIJobSizeMaxLevel) { $wantLevel = $script:SIJobSizeMaxLevel }
|    if ($custRes.Count -and $wantLevel -gt $curLevel) { $notes.Add(('{0} would get {1}, but {2} is set -- the customer''s size is kept' -f $JobName, $script:SIJobSizeBands[$wantLevel].Text, ($custRes -join ' / '))); $wantLevel = $curLevel }
|    $raiseRes = $wantLevel -gt $curLevel
|    $cpu = if ($raiseRes) { $script:SIJobSizeBands[$wantLevel].Cpu } else { $Current.Cpu.ToString('0.0#', $inv) }
|    $mem = if ($raiseRes) { $script:SIJobSizeBands[$wantLevel].Memory } else { [string]$Current.Memory }
|    $to = $curTo
|    if (-not $raiseRes) {
|        return [pscustomobject]@{ Action = 'keep'; Cpu = $cpu; Memory = $mem; ReplicaTimeout = $to; Level = $curLevel; Reasons = @(); Notes = $notes.ToArray(); Line = '' }
|    }
|    $fromTxt = '{0} CPU / {1}, {2}' -f $Current.Cpu.ToString('0.0#', $inv), $Current.Memory, (Format-SIJobTimeout -Seconds $curTo)
|    $toTxt = '{0} CPU / {1}, {2}' -f $cpu, $mem, (Format-SIJobTimeout -Seconds $to)
|    $line = 'job size: {0} raised {1} -> {2} -- {3}' -f $JobName, $fromTxt, $toTxt, ($reasons -join '; ')
|    [pscustomobject]@{ Action = 'raise'; Cpu = $cpu; Memory = $mem; ReplicaTimeout = $to; Level = $wantLevel; Reasons = $reasons.ToArray(); Notes = $notes.ToArray(); Line = $line }
|}
|
|function Get-SIJobSizingCountsFromCiRecords {
|    <#
|        PURE. The tenant's counts from the records the last collection wrote (sidata.CiRecord grouped by Provider,
|        RecordType -> Records): Users / Groups / ServicePrincipals from Entra, Devices = the largest device count of any
|        provider (Entra, Defender, Intune and AD each see the same devices). $null when nothing was recorded.
|    #>
|    param([object[]]$Rows = @())
|    $c = @{ Users = 0L; Groups = 0L; ServicePrincipals = 0L; Devices = 0L }; $any = $false
|    foreach ($r in @($Rows)) {
|        if (-not $r) { continue }
|        $n = 0L; if (-not [long]::TryParse("$($r.Records)", [ref]$n) -or $n -le 0) { continue }
|        $prov = "$($r.Provider)".ToLowerInvariant(); $type = "$($r.RecordType)".ToLowerInvariant()
|        switch ($type) {
|            'user' { if ($prov -eq 'entra') { $c.Users += $n; $any = $true } }
|            'group' { if ($prov -eq 'entra') { $c.Groups += $n; $any = $true } }
|            'service_principal' { if ($prov -eq 'entra') { $c.ServicePrincipals += $n; $any = $true } }
|            'device' { if ($n -gt $c.Devices) { $c.Devices = $n }; $any = $true }
|        }
|    }
|    if ($any) { $c } else { $null }
|}
|
|function Get-SIJobSizingCountsFromRunHealth {
|    <#
|        PURE. The tenant's counts from the engines' own run health (Engine, Assets = the largest run of the last 7 days):
|        the identity engine's assets stand for its users + groups + service principals, the endpoint engine's for the
|        devices. $null when neither engine recorded a run.
|    #>
|    param([object[]]$Rows = @())
|    $id = 0L; $ep = 0L
|    foreach ($r in @($Rows)) {
|        if (-not $r) { continue }
|        $n = 0L; if (-not [long]::TryParse("$($r.Assets)", [ref]$n) -or $n -le 0) { continue }
|        $e = "$($r.Engine)".ToLowerInvariant()
|        if ($e -match 'identity' -and $n -gt $id) { $id = $n }
|        elseif ($e -match 'endpoint' -and $n -gt $ep) { $ep = $n }
|    }
|    if (-not $id -and -not $ep) { return $null }
|    @{ Users = $id; Groups = 0L; ServicePrincipals = 0L; Devices = $ep }
|}
|
|function Get-SIJobSizingCountsFromTenantMark {
|    <#
|        PURE. The tenant's counts the collections recorded (cfg.InstallState 'TenantSize', engine\_shared\SI-TenantSizeMark.ps1:
|        the identity / endpoint collection's own Microsoft Graph counts, read with the collection's directory rights) from
|        the rows of $script:SIJobSizingTenantMarkSql (one row, Value). @{ Users; Groups; ServicePrincipals; Devices } or $null.
|    #>
|    param([object[]]$Rows = @())
|    foreach ($r in @($Rows)) {
|        if (-not $r) { continue }
|        $v = if ($r -is [System.Collections.IDictionary]) { $r['Value'] } else { $r.Value }
|        if ($null -eq $v -or $v -is [System.DBNull]) { continue }
|        if (-not (Get-Command -Name ConvertFrom-SITenantSizeMark -ErrorAction SilentlyContinue)) { return $null }
|        $m = ConvertFrom-SITenantSizeMark -Value ([string]$v)
|        if ($m) { return @{ Users = [long]$m.Users; Groups = [long]$m.Groups; ServicePrincipals = [long]$m.ServicePrincipals; Devices = [long]$m.Devices } }
|    }
|    $null
|}
|
|function Resolve-SIJobSizingCounts {
|    <#
|        PURE. The tenant's counts and where they came from: @{ Counts; From }.
|        Microsoft Graph, read now, is the whole answer when it can be read. Otherwise each half is taken from the first
|        source that HAS it (#720, live 2026-10-16: the identity collection had written 0 users while the endpoint's records
|        were there -- the rule read 0 users and kept the identity job small): the identity half (users, groups, service
|        principals) from the first source with users, the devices from the first with devices, in the order: the directory
|        counts the collections recorded (-Collected: cfg.InstallState 'TenantSize' -- Microsoft Graph's own counts, read by
|        the identity / endpoint collection with ITS directory rights, so the updater needs none), the records the last
|        collection wrote (sidata.CiRecord), the counts setup read from Microsoft Graph at install (the job tags, -Install),
|        the engines' run health. A 0 is "not known", never "none". Neither half anywhere: Counts = $null.
|    #>
|    param([hashtable]$Graph, [hashtable]$CiRecords, [hashtable]$RunHealth, [hashtable]$Install, [hashtable]$Collected)
|    if ($Graph) { return [pscustomobject]@{ Counts = $Graph; From = 'the directory (Microsoft Graph)' } }
|    $srcs = @(
|        [pscustomobject]@{ C = $Collected; From = 'the directory counts the collections recorded (cfg.InstallState TenantSize)' },
|        [pscustomobject]@{ C = $CiRecords; From = 'the records the last collection wrote (sidata.CiRecord)' },
|        [pscustomobject]@{ C = $Install; From = 'the directory counts setup read at install (the jobs'' si-tenant-* tags)' },
|        [pscustomobject]@{ C = $RunHealth; From = 'the engines'' run health (SI_RunHealth_CL, last 7 days)' })
|    $n = { param($h, $k) $v = 0L; if ($h -and $h.ContainsKey($k)) { [void][long]::TryParse("$($h[$k])", [ref]$v) }; $v }
|    $id = @($srcs | Where-Object { $_.C -and (& $n $_.C 'Users') -gt 0 }) | Select-Object -First 1
|    $dv = @($srcs | Where-Object { $_.C -and (& $n $_.C 'Devices') -gt 0 }) | Select-Object -First 1
|    if (-not $id -and -not $dv) {
|        # nothing with users or devices: a source that carries only groups / service principals still counts (as before)
|        $any = @($srcs | Where-Object { $_.C }) | Select-Object -First 1
|        if ($any) { return [pscustomobject]@{ Counts = $any.C; From = $any.From } }
|        return [pscustomobject]@{ Counts = $null; From = '' }
|    }
|    $c = @{ Users = 0L; Groups = 0L; ServicePrincipals = 0L; Devices = 0L }
|    if ($id) { $c.Users = & $n $id.C 'Users'; $c.Groups = & $n $id.C 'Groups'; $c.ServicePrincipals = & $n $id.C 'ServicePrincipals' }
|    if ($dv) { $c.Devices = & $n $dv.C 'Devices' }
|    $from = if ($id -and $dv -and $id.From -ne $dv.From) { 'users / groups / service principals from {0}; devices from {1}' -f $id.From, $dv.From }
|            elseif ($id) { $id.From } else { $dv.From }
|    [pscustomobject]@{ Counts = $c; From = $from }
|}
|
|function New-SIJobSizePatchBody {
|    <#
|        PURE. The ARM PATCH body that resizes a job (-Job: ARM shape, as just read), what `az containerapp job update --cpu
|        --memory --replica-timeout [--set-env-vars]` did: { properties: { template: <the job's WHOLE template, the first
|        container's resources.cpu / memory set, -SetEnv upserted into its env>, configuration: <only when -ReplicaTimeout
|        differs: triggerType, replicaTimeout, replicaRetryLimit and the trigger's own config as read> } }. Never the secrets or
|        registries (ARM returns secrets without values). The default imageType and the read-only ephemeralStorage are left
|        out (the live 400 of 2026-10-06). Returns the JSON text; the input is not changed.
|    #>
|    # -ReplicaRetryLimit (export hotfix 2026-10-16): 0 or more = the job's retry limit set to it (the configuration is then
|    # sent, its run limit as it is unless -ReplicaTimeout changes it); -1 (the default) = left as read.
|    param([Parameter(Mandatory)]$Job, [Parameter(Mandatory)][string]$Cpu, [Parameter(Mandatory)][string]$Memory, [int]$ReplicaTimeout = 0, [hashtable]$SetEnv = @{}, [int]$ReplicaRetryLimit = -1)
|    $tpl = ConvertTo-Json -InputObject $Job.properties.template -Depth 60 | ConvertFrom-Json
|    $first = @($tpl.containers | Where-Object { $_ }) | Select-Object -First 1
|    if (-not $first) { throw 'the job has no container to size' }
|    $cpuNum = 0.0; [void][double]::TryParse($Cpu, [Globalization.NumberStyles]::Float, [Globalization.CultureInfo]::InvariantCulture, [ref]$cpuNum)
|    if (-not $first.PSObject.Properties['resources'] -or -not $first.resources) { $first | Add-Member -NotePropertyName resources -NotePropertyValue ([pscustomobject]@{}) -Force }
|    $first.resources | Add-Member -NotePropertyName cpu -NotePropertyValue $cpuNum -Force
|    $first.resources | Add-Member -NotePropertyName memory -NotePropertyValue $Memory -Force
|    if ($SetEnv.Count) {
|        $envList = New-Object System.Collections.Generic.List[object]
|        foreach ($e in @($first.env)) { if ($e -and -not $SetEnv.ContainsKey([string]$e.name)) { $envList.Add($e) } }
|        foreach ($k in @($SetEnv.Keys | Sort-Object)) { $envList.Add([pscustomobject]@{ name = [string]$k; value = [string]$SetEnv[$k] }) }
|        $first | Add-Member -NotePropertyName env -NotePropertyValue $envList.ToArray() -Force
|    }
|    foreach ($c in (@($tpl.containers) + @($tpl.initContainers))) {
|        if (-not $c) { continue }
|        if ($c.PSObject.Properties['imageType'] -and ([string]$c.imageType -in '', 'ContainerImage')) { $c.PSObject.Properties.Remove('imageType') }
|        if ($c.PSObject.Properties['resources'] -and $c.resources -and $c.resources.PSObject.Properties['ephemeralStorage']) { $c.resources.PSObject.Properties.Remove('ephemeralStorage') }
|    }
|    $props = [ordered]@{ template = $tpl }
|    $cfg = $Job.properties.configuration
|    $toChange = ($ReplicaTimeout -gt 0 -and $cfg -and [int]"$($cfg.replicaTimeout)" -ne $ReplicaTimeout)
|    $retryChange = ($ReplicaRetryLimit -ge 0 -and $cfg -and -not ($cfg.PSObject.Properties['replicaRetryLimit'] -and "$($cfg.replicaRetryLimit)" -ne '' -and [int]"$($cfg.replicaRetryLimit)" -eq $ReplicaRetryLimit))
|    if ($toChange -or $retryChange) {
|        $c2 = [ordered]@{ triggerType = [string]$cfg.triggerType; replicaTimeout = $(if ($toChange) { $ReplicaTimeout } else { [int]"$($cfg.replicaTimeout)" }) }
|        if ($retryChange) { $c2.replicaRetryLimit = $ReplicaRetryLimit }
|        elseif ($cfg.PSObject.Properties['replicaRetryLimit'] -and $null -ne $cfg.replicaRetryLimit) { $c2.replicaRetryLimit = $cfg.replicaRetryLimit }
|        foreach ($k in 'scheduleTriggerConfig', 'manualTriggerConfig', 'eventTriggerConfig') { if ($cfg.PSObject.Properties[$k] -and $cfg.$k) { $c2[$k] = $cfg.$k } }
|        $props.configuration = $c2
|    }
|    ConvertTo-Json -InputObject ([ordered]@{ properties = $props }) -Depth 60 -Compress
|}
|
|function ConvertFrom-SILaQueryAnswer {
|    <# PURE. A Log Analytics query answer ({ tables: [ { columns: [ { name } ], rows: [ [..] ] } ] }) -> objects. #>
|    param([AllowNull()]$Answer)
|    if (-not $Answer -or -not $Answer.PSObject.Properties['tables']) { return @() }
|    $t = @($Answer.tables)[0]; if (-not $t) { return @() }
|    $cols = @($t.columns | ForEach-Object { [string]$_.name })
|    foreach ($row in @($t.rows)) {
|        $o = [ordered]@{}; $vals = @($row)
|        for ($i = 0; $i -lt $cols.Count; $i++) { $o[$cols[$i]] = $(if ($i -lt $vals.Count) { $vals[$i] } else { $null }) }
|        [pscustomobject]$o
|    }
|}
|
|function Get-SIJobSizingKql {
|    <# PURE. The three Log Analytics reads: RunHealthCounts | RunHealthRows | SystemLogs. #>
|    param([Parameter(Mandatory)][ValidateSet('RunHealthCounts', 'RunHealthRows', 'SystemLogs')][string]$Kind)
|    switch ($Kind) {
|        'RunHealthCounts' { "SI_RunHealth_CL | where TimeGenerated > ago(7d) | extend Eng = tostring(column_ifexists('Engine', '')), Ph = tostring(column_ifexists('Phase', '')), Rid = tostring(column_ifexists('RunId', '')), Ac = toint(column_ifexists('AssetCount', int(-1))) | where Ph == 'End' and Ac > 0 | summarize A = sum(Ac) by Eng, Rid | summarize Assets = max(A) by Engine = Eng" }
|        'RunHealthRows' { "SI_RunHealth_CL | where TimeGenerated > ago(3d) | project TimeGenerated, Engine = tostring(column_ifexists('Engine', '')), Phase = tostring(column_ifexists('Phase', '')), ExitReason = tostring(column_ifexists('ExitReason', '')), ErrorMessage = tostring(column_ifexists('ErrorMessage', '')), Execution = tostring(column_ifexists('Execution', '')) | where Phase in ('Start', 'End') | take 20000" }
|        'SystemLogs' { "union isfuzzy=true ContainerAppSystemLogs_CL, ContainerAppSystemLogs | where TimeGenerated > ago(3d) | extend Job = coalesce(tostring(column_ifexists('JobName_s', '')), tostring(column_ifexists('JobName', ''))), Exec = coalesce(tostring(column_ifexists('ExecutionName_s', '')), tostring(column_ifexists('ExecutionName', ''))), Reason = coalesce(tostring(column_ifexists('Reason_s', '')), tostring(column_ifexists('Reason', ''))), Msg = coalesce(tostring(column_ifexists('Log_s', '')), tostring(column_ifexists('Log', ''))) | where Reason has 'OOMKilled' or Msg has 'OOMKilled' or Msg contains 'exit code 137' or Msg contains `"exit code '137'`" | project TimeGenerated, Job, Exec, Reason, Msg | take 500" }
|    }
|}
|
|# the directory counts the identity / endpoint collections recorded (engine\_shared\SI-TenantSizeMark.ps1) -- in the Pro
|# (settings) database the updater already reads; no directory right needed
|$script:SIJobSizingTenantMarkSql = @'
|IF OBJECT_ID('cfg.InstallState') IS NOT NULL
|    SELECT Value FROM cfg.InstallState WHERE Name = N'TenantSize';
|ELSE
|    SELECT CAST(NULL AS NVARCHAR(400)) AS Value WHERE 1 = 0;
|'@
|
|$script:SIJobSizingCiRecordSql = @'
|IF OBJECT_ID('sidata.CiRecord') IS NOT NULL
|    SELECT Provider, RecordType, COUNT_BIG(*) AS Records FROM sidata.CiRecord GROUP BY Provider, RecordType;
|ELSE
|    SELECT CAST(NULL AS NVARCHAR(32)) AS Provider, CAST(NULL AS NVARCHAR(32)) AS RecordType, CAST(0 AS BIGINT) AS Records WHERE 1 = 0;
|'@
|
|function Invoke-SIJobSizePatch {
|    <#
|        THE ONE WRITE of a job's size and run limit: the job read at the PATCH's own api-version, then ONE read-modify-write
|        PATCH (New-SIJobSizePatchBody) with -Cpu / -Memory (neither given = as the job has them) and -ReplicaTimeout; a KEDA
|        worker (-Worker) whose run limit grows gets its queue lease with it (limit + 300 s, at most 7 days).
|        A RUN LIMIT ABOVE 24 HOURS THAT AZURE REFUSES (Test-SIRunLimitRefusal) is sent ONCE MORE as 24 hours with the same
|        CPU and memory -- so a size raise is never lost -- and when that is accepted the refusal is remembered for the run
|        (Set-SIRunLimitRefused: the next jobs ask for 24 hours at once) and said in one line. -CurrentReplicaTimeout: the
|        job's run limit before the change. Returns @{ Ok; Why; ReplicaTimeout (what the job now has asked for); Lines }.
|        Never throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$JobUri, [Parameter(Mandatory)][string]$JobName,
|          [string]$Cpu, [string]$Memory, [Parameter(Mandatory)][int]$ReplicaTimeout, [int]$CurrentReplicaTimeout = 0, [switch]$Worker)
|    $lines = New-Object System.Collections.Generic.List[string]
|    $known = [int](Get-SIAzureKnownRunLimit)
|    $to = [int](Get-SIRunLimitToSend -ReplicaTimeout $ReplicaTimeout)
|    $why = ''
|    try {
|        $now = Invoke-SIRestJson -Rest $Rest -Uri $JobUri -What ('the job {0}' -f $JobName)
|        # NEVER LOWERS: the job as it is NOW may have a longer run limit than the caller knew (the list an update read
|        # before another step raised it) -- then that one is kept, and a KEDA worker's lease is not touched
|        $haveNow = [int](Get-SIJobCurrentSize -Job $now).ReplicaTimeout
|        if ($haveNow -gt $to) { $to = $haveNow }
|        if ($haveNow -gt $CurrentReplicaTimeout) { $CurrentReplicaTimeout = $haveNow }
|        if (-not $Cpu -or -not $Memory) {
|            $size = Get-SIJobCurrentSize -Job $now
|            if ($size.Cpu -le 0 -or -not $size.Memory) { throw 'its CPU and memory could not be read' }
|            $Cpu = $size.Cpu.ToString('0.0#', [Globalization.CultureInfo]::InvariantCulture); $Memory = [string]$size.Memory
|        }
|        $send = {
|            param([int]$Seconds)
|            $setEnv = @{}
|            if ($Worker -and $Seconds -gt $CurrentReplicaTimeout -and $Seconds -gt 3600) { $setEnv['SI_QUEUE_LEASE_SECONDS'] = [string]([Math]::Min(604800, $Seconds + 300)) }
|            & $Rest 'PATCH' $JobUri (New-SIJobSizePatchBody -Job $now -Cpu $Cpu -Memory $Memory -ReplicaTimeout $Seconds -SetEnv $setEnv) 'https://management.azure.com/' @{ 'Content-Type' = 'application/json' }
|        }
|        $ok = { param($x) [bool]($x -and [int]$x.Status -ge 200 -and [int]$x.Status -lt 300) }
|        $r = & $send $to
|        if (-not (& $ok $r)) {
|            $why = Format-SIRestFailure -Response $r
|            $status = 0; try { $status = [int]$r.Status } catch { }
|            # only a job that is not above 24 hours already can have been refused for it
|            if ($CurrentReplicaTimeout -le $known -and (Test-SIRunLimitRefusal -ReplicaTimeout $to -Status $status -Text ([string]$r.Body))) {
|                $r2 = & $send $known
|                if (& $ok $r2) {
|                    Set-SIRunLimitRefused
|                    $lines.Add((Get-SIRunLimitRefusedLine -Job $JobName -ReplicaTimeout $to))
|                    $to = $known; $why = ''
|                }
|            }
|        }
|    } catch { $why = $_.Exception.Message }
|    if ($why) { $why = ("$why" -replace '\s+', ' ').Trim(); if ($why.Length -gt 300) { $why = $why.Substring(0, 297) + '...' } }
|    [pscustomobject]@{ Ok = (-not $why); Why = $why; ReplicaTimeout = $to; Lines = $lines.ToArray() }
|}
|
|function Invoke-SIJobRunLimitHeal {
|    <#
|        SELF-HEALING IN THE SAME RUN (owner 2026-10-12: "si must self heal with limits"). The pipeline found that -JobName
|        was stopped at its own run limit (-HitLimitSeconds) -- a job an update has not yet given the longest run limit
|        Azure takes (Get-SIJobRunLimit). It gets that limit NOW, by the same value and the same write as the update's floor
|        step -- Invoke-SIJobSizePatch (24 hours when Azure refuses a longer limit; a KEDA worker's queue lease in step) -- so
|        the pipeline can start the step again in the same run. Only the run limit changes here, never CPU or memory.
|        NO RAISE, NO RESTART: the customer's own SI_Bootstrap_ReplicaTimeout_<Engine> (-Globals) is kept; the job has the
|        longest limit already; Azure took no longer limit; or this identity may not change the job (the reason says which right).
|        The job's limit is ALREADY longer than the one that stopped the run (an update raised it meanwhile): nothing is
|        written and the step may start again.
|        Returns @{ Restart; Raised; OldSeconds; NewSeconds; Why; Lines }. Never throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [Parameter(Mandatory)][string]$JobName, [Parameter(Mandatory)][int]$HitLimitSeconds, [hashtable]$Globals = @{}, [object[]]$Steps)
|    $no = { param($why, $old) [pscustomobject]@{ Restart = $false; Raised = $false; OldSeconds = [int]$old; NewSeconds = [int]$old; Why = [string]$why; Lines = @() } }
|    try {
|        if (-not $PSBoundParameters.ContainsKey('Steps')) { $Steps = @(Get-SIJobSizingStepKeys) }
|        $jobUri = 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs/{2}?api-version={3}' -f $SubscriptionId, $ResourceGroup, $JobName, $script:SIJobSizePatchApi
|        $job = Invoke-SIRestJson -Rest $Rest -Uri $jobUri -What ('the job {0}' -f $JobName)
|        $cur = Get-SIJobCurrentSize -Job $job
|        if ($cur.ReplicaTimeout -gt $HitLimitSeconds) {
|            return [pscustomobject]@{ Restart = $true; Raised = $false; OldSeconds = $HitLimitSeconds; NewSeconds = [int]$cur.ReplicaTimeout; Why = ''; Lines = @() }
|        }
|        $e = Get-SIJobRunLimitJob -JobName $JobName -Steps $Steps
|        $engine = if ($e) { [string]$e.Engine } else { ($JobName -replace '^(?i)caj-si-', '') -replace '-(producer|worker)$', '' }
|        $limit = [int](Get-SIJobRunLimit)
|        $own = Get-SIJobRunLimitSetting -Engines (@($engine) + $(if ($e) { @($e.Names) } else { @() })) -Globals $Globals
|        if ($own) { return (& $no ('{0} would run for up to {1}, but {2} is set -- the customer''s run time is kept' -f $JobName, (Format-SIJobTimeout -Seconds $limit), $own) $cur.ReplicaTimeout) }
|        if ($cur.ReplicaTimeout -ge $limit) { return (& $no ('{0} is the longest run limit Azure takes for a job -- the job cannot be given more time' -f (Format-SIJobTimeout -Seconds $limit)) $cur.ReplicaTimeout) }
|        $p = Invoke-SIJobSizePatch -Rest $Rest -JobUri $jobUri -JobName $JobName -ReplicaTimeout $limit -CurrentReplicaTimeout $cur.ReplicaTimeout -Worker:([bool]($e -and $e.Role -eq 'worker'))
|        if (-not $p.Ok) {
|            return (& $no ('the pipeline could not change the job ({0}) -- its identity needs the right to change Container Apps jobs (the role "Container Apps Jobs Contributor" on the jobs'' resource group); the next update raises the limit' -f $p.Why) $cur.ReplicaTimeout)
|        }
|        if ($p.ReplicaTimeout -le $cur.ReplicaTimeout) {
|            return [pscustomobject]@{ Restart = $false; Raised = $false; OldSeconds = [int]$cur.ReplicaTimeout; NewSeconds = [int]$cur.ReplicaTimeout; Lines = @($p.Lines)
|                                      Why = ('Azure did not accept a run limit longer than {0} for this job' -f (Format-SIJobTimeout -Seconds $cur.ReplicaTimeout)) }
|        }
|        [pscustomobject]@{ Restart = $true; Raised = $true; OldSeconds = [int]$cur.ReplicaTimeout; NewSeconds = [int]$p.ReplicaTimeout; Why = ''; Lines = @($p.Lines) }
|    } catch { & $no ('the job''s run limit could not be raised ({0})' -f $_.Exception.Message) 0 }
|}
|
|function Get-SIJobFloorChange {
|    <#
|        PURE. THE FLOOR every engine job is raised to on every update, for ONE job (-Job: ARM shape; -AllJobs: every job of
|        the install): at least 2 CPU / 4 GiB -- a queue producer also at least its engine's single job (caj-si-<engine>) --
|        and THE RUN LIMIT every engine job gets (Get-SIJobRunLimit, the longest Azure takes).
|        The run limit is LEFT AS IT IS for the pipeline job (caj-si-flow: its own rule, Invoke-SIFlowJobRunLimit), for the
|        hourly status report (caj-si-heartbeat, #718: 30 minutes, Get-SIHeartbeatJobRunLimit) and for a
|        job whose run limit the customer set (SI_Bootstrap_ReplicaTimeout_<Engine> in -Globals; -Steps gives the engine's
|        other name). Never lowers anything.
|        Returns @{ Job; Action = raise | keep; Cpu; Memory; ReplicaTimeout; Was; Reasons; Line (the keep line) }.
|    #>
|    param([Parameter(Mandatory)]$Job, [object[]]$AllJobs = @(), [hashtable]$Globals = @{}, [object[]]$Steps = @())
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $name = [string]$Job.name
|    $cur = Get-SIJobCurrentSize -Job $Job
|    $was = '{0} CPU / {1}, {2}' -f $cur.Cpu.ToString('0.0#', $inv), $cur.Memory, (Format-SIJobTimeout -Seconds $cur.ReplicaTimeout)
|    $fCpu = 2.0; $fMem = 4.0
|    # OPEN-27 (owner 2026-11-04: "heavy jobs start 4/8"; 2026-11-04 night at a large private install whose every job ran
|    # 2 CPU / 4 GiB: "you should size bigger. that is too small"): the HEAVY jobs -- the collections, correlation, Risk
|    # Analysis and its workers, the data sync, vulnerabilities -- are raised to at least 4 CPU / 8 GiB on every update; the
|    # light ones (runner, heartbeat, mail, support, ...) keep 2 CPU / 4 GiB. Never lowers a job.
|    $heavy = ($null -ne (Get-SIJobSizingEngine -JobName $name)) -or ($name -match '(?i)^caj-si-raworker-')
|    if ($heavy) { $fCpu = 4.0; $fMem = 8.0 }
|    if ($name -like '*-producer') {
|        $single = @(@($AllJobs) | Where-Object { $_ -and [string]$_.name -eq ($name -replace '-producer$', '') }) | Select-Object -First 1
|        if ($single) { $s = Get-SIJobCurrentSize -Job $single; $fCpu = [Math]::Max($fCpu, [double]$s.Cpu); $fMem = [Math]::Max($fMem, [double]$s.MemoryGi) }
|    }
|    $reasons = New-Object System.Collections.Generic.List[string]
|    $nCpu = [Math]::Max([double]$cur.Cpu, $fCpu); $nMem = [Math]::Max([double]$cur.MemoryGi, $fMem)
|    $sizeUp = ($cur.Cpu -lt $fCpu -or $cur.MemoryGi -lt $fMem)
|    if ($sizeUp) {
|        if ($nMem -lt 2 * $nCpu) { $nMem = 2 * $nCpu }   # a consumption pair: memory = 2 x CPU
|        $reasons.Add($(if ($heavy) { 'a heavy job runs with at least 4 CPU / 8 GiB' } else { 'every job runs with at least 2 CPU / 4 GiB' }))
|    }
|    # the run limit
|    $limit = [int](Get-SIJobRunLimit); $nTo = [int]$cur.ReplicaTimeout; $kept = ''
|    # #718: the hourly status report (caj-si-heartbeat) keeps its own short run limit (Get-SIHeartbeatJobRunLimit) -- a
|    # 7-day limit would let one hung tick keep every later hour from reporting
|    # (the users' sign-in methods read in the background, caj-si-signin-methods, keeps the same short limit: a run reads for its slice)
|    if ($name -notin @('caj-si-flow', 'caj-si-heartbeat', 'caj-si-signin-methods') -and $cur.ReplicaTimeout -lt $limit) {
|        $key = (($name -replace '^(?i)caj-si-', '') -replace '-(producer|worker)$', '').ToLowerInvariant()
|        $names = @($key); $step = @(@($Steps) | Where-Object { $_ -and [string]$_.Key -eq $key }) | Select-Object -First 1
|        if ($step -and $step.Engine -and [string]$step.Engine -ne $key) { $names += [string]$step.Engine }
|        $own = Get-SIJobRunLimitSetting -Engines $names -Globals $Globals
|        if ($own) { $kept = ' (its run limit is the customer''s own, {0} -- kept)' -f $own }
|        else { $nTo = $limit; $reasons.Add((Get-SIJobRunLimitReason)) }
|    }
|    $cpuText = if ($sizeUp) { $nCpu.ToString('0.0#', $inv) } else { $cur.Cpu.ToString('0.0#', $inv) }
|    $memText = if ($sizeUp) { '{0}Gi' -f $nMem.ToString($inv) } else { [string]$cur.Memory }
|    $action = if ($sizeUp -or $nTo -gt $cur.ReplicaTimeout) { 'raise' } else { 'keep' }
|    [pscustomobject]@{ Job = $name; Action = $action; Cpu = $cpuText; Memory = $memText; ReplicaTimeout = $nTo; SizeUp = [bool]$sizeUp; Was = $was; Reasons = $reasons.ToArray()
|                       Line = ('job size: {0} runs {1}{2} -- nothing to raise' -f $name, $was, $kept) }
|}
|
|function Invoke-SIJobFloor {
|    <#
|        EVERY UPDATE, EVERY ENGINE JOB (every caj-si-* job of -Jobs but the updater, -UpdaterName): raised to the floor
|        (Get-SIJobFloorChange) -- at least 2 CPU / 4 GiB and the run limit every engine job gets, the longest Azure takes --
|        by ONE read-modify-write PATCH per job (Invoke-SIJobSizePatch: 24 hours when Azure refuses a longer run limit, said
|        in one line; a KEDA worker's queue lease in step). It needs no run history and no count: a job that never finished
|        a run is raised like any other. Raises only. -WhatIf: the plan only.
|        ONE LINE PER JOB: "... runs 4 CPU / 8Gi, 7 days -- nothing to raise" or "... raised 2 CPU / 4Gi, 2 h -> 2 CPU /
|        4Gi, 7 days -- <why>". Returns @{ Results = @(@{ Job; Action = raised | keep | would-raise | failed; Line }); Lines }.
|        Never throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [object[]]$Jobs = @(), [string]$UpdaterName = '', [hashtable]$Globals = @{}, [switch]$WhatIf, [object[]]$Steps)
|    $results = New-Object System.Collections.Generic.List[object]
|    $lines = New-Object System.Collections.Generic.List[string]
|    if (-not $PSBoundParameters.ContainsKey('Steps')) { $Steps = @(Get-SIJobSizingStepKeys) }
|    $mine = @(@($Jobs) | Where-Object { $_ -and [string]$_.name -like 'caj-si-*' -and [string]$_.name -ne 'caj-si-updater' -and (-not $UpdaterName -or [string]$_.name -ne $UpdaterName) })
|    $add = { param($job, $action, $line) $results.Add([pscustomobject]@{ Job = $job; Action = $action; Line = $line }); $lines.Add($line) }
|    foreach ($j in $mine) {
|        $name = [string]$j.name
|        try {
|            $ch = Get-SIJobFloorChange -Job $j -AllJobs $Jobs -Globals $Globals -Steps $Steps
|            $cur = Get-SIJobCurrentSize -Job $j
|            $text = { param([int]$Seconds) 'job size: {0} raised {1} -> {2} CPU / {3}, {4} -- {5}' -f $name, $ch.Was, $ch.Cpu, $ch.Memory, (Format-SIJobTimeout -Seconds $Seconds), ($ch.Reasons -join '; ') }
|            # the run limit as it is written: 24 hours instead of a longer one once Azure refused that in this run
|            $ask = [int](Get-SIRunLimitToSend -ReplicaTimeout $ch.ReplicaTimeout)
|            if ($ch.Action -eq 'keep' -or (-not $ch.SizeUp -and $ask -le $cur.ReplicaTimeout)) { & $add $name 'keep' $ch.Line; continue }
|            if ($WhatIf) { & $add $name 'would-raise' (((& $text ([Math]::Max($ask, $cur.ReplicaTimeout))) -replace ' raised ', ' would be raised ') + ' (re-run with -Apply)'); continue }
|            $jobUri = 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs/{2}?api-version={3}' -f $SubscriptionId, $ResourceGroup, $name, $script:SIJobSizePatchApi
|            $p = Invoke-SIJobSizePatch -Rest $Rest -JobUri $jobUri -JobName $name -Cpu $ch.Cpu -Memory $ch.Memory -ReplicaTimeout $ch.ReplicaTimeout -CurrentReplicaTimeout $cur.ReplicaTimeout -Worker:($name -like '*-worker')
|            foreach ($n in @($p.Lines)) { $lines.Add(('job size: {0}' -f $n)) }
|            if (-not $p.Ok) { & $add $name 'failed' ('job size: {0} was NOT raised ({1}): {2} -- the next update tries again' -f $name, ($ch.Reasons -join '; '), $p.Why); continue }
|            if (-not $ch.SizeUp -and $p.ReplicaTimeout -le $cur.ReplicaTimeout) { & $add $name 'keep' $ch.Line; continue }
|            & $add $name 'raised' (& $text ([Math]::Max([int]$p.ReplicaTimeout, $cur.ReplicaTimeout)))
|        } catch {
|            & $add $name 'failed' ('job size: {0} was not checked ({1}) -- the next update tries again' -f $name, $_.Exception.Message)
|        }
|    }
|    [pscustomobject]@{ Results = $results.ToArray(); Lines = $lines.ToArray() }
|}
|
|function Invoke-SIFlowJobRunLimit {
|    <#
|        EXISTING INSTALLS: the pipeline job (caj-si-flow, in -Jobs as the update read them) waits for every step inside its
|        own execution -- its run limit is raised to Get-SIFlowJobReplicaTimeout (7 days) by ONE read-modify-write PATCH (its
|        CPU and memory as they are). Raises only; SI_Bootstrap_ReplicaTimeout_Flow set by the customer: left alone; no such
|        job (an install made before the pipeline): nothing. -WhatIf: the plan only.
|        Returns @(@{ Job; Action = raised | would-raise | failed; Line }) -- empty when nothing is to do. Never throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [object[]]$Jobs = @(), [hashtable]$Globals = @{}, [switch]$WhatIf)
|    $name = 'caj-si-flow'
|    $flow = @(@($Jobs) | Where-Object { $_ -and [string]$_.name -eq $name }) | Select-Object -First 1
|    if (-not $flow) { return @() }
|    try {
|        if ($Globals -and $Globals.ContainsKey('SI_Bootstrap_ReplicaTimeout_Flow') -and "$($Globals['SI_Bootstrap_ReplicaTimeout_Flow'])".Trim()) { return @() }
|        # 7 days -- or 24 hours once Azure refused a longer run limit in this run
|        $want = [int](Get-SIRunLimitToSend -ReplicaTimeout ([int](Get-SIFlowJobReplicaTimeout)))
|        $cur = Get-SIJobCurrentSize -Job $flow
|        if ($cur.ReplicaTimeout -le 0 -or $cur.ReplicaTimeout -ge $want) { return @() }
|        $text = { param([int]$Seconds) 'job size: {0} (the pipeline) may run for up to {1}, was {2} -- it waits for every step, so it must not end before a step does' -f $name, (Format-SIJobTimeout -Seconds $Seconds), (Format-SIJobTimeout -Seconds $cur.ReplicaTimeout) }
|        if ($WhatIf) { return @([pscustomobject]@{ Job = $name; Action = 'would-raise'; Line = ((& $text $want) -replace ' may run ', ' would run ') + ' (re-run with -Apply)' }) }
|        $jobUri = 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs/{2}?api-version={3}' -f $SubscriptionId, $ResourceGroup, $name, $script:SIJobSizePatchApi
|        $p = Invoke-SIJobSizePatch -Rest $Rest -JobUri $jobUri -JobName $name -ReplicaTimeout $want -CurrentReplicaTimeout $cur.ReplicaTimeout
|        $out = @(@($p.Lines) | ForEach-Object { [pscustomobject]@{ Job = $name; Action = 'note'; Line = ('job size: {0}' -f $_) } })
|        if ($p.Ok) {
|            if ($p.ReplicaTimeout -gt $cur.ReplicaTimeout) { $out += [pscustomobject]@{ Job = $name; Action = 'raised'; Line = (& $text $p.ReplicaTimeout) } }
|            return $out
|        }
|        $why = $p.Why
|        return @([pscustomobject]@{ Job = $name; Action = 'failed'; Line = ('job size: {0} (the pipeline) was NOT raised to {1}: {2} -- the next update tries again' -f $name, (Format-SIJobTimeout -Seconds $want), $why) })
|    } catch {
|        return @([pscustomobject]@{ Job = $name; Action = 'failed'; Line = ('job size: {0} was not checked ({1}) -- the next update tries again' -f $name, $_.Exception.Message) })
|    }
|}
|
|function Test-SIRaJobName {
|    <# PURE. A Risk Analysis job: caj-si-risk-analysis, caj-si-risk-analysis-detailed, caj-si-ra-<name> (the extra templates). #>
|    param([AllowEmptyString()][string]$Name)
|    [bool]("$Name" -match '^(?i)caj-si-(risk-analysis|risk-analysis-detailed|ra-[a-z0-9-]+)$')
|}
|
|function Invoke-SIEngineJobRetryLimit {
|    <#
|        EVERY UPDATE, EVERY ENGINE JOB (Test-SIEngineJobName: the jobs the pipeline starts -- its steps, their producers and
|        workers, every Risk Analysis job and its queue workers): the replica retry limit is 0. Live 2026-10-16: a Detailed
|        run stored every report, then failed building its workbook; Azure restarted the replica in the same execution and a
|        whole new 6-hour run began. Live 2026-10-23: Azure re-ran a failed data sync container in the same execution (852
|        min = 504 + 347) and the vulnerability step twice (2 x 18 min). An engine run is never restarted by Azure: the
|        pipeline decides what runs again. The runner (caj-si-flow), the updater and the jobs that are no step are not
|        touched. -StepKeys: test seam (default the shipped map). One read-modify-write PATCH per job that still has another
|        limit (New-SIJobSizePatchBody -ReplicaRetryLimit 0: its template, size and run limit as they are), then the job READ
|        BACK. -WhatIf: the plan only. Returns @(@{ Job; Action = set | would-set | failed; Line }) -- empty when every job
|        already has 0. Never throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [object[]]$Jobs = @(), [string[]]$StepKeys, [switch]$WhatIf)
|    $out = New-Object System.Collections.Generic.List[object]
|    if ($null -eq $StepKeys) { $StepKeys = @(Get-SIPipelineStepKeys) }
|    foreach ($j in @(@($Jobs) | Where-Object { $_ -and (Test-SIEngineJobName -Name ([string]$_.name) -StepKeys $StepKeys) })) {
|        $name = [string]$j.name
|        try {
|            $cfg = $j.properties.configuration
|            $cur = if ($cfg -and $cfg.PSObject.Properties['replicaRetryLimit'] -and "$($cfg.replicaRetryLimit)" -ne '') { [int]"$($cfg.replicaRetryLimit)" } else { -1 }
|            if ($cur -eq 0) { continue }
|            $line = 'retry limit: {0} restarts a failed run {1} -> 0 -- an engine run is never started again by Azure; the pipeline decides' -f $name, $(if ($cur -lt 0) { '(not set)' } else { "$cur time(s)" })
|            if ($WhatIf) { $out.Add([pscustomobject]@{ Job = $name; Action = 'would-set'; Line = ($line + ' (re-run with -Apply)') }); continue }
|            $uri = 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs/{2}?api-version={3}' -f $SubscriptionId, $ResourceGroup, $name, $script:SIJobSizePatchApi
|            $now = Invoke-SIRestJson -Rest $Rest -Uri $uri -What ('the job {0}' -f $name)
|            $size = Get-SIJobCurrentSize -Job $now
|            if ($size.Cpu -le 0 -or -not $size.Memory) { throw 'its CPU and memory could not be read' }
|            $body = New-SIJobSizePatchBody -Job $now -Cpu ($size.Cpu.ToString('0.0#', [Globalization.CultureInfo]::InvariantCulture)) -Memory ([string]$size.Memory) -ReplicaRetryLimit 0
|            $r = & $Rest 'PATCH' $uri $body 'https://management.azure.com/' @{ 'Content-Type' = 'application/json' }
|            if (-not ($r -and [int]$r.Status -ge 200 -and [int]$r.Status -lt 300)) { throw (Format-SIRestFailure -Response $r) }
|            # read back: what Azure has now
|            $back = Invoke-SIRestJson -Rest $Rest -Uri $uri -What ('the job {0}' -f $name)
|            $bc = $back.properties.configuration
|            $got = if ($bc -and $bc.PSObject.Properties['replicaRetryLimit'] -and "$($bc.replicaRetryLimit)" -ne '') { [int]"$($bc.replicaRetryLimit)" } else { -1 }
|            if ($got -ne 0) { throw ('Azure accepted the change but the job reads back {0}' -f $(if ($got -lt 0) { 'no retry limit' } else { $got })) }
|            $out.Add([pscustomobject]@{ Job = $name; Action = 'set'; Line = $line })
|        } catch {
|            $why = ("$($_.Exception.Message)" -replace '\s+', ' ').Trim(); if ($why.Length -gt 300) { $why = $why.Substring(0, 297) + '...' }
|            $out.Add([pscustomobject]@{ Job = $name; Action = 'failed'; Line = ('retry limit: {0} was NOT set to 0 ({1}) -- the next update tries again' -f $name, $why) })
|        }
|    }
|    $out.ToArray()   # unrolled: callers wrap the call in @()
|}
|
|function Invoke-SIJobSizing {
|    <#
|        EXISTING INSTALLS: apply the job sizing rule to the jobs of -ResourceGroup. -Jobs: the job list (ARM shape) the update
|        already read. -Rest: the update's REST seam (setup/_shared/SI-UpdateRest.ps1). -SqlRows { param([string]$Sql) } -> rows
|        from the Pro database ($null = no Pro database). -WorkspaceResourceId: the run health and the Container Apps system
|        logs. -Globals: the customer's settings. -WhatIf: plan only.
|        Covers the collection / CI build / Risk Analysis / data jobs (Get-SIJobSizingEngine) for CPU AND MEMORY, and the
|        pipeline job itself for its run limit (7 days). An engine job's RUN LIMIT is not sized: the update's floor step
|        gives every one of them the same value (Invoke-SIJobFloor).
|        Returns @{ Results = @(@{ Job; Action = raised | keep | would-raise | failed; Line }); Lines; CountsFrom }. NEVER throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [object[]]$Jobs = @(), [hashtable]$Globals = @{}, [scriptblock]$SqlRows, [string]$WorkspaceResourceId, [switch]$WhatIf)
|    $results = New-Object System.Collections.Generic.List[object]
|    $lines = New-Object System.Collections.Generic.List[string]
|    $cnt = [pscustomobject]@{ Counts = $null; From = '' }
|    $arm = 'https://management.azure.com/'
|    $flowDone = @(Invoke-SIFlowJobRunLimit -Rest $Rest -SubscriptionId $SubscriptionId -ResourceGroup $ResourceGroup -Jobs $Jobs -Globals $Globals -WhatIf:$WhatIf)
|    $sized = @(@($Jobs) | Where-Object { $_ -and (Get-SIJobSizingEngine -JobName ([string]$_.name)) })
|    if (-not $sized.Count) {
|        $lines.Add('job size: no collection, CI build or Risk Analysis job in this install -- nothing to size')
|        foreach ($f in $flowDone) { $results.Add($f); $lines.Add([string]$f.Line) }
|        return [pscustomobject]@{ Results = $results.ToArray(); Lines = $lines.ToArray(); CountsFrom = '' }
|    }
|    $la = {
|        param([string]$Kql)
|        if (-not $WorkspaceResourceId) { return @() }
|        try {
|            $url = 'https://management.azure.com{0}/api/query?api-version=2017-10-01' -f $WorkspaceResourceId.TrimEnd('/')
|            return @(ConvertFrom-SILaQueryAnswer (Invoke-SIRestJson -Rest $Rest -Method POST -Uri $url -Body (ConvertTo-Json -InputObject ([ordered]@{ query = $Kql }) -Compress) -What 'the Log Analytics query'))
|        } catch { return @() }
|    }
|    try {
|        # ---- the tenant's counts: Graph, else the Pro database's records, else the run health ----
|        $graph = $null; try { $graph = Get-SISqlTierTenantCounts -Rest $Rest -SubscriptionId $SubscriptionId } catch { $graph = $null }
|        $ci = $null; $coll = $null
|        if (-not $graph -and $SqlRows) {
|            # the directory counts the collections recorded with their own directory rights (cfg.InstallState 'TenantSize')
|            try { $coll = Get-SIJobSizingCountsFromTenantMark -Rows @(& $SqlRows $script:SIJobSizingTenantMarkSql) }
|            catch { $coll = $null; $lines.Add(('job size: the tenant size the collections recorded could not be read from the Pro database ({0})' -f (("$($_.Exception.Message)" -replace '\s+', ' ').Trim()))) }
|            # a read that fails is said (it was silent: an install whose records could not be read looked like one with none)
|            try { $ci = Get-SIJobSizingCountsFromCiRecords -Rows @(& $SqlRows $script:SIJobSizingCiRecordSql) }
|            catch { $ci = $null; $lines.Add(('job size: the records in the Pro database could not be read for the tenant''s size ({0})' -f (("$($_.Exception.Message)" -replace '\s+', ' ').Trim()))) }
|        }
|        # #720: the counts setup read at install, kept on the jobs (si-tenant-* tags) -- the list this update already read
|        $inst = $null
|        if (-not $graph) { try { $inst = ConvertFrom-SITenantSizeTags -Jobs $Jobs } catch { $inst = $null } }
|        # each half (identity objects, devices) from the first source that has it -- the run health only when a half is missing
|        $hasHalf = { param($h, $k) $v = 0L; [bool]($h -and $h.ContainsKey($k) -and [long]::TryParse("$($h[$k])", [ref]$v) -and $v -gt 0) }
|        $rhc = $null
|        $idKnown = (& $hasHalf $coll 'Users') -or (& $hasHalf $ci 'Users') -or (& $hasHalf $inst 'Users')
|        $devKnown = (& $hasHalf $coll 'Devices') -or (& $hasHalf $ci 'Devices') -or (& $hasHalf $inst 'Devices')
|        if (-not $graph -and -not ($idKnown -and $devKnown)) {
|            $rhc = Get-SIJobSizingCountsFromRunHealth -Rows @(& $la (Get-SIJobSizingKql -Kind RunHealthCounts))
|        }
|        $cnt = Resolve-SIJobSizingCounts -Graph $graph -CiRecords $ci -RunHealth $rhc -Install $inst -Collected $coll
|        if ($cnt.Counts) {
|            $c = $cnt.Counts; $inv = [Globalization.CultureInfo]::InvariantCulture
|            $lines.Add(('job size: tenant size from {0}: {1} users, {2} groups, {3} service principals, {4} devices' -f $cnt.From,
|                ([long]$c.Users).ToString('N0', $inv), ([long]$c.Groups).ToString('N0', $inv), ([long]$c.ServicePrincipals).ToString('N0', $inv), ([long]$c.Devices).ToString('N0', $inv)))
|            $miss = @()
|            if (-not (Test-SIJobSizingCountKnown -Engine identity -Counts $c)) { $miss += 'users' }
|            if (-not (Test-SIJobSizingCountKnown -Engine endpoint -Counts $c)) { $miss += 'devices' }
|            if ($miss.Count) { $lines.Add(('job size: the tenant''s {0} could not be read -- the jobs that count them are sized for a large tenant (4 CPU / 8 GiB)' -f ($miss -join ' and '))) }
|        } else {
|            $lines.Add('job size: the tenant''s size could not be read (no directory read, no counts recorded by the collections, no records in the Pro database, no counts from setup on the jobs, no run health) -- every sized job is sized for a large tenant (4 CPU / 8 GiB)')
|        }
|        # ---- the last runs: Container Apps system logs + run health, read once ----
|        $sysRows = @(& $la (Get-SIJobSizingKql -Kind SystemLogs))
|        $rhRows = @(& $la (Get-SIJobSizingKql -Kind RunHealthRows))
|        foreach ($j in $sized) {
|            $name = [string]$j.name; $e = Get-SIJobSizingEngine -JobName $name
|            try {
|                $cur = Get-SIJobCurrentSize -Job $j
|                # the job's executions: how its LAST run ended (CPU and memory go up one band after an out-of-memory run or a
|                # run stopped at its run limit). A list that cannot be read is no signal -- the counts still size the job.
|                $execs = New-Object System.Collections.Generic.List[object]
|                $exUri = 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs/{2}/executions?api-version={3}' -f $SubscriptionId, $ResourceGroup, $name, $script:SIJobSizeArmApi
|                $pages = 0
|                while ($exUri -and $pages -lt 20) {
|                    $pages++; $ex = $null
|                    try { $ex = Invoke-SIRestJson -Rest $Rest -Uri $exUri -What ('the executions of {0}' -f $name) } catch { $ex = $null }
|                    if (-not $ex) { break }
|                    if ($ex.PSObject.Properties['value']) { foreach ($x in @($ex.value)) { if ($x) { $execs.Add($x) } } }
|                    $exUri = if ($ex.PSObject.Properties['nextLink'] -and $ex.nextLink) { [string]$ex.nextLink } else { '' }
|                }
|                $execs = $execs.ToArray()
|                $fail = Get-SIJobFailureSignal -JobName $name -Engine $e.Engine -ReplicaTimeout $cur.ReplicaTimeout -Executions $execs -SystemLogRows $sysRows -RunHealthRows $rhRows
|                $ch = Get-SIJobSizeChange -JobName $name -Engine $e.Engine -Current $cur -Counts $cnt.Counts -CountsFrom $cnt.From -Failure $fail -Globals $Globals
|                foreach ($n in @($ch.Notes)) { $lines.Add(('job size: {0}' -f $n)) }
|                if ($ch.Action -eq 'keep') { $results.Add([pscustomobject]@{ Job = $name; Action = 'keep'; Line = '' }); continue }
|                if ($WhatIf) { $l = $ch.Line -replace ' raised ', ' would be raised '; $l += ' (re-run with -Apply)'; $results.Add([pscustomobject]@{ Job = $name; Action = 'would-raise'; Line = $l }); $lines.Add($l); continue }
|                # READ-MODIFY-WRITE at ONE api-version: the job as it is now, its whole template back with the new CPU and
|                # memory. The run limit is not changed here (Invoke-SIJobSizePatch keeps what the job has now).
|                $jobUri = 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs/{2}?api-version={3}' -f $SubscriptionId, $ResourceGroup, $name, $script:SIJobSizePatchApi
|                $p = Invoke-SIJobSizePatch -Rest $Rest -JobUri $jobUri -JobName $name -Cpu $ch.Cpu -Memory $ch.Memory -ReplicaTimeout $cur.ReplicaTimeout -CurrentReplicaTimeout $cur.ReplicaTimeout -Worker:($e.Role -eq 'worker')
|                foreach ($n in @($p.Lines)) { $lines.Add(('job size: {0}' -f $n)) }
|                if ($p.Ok) { $results.Add([pscustomobject]@{ Job = $name; Action = 'raised'; Line = $ch.Line }); $lines.Add($ch.Line) }
|                else {
|                    $l = ('job size: {0} was NOT raised ({1}): {2} -- the next update tries again' -f $name, ($ch.Reasons -join '; '), [string]$p.Why)
|                    $results.Add([pscustomobject]@{ Job = $name; Action = 'failed'; Line = $l }); $lines.Add($l)
|                }
|            } catch {
|                $l = ('job size: {0} was not checked ({1}) -- the next update tries again' -f $name, $_.Exception.Message)
|                $results.Add([pscustomobject]@{ Job = $name; Action = 'failed'; Line = $l }); $lines.Add($l)
|            }
|        }
|        if (-not @($results | Where-Object { $_.Action -ne 'keep' }).Count) { $lines.Add(('job size: every sized job ({0}) already has the CPU and memory the rule gives -- nothing changed' -f $sized.Count)) }
|    } catch {
|        $lines.Add(('job size: not checked ({0}) -- the update goes on; the next update tries again' -f $_.Exception.Message))
|    }
|    foreach ($f in $flowDone) { $results.Add($f); $lines.Add([string]$f.Line) }
|    [pscustomobject]@{ Results = $results.ToArray(); Lines = $lines.ToArray(); CountsFrom = $cnt.From }
|}
|
|# THE WEB APP'S SIZE. What setup gives a new install (pro-management/deploy/Deploy-SIManagement.ps1 -Cpu / -Memory), and what
|# every update SETS an existing install's web app to. History: 0.5 CPU / 1 GiB; 1 CPU / 2 GiB (owner 2026-10-11: "why is the
|# performance so bad"); 4 CPU / 8 GiB (owner 2026-10-12: "make sure al ring 1+2 customers are running on web app 4 cpu/8 gb");
|# 2 CPU / 4 GiB since 2026-10-18 (owner: "reduce web app to 2cpus 4 gb ram" -- 7 days of telemetry: the web app used at most
|# 0.1 CPU / 0.5 GiB of its 4 CPU / 8 GiB).
|# The update raises a smaller web app and LOWERS one on the product's own earlier default (4 CPU / 8 GiB, or 3.75 / 7.5 GiB:
|# that default less the sign-in front's share); any other larger size is the customer's and is kept. A size the customer set
|# (SI_Bootstrap_WebAppCpu / SI_Bootstrap_WebAppMemory) wins in both directions. Only the web app's own container (the first) is
|# sized: the sign-in front sidecar (0.25 CPU / 0.5 GiB) and the MCP server keep theirs.
|$script:SIWebAppCpu = 2.0
|$script:SIWebAppMemoryGi = 4.0
|# the product's own earlier defaults that the update lowers (CPU, GiB) -- the 4 / 8 of 2026-10-12, alone or behind the front
|$script:SIWebAppEarlierDefaults = @(@(4.0, 8.0), @(3.75, 7.5))
|# what one revision of a Consumption container app may hold (all its containers together)
|$script:SIWebAppMaxCpu = 4.0
|$script:SIWebAppMaxMemoryGi = 8.0
|$script:SIWebAppArmApi = '2025-07-01'
|
|function Get-SIWebAppSizeSetting {
|    <#
|        PURE. The web app size the customer set: -Cpu (SI_Bootstrap_WebAppCpu, '1.5') and/or -Memory (SI_Bootstrap_WebAppMemory,
|        '3Gi' or '3'). One of them is enough: the other is the pair Container Apps takes (memory = 2 x CPU). CPU from 0.5 to 4
|        in steps of 0.25. Returns @{ Set; Cpu; MemoryGi; Note } -- Set = $false (with a Note when something unusable was set)
|        means: the product's rule.
|    #>
|    param([AllowNull()]$Cpu, [AllowNull()]$Memory)
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $ct = "$Cpu".Trim().Trim('"').Trim(); $mt = "$Memory".Trim().Trim('"').Trim()
|    $none = { param($n) [pscustomobject]@{ Set = $false; Cpu = 0.0; MemoryGi = 0.0; Note = $n } }
|    if (-not $ct -and -not $mt) { return (& $none '') }
|    $c = 0.0; $m = 0.0
|    if ($ct -and -not [double]::TryParse($ct, [Globalization.NumberStyles]::Float, $inv, [ref]$c)) { $c = -1.0 }
|    if ($mt) { $m = ConvertTo-SIJobMemoryGi $mt; if ($m -le 0) { $m = -1.0 } }
|    if ($c -lt 0 -or $m -lt 0) { return (& $none ("the web app size that was set (CPU '{0}', memory '{1}') is not a number -- the product's size applies" -f $ct, $mt)) }
|    if ($c -le 0) { $c = $m / 2 }
|    if ($m -le 0) { $m = 2 * $c }
|    # a pair Container Apps takes: the larger of the two decides
|    if ($m -lt 2 * $c) { $m = 2 * $c } elseif ($c -lt $m / 2) { $c = $m / 2 }
|    if ($c -lt 0.5 -or $c -gt $script:SIWebAppMaxCpu -or ([Math]::Round($c * 4) -ne $c * 4)) {
|        return (& $none ("the web app size that was set ({0} CPU / {1} GiB) is not one Container Apps takes (0.5 to 4 CPU in steps of 0.25, memory 2 x CPU) -- the product's size applies" -f $c.ToString($inv), $m.ToString($inv)))
|    }
|    [pscustomobject]@{ Set = $true; Cpu = $c; MemoryGi = $m; Note = '' }
|}
|
|function New-SIWebAppSizePatchBody {
|    <#
|        PURE. The ARM PATCH body that sizes a container app's web container (-App: ARM shape, as just read; the FIRST container):
|        its WHOLE template as read (a template PATCH replaces the container list) with the first container's cpu / memory set,
|        the revision suffix dropped (a reused suffix is refused), the default imageType and the read-only ephemeralStorage left
|        out. Never the configuration (ARM returns secrets without values). Every other container (the sign-in front) is sent
|        exactly as read.
|        The size: -CustomerSet = exactly -Cpu / -MemoryGi, both ways. Otherwise the product's rule: a smaller web container is
|        raised to at least -Cpu / -MemoryGi (memory = 2 x CPU), one on the product's earlier default ($script:SIWebAppEarlierDefaults)
|        is lowered to it, any other larger size is the customer's and kept. All containers together stay within one revision's
|        4 CPU / 8 GiB (the web container gives up what the others take). $null when nothing changes.
|    #>
|    param([Parameter(Mandatory)]$App, [Alias('MinCpu')][double]$Cpu = $script:SIWebAppCpu, [Alias('MinMemoryGi')][double]$MemoryGi = $script:SIWebAppMemoryGi,
|          [switch]$CustomerSet)
|    # (the current size is $have / $haveMem: PowerShell names are case-insensitive, $cpu would overwrite -Cpu)
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $tpl = ConvertTo-Json -InputObject $App.properties.template -Depth 60 | ConvertFrom-Json
|    $first = @($tpl.containers | Where-Object { $_ }) | Select-Object -First 1
|    if (-not $first) { throw 'the web app has no container to size' }
|    $have = 0.0; $haveMem = 0.0
|    if ($first.PSObject.Properties['resources'] -and $first.resources) {
|        try { $have = [double]::Parse([string]$first.resources.cpu, $inv) } catch { $have = 0.0 }
|        $haveMem = ConvertTo-SIJobMemoryGi ([string]$first.resources.memory)
|    }
|    # CR7: a second container in the same revision (the shared sign-in front) keeps its own size; the web container takes
|    # what is left of one revision when the total would pass it (a revision of 4.25 CPU is refused on Consumption)
|    $oCpu = 0.0; $oMem = 0.0
|    foreach ($o in @(@($tpl.containers | Where-Object { $_ }) | Select-Object -Skip 1)) {
|        if (-not ($o.PSObject.Properties['resources'] -and $o.resources)) { continue }
|        try { $oCpu += [double]::Parse([string]$o.resources.cpu, $inv) } catch { }
|        $oMem += ConvertTo-SIJobMemoryGi ([string]$o.resources.memory)
|    }
|    $tCpu = [Math]::Max(0.25, [Math]::Min($Cpu, $script:SIWebAppMaxCpu - $oCpu)); $tMem = [Math]::Max(0.5, [Math]::Min($MemoryGi, $script:SIWebAppMaxMemoryGi - $oMem))
|    if ($CustomerSet) {
|        if ($have -eq $tCpu -and $haveMem -eq $tMem) { return $null }
|        $nCpu = $tCpu; $nMem = $tMem
|    } elseif ($have -lt $tCpu -or $haveMem -lt $tMem) {
|        # raise: the larger of now and the rule, as a pair Container Apps takes
|        $nCpu = [Math]::Max($have, $tCpu); $nMem = [Math]::Max($haveMem, $tMem)
|        if ($nMem -lt 2 * $nCpu) { $nMem = 2 * $nCpu }
|        if ($nCpu -lt $nMem / 2) { $nCpu = $nMem / 2 }
|    } elseif (($have -gt $tCpu -or $haveMem -gt $tMem) -and @($script:SIWebAppEarlierDefaults | Where-Object { $have -eq $_[0] -and $haveMem -eq $_[1] }).Count) {
|        # lower: the product's own earlier default only
|        $nCpu = $tCpu; $nMem = $tMem
|    } else { return $null }
|    if (-not $first.PSObject.Properties['resources'] -or -not $first.resources) { $first | Add-Member -NotePropertyName resources -NotePropertyValue ([pscustomobject]@{}) -Force }
|    $first.resources | Add-Member -NotePropertyName cpu -NotePropertyValue $nCpu -Force
|    $first.resources | Add-Member -NotePropertyName memory -NotePropertyValue ('{0}Gi' -f $nMem.ToString($inv)) -Force
|    foreach ($c in (@($tpl.containers) + @($tpl.initContainers))) {
|        if (-not $c) { continue }
|        if ($c.PSObject.Properties['imageType'] -and ([string]$c.imageType -in '', 'ContainerImage')) { $c.PSObject.Properties.Remove('imageType') }
|        if ($c.PSObject.Properties['resources'] -and $c.resources -and $c.resources.PSObject.Properties['ephemeralStorage']) { $c.resources.PSObject.Properties.Remove('ephemeralStorage') }
|    }
|    if ($tpl.PSObject.Properties['revisionSuffix']) { $tpl.PSObject.Properties.Remove('revisionSuffix') }
|    ConvertTo-Json -InputObject ([ordered]@{ properties = [ordered]@{ template = $tpl } }) -Depth 60 -Compress
|}
|
|function Invoke-SIWebAppSize {
|    <#
|        Every update: the Pro web app (-Name, a container app in -ResourceGroup) set to the product's size (2 CPU / 4 GiB:
|        a smaller one raised, one on the product's earlier 4 CPU / 8 GiB lowered, any other larger size kept) -- or to the size
|        the customer set (-Cpu / -Memory: SI_Bootstrap_WebAppCpu / SI_Bootstrap_WebAppMemory, both ways) -- by ONE
|        read-modify-write ARM PATCH of the web container only, then its new revision waited for (up to -WaitSeconds) so the web
|        app roll that follows is not refused as an operation in flight, and the size read back. No such app (Community, or not
|        deployed yet): nothing to do. -WhatIf: the plan only. Returns @{ Action = raise | lower | keep | none | plan | failed;
|        Lines }. Never throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [string]$Name = 'ca-si-management', [AllowNull()]$Cpu, [AllowNull()]$Memory, [int]$WaitSeconds = 300, [int]$PollSeconds = 10, [switch]$WhatIf)
|    $lines = New-Object System.Collections.Generic.List[string]
|    $uri = 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/containerApps/{2}?api-version={3}' -f $SubscriptionId, $ResourceGroup, $Name, $script:SIWebAppArmApi
|    try {
|        $want = Get-SIWebAppSizeSetting -Cpu $Cpu -Memory $Memory
|        if ($want.Note) { $lines.Add(('web app size: {0}' -f $want.Note)) }
|        $app = Invoke-SIRestJson -Rest $Rest -Uri $uri -AllowNotFound -What ('the web app {0}' -f $Name)
|        if (-not $app) { $lines.Add(('web app size: no web app {0} in this install -- nothing to size' -f $Name)); return [pscustomobject]@{ Action = 'none'; Lines = $lines.ToArray() } }
|        $first = @($app.properties.template.containers | Where-Object { $_ }) | Select-Object -First 1
|        $cur = '{0} CPU / {1}' -f $first.resources.cpu, $first.resources.memory
|        $whose = if ($want.Set) { 'the size this install set' } else { 'the product''s size' }
|        $body = if ($want.Set) { New-SIWebAppSizePatchBody -App $app -Cpu $want.Cpu -MemoryGi $want.MemoryGi -CustomerSet } else { New-SIWebAppSizePatchBody -App $app }
|        if (-not $body) { $lines.Add(('web app size: {0} runs {1} -- kept ({2})' -f $Name, $cur, $(if ($want.Set) { $whose } else { 'the product''s size, or a size the customer chose' }))); return [pscustomobject]@{ Action = 'keep'; Lines = $lines.ToArray() } }
|        $res = ($body | ConvertFrom-Json).properties.template.containers[0].resources
|        $to = '{0} CPU / {1}' -f $res.cpu, $res.memory
|        $inv = [Globalization.CultureInfo]::InvariantCulture
|        $curCpu = 0.0; try { $curCpu = [double]::Parse([string]$first.resources.cpu, $inv) } catch { }
|        $down = ([double]$res.cpu -lt $curCpu -or (ConvertTo-SIJobMemoryGi ([string]$res.memory)) -lt (ConvertTo-SIJobMemoryGi ([string]$first.resources.memory)))
|        $verb = if ($down) { 'lowered' } else { 'raised' }
|        if ($WhatIf) { $lines.Add(('web app size: {0} would be {1} from {2} to {3}, {4} (re-run with -Apply)' -f $Name, $verb, $cur, $to, $whose)); return [pscustomobject]@{ Action = 'plan'; Lines = $lines.ToArray() } }
|        $r = & $Rest 'PATCH' $uri $body 'https://management.azure.com' @{ 'Content-Type' = 'application/json' }
|        $code = 0; try { $code = [int]$r.Status } catch { }
|        if ($code -lt 200 -or $code -ge 300) {
|            $lines.Add(('web app size: {0} was NOT {1} ({2}) -- the next update tries again' -f $Name, $verb, (Format-SIRestFailure -Response $r)))
|            return [pscustomobject]@{ Action = 'failed'; Lines = $lines.ToArray() }
|        }
|        # the new revision: provisioned before the web app roll patches the app again; then the size read back
|        $state = ''; $now = $null
|        $deadline = [datetime]::UtcNow.AddSeconds([Math]::Max(0, $WaitSeconds))
|        do {
|            try { $now = Invoke-SIRestJson -Rest $Rest -Uri $uri -What ('the web app {0}' -f $Name); $state = [string]$now.properties.provisioningState } catch { $state = '' }
|            if ($state -in 'Succeeded', 'Failed', 'Canceled') { break }
|            if ($PollSeconds -gt 0) { Start-Sleep -Seconds $PollSeconds }
|        } while ([datetime]::UtcNow -lt $deadline)
|        $back = ''
|        try {
|            $nf = @($now.properties.template.containers | Where-Object { $_ }) | Select-Object -First 1
|            if ($nf -and $nf.resources -and ([double]::Parse([string]$nf.resources.cpu, $inv) -ne [double]$res.cpu -or (ConvertTo-SIJobMemoryGi ([string]$nf.resources.memory)) -ne (ConvertTo-SIJobMemoryGi ([string]$res.memory)))) {
|                $back = (' -- read back {0} CPU / {1}, the next update checks again' -f $nf.resources.cpu, $nf.resources.memory)
|            }
|        } catch { }
|        $lines.Add(('web app size: {0} {1} from {2} to {3}, {4}{5}{6}' -f $Name, $verb, $cur, $to, $whose, $(if ($state -eq 'Succeeded') { '' } else { " -- its new revision is still $(if ($state) { $state } else { 'provisioning' })" }), $back))
|        [pscustomobject]@{ Action = $(if ($down) { 'lower' } else { 'raise' }); Lines = $lines.ToArray() }
|    } catch {
|        $lines.Add(('web app size: {0} could not be checked ({1}) -- the update goes on; the next update tries again' -f $Name, $_.Exception.Message))
|        [pscustomobject]@{ Action = 'failed'; Lines = $lines.ToArray() }
|    }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-TenantSizeMark.ps1'] = @{ Sha256 = '9984adb4bf0079ceb3eed549f59cf221bf6e7fd0c60cfb36768b86f4e3df298e'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE TENANT'S SIZE, RECORDED BY THE COLLECTION THAT COUNTED IT (found 2026-10-16: a 153,000-user
|    tenant ran every sized job on 2 CPU / 4 GiB because the updater could not read the tenant's size).
|
|    The update's job-size rule (setup\_shared\SI-JobSizing.ps1) needs the tenant's users / groups / service principals /
|    devices. The updater's identity has no directory read, so its Microsoft Graph $count is refused. But the identity and
|    endpoint collections already COUNT the directory before they read it (engine\asset-profiling\stages\Invoke-Discover.ps1:
|    the streaming discovery's part count), with the collection's own directory rights. Those counts are now recorded where
|    the updater already reads: the Pro database, cfg.InstallState 'TenantSize' -- on the connection the run already has
|    ($global:SI_ProSettingsStore; the engine role holds SELECT / INSERT / UPDATE on cfg.InstallState, SI-EngineGrants.ps1).
|    No new right for any identity.
|
|    The value is compact JSON: {"users":n,"groups":n,"servicePrincipals":n,"devices":n,"identityAt":"<utc>","devicesAt":"<utc>"}.
|    Each collection writes ITS half (identity: users, groups, service principals; endpoint: devices) and keeps the other
|    one -- merged in ONE statement under an update lock, because both collections run at the same time. A count that was
|    not read is left as it was (never written as 0). PS 5.1 + 7.
|#>
|
|$script:SITenantSizeMarkName = 'TenantSize'
|
|function ConvertTo-SITenantSizeMarkParams {
|    <#
|        PURE. The statement's parameters for -Counts (Users / Groups / ServicePrincipals / Devices; a key that is absent,
|        $null or negative is NOT written -- ''), the half each count belongs to stamped with -NowUtc. $null when nothing
|        is left to write.
|    #>
|    param([hashtable]$Counts, $NowUtc)
|    if (-not $Counts) { return $null }
|    $at = if ($NowUtc) { ([datetime]$NowUtc).ToUniversalTime() } else { [datetime]::UtcNow }
|    $atText = $at.ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture)
|    $p = [ordered]@{ Name = $script:SITenantSizeMarkName; Users = ''; Groups = ''; ServicePrincipals = ''; Devices = ''; IdentityAt = ''; DevicesAt = ''; By = 'si-engine (collection counts)' }
|    $any = $false
|    foreach ($k in 'Users', 'Groups', 'ServicePrincipals', 'Devices') {
|        if (-not $Counts.ContainsKey($k) -or $null -eq $Counts[$k]) { continue }
|        $n = 0L
|        if (-not [long]::TryParse("$($Counts[$k])", [ref]$n) -or $n -lt 0) { continue }
|        $p[$k] = $n.ToString([Globalization.CultureInfo]::InvariantCulture); $any = $true
|        if ($k -eq 'Devices') { $p.DevicesAt = $atText } else { $p.IdentityAt = $atText }
|    }
|    if (-not $any) { return $null }
|    $p
|}
|
|function Get-SITenantSizeMarkSaveSql {
|    <# The ONE statement that merges a collection's half into cfg.InstallState 'TenantSize' (the other half is kept). #>
|    @'
|IF OBJECT_ID('cfg.InstallState') IS NOT NULL
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    DECLARE @old nvarchar(400) = (SELECT Value FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @Name);
|    DECLARE @v nvarchar(400) = CASE WHEN @old IS NOT NULL AND ISJSON(@old) = 1 THEN @old ELSE N'{}' END;
|    IF @Users <> N'' SET @v = JSON_MODIFY(@v, '$.users', CONVERT(bigint, @Users));
|    IF @Groups <> N'' SET @v = JSON_MODIFY(@v, '$.groups', CONVERT(bigint, @Groups));
|    IF @ServicePrincipals <> N'' SET @v = JSON_MODIFY(@v, '$.servicePrincipals', CONVERT(bigint, @ServicePrincipals));
|    IF @Devices <> N'' SET @v = JSON_MODIFY(@v, '$.devices', CONVERT(bigint, @Devices));
|    IF @IdentityAt <> N'' SET @v = JSON_MODIFY(@v, '$.identityAt', @IdentityAt);
|    IF @DevicesAt <> N'' SET @v = JSON_MODIFY(@v, '$.devicesAt', @DevicesAt);
|    IF @old IS NULL
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@Name, @v, NULL, @By);
|    ELSE
|        UPDATE cfg.InstallState SET Value = @v, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @Name;
|    COMMIT;
|END
|'@
|}
|
|function Save-SITenantSizeMark {
|    <# Records -Counts (a collection's half) on -Store (the run's Pro database store: .Invoke sql params mode). Throws on failure. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][hashtable]$Counts, $NowUtc)
|    $p = ConvertTo-SITenantSizeMarkParams -Counts $Counts -NowUtc $NowUtc
|    if ($null -eq $p) { return $false }
|    $null = & $Store.Invoke (Get-SITenantSizeMarkSaveSql) $p 'nonquery'
|    $true
|}
|
|function Invoke-SITenantSizeMarkSave {
|    <#
|        A collection's directory counts for the update's job-size rule: -OnSave (tests), else the Pro database this run
|        opened ($global:SI_ProSettingsStore -- no second sign-in; Community has none and records nothing). One plain line.
|        NEVER throws; $true when recorded.
|    #>
|    param([hashtable]$Counts, [scriptblock]$OnSave, $NowUtc, [scriptblock]$Log)
|    $done = $false; $why = ''
|    try {
|        if ($OnSave) { $null = & $OnSave $Counts; $done = $true }
|        elseif ($global:SI_ProSettingsStore) { $done = [bool](Save-SITenantSizeMark -Store $global:SI_ProSettingsStore -Counts $Counts -NowUtc $NowUtc) }
|        else { return $false }
|    } catch { $done = $false; $why = (("$($_.Exception.Message)" -replace '\s+', ' ').Trim()) }
|    try {
|        $line = if ($done) { 'tenant size recorded for the update''s job sizing (the counts this collection read)' }
|                else { 'the tenant size could not be recorded for the update''s job sizing{0} -- the update uses its other sources' -f $(if ($why) { " ($why)" } else { '' }) }
|        if ($Log) { & $Log $line } else { Write-Host (' [INFO] ' + $line) }
|    } catch { }
|    $done
|}
|
|function ConvertFrom-SITenantSizeMark {
|    <#
|        PURE. The recorded value (cfg.InstallState 'TenantSize' JSON) -> @{ Users; Groups; ServicePrincipals; Devices;
|        IdentityAt; DevicesAt } (a count not recorded = 0, a time not recorded = ''), or $null when nothing usable is in it.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    if ([string]::IsNullOrWhiteSpace($Value)) { return $null }
|    $o = $null
|    try { $o = $Value | ConvertFrom-Json -ErrorAction Stop } catch { return $null }
|    if ($null -eq $o) { return $null }
|    $c = @{ Users = 0L; Groups = 0L; ServicePrincipals = 0L; Devices = 0L; IdentityAt = ''; DevicesAt = '' }
|    $any = $false
|    foreach ($pair in @(@('users', 'Users'), @('groups', 'Groups'), @('servicePrincipals', 'ServicePrincipals'), @('devices', 'Devices'))) {
|        $pp = $o.PSObject.Properties[$pair[0]]
|        $n = 0L
|        if ($pp -and $null -ne $pp.Value -and [long]::TryParse("$($pp.Value)", [ref]$n) -and $n -ge 0) { $c[$pair[1]] = $n; if ($n -gt 0) { $any = $true } }
|    }
|    # the times as the text that was written (ConvertFrom-Json on pwsh 7 would turn them into local dates)
|    foreach ($pair in @(@('identityAt', 'IdentityAt'), @('devicesAt', 'DevicesAt'))) {
|        $m = [regex]::Match($Value, ('"{0}"\s*:\s*"([^"]*)"' -f $pair[0]))
|        if ($m.Success) { $c[$pair[1]] = $m.Groups[1].Value }
|    }
|    if ($any) { $c } else { $null }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-RaWorkerJobs.ps1'] = @{ Sha256 = 'ad10acbd513648fa04dd8473d0511821b914dbc64accfe8ec871f505f8337806'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- EXISTING INSTALLS GET THE RISK ANALYSIS WORKER JOB (#742; rule: existing installs reach new-install
|    state). A new install's Detailed Risk Analysis job is the PRODUCER of a queue-scaled worker job, caj-si-raworker-detailed
|    (Bootstrap-ContainerAppJob.ps1, step 4c): the producer plans one work item per report, the workers run them in parallel
|    (engine/risk-analysis/_shared/RA-ScaleOut.ps1). Every update (setup\Invoke-SIContainerUpdate.ps1, the updater job and the
|    VM sync hook both run it) gives an install made before it the same jobs, built by the same definitions Bootstrap uses
|    (Get-SIKedaWorkerCreateArgs with the work queue, Get-SIRaWorkerEnvArgs, Get-SIRaProducerScaleOutEnvArgs in
|    container\_shared\SI-ContainerConfig.ps1):
|
|      * ON BY DEFAULT WHERE THEY CAN RUN (owner 2026-10-18: "pls dont turn off things that improve time, why do that"; they
|        were off by default for one day as a review-gap closure). Not set = on (Get-SIRaScaleOutOptIn). The customer's
|        SI_Bootstrap_RaScaleOut = $false (or SI_UPDATER_RA_SCALE_OUT = off on the updater job; the config wins) switches
|        them off: no job is created, no role granted; a Risk Analysis job that was told it is a producer is told it is not
|        any more (its two switches removed, read back -- 'unflag'), so it runs its reports itself; the idle worker job is
|        left in place (setup with $false removes it). Where they cannot run, nothing changes and one line says why.
|      * WHEN (Get-SIRaWorkerJobPlan, PURE): not switched off, the Detailed Risk Analysis job exists, SI's setup made it (si-build
|        tag), it signs in with the managed identity (or the certificate, which also carries the identity) -- the queue
|        scaler signs in with it -- and the install has not switched queue scaling off (SI_Bootstrap_UseKEDA /
|        SI_UPDATER_USE_KEDA). Queue scaling off = an existing worker job is left in place and its producer runs its reports
|        itself (one line says so).
|      * HOW (Invoke-SIRaWorkerJobs): from the Risk Analysis job itself -- its image, environment, secrets, identity,
|        registry and size: (1) the queue scaler's storage queue role for the identity (present, or granted; missing =
|        nothing changes); (2) the work queue (the producer also makes it); (3) the worker (event-triggered, the queue rule,
|        up to SI_Bootstrap_RaMaxWorkers at once, default 4), READ BACK; (4) only then the Risk Analysis job is told it is a
|        producer (SI_RA_SCALE_OUT=on, SI_RA_WORKER_JOB) -- one read-modify-write PATCH of its container's environment, read
|        back. A worker job with no producer flag is the state a failed step 4 leaves: the next update sets the flag.
|      * Any failure: a worker this run created is removed again, the Risk Analysis job runs on as before, one line says
|        why, and the next update tries again. Never throws; -WhatIf: the plan only, no Azure call at all.
|
|    NO az CLI, no PowerShell module: ONE seam, -Rest { param([string]$Method, [string]$Uri, $Body, [string]$Resource,
|    [hashtable]$Headers) } -> @{ Status; Body } (the same as setup\_shared\SI-KedaConvert.ps1).
|#>
|
|$script:SIRaWorkerJobsLibRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|if (-not (Get-Command ConvertFrom-SIJobCreateArgs -ErrorAction SilentlyContinue)) { . ([IO.Path]::Combine($script:SIRaWorkerJobsLibRoot, 'setup', '_shared', 'SI-KedaConvert.ps1')) }
|if (-not (Get-Command Get-SIRaWorkerEnvArgs -ErrorAction SilentlyContinue)) { . ([IO.Path]::Combine($script:SIRaWorkerJobsLibRoot, 'container', '_shared', 'SI-ContainerConfig.ps1')) }
|
|$script:SIRaWorkerJobsArmApi = '2025-07-01'
|
|function Get-SIRaWorkerJobPlan {
|    <#
|        PURE. Per grain with workers (Detailed): create | flag (the worker exists, its producer is not told yet) | present |
|        keep (Reason says why) | none (no Risk Analysis job of that grain) | off (the customer switched the workers off, and
|        no Risk Analysis job is told it is a producer) | unflag (switched off, and the Risk Analysis job SI's setup made is
|        still told it is a producer). -Jobs: the job list (ARM shape). -UpdaterRaScaleOut: SI_UPDATER_RA_SCALE_OUT of the
|        updater job. Returns @(@{ Grain; Engine; Producer; Worker; Action; Reason; AuthMode; Identity; StorageAccount }).
|    #>
|    param([object[]]$Jobs = @(), [hashtable]$Globals = @{}, [string]$UpdaterUseKeda, [string]$UpdaterRaScaleOut)
|    $optIn = Get-SIRaScaleOutOptIn -Globals $Globals -UpdaterValue $UpdaterRaScaleOut
|    $byName = @{}
|    foreach ($j in @($Jobs)) { if ($j) { $n = [string](Get-SIKedaConvertProp $j @('name')); if ($n) { $byName[$n.ToLowerInvariant()] = $j } } }
|    $rows = New-Object System.Collections.Generic.List[object]
|    foreach ($engine in @('risk-analysis-detailed')) {
|        $grain = Get-SIRaScaleOutGrain -Engine $engine
|        $pName = Get-SIBootstrapJobName -Engine $engine
|        $wName = Get-SIRaWorkerJobName -Grain $grain
|        $row = [ordered]@{ Grain = $grain; Engine = $engine; Producer = $pName; Worker = $wName; Action = 'keep'; Reason = ''; AuthMode = ''; Identity = $null; StorageAccount = '' }
|        $p = $byName[$pName]
|        $env = @()
|        if ($p) { $env = @(ConvertTo-SIKedaConvertEnvArgs -Env @(Get-SIKedaConvertProp $p @('properties', 'template', 'containers') | Select-Object -First 1 | ForEach-Object { Get-SIKedaConvertProp $_ @('env') })) }
|        $flagged = ((Get-SIKedaConvertEnvValue -EnvArgs $env -Name 'SI_RA_SCALE_OUT') -match '^(?i)(1|true|on|yes)$') -and ((Get-SIKedaConvertEnvValue -EnvArgs $env -Name 'SI_RA_WORKER_JOB') -eq $wName)
|        # #831: a producer made before it knew the worker count (or with another) is told it again
|        $flagged = $flagged -and ([string](Get-SIKedaConvertEnvValue -EnvArgs $env -Name 'SI_RA_WORKERS') -eq [string](Get-SIRaWorkerMaxExecutions -Globals $Globals))
|        if (-not $optIn.On) {
|            # the customer's choice: the workers are off. A producer SI's setup made is told it is not one any more.
|            $row.Action = 'off'
|            $row.Reason = 'the Risk Analysis workers are switched off for this install (SI_Bootstrap_RaScaleOut = $false) -- the Risk Analysis reports run in their job'
|            if ($p -and ((Get-SIKedaConvertEnvValue -EnvArgs $env -Name 'SI_RA_SCALE_OUT') -or (Get-SIKedaConvertEnvValue -EnvArgs $env -Name 'SI_RA_WORKER_JOB'))) {
|                if (Test-SIBootstrapJobIsSI -Job $p) { $row.Action = 'unflag'; $row.Reason = 'the Risk Analysis workers are switched off for this install (SI_Bootstrap_RaScaleOut = $false), and the Risk Analysis job still hands its reports to them' }
|                else { $row.Reason = 'the Risk Analysis workers are switched off for this install, but SecurityInsight''s setup did not create the Risk Analysis job (no si-build tag), so the update does not change it' }
|            }
|            $rows.Add([pscustomobject]$row); continue
|        }
|        if (-not $p) { $row.Action = 'none'; $row.Reason = 'no Detailed Risk Analysis job'; $rows.Add([pscustomobject]$row); continue }
|        $ident = Get-SIKedaConvertJobIdentity -Job $p -ClientId (Get-SIKedaConvertEnvValue -EnvArgs $env -Name 'SI_UAMI_CLIENTID')
|        $authEnv = @{}; foreach ($a in $env) { $kv = ([string]$a) -split '=', 2; if ($kv.Count -eq 2) { $authEnv[$kv[0]] = $kv[1] } }
|        if ($ident) { $authEnv['IDENTITY_ENDPOINT'] = 'assigned' }
|        $auth = Resolve-SIContainerAuthMode -Environment $authEnv
|        $row.AuthMode = $auth.Mode; $row.Identity = $ident
|        $row.StorageAccount = Get-SIKedaConvertEnvValue -EnvArgs $env -Name 'SI_STORAGE_ACCOUNT'
|        if (-not $row.StorageAccount -and $Globals.ContainsKey('SI_StorageAccount')) { $row.StorageAccount = "$($Globals['SI_StorageAccount'])".Trim() }
|        $hasWorker = $byName.ContainsKey($wName)
|        $kedaCfg = Resolve-SIKedaConvertOptOut -Globals $Globals -UpdaterValue $UpdaterUseKeda
|        $kedaOff = ($null -ne $kedaCfg -and -not ("$kedaCfg".Trim() -match '^(?i)(1|true|on|yes)$'))
|        if ($kedaOff) { $row.Reason = 'queue scaling is switched off for this install (SI_Bootstrap_UseKEDA = $false) -- the Risk Analysis reports run in their job' }
|        elseif ($auth.Mode -eq 'Secret' -or $auth.Mode -eq 'None') { $row.Reason = 'its job signs in with a client secret, and the queue scaler needs the jobs'' managed identity -- the update never changes how the jobs sign in' }
|        elseif (-not $ident) { $row.Reason = 'the job''s managed identity could not be told apart (none, or more than one, assigned)' }
|        elseif (-not (Test-SIBootstrapJobIsSI -Job $p)) { $row.Reason = 'SecurityInsight''s setup did not create the Risk Analysis job (no si-build tag), so the update does not change it' }
|        elseif (-not $row.StorageAccount) { $row.Reason = 'the storage account that holds the work queue is not known (SI_STORAGE_ACCOUNT on the job)' }
|        elseif (-not [string](Get-SIKedaConvertProp $p @('properties', 'environmentId'))) { $row.Reason = 'the job''s Container Apps environment could not be read' }
|        elseif ($hasWorker -and $flagged) { $row.Action = 'present'; $row.Reason = 'already runs its reports on queue workers' }
|        elseif ($hasWorker) { $row.Action = 'flag'; $row.Reason = 'the worker job exists; the Risk Analysis job is not told yet' }
|        else { $row.Action = 'create'; $row.Reason = 'runs its reports one after another in one job' }
|        $rows.Add([pscustomobject]$row)
|    }
|    $rows.ToArray()
|}
|
|function Get-SIRaWorkerJobSpec {
|    <#
|        PURE. The worker job from its producer (the Risk Analysis job): Bootstrap's definition (Get-SIKedaWorkerCreateArgs on the
|        grain's work queue) with the producer's image, registry, identity, size, environment (Get-SIRaWorkerEnvArgs) and
|        secrets, translated to the ARM resource. -SecretArgs: name=value / name=keyvaultref:... of every secret the producer
|        carries (the registry password excluded -- -RegistryPassword). Returns @{ Name; Args; Body; Image; QueueName }.
|    #>
|    param([Parameter(Mandatory)]$Producer, [Parameter(Mandatory)]$Plan, [Parameter(Mandatory)][string]$ResourceGroup,
|          [object[]]$SecretArgs = @(), [string]$RegistryPassword, [int]$MaxExecutions = 4)
|    $c = @(Get-SIKedaConvertProp $Producer @('properties', 'template', 'containers'))[0]
|    $image = [string](Get-SIKedaConvertProp $c @('image'))
|    $env = @(ConvertTo-SIKedaConvertEnvArgs -Env @(Get-SIKedaConvertProp $c @('env')))
|    $cfg = Get-SIKedaConvertProp $Producer @('properties', 'configuration')
|    $timeout = [int](Get-SIKedaConvertProp $cfg @('replicaTimeout')); if ($timeout -le 0) { $timeout = [int](Get-SIJobRunLimit) }
|    $cpuRaw = Get-SIKedaConvertProp $c @('resources', 'cpu')
|    $cpu = if ($null -ne $cpuRaw -and "$cpuRaw".Trim()) { ([double]$cpuRaw).ToString([Globalization.CultureInfo]::InvariantCulture) } else { '4.0' }
|    $mem = [string](Get-SIKedaConvertProp $c @('resources', 'memory')); if (-not $mem) { $mem = '8Gi' }
|    $reg = @(Get-SIKedaConvertProp $cfg @('registries') | Where-Object { $_ })[0]
|    $login = [string](Get-SIKedaConvertProp $reg @('server')); if (-not $login) { $login = ($image -split '/')[0] }
|    $regArgs = @()
|    $regIdentity = [string](Get-SIKedaConvertProp $reg @('identity')); $regUser = [string](Get-SIKedaConvertProp $reg @('username'))
|    if ($regIdentity) { $regArgs = @(Get-SIRegistryPullArgs -Mode 'ManagedIdentity' -IdentityResourceId $regIdentity) }
|    elseif ($regUser -and $RegistryPassword) { $regArgs = @('--registry-username', $regUser, '--registry-password', $RegistryPassword) }
|    $build = [string](Get-SIKedaConvertProp $Producer @('tags', 'si-build'))
|    $envId = [string](Get-SIKedaConvertProp $Producer @('properties', 'environmentId'))
|    $location = [string](Get-SIKedaConvertProp $Producer @('location'))
|    $queue = Get-SIRaScaleOutQueueName -Grain $Plan.Grain
|    $a = @(Get-SIKedaWorkerCreateArgs -Name $Plan.Worker -ResourceGroup $ResourceGroup -Environment $envId -Image $image -LoginServer $login -ReplicaTimeout $timeout `
|            -Cpu $cpu -Memory $mem -MaxExecutions $MaxExecutions -Engine $Plan.Engine -StorageAccount $Plan.StorageAccount -IdentityResourceId ([string]$Plan.Identity.ResourceId) -QueueName $queue)
|    if ($build) { $a += @('--tags', "si-build=$build") }
|    $a += $regArgs
|    $a += @('--mi-user-assigned', [string]$Plan.Identity.ResourceId)
|    if (@($SecretArgs).Count) { $a += @('--secrets') + @($SecretArgs) }
|    $a += @('--env-vars') + @(Get-SIRaWorkerEnvArgs -EnvArgs $env -ReplicaTimeout $timeout -Workers $MaxExecutions)
|    [pscustomobject]@{ Name = $Plan.Worker; Args = $a; Body = (ConvertFrom-SIJobCreateArgs -CreateArgs $a -Location $location).Body; Image = $image; QueueName = $queue }
|}
|
|function Get-SIRaProducerFlagPatch {
|    <#
|        PURE. The PATCH that tells the Risk Analysis job it is the producer: its template as it is, with SI_RA_SCALE_OUT=on and
|        SI_RA_WORKER_JOB=<worker> set in its first container's environment (replaced when there, added when not); nothing
|        else changes. Returns @{ Body; Changed }.
|    #>
|    # -Workers (#831): SI_RA_WORKERS, the same count the workers get (Get-SIRaWorkerMaxExecutions)
|    param([Parameter(Mandatory)]$Producer, [Parameter(Mandatory)][string]$Grain, [int]$Workers = 0)
|    $t = Get-SIKedaConvertProp $Producer @('properties', 'template')
|    $tpl = ConvertTo-Json -InputObject $t -Depth 30 | ConvertFrom-Json
|    $c0 = @($tpl.containers)[0]
|    $want = [ordered]@{}; foreach ($e in @(Get-SIRaProducerScaleOutEnvArgs -Grain $Grain -Workers $Workers)) { $kv = ([string]$e) -split '=', 2; $want[$kv[0]] = $kv[1] }
|    $list = New-Object System.Collections.Generic.List[object]
|    $changed = $false
|    foreach ($e in @($c0.env)) {
|        if ($null -eq $e) { continue }
|        $n = [string]$e.name
|        if ($want.Contains($n)) { if ([string]$e.value -ne [string]$want[$n] -or $e.PSObject.Properties['secretRef']) { $changed = $true }; $list.Add([ordered]@{ name = $n; value = [string]$want[$n] }); $want.Remove($n); continue }
|        $list.Add($e)
|    }
|    foreach ($k in @($want.Keys)) { $list.Add([ordered]@{ name = $k; value = [string]$want[$k] }); $changed = $true }
|    $c0 | Add-Member -NotePropertyName env -NotePropertyValue $list.ToArray() -Force
|    [pscustomobject]@{ Body = [ordered]@{ properties = [ordered]@{ template = $tpl } }; Changed = $changed }
|}
|
|function Get-SIRaProducerUnflagPatch {
|    <#
|        PURE. The PATCH that tells the Risk Analysis job it is NOT a producer any more (the customer switched the workers
|        off): its template as it is, without SI_RA_SCALE_OUT and SI_RA_WORKER_JOB in its first container's environment;
|        nothing else changes. Returns @{ Body; Changed }.
|    #>
|    param([Parameter(Mandatory)]$Producer)
|    $t = Get-SIKedaConvertProp $Producer @('properties', 'template')
|    $tpl = ConvertTo-Json -InputObject $t -Depth 30 | ConvertFrom-Json
|    $c0 = @($tpl.containers)[0]
|    $list = New-Object System.Collections.Generic.List[object]
|    $changed = $false
|    foreach ($e in @($c0.env)) {
|        if ($null -eq $e) { continue }
|        if ([string]$e.name -in @('SI_RA_SCALE_OUT', 'SI_RA_WORKER_JOB', 'SI_RA_WORKERS')) { $changed = $true; continue }
|        $list.Add($e)
|    }
|    $c0 | Add-Member -NotePropertyName env -NotePropertyValue $list.ToArray() -Force
|    [pscustomobject]@{ Body = [ordered]@{ properties = [ordered]@{ template = $tpl } }; Changed = $changed }
|}
|
|function Test-SIRaWorkerReadBack {
|    <# PURE. The worker as Azure returned it: created, event-triggered with the queue rule on the work queue, on the image,
|       role worker. Returns '' (good) or what is wrong. #>
|    param($Worker, [Parameter(Mandatory)][string]$Image, [Parameter(Mandatory)][string]$QueueName)
|    if (-not $Worker) { return 'the worker could not be read back' }
|    $ps = [string](Get-SIKedaConvertProp $Worker @('properties', 'provisioningState'))
|    if ($ps -and $ps -ne 'Succeeded') { return ('the worker was not created (provisioning {0})' -f $ps) }
|    if ([string](Get-SIKedaConvertProp $Worker @('properties', 'configuration', 'triggerType')) -ne 'Event') { return 'the worker is not event-triggered' }
|    $rule = @(Get-SIKedaConvertProp $Worker @('properties', 'configuration', 'eventTriggerConfig', 'scale', 'rules') | Where-Object { $_ })[0]
|    if (-not $rule) { return 'the worker has no queue scale rule' }
|    $q = [string](Get-SIKedaConvertProp $rule @('metadata', 'queueName'))
|    if ($q -ne $QueueName) { return ('the worker''s scale rule reads {0}, not {1}' -f $q, $QueueName) }
|    $c = @(Get-SIKedaConvertProp $Worker @('properties', 'template', 'containers'))[0]
|    if ([string](Get-SIKedaConvertProp $c @('image')) -ne $Image) { return ('the worker runs {0}, not {1}' -f [string](Get-SIKedaConvertProp $c @('image')), $Image) }
|    $env = @(ConvertTo-SIKedaConvertEnvArgs -Env @(Get-SIKedaConvertProp $c @('env')))
|    if ((Get-SIKedaConvertEnvValue -EnvArgs $env -Name 'SI_RA_SCALEOUT_ROLE') -ne 'worker') { return 'the worker does not run as a Risk Analysis worker (SI_RA_SCALEOUT_ROLE)' }
|    ''
|}
|
|function Invoke-SIRaWorkerJobs {
|    <#
|        EXISTING INSTALLS: give the Detailed Risk Analysis job its queue-scaled worker job (the plan: Get-SIRaWorkerJobPlan).
|        -Rest: the REST seam (ARM https://management.azure.com/, the queue data plane https://storage.azure.com/). -WhatIf:
|        the plan only. Returns @{ Results = @(@{ Grain; Action = off | unflagged | would-unflag | created | flagged |
|        would-create | would-flag | present | keep | none | failed; Line }); Lines }. NEVER throws. Off (switched off by the
|        customer, no producer to undo) = not one call of -Rest.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [object[]]$Jobs = @(), [hashtable]$Globals = @{}, [string]$UpdaterUseKeda, [string]$UpdaterRaScaleOut, [switch]$WhatIf, [int]$PollSeconds = 5, [int]$PollMax = 36)
|    $results = New-Object System.Collections.Generic.List[object]
|    $lines = New-Object System.Collections.Generic.List[string]
|    $add = { param($r, $a, $l) $results.Add([pscustomobject]@{ Grain = $r.Grain; Worker = $r.Worker; Action = $a; Line = $l }); if ($l) { $lines.Add($l) } }
|    try {
|        $plan = @(Get-SIRaWorkerJobPlan -Jobs $Jobs -Globals $Globals -UpdaterUseKeda $UpdaterUseKeda -UpdaterRaScaleOut $UpdaterRaScaleOut)
|        $arm = 'https://management.azure.com/'; $stor = 'https://storage.azure.com/'
|        $api = $script:SIRaWorkerJobsArmApi
|        $call = {
|            param([string]$Method, [string]$Uri, $Body, [string]$Resource, [hashtable]$Headers)
|            $r = $null
|            try { $r = & $Rest $Method $Uri $Body $Resource $Headers } catch { $r = [pscustomobject]@{ Status = 0; Body = $_.Exception.Message } }
|            if (-not $r) { $r = [pscustomobject]@{ Status = 0; Body = 'no answer' } }
|            $r
|        }
|        $isOk = { param($r) $r -and [int]$r.Status -ge 200 -and [int]$r.Status -lt 300 }
|        $parse = { param($r) if (-not $r -or -not "$($r.Body)".Trim()) { return $null }; $o = $null; try { $o = ("$($r.Body)" | ConvertFrom-Json) } catch { $o = $null }; return $o }
|        $why = { param($r) $t = ("$(if ($r) { $r.Body })" -replace '\s+', ' ').Trim(); if ($t.Length -gt 300) { $t = $t.Substring(0, 297) + '...' }; ('HTTP {0}{1}' -f $(if ($r) { [int]$r.Status } else { 0 }), $(if ($t) { ": $t" } else { '' })) }
|        $jobUri = { param($n, [string]$Action) 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs/{2}{3}?api-version={4}' -f $SubscriptionId, $ResourceGroup, $n, $Action, $api }
|        $toJson = { param($o) ConvertTo-Json -InputObject $o -Depth 30 -Compress }
|        $readBack = {
|            param([string]$n)
|            $j = $null
|            for ($k = 1; $k -le [Math]::Max(1, $PollMax); $k++) {
|                $r = & $call 'GET' (& $jobUri $n) $null $arm $null
|                if (-not (& $isOk $r)) { return $null }
|                $j = & $parse $r
|                $ps = [string](Get-SIKedaConvertProp $j @('properties', 'provisioningState'))
|                if (-not $ps -or $ps -in @('Succeeded', 'Failed', 'Canceled')) { return $j }
|                if ($k -lt $PollMax -and $PollSeconds -gt 0) { Start-Sleep -Seconds $PollSeconds }
|            }
|            $j
|        }
|        $byName = @{}; foreach ($j in @($Jobs)) { if ($j) { $byName[([string](Get-SIKedaConvertProp $j @('name'))).ToLowerInvariant()] = $j } }
|        $max = Get-SIRaWorkerMaxExecutions -Globals $Globals
|        # the producer is told it is one: its environment, read-modify-write, read back
|        $flag = {
|            param($row, $prod)
|            $fp = Get-SIRaProducerFlagPatch -Producer $prod -Grain $row.Grain -Workers $max
|            if ($fp.Changed) {
|                $r = & $call 'PATCH' (& $jobUri $row.Producer) (& $toJson $fp.Body) $arm @{ 'Content-Type' = 'application/json' }
|                if (-not (& $isOk $r)) { return ('the Risk Analysis job could not be told it is the producer ({0})' -f (& $why $r)) }
|            }
|            $pb = & $readBack $row.Producer
|            $penv = @(ConvertTo-SIKedaConvertEnvArgs -Env @(Get-SIKedaConvertProp $pb @('properties', 'template', 'containers') | Select-Object -First 1 | ForEach-Object { Get-SIKedaConvertProp $_ @('env') }))
|            if ((Get-SIKedaConvertEnvValue -EnvArgs $penv -Name 'SI_RA_SCALE_OUT') -ne 'on' -or (Get-SIKedaConvertEnvValue -EnvArgs $penv -Name 'SI_RA_WORKER_JOB') -ne $row.Worker) { return 'the Risk Analysis job did not read back as the producer' }
|            # #831: the producer plans the parts of a big report for the real worker count
|            if ([string](Get-SIKedaConvertEnvValue -EnvArgs $penv -Name 'SI_RA_WORKERS') -ne [string]$max) { return ('the Risk Analysis job did not read back with the worker count (SI_RA_WORKERS={0})' -f $max) }
|            ''
|        }
|        foreach ($row in $plan) {
|            if ($row.Action -eq 'off') { & $add $row 'off' ('risk analysis workers: {0}' -f $row.Reason); continue }
|            if ($row.Action -eq 'unflag') {
|                # the customer's off: the Risk Analysis job runs its reports itself again -- read-modify-write, read back
|                if ($WhatIf) { & $add $row 'would-unflag' ('risk analysis workers: {0} would run its reports itself again -- the workers are switched off (re-run with -Apply)' -f $row.Producer); continue }
|                $prod = $byName[$row.Producer.ToLowerInvariant()]
|                $up = Get-SIRaProducerUnflagPatch -Producer $prod
|                $bad = ''
|                $r = & $call 'PATCH' (& $jobUri $row.Producer) (& $toJson $up.Body) $arm @{ 'Content-Type' = 'application/json' }
|                if (-not (& $isOk $r)) { $bad = ('it could not be changed ({0})' -f (& $why $r)) }
|                else {
|                    $pb = & $readBack $row.Producer
|                    $penv = @(ConvertTo-SIKedaConvertEnvArgs -Env @(Get-SIKedaConvertProp $pb @('properties', 'template', 'containers') | Select-Object -First 1 | ForEach-Object { Get-SIKedaConvertProp $_ @('env') }))
|                    if (-not $pb) { $bad = 'it could not be read back' }
|                    elseif ((Get-SIKedaConvertEnvValue -EnvArgs $penv -Name 'SI_RA_SCALE_OUT') -or (Get-SIKedaConvertEnvValue -EnvArgs $penv -Name 'SI_RA_WORKER_JOB')) { $bad = 'it still read back as the producer' }
|                }
|                if ($bad) { & $add $row 'failed' ('risk analysis workers: switched off, but {0} was NOT told to run its reports itself ({2}) -- it still hands them to {1}; the next update tries again' -f $row.Producer, $row.Worker, $bad) }
|                else { & $add $row 'unflagged' ('risk analysis workers: switched off -- {0} runs its reports itself again (read back); {1} stays idle' -f $row.Producer, $row.Worker) }
|                continue
|            }
|            if ($row.Action -eq 'none') { & $add $row 'none' ''; continue }
|            if ($row.Action -eq 'present') { & $add $row 'present' ''; continue }
|            if ($row.Action -eq 'keep') { & $add $row 'keep' ('risk analysis workers: {0} runs its reports in its own job -- {1}' -f $row.Producer, $row.Reason); continue }
|            $prod = $byName[$row.Producer.ToLowerInvariant()]
|            if ($WhatIf) {
|                if ($row.Action -eq 'flag') { & $add $row 'would-flag' ('risk analysis workers: {0} would be told to hand its reports to {1} (re-run with -Apply)' -f $row.Producer, $row.Worker) }
|                else { & $add $row 'would-create' ('risk analysis workers: {0} would get queue-scaled workers ({1}, up to {2} at once) and hand its reports to them (re-run with -Apply)' -f $row.Producer, $row.Worker, $max) }
|                continue
|            }
|            if ($row.Action -eq 'flag') {
|                $bad = & $flag $row $prod
|                if ($bad) { & $add $row 'failed' ('risk analysis workers: {0} was NOT told to hand its reports to {1} ({2}) -- it runs them itself; the next update tries again' -f $row.Producer, $row.Worker, $bad) }
|                else { & $add $row 'flagged' ('risk analysis workers: {0} now hands its reports to {1}' -f $row.Producer, $row.Worker) }
|                continue
|            }
|            $created = $false
|            $fail = {
|                param([string]$Reason)
|                if ($created) { $null = & $call 'DELETE' (& $jobUri $row.Worker) $null $arm $null }
|                & $add $row 'failed' ('risk analysis workers: {0} was NOT given its workers ({1}) -- it runs its reports itself, as before; the next update tries again' -f $row.Producer, $Reason)
|            }
|            try {
|                # (1) the storage account, and the queue scaler's role on it for the jobs' identity
|                $acct = $row.StorageAccount.ToLowerInvariant(); $stgId = ''; $last = ''
|                foreach ($rgName in @($ResourceGroup, $(if ($Globals.ContainsKey('SI_StorageResourceGroup')) { "$($Globals['SI_StorageResourceGroup'])".Trim() }) | Where-Object { $_ } | Select-Object -Unique)) {
|                    if ($stgId) { break }
|                    $r = & $call 'GET' ('https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Storage/storageAccounts/{2}?api-version=2023-05-01' -f $SubscriptionId, $rgName, $acct) $null $arm $null
|                    if (& $isOk $r) { $stgId = [string](Get-SIKedaConvertProp (& $parse $r) @('id')) } else { $last = (& $why $r) }
|                }
|                if (-not $stgId) { & $fail ('the storage account {0} could not be read{1}' -f $row.StorageAccount, $(if ($last) { ' -- Azure answered ' + $last } else { '' })); continue }
|                $principal = [string]$row.Identity.PrincipalId
|                if (-not $principal) { & $fail 'the managed identity''s object id could not be read'; continue }
|                $roleOk = $false; $grantWhy = ''
|                $flt = [uri]::EscapeDataString(("principalId eq '{0}'" -f $principal))
|                $r = & $call 'GET' ('https://management.azure.com{0}/providers/Microsoft.Authorization/roleAssignments?$filter={1}&api-version=2022-04-01' -f $stgId, $flt) $null $arm $null
|                if (& $isOk $r) {
|                    $ids = @(@(Get-SIKedaConvertProp (& $parse $r) @('value')) | Where-Object { $_ } | ForEach-Object { ([string](Get-SIKedaConvertProp $_ @('properties', 'roleDefinitionId'))).ToLowerInvariant() })
|                    $roleOk = [bool](@($ids | Where-Object { $_.EndsWith('/974c5e8b-45b9-4653-ba55-5f855dd0fb88') -or $_.EndsWith('/19e7f393-937e-4f77-808e-94535e297925') }).Count)
|                    if (-not $roleOk) {
|                        $body = [ordered]@{ properties = [ordered]@{ roleDefinitionId = ('/subscriptions/{0}/providers/Microsoft.Authorization/roleDefinitions/974c5e8b-45b9-4653-ba55-5f855dd0fb88' -f $SubscriptionId); principalId = $principal; principalType = 'ServicePrincipal' } }
|                        $g = & $call 'PUT' ('https://management.azure.com{0}/providers/Microsoft.Authorization/roleAssignments/{1}?api-version=2022-04-01' -f $stgId, [guid]::NewGuid().ToString()) (& $toJson $body) $arm $null
|                        if (& $isOk $g) { $roleOk = $true } else { $grantWhy = ('the jobs'' identity lacks Storage Queue Data Contributor on the storage account and it could not be granted here ({0}) -- grant it once to object id {1} on {2}' -f (& $why $g), $principal, $stgId) }
|                    }
|                } else { $grantWhy = ('the role assignments on the storage account could not be read ({0})' -f (& $why $r)) }
|                if (-not $roleOk) { & $fail $grantWhy; continue }
|                # (2) the producer's secrets, with their values (Key Vault references as references)
|                $secretArgs = @(); $regPassword = ''
|                $reg = @(Get-SIKedaConvertProp $prod @('properties', 'configuration', 'registries') | Where-Object { $_ })[0]
|                $regPwRef = [string](Get-SIKedaConvertProp $reg @('passwordSecretRef'))
|                if (@(Get-SIKedaConvertProp $prod @('properties', 'configuration', 'secrets') | Where-Object { $_ }).Count) {
|                    $r = & $call 'POST' (& $jobUri $row.Producer '/listSecrets') $null $arm $null
|                    if (-not (& $isOk $r)) { & $fail ('the Risk Analysis job''s secrets could not be read ({0})' -f (& $why $r)); continue }
|                    foreach ($s in @(Get-SIKedaConvertProp (& $parse $r) @('value'))) {
|                        $sn = [string](Get-SIKedaConvertProp $s @('name')); if (-not $sn) { continue }
|                        $kvu = [string](Get-SIKedaConvertProp $s @('keyVaultUrl')); $val = [string](Get-SIKedaConvertProp $s @('value'))
|                        if ($sn -eq $regPwRef) { $regPassword = $val; continue }
|                        if ($kvu) { $id = [string](Get-SIKedaConvertProp $s @('identity')); $secretArgs += $(if ($id) { '{0}=keyvaultref:{1},identityref:{2}' -f $sn, $kvu, $id } else { '{0}=keyvaultref:{1}' -f $sn, $kvu }) }
|                        else { $secretArgs += ('{0}={1}' -f $sn, $val) }
|                    }
|                }
|                if ($regPwRef -and -not $regPassword -and -not [string](Get-SIKedaConvertProp $reg @('identity'))) { & $fail 'the registry password of the Risk Analysis job could not be read'; continue }
|                $spec = Get-SIRaWorkerJobSpec -Producer $prod -Plan $row -ResourceGroup $ResourceGroup -SecretArgs $secretArgs -RegistryPassword $regPassword -MaxExecutions $max
|                # (3) the work queue (the producer creates it on its first run as well)
|                $r = & $call 'PUT' ('https://{0}.queue.core.windows.net/{1}' -f $acct, $spec.QueueName) $null $stor @{ 'x-ms-version' = '2021-08-06' }
|                if (-not ((& $isOk $r) -or [int]$r.Status -eq 409)) { $lines.Add(('risk analysis workers: the queue {0} could not be created from here ({1}) -- the producer creates it on its first run' -f $spec.QueueName, (& $why $r))) }
|                # (4) the worker -- idle until the producer queues reports, so creating it starts nothing
|                $r = & $call 'GET' (& $jobUri $spec.Name) $null $arm $null
|                if (& $isOk $r) { & $add $row 'present' ('risk analysis workers: {0} exists now (made meanwhile) -- the next update tells the Risk Analysis job' -f $spec.Name); continue }
|                $r = & $call 'PUT' (& $jobUri $spec.Name) (& $toJson $spec.Body) $arm @{ 'Content-Type' = 'application/json' }
|                if (-not (& $isOk $r)) { & $fail ('Azure refused the worker: {0}' -f (& $why $r)); continue }
|                $created = $true
|                $bad = Test-SIRaWorkerReadBack -Worker (& $readBack $spec.Name) -Image $spec.Image -QueueName $spec.QueueName
|                if ($bad) { & $fail ('read back: {0}' -f $bad); continue }
|                # (5) only now the producer is told -- a worker without its producer's flag is idle, never two layouts at once
|                $bad = & $flag $row $prod
|                if ($bad) { & $add $row 'failed' ('risk analysis workers: {0} was created, but {1} was NOT told to hand its reports to it ({2}) -- it runs them itself; the next update tells it' -f $spec.Name, $row.Producer, $bad); continue }
|                & $add $row 'created' ('risk analysis workers: {0} now hands its reports to up to {1} queue-scaled workers ({2}) -- created, read back' -f $row.Producer, $max, $spec.Name)
|            } catch { & $fail $_.Exception.Message }
|        }
|        if (-not @($results | Where-Object { $_.Line }).Count) { $lines.Add('risk analysis workers: nothing to do') }
|    } catch {
|        $lines.Add(('risk analysis workers: not checked ({0}) -- the update goes on; the next update tries again' -f $_.Exception.Message))
|    }
|    [pscustomobject]@{ Results = $results.ToArray(); Lines = $lines.ToArray() }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-RaGcSetting.ps1'] = @{ Sha256 = '11f9c7cc4cd7cb09bcf845e05341ee97e96a2be45f02727c1049e265adde67ec'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- #873 E: THE RISK ANALYSIS JOBS RUN WITH A LARGER .NET GEN0 BUDGET (DOTNET_GCgen0size), ON BY DEFAULT.
|
|    Measured (REQUIREMENTS #716, test VM): the per-row work of a Detailed slice allocates ~1.6 MB per row in PowerShell, and
|    the default workstation GC stops every scoring runspace for each gen0 collection (~1,000 per slice, 7.3 s of a 17 s
|    four-core run). DOTNET_GCgen0size=10000000 (hex: 256 MB) took the four-core run to 14.5 s. It is a runtime setting of the
|    process: no row, no order and no verdict depends on it (tests\pester\SIv3-RaGcSetting.Tests.ps1 proves the stored rows
|    identical with it set and unset, in child processes, and measures the memory peak).
|
|      NEW INSTALL   Bootstrap gives every Risk Analysis job the variable (container\_shared\SI-ContainerConfig.ps1
|                    Get-SIRaJobEnvArgs); its queue worker copies the producer's environment (Get-SIRaWorkerEnvArgs).
|      EXISTING      every update (setup\Invoke-SIContainerUpdate.ps1 Invoke-SIUpdateRaGcSetting) gives each Risk Analysis job,
|                    its extra report jobs and its queue workers the variable when it is missing: one read-modify-write PATCH
|                    of the first container's environment (nothing else changes), READ BACK. A job that already has the
|                    variable keeps its value (a value an operator set is never overwritten).
|      OFF           SI_Bootstrap_RaGcGen0Size = off (false / no / 0) in the customer's settings: the variable is not added
|                    (one line says so); a job that has it keeps it.
|    Never throws; -WhatIf: the plan only, no Azure call. ONE seam, -Rest { param($Method, $Uri, $Body, $Resource, $Headers) }
|    -> @{ Status; Body } (the update's REST seam). No az CLI, no PowerShell module.
|#>
|
|$script:SIRaGcName = 'DOTNET_GCgen0size'
|$script:SIRaGcValue = '10000000'      # hexadecimal, as the .NET runtime reads GC settings: 0x10000000 = 256 MB
|$script:SIRaGcArmApi = '2025-07-01'
|
|function Get-SIRaGcEnvArg {
|    <# PURE. The env var every Risk Analysis job gets ('DOTNET_GCgen0size=10000000'). #>
|    '{0}={1}' -f $script:SIRaGcName, $script:SIRaGcValue
|}
|
|function Test-SIRaGcOn {
|    <# PURE. Whether the setting is on: unset = ON; SI_Bootstrap_RaGcGen0Size off / false / no / 0 = off. #>
|    param([hashtable]$Globals = @{})
|    if ($null -eq $Globals -or -not $Globals.ContainsKey('SI_Bootstrap_RaGcGen0Size')) { return $true }
|    $v = ([string]$Globals['SI_Bootstrap_RaGcGen0Size']).Trim()
|    if (-not $v) { return $true }
|    -not ($v -match '^(?i)(off|false|no|0|disabled?)$')
|}
|
|function Test-SIRaGcJobName {
|    <# PURE. A Risk Analysis job: caj-si-risk-analysis-<grain>, an extra report job caj-si-ra-<name>, a queue worker
|       caj-si-raworker-<grain>. #>
|    param([string]$Name)
|    ([string]$Name).ToLowerInvariant() -match '^caj-si-(risk-analysis-|ra-|raworker-)'
|}
|
|function Get-SIRaGcJobEnv {
|    <# PURE. The first container's env list of a job (ARM shape), @() when none. #>
|    param($Job)
|    if ($null -eq $Job -or -not $Job.PSObject.Properties['properties'] -or $null -eq $Job.properties.template) { return @() }
|    $c = @($Job.properties.template.containers)[0]
|    if ($null -eq $c -or -not $c.PSObject.Properties['env']) { return @() }
|    @($c.env | Where-Object { $null -ne $_ })
|}
|
|function Test-SIRaGcJobHas {
|    <# PURE. Whether the job's first container already carries DOTNET_GCgen0size (any value). #>
|    param($Job)
|    [bool](@(Get-SIRaGcJobEnv -Job $Job | Where-Object { [string]$_.name -eq $script:SIRaGcName }).Count)
|}
|
|function Get-SIRaGcPatch {
|    <# PURE. The PATCH that adds DOTNET_GCgen0size to the job's first container: its template as it is, the variable added
|       at the end of the env list when it is missing; nothing else changes. Returns @{ Body; Changed }. #>
|    param([Parameter(Mandatory)]$Job)
|    $tpl = ConvertTo-Json -InputObject $Job.properties.template -Depth 30 | ConvertFrom-Json
|    $c0 = @($tpl.containers)[0]
|    $list = New-Object System.Collections.Generic.List[object]
|    foreach ($e in @(Get-SIRaGcJobEnv -Job ([pscustomobject]@{ properties = [pscustomobject]@{ template = $tpl } }))) { $list.Add($e) }
|    $changed = $false
|    if (-not @($list | Where-Object { [string]$_.name -eq $script:SIRaGcName }).Count) { $list.Add([ordered]@{ name = $script:SIRaGcName; value = $script:SIRaGcValue }); $changed = $true }
|    $c0 | Add-Member -NotePropertyName env -NotePropertyValue $list.ToArray() -Force
|    [pscustomobject]@{ Body = [ordered]@{ properties = [ordered]@{ template = $tpl } }; Changed = $changed }
|}
|
|function Invoke-SIRaGcSetting {
|    <#
|        EVERY UPDATE: each Risk Analysis job (Test-SIRaGcJobName) without DOTNET_GCgen0size gets it -- GET, PATCH, READ BACK.
|        -Jobs: the job list (ARM shape) the update read. Returns @(@{ Job; Action = set | would-set | off | failed; Line }) --
|        empty when every Risk Analysis job has it. Never throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [object[]]$Jobs = @(), [hashtable]$Globals = @{}, [switch]$WhatIf)
|    $out = New-Object System.Collections.Generic.List[object]
|    $todo = @(@($Jobs) | Where-Object { $_ -and (Test-SIRaGcJobName -Name ([string]$_.name)) -and -not (Test-SIRaGcJobHas -Job $_) })
|    if (-not $todo.Count) { return $out.ToArray() }
|    if (-not (Test-SIRaGcOn -Globals $Globals)) {
|        $out.Add([pscustomobject]@{ Job = ''; Action = 'off'; Line = ('risk analysis GC: switched off (SI_Bootstrap_RaGcGen0Size) -- {0} job(s) keep the default .NET gen0 budget' -f $todo.Count) })
|        return $out.ToArray()
|    }
|    foreach ($j in $todo) {
|        $name = [string]$j.name
|        $line = 'risk analysis GC: {0} gets {1} (a 256 MB gen0 budget: fewer pauses while rows are scored; no row changes)' -f $name, (Get-SIRaGcEnvArg)
|        if ($WhatIf) { $out.Add([pscustomobject]@{ Job = $name; Action = 'would-set'; Line = ($line + ' (re-run with -Apply)') }); continue }
|        try {
|            $uri = 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.App/jobs/{2}?api-version={3}' -f $SubscriptionId, $ResourceGroup, $name, $script:SIRaGcArmApi
|            $g = & $Rest 'GET' $uri $null 'https://management.azure.com/' $null
|            if (-not ($g -and [int]$g.Status -ge 200 -and [int]$g.Status -lt 300)) { throw ('the job could not be read (HTTP {0})' -f $(if ($g) { [int]$g.Status } else { 0 })) }
|            $now = "$($g.Body)" | ConvertFrom-Json
|            if (Test-SIRaGcJobHas -Job $now) { continue }
|            $p = Get-SIRaGcPatch -Job $now
|            $r = & $Rest 'PATCH' $uri (ConvertTo-Json -InputObject $p.Body -Depth 30 -Compress) 'https://management.azure.com/' @{ 'Content-Type' = 'application/json' }
|            if (-not ($r -and [int]$r.Status -ge 200 -and [int]$r.Status -lt 300)) { throw ('Azure refused the change (HTTP {0})' -f $(if ($r) { [int]$r.Status } else { 0 })) }
|            $b = & $Rest 'GET' $uri $null 'https://management.azure.com/' $null
|            $back = $null; if ($b -and [int]$b.Status -ge 200 -and [int]$b.Status -lt 300) { $back = "$($b.Body)" | ConvertFrom-Json }
|            if (-not (Test-SIRaGcJobHas -Job $back)) { throw 'Azure accepted the change but the job does not read back with it' }
|            $out.Add([pscustomobject]@{ Job = $name; Action = 'set'; Line = $line })
|        } catch {
|            $why = ("$($_.Exception.Message)" -replace '\s+', ' ').Trim(); if ($why.Length -gt 300) { $why = $why.Substring(0, 297) + '...' }
|            $out.Add([pscustomobject]@{ Job = $name; Action = 'failed'; Line = ('risk analysis GC: {0} did NOT get {1} ({2}) -- it runs as before; the next update tries again' -f $name, $script:SIRaGcName, $why) })
|        }
|    }
|    $out.ToArray()
|}
'@ }
$__siSupportFiles['engine/_shared/SI-InstallNames.ps1'] = @{ Sha256 = '63b8074518113373d957f5cb845df078a38098960f58790cec4621af644a7d93'; Text = @'
|#Requires -Version 5.1
|<#
|    SI-InstallNames.ps1 -- the names of THIS install's own Azure resources, read from one place (framework DOCS/REQUIREMENTS.md
|    section 12.11c NAMING item 6, SI REQUIREMENTS #655 step 1): never a literal in the code that looks a resource up, so the names
|    every install runs with today and the shorter names a NEW install gets later (a separate step) work side by side.
|
|    TODAY'S NAME IS THE DEFAULT (owner 2026-10-14: existing installs keep what they have): an install with no record and no
|    variable resolves exactly the names it runs with now -- nothing is renamed, nothing has to be set.
|
|    Resolution, per role (the first that answers):
|      1. the install record: cfg.InstallState 'InstallNames' (compact JSON, one name per role + recordedUtc), written by the
|         updater (Save-SIInstallNamesRecord) from what it runs with -- preloaded per process in $global:SI_InstallNames
|      2. the variables an install's updater job carries (SI_UPDATER_WEB_APP, SI_UPDATER_MCP_APP, SI_UPDATER_JOB_NAME; set by
|         setup\Install-SIUpdaterJob.ps1)
|      3. today's name (Get-SIInstallNameDefaults)
|    A record that cannot be read is never an error: the next source answers.
|    Get-SIInstallNameCandidates gives a FINDER every name worth trying, in order (the resolved name, then today's name), so a
|    lookup keeps working on an install whose record names something else.
|
|    Pure except Read-SIInstallNamesRecord / Save-SIInstallNamesRecord (one cfg.InstallState read / write over -Store).
|    ASCII only; PowerShell 5.1-safe.
|#>
|
|function Get-SIInstallNameDefaults {
|    <# PURE. Today's names -- what every existing install runs with. A table in a function, not a $script: variable, so a
|       caller that dot-sources this file from another scope still sees it. #>
|    [ordered]@{
|        web             = 'ca-si-management'                 # the Pro web app
|        mcp             = 'ca-si-mcp'                        # its MCP server
|        updater         = 'caj-si-updater'                   # the product updater job
|        templates       = 'caj-si-templates'                 # the template release job
|        webIdentity     = 'uami-si-management'               # the web app's own identity
|        mcpIdentity     = 'uami-si-mcp'                      # the MCP server's own identity
|        updaterIdentity = 'uami-si-updater'                  # the updater job's own identity
|        taggingIdentity = 'uami-securityinsight-tagging'     # asset tagging's own identity
|    }
|}
|
|function Get-SIInstallNameRoles { @((Get-SIInstallNameDefaults).Keys) }
|
|function Get-SIInstallNameVariable {
|    <# PURE. The updater job's variable that names -Role ('' = none). #>
|    param([Parameter(Mandatory)][string]$Role)
|    switch ($Role) {
|        'web'     { 'SI_UPDATER_WEB_APP' }
|        'mcp'     { 'SI_UPDATER_MCP_APP' }
|        'updater' { 'SI_UPDATER_JOB_NAME' }
|        default   { '' }
|    }
|}
|
|function Test-SIInstallNameValue {
|    <# PURE. A name accepted from a record or a variable: an Azure resource name, 2-90 letters, digits, '-', '_', '.'. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    [bool]("$Value".Trim() -match '^[A-Za-z0-9][A-Za-z0-9._-]{1,89}$')
|}
|
|function Get-SIInstallNameProp {
|    <# PURE. One role's value from a record (a hashtable, a parsed JSON object or a JSON string); '' when it has none. #>
|    param([AllowNull()]$Record, [Parameter(Mandatory)][string]$Role)
|    if ($null -eq $Record) { return '' }
|    if ($Record -is [string]) { $Record = ConvertFrom-SIInstallNamesValue -Value $Record; if ($null -eq $Record) { return '' } }
|    if ($Record -is [System.Collections.IDictionary]) { if ($Record.Contains($Role)) { return "$($Record[$Role])".Trim() } else { return '' } }
|    if ($Record.PSObject.Properties[$Role]) { return "$($Record.$Role)".Trim() }
|    ''
|}
|
|function ConvertFrom-SIInstallNamesValue {
|    <# PURE. The cfg.InstallState 'InstallNames' value (compact JSON) as an object; $null when empty or not JSON. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    if (-not "$Value".Trim()) { return $null }
|    try { $o = "$Value" | ConvertFrom-Json -ErrorAction Stop } catch { return $null }
|    if ($o -is [System.Management.Automation.PSCustomObject]) { return $o }
|    $null
|}
|
|function Get-SIInstallName {
|    <#
|        THE name of one part of this install. -Role: web | mcp | updater | templates | webIdentity | mcpIdentity |
|        updaterIdentity | taggingIdentity. Record -> variable -> today's name (see the header). -Record: the record a caller
|        already holds (else $global:SI_InstallNames); -NoRecord skips it. -Env: variables to read before the process's own
|        (the updater's run hashtable; tests). Never throws for a known role; an unknown role throws (a typo must never
|        quietly become another resource).
|    #>
|    param([Parameter(Mandatory)][string]$Role, [AllowNull()]$Record = $null, [switch]$NoRecord, [hashtable]$Env = @{})
|    $defaults = Get-SIInstallNameDefaults
|    if (-not $defaults.Contains($Role)) { throw ("Get-SIInstallName: unknown role '{0}' (known: {1})" -f $Role, ((Get-SIInstallNameRoles) -join ', ')) }
|    if (-not $NoRecord) {
|        $rec = if ($null -ne $Record) { $Record } else { $global:SI_InstallNames }
|        $v = Get-SIInstallNameProp -Record $rec -Role $Role
|        if (Test-SIInstallNameValue $v) { return $v }
|    }
|    $var = Get-SIInstallNameVariable -Role $Role
|    if ($var) {
|        $e = if ($Env.ContainsKey($var)) { "$($Env[$var])".Trim() } else { "$([Environment]::GetEnvironmentVariable($var))".Trim() }
|        if (Test-SIInstallNameValue $e) { return $e }
|    }
|    [string]$defaults[$Role]
|}
|
|function Get-SIInstallNameCandidates {
|    <# PURE apart from Get-SIInstallName's reads. Every name a FINDER tries for -Role, in order: the resolved name, then
|       today's name; no duplicates (case-insensitive). #>
|    param([Parameter(Mandatory)][string]$Role, [AllowNull()]$Record = $null, [hashtable]$Env = @{})
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($n in @((Get-SIInstallName -Role $Role -Record $Record -Env $Env), [string](Get-SIInstallNameDefaults)[$Role])) {
|        if ((Test-SIInstallNameValue $n) -and -not @($out | Where-Object { $_ -ieq $n }).Count) { $out.Add("$n".Trim()) }
|    }
|    $out.ToArray()
|}
|
|function New-SIInstallNamesRecord {
|    <#
|        PURE. The record the updater stores: -Names (role -> name; an empty or invalid name is left out) over -Current (what
|        is stored; a hashtable, object or JSON). A role -Names does not give keeps its stored value; a role neither gives is
|        left out (its readers fall back to the variable, then today's name). Returns @{ Record (ordered, + recordedUtc);
|        Value (compact JSON); Changed }.
|    #>
|    param([hashtable]$Names = @{}, [AllowNull()]$Current = $null, [datetime]$NowUtc = [datetime]::UtcNow)
|    $out = [ordered]@{}; $changed = $false
|    foreach ($r in (Get-SIInstallNameRoles)) {
|        $cur = Get-SIInstallNameProp -Record $Current -Role $r
|        $new = if ($Names.ContainsKey($r)) { "$($Names[$r])".Trim() } else { '' }
|        if (Test-SIInstallNameValue $new) { $out[$r] = $new } elseif (Test-SIInstallNameValue $cur) { $out[$r] = $cur }
|        if ($out.Contains($r) -and $out[$r] -cne $cur) { $changed = $true }
|    }
|    $out['recordedUtc'] = $NowUtc.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture)
|    @{ Record = $out; Value = ($out | ConvertTo-Json -Compress); Changed = $changed }
|}
|
|function Read-SIInstallNamesRecord {
|    <# The stored record (cfg.InstallState 'InstallNames') over -Store (the Pro database: $Store.Invoke $sql $params 'reader');
|       $null when there is none, the table is not there, or it cannot be read. Never throws. #>
|    param($Store)
|    if (-not $Store -or -not $Store.Invoke) { return $null }
|    $sql = "IF OBJECT_ID('cfg.InstallState') IS NOT NULL SELECT Value FROM cfg.InstallState WHERE Name = N'InstallNames';"
|    try {
|        # the store answers its rows as ONE array (', $out.ToArray()'): ForEach-Object unrolls it, as every reader does
|        $row = @(& $Store.Invoke $sql ([ordered]@{}) 'reader' | ForEach-Object { $_ } | Where-Object { $_ }) | Select-Object -First 1
|        if (-not $row) { return $null }
|        $v = if ($row -is [System.Collections.IDictionary]) { [string]$row['Value'] } elseif ($row.PSObject.Properties['Value']) { [string]$row.Value } else { [string]$row }
|        ConvertFrom-SIInstallNamesValue -Value $v
|    } catch { $null }
|}
|
|function Save-SIInstallNamesRecord {
|    <# The record (-Value, compact JSON from New-SIInstallNamesRecord) into cfg.InstallState 'InstallNames'. Never throws:
|       $true written, $false not. #>
|    param($Store, [AllowEmptyString()][string]$Value, [string]$By = 'caj-si-updater')
|    if (-not $Store -or -not $Store.Invoke -or -not "$Value".Trim()) { return $false }
|    $sql = @'
|IF OBJECT_ID('cfg.InstallState') IS NOT NULL
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N'InstallNames')
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'InstallNames';
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'InstallNames', @Value, NULL, @By);
|    COMMIT;
|END
|'@
|    try { $null = & $Store.Invoke $sql ([ordered]@{ Value = "$Value"; By = $By }) 'nonquery'; $true } catch { $false }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-PermissionNote.ps1'] = @{ Sha256 = '3cd713a2350c101389a4686a83eb9c46dfda2720d0075adb0300c755eaa8d60d'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- AN UPDATE SAYS WHICH READ-ONLY PERMISSIONS AN EXISTING INSTALL HAS NOT GRANTED YET (owner 2026-10-11:
|    SecurityInsight may ask for more read-only permissions; "customers grant on their next permission setup run").
|
|    A release can add a permission to config/permissions.locked.json. A new install grants it at setup; an existing install
|    keeps running without it -- the columns it feeds stay empty. Every update (setup/Invoke-SIContainerUpdate.ps1, last step)
|    therefore compares what SecurityInsight's COLLECTION identity holds with that list and writes, per missing permission,
|    ONE plain line (what it is for, that it is read-only, what stays empty) and the two lines that grant them.
|
|      * NEVER fails or holds an update, NEVER grants or changes anything: every call here is a GET (or the Log Analytics
|        query POST). Nothing is said when every permission is granted.
|      * What the identity holds is READ, never guessed:
|          1. the directory: the identity's application permissions (Microsoft Graph appRoleAssignments) against the app
|             roles of each API in the list;
|          2. when this update's sign-in may not read the directory (the updater job's identity has no directory right):
|             the collection engines' OWN check of their own access token, as recorded on their newest run
|             (SI_RunHealth_CL, engine/_shared/SI-PermissionCheck.ps1). A missing permission recorded there is exact. "Nothing
|             missing" counts only from a run that checked THIS list in full (the record carries the fingerprint of the
|             permissions it checked; a run made before a permission was added did not know it); otherwise the update says
|             in one line that it could not check.
|      * The command follows the rule for every command a person is shown: line 1 downloads the script from
|        https://invardia.com/support/si/, line 2 runs it with this install's names filled in (never a placeholder). When a
|        name is not known here, the line points at Get Started > Permissions instead.
|
|    Functions (all but Invoke-SIPermissionNote and the two readers are PURE):
|      Get-SIPermissionNoteCatalog      the collection identity's APIs + roles, and its engines, from the list
|      Get-SIPermissionNoteIdentity     the collection identity and the install's names, from the job list the update read
|      Get-SIPermissionNoteGranted      reader 1 (the directory)
|      Get-SIPermissionNoteFromRuns     reader 2 (the engines' own check)
|      Get-SIPermissionNoteMissing      the list minus what is held
|      Get-SIPermissionNoteCommand      the two lines
|      Get-SIPermissionNoteLines        the text
|      Invoke-SIPermissionNote          all of it; never throws
|
|    -Rest is the update's REST seam (setup/_shared/SI-UpdateRest.ps1):
|        { param([string]$Method, [string]$Uri, $Body, [string]$Resource, [hashtable]$Headers) } -> @{ Status; Body }
|    PowerShell 5.1-compatible (the VM sync hook); no PowerShell module, no az.
|#>
|
|# the fingerprint a collection run records for the permissions it checked (Get-SIPermissionListFingerprint)
|if (-not (Get-Command -Name Get-SIPermissionListFingerprint -ErrorAction SilentlyContinue)) {
|    $siPermissionNoteCheck = [IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'engine', '_shared', 'SI-PermissionCheck.ps1')
|    if (Test-Path -LiteralPath $siPermissionNoteCheck) { . $siPermissionNoteCheck }
|}
|
|$script:SIPermissionNoteUrlBase = 'https://invardia.com/support/si/'
|$script:SIPermissionNoteGraph = 'https://graph.microsoft.com/'
|
|# What a permission added after an install was made is for, and what stays empty without it. A permission that is not
|# listed here is one SecurityInsight has always needed: its line says only that its data is not collected.
|$script:SIPermissionNoteText = @{
|    'DeviceManagementConfiguration.Read.All'  = @{ For = 'which Intune compliance policies a device does not meet, and its update ring'
|                                                   Empty = 'the failing compliance policy and update ring columns stay empty' }
|    'AccessReview.Read.All'                   = @{ For = 'when a privileged role, group or application was last reviewed'
|                                                   Empty = 'the last access review columns stay empty' }
|    'SecurityAlert.Read.All'                  = @{ For = 'the open alerts of each device: how many, their highest severity and the newest one'
|                                                   Empty = 'the open alert columns of the devices stay unknown' }
|    'Vulnerability.Read.All'                  = @{ For = 'the exploit details of a vulnerability from Defender (verified exploit, exploit kit, exploit type, exposed devices)'
|                                                   Empty = 'the exploit detail columns of the vulnerability findings stay empty' }
|    'SecurityRecommendation.Read.All'         = @{ For = 'the exposure impact and the active alert of a Defender recommendation'
|                                                   Empty = 'the exposure impact and active alert columns of the vulnerability and configuration findings stay empty' }
|    'SecurityEvents.Read.All'                 = @{ For = 'the Microsoft Secure Score of the tenant, sent with the hourly status report'
|                                                   Empty = 'the hourly status report carries no Secure Score' }
|    'Score.Read.All'                          = @{ For = 'the Defender exposure score of the tenant, sent with the hourly status report'
|                                                   Empty = 'the hourly status report carries no exposure score' }
|    'DeviceManagementManagedDevices.Read.All' = @{ For = 'Intune devices: serial numbers and MAC addresses for the full asset details'
|                                                   Empty = 'the serial number and MAC address columns from Intune stay empty' }
|    'UserAuthenticationMethod.Read.All'       = @{ For = 'the sign-in methods of each user'
|                                                   Empty = 'the passwordless-only and MFA strength columns stay unknown' }
|}
|
|function Get-SIPermissionNoteProp {
|    <# PURE. A property of a parsed object or a dictionary, $null when a level is absent (never throws). #>
|    param($Object, [string[]]$Path)
|    $o = $Object
|    foreach ($p in $Path) {
|        if ($null -eq $o) { return $null }
|        if ($o -is [System.Collections.IDictionary]) { if ($o.Contains($p)) { $o = $o[$p] } else { return $null }; continue }
|        $pp = $o.PSObject.Properties[$p]; if (-not $pp) { return $null }; $o = $pp.Value
|    }
|    $o
|}
|
|function Get-SIPermissionNoteCatalog {
|    <#
|        The collection identity as config/permissions.locked.json lists it:
|          @{ Label; Apis = @( @{ Resource; ResourceAppId; Roles = string[] } ); Engines = string[] }
|        Engines = the engines that run as that identity AND check its application permissions. -Path: the list (default:
|        this tree's). Throws when the list cannot be read (the caller says so in one line).
|    #>
|    param([string]$Path)
|    if (-not $Path) { $Path = [IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'config', 'permissions.locked.json') }
|    $cat = [IO.File]::ReadAllText($Path) | ConvertFrom-Json
|    $id = Get-SIPermissionNoteProp $cat @('identities', 'collection')
|    if (-not $id) { throw 'the permission list names no collection identity' }
|    $apis = New-Object System.Collections.Generic.List[object]
|    foreach ($a in @($id.api)) {
|        if (-not $a -or -not "$($a.resourceAppId)".Trim()) { continue }
|        $roles = @(@($a.roles) | Where-Object { $_ } | ForEach-Object { [string]$_ })
|        if (-not $roles.Count) { continue }
|        $apis.Add([pscustomobject]@{ Resource = [string]$a.resource; ResourceAppId = ([string]$a.resourceAppId).Trim().ToLowerInvariant(); Roles = $roles })
|    }
|    $engines = New-Object System.Collections.Generic.List[string]
|    $eng = Get-SIPermissionNoteProp $cat @('engines')
|    if ($eng) {
|        foreach ($p in $eng.PSObject.Properties) {
|            if ($p.Name -eq 'default' -or -not $p.Value) { continue }
|            if ([string]$p.Value.identity -eq 'collection' -and (@($p.Value.checks) -contains 'api')) { $engines.Add($p.Name.ToLowerInvariant()) }
|        }
|    }
|    [pscustomobject]@{ Label = [string]$id.label; Apis = $apis.ToArray(); Engines = $engines.ToArray() }
|}
|
|function Test-SIPermissionNoteSafe {
|    <# PURE. A value that may be pasted into a command: a resource name, an id or a resource id -- nothing else. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    "$Value" -match '^[A-Za-z0-9/][A-Za-z0-9._()/-]{0,400}$'
|}
|
|function Get-SIPermissionNoteIdentity {
|    <#
|        PURE. SecurityInsight's collection identity and this install's names, read from the job list the update already has
|        (ARM shape): the first job whose SI_ENGINE is one of -Engines and that names its sign-in.
|          @{ Job; ClientId; ObjectId; Managed; IdentityName; IdentityResourceGroup; WorkspaceResourceId; StorageAccount; DcrResourceGroup }
|        Managed = the job signs in with a user-assigned managed identity (SI_UAMI_CLIENTID); otherwise an app registration
|        (SI_SPN_APPID). IdentityName / IdentityResourceGroup: the job's user-assigned identity with that client id ('' when
|        the job does not say). $null when no such job is in the list.
|    #>
|    param([object[]]$Jobs = @(), [string[]]$Engines = @())
|    $want = @($Engines | ForEach-Object { "$_".Trim().ToLowerInvariant() } | Where-Object { $_ })
|    foreach ($j in @($Jobs | Where-Object { $_ } | Sort-Object { [string]$_.name })) {
|        $c = @(Get-SIPermissionNoteProp $j @('properties', 'template', 'containers') | Where-Object { $_ }) | Select-Object -First 1
|        if (-not $c) { continue }
|        $ev = @{}
|        foreach ($e in @($c.env)) { if ($e -and "$($e.name)".Trim() -and $e.PSObject.Properties['value']) { $ev[([string]$e.name).Trim().ToUpperInvariant()] = "$($e.value)".Trim() } }
|        $engine = "$($ev['SI_ENGINE'])".ToLowerInvariant()
|        if (-not $engine -or ($want.Count -and $want -notcontains $engine)) { continue }
|        $uami = "$($ev['SI_UAMI_CLIENTID'])"; $app = "$($ev['SI_SPN_APPID'])"
|        $client = if ($uami) { $uami } else { $app }
|        if (-not $client) { continue }
|        $name = ''; $rg = ''
|        if ($uami) {
|            $ua = Get-SIPermissionNoteProp $j @('identity', 'userAssignedIdentities')
|            $props = if ($ua -is [System.Collections.IDictionary]) { @($ua.Keys | ForEach-Object { [pscustomobject]@{ Name = [string]$_; Value = $ua[$_] } }) } elseif ($ua) { @($ua.PSObject.Properties) } else { @() }
|            foreach ($p in $props) {
|                if ("$(Get-SIPermissionNoteProp $p.Value @('clientId'))".Trim() -ine $uami) { continue }
|                $m = [regex]::Match([string]$p.Name, '(?i)^/subscriptions/[^/]+/resourceGroups/([^/]+)/providers/Microsoft\.ManagedIdentity/userAssignedIdentities/([^/]+)$')
|                if ($m.Success) { $rg = $m.Groups[1].Value; $name = $m.Groups[2].Value }
|                break
|            }
|        }
|        return [pscustomobject]@{
|            Job = [string]$j.name; ClientId = $client; ObjectId = "$($ev['SI_SPN_OBJECTID'])"; Managed = [bool]$uami
|            IdentityName = $name; IdentityResourceGroup = $rg
|            WorkspaceResourceId = "$($ev['SI_WORKSPACE_RESOURCEID'])"; StorageAccount = "$($ev['SI_STORAGE_ACCOUNT'])"; DcrResourceGroup = "$($ev['SI_DCR_RESOURCEGROUP'])"
|        }
|    }
|    $null
|}
|
|function Get-SIPermissionNoteGraphList {
|    <# Every item of a Microsoft Graph list (value[], following @odata.nextLink). @{ Status; Items }: Status is the first answer that was not 2xx (0 = no answer), else 200. #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$Uri, [int]$MaxPages = 40)
|    $items = New-Object System.Collections.Generic.List[object]
|    $url = $Uri
|    for ($p = 0; $url -and $p -lt $MaxPages; $p++) {
|        $r = & $Rest 'GET' $url $null $script:SIPermissionNoteGraph @{}
|        $code = 0; try { $code = [int]$r.Status } catch { $code = 0 }
|        if ($code -lt 200 -or $code -ge 300) { return [pscustomobject]@{ Status = $code; Items = @() } }
|        $page = $null; try { $page = [string]$r.Body | ConvertFrom-Json } catch { return [pscustomobject]@{ Status = 0; Items = @() } }
|        $url = ''
|        if ($page) {
|            foreach ($x in @($page.value)) { if ($null -ne $x) { $items.Add($x) } }
|            if ($page.PSObject.Properties['@odata.nextLink']) { $url = [string]$page.'@odata.nextLink' }
|        }
|    }
|    [pscustomobject]@{ Status = 200; Items = $items.ToArray() }
|}
|
|function Get-SIPermissionNoteGranted {
|    <#
|        READER 1 -- the directory. The application permissions the identity holds, per API of -Apis:
|          @{ Readable; Why; Granted = @{ <resourceAppId> = string[] }; Absent = string[] }
|        Readable = $false: this sign-in may not read them (Why says it; nothing is assumed). Absent: an API of the list that
|        is not in this directory at all (its product is not in use there) -- nothing can be granted on it, so nothing is
|        said about it. GET only.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [string]$ObjectId, [string]$ClientId, [object[]]$Apis = @())
|    $no = { param($why) [pscustomobject]@{ Readable = $false; Why = $why; Granted = @{}; Absent = @() } }
|    $why = { param($code) if ($code -eq 401 -or $code -eq 403) { 'the sign-in of this update may not read the directory' } elseif ($code -eq 404) { 'the identity was not found in the directory' } elseif ($code -le 0) { 'the directory did not answer' } else { 'the directory answered HTTP {0}' -f $code } }
|    $oid = "$ObjectId".Trim(); $cid = "$ClientId".Trim()
|    $guid = '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'
|    $sp = if ($oid -match $guid) { 'servicePrincipals/{0}' -f $oid } elseif ($cid -match $guid) { "servicePrincipals(appId='{0}')" -f $cid } else { '' }
|    if (-not $sp) { return (& $no 'the identity''s id is not known here') }
|    $mine = Get-SIPermissionNoteGraphList -Rest $Rest -Uri ('https://graph.microsoft.com/v1.0/{0}/appRoleAssignments' -f $sp)
|    if ($mine.Status -ne 200) { return (& $no (& $why $mine.Status)) }
|    $granted = @{}; $absent = New-Object System.Collections.Generic.List[string]
|    foreach ($a in @($Apis)) {
|        if (-not $a) { continue }
|        $u = "https://graph.microsoft.com/v1.0/servicePrincipals(appId='{0}')?{1}=id,appRoles" -f $a.ResourceAppId, '$select'
|        $r = & $Rest 'GET' $u $null $script:SIPermissionNoteGraph @{}
|        $code = 0; try { $code = [int]$r.Status } catch { $code = 0 }
|        if ($code -eq 404) { $absent.Add([string]$a.ResourceAppId); continue }
|        if ($code -lt 200 -or $code -ge 300) { return (& $no (& $why $code)) }
|        $res = $null; try { $res = [string]$r.Body | ConvertFrom-Json } catch { return (& $no 'the directory''s answer could not be read') }
|        $rid = "$($res.id)".Trim()
|        if (-not $rid) { return (& $no 'the directory''s answer could not be read') }
|        $byId = @{}
|        foreach ($ar in @($res.appRoles)) { if ($ar -and "$($ar.id)".Trim()) { $byId[([string]$ar.id).ToLowerInvariant()] = [string]$ar.value } }
|        $have = New-Object System.Collections.Generic.List[string]
|        foreach ($g in @($mine.Items)) {
|            if ("$($g.resourceId)".Trim() -ine $rid) { continue }
|            $v = $byId[("$($g.appRoleId)").ToLowerInvariant()]
|            if ($v) { $have.Add($v) }
|        }
|        $granted[[string]$a.ResourceAppId] = $have.ToArray()
|    }
|    [pscustomobject]@{ Readable = $true; Why = ''; Granted = $granted; Absent = $absent.ToArray() }
|}
|
|function Get-SIPermissionNoteFingerprint {
|    <#
|        PURE. The fingerprint of the list's application permissions, as a collection run records the ones it checked
|        (engine/_shared/SI-PermissionCheck.ps1, Get-SIPermissionListFingerprint over '<api>|<permission>'). '' when that
|        function is not in this tree -- then no run record counts as a check of the whole list.
|    #>
|    param([object[]]$Apis = @())
|    if (-not (Get-Command -Name Get-SIPermissionListFingerprint -ErrorAction SilentlyContinue)) { return '' }
|    $names = New-Object System.Collections.Generic.List[string]
|    foreach ($a in @($Apis)) { if ($a) { foreach ($r in @($a.Roles)) { $names.Add(('{0}|{1}' -f $a.Resource, $r)) } } }
|    [string](Get-SIPermissionListFingerprint -Names $names.ToArray())
|}
|
|function Get-SIPermissionNoteKql {
|    <# PURE. The newest run record of each engine that carries the engine's own permission check (last 7 days). #>
|    "SI_RunHealth_CL | where TimeGenerated > ago(7d) | extend Eng = tolower(tostring(column_ifexists('Engine', ''))), Ph = tostring(column_ifexists('Phase', '')), Gaps = tostring(column_ifexists('PermissionGaps', '')) | where Ph == 'End' and isnotempty(Gaps) and Eng !startswith 'flow:' | summarize arg_max(TimeGenerated, Gaps) by Engine = Eng | project Engine, At = tostring(TimeGenerated), Gaps"
|}
|
|function ConvertFrom-SIPermissionNoteRuns {
|    <#
|        PURE. READER 2's answer from the run records (Engine, At = when, Gaps = the PermissionGaps JSON):
|          @{ Known; Missing = @( @{ Resource; Role } ); Why }
|        Only the engines of -Engines count, and only a record whose check ran (no 'error').
|          * A record that checked THIS list in full ('apiChecked' = -Fingerprint, nothing left out) is exact: the newest one
|            is the answer -- what it lists as missing is missing, and nothing listed means everything is granted.
|          * Without such a record (the newest runs were made before a permission was added, or could not check an API):
|            a permission of the list that a record says is missing is still named (the engine read its own token); when
|            none says so, nothing is known -- "nothing missing" from a shorter list is not an answer.
|    #>
|    param([object[]]$Rows = @(), [object[]]$Apis = @(), [string[]]$Engines = @(), [string]$Fingerprint)
|    $roleOf = @{}; $areas = @{}
|    foreach ($a in @($Apis)) { if ($a) { $areas[([string]$a.Resource).ToLowerInvariant()] = [string]$a.Resource; foreach ($r in @($a.Roles)) { $roleOf[(([string]$a.Resource) + '|' + [string]$r).ToLowerInvariant()] = [string]$r } } }
|    $want = @($Engines | ForEach-Object { "$_".ToLowerInvariant() })
|    $fp = "$Fingerprint".Trim()
|    $toItems = { param($keys) @($keys | ForEach-Object { [pscustomobject]@{ Resource = $areas[($_ -split '\|')[0]]; Role = $roleOf[$_] } } | Sort-Object Resource, Role) }
|    $union = @{}; $seen = 0; $exact = $null; $exactAt = [long]-1
|    foreach ($row in @($Rows)) {
|        if (-not $row -or $want -notcontains "$($row.Engine)".ToLowerInvariant()) { continue }
|        $j = $null; try { $j = [string]$row.Gaps | ConvertFrom-Json } catch { $j = $null }
|        if (-not $j -or "$(Get-SIPermissionNoteProp $j @('error'))".Trim()) { continue }
|        $seen++
|        $mine = New-Object System.Collections.Generic.List[string]
|        foreach ($i in @($j.items)) {
|            if (-not $i -or "$($i.state)" -ne 'missing') { continue }
|            $k = ("$($i.area)" + '|' + "$($i.item)").ToLowerInvariant()
|            if ($roleOf.ContainsKey($k) -and -not $mine.Contains($k)) { $mine.Add($k) }
|        }
|        # a record cut short ('more' items left out) is not the whole check
|        $more = 0; try { $more = [int](Get-SIPermissionNoteProp $j @('more')) } catch { $more = 0 }
|        if ($fp -and $more -le 0 -and "$(Get-SIPermissionNoteProp $j @('apiChecked'))".Trim() -eq $fp) {
|            $at = [long]0
|            $v = Get-SIPermissionNoteProp $row @('At')
|            try {
|                if ($v -is [datetime]) { $at = $v.ToUniversalTime().Ticks }
|                elseif ("$v".Trim()) { $at = [datetime]::Parse("$v", [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal).Ticks }
|            } catch { $at = [long]0 }
|            if ($at -gt $exactAt) { $exactAt = $at; $exact = $mine.ToArray() }
|        } else { foreach ($k in $mine) { $union[$k] = $true } }
|    }
|    if ($null -ne $exact) { return [pscustomobject]@{ Known = $true; Missing = @(& $toItems $exact); Why = '' } }
|    if ($union.Count) { return [pscustomobject]@{ Known = $true; Missing = @(& $toItems @($union.Keys)); Why = '' } }
|    [pscustomobject]@{ Known = $false; Missing = @(); Why = $(if ($seen) { 'no collection run has checked the current permission list yet' } else { 'no collection run has recorded its own check' }) }
|}
|
|function Get-SIPermissionNoteFromRuns {
|    <# READER 2 -- the collection engines' own check on their newest run (one Log Analytics query). Never throws: not readable = not Known. #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [string]$WorkspaceResourceId, [object[]]$Apis = @(), [string[]]$Engines = @())
|    $no = [pscustomobject]@{ Known = $false; Missing = @(); Why = 'the run records could not be read' }
|    $ws = "$WorkspaceResourceId".Trim().TrimEnd('/')
|    if (-not $ws) { return $no }
|    try {
|        $url = 'https://management.azure.com{0}/api/query?api-version=2017-10-01' -f $ws
|        $r = & $Rest 'POST' $url (ConvertTo-Json -InputObject ([ordered]@{ query = (Get-SIPermissionNoteKql) }) -Compress) 'https://management.azure.com/' @{ 'Content-Type' = 'application/json' }
|        $code = 0; try { $code = [int]$r.Status } catch { $code = 0 }
|        if ($code -lt 200 -or $code -ge 300) { return $no }
|        $ans = [string]$r.Body | ConvertFrom-Json
|        $t = @($ans.tables)[0]; if (-not $t) { return $no }
|        $cols = @($t.columns | ForEach-Object { [string]$_.name })
|        $rows = New-Object System.Collections.Generic.List[object]
|        foreach ($row in @($t.rows)) {
|            $o = [ordered]@{}; $vals = @($row)
|            for ($i = 0; $i -lt $cols.Count; $i++) { $o[$cols[$i]] = $(if ($i -lt $vals.Count) { $vals[$i] } else { $null }) }
|            $rows.Add([pscustomobject]$o)
|        }
|        return (ConvertFrom-SIPermissionNoteRuns -Rows $rows.ToArray() -Apis $Apis -Engines $Engines -Fingerprint (Get-SIPermissionNoteFingerprint -Apis $Apis))
|    } catch { return $no }
|}
|
|function Get-SIPermissionNoteMissing {
|    <# PURE. The list's permissions the identity does not hold: @( @{ Resource; Role } ), in the list's order. An API in -Absent is left out. #>
|    param([object[]]$Apis = @(), [hashtable]$Granted = @{}, [string[]]$Absent = @())
|    foreach ($a in @($Apis)) {
|        if (-not $a -or @($Absent) -contains [string]$a.ResourceAppId) { continue }
|        $have = @{}
|        foreach ($g in @($Granted[[string]$a.ResourceAppId])) { if ($g) { $have[([string]$g).ToLowerInvariant()] = $true } }
|        foreach ($r in @($a.Roles)) { if (-not $have.ContainsKey(([string]$r).ToLowerInvariant())) { [pscustomobject]@{ Resource = [string]$a.Resource; Role = [string]$r } } }
|    }
|}
|
|function Get-SIPermissionNoteCommand {
|    <#
|        PURE. The two lines that grant the collection identity its permissions -- download from invardia.com, then run with
|        THIS install's names (the workspace, storage and data collection resource group are always given: without them the
|        script plans the Azure roles on a configuration file's names). '' when a name it needs is not known here or is not a
|        plain resource name (never a placeholder).
|          managed identity  -> Grant-SIIdentity.ps1 -IdentityName .. -IdentityResourceGroup .. (or -PrincipalId <object id>) .. -AllowSchemaCreate -Apply
|          app registration  -> Grant-SIIdentity.ps1 -AppId <client id> .. -AllowSchemaCreate -Apply (the same script, the
|                               identity found by its application id -- never by its name)
|    #>
|    param($Identity, [string]$SubscriptionId, [string]$WorkspaceResourceId, [string]$StorageAccount, [string]$StorageResourceGroup, [string]$DcrResourceGroup)
|    if (-not $Identity) { return '' }
|    $ok = { param($v) $t = "$v".Trim(); [bool]($t -and (Test-SIPermissionNoteSafe -Value $t)) }
|    $arg = { param($n, $v) ' -{0} {1}' -f $n, "$v".Trim() }
|    $dl = { param($s) 'Invoke-WebRequest {0}{1}.ps1 -OutFile {1}.ps1' -f $script:SIPermissionNoteUrlBase, $s }
|    if (-not (& $ok $SubscriptionId)) { return '' }
|    if (-not (& $ok $WorkspaceResourceId)) { return '' }
|    $cmd = './Grant-SIIdentity.ps1'
|    if (-not $Identity.Managed) {
|        if (-not (& $ok $Identity.ClientId)) { return '' }
|        $cmd += (& $arg 'AppId' $Identity.ClientId)
|    }
|    elseif ((& $ok $Identity.IdentityName) -and (& $ok $Identity.IdentityResourceGroup)) { $cmd += (& $arg 'IdentityName' $Identity.IdentityName) + (& $arg 'IdentityResourceGroup' $Identity.IdentityResourceGroup) }
|    elseif (& $ok $Identity.ObjectId) { $cmd += (& $arg 'PrincipalId' $Identity.ObjectId) }
|    else { return '' }
|    $cmd += (& $arg 'SubscriptionId' $SubscriptionId) + (& $arg 'WorkspaceResourceId' $WorkspaceResourceId)
|    if ((& $ok $StorageAccount) -and (& $ok $StorageResourceGroup)) { $cmd += (& $arg 'StorageAccountName' $StorageAccount) + (& $arg 'StorageResourceGroup' $StorageResourceGroup) }
|    if (& $ok $DcrResourceGroup) { $cmd += (& $arg 'DcrResourceGroup' $DcrResourceGroup) }
|    # -AllowSchemaCreate, as the guided install grants it: an install repaired from this note must be able to create its
|    # tables and rules too (a run creates them, and gives itself no role)
|    (& $dl 'Grant-SIIdentity') + "`n" + $cmd + ' -AllowSchemaCreate -Apply'
|}
|
|function Get-SIPermissionNoteLines {
|    <#
|        PURE. The text of the note: one line per missing permission, then who grants them and the two command lines (or
|        where the command is shown, when -Command is ''). @() when nothing is missing.
|    #>
|    param([object[]]$Missing = @(), [string]$Command, [string]$Label = "SecurityInsight's collection identity")
|    $m = @($Missing | Where-Object { $_ })
|    if (-not $m.Count) { return @() }
|    $lines = New-Object System.Collections.Generic.List[string]
|    foreach ($x in $m) {
|        $t = $script:SIPermissionNoteText[[string]$x.Role]
|        if ($t) { $lines.Add(('permissions: {0} {1} is not granted to {2} -- it is read-only and gives {3}. Nothing breaks without it: {4}.' -f $x.Resource, $x.Role, $Label, $t.For, $t.Empty)) }
|        else { $lines.Add(('permissions: {0} {1} is not granted to {2} -- it is read-only; the data it gives is not collected until it is granted.' -f $x.Resource, $x.Role, $Label)) }
|    }
|    $it = if ($m.Count -eq 1) { 'it' } else { 'them' }
|    if ("$Command".Trim()) {
|        $lines.Add(('permissions: to grant {0}, an admin who can give admin consent (Privileged Role Administrator or Global Administrator) runs these two lines in Azure Cloud Shell or PowerShell 7 -- SecurityInsight keeps running as it does today until then:' -f $it))
|        foreach ($c in ("$Command" -split "`r?`n")) { if ($c.Trim()) { $lines.Add($c.Trim()) } }
|    } else {
|        $lines.Add(('permissions: to grant {0}, open Get Started > Permissions in the SecurityInsight web app -- it shows the two lines to run, with this install''s names filled in. SecurityInsight keeps running as it does today until then.' -f $it))
|    }
|    $lines.ToArray()
|}
|
|function Invoke-SIPermissionNote {
|    <#
|        The whole step. READ ONLY and NEVER throws.
|          @{ State = granted | missing | not-checked; Source = directory | runs | ''; Missing = @( @{ Resource; Role } ); Lines = string[] }
|        granted: Lines is empty (nothing is said). not-checked: ONE line saying why -- nothing is assumed.
|        -Jobs: the job list the update read. -Globals: the customer's settings (a workspace / storage name set there wins
|        over the job's own).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [object[]]$Jobs = @(), [string]$SubscriptionId, [string]$ResourceGroup, [hashtable]$Globals = @{},
|          [string]$WorkspaceResourceId, [string]$CatalogPath)
|    $notChecked = { param($why) [pscustomobject]@{ State = 'not-checked'; Source = ''; Missing = @()
|        Lines = @(('permissions: not checked -- {0}. Get Started > Permissions in the SecurityInsight web app shows any permission that is missing after the next collection run.' -f $why)) } }
|    try {
|        $cat = Get-SIPermissionNoteCatalog -Path $CatalogPath
|        $id = Get-SIPermissionNoteIdentity -Jobs $Jobs -Engines $cat.Engines
|        if (-not $id) { return (& $notChecked 'the identity SecurityInsight collects with could not be told from this install''s jobs') }
|        $gv = { param($n) if ($Globals -and $Globals.ContainsKey($n) -and "$($Globals[$n])".Trim()) { "$($Globals[$n])".Trim() } else { '' } }
|        $ws = "$WorkspaceResourceId".Trim(); if (-not $ws) { $ws = & $gv 'SI_WorkspaceResourceId' }; if (-not $ws) { $ws = $id.WorkspaceResourceId }
|        $stg = & $gv 'SI_StorageAccount'; if (-not $stg) { $stg = $id.StorageAccount }
|        $stgRg = & $gv 'SI_StorageResourceGroup'; if (-not $stgRg) { $stgRg = $ResourceGroup }
|        $dcr = & $gv 'SI_DcrResourceGroup'; if (-not $dcr) { $dcr = $id.DcrResourceGroup }
|
|        $source = 'directory'; $missing = @()
|        $g = Get-SIPermissionNoteGranted -Rest $Rest -ObjectId $id.ObjectId -ClientId $id.ClientId -Apis $cat.Apis
|        if ($g.Readable) { $missing = @(Get-SIPermissionNoteMissing -Apis $cat.Apis -Granted $g.Granted -Absent $g.Absent) }
|        else {
|            $source = 'runs'
|            $r = Get-SIPermissionNoteFromRuns -Rest $Rest -WorkspaceResourceId $ws -Apis $cat.Apis -Engines $cat.Engines
|            if (-not $r.Known) { return (& $notChecked ('{0}, and {1}' -f $g.Why, $r.Why)) }
|            $missing = @($r.Missing)
|        }
|        if (-not $missing.Count) { return [pscustomobject]@{ State = 'granted'; Source = $source; Missing = @(); Lines = @() } }
|        $cmd = Get-SIPermissionNoteCommand -Identity $id -SubscriptionId $SubscriptionId -WorkspaceResourceId $ws -StorageAccount $stg -StorageResourceGroup $stgRg -DcrResourceGroup $dcr
|        $label = if ("$($cat.Label)".Trim()) { [string]$cat.Label } else { "SecurityInsight's collection identity" }
|        [pscustomobject]@{ State = 'missing'; Source = $source; Missing = $missing; Lines = @(Get-SIPermissionNoteLines -Missing $missing -Command $cmd -Label $label) }
|    } catch {
|        & $notChecked ('the check could not run ({0})' -f $_.Exception.Message)
|    }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-PermissionCheck.ps1'] = @{ Sha256 = 'b9929f8729c9786399c2cca2c2c7d6a64cbaedd5ef16b62f56b9d1320d65c664'; Text = @'
|#Requires -Version 5.1
|<#
|    SI -- AN ENGINE CHECKS ITS OWN PERMISSIONS AT RUN START, and the run-health END record says what is missing.
|
|    Why: asset tagging runs under its own identity, and on every Pro install that identity had no user in the Pro database --
|    the daily run failed for days before anyone saw why (operator 2026-10-08: "make sure to add permissions into the get
|    started so we can verify we have the needed permissions"). The web app cannot read other identities' grants, but every
|    engine can read its OWN, cheaply and exactly:
|      api       -- the 'roles' claim of the engine's own access token for each API (Microsoft Graph, Microsoft Threat
|                   Protection, Defender for Endpoint) against the catalog. One token per API, nothing else is called.
|      azure     -- ONE read of the caller's own permissions (Microsoft.Authorization/permissions) at the collection scope;
|                   Reader = '*/read'. A scope that cannot be read is "not checked", never "missing".
|      database  -- Pro only: the settings layer already signs in to the Pro database; it records whether the sign-in
|                   worked and IS_ROLEMEMBER for the roles ($global:SI_ProDatabaseAccess, Read-SIProDatabaseAccess in
|                   engine/pro-settings/SI-ProSettings.ps1). Community has no Pro database: the area is simply absent.
|    The catalog is config/permissions.locked.json -- the ONE list (engine, docs and tests read it).
|
|    NEVER STOPS A RUN (warn, don't block): every function here swallows its own failures and says "not checked". A missing
|    permission the run actually needs still fails the run exactly as before.
|
|    Result (Invoke-SIPermissionSelfCheck, kept in $global:SI_PermissionCheck):
|      { Engine; Identity (client id); IdentityKey; Label; Checked = @( { Area; Item; State = ok|missing|not-checked; Fix; When } ) }
|    The run-health END record carries ConvertTo-SIPermissionGapsJson of it (only the gaps and the not-checked items).
|
|    PS 5.1 safe, no PowerShell modules (REST / .NET only). Shipped in both editions; it never loads a Pro path.
|#>
|
|function Get-SIPermissionCatalog {
|    <# The catalog (config/permissions.locked.json), parsed. -Path is a seam for tests; cached per process for the default path. #>
|    param([string]$Path)
|    $default = -not $Path
|    if ($default -and $script:SIPermissionCatalog) { return $script:SIPermissionCatalog }
|    if ($default) { $Path = [System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'config', 'permissions.locked.json') }
|    $cat = [System.IO.File]::ReadAllText($Path) | ConvertFrom-Json
|    if ($default) { $script:SIPermissionCatalog = $cat }
|    $cat
|}
|
|function Get-SIPermissionEngineSpec {
|    <# PURE. Which identity an engine (SI_ENGINE) runs as, and which areas it checks: the catalog's entry, else 'default'. #>
|    param([Parameter(Mandatory)]$Catalog, [Parameter(Mandatory)][string]$Engine)
|    $e = $Engine.Trim().ToLowerInvariant()
|    $spec = $null
|    if ($Catalog.engines) {
|        foreach ($p in $Catalog.engines.PSObject.Properties) { if ($p.Name -eq $e) { $spec = $p.Value } }
|        if (-not $spec) { $spec = $Catalog.engines.default }
|    }
|    if (-not $spec) { throw ("the permission catalog has no entry for the engine '{0}' and no default" -f $e) }
|    $key = [string]$spec.identity
|    $identity = $null
|    if ($Catalog.identities) { foreach ($p in $Catalog.identities.PSObject.Properties) { if ($p.Name -eq $key) { $identity = $p.Value } } }
|    if (-not $identity) { throw ("the permission catalog names no identity '{0}' for the engine '{1}'" -f $key, $e) }
|    [pscustomobject]@{ Engine = $e; IdentityKey = $key; Identity = $identity; Checks = @($spec.checks | Where-Object { $_ } | ForEach-Object { [string]$_ }) }
|}
|
|function ConvertFrom-SIPermissionJwt {
|    <# PURE. The claims of a JWT (no signature check -- only our own token's roles / appid are read). $null when not a JWT. #>
|    param([AllowEmptyString()][AllowNull()][string]$Token)
|    $parts = ([string]$Token) -split '\.'
|    if ($parts.Count -lt 2 -or -not $parts[1]) { return $null }
|    $p = $parts[1].Replace('-', '+').Replace('_', '/')
|    switch ($p.Length % 4) { 2 { $p += '==' } 3 { $p += '=' } }
|    try { return ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($p)) | ConvertFrom-Json) } catch { return $null }
|}
|
|function Get-SIPermissionTokenRoles {
|    <# PURE. The application permissions ('roles' claim) of a token; @() when it has none. $null when it is not a token. #>
|    param([AllowEmptyString()][AllowNull()][string]$Token)
|    $c = ConvertFrom-SIPermissionJwt -Token $Token
|    if ($null -eq $c) { return $null }
|    # the leading comma keeps an EMPTY list a list ($null would read as "no token" = not checked)
|    if ($c.PSObject.Properties['roles']) { return , [string[]]@($c.roles | ForEach-Object { [string]$_ }) }
|    return , [string[]]@()
|}
|
|function Test-SIPermissionTruthy {
|    param($Value)
|    if ($null -eq $Value) { return $false }
|    if ($Value -is [bool]) { return $Value }
|    ("$Value".Trim().Trim('$').ToLowerInvariant()) -in @('true', '1', 'yes', 'on')
|}
|
|function New-SIPermissionItem {
|    param([string]$Area, [string]$Item, [string]$State, [string]$Fix, [string]$When)
|    [pscustomobject]@{ Area = $Area; Item = $Item; State = $State; Fix = $Fix; When = $When }
|}
|
|function Test-SIPermissionApiRoles {
|    <#
|        PURE. One API's required roles (the catalog entry: roles + conditionalRoles) against the roles of the engine's own
|        token. -TokenRoles $null = the token could not be had: every role is "not-checked". A conditional role carries its
|        'when' setting; whether it counts is decided when the result is recorded (the setting may come from the Pro database).
|    #>
|    param([Parameter(Mandatory)]$Api, [AllowNull()][string[]]$TokenRoles, [string]$Fix, [string]$Reason)
|    $have = @{}
|    $known = ($null -ne $TokenRoles)
|    if ($known) { foreach ($r in $TokenRoles) { $have[([string]$r).ToLowerInvariant()] = $true } }
|    $out = New-Object System.Collections.Generic.List[object]
|    $want = New-Object System.Collections.Generic.List[object]
|    foreach ($r in @($Api.roles)) { if ($r) { $want.Add(@{ Role = [string]$r; When = '' }) } }
|    foreach ($c in @($Api.conditionalRoles)) { if ($c -and $c.role) { $want.Add(@{ Role = [string]$c.role; When = [string]$c.when }) } }
|    foreach ($w in $want) {
|        $state = if (-not $known) { 'not-checked' } elseif ($have.ContainsKey($w.Role.ToLowerInvariant())) { 'ok' } else { 'missing' }
|        $fixText = if ($state -eq 'not-checked' -and $Reason) { $Reason } else { $Fix }
|        $out.Add((New-SIPermissionItem -Area ([string]$Api.resource) -Item $w.Role -State $state -Fix $fixText -When $w.When))
|    }
|    $out.ToArray()
|}
|
|function Test-SIPermissionAzureActions {
|    <#
|        PURE. The catalog's Azure items against the caller's own permissions at a scope (the 'value' of
|        Microsoft.Authorization/permissions: entries of actions + notActions). An item is ok when one entry has an action
|        pattern that covers it (wildcards, case-insensitive) and no notAction of that entry removes it.
|        -Permissions $null = they could not be read: every item is "not-checked" (never "missing").
|    #>
|    param([object[]]$Items, [AllowNull()][object[]]$Permissions, [string]$Scope, [string]$Fix, [string]$Reason)
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($it in @($Items)) {
|        if (-not $it) { continue }
|        $name = [string]$it.item; $action = [string]$it.action; $when = [string]$it.when
|        if ($null -eq $Permissions) {
|            $out.Add((New-SIPermissionItem -Area 'Azure' -Item $name -State 'not-checked' -Fix $(if ($Reason) { $Reason } else { $Fix }) -When $when))
|            continue
|        }
|        $granted = $false
|        foreach ($p in @($Permissions)) {
|            if (-not $p) { continue }
|            $hit = $false
|            foreach ($a in @($p.actions)) { if ($a -and ($action -like [string]$a)) { $hit = $true; break } }
|            if (-not $hit) { continue }
|            $removed = $false
|            foreach ($n in @($p.notActions)) { if ($n -and ($action -like [string]$n)) { $removed = $true; break } }
|            if (-not $removed) { $granted = $true; break }
|        }
|        $label = if ($Scope) { '{0} ({1})' -f $name, $Scope } else { $name }
|        $out.Add((New-SIPermissionItem -Area 'Azure' -Item $label -State $(if ($granted) { 'ok' } else { 'missing' }) -Fix $Fix -When $when))
|    }
|    $out.ToArray()
|}
|
|function Get-SIPermissionDatabaseFailure {
|    <#
|        PURE. Why a sign-in to the Pro database failed, from the error's text -- because "cannot connect" is not "no user":
|          firewall     -- the server's firewall or network rules refused the connection before any sign-in: SQL error 40615
|                          ("Cannot open server ... Client with IP address ... is not allowed to access the server"), 40914
|                          (a virtual network rule), 47073 (public network access is off)
|          unreachable  -- the server did not answer or was not found: a connection timeout, a network error, a name that
|                          does not resolve, a database that is not available right now (40613)
|          no-user      -- a database that ANSWERED refused the sign-in: "Login failed for user" (18456), the
|                          token-identified principal, "Cannot open database ... requested by the login" (4060)
|          unknown      -- anything else (an empty text too)
|        The firewall is asked first: its text also says "Cannot open server ... requested by the login", which read alone
|        looks like a refused sign-in (first customer install 2026-10-12: the database user existed, the firewall rule for
|        the install's own jobs did not, and Get Started said "a database user for this identity is missing").
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Message)
|    $m = "$Message"
|    if (-not $m.Trim()) { return 'unknown' }
|    if ($m -match '(?i)is not allowed to access the server|\b(40615|40914|47073)\b|Deny Public Network Access|virtual network rule|Connection was denied') { return 'firewall' }
|    if ($m -match '(?i)Connection Timeout Expired|timeout period elapsed|network-related or instance-specific|No such host is known|Name or service not known|nodename nor servname|could not be resolved|server was not found or was not accessible|is not currently available|\b40613\b|actively refused|forcibly closed') { return 'unreachable' }
|    if ($m -match '(?i)Login failed for user|\b18456\b|token-identified principal|Cannot open database .* requested by the login') { return 'no-user' }
|    'unknown'
|}
|
|function Test-SIPermissionDatabaseRoles {
|    <#
|        PURE. The Pro database roles the identity needs against what the settings layer recorded ($global:SI_ProDatabaseAccess):
|          $null                              -> not checked (the settings layer did not get to the database)
|          @{ SignIn = 'failed'; Error }      -> one "missing" item, and WHICH one the error says (Get-SIPermissionDatabaseFailure):
|                                                the database could not be reached (its firewall refused this job / it did
|                                                not answer) -- or the identity cannot sign in (no database user). Only a
|                                                refused sign-in on a database that answers is "no database user".
|          @{ SignIn = 'ok'; Roles = @{..} }  -> per role: IS_ROLEMEMBER = 1 (or db_owner) ok, 0 missing, unknown not-checked
|    #>
|    param([string[]]$Roles, $Access, [string]$Fix)
|    $out = New-Object System.Collections.Generic.List[object]
|    if ($null -eq $Access) {
|        foreach ($r in @($Roles)) { if ($r) { $out.Add((New-SIPermissionItem -Area 'Pro database' -Item $r -State 'not-checked' -Fix 'The run did not reach the Pro database, so its access was not checked.')) } }
|        return $out.ToArray()
|    }
|    $signIn = [string]$Access.SignIn
|    if ($signIn -eq 'failed') {
|        $err = ''
|        if ($Access -is [System.Collections.IDictionary]) { if ($Access.Contains('Error')) { $err = [string]$Access['Error'] } }
|        elseif ($Access.PSObject.Properties['Error']) { $err = [string]$Access.Error }
|        $why = Get-SIPermissionDatabaseFailure -Message $err
|        if ($why -eq 'firewall') {
|            $out.Add((New-SIPermissionItem -Area 'Pro database' -Item 'connection (the database could not be reached: its firewall refused this job)' -State 'missing' `
|                -Fix 'The database user is not the problem: the database server''s firewall refused this job before it could sign in. As an Azure administrator of the install: open the SQL server in the Azure portal, Networking, and allow Azure services and resources to access this server -- or run the guided install again (setup\Install-SecurityInsight.ps1): its database step sets the rule the install''s own jobs need.'))
|            return $out.ToArray()
|        }
|        if ($why -eq 'unreachable') {
|            $out.Add((New-SIPermissionItem -Area 'Pro database' -Item 'connection (the database could not be reached: it did not answer)' -State 'missing' `
|                -Fix 'The database user is not the problem: the database server did not answer this job. Check in the Azure portal that the SQL server and the Pro database are running and that the server''s Networking lets the install''s jobs in; the next run checks again.'))
|            return $out.ToArray()
|        }
|        $out.Add((New-SIPermissionItem -Area 'Pro database' -Item 'sign-in (a database user for this identity)' -State 'missing' -Fix $Fix))
|        return $out.ToArray()
|    }
|    $have = $Access.Roles
|    $owner = $false
|    if ($have -is [System.Collections.IDictionary] -and $have.Contains('db_owner')) { $owner = ([string]$have['db_owner'] -eq '1') }
|    foreach ($r in @($Roles)) {
|        if (-not $r) { continue }
|        $v = $null
|        if ($have -is [System.Collections.IDictionary] -and $have.Contains($r)) { $v = $have[$r] }
|        $state = if ($owner -or [string]$v -eq '1') { 'ok' } elseif ($null -eq $v -or [string]$v -eq '') { 'not-checked' } else { 'missing' }
|        $fixText = if ($state -eq 'not-checked') { 'The role membership could not be read from the Pro database.' } else { $Fix }
|        $out.Add((New-SIPermissionItem -Area 'Pro database' -Item $r -State $state -Fix $fixText))
|    }
|    $out.ToArray()
|}
|
|function Resolve-SIPermissionAzureScope {
|    <#
|        PURE over -Globals. The scope the Azure read is made at -- where SecurityInsight collects from:
|          SI_PermissionCheck_AzureScope (an explicit scope), else the first of SI_Bootstrap_IdentityReaderScopes (what setup
|          granted Reader at: the subscription, a management group or the tenant root group), else the install's
|          subscription (SI_AzSubscriptionId, or the one in SI_WorkspaceResourceId). Reader granted higher up is inherited, so
|          the subscription is never a false "missing". '' when none is known.
|    #>
|    param([hashtable]$Globals = @{})
|    $g = { param($n) if ($Globals.ContainsKey($n)) { $Globals[$n] } else { $null } }
|    $x = [string](& $g 'SI_PermissionCheck_AzureScope')
|    if ($x.Trim()) { return $x.Trim().TrimEnd('/') }
|    foreach ($s in @(& $g 'SI_Bootstrap_IdentityReaderScopes')) { if ($s -and "$s".Trim().StartsWith('/')) { return "$s".Trim().TrimEnd('/') } }
|    $sub = [string](& $g 'SI_AzSubscriptionId')
|    if (-not $sub.Trim()) { $ws = [string](& $g 'SI_WorkspaceResourceId'); if ($ws -match '/subscriptions/([^/]+)') { $sub = $Matches[1] } }
|    if ($sub.Trim()) { return ('/subscriptions/{0}' -f $sub.Trim()) }
|    ''
|}
|
|function Get-SIPermissionGlobals {
|    <# The current $global: values as a hashtable (what the pure functions read). #>
|    $h = @{}
|    foreach ($v in (Get-Variable -Scope Global -ErrorAction SilentlyContinue)) { $h[$v.Name] = $v.Value }
|    $h
|}
|
|function Invoke-SIPermissionSelfCheck {
|    <#
|        Run start: the engine's own API and Azure permissions (the database part is added when the result is recorded --
|        the settings layer reads it later in the run start). NEVER THROWS and never stops the run; prints one line per gap.
|        -GetToken { param($Resource) <token> } and -GetArmPermissions { param($Scope) , @(<value entries>) } are seams
|        (tests; $null from -GetArmPermissions = could not be read, , @() = read and empty);
|        by default they are SecurityInsight's own REST sign-in (Get-SIAzureToken, Invoke-SIArm) -- the same identity the
|        run uses for everything else. Sets and returns $global:SI_PermissionCheck.
|    #>
|    param([Parameter(Mandatory)][string]$Engine, $Catalog, [scriptblock]$GetToken, [scriptblock]$GetArmPermissions,
|          [hashtable]$Globals, [switch]$Quiet)
|    $result = $null
|    try {
|        if (-not $Catalog) { $Catalog = Get-SIPermissionCatalog }
|        if (-not $Globals) { $Globals = Get-SIPermissionGlobals }
|        $spec = Get-SIPermissionEngineSpec -Catalog $Catalog -Engine $Engine
|        $g = { param($n) if ($Globals.ContainsKey($n)) { $Globals[$n] } else { $null } }
|        $identity = [string](& $g 'SI_UAMI_ClientId')
|        if (-not ([bool](& $g 'SI_UseManagedIdentity')) -or -not $identity) { $id2 = [string](& $g 'SI_SPN_AppId'); if ($id2) { $identity = $id2 } }
|        if (-not $GetToken) {
|            $GetToken = { param($Resource) if (Get-Command -Name Get-SIAzureToken -ErrorAction SilentlyContinue) { Get-SIAzureToken -Resource $Resource } }
|        }
|        if (-not $GetArmPermissions) {
|            $GetArmPermissions = { param($Scope)
|                if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { return $null }
|                $r = Invoke-SIArm -Path ($Scope + '/providers/Microsoft.Authorization/permissions') -ApiVersion '2022-04-01'
|                if ($null -eq $r) { return $null }
|                , @($r.value)
|            }
|        }
|        $items = New-Object System.Collections.Generic.List[object]
|        $fix = $spec.Identity.fix
|        if ($spec.Checks -contains 'api') {
|            foreach ($api in @($spec.Identity.api)) {
|                $roles = $null; $why = ''
|                try {
|                    $tok = [string](& $GetToken ([string]$api.audience))
|                    if ($tok) {
|                        $roles = Get-SIPermissionTokenRoles -Token $tok
|                        $claims = ConvertFrom-SIPermissionJwt -Token $tok
|                        if (-not $identity -and $claims) { foreach ($n in 'appid', 'azp') { if ($claims.PSObject.Properties[$n] -and $claims.$n) { $identity = [string]$claims.$n; break } } }
|                    }
|                    if ($null -eq $roles) { $why = ('No access token for {0} could be had, so its permissions were not checked.' -f $api.resource) }
|                } catch { $roles = $null; $why = ('No access token for {0} could be had, so its permissions were not checked ({1}).' -f $api.resource, $_.Exception.Message) }
|                foreach ($i in (Test-SIPermissionApiRoles -Api $api -TokenRoles $roles -Fix ([string]$fix.api) -Reason $why)) { $items.Add($i) }
|            }
|        }
|        if ($spec.Checks -contains 'azure' -and @($spec.Identity.azure).Count) {
|            $scope = Resolve-SIPermissionAzureScope -Globals $Globals
|            $perms = $null; $why = ''
|            if (-not $scope) { $why = 'The scope SecurityInsight collects from is not known here, so the Azure roles were not checked.' }
|            else {
|                try { $perms = & $GetArmPermissions $scope } catch { $perms = $null; $why = ('The Azure permissions at {0} could not be read ({1}), so the Azure roles were not checked.' -f $scope, $_.Exception.Message) }
|                if ($null -eq $perms -and -not $why) { $why = ('The Azure permissions at {0} could not be read, so the Azure roles were not checked.' -f $scope) }
|            }
|            foreach ($i in (Test-SIPermissionAzureActions -Items @($spec.Identity.azure) -Permissions $perms -Scope $scope -Fix ([string]$fix.azure) -Reason $why)) { $items.Add($i) }
|        }
|        $result = [pscustomobject]@{
|            Engine = $spec.Engine; Identity = $identity; IdentityKey = $spec.IdentityKey; Label = [string]$spec.Identity.label
|            Checks = $spec.Checks; DatabaseRoles = @($spec.Identity.database | ForEach-Object { [string]$_ }); DatabaseFix = [string]$fix.database
|            Checked = $items.ToArray(); Error = ''; CheckedAt = [datetime]::UtcNow
|        }
|    } catch {
|        # the check itself failed: recorded as such (Get Started counts it as open), and the run goes on
|        $result = [pscustomobject]@{ Engine = $Engine; Identity = ''; IdentityKey = ''; Label = ''; Checks = @(); DatabaseRoles = @(); DatabaseFix = ''
|            Checked = @(); Error = ('The permission check could not run: {0}' -f $_.Exception.Message); CheckedAt = [datetime]::UtcNow }
|    }
|    $global:SI_PermissionCheck = $result
|    if (-not $Quiet) { try { Write-SIPermissionCheckSummary -Check $result } catch { } }
|    $result
|}
|
|function Complete-SIPermissionCheck {
|    <#
|        PURE. The check as it stands at the end of the run: the conditional items whose setting is off are dropped (asset
|        tagging writes only with SI_Pro_AssetTagging_Apply), and -- on a Pro install (SI_ProSqlServer + SI_ProSqlDatabase)
|        when the engine checks the database -- the Pro database items from -DatabaseAccess. Community: no database area.
|    #>
|    param([Parameter(Mandatory)]$Check, [hashtable]$Globals = @{}, $DatabaseAccess)
|    $g = { param($n) if ($Globals.ContainsKey($n)) { $Globals[$n] } else { $null } }
|    $items = New-Object System.Collections.Generic.List[object]
|    foreach ($i in @($Check.Checked)) {
|        if (-not $i) { continue }
|        if ($i.When -and -not (Test-SIPermissionTruthy (& $g ([string]$i.When)))) { continue }
|        $items.Add($i)
|    }
|    $isPro = -not [string]::IsNullOrWhiteSpace([string](& $g 'SI_ProSqlServer')) -and -not [string]::IsNullOrWhiteSpace([string](& $g 'SI_ProSqlDatabase'))
|    if ($isPro -and @($Check.Checks) -contains 'database' -and @($Check.DatabaseRoles).Count) {
|        foreach ($i in (Test-SIPermissionDatabaseRoles -Roles @($Check.DatabaseRoles) -Access $DatabaseAccess -Fix ([string]$Check.DatabaseFix))) { $items.Add($i) }
|    }
|    [pscustomobject]@{ Engine = $Check.Engine; Identity = $Check.Identity; IdentityKey = $Check.IdentityKey; Label = $Check.Label
|        Checked = $items.ToArray(); Error = [string]$Check.Error; CheckedAt = $Check.CheckedAt }
|}
|
|function Get-SIPermissionListFingerprint {
|    <#
|        PURE. A short fingerprint of a set of permission names ('<api>|<permission>'; case, order and repeats do not
|        matter): 16 hex characters of their SHA-256, '' for an empty set. The run record carries the fingerprint of the
|        application permissions an engine actually CHECKED; a reader that holds the list (the update's note about
|        permissions an existing install has not granted yet, setup/_shared/SI-PermissionNote.ps1) can tell "nothing is
|        missing from THIS list" from "nothing was missing from an older, shorter list".
|    #>
|    param([string[]]$Names = @())
|    $set = @{}
|    foreach ($n in @($Names)) { $k = "$n".Trim().ToLowerInvariant(); if ($k) { $set[$k] = $true } }
|    if (-not $set.Count) { return '' }
|    [string[]]$keys = @($set.Keys)
|    [Array]::Sort($keys, [System.StringComparer]::Ordinal)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $hash = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes(($keys -join "`n"))) } finally { $sha.Dispose() }
|    $hex = New-Object System.Text.StringBuilder
|    foreach ($b in $hash) { $null = $hex.Append($b.ToString('x2')) }
|    $hex.ToString().Substring(0, 16)
|}
|
|function ConvertTo-SIPermissionGapsJson {
|    <#
|        PURE. What the run-health record carries: the engine, its identity and ONLY the gaps and the not-checked items (an
|        empty list = every permission is in place). Kept short: at most -MaxItems items, then 'more' says how many were left
|        out (the missing ones first). 'apiChecked' = the fingerprint of the application permissions that WERE checked
|        (ok or missing; Get-SIPermissionListFingerprint) -- absent when none was.
|    #>
|    param([Parameter(Mandatory)]$Check, [int]$MaxItems = 40)
|    $gaps = @(@($Check.Checked) | Where-Object { $_ -and $_.State -eq 'missing' }) + @(@($Check.Checked) | Where-Object { $_ -and $_.State -eq 'not-checked' })
|    $keep = @($gaps | Select-Object -First $MaxItems)
|    $list = New-Object System.Collections.Generic.List[object]
|    foreach ($i in $keep) { $list.Add([ordered]@{ area = [string]$i.Area; item = [string]$i.Item; state = [string]$i.State; fix = [string]$i.Fix }) }
|    $o = [ordered]@{ v = 1; engine = [string]$Check.Engine; identity = [string]$Check.Identity; label = [string]$Check.Label
|        missing = @($gaps | Where-Object { $_.State -eq 'missing' }).Count; notChecked = @($gaps | Where-Object { $_.State -eq 'not-checked' }).Count
|        items = $list.ToArray(); more = ($gaps.Count - $keep.Count) }
|    if ([string]$Check.Error) { $o['error'] = [string]$Check.Error }
|    # the application permissions this run checked on its own token (every area but the Azure roles and the database)
|    $apiNames = @(@($Check.Checked) | Where-Object { $_ -and [string]$_.State -ne 'not-checked' -and @('Azure', 'Pro database') -notcontains [string]$_.Area } | ForEach-Object { '{0}|{1}' -f $_.Area, $_.Item })
|    if ($apiNames.Count) { $o['apiChecked'] = Get-SIPermissionListFingerprint -Names $apiNames }
|    # -InputObject: a 1-item list stays a list in PS 5.1
|    ConvertTo-Json -InputObject $o -Depth 5 -Compress
|}
|
|function Get-SIRunHealthPermissionGaps {
|    <#
|        The PermissionGaps value of a run-health record: '' unless this process ran the self-check, the record is an END
|        record and it is the engine's own (the job flow's step records 'flow:<engine>' speak for another job's identity).
|        NEVER THROWS.
|    #>
|    param($RunContext, [string]$Phase = 'End')
|    try {
|        if ($Phase -ne 'End') { return '' }
|        $chk = Get-Variable -Scope Global -Name SI_PermissionCheck -ValueOnly -ErrorAction SilentlyContinue
|        if (-not $chk) { return '' }
|        $eng = if ($RunContext) { [string]$RunContext.Engine } else { '' }
|        if ($eng -like 'flow:*') { return '' }
|        $db = Get-Variable -Scope Global -Name SI_ProDatabaseAccess -ValueOnly -ErrorAction SilentlyContinue
|        $done = Complete-SIPermissionCheck -Check $chk -Globals (Get-SIPermissionGlobals) -DatabaseAccess $db
|        return (ConvertTo-SIPermissionGapsJson -Check $done)
|    } catch { return '' }
|}
|
|function Write-SIPermissionCheckSummary {
|    <# One line per missing permission (customer-facing), one line for what could not be checked; never throws. #>
|    param($Check)
|    if (-not $Check) { return }
|    if ([string]$Check.Error) { Write-Warning ('[permissions] {0}' -f $Check.Error); return }
|    $who = if ($Check.Identity) { '{0} ({1})' -f $Check.Label, $Check.Identity } else { $Check.Label }
|    $missing = @(@($Check.Checked) | Where-Object { $_.State -eq 'missing' -and -not $_.When })
|    $notChecked = @(@($Check.Checked) | Where-Object { $_.State -eq 'not-checked' -and -not $_.When })
|    if (-not $missing.Count) { Write-Host ('[permissions] {0}: every permission checked is in place{1}.' -f $who, $(if ($notChecked.Count) { ' ({0} could not be checked)' -f $notChecked.Count } else { '' })) }
|    foreach ($m in $missing) { Write-Warning ('[permissions] {0} is missing {1} {2} -- {3}' -f $who, $m.Area, $m.Item, $m.Fix) }
|    foreach ($a in @($notChecked | Group-Object Area)) { Write-Host ('[permissions] {0}: {1} not checked -- {2}' -f $who, $a.Name, $a.Group[0].Fix) }
|}
'@ }
$__siSupportFiles['config/permissions.locked.json'] = @{ Sha256 = '11f97b17d5db0d350ab66a9199a0f0443910ddbab9ac1cda186bae37a1795e4c'; Text = @'
|{
|  "_": "THE ONE LIST of what each SecurityInsight engine's own identity must hold, read by the engines' permission self-check at run start (engine/_shared/SI-PermissionCheck.ps1), recorded on the run-health END record (PermissionGaps) and shown in Get Started > Permissions. The application permissions are the same as the grant plans in container/_shared/SI-ContainerConfig.ps1 (collection: SIContainerIdentityAppRoles, asset tagging: SIAssetTaggingIdentityAppRoles) -- tests/pester/SIv3-PermissionCheck.Tests.ps1 fails when they drift apart. 'when' = only while that setting is on (asset tagging writes only when SI_Pro_AssetTagging_Apply is on). 'azure' items are Azure actions checked at the collection scope with ONE read of the caller's own permissions. 'database' items are roles in the Pro database (Pro installs only; absent on Community). 'engines' says which identity each container engine (SI_ENGINE) runs as and which areas it checks; an engine not listed uses 'default'.",
|  "version": 1,
|  "identities": {
|    "collection": {
|      "label": "SecurityInsight's collection identity",
|      "api": [
|        {
|          "resource": "Microsoft Graph",
|          "resourceAppId": "00000003-0000-0000-c000-000000000000",
|          "audience": "https://graph.microsoft.com/",
|          "roles": [
|            "User.Read.All", "Group.Read.All", "Directory.Read.All", "Device.Read.All", "Application.Read.All",
|            "AuditLog.Read.All", "Policy.Read.All", "RoleManagement.Read.All", "RoleManagement.Read.Directory",
|            "RoleManagementPolicy.Read.Directory", "RoleEligibilitySchedule.Read.Directory", "RoleAssignmentSchedule.Read.Directory",
|            "PrivilegedAccess.Read.AzureADGroup", "IdentityRiskyUser.Read.All", "IdentityRiskEvent.Read.All",
|            "IdentityRiskyServicePrincipal.Read.All", "ThreatHunting.Read.All", "UserAuthenticationMethod.Read.All", "DeviceManagementManagedDevices.Read.All", "DeviceManagementConfiguration.Read.All", "AccessReview.Read.All", "SecurityAlert.Read.All", "SecurityEvents.Read.All"
|          ],
|          "conditionalRoles": []
|        },
|        {
|          "resource": "Microsoft Threat Protection",
|          "resourceAppId": "8ee8fdad-f234-4243-8f3b-15c294843740",
|          "audience": "https://api.security.microsoft.com/",
|          "roles": [ "AdvancedHunting.Read.All" ],
|          "conditionalRoles": []
|        },
|        {
|          "resource": "WindowsDefenderATP",
|          "resourceAppId": "fc780465-2017-40d4-a0c5-307022471b92",
|          "audience": "https://api.securitycenter.microsoft.com/",
|          "roles": [ "Machine.Read.All", "Vulnerability.Read.All", "SecurityRecommendation.Read.All", "Score.Read.All" ],
|          "conditionalRoles": []
|        }
|      ],
|      "azure": [
|        { "item": "Reader", "action": "*/read" }
|      ],
|      "database": [ "db_datareader", "db_datawriter" ],
|      "fix": {
|        "api": "Grant the application permission and give admin consent: for the managed identity run setup\\Grant-SIIdentity.ps1 -IdentityName <identity> -IdentityResourceGroup <resource group> -Apply; for an app registration run setup\\Grant-SIIdentity.ps1 -AppId <client id> -Apply.",
|        "azure": "Give the identity Reader where SecurityInsight collects from (the subscription, a management group or the tenant root group): setup\\Grant-SIIdentity.ps1 -IdentityName <identity> -IdentityResourceGroup <resource group> -ReaderScopes <scope> -Apply.",
|        "database": "As the SQL server's Entra admin, give the identity a user in the Pro database with db_datareader and db_datawriter: run the guided install again (setup\\Install-SecurityInsight.ps1) -- its database step adds it."
|      }
|    },
|    "tagging": {
|      "label": "asset tagging's own identity",
|      "api": [
|        {
|          "resource": "Microsoft Graph",
|          "resourceAppId": "00000003-0000-0000-c000-000000000000",
|          "audience": "https://graph.microsoft.com/",
|          "roles": [ "ThreatHunting.Read.All", "User.Read.All", "Application.Read.All" ],
|          "conditionalRoles": [ { "role": "CustomSecAttributeAssignment.ReadWrite.All", "when": "SI_Pro_AssetTagging_Apply" } ]
|        },
|        {
|          "resource": "WindowsDefenderATP",
|          "resourceAppId": "fc780465-2017-40d4-a0c5-307022471b92",
|          "audience": "https://api.securitycenter.microsoft.com/",
|          "roles": [],
|          "conditionalRoles": [ { "role": "Machine.ReadWrite.All", "when": "SI_Pro_AssetTagging_Apply" } ]
|        }
|      ],
|      "azure": [
|        { "item": "Reader", "action": "*/read" },
|        { "item": "Tag Contributor", "action": "Microsoft.Resources/tags/write", "when": "SI_Pro_AssetTagging_Apply" }
|      ],
|      "database": [ "db_datareader" ],
|      "fix": {
|        "api": "Grant asset tagging's permissions and give admin consent: setup\\Grant-SIIdentity.ps1 -IdentityName uami-securityinsight-tagging -IdentityResourceGroup <resource group> -Tagging -Apply.",
|        "azure": "Give asset tagging's identity its Azure roles: setup\\Grant-SIIdentity.ps1 -IdentityName uami-securityinsight-tagging -IdentityResourceGroup <resource group> -Tagging -Apply.",
|        "database": "As the SQL server's Entra admin, once: setup\\Grant-SITaggingDatabase.ps1 -SubscriptionId <subscription> -ResourceGroupName <resource group> -SqlServer <server> -SqlDatabase <database> -Apply."
|      }
|    }
|  },
|  "engines": {
|    "default": { "identity": "collection", "checks": [ "database" ] },
|    "identity": { "identity": "collection", "checks": [ "api", "azure", "database" ] },
|    "azure": { "identity": "collection", "checks": [ "api", "azure", "database" ] },
|    "endpoint": { "identity": "collection", "checks": [ "api", "azure", "database" ] },
|    "publicip": { "identity": "collection", "checks": [ "api", "azure", "database" ] },
|    "risk-analysis": { "identity": "collection", "checks": [ "api", "azure", "database" ] },
|    "verification": { "identity": "collection", "checks": [ "api", "azure", "database" ] },
|    "asset-tagging": { "identity": "tagging", "checks": [ "api", "azure", "database" ] }
|  }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-SummaryGroupsRebuild.ps1'] = @{ Sha256 = 'e449401a7eed59ce0d2ad23e3c48349a3aae6a754c7407509f75a6f4b4220948'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- #842 (owner 2026-10-20: Security recommendations > Summary "still not working"). THE SUMMARY VIEWS OF AN
|    EXISTING INSTALL ARE WRITTEN AGAIN RIGHT AFTER AN UPDATE THAT CHANGED THEM -- not on the next nightly run.
|
|    The Summary views are groupings the data sync writes per collection (engine\pro-data\_shared\SI-DataSummaryGroups.ps1:
|    sidata.SummaryGroup / SummaryGroupCounted, sidata.SummaryGroupState with the hash of the definition they were written
|    from). A collection written from another definition (data-model\summary-groupings.locked.json changed -- a new grouping,
|    a new default) is written again by the NEXT data sync. Until then the view it lacks is not there: after the update of
|    2026-10-20 the new default view of every collection waited a day for the nightly run.
|
|    The step, run by the update (Invoke-SIContainerUpdate.ps1 step 9f), Pro only:
|      * reads how many live complete Detailed collections were written from another definition than the one this release
|        ships (Get-SISummaryGroupingDefinition .Hash -- the engine's own hash; nothing is hashed here);
|      * none -> nothing, and nothing is said (every later update finds none too: the step is idempotent);
|      * some -> queues ONE run of the pipeline step asset-datasync in cfg.PipelineQueue -- the same statement and the same
|        dedup the web app's "Run now" and the runner use (Get-SIPipelineSqlText 'Enqueue'): a request that already waits is
|        kept once. A queued request never runs over anything: it waits until the install's lock is free (a pipeline run
|        going finishes first), then the pipeline job takes it on its next wake-up (every 5 minutes);
|      * a pipeline run, the Deliver stage or a data sync already waiting -> nothing is queued (that run writes them);
|      * the install runs its jobs on their own schedules (Operations > Jobs: Schedules), or the pipeline has no data sync
|        step -> nothing is queued; the data sync's next run writes them (said).
|    One plain line in the update log. Never fails the update. PURE planning (Get-SISummaryGroupsRebuildPlan) over two SQL
|    seams (the data database, the Pro database).
|#>
|
|if (-not (Get-Command -Name Get-SIPipelineSqlText -ErrorAction SilentlyContinue)) {
|    $siPipe = [IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'engine', '_shared', 'SI-Pipeline.ps1')
|    if (Test-Path -LiteralPath $siPipe) { . $siPipe }
|}
|
|$script:SISummaryRebuild = @{ Step = 'asset-datasync'; By = 'SecurityInsight update' }
|
|function Get-SISummaryGroupsRebuildSql {
|    <#
|        'Stale' (the data database, @Hash): how many live complete Detailed collections hold Summary views written from another
|        definition; -1 = the database has no Summary views yet (the schema step adds them; the data sync then fills them).
|        'Pipeline' (the Pro database): the pipeline's mode and definition, and the requests that wait in its queue.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Stale', 'Pipeline')][string]$Name)
|    if ($Name -eq 'Stale') {
|        return @'
|IF OBJECT_ID(N'sidata.SummaryGroupState') IS NULL OR OBJECT_ID(N'sidata.Collection') IS NULL OR COL_LENGTH(N'sidata.SummaryGroupState', N'DefinitionHash') IS NULL
|BEGIN SELECT CAST(-1 AS int) AS Stale; RETURN; END
|DECLARE @q nvarchar(max) = N'SELECT COUNT(*) AS Stale FROM sidata.SummaryGroupState AS s JOIN sidata.Collection AS c ON c.CollectionId = s.CollectionId WHERE c.Status = N''Complete'' AND c.Kind = N''Detailed'' AND ISNULL(s.DefinitionHash, N'''') <> @Hash'
|    + CASE WHEN COL_LENGTH(N'sidata.Collection', N'RetiredAt') IS NULL THEN N'' ELSE N' AND c.RetiredAt IS NULL' END + N';';
|EXEC sys.sp_executesql @q, N'@Hash nvarchar(64)', @Hash = @Hash;
|'@
|    }
|    @'
|DECLARE @mode nvarchar(16) = NULL, @def nvarchar(max) = NULL;
|IF OBJECT_ID(N'cfg.JobFlow') IS NOT NULL SELECT @mode = Mode, @def = DefinitionJson FROM cfg.JobFlow WHERE FlowId = N'daily';
|IF OBJECT_ID(N'cfg.PipelineQueue') IS NULL
|    SELECT N'flow' AS Kind, CAST(@mode AS nvarchar(max)) AS Scope, @def AS Target, CAST(0 AS int) AS HasQueue;
|ELSE
|    SELECT N'flow' AS Kind, CAST(@mode AS nvarchar(max)) AS Scope, @def AS Target, CAST(1 AS int) AS HasQueue
|    UNION ALL
|    SELECT N'queued', CAST(Scope AS nvarchar(max)), CAST(Target AS nvarchar(max)), CAST(1 AS int) FROM cfg.PipelineQueue WHERE PipelineId = N'daily' AND State = N'Queued';
|'@
|}
|
|function Test-SISummaryGroupsRebuildCovered {
|    <# PURE. A waiting request that runs the data sync: the pipeline, the Deliver stage, the data sync step (or the pipeline from it). #>
|    param($Request)
|    $scope = ([string]$Request.Scope).Trim().ToLowerInvariant(); $target = ([string]$Request.Target).Trim().ToLowerInvariant()
|    if ($target.StartsWith('caj-si-')) { $target = $target.Substring(7) }
|    ($scope -eq 'pipeline') -or ($scope -eq 'stage' -and $target -eq 'deliver') -or ($scope -in 'step', 'from-step' -and $target -eq $script:SISummaryRebuild.Step)
|}
|
|function Get-SISummaryGroupsRebuildPlan {
|    <#
|        PURE. -Stale: collections written from another definition (-1 = no Summary views in the database yet); -Mode / -DefinitionJson:
|        the stored pipeline (empty = none stored: the default pipeline over the installed jobs); -Queued: the waiting requests
|        (Scope, Target); -HasQueue: cfg.PipelineQueue exists; -DataSyncInstalled: the install has the data sync job.
|        Returns @{ Action = none | schedules | no-step | no-queue | already | queue; Stale; Lines }.
|    #>
|    param([int]$Stale = 0, [string]$Mode = '', [string]$DefinitionJson = '', [AllowEmptyCollection()][object[]]$Queued = @(),
|          [bool]$HasQueue = $true, [bool]$DataSyncInstalled = $true)
|    $n = [Math]::Max(0, $Stale)
|    $what = '{0} collection(s) hold Summary views from the previous version' -f $n
|    $out = { param($a, $l) [pscustomobject]@{ Action = $a; Stale = $n; Lines = @($l | Where-Object { $_ }) } }
|    if ($Stale -le 0) { return (& $out 'none' @()) }
|    if (([string]$Mode).Trim().ToLowerInvariant() -eq 'schedules') {
|        return (& $out 'schedules' ('summary views: {0} -- the data sync writes them again on its next scheduled run (this install runs its jobs on their own schedules)' -f $what))
|    }
|    $hasStep = $DataSyncInstalled -and (-not ([string]$DefinitionJson).Trim() -or ([string]$DefinitionJson -match '(?i)"job"\s*:\s*"(caj-si-)?asset-datasync"'))
|    if (-not $hasStep) {
|        return (& $out 'no-step' ('summary views: {0} -- the data sync is not a step of the pipeline, so nothing is queued; the data sync writes them again on its next run' -f $what))
|    }
|    if (-not $HasQueue) {
|        return (& $out 'no-queue' ('summary views: {0} -- the pipeline''s queue is not in the database yet, so nothing is queued; the next data sync writes them again' -f $what))
|    }
|    if (@($Queued | Where-Object { $_ -and (Test-SISummaryGroupsRebuildCovered $_) }).Count) {
|        return (& $out 'already' ('summary views: {0} -- a data sync already waits in the queue and writes them again' -f $what))
|    }
|    & $out 'queue' ('summary views: {0} -- the data sync is queued now to write them again; it starts as soon as no pipeline run is going' -f $what)
|}
|
|function Invoke-SISummaryGroupsRebuild {
|    <#
|        -DataSql / -Sql: { param($Query, $Params, $Mode) } over the data database and the Pro database ('reader' -> rows);
|        -Hash: the shipped definition's hash (Get-SISummaryGroupingDefinition .Hash); -DataSyncInstalled: the install has the
|        data sync job. -WhatIf: the plan only. Never throws. Returns @{ Action = none | schedules | no-step | no-queue | already
|        | queued | plan | failed; Lines }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$DataSql, [Parameter(Mandatory)][scriptblock]$Sql, [Parameter(Mandatory)][string]$Hash,
|          [bool]$DataSyncInstalled = $true, [switch]$WhatIf)
|    $rows = { param($r) @($r | ForEach-Object { $_ } | Where-Object { $_ } | ForEach-Object { if ($_ -is [System.Collections.IDictionary]) { [pscustomobject]$_ } else { $_ } }) }
|    $val = { param($o, $n) if ($null -eq $o) { return $null }; $p = $o.PSObject.Properties[$n]; if ($p -and $null -ne $p.Value -and -not ($p.Value -is [DBNull])) { $p.Value } else { $null } }
|    try {
|        if (-not "$Hash".Trim()) { throw 'the shipped definition of the Summary views has no hash' }
|        $s = @(& $rows (& $DataSql (Get-SISummaryGroupsRebuildSql -Name Stale) @{ Hash = [string]$Hash } 'reader'))
|        $stale = if ($s.Count) { [int](& $val $s[0] 'Stale') } else { 0 }
|        if ($stale -le 0) { return [pscustomobject]@{ Action = 'none'; Lines = @() } }
|        $p = @(& $rows (& $Sql (Get-SISummaryGroupsRebuildSql -Name Pipeline) @{} 'reader'))
|        $flow = @($p | Where-Object { [string]$_.Kind -eq 'flow' })[0]
|        $plan = Get-SISummaryGroupsRebuildPlan -Stale $stale -Mode ([string](& $val $flow 'Scope')) -DefinitionJson ([string](& $val $flow 'Target')) `
|            -Queued @($p | Where-Object { [string]$_.Kind -eq 'queued' }) -HasQueue ($flow -and [int](& $val $flow 'HasQueue') -eq 1) -DataSyncInstalled $DataSyncInstalled
|        if ($plan.Action -ne 'queue') { return [pscustomobject]@{ Action = $plan.Action; Lines = $plan.Lines } }
|        if ($WhatIf) { return [pscustomobject]@{ Action = 'plan'; Lines = @($plan.Lines | ForEach-Object { $_ -replace 'is queued now', 'would be queued (re-run with -Apply)' }) } }
|        if (-not (Get-Command -Name Get-SIPipelineSqlText -ErrorAction SilentlyContinue)) { throw 'the pipeline''s queue statement is not loaded' }
|        $note = 'the update changed the Summary views: the data sync writes them again for {0} collection(s)' -f $plan.Stale
|        $q = @(& $rows (& $Sql (Get-SIPipelineSqlText 'Enqueue') @{ Scope = 'step'; Target = $script:SISummaryRebuild.Step; Trg = 'manual'; RequestedBy = $script:SISummaryRebuild.By; SlotUtc = $null; Note = $note } 'reader'))
|        $outcome = if ($q.Count) { [string](& $val $q[0] 'Outcome') } else { 'Missing' }
|        switch ($outcome) {
|            'Queued' { return [pscustomobject]@{ Action = 'queued'; Lines = $plan.Lines } }
|            'Deduplicated' { return [pscustomobject]@{ Action = 'already'; Lines = @(('summary views: {0} collection(s) hold Summary views from the previous version -- a data sync already waits in the queue and writes them again' -f $plan.Stale)) } }
|            default { return [pscustomobject]@{ Action = 'no-queue'; Lines = @(('summary views: {0} collection(s) hold Summary views from the previous version -- the pipeline''s queue is not in the database yet, so nothing is queued; the next data sync writes them again' -f $plan.Stale)) } }
|        }
|    } catch {
|        return [pscustomobject]@{ Action = 'failed'; Lines = @(('summary views: whether they must be written again was not checked ({0}) -- the next data sync writes them; the next update checks again' -f $_.Exception.Message)) }
|    }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-SummaryGroupings.ps1'] = @{ Sha256 = 'a82d2b93cce303bf3269f88847bd6d4b30d9d81a3336479603e84d7609cf27ff'; Text = @'
|#Requires -Version 5.1
|<#
|    THE SUMMARY GROUPINGS -- ONE DEFINITION, ONE FUNCTION, BOTH EDITIONS (REQUIREMENTS #636, owner 2026-10-19: "summary could
|    be build as views with the detailed data instead. it is just views with groupings of data instead, like group per tier
|    category" / "community must switch" / "same core functionality").
|
|    The Summary-shaped views (one row per recommendation with its affected assets, per asset, per tier, per Domain > Category
|    > Subcategory, per risk rating, per department, per severity, per report) are GROUPINGS OF THE DETAILED FINDINGS -- never
|    a second Risk Analysis. data-model\summary-groupings.locked.json declares them (keys and measures); this file is the ONE
|    engine function that computes them, Invoke-SISummaryGrouping:
|
|      * -Rows / -Pager  the Detailed result in the run (Community: no SQL -- its management mail and outputs read it);
|      * -AsSql          the statement that computes the very same groupings for ONE stored collection (@CollectionId) in the
|                        Pro database and writes them, typed and indexed, into sidata.SummaryGroup / SummaryGroupCounted /
|                        SummaryGroupState (the data sync runs it: engine\pro-data\_shared\SI-DataSummaryGroups.ps1).
|
|    Both read ONE compiled plan of the definition (Get-SISummaryGroupingPlan): the same fields, the same normalisation of each
|    value (the same trimming, the same tier words, the same severity words), the same measures. A test holds the two paths
|    equal on the same findings (tests\pester\SIv3-SummaryGroupings.Tests.ps1, on a real SQL Server too). There is no second
|    summary logic anywhere: a new grouping is one entry in the definition.
|
|    Every finding counts: no cap, no sample. The counted variant (#264) leaves out the rows with an exemption mark.
|    PURE except Invoke-SISummaryGrouping -AsSql (returns text) -- nothing here reads or writes a database.
|#>
|
|$script:SISummaryGroupingDefinitionPath = [IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'data-model', 'summary-groupings.locked.json')
|$script:SISummaryGroupingPlanCache = $null
|
|function Get-SISummaryGroupingDefinition {
|    <# The definition (data-model\summary-groupings.locked.json) as an object, with .Hash = SHA-256 of its text (the data sync
|       writes a collection again when the definition changed). -Path: another file (tests). #>
|    param([string]$Path = $script:SISummaryGroupingDefinitionPath)
|    $text = [IO.File]::ReadAllText($Path)
|    $def = $text | ConvertFrom-Json
|    $sha = [Security.Cryptography.SHA256]::Create()
|    try { $hash = -join ($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes(($text -replace "`r`n", "`n"))) | ForEach-Object { $_.ToString('x2') }) } finally { $sha.Dispose() }
|    $def | Add-Member -NotePropertyName Hash -NotePropertyValue $hash.Substring(0, 32) -Force
|    $def
|}
|
|function Get-SISummaryGroupingPlan {
|    <#
|        PURE. The definition compiled once: .Fields (name -> @{ Kind; Max; Sql; Row; PathRow }), .Measures, .Groupings
|        (each with .Keys[3] -- '' for an unused key -- and .LabelField), .SeverityWords, .Exempted, .Hash, .MeasureIds.
|        Refuses a definition that names an unknown field, an unknown kind or op, or more than three keys.
|    #>
|    param($Definition)
|    if (-not $Definition) {
|        if ($script:SISummaryGroupingPlanCache) { return $script:SISummaryGroupingPlanCache }
|        $Definition = Get-SISummaryGroupingDefinition
|        $cache = $true
|    } else { $cache = $false }
|    # 'tokens' (#812): a ';'-list -- a finding counts once under each distinct token (MITRE tactics / techniques, compliance
|    # controls); 'band': a number into the labelled bands the field declares (the CVSS bands)
|    # 'date' (2026-10-20): the day yyyy-MM-dd, none = no value -- an attribute's first seen
|    $kinds = @('text', 'tier', 'tierNumber', 'severity', 'id', 'number', 'flag', 'presence', 'tokens', 'band', 'date')
|    $ops = @('count', 'countDistinct', 'max', 'min', 'sum')
|    $fields = [ordered]@{}
|    foreach ($p in $Definition.fields.PSObject.Properties) {
|        $f = $p.Value
|        if ($kinds -cnotcontains [string]$f.kind) { throw ("summary groupings: field '{0}' has an unknown kind '{1}'" -f $p.Name, $f.kind) }
|        if ([string]$p.Name -notmatch '^[a-zA-Z][a-zA-Z0-9]{0,30}$') { throw ("summary groupings: '{0}' is not a field name" -f $p.Name) }
|        $max = 0; if ($f.PSObject.Properties['max']) { $max = [int]$f.max }
|        if ($f.kind -in 'text', 'tokens' -and $max -le 0) { throw ("summary groupings: {0} field '{1}' needs 'max'" -f $f.kind, $p.Name) }
|        if ($f.kind -eq 'tokens' -and $max -gt 400) { throw ("summary groupings: tokens field '{0}': a token is a key, at most 400 characters" -f $p.Name) }
|        $split = @(); if ($f.PSObject.Properties['split']) { $split = @($f.split | ForEach-Object { [string]$_ } | Where-Object { $_ -and $_ -ne ';' }) }
|        $bands = @(); $else = ''
|        if ($f.kind -eq 'band') {
|            foreach ($b in @($f.bands)) {
|                $atLeast = $b.PSObject.Properties['atLeast']; $above = $b.PSObject.Properties['above']
|                if (-not ($atLeast -or $above) -or -not [string]$b.label) { throw ("summary groupings: band field '{0}': every band needs 'atLeast' or 'above' and a 'label'" -f $p.Name) }
|                $bands += [pscustomobject]@{ Op = $(if ($atLeast) { '>=' } else { '>' }); Value = [double]$(if ($atLeast) { $atLeast.Value } else { $above.Value }); Label = [string]$b.label }
|            }
|            if ($bands.Count -eq 0 -or -not $f.PSObject.Properties['else']) { throw ("summary groupings: band field '{0}' needs 'bands' and 'else'" -f $p.Name) }
|            $else = [string]$f.else
|        }
|        $fields[$p.Name] = [pscustomobject]@{ Name = $p.Name; Kind = [string]$f.kind; Max = $max; Sql = [string]$f.sql; Split = $split; Bands = $bands; Else = $else
|            Row = @($f.row | ForEach-Object { [string]$_ }); PathRow = @($(if ($f.PSObject.Properties['pathRow']) { $f.pathRow | ForEach-Object { [string]$_ } })) }
|    }
|    $need = { param($n, $what) if (-not $fields.Contains([string]$n)) { throw ("summary groupings: {0} names the unknown field '{1}'" -f $what, $n) } }
|    # a tokens field is only ever a grouping key (one per grouping): a finding stands under several of its values
|    $noTokens = { param($n, $what) if ($n -and $fields[[string]$n].Kind -eq 'tokens') { throw ("summary groupings: {0} names the tokens field '{1}' -- a tokens field is a grouping key only" -f $what, $n) } }
|    $measures = foreach ($m in @($Definition.measures)) {
|        if ($ops -cnotcontains [string]$m.op) { throw ("summary groupings: measure '{0}' has an unknown op '{1}'" -f $m.id, $m.op) }
|        if ([string]$m.id -notmatch '^[A-Z][A-Za-z0-9]{0,40}$') { throw ("summary groupings: '{0}' is not a measure id" -f $m.id) }
|        $fld = ''; if ($m.PSObject.Properties['field'] -and $m.field) { $fld = [string]$m.field; & $need $fld ("measure '{0}'" -f $m.id); & $noTokens $fld ("measure '{0}'" -f $m.id) }
|        if ($m.op -ne 'count' -and -not $fld) { throw ("summary groupings: measure '{0}' needs a field" -f $m.id) }
|        $wf = ''; $wv = ''
|        if ($m.PSObject.Properties['where'] -and $m.where) { $wf = [string]$m.where.field; $wv = [string]$m.where.equals; & $need $wf ("measure '{0}' (where)" -f $m.id); & $noTokens $wf ("measure '{0}' (where)" -f $m.id) }
|        [pscustomobject]@{ Id = [string]$m.id; Op = [string]$m.op; Field = $fld; WhereField = $wf; WhereEquals = $wv }
|    }
|    $groupings = foreach ($g in @($Definition.groupings)) {
|        $keys = @($g.keys | ForEach-Object { [string]$_ })
|        if ($keys.Count -lt 1 -or $keys.Count -gt 3) { throw ("summary groupings: grouping '{0}' needs 1 to 3 keys" -f $g.id) }
|        foreach ($k in $keys) { & $need $k ("grouping '{0}'" -f $g.id) }
|        if (@($keys | Where-Object { $fields[$_].Kind -eq 'tokens' }).Count -gt 1) { throw ("summary groupings: grouping '{0}' has more than one tokens key" -f $g.id) }
|        if ([string]$g.id -notmatch '^[a-z][a-z0-9\-]{0,39}$') { throw ("summary groupings: '{0}' is not a grouping id" -f $g.id) }
|        $lf = ''; if ($g.PSObject.Properties['labelField'] -and $g.labelField) { $lf = [string]$g.labelField; & $need $lf ("grouping '{0}' (label)" -f $g.id); & $noTokens $lf ("grouping '{0}' (label)" -f $g.id) }
|        # attributes (owner 2026-10-20, the Summary report's columns per row): max / min of a field, or a list of its distinct
|        # values -- never over a tokens field, and only on a grouping without a tokens key (the rows of a key are looked up)
|        $attrs = @(foreach ($a in @($(if ($g.PSObject.Properties['attributes']) { $g.attributes }))) {
|            if ([string]$a.id -notmatch '^[A-Z][A-Za-z0-9]{0,40}$') { throw ("summary groupings: '{0}' is not an attribute id (grouping '{1}')" -f $a.id, $g.id) }
|            if (@('max', 'min', 'list', 'first') -cnotcontains [string]$a.op) { throw ("summary groupings: attribute '{0}' of grouping '{1}' has an unknown op '{2}'" -f $a.id, $g.id, $a.op) }
|            $ord = @(); if ($a.PSObject.Properties['order']) { $ord = @($a.order | ForEach-Object { [string]$_ } | Where-Object { $_ }) }
|            if ($a.op -eq 'first' -and $ord.Count -lt 1) { throw ("summary groupings: attribute '{0}' of grouping '{1}' ('first') needs 'order'" -f $a.id, $g.id) }
|            & $need ([string]$a.field) ("grouping '{0}' (attribute '{1}')" -f $g.id, $a.id); & $noTokens ([string]$a.field) ("grouping '{0}' (attribute '{1}')" -f $g.id, $a.id)
|            if ($fields[[string]$a.field].Kind -notin 'text', 'date', 'tier', 'severity', 'band') { throw ("summary groupings: attribute '{0}' of grouping '{1}' reads a {2} field -- a text or date field only" -f $a.id, $g.id, $fields[[string]$a.field].Kind) }
|            $am = 0; if ($a.PSObject.Properties['max']) { $am = [int]$a.max }
|            if ($a.op -eq 'list' -and ($am -lt 1 -or $am -gt 100)) { throw ("summary groupings: list attribute '{0}' of grouping '{1}' needs 'max' 1..100" -f $a.id, $g.id) }
|            [pscustomobject]@{ Id = [string]$a.id; Op = [string]$a.op; Field = [string]$a.field; Max = $am; Order = $ord }
|        })
|        if ($attrs.Count -and @($keys | Where-Object { $fields[$_].Kind -eq 'tokens' }).Count) { throw ("summary groupings: grouping '{0}' has attributes and a tokens key" -f $g.id) }
|        if (@($attrs | ForEach-Object Id | Select-Object -Unique).Count -ne $attrs.Count) { throw ("summary groupings: grouping '{0}' names an attribute twice" -f $g.id) }
|        while ($keys.Count -lt 3) { $keys += '' }
|        [pscustomobject]@{ Id = [string]$g.id; Label = [string]$g.label; Keys = $keys; LabelField = $lf; Attributes = $attrs }
|    }
|    $sev = [ordered]@{}
|    foreach ($p in $Definition.severityWords.PSObject.Properties) { $sev[[string]$p.Name] = [string]$p.Value }
|    $ex = [string]$Definition.exempted; & $need $ex 'exempted'
|    $plan = [pscustomobject]@{ Fields = $fields; Measures = @($measures); Groupings = @($groupings); SeverityWords = $sev; Exempted = $ex
|        Hash = $(if ($Definition.PSObject.Properties['Hash']) { [string]$Definition.Hash } else { '' }); MeasureIds = @($measures | ForEach-Object { $_.Id }) }
|    if ($cache) { $script:SISummaryGroupingPlanCache = $plan }
|    $plan
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|#  THE NORMALISATION -- the same rule on both paths (PowerShell here, the SQL expression below)
|# ---------------------------------------------------------------------------------------------------------------------
|
|function ConvertTo-SISummaryGroupingValue {
|    <# PURE. One raw value normalised by its field's kind (see the definition's comment). Returns a string, a [double] or $null. #>
|    param($Field, [AllowNull()]$Value, $Plan)
|    if ($Field.Kind -eq 'tokens') { return , (ConvertTo-SISummaryGroupingTokens -Field $Field -Value $Value) }
|    if ($Field.Kind -eq 'date') { return (ConvertTo-SISummaryGroupingDay $Value) }
|    $s = ''
|    if ($null -ne $Value -and -not ($Value -is [DBNull])) {
|        if ($Value -is [bool]) { $s = $(if ($Value) { 'true' } else { 'false' }) }
|        elseif ($Value -is [double] -or $Value -is [single] -or $Value -is [decimal]) { $s = ([double]$Value).ToString('R', [Globalization.CultureInfo]::InvariantCulture) }
|        else { $s = ([string]$Value).Trim() }
|        # Log Analytics returns an empty dynamic value as text
|        if (@('{}', '[]', 'null', '@{}') -contains $s) { $s = '' }
|    }
|    switch ($Field.Kind) {
|        'text' { if ($s.Length -gt $Field.Max) { return $s.Substring(0, $Field.Max) }; return $s }
|        'tier' { $t = ConvertTo-SISummaryGroupingTier $s; if ($null -eq $t) { return 'Unclassified' }; return [string]$t }
|        'tierNumber' { return (ConvertTo-SISummaryGroupingTier $s) }
|        'severity' {
|            if (-not $s) { return 'None' }
|            $k = ($s.ToLowerInvariant() -replace '[\s\-_]', '')
|            if ($Plan.SeverityWords.Contains($k)) { return [string]$Plan.SeverityWords[$k] }
|            return 'Other'
|        }
|        'id' { $n = 0L; if ([long]::TryParse($s, [ref]$n)) { return [string]$n }; return '0' }
|        'number' { $d = 0.0; if ($s -and [double]::TryParse($s, [Globalization.NumberStyles]::Float, [Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $d }; return $null }
|        'flag' { if ($s -match '^(?i:true|1)$') { return '1' }; return '0' }
|        'presence' { if ($s) { return '1' }; return '0' }
|        'band' {
|            $d = 0.0
|            if (-not $s -or -not [double]::TryParse($s, [Globalization.NumberStyles]::Float, [Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return '' }
|            foreach ($b in $Field.Bands) { if (($b.Op -eq '>=' -and $d -ge $b.Value) -or ($b.Op -eq '>' -and $d -gt $b.Value)) { return $b.Label } }
|            return $Field.Else
|        }
|    }
|    $s
|}
|
|function ConvertTo-SISummaryGroupingTokens {
|    <#
|        PURE. A tokens field's value as its distinct tokens (string[]): a list (an array, a JSON array text, or a text) joined
|        with ';', every separator of the field's 'split' turned into ';', split on ';', each trimmed and cut to 'max', empty ones
|        dropped, distinct ignoring case (as SQL groups) -- the first spelling kept. Written to the pipeline one by one (wrap the call in @()). The twin of the SQL CROSS APPLY in
|        Get-SISummaryGroupingSqlText (and of the data sync's derive of the list columns).
|    #>
|    param($Field, [AllowNull()]$Value)
|    $items = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Value -or $Value -is [DBNull]) { return }
|    if ($Value -is [string]) {
|        $t = $Value.Trim()
|        if ($t.StartsWith('[') -and $t.EndsWith(']')) {
|            try { foreach ($x in @($t | ConvertFrom-Json)) { if ($null -ne $x) { $items.Add([string]$x) } } } catch { $items.Add($t) }
|        } else { $items.Add($t) }
|    } elseif ($Value -is [System.Collections.IEnumerable]) {
|        foreach ($x in $Value) { if ($null -ne $x) { $items.Add([string]$x) } }
|    } else { $items.Add([string]$Value) }
|    $s = $items -join ';'
|    foreach ($sep in $Field.Split) { $s = $s.Replace($sep, ';') }
|    $seen = [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($p in $s.Split(';')) {
|        $v = $p.Trim()
|        if ($v.Length -gt $Field.Max) { $v = $v.Substring(0, $Field.Max) }
|        if ($v -and @('{}', '[]', 'null', '@{}') -notcontains $v -and $seen.Add($v)) { $out.Add($v) }
|    }
|    $out.ToArray()
|}
|
|function ConvertTo-SISummaryGroupingDay {
|    <# PURE. A date as its day 'yyyy-MM-dd' (a [datetime] / [datetimeoffset], or a text read in the invariant culture -- an
|       offset is taken to UTC); anything else = $null. The twin of CONVERT(nvarchar(10), CONVERT(date, x), 23). #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -is [DBNull]) { return $null }
|    if ($Value -is [datetime]) { return $Value.ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture) }
|    if ($Value -is [datetimeoffset]) { return $Value.UtcDateTime.ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture) }
|    $t = ([string]$Value).Trim()
|    if (-not $t) { return $null }
|    $d = [datetimeoffset]::MinValue
|    if ([datetimeoffset]::TryParse($t, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AssumeUniversal, [ref]$d)) {
|        return $d.UtcDateTime.ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture)
|    }
|    $null
|}
|
|function ConvertTo-SISummaryGroupingTier {
|    <# PURE. 0..3 from '0', 2, 'Tier1', '1.0'; else $null. #>
|    param([AllowNull()][string]$Text)
|    if (-not $Text) { return $null }
|    $t = $Text -replace '(?i)^tier\s*', ''
|    $d = 0.0
|    if (-not [double]::TryParse($t, [Globalization.NumberStyles]::Float, [Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $null }
|    if ($d -ne [Math]::Floor($d) -or $d -lt 0 -or $d -gt 3) { return $null }
|    [int]$d
|}
|
|function Get-SISummaryGroupingSqlValue {
|    <# The SQL expression of one field's normalised value over sidata.Finding (alias f) -- the twin of ConvertTo-SISummaryGroupingValue. #>
|    param($Field, $Plan)
|    $x = $Field.Sql
|    switch ($Field.Kind) {
|        'text' { return ("LEFT(LTRIM(RTRIM(ISNULL(CONVERT(nvarchar(4000), {0}), N''))), {1})" -f $x, $Field.Max) }
|        'tier' { return ("CASE WHEN {0} BETWEEN 0 AND 3 THEN CONVERT(nvarchar(12), {0}) ELSE N'Unclassified' END" -f $x) }
|        'tierNumber' { return ("CASE WHEN {0} BETWEEN 0 AND 3 THEN CONVERT(tinyint, {0}) END" -f $x) }
|        'severity' {
|            $norm = "LOWER(REPLACE(REPLACE(REPLACE(LTRIM(RTRIM(COALESCE({0}, N''))), N' ', N''), N'-', N''), N'_', N''))" -f $x
|            $when = foreach ($k in $Plan.SeverityWords.Keys) { "WHEN N'{0}' THEN N'{1}'" -f $k.Replace("'", "''"), ([string]$Plan.SeverityWords[$k]).Replace("'", "''") }
|            return ("CASE {0} WHEN N'' THEN N'None' {1} ELSE N'Other' END" -f $norm, ($when -join ' '))
|        }
|        'id' { return ("CONVERT(nvarchar(32), ISNULL(CONVERT(bigint, {0}), 0))" -f $x) }
|        'number' { return ("CONVERT(float, {0})" -f $x) }
|        'flag' { return ("CASE WHEN {0} = 1 THEN N'1' ELSE N'0' END" -f $x) }
|        'presence' { return ("CASE WHEN {0} IS NULL THEN N'0' ELSE N'1' END" -f $x) }
|        # the list as stored, every separator of 'split' turned into ';' -- the grouping splits it (Get-SISummaryGroupingSqlText, one CROSS APPLY)
|        'tokens' {
|            $e = "ISNULL(CONVERT(nvarchar(4000), {0}), N'')" -f $x
|            foreach ($sep in $Field.Split) { $e = "REPLACE({0}, N'{1}', N';')" -f $e, $sep.Replace("'", "''") }
|            return $e
|        }
|        'band' {
|            $when = foreach ($b in $Field.Bands) { "WHEN CONVERT(float, {0}) {1} {2} THEN N'{3}'" -f $x, $b.Op, $b.Value.ToString('R', [Globalization.CultureInfo]::InvariantCulture), $b.Label.Replace("'", "''") }
|            return ("CASE WHEN {0} IS NULL THEN N'' {1} ELSE N'{2}' END" -f $x, ($when -join ' '), $Field.Else.Replace("'", "''"))
|        }
|        'date' { return ("CONVERT(nvarchar(10), CONVERT(date, {0}), 23)" -f $x) }
|    }
|    throw ("summary groupings: no SQL for kind '{0}'" -f $Field.Kind)
|}
|
|function Get-SISummaryGroupingRowValues {
|    <# PURE. One Detailed row -> @{ field = normalised value } for every field of the plan (the row's first present column wins;
|       an attack-path row takes the 'pathRow' column for the tier when it has it -- Get-SIDataRowTiers). #>
|    param([Parameter(Mandatory)]$Row, [Parameter(Mandatory)]$Plan)
|    $props = $Row.PSObject.Properties
|    $get = {
|        param([string[]]$names)
|        foreach ($n in $names) {
|            if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($n)) { $v = $Row[$n]; if ($null -ne $v -and "$v" -ne '') { return $v } } ; continue }
|            $p = $props[$n]; if ($p -and $null -ne $p.Value -and "$($p.Value)" -ne '') { return $p.Value }
|        }
|        $null
|    }
|    $rep = [string](& $get @('AssetDetectedInReportName', 'ReportName')); $cat = [string](& $get @('Category'))
|    $isPath = $rep.StartsWith('Attack_Paths') -or $cat.StartsWith('AttackPath') -or $cat -eq 'Attack Paths'
|    $out = @{}
|    foreach ($f in $Plan.Fields.Values) {
|        $raw = $null
|        if ($isPath -and $f.PathRow.Count) { $raw = & $get $f.PathRow; if ($null -ne $raw -and $null -eq (ConvertTo-SISummaryGroupingTier ([string]$raw))) { $raw = $null } }
|        if ($null -eq $raw) { $raw = & $get $f.Row }
|        $out[$f.Name] = ConvertTo-SISummaryGroupingValue -Field $f -Value $raw -Plan $Plan
|    }
|    $out
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|#  THE ONE FUNCTION
|# ---------------------------------------------------------------------------------------------------------------------
|
|function Invoke-SISummaryGrouping {
|    <#
|    .SYNOPSIS  THE summary groupings of the Detailed findings (data-model\summary-groupings.locked.json) -- in the run, or as SQL.
|    .DESCRIPTION
|        -Rows / -Pager (Community; and any caller with the Detailed rows): the groupings computed in memory. A pager is any
|        object with .Next() returning the next page of rows or $null (New-RARowPager) -- the rows are never held all at once.
|        Returns one object per (grouping, counted, keys): GroupingId, Counted (False = every finding, True = without the
|        exempted ones), Key1, Key2, Key3 ('' when unused), Label, then one property per measure (Findings, Assets, ...).
|        -AsSql (Pro): the statement that computes exactly these rows for ONE stored collection (@CollectionId, plus @Hash: the
|        definition's hash) from sidata.Finding and replaces the collection's sidata.SummaryGroup / SummaryGroupCounted /
|        SummaryGroupState rows in ONE transaction. It answers the number of groups (every finding). One read of the
|        collection's narrow finding columns (never DetailJson), no cap, no sample.
|        -Grouping: only these grouping ids (default: every one).
|    #>
|    [CmdletBinding(DefaultParameterSetName = 'Rows')]
|    param(
|        [Parameter(ParameterSetName = 'Rows')][AllowNull()][AllowEmptyCollection()][object[]]$Rows = @(),
|        [Parameter(ParameterSetName = 'Pager', Mandatory)]$Pager,
|        [Parameter(ParameterSetName = 'Sql', Mandatory)][switch]$AsSql,
|        $Plan,
|        [string[]]$Grouping
|    )
|    if (-not $Plan) { $Plan = Get-SISummaryGroupingPlan }
|    $groupings = @($Plan.Groupings | Where-Object { -not $Grouping -or $Grouping -contains $_.Id })
|    if ($AsSql) { return (Get-SISummaryGroupingSqlText -Plan $Plan -Groupings $groupings) }
|
|    $acc = @{}                                     # "<grouping>|<counted>|k1|k2|k3" -> accumulator (case-insensitive, as SQL groups)
|    $order = New-Object System.Collections.Generic.List[string]
|    $sep = [string][char]31
|    $add = {
|        param($vals)
|        $exempt = ([string]$vals[$Plan.Exempted]) -eq '1'
|        foreach ($g in $groupings) {
|          # a tokens key: the finding stands under each of its distinct tokens (none = not in this grouping), as the SQL's CROSS APPLY
|          $ti = -1; for ($i = 0; $i -lt 3; $i++) { if ($g.Keys[$i] -and $Plan.Fields[$g.Keys[$i]].Kind -eq 'tokens') { $ti = $i } }
|          $base = @(foreach ($kf in $g.Keys) { if ($kf -and $Plan.Fields[$kf].Kind -ne 'tokens') { [string]$vals[$kf] } else { '' } })
|          $tuples = New-Object System.Collections.Generic.List[object]
|          if ($ti -lt 0) { $tuples.Add($base) }
|          else { foreach ($tok in @($vals[$g.Keys[$ti]] | Where-Object { $_ })) { $t = [object[]]$base.Clone(); $t[$ti] = [string]$tok; $tuples.Add($t) } }
|          foreach ($k in $tuples) {
|            foreach ($counted in @($false, $true)) {
|                if ($counted -and $exempt) { continue }
|                $id = $g.Id + $sep + $(if ($counted) { '1' } else { '0' }) + $sep + ($k -join $sep)
|                $a = $acc[$id]
|                if ($null -eq $a) {
|                    $a = @{ G = $g.Id; C = $counted; K = $k; Label = $null; M = @{}; A = @{} }
|                    foreach ($at in @($g.Attributes)) {
|                        $a.A[$at.Id] = switch ($at.Op) {
|                            'list' { , [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase) }
|                            'first' { @{ Rank = [int]::MaxValue; V = $null } }
|                            default { $null }
|                        }
|                    }
|                    foreach ($m in $Plan.Measures) {
|                        # assigned directly, never through a pipeline (an empty set written to the pipeline would arrive as nothing)
|                        if ($m.Op -eq 'count') { $a.M[$m.Id] = [long]0 }
|                        elseif ($m.Op -eq 'countDistinct') { $a.M[$m.Id] = [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase) }
|                        else { $a.M[$m.Id] = $null }
|                    }
|                    $acc[$id] = $a; $order.Add($id)
|                }
|                if ($g.LabelField) {
|                    $lv = [string]$vals[$g.LabelField]
|                    if ($null -eq $a.Label -or [string]::Compare($lv, $a.Label, [StringComparison]::OrdinalIgnoreCase) -gt 0) { $a.Label = $lv }
|                }
|                # the attributes: the empty text / no date never counts (the SQL's NULLIF)
|                foreach ($at in @($g.Attributes)) {
|                    $v = $vals[$at.Field]
|                    if ($null -eq $v -or ([string]$v) -eq '') { continue }
|                    $v = [string]$v
|                    switch ($at.Op) {
|                        'max' { if ($null -eq $a.A[$at.Id] -or [string]::Compare($v, $a.A[$at.Id], [StringComparison]::OrdinalIgnoreCase) -gt 0) { $a.A[$at.Id] = $v } }
|                        'min' { if ($null -eq $a.A[$at.Id] -or [string]::Compare($v, $a.A[$at.Id], [StringComparison]::OrdinalIgnoreCase) -lt 0) { $a.A[$at.Id] = $v } }
|                        'list' { [void]$a.A[$at.Id].Add($v) }
|                        'first' {
|                            $rank = 1000; for ($i = 0; $i -lt $at.Order.Count; $i++) { if ([string]::Equals($at.Order[$i], $v, [StringComparison]::OrdinalIgnoreCase)) { $rank = $i + 1; break } }
|                            $cur = $a.A[$at.Id]
|                            if ($rank -lt $cur.Rank -or ($rank -eq 1000 -and $cur.Rank -eq 1000 -and [string]::Compare($v, $cur.V, [StringComparison]::OrdinalIgnoreCase) -gt 0)) { $cur.Rank = $rank; $cur.V = $v }
|                        }
|                    }
|                }
|                foreach ($m in $Plan.Measures) {
|                    if ($m.WhereField -and [string]$vals[$m.WhereField] -ne $m.WhereEquals) { continue }
|                    switch ($m.Op) {
|                        'count' { $a.M[$m.Id] = $a.M[$m.Id] + 1 }
|                        'countDistinct' { $v = [string]$vals[$m.Field]; if ($v) { [void]$a.M[$m.Id].Add($v) } }
|                        'max' { $v = $vals[$m.Field]; if ($null -ne $v -and ($null -eq $a.M[$m.Id] -or [double]$v -gt [double]$a.M[$m.Id])) { $a.M[$m.Id] = [double]$v } }
|                        'min' { $v = $vals[$m.Field]; if ($null -ne $v -and ($null -eq $a.M[$m.Id] -or [double]$v -lt [double]$a.M[$m.Id])) { $a.M[$m.Id] = $v } }
|                        'sum' { $v = $vals[$m.Field]; if ($null -ne $v) { $a.M[$m.Id] = $(if ($null -eq $a.M[$m.Id]) { [double]$v } else { [double]$a.M[$m.Id] + [double]$v }) } }
|                    }
|                }
|            }
|          }
|        }
|    }
|    if ($PSCmdlet.ParameterSetName -eq 'Pager') {
|        while ($null -ne ($page = $Pager.Next())) { foreach ($r in @($page)) { if ($null -ne $r) { & $add (Get-SISummaryGroupingRowValues -Row $r -Plan $Plan) } } }
|    } else {
|        foreach ($r in @($Rows)) { if ($null -ne $r) { & $add (Get-SISummaryGroupingRowValues -Row $r -Plan $Plan) } }
|    }
|    foreach ($id in $order) {
|        $a = $acc[$id]
|        $o = [ordered]@{ GroupingId = $a.G; Counted = [bool]$a.C; Key1 = $a.K[0]; Key2 = $a.K[1]; Key3 = $a.K[2]; Label = $a.Label }
|        foreach ($m in $Plan.Measures) {
|            $v = $a.M[$m.Id]
|            $o[$m.Id] = switch ($m.Op) { 'count' { [long]$v } 'countDistinct' { [long]$v.Count } default { $v } }
|        }
|        $o['AttributesJson'] = Get-SISummaryGroupingAttributesJson -Grouping @($groupings | Where-Object { $_.Id -eq $a.G })[0] -Values $a.A
|        [pscustomobject]$o
|    }
|}
|
|function Get-SISummaryGroupingAttributesJson {
|    <# PURE. One group's attributes as the compact JSON the SQL path stores (FOR JSON PATH, WITHOUT_ARRAY_WRAPPER): a property
|       per attribute in the definition's order, an attribute without a value left out, a list = its first 'max' distinct values
|       in ascending order joined with '; '. $null for a grouping without attributes (or none with a value). #>
|    param($Grouping, [hashtable]$Values)
|    if (-not $Grouping -or -not @($Grouping.Attributes).Count) { return $null }
|    $o = [ordered]@{}
|    foreach ($at in $Grouping.Attributes) {
|        $v = $Values[$at.Id]
|        switch ($at.Op) {
|            'list' { $items = @($v | Sort-Object { $_ } -Culture ([Globalization.CultureInfo]::InvariantCulture) | Select-Object -First $at.Max); if ($items.Count) { $o[$at.Id] = $items -join '; ' } }
|            'first' { if ($null -ne $v.V) { $o[$at.Id] = [string]$v.V } }
|            default { if ($null -ne $v) { $o[$at.Id] = [string]$v } }
|        }
|    }
|    if ($o.Count -eq 0) { return $null }
|    [pscustomobject]$o | ConvertTo-Json -Compress
|}
|
|function Get-SISummaryGroupingLifecycleSql {
|    <#
|        PURE. #855 (owner 2026-10-21: "default filter is active, so it should be active only"): the Pro database's grouped rows
|        are of the findings of ACTIVE CIs only (sidata.Finding.CiLifecycle; a finding no CI carries, or of a collection stored
|        before the lifecycle was stamped, counts as active). The definition's keys (Key1-3) are the groupings' own, so the
|        lifecycle is a filter of the rows, never a fourth key; the pages say so. The row path (Risk Analysis) is unchanged.
|    #>
|    " AND (f.CiLifecycle IS NULL OR f.CiLifecycle = N'active')"
|}
|
|function Get-SISummaryGroupingSqlText {
|    <# The -AsSql statement (see Invoke-SISummaryGrouping). One pass over the collection into #f (the normalised fields), one
|       aggregate per grouping into #s, then ONE transaction replaces the stored rows and the state row. #>
|    param([Parameter(Mandatory)]$Plan, [Parameter(Mandatory)][object[]]$Groupings)
|    $used = New-Object System.Collections.Generic.List[string]
|    $use = { param($n) if ($n -and -not $used.Contains($n)) { $used.Add($n) } }
|    & $use $Plan.Exempted
|    foreach ($g in $Groupings) { foreach ($k in $g.Keys) { & $use $k }; & $use $g.LabelField; foreach ($at in @($g.Attributes)) { & $use $at.Field } }
|    foreach ($m in $Plan.Measures) { & $use $m.Field; & $use $m.WhereField }
|    $colType = {
|        param($f)
|        switch ($f.Kind) { 'text' { "nvarchar($($f.Max)) COLLATE DATABASE_DEFAULT NOT NULL" } 'tokens' { 'nvarchar(4000) COLLATE DATABASE_DEFAULT NOT NULL' } 'band' { 'nvarchar(64) COLLATE DATABASE_DEFAULT NOT NULL' } 'tierNumber' { 'tinyint NULL' } 'number' { 'float NULL' } 'date' { 'nvarchar(10) COLLATE DATABASE_DEFAULT NULL' } default { 'nvarchar(32) COLLATE DATABASE_DEFAULT NOT NULL' } }
|    }
|    $cols = @($used | ForEach-Object { 'x_' + $_ })
|    $def = @($used | ForEach-Object { '{0} {1}' -f ('x_' + $_), (& $colType $Plan.Fields[$_]) }) -join ', '
|    $sel = @($used | ForEach-Object { Get-SISummaryGroupingSqlValue -Field $Plan.Fields[$_] -Plan $Plan }) -join ",`r`n       "
|    $mCols = @($Plan.Measures | ForEach-Object { $_.Id })
|    $mDef = @($Plan.Measures | ForEach-Object { if ($_.Op -in 'count', 'countDistinct') { '{0} INT NOT NULL' -f $_.Id } elseif ($_.Field -and $Plan.Fields[$_.Field].Kind -eq 'tierNumber') { '{0} TINYINT NULL' -f $_.Id } else { '{0} FLOAT NULL' -f $_.Id } }) -join ', '
|    $mExpr = foreach ($m in $Plan.Measures) {
|        $cond = if ($m.WhereField) { "f.x_{0} = N'{1}'" -f $m.WhereField, $m.WhereEquals.Replace("'", "''") } else { '' }
|        $val = if ($m.Field) { 'f.x_' + $m.Field } else { '' }
|        switch ($m.Op) {
|            'count' { if ($cond) { "SUM(CASE WHEN $cond THEN 1 ELSE 0 END)" } else { 'COUNT(*)' } }
|            'countDistinct' { if ($cond) { "COUNT(DISTINCT CASE WHEN $cond THEN NULLIF($val, N'') END)" } else { "COUNT(DISTINCT NULLIF($val, N''))" } }
|            'max' { if ($cond) { "MAX(CASE WHEN $cond THEN $val END)" } else { "MAX($val)" } }
|            'min' { if ($cond) { "MIN(CASE WHEN $cond THEN $val END)" } else { "MIN($val)" } }
|            'sum' { if ($cond) { "SUM(CASE WHEN $cond THEN $val END)" } else { "SUM($val)" } }
|        }
|    }
|    $ins = foreach ($g in $Groupings) {
|        # a tokens key (#812): each distinct trimmed token of the finding's list, cut to the field's 'max' -- the finding stands
|        # under each (ConvertTo-SISummaryGroupingTokens is the row path's twin)
|        $keyOf = {
|            param($kf)
|            if (-not $kf) { return "N''" }
|            if ($Plan.Fields[$kf].Kind -eq 'tokens') { return 'tk.V' }
|            'f.x_' + $kf
|        }
|        $k = @(foreach ($kf in $g.Keys) { & $keyOf $kf })
|        $grp = @(@('v.Counted') + @($g.Keys | Where-Object { $_ } | ForEach-Object { & $keyOf $_ })) -join ', '
|        $lab = if ($g.LabelField) { 'MAX(f.x_{0})' -f $g.LabelField } else { 'NULL' }
|        $tok = @($g.Keys | Where-Object { $_ -and $Plan.Fields[$_].Kind -eq 'tokens' })
|        $apply = ''
|        if ($tok.Count) {
|            $tf = $Plan.Fields[$tok[0]]
|            $apply = "`r`nCROSS APPLY (SELECT DISTINCT LEFT(LTRIM(RTRIM(ts.[value])), $($tf.Max)) AS V FROM STRING_SPLIT(f.x_$($tf.Name), N';') AS ts WHERE LTRIM(RTRIM(ts.[value])) <> N'') AS tk"
|        }
|@"
|INSERT #s (GroupingId, Counted, Key1, Key2, Key3, Label, $($mCols -join ', '))
|SELECT N'$($g.Id)', v.Counted, $($k -join ', '), $lab,
|       $($mExpr -join ', ')
|FROM #f AS f CROSS APPLY (VALUES (CONVERT(bit, 0)), (CONVERT(bit, 1))) AS v(Counted)$apply
|WHERE v.Counted = 0 OR f.x_$($Plan.Exempted) = N'0'
|GROUP BY $grp;
|"@
|    }
|    # the attributes (owner 2026-10-20): per grouping that has them, an index on its keys and ONE update of its rows -- each
|    # row's attributes read from the findings of its keys (the counted variant without the exempted), as one JSON object
|    $attr = foreach ($g in @($Groupings | Where-Object { @($_.Attributes).Count })) {
|        $kf = @($g.Keys | Where-Object { $_ })
|        $match = { param($alias) @(for ($i = 0; $i -lt $kf.Count; $i++) { '{0}.x_{1} = s.Key{2}' -f $alias, $kf[$i], ($i + 1) }) -join ' AND ' }
|        $cnt = { param($alias) "(s.Counted = 0 OR {0}.x_{1} = N'0')" -f $alias, $Plan.Exempted }
|        $items = foreach ($at in $g.Attributes) {
|            $x = 'f.x_' + $at.Field
|            $nz = "NULLIF({0}, N'')" -f $x
|            switch ($at.Op) {
|                'max' { 'MAX({0}) AS [{1}]' -f $nz, $at.Id }
|                'min' { 'MIN({0}) AS [{1}]' -f $nz, $at.Id }
|                'first' {
|                    $rank = "CASE WHEN {0} IS NULL THEN NULL {1} ELSE 1000 END" -f $nz, ((@(for ($i = 0; $i -lt $at.Order.Count; $i++) { "WHEN {0} = N'{1}' THEN {2}" -f $x, $at.Order[$i].Replace("'", "''"), ($i + 1) })) -join ' ')
|                    $back = @(for ($i = 0; $i -lt $at.Order.Count; $i++) { "WHEN {0} THEN N'{1}'" -f ($i + 1), $at.Order[$i].Replace("'", "''") }) -join ' '
|                    'CASE MIN({0}) {1} WHEN 1000 THEN MAX({2}) END AS [{3}]' -f $rank, $back, $nz, $at.Id
|                }
|                'list' {
|                    $f2 = 'f2.x_' + $at.Field
|                    "(SELECT STRING_AGG(n.V, N'; ') WITHIN GROUP (ORDER BY n.V) FROM (SELECT DISTINCT TOP ({0}) {1} AS V FROM #f AS f2 WHERE {2} AND {3} AND {1} <> N'' ORDER BY V) AS n) AS [{4}]" -f $at.Max, $f2, (& $match 'f2'), (& $cnt 'f2'), $at.Id
|                }
|            }
|        }
|        $ix = 'IX_f_' + ($g.Id -replace '[^A-Za-z0-9]', '_')
|        $inc = @(@($g.Attributes | ForEach-Object { 'x_' + $_.Field }) + @('x_' + $Plan.Exempted) | Select-Object -Unique | Where-Object { $kf -notcontains $_.Substring(2) })
|@"
|CREATE INDEX $ix ON #f ($((@($kf | ForEach-Object { 'x_' + $_ })) -join ', ')) INCLUDE ($($inc -join ', '));
|UPDATE s SET AttributesJson = (SELECT $($items -join ",`r`n       ")
|    FROM #f AS f WHERE $(& $match 'f') AND $(& $cnt 'f')
|    FOR JSON PATH, WITHOUT_ARRAY_WRAPPER)
|FROM #s AS s WHERE s.GroupingId = N'$($g.Id)';
|"@
|    }
|    $list = "GroupingId, Key1, Key2, Key3, Label, $($mCols -join ', '), AttributesJson"
|    # #812: the groupings these rows hold -- a page whose grouping is not among them says the collection is being prepared
|    $gids = ';' + ((@($Groupings | ForEach-Object { $_.Id })) -join ';') + ';'
|@"
|SET NOCOUNT ON;
|SET XACT_ABORT ON;
|CREATE TABLE #f ($def);
|INSERT #f ($($cols -join ', '))
|SELECT $sel
|FROM sidata.Finding AS f
|WHERE f.CollectionId = @CollectionId$(Get-SISummaryGroupingLifecycleSql);
|CREATE TABLE #s (GroupingId VARCHAR(40) COLLATE DATABASE_DEFAULT NOT NULL, Counted BIT NOT NULL, Key1 NVARCHAR(400) COLLATE DATABASE_DEFAULT NOT NULL,
|                 Key2 NVARCHAR(256) COLLATE DATABASE_DEFAULT NOT NULL, Key3 NVARCHAR(256) COLLATE DATABASE_DEFAULT NOT NULL, Label NVARCHAR(1000) NULL, $mDef, AttributesJson NVARCHAR(MAX) NULL);
|$($ins -join "`r`n")
|$($attr -join "`r`n")
|DECLARE @groups INT = (SELECT COUNT(*) FROM #s WHERE Counted = 0);
|DECLARE @counted INT = (SELECT COUNT(*) FROM #s WHERE Counted = 1);
|DECLARE @findings BIGINT = (SELECT COUNT_BIG(*) FROM #f);
|BEGIN TRAN;
|DELETE FROM sidata.SummaryGroup WHERE CollectionId = @CollectionId;
|INSERT sidata.SummaryGroup (CollectionId, $list)
|SELECT @CollectionId, $list FROM #s WHERE Counted = 0;
|DELETE FROM sidata.SummaryGroupCounted WHERE CollectionId = @CollectionId;
|INSERT sidata.SummaryGroupCounted (CollectionId, $list)
|SELECT @CollectionId, $list FROM #s WHERE Counted = 1;
|DELETE FROM sidata.SummaryGroupState WHERE CollectionId = @CollectionId;
|INSERT sidata.SummaryGroupState (CollectionId, BuiltAt, DefinitionHash, Groups, CountedGroups, Findings, Groupings) VALUES (@CollectionId, SYSUTCDATETIME(), @Hash, @groups, @counted, @findings, N'$($gids)');
|COMMIT;
|SELECT @groups;
|"@
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|#  READING THE RESULT (both editions): one grouping's rows, the most findings first
|# ---------------------------------------------------------------------------------------------------------------------
|
|function Select-SISummaryGroupingRows {
|    <# PURE. The rows of one grouping and variant from a result of Invoke-SISummaryGrouping, sorted: most findings, then the key. #>
|    param([AllowEmptyCollection()][object[]]$Result = @(), [Parameter(Mandatory)][string]$GroupingId, [bool]$Counted = $false, [int]$Top = 0)
|    $r = @($Result | Where-Object { $_ -and $_.GroupingId -eq $GroupingId -and [bool]$_.Counted -eq $Counted } |
|        Sort-Object -Property @{ Expression = { [long]$_.Findings }; Descending = $true }, @{ Expression = { [string]$_.Key1 } }, @{ Expression = { [string]$_.Key2 } }, @{ Expression = { [string]$_.Key3 } })
|    if ($Top -gt 0) { return @($r | Select-Object -First $Top) }
|    $r
|}
'@ }
$__siSupportFiles['data-model/summary-groupings.locked.json'] = @{ Sha256 = '9a063ca42a251eea3fdfebb9a72a9d05e0f83707b6aa0d9edfe09518021b18dc'; Text = @'
|{
|  "$comment": "THE SUMMARY GROUPINGS (REQUIREMENTS #636, owner 2026-10-19: \"summary could be build as views with the detailed data instead. it is just views with groupings of data instead, like group per tier category\" / \"community must switch\" / \"same core functionality\"). ONE declarative definition of every Summary-shaped grouping of the Detailed findings, read by ONE engine function (engine/_shared/SI-SummaryGroupings.ps1 Invoke-SISummaryGrouping) in both editions: Pro -- the data sync writes the result per collection into sidata.SummaryGroup / SummaryGroupCounted / SummaryGroupState (the SQL the function compiles from this file); Community -- the same function groups the Detailed result in the run (no SQL) for its management mail and outputs. 'fields': the finding values a key or a measure reads -- 'sql' the sidata.Finding expression (alias f), 'row' the Detailed row's columns (the first one present wins), 'kind' how the value is normalised the same way on both paths (text: trimmed, '' for none, at most 'max' characters; tier: '0'..'3' or 'Unclassified'; tierNumber: 0..3 or none; severity: one word of 'severityWords' after lower-casing and removing spaces, '-' and '_' -- '' = 'None', any other word = 'Other'; id: a whole number, none = '0' (Unassigned); number: a decimal or none; flag: '1' when the value is true / 1, else '0'; presence: '1' when the value is set; tokens (#812): a ';'-list, every separator of 'split' turned into ';' first -- a finding counts once under each distinct trimmed token (at most 'max' characters), a tokens field is a grouping key only, one per grouping; band (#812): a number into the field's 'bands' (the first whose 'atLeast' / 'above' it meets), else 'else', no value = ''). 'pathRow' (tier, tierNumber): an attack-path row (its report starts Attack_Paths, or its Category starts AttackPath / is 'Attack Paths') takes that column when it has it -- the source asset's tier, as the data sync stores it (Get-SIDataRowTiers). 'measures': the same columns on every grouping (and on sidata.SummaryGroup): count (rows), countDistinct (distinct non-empty values of 'field'), max / min / sum (of a number), each optionally only over the rows 'where' a field equals a value. 'groupings': id, label (a person's name for it), keys (1-3 fields, in order -- Key1..Key3), labelField (the name shown next to the key: the most recent text in sort order, MAX), attributes (optional, owner 2026-10-20: the Summary report's columns per row -- 'max' / 'min' of a text or date field (the empty text / no date never wins), 'first' = the value earliest in 'order' (the most severe; a value outside it ranks after, the greatest of those), 'list' = the distinct non-empty values in ascending order, at most 'max' of them joined with '; ' -- stored per row as AttributesJson, a property per attribute, none = left out). A 'date' field (2026-10-20): the day 'yyyy-MM-dd' of a date, none = no value. 'exempted': the field whose presence leaves a row out of the counted variant (#264: SummaryGroupCounted / Counted = true). Changing anything here changes the definition hash: the data sync then writes every stored collection again (newest first). Add a grouping = one entry here (and its words in the web app's grouped view); add a measure = one entry here + its column in sql/si-data-schema.sql (a test holds the two together).",
|  "kind": "summary-groupings",
|  "version": "1.0.0",
|  "exempted": "exempted",
|  "severityWords": {
|    "veryhigh": "Very High",
|    "critical": "Very High",
|    "high": "High",
|    "mediumhigh": "Medium-High",
|    "medium": "Medium",
|    "moderate": "Medium",
|    "low": "Low",
|    "informational": "Informational",
|    "information": "Informational",
|    "info": "Informational"
|  },
|  "fields": {
|    "asset":              { "kind": "text", "max": 400,  "sql": "f.AssetKey",        "row": [ "SI_AssetId", "AssetId" ] },
|    "assetName":          { "kind": "text", "max": 400,  "sql": "f.AssetName",       "row": [ "AssetName" ] },
|    "recommendation":     { "kind": "text", "max": 256,  "sql": "f.ConfigurationId", "row": [ "ConfigurationId" ] },
|    "recommendationName": { "kind": "text", "max": 1000, "sql": "f.Title",           "row": [ "ConfigurationName" ] },
|    "tier":               { "kind": "tier",              "sql": "f.Tier",            "row": [ "CriticalityTier" ], "pathRow": [ "SourceCriticalityTier" ] },
|    "tierNumber":         { "kind": "tierNumber",        "sql": "f.Tier",            "row": [ "CriticalityTier" ], "pathRow": [ "SourceCriticalityTier" ] },
|    "severity":           { "kind": "severity",          "sql": "f.Severity",        "row": [ "SecuritySeverity" ] },
|    "domain":             { "kind": "text", "max": 128,  "sql": "f.SecurityDomain",  "row": [ "SecurityDomain" ] },
|    "category":           { "kind": "text", "max": 256,  "sql": "f.Category",        "row": [ "Category" ] },
|    "subcategory":        { "kind": "text", "max": 256,  "sql": "f.Subcategory",     "row": [ "Subcategory" ] },
|    "riskRating":         { "kind": "text", "max": 16,   "sql": "f.RiskRating",      "row": [ "RiskRating" ] },
|    "department":         { "kind": "id",                "sql": "f.DepartmentId",    "row": [ "SI_DepartmentId" ] },
|    "report":             { "kind": "text", "max": 256,  "sql": "f.ReportName",      "row": [ "AssetDetectedInReportName", "ReportName" ] },
|    "risk":               { "kind": "number",            "sql": "f.RiskScore",       "row": [ "RiskScoreTotal" ] },
|    "exploit":            { "kind": "flag",              "sql": "f.HasExploit",      "row": [ "HasExploit" ] },
|    "exempted":           { "kind": "presence",          "sql": "f.ExemptionId",     "row": [ "SI_ExemptionId" ] },
|    "mitreTactic":        { "kind": "tokens", "max": 400, "split": [ "," ], "sql": "f.MitreTactics",    "row": [ "MITRE_Tactics" ] },
|    "mitreTechnique":     { "kind": "tokens", "max": 400, "split": [ "," ], "sql": "f.MitreTechniques", "row": [ "MITRE_Techniques" ] },
|    "complianceTag":      { "kind": "tokens", "max": 400,                   "sql": "f.ComplianceTags",  "row": [ "ComplianceTags" ] },
|    "remediation":        { "kind": "text", "max": 1000, "sql": "f.FixRemediation",  "row": [ "si_fix_remediation", "FixRemediation" ] },
|    "firstSeen":          { "kind": "date",              "sql": "f.SourceFirstDetected", "row": [ "si_source_first_seen", "si_source_first_detected" ] },
|    "cvssBand":           { "kind": "band", "sql": "f.Cvss", "row": [ "MaxCvssScore" ],
|                            "bands": [ { "atLeast": 9, "label": "Critical (9.0-10)" }, { "atLeast": 7, "label": "High (7.0-8.9)" }, { "atLeast": 4, "label": "Medium (4.0-6.9)" }, { "above": 0, "label": "Low (0.1-3.9)" } ],
|                            "else": "None (0)" }
|  },
|  "measures": [
|    { "id": "Findings",                 "op": "count" },
|    { "id": "Assets",                   "op": "countDistinct", "field": "asset" },
|    { "id": "Recommendations",          "op": "countDistinct", "field": "recommendation" },
|    { "id": "MaxRisk",                  "op": "max",           "field": "risk" },
|    { "id": "TotalRisk",                "op": "sum",           "field": "risk" },
|    { "id": "BestTier",                 "op": "min",           "field": "tierNumber" },
|    { "id": "Tier0Findings",            "op": "count",                                    "where": { "field": "tier", "equals": "0" } },
|    { "id": "CriticalFindings",         "op": "count",                                    "where": { "field": "severity", "equals": "Very High" } },
|    { "id": "HighFindings",             "op": "count",                                    "where": { "field": "severity", "equals": "High" } },
|    { "id": "RatedCriticalFindings",    "op": "count",                                    "where": { "field": "riskRating", "equals": "Critical" } },
|    { "id": "RatedHighFindings",        "op": "count",                                    "where": { "field": "riskRating", "equals": "High" } },
|    { "id": "CriticalRecommendations",  "op": "countDistinct", "field": "recommendation", "where": { "field": "severity", "equals": "Very High" } },
|    { "id": "HighRecommendations",      "op": "countDistinct", "field": "recommendation", "where": { "field": "severity", "equals": "High" } },
|    { "id": "ExploitedRecommendations", "op": "countDistinct", "field": "recommendation", "where": { "field": "exploit", "equals": "1" } }
|  ],
|  "groupings": [
|    { "id": "recommendation-tier",         "label": "Per recommendation and tier (as the Summary report)", "keys": [ "recommendation", "tier" ], "labelField": "recommendationName",
|      "attributes": [
|        { "id": "Domain",      "op": "max",  "field": "domain" },
|        { "id": "Category",    "op": "max",  "field": "category" },
|        { "id": "Subcategory", "op": "max",  "field": "subcategory" },
|        { "id": "Severity",    "op": "first", "field": "severity",   "order": [ "Very High", "High", "Medium-High", "Medium", "Low", "Informational" ] },
|        { "id": "RiskRating",  "op": "first", "field": "riskRating", "order": [ "Critical", "High", "Moderate", "Low" ] },
|        { "id": "AssetNames",  "op": "list", "field": "assetName", "max": 10 },
|        { "id": "FirstSeen",   "op": "min",  "field": "firstSeen" },
|        { "id": "Remediation", "op": "max",  "field": "remediation" }
|      ] },
|    { "id": "recommendation",              "label": "Per recommendation (with its affected assets)", "keys": [ "recommendation" ], "labelField": "recommendationName" },
|    { "id": "asset",                       "label": "Per asset",                                     "keys": [ "asset" ],          "labelField": "assetName" },
|    { "id": "tier",                        "label": "Per tier",                                      "keys": [ "tier" ] },
|    { "id": "domain",                      "label": "Per security domain",                           "keys": [ "domain" ] },
|    { "id": "domain-category",             "label": "Per domain > category",                         "keys": [ "domain", "category" ] },
|    { "id": "domain-category-subcategory", "label": "Per domain > category > subcategory",           "keys": [ "domain", "category", "subcategory" ] },
|    { "id": "risk-rating",                 "label": "Per risk rating",                               "keys": [ "riskRating" ] },
|    { "id": "department",                  "label": "Per department",                                "keys": [ "department" ] },
|    { "id": "severity",                    "label": "Per severity",                                  "keys": [ "severity" ] },
|    { "id": "report",                      "label": "Per report",                                    "keys": [ "report" ] },
|    { "id": "mitre-tactic",                "label": "Per MITRE ATT&CK tactic",                       "keys": [ "mitreTactic" ] },
|    { "id": "mitre-technique",             "label": "Per MITRE ATT&CK technique",                    "keys": [ "mitreTechnique" ] },
|    { "id": "compliance-control",          "label": "Per compliance control",                        "keys": [ "complianceTag" ] },
|    { "id": "cvss-band",                   "label": "Per CVSS band",                                 "keys": [ "cvssBand" ] }
|  ]
|}
'@ }
$__siSupportFiles['engine/_shared/data-sql/SI-DataPublishedRun.ps1'] = @{ Sha256 = '989be31c6f82b19bf5e0c57fd2039975717f508f89162551f09d9b5441b92a79'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight Pro -- ONE TRUSTED RUN (owner 2026-10-19: "it is a big problem that we have a mix of old and new data,
|    so trust is broken to the solution. we need the views to use last know good run, where we can trust it apart all" /
|    "and not show some parts from recent run and some from last known good run").
|
|    Every view of the web app reads ONE run per install: the PUBLISHED run (sidata.PublishedRun 'current',
|    sql/si-data-schema.sql "ONE TRUSTED RUN"). The pointer moves ONLY here, at the END of a pipeline run, and only when the
|    run is trusted:
|      * the run (Get-SIDataPublishEligibility, PURE): a run of the WHOLE pipeline (not one stage or one step) that ended
|        Succeeded, in which every step that was not switched off succeeded -- the data sync and the verification service
|        included. A re-run from a step counts as the whole run it finishes when every step it skipped succeeded in the run
|        before it (owner 2026-10-23); its collection is then looked for from that run's start. A run that failed, was stopped, was cancelled, or went on after a failed step
|        never publishes: the previous trusted run stays what every view shows.
|      * the data (the database's own procedure sidata.PublishedRunSet, one transaction): the run's own Risk Analysis
|        collection is complete and not empty, its view data and day totals are written, it is not partial, the run wrote
|        the executive view of every Risk Analysis grain it ran, its summary is loaded whole, and it built the merged
|        assets. What is not met is answered in plain words and kept as the 'refused' row.
|    PARTIAL (a report of the run fell back to an earlier result -- sidata.CollectionPartial / CollectionReportCarry):
|    SI_Pro_PublishPartialRun, OFF by default (the owner: no mixing) -- such a run does not publish.
|    On an install whose jobs run on their own schedules (no pipeline runs), each wake-up of the pipeline runner publishes
|    the newest complete collection newer than the published one (Source 'schedules').
|    Never throws and never fails the run: a publish that cannot be made is said, and the views keep the trusted run.
|    PS 5.1 safe.
|#>
|
|Set-StrictMode -Off
|
|function Test-SIPublishPartialRun {
|    <# PURE. The setting SI_Pro_PublishPartialRun: OFF unless it is set to true / 1 / yes / on (then a run in which a report
|       fell back to an earlier result is published, marked partial). #>
|    param($Value = $global:SI_Pro_PublishPartialRun)
|    if ($null -eq $Value) { return $false }
|    if ($Value -is [bool]) { return [bool]$Value }
|    ([string]$Value).Trim().Trim('$') -match '^(?i)(true|1|yes|on)$'
|}
|
|function Test-SIDataPublishWholeRun {
|    <# PURE. A run of the whole pipeline (not one stage, one step or a re-run from a step). #>
|    param([Parameter(Mandatory)]$State)
|    $scope = if ($State.PSObject.Properties['Scope'] -and $State.Scope) { [string]$State.Scope } else { 'pipeline' }
|    ($scope -eq 'pipeline') -and -not ($State.PSObject.Properties['FromStep'] -and [string]$State.FromStep)
|}
|
|function Get-SIDataPublishContinuedSteps {
|    <#
|        PURE. A re-run from a step FINISHES the run before it (owner 2026-10-23: a re-run whose earlier run had every step
|        before it succeed is one whole run -- live: the data sync re-run at the largest install succeeded, the web app stayed
|        on a collection three days old). -State: the re-run's record; -Previous: the run record that was the last one when the
|        re-run was asked for (the run it continues). The steps the re-run skipped ('before-rerun') are taken from that run;
|        each must have succeeded there (or be switched off). Only one level: a re-run of a re-run is not continued.
|        Returns @{ Ok; Why; Steps (the whole run's steps); StartedUtc (the earlier run's start); ContinuesRunId }.
|    #>
|    param([Parameter(Mandatory)]$State, $Previous)
|    $no = { param($why) [pscustomobject]@{ Ok = $false; Why = ('a re-run from a step is not a whole run ({0})' -f $why); Steps = @(); StartedUtc = $null; ContinuesRunId = '' } }
|    if (-not $Previous -or -not [string]$Previous.FlowRunId) { return (& $no 'the run it continues is not known') }
|    if ([string]$Previous.FlowRunId -eq [string]$State.FlowRunId) { return (& $no 'the run it continues is not known') }
|    $pScope = if ($Previous.PSObject.Properties['Scope'] -and $Previous.Scope) { [string]$Previous.Scope } else { 'pipeline' }
|    if ($pScope -ne 'pipeline' -or ($Previous.PSObject.Properties['FromStep'] -and [string]$Previous.FromStep)) { return (& $no 'the run before it was not a run of the whole pipeline') }
|    if (-not $Previous.StartedUtc -or -not $Previous.EndedUtc) { return (& $no 'the run before it did not end') }
|    if ($State.StartedUtc -and ([datetime]$Previous.StartedUtc).ToUniversalTime() -ge ([datetime]$State.StartedUtc).ToUniversalTime()) { return (& $no 'the run before it started after it') }
|    $prevSteps = @{}
|    foreach ($p in @($Previous.Steps | Where-Object { $_ })) { $prevSteps[(Get-SIJobFlowKey ([string]$p.Job))] = $p }
|    $steps = New-Object System.Collections.ArrayList
|    foreach ($s in @($State.Steps | Where-Object { $_ })) {
|        if ([string]$s.ErrorClass -ne 'before-rerun') { [void]$steps.Add($s); continue }
|        $k = Get-SIJobFlowKey ([string]$s.Job)
|        $p = $prevSteps[$k]
|        if (-not $p) { return (& $no ('step {0} is not in the run before it' -f $k)) }
|        if ([string]$p.State -notin @('Success', 'Disabled')) { return (& $no ('step {0} did not succeed in the run before it ({1})' -f $k, ([string]$p.State).ToLowerInvariant())) }
|        [void]$steps.Add($p)
|    }
|    [pscustomobject]@{ Ok = $true; Why = ''; Steps = @($steps); StartedUtc = $Previous.StartedUtc; ContinuesRunId = [string]$Previous.FlowRunId }
|}
|
|function Get-SIDataPublishEligibility {
|    <#
|        PURE. May this ended pipeline run publish? -State: the run record Invoke-SIJobFlow answered. -Map: Get-SIJobFlowMap.
|        -Previous: the last run record when this run was asked for (a re-run from a step continues it).
|        Returns @{ Eligible; Why; Grains ('Detailed,Summary' -- the Risk Analysis grains whose step ran); NeedCiBuild;
|        StartedUtc (a re-run that continues a run: that run's start -- the window of the run's own collection; else $null);
|        ContinuesRunId }.
|        Eligible only for a run of the whole pipeline -- or a re-run from a step that finishes the run before it
|        (Get-SIDataPublishContinuedSteps) -- that ended Succeeded, with every step Success or switched off (Disabled), and with
|        the data sync and the verification service among the steps that succeeded.
|    #>
|    param([Parameter(Mandatory)]$State, $Map, $Previous)
|    $no = { param($why) [pscustomobject]@{ Eligible = $false; Why = $why; Grains = ''; NeedCiBuild = $false; StartedUtc = $null; ContinuesRunId = '' } }
|    $scope = if ($State.PSObject.Properties['Scope'] -and $State.Scope) { [string]$State.Scope } else { 'pipeline' }
|    if ($scope -ne 'pipeline') { return (& $no ('a run of one {0} is not a whole run' -f $(if ($scope -eq 'from-step') { 'part of the pipeline' } else { $scope }))) }
|    if ([string]$State.State -ne 'Succeeded') { return (& $no ('the run ended {0}' -f ([string]$State.State).ToLowerInvariant())) }
|    $steps = @($State.Steps | Where-Object { $_ })
|    $from = $null; $contId = ''
|    if ($State.PSObject.Properties['FromStep'] -and [string]$State.FromStep) {
|        $cont = Get-SIDataPublishContinuedSteps -State $State -Previous $Previous
|        if (-not $cont.Ok) { return (& $no $cont.Why) }
|        $steps = @($cont.Steps); $from = $cont.StartedUtc; $contId = $cont.ContinuesRunId
|    }
|    $bad = @($steps | Where-Object { [string]$_.State -notin @('Success', 'Disabled') })
|    if ($bad.Count) { return (& $no ('step {0} did not succeed ({1})' -f (Get-SIJobFlowKey ([string]$bad[0].Job)), ([string]$bad[0].State).ToLowerInvariant())) }
|    $ok = @($steps | Where-Object { [string]$_.State -eq 'Success' } | ForEach-Object { Get-SIJobFlowKey ([string]$_.Job) })
|    foreach ($must in 'risk-analysis-detailed', 'asset-datasync', 'verification') {
|        if ($ok -notcontains $must) { return (& $no ('step {0} did not run in this run' -f $must)) }
|    }
|    $grains = @('Detailed')
|    if ($ok -contains 'risk-analysis') { $grains += 'Summary' }
|    $ci = $false
|    # the build of the merged assets: the map's 'assetBuild' step, when it ran in this run (no map = not asked)
|    if ($Map -and $Map.Jobs) { foreach ($k in $ok) { if ($Map.Jobs.Contains($k) -and [bool]$Map.Jobs[$k].AssetBuild) { $ci = $true } } }
|    [pscustomobject]@{ Eligible = $true; Why = ''; Grains = ($grains -join ','); NeedCiBuild = $ci; StartedUtc = $from; ContinuesRunId = $contId }
|}
|
|function Get-SIDataPublishSql {
|    <#
|        The ONE batch: the database's publisher decides (sidata.PublishedRunSet, created by the schema apply). One code path for
|        every publisher: the run, the schedules, the update and a hand publish all go through the procedure.
|        #881 THE COPIES ARE NOT REFRESHED IN THIS BATCH any more (live 2026-10-22, the largest tenant: the refresh of every copy
|        as one statement per table inside the publishing transaction ran 20+ minutes at the log-rate governor and held the
|        pipeline's start). The publisher runs here inside INSERT ... EXEC, so it leaves the copies stale (CopiedAt older than
|        the publish); Invoke-SIDataPublishRun then catches them up range by range, the ranges at once, with a progress line
|        (Invoke-SIPublishedCopyCatchUp -> Invoke-SIPublishedCopyRefresh), and CopiedAt moves only when every range is done.
|        Answers the publisher's row (or one row saying it is not there yet: the update adds it), plus CopiesCaughtUp /
|        CopiesNote (always 0 / NULL now: kept for the readers of earlier releases).
|    #>
|    @'
|SET NOCOUNT ON;
|SET XACT_ABORT ON;
|IF OBJECT_ID(N'sidata.PublishedRunSet') IS NULL
|BEGIN
|    SELECT CONVERT(bit, 0) AS Published, N'the database does not have the publisher yet -- the update adds it; the views keep what they show' AS Reason,
|           CAST(NULL AS int) AS CollectionId, CAST(NULL AS datetime2(3)) AS CollectionTime, CONVERT(bit, 0) AS [Partial],
|           CONVERT(bit, 0) AS CopiesCaughtUp, CAST(NULL AS nvarchar(400)) AS CopiesNote;
|    RETURN;
|END
|-- 2026-10-29 NEVER WHILE THE FINDINGS PER CI ARE BEING REPLACED (engine\pro-data\_shared\SI-DataCi.ps1: the replace runs a range
|-- at a time and keeps sidata.ViewState 'cifinding-swap' open until the stored set is the staged one) -- the views keep what they show
|DECLARE @swap nvarchar(64) = CASE WHEN OBJECT_ID(N'sidata.ViewState') IS NULL THEN NULL ELSE (SELECT TOP (1) Value FROM sidata.ViewState WHERE Name = N'cifinding-swap' AND Value LIKE N'open%') END;
|IF @swap IS NOT NULL AND ISNULL(@RefuseWhy, N'') = N''
|BEGIN
|    SELECT CONVERT(bit, 0) AS Published,
|           CONVERT(nvarchar(400), CONCAT(N'the findings per CI of ', LTRIM(STUFF(@swap, 1, 4, N'')), N' are being replaced by the data sync (or it stopped part-way) -- the pages keep showing the published run; a run publishes once the replace is whole')) AS Reason,
|           CAST(NULL AS int) AS CollectionId, CAST(NULL AS datetime2(3)) AS CollectionTime, CONVERT(bit, 0) AS [Partial],
|           CONVERT(bit, 0) AS CopiesCaughtUp, CAST(NULL AS nvarchar(400)) AS CopiesNote;
|    RETURN;
|END
|-- every value arrives as text ('' = none): typed here, once
|DECLARE @rs datetime2(3) = TRY_CONVERT(datetime2(3), NULLIF(@RunStartedUtc, N''), 126),
|        @re datetime2(3) = TRY_CONVERT(datetime2(3), NULLIF(@RunEndedUtc, N''), 126),
|        @ci bit = CASE WHEN @NeedCiBuild = N'1' THEN 1 ELSE 0 END,
|        @ap bit = CASE WHEN @AllowPartial = N'1' THEN 1 ELSE 0 END,
|        @keep int = ISNULL(TRY_CONVERT(int, @SnapshotKeepDays), 90),
|        @fr nvarchar(64) = NULLIF(@FlowRunId, N''), @sv nvarchar(64) = NULLIF(@SolutionVersion, N'');
|DECLARE @res TABLE (Published bit, Reason nvarchar(400), CollectionId int, CollectionTime datetime2(3), [Partial] bit);
|-- the decision and the pointer: one call, one transaction (the copies follow, range by range: Invoke-SIDataPublishRun)
|INSERT @res EXEC sidata.PublishedRunSet @Source = @Source, @FlowRunId = @fr, @RunStartedUtc = @rs, @RunEndedUtc = @re,
|     @SolutionVersion = @sv, @Grains = @Grains, @NeedCiBuild = @ci, @AllowPartial = @ap, @SnapshotKeepDays = @keep,
|     @RefuseWhy = @RefuseWhy;
|SELECT Published, Reason, CollectionId, CollectionTime, [Partial], CONVERT(bit, 0) AS CopiesCaughtUp, CAST(NULL AS nvarchar(400)) AS CopiesNote FROM @res;
|'@
|}
|
|$script:SIPublishedCopyTables = @('Ci', 'CiLink', 'CiFinding', 'CiService', 'CiRecord', 'CiFindingState', 'CiRelation', 'Asset', 'AssetIdentifier', 'AssetTag')
|
|function Get-SIPublishedCopyRangeSql {
|    <# #881 One key range of one copy (sidata.PublishedCopyRefreshRange): parameters Table, HasFrom, From, Size, HasTo, To.
|       One row: Rows (NULL = the copy or its source is not there), Next (the range's upper bound as text), Done. #>
|    @'
|SET NOCOUNT ON;
|DECLARE @n nvarchar(max), @d bit, @r bigint;
|EXEC sidata.PublishedCopyRefreshRange @Table = @Table, @HasFrom = @HasFrom, @From = @From, @Size = @Size, @HasTo = @HasTo, @To = @To,
|     @Next = @n OUTPUT, @Done = @d OUTPUT, @Rows = @r OUTPUT;
|SELECT @r AS [Rows], @n AS [Next], CONVERT(int, @d) AS Done;
|'@
|}
|
|function Get-SIPublishedCopyBoundsSql {
|    <# #881 The next @Count range bounds of one copy after @From, @Size values apart (a read): rows K, in order. #>
|    'SET NOCOUNT ON; EXEC sidata.PublishedCopyRefreshRange @Table = @Table, @HasFrom = @HasFrom, @From = @From, @Size = @Size, @Count = @Count;'
|}
|
|function Get-SIPublishedCopyFigureSql {
|    <# #881 One copy's figures after its refresh (sidata.PublishedCopy: rows written, milliseconds, when). #>
|    @'
|SET NOCOUNT ON;
|MERGE sidata.PublishedCopy AS x
|USING (SELECT CONVERT(nvarchar(64), @Table) AS TableName) AS s ON x.TableName = s.TableName
|WHEN MATCHED THEN UPDATE SET [Rows] = CONVERT(bigint, @Rows), Milliseconds = CONVERT(int, @Ms), CopiedAt = SYSUTCDATETIME()
|WHEN NOT MATCHED THEN INSERT (TableName, [Rows], Milliseconds) VALUES (s.TableName, CONVERT(bigint, @Rows), CONVERT(int, @Ms));
|'@
|}
|
|function Get-SIPublishedCopyWorkers {
|    <# How many ranges run at once: the database's own cores (Get-SIDataFillWorkers when the data sync's code is loaded),
|       else the schedulers it sees, else 2 -- a measurement of the database, never a fixed count. Never throws. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke)
|    if (Get-Command -Name Get-SIDataFillWorkers -ErrorAction SilentlyContinue) { return (Get-SIDataFillWorkers -Invoke $Invoke) }
|    $n = 0
|    foreach ($sql in @('SELECT MAX(cpu_limit) FROM sys.dm_user_db_resource_governance WHERE database_id = DB_ID();', "SELECT COUNT(*) FROM sys.dm_os_schedulers WHERE status = N'VISIBLE ONLINE';")) {
|        try { $v = & $Invoke $sql @{} 'scalar'; if ($null -ne $v -and -not ($v -is [System.DBNull])) { $n = [int]$v } } catch { $n = 0 }
|        if ($n -ge 1) { break }
|    }
|    if ($n -lt 1) { 2 } else { $n }
|}
|
|function Test-SIPublishedCopyTransientError {
|    <# PURE. Is a failed range's error one of Microsoft's TRANSIENT SQL answers, so the same range may simply run again (review
|       S4)? -Numbers: the SQL error numbers (SqlException.Errors); -Message: the error's text. Transient: a deadlock victim (1205),
|       a client timeout (-2), the Azure SQL "not available / busy / failover / resource" errors (40613, 40501, 40197, 49918, 49919,
|       49920), and a connection that was reset or closed under the command. Anything else is not: it fails the refresh. #>
|    param([AllowNull()][int[]]$Numbers = @(), [AllowNull()][AllowEmptyString()][string]$Message = '')
|    $codes = @(1205, -2, 40613, 40501, 40197, 49918, 49919, 49920, 10053, 10054, 233, 64)
|    foreach ($n in @($Numbers)) { if ($codes -contains [int]$n) { return $true } }
|    [bool]([string]$Message -match '(?i)deadlocked on lock|deadlock victim|Timeout expired|transport-level error|connection was forcibly closed|forcibly closed by the remote host|connection reset|Connection reset by peer|broken pipe|is not currently available|\b(40613|40501|40197|49918|49919|49920)\b')
|}
|
|function Invoke-SIPublishedCopyRangeWave {
|    <# #881 One wave: every range of -Ranges AT ONCE, each on its own connection, no command time limit; waits for all. Answers,
|       in the order of -Ranges, @{ Failed; Rows ($null = the copy is not there); Ms; Numbers; Message } -- an error is ANSWERED
|       (with its SQL error numbers), never thrown, so the caller can tell a transient one from any other. #>
|    param([Parameter(Mandatory)]$Info, [Parameter(Mandatory)][object[]]$Ranges)
|    $sql = Get-SIPublishedCopyRangeSql
|    $work = {
|        param([string]$Cs, [string]$Token, [string]$Text, [hashtable]$R)
|        $sw = [Diagnostics.Stopwatch]::StartNew()
|        try {
|            $cn = New-Object System.Data.SqlClient.SqlConnection($Cs)
|            if ($Token) { $cn.AccessToken = $Token }
|            try {
|                $cn.Open()
|                $c = $cn.CreateCommand(); $c.CommandText = $Text; $c.CommandTimeout = 0
|                foreach ($k in 'Table', 'HasFrom', 'From', 'Size', 'HasTo', 'To') { $v = $R[$k]; if ($null -eq $v) { $v = [System.DBNull]::Value }; [void]$c.Parameters.AddWithValue('@' + $k, $v) }
|                $rd = $c.ExecuteReader(); $rows = $null
|                try { if ($rd.Read()) { $rows = $(if ($rd.IsDBNull(0)) { $null } else { [long]$rd.GetValue(0) }) } } finally { $rd.Close() }
|                [pscustomobject]@{ Failed = $false; Rows = $rows; Ms = $sw.ElapsedMilliseconds; Numbers = @(); Message = '' }
|            } finally { $cn.Dispose() }
|        } catch {
|            $nums = New-Object System.Collections.Generic.List[int]
|            $e = $_.Exception
|            while ($e) { if ($e -is [System.Data.SqlClient.SqlException]) { foreach ($x in $e.Errors) { $nums.Add([int]$x.Number) } }; $e = $e.InnerException }
|            [pscustomobject]@{ Failed = $true; Rows = $null; Ms = $sw.ElapsedMilliseconds; Numbers = $nums.ToArray(); Message = [string]$_.Exception.Message }
|        }
|    }
|    $pool = [runspacefactory]::CreateRunspacePool(1, [Math]::Max(1, $Ranges.Count))
|    $pool.Open()
|    $jobs = New-Object System.Collections.Generic.List[object]
|    try {
|        foreach ($r in $Ranges) {
|            $ps = [powershell]::Create(); $ps.RunspacePool = $pool
|            $null = $ps.AddScript($work.ToString()).AddArgument([string]$Info.ConnectionString).AddArgument([string]$Info.AccessToken).AddArgument($sql).AddArgument([hashtable]$r)
|            $jobs.Add(@($ps, $ps.BeginInvoke()))
|        }
|        $out = New-Object System.Collections.Generic.List[object]
|        foreach ($j in $jobs) {
|            $o = $null
|            try {
|                $res = @($j[0].EndInvoke($j[1]))
|                if ($res.Count) { $o = $res[-1] }
|                elseif ($j[0].Streams.Error.Count -gt 0) { $o = [pscustomobject]@{ Failed = $true; Rows = $null; Ms = 0L; Numbers = @(); Message = [string]$j[0].Streams.Error[0].Exception.Message } }
|            } catch { $o = [pscustomobject]@{ Failed = $true; Rows = $null; Ms = 0L; Numbers = @(); Message = [string]$_.Exception.Message } }
|            if ($null -eq $o) { $o = [pscustomobject]@{ Failed = $true; Rows = $null; Ms = 0L; Numbers = @(); Message = 'the range answered nothing' } }
|            $out.Add($o)
|        }
|        , $out.ToArray()
|    } finally {
|        foreach ($j in $jobs) { try { $j[0].Dispose() } catch { } }
|        $pool.Close(); $pool.Dispose()
|    }
|}
|
|function Invoke-SIPublishedCopyRangesParallel {
|    <#
|        #881 Runs Get-SIPublishedCopyRangeSql for every range of -Ranges (@{ Table; HasFrom; From; Size; HasTo; To }) AT ONCE,
|        each on its own connection (-ConnectionInfo: the seam's SIConnectionInfo), with no command time limit; waits for all.
|        Answers @{ Rows ($null = the copy is not there); Ms } per range, in the order of -Ranges. The same shape as
|        Invoke-SIDataParallelRanges (SI-DataViewContext.ps1), whose ranges are numbers -- these are key values as text.
|        Review S4: a range that fails with one of Microsoft's TRANSIENT SQL answers (Test-SIPublishedCopyTransientError: a
|        deadlock, a timeout, Azure SQL busy / failover, a reset connection) runs again, after a growing pause (2, 4, 8 ... s,
|        at most a minute), up to -TransientRetries times -- a bound on Microsoft's errors, never on SI's own work. A range is
|        IDEMPOTENT (sidata.PublishedCopyRefreshRange makes its rows equal to the source's, in its own transaction): a repeat
|        writes the same rows. Any other error -- or a transient one past its retries -- is thrown after every range has ended,
|        as before (the copies stay stale, the next refresh does it again). -Wave / -Sleep / -Log are seams.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$ConnectionInfo, [Parameter(Mandatory)][object[]]$Ranges,
|          [scriptblock]$Wave = { param($info, $ranges) Invoke-SIPublishedCopyRangeWave -Info $info -Ranges $ranges },
|          [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s }, [scriptblock]$Log = { param($l, $m) },
|          [int]$TransientRetries = 5)
|    if ($Ranges.Count -eq 0) { return , @() }
|    $results = New-Object object[] $Ranges.Count
|    $pending = @(0..($Ranges.Count - 1))
|    $attempt = 0
|    while ($pending.Count) {
|        $info = & $ConnectionInfo   # asked again for every attempt: a fresh token after a long pause
|        # assigned first, then @(): a wave answers `, $array` -- @(& $Wave ...) would wrap that array as ONE element
|        $outs = & $Wave $info @($pending | ForEach-Object { $Ranges[$_] }); $outs = @($outs)
|        $again = New-Object System.Collections.Generic.List[int]; $err = $null
|        for ($i = 0; $i -lt $pending.Count; $i++) {
|            $idx = $pending[$i]; $o = $(if ($i -lt $outs.Count) { $outs[$i] } else { $null })
|            if ($null -eq $o) { $o = [pscustomobject]@{ Failed = $true; Rows = $null; Ms = 0L; Numbers = @(); Message = 'the range answered nothing' } }
|            if (-not [bool]$o.Failed) { $results[$idx] = [pscustomobject]@{ Rows = $o.Rows; Ms = [long]$o.Ms }; continue }
|            $transient = Test-SIPublishedCopyTransientError -Numbers @($o.Numbers) -Message ([string]$o.Message)
|            if ($transient -and $attempt -lt $TransientRetries) { $again.Add($idx); continue }
|            if ($null -eq $err) {
|                $r = $Ranges[$idx]
|                $err = ("published copies: {0}Pub, the range after '{1}': {2}{3}" -f $r.Table, $(if ([int]$r.HasFrom -eq 1) { [string]$r.From } else { '(the start)' }), [string]$o.Message,
|                        $(if ($transient) { (' (a transient SQL error, still there after {0} retries)' -f $attempt) } else { '' }))
|            }
|        }
|        if ($err) { throw $err }
|        if ($again.Count) {
|            $attempt++
|            $pause = [int][Math]::Min(60, [Math]::Pow(2, $attempt))
|            & $Log 'WARN' ("published copies: {0} range(s) of {1}Pub met a transient SQL error (a deadlock, a timeout or Azure SQL busy) -- run again in {2} s (retry {3} of {4})" -f $again.Count, $Ranges[$again[0]].Table, $pause, $attempt, $TransientRetries)
|            & $Sleep $pause
|        }
|        $pending = $again.ToArray()
|    }
|    , $results
|}
|
|function Invoke-SIPublishedCopyRefresh {
|    <#
|        #881 THE PUBLISHED COPIES MADE EQUAL TO THEIR SOURCES, RANGE BY RANGE (the engine's driver: the pipeline runner and the
|        update reach it through Invoke-SIPublishedCopyCatchUp). For each of the ten copies the key ranges of a wave run AT ONCE,
|        each its own short transaction on its own connection -- as many as the database has cores (Get-SIPublishedCopyWorkers),
|        one fewer each time the database is saturated (SI-SqlPacing.ps1) and one more again when it is not; the range size
|        follows the measured time of the wave before (Get-SIDataNextSize; -FirstSize is only where it starts). A seam without
|        a connection to hand out (a test's fake) runs the ranges one after another. ONE REFRESHER at a time: the session lock
|        si-published-copy-refresh on a connection of its own for the whole refresh (another one running = Held, nothing
|        done). A progress line every -ProgressSeconds and one line per copy that changed. No time limit.
|        Returns @{ Ok (every copy refreshed); Held; Tables; Rows; Ranges; Seconds; Missing (copies not there) }. Throws on a
|        failure (the caller says it): the copies stay stale, CopiedAt is not moved, the next catch-up refreshes.
|        -Beat (2026-10-24): called while the refresh makes progress -- when it starts and then at most every -BeatSeconds,
|        after a range or a wave has ended -- so the pipeline runner can keep ITS lock alive while the run's copy is written
|        (a 15-50 minute copy outlived the lock's 15 minutes and the next wake-up could start a run beside it). Only progress
|        beats: a refresh that hangs or dies stops beating, and the lock lapses as before. A beat that fails never stops it.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [scriptblock]$Log = { param($l, $m) }, [int]$Workers = 0, [long]$FirstSize = 10000,
|          [long]$TargetMs = 2000, [double]$ProgressSeconds = 60, [scriptblock]$Beat, [double]$BeatSeconds = 60)
|    $res = [pscustomobject]@{ Ok = $false; Held = $false; Tables = 0; Rows = 0L; Ranges = 0L; Seconds = 0.0; Missing = @() }
|    $ci = $null; if ($Invoke.PSObject.Properties['SIConnectionInfo'] -and $Invoke.SIConnectionInfo) { $ci = $Invoke.SIConnectionInfo }
|    $maxWorkers = 1
|    if ($ci -and $Workers -ne 1) { $maxWorkers = $(if ($Workers -gt 1) { $Workers } else { Get-SIPublishedCopyWorkers -Invoke $Invoke }) }
|    $paced = [bool](Get-Command -Name Invoke-SISqlPacing -ErrorAction SilentlyContinue)
|    $tgt = $TargetMs
|    $nextSize = {
|        param([long]$cur, [long]$ms)
|        if (Get-Command -Name Get-SIDataNextSize -ErrorAction SilentlyContinue) { return (Get-SIDataNextSize -Current $cur -ElapsedMs $ms -TargetMs $tgt -Minimum 1) }
|        $limit = [Math]::Min([double]([long]::MaxValue / 2), 2.0 * $cur)
|        $w = if ($ms -le 0) { $limit } else { [Math]::Min($limit, [Math]::Floor([double]$cur * $tgt / $ms)) }
|        [long][Math]::Max(1, $w)
|    }
|    $val = { param($row, $n) if ($null -eq $row) { $null } elseif ($row -is [System.Collections.IDictionary]) { $v = $row[$n]; if ($v -is [System.DBNull]) { $null } else { $v } } else { $v = $row.$n; if ($v -is [System.DBNull]) { $null } else { $v } } }
|    $lockCn = $null
|    $clock = [Diagnostics.Stopwatch]::StartNew(); $said = [double]0
|    $beatState = @{ At = [double]::NegativeInfinity }
|    $beatNow = { if ($Beat -and ($clock.Elapsed.TotalSeconds - $beatState.At) -ge $BeatSeconds) { $beatState.At = $clock.Elapsed.TotalSeconds; try { $null = & $Beat } catch { } } }
|    try {
|        if ($ci) {
|            # one refresher at a time: the session lock, on a connection held for the whole refresh
|            $info = & $ci
|            $lockCn = New-Object System.Data.SqlClient.SqlConnection([string]$info.ConnectionString)
|            if ($info.AccessToken) { $lockCn.AccessToken = [string]$info.AccessToken }
|            $lockCn.Open()
|            $lc = $lockCn.CreateCommand(); $lc.CommandTimeout = 0
|            $lc.CommandText = "DECLARE @l int; EXEC @l = sp_getapplock @Resource = N'si-published-copy-refresh', @LockMode = N'Exclusive', @LockOwner = N'Session', @LockTimeout = 0; SELECT @l;"
|            if ([int]$lc.ExecuteScalar() -lt 0) { $res.Held = $true; return $res }
|        }
|        & $beatNow
|        if ($maxWorkers -gt 1) { & $Log 'INFO' ("published copies: the merged assets' copies are refreshed {0} range(s) at a time (the database's cores)" -f $maxWorkers) }
|        $missing = New-Object System.Collections.Generic.List[string]
|        foreach ($t in $script:SIPublishedCopyTables) {
|            $tw = [Diagnostics.Stopwatch]::StartNew(); $rows = 0L; $ranges = 0L; $size = [Math]::Max(1L, $FirstSize); $workersNow = $maxWorkers; $lastMs = 0L
|            $hasFrom = 0; $from = $null; $done = $false; $gone = $false
|            while (-not $done) {
|                if ($paced) {
|                    $pace = Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs -Log $Log
|                    if ($pace.Shrink) { $size = [Math]::Max(1L, [long][Math]::Floor($size / 2)); $workersNow = [Math]::Max(1, $workersNow - 1) }
|                    elseif ($workersNow -lt $maxWorkers -and [string]$pace.State -eq 'normal') { $workersNow++ }
|                }
|                $sz = [int][Math]::Min([double][int]::MaxValue, [double]$size)
|                $sw = [Diagnostics.Stopwatch]::StartNew(); $ms = 0L
|                if ($workersNow -le 1) {
|                    # one range: its upper bound worked out by the procedure (the @Size-th value after the last one)
|                    $row = @(& $Invoke (Get-SIPublishedCopyRangeSql) @{ Table = $t; HasFrom = $hasFrom; From = $from; Size = $sz; HasTo = 0; To = $null } 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) | Select-Object -First 1
|                    $n = & $val $row 'Rows'
|                    if ($null -eq $n) { $gone = $true; break }
|                    $rows += [long]$n; $ranges++
|                    $next = & $val $row 'Next'
|                    $done = ([int](& $val $row 'Done')) -eq 1 -or $null -eq $next
|                    $from = $next; $hasFrom = 1
|                    $ms = $sw.ElapsedMilliseconds
|                } else {
|                    # a wave: the next bounds first (a read), then every range of the wave at once. Fewer bounds than ranges
|                    # wanted = the column ends inside this wave: its last range is open upwards (worked out by the procedure)
|                    $bounds = @(@(& $Invoke (Get-SIPublishedCopyBoundsSql) @{ Table = $t; HasFrom = $hasFrom; From = $from; Size = $sz; Count = $workersNow } 'rows') | ForEach-Object { $_ } | Where-Object { $null -ne $_ } | ForEach-Object { [string](& $val $_ 'K') })
|                    $wave = New-Object System.Collections.Generic.List[object]
|                    $pf = $hasFrom; $pv = $from
|                    foreach ($k in $bounds) { $wave.Add(@{ Table = $t; HasFrom = $pf; From = $pv; Size = $sz; HasTo = 1; To = $k }); $pf = 1; $pv = $k }
|                    # (the open range is asked for every row that is left: its own TOP takes them all, so nothing past it is left out)
|                    if ($bounds.Count -lt $workersNow) { $wave.Add(@{ Table = $t; HasFrom = $pf; From = $pv; Size = [int]::MaxValue; HasTo = 0; To = $null }); $done = $true }
|                    foreach ($r in (Invoke-SIPublishedCopyRangesParallel -ConnectionInfo $ci -Ranges $wave.ToArray() -Log $Log)) {
|                        if ($null -eq $r.Rows) { $gone = $true } else { $rows += [long]$r.Rows }
|                        if ([long]$r.Ms -gt $ms) { $ms = [long]$r.Ms }
|                    }
|                    if ($gone) { break }
|                    $ranges += $wave.Count; $hasFrom = $pf; $from = $pv
|                }
|                $lastMs = $ms
|                # a range / a wave has ended: progress -- the caller's lock is kept alive
|                & $beatNow
|                $size = & $nextSize $size $ms
|                $now = $clock.Elapsed.TotalSeconds
|                if (-not $done -and ($now - $said) -ge $ProgressSeconds) {
|                    $said = $now
|                    & $Log 'INFO' ("published copies: {0}Pub -- {1:N0} range(s), {2:N0} row(s) written so far" -f $t, $ranges, $rows)
|                }
|            }
|            if ($gone) { $missing.Add($t); continue }
|            $null = & $Invoke (Get-SIPublishedCopyFigureSql) @{ Table = $t; Rows = [string]$rows; Ms = [string][Math]::Min([long][int]::MaxValue, $tw.ElapsedMilliseconds) } 'nonquery'
|            $res.Tables++; $res.Rows += $rows; $res.Ranges += $ranges
|            if ($rows -gt 0 -or $tw.Elapsed.TotalSeconds -ge $ProgressSeconds) {
|                & $Log 'INFO' ("published copies: {0}Pub -- {1:N0} row(s) written in {2:N0} range(s), {3:N0} s" -f $t, $rows, $ranges, $tw.Elapsed.TotalSeconds)
|            }
|        }
|        $res.Missing = $missing.ToArray()
|        $res.Ok = ($res.Tables -eq $script:SIPublishedCopyTables.Count)
|        $res.Seconds = [Math]::Round($clock.Elapsed.TotalSeconds, 1)
|        $res
|    } finally {
|        if ($lockCn) {
|            try { $lc = $lockCn.CreateCommand(); $lc.CommandText = "EXEC sp_releaseapplock @Resource = N'si-published-copy-refresh', @LockOwner = N'Session';"; [void]$lc.ExecuteNonQuery() } catch { }
|            $lockCn.Dispose()
|        }
|    }
|}
|
|function Get-SIDataCiSwapOpenSql {
|    <# READS ONLY. 2026-10-29 The open mark of a replace of the findings per CI (engine\pro-data\_shared\SI-DataCi.ps1,
|       Invoke-SIDataCiFindingSwap), as the one column CiFindingSwapOpen ('' when there is none). The same read as
|       Get-SIDataCiFindingSwapOpenSql there (a test keeps the two equal). #>
|    "SELECT CASE WHEN OBJECT_ID('sidata.ViewState') IS NULL THEN N'' ELSE ISNULL((SELECT TOP (1) Value FROM sidata.ViewState WHERE Name = N'cifinding-swap'), N'') END AS CiFindingSwapOpen;"
|}
|
|function Get-SIDataCiSwapOpen {
|    <#
|        2026-10-29 Is a replace of the findings per CI under way (or stopped part-way)? The data sync replaces them a range at a
|        time and keeps the mark open until the stored set is the staged one; meanwhile the source table is part old, part new.
|        The copy refresh and the publish HOLD while it is open, so a half-replaced set never becomes what the pages show.
|        Answers the mark's text ('open <collection>'), '' when there is none or it cannot be read (a read that fails is
|        not a reason to hold: the copies were taken as before).
|    #>
|    param([scriptblock]$Invoke)
|    if (-not $Invoke) { return '' }
|    try {
|        foreach ($r in @(& $Invoke (Get-SIDataCiSwapOpenSql) @{} 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })) {
|            $v = $null
|            if ($r -is [System.Collections.IDictionary]) { if ($r.Contains('CiFindingSwapOpen')) { $v = $r['CiFindingSwapOpen'] } }
|            elseif ($r.PSObject.Properties['CiFindingSwapOpen']) { $v = $r.CiFindingSwapOpen }
|            if ($v -is [string] -and $v -match '^open\b') { return $v }
|        }
|    } catch { }
|    ''
|}
|
|function Get-SIDataCiSwapOpenText {
|    <# PURE. The one plain line while the findings per CI are being replaced (-Mark: Get-SIDataCiSwapOpen's answer). #>
|    param([Parameter(Mandatory)][string]$Mark, [Parameter(Mandatory)][ValidateSet('copies', 'publish')][string]$What)
|    $c = ($Mark -replace '^open\s*', '').Trim(); if (-not $c) { $c = 'the newest collection' }
|    if ($What -eq 'copies') { return ('the copies the pages show wait: the findings per CI of {0} are being replaced by the data sync (or it stopped part-way) -- the pages keep showing the published run, and the copies are refreshed once the replace is whole' -f $c) }
|    ('not published now: the findings per CI of {0} are being replaced by the data sync (or it stopped part-way) -- the pages keep showing the published run; a run publishes once the replace is whole' -f $c)
|}
|
|function Get-SIPublishedCopyCatchUpSql {
|    <# The catch-up of the shown run's copies (sidata.PublishedCopyCatchUp), one row: Ready (the procedure is there), Stale,
|       Refreshed, PublishedAt, CopiedAt, Ranged (#881: the copies can be refreshed range by range by the engine's driver --
|       sidata.PublishedCopyRefreshRange is there), Now (the database's time, ISO text). @WhatIf = '1': only whether they are
|       stale. @MarkFor (ISO text, '' = none): the engine refreshed the copies itself, range by range, for the publish of that
|       PublishedAt -- only the claim (CopiedAt) is made, and only while that is still the publish shown. #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'sidata.PublishedRun') IS NULL
|   OR NOT EXISTS (SELECT 1 FROM sys.parameters WHERE object_id = OBJECT_ID(N'sidata.PublishedCopyCatchUp') AND name = N'@Refreshed')
|BEGIN
|    SELECT CONVERT(bit, 0) AS Ready, CONVERT(bit, 0) AS Stale, CONVERT(bit, 0) AS Refreshed, CAST(NULL AS datetime2(0)) AS PublishedAt, CAST(NULL AS datetime2(0)) AS CopiedAt,
|           CONVERT(bit, 0) AS Ranged, CAST(NULL AS nvarchar(30)) AS Now;
|    RETURN;
|END
|DECLARE @s bit, @r bit, @p datetime2(0), @c datetime2(0), @w bit = CASE WHEN @WhatIf = N'1' THEN 1 ELSE 0 END,
|        @m datetime2(0) = TRY_CONVERT(datetime2(0), NULLIF(@MarkFor, N''), 126), @now nvarchar(30) = CONVERT(nvarchar(30), SYSUTCDATETIME(), 126),
|        @ranged bit = CASE WHEN OBJECT_ID(N'sidata.PublishedCopyRefreshRange') IS NOT NULL
|                            AND EXISTS (SELECT 1 FROM sys.parameters WHERE object_id = OBJECT_ID(N'sidata.PublishedCopyCatchUp') AND name = N'@MarkFor') THEN 1 ELSE 0 END;
|IF @m IS NOT NULL AND @ranged = 1
|    EXEC sidata.PublishedCopyCatchUp @Stale = @s OUTPUT, @Refreshed = @r OUTPUT, @PublishedAt = @p OUTPUT, @CopiedAt = @c OUTPUT, @MarkFor = @m;
|ELSE
|    EXEC sidata.PublishedCopyCatchUp @WhatIf = @w, @Stale = @s OUTPUT, @Refreshed = @r OUTPUT, @PublishedAt = @p OUTPUT, @CopiedAt = @c OUTPUT;
|-- 2026-10-29 the open replace of the findings per CI (the caller holds the copies while it is open)
|SELECT CONVERT(bit, 1) AS Ready, ISNULL(@s, 0) AS Stale, ISNULL(@r, 0) AS Refreshed, @p AS PublishedAt, @c AS CopiedAt, @ranged AS Ranged, @now AS Now,
|       CASE WHEN OBJECT_ID(N'sidata.ViewState') IS NULL THEN NULL ELSE (SELECT TOP (1) Value FROM sidata.ViewState WHERE Name = N'cifinding-swap' AND Value LIKE N'open%') END AS CiFindingSwapOpen;
|'@
|}
|
|function Get-SIPublishedCopyCatchUpText {
|    <# PURE. The one plain line about the shown run's copies, or '' when there is nothing to say. -Result: Invoke-SIPublishedCopyCatchUp's.
|       -AfterPublish (#881: every publish leaves the copies to be caught up right after it): a refresh is the normal course,
|       said as how much it wrote -- never as a warning. #>
|    param([Parameter(Mandatory)]$Result, [switch]$AfterPublish)
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $fmt = { param($d) if ($null -eq $d) { 'never' } else { [string]::Format($inv, '{0:yyyy-MM-dd HH:mm} UTC', ([datetime]$d)) } }
|    $how = ''
|    if ($Result.PSObject.Properties['Refresh'] -and $Result.Refresh) { $how = [string]::Format($inv, ' ({0:N0} row(s) written in {1:N0} range(s), {2:N0} s)', $Result.Refresh.Rows, $Result.Refresh.Ranges, $Result.Refresh.Seconds) }
|    if ($AfterPublish) {
|        switch ([string]$Result.Action) {
|            'refreshed' { return ('the merged assets'' pages (CIs and assets) now show the published run{0}' -f $how) }
|            'current'   { return '' }
|        }
|    }
|    $what = 'the merged assets'' pages (CIs and assets) showed a copy older than the run the web app shows (run published {0}, copy {1})' -f (& $fmt $Result.PublishedAt), (& $fmt $Result.CopiedAt)
|    switch ([string]$Result.Action) {
|        'refreshed'     { return ('{0} -- refreshed now{1}; every page shows the same run again' -f $what, $how) }
|        'would-refresh' { return ('{0} -- the update would refresh it now' -f $what) }
|        'held'          { return ('{0} -- not refreshed this time ({1}); the next wake-up tries again' -f $what, $(if ($Result.Reason) { $Result.Reason } else { 'another publish or refresh was running, or a copy is missing' })) }
|        'failed'        { return ('the copies of the merged assets could not be checked or refreshed ({0}) -- the next wake-up tries again' -f $Result.Reason) }
|    }
|    ''
|}
|
|function Invoke-SIPublishedCopyCatchUp {
|    <#
|        The shown run's copies caught up when they are older than it (CopiedAt NULL or older than the publish). NEVER throws.
|        Used by the pipeline runner after every publish attempt and on every wake-up (Invoke-SIDataPublishRun) and by the update
|        (setup\Invoke-SIContainerUpdate.ps1 step 9g). -Invoke: the data database seam (sql, params, mode 'rows'); -WhatIf: only
|        whether they are stale.
|        #881 RANGE BY RANGE: on a database that has sidata.PublishedCopyRefreshRange the engine refreshes the copies itself
|        (Invoke-SIPublishedCopyRefresh: the ranges at once, each its own short transaction, a progress line), and only when
|        every range of every copy is done does it claim them (CopiedAt, for the publish it was for). An older
|        database: the procedure as before. -AfterPublish: this run just published -- the refresh is said as INFO, not as a
|        stale copy.
|        Returns @{ Action ('not-yet' | 'current' | 'refreshed' | 'would-refresh' | 'held' | 'failed'); Stale; PublishedAt;
|        CopiedAt; Reason; Lines; Refresh }. Said: one line when they were stale or could not be checked (a data-health
|        warning; warn only, never a block), nothing when they are current.
|    #>
|    param([scriptblock]$Invoke, [switch]$WhatIf, [switch]$AfterPublish, [scriptblock]$Log = { param($l, $m) }, [scriptblock]$Beat)
|    $res = [pscustomobject]@{ Action = 'not-yet'; Stale = $false; PublishedAt = $null; CopiedAt = $null; Reason = ''; Lines = @(); Refresh = $null }
|    $bit = { param($x) ($x -eq $true) -or ([string]$x -in @('1', 'True', 'true')) }
|    $ask = {
|        param([string]$w, [string]$mark)
|        $rows = @(& $Invoke (Get-SIPublishedCopyCatchUpSql) @{ WhatIf = $w; MarkFor = $mark } 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })
|        if (-not $rows.Count) { throw 'the database answered no result' }
|        $r = $rows[0]
|        $val = { param($n) $v = $null; if ($r -is [System.Collections.IDictionary]) { if ($r.Contains($n)) { $v = $r[$n] } } elseif ($r.PSObject.Properties[$n]) { $v = $r.$n }; if ($v -is [System.DBNull]) { $null } else { $v } }
|        [pscustomobject]@{ Ready = (& $bit (& $val 'Ready')); Stale = (& $bit (& $val 'Stale')); Refreshed = (& $bit (& $val 'Refreshed'))
|                           PublishedAt = (& $val 'PublishedAt'); CopiedAt = (& $val 'CopiedAt'); Ranged = (& $bit (& $val 'Ranged')); Now = [string](& $val 'Now'); SwapOpen = [string](& $val 'CiFindingSwapOpen') }
|    }
|    try {
|        if (-not $Invoke) { return $res }
|        # first only ask (a database that refreshes range by range is refreshed by the engine itself, below)
|        $a = & $ask '1' ''
|        if (-not $a.Ready) { return $res }
|        # 2026-10-29 never while the findings per CI are being replaced (their source table is part old, part new): one plain line
|        if ($a.SwapOpen -match '^open\b') { $res.PublishedAt = $a.PublishedAt; $res.CopiedAt = $a.CopiedAt; $res.Stale = [bool]$a.Stale; $res.Action = 'held'; $res.Reason = (Get-SIDataCiSwapOpenText -Mark $a.SwapOpen -What copies); & $Log 'INFO' $res.Reason; return $res }
|        $res.PublishedAt = $a.PublishedAt; $res.CopiedAt = $a.CopiedAt
|        if (-not $a.Stale) { $res.Action = 'current' }
|        elseif ($WhatIf) { $res.Stale = $true; $res.Action = 'would-refresh' }
|        elseif ($a.Ranged -and $null -ne $a.PublishedAt -and $Invoke.PSObject.Properties['SIConnectionInfo'] -and $Invoke.SIConnectionInfo) {
|            # review S3: the engine's range driver ONLY on a seam that can hand out connections -- it then takes the refresher
|            # lock si-published-copy-refresh for the whole refresh. A seam without one (the update's) never refreshes unlocked:
|            # it goes to the database's procedure below, which takes the same lock itself (another refresher = nothing done).
|            $res.Refresh = Invoke-SIPublishedCopyRefresh -Invoke $Invoke -Log $Log -Beat $Beat
|            if ($res.Refresh.Held) { $res.Stale = $true; $res.Action = 'held'; $res.Reason = 'another refresh of the copies was running' }
|            elseif (-not $res.Refresh.Ok) { $res.Stale = $true; $res.Action = 'held'; $res.Reason = ('a copy is not there: {0}' -f (@($res.Refresh.Missing) -join ', ')) }
|            else {
|                # every range of every copy is done: claimed for the publish it was for (PublishedAt as asked before it began)
|                $m = & $ask '0' ([datetime]$a.PublishedAt).ToString('yyyy-MM-ddTHH:mm:ss', [Globalization.CultureInfo]::InvariantCulture)
|                if ($m.Refreshed) { $res.Action = 'refreshed' }
|                else { $res.Stale = $true; $res.Action = 'held'; $res.Reason = 'a newer publish came while the copies were refreshed' }
|            }
|        } else {
|            # an older database, or a seam without connections: the procedure refreshes (under the refresher lock) and claims them itself
|            $o = & $ask '0' ''
|            $res.Stale = $o.Stale -and -not $o.Refreshed
|            $res.Action = if ($o.Refreshed) { 'refreshed' } elseif (-not $o.Stale) { 'current' } else { 'held' }
|        }
|    } catch {
|        $res.Action = 'failed'; $res.Reason = $_.Exception.Message
|    }
|    $line = Get-SIPublishedCopyCatchUpText -Result $res -AfterPublish:$AfterPublish
|    if ($line) { $res.Lines = @($line); & $Log $(if ($AfterPublish -and $res.Action -eq 'refreshed') { 'INFO' } else { 'WARN' }) $line }
|    $res
|}
|
|function Get-SIDataPublishSnapshotPruneSql {
|    <# The executive-view copies no pointer names any more, past the data retention (the schema file stays additive: this
|       removal lives here). Answers how many were removed. #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'sidata.RiskExecViewSnapshot') IS NULL OR OBJECT_ID(N'sidata.PublishedRun') IS NULL BEGIN SELECT 0; RETURN; END
|DELETE s FROM sidata.RiskExecViewSnapshot AS s
|WHERE s.SnapshotAt < DATEADD(DAY, -ISNULL(TRY_CONVERT(int, @KeepDays), 90), SYSUTCDATETIME())
|  AND NOT EXISTS (SELECT 1 FROM sidata.PublishedRun AS p WHERE p.ExecViewDetailedId = s.SnapshotId OR p.ExecViewSummaryId = s.SnapshotId);
|SELECT @@ROWCOUNT;
|'@
|}
|
|function Format-SIDataPublishTime {
|    <# PURE. A UTC time as the ISO text the statements convert (style 126), or $null. #>
|    param($Time)
|    if ($null -eq $Time -or [string]$Time -eq '') { return $null }
|    $d = if ($Time -is [datetime]) { [datetime]$Time } else { [datetime]::Parse([string]$Time, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::RoundtripKind) }
|    $d.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fff', [Globalization.CultureInfo]::InvariantCulture)
|}
|
|function Get-SIDataPublishText {
|    <# PURE. The one plain line the run log says. -Result: Invoke-SIDataPublishRun's answer. #>
|    param([Parameter(Mandatory)]$Result)
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    if ($Result.Published) {
|        $when = if ($Result.CollectionTime) { [string]::Format($inv, ' of {0:yyyy-MM-dd HH:mm} UTC', ([datetime]$Result.CollectionTime)) } else { '' }
|        return ('the web app now shows this run: its collection{0} is published{1}' -f $when, $(if ($Result.Reason) { ' (' + ([string]$Result.Reason).TrimEnd(' ', ';') + ')' } else { '' }))
|    }
|    if ($Result.Skipped) { return ('the web app keeps showing the last complete run: {0}' -f $Result.Reason) }
|    'the web app keeps showing the last complete run -- this run is not published: {0}' -f $Result.Reason
|}
|
|function Write-SIDataPublishCopiesLine {
|    <# The publish batch's word on the shown run's copies (CopiesCaughtUp / CopiesNote), as one WARN line -- nothing when the
|       copies were current. Never throws. #>
|    param($Rows, [scriptblock]$Log = { param($l, $m) })
|    try {
|        $r = @(@($Rows) | ForEach-Object { $_ } | Where-Object { $null -ne $_ })[0]
|        if ($null -eq $r) { return }
|        $val = { param($n) $v = $null; if ($r -is [System.Collections.IDictionary]) { if ($r.Contains($n)) { $v = $r[$n] } } elseif ($r.PSObject.Properties[$n]) { $v = $r.$n }; if ($v -is [System.DBNull]) { $null } else { $v } }
|        $caught = & $val 'CopiesCaughtUp'; $note = [string](& $val 'CopiesNote')
|        if (($caught -eq $true) -or ([string]$caught -in @('1', 'True', 'true'))) { & $Log 'WARN' 'the merged assets'' pages (CIs and assets) showed a copy older than the run the web app shows -- refreshed now; every page shows the same run again' }
|        elseif ($note) { & $Log 'WARN' ('the copies of the merged assets could not be checked or refreshed ({0}) -- the next wake-up tries again' -f $note) }
|    } catch { }
|}
|
|function Invoke-SIDataPublishRun {    <#
|        Publish (or not) one ended run. NEVER throws. -Invoke: the data database seam (sql, params, mode 'rows'), $null = no
|        database (nothing to publish). -State + -Map: a pipeline run (Source 'run'); -Source 'schedules': no run, the
|        newest complete collection; -Source 'update': an install that has data and NOTHING published yet (the update that
|        brought the published run) is published once -- the newest complete collection, its copies filled -- and every later
|        wake-up only reads that something is published and catches up the shown run's copies when they are older than it
|        (Invoke-SIPublishedCopyCatchUp). Returns @{ Published; Skipped (the run was not eligible -- the
|        database was not asked); Reason; CollectionId; CollectionTime; Partial; Text }.
|    #>
|    param([scriptblock]$Invoke, $State, $Map, $Previous, [ValidateSet('run', 'schedules', 'update')][string]$Source = 'run', [string]$SolutionVersion = '',
|          [bool]$AllowPartial = (Test-SIPublishPartialRun), [int]$RetentionDays = 0, [scriptblock]$Log = { param($l, $m) }, [scriptblock]$Beat)
|    $res = [pscustomobject]@{ Published = $false; Skipped = $false; Reason = ''; CollectionId = $null; CollectionTime = $null; Partial = $false; Text = '' }
|    try {
|        if (-not $Invoke) { $res.Skipped = $true; $res.Reason = 'this install has no database'; $res.Text = Get-SIDataPublishText -Result $res; return $res }
|        if ($Source -eq 'update') {
|            # one read on every wake-up; the publisher (its lock, its checks) only while nothing is published
|            $n = @(& $Invoke "SELECT CASE WHEN OBJECT_ID(N'sidata.PublishedRun') IS NULL OR OBJECT_ID(N'sidata.PublishedRunSet') IS NULL THEN 1 ELSE (SELECT COUNT(*) FROM sidata.PublishedRun WHERE Name = N'current') END AS N" @{} 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })
|            $has = if ($n.Count) { $v = if ($n[0] -is [System.Collections.IDictionary]) { $n[0]['N'] } else { $n[0].N }; [int]$v -gt 0 } else { $true }
|            # a run is published: its copies of the merged assets caught up when they are older than it (one cheap read when not)
|            if ($has) { $null = Invoke-SIPublishedCopyCatchUp -Invoke $Invoke -Log $Log; $res.Skipped = $true; $res.Reason = 'a run is published'; return $res }
|        }
|        $prm = @{ Source = $Source; FlowRunId = ''; RunStartedUtc = ''; RunEndedUtc = ''; SolutionVersion = $SolutionVersion
|                  Grains = 'Detailed,Summary'; NeedCiBuild = '0'; AllowPartial = $(if ($AllowPartial) { '1' } else { '0' }); RefuseWhy = ''
|                  SnapshotKeepDays = $(if ($RetentionDays -gt 0) { $RetentionDays } elseif ([int]$global:SI_Pro_DataRetentionDays -gt 0) { [int]$global:SI_Pro_DataRetentionDays } else { 90 }) }
|        if ($Source -eq 'run') {
|            if (-not $State) { throw 'no run record' }
|            $el = Get-SIDataPublishEligibility -State $State -Map $Map -Previous $Previous
|            $prm.FlowRunId = [string]$State.FlowRunId
|            # a re-run that finishes the run before it: the run's own collection is looked for from THAT run's start
|            $prm.RunStartedUtc = Format-SIDataPublishTime $(if ($el.StartedUtc) { $el.StartedUtc } else { $State.StartedUtc })
|            if ($el.Eligible -and $el.ContinuesRunId) { & $Log 'INFO' ('this re-run finishes run {0} (every step before the re-run succeeded there): the two are published as one run' -f $el.ContinuesRunId) }
|            $prm.RunEndedUtc = Format-SIDataPublishTime $(if ($State.EndedUtc) { $State.EndedUtc } else { [datetime]::UtcNow })
|            if (-not $el.Eligible) {
|                $res.Skipped = $true; $res.Reason = $el.Why; $res.Text = Get-SIDataPublishText -Result $res
|                & $Log 'INFO' $res.Text
|                # a run of the WHOLE pipeline that did not end trusted is what the banner calls "the newest run did not
|                # complete": its reason is kept (a stage or a step run on its own is not a run of the data, and is not kept)
|                if (Test-SIDataPublishWholeRun -State $State) {
|                    $prm.RefuseWhy = $el.Why
|                    try { Write-SIDataPublishCopiesLine -Rows @(& $Invoke (Get-SIDataPublishSql) $prm 'rows') -Log $Log } catch { & $Log 'WARN' ('why this run is not shown could not be kept ({0})' -f $_.Exception.Message) }
|                    # #881 the shown run's copies caught up when they are older than it (range by range)
|                    $null = Invoke-SIPublishedCopyCatchUp -Invoke $Invoke -Log $Log -Beat $Beat
|                }
|                return $res
|            }
|            $prm.Grains = $el.Grains; $prm.NeedCiBuild = $(if ($el.NeedCiBuild) { '1' } else { '0' })
|        }
|        # the rows as one list, however the seam hands them back (one array, or one row after the other)
|        $rows = @(& $Invoke (Get-SIDataPublishSql) $prm 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })
|        if (-not $rows.Count) { throw 'the database answered no result' }
|        $r = $rows[0]
|        $val = { param($n) $v = $null; if ($r -is [System.Collections.IDictionary]) { if ($r.Contains($n)) { $v = $r[$n] } } elseif ($r.PSObject.Properties[$n]) { $v = $r.$n }; if ($v -is [System.DBNull]) { $null } else { $v } }
|        $bit = { param($x) ($x -eq $true) -or ([string]$x -in @('1', 'True', 'true')) }
|        $res.Published = & $bit (& $val 'Published')
|        $res.Reason = [string](& $val 'Reason')
|        $res.CollectionId = & $val 'CollectionId'
|        $res.CollectionTime = & $val 'CollectionTime'
|        $res.Partial = & $bit (& $val 'Partial')
|        # an attempt that did not publish caught up the shown run's copies when they were older than it: said (a data-health warning)
|        Write-SIDataPublishCopiesLine -Rows $rows -Log $Log
|        # #881 the copies follow the pointer range by range, right after it moved (CopiedAt only when every range is done); an
|        # attempt that did not publish catches up copies older than the shown run the same way
|        $null = Invoke-SIPublishedCopyCatchUp -Invoke $Invoke -Log $Log -AfterPublish:$res.Published -Beat $Beat
|        # 'schedules': nothing newer is the normal answer of most wake-ups -- not said ('update': nothing complete yet, the same)
|        if (($Source -in @('schedules', 'update')) -and -not $res.Published) { $res.Skipped = $true; $res.Text = ''; return $res }
|        $res.Text = Get-SIDataPublishText -Result $res
|        # #901 published with reports held at their last complete result: said as a WARNING, by name (never a silent publish)
|        & $Log $(if ($res.Published -and [string]$res.Reason -notmatch 'report\(s\) held at their last complete result') { 'INFO' } else { 'WARN' }) $res.Text
|        if ($res.Published) {
|            try { $null = & $Invoke (Get-SIDataPublishSnapshotPruneSql) @{ KeepDays = [string]$prm.SnapshotKeepDays } 'scalar' }
|            catch { & $Log 'WARN' ('the older executive-view copies were not removed this time ({0}) -- the next publish tries again' -f $_.Exception.Message) }
|        }
|    } catch {
|        $res.Published = $false
|        $res.Reason = ('it could not be published ({0}) -- the next trusted run publishes' -f $_.Exception.Message)
|        $res.Text = Get-SIDataPublishText -Result $res
|        & $Log 'WARN' $res.Text
|    }
|    $res
|}
'@ }
$__siSupportFiles['engine/_shared/SI-ProtectionScore.ps1'] = @{ Sha256 = 'ae4ea04e8c7392299d8fdcb1953a4d55f82560d07ab0e3d1e318775d86946496'; Text = @'
|# =====================================================================================================================
|# THE PROTECTION SCORE -- ONE engine function for both editions (#636, owner 2026-10-19).
|#
|# Owner, verbatim: "here i propose we define a new number which defines our ability to protect our assets. that is a % from
|# 0-100. a higher number is good" / "i think we need to have 2 views as both are accepted by mgmt: view 1 shows the raw
|# protection score where a new patch coming out yesterday impacts our score, as assets technically are vulnerable - the
|# other includes our lifecycle, which are under 'accepted risks' lifecycle process" / (on the old 0-100 KPI) "replace it with
|# the Protection score everywhere ... both editions, same core functionality".
|#
|#   IN SCOPE     the ACTIVE CIs that can carry findings: devices, identities (groups left out), cloud resources, public IPs
|#   GOOD         no open, non-exempted finding of a counted severity (SI_ProtectionScore_Severities: Very High, Critical, High)
|#   WEIGHT       the CI's tier (SI_ProtectionScore_TierWeights: 8, 4, 2, 1; unclassified = Tier 3)
|#   TECHNICAL    every such finding counts
|#   LIFECYCLE    "within accepted lifecycle": a finding younger than its asset type's grace does not count
|#                (SI_ProtectionScore_GraceDays_Device | _Identity | _CloudResource | _PublicIp, default 30 days)
|#   AGE          the first that is known: the fix's release (si_fix_release_date, else the 2nd Tuesday of the recommended
|#                update's month), the SOURCE's own first-seen (si_source_first_seen / si_source_first_detected), SI's first
|#                detection; none = the finding counts (conservative), and how many had none is told
|#
|# Community: Risk Analysis feeds the Detailed run's findings and its CI index through New- / Add- / Complete-SIProtectionTally
|# (no SQL). Pro: the data sync writes the same rules as SQL per collection (Get-SIKeyFigureProtectionSql); a test holds the two
|# to the same answer on one fixture. Community-safe: no Pro file, no module; PS 5.1 and 7.
|# =====================================================================================================================
|
|$script:SIProtectionTypes = [ordered]@{ device = 'Devices'; identity = 'Identities'; cloud_resource = 'Cloud resources'; public_ip = 'Public IPs' }
|$script:SIProtectionGroupTypes = @('group', 'security group', 'microsoft 365 group')
|$script:SIProtectionBasis = @(@(1, 'fix release'), @(2, 'source first seen'), @(3, 'SI first detected'), @(0, 'no date (counted)'))
|
|function Get-SIProtectionScoreSettings {
|    <#
|        PURE. The protection score's settings, from -Settings (a dictionary) or the globals: @{ Severities; Weights (Tier 0..3);
|        Grace = @{ device; identity; cloud_resource; public_ip } }. A missing or invalid value = the default.
|    #>
|    param($Settings)
|    $val = {
|        param($n)
|        if ($Settings -is [System.Collections.IDictionary]) { if ($Settings.Contains($n)) { return $Settings[$n] }; return $null }
|        Get-Variable -Scope Global -Name $n -ValueOnly -ErrorAction SilentlyContinue
|    }
|    $days = {
|        param($n, [int]$default = 30)
|        $x = 0; $v = & $val $n
|        if ($null -ne $v -and [int]::TryParse(([string]$v).Trim(), [ref]$x) -and $x -ge 0 -and $x -le 3650) { return $x }
|        $default
|    }
|    $w = @(8.0, 4.0, 2.0, 1.0)
|    $raw = [string](& $val 'SI_ProtectionScore_TierWeights')
|    if ($raw) {
|        $parts = @($raw -split '[,;\s]+' | Where-Object { $_ -ne '' })
|        $vals = New-Object System.Collections.Generic.List[double]
|        foreach ($p in $parts) { $d = 0.0; if ([double]::TryParse($p, [Globalization.NumberStyles]::Float, [Globalization.CultureInfo]::InvariantCulture, [ref]$d) -and $d -ge 0) { $vals.Add($d) } }
|        if ($parts.Count -eq 4 -and $vals.Count -eq 4) { $w = $vals.ToArray() }
|    }
|    $sev = @('Very High', 'Critical', 'High')
|    $rawSev = [string](& $val 'SI_ProtectionScore_Severities')
|    if ($rawSev) { $s = @($rawSev -split '[,;]' | ForEach-Object { $_.Trim() } | Where-Object { $_ }); if ($s.Count -gt 0) { $sev = $s } }
|    @{
|        Severities = $sev
|        Weights    = $w
|        Grace      = @{
|            device         = (& $days 'SI_ProtectionScore_GraceDays_Device')
|            identity       = (& $days 'SI_ProtectionScore_GraceDays_Identity')
|            cloud_resource = (& $days 'SI_ProtectionScore_GraceDays_CloudResource')
|            public_ip      = (& $days 'SI_ProtectionScore_GraceDays_PublicIp')
|        }
|        # #860 (owner 2026-10-21: "grace 0 for non-patch"): the grace of a finding WITHOUT a patch cycle (configuration,
|        # identity, Azure, attack paths -- Test-SIProtectionPatchFinding), per asset type; default 0 = it counts from day one
|        OtherGrace = @{
|            device         = (& $days 'SI_ProtectionScore_OtherGraceDays_Device' 0)
|            identity       = (& $days 'SI_ProtectionScore_OtherGraceDays_Identity' 0)
|            cloud_resource = (& $days 'SI_ProtectionScore_OtherGraceDays_CloudResource' 0)
|            public_ip      = (& $days 'SI_ProtectionScore_OtherGraceDays_PublicIp' 0)
|        }
|    }
|}
|
|function Test-SIProtectionPatchFinding {
|    <#
|        PURE. #860: whether a finding has a PATCH CYCLE -- a vulnerability with a vendor fix -- and so gets the accepted-lifecycle
|        grace (SI_ProtectionScore_GraceDays_*). The same test as the Pro SQL (Get-SIKeyFigureProtectionSql): the finding names
|        its fix -- a fix release date (si_fix_release_date), a recommended update (its name or its id), or a patch cycle a
|        source gave that is a cycle (In monthly cycle / Catch-up). Anything else -- a configuration, an identity or Azure
|        finding, an attack path, a CVE with no fix -- is not a patch: its grace is SI_ProtectionScore_OtherGraceDays_* (0).
|    #>
|    param($FixRelease, [string]$UpdateName, [string]$UpdateId, [string]$PatchCycle)
|    if ($null -ne (ConvertTo-SIProtectionDate $FixRelease)) { return $true }
|    if ("$UpdateName".Trim() -or "$UpdateId".Trim()) { return $true }
|    $c = "$PatchCycle".Trim().ToLowerInvariant()
|    $c.StartsWith('in monthly') -or $c.StartsWith('catch')
|}
|
|function ConvertTo-SIProtectionDate {
|    <# PURE. A date a row carries (datetime, ISO text, $null / blank / DBNull) as a UTC datetime, $null when none. #>
|    param($Value)
|    if ($null -eq $Value -or $Value -is [System.DBNull]) { return $null }
|    if ($Value -is [datetime]) { return $Value }
|    if ($Value -is [datetimeoffset]) { return $Value.UtcDateTime }
|    $s = ([string]$Value).Trim()
|    if (-not $s) { return $null }
|    $d = [datetime]::MinValue
|    if ([datetime]::TryParse($s, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal, [ref]$d)) { return $d }
|    $null
|}
|
|function New-SIProtectionTally {
|    <# The tally of one run / collection: -CollectionTime is "now" for the ages; -Settings as Get-SIProtectionScoreSettings reads them. #>
|    param([datetime]$CollectionTime = [datetime]::UtcNow, $Settings)
|    $cfg = Get-SIProtectionScoreSettings -Settings $Settings
|    $sevSet = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($s in $cfg.Severities) { [void]$sevSet.Add([string]$s) }
|    # the counted findings are COUNTED, never kept (owner 2026-10-22: "500,000 devices / millions of findings"): per age basis
|    # (0..3) the number of findings and the distinct CIs -- memory grows with the assets, not with the findings
|    $basisCis = @{}; foreach ($b in 0..3) { $basisCis[$b] = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::Ordinal) }
|    [pscustomobject]@{
|        CollectionTime = $CollectionTime
|        Settings       = $cfg
|        SevSet         = $sevSet
|        Assets         = @{}       # CI id (lower) -> @{ Type; Tier; W; Tech; Life }
|        BasisCount     = @{ 0 = 0L; 1 = 0L; 2 = 0L; 3 = 0L }
|        BasisCis       = $basisCis
|    }
|}
|
|function Add-SIProtectionAsset {
|    <#
|        One CI of the inventory. Out of scope (not added): inactive, a class without findings of its own, a group.
|        -Tier 0..3 or $null (unclassified = Tier 3's weight).
|    #>
|    param([Parameter(Mandatory)]$Tally, [string]$Id, [string]$Class, [string]$AssetType, $Tier, [bool]$Active = $true)
|    if (-not $Id -or -not $Active) { return }
|    $c = "$Class".Trim().ToLowerInvariant()
|    if (-not $script:SIProtectionTypes.Contains($c)) { return }
|    if ($script:SIProtectionGroupTypes -contains "$AssetType".Trim().ToLowerInvariant()) { return }
|    $t = $null; $ti = 0
|    if ($null -ne $Tier -and -not ($Tier -is [System.DBNull]) -and [int]::TryParse(([string]$Tier).Trim(), [ref]$ti) -and $ti -ge 0 -and $ti -le 3) { $t = $ti }
|    $w = $Tally.Settings.Weights[$(if ($null -eq $t) { 3 } else { $t })]
|    $Tally.Assets[$Id.Trim().ToLowerInvariant()] = @{ Class = $c; Type = $script:SIProtectionTypes[$c]; Tier = $(if ($null -eq $t) { 'Unclassified' } else { 'Tier ' + $t }); W = [double]$w; Tech = $false; Life = $false }
|}
|
|function Get-SIProtectionAge {
|    <#
|        PURE. The age basis of one finding: @{ Basis = 1 fix release | 2 source first seen | 3 SI first detected | 0 none; Date }.
|        -FixRelease wins; else the 2nd Tuesday of -UpdateName's month; then -SourceFirstSeen; then -FirstDetected.
|    #>
|    param($FixRelease, [string]$UpdateName, $SourceFirstSeen, $FirstDetected)
|    $d = ConvertTo-SIProtectionDate $FixRelease
|    if ($null -eq $d -and $UpdateName) {
|        if (-not (Get-Command -Name Get-SIPatchCycleMonth -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-PatchCycle.ps1') }
|        $m = Get-SIPatchCycleMonth -UpdateName $UpdateName
|        if ($null -ne $m) { $d = Get-SIPatchCycleRelease -Month $m }
|    }
|    if ($null -ne $d) { return @{ Basis = 1; Date = $d } }
|    $d = ConvertTo-SIProtectionDate $SourceFirstSeen
|    if ($null -ne $d) { return @{ Basis = 2; Date = $d } }
|    $d = ConvertTo-SIProtectionDate $FirstDetected
|    if ($null -ne $d) { return @{ Basis = 3; Date = $d } }
|    @{ Basis = 0; Date = $null }
|}
|
|function Add-SIProtectionFinding {
|    <#
|        One open finding. Not counted: a severity the settings do not count, an exempted one, one on a CI that is not in scope
|        (call Add-SIProtectionAsset for the inventory first). The age decides the lifecycle view.
|    #>
|    param([Parameter(Mandatory)]$Tally, [string]$CiId, [string]$Severity, [bool]$Exempted = $false,
|          $FixRelease, [string]$UpdateName, $SourceFirstSeen, $FirstDetected, [string]$UpdateId, [string]$PatchCycle)
|    if ($Exempted -or -not $CiId) { return }
|    if (-not $Tally.SevSet.Contains("$Severity".Trim())) { return }
|    $a = $Tally.Assets[$CiId.Trim().ToLowerInvariant()]
|    if ($null -eq $a) { return }
|    $age = Get-SIProtectionAge -FixRelease $FixRelease -UpdateName $UpdateName -SourceFirstSeen $SourceFirstSeen -FirstDetected $FirstDetected
|    $patch = Test-SIProtectionPatchFinding -FixRelease $FixRelease -UpdateName $UpdateName -UpdateId $UpdateId -PatchCycle $PatchCycle
|    $b = [int]$age.Basis
|    $Tally.BasisCount[$b] = [long]$Tally.BasisCount[$b] + 1
|    [void]$Tally.BasisCis[$b].Add($CiId.Trim().ToLowerInvariant())
|    $a.Tech = $true
|    # #860: only a patch finding gets the accepted-lifecycle grace; every other finding has its own (default 0)
|    $grace = $(if ($patch) { [int]$Tally.Settings.Grace[$a.Class] } else { [int]$Tally.Settings.OtherGrace[$a.Class] })
|    if ($null -eq $age.Date -or ($Tally.CollectionTime.Date - $age.Date.Date).Days -ge $grace) { $a.Life = $true }
|}
|
|function Add-SIProtectionRow {
|    <#
|        One Risk Analysis finding row (both editions read the same row): the CI (si_ci_id), the severity, the exemption,
|        the fix's release / the update's name, the source's first-seen, SI's first detection.
|    #>
|    param([Parameter(Mandatory)]$Tally, $Row)
|    if ($null -eq $Row) { return }
|    $g = {
|        param([string[]]$names)
|        foreach ($n in $names) {
|            $v = $null
|            if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($n)) { $v = $Row[$n] } }
|            elseif ($Row.PSObject.Properties[$n]) { $v = $Row.$n }
|            if ($null -ne $v -and -not ($v -is [System.DBNull]) -and "$v".Trim()) { return $v }
|        }
|        $null
|    }
|    Add-SIProtectionFinding -Tally $Tally -CiId ([string](& $g @('si_ci_id'))) -Severity ([string](& $g @('si_severity', 'SecuritySeverity', 'Severity'))) `
|        -Exempted ([bool](& $g @('SI_ExemptionId', 'si_exemption_id'))) -FixRelease (& $g @('si_fix_release_date')) `
|        -UpdateName ([string](& $g @('si_fix_recommended_update', 'RecommendedSecurityUpdate'))) `
|        -UpdateId ([string](& $g @('si_fix_recommended_update_id', 'RecommendedSecurityUpdateId'))) -PatchCycle ([string](& $g @('si_patch_cycle'))) `
|        -SourceFirstSeen (& $g @('si_source_first_seen', 'si_source_first_detected')) -FirstDetected (& $g @('si_first_detected', 'FirstDetected'))
|}
|
|function Complete-SIProtectionTally {
|    <#
|        PURE over the tally. The protection score in the shape the Pro key figures store it: Rows of
|        @{ Figure = technical | lifecycle | agebasis; Dim1 = asset type | (all) | age basis; Dim2 = tier | (all) | ''; Value; Assets; Total },
|        plus Technical / Lifecycle (the overall %, $null when no asset is in scope), Assets (in scope), NoDate, Findings.
|    #>
|    param([Parameter(Mandatory)]$Tally)
|    # ONE pass over the assets (never a pass per group): each asset adds its weight to its four cells -- (all) x (all), its type,
|    # its tier, its type x tier -- with how much of it is in good standing in each view
|    $cells = @{}
|    foreach ($a in $Tally.Assets.Values) {
|        foreach ($k in @(@('(all)', '(all)'), @($a.Type, '(all)'), @('(all)', $a.Tier), @($a.Type, $a.Tier))) {
|            $key = $k[0] + '|' + $k[1]
|            $c = $cells[$key]
|            if ($null -eq $c) { $c = @{ D1 = $k[0]; D2 = $k[1]; W = 0.0; N = 0; TechW = 0.0; TechN = 0; LifeW = 0.0; LifeN = 0 }; $cells[$key] = $c }
|            $c.W += $a.W; $c.N++
|            if (-not $a.Tech) { $c.TechW += $a.W; $c.TechN++ }
|            if (-not $a.Life) { $c.LifeW += $a.W; $c.LifeN++ }
|        }
|    }
|    $pctOf = { param($num, $den) if ($den -gt 0) { [Math]::Round(100.0 * $num / $den, 1, [MidpointRounding]::AwayFromZero) } else { $null } }
|    # the order of the rows: (all) first, then each type, each tier, each type x tier
|    $rank = { param($c) if ($c.D1 -eq '(all)' -and $c.D2 -eq '(all)') { 0 } elseif ($c.D2 -eq '(all)') { 1 } elseif ($c.D1 -eq '(all)') { 2 } else { 3 } }
|    $ordered = @($cells.Values | Sort-Object @{ Expression = { & $rank $_ } }, @{ Expression = { $_.D1 } }, @{ Expression = { $_.D2 } })
|    $rows = New-Object System.Collections.Generic.List[object]
|    foreach ($view in 'technical', 'lifecycle') {
|        foreach ($c in $ordered) {
|            $num = $(if ($view -eq 'technical') { $c.TechW } else { $c.LifeW }); $good = $(if ($view -eq 'technical') { $c.TechN } else { $c.LifeN })
|            $rows.Add([pscustomobject]@{ Figure = $view; Dim1 = $c.D1; Dim2 = $c.D2; Value = (& $pctOf $num $c.W); Assets = $good; Total = $c.N })
|        }
|    }
|    $counted = [long]0; foreach ($b in 0..3) { $counted += [long]$Tally.BasisCount[$b] }
|    foreach ($pair in $script:SIProtectionBasis) {
|        $b = [int]$pair[0]
|        $rows.Add([pscustomobject]@{ Figure = 'agebasis'; Dim1 = [string]$pair[1]; Dim2 = ''; Value = [double]$Tally.BasisCount[$b]; Assets = $Tally.BasisCis[$b].Count; Total = $counted })
|    }
|    $all = $cells['(all)|(all)']
|    $tech = $null; $life = $null; $techN = 0; $lifeN = 0; $n = 0
|    if ($null -ne $all) { $tech = & $pctOf $all.TechW $all.W; $life = & $pctOf $all.LifeW $all.W; $techN = $all.TechN; $lifeN = $all.LifeN; $n = $all.N }
|    [pscustomobject]@{
|        Technical = $tech; TechnicalGood = $techN
|        Lifecycle = $life; LifecycleGood = $lifeN
|        Assets    = $n
|        NoDate    = [long]$Tally.BasisCount[0]
|        Findings  = $counted
|        Grace     = $Tally.Settings.Grace
|        Weights   = $Tally.Settings.Weights
|        Rows      = $rows.ToArray()
|        Source    = 'tally'
|    }
|}
|
|function ConvertFrom-SIProtectionKeyFigures {
|    <#
|        PURE. THE STORED PROTECTION SCORE of one collection (Pro: sidata.KeyFigure, written by the data sync -- the numbers the web
|        app shows) in the shape Complete-SIProtectionTally answers, so the mail renders it with the SAME code and never computes a
|        score of its own (owner 2026-10-22: "one computation, never two that can differ"). -Rows: the collection's KeyFigure rows
|        of Block 'protection' (technical | lifecycle | agebasis) and Block 'headline' (protection_technical | protection_lifecycle),
|        as objects or dictionaries. Answers $null when the collection has no stored score yet; a stored score that is not
|        available (Available = 0) answers Lifecycle = $null and its Note -- the one plain reason the data sync stored.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), $Settings)
|    $v = {
|        param($r, [string]$n)
|        $x = $null
|        if ($r -is [System.Collections.IDictionary]) { if ($r.Contains($n)) { $x = $r[$n] } } elseif ($null -ne $r -and $r.PSObject.Properties[$n]) { $x = $r.$n }
|        if ($x -is [System.DBNull]) { $null } else { $x }
|    }
|    $rs = @($Rows | Where-Object { $null -ne $_ })
|    $head = { param($fig) @($rs | Where-Object { [string](& $v $_ 'Block') -eq 'headline' -and [string](& $v $_ 'Figure') -eq $fig }) | Select-Object -First 1 }
|    $hl = & $head 'protection_lifecycle'; $ht = & $head 'protection_technical'
|    if ($null -eq $hl -or $null -eq $ht) { return $null }
|    $cfg = Get-SIProtectionScoreSettings -Settings $Settings
|    $num = { param($x) if ($null -eq $x -or "$x" -eq '') { $null } else { [double]$x } }
|    $int = { param($x) if ($null -eq $x -or "$x" -eq '') { 0 } else { [long]$x } }
|    $available = [bool](& $v $hl 'Available') -and $null -ne (& $v $hl 'Value')
|    $prot = New-Object System.Collections.Generic.List[object]
|    foreach ($r in $rs) {
|        if ([string](& $v $r 'Block') -ne 'protection') { continue }
|        $f = [string](& $v $r 'Figure'); if ($f -notin 'technical', 'lifecycle', 'agebasis') { continue }
|        $prot.Add([pscustomobject]@{ Figure = $f; Dim1 = [string](& $v $r 'Dim1'); Dim2 = [string](& $v $r 'Dim2'); Value = (& $num (& $v $r 'Value')); Assets = (& $int (& $v $r 'Assets')); Total = (& $int (& $v $r 'Total')) })
|    }
|    $basis = @($prot | Where-Object { $_.Figure -eq 'agebasis' })
|    $noDate = @($basis | Where-Object { $_.Dim1 -eq 'no date (counted)' } | Select-Object -First 1)
|    [pscustomobject]@{
|        Technical = $(if ($available) { & $num (& $v $ht 'Value') } else { $null }); TechnicalGood = (& $int (& $v $ht 'Assets'))
|        Lifecycle = $(if ($available) { & $num (& $v $hl 'Value') } else { $null }); LifecycleGood = (& $int (& $v $hl 'Assets'))
|        Assets    = (& $int (& $v $hl 'Total'))
|        NoDate    = $(if ($noDate.Count) { [long]$noDate[0].Value } else { 0 })
|        Findings  = $(if ($basis.Count) { [long]$basis[0].Total } else { 0 })
|        Grace     = $cfg.Grace
|        Weights   = $cfg.Weights
|        Rows      = $prot.ToArray()
|        Source    = 'stored'
|        Note      = $(if ($available) { $null } else { $n = [string](& $v $hl 'Note'); if ($n.Trim()) { $n.Trim() } else { 'the stored figures of this run have no score' } })
|    }
|}
|
|function Get-SIProtectionBands {
|    <#
|        The Protection Score's bands, highest first: data-model\protection-score-bands.locked.json -- the ONE definition the web
|        app embeds a copy of (a test keeps the two equal). A missing or unreadable file = the same four bands built in.
|    #>
|    if ($script:SIProtectionBandsCache) { return $script:SIProtectionBandsCache }
|    $bands = $null
|    try {
|        $f = [System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'data-model', 'protection-score-bands.locked.json')
|        if (Test-Path -LiteralPath $f) { $bands = @((Get-Content -LiteralPath $f -Raw | ConvertFrom-Json).bands | ForEach-Object { [pscustomobject]@{ Name = [string]$_.name; Min = [double]$_.min; Tone = [string]$_.tone; Ink = [string]$_.ink } }) }
|    } catch { $bands = $null }
|    if (-not $bands -or $bands.Count -eq 0) {
|        $bands = @([pscustomobject]@{ Name = 'Very Good'; Min = 90; Tone = 'very-good'; Ink = '#1b5e20' }, [pscustomobject]@{ Name = 'Good'; Min = 75; Tone = 'good'; Ink = '#2e7d32' },
|                   [pscustomobject]@{ Name = 'Moderate'; Min = 50; Tone = 'moderate'; Ink = '#a14a00' }, [pscustomobject]@{ Name = 'At Risk'; Min = 0; Tone = 'at-risk'; Ink = '#c62828' })
|    }
|    $script:SIProtectionBandsCache = @($bands | Sort-Object Min -Descending)
|    $script:SIProtectionBandsCache
|}
|
|function Get-SIProtectionBand {
|    <# PURE (after the one read). The band of a 0-100 score: @{ Name; Tone; Ink (the mail colour) }; $null score = Unknown. #>
|    param($Score)
|    $unknown = [pscustomobject]@{ Name = 'Unknown'; Tone = 'unknown'; Ink = '#546e7a' }
|    if ($null -eq $Score -or "$Score" -eq '') { return $unknown }
|    $s = [double]$Score
|    foreach ($b in (Get-SIProtectionBands)) {
|        if ($s -ge $b.Min) {
|            $ink = '#333333'
|            if ($b.Ink) { $ink = $b.Ink }
|            return [pscustomobject]@{ Name = $b.Name; Tone = $b.Tone; Ink = $ink }
|        }
|    }
|    $unknown
|}
|
|function ConvertTo-SIProtectionMailHtml {
|    <#
|        PURE. The protection score as mail lines (the Risk Analysis mail; Community too): both views, the accepted lifecycle
|        first, and how many findings had no date. -Score: Complete-SIProtectionTally's or ConvertFrom-SIProtectionKeyFigures's
|        answer; without a score, ONE plain line says why (-Reason, else the score's own Note).
|    #>
|    param($Score, [string]$Reason)
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    if ($null -eq $Score -or $null -eq $Score.Lifecycle) {
|        return ('<p data-mail-protection="none" style="margin:0 0 12px 0;"><strong>Protection Score:</strong> {0}</p>' -f [System.Net.WebUtility]::HtmlEncode((Get-SIProtectionNoScoreText -Score $Score -Reason $Reason)))
|    }
|    $graceVals = @($Score.Grace.Values | Sort-Object -Unique)
|    $grace = $(if ($graceVals.Count -eq 1) { [string]::Format($inv, '{0} days', $graceVals[0]) } else { [string]::Format($inv, 'devices {0}, identities {1}, cloud resources {2}, public IPs {3} days', $Score.Grace.device, $Score.Grace.identity, $Score.Grace.cloud_resource, $Score.Grace.public_ip) })
|    $sb = New-Object System.Text.StringBuilder
|    $bl = Get-SIProtectionBand -Score $Score.Lifecycle; $bt = Get-SIProtectionBand -Score $Score.Technical
|    [void]$sb.Append('<div data-mail-protection="1" style="margin:0 0 12px 0;">')
|    # owner 2026-10-20: the two names, and each value in its band's words and colour (protection-score-bands.locked.json)
|    [void]$sb.Append([string]::Format($inv, '<p style="margin:0 0 4px 0;"><strong>Protection Score, within Accepted Lifecycle:</strong> <span data-band="{5}" style="color:{4};font-weight:700;">{0:0.0} % &middot; {3}</span> ({1:N0} of {2:N0} assets in good standing)</p>', $Score.Lifecycle, $Score.LifecycleGood, $Score.Assets, $bl.Name, $bl.Ink, $bl.Tone))
|    [void]$sb.Append([string]::Format($inv, '<p style="margin:0 0 4px 0;"><strong>Protection Score, Actual Risks:</strong> <span data-band="{5}" style="color:{4};font-weight:700;">{0:0.0} % &middot; {3}</span> ({1:N0} of {2:N0})</p>', $Score.Technical, $Score.TechnicalGood, $Score.Assets, $bt.Name, $bt.Ink, $bt.Tone))
|    [void]$sb.Append([string]::Format($inv, '<p style="margin:0;font-size:12px;color:#5a6a7a;">Higher is better. Good standing = no open Very High / High finding; tier-weighted. Accepted lifecycle: {0}. {1:N0} of {2:N0} counted findings had no usable date and count as open.</p>', $grace, $Score.NoDate, $Score.Findings))
|    [void]$sb.Append('</div>')
|    $sb.ToString()
|}
|
|# THE REASONS a mail has no score -- one plain sentence each (owner 2026-10-22: "the mail must say WHY in one plain line, never a misleading
|# line that the score comes later"). The mail prints "Protection Score: not shown for this run -- <reason>."
|$script:SIProtectionReasons = [ordered]@{
|    'no-cis'        = 'no CIs are stored yet, so no asset is in scope (the CIs are built from the collected data before Risk Analysis runs)'
|    'no-scope'      = 'no active asset is in scope (devices, identities, cloud resources and public IPs; groups are left out)'
|    'summary'       = 'it is in the Detailed report, which counts the findings of every asset'
|    'not-figured'   = 'the data sync has not computed this run''s figures; the web app''s Executive overview shows the last computed score'
|    'figures-failed'= 'the data sync could not compute this run''s figures; the web app''s Executive overview shows the last computed score'
|    'not-taken-in'  = 'the data sync did not take this run''s results in, so no score was computed for it'
|    'no-wait'       = 'it is computed by the data sync after this run, and this mail could not wait for it; the web app''s Executive overview shows it once computed'
|    # review B1 / S1 (2026-10-22)
|    'mail-not-ready'= 'the protection score is shown in SecurityInsight'
|    'not-computed'  = 'not computed for this run'
|}
|
|function Get-SIProtectionReason {
|    <# PURE. One reason sentence by its code (see above), with an optional detail in brackets ("... (the error)"). #>
|    param([Parameter(Mandatory)][string]$Code, [string]$Detail)
|    $t = [string]$script:SIProtectionReasons[$Code]
|    if (-not $t) { $t = $Code }
|    if ("$Detail".Trim()) { $t = $(if ($Code -eq 'not-computed') { '{0} -- {1}' } else { '{0} ({1})' }) -f $t, "$Detail".Trim().TrimEnd('.') }
|    $t
|}
|
|function Get-SIProtectionNoScoreText {
|    <# PURE. The text after "Protection Score:" when there is no score: -Reason, else the stored score's Note, else a plain default. #>
|    param($Score, [string]$Reason)
|    $why = "$Reason".Trim()
|    if (-not $why -and $null -ne $Score -and $Score.PSObject.Properties['Note'] -and "$($Score.Note)".Trim()) { $why = "$($Score.Note)".Trim() }
|    if (-not $why -and $null -ne $Score -and [long]$Score.Assets -eq 0) { $why = Get-SIProtectionReason 'no-scope' }
|    if (-not $why) { $why = 'no score was computed for this run' }
|    # review S1: 'not computed for this run -- <reason>' is said as it is
|    if ($why.StartsWith('not computed for this run')) { return ($why.TrimEnd('.') + '.') }
|    'not shown for this run -- ' + $why.TrimEnd('.') + '.'
|}
'@ }
$__siSupportFiles['engine/_shared/SI-PatchCycle.ps1'] = @{ Sha256 = '93f43943b8783dd204152ae73bcecfa8b94132dcc3aa439a5088ff667af0544c'; Text = @'
|#Requires -Version 5.1
|<#
|    THE PATCH CYCLE of a missing patch (#636, owner 2026-10-19: "we need a filter option, where we filter between 'being
|    fixed during monthly lifecycle' vs. 'catch-up older than 1 month'" / "make sure the emails are also adjusted to the new
|    conclusions, so we dont send wrong signals. include both angles with gaps vs. monthly lifecycle").
|
|    A raw count of missing CVEs overstates the work: one monthly cumulative update closes hundreds of CVEs per device.
|    Every place that shows missing patches shows the three groups side by side instead:
|      cycle    IN THE MONTHLY CYCLE -- the recommended update was released at most -CatchUpDays (SI_PatchCycle_CatchUpDays,
|               30) before the collection: the normal rollout, no action
|      catchup  CATCH-UP -- the update is older: these devices are behind; act on these
|      nofix    NO SINGLE UPDATE / NO FIX -- no recommended update (browsers, third-party software, configuration): fixed by
|               their own owner
|      unknown  an update whose month cannot be read from its name -- NOT CLASSIFIED (unknown cycle); every place that shows
|               the three groups also shows this one whenever it is above 0 (#906: never hide findings)
|    The finding's own si_patch_cycle wins when a source gives it ("In monthly cycle", "Catch-up (older than 1 month)", "No
|    fix available", "Unknown"). The release of an update is the 2nd Tuesday of the month its name says ("October 2026
|    Security Updates"). The SQL twin is the data sync's key figures (engine\pro-data\_shared\SI-DataKeyFigures.ps1,
|    Get-SIKeyFigurePatchesSql); a test holds the two equal. PURE throughout; Community and Pro alike (no SQL).
|#>
|
|$script:SIPatchCycleMonths = @{ january = 1; february = 2; march = 3; april = 4; may = 5; june = 6; july = 7; august = 8; september = 9; october = 10; november = 11; december = 12 }
|
|function Get-SIPatchCycleMonth {
|    <# PURE. The first day of the month an update's name says ("October 2026 Security Updates"), $null when it names none. #>
|    param([string]$UpdateName)
|    if (-not $UpdateName) { return $null }
|    $y = [regex]::Match($UpdateName, '20[0-9][0-9]')
|    if (-not $y.Success) { return $null }
|    $low = $UpdateName.ToLowerInvariant()
|    # the lowest month number whose name is in the text (the SQL twin: TOP (1) ... ORDER BY the month number)
|    $m = @($script:SIPatchCycleMonths.GetEnumerator() | Where-Object { $low.Contains($_.Key) } | Sort-Object Value | Select-Object -First 1)
|    if (-not $m.Count) { return $null }
|    [datetime]::new([int]$y.Value, [int]$m[0].Value, 1)
|}
|
|function Get-SIPatchCycleRelease {
|    <# PURE. The release of a month's updates: its 2nd Tuesday. #>
|    param([Parameter(Mandatory)][datetime]$Month)
|    $first = [datetime]::new($Month.Year, $Month.Month, 1)
|    $offset = (([int][DayOfWeek]::Tuesday) - [int]$first.DayOfWeek + 7) % 7
|    $first.AddDays(7 + $offset)
|}
|
|function Get-SIPatchCycle {
|    <# PURE. cycle | catchup | nofix | unknown for one missing patch (see above). #>
|    param([string]$Given, [string]$UpdateId, [string]$UpdateName, [Parameter(Mandatory)][datetime]$CollectionTime, [int]$CatchUpDays = 30)
|    $g = "$Given".Trim().ToLowerInvariant()
|    if ($g.StartsWith('in monthly')) { return 'cycle' }
|    if ($g.StartsWith('catch')) { return 'catchup' }
|    if ($g.StartsWith('no fix')) { return 'nofix' }
|    if ($g.StartsWith('unknown')) { return 'unknown' }
|    if (-not "$UpdateId".Trim() -and -not "$UpdateName".Trim()) { return 'nofix' }
|    $month = Get-SIPatchCycleMonth -UpdateName $UpdateName
|    if ($null -eq $month) { return 'unknown' }
|    $days = ($CollectionTime.Date - (Get-SIPatchCycleRelease -Month $month).Date).Days
|    if ($days -le $CatchUpDays) { return 'cycle' }
|    'catchup'
|}
|
|function New-SIPatchCycleTally {
|    <# A tally to add the rows of a run to, one at a time (the Risk Analysis KPI loop pages its rows). #>
|    param([datetime]$CollectionTime = [datetime]::UtcNow, [int]$CatchUpDays = 30)
|    [pscustomobject]@{
|        CollectionTime = $CollectionTime; CatchUpDays = $CatchUpDays; Findings = [long]0
|        Devices = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|        Groups = @{ cycle = [long]0; catchup = [long]0; nofix = [long]0; unknown = [long]0 }
|        GroupDevices = @{
|            cycle = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|            catchup = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|            nofix = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|            unknown = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|        }
|        CatchUpFixes = @{}
|        Cycles = @{}
|    }
|}
|
|function Get-SIPatchCycleRowValue {
|    <# PURE. The first of -Names that the row carries with a value ('' when none). #>
|    param($Row, [string[]]$Names)
|    foreach ($n in $Names) {
|        $v = $null
|        if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($n)) { $v = $Row[$n] } }
|        elseif ($null -ne $Row -and $Row.PSObject.Properties[$n]) { $v = $Row.$n }
|        if ($null -ne $v -and "$v".Trim()) { return "$v".Trim() }
|    }
|    ''
|}
|
|function Add-SIPatchCycleRow {
|    <# Adds one Risk Analysis row: a CVE finding only (its CVE id, else a configuration id that is one). Cheap for any other row. #>
|    param([Parameter(Mandatory)]$Tally, $Row)
|    if ($null -eq $Row) { return }
|    $cve = Get-SIPatchCycleRowValue $Row @('si_cve', 'Cve', 'CveId')
|    if (-not $cve) { $cfg = Get-SIPatchCycleRowValue $Row @('ConfigurationId'); if ($cfg -like 'CVE-*') { $cve = $cfg } }
|    if (-not $cve) { return }
|    $uid = Get-SIPatchCycleRowValue $Row @('si_fix_recommended_update_id', 'RecommendedSecurityUpdateId')
|    $upd = Get-SIPatchCycleRowValue $Row @('si_fix_recommended_update', 'RecommendedSecurityUpdate')
|    $key = "$uid|$upd"
|    if ($Tally.Cycles.ContainsKey($key) -and -not (Get-SIPatchCycleRowValue $Row @('si_patch_cycle'))) { $c = $Tally.Cycles[$key] }
|    else {
|        $c = Get-SIPatchCycle -Given (Get-SIPatchCycleRowValue $Row @('si_patch_cycle')) -UpdateId $uid -UpdateName $upd -CollectionTime $Tally.CollectionTime -CatchUpDays $Tally.CatchUpDays
|        if (-not (Get-SIPatchCycleRowValue $Row @('si_patch_cycle'))) { $Tally.Cycles[$key] = $c }
|    }
|    $dev = Get-SIPatchCycleRowValue $Row @('si_ci_id', 'SI_AssetId', 'AssetId', 'AssetName')
|    $Tally.Findings++
|    $Tally.Groups[$c]++
|    if ($dev) { [void]$Tally.Devices.Add($dev); [void]$Tally.GroupDevices[$c].Add($dev) }
|    if ($c -eq 'catchup' -and $uid) {
|        if (-not $Tally.CatchUpFixes.ContainsKey($uid)) {
|            $Tally.CatchUpFixes[$uid] = [pscustomobject]@{ Id = $uid; Name = $upd; Findings = [long]0; Devices = (New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)); Month = (Get-SIPatchCycleMonth -UpdateName $upd) }
|        }
|        $fx = $Tally.CatchUpFixes[$uid]; $fx.Findings++; if ($dev) { [void]$fx.Devices.Add($dev) }
|    }
|}
|
|function Complete-SIPatchCycleTally {
|    <#
|        PURE. The tally as plain numbers: Findings, Devices and per group (cycle, catchup, nofix, unknown) Findings, Devices
|        and Share (percent of the findings); the catch-up fixes oldest and largest first with how many months behind.
|    #>
|    param([Parameter(Mandatory)]$Tally)
|    $groups = foreach ($g in 'cycle', 'catchup', 'nofix', 'unknown') {
|        $n = [long]$Tally.Groups[$g]
|        [pscustomobject]@{ Code = $g; Findings = $n; Devices = [long]$Tally.GroupDevices[$g].Count
|                           Share = $(if ($Tally.Findings -gt 0) { [Math]::Round(100.0 * $n / $Tally.Findings, 1) } else { 0.0 }) }
|    }
|    $col = [datetime]::new($Tally.CollectionTime.Year, $Tally.CollectionTime.Month, 1)
|    $fixes = @($Tally.CatchUpFixes.Values | ForEach-Object {
|        $behind = $null; if ($null -ne $_.Month) { $behind = (($col.Year - $_.Month.Year) * 12) + $col.Month - $_.Month.Month }
|        [pscustomobject]@{ Id = $_.Id; Name = $_.Name; Findings = $_.Findings; Devices = [long]$_.Devices.Count; MonthsBehind = $behind }
|    } | Sort-Object @{ Expression = { if ($null -eq $_.MonthsBehind) { -1 } else { $_.MonthsBehind } }; Descending = $true }, @{ Expression = 'Findings'; Descending = $true })
|    [pscustomobject]@{ Findings = [long]$Tally.Findings; Devices = [long]$Tally.Devices.Count; CatchUpDays = $Tally.CatchUpDays; Groups = @($groups); CatchUpFixes = $fixes }
|}
|
|function ConvertTo-SIPatchCycleMailHtml {
|    <#
|        PURE. "Missing patches" in a mail (the one SI mail layout): the three groups side by side with their share and devices,
|        the total only after them, catch-up first in what to do, what catch-up means. '' when the run has no missing patch.
|    #>
|    param($Summary)
|    if ($null -eq $Summary -or [long]$Summary.Findings -le 0) { return '' }
|    if (-not (Get-Command -Name ConvertTo-SIMailHeadingHtml -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-MailLayout.ps1')) }
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $g = @{}; foreach ($x in @($Summary.Groups)) { $g[[string]$x.Code] = $x }
|    $line = { param($code) $x = $g[$code]; [string]::Format($inv, '<strong>{0:N0}</strong> findings on {1:N0} devices ({2:0.0} %)', $x.Findings, $x.Devices, $x.Share) }
|    $sb = New-Object System.Text.StringBuilder
|    [void]$sb.Append((ConvertTo-SIMailHeadingHtml 'Missing patches'))
|    [void]$sb.Append((ConvertTo-SIMailLineHtml -Topic '1. In monthly cycle' -Html ((& $line 'cycle') + ' &mdash; the normal rollout, no action')))
|    [void]$sb.Append((ConvertTo-SIMailLineHtml -Topic '2. Catch-up' -Html ((& $line 'catchup') + ' &mdash; the fix is older than the monthly cycle: <strong>act on these</strong>')))
|    [void]$sb.Append((ConvertTo-SIMailLineHtml -Topic '3. No single update / no fix' -Html ((& $line 'nofix') + ' &mdash; browsers, third-party software, configuration: who owns those updates?')))
|    # #906: never hide a finding -- the ones no group takes are said, with the same words as the Executive page
|    if ([long]$g['unknown'].Findings -gt 0) { [void]$sb.Append((ConvertTo-SIMailLineHtml -Topic 'Not classified (unknown cycle)' -Html ((& $line 'unknown') + ' &mdash; an update whose month cannot be read; counted in none of the three groups'))) }
|    [void]$sb.Append((ConvertTo-SIMailLineHtml -Topic 'All together' -Html ([string]::Format($inv, '{0:N0} findings on {1:N0} devices &mdash; one monthly cumulative update can close hundreds of CVEs per device: read the groups, not the total', $Summary.Findings, $Summary.Devices))))
|    $top = @($Summary.CatchUpFixes) | Select-Object -First 1
|    if ($top) {
|        $behind = if ($null -eq $top.MonthsBehind) { 'how far behind is not known' } elseif ($top.MonthsBehind -le 1) { '1 month behind' } else { "$($top.MonthsBehind) months behind" }
|        [void]$sb.Append((ConvertTo-SIMailLineHtml -Topic 'First: catch-up' -Html ([string]::Format($inv, 'start with KB{0} ({1}, {2}): {3:N0} findings on {4:N0} devices', ([string]$top.Id).TrimStart('K', 'B'), [System.Net.WebUtility]::HtmlEncode([string]$top.Name), $behind, $top.Findings, $top.Devices))))
|    }
|    $L = $script:SIMailLayout
|    [void]$sb.Append(('<p style="{0}font-size:12px;line-height:1.5;color:{1};margin:4px 0 14px 0;" data-mail-patch-scope>Catch-up = the recommended update was released more than {2} days before this run (SI_PatchCycle_CatchUpDays).</p>' -f $L.Font, $L.Muted, [int]$Summary.CatchUpDays))
|    $sb.ToString()
|}
'@ }
$__siSupportFiles['data-model/protection-score-bands.locked.json'] = @{ Sha256 = '20538637a68dd233d092ce968275c38d313fe817f5a3c1e716fdff29dbd47862'; Text = @'
|{
|  "version": 1,
|  "about": "The Protection Score's bands -- ONE definition, read by the engine (engine\\_shared\\SI-ProtectionScore.ps1 Get-SIProtectionBand: the mails, the Risk Analysis log line) and the web app (SI.Management.Core ProtectionBands: the score cards, the wall board, the Executive overview and report, the management mail). The score is 0-100, higher is better; a band is the first one, from the top, whose 'min' the score reaches. Tone is the web app's colour family (a score, not a risk: a good band may be green); ink is the colour the mails use on white (WCAG AA). The ranges are the engine's existing bands (mirroring Microsoft's Secure Score bands) -- to confirm with the owner (REQUIREMENTS #827). The web app embeds an exact copy (pro-management\\src\\SI.Management.Core\\ProData\\DataModel); a test keeps the two equal.",
|  "bands": [
|    { "name": "Very Good", "min": 90, "tone": "very-good", "ink": "#1b5e20" },
|    { "name": "Good", "min": 75, "tone": "good", "ink": "#2e7d32" },
|    { "name": "Moderate", "min": 50, "tone": "moderate", "ink": "#a14a00" },
|    { "name": "At Risk", "min": 0, "tone": "at-risk", "ink": "#c62828" }
|  ]
|}
'@ }
$__siSupportFiles['engine/pro-data/_shared/SI-DataKeyFigures.ps1'] = @{ Sha256 = '61f98790b7064d98e7fbb0b8cb9b18c8aedd6fb50625449115990817c2b774bd'; Text = @'
|#Requires -Version 7.0
|<#
|    SecurityInsight Pro -- THE KEY FIGURES (#636, owner 2026-10-19: "we need to have some core stats relevant for mgmt like
|    Missing patches (cve's) on windows vs. linux, servers vs clients and others" / "one could be report and other could be
|    click to see the stats with buttons of most interesting topics so they can click around").
|
|    ONE SOURCE for Overview > Executive overview (the topics to explore) AND Overview > Executive report (the page to read,
|    its PDF and the scheduled management mail): sidata.KeyFigure, one row per collection + block + figure + two dimensions,
|    written HERE once per collection by the data sync -- never computed per page load, so the two pages can never disagree.
|    "Change since the last report" is the same row of the collection before.
|
|    FROM WHAT (all stored tables; no Log Analytics read):
|      sidata.Finding        the collection's findings (open = not exempted): CVE, severity, tier, exploit, end of support,
|                            fix due date, the source's first-detected date
|      sidata.Ci (+ CiLink)  each finding's CI (the CI id, else the CI that carries the id as a linked object) and the CI's
|                            OS family (si_os_platform: windows / windows_server -> Windows, linux -> Linux, macos, ios,
|                            android), device type (si_asset_type: Server, Workstation, Mobile, IoT, Network device, else
|                            Other), class, lifecycle, onboarding, internet exposure, Azure VM / Defender agent, MFA, sign-in
|      sidata.CiFindingState the finding lifecycle: opened / fixed in the last N days and the mean time to fix (#859: every
|                            window is a setting, Get-SIKeyFigureWindowSettings)
|    A device / identity attribute is the CI's CURRENT one (the CI list is current state). A figure the data cannot answer
|    (no first-detected date, no due date, no MFA state ...) is written Available = 0 with the reason -- never as 0.
|    Never fails the data sync. No PowerShell module.
|#>
|
|$script:SIKeyFigureBlocks = @('headline', 'patching', 'exposure', 'coverage', 'identity', 'cloud')
|
|function Get-SIDataKeyFiguresSchemaCheckSql {
|    <# 1 when the database carries the table and every column the figures read; else 0. #>
|    $need = @("OBJECT_ID('sidata.KeyFigure')", "COL_LENGTH('sidata.Collection', 'KeyFiguresAt')", "COL_LENGTH('sidata.Collection', 'ContextAt')")
|    foreach ($c in 'Cve', 'Severity', 'Tier', 'HasExploit', 'EosStatus', 'FixDueDate', 'SourceFirstDetected', 'ExemptionId', 'AssetKey', 'FixRecommendedUpdate', 'FixRecommendedUpdateId', 'FixRemediation', 'AffectedProduct', 'AffectedVersion', 'AffectedSoftware', 'SecurityDomain', 'ReportName') { $need += "COL_LENGTH('sidata.Finding', '$c')" }
|    foreach ($c in 'Class', 'AssetType', 'OsPlatform', 'Lifecycle', 'LastSeen', 'OnboardingStatus', 'InternetExposed', 'AzureResourceType', 'MdeDeviceId',
|                   'AccountEnabled', 'MfaRegistered', 'LastSignIn', 'PrivilegedAccessCount', 'AzureSubscriptionName', 'AzureSubscriptionId', 'Tier') { $need += "COL_LENGTH('sidata.Ci', '$c')" }
|    $need += "OBJECT_ID('sidata.CiLink')"; $need += "OBJECT_ID('sidata.RiskExecView')"; $need += "OBJECT_ID('sidata.CiFindingState')"; $need += "COL_LENGTH('sidata.CiFindingState', 'CloseReason')"
|    'SELECT CASE WHEN ' + (($need | ForEach-Object { "$_ IS NOT NULL" }) -join ' AND ') + ' THEN 1 ELSE 0 END'
|}
|
|function Get-SIDataUnfiguredSql {
|    <#
|        Complete Detailed collections with their prepared context and no key figures (or figures older than the context),
|        among the -Newest complete ones only (#818, owner 2026-10-20: a run can be compared with the ones before it right after
|        an update -- the back-fill of runs synced before the figures existed is bounded, never every stored run). Newest first.
|        A run figured before the per-view finding counts existed (no protection / findings_lifecycle row, owner 2026-10-20) is
|        figured again -- in the same bounded set.
|    #>
|    param([int]$Newest = 4)
|    $live = ''; if (Get-Command -Name Get-SIDataLiveFilter -ErrorAction SilentlyContinue) { $live = Get-SIDataLiveFilter }
|    $n = [Math]::Max(1, $Newest)
|    "SELECT CollectionId, CollectionTime FROM sidata.Collection WHERE Kind = N'Detailed' AND Status = 'Complete' AND ContextAt IS NOT NULL" +
|    " AND (KeyFiguresAt IS NULL OR KeyFiguresAt < ContextAt OR NOT EXISTS (SELECT 1 FROM sidata.KeyFigure AS kx WHERE kx.CollectionId = sidata.Collection.CollectionId AND kx.Block = N'protection' AND kx.Figure = N'findings_lifecycle')" +
|    " OR NOT EXISTS (SELECT 1 FROM sidata.KeyFigure AS ka WHERE ka.CollectionId = sidata.Collection.CollectionId AND ka.Block = N'meta' AND ka.Figure = N'active_assets_only')" +
|    " OR NOT EXISTS (SELECT 1 FROM sidata.KeyFigure AS kg WHERE kg.CollectionId = sidata.Collection.CollectionId AND kg.Block = N'meta' AND kg.Figure = N'grace_by_kind')" +
|    # #855 W11: a run figured before the not-onboarded devices were split by status is figured again (bounded as above)
|    " OR NOT EXISTS (SELECT 1 FROM sidata.KeyFigure AS ko WHERE ko.CollectionId = sidata.Collection.CollectionId AND ko.Block = N'meta' AND ko.Figure = N'onboarding_by_status'))$live" +
|    " AND CollectionId IN (SELECT TOP ($n) n.CollectionId FROM sidata.Collection AS n WHERE n.Kind = N'Detailed' AND n.Status = 'Complete' ORDER BY n.CollectionTime DESC) ORDER BY CollectionTime DESC"
|}
|
|function Get-SIKeyFigureDomainSql {
|    <#
|        PURE. The security domain of a finding (alias f) as the Risk Analysis domain x severity table counts it
|        (Invoke-RiskAnalysis: SecurityDomain, PublicIp = PublicIP, else _DomainFromReportName on the report's name): Endpoint |
|        Identity | Azure | PublicIP | Other.
|    #>
|    "CASE WHEN NULLIF(LTRIM(RTRIM(f.SecurityDomain)), N'') IS NOT NULL THEN CASE LOWER(LTRIM(RTRIM(f.SecurityDomain))) WHEN N'endpoint' THEN N'Endpoint' WHEN N'identity' THEN N'Identity' WHEN N'azure' THEN N'Azure' WHEN N'publicip' THEN N'PublicIP' ELSE N'Other' END" +
|    " WHEN LOWER(f.ReportName) LIKE N'%public[_]ip[_]to[_]vm%' OR LOWER(f.ReportName) LIKE N'%device[_]with[_]high[_]severity[_]vulnerabilities%' THEN N'Endpoint'" +
|    " WHEN LOWER(f.ReportName) LIKE N'publicip[_]%' THEN N'PublicIP'" +
|    " WHEN LOWER(f.ReportName) LIKE N'device[_]%' OR LOWER(f.ReportName) LIKE N'endpoint[_]%' THEN N'Endpoint'" +
|    " WHEN LOWER(f.ReportName) LIKE N'identity[_]%' OR LOWER(f.ReportName) LIKE N'%credential[_]based[_]lateral[_]movement%' OR LOWER(f.ReportName) LIKE N'%identity[_]group[_]membership%' OR LOWER(f.ReportName) LIKE N'%data[_]sensitivity[_]to[_]exposed[_]credentials%' THEN N'Identity'" +
|    " WHEN LOWER(f.ReportName) LIKE N'azure[_]%' OR LOWER(f.ReportName) LIKE N'%github[_]to[_]azure%' OR LOWER(f.ReportName) LIKE N'%to[_]azure[_]resources%' THEN N'Azure'" +
|    " ELSE N'Other' END"
|}
|
|function Get-SIKeyFigureOsFamilySql {
|    <# PURE. The OS family of a CI (alias c) from si_os_platform. #>
|    "CASE LOWER(c.OsPlatform) WHEN N'windows' THEN N'Windows' WHEN N'windows_server' THEN N'Windows' WHEN N'linux' THEN N'Linux' WHEN N'macos' THEN N'macOS' WHEN N'ios' THEN N'iOS' WHEN N'android' THEN N'Android' WHEN N'other' THEN N'Other' ELSE N'Unknown' END"
|}
|
|function Get-SIKeyFigureDeviceTypeSql {
|    <# PURE. The device type of a CI (alias c) from si_asset_type (a Windows server platform without a type counts as a server). #>
|    "CASE WHEN c.AssetType = N'Server' OR (c.AssetType IS NULL AND LOWER(c.OsPlatform) = N'windows_server') THEN N'Server' WHEN c.AssetType = N'Workstation' THEN N'Workstation' WHEN c.AssetType = N'Mobile' THEN N'Mobile' WHEN c.AssetType = N'IoT' THEN N'IoT' WHEN c.AssetType = N'Network device' THEN N'Network device' ELSE N'Other' END"
|}
|
|function Get-SIKeyFigurePatchesSql {
|    <#
|        PURE. The topic "Missing patches & findings" (owner 2026-10-19: "is it possible to detail the windows more into the sub
|        categories like os, browser, etc so i can figure out what is happening. what patches are missing" / "with the
|        breakdown to show fx CVEs but also all security findings like this" / "we need a filter option, where we filter
|        between 'being fixed during monthly lifecycle' vs. 'catch-up older than 1 month'"): over the open findings on ACTIVE
|        DEVICES, with CVEs only (mode cve) and with every security finding (mode all), and for each PATCH CYCLE (cyc): all |
|        cycle (in the monthly cycle) | catchup (catch-up, the fix is older than -CatchUpDays) | nofix (no fix available) |
|        unknown -- Block 'patches', figure '<what>_<mode>_<cyc>':
|          matrix    Dim1 OS family ('(all)' = every), Dim2 Server | Client | Other ('(all)'): findings, devices, distinct CVEs /
|                    recommendations (Items), Very High findings; Total = the findings of that mode and cycle (a share)
|          component Dim1 the component (si_component), Dim2 Server | Client | Other | '(all)'
|          software  Dim1 the affected software (product + version), the 50 with the most findings
|          fix       Dim1 the recommended update's id, Dim2 its name (the 50 that close the most); a finding without an update
|                    id is grouped by its remediation text under Dim1 '(no single update)'. Servers / Clients = the devices of
|                    each; Note = how far behind: current | 1 month behind | 2+ months behind | not known (the update's month,
|                    from its name, against the collection's month)
|          fixlag    Dim1 that months-behind split
|          devices   Dim1 the CI id, Dim2 its name: the 50 devices with the most findings of that cycle (Note = Server | Client | Other)
|        and 'cycle_<mode>': Dim1 the cycle -- findings and devices (the two headline numbers side by side).
|        THE PATCH CYCLE: the finding's si_patch_cycle when its source gives one ("In monthly cycle", "Catch-up (older than 1
|        month)", "No fix available", "Unknown"); else: no recommended update = no single update (browsers, third-party
|        software, configuration: fixed by their own owner); an update whose month is known
|        = in the cycle while its release (the 2nd Tuesday of its month) is at most -CatchUpDays before the collection, else
|        catch-up; anything else unknown.
|        Needs #fd / #d / #kf of Get-SIDataKeyFiguresSql (and @t).
|    #>
|    param([int]$CatchUpDays = 30)
|    @"
|CREATE TABLE #pm (Mode VARCHAR(3) NOT NULL, Cyc VARCHAR(8) NOT NULL, CiId NVARCHAR(64) COLLATE DATABASE_DEFAULT NOT NULL, Fam NVARCHAR(16) NOT NULL, Dc NVARCHAR(8) NOT NULL, Cls CHAR(2) NOT NULL,
|                  Rec NVARCHAR(256) COLLATE DATABASE_DEFAULT NULL, Comp NVARCHAR(64) COLLATE DATABASE_DEFAULT NOT NULL, Soft NVARCHAR(200) COLLATE DATABASE_DEFAULT NULL,
|                  FixKey NVARCHAR(200) COLLATE DATABASE_DEFAULT NOT NULL, FixName NVARCHAR(120) COLLATE DATABASE_DEFAULT NOT NULL, Lag NVARCHAR(24) NOT NULL);
|WITH x AS (
|    SELECT fd.*, d.Fam, CASE d.Typ WHEN N'Server' THEN N'Server' WHEN N'Workstation' THEN N'Client' ELSE N'Other' END AS Dc,
|           -- the 2nd Tuesday of the update's month: its release (Patch Tuesday)
|           CASE WHEN fd.FixMonth IS NULL THEN NULL
|                ELSE DATEADD(day, 7 + ((1 - (DATEDIFF(day, '19000101', fd.FixMonth) % 7) + 7) % 7), fd.FixMonth) END AS Released,
|           LOWER(fd.Cycle) AS Given
|    FROM #fd AS fd JOIN #d AS d ON d.CiId = fd.CiId
|    WHERE d.Class = N'device' AND d.Active = 1
|), y AS (
|    SELECT x.*, CASE WHEN x.Given LIKE N'in monthly%' THEN 'cycle' WHEN x.Given LIKE N'catch%' THEN 'catchup' WHEN x.Given LIKE N'no fix%' THEN 'nofix' WHEN x.Given LIKE N'unknown%' THEN 'unknown'
|                     WHEN x.FixId IS NULL AND x.FixName IS NULL THEN 'nofix'
|                     WHEN x.Released IS NOT NULL AND DATEDIFF(day, x.Released, @t) <= $CatchUpDays THEN 'cycle'
|                     WHEN x.Released IS NOT NULL THEN 'catchup'
|                     ELSE 'unknown' END AS Own
|    FROM x
|)
|INSERT #pm
|SELECT m.Mode, c.Cyc, y.CiId, y.Fam, y.Dc, y.Cls, y.Rec, ISNULL(y.Comp, N'Other'), y.Soft,
|       COALESCE(y.FixId, N'(no single update)'), LEFT(COALESCE(CASE WHEN y.FixId IS NOT NULL THEN COALESCE(y.FixName, N'Security update ' + y.FixId) END, y.Remedy, N'(no remediation given)'), 120),
|       CASE WHEN y.FixMonth IS NULL THEN N'not known'
|            WHEN DATEDIFF(month, y.FixMonth, DATEFROMPARTS(YEAR(@t), MONTH(@t), 1)) <= 0 THEN N'current'
|            WHEN DATEDIFF(month, y.FixMonth, DATEFROMPARTS(YEAR(@t), MONTH(@t), 1)) = 1 THEN N'1 month behind'
|            ELSE N'2+ months behind' END
|FROM y
|CROSS JOIN (VALUES ('cve'), ('all')) AS m (Mode)
|CROSS APPLY (VALUES ('all'), (y.Own)) AS c (Cyc)
|WHERE m.Mode = 'all' OR y.Cve IS NOT NULL;
|CREATE TABLE #pt (Mode VARCHAR(3) NOT NULL, Cyc VARCHAR(8) NOT NULL, N INT NOT NULL, PRIMARY KEY (Mode, Cyc));
|INSERT #pt SELECT v.Mode, w.Cyc, ISNULL((SELECT COUNT(*) FROM #pm AS p WHERE p.Mode = v.Mode AND p.Cyc = w.Cyc), 0)
|FROM (VALUES ('cve'), ('all')) AS v (Mode) CROSS JOIN (VALUES ('all'), ('cycle'), ('catchup'), ('nofix'), ('unknown')) AS w (Cyc);
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note, Items, VeryHigh, Servers, Clients)
|SELECT N'patches', N'cycle_' + p.Mode, p.Cyc, N'', COUNT(*), COUNT(DISTINCT p.CiId), t.N, 1, NULL, COUNT(DISTINCT p.Rec), SUM(CASE WHEN p.Cls = 'vh' THEN 1 ELSE 0 END),
|       COUNT(DISTINCT CASE WHEN p.Dc = N'Server' THEN p.CiId END), COUNT(DISTINCT CASE WHEN p.Dc = N'Client' THEN p.CiId END)
|FROM #pm AS p JOIN #pt AS t ON t.Mode = p.Mode AND t.Cyc = 'all' WHERE p.Cyc <> 'all' GROUP BY p.Mode, p.Cyc, t.N;
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note, Items, VeryHigh, Servers, Clients)
|SELECT N'patches', N'matrix_' + g.Mode + N'_' + g.Cyc, g.Fam, g.Dc, g.N, g.Devices, t.N, 1, NULL, g.Items, g.Vh, g.Servers, g.Clients
|FROM (SELECT p.Mode, p.Cyc, CASE WHEN GROUPING(p.Fam) = 1 THEN N'(all)' ELSE p.Fam END AS Fam, CASE WHEN GROUPING(p.Dc) = 1 THEN N'(all)' ELSE p.Dc END AS Dc,
|             COUNT(*) AS N, COUNT(DISTINCT p.CiId) AS Devices, COUNT(DISTINCT p.Rec) AS Items, SUM(CASE WHEN p.Cls = 'vh' THEN 1 ELSE 0 END) AS Vh,
|             COUNT(DISTINCT CASE WHEN p.Dc = N'Server' THEN p.CiId END) AS Servers, COUNT(DISTINCT CASE WHEN p.Dc = N'Client' THEN p.CiId END) AS Clients
|      FROM #pm AS p GROUP BY GROUPING SETS ((p.Mode, p.Cyc, p.Fam, p.Dc), (p.Mode, p.Cyc, p.Fam), (p.Mode, p.Cyc, p.Dc), (p.Mode, p.Cyc))) AS g
|JOIN #pt AS t ON t.Mode = g.Mode AND t.Cyc = g.Cyc;
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note, Items, VeryHigh, Servers, Clients)
|SELECT N'patches', N'component_' + g.Mode + N'_' + g.Cyc, g.Comp, g.Dc, g.N, g.Devices, t.N, 1, NULL, g.Items, g.Vh, NULL, NULL
|FROM (SELECT p.Mode, p.Cyc, p.Comp, CASE WHEN GROUPING(p.Dc) = 1 THEN N'(all)' ELSE p.Dc END AS Dc, COUNT(*) AS N, COUNT(DISTINCT p.CiId) AS Devices,
|             COUNT(DISTINCT p.Rec) AS Items, SUM(CASE WHEN p.Cls = 'vh' THEN 1 ELSE 0 END) AS Vh
|      FROM #pm AS p GROUP BY GROUPING SETS ((p.Mode, p.Cyc, p.Comp, p.Dc), (p.Mode, p.Cyc, p.Comp))) AS g
|JOIN #pt AS t ON t.Mode = g.Mode AND t.Cyc = g.Cyc;
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note, Items, VeryHigh, Servers, Clients)
|SELECT N'patches', N'software_' + s.Mode + N'_' + s.Cyc, s.Soft, N'', s.N, s.Devices, t.N, 1, NULL, s.Items, s.Vh, s.Servers, s.Clients
|FROM (SELECT p.Mode, p.Cyc, p.Soft, COUNT(*) AS N, COUNT(DISTINCT p.CiId) AS Devices, COUNT(DISTINCT p.Rec) AS Items, SUM(CASE WHEN p.Cls = 'vh' THEN 1 ELSE 0 END) AS Vh,
|             COUNT(DISTINCT CASE WHEN p.Dc = N'Server' THEN p.CiId END) AS Servers, COUNT(DISTINCT CASE WHEN p.Dc = N'Client' THEN p.CiId END) AS Clients,
|             ROW_NUMBER() OVER (PARTITION BY p.Mode, p.Cyc ORDER BY COUNT(*) DESC, p.Soft) AS Rn
|      FROM #pm AS p WHERE p.Soft IS NOT NULL GROUP BY p.Mode, p.Cyc, p.Soft) AS s
|JOIN #pt AS t ON t.Mode = s.Mode AND t.Cyc = s.Cyc WHERE s.Rn <= 50;
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note, Items, VeryHigh, Servers, Clients)
|SELECT N'patches', N'fix_' + s.Mode + N'_' + s.Cyc, s.FixKey, s.FixName, s.N, s.Devices, t.N, 1, s.Lag, s.Items, s.Vh, s.Servers, s.Clients
|FROM (SELECT p.Mode, p.Cyc, p.FixKey, p.FixName, MAX(p.Lag) AS Lag, COUNT(*) AS N, COUNT(DISTINCT p.CiId) AS Devices, COUNT(DISTINCT p.Rec) AS Items,
|             SUM(CASE WHEN p.Cls = 'vh' THEN 1 ELSE 0 END) AS Vh,
|             COUNT(DISTINCT CASE WHEN p.Dc = N'Server' THEN p.CiId END) AS Servers, COUNT(DISTINCT CASE WHEN p.Dc = N'Client' THEN p.CiId END) AS Clients,
|             ROW_NUMBER() OVER (PARTITION BY p.Mode, p.Cyc ORDER BY COUNT(*) DESC, p.FixKey, p.FixName) AS Rn
|      FROM #pm AS p GROUP BY p.Mode, p.Cyc, p.FixKey, p.FixName) AS s
|JOIN #pt AS t ON t.Mode = s.Mode AND t.Cyc = s.Cyc WHERE s.Rn <= 50;
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note, Items, VeryHigh, Servers, Clients)
|SELECT N'patches', N'fixlag_' + p.Mode + N'_' + p.Cyc, p.Lag, N'', COUNT(*), COUNT(DISTINCT p.CiId), t.N, 1, NULL, COUNT(DISTINCT CASE WHEN p.FixKey <> N'(no single update)' THEN p.FixKey END),
|       SUM(CASE WHEN p.Cls = 'vh' THEN 1 ELSE 0 END), COUNT(DISTINCT CASE WHEN p.Dc = N'Server' THEN p.CiId END), COUNT(DISTINCT CASE WHEN p.Dc = N'Client' THEN p.CiId END)
|FROM #pm AS p JOIN #pt AS t ON t.Mode = p.Mode AND t.Cyc = p.Cyc WHERE p.FixKey <> N'(no single update)' GROUP BY p.Mode, p.Cyc, p.Lag, t.N;
|-- the devices that carry the most of each cycle (the devices behind, the single machines far behind): Dim1 the CI id, Dim2
|-- its name, Items = the distinct updates / software, Servers = 1 when it is a server; the 50 with the most findings
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note, Items, VeryHigh, Servers, Clients)
|SELECT N'patches', N'devices_' + s.Mode + N'_' + s.Cyc, s.CiId, LEFT(ISNULL(d.Name, s.CiId), 120), s.N, 1, t.N, 1, s.Dc, s.Items, s.Vh,
|       CASE WHEN s.Dc = N'Server' THEN 1 ELSE 0 END, CASE WHEN s.Dc = N'Client' THEN 1 ELSE 0 END
|FROM (SELECT p.Mode, p.Cyc, p.CiId, MAX(p.Dc) AS Dc, COUNT(*) AS N, COUNT(DISTINCT COALESCE(NULLIF(p.FixKey, N'(no single update)'), p.Soft)) AS Items,
|             SUM(CASE WHEN p.Cls = 'vh' THEN 1 ELSE 0 END) AS Vh, ROW_NUMBER() OVER (PARTITION BY p.Mode, p.Cyc ORDER BY COUNT(*) DESC, p.CiId) AS Rn
|      FROM #pm AS p GROUP BY p.Mode, p.Cyc, p.CiId) AS s
|JOIN #pt AS t ON t.Mode = s.Mode AND t.Cyc = s.Cyc
|LEFT JOIN #d AS d ON d.CiId = s.CiId
|WHERE s.Rn <= 50;
|"@
|}
|function Get-SIKeyFigureProtectionSql {
|    <#
|        PURE. THE PROTECTION SCORE (#636, owner 2026-10-19: "here i propose we define a new number which defines our ability to
|        protect our assets. that is a % from 0-100. a higher number is good" / "i think we need to have 2 views as both are
|        accepted by mgmt: view 1 shows the raw protection score where a new patch coming out yesterday impacts our score ...
|        the other includes our lifecycle, which are under 'accepted risks' lifecycle process"):
|          the share of the in-scope ACTIVE CIs (devices, identities but groups, cloud resources, public IPs) in GOOD STANDING
|          -- no open, non-exempted finding of a counted severity (@Sevs, default Very High / Critical / High) -- each CI
|          weighted by its tier (@W0..@W3, default 8 / 4 / 2 / 1; unclassified = @W3). Two views:
|            technical  every such finding counts
|            lifecycle  "within accepted lifecycle": a finding younger than its asset type's grace (@GraceDevice,
|                       @GraceIdentity, @GraceCloud, @GracePublicIp; SI_ProtectionScore_GraceDays_*, default 30) does not count
|                       -- #860 (owner 2026-10-21: "grace 0 for non-patch"): that grace is for a PATCH finding only (a
|                       vulnerability with a vendor fix: a fix release date, a recommended update -- its name or id -- or a
|                       source's patch cycle In monthly cycle / Catch-up; Test-SIProtectionPatchFinding is the engine's twin).
|                       Every other finding (configuration, identity, Azure, attack paths) has its own grace per asset type
|                       (@OtherGraceDevice ...; SI_ProtectionScore_OtherGraceDays_*, default 0 = it counts from day one)
|          THE AGE of a finding, the first that is known: the fix's release (si_fix_release_date, else the 2nd Tuesday of the
|          update's month), the source's own first-seen (sidata.Finding.SourceFirstDetected), SI's first detection (the finding
|          lifecycle: "first seen by SecurityInsight on <date>", the dates kept in the basis row's Note); no date = it COUNTS
|          (a risk with no first-seen date) -- and how many had no date is stored ('no date (counted)').
|        Block 'protection': figure technical | lifecycle, Dim1 Devices | Identities | Cloud resources | Public IPs | (all),
|        Dim2 Tier 0..3 | Unclassified | (all): Value = the %, Assets = CIs in good standing, Total = CIs in scope; 'agebasis'
|        Dim1 = where the age came from; and the headline twins headline / protection_technical, protection_lifecycle.
|        The findings of each view (owner 2026-10-20, the wall board's domain x severity table follows the view chosen):
|        figure findings_technical | findings_lifecycle, Dim1 Endpoint | Identity | Azure | PublicIP | Other | (all), Dim2
|        Critical | High | Medium | Low | Other | (all): Value = the findings the view counts, Total = every open finding there.
|        Needs #f / #m / #d of Get-SIDataKeyFiguresSql (and @t).
|    #>
|    # #860: a PATCH finding (alias f of #f) -- the engine's twin is Test-SIProtectionPatchFinding (SI-ProtectionScore.ps1)
|    $patch = "CASE WHEN f.FixRelease IS NOT NULL OR f.FixId IS NOT NULL OR f.FixName IS NOT NULL OR LOWER(f.Cycle) LIKE N'in monthly%' OR LOWER(f.Cycle) LIKE N'catch%' THEN 1 ELSE 0 END"
|    $graceOf = "CASE d.Class WHEN N'device' THEN @pgDev WHEN N'identity' THEN @pgId WHEN N'cloud_resource' THEN @pgCloud ELSE @pgIp END"
|    $otherOf = "CASE d.Class WHEN N'device' THEN @ogDev WHEN N'identity' THEN @ogId WHEN N'cloud_resource' THEN @ogCloud ELSE @ogIp END"
|    @"
|DECLARE @pw0 float = TRY_CONVERT(float, @W0), @pw1 float = TRY_CONVERT(float, @W1), @pw2 float = TRY_CONVERT(float, @W2), @pw3 float = TRY_CONVERT(float, @W3),
|        @pgDev int = TRY_CONVERT(int, @GraceDevice), @pgId int = TRY_CONVERT(int, @GraceIdentity), @pgCloud int = TRY_CONVERT(int, @GraceCloud), @pgIp int = TRY_CONVERT(int, @GracePublicIp),
|        @ogDev int = TRY_CONVERT(int, @OtherGraceDevice), @ogId int = TRY_CONVERT(int, @OtherGraceIdentity), @ogCloud int = TRY_CONVERT(int, @OtherGraceCloud), @ogIp int = TRY_CONVERT(int, @OtherGracePublicIp);
|CREATE TABLE #pf (CiId NVARCHAR(64) COLLATE DATABASE_DEFAULT NOT NULL, AgeDate DATETIME2(3) NULL, Basis TINYINT NOT NULL, Patch BIT NOT NULL);
|INSERT #pf (CiId, AgeDate, Basis, Patch)
|SELECT m.CiId, COALESCE(f.FixRelease, r.Released, f.First, s.FirstDetected),
|       CASE WHEN f.FixRelease IS NOT NULL OR r.Released IS NOT NULL THEN 1 WHEN f.First IS NOT NULL THEN 2 WHEN s.FirstDetected IS NOT NULL THEN 3 ELSE 0 END,
|       $patch
|FROM #f AS f
|JOIN #m AS m ON m.AssetKey = f.AssetKey AND m.CiId IS NOT NULL
|CROSS APPLY (SELECT CASE WHEN f.FixMonth IS NULL THEN NULL ELSE DATEADD(day, 7 + ((1 - (DATEDIFF(day, '19000101', f.FixMonth) % 7) + 7) % 7), CONVERT(datetime2(3), f.FixMonth)) END AS Released) AS r
|OUTER APPLY (SELECT MIN(st.FirstDetected) AS FirstDetected FROM sidata.CiFindingState AS st WHERE st.OwnerKey = m.CiId AND st.FindingKey IN (f.Rec, f.Cve) AND st.State <> N'closed') AS s
|WHERE f.Sev IN (SELECT LTRIM(RTRIM(v.[value])) FROM OPENJSON(@Sevs) AS v);
|CREATE INDEX IX_pf ON #pf (CiId);
|CREATE TABLE #pc (CiId NVARCHAR(64) COLLATE DATABASE_DEFAULT NOT NULL PRIMARY KEY, TypeName NVARCHAR(24) NOT NULL, TierName NVARCHAR(16) NOT NULL, W FLOAT NOT NULL,
|                  BadTech BIT NOT NULL, BadLife BIT NOT NULL);
|INSERT #pc
|SELECT d.CiId,
|       CASE d.Class WHEN N'device' THEN N'Devices' WHEN N'identity' THEN N'Identities' WHEN N'cloud_resource' THEN N'Cloud resources' ELSE N'Public IPs' END,
|       CASE d.Tier WHEN 0 THEN N'Tier 0' WHEN 1 THEN N'Tier 1' WHEN 2 THEN N'Tier 2' WHEN 3 THEN N'Tier 3' ELSE N'Unclassified' END,
|       CONVERT(float, CASE d.Tier WHEN 0 THEN @pw0 WHEN 1 THEN @pw1 WHEN 2 THEN @pw2 ELSE @pw3 END),
|       CASE WHEN EXISTS (SELECT 1 FROM #pf AS p WHERE p.CiId = d.CiId) THEN 1 ELSE 0 END,
|       CASE WHEN EXISTS (SELECT 1 FROM #pf AS p WHERE p.CiId = d.CiId
|                         AND (p.AgeDate IS NULL OR DATEDIFF(day, p.AgeDate, @t) >= CASE WHEN p.Patch = 1 THEN $graceOf ELSE $otherOf END)) THEN 1 ELSE 0 END
|FROM #d AS d
|WHERE d.Active = 1 AND d.Class IN (N'device', N'identity', N'cloud_resource', N'public_ip') AND ISNULL(d.AssetType, N'') NOT IN (N'Group', N'Security group', N'Microsoft 365 group');
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note)
|SELECT N'protection', v.Fig, CASE WHEN GROUPING(c.TypeName) = 1 THEN N'(all)' ELSE c.TypeName END, CASE WHEN GROUPING(c.TierName) = 1 THEN N'(all)' ELSE c.TierName END,
|       ROUND(100.0 * SUM(CASE WHEN (v.Fig = N'technical' AND c.BadTech = 0) OR (v.Fig = N'lifecycle' AND c.BadLife = 0) THEN c.W ELSE 0 END) / NULLIF(SUM(c.W), 0), 1),
|       SUM(CASE WHEN (v.Fig = N'technical' AND c.BadTech = 0) OR (v.Fig = N'lifecycle' AND c.BadLife = 0) THEN 1 ELSE 0 END), COUNT(*), 1, NULL
|FROM #pc AS c CROSS JOIN (VALUES (N'technical'), (N'lifecycle')) AS v (Fig)
|GROUP BY GROUPING SETS ((v.Fig, c.TypeName, c.TierName), (v.Fig, c.TypeName), (v.Fig, c.TierName), (v.Fig));
|-- the figure's name from the view list, never from the joined row: a collection with NO active asset in scope has no
|-- protection row to join, and its two headline rows still say so (Available = 0, the reason) -- the mail prints that line
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note)
|SELECT N'headline', N'protection_' + f.Fig, N'', N'', k.Value, k.Assets, ISNULL(k.Total, 0), CASE WHEN k.Total > 0 THEN 1 ELSE 0 END,
|       CASE WHEN k.Total IS NULL OR k.Total = 0 THEN N'no active asset is in scope yet' END
|FROM (VALUES (N'technical'), (N'lifecycle')) AS f (Fig)
|LEFT JOIN #kf AS k ON k.Block = N'protection' AND k.Figure = f.Fig AND k.Dim1 = N'(all)' AND k.Dim2 = N'(all)';
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note)
|SELECT N'protection', N'agebasis', b.Name, N'', COUNT(p.CiId), COUNT(DISTINCT p.CiId), (SELECT COUNT(*) FROM #pf AS q WHERE q.CiId IN (SELECT CiId FROM #pc)), 1,
|       -- #860 (b): "first seen by SecurityInsight on <date>" -- the first and the last such date, for the page to say
|       CASE WHEN b.Basis = 3 AND COUNT(p.CiId) > 0 THEN CONVERT(nvarchar(10), MIN(p.AgeDate), 23) + N'|' + CONVERT(nvarchar(10), MAX(p.AgeDate), 23) END
|FROM (VALUES (1, N'fix release'), (2, N'source first seen'), (3, N'SI first detected'), (0, N'no date (counted)')) AS b (Basis, Name)
|LEFT JOIN #pf AS p ON p.Basis = b.Basis AND p.CiId IN (SELECT c.CiId FROM #pc AS c)
|GROUP BY b.Basis, b.Name;
|-- the FINDINGS of each view by domain x severity (owner 2026-10-20: "the toggle is also confusing as it just flips the 2
|-- numbers around, but the numbers below doesnt chg"): findings_technical = every open finding of the run; findings_lifecycle =
|-- the ones the lifecycle view counts -- on an active in-scope CI and past its asset type's grace (no date = it counts)
|CREATE TABLE #pg (Dom NVARCHAR(16) NOT NULL, SevB NVARCHAR(16) NOT NULL, Life BIT NOT NULL);
|INSERT #pg (Dom, SevB, Life)
|SELECT f.Dom,
|       CASE WHEN f.Sev IN (N'Very High', N'Critical') THEN N'Critical' WHEN f.Sev IN (N'High', N'Medium-High', N'MediumHigh') THEN N'High'
|            WHEN f.Sev = N'Medium' THEN N'Medium' WHEN f.Sev = N'Low' THEN N'Low' ELSE N'Other' END,
|       CASE WHEN d.CiId IS NULL THEN 0
|            WHEN a.AgeDate IS NULL THEN 1
|            WHEN DATEDIFF(day, a.AgeDate, @t) >= CASE WHEN $patch = 1 THEN $graceOf ELSE $otherOf END THEN 1
|            ELSE 0 END
|FROM #f AS f
|LEFT JOIN #m AS m ON m.AssetKey = f.AssetKey
|LEFT JOIN #d AS d ON d.CiId = m.CiId AND d.Active = 1 AND d.Class IN (N'device', N'identity', N'cloud_resource', N'public_ip')
|                 AND ISNULL(d.AssetType, N'') NOT IN (N'Group', N'Security group', N'Microsoft 365 group')
|CROSS APPLY (SELECT CASE WHEN f.FixMonth IS NULL THEN NULL ELSE DATEADD(day, 7 + ((1 - (DATEDIFF(day, '19000101', f.FixMonth) % 7) + 7) % 7), CONVERT(datetime2(3), f.FixMonth)) END AS Released) AS r
|-- SI's first detection only when the finding carries no other date (the same order as #pf)
|OUTER APPLY (SELECT MIN(st.FirstDetected) AS FirstDetected FROM sidata.CiFindingState AS st
|             WHERE d.CiId IS NOT NULL AND f.FixRelease IS NULL AND r.Released IS NULL AND f.First IS NULL
|               AND st.OwnerKey = d.CiId AND st.FindingKey IN (f.Rec, f.Cve) AND st.State <> N'closed') AS s
|CROSS APPLY (SELECT COALESCE(f.FixRelease, r.Released, f.First, s.FirstDetected) AS AgeDate) AS a;
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note)
|SELECT N'protection', v.Fig, CASE WHEN GROUPING(g.Dom) = 1 THEN N'(all)' ELSE g.Dom END, CASE WHEN GROUPING(g.SevB) = 1 THEN N'(all)' ELSE g.SevB END,
|       SUM(CASE WHEN v.Fig = N'findings_technical' OR g.Life = 1 THEN 1 ELSE 0 END), NULL, COUNT(*), 1, NULL
|FROM #pg AS g CROSS JOIN (VALUES (N'findings_technical'), (N'findings_lifecycle')) AS v (Fig)
|GROUP BY GROUPING SETS ((v.Fig, g.Dom, g.SevB), (v.Fig, g.Dom), (v.Fig, g.SevB), (v.Fig));
|-- a run with no open finding still has its two (all) rows (0), so the page shows 0s, never "not computed"
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note)
|SELECT N'protection', v.Fig, N'(all)', N'(all)', 0, NULL, 0, 1, NULL
|FROM (VALUES (N'findings_technical'), (N'findings_lifecycle')) AS v (Fig)
|WHERE NOT EXISTS (SELECT 1 FROM #pg);
|"@
|}
|function Get-SIDataKeyFiguresSql {
|    <#
|        ONE collection (@CollectionId): every figure into #kf, then the collection's sidata.KeyFigure rows replaced and
|        Collection.KeyFiguresAt stamped in one transaction. Answers the number of figure rows. -CatchUpDays: the patch cycle's
|        threshold (SI_PatchCycle_CatchUpDays, default 30).
|    #>
|    param([int]$CatchUpDays = 30)
|    $fam = Get-SIKeyFigureOsFamilySql
|    $dom = Get-SIKeyFigureDomainSql
|    $protection = Get-SIKeyFigureProtectionSql
|    $typ = Get-SIKeyFigureDeviceTypeSql
|    $patches = Get-SIKeyFigurePatchesSql -CatchUpDays $CatchUpDays
|    @"
|SET NOCOUNT ON;
|SET XACT_ABORT ON;
|DECLARE @c int = CONVERT(int, @CollectionId);
|DECLARE @t datetime2(3) = (SELECT CollectionTime FROM sidata.Collection WHERE CollectionId = @c);
|-- #859: every window is the install's setting (Get-SIKeyFigureWindowSettings; never a literal here): opened / fixed in the
|-- last N days, the mean time to fix over the last N days, privileged accounts without a sign-in for N days, the CVE age bands
|DECLARE @kfRecent int = CONVERT(int, @RecentDays), @kfMttr int = CONVERT(int, @MttrDays), @kfStale int = CONVERT(int, @StaleAdminDays);
|DECLARE @kfLo bigint = 0, @kfHi bigint = 9223372036854775807;
|-- SI:STEP setup
|CREATE TABLE #ageBand (Dim NVARCHAR(40) NOT NULL, Days INT NOT NULL);
|INSERT #ageBand (Dim, Days) SELECT DISTINCT N'older than ' + CONVERT(nvarchar(10), b.Days) + N' days', b.Days
|FROM (SELECT TRY_CONVERT(int, v.[value]) AS Days FROM OPENJSON(@CveAgeBands) AS v) AS b WHERE b.Days > 0;
|CREATE TABLE #kf (Block NVARCHAR(16) NOT NULL, Figure NVARCHAR(48) NOT NULL, Dim1 NVARCHAR(200) NOT NULL, Dim2 NVARCHAR(120) NOT NULL,
|                  Value FLOAT NULL, Assets INT NULL, Total INT NULL, Available BIT NOT NULL, Note NVARCHAR(400) NULL,
|                  Items INT NULL, VeryHigh INT NULL, Servers INT NULL, Clients INT NULL);
|-- the collection's OPEN findings (not exempted), narrow; severity as a class: vh = Very High / Critical, h = High
|CREATE TABLE #f (AssetKey NVARCHAR(400) COLLATE DATABASE_DEFAULT NULL, Cve NVARCHAR(100) COLLATE DATABASE_DEFAULT NULL, Sev NVARCHAR(30) NULL, Cls CHAR(2) NOT NULL,
|                 Tier TINYINT NULL, Exploit BIT NOT NULL, Eos BIT NOT NULL, Due DATETIME2(3) NULL, First DATETIME2(3) NULL,
|                 Rec NVARCHAR(256) COLLATE DATABASE_DEFAULT NULL, Comp NVARCHAR(64) COLLATE DATABASE_DEFAULT NULL, Soft NVARCHAR(200) COLLATE DATABASE_DEFAULT NULL,
|                 FixId NVARCHAR(200) COLLATE DATABASE_DEFAULT NULL, FixName NVARCHAR(120) COLLATE DATABASE_DEFAULT NULL, Remedy NVARCHAR(120) COLLATE DATABASE_DEFAULT NULL, FixMonth DATE NULL, Cycle NVARCHAR(40) COLLATE DATABASE_DEFAULT NULL,
|                 FixRelease DATETIME2(3) NULL, Dom NVARCHAR(16) NOT NULL);
|-- SI:STEP findings
|-- (one key range of the collection's findings at a time when run in steps: @kfLo < FindingId <= @kfHi, a clustered-key seek)
|INSERT #f
|SELECT f.AssetKey, NULLIF(f.Cve, N''), f.Severity,
|       CASE WHEN f.Severity IN (N'Very High', N'Critical') THEN 'vh' WHEN f.Severity = N'High' THEN 'h' ELSE 'o' END,
|       f.Tier, ISNULL(f.HasExploit, 0), CASE WHEN f.EosStatus LIKE N'EOS%' THEN 1 ELSE 0 END, f.FixDueDate, f.SourceFirstDetected,
|       LEFT(COALESCE(NULLIF(f.Cve, N''), NULLIF(f.ConfigurationId, N''), f.Title), 256),
|       -- the component (si_component: OS, Browser, Application, Office, SQL, Network, Hardware, Other), read once per finding
|       COALESCE(CASE WHEN f.DetailJson IS NOT NULL AND ISJSON(f.DetailJson) = 1 THEN NULLIF(LEFT(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.si_component'))), 64), N'') END, N'Other'),
|       LEFT(NULLIF(LTRIM(RTRIM(COALESCE(NULLIF(LTRIM(RTRIM(f.AffectedProduct)), N'') + COALESCE(N' ' + NULLIF(LTRIM(RTRIM(f.AffectedVersion)), N''), N''), f.AffectedSoftware))), N''), 200),
|       LEFT(NULLIF(LTRIM(RTRIM(f.FixRecommendedUpdateId)), N''), 200), LEFT(NULLIF(LTRIM(RTRIM(f.FixRecommendedUpdate)), N''), 120),
|       LEFT(NULLIF(LTRIM(RTRIM(f.FixRemediation)), N''), 120),
|       -- the month of the recommended update, from its name ("October 2026 Security Updates"); none = not known
|       (SELECT TOP (1) DATEFROMPARTS(TRY_CONVERT(int, SUBSTRING(f.FixRecommendedUpdate, PATINDEX(N'%20[0-9][0-9]%', f.FixRecommendedUpdate), 4)), mo.N, 1)
|        FROM (VALUES (N'January', 1), (N'February', 2), (N'March', 3), (N'April', 4), (N'May', 5), (N'June', 6), (N'July', 7), (N'August', 8), (N'September', 9),
|                     (N'October', 10), (N'November', 11), (N'December', 12)) AS mo (Name, N)
|        WHERE f.FixRecommendedUpdate LIKE N'%' + mo.Name + N'%' AND PATINDEX(N'%20[0-9][0-9]%', f.FixRecommendedUpdate) > 0 ORDER BY mo.N),
|       -- the patch cycle a source gave the finding (si_patch_cycle), else worked out below from the update's month
|       CASE WHEN f.DetailJson IS NOT NULL AND ISJSON(f.DetailJson) = 1 THEN NULLIF(LEFT(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.si_patch_cycle'))), 40), N'') END,
|       -- the fix's release date a source gives (si_fix_release_date), the protection score's first age basis
|       CASE WHEN f.DetailJson IS NOT NULL AND ISJSON(f.DetailJson) = 1 THEN TRY_CONVERT(datetime2(3), LEFT(JSON_VALUE(f.DetailJson, '$.si_fix_release_date'), 23), 126) END,
|       $dom
|FROM sidata.Finding AS f WHERE f.CollectionId = @c AND f.FindingId > @kfLo AND f.FindingId <= @kfHi AND f.ExemptionId IS NULL;
|-- SI:STEP assets
|-- each finding's CI: the CI id itself, else the CI that carries the id as a linked object (built ONCE per distinct asset)
|-- #860 (d) THE COMPOSITE KEY FORMS, resolved the way the CI list resolves an asset key (CiViews.CiOfAsset: the CI id, else the
|-- CI that links the id, else an 'az:' key by its ARM id) plus the forms the Risk Analysis reports write:
|--   'tenantid=<t>;objectid=<o>' (the identity / attack-path reports) -> the Entra object id <o>: the CI that links it, else
|--                                   the CI whose record carries it as AadObjectId (sidata.RecordIdentifier)
|--   '<prefix>/subscriptions/...[;...]' (an ARM id inside a composite key) -> that ARM id
|-- One alternative key per DISTINCT asset key (Alt), then index seeks (IX_CiLink_Native, IX_RecordIdentifier_Id) -- set-based.
|CREATE TABLE #m (AssetKey NVARCHAR(400) COLLATE DATABASE_DEFAULT NOT NULL PRIMARY KEY, CiId NVARCHAR(64) COLLATE DATABASE_DEFAULT NULL,
|                 Alt NVARCHAR(450) COLLATE DATABASE_DEFAULT NULL, Oid NVARCHAR(36) COLLATE DATABASE_DEFAULT NULL);
|INSERT #m (AssetKey, CiId, Alt, Oid)
|SELECT a.AssetKey, COALESCE(ci.CiId, lk.CiId), x.Alt, x.Oid
|FROM (SELECT DISTINCT AssetKey FROM #f WHERE AssetKey IS NOT NULL) AS a
|CROSS APPLY (SELECT LOWER(a.AssetKey) AS K, CHARINDEX(N'objectid=', LOWER(a.AssetKey)) AS O, CHARINDEX(N'/subscriptions/', LOWER(a.AssetKey)) AS S) AS k
|CROSS APPLY (SELECT CASE WHEN k.O > 0 AND TRY_CONVERT(uniqueidentifier, SUBSTRING(k.K, k.O + 9, 36)) IS NOT NULL THEN SUBSTRING(k.K, k.O + 9, 36) END AS Oid,
|                    CASE WHEN k.K LIKE N'az:%' THEN SUBSTRING(k.K, 4, 450)
|                         WHEN k.S > 1 THEN LEFT(SUBSTRING(k.K, k.S, 450), CHARINDEX(N';', SUBSTRING(k.K, k.S, 450) + N';') - 1) END AS Arm) AS y
|CROSS APPLY (SELECT y.Oid, COALESCE(y.Oid, y.Arm) AS Alt) AS x
|LEFT JOIN sidata.Ci AS ci ON LEN(a.AssetKey) <= 64 AND ci.CiId = a.AssetKey
|OUTER APPLY (SELECT TOP (1) l.CiId FROM sidata.CiLink AS l WHERE ci.CiId IS NULL AND LEN(a.AssetKey) <= 450 AND l.NativeId = LOWER(a.AssetKey) ORDER BY l.IsPrimary DESC, l.LastSeen DESC) AS lk;
|UPDATE m SET CiId = lk.CiId
|FROM #m AS m
|CROSS APPLY (SELECT TOP (1) l.CiId FROM sidata.CiLink AS l WHERE l.NativeId = m.Alt ORDER BY l.IsPrimary DESC, l.LastSeen DESC) AS lk
|WHERE m.CiId IS NULL AND m.Alt IS NOT NULL;
|IF OBJECT_ID('sidata.RecordIdentifier') IS NOT NULL AND OBJECT_ID('sidata.CiRecord') IS NOT NULL
|    UPDATE m SET CiId = r.CiId
|    FROM #m AS m
|    CROSS APPLY (SELECT TOP (1) cr.CiId FROM sidata.RecordIdentifier AS ri JOIN sidata.CiRecord AS cr ON cr.RecordKey = ri.RecordKey
|                 WHERE ri.IdType = N'AadObjectId' AND ri.IdValue = m.Oid AND cr.CiId IS NOT NULL ORDER BY cr.CollectionTime DESC) AS r
|    WHERE m.CiId IS NULL AND m.Oid IS NOT NULL;
|-- the CIs with their dimensions
|CREATE TABLE #d (CiId NVARCHAR(64) COLLATE DATABASE_DEFAULT NOT NULL PRIMARY KEY, Class NVARCHAR(16) NULL, Fam NVARCHAR(16) NOT NULL, Typ NVARCHAR(32) NOT NULL,
|                 Active BIT NOT NULL, Tier TINYINT NULL, Internet BIT NOT NULL, Onboarded NVARCHAR(32) NULL, NotSeen BIT NOT NULL, AzureVm BIT NOT NULL, HasMde BIT NOT NULL,
|                 AssetType NVARCHAR(128) NULL, Enabled BIT NULL, Mfa BIT NULL, LastSignIn DATETIME2(3) NULL, Privileged BIT NOT NULL, Sub NVARCHAR(400) NULL, Name NVARCHAR(400) NULL);
|INSERT #d
|SELECT c.CiId, c.Class, $fam, $typ,
|       CASE WHEN ISNULL(c.Lifecycle, N'active') = N'active' THEN 1 ELSE 0 END, c.Tier, ISNULL(c.InternetExposed, 0), LOWER(c.OnboardingStatus),
|       CASE WHEN c.Lifecycle = N'not_seen' THEN 1 ELSE 0 END,
|       CASE WHEN LOWER(c.AzureResourceType) = N'microsoft.compute/virtualmachines' THEN 1 ELSE 0 END, CASE WHEN NULLIF(c.MdeDeviceId, N'') IS NULL THEN 0 ELSE 1 END,
|       c.AssetType, c.AccountEnabled, c.MfaRegistered, c.LastSignIn, CASE WHEN c.Tier = 0 OR ISNULL(c.PrivilegedAccessCount, 0) > 0 THEN 1 ELSE 0 END,
|       COALESCE(NULLIF(c.AzureSubscriptionName, N''), NULLIF(c.AzureSubscriptionId, N'')), c.Name
|FROM sidata.Ci AS c WHERE ISNULL(c.Lifecycle, N'active') <> N'retired';
|-- #855 (owner 2026-10-21: "we need to be able to trust all data" / "default filter is active, so it should be active only"):
|-- every figure counts the findings of ACTIVE assets only -- a finding on a CI that is not seen or retired is left out here,
|-- once, before any figure reads #f. A finding no CI carries stays (its asset is not known to be gone).
|DELETE f FROM #f AS f JOIN #m AS m ON m.AssetKey = f.AssetKey
|WHERE m.CiId IS NOT NULL AND NOT EXISTS (SELECT 1 FROM #d AS d WHERE d.CiId = m.CiId AND d.Active = 1);
|CREATE TABLE #fd (CiId NVARCHAR(64) COLLATE DATABASE_DEFAULT NOT NULL, Cve NVARCHAR(100) COLLATE DATABASE_DEFAULT NULL, Cls CHAR(2) NOT NULL, Tier TINYINT NULL, Exploit BIT NOT NULL, Eos BIT NOT NULL,
|                  Rec NVARCHAR(256) COLLATE DATABASE_DEFAULT NULL, Comp NVARCHAR(64) COLLATE DATABASE_DEFAULT NULL, Soft NVARCHAR(200) COLLATE DATABASE_DEFAULT NULL,
|                  FixId NVARCHAR(200) COLLATE DATABASE_DEFAULT NULL, FixName NVARCHAR(120) COLLATE DATABASE_DEFAULT NULL, Remedy NVARCHAR(120) COLLATE DATABASE_DEFAULT NULL, FixMonth DATE NULL, Cycle NVARCHAR(40) COLLATE DATABASE_DEFAULT NULL);
|INSERT #fd SELECT m.CiId, f.Cve, f.Cls, f.Tier, f.Exploit, f.Eos, f.Rec, f.Comp, f.Soft, f.FixId, f.FixName, f.Remedy, f.FixMonth, f.Cycle FROM #f AS f JOIN #m AS m ON m.AssetKey = f.AssetKey WHERE m.CiId IS NOT NULL;
|CREATE INDEX IX_fd ON #fd (CiId);
|
|-- SI:STEP figures
|-- ==== (0) HEADLINE ================================================================================================
|-- the Risk Analysis KPI (0-100) of the run behind this collection (the kept Risk Analysis view) -- kept per collection for its own
|-- trend. It is NOT the protection score (owner 2026-10-19: the 0-100 management number is the protection score, below); a run
|-- that kept no view is not available, never 0
|DECLARE @score float = (SELECT TOP (1) TRY_CONVERT(float, JSON_VALUE(v.PayloadJson, '$.Kpi.GlobalScore')) FROM sidata.RiskExecView AS v
|                        WHERE v.CollectionTime = @t AND ISJSON(v.PayloadJson) = 1 ORDER BY CASE v.Grain WHEN N'Detailed' THEN 0 ELSE 1 END);
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) VALUES (N'headline', N'ra_kpi', N'', N'', @score, NULL, NULL, CASE WHEN @score IS NULL THEN 0 ELSE 1 END,
|                   CASE WHEN @score IS NULL THEN N'the Risk Analysis run of this collection kept no KPI' END);
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'headline', N'open_findings', N'', N'', COUNT_BIG(*), COUNT(DISTINCT AssetKey), NULL, 1, NULL FROM #f;
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'headline', N'very_high_high', N'', N'', SUM(CASE WHEN Cls IN ('vh', 'h') THEN 1 ELSE 0 END), COUNT(DISTINCT CASE WHEN Cls IN ('vh', 'h') THEN AssetKey END), COUNT(DISTINCT AssetKey), 1, NULL FROM #f;
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'headline', N'known_exploited', N'', N'', COUNT(DISTINCT CASE WHEN Exploit = 1 THEN Cve END), COUNT(DISTINCT CASE WHEN Exploit = 1 AND Cve IS NOT NULL THEN AssetKey END), NULL, 1, NULL FROM #f;
|
|-- ==== (1) PATCHING ================================================================================================
|-- missing patches (open CVE findings) and the devices they are on, per OS family x device type, with every total
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note)
|SELECT N'patching', N'missing_patches', CASE WHEN GROUPING(d.Fam) = 1 THEN N'(all)' ELSE d.Fam END, CASE WHEN GROUPING(d.Typ) = 1 THEN N'(all)' ELSE d.Typ END,
|       COUNT(x.Cve), COUNT(DISTINCT CASE WHEN x.Cve IS NOT NULL THEN d.CiId END), COUNT(DISTINCT d.CiId), 1, NULL
|FROM #d AS d LEFT JOIN #fd AS x ON x.CiId = d.CiId AND x.Cve IS NOT NULL
|WHERE d.Class = N'device' AND d.Active = 1
|GROUP BY GROUPING SETS ((d.Fam, d.Typ), (d.Fam), (d.Typ), ());
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note)
|SELECT N'patching', N'very_high_cve_devices', CASE WHEN GROUPING(d.Fam) = 1 THEN N'(all)' ELSE d.Fam END, CASE WHEN GROUPING(d.Typ) = 1 THEN N'(all)' ELSE d.Typ END,
|       COUNT(x.Cve), COUNT(DISTINCT CASE WHEN x.Cve IS NOT NULL THEN d.CiId END), COUNT(DISTINCT d.CiId), 1, NULL
|FROM #d AS d LEFT JOIN #fd AS x ON x.CiId = d.CiId AND x.Cve IS NOT NULL AND x.Cls = 'vh'
|WHERE d.Class = N'device' AND d.Active = 1
|GROUP BY GROUPING SETS ((d.Fam, d.Typ), (d.Fam), (d.Typ), ());
|-- known-exploited CVEs open: how many CVEs, on how many devices, and on how many servers
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'patching', N'known_exploited', N'', N'', COUNT(DISTINCT x.Cve), COUNT(DISTINCT x.CiId), (SELECT COUNT(*) FROM #d WHERE Class = N'device' AND Active = 1), 1, NULL
|FROM #fd AS x WHERE x.Exploit = 1 AND x.Cve IS NOT NULL;
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'patching', N'known_exploited_servers', N'', N'', COUNT(DISTINCT x.Cve), COUNT(DISTINCT x.CiId), (SELECT COUNT(*) FROM #d WHERE Class = N'device' AND Active = 1 AND Typ = N'Server'), 1, NULL
|FROM #fd AS x JOIN #d AS d ON d.CiId = x.CiId WHERE x.Exploit = 1 AND x.Cve IS NOT NULL AND d.Typ = N'Server';
|-- age of open CVE findings (the source's first-detected date)
|IF EXISTS (SELECT 1 FROM #f WHERE Cve IS NOT NULL AND First IS NOT NULL)
|    INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'patching', N'cve_age', a.Dim, N'', SUM(CASE WHEN f.First < DATEADD(day, -a.Days, @t) THEN 1 ELSE 0 END),
|                      COUNT(DISTINCT CASE WHEN f.First < DATEADD(day, -a.Days, @t) THEN f.AssetKey END), COUNT(*), 1, NULL
|    FROM #f AS f CROSS JOIN #ageBand AS a
|    WHERE f.Cve IS NOT NULL GROUP BY a.Dim;
|ELSE INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) VALUES (N'patching', N'cve_age', N'', N'', NULL, NULL, NULL, 0, N'the sources give no first-detected date for these vulnerabilities');
|-- SLA breaches: open findings past their fix due date, per severity
|IF EXISTS (SELECT 1 FROM #f WHERE Due IS NOT NULL)
|    INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'patching', N'sla_breaches', CASE WHEN GROUPING(ISNULL(Sev, N'(none)')) = 1 THEN N'(all)' ELSE ISNULL(Sev, N'(none)') END, N'',
|                      SUM(CASE WHEN Due < @t THEN 1 ELSE 0 END), COUNT(DISTINCT CASE WHEN Due < @t THEN AssetKey END), SUM(CASE WHEN Due IS NOT NULL THEN 1 ELSE 0 END), 1, NULL
|    FROM #f GROUP BY GROUPING SETS ((ISNULL(Sev, N'(none)')), ());
|ELSE INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) VALUES (N'patching', N'sla_breaches', N'(all)', N'', NULL, NULL, NULL, 0, N'no finding has a fix due date (a remediation flow or service level sets si_fix_due_date)');
|-- opened vs fixed in the last @kfRecent days (SI_KeyFigures_RecentDays) and the mean time to fix over the last @kfMttr days
|-- (SI_KeyFigures_MeanTimeToFixDays) -- the finding lifecycle, CVE findings. The figures' keys keep their old names
|-- (opened_30d / fixed_30d); the window in force is the meta 'window' row below
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'patching', N'opened_30d', N'', N'', COUNT_BIG(*), COUNT(DISTINCT s.CiId), NULL, 1, NULL FROM sidata.CiFindingState AS s
|WHERE s.FindingKey LIKE N'CVE-%' AND s.FirstDetected > DATEADD(day, -@kfRecent, @t) AND s.FirstDetected <= @t;
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'patching', N'fixed_30d', N'', N'', COUNT_BIG(*), COUNT(DISTINCT s.CiId), NULL, 1, NULL FROM sidata.CiFindingState AS s
|WHERE s.FindingKey LIKE N'CVE-%' AND s.ClosedAt > DATEADD(day, -@kfRecent, @t) AND s.ClosedAt <= @t AND s.CloseReason = N'remediated';
|-- #855: FIXED means remediated -- a finding closed because its asset was retired, is no longer monitored or its report changed
|-- was not fixed, and never counts here (nor in the mean time to fix)
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'patching', N'mean_days_to_fix', N'', N'', AVG(CONVERT(float, DATEDIFF(hour, s.FirstDetected, s.ClosedAt)) / 24.0), COUNT(DISTINCT s.CiId), COUNT_BIG(*),
|                  CASE WHEN COUNT_BIG(*) > 0 THEN 1 ELSE 0 END, CASE WHEN COUNT_BIG(*) = 0 THEN N'no vulnerability was fixed in the last ' + CONVERT(nvarchar(10), @kfMttr) + N' days' END
|FROM sidata.CiFindingState AS s WHERE s.FindingKey LIKE N'CVE-%' AND s.ClosedAt > DATEADD(day, -@kfMttr, @t) AND s.ClosedAt <= @t AND s.CloseReason = N'remediated';
|
|-- ==== (2) EXPOSURE ================================================================================================
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'exposure', N'tier0_very_high_high', N'', N'', COUNT(DISTINCT CASE WHEN x.Cls IN ('vh', 'h') THEN d.CiId END), COUNT(DISTINCT CASE WHEN x.Cls IN ('vh', 'h') THEN d.CiId END), COUNT(DISTINCT d.CiId), 1, NULL
|FROM #d AS d LEFT JOIN #fd AS x ON x.CiId = d.CiId WHERE d.Tier = 0 AND d.Active = 1;
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'exposure', N'internet_very_high_cve', N'', N'', COUNT(DISTINCT CASE WHEN x.Cls = 'vh' AND x.Cve IS NOT NULL THEN d.CiId END), COUNT(DISTINCT CASE WHEN x.Cls = 'vh' AND x.Cve IS NOT NULL THEN d.CiId END), COUNT(DISTINCT d.CiId), 1, NULL
|FROM #d AS d LEFT JOIN #fd AS x ON x.CiId = d.CiId WHERE d.Internet = 1 AND d.Active = 1;
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'exposure', N'end_of_support', CASE WHEN GROUPING(CASE WHEN d.Typ = N'Server' THEN N'Servers' ELSE N'Other devices' END) = 1 THEN N'(all)' ELSE CASE WHEN d.Typ = N'Server' THEN N'Servers' ELSE N'Other devices' END END, N'',
|                  COUNT(DISTINCT CASE WHEN x.Eos = 1 THEN d.CiId END), COUNT(DISTINCT CASE WHEN x.Eos = 1 THEN d.CiId END), COUNT(DISTINCT d.CiId), 1, NULL
|FROM #d AS d LEFT JOIN #fd AS x ON x.CiId = d.CiId WHERE d.Class = N'device' AND d.Active = 1
|GROUP BY GROUPING SETS ((CASE WHEN d.Typ = N'Server' THEN N'Servers' ELSE N'Other devices' END), ());
|
|-- ==== (3) COVERAGE ================================================================================================
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'coverage', N'not_onboarded', N'', N'', SUM(CASE WHEN ISNULL(Onboarded, N'') <> N'onboarded' THEN 1 ELSE 0 END), SUM(CASE WHEN ISNULL(Onboarded, N'') <> N'onboarded' THEN 1 ELSE 0 END), COUNT(*), 1, NULL
|FROM #d WHERE Class = N'device' AND Active = 1;
|-- #855 W11 / #858 (owner 2026-10-21: "another filter can easily be unonboarded"): the active devices not onboarded, split by
|-- Defender's onboarding status -- can be onboarded (the actionable part), unsupported, insufficient info, offboarded, and
|-- unknown (no status) -- each linked to the CI list's Onboarding filter; the total above stays the sum of the parts
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note)
|SELECT N'coverage', N'not_onboarded_status', s.Dim1, N'', COUNT(*), COUNT(*), (SELECT COUNT(*) FROM #d WHERE Class = N'device' AND Active = 1), 1, NULL
|FROM (SELECT CASE WHEN ISNULL(Onboarded, N'') IN (N'can_be_onboarded', N'unsupported', N'insufficient_info', N'offboarded') THEN Onboarded ELSE N'unknown' END AS Dim1
|      FROM #d WHERE Class = N'device' AND Active = 1 AND ISNULL(Onboarded, N'') <> N'onboarded') AS s
|GROUP BY s.Dim1;
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'coverage', N'not_seen_30d', N'', N'', SUM(CONVERT(int, NotSeen)), SUM(CONVERT(int, NotSeen)), COUNT(*), 1, NULL FROM #d WHERE Class = N'device';
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'coverage', N'azure_vm_no_agent', N'', N'', SUM(CASE WHEN HasMde = 0 THEN 1 ELSE 0 END), SUM(CASE WHEN HasMde = 0 THEN 1 ELSE 0 END), COUNT(*), 1, NULL FROM #d WHERE AzureVm = 1 AND Active = 1;
|
|-- ==== (4) IDENTITY ================================================================================================
|IF EXISTS (SELECT 1 FROM #d WHERE Class = N'identity' AND AssetType = N'User' AND Mfa IS NOT NULL)
|    INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'identity', N'users_without_mfa', N'', N'', SUM(CASE WHEN Mfa = 0 THEN 1 ELSE 0 END), SUM(CASE WHEN Mfa = 0 THEN 1 ELSE 0 END), COUNT(*), 1, NULL
|    FROM #d WHERE Class = N'identity' AND AssetType = N'User' AND ISNULL(Enabled, 1) = 1 AND Active = 1 AND Mfa IS NOT NULL;
|ELSE INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) VALUES (N'identity', N'users_without_mfa', N'', N'', NULL, NULL, NULL, 0, N'no user carries an MFA registration state (the identity profile reads it from Entra ID)');
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'identity', N'tier0_identities_at_risk', N'', N'', COUNT(DISTINCT CASE WHEN x.Cls IN ('vh', 'h') THEN d.CiId END), COUNT(DISTINCT CASE WHEN x.Cls IN ('vh', 'h') THEN d.CiId END), COUNT(DISTINCT d.CiId), 1, NULL
|FROM #d AS d LEFT JOIN #fd AS x ON x.CiId = d.CiId WHERE d.Class = N'identity' AND d.Tier = 0 AND d.Active = 1;
|IF EXISTS (SELECT 1 FROM #d WHERE Class = N'identity' AND Privileged = 1 AND LastSignIn IS NOT NULL)
|    INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'identity', N'stale_admins', N'', N'', SUM(CASE WHEN LastSignIn < DATEADD(day, -@kfStale, @t) THEN 1 ELSE 0 END), SUM(CASE WHEN LastSignIn < DATEADD(day, -@kfStale, @t) THEN 1 ELSE 0 END), COUNT(*), 1, NULL
|    FROM #d WHERE Class = N'identity' AND Privileged = 1 AND ISNULL(Enabled, 1) = 1 AND Active = 1 AND LastSignIn IS NOT NULL;
|ELSE INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) VALUES (N'identity', N'stale_admins', N'', N'', NULL, NULL, NULL, 0, N'no privileged account carries a last sign-in time (the identity profile reads it from Entra ID sign-in activity)');
|
|-- ==== (5) CLOUD ===================================================================================================
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) SELECT N'cloud', N'high_recommendations', LEFT(ISNULL(d.Sub, N'(no subscription)'), 128), N'', COUNT_BIG(*), COUNT(DISTINCT d.CiId), NULL, 1, NULL
|FROM #fd AS x JOIN #d AS d ON d.CiId = x.CiId WHERE d.Class = N'cloud_resource' AND x.Cls IN ('vh', 'h')
|GROUP BY LEFT(ISNULL(d.Sub, N'(no subscription)'), 128);
|
|-- SI:STEP patches
|$patches
|-- SI:STEP protection
|$protection
|
|-- SI:STEP write
|-- #855 the marker: these figures count active assets only and remediated as fixed (a collection without it is figured again)
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) VALUES (N'meta', N'active_assets_only', N'', N'', 1, NULL, NULL, 1, NULL);
|-- #860 the marker: the grace is by kind (patch / other), the composite keys are resolved (a collection without it is figured again)
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) VALUES (N'meta', N'grace_by_kind', N'', N'', 1, NULL, NULL, 1, NULL);
|-- #859 the windows these figures were worked out with (the labels say the value in force for THIS collection)
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note)
|VALUES (N'meta', N'window', N'recent_days', N'', @kfRecent, NULL, NULL, 1, NULL), (N'meta', N'window', N'mttr_days', N'', @kfMttr, NULL, NULL, 1, NULL),
|       (N'meta', N'window', N'stale_admin_days', N'', @kfStale, NULL, NULL, 1, NULL);
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note)
|SELECT N'meta', N'window', N'cve_age_band', CONVERT(nvarchar(10), Days), Days, NULL, NULL, 1, NULL FROM #ageBand;
|INSERT #kf (Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note) VALUES (N'meta', N'onboarding_by_status', N'', N'', 1, NULL, NULL, 1, NULL);
|
|BEGIN TRAN;
|DELETE FROM sidata.KeyFigure WHERE CollectionId = @c;
|INSERT sidata.KeyFigure (CollectionId, Block, Figure, Dim1, Dim2, Value, Assets, Total, Available, Note, Items, VeryHigh, Servers, Clients)
|SELECT @c, Block, Figure, LEFT(Dim1, 200), LEFT(Dim2, 120), Value, Assets, Total, Available, Note, Items, VeryHigh, Servers, Clients FROM #kf;
|DECLARE @n INT = @@ROWCOUNT;
|UPDATE sidata.Collection SET KeyFiguresAt = SYSUTCDATETIME() WHERE CollectionId = @c;
|COMMIT;
|SELECT @n;
|"@
|}
|
|function Get-SIProtectionScoreParams {
|    <#
|        PURE. The key-figure SQL's parameters: the protection score's settings (ONE reader for both editions:
|        Get-SIProtectionScoreSettings in engine\_shared\SI-ProtectionScore.ps1) and the figures' windows (#859, ONE reader:
|        Get-SIKeyFigureWindowSettings).
|    #>
|    param($Settings)
|    if (-not (Get-Command -Name Get-SIProtectionScoreSettings -ErrorAction SilentlyContinue)) {
|        . ([System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), '_shared', 'SI-ProtectionScore.ps1'))
|    }
|    $c = Get-SIProtectionScoreSettings -Settings $Settings
|    $w = Get-SIKeyFigureWindowSettings -Settings $Settings
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    [ordered]@{
|        Sevs = (ConvertTo-Json -InputObject @($c.Severities) -Compress)
|        W0 = ([double]$c.Weights[0]).ToString($inv); W1 = ([double]$c.Weights[1]).ToString($inv); W2 = ([double]$c.Weights[2]).ToString($inv); W3 = ([double]$c.Weights[3]).ToString($inv)
|        GraceDevice = [string]$c.Grace.device; GraceIdentity = [string]$c.Grace.identity
|        GraceCloud = [string]$c.Grace.cloud_resource; GracePublicIp = [string]$c.Grace.public_ip
|        OtherGraceDevice = [string]$c.OtherGrace.device; OtherGraceIdentity = [string]$c.OtherGrace.identity
|        OtherGraceCloud = [string]$c.OtherGrace.cloud_resource; OtherGracePublicIp = [string]$c.OtherGrace.public_ip
|        RecentDays = $w.RecentDays.ToString($inv); MttrDays = $w.MeanTimeToFixDays.ToString($inv); StaleAdminDays = $w.StaleAdminDays.ToString($inv)
|        CveAgeBands = (ConvertTo-Json -InputObject @($w.CveAgeBands) -Compress)
|    }
|}
|
|# #859 (owner 2026-10-21: "do we have static values in the code ?" / "why not use the settings values (customer specific)"):
|# every window a key figure counts over is a setting of the install, today's value as its shipped default.
|$script:SIKeyFigureWindowDefaults = [ordered]@{
|    SI_KeyFigures_RecentDays        = 30          # "opened / fixed in the last N days"
|    SI_KeyFigures_MeanTimeToFixDays = 90          # "mean time to fix (days, last N days)"
|    SI_KeyFigures_StaleAdminDays    = 90          # "privileged accounts without a sign-in for N days"
|    SI_KeyFigures_CveAgeBands       = '30,60,90'  # "age of open CVE findings: older than N days", one band per number
|}
|
|function Get-SIKeyFigureWindowSettings {
|    <#
|        PURE. THE reader of the key figures' windows (#859), from -Settings (a dictionary: the update passes the install's own)
|        or the globals (the data sync loads the config and the Settings page's values): @{ RecentDays; MeanTimeToFixDays;
|        StaleAdminDays; CveAgeBands (ascending, distinct, 1..3650) }. A missing or invalid value = its default
|        ($script:SIKeyFigureWindowDefaults); a band list with no valid number = the default bands.
|    #>
|    param($Settings)
|    $val = {
|        param($n)
|        if ($Settings -is [System.Collections.IDictionary]) { if ($Settings.Contains($n)) { return $Settings[$n] }; return $null }
|        Get-Variable -Scope Global -Name $n -ValueOnly -ErrorAction SilentlyContinue
|    }
|    $days = {
|        param($n)
|        $x = 0; $v = & $val $n
|        if ($null -ne $v -and [int]::TryParse(([string]$v).Trim(), [Globalization.NumberStyles]::None, [Globalization.CultureInfo]::InvariantCulture, [ref]$x) -and $x -ge 1 -and $x -le 3650) { return $x }
|        [int]$script:SIKeyFigureWindowDefaults[$n]
|    }
|    $bandsOf = {
|        param($raw)
|        $out = New-Object System.Collections.Generic.List[int]
|        foreach ($p in @(([string]$raw) -split '[,;\s]+')) { $x = 0; if ($p -ne '' -and [int]::TryParse($p, [Globalization.NumberStyles]::None, [Globalization.CultureInfo]::InvariantCulture, [ref]$x) -and $x -ge 1 -and $x -le 3650 -and -not $out.Contains($x)) { $out.Add($x) } }
|        , @($out | Sort-Object)
|    }
|    $rawBands = & $val 'SI_KeyFigures_CveAgeBands'
|    if ($rawBands -is [System.Array]) { $rawBands = (@($rawBands) | ForEach-Object { "$_" }) -join ',' }
|    $bands = & $bandsOf $rawBands
|    if ($bands.Count -eq 0) { $bands = & $bandsOf $script:SIKeyFigureWindowDefaults['SI_KeyFigures_CveAgeBands'] }
|    @{
|        RecentDays        = (& $days 'SI_KeyFigures_RecentDays')
|        MeanTimeToFixDays = (& $days 'SI_KeyFigures_MeanTimeToFixDays')
|        StaleAdminDays    = (& $days 'SI_KeyFigures_StaleAdminDays')
|        CveAgeBands       = [int[]]$bands
|    }
|}
|function Get-SIDataKeyFiguresSteps {
|    <#
|        PURE. The key-figure script (Get-SIDataKeyFiguresSql) cut at its '-- SI:STEP <name>' lines: @{ Prologue; Steps =
|        [ordered] name -> text }. The prologue is the declarations every step needs (@c, @t, the windows, @kfLo / @kfHi);
|        the step 'findings' reads one key range of the collection's findings (@kfLo < FindingId <= @kfHi).
|    #>
|    param([int]$CatchUpDays = 30)
|    $all = Get-SIDataKeyFiguresSql -CatchUpDays $CatchUpDays
|    $parts = [regex]::Split($all, '(?m)^-- SI:STEP (\w+)\s*$')
|    $head = $parts[0] -replace '(?m)^SET (NOCOUNT|XACT_ABORT) ON;\s*$', ''
|    $steps = [ordered]@{}
|    for ($i = 1; $i -lt $parts.Count; $i += 2) { $steps[$parts[$i]] = $parts[$i + 1] }
|    [pscustomobject]@{ Prologue = $head.Trim(); Steps = $steps }
|}
|
|function ConvertTo-SIKeyFigureParamDeclare {
|    <#
|        PURE. The parameters of the key-figure script as T-SQL declarations (DECLARE @Name nvarchar(max) = N'value';) -- a step
|        runs as a plain batch, because a parameterised command runs in sp_executesql and drops the #temp tables the next step
|        reads. Names are identifiers only; every value is a quoted N'' string (quotes doubled), as the script converts each one.
|    #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Params)
|    $lines = foreach ($k in @($Params.Keys)) {
|        if ([string]$k -notmatch '^[A-Za-z_][A-Za-z0-9_]*$') { throw ("key figures: '{0}' is not a parameter name" -f $k) }
|        $v = $Params[$k]
|        if ($null -eq $v) { "DECLARE @$k nvarchar(max) = NULL;" } else { "DECLARE @$k nvarchar(max) = N'" + ([string]$v).Replace("'", "''") + "';" }
|    }
|    ($lines -join "`n")
|}
|
|function Invoke-SIDataKeyFiguresStepped {
|    <#
|        THE KEY FIGURES OF ONE COLLECTION AT ANY SIZE (owner 2026-10-22: "i accept no limits ... this must work for customers
|        with 50 mio objects"): the same script as Get-SIDataKeyFiguresSql, run as its steps on ONE connection (the seam's mode
|        'session'), each its own command with no time limit, with a progress line per step -- and the collection's findings
|        read into the working set one key range at a time (a clustered-key seek on (CollectionId, FindingId)), the range
|        sized from the measured seconds of the one before (aim -TargetSeconds a range; never a fixed row count). The result
|        is identical to the one-statement run (the same text, the same order). Answers the number of figure rows.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][System.Collections.IDictionary]$Params, [int]$CatchUpDays = 30,
|          [scriptblock]$Log, [double]$TargetSeconds = 20, [long]$FirstSpan = 200000)
|    if (-not $Log) { $Log = { param($l, $m) } }
|    $plan = Get-SIDataKeyFiguresSteps -CatchUpDays $CatchUpDays
|    $decl = ConvertTo-SIKeyFigureParamDeclare -Params $Params
|    $cid = [string]$Params['CollectionId']
|    $batchOf = {
|        param([string]$Text, [long]$Lo, [long]$Hi)
|        $pro = $plan.Prologue -replace 'DECLARE @kfLo bigint = \d+, @kfHi bigint = \d+;', ('DECLARE @kfLo bigint = {0}, @kfHi bigint = {1};' -f $Lo, $Hi)
|        "SET NOCOUNT ON;`nSET XACT_ABORT ON;`n$decl`n$pro`n$Text"
|    }
|    $onSession = {
|        param($Run)
|        $clock = [Diagnostics.Stopwatch]::StartNew(); $sw = [Diagnostics.Stopwatch]::new()
|        $null = & $Run (& $batchOf $plan.Steps['setup'] 0 ([long]::MaxValue)) 'nonquery'
|        # the collection's finding ids: two seeks on the clustered key, never a count of the rows
|        $rg = @(& $Run ("SELECT MIN(FindingId) AS Lo, MAX(FindingId) AS Hi FROM sidata.Finding WHERE CollectionId = CONVERT(int, N'{0}');" -f ([int]$cid)) 'reader') | Select-Object -First 1
|        $lo = $null; $hi = $null
|        if ($rg) { $lo = $rg.Lo; $hi = $rg.Hi; if ($lo -is [System.DBNull]) { $lo = $null }; if ($hi -is [System.DBNull]) { $hi = $null } }
|        if ($null -ne $lo -and $null -ne $hi) {
|            $from = [long]$lo - 1; $top = [long]$hi; $span = [Math]::Max(1L, $FirstSpan); $said = [Diagnostics.Stopwatch]::StartNew()
|            while ($from -lt $top) {
|                $to = [long][Math]::Min([double]$top, [double]$from + $span)
|                $sw.Restart()
|                $null = & $Run (& $batchOf $plan.Steps['findings'] $from $to) 'nonquery'
|                $sec = [Math]::Max(0.05, $sw.Elapsed.TotalSeconds)
|                $from = $to
|                # the next range from the measured pace (at most twice / half the last one, so one slow range never swings it)
|                $span = [long][Math]::Max(1, [Math]::Round($span * [Math]::Min(2.0, [Math]::Max(0.5, $TargetSeconds / $sec))))
|                if ($said.Elapsed.TotalSeconds -ge 60 -or $from -ge $top) {
|                    & $Log 'INFO' ("key figures : collection {0} -- findings read {1:N0}% ({2:N0} s so far)" -f $cid, (100.0 * ($from - [long]$lo + 1) / [Math]::Max(1, ($top - [long]$lo + 1))), $clock.Elapsed.TotalSeconds)
|                    $said.Restart()
|                }
|            }
|        }
|        $n = 0L
|        foreach ($name in @($plan.Steps.Keys)) {
|            if ($name -in 'setup', 'findings') { continue }
|            $sw.Restart()
|            if ($name -eq 'write') { $n = [long](& $Run (& $batchOf $plan.Steps[$name] 0 ([long]::MaxValue)) 'scalar') }
|            else { $null = & $Run (& $batchOf $plan.Steps[$name] 0 ([long]::MaxValue)) 'nonquery' }
|            & $Log 'INFO' ("key figures : collection {0} -- {1} done in {2:N1} s ({3:N0} s so far)" -f $cid, $name, $sw.Elapsed.TotalSeconds, $clock.Elapsed.TotalSeconds)
|        }
|        $n
|    }
|    [long](& $Invoke $null $null 'session' $onSession)
|}
|
|function Invoke-SIDataKeyFigures {
|    <#
|    .SYNOPSIS  Writes the key figures of the newest complete collections that have none (newest first). Never throws.
|    .NOTES     -Keep: how many of the newest pending collections get figures in one run (the trend reads every one that has
|               them; older ones follow on the next runs). A collection without them: the Executive pages say "being prepared".
|               NO TIME LIMIT ON THE WORK (owner 2026-10-22): a seam that runs a session (SISqlSession: the data sync's and the
|               update's) works each collection out in steps with progress (Invoke-SIDataKeyFiguresStepped), no command time
|               limit. -BudgetSeconds never stops a collection that has started: it only says when the OLDER pending
|               collections are left to the next run (resume in parts -- the newest is always done first).
|    #>
|    # -Settings: the protection score's settings (a dictionary; none = the globals, as the data sync loads them) -- the update
|    # passes the install's own when it figures the collections again (Invoke-SIContainerUpdate.ps1 step 9g)
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [switch]$DryRun, [scriptblock]$Log, [int]$BudgetSeconds = 600, $Settings = $null)
|    if (-not $Log) { $Log = { param($l, $m) Write-Host ('[{0}] {1}' -f $l, $m) } }
|    try {
|        if (([int](& $Invoke (Get-SIDataKeyFiguresSchemaCheckSql) @{} 'scalar')) -ne 1) {
|            & $Log 'INFO' 'key figures : the database does not have the key figures table yet (the updater adds it) -- the Executive overview and report say they are being prepared.'
|            return [pscustomobject]@{ Status = 'no-schema'; Collections = 0 }
|        }
|        $pending = @(@(& $Invoke (Get-SIDataUnfiguredSql) @{} 'reader') | ForEach-Object { $_ } | Where-Object { $null -ne $_ })
|        if ($DryRun) {
|            & $Log 'INFO' ("key figures : {0} collection(s) would get their key figures; nothing is written." -f $pending.Count)
|            return [pscustomobject]@{ Status = 'dry-run'; Collections = 0; Pending = $pending.Count }
|        }
|        if ($pending.Count -eq 0) { return [pscustomobject]@{ Status = 'ok'; Collections = 0; Pending = 0 } }
|        $days = 30; if ($global:SI_PatchCycle_CatchUpDays -and [int]$global:SI_PatchCycle_CatchUpDays -gt 0) { $days = [int]$global:SI_PatchCycle_CatchUpDays }
|        $sql = Get-SIDataKeyFiguresSql -CatchUpDays $days
|        $clock = [Diagnostics.Stopwatch]::StartNew(); $done = 0; $rows = [long]0
|        foreach ($p in $pending) {
|            if ($done -gt 0 -and $clock.Elapsed.TotalSeconds -gt $BudgetSeconds) { break }
|            $cid = $(if ($p -is [System.Collections.IDictionary]) { $p['CollectionId'] } else { $p.CollectionId })
|            $ps = Get-SIProtectionScoreParams -Settings $Settings; $ps['CollectionId'] = [string][int]$cid
|            if ($Invoke.PSObject.Properties['SISqlSession'] -and $Invoke.SISqlSession) {
|                $rows += Invoke-SIDataKeyFiguresStepped -Invoke $Invoke -Params $ps -CatchUpDays $days -Log $Log
|            } else {
|                $rows += [long](& $Invoke $sql $ps 'scalar')
|            }
|            $done++
|        }
|        $left = $pending.Count - $done
|        & $Log 'OK' ("key figures : {0} collection(s) got their key figures ({1} figure row(s))" -f $done, $rows)
|        if ($left -gt 0) { & $Log 'INFO' ("key figures : {0} older collection(s) follow on the next run(s)" -f $left) }
|        return [pscustomobject]@{ Status = 'ok'; Collections = $done; Rows = $rows; Pending = $left }
|    } catch {
|        & $Log 'WARN' ("key figures : not completed this run -- {0}. Tried again on the next run; the Executive pages show the last complete set." -f $_.Exception.Message)
|        return [pscustomobject]@{ Status = 'failed'; Error = $_.Exception.Message }
|    }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-SupportGrantUpdate.ps1'] = @{ Sha256 = 'cae8a6d85fc6374454d0b8a36c707e05863a2c07300daa3fdba958f51e294a9c'; Text = @'
|#Requires -Version 5.1
|<#
|    #1021 -- THE UPDATE'S HALF OF THE SUPPORT GRANT (rule: existing installs reach the new-install state through the update).
|    What the updater's identity may do (Contributor on the resource group, its own user in the Pro database):
|
|      1. THE QUEUE si-support-requests in the install's own storage account (control plane: an ARM PUT, read back) -- where
|         the Invardia Support session puts its request for caj-si-support-grant. The job itself is made by the missing-jobs
|         step (SI-MissingJobs.ps1).
|      2. A DERIVED CONSENT (owner decision 2026-11-01), ONCE, into an empty cfg.SupportConsent: the Support app recorded on
|         the install (cfg.InstallState 'SupportApp') and the level its Azure role on the install's Key Vault shows today --
|         Key Vault Secrets Officer = setup, Key Vault Reader = troubleshoot (what Grant-SISupportAccess gives at each level);
|         no such role = no consent (nothing is written; the customer's admin grants it with Grant-SISupportAccess). A
|         consent that is there -- the customer's or an earlier derived one -- is never touched. The table's trigger lets the
|         updater write exactly this and nothing else.
|    What it can NOT do, and leaves to the one Support-session step per install (setup\Install-SISupportGrantProcedure.ps1):
|    sign the procedures (needs db_owner), the Support app's read-only user, and its one Azure role -- Storage Queue Data
|    Message Sender on the queue (needs role assignment rights). Every line says what was done or why not; nothing here fails
|    the update.
|
|      3. #1154 (framework §5.5, 2026-11-08) THE JOB IS STARTED BY ITS QUEUE, AND THE SUPPORT APP HOLDS NO RIGHT ON ANY JOB
|         (Invoke-SISupportGrantQueueTrigger): Microsoft.App/jobs/start/action ALONE accepts a container override, so a start
|         right on caj-si-support-grant let the Support app run its own command as the engine identity. In this order:
|           a. caj-si-support-grant -> triggerType Event with the azure-queue scale rule on si-support-requests in the install's
|              own storage account, the scaler signed in as the ENGINE identity (no key: shared-key access is off) -- one
|              merge PATCH of the trigger only, READ BACK with retries (ARM reads are eventually consistent);
|           b. ONLY when the trigger reads back as Event: every role assignment the Support app holds AT a caj-si-* job is
|              removed (whatever its role -- no ARM right on any job), READ BACK. A right held on something broader (the
|              resource group, the subscription) that also starts jobs is SAID, never changed here.
|         So support never loses its way in: the queue starts the job before the start right goes. The updater holds
|         Contributor, which may not remove a role assignment: then the line says who can (the Support-session step or the
|         customer's admin) and the next update checks again. Idempotent; never throws; a second run changes nothing.
|
|    Seams: -Rest (setup\_shared\SI-UpdateRest.ps1: Invoke-SIRestJson / ARM + Graph), -Sql { param([string]$Query, $Params,
|    [string]$Mode) } on the Pro database, -Arm { param([string]$Method, [string]$Path, $Body) } (a path with its api-version;
|    the parsed answer, $null for a GET that is 404, throws on anything else). PS 5.1 safe; no module.
|#>
|
|$script:SISupportGrantUpdate = [ordered]@{
|    Queue         = 'si-support-requests'
|    StorageApi    = '2023-01-01'
|    VaultApi      = '2022-07-01'
|    AuthApi       = '2022-04-01'
|    # #1154: the job, its trigger (the same values as container\_shared\SI-ContainerConfig.ps1 Get-SISupportGrantTriggerArgs --
|    # a test holds them equal) and the jobs' api-version (the schema the fast roll reads and writes)
|    Job           = 'caj-si-support-grant'
|    JobsApi       = '2025-07-01'
|    RuleName      = 'si-support-requests'
|    MaxExecutions = 1
|    PollingInterval = 10
|    # the role names said in a line (a role assignment names its role only by id)
|    RoleNames     = [ordered]@{ 'b9a307c4-5aa3-4b52-ba60-2b17c136cd7b' = 'Container Apps Jobs Operator'; '4e3d2b60-56ae-4dc6-a233-09c8e5a82e68' = 'Container Apps Jobs Contributor'
|                                'b24988ac-6180-42a0-ab88-20f7382dd24c' = 'Contributor'; '8e3af657-a8ff-443c-a75c-2fe8c4bcb635' = 'Owner'; 'acdd72a7-3385-48ef-bd42-f606fba81ae7' = 'Reader' }
|    # the built-in role definitions (their ids are the same in every tenant) -> the level they show
|    LevelByRoleId = [ordered]@{ 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7' = 'setup'; '21090545-7ca7-4776-b22c-e363652d74d2' = 'troubleshoot' }
|}
|
|function Get-SISupportGrantDerivedLevel {
|    <# PURE. The level the Support app's role assignments on the Key Vault show: setup (Key Vault Secrets Officer) wins over
|       troubleshoot (Key Vault Reader); '' = neither (no consent can be derived). -RoleDefinitionIds: full ids or GUIDs. #>
|    param([AllowEmptyCollection()][string[]]$RoleDefinitionIds = @())
|    $ids = @($RoleDefinitionIds | Where-Object { $_ } | ForEach-Object { ([string]$_ -split '/')[-1].ToLowerInvariant() })
|    $map = $script:SISupportGrantUpdate.LevelByRoleId
|    if (@($ids | Where-Object { $map.Contains($_) -and $map[$_] -eq 'setup' }).Count) { return 'setup' }
|    if (@($ids | Where-Object { $map.Contains($_) -and $map[$_] -eq 'troubleshoot' }).Count) { return 'troubleshoot' }
|    ''
|}
|
|function Get-SISupportGrantConsentReadSql {
|    <# PURE. READ ONLY, one row: the recorded Support app, the consent row (if any) -- '' where the table is not there. #>
|    @"
|SELECT CASE WHEN OBJECT_ID(N'cfg.InstallState') IS NULL THEN N'' ELSE ISNULL((SELECT Value FROM cfg.InstallState WHERE Name = N'SupportApp'), N'') END AS SupportApp,
|       CASE WHEN OBJECT_ID(N'cfg.SupportConsent') IS NULL THEN N'-' ELSE ISNULL((SELECT [Level] + N'|' + Source FROM cfg.SupportConsent WHERE Id = 1), N'') END AS Consent,
|       CASE WHEN OBJECT_ID(N'cfg.InstallState') IS NULL THEN N'' ELSE ISNULL((SELECT Value FROM cfg.InstallState WHERE Name = N'SupportConsentPortal'), N'') END AS Portal;
|"@
|}
|
|function Get-SISupportGrantDerivedConsentSql {
|    <# PURE. The ONE write: a derived consent into an EMPTY table (parameters @AppId, @Level, @By), then the row read back. #>
|    @"
|IF NOT EXISTS (SELECT 1 FROM cfg.SupportConsent WHERE Id = 1)
|    INSERT cfg.SupportConsent (Id, AppId, [Level], Source, ConsentedBy) VALUES (1, CONVERT(uniqueidentifier, @AppId), @Level, N'derived', LEFT(@By, 256));
|SELECT ISNULL((SELECT [Level] + N'|' + Source FROM cfg.SupportConsent WHERE Id = 1), N'') AS Consent;
|"@
|}
|
|function Invoke-SISupportGrantQueueEnsure {
|    <# The queue si-support-requests in -Account: made when missing (ARM PUT), READ BACK. @{ Action (present | created |
|       planned | failed); Line }. Never throws. #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [AllowEmptyString()][string]$Account, [switch]$WhatIf)
|    $c = $script:SISupportGrantUpdate
|    if (-not "$Account".Trim()) { return [pscustomobject]@{ Action = 'failed'; Line = 'support requests: the install names no storage account (SI_StorageAccount) -- the queue was not made' } }
|    $uri = 'https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Storage/storageAccounts/{2}/queueServices/default/queues/{3}?api-version={4}' -f $SubscriptionId, $ResourceGroup, $Account.Trim(), $c.Queue, $c.StorageApi
|    try {
|        if (Invoke-SIRestJson -Rest $Rest -Uri $uri -AllowNotFound -What 'the support request queue') { return [pscustomobject]@{ Action = 'present'; Line = '' } }
|        if ($WhatIf) { return [pscustomobject]@{ Action = 'planned'; Line = ('support requests: the queue {0} would be made in {1}' -f $c.Queue, $Account) } }
|        $null = Invoke-SIRestJson -Rest $Rest -Method PUT -Uri $uri -Body (@{ properties = @{} } | ConvertTo-Json -Compress) -What 'make the support request queue'
|        if (Invoke-SIRestJson -Rest $Rest -Uri $uri -AllowNotFound -What 'the support request queue (read back)') { return [pscustomobject]@{ Action = 'created'; Line = ('support requests: the queue {0} was made in {1}, and read back' -f $c.Queue, $Account) } }
|        [pscustomobject]@{ Action = 'failed'; Line = ('support requests: the queue {0} was sent but does not read back yet -- the next update checks it again' -f $c.Queue) }
|    } catch { [pscustomobject]@{ Action = 'failed'; Line = ('support requests: the queue {0} was not made ({1}) -- the next update tries again' -f $c.Queue, $_.Exception.Message) } }
|}
|
|function Invoke-SISupportGrantDerivedConsent {
|    <#
|        The DERIVED CONSENT (see the header). @{ Action (present | none | derived | planned | failed); Level; Line }. Never
|        throws. -VaultName: the install's Key Vault (SI_KeyVaultName), in -ResourceGroup.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [Parameter(Mandatory)][scriptblock]$Sql, [Parameter(Mandatory)][string]$SubscriptionId,
|          [Parameter(Mandatory)][string]$ResourceGroup, [AllowEmptyString()][string]$VaultName, [switch]$WhatIf)
|    $c = $script:SISupportGrantUpdate
|    $out = { param($a, $lv, $l) [pscustomobject]@{ Action = $a; Level = $lv; Line = $l } }
|    $val = { param($r, $k) if ($null -eq $r) { '' } elseif ($r -is [System.Collections.IDictionary]) { [string]$r[$k] } elseif ($r.PSObject.Properties[$k]) { [string]$r.$k } else { '' } }
|    try {
|        $row = @(& $Sql (Get-SISupportGrantConsentReadSql) @{} 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })[0]
|        $app = (& $val $row 'SupportApp').Trim(); $have = (& $val $row 'Consent').Trim()
|        if ($have -eq '-') { return (& $out 'failed' '' 'support consent: the Pro database has no cfg.SupportConsent yet (its schema step runs first) -- the next update derives it') }
|        if ($have) { return (& $out 'present' (($have -split '\|')[0]) '') }
|        # the level now comes from the Invardia portal (SI-SupportPortalConsent.ps1, applied by the updater): once Invardia has
|        # answered, nothing is derived any more -- a level the portal took away (none) must never come back from a Key Vault role
|        if ((& $val $row 'Portal').Trim()) { return (& $out 'none' '' '') }
|        if ($app -notmatch '^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$') { return (& $out 'none' '' '') }   # no Support app on this install: nothing to derive, nothing said
|        if (-not "$VaultName".Trim()) { return (& $out 'none' '' 'support consent: not derived -- the install names no Key Vault (SI_KeyVaultName); the customer''s admin records it with Grant-SISupportAccess') }
|        $sp = Invoke-SIRestJson -Rest $Rest -Uri ("https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appId eq '{0}'&`$select=id" -f $app) -Resource 'https://graph.microsoft.com/' -What 'the Support app in this tenant'
|        $spId = [string](@($sp.value)[0].id)
|        if (-not $spId) { return (& $out 'none' '' 'support consent: not derived -- the Support app recorded on the install is not in this tenant') }
|        $scope = '/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.KeyVault/vaults/{2}' -f $SubscriptionId, $ResourceGroup, $VaultName.Trim()
|        $list = @(Get-SIRestList -Rest $Rest -Uri ('https://management.azure.com{0}/providers/Microsoft.Authorization/roleAssignments?api-version={1}&$filter={2}' -f $scope, $c.AuthApi, [uri]::EscapeDataString("principalId eq '$spId'")) -What 'the Support app''s roles on the Key Vault')
|        $level = Get-SISupportGrantDerivedLevel -RoleDefinitionIds @($list | ForEach-Object { [string]$_.properties.roleDefinitionId })
|        if (-not $level) { return (& $out 'none' '' 'support consent: not derived -- the Support app has neither Key Vault Secrets Officer nor Key Vault Reader on the install''s Key Vault (no consent: the customer''s admin grants it with Grant-SISupportAccess)') }
|        if ($WhatIf) { return (& $out 'planned' $level ('support consent: would be recorded as DERIVED, level {0} (from the Support app''s Key Vault role)' -f $level)) }
|        $back = @(& $Sql (Get-SISupportGrantDerivedConsentSql) @{ AppId = $app; Level = $level; By = 'caj-si-updater (derived from the Support app''s Key Vault role)' } 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })[0]
|        $got = (& $val $back 'Consent').Trim()
|        if ($got -eq ('{0}|derived' -f $level)) { return (& $out 'derived' $level ('support consent: recorded as DERIVED, level {0} (from the Support app''s Key Vault role), and read back' -f $level)) }
|        if ($got) { return (& $out 'present' (($got -split '\|')[0]) '') }
|        & $out 'failed' $level 'support consent: the derived consent does not read back -- the next update tries again'
|    } catch { & $out 'failed' '' ('support consent: not derived ({0}) -- the next update tries again' -f $_.Exception.Message) }
|}
|
|# ---- #1154: THE JOB IS STARTED BY ITS QUEUE; THE SUPPORT APP HOLDS NO RIGHT ON ANY JOB --------------------------------------
|
|function Get-SISupportGrantProp {
|    <# PURE. A property of a parsed ARM object, $null when absent (dictionary or PSObject; never throws on a missing level). #>
|    param($Object, [string[]]$Path)
|    $o = $Object
|    foreach ($p in $Path) {
|        if ($null -eq $o) { return $null }
|        if ($o -is [System.Collections.IDictionary]) { if ($o.Contains($p)) { $o = $o[$p] } else { return $null }; continue }
|        $pp = $o.PSObject.Properties[$p]; if (-not $pp) { return $null }; $o = $pp.Value
|    }
|    $o
|}
|
|function Get-SISupportGrantJobEnvValue {
|    <# PURE. The value of env NAME (case-insensitive) on the job's first container that has it ('' when none). #>
|    param($Job, [Parameter(Mandatory)][string]$Name)
|    foreach ($c in @(Get-SISupportGrantProp $Job @('properties', 'template', 'containers'))) {
|        foreach ($e in @(Get-SISupportGrantProp $c @('env'))) {
|            if ($e -and [string](Get-SISupportGrantProp $e @('name')) -ieq $Name) { $v = [string](Get-SISupportGrantProp $e @('value')); if ($v.Trim()) { return $v.Trim() } }
|        }
|    }
|    ''
|}
|
|function Select-SISupportGrantJobIdentity {
|    <#
|        PURE. The ENGINE identity a job signs in as -- the user-assigned identity whose client id is the job's SI_UAMI_CLIENTID,
|        else the job's only user-assigned identity. '' when there is none or it cannot be told (several, none named).
|    #>
|    param($Job)
|    $ua = Get-SISupportGrantProp $Job @('identity', 'userAssignedIdentities')
|    if ($null -eq $ua) { return '' }
|    $ids = @(if ($ua -is [System.Collections.IDictionary]) { foreach ($k in $ua.Keys) { [pscustomobject]@{ Id = [string]$k; ClientId = [string](Get-SISupportGrantProp $ua[$k] @('clientId')) } } }
|             else { foreach ($p in $ua.PSObject.Properties) { [pscustomobject]@{ Id = [string]$p.Name; ClientId = [string](Get-SISupportGrantProp $p.Value @('clientId')) } } })
|    $ids = @($ids | Where-Object { $_.Id.Trim() })
|    $cid = Get-SISupportGrantJobEnvValue -Job $Job -Name 'SI_UAMI_CLIENTID'
|    if ($cid) { $m = @($ids | Where-Object { $_.ClientId -and $_.ClientId -ieq $cid })[0]; if ($m) { return $m.Id } }
|    if ($ids.Count -eq 1) { return $ids[0].Id }
|    ''
|}
|
|function Get-SISupportGrantEventTriggerConfig {
|    <# PURE. The eventTriggerConfig of caj-si-support-grant: one execution at a time, the azure-queue rule on si-support-requests
|       in -StorageAccount, signed in as -IdentityResourceId. Exactly what Bootstrap's create arguments translate to. #>
|    param([Parameter(Mandatory)][string]$StorageAccount, [Parameter(Mandatory)][string]$IdentityResourceId)
|    $c = $script:SISupportGrantUpdate
|    $rule = [ordered]@{ name = $c.RuleName; type = 'azure-queue'; metadata = [ordered]@{ queueName = $c.Queue; accountName = $StorageAccount.Trim(); queueLength = '1' }; identity = $IdentityResourceId.Trim() }
|    [ordered]@{ parallelism = 1; replicaCompletionCount = 1
|                scale = [ordered]@{ minExecutions = 0; maxExecutions = [int]$c.MaxExecutions; pollingInterval = [int]$c.PollingInterval; rules = @($rule) } }
|}
|
|function Get-SISupportGrantTriggerState {
|    <#
|        PURE. Where caj-si-support-grant stands (-Job as ARM returned it): @{ State; Account; Identity; Why }
|          event    already started by its queue: Event, an azure-queue rule on si-support-requests in the account, signed in
|                   as the engine identity
|          convert  not yet (manual, another rule, no identity on the rule, another account)
|          cannot   it cannot be: no storage account (-StorageAccount, else the job's SI_STORAGE_ACCOUNT), or no engine identity
|    #>
|    param([Parameter(Mandatory)]$Job, [AllowEmptyString()][string]$StorageAccount = '')
|    $c = $script:SISupportGrantUpdate
|    $acct = "$StorageAccount".Trim(); if (-not $acct) { $acct = Get-SISupportGrantJobEnvValue -Job $Job -Name 'SI_STORAGE_ACCOUNT' }
|    $id = Select-SISupportGrantJobIdentity -Job $Job
|    $out = { param($s, $w) [pscustomobject]@{ State = $s; Account = $acct; Identity = $id; Why = $w } }
|    if (-not $acct) { return (& $out 'cannot' 'the install names no storage account (SI_STORAGE_ACCOUNT on the job)') }
|    if (-not $id) { return (& $out 'cannot' 'the job has no managed identity the queue scaler could sign in as') }
|    $cfg = Get-SISupportGrantProp $Job @('properties', 'configuration')
|    $tt = [string](Get-SISupportGrantProp $cfg @('triggerType'))
|    if ($tt -ne 'Event') { return (& $out 'convert' ('its trigger is {0}' -f $(if ($tt) { $tt } else { 'not known' }))) }
|    $ok = @(@(Get-SISupportGrantProp $cfg @('eventTriggerConfig', 'scale', 'rules')) | Where-Object {
|        $_ -and [string](Get-SISupportGrantProp $_ @('type')) -eq 'azure-queue' -and
|        [string](Get-SISupportGrantProp $_ @('metadata', 'queueName')) -eq $c.Queue -and
|        [string](Get-SISupportGrantProp $_ @('metadata', 'accountName')) -ieq $acct -and
|        [string](Get-SISupportGrantProp $_ @('identity')) -ieq $id }).Count
|    if ($ok) { return (& $out 'event' '') }
|    & $out 'convert' ('its queue rule is not on {0} in {1} signed in as the engine identity' -f $c.Queue, $acct)
|}
|
|function Get-SISupportGrantTriggerPatch {
|    <#
|        PURE. The PATCH that makes caj-si-support-grant started by its queue. A Container Apps PATCH is a JSON MERGE patch: the
|        body carries ONLY the trigger (triggerType, its run limit and retry limit as the job has them, eventTriggerConfig --
|        whose rules array is replaced whole); the secrets, the template, the identity and the registry are not sent and stay.
|    #>
|    param([Parameter(Mandatory)]$Job, [Parameter(Mandatory)][string]$StorageAccount, [Parameter(Mandatory)][string]$IdentityResourceId)
|    $cfg = Get-SISupportGrantProp $Job @('properties', 'configuration')
|    $c = [ordered]@{ triggerType = 'Event' }
|    $to = Get-SISupportGrantProp $cfg @('replicaTimeout'); if ($to) { $c.replicaTimeout = [int]$to }
|    $rl = Get-SISupportGrantProp $cfg @('replicaRetryLimit'); if ($null -ne $rl) { $c.replicaRetryLimit = [int]$rl }
|    $c.eventTriggerConfig = Get-SISupportGrantEventTriggerConfig -StorageAccount $StorageAccount -IdentityResourceId $IdentityResourceId
|    [ordered]@{ properties = [ordered]@{ configuration = $c } }
|}
|
|function Test-SISupportGrantRoleStartsJobs {
|    <# PURE. Does a role definition's permissions (@(@{ actions; notActions })) allow Microsoft.App/jobs/start/action (a
|       wildcard such as *, Microsoft.App/* or Microsoft.App/jobs/* included; a notAction that covers it excluded)? #>
|    param([AllowEmptyCollection()][object[]]$Permissions = @())
|    $target = 'Microsoft.App/jobs/start/action'
|    $hit = { param($pat) $p = "$pat".Trim(); if (-not $p) { return $false }; $target -match ('^' + [regex]::Escape($p).Replace('\*', '.*') + '$') }
|    foreach ($perm in @($Permissions | Where-Object { $_ })) {
|        $in = @(@(Get-SISupportGrantProp $perm @('actions')) | Where-Object { & $hit $_ }).Count
|        $out = @(@(Get-SISupportGrantProp $perm @('notActions')) | Where-Object { & $hit $_ }).Count
|        if ($in -and -not $out) { return $true }
|    }
|    $false
|}
|
|function Get-SISupportGrantRoleName {
|    <# PURE. A role assignment's role in words: the built-in name where known, else 'the role <guid>'. #>
|    param([AllowEmptyString()][string]$RoleDefinitionId)
|    $g = ("$RoleDefinitionId" -split '/')[-1].ToLowerInvariant()
|    if ($script:SISupportGrantUpdate.RoleNames.Contains($g)) { return [string]$script:SISupportGrantUpdate.RoleNames[$g] }
|    'the role {0}' -f $g
|}
|
|function Get-SISupportGrantRecordedApp {
|    <# READ ONLY. The Invardia Support app's client id recorded on the install (cfg.InstallState 'SupportApp'); '' when none.
|       -Sql { param($Query, $Params, $Mode) } ('rows'). Never throws. #>
|    param([Parameter(Mandatory)][scriptblock]$Sql)
|    try {
|        $row = @(& $Sql "SELECT CASE WHEN OBJECT_ID(N'cfg.InstallState') IS NULL THEN N'' ELSE ISNULL((SELECT Value FROM cfg.InstallState WHERE Name = N'SupportApp'), N'') END AS SupportApp;" @{} 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })[0]
|        $v = if ($null -eq $row) { '' } elseif ($row -is [System.Collections.IDictionary]) { [string]$row['SupportApp'] } elseif ($row.PSObject.Properties['SupportApp']) { [string]$row.SupportApp } else { '' }
|        $v = $v.Trim()
|        if ($v -match '^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$') { return $v }
|    } catch { }
|    ''
|}
|
|function Resolve-SISupportGrantPrincipal {
|    <# The service principal (object id) of the Support app -AppId in this tenant, through Graph (-Rest). '' when none or
|       not readable. Never throws. #>
|    param([Parameter(Mandatory)][scriptblock]$Rest, [AllowEmptyString()][string]$AppId)
|    if ("$AppId".Trim() -notmatch '^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$') { return '' }
|    try {
|        $sp = Invoke-SIRestJson -Rest $Rest -Uri ("https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appId eq '{0}'&`$select=id" -f $AppId.Trim()) -Resource 'https://graph.microsoft.com/' -What 'the Support app in this tenant'
|        return [string](@($sp.value)[0].id)
|    } catch { return '' }
|}
|
|function Invoke-SISupportGrantQueueTrigger {
|    <#
|        THE #1154 STEP (see the header, point 3). -Arm: the ARM seam (a path with its api-version). -SupportPrincipalId: the
|        Invardia Support app's service principal (object id) in this tenant ('' = no Support app here: the trigger is still
|        converted, nothing is removed). -RemoveHow: who can remove a right this identity may not (said in the line).
|        -Tries / -WaitSeconds / -Sleep: the read-backs. -WhatIf: reads only, the plan said.
|        Returns @{ Trigger (none | present | converted | planned | failed | cannot); Removal (none | removed | planned | failed |
|        held | skipped); Removed = @(ids); Kept = @(ids); Lines = @(@{ Level (info | warn); Text }) }. NEVER throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup,
|          [AllowEmptyString()][string]$StorageAccount = '', [AllowEmptyString()][string]$SupportPrincipalId = '',
|          [string]$RemoveHow = 'Invardia support removes it in its Support session (its support grant install step, roles), or the customer''s admin: Azure portal > the job > Access control (IAM) > Role assignments > remove the Invardia Support app',
|          [int]$Tries = 12, [int]$WaitSeconds = 10, [scriptblock]$Sleep, [switch]$WhatIf)
|    $c = $script:SISupportGrantUpdate
|    $res = [ordered]@{ Trigger = 'none'; Removal = 'none'; Removed = @(); Kept = @(); Lines = (New-Object System.Collections.Generic.List[object]) }
|    $say = { param($lv, $t) $res.Lines.Add([pscustomobject]@{ Level = $lv; Text = $t }) }
|    $done = { [pscustomobject]@{ Trigger = $res.Trigger; Removal = $res.Removal; Removed = @($res.Removed); Kept = @($res.Kept); Lines = $res.Lines.ToArray() } }
|    if (-not $Sleep) { $Sleep = { param($s) if ($s -gt 0) { Start-Sleep -Seconds $s } } }
|    $rg = '/subscriptions/{0}/resourceGroups/{1}' -f $SubscriptionId, $ResourceGroup
|    $jobPath = '{0}/providers/Microsoft.App/jobs/{1}?api-version={2}' -f $rg, $c.Job, $c.JobsApi
|    try {
|        # ---- a. THE TRIGGER ----
|        $job = $null
|        try { $job = & $Arm 'GET' $jobPath $null } catch { & $say 'warn' ('support requests: the support grant job could not be read ({0}) -- the next update tries again' -f $_.Exception.Message); $res.Trigger = 'failed'; $res.Removal = 'held'; return (& $done) }
|        if (-not $job) { return (& $done) }   # no support grant job at this install: nothing to do, nothing said
|        $st = Get-SISupportGrantTriggerState -Job $job -StorageAccount $StorageAccount
|        if ($st.State -eq 'cannot') {
|            & $say 'warn' ('support requests: {0} cannot be started by its queue yet -- {1}; the Invardia Support app keeps its way in until it can' -f $c.Job, $st.Why)
|            $res.Trigger = 'cannot'; $res.Removal = 'held'; return (& $done)
|        }
|        if ($st.State -eq 'event') { $res.Trigger = 'present' }
|        elseif ($WhatIf) {
|            & $say 'info' ('support requests: {0} would be started by its queue {1} (event trigger, the queue read as the engine identity); once that reads back, the Invardia Support app''s rights on the jobs would be removed' -f $c.Job, $c.Queue)
|            $res.Trigger = 'planned'; $res.Removal = 'held'; return (& $done)
|        } else {
|            try { $null = & $Arm 'PATCH' $jobPath (Get-SISupportGrantTriggerPatch -Job $job -StorageAccount $st.Account -IdentityResourceId $st.Identity) }
|            catch { & $say 'warn' ('support requests: {0} was not moved to its queue ({1}) -- the Invardia Support app keeps its way in; the next update tries again' -f $c.Job, $_.Exception.Message); $res.Trigger = 'failed'; $res.Removal = 'held'; return (& $done) }
|            $back = $false
|            for ($i = 1; $i -le [Math]::Max(1, $Tries); $i++) {
|                $j = $null; try { $j = & $Arm 'GET' $jobPath $null } catch { $j = $null }
|                # read back = the job says Event on the queue AND its change has finished (a PATCH of a job runs on: until it
|                # has succeeded, the trigger shown may not be the one in force)
|                $ps = [string](Get-SISupportGrantProp $j @('properties', 'provisioningState'))
|                if ($j -and (-not $ps -or $ps -eq 'Succeeded') -and (Get-SISupportGrantTriggerState -Job $j -StorageAccount $st.Account).State -eq 'event') { $back = $true; break }
|                if ($i -lt $Tries) { & $Sleep $WaitSeconds }
|            }
|            if (-not $back) {
|                & $say 'warn' ('support requests: {0} was moved to its queue trigger but does not read back that way yet -- the Invardia Support app keeps its way in; the next update checks again' -f $c.Job)
|                $res.Trigger = 'failed'; $res.Removal = 'held'; return (& $done)
|            }
|            & $say 'info' ('support requests: {0} is now started by its queue {1} (event trigger, the queue read as the engine identity), and read back' -f $c.Job, $c.Queue)
|            $res.Trigger = 'converted'
|        }
|
|        # ---- b. NO RIGHT ON ANY JOB -- only now that the queue starts the job ----
|        $spId = "$SupportPrincipalId".Trim()
|        if (-not $spId) { $res.Removal = 'skipped'; return (& $done) }
|        $listPath = '{0}/providers/Microsoft.Authorization/roleAssignments?api-version={1}&$filter={2}' -f $rg, $c.AuthApi, [uri]::EscapeDataString("principalId eq '$spId'")
|        $list = {
|            $page = & $Arm 'GET' $listPath $null
|            @(@(Get-SISupportGrantProp $page @('value')) | Where-Object { $_ -and [string](Get-SISupportGrantProp $_ @('properties', 'principalId')) -ieq $spId })
|        }
|        $all = @()
|        try { $all = @(& $list) } catch { & $say 'warn' ('support access: the Invardia Support app''s rights could not be read ({0}) -- the next update checks again' -f $_.Exception.Message); $res.Removal = 'failed'; return (& $done) }
|        $jobRx = '(?i)^' + [regex]::Escape($rg) + '/providers/Microsoft\.App/jobs/caj-si-[^/]+$'
|        $onJob = @($all | Where-Object { [string](Get-SISupportGrantProp $_ @('properties', 'scope')) -match $jobRx })
|        # a right on something BROADER that also starts jobs (the resource group, the subscription, a management group) -- said
|        $rgKey = $rg.ToLowerInvariant() + '/'
|        $defs = @{}
|        foreach ($a in @($all | Where-Object { $sc = [string](Get-SISupportGrantProp $_ @('properties', 'scope')); $sc -and $rgKey.StartsWith($sc.TrimEnd('/').ToLowerInvariant() + '/') })) {
|            $rd = [string](Get-SISupportGrantProp $a @('properties', 'roleDefinitionId'))
|            $starts = $null
|            try {
|                if (-not $defs.ContainsKey($rd)) { $defs[$rd] = & $Arm 'GET' ('{0}?api-version={1}' -f $rd, $c.AuthApi) $null }
|                $starts = Test-SISupportGrantRoleStartsJobs -Permissions @(Get-SISupportGrantProp $defs[$rd] @('properties', 'permissions'))
|            } catch { $starts = $null }
|            $scopeName = [string](Get-SISupportGrantProp $a @('properties', 'scope'))
|            if ($starts) { $res.Kept += [string](Get-SISupportGrantProp $a @('id')); & $say 'warn' ('support access: the Invardia Support app holds {0} on {1}, which also lets it start the jobs -- the update does not change a right broader than a job; the customer''s admin decides' -f (Get-SISupportGrantRoleName $rd), $scopeName) }
|            elseif ($null -eq $starts) { & $say 'warn' ('support access: whether the Invardia Support app''s {0} on {1} lets it start the jobs could not be read -- the next update checks again' -f (Get-SISupportGrantRoleName $rd), $scopeName) }
|        }
|        if (-not $onJob.Count) { return (& $done) }
|        $what = { param($a) '{0} on {1}' -f (Get-SISupportGrantRoleName ([string](Get-SISupportGrantProp $a @('properties', 'roleDefinitionId')))), ([string](Get-SISupportGrantProp $a @('properties', 'scope')) -split '/')[-1] }
|        if ($WhatIf) {
|            foreach ($a in $onJob) { & $say 'info' ('support access: the Invardia Support app''s {0} would be removed -- support asks through its queue only' -f (& $what $a)) }
|            $res.Removal = 'planned'; return (& $done)
|        }
|        $sent = New-Object System.Collections.Generic.List[object]; $failed = 0
|        foreach ($a in $onJob) {
|            $aid = [string](Get-SISupportGrantProp $a @('id'))
|            try { $null = & $Arm 'DELETE' ('{0}?api-version={1}' -f $aid, $c.AuthApi) $null; $sent.Add($a) }
|            catch { $failed++; & $say 'warn' ('support access: the Invardia Support app''s {0} could not be removed ({1}) -- {2}; the next update checks again' -f (& $what $a), $_.Exception.Message, $RemoveHow) }
|        }
|        # THE READ-BACK: what was removed must be gone from the list (role assignments are eventually consistent: read again)
|        $left = @($sent.ToArray())
|        for ($i = 1; $left.Count -and $i -le [Math]::Max(1, $Tries); $i++) {
|            $now = $null; try { $now = @(& $list) } catch { $now = $null }
|            if ($null -ne $now) { $ids = @($now | ForEach-Object { [string](Get-SISupportGrantProp $_ @('id')) }); $left = @($left | Where-Object { $ids -icontains [string](Get-SISupportGrantProp $_ @('id')) }) }
|            if ($left.Count -and $i -lt $Tries) { & $Sleep $WaitSeconds }
|        }
|        foreach ($a in $sent) {
|            $aid = [string](Get-SISupportGrantProp $a @('id'))
|            if (@($left | Where-Object { [string](Get-SISupportGrantProp $_ @('id')) -ieq $aid }).Count) { $failed++; & $say 'warn' ('support access: the Invardia Support app''s {0} was removed but still reads back -- the next update checks again' -f (& $what $a)) }
|            else { $res.Removed += $aid; & $say 'info' ('support access: the Invardia Support app''s {0} was removed, and read back -- support asks through its queue only' -f (& $what $a)) }
|        }
|        $res.Removal = if ($failed) { 'failed' } else { 'removed' }
|        & $done
|    } catch {
|        & $say 'warn' ('support requests: the queue trigger was not checked ({0}) -- the next update tries again' -f $_.Exception.Message)
|        if ($res.Trigger -eq 'none') { $res.Trigger = 'failed' }
|        if ($res.Removal -eq 'none') { $res.Removal = 'held' }
|        & $done
|    }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-PipelineLayout.ps1'] = @{ Sha256 = '1c8426370bd91a42a3df61ac47407a56a712d7650692f49f57dae26eb67ff5f4'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- EXISTING INSTALLS GET THE PIPELINE A NEW INSTALL GETS (#754, #748; rule: existing installs reach
|    new-install state). The stored pipeline (cfg.JobFlow 'daily' in the Pro database) is what the pipeline runner and the
|    web app read. Both already bring an old layout to the current one IN MEMORY as they read it (engine\_shared\SI-JobFlow.ps1:
|    ConvertFrom-SIJobFlowJson -- Update-SIJobFlowDefaultLayout, Move-SIJobFlowStepAfterNeeds, the updater / a retired job taken
|    out), but nothing STORED it until a person saved the pipeline on the Jobs page. Every update now stores it:
|
|      * WHAT (Get-SIPipelineLayoutPlan, PURE): the stored definition read as the runner reads it, plus every step the map
|        marks 'required' whose job is installed and that the pipeline does not have (Add-SIJobFlowRequiredStep: the
|        verification service, which runs the daily data health check -- #748). Level 3 of the default layout (#754): Risk
|        Analysis Summary and Detailed start together after the asset correlation, on a pipeline still on the default layout
|        of its own level; a pipeline a person changed is only marked with the level, never re-laid. Nothing changed = no write.
|      * HOW (Invoke-SIPipelineLayout): ONE parameterised UPDATE of cfg.JobFlow, only while the row still holds the text that
|        was read (a save from the web app in between wins -- the next update looks again), then the row is READ BACK: it must
|        be the planned text, and reading it once more must change nothing (idempotent). One plain line per change.
|      * Never throws; -WhatIf: the plan only, nothing written. No az CLI, no PowerShell module: SQL through ONE seam,
|        -Sql { param([string]$Query, $Params, [string]$Mode) } ('reader' -> rows, 'nonquery' -> count).
|#>
|
|if (-not (Get-Command -Name ConvertFrom-SIJobFlowJson -ErrorAction SilentlyContinue)) {
|    . ([IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'engine', '_shared', 'SI-JobFlow.ps1'))
|}
|
|$script:SIPipelineLayout = @{ By = 'update (pipeline layout)'; FlowId = 'daily' }
|
|function Get-SIPipelineLayoutPlan {
|    <#
|        PURE. -FlowJson: the stored definition ('' / $null = none: nothing to do). -Installed: the install's jobs (keys or
|        caj-si-* names). Returns @{ Changed; FlowJson (the definition to store, or $null); Lines (one plain line per change);
|        DefaultsLevel }. The runner's own reading decides the layout, so the stored pipeline is exactly what the runner runs.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$FlowJson = '', [AllowEmptyCollection()][string[]]$Installed = @(), $Map)
|    $none = [pscustomobject]@{ Changed = $false; FlowJson = $null; Lines = @(); DefaultsLevel = 0 }
|    if (-not "$FlowJson".Trim()) { return $none }
|    if (-not $Map) { $Map = Get-SIJobFlowMap }
|    $d = ConvertFrom-SIJobFlowJson -Json $FlowJson -Map $Map
|    $d = Add-SIJobFlowRequiredStep -Definition $d -Installed $Installed -Map $Map
|    $new = ConvertTo-SIJobFlowJson -Definition $d
|    $lvl = if ($d.PSObject.Properties['DefaultsLevel']) { [int]$d.DefaultsLevel } else { 0 }
|    # only the level moved (a pipeline a person changed): stored too, so the decision is never made again
|    $moved = [bool]($d.PSObject.Properties['Migrated'] -and $d.Migrated)
|    $storedLevel = 1
|    $m = [regex]::Match($FlowJson, '"defaults"\s*:\s*(\d+)'); if ($m.Success) { $storedLevel = [int]$m.Groups[1].Value }
|    if (-not $moved -and $storedLevel -ge $lvl) { return [pscustomobject]@{ Changed = $false; FlowJson = $null; Lines = @(); DefaultsLevel = $lvl } }
|    $lines = New-Object System.Collections.Generic.List[string]
|    foreach ($n in @($(if ($d.PSObject.Properties['MigrationNotes']) { $d.MigrationNotes }))) { if ($n) { $lines.Add(('The daily pipeline: {0}.' -f ([string]$n).TrimEnd('.'))) } }
|    if (-not $lines.Count) { $lines.Add(('The daily pipeline is kept as it is (it was changed by a person); it is marked with the current layout level {0}, so it is never re-laid.' -f $lvl)) }
|    [pscustomobject]@{ Changed = $true; FlowJson = $new; Lines = $lines.ToArray(); DefaultsLevel = $lvl }
|}
|
|function Get-SIPipelineLayoutSql {
|    <# The statements. 'Read': the stored daily pipeline. 'Apply': the new text, only while the row still holds the old. #>
|    param([Parameter(Mandatory)][ValidateSet('Read', 'Apply')][string]$Name)
|    if ($Name -eq 'Read') {
|        return "IF OBJECT_ID(N'cfg.JobFlow') IS NOT NULL SELECT DefinitionJson FROM cfg.JobFlow WHERE FlowId = @FlowId;"
|    }
|    "UPDATE cfg.JobFlow SET DefinitionJson = @New, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE FlowId = @FlowId AND DefinitionJson = @Old;"
|}
|
|function Invoke-SIPipelineLayout {
|    <#
|        The stored pipeline brought to the new-install state, once per change (see the header). -Sql: the seam; -Installed:
|        the install's jobs. Never throws. Returns @{ Action = none | kept | plan | changed | raced | failed; Lines }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Sql, [AllowEmptyCollection()][string[]]$Installed = @(), $Map, [switch]$WhatIf)
|    try {
|        if (-not $Map) { $Map = Get-SIJobFlowMap }
|        $read = {
|            $rows = @(& $Sql (Get-SIPipelineLayoutSql -Name Read) @{ FlowId = $script:SIPipelineLayout.FlowId } 'reader' | Where-Object { $_ })
|            if (-not $rows.Count) { return '' }
|            $r = $rows[0]
|            $v = if ($r -is [System.Collections.IDictionary]) { $r['DefinitionJson'] } else { $r.DefinitionJson }
|            if ($null -eq $v -or $v -is [DBNull]) { '' } else { [string]$v }
|        }
|        $old = & $read
|        if (-not $old.Trim()) { return [pscustomobject]@{ Action = 'none'; Lines = @() } }
|        $plan = Get-SIPipelineLayoutPlan -FlowJson $old -Installed $Installed -Map $Map
|        if (-not $plan.Changed) { return [pscustomobject]@{ Action = 'kept'; Lines = @() } }
|        if ($WhatIf) { return [pscustomobject]@{ Action = 'plan'; Lines = @($plan.Lines | ForEach-Object { '{0} (re-run with -Apply)' -f $_ }) } }
|        $n = [int](& $Sql (Get-SIPipelineLayoutSql -Name Apply) @{ FlowId = $script:SIPipelineLayout.FlowId; Old = $old; New = [string]$plan.FlowJson; By = $script:SIPipelineLayout.By } 'nonquery')
|        if ($n -lt 1) { return [pscustomobject]@{ Action = 'raced'; Lines = @('The daily pipeline was saved by someone else while the update read it -- it is checked again on the next update.') } }
|        # READ BACK: the row holds the planned text, and reading it once more changes nothing
|        $back = & $read
|        if ($back -ne [string]$plan.FlowJson) { return [pscustomobject]@{ Action = 'failed'; Lines = @('The daily pipeline did not read back as written -- the next update checks it again.') } }
|        $again = Get-SIPipelineLayoutPlan -FlowJson $back -Installed $Installed -Map $Map
|        if ($again.Changed) { return [pscustomobject]@{ Action = 'failed'; Lines = @(@($plan.Lines) + 'The daily pipeline would change again when read once more -- the next update checks it again.') } }
|        [pscustomobject]@{ Action = 'changed'; Lines = @($plan.Lines) }
|    } catch { [pscustomobject]@{ Action = 'failed'; Lines = @(('The daily pipeline''s layout was not checked ({0}) -- the next update tries again.' -f $_.Exception.Message)) } }
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|#  #636 LEVEL 4 -- RISK ANALYSIS SUMMARY OFF BY DEFAULT (owner 2026-10-19: "i prefer to switch so detailed becomes the engine
|#  default and summary is optional"). The layout plan above stores it like every level: on a stored pipeline that is still
|#  the default of its level with every step on, the Summary step (risk-analysis) is switched off (Update-SIJobFlowDefaultLayout,
|#  one line); one a person changed keeps it, and one line says so. What hangs on the Summary report then follows here:
|#  the management summary reports a person scheduled for the Summary report's data (cfg.MgmtReport Grain 'Summary') show the
|#  Detailed report's -- once, only while the stored pipeline has the Summary step off, one line per report moved.
|# ---------------------------------------------------------------------------------------------------------------------
|
|function Get-SIMgmtReportsDetailedSql {
|    <# 'Read': the scheduled Summary reports. 'Apply': each to Detailed, only while it is still Summary (a save in between wins). #>
|    param([Parameter(Mandatory)][ValidateSet('Read', 'Apply')][string]$Name)
|    if ($Name -eq 'Read') {
|        return "IF OBJECT_ID(N'cfg.MgmtReport') IS NOT NULL SELECT ReportId, Name FROM cfg.MgmtReport WHERE Grain = N'Summary' AND RemovedAt IS NULL ORDER BY ReportId;"
|    }
|    "UPDATE cfg.MgmtReport SET Grain = N'Detailed', UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE ReportId = @Id AND Grain = N'Summary' AND RemovedAt IS NULL;"
|}
|
|function Invoke-SIMgmtReportsDetailed {
|    <#
|        The scheduled management summary reports of the Summary report's data -> the Detailed report's, while the stored pipeline
|        has the Summary step off (engine\_shared\SI-SummaryStep.ps1). -Sql: the seam (as Invoke-SIPipelineLayout). Never throws.
|        Returns @{ Action = none | kept | plan | changed | failed; Lines }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Sql, [switch]$WhatIf)
|    try {
|        if (-not (Get-Command -Name Get-SISummaryStepState -ErrorAction SilentlyContinue)) {
|            . ([IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'engine', '_shared', 'SI-SummaryStep.ps1'))
|        }
|        $state = Get-SISummaryStepState -Invoke $Sql -StoredOnly
|        if ($state -ne 'off') { return [pscustomobject]@{ Action = 'kept'; Lines = @() } }
|        $reports = @(& $Sql (Get-SIMgmtReportsDetailedSql -Name Read) @{} 'reader' | Where-Object { $_ })
|        if (-not $reports.Count) { return [pscustomobject]@{ Action = 'none'; Lines = @() } }
|        $val = { param($r, $n) if ($r -is [System.Collections.IDictionary]) { $r[$n] } else { $r.$n } }
|        $lines = New-Object System.Collections.Generic.List[string]
|        foreach ($r in $reports) {
|            $line = "The management summary report '{0}' now shows the Detailed report's data (the Risk Analysis Summary step is off)." -f [string](& $val $r 'Name')
|            if ($WhatIf) { $lines.Add($line + ' (re-run with -Apply)'); continue }
|            $n = [int](& $Sql (Get-SIMgmtReportsDetailedSql -Name Apply) @{ Id = [long](& $val $r 'ReportId'); By = $script:SIPipelineLayout.By } 'nonquery')
|            if ($n -ge 1) { $lines.Add($line) }
|        }
|        [pscustomobject]@{ Action = $(if ($WhatIf) { 'plan' } elseif ($lines.Count) { 'changed' } else { 'none' }); Lines = $lines.ToArray() }
|    } catch { [pscustomobject]@{ Action = 'failed'; Lines = @(('The management summary reports were not checked ({0}) -- the next update tries again.' -f $_.Exception.Message)) } }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-SummaryStep.ps1'] = @{ Sha256 = 'bfc55a48aac8843bf302f2a24f505acbead052f76aa54e3294916229743f86e9'; Text = @'
|#Requires -Version 5.1
|<#
|    IS THE RISK ANALYSIS SUMMARY STEP ON? (REQUIREMENTS #636, owner 2026-10-19: "i prefer to switch so detailed becomes the
|    engine default and summary is optional, which a customer can enable if they want" / "i dont see a need for summary in
|    pipeline").
|
|    The Summary step (job 'risk-analysis') is OFF by default in both editions (config\job-flow.locked.json defaultEnabled);
|    a customer switches it on per install with the step's own switch (Operations > Jobs, or config\job-flow.custom.json).
|    What reads this:
|      * the Detailed run's mail (Invoke-RiskAnalysis.ps1): the Summary mail settings (RiskAnalysis_Summary_SendMail / _To)
|        move to the management mail -- the Detailed mail -- while the Summary step is not on (a customer who switches it on
|        gets the Summary mail again, and the Detailed mail goes only to its own recipients, as before);
|      * the data sync (SI-DataSync.ps1 / SI-DataQuality.ps1): no Summary load and no Summary warnings for a step that is off.
|    The web app has the same rule (Jobs/SummaryStep.cs).
|
|    The answer: 'on' | 'off' | 'unknown'.
|      'off'      the stored pipeline (mode flow) has the step switched off, or does not have it; or no pipeline is stored
|                 and the shipped default is off;
|      'on'       the stored pipeline runs it;
|      'unknown'  the jobs run on their own timers (mode schedules), or the pipeline could not be read -- a caller then keeps
|                 what it did before (nothing moves).
|    PURE except Get-SISummaryStepState's reads (the -Invoke seam, a file).
|#>
|
|$script:SISummaryStepJob = 'risk-analysis'
|
|function Get-SISummaryStepStateFromJson {
|    <# PURE. The state from a stored definition's JSON (schema 1 or 2, as the web app and the runner write it). #>
|    param([AllowNull()][AllowEmptyString()][string]$Json)
|    if (-not "$Json".Trim()) { return 'unknown' }
|    try { $o = $Json | ConvertFrom-Json -ErrorAction Stop } catch { return 'unknown' }
|    $mode = ''; if ($o.PSObject.Properties['mode'] -and $o.mode) { $mode = ([string]$o.mode).ToLowerInvariant() }
|    if ($mode -and $mode -ne 'flow') { return 'unknown' }
|    $steps = New-Object System.Collections.Generic.List[object]
|    if ($o.PSObject.Properties['stages'] -and $null -ne $o.stages) { foreach ($st in @($o.stages)) { if ($st -and $st.PSObject.Properties['steps']) { foreach ($s in @($st.steps)) { if ($s) { $steps.Add($s) } } } } }
|    if (-not $steps.Count -and $o.PSObject.Properties['steps']) { foreach ($s in @($o.steps)) { if ($s) { $steps.Add($s) } } }
|    foreach ($s in $steps) {
|        $k = ([string]$s.job).Trim().ToLowerInvariant(); if ($k.StartsWith('caj-si-')) { $k = $k.Substring(7) }
|        if ($k -ne $script:SISummaryStepJob) { continue }
|        $en = $true; if ($s.PSObject.Properties['enabled'] -and $null -ne $s.enabled -and "$($s.enabled)" -ne '') { $en = [bool]$s.enabled }
|        if ($en) { return 'on' } else { return 'off' }
|    }
|    'off'
|}
|
|function Get-SISummaryStepDefaultState {
|    <# PURE. What a new install gets: the map's defaultEnabled of the Summary step (config\job-flow.locked.json). #>
|    param([string]$MapPath = [IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'config', 'job-flow.locked.json'))
|    try {
|        $m = [IO.File]::ReadAllText($MapPath) | ConvertFrom-Json
|        $j = @($m.jobs | Where-Object { [string]$_.key -eq $script:SISummaryStepJob })[0]
|        if ($j -and $j.PSObject.Properties['defaultEnabled'] -and $j.defaultEnabled -eq $false) { return 'off' }
|        return 'on'
|    } catch { return 'off' }
|}
|
|function Get-SISummaryStepState {
|    <#
|        The Summary step's state for this install. -Invoke (Pro): the Pro database seam { param($sql, $params, $mode) } --
|        cfg.JobFlow 'daily'. -FlowFile (a VM / Community): config\job-flow.custom.json. Neither stored: the shipped default.
|        A read that fails = 'unknown'. Never throws. -StoredOnly: only what the database says ('unknown' when it holds no
|        pipeline) -- for the readers that must never hide a step on a guess (the data sync's Summary load, the data quality,
|        the status report).
|    #>
|    param([scriptblock]$Invoke, [string]$Mode = 'reader', [string]$FlowFile = [IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'config', 'job-flow.custom.json'),
|          [switch]$StoredOnly)
|    try {
|        if ($Invoke) {
|            $rows = @(& $Invoke "IF OBJECT_ID(N'cfg.JobFlow') IS NOT NULL SELECT DefinitionJson FROM cfg.JobFlow WHERE FlowId = N'daily';" @{} $Mode | ForEach-Object { $_ } | Where-Object { $_ })
|            if ($rows.Count) {
|                $r = $rows[0]; $v = if ($r -is [System.Collections.IDictionary]) { $r['DefinitionJson'] } else { $r.DefinitionJson }
|                if ($null -ne $v -and -not ($v -is [DBNull]) -and "$v".Trim()) { return (Get-SISummaryStepStateFromJson -Json ([string]$v)) }
|            }
|        }
|        if ($StoredOnly) { return 'unknown' }
|        if ($FlowFile -and (Test-Path -LiteralPath $FlowFile)) { return (Get-SISummaryStepStateFromJson -Json ([IO.File]::ReadAllText($FlowFile))) }
|        return (Get-SISummaryStepDefaultState)
|    } catch { return 'unknown' }
|}
|
|function Resolve-SIManagementMailRouting {
|    <#
|        PURE. The Detailed run's mail -- the management mail -- with the Summary mail settings moved onto it while the Summary
|        step is not on. -SummaryStep: 'on' | 'off' | 'unknown' (unknown = as before: nothing moves).
|        Returns @{ Send; To (distinct, case-insensitive, Detailed recipients first); Moved (the Summary recipients added) }.
|    #>
|    param([bool]$DetailedSend, [AllowEmptyCollection()][string[]]$DetailedTo = @(), [bool]$SummarySend, [AllowEmptyCollection()][string[]]$SummaryTo = @(),
|          [ValidateSet('on', 'off', 'unknown')][string]$SummaryStep = 'unknown')
|    $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $to = New-Object System.Collections.Generic.List[string]
|    $moved = New-Object System.Collections.Generic.List[string]
|    $move = ($SummaryStep -eq 'off' -and $SummarySend)
|    # the Detailed recipients receive it when the Detailed mail is on (or when nothing moves: exactly as before)
|    if ($DetailedSend -or -not $move) { foreach ($a in @($DetailedTo)) { $t = ([string]$a).Trim(); if ($t -and $seen.Add($t)) { $to.Add($t) } } }
|    $send = $DetailedSend
|    if ($move) {
|        foreach ($a in @($SummaryTo)) { $t = ([string]$a).Trim(); if ($t -and $seen.Add($t)) { $to.Add($t); $moved.Add($t) } }
|        if ($to.Count) { $send = $true }
|    }
|    [pscustomobject]@{ Send = [bool]$send; To = $to.ToArray(); Moved = $moved.ToArray() }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-DisplayNames.ps1'] = @{ Sha256 = '3d9453e1cd61e090880ba81c12e455024851ccea07a0142ce9a3e509add9f8e6'; Text = @'
|#Requires -Version 5.1
|<#
|    SI-DisplayNames.ps1 -- THE NAMES PEOPLE READ, at EXISTING installs too (framework DOCS/REQUIREMENTS.md section 12.11c item 5,
|    SI REQUIREMENTS #655 item 5). Owner: "Short code in Azure, full name where people read"; existing installs: "if a resource
|    can be renamed, we do that. if not, we keep for now, display names are updated".
|
|    WHAT IS RENAMED (Get-SIDisplayNameRenames) -- directory objects only, and only from SecurityInsight's own earlier default:
|      the web app's sign-in application (app registration + enterprise application)  "SecurityInsight Management" -> "SecurityInsight"
|      SecurityInsight's engine application (app registration + enterprise application) "SecurityInsight" -> "SecurityInsight Engine"
|      the SQL admin group (display name only; mailNickname grpsisqladmins kept)        "grp-si-sql-admins" -> "SecurityInsight SQL admins"
|    NEVER renamed: an Azure resource (container app, job, managed identity, SQL server, Key Vault, registry -- Azure cannot), a
|    name the customer chose (anything but the earlier default is left exactly as it is), the mail sender's ADDRESS and the
|    Exchange scope (customers' mail rules). The mail sender's DISPLAY name has always been "SecurityInsight" (setup\Set-SIMail.ps1):
|    it is read and reported, never changed.
|
|    ORDER AND SAFETY
|      * the engine application FIRST: the web app's sign-in application takes the name "SecurityInsight", which the engine's
|        application carries today. While any OTHER application is still named "SecurityInsight" the sign-in application is HELD
|        (one line says which application) -- two applications of one name would let a lookup by name pick the wrong one.
|      * an object is identified by its id, never by its name: the sign-in application by the web app's client id
|        (AzureAd__ClientId), the engine's by its client id (SI_SPN_AppId), the group as the SQL server's Entra admin (its sid).
|      * each rename is read back; a rename that does not read back is PUT BACK to the earlier name, and an application whose
|        enterprise application could not follow is put back too -- never half-renamed.
|      * NEVER TWICE: an object renamed once is recorded (-Done: object id -> UTC); when someone named it back since, it is left.
|        The update renames only where it can keep that record (the Pro database); without it, it says what it would rename.
|      * THE UPDATE'S SWITCH SI_Update_RenameDisplayNames is ON by default (owner 2026-10-18: "everything that we can rename,
|        must follow agreed naming. consistent"); $false keeps the update to the plan.
|      * every FINDER that looked for the earlier name also finds the new one (Find-SISqlAdminGroup, Get-SIDisplayNameAliases,
|        the Graph finders in SI-GraphRest.ps1, New-SIManagementAppRegistration.ps1), so a setup run after the rename never
|        creates a second object -- and never names it back.
|
|    Pure except the -Graph seam: { param([string]$Method, [string]$Uri, $Body) } -> the parsed answer; throws on a failure.
|    ASCII only; PowerShell 5.1-safe.
|#>
|
|function Get-SIDisplayNameRenames {
|    <# PURE. Every directory object whose display name SecurityInsight renames at an existing install, in the order they are
|       renamed (the engine application before the sign-in application: see the header). #>
|    [ordered]@{
|        EngineApp     = [pscustomobject]@{ Role = 'EngineApp'; Kind = 'application'; Old = 'SecurityInsight'; New = 'SecurityInsight Engine'; Nick = ''
|                                           What = 'SecurityInsight''s engine application' }
|        WebSignInApp  = [pscustomobject]@{ Role = 'WebSignInApp'; Kind = 'application'; Old = 'SecurityInsight Management'; New = 'SecurityInsight'; Nick = ''
|                                           What = 'the web app''s sign-in application' }
|        SqlAdminGroup = [pscustomobject]@{ Role = 'SqlAdminGroup'; Kind = 'group'; Old = 'grp-si-sql-admins'; New = 'SecurityInsight SQL admins'; Nick = 'grpsisqladmins'
|                                           What = 'the SQL admin group' }
|    }
|}
|
|function Get-SIWebSignInRoleIds {
|    <# PURE. The stable app role ids of the web app's sign-in application (pro-management\deploy\New-SIManagementAppRegistration.ps1):
|       an application that carries one of them IS the sign-in application, whatever its name. #>
|    @('5f1e6c62-6a3b-4c38-9d8f-2a1d0c9e7a05', '5f1e6c62-6a3b-4c38-9d8f-2a1d0c9e7a01', '5f1e6c62-6a3b-4c38-9d8f-2a1d0c9e7a02',
|      '5f1e6c62-6a3b-4c38-9d8f-2a1d0c9e7a04', '5f1e6c62-6a3b-4c38-9d8f-2a1d0c9e7a06')
|}
|
|function Test-SIWebSignInApplication {
|    <# PURE. Does this application / service principal (an object with appRoles) carry one of the sign-in application's role ids? #>
|    param([AllowNull()]$Object)
|    if ($null -eq $Object -or -not $Object.PSObject.Properties['appRoles']) { return $false }
|    $ids = Get-SIWebSignInRoleIds
|    [bool]@(@($Object.appRoles) | Where-Object { $_ -and $_.PSObject.Properties['id'] -and $ids -contains [string]$_.id }).Count
|}
|
|function Get-SIDisplayNameAliases {
|    <# PURE. Every display name the object of -Role may carry, the name asked for first: today's earlier default and the new
|       one. -Name: the name a caller looks for (a customer's own name has no aliases: just itself). #>
|    param([Parameter(Mandatory)][ValidateSet('EngineApp', 'WebSignInApp', 'SqlAdminGroup')][string]$Role, [AllowEmptyString()][string]$Name = '')
|    $r = (Get-SIDisplayNameRenames)[$Role]
|    $n = "$Name".Trim()
|    if ($n -and $n -cne $r.Old -and $n -cne $r.New) { return @($n) }
|    if ($n -ceq $r.New) { return @($r.New, $r.Old) }
|    @($r.Old, $r.New)
|}
|
|function Test-SIDisplayNameRenameOn {
|    <#
|        PURE. Is SI_Update_RenameDisplayNames ON for this install? ON BY DEFAULT (owner 2026-10-18: "everything that we can
|        rename, must follow agreed naming. consistent" -- every existing install reaches the names a new install gets). Only
|        an explicit 'false' / '0' / 'no' / 'off' (a JSON value of the Pro database may carry quotes) turns it off; not set,
|        empty or anything else is on. From -Values (the install's Pro setting / config), else -Env (default: the process --
|        the updater job's variable). Off: the update says what it WOULD rename, one line each, and changes nothing;
|        setup\Set-SIDisplayNames.ps1 -Apply (an administrator) renames regardless.
|    #>
|    param([System.Collections.IDictionary]$Values, [System.Collections.IDictionary]$Env)
|    $name = 'SI_Update_RenameDisplayNames'
|    $v = $null
|    if ($Values -and $Values.Contains($name)) { $v = $Values[$name] }
|    if ($null -eq $v -or "$v".Trim() -eq '') { $v = if ($Env) { if ($Env.Contains($name)) { $Env[$name] } else { $null } } else { [Environment]::GetEnvironmentVariable($name) } }
|    if ($v -is [bool]) { return [bool]$v }
|    -not ("$v".Trim().Trim('"').Trim('$').Trim() -match '^(?i)(false|0|no|off)$')
|}
|
|function Get-SIDisplayNameSettingSql {
|    <# PURE. The Pro database's value of SI_Update_RenameDisplayNames (the web app's Settings page; solution scope): one
|       ValueJson, or no row (not set = the default, on). #>
|    "IF OBJECT_ID('cfg.Setting') IS NOT NULL SELECT ValueJson FROM cfg.Setting WHERE Name = N'SI_Update_RenameDisplayNames' AND Scope = N'solution';"
|}
|
|function Get-SIDisplayNameProp {
|    param([AllowNull()]$Object, [Parameter(Mandatory)][string]$Name)
|    if ($null -eq $Object) { return $null }
|    if ($Object -is [System.Collections.IDictionary]) { return $Object[$Name] }
|    if ($Object.PSObject.Properties[$Name]) { return $Object.$Name }
|    $null
|}
|
|function Get-SISqlAdminGroupFilter {
|    <# PURE. The Graph $filter that finds the SQL admin group -GroupName under ANY of its names: the name asked for, the other
|       of SecurityInsight's two display names, and its mailNickname (which never changes). A customer's own group: its name only. #>
|    param([AllowEmptyString()][string]$GroupName = 'grp-si-sql-admins')
|    # SI #750 (2026-10-27): a Community edition install's own group (setup\_shared\SI-SetupNaming.ps1, side by side with a Pro
|    # install in the same tenant) is found under ITS two names and its mailNickname -- never under the Pro group's names
|    $c = Get-SICommunitySqlAdminGroupNames
|    if ("$GroupName".Trim() -ceq $c.Old -or "$GroupName".Trim() -ceq $c.New) {
|        return (@(("displayName eq '{0}'" -f $c.Old), ("displayName eq '{0}'" -f $c.New), ("mailNickname eq '{0}'" -f $c.Nick)) -join ' or ')
|    }
|    $r = (Get-SIDisplayNameRenames)['SqlAdminGroup']
|    $names = @(Get-SIDisplayNameAliases -Role SqlAdminGroup -Name $GroupName)
|    $parts = @($names | ForEach-Object { "displayName eq '{0}'" -f $_.Replace("'", "''") })
|    if ($names -ccontains $r.Old) { $parts += ("mailNickname eq '{0}'" -f $r.Nick) }
|    $parts -join ' or '
|}
|
|function Get-SICommunitySqlAdminGroupNames {
|    <# PURE. The Community edition install's SQL admin group (SI #750, side by side with a Pro install in one tenant): the name it
|       is created and looked up by, the name people read, and its mailNickname (Set-SISqlAdminGroup.ps1: -GroupName without
|       its separators). Not renamed by the update: it has had its final display name from the start. #>
|    [pscustomobject]@{ Old = 'grp-si-community-sql-admins'; New = 'SecurityInsight Community SQL admins'; Nick = 'grpsicommunitysqladmins' }
|}
|
|function Find-SISqlAdminGroup {
|    <#
|        The SQL admin group by any of its names (Get-SISqlAdminGroupFilter), never by one display name only -- once renamed,
|        a lookup of "grp-si-sql-admins" alone would find nothing and a setup run would create a SECOND group. Returns
|        @{ Group (@{ Id; DisplayName; MailNickname; IsAssignableToRole; SecurityEnabled }, or $null); Count; Ids }.
|        More than one group: Group $null, Count > 1 (the caller refuses). Throws when the directory cannot be read.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Graph, [AllowEmptyString()][string]$GroupName = 'grp-si-sql-admins')
|    $f = [uri]::EscapeDataString((Get-SISqlAdminGroupFilter -GroupName $GroupName))
|    $r = & $Graph 'GET' ("https://graph.microsoft.com/v1.0/groups?`$filter=$f&`$select=id,displayName,mailNickname,securityEnabled,isAssignableToRole") $null
|    $seen = @{}; $list = New-Object System.Collections.Generic.List[object]
|    foreach ($g in @(Get-SIDisplayNameProp $r 'value')) {
|        if (-not $g) { continue }
|        $id = [string](Get-SIDisplayNameProp $g 'id'); if (-not $id -or $seen.ContainsKey($id)) { continue }
|        $seen[$id] = $true
|        $list.Add([pscustomobject]@{ Id = $id; DisplayName = [string](Get-SIDisplayNameProp $g 'displayName'); MailNickname = [string](Get-SIDisplayNameProp $g 'mailNickname')
|                                     IsAssignableToRole = [bool](Get-SIDisplayNameProp $g 'isAssignableToRole'); SecurityEnabled = [bool](Get-SIDisplayNameProp $g 'securityEnabled') })
|    }
|    [pscustomobject]@{ Group = $(if ($list.Count -eq 1) { $list[0] } else { $null }); Count = $list.Count; Ids = @($list | ForEach-Object { $_.Id }) }
|}
|
|function Get-SIDisplayNameErrorKind {
|    <# PURE. 'rights' when a failed Graph call was a refusal (403 / Authorization_RequestDenied / insufficient privileges), else 'error'. #>
|    param([AllowEmptyString()][string]$Text)
|    if ("$Text" -match '(?i)\b403\b|Authorization_RequestDenied|Insufficient privileges|Forbidden') { 'rights' } else { 'error' }
|}
|
|function Get-SIDisplayNameRightsText {
|    <# PURE. The rights a rename of -Kind needs, in one plain sentence. #>
|    param([Parameter(Mandatory)][ValidateSet('application', 'group')][string]$Kind)
|    if ($Kind -eq 'application') { return 'an owner of the application, or Application Administrator / Cloud Application Administrator (a person), or Microsoft Graph Application.ReadWrite.All (an app)' }
|    'Privileged Role Administrator (a person: the group is role-assignable), or Microsoft Graph Group.ReadWrite.All with RoleManagement.ReadWrite.Directory (an app)'
|}
|
|function Get-SIDisplayNamePlan {
|    <#
|        READ ONLY. What would be renamed at this install: one item per object SecurityInsight can identify --
|          @{ Role; Kind; What; Id (object id); AppId; SpId; SpName; Old; New; Current; Action; Line }
|        Action: rename | present (already the new name) | kept (a name of the customer's own, or named back after an earlier
|        rename -- never twice) | held (another application already carries the new name) | not-found | unchecked (could not
|        be read). -WebAppId / -EngineAppId: client ids ('' = not known, no item); -SqlAdminSid: the SQL server's Entra admin
|        ('' = no item). -Done: object id -> UTC of an earlier rename by SecurityInsight (the install's record).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Graph, [AllowEmptyString()][string]$WebAppId = '', [AllowEmptyString()][string]$EngineAppId = '',
|          [AllowEmptyString()][string]$SqlAdminSid = '', [hashtable]$Done = @{})
|    $map = Get-SIDisplayNameRenames
|    $items = New-Object System.Collections.Generic.List[object]
|    $new = { param($r) [pscustomobject]@{ Role = $r.Role; Kind = $r.Kind; What = $r.What; Id = ''; AppId = ''; SpId = ''; SpName = ''; Old = $r.Old; New = $r.New; Current = ''; Action = ''; Line = '' } }
|    $decide = {
|        param($it)
|        if ($it.Current -ceq $it.New) { $it.Action = 'present'; $it.Line = ('{0} is already named "{1}"' -f $it.What, $it.New); return }
|        if ($it.Current -cne $it.Old) { $it.Action = 'kept'; $it.Line = ('{0} is named "{1}" (not SecurityInsight''s earlier name) -- kept as it is' -f $it.What, $it.Current); return }
|        if ($it.Id -and $Done.ContainsKey($it.Id)) { $it.Action = 'kept'; $it.Line = ('{0} was renamed to "{1}" on {2} and has been named "{3}" again since -- left as it is (never renamed twice)' -f $it.What, $it.New, $Done[$it.Id], $it.Old); return }
|        $it.Action = 'rename'; $it.Line = ('{0}: "{1}" -> "{2}"' -f $it.What, $it.Old, $it.New)
|    }
|    $readApp = {
|        param($r, [string]$appId)
|        $it = & $new $r; $it.AppId = $appId
|        try {
|            $a = & $Graph 'GET' ("https://graph.microsoft.com/v1.0/applications(appId='{0}')?`$select=id,appId,displayName" -f $appId) $null
|            if (-not $a -or -not [string](Get-SIDisplayNameProp $a 'id')) { $it.Action = 'not-found'; $it.Line = ('{0} (client id {1}) was not found -- nothing to rename' -f $it.What, $appId); return $it }
|            $it.Id = [string](Get-SIDisplayNameProp $a 'id'); $it.Current = [string](Get-SIDisplayNameProp $a 'displayName')
|            try {
|                $s = & $Graph 'GET' ("https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appId eq '{0}'&`$select=id,displayName" -f $appId) $null
|                $sp = @(Get-SIDisplayNameProp $s 'value' | Where-Object { $_ })[0]
|                if ($sp) { $it.SpId = [string](Get-SIDisplayNameProp $sp 'id'); $it.SpName = [string](Get-SIDisplayNameProp $sp 'displayName') }
|            } catch { }
|            & $decide $it
|        } catch {
|            $it.Action = 'unchecked'
|            $it.Line = ('{0} (client id {1}) could not be read ({2}) -- not renamed' -f $it.What, $appId, $(if ((Get-SIDisplayNameErrorKind $_.Exception.Message) -eq 'rights') { 'this identity may not read applications' } else { $_.Exception.Message }))
|        }
|        $it
|    }
|    $engine = $null
|    if ("$EngineAppId".Trim()) { $engine = & $readApp $map['EngineApp'] "$EngineAppId".Trim(); $items.Add($engine) }
|    if ("$WebAppId".Trim()) {
|        $web = & $readApp $map['WebSignInApp'] "$WebAppId".Trim()
|        if ($web.Action -eq 'rename') {
|            # another application already named "SecurityInsight" (not this one, not the engine's about to be renamed): HELD
|            try {
|                $f = [uri]::EscapeDataString(("displayName eq '{0}'" -f $web.New))
|                $same = @(Get-SIDisplayNameProp (& $Graph 'GET' ("https://graph.microsoft.com/v1.0/applications?`$filter=$f&`$select=id,appId,displayName") $null) 'value' | Where-Object { $_ })
|                $others = @($same | Where-Object { [string](Get-SIDisplayNameProp $_ 'appId') -ine $web.AppId -and -not ($engine -and $engine.Action -eq 'rename' -and [string](Get-SIDisplayNameProp $_ 'appId') -ieq $engine.AppId) })
|                if ($others.Count) {
|                    $web.Action = 'held'
|                    $web.Line = ('{0} is NOT renamed to "{1}": another application already has that name (client id {2}) -- rename that one first (setup\Set-SIDisplayNames.ps1 -EngineAppId <its client id>), or give it a name of your own' -f $web.What, $web.New, ((@($others | ForEach-Object { [string](Get-SIDisplayNameProp $_ 'appId') })) -join ', '))
|                }
|            } catch {
|                $web.Action = 'unchecked'; $web.Line = ('{0}: whether another application is already named "{1}" could not be read ({2}) -- not renamed' -f $web.What, $web.New, $_.Exception.Message)
|            }
|        }
|        $items.Add($web)
|    }
|    if ("$SqlAdminSid".Trim()) {
|        $r = $map['SqlAdminGroup']; $it = & $new $r
|        try {
|            $g = & $Graph 'GET' ("https://graph.microsoft.com/v1.0/groups/{0}?`$select=id,displayName,mailNickname" -f "$SqlAdminSid".Trim()) $null
|            if (-not $g -or -not [string](Get-SIDisplayNameProp $g 'id')) { $it.Action = 'not-found'; $it.Line = 'the SQL server''s Entra admin is not a group -- no admin group to rename' }
|            else {
|                $it.Id = [string](Get-SIDisplayNameProp $g 'id'); $it.Current = [string](Get-SIDisplayNameProp $g 'displayName')
|                $nick = [string](Get-SIDisplayNameProp $g 'mailNickname')
|                # only SecurityInsight's own group (its mailNickname, or one of its two names): a customer's own admin group is never touched
|                if ($nick -cne $r.Nick -and $it.Current -cne $r.Old -and $it.Current -cne $r.New) { $it.Action = 'kept'; $it.Line = ('the SQL server''s admin group is "{0}", a group of your own -- kept as it is' -f $it.Current) }
|                # framework §5.5 / §12.11c (Invardia, 2026-11-07): the SQL admin group's name is its STANDARD name
|                # grp-si-sql-admins, not a display name -- this step never renames it any more (it would undo the update's
|                # identity-names step, setup\_shared\SI-IdentityNamesStep.ps1, which renames it back in place with the SQL
|                # server's admin login)
|                elseif ($it.Current -ceq $r.Old) { $it.Action = 'present'; $it.Line = ('the SQL admin group has its standard name "{0}"' -f $r.Old) }
|                else { $it.Action = 'kept'; $it.Line = ('the SQL admin group is "{0}" -- the update''s identity-names step gives it its standard name "{1}" (not this step)' -f $it.Current, $r.Old) }
|            }
|        } catch {
|            # a 404 = the admin is not a group (a person, an application)
|            if ("$($_.Exception.Message)" -match '(?i)\b404\b|Request_ResourceNotFound|does not exist') { $it.Action = 'not-found'; $it.Line = 'the SQL server''s Entra admin is not a group -- no admin group to rename' }
|            else { $it.Action = 'unchecked'; $it.Line = ('the SQL admin group could not be read ({0}) -- not renamed' -f $(if ((Get-SIDisplayNameErrorKind $_.Exception.Message) -eq 'rights') { 'this identity may not read groups' } else { $_.Exception.Message })) }
|        }
|        $items.Add($it)
|    }
|    # one item per object, enumerated (callers wrap the call in @())
|    $items.ToArray()
|}
|
|function Set-SIDisplayNameOnObject {
|    <# One PATCH of displayName on -Path (applications/<id>, servicePrincipals/<id>, groups/<id>), then READ BACK (a few tries:
|       the directory replicates). $true = it reads back as -Name. Throws when the PATCH is refused. #>
|    param([Parameter(Mandatory)][scriptblock]$Graph, [Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Name, [scriptblock]$Sleep, [int[]]$Waits = @(0, 5, 10, 20))
|    $null = & $Graph 'PATCH' ("https://graph.microsoft.com/v1.0/{0}" -f $Path) (@{ displayName = $Name } | ConvertTo-Json -Compress)
|    foreach ($w in $Waits) {
|        if ($w) { if ($Sleep) { & $Sleep $w } else { Start-Sleep -Seconds $w } }
|        try { $b = & $Graph 'GET' ("https://graph.microsoft.com/v1.0/{0}?`$select=id,displayName" -f $Path) $null; if ([string](Get-SIDisplayNameProp $b 'displayName') -ceq $Name) { return $true } } catch { }
|    }
|    $false
|}
|
|function Invoke-SIDisplayNameRenames {
|    <#
|        THE RENAME, item by item (the plan of Get-SIDisplayNamePlan, in its order). Only items with Action 'rename', only with
|        -Apply. An application: the app registration, then its enterprise application (when it carries the earlier name); a
|        group: its display name (mailNickname never). Each change READ BACK; a change that does not read back -- or an
|        application whose enterprise application could not follow -- is PUT BACK to the earlier name and read back again.
|        A refusal names the rights it needs and the setup script that does it. Never throws.
|        Returns @{ Items (each + State: renamed | planned | failed | no-rights | put-back-failed, and Line); Lines; Done
|        (object id -> UTC for what was renamed now); Renamed (count) }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Graph, [AllowEmptyCollection()][object[]]$Plan = @(), [switch]$Apply, [scriptblock]$Sleep,
|          [string]$SetupCommand = '.\setup\Set-SIDisplayNames.ps1 -Apply', [datetime]$NowUtc = [datetime]::UtcNow)
|    $lines = New-Object System.Collections.Generic.List[string]; $done = @{}; $n = 0
|    $stamp = $NowUtc.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture)
|    $out = foreach ($it in @($Plan)) {
|        if (-not $it) { continue }
|        $o = [pscustomobject]@{ Role = $it.Role; Kind = $it.Kind; Id = $it.Id; Old = $it.Old; New = $it.New; Action = $it.Action; State = $it.Action; Line = $it.Line }
|        if ($it.Action -ne 'rename') { $o; continue }
|        if (-not $Apply) { $o.State = 'planned'; $o.Line = 'would rename ' + $it.Line; $lines.Add($o.Line); $o; continue }
|        $root = if ($it.Kind -eq 'application') { 'applications/' + $it.Id } else { 'groups/' + $it.Id }
|        $changed = @()
|        try {
|            if (-not (Set-SIDisplayNameOnObject -Graph $Graph -Path $root -Name $it.New -Sleep $Sleep)) { $changed += $root; throw 'it did not read back under the new name' }
|            $changed += $root
|            if ($it.Kind -eq 'application' -and $it.SpId -and $it.SpName -ceq $it.Old) {
|                $spPath = 'servicePrincipals/' + $it.SpId
|                if (-not (Set-SIDisplayNameOnObject -Graph $Graph -Path $spPath -Name $it.New -Sleep $Sleep)) { $changed += $spPath; throw 'its enterprise application did not read back under the new name' }
|                $changed += $spPath
|            }
|            $o.State = 'renamed'; $o.Line = 'renamed ' + $it.Line + ', read back'; $done[$it.Id] = $stamp; $n++
|        } catch {
|            $why = [string]$_.Exception.Message
|            $kind = Get-SIDisplayNameErrorKind $why
|            # PUT BACK: everything this item changed returns to the earlier name (never half-renamed)
|            $back = $true
|            foreach ($p in @($changed)) { try { if (-not (Set-SIDisplayNameOnObject -Graph $Graph -Path $p -Name $it.Old -Sleep $Sleep)) { $back = $false } } catch { $back = $false } }
|            if (-not $back) { $o.State = 'put-back-failed'; $o.Line = ('{0} could NOT be renamed ({1}) and could not be put back to "{2}" either -- check it in the Entra admin center' -f $it.What, $why, $it.Old) }
|            elseif ($kind -eq 'rights') { $o.State = 'no-rights'; $o.Line = ('{0} is NOT renamed: this identity may not change it. It needs {1}. An administrator renames it with: {2}' -f $it.What, (Get-SIDisplayNameRightsText -Kind $it.Kind), $SetupCommand) }
|            else { $o.State = 'failed'; $o.Line = ('{0} is NOT renamed ({1}){2}' -f $it.What, $why, $(if (@($changed).Count) { ' -- put back to "' + $it.Old + '"' } else { '' })) }
|        }
|        $lines.Add($o.Line)
|        $o
|    }
|    [pscustomobject]@{ Items = @($out); Lines = $lines.ToArray(); Done = $done; Renamed = $n }
|}
|
|function ConvertFrom-SIDisplayNamesRecord {
|    <# PURE. The record cfg.InstallState 'DisplayNames' (compact JSON: object id -> UTC) as a hashtable; empty when none / not JSON. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    $h = @{}
|    if (-not "$Value".Trim()) { return $h }
|    try { $o = "$Value" | ConvertFrom-Json -ErrorAction Stop } catch { return $h }
|    # PowerShell 7's ConvertFrom-Json turns an ISO date string into a [datetime]: written back as the same UTC text
|    if ($o -is [System.Management.Automation.PSCustomObject]) {
|        foreach ($p in $o.PSObject.Properties) {
|            $val = if ($p.Value -is [datetime]) { $p.Value.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) } else { "$($p.Value)".Trim() }
|            if ($val) { $h[$p.Name] = $val }
|        }
|    }
|    $h
|}
|
|function Get-SIDisplayNamesRecordSql {
|    <# PURE. -Read: the stored record (one value or no row); else the upsert of @Value (the whole record) by @By. #>
|    param([switch]$Read)
|    if ($Read) { return "IF OBJECT_ID('cfg.InstallState') IS NOT NULL SELECT Value FROM cfg.InstallState WHERE Name = N'DisplayNames';" }
|    @'
|IF OBJECT_ID('cfg.InstallState') IS NOT NULL
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N'DisplayNames')
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'DisplayNames';
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'DisplayNames', @Value, NULL, @By);
|    COMMIT;
|END
|'@
|}
|
|function Merge-SIDisplayNamesRecord {
|    <# PURE. -Current (the record) with -Done (what was renamed now) added; an id renamed before keeps its first date. Compact JSON. #>
|    param([hashtable]$Current = @{}, [hashtable]$Done = @{})
|    $m = [ordered]@{}
|    foreach ($k in @($Current.Keys | Sort-Object)) { $m[$k] = $Current[$k] }
|    foreach ($k in @($Done.Keys | Sort-Object)) { if (-not $m.Contains($k)) { $m[$k] = $Done[$k] } }
|    $m | ConvertTo-Json -Compress
|}
'@ }
$__siSupportFiles['pro-management/deploy/SI-SigninFrontPlan.ps1'] = @{ Sha256 = '336bc61ec927af7ffc336373d9a5c2f2345fe80cf836a44064b0e332da8d6a44'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- THE WEB APP BEHIND THE ONE SHARED SIGN-IN FRONT (CR7, framework DOCS/REQUIREMENTS.md 12.11g). PURE.
|
|    The front is FRAMEWORK/signin-front -- ONE component PIM and SecurityInsight both build from one source path, pinned by
|    version (pro-management\signin-front.pin.json). It runs as a SIDECAR container in the SAME Container App revision as the
|    web app and is the only container the ingress reaches; the web app listens on 127.0.0.1:<upstream port> and verifies the
|    front's token on every request (SI.Management.Web, Auth\SigninFront.cs, switch SI_Web_SigninFront).
|
|    This file holds the PURE half -- read the pin, find the component's source, the image tag, the settings of both
|    containers, the template PATCH that adds / keeps / removes the front, and the read-back check. No HTTP, no sign-in, no
|    dependency: the setup cutover (SI-ManagementSigninFront.ps1, Deploy-SIManagement.ps1 -SigninFront,
|    setup\Set-SISigninFront.ps1) and the updater (container\updater\_shared\SI-UpdaterWebApp.ps1, from the release) both load
|    it. Strict-mode safe; PS 5.1 + pwsh 7.
|
|    SWITCH OFF (the default): none of this runs -- the web app is one container exactly as before.
|#>
|
|# #852: what the front 1.3.0 needs before it starts (its SQL store + Key Vault key) -- SI-SigninFrontStore.ps1, beside this file
|$siSigninStoreLib = [IO.Path]::Combine($PSScriptRoot, 'SI-SigninFrontStore.ps1')
|if ((Test-Path -LiteralPath $siSigninStoreLib) -and -not (Get-Command -Name Test-SISigninFrontNeedsStore -ErrorAction SilentlyContinue)) { . $siSigninStoreLib }
|# #852: the web app's own API the front 1.4.0 asks an access token for (SIGNIN_UPSTREAM_SCOPE) -- SI-SigninFrontApi.ps1
|$siSigninApiLib = [IO.Path]::Combine($PSScriptRoot, 'SI-SigninFrontApi.ps1')
|if ((Test-Path -LiteralPath $siSigninApiLib) -and -not (Get-Command -Name Invoke-SISigninFrontApi -ErrorAction SilentlyContinue)) { . $siSigninApiLib }
|
|$script:SISigninFrontSwitch = 'SI_Web_SigninFront'
|$script:SISigninFrontWebSettings = @('SI_Web_SigninFront', 'SIGNIN_UPSTREAM_PORT')
|# Container Apps on the Consumption profile: at most 4 CPU / 8 GiB for ALL containers of a revision together
|$script:SISigninFrontAppMaxCpu = 4.0
|$script:SISigninFrontAppMaxMemoryGi = 8.0
|# The health probes of the front container (the only container the ingress reaches; the web app has none on its own port).
|# Live 2026-11-05: the probes were sent without times, so Kubernetes' defaults applied (timeout 1 s, failure after 3) and while
|# an update changed the database the serving revision failed BOTH ("timeout in 1 seconds"). The front's GET /healthz needs no
|# database and no dependency (its README: "/healthz stays up so the platform does not restart-loop it"), so a probe only
|# fails when the process itself does not answer: liveness after 6 misses of 10 s (a minute), each given 5 s; readiness the
|# same, so a busy moment never takes the ONLY replica out of rotation (the web app answers "being updated" meanwhile).
|$script:SISigninFrontProbeSettings = [ordered]@{ timeoutSeconds = 5; periodSeconds = 10; failureThreshold = 6 }
|
|function Get-SISigninFrontPin {
|    <# PURE (reads one shipped file). The pinned component (pro-management\signin-front.pin.json under -SIRoot). Throws when
|       the file is missing or not the expected shape. #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $p = [IO.Path]::Combine($SIRoot, 'pro-management', 'signin-front.pin.json')
|    if (-not (Test-Path -LiteralPath $p)) { throw ('The sign-in front pin is missing: {0}' -f $p) }
|    $j = [IO.File]::ReadAllText($p).TrimStart([char]0xFEFF) | ConvertFrom-Json
|    foreach ($k in 'component', 'version', 'state', 'image', 'dockerfile', 'containerName', 'listenPort', 'upstreamPort', 'sessionHours', 'bearerPaths') {
|        if (-not $j.PSObject.Properties[$k] -or "$($j.$k)".Trim() -eq '') { throw ('The sign-in front pin has no {0}: {1}' -f $k, $p) }
|    }
|    if ("$($j.version)" -notmatch '^\d+\.\d+\.\d+$') { throw ('The sign-in front pin''s version is not x.y.z: {0}' -f $j.version) }
|    if ("$($j.state)" -notin 'contract', 'pinned') { throw ('The sign-in front pin''s state is neither contract nor pinned: {0}' -f $j.state) }
|    if ("$($j.state)" -eq 'pinned' -and "$($j.commit)" -notmatch '^[0-9a-f]{7,40}$') { throw 'The sign-in front pin is pinned without a commit.' }
|    if ([int]$j.upstreamPort -eq [int]$j.listenPort) { throw 'The sign-in front pin gives the front and the web app the same port.' }
|    # the link paths (CR7, Option A): validated exactly as the front validates SIGNIN_ANONYMOUS_PATHS -- an invalid entry
|    # would stop the front's container at start, so setup never writes one
|    $ap = $(if ($j.PSObject.Properties['anonymousPaths']) { [string]$j.anonymousPaths } else { '' })
|    $chk = Test-SISigninFrontAnonymousPaths -Value $ap -BearerPaths ([string]$j.bearerPaths)
|    if (-not $chk.Ok) { throw ('The sign-in front pin''s anonymousPaths is not valid: {0}' -f $chk.Why) }
|    $j
|}
|
|function Test-SISigninFrontAnonymousPaths {
|    <#
|        PURE. SIGNIN_ANONYMOUS_PATHS as signin-front 1.1.0 reads it (its README "Open paths"): comma-separated, whitespace
|        around an entry ignored, empty = no open path. Each entry starts with "/", one trailing "/" is trimmed; refused: an
|        empty entry, "/" alone, "*", "?", "..", braces, spaces, and anything equal to or under /signout, /signin-oidc,
|        /signout-callback-oidc, /healthz or a bearer path. Matching
|        is case-insensitive, so the comparisons here are too. Returns @{ Ok; Why; Paths (normalised); Value (the line to
|        write: the normalised entries joined with ",") }.
|    #>
|    param([AllowEmptyString()][string]$Value, [AllowEmptyString()][string]$BearerPaths = '/mcp,/.well-known')
|    $reserved = @('/signout', '/signin-oidc', '/signout-callback-oidc', '/healthz') + @("$BearerPaths" -split ',' | ForEach-Object { $_.Trim().TrimEnd('/') } | Where-Object { $_ })
|    $paths = New-Object System.Collections.Generic.List[string]
|    if ("$Value".Trim() -eq '') { return [pscustomobject]@{ Ok = $true; Why = ''; Paths = @(); Value = '' } }
|    foreach ($raw in @("$Value" -split ',')) {
|        $e = $raw.Trim()
|        if ($e -eq '') { return [pscustomobject]@{ Ok = $false; Why = 'an empty entry'; Paths = @(); Value = '' } }
|        if ($e.Length -gt 1 -and $e.EndsWith('/')) { $e = $e.Substring(0, $e.Length - 1) }
|        $bad = $(
|            if (-not $e.StartsWith('/')) { 'does not start with "/"' }
|            elseif ($e -eq '/') { 'is "/" alone' }
|            elseif ($e.Contains('*') -or $e.Contains('?')) { 'holds "*" or "?"' }
|            elseif ($e.Contains('..')) { 'holds ".."' }
|            elseif ($e.Contains('{') -or $e.Contains('}')) { 'holds a brace' }
|            elseif ($e -match '\s') { 'holds a space' }
|            elseif ($e.Contains('//')) { 'is not one clean path' }
|            else {
|                $hit = @($reserved | Where-Object { $e.Equals($_, [StringComparison]::OrdinalIgnoreCase) -or $e.StartsWith($_ + '/', [StringComparison]::OrdinalIgnoreCase) }) | Select-Object -First 1
|                if ($hit) { 'is ' + $hit + ' or under it (the front''s own path)' } else { '' }
|            })
|        if ($bad) { return [pscustomobject]@{ Ok = $false; Why = ('"{0}" {1}' -f $raw.Trim(), $bad); Paths = @(); Value = '' } }
|        if (-not @($paths | Where-Object { $_.Equals($e, [StringComparison]::OrdinalIgnoreCase) }).Count) { $paths.Add($e) }
|    }
|    [pscustomobject]@{ Ok = $true; Why = ''; Paths = $paths.ToArray(); Value = ($paths -join ',') }
|}
|
|function Get-SISigninFrontAnonymousPathsValue {
|    <# PURE. The SIGNIN_ANONYMOUS_PATHS line SecurityInsight writes on the front: exactly the pin's list, normalised. #>
|    param([Parameter(Mandatory)]$Pin)
|    $ap = $(if ($Pin.PSObject.Properties['anonymousPaths']) { [string]$Pin.anonymousPaths } else { '' })
|    $r = Test-SISigninFrontAnonymousPaths -Value $ap -BearerPaths ([string]$Pin.bearerPaths)
|    if (-not $r.Ok) { throw ('The sign-in front pin''s anonymousPaths is not valid: {0}' -f $r.Why) }
|    $r.Value
|}
|
|function Resolve-SISigninFrontSource {
|    <#
|        PURE (reads the disk). Where the component's source is, for -SIRoot:
|          a release      <SIRoot>\pro-management\signin-front\   (Publish-SIRelease.ps1 packs the pinned tree there)
|          the repository <SIRoot>\..\..\FRAMEWORK\signin-front\  (SOLUTIONS\SecurityInsight -> the repo root)
|          the vendored   <SIRoot>\vendor\signin-front\           (#1061, framework PUB-FRONT: the Community release carries
|                         copy                                     FRAMEWORK/signin-front/{src,VERSION} at the pin) -- used ONLY
|                                                                  when FRAMEWORK/signin-front is not there
|        It is usable only when its VERSION is the pinned version and it has its Dockerfile.
|        Returns @{ Ok; Path; BuildPath; Version; Why; Source ('release' / 'framework' / 'vendor' / '') }.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)]$Pin)
|    $fw = [IO.Path]::GetFullPath([IO.Path]::Combine($SIRoot, '..', '..', ($Pin.component -replace '/', [IO.Path]::DirectorySeparatorChar)))
|    $cands = @(
|        @{ P = [IO.Path]::Combine($SIRoot, 'pro-management', 'signin-front'); S = 'release' },
|        @{ P = $fw; S = 'framework' }
|    )
|    if (-not (Test-Path -LiteralPath $fw -PathType Container)) { $cands += @{ P = [IO.Path]::Combine($SIRoot, 'vendor', 'signin-front'); S = 'vendor' } }
|    $why = New-Object System.Collections.Generic.List[string]
|    foreach ($cand in $cands) {
|        $c = $cand.P
|        if (-not (Test-Path -LiteralPath $c -PathType Container)) { continue }
|        $vf = [IO.Path]::Combine($c, 'VERSION')
|        $v = if (Test-Path -LiteralPath $vf) { ([IO.File]::ReadAllText($vf)).Trim() } else { '' }
|        if ($v -ne [string]$Pin.version) { $why.Add(('{0} is version "{1}", not the pinned {2}' -f $c, $v, $Pin.version)); continue }
|        # the image's build context (README: FRAMEWORK/signin-front/src) and its Dockerfile inside it
|        $ctx = $(if ($Pin.PSObject.Properties['context'] -and "$($Pin.context)".Trim()) { [IO.Path]::Combine($c, "$($Pin.context)".Trim()) } else { $c })
|        if (-not (Test-Path -LiteralPath ([IO.Path]::Combine($ctx, [string]$Pin.dockerfile)))) { $why.Add(('{0} has no {1}' -f $ctx, $Pin.dockerfile)); continue }
|        return [pscustomobject]@{ Ok = $true; Path = $c; BuildPath = $ctx; Version = $v; Why = ''; Source = $cand.S }
|    }
|    if (-not $why.Count) { $why.Add(('the component {0} {1} is not in this release or tree (pin state: {2})' -f $Pin.component, $Pin.version, $Pin.state)) }
|    [pscustomobject]@{ Ok = $false; Path = ''; BuildPath = ''; Version = ''; Why = ($why -join '; '); Source = '' }
|}
|
|function Get-SISigninFrontImageTag {
|    <# PURE. The front's image tag: <version>-src-<16 hex of its sources> when the source hash is at hand (the fast roll's
|       Get-SISourceHash), else <version>. The same source gives the same tag: an unchanged front is never rebuilt or rolled. #>
|    param([Parameter(Mandatory)]$Pin, [string]$SourcePath = '')
|    $v = [string]$Pin.version
|    if ($SourcePath -and (Get-Command -Name Get-SISourceHash -ErrorAction SilentlyContinue)) {
|        $h = ''; try { $h = [string](Get-SISourceHash -Root $SourcePath -Paths @('.')) } catch { $h = '' }
|        if ($h.Length -ge 16) { return ('{0}-src-{1}' -f $v, $h.Substring(0, 16)) }
|    }
|    $v
|}
|
|function Get-SISigninFrontEnv {
|    <# PURE. The front container's settings (the component's README is the truth for the names). No secret: the client
|       assertion is the web app's managed identity as a federated credential on the SAME app registration. #>
|    param([Parameter(Mandatory)][string]$TenantId, [Parameter(Mandatory)][string]$ClientId, [Parameter(Mandatory)][string]$ManagedIdentityClientId,
|          [Parameter(Mandatory)]$Pin,
|          # #852: the front's store settings (SIGNIN_SQL_SERVER / _DATABASE / SIGNIN_KEYVAULT_KEY_ID / SIGNIN_STATE_MI_CLIENT_ID)
|          # from Invoke-SISigninFrontStore; not passed = the ones the update's step 9g made ready in this process, if any
|          [string[]]$StoreEnv = $null)
|    $store = @(Get-SISigninFrontStoreEnvInUse -StoreEnv $StoreEnv)
|    @(
|        ('SIGNIN_TENANT_ID={0}' -f $TenantId.Trim().ToLowerInvariant()),
|        ('SIGNIN_CLIENT_ID={0}' -f $ClientId.Trim().ToLowerInvariant()),
|        ('SIGNIN_FIC_MI_CLIENT_ID={0}' -f $ManagedIdentityClientId.Trim().ToLowerInvariant()),
|        ('SIGNIN_UPSTREAM_PORT={0}' -f [int]$Pin.upstreamPort),
|        ('SIGNIN_SESSION_HOURS={0}' -f [int]$Pin.sessionHours),
|        ('SIGNIN_BEARER_PATHS={0}' -f [string]$Pin.bearerPaths),
|        # CR7 Option A: the link pages the web app guards itself (its own single-use, short-lived, target-bound token)
|        ('SIGNIN_ANONYMOUS_PATHS={0}' -f (Get-SISigninFrontAnonymousPathsValue -Pin $Pin))
|    ) + $store
|}
|
|function Get-SISigninFrontStoreEnvInUse {
|    <# #852. The front's store settings to write: -StoreEnv when given, else the ones the update's step 9g made ready in
|       THIS process ($global:SI_SigninFrontStoreEnv, set only when every piece read back), else none. #>
|    param([string[]]$StoreEnv = $null)
|    if ($null -ne $StoreEnv) { return @($StoreEnv | Where-Object { "$_".Trim() }) }
|    $g = Get-Variable -Scope Global -Name SI_SigninFrontStoreEnv -ValueOnly -ErrorAction Ignore
|    if ($g) { return @(@($g) | Where-Object { "$_".Trim() }) }
|    @()
|}
|
|function Test-SISigninFrontStoreReady {
|    <# #852. PURE. May the pinned front run with these settings? A front before 1.3.0: always. 1.3.0 on: only with every
|       required store setting (-Env: 'N=V' lines or ARM env entries). #>
|    param([Parameter(Mandatory)]$Pin, [AllowNull()][object[]]$Env)
|    if (-not (Get-Command -Name Test-SISigninFrontNeedsStore -ErrorAction SilentlyContinue)) { return $true }
|    if (-not (Test-SISigninFrontNeedsStore -Pin $Pin)) { return $true }
|    Test-SISigninStoreEnvComplete -Env $Env
|}
|
|function Get-SISigninFrontWebEnv {
|    <# PURE. The web container's settings behind the front: the switch on, the loopback port. #>
|    param([Parameter(Mandatory)]$Pin)
|    @(('{0}=true' -f $script:SISigninFrontSwitch), ('SIGNIN_UPSTREAM_PORT={0}' -f [int]$Pin.upstreamPort))
|}
|
|function Get-SISigninFrontProp {
|    <# PURE. A nested property of an ARM object (PSCustomObject or dictionary), $null when any step is missing. #>
|    param($Object, [string[]]$Path)
|    $o = $Object
|    foreach ($p in $Path) {
|        if ($null -eq $o) { return $null }
|        if ($o -is [System.Collections.IDictionary]) { $o = $(if ($o.Contains($p)) { $o[$p] } else { $null }); continue }
|        $pp = $o.PSObject.Properties[$p]
|        $o = $(if ($pp) { $pp.Value } else { $null })
|    }
|    $o
|}
|
|function Get-SISigninFrontProbes {
|    <# PURE. The front container's probes (ARM shape): Liveness + Readiness, GET /healthz on the front's port, with the times of
|       $script:SISigninFrontProbeSettings -- never Kubernetes' defaults (1 s). #>
|    param([Parameter(Mandatory)][int]$Port)
|    $one = { param($type)
|        $p = [ordered]@{ type = $type; httpGet = [ordered]@{ path = '/healthz'; port = $Port } }
|        foreach ($k in $script:SISigninFrontProbeSettings.Keys) { $p[$k] = [int]$script:SISigninFrontProbeSettings[$k] }
|        $p }
|    # emitted one by one (a caller's @() or assignment gets the two probes, never an array in an array)
|    & $one 'Liveness'
|    & $one 'Readiness'
|}
|
|function Test-SISigninFrontProbes {
|    <# PURE. Does -Container (ARM, as read or as built) carry the front's probes (Get-SISigninFrontProbes) -- each type once, its
|       path, port and times? Fields ARM adds on its own (scheme, successThreshold, initialDelaySeconds) are not compared.
|       Returns @{ Ok; Why }. #>
|    param([AllowNull()]$Container, [Parameter(Mandatory)][int]$Port)
|    $have = @(@(Get-SISigninFrontProp $Container @('probes')) | Where-Object { $_ })
|    foreach ($want in (Get-SISigninFrontProbes -Port $Port)) {
|        $p = @($have | Where-Object { [string](Get-SISigninFrontProp $_ @('type')) -eq $want.type })
|        if ($p.Count -ne 1) { return [pscustomobject]@{ Ok = $false; Why = ('the front has {0} {1} probe(s), not one' -f $p.Count, $want.type) } }
|        $p = $p[0]
|        if ([string](Get-SISigninFrontProp $p @('httpGet', 'path')) -ne '/healthz' -or [int](0 + (Get-SISigninFrontProp $p @('httpGet', 'port'))) -ne $Port) {
|            return [pscustomobject]@{ Ok = $false; Why = ('the front''s {0} probe does not ask GET /healthz on port {1}' -f $want.type, $Port) }
|        }
|        foreach ($k in $script:SISigninFrontProbeSettings.Keys) {
|            $v = [int](0 + (Get-SISigninFrontProp $p @($k)))
|            if ($v -ne [int]$want[$k]) { return [pscustomobject]@{ Ok = $false; Why = ('the front''s {0} probe has {1} {2}, not {3}' -f $want.type, $k, $(if ($v) { $v } else { '(not set)' }), $want[$k]) } }
|        }
|    }
|    [pscustomobject]@{ Ok = $true; Why = '' }
|}
|
|function Get-SISigninFrontState {
|    <# PURE. What the app (ARM, as read) runs: @{ HasFront; FrontImage; WebOn (the switch on the web container); WebImage;
|       TargetPort; Containers }. The web container is the FIRST one (every other SI tool points at containers[0]). #>
|    param([AllowNull()]$App, [string]$ContainerName = 'signin-front')
|    $cs = @(@(Get-SISigninFrontProp $App @('properties', 'template', 'containers')) | Where-Object { $_ })
|    $web = $(if ($cs.Count) { $cs[0] } else { $null })
|    $front = @($cs | Where-Object { [string](Get-SISigninFrontProp $_ @('name')) -eq $ContainerName }) | Select-Object -First 1
|    $on = $false
|    foreach ($e in @(@(Get-SISigninFrontProp $web @('env')) | Where-Object { $_ })) {
|        if ([string](Get-SISigninFrontProp $e @('name')) -eq $script:SISigninFrontSwitch) { $on = ("$(Get-SISigninFrontProp $e @('value'))".Trim() -match '^(?i:true|1|on|yes)$') }
|    }
|    # the front's SIGNIN_ANONYMOUS_PATHS as it runs ($null = not set)
|    $anon = $null
|    foreach ($e in @(@(Get-SISigninFrontProp $front @('env')) | Where-Object { $_ })) {
|        if ([string](Get-SISigninFrontProp $e @('name')) -eq 'SIGNIN_ANONYMOUS_PATHS') { $anon = [string](Get-SISigninFrontProp $e @('value')) }
|    }
|    [pscustomobject]@{
|        HasFront   = [bool]$front
|        FrontImage = [string](Get-SISigninFrontProp $front @('image'))
|        WebOn      = $on
|        WebImage   = [string](Get-SISigninFrontProp $web @('image'))
|        TargetPort = [int](0 + (Get-SISigninFrontProp $App @('properties', 'configuration', 'ingress', 'targetPort')))
|        Containers = $cs.Count
|        MaxReplicas = [int](0 + (Get-SISigninFrontProp $App @('properties', 'template', 'scale', 'maxReplicas')))
|        MinReplicas = [int](0 + (Get-SISigninFrontProp $App @('properties', 'template', 'scale', 'minReplicas')))
|        AnonymousPaths = $anon
|    }
|}
|
|function ConvertTo-SISigninFrontPlain {
|    <# PURE. An ARM object read back (PSCustomObject) as ordered dictionaries + arrays, so it can be changed and sent back. #>
|    param($InputObject)
|    if ($null -eq $InputObject) { return $null }
|    if ($InputObject -is [string] -or $InputObject -is [ValueType]) { return $InputObject }
|    if ($InputObject -is [System.Collections.IDictionary]) { $h = [ordered]@{}; foreach ($k in @($InputObject.Keys)) { $h[[string]$k] = ConvertTo-SISigninFrontPlain $InputObject[$k] }; return $h }
|    if ($InputObject -is [System.Collections.IEnumerable]) { $l = New-Object System.Collections.Generic.List[object]; foreach ($i in $InputObject) { $l.Add((ConvertTo-SISigninFrontPlain $i)) }; return , $l.ToArray() }
|    $h = [ordered]@{}; foreach ($pp in $InputObject.PSObject.Properties) { $h[$pp.Name] = ConvertTo-SISigninFrontPlain $pp.Value }; $h
|}
|
|function ConvertTo-SISigninFrontEnvEntry {
|    <# PURE. 'N=V' as an ARM env entry. #>
|    param([Parameter(Mandatory)][string]$Setting)
|    $p = $Setting -split '=', 2
|    [ordered]@{ name = $p[0]; value = $(if ($p.Count -gt 1) { $p[1] } else { '' }) }
|}
|
|function Set-SISigninFrontEnvList {
|    <# PURE. -Env (ARM env entries) with -Set ('N=V', set / overwritten by name) and -Remove (names) applied. #>
|    param([AllowNull()][object[]]$Env, [string[]]$Set = @(), [string[]]$Remove = @())
|    $list = New-Object System.Collections.Generic.List[object]
|    foreach ($e in @(@($Env) | Where-Object { $_ })) { if ($Remove -notcontains [string](Get-SISigninFrontProp $e @('name'))) { $list.Add($e) } }
|    foreach ($s in @($Set | Where-Object { $_ })) {
|        $n = ConvertTo-SISigninFrontEnvEntry -Setting $s
|        $i = -1; for ($k = 0; $k -lt $list.Count; $k++) { if ([string](Get-SISigninFrontProp $list[$k] @('name')) -eq $n.name) { $i = $k } }
|        if ($i -ge 0) { $list[$i] = $n } else { $list.Add($n) }
|    }
|    , $list.ToArray()
|}
|
|function ConvertTo-SISigninFrontGi {
|    param([AllowEmptyString()][string]$Memory)
|    $m = [regex]::Match("$Memory", '^\s*([0-9]+(?:\.[0-9]+)?)\s*Gi\s*$')
|    if ($m.Success) { return [double]::Parse($m.Groups[1].Value, [Globalization.CultureInfo]::InvariantCulture) }
|    0.0
|}
|
|function Clear-SISigninFrontTemplate {
|    <# PURE. What ARM refuses to take back: the revision suffix (a reused one), the default imageType, ephemeralStorage. #>
|    param([Parameter(Mandatory)]$Template)
|    foreach ($c in @(@($(if ($Template.Contains('containers')) { $Template.containers })) + @($(if ($Template.Contains('initContainers')) { $Template.initContainers })) | Where-Object { $_ })) {
|        if ($c.Contains('imageType') -and ([string]$c.imageType -in '', 'ContainerImage')) { $c.Remove('imageType') }
|        if ($c.Contains('resources') -and $c.resources -is [System.Collections.IDictionary] -and $c.resources.Contains('ephemeralStorage')) { $c.resources.Remove('ephemeralStorage') }
|    }
|    if ($Template.Contains('revisionSuffix')) { $Template.Remove('revisionSuffix') }
|}
|
|function New-SISigninFrontPatch {
|    <#
|        PURE. The ONE read-modify-write PATCH that puts the front in front of the web app (-App, as read), or keeps it current:
|          * the web container stays FIRST (its image untouched), its settings gain SI_Web_SigninFront=true + the port;
|          * the front container (-FrontImage, -FrontEnv) is added second -- or, already there, gets that image and settings;
|          * the app's CPU / memory stay within what one revision takes: the web container gives the front its share
|            (4 CPU / 8 GiB together on Consumption);
|          * the ingress targets the front's port (the only container the ingress reaches).
|        Every other container, the scale, the volumes and the configuration's other parts are sent as read. Returns
|        @{ Body; Changed }.
|    #>
|    param([Parameter(Mandatory)]$App, [Parameter(Mandatory)][string]$FrontImage, [Parameter(Mandatory)][AllowEmptyCollection()][string[]]$FrontEnv, [Parameter(Mandatory)]$Pin)
|    $tpl = ConvertTo-SISigninFrontPlain (Get-SISigninFrontProp $App @('properties', 'template'))
|    if ($null -eq $tpl -or -not $tpl.Contains('containers') -or -not @($tpl.containers | Where-Object { $_ }).Count) { throw 'The web app has no container to put the sign-in front in front of.' }
|    # compared after the read-only parts ARM returns are dropped: only a real change counts
|    Clear-SISigninFrontTemplate -Template $tpl
|    $cs = @($tpl.containers | Where-Object { $_ })
|    $before = ConvertTo-Json -InputObject $tpl -Depth 60 -Compress
|    $web = $cs[0]
|    $web.env = Set-SISigninFrontEnvList -Env @($(if ($web.Contains('env')) { $web.env })) -Set (Get-SISigninFrontWebEnv -Pin $Pin)
|    $name = [string]$Pin.containerName
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $fCpu = [double]::Parse([string]$Pin.cpu, $inv); $fMem = ConvertTo-SISigninFrontGi ([string]$Pin.memory)
|    $front = @($cs | Where-Object { [string]$_.name -eq $name }) | Select-Object -First 1
|    # #852: a front that needs its store (1.3.0 on) is never put in without its settings -- it would refuse to start
|    $storeHave = @($FrontEnv) + @($(if ($front -and $front.Contains('env')) { @($front.env) | Where-Object { $_ } | ForEach-Object { '{0}={1}' -f $_.name, $_.value } }))
|    if (-not (Test-SISigninFrontStoreReady -Pin $Pin -Env $storeHave)) {
|        return [pscustomobject]@{ Body = $null; Changed = $false; Why = ('the sign-in front {0} needs its SQL store and Key Vault key settings, and they are not ready' -f $Pin.version) }
|    }
|    if ($front) {
|        $front.image = $FrontImage
|        $front.env = Set-SISigninFrontEnvList -Env @($(if ($front.Contains('env')) { $front.env })) -Set $FrontEnv
|        # the probes with realistic times (2026-11-05), put right on a front that has the old ones
|        if (-not (Test-SISigninFrontProbes -Container $front -Port ([int]$Pin.listenPort)).Ok) { $front.probes = Get-SISigninFrontProbes -Port ([int]$Pin.listenPort) }
|    } else {
|        $front = [ordered]@{ name = $name; image = $FrontImage; env = (Set-SISigninFrontEnvList -Env @() -Set $FrontEnv)
|                             resources = [ordered]@{ cpu = $fCpu; memory = [string]$Pin.memory }
|                             # README 1.0.0: the health probe is the front's GET /healthz (the app gets none on its own port)
|                             probes = (Get-SISigninFrontProbes -Port ([int]$Pin.listenPort)) }
|        $cs = @($cs) + @($front)
|    }
|    # the revision's total stays within the profile: the web container gives up what the front takes
|    $otherCpu = 0.0; $otherMem = 0.0
|    for ($i = 1; $i -lt $cs.Count; $i++) {
|        $r = $cs[$i].resources
|        if ($r) { try { $otherCpu += [double]::Parse([string]$r.cpu, $inv) } catch { }; $otherMem += ConvertTo-SISigninFrontGi ([string]$r.memory) }
|    }
|    if ($web.Contains('resources') -and $web.resources) {
|        $wCpu = 0.0; try { $wCpu = [double]::Parse([string]$web.resources.cpu, $inv) } catch { }
|        $wMem = ConvertTo-SISigninFrontGi ([string]$web.resources.memory)
|        if ($wCpu + $otherCpu -gt $script:SISigninFrontAppMaxCpu -or $wMem + $otherMem -gt $script:SISigninFrontAppMaxMemoryGi) {
|            $nCpu = [Math]::Min($wCpu, $script:SISigninFrontAppMaxCpu - $otherCpu); $nMem = [Math]::Min($wMem, $script:SISigninFrontAppMaxMemoryGi - $otherMem)
|            $web.resources.cpu = $nCpu; $web.resources.memory = ('{0}Gi' -f $nMem.ToString($inv))
|        }
|    }
|    $cs[0] = $web
|    $tpl.containers = $cs
|    # ONE replica (signin-front 1.0.0 README: the cookie keys and the token cache are in memory -- a second replica would
|    # sign users in again on every switch between replicas)
|    if (-not $tpl.Contains('scale') -or -not ($tpl.scale -is [System.Collections.IDictionary])) { $tpl.scale = [ordered]@{} }
|    $tpl.scale.maxReplicas = 1
|    $tpl.scale.minReplicas = 1
|    Clear-SISigninFrontTemplate -Template $tpl
|    $after = ConvertTo-Json -InputObject $tpl -Depth 60 -Compress
|    $port = [int]$Pin.listenPort
|    $ingressChanged = ([int](0 + (Get-SISigninFrontProp $App @('properties', 'configuration', 'ingress', 'targetPort'))) -ne $port)
|    $body = [ordered]@{ properties = [ordered]@{ template = $tpl } }
|    if ($ingressChanged) { $body.properties.configuration = [ordered]@{ ingress = [ordered]@{ targetPort = $port } } }
|    [pscustomobject]@{ Body = $body; Changed = ($ingressChanged -or $before -ne $after); Why = '' }
|}
|
|function New-SISigninFrontImagePatch {
|    <# PURE. The updater's change on an app that IS behind the front: only the front container's image set to -FrontImage
|       (its settings, the web container and everything else sent as read). $null when the app has no front or runs that
|       image already -- the updater never adds or removes the front. #>
|    param([Parameter(Mandatory)]$App, [Parameter(Mandatory)][string]$FrontImage, [Parameter(Mandatory)]$Pin)
|    $tpl = ConvertTo-SISigninFrontPlain (Get-SISigninFrontProp $App @('properties', 'template'))
|    if ($null -eq $tpl -or -not $tpl.Contains('containers')) { return $null }
|    $front = @($tpl.containers | Where-Object { $_ -and [string]$_.name -eq [string]$Pin.containerName }) | Select-Object -First 1
|    if (-not $front) { return $null }
|    $one = ($tpl.Contains('scale') -and $tpl.scale -is [System.Collections.IDictionary] -and $tpl.scale.Contains('maxReplicas') -and [int]$tpl.scale.maxReplicas -eq 1 `
|            -and $tpl.scale.Contains('minReplicas') -and [int]$tpl.scale.minReplicas -eq 1)
|    # the link paths SecurityInsight guards itself (CR7 Option A) -- exactly the pin's list on the front, kept or put right
|    $anonLine = 'SIGNIN_ANONYMOUS_PATHS={0}' -f (Get-SISigninFrontAnonymousPathsValue -Pin $Pin)
|    $fenv = @($(if ($front.Contains('env')) { $front.env }))
|    $anonNow = @($fenv | Where-Object { $_ -and [string](Get-SISigninFrontProp $_ @('name')) -eq 'SIGNIN_ANONYMOUS_PATHS' } | ForEach-Object { [string](Get-SISigninFrontProp $_ @('value')) })
|    $anonOk = ($anonNow.Count -eq 1 -and $anonNow[0] -ceq ($anonLine -split '=', 2)[1])
|    # #852: the front's store settings the update made ready (step 9g) -- written beside the others, every other setting kept
|    $store = @(Get-SISigninFrontStoreEnvInUse)
|    $storeOk = $true
|    foreach ($l in $store) {
|        $p = $l -split '=', 2
|        $now = @($fenv | Where-Object { $_ -and [string](Get-SISigninFrontProp $_ @('name')) -eq $p[0] } | ForEach-Object { [string](Get-SISigninFrontProp $_ @('value')) })
|        if ($now.Count -ne 1 -or $now[0] -cne $p[1]) { $storeOk = $false }
|    }
|    # a front that needs its store (1.3.0 on) stays on what it runs until its settings are there -- it would refuse to start
|    $fenvLines = @($fenv | Where-Object { $_ } | ForEach-Object { '{0}={1}' -f (Get-SISigninFrontProp $_ @('name')), (Get-SISigninFrontProp $_ @('value')) })
|    if (-not (Test-SISigninFrontStoreReady -Pin $Pin -Env (@($fenvLines) + @($store)))) { return $null }
|    # 2026-11-05: the front's probes with realistic times -- an install rolled before them gets them with this update
|    $probesOk = (Test-SISigninFrontProbes -Container $front -Port ([int]$Pin.listenPort)).Ok
|    if ([string]$front.image -eq $FrontImage -and $one -and $anonOk -and $storeOk -and $probesOk) { return $null }
|    $front.image = $FrontImage
|    $front.env = Set-SISigninFrontEnvList -Env $fenv -Set (@($anonLine) + @($store))
|    if (-not $probesOk) { $front.probes = Get-SISigninFrontProbes -Port ([int]$Pin.listenPort) }
|    # ONE replica behind the front 1.0.0 (its keys and token cache are in memory) -- kept, or put right
|    if (-not ($tpl.Contains('scale') -and $tpl.scale -is [System.Collections.IDictionary])) { $tpl.scale = [ordered]@{} }
|    $tpl.scale.maxReplicas = 1; $tpl.scale.minReplicas = 1
|    Clear-SISigninFrontTemplate -Template $tpl
|    [ordered]@{ properties = [ordered]@{ template = $tpl } }
|}
|
|function New-SISigninFrontRemovePatch {
|    <#
|        PURE. The way back (-Off, or a cutover that did not read back healthy): the front container removed, the web
|        container's port setting removed and its switch written OFF (it listens on 8080 again with its own sign-in; the
|        updater keeps that choice and never moves the app behind the front again), the ingress on 8080.
|        The web container's size is left as it is. Returns @{ Body; Changed }.
|    #>
|    param([Parameter(Mandatory)]$App, [Parameter(Mandatory)]$Pin, [int]$WebPort = 8080)
|    $tpl = ConvertTo-SISigninFrontPlain (Get-SISigninFrontProp $App @('properties', 'template'))
|    if ($null -eq $tpl -or -not $tpl.Contains('containers')) { throw 'The web app has no containers.' }
|    Clear-SISigninFrontTemplate -Template $tpl
|    $before = ConvertTo-Json -InputObject $tpl -Depth 60 -Compress
|    $hadFront = [bool](@($tpl.containers | Where-Object { $_ -and [string]$_.name -eq [string]$Pin.containerName }).Count)
|    $cs = @($tpl.containers | Where-Object { $_ -and [string]$_.name -ne [string]$Pin.containerName })
|    if (-not $cs.Count) { throw 'The web app would have no container left.' }
|    # the switch is written OFF, not removed: the way back is a CHOICE (Get-SISigninFrontChoice 'own')
|    $cs[0].env = Set-SISigninFrontEnvList -Env @($(if ($cs[0].Contains('env')) { $cs[0].env })) -Remove @('SIGNIN_UPSTREAM_PORT') -Set @(('{0}=false' -f $script:SISigninFrontSwitch))
|    # without the front the web app may run two replicas again (its keys are shared in the Pro database), as a deploy sets it
|    if ($hadFront -and $tpl.Contains('scale') -and $tpl.scale -is [System.Collections.IDictionary] -and [int](0 + $tpl.scale.maxReplicas) -eq 1) { $tpl.scale.maxReplicas = 2 }
|    $tpl.containers = $cs
|    Clear-SISigninFrontTemplate -Template $tpl
|    $after = ConvertTo-Json -InputObject $tpl -Depth 60 -Compress
|    $ingressChanged = ([int](0 + (Get-SISigninFrontProp $App @('properties', 'configuration', 'ingress', 'targetPort'))) -ne $WebPort)
|    $body = [ordered]@{ properties = [ordered]@{ template = $tpl } }
|    if ($ingressChanged) { $body.properties.configuration = [ordered]@{ ingress = [ordered]@{ targetPort = $WebPort } } }
|    [pscustomobject]@{ Body = $body; Changed = ($ingressChanged -or $before -ne $after) }
|}
|
|function New-SISigninFrontRestorePatch {
|    <# PURE. Put back EXACTLY what ran before (-Before = the app as read before the change): its whole template and its
|       ingress port. Used when a change did not read back healthy. #>
|    param([Parameter(Mandatory)]$Before)
|    $tpl = ConvertTo-SISigninFrontPlain (Get-SISigninFrontProp $Before @('properties', 'template'))
|    Clear-SISigninFrontTemplate -Template $tpl
|    $body = [ordered]@{ properties = [ordered]@{ template = $tpl } }
|    $port = [int](0 + (Get-SISigninFrontProp $Before @('properties', 'configuration', 'ingress', 'targetPort')))
|    if ($port -gt 0) { $body.properties.configuration = [ordered]@{ ingress = [ordered]@{ targetPort = $port } } }
|    $body
|}
|
|function Test-SISigninFrontReadBack {
|    <#
|        PURE. Does the app as read back run what was asked? -Want 'on': the front container with -FrontImage, the web
|        container's switch on, the ingress on the front's port, the latest revision ready. -Want 'off': no front, switch off,
|        ingress on -WebPort. Returns @{ Ok; Why }.
|    #>
|    param([AllowNull()]$App, [Parameter(Mandatory)]$Pin, [ValidateSet('on', 'off')][string]$Want = 'on', [string]$FrontImage = '', [int]$WebPort = 8080)
|    if (-not $App) { return [pscustomobject]@{ Ok = $false; Why = 'the web app could not be read back' } }
|    $s = Get-SISigninFrontState -App $App -ContainerName ([string]$Pin.containerName)
|    if ($Want -eq 'on') {
|        if (-not $s.HasFront) { return [pscustomobject]@{ Ok = $false; Why = 'the sign-in front container is not in the app' } }
|        if ($FrontImage -and $s.FrontImage -ne $FrontImage) { return [pscustomobject]@{ Ok = $false; Why = ('the front runs {0}, not {1}' -f $s.FrontImage, $FrontImage) } }
|        if (-not $s.WebOn) { return [pscustomobject]@{ Ok = $false; Why = 'the web container''s switch is not on' } }
|        if ($s.TargetPort -ne [int]$Pin.listenPort) { return [pscustomobject]@{ Ok = $false; Why = ('the ingress targets port {0}, not the front''s {1}' -f $s.TargetPort, $Pin.listenPort) } }
|        if ($s.MaxReplicas -ne 1 -or $s.MinReplicas -ne 1) { return [pscustomobject]@{ Ok = $false; Why = ('the app may run {0} to {1} replicas, not exactly one (the front keeps its keys in memory)' -f $s.MinReplicas, $s.MaxReplicas) } }
|        $wantAnon = Get-SISigninFrontAnonymousPathsValue -Pin $Pin
|        if ([string]$s.AnonymousPaths -cne $wantAnon) { return [pscustomobject]@{ Ok = $false; Why = ('the front''s SIGNIN_ANONYMOUS_PATHS is "{0}", not SecurityInsight''s "{1}"' -f $s.AnonymousPaths, $wantAnon) } }
|        # 2026-11-05: the probes as written (realistic times, never Kubernetes' 1 s default)
|        $fc = @(@(Get-SISigninFrontProp $App @('properties', 'template', 'containers')) | Where-Object { $_ -and [string](Get-SISigninFrontProp $_ @('name')) -eq [string]$Pin.containerName }) | Select-Object -First 1
|        $pr = Test-SISigninFrontProbes -Container $fc -Port ([int]$Pin.listenPort)
|        if (-not $pr.Ok) { return [pscustomobject]@{ Ok = $false; Why = $pr.Why } }
|    } else {
|        if ($s.HasFront) { return [pscustomobject]@{ Ok = $false; Why = 'the sign-in front container is still in the app' } }
|        if ($s.WebOn) { return [pscustomobject]@{ Ok = $false; Why = 'the web container''s switch is still on' } }
|        if ($s.TargetPort -and $s.TargetPort -ne $WebPort) { return [pscustomobject]@{ Ok = $false; Why = ('the ingress targets port {0}, not {1}' -f $s.TargetPort, $WebPort) } }
|    }
|    $latest = [string](Get-SISigninFrontProp $App @('properties', 'latestRevisionName'))
|    $ready = [string](Get-SISigninFrontProp $App @('properties', 'latestReadyRevisionName'))
|    if ($latest -and $ready -ne $latest) { return [pscustomobject]@{ Ok = $false; Why = ('the new revision {0} is not ready yet (ready: {1})' -f $latest, $(if ($ready) { $ready } else { 'none' })) } }
|    $ps = [string](Get-SISigninFrontProp $App @('properties', 'provisioningState'))
|    if ($ps -and $ps -ne 'Succeeded') { return [pscustomobject]@{ Ok = $false; Why = ('provisioning is {0}' -f $ps) } }
|    [pscustomobject]@{ Ok = $true; Why = '' }
|}
|
|function Get-SISigninFrontSecretIds {
|    <# PURE. The client secrets (passwordCredentials) of the app registration -- the ones the switch makes unneeded. Only
|       their key ids; never a value (Graph never returns one). #>
|    param([AllowNull()][object[]]$PasswordCredentials)
|    @(@($PasswordCredentials) | Where-Object { $_ -and "$(Get-SISigninFrontProp $_ @('keyId'))".Trim() } | ForEach-Object { "$(Get-SISigninFrontProp $_ @('keyId'))".Trim() })
|}
|
|function Get-SISigninFrontChoice {
|    <#
|        PURE. What the web app (-App, as read) says about the sign-in front:
|          'front'      the front container is there, or the switch is on (the updater keeps it on the release's front);
|          'own'        the web container carries SI_Web_SigninFront with a value that is not on -- a CHOICE (the way back,
|                       setup\Set-SISigninFront.ps1 -Off, writes 'false'): the updater never moves it;
|          'undecided'  no front and no switch at all (every install from before the front): the updater moves it behind
|                       the front once everything the front needs reads back (Invoke-SIUpdaterSigninFrontAdopt).
|    #>
|    param([AllowNull()]$App, [string]$ContainerName = 'signin-front')
|    $s = Get-SISigninFrontState -App $App -ContainerName $ContainerName
|    if ($s.HasFront -or $s.WebOn) { return 'front' }
|    $cs = @(@(Get-SISigninFrontProp $App @('properties', 'template', 'containers')) | Where-Object { $_ })
|    $web = $(if ($cs.Count) { $cs[0] } else { $null })
|    foreach ($e in @(@(Get-SISigninFrontProp $web @('env')) | Where-Object { $_ })) {
|        if ([string](Get-SISigninFrontProp $e @('name')) -eq $script:SISigninFrontSwitch) { return 'own' }
|    }
|    'undecided'
|}
|
|function Get-SISigninFrontWebSetting {
|    <# PURE. One setting of the web container (the first one) as read; '' when it is not there. #>
|    param([AllowNull()]$App, [Parameter(Mandatory)][string]$Name)
|    $cs = @(@(Get-SISigninFrontProp $App @('properties', 'template', 'containers')) | Where-Object { $_ })
|    if (-not $cs.Count) { return '' }
|    foreach ($e in @(@(Get-SISigninFrontProp $cs[0] @('env')) | Where-Object { $_ })) {
|        if ([string](Get-SISigninFrontProp $e @('name')) -eq $Name) { return [string](Get-SISigninFrontProp $e @('value')) }
|    }
|    ''
|}
|
|function Get-SISigninFrontWebIdentity {
|    <#
|        PURE. The web app's user-assigned managed identity -- the front's client assertion -- from the app as read
|        (identity.userAssignedIdentities): the one the web container already names as its sign-in credential
|        (AzureAd__ClientCredentials__0__ManagedIdentityClientId), else the one the front container names as its client
|        assertion (SIGNIN_FIC_MI_CLIENT_ID, any container), else the one named in -Names (the standard name first), else
|        the only one. Returns @{ ClientId; PrincipalId; Name }, or $null when it cannot be told.
|        #1145: during an identity move BOTH identities are attached; the switch re-points the containers' settings, so the
|        settings decide. (Before: a web container without the credential setting fell back to the OLD name first, and every
|        update wrote the old client id back into the front's SIGNIN_STATE_MI_CLIENT_ID after the switch -- live at internal
|        2026-11-07, the clean-up stopped on it.)
|    #>
|    param([AllowNull()]$App, [string[]]$Names = @('id-si-web', 'uami-si-management'))
|    $ua = Get-SISigninFrontProp $App @('identity', 'userAssignedIdentities')
|    if ($null -eq $ua) { return $null }
|    $list = New-Object System.Collections.Generic.List[object]
|    $keys = if ($ua -is [System.Collections.IDictionary]) { @($ua.Keys) } else { @($ua.PSObject.Properties | ForEach-Object { $_.Name }) }
|    foreach ($k in $keys) {
|        $v = if ($ua -is [System.Collections.IDictionary]) { $ua[$k] } else { $ua.$k }
|        $cid = [string](Get-SISigninFrontProp $v @('clientId')); $prin = [string](Get-SISigninFrontProp $v @('principalId'))
|        if ($cid -notmatch '^[0-9a-fA-F-]{36}$' -or $prin -notmatch '^[0-9a-fA-F-]{36}$') { continue }
|        $list.Add([pscustomobject]@{ ClientId = $cid.ToLowerInvariant(); PrincipalId = $prin.ToLowerInvariant(); Name = ([string]$k -split '/')[-1] })
|    }
|    if (-not $list.Count) { return $null }
|    $named = @((Get-SISigninFrontWebSetting -App $App -Name 'AzureAd__ClientCredentials__0__ManagedIdentityClientId').Trim().ToLowerInvariant())
|    foreach ($c in @(@(Get-SISigninFrontProp $App @('properties', 'template', 'containers')) | Where-Object { $_ })) {
|        foreach ($e in @(@(Get-SISigninFrontProp $c @('env')) | Where-Object { $_ })) {
|            if ([string](Get-SISigninFrontProp $e @('name')) -eq 'SIGNIN_FIC_MI_CLIENT_ID') { $named += ([string](Get-SISigninFrontProp $e @('value'))).Trim().ToLowerInvariant() }
|        }
|    }
|    foreach ($n in @($named | Where-Object { $_ })) { $m = @($list | Where-Object { $_.ClientId -eq $n }); if ($m.Count) { return $m[0] } }
|    foreach ($n in $Names) { $m = @($list | Where-Object { $_.Name -ieq $n }); if ($m.Count) { return $m[0] } }
|    if ($list.Count -eq 1) { return $list[0] }
|    $null
|}
'@ }
$__siSupportFiles['pro-management/deploy/SI-SigninFrontStore.ps1'] = @{ Sha256 = '32bdfff8117e20f6fb7a350dba0859fdc433a445c508904c933cd6c2a5f1fa67'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- WHAT THE SHARED SIGN-IN FRONT 1.3.0 NEEDS BEFORE IT STARTS (#852, framework DOCS/REQUIREMENTS.md
|    12.11g item 9). The front keeps its sessions, its token cache and its Data Protection keys in the product's OWN SQL
|    database (schema "signin", tables created by the front on first use) and wraps the keys with a Key Vault key; it REFUSES
|    to start without SIGNIN_SQL_SERVER, SIGNIN_SQL_DATABASE and SIGNIN_KEYVAULT_KEY_ID. Its identity is the managed identity
|    named by SIGNIN_STATE_MI_CLIENT_ID (SecurityInsight sets it to the web app's identity, the same one as
|    SIGNIN_FIC_MI_CLIENT_ID).
|
|    ONE library for every path that reaches an install:
|      * a new install (Deploy-SIManagement.ps1 -SigninStoreKeyVaultName, run by the guided install as the server's admin);
|      * the cutover (SI-ManagementSigninFront.ps1, Set-SISigninFront.ps1 through the Support app);
|      * every update (setup\Invoke-SIContainerUpdate.ps1 step 9g, run by caj-si-updater from the release).
|    The pieces, each idempotent, each one plain line, each read back:
|      key         an RSA key "signin-front-dp" in the install's own Key Vault (RSA 3072, wrapKey / unwrapKey) -- created over
|                  ARM when it is not there; an existing one is used as it is, never changed, never removed;
|      key-access  "Key Vault Crypto Service Encryption User" for the identity on THAT KEY only (never the vault);
|      sql-user    the identity's contained database user (WITH SID = its client id, TYPE = E -- the SI way; the test VM's
|                  SQL Server has no Entra users: a user WITHOUT LOGIN stands in) -- only when there is none;
|      sql-schema  the schema "signin" owned by that user (CREATE SCHEMA ... AUTHORIZATION). A sign-in that may not name
|                  another owner creates it as itself and gives the user CONTROL on that one schema -- the same rights;
|      sql-grant   GRANT CREATE TABLE to that user (the front creates its two tables on first use).
|    LEAST PRIVILEGE: the identity gets only that key (wrap / unwrap) and only its own schema + CREATE TABLE -- never
|    db_owner, never a vault-wide role. The settings the front needs (Get-SISigninStoreEnv) are handed out ONLY when every
|    piece reads back: a front 1.3.0 without them refuses to start and the update puts back the front that ran, so a missing
|    piece never breaks the sign-in. A front 1.2.1 ignores the settings and the unused schema.
|
|    Every call to Azure goes through -Arm { param([string]$Method, [string]$Path, $Body) } (Path = an ARM path WITH its
|    api-version; a GET of something that is not there answers $null) and to SQL through -Sql { param([string]$Query,
|    $Params, [string]$Mode) } (Mode 'reader' = rows, 'nonquery'). No module, no az, no native exe. PS 5.1 + pwsh 7.
|#>
|
|$script:SISigninStoreKeyName = 'signin-front-dp'
|$script:SISigninStoreSchema = 'signin'
|$script:SISigninStoreKvApi = '2023-07-01'
|$script:SISigninStoreAuthApi = '2022-04-01'
|$script:SISigninStoreResApi = '2021-04-01'
|# Key Vault Crypto Service Encryption User (built-in): get, wrapKey, unwrapKey on keys
|$script:SISigninStoreCryptoRole = 'e147488a-f6f5-4113-8e2d-b22465e65bf6'
|$script:SISigninStoreSettingNames = @('SIGNIN_SQL_SERVER', 'SIGNIN_SQL_DATABASE', 'SIGNIN_KEYVAULT_KEY_ID', 'SIGNIN_STATE_MI_CLIENT_ID')
|
|function Get-SISigninStoreProp {
|    param($Object, [string[]]$Path)
|    $o = $Object
|    foreach ($p in $Path) {
|        if ($null -eq $o) { return $null }
|        if ($o -is [System.Collections.IDictionary]) { $o = $(if ($o.Contains($p)) { $o[$p] } else { $null }); continue }
|        $pp = $o.PSObject.Properties[$p]
|        $o = $(if ($pp) { $pp.Value } else { $null })
|    }
|    $o
|}
|
|function Test-SISigninFrontNeedsStore {
|    <# PURE. Does the pinned front (-Pin, or a version text) refuse to start without its SQL + Key Vault settings? 1.3.0 on. #>
|    param([Parameter(Mandatory)]$Pin)
|    $v = $(if ($Pin -is [string]) { $Pin } else { [string](Get-SISigninStoreProp $Pin @('version')) })
|    $pv = $null
|    if (-not [version]::TryParse("$v".Trim(), [ref]$pv)) { return $false }
|    $pv -ge [version]'1.3.0'
|}
|
|function Get-SISigninStoreSqlFqdn {
|    <# PURE. The SQL server's host name (a bare server name gets .database.windows.net). '' stays ''. #>
|    param([AllowEmptyString()][string]$Server)
|    $s = "$Server".Trim()
|    if ($s -match '^tcp:') { $s = $s.Substring(4) }
|    $s = ($s -split ',')[0].Trim()
|    if ($s -and $s -notmatch '\.') { $s = $s + '.database.windows.net' }
|    $s
|}
|
|function Get-SISigninStoreKeyUri {
|    <# PURE. The key id the front gets: the VERSIONLESS data-plane id (https://<vault>/keys/<name>) -- a new key version
|       is taken up without a change here. From the key as ARM returns it (keyUri, else keyUriWithVersion). '' = none. #>
|    param($Key)
|    $ku = [string](Get-SISigninStoreProp $Key @('properties', 'keyUri'))
|    if (-not $ku) { $ku = [string](Get-SISigninStoreProp $Key @('properties', 'keyUriWithVersion')) }
|    $ku = $ku.Trim().TrimEnd('/')
|    $m = [regex]::Match($ku, '(?i)^(https://[^/]+/keys/[^/]+)(/[^/]+)?$')
|    if (-not $m.Success) { return '' }
|    $m.Groups[1].Value
|}
|
|function Get-SISigninStoreEnv {
|    <# PURE. The front container's store settings ('N=V'), exactly the names the front reads (signin-front 1.3.0 README). #>
|    param([Parameter(Mandatory)][string]$SqlServer, [Parameter(Mandatory)][string]$SqlDatabase, [Parameter(Mandatory)][string]$KeyUri,
|          [Parameter(Mandatory)][string]$StateClientId)
|    @(
|        ('SIGNIN_SQL_SERVER={0}' -f (Get-SISigninStoreSqlFqdn -Server $SqlServer)),
|        ('SIGNIN_SQL_DATABASE={0}' -f $SqlDatabase.Trim()),
|        ('SIGNIN_KEYVAULT_KEY_ID={0}' -f $KeyUri.Trim()),
|        ('SIGNIN_STATE_MI_CLIENT_ID={0}' -f $StateClientId.Trim().ToLowerInvariant())
|    )
|}
|
|function Test-SISigninStoreEnvComplete {
|    <# PURE. Do these settings ('N=V' lines, or ARM env entries) carry every REQUIRED store setting with a value? #>
|    param([AllowNull()][object[]]$Env)
|    $have = @{}
|    foreach ($e in @(@($Env) | Where-Object { $_ })) {
|        if ($e -is [string]) { $p = $e -split '=', 2; if ($p.Count -eq 2 -and "$($p[1])".Trim()) { $have[$p[0]] = $true } }
|        else { $n = [string](Get-SISigninStoreProp $e @('name')); $v = [string](Get-SISigninStoreProp $e @('value')); if ($n -and $v.Trim()) { $have[$n] = $true } }
|    }
|    foreach ($n in 'SIGNIN_SQL_SERVER', 'SIGNIN_SQL_DATABASE', 'SIGNIN_KEYVAULT_KEY_ID') { if (-not $have.ContainsKey($n)) { return $false } }
|    $true
|}
|
|function Get-SISigninStoreKeyPath {
|    <# PURE. The ARM id of the key in the vault (-VaultId = the vault's ARM id). #>
|    param([Parameter(Mandatory)][string]$VaultId, [string]$KeyName = $script:SISigninStoreKeyName)
|    '{0}/keys/{1}' -f $VaultId.Trim().TrimEnd('/'), $KeyName
|}
|
|function Get-SISigninStoreKeyBody {
|    <# PURE. A new key: RSA 3072, only wrapKey / unwrapKey (it wraps the front's Data Protection keys and does nothing else). #>
|    [ordered]@{ properties = [ordered]@{ kty = 'RSA'; keySize = 3072; keyOps = @('wrapKey', 'unwrapKey') } }
|}
|
|function Get-SISigninStoreRoleRequest {
|    <# PURE. The ONE role assignment: Key Vault Crypto Service Encryption User for -PrincipalId, SCOPE = THE KEY (its ARM
|       id). Returns @{ Path (with api-version); Body }. -Name: the assignment's guid (tests pass one). #>
|    param([Parameter(Mandatory)][string]$KeyId, [Parameter(Mandatory)][string]$PrincipalId, [Parameter(Mandatory)][string]$SubscriptionId, [string]$Name = '')
|    if (-not $Name) { $Name = [guid]::NewGuid().ToString() }
|    [pscustomobject]@{
|        Path = '{0}/providers/Microsoft.Authorization/roleAssignments/{1}?api-version={2}' -f $KeyId.TrimEnd('/'), $Name, $script:SISigninStoreAuthApi
|        Body = [ordered]@{ properties = [ordered]@{
|            roleDefinitionId = ('/subscriptions/{0}/providers/Microsoft.Authorization/roleDefinitions/{1}' -f $SubscriptionId, $script:SISigninStoreCryptoRole)
|            principalId = $PrincipalId; principalType = 'ServicePrincipal' } }
|    }
|}
|
|function Test-SISigninStoreRolePresent {
|    <# PURE. Does a role assignment list (as read at the key's scope, filtered to the principal) give the crypto role on the
|       key -- at the key itself or inherited from above it (a broader grant someone made is enough; never made here)? #>
|    param([AllowNull()][object[]]$Assignments, [Parameter(Mandatory)][string]$KeyId, [Parameter(Mandatory)][string]$PrincipalId)
|    $k = $KeyId.Trim().TrimEnd('/').ToLowerInvariant()
|    foreach ($a in @(@($Assignments) | Where-Object { $_ })) {
|        $rd = [string](Get-SISigninStoreProp $a @('properties', 'roleDefinitionId'))
|        $pr = [string](Get-SISigninStoreProp $a @('properties', 'principalId'))
|        $sc = ([string](Get-SISigninStoreProp $a @('properties', 'scope'))).Trim().TrimEnd('/').ToLowerInvariant()
|        if ($rd -notmatch ('(?i)/' + $script:SISigninStoreCryptoRole + '$')) { continue }
|        if ($pr -and $pr -ine $PrincipalId) { continue }
|        if (-not $sc -or $sc -eq $k -or $k.StartsWith($sc + '/')) { return $true }
|    }
|    $false
|}
|
|function Get-SISigninStoreStateSql {
|    <# PURE. READ ONLY: the identity's user (by SID = its client id; on a non-Azure engine -- the test VM -- by name), the
|       schema, its owner, CONTROL on it, CREATE TABLE. Parameters @ClientId, @UserName. One row. #>
|    @'
|SET NOCOUNT ON;
|DECLARE @sid varbinary(16) = CONVERT(varbinary(16), CAST(@ClientId AS uniqueidentifier));
|DECLARE @u sysname = (SELECT TOP (1) name FROM sys.database_principals WHERE sid = @sid AND [type] IN ('E', 'X'));
|IF @u IS NULL AND CONVERT(int, SERVERPROPERTY('EngineEdition')) NOT IN (5, 8)
|    SET @u = (SELECT TOP (1) name FROM sys.database_principals WHERE name = @UserName AND [type] IN ('S', 'E', 'X'));
|DECLARE @uid int = DATABASE_PRINCIPAL_ID(@u);
|SELECT @u AS UserName,
|       CAST(CASE WHEN SCHEMA_ID(N'signin') IS NULL THEN 0 ELSE 1 END AS bit) AS SchemaExists,
|       (SELECT USER_NAME(principal_id) FROM sys.schemas WHERE name = N'signin') AS SchemaOwner,
|       CAST(CASE WHEN @uid IS NOT NULL AND EXISTS (SELECT 1 FROM sys.database_permissions WHERE class = 3 AND major_id = SCHEMA_ID(N'signin')
|                 AND grantee_principal_id = @uid AND permission_name = N'CONTROL' AND [state] IN ('G', 'W')) THEN 1 ELSE 0 END AS bit) AS SchemaControl,
|       CAST(CASE WHEN @uid IS NOT NULL AND EXISTS (SELECT 1 FROM sys.database_permissions WHERE class = 0 AND grantee_principal_id = @uid
|                 AND permission_name = N'CREATE TABLE' AND [state] IN ('G', 'W')) THEN 1 ELSE 0 END AS bit) AS CreateTable,
|       CONVERT(int, SERVERPROPERTY('EngineEdition')) AS EngineEdition;
|'@
|}
|
|function ConvertFrom-SISigninStoreStateRow {
|    <# PURE. The state row as @{ User; SchemaExists; SchemaOwner; SchemaOk (owned by the user, or CONTROL on it); CreateTable }. #>
|    param($Row)
|    $g = { param($k) $v = Get-SISigninStoreProp $Row @($k); if ($v -is [DBNull]) { $null } else { $v } }
|    $user = [string](& $g 'UserName')
|    $owner = [string](& $g 'SchemaOwner')
|    $exists = [bool](& $g 'SchemaExists')
|    $control = [bool](& $g 'SchemaControl')
|    [pscustomobject]@{
|        User = $user; SchemaExists = $exists; SchemaOwner = $owner
|        SchemaOk = [bool]($user -and $exists -and (($owner -ceq $user) -or $control))
|        CreateTable = [bool](& $g 'CreateTable')
|    }
|}
|
|function Get-SISigninStorePlan {
|    <#
|        PURE. What is missing, in the order it is made: 'key', 'key-access', 'sql-user', 'sql-schema', 'sql-grant'. Nothing
|        missing = an empty plan (nothing is sent). -KeyPresent / -KeyAccess: the key and the identity's right on it read;
|        -Sql: ConvertFrom-SISigninStoreStateRow. A missing key means its right is missing too; a missing user means its
|        schema ownership and its grant are missing too.
|    #>
|    param([bool]$KeyPresent, [bool]$KeyAccess, [Parameter(Mandatory)]$Sql)
|    $a = New-Object System.Collections.Generic.List[string]
|    if (-not $KeyPresent) { $a.Add('key') }
|    if (-not $KeyPresent -or -not $KeyAccess) { $a.Add('key-access') }
|    if (-not $Sql.User) { $a.Add('sql-user') }
|    if (-not $Sql.User -or -not $Sql.SchemaOk) { $a.Add('sql-schema') }
|    if (-not $Sql.User -or -not $Sql.CreateTable) { $a.Add('sql-grant') }
|    $a.ToArray()   # unrolled: callers wrap the call in @( )
|}
|
|function Get-SISigninStoreSql {
|    <#
|        PURE. The T-SQL of ONE SQL action ('sql-user', 'sql-schema', 'sql-grant') for the identity (@ClientId, @UserName as
|        parameters; every name QUOTENAME'd inside SQL). Each is idempotent on its own: it checks before it changes.
|          sql-user    CREATE USER [name] WITH SID = <client id>, TYPE = E (Azure SQL / Managed Instance); any other engine
|                      -- only the test VM's SQL Server -- has no Entra users: CREATE USER [name] WITHOUT LOGIN;
|          sql-schema  CREATE SCHEMA [signin] AUTHORIZATION [user] (an existing schema owned by someone else: ALTER
|                      AUTHORIZATION); when this sign-in may not name another owner, the schema is made as the caller and the
|                      user gets CONTROL on that one schema -- the same rights, nothing wider;
|          sql-grant   GRANT CREATE TABLE TO [user].
|    #>
|    param([Parameter(Mandatory)][ValidateSet('sql-user', 'sql-schema', 'sql-grant')][string]$Action)
|    $head = @'
|SET NOCOUNT ON;
|DECLARE @s nvarchar(max);
|DECLARE @sid varbinary(16) = CONVERT(varbinary(16), CAST(@ClientId AS uniqueidentifier));
|DECLARE @u sysname = (SELECT TOP (1) name FROM sys.database_principals WHERE sid = @sid AND [type] IN ('E', 'X'));
|IF @u IS NULL AND CONVERT(int, SERVERPROPERTY('EngineEdition')) NOT IN (5, 8)
|    SET @u = (SELECT TOP (1) name FROM sys.database_principals WHERE name = @UserName AND [type] IN ('S', 'E', 'X'));
|'@
|    switch ($Action) {
|        'sql-user' { $head + @'
|IF @u IS NULL
|BEGIN
|    IF @UserName IS NULL OR LEN(@UserName) < 1 OR LEN(@UserName) > 128 OR @UserName LIKE N'%[^A-Za-z0-9 ._@-]%'
|        THROW 51852, N'the sign-in front identity needs a safe user name (letters, digits, space . _ @ -)', 1;
|    IF EXISTS (SELECT 1 FROM sys.database_principals WHERE name = @UserName)
|        THROW 51852, N'another database principal already has the sign-in front identity''s name -- an administrator resolves it', 1;
|    IF CONVERT(int, SERVERPROPERTY('EngineEdition')) IN (5, 8)
|        SET @s = N'CREATE USER ' + QUOTENAME(@UserName) + N' WITH SID = ' + CONVERT(nvarchar(40), @sid, 1) + N', TYPE = E;';
|    ELSE SET @s = N'CREATE USER ' + QUOTENAME(@UserName) + N' WITHOUT LOGIN;';
|    EXEC sys.sp_executesql @s;
|END
|'@ }
|        'sql-schema' { $head + @'
|IF @u IS NULL THROW 51852, N'the sign-in front identity has no user in this database', 1;
|IF SCHEMA_ID(N'signin') IS NULL
|BEGIN
|    BEGIN TRY
|        SET @s = N'CREATE SCHEMA [signin] AUTHORIZATION ' + QUOTENAME(@u) + N';'; EXEC sys.sp_executesql @s;
|    END TRY
|    BEGIN CATCH
|        -- this sign-in may not name another owner: the schema as the caller, CONTROL on it for the user (the owner's rights)
|        IF SCHEMA_ID(N'signin') IS NULL EXEC (N'CREATE SCHEMA [signin];');
|        SET @s = N'GRANT CONTROL ON SCHEMA::[signin] TO ' + QUOTENAME(@u) + N';'; EXEC sys.sp_executesql @s;
|    END CATCH
|END
|ELSE IF ISNULL((SELECT USER_NAME(principal_id) FROM sys.schemas WHERE name = N'signin'), N'') <> @u
|     AND NOT EXISTS (SELECT 1 FROM sys.database_permissions WHERE class = 3 AND major_id = SCHEMA_ID(N'signin')
|                     AND grantee_principal_id = DATABASE_PRINCIPAL_ID(@u) AND permission_name = N'CONTROL' AND [state] IN ('G', 'W'))
|BEGIN
|    BEGIN TRY
|        SET @s = N'ALTER AUTHORIZATION ON SCHEMA::[signin] TO ' + QUOTENAME(@u) + N';'; EXEC sys.sp_executesql @s;
|    END TRY
|    BEGIN CATCH
|        SET @s = N'GRANT CONTROL ON SCHEMA::[signin] TO ' + QUOTENAME(@u) + N';'; EXEC sys.sp_executesql @s;
|    END CATCH
|END
|'@ }
|        'sql-grant' { $head + @'
|IF @u IS NULL THROW 51852, N'the sign-in front identity has no user in this database', 1;
|IF NOT EXISTS (SELECT 1 FROM sys.database_permissions WHERE class = 0 AND grantee_principal_id = DATABASE_PRINCIPAL_ID(@u)
|               AND permission_name = N'CREATE TABLE' AND [state] IN ('G', 'W'))
|BEGIN
|    SET @s = N'GRANT CREATE TABLE TO ' + QUOTENAME(@u) + N';'; EXEC sys.sp_executesql @s;
|END
|'@ }
|    }
|}
|
|function Get-SISigninStoreActionText {
|    <# PURE. One plain line per action (what it does, never a secret). #>
|    param([Parameter(Mandatory)][string]$Action, [string]$KeyName = $script:SISigninStoreKeyName, [string]$VaultName = '', [string]$User = '')
|    switch ($Action) {
|        'key'        { 'the key {0} is created in the Key Vault {1} (RSA 3072, wrap and unwrap only)' -f $KeyName, $VaultName }
|        'key-access' { 'the identity {0} gets "Key Vault Crypto Service Encryption User" on the key {1} only' -f $User, $KeyName }
|        'sql-user'   { 'the identity {0} gets its own user in the database (by its client id)' -f $User }
|        'sql-schema' { 'the schema signin is created, owned by {0}' -f $User }
|        'sql-grant'  { '{0} may create tables (GRANT CREATE TABLE) -- the front creates its two tables in its own schema' -f $User }
|        default      { $Action }
|    }
|}
|
|function Get-SISigninStoreRecordSql {
|    <# PURE. The step's marker: cfg.InstallState 'SigninFrontStore' = @Value (JSON), by @By -- written or replaced. #>
|    @'
|IF OBJECT_ID('cfg.InstallState') IS NOT NULL
|BEGIN
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WHERE Name = N'SigninFrontStore')
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'SigninFrontStore';
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'SigninFrontStore', @Value, NULL, @By);
|END
|'@
|}
|
|function Resolve-SISigninStoreVaultId {
|    <# The ARM id of the install's Key Vault -VaultName: in -ResourceGroup first, else anywhere in the subscription (one ARM
|       resource list filtered by type and name). '' when it is not found. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$SubscriptionId, [string]$ResourceGroup = '', [Parameter(Mandatory)][string]$VaultName)
|    if ($ResourceGroup) {
|        $id = '/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.KeyVault/vaults/{2}' -f $SubscriptionId, $ResourceGroup, $VaultName
|        $v = & $Arm 'GET' ('{0}?api-version={1}' -f $id, $script:SISigninStoreKvApi) $null
|        if ($v) { return [pscustomobject]@{ Id = $id; Vault = $v } }
|    }
|    $flt = [uri]::EscapeDataString(("resourceType eq 'Microsoft.KeyVault/vaults' and name eq '{0}'" -f $VaultName))
|    $l = & $Arm 'GET' ('/subscriptions/{0}/resources?$filter={1}&api-version={2}' -f $SubscriptionId, $flt, $script:SISigninStoreResApi) $null
|    $hit = @(@(Get-SISigninStoreProp $l @('value')) | Where-Object { $_ -and [string](Get-SISigninStoreProp $_ @('name')) -ieq $VaultName }) | Select-Object -First 1
|    if (-not $hit) { return $null }
|    $id = [string](Get-SISigninStoreProp $hit @('id'))
|    $v = & $Arm 'GET' ('{0}?api-version={1}' -f $id, $script:SISigninStoreKvApi) $null
|    [pscustomobject]@{ Id = $id; Vault = $v }
|}
|
|function Invoke-SISigninFrontStore {
|    <#
|        Makes sure of every piece (see the file header) for the identity -Identity (@{ ClientId; PrincipalId; Name }) in the
|        install's vault -VaultName and its Pro database (-SqlServer / -SqlDatabase, reached through -Sql as the CALLER).
|        -Apply:$false = the plan only (what is missing, one line each; nothing changed). Never throws.
|        Returns @{ Ok (every piece reads back); Env (the front's settings -- ONLY when Ok, else empty); Actions (what was
|        missing); Lines; Failed (the piece that could not be made, '' = none); Why }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][scriptblock]$Sql, [Parameter(Mandatory)][string]$SubscriptionId,
|          [string]$ResourceGroup = '', [Parameter(Mandatory)][string]$VaultName, [Parameter(Mandatory)][string]$SqlServer,
|          [Parameter(Mandatory)][string]$SqlDatabase, [Parameter(Mandatory)]$Identity, [string]$KeyName = $script:SISigninStoreKeyName,
|          [switch]$Apply, [scriptblock]$Log = { param($m) Write-Host $m }, [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s },
|          [int]$ReadBackTries = 6, [int]$ReadBackSeconds = 5)
|    $lines = New-Object System.Collections.Generic.List[string]
|    $say = { param($m) $lines.Add([string]$m); & $Log $m }
|    $res = { param([bool]$ok, $actions, [string]$failed, [string]$why, $env)
|        [pscustomobject]@{ Ok = $ok; Env = @($env); Actions = @($actions); Lines = $lines.ToArray(); Failed = $failed; Why = $why } }
|    $actions = @()
|    try {
|        $cid = ([string](Get-SISigninStoreProp $Identity @('ClientId'))).Trim().ToLowerInvariant()
|        $prin = ([string](Get-SISigninStoreProp $Identity @('PrincipalId'))).Trim().ToLowerInvariant()
|        $uname = ([string](Get-SISigninStoreProp $Identity @('Name'))).Trim()
|        if ($cid -notmatch '^[0-9a-f-]{36}$' -or $prin -notmatch '^[0-9a-f-]{36}$' -or -not $uname) { return (& $res $false @() 'identity' 'the sign-in front''s identity (client id, object id, name) could not be read' @()) }
|        $srv = Get-SISigninStoreSqlFqdn -Server $SqlServer
|        if (-not $srv -or -not "$SqlDatabase".Trim()) { return (& $res $false @() 'sql' 'the Pro database (server and name) is not known here' @()) }
|        # ---- the vault and the key (read) ----
|        $vr = Resolve-SISigninStoreVaultId -Arm $Arm -SubscriptionId $SubscriptionId -ResourceGroup $ResourceGroup -VaultName $VaultName
|        if (-not $vr -or -not $vr.Id) { return (& $res $false @() 'key' ('the Key Vault {0} was not found' -f $VaultName) @()) }
|        if ($vr.Vault -and (Get-SISigninStoreProp $vr.Vault @('properties', 'enableRbacAuthorization')) -eq $false) {
|            return (& $res $false @() 'key-access' ('the Key Vault {0} uses access policies, not Azure roles -- the front''s right on its key cannot be given on the key alone' -f $VaultName) @())
|        }
|        $keyId = Get-SISigninStoreKeyPath -VaultId $vr.Id -KeyName $KeyName
|        $keyPath = '{0}?api-version={1}' -f $keyId, $script:SISigninStoreKvApi
|        $key = & $Arm 'GET' $keyPath $null
|        $kty = [string](Get-SISigninStoreProp $key @('properties', 'kty'))
|        if ($key -and $kty -and $kty -notmatch '^RSA') { return (& $res $false @() 'key' ('the key {0} in {1} is {2}, not RSA -- it is left as it is' -f $KeyName, $VaultName, $kty) @()) }
|        $roleListPath = '{0}/providers/Microsoft.Authorization/roleAssignments?$filter={1}&api-version={2}' -f $keyId, [uri]::EscapeDataString(("principalId eq '{0}'" -f $prin)), $script:SISigninStoreAuthApi
|        $access = $false
|        if ($key) { $access = Test-SISigninStoreRolePresent -Assignments @(Get-SISigninStoreProp (& $Arm 'GET' $roleListPath $null) @('value')) -KeyId $keyId -PrincipalId $prin }
|        # ---- the database (read) ----
|        $st = ConvertFrom-SISigninStoreStateRow -Row (@(& $Sql (Get-SISigninStoreStateSql) ([ordered]@{ ClientId = $cid; UserName = $uname }) 'reader' | ForEach-Object { $_ }) | Select-Object -First 1)
|        $user = $(if ($st.User) { $st.User } else { $uname })
|        $actions = @(Get-SISigninStorePlan -KeyPresent ([bool]$key) -KeyAccess $access -Sql $st)
|        $envOf = { param($k) Get-SISigninStoreEnv -SqlServer $srv -SqlDatabase $SqlDatabase -KeyUri (Get-SISigninStoreKeyUri -Key $k) -StateClientId $cid }
|        if (-not @($actions).Count) {
|            & $say ('sign-in front store: in place (key {0} in {1}, the identity''s right on it, schema signin of {2}, CREATE TABLE)' -f $KeyName, $VaultName, $user)
|            $env = & $envOf $key
|            if (-not (Test-SISigninStoreEnvComplete -Env $env)) { return (& $res $false @() 'key' ('the key {0} does not show its address' -f $KeyName) @()) }
|            return (& $res $true @() '' '' $env)
|        }
|        if (-not $Apply) {
|            foreach ($a in $actions) { & $say ('sign-in front store (plan): ' + (Get-SISigninStoreActionText -Action $a -KeyName $KeyName -VaultName $VaultName -User $user)) }
|            return (& $res $false $actions '' 'plan only' @())
|        }
|        # ---- make what is missing, in order; each read back ----
|        foreach ($a in $actions) {
|            $text = Get-SISigninStoreActionText -Action $a -KeyName $KeyName -VaultName $VaultName -User $user
|            try {
|                switch ($a) {
|                    'key' {
|                        $null = & $Arm 'PUT' $keyPath (Get-SISigninStoreKeyBody)
|                        for ($i = 1; $i -le $ReadBackTries; $i++) { $key = & $Arm 'GET' $keyPath $null; if (Get-SISigninStoreKeyUri -Key $key) { break }; if ($i -lt $ReadBackTries) { & $Sleep $ReadBackSeconds } }
|                        if (-not (Get-SISigninStoreKeyUri -Key $key)) { throw 'the key does not read back' }
|                    }
|                    'key-access' {
|                        $rq = Get-SISigninStoreRoleRequest -KeyId $keyId -PrincipalId $prin -SubscriptionId $SubscriptionId
|                        $null = & $Arm 'PUT' $rq.Path $rq.Body
|                        $ok = $false
|                        for ($i = 1; $i -le $ReadBackTries; $i++) {
|                            $ok = Test-SISigninStoreRolePresent -Assignments @(Get-SISigninStoreProp (& $Arm 'GET' $roleListPath $null) @('value')) -KeyId $keyId -PrincipalId $prin
|                            if ($ok) { break }; if ($i -lt $ReadBackTries) { & $Sleep $ReadBackSeconds }
|                        }
|                        if (-not $ok) { throw 'the role assignment does not read back' }
|                    }
|                    default { $null = & $Sql (Get-SISigninStoreSql -Action $a) ([ordered]@{ ClientId = $cid; UserName = $uname }) 'nonquery' }
|                }
|            } catch {
|                $why = ('{0} -- FAILED: {1}' -f $text, $_.Exception.Message)
|                & $say ('sign-in front store: ' + $why)
|                return (& $res $false $actions $a $why @())
|            }
|            & $say ('sign-in front store: ' + $text + ' (done)')
|        }
|        # ---- the database read back as a whole ----
|        $st = ConvertFrom-SISigninStoreStateRow -Row (@(& $Sql (Get-SISigninStoreStateSql) ([ordered]@{ ClientId = $cid; UserName = $uname }) 'reader' | ForEach-Object { $_ }) | Select-Object -First 1)
|        if (-not $st.User -or -not $st.SchemaOk -or -not $st.CreateTable) {
|            $why = 'the database does not read back as made (user: {0}; schema signin of the user: {1}; CREATE TABLE: {2})' -f $(if ($st.User) { $st.User } else { 'none' }), $st.SchemaOk, $st.CreateTable
|            & $say ('sign-in front store: ' + $why)
|            return (& $res $false $actions 'sql' $why @())
|        }
|        $env = & $envOf $key
|        if (-not (Test-SISigninStoreEnvComplete -Env $env)) { return (& $res $false $actions 'key' ('the key {0} does not show its address' -f $KeyName) @()) }
|        & $say 'sign-in front store: read back -- the front''s settings are ready'
|        & $res $true $actions '' '' $env
|    } catch {
|        $why = ('could not be checked: {0}' -f $_.Exception.Message)
|        & $say ('sign-in front store: ' + $why)
|        & $res $false $actions 'read' $why @()
|    }
|}
'@ }
$__siSupportFiles['pro-management/deploy/SI-SigninFrontApi.ps1'] = @{ Sha256 = '21f016268239e68cd5132d4fff9721eff9805d4c20b4ca3f2f098dfc5be4c30e'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- THE WEB APP'S OWN API FOR THE SHARED SIGN-IN FRONT 1.4.0 (#852, framework DOCS/REQUIREMENTS.md
|    12.11g item 9). The front 1.4.0 can send the web app an ACCESS token for the app's own API instead of the ID token: it asks
|    for openid profile offline_access + SIGNIN_UPSTREAM_SCOPE = api://<client id>/user_impersonation (only that form for
|    THIS client id). For that the web app's app registration needs:
|      uri    the identifier URI api://<client id> (added; any other URI kept);
|      scope  a delegated scope "user_impersonation" (admin consent; added beside the scopes it has -- Estate.Read stays);
|      grant  an organisation-wide (AllPrincipals) oauth2PermissionGrant from the app's service principal to ITSELF for that
|             scope, so nobody is asked to consent.
|    requestedAccessTokenVersion is NEVER set here (it stays as it is; PIM's MCP clients share the pattern). Each piece only
|    when missing, read back; idempotent. The front's SIGNIN_UPSTREAM_SCOPE is handed out ONLY when every piece reads back,
|    and only to a front from 1.4.0 on (unset = the ID token, as in 1.3.0).
|
|    One library for the setup scripts (New-SIManagementAppRegistration.ps1, Set-SISigninFront.ps1) and the update's step
|    9h. -Graph { param([string]$Method, [string]$Uri, $Body) } -> the parsed answer; throws on failure. No module. PS 5.1 + pwsh 7.
|#>
|
|$script:SISigninApiScope = 'user_impersonation'
|# the scope's id in a NEW registration (fixed, as Estate.Read's): an app that has the scope keeps its own id
|$script:SISigninApiScopeId = '8d1c4f0e-3b7a-4e52-9c61-5a2f7e0d9b14'
|
|function Get-SISigninApiProp {
|    param($Object, [string[]]$Path)
|    $o = $Object
|    foreach ($p in $Path) {
|        if ($null -eq $o) { return $null }
|        if ($o -is [System.Collections.IDictionary]) { $o = $(if ($o.Contains($p)) { $o[$p] } else { $null }); continue }
|        $pp = $o.PSObject.Properties[$p]
|        $o = $(if ($pp) { $pp.Value } else { $null })
|    }
|    $o
|}
|
|function Test-SISigninFrontWantsScope {
|    <# PURE. Does the pinned front (-Pin, or a version text) take SIGNIN_UPSTREAM_SCOPE? 1.4.2 on: 1.4.0 and 1.4.1 asked for the access token without naming the sign-in scheme and looped every sign-in back (2026-10-21, PIM and SI internal) -- never access mode before 1.4.2. #>
|    param([Parameter(Mandatory)]$Pin)
|    $v = $(if ($Pin -is [string]) { $Pin } else { [string](Get-SISigninApiProp $Pin @('version')) })
|    $pv = $null
|    if (-not [version]::TryParse("$v".Trim(), [ref]$pv)) { return $false }
|    $pv -ge [version]'1.4.2'
|}
|
|function Get-SISigninApiScopeValue {
|    <# PURE. The front's SIGNIN_UPSTREAM_SCOPE for -ClientId: api://<client id>/user_impersonation. #>
|    param([Parameter(Mandatory)][string]$ClientId)
|    'api://{0}/{1}' -f $ClientId.Trim().ToLowerInvariant(), $script:SISigninApiScope
|}
|
|function New-SISigninApiScope {
|    <# PURE. The delegated scope (admin consent) the front asks for. #>
|    param([string]$Id = $script:SISigninApiScopeId)
|    [ordered]@{ id = $Id; value = $script:SISigninApiScope; type = 'Admin'; isEnabled = $true
|                adminConsentDisplayName = 'Sign in to SecurityInsight'
|                adminConsentDescription = 'Lets the SecurityInsight sign-in front call the SecurityInsight web app as the signed-in user. The user still needs a SecurityInsight role.'
|                userConsentDisplayName = 'Sign in to SecurityInsight'
|                userConsentDescription = 'Lets the sign-in front call SecurityInsight as you.' }
|}
|
|function Get-SISigninApiAppPlan {
|    <#
|        PURE. What the app registration (-App as read: identifierUris, api) lacks, and the ONE PATCH that adds it:
|        @{ NeedUri; NeedScope; Body ($null = nothing to send) }. The PATCH carries the WHOLE api object as read (a PATCH
|        replaces a complex property) with the scope added -- every other scope and requestedAccessTokenVersion as they are.
|    #>
|    param([Parameter(Mandatory)]$App, [Parameter(Mandatory)][string]$ClientId)
|    $uri = 'api://{0}' -f $ClientId.Trim().ToLowerInvariant()
|    $uris = @(@(Get-SISigninApiProp $App @('identifierUris')) | Where-Object { $_ } | ForEach-Object { [string]$_ })
|    $needUri = -not @($uris | Where-Object { $_.TrimEnd('/') -ieq $uri }).Count
|    $scopes = @(@(Get-SISigninApiProp $App @('api', 'oauth2PermissionScopes')) | Where-Object { $_ })
|    $needScope = -not @($scopes | Where-Object { [string](Get-SISigninApiProp $_ @('value')) -ceq $script:SISigninApiScope }).Count
|    if (-not $needUri -and -not $needScope) { return [pscustomobject]@{ NeedUri = $false; NeedScope = $false; Body = $null } }
|    $body = [ordered]@{}
|    if ($needUri) { $body.identifierUris = @(@($uris) + @($uri)) }
|    if ($needScope) {
|        $api = [ordered]@{}
|        $have = Get-SISigninApiProp $App @('api')
|        if ($have) {
|            $props = if ($have -is [System.Collections.IDictionary]) { @($have.Keys) } else { @($have.PSObject.Properties | ForEach-Object { $_.Name }) }
|            # sent back as read; an unset value (null) is not sent, so nothing is set that was not set
|            foreach ($k in $props) { $v = Get-SISigninApiProp $have @([string]$k); if ($null -ne $v) { $api[[string]$k] = $v } }
|        }
|        $ids = @($scopes | ForEach-Object { [string](Get-SISigninApiProp $_ @('id')) })
|        $id = $(if ($ids -contains $script:SISigninApiScopeId) { [guid]::NewGuid().ToString() } else { $script:SISigninApiScopeId })
|        $api.oauth2PermissionScopes = @(@($scopes) + @(New-SISigninApiScope -Id $id))
|        $body.api = $api
|    }
|    [pscustomobject]@{ NeedUri = $needUri; NeedScope = $needScope; Body = $body }
|}
|
|function Get-SISigninApiGrantPlan {
|    <# PURE. The app's own organisation-wide grant to itself (-Grants: clientId = resourceId = the app's service principal):
|       @{ Action = none | create | patch; GrantId; Scope (the scope text to write) }. Scopes are only ever added. #>
|    param([AllowNull()][object[]]$Grants)
|    $g = @(@($Grants) | Where-Object { $_ -and [string](Get-SISigninApiProp $_ @('consentType')) -eq 'AllPrincipals' }) | Select-Object -First 1
|    if (-not $g) { return [pscustomobject]@{ Action = 'create'; GrantId = ''; Scope = $script:SISigninApiScope } }
|    $have = @(("$(Get-SISigninApiProp $g @('scope'))" -split '\s+') | Where-Object { $_ })
|    if ($have -ccontains $script:SISigninApiScope) { return [pscustomobject]@{ Action = 'none'; GrantId = [string](Get-SISigninApiProp $g @('id')); Scope = ($have -join ' ') } }
|    [pscustomobject]@{ Action = 'patch'; GrantId = [string](Get-SISigninApiProp $g @('id')); Scope = ((@($have) + @($script:SISigninApiScope)) -join ' ') }
|}
|
|function Invoke-SISigninFrontApi {
|    <#
|        Makes sure of the identifier URI, the scope and the self grant for the app -ClientId (see the file header). Without
|        -Apply: reads only and says what it would do. NEVER THROWS. Returns @{ State = in-place | given | planned |
|        no-read | no-rights | failed; Ok (every piece reads back); Scope (SIGNIN_UPSTREAM_SCOPE's value when Ok, else '');
|        Lines; Why }.
|        #905: the ways it ends without the scope are kept apart, because only ONE of them is anybody's action:
|          no-read    a READ was refused (403 / insufficient privileges on the app registration, its service principal or
|                     its grants): nothing is known about what is there -- it may well all be in place;
|          planned    read OK, a piece is missing, no -Apply;
|          no-rights  read OK, a piece is missing, and the WRITE was refused.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Graph, [Parameter(Mandatory)][string]$ClientId, [switch]$Apply,
|          [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s }, [int[]]$Waits = @(0, 5, 10, 20), [string]$GraphBase = 'https://graph.microsoft.com/v1.0')
|    $lines = New-Object System.Collections.Generic.List[string]
|    $rights = { param([string]$m) "$m" -match '(?i)\b403\b|Authorization_RequestDenied|Insufficient privileges|Forbidden' }
|    $res = { param([string]$state, [string]$why) [pscustomobject]@{ State = $state; Ok = ($state -in 'in-place', 'given'); Scope = $(if ($state -in 'in-place', 'given') { Get-SISigninApiScopeValue -ClientId $ClientId } else { '' }); Lines = $lines.ToArray(); Why = $why } }
|    $cid = "$ClientId".Trim().ToLowerInvariant()
|    if ($cid -notmatch '^[0-9a-f-]{36}$') { return (& $res 'failed' 'no client id') }
|    $step = 'read'
|    try {
|        $readApp = { & $Graph 'GET' ("$GraphBase/applications(appId='{0}')?`$select=id,identifierUris,api" -f $cid) $null }
|        $app = & $readApp
|        if (-not $app -or -not [string](Get-SISigninApiProp $app @('id'))) { return (& $res 'failed' ('the app registration {0} was not found' -f $cid)) }
|        $plan = Get-SISigninApiAppPlan -App $app -ClientId $cid
|        $sps = & $Graph 'GET' ("$GraphBase/servicePrincipals?`$filter={0}&`$select=id" -f [uri]::EscapeDataString(("appId eq '{0}'" -f $cid))) $null
|        $spId = [string](Get-SISigninApiProp (@(@(Get-SISigninApiProp $sps @('value')) | Where-Object { $_ }) | Select-Object -First 1) @('id'))
|        if (-not $spId) { return (& $res 'failed' ('the app {0} has no enterprise application (service principal)' -f $cid)) }
|        $grantsUri = "$GraphBase/oauth2PermissionGrants?`$filter={0}" -f [uri]::EscapeDataString(("clientId eq '{0}' and resourceId eq '{0}'" -f $spId))
|        $readGrants = { $g = & $Graph 'GET' $grantsUri $null; @($(if ($g) { Get-SISigninApiProp $g @('value') })) }
|        $gplan = Get-SISigninApiGrantPlan -Grants (& $readGrants)
|        if (-not $plan.Body -and $gplan.Action -eq 'none') { $lines.Add(('the web app''s own API: api://{0}, the scope {1} and its organisation-wide consent are in place' -f $cid, $script:SISigninApiScope)); return (& $res 'in-place' '') }
|        $what = @()
|        if ($plan.NeedUri) { $what += ('the identifier URI api://{0}' -f $cid) }
|        if ($plan.NeedScope) { $what += ('the delegated scope {0} (admin consent)' -f $script:SISigninApiScope) }
|        if ($gplan.Action -ne 'none') { $what += ('the organisation-wide consent of the app to its own scope {0}' -f $script:SISigninApiScope) }
|        if (-not $Apply) { $lines.Add(('the web app''s own API (plan): would add ' + ($what -join '; '))); return (& $res 'planned' '') }
|        if ($plan.Body) { $step = 'app'; $null = & $Graph 'PATCH' ("$GraphBase/applications/{0}" -f (Get-SISigninApiProp $app @('id'))) $plan.Body }
|        if ($gplan.Action -eq 'create') { $step = 'grant'; $null = & $Graph 'POST' "$GraphBase/oauth2PermissionGrants" ([ordered]@{ clientId = $spId; consentType = 'AllPrincipals'; resourceId = $spId; scope = $gplan.Scope }) }
|        elseif ($gplan.Action -eq 'patch') { $step = 'grant'; $null = & $Graph 'PATCH' ("$GraphBase/oauth2PermissionGrants/{0}" -f $gplan.GrantId) ([ordered]@{ scope = $gplan.Scope }) }
|        # read back (the directory replicates: a few tries)
|        $step = 'read back'
|        foreach ($w in $Waits) {
|            if ($w -gt 0) { & $Sleep $w }
|            $p2 = Get-SISigninApiAppPlan -App (& $readApp) -ClientId $cid
|            $g2 = Get-SISigninApiGrantPlan -Grants (& $readGrants)
|            if (-not $p2.Body -and $g2.Action -eq 'none') { $lines.Add(('the web app''s own API: added ' + ($what -join '; ') + ' (read back)')); return (& $res 'given' '') }
|        }
|        $lines.Add(('the web app''s own API: ' + ($what -join '; ') + ' written but does not read back yet -- the next run checks again'))
|        & $res 'failed' 'written but not read back'
|    } catch {
|        $m = [string]$_.Exception.Message
|        if ((& $rights $m) -and $step -in 'read', 'read back') {
|            # #905: a refused READ says nothing about what is there (2026-10-27: all of it was in place on every install
|            # whose update could not read it) -- never "may not change", never a customer action
|            $lines.Add(('the web app''s own API: this sign-in may not read the app registration or its consent ({0}: {1}) -- whether api://{2}, the scope {3} and its organisation-wide consent are in place is not known' -f $step, $m, $cid, $script:SISigninApiScope))
|            return (& $res 'no-read' $m)
|        }
|        if (& $rights $m) {
|            $lines.Add(('the web app''s own API: this sign-in may not change the app registration or its consent ({0}: {1})' -f $step, $m))
|            return (& $res 'no-rights' $m)
|        }
|        $lines.Add(('the web app''s own API: {0} failed ({1})' -f $step, $m))
|        & $res 'failed' $m
|    }
|}
|
|function Get-SISigninFrontApiUpdateOutcome {
|    <#
|        PURE. #905 -- what the update's step 9h SAYS about one Invoke-SISigninFrontApi result (-Result) for the web app
|        -WebApp, and whether it is a customer action. Returns @{ Info (lines); Warn (lines); Env ('SIGNIN_UPSTREAM_SCOPE=...'
|        when every piece reads back, else ''); Action (the customer action's text, '' = none) }.
|          in-place / given  Info; the update hands the front SIGNIN_UPSTREAM_SCOPE itself.
|          planned           Info (-WhatIf / detect only).
|          no-read           Info ONLY: the update's identity could not READ the app registration or its consent, so it
|                            knows nothing about what is there (on 2026-10-27 all of it was in place on every install that
|                            said "config-missing"). The front stays on the ID token -- it signs in as before. NEVER a
|                            customer action.
|          no-rights         read OK, a piece missing, the WRITE refused: Warn + ONE customer action naming
|                            setup\Set-SISigninFront.ps1 -Apply AND what else that script does (it is more than a scope).
|          failed            Warn; no customer action (the next update tries again).
|    #>
|    param([Parameter(Mandatory)]$Result, [string]$WebApp = 'ca-si-management', [switch]$WhatIf)
|    $state = [string](Get-SISigninApiProp $Result @('State'))
|    $lines = @(@(Get-SISigninApiProp $Result @('Lines')) | Where-Object { "$_".Trim() } | ForEach-Object { [string]$_ })
|    $o = [ordered]@{ Info = @(); Warn = @(); Env = ''; Action = '' }
|    switch ($state) {
|        { $_ -in 'in-place', 'given' } {
|            $o.Info = $lines
|            $sc = [string](Get-SISigninApiProp $Result @('Scope'))
|            if ($sc) { $o.Env = ('SIGNIN_UPSTREAM_SCOPE={0}' -f $sc) }
|        }
|        'no-read' {
|            $o.Info = @($lines) + @(('{0}: the sign-in front stays on the ID token (it signs users in as before) -- this update''s identity may not read the app registration or its consent, so it cannot tell whether the scope {1} and its organisation-wide consent are in place. Nothing to do: once the update can read them (its identity holds Directory.Read.All, which Install-SIUpdaterJob gives when it may) and they are in place, the update hands the front the access token for the web app''s own API itself.' -f $WebApp, $script:SISigninApiScope))
|        }
|        'no-rights' {
|            $o.Warn = $lines
|            if (-not $WhatIf) {
|                $o.Action = ('{0}: the sign-in front signs users in with the ID token, not an access token for the web app''s own API -- the update read that the scope {1} or its organisation-wide consent is missing, and it may not add them. Run setup\Set-SISigninFront.ps1 -Apply through the Support app (as an administrator); it adds them and reads them back. That script does more than the scope -- run it first WITHOUT -Apply to see its plan: it also makes sure of the sign-in consent, the federated credential and the front''s store, rolls a new revision of the web app with the pinned front, turns Easy Auth off, and DELETES the app registration''s client secrets unless -KeepClientSecrets is given.' -f $WebApp, $script:SISigninApiScope)
|            }
|        }
|        'planned' { $o.Info = $lines }
|        default { $o.Warn = $lines }
|    }
|    [pscustomobject]$o
|}
'@ }
$__siSupportFiles['pro-management/signin-front.pin.json'] = @{ Sha256 = '2770a3379fa1ad28ba7392d5851f8a80f5c632e30682bb670e92a680b9963d72'; Text = @'
|{
|  "_comment": "CR7 (framework 12.11g): the ONE shared sign-in front SecurityInsight's web app runs behind, pinned by version. state 'contract' = built against the component's contract, the component is not on main yet: a release carries no front and the switch SI_Web_SigninFront cannot be turned on (setup refuses). state 'pinned' = commit names the main commit of FRAMEWORK/signin-front at that version: setup\\Publish-SIRelease.ps1 packs exactly that tree into the release (pro-management/signin-front/), and setup / the updater build the front's image from it in the install's own registry. The settings below follow the component's README; a change the component needs for SecurityInsight goes to the coordinator, never into a copy here.",
|  "component": "FRAMEWORK/signin-front",
|  "version": "1.5.0",
|  "state": "pinned",
|  "commit": "44818393d6fd249e59a13ab29ddccdc6e520b264",
|  "tree": "b19bd32c07de8fafc91ca9da59ebffd7324456f9",
|  "image": "signin-front",
|  "context": "src",
|  "dockerfile": "Dockerfile",
|  "containerName": "signin-front",
|  "listenPort": 8080,
|  "upstreamPort": 8081,
|  "sessionHours": 8,
|  "bearerPaths": "/mcp,/.well-known",
|  "anonymousPaths": "/MagicLink,/MagicLinkRequest",
|  "callbackPath": "/signin-oidc",
|  "cpu": "0.25",
|  "memory": "0.5Gi"
|}
'@ }
$__siSupportFiles['setup/_shared/SI-PrivateNetwork.ps1'] = @{ Sha256 = '9bd61b9972216c3c203c491ebc4130172f8979e92ee9f94a564c2f0bc4ee0bbe'; Text = @'
|#Requires -Version 5.1
|<#
|    PRIVATE NETWORKING AS AN OPTION (#681). ONE library for both ways it reaches an install:
|      - a NEW install: the guided install, only when the install asks for it (privateNetwork = true; default OFF -- the
|        default install is unchanged): the two subnets before the container setup (the Container Apps environment is
|        created IN the customer's virtual network, internal), the private endpoints, the private DNS zones and closing the
|        public endpoints at the end of the install;
|      - an EXISTING install: setup\Set-SIPrivateNetworking.ps1 (PLAN by default, idempotent steps, read back after every
|        change, ONE rollback record per run), through the Invardia Support app, one environment at a time.
|
|    What "private" means here:
|      * the Container Apps environment runs in the customer's subnet (delegated to Microsoft.App/environments), INTERNAL:
|        the web app is reachable from the customer's network only (an internal environment has no public address);
|      * private endpoints for the Pro database server (sqlServer), the Key Vault (vault), the storage account (blob, queue,
|        table) and the container registry (registry; the registry must be Premium for that);
|      * the private DNS zones of those endpoints (privatelink.*), linked to the virtual network -- in the install's resource
|        group, or in the resource group the customer keeps its central zones in;
|      * the environment's own DNS zone (its default domain -> its internal address), linked to the virtual network;
|      * the public endpoints CLOSED: the database server and the storage account publicNetworkAccess = Disabled; the Key
|        Vault's firewall Deny with "trusted Microsoft services" allowed (so a customer-managed key keeps working -- a vault
|        with publicNetworkAccess Disabled refuses even those). The registry's public endpoint is closed only on its own,
|        explicit step (its image builds run on Azure's build service).
|
|    OWNER 2026-10-19: "same config as pim. when we say it is private, it stays that way". The design is PIM's private
|    topology (PIM docs/DESIGN.md "Convert public to private", §27.11 "From inside: a private database"):
|      * NO PUBLIC OPENING, EVER, once closed -- not for support, not for a setup re-run, not "for a few minutes" (PIM's
|        MSP build window is NOT taken over). Set-SIPublicAccess refuses to put an open endpoint back unless the caller says
|        -AllowReopen, which only the cut-over's rollback passes, and only with the customer's own -ReopenPublicAccess.
|      * The Invardia Support app's database access is made BEFORE the public endpoint closes (its own user, db_owner, and
|        its membership of the admin group, read back) -- the cut-over refuses to close otherwise.
|      * After the close, support reaches the database ONLY FROM INSIDE: a one-time job in the install's own private
|        environment (setup\Invoke-SISupportSqlAccessJob.ps1), signed in as the in-network SQL identity id-si-sql (PIM:
|        id-pim-sql-<token>), a member of the database server's admin group. No firewall rule, no jump host.
|      * The registry's public endpoint closes only when image builds run INSIDE the network: an agent pool of the
|        registry in the endpoints subnet (PIM: the ACR agent pool), and the registry's own private endpoint approved.
|
|    Every function that talks to Azure takes -Arm, a script block  { param([string]$Method, [string]$Path, $Body) }:
|    -Path is '/subscriptions/...?api-version=...'; it returns the parsed answer, $null for "not found" on a GET, and
|    THROWS on any other error. Setup passes Invoke-SIArm; the cut-over passes the Support session's recording seam; the
|    tests pass a fake. No module, no az, no native exe. After every create or change: wait, and READ IT BACK.
|    PS 5.1 safe.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|
|$script:SIPnNetApi  = '2024-05-01'
|$script:SIPnDnsApi  = '2020-06-01'
|$script:SIPnAppApi  = '2025-07-01'
|$script:SIPnSqlApi  = '2021-11-01'
|$script:SIPnKvApi   = '2023-07-01'
|$script:SIPnStApi   = '2023-05-01'
|$script:SIPnAcrApi  = '2023-07-01'
|$script:SIPnAuthApi = '2022-04-01'
|$script:SIPnDiagApi = '2021-05-01-preview'
|$script:SIPnMiApi   = '2023-01-31'
|$script:SIPnAcrTasksApi = '2019-06-01-preview'
|$script:SIPnAppsDelegation = 'Microsoft.App/environments'
|
|# The private endpoint kinds: the sub-resource (group id) each one connects to and its private DNS zone (Azure public cloud).
|# The three storage zones share one pattern (privatelink.<service>.core.windows.net), built from the service name.
|$script:SIPnStorageZone = 'privatelink.{0}.core.windows.net'
|$script:SIPnKinds = [ordered]@{
|    sql      = @{ GroupId = 'sqlServer'; Zone = 'privatelink.database.windows.net'; Suffix = 'database.windows.net';         Type = 'Microsoft.Sql/servers';                  Label = 'database server' }
|    vault    = @{ GroupId = 'vault';     Zone = 'privatelink.vaultcore.azure.net'; Suffix = 'vault.azure.net';          Type = 'Microsoft.KeyVault/vaults';              Label = 'Key Vault' }
|    blob     = @{ GroupId = 'blob';      Zone = ($script:SIPnStorageZone -f 'blob'); Suffix = 'blob.core.windows.net';         Type = 'Microsoft.Storage/storageAccounts';      Label = 'storage (blobs)' }
|    queue    = @{ GroupId = 'queue';     Zone = ($script:SIPnStorageZone -f 'queue'); Suffix = 'queue.core.windows.net';        Type = 'Microsoft.Storage/storageAccounts';      Label = 'storage (queues)' }
|    table    = @{ GroupId = 'table';     Zone = ($script:SIPnStorageZone -f 'table'); Suffix = 'table.core.windows.net';        Type = 'Microsoft.Storage/storageAccounts';      Label = 'storage (tables)' }
|    registry = @{ GroupId = 'registry';  Zone = 'privatelink.azurecr.io'; Suffix = 'azurecr.io';             Type = 'Microsoft.ContainerRegistry/registries'; Label = 'container registry' }
|}
|
|function Get-SIPrivateNetworkNames {
|    <# PURE. The names this option gives what it creates. No ring or environment in them (framework 12.11c): the resource
|       group and its tags say which install they belong to. PrivateEnvironment is the environment an EXISTING install moves
|       to (a Container Apps environment cannot be moved into a virtual network; a new install's environment is created
|       there under its usual name). #>
|    [ordered]@{
|        # #866: SecurityInsight's own spoke network, made when the customer gives an address range instead of a network
|        Vnet               = 'vnet-si'
|        AppsSubnet         = 'snet-si-apps'
|        EndpointsSubnet    = 'snet-si-endpoints'
|        PrivateEnvironment = 'cae-si-private'
|        EndpointPrefix     = 'pe-si-'
|        ZoneGroup          = 'default'
|        # the in-network SQL identity (PIM: id-pim-sql-<token>): a member of the server's admin group, carried ONLY by a
|        # one-time job while it runs (setup\Invoke-SISupportSqlAccessJob.ps1) -- no standing job carries it
|        SqlIdentity        = 'id-si-sql'
|        SupportSqlJob      = 'caj-si-supportsql'
|        # #866: the one-time job that checks, from inside the environment, that the names resolve to private addresses
|        InsideCheckJob     = 'caj-si-insidecheck'
|        # the registry's agent pool in the endpoints subnet: image builds run inside the network (PIM: the ACR agent pool)
|        AgentPool          = 'si-vnet-pool'
|    }
|}
|
|function Get-SIPnProp {
|    <# PURE. A nested property (PSCustomObject or hashtable), $null when any step is missing. #>
|    param($Object, [string[]]$Names)
|    $o = $Object
|    foreach ($n in $Names) {
|        if ($null -eq $o) { return $null }
|        if ($o -is [System.Collections.IDictionary]) { if ($o.Contains($n)) { $o = $o[$n] } else { return $null }; continue }
|        $p = $o.PSObject.Properties[$n]
|        if (-not $p) { return $null }
|        $o = $p.Value
|    }
|    $o
|}
|
|function ConvertTo-SIPnHashtable {
|    <# PURE. A parsed ARM answer (PSCustomObjects, arrays) as ordered hashtables and arrays, so a body can be changed and
|       sent back. Strings, numbers and booleans stay as they are. #>
|    param($Object)
|    if ($null -eq $Object) { return $null }
|    if ($Object -is [string] -or $Object -is [ValueType]) { return $Object }
|    if ($Object -is [System.Collections.IDictionary]) {
|        $h = [ordered]@{}; foreach ($k in @($Object.Keys)) { $h[[string]$k] = ConvertTo-SIPnHashtable $Object[$k] }; return $h
|    }
|    if ($Object -is [System.Collections.IEnumerable]) { return , @(foreach ($i in $Object) { ConvertTo-SIPnHashtable $i }) }
|    $h = [ordered]@{}
|    foreach ($p in $Object.PSObject.Properties) { $h[$p.Name] = ConvertTo-SIPnHashtable $p.Value }
|    $h
|}
|
|function ConvertFrom-SIPnResourceId {
|    <# PURE. /subscriptions/<s>/resourceGroups/<g>/providers/<ns>/<type>/<name>[/...] as its parts; $null when it is not one. #>
|    param([AllowEmptyString()][AllowNull()][string]$Id)
|    $m = [regex]::Match("$Id".Trim(), '(?i)^/subscriptions/([^/]+)/resourceGroups/([^/]+)(?:/providers/([^/]+)/([^/]+)/([^/]+))?')
|    if (-not $m.Success) { return $null }
|    [pscustomobject]@{ SubscriptionId = $m.Groups[1].Value; ResourceGroup = $m.Groups[2].Value; Namespace = $m.Groups[3].Value
|                       Type = $(if ($m.Groups[4].Success) { '{0}/{1}' -f $m.Groups[3].Value, $m.Groups[4].Value } else { '' }); Name = $m.Groups[5].Value
|                       ResourceGroupId = ('/subscriptions/{0}/resourceGroups/{1}' -f $m.Groups[1].Value, $m.Groups[2].Value) }
|}
|
|function Get-SIPnArmList {
|    <# Every item of an ARM list (follows nextLink). -Path includes the api-version. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$Path)
|    $items = New-Object System.Collections.Generic.List[object]
|    $next = $Path
|    for ($i = 0; $next -and $i -lt 50; $i++) {
|        $page = & $Arm 'GET' $next $null
|        if (-not $page) { break }
|        foreach ($v in @(Get-SIPnProp $page @('value'))) { if ($null -ne $v) { $items.Add($v) } }
|        $nl = [string](Get-SIPnProp $page @('nextLink'))
|        $next = if ($nl) { $nl -replace '^https://management\.azure\.com', '' } else { '' }
|    }
|    $items.ToArray()
|}
|
|function Read-SIPnBack {
|    <# Reads -Path back until -Test is true about it (an ARM change finishes after its answer), at most -Tries reads,
|       -PauseSeconds apart. Returns the last read ($null = not there). #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][scriptblock]$Test,
|          [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s }, [int]$Tries = 24, [int]$PauseSeconds = 10)
|    $o = $null
|    for ($i = 1; $i -le $Tries; $i++) {
|        $o = & $Arm 'GET' $Path $null
|        if (& $Test $o) { return $o }
|        if ($i -lt $Tries) { & $Sleep $PauseSeconds }
|    }
|    $o
|}
|
|function Test-SIPnSucceeded { param($Resource) [string](Get-SIPnProp $Resource @('properties', 'provisioningState')) -eq 'Succeeded' }
|
|function Test-SIPnSameId {
|    <# PURE. Two resource ids are the same resource (case does not matter, a trailing slash neither). #>
|    param([AllowNull()][string]$A, [AllowNull()][string]$B)
|    $x = "$A".Trim().TrimEnd('/'); $y = "$B".Trim().TrimEnd('/')
|    [bool]($x -and $y -and [string]::Equals($x, $y, [System.StringComparison]::OrdinalIgnoreCase))
|}
|
|function Get-SIPnPrefixLength { param([AllowNull()][string]$Prefix) $m = [regex]::Match("$Prefix", '/(\d{1,2})$'); if ($m.Success) { [int]$m.Groups[1].Value } else { -1 } }
|
|function ConvertTo-SICidrRange {
|    <# PURE. An IPv4 range a.b.c.d/n as @{ Start; End; Bits } (unsigned), $null when it is not one. The address is taken
|       as given (10.0.0.5/24 = 10.0.0.0 .. 10.0.0.255). #>
|    param([AllowNull()][string]$Cidr)
|    $m = [regex]::Match("$Cidr".Trim(), '^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})$')
|    if (-not $m.Success) { return $null }
|    $o = @(1..4 | ForEach-Object { [uint64]$m.Groups[$_].Value }); if (@($o | Where-Object { $_ -gt 255 }).Count) { return $null }
|    $bits = [int]$m.Groups[5].Value; if ($bits -gt 32) { return $null }
|    $ip = ($o[0] * 16777216) + ($o[1] * 65536) + ($o[2] * 256) + $o[3]
|    $size = [uint64][math]::Pow(2, 32 - $bits)
|    $start = $ip - ($ip % $size)
|    @{ Start = [uint64]$start; End = [uint64]($start + $size - 1); Bits = $bits }
|}
|
|function ConvertFrom-SICidrStart {
|    <# PURE. The range a.b.c.d/-Bits starting at -Start (an unsigned address). #>
|    param([uint64]$Start, [int]$Bits)
|    $o = @(([uint64][math]::Floor($Start / 16777216) % 256), ([uint64][math]::Floor($Start / 65536) % 256), ([uint64][math]::Floor($Start / 256) % 256), ($Start % 256))
|    ('{0}.{1}.{2}.{3}/{4}' -f $o[0], $o[1], $o[2], $o[3], $Bits)
|}
|
|function Test-SICidrOverlap {
|    <# PURE. Do two ranges overlap? $null when either is not a range (unknown -- NOT "no overlap"). #>
|    param([AllowNull()][string]$A, [AllowNull()][string]$B)
|    $x = ConvertTo-SICidrRange $A; $y = ConvertTo-SICidrRange $B
|    if ($null -eq $x -or $null -eq $y) { return $null }
|    [bool](($x.Start -le $y.End) -and ($y.Start -le $x.End))
|}
|
|function Test-SICidrInside {
|    <# PURE. Is -Inner wholly inside -Outer? $null when either is not a range. #>
|    param([AllowNull()][string]$Inner, [AllowNull()][string]$Outer)
|    $i = ConvertTo-SICidrRange $Inner; $o = ConvertTo-SICidrRange $Outer
|    if ($null -eq $i -or $null -eq $o) { return $null }
|    [bool](($i.Start -ge $o.Start) -and ($i.End -le $o.End))
|}
|
|function Get-SISpokeSubnetDefaults {
|    <# PURE. The subnets of a network SecurityInsight makes from -AddressPrefix (PIM's spoke: a /26 delegated to Container
|       Apps + a /26 for the private endpoints): the FIRST /26 for the environment, the SECOND for the endpoints. A range
|       smaller than /25 has no room for both: @{ Ok = $false; Reason }. #>
|    param([Parameter(Mandatory)][string]$AddressPrefix)
|    $r = ConvertTo-SICidrRange $AddressPrefix
|    if (-not $r) { return @{ Ok = $false; Reason = ('{0} is not an address range (e.g. 10.212.24.0/24)' -f $AddressPrefix); Apps = ''; Endpoints = '' } }
|    if ($r.Bits -gt 25) { return @{ Ok = $false; Reason = ('{0} is too small: SecurityInsight''s network needs at least a /25 (two /26 subnets)' -f $AddressPrefix); Apps = ''; Endpoints = '' } }
|    @{ Ok = $true; Reason = ''; Apps = (ConvertFrom-SICidrStart -Start $r.Start -Bits 26); Endpoints = (ConvertFrom-SICidrStart -Start ($r.Start + 64) -Bits 26) }
|}
|
|function Get-SIVnetPrefixes { param($Vnet) @(Get-SIPnProp $Vnet @('properties', 'addressSpace', 'addressPrefixes') | Where-Object { $_ } | ForEach-Object { [string]$_ }) }
|
|function Set-SIVnet {
|    <# #866: SecurityInsight's own spoke network -VnetId (in its own resource group), made from -AddressPrefix when it is
|       not there, READ BACK. A network that is there is NEVER changed (its address space untouched; a different range given
|       is said). Returns @{ Ok; Created; Line; Vnet }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$VnetId, [Parameter(Mandatory)][string]$Location,
|          [Parameter(Mandatory)][string]$AddressPrefix, [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $path = '{0}?api-version={1}' -f $VnetId.TrimEnd('/'), $script:SIPnNetApi
|    $name = ($VnetId.TrimEnd('/') -split '/')[-1]
|    $have = & $Arm 'GET' $path $null
|    if ($have) {
|        $sp = @(Get-SIVnetPrefixes $have)
|        $note = if ($sp -notcontains $AddressPrefix.Trim()) { (' -- it keeps its own address space {0}; the range given, {1}, is not used' -f ($sp -join ', '), $AddressPrefix) } else { '' }
|        return @{ Ok = $true; Created = $false; Vnet = $have; Line = ('the virtual network {0} ({1}) is there{2}' -f $name, ($sp -join ', '), $note) }
|    }
|    if (-not (ConvertTo-SICidrRange $AddressPrefix)) { throw ('Private network: {0} is not an address range. Nothing was changed.' -f $AddressPrefix) }
|    $null = & $Arm 'PUT' $path ([ordered]@{ location = $Location; tags = [ordered]@{ purpose = 'securityinsight-private-network' }; properties = [ordered]@{ addressSpace = [ordered]@{ addressPrefixes = @($AddressPrefix.Trim()) } } })
|    $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Test { param($o) Test-SIPnSucceeded $o }
|    $ok = Test-SIPnSucceeded $back
|    @{ Ok = [bool]$ok; Created = $true; Vnet = $back; Line = $(if ($ok) { 'the virtual network {0} ({1}) made in SecurityInsight''s resource group (read back)' -f $name, $AddressPrefix } else { 'the virtual network {0} does not read back as ready' -f $name }) }
|}
|
|# ============================================================================================================== SUBNETS
|
|function Get-SISubnetDecision {
|    <#
|        PURE. What to do with one subnet of the customer's virtual network. -Subnet: the subnet as ARM returns it ($null =
|        not there). -Prefix: the address range for a subnet that is not there yet. -Delegate: the subnet of the Container
|        Apps environment (delegated to Microsoft.App/environments, at least a /27).
|        @{ Action = 'none' | 'create' | 'delegate' | 'fail'; Reason }.
|    #>
|    param($Subnet, [AllowEmptyString()][AllowNull()][string]$Prefix, [Parameter(Mandatory)][string]$Name, [switch]$Delegate,
|          # #866: the virtual network as ARM returns it -- a new subnet must lie in its address space and overlap none of its
|          # other subnets (refused with the reason; the network is never changed)
|          $Vnet = $null)
|    $p = "$Prefix".Trim()
|    if (-not $Subnet) {
|        if (-not $p) { return @{ Action = 'fail'; Reason = ('the subnet {0} is not in the virtual network, and no address range was given for it -- give one (for example 10.20.0.0/27), or create the subnet first' -f $Name) } }
|        if ($Delegate -and (Get-SIPnPrefixLength $p) -gt 27) { return @{ Action = 'fail'; Reason = ('the Container Apps environment needs at least a /27 subnet; {0} is too small for {1}' -f $p, $Name) } }
|        if ($Vnet) {
|            $space = @(Get-SIVnetPrefixes $Vnet)
|            if ($space.Count -and -not @($space | Where-Object { Test-SICidrInside $p $_ }).Count) { return @{ Action = 'fail'; Reason = ('{0} for {1} is not inside the virtual network''s address space ({2}) -- the network is never changed; give a range inside it' -f $p, $Name, ($space -join ', ')) } }
|            foreach ($s in @(Get-SIPnProp $Vnet @('properties', 'subnets') | Where-Object { $_ })) {
|                if ([string](Get-SIPnProp $s @('name')) -eq $Name) { continue }
|                $sp = @(@([string](Get-SIPnProp $s @('properties', 'addressPrefix'))) + @(Get-SIPnProp $s @('properties', 'addressPrefixes')) | Where-Object { $_ })
|                foreach ($x in $sp) { if (Test-SICidrOverlap $p $x) { return @{ Action = 'fail'; Reason = ('{0} for {1} overlaps the subnet {2} ({3}) of the virtual network -- give a free range' -f $p, $Name, [string](Get-SIPnProp $s @('name')), $x) } } }
|            }
|        }
|        return @{ Action = 'create'; Reason = ('the subnet {0} ({1}) is created{2}' -f $Name, $p, $(if ($Delegate) { ', delegated to Container Apps' } else { ' for the private endpoints and the build agent pool, with default outbound access (outbound only)' })) }
|    }
|    $have = "$(Get-SIPnProp $Subnet @('properties', 'addressPrefix'))".Trim()
|    if (-not $have) { $have = (@(Get-SIPnProp $Subnet @('properties', 'addressPrefixes')) | Where-Object { $_ } | Select-Object -First 1) }
|    $note = if ($p -and $have -and $p -ne $have) { (' (it keeps its own range {0}; the range given, {1}, is not used)' -f $have, $p) } else { '' }
|    if (-not $Delegate) { return @{ Action = 'none'; Reason = ('the subnet {0} ({1}) is there{2}' -f $Name, $have, $note) } }
|    if ((Get-SIPnPrefixLength $have) -gt 27) { return @{ Action = 'fail'; Reason = ('the subnet {0} ({1}) is too small: the Container Apps environment needs at least a /27' -f $Name, $have) } }
|    $dels = @(Get-SIPnProp $Subnet @('properties', 'delegations') | Where-Object { $_ } | ForEach-Object { [string](Get-SIPnProp $_ @('properties', 'serviceName')) })
|    if ($dels -contains $script:SIPnAppsDelegation) { return @{ Action = 'none'; Reason = ('the subnet {0} ({1}) is delegated to Container Apps{2}' -f $Name, $have, $note) } }
|    if ($dels.Count) { return @{ Action = 'fail'; Reason = ('the subnet {0} is delegated to {1}: a subnet takes one delegation -- give another subnet for the Container Apps environment' -f $Name, ($dels -join ', ')) } }
|    $used = @(Get-SIPnProp $Subnet @('properties', 'ipConfigurations') | Where-Object { $_ }).Count + @(Get-SIPnProp $Subnet @('properties', 'privateEndpoints') | Where-Object { $_ }).Count
|    if ($used) { return @{ Action = 'fail'; Reason = ('the subnet {0} is in use ({1} address(es)): only an empty subnet can be delegated to Container Apps -- give an empty one' -f $Name, $used) } }
|    @{ Action = 'delegate'; Reason = ('the subnet {0} ({1}) is delegated to Container Apps{2}' -f $Name, $have, $note) }
|}
|
|function Get-SISubnetBody {
|    <# PURE. The PUT body of a subnet. A subnet PUT REPLACES the subnet, so an existing one keeps everything it has (its
|       network security group, route table, NAT gateway, service endpoints, policies) and only gains the delegation. #>
|    param($Subnet, [AllowEmptyString()][AllowNull()][string]$Prefix, [switch]$Delegate)
|    $props = [ordered]@{}
|    if ($Subnet) {
|        foreach ($k in 'addressPrefix', 'addressPrefixes', 'networkSecurityGroup', 'routeTable', 'natGateway', 'serviceEndpoints', 'serviceEndpointPolicies',
|                       'delegations', 'privateEndpointNetworkPolicies', 'privateLinkServiceNetworkPolicies', 'defaultOutboundAccess') {
|            $v = Get-SIPnProp $Subnet @('properties', $k)
|            if ($null -ne $v) { $props[$k] = ConvertTo-SIPnHashtable $v }
|        }
|    } else {
|        $props['addressPrefix'] = "$Prefix".Trim()
|        if (-not $Delegate) {
|            $props['privateEndpointNetworkPolicies'] = 'Disabled'
|            # #1087: the endpoints subnet is also where the registry's build agent pool runs (PIM's design: the pool in the
|            # PE subnet). Azure makes NEW subnets private (defaultOutboundAccess false) since late 2025 -- without NAT or a
|            # route the pool's machines have no way out and Azure's own pool deployment fails. Outbound only: nothing here
|            # becomes reachable from outside; the endpoints, vault, storage, SQL and registry stay private.
|            $props['defaultOutboundAccess'] = $true
|        }
|    }
|    if ($Delegate) {
|        $d = @(@($props['delegations']) | Where-Object { $_ })
|        $props['delegations'] = @($d + @([ordered]@{ name = 'Microsoft.App.environments'; properties = [ordered]@{ serviceName = $script:SIPnAppsDelegation } }))
|    }
|    [ordered]@{ properties = $props }
|}
|
|function Set-SISubnet {
|    <# One subnet as Get-SISubnetDecision says, READ BACK. Returns @{ Ok; Action; Line; Id; Before } -- Before: $null for a
|       subnet this created (a rollback removes it), else the subnet as it was. Throws when the decision is 'fail'. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$VnetId, [Parameter(Mandatory)][string]$Name,
|          [AllowEmptyString()][string]$Prefix = '', [switch]$Delegate, $Vnet = $null, [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $id = '{0}/subnets/{1}' -f $VnetId.TrimEnd('/'), $Name
|    $path = '{0}?api-version={1}' -f $id, $script:SIPnNetApi
|    $have = & $Arm 'GET' $path $null
|    $d = Get-SISubnetDecision -Subnet $have -Prefix $Prefix -Name $Name -Delegate:$Delegate -Vnet $Vnet
|    if ($d.Action -eq 'fail') { throw ('Private network: {0}. Nothing was changed.' -f $d.Reason) }
|    if ($d.Action -eq 'none') { return @{ Ok = $true; Action = 'none'; Line = $d.Reason; Id = [string](Get-SIPnProp $have @('id')); Before = $have } }
|    $body = Get-SISubnetBody -Subnet $have -Prefix $Prefix -Delegate:$Delegate
|    # #1087 / framework rule 11b: a subnet created with defaultOutboundAccess = true must READ BACK true
|    $wantOut = [bool](Test-SISubnetOutboundSet $body)
|    $null = & $Arm 'PUT' $path $body
|    $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Test { param($o) (Test-SIPnSucceeded $o) -and (-not $wantOut -or (Test-SISubnetOutboundSet $o)) -and (-not $Delegate -or (@(Get-SIPnProp $o @('properties', 'delegations') | ForEach-Object { [string](Get-SIPnProp $_ @('properties', 'serviceName')) }) -contains $script:SIPnAppsDelegation)) }
|    if ($wantOut -and (Test-SIPnSucceeded $back) -and -not (Test-SISubnetOutboundSet $back)) {
|        throw ('Private network: the subnet {0} was created with default outbound access, but it does not read back true (Azure shows: {1}). The registry''s build agent pool needs it. Run the install again: it checks the subnet again before the pool is made.' -f $Name, $(if ($null -eq (Get-SIPnProp $back @('properties', 'defaultOutboundAccess'))) { 'not set' } else { [string](Get-SIPnProp $back @('properties', 'defaultOutboundAccess')) }))
|    }
|    $ok = [bool](Test-SIPnSucceeded $back)
|    @{ Ok = $ok; Action = $d.Action; Id = $(if ($back) { [string](Get-SIPnProp $back @('id')) } else { $id }); Before = $have
|       Line = $(if ($ok) { $d.Reason + ' (read back)' } else { ('the subnet {0} does not read back as ready after the change (Azure shows: {1})' -f $Name, [string](Get-SIPnProp $back @('properties', 'provisioningState'))) }) }
|}
|
|# ============================================================================================================== PRIVATE ENDPOINTS
|
|function Get-SIPrivateEndpointTargets {
|    <# PURE. The private endpoints an install gets: one per kind of each resource that is there (the database server only
|       for Pro). @( @{ Kind; Name; GroupId; Zone; ResourceId; Label } ). #>
|    param([string]$SqlServerId = '', [string]$KeyVaultId = '', [string]$StorageAccountId = '', [string]$RegistryId = '')
|    $prefix = (Get-SIPrivateNetworkNames).EndpointPrefix
|    $map = [ordered]@{ sql = $SqlServerId; vault = $KeyVaultId; blob = $StorageAccountId; queue = $StorageAccountId; table = $StorageAccountId; registry = $RegistryId }
|    foreach ($k in $map.Keys) {
|        $rid = "$($map[$k])".Trim()
|        if (-not $rid) { continue }
|        $kind = $script:SIPnKinds[$k]
|        [pscustomobject]@{ Kind = $k; Name = ($prefix + $k); GroupId = $kind.GroupId; Zone = $kind.Zone; ResourceId = $rid; Label = $kind.Label }
|    }
|}
|
|function Get-SIPrivateEndpointBody {
|    <# PURE. The PUT body of one private endpoint (auto-approved: the install's own resource). #>
|    param([Parameter(Mandatory)][string]$Location, [Parameter(Mandatory)][string]$SubnetId, [Parameter(Mandatory)]$Target)
|    [ordered]@{ location = $Location; properties = [ordered]@{
|        subnet = [ordered]@{ id = $SubnetId }
|        privateLinkServiceConnections = @([ordered]@{ name = [string]$Target.Name; properties = [ordered]@{ privateLinkServiceId = [string]$Target.ResourceId; groupIds = @([string]$Target.GroupId) } }) } }
|}
|
|function Test-SIPrivateEndpointMatch {
|    <# PURE. Is -Endpoint (as ARM returns it) the endpoint -Target asks for, in -SubnetId? #>
|    param($Endpoint, [Parameter(Mandatory)]$Target, [Parameter(Mandatory)][string]$SubnetId)
|    if (-not $Endpoint) { return $false }
|    if (-not (Test-SIPnSameId ([string](Get-SIPnProp $Endpoint @('properties', 'subnet', 'id'))) $SubnetId)) { return $false }
|    foreach ($c in @(@(Get-SIPnProp $Endpoint @('properties', 'privateLinkServiceConnections')) + @(Get-SIPnProp $Endpoint @('properties', 'manualPrivateLinkServiceConnections')) | Where-Object { $_ })) {
|        if ((Test-SIPnSameId ([string](Get-SIPnProp $c @('properties', 'privateLinkServiceId'))) ([string]$Target.ResourceId)) -and
|            @(Get-SIPnProp $c @('properties', 'groupIds')) -contains [string]$Target.GroupId) { return $true }
|    }
|    $false
|}
|
|function Get-SIPrivateEndpointState {
|    <# PURE. 'Approved' when the endpoint's connection to its resource is approved, else what Azure says. #>
|    param($Endpoint)
|    $c = @(@(Get-SIPnProp $Endpoint @('properties', 'privateLinkServiceConnections')) | Where-Object { $_ })[0]
|    [string](Get-SIPnProp $c @('properties', 'privateLinkServiceConnectionState', 'status'))
|}
|
|function Set-SIPrivateEndpoint {
|    <# One private endpoint in -ResourceGroupId, idempotent, READ BACK until it is provisioned and its connection approved.
|       An endpoint of that name that points elsewhere is NEVER replaced (it is said; nothing is changed).
|       Returns @{ Ok; Action = 'none' | 'create'; Line; Id; Created }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$ResourceGroupId, [Parameter(Mandatory)][string]$Location,
|          [Parameter(Mandatory)][string]$SubnetId, [Parameter(Mandatory)]$Target, [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $id = '{0}/providers/Microsoft.Network/privateEndpoints/{1}' -f $ResourceGroupId.TrimEnd('/'), $Target.Name
|    $path = '{0}?api-version={1}' -f $id, $script:SIPnNetApi
|    $have = & $Arm 'GET' $path $null
|    if ($have) {
|        if (-not (Test-SIPrivateEndpointMatch -Endpoint $have -Target $Target -SubnetId $SubnetId)) {
|            return @{ Ok = $false; Action = 'none'; Id = $id; Created = $false; Line = ('the private endpoint {0} exists but connects to something else or sits in another subnet -- it is not changed; remove or rename it, then run again' -f $Target.Name) }
|        }
|        if ((Test-SIPnSucceeded $have) -and (Get-SIPrivateEndpointState $have) -eq 'Approved') {
|            return @{ Ok = $true; Action = 'none'; Id = $id; Created = $false; Line = ('private endpoint {0} for the {1} is there' -f $Target.Name, $Target.Label) }
|        }
|    }
|    if (-not $have) { $null = & $Arm 'PUT' $path (Get-SIPrivateEndpointBody -Location $Location -SubnetId $SubnetId -Target $Target) }
|    $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Test { param($o) (Test-SIPnSucceeded $o) -and (Get-SIPrivateEndpointState $o) -eq 'Approved' }
|    $ok = (Test-SIPnSucceeded $back) -and (Get-SIPrivateEndpointState $back) -eq 'Approved'
|    @{ Ok = [bool]$ok; Action = 'create'; Id = $id; Created = (-not $have)
|       Line = $(if ($ok) { 'private endpoint {0} for the {1} (read back, approved)' -f $Target.Name, $Target.Label } else { 'private endpoint {0} for the {1} does not read back as ready (Azure shows: {2}, connection {3})' -f $Target.Name, $Target.Label, [string](Get-SIPnProp $back @('properties', 'provisioningState')), (Get-SIPrivateEndpointState $back) }) }
|}
|
|# ============================================================================================================== PRIVATE DNS
|
|function Set-SIPrivateDnsZone {
|    <# One private DNS zone in -ResourceGroupId (global), idempotent, READ BACK. Returns @{ Ok; Line; Id; Created }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$ResourceGroupId, [Parameter(Mandatory)][string]$Zone, [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $id = '{0}/providers/Microsoft.Network/privateDnsZones/{1}' -f $ResourceGroupId.TrimEnd('/'), $Zone
|    $path = '{0}?api-version={1}' -f $id, $script:SIPnDnsApi
|    $have = & $Arm 'GET' $path $null
|    if ($have) { return @{ Ok = $true; Line = ('private DNS zone {0} is there' -f $Zone); Id = $id; Created = $false } }
|    $null = & $Arm 'PUT' $path ([ordered]@{ location = 'global' })
|    $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Test { param($o) Test-SIPnSucceeded $o }
|    $ok = Test-SIPnSucceeded $back
|    @{ Ok = [bool]$ok; Id = $id; Created = $true; Line = $(if ($ok) { 'private DNS zone {0} (read back)' -f $Zone } else { 'private DNS zone {0} does not read back as ready' -f $Zone }) }
|}
|
|function Find-SIVnetLinkedZone {
|    <# READ ONLY. A private DNS zone named -Zone that -VnetId is ALREADY linked to (any resource group of -SubscriptionIds):
|       its id, '' = none. Azure refuses a second zone of the same name on one network ("A virtual network cannot be linked
|       to multiple zones with overlapping namespaces"), so such a zone is USED, never doubled. Azure Resource Graph first;
|       when it gives no answer, the zones of that name in each subscription and their links. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$VnetId, [Parameter(Mandatory)][string]$Zone, [string[]]$SubscriptionIds = @())
|    $z = $Zone.ToLowerInvariant(); $subs = @($SubscriptionIds | Where-Object { $_ } | ForEach-Object { $_.ToLowerInvariant() } | Select-Object -Unique)
|    $zoneOf = { param($linkId) $m = [regex]::Match([string]$linkId, '(?i)^(.*/providers/Microsoft\.Network/privateDnsZones/([^/]+))/virtualNetworkLinks/'); if ($m.Success -and $m.Groups[2].Value.ToLowerInvariant() -eq $z) { $m.Groups[1].Value } else { '' } }
|    $ans = $null
|    try {
|        $q = "resources | where type =~ 'microsoft.network/privatednszones/virtualnetworklinks' | where tolower(tostring(properties.virtualNetwork.id)) == '{0}' | project id, vnet = tostring(properties.virtualNetwork.id)" -f $VnetId.TrimEnd('/').ToLowerInvariant()
|        $ans = & $Arm 'POST' '/providers/Microsoft.ResourceGraph/resources?api-version=2022-10-01' ([ordered]@{ subscriptions = $subs; query = $q })
|    } catch { $ans = $null }
|    if ($ans -and $null -ne (Get-SIPnProp $ans @('data'))) {
|        foreach ($row in @(Get-SIPnProp $ans @('data') | Where-Object { $_ })) {
|            if (-not (Test-SIPnSameId ([string](Get-SIPnProp $row @('vnet'))) $VnetId)) { continue }
|            $zid = & $zoneOf ([string](Get-SIPnProp $row @('id'))); if ($zid) { return $zid }
|        }
|        return ''
|    }
|    foreach ($s in $subs) {
|        foreach ($zo in @(Get-SIPnArmList -Arm $Arm -Path ('/subscriptions/{0}/providers/Microsoft.Network/privateDnsZones?api-version={1}' -f $s, $script:SIPnDnsApi) | Where-Object { ([string](Get-SIPnProp $_ @('name'))).ToLowerInvariant() -eq $z })) {
|            $zid = [string](Get-SIPnProp $zo @('id'))
|            if (@(Get-SIPnArmList -Arm $Arm -Path ('{0}/virtualNetworkLinks?api-version={1}' -f $zid, $script:SIPnDnsApi) | Where-Object { Test-SIPnSameId ([string](Get-SIPnProp $_ @('properties', 'virtualNetwork', 'id'))) $VnetId }).Count) { return $zid }
|        }
|    }
|    ''
|}
|
|function Resolve-SIPrivateDnsZone {
|    <#
|        #866 item 6 -- WHICH zone of -Zone an install uses, never two of a name on one network:
|          * a central resource group is given (-CentralResourceGroupId, the customer's): its zone is USED; one that is not
|            there is a HAND-OFF line -- SecurityInsight NEVER makes a zone in the customer's resource group (PIM's rule);
|          * else SecurityInsight's own resource group: its zone when there; else a zone of that name the network is ALREADY
|            linked to elsewhere is used (Azure refuses a second); else it is made there, read back.
|        Returns @{ Ok; ZoneId; Created; Elsewhere; HandOff; Line }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$Zone, [Parameter(Mandatory)][string]$ResourceGroupId,
|          [string]$CentralResourceGroupId = '', [string]$VnetId = '', [string[]]$SubscriptionIds = @(), [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $central = "$CentralResourceGroupId".Trim().TrimEnd('/')
|    if ($central -and -not (Test-SIPnSameId $central $ResourceGroupId)) {
|        $zid = '{0}/providers/Microsoft.Network/privateDnsZones/{1}' -f $central, $Zone
|        if (& $Arm 'GET' ('{0}?api-version={1}' -f $zid, $script:SIPnDnsApi) $null) { return @{ Ok = $true; ZoneId = $zid; Created = $false; Elsewhere = $true; HandOff = $false; Line = ('private DNS zone {0} in your central resource group {1} is used' -f $Zone, ($central -split '/')[-1]) } }
|        return @{ Ok = $false; ZoneId = ''; Created = $false; Elsewhere = $true; HandOff = $true
|                  Line = ('the zone {0} is NOT in your central resource group {1} -- SecurityInsight never makes a zone there: your network team creates it (or leave the central resource group empty and SecurityInsight uses its own)' -f $Zone, ($central -split '/')[-1]) }
|    }
|    $own = '{0}/providers/Microsoft.Network/privateDnsZones/{1}' -f $ResourceGroupId.TrimEnd('/'), $Zone
|    if (& $Arm 'GET' ('{0}?api-version={1}' -f $own, $script:SIPnDnsApi) $null) { return @{ Ok = $true; ZoneId = $own; Created = $false; Elsewhere = $false; HandOff = $false; Line = ('private DNS zone {0} is there' -f $Zone) } }
|    if ($VnetId) {
|        $found = Find-SIVnetLinkedZone -Arm $Arm -VnetId $VnetId -Zone $Zone -SubscriptionIds $SubscriptionIds
|        if ($found -and -not (Test-SIPnSameId $found $own)) {
|            return @{ Ok = $true; ZoneId = $found; Created = $false; Elsewhere = $true; HandOff = $false
|                      Line = ('the network is already linked to a zone {0} ({1}) -- it is used: Azure refuses a second zone of that name on one network' -f $Zone, ((ConvertFrom-SIPnResourceId $found).ResourceGroup)) }
|        }
|    }
|    $z = Set-SIPrivateDnsZone -Arm $Arm -ResourceGroupId $ResourceGroupId -Zone $Zone -Sleep $Sleep
|    @{ Ok = [bool]$z.Ok; ZoneId = $z.Id; Created = [bool]$z.Created; Elsewhere = $false; HandOff = $false; Line = $z.Line }
|}
|
|function Get-SIZoneSearchSubscriptions {
|    <# PURE. The subscriptions a same-name zone is looked for in: the install's, the network's, the central zones'. #>
|    param([string[]]$Ids = @())
|    @($Ids | Where-Object { $_ } | ForEach-Object { $p = ConvertFrom-SIPnResourceId $_; if ($p) { $p.SubscriptionId.ToLowerInvariant() } } | Select-Object -Unique)
|}
|
|function Get-SIPrivateDnsLinkName {
|    <# PURE. The name of a zone's link to a virtual network: the network's name (one link per network per zone). #>
|    param([Parameter(Mandatory)][string]$VnetId)
|    $n = (($VnetId.TrimEnd('/') -split '/')[-1]).ToLowerInvariant() -replace '[^a-z0-9_.-]', '-'
|    if ($n.Length -gt 80) { $n = $n.Substring(0, 80) }
|    $n
|}
|
|function Get-SIPrivateDnsLinkPlan {
|    <# PURE (#866 item 7, PIM's Get-PimZoneLinkPlan). Should -VnetId be linked to the zone, given its existing -Links (ARM
|       objects)? A network linked under ANY name is left alone ('skip'). Otherwise 'create' under the network's name -- or,
|       when a link of THAT name points at ANOTHER network (two networks of one name in different groups / subscriptions),
|       under <name>-<hash>: a PUT under the taken name would REPOINT the other network's link and cut its resolution.
|       @{ Action = 'skip' | 'create'; Name }. #>
|    param([Parameter(Mandatory)][string]$VnetId, [object[]]$Links = @())
|    foreach ($l in @($Links | Where-Object { $_ })) {
|        if (Test-SIPnSameId ([string](Get-SIPnProp $l @('properties', 'virtualNetwork', 'id'))) $VnetId) { return @{ Action = 'skip'; Name = [string](Get-SIPnProp $l @('name')) } }
|    }
|    $name = Get-SIPrivateDnsLinkName -VnetId $VnetId
|    if (@($Links | Where-Object { $_ -and ([string](Get-SIPnProp $_ @('name'))) -ieq $name }).Count) {
|        $sha = [Security.Cryptography.SHA256]::Create()
|        try { $hx = -join (@($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($VnetId.TrimEnd('/').ToLowerInvariant()))[0..3]) | ForEach-Object { $_.ToString('x2') }) } finally { $sha.Dispose() }
|        $base = if ($name.Length -gt 71) { $name.Substring(0, 71) } else { $name }
|        $name = '{0}-{1}' -f $base, $hx
|    }
|    @{ Action = 'create'; Name = $name }
|}
|
|function Set-SIPrivateDnsLink {
|    <# The zone's link to the virtual network, idempotent (any link of the zone to that network counts -- matched by the
|       NETWORK, never by the link's name), READ BACK. -HandOffOnError (the customer's hub network, #866): a link SecurityInsight
|       may not write is NOT a failure -- it is returned as a hand-off line (HandOff = $true) for the customer's network team.
|       Returns @{ Ok; Line; Id; Created; HandOff }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$ZoneId, [Parameter(Mandatory)][string]$VnetId, [switch]$HandOffOnError,
|          [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $zone = ($ZoneId.TrimEnd('/') -split '/')[-1]
|    $vn = ($VnetId.TrimEnd('/') -split '/')[-1]
|    $links = @(Get-SIPnArmList -Arm $Arm -Path ('{0}/virtualNetworkLinks?api-version={1}' -f $ZoneId.TrimEnd('/'), $script:SIPnDnsApi))
|    $same = @($links | Where-Object { Test-SIPnSameId ([string](Get-SIPnProp $_ @('properties', 'virtualNetwork', 'id'))) $VnetId })[0]
|    if ($same) { return @{ Ok = $true; Created = $false; HandOff = $false; Id = [string](Get-SIPnProp $same @('id')); Line = ('{0} is linked to {1}' -f $zone, $vn) } }
|    # #866 item 7: a link of the network's name that points at ANOTHER network is never repointed -- a hash suffix instead
|    $id = '{0}/virtualNetworkLinks/{1}' -f $ZoneId.TrimEnd('/'), (Get-SIPrivateDnsLinkPlan -VnetId $VnetId -Links $links).Name
|    $path = '{0}?api-version={1}' -f $id, $script:SIPnDnsApi
|    try { $null = & $Arm 'PUT' $path ([ordered]@{ location = 'global'; properties = [ordered]@{ virtualNetwork = [ordered]@{ id = $VnetId }; registrationEnabled = $false } }) }
|    catch {
|        if (-not $HandOffOnError) { throw }
|        return @{ Ok = $false; Created = $false; HandOff = $true; Id = ''
|                  Line = ('{0} is NOT linked to {1}: SecurityInsight may not do it ({2}) -- the customer''s network team links it (or gives the rights), see the network hand-off' -f $zone, $vn, $_.Exception.Message) }
|    }
|    $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Test { param($o) Test-SIPnSucceeded $o }
|    $ok = Test-SIPnSucceeded $back
|    @{ Ok = [bool]$ok; Created = $true; HandOff = $false; Id = $id; Line = $(if ($ok) { '{0} linked to {1} (read back)' -f $zone, $vn } else { 'the link of {0} to {1} does not read back as ready' -f $zone, $vn }) }
|}
|
|function Test-SIActionAllowed {
|    <# PURE. Do -Permissions (ARM's permissions answer: @{ actions; notActions }, each a list with * wildcards) allow
|       -Action? Allowed by one entry's actions and not taken away by that entry's notActions. #>
|    param([object[]]$Permissions = @(), [Parameter(Mandatory)][string]$Action)
|    foreach ($p in @($Permissions | Where-Object { $_ })) {
|        $in = @(@(Get-SIPnProp $p @('actions')) | Where-Object { $_ -and $Action -like [string]$_ }).Count
|        $out = @(@(Get-SIPnProp $p @('notActions')) | Where-Object { $_ -and $Action -like [string]$_ }).Count
|        if ($in -and -not $out) { return $true }
|    }
|    $false
|}
|
|function Get-SIHubRightsProblem {
|    <# READ ONLY. Why the signed-in identity may NOT do -Actions on -Scope ('' = it may): ARM's own permissions answer for
|       that scope. The text names the role and the scope to grant. Nothing is written. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$Scope, [Parameter(Mandatory)][string[]]$Actions, [string]$Role = 'Network Contributor')
|    $perm = $null
|    try { $perm = & $Arm 'GET' ('{0}/providers/Microsoft.Authorization/permissions?api-version={1}' -f $Scope.TrimEnd('/'), $script:SIPnAuthApi) $null }
|    catch { return ('the rights on {0} could not be read ({1}) -- grant {2} on it' -f $Scope, $_.Exception.Message, $Role) }
|    $list = @(Get-SIPnProp $perm @('value') | Where-Object { $_ })
|    $missing = @($Actions | Where-Object { -not (Test-SIActionAllowed -Permissions $list -Action $_) })
|    if (-not $missing.Count) { return '' }
|    ('the installing identity may not {0} on {1} -- grant it {2} on that scope (or let your network team do it)' -f ($missing -join ', '), $Scope, $Role)
|}
|
|function Get-SIHubLinkDecision {
|    <# READ ONLY. Is the environment's zone linked to the hub? Only when the customer turned it on (LinkZonesToHub) AND
|       the identity may join the hub network (checked BEFORE any change). @{ HubVnetId ('' = not linked); Line }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][System.Collections.IDictionary]$Target)
|    $hub = [string]$Target['HubVnetId']
|    if (-not $hub) { return @{ HubVnetId = ''; Line = '' } }
|    if (-not [bool]$Target['LinkZonesToHub']) { return @{ HubVnetId = ''; Line = '' } }
|    $why = Get-SIHubRightsProblem -Arm $Arm -Scope $hub -Actions @('Microsoft.Network/virtualNetworks/join/action')
|    if ($why) { return @{ HubVnetId = ''; Line = ('linkZonesToHub REFUSED before any change: {0}' -f $why) } }
|    @{ HubVnetId = $hub; Line = '' }
|}
|
|function Get-SIDnsLinkVnetIds {
|    <# PURE. The networks the environment's own zone is linked to: SecurityInsight's network (the spoke) and -- when given
|       -- the customer's hub, so clients resolving through the hub (its private DNS resolver, other spokes, on-premises)
|       find the web app. Each once (the same network given twice, in any case, is linked once). #>
|    param([AllowEmptyString()][AllowNull()][string]$VnetId, [AllowEmptyString()][AllowNull()][string]$HubVnetId)
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($v in @($VnetId, $HubVnetId)) {
|        $t = "$v".Trim().TrimEnd('/')
|        if (-not $t) { continue }
|        if (@($out | Where-Object { Test-SIPnSameId $_ $t }).Count) { continue }
|        $out.Add($t)
|    }
|    $out.ToArray()
|}
|
|function Get-SIPrivateDnsZoneGroupBody {
|    <# PURE. The endpoint's DNS zone group: Azure keeps the zone's A record(s) for the endpoint itself. #>
|    param([Parameter(Mandatory)][string]$ZoneId)
|    $zone = ($ZoneId.TrimEnd('/') -split '/')[-1]
|    [ordered]@{ properties = [ordered]@{ privateDnsZoneConfigs = @([ordered]@{ name = ($zone -replace '\.', '-'); properties = [ordered]@{ privateDnsZoneId = $ZoneId } }) } }
|}
|
|function Set-SIPrivateDnsZoneGroup {
|    <# The endpoint's zone group pointing at -ZoneId, idempotent, READ BACK. Returns @{ Ok; Line; Created }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$EndpointId, [Parameter(Mandatory)][string]$ZoneId, [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $path = '{0}/privateDnsZoneGroups/{1}?api-version={2}' -f $EndpointId.TrimEnd('/'), (Get-SIPrivateNetworkNames).ZoneGroup, $script:SIPnNetApi
|    $pe = ($EndpointId.TrimEnd('/') -split '/')[-1]
|    $has = { param($o) @(Get-SIPnProp $o @('properties', 'privateDnsZoneConfigs') | Where-Object { $_ } | Where-Object { Test-SIPnSameId ([string](Get-SIPnProp $_ @('properties', 'privateDnsZoneId'))) $ZoneId }).Count -gt 0 }
|    $have = & $Arm 'GET' $path $null
|    if ($have -and (& $has $have)) { return @{ Ok = $true; Created = $false; Line = ('{0} keeps its address in its private DNS zone' -f $pe) } }
|    $null = & $Arm 'PUT' $path (Get-SIPrivateDnsZoneGroupBody -ZoneId $ZoneId)
|    $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Test { param($o) (Test-SIPnSucceeded $o) -and (& $has $o) }
|    $ok = (Test-SIPnSucceeded $back) -and (& $has $back)
|    @{ Ok = [bool]$ok; Created = (-not $have); Line = $(if ($ok) { '{0}: its address is in the private DNS zone (read back)' -f $pe } else { '{0}: its DNS zone group does not read back as ready' -f $pe }) }
|}
|
|# ============================================================================================================== PUBLIC ENDPOINTS
|
|function Get-SIPublicAccessKind {
|    <# PURE. The kind of a resource id for the public-endpoint rules: sql | vault | storage | registry ('' = not one). #>
|    param([AllowNull()][string]$ResourceId)
|    switch -Regex ("$ResourceId") {
|        '(?i)/providers/Microsoft\.Sql/servers/' { return 'sql' }
|        '(?i)/providers/Microsoft\.KeyVault/vaults/' { return 'vault' }
|        '(?i)/providers/Microsoft\.Storage/storageAccounts/' { return 'storage' }
|        '(?i)/providers/Microsoft\.ContainerRegistry/registries/' { return 'registry' }
|    }
|    ''
|}
|
|function Get-SIPublicAccessApi { param([string]$Kind) switch ($Kind) { 'sql' { $script:SIPnSqlApi } 'vault' { $script:SIPnKvApi } 'storage' { $script:SIPnStApi } 'registry' { $script:SIPnAcrApi } } }
|
|function Test-SIPublicAccessClosed {
|    <# PURE. Is the resource's public endpoint closed the way this option closes it? A Key Vault counts as closed when its
|       firewall denies by default (trusted Microsoft services allowed) or its public access is off. #>
|    param([Parameter(Mandatory)][string]$Kind, $Resource)
|    if (-not $Resource) { return $false }
|    # #866 (owner 2026-10-21: "we will not allow fw option or exceptions"): a Key Vault counts as closed only with its public
|    # access DISABLED, like the others -- a firewall that denies by default is not the end state any more
|    if ([string](Get-SIPnProp $Resource @('properties', 'publicNetworkAccess')) -ne 'Disabled') { return $false }
|    # Framework installer rule 11: a vault ALSO needs trusted Microsoft services allowed (bypass AzureServices) -- under
|    # bypass None (what a RECOVERED vault comes back with) ARM key / secret calls fail with ForbiddenByConnection. Such a
|    # vault is not closed "the way this option closes it": Set-SIPublicAccess PATCHes it to the close body, which has it.
|    if ($Kind -eq 'vault' -and [string](Get-SIPnProp $Resource @('properties', 'networkAcls', 'bypass')) -ne 'AzureServices') { return $false }
|    $true
|}
|
|function Get-SIPublicAccessBefore {
|    <# PURE. What a rollback puts back: the public-endpoint settings of the resource as they are now. #>
|    param([Parameter(Mandatory)][string]$Kind, $Resource)
|    $p = [ordered]@{ publicNetworkAccess = [string](Get-SIPnProp $Resource @('properties', 'publicNetworkAccess')) }
|    if ($Kind -in 'vault', 'storage', 'registry') {
|        $acl = Get-SIPnProp $Resource @('properties', $(if ($Kind -eq 'registry') { 'networkRuleSet' } else { 'networkAcls' }))
|        if ($null -ne $acl) { $p[$(if ($Kind -eq 'registry') { 'networkRuleSet' } else { 'networkAcls' })] = ConvertTo-SIPnHashtable $acl }
|    }
|    if ($Kind -eq 'registry') { $b = Get-SIPnProp $Resource @('properties', 'networkRuleBypassOptions'); if ($b) { $p['networkRuleBypassOptions'] = [string]$b } }
|    $p
|}
|
|function Get-SIPublicAccessCloseBody {
|    <# PURE. The PATCH body that closes the public endpoint of a resource of -Kind.
|         sql / storage   publicNetworkAccess Disabled (the private endpoint is the only way in)
|         vault           publicNetworkAccess Disabled (#866, owner: no firewall option, no exceptions) and its firewall Deny,
|                         trusted Microsoft services allowed, no IP or network rules
|         registry        publicNetworkAccess Disabled, trusted Microsoft services allowed #>
|    param([Parameter(Mandatory)][ValidateSet('sql', 'vault', 'storage', 'registry')][string]$Kind, $Resource)
|    switch ($Kind) {
|        'sql' { return [ordered]@{ properties = [ordered]@{ publicNetworkAccess = 'Disabled' } } }
|        'storage' { return [ordered]@{ properties = [ordered]@{ publicNetworkAccess = 'Disabled' } } }
|        'vault' { return [ordered]@{ properties = [ordered]@{ publicNetworkAccess = 'Disabled'; networkAcls = [ordered]@{ defaultAction = 'Deny'; bypass = 'AzureServices'; ipRules = @(); virtualNetworkRules = @() } } } }
|        'registry' { return [ordered]@{ properties = [ordered]@{ publicNetworkAccess = 'Disabled'; networkRuleBypassOptions = 'AzureServices' } } }
|    }
|}
|
|function Test-SIPublicAccessReopen {
|    <# PURE. Would putting -Before back OPEN the public endpoint of a resource of -Kind? (publicNetworkAccess Enabled or not
|       set -- Azure's default is Enabled -- or a firewall that allows by default.) The never-reopen guard asks this. #>
|    param([Parameter(Mandatory)][string]$Kind, [AllowNull()][System.Collections.IDictionary]$Before)
|    if ($null -eq $Before) { return $false }
|    $pna = [string]$Before['publicNetworkAccess']
|    $aclKey = if ($Kind -eq 'registry') { 'networkRuleSet' } else { 'networkAcls' }
|    $acl = $Before[$aclKey]
|    $def = if ($acl -is [System.Collections.IDictionary]) { [string]$acl['defaultAction'] } elseif ($acl) { [string](Get-SIPnProp $acl @('defaultAction')) } else { '' }
|    ($pna -ne 'Disabled')
|}
|
|function Set-SIPublicAccess {
|    <# Closes (or, with -Before, puts back) the public endpoint of -ResourceId, READ BACK. Returns @{ Ok; Line; Action }.
|       NEVER-REOPEN GUARD (owner 2026-10-19: "when we say it is private, it stays that way"): a -Before that would open the
|       endpoint again is REFUSED (nothing is sent) unless -AllowReopen is given -- and only the cut-over's rollback passes
|       it, and only on the customer's own -ReopenPublicAccess. No support step, no setup re-run, no updater ever does. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$ResourceId, [System.Collections.IDictionary]$Before, [switch]$AllowReopen,
|          [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $kind = Get-SIPublicAccessKind -ResourceId $ResourceId
|    if (-not $kind) { throw ('Not a resource whose public endpoint this closes: {0}' -f $ResourceId) }
|    $path = '{0}?api-version={1}' -f $ResourceId.TrimEnd('/'), (Get-SIPublicAccessApi $kind)
|    $name = ($ResourceId.TrimEnd('/') -split '/')[-1]
|    if ($Before -and -not $AllowReopen -and (Test-SIPublicAccessReopen -Kind $kind -Before $Before)) {
|        return @{ Ok = $false; Action = 'refused'; Line = ('{0}: its public endpoint STAYS CLOSED -- putting it back would open it, and a private install stays private (only the customer''s own decision to leave private networking, -ReopenPublicAccess, opens it)' -f $name) }
|    }
|    $have = & $Arm 'GET' $path $null
|    if (-not $have) { return @{ Ok = $false; Action = 'none'; Line = ('{0} was not found' -f $name) } }
|    if ($Before) {
|        $body = [ordered]@{ properties = [ordered]@{} }
|        foreach ($k in $Before.Keys) { if ($null -ne $Before[$k] -and "$($Before[$k])" -ne '') { $body.properties[$k] = $Before[$k] } }
|        $null = & $Arm 'PATCH' $path $body
|        $want = [string]$Before['publicNetworkAccess']
|        $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Tries 12 -Test { param($o) -not $want -or [string](Get-SIPnProp $o @('properties', 'publicNetworkAccess')) -eq $want }
|        return @{ Ok = $true; Action = 'restore'; Line = ('{0}: its public endpoint is back as it was (read back: {1})' -f $name, [string](Get-SIPnProp $back @('properties', 'publicNetworkAccess'))) }
|    }
|    if (Test-SIPublicAccessClosed -Kind $kind -Resource $have) { return @{ Ok = $true; Action = 'none'; Line = ('{0}: its public endpoint is already closed' -f $name) } }
|    $null = & $Arm 'PATCH' $path (Get-SIPublicAccessCloseBody -Kind $kind -Resource $have)
|    $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Tries 12 -Test { param($o) Test-SIPublicAccessClosed -Kind $kind -Resource $o }
|    $ok = Test-SIPublicAccessClosed -Kind $kind -Resource $back
|    @{ Ok = [bool]$ok; Action = 'close'; Line = $(if ($ok) { '{0}: its public endpoint is closed{1} (read back)' -f $name, $(if ($kind -eq 'vault') { ' (public access disabled; its firewall denies, trusted Microsoft services allowed)' } else { '' }) } else { '{0}: its public endpoint still reads open after the change' -f $name }) }
|}
|
|# ============================================================================================================== REGISTRY SKU
|
|function Get-SIRegistrySkuDecision {
|    <# PURE. A registry takes a private endpoint only on the Premium tier. @{ Action = 'none' | 'upgrade'; Reason; Sku }. #>
|    param($Registry)
|    $sku = [string](Get-SIPnProp $Registry @('sku', 'name'))
|    if (-not $Registry) { return @{ Action = 'none'; Reason = 'no container registry was found'; Sku = '' } }
|    if ($sku -eq 'Premium') { return @{ Action = 'none'; Reason = 'the container registry is Premium (it takes a private endpoint)'; Sku = $sku } }
|    @{ Action = 'upgrade'; Sku = $sku; Reason = ('the container registry is {0}: a private endpoint needs Premium -- it is changed to Premium (a higher daily price; nothing in it changes)' -f $(if ($sku) { $sku } else { 'not Premium' })) }
|}
|
|function Set-SIRegistrySku {
|    <# The registry's tier, READ BACK. Returns @{ Ok; Line }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$RegistryId, [Parameter(Mandatory)][string]$Sku, [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $path = '{0}?api-version={1}' -f $RegistryId.TrimEnd('/'), $script:SIPnAcrApi
|    $null = & $Arm 'PATCH' $path ([ordered]@{ sku = [ordered]@{ name = $Sku } })
|    $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Tries 12 -Test { param($o) [string](Get-SIPnProp $o @('sku', 'name')) -eq $Sku }
|    $now = [string](Get-SIPnProp $back @('sku', 'name'))
|    @{ Ok = ($now -eq $Sku); Line = ('container registry {0}: {1}{2}' -f ($RegistryId -split '/')[-1], $now, $(if ($now -eq $Sku) { ' (read back)' } else { ' -- NOT ' + $Sku + ' after the change' })) }
|}
|
|# ============================================================================================================== BUILDS INSIDE THE NETWORK
|
|function Get-SIAcrAgentPoolBody {
|    <# PURE. The registry's agent pool in -SubnetId: image builds run there, inside the network, so the registry's public
|       endpoint can be closed (Azure's shared build agents are refused by a closed registry). Framework rule 11g: tier S2,
|       0 agents -- the pool is scaled to 2 only while images are built (setup\_shared\SI-AcrBuildPool.ps1), Linux. #>
|    param([Parameter(Mandatory)][string]$Location, [Parameter(Mandatory)][string]$SubnetId)
|    # HOTFIX 2026-11-05: Azure refuses to CREATE a pool at count 0 (AgentPoolInvalidCount: at least 1) -- made at 1, then scaled to 0
|    # and read back by Set-SIAcrAgentPool once Azure reads it Succeeded
|    [ordered]@{ location = $Location; properties = [ordered]@{ count = 1; tier = 'S2'; os = 'Linux'; virtualNetworkSubnetResourceId = $SubnetId } }
|}
|
|function Test-SIAcrAgentPoolInNetwork {
|    <# PURE. Is -Pool (as ARM returns it) provisioned and in a subnet of -VnetId (any network when not given)? #>
|    param($Pool, [string]$VnetId = '')
|    if (-not (Test-SIPnSucceeded $Pool)) { return $false }
|    $s = [string](Get-SIPnProp $Pool @('properties', 'virtualNetworkSubnetResourceId'))
|    if (-not $s) { return $false }
|    if (-not $VnetId) { return $true }
|    $s.ToLowerInvariant().StartsWith($VnetId.TrimEnd('/').ToLowerInvariant() + '/subnets/')
|}
|
|# How long setup / the updater wait for Azure to make the registry's agent pool in the network. Azure documents the creation
|# of a pool in a virtual network in MINUTES (the agents are deployed into the subnet); a live private install (3.0.31) read
|# 'Creating' after the earlier 15 min of read-backs and failed the step although Azure was still at work. 30 min: twice what
|# was seen not to be enough, and still a bound that is said in the output -- a pool still 'Creating' after it is a re-run.
|$script:SIAcrAgentPoolWaitMinutes = 30
|
|function Get-SIAcrAgentPoolError {
|    <# PURE. Azure's words for why -Pool did not provision ('' = none on the resource). #>
|    param($Pool)
|    foreach ($p in @(@('properties', 'error', 'message'), @('properties', 'provisioningError', 'message'), @('error', 'message'), @('properties', 'statusMessage'))) {
|        $m = [string](Get-SIPnProp $Pool $p); if ($m.Trim()) { return $m.Trim() }
|    }
|    ''
|}
|
|function Wait-SIAcrAgentPool {
|    <# Waits for the agent pool at -Path until Azure reads it Succeeded / Failed / Canceled, or -LimitMinutes pass (the clock
|       is -Now, so tests do not wait). Says what it waits for and how long at most, then one progress line every
|       -ProgressSeconds. Reuses Read-SIPnBack (the read-back of every other resource) with the pool's own, longer bound.
|       Returns @{ Pool = <last read>; State; TimedOut; Minutes }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Name,
|          [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s }, [scriptblock]$Now = { [datetime]::UtcNow },
|          [scriptblock]$Say = { param($t) Write-Host $t }, [int]$LimitMinutes = $script:SIAcrAgentPoolWaitMinutes,
|          [int]$PauseSeconds = 15, [int]$ProgressSeconds = 60, [string]$FirstState = '')
|    $start = [datetime](& $Now); $deadline = $start.AddMinutes($LimitMinutes)
|    $st = @{ Said = $start; Announced = $false; TimedOut = $false }
|    $first = $(if ($FirstState) { $FirstState } else { 'Creating' })
|    & $Say ('  waiting for the build agent pool {0} (Azure: {1}) -- up to {2} min; Azure takes several minutes to place it in the network' -f $Name, $first, $LimitMinutes)
|    $tries = [int][math]::Ceiling(($LimitMinutes * 60) / [math]::Max(1, $PauseSeconds)) + 1
|    $back = Read-SIPnBack -Arm $Arm -Path $Path -Sleep $Sleep -Tries $tries -PauseSeconds $PauseSeconds -Test {
|        param($o)
|        $s = [string](Get-SIPnProp $o @('properties', 'provisioningState'))
|        if ($s -in 'Succeeded', 'Failed', 'Canceled') { return $true }
|        $t = [datetime](& $Now)
|        if ($t -ge $deadline) { $st.TimedOut = $true; return $true }
|        if (($t - $st.Said).TotalSeconds -ge $ProgressSeconds) {
|            $st.Said = $t
|            & $Say ('  still waiting for the build agent pool {0} (Azure: {1}) -- {2} of up to {3} min' -f $Name, $(if ($s) { $s } else { 'not readable yet' }), [int][math]::Floor(($t - $start).TotalMinutes), $LimitMinutes)
|        }
|        $false
|    }
|    $state = [string](Get-SIPnProp $back @('properties', 'provisioningState'))
|    if ($state -notin 'Succeeded', 'Failed', 'Canceled' -and -not $st.TimedOut) { $st.TimedOut = $true }   # the tries ran out first
|    @{ Pool = $back; State = $state; TimedOut = [bool]$st.TimedOut; Minutes = [int][math]::Floor((([datetime](& $Now)) - $start).TotalMinutes) }
|}
|
|function Set-SIAcrAgentPool {
|    <# The registry's agent pool -Name in -SubnetId, idempotent, READ BACK -- Azure takes several minutes to make a pool in a
|       network, so it WAITS for it (Wait-SIAcrAgentPool, up to $script:SIAcrAgentPoolWaitMinutes, said in the output). A pool
|       Azure left Failed / Canceled is asked for again. A pool of that name in another network is never changed (said).
|       Returns @{ Ok; Line; Id; Created; State; TimedOut }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$RegistryId, [Parameter(Mandatory)][string]$Name,
|          [Parameter(Mandatory)][string]$Location, [Parameter(Mandatory)][string]$SubnetId, [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s },
|          [scriptblock]$Now = { [datetime]::UtcNow }, [scriptblock]$Say = { param($t) Write-Host $t }, [int]$LimitMinutes = $script:SIAcrAgentPoolWaitMinutes)
|    $id = '{0}/agentPools/{1}' -f $RegistryId.TrimEnd('/'), $Name
|    $path = '{0}?api-version={1}' -f $id, $script:SIPnAcrTasksApi
|    $have = & $Arm 'GET' $path $null
|    $haveState = [string](Get-SIPnProp $have @('properties', 'provisioningState'))
|    if ($have) {
|        if (-not (Test-SIPnSameId ([string](Get-SIPnProp $have @('properties', 'virtualNetworkSubnetResourceId'))) $SubnetId)) {
|            return @{ Ok = $false; Created = $false; Id = $id; State = $haveState; TimedOut = $false; Line = ('the agent pool {0} exists in another subnet -- it is not changed' -f $Name) }
|        }
|        if (Test-SIPnSucceeded $have) { return @{ Ok = $true; Created = $false; Id = $id; State = $haveState; TimedOut = $false; Line = ('the registry''s agent pool {0} runs in the network' -f $Name) } }
|        # Azure gave up on it earlier: ask again (the same body; a PUT of the same pool is idempotent)
|        if ($haveState -in 'Failed', 'Canceled') { $null = & $Arm 'PUT' $path (Get-SIAcrAgentPoolBody -Location $Location -SubnetId $SubnetId); $haveState = 'Creating' }
|    } else { $null = & $Arm 'PUT' $path (Get-SIAcrAgentPoolBody -Location $Location -SubnetId $SubnetId); $haveState = 'Creating' }
|    $w = Wait-SIAcrAgentPool -Arm $Arm -Path $path -Name $Name -Sleep $Sleep -Now $Now -Say $Say -LimitMinutes $LimitMinutes -FirstState $haveState
|    $ok = $w.State -eq 'Succeeded'
|    # HOTFIX 2026-11-05 (rule 11g: 0 agents between builds): a pool made or made again here starts at 1 agent (Azure's least
|    # at creation) -- scaled to 0 now and read back; a pool that cannot be scaled stays at 1 (it works; it costs one agent) and that is said
|    $scaleNote = ''
|    if ($ok -and [int](Get-SIPnProp $w.Pool @('properties', 'count')) -gt 0) {
|        try {
|            $null = & $Arm 'PATCH' $path ([ordered]@{ properties = [ordered]@{ count = 0 } })
|            $zb = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Tries 40 -PauseSeconds 15 -Test { param($o) [string](Get-SIPnProp $o @('properties', 'provisioningState')) -eq 'Succeeded' -and [int](Get-SIPnProp $o @('properties', 'count')) -eq 0 }
|            $scaleNote = if ([int](Get-SIPnProp $zb @('properties', 'count')) -eq 0) { '; scaled to 0 agents between builds (read back)' } else { '; it still has 1 agent -- the next update scales it to 0' }
|        } catch { $scaleNote = ('; it still has 1 agent (the scale to 0 was refused: {0}) -- the next update scales it to 0' -f $_.Exception.Message) }
|    }
|    $line = if ($ok) { 'the registry''s agent pool {0} in the network: image builds run inside it (read back, after {1} min){2}' -f $Name, $w.Minutes, $scaleNote }
|            elseif ($w.State -in 'Failed', 'Canceled') {
|                $err = Get-SIAcrAgentPoolError $w.Pool
|                'Azure could not make the agent pool {0} (Azure shows: {1}{2})' -f $Name, $w.State, $(if ($err) { ': ' + $err } else { '; Azure gives no reason on the pool -- the registry''s Activity log has it' })
|            }
|            else { 'the agent pool {0} does not read back as ready after {1} min of waiting (Azure shows: {2}) -- Azure is still making it' -f $Name, $LimitMinutes, $(if ($w.State) { $w.State } else { 'not readable' }) }
|    @{ Ok = [bool]$ok; Created = (-not $have); Id = $id; State = $w.State; TimedOut = [bool]$w.TimedOut; Line = $line }
|}
|
|# #1087 (3.0.33): a live private install's agent pool FAILED twice inside Azure's own deployment -- the endpoints subnet SI
|# made read defaultOutboundAccess = false (Azure's default for NEW subnets since late 2025), with no NAT gateway and no
|# route table, so the pool's machines had no way out. PIM's working pool at the same customer sits in its older PE subnet
|# (defaultOutboundAccess unset = implicit outbound). The design stays PIM's (the pool in the PE subnet); the subnet must
|# have an outbound path. Never a pool that is certain to fail.
|
|function Get-SISubnetOutboundPath {
|    <# PURE. The outbound path of -Subnet (as ARM returns it): 'default' (defaultOutboundAccess true, or unset = the
|       implicit outbound of an older subnet), 'nat' (a NAT gateway), 'route' (-RouteTable, the route table the subnet
|       names, has a 0.0.0.0/0 route to a next hop other than None), '' = none. #>
|    param($Subnet, $RouteTable = $null)
|    if (-not $Subnet) { return '' }
|    $doa = Get-SIPnProp $Subnet @('properties', 'defaultOutboundAccess')
|    if ($null -eq $doa -or "$doa" -eq '' -or "$doa" -eq 'True') { return 'default' }
|    if ([string](Get-SIPnProp $Subnet @('properties', 'natGateway', 'id'))) { return 'nat' }
|    foreach ($r in @(Get-SIPnProp $RouteTable @('properties', 'routes') | Where-Object { $_ })) {
|        if ([string](Get-SIPnProp $r @('properties', 'addressPrefix')) -eq '0.0.0.0/0' -and [string](Get-SIPnProp $r @('properties', 'nextHopType')) -ne 'None') { return 'route' }
|    }
|    ''
|}
|
|function Test-SISubnetOutboundSet { <# PURE. Does -Subnet read defaultOutboundAccess = true (explicitly)? #> param($Subnet) "$(Get-SIPnProp $Subnet @('properties', 'defaultOutboundAccess'))" -eq 'True' }
|
|function Test-SIOwnSpokeVnet {
|    <# PURE. Is -Vnet (as ARM returns it) SecurityInsight's OWN spoke network -- the one Set-SIVnet makes from vnetAddressPrefix:
|       in the install's resource group -ResourceGroupId AND tagged purpose = securityinsight-private-network? A customer's
|       network (vnetId given) is never this. #>
|    param($Vnet, [string]$ResourceGroupId = '')
|    if (-not $Vnet -or -not "$ResourceGroupId".Trim()) { return $false }
|    $id = [string](Get-SIPnProp $Vnet @('id'))
|    $inRg = $id -and $id.TrimEnd('/').StartsWith($ResourceGroupId.TrimEnd('/') + '/providers/', [System.StringComparison]::OrdinalIgnoreCase)
|    [bool]($inRg -and [string](Get-SIPnProp $Vnet @('tags', 'purpose')) -eq 'securityinsight-private-network')
|}
|
|function Get-SIBuildSubnetOutboundStep {
|    <# PURE. The one customer step when the build subnet of a CUSTOMER'S network has no outbound path. #>
|    param([Parameter(Mandatory)][string]$SubnetName)
|    'the build subnet {0} has no outbound path; give it outbound access (defaultOutboundAccess, a NAT gateway or a route to your firewall that allows the Azure services an ACR agent pool needs), then run the install again' -f $SubnetName
|}
|
|function Set-SIBuildSubnetOutbound {
|    <#
|        #1087. READS the subnet -SubnetId the registry's agent pool goes in, BEFORE the pool is made. An outbound path
|        (Get-SISubnetOutboundPath) = fine, nothing written. None:
|          SecurityInsight's own spoke (-OwnNetwork, or the network reads as its own: Test-SIOwnSpokeVnet)
|              defaultOutboundAccess set true (the subnet PUT keeps everything else it has), READ BACK;
|          a customer's network
|              NOTHING is changed: Blocked, with the one customer step (Get-SIBuildSubnetOutboundStep).
|        A subnet that cannot be read is not guessed at: said, not blocked (the pool step reports what Azure does).
|        -ReportOnly (the updater's -WhatIf): the plan, nothing written.
|        Returns @{ Ok; Blocked; Fixed; Path; Own; Line; Step }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$SubnetId, [bool]$OwnNetwork = $false,
|          [string]$ResourceGroupId = '', [switch]$ReportOnly, [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $name = ($SubnetId.TrimEnd('/') -split '/')[-1]
|    $path = '{0}?api-version={1}' -f $SubnetId.TrimEnd('/'), $script:SIPnNetApi
|    $sn = & $Arm 'GET' $path $null
|    if (-not $sn) { return @{ Ok = $true; Blocked = $false; Fixed = $false; Path = ''; Own = $OwnNetwork; Step = ''; Line = ('the build subnet {0} could not be read, so its outbound path is not checked' -f $name) } }
|    $rtId = [string](Get-SIPnProp $sn @('properties', 'routeTable', 'id'))
|    $rt = if ($rtId) { & $Arm 'GET' ('{0}?api-version={1}' -f $rtId.TrimEnd('/'), $script:SIPnNetApi) $null } else { $null }
|    $via = Get-SISubnetOutboundPath -Subnet $sn -RouteTable $rt
|    $what = @{ default = 'default outbound access'; nat = 'a NAT gateway'; route = 'a route table with a 0.0.0.0/0 route' }
|    if ($via) { return @{ Ok = $true; Blocked = $false; Fixed = $false; Path = $via; Own = $OwnNetwork; Step = ''; Line = ('the build subnet {0} has an outbound path ({1})' -f $name, $what[$via]) } }
|    $own = [bool]$OwnNetwork
|    if (-not $own) {
|        $vnet = & $Arm 'GET' ('{0}?api-version={1}' -f ($SubnetId.TrimEnd('/') -replace '(?i)/subnets/[^/]+$', ''), $script:SIPnNetApi) $null
|        $own = Test-SIOwnSpokeVnet -Vnet $vnet -ResourceGroupId $ResourceGroupId
|    }
|    if (-not $own) {
|        $step = Get-SIBuildSubnetOutboundStep -SubnetName $name
|        return @{ Ok = $false; Blocked = $true; Fixed = $false; Path = ''; Own = $false; Step = $step
|                  Line = ('the build subnet {0} is in your network and has no outbound path (no default outbound access, no NAT gateway, no 0.0.0.0/0 route) -- the agent pool is NOT made (it would fail); SecurityInsight does not change your network: {1}' -f $name, $step) }
|    }
|    if ($ReportOnly) { return @{ Ok = $true; Blocked = $false; Fixed = $false; Path = ''; Own = $true; Step = ''; Line = ('the build subnet {0} would get default outbound access (SecurityInsight''s own network; outbound only)' -f $name) } }
|    $body = Get-SISubnetBody -Subnet $sn
|    $body.properties['defaultOutboundAccess'] = $true
|    $null = & $Arm 'PUT' $path $body
|    # read back EXPLICITLY true (framework rule 11b, the build-pool outbound rule) -- unset is not what was written
|    $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Tries 12 -Test { param($o) (Test-SIPnSucceeded $o) -and (Test-SISubnetOutboundSet $o) }
|    $ok = [bool]((Test-SIPnSucceeded $back) -and (Test-SISubnetOutboundSet $back))
|    @{ Ok = $ok; Blocked = (-not $ok); Fixed = $ok; Path = $(if ($ok) { 'default' } else { '' }); Own = $true
|       Step = $(if ($ok) { '' } else { 'run the install again: SecurityInsight sets default outbound access on its own build subnet {0} and reads it back' -f $name })
|       Line = $(if ($ok) { 'the build subnet {0} (SecurityInsight''s own network) had no outbound path: default outbound access turned on (outbound only; read back)' -f $name }
|                else { 'the build subnet {0} (SecurityInsight''s own network) does not read back with default outbound access after the change -- the agent pool is NOT made' -f $name }) }
|}
|
|function Invoke-SIAcrAgentPoolStep {
|    <# #1087. The registry's agent pool -Name in -SubnetId, never one that is certain to fail: a pool that already runs there
|       is kept as it is; otherwise the subnet's outbound path is checked first (Set-SIBuildSubnetOutbound) and the pool is
|       made (Set-SIAcrAgentPool: a Failed / Canceled one is asked for again) only when there is one. Returns
|       Set-SIAcrAgentPool's hashtable plus Blocked, Step and OutboundLine. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$RegistryId, [Parameter(Mandatory)][string]$Name,
|          [Parameter(Mandatory)][string]$Location, [Parameter(Mandatory)][string]$SubnetId, [bool]$OwnNetwork = $false, [string]$ResourceGroupId = '',
|          [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s }, [scriptblock]$Now = { [datetime]::UtcNow }, [scriptblock]$Say = { param($t) Write-Host $t })
|    $id = '{0}/agentPools/{1}' -f $RegistryId.TrimEnd('/'), $Name
|    $have = & $Arm 'GET' ('{0}?api-version={1}' -f $id, $script:SIPnAcrTasksApi) $null
|    $runs = $have -and (Test-SIPnSucceeded $have) -and (Test-SIPnSameId ([string](Get-SIPnProp $have @('properties', 'virtualNetworkSubnetResourceId'))) $SubnetId)
|    $o = @{ Ok = $true; Line = ''; Step = '' }
|    if (-not $runs) {
|        $o = Set-SIBuildSubnetOutbound -Arm $Arm -SubnetId $SubnetId -OwnNetwork $OwnNetwork -ResourceGroupId $ResourceGroupId -Sleep $Sleep
|        if ($o.Blocked) { return @{ Ok = $false; Blocked = $true; Created = $false; Id = $id; State = [string](Get-SIPnProp $have @('properties', 'provisioningState')); TimedOut = $false; Line = $o.Line; Step = $o.Step; OutboundLine = $o.Line } }
|    }
|    $p = Set-SIAcrAgentPool -Arm $Arm -RegistryId $RegistryId -Name $Name -Location $Location -SubnetId $SubnetId -Sleep $Sleep -Now $Now -Say $Say
|    $p['Blocked'] = $false; $p['Step'] = ''; $p['OutboundLine'] = [string]$o.Line
|    $p
|}
|
|# ============================================================================================================== RETURN ROUTE (#1095)
|# LIVE 2026-11-04 (a private install in a hub-and-spoke network with a firewall in the hub): DNS resolved, the peering read
|# Connected, and the browser on the customer's internal network still timed out. The requests reached the web app through
|# the hub's firewall, but the apps subnet had NO route table: the replies to the customer's own address ranges took Azure's
|# default route and were dropped. The cure (made by hand that day, and it worked) is a route table on the apps subnet: each
|# range the customer's people browse from -> the hub firewall's private IP as VirtualAppliance, BGP route propagation off.
|#   * Made ONLY on SecurityInsight's OWN spoke (the network it creates) and ONLY from the customer's own answers
|#     (returnRouteRanges + returnRouteNextHop) -- the next hop is a customer value SecurityInsight can never guess.
|#   * A CUSTOMER-PROVIDED network is never changed: the network hand-off carries the item for the customer's network team.
|#   * Framework rule 11d (Invardia 301d9d81): the table is rt-si in the install's resource group. A table already attached
|#     to the apps subnet (an earlier hand-made one) is REUSED as it is -- never a second table, never renamed -- and routes
|#     SecurityInsight did not make are kept, never removed.
|#   * NOT on the endpoints subnet, on purpose: the private endpoints are reached by SecurityInsight's own jobs and web app
|#     inside its network, and Azure answers a private endpoint's traffic symmetrically without a user route (its network
|#     policies are Disabled, so a route table there would not even apply to them). The registry's build pool in that subnet
|#     needs a way OUT (rule 11b, Set-SIBuildSubnetOutbound), not a way back to the customer's ranges.
|
|function Get-SIReturnRouteTableName { <# PURE. The name of the route table SecurityInsight makes (framework rule 11d). #> 'rt-si' }
|
|function Get-SIReturnRouteName {
|    <# PURE. The name SecurityInsight gives the route for -Range: si-return-<range with / as ->, e.g. si-return-10.0.0.0-16. #>
|    param([Parameter(Mandatory)][string]$Range)
|    'si-return-' + ($Range.Trim() -replace '/', '-')
|}
|
|function ConvertTo-SIReturnRouteRanges {
|    <# PURE. The answer returnRouteRanges -- text ("10.0.0.0/16, 10.2.0.0/16") or a list -- as @{ Ranges; Bad }: each range in
|       its network form (10.0.0.5/16 -> 10.0.0.0/16), each once, in the order given; Bad = what is not an IPv4 range. #>
|    param([AllowNull()]$Value)
|    $ranges = New-Object System.Collections.Generic.List[string]; $bad = New-Object System.Collections.Generic.List[string]
|    foreach ($v in @($Value)) {
|        foreach ($p in ("$v" -split '[,;\s]+')) {
|            $x = $p.Trim(); if (-not $x) { continue }
|            $r = ConvertTo-SICidrRange $x
|            if ($r) { $n = ConvertFrom-SICidrStart -Start $r.Start -Bits $r.Bits; if (-not $ranges.Contains($n)) { $ranges.Add($n) } } else { $bad.Add($x) }
|        }
|    }
|    @{ Ranges = $ranges.ToArray(); Bad = $bad.ToArray() }
|}
|
|function Test-SIIpv4Address {
|    <# PURE. Is -Ip one IPv4 address (a.b.c.d, each 0-255)? #>
|    param([AllowNull()][string]$Ip)
|    $m = [regex]::Match("$Ip".Trim(), '^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$')
|    [bool]($m.Success -and -not @(1..4 | Where-Object { [int]$m.Groups[$_].Value -gt 255 }).Count)
|}
|
|function Get-SIReturnRouteCoverage {
|    <# PURE. Does -RouteTable (as ARM returns it) send every one of -Ranges to -NextHop as VirtualAppliance? With no
|       -NextHop, any VirtualAppliance next hop counts. @{ Ok; Missing (ranges without such a route); Conflicts (ranges whose
|       prefix a route sends elsewhere -- 'range -> hop (route name)') }. #>
|    param($RouteTable, [string[]]$Ranges = @(), [string]$NextHop = '')
|    $routes = @(Get-SIPnProp $RouteTable @('properties', 'routes') | Where-Object { $_ })
|    $missing = New-Object System.Collections.Generic.List[string]; $conflicts = New-Object System.Collections.Generic.List[string]
|    foreach ($rg in @($Ranges | Where-Object { $_ })) {
|        $same = @($routes | Where-Object { [string](Get-SIPnProp $_ @('properties', 'addressPrefix')) -eq $rg })
|        $good = @($same | Where-Object { [string](Get-SIPnProp $_ @('properties', 'nextHopType')) -eq 'VirtualAppliance' -and (-not $NextHop -or [string](Get-SIPnProp $_ @('properties', 'nextHopIpAddress')) -eq $NextHop) })
|        if ($good.Count) { continue }
|        $missing.Add($rg)
|        foreach ($s in $same) { $conflicts.Add(('{0} -> {1} {2} ({3})' -f $rg, [string](Get-SIPnProp $s @('properties', 'nextHopType')), [string](Get-SIPnProp $s @('properties', 'nextHopIpAddress')), [string](Get-SIPnProp $s @('name')))) }
|    }
|    @{ Ok = ($missing.Count -eq 0); Missing = $missing.ToArray(); Conflicts = $conflicts.ToArray() }
|}
|
|function Get-SIReturnRouteTableBody {
|    <#
|        PURE. The PUT body of the route table that sends each of -Ranges to -NextHop (VirtualAppliance), BGP route
|        propagation off. -Existing: the table as ARM returns it ($null = a new table, made in -Location, tagged as
|        SecurityInsight's). A route table PUT REPLACES its routes, so EVERY route that is there is carried over unchanged --
|        a route SecurityInsight did not make is never removed or changed. Per range: a route that already sends it to the next
|        hop is kept; SecurityInsight's own route (si-return-<range>) with another next hop is corrected; a range a FOREIGN route
|        sends elsewhere is NOT overwritten (Azure takes one route per prefix) -- it is a Conflict, said, for the customer.
|        @{ Body; Added; Updated; Kept (foreign routes carried over); Conflicts; Changed }.
|    #>
|    param($Existing, [Parameter(Mandatory)][string[]]$Ranges, [Parameter(Mandatory)][string]$NextHop, [string]$Location = '')
|    $routes = New-Object System.Collections.Generic.List[object]
|    $added = New-Object System.Collections.Generic.List[string]; $updated = New-Object System.Collections.Generic.List[string]
|    $kept = New-Object System.Collections.Generic.List[string]; $conflicts = New-Object System.Collections.Generic.List[string]
|    $conflictRanges = New-Object System.Collections.Generic.List[string]
|    $own = @{}; foreach ($rg in $Ranges) { $own[(Get-SIReturnRouteName -Range $rg)] = $rg }
|    foreach ($r in @(Get-SIPnProp $Existing @('properties', 'routes') | Where-Object { $_ })) {
|        $nm = [string](Get-SIPnProp $r @('name'))
|        $p = [ordered]@{ addressPrefix = [string](Get-SIPnProp $r @('properties', 'addressPrefix')); nextHopType = [string](Get-SIPnProp $r @('properties', 'nextHopType')) }
|        $hop = [string](Get-SIPnProp $r @('properties', 'nextHopIpAddress')); if ($hop) { $p['nextHopIpAddress'] = $hop }
|        if ($own.ContainsKey($nm) -and $p.addressPrefix -eq $own[$nm] -and -not ($p.nextHopType -eq 'VirtualAppliance' -and $hop -eq $NextHop)) {
|            $p = [ordered]@{ addressPrefix = $own[$nm]; nextHopType = 'VirtualAppliance'; nextHopIpAddress = $NextHop }; $updated.Add($own[$nm])
|        } elseif (-not $own.ContainsKey($nm)) { $kept.Add($nm) }
|        $routes.Add([ordered]@{ name = $nm; properties = $p })
|    }
|    foreach ($rg in $Ranges) {
|        $same = @($routes | Where-Object { [string]$_.properties.addressPrefix -eq $rg })
|        if ($same.Count) {
|            $ok = @($same | Where-Object { $_.properties.nextHopType -eq 'VirtualAppliance' -and [string]$_.properties.nextHopIpAddress -eq $NextHop })
|            if (-not $ok.Count) { $conflictRanges.Add($rg); foreach ($s in $same) { $conflicts.Add(('{0} -> {1} {2} (route {3}, not SecurityInsight''s: kept)' -f $rg, $s.properties.nextHopType, [string]$s.properties.nextHopIpAddress, $s.name)) } }
|            continue
|        }
|        $routes.Add([ordered]@{ name = (Get-SIReturnRouteName -Range $rg); properties = [ordered]@{ addressPrefix = $rg; nextHopType = 'VirtualAppliance'; nextHopIpAddress = $NextHop } }); $added.Add($rg)
|    }
|    $bgpOff = "$(Get-SIPnProp $Existing @('properties', 'disableBgpRoutePropagation'))" -eq 'True'
|    $body = [ordered]@{}
|    if ($Existing) {
|        $body['location'] = [string](Get-SIPnProp $Existing @('location'))
|        $tags = Get-SIPnProp $Existing @('tags'); if ($null -ne $tags) { $body['tags'] = ConvertTo-SIPnHashtable $tags }
|    } else { $body['location'] = $Location; $body['tags'] = [ordered]@{ purpose = 'securityinsight-private-network' } }
|    $body['properties'] = [ordered]@{ disableBgpRoutePropagation = $true; routes = @($routes.ToArray()) }
|    @{ Body = $body; Added = $added.ToArray(); Updated = $updated.ToArray(); Kept = $kept.ToArray(); Conflicts = $conflicts.ToArray(); ConflictRanges = $conflictRanges.ToArray()
|       Changed = [bool](-not $Existing -or $added.Count -or $updated.Count -or -not $bgpOff) }
|}
|
|function Get-SIReturnRouteFacts {
|    <# READ ONLY. The return route of -Target's apps subnet: its answers (returnRouteRanges / returnRouteNextHop), whether
|       the network is SecurityInsight's own, the route table attached to the apps subnet and whether it covers the ranges.
|       @{ SubnetName; SubnetId; SubnetRead; Own; Ranges; Bad; NextHop; Answers; RouteTableId; RouteTableName; Covered; Missing;
|          Conflicts; HasApplianceRoute; ResourceGroup; VnetId }. Never writes, never throws for a read that fails. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][System.Collections.IDictionary]$Target)
|    $vnetId = ([string]$Target['VnetId']).TrimEnd('/'); $snName = [string]$Target['AppsSubnetName']; if (-not $snName) { $snName = (Get-SIPrivateNetworkNames).AppsSubnet }
|    $rr = ConvertTo-SIReturnRouteRanges $Target['ReturnRouteRanges']; $hop = ([string]$Target['ReturnRouteNextHop']).Trim()
|    $rgId = ([string]$Target['ResourceGroupId']).TrimEnd('/')
|    $f = [ordered]@{ SubnetName = $snName; SubnetId = $(if ($vnetId) { '{0}/subnets/{1}' -f $vnetId, $snName } else { '' }); SubnetRead = $false; Own = [bool]$Target['CreateVnet']
|                     Ranges = @($rr.Ranges); Bad = @($rr.Bad); NextHop = $hop; Answers = [bool](@($rr.Ranges).Count -and (Test-SIIpv4Address $hop))
|                     RouteTableId = ''; RouteTableName = ''; Covered = $false; Missing = @($rr.Ranges); Conflicts = @(); HasApplianceRoute = $false
|                     ResourceGroup = $(if ($rgId) { ($rgId -split '/')[-1] } else { '' }); VnetId = $vnetId }
|    if (-not $vnetId) { return $f }
|    try {
|        if (-not $f.Own) { $f.Own = [bool](Test-SIOwnSpokeVnet -Vnet (& $Arm 'GET' ('{0}?api-version={1}' -f $vnetId, $script:SIPnNetApi) $null) -ResourceGroupId $rgId) }
|        $sn = & $Arm 'GET' ('{0}?api-version={1}' -f $f.SubnetId, $script:SIPnNetApi) $null
|        if (-not $sn) { return $f }
|        $f.SubnetRead = $true
|        $f.RouteTableId = [string](Get-SIPnProp $sn @('properties', 'routeTable', 'id'))
|        if (-not $f.RouteTableId) { return $f }
|        $f.RouteTableName = ($f.RouteTableId.TrimEnd('/') -split '/')[-1]
|        $rt = & $Arm 'GET' ('{0}?api-version={1}' -f $f.RouteTableId.TrimEnd('/'), $script:SIPnNetApi) $null
|        $f.HasApplianceRoute = [bool]@(Get-SIPnProp $rt @('properties', 'routes') | Where-Object { $_ } | Where-Object { [string](Get-SIPnProp $_ @('properties', 'nextHopType')) -eq 'VirtualAppliance' -or [string](Get-SIPnProp $_ @('properties', 'addressPrefix')) -eq '0.0.0.0/0' }).Count
|        if (@($f.Ranges).Count) { $c = Get-SIReturnRouteCoverage -RouteTable $rt -Ranges @($f.Ranges) -NextHop $(if (Test-SIIpv4Address $hop) { $hop } else { '' }); $f.Covered = [bool]$c.Ok; $f.Missing = @($c.Missing); $f.Conflicts = @($c.Conflicts) }
|    } catch { }
|    $f
|}
|
|function Get-SIReturnRouteHandOff {
|    <# PURE. The network hand-off's RETURN ROUTE item from -Facts (Get-SIReturnRouteFacts; $null = not read: the item is
|       said in general). -Number: its number in the list. @{ Open (it counts as an open item); Done; Lines }. Open when the apps
|       subnet reads WITHOUT a route table, or a table that misses one of the ranges given; not counted when it was not read,
|       or a table is attached and no ranges are known (it is then a check for the network team). #>
|    param($Facts, [string]$Number = '6')
|    $L = New-Object System.Collections.Generic.List[string]
|    $sn = if ($Facts -and [string]$Facts['SubnetName']) { [string]$Facts['SubnetName'] } else { (Get-SIPrivateNetworkNames).AppsSubnet }
|    $ranges = if ($Facts) { @($Facts['Ranges'] | Where-Object { $_ }) } else { @() }; $hop = if ($Facts -and (Test-SIIpv4Address ([string]$Facts['NextHop']))) { [string]$Facts['NextHop'] } else { '' }
|    if ($Facts -and [bool]$Facts['SubnetRead'] -and [string]$Facts['RouteTableId'] -and $ranges.Count -and [bool]$Facts['Covered']) {
|        $L.Add(('{0}. RETURN ROUTE: done -- route table {1} on the apps subnet {2} sends {3} to {4} (VirtualAppliance).' -f $Number, $Facts['RouteTableName'], $sn, ($ranges -join ', '), $(if ($hop) { $hop } else { 'your firewall' })))
|        return @{ Open = $false; Done = $true; Lines = $L.ToArray() }
|    }
|    $r1 = if ($ranges.Count) { $ranges[0] } else { '<a range your people browse from>' }
|    $h1 = if ($hop) { $hop } else { '<its private IP>' }
|    $L.Add(('{0}. RETURN ROUTE: the apps subnet {1} needs a route for each range your people browse from (e.g. a route table: {2} -> your firewall {3} as VirtualAppliance), or replies time out.' -f $Number, $sn, $r1, $h1))
|    if ($ranges.Count) { foreach ($x in $ranges) { $L.Add(('        {0,-20} -> VirtualAppliance {1}' -f $x, $h1)) } }
|    if ($Facts -and [string]$Facts['RouteTableId']) {
|        $L.Add(('   the apps subnet has the route table {0}{1}' -f $Facts['RouteTableName'], $(if ($ranges.Count) { ' -- it has no such route for: ' + (@($Facts['Missing']) -join ', ') } else { ': check that it has these routes' })))
|        foreach ($c in @($Facts['Conflicts'] | Where-Object { $_ })) { $L.Add(('   a route there sends {0} -- your team decides which way it goes' -f $c)) }
|    } elseif ($Facts -and [bool]$Facts['SubnetRead']) { $L.Add('   the apps subnet has NO route table now: replies to your own ranges take Azure''s default route and are dropped by your firewall.') }
|    if ($Facts -and [bool]$Facts['Own'] -and -not [bool]$Facts['Answers']) {
|        $L.Add('   This is SecurityInsight''s own network: SecurityInsight makes the route table itself once it has the two answers. Give them and run again:')
|        $L.Add(('     the install command with -ReturnRouteRanges ''{0}'' -ReturnRouteNextHop ''{1}'' -Resume, or' -f $(if ($ranges.Count) { $ranges -join ',' } else { '<range>[,<range>]' }), $(if ($hop) { $hop } else { '<firewall private IP>' })))
|        $L.Add(('     ./setup/Set-SIPrivateNetworking.ps1 -ResourceGroup {0} -VnetId {1} -ReturnRouteRanges <range>[,<range>] -ReturnRouteNextHop <firewall private IP> -Apply -Steps return-route' -f $(if ([string]$Facts['ResourceGroup']) { $Facts['ResourceGroup'] } else { '<resource group>' }), $(if ([string]$Facts['VnetId']) { $Facts['VnetId'] } else { '<vnet id>' })))
|    }
|    $open = [bool]($Facts -and [bool]$Facts['SubnetRead'] -and (-not [string]$Facts['RouteTableId'] -or ($ranges.Count -and -not [bool]$Facts['Covered'])))
|    @{ Open = $open; Done = $false; Lines = $L.ToArray() }
|}
|
|function Set-SIReturnRoute {
|    <#
|        #1095. The return route of SecurityInsight's OWN spoke: with both answers given, the route table (the one attached to
|        the apps subnet, else rt-si in the install's resource group) sends each range to the next hop as VirtualAppliance, BGP
|        route propagation off; attached to the apps subnet. Every change READ BACK (the routes AND the attachment).
|        Idempotent: a table that is right is not written; routes SecurityInsight did not make are kept.
|        Changes NOTHING when the network is the customer's, or an answer is missing -- the hand-off item instead (HandOff).
|        -ReportOnly: the plan, nothing written.
|        Returns @{ Ok; Own; HandOff; Changed; Created; Attached; AttachedNow (attached by THIS call); RouteTableId; AddedRanges; Conflicts; Line; Lines }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][System.Collections.IDictionary]$Target, [string]$Location = '',
|          [switch]$ReportOnly, [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $f = Get-SIReturnRouteFacts -Arm $Arm -Target $Target
|    $out = { param($ok, $line, $extra) $h = @{ Ok = [bool]$ok; Own = [bool]$f.Own; HandOff = $false; Changed = $false; Created = $false; Attached = $false; RouteTableId = [string]$f.RouteTableId; AddedRanges = @(); Conflicts = @(); Line = $line; Lines = @($line) }; if ($extra) { foreach ($k in $extra.Keys) { $h[$k] = $extra[$k] } }; $h }
|    $sn = $f.SubnetName
|    if (-not $f.VnetId) { return (& $out $true 'return route: no network is named -- nothing to do' @{ HandOff = $true }) }
|    if (-not $f.Own) { return (& $out $true ('return route: the apps subnet {0} is in YOUR network -- SecurityInsight changes nothing there; the route is on the network hand-off (RETURN ROUTE)' -f $sn) @{ HandOff = $true }) }
|    if (@($f.Bad).Count) { return (& $out $false ('return route: returnRouteRanges holds what is not an address range ({0}) -- nothing was changed' -f (@($f.Bad) -join ', ')) $null) }
|    if (-not @($f.Ranges).Count -or -not "$($f.NextHop)") { return (& $out $true ('return route: not made -- the answers returnRouteRanges and returnRouteNextHop are not both given; it is on the network hand-off (RETURN ROUTE) with how to give them') @{ HandOff = $true }) }
|    if (-not (Test-SIIpv4Address $f.NextHop)) { return (& $out $false ('return route: returnRouteNextHop {0} is not an IPv4 address -- nothing was changed' -f $f.NextHop) $null) }
|    if (-not $f.SubnetRead) { return (& $out $false ('return route: the apps subnet {0} was not found -- nothing was changed (the subnets step makes it first)' -f $sn) $null) }
|    $rgId = ([string]$Target['ResourceGroupId']).TrimEnd('/')
|    # framework rule 11d: the table ATTACHED to the apps subnet is the one (never a second, never renamed); else rt-si
|    $rtId = if ($f.RouteTableId) { $f.RouteTableId.TrimEnd('/') } else { '{0}/providers/Microsoft.Network/routeTables/{1}' -f $rgId, (Get-SIReturnRouteTableName) }
|    $rtName = ($rtId -split '/')[-1]
|    $rtPath = '{0}?api-version={1}' -f $rtId, $script:SIPnNetApi
|    $have = & $Arm 'GET' $rtPath $null
|    $loc = $Location; if (-not $loc) { $loc = [string](Get-SIPnProp (& $Arm 'GET' ('{0}?api-version={1}' -f $f.VnetId, $script:SIPnNetApi) $null) @('location')) }
|    $b = Get-SIReturnRouteTableBody -Existing $have -Ranges @($f.Ranges) -NextHop $f.NextHop -Location $loc
|    $attached = [bool]$f.RouteTableId
|    $routeText = ((@($f.Ranges) | ForEach-Object { '{0} -> {1}' -f $_, $f.NextHop }) -join ', ')
|    if ($ReportOnly) {
|        $plan = @(); if ($b.Changed) { $plan += $(if ($have) { 'route table {0}: {1} (VirtualAppliance), BGP route propagation off' -f $rtName, $routeText } else { 'route table {0} made: {1} (VirtualAppliance), BGP route propagation off' -f $rtName, $routeText }) }
|        if (-not $attached) { $plan += ('attached to {0}' -f $sn) }
|        return (& $out $true $(if ($plan.Count) { 'return route WOULD be: ' + ($plan -join '; ') } else { 'return route: route table {0} on {1} sends {2} (VirtualAppliance) -- nothing to do' -f $rtName, $sn, $routeText }) @{ RouteTableId = $rtId; Conflicts = @($b.Conflicts) })
|    }
|    if (-not $loc) { return (& $out $false 'return route: the region of the network could not be read -- nothing was changed' $null) }
|    # the ranges SecurityInsight may route: a range a foreign route sends elsewhere stays the customer's (a Conflict, said)
|    $want = @(@($f.Ranges) | Where-Object { @($b.ConflictRanges) -notcontains $_ })
|    $isRight = { param($o) [bool]((Test-SIPnSucceeded $o) -and "$(Get-SIPnProp $o @('properties', 'disableBgpRoutePropagation'))" -eq 'True' -and (Get-SIReturnRouteCoverage -RouteTable $o -Ranges $want -NextHop $f.NextHop).Ok) }
|    $lines = New-Object System.Collections.Generic.List[string]
|    $ok = $true; $rtOk = $true
|    if ($b.Changed) {
|        $null = & $Arm 'PUT' $rtPath $b.Body
|        $back = Read-SIPnBack -Arm $Arm -Path $rtPath -Sleep $Sleep -Tries 12 -Test $isRight
|        $rtOk = [bool](& $isRight $back)
|        if ($rtOk) {
|            $lines.Add(('route table {0} {1}: {2} (VirtualAppliance), BGP route propagation off{3} (read back)' -f $rtName, $(if ($have) { 'converged' } else { 'made in the install''s resource group' }),
|                ((@($want) | ForEach-Object { '{0} -> {1}' -f $_, $f.NextHop }) -join ', '), $(if (@($b.Kept).Count) { '; routes it did not make kept: ' + (@($b.Kept) -join ', ') } else { '' })))
|        } else { $ok = $false; $lines.Add(('route table {0} does not read back with the routes {1} and BGP route propagation off after the change' -f $rtName, $routeText)) }
|    } else { $lines.Add(('route table {0} sends {1} (VirtualAppliance), BGP route propagation off -- nothing to change' -f $rtName, ((@($want) | ForEach-Object { '{0} -> {1}' -f $_, $f.NextHop }) -join ', '))) }
|    foreach ($c in @($b.Conflicts)) { $ok = $false; $lines.Add(('return route: a route that SecurityInsight did not make sends {0} -- not changed; your team decides which way it goes' -f $c)) }
|    $didAttach = $false
|    # attached once the table reads back right (a Conflict on one range does not keep the others from working)
|    if ($rtOk -and -not $attached) {
|        $snPath = '{0}?api-version={1}' -f $f.SubnetId, $script:SIPnNetApi
|        $snNow = & $Arm 'GET' $snPath $null
|        # a subnet PUT REPLACES the subnet: everything it has is carried over (its delegation, NSG, ...), the table added
|        $sb = Get-SISubnetBody -Subnet $snNow
|        $sb.properties['routeTable'] = [ordered]@{ id = $rtId }
|        $null = & $Arm 'PUT' $snPath $sb
|        $snBack = Read-SIPnBack -Arm $Arm -Path $snPath -Sleep $Sleep -Tries 12 -Test { param($o) (Test-SIPnSucceeded $o) -and (Test-SIPnSameId ([string](Get-SIPnProp $o @('properties', 'routeTable', 'id'))) $rtId) }
|        if ((Test-SIPnSucceeded $snBack) -and (Test-SIPnSameId ([string](Get-SIPnProp $snBack @('properties', 'routeTable', 'id'))) $rtId)) { $didAttach = $true; $lines.Add(('route table {0} attached to the apps subnet {1} (read back)' -f $rtName, $sn)) }
|        else { $ok = $false; $lines.Add(('route table {0} is NOT attached to the apps subnet {1} after the change -- run again' -f $rtName, $sn)) }
|    } elseif ($attached) { $lines.Add(('route table {0} is the one attached to the apps subnet {1} (reused as it is, never a second one)' -f $rtName, $sn)) }
|    $line = if ($ok) { 'return route: {0}' -f ($lines -join '; ') } else { 'return route NOT complete: {0}' -f ($lines -join '; ') }
|    @{ Ok = $ok; Own = $true; HandOff = (-not $ok); Changed = [bool]($b.Changed -or $didAttach); Created = [bool](-not $have); Attached = [bool]($attached -or $didAttach); AttachedNow = $didAttach
|       RouteTableId = $rtId; AddedRanges = @($b.Added); Conflicts = @($b.Conflicts); Line = $line; Lines = $lines.ToArray() }
|}
|
|function Invoke-SIPrivateNetworkReturnRoute {
|    <# Setup's call (#1095, the guided install's private-network step, every run until it is done): Set-SIReturnRoute over
|       setup's own ARM sign-in (Invoke-SIArm unless -Arm is given). Never throws for what it cannot do: said in the answer. #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Target, [string]$Location = '', [scriptblock]$Arm, [scriptblock]$Sleep, [string]$SubscriptionId)
|    if (-not $Arm) { $Arm = { param([string]$Method, [string]$Path, $Body) if ($Method -eq 'GET') { Invoke-SIArm -Path $Path -AllowNotFound } else { Invoke-SIArm -Method $Method -Path $Path -Body $Body } } }
|    if (-not $Sleep) { $Sleep = { param($s) Start-Sleep -Seconds $s } }
|    try { Set-SIReturnRoute -Arm $Arm -Target $Target -Location $Location -Sleep $Sleep }
|    catch { @{ Ok = $false; Own = $true; HandOff = $true; Changed = $false; Created = $false; Attached = $false; RouteTableId = ''; AddedRanges = @(); Conflicts = @(); Line = ('return route: {0} -- run again' -f $_.Exception.Message); Lines = @(('return route: {0}' -f $_.Exception.Message)) } }
|}
|
|function Get-SIPrivateNetworkReturnRouteCheck {
|    <# READ ONLY (#1095, the install's end check): on a private install WITH the answers, is the route table attached to the
|       apps subnet and does it send every range to the next hop? @{ Checked; Ok; Line; Fix }. Not read = not checked (never
|       reported as missing). #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Target, [scriptblock]$Arm, [string]$SubscriptionId)
|    if (-not $Arm) { $Arm = { param([string]$Method, [string]$Path, $Body) if ($Method -eq 'GET') { Invoke-SIArm -Path $Path -AllowNotFound } else { Invoke-SIArm -Method $Method -Path $Path -Body $Body } } }
|    $f = Get-SIReturnRouteFacts -Arm $Arm -Target $Target
|    if (-not $f.Answers -or -not $f.SubnetRead) { return @{ Checked = $false; Ok = $true; Line = ''; Fix = '' } }
|    if ($f.RouteTableId -and $f.Covered) { return @{ Checked = $true; Ok = $true; Line = ('the return route is in place: route table {0} on {1} sends {2} to {3}' -f $f.RouteTableName, $f.SubnetName, (@($f.Ranges) -join ', '), $f.NextHop); Fix = '' } }
|    $what = if (-not $f.RouteTableId) { 'the apps subnet {0} has no route table' -f $f.SubnetName } else { 'the route table {0} on {1} has no route to {2} for {3}' -f $f.RouteTableName, $f.SubnetName, $f.NextHop, (@($f.Missing) -join ', ') }
|    $fix = if ($f.Own) { './setup/Set-SIPrivateNetworking.ps1 -ResourceGroup {0} -VnetId {1} -ReturnRouteRanges {2} -ReturnRouteNextHop {3} -Apply -Steps return-route' -f $f.ResourceGroup, $f.VnetId, (@($f.Ranges) -join ','), $f.NextHop }
|           else { 'your network team: the RETURN ROUTE item of the network hand-off (a route table on {0}: each range -> {1} as VirtualAppliance)' -f $f.SubnetName, $f.NextHop }
|    @{ Checked = $true; Ok = $false; Line = ('{0} -- replies to your people''s ranges time out' -f $what); Fix = $fix }
|}
|
|function Get-SIUpdateReturnRouteReport {
|    <# THE UPDATER'S CALL (#1095), REPORT ONLY: a PRIVATE install (Get-SIInstallPrivateState) whose apps subnet has no route
|       table, or a table with neither a 0.0.0.0/0 route nor a VirtualAppliance route, is said as a warning -- NEVER made: the
|       next hop is a customer value the updater cannot know. @{ Private; Warn; Line }. Never writes; never throws. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$ResourceGroupId)
|    try {
|        $st = Get-SIInstallPrivateState -Arm $Arm -ResourceGroupId $ResourceGroupId
|        if (-not $st.Private -or -not $st.SubnetId) { return @{ Private = [bool]$st.Private; Warn = $false; Line = '' } }
|        $f = Get-SIReturnRouteFacts -Arm $Arm -Target ([ordered]@{ VnetId = $st.VnetId; AppsSubnetName = (($st.SubnetId -split '/')[-1]); ResourceGroupId = $ResourceGroupId })
|        if (-not $f.SubnetRead) { return @{ Private = $true; Warn = $false; Line = ('return route: the apps subnet {0} could not be read -- not checked' -f $f.SubnetName) } }
|        if ($f.RouteTableId -and $f.HasApplianceRoute) { return @{ Private = $true; Warn = $false; Line = ('return route: the apps subnet {0} has the route table {1}' -f $f.SubnetName, $f.RouteTableName) } }
|        $why = if ($f.RouteTableId) { 'its route table {0} has no 0.0.0.0/0 or VirtualAppliance route' -f $f.RouteTableName } else { 'it has no route table' }
|        @{ Private = $true; Warn = $true; Line = ('return route: the apps subnet {0} of this private install: {1}. Behind a firewall in a hub, replies to your people''s ranges time out. NOT changed by the updater (the firewall''s IP is yours): give the ranges and the firewall IP -- ./setup/Set-SIPrivateNetworking.ps1 -ReturnRouteRanges <range>[,<range>] -ReturnRouteNextHop <firewall private IP> -Apply -Steps return-route (SecurityInsight''s own network), or your network team adds the route (your network)' -f $f.SubnetName, $why) }
|    } catch { @{ Private = $false; Warn = $false; Line = ('return route: not checked ({0})' -f $_.Exception.Message) } }
|}
|
|function Get-SIRegistryCloseProblem {
|    <# PURE. Why the registry's public endpoint may NOT close yet ('' = it may): its private endpoint approved, and an agent
|       pool of it provisioned in the network (PIM: refused until the registry has an approved private endpoint and the build
|       pool runs in the VNet). Without both, the next image build -- the updater's -- has no way in. #>
|    param($RegistryEndpoint, [object[]]$Pools = @(), [string]$VnetId = '')
|    $why = @()
|    if (-not ((Test-SIPnSucceeded $RegistryEndpoint) -and (Get-SIPrivateEndpointState $RegistryEndpoint) -eq 'Approved')) { $why += 'the registry''s private endpoint (pe-si-registry) is not there and approved -- run private-endpoints and private-dns' }
|    if (-not @($Pools | Where-Object { Test-SIAcrAgentPoolInNetwork -Pool $_ -VnetId $VnetId }).Count) { $why += 'no agent pool of the registry runs in the network, so image builds could not reach a closed registry -- run registry-agent-pool' }
|    $why -join '; '
|}
|
|# ============================================================================================================== THE REGISTRY, PRIVATE FROM BIRTH
|
|# Framework installer rule 11b (Invardia 2026-11-04): "The container registry of a private install is private from birth
|# too ... On a private install: Premium + private endpoint + the azurecr zone in the preflight from the first create, images
|# built inside the network, admin user OFF, pulls by managed identity." Rule 11 (made general the same day): made, recovered
|# OR FOUND, every resource of a private install ends private, read back. A registry an earlier release made Basic, public,
|# admin user on (a customer's private install stopped before its image build, 2026-11-04) is CONVERGED to this shape.
|
|function Get-SIPrivateRegistryBody {
|    <# PURE. A private install's container registry as it is CREATED: Premium (a private endpoint needs it), public network
|       access Disabled, trusted Azure services allowed (networkRuleBypassOptions AzureServices), the admin user OFF. #>
|    param([Parameter(Mandatory)][string]$Location)
|    [ordered]@{ location = $Location; sku = [ordered]@{ name = 'Premium' }; properties = [ordered]@{
|        adminUserEnabled = $false; publicNetworkAccess = 'Disabled'; networkRuleBypassOptions = 'AzureServices' } }
|}
|
|function Get-SIRegistryPrivateGap {
|    <# PURE. What keeps -Registry (as ARM returns it) from the private shape: a subset of 'sku', 'public', 'bypass', 'admin'
|       (none = private). A registry that is not there has every gap. #>
|    param($Registry)
|    $gap = @()
|    if ([string](Get-SIPnProp $Registry @('sku', 'name')) -ne 'Premium') { $gap += 'sku' }
|    if ([string](Get-SIPnProp $Registry @('properties', 'publicNetworkAccess')) -ne 'Disabled') { $gap += 'public' }
|    if ([string](Get-SIPnProp $Registry @('properties', 'networkRuleBypassOptions')) -ne 'AzureServices') { $gap += 'bypass' }
|    if (-not $Registry -or [bool](Get-SIPnProp $Registry @('properties', 'adminUserEnabled'))) { $gap += 'admin' }
|    $gap
|}
|
|function Get-SIRegistryPasswordUsers {
|    <# PURE. The jobs / container apps (as ARM returns them) that sign in to the registry -LoginServer with its admin
|       password (configuration.registries[].passwordSecretRef). Turning the admin user off would stop their pulls. #>
|    param([object[]]$Apps = @(), [string]$LoginServer = '')
|    $server = "$LoginServer".Trim().ToLowerInvariant()
|    @(foreach ($a in @($Apps | Where-Object { $null -ne $_ })) {
|        foreach ($r in @(Get-SIPnProp $a @('properties', 'configuration', 'registries') | Where-Object { $_ })) {
|            $rs = ([string](Get-SIPnProp $r @('server'))).Trim().ToLowerInvariant()
|            if ([string](Get-SIPnProp $r @('passwordSecretRef')) -and (-not $server -or -not $rs -or $rs -eq $server)) { [string](Get-SIPnProp $a @('name')); break }
|        }
|    })
|}
|
|function Set-SIPrivateRegistry {
|    <#
|        The container registry -RegistryId in its PRIVATE shape (Get-SIPrivateRegistryBody), idempotent, READ BACK:
|          not there   created private (Premium, public access Disabled, trusted services allowed, admin user off)
|          found       converged: the tier to Premium first (Azure takes publicNetworkAccess Disabled on Premium only), then
|                      public access Disabled + trusted services allowed + the admin user off -- nothing in it changes
|        -PasswordUsers: jobs / apps that still pull with the admin password -- the admin user then STAYS on (said, Ok false):
|        it is never pulled out from under a running pull. Returns @{ Ok; Created; Changed; Gap; Line; Registry }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$RegistryId, [Parameter(Mandatory)][string]$Location,
|          [string[]]$PasswordUsers = @(), [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $path = '{0}?api-version={1}' -f $RegistryId.TrimEnd('/'), $script:SIPnAcrApi
|    $name = ($RegistryId.TrimEnd('/') -split '/')[-1]
|    $users = @($PasswordUsers | Where-Object { $_ })
|    $have = & $Arm 'GET' $path $null
|    $created = $false; $changed = @()
|    if (-not $have) {
|        $null = & $Arm 'PUT' $path (Get-SIPrivateRegistryBody -Location $Location)
|        $created = $true
|    } else {
|        $gap = @(Get-SIRegistryPrivateGap $have)
|        if ($gap -contains 'sku') {
|            $null = & $Arm 'PATCH' $path ([ordered]@{ sku = [ordered]@{ name = 'Premium' } })
|            $null = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Tries 12 -Test { param($o) [string](Get-SIPnProp $o @('sku', 'name')) -eq 'Premium' }
|            $changed += 'Premium'
|        }
|        $props = [ordered]@{}
|        if ($gap -contains 'public') { $props['publicNetworkAccess'] = 'Disabled'; $changed += 'public access Disabled' }
|        if ($gap -contains 'bypass') { $props['networkRuleBypassOptions'] = 'AzureServices'; $changed += 'trusted Azure services allowed' }
|        if ($gap -contains 'admin' -and -not $users.Count) { $props['adminUserEnabled'] = $false; $changed += 'admin user off' }
|        if ($props.Count) { $null = & $Arm 'PATCH' $path ([ordered]@{ properties = $props }) }
|    }
|    $want = { param($o) $g = @(Get-SIRegistryPrivateGap $o); if ($users.Count) { $g = @($g | Where-Object { $_ -ne 'admin' }) }; $o -and -not $g.Count -and (Test-SIPnSucceeded $o) }
|    $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Tries 30 -Test $want
|    $left = @(Get-SIRegistryPrivateGap $back)
|    $ok = [bool]($back -and -not $left.Count -and (Test-SIPnSucceeded $back))
|    $what = 'Premium, public access Disabled, trusted Azure services allowed, admin user off'
|    $line = if ($ok -and $created) { 'container registry {0} created private ({1}; read back)' -f $name, $what }
|            elseif ($ok -and $changed.Count) { 'container registry {0} made private: {1} (read back: {2})' -f $name, ($changed -join ', '), $what }
|            elseif ($ok) { 'container registry {0} is private ({1})' -f $name, $what }
|            elseif (-not $back) { 'container registry {0} does not read back after it was created' -f $name }
|            elseif ($left.Count -eq 1 -and $left[0] -eq 'admin' -and $users.Count) { 'container registry {0} is private, but its admin user STAYS ON: {1} still pull(s) with its password -- they must pull as their managed identity first' -f $name, ($users -join ', ') }
|            else { 'container registry {0} does not read back private yet (still: {1})' -f $name, ($left -join ', ') }
|    @{ Ok = $ok; Created = $created; Changed = @($changed); Gap = $left; Line = $line; Registry = $back }
|}
|
|function Get-SIRegistryDnsNames {
|    <# PURE. The names of -Registry that its private endpoint answers for: the login server and the data endpoint of its
|       region (<name>.<region>.data.azurecr.io -- the image layers come from there), or the data endpoints Azure names. #>
|    param($Registry)
|    if (-not $Registry) { return @() }
|    $out = New-Object System.Collections.Generic.List[string]
|    $ls = ([string](Get-SIPnProp $Registry @('properties', 'loginServer'))).Trim().ToLowerInvariant()
|    $nm = ([string](Get-SIPnProp $Registry @('name'))).Trim().ToLowerInvariant()
|    if (-not $ls -and $nm) { $ls = '{0}.azurecr.io' -f $nm }
|    if ($ls) { $out.Add($ls) }
|    $data = @(Get-SIPnProp $Registry @('properties', 'dataEndpointHostNames') | Where-Object { $_ } | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() })
|    if (-not $data.Count) {
|        $loc = (([string](Get-SIPnProp $Registry @('location'))) -replace '\s', '').ToLowerInvariant()
|        $short = if ($ls) { ($ls -split '\.')[0] } else { $nm }
|        if ($short -and $loc) { $data = @('{0}.{1}.data.azurecr.io' -f $short, $loc) }
|    }
|    foreach ($d in $data) { if (-not $out.Contains($d)) { $out.Add($d) } }
|    $out.ToArray()
|}
|
|function Invoke-SIPrivateNetworkRegistry {
|    <#
|        Setup's call AND the updater's (framework installer rule 11b; owner 2026-11-04: "if we have leftovers that are wrong,
|        then we must handle that"): the registry of a private install private BEFORE its first image build --
|          1. the registry created private, or a found one converged (Set-SIPrivateRegistry; the admin user stays on only
|             while a job or app still pulls with its password, named);
|          2. its private endpoint pe-si-registry + the privatelink.azurecr.io zone + link + zone group (the vault's and the
|             storage's mechanism: a central group's zone is used, a write SecurityInsight may not make is a hand-off line);
|          3. its agent pool in the network (si-vnet-pool, the endpoints subnet): image builds run inside it from the first;
|          4. the DNS check FROM THIS MACHINE for the registry's names (login server + data endpoint) -- -SkipDnsGate for
|             the updater, which runs inside the environment.
|        Returns @{ Ok; Lines; HandOff; Gate; RegistryOk; NetworkShapeOk; EndpointsOk; PoolOk; AgentPool; LoginServer; PasswordUsers }.
|    #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Target, [Parameter(Mandatory)][string]$Location, [Parameter(Mandatory)][string]$RegistryId,
|          [string]$EndpointsSubnetId = '', [scriptblock]$Resolve, [switch]$SkipDnsGate, [switch]$SkipAgentPool,
|          # where a registry that is not there yet is created (the install's region); -Location is the endpoint's (the network's)
|          [string]$RegistryLocation = '',
|          [scriptblock]$Arm, [scriptblock]$Sleep, [string]$SubscriptionId)
|    if (-not $Arm) { $Arm = { param([string]$Method, [string]$Path, $Body) if ($Method -eq 'GET') { Invoke-SIArm -Path $Path -AllowNotFound } else { Invoke-SIArm -Method $Method -Path $Path -Body $Body } } }
|    if (-not $Sleep) { $Sleep = { param($s) Start-Sleep -Seconds $s } }
|    if (-not $EndpointsSubnetId) { $EndpointsSubnetId = '{0}/subnets/{1}' -f ([string]$Target['VnetId']).TrimEnd('/'), [string]$Target['EndpointsSubnetName'] }
|    $lines = New-Object System.Collections.Generic.List[string]; $handOff = New-Object System.Collections.Generic.List[string]
|    $rg = ([string]$Target['ResourceGroupId']).TrimEnd('/')
|    # who still pulls with the registry's password (an install from before the managed identity) -- read, never guessed
|    $pulls = @()
|    foreach ($t in 'Microsoft.App/jobs', 'Microsoft.App/containerApps') { $pulls += @(Get-SIPnArmList -Arm $Arm -Path ('{0}/providers/{1}?api-version={2}' -f $rg, $t, $script:SIPnAppApi)) }
|    $regNow = & $Arm 'GET' ('{0}?api-version={1}' -f $RegistryId, $script:SIPnAcrApi) $null
|    $users = @(Get-SIRegistryPasswordUsers -Apps $pulls -LoginServer ([string](Get-SIPnProp $regNow @('properties', 'loginServer'))))
|    $regLoc = [string](Get-SIPnProp $regNow @('location')); if (-not $regLoc) { $regLoc = $(if ($RegistryLocation) { $RegistryLocation } else { $Location }) }
|    $r = Set-SIPrivateRegistry -Arm $Arm -RegistryId $RegistryId -Location $regLoc -PasswordUsers $users -Sleep $Sleep
|    $lines.Add($r.Line)
|    $regOk = [bool]$r.Ok
|    # the shape that matters for the network (Premium, closed) may be there while the admin user waits for a pull to move
|    $netOk = $r.Registry -and -not @(@($r.Gap) | Where-Object { $_ -ne 'admin' }).Count
|    $ep = @{ Ok = $false; Lines = @(); HandOff = @() }
|    if ($netOk) { $ep = Set-SIPrivateEndpointsWithDns -Arm $Arm -Target $Target -Location $Location -EndpointsSubnetId $EndpointsSubnetId -RegistryId $RegistryId -Sleep $Sleep }
|    foreach ($x in @($ep.Lines)) { $lines.Add($x) }; foreach ($x in @($ep.HandOff)) { $handOff.Add($x) }
|    $poolName = (Get-SIPrivateNetworkNames).AgentPool
|    $pool = @{ Ok = [bool]$SkipAgentPool; Line = ''; Blocked = $false; Step = '' }
|    if ($netOk -and -not $SkipAgentPool) {
|        # #1087: the build subnet's outbound path first -- SecurityInsight's own spoke (vnetAddressPrefix, no vnetId: CreateVnet)
|        # gets it, a customer's network is never changed (the one customer step); never a pool that is certain to fail
|        try { $pool = Invoke-SIAcrAgentPoolStep -Arm $Arm -RegistryId $RegistryId -Name $poolName -Location $regLoc -SubnetId $EndpointsSubnetId -OwnNetwork ([bool]$Target['CreateVnet']) -ResourceGroupId $rg -Sleep $Sleep }
|        catch { $pool = @{ Ok = $false; Blocked = $false; Step = ''; Line = ('the registry''s agent pool {0} could not be made in the network: {1}' -f $poolName, $_.Exception.Message) } }
|        if ([string]$pool.OutboundLine -and [string]$pool.OutboundLine -ne [string]$pool.Line) { $lines.Add([string]$pool.OutboundLine) }
|        $lines.Add($pool.Line)
|    }
|    $gate = @{ Ok = $true; Lines = @(); Failed = @(); Records = @(); Names = @() }
|    if (-not $SkipDnsGate -and $ep.Ok) {
|        $gate = Invoke-SIPrivateNetworkDnsGate -Arm $Arm -Target $Target -RegistryId $RegistryId -Resolve $Resolve
|        foreach ($x in @($gate.Lines)) { $lines.Add($x) }
|    }
|    @{ Ok = [bool]($netOk -and $ep.Ok -and $pool.Ok -and $gate.Ok); Lines = $lines.ToArray(); HandOff = $handOff.ToArray(); Gate = $gate
|       RegistryOk = $regOk; NetworkShapeOk = [bool]$netOk; EndpointsOk = [bool]$ep.Ok; PoolOk = [bool]$pool.Ok
|       PoolBlocked = [bool]$pool.Blocked; OutboundStep = [string]$pool.Step; AgentPool = $(if ($pool.Ok -and -not $SkipAgentPool) { $poolName } else { '' })
|       LoginServer = [string](Get-SIPnProp $r.Registry @('properties', 'loginServer')); PasswordUsers = $users }
|}
|
|function Get-SIInstallPrivateState {
|    <# READ ONLY. Is the install in -ResourceGroupId PRIVATE -- does the environment its jobs run in sit internal in a
|       subnet? @{ Private; EnvironmentId; SubnetId; VnetId }. No job, or an environment that cannot be read = not private
|       (nothing is changed for it). #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$ResourceGroupId)
|    $no = @{ Private = $false; EnvironmentId = ''; SubnetId = ''; VnetId = '' }
|    $jobs = @(Get-SIPnArmList -Arm $Arm -Path ('{0}/providers/Microsoft.App/jobs?api-version={1}' -f $ResourceGroupId.TrimEnd('/'), $script:SIPnAppApi))
|    $envId = @($jobs | ForEach-Object { [string](Get-SIPnProp $_ @('properties', 'environmentId')) } | Where-Object { $_ } | Select-Object -Unique)[0]
|    if (-not $envId) { return $no }
|    $env = & $Arm 'GET' ('{0}?api-version={1}' -f $envId, $script:SIPnAppApi) $null
|    if (-not (Test-SIEnvironmentPrivate -Environment $env)) { return $no }
|    $sn = [string](Get-SIPnProp $env @('properties', 'vnetConfiguration', 'infrastructureSubnetId'))
|    @{ Private = $true; EnvironmentId = $envId; SubnetId = $sn; VnetId = ($sn -replace '(?i)/subnets/[^/]+$', '') }
|}
|
|function Invoke-SIUpdatePrivateRegistry {
|    <#
|        THE UPDATER'S CALL (framework installer rule 11, general since 2026-11-04: made, recovered OR FOUND, every resource
|        of a private install ends private, read back; the owner the same day: "if we have leftovers that are wrong, then we
|        must handle that" -- existing installs reach the new-install state through the updater). Runs INSIDE the install's
|        environment, so it checks name resolution from where the jobs pull. For a PRIVATE install only (Get-SIInstallPrivateState);
|        a public install is not touched (rule 11b covers private installs; a public one keeps its Basic registry).
|          1. the registry Premium (a private endpoint needs it; nothing in it changes);
|          2. the admin user OFF -- only when no job or app still pulls with its password (they are named otherwise);
|          3. its private endpoint pe-si-registry (+ zone, link, zone group) when it has none -- in the endpoints subnet of the
|             install's other private endpoints;
|          4. its agent pool in that subnet, so image builds run inside the network;
|          5. public network access CLOSED (Disabled, trusted Azure services allowed) -- ONLY when 3 and 4 read back AND the
|             registry's names resolve to private addresses HERE, inside (never a closed registry the jobs cannot reach).
|        -WhatIf: the plan only. Never throws for a step it cannot make: said, the next update tries again.
|        Returns @{ Private; Ok; Lines; Closed; Changed }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$ResourceGroupId, [Parameter(Mandatory)][string]$RegistryId,
|          [scriptblock]$Resolve, [switch]$WhatIf, [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $lines = New-Object System.Collections.Generic.List[string]; $changed = New-Object System.Collections.Generic.List[string]
|    $st = Get-SIInstallPrivateState -Arm $Arm -ResourceGroupId $ResourceGroupId
|    if (-not $st.Private) { return @{ Private = $false; Ok = $true; Lines = @(); Closed = $false; Changed = @() } }
|    $rgId = $ResourceGroupId.TrimEnd('/')
|    $regPath = '{0}?api-version={1}' -f $RegistryId.TrimEnd('/'), $script:SIPnAcrApi
|    $reg = & $Arm 'GET' $regPath $null
|    $name = ($RegistryId.TrimEnd('/') -split '/')[-1]
|    if (-not $reg) { return @{ Private = $true; Ok = $false; Lines = @(('container registry {0} was not found' -f $name)); Closed = $false; Changed = @() } }
|    $gap = @(Get-SIRegistryPrivateGap $reg)
|    # #1087: a private registry whose agent pool does not run (Azure left it Failed -- e.g. a build subnet without an
|    # outbound path) is not done: it goes on to the pool step (the outbound check first), so the next build has its pool
|    $poolNow = & $Arm 'GET' ('{0}/agentPools/{1}?api-version={2}' -f $RegistryId.TrimEnd('/'), (Get-SIPrivateNetworkNames).AgentPool, $script:SIPnAcrTasksApi) $null
|    if (-not $gap.Count -and (Test-SIPnSucceeded $poolNow)) { return @{ Private = $true; Ok = $true; Lines = @(('container registry {0} is private (Premium, public access Disabled, trusted Azure services allowed, admin user off)' -f $name)); Closed = $true; Changed = @() } }
|    $pulls = @()
|    foreach ($t in 'Microsoft.App/jobs', 'Microsoft.App/containerApps') { $pulls += @(Get-SIPnArmList -Arm $Arm -Path ('{0}/providers/{1}?api-version={2}' -f $rgId, $t, $script:SIPnAppApi)) }
|    $users = @(Get-SIRegistryPasswordUsers -Apps $pulls -LoginServer ([string](Get-SIPnProp $reg @('properties', 'loginServer'))))
|    $prefix = (Get-SIPrivateNetworkNames).EndpointPrefix
|    $peOf = { param($k) & $Arm 'GET' ('{0}/providers/Microsoft.Network/privateEndpoints/{1}{2}?api-version={3}' -f $rgId, $prefix, $k, $script:SIPnNetApi) $null }
|    $regPe = & $peOf 'registry'
|    # the endpoints subnet: the one the registry's endpoint -- else the vault's, the storage's -- sits in (the install made them)
|    $peSubnet = ''
|    foreach ($k in 'registry', 'vault', 'blob', 'sql') { $p = $(if ($k -eq 'registry') { $regPe } else { & $peOf $k }); $s = [string](Get-SIPnProp $p @('properties', 'subnet', 'id')); if ($s) { $peSubnet = $s; break } }
|    # INS-06 (framework installer rule 8) for the UPDATE: the update adds a private resource here (the registry's private
|    # endpoint + its privatelink zone), so the zone's prerequisites are READ before its first change (the Premium SKU): a
|    # real missing item holds the whole change (nothing is changed; the next update checks again); a read that fails is
|    # "not checked" and holds nothing.
|    $pre = $null
|    if ($peSubnet -and -not ((Test-SIPnSucceeded $regPe) -and (Get-SIPrivateEndpointState $regPe) -eq 'Approved')) {
|        $preTarget = Get-SIInstallPrivateNetworkTarget -Values ([ordered]@{ vnetId = ($peSubnet -replace '(?i)/subnets/[^/]+$', ''); endpointsSubnetName = (($peSubnet -split '/')[-1]) }) -ResourceGroupId $rgId
|        try { $pre = Get-SIPrivateNetworkPreflight -Arm $Arm -Target $preTarget -Sql $false -Vault $false -Storage $false -Registry $true -ZonesOnly } catch { $pre = $null }
|    }
|    $preHeld = [bool]($pre -and -not $pre.Ok)
|    $preLine = if ($preHeld) { 'container registry {0}: NOT made private -- the update holds before its first change, a prerequisite is missing: {1} (the next update checks again)' -f $name, ((@(Format-SIPrivateNetworkPreflightMissing -Missing @($pre.Missing))) -join ' ') } else { '' }
|    if ($WhatIf) {
|        if ($preHeld) { return @{ Private = $true; Ok = $true; Lines = @($preLine); Closed = $false; Changed = @() } }
|        $plan = @()
|        if ($gap -contains 'sku') { $plan += 'Premium' }
|        if ($gap -contains 'admin') { $plan += $(if ($users.Count) { 'admin user stays on ({0} pull with its password)' -f ($users -join ', ') } else { 'admin user off' }) }
|        if (-not $regPe) { $plan += 'its private endpoint' }
|        if ($peSubnet) { $ob = Set-SIBuildSubnetOutbound -Arm $Arm -SubnetId $peSubnet -ResourceGroupId $rgId -ReportOnly; if (-not $ob.Path -and ($ob.Blocked -or $ob.Line -match 'would get')) { $plan += $ob.Line } }
|        $plan += 'its agent pool in the network'
|        if ($gap -contains 'public' -or $gap -contains 'bypass') { $plan += 'public access closed once its names resolve to private addresses inside' }
|        return @{ Private = $true; Ok = $true; Lines = @(('container registry {0} would be made private: {1}' -f $name, ($plan -join '; '))); Closed = $false; Changed = @() }
|    }
|    if ($preHeld) { return @{ Private = $true; Ok = $false; Lines = @($preLine); Closed = $false; Changed = @() } }
|    $ok = $true
|    try {
|        if ($gap -contains 'sku') { $x = Set-SIRegistrySku -Arm $Arm -RegistryId $RegistryId -Sku 'Premium' -Sleep $Sleep; $lines.Add($x.Line); if ($x.Ok) { $changed.Add('Premium') } else { $ok = $false } }
|        if ($gap -contains 'admin') {
|            if ($users.Count) { $lines.Add(('container registry {0}: its admin user STAYS ON -- {1} still pull(s) with its password (they must pull as their managed identity first)' -f $name, ($users -join ', '))); $ok = $false }
|            else {
|                $null = & $Arm 'PATCH' $regPath ([ordered]@{ properties = [ordered]@{ adminUserEnabled = $false } })
|                $back = Read-SIPnBack -Arm $Arm -Path $regPath -Sleep $Sleep -Tries 12 -Test { param($o) $o -and -not [bool](Get-SIPnProp $o @('properties', 'adminUserEnabled')) }
|                if (-not [bool](Get-SIPnProp $back @('properties', 'adminUserEnabled'))) { $lines.Add(('container registry {0}: admin user off (read back)' -f $name)); $changed.Add('admin user off') } else { $lines.Add(('container registry {0}: the admin user still reads on after the change' -f $name)); $ok = $false }
|            }
|        }
|        if (-not $peSubnet) {
|            $lines.Add(('container registry {0}: no private endpoint of this install was found to place its own beside -- its public access stays as it is (Invardia support: setup\Set-SIPrivateNetworking.ps1 -Steps private-endpoints,private-dns,registry-agent-pool,registry-public-off)' -f $name))
|            return @{ Private = $true; Ok = $false; Lines = $lines.ToArray(); Closed = $false; Changed = $changed.ToArray() }
|        }
|        $vnet = $peSubnet -replace '(?i)/subnets/[^/]+$', ''
|        $target = Get-SIInstallPrivateNetworkTarget -Values ([ordered]@{ vnetId = $vnet; endpointsSubnetName = (($peSubnet -split '/')[-1]) }) -ResourceGroupId $rgId
|        $regLoc = [string](Get-SIPnProp $reg @('location'))
|        if (-not ((Test-SIPnSucceeded $regPe) -and (Get-SIPrivateEndpointState $regPe) -eq 'Approved')) {
|            $vnetObj = & $Arm 'GET' ('{0}?api-version={1}' -f $vnet, $script:SIPnNetApi) $null
|            $peLoc = [string](Get-SIPnProp $vnetObj @('location')); if (-not $peLoc) { $peLoc = $regLoc }
|            $ep = Set-SIPrivateEndpointsWithDns -Arm $Arm -Target $target -Location $peLoc -EndpointsSubnetId $peSubnet -RegistryId $RegistryId -Sleep $Sleep
|            foreach ($l in @($ep.Lines)) { $lines.Add($l) }
|            if ($ep.Ok) { $changed.Add('private endpoint') } else { $ok = $false }
|            $regPe = & $peOf 'registry'
|        }
|        # #1087: the same outbound check as setup before the pool (own spoke = read from the network: in this resource
|        # group, tagged by SecurityInsight); a customer's subnet without a path is REPORTED, the update goes on
|        $pool = Invoke-SIAcrAgentPoolStep -Arm $Arm -RegistryId $RegistryId -Name (Get-SIPrivateNetworkNames).AgentPool -Location $regLoc -SubnetId $peSubnet -ResourceGroupId $rgId -Sleep $Sleep
|        if ([string]$pool.OutboundLine -and [string]$pool.OutboundLine -ne [string]$pool.Line) { $lines.Add([string]$pool.OutboundLine); if ($pool.OutboundLine -match 'turned on') { $changed.Add('build subnet outbound') } }
|        $lines.Add($pool.Line); if ($pool.Created -and $pool.Ok) { $changed.Add('agent pool') }; if (-not $pool.Ok) { $ok = $false }
|        $closed = $false
|        if ($gap -contains 'public' -or $gap -contains 'bypass') {
|            $why = Get-SIRegistryCloseProblem -RegistryEndpoint $regPe -Pools @(& $Arm 'GET' ('{0}/agentPools/{1}?api-version={2}' -f $RegistryId.TrimEnd('/'), (Get-SIPrivateNetworkNames).AgentPool, $script:SIPnAcrTasksApi) $null) -VnetId $vnet
|            $names = @(Get-SIRegistryDnsNames -Registry (& $Arm 'GET' $regPath $null))
|            $res = Test-SIInsideResolution -Names $names -Resolve $Resolve
|            if ($why) { $lines.Add(('container registry {0}: its public access stays open for now -- {1}' -f $name, $why)); $ok = $false }
|            elseif (-not $res.Ok) {
|                $lines.Add(('container registry {0}: its public access stays open for now -- its names do not resolve to private addresses inside the network yet ({1}); the network hand-off lists the records' -f $name, (@($res.Failed) -join ', ')))
|                $ok = $false
|            } elseif ($gap -contains 'public') {
|                $c = Set-SIPublicAccess -Arm $Arm -ResourceId $RegistryId -Sleep $Sleep
|                $lines.Add($c.Line); if ($c.Ok) { $closed = $true; $changed.Add('public access closed') } else { $ok = $false }
|            } else {
|                # closed already, only trusted Azure services not allowed yet
|                $null = & $Arm 'PATCH' $regPath ([ordered]@{ properties = [ordered]@{ networkRuleBypassOptions = 'AzureServices' } })
|                $b2 = Read-SIPnBack -Arm $Arm -Path $regPath -Sleep $Sleep -Tries 12 -Test { param($o) [string](Get-SIPnProp $o @('properties', 'networkRuleBypassOptions')) -eq 'AzureServices' }
|                $closed = [string](Get-SIPnProp $b2 @('properties', 'networkRuleBypassOptions')) -eq 'AzureServices'
|                $lines.Add(('container registry {0}: trusted Azure services allowed{1}' -f $name, $(if ($closed) { ' (read back)' } else { ' -- NOT after the change' }))); if (-not $closed) { $ok = $false }
|            }
|        } else { $closed = $true }
|    } catch { $lines.Add(('container registry {0}: {1} -- the next update tries again' -f $name, $_.Exception.Message)); $ok = $false; $closed = $false }
|    @{ Private = $true; Ok = $ok; Lines = $lines.ToArray(); Closed = $closed; Changed = $changed.ToArray() }
|}
|
|# ============================================================================================================== THE IN-NETWORK SQL IDENTITY
|
|function Set-SISqlIdentity {
|    <# The in-network SQL identity (user-assigned, -Name, default id-si-sql) in -ResourceGroupId, idempotent, READ BACK until
|       Azure shows its principal and client id. Returns @{ Ok; Line; Id; PrincipalId; ClientId; Created }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$ResourceGroupId, [Parameter(Mandatory)][string]$Location,
|          [string]$Name = '', [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    if (-not $Name) { $Name = (Get-SIPrivateNetworkNames).SqlIdentity }
|    $id = '{0}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{1}' -f $ResourceGroupId.TrimEnd('/'), $Name
|    $path = '{0}?api-version={1}' -f $id, $script:SIPnMiApi
|    $have = & $Arm 'GET' $path $null
|    if (-not $have) { $null = & $Arm 'PUT' $path ([ordered]@{ location = $Location; tags = [ordered]@{ purpose = 'securityinsight-sql-in-network' } }) }
|    $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Tries 12 -PauseSeconds 5 -Test { param($o) [string](Get-SIPnProp $o @('properties', 'principalId')) -and [string](Get-SIPnProp $o @('properties', 'clientId')) }
|    $pid_ = [string](Get-SIPnProp $back @('properties', 'principalId')); $cid = [string](Get-SIPnProp $back @('properties', 'clientId'))
|    @{ Ok = [bool]($pid_ -and $cid); Created = (-not $have); Id = $id; PrincipalId = $pid_; ClientId = $cid
|       Line = $(if ($pid_ -and $cid) { 'the in-network SQL identity {0}{1} (client {2}; read back)' -f $Name, $(if ($have) { ' is there' } else { '' }), $cid } else { 'the in-network SQL identity {0} does not read back with its ids' -f $Name }) }
|}
|
|# ============================================================================================================== THE ENVIRONMENT
|
|function Get-SIPrivateEnvironmentBody {
|    <# PURE. A Container Apps environment in -SubnetId, INTERNAL (no public address), the Consumption workload profile,
|       logs through Azure Monitor (the diagnostic setting sends them to the install's workspace). #>
|    param([Parameter(Mandatory)][string]$Location, [Parameter(Mandatory)][string]$SubnetId)
|    [ordered]@{ location = $Location; properties = [ordered]@{
|        appLogsConfiguration = [ordered]@{ destination = 'azure-monitor' }
|        vnetConfiguration    = [ordered]@{ infrastructureSubnetId = $SubnetId; internal = $true }
|        workloadProfiles     = @([ordered]@{ name = 'Consumption'; workloadProfileType = 'Consumption' }) } }
|}
|
|function Test-SIEnvironmentPrivate {
|    <# PURE. Is -Environment in -SubnetId (any subnet when not given) and internal? #>
|    param($Environment, [string]$SubnetId = '')
|    $s = [string](Get-SIPnProp $Environment @('properties', 'vnetConfiguration', 'infrastructureSubnetId'))
|    if (-not $s) { return $false }
|    if ($SubnetId -and -not (Test-SIPnSameId $s $SubnetId)) { return $false }
|    [bool](Get-SIPnProp $Environment @('properties', 'vnetConfiguration', 'internal'))
|}
|
|function Set-SIPrivateEnvironment {
|    <# The private Container Apps environment -Name in -ResourceGroupId, idempotent, READ BACK until Azure has made it (up
|       to 30 minutes). An environment of that name that is NOT private is never changed (it is said). Its logs get the same
|       diagnostic settings as -LogsLikeId (the environment the install runs in now). Returns @{ Ok; Line; Environment; Created }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$ResourceGroupId, [Parameter(Mandatory)][string]$Name,
|          [Parameter(Mandatory)][string]$Location, [Parameter(Mandatory)][string]$SubnetId, [string]$LogsLikeId = '', [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $id = '{0}/providers/Microsoft.App/managedEnvironments/{1}' -f $ResourceGroupId.TrimEnd('/'), $Name
|    $path = '{0}?api-version={1}' -f $id, $script:SIPnAppApi
|    $have = & $Arm 'GET' $path $null
|    if ($have -and -not (Test-SIEnvironmentPrivate -Environment $have -SubnetId $SubnetId)) {
|        return @{ Ok = $false; Created = $false; Environment = $have; Line = ('the Container Apps environment {0} exists but is not in the subnet as an internal environment -- it is not changed' -f $Name) }
|    }
|    if ($have -and (Test-SIPnSucceeded $have)) { return @{ Ok = $true; Created = $false; Environment = $have; Line = ('the private Container Apps environment {0} is there' -f $Name) } }
|    if (-not $have) { $null = & $Arm 'PUT' $path (Get-SIPrivateEnvironmentBody -Location $Location -SubnetId $SubnetId) }
|    $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Tries 120 -PauseSeconds 15 -Test { param($o) [string](Get-SIPnProp $o @('properties', 'provisioningState')) -in 'Succeeded', 'Failed', 'Canceled' }
|    $ok = Test-SIPnSucceeded $back
|    $lines = @()
|    if ($ok -and $LogsLikeId) { $lines += (Copy-SIDiagnosticSettings -Arm $Arm -FromId $LogsLikeId -ToId $id).Line }
|    @{ Ok = [bool]$ok; Created = (-not $have); Environment = $back
|       Line = $(if ($ok) { (@(('the private Container Apps environment {0} (internal, in the subnet; read back)' -f $Name)) + $lines) -join '; ' } else { 'Azure did not make the environment {0} (it shows: {1})' -f $Name, [string](Get-SIPnProp $back @('properties', 'provisioningState')) }) }
|}
|
|function Copy-SIDiagnosticSettings {
|    <# The diagnostic settings of -FromId put on -ToId (same names, same destinations), each read back. Returns @{ Ok; Line }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$FromId, [Parameter(Mandatory)][string]$ToId)
|    $from = @(Get-SIPnArmList -Arm $Arm -Path ('{0}/providers/Microsoft.Insights/diagnosticSettings?api-version={1}' -f $FromId.TrimEnd('/'), $script:SIPnDiagApi))
|    if (-not $from.Count) { return @{ Ok = $true; Line = 'no diagnostic setting to carry over' } }
|    $done = @()
|    foreach ($d in $from) {
|        $n = [string](Get-SIPnProp $d @('name')); if (-not $n) { continue }
|        $p = '{0}/providers/Microsoft.Insights/diagnosticSettings/{1}?api-version={2}' -f $ToId.TrimEnd('/'), $n, $script:SIPnDiagApi
|        $null = & $Arm 'PUT' $p ([ordered]@{ properties = (ConvertTo-SIPnHashtable (Get-SIPnProp $d @('properties'))) })
|        if (& $Arm 'GET' $p $null) { $done += $n }
|    }
|    @{ Ok = ($done.Count -eq $from.Count); Line = ('its logs go where the current environment''s go ({0})' -f ($done -join ', ')) }
|}
|
|function Get-SIEnvironmentDnsRecordNames {
|    <# PURE. The A records of the environment's own zone, each -> its static IP (PIM's Get-PimPrivateDnsPlan): '@' the zone
|       apex, '*' every app's name, '*.internal' the environment-internal ingress names (<app>.internal.<domain>) -- a
|       wildcard matches ONE label, so '*' alone leaves those unresolved. #>
|    @('@', '*', '*.internal')
|}
|
|function Get-SIEnvironmentDnsMissing {
|    <# READ ONLY. What the environment's own zone still lacks in -ZoneResourceGroupId: the zone, a record, a link to one of
|       -LinkVnetIds (matched by the network). @() = complete. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$ZoneResourceGroupId, $Environment, [string[]]$LinkVnetIds = @())
|    $domain = [string](Get-SIPnProp $Environment @('properties', 'defaultDomain')); $ip = [string](Get-SIPnProp $Environment @('properties', 'staticIp'))
|    if (-not $domain -or -not $ip) { return @('the environment shows no default domain or internal address yet') }
|    $zid = '{0}/providers/Microsoft.Network/privateDnsZones/{1}' -f $ZoneResourceGroupId.TrimEnd('/'), $domain
|    if (-not (& $Arm 'GET' ('{0}?api-version={1}' -f $zid, $script:SIPnDnsApi) $null)) { return @(('the zone {0}' -f $domain)) }
|    $miss = New-Object System.Collections.Generic.List[string]
|    foreach ($rec in (Get-SIEnvironmentDnsRecordNames)) {
|        $have = & $Arm 'GET' ('{0}/A/{1}?api-version={2}' -f $zid, $rec, $script:SIPnDnsApi) $null
|        if (@(Get-SIPnProp $have @('properties', 'aRecords') | Where-Object { $_ } | ForEach-Object { [string](Get-SIPnProp $_ @('ipv4Address')) }) -notcontains $ip) { $miss.Add(('the record {0} -> {1}' -f $rec, $ip)) }
|    }
|    $links = @(Get-SIPnArmList -Arm $Arm -Path ('{0}/virtualNetworkLinks?api-version={1}' -f $zid, $script:SIPnDnsApi))
|    foreach ($v in @($LinkVnetIds | Where-Object { $_ })) {
|        if (-not @($links | Where-Object { Test-SIPnSameId ([string](Get-SIPnProp $_ @('properties', 'virtualNetwork', 'id'))) $v }).Count) { $miss.Add(('the link to {0}' -f ($v -split '/')[-1])) }
|    }
|    $miss.ToArray()
|}
|
|function Set-SIEnvironmentDns {
|    <# An internal environment's addresses resolve in the virtual network: the private DNS zone of its default domain, the
|       records '@', '*' and '*.internal' -> its internal address, linked to SecurityInsight's network -- and to the customer's
|       hub network ONLY when -HubVnetId is given (#866: the callers pass it only when the customer turned linkZonesToHub on
|       and the rights read back: by default SecurityInsight writes nothing on the hub) -- each network once. A hub link SecurityInsight may not write is a
|       hand-off line (HandOff), never a failure. Each read back. Returns @{ Ok; Lines; ZoneId; Created; Domain; StaticIp;
|       LinksCreated; HandOff }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$ZoneResourceGroupId, [Parameter(Mandatory)]$Environment,
|          [Parameter(Mandatory)][string]$VnetId, [string]$HubVnetId = '', [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $domain = [string](Get-SIPnProp $Environment @('properties', 'defaultDomain'))
|    $ip = [string](Get-SIPnProp $Environment @('properties', 'staticIp'))
|    if (-not $domain -or -not $ip) { return @{ Ok = $false; ZoneId = ''; Created = $false; Domain = $domain; StaticIp = $ip; LinksCreated = @(); HandOff = @(); Lines = @('the environment shows no default domain or internal address yet -- run again in a few minutes') } }
|    $lines = New-Object System.Collections.Generic.List[string]
|    # #866 item 6: SecurityInsight's own zone -- or the one of that name the network is already linked to (never two)
|    $zr = Resolve-SIPrivateDnsZone -Arm $Arm -Zone $domain -ResourceGroupId $ZoneResourceGroupId -VnetId $VnetId -SubscriptionIds (Get-SIZoneSearchSubscriptions @($ZoneResourceGroupId, $VnetId)) -Sleep $Sleep
|    $z = @{ Ok = $zr.Ok; Id = $zr.ZoneId; Created = $zr.Created; Line = $zr.Line }; $lines.Add($z.Line)
|    $ok = [bool]$z.Ok
|    foreach ($rec in (Get-SIEnvironmentDnsRecordNames)) {
|        $p = '{0}/A/{1}?api-version={2}' -f $z.Id, $rec, $script:SIPnDnsApi
|        $have = & $Arm 'GET' $p $null
|        $ips = @(Get-SIPnProp $have @('properties', 'aRecords') | Where-Object { $_ } | ForEach-Object { [string](Get-SIPnProp $_ @('ipv4Address')) })
|        if ($ips -contains $ip) { $lines.Add(('{0} {1} -> {2}' -f $rec, $domain, $ip)); continue }
|        $null = & $Arm 'PUT' $p ([ordered]@{ properties = [ordered]@{ ttl = 3600; aRecords = @([ordered]@{ ipv4Address = $ip }) } })
|        $back = & $Arm 'GET' $p $null
|        $bi = @(Get-SIPnProp $back @('properties', 'aRecords') | Where-Object { $_ } | ForEach-Object { [string](Get-SIPnProp $_ @('ipv4Address')) })
|        if ($bi -contains $ip) { $lines.Add(('{0} {1} -> {2} (read back)' -f $rec, $domain, $ip)) } else { $ok = $false; $lines.Add(('the record {0} of {1} does not read back' -f $rec, $domain)) }
|    }
|    $made = New-Object System.Collections.Generic.List[string]; $hand = New-Object System.Collections.Generic.List[string]
|    foreach ($v in @(Get-SIDnsLinkVnetIds -VnetId $VnetId -HubVnetId $HubVnetId)) {
|        $isHub = [bool]($HubVnetId -and (Test-SIPnSameId $v $HubVnetId) -and -not (Test-SIPnSameId $v $VnetId))
|        $l = Set-SIPrivateDnsLink -Arm $Arm -ZoneId $z.Id -VnetId $v -HandOffOnError:$isHub -Sleep $Sleep; $lines.Add($l.Line)
|        if ($l.Created) { $made.Add([string]$l.Id) }
|        if ($l.HandOff) { $hand.Add($l.Line) } elseif (-not $l.Ok) { $ok = $false }
|    }
|    @{ Ok = $ok; Lines = $lines.ToArray(); ZoneId = $z.Id; Created = [bool]$z.Created; Domain = $domain; StaticIp = $ip; LinksCreated = $made.ToArray(); HandOff = $hand.ToArray() }
|}
|
|# ============================================================================================================== THE INSIDE CHECK
|# #866 (PIM: Convert-PimToPrivate verify-inside, exit 10 until it passes): the public endpoints close only once the names
|# SecurityInsight and its users need resolve to PRIVATE addresses from inside -- from the machine that runs the install /
|# cut-over when it is inside, else from a one-time job in the install's own environment (the support SQL job's pattern).
|# A spoke whose virtual network asks the hub's DNS resolver (custom DNS servers) does NOT see SecurityInsight's spoke-linked
|# zones until the hub side is done: closing then would leave a database nothing can reach -- SecurityInsight's own jobs
|# included. Refused unless the check passes or the operator confirms it from inside (-ConfirmedFromInside).
|
|function Test-SIPrivateIpv4 {
|    <# PURE. Is -Ip an RFC1918 IPv4 address (10/8, 172.16/12, 192.168/16)? #>
|    param([AllowNull()][string]$Ip)
|    $m = [regex]::Match("$Ip".Trim(), '^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$')
|    if (-not $m.Success) { return $false }
|    $a = [int]$m.Groups[1].Value; $b = [int]$m.Groups[2].Value
|    foreach ($g in 1..4) { if ([int]$m.Groups[$g].Value -gt 255) { return $false } }
|    ($a -eq 10) -or ($a -eq 172 -and $b -ge 16 -and $b -le 31) -or ($a -eq 192 -and $b -eq 168)
|}
|
|function Get-SIPnHost { param([AllowNull()][string]$Url) $u = "$Url".Trim(); if (-not $u) { return '' }; ($u -replace '^[a-z]+://', '' -split '[/:]')[0].ToLowerInvariant() }
|
|function Get-SIInsideCheckNames {
|    <# PURE. The names that must resolve to private addresses before the public endpoints close: the web app's (and every
|       app's) address, the database server, the Key Vault and the storage account's blob / queue / table endpoints -- each
|       from what Azure says about the resource, each once. #>
|    param([string[]]$AppFqdns = @(), $SqlServer, $Vault, $Storage,
|          # rule 11b: the container registry's login server and data endpoint (Get-SIRegistryDnsNames)
|          $Registry)
|    $out = New-Object System.Collections.Generic.List[string]
|    $add = { param($n) $h = Get-SIPnHost $n; if ($h -and -not $out.Contains($h)) { $out.Add($h) } }
|    foreach ($f in @($AppFqdns)) { & $add $f }
|    foreach ($f in @(Get-SIRegistryDnsNames -Registry $Registry)) { & $add $f }
|    & $add ([string](Get-SIPnProp $SqlServer @('properties', 'fullyQualifiedDomainName')))
|    & $add ([string](Get-SIPnProp $Vault @('properties', 'vaultUri')))
|    if ($Storage) {
|        $sn = [string](Get-SIPnProp $Storage @('name'))
|        foreach ($k in 'blob', 'queue', 'table') {
|            $e = [string](Get-SIPnProp $Storage @('properties', 'primaryEndpoints', $k))
|            if (-not $e -and $sn) { $e = '{0}.{1}.core.windows.net' -f $sn, $k }
|            & $add $e
|        }
|    }
|    $out.ToArray()
|}
|
|function Test-SIInsideResolution {
|    <# Do -Names resolve to private addresses HERE (the machine this runs on)? -Resolve { param([string]$Name) } returns the
|       addresses (default: the system resolver). A name passes when it resolves and every IPv4 address it has is RFC1918.
|       Returns @{ Ok; Lines; Failed }. Read-only. #>
|    param([string[]]$Names = @(), [scriptblock]$Resolve)
|    if (-not $Resolve) { $Resolve = { param([string]$Name) @([System.Net.Dns]::GetHostAddresses($Name) | ForEach-Object { $_.IPAddressToString }) } }
|    $lines = New-Object System.Collections.Generic.List[string]; $failed = New-Object System.Collections.Generic.List[string]
|    foreach ($n in @($Names | Where-Object { $_ })) {
|        $ips = @(); try { $ips = @(& $Resolve $n | Where-Object { $_ } | ForEach-Object { [string]$_ }) } catch { $ips = @() }
|        $v4 = @($ips | Where-Object { $_ -match '^\d{1,3}(\.\d{1,3}){3}$' })
|        if ($v4.Count -and -not @($v4 | Where-Object { -not (Test-SIPrivateIpv4 $_) }).Count) { $lines.Add(('{0} -> {1} (private)' -f $n, ($v4 -join ', '))) }
|        else { $failed.Add($n); $lines.Add(('{0} -> {1}' -f $n, $(if ($ips.Count) { ($ips -join ', ') + ' -- NOT a private address' } else { 'does not resolve' }))) }
|    }
|    @{ Ok = [bool](@($Names | Where-Object { $_ }).Count -and -not $failed.Count); Lines = $lines.ToArray(); Failed = $failed.ToArray() }
|}
|
|function Get-SIInsideCheckJobScript {
|    <# PURE. What the one-time inside-check job runs (PowerShell 7 in the engine image): resolve each name of
|       SI_INSIDE_NAMES, one line per name, exit 0 only when every name resolves to private (RFC1918) addresses. #>
|    $fn = (Get-Command -Name Test-SIPrivateIpv4 -CommandType Function).ScriptBlock.ToString()
|    (@('$ErrorActionPreference = ''Stop''', ('function Test-SIPrivateIpv4 {{{0}}}' -f $fn), @'
|$names = @(([string]$env:SI_INSIDE_NAMES) -split ';' | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|$bad = 0
|foreach ($n in $names) {
|    $ips = @(); try { $ips = @([System.Net.Dns]::GetHostAddresses($n) | ForEach-Object { $_.IPAddressToString }) } catch { $ips = @() }
|    $v4 = @($ips | Where-Object { $_ -match '^\d{1,3}(\.\d{1,3}){3}$' })
|    $ok = $v4.Count -and -not @($v4 | Where-Object { -not (Test-SIPrivateIpv4 $_) }).Count
|    if (-not $ok) { $bad++ }
|    Write-Output ('[insidecheck] {0} -> {1} {2}' -f $n, ($ips -join ','), $(if ($ok) { 'private' } else { 'NOT PRIVATE' }))
|}
|if (-not $names.Count) { Write-Output '[insidecheck] no names given'; exit 1 }
|if ($bad) { exit 1 } else { exit 0 }
|'@)) -join "`n"
|}
|
|function Get-SIInsideCheckJobBody {
|    <# PURE. The one-time job: manual trigger, one replica, no retry, ONLY the identity the image is pulled with, tagged
|       as a one-time job; the names in SI_INSIDE_NAMES. #>
|    param([Parameter(Mandatory)][string]$Location, [Parameter(Mandatory)][string]$EnvironmentId, [Parameter(Mandatory)][string]$Image,
|          [Parameter(Mandatory)][string]$RegistryServer, [Parameter(Mandatory)][string]$PullIdentityId, [Parameter(Mandatory)][string[]]$Names, [int]$TimeoutSeconds = 300)
|    $ua = [ordered]@{}; $ua[$PullIdentityId] = [ordered]@{}
|    $cmd = @('pwsh', '-NoProfile', '-NonInteractive', '-EncodedCommand', [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes((Get-SIInsideCheckJobScript))))
|    [ordered]@{
|        location = $Location; tags = [ordered]@{ 'si-one-time-job' = 'inside-check' }
|        identity = [ordered]@{ type = 'UserAssigned'; userAssignedIdentities = $ua }
|        properties = [ordered]@{
|            environmentId = $EnvironmentId
|            configuration = [ordered]@{ triggerType = 'Manual'; replicaTimeout = $TimeoutSeconds; replicaRetryLimit = 0
|                                        manualTriggerConfig = [ordered]@{ parallelism = 1; replicaCompletionCount = 1 }
|                                        registries = @([ordered]@{ server = $RegistryServer; identity = $PullIdentityId }) }
|            template = [ordered]@{ containers = @([ordered]@{ name = 'insidecheck'; image = $Image; command = $cmd; resources = [ordered]@{ cpu = 0.25; memory = '0.5Gi' }
|                                                              env = @([ordered]@{ name = 'SI_INSIDE_NAMES'; value = (@($Names) -join ';') }) }) }
|        }
|    }
|}
|
|function Get-SIInsideCheckJobPlan {
|    <# READ ONLY. What the one-time inside-check job takes from an install job in -EnvironmentId: its image, its registry
|       and the user-assigned identity it pulls with (never a password, never another identity). @{ Ok; Problem; ... }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$ResourceGroupId, [Parameter(Mandatory)][string]$EnvironmentId, [string]$JobName = '')
|    if (-not $JobName) { $JobName = (Get-SIPrivateNetworkNames).InsideCheckJob }
|    $p = [ordered]@{ Ok = $false; Problem = ''; JobName = $JobName; JobId = ('{0}/providers/Microsoft.App/jobs/{1}' -f $ResourceGroupId.TrimEnd('/'), $JobName)
|                     EnvironmentId = $EnvironmentId; Location = ''; Image = ''; RegistryServer = ''; PullIdentityId = ''; Leftover = $false }
|    $jobs = @(Get-SIPnArmList -Arm $Arm -Path ('{0}/providers/Microsoft.App/jobs?api-version={1}' -f $ResourceGroupId.TrimEnd('/'), $script:SIPnAppApi))
|    foreach ($j in $jobs) {
|        if ([string](Get-SIPnProp $j @('tags', 'si-one-time-job'))) { continue }
|        $reg = @(Get-SIPnProp $j @('properties', 'configuration', 'registries') | Where-Object { $_ })[0]
|        $pull = [string](Get-SIPnProp $reg @('identity'))
|        $img = [string](Get-SIPnProp @(Get-SIPnProp $j @('properties', 'template', 'containers'))[0] @('image'))
|        if (-not $img -or [string](Get-SIPnProp $reg @('passwordSecretRef')) -or $pull -notmatch '(?i)/providers/Microsoft\.ManagedIdentity/userAssignedIdentities/') { continue }
|        $p.Image = $img; $p.RegistryServer = [string](Get-SIPnProp $reg @('server')); $p.PullIdentityId = $pull; $p.Location = [string](Get-SIPnProp $j @('location'))
|        break
|    }
|    if (-not $p.Image) { $p.Problem = 'no job of the install pulls its image with a user-assigned identity -- the one-time check job has nothing to run'; return $p }
|    $have = & $Arm 'GET' ('{0}?api-version={1}' -f $p.JobId, $script:SIPnAppApi) $null
|    if ($have) {
|        if ([string](Get-SIPnProp $have @('tags', 'si-one-time-job')) -eq 'inside-check') { $p.Leftover = $true }
|        else { $p.Problem = ('a job named {0} is there that this check did not make -- it is not touched' -f $JobName); return $p }
|    }
|    $p.Ok = $true
|    $p
|}
|
|function Invoke-SIInsideCheckJob {
|    <# The one-time inside-check job: made, started once, waited for (bounded), its execution read -- and ALWAYS (finally)
|       removed and read back gone. PASS = the execution Succeeded (every name resolved private INSIDE the environment).
|       Returns @{ Ok; Lines; Status; Removed }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)]$Plan, [Parameter(Mandatory)][string[]]$Names,
|          [int]$TimeoutSeconds = 300, [int]$PollSeconds = 10, [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $lines = New-Object System.Collections.Generic.List[string]
|    $path = '{0}?api-version={1}' -f $Plan.JobId, $script:SIPnAppApi
|    $status = ''; $made = $false; $removed = $false
|    try {
|        if ($Plan.Leftover) {
|            $null = & $Arm 'DELETE' $path $null
|            if (Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Tries 30 -PauseSeconds 10 -Test { param($o) $null -eq $o }) { throw ('the leftover {0} is still there' -f $Plan.JobName) }
|        }
|        $null = & $Arm 'PUT' $path (Get-SIInsideCheckJobBody -Location $Plan.Location -EnvironmentId $Plan.EnvironmentId -Image $Plan.Image -RegistryServer $Plan.RegistryServer -PullIdentityId $Plan.PullIdentityId -Names $Names -TimeoutSeconds $TimeoutSeconds)
|        $made = $true
|        $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Tries 30 -PauseSeconds 10 -Test { param($o) [string](Get-SIPnProp $o @('properties', 'provisioningState')) -in 'Succeeded', 'Failed', 'Canceled' }
|        if (-not (Test-SIPnSucceeded $back)) { throw ('the one-time job {0} was not made' -f $Plan.JobName) }
|        $start = & $Arm 'POST' ('{0}/start?api-version={1}' -f $Plan.JobId, $script:SIPnAppApi) ([ordered]@{})
|        $exec = [string](Get-SIPnProp $start @('name')); if (-not $exec) { $exec = (([string](Get-SIPnProp $start @('id'))) -split '/')[-1] }
|        if (-not $exec) { throw 'the job was started but Azure named no execution' }
|        $deadline = [datetime]::UtcNow.AddSeconds($TimeoutSeconds + 120)
|        while ($true) {
|            $e = & $Arm 'GET' ('{0}/executions/{1}?api-version={2}' -f $Plan.JobId, $exec, $script:SIPnAppApi) $null
|            $status = [string](Get-SIPnProp $e @('properties', 'status'))
|            if ($status -in 'Succeeded', 'Failed', 'Stopped', 'Degraded') { break }
|            if ([datetime]::UtcNow -ge $deadline) { $status = 'TimedOut'; break }
|            & $Sleep $PollSeconds
|        }
|        $lines.Add(('the one-time job {0} in {1} resolved {2} name(s): {3}' -f $Plan.JobName, ($Plan.EnvironmentId -split '/')[-1], @($Names).Count,
|                    $(if ($status -eq 'Succeeded') { 'every one to a private address' } else { 'NOT every one to a private address (' + $status + ') -- its log ([insidecheck] lines) names which' })))
|    } catch { $lines.Add(('the one-time check job FAILED: {0}' -f $_.Exception.Message)) }
|    finally {
|        if ($made -or $Plan.Leftover) {
|            try { $null = & $Arm 'DELETE' $path $null; $removed = ($null -eq (Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Tries 30 -PauseSeconds 10 -Test { param($o) $null -eq $o })) } catch { $removed = $false }
|            if (-not $removed) { $lines.Add(('the one-time job {0} is STILL THERE -- delete it in the resource group' -f $Plan.JobName)) }
|        } else { $removed = $true }
|    }
|    @{ Ok = [bool]($status -eq 'Succeeded'); Lines = $lines.ToArray(); Status = $status; Removed = $removed }
|}
|
|function Invoke-SIInsideCheck {
|    <#
|        THE GATE before any public endpoint closes. Passes when -Names resolve to private addresses
|          1. from THIS machine (it is inside the customer's network), or
|          2. from a one-time job in the install's own environment (-EnvironmentId; -UseJob), or
|          3. the operator confirms it from inside (-ConfirmedFromInside) -- said in the lines.
|        Returns @{ Ok; Via = machine | job | confirmed | ''; Lines; Failed }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [string[]]$Names = @(), [scriptblock]$Resolve, [string]$ResourceGroupId = '', [string]$EnvironmentId = '',
|          [switch]$UseJob, [switch]$ConfirmedFromInside, [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $lines = New-Object System.Collections.Generic.List[string]
|    if (-not @($Names | Where-Object { $_ }).Count) { return @{ Ok = $false; Via = ''; Failed = @(); Lines = @('the inside check has no names to resolve') } }
|    $m = Test-SIInsideResolution -Names $Names -Resolve $Resolve
|    if ($m.Ok) { return @{ Ok = $true; Via = 'machine'; Failed = @(); Lines = @(@('inside check (this machine): every name resolves to a private address') + @($m.Lines)) } }
|    $lines.Add('inside check (this machine): not every name resolves to a private address here')
|    foreach ($l in $m.Lines) { $lines.Add('  ' + $l) }
|    if ($UseJob -and $EnvironmentId -and $ResourceGroupId) {
|        $jp = Get-SIInsideCheckJobPlan -Arm $Arm -ResourceGroupId $ResourceGroupId -EnvironmentId $EnvironmentId
|        if (-not $jp.Ok) { $lines.Add(('inside check (one-time job): not run -- {0}' -f $jp.Problem)) }
|        else {
|            $j = Invoke-SIInsideCheckJob -Arm $Arm -Plan $jp -Names $Names -Sleep $Sleep
|            foreach ($l in $j.Lines) { $lines.Add('inside check (one-time job): ' + $l) }
|            if ($j.Ok) { return @{ Ok = $true; Via = 'job'; Failed = @(); Lines = $lines.ToArray() } }
|        }
|    }
|    if ($ConfirmedFromInside) { $lines.Add('-ConfirmedFromInside: the operator confirmed from inside the network that these names resolve to their private addresses'); return @{ Ok = $true; Via = 'confirmed'; Failed = @($m.Failed); Lines = $lines.ToArray() } }
|    @{ Ok = $false; Via = ''; Failed = @($m.Failed); Lines = $lines.ToArray() }
|}
|
|# ============================================================================================================== MOVING JOBS AND APPS
|
|function Get-SIContainerMoveProblem {
|    <# PURE. Why -Resource (a Container Apps job or app) cannot be moved now ('' = it can): a secret that is NOT a Key
|       Vault reference (its value is never read, written down or carried -- make it a Key Vault reference first), a
|       registry signed in to with a password, or a run still going (a job). #>
|    param([Parameter(Mandatory)]$Resource, [object[]]$Executions = @())
|    $name = [string](Get-SIPnProp $Resource @('name'))
|    $plain = @(Get-SIPnProp $Resource @('properties', 'configuration', 'secrets') | Where-Object { $_ -and -not [string](Get-SIPnProp $_ @('keyVaultUrl')) } | ForEach-Object { [string](Get-SIPnProp $_ @('name')) })
|    if ($plain.Count) { return ('{0} holds secret(s) that are not Key Vault references ({1}) -- they are never copied; make them Key Vault references first' -f $name, ($plain -join ', ')) }
|    $pw = @(Get-SIPnProp $Resource @('properties', 'configuration', 'registries') | Where-Object { $_ -and [string](Get-SIPnProp $_ @('passwordSecretRef')) })
|    if ($pw.Count) { return ('{0} pulls its image with a password -- it must pull as its managed identity first' -f $name) }
|    $run = @($Executions | Where-Object { $_ -and [string](Get-SIPnProp $_ @('properties', 'status')) -in 'Running', 'Processing' })
|    if ($run.Count) { return ('{0} is running now ({1}) -- moved when it is not running' -f $name, [string](Get-SIPnProp $run[0] @('name'))) }
|    ''
|}
|
|function Get-SIContainerMoveBody {
|    <#
|        PURE. The PUT body that creates -Resource again in -EnvironmentId: its location, tags, identities, configuration and
|        template exactly as they are, with the new environment. What Azure fills in itself is left out (its address, its
|        provisioning state, its revisions). -External (apps only): the ingress' external flag in the new environment -- in an
|        INTERNAL environment "external" means "reachable from the virtual network", never from the internet.
|    #>
|    param([Parameter(Mandatory)]$Resource, [Parameter(Mandatory)][string]$EnvironmentId, [ValidateSet('job', 'app')][string]$Kind = 'job', $External = $null)
|    $r = ConvertTo-SIPnHashtable $Resource
|    $body = [ordered]@{ location = [string]$r['location'] }
|    if ($r.Contains('tags') -and $r['tags']) { $body['tags'] = $r['tags'] }
|    if ($r.Contains('identity') -and $r['identity']) {
|        $idn = [ordered]@{ type = [string]$r['identity']['type'] }
|        $ua = $r['identity']['userAssignedIdentities']
|        if ($ua) { $u = [ordered]@{}; foreach ($k in @($ua.Keys)) { $u[$k] = [ordered]@{} }; $idn['userAssignedIdentities'] = $u }
|        $body['identity'] = $idn
|    }
|    $src = $r['properties']; $props = [ordered]@{}
|    if ($Kind -eq 'app') { $props['managedEnvironmentId'] = $EnvironmentId }
|    $props['environmentId'] = $EnvironmentId
|    if ($src.Contains('workloadProfileName') -and $src['workloadProfileName']) { $props['workloadProfileName'] = $src['workloadProfileName'] }
|    $cfg = $src['configuration']
|    if ($cfg) {
|        if ($cfg.Contains('ingress') -and $cfg['ingress']) {
|            foreach ($ro in 'fqdn') { if ($cfg['ingress'].Contains($ro)) { $cfg['ingress'].Remove($ro) } }
|            if ($null -ne $External) { $cfg['ingress']['external'] = [bool]$External }
|        }
|        $props['configuration'] = $cfg
|    }
|    if ($src.Contains('template') -and $src['template']) { $props['template'] = $src['template'] }
|    $body['properties'] = $props
|    $body
|}
|
|function Get-SIScopedRoleAssignments {
|    <# The role assignments made AT -Scope itself (not inherited) -- they go with the resource when it is removed. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$Scope)
|    @(Get-SIPnArmList -Arm $Arm -Path ('{0}/providers/Microsoft.Authorization/roleAssignments?$filter=atScope()&api-version={1}' -f $Scope.TrimEnd('/'), $script:SIPnAuthApi) |
|      Where-Object { Test-SIPnSameId ([string](Get-SIPnProp $_ @('properties', 'scope'))) $Scope })
|}
|
|function Move-SIContainerResource {
|    <#
|        Moves ONE Container Apps job or app to -EnvironmentId. Azure cannot move one, and a name is unique per resource group,
|        so it is REMOVED and CREATED AGAIN under the same name, with the same identities, configuration and template (Get-
|        SIContainerMoveBody), and the role assignments made on it are made again. Every part is read back. Refused up front
|        (nothing removed) when Get-SIContainerMoveProblem names a problem. -Definition: the definition to create (a
|        rollback passes the recorded one). Returns @{ Ok; Lines; Fqdn; Roles }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)]$Resource, [Parameter(Mandatory)][string]$EnvironmentId,
|          [ValidateSet('job', 'app')][string]$Kind = 'job', $External = $null, [object[]]$RoleAssignments = $null, [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $id = [string](Get-SIPnProp $Resource @('id')); $name = [string](Get-SIPnProp $Resource @('name'))
|    $path = '{0}?api-version={1}' -f $id, $script:SIPnAppApi
|    $lines = New-Object System.Collections.Generic.List[string]
|    $exec = @(); if ($Kind -eq 'job') { $exec = @(Get-SIPnArmList -Arm $Arm -Path ('{0}/executions?api-version={1}' -f $id, $script:SIPnAppApi)) }
|    $why = Get-SIContainerMoveProblem -Resource $Resource -Executions $exec
|    if ($why) { return @{ Ok = $false; Lines = @(('NOT moved: {0}. Nothing was removed.' -f $why)); Fqdn = ''; Roles = @() } }
|    $roles = if ($null -ne $RoleAssignments) { @($RoleAssignments) } else { @(Get-SIScopedRoleAssignments -Arm $Arm -Scope $id) }
|    $body = Get-SIContainerMoveBody -Resource $Resource -EnvironmentId $EnvironmentId -Kind $Kind -External $External
|    # a resource that is not there (a move that stopped half-way; a rollback from the record) is only created
|    if (& $Arm 'GET' $path $null) {
|        $null = & $Arm 'DELETE' $path $null
|        $gone = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Tries 60 -PauseSeconds 10 -Test { param($o) $null -eq $o }
|        if ($gone) { return @{ Ok = $false; Lines = @(('{0} is still there after its removal was asked for -- not created again; run the step again' -f $name)); Fqdn = ''; Roles = @() } }
|        $lines.Add(('{0} removed from its old environment' -f $name))
|    } else { $lines.Add(('{0} is not there -- it is created from its definition' -f $name)) }
|    $null = & $Arm 'PUT' $path $body
|    $envProp = if ($Kind -eq 'app') { 'managedEnvironmentId' } else { 'environmentId' }
|    $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Tries 90 -PauseSeconds 10 -Test { param($o) (Test-SIPnSucceeded $o) -and (Test-SIPnSameId ([string](Get-SIPnProp $o @('properties', $envProp))) $EnvironmentId) }
|    $ok = (Test-SIPnSucceeded $back) -and (Test-SIPnSameId ([string](Get-SIPnProp $back @('properties', $envProp))) $EnvironmentId)
|    $lines.Add($(if ($ok) { '{0} created again in {1} (read back)' -f $name, ($EnvironmentId -split '/')[-1] } else { '{0} does NOT read back in {1} (Azure shows: {2}) -- the rollback record holds its definition' -f $name, ($EnvironmentId -split '/')[-1], [string](Get-SIPnProp $back @('properties', 'provisioningState')) }))
|    $made = New-Object System.Collections.Generic.List[string]
|    foreach ($ra in $roles) {
|        $rd = [string](Get-SIPnProp $ra @('properties', 'roleDefinitionId')); $prin = [string](Get-SIPnProp $ra @('properties', 'principalId'))
|        if (-not $rd -or -not $prin) { continue }
|        $aid = '{0}/providers/Microsoft.Authorization/roleAssignments/{1}' -f $id, ([guid]::NewGuid().ToString())
|        $ap = '{0}?api-version={1}' -f $aid, $script:SIPnAuthApi
|        $rb = [ordered]@{ properties = [ordered]@{ roleDefinitionId = $rd; principalId = $prin } }
|        $pt = [string](Get-SIPnProp $ra @('properties', 'principalType')); if ($pt) { $rb.properties['principalType'] = $pt }
|        try {
|            $null = & $Arm 'PUT' $ap $rb
|            $rback = Read-SIPnBack -Arm $Arm -Path $ap -Sleep $Sleep -Tries 6 -PauseSeconds 5 -Test { param($o) $null -ne $o }
|            if ($rback) { $made.Add($aid); $lines.Add(('{0}: role {1} for {2} made again (read back)' -f $name, ($rd -split '/')[-1], $prin)) } else { $ok = $false; $lines.Add(('{0}: role {1} for {2} does not read back' -f $name, ($rd -split '/')[-1], $prin)) }
|        } catch { $ok = $false; $lines.Add(('{0}: role {1} for {2} could not be made again: {3}' -f $name, ($rd -split '/')[-1], $prin, $_.Exception.Message)) }
|    }
|    @{ Ok = [bool]$ok; Lines = $lines.ToArray(); Fqdn = [string](Get-SIPnProp $back @('properties', 'configuration', 'ingress', 'fqdn')); Roles = $made.ToArray() }
|}
|
|function Get-SIMoveRecord {
|    <# PURE. What the rollback record keeps of a resource before it is moved: its id, name, kind, environment, definition
|       (no secret values exist in it -- a resource with a plain secret is never moved) and the role assignments made on it. #>
|    param([Parameter(Mandatory)]$Resource, [ValidateSet('job', 'app')][string]$Kind, [object[]]$RoleAssignments = @())
|    $envProp = if ($Kind -eq 'app') { 'managedEnvironmentId' } else { 'environmentId' }
|    [ordered]@{ id = [string](Get-SIPnProp $Resource @('id')); name = [string](Get-SIPnProp $Resource @('name')); kind = $Kind
|                environmentId = [string](Get-SIPnProp $Resource @('properties', $envProp))
|                external = Get-SIPnProp $Resource @('properties', 'configuration', 'ingress', 'external')
|                definition = (ConvertTo-SIPnHashtable $Resource)
|                roles = @($RoleAssignments | ForEach-Object { [ordered]@{ roleDefinitionId = [string](Get-SIPnProp $_ @('properties', 'roleDefinitionId')); principalId = [string](Get-SIPnProp $_ @('properties', 'principalId')); principalType = [string](Get-SIPnProp $_ @('properties', 'principalType')) } }) }
|}
|
|# ============================================================================================================== THE WEB APP'S SIGN-IN ADDRESS
|
|function Add-SIWebSignInAddress {
|    <# The web app's new address ADDED to its sign-in registration (the old ones stay -- add before remove), READ BACK.
|       -Graph { param($Method, $Uri, $Body) }. Returns @{ Ok; Line; Before = @{ objectId; redirectUris; logoutUrl } }. #>
|    param([Parameter(Mandatory)][scriptblock]$Graph, [Parameter(Mandatory)][string]$ClientId, [Parameter(Mandatory)][string]$Fqdn)
|    $h = $Fqdn.Trim().TrimEnd('/') -replace '^https?://', ''
|    $list = & $Graph 'GET' ("https://graph.microsoft.com/v1.0/applications?`$filter=appId eq '{0}'&`$select=id,appId,web" -f $ClientId) $null
|    $app = @(Get-SIPnProp $list @('value') | Where-Object { $_ })[0]
|    if (-not $app) { return @{ Ok = $false; Before = $null; Line = ('the sign-in registration {0} was not found -- the new address https://{1}/ must be added to it by hand' -f $ClientId, $h) } }
|    $oid = [string](Get-SIPnProp $app @('id'))
|    $uris = @(Get-SIPnProp $app @('web', 'redirectUris') | Where-Object { $_ })
|    $before = [ordered]@{ objectId = $oid; redirectUris = $uris; logoutUrl = [string](Get-SIPnProp $app @('web', 'logoutUrl')) }
|    $want = "https://$h/signin-oidc"
|    if ($uris -contains $want) { return @{ Ok = $true; Before = $before; Line = ('the sign-in registration already knows https://{0}/' -f $h) } }
|    $web = [ordered]@{ redirectUris = @($uris + @($want) | Select-Object -Unique); logoutUrl = "https://$h/signout-callback-oidc" }
|    $ig = Get-SIPnProp $app @('web', 'implicitGrantSettings'); if ($ig) { $web['implicitGrantSettings'] = ConvertTo-SIPnHashtable $ig }
|    $null = & $Graph 'PATCH' ('https://graph.microsoft.com/v1.0/applications/{0}' -f $oid) ([ordered]@{ web = $web })
|    $back = & $Graph 'GET' ('https://graph.microsoft.com/v1.0/applications/{0}?$select=id,web' -f $oid) $null
|    $ok = @(Get-SIPnProp $back @('web', 'redirectUris')) -contains $want
|    @{ Ok = [bool]$ok; Before = $before; Line = $(if ($ok) { 'the sign-in registration knows the new address https://{0}/ (read back; the old addresses stay)' -f $h } else { 'the new address https://{0}/ does not read back on the sign-in registration' -f $h }) }
|}
|
|# ============================================================================================================== THE NETWORK HAND-OFF
|# #866 (owner 2026-10-21: "that is where everything must be added by the customer"; "we are not allowed to"): SecurityInsight
|# does the spoke; the customer's network team does the hub. The install and the cut-over end with ONE exact list for that
|# team -- real names, ids, addresses -- and a script the hub owner can read or run (PIM's New-PimHubPrepareScript).
|
|function Get-SIVnetShortName {
|    <# PURE. A network's short name for a peering name (PIM's Get-PimVnetShortName): vnet-x / x-vnet -> x. #>
|    param([Parameter(Mandatory)][string]$VnetId)
|    $n = (($VnetId.TrimEnd('/') -split '/')[-1]).ToLowerInvariant()
|    if ($n -like 'vnet-*') { $n = $n.Substring(5) } elseif ($n -like '*-vnet') { $n = $n.Substring(0, $n.Length - 5) }
|    $n.Trim('-')
|}
|
|function Get-SIPeeringBody {
|    <# PURE. One side of the peering, PIM's settings (Set-PimVnetPeering / its hub owner's script), the same both ways:
|       network access on, forwarded traffic off, gateway transit off, remote gateways off. #>
|    param([Parameter(Mandatory)][string]$RemoteVnetId)
|    [ordered]@{ properties = [ordered]@{ remoteVirtualNetwork = [ordered]@{ id = $RemoteVnetId }; allowVirtualNetworkAccess = $true; allowForwardedTraffic = $false; allowGatewayTransit = $false; useRemoteGateways = $false } }
|}
|
|function Get-SIPeeringPlan {
|    <# PURE. Both directions of the peering of SecurityInsight's network (-SpokeVnetId) with the hub, ALWAYS both (a
|       one-sided peering reads Initiated and carries nothing). Refused: the same network, or address spaces that overlap
|       (when both are known). @{ Ok; Reason; Pairs = @( @{ Direction; VnetId; Name; RemoteVnetId; Path } ); CrossSubscription }. #>
|    param([Parameter(Mandatory)][string]$SpokeVnetId, [Parameter(Mandatory)][string]$HubVnetId, [string[]]$SpokePrefixes = @(), [string[]]$HubPrefixes = @())
|    if (Test-SIPnSameId $SpokeVnetId $HubVnetId) { return @{ Ok = $false; Pairs = @(); CrossSubscription = $false; Reason = 'the hub and SecurityInsight''s network are the SAME network -- a network cannot be peered to itself' } }
|    foreach ($s in @($SpokePrefixes | Where-Object { $_ })) { foreach ($h in @($HubPrefixes | Where-Object { $_ })) {
|        if (Test-SICidrOverlap $s $h) { return @{ Ok = $false; Pairs = @(); CrossSubscription = $false; Reason = ('the address spaces OVERLAP (SecurityInsight {0}, hub {1}) -- Azure cannot peer them; SecurityInsight needs a range that is free in your network' -f $s, $h) } }
|    } }
|    $ss = Get-SIVnetShortName $SpokeVnetId; $hs = Get-SIVnetShortName $HubVnetId
|    $mk = { param($v, $name, $remote, $dir) @{ Direction = $dir; VnetId = $v.TrimEnd('/'); Name = $name; RemoteVnetId = $remote.TrimEnd('/'); Path = ('{0}/virtualNetworkPeerings/{1}' -f $v.TrimEnd('/'), $name) } }
|    $sub = { param($id) (ConvertFrom-SIPnResourceId $id).SubscriptionId }
|    @{ Ok = $true; Reason = ''; CrossSubscription = [bool]((& $sub $SpokeVnetId) -ne (& $sub $HubVnetId))
|       Pairs = @((& $mk $SpokeVnetId ('{0}-to-{1}' -f $ss, $hs) $HubVnetId 'spoke-to-hub'), (& $mk $HubVnetId ('{0}-to-{1}' -f $hs, $ss) $SpokeVnetId 'hub-to-spoke')) }
|}
|
|function Get-SIPeeringState {
|    <# READ ONLY. The state of the peering of -VnetId with -RemoteVnetId: the peeringState of ANY peering on -VnetId that
|       points at -RemoteVnetId ('' = none; 'unreadable' = this identity may not read that network -- the hub, usually). #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$VnetId, [Parameter(Mandatory)][string]$RemoteVnetId)
|    try { $list = @(Get-SIPnArmList -Arm $Arm -Path ('{0}/virtualNetworkPeerings?api-version={1}' -f $VnetId.TrimEnd('/'), $script:SIPnNetApi)) } catch { return 'unreadable' }
|    $p = @($list | Where-Object { Test-SIPnSameId ([string](Get-SIPnProp $_ @('properties', 'remoteVirtualNetwork', 'id'))) $RemoteVnetId })[0]
|    if (-not $p) { return '' }
|    [string](Get-SIPnProp $p @('properties', 'peeringState'))
|}
|
|function Set-SIVnetPeering {
|    <#
|        #866 item 5 (owner: "i would ask si to do the peering to hub, but i must get approval first"): the peering of
|        SecurityInsight's network with the hub, BOTH directions (PIM's Set-PimVnetPeering), ONLY when the customer turned
|        it on (peerToHub / the cut-over's peer-to-hub step). Before ANY change: both networks readable, no overlap, no
|        same-name peering pointing elsewhere, and the rights on BOTH networks (peerings/write + peer/action) read back --
|        else REFUSED, nothing written, the role and the scope named. NEVER HALF A PEERING: when the second side cannot be
|        made, the first side this made is removed again (and said). Done = both sides read Connected.
|        Returns @{ Ok; Refused; Lines; Created (peering ids this made) }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$SpokeVnetId, [Parameter(Mandatory)][string]$HubVnetId,
|          [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $lines = New-Object System.Collections.Generic.List[string]; $created = New-Object System.Collections.Generic.List[string]
|    $refuse = { param($why) @{ Ok = $false; Refused = $true; Created = @(); Lines = @(('peering REFUSED before any change: {0} -- it stays on the network hand-off list' -f $why)) } }
|    $get = { param($id) try { & $Arm 'GET' ('{0}?api-version={1}' -f $id, $script:SIPnNetApi) $null } catch { $null } }
|    $spoke = & $get $SpokeVnetId; $hub = & $get $HubVnetId
|    if (-not $spoke) { return (& $refuse ('SecurityInsight''s network {0} cannot be read' -f $SpokeVnetId)) }
|    if (-not $hub) { return (& $refuse ('the hub {0} cannot be read by the installing identity -- grant it Network Contributor on the hub virtual network' -f $HubVnetId)) }
|    $plan = Get-SIPeeringPlan -SpokeVnetId $SpokeVnetId -HubVnetId $HubVnetId -SpokePrefixes @(Get-SIVnetPrefixes $spoke) -HubPrefixes @(Get-SIVnetPrefixes $hub)
|    if (-not $plan.Ok) { return (& $refuse $plan.Reason) }
|    foreach ($v in @($SpokeVnetId, $HubVnetId)) {
|        $why = Get-SIHubRightsProblem -Arm $Arm -Scope $v -Actions @('Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write', 'Microsoft.Network/virtualNetworks/peer/action')
|        if ($why) { return (& $refuse $why) }
|    }
|    $todo = @()
|    foreach ($p in $plan.Pairs) {
|        $have = & $Arm 'GET' ('{0}?api-version={1}' -f $p.Path, $script:SIPnNetApi) $null
|        if ($have) {
|            $rv = [string](Get-SIPnProp $have @('properties', 'remoteVirtualNetwork', 'id'))
|            if (-not (Test-SIPnSameId $rv $p.RemoteVnetId)) { return (& $refuse ('the peering ''{0}'' on {1} already points at {2}, not at {3} -- remove or rename it' -f $p.Name, ($p.VnetId -split '/')[-1], $rv, $p.RemoteVnetId)) }
|            $lines.Add(('peering ''{0}'' on {1} is there' -f $p.Name, ($p.VnetId -split '/')[-1]))
|        } else { $todo += , $p }
|    }
|    foreach ($p in $todo) {
|        $path = '{0}?api-version={1}' -f $p.Path, $script:SIPnNetApi
|        try {
|            $null = & $Arm 'PUT' $path (Get-SIPeeringBody -RemoteVnetId $p.RemoteVnetId)
|            $back = Read-SIPnBack -Arm $Arm -Path $path -Sleep $Sleep -Tries 30 -PauseSeconds 5 -Test { param($o) [string](Get-SIPnProp $o @('properties', 'provisioningState')) -in 'Succeeded', 'Failed', 'Canceled' }
|            if (-not (Test-SIPnSucceeded $back)) { throw ('it does not read back as made (Azure shows: {0})' -f [string](Get-SIPnProp $back @('properties', 'provisioningState'))) }
|            $created.Add($p.Path); $lines.Add(('peering ''{0}'' on {1} -> {2} made (read back)' -f $p.Name, ($p.VnetId -split '/')[-1], ($p.RemoteVnetId -split '/')[-1]))
|        } catch {
|            $lines.Add(('peering ''{0}'' on {1} could NOT be made: {2}' -f $p.Name, ($p.VnetId -split '/')[-1], $_.Exception.Message))
|            # never half a peering: what this run made is removed again
|            foreach ($c in @($created.ToArray())) {
|                try { $null = & $Arm 'DELETE' ('{0}?api-version={1}' -f $c, $script:SIPnNetApi) $null; $lines.Add(('the side made a moment ago (''{0}'') is REMOVED again -- no half peering is left' -f ($c -split '/')[-1])) }
|                catch { $lines.Add(('the side made a moment ago (''{0}'') could NOT be removed: {1} -- remove it by hand' -f ($c -split '/')[-1], $_.Exception.Message)) }
|            }
|            return @{ Ok = $false; Refused = $false; Created = @(); Lines = $lines.ToArray() }
|        }
|    }
|    # both sides Connected -- Initiated is the shape of a half-built peering, indistinguishable unless read
|    $bad = @()
|    foreach ($p in $plan.Pairs) {
|        $st = [string](Get-SIPnProp (Read-SIPnBack -Arm $Arm -Path ('{0}?api-version={1}' -f $p.Path, $script:SIPnNetApi) -Sleep $Sleep -Tries 12 -PauseSeconds 5 -Test { param($o) [string](Get-SIPnProp $o @('properties', 'peeringState')) -eq 'Connected' }) @('properties', 'peeringState'))
|        $lines.Add(('{0}: {1}' -f $p.Name, $(if ($st) { $st } else { 'unreadable' })))
|        if ($st -ne 'Connected') { $bad += $p.Name }
|    }
|    if ($bad.Count) { $lines.Add(('the peering is NOT Connected in both directions ({0}) -- the hub has no route to SecurityInsight yet' -f ($bad -join ', '))) }
|    @{ Ok = (-not $bad.Count); Refused = $false; Created = $created.ToArray(); Lines = $lines.ToArray() }
|}
|
|function Invoke-SIPrivateNetworkPeering {
|    <# Setup's call (the guided install's subnets step, only when peerToHub is on and a hub is given): Set-SIVnetPeering
|       over setup's own ARM sign-in. Returns its answer. #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Target, [scriptblock]$Arm, [scriptblock]$Sleep, [string]$SubscriptionId)
|    if (-not $Arm) { $Arm = { param([string]$Method, [string]$Path, $Body) if ($Method -eq 'GET') { Invoke-SIArm -Path $Path -AllowNotFound } else { Invoke-SIArm -Method $Method -Path $Path -Body $Body } } }
|    if (-not $Sleep) { $Sleep = { param($s) Start-Sleep -Seconds $s } }
|    Set-SIVnetPeering -Arm $Arm -SpokeVnetId ([string]$Target['VnetId']) -HubVnetId ([string]$Target['HubVnetId']) -Sleep $Sleep
|}
|
|function Get-SIPrivateEndpointNicPairs {
|    <# READ ONLY. The (name, address) pairs of one private endpoint, read from ITS NETWORK INTERFACE -- the source of truth
|       for the address: properties.networkInterfaces[].id -> GET the interface -> each ipConfigurations[].properties
|       .privateIPAddress, named by that configuration's privateLinkConnectionProperties.fqdns. Azure leaves the endpoint's
|       customDnsConfigs EMPTY once a private DNS zone group is attached, so the endpoint itself is not enough.
|       Returns @( ,@(<fqdn>, @(<ip>)) ... ); an interface that cannot be read gives nothing (the caller falls back). #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, $Endpoint)
|    $pairs = @()
|    foreach ($nr in @(Get-SIPnProp $Endpoint @('properties', 'networkInterfaces') | Where-Object { $_ })) {
|        $nid = [string](Get-SIPnProp $nr @('id'))
|        if (-not $nid) { continue }
|        $nic = $null
|        try { $nic = & $Arm 'GET' ('{0}?api-version={1}' -f $nid, $script:SIPnNetApi) $null } catch { $nic = $null }
|        foreach ($ic in @(Get-SIPnProp $nic @('properties', 'ipConfigurations') | Where-Object { $_ })) {
|            $ip = [string](Get-SIPnProp $ic @('properties', 'privateIPAddress'))
|            if (-not $ip) { continue }
|            foreach ($fq in @(Get-SIPnProp $ic @('properties', 'privateLinkConnectionProperties', 'fqdns') | Where-Object { $_ })) { $pairs += , @([string]$fq, @($ip)) }
|        }
|    }
|    , $pairs
|}
|
|function Get-SIPrivateLinkRecords {
|    <# READ ONLY. The A records of the install's private endpoints (pe-si-*) in -ResourceGroupId, as the customer adds them
|       in the hub's zones: @( @{ Zone; Name; Fqdn; Ip; Source; ZoneGroupIp } ).
|       The address comes from the endpoint's NETWORK INTERFACE (Get-SIPrivateEndpointNicPairs) -- the source of truth.
|       The zone group's record sets are a cross-check (ZoneGroupIp is set when Azure's zone record says something else) and
|       the source only when the interface cannot be read; the endpoint's customDnsConfigs are the last fallback, because
|       Azure leaves them empty once a zone group is attached. Source = 'nic' | 'zonegroup' | 'customdns'. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$ResourceGroupId)
|    $prefix = (Get-SIPrivateNetworkNames).EndpointPrefix
|    $out = New-Object System.Collections.Generic.List[object]
|    # the record's name in the privatelink zone: the name before the service's public suffix (a zone group's fqdn already
|    # names the privatelink zone)
|    $nameOf = { param($fq, $kind) if ($fq.EndsWith('.' + $kind.Zone)) { $fq.Substring(0, $fq.Length - $kind.Zone.Length - 1) } elseif ($fq.EndsWith('.' + $kind.Suffix)) { $fq.Substring(0, $fq.Length - $kind.Suffix.Length - 1) } else { ($fq -split '\.')[0] } }
|    $toMap = {
|        param($pairs, $kind)
|        $m = [ordered]@{}
|        foreach ($p in @($pairs)) {
|            $fq = ([string]$p[0]).TrimEnd('.').ToLowerInvariant()
|            $ip = [string](@($p[1] | Where-Object { $_ })[0])
|            if (-not $fq -or -not $ip) { continue }
|            $n = & $nameOf $fq $kind
|            if (-not $m.Contains($n)) { $m[$n] = $ip }
|        }
|        $m
|    }
|    foreach ($k in @($script:SIPnKinds.Keys)) {
|        $kind = $script:SIPnKinds[$k]
|        $id = '{0}/providers/Microsoft.Network/privateEndpoints/{1}{2}' -f $ResourceGroupId.TrimEnd('/'), $prefix, $k
|        $pe = & $Arm 'GET' ('{0}?api-version={1}' -f $id, $script:SIPnNetApi) $null
|        if (-not $pe) { continue }
|        # 1. the network interface -- the source of truth
|        $nicMap = & $toMap (Get-SIPrivateEndpointNicPairs -Arm $Arm -Endpoint $pe) $kind
|        # 2. the zone group's record sets -- the cross-check
|        $zgPairs = @()
|        $zg = & $Arm 'GET' ('{0}/privateDnsZoneGroups/{1}?api-version={2}' -f $id, (Get-SIPrivateNetworkNames).ZoneGroup, $script:SIPnNetApi) $null
|        foreach ($c in @(Get-SIPnProp $zg @('properties', 'privateDnsZoneConfigs') | Where-Object { $_ })) {
|            foreach ($rs in @(Get-SIPnProp $c @('properties', 'recordSets') | Where-Object { $_ })) { $zgPairs += , @([string](Get-SIPnProp $rs @('fqdn')), @(Get-SIPnProp $rs @('ipAddresses'))) }
|        }
|        $zgMap = & $toMap $zgPairs $kind
|        $use = $nicMap; $src = 'nic'
|        if (-not $use.Count) { $use = $zgMap; $src = 'zonegroup' }
|        # 3. the endpoint's customDnsConfigs -- the last fallback (empty once a zone group is attached)
|        if (-not $use.Count) {
|            $cd = @(); foreach ($c in @(Get-SIPnProp $pe @('properties', 'customDnsConfigs') | Where-Object { $_ })) { $cd += , @([string](Get-SIPnProp $c @('fqdn')), @(Get-SIPnProp $c @('ipAddresses'))) }
|            $use = & $toMap $cd $kind; $src = 'customdns'
|        }
|        foreach ($name in @($use.Keys)) {
|            if (@($out | Where-Object { $_.Zone -eq $kind.Zone -and $_.Name -eq $name }).Count) { continue }
|            $ip = [string]$use[$name]
|            $zgIp = if ($src -eq 'nic' -and $zgMap.Contains($name) -and [string]$zgMap[$name] -ne $ip) { [string]$zgMap[$name] } else { '' }
|            $out.Add(@{ Zone = $kind.Zone; Name = $name; Fqdn = ('{0}.{1}' -f $name, $kind.Suffix); Ip = $ip; Source = $src; ZoneGroupIp = $zgIp })
|        }
|    }
|    $out.ToArray()
|}
|
|function Get-SINetworkHandOffFacts {
|    <# READ ONLY. What the hand-off list says, read from Azure: SecurityInsight's network (its id, address space,
|       subscription, DNS servers), the hub (when given and readable), both sides of the peering, the environment's zone
|       (its records' address, whether the hub is linked), the private endpoints' records. Never writes. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][System.Collections.IDictionary]$Target, [string]$EnvironmentId = '', [string[]]$InsideNames = @(), [string[]]$Notes = @())
|    $spokeId = [string]$Target['VnetId']; $hubId = [string]$Target['HubVnetId']
|    $spoke = if ($spokeId) { & $Arm 'GET' ('{0}?api-version={1}' -f $spokeId, $script:SIPnNetApi) $null } else { $null }
|    $hub = $null; $hubReadable = $false
|    if ($hubId) { try { $hub = & $Arm 'GET' ('{0}?api-version={1}' -f $hubId, $script:SIPnNetApi) $null; $hubReadable = [bool]$hub } catch { $hub = $null } }
|    $f = [ordered]@{
|        SpokeVnetId = $spokeId; SpokePrefixes = @(Get-SIVnetPrefixes $spoke); SpokeSubscription = $(if ($spokeId) { [string](ConvertFrom-SIPnResourceId $spokeId).SubscriptionId } else { '' })
|        SpokeDnsServers = @(Get-SIPnProp $spoke @('properties', 'dhcpOptions', 'dnsServers') | Where-Object { $_ })
|        HubVnetId = $hubId; HubReadable = $hubReadable; HubPrefixes = @(Get-SIVnetPrefixes $hub)
|        SpokeSide = ''; HubSide = ''
|        EnvZone = ''; EnvZoneId = ''; EnvIp = ''; EnvLinkedToHub = $false
|        PrivateLinkRecords = @(Get-SIPrivateLinkRecords -Arm $Arm -ResourceGroupId ([string]$Target['ResourceGroupId']))
|        InsideNames = @($InsideNames | Where-Object { $_ }); Notes = @($Notes | Where-Object { $_ })
|        CloseCommand = ''
|        # #1095: the apps subnet's return route (its route table, the answers returnRouteRanges / returnRouteNextHop)
|        ReturnRoute = (Get-SIReturnRouteFacts -Arm $Arm -Target $Target)
|    }
|    if ($spokeId -and $hubId) {
|        $f.SpokeSide = Get-SIPeeringState -Arm $Arm -VnetId $spokeId -RemoteVnetId $hubId
|        $f.HubSide = if ($hubReadable) { Get-SIPeeringState -Arm $Arm -VnetId $hubId -RemoteVnetId $spokeId } else { 'unreadable' }
|    }
|    if ($EnvironmentId) {
|        $env = & $Arm 'GET' ('{0}?api-version={1}' -f $EnvironmentId, $script:SIPnAppApi) $null
|        $f.EnvZone = [string](Get-SIPnProp $env @('properties', 'defaultDomain')); $f.EnvIp = [string](Get-SIPnProp $env @('properties', 'staticIp'))
|        if ($f.EnvZone) {
|            foreach ($rg in @([string]$Target['ResourceGroupId'], [string]$Target['DnsResourceGroupId']) | Where-Object { $_ } | Select-Object -Unique) {
|                $zid = '{0}/providers/Microsoft.Network/privateDnsZones/{1}' -f $rg.TrimEnd('/'), $f.EnvZone
|                if (& $Arm 'GET' ('{0}?api-version={1}' -f $zid, $script:SIPnDnsApi) $null) {
|                    $f.EnvZoneId = $zid
|                    if ($hubId) { $f.EnvLinkedToHub = [bool]@(Get-SIPnArmList -Arm $Arm -Path ('{0}/virtualNetworkLinks?api-version={1}' -f $zid, $script:SIPnDnsApi) | Where-Object { Test-SIPnSameId ([string](Get-SIPnProp $_ @('properties', 'virtualNetwork', 'id'))) $hubId }).Count }
|                    break
|                }
|            }
|        }
|    }
|    $f
|}
|
|function Get-SINetworkHandOff {
|    <#
|        PURE. THE list for the customer's network team, from -Facts (Get-SINetworkHandOffFacts): what is still theirs, with
|        real names, ids and addresses -- the peering (both directions, PIM's settings, both must read Connected), the DNS
|        zones and A records (link to the hub, or add in the hub's zones / on the resolver), the DNS servers SecurityInsight's
|        network asks, the rights SecurityInsight would need to do it itself, the test from the customer's network, and the
|        command that then closes the public endpoints. @{ Open (hub items still open); Lines; Items; Text }.
|    #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Facts)
|    $L = New-Object System.Collections.Generic.List[string]; $open = 0; $items = New-Object System.Collections.Generic.List[object]
|    $spokeId = [string]$Facts['SpokeVnetId']; $hubId = [string]$Facts['HubVnetId']
|    $space = (@($Facts['SpokePrefixes']) | Where-Object { $_ }) -join ', '; if (-not $space) { $space = '(address space not read)' }
|    $hubName = if ($hubId) { $hubId } else { '<your hub virtual network>' }
|    $L.Add('NETWORK HAND-OFF -- for your network team. SecurityInsight wrote only in its own network and resource group; nothing on your hub.')
|    # 1. the peering
|    if ([string]$Facts['SpokeSide'] -eq 'Connected') { $L.Add(('1. PEERING: done -- {0} reads Connected with {1}.' -f ($spokeId -split '/')[-1], ($hubName -split '/')[-1])) }
|    else {
|        $open++
|        $plan = if ($hubId -and $spokeId) { Get-SIPeeringPlan -SpokeVnetId $spokeId -HubVnetId $hubId -SpokePrefixes @($Facts['SpokePrefixes']) -HubPrefixes @($Facts['HubPrefixes']) } else { $null }
|        $L.Add(('1. PEERING -- peer {0} ({1}) with your hub, BOTH directions; both sides must read Connected.' -f $spokeId, $space))
|        $L.Add(('   SecurityInsight''s network: subscription {0}, address space {1}' -f [string]$Facts['SpokeSubscription'], $space))
|        if ($plan -and -not $plan.Ok) { $L.Add(('   NOT POSSIBLE AS IT IS: {0}' -f $plan.Reason)) }
|        $nm = if ($plan -and $plan.Ok) { @{ s = @($plan.Pairs | Where-Object { $_.Direction -eq 'spoke-to-hub' })[0].Name; h = @($plan.Pairs | Where-Object { $_.Direction -eq 'hub-to-spoke' })[0].Name } } else { @{ s = '<name>'; h = '<name>' } }
|        $L.Add(('   a) SecurityInsight -> hub: on {0}, peering ''{1}'' -> {2}' -f ($spokeId -split '/')[-1], $nm.s, $hubName))
|        $L.Add(('   b) hub -> SecurityInsight: on {0}, peering ''{1}'' -> {2}' -f ($hubName -split '/')[-1], $nm.h, $spokeId))
|        $L.Add('      both directions: allowVirtualNetworkAccess = true, allowForwardedTraffic = false, allowGatewayTransit = false, useRemoteGateways = false')
|        $L.Add('      (PIM4EntraPS''s settings. If your on-premises network reaches SecurityInsight through the hub''s VPN / ExpressRoute gateway, your team sets gateway transit on the hub side and remote gateways on SecurityInsight''s side.)')
|        $L.Add(('   state now: SecurityInsight''s side {0}; hub side {1}' -f $(if ($Facts['SpokeSide']) { $Facts['SpokeSide'] } else { 'not made' }), $(if ($Facts['HubSide'] -eq 'unreadable') { 'not readable by SecurityInsight' } elseif ($Facts['HubSide']) { $Facts['HubSide'] } else { 'not made' })))
|        $items.Add(@{ Kind = 'peering'; Done = $false })
|    }
|    # 2. the environment's own zone
|    if ([string]$Facts['EnvZone']) {
|        $z = [string]$Facts['EnvZone']; $ip = [string]$Facts['EnvIp']
|        if ($hubId -and [bool]$Facts['EnvLinkedToHub']) { $L.Add(('2. DNS, the web app''s zone {0}: done -- linked to the hub.' -f $z)) }
|        else {
|            $open++
|            $L.Add(('2. DNS, the web app''s zone {0} (its address {1}) -- EITHER:' -f $z, $ip))
|            $L.Add(('   a) link SecurityInsight''s zone {0}' -f $(if ($Facts['EnvZoneId']) { $Facts['EnvZoneId'] } else { $z })))
|            $L.Add(('      to {0} (registration off) -- the network your private DNS resolver is in; OR' -f $hubName))
|            $L.Add(('   b) make the zone {0} in your DNS / on your resolver with these A records:' -f $z))
|            foreach ($rec in (Get-SIEnvironmentDnsRecordNames)) { $L.Add(('        {0,-12} A  {1}' -f $rec, $ip)) }
|            $items.Add(@{ Kind = 'environment-zone'; Done = $false })
|        }
|    }
|    # 3. the private endpoints' records
|    $recs = @($Facts['PrivateLinkRecords'] | Where-Object { $_ })
|    if ($recs.Count) {
|        $open++
|        $L.Add('3. DNS, the private endpoints -- add these A records in YOUR zones of these names that the hub resolves (a network takes only one zone of a name, so SecurityInsight''s zones cannot also be linked where yours are):')
|        foreach ($g in @($recs | Group-Object { $_.Zone })) {
|            $L.Add(('   zone {0}' -f $g.Name))
|            foreach ($r in $g.Group) {
|                $L.Add(('        {0,-40} A  {1}   ({2})' -f $r.Name, $r.Ip, $r.Fqdn))
|                $zgIp = [string](Get-SIPnProp $r @('ZoneGroupIp'))
|                if ($zgIp) { $L.Add(('          note: Azure''s own zone record still says {0}; the endpoint''s network interface says {1} -- use {1}' -f $zgIp, $r.Ip)) }
|            }
|        }
|        $L.Add('   (when your hub has no zone of that name: link SecurityInsight''s zone of that name, in its resource group, to the hub instead)')
|        $items.Add(@{ Kind = 'privatelink-records'; Done = $false })
|    }
|    # 4. which DNS SecurityInsight's own network asks
|    $dns = @($Facts['SpokeDnsServers'] | Where-Object { $_ })
|    if ($dns.Count) { $L.Add(('4. SecurityInsight''s network asks the DNS server(s) {0} (not Azure''s): they must answer every name above with its private address (your resolver, forwarding to Azure DNS from a network the zones are linked to) -- until then SecurityInsight''s own jobs cannot reach its private database.' -f ($dns -join ', '))) }
|    else { $L.Add('4. SecurityInsight''s network uses Azure''s DNS: its own jobs resolve these names already (its zones are linked to it).') }
|    # 5. the rights, if SecurityInsight should do the hub side itself
|    $L.Add(('5. Only if SecurityInsight should do 1 and 2a itself (answers peerToHub / linkZonesToHub, with your approval): the installing identity needs Network Contributor on {0}; for records in your zones, Private DNS Zone Contributor on their resource group.' -f $hubName))
|    # 6. the return route (#1095): replies from the apps subnet to your people's ranges go back through your firewall
|    $rr = Get-SIReturnRouteHandOff -Facts $Facts['ReturnRoute'] -Number '6'
|    foreach ($x in @($rr.Lines)) { $L.Add($x) }
|    if ($rr.Open) { $open++; $items.Add(@{ Kind = 'return-route'; Done = $false }) }
|    # 7. the test
|    $L.Add('7. CHECK from a machine in your network (each must answer with the private address shown):')
|    foreach ($n in @($Facts['InsideNames'] | Where-Object { $_ })) {
|        $exp = @($recs | Where-Object { $_.Fqdn -eq $n } | ForEach-Object { $_.Ip })[0]
|        if (-not $exp -and $Facts['EnvZone'] -and $n.EndsWith('.' + [string]$Facts['EnvZone'])) { $exp = [string]$Facts['EnvIp'] }
|        $L.Add(('        Resolve-DnsName {0} -Type A        # expect {1}' -f $n, $(if ($exp) { $exp } else { 'a private (10.x / 172.16-31.x / 192.168.x) address' })))
|    }
|    $web = @($Facts['InsideNames'] | Where-Object { $Facts['EnvZone'] -and $_.EndsWith('.' + [string]$Facts['EnvZone']) })[0]
|    if ($web) { $L.Add(('        Test-NetConnection {0} -Port 443' -f $web)) }
|    foreach ($nt in @($Facts['Notes'])) { $L.Add(('NOTE: {0}' -f $nt)) }
|    if ([string]$Facts['CloseCommand']) { $L.Add(('8. THEN close the public endpoints: {0}' -f $Facts['CloseCommand'])) }
|    @{ Open = $open; Lines = $L.ToArray(); Items = $items.ToArray(); Text = ($L.ToArray() -join "`n") }
|}
|
|function New-SIHubOwnerScript {
|    <#
|        PURE (returns text). The hub owner's script (PIM's New-PimHubPrepareScript, framework 12.17): ONE self-contained file
|        the customer's network team reads or runs -- no Azure CLI, no PowerShell module, a browser sign-in (auth code + PKCE
|        on a loopback port; never a device code), Azure Resource Manager REST. PLAN FIRST: without -Apply it prints what it
|        would do. With -Apply: (1) the hub side of the peering, PIM's settings, a same-name peering pointing elsewhere is
|        refused; (2) with -HubZonesResourceGroupId: the A records of the hand-off list in the EXISTING zones there (a zone
|        that is not there is said, never made); (3) with -LinkSecurityInsightZone: SecurityInsight's environment zone linked
|        to the hub; (4) the state of both sides of the peering and every name resolved from the machine it runs on. It
|        never deletes anything; running it twice is safe. Returns @{ Ok; Reason; FileName; Text }.
|    #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Facts, [string]$TenantId = '', [datetime]$NowUtc = [datetime]::UtcNow)
|    $spokeId = [string]$Facts['SpokeVnetId']; $hubId = [string]$Facts['HubVnetId']
|    if (-not $spokeId) { return @{ Ok = $false; Reason = 'SecurityInsight''s network is not known'; FileName = ''; Text = '' } }
|    $hubGiven = [bool]$hubId
|    $plan = if ($hubGiven) { Get-SIPeeringPlan -SpokeVnetId $spokeId -HubVnetId $hubId -SpokePrefixes @($Facts['SpokePrefixes']) -HubPrefixes @($Facts['HubPrefixes']) } else { $null }
|    if ($plan -and -not $plan.Ok) { return @{ Ok = $false; Reason = $plan.Reason; FileName = ''; Text = '' } }
|    $q = { param($s) "'" + ([string]$s).Replace("'", "''") + "'" }
|    foreach ($v in @($spokeId, $hubId, $Facts['EnvZone'], $Facts['EnvZoneId'], $Facts['EnvIp'])) { if ("$v" -match "[`r`n``]") { return @{ Ok = $false; Reason = ('a value holds a line break: {0}' -f $v); FileName = ''; Text = '' } } }
|    $recs = @(@($Facts['PrivateLinkRecords'] | Where-Object { $_ }) | ForEach-Object { '@{{ Zone = {0}; Name = {1}; Ip = {2} }}' -f (& $q $_.Zone), (& $q $_.Name), (& $q $_.Ip) })
|    if ([string]$Facts['EnvZone'] -and [string]$Facts['EnvIp']) { foreach ($r in (Get-SIEnvironmentDnsRecordNames)) { $recs += ('@{{ Zone = {0}; Name = {1}; Ip = {2} }}' -f (& $q $Facts['EnvZone']), (& $q $r), (& $q $Facts['EnvIp'])) } }
|    $hubPeer = if ($plan) { @($plan.Pairs | Where-Object { $_.Direction -eq 'hub-to-spoke' })[0] } else { $null }
|    $spokePeer = if ($plan) { @($plan.Pairs | Where-Object { $_.Direction -eq 'spoke-to-hub' })[0] } else { $null }
|    $L = New-Object System.Collections.Generic.List[string]
|    $L.Add('#Requires -Version 5.1')
|    $L.Add('<#')
|    $L.Add('.SYNOPSIS')
|    $L.Add(('    SecurityInsight -- the HUB SIDE of a private install, for the hub''s network team. Generated {0} UTC by SecurityInsight setup.' -f $NowUtc.ToUniversalTime().ToString('yyyy-MM-dd HH:mm')))
|    $L.Add('.DESCRIPTION')
|    $L.Add('    Read it, or run it as someone who may change the hub network. PowerShell 7 or Windows PowerShell 5.1, a browser sign-in --')
|    $L.Add('    no Azure CLI, no PowerShell module, nothing to install. WITHOUT -Apply IT ONLY SHOWS WHAT IT WOULD DO.')
|    $L.Add('    -Apply: (1) the hub side of the peering with SecurityInsight''s network (PIM4EntraPS''s settings); (2) with')
|    $L.Add('    -HubZonesResourceGroupId: the A records below in the EXISTING private DNS zones of that resource group (a zone that is')
|    $L.Add('    not there is said, never made); (3) with -LinkSecurityInsightZone: SecurityInsight''s web app zone linked to the hub;')
|    $L.Add('    (4) the state of both sides of the peering, and every name resolved from this machine. It never deletes anything.')
|    $L.Add('.EXAMPLE')
|    $L.Add('    ./prepare-hub-securityinsight.ps1                                   # the plan only')
|    $L.Add('    ./prepare-hub-securityinsight.ps1 -Apply -HubZonesResourceGroupId /subscriptions/<s>/resourceGroups/<your zones>')
|    $L.Add('#>')
|    $L.Add('[CmdletBinding()] param([switch]$Apply, [string]$HubZonesResourceGroupId = '''', [switch]$LinkSecurityInsightZone, [string]$TenantId = ' + (& $q $TenantId) + ')')
|    $L.Add('$ErrorActionPreference = ''Stop''')
|    $L.Add(('$SpokeId      = {0}' -f (& $q $spokeId)))
|    $L.Add(('$SpokeSpace   = {0}' -f (& $q ((@($Facts['SpokePrefixes']) | Where-Object { $_ }) -join ', '))))
|    $L.Add(('$HubId        = {0}' -f (& $q $hubId)))
|    $L.Add(('$HubPeering   = {0}' -f (& $q $(if ($hubPeer) { $hubPeer.Name } else { '' }))))
|    $L.Add(('$SpokePeering = {0}' -f (& $q $(if ($spokePeer) { $spokePeer.Name } else { '' }))))
|    $L.Add(('$EnvZoneId    = {0}' -f (& $q $Facts['EnvZoneId'])))
|    $L.Add(('$Records      = @({0})' -f ($recs -join ', ')))
|    $L.Add(('$Names        = @({0})' -f ((@($Facts['InsideNames'] | Where-Object { $_ }) | ForEach-Object { & $q $_ }) -join ', ')))
|    $L.Add(((Get-SIHubOwnerScriptBody) -replace "`r`n", "`n"))
|    @{ Ok = $true; Reason = ''; FileName = 'prepare-hub-securityinsight.ps1'; Text = (($L.ToArray() -join "`n").TrimEnd("`n") + "`n") }
|}
|
|function Get-SIHubOwnerScriptBody {
|    # the constant part of the hub owner's script (nothing in it is expanded by the generator)
|    return @'
|
|$Arm = 'https://management.azure.com'; $NetApi = '2024-05-01'; $DnsApi = '2020-06-01'
|# The Microsoft Azure CLI first-party public client APP ID, pre-authorised for Azure Resource Manager in every tenant, used
|# over REST for the browser sign-in -- the Azure CLI program is NOT needed and NOT used.
|$SignInClientId = '04b07795-8ddb-461a-bbee-02f9e1bf7b46'
|$Token = ''
|try { [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12 } catch { }
|function Get-Sub([string]$Id) { ($Id -split '/')[2] }
|function ConvertTo-B64Url([byte[]]$B) { [Convert]::ToBase64String($B).TrimEnd('=').Replace('+', '-').Replace('/', '_') }
|
|function Find-Tenant {
|    if ("$TenantId".Trim()) { return "$TenantId".Trim() }
|    try { $null = Invoke-RestMethod -Method GET -Uri "$Arm/subscriptions/$(Get-Sub $(if ($HubId) { $HubId } else { $SpokeId }))?api-version=2022-12-01" -ErrorAction Stop } catch {
|        $h = ''; try { $h = "$($_.Exception.Response.Headers['WWW-Authenticate'])" } catch { }
|        if (-not $h) { try { $h = (@($_.Exception.Response.Headers.WwwAuthenticate) | ForEach-Object { "$_" }) -join ', ' } catch { } }
|        if ($h -match 'authorization_uri="?https://login\.(?:windows\.net|microsoftonline\.com)/([0-9a-fA-F-]{36})') { return $Matches[1] }
|    }
|    throw 'Could not find the hub''s tenant -- run again with -TenantId <the tenant id>.'
|}
|
|function Get-ArmToken([string]$Tenant) {
|    $b = New-Object byte[] 32; [Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($b)
|    $verifier = ConvertTo-B64Url $b
|    $challenge = ConvertTo-B64Url ([Security.Cryptography.SHA256]::Create().ComputeHash([Text.Encoding]::ASCII.GetBytes($verifier)))
|    $state = [guid]::NewGuid().ToString('N')
|    $tcp = New-Object System.Net.Sockets.TcpListener([System.Net.IPAddress]::Loopback, 0); $tcp.Start()
|    $redirect = "http://localhost:$(([System.Net.IPEndPoint]$tcp.LocalEndpoint).Port)/"
|    $scope = "$Arm/.default offline_access openid profile"
|    $url = "https://login.microsoftonline.com/$Tenant/oauth2/v2.0/authorize?client_id=$SignInClientId&response_type=code&response_mode=query&redirect_uri=$([uri]::EscapeDataString($redirect))&scope=$([uri]::EscapeDataString($scope))&state=$state&code_challenge=$challenge&code_challenge_method=S256&prompt=select_account"
|    Write-Host "Sign in as the hub network's owner (tenant $Tenant). If no browser opens, open this address:" -ForegroundColor Yellow
|    Write-Host "  $url" -ForegroundColor DarkGray
|    try { Start-Process $url } catch { }
|    $query = $null
|    try {
|        $deadline = (Get-Date).AddMinutes(5)
|        while (-not $query) {
|            if ((Get-Date) -gt $deadline) { throw 'Timed out (5 min) waiting for the sign-in.' }
|            if (-not $tcp.Pending()) { Start-Sleep -Milliseconds 200; continue }
|            $c = $tcp.AcceptTcpClient()
|            try {
|                $s = $c.GetStream(); $line = (New-Object System.IO.StreamReader($s)).ReadLine()
|                $html = '<html><body style="font-family:sans-serif"><h3>Sign-in complete.</h3>Return to PowerShell.</body></html>'
|                $w = New-Object System.IO.StreamWriter($s); $w.Write("HTTP/1.1 200 OK`r`nContent-Type: text/html`r`nContent-Length: $($html.Length)`r`nConnection: close`r`n`r`n$html"); $w.Flush()
|                if ($line -match '^GET /\?(\S+) HTTP') { $query = $Matches[1] }
|            } finally { $c.Close() }
|        }
|    } finally { $tcp.Stop() }
|    $kv = @{}; foreach ($p in ($query -split '&')) { $k, $v = $p -split '=', 2; $kv[$k] = if ($null -ne $v) { [uri]::UnescapeDataString(($v -replace '\+', ' ')) } else { '' } }
|    if ($kv['error']) { throw "Sign-in failed: $($kv['error']) -- $($kv['error_description'])" }
|    if ($kv['state'] -ne $state -or -not $kv['code']) { throw 'The sign-in answer did not match this request -- run the script again.' }
|    $r = Invoke-RestMethod -Method POST -Uri "https://login.microsoftonline.com/$Tenant/oauth2/v2.0/token" -ContentType 'application/x-www-form-urlencoded' -Body @{
|        client_id = $SignInClientId; grant_type = 'authorization_code'; code = $kv['code']; redirect_uri = $redirect; code_verifier = $verifier; scope = $scope }
|    "$($r.access_token)"
|}
|
|function Invoke-Arm([string]$Method, [string]$Path, $Body = $null, [switch]$NotFoundOk) {
|    $p = @{ Method = $Method; Uri = ($Arm + $Path); Headers = @{ Authorization = "Bearer $Token" }; ErrorAction = 'Stop' }
|    if ($null -ne $Body) { $p.ContentType = 'application/json'; $p.Body = [Text.Encoding]::UTF8.GetBytes(($Body | ConvertTo-Json -Depth 10 -Compress)) }
|    try { Invoke-RestMethod @p } catch {
|        $code = 0; try { $code = [int]$_.Exception.Response.StatusCode } catch { }
|        if ($NotFoundOk -and $code -eq 404) { return $null }
|        throw "$Method $Path -> HTTP $code $($_.ErrorDetails.Message)"
|    }
|}
|
|function Wait-Succeeded([string]$Path) {
|    for ($i = 0; $i -lt 60; $i++) { $o = Invoke-Arm GET $Path -NotFoundOk; if ("$($o.properties.provisioningState)" -eq 'Succeeded') { return $o }; Start-Sleep -Seconds 5 }
|    throw "$Path did not reach Succeeded -- run the script again."
|}
|
|# ---- the plan --------------------------------------------------------------------------------------------------------
|Write-Host 'SecurityInsight -- the hub side of a private install' -ForegroundColor Cyan
|Write-Host "  SecurityInsight's network: $SpokeId ($SpokeSpace)"
|if ($HubId) {
|    Write-Host "  PLAN 1. on the hub $HubId : peering '$HubPeering' -> SecurityInsight's network (allowVirtualNetworkAccess true, allowForwardedTraffic false, allowGatewayTransit false, useRemoteGateways false)"
|} else { Write-Host '  PLAN 1. (no hub was named to SecurityInsight: make the peering of your hub with the network above, both directions, the settings above)' -ForegroundColor Yellow }
|if ($HubZonesResourceGroupId) { Write-Host "  PLAN 2. in the EXISTING zones of $HubZonesResourceGroupId : the A records" } else { Write-Host '  PLAN 2. (add -HubZonesResourceGroupId to write these A records in your existing zones):' }
|foreach ($r in $Records) { Write-Host ("           {0,-50} A {1,-12} in {2}" -f $r.Name, $r.Ip, $r.Zone) }
|if ($LinkSecurityInsightZone -and $EnvZoneId) { Write-Host "  PLAN 3. link SecurityInsight's zone $EnvZoneId to the hub" }
|Write-Host '  PLAN 4. read both sides of the peering; resolve every name from this machine'
|if (-not $Apply) { Write-Host 'Plan only -- nothing was changed. Run it with -Apply to make these changes (a browser sign-in).' -ForegroundColor Yellow; return }
|
|# ---- apply ------------------------------------------------------------------------------------------------------------
|$Token = Get-ArmToken -Tenant (Find-Tenant)
|if ($HubId) {
|    $pp = "$HubId/virtualNetworkPeerings/$($HubPeering)?api-version=$NetApi"
|    $have = Invoke-Arm GET $pp -NotFoundOk
|    if ($have -and "$($have.properties.remoteVirtualNetwork.id)".ToLowerInvariant() -ne $SpokeId.ToLowerInvariant()) { throw "a peering named $HubPeering already points at $($have.properties.remoteVirtualNetwork.id) -- nothing was changed." }
|    if (-not $have) {
|        $null = Invoke-Arm PUT $pp @{ properties = @{ remoteVirtualNetwork = @{ id = $SpokeId }; allowVirtualNetworkAccess = $true; allowForwardedTraffic = $false; allowGatewayTransit = $false; useRemoteGateways = $false } }
|        $null = Wait-Succeeded $pp; Write-Host "peering $HubPeering made" -ForegroundColor Green
|    } else { Write-Host "peering $HubPeering is there" }
|}
|if ($HubZonesResourceGroupId) {
|    foreach ($r in $Records) {
|        $zp = "$($HubZonesResourceGroupId.TrimEnd('/'))/providers/Microsoft.Network/privateDnsZones/$($r.Zone)"
|        if (-not (Invoke-Arm GET "$($zp)?api-version=$DnsApi" -NotFoundOk)) { Write-Host "  zone $($r.Zone) is not in $HubZonesResourceGroupId -- skipped (this script makes no zone)" -ForegroundColor Yellow; continue }
|        $rp = "$zp/A/$($r.Name)?api-version=$DnsApi"
|        $cur = Invoke-Arm GET $rp -NotFoundOk
|        if (@($cur.properties.aRecords | ForEach-Object { "$($_.ipv4Address)" }) -contains $r.Ip) { Write-Host "  $($r.Name).$($r.Zone) -> $($r.Ip) is there"; continue }
|        $null = Invoke-Arm PUT $rp @{ properties = @{ ttl = 3600; aRecords = @(@{ ipv4Address = $r.Ip }) } }
|        Write-Host "  $($r.Name).$($r.Zone) -> $($r.Ip) written" -ForegroundColor Green
|    }
|}
|if ($LinkSecurityInsightZone -and $EnvZoneId -and $HubId) {
|    $links = @((Invoke-Arm GET "$EnvZoneId/virtualNetworkLinks?api-version=$DnsApi").value)
|    if (@($links | Where-Object { "$($_.properties.virtualNetwork.id)".ToLowerInvariant() -eq $HubId.ToLowerInvariant() }).Count) { Write-Host '  the zone is linked to the hub' }
|    else {
|        $ln = 'link-' + ($HubId -split '/')[-1]
|        if (@($links | Where-Object { "$($_.name)" -eq $ln }).Count) { $ln = $ln + '-hub' }
|        $lp = "$EnvZoneId/virtualNetworkLinks/$($ln)?api-version=$DnsApi"
|        $null = Invoke-Arm PUT $lp @{ location = 'global'; properties = @{ virtualNetwork = @{ id = $HubId }; registrationEnabled = $false } }
|        $null = Wait-Succeeded $lp; Write-Host "  the zone is linked to the hub ($ln)" -ForegroundColor Green
|    }
|}
|# ---- the check ----------------------------------------------------------------------------------------------------------
|if ($HubId) {
|    $h = Invoke-Arm GET "$HubId/virtualNetworkPeerings/$($HubPeering)?api-version=$NetApi" -NotFoundOk
|    $s = $null; try { $s = Invoke-Arm GET "$SpokeId/virtualNetworkPeerings/$($SpokePeering)?api-version=$NetApi" -NotFoundOk } catch { }
|    Write-Host ("hub side             {0}: {1}" -f $HubPeering, $(if ($h) { $h.properties.peeringState } else { 'not there' }))
|    Write-Host ("SecurityInsight side {0}: {1}" -f $SpokePeering, $(if ($s) { $s.properties.peeringState } else { 'not readable from here / not made yet' }))
|    Write-Host 'Both sides must read Connected. SecurityInsight''s side is made by SecurityInsight setup (or by you, with its settings above).'
|}
|foreach ($n in $Names) {
|    $ips = @(); try { $ips = @([System.Net.Dns]::GetHostAddresses($n) | ForEach-Object { $_.IPAddressToString }) } catch { }
|    $ok = $ips.Count -and -not @($ips | Where-Object { $_ -notmatch '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)' }).Count
|    Write-Host ("  {0} -> {1}" -f $n, $(if ($ips.Count) { $ips -join ', ' } else { 'does not resolve' })) -ForegroundColor $(if ($ok) { 'Green' } else { 'Yellow' })
|}
|'@
|}
|
|function Write-SINetworkHandOffFiles {
|    <# The hand-off as files next to -BasePath: <base>.txt (the list) and prepare-hub-securityinsight.ps1 (the hub owner's
|       script) -- for the customer's network team and for Invardia. Returns @{ ListPath; ScriptPath }; a file that cannot be
|       written is ''. #>
|    param([Parameter(Mandatory)][string]$Directory, [Parameter(Mandatory)]$HandOff, $Script)
|    $out = @{ ListPath = ''; ScriptPath = '' }
|    try {
|        if (-not (Test-Path -LiteralPath $Directory)) { $null = New-Item -ItemType Directory -Force -Path $Directory }
|        $out.ListPath = [IO.Path]::Combine($Directory, 'network-hand-off.txt'); [IO.File]::WriteAllText($out.ListPath, [string]$HandOff.Text, (New-Object Text.UTF8Encoding $false))
|        if ($Script -and $Script.Ok) { $out.ScriptPath = [IO.Path]::Combine($Directory, $Script.FileName); [IO.File]::WriteAllText($out.ScriptPath, [string]$Script.Text, (New-Object Text.UTF8Encoding $false)) }
|    } catch { }
|    $out
|}
|
|# ============================================================================================================== THE NETWORK PREFLIGHT (INS-06 / INS-08)
|# Framework installer rule 8 (Invardia, after a customer's private install 2026-11-03: two privatelink zones were missing in
|# the customer's central DNS resource group, found only AFTER the workspace, the data collection endpoint and the storage
|# account were made): EVERY prerequisite of a private install is checked BEFORE the first resource -- the private DNS zones
|# the install's private endpoints need, the subnets (delegation, size, overlap), the rights on the customer's network and
|# zones, the outbound path of the build subnet, the hub (peering) and the DNS path -- with READS only, as the installing
|# identity. EVERYTHING missing is listed at once, with what to create, and the install stops before anything is made.
|# A read that fails (403, a throttled call, a network error) is NOT a missing item: it is said as "not checked" and never
|# blocks (owner rule: warn on suspicion, hold only on a real failure). What only warns in the install itself (the hub
|# peering, the zones' hub link, a DNS path that will pause at the DNS check) is a note here too, never a stop.
|
|function Get-SIPrivateNetworkZoneNames {
|    <# PURE. The private DNS zones the install's private endpoints need -- derived from the SAME list the endpoints are
|       made from (Get-SIPrivateEndpointTargets over $script:SIPnKinds), so a new endpoint kind is in the preflight at once.
|       -Sql: the database server (every install with the database); -Registry: the container registry (every private
|       install, framework rule 11b). The Container Apps environment's own zone is not here: it is always made in
|       SecurityInsight's own resource group (never the customer's), so it is never a prerequisite. #>
|    param([bool]$Sql = $true, [bool]$Vault = $true, [bool]$Storage = $true, [bool]$Registry = $true)
|    $p = '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers'
|    $t = @(Get-SIPrivateEndpointTargets -SqlServerId $(if ($Sql) { "$p/Microsoft.Sql/servers/x" } else { '' }) -KeyVaultId $(if ($Vault) { "$p/Microsoft.KeyVault/vaults/x" } else { '' }) `
|             -StorageAccountId $(if ($Storage) { "$p/Microsoft.Storage/storageAccounts/x" } else { '' }) -RegistryId $(if ($Registry) { "$p/Microsoft.ContainerRegistry/registries/x" } else { '' }))
|    @($t | ForEach-Object { [string]$_.Zone } | Select-Object -Unique)
|}
|
|function Get-SIPnRightsGap {
|    <# READ ONLY. Which of -Actions the signed-in identity may NOT do on -Scope (ARM's own permissions answer for that scope).
|       @{ Read; Missing; Error } -- Read = $false: the answer could not be read (a "not checked", never a missing right). #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][string]$Scope, [Parameter(Mandatory)][string[]]$Actions)
|    $perm = $null
|    try { $perm = & $Arm 'GET' ('{0}/providers/Microsoft.Authorization/permissions?api-version={1}' -f $Scope.TrimEnd('/'), $script:SIPnAuthApi) $null }
|    catch { return @{ Read = $false; Missing = @(); Error = [string]$_.Exception.Message } }
|    if ($null -eq $perm -or $null -eq (Get-SIPnProp $perm @('value'))) { return @{ Read = $false; Missing = @(); Error = 'Azure gave no permissions answer' } }
|    $list = @(Get-SIPnProp $perm @('value') | Where-Object { $_ })
|    @{ Read = $true; Missing = @($Actions | Where-Object { -not (Test-SIActionAllowed -Permissions $list -Action $_) }); Error = '' }
|}
|
|function Get-SIPrivateNetworkPreflight {
|    <#
|        READ ONLY (INS-06 / INS-08, framework installer rule 8). Every prerequisite of a private install for -Target
|        (Get-SIInstallPrivateNetworkTarget), checked with the installing identity's own ARM reads before anything is made.
|        Nothing is written: every call through -Arm is a GET (an Azure Resource Graph query, a read, at most).
|          -Sql / -Vault / -Storage / -Registry   which private endpoints the install makes (the zones follow from them)
|          -ZonesOnly   only the zones (the updater adding ONE private resource to an install whose network is in place)
|        Returns @{ Ok; Items; Missing; NotChecked; Notes; Lines } -- Items: @{ State = ok | missing | notchecked | note;
|        Area; Line; Create }. Ok = no item is 'missing' (a 'notchecked' or a 'note' never makes it false).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][System.Collections.IDictionary]$Target,
|          [bool]$Sql = $true, [bool]$Vault = $true, [bool]$Storage = $true, [bool]$Registry = $true, [switch]$ZonesOnly)
|    $items = New-Object System.Collections.Generic.List[object]
|    $add = { param([string]$State, [string]$Area, [string]$Line, [string]$Create = '') $items.Add([pscustomobject]@{ State = $State; Area = $Area; Line = $Line; Create = $Create }) }
|    $short = { param([string]$Id) if ($Id) { ($Id.TrimEnd('/') -split '/')[-1] } else { '' } }
|    $rgId = ([string]$Target['ResourceGroupId']).TrimEnd('/')
|    $vnetId = ([string]$Target['VnetId']).TrimEnd('/')
|    $create = [bool]$Target['CreateVnet']
|    $vnet = $null; $vnetRead = $false; $vnetReal = $false
|
|    # ---- the virtual network (-ZonesOnly: the network is in place -- the install's endpoints already sit in it)
|    if ($ZonesOnly) { $vnetReal = [bool]$vnetId }
|    elseif (-not $vnetId) {
|        & $add 'missing' 'network' 'no virtual network was given (vnetId), nor an address range for SecurityInsight''s own network (vnetAddressPrefix)' 'give vnetId (your network), or vnetAddressPrefix (at least a /25: SecurityInsight makes its own network in its resource group)'
|    } else {
|        try { $vnet = & $Arm 'GET' ('{0}?api-version={1}' -f $vnetId, $script:SIPnNetApi) $null; $vnetRead = $true }
|        catch { & $add 'notchecked' 'network' ('the virtual network {0} could not be read ({1}) -- not checked; the install checks it again when it prepares the subnets' -f (& $short $vnetId), $_.Exception.Message) }
|        if ($vnet) { $vnetReal = $true; & $add 'ok' 'network' ('the virtual network {0} ({1}) is there' -f (& $short $vnetId), ((@(Get-SIVnetPrefixes $vnet)) -join ', ')) }
|        elseif ($vnetRead -and $create) {
|            $sd = Get-SISpokeSubnetDefaults -AddressPrefix ([string]$Target['VnetAddressPrefix'])
|            if ($sd.Ok) { & $add 'ok' 'network' ('the virtual network {0} ({1}) is made by the install in its resource group' -f (& $short $vnetId), $Target['VnetAddressPrefix']) }
|            else { & $add 'missing' 'network' $sd.Reason 'give vnetAddressPrefix as a range of at least a /25 (two /26 subnets)' }
|            # the subnets are decided against the network the install will make
|            $vnet = [pscustomobject]@{ properties = [pscustomobject]@{ addressSpace = [pscustomobject]@{ addressPrefixes = @([string]$Target['VnetAddressPrefix']) }; subnets = @() } }
|        } elseif ($vnetRead) {
|            & $add 'missing' 'network' ('the virtual network {0} was not found, or the installing account cannot read it' -f $vnetId) 'give the id of an existing virtual network the installing account can read (Reader on it at least), or vnetAddressPrefix for SecurityInsight''s own network'
|        }
|    }
|    $own = $create -or ($vnetReal -and (Test-SIOwnSpokeVnet -Vnet $vnet -ResourceGroupId $rgId))
|
|    # ---- the subnets: size, delegation, inside the address space, no overlap
|    $snE = $null; $decE = $null; $decA = $null; $subnetActions = @()
|    if (-not $ZonesOnly -and $vnet) {
|        $subs = @(@{ Name = [string]$Target['AppsSubnetName']; Prefix = [string]$Target['AppsSubnetPrefix']; Delegate = $true }, @{ Name = [string]$Target['EndpointsSubnetName']; Prefix = [string]$Target['EndpointsSubnetPrefix']; Delegate = $false })
|        foreach ($s in $subs) {
|            $sn = $null
|            if ($vnetReal) {
|                try { $sn = & $Arm 'GET' ('{0}/subnets/{1}?api-version={2}' -f $vnetId, $s.Name, $script:SIPnNetApi) $null }
|                catch { & $add 'notchecked' 'subnet' ('the subnet {0} could not be read ({1}) -- not checked' -f $s.Name, $_.Exception.Message); continue }
|            }
|            $d = Get-SISubnetDecision -Subnet $sn -Prefix $s.Prefix -Name $s.Name -Delegate:([bool]$s.Delegate) -Vnet $vnet
|            if ($s.Delegate) { $decA = $d } else { $decE = $d; $snE = $sn }
|            if ($d.Action -eq 'fail') {
|                $fix = if ($s.Delegate) { 'give appsSubnetName / appsSubnetPrefix for an empty subnet of at least a /27 that is free for the Container Apps delegation (or let your network team create it, delegated to Microsoft.App/environments)' }
|                       else { 'give endpointsSubnetName / endpointsSubnetPrefix for a subnet of the private endpoints (or let your network team create it)' }
|                & $add 'missing' 'subnet' $d.Reason $fix
|            } else {
|                & $add 'ok' 'subnet' $(if ($d.Action -eq 'none') { $d.Reason } else { $d.Reason -replace ' is (created|delegated)', ' is $1 by the install' })
|                if ($d.Action -in 'create', 'delegate') { $subnetActions += 'Microsoft.Network/virtualNetworks/subnets/write' }
|            }
|        }
|        if ($decA -and $decE -and $decA.Action -eq 'create' -and $decE.Action -eq 'create' -and (Test-SICidrOverlap ([string]$Target['AppsSubnetPrefix']) ([string]$Target['EndpointsSubnetPrefix']))) {
|            & $add 'missing' 'subnet' ('the two new subnets overlap ({0} and {1})' -f $Target['AppsSubnetPrefix'], $Target['EndpointsSubnetPrefix']) 'give two address ranges that do not overlap (appsSubnetPrefix, endpointsSubnetPrefix)'
|        }
|    }
|
|    # ---- the outbound path of the build subnet (rule 11b: the registry's agent pool runs in the endpoints subnet)
|    if (-not $ZonesOnly -and $Registry -and $decE -and $decE.Action -ne 'fail') {
|        if ($decE.Action -eq 'create') { & $add 'ok' 'outbound' ('the build subnet {0} is created with default outbound access (outbound only)' -f $Target['EndpointsSubnetName']) }
|        elseif ($snE) {
|            $rt = $null; $rtOk = $true
|            $rtId = [string](Get-SIPnProp $snE @('properties', 'routeTable', 'id'))
|            if ($rtId) { try { $rt = & $Arm 'GET' ('{0}?api-version={1}' -f $rtId.TrimEnd('/'), $script:SIPnNetApi) $null } catch { $rtOk = $false } }
|            $via = Get-SISubnetOutboundPath -Subnet $snE -RouteTable $rt
|            $what = @{ default = 'default outbound access'; nat = 'a NAT gateway'; route = 'a route table with a 0.0.0.0/0 route (your firewall)' }
|            if ($via) { & $add 'ok' 'outbound' ('the build subnet {0} has an outbound path ({1})' -f $Target['EndpointsSubnetName'], $what[$via]) }
|            elseif (-not $rtOk) { & $add 'notchecked' 'outbound' ('the route table {0} of the build subnet {1} could not be read -- its outbound path is not checked' -f (& $short $rtId), $Target['EndpointsSubnetName']) }
|            elseif ($own) { & $add 'ok' 'outbound' ('the build subnet {0} (SecurityInsight''s own network) gets default outbound access from the install (outbound only)' -f $Target['EndpointsSubnetName']) }
|            else { & $add 'missing' 'outbound' ('the build subnet {0} has no outbound path (no default outbound access, no NAT gateway, no 0.0.0.0/0 route): the registry''s build agent pool cannot run there' -f $Target['EndpointsSubnetName']) (Get-SIBuildSubnetOutboundStep -SubnetName ([string]$Target['EndpointsSubnetName'])) }
|        }
|    }
|
|    # ---- the private DNS zones
|    $zones = @(Get-SIPrivateNetworkZoneNames -Sql $Sql -Vault $Vault -Storage $Storage -Registry $Registry)
|    $central = ([string]$Target['DnsResourceGroupId']).TrimEnd('/')
|    if (Test-SIPnSameId $central $rgId) { $central = '' }
|    $zSubs = Get-SIZoneSearchSubscriptions @($rgId, $vnetId, $central)
|    $hub = ([string]$Target['HubVnetId']).TrimEnd('/')
|    $needVnetJoin = $false
|    foreach ($z in $zones) {
|        $zoneId = ''; $where = ''
|        if ($central) {
|            $cid = '{0}/providers/Microsoft.Network/privateDnsZones/{1}' -f $central, $z
|            $zo = $null
|            try { $zo = & $Arm 'GET' ('{0}?api-version={1}' -f $cid, $script:SIPnDnsApi) $null }
|            catch { & $add 'notchecked' 'dns' ('the private DNS zone {0} in your central resource group {1} could not be read ({2}) -- not checked' -f $z, (& $short $central), $_.Exception.Message); continue }
|            if (-not $zo) {
|                & $add 'missing' 'dns' ('the private DNS zone {0} is not in your central resource group {1} (SecurityInsight never makes a zone there)' -f $z, (& $short $central)) ('your network team creates the private DNS zone {0} in {1} -- or leave the central resource group empty (privateDnsZonesResourceGroupId) and the install uses its own zones' -f $z, (& $short $central))
|                continue
|            }
|            $zoneId = $cid; $where = ('your central resource group {0}' -f (& $short $central))
|        } else {
|            $ownZ = '{0}/providers/Microsoft.Network/privateDnsZones/{1}' -f $rgId, $z
|            $have = $null
|            try { $have = & $Arm 'GET' ('{0}?api-version={1}' -f $ownZ, $script:SIPnDnsApi) $null } catch { $have = $null }
|            if ($have) { & $add 'ok' 'dns' ('the private DNS zone {0} is there (SecurityInsight''s own)' -f $z); continue }
|            if ($vnetReal) {
|                $found = ''
|                try { $found = Find-SIVnetLinkedZone -Arm $Arm -VnetId $vnetId -Zone $z -SubscriptionIds $zSubs }
|                catch { & $add 'notchecked' 'dns' ('whether the network is already linked to another zone {0} could not be read ({1}) -- not checked; the install makes its own zone or uses that one' -f $z, $_.Exception.Message); continue }
|                if ($found -and -not (Test-SIPnSameId $found $ownZ)) { $zoneId = $found; $where = ('resource group {0} (the network is already linked to it, so it is used: Azure refuses a second zone of that name on one network)' -f (ConvertFrom-SIPnResourceId $found).ResourceGroup) }
|            }
|            if (-not $zoneId) { & $add 'ok' 'dns' ('the private DNS zone {0} is made by the install in its resource group, linked to the network' -f $z); continue }
|        }
|        # a zone that is NOT SecurityInsight's own: the install writes each endpoint's record into it (its zone group:
|        # privateDnsZones/join/action) and links it to the network when it is not linked yet (virtualNetworkLinks/write)
|        $links = $null
|        try { $links = @(Get-SIPnArmList -Arm $Arm -Path ('{0}/virtualNetworkLinks?api-version={1}' -f $zoneId, $script:SIPnDnsApi)) } catch { $links = $null }
|        $linked = $false
|        if ($null -ne $links -and $vnetId) { $linked = [bool]@($links | Where-Object { Test-SIPnSameId ([string](Get-SIPnProp $_ @('properties', 'virtualNetwork', 'id'))) $vnetId }).Count }
|        $acts = @('Microsoft.Network/privateDnsZones/join/action')
|        if (-not $linked) { $acts += 'Microsoft.Network/privateDnsZones/virtualNetworkLinks/write'; $needVnetJoin = $true }
|        $g = Get-SIPnRightsGap -Arm $Arm -Scope $zoneId -Actions $acts
|        $linkWord = if ($linked) { ('linked to {0}' -f (& $short $vnetId)) } elseif ($null -eq $links) { 'its links could not be read' } else { ('not linked to {0} yet: the install links it' -f (& $short $vnetId)) }
|        if (-not $g.Read) {
|            & $add 'ok' 'dns' ('the private DNS zone {0} is in {1}, {2}' -f $z, $where, $linkWord)
|            & $add 'notchecked' 'rights' ('the installing account''s rights on the zone {0} could not be read ({1}) -- not checked (the install writes the endpoints'' records into it{2})' -f $z, $g.Error, $(if ($linked) { '' } else { ' and links it to the network' }))
|        } elseif (@($g.Missing).Count) {
|            & $add 'missing' 'rights' ('the private DNS zone {0} is in {1}, {2} -- but the installing account may not {3} on it' -f $z, $where, $linkWord, (@($g.Missing) -join ', ')) ('grant the installing account Private DNS Zone Contributor on the zone {0} (or your network team links it to {1} and grants the record write)' -f $z, (& $short $vnetId))
|        } else { & $add 'ok' 'dns' ('the private DNS zone {0} is in {1}, {2}; the installing account may write its records' -f $z, $where, $linkWord) }
|        # warn only: a central zone the hub is not linked to (clients resolving through the hub may not find the names)
|        if (-not $ZonesOnly -and $hub -and $null -ne $links -and -not @($links | Where-Object { Test-SIPnSameId ([string](Get-SIPnProp $_ @('properties', 'virtualNetwork', 'id'))) $hub }).Count) {
|            & $add 'note' 'dns' ('the private DNS zone {0} is not linked to the hub network {1}: clients that resolve through the hub may not find SecurityInsight''s names until your network team links it' -f $z, (& $short $hub))
|        }
|    }
|
|    # ---- the rights on the customer's network (SecurityInsight's own spoke: the resource group rights the preflight checks)
|    if (-not $ZonesOnly -and $vnetReal -and -not $own) {
|        $acts = @('Microsoft.Network/virtualNetworks/subnets/join/action') + @($subnetActions | Select-Object -Unique)
|        if ($needVnetJoin) { $acts += 'Microsoft.Network/virtualNetworks/join/action' }
|        $g = Get-SIPnRightsGap -Arm $Arm -Scope $vnetId -Actions $acts
|        if (-not $g.Read) { & $add 'notchecked' 'rights' ('the installing account''s rights on the virtual network {0} could not be read ({1}) -- not checked' -f (& $short $vnetId), $g.Error) }
|        elseif (@($g.Missing).Count) { & $add 'missing' 'rights' ('the installing account may not {0} on the virtual network {1}' -f (@($g.Missing) -join ', '), (& $short $vnetId)) ('grant the installing account Network Contributor on the virtual network {0} (or your network team prepares the subnets and the links)' -f (& $short $vnetId)) }
|        else { & $add 'ok' 'rights' ('the installing account may use the virtual network {0}' -f (& $short $vnetId)) }
|    }
|
|    if (-not $ZonesOnly) {
|        # ---- the hub: the peering and the zones' hub link warn in the install (hand-off list), so they warn here too
|        if ($hub) {
|            $hubObj = $null; $hubRead = $true
|            try { $hubObj = & $Arm 'GET' ('{0}?api-version={1}' -f $hub, $script:SIPnNetApi) $null } catch { $hubRead = $false }
|            if (-not $hubRead -or -not $hubObj) {
|                & $add 'note' 'hub' ('the hub network {0} could not be read by the installing account -- the peering and the hub''s DNS are on the network hand-off list for your network team' -f (& $short $hub))
|            } else {
|                $pst = if ($vnetReal) { Get-SIPeeringState -Arm $Arm -VnetId $vnetId -RemoteVnetId $hub } else { '' }
|                if ($pst -eq 'Connected') { & $add 'ok' 'hub' ('the network is peered with the hub {0} (Connected)' -f (& $short $hub)) }
|                elseif ([bool]$Target['PeerToHub']) {
|                    $hg = Get-SIPnRightsGap -Arm $Arm -Scope $hub -Actions @('Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write', 'Microsoft.Network/virtualNetworks/peer/action')
|                    if ($hg.Read -and @($hg.Missing).Count) { & $add 'note' 'hub' ('peerToHub is on, but the installing account may not {0} on the hub {1}: the install goes on without the peering (it is on the network hand-off list), or grant Network Contributor on the hub' -f (@($hg.Missing) -join ', '), (& $short $hub)) }
|                    else { & $add 'ok' 'hub' ('the install peers the network with the hub {0} (both directions, peerToHub)' -f (& $short $hub)) }
|                } else { & $add 'note' 'hub' ('the network is not peered with the hub {0} yet{1}: the peering is on the network hand-off list for your network team (or turn on peerToHub)' -f (& $short $hub), $(if ($pst -and $pst -ne 'unreadable') { (' (state: {0})' -f $pst) } else { '' })) }
|                if ([bool]$Target['LinkZonesToHub']) {
|                    $lg = Get-SIPnRightsGap -Arm $Arm -Scope $hub -Actions @('Microsoft.Network/virtualNetworks/join/action')
|                    if ($lg.Read -and @($lg.Missing).Count) { & $add 'note' 'hub' ('linkZonesToHub is on, but the installing account may not join the hub {0}: the environment''s zone is not linked to the hub (hand-off list)' -f (& $short $hub)) }
|                }
|            }
|        }
|        # ---- the DNS path: a network that resolves through its own DNS servers (a hub resolver / forwarder) does not see
|        # zones linked only to SecurityInsight's network -- the install then PAUSES at its DNS check (a wait, not a failure)
|        if ($vnetReal) {
|            $dns = @(Get-SIPnProp $vnet @('properties', 'dhcpOptions', 'dnsServers') | Where-Object { $_ })
|            if ($dns.Count -and -not $central) {
|                & $add 'note' 'dns-path' ('the network resolves names through your DNS servers ({0}): the zones SecurityInsight makes are linked to its network only, so the install pauses at its DNS check until your network team adds the records it lists or forwards the privatelink zones to Azure DNS (168.63.129.16) -- or name a central zone group (privateDnsZonesResourceGroupId) your resolver already answers from' -f ($dns -join ', '))
|            } elseif ($dns.Count) { & $add 'ok' 'dns-path' ('the network resolves names through your DNS servers ({0}); the zones are in your central resource group' -f ($dns -join ', ')) }
|            else { & $add 'ok' 'dns-path' 'the network resolves names through Azure DNS (the zones linked to it answer)' }
|        }
|    }
|
|    $miss = @($items | Where-Object { $_.State -eq 'missing' })
|    $nc = @($items | Where-Object { $_.State -eq 'notchecked' })
|    $notes = @($items | Where-Object { $_.State -eq 'note' })
|    $lines = New-Object System.Collections.Generic.List[string]
|    foreach ($i in $items) { $lines.Add(('{0,-11} {1}' -f $(switch ($i.State) { 'ok' { 'ok' } 'missing' { 'MISSING' } 'notchecked' { 'NOT CHECKED' } default { 'note' } }), $i.Line)) }
|    @{ Ok = (-not $miss.Count); Items = $items.ToArray(); Missing = $miss; NotChecked = $nc; Notes = $notes; Lines = $lines.ToArray(); Zones = $zones }
|}
|
|function Format-SIPrivateNetworkPreflightMissing {
|    <# PURE. The one list the customer's network team works from: each missing item and what to create / grant. #>
|    param([object[]]$Missing = @())
|    $n = 0
|    @(foreach ($m in @($Missing | Where-Object { $_ })) { $n++; '{0}. {1} -- {2}' -f $n, $m.Line, $(if ($m.Create) { $m.Create } else { 'fix it, then run the install again' }) })
|}
|
|function Invoke-SIPrivateNetworkPreflight {
|    <# Setup's call (the guided install's preflight-network step, BEFORE the first resource): Get-SIPrivateNetworkPreflight
|       over setup's own ARM sign-in (Invoke-SIArm, GET only, unless -Arm is given). Returns its answer. #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Target, [bool]$Sql = $true, [bool]$Registry = $true, [scriptblock]$Arm, [string]$SubscriptionId)
|    if (-not $Arm) { $Arm = { param([string]$Method, [string]$Path, $Body) if ($Method -eq 'GET') { Invoke-SIArm -Path $Path -AllowNotFound } else { Invoke-SIArm -Method $Method -Path $Path -Body $Body } } }
|    Get-SIPrivateNetworkPreflight -Arm $Arm -Target $Target -Sql $Sql -Registry $Registry
|}
|
|# ============================================================================================================== SETUP'S CALLS
|
|function Get-SIInstallPrivateNetworkTarget {
|    <# PURE. The private-network answers of the guided install as one target. #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Values, [Parameter(Mandatory)][string]$ResourceGroupId)
|    $n = Get-SIPrivateNetworkNames
|    $dns = "$($Values['privateDnsZonesResourceGroupId'])".Trim().TrimEnd('/')
|    $vnet = "$($Values['vnetId'])".Trim().TrimEnd('/')
|    # #866 (PIM's New-PimHostingPrerequisites): no network given but an address range -- SecurityInsight makes its OWN spoke
|    # network in its resource group (vnetName, default vnet-si); its subnets default to the first and second /26 of it
|    $vPrefix = "$($Values['vnetAddressPrefix'])".Trim()
|    $create = [bool](-not $vnet -and $vPrefix)
|    $vName = if ("$($Values['vnetName'])".Trim()) { "$($Values['vnetName'])".Trim() } else { $n.Vnet }
|    if ($create) { $vnet = '{0}/providers/Microsoft.Network/virtualNetworks/{1}' -f $ResourceGroupId.TrimEnd('/'), $vName }
|    $split = if ($create) { Get-SISpokeSubnetDefaults -AddressPrefix $vPrefix } else { @{ Ok = $false; Apps = ''; Endpoints = '' } }
|    # #866: the customer's hub network (optional; may be in another subscription). OWNER 2026-10-21 ("we are not allowed
|    # to"): SecurityInsight writes NOTHING on the hub by default -- the hub id only makes the network hand-off exact. Only
|    # when the customer turns it on (and the rights read back first) does SecurityInsight link its zones to the hub
|    # (linkZonesToHub) or peer the networks (peerToHub).
|    $hub = "$($Values['hubVnetId'])".Trim().TrimEnd('/')
|    if ($hub -and (Test-SIPnSameId $hub $vnet)) { $hub = '' }
|    $yes = { param($x) [bool]($x -eq $true -or "$x" -eq 'True') }
|    $linkHub = [bool]($hub -and (& $yes $Values['linkZonesToHub']))
|    [ordered]@{
|        VnetId = $vnet
|        HubVnetId = $hub
|        LinkZonesToHub = $linkHub
|        PeerToHub = [bool]($hub -and (& $yes $Values['peerToHub']))
|        LinkVnetIds = @(Get-SIDnsLinkVnetIds -VnetId $vnet -HubVnetId $(if ($linkHub) { $hub } else { '' }))
|        CreateVnet = $create
|        VnetAddressPrefix = $vPrefix
|        AppsSubnetName = $(if ("$($Values['appsSubnetName'])".Trim()) { "$($Values['appsSubnetName'])".Trim() } else { $n.AppsSubnet })
|        AppsSubnetPrefix = $(if ("$($Values['appsSubnetPrefix'])".Trim()) { "$($Values['appsSubnetPrefix'])".Trim() } else { [string]$split.Apps })
|        EndpointsSubnetName = $(if ("$($Values['endpointsSubnetName'])".Trim()) { "$($Values['endpointsSubnetName'])".Trim() } else { $n.EndpointsSubnet })
|        EndpointsSubnetPrefix = $(if ("$($Values['endpointsSubnetPrefix'])".Trim()) { "$($Values['endpointsSubnetPrefix'])".Trim() } else { [string]$split.Endpoints })
|        DnsResourceGroupId = $(if ($dns) { $dns } else { $ResourceGroupId })
|        ResourceGroupId = $ResourceGroupId
|        # #1095: the return route of the apps subnet -- the ranges the customer's people browse from and the hub firewall's
|        # private IP (both the customer's answers; SecurityInsight makes the route only on its own spoke)
|        # (as given, one item per range; Get-SIReturnRouteFacts normalises them and names what is not a range)
|        ReturnRouteRanges = @(@($Values['returnRouteRanges']) | Where-Object { $_ } | ForEach-Object { "$_" -split '[,;\s]+' } | Where-Object { $_ })
|        ReturnRouteNextHop = "$($Values['returnRouteNextHop'])".Trim()
|    }
|}
|
|function Invoke-SIPrivateNetworkSubnets {
|    <# Setup's call (the guided install, before the container setup): the two subnets, over setup's own ARM sign-in
|       (Invoke-SIArm unless -Arm is given). Returns @{ Ok; Lines; AppsSubnetId; EndpointsSubnetId }; throws when a subnet
|       cannot be used (the reason, nothing changed). #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Target, [scriptblock]$Arm, [scriptblock]$Sleep, [string]$SubscriptionId,
|          # #866: where SecurityInsight's own network is made (vnetAddressPrefix without vnetId): the install's region
|          [string]$Location = '')
|    if (-not $Arm) { $Arm = { param([string]$Method, [string]$Path, $Body) if ($Method -eq 'GET') { Invoke-SIArm -Path $Path -AllowNotFound } else { Invoke-SIArm -Method $Method -Path $Path -Body $Body } } }
|    if (-not $Sleep) { $Sleep = { param($s) Start-Sleep -Seconds $s } }
|    if (-not "$($Target['VnetId'])") { throw 'Private network: no virtual network was given (vnetId), nor an address range for SecurityInsight''s own (vnetAddressPrefix). Nothing was changed.' }
|    $lines = New-Object System.Collections.Generic.List[string]; $created = $false
|    $vnetPath = '{0}?api-version={1}' -f $Target['VnetId'], $script:SIPnNetApi
|    if ([bool]$Target['CreateVnet']) {
|        $sd = Get-SISpokeSubnetDefaults -AddressPrefix ([string]$Target['VnetAddressPrefix'])
|        if (-not $sd.Ok) { throw ('Private network: {0}. Nothing was changed.' -f $sd.Reason) }
|        if (Test-SICidrOverlap ([string]$Target['AppsSubnetPrefix']) ([string]$Target['EndpointsSubnetPrefix'])) { throw ('Private network: the two subnets overlap ({0}, {1}). Nothing was changed.' -f $Target['AppsSubnetPrefix'], $Target['EndpointsSubnetPrefix']) }
|        if (-not $Location) { throw 'Private network: the region for SecurityInsight''s network is not known. Nothing was changed.' }
|        $v = Set-SIVnet -Arm $Arm -VnetId ([string]$Target['VnetId']) -Location $Location -AddressPrefix ([string]$Target['VnetAddressPrefix']) -Sleep $Sleep
|        $lines.Add($v.Line); $created = [bool]$v.Created
|        if (-not $v.Ok) { return @{ Ok = $false; Lines = $lines.ToArray(); AppsSubnetId = ''; EndpointsSubnetId = ''; Location = $Location; VnetId = [string]$Target['VnetId']; VnetCreated = $created } }
|    }
|    $vnet = & $Arm 'GET' $vnetPath $null
|    if (-not $vnet) { throw ('Private network: the virtual network {0} was not found, or this account cannot read it. Nothing was changed.' -f $Target['VnetId']) }
|    $a = Set-SISubnet -Arm $Arm -VnetId $Target['VnetId'] -Name $Target['AppsSubnetName'] -Prefix $Target['AppsSubnetPrefix'] -Delegate -Vnet $vnet -Sleep $Sleep
|    $vnet = & $Arm 'GET' $vnetPath $null
|    $e = Set-SISubnet -Arm $Arm -VnetId $Target['VnetId'] -Name $Target['EndpointsSubnetName'] -Prefix $Target['EndpointsSubnetPrefix'] -Vnet $vnet -Sleep $Sleep
|    $lines.Add($a.Line); $lines.Add($e.Line)
|    @{ Ok = ($a.Ok -and $e.Ok); Lines = $lines.ToArray(); AppsSubnetId = $a.Id; EndpointsSubnetId = $e.Id
|       Location = [string](Get-SIPnProp $vnet @('location')); VnetId = [string]$Target['VnetId']; VnetCreated = $created }
|}
|
|function Invoke-SIPrivateNetworkHandOff {
|    <# Setup's call (#866, the end of the guided install's private-network step): the network hand-off -- read from Azure
|       (never a write), the list, the hub owner's script, both written to -Directory when given. Returns @{ HandOff;
|       Script; ListPath; ScriptPath; Facts }. #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Target, [string]$EnvironmentId = '', [string[]]$InsideNames = @(), [string[]]$Notes = @(),
|          [string]$CloseCommand = '', [string]$Directory = '', [string]$TenantId = '', [scriptblock]$Arm, [string]$SubscriptionId)
|    if (-not $Arm) { $Arm = { param([string]$Method, [string]$Path, $Body) if ($Method -eq 'GET') { Invoke-SIArm -Path $Path -AllowNotFound } else { Invoke-SIArm -Method $Method -Path $Path -Body $Body } } }
|    $f = Get-SINetworkHandOffFacts -Arm $Arm -Target $Target -EnvironmentId $EnvironmentId -InsideNames $InsideNames -Notes $Notes
|    $f.CloseCommand = $CloseCommand
|    $h = Get-SINetworkHandOff -Facts $f
|    $s = New-SIHubOwnerScript -Facts $f -TenantId $TenantId
|    $w = if ($Directory) { Write-SINetworkHandOffFiles -Directory $Directory -HandOff $h -Script $s } else { @{ ListPath = ''; ScriptPath = '' } }
|    @{ HandOff = $h; Script = $s; ListPath = $w.ListPath; ScriptPath = $w.ScriptPath; Facts = $f }
|}
|
|function Invoke-SIPrivateNetworkSqlIdentity {
|    <# Setup's call (the guided install's private-network step, Pro, BEFORE the public endpoints close): the in-network
|       SQL identity id-si-sql, over setup's own ARM sign-in (Invoke-SIArm unless -Arm is given). Its membership of the
|       admin group is the step's own Graph call. Returns Set-SISqlIdentity's answer. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupId, [Parameter(Mandatory)][string]$Location, [scriptblock]$Arm, [scriptblock]$Sleep, [string]$SubscriptionId)
|    if (-not $Arm) { $Arm = { param([string]$Method, [string]$Path, $Body) if ($Method -eq 'GET') { Invoke-SIArm -Path $Path -AllowNotFound } else { Invoke-SIArm -Method $Method -Path $Path -Body $Body } } }
|    if (-not $Sleep) { $Sleep = { param($s) Start-Sleep -Seconds $s } }
|    Set-SISqlIdentity -Arm $Arm -ResourceGroupId $ResourceGroupId -Location $Location -Sleep $Sleep
|}
|
|function Set-SIPrivateEndpointsWithDns {
|    <# The private endpoints of the given resources, each with its zone (Resolve-SIPrivateDnsZone: SecurityInsight's own,
|       a central group's existing one, or the one of that name the network is already linked to), the zone's link to
|       SecurityInsight's network and the endpoint's zone group -- each read back. Returns @{ Ok; Lines; HandOff }. #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][System.Collections.IDictionary]$Target, [Parameter(Mandatory)][string]$Location,
|          [Parameter(Mandatory)][string]$EndpointsSubnetId, [string]$SqlServerId = '', [string]$KeyVaultId = '', [string]$StorageAccountId = '', [string]$RegistryId = '',
|          [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s })
|    $lines = New-Object System.Collections.Generic.List[string]; $handOff = New-Object System.Collections.Generic.List[string]; $ok = $true
|    $zones = @{}
|    $zSubs = Get-SIZoneSearchSubscriptions @([string]$Target['ResourceGroupId'], [string]$Target['VnetId'], [string]$Target['DnsResourceGroupId'])
|    foreach ($t in @(Get-SIPrivateEndpointTargets -SqlServerId $SqlServerId -KeyVaultId $KeyVaultId -StorageAccountId $StorageAccountId -RegistryId $RegistryId)) {
|        $pe = Set-SIPrivateEndpoint -Arm $Arm -ResourceGroupId $Target['ResourceGroupId'] -Location $Location -SubnetId $EndpointsSubnetId -Target $t -Sleep $Sleep
|        $lines.Add($pe.Line); if (-not $pe.Ok) { $ok = $false; continue }
|        if (-not $zones.ContainsKey($t.Zone)) {
|            # #866 item 6: a central resource group's zone is used, never made; a same-name zone the network is already
|            # linked to is used; a write SecurityInsight may not make on a zone that is not its own is a hand-off line
|            $z = Resolve-SIPrivateDnsZone -Arm $Arm -Zone $t.Zone -ResourceGroupId $Target['ResourceGroupId'] -CentralResourceGroupId $Target['DnsResourceGroupId'] -VnetId $Target['VnetId'] -SubscriptionIds $zSubs -Sleep $Sleep
|            $lines.Add($z.Line); $zones[$t.Zone] = ''
|            if (-not $z.Ok) { $ok = $false; if ($z.HandOff) { $handOff.Add($z.Line) }; continue }
|            $l = Set-SIPrivateDnsLink -Arm $Arm -ZoneId $z.ZoneId -VnetId $Target['VnetId'] -HandOffOnError:([bool]$z.Elsewhere) -Sleep $Sleep; $lines.Add($l.Line)
|            if ($l.HandOff) { $handOff.Add($l.Line); $ok = $false } elseif (-not $l.Ok) { $ok = $false }
|            $zones[$t.Zone] = $z.ZoneId
|        }
|        if (-not $zones[$t.Zone]) { continue }
|        try { $g = Set-SIPrivateDnsZoneGroup -Arm $Arm -EndpointId $pe.Id -ZoneId $zones[$t.Zone] -Sleep $Sleep; $lines.Add($g.Line); if (-not $g.Ok) { $ok = $false } }
|        catch { $ok = $false; $gl = ('{0}: its address could not be written into the zone {1} ({2}) -- the record is on the network hand-off list' -f $t.Name, $t.Zone, $_.Exception.Message); $lines.Add($gl); $handOff.Add($gl) }
|    }
|    @{ Ok = $ok; Lines = $lines.ToArray(); HandOff = $handOff.ToArray() }
|}
|
|function Invoke-SIPrivateNetworkDataEndpoints {
|    <#
|        Setup's call (#866, owner 2026-10-21: "we will not allow fw option or exceptions"): RIGHT AFTER a data resource is
|        created private (the Key Vault and the storage account in the infrastructure step, the database server in pro-sql),
|        its private endpoint(s), zone(s) and zone group(s) -- BEFORE anything reads or writes it. Then the DNS GATE
|        (Invoke-SIPrivateNetworkDnsGate). Returns @{ Ok; Lines; HandOff; Gate }.
|    #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Target, [Parameter(Mandatory)][string]$Location, [string]$EndpointsSubnetId = '',
|          [string]$SqlServerId = '', [string]$KeyVaultId = '', [string]$StorageAccountId = '', [scriptblock]$Resolve,
|          [scriptblock]$Arm, [scriptblock]$Sleep, [string]$SubscriptionId)
|    if (-not $Arm) { $Arm = { param([string]$Method, [string]$Path, $Body) if ($Method -eq 'GET') { Invoke-SIArm -Path $Path -AllowNotFound } else { Invoke-SIArm -Method $Method -Path $Path -Body $Body } } }
|    if (-not $Sleep) { $Sleep = { param($s) Start-Sleep -Seconds $s } }
|    if (-not $EndpointsSubnetId) { $EndpointsSubnetId = '{0}/subnets/{1}' -f ([string]$Target['VnetId']).TrimEnd('/'), [string]$Target['EndpointsSubnetName'] }
|    $ep = Set-SIPrivateEndpointsWithDns -Arm $Arm -Target $Target -Location $Location -EndpointsSubnetId $EndpointsSubnetId -SqlServerId $SqlServerId -KeyVaultId $KeyVaultId -StorageAccountId $StorageAccountId -Sleep $Sleep
|    $gate = Invoke-SIPrivateNetworkDnsGate -Arm $Arm -Target $Target -SqlServerId $SqlServerId -KeyVaultId $KeyVaultId -StorageAccountId $StorageAccountId -Resolve $Resolve
|    @{ Ok = [bool]($ep.Ok -and $gate.Ok); Lines = @(@($ep.Lines) + @($gate.Lines)); HandOff = @($ep.HandOff); Gate = $gate; EndpointsOk = [bool]$ep.Ok }
|}
|
|function Invoke-SIPrivateNetworkDnsGate {
|    <#
|        THE PAUSE (#866): the machine that runs the install is inside the customer's network but resolves through the hub's
|        DNS resolver, so the private endpoints' names resolve there only once the customer's network team has added them.
|        This resolves each name of the given resources FROM THIS MACHINE and passes only when every one answers with its
|        private address. Not passing: Records = the exact A records (zone, name, private address) for the hub, so the
|        install stops with ONE customer action and a resume continues from here. Never a write to a resource this machine
|        cannot reach. Returns @{ Ok; Lines; Failed; Records; Names }. Read only.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Arm, [Parameter(Mandatory)][System.Collections.IDictionary]$Target, [string]$SqlServerId = '', [string]$KeyVaultId = '',
|          [string]$StorageAccountId = '', [scriptblock]$Resolve,
|          # rule 11b: the container registry's names too (login server + data endpoint), before its first image build
|          [string]$RegistryId = '')
|    $get = { param($id, $api) if ($id) { & $Arm 'GET' ('{0}?api-version={1}' -f $id, $api) $null } else { $null } }
|    $names = @(Get-SIInsideCheckNames -SqlServer (& $get $SqlServerId $script:SIPnSqlApi) -Vault (& $get $KeyVaultId $script:SIPnKvApi) -Storage (& $get $StorageAccountId $script:SIPnStApi) -Registry (& $get $RegistryId $script:SIPnAcrApi))
|    $recs = @(Get-SIPrivateLinkRecords -Arm $Arm -ResourceGroupId ([string]$Target['ResourceGroupId']) | Where-Object { $names -contains $_.Fqdn })
|    $m = Test-SIInsideResolution -Names $names -Resolve $Resolve
|    $lines = New-Object System.Collections.Generic.List[string]
|    $lines.Add($(if ($m.Ok) { 'DNS check (this machine): every name resolves to its private address -- the install goes on' } else { 'DNS check (this machine): NOT every name resolves to its private address yet -- the install waits for the hub DNS records' }))
|    foreach ($l in $m.Lines) { $lines.Add('  ' + $l) }
|    if (-not $m.Ok) {
|        $lines.Add('ADD THESE A RECORDS where your network resolves (your hub''s private DNS zones of these names, or forward them on your resolver):')
|        foreach ($r in $recs) { $lines.Add(('  zone {0,-36} {1,-36} A  {2}   ({3})' -f $r.Zone, $r.Name, $r.Ip, $r.Fqdn)) }
|    }
|    @{ Ok = [bool]$m.Ok; Lines = $lines.ToArray(); Failed = @($m.Failed); Records = $recs; Names = $names }
|}
|
|function Invoke-SIPrivateNetworkEndpoints {
|    <#
|        Setup's call (the guided install, after the database, the web app and the updater, before the first run): the
|        registry to Premium, the private endpoints, their DNS zones (+ links, zone groups), the environment's DNS zone, and
|        the public endpoints of the database server, the storage account and the Key Vault closed. Every change read back.
|        -ClosePublic:$false leaves the public endpoints as they are. Returns @{ Ok; Lines }.
|    #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Target, [Parameter(Mandatory)][string]$Location, [Parameter(Mandatory)][string]$EndpointsSubnetId,
|          [string]$SqlServerId = '', [string]$KeyVaultId = '', [string]$StorageAccountId = '', [string]$RegistryId = '', [string]$EnvironmentId = '',
|          [bool]$ClosePublic = $true,
|          # #866 the inside check before the close: -Resolve (test seam; default the system resolver), -UseInsideJob (a
|          # one-time job in -EnvironmentId when this machine is not inside), -ConfirmedFromInside (the operator's word)
|          [scriptblock]$Resolve, [bool]$UseInsideJob = $true, [switch]$ConfirmedFromInside,
|          [scriptblock]$Arm, [scriptblock]$Sleep, [string]$SubscriptionId)
|    if (-not $Arm) { $Arm = { param([string]$Method, [string]$Path, $Body) if ($Method -eq 'GET') { Invoke-SIArm -Path $Path -AllowNotFound } else { Invoke-SIArm -Method $Method -Path $Path -Body $Body } } }
|    if (-not $Sleep) { $Sleep = { param($s) Start-Sleep -Seconds $s } }
|    $lines = New-Object System.Collections.Generic.List[string]; $ok = $true
|    if ($RegistryId) {
|        $reg = & $Arm 'GET' ('{0}?api-version={1}' -f $RegistryId, $script:SIPnAcrApi) $null
|        $d = Get-SIRegistrySkuDecision -Registry $reg
|        if ($d.Action -eq 'upgrade') { $x = Set-SIRegistrySku -Arm $Arm -RegistryId $RegistryId -Sku 'Premium' -Sleep $Sleep; $lines.Add($x.Line); if (-not $x.Ok) { $ok = $false } }
|    }
|    $handOff = New-Object System.Collections.Generic.List[string]
|    $ep = Set-SIPrivateEndpointsWithDns -Arm $Arm -Target $Target -Location $Location -EndpointsSubnetId $EndpointsSubnetId -SqlServerId $SqlServerId -KeyVaultId $KeyVaultId -StorageAccountId $StorageAccountId -RegistryId $RegistryId -Sleep $Sleep
|    foreach ($x in $ep.Lines) { $lines.Add($x) }; foreach ($x in $ep.HandOff) { $handOff.Add($x) }; if (-not $ep.Ok) { $ok = $false }
|    if ($EnvironmentId) {
|        $env = & $Arm 'GET' ('{0}?api-version={1}' -f $EnvironmentId, $script:SIPnAppApi) $null
|        if (Test-SIEnvironmentPrivate -Environment $env) {
|            $hubLink = Get-SIHubLinkDecision -Arm $Arm -Target $Target
|            if ($hubLink.Line) { $lines.Add($hubLink.Line); if (-not $hubLink.HubVnetId) { $handOff.Add($hubLink.Line) } }
|            # the environment's own zone is ALWAYS in SecurityInsight's resource group (PIM's design) -- never the customer's
|            $ed = Set-SIEnvironmentDns -Arm $Arm -ZoneResourceGroupId $Target['ResourceGroupId'] -Environment $env -VnetId $Target['VnetId'] -HubVnetId $hubLink.HubVnetId -Sleep $Sleep
|            foreach ($x in $ed.Lines) { $lines.Add($x) }; if (-not $ed.Ok) { $ok = $false }
|            foreach ($x in @($ed.HandOff)) { $handOff.Add($x) }
|        } else { $ok = $false; $lines.Add('the Container Apps environment is not in the virtual network -- the web app is not private (an existing install moves with setup\Set-SIPrivateNetworking.ps1)') }
|    }
|    # the public endpoints closed only when every private way in reads back AND (#866) the names resolve to private
|    # addresses from inside -- never a closed resource nothing can reach
|    $closed = $false; $inside = $null
|    $names = @()
|    # #866 (owner: "we will not allow fw option or exceptions"): a private install CREATES its data resources private --
|    # when every one reads closed already, nothing is left to close (its names were checked from this machine before any
|    # write, Invoke-SIPrivateNetworkDnsGate)
|    $openNow = @(foreach ($rid in @($SqlServerId, $StorageAccountId, $KeyVaultId) | Where-Object { $_ }) { $k = Get-SIPublicAccessKind $rid; if (-not (Test-SIPublicAccessClosed -Kind $k -Resource (& $Arm 'GET' ('{0}?api-version={1}' -f $rid, (Get-SIPublicAccessApi $k)) $null))) { $rid } })
|    if ($ClosePublic -and $ok -and -not $openNow.Count) {
|        $lines.Add('the database server, the storage account and the Key Vault were created private: no public endpoint to close')
|        $apps0 = @(Get-SIPnArmList -Arm $Arm -Path ('{0}/providers/Microsoft.App/containerApps?api-version={1}' -f ([string]$Target['ResourceGroupId']).TrimEnd('/'), $script:SIPnAppApi) | ForEach-Object { [string](Get-SIPnProp $_ @('properties', 'configuration', 'ingress', 'fqdn')) } | Where-Object { $_ })
|        $get0 = { param($id, $api) if ($id) { & $Arm 'GET' ('{0}?api-version={1}' -f $id, $api) $null } else { $null } }
|        $names = @(Get-SIInsideCheckNames -AppFqdns $apps0 -SqlServer (& $get0 $SqlServerId $script:SIPnSqlApi) -Vault (& $get0 $KeyVaultId $script:SIPnKvApi) -Storage (& $get0 $StorageAccountId $script:SIPnStApi))
|        return @{ Ok = $ok; Lines = $lines.ToArray(); HandOff = $handOff.ToArray(); Closed = $true; InsideCheck = @{ Ok = $true; Via = 'created-private'; Lines = @(); Failed = @() }; InsideNames = $names }
|    }
|    if ($ClosePublic -and $ok) {
|        $apps = @(Get-SIPnArmList -Arm $Arm -Path ('{0}/providers/Microsoft.App/containerApps?api-version={1}' -f ([string]$Target['ResourceGroupId']).TrimEnd('/'), $script:SIPnAppApi) |
|                  ForEach-Object { [string](Get-SIPnProp $_ @('properties', 'configuration', 'ingress', 'fqdn')) } | Where-Object { $_ })
|        $get = { param($id, $api) if ($id) { & $Arm 'GET' ('{0}?api-version={1}' -f $id, $api) $null } else { $null } }
|        $names = @(Get-SIInsideCheckNames -AppFqdns $apps -SqlServer (& $get $SqlServerId $script:SIPnSqlApi) -Vault (& $get $KeyVaultId $script:SIPnKvApi) -Storage (& $get $StorageAccountId $script:SIPnStApi))
|        $inside = Invoke-SIInsideCheck -Arm $Arm -Names $names -Resolve $Resolve -ResourceGroupId ([string]$Target['ResourceGroupId']) -EnvironmentId $EnvironmentId -UseJob:$UseInsideJob -ConfirmedFromInside:$ConfirmedFromInside -Sleep $Sleep
|        foreach ($x in $inside.Lines) { $lines.Add($x) }
|    }
|    if ($ClosePublic -and $ok -and $inside.Ok) {
|        foreach ($rid in @($SqlServerId, $StorageAccountId, $KeyVaultId) | Where-Object { $_ }) {
|            $c = Set-SIPublicAccess -Arm $Arm -ResourceId $rid -Sleep $Sleep; $lines.Add($c.Line); if (-not $c.Ok) { $ok = $false }
|        }
|        $closed = $ok
|    } elseif ($ClosePublic -and $ok) {
|        $lines.Add('the public endpoints are STILL OPEN: the names do not resolve to private addresses from inside yet -- nothing is closed that nothing could reach. Do the network hand-off, then run again (or confirm it from inside: -ConfirmedFromInside)')
|        # a resource the customer's policy keeps closed already (e.g. a Key Vault with public access denied) is said: it is
|        # reached from inside only, until the hub side is done
|        foreach ($rid in @($SqlServerId, $StorageAccountId, $KeyVaultId) | Where-Object { $_ }) {
|            $k = Get-SIPublicAccessKind $rid
|            if (Test-SIPublicAccessClosed -Kind $k -Resource (& $Arm 'GET' ('{0}?api-version={1}' -f $rid, (Get-SIPublicAccessApi $k)) $null)) {
|                $lines.Add(('{0}: its public endpoint is already closed (your policy) -- it is reached ONLY from inside SecurityInsight''s network until the hub side is done' -f ($rid -split '/')[-1]))
|            }
|        }
|    } elseif ($ClosePublic) { $lines.Add('the public endpoints were NOT closed: a private way in did not read back (run again; nothing is closed before every private endpoint is ready)') }
|    @{ Ok = $ok; Lines = $lines.ToArray(); HandOff = $handOff.ToArray(); Closed = $closed; InsideCheck = $inside; InsideNames = $names }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-PreviousReleaseFiles.locked.json'] = @{ Sha256 = '4e0c3ef6fe5e73096b55c22e211f2ab9f020f104ac0cdd90d9f92c2a9302ec2a'; Text = @'
|{
|  "schema": 1,
|  "_comment": "Files that SecurityInsight 2.2.x releases shipped and this release no longer has, each with the SHA-256 of every shipped version (CRLF read as LF). The first update by the signed channel removes such a file only when it is byte for byte one of these versions (a changed copy is kept) and never a customer file. Generated from the release history; tests/pester/SI-UpdateChannelClient.Tests.ps1 checks it.",
|  "files": {
|    "analyzer-web/.gitignore": [
|      "f22babb138af7c0f9c609743497a19f1c7d338f090bd614e0b53e5a171da9aa4"
|    ],
|    "analyzer-web/deploy/Deploy-SIAnalyzer.ps1": [
|      "2a4a9401e84ed10339bde588c40a1314ed26c3da24f84e97a66a4347b26cca1d",
|      "64bf6fd981165ed2ba68807f5df2ca56b80f7d87c47f5aad623ab1865e68e08b",
|      "399b9f5ba2b93417cb960de21753a95a4d8ece2412991e8c1cc437618b771466",
|      "51c64b0cc79bc848460210841b7e34aac974795938f261d257b95bf99dd78077",
|      "d94c9898e9d5d750b2b13ecaebd5af2be4fd6157e1216a1f6868654b31857baf",
|      "0468f34c5f7481fc7875cf0cf7902a7636171b9b6933d22b05dac012d468ea1d",
|      "0283178e3f69f6974ee0d624847f0af39caca416629e49f839f18978de11cfe2",
|      "7c204b9f85a7a1280f437434653ff34909743f79117c69a9a688abff34ed7e60"
|    ],
|    "analyzer-web/deploy/Dockerfile": [
|      "dfc5e2f18be18ffe162a9dbeedf613e9ab9281c8b003f9564c436e1fadd39cdd",
|      "77b39456105d37b88ced0ee592ffc5815a5049d8c9c8e0954d06076350abd1b6",
|      "2a4621fd3f1c2ac9583b572c344b3fca5395f333fd0d97967fee77b46581631b",
|      "d4102ad269d85520cefec70bb6ce28a7a9ce72e4b2e19a440838e959412cf324"
|    ],
|    "analyzer-web/deploy/Install-SIAnalyzerEnvironment.ps1": [
|      "240db9edf780588e0e18d1249deb1442a05e95cd7d4eab4294aa8e4826cfd3e4",
|      "65e35bcaa0b8de955147f08ce70688c09a6f0e93b6b2463f0f01f826fc41b8b7"
|    ],
|    "analyzer-web/Directory.Build.props": [
|      "f5885da02081cfe5d977f2ee619ea722e2c3b522cd08d4f6c0560e525449e16f",
|      "c7eee6e7c0ebe6fcfea04be77abe2c6b442d64e4e2c9aacc209aa5de7dfae631"
|    ],
|    "analyzer-web/preview/board-deck.html": [
|      "864874f14486fdda124605895a3ac1a9df664d7316222728207c62f04ac48047",
|      "dfde371330523596d1c8a6a65240ba21f385eeb9c8fa3e18ad05aa4d77139943",
|      "4d6fef993b9de84962db6a893f652fb73b3672131d2b92710af79cf5e360ad2e"
|    ],
|    "analyzer-web/preview/exec-dashboard.html": [
|      "ea728113a55649de342cfd6c56f5b2303270eeabb68beade60c41b4b2aa860a9",
|      "24970318faf4d009c3ebf19f2f319f98db44df5c3d0fdd7c1bc958165b74bc33",
|      "4b892a6e5da5da76ef622b5b629ad0e1d28734cf87f77ae52c6eb98a2a556f15",
|      "78260d906b0953b39b513d04b701a4066904622949588e9f7cfc26f7116c72fd",
|      "2ed1a94be481ac2f1fe0ac0587edd413c6184403f9f0ad0ec33dd895c529b6e3",
|      "9bf95b09b68d2b29db87d5bed58217f8ec9009205be7bc3cbf387bcadb7c2f94",
|      "12fa740673b7e68178ea9f03d7ba26eb530196f5179a4d51685c623594a64010",
|      "6dcc852d424001ae92b84935bddcd49621399e990a485c0db4477a19adbbf2a2",
|      "d6fc81a9dd82103425f9deedb61c789f756e8d170603cae7e71bbd5988be4355",
|      "c3f607c9068f8c40c0a7acab7310cfb1045e7b9e1e39b04c9d683eb2eb5a85eb",
|      "0c859f9475a179670fdee010a654a3bb00de9f2fbde85ead1bcf4eb391b087af"
|    ],
|    "analyzer-web/SIAnalyzer.sln": [
|      "fd2b8af5d39c5ae40852d83e93e8bfc9c0c1e7d71f642b786592438242326916"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Ai/GroundedPrompt.cs": [
|      "99fdb2d554407379071a1faa3869b2b8fccfec0e91c1f771f48aeb4990160ecb",
|      "752e830cd337a1c2c70f62e43337473f7949638e864b9b03de8566ab5fa93239"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Analysis/PeriodComparison.cs": [
|      "85c117de93bc1557861ac98b22268fd3c6b2a1a274c3815743820893f92c795a"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Analysis/SnapshotDiff.cs": [
|      "a313ede0de15198b796c0566ffab311521ae2fe9bbef24c3bbd844a78fa8d482"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Configuration/WorkspaceResolver.cs": [
|      "ca6b2fc8e84a659c27f253720b484bc873d759e1150df889349556ebc598f1f3"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/DataAccess/DemoData.cs": [
|      "5971e4694e3ea39657dab72ff24e18b6a9d572e5c0d3fcde3082c977dbd46677"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Exec/AgingAnalysis.cs": [
|      "18c3087966d6514f232d0ecd2b7d0ddabb84a5399a16f0a12032b4b557c29281"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Exec/BusinessImpact.cs": [
|      "0f3a4dc5a4ecafce11b0c3034b15049938b8c228605c947d579ab2e7dd8233ff"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Exec/Drilldown.cs": [
|      "be76f284e459db22f7edfcff2c2ff32a0e1d8c89238854b2cb27e247062c9d7b"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Exec/EmailCadence.cs": [
|      "7ac6783aa6ff7b4d3766930d921de1572215d21ad0615c09dfe9bd6a24c96169"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Exec/ExecDashboard.cs": [
|      "f57f4f44f2ac63048568eb9ab107637bc1dfa8554f4548bb8283de8afa55c4b7"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Exec/ExecEmail.cs": [
|      "42b3404e69372f4b7a3bf5e3283080f9f8b78f98da42b4fb65f016c7ee776607",
|      "f3661521dfcbd20ce0be59a8043f9919e4034a02b8f4262049c9ecf0668031ec"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Exec/ExecHeadline.cs": [
|      "8551d74089fc0859d3095116c3c4a9f4d7b6f99ccc63e953b9033df826501d5f"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Exec/FrameworkLens.cs": [
|      "9775c70b1dc16e9e6e397aa796af74fe794bca14d79ed6d415ee0e8cdfad77b3"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Exec/Glossary.cs": [
|      "29393d867f2d722c6232566a2d7b5ef2799f9f4899f888e9e4752c1b214b61fc"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Exec/MaturityScorecard.cs": [
|      "29dcebde8933fbbf2648558ccc2d400cddf23e00dcba25b7d208c7c4e1a61742"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Exec/OrgCoaching.cs": [
|      "8bb122a2d70efc5c8d7580e68f5ef77e751d0f4343488a45cd3b402d3a67b397"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Exec/RemediationPlan.cs": [
|      "f7e3b1516d86b38c8457ddee3d06635b09476330765e08553e55032a18c7c178"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Exec/RiskConcentration.cs": [
|      "9dd5d9bd93fbe7726b78b40950c82a6f623b64ba1d876f5d9946ef54555736a1"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Exec/TopMovers.cs": [
|      "ec7c6abb3ec6a1ddac078bc079373264e6592c377fd933054010f1737135d24b"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Governance/GovernanceCapabilities.cs": [
|      "38b5fa385a5f84440166185441c20d8309f50654b672a6e162141d5418ee1719"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Governance/GovernanceModel.cs": [
|      "a017bd83cb43ff1498374be632a530344e11f81546a392cf7c0e933651d6caa7",
|      "a8de9387bef022ed89c3aacd0b0cda94b6b2ab862701fa55929e3180b344d7fc"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Governance/GovernanceStore.cs": [
|      "ef2f66593af68c7193972c571a4deacf3688afcf2765d8ad4601b09b3f26a0eb",
|      "01ed26c0bca6d4c102495846c85ebb2e6844595dd761ceda05325f6e65cc5a0f",
|      "7fc4b1c79dfaa0b5b7bdfc3a7e732cd599628f6a643fa8fc6756830beeda8348"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Governance/IGovernancePersistence.cs": [
|      "9bc0614a95928a255b3faaea90271d5b992f29cb6bfe49b54994d1d88b9351e3"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Kql/KqlBuilders.cs": [
|      "7e468b085848aede1d272b5ecf7666fca8f4081c8a817cb681a72c67af441cc4",
|      "9492a3e27af6d38e3bc957b226b66d6452e2f36bf9785ae76e45e6548a94be83"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Kql/KqlGuardrail.cs": [
|      "8d619fea4c27d5ea0863096067ffa2c91d8f8bf1103bc1f201654b42a1814080",
|      "6d52914b6f8b0fc7bedc7201de874f18f3aa10f3a8f3359ae2ab700caac07eb6"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Kql/PrestagedLibrary.cs": [
|      "684bcb645bc727be7ed7589fc2ece37a07086e25dd0ec8a4267799c7bfe1d9ed"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Kql/SiTables.cs": [
|      "dda87983ce0c66bea97e7b2c22419ae1c4eb512eb223f413f2c88a7c8640b50c",
|      "f7bdc2dd22170c6f2d9988189a2d8ebd5db19041ed26503e36e9cf3e1eb05613"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Model/RiskRow.cs": [
|      "5db926e6d5b176aaa71dbbd9c2b17de76e9fd414c3f99925d65d55d0bd4aa811"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Model/RiskRowMapper.cs": [
|      "6b8fbbb1e54902f60589ffed45e324fbaed9fbbc9d082ed379e0ad4140478352"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/Scheduling/ISendMarkerStore.cs": [
|      "802d7fd6772e51aa536efcba119119e79fbf762dcd6d397b3923c08d3bb5d38c"
|    ],
|    "analyzer-web/src/SIAnalyzer.Core/SIAnalyzer.Core.csproj": [
|      "5d1ba025eab01fa2f264c91aa3dc709fd416a2c8f3c60db4c34b4e593919cd0c"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/appsettings.Development.json": [
|      "649f12c9d2fdd68d92406ce59adb29a9cb93da2a9ba4d11ca3f9b3d804c470a6"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/appsettings.json": [
|      "abacadc8d0dc4c8ba80b1bfe6959fae055c1f8f3c8a8814647134a4e3d4b7ef9"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Auth/ClientPrincipal.cs": [
|      "357de48b76fced6fc125487ab99196274e0ee842343f3925e7c138a8ed44534f"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Auth/EasyAuth.cs": [
|      "342674694be9a86a5d28b5bf23e9ae48b2b63cada234d0f1ec97491be54febf7"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Auth/EasyAuthOptions.cs": [
|      "f4c79678f1b1f6f49d36a88452298666ad3ce0c0447c2861fed98799258b3ee4",
|      "d1c74a2b2dba90b319476a35d968f2b93d10e680dec9113088b9902271d4698a"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Mcp/McpServer.cs": [
|      "d551844b23bc3e3cbd0124a4406e8519b861beec826380dd86c4063f8fafbeec",
|      "00b6c8b8aec9bd3fc9d1ede6737aa2d2e92f0ecf80220b9f78b039944fd1cfed"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Pages/Analyst.cshtml": [
|      "56ec2bb4df050bf49532666c1b5a63d324f88affdb1e229adfa2b5b699e0c1dc",
|      "4aa93d12f3db3df5e15e012a77c98cd59e51a9738f5fcf15db67a3f38291f1d8",
|      "9b21d8ecfbcc23449529cacb13a2eb3320f806da92b0953dc627af18c3eec504",
|      "7eba472cbf03aec7cd0fcfa9b5508232aea36ad6836f65fb2e6c34d1fdf6f0a4"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Pages/Analyst.cshtml.cs": [
|      "16c8f4b6f6b18ffc2296ceabc69de215eea459038d0c87d6108f1cc1fc69060a",
|      "1b4e9e40196dd154fd65e5be9be2a36b3acbaa94b1b4415790e61006552c9afe"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Pages/Board.cshtml": [
|      "db42232cd4b8708ae94e2ceacac7468b826311572813a9f47f96ada5436b5d07",
|      "583120879964c63b685edc277806228a0505c3a977a27d41b9ef8f5ee79e3579"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Pages/Board.cshtml.cs": [
|      "a73b7508bc87c6bf4ecd439d9d98a925f2d39845354744f268d19607c9f5b40f"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Pages/Exec.cshtml": [
|      "bc81d0b3c426d0e9262af32c70462e3364b33a446acc4bd53dd22f5a6e4b474a",
|      "4b4c870a7537e84a195181d4694afb20a0be05155f55ca972be76eb408d3d7d0"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Pages/Exec.cshtml.cs": [
|      "3c9ba94fc6dab59efe5938c821aa6255b446e6787efcb50d9111778ae6e35759"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Pages/Governance.cshtml": [
|      "babaa9d9f4608cac2cbd61ad60f4e3a8828fa8e232e915d2b03fdf7de9f9fd39",
|      "4f740d535332126be5c8e782591003099260156dbea5fa31be89ac83465b8172"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Pages/Governance.cshtml.cs": [
|      "f049d55c0bce8924a106d7d9042d2bc5999504560d7c92539c14706f06ddc004"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Program.cs": [
|      "44428e1ffcc1f68ce97a2502453f1a53ad4a300701895f2aa8b80549075f8c8f",
|      "96480acb83c6cff093233cef0179a34553f5507e6fc2f6245bb87e6489e4aa78",
|      "abeafe403ed405eb10510170662e8a061e4bf93e89b11ded809d0dbd242ac916",
|      "380d9906b30bb374bd1292ae41aef29434052beeb56d16d2d9d3992704f1211a",
|      "b26b813bfde059c0b8ce3e167a3e4262e3ab5d61c7fa1c00308dbc09049fd5ca",
|      "7882a20b489c9f5e76f98b7846eaefc2571c6d9915fd2437d4f0b2239768c645",
|      "c3e79bf522b6a9504ffa197cb7b23a2fe5c5879bc5831f2bddcaf217777daf81",
|      "f0c79f9e621db60adaaf0683682b9a2177ee41dba70544c583cc50e732e9dd64"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Rendering/BoardDeckRenderer.cs": [
|      "de556168b90bdd544da7b691e24ee99623e51c726e8ebc1ff3a56e38da0aab2d",
|      "214d0ef21414b4503482d122d02fe68ede43761de0c701fbf76ad299246a208f",
|      "4f8dfad1aec5e9d50427393f6437279cf91f6640c3d33e8ff5016339d16c5914"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Rendering/ExecHtmlRenderer.cs": [
|      "78a9b1a7bdf35ccfc663ecb8d7c8d9be6c6afb063a0ba13a0265710e03db9e6d",
|      "c6c52647a4d1f68a1ae8816766c011c525d1b9a02b68bbcb299b6b8d3a30d763",
|      "cf7b39cb0ed993d4d4f062e44346ce642248d7e22e42bc0c55adde89fbe6b78d"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Rendering/GovernanceRenderer.cs": [
|      "15b8183af96ee40901684b5aa665d2625699c4e89af7a7f970edce021d0fad39",
|      "8acd013796973f297983227af972ee4e09bbe7740d7bc647cbe5a192206300dd",
|      "126611a228b9889a7091b0052c1b1b4c2270d15a023880f2ece14b4c3060e817"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Security/CsrfGuard.cs": [
|      "e2a584fc36c7e9975a4203fbeb70af5505b57c4bb6cb87394dbdf493e36f12fd"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Security/SecurityHeaders.cs": [
|      "d6aabdf3cf37f8a1a4f006e61eac31a889fe3fa6d598c52a30c867cf977e712c"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/AiNarrativeService.cs": [
|      "5cb5252454965eb55caa7f492fd932a10de66a72ac125c67425de7d00a596547",
|      "dcd5125c61a542b00bb4b788c6c228dcb8f68104de7dad1beac5868c4d84f72d"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/AnalyzerService.cs": [
|      "ec91ffacb7cf2d321c19aa137a178c7be86ba35b1d0ff19648a0af9acccd5b12",
|      "134c37111a5be29c7cd75ec0cc71478c31d3d20a0e19d14c76c71f85ec817bb3",
|      "7dc96ebe9484b9b032f84e49924bc80651366a543696007642e94047eb699837"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/CachedRiskDataSource.cs": [
|      "c12895771991a6f0da98a25aae6fd97f58a14d8feab221c5affd709efc72d3d8"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/DemoRiskDataSource.cs": [
|      "dedfb302a9721c53ce6d911b8d4d56f6cae40244060a64f108e15abac965284c",
|      "d51e5d8a0f6ea449d9dc606171d4cd41bfe7b6cd820fc9a19c5524a3bbd80dcf"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/EmailScheduleOptions.cs": [
|      "65b7611cef5a4abd6e0a0caabafc9298ca71eb009289922803be13019dc5ed13"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/ExecEmailSender.cs": [
|      "97cac756c77080cfd550c38a5e8775810be1b6ada84c6d68f9c5dafa6fa847ed"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/ExecEmailService.cs": [
|      "f6caeee1dc97a8eb405fc476c7867154e3a23404e9e71da68f6610e7b4fe6e3e",
|      "a2780c91f688c9dd51545afa238142881b7d58664f8e247576a87c4ebc689cd6"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/GovernanceExpirySweepService.cs": [
|      "951096f5d26b8f57ee2c20b48e5b7b87e6bf0253c276c6b4b28127866c4193ee"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/GovernanceOptions.cs": [
|      "b38774c192d71a25c6a7a6454bd81ff12190fb16ddc71c8de4bb64828a27cd00",
|      "2ab83dd023853986e19fd1b3353b26089092d35754b9059b3811135cad418677"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/IRiskDataSource.cs": [
|      "c54dadc4f91e9a0b5e5cd27683043a180c105630ee18f547e75f07ab39f785a4",
|      "7db53996e6934d3319f072535537b613ca54d2c5b10730f621a8282c8afc7b5d"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/LogAnalyticsRiskDataSource.cs": [
|      "8be55bf9c7e98146bbb02b35099b05010633d1511b4b221b0c762dd4364758cd",
|      "ce03840212de24036053eeca7edc2ccef1220892c6c5ab0b007d3129de8a146e"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/McpOptions.cs": [
|      "f5fbc31539556e76a9ba7504a04841d93ed76e382e4cf950f46c859813e98b29"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/ScheduledExecEmailHostedService.cs": [
|      "7edde1c7a0150a48ea87040a2f5dd92a4f6888bbea1eafe555b6382383edf28c",
|      "79a73618516573504487ddef83232dbebb4a75e3e1b1ba8fb80f1f0af25ef805"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/ScheduleStorageOptions.cs": [
|      "7ec59a30a3d2b0b790c67091cb5bd7f27cdae6f6ed2ca17d226f8d4d4223f30d"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/SIAnalyzerOptions.cs": [
|      "83671ef7657448d8f49d95811e6f1a69d5f2d342a78913ebf586857c33b44d33",
|      "b2633ff715a9bdd30e7b3471e1860666ce52081db83a166c1283ab1862ada72a",
|      "75a27c368b740ed162f25b854c927703046e2da0994e40655e529e09d753c1ec"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/TableGovernancePersistence.cs": [
|      "80939a140def0d6685a8520b621e8741bcd53667efa2964f45a5ee370f41617b"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/Services/TableSendMarkerStore.cs": [
|      "9c5894aa2e9137be7068368a463ee05a44e3a736b743dea5846f11748b8e1fca"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/SIAnalyzer.Web.csproj": [
|      "ebdee4186b748b5ac229df27881f4adfbb9f232f9f36ec14937bd03bd74c17c4",
|      "6b3d74f16ce5a43ec95ff93b7e6b3b96e8cb7414ae7171a0b96abbd712c6c09e"
|    ],
|    "analyzer-web/src/SIAnalyzer.Web/wwwroot/lib/chart.umd.js": [
|      "6e708cb2c2b41604db1f5dec01724856ec53ac867899a1e4e2cfb8f0ace6bed9"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/AiCallBudgetTests.cs": [
|      "53a47b5677859bc8ad732ff7ec3ce740576db7eba3e006941dbd9ece915bb622"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/AnalysisTests.cs": [
|      "cfa0ea56cc0034d2e02796851a064da474fbebeb86de9203d7457bafaf62f22a"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/AuthTests.cs": [
|      "cca9f8859a55bb9d25757878b374a199a3911a7a611fed46f0cbbfbd06b828bc"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/BoardDeckTests.cs": [
|      "053fd77b791f7c82a3dfe68727b82ba50728c6458631a006a9c0db6c11f3a855"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/BusinessImpactAndDrilldownTests.cs": [
|      "133d3aef0b461819b407db46ff0d5c085e28a49210b8473d073dbd2cc54f47d0"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/ConsistencyDefectTests.cs": [
|      "c90c471f2f36f96132ef7f5a7042ad042654a31c488d3f058ca737af08c18521"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/CsrfGuardTests.cs": [
|      "c6cf71ee72302d3c1eb215e8add3d02914db46de79b20db5faabbf85e28c6eb9"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/DefaultDenyAuthTests.cs": [
|      "58b7c440d686442365c4937b53ee1ec4f1295e73b441363199753689cf777826",
|      "fbc01f793b7114ef7721cfc216664183ab6ebc0f81fd359905f7477cbb65ec05"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/ExecEmailTests.cs": [
|      "27665b528aee10903f02da3f7a13e123704bbee60f1deb83631a1c6741a6885c"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/ExecEnhancementsTests.cs": [
|      "6cc13c05c3b3a53f48fa54c8a1f15ee7d247d3c23692e6cc540656669486d711"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/ExecHeadlineTests.cs": [
|      "bafa0b308df540d0cd589a08278cdca9ec44fb923a0b7e0266f16a34b26b164f"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/GlossaryTests.cs": [
|      "1b9abcb50f087227c45c9bd510fc99f603165495706a336d6302bb8d1ce82e68"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/GovernanceDurabilityTests.cs": [
|      "4342424e6456d69c97a5fadcf8947e0fc70af1d2d1baeaf5e798b5732fc2abcd"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/GovernanceTests.cs": [
|      "ae59dd117f19472ed1e2bbe9e10499d16bbee8b64baecdd471189d875048ddfe",
|      "527a291553c1ace810a33fb837a0c74e716d0be0c26a65cdd51e9f793d415999"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/GroundingAndConfigTests.cs": [
|      "0ca1205a2dde4656fc8d7e8751f092f77047036da3e2151d1b17f9a58b17c866"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/GuardrailTests.cs": [
|      "08b48f6c7aa463aeb64321059bc7608f4172d45855c32dd3444ff659eaad3e28",
|      "60be1e177519f4e983fcdddcd06710e4160187d61b0b8adfbb565ba7c37d193a"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/HttpHelpers.cs": [
|      "19e2eb3298852fc348d3a3244a36de5f2376cca4f181e2d0f91cc7cf6cfc1f4c",
|      "224556746fdb64f54f1a6bc7894bacef45585bb397a9dd8c6afc0f01e1eb85b1"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/KqlSourceWhitelistTests.cs": [
|      "5f1353a160ab8ebdaca18ef9830932fe2cdf99b9332bd86e55b0f3d66e570a0e"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/MaturityScorecardTests.cs": [
|      "226807bf88e3c7cb84397ae422752355debc920c90fb46a7f0e46c7808d1b950"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/McpSideEffectTests.cs": [
|      "59bda845ba2f287d073cc75aeef4ebe441bd6401c4af12994c2a279142fac16a"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/McpTests.cs": [
|      "e49bfdae106476f413d489b69fbfeb135c61eabe6902f9a272520e01c0ee3a58",
|      "fc245e38629574c98c82fb3f5abc2311f133550ee2278d1947c54ecc6f085e37"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/OrgCoachingTests.cs": [
|      "b35d57092f39c7ab8ccf92a0c412341d879279044112035d396192348a23c3a1"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/PartialDataAndCacheTests.cs": [
|      "55ef8b209ab649865fc5cb1efea7e36538b19f15e567e74c407e48b8f887de44"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/PeriodAndConcentrationTests.cs": [
|      "d71522828b638617837bd50f7999cac319b9d1b11beb9f290b0446d9c3a54048"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/RealSchemaTests.cs": [
|      "6aa8b057ba871f012d0e52ae5acfafbc716818ee2c4961e3ca773c034202eb20"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/RemediationPlanTests.cs": [
|      "d5a18f500cd8664e8039fdd705453aa5eba32d5ded07323319c52f627bd0faea"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/ScheduledSendMarkerTests.cs": [
|      "3bd5b3fbc9eab345026c76f4245eef33a0668689218da64327bf921ee9c1e6a2"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/SecurityHeadersTests.cs": [
|      "ebe7fcab80043f146f439af6d018a7b7e45481a891979a481af2a29d69a5126f"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/SIAnalyzer.Tests.csproj": [
|      "115c810af58ad0d47e3c907c1a29a3399a51c059dce98645f1f9a68b28aaf599"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/TestData.cs": [
|      "bc057b500e72b1228f84d643b1f2d35304a9bf99c6f2687e3904e203fa391df7"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/TopMoversTests.cs": [
|      "e97cfaeca40cc0dd05da0a0b228325f1e40de973884495694e058b1a9c601e49"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/UiThemeTests.cs": [
|      "45d199e743edeadc07c0a390758896af16a42bb7a53289c76b0f0c38f23a0291"
|    ],
|    "analyzer-web/tests/SIAnalyzer.Tests/WebIntegrationTests.cs": [
|      "32bbb122a079a253061cf615bee60c2df5e0576ffe1428dc5e4c1d180c74a18d",
|      "fc74a59d079e1028421c96aa92c019b14d6e606facea4f0aa6b7e71abb03133f"
|    ],
|    "analyzer-web/tools/SIAnalyzer.Preview/Program.cs": [
|      "2681afd53239ef945bcd5476f10678360f0defce59aa86e35d58082940ab5553"
|    ],
|    "analyzer-web/tools/SIAnalyzer.Preview/SIAnalyzer.Preview.csproj": [
|      "47d3b926942aa44949e206dd0b70b48483241952f7158baa4d9ebdac856d6870"
|    ],
|    "analyzer/seed/demo-snapshot.json": [
|      "c6e74a9987acf3a0e7525d05acc7fc3e67dab25d6561db8b448e42cd63ad18d2",
|      "5b55c21982ab4456cbc8392b414556c811563f3a97327edad40b3ea5db999e1e"
|    ],
|    "container/Sync-ContainerModules.ps1": [
|      "72bb1335f02c31c58561fec0f812dc10492675dbbb84d6de1f1ac56723633ea0"
|    ],
|    "engine/asset-tagging/_shared/Ensure-Module.ps1": [
|      "95ea51f9f6db26d5225d76fd9b789813bef86d0a69b14865fe93130a8479b229",
|      "ed7bb5dd9d9605d60a5a5bc720353b5412cea75c507ae220e82726d52bf81b36",
|      "360e5f38f45546bb1af0d5f9affae5da6bcb263de4c8f411df5d8a397318f8b6",
|      "3e8b313c051f6a914402010811a9eafc5e90916bfc21d60c192e75a95c6ebf20",
|      "a797af4c4bff9e5670f1e00913652771a8650c110464f5bf8eefb936e628b2c6",
|      "3c4c184711cdad367f538fee97120735aa48dd137d964531331373f0a7c162e6",
|      "1d2024b6d56a841e754cdcaae8c9571f46786068f8bd552d63eb23f7b7c1aac1",
|      "39e635566490b0eebf866a68562797fb8c944a74fdc20f11cdcde4c1df761719",
|      "84e29b42046d8fc29139f6e367db32167933e826d9d2e57b391aa8e15efcc216"
|    ],
|    "engine/privilege-tier-classifier/_shared/Ensure-Module.ps1": [
|      "95ea51f9f6db26d5225d76fd9b789813bef86d0a69b14865fe93130a8479b229",
|      "ed7bb5dd9d9605d60a5a5bc720353b5412cea75c507ae220e82726d52bf81b36",
|      "360e5f38f45546bb1af0d5f9affae5da6bcb263de4c8f411df5d8a397318f8b6",
|      "3e8b313c051f6a914402010811a9eafc5e90916bfc21d60c192e75a95c6ebf20",
|      "a797af4c4bff9e5670f1e00913652771a8650c110464f5bf8eefb936e628b2c6",
|      "3c4c184711cdad367f538fee97120735aa48dd137d964531331373f0a7c162e6",
|      "1d2024b6d56a841e754cdcaae8c9571f46786068f8bd552d63eb23f7b7c1aac1",
|      "39e635566490b0eebf866a68562797fb8c944a74fdc20f11cdcde4c1df761719",
|      "84e29b42046d8fc29139f6e367db32167933e826d9d2e57b391aa8e15efcc216"
|    ],
|    "engine/risk-analysis/_shared/Ensure-Module.ps1": [
|      "95ea51f9f6db26d5225d76fd9b789813bef86d0a69b14865fe93130a8479b229",
|      "ed7bb5dd9d9605d60a5a5bc720353b5412cea75c507ae220e82726d52bf81b36",
|      "360e5f38f45546bb1af0d5f9affae5da6bcb263de4c8f411df5d8a397318f8b6",
|      "3e8b313c051f6a914402010811a9eafc5e90916bfc21d60c192e75a95c6ebf20",
|      "a797af4c4bff9e5670f1e00913652771a8650c110464f5bf8eefb936e628b2c6",
|      "3c4c184711cdad367f538fee97120735aa48dd137d964531331373f0a7c162e6",
|      "1d2024b6d56a841e754cdcaae8c9571f46786068f8bd552d63eb23f7b7c1aac1",
|      "39e635566490b0eebf866a68562797fb8c944a74fdc20f11cdcde4c1df761719",
|      "84e29b42046d8fc29139f6e367db32167933e826d9d2e57b391aa8e15efcc216"
|    ],
|    "preview/PowerBI/measures.dax": [
|      "ec76cccd361bc39a8d554e3ba88cc902f6e04dcc9bfe8c3f51bb225cbe8564cd"
|    ],
|    "preview/PowerBI/queries/01-RiskAnalysis-Summary-LatestRun.kql": [
|      "49a25b919a2b1e3ec45d1036cb2f00196a922a0c61fe78e039fbb82f6597835e"
|    ],
|    "preview/PowerBI/queries/02-RiskAnalysis-Summary-Trend.kql": [
|      "f411b8eebbcd0650f981030bc4035559ec11334583cca590a6680bb98c122b78"
|    ],
|    "preview/PowerBI/queries/03-RiskAnalysis-NewVsResolved-PerRun.kql": [
|      "a5696472990ffa126138bdac11d7038b689f2a3cdefef5d1dce1993eb92e537f"
|    ],
|    "preview/PowerBI/queries/04-RiskAnalysis-TopN-CurrentRun.kql": [
|      "3ec3cd60e0082014fc50fef2e54fca5dfcebcf2ecdd8f15f1831dbccb0f7668c"
|    ],
|    "preview/PowerBI/queries/05-RiskAnalysis-StaleFindings.kql": [
|      "8faae797897825a1c3672e13540a9eeb7ea246bfcf6c64437b7b793bf502fd8b"
|    ],
|    "preview/PowerBI/queries/06-RiskAnalysis-RiskScoreTrend-Aggregated.kql": [
|      "912de27368133ae3c4d320c8cbca5fb818d85612288f475a2ced31683b80bad1"
|    ],
|    "preview/PowerBI/queries/07-RiskAnalysis-BySecurityDomain-Trend.kql": [
|      "355b8a21885df5b8316a6aaca8ba16e904fc2b78550eb89cac9904f9fe662d15"
|    ],
|    "preview/PowerBI/queries/08-IdentityAssets-LatestCollection.kql": [
|      "dd8cb09b05d6baee1fa8c652c3c9e78419ace1188caa806a66b0efac7c38adb0"
|    ],
|    "setup/_shared/Ensure-Module.ps1": [
|      "84e29b42046d8fc29139f6e367db32167933e826d9d2e57b391aa8e15efcc216"
|    ],
|    "setup/_shared/Ensure-SecurityInsightInfra.ps1": [
|      "c2b5dce0f9b8362291fabdddd125920e2cd865ff687dfc23b4a09cc4e3685e9e"
|    ],
|    "setup/_shared/Send-SecurityInsightExportFile.ps1": [
|      "76422d4220935692eb40954c39d3ccf7e192d843741795510b07dd98f265788b"
|    ],
|    "setup/Deploy-SIPowerBI.ps1": [
|      "fc808f2c33e21f42c855ee6983dccf989ce27dc27186407d847139b2220fe5cd"
|    ],
|    "tests/pester/SIA-Container.Tests.ps1": [
|      "c420c3c49cf91a9a1d4d32764635a0ca1d17d94d475ca1297f66cb1a03379476"
|    ],
|    "tests/pester/SIA-InstallEnvironment.Tests.ps1": [
|      "7f3568515e8b7871554ebfa59d7e12227a7203fb2e3fecd6eb4d38d5cec1827c"
|    ],
|    "viewer/README.md": [
|      "2942170b412bd3040f281d55d044774bbf452c99c6f2eb6fd40a9d8a4dd102f8",
|      "ab3096b3c3fcac3dd0e5f38d0dae9aabc7390140a8288d152e45880bc2aee740"
|    ],
|    "viewer/Start-SIViewer.ps1": [
|      "a80d05662ca0c99338ca7b58c00dc32692c9f8652e61cc7f082f3c290a107ee6"
|    ],
|    "viewer/web/index.html": [
|      "d6892ca426519e2bd9f76b532f7ae58d89b8d7bdfc4dbb719aa82575c457c6b2",
|      "345546fed5ada53c0108c6b836fa1b59dc8315a58b456d344c4f1b6dc66deeae",
|      "d9b230343638dd819655736b8911b3ce8e34f158a24bde80a18c9d9e66037528"
|    ]
|  }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-OpenAIPrivate.ps1'] = @{ Sha256 = 'e2ec3faa8b0c91b803bef46c77a80287f90eb6194c009491df7dffc7ccd59261'; Text = @'
|#Requires -Version 5.1
|<#
|    #1102 (framework rules 11 / 11f): the OPTIONAL Azure OpenAI account of a PRIVATE install follows rule 11 -- it would need
|    a private endpoint, so setup\Validate-SIOpenAI.ps1 never creates one with public access, and never switches one to it.
|    Only logs / the data collection endpoint may stay public (rule 11f).
|
|      Test-SIOpenAIInstallPrivate   is the install private? Its private-network answer (-PrivateNetwork), else its SecurityInsight
|                                    database server (sql-si-*) in the install's resource group reads public network access off
|                                    (Test-SISqlServerPrivate, setup\_shared\SI-SetupArm.ps1). A read that fails THROWS -- the
|                                    script then creates nothing.
|      Get-SIOpenAIPrivatePlan       PURE. What the script does with the account: proceed (public install, unchanged), refuse
|                                    (private, no account: nothing is created, AI features stay off), report (private, an
|                                    existing account reads public Enabled: said, never changed), reuse (private, an existing
|                                    account already closed).
|    Dot-source AFTER setup\_shared\SI-SetupAzure.ps1 and SI-SetupArm.ps1. No modules.
|#>
|
|$script:SIOpenAIPrivateRefusal = 'this install is private: an Azure OpenAI account would need a private endpoint (framework rule 11) -- not created; AI features stay off'
|
|function Test-SIOpenAIInstallPrivate {
|    <# @{ Private; Why }. -PrivateNetwork (the install's answer) decides at once; otherwise every SecurityInsight database
|       server in -ResourceGroupName is read (ARM GET). No resource group / no server = not private (a public or a new
|       install). Any other failure THROWS. #>
|    param([bool]$PrivateNetwork, [Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroupName)
|    if ($PrivateNetwork) { return [pscustomobject]@{ Private = $true; Why = 'the install''s private-network answer' } }
|    $list = Invoke-SIArm -Path ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Sql/servers' -f $SubscriptionId, $ResourceGroupName) -ApiVersion '2021-11-01' -AllowNotFound
|    $names = @(@(if ($list) { $list.value }) | Where-Object { $_ -and [string]$_.name -like 'sql-si-*' } | ForEach-Object { [string]$_.name })
|    foreach ($n in $names) {
|        if (Test-SISqlServerPrivate -ResourceGroupName $ResourceGroupName -ServerName $n -SubscriptionId $SubscriptionId) {
|            return [pscustomobject]@{ Private = $true; Why = ('its database server {0} has public network access off' -f $n) }
|        }
|    }
|    [pscustomobject]@{ Private = $false; Why = '' }
|}
|
|function Get-SIOpenAIPrivatePlan {
|    <# PURE. -Account = the account as ARM returns it ($null = not there). @{ Action = proceed | refuse | report | reuse; Line }.
|       Nothing here ever writes the account: an existing one is only read. #>
|    param([bool]$Private, $Account, [string]$AccountName)
|    if (-not $Private) { return [pscustomobject]@{ Action = 'proceed'; Line = '' } }
|    if (-not $Account) { return [pscustomobject]@{ Action = 'refuse'; Line = $script:SIOpenAIPrivateRefusal } }
|    $pna = ''
|    if ($Account.PSObject.Properties['properties'] -and $Account.properties -and $Account.properties.PSObject.Properties['publicNetworkAccess']) { $pna = [string]$Account.properties.publicNetworkAccess }
|    if ($pna -eq '' -or $pna -ieq 'Enabled') {
|        return [pscustomobject]@{ Action = 'report'; Line = ('this install is private: the existing Azure OpenAI account {0} reads public network access Enabled -- reported, not changed (framework rule 11: it needs a private endpoint, a customer step)' -f $AccountName) }
|    }
|    [pscustomobject]@{ Action = 'reuse'; Line = ('this install is private: the existing Azure OpenAI account {0} has public network access {1} -- reused as it is' -f $AccountName, $pna) }
|}
'@ }

# ---- the runner (release/Build-SISupportScripts.ps1) ----------------------------------------------------------------
$__siSupportDir = [IO.Path]::Combine([IO.Path]::GetTempPath(), ('securityinsight-support-' + [guid]::NewGuid().ToString('N').Substring(0, 12)))
$__siSupportWritten = New-Object System.Collections.Generic.List[string]
$__siSupportSha = [System.Security.Cryptography.SHA256]::Create()
try {
    foreach ($__k in @($__siSupportFiles.Keys)) {
        $__lines = ($__siSupportFiles[$__k].Text -replace "`r", '') -split "`n"
        $__body = (@($__lines | ForEach-Object { if ($_.StartsWith('|')) { $_.Substring(1) } else { $_ } }) -join "`r`n") + "`r`n"
        $__hash = -join ($__siSupportSha.ComputeHash((New-Object System.Text.UTF8Encoding($false)).GetBytes($__body)) | ForEach-Object { $_.ToString('x2') })
        if ($__hash -ne $__siSupportFiles[$__k].Sha256) { throw "SecurityInsight standalone script: the embedded file '$__k' is damaged (SHA-256 mismatch) -- download the script again." }
        $__p = [IO.Path]::Combine($__siSupportDir, ($__k -replace '/', [string][IO.Path]::DirectorySeparatorChar))
        $__d = [IO.Path]::GetDirectoryName($__p)
        if (-not [IO.Directory]::Exists($__d)) { [void][IO.Directory]::CreateDirectory($__d) }
        [IO.File]::WriteAllText($__p, $__body, (New-Object System.Text.UTF8Encoding($__k -match '\.ps[dm]?1$')))
        $__siSupportWritten.Add($__p)
    }
    $__target = [IO.Path]::Combine($__siSupportDir, ($__siSupportEntry -replace '/', [string][IO.Path]::DirectorySeparatorChar))
    if ($env:SI_SUPPORT_SELFTEST -eq '1') {
        # the support pipeline's own check: every file extracted and verified, the entry script's parameters readable
        $__cmd = Get-Command -Name $__target -ErrorAction Stop
        [pscustomobject]@{ SISupportSelfTest = 'ok'; Version = $__siSupportVersion; Entry = $__siSupportEntry; Files = $__siSupportWritten.Count; Parameters = @($__cmd.Parameters.Keys) }
        return
    }
    $global:LASTEXITCODE = 0
    & $__target @PSBoundParameters
    $__exit = $LASTEXITCODE
} finally {
    $__siSupportSha.Dispose()
    foreach ($__p in $__siSupportWritten) { try { [IO.File]::Delete($__p) } catch { } }
    if ([IO.Directory]::Exists($__siSupportDir)) {
        $__left = @([IO.Directory]::GetFiles($__siSupportDir, '*', [IO.SearchOption]::AllDirectories))
        if ($__left.Count) { Write-Host ("SecurityInsight: the script left {0} file(s) (logs or output) in {1}" -f $__left.Count, $__siSupportDir) }
        else { try { [IO.Directory]::Delete($__siSupportDir, $true) } catch { } }
    }
}
if ($__exit) { exit $__exit }